From nobody Tue May 1 15:51:36 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CAEB12EA67; Tue, 1 May 2018 15:51:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.79.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152521509513.10954.4372893261949043403@ietfa.amsl.com> Date: Tue, 01 May 2018 15:51:35 -0700 Archived-At: Subject: [Id-event] I-D Action: draft-ietf-secevent-token-10.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 May 2018 22:51:35 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Events WG of the IETF. Title : Security Event Token (SET) Authors : Phil Hunt Michael B. Jones William Denniss Morteza Ansari Filename : draft-ietf-secevent-token-10.txt Pages : 30 Date : 2018-05-01 Abstract: This specification defines the Security Event Token (SET) data structure. A SET describes statements of fact from the perspective of an issuer about a subject. These statements of fact represent an event that occurred directly to or about a security subject, for example, a statement about the issuance or revocation of a token on behalf of a subject. This specification is intended to enable representing security- and identity-related events. A SET is a JSON Web Token (JWT), which can be optionally signed and/or encrypted. SETs can be distributed via protocols such as HTTP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-secevent-token-10 https://datatracker.ietf.org/doc/html/draft-ietf-secevent-token-10 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-token-10 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue May 1 15:57:46 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A42EE127201 for ; Tue, 1 May 2018 15:57:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BrEZuJv3elCc for ; Tue, 1 May 2018 15:57:41 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0125.outbound.protection.outlook.com [104.47.36.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6791E127078 for ; Tue, 1 May 2018 15:57:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=pjQx9t30hUAKYpVsIm1rfrGjfB+VTRjQGgHDo10lxq8=; b=VQJrzRcGiNYZpa8Z8HXETL8nMFWf0ve5nwBXRMX6UzkynCRcd+3VRzwBWNqGp623ZFfyc6OUhTPfTRke+lKKphCy6vAtxO6s7u8rZ/G2hdo4v/okQZp77bZynIEZTvEb+6wu3CTAr2QNgw3iV41UHo2oz3Xlh50TAZ4zhqixFTs= Received: from DM5PR00MB0293.namprd00.prod.outlook.com (2603:10b6:4:9e::34) by DM5PR00MB0294.namprd00.prod.outlook.com (2603:10b6:4:9e::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.771.0; Tue, 1 May 2018 22:57:38 +0000 Received: from DM5PR00MB0293.namprd00.prod.outlook.com ([fe80::143d:17c6:2a98:bbf2]) by DM5PR00MB0293.namprd00.prod.outlook.com ([fe80::143d:17c6:2a98:bbf2%3]) with mapi id 15.20.0771.000; Tue, 1 May 2018 22:57:38 +0000 From: Mike Jones To: "id-event@ietf.org" Thread-Topic: Security Event Token (SET) spec addressing additional SecDir review comments Thread-Index: AdPhnY6tcn2PCWNwSQeDLi0V40Ep2A== Date: Tue, 1 May 2018 22:57:38 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-05-01T22:57:37.7256387Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:e::36] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR00MB0294; 7:XgAxwnWtj+FLCTDA9+KsU8lvZDrbdFCQLIB5leYjGBY/k5q/qxXmwj2E6EajC76zUJ4Ba/mAOSGckuWbko7mSSGy/s/5adUliGDSSDSuINrtld0aPZTuAhnPxJimfhDY3pafTxrjtwqlFW/c7cJS0khpe1+733IioHaTdAFTsHfUVamD6PPYsiUMwWB28ja3uLURoWCmrkAiyXj9h1Bb4iESFnWv4vApfPVyAKqdEhZ/ccoDghh04FlwbZkyu6fn; 20:MhCUMNlgfpVpgPnV/HSyaPjvv1c192V/IW10qdRjLswCCRDJffSI9asgSfw/D2V2WE0NE/ZFTxrToYCbttGl8f0BUPEmTNZn9mT5A7m9o7tknS/DrAxEGBZfC0GgqZa0w/8JJYbgBCH6GkzGAkApWN0NTJ6/CGicdfATCNmHbCc= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(48565401081)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7193020); SRVR:DM5PR00MB0294; x-ms-traffictypediagnostic: DM5PR00MB0294: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(192374486261705)(31418570063057)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(2017102700009)(2017102701064)(6040522)(2401047)(5005006)(8121501046)(2017102702064)(20171027021009)(20171027022009)(20171027023009)(20171027024009)(20171027025009)(20171027026009)(2017102703076)(3002001)(10201501046)(3231254)(2018427008)(944501410)(52105095)(93006095)(93001095)(6055026)(6041310)(20161123564045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:DM5PR00MB0294; BCL:0; PCL:0; RULEID:; SRVR:DM5PR00MB0294; x-forefront-prvs: 06592CCE58 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(39860400002)(366004)(346002)(376002)(39380400002)(209900001)(189003)(199004)(7696005)(2900100001)(54896002)(6306002)(9686003)(6916009)(25786009)(486006)(7736002)(186003)(59450400001)(106356001)(105586002)(52396003)(6346003)(99286004)(236005)(86362001)(46003)(55016002)(53376002)(21615005)(5250100002)(86612001)(966005)(476003)(68736007)(53936002)(22452003)(316002)(478600001)(72206003)(2501003)(10290500003)(6506007)(5630700001)(790700001)(6116002)(33656002)(2351001)(10090500001)(6436002)(5640700003)(8936002)(14454004)(606006)(8990500004)(15650500001)(2420400007)(3280700002)(3660700001)(7110500001)(2906002)(97736004)(74316002)(5660300001)(102836004)(8676002)(81156014)(81166006)(6606295002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR00MB0294; H:DM5PR00MB0293.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-microsoft-antispam-message-info: +/eHmBn99tStZi5HqybJjy2LK1cC+0z1VokJC0Pq6hsbc/Di1j/HEKeDNH0HU959nY/d4AcmgnOZOn0s7b9xCOEEultYwMtOfC2FwpfHavxFkIH9vjsfI3ZVaVpLRY+ju3d7DB+akjg9v93BQMpoCReioHj7XQsdbOUvKZ9tH5TPuXMSmt/t/FH9oWv9c6pb spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR00MB0293F3B9ACDB9EDE9C303680F5810DM5PR00MB0293namp_" MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 97fc8009-13e3-4c90-f3a6-08d5afb6f011 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 97fc8009-13e3-4c90-f3a6-08d5afb6f011 X-MS-Exchange-CrossTenant-originalarrivaltime: 01 May 2018 22:57:38.8299 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR00MB0294 Archived-At: Subject: [Id-event] Security Event Token (SET) spec addressing additional SecDir review comments X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 May 2018 22:57:45 -0000 --_000_DM5PR00MB0293F3B9ACDB9EDE9C303680F5810DM5PR00MB0293namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable An updated Security Event Token (SET) specification has published to addres= s recent review comments received. Changes were: * Incorporated wording improvements resulting from Russ Housley's addit= ional SecDir comments. * Registered +jwt structured syntax suffix. The specification is available at: * https://tools.ietf.org/html/draft-ietf-secevent-token-10 An HTML-formatted version is also available at: * http://self-issued.info/docs/draft-ietf-secevent-token-10.html -- Mike P.S. This announcement was also posted at http://self-issued.info/?p=3D182= 9 and as @selfissued. --_000_DM5PR00MB0293F3B9ACDB9EDE9C303680F5810DM5PR00MB0293namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

An updated Security Event Token (SET) specification = has published to address recent review comments received.  Changes wer= e:

  • Incorporated word= ing improvements resulting from Russ Housley's additional SecDir comments.<= o:p>
  • Re= gistered +jwt structured syntax suffix.

 

The specification is available at:

 

An HTML-formatted version is also available at:=

 

        &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;     -- Mike

 

P.S.  This announcement was also posted at http://self-issued.info/?p=3D1829 and as @selfissued.

 

--_000_DM5PR00MB0293F3B9ACDB9EDE9C303680F5810DM5PR00MB0293namp_-- From nobody Tue May 1 16:00:27 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 133EF127137; Tue, 1 May 2018 16:00:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.008 X-Spam-Level: X-Spam-Status: No, score=-2.008 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FOM3lV3bMMXU; Tue, 1 May 2018 16:00:20 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on070b.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe48::70b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2383127201; Tue, 1 May 2018 16:00:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=z+MFboR+3m5hZcgSbc4r56Q87bkZmXZMo1e0bCvuQmQ=; b=iLBZ4uYU9N+BEgQ2vfndusFTh8Ejb1uL48wO7qxv+vctJ2GMwULJRTiT00zXN9Yhrv2mtX3EtMcx5Km+3kxC/a7bjvXDHf0H6Abf4Rd465Ngs/zega0vfx6H+IC1VQH3Y281YbovfxNu7KRyJguC/uNFiAStob557B05oynlKVM= Received: from DM5PR00MB0293.namprd00.prod.outlook.com (2603:10b6:4:9e::34) by DM5PR00MB0326.namprd00.prod.outlook.com (2603:10b6:4:9f::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.766.0; Tue, 1 May 2018 23:00:16 +0000 Received: from DM5PR00MB0293.namprd00.prod.outlook.com ([fe80::143d:17c6:2a98:bbf2]) by DM5PR00MB0293.namprd00.prod.outlook.com ([fe80::143d:17c6:2a98:bbf2%3]) with mapi id 15.20.0771.000; Tue, 1 May 2018 23:00:16 +0000 From: Mike Jones To: Russ Housley CC: Phil Hunt , "draft-ietf-secevent-token.all@ietf.org" , "ietf@ietf.org" , ID Events Mailing List , "secdir@ietf.org" Thread-Topic: [Id-event] Secdir last call review of draft-ietf-secevent-token-09 Thread-Index: AQHT2NHtvc95Fiwi1UCrOyZVUllp6qQQeq+AgAfjstCAAy+xgA== Date: Tue, 1 May 2018 23:00:16 +0000 Message-ID: References: <152424742315.3484.7625515486296411114@ietfa.amsl.com> <2F2D2F99-8116-40EE-8245-D7C5F8793BC0@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-05-01T23:00:11.9121632Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:e::36] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR00MB0326; 7:YsKObRodgxwN04FZDCXtsd1MwYeNTSXSBPbtTQ+VlVr7Fl6LjjEBTevyLMlkJXKqAZCHTh4b+CtMdmL8IBZ/QAiTaNMVXyenH1EMZIpg2FFxDMzkz0DKNdvBCM2DajRRJq9G8FS9cRim1HZq/lexR0aEsbJiyY6Z25SUiZGjSNcZwwQGbMpcvFTwBc/eQ1iMkP5/xMJhyJaaglO6q6Cac4+83AeZzSJwRA/L/syEtcB0E2uoJN+1NR8KOPwxpACB; 20:LrOky16nnxuoh2kFXXAHbjEA7RfkYMClJiMZPyZhzQLg8sifDX9AeadNlZ8ZP+V0Vy97kRUYS+gAG+icGJpvSGRbdYYk+hWlZZwMGhmfUdvCjne51WXbYXPPs8KU3YtZQqD0sMdrggMTtsUCmipmJkLqSEdR4cP7q1zqCt3Gi0Q= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(48565401081)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7193020); SRVR:DM5PR00MB0326; x-ms-traffictypediagnostic: DM5PR00MB0326: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(10436049006162)(89211679590171)(192374486261705)(21748063052155)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(2017102700009)(2017102701064)(6040522)(2401047)(5005006)(8121501046)(2017102702064)(20171027021009)(20171027022009)(20171027023009)(20171027024009)(20171027025009)(20171027026009)(2017102703076)(10201501046)(3002001)(93006095)(93001095)(3231254)(2018427008)(944501410)(52105095)(6055026)(6041310)(20161123558120)(20161123562045)(20161123564045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011); SRVR:DM5PR00MB0326; BCL:0; PCL:0; RULEID:; SRVR:DM5PR00MB0326; x-forefront-prvs: 06592CCE58 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(39380400002)(376002)(346002)(396003)(366004)(377424004)(189003)(199004)(8990500004)(46003)(53546011)(22452003)(106356001)(25786009)(9326002)(105586002)(52396003)(236005)(10090500001)(8676002)(53936002)(76176011)(10290500003)(316002)(14454004)(8936002)(7696005)(81156014)(59450400001)(81166006)(6116002)(4326008)(54906003)(5660300001)(790700001)(6506007)(606006)(33656002)(6436002)(186003)(486006)(74316002)(3660700001)(229853002)(5890100001)(1680700002)(575784001)(19609705001)(5250100002)(97736004)(6306002)(53386004)(86362001)(476003)(68736007)(11346002)(478600001)(2900100001)(446003)(72206003)(54896002)(6916009)(6246003)(7736002)(86612001)(3280700002)(102836004)(9686003)(99286004)(55016002)(2906002)(966005); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR00MB0326; H:DM5PR00MB0293.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: u6wf2xq5W0veQQVDrL+wHdeUrDisego5yRsd3EozdviDzRnRjHFTe5nDiZ7qOGgO/auE9rdA01njLHma4yEDnrsg9jkKGdo7M33w86uP4F9H9i2bnW0XzAfleG2dP58oNTkXSn0/z81mLpKBV7fShwVd2rgBkLMlVZzW6JZi1Kggr14faRxaPFQ0/OyyLlrb spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR00MB029324695FEA6EF07878D6E4F5810DM5PR00MB0293namp_" MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 4bc72181-29f1-48fa-defd-08d5afb74e3a X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4bc72181-29f1-48fa-defd-08d5afb74e3a X-MS-Exchange-CrossTenant-originalarrivaltime: 01 May 2018 23:00:16.7348 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR00MB0326 Archived-At: Subject: Re: [Id-event] Secdir last call review of draft-ietf-secevent-token-09 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 May 2018 23:00:25 -0000 --_000_DM5PR00MB029324695FEA6EF07878D6E4F5810DM5PR00MB0293namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgUnVzcywNCg0KTm90IGhhdmluZyBoZWFyZCBiYWNrIGZyb20geW91IGZvciBhIHdlZWssIHRo ZSBlZGl0b3JzIGRlY2lkZWQgdG8gcHVibGlzaCBhbiB1cGRhdGVkIGRyYWZ0IGh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTEwIHRoYXQgYWRkcmVz c2VzIHlvdXIgYWRkaXRpb25hbCBTZWNEaXIgcmV2aWV3IGNvbW1lbnRzIGluIHRoZSBtYW5uZXIg cHJvcG9zZWQgbGFzdCB3ZWVrLiAgSW4gcGFydGljdWxhciwgdGhlIHJldmlzZWQgdGV4dCBtYWtl cyBpdCBjbGVhcmVyIHdoYXQgcmVxdWlyZW1lbnRzIHRoaXMgc3BlY2lmaWNhdGlvbiBpcyBpbXBv c2luZyBvbiBwcm9maWxpbmcgc3BlY2lmaWNhdGlvbnMuICBJIGhvcGUgdGhlIG5ldyB0ZXh0IHdv cmtzIGZvciB5b3UuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBCZXN0IHdpc2hlcywNCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZy b206IE1pa2UgSm9uZXMNClNlbnQ6IFN1bmRheSwgQXByaWwgMjksIDIwMTggMzoyMCBQTQ0KVG86 IFJ1c3MgSG91c2xleSA8aG91c2xleUB2aWdpbHNlYy5jb20+DQpDYzogUGhpbCBIdW50IDxwaGls Lmh1bnRAb3JhY2xlLmNvbT47IGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4uYWxsQGlldGYub3Jn OyBpZXRmQGlldGYub3JnOyBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9y Zz47IHNlY2RpckBpZXRmLm9yZw0KU3ViamVjdDogUkU6IFtJZC1ldmVudF0gU2VjZGlyIGxhc3Qg Y2FsbCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0wOQ0KDQpIaSBSdXNzLA0K DQpJIHdhbnRlZCB0byBjaGVjayBiYWNrIGluLiAgQXJlIHlvdSBnb29kIHdpdGggdGhlc2UgY2hh bmdlcyB0byBhZGRyZXNzIHlvdXIgY29tbWVudCBvciBkbyB3YW50IHRvIHN1Z2dlc3QgdGhhdCB3 ZSB0YWtlIGEgZGlmZmVyZW50IGRpcmVjdGlvbj8NCg0KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoYW5rcywNCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IElk LWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzppZC1ldmVudC1ib3VuY2Vz QGlldGYub3JnPj4gT24gQmVoYWxmIE9mIFBoaWwgSHVudA0KU2VudDogVHVlc2RheSwgQXByaWwg MjQsIDIwMTggMjo1MCBQTQ0KVG86IFJ1c3MgSG91c2xleSA8aG91c2xleUB2aWdpbHNlYy5jb208 bWFpbHRvOmhvdXNsZXlAdmlnaWxzZWMuY29tPj4NCkNjOiBkcmFmdC1pZXRmLXNlY2V2ZW50LXRv a2VuLmFsbEBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi5hbGxAaWV0 Zi5vcmc+OyBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+OyBpZXRmQGlldGYub3JnPG1haWx0bzppZXRmQGll dGYub3JnPjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRv OmlkLWV2ZW50QGlldGYub3JnPj47IHNlY2RpckBpZXRmLm9yZzxtYWlsdG86c2VjZGlyQGlldGYu b3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2Yg ZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0wOQ0KDQpSdXNzLA0KDQpIZXJlIGFyZSBwcm9wb3Nl ZCBjaGFuZ2VzIHRvIGFkZHJlc3MgeW91ciBxdWVzdGlvbnMgYWJvdXQgU2VjdGlvbiAzLiAgWW91 4oCZcmUgcmlnaHQgdGhhdCB0aGlzIHNlY3Rpb24gaXMgcGxhY2luZyByZXF1aXJlbWVudHMgb24g cHJvZmlsaW5nIHNwZWNpZmljYXRpb25zLiAgVGhlIGNoYW5nZXMgbWFkZSBhcmUgaW50ZW5kZWQg dG8gbWFrZSB0aGlzIG1vcmUgZXhwbGljaXQuICBQbGVhc2UgbGV0IHVzIGtub3cgaWYgdGhlIHVw ZGF0ZWQgdGV4dCB3b3JrcyBmb3IgeW91LCBhbmQgaWYgc28sIHdl4oCZbGwgcHVibGlzaCBhbiB1 cGRhdGVkIGRyYWZ0IHVzaW5nIGl0Lg0KDQpQbGVhc2Ugc2VlIHRoZSB3ZGlmZiB0ZXh0IGZvciBz ZWN0aW9uIDMgYmVsb3cgKGFsc28gYXR0YWNoZWQpLg0KDQpUaGFua3MsDQoNClBoaWwgJiBNaWtl DQoNCuKAlHdkaWZmIGZvciBzZWMgMy0tDQoNCjMuICBSZXF1aXJlbWVudHMgZm9yIFNFVCBQcm9m aWxlcw0KDQoNCg0KICAgUHJvZmlsaW5nIHNwZWNpZmljYXRpb25zIG9mIHRoaXMgc3BlY2lmaWNh dGlvbiBkZWZpbmUgYWN0dWFsIFNFVHMgdG8NCg0KICAgYmUgdXNlZCBpbiBwYXJ0aWN1bGFyIHVz ZSBjYXNlcy4gIFRoZXNlIHByb2ZpbGluZyBzcGVjaWZpY2F0aW9ucw0KDQogICBkZWZpbmUgdGhl IHN5bnRheCBhbmQgc2VtYW50aWNzIG9mIFNFVHMgY29uZm9ybWluZyB0byB0aGF0IFNFVA0KDQog ICBwcm9maWxlIGFuZCBydWxlcyBmb3IgdmFsaWRhdGluZyB0aG9zZSBTRVRzLiAgUHJvZmlsaW5n DQoNCiAgIHNwZWNpZmljYXRpb25zIFNIT1VMRCBkZWZpbmUgc3ludGF4LCBzZW1hbnRpY3MsIHN1 YmplY3QNCg0KICAgaWRlbnRpZmljYXRpb24sIGFuZCB2YWxpZGF0aW9uLg0KDQoNCg0KICAgU3lu dGF4DQoNCiAgICAgIFRoZSBzeW50YXggZGVmaW5lZCBieQ0KDQogICBwcm9maWxpbmcgc3BlY2lm aWNhdGlvbnMgaW5jbHVkZXMgd2hhdCBjbGFpbXMgb2YgdGhlIFNFVHMgZGVmaW5lZCwgaW5jbHVk aW5nOg0KDQoNCg0KICAgICAgVG9wLUxldmVsIENsYWltcw0KDQogICAgICAgICBDbGFpbXMgYW5k IGV2ZW50IHBheWxvYWQgdmFsdWVzIHBsYWNlZCBhdCB0aGUgSldUIENsYWltcyBTZXQuIEV4YW1w bGVzIGFyZSB1c2VkDQoNCiAgICAgICAgIGNsYWltcyBkZWZpbmVkIGJ5IFNFVHMgdXRpbGl6aW5n IHRoZSBwcm9maWxlLiBKV1Qgc3BlY2lmaWNhdGlvbiAoc2VlIFtSRkM3NTE5XSksIHRoZQ0KDQog ICAgICAgICBTRVQgc3BlY2lmaWNhdGlvbiwgYW5kIGJ5IHRoZSBwcm9maWxpbmcgc3BlY2lmaWNh dGlvbi4NCg0KDQoNCiAgICAgIEV2ZW50IFBheWxvYWQNCg0KICAgICAgICAgVGhlIEpTT04gZGF0 YSBzdHJ1Y3R1cmUgY29udGVudHMgYW5kIGZvcm1hdCwgY29udGFpbmluZyBldmVudC0NCg0KICAg ICAgICAgc3BlY2lmaWMgaW5mb3JtYXRpb24sIGlmIGFueSAoc2VlIFNlY3Rpb24gMS4yKS4NCg0K DQoNCiAgIFNlbWFudGljcw0KDQogICAgICBEZWZpbmluZyB0aGUgc2VtYW50aWNzIG9mIHRoZSBT RVQgY29udGVudHMgZm9yIFNFVHMgdXRpbGl6aW5nIHRoZQ0KDQogICAgICBwcm9maWxlIGlzIGVx dWFsbHkgaW1wb3J0YW50LiAgUG9zc2libHkgbW9zdCBpbXBvcnRhbnQgaXMgZGVmaW5pbmcNCg0K ICAgICAgdGhlIHByb2NlZHVyZXMgdXNlZCB0byB2YWxpZGF0ZSB0aGUgU0VUIGlzc3VlciBhbmQg dG8gb2J0YWluIHRoZQ0KDQogICAgICBrZXlzIGNvbnRyb2xsZWQgYnkgdGhlIGlzc3VlciB0aGF0 IHdlcmUgdXNlZCBmb3IgY3J5cHRvZ3JhcGhpYw0KDQogICAgICBvcGVyYXRpb25zIHVzZWQgaW4g dGhlIEpXVCByZXByZXNlbnRpbmcgdGhlIFNFVC4gIEZvciBpbnN0YW5jZSwNCg0KICAgICAgc29t ZSBwcm9maWxlcyBtYXkgZGVmaW5lIGFuIGFsZ29yaXRobSBmb3IgcmV0cmlldmluZyB0aGUgU0VU DQoNCiAgICAgIGlzc3VlcidzIGtleXMgdGhhdCB1c2VzIHRoZSAiaXNzIiBjbGFpbSB2YWx1ZSBh cyBpdHMgaW5wdXQuDQoNCiAgICAgIExpa2V3aXNlLCBpZiB0aGUgcHJvZmlsZSBhbGxvd3MgKG9y IHJlcXVpcmVzKSB0aGF0IHRoZSBKV1QgYmUNCg0KICAgICAgdW5zZWN1cmVkLCB0aGUgbWVhbnMg Ynkgd2hpY2ggdGhlIGludGVncml0eSBvZiB0aGUgSldUIGlzIGVuc3VyZWQNCg0KICAgICAgTVVT VCBiZSBzcGVjaWZpZWQuDQoNCg0KDQogICBTdWJqZWN0IElkZW50aWZpY2F0aW9uDQoNCiAgICAg IFByb2ZpbGluZyBzcGVjaWZpY2F0aW9ucyBNVVNUIGRlZmluZSBob3cgdGhlIGV2ZW50IHN1Ympl Y3QgaXMNCg0KICAgICAgaWRlbnRpZmllZCBpbiB0aGUgU0VULCBhcyB3ZWxsIGFzIGhvdyB0byBk aWZmZXJlbnRpYXRlIGJldHdlZW4gdGhlDQoNCiAgICAgIGV2ZW50IHN1YmplY3QncyBpc3N1ZXIg YW5kIHRoZSBTRVQgaXNzdWVyLCBpZiBhcHBsaWNhYmxlLiAgSXQgaXMNCg0KICAgICAgTk9UIFJF Q09NTUVOREVEIGZvciBwcm9maWxpbmcgc3BlY2lmaWNhdGlvbnMgdG8gdXNlIHRoZSAic3ViIg0K DQogICAgICBjbGFpbSBpbiBjYXNlcyBpbiB3aGljaCB0aGUgc3ViamVjdCBpcyBub3QgZ2xvYmFs bHkgdW5pcXVlIGFuZCBoYXMNCg0KICAgICAgYSBkaWZmZXJlbnQgaXNzdWVyIGZyb20gdGhlIFNF VCBpdHNlbGYuDQoNCg0KDQogICBWYWxpZGF0aW9uDQoNCiAgICAgIFByb2ZpbGluZyBzcGVjaWZp Y2F0aW9ucyBNVVNUIGNsZWFybHkgc3BlY2lmeSB0aGUgc3RlcHMgdGhhdCBhDQoNCiAgICAgIHJl Y2lwaWVudCBvZiBhIFNFVCB1dGlsaXppbmcgdGhhdCBwcm9maWxlIE1VU1QgcGVyZm9ybSB0byB2 YWxpZGF0ZQ0KDQogICAgICB0aGF0IHRoZSBTRVQgaXMgYm90aCBzeW50YWN0aWNhbGx5IGFuZCBz ZW1hbnRpY2FsbHkgdmFsaWQuDQoNCg0KDQogICAgICBBbW9uZyB0aGUgc3ludGF4IGFuZCBzZW1h bnRpY3Mgb2YgU0VUcyB0aGF0IGEgcHJvZmlsaW5nDQoNCiAgICAgIHNwZWNpZmljYXRpb24gbWF5 IGRlZmluZSBpcyB3aGV0aGVyIHRoZSB2YWx1ZSBvZiB0aGUgImV2ZW50cyINCg0KICAgICAgY2xh aW0gbWF5IGNvbnRhaW4gbXVsdGlwbGUgbWVtYmVycywgYW5kIHdoYXQgcHJvY2Vzc2luZw0KDQog ICAgICBpbnN0cnVjdGlvbnMgYXJlIGVtcGxveWVkIGluIHRoZSBzaW5nbGUtIGFuZCBtdWx0aXBs ZS12YWx1ZWQgY2FzZXMNCg0KICAgICAgZm9yIFNFVHMgY29uZm9ybWluZyB0byB0aGF0IHByb2Zp bGUuICBNYW55IHZhbGlkIGNob2ljZXMgYXJlDQoNCiAgICAgIHBvc3NpYmxlLiAgRm9yIGluc3Rh bmNlLCBzb21lIHByb2ZpbGVzIG1pZ2h0IGFsbG93IG11bHRpcGxlIGV2ZW50DQoNCiAgICAgIGlk ZW50aWZpZXJzIHRvIGJlIHByZXNlbnQgYW5kIHNwZWNpZnkgdGhhdCBhbnkgdGhhdCBhcmUgbm90 DQoNCiAgICAgIHVuZGVyc3Rvb2QgYnkgcmVjaXBpZW50cyBiZSBpZ25vcmVkLCB0aHVzIGVuYWJs aW5nIGV4dGVuc2liaWxpdHkuDQoNCiAgICAgIE90aGVyIHByb2ZpbGVzIG1pZ2h0IGFsbG93IG11 bHRpcGxlIGV2ZW50IGlkZW50aWZpZXJzIHRvIGJlDQoNCiAgICAgIHByZXNlbnQgYnV0IHJlcXVp cmUgdGhhdCBhbGwgYmUgdW5kZXJzdG9vZCBpZiB0aGUgU0VUIGlzIHRvIGJlDQoNCiAgICAgIGFj Y2VwdGVkLiAgU29tZSBwcm9maWxlcyBtaWdodCByZXF1aXJlIHRoYXQgb25seSBhIHNpbmdsZSB2 YWx1ZSBiZQ0KDQogICAgICBwcmVzZW50LiAgQWxsIHN1Y2ggY2hvaWNlcyBhcmUgd2l0aGluIHRo ZSBzY29wZSBvZiBwcm9maWxpbmcNCg0KICAgICAgc3BlY2lmaWNhdGlvbnMgdG8gZGVmaW5lLg0K DQoNCg0KICAgUHJvZmlsaW5nIHNwZWNpZmljYXRpb25zIE1VU1QgY2xlYXJseSBzcGVjaWZ5IHRo ZSBzdGVwcyB0aGF0IGENCg0KICAgcmVjaXBpZW50IG9mIGEgU0VUIHV0aWxpemluZyB0aGF0IHBy b2ZpbGUgTVVTVCBwZXJmb3JtIHRvIHZhbGlkYXRlDQoNCiAgIHRoYXQgdGhlIFNFVCBpcyBib3Ro IHN5bnRhY3RpY2FsbHkgYW5kIHNlbWFudGljYWxseSB2YWxpZC4NCg0KUGhpbA0KDQpPcmFjbGUg Q29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdA0KQGluZGVwZW5k ZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29t Pg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPg0KDQpP biBBcHIgMjAsIDIwMTgsIGF0IDExOjAzIEFNLCBSdXNzIEhvdXNsZXkgPGhvdXNsZXlAdmlnaWxz ZWMuY29tPG1haWx0bzpob3VzbGV5QHZpZ2lsc2VjLmNvbT4+IHdyb3RlOg0KDQpSZXZpZXdlcjog UnVzcyBIb3VzbGV5DQpSZXZpZXcgcmVzdWx0OiBIYXMgSXNzdWVzDQoNCkkgcmV2aWV3ZWQgdGhp cyBkb2N1bWVudCBhcyBwYXJ0IG9mIHRoZSBTZWN1cml0eSBEaXJlY3RvcmF0ZSdzIG9uZ29pbmcN CmVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1lbnRzIGJlaW5nIHByb2Nlc3NlZCBieSB0 aGUgSUVTRy4gIFRoZXNlDQpjb21tZW50cyB3ZXJlIHdyaXR0ZW4gcHJpbWFyaWx5IGZvciB0aGUg YmVuZWZpdCBvZiB0aGUgU2VjdXJpdHkgQXJlYQ0KRGlyZWN0b3JzLiAgRG9jdW1lbnQgYXV0aG9y cywgZG9jdW1lbnQgZWRpdG9ycywgYW5kIFdHIGNoYWlycyBzaG91bGQNCnRyZWF0IHRoZXNlIGNv bW1lbnRzIGp1c3QgbGlrZSBhbnkgb3RoZXIgSUVURiBMYXN0IENhbGwgY29tbWVudHMuDQoNCkRv Y3VtZW50OiBkcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTA5DQpSZXZpZXdlcjogUnVzcyBIb3Vz bGV5DQpSZXZpZXcgRGF0ZTogMjAxOC0wNC0yMA0KSUVURiBMQyBFbmQgRGF0ZTogdW5rbm93bg0K SUVTRyBUZWxlY2hhdCBkYXRlOiAyMDE4LTA1LTEwDQoNClN1bW1hcnk6IEhhcyBJc3N1ZXMNCg0K TWFqb3IgQ29uY2VybnMNCg0KSSBkbyBub3QgdW5kZXJzdGFuZCB0aGUgZmlyc3QgcGFyYWdyYXBo IG9mIFNlY3Rpb24gMy4gIEkgbWFkZSB0aGlzDQpjb21tZW50IG9uIHZlcnNpb24gLTA3LCBhbmQg c29tZSB3b3JkcyB3ZXJlIGFkZGVkLCBidXQgSSBzdGlsbCBkbw0Kbm90IHVuZGVyc3RhbmQgdGhp cyBwYXJhZ3JhcGguICBJIHRoaW5rIHlvdSBhcmUgdHJ5aW5nIHRvIGltcG9zZSBzb21lDQpydWxl cyBvbiBmdXR1cmUgc3BlY2lmaWNhdGlvbnMgdGhhdCB1c2UgU0VUIHRvIGRlZmluZSBldmVudHMu ICBMZXQgbWUNCmFzayBhIGNvdXBsZSBvZiBxdWVzdGlvbnMgdGhhdCBtYXkgaGVscC4gIEkgdW5k ZXJzdGFuZCB0aGF0IGENCnByb2ZpbGluZyBzcGVjaWZpY2F0aW9uIE1VU1Qgc3BlY2lmeSB0aGUg c3ludGF4IGFuZCBzZW1hbnRpY3MgZm9yIGENCmNvbGxlY3Rpb24gb2Ygc2VjdXJpdHkgZXZlbnQg dG9rZW5zLCBpbmNsdWRpbmcgdGhlIGNsYWltcyBhbmQgcGF5bG9hZHMNCnRoYXQgYXJlIGV4cGVj dGVkLiAgV2hhdCBNVVNUIGEgcHJvZmlsaW5nIHNwZWNpZmljYXRpb24gaW5jbHVkZT8gIFdoYXQN Ck1VU1QgYSBwcm9maWxpbmcgc3BlY2lmaWNhdGlvbiBOT1QgaW5jbHVkZT8NCg0KDQpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGlu ZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRm Li5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlY UHB1WXFQa0FJMWFMY0xONEtaTkEmbT1oSkZ4LVoyaWgxOHVVTkNYb3NBanZ5Z0hxbjJfSzJtdE56 cUllajNBaC1jJnM9MjhPV2U0MlMwYmc4WTJlbzNWVnpBQ2VTWW56Z2l5eWVYTGw3dFR1OWkxWSZl PQ0KDQo= --_000_DM5PR00MB029324695FEA6EF07878D6E4F5810DM5PR00MB0293namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVk IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpzcGFuLkhUTUxQcmVmb3Jt YXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCglt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVk IjsNCglmb250LWZhbWlseTpDb25zb2xhczt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAs IGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4ueGFwcGxlLXN0eWxlLXNwYW4NCgl7bXNv LXN0eWxlLW5hbWU6eF9hcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOiMwMDIwNjA7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjQNCgl7bXNvLXN0eWxlLXR5cGU6 cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29s b3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25s eTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWlu IDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0 aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5 XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4N CjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlv dXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286 c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1V UyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPkhpIFJ1 c3MsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5Ob3QgaGF2aW5nIGhlYXJk IGJhY2sgZnJvbSB5b3UgZm9yIGEgd2VlaywgdGhlIGVkaXRvcnMgZGVjaWRlZCB0byBwdWJsaXNo IGFuIHVwZGF0ZWQgZHJhZnQNCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9k cmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTEwIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwv ZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0xMDwvYT4gdGhhdCBhZGRyZXNzZXMgeW91ciBhZGRp dGlvbmFsIFNlY0RpciByZXZpZXcgY29tbWVudHMgaW4gdGhlIG1hbm5lciBwcm9wb3NlZCBsYXN0 IHdlZWsuJm5ic3A7IEluIHBhcnRpY3VsYXIsIHRoZSByZXZpc2VkIHRleHQgbWFrZXMgaXQNCiBj bGVhcmVyIHdoYXQgcmVxdWlyZW1lbnRzIHRoaXMgc3BlY2lmaWNhdGlvbiBpcyBpbXBvc2luZyBv biBwcm9maWxpbmcgc3BlY2lmaWNhdGlvbnMuJm5ic3A7IEkgaG9wZSB0aGUgbmV3IHRleHQgd29y a3MgZm9yIHlvdS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBCZXN0IHdpc2hlcyw8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2 MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAw aW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBNaWtlIEpvbmVzIDxi cj4NCjxiPlNlbnQ6PC9iPiBTdW5kYXksIEFwcmlsIDI5LCAyMDE4IDM6MjAgUE08YnI+DQo8Yj5U bzo8L2I+IFJ1c3MgSG91c2xleSAmbHQ7aG91c2xleUB2aWdpbHNlYy5jb20mZ3Q7PGJyPg0KPGI+ Q2M6PC9iPiBQaGlsIEh1bnQgJmx0O3BoaWwuaHVudEBvcmFjbGUuY29tJmd0OzsgZHJhZnQtaWV0 Zi1zZWNldmVudC10b2tlbi5hbGxAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IElEIEV2ZW50cyBN YWlsaW5nIExpc3QgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0Ozsgc2VjZGlyQGlldGYub3JnPGJy Pg0KPGI+U3ViamVjdDo8L2I+IFJFOiBbSWQtZXZlbnRdIFNlY2RpciBsYXN0IGNhbGwgcmV2aWV3 IG9mIGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMDk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5IaSBSdXNzLDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+SSB3YW50ZWQgdG8gY2hlY2sgYmFjayBp bi4mbmJzcDsgQXJlIHlvdSBnb29kIHdpdGggdGhlc2UgY2hhbmdlcyB0byBhZGRyZXNzIHlvdXIg Y29tbWVudCBvciBkbyB3YW50IHRvIHN1Z2dlc3QgdGhhdCB3ZSB0YWtlIGEgZGlmZmVyZW50IGRp cmVjdGlvbj88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBUaGFua3MsPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGlu IDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gSWQtZXZlbnQgJmx0Ozxh IGhyZWY9Im1haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnIj5pZC1ldmVudC1ib3VuY2Vz QGlldGYub3JnPC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+UGhpbCBIdW50PGJyPg0KPGI+ U2VudDo8L2I+IFR1ZXNkYXksIEFwcmlsIDI0LCAyMDE4IDI6NTAgUE08YnI+DQo8Yj5Ubzo8L2I+ IFJ1c3MgSG91c2xleSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmhvdXNsZXlAdmlnaWxzZWMuY29tIj5o b3VzbGV5QHZpZ2lsc2VjLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWls dG86ZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi5hbGxAaWV0Zi5vcmciPmRyYWZ0LWlldGYtc2Vj ZXZlbnQtdG9rZW4uYWxsQGlldGYub3JnPC9hPjsgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFp bHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBpZXRmLm9y ZzwvYT47IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVu dEBpZXRmLm9yZyI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpz ZWNkaXJAaWV0Zi5vcmciPnNlY2RpckBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4g UmU6IFtJZC1ldmVudF0gU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1zZWNl dmVudC10b2tlbi0wOTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5SdXNzLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+SGVyZSBhcmUgcHJvcG9z ZWQgY2hhbmdlcyB0byBhZGRyZXNzIHlvdXIgcXVlc3Rpb25zIGFib3V0IFNlY3Rpb24gMy4mbmJz cDsgWW914oCZcmUgcmlnaHQgdGhhdCB0aGlzIHNlY3Rpb24gaXMgcGxhY2luZyByZXF1aXJlbWVu dHMgb24gcHJvZmlsaW5nIHNwZWNpZmljYXRpb25zLiZuYnNwOyBUaGUgY2hhbmdlcyBtYWRlIGFy ZSBpbnRlbmRlZCB0byBtYWtlIHRoaXMgbW9yZSBleHBsaWNpdC4mbmJzcDsNCiBQbGVhc2UgbGV0 IHVzIGtub3cgaWYgdGhlIHVwZGF0ZWQgdGV4dCB3b3JrcyBmb3IgeW91LCBhbmQgaWYgc28sIHdl 4oCZbGwgcHVibGlzaCBhbiB1cGRhdGVkIGRyYWZ0IHVzaW5nIGl0Ljwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPlBsZWFzZSBzZWUgdGhlIHdkaWZmIHRleHQgZm9yIHNlY3Rpb24gMyBi ZWxvdyAoYWxzbyBhdHRhY2hlZCkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+VGhh bmtzLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPlBoaWwgJmFtcDsgTWlrZTwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPuKAlHdkaWZmIGZvciBzZWMgMy0tPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cHJlPjMuJm5ic3A7IFJlcXVpcmVtZW50cyBmb3IgU0VU IFByb2ZpbGVzPG86cD48L286cD48L3ByZT4NCjxwcmU+PG86cD4mbmJzcDs8L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7Jm5ic3A7IFByb2ZpbGluZyBzcGVjaWZpY2F0aW9ucyBvZiB0aGlzIHNwZWNp ZmljYXRpb24gZGVmaW5lIGFjdHVhbCBTRVRzIHRvPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7IGJlIHVzZWQgaW4gcGFydGljdWxhciB1c2UgY2FzZXMuJm5ic3A7IFRoZXNlIHBy b2ZpbGluZyBzcGVjaWZpY2F0aW9uczxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNw OyBkZWZpbmUgdGhlIHN5bnRheCBhbmQgc2VtYW50aWNzIG9mIFNFVHMgY29uZm9ybWluZyB0byB0 aGF0IFNFVDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBwcm9maWxlIGFuZCBy dWxlcyBmb3IgdmFsaWRhdGluZyB0aG9zZSBTRVRzLiZuYnNwOyA8c3Ryb25nPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpncmVlbiI+UHJvZmls aW5nPG86cD48L286cD48L3NwYW4+PC9zdHJvbmc+PC9wcmU+DQo8cHJlPjxzdHJvbmc+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmdyZWVuIj4m bmJzcDsmbmJzcDsgc3BlY2lmaWNhdGlvbnMgU0hPVUxEIGRlZmluZSBzeW50YXgsIHNlbWFudGlj cywgc3ViamVjdDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Ryb25nPjwvcHJlPg0KPHByZT48c3Ryb25n PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpn cmVlbiI+Jm5ic3A7Jm5ic3A7IGlkZW50aWZpY2F0aW9uLCBhbmQgdmFsaWRhdGlvbi48bzpwPjwv bzpwPjwvc3Bhbj48L3N0cm9uZz48L3ByZT4NCjxwcmU+PHN0cm9uZz48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6Z3JlZW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvc3Ryb25nPjwvcHJlPg0KPHByZT48c3Ryb25nPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpncmVlbiI+Jm5ic3A7Jm5i c3A7IFN5bnRheDwvc3Bhbj48L3N0cm9uZz48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgVGhlIHN5bnRheCA8cz48c3BhbiBzdHlsZT0iY29sb3I6 cmVkIj5kZWZpbmVkIGJ5PG86cD48L286cD48L3NwYW4+PC9zPjwvcHJlPg0KPHByZT48cz48c3Bh biBzdHlsZT0iY29sb3I6cmVkIj4mbmJzcDsmbmJzcDsgcHJvZmlsaW5nIHNwZWNpZmljYXRpb25z IGluY2x1ZGVzIHdoYXQgY2xhaW1zPC9zcGFuPjwvcz4gPHN0cm9uZz48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6Z3JlZW4iPm9mIHRoZSBTRVRz IGRlZmluZWQsIGluY2x1ZGluZzo8bzpwPjwvbzpwPjwvc3Bhbj48L3N0cm9uZz48L3ByZT4NCjxw cmU+PHN0cm9uZz48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDs7Y29sb3I6Z3JlZW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Ryb25nPjwvcHJlPg0K PHByZT48c3Ryb25nPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90Oztjb2xvcjpncmVlbiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFRvcC1MZXZl bCBDbGFpbXM8bzpwPjwvbzpwPjwvc3Bhbj48L3N0cm9uZz48L3ByZT4NCjxwcmU+PHN0cm9uZz48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6Z3Jl ZW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBDbGFp bXM8L3NwYW4+PC9zdHJvbmc+IGFuZCA8cz48c3BhbiBzdHlsZT0iY29sb3I6cmVkIj5ldmVudCBw YXlsb2FkPC9zcGFuPjwvcz4gdmFsdWVzIDxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmdyZWVuIj5wbGFjZWQgYXQgdGhlIEpXVCBD bGFpbXMgU2V0LiBFeGFtcGxlczwvc3Bhbj48L3N0cm9uZz4gYXJlIDxzPjxzcGFuIHN0eWxlPSJj b2xvcjpyZWQiPnVzZWQ8L3NwYW4+PC9zPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8c3Ryb25nPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpncmVlbiI+Y2xh aW1zIGRlZmluZWQ8L3NwYW4+PC9zdHJvbmc+IGJ5IDxzPjxzcGFuIHN0eWxlPSJjb2xvcjpyZWQi PlNFVHMgdXRpbGl6aW5nPC9zcGFuPjwvcz4gdGhlIDxzPjxzcGFuIHN0eWxlPSJjb2xvcjpyZWQi PnByb2ZpbGUuPC9zcGFuPjwvcz4gPHN0cm9uZz48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6Z3JlZW4iPkpXVCBzcGVjaWZpY2F0aW9uIChzZWUg W1JGQzc1MTldKSwgdGhlPG86cD48L286cD48L3NwYW4+PC9zdHJvbmc+PC9wcmU+DQo8cHJlPjxz dHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Nv bG9yOmdyZWVuIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgU0VUIHNwZWNpZmljYXRpb24sIGFuZCBieSB0aGUgcHJvZmlsaW5nIHNwZWNpZmljYXRpb24u PG86cD48L286cD48L3NwYW4+PC9zdHJvbmc+PC9wcmU+DQo8cHJlPjxzdHJvbmc+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmdyZWVuIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3N0cm9uZz48L3ByZT4NCjxwcmU+PHN0cm9uZz48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6Z3JlZW4iPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBFdmVudCBQYXlsb2FkPG86cD48L286cD48L3Nw YW4+PC9zdHJvbmc+PC9wcmU+DQo8cHJlPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmdyZWVuIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgVGhlIEpTT04gZGF0YSBzdHJ1Y3R1cmUgY29u dGVudHMgYW5kIGZvcm1hdCwgY29udGFpbmluZyBldmVudC08bzpwPjwvbzpwPjwvc3Bhbj48L3N0 cm9uZz48L3ByZT4NCjxwcmU+PHN0cm9uZz48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7Y29sb3I6Z3JlZW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBzcGVjaWZpYyBpbmZvcm1hdGlvbiwgaWYgYW55IChzZWUg U2VjdGlvbiAxLjIpLjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Ryb25nPjwvcHJlPg0KPHByZT48c3Ry b25nPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xv cjpncmVlbiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zdHJvbmc+PC9wcmU+DQo8cHJlPjxz dHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Nv bG9yOmdyZWVuIj4mbmJzcDsmbmJzcDsgU2VtYW50aWNzPC9zcGFuPjwvc3Ryb25nPjxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBEZWZpbmluZyB0 aGUgc2VtYW50aWNzIG9mIHRoZSBTRVQgY29udGVudHMgZm9yIFNFVHMgdXRpbGl6aW5nIHRoZTxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBwcm9m aWxlIGlzIGVxdWFsbHkgaW1wb3J0YW50LiZuYnNwOyBQb3NzaWJseSBtb3N0IGltcG9ydGFudCBp cyBkZWZpbmluZzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyB0aGUgcHJvY2VkdXJlcyB1c2VkIHRvIHZhbGlkYXRlIHRoZSBTRVQgaXNzdWVyIGFu ZCB0byBvYnRhaW4gdGhlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IGtleXMgY29udHJvbGxlZCBieSB0aGUgaXNzdWVyIHRoYXQgd2VyZSB1c2Vk IGZvciBjcnlwdG9ncmFwaGljPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IG9wZXJhdGlvbnMgdXNlZCBpbiB0aGUgSldUIHJlcHJlc2VudGluZyB0 aGUgU0VULiZuYnNwOyBGb3IgaW5zdGFuY2UsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHNvbWUgcHJvZmlsZXMgbWF5IGRlZmluZSBhbiBhbGdv cml0aG0gZm9yIHJldHJpZXZpbmcgdGhlIFNFVDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBpc3N1ZXIncyBrZXlzIHRoYXQgdXNlcyB0aGUgJnF1 b3Q7aXNzJnF1b3Q7IGNsYWltIHZhbHVlIGFzIGl0cyBpbnB1dC48bzpwPjwvbzpwPjwvcHJlPg0K PHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgTGlrZXdpc2UsIGlmIHRoZSBwcm9m aWxlIGFsbG93cyAob3IgcmVxdWlyZXMpIHRoYXQgdGhlIEpXVCBiZTxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB1bnNlY3VyZWQsIHRoZSBtZWFu cyBieSB3aGljaCB0aGUgaW50ZWdyaXR5IG9mIHRoZSBKV1QgaXMgZW5zdXJlZDxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBNVVNUIGJlIHNwZWNp ZmllZC48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsgPHN0cm9uZz48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDs7Y29sb3I6Z3JlZW4iPlN1YmplY3QgSWRlbnRpZmljYXRpb248L3NwYW4+ PC9zdHJvbmc+PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IFByb2ZpbGluZyBzcGVjaWZpY2F0aW9ucyBNVVNUIGRlZmluZSBob3cgdGhlIGV2ZW50 IHN1YmplY3QgaXM8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgaWRlbnRpZmllZCBpbiB0aGUgU0VULCBhcyB3ZWxsIGFzIGhvdyB0byBkaWZmZXJl bnRpYXRlIGJldHdlZW4gdGhlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IGV2ZW50IHN1YmplY3QncyBpc3N1ZXIgYW5kIHRoZSBTRVQgaXNzdWVy LCBpZiBhcHBsaWNhYmxlLiZuYnNwOyBJdCBpczxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBOT1QgUkVDT01NRU5ERUQgZm9yIHByb2ZpbGluZyBz cGVjaWZpY2F0aW9ucyB0byB1c2UgdGhlICZxdW90O3N1YiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBjbGFpbSBpbiBjYXNlcyBpbiB3 aGljaCB0aGUgc3ViamVjdCBpcyBub3QgZ2xvYmFsbHkgdW5pcXVlIGFuZCBoYXM8bzpwPjwvbzpw PjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgYSBkaWZmZXJlbnQg aXNzdWVyIGZyb20gdGhlIFNFVCBpdHNlbGYuPG86cD48L286cD48L3ByZT4NCjxwcmU+PG86cD4m bmJzcDs8L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IDxzdHJvbmc+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmdyZWVuIj5WYWxpZGF0 aW9uPG86cD48L286cD48L3NwYW4+PC9zdHJvbmc+PC9wcmU+DQo8cHJlPjxzdHJvbmc+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmdyZWVuIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgUHJvZmlsaW5nIHNwZWNpZmljYXRpb25zIE1V U1QgY2xlYXJseSBzcGVjaWZ5IHRoZSBzdGVwcyB0aGF0IGE8bzpwPjwvbzpwPjwvc3Bhbj48L3N0 cm9uZz48L3ByZT4NCjxwcmU+PHN0cm9uZz48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7Y29sb3I6Z3JlZW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyByZWNpcGllbnQgb2YgYSBTRVQgdXRpbGl6aW5nIHRoYXQgcHJvZmlsZSBNVVNUIHBlcmZv cm0gdG8gdmFsaWRhdGU8bzpwPjwvbzpwPjwvc3Bhbj48L3N0cm9uZz48L3ByZT4NCjxwcmU+PHN0 cm9uZz48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29s b3I6Z3JlZW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0aGF0IHRoZSBTRVQgaXMg Ym90aCBzeW50YWN0aWNhbGx5IGFuZCBzZW1hbnRpY2FsbHkgdmFsaWQuPC9zcGFuPjwvc3Ryb25n PjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBBbW9uZyB0aGUgc3ludGF4IGFuZCBzZW1hbnRp Y3Mgb2YgU0VUcyB0aGF0IGEgcHJvZmlsaW5nPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHNwZWNpZmljYXRpb24gbWF5IGRlZmluZSBpcyB3aGV0 aGVyIHRoZSB2YWx1ZSBvZiB0aGUgJnF1b3Q7ZXZlbnRzJnF1b3Q7PG86cD48L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGNsYWltIG1heSBjb250YWluIG11 bHRpcGxlIG1lbWJlcnMsIGFuZCB3aGF0IHByb2Nlc3Npbmc8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgaW5zdHJ1Y3Rpb25zIGFyZSBlbXBsb3ll ZCBpbiB0aGUgc2luZ2xlLSBhbmQgbXVsdGlwbGUtdmFsdWVkIGNhc2VzPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGZvciBTRVRzIGNvbmZvcm1p bmcgdG8gdGhhdCBwcm9maWxlLiZuYnNwOyBNYW55IHZhbGlkIGNob2ljZXMgYXJlPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHBvc3NpYmxlLiZu YnNwOyBGb3IgaW5zdGFuY2UsIHNvbWUgcHJvZmlsZXMgbWlnaHQgYWxsb3cgbXVsdGlwbGUgZXZl bnQ8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg aWRlbnRpZmllcnMgdG8gYmUgcHJlc2VudCBhbmQgc3BlY2lmeSB0aGF0IGFueSB0aGF0IGFyZSBu b3Q8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg dW5kZXJzdG9vZCBieSByZWNpcGllbnRzIGJlIGlnbm9yZWQsIHRodXMgZW5hYmxpbmcgZXh0ZW5z aWJpbGl0eS48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgT3RoZXIgcHJvZmlsZXMgbWlnaHQgYWxsb3cgbXVsdGlwbGUgZXZlbnQgaWRlbnRpZmll cnMgdG8gYmU8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgcHJlc2VudCBidXQgcmVxdWlyZSB0aGF0IGFsbCBiZSB1bmRlcnN0b29kIGlmIHRoZSBT RVQgaXMgdG8gYmU8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgYWNjZXB0ZWQuJm5ic3A7IFNvbWUgcHJvZmlsZXMgbWlnaHQgcmVxdWlyZSB0aGF0 IG9ubHkgYSBzaW5nbGUgdmFsdWUgYmU8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgcHJlc2VudC4mbmJzcDsgQWxsIHN1Y2ggY2hvaWNlcyBhcmUg d2l0aGluIHRoZSBzY29wZSBvZiBwcm9maWxpbmc8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgc3BlY2lmaWNhdGlvbnMgdG8gZGVmaW5lLjxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyA8cz48c3BhbiBzdHlsZT0iY29sb3I6cmVkIj5Qcm9maWxpbmcgc3BlY2lmaWNhdGlvbnMg TVVTVCBjbGVhcmx5IHNwZWNpZnkgdGhlIHN0ZXBzIHRoYXQgYTxvOnA+PC9vOnA+PC9zcGFuPjwv cz48L3ByZT4NCjxwcmU+PHM+PHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+Jm5ic3A7Jm5ic3A7IHJl Y2lwaWVudCBvZiBhIFNFVCB1dGlsaXppbmcgdGhhdCBwcm9maWxlIE1VU1QgcGVyZm9ybSB0byB2 YWxpZGF0ZTxvOnA+PC9vOnA+PC9zcGFuPjwvcz48L3ByZT4NCjxwcmU+PHM+PHNwYW4gc3R5bGU9 ImNvbG9yOnJlZCI+Jm5ic3A7Jm5ic3A7IHRoYXQgdGhlIFNFVCBpcyBib3RoIHN5bnRhY3RpY2Fs bHkgYW5kIHNlbWFudGljYWxseSB2YWxpZC48L3NwYW4+PC9zPjxvOnA+PC9vOnA+PC9wcmU+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFj ayI+UGhpbDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOmJsYWNrIj5PcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2Vz IEFyY2hpdGVjdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+QGluZGVwZW5kZW50aWQ8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRp ZC5jb20iPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t Ij5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEy LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5PbiBBcHIgMjAsIDIwMTgsIGF0IDExOjAzIEFNLCBSdXNzIEhvdXNsZXkgJmx0OzxhIGhyZWY9 Im1haWx0bzpob3VzbGV5QHZpZ2lsc2VjLmNvbSI+aG91c2xleUB2aWdpbHNlYy5jb208L2E+Jmd0 OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJl dmlld2VyOiBSdXNzIEhvdXNsZXk8YnI+DQpSZXZpZXcgcmVzdWx0OiBIYXMgSXNzdWVzPGJyPg0K PGJyPg0KSSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIFNlY3VyaXR5IERp cmVjdG9yYXRlJ3Mgb25nb2luZzxicj4NCmVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1l bnRzIGJlaW5nIHByb2Nlc3NlZCBieSB0aGUgSUVTRy4gJm5ic3A7VGhlc2U8YnI+DQpjb21tZW50 cyB3ZXJlIHdyaXR0ZW4gcHJpbWFyaWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0aGUgU2VjdXJpdHkg QXJlYTxicj4NCkRpcmVjdG9ycy4gJm5ic3A7RG9jdW1lbnQgYXV0aG9ycywgZG9jdW1lbnQgZWRp dG9ycywgYW5kIFdHIGNoYWlycyBzaG91bGQ8YnI+DQp0cmVhdCB0aGVzZSBjb21tZW50cyBqdXN0 IGxpa2UgYW55IG90aGVyIElFVEYgTGFzdCBDYWxsIGNvbW1lbnRzLjxicj4NCjxicj4NCkRvY3Vt ZW50OiBkcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTA5PGJyPg0KUmV2aWV3ZXI6IFJ1c3MgSG91 c2xleTxicj4NClJldmlldyBEYXRlOiAyMDE4LTA0LTIwPGJyPg0KSUVURiBMQyBFbmQgRGF0ZTog dW5rbm93bjxicj4NCklFU0cgVGVsZWNoYXQgZGF0ZTogMjAxOC0wNS0xMDxicj4NCjxicj4NClN1 bW1hcnk6IEhhcyBJc3N1ZXM8YnI+DQo8YnI+DQpNYWpvciBDb25jZXJuczxicj4NCjxicj4NCkkg ZG8gbm90IHVuZGVyc3RhbmQgdGhlIGZpcnN0IHBhcmFncmFwaCBvZiBTZWN0aW9uIDMuICZuYnNw O0kgbWFkZSB0aGlzPGJyPg0KY29tbWVudCBvbiB2ZXJzaW9uIC0wNywgYW5kIHNvbWUgd29yZHMg d2VyZSBhZGRlZCwgYnV0IEkgc3RpbGwgZG88YnI+DQpub3QgdW5kZXJzdGFuZCB0aGlzIHBhcmFn cmFwaC4gJm5ic3A7SSB0aGluayB5b3UgYXJlIHRyeWluZyB0byBpbXBvc2Ugc29tZTxicj4NCnJ1 bGVzIG9uIGZ1dHVyZSBzcGVjaWZpY2F0aW9ucyB0aGF0IHVzZSBTRVQgdG8gZGVmaW5lIGV2ZW50 cy4gJm5ic3A7TGV0IG1lPGJyPg0KYXNrIGEgY291cGxlIG9mIHF1ZXN0aW9ucyB0aGF0IG1heSBo ZWxwLiAmbmJzcDtJIHVuZGVyc3RhbmQgdGhhdCBhPGJyPg0KcHJvZmlsaW5nIHNwZWNpZmljYXRp b24gTVVTVCBzcGVjaWZ5IHRoZSBzeW50YXggYW5kIHNlbWFudGljcyBmb3IgYTxicj4NCmNvbGxl Y3Rpb24gb2Ygc2VjdXJpdHkgZXZlbnQgdG9rZW5zLCBpbmNsdWRpbmcgdGhlIGNsYWltcyBhbmQg cGF5bG9hZHM8YnI+DQp0aGF0IGFyZSBleHBlY3RlZC4gJm5ic3A7V2hhdCBNVVNUIGEgcHJvZmls aW5nIHNwZWNpZmljYXRpb24gaW5jbHVkZT8gJm5ic3A7V2hhdDxicj4NCk1VU1QgYSBwcm9maWxp bmcgc3BlY2lmaWNhdGlvbiBOT1QgaW5jbHVkZT88YnI+DQo8YnI+DQo8YnI+DQpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxp bmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+SWQtZXZlbnRA aWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi4ub3JnX21haWxtYW5fbGlzdGluZm9faWQt MkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUly TVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNM TjRLWk5BJmFtcDttPWhKRngtWjJpaDE4dVVOQ1hvc0FqdnlnSHFuMl9LMm10TnpxSWVqM0FoLWMm YW1wO3M9MjhPV2U0MlMwYmc4WTJlbzNWVnpBQ2VTWW56Z2l5eWVYTGw3dFR1OWkxWSZhbXA7ZSI+ aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cu aWV0Zi4ub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpC VFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWhKRngtWjJpaDE4dVVO Q1hvc0FqdnlnSHFuMl9LMm10TnpxSWVqM0FoLWMmYW1wO3M9MjhPV2U0MlMwYmc4WTJlbzNWVnpB Q2VTWW56Z2l5eWVYTGw3dFR1OWkxWSZhbXA7ZTwvYT49PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM5PR00MB029324695FEA6EF07878D6E4F5810DM5PR00MB0293namp_-- From nobody Sun May 6 15:31:12 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 94E5E12426E; Sun, 6 May 2018 15:31:10 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Eric Rescorla To: "The IESG" Cc: secevent-chairs@ietf.org, yaronf.ietf@gmail.com, Yaron Sheffer , draft-ietf-secevent-token@ietf.org, id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.79.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> Date: Sun, 06 May 2018 15:31:10 -0700 Archived-At: Subject: [Id-event] Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 May 2018 22:31:11 -0000 Eric Rescorla has entered the following ballot position for draft-ietf-secevent-token-10: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Rich version of this review at: https://mozphab-ietf.devsvcdev.mozaws.net/D4210 IMPORTANT S 2.2. > * a URI representing a user resource that was modified; or, > > * a token identifier (e.g. "jti") for a revoked token. > > If used, the profiling specification SHOULD define the content and > format semantics for the value. This claim is OPTIONAL, as the Doesn't this need to be a MUST for interoperability? S 4. > present but require that all be understood if the SET is to be > accepted. Some profiles might require that only a single value be > present. All such choices are within the scope of profiling > specifications to define. > > 4. Preventing Confusion between SETs and other JWTs Why don't you include some claim that makes these unambiguously SETs? That would at least prevent one directional confusion. COMMENTS S 2.2. > > "iss" (Issuer) Claim > As defined by Section 4.1.1 of [RFC7519], this claim contains a > string identifying the service provider publishing the SET (the > issuer). In some cases, the SET issuer is not the issuer of the > security subject. Therefore, implementers cannot assume that the I am having a hard time reading this text. What do you mean "issue or security subject?" S 3. > Profiling specifications MUST define how the event subject is > identified in the SET, as well as how to differentiate between the > event subject's issuer and the SET issuer, if applicable. It is > NOT RECOMMENDED for profiling specifications to use the "sub" > claim in cases in which the subject is not globally unique and has > a different issuer from the SET itself. Doesn't this contradict the SHOULD i called out above? S 5.1. > personally identifiable information SHOULD be encrypted using JWE > [RFC7516] or secured for confidentiality by other means. > > Unless integrity of the JWT is ensured by other means, it MUST be > signed using JWS [RFC7515] so that the SET can be authenticated and > validated by the SET recipient. This MUST seems less helpful than it would otherwise be because it doesn't specify what a valid signer is. S 5.4. > When SETs are delivered asynchronously and/or out-of-band with > respect to the original action that incurred the security event, it > is important to consider that a SET might be delivered to a SET > recipient in advance of or behind the process that caused the event. > For example, a user having been required to log out and then log back > in again, may cause a token revoked SET to be issued, typically Might be clearer to quote "token revoked" From nobody Sun May 6 15:57:02 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FAD112D86F for ; Sun, 6 May 2018 15:57:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=yahoo.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RuHJJJ8mwweX for ; Sun, 6 May 2018 15:56:58 -0700 (PDT) Received: from sonic309-14.consmr.mail.bf2.yahoo.com (sonic309-14.consmr.mail.bf2.yahoo.com [74.6.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65CA912D86D for ; Sun, 6 May 2018 15:56:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1525647417; bh=DQTefgpuDJTROBJ+B2Djk4T1JAhROGkPhc4TU8S5j/8=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From:Subject; b=KiuJvMm/FQqNX1sYyU5GrtQ/l4Wo0swti62b7PH/dCoSuGegn87P3PF8Jqt/OddhqvyIHMG9ei5SEb5KabQTz66FfIjSPLJibT6GjRGgr9P8ycI8onJJ/qJuqDh4cfcVJKn14rNSqn2Ul4sfx6/bGYrnlk9mObAY8QKMDW+rnw0uKcPQ6GoaBrrphyj5ocZV20isEj0WFmL+ezek2/eVs0JigU3E7VSN+gMU1MoKyGKQae6HTl6ugQ+tW1YSPmdzIO5zRdBKsv1mYzKH3J0XFjZ5eglo+qqxAhcMqRXx21tdBSbOs7tCd1gBpAw5Gla0YTYJIFHmqacXK9qUmGc8eQ== X-YMail-OSG: aVD6EkkVM1kCEoDgjxSHAdnBB8_mMLFMGWveXnKnPPFw2Ll6usj_b3jKZa_wC9E CDh3OJPnH.7Xg8hLZwLo49IyhCt5UzKsiv5RE5O7MApb9PkkQ4vKGjjpZpbwpuTnvjy5Np0cWtZ0 7TlPH5l.z7DGRKTuOd9_6WOxVjBqw8_ZTPIWUFpN8b3GmulG0t36NDXnx8.tMlekdIRrIZtmUBrO WQcyD7lhkMOSd_wFQMo5xBQ16z57jEBUxL8GQD7SVOkAo9SX0.LnjHypQ.ryBZSNg2xc.8iX.SXE yHFRwmlVSrvE1mpRYNFbIpz89b8CLXrtiSAqGNDBZOmG0Rjs2RM5puBZf69CecRrllDqVaPrH4OQ JIn6dxfmXb85GF8MTZ1TmAukxZ.yFy7kqzvSctHXHTjNfHnx_PIKvrFA6.gwrtmXeIYDfcrGWeGD BSB3.D5Zo.gVUA1Rk7OBglbExGWeKwv4fkHmjj0YXcDTS0IUgASoXJZUBfVHB79GJ7mZ_jhxyA7i QmuYfYYvvM61w0BwxTW8WrT67.KGGhVHkTaXYJcWTVc1epJFEvPNk7BXNz2H9l1A_z8Y825n4Uxo z0.v85va1S5vj6_pV8JEOpN1F5SbmdYFNHFYdyuVW.afG_Y.ORXBHLUsA.HxRu39fgZlKtGDCmTR 0.IzEbE9x08FCm64dHmAj6fHrgC82GXX3QS5Aqb7nUVH_IZYi4jJ5YViozristA-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic309.consmr.mail.bf2.yahoo.com with HTTP; Sun, 6 May 2018 22:56:57 +0000 Received: from S010678ca39faa2bd.vn.shawcable.net (EHLO [192.168.1.27]) ([70.70.142.148]) by smtp413.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID be494c91c0f2177951cc06cc5bd165cd; Sun, 06 May 2018 22:56:56 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Phil Hunt X-Mailer: iPhone Mail (15E302) In-Reply-To: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> Date: Sun, 6 May 2018 15:56:55 -0700 Cc: The IESG , secevent-chairs@ietf.org, yaronf.ietf@gmail.com, draft-ietf-secevent-token@ietf.org, id-event@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <6490BDE6-7245-455A-BAAA-7370EAE6414B@yahoo.com> References: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> To: Eric Rescorla Archived-At: Subject: Re: [Id-event] Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 May 2018 22:57:00 -0000 Eric,=20 Thanks for the great comments, my responses in line.=20 Mike can you answer the disambiguation question? Phil > On May 6, 2018, at 3:31 PM, Eric Rescorla wrote: >=20 > Eric Rescorla has entered the following ballot position for > draft-ietf-secevent-token-10: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this > introductory paragraph, however.) >=20 >=20 > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > Rich version of this review at: > https://mozphab-ietf.devsvcdev.mozaws.net/D4210 >=20 >=20 >=20 > IMPORTANT > S 2.2. >> * a URI representing a user resource that was modified; or, >>=20 >> * a token identifier (e.g. "jti") for a revoked token. >>=20 >> If used, the profiling specification SHOULD define the content and= >> format semantics for the value. This claim is OPTIONAL, as the >=20 > Doesn't this need to be a MUST for interoperability? Agreed. Also per your comment below.=20 >=20 >=20 > S 4. >> present but require that all be understood if the SET is to be >> accepted. Some profiles might require that only a single value be= >> present. All such choices are within the scope of profiling >> specifications to define. >>=20 >> 4. Preventing Confusion between SETs and other JWTs >=20 > Why don't you include some claim that makes these unambiguously SETs? > That would at least prevent one directional confusion. I will leave Mike to comment here.=20 >=20 > COMMENTS > S 2.2. >>=20 >> "iss" (Issuer) Claim >> As defined by Section 4.1.1 of [RFC7519], this claim contains a >> string identifying the service provider publishing the SET (the >> issuer). In some cases, the SET issuer is not the issuer of the >> security subject. Therefore, implementers cannot assume that the >=20 > I am having a hard time reading this text. What do you mean "issue or > security subject?" =E2=80=9Cissuer of the security subject=E2=80=9D not =E2=80=98or=E2=80=99.=20= JWT has a usage pattern where iss of the assertion is the same issuer of the= subject.=20 In SET an issuer may wish to talk about someone else's subject. Hence the is= suer of the subject is not the issuer of the security token assertion.=20 If you like, I am happy to work on the text some more. =20 >=20 >=20 > S 3. >> Profiling specifications MUST define how the event subject is >> identified in the SET, as well as how to differentiate between the= >> event subject's issuer and the SET issuer, if applicable. It is >> NOT RECOMMENDED for profiling specifications to use the "sub" >> claim in cases in which the subject is not globally unique and has= >> a different issuer from the SET itself. >=20 > Doesn't this contradict the SHOULD i called out above? Agreed. Will change per above suggestion.=20 >=20 >=20 > S 5.1. >> personally identifiable information SHOULD be encrypted using JWE >> [RFC7516] or secured for confidentiality by other means. >>=20 >> Unless integrity of the JWT is ensured by other means, it MUST be >> signed using JWS [RFC7515] so that the SET can be authenticated and >> validated by the SET recipient. >=20 > This MUST seems less helpful than it would otherwise be because it > doesn't specify what a valid signer is. Will reference the appropriate section in 7515.=20 >=20 >=20 > S 5.4. >> When SETs are delivered asynchronously and/or out-of-band with >> respect to the original action that incurred the security event, it >> is important to consider that a SET might be delivered to a SET >> recipient in advance of or behind the process that caused the event. >> For example, a user having been required to log out and then log back= >> in again, may cause a token revoked SET to be issued, typically >=20 > Might be clearer to quote "token revoked" Will do.=20 >=20 >=20 From nobody Sun May 6 16:20:24 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A438E12D87F for ; Sun, 6 May 2018 16:20:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.609 X-Spam-Level: X-Spam-Status: No, score=-2.609 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, T_DKIMWL_WL_MED=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kooAIGxYDKAA for ; Sun, 6 May 2018 16:20:19 -0700 (PDT) Received: from mail-oi0-x22f.google.com (mail-oi0-x22f.google.com [IPv6:2607:f8b0:4003:c06::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25C2612D87B for ; Sun, 6 May 2018 16:20:17 -0700 (PDT) Received: by mail-oi0-x22f.google.com with SMTP id b130-v6so23568726oif.12 for ; Sun, 06 May 2018 16:20:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=M/KL+nt/ul9eHvL1PlJgRXhSW3RAoc83OxaXMky7Y8s=; b=a3o92/YkrBsmOGNVgcMeJyjrLPIkkDStJveP6vjH0uskjIY5IAGl4Jg4Azdh6KLvGS c1slTte2gi9JExCILXL38OSrldQyzB+PYJuPTRpXEKMu08K55MjlAFVAZU7t37c2Y9lL LtZLtiodRdHPRVNh05yfZLQ4cqU4+9p9T+m+GSK6wEeTxvUZtlb26DaoisIeoUnIkBXM gfcVnS6tKwuZ4mZBKrcxMwDnnxuWTd2SwQsX4Ifi0kPlyMndqUnZtZMbmJL14I9LsCqs pjXQx73jX5iQPS0kZM7m1jiGgEILDgJphJ/2jGILl9F4kGzzqvKOh85HbufvhB3owVfW QmXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=M/KL+nt/ul9eHvL1PlJgRXhSW3RAoc83OxaXMky7Y8s=; b=HCewc3OhxUoH7YTVqH3YwfheIXYiogN74YeI58IapWoM+VSQ4aYSsTs3FqWhjiCh1m 5GC7gIJHnKTDS33mP12gzCh1wBY+dL3tatUU/7np6xvyxJsDAg7SJh4XCbxS7a8ggSAy 84dL5AdOwJW1/qArr8OSG5fSPObhCsW7Ir9/PfAWTAUQToDtgvqhpQ9xEBkPObr/ks2n G+OmpVIUySmcVFXzdjHJR84Gj/o8U7GH8Lz/cNiLxozlt9CC6w1rgEQ5+kkNddavxFU6 TqJ5gqBlEWnC1VOXJ96m130b+za07x1zzbDgYAhS9mZ2Oev/BcohmlQJraCp+lKDnngf 6Scg== X-Gm-Message-State: ALQs6tA0qYKfUa/Hj3n3qlf4uHX7JIF58NY3IJ4b5OhH3wN5/9lMolR+ /qkhcGrfVkTBGUSZmwh6M6sEC5G87XPZVTReN1YCdg== X-Google-Smtp-Source: AB8JxZrs3O22D25t+yQ21hIniBJXypTda+75e/HiSFfy5YotSopND8QP6zMH3DCwKLd43WsFwZkL2u6fTPV+Wk0R3RI= X-Received: by 2002:aca:3cc1:: with SMTP id j184-v6mr23190066oia.91.1525648816538; Sun, 06 May 2018 16:20:16 -0700 (PDT) MIME-Version: 1.0 Received: by 10.201.118.130 with HTTP; Sun, 6 May 2018 16:19:36 -0700 (PDT) In-Reply-To: <6490BDE6-7245-455A-BAAA-7370EAE6414B@yahoo.com> References: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> <6490BDE6-7245-455A-BAAA-7370EAE6414B@yahoo.com> From: Eric Rescorla Date: Sun, 6 May 2018 16:19:36 -0700 Message-ID: To: Phil Hunt Cc: The IESG , secevent-chairs@ietf.org, Yaron Sheffer , draft-ietf-secevent-token@ietf.org, id-event@ietf.org Content-Type: multipart/alternative; boundary="000000000000c31a43056b91cb61" Archived-At: Subject: Re: [Id-event] Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 May 2018 23:20:22 -0000 --000000000000c31a43056b91cb61 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, May 6, 2018 at 3:56 PM, Phil Hunt wrote: > Eric, > > Thanks for the great comments, my responses in line. > > Mike can you answer the disambiguation question? > > Phil > > > On May 6, 2018, at 3:31 PM, Eric Rescorla wrote: > > > > Eric Rescorla has entered the following ballot position for > > draft-ietf-secevent-token-10: No Objection > > > > When responding, please keep the subject line intact and reply to all > > email addresses included in the To and CC lines. (Feel free to cut this > > introductory paragraph, however.) > > > > > > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria. > html > > for more information about IESG DISCUSS and COMMENT positions. > > > > > > The document, along with other ballot positions, can be found here: > > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ > > > > > > > > ---------------------------------------------------------------------- > > COMMENT: > > ---------------------------------------------------------------------- > > > > Rich version of this review at: > > https://mozphab-ietf.devsvcdev.mozaws.net/D4210 > > > > > > > > IMPORTANT > > S 2.2. > >> * a URI representing a user resource that was modified; or, > >> > >> * a token identifier (e.g. "jti") for a revoked token. > >> > >> If used, the profiling specification SHOULD define the content > and > >> format semantics for the value. This claim is OPTIONAL, as the > > > > Doesn't this need to be a MUST for interoperability? > > Agreed. Also per your comment below. > > > > > > S 4. > >> present but require that all be understood if the SET is to be > >> accepted. Some profiles might require that only a single value > be > >> present. All such choices are within the scope of profiling > >> specifications to define. > >> > >> 4. Preventing Confusion between SETs and other JWTs > > > > Why don't you include some claim that makes these unambiguously SETs? > > That would at least prevent one directional confusion. > > I will leave Mike to comment here. > > > > COMMENTS > > S 2.2. > >> > >> "iss" (Issuer) Claim > >> As defined by Section 4.1.1 of [RFC7519], this claim contains a > >> string identifying the service provider publishing the SET (the > >> issuer). In some cases, the SET issuer is not the issuer of th= e > >> security subject. Therefore, implementers cannot assume that t= he > > > > I am having a hard time reading this text. What do you mean "issue or > > security subject?" > > =E2=80=9Cissuer of the security subject=E2=80=9D not =E2=80=98or=E2=80=99= . > Sorry, typo. > JWT has a usage pattern where iss of the assertion is the same issuer of > the subject. > > In SET an issuer may wish to talk about someone else's subject. Hence the > issuer of the subject is not the issuer of the security token assertion. > > If you like, I am happy to work on the text some more. > Yeah, I think it might be helpful, because, as you say, this deviates from standard JWT practice. -Ekr > S 3. > >> Profiling specifications MUST define how the event subject is > >> identified in the SET, as well as how to differentiate between > the > >> event subject's issuer and the SET issuer, if applicable. It i= s > >> NOT RECOMMENDED for profiling specifications to use the "sub" > >> claim in cases in which the subject is not globally unique and > has > >> a different issuer from the SET itself. > > > > Doesn't this contradict the SHOULD i called out above? > > Agreed. Will change per above suggestion. > > > > > > S 5.1. > >> personally identifiable information SHOULD be encrypted using JWE > >> [RFC7516] or secured for confidentiality by other means. > >> > >> Unless integrity of the JWT is ensured by other means, it MUST be > >> signed using JWS [RFC7515] so that the SET can be authenticated an= d > >> validated by the SET recipient. > > > > This MUST seems less helpful than it would otherwise be because it > > doesn't specify what a valid signer is. > > Will reference the appropriate section in 7515. > > > > > > S 5.4. > >> When SETs are delivered asynchronously and/or out-of-band with > >> respect to the original action that incurred the security event, i= t > >> is important to consider that a SET might be delivered to a SET > >> recipient in advance of or behind the process that caused the even= t. > >> For example, a user having been required to log out and then log > back > >> in again, may cause a token revoked SET to be issued, typically > > > > Might be clearer to quote "token revoked" > > Will do. > > > > > > --000000000000c31a43056b91cb61 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Sun, May 6, 2018 at 3:56 PM, Phil Hunt <phil.hunt@yahoo.com&g= t; wrote:
Eric,

Thanks for the great comments, my responses in line.

Mike can you answer the disambiguation question?

Phil

> On May 6, 2018, at 3:31 PM, Eric Rescorla <ekr@rtfm.com> wrote:
>
> Eric Rescorla has entered the following ballot position for
> draft-ietf-secevent-token-10: No Objection
>
> When responding, please keep the subject line intact and reply to all<= br> > email addresses included in the To and CC lines. (Feel free to cut thi= s
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/i= esg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/do= c/draft-ietf-secevent-token/
>
>
>
> ------------------------------------------------------------= ----------
> COMMENT:
> ------------------------------------------------------------= ----------
>
> Rich version of this review at:
> https://mozphab-ietf.devsvcdev.mozaws.net/D= 4210
>
>
>
> IMPORTANT
> S 2.2.
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 a URI representing a user resou= rce that was modified; or,
>>
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 a token identifier (e.g. "= jti") for a revoked token.
>>
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 If used, the profiling specification SH= OULD define the content and
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 format semantics for the value.=C2=A0 T= his claim is OPTIONAL, as the
>
> Doesn't this need to be a MUST for interoperability?

Agreed. Also per your comment below.
>
>
> S 4.
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 present but require that all be underst= ood if the SET is to be
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 accepted.=C2=A0 Some profiles might req= uire that only a single value be
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 present.=C2=A0 All such choices are wit= hin the scope of profiling
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 specifications to define.
>>
>>=C2=A0 4.=C2=A0 Preventing Confusion between SETs and other JWTs >
> Why don't you include some claim that makes these unambiguously SE= Ts?
> That would at least prevent one directional confusion.

I will leave Mike to comment here.
>
> COMMENTS
> S 2.2.
>>
>>=C2=A0 =C2=A0 =C2=A0"iss" (Issuer) Claim
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 As defined by Section 4.1.1 of [RFC7519= ], this claim contains a
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 string identifying the service provider= publishing the SET (the
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer).=C2=A0 In some cases, the SET i= ssuer is not the issuer of the
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 security subject.=C2=A0 Therefore, impl= ementers cannot assume that the
>
> I am having a hard time reading this text. What do you mean "issu= e or
> security subject?"

=E2=80=9Cissuer of the security subject=E2=80=9D not =E2=80=98or=E2= =80=99.

Sorry, typo.


JWT has a usage pattern where iss of the assertion is the same issuer of th= e subject.

In SET an issuer may wish to talk about someone else's subject. Hence t= he issuer of the subject is not the issuer of the security token assertion.=

If you like, I am happy to work on the text some more.=C2=A0

Yeah, I think it might be helpful, because, as you s= ay, this deviates from standard JWT practice.

= -Ekr


=
> S 3.
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Profiling specifications MUST define ho= w the event subject is
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 identified in the SET, as well as how t= o differentiate between the
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 event subject's issuer and the SET = issuer, if applicable.=C2=A0 It is
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 NOT RECOMMENDED for profiling specifica= tions to use the "sub"
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 claim in cases in which the subject is = not globally unique and has
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 a different issuer from the SET itself.=
>
> Doesn't this contradict the SHOULD i called out above?

Agreed. Will change per above suggestion.
>
>
> S 5.1.
>>=C2=A0 =C2=A0 =C2=A0personally identifiable information SHOULD be e= ncrypted using JWE
>>=C2=A0 =C2=A0 =C2=A0[RFC7516] or secured for confidentiality by oth= er means.
>>
>>=C2=A0 =C2=A0 =C2=A0Unless integrity of the JWT is ensured by other= means, it MUST be
>>=C2=A0 =C2=A0 =C2=A0signed using JWS [RFC7515] so that the SET can = be authenticated and
>>=C2=A0 =C2=A0 =C2=A0validated by the SET recipient.
>
> This MUST seems less helpful than it would otherwise be because it
> doesn't specify what a valid signer is.

Will reference the appropriate section in 7515.
>
>
> S 5.4.
>>=C2=A0 =C2=A0 =C2=A0When SETs are delivered asynchronously and/or o= ut-of-band with
>>=C2=A0 =C2=A0 =C2=A0respect to the original action that incurred th= e security event, it
>>=C2=A0 =C2=A0 =C2=A0is important to consider that a SET might be de= livered to a SET
>>=C2=A0 =C2=A0 =C2=A0recipient in advance of or behind the process t= hat caused the event.
>>=C2=A0 =C2=A0 =C2=A0For example, a user having been required to log= out and then log back
>>=C2=A0 =C2=A0 =C2=A0in again, may cause a token revoked SET to be i= ssued, typically
>
> Might be clearer to quote "token revoked"

Will do.
>
>


--000000000000c31a43056b91cb61-- From nobody Sun May 6 21:14:12 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6609F1270B4 for ; Sun, 6 May 2018 21:14:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5_25Yg6SiAef for ; Sun, 6 May 2018 21:14:09 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B862912704A for ; Sun, 6 May 2018 21:14:09 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 7F9D9300A27 for ; Mon, 7 May 2018 00:14:07 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id yuwT-GfxEuhL for ; Mon, 7 May 2018 00:14:06 -0400 (EDT) Received: from [172.20.1.136] (h39.7.140.40.ip.windstream.net [40.140.7.39]) by mail.smeinc.net (Postfix) with ESMTPSA id 47A27300435; Mon, 7 May 2018 00:14:05 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Russ Housley In-Reply-To: <152424742315.3484.7625515486296411114@ietfa.amsl.com> Date: Mon, 7 May 2018 00:14:10 -0400 Cc: draft-ietf-secevent-token.all@ietf.org, IETF , id-event@ietf.org Content-Transfer-Encoding: 7bit Message-Id: <607C4253-4F88-4BD2-9AAC-37D52BEB7DC0@vigilsec.com> References: <152424742315.3484.7625515486296411114@ietfa.amsl.com> To: IETF SecDir X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Id-event] [secdir] Secdir last call review of draft-ietf-secevent-token-09 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 04:14:11 -0000 The updated draft (-10) resolves my concern. Thanks, Russ > On Apr 20, 2018, at 2:03 PM, Russ Housley wrote: > > Reviewer: Russ Housley > Review result: Has Issues > > I reviewed this document as part of the Security Directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the Security Area > Directors. Document authors, document editors, and WG chairs should > treat these comments just like any other IETF Last Call comments. > > Document: draft-ietf-secevent-token-09 > Reviewer: Russ Housley > Review Date: 2018-04-20 > IETF LC End Date: unknown > IESG Telechat date: 2018-05-10 > > Summary: Has Issues > > Major Concerns > > I do not understand the first paragraph of Section 3. I made this > comment on version -07, and some words were added, but I still do > not understand this paragraph. I think you are trying to impose some > rules on future specifications that use SET to define events. Let me > ask a couple of questions that may help. I understand that a > profiling specification MUST specify the syntax and semantics for a > collection of security event tokens, including the claims and payloads > that are expected. What MUST a profiling specification include? What > MUST a profiling specification NOT include? From nobody Mon May 7 05:02:43 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D10C1243FE; Mon, 7 May 2018 05:02:41 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?q?Mirja_K=C3=BChlewind?= To: "The IESG" Cc: draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, yaronf.ietf@gmail.com, id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.79.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152569456137.1257.196817285072016580.idtracker@ietfa.amsl.com> Date: Mon, 07 May 2018 05:02:41 -0700 Archived-At: Subject: [Id-event] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Record_on_draft-?= =?utf-8?q?ietf-secevent-token-10=3A_=28with_COMMENT=29?= X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 12:02:41 -0000 Mirja Kühlewind has entered the following ballot position for draft-ietf-secevent-token-10: No Record When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- I guess this doc could also be informational as it "only" specifies a SET data structure and specific profiles will be defined in other documents that I guess would/could/should be stand-alone and as such might only need to refer this doc informatively. Was the intended state discussed in the working group? Minor question/comment: sec 6: "SET issuers SHOULD take steps to minimize the chance of event correlation, when such correlation would constitute a privacy violation." Should this maybe be a MUST given there is a constraint already given? From nobody Mon May 7 09:22:22 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 491C4126D3F; Mon, 7 May 2018 09:22:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.011 X-Spam-Level: X-Spam-Status: No, score=-2.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y_QpOu5xvlxU; Mon, 7 May 2018 09:22:19 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0125.outbound.protection.outlook.com [104.47.33.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C906120726; Mon, 7 May 2018 09:22:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=tN4gB6n+LnJQtB5r4C114Ljp40KoZlZuwdA7tqlv3BU=; b=l0ijMVoOtmFGvlcCtiHdRPXZY4hYJ/46KXWxc2bjwQSRKDeWjC5gurwdAYFM7fG44TfvqvrG42pDvE/UTFnek5SXEtgdD7aY3UYfVNQ4q6mtY9Sz3ufdM/ssbeg62leRmACwczqLjCMQPSYZK/jN8QW0b9yt6Ncjayj4JqJ/JdI= Received: from BL0PR00MB0292.namprd00.prod.outlook.com (2603:10b6:207:1e::30) by BL0PR00MB0401.namprd00.prod.outlook.com (2603:10b6:207:1f::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.788.0; Mon, 7 May 2018 16:22:06 +0000 Received: from BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::84a0:cb3c:39ec:1b01]) by BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::84a0:cb3c:39ec:1b01%5]) with mapi id 15.20.0788.000; Mon, 7 May 2018 16:22:06 +0000 From: Mike Jones To: Phil Hunt , Eric Rescorla CC: The IESG , "secevent-chairs@ietf.org" , "yaronf.ietf@gmail.com" , "draft-ietf-secevent-token@ietf.org" , "id-event@ietf.org" Thread-Topic: Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) Thread-Index: AQHT5YnxaPc1mOAkuUSjF/vxU7E9+aQjT/uAgAEjZdA= Date: Mon, 7 May 2018 16:22:06 +0000 Message-ID: References: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> <6490BDE6-7245-455A-BAAA-7370EAE6414B@yahoo.com> In-Reply-To: <6490BDE6-7245-455A-BAAA-7370EAE6414B@yahoo.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [50.47.80.188] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BL0PR00MB0401; 7:ImhytWDGT8llyOh5DFs2hmZVMsU+ryLveOAIaAtJfegVgjfEJieBKYi1v+KrQf//TBtuB3KFoOsuAQjiLiz7QCjVZsbmFHT61cg/kgvm84eaobP3HpqVuPW6ZEUI5thA5AKJzyipo5fn+Guz1X2xcxeVaNLE2iwa2x7jEemlaNKpfLv4q0Vzk9XuOauHUvs23jYOkuUYDBL1v+FFZrAVGHw6T6uUnmDbpiD7822qiqJ16Aj/aOwXgp8CBOq5fLwZ; 20:30pXFXJuWPZ+L0c51oC+HnIctomm83pYxKyJ1eltGqu4C1IovW6Owc+hv1TBw9Kvr2Y1ohBHbR/lZ2cFW9xpgSlIt+KrA3J0GOnXQ/37frz8sh5Pl4imH7RHJ8C/v84PMZJPri33JsEnjN0ueh//cS0wHB2O+FmWrpAqXSuNKDw= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(48565401081)(2017052603328)(7193020); SRVR:BL0PR00MB0401; x-ms-traffictypediagnostic: BL0PR00MB0401: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(120809045254105)(192374486261705)(85827821059158)(201166117486090); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(2017102700009)(2017102701064)(6040522)(2401047)(8121501046)(5005006)(2017102702064)(20171027021009)(20171027022009)(20171027023009)(20171027024009)(20171027025009)(20171027026009)(2017102703076)(3231254)(2018427008)(944501410)(52105095)(93006095)(93001095)(10201501046)(3002001)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:BL0PR00MB0401; BCL:0; PCL:0; RULEID:; SRVR:BL0PR00MB0401; x-forefront-prvs: 066517B35B x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39380400002)(396003)(346002)(39860400002)(366004)(376002)(199004)(189003)(13464003)(51914003)(316002)(7696005)(229853002)(22452003)(6436002)(76176011)(186003)(59450400001)(486006)(99286004)(446003)(11346002)(86362001)(53936002)(66066001)(8990500004)(476003)(7736002)(5250100002)(305945005)(81156014)(81166006)(26005)(8676002)(86612001)(97736004)(74316002)(5660300001)(6246003)(6306002)(6116002)(3280700002)(3846002)(55016002)(2906002)(9686003)(33656002)(25786009)(8936002)(105586002)(106356001)(3660700001)(10090500001)(53546011)(52396003)(6506007)(10290500003)(54906003)(2900100001)(110136005)(478600001)(14454004)(102836004)(4326008)(39060400002)(72206003)(966005)(68736007); DIR:OUT; SFP:1102; SCL:1; SRVR:BL0PR00MB0401; H:BL0PR00MB0292.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 5XmUzsJKsNjrWqNV07uDOfh3uMIHreNefMuj6Wc0f1nZZhtfmoIW+97Of/J+dIQCMJMpBKmIg1XBde3ScD/C2LywiomVXb55wKndsL46uuUMKpSwyxK8Jlk/yRrh+TUo6kImaVCYdKRV+RaaPqZnWFZaJBSSASonaJaioh698lE0RAyP0HslYKjPHvwwURGp spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: bbd5cb88-826a-42dd-c76a-08d5b436acdc X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: bbd5cb88-826a-42dd-c76a-08d5b436acdc X-MS-Exchange-CrossTenant-originalarrivaltime: 07 May 2018 16:22:06.2045 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR00MB0401 Archived-At: Subject: Re: [Id-event] Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 16:22:21 -0000 SGkgRUtSLA0KDQpZb3Ugd3JvdGU6DQo+IFdoeSBkb24ndCB5b3UgaW5jbHVkZSBzb21lIGNsYWlt IHRoYXQgbWFrZXMgdGhlc2UgdW5hbWJpZ3VvdXNseSBTRVRzPw0KPiBUaGF0IHdvdWxkIGF0IGxl YXN0IHByZXZlbnQgb25lIGRpcmVjdGlvbmFsIGNvbmZ1c2lvbi4NCg0KQWN0dWFsbHksIHRoZSBy ZXF1aXJlZCAiZXZlbnRzIiBjbGFpbSBtYWtlcyBhIEpXVCB1bmFtYmlndW91c2x5IGEgU0VULiAg U28geW91ciBzdWdnZXN0aW9uIGlzIGFscmVhZHkgc2F0aXNmaWVkIGJ5IG5vcm1hdGl2ZSB0ZXh0 IGluIHRoZSBzcGVjaWZpY2F0aW9uLg0KDQoJCQkJVGhhbmtzIGFnYWluLA0KCQkJCS0tIE1pa2UN Cg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFBoaWwgSHVudCA8cGhpbC5odW50 QHlhaG9vLmNvbT4gDQpTZW50OiBTdW5kYXksIE1heSA2LCAyMDE4IDM6NTcgUE0NClRvOiBFcmlj IFJlc2NvcmxhIDxla3JAcnRmbS5jb20+DQpDYzogVGhlIElFU0cgPGllc2dAaWV0Zi5vcmc+OyBz ZWNldmVudC1jaGFpcnNAaWV0Zi5vcmc7IHlhcm9uZi5pZXRmQGdtYWlsLmNvbTsgZHJhZnQtaWV0 Zi1zZWNldmVudC10b2tlbkBpZXRmLm9yZzsgaWQtZXZlbnRAaWV0Zi5vcmcNClN1YmplY3Q6IFJl OiBFcmljIFJlc2NvcmxhJ3MgTm8gT2JqZWN0aW9uIG9uIGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9r ZW4tMTA6ICh3aXRoIENPTU1FTlQpDQoNCkVyaWMsIA0KDQpUaGFua3MgZm9yIHRoZSBncmVhdCBj b21tZW50cywgbXkgcmVzcG9uc2VzIGluIGxpbmUuIA0KDQpNaWtlIGNhbiB5b3UgYW5zd2VyIHRo ZSBkaXNhbWJpZ3VhdGlvbiBxdWVzdGlvbj8NCg0KUGhpbA0KDQo+IE9uIE1heSA2LCAyMDE4LCBh dCAzOjMxIFBNLCBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS5jb20+IHdyb3RlOg0KPiANCj4gRXJp YyBSZXNjb3JsYSBoYXMgZW50ZXJlZCB0aGUgZm9sbG93aW5nIGJhbGxvdCBwb3NpdGlvbiBmb3IN Cj4gZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0xMDogTm8gT2JqZWN0aW9uDQo+IA0KPiBXaGVu IHJlc3BvbmRpbmcsIHBsZWFzZSBrZWVwIHRoZSBzdWJqZWN0IGxpbmUgaW50YWN0IGFuZCByZXBs eSB0byBhbGwgDQo+IGVtYWlsIGFkZHJlc3NlcyBpbmNsdWRlZCBpbiB0aGUgVG8gYW5kIENDIGxp bmVzLiAoRmVlbCBmcmVlIHRvIGN1dCANCj4gdGhpcyBpbnRyb2R1Y3RvcnkgcGFyYWdyYXBoLCBo b3dldmVyLikNCj4gDQo+IA0KPiBQbGVhc2UgcmVmZXIgdG8gDQo+IGh0dHBzOi8vd3d3LmlldGYu b3JnL2llc2cvc3RhdGVtZW50L2Rpc2N1c3MtY3JpdGVyaWEuaHRtbA0KPiBmb3IgbW9yZSBpbmZv cm1hdGlvbiBhYm91dCBJRVNHIERJU0NVU1MgYW5kIENPTU1FTlQgcG9zaXRpb25zLg0KPiANCj4g DQo+IFRoZSBkb2N1bWVudCwgYWxvbmcgd2l0aCBvdGhlciBiYWxsb3QgcG9zaXRpb25zLCBjYW4g YmUgZm91bmQgaGVyZToNCj4gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQt aWV0Zi1zZWNldmVudC10b2tlbi8NCj4gDQo+IA0KPiANCj4gLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KPiBDT01N RU5UOg0KPiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+IA0KPiBSaWNoIHZlcnNpb24gb2YgdGhpcyByZXZpZXcg YXQ6DQo+IGh0dHBzOi8vbW96cGhhYi1pZXRmLmRldnN2Y2Rldi5tb3phd3MubmV0L0Q0MjEwDQo+ IA0KPiANCj4gDQo+IElNUE9SVEFOVA0KPiBTIDIuMi4NCj4+ICAgICAgICAqICBhIFVSSSByZXBy ZXNlbnRpbmcgYSB1c2VyIHJlc291cmNlIHRoYXQgd2FzIG1vZGlmaWVkOyBvciwNCj4+IA0KPj4g ICAgICAgICogIGEgdG9rZW4gaWRlbnRpZmllciAoZS5nLiAianRpIikgZm9yIGEgcmV2b2tlZCB0 b2tlbi4NCj4+IA0KPj4gICAgICAgIElmIHVzZWQsIHRoZSBwcm9maWxpbmcgc3BlY2lmaWNhdGlv biBTSE9VTEQgZGVmaW5lIHRoZSBjb250ZW50IGFuZA0KPj4gICAgICAgIGZvcm1hdCBzZW1hbnRp Y3MgZm9yIHRoZSB2YWx1ZS4gIFRoaXMgY2xhaW0gaXMgT1BUSU9OQUwsIGFzIA0KPj4gdGhlDQo+ IA0KPiBEb2Vzbid0IHRoaXMgbmVlZCB0byBiZSBhIE1VU1QgZm9yIGludGVyb3BlcmFiaWxpdHk/ DQoNCkFncmVlZC4gQWxzbyBwZXIgeW91ciBjb21tZW50IGJlbG93LiANCj4gDQo+IA0KPiBTIDQu DQo+PiAgICAgICAgcHJlc2VudCBidXQgcmVxdWlyZSB0aGF0IGFsbCBiZSB1bmRlcnN0b29kIGlm IHRoZSBTRVQgaXMgdG8gYmUNCj4+ICAgICAgICBhY2NlcHRlZC4gIFNvbWUgcHJvZmlsZXMgbWln aHQgcmVxdWlyZSB0aGF0IG9ubHkgYSBzaW5nbGUgdmFsdWUgYmUNCj4+ICAgICAgICBwcmVzZW50 LiAgQWxsIHN1Y2ggY2hvaWNlcyBhcmUgd2l0aGluIHRoZSBzY29wZSBvZiBwcm9maWxpbmcNCj4+ ICAgICAgICBzcGVjaWZpY2F0aW9ucyB0byBkZWZpbmUuDQo+PiANCj4+ICA0LiAgUHJldmVudGlu ZyBDb25mdXNpb24gYmV0d2VlbiBTRVRzIGFuZCBvdGhlciBKV1RzDQo+IA0KPiBXaHkgZG9uJ3Qg eW91IGluY2x1ZGUgc29tZSBjbGFpbSB0aGF0IG1ha2VzIHRoZXNlIHVuYW1iaWd1b3VzbHkgU0VU cz8NCj4gVGhhdCB3b3VsZCBhdCBsZWFzdCBwcmV2ZW50IG9uZSBkaXJlY3Rpb25hbCBjb25mdXNp b24uDQoNCkkgd2lsbCBsZWF2ZSBNaWtlIHRvIGNvbW1lbnQgaGVyZS4gDQo+IA0KPiBDT01NRU5U Uw0KPiBTIDIuMi4NCj4+IA0KPj4gICAgICJpc3MiIChJc3N1ZXIpIENsYWltDQo+PiAgICAgICAg QXMgZGVmaW5lZCBieSBTZWN0aW9uIDQuMS4xIG9mIFtSRkM3NTE5XSwgdGhpcyBjbGFpbSBjb250 YWlucyBhDQo+PiAgICAgICAgc3RyaW5nIGlkZW50aWZ5aW5nIHRoZSBzZXJ2aWNlIHByb3ZpZGVy IHB1Ymxpc2hpbmcgdGhlIFNFVCAodGhlDQo+PiAgICAgICAgaXNzdWVyKS4gIEluIHNvbWUgY2Fz ZXMsIHRoZSBTRVQgaXNzdWVyIGlzIG5vdCB0aGUgaXNzdWVyIG9mIHRoZQ0KPj4gICAgICAgIHNl Y3VyaXR5IHN1YmplY3QuICBUaGVyZWZvcmUsIGltcGxlbWVudGVycyBjYW5ub3QgYXNzdW1lIHRo YXQgDQo+PiB0aGUNCj4gDQo+IEkgYW0gaGF2aW5nIGEgaGFyZCB0aW1lIHJlYWRpbmcgdGhpcyB0 ZXh0LiBXaGF0IGRvIHlvdSBtZWFuICJpc3N1ZSBvciANCj4gc2VjdXJpdHkgc3ViamVjdD8iDQoN CuKAnGlzc3VlciBvZiB0aGUgc2VjdXJpdHkgc3ViamVjdOKAnSBub3Qg4oCYb3LigJkuIA0KDQpK V1QgaGFzIGEgdXNhZ2UgcGF0dGVybiB3aGVyZSBpc3Mgb2YgdGhlIGFzc2VydGlvbiBpcyB0aGUg c2FtZSBpc3N1ZXIgb2YgdGhlIHN1YmplY3QuIA0KDQpJbiBTRVQgYW4gaXNzdWVyIG1heSB3aXNo IHRvIHRhbGsgYWJvdXQgc29tZW9uZSBlbHNlJ3Mgc3ViamVjdC4gSGVuY2UgdGhlIGlzc3VlciBv ZiB0aGUgc3ViamVjdCBpcyBub3QgdGhlIGlzc3VlciBvZiB0aGUgc2VjdXJpdHkgdG9rZW4gYXNz ZXJ0aW9uLiANCg0KSWYgeW91IGxpa2UsIEkgYW0gaGFwcHkgdG8gd29yayBvbiB0aGUgdGV4dCBz b21lIG1vcmUuICANCj4gDQo+IA0KPiBTIDMuDQo+PiAgICAgICAgUHJvZmlsaW5nIHNwZWNpZmlj YXRpb25zIE1VU1QgZGVmaW5lIGhvdyB0aGUgZXZlbnQgc3ViamVjdCBpcw0KPj4gICAgICAgIGlk ZW50aWZpZWQgaW4gdGhlIFNFVCwgYXMgd2VsbCBhcyBob3cgdG8gZGlmZmVyZW50aWF0ZSBiZXR3 ZWVuIHRoZQ0KPj4gICAgICAgIGV2ZW50IHN1YmplY3QncyBpc3N1ZXIgYW5kIHRoZSBTRVQgaXNz dWVyLCBpZiBhcHBsaWNhYmxlLiAgSXQgaXMNCj4+ICAgICAgICBOT1QgUkVDT01NRU5ERUQgZm9y IHByb2ZpbGluZyBzcGVjaWZpY2F0aW9ucyB0byB1c2UgdGhlICJzdWIiDQo+PiAgICAgICAgY2xh aW0gaW4gY2FzZXMgaW4gd2hpY2ggdGhlIHN1YmplY3QgaXMgbm90IGdsb2JhbGx5IHVuaXF1ZSBh bmQgaGFzDQo+PiAgICAgICAgYSBkaWZmZXJlbnQgaXNzdWVyIGZyb20gdGhlIFNFVCBpdHNlbGYu DQo+IA0KPiBEb2Vzbid0IHRoaXMgY29udHJhZGljdCB0aGUgU0hPVUxEIGkgY2FsbGVkIG91dCBh Ym92ZT8NCg0KQWdyZWVkLiBXaWxsIGNoYW5nZSBwZXIgYWJvdmUgc3VnZ2VzdGlvbi4gDQo+IA0K PiANCj4gUyA1LjEuDQo+PiAgICAgcGVyc29uYWxseSBpZGVudGlmaWFibGUgaW5mb3JtYXRpb24g U0hPVUxEIGJlIGVuY3J5cHRlZCB1c2luZyBKV0UNCj4+ICAgICBbUkZDNzUxNl0gb3Igc2VjdXJl ZCBmb3IgY29uZmlkZW50aWFsaXR5IGJ5IG90aGVyIG1lYW5zLg0KPj4gDQo+PiAgICAgVW5sZXNz IGludGVncml0eSBvZiB0aGUgSldUIGlzIGVuc3VyZWQgYnkgb3RoZXIgbWVhbnMsIGl0IE1VU1Qg YmUNCj4+ICAgICBzaWduZWQgdXNpbmcgSldTIFtSRkM3NTE1XSBzbyB0aGF0IHRoZSBTRVQgY2Fu IGJlIGF1dGhlbnRpY2F0ZWQgYW5kDQo+PiAgICAgdmFsaWRhdGVkIGJ5IHRoZSBTRVQgcmVjaXBp ZW50Lg0KPiANCj4gVGhpcyBNVVNUIHNlZW1zIGxlc3MgaGVscGZ1bCB0aGFuIGl0IHdvdWxkIG90 aGVyd2lzZSBiZSBiZWNhdXNlIGl0IA0KPiBkb2Vzbid0IHNwZWNpZnkgd2hhdCBhIHZhbGlkIHNp Z25lciBpcy4NCg0KV2lsbCByZWZlcmVuY2UgdGhlIGFwcHJvcHJpYXRlIHNlY3Rpb24gaW4gNzUx NS4gDQo+IA0KPiANCj4gUyA1LjQuDQo+PiAgICAgV2hlbiBTRVRzIGFyZSBkZWxpdmVyZWQgYXN5 bmNocm9ub3VzbHkgYW5kL29yIG91dC1vZi1iYW5kIHdpdGgNCj4+ICAgICByZXNwZWN0IHRvIHRo ZSBvcmlnaW5hbCBhY3Rpb24gdGhhdCBpbmN1cnJlZCB0aGUgc2VjdXJpdHkgZXZlbnQsIGl0DQo+ PiAgICAgaXMgaW1wb3J0YW50IHRvIGNvbnNpZGVyIHRoYXQgYSBTRVQgbWlnaHQgYmUgZGVsaXZl cmVkIHRvIGEgU0VUDQo+PiAgICAgcmVjaXBpZW50IGluIGFkdmFuY2Ugb2Ygb3IgYmVoaW5kIHRo ZSBwcm9jZXNzIHRoYXQgY2F1c2VkIHRoZSBldmVudC4NCj4+ICAgICBGb3IgZXhhbXBsZSwgYSB1 c2VyIGhhdmluZyBiZWVuIHJlcXVpcmVkIHRvIGxvZyBvdXQgYW5kIHRoZW4gbG9nIGJhY2sNCj4+ ICAgICBpbiBhZ2FpbiwgbWF5IGNhdXNlIGEgdG9rZW4gcmV2b2tlZCBTRVQgdG8gYmUgaXNzdWVk LCB0eXBpY2FsbHkNCj4gDQo+IE1pZ2h0IGJlIGNsZWFyZXIgdG8gcXVvdGUgInRva2VuIHJldm9r ZWQiDQoNCldpbGwgZG8uIA0KPiANCj4gDQoNCg== From nobody Mon May 7 09:26:53 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22F65127010; Mon, 7 May 2018 09:26:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.011 X-Spam-Level: X-Spam-Status: No, score=-2.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DQcqwv8aNRPH; Mon, 7 May 2018 09:26:50 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0124.outbound.protection.outlook.com [104.47.32.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06E10120726; Mon, 7 May 2018 09:26:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=r79ODjbsFtKEW3hq0TIAH8gLyxoCzfOk6dKRTN0eF8M=; b=L7hY6WAlDyFnGtwl3K7l5a7BOucR2iupGNFC/XQhA1Vp+LaGcH1Vz9073Ft2VEIx1395opoADxzNLod/zgKo2BU4kzke4dxHijtiOtZsBdctbdI3DUyxGmPtwT5bwhw3kep6eqwM+BqVEAHgCd6CZTGmeZhFv2oggfpjHqYXiHA= Received: from BL0PR00MB0292.namprd00.prod.outlook.com (2603:10b6:207:1e::30) by BL0PR00MB0386.namprd00.prod.outlook.com (2603:10b6:207:1f::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.784.0; Mon, 7 May 2018 16:26:47 +0000 Received: from BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::84a0:cb3c:39ec:1b01]) by BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::84a0:cb3c:39ec:1b01%5]) with mapi id 15.20.0788.000; Mon, 7 May 2018 16:26:47 +0000 From: Mike Jones To: =?utf-8?B?TWlyamEgS8O8aGxld2luZA==?= , The IESG CC: "draft-ietf-secevent-token@ietf.org" , Yaron Sheffer , "secevent-chairs@ietf.org" , "yaronf.ietf@gmail.com" , "id-event@ietf.org" Thread-Topic: =?utf-8?B?TWlyamEgS8O8aGxld2luZCdzIE5vIFJlY29yZCBvbiBkcmFmdC1pZXRmLXNl?= =?utf-8?Q?cevent-token-10:_(with_COMMENT)?= Thread-Index: AQHT5ftPRS7zUSNpjE2R1KmcMIBKWKQkc0Ag Date: Mon, 7 May 2018 16:26:47 +0000 Message-ID: References: <152569456137.1257.196817285072016580.idtracker@ietfa.amsl.com> In-Reply-To: <152569456137.1257.196817285072016580.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [50.47.80.188] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BL0PR00MB0386; 7:Kil50IXRfjJ72WmDT8u5ywv9jtpJjACTy7fWnmAw8lUri1TMDGDr+1o75UvqCLLHl8FAEvibTVdxelTnZS91YCgrgboBpQN9/oNH8P1ZBltX503uRGZwhFJfdtrwHu1miFgKVIUWcmy5K9vscl7eOzjwzUcufkFIjRIcCVPNYUjh+Hqiolw9lDwfbp4xopiYYTmkfOv2tsTXNbSMOOsQhNsV/HKZU5VAq9+IJ0u94GFKULMcz1/myuOiAa+Zs6iB; 20:6Wu1+oXJqvq0nt9qgqnypKrqGMtVdLEBeYj283fHMDn5ecv2Kprhdy0rYjuwJsMDb+9mnSHO2Ojo3raUhYKU11yq83MGRFwP3JzWiqFb7g62Cb63031C53p56TL8cTEcRgb5k+ab/F14hr/01jXzBTKrUWYXdyYchmlepp8DrEU= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7193020); SRVR:BL0PR00MB0386; x-ms-traffictypediagnostic: BL0PR00MB0386: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(120809045254105)(85827821059158); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(2017102700009)(2017102701064)(6040522)(2401047)(5005006)(8121501046)(2017102702064)(20171027021009)(20171027022009)(20171027023009)(20171027024009)(20171027025009)(20171027026009)(2017102703076)(3231254)(2018427008)(944501410)(52105095)(3002001)(10201501046)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123560045)(20161123564045)(20161123558120)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011); SRVR:BL0PR00MB0386; BCL:0; PCL:0; RULEID:; SRVR:BL0PR00MB0386; x-forefront-prvs: 066517B35B x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(396003)(376002)(346002)(366004)(39380400002)(13464003)(189003)(199004)(52396003)(2906002)(5250100002)(99286004)(14454004)(316002)(55016002)(3660700001)(81156014)(81166006)(102836004)(476003)(3280700002)(53546011)(6506007)(305945005)(8936002)(7736002)(6116002)(446003)(229853002)(6346003)(39060400002)(6246003)(4326008)(9686003)(54906003)(3846002)(53936002)(6306002)(22452003)(110136005)(186003)(26005)(10290500003)(478600001)(68736007)(74316002)(72206003)(224313004)(106356001)(224303003)(105586002)(33656002)(5660300001)(97736004)(7696005)(8990500004)(6436002)(10090500001)(11346002)(486006)(76176011)(2900100001)(25786009)(66066001)(966005)(86362001)(86612001); DIR:OUT; SFP:1102; SCL:1; SRVR:BL0PR00MB0386; H:BL0PR00MB0292.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-microsoft-antispam-message-info: wjuL2egKpzrXFwfvQ2vuZjla3Ejd+kXSOFgMvw69gciJQqBBeIJKZF8qB1NEZXYUm1UiiTIjQthc5+uJCr+hYAceoGIJOs1gswQqSco4VTfNkdHAQiVH6B50+Jww1lwsz9lEAyWLqfVDwU/0X84tx6YE5hr905dDcA3kilMmI9VKbssuRRoLmQkN1Np7cWVx spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: aab20147-dae6-43cc-8975-08d5b4375456 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: aab20147-dae6-43cc-8975-08d5b4375456 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 May 2018 16:26:47.1950 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR00MB0386 Archived-At: Subject: Re: [Id-event] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Record_on_draft?= =?utf-8?q?-ietf-secevent-token-10=3A_=28with_COMMENT=29?= X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 16:26:52 -0000 VGhhbmtzIGZvciB5b3VyIGNvbW1lbnRzLCBNaXJqYS4gIE15IHJlcGxpZXMgYXJlIGlubGluZSBi ZWxvdywgcHJlZml4ZWQgYnkgIk1pa2U+Ii4NCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0N CkZyb206IE1pcmphIEvDvGhsZXdpbmQgPGlldGZAa3VlaGxld2luZC5uZXQ+IA0KU2VudDogTW9u ZGF5LCBNYXkgNywgMjAxOCA1OjAzIEFNDQpUbzogVGhlIElFU0cgPGllc2dAaWV0Zi5vcmc+DQpD YzogZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbkBpZXRmLm9yZzsgWWFyb24gU2hlZmZlciA8eWFy b25mLmlldGZAZ21haWwuY29tPjsgc2VjZXZlbnQtY2hhaXJzQGlldGYub3JnOyB5YXJvbmYuaWV0 ZkBnbWFpbC5jb207IGlkLWV2ZW50QGlldGYub3JnDQpTdWJqZWN0OiBNaXJqYSBLw7xobGV3aW5k J3MgTm8gUmVjb3JkIG9uIGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMTA6ICh3aXRoIENPTU1F TlQpDQoNCk1pcmphIEvDvGhsZXdpbmQgaGFzIGVudGVyZWQgdGhlIGZvbGxvd2luZyBiYWxsb3Qg cG9zaXRpb24gZm9yDQpkcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTEwOiBObyBSZWNvcmQNCg0K V2hlbiByZXNwb25kaW5nLCBwbGVhc2Uga2VlcCB0aGUgc3ViamVjdCBsaW5lIGludGFjdCBhbmQg cmVwbHkgdG8gYWxsIGVtYWlsIGFkZHJlc3NlcyBpbmNsdWRlZCBpbiB0aGUgVG8gYW5kIENDIGxp bmVzLiAoRmVlbCBmcmVlIHRvIGN1dCB0aGlzIGludHJvZHVjdG9yeSBwYXJhZ3JhcGgsIGhvd2V2 ZXIuKQ0KDQoNClBsZWFzZSByZWZlciB0byBodHRwczovL3d3dy5pZXRmLm9yZy9pZXNnL3N0YXRl bWVudC9kaXNjdXNzLWNyaXRlcmlhLmh0bWwNCmZvciBtb3JlIGluZm9ybWF0aW9uIGFib3V0IElF U0cgRElTQ1VTUyBhbmQgQ09NTUVOVCBwb3NpdGlvbnMuDQoNCg0KVGhlIGRvY3VtZW50LCBhbG9u ZyB3aXRoIG90aGVyIGJhbGxvdCBwb3NpdGlvbnMsIGNhbiBiZSBmb3VuZCBoZXJlOg0KaHR0cHM6 Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi8NCg0K DQoNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0NCkNPTU1FTlQ6DQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoNCkkgZ3Vlc3MgdGhp cyBkb2MgY291bGQgYWxzbyBiZSBpbmZvcm1hdGlvbmFsIGFzIGl0ICJvbmx5IiBzcGVjaWZpZXMg YSBTRVQgZGF0YSBzdHJ1Y3R1cmUgYW5kIHNwZWNpZmljIHByb2ZpbGVzIHdpbGwgYmUgZGVmaW5l ZCBpbiBvdGhlciBkb2N1bWVudHMgdGhhdCBJIGd1ZXNzIHdvdWxkL2NvdWxkL3Nob3VsZCBiZSBz dGFuZC1hbG9uZSBhbmQgYXMgc3VjaCBtaWdodCBvbmx5IG5lZWQgdG8gcmVmZXIgdGhpcyBkb2Mg aW5mb3JtYXRpdmVseS4gV2FzIHRoZSBpbnRlbmRlZCBzdGF0ZSBkaXNjdXNzZWQgaW4gdGhlIHdv cmtpbmcgZ3JvdXA/DQoNCk1pa2U+IFRoZSBkb2N1bWVudCBpcyBzdGFuZGFyZHMtdHJhY2sgYmVj YXVzZSBpdCBpbXBvc2VzIG5vcm1hdGl2ZSByZXF1aXJlbWVudHMgb24gYWxsIFNFVCBpbXBsZW1l bnRhdGlvbnMuICBGb3IgaW5zdGFuY2UsIGl0IGRlZmluZXMgdGhlICJldmVudHMiIGNsYWltIGFu ZCBzcGVjaWZpZXMgaG93IGl0IGlzIHVzZWQuDQoNCk1pbm9yIHF1ZXN0aW9uL2NvbW1lbnQ6DQpz ZWMgIDY6ICJTRVQgaXNzdWVycyBTSE9VTEQgdGFrZSBzdGVwcyB0byBtaW5pbWl6ZSB0aGUgY2hh bmNlIG9mIGV2ZW50IGNvcnJlbGF0aW9uLCB3aGVuIHN1Y2ggY29ycmVsYXRpb24gd291bGQgY29u c3RpdHV0ZSBhIHByaXZhY3kgdmlvbGF0aW9uLiINClNob3VsZCB0aGlzIG1heWJlIGJlIGEgTVVT VCBnaXZlbiB0aGVyZSBpcyBhIGNvbnN0cmFpbnQgYWxyZWFkeSBnaXZlbj8NCg0KTWlrZT4gSSBi ZWxpZXZlIGl0IHdvdWxkIGJlIGluIHRoZSByZWFsbSBvZiB0aGUgcHJvZmlsaW5nIHNwZWNpZmlj YXRpb25zIHRvIG1ha2UgdGhpcyBhICJNVVNUIiBpZiBhcHByb3ByaWF0ZSBmb3IgdGhlIHVzZSBj YXNlLiAgR2l2ZW4gU0VUcyBjYW4gYmUgcHJvZmlsZWQgZm9yIG1hbnkgZGlmZmVyZW50IGtpbmRz IG9mIHVzZSBjYXNlcywgSSdtIHdvcnJpZWQgdGhhdCBtYWtpbmcgdGhpcyBhICJNVVNUIiBpbiB0 aGUgYmFzZSBTRVQgc3BlY2lmaWNhdGlvbiBtaWdodCBiZSB0aGUgd3JvbmcgY2hvaWNlIGZvciBz b21lIHVzZSBjYXNlcy4gDQoNCgkJCQlUaGFua3MgYWdhaW4sDQoJCQkJLS0gTWlrZQ0KDQo= From nobody Mon May 7 09:48:21 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CE311270AE for ; Mon, 7 May 2018 09:48:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mhe5Vs0ZJp_M for ; Mon, 7 May 2018 09:48:13 -0700 (PDT) Received: from mail-ot0-x22e.google.com (mail-ot0-x22e.google.com [IPv6:2607:f8b0:4003:c0f::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D27FB120726 for ; Mon, 7 May 2018 09:48:09 -0700 (PDT) Received: by mail-ot0-x22e.google.com with SMTP id y10-v6so32709710otg.10 for ; Mon, 07 May 2018 09:48:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=q1mKZBi6MiNHCGpVI3r4zy0PxMv+mS47+/2AweS5WSY=; b=j3mWfiYEZmNkkmAn/6l8EwFqKX99X+6yNln9aVTwXVjuBQpRsBUCGem9OUogt6cgjU cyTGQ2Tmtj5N/vEbnDEitHFnzfUUAMb7yW6v1J4OwQizogwEMpiI+OmknSTnnHp3HapW RUX691mjCrbIFHCCBQ7hmwirz1Sb50bcHMN4uuIKY8zEo+gqkhtbs2SM4ev5wabGtYOx 0PczibK/jAn3H3w7iuEeNAnr8u23kQTxHh3tjWJGZsaE5lhJ2VeZWrXL3wI8rgXBvx15 8UtF407Y9TTV2CxNfj0ay8q9cajleSJUmh3rjOVGchvkN4SbjIt2rjmrpWP85sR8hgVv 9vbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=q1mKZBi6MiNHCGpVI3r4zy0PxMv+mS47+/2AweS5WSY=; b=tdVpbb1SMn249nt2kJA50oP1SB3+t4iy64m0hLRHkueqN72qzYQV7I+GloNoLNI43a U541mKV6ZcXgLwRdO+i42y92ytezDYf/ARja3Qzu0zMff/+XdRx/fkX9MoF8hLFmTA0w +TjPP3e/ApLvLUe/MCHBMHX/b6Gv+CZnaO0N+h2LaFjOfKWT59tAOG6vQv0mJmk4mGFZ RX69nlBi/wmYCnfSBkJ5Ubts9UuTRFQzDOhDcPEvtkHTMPGE/DX8d+PP6oTezWo2MmjK kPyjU9iRYo4ezOvJ6LvOIhQuJ/tS1p/FVhoz+XGGJGGeZbhAHZH660hPMT7S/w0ujE0o Z4VQ== X-Gm-Message-State: ALQs6tDpXz2fdZcFV8aIvb65TIdq/ReVZtC6o+yoZ6Wc6yIYPjYjyAp1 OWYwEdeR+VT2G49WiX0WWbzjR3WPN0pQFQQVLWEM+A== X-Google-Smtp-Source: AB8JxZqQxnUcHl6Q9nbR/Q5w7T0DyVlJ2N6mb6axB2AD6J1SjanZufWQtPSgie7kZuPFRk8nCtVezENPkEXR41MislU= X-Received: by 2002:a9d:72c6:: with SMTP id d6-v6mr13928432otk.392.1525711689210; Mon, 07 May 2018 09:48:09 -0700 (PDT) MIME-Version: 1.0 Received: by 10.201.118.130 with HTTP; Mon, 7 May 2018 09:47:28 -0700 (PDT) In-Reply-To: References: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> <6490BDE6-7245-455A-BAAA-7370EAE6414B@yahoo.com> From: Eric Rescorla Date: Mon, 7 May 2018 09:47:28 -0700 Message-ID: To: Mike Jones Cc: Phil Hunt , The IESG , "secevent-chairs@ietf.org" , "yaronf.ietf@gmail.com" , "draft-ietf-secevent-token@ietf.org" , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="00000000000043eb50056ba06f64" Archived-At: Subject: Re: [Id-event] Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 16:48:16 -0000 --00000000000043eb50056ba06f64 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, May 7, 2018 at 9:22 AM, Mike Jones wrote: > Hi EKR, > > You wrote: > > Why don't you include some claim that makes these unambiguously SETs? > > That would at least prevent one directional confusion. > > Actually, the required "events" claim makes a JWT unambiguously a SET. S= o > your suggestion is already satisfied by normative text in the specificati= on. > Might it be worth making this point slightly more sharply? With that said, isn't it possible other specifications might define "events"? -Ekr > Thanks again, > -- Mike > > -----Original Message----- > From: Phil Hunt > Sent: Sunday, May 6, 2018 3:57 PM > To: Eric Rescorla > Cc: The IESG ; secevent-chairs@ietf.org; > yaronf.ietf@gmail.com; draft-ietf-secevent-token@ietf.org; > id-event@ietf.org > Subject: Re: Eric Rescorla's No Objection on draft-ietf-secevent-token-10= : > (with COMMENT) > > Eric, > > Thanks for the great comments, my responses in line. > > Mike can you answer the disambiguation question? > > Phil > > > On May 6, 2018, at 3:31 PM, Eric Rescorla wrote: > > > > Eric Rescorla has entered the following ballot position for > > draft-ietf-secevent-token-10: No Objection > > > > When responding, please keep the subject line intact and reply to all > > email addresses included in the To and CC lines. (Feel free to cut > > this introductory paragraph, however.) > > > > > > Please refer to > > https://www.ietf.org/iesg/statement/discuss-criteria.html > > for more information about IESG DISCUSS and COMMENT positions. > > > > > > The document, along with other ballot positions, can be found here: > > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ > > > > > > > > ---------------------------------------------------------------------- > > COMMENT: > > ---------------------------------------------------------------------- > > > > Rich version of this review at: > > https://mozphab-ietf.devsvcdev.mozaws.net/D4210 > > > > > > > > IMPORTANT > > S 2.2. > >> * a URI representing a user resource that was modified; or, > >> > >> * a token identifier (e.g. "jti") for a revoked token. > >> > >> If used, the profiling specification SHOULD define the content > and > >> format semantics for the value. This claim is OPTIONAL, as > >> the > > > > Doesn't this need to be a MUST for interoperability? > > Agreed. Also per your comment below. > > > > > > S 4. > >> present but require that all be understood if the SET is to be > >> accepted. Some profiles might require that only a single value > be > >> present. All such choices are within the scope of profiling > >> specifications to define. > >> > >> 4. Preventing Confusion between SETs and other JWTs > > > > Why don't you include some claim that makes these unambiguously SETs? > > That would at least prevent one directional confusion. > > I will leave Mike to comment here. > > > > COMMENTS > > S 2.2. > >> > >> "iss" (Issuer) Claim > >> As defined by Section 4.1.1 of [RFC7519], this claim contains a > >> string identifying the service provider publishing the SET (the > >> issuer). In some cases, the SET issuer is not the issuer of th= e > >> security subject. Therefore, implementers cannot assume that > >> the > > > > I am having a hard time reading this text. What do you mean "issue or > > security subject?" > > =E2=80=9Cissuer of the security subject=E2=80=9D not =E2=80=98or=E2=80=99= . > > JWT has a usage pattern where iss of the assertion is the same issuer of > the subject. > > In SET an issuer may wish to talk about someone else's subject. Hence the > issuer of the subject is not the issuer of the security token assertion. > > If you like, I am happy to work on the text some more. > > > > > > S 3. > >> Profiling specifications MUST define how the event subject is > >> identified in the SET, as well as how to differentiate between > the > >> event subject's issuer and the SET issuer, if applicable. It i= s > >> NOT RECOMMENDED for profiling specifications to use the "sub" > >> claim in cases in which the subject is not globally unique and > has > >> a different issuer from the SET itself. > > > > Doesn't this contradict the SHOULD i called out above? > > Agreed. Will change per above suggestion. > > > > > > S 5.1. > >> personally identifiable information SHOULD be encrypted using JWE > >> [RFC7516] or secured for confidentiality by other means. > >> > >> Unless integrity of the JWT is ensured by other means, it MUST be > >> signed using JWS [RFC7515] so that the SET can be authenticated an= d > >> validated by the SET recipient. > > > > This MUST seems less helpful than it would otherwise be because it > > doesn't specify what a valid signer is. > > Will reference the appropriate section in 7515. > > > > > > S 5.4. > >> When SETs are delivered asynchronously and/or out-of-band with > >> respect to the original action that incurred the security event, i= t > >> is important to consider that a SET might be delivered to a SET > >> recipient in advance of or behind the process that caused the even= t. > >> For example, a user having been required to log out and then log > back > >> in again, may cause a token revoked SET to be issued, typically > > > > Might be clearer to quote "token revoked" > > Will do. > > > > > > --00000000000043eb50056ba06f64 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, May 7, 2018 at 9:22 AM, Mike Jones <Michael.Jones@mi= crosoft.com> wrote:
Hi EKR,=

You wrote:
> Why don't you include some claim that makes these unambiguously SE= Ts?
> That would at least prevent one directional confusion.

Actually, the required "events" claim makes a JWT unambigu= ously a SET.=C2=A0 So your suggestion is already satisfied by normative tex= t in the specification.

Might it be wor= th making this point slightly more sharply?

With t= hat said, isn't it possible other specifications might define "eve= nts"?

-Ekr


=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Thanks again,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 -- Mike

-----Original Message-----
From: Phil Hunt <phil.hunt@yahoo.= com>
Sent: Sunday, May 6, 2018 3:57 PM
To: Eric Rescorla <ekr@rtfm.com><= br> Cc: The IESG <iesg@ietf.org>; secevent-chairs@ietf.org; yaronf.ietf@gmail.com; draft-ietf-secevent-token@= ietf.org; id-event@ietf.org Subject: Re: Eric Rescorla's No Objection on draft-ietf-secevent-token-= 10: (with COMMENT)

Eric,

Thanks for the great comments, my responses in line.

Mike can you answer the disambiguation question?

Phil

> On May 6, 2018, at 3:31 PM, Eric Rescorla <ekr@rtfm.com> wrote:
>
> Eric Rescorla has entered the following ballot position for
> draft-ietf-secevent-token-10: No Objection
>
> When responding, please keep the subject line intact and reply to all =
> email addresses included in the To and CC lines. (Feel free to cut > this introductory paragraph, however.)
>
>
> Please refer to
> https://www.ietf.org/iesg/stateme= nt/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/do= c/draft-ietf-secevent-token/
>
>
>
> ------------------------------------------------------------= ----------
> COMMENT:
> ------------------------------------------------------------= ----------
>
> Rich version of this review at:
> https://mozphab-ietf.devsvcdev.mozaws.net/D= 4210
>
>
>
> IMPORTANT
> S 2.2.
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 a URI representing a user resou= rce that was modified; or,
>>
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 a token identifier (e.g. "= jti") for a revoked token.
>>
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 If used, the profiling specification SH= OULD define the content and
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 format semantics for the value.=C2=A0 T= his claim is OPTIONAL, as
>> the
>
> Doesn't this need to be a MUST for interoperability?

Agreed. Also per your comment below.
>
>
> S 4.
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 present but require that all be underst= ood if the SET is to be
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 accepted.=C2=A0 Some profiles might req= uire that only a single value be
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 present.=C2=A0 All such choices are wit= hin the scope of profiling
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 specifications to define.
>>
>>=C2=A0 4.=C2=A0 Preventing Confusion between SETs and other JWTs >
> Why don't you include some claim that makes these unambiguously SE= Ts?
> That would at least prevent one directional confusion.

I will leave Mike to comment here.
>
> COMMENTS
> S 2.2.
>>
>>=C2=A0 =C2=A0 =C2=A0"iss" (Issuer) Claim
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 As defined by Section 4.1.1 of [RFC7519= ], this claim contains a
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 string identifying the service provider= publishing the SET (the
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer).=C2=A0 In some cases, the SET i= ssuer is not the issuer of the
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 security subject.=C2=A0 Therefore, impl= ementers cannot assume that
>> the
>
> I am having a hard time reading this text. What do you mean "issu= e or
> security subject?"

=E2=80=9Cissuer of the security subject=E2=80=9D not =E2=80=98or=E2=80=99. =

JWT has a usage pattern where iss of the assertion is the same issuer of th= e subject.

In SET an issuer may wish to talk about someone else's subject. Hence t= he issuer of the subject is not the issuer of the security token assertion.=

If you like, I am happy to work on the text some more.=C2=A0
>
>
> S 3.
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Profiling specifications MUST define ho= w the event subject is
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 identified in the SET, as well as how t= o differentiate between the
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 event subject's issuer and the SET = issuer, if applicable.=C2=A0 It is
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 NOT RECOMMENDED for profiling specifica= tions to use the "sub"
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 claim in cases in which the subject is = not globally unique and has
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 a different issuer from the SET itself.=
>
> Doesn't this contradict the SHOULD i called out above?

Agreed. Will change per above suggestion.
>
>
> S 5.1.
>>=C2=A0 =C2=A0 =C2=A0personally identifiable information SHOULD be e= ncrypted using JWE
>>=C2=A0 =C2=A0 =C2=A0[RFC7516] or secured for confidentiality by oth= er means.
>>
>>=C2=A0 =C2=A0 =C2=A0Unless integrity of the JWT is ensured by other= means, it MUST be
>>=C2=A0 =C2=A0 =C2=A0signed using JWS [RFC7515] so that the SET can = be authenticated and
>>=C2=A0 =C2=A0 =C2=A0validated by the SET recipient.
>
> This MUST seems less helpful than it would otherwise be because it > doesn't specify what a valid signer is.

Will reference the appropriate section in 7515.
>
>
> S 5.4.
>>=C2=A0 =C2=A0 =C2=A0When SETs are delivered asynchronously and/or o= ut-of-band with
>>=C2=A0 =C2=A0 =C2=A0respect to the original action that incurred th= e security event, it
>>=C2=A0 =C2=A0 =C2=A0is important to consider that a SET might be de= livered to a SET
>>=C2=A0 =C2=A0 =C2=A0recipient in advance of or behind the process t= hat caused the event.
>>=C2=A0 =C2=A0 =C2=A0For example, a user having been required to log= out and then log back
>>=C2=A0 =C2=A0 =C2=A0in again, may cause a token revoked SET to be i= ssued, typically
>
> Might be clearer to quote "token revoked"

Will do.
>
>


--00000000000043eb50056ba06f64-- From nobody Mon May 7 09:52:24 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6322212D969; Mon, 7 May 2018 09:52:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 07PntrSTSESh; Mon, 7 May 2018 09:52:06 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0124.outbound.protection.outlook.com [104.47.40.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C85712D778; Mon, 7 May 2018 09:52:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VX5i5QQjQxqhSWb8SXe0LDaG+bCg1OzVVyrmryp6t9k=; b=ICH6Rlo6jn7JNzdfHrBqXz//YILCJM/s33z1HInLq8PEHRrrCaB75gPFfWc22sc/Ab++llynPUYZ3hftMkmYn4CBqd9UCBb4JVN6vcJ6dbH1LzyPD0e/5MLmagzdfyoElnaEe/p9pflNE84Gb5q5LBuuN77dJ8I5jqWTra/mjw4= Received: from BL0PR00MB0292.namprd00.prod.outlook.com (2603:10b6:207:1e::30) by BL0PR00MB0404.namprd00.prod.outlook.com (2603:10b6:207:31::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.789.0; Mon, 7 May 2018 16:51:48 +0000 Received: from BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::84a0:cb3c:39ec:1b01]) by BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::84a0:cb3c:39ec:1b01%5]) with mapi id 15.20.0788.000; Mon, 7 May 2018 16:51:48 +0000 From: Mike Jones To: Eric Rescorla CC: Phil Hunt , The IESG , "secevent-chairs@ietf.org" , "yaronf.ietf@gmail.com" , "draft-ietf-secevent-token@ietf.org" , "id-event@ietf.org" Thread-Topic: Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) Thread-Index: AQHT5YnxaPc1mOAkuUSjF/vxU7E9+aQjT/uAgAEjZdCAAAe2AIAAAFyg Date: Mon, 7 May 2018 16:51:48 +0000 Message-ID: References: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> <6490BDE6-7245-455A-BAAA-7370EAE6414B@yahoo.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [50.47.80.188] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BL0PR00MB0404; 7:x1TMlDecXMbYe/kEPnc1sbCtEvAPwYrQuTEj1CtgYrGDY6NOBY9MPI5zY0xmQ+INFa/3qiTDHI0LZVMb2P6a9d08yx02MwgZtCUrxhtBduuHsYRFinZX5OMTtMkD0rBdMf2DQi8XeT40/di0ZAzBbK16KVBPMrHyoy2oGkdLkivBxma9mhURZgN+/GTioYrT2uCdMi1llCAfeEPzVstKC5QSezsk6a1BZwC5MxjwM+amg6CjOgHrWOt6yTkz4mLt; 20:XmCOMmY4AAQSaZlib7IsXl3u+6HZEXDHk8swdLXnUTWtV/wJbOW3QRt3ublY4/EgFi97gxDhGIa5cNlOCD6MiPVPLjOfT56KyrRXsqCz+NqLTgBJbXXT9Z8c4xRlWGJ0v10CnTI/3KKYpIGx8JyG4SNnzWN/8ljTnpwsuqOQljc= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(48565401081)(2017052603328)(7193020); SRVR:BL0PR00MB0404; x-ms-traffictypediagnostic: BL0PR00MB0404: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(89211679590171)(120809045254105)(192374486261705)(85827821059158)(21748063052155)(201166117486090); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(2017102700009)(2017102701064)(6040522)(2401047)(8121501046)(5005006)(2017102702064)(20171027021009)(20171027022009)(20171027023009)(20171027024009)(20171027025009)(20171027026009)(2017102703076)(3231254)(2018427008)(944501410)(52105095)(93006095)(93001095)(10201501046)(3002001)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:BL0PR00MB0404; BCL:0; PCL:0; RULEID:; SRVR:BL0PR00MB0404; x-forefront-prvs: 066517B35B x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(396003)(39380400002)(366004)(346002)(39860400002)(13464003)(51914003)(199004)(189003)(3660700001)(25786009)(66066001)(10090500001)(5660300001)(8990500004)(97736004)(81156014)(81166006)(8676002)(8936002)(14454004)(6506007)(102836004)(186003)(99286004)(6346003)(76176011)(26005)(53546011)(86612001)(52396003)(59450400001)(86362001)(7696005)(2906002)(6436002)(54906003)(4326008)(39060400002)(229853002)(6246003)(22452003)(6916009)(3280700002)(316002)(10290500003)(478600001)(105586002)(106356001)(19609705001)(68736007)(5250100002)(33656002)(476003)(21615005)(446003)(11346002)(486006)(236005)(93886005)(53936002)(74316002)(606006)(7736002)(55016002)(790700001)(966005)(72206003)(6306002)(54896002)(3846002)(9686003)(6116002)(2900100001); DIR:OUT; SFP:1102; SCL:1; SRVR:BL0PR00MB0404; H:BL0PR00MB0292.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-microsoft-antispam-message-info: ZdEn3ZXj1DLKJ/oyyCCnWLIc454W/YNg7blfHMSdIT3t/DsYqzVu5JH6tp/F/ehbDCGx9F6iC7FYkvEjPqfCK6bLlFPWV0+hRDp9GJ0QWH1ujusUYzB5rbjtRLSwmk0TtFaGwsGGqbAfxayydlcgz8La8w0gcLSq98vRaMGwmb+2Nr5xx+f7gg/c4UVfM8q2 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BL0PR00MB0292ADA43ADB5B86CCCAC227F59B0BL0PR00MB0292namp_" MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: d7762375-6e4f-48ce-e59f-08d5b43ad34d X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: d7762375-6e4f-48ce-e59f-08d5b43ad34d X-MS-Exchange-CrossTenant-originalarrivaltime: 07 May 2018 16:51:48.8613 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR00MB0404 Archived-At: Subject: Re: [Id-event] Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 16:52:14 -0000 --_000_BL0PR00MB0292ADA43ADB5B86CCCAC227F59B0BL0PR00MB0292namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 V2UgY2FuIGxvb2sgYXQgYmVlZmluZyB1cCB0aGlzIHN0YXRlbWVudCwgYXMgeW91IHN1Z2dlc3Qg 4oCTIHByb2JhYmx5IHNvbWV3aGVyZSBpbiBTZWN0aW9uIDQgKFByZXZlbnRpbmcgQ29uZnVzaW9u IGJldHdlZW4gU0VUcyBhbmQgb3RoZXIgSldUcykuDQoNCk90aGVyIHNwZWNpZmljYXRpb25zIGNh bm5vdCBkZWZpbmUg4oCcZXZlbnRz4oCdIGJlY2F1c2UgdGhpcyBzcGVjaWZpY2F0aW9uIHJlZ2lz dGVycyDigJxldmVudHPigJ0gaW4gdGhlIElBTkEgSldUIENsYWltcyByZWdpc3RyeSAodGhhdCBp cywgdW5sZXNzIHRoZXkgcGxhbiB0byBiZSBub24tY29uZm9ybWluZyB3aXRoIHRoZSByZWdpc3Rl cmVkIGNsYWltcyB1c2FnZXMpLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBFcmljIFJlc2NvcmxhIDxla3JA cnRmbS5jb20+DQpTZW50OiBNb25kYXksIE1heSA3LCAyMDE4IDk6NDcgQU0NClRvOiBNaWtlIEpv bmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+DQpDYzogUGhpbCBIdW50IDxwaGlsLmh1 bnRAeWFob28uY29tPjsgVGhlIElFU0cgPGllc2dAaWV0Zi5vcmc+OyBzZWNldmVudC1jaGFpcnNA aWV0Zi5vcmc7IHlhcm9uZi5pZXRmQGdtYWlsLmNvbTsgZHJhZnQtaWV0Zi1zZWNldmVudC10b2tl bkBpZXRmLm9yZzsgaWQtZXZlbnRAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBFcmljIFJlc2Nvcmxh J3MgTm8gT2JqZWN0aW9uIG9uIGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMTA6ICh3aXRoIENP TU1FTlQpDQoNCg0KDQpPbiBNb24sIE1heSA3LCAyMDE4IGF0IDk6MjIgQU0sIE1pa2UgSm9uZXMg PE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPj4gd3JvdGU6DQpIaSBFS1IsDQoNCllvdSB3cm90ZToNCj4gV2h5IGRvbid0IHlvdSBp bmNsdWRlIHNvbWUgY2xhaW0gdGhhdCBtYWtlcyB0aGVzZSB1bmFtYmlndW91c2x5IFNFVHM/DQo+ IFRoYXQgd291bGQgYXQgbGVhc3QgcHJldmVudCBvbmUgZGlyZWN0aW9uYWwgY29uZnVzaW9uLg0K DQpBY3R1YWxseSwgdGhlIHJlcXVpcmVkICJldmVudHMiIGNsYWltIG1ha2VzIGEgSldUIHVuYW1i aWd1b3VzbHkgYSBTRVQuICBTbyB5b3VyIHN1Z2dlc3Rpb24gaXMgYWxyZWFkeSBzYXRpc2ZpZWQg Ynkgbm9ybWF0aXZlIHRleHQgaW4gdGhlIHNwZWNpZmljYXRpb24uDQoNCk1pZ2h0IGl0IGJlIHdv cnRoIG1ha2luZyB0aGlzIHBvaW50IHNsaWdodGx5IG1vcmUgc2hhcnBseT8NCg0KV2l0aCB0aGF0 IHNhaWQsIGlzbid0IGl0IHBvc3NpYmxlIG90aGVyIHNwZWNpZmljYXRpb25zIG1pZ2h0IGRlZmlu ZSAiZXZlbnRzIj8NCg0KLUVrcg0KDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg VGhhbmtzIGFnYWluLA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoN Ci0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBQaGlsIEh1bnQgPHBoaWwuaHVudEB5 YWhvby5jb208bWFpbHRvOnBoaWwuaHVudEB5YWhvby5jb20+Pg0KU2VudDogU3VuZGF5LCBNYXkg NiwgMjAxOCAzOjU3IFBNDQpUbzogRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPG1haWx0bzpl a3JAcnRmbS5jb20+Pg0KQ2M6IFRoZSBJRVNHIDxpZXNnQGlldGYub3JnPG1haWx0bzppZXNnQGll dGYub3JnPj47IHNlY2V2ZW50LWNoYWlyc0BpZXRmLm9yZzxtYWlsdG86c2VjZXZlbnQtY2hhaXJz QGlldGYub3JnPjsgeWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0bzp5YXJvbmYuaWV0ZkBnbWFp bC5jb20+OyBkcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuQGlldGYub3JnPG1haWx0bzpkcmFmdC1p ZXRmLXNlY2V2ZW50LXRva2VuQGlldGYub3JnPjsgaWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlk LWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6IEVyaWMgUmVzY29ybGEncyBObyBPYmplY3Rp b24gb24gZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0xMDogKHdpdGggQ09NTUVOVCkNCg0KRXJp YywNCg0KVGhhbmtzIGZvciB0aGUgZ3JlYXQgY29tbWVudHMsIG15IHJlc3BvbnNlcyBpbiBsaW5l Lg0KDQpNaWtlIGNhbiB5b3UgYW5zd2VyIHRoZSBkaXNhbWJpZ3VhdGlvbiBxdWVzdGlvbj8NCg0K UGhpbA0KDQo+IE9uIE1heSA2LCAyMDE4LCBhdCAzOjMxIFBNLCBFcmljIFJlc2NvcmxhIDxla3JA cnRmbS5jb208bWFpbHRvOmVrckBydGZtLmNvbT4+IHdyb3RlOg0KPg0KPiBFcmljIFJlc2Nvcmxh IGhhcyBlbnRlcmVkIHRoZSBmb2xsb3dpbmcgYmFsbG90IHBvc2l0aW9uIGZvcg0KPiBkcmFmdC1p ZXRmLXNlY2V2ZW50LXRva2VuLTEwOiBObyBPYmplY3Rpb24NCj4NCj4gV2hlbiByZXNwb25kaW5n LCBwbGVhc2Uga2VlcCB0aGUgc3ViamVjdCBsaW5lIGludGFjdCBhbmQgcmVwbHkgdG8gYWxsDQo+ IGVtYWlsIGFkZHJlc3NlcyBpbmNsdWRlZCBpbiB0aGUgVG8gYW5kIENDIGxpbmVzLiAoRmVlbCBm cmVlIHRvIGN1dA0KPiB0aGlzIGludHJvZHVjdG9yeSBwYXJhZ3JhcGgsIGhvd2V2ZXIuKQ0KPg0K Pg0KPiBQbGVhc2UgcmVmZXIgdG8NCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaWVzZy9zdGF0ZW1l bnQvZGlzY3Vzcy1jcml0ZXJpYS5odG1sDQo+IGZvciBtb3JlIGluZm9ybWF0aW9uIGFib3V0IElF U0cgRElTQ1VTUyBhbmQgQ09NTUVOVCBwb3NpdGlvbnMuDQo+DQo+DQo+IFRoZSBkb2N1bWVudCwg YWxvbmcgd2l0aCBvdGhlciBiYWxsb3QgcG9zaXRpb25zLCBjYW4gYmUgZm91bmQgaGVyZToNCj4g aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1zZWNldmVudC10b2tl bi8NCj4NCj4NCj4NCj4gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KPiBDT01NRU5UOg0KPiAtLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t DQo+DQo+IFJpY2ggdmVyc2lvbiBvZiB0aGlzIHJldmlldyBhdDoNCj4gaHR0cHM6Ly9tb3pwaGFi LWlldGYuZGV2c3ZjZGV2Lm1vemF3cy5uZXQvRDQyMTANCj4NCj4NCj4NCj4gSU1QT1JUQU5UDQo+ IFMgMi4yLg0KPj4gICAgICAgICogIGEgVVJJIHJlcHJlc2VudGluZyBhIHVzZXIgcmVzb3VyY2Ug dGhhdCB3YXMgbW9kaWZpZWQ7IG9yLA0KPj4NCj4+ICAgICAgICAqICBhIHRva2VuIGlkZW50aWZp ZXIgKGUuZy4gImp0aSIpIGZvciBhIHJldm9rZWQgdG9rZW4uDQo+Pg0KPj4gICAgICAgIElmIHVz ZWQsIHRoZSBwcm9maWxpbmcgc3BlY2lmaWNhdGlvbiBTSE9VTEQgZGVmaW5lIHRoZSBjb250ZW50 IGFuZA0KPj4gICAgICAgIGZvcm1hdCBzZW1hbnRpY3MgZm9yIHRoZSB2YWx1ZS4gIFRoaXMgY2xh aW0gaXMgT1BUSU9OQUwsIGFzDQo+PiB0aGUNCj4NCj4gRG9lc24ndCB0aGlzIG5lZWQgdG8gYmUg YSBNVVNUIGZvciBpbnRlcm9wZXJhYmlsaXR5Pw0KDQpBZ3JlZWQuIEFsc28gcGVyIHlvdXIgY29t bWVudCBiZWxvdy4NCj4NCj4NCj4gUyA0Lg0KPj4gICAgICAgIHByZXNlbnQgYnV0IHJlcXVpcmUg dGhhdCBhbGwgYmUgdW5kZXJzdG9vZCBpZiB0aGUgU0VUIGlzIHRvIGJlDQo+PiAgICAgICAgYWNj ZXB0ZWQuICBTb21lIHByb2ZpbGVzIG1pZ2h0IHJlcXVpcmUgdGhhdCBvbmx5IGEgc2luZ2xlIHZh bHVlIGJlDQo+PiAgICAgICAgcHJlc2VudC4gIEFsbCBzdWNoIGNob2ljZXMgYXJlIHdpdGhpbiB0 aGUgc2NvcGUgb2YgcHJvZmlsaW5nDQo+PiAgICAgICAgc3BlY2lmaWNhdGlvbnMgdG8gZGVmaW5l Lg0KPj4NCj4+ICA0LiAgUHJldmVudGluZyBDb25mdXNpb24gYmV0d2VlbiBTRVRzIGFuZCBvdGhl ciBKV1RzDQo+DQo+IFdoeSBkb24ndCB5b3UgaW5jbHVkZSBzb21lIGNsYWltIHRoYXQgbWFrZXMg dGhlc2UgdW5hbWJpZ3VvdXNseSBTRVRzPw0KPiBUaGF0IHdvdWxkIGF0IGxlYXN0IHByZXZlbnQg b25lIGRpcmVjdGlvbmFsIGNvbmZ1c2lvbi4NCg0KSSB3aWxsIGxlYXZlIE1pa2UgdG8gY29tbWVu dCBoZXJlLg0KPg0KPiBDT01NRU5UUw0KPiBTIDIuMi4NCj4+DQo+PiAgICAgImlzcyIgKElzc3Vl cikgQ2xhaW0NCj4+ICAgICAgICBBcyBkZWZpbmVkIGJ5IFNlY3Rpb24gNC4xLjEgb2YgW1JGQzc1 MTldLCB0aGlzIGNsYWltIGNvbnRhaW5zIGENCj4+ICAgICAgICBzdHJpbmcgaWRlbnRpZnlpbmcg dGhlIHNlcnZpY2UgcHJvdmlkZXIgcHVibGlzaGluZyB0aGUgU0VUICh0aGUNCj4+ICAgICAgICBp c3N1ZXIpLiAgSW4gc29tZSBjYXNlcywgdGhlIFNFVCBpc3N1ZXIgaXMgbm90IHRoZSBpc3N1ZXIg b2YgdGhlDQo+PiAgICAgICAgc2VjdXJpdHkgc3ViamVjdC4gIFRoZXJlZm9yZSwgaW1wbGVtZW50 ZXJzIGNhbm5vdCBhc3N1bWUgdGhhdA0KPj4gdGhlDQo+DQo+IEkgYW0gaGF2aW5nIGEgaGFyZCB0 aW1lIHJlYWRpbmcgdGhpcyB0ZXh0LiBXaGF0IGRvIHlvdSBtZWFuICJpc3N1ZSBvcg0KPiBzZWN1 cml0eSBzdWJqZWN0PyINCg0K4oCcaXNzdWVyIG9mIHRoZSBzZWN1cml0eSBzdWJqZWN04oCdIG5v dCDigJhvcuKAmS4NCg0KSldUIGhhcyBhIHVzYWdlIHBhdHRlcm4gd2hlcmUgaXNzIG9mIHRoZSBh c3NlcnRpb24gaXMgdGhlIHNhbWUgaXNzdWVyIG9mIHRoZSBzdWJqZWN0Lg0KDQpJbiBTRVQgYW4g aXNzdWVyIG1heSB3aXNoIHRvIHRhbGsgYWJvdXQgc29tZW9uZSBlbHNlJ3Mgc3ViamVjdC4gSGVu Y2UgdGhlIGlzc3VlciBvZiB0aGUgc3ViamVjdCBpcyBub3QgdGhlIGlzc3VlciBvZiB0aGUgc2Vj dXJpdHkgdG9rZW4gYXNzZXJ0aW9uLg0KDQpJZiB5b3UgbGlrZSwgSSBhbSBoYXBweSB0byB3b3Jr IG9uIHRoZSB0ZXh0IHNvbWUgbW9yZS4NCj4NCj4NCj4gUyAzLg0KPj4gICAgICAgIFByb2ZpbGlu ZyBzcGVjaWZpY2F0aW9ucyBNVVNUIGRlZmluZSBob3cgdGhlIGV2ZW50IHN1YmplY3QgaXMNCj4+ ICAgICAgICBpZGVudGlmaWVkIGluIHRoZSBTRVQsIGFzIHdlbGwgYXMgaG93IHRvIGRpZmZlcmVu dGlhdGUgYmV0d2VlbiB0aGUNCj4+ICAgICAgICBldmVudCBzdWJqZWN0J3MgaXNzdWVyIGFuZCB0 aGUgU0VUIGlzc3VlciwgaWYgYXBwbGljYWJsZS4gIEl0IGlzDQo+PiAgICAgICAgTk9UIFJFQ09N TUVOREVEIGZvciBwcm9maWxpbmcgc3BlY2lmaWNhdGlvbnMgdG8gdXNlIHRoZSAic3ViIg0KPj4g ICAgICAgIGNsYWltIGluIGNhc2VzIGluIHdoaWNoIHRoZSBzdWJqZWN0IGlzIG5vdCBnbG9iYWxs eSB1bmlxdWUgYW5kIGhhcw0KPj4gICAgICAgIGEgZGlmZmVyZW50IGlzc3VlciBmcm9tIHRoZSBT RVQgaXRzZWxmLg0KPg0KPiBEb2Vzbid0IHRoaXMgY29udHJhZGljdCB0aGUgU0hPVUxEIGkgY2Fs bGVkIG91dCBhYm92ZT8NCg0KQWdyZWVkLiBXaWxsIGNoYW5nZSBwZXIgYWJvdmUgc3VnZ2VzdGlv bi4NCj4NCj4NCj4gUyA1LjEuDQo+PiAgICAgcGVyc29uYWxseSBpZGVudGlmaWFibGUgaW5mb3Jt YXRpb24gU0hPVUxEIGJlIGVuY3J5cHRlZCB1c2luZyBKV0UNCj4+ICAgICBbUkZDNzUxNl0gb3Ig c2VjdXJlZCBmb3IgY29uZmlkZW50aWFsaXR5IGJ5IG90aGVyIG1lYW5zLg0KPj4NCj4+ICAgICBV bmxlc3MgaW50ZWdyaXR5IG9mIHRoZSBKV1QgaXMgZW5zdXJlZCBieSBvdGhlciBtZWFucywgaXQg TVVTVCBiZQ0KPj4gICAgIHNpZ25lZCB1c2luZyBKV1MgW1JGQzc1MTVdIHNvIHRoYXQgdGhlIFNF VCBjYW4gYmUgYXV0aGVudGljYXRlZCBhbmQNCj4+ICAgICB2YWxpZGF0ZWQgYnkgdGhlIFNFVCBy ZWNpcGllbnQuDQo+DQo+IFRoaXMgTVVTVCBzZWVtcyBsZXNzIGhlbHBmdWwgdGhhbiBpdCB3b3Vs ZCBvdGhlcndpc2UgYmUgYmVjYXVzZSBpdA0KPiBkb2Vzbid0IHNwZWNpZnkgd2hhdCBhIHZhbGlk IHNpZ25lciBpcy4NCg0KV2lsbCByZWZlcmVuY2UgdGhlIGFwcHJvcHJpYXRlIHNlY3Rpb24gaW4g NzUxNS4NCj4NCj4NCj4gUyA1LjQuDQo+PiAgICAgV2hlbiBTRVRzIGFyZSBkZWxpdmVyZWQgYXN5 bmNocm9ub3VzbHkgYW5kL29yIG91dC1vZi1iYW5kIHdpdGgNCj4+ICAgICByZXNwZWN0IHRvIHRo ZSBvcmlnaW5hbCBhY3Rpb24gdGhhdCBpbmN1cnJlZCB0aGUgc2VjdXJpdHkgZXZlbnQsIGl0DQo+ PiAgICAgaXMgaW1wb3J0YW50IHRvIGNvbnNpZGVyIHRoYXQgYSBTRVQgbWlnaHQgYmUgZGVsaXZl cmVkIHRvIGEgU0VUDQo+PiAgICAgcmVjaXBpZW50IGluIGFkdmFuY2Ugb2Ygb3IgYmVoaW5kIHRo ZSBwcm9jZXNzIHRoYXQgY2F1c2VkIHRoZSBldmVudC4NCj4+ICAgICBGb3IgZXhhbXBsZSwgYSB1 c2VyIGhhdmluZyBiZWVuIHJlcXVpcmVkIHRvIGxvZyBvdXQgYW5kIHRoZW4gbG9nIGJhY2sNCj4+ ICAgICBpbiBhZ2FpbiwgbWF5IGNhdXNlIGEgdG9rZW4gcmV2b2tlZCBTRVQgdG8gYmUgaXNzdWVk LCB0eXBpY2FsbHkNCj4NCj4gTWlnaHQgYmUgY2xlYXJlciB0byBxdW90ZSAidG9rZW4gcmV2b2tl ZCINCg0KV2lsbCBkby4NCj4NCj4NCg0K --_000_BL0PR00MB0292ADA43ADB5B86CCCAC227F59B0BL0PR00MB0292namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNvbm9y bWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNv bm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJ bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6 ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFp bFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFy Z2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpX b3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNo YXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRp Zl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0 Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0Pjwv eG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUi IHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5XZSBjYW4gbG9vayBhdCBiZWVm aW5nIHVwIHRoaXMgc3RhdGVtZW50LCBhcyB5b3Ugc3VnZ2VzdCDigJMgcHJvYmFibHkgc29tZXdo ZXJlIGluIFNlY3Rpb24gNCAoPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj5QcmV2ZW50aW5nIENvbmZ1c2lvbiBiZXR3 ZWVuIFNFVHMgYW5kIG90aGVyIEpXVHM8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PikuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5PdGhlciBzcGVjaWZpY2F0 aW9ucyBjYW5ub3QgZGVmaW5lIOKAnGV2ZW50c+KAnSBiZWNhdXNlIHRoaXMgc3BlY2lmaWNhdGlv biByZWdpc3RlcnMg4oCcZXZlbnRz4oCdIGluIHRoZSBJQU5BIEpXVCBDbGFpbXMgcmVnaXN0cnkg KHRoYXQgaXMsIHVubGVzcyB0aGV5IHBsYW4gdG8gYmUgbm9uLWNvbmZvcm1pbmcgd2l0aCB0aGUg cmVnaXN0ZXJlZCBjbGFpbXMgdXNhZ2VzKS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMw MDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPkZyb206PC9iPiBFcmljIFJlc2NvcmxhICZsdDtla3JAcnRmbS5jb20mZ3Q7IDxi cj4NCjxiPlNlbnQ6PC9iPiBNb25kYXksIE1heSA3LCAyMDE4IDk6NDcgQU08YnI+DQo8Yj5Ubzo8 L2I+IE1pa2UgSm9uZXMgJmx0O01pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSZndDs8YnI+DQo8 Yj5DYzo8L2I+IFBoaWwgSHVudCAmbHQ7cGhpbC5odW50QHlhaG9vLmNvbSZndDs7IFRoZSBJRVNH ICZsdDtpZXNnQGlldGYub3JnJmd0Ozsgc2VjZXZlbnQtY2hhaXJzQGlldGYub3JnOyB5YXJvbmYu aWV0ZkBnbWFpbC5jb207IGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW5AaWV0Zi5vcmc7IGlkLWV2 ZW50QGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBFcmljIFJlc2NvcmxhJ3MgTm8g T2JqZWN0aW9uIG9uIGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMTA6ICh3aXRoIENPTU1FTlQp PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBNb24sIE1heSA3LCAyMDE4IGF0IDk6MjIgQU0sIE1pa2Ug Sm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRh cmdldD0iX2JsYW5rIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8 bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVm dDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxl ZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBFS1Is PGJyPg0KPGJyPg0KWW91IHdyb3RlOjxicj4NCiZndDsgV2h5IGRvbid0IHlvdSBpbmNsdWRlIHNv bWUgY2xhaW0gdGhhdCBtYWtlcyB0aGVzZSB1bmFtYmlndW91c2x5IFNFVHM/PGJyPg0KJmd0OyBU aGF0IHdvdWxkIGF0IGxlYXN0IHByZXZlbnQgb25lIGRpcmVjdGlvbmFsIGNvbmZ1c2lvbi48YnI+ DQo8YnI+DQpBY3R1YWxseSwgdGhlIHJlcXVpcmVkICZxdW90O2V2ZW50cyZxdW90OyBjbGFpbSBt YWtlcyBhIEpXVCB1bmFtYmlndW91c2x5IGEgU0VULiZuYnNwOyBTbyB5b3VyIHN1Z2dlc3Rpb24g aXMgYWxyZWFkeSBzYXRpc2ZpZWQgYnkgbm9ybWF0aXZlIHRleHQgaW4gdGhlIHNwZWNpZmljYXRp b24uPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5NaWdodCBpdCBiZSB3b3J0aCBtYWtpbmcgdGhpcyBwb2ludCBzbGlnaHRseSBtb3Jl IHNoYXJwbHk/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPldpdGggdGhhdCBzYWlkLCBpc24ndCBpdCBwb3NzaWJsZSBvdGhlciBzcGVjaWZpY2F0 aW9ucyBtaWdodCBkZWZpbmUgJnF1b3Q7ZXZlbnRzJnF1b3Q7PzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tRWtyPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk ICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCiZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBUaGFua3MgYWdh aW4sPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQotLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLTxicj4NCkZyb206IFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBo aWwuaHVudEB5YWhvby5jb20iPnBoaWwuaHVudEB5YWhvby5jb208L2E+Jmd0OyA8YnI+DQpTZW50 OiBTdW5kYXksIE1heSA2LCAyMDE4IDM6NTcgUE08YnI+DQpUbzogRXJpYyBSZXNjb3JsYSAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmVrckBydGZtLmNvbSI+ZWtyQHJ0Zm0uY29tPC9hPiZndDs8YnI+DQpD YzogVGhlIElFU0cgJmx0OzxhIGhyZWY9Im1haWx0bzppZXNnQGlldGYub3JnIj5pZXNnQGlldGYu b3JnPC9hPiZndDs7IDxhIGhyZWY9Im1haWx0bzpzZWNldmVudC1jaGFpcnNAaWV0Zi5vcmciPg0K c2VjZXZlbnQtY2hhaXJzQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnlhcm9uZi5pZXRm QGdtYWlsLmNvbSI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPjsNCjxhIGhyZWY9Im1haWx0bzpk cmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuQGlldGYub3JnIj5kcmFmdC1pZXRmLXNlY2V2ZW50LXRv a2VuQGlldGYub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyI+aWQt ZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KU3ViamVjdDogUmU6IEVyaWMgUmVzY29ybGEncyBObyBP YmplY3Rpb24gb24gZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0xMDogKHdpdGggQ09NTUVOVCk8 YnI+DQo8YnI+DQpFcmljLCA8YnI+DQo8YnI+DQpUaGFua3MgZm9yIHRoZSBncmVhdCBjb21tZW50 cywgbXkgcmVzcG9uc2VzIGluIGxpbmUuIDxicj4NCjxicj4NCk1pa2UgY2FuIHlvdSBhbnN3ZXIg dGhlIGRpc2FtYmlndWF0aW9uIHF1ZXN0aW9uPzxicj4NCjxicj4NClBoaWw8YnI+DQo8YnI+DQom Z3Q7IE9uIE1heSA2LCAyMDE4LCBhdCAzOjMxIFBNLCBFcmljIFJlc2NvcmxhICZsdDs8YSBocmVm PSJtYWlsdG86ZWtyQHJ0Zm0uY29tIj5la3JAcnRmbS5jb208L2E+Jmd0OyB3cm90ZTo8YnI+DQom Z3Q7IDxicj4NCiZndDsgRXJpYyBSZXNjb3JsYSBoYXMgZW50ZXJlZCB0aGUgZm9sbG93aW5nIGJh bGxvdCBwb3NpdGlvbiBmb3I8YnI+DQomZ3Q7IGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMTA6 IE5vIE9iamVjdGlvbjxicj4NCiZndDsgPGJyPg0KJmd0OyBXaGVuIHJlc3BvbmRpbmcsIHBsZWFz ZSBrZWVwIHRoZSBzdWJqZWN0IGxpbmUgaW50YWN0IGFuZCByZXBseSB0byBhbGwgPGJyPg0KJmd0 OyBlbWFpbCBhZGRyZXNzZXMgaW5jbHVkZWQgaW4gdGhlIFRvIGFuZCBDQyBsaW5lcy4gKEZlZWwg ZnJlZSB0byBjdXQgPGJyPg0KJmd0OyB0aGlzIGludHJvZHVjdG9yeSBwYXJhZ3JhcGgsIGhvd2V2 ZXIuKTxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFBsZWFzZSByZWZlciB0byA8YnI+ DQomZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL2llc2cvc3RhdGVtZW50L2Rpc2N1 c3MtY3JpdGVyaWEuaHRtbCIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcv aWVzZy9zdGF0ZW1lbnQvZGlzY3Vzcy1jcml0ZXJpYS5odG1sPC9hPjxicj4NCiZndDsgZm9yIG1v cmUgaW5mb3JtYXRpb24gYWJvdXQgSUVTRyBESVNDVVNTIGFuZCBDT01NRU5UIHBvc2l0aW9ucy48 YnI+DQomZ3Q7IDxicj4NCiZndDsgPGJyPg0KJmd0OyBUaGUgZG9jdW1lbnQsIGFsb25nIHdpdGgg b3RoZXIgYmFsbG90IHBvc2l0aW9ucywgY2FuIGJlIGZvdW5kIGhlcmU6PGJyPg0KJmd0OyA8YSBo cmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLXNlY2V2ZW50 LXRva2VuLyIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9k b2MvZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi88L2E+PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDxi cj4NCiZndDsgPGJyPg0KJmd0OyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPGJyPg0KJmd0OyBDT01NRU5UOjxicj4N CiZndDsgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLTxicj4NCiZndDsgPGJyPg0KJmd0OyBSaWNoIHZlcnNpb24gb2Yg dGhpcyByZXZpZXcgYXQ6PGJyPg0KJmd0OyA8YSBocmVmPSJodHRwczovL21venBoYWItaWV0Zi5k ZXZzdmNkZXYubW96YXdzLm5ldC9ENDIxMCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vbW96cGhh Yi1pZXRmLmRldnN2Y2Rldi5tb3phd3MubmV0L0Q0MjEwPC9hPjxicj4NCiZndDsgPGJyPg0KJmd0 OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsgSU1QT1JUQU5UPGJyPg0KJmd0OyBTIDIuMi48YnI+DQom Z3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAqJm5ic3A7IGEgVVJJIHJlcHJlc2Vu dGluZyBhIHVzZXIgcmVzb3VyY2UgdGhhdCB3YXMgbW9kaWZpZWQ7IG9yLDxicj4NCiZndDsmZ3Q7 IDxicj4NCiZndDsmZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICombmJzcDsgYSB0b2tl biBpZGVudGlmaWVyIChlLmcuICZxdW90O2p0aSZxdW90OykgZm9yIGEgcmV2b2tlZCB0b2tlbi48 YnI+DQomZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBJ ZiB1c2VkLCB0aGUgcHJvZmlsaW5nIHNwZWNpZmljYXRpb24gU0hPVUxEIGRlZmluZSB0aGUgY29u dGVudCBhbmQ8YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBmb3JtYXQg c2VtYW50aWNzIGZvciB0aGUgdmFsdWUuJm5ic3A7IFRoaXMgY2xhaW0gaXMgT1BUSU9OQUwsIGFz IDxicj4NCiZndDsmZ3Q7IHRoZTxicj4NCiZndDsgPGJyPg0KJmd0OyBEb2Vzbid0IHRoaXMgbmVl ZCB0byBiZSBhIE1VU1QgZm9yIGludGVyb3BlcmFiaWxpdHk/PGJyPg0KPGJyPg0KQWdyZWVkLiBB bHNvIHBlciB5b3VyIGNvbW1lbnQgYmVsb3cuIDxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQom Z3Q7IFMgNC48YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBwcmVzZW50 IGJ1dCByZXF1aXJlIHRoYXQgYWxsIGJlIHVuZGVyc3Rvb2QgaWYgdGhlIFNFVCBpcyB0byBiZTxi cj4NCiZndDsmZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IGFjY2VwdGVkLiZuYnNwOyBT b21lIHByb2ZpbGVzIG1pZ2h0IHJlcXVpcmUgdGhhdCBvbmx5IGEgc2luZ2xlIHZhbHVlIGJlPGJy Pg0KJmd0OyZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgcHJlc2VudC4mbmJzcDsgQWxs IHN1Y2ggY2hvaWNlcyBhcmUgd2l0aGluIHRoZSBzY29wZSBvZiBwcm9maWxpbmc8YnI+DQomZ3Q7 Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBzcGVjaWZpY2F0aW9ucyB0byBkZWZpbmUu PGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsmbmJzcDsgNC4mbmJzcDsgUHJldmVudGluZyBD b25mdXNpb24gYmV0d2VlbiBTRVRzIGFuZCBvdGhlciBKV1RzPGJyPg0KJmd0OyA8YnI+DQomZ3Q7 IFdoeSBkb24ndCB5b3UgaW5jbHVkZSBzb21lIGNsYWltIHRoYXQgbWFrZXMgdGhlc2UgdW5hbWJp Z3VvdXNseSBTRVRzPzxicj4NCiZndDsgVGhhdCB3b3VsZCBhdCBsZWFzdCBwcmV2ZW50IG9uZSBk aXJlY3Rpb25hbCBjb25mdXNpb24uPGJyPg0KPGJyPg0KSSB3aWxsIGxlYXZlIE1pa2UgdG8gY29t bWVudCBoZXJlLiA8YnI+DQomZ3Q7IDxicj4NCiZndDsgQ09NTUVOVFM8YnI+DQomZ3Q7IFMgMi4y Ljxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtp c3MmcXVvdDsgKElzc3VlcikgQ2xhaW08YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyBBcyBkZWZpbmVkIGJ5IFNlY3Rpb24gNC4xLjEgb2YgW1JGQzc1MTldLCB0aGlzIGNs YWltIGNvbnRhaW5zIGE8YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBz dHJpbmcgaWRlbnRpZnlpbmcgdGhlIHNlcnZpY2UgcHJvdmlkZXIgcHVibGlzaGluZyB0aGUgU0VU ICh0aGU8YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBpc3N1ZXIpLiZu YnNwOyBJbiBzb21lIGNhc2VzLCB0aGUgU0VUIGlzc3VlciBpcyBub3QgdGhlIGlzc3VlciBvZiB0 aGU8YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBzZWN1cml0eSBzdWJq ZWN0LiZuYnNwOyBUaGVyZWZvcmUsIGltcGxlbWVudGVycyBjYW5ub3QgYXNzdW1lIHRoYXQgPGJy Pg0KJmd0OyZndDsgdGhlPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEkgYW0gaGF2aW5nIGEgaGFyZCB0 aW1lIHJlYWRpbmcgdGhpcyB0ZXh0LiBXaGF0IGRvIHlvdSBtZWFuICZxdW90O2lzc3VlIG9yIDxi cj4NCiZndDsgc2VjdXJpdHkgc3ViamVjdD8mcXVvdDs8YnI+DQo8YnI+DQrigJxpc3N1ZXIgb2Yg dGhlIHNlY3VyaXR5IHN1YmplY3TigJ0gbm90IOKAmG9y4oCZLiA8YnI+DQo8YnI+DQpKV1QgaGFz IGEgdXNhZ2UgcGF0dGVybiB3aGVyZSBpc3Mgb2YgdGhlIGFzc2VydGlvbiBpcyB0aGUgc2FtZSBp c3N1ZXIgb2YgdGhlIHN1YmplY3QuDQo8YnI+DQo8YnI+DQpJbiBTRVQgYW4gaXNzdWVyIG1heSB3 aXNoIHRvIHRhbGsgYWJvdXQgc29tZW9uZSBlbHNlJ3Mgc3ViamVjdC4gSGVuY2UgdGhlIGlzc3Vl ciBvZiB0aGUgc3ViamVjdCBpcyBub3QgdGhlIGlzc3VlciBvZiB0aGUgc2VjdXJpdHkgdG9rZW4g YXNzZXJ0aW9uLg0KPGJyPg0KPGJyPg0KSWYgeW91IGxpa2UsIEkgYW0gaGFwcHkgdG8gd29yayBv biB0aGUgdGV4dCBzb21lIG1vcmUuJm5ic3A7IDxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQom Z3Q7IFMgMy48YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBQcm9maWxp bmcgc3BlY2lmaWNhdGlvbnMgTVVTVCBkZWZpbmUgaG93IHRoZSBldmVudCBzdWJqZWN0IGlzPGJy Pg0KJmd0OyZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgaWRlbnRpZmllZCBpbiB0aGUg U0VULCBhcyB3ZWxsIGFzIGhvdyB0byBkaWZmZXJlbnRpYXRlIGJldHdlZW4gdGhlPGJyPg0KJmd0 OyZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgZXZlbnQgc3ViamVjdCdzIGlzc3VlciBh bmQgdGhlIFNFVCBpc3N1ZXIsIGlmIGFwcGxpY2FibGUuJm5ic3A7IEl0IGlzPGJyPg0KJmd0OyZn dDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgTk9UIFJFQ09NTUVOREVEIGZvciBwcm9maWxp bmcgc3BlY2lmaWNhdGlvbnMgdG8gdXNlIHRoZSAmcXVvdDtzdWImcXVvdDs8YnI+DQomZ3Q7Jmd0 OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBjbGFpbSBpbiBjYXNlcyBpbiB3aGljaCB0aGUg c3ViamVjdCBpcyBub3QgZ2xvYmFsbHkgdW5pcXVlIGFuZCBoYXM8YnI+DQomZ3Q7Jmd0OyZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBhIGRpZmZlcmVudCBpc3N1ZXIgZnJvbSB0aGUgU0VUIGl0 c2VsZi48YnI+DQomZ3Q7IDxicj4NCiZndDsgRG9lc24ndCB0aGlzIGNvbnRyYWRpY3QgdGhlIFNI T1VMRCBpIGNhbGxlZCBvdXQgYWJvdmU/PGJyPg0KPGJyPg0KQWdyZWVkLiBXaWxsIGNoYW5nZSBw ZXIgYWJvdmUgc3VnZ2VzdGlvbi4gPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsgUyA1 LjEuPGJyPg0KJmd0OyZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO3BlcnNvbmFsbHkgaWRlbnRpZmlh YmxlIGluZm9ybWF0aW9uIFNIT1VMRCBiZSBlbmNyeXB0ZWQgdXNpbmcgSldFPGJyPg0KJmd0OyZn dDsmbmJzcDsgJm5ic3A7ICZuYnNwO1tSRkM3NTE2XSBvciBzZWN1cmVkIGZvciBjb25maWRlbnRp YWxpdHkgYnkgb3RoZXIgbWVhbnMuPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsmbmJzcDsg Jm5ic3A7ICZuYnNwO1VubGVzcyBpbnRlZ3JpdHkgb2YgdGhlIEpXVCBpcyBlbnN1cmVkIGJ5IG90 aGVyIG1lYW5zLCBpdCBNVVNUIGJlPGJyPg0KJmd0OyZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO3Np Z25lZCB1c2luZyBKV1MgW1JGQzc1MTVdIHNvIHRoYXQgdGhlIFNFVCBjYW4gYmUgYXV0aGVudGlj YXRlZCBhbmQ8YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7dmFsaWRhdGVkIGJ5IHRo ZSBTRVQgcmVjaXBpZW50Ljxicj4NCiZndDsgPGJyPg0KJmd0OyBUaGlzIE1VU1Qgc2VlbXMgbGVz cyBoZWxwZnVsIHRoYW4gaXQgd291bGQgb3RoZXJ3aXNlIGJlIGJlY2F1c2UgaXQgPGJyPg0KJmd0 OyBkb2Vzbid0IHNwZWNpZnkgd2hhdCBhIHZhbGlkIHNpZ25lciBpcy48YnI+DQo8YnI+DQpXaWxs IHJlZmVyZW5jZSB0aGUgYXBwcm9wcmlhdGUgc2VjdGlvbiBpbiA3NTE1LiA8YnI+DQomZ3Q7IDxi cj4NCiZndDsgPGJyPg0KJmd0OyBTIDUuNC48YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5i c3A7V2hlbiBTRVRzIGFyZSBkZWxpdmVyZWQgYXN5bmNocm9ub3VzbHkgYW5kL29yIG91dC1vZi1i YW5kIHdpdGg8YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7cmVzcGVjdCB0byB0aGUg b3JpZ2luYWwgYWN0aW9uIHRoYXQgaW5jdXJyZWQgdGhlIHNlY3VyaXR5IGV2ZW50LCBpdDxicj4N CiZndDsmZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDtpcyBpbXBvcnRhbnQgdG8gY29uc2lkZXIgdGhh dCBhIFNFVCBtaWdodCBiZSBkZWxpdmVyZWQgdG8gYSBTRVQ8YnI+DQomZ3Q7Jmd0OyZuYnNwOyAm bmJzcDsgJm5ic3A7cmVjaXBpZW50IGluIGFkdmFuY2Ugb2Ygb3IgYmVoaW5kIHRoZSBwcm9jZXNz IHRoYXQgY2F1c2VkIHRoZSBldmVudC48YnI+DQomZ3Q7Jmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7 Rm9yIGV4YW1wbGUsIGEgdXNlciBoYXZpbmcgYmVlbiByZXF1aXJlZCB0byBsb2cgb3V0IGFuZCB0 aGVuIGxvZyBiYWNrPGJyPg0KJmd0OyZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO2luIGFnYWluLCBt YXkgY2F1c2UgYSB0b2tlbiByZXZva2VkIFNFVCB0byBiZSBpc3N1ZWQsIHR5cGljYWxseTxicj4N CiZndDsgPGJyPg0KJmd0OyBNaWdodCBiZSBjbGVhcmVyIHRvIHF1b3RlICZxdW90O3Rva2VuIHJl dm9rZWQmcXVvdDs8YnI+DQo8YnI+DQpXaWxsIGRvLiA8YnI+DQomZ3Q7IDxicj4NCiZndDsgPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_BL0PR00MB0292ADA43ADB5B86CCCAC227F59B0BL0PR00MB0292namp_-- From nobody Mon May 7 09:53:33 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E21B51270A3; Mon, 7 May 2018 09:53:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.721 X-Spam-Level: X-Spam-Status: No, score=-0.721 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IFmAIuve0dh3; Mon, 7 May 2018 09:53:28 -0700 (PDT) Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88FBB1270AE; Mon, 7 May 2018 09:53:28 -0700 (PDT) Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w47Gp1vA011314; Mon, 7 May 2018 16:53:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=corp-2017-10-26; bh=EnARtNjfE00DFvyq3he8TCe3H5rwwKuuP8wCXU5g04Y=; b=TeC0fuH2ghnWFke0bIg8lG5zkkigYsYHm7Q1JNgPJfDWLlojO4PwJsiYSofkkBxEuZnf ZOFoBPuWY4aOTkYr3zK2pE8iJrYkL8oe2Xdqwdhw1AHGSXnETlOgaIcZkgQPZbuiSGrR uQHgGrQZMzIqhCKgjFuPP0bA2IN3YdLNBFwW2QevNNbykqLEW5mDWs2LdgUmRtdsKrGz QKr6C7FSMcs6cJ+uT77xDdzKPDJ7HlV4Bty4/bif4lCcfu1p7PMd8WI4MynnwBvsc2RI 5XUljfTNunpS+xiACfE7bvK+QzMSdKmH6K65HRD4u0heBAtKBON+w3PHJ/eusZCi25q5 Xg== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp2130.oracle.com with ESMTP id 2hs426d3su-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 07 May 2018 16:53:26 +0000 Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w47GrPYo016836 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 7 May 2018 16:53:25 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w47GrPQ1010386; Mon, 7 May 2018 16:53:25 GMT Received: from [192.168.1.28] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 07 May 2018 09:53:24 -0700 From: Phil Hunt Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_8165E80E-8F76-4B78-9532-1F256886FC62" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Mon, 7 May 2018 09:53:22 -0700 In-Reply-To: Cc: Eric Rescorla , "secevent-chairs@ietf.org" , "yaronf.ietf@gmail.com" , "draft-ietf-secevent-token@ietf.org" , The IESG , "id-event@ietf.org" To: Mike Jones References: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> <6490BDE6-7245-455A-BAAA-7370EAE6414B@yahoo.com> X-Mailer: Apple Mail (2.3445.6.18) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8886 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805070170 Archived-At: Subject: Re: [Id-event] Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 16:53:32 -0000 --Apple-Mail=_8165E80E-8F76-4B78-9532-1F256886FC62 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 +1, I was just going to say the same thing. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On May 7, 2018, at 9:51 AM, Mike Jones = wrote: >=20 > We can look at beefing up this statement, as you suggest =E2=80=93 = probably somewhere in Section 4 (Preventing Confusion between SETs and = other JWTs). > =20 > Other specifications cannot define =E2=80=9Cevents=E2=80=9D because = this specification registers =E2=80=9Cevents=E2=80=9D in the IANA JWT = Claims registry (that is, unless they plan to be non-conforming with the = registered claims usages). > =20 > -- Mike > =20 > From: Eric Rescorla >=20 > Sent: Monday, May 7, 2018 9:47 AM > To: Mike Jones > > Cc: Phil Hunt >; The = IESG >; secevent-chairs@ietf.org = ; yaronf.ietf@gmail.com = ; draft-ietf-secevent-token@ietf.org = ; id-event@ietf.org = > Subject: Re: Eric Rescorla's No Objection on = draft-ietf-secevent-token-10: (with COMMENT) > =20 > =20 > =20 > On Mon, May 7, 2018 at 9:22 AM, Mike Jones = > = wrote: > Hi EKR, >=20 > You wrote: > > Why don't you include some claim that makes these unambiguously = SETs? > > That would at least prevent one directional confusion. >=20 > Actually, the required "events" claim makes a JWT unambiguously a SET. = So your suggestion is already satisfied by normative text in the = specification. > =20 > Might it be worth making this point slightly more sharply? > =20 > With that said, isn't it possible other specifications might define = "events"? > =20 > -Ekr > =20 >=20 > Thanks again, > -- Mike >=20 > -----Original Message----- > From: Phil Hunt >=20 > Sent: Sunday, May 6, 2018 3:57 PM > To: Eric Rescorla > > Cc: The IESG >; = secevent-chairs@ietf.org ; = yaronf.ietf@gmail.com ; = draft-ietf-secevent-token@ietf.org = ; id-event@ietf.org = > Subject: Re: Eric Rescorla's No Objection on = draft-ietf-secevent-token-10: (with COMMENT) >=20 > Eric,=20 >=20 > Thanks for the great comments, my responses in line.=20 >=20 > Mike can you answer the disambiguation question? >=20 > Phil >=20 > > On May 6, 2018, at 3:31 PM, Eric Rescorla > wrote: > >=20 > > Eric Rescorla has entered the following ballot position for > > draft-ietf-secevent-token-10: No Objection > >=20 > > When responding, please keep the subject line intact and reply to = all=20 > > email addresses included in the To and CC lines. (Feel free to cut=20= > > this introductory paragraph, however.) > >=20 > >=20 > > Please refer to=20 > > https://www.ietf.org/iesg/statement/discuss-criteria.html = > > for more information about IESG DISCUSS and COMMENT positions. > >=20 > >=20 > > The document, along with other ballot positions, can be found here: > > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ = > >=20 > >=20 > >=20 > > = ---------------------------------------------------------------------- > > COMMENT: > > = ---------------------------------------------------------------------- > >=20 > > Rich version of this review at: > > https://mozphab-ietf.devsvcdev.mozaws.net/D4210 = > >=20 > >=20 > >=20 > > IMPORTANT > > S 2.2. > >> * a URI representing a user resource that was modified; or, > >>=20 > >> * a token identifier (e.g. "jti") for a revoked token. > >>=20 > >> If used, the profiling specification SHOULD define the = content and > >> format semantics for the value. This claim is OPTIONAL, as=20= > >> the > >=20 > > Doesn't this need to be a MUST for interoperability? >=20 > Agreed. Also per your comment below.=20 > >=20 > >=20 > > S 4. > >> present but require that all be understood if the SET is to = be > >> accepted. Some profiles might require that only a single = value be > >> present. All such choices are within the scope of profiling > >> specifications to define. > >>=20 > >> 4. Preventing Confusion between SETs and other JWTs > >=20 > > Why don't you include some claim that makes these unambiguously = SETs? > > That would at least prevent one directional confusion. >=20 > I will leave Mike to comment here.=20 > >=20 > > COMMENTS > > S 2.2. > >>=20 > >> "iss" (Issuer) Claim > >> As defined by Section 4.1.1 of [RFC7519], this claim = contains a > >> string identifying the service provider publishing the SET = (the > >> issuer). In some cases, the SET issuer is not the issuer of = the > >> security subject. Therefore, implementers cannot assume = that=20 > >> the > >=20 > > I am having a hard time reading this text. What do you mean "issue = or=20 > > security subject?" >=20 > =E2=80=9Cissuer of the security subject=E2=80=9D not =E2=80=98or=E2=80=99= .=20 >=20 > JWT has a usage pattern where iss of the assertion is the same issuer = of the subject.=20 >=20 > In SET an issuer may wish to talk about someone else's subject. Hence = the issuer of the subject is not the issuer of the security token = assertion.=20 >=20 > If you like, I am happy to work on the text some more. =20 > >=20 > >=20 > > S 3. > >> Profiling specifications MUST define how the event subject = is > >> identified in the SET, as well as how to differentiate = between the > >> event subject's issuer and the SET issuer, if applicable. = It is > >> NOT RECOMMENDED for profiling specifications to use the = "sub" > >> claim in cases in which the subject is not globally unique = and has > >> a different issuer from the SET itself. > >=20 > > Doesn't this contradict the SHOULD i called out above? >=20 > Agreed. Will change per above suggestion.=20 > >=20 > >=20 > > S 5.1. > >> personally identifiable information SHOULD be encrypted using = JWE > >> [RFC7516] or secured for confidentiality by other means. > >>=20 > >> Unless integrity of the JWT is ensured by other means, it MUST = be > >> signed using JWS [RFC7515] so that the SET can be authenticated = and > >> validated by the SET recipient. > >=20 > > This MUST seems less helpful than it would otherwise be because it=20= > > doesn't specify what a valid signer is. >=20 > Will reference the appropriate section in 7515.=20 > >=20 > >=20 > > S 5.4. > >> When SETs are delivered asynchronously and/or out-of-band with > >> respect to the original action that incurred the security = event, it > >> is important to consider that a SET might be delivered to a SET > >> recipient in advance of or behind the process that caused the = event. > >> For example, a user having been required to log out and then = log back > >> in again, may cause a token revoked SET to be issued, typically > >=20 > > Might be clearer to quote "token revoked" >=20 > Will do.=20 > >=20 > >=20 >=20 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65ea= pI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3Dh9HmvB9543zWP3c= IMJFTAvV_bSyHSuYaL8cJ3XKbIc4&s=3D-yzzJ5T3VeoP3RJMCKwYfNK_kLlOSIag4rrPEqQNE= Zk&e=3D = --Apple-Mail=_8165E80E-8F76-4B78-9532-1F256886FC62 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 +1, = I was just going to say the same thing.

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 7, 2018, at 9:51 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

We can look at beefing up = this statement, as you suggest =E2=80=93 probably somewhere in Section 4 = (Preventing Confusion between SETs and other JWTs).
 
Other = specifications cannot define =E2=80=9Cevents=E2=80=9D because this = specification registers =E2=80=9Cevents=E2=80=9D in the IANA JWT Claims = registry (that is, unless they plan to be non-conforming with the = registered claims usages).
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;       -- Mike
 
From: Eric Rescorla <ekr@rtfm.com> 
Sent: Monday, May 7, 2018 9:47 = AM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Phil = Hunt <phil.hunt@yahoo.com>; The = IESG <iesg@ietf.org>; secevent-chairs@ietf.org; yaronf.ietf@gmail.com; draft-ietf-secevent-token@ietf.org; id-event@ietf.org
Subject: Re: Eric Rescorla's No = Objection on draft-ietf-secevent-token-10: (with COMMENT)
 
 
 
On Mon, May 7, 2018 at = 9:22 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:
Hi EKR,

You wrote:
> Why don't you include some = claim that makes these unambiguously SETs?
> That would = at least prevent one directional confusion.

Actually, the required "events" claim makes a JWT = unambiguously a SET.  So your suggestion is already satisfied by = normative text in the specification.
 
Might it be worth making this point = slightly more sharply?
 
With that said, isn't it possible other specifications might = define "events"?
 
-Ekr
 

                =                 Thanks again,
                =                 -- Mike


-----Original = Message-----
From: Phil Hunt <phil.hunt@yahoo.com> 
Sent: = Sunday, May 6, 2018 3:57 PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: The IESG = <iesg@ietf.org>; secevent-chairs@ietf.org; yaronf.ietf@gmail.com; draft-ietf-secevent-token@ietf.org; id-event@ietf.org
Subject: Re: Eric Rescorla's No Objection on = draft-ietf-secevent-token-10: (with COMMENT)

Eric, 

Thanks for the great comments, my responses in = line. 
Mike can you answer the disambiguation question?

Phil

> On May = 6, 2018, at 3:31 PM, Eric Rescorla <ekr@rtfm.com> wrote:
> 
> Eric = Rescorla has entered the following ballot position for
> = draft-ietf-secevent-token-10: No Objection
> 
> When = responding, please keep the subject line intact and reply to all 
> email = addresses included in the To and CC lines. (Feel free to cut 
> this = introductory paragraph, however.)
> 
> 
> Please = refer to 
> https://www.ietf.org/iesg/statement/discuss-criteria.html> for more information about IESG DISCUSS and COMMENT = positions.
> 
> 
> The = document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/=
> 
> 
> 
> = ----------------------------------------------------------------------
> COMMENT:
> = ----------------------------------------------------------------------
> 
> Rich version of this review at:
> https://mozphab-ietf.devsvcdev.mozaws.net/D4210
> 
> 
> 
> IMPORTANT
> S 2.2.
>>        *  a URI = representing a user resource that was modified; or,
>> 
>>        *  a token = identifier (e.g. "jti") for a revoked token.
>> 
>> =       If used, the profiling specification SHOULD define = the content and
>>        format = semantics for the value.  This claim is OPTIONAL, as 
>> = the
> 
> Doesn't = this need to be a MUST for interoperability?

Agreed. Also per your comment below. 
> 
> 
> S 4.
>>        present but require that = all be understood if the SET is to be
>>  =       accepted.  Some profiles might require that = only a single value be
>>        = present.  All such choices are within the scope of profiling
>>        specifications to = define.
>> 
>> = 4.  Preventing Confusion between SETs and other JWTs
> 
> Why don't you include some claim that makes these = unambiguously SETs?
> That would at least prevent one = directional confusion.

I will leave Mike to = comment here. 
> 
> COMMENTS
> S 2.2.
>> 
>>     "iss" (Issuer) Claim
>>        As defined by Section = 4.1.1 of [RFC7519], this claim contains a
>>  =       string identifying the service provider publishing = the SET (the
>>        = issuer).  In some cases, the SET issuer is not the issuer of the
>>        security subject.  = Therefore, implementers cannot assume that 
>> = the
> 
> I am = having a hard time reading this text. What do you mean "issue or 
> = security subject?"

=E2=80=9Cissuer of the = security subject=E2=80=9D not =E2=80=98or=E2=80=99. 

JWT has a usage pattern where iss of the assertion is the = same issuer of the subject. 

In SET an issuer may wish to talk about someone else's = subject. Hence the issuer of the subject is not the issuer of the = security token assertion. 

If you like, I am happy to work on the text some = more.  
> 
> 
> S 3.
>>        = Profiling specifications MUST define how the event subject is
>>        identified in the SET, as = well as how to differentiate between the
>>  =       event subject's issuer and the SET issuer, if = applicable.  It is
>>      =   NOT RECOMMENDED for profiling specifications to use the "sub"
>>        claim in cases in which = the subject is not globally unique and has
>>  =       a different issuer from the SET itself.
> 
> Doesn't this contradict the SHOULD i called out = above?

Agreed. Will change per above = suggestion. 
> 
> 
> S 5.1.
>>    =  personally identifiable information SHOULD be encrypted using = JWE
>>     [RFC7516] or secured for = confidentiality by other means.
>> 
>> =    Unless integrity of the JWT is ensured by other means, it = MUST be
>>     signed using JWS = [RFC7515] so that the SET can be authenticated and
>>     validated by the SET = recipient.
> 
> This = MUST seems less helpful than it would otherwise be because it 
> doesn't = specify what a valid signer is.

Will = reference the appropriate section in 7515. 
> 
> 
> S = 5.4.
>>     When SETs are delivered = asynchronously and/or out-of-band with
>>  =    respect to the original action that incurred the security = event, it
>>     is important to = consider that a SET might be delivered to a SET
>>     recipient in advance of or behind = the process that caused the event.
>>    =  For example, a user having been required to log out and then log = back
>>     in again, may cause a = token revoked SET to be issued, typically
> 
> Might = be clearer to quote "token revoked"

Will = do. 
> 
> 

 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3Dh9HmvB9543zWP3cIMJFTAvV_bSyHSuYaL8cJ3XKbIc4&s=3D-yzzJ5T3Ve= oP3RJMCKwYfNK_kLlOSIag4rrPEqQNEZk&e=3D

= --Apple-Mail=_8165E80E-8F76-4B78-9532-1F256886FC62-- From nobody Mon May 7 09:56:44 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49F81127369 for ; Mon, 7 May 2018 09:56:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VJUBzlqKNXIS for ; Mon, 7 May 2018 09:56:39 -0700 (PDT) Received: from mail-ot0-x22e.google.com (mail-ot0-x22e.google.com [IPv6:2607:f8b0:4003:c0f::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A2EB71270AE for ; Mon, 7 May 2018 09:56:36 -0700 (PDT) Received: by mail-ot0-x22e.google.com with SMTP id l13-v6so32770406otk.9 for ; Mon, 07 May 2018 09:56:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=qRH+W/gLVN+DY7yUVGM75GtQI9t8TMCFcqFX6nK6vjM=; b=vtXivyrEgMND0WB1C0SJSneOX0K+rKWWJawKV3JqIHlYOR+Dc/2ZMte5PcvUxlGNJQ nzVGAaMK8qebgHjd4/t5lekvRnlhh+gp5SN2HwYhHhFr2acILWjzM7FtX9cCO9uVdBJ7 m4CiKhz+lDcN48PSGFoiOqjjIp9EaFjDXaE6xF1Bvh/7AuaBrkYvTBY+/YCHvTi4xSol eFIhB6SUryI3+OGOj4/kxrL9XAKi4/3Ux0xj1rUe4F7Zl9qNq4c7Y4C9Eu34EkewKm4R vn+lbG8SZrqfu5EDhDfhEDTWFR31ozz8Fn6Xs8lbENavWVIQLbF7L5LAo6qhwDb81ZSH 9w+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=qRH+W/gLVN+DY7yUVGM75GtQI9t8TMCFcqFX6nK6vjM=; b=qMCAzvpCSsxTizK4QoS/7GYTv+ihdR362QV7vridjoiHmK8dgSTjHJlUg6uC6m5gD9 QNuXFZmDTwoVAonqyw9b0yh6oDLe5RhY9DiYogd5hiVkomrp3dmWZdkoLjEphZnLqjVS E1M1nVjwveBXFVlt/kS9nkoEawSU1zzQmsowXydBliScXCPm0ri2dHI3p3AbXwYR/mR5 ZrCBUWlxXD+jBRbHsEd+GJbJ/3lVibDJEAXPB8cY1YjB/oH8N2JHAoW+a68JQuap3LOq L2SKyxhbKa5d7zRq+rnl7VJWeTUTInU/hYSvUMAA5U+bcJGuKNyVKMscr2GsMvjs6Jw6 9ocg== X-Gm-Message-State: ALQs6tBCP1MSk+qt78tDHVWatqt1dl5hgUk+lyOCAj5x+qciAYT0CiD3 q+RcrkKY+TwVfq02aGkggfq0ZEkWbRQ1xMMBwE/MQexT X-Google-Smtp-Source: AB8JxZq2OJuLzVdNRs674T+iCGziyGe2qwDy5/aec9r3l2eA+U2JrvZ9BuqON9+kOmyVcv7Uy4Vm6nzhVNw0KaTLeEo= X-Received: by 2002:a9d:5917:: with SMTP id t23-v6mr24739870oth.217.1525712196057; Mon, 07 May 2018 09:56:36 -0700 (PDT) MIME-Version: 1.0 Received: by 10.201.118.130 with HTTP; Mon, 7 May 2018 09:55:55 -0700 (PDT) In-Reply-To: References: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> <6490BDE6-7245-455A-BAAA-7370EAE6414B@yahoo.com> From: Eric Rescorla Date: Mon, 7 May 2018 09:55:55 -0700 Message-ID: To: Mike Jones Cc: Phil Hunt , The IESG , "secevent-chairs@ietf.org" , "yaronf.ietf@gmail.com" , "draft-ietf-secevent-token@ietf.org" , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="00000000000079d8b7056ba08d71" Archived-At: Subject: Re: [Id-event] Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 16:56:42 -0000 --00000000000079d8b7056ba08d71 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, May 7, 2018 at 9:51 AM, Mike Jones wrote: > We can look at beefing up this statement, as you suggest =E2=80=93 probab= ly > somewhere in Section 4 (Preventing Confusion between SETs and other JWTs)= . > > > > Other specifications cannot define =E2=80=9Cevents=E2=80=9D because this = specification > registers =E2=80=9Cevents=E2=80=9D in the IANA JWT Claims registry (that = is, unless they > plan to be non-conforming with the registered claims usages). > OK, great! -Ekr > > -- Mike > > > > *From:* Eric Rescorla > *Sent:* Monday, May 7, 2018 9:47 AM > *To:* Mike Jones > *Cc:* Phil Hunt ; The IESG ; > secevent-chairs@ietf.org; yaronf.ietf@gmail.com; > draft-ietf-secevent-token@ietf.org; id-event@ietf.org > > *Subject:* Re: Eric Rescorla's No Objection on > draft-ietf-secevent-token-10: (with COMMENT) > > > > > > > > On Mon, May 7, 2018 at 9:22 AM, Mike Jones > wrote: > > Hi EKR, > > You wrote: > > Why don't you include some claim that makes these unambiguously SETs? > > That would at least prevent one directional confusion. > > Actually, the required "events" claim makes a JWT unambiguously a SET. S= o > your suggestion is already satisfied by normative text in the specificati= on. > > > > Might it be worth making this point slightly more sharply? > > > > With that said, isn't it possible other specifications might define > "events"? > > > > -Ekr > > > > > Thanks again, > -- Mike > > > -----Original Message----- > From: Phil Hunt > Sent: Sunday, May 6, 2018 3:57 PM > To: Eric Rescorla > Cc: The IESG ; secevent-chairs@ietf.org; > yaronf.ietf@gmail.com; draft-ietf-secevent-token@ietf.org; > id-event@ietf.org > Subject: Re: Eric Rescorla's No Objection on draft-ietf-secevent-token-10= : > (with COMMENT) > > Eric, > > Thanks for the great comments, my responses in line. > > Mike can you answer the disambiguation question? > > Phil > > > On May 6, 2018, at 3:31 PM, Eric Rescorla wrote: > > > > Eric Rescorla has entered the following ballot position for > > draft-ietf-secevent-token-10: No Objection > > > > When responding, please keep the subject line intact and reply to all > > email addresses included in the To and CC lines. (Feel free to cut > > this introductory paragraph, however.) > > > > > > Please refer to > > https://www.ietf.org/iesg/statement/discuss-criteria.html > > for more information about IESG DISCUSS and COMMENT positions. > > > > > > The document, along with other ballot positions, can be found here: > > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ > > > > > > > > ---------------------------------------------------------------------- > > COMMENT: > > ---------------------------------------------------------------------- > > > > Rich version of this review at: > > https://mozphab-ietf.devsvcdev.mozaws.net/D4210 > > > > > > > > IMPORTANT > > S 2.2. > >> * a URI representing a user resource that was modified; or, > >> > >> * a token identifier (e.g. "jti") for a revoked token. > >> > >> If used, the profiling specification SHOULD define the content > and > >> format semantics for the value. This claim is OPTIONAL, as > >> the > > > > Doesn't this need to be a MUST for interoperability? > > Agreed. Also per your comment below. > > > > > > S 4. > >> present but require that all be understood if the SET is to be > >> accepted. Some profiles might require that only a single value > be > >> present. All such choices are within the scope of profiling > >> specifications to define. > >> > >> 4. Preventing Confusion between SETs and other JWTs > > > > Why don't you include some claim that makes these unambiguously SETs? > > That would at least prevent one directional confusion. > > I will leave Mike to comment here. > > > > COMMENTS > > S 2.2. > >> > >> "iss" (Issuer) Claim > >> As defined by Section 4.1.1 of [RFC7519], this claim contains a > >> string identifying the service provider publishing the SET (the > >> issuer). In some cases, the SET issuer is not the issuer of th= e > >> security subject. Therefore, implementers cannot assume that > >> the > > > > I am having a hard time reading this text. What do you mean "issue or > > security subject?" > > =E2=80=9Cissuer of the security subject=E2=80=9D not =E2=80=98or=E2=80=99= . > > JWT has a usage pattern where iss of the assertion is the same issuer of > the subject. > > In SET an issuer may wish to talk about someone else's subject. Hence the > issuer of the subject is not the issuer of the security token assertion. > > If you like, I am happy to work on the text some more. > > > > > > S 3. > >> Profiling specifications MUST define how the event subject is > >> identified in the SET, as well as how to differentiate between > the > >> event subject's issuer and the SET issuer, if applicable. It i= s > >> NOT RECOMMENDED for profiling specifications to use the "sub" > >> claim in cases in which the subject is not globally unique and > has > >> a different issuer from the SET itself. > > > > Doesn't this contradict the SHOULD i called out above? > > Agreed. Will change per above suggestion. > > > > > > S 5.1. > >> personally identifiable information SHOULD be encrypted using JWE > >> [RFC7516] or secured for confidentiality by other means. > >> > >> Unless integrity of the JWT is ensured by other means, it MUST be > >> signed using JWS [RFC7515] so that the SET can be authenticated an= d > >> validated by the SET recipient. > > > > This MUST seems less helpful than it would otherwise be because it > > doesn't specify what a valid signer is. > > Will reference the appropriate section in 7515. > > > > > > S 5.4. > >> When SETs are delivered asynchronously and/or out-of-band with > >> respect to the original action that incurred the security event, i= t > >> is important to consider that a SET might be delivered to a SET > >> recipient in advance of or behind the process that caused the even= t. > >> For example, a user having been required to log out and then log > back > >> in again, may cause a token revoked SET to be issued, typically > > > > Might be clearer to quote "token revoked" > > Will do. > > > > > > > --00000000000079d8b7056ba08d71 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, May 7, 2018 at 9:51 AM, Mike Jones <Michael.Jones@mi= crosoft.com> wrote:

We can look at beefing= up this statement, as you suggest =E2=80=93 probably somewhere in Section = 4 (Preventing Confusion between SETs and other JWTs).

=C2=A0

Other specifications c= annot define =E2=80=9Cevents=E2=80=9D because this specification registers = =E2=80=9Cevents=E2=80=9D in the IANA JWT Claims registry (that is, unless t= hey plan to be non-conforming with the registered claims usages).


OK, great!

-Ekr

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

=C2=A0

From: Eric Rescorla <ekr@rtfm.com>
Sent: Monday, May 7, 2018 9:47 AM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Phil Hunt <phil.hunt@yahoo.com>; The IESG <iesg@ietf.org>; secevent-chairs@ietf.org; yaronf.ietf@gmail.com;= dr= aft-ietf-secevent-token@ietf.org; id-event@ietf.org


Subject: Re: Eric Rescorla's No Objection on draft-ietf-secevent= -token-10: (with COMMENT)

=C2=A0

=C2=A0

=C2=A0

On Mon, May 7, 2018 at 9:22 AM, Mike Jones <Michael.Jones@m= icrosoft.com> wrote:

Hi EKR,

You wrote:
> Why don't you include some claim that makes these unambiguously SE= Ts?
> That would at least prevent one directional confusion.

Actually, the required "events" claim makes a JWT unambiguously a= SET.=C2=A0 So your suggestion is already satisfied by normative text in th= e specification.

=C2=A0

Might it be worth making this point slightly more sh= arply?

=C2=A0

With that said, isn't it possible other specific= ations might define "events"?

=C2=A0

-Ekr

=C2=A0


=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Thanks again,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 -- Mike


-----Original Message-----
From: Phil Hunt <phil.hunt@yahoo.com>
Sent: Sunday, May 6, 2018 3:57 PM
To: Eric Rescorla <ekr= @rtfm.com>
Cc: The IESG <iesg@ie= tf.org>; secevent-chairs@ietf.org; yaronf.ietf@gmail.com; dra= ft-ietf-secevent-token@ietf.org; id-event@ietf.org
Subject: Re: Eric Rescorla's No Objection on draft-ietf-secevent-token-= 10: (with COMMENT)

Eric,

Thanks for the great comments, my responses in line.

Mike can you answer the disambiguation question?

Phil

> On May 6, 2018, at 3:31 PM, Eric Rescorla <ekr@rtfm.com> wrote:
>
> Eric Rescorla has entered the following ballot position for
> draft-ietf-secevent-token-10: No Objection
>
> When responding, please keep the subject line intact and reply to all =
> email addresses included in the To and CC lines. (Feel free to cut > this introductory paragraph, however.)
>
>
> Please refer to
> https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/
>
>
>
> ------------------------------------------------------------= ----------
> COMMENT:
> ------------------------------------------------------------= ----------
>
> Rich version of this review at:
> https://mozphab-ietf.devsvcdev.mozaws.net/D4210
>
>
>
> IMPORTANT
> S 2.2.
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 a URI representing a user resou= rce that was modified; or,
>>
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 a token identifier (e.g. "= jti") for a revoked token.
>>
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 If used, the profiling specification SH= OULD define the content and
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 format semantics for the value.=C2=A0 T= his claim is OPTIONAL, as
>> the
>
> Doesn't this need to be a MUST for interoperability?

Agreed. Also per your comment below.
>
>
> S 4.
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 present but require that all be underst= ood if the SET is to be
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 accepted.=C2=A0 Some profiles might req= uire that only a single value be
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 present.=C2=A0 All such choices are wit= hin the scope of profiling
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 specifications to define.
>>
>>=C2=A0 4.=C2=A0 Preventing Confusion between SETs and other JWTs >
> Why don't you include some claim that makes these unambiguously SE= Ts?
> That would at least prevent one directional confusion.

I will leave Mike to comment here.
>
> COMMENTS
> S 2.2.
>>
>>=C2=A0 =C2=A0 =C2=A0"iss" (Issuer) Claim
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 As defined by Section 4.1.1 of [RFC7519= ], this claim contains a
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 string identifying the service provider= publishing the SET (the
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer).=C2=A0 In some cases, the SET i= ssuer is not the issuer of the
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 security subject.=C2=A0 Therefore, impl= ementers cannot assume that
>> the
>
> I am having a hard time reading this text. What do you mean "issu= e or
> security subject?"

=E2=80=9Cissuer of the security subject=E2=80=9D not =E2=80=98or=E2=80=99. =

JWT has a usage pattern where iss of the assertion is the same issuer of th= e subject.

In SET an issuer may wish to talk about someone else's subject. Hence t= he issuer of the subject is not the issuer of the security token assertion.

If you like, I am happy to work on the text some more.=C2=A0
>
>
> S 3.
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Profiling specifications MUST define ho= w the event subject is
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 identified in the SET, as well as how t= o differentiate between the
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 event subject's issuer and the SET = issuer, if applicable.=C2=A0 It is
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 NOT RECOMMENDED for profiling specifica= tions to use the "sub"
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 claim in cases in which the subject is = not globally unique and has
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 a different issuer from the SET itself.=
>
> Doesn't this contradict the SHOULD i called out above?

Agreed. Will change per above suggestion.
>
>
> S 5.1.
>>=C2=A0 =C2=A0 =C2=A0personally identifiable information SHOULD be e= ncrypted using JWE
>>=C2=A0 =C2=A0 =C2=A0[RFC7516] or secured for confidentiality by oth= er means.
>>
>>=C2=A0 =C2=A0 =C2=A0Unless integrity of the JWT is ensured by other= means, it MUST be
>>=C2=A0 =C2=A0 =C2=A0signed using JWS [RFC7515] so that the SET can = be authenticated and
>>=C2=A0 =C2=A0 =C2=A0validated by the SET recipient.
>
> This MUST seems less helpful than it would otherwise be because it > doesn't specify what a valid signer is.

Will reference the appropriate section in 7515.
>
>
> S 5.4.
>>=C2=A0 =C2=A0 =C2=A0When SETs are delivered asynchronously and/or o= ut-of-band with
>>=C2=A0 =C2=A0 =C2=A0respect to the original action that incurred th= e security event, it
>>=C2=A0 =C2=A0 =C2=A0is important to consider that a SET might be de= livered to a SET
>>=C2=A0 =C2=A0 =C2=A0recipient in advance of or behind the process t= hat caused the event.
>>=C2=A0 =C2=A0 =C2=A0For example, a user having been required to log= out and then log back
>>=C2=A0 =C2=A0 =C2=A0in again, may cause a token revoked SET to be i= ssued, typically
>
> Might be clearer to quote "token revoked"

Will do.
>
>

=C2=A0


--00000000000079d8b7056ba08d71-- From nobody Mon May 7 10:05:25 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40B7B127522; Mon, 7 May 2018 10:05:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ioz0JKGg8pWH; Mon, 7 May 2018 10:05:16 -0700 (PDT) Received: from aserp2120.oracle.com (aserp2120.oracle.com [141.146.126.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B3B71273E2; Mon, 7 May 2018 10:05:15 -0700 (PDT) Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w47H1Upn108382; Mon, 7 May 2018 17:05:14 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=corp-2017-10-26; bh=hDkr3zHwjMMGjBn0C0YTuMrAjzktCx0qqf9/azM+9SQ=; b=hMb4q172xq8c11vJJw8iaq6PBAXr0BjUwHuqCKgfEz3pTe0AS7j7HYRb5CqjQoYdLMRf qrJiiJlTcs18nUz9dOXNOjXhzPcCtmDjTFqzp/caM/55HadH8N7glSLK3FPsjzj/julG PafxCVVbBhL+SxNcsd6TjF98/3GdAN3LWdaQb/qlf1RfMuLoweI46xBWYinXo0GqeaSw Vb6ZtnskP5u21ZidZNjHXjnqdPDP2dUE5i5TA3luL1UtQ2EvkxCPV5UAJv/eUzjujEgT NwJAbP9Ni6twrM5VJheKDAXoRJDUyDkfUq0cQmIQeRkFxuG8LMAXekwA5ddWbFZ+47Lo Yg== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp2120.oracle.com with ESMTP id 2hs4k25340-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 07 May 2018 17:05:13 +0000 Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w47H5CLa027394 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 7 May 2018 17:05:12 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w47H5C9X009840; Mon, 7 May 2018 17:05:12 GMT Received: from [192.168.1.28] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 07 May 2018 10:05:12 -0700 From: Phil Hunt Message-Id: <39CB7380-A96E-4811-B21D-15076769504A@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_257CDA80-C22A-402C-9074-6AB85B5777B0" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Mon, 7 May 2018 10:05:09 -0700 In-Reply-To: Cc: =?utf-8?Q?Mirja_K=C3=BChlewind?= , The IESG , "draft-ietf-secevent-token@ietf.org" , Yaron Sheffer , "secevent-chairs@ietf.org" , "id-event@ietf.org" To: Mike Jones References: <152569456137.1257.196817285072016580.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.6.18) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8886 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805070171 Archived-At: Subject: Re: [Id-event] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Record_on_draft?= =?utf-8?q?-ietf-secevent-token-10=3A_=28with_COMMENT=29?= X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 17:05:18 -0000 --Apple-Mail=_257CDA80-C22A-402C-9074-6AB85B5777B0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Mirja, Thanks for your questions. Just to add to Mike=E2=80=99s comments, the spec follows similar = normative pattern as the JWT (RFC7519) spec that it extends. While the draft talks about profiles there is an expectation that = informal profiles will be developed between specific parties in just the = same way as JWT tokens may be locally defined between parties.=20 There is significant other normative rules clarifying use of JWT claims = as well as defining other new claims (e.g. toe and txn). The spec also = helps define disambiguation of SETs from other token types as well as = other key security considerations that arise from the class of use.=20 Hope this helps. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On May 7, 2018, at 9:26 AM, Mike Jones = wrote: >=20 > Thanks for your comments, Mirja. My replies are inline below, = prefixed by "Mike>". >=20 > -----Original Message----- > From: Mirja K=C3=BChlewind =20 > Sent: Monday, May 7, 2018 5:03 AM > To: The IESG > Cc: draft-ietf-secevent-token@ietf.org; Yaron Sheffer = ; secevent-chairs@ietf.org; = yaronf.ietf@gmail.com; id-event@ietf.org > Subject: Mirja K=C3=BChlewind's No Record on = draft-ietf-secevent-token-10: (with COMMENT) >=20 > Mirja K=C3=BChlewind has entered the following ballot position for > draft-ietf-secevent-token-10: No Record >=20 > When responding, please keep the subject line intact and reply to all = email addresses included in the To and CC lines. (Feel free to cut this = introductory paragraph, however.) >=20 >=20 > Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > I guess this doc could also be informational as it "only" specifies a = SET data structure and specific profiles will be defined in other = documents that I guess would/could/should be stand-alone and as such = might only need to refer this doc informatively. Was the intended state = discussed in the working group? >=20 > Mike> The document is standards-track because it imposes normative = requirements on all SET implementations. For instance, it defines the = "events" claim and specifies how it is used. >=20 > Minor question/comment: > sec 6: "SET issuers SHOULD take steps to minimize the chance of event = correlation, when such correlation would constitute a privacy = violation." > Should this maybe be a MUST given there is a constraint already given? >=20 > Mike> I believe it would be in the realm of the profiling = specifications to make this a "MUST" if appropriate for the use case. = Given SETs can be profiled for many different kinds of use cases, I'm = worried that making this a "MUST" in the base SET specification might be = the wrong choice for some use cases.=20 >=20 > Thanks again, > -- Mike >=20 --Apple-Mail=_257CDA80-C22A-402C-9074-6AB85B5777B0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Mirja,

Thanks for your questions.

Just to add to Mike=E2=80=99s comments, = the spec follows similar normative pattern as the JWT (RFC7519) spec = that it extends.

While the draft talks about profiles there is an expectation = that informal profiles will be developed between specific parties in = just the same way as JWT tokens may be locally defined between = parties. 

There is significant other normative rules clarifying use of = JWT claims as well as defining other new claims (e.g. toe and txn). The = spec also helps define disambiguation of SETs from other token types as = well as other key security considerations that arise from the class of = use. 

Hope = this helps.

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 7, 2018, at 9:26 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Thanks= for your comments, Mirja.  My replies are inline below, prefixed = by "Mike>".

-----Original = Message-----
From: Mirja K=C3=BChlewind <ietf@kuehlewind.net>=
Sent: Monday, May 7, 2018 5:03 AM
To: The = IESG <iesg@ietf.org>
Cc: draft-ietf-secevent-token@ietf.org; Yaron Sheffer <yaronf.ietf@gmail.com>; secevent-chairs@ietf.org; yaronf.ietf@gmail.com; id-event@ietf.org
Subject: Mirja = K=C3=BChlewind's No Record on draft-ietf-secevent-token-10: (with = COMMENT)

Mirja K=C3=BChlewind has entered = the following ballot position for
draft-ietf-secevent-token-10: No Record

When responding, please keep the subject line intact and = reply to all email addresses included in the To and CC lines. (Feel free = to cut this introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.htmlfor more information about IESG DISCUSS and COMMENT = positions.


The document, = along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-token/=



---------------------------------------------------------------= -------
COMMENT:
---------------------------------------------------------------= -------

I guess this doc could also be = informational as it "only" specifies a SET data structure and specific = profiles will be defined in other documents that I guess = would/could/should be stand-alone and as such might only need to refer = this doc informatively. Was the intended state discussed in the working = group?

Mike> The document is = standards-track because it imposes normative requirements on all SET = implementations.  For instance, it defines the "events" claim and = specifies how it is used.

Minor = question/comment:
sec  6: "SET issuers SHOULD take = steps to minimize the chance of event correlation, when such correlation = would constitute a privacy violation."
Should this maybe = be a MUST given there is a constraint already given?

Mike> I believe it would be in the realm of the profiling = specifications to make this a "MUST" if appropriate for the use case. =  Given SETs can be profiled for many different kinds of use cases, = I'm worried that making this a "MUST" in the base SET specification = might be the wrong choice for some use cases.

= = = = Thanks again,
-- Mike


= --Apple-Mail=_257CDA80-C22A-402C-9074-6AB85B5777B0-- From nobody Mon May 7 12:07:44 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFB3E12E040 for ; Mon, 7 May 2018 12:07:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); domainkeys=pass (1024-bit key) header.from=ietf@kuehlewind.net header.d=kuehlewind.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PM6SwCN7QYdD for ; Mon, 7 May 2018 12:07:31 -0700 (PDT) Received: from kuehlewind.net (kuehlewind.net [83.169.45.111]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A316012DA00 for ; Mon, 7 May 2018 12:07:19 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kuehlewind.net; b=Sad5899HpAInr4DxOyysi8X0Vmv5PK9y1R8JW4AKkagtp6dGWDnu48GbnS4s++/in21v00GiU7sgrzxVS3ahbPaItyogg3D7zxIKa7YMeHE6JKj8jbDUWjJlFLd7zYsvMYuooVKI0nefJEFmdHw8nM4pd326QFaguDB0rztApsg=; h=Received:Received:Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc:Content-Transfer-Encoding:Message-Id:References:To:X-Mailer:X-PPP-Message-ID:X-PPP-Vhost; Received: (qmail 30276 invoked from network); 7 May 2018 21:00:36 +0200 Received: from i577bce2f.versanet.de (HELO ?192.168.178.24?) (87.123.206.47) by kuehlewind.net with ESMTPSA (DHE-RSA-AES256-SHA encrypted, authenticated); 7 May 2018 21:00:36 +0200 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) From: "Mirja Kuehlewind (IETF)" In-Reply-To: Date: Mon, 7 May 2018 21:00:35 +0200 Cc: The IESG , "secevent-chairs@ietf.org" , "yaronf.ietf@gmail.com" , "draft-ietf-secevent-token@ietf.org" , "id-event@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <0B17743B-8186-4AFA-A829-E9EA99C29199@kuehlewind.net> References: <152569456137.1257.196817285072016580.idtracker@ietfa.amsl.com> To: Mike Jones X-Mailer: Apple Mail (2.3445.6.18) X-PPP-Message-ID: <20180507190036.30267.16870@lvps83-169-45-111.dedicated.hosteurope.de> X-PPP-Vhost: kuehlewind.net Archived-At: Subject: Re: [Id-event] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Record_on_draft?= =?utf-8?q?-ietf-secevent-token-10=3A_=28with_COMMENT=29?= X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 19:07:37 -0000 Hi Mike > Am 07.05.2018 um 18:26 schrieb Mike Jones = : >=20 > I guess this doc could also be informational as it "only" specifies a = SET data structure and specific profiles will be defined in other = documents that I guess would/could/should be stand-alone and as such = might only need to refer this doc informatively. Was the intended state = discussed in the working group? >=20 > Mike> The document is standards-track because it imposes normative = requirements on all SET implementations. For instance, it defines the = "events" claim and specifies how it is used. Informational document can also have normative claims.=20 Mirja From nobody Mon May 7 13:01:06 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C0BC12DA4D for ; Mon, 7 May 2018 13:00:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); domainkeys=pass (1024-bit key) header.from=ietf@kuehlewind.net header.d=kuehlewind.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Td-2vS6L7DHb for ; Mon, 7 May 2018 13:00:54 -0700 (PDT) Received: from kuehlewind.net (kuehlewind.net [83.169.45.111]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2967812E03C for ; Mon, 7 May 2018 13:00:52 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kuehlewind.net; b=g6w+lHWfHdhLVMh+WN+fggGDsRHHrTOPDoTuAwYaWfcD/u+NY8RmJXYxw/B8p7WL0MG/j3EJ5GkVIjsez86WvwOrcn9Pn2EkLkc1v5qiAswOkCy9Ax/16fE/gDcO+upmDduuYyPWzaXBdJPp9KmxpJHbekC3NlmH5maq3RCEqkQ=; h=Received:Received:Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc:Content-Transfer-Encoding:Message-Id:References:To:X-Mailer:X-PPP-Message-ID:X-PPP-Vhost; Received: (qmail 30325 invoked from network); 7 May 2018 21:00:50 +0200 Received: from i577bce2f.versanet.de (HELO ?192.168.178.24?) (87.123.206.47) by kuehlewind.net with ESMTPSA (DHE-RSA-AES256-SHA encrypted, authenticated); 7 May 2018 21:00:50 +0200 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) From: "Mirja Kuehlewind (IETF)" In-Reply-To: <39CB7380-A96E-4811-B21D-15076769504A@oracle.com> Date: Mon, 7 May 2018 21:00:50 +0200 Cc: Mike Jones , "secevent-chairs@ietf.org" , Yaron Sheffer , "draft-ietf-secevent-token@ietf.org" , The IESG , "id-event@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <7B19ACC3-1720-4626-9DE1-CDBBF0CACF2A@kuehlewind.net> References: <152569456137.1257.196817285072016580.idtracker@ietfa.amsl.com> <39CB7380-A96E-4811-B21D-15076769504A@oracle.com> To: Phil Hunt X-Mailer: Apple Mail (2.3445.6.18) X-PPP-Message-ID: <20180507190050.30315.35012@lvps83-169-45-111.dedicated.hosteurope.de> X-PPP-Vhost: kuehlewind.net Archived-At: Subject: Re: [Id-event] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Record_on_draft?= =?utf-8?q?-ietf-secevent-token-10=3A_=28with_COMMENT=29?= X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 20:01:01 -0000 Okay. Thanks for the background info! > Am 07.05.2018 um 19:05 schrieb Phil Hunt : >=20 > Mirja, >=20 > Thanks for your questions. >=20 > Just to add to Mike=E2=80=99s comments, the spec follows similar = normative pattern as the JWT (RFC7519) spec that it extends. >=20 > While the draft talks about profiles there is an expectation that = informal profiles will be developed between specific parties in just the = same way as JWT tokens may be locally defined between parties.=20 >=20 > There is significant other normative rules clarifying use of JWT = claims as well as defining other new claims (e.g. toe and txn). The spec = also helps define disambiguation of SETs from other token types as well = as other key security considerations that arise from the class of use.=20= >=20 > Hope this helps. >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > phil.hunt@oracle.com >=20 >> On May 7, 2018, at 9:26 AM, Mike Jones = wrote: >>=20 >> Thanks for your comments, Mirja. My replies are inline below, = prefixed by "Mike>". >>=20 >> -----Original Message----- >> From: Mirja K=C3=BChlewind =20 >> Sent: Monday, May 7, 2018 5:03 AM >> To: The IESG >> Cc: draft-ietf-secevent-token@ietf.org; Yaron Sheffer = ; secevent-chairs@ietf.org; = yaronf.ietf@gmail.com; id-event@ietf.org >> Subject: Mirja K=C3=BChlewind's No Record on = draft-ietf-secevent-token-10: (with COMMENT) >>=20 >> Mirja K=C3=BChlewind has entered the following ballot position for >> draft-ietf-secevent-token-10: No Record >>=20 >> When responding, please keep the subject line intact and reply to all = email addresses included in the To and CC lines. (Feel free to cut this = introductory paragraph, however.) >>=20 >>=20 >> Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html >> for more information about IESG DISCUSS and COMMENT positions. >>=20 >>=20 >> The document, along with other ballot positions, can be found here: >> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >>=20 >>=20 >>=20 >> = ---------------------------------------------------------------------- >> COMMENT: >> = ---------------------------------------------------------------------- >>=20 >> I guess this doc could also be informational as it "only" specifies a = SET data structure and specific profiles will be defined in other = documents that I guess would/could/should be stand-alone and as such = might only need to refer this doc informatively. Was the intended state = discussed in the working group? >>=20 >> Mike> The document is standards-track because it imposes normative = requirements on all SET implementations. For instance, it defines the = "events" claim and specifies how it is used. >>=20 >> Minor question/comment: >> sec 6: "SET issuers SHOULD take steps to minimize the chance of = event correlation, when such correlation would constitute a privacy = violation." >> Should this maybe be a MUST given there is a constraint already = given? >>=20 >> Mike> I believe it would be in the realm of the profiling = specifications to make this a "MUST" if appropriate for the use case. = Given SETs can be profiled for many different kinds of use cases, I'm = worried that making this a "MUST" in the base SET specification might be = the wrong choice for some use cases.=20 >>=20 >> Thanks again, >> -- Mike >>=20 >=20 From nobody Mon May 7 21:05:31 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EBA71127058; Mon, 7 May 2018 21:05:29 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.79.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152575232990.20053.11060695504716334698@ietfa.amsl.com> Date: Mon, 07 May 2018 21:05:29 -0700 Archived-At: Subject: [Id-event] I-D Action: draft-ietf-secevent-token-11.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 May 2018 04:05:30 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Events WG of the IETF. Title : Security Event Token (SET) Authors : Phil Hunt Michael B. Jones William Denniss Morteza Ansari Filename : draft-ietf-secevent-token-11.txt Pages : 30 Date : 2018-05-07 Abstract: This specification defines the Security Event Token (SET) data structure. A SET describes statements of fact from the perspective of an issuer about a subject. These statements of fact represent an event that occurred directly to or about a security subject, for example, a statement about the issuance or revocation of a token on behalf of a subject. This specification is intended to enable representing security- and identity-related events. A SET is a JSON Web Token (JWT), which can be optionally signed and/or encrypted. SETs can be distributed via protocols such as HTTP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-secevent-token-11 https://datatracker.ietf.org/doc/html/draft-ietf-secevent-token-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-token-11 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon May 7 21:17:49 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4047E1204DA for ; Mon, 7 May 2018 21:17:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.72 X-Spam-Level: X-Spam-Status: No, score=-0.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2DTEkqFb5Ewo for ; Mon, 7 May 2018 21:17:46 -0700 (PDT) Received: from aserp2120.oracle.com (aserp2120.oracle.com [141.146.126.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C9721201FA for ; Mon, 7 May 2018 21:17:46 -0700 (PDT) Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w484G11L142939 for ; Tue, 8 May 2018 04:17:45 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : content-type : mime-version : subject : message-id : date : to; s=corp-2017-10-26; bh=KNtnJWyqd8sJ5dI/NEX1GuObk43ahwdW0ghBGYBjKmk=; b=ukFHsGOz6RDjmR1Afli9lkxd3nYP8dLfUIySlLNRD6uxKg/65SLnvDTrc4ExfslUXU67 n178z0pN/k56hmQ7mQzk1AeaPtH2lWuJr1B1kX1mqRtaWQBopxTzqFA6eIkdU3OEjiTz BOVp6fQNYPCaMP4DZaTi0nHxcKm3tFuIWIw2Vf0SuIKcZcpt98YA+ArL6oJ2BxFzlByf 8+JW45jdPJEKsF0fxofUQFWpwe+jfAE4JGSwhZ7eo8qMmybPDNwrHxTqI0xCUNKhKFvP Z16Ie4e9NCcjG5s2YfiUOJX9mPpt1AtI6a3ot5OK/6HiqArF651Uvp2/sAxSBYgnT3dq ZQ== Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp2120.oracle.com with ESMTP id 2hs4k26rhq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Tue, 08 May 2018 04:17:45 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w484HiaY006060 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Tue, 8 May 2018 04:17:45 GMT Received: from abhmp0009.oracle.com (abhmp0009.oracle.com [141.146.116.15]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w484HiCH017075 for ; Tue, 8 May 2018 04:17:44 GMT Received: from [192.168.1.28] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 07 May 2018 21:17:44 -0700 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_D5B36804-F4D5-4C4D-A952-7D1F49C8C5C3" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Message-Id: Date: Mon, 7 May 2018 21:17:42 -0700 To: ID Events Mailing List X-Mailer: Apple Mail (2.3445.6.18) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8886 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=965 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805080042 Archived-At: Subject: [Id-event] Security Event Token (SET) spec draft-ietf-secevent-token-11 addressing SecDir and IANA comments X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 May 2018 04:17:48 -0000 --Apple-Mail=_D5B36804-F4D5-4C4D-A952-7D1F49C8C5C3 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 An updated Security Event Token (SET) specification has been published = to address recent review comments received form Eric Rescola, Ned Freed. = A summary of changes includes: Clarified "iss" claim language about the SET issuer versus the security = subject issuer. Changed a "SHOULD" to a "MUST" in the "sub" claim description to be = consistent with the Requirements for SET Profiles section. Described the use of the "events" claim to prevent attackers from = passing off other kinds of JWTs as SETs. Stated that SETs are to be signed by an issuer that is trusted to do so = for the use case.=20 Added quotes in the phrase "token revoked" SET to be issued=E2=80=99 in = the Timing Issues section. Added section number references to the media type and media type suffix = registrations. Changed the encodings of the media type and media type suffix = registrations to binary (since no line breaks are allowed). Replaced a "TBD" in the media type registration with descriptive text. Updated acknowledgments =20 An HTML-formatted version is also available at: https://tools.ietf.org/html/draft-ietf-secevent-token-11 = -Phil --Apple-Mail=_D5B36804-F4D5-4C4D-A952-7D1F49C8C5C3 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
An updated Security Event Token (SET) = specification has been published to address recent review comments = received form Eric Rescola, Ned Freed.  A summary of changes = includes:

  • Clarified "iss" claim = language about the SET issuer versus the security subject issuer.
  • Changed a "SHOULD" to a "MUST" in the = "sub" claim description to be = consistent with the Requirements for SET Profiles = section.
  • Described the use of the "events" claim to prevent attackers = from passing off other kinds of = JWTs as SETs.
  • Stated= that SETs are to be signed by an issuer that is trusted = to do so for the use = case. 
  • Added quotes in the phrase "token revoked" SET to be = issued=E2=80=99 in the Timing Issues section.
  • Added section number references to the = media type and media type suffix= registrations.
  • Changed the encodings of the media type and media type = suffix registrations to binary = (since no line breaks are allowed).
  • Replaced a "TBD" in the media type registration = with descriptive text.
  • Updated = acknowledgments
  
An = HTML-formatted version is also available at:

-Phil


= --Apple-Mail=_D5B36804-F4D5-4C4D-A952-7D1F49C8C5C3-- From nobody Tue May 8 00:00:15 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9591112704A; Tue, 8 May 2018 00:00:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pbLIuDpCD8Ba; Tue, 8 May 2018 00:00:09 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0117.outbound.protection.outlook.com [104.47.42.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 849F8126CC7; Tue, 8 May 2018 00:00:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=qW84zr6abG+iKLJ0UQo1rvmmsiKbbyZ8k/FRxTxZz2w=; b=LPtSMe1kQ4j4vrYJRS/33g0YAiyS1A+5BbpBXl157Q2nLiDQrzbpaN0wFxmZycITnvzhvw1MHnatwRJ86M37FgvaBk+svIy3ye/jL2ObEYK+B2nQQHkvbIIf+3/T+/no986BfQFzqk6HCH115Z5epGSG+eO7rwGt+OfevANJQIQ= Received: from BL0PR00MB0292.namprd00.prod.outlook.com (2603:10b6:207:1e::30) by BL0PR00MB0369.namprd00.prod.outlook.com (2603:10b6:207:1f::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.787.0; Tue, 8 May 2018 07:00:06 +0000 Received: from BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::84a0:cb3c:39ec:1b01]) by BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::84a0:cb3c:39ec:1b01%5]) with mapi id 15.20.0788.000; Tue, 8 May 2018 07:00:05 +0000 From: Mike Jones To: Eric Rescorla , The IESG CC: "secevent-chairs@ietf.org" , "yaronf.ietf@gmail.com" , Yaron Sheffer , "draft-ietf-secevent-token@ietf.org" , "id-event@ietf.org" Thread-Topic: Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) Thread-Index: AQHT5YnxaPc1mOAkuUSjF/vxU7E9+aQlYb7g Date: Tue, 8 May 2018 07:00:05 +0000 Message-ID: References: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> In-Reply-To: <152564587056.1391.2036135277474537760.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-05-08T07:00:02.3935007Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [50.47.80.188] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BL0PR00MB0369; 7:ozClKGKWyC4hOZr9Mu/AujX/Y6c+9xMTL0CW6oWbT9YJWFulatcYqlJZ36ebTglLuSgMDn5mXPFrivl9MF4ZX8dKG2qTawhnhl70pI0ML9rlfM58T8vQMfdMVqMzs/9bkZeJTqOlrBdVQxUKBvicoXV9YKizUW82ooBdZDeW3ccEpc9L0udtIYvikUmBAPBOtzsGiKOTExak3nJ0Gpjq1Ir/rjaM4Z82Dl6qxr2fbx6owOGKkzAdH1VUMl5K5MhG; 20:C2RMrPfLX1GaMxddrjNpIbAmxFYlCXA4DHtBJcw2r5e9NOKVY3T+1UmUhAXqvdzXQA+s8M+MfVCFsT9cjblEkfGCBtmL4RxAUzbfFBtizPvnzpRHzGu74vmhTrbuSYH0Zx2ocqRcGKo7LiCunCVruu3TnoLVoCHbK4R/f9OARew= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(48565401081)(2017052603328)(7193020); SRVR:BL0PR00MB0369; x-ms-traffictypediagnostic: BL0PR00MB0369: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(120809045254105)(192374486261705)(85827821059158); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(2017102700009)(2017102701064)(6040522)(2401047)(8121501046)(5005006)(2017102702064)(20171027021009)(20171027022009)(20171027023009)(20171027024009)(20171027025009)(20171027026009)(2017102703076)(3231254)(2018427008)(944501410)(52105095)(10201501046)(3002001)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:BL0PR00MB0369; BCL:0; PCL:0; RULEID:; SRVR:BL0PR00MB0369; x-forefront-prvs: 0666E15D35 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(39380400002)(366004)(396003)(39860400002)(199004)(189003)(13464003)(10090500001)(8990500004)(25786009)(2900100001)(74316002)(446003)(6346003)(86612001)(966005)(5660300001)(72206003)(53936002)(5250100002)(54906003)(110136005)(22452003)(97736004)(316002)(53546011)(6506007)(486006)(11346002)(476003)(102836004)(59450400001)(186003)(99286004)(26005)(52396003)(7696005)(86362001)(76176011)(305945005)(14454004)(33656002)(7736002)(8676002)(3280700002)(66066001)(3660700001)(81156014)(68736007)(10290500003)(6436002)(478600001)(81166006)(6246003)(39060400002)(4326008)(6116002)(106356001)(9686003)(6306002)(55016002)(229853002)(8936002)(2906002)(3846002)(105586002); DIR:OUT; SFP:1102; SCL:1; SRVR:BL0PR00MB0369; H:BL0PR00MB0292.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-microsoft-antispam-message-info: jdRzPDO4mUITXE4I04JdsN8e/dUz04FM7+hNYLRx7A6b1CmiahzXHfCoSUhLaLCRcEyTTxZuqfyzgNjDYqVshLf4aquRvsblY6n6Dsiyc5Pm/NOwwfWJnKXbBx7/Ecypy/l2XEc1JJMTNRrJuGKubBQEqIWQBROf2EH2ImpmFVX1jAc6nmicwCWihQwWiOfH spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: eaa92623-14df-4a72-8333-08d5b4b15454 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: eaa92623-14df-4a72-8333-08d5b4b15454 X-MS-Exchange-CrossTenant-originalarrivaltime: 08 May 2018 07:00:05.7087 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR00MB0369 Archived-At: Subject: Re: [Id-event] Eric Rescorla's No Objection on draft-ietf-secevent-token-10: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 May 2018 07:00:14 -0000 VGhhbmtzIGFnYWluIGZvciB5b3VyIHVzZWZ1bCBjb21tZW50cywgRWtyLiAgaHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMTEgaGFzIGJlZW4gcHVi bGlzaGVkIHRvIGFkZHJlc3MgdGhlbSwgYXMgd2VsbCBhcyBjb21tZW50cyBmcm9tIERlc2lnbmF0 ZWQgRXhwZXJ0IE5lZCBGcmVlZC4gIEknbSByZXBseWluZyB0byB5b3VyIG9yaWdpbmFsIG1lc3Nh Z2UgdG8gaG9wZWZ1bGx5IG1ha2UgdGhlIHJlcGxpZXMgZWFzaWVyIHRvIHVuZGVyc3RhbmQgaW4g Y29udGV4dC4gIE15IHJlcGxpZXMgYXJlIGlubGluZSBwcmVmaXhlZCBieSAiTWlrZT4iLg0KDQot LS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0u Y29tPiANClNlbnQ6IFN1bmRheSwgTWF5IDYsIDIwMTggMzozMSBQTQ0KVG86IFRoZSBJRVNHIDxp ZXNnQGlldGYub3JnPg0KQ2M6IHNlY2V2ZW50LWNoYWlyc0BpZXRmLm9yZzsgeWFyb25mLmlldGZA Z21haWwuY29tOyBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb20+OyBkcmFmdC1p ZXRmLXNlY2V2ZW50LXRva2VuQGlldGYub3JnOyBpZC1ldmVudEBpZXRmLm9yZw0KU3ViamVjdDog RXJpYyBSZXNjb3JsYSdzIE5vIE9iamVjdGlvbiBvbiBkcmFmdC1pZXRmLXNlY2V2ZW50LXRva2Vu LTEwOiAod2l0aCBDT01NRU5UKQ0KDQpFcmljIFJlc2NvcmxhIGhhcyBlbnRlcmVkIHRoZSBmb2xs b3dpbmcgYmFsbG90IHBvc2l0aW9uIGZvcg0KZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0xMDog Tm8gT2JqZWN0aW9uDQoNCldoZW4gcmVzcG9uZGluZywgcGxlYXNlIGtlZXAgdGhlIHN1YmplY3Qg bGluZSBpbnRhY3QgYW5kIHJlcGx5IHRvIGFsbCBlbWFpbCBhZGRyZXNzZXMgaW5jbHVkZWQgaW4g dGhlIFRvIGFuZCBDQyBsaW5lcy4gKEZlZWwgZnJlZSB0byBjdXQgdGhpcyBpbnRyb2R1Y3Rvcnkg cGFyYWdyYXBoLCBob3dldmVyLikNCg0KDQpQbGVhc2UgcmVmZXIgdG8gaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvaWVzZy9zdGF0ZW1lbnQvZGlzY3Vzcy1jcml0ZXJpYS5odG1sDQpmb3IgbW9yZSBpbmZv cm1hdGlvbiBhYm91dCBJRVNHIERJU0NVU1MgYW5kIENPTU1FTlQgcG9zaXRpb25zLg0KDQoNClRo ZSBkb2N1bWVudCwgYWxvbmcgd2l0aCBvdGhlciBiYWxsb3QgcG9zaXRpb25zLCBjYW4gYmUgZm91 bmQgaGVyZToNCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtc2Vj ZXZlbnQtdG9rZW4vDQoNCg0KDQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpDT01NRU5UOg0KLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQ0KDQpSaWNoIHZlcnNpb24gb2YgdGhpcyByZXZpZXcgYXQ6DQpodHRwczovL21venBoYWItaWV0 Zi5kZXZzdmNkZXYubW96YXdzLm5ldC9ENDIxMA0KDQoNCg0KSU1QT1JUQU5UDQpTIDIuMi4NCj4g ICAgICAgICAqICBhIFVSSSByZXByZXNlbnRpbmcgYSB1c2VyIHJlc291cmNlIHRoYXQgd2FzIG1v ZGlmaWVkOyBvciwNCj4gICANCj4gICAgICAgICAqICBhIHRva2VuIGlkZW50aWZpZXIgKGUuZy4g Imp0aSIpIGZvciBhIHJldm9rZWQgdG9rZW4uDQo+ICAgDQo+ICAgICAgICAgSWYgdXNlZCwgdGhl IHByb2ZpbGluZyBzcGVjaWZpY2F0aW9uIFNIT1VMRCBkZWZpbmUgdGhlIGNvbnRlbnQgYW5kDQo+ ICAgICAgICAgZm9ybWF0IHNlbWFudGljcyBmb3IgdGhlIHZhbHVlLiAgVGhpcyBjbGFpbSBpcyBP UFRJT05BTCwgYXMgDQo+IHRoZQ0KDQpEb2Vzbid0IHRoaXMgbmVlZCB0byBiZSBhIE1VU1QgZm9y IGludGVyb3BlcmFiaWxpdHk/DQoNCk1pa2U+IEl0J3Mgbm93IGEgTVVTVC4NCg0KUyA0Lg0KPiAg ICAgICAgIHByZXNlbnQgYnV0IHJlcXVpcmUgdGhhdCBhbGwgYmUgdW5kZXJzdG9vZCBpZiB0aGUg U0VUIGlzIHRvIGJlDQo+ICAgICAgICAgYWNjZXB0ZWQuICBTb21lIHByb2ZpbGVzIG1pZ2h0IHJl cXVpcmUgdGhhdCBvbmx5IGEgc2luZ2xlIHZhbHVlIGJlDQo+ICAgICAgICAgcHJlc2VudC4gIEFs bCBzdWNoIGNob2ljZXMgYXJlIHdpdGhpbiB0aGUgc2NvcGUgb2YgcHJvZmlsaW5nDQo+ICAgICAg ICAgc3BlY2lmaWNhdGlvbnMgdG8gZGVmaW5lLg0KPiAgIA0KPiAgIDQuICBQcmV2ZW50aW5nIENv bmZ1c2lvbiBiZXR3ZWVuIFNFVHMgYW5kIG90aGVyIEpXVHMNCg0KV2h5IGRvbid0IHlvdSBpbmNs dWRlIHNvbWUgY2xhaW0gdGhhdCBtYWtlcyB0aGVzZSB1bmFtYmlndW91c2x5IFNFVHM/DQpUaGF0 IHdvdWxkIGF0IGxlYXN0IHByZXZlbnQgb25lIGRpcmVjdGlvbmFsIGNvbmZ1c2lvbi4NCg0KTWlr ZT4gVGhlcmUncyBhIG5ldyBzZW50ZW5jZSBpbiBhdCB0aGUgZW5kIG9mIHRoZSAzcmQgcGFyYWdy YXBoIG9mIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXRv a2VuLTExI3NlY3Rpb24tNC4zIGFkZHJlc3NpbmcgdGhpcyB2ZXJ5IHBvaW50Lg0KDQpDT01NRU5U Uw0KUyAyLjIuDQo+ICAgDQo+ICAgICAgImlzcyIgKElzc3VlcikgQ2xhaW0NCj4gICAgICAgICBB cyBkZWZpbmVkIGJ5IFNlY3Rpb24gNC4xLjEgb2YgW1JGQzc1MTldLCB0aGlzIGNsYWltIGNvbnRh aW5zIGENCj4gICAgICAgICBzdHJpbmcgaWRlbnRpZnlpbmcgdGhlIHNlcnZpY2UgcHJvdmlkZXIg cHVibGlzaGluZyB0aGUgU0VUICh0aGUNCj4gICAgICAgICBpc3N1ZXIpLiAgSW4gc29tZSBjYXNl cywgdGhlIFNFVCBpc3N1ZXIgaXMgbm90IHRoZSBpc3N1ZXIgb2YgdGhlDQo+ICAgICAgICAgc2Vj dXJpdHkgc3ViamVjdC4gIFRoZXJlZm9yZSwgaW1wbGVtZW50ZXJzIGNhbm5vdCBhc3N1bWUgdGhh dCANCj4gdGhlDQoNCkkgYW0gaGF2aW5nIGEgaGFyZCB0aW1lIHJlYWRpbmcgdGhpcyB0ZXh0LiBX aGF0IGRvIHlvdSBtZWFuICJpc3N1ZSBvciBzZWN1cml0eSBzdWJqZWN0PyINCg0KTWlrZT4gVGhl IDJuZCBzZW50ZW5jZSBvZiB0aGUgImlzcyIgY2xhaW0gZGVzY3JpcHRpb24gYXQgaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMTEjc2VjdGlvbi0y LjIgaGFzIGJlZW4gcmV3b3JrZWQgdG8gaG9wZWZ1bGx5IG1ha2UgaXQgbW9yZSByZWFkYWJsZS4N Cg0KUyAzLg0KPiAgICAgICAgIFByb2ZpbGluZyBzcGVjaWZpY2F0aW9ucyBNVVNUIGRlZmluZSBo b3cgdGhlIGV2ZW50IHN1YmplY3QgaXMNCj4gICAgICAgICBpZGVudGlmaWVkIGluIHRoZSBTRVQs IGFzIHdlbGwgYXMgaG93IHRvIGRpZmZlcmVudGlhdGUgYmV0d2VlbiB0aGUNCj4gICAgICAgICBl dmVudCBzdWJqZWN0J3MgaXNzdWVyIGFuZCB0aGUgU0VUIGlzc3VlciwgaWYgYXBwbGljYWJsZS4g IEl0IGlzDQo+ICAgICAgICAgTk9UIFJFQ09NTUVOREVEIGZvciBwcm9maWxpbmcgc3BlY2lmaWNh dGlvbnMgdG8gdXNlIHRoZSAic3ViIg0KPiAgICAgICAgIGNsYWltIGluIGNhc2VzIGluIHdoaWNo IHRoZSBzdWJqZWN0IGlzIG5vdCBnbG9iYWxseSB1bmlxdWUgYW5kIGhhcw0KPiAgICAgICAgIGEg ZGlmZmVyZW50IGlzc3VlciBmcm9tIHRoZSBTRVQgaXRzZWxmLg0KDQpEb2Vzbid0IHRoaXMgY29u dHJhZGljdCB0aGUgU0hPVUxEIGkgY2FsbGVkIG91dCBhYm92ZT8NCg0KTWlrZT4gTm90IGFueW1v cmUsIGJlY2F1c2UgdGhlIHByZXZpb3VzIFNIT1VMRCBpcyBub3cgYSBNVVNULg0KDQpTIDUuMS4N Cj4gICAgICBwZXJzb25hbGx5IGlkZW50aWZpYWJsZSBpbmZvcm1hdGlvbiBTSE9VTEQgYmUgZW5j cnlwdGVkIHVzaW5nIEpXRQ0KPiAgICAgIFtSRkM3NTE2XSBvciBzZWN1cmVkIGZvciBjb25maWRl bnRpYWxpdHkgYnkgb3RoZXIgbWVhbnMuDQo+ICAgDQo+ICAgICAgVW5sZXNzIGludGVncml0eSBv ZiB0aGUgSldUIGlzIGVuc3VyZWQgYnkgb3RoZXIgbWVhbnMsIGl0IE1VU1QgYmUNCj4gICAgICBz aWduZWQgdXNpbmcgSldTIFtSRkM3NTE1XSBzbyB0aGF0IHRoZSBTRVQgY2FuIGJlIGF1dGhlbnRp Y2F0ZWQgYW5kDQo+ICAgICAgdmFsaWRhdGVkIGJ5IHRoZSBTRVQgcmVjaXBpZW50Lg0KDQpUaGlz IE1VU1Qgc2VlbXMgbGVzcyBoZWxwZnVsIHRoYW4gaXQgd291bGQgb3RoZXJ3aXNlIGJlIGJlY2F1 c2UgaXQgZG9lc24ndCBzcGVjaWZ5IHdoYXQgYSB2YWxpZCBzaWduZXIgaXMuDQoNCk1pa2U+IGh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTExI3Nl Y3Rpb24tNS4xIG5vdyBzYXlzIHRoYXQgaXQgIk1VU1QgYmUgc2lnbmVkIHVzaW5nIEpXUyBbUkZD NzUxNV0gYnkgYW4gaXNzdWVyIHRoYXQgaXMgdHJ1c3RlZCB0byBkbyBzbyBmb3IgdGhlIHVzZSBj YXNlIi4NCg0KUyA1LjQuDQo+ICAgICAgV2hlbiBTRVRzIGFyZSBkZWxpdmVyZWQgYXN5bmNocm9u b3VzbHkgYW5kL29yIG91dC1vZi1iYW5kIHdpdGgNCj4gICAgICByZXNwZWN0IHRvIHRoZSBvcmln aW5hbCBhY3Rpb24gdGhhdCBpbmN1cnJlZCB0aGUgc2VjdXJpdHkgZXZlbnQsIGl0DQo+ICAgICAg aXMgaW1wb3J0YW50IHRvIGNvbnNpZGVyIHRoYXQgYSBTRVQgbWlnaHQgYmUgZGVsaXZlcmVkIHRv IGEgU0VUDQo+ICAgICAgcmVjaXBpZW50IGluIGFkdmFuY2Ugb2Ygb3IgYmVoaW5kIHRoZSBwcm9j ZXNzIHRoYXQgY2F1c2VkIHRoZSBldmVudC4NCj4gICAgICBGb3IgZXhhbXBsZSwgYSB1c2VyIGhh dmluZyBiZWVuIHJlcXVpcmVkIHRvIGxvZyBvdXQgYW5kIHRoZW4gbG9nIGJhY2sNCj4gICAgICBp biBhZ2FpbiwgbWF5IGNhdXNlIGEgdG9rZW4gcmV2b2tlZCBTRVQgdG8gYmUgaXNzdWVkLCB0eXBp Y2FsbHkNCg0KTWlnaHQgYmUgY2xlYXJlciB0byBxdW90ZSAidG9rZW4gcmV2b2tlZCINCg0KTWlr ZT4gRG9uZQ0KDQoJCQkJVGhhbmtzIGFnYWluLA0KCQkJCS0tIE1pa2UgJiBQaGlsDQoNCg0K From nobody Tue May 8 22:19:33 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E79EC127058; Tue, 8 May 2018 22:19:25 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Adam Roach To: "The IESG" Cc: draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, yaronf.ietf@gmail.com, id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152584316591.2438.16648027399496706893.idtracker@ietfa.amsl.com> Date: Tue, 08 May 2018 22:19:25 -0700 Archived-At: Subject: [Id-event] Adam Roach's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 05:19:26 -0000 Adam Roach has entered the following ballot position for draft-ietf-secevent-token-11: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thanks to the authors and everyone else who contributed to this document. I have two minor editorial comments. --------------------------------------------------------------------------- Please make sure these nits are fixed before sending on to the RFC editor: == Unused Reference: 'RFC7009' is defined on line 1066, but no explicit reference was found in the text == Unused Reference: 'RFC7517' is defined on line 1078, but no explicit reference was found in the text --------------------------------------------------------------------------- §4.3: > JWTs are now being used in application areas beyond the identity > applications in which they first appeared. For instance, the Session > Initiation Protocol (SIP) Via Header Field [RFC8055] and Personal > Assertion Token (PASSporT) [RFC8225] specifications... RFC 8055 defines a Received Realm parameter for the Via Header Field, not the header field itself. Please rephrase as "...the Session Initiation Protocol (SIP) Via Header Field Received Realm parameter [RFC8055]..." From nobody Wed May 9 08:12:55 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D518126DCA; Wed, 9 May 2018 08:12:48 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Alexey Melnikov To: "The IESG" Cc: draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, yaronf.ietf@gmail.com, id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152587876814.4037.18028345896562674703.idtracker@ietfa.amsl.com> Date: Wed, 09 May 2018 08:12:48 -0700 Archived-At: Subject: [Id-event] Alexey Melnikov's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 15:12:48 -0000 Alexey Melnikov has entered the following ballot position for draft-ietf-secevent-token-11: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- This document is in a good shape, thank you for your work on it. A couple of nits: First references to Base64url and UTF-8 need normative references. Use RFC 3629 for the latter. From nobody Wed May 9 12:30:22 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CAC4112DA6C; Wed, 9 May 2018 12:30:20 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Alissa Cooper To: "The IESG" Cc: draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, yaronf.ietf@gmail.com, id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152589422080.3937.17278656045470630984.idtracker@ietfa.amsl.com> Date: Wed, 09 May 2018 12:30:20 -0700 Archived-At: Subject: [Id-event] Alissa Cooper's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 19:30:21 -0000 Alissa Cooper has entered the following ballot position for draft-ietf-secevent-token-11: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- = Sec. 5.1 = "Security events distributed through third parties or that carry personally identifiable information SHOULD be encrypted using JWE [RFC7516] or secured for confidentiality by other means." The SHOULD here seems like it should be a MUST unless there are obvious exception cases. = Sec. 5.2 = "In addition to confidentiality and integrity (discussed above), implementers and profiling specifications MUST consider the consequences of delivery mechanisms that are not secure and/or not assured." The "implementers ... MUST consider" construction seems like an odd use of normative language. From nobody Wed May 9 14:22:58 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE85112DA4A; Wed, 9 May 2018 14:22:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w25aFvMpkN2l; Wed, 9 May 2018 14:22:50 -0700 (PDT) Received: from aserp2130.oracle.com (aserp2130.oracle.com [141.146.126.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 761DB129C51; Wed, 9 May 2018 14:22:50 -0700 (PDT) Received: from pps.filterd (aserp2130.oracle.com [127.0.0.1]) by aserp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w49LLEjv061494; Wed, 9 May 2018 21:22:45 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=corp-2017-10-26; bh=Z/y4I3UzgcbKoPf4bez8qrb6nwsuDgYgp0RwYLjxFvw=; b=oJlo8398oYqw65EDdXW1LtLVKiDEOTVBTdw2h9RqVF5DCWgXA3sUlKrpwgdEmjHrRv5Z JFC6pZqcrflYSQw2ZkJ9Vw3+8JvsGCWAwDlmaMRTYF6hzj154bxRt77WA/BsbDaX2Wjp agX4AYic9FYn12UaVqpWk60ri30EsQku+TysI8NSibwsBCX4P5qgzokaImtYJqTmsIjV 8VHLOvZJOR7jD8cex9RNgQR41/LvREkGAJgYxUZ3Kl8GrX8zEUPAflRfMXv6v8Ki86i9 aShORV1IJxryWatmrcNNezI6STaUSQykLkXSbYgsQdqt3pkerf/MuJOZv6TG9eUWHpom tg== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp2130.oracle.com with ESMTP id 2hv6m4gntw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 09 May 2018 21:22:45 +0000 Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w49LMiKh023506 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 9 May 2018 21:22:44 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w49LMh04018969; Wed, 9 May 2018 21:22:43 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 09 May 2018 14:22:43 -0700 From: Phil Hunt Message-Id: <0A8CCB78-BF32-4E7B-9EAE-D98F4F03A304@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_76D960C9-6B5F-4D89-87AC-BFB2A9B5925D" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Wed, 9 May 2018 14:22:41 -0700 In-Reply-To: <152587876814.4037.18028345896562674703.idtracker@ietfa.amsl.com> Cc: The IESG , draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, id-event@ietf.org To: Alexey Melnikov References: <152587876814.4037.18028345896562674703.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.6.18) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8888 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805090199 Archived-At: Subject: Re: [Id-event] Alexey Melnikov's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 21:22:52 -0000 --Apple-Mail=_76D960C9-6B5F-4D89-87AC-BFB2A9B5925D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Alexey, Thanks for the catch. Adding the changes to draft 12. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On May 9, 2018, at 8:12 AM, Alexey Melnikov = wrote: >=20 > Alexey Melnikov has entered the following ballot position for > draft-ietf-secevent-token-11: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut = this > introductory paragraph, however.) >=20 >=20 > Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > This document is in a good shape, thank you for your work on it. >=20 > A couple of nits: >=20 > First references to Base64url and UTF-8 need normative references. > Use RFC 3629 for the latter. >=20 >=20 --Apple-Mail=_76D960C9-6B5F-4D89-87AC-BFB2A9B5925D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Alexey,

Thanks for the catch. Adding the changes to draft = 12.

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 9, 2018, at 8:12 AM, Alexey Melnikov <aamelnikov@fastmail.fm> wrote:

Alexey= Melnikov has entered the following ballot position for
draft-ietf-secevent-token-11: No Objection

When responding, please keep the subject line intact and = reply to all
email addresses included in the To and CC = lines. (Feel free to cut this
introductory paragraph, = however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.htmlfor more information about IESG DISCUSS and COMMENT = positions.


The document, = along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-token/=



---------------------------------------------------------------= -------
COMMENT:
---------------------------------------------------------------= -------

This document is in a good shape, = thank you for your work on it.

A couple of = nits:

First references to Base64url and = UTF-8 need normative references.
Use RFC 3629 for the = latter.



= --Apple-Mail=_76D960C9-6B5F-4D89-87AC-BFB2A9B5925D-- From nobody Wed May 9 15:06:12 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B623A12D7E2; Wed, 9 May 2018 15:06:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.711 X-Spam-Level: X-Spam-Status: No, score=-2.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VMvUPB1LnUd9; Wed, 9 May 2018 15:06:08 -0700 (PDT) Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D04BB126CF9; Wed, 9 May 2018 15:06:08 -0700 (PDT) Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w49M2Xtb128376; Wed, 9 May 2018 22:06:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=corp-2017-10-26; bh=YF0xpSS1gOF8esxXr0a23xCDf2n0fJbQQP+zETPkCTc=; b=bwhg+8a0NSujHnwwyO7qGEGdIAFqtf6mnOFqHHZejqX60CTc+k2Yd3Q3hPXdqDe35/O0 mXWfJM4Acf04iGSUHD3dpL2mbd9m3QKwS0K6kmfgVvkH7533pkNmOP+Fs8KzCYA9KGAq UuYvJLkt+V9Ud6iGmI/6xkBtLLSTNk3+ttrZQq8PfNr48h+fDI/JkuRCzEgXnqIqpvbK 5qMAurg8/jxwaHmaB/qzvjaOcU93Dg4DFfbKBAFiGmpLrfQNVQvPgej4FbqDjYtghVVj kRphfciT7I4mPlHx96oXshY1diMaowiQIPNRl7zgm1Avkmhmkf+lKMD4yZm1/9iHmMA4 qA== Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp2130.oracle.com with ESMTP id 2hv6kp8uud-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 09 May 2018 22:06:04 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w49M63pk021609 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 9 May 2018 22:06:03 GMT Received: from abhmp0006.oracle.com (abhmp0006.oracle.com [141.146.116.12]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w49M63H3008101; Wed, 9 May 2018 22:06:03 GMT Received: from [10.0.1.20] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 09 May 2018 15:06:03 -0700 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Phil Hunt X-Mailer: iPhone Mail (15E302) In-Reply-To: <152589422080.3937.17278656045470630984.idtracker@ietfa.amsl.com> Date: Wed, 9 May 2018 15:06:00 -0700 Cc: The IESG , secevent-chairs@ietf.org, yaronf.ietf@gmail.com, draft-ietf-secevent-token@ietf.org, id-event@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <152589422080.3937.17278656045470630984.idtracker@ietfa.amsl.com> To: Alissa Cooper X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8888 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=7 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805090205 Archived-At: Subject: Re: [Id-event] Alissa Cooper's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 22:06:11 -0000 Alissa, Thanks for the comments. I will apply them in draft 12.=20 Cheers, Phil > On May 9, 2018, at 12:30 PM, Alissa Cooper wrote: >=20 > Alissa Cooper has entered the following ballot position for > draft-ietf-secevent-token-11: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this > introductory paragraph, however.) >=20 >=20 > Please refer to https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www= .ietf.org_iesg_statement_discuss-2Dcriteria.html&d=3DDwICAg&c=3DRoP1YumCXCga= WHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3D95fIBcwc6yxsWmW8TNIRDyen0OFdCfQtVvsCvKglxMQ&s=3DyuXqSMMhZSFnEliz1Lpg= Hr4-6AVMlwMYg4hGPfUV_VI&e=3D > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.or= g_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZ= h8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D95= fIBcwc6yxsWmW8TNIRDyen0OFdCfQtVvsCvKglxMQ&s=3DNXgUokg6RBO_Hy_uEx4k1CEjdsnMAJ= zHql9xQ0wKp9E&e=3D >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > =3D Sec. 5.1 =3D >=20 > "Security events distributed through third parties or that carry > personally identifiable information SHOULD be encrypted using JWE > [RFC7516] or secured for confidentiality by other means." >=20 > The SHOULD here seems like it should be a MUST unless there are obvious ex= ception cases. >=20 > =3D Sec. 5.2 =3D >=20 > "In > addition to confidentiality and integrity (discussed above), > implementers and profiling specifications MUST consider the > consequences of delivery mechanisms that are not secure and/or not > assured." >=20 > The "implementers ... MUST consider" construction seems like an odd use of= normative language. >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI= _JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D95fIBcwc6yxsWmW8TNI= RDyen0OFdCfQtVvsCvKglxMQ&s=3DtYI2_anKOqEnJ4NeoeMuFe4ezRHvI5d--_8CfEdSx74&e=3D= From nobody Wed May 9 15:07:17 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A89E12D7E2; Wed, 9 May 2018 15:07:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.711 X-Spam-Level: X-Spam-Status: No, score=-2.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VhhsHgXXSNTp; Wed, 9 May 2018 15:07:14 -0700 (PDT) Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 553CE126CF9; Wed, 9 May 2018 15:07:14 -0700 (PDT) Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w49M2Xtg128376; Wed, 9 May 2018 22:07:11 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=corp-2017-10-26; bh=kiBWB5Oc/jOm/B8pYk3LGYYmXC+ujwcBNVYohosHbuY=; b=DnxiHVuj+fuoKAHJWpoBmqRJ+B1QS9qjCOi1JH+xVMFAsXWYmpLLY3iEzuBRctPKrzxp rcOWQHhV2PAugvWcnLnwPqCnM+COoi8pRc1ZaVMVd5Z0dJjVxXzIHl3aECTKqFp7pWfk g/1/RwyQxjSJf7skcsXbIXoOjvakyjbE9nVWzaLgpNa8WcoMsE43grn18K9KwepVi9S5 SG5E0/hiy7gh7GB0mNUp77bHbFJO9DIfJ2WD4ag0yyYrqbQS+wB/ObwzVOWA74uWBYhC VJ30wG1byk3IiXntVNmdYMcHG9AQlNwZQ831JaYBPPnY4onToG9JvUs8DmJ2xlpc8W0Q 8Q== Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp2130.oracle.com with ESMTP id 2hv6kp8uyr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 09 May 2018 22:07:11 +0000 Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w49M7AHh024435 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 9 May 2018 22:07:10 GMT Received: from abhmp0009.oracle.com (abhmp0009.oracle.com [141.146.116.15]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w49M79Fo019736; Wed, 9 May 2018 22:07:09 GMT Received: from [10.0.1.20] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 09 May 2018 15:07:09 -0700 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Phil Hunt X-Mailer: iPhone Mail (15E302) In-Reply-To: <152584316591.2438.16648027399496706893.idtracker@ietfa.amsl.com> Date: Wed, 9 May 2018 15:07:06 -0700 Cc: The IESG , draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, id-event@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <152584316591.2438.16648027399496706893.idtracker@ietfa.amsl.com> To: Adam Roach X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8888 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805090205 Archived-At: Subject: Re: [Id-event] Adam Roach's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 22:07:16 -0000 Adam, Thanks for the comments. I will apply then in draft 12.=20 Cheers, Phil > On May 8, 2018, at 10:19 PM, Adam Roach wrote: >=20 > Adam Roach has entered the following ballot position for > draft-ietf-secevent-token-11: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this > introductory paragraph, however.) >=20 >=20 > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > Thanks to the authors and everyone else who contributed to this document. I= have > two minor editorial comments. >=20 > --------------------------------------------------------------------------= - >=20 > Please make sure these nits are fixed before sending on to the RFC editor:= >=20 > =3D=3D Unused Reference: 'RFC7009' is defined on line 1066, but no explic= it > reference was found in the text >=20 > =3D=3D Unused Reference: 'RFC7517' is defined on line 1078, but no explic= it > reference was found in the text >=20 > --------------------------------------------------------------------------= - >=20 > =C2=A74.3: >=20 >> JWTs are now being used in application areas beyond the identity >> applications in which they first appeared. For instance, the Session >> Initiation Protocol (SIP) Via Header Field [RFC8055] and Personal >> Assertion Token (PASSporT) [RFC8225] specifications... >=20 > RFC 8055 defines a Received Realm parameter for the Via Header Field, not t= he > header field itself. Please rephrase as "...the Session Initiation Protoco= l > (SIP) Via Header Field Received Realm parameter [RFC8055]..." >=20 >=20 From nobody Wed May 9 16:18:15 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EBF96126CF9; Wed, 9 May 2018 16:18:07 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152590788792.10350.4922410492622474159@ietfa.amsl.com> Date: Wed, 09 May 2018 16:18:07 -0700 Archived-At: Subject: [Id-event] I-D Action: draft-ietf-secevent-token-12.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 23:18:08 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Events WG of the IETF. Title : Security Event Token (SET) Authors : Phil Hunt Michael B. Jones William Denniss Morteza Ansari Filename : draft-ietf-secevent-token-12.txt Pages : 31 Date : 2018-05-09 Abstract: This specification defines the Security Event Token (SET) data structure. A SET describes statements of fact from the perspective of an issuer about a subject. These statements of fact represent an event that occurred directly to or about a security subject, for example, a statement about the issuance or revocation of a token on behalf of a subject. This specification is intended to enable representing security- and identity-related events. A SET is a JSON Web Token (JWT), which can be optionally signed and/or encrypted. SETs can be distributed via protocols such as HTTP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-secevent-token-12 https://datatracker.ietf.org/doc/html/draft-ietf-secevent-token-12 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-token-12 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed May 9 16:24:42 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEB0912DA17; Wed, 9 May 2018 16:24:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lz7fhKFzrGiS; Wed, 9 May 2018 16:24:33 -0700 (PDT) Received: from aserp2120.oracle.com (aserp2120.oracle.com [141.146.126.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9EC012D7F3; Wed, 9 May 2018 16:24:33 -0700 (PDT) Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w49NLpuI076875; Wed, 9 May 2018 23:24:32 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=corp-2017-10-26; bh=+SXg1+FBrXVx859xNB2fFarWJVSv0LdebG5ZydUH3X8=; b=Po1H/cJIBbYNbTz/J2XTSKKeM+p/xpSKiDNaHEpcrLSFkbrJv+I6eqOxveKPIbX/9ym9 N4R3RexO0OYlIxzsi8CVDj0v5dM61VtOOWgI4CMnjgL92JaFN6AqjtkgZaYU86qeF4H0 B+LbgM+1JV5Lw6oRWfScEJCQvdTyxvIRBnTvSCiq9BicRoJylOy32eXloS99dRmCMhvM OcMslcZJ0i5WhRnCfZQI9S4p7Bi1zreDE4RTOASCimT2NCsmjqm9KA7w0/xRth/1ic0R t+l4axa91Rdaomx0IinuQ0LQo7vQdAcEakYPtRkCA8R3f3zoz/uLFGPk8V0XF9vCjNYD dw== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp2120.oracle.com with ESMTP id 2hv6kp12pd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 09 May 2018 23:24:32 +0000 Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w49NOVAS017127 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 9 May 2018 23:24:31 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w49NOVjO024289; Wed, 9 May 2018 23:24:31 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 09 May 2018 16:24:30 -0700 From: Phil Hunt Message-Id: <451DE49E-C184-4A80-B04B-D57A22FBB5D8@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_0F811C8D-0030-4740-9F7E-60A682171765" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Wed, 9 May 2018 16:24:29 -0700 In-Reply-To: <152590788792.10350.4922410492622474159@ietfa.amsl.com> Cc: i-d-announce@ietf.org, id-event@ietf.org To: internet-drafts@ietf.org References: <152590788792.10350.4922410492622474159@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.6.18) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8888 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805090215 Archived-At: Subject: Re: [Id-event] I-D Action: draft-ietf-secevent-token-12.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 23:24:37 -0000 --Apple-Mail=_0F811C8D-0030-4740-9F7E-60A682171765 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 This update incorporates feedback from Adam Roach, Alexey Melnikov, and = Alissa Cooper. o Removed unused references to RFC 7009 and RFC 7517. o Corrected name of RFC 8055 in Section 4.3 to "Session Initiation Protocol (SIP) Via Header Field Parameter to Indicate Received Realm". o Added normative references for base64url and UTF-8. o Section 5.1 - Changed SHOULD to MUST in "personally identifiable information MUST be encrypted using JWE [RFC7516] or ...". o Section 5.2 - Changed "MUST consider" to "must consider=E2=80=9D. Thanks everyone! Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On May 9, 2018, at 4:18 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Security Events WG of the IETF. >=20 > Title : Security Event Token (SET) > Authors : Phil Hunt > Michael B. Jones > William Denniss > Morteza Ansari > Filename : draft-ietf-secevent-token-12.txt > Pages : 31 > Date : 2018-05-09 >=20 > Abstract: > This specification defines the Security Event Token (SET) data > structure. A SET describes statements of fact from the perspective > of an issuer about a subject. These statements of fact represent an > event that occurred directly to or about a security subject, for > example, a statement about the issuance or revocation of a token on > behalf of a subject. This specification is intended to enable > representing security- and identity-related events. A SET is a JSON > Web Token (JWT), which can be optionally signed and/or encrypted. > SETs can be distributed via protocols such as HTTP. >=20 >=20 > The IETF datatracker status page for this draft is: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.or= g_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8= PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D= NXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkNO_3CJx8&s=3DIDNzRl7aHmWJwxLuE_qKw6k1K4= Alq_cbzI_KiO_5NcM&e=3D >=20 > There are also htmlized versions available at: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__tools.ietf.org_html= _draft-2Dietf-2Dsecevent-2Dtoken-2D12&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8P= Zh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D= NXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkNO_3CJx8&s=3DJXXSYfFKL1zeKtfRjGH9nRTse9= gMxeXwY8v51L1B7OE&e=3D > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.or= g_doc_html_draft-2Dietf-2Dsecevent-2Dtoken-2D12&d=3DDwICAg&c=3DRoP1YumCXCg= aWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcL= N4KZNA&m=3DNXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkNO_3CJx8&s=3DSLDXUrsLni2XzYm= jlL3kXuLtsbT2bpH-OXFaj0juGCc&e=3D >=20 > A diff from the previous version is available at: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_rfcdif= f-3Furl2-3Ddraft-2Dietf-2Dsecevent-2Dtoken-2D12&d=3DDwICAg&c=3DRoP1YumCXCg= aWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcL= N4KZNA&m=3DNXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkNO_3CJx8&s=3DKNgd2x-0rlFvASj= 90a203LUclSe5TlLLWrOZJe9AbzQ&e=3D >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > = https://urldefense.proofpoint.com/v2/url?u=3Dftp-3A__ftp.ietf.org_internet= -2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D= na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DNXu-kA6pso5OBdU15rCDola-Mn= CZxWfZ2nkNO_3CJx8&s=3DepuofEykxEFWGxD3gV2AOPykzQhr5YRDol6kQdz1QOY&e=3D >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65ea= pI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DNXu-kA6pso5OBdU= 15rCDola-MnCZxWfZ2nkNO_3CJx8&s=3DZxerjhu6ccLZ-8IrH2XkeIqWbFpjfLKydI05c4m22= No&e=3D --Apple-Mail=_0F811C8D-0030-4740-9F7E-60A682171765 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
This update incorporates feedback from Adam Roach, Alexey = Melnikov, and Alissa Cooper.

   o  Removed unused = references to RFC 7009 and RFC 7517.

   o  Corrected name of = RFC 8055 in Section 4.3 to "Session Initiation
 =     Protocol (SIP) Via Header Field Parameter to Indicate = Received
      Realm".

   o =  Added normative references for base64url and UTF-8.

   o =  Section 5.1 - Changed SHOULD to MUST in "personally = identifiable
      information MUST = be encrypted using JWE [RFC7516] or ...".

   o  Section 5.2 - = Changed "MUST consider" to "must consider=E2=80=9D.

Thanks = everyone!

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 9, 2018, at 4:18 PM, internet-drafts@ietf.org wrote:


A New Internet-Draft is available from the on-line = Internet-Drafts directories.
This draft is a work item of = the Security Events WG of the IETF.

=        Title =           : Security = Event Token (SET)
=        Authors =         : Phil Hunt
= =             &n= bsp;           &nbs= p;Michael B. Jones
=             &n= bsp;           &nbs= p;William Denniss
=             &n= bsp;           &nbs= p;Morteza Ansari
Filename =        : = draft-ietf-secevent-token-12.txt
Pages =           : 31
= Date =            : = 2018-05-09

Abstract:
=   This specification defines the Security Event Token (SET) = data
  structure.  A SET describes = statements of fact from the perspective
  of an = issuer about a subject.  These statements of fact represent an
  event that occurred directly to or about a = security subject, for
  example, a statement = about the issuance or revocation of a token on
=   behalf of a subject.  This specification is intended to = enable
  representing security- and = identity-related events.  A SET is a JSON
=   Web Token (JWT), which can be optionally signed and/or = encrypted.
  SETs can be distributed via = protocols such as HTTP.


The = IETF datatracker status page for this draft is:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwICAg&c=3DR= oP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyX= PpuYqPkAI1aLcLN4KZNA&m=3DNXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkNO_3CJx8&a= mp;s=3DIDNzRl7aHmWJwxLuE_qKw6k1K4Alq_cbzI_KiO_5NcM&e=3D

There are also htmlized versions available = at:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__tools.ie= tf.org_html_draft-2Dietf-2Dsecevent-2Dtoken-2D12&d=3DDwICAg&c=3DRo= P1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXP= puYqPkAI1aLcLN4KZNA&m=3DNXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkNO_3CJx8&am= p;s=3DJXXSYfFKL1zeKtfRjGH9nRTse9gMxeXwY8v51L1B7OE&e=3D
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_html_draft-2Dietf-2Dsecevent-2Dtoken-2D12&d=3DDwICAg&= amp;c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqW= Ny4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DNXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkN= O_3CJx8&s=3DSLDXUrsLni2XzYmjlL3kXuLtsbT2bpH-OXFaj0juGCc&e=3D

A diff from the previous version is available = at:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_rfcdiff-3Furl2-3Ddraft-2Dietf-2Dsecevent-2Dtoken-2D12&d=3DDwICAg&= amp;c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqW= Ny4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DNXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkN= O_3CJx8&s=3DKNgd2x-0rlFvASj90a203LUclSe5TlLLWrOZJe9AbzQ&e=3D


Please note that it may take a = couple of minutes from the time of submission
until the = htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by = anonymous FTP at:
https://urldefense.proofpoint.com/v2/url?u=3Dftp-3A__ftp.ietf.o= rg_internet-2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qI= rMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D= NXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkNO_3CJx8&s=3DepuofEykxEFWGxD3gV2AOP= ykzQhr5YRDol6kQdz1QOY&e=3D

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3DNXu-kA6pso5OBdU15rCDola-MnCZxWfZ2nkNO_3CJx8&s=3DZxerjhu6cc= LZ-8IrH2XkeIqWbFpjfLKydI05c4m22No&e=3D

= --Apple-Mail=_0F811C8D-0030-4740-9F7E-60A682171765-- From nobody Wed May 9 16:25:40 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92FEA12DA17; Wed, 9 May 2018 16:25:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xOuWUiYuYnIy; Wed, 9 May 2018 16:25:31 -0700 (PDT) Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5188412D7F3; Wed, 9 May 2018 16:25:31 -0700 (PDT) Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w49NKvDv182023; Wed, 9 May 2018 23:25:27 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=corp-2017-10-26; bh=WofrR0ThnVgOdNLHwrPgFYvlQAEEpYiKjjWx/PDWCpg=; b=iXFjDcbvAmpzmyglPLBW1fdt489St138tphWbvI5KQ/7wK7daZ1mBKwKTTwZZ6oOEtFT uzI1nTUq5/B5tEHnPU+sAp6c0++XgUleK7fBYrXmwycb2AqqLklDJMdaWKcSpUZYdmkK lCs7jqxy+LPAdy1Do/2bw3eBUENk3oTz0s1GMm2iI+gTYiYyQA6/EqfWq7TddIRRu9dT zGPYs3EpslnnkNy6OKbf6x84M9Gb28wmFTBlgc6xd/459RWzLW/CrVIazshPObdrzsKq NCIWETrv47OcIy/QFlo6TRgcWqOq53pcXkyHnruIwwZPegJDZh/OHamPDHS6HVoQkuxK Yg== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp2130.oracle.com with ESMTP id 2hv6kp93dv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 09 May 2018 23:25:26 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w49NPQCm019375 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 9 May 2018 23:25:26 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w49NPP2Z020576; Wed, 9 May 2018 23:25:25 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 09 May 2018 16:25:25 -0700 From: Phil Hunt Message-Id: <993988C7-0C27-465D-9BEE-9BD40861F93B@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_6F9B7266-3239-46AC-B03C-47DBCBA5161F" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Wed, 9 May 2018 16:25:24 -0700 In-Reply-To: <152589422080.3937.17278656045470630984.idtracker@ietfa.amsl.com> Cc: The IESG , draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, id-event@ietf.org To: Alissa Cooper References: <152589422080.3937.17278656045470630984.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.6.18) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8888 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=8 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805090215 Archived-At: Subject: Re: [Id-event] Alissa Cooper's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 23:25:34 -0000 --Apple-Mail=_6F9B7266-3239-46AC-B03C-47DBCBA5161F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Alissa, Your feedback is now posted in draft 12.=20 Thanks again, Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On May 9, 2018, at 12:30 PM, Alissa Cooper wrote: >=20 > Alissa Cooper has entered the following ballot position for > draft-ietf-secevent-token-11: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut = this > introductory paragraph, however.) >=20 >=20 > Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > =3D Sec. 5.1 =3D >=20 > "Security events distributed through third parties or that carry > personally identifiable information SHOULD be encrypted using JWE > [RFC7516] or secured for confidentiality by other means." >=20 > The SHOULD here seems like it should be a MUST unless there are = obvious exception cases. >=20 > =3D Sec. 5.2 =3D >=20 > "In > addition to confidentiality and integrity (discussed above), > implementers and profiling specifications MUST consider the > consequences of delivery mechanisms that are not secure and/or not > assured." >=20 > The "implementers ... MUST consider" construction seems like an odd = use of normative language. >=20 >=20 --Apple-Mail=_6F9B7266-3239-46AC-B03C-47DBCBA5161F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Alissa,

Your feedback is now posted in draft 12. 

Thanks again,

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 9, 2018, at 12:30 PM, Alissa Cooper <alissa@cooperw.in> = wrote:

Alissa Cooper has entered the following ballot position = for
draft-ietf-secevent-token-11: No Objection

When responding, please keep the subject line = intact and reply to all
email addresses included in the To = and CC lines. (Feel free to cut this
introductory = paragraph, however.)


Please = refer to https://www.ietf.org/iesg/statement/discuss-criteria.htmlfor more information about IESG DISCUSS and COMMENT = positions.


The document, = along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-token/=



---------------------------------------------------------------= -------
COMMENT:
---------------------------------------------------------------= -------

=3D Sec. 5.1 =3D

"Security events distributed through third parties or that = carry
  personally identifiable information = SHOULD be encrypted using JWE
  [RFC7516] or = secured for confidentiality by other means."

The SHOULD here seems like it should be a MUST unless there = are obvious exception cases.

=3D Sec. 5.2 = =3D

"In
  addition = to confidentiality and integrity (discussed above),
=   implementers and profiling specifications MUST consider = the
  consequences of delivery mechanisms that = are not secure and/or not
  assured."

The "implementers ... MUST consider" = construction seems like an odd use of normative language.



= --Apple-Mail=_6F9B7266-3239-46AC-B03C-47DBCBA5161F-- From nobody Wed May 9 16:26:37 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E377212D7F3; Wed, 9 May 2018 16:26:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UOddr6MRJtHb; Wed, 9 May 2018 16:26:28 -0700 (PDT) Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC482126CF9; Wed, 9 May 2018 16:26:28 -0700 (PDT) Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w49NQRmE185482; Wed, 9 May 2018 23:26:27 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=corp-2017-10-26; bh=4j6RqLGIRDt09t2iftYYRrk2WF56cS3jBauYEDljEZA=; b=L5/ixnGswuAXg4a/0T49SLuMyKmTwOrAQPoiWz0lLrSiQY7b0W6UTuUB33VAp+p+SYZ1 7HV0JD1mqlOZ1YcuyncQ6KMAV6akL/zQo3iX0ChKzqYjl7N9yBgcldcWhxbFY9SVSylA 9loiIgnDp+537OJQJkXuVHhMOoxpKqs6vR+ryFuWRcz5lRaKmo9+h/xnpYpRgT6rN4Kr lLbZ5kRjX2zM118q12UvD9/fNpsogscd8/5AybKXI7O3S+9f1MRYKa6JAAy0mW8oTiJc LjcldSJZZK2ULQuVP0/km2X1nRWN8Yvcjw4oKz7p5CT02YgPiJxgJIt+y/1A49ZsJMTF hQ== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp2130.oracle.com with ESMTP id 2hv6kp93ga-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 09 May 2018 23:26:27 +0000 Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w49NQRG7021850 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 9 May 2018 23:26:27 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w49NQQ19025037; Wed, 9 May 2018 23:26:26 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 09 May 2018 16:26:26 -0700 From: Phil Hunt Message-Id: <7C051133-5E40-4127-A5F4-539917CF3202@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_8EA01722-F802-4211-B4F4-80275C4183FA" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Wed, 9 May 2018 16:26:24 -0700 In-Reply-To: Cc: The IESG , draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, ID Events Mailing List To: Adam Roach References: <152584316591.2438.16648027399496706893.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.6.18) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8888 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805090216 Archived-At: Subject: Re: [Id-event] Adam Roach's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 23:26:31 -0000 --Apple-Mail=_8EA01722-F802-4211-B4F4-80275C4183FA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Adam, Your comments are now posted in draft 12. Cheers, Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On May 9, 2018, at 3:07 PM, Phil Hunt wrote: >=20 > Adam, >=20 > Thanks for the comments. I will apply then in draft 12.=20 >=20 > Cheers, >=20 > Phil >=20 >> On May 8, 2018, at 10:19 PM, Adam Roach wrote: >>=20 >> Adam Roach has entered the following ballot position for >> draft-ietf-secevent-token-11: No Objection >>=20 >> When responding, please keep the subject line intact and reply to all >> email addresses included in the To and CC lines. (Feel free to cut = this >> introductory paragraph, however.) >>=20 >>=20 >> Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html >> for more information about IESG DISCUSS and COMMENT positions. >>=20 >>=20 >> The document, along with other ballot positions, can be found here: >> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >>=20 >>=20 >>=20 >> = ---------------------------------------------------------------------- >> COMMENT: >> = ---------------------------------------------------------------------- >>=20 >> Thanks to the authors and everyone else who contributed to this = document. I have >> two minor editorial comments. >>=20 >> = --------------------------------------------------------------------------= - >>=20 >> Please make sure these nits are fixed before sending on to the RFC = editor: >>=20 >> =3D=3D Unused Reference: 'RFC7009' is defined on line 1066, but no = explicit >> reference was found in the text >>=20 >> =3D=3D Unused Reference: 'RFC7517' is defined on line 1078, but no = explicit >> reference was found in the text >>=20 >> = --------------------------------------------------------------------------= - >>=20 >> =C2=A74.3: >>=20 >>> JWTs are now being used in application areas beyond the identity >>> applications in which they first appeared. For instance, the = Session >>> Initiation Protocol (SIP) Via Header Field [RFC8055] and Personal >>> Assertion Token (PASSporT) [RFC8225] specifications... >>=20 >> RFC 8055 defines a Received Realm parameter for the Via Header Field, = not the >> header field itself. Please rephrase as "...the Session Initiation = Protocol >> (SIP) Via Header Field Received Realm parameter [RFC8055]..." >>=20 >>=20 >=20 --Apple-Mail=_8EA01722-F802-4211-B4F4-80275C4183FA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Adam,

Your = comments are now posted in draft 12.

Cheers,

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 9, 2018, at 3:07 PM, Phil Hunt <phil.hunt@oracle.com> wrote:

Adam,

Thanks for the comments. I = will apply then in draft 12.

Cheers,

Phil

On May 8, 2018, at 10:19 PM, Adam Roach <adam@nostrum.com> = wrote:

Adam Roach has entered the following = ballot position for
draft-ietf-secevent-token-11: No = Objection

When responding, please keep the = subject line intact and reply to all
email addresses = included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.htmlfor more information about IESG DISCUSS and COMMENT = positions.


The document, = along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-token/=



---------------------------------------------------------------= -------
COMMENT:
---------------------------------------------------------------= -------

Thanks to the authors and everyone = else who contributed to this document. I have
two minor = editorial comments.

---------------------------------------------------------------= ------------

Please make sure these nits = are fixed before sending on to the RFC editor:

=3D=3D Unused Reference: 'RFC7009' is defined on line 1066, = but no explicit
   reference was found in = the text

=3D=3D Unused Reference: = 'RFC7517' is defined on line 1078, but no explicit
=    reference was found in the text

---------------------------------------------------------------= ------------

=C2=A74.3:

JWTs are now being used = in application areas beyond the identity
applications in = which they first appeared.  For instance, the Session
Initiation Protocol (SIP) Via Header Field [RFC8055] and = Personal
Assertion Token (PASSporT) [RFC8225] = specifications...

RFC 8055 = defines a Received Realm parameter for the Via Header Field, not the
header field itself. Please rephrase as "...the Session = Initiation Protocol
(SIP) Via Header Field Received Realm = parameter [RFC8055]..."




= --Apple-Mail=_8EA01722-F802-4211-B4F4-80275C4183FA-- From nobody Wed May 9 16:27:41 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CF6C12E865; Wed, 9 May 2018 16:27:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eXo4XOAK3VlV; Wed, 9 May 2018 16:27:32 -0700 (PDT) Received: from aserp2130.oracle.com (aserp2130.oracle.com [141.146.126.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 561B2126CF9; Wed, 9 May 2018 16:27:32 -0700 (PDT) Received: from pps.filterd (aserp2130.oracle.com [127.0.0.1]) by aserp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w49NQSpB147776; Wed, 9 May 2018 23:27:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=corp-2017-10-26; bh=gZo3oNuwsvQDcRY5QWdvF0ak8c3kwVJ1bPh8ci0WRHY=; b=G1tPuSijq73feJcK1mmlaLMN4vOlF8wNvNby+hIWQLsPIIuG9a1pa/E1y9kYHo17S1uO iaOuA1sXAK6sl4LWnH2GYiepXTatmP0hxaQ7KJ4zdBuTckk/+upN4hjcEuCFkw8zzZHl rzjyPFLfyAd5pA9adabrnlPIaIsAp2YPaKBm0yWFYQLgLz7yUunAA8ZrWnLaetUfuOuM iv/gnFZP4/qHySsILQZfroyQtVO/kyqPiToZmDvwlsb2QL9fe3ibndFfEb7arqYbwIS7 a2nIgtgvTmVp8tpLc0k6THFog+HFWGUz4fM1g5n7Q5U605SQtAPPx7b6ctIDHXNthDZ3 mg== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp2130.oracle.com with ESMTP id 2hv6m4h29t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 09 May 2018 23:27:27 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w49NRQV1023825 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 9 May 2018 23:27:26 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w49NRQH3021440; Wed, 9 May 2018 23:27:26 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 09 May 2018 16:27:26 -0700 From: Phil Hunt Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_D904A28F-8801-4C34-BBB7-8FC1A4220001" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Wed, 9 May 2018 16:27:24 -0700 In-Reply-To: <152587876814.4037.18028345896562674703.idtracker@ietfa.amsl.com> Cc: The IESG , draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, id-event@ietf.org To: Alexey Melnikov References: <152587876814.4037.18028345896562674703.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.6.18) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8888 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805090216 Archived-At: Subject: Re: [Id-event] Alexey Melnikov's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 23:27:34 -0000 --Apple-Mail=_D904A28F-8801-4C34-BBB7-8FC1A4220001 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Alexey, Your comments have now been posted in draft 12. Cheers, Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On May 9, 2018, at 8:12 AM, Alexey Melnikov = wrote: >=20 > Alexey Melnikov has entered the following ballot position for > draft-ietf-secevent-token-11: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut = this > introductory paragraph, however.) >=20 >=20 > Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > This document is in a good shape, thank you for your work on it. >=20 > A couple of nits: >=20 > First references to Base64url and UTF-8 need normative references. > Use RFC 3629 for the latter. >=20 >=20 --Apple-Mail=_D904A28F-8801-4C34-BBB7-8FC1A4220001 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Alexey,

Your comments have now been posted in draft 12.

Cheers,

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 9, 2018, at 8:12 AM, Alexey Melnikov <aamelnikov@fastmail.fm> wrote:

Alexey= Melnikov has entered the following ballot position for
draft-ietf-secevent-token-11: No Objection

When responding, please keep the subject line intact and = reply to all
email addresses included in the To and CC = lines. (Feel free to cut this
introductory paragraph, = however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.htmlfor more information about IESG DISCUSS and COMMENT = positions.


The document, = along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-token/=



---------------------------------------------------------------= -------
COMMENT:
---------------------------------------------------------------= -------

This document is in a good shape, = thank you for your work on it.

A couple of = nits:

First references to Base64url and = UTF-8 need normative references.
Use RFC 3629 for the = latter.



= --Apple-Mail=_D904A28F-8801-4C34-BBB7-8FC1A4220001-- From nobody Wed May 9 17:26:20 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B82EA12E057; Wed, 9 May 2018 17:26:18 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152591197871.10259.4492445207095813392@ietfa.amsl.com> Date: Wed, 09 May 2018 17:26:18 -0700 Archived-At: Subject: [Id-event] I-D Action: draft-ietf-secevent-token-13.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 00:26:19 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Events WG of the IETF. Title : Security Event Token (SET) Authors : Phil Hunt Michael B. Jones William Denniss Morteza Ansari Filename : draft-ietf-secevent-token-13.txt Pages : 31 Date : 2018-05-09 Abstract: This specification defines the Security Event Token (SET) data structure. A SET describes statements of fact from the perspective of an issuer about a subject. These statements of fact represent an event that occurred directly to or about a security subject, for example, a statement about the issuance or revocation of a token on behalf of a subject. This specification is intended to enable representing security- and identity-related events. A SET is a JSON Web Token (JWT), which can be optionally signed and/or encrypted. SETs can be distributed via protocols such as HTTP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-secevent-token-13 https://datatracker.ietf.org/doc/html/draft-ietf-secevent-token-13 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-token-13 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed May 9 17:30:33 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4660212E057; Wed, 9 May 2018 17:30:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YadPJEPljUV6; Wed, 9 May 2018 17:30:30 -0700 (PDT) Received: from aserp2120.oracle.com (aserp2120.oracle.com [141.146.126.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF8E41200A0; Wed, 9 May 2018 17:30:29 -0700 (PDT) Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w4A0KY8g114662; Thu, 10 May 2018 00:30:29 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=corp-2017-10-26; bh=nHKoo8Sb+pcfHbCF+A5nMysdY7uNP2cmHihNKUav/nQ=; b=jn5Qawqupm0hfCS3BioLJQIbRGPNrjsIG8Nkq87nDMQ4XbzsECUq2+UDqj2zqCQS2P1R wQyH7cQjnt1i9tyKmv0/Y8LeCAFuGxFgawAeeamNhbV9+acCGsU092jXWqep0063+2Xy Ztcve7ni0aWJ1Ls14zrZox5K9ab/h+f7ktCOvMoH94tLfE6RlTQzgk3kBWWcHshv+GEg EZlCSqEcHiq6tI4lHYa1BeDzBtz33HLHEB/vuy6esji8cG0irt/1Kv05sSk5ZXswFKIq bDUrRz6xjDu1zodwUqPPrmkAWdv6g7fNym/nZTPI8SNOi5CgGRMumpqyRAyDUkcJvLZ3 Ww== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp2120.oracle.com with ESMTP id 2hv6kp183j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 10 May 2018 00:30:28 +0000 Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w4A0USb5017728 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 10 May 2018 00:30:28 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w4A0URMd022554; Thu, 10 May 2018 00:30:27 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 09 May 2018 17:30:27 -0700 From: Phil Hunt Message-Id: <9EC99EBB-2B98-40C4-AFA4-2CAD919DE385@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_8B32A8B8-8777-47D5-8E34-997B5D92A798" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Wed, 9 May 2018 17:30:25 -0700 In-Reply-To: <152591197871.10259.4492445207095813392@ietfa.amsl.com> Cc: i-d-announce@ietf.org, id-event@ietf.org To: internet-drafts@ietf.org References: <152591197871.10259.4492445207095813392@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.6.18) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8888 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805100001 Archived-At: Subject: Re: [Id-event] I-D Action: draft-ietf-secevent-token-13.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 00:30:32 -0000 --Apple-Mail=_8B32A8B8-8777-47D5-8E34-997B5D92A798 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Apologies for 2 drafts today. Draft 13 addresses a comment from Martin = Vigoureux regarding a non-normative MAY. Thanks to Mike who noticed it = on the document status. We wanted to get this nit addressed ahead of = tomorrow's telechat. Regards, Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On May 9, 2018, at 5:26 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Security Events WG of the IETF. >=20 > Title : Security Event Token (SET) > Authors : Phil Hunt > Michael B. Jones > William Denniss > Morteza Ansari > Filename : draft-ietf-secevent-token-13.txt > Pages : 31 > Date : 2018-05-09 >=20 > Abstract: > This specification defines the Security Event Token (SET) data > structure. A SET describes statements of fact from the perspective > of an issuer about a subject. These statements of fact represent an > event that occurred directly to or about a security subject, for > example, a statement about the issuance or revocation of a token on > behalf of a subject. This specification is intended to enable > representing security- and identity-related events. A SET is a JSON > Web Token (JWT), which can be optionally signed and/or encrypted. > SETs can be distributed via protocols such as HTTP. >=20 >=20 > The IETF datatracker status page for this draft is: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.or= g_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8= PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D= YVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DTKCt4s8_UAzD0LKg3XRy1ArveQ= 4Kz4AF7AUgOFPQOrE&e=3D >=20 > There are also htmlized versions available at: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__tools.ietf.org_html= _draft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8P= Zh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D= YVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3Duj9ERlh8rz9AmLq1jI3iNDT7id= BLijfPqLATbME0rwk&e=3D > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.or= g_doc_html_draft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&c=3DRoP1YumCXCg= aWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcL= N4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DtHlycQjNI-NTpHH= R5FWN08hbbtLOxF4ikw7QGDdv2BM&e=3D >=20 > A diff from the previous version is available at: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_rfcdif= f-3Furl2-3Ddraft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&c=3DRoP1YumCXCg= aWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcL= N4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DlnlHG42k_dDatVY= guj9I-Tdf-tMTF4kfL_3Wlmw-N3w&e=3D >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > = https://urldefense.proofpoint.com/v2/url?u=3Dftp-3A__ftp.ietf.org_internet= -2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D= na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAx= NO-FqnUrEJlREH7Uw&s=3Dg2q0nvtYwyVHQ82FuJvjJMHnTmxiKTYIs5qtVYFeYHw&e=3D >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65ea= pI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYVELA0RpOT--40T= f54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DZ1U5RerOt4KIpZVUmC1gFkZ1gYDd0cEHIjy4warxM= fA&e=3D --Apple-Mail=_8B32A8B8-8777-47D5-8E34-997B5D92A798 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Apologies for 2 drafts today. Draft 13 addresses a comment = from Martin Vigoureux regarding a non-normative MAY. Thanks to Mike who = noticed it on the document status. We wanted to get this nit addressed = ahead of tomorrow's telechat.

Regards,

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 9, 2018, at 5:26 PM, internet-drafts@ietf.org wrote:


A New Internet-Draft is available from the on-line = Internet-Drafts directories.
This draft is a work item of = the Security Events WG of the IETF.

=        Title =           : Security = Event Token (SET)
=        Authors =         : Phil Hunt
= =             &n= bsp;           &nbs= p;Michael B. Jones
=             &n= bsp;           &nbs= p;William Denniss
=             &n= bsp;           &nbs= p;Morteza Ansari
Filename =        : = draft-ietf-secevent-token-13.txt
Pages =           : 31
= Date =            : = 2018-05-09

Abstract:
=   This specification defines the Security Event Token (SET) = data
  structure.  A SET describes = statements of fact from the perspective
  of an = issuer about a subject.  These statements of fact represent an
  event that occurred directly to or about a = security subject, for
  example, a statement = about the issuance or revocation of a token on
=   behalf of a subject.  This specification is intended to = enable
  representing security- and = identity-related events.  A SET is a JSON
=   Web Token (JWT), which can be optionally signed and/or = encrypted.
  SETs can be distributed via = protocols such as HTTP.


The = IETF datatracker status page for this draft is:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwICAg&c=3DR= oP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyX= PpuYqPkAI1aLcLN4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&a= mp;s=3DTKCt4s8_UAzD0LKg3XRy1ArveQ4Kz4AF7AUgOFPQOrE&e=3D

There are also htmlized versions available = at:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__tools.ie= tf.org_html_draft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&c=3DRo= P1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXP= puYqPkAI1aLcLN4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&am= p;s=3Duj9ERlh8rz9AmLq1jI3iNDT7idBLijfPqLATbME0rwk&e=3D
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_html_draft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&= amp;c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqW= Ny4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJ= lREH7Uw&s=3DtHlycQjNI-NTpHHR5FWN08hbbtLOxF4ikw7QGDdv2BM&e=3D

A diff from the previous version is available = at:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_rfcdiff-3Furl2-3Ddraft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&= amp;c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqW= Ny4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJ= lREH7Uw&s=3DlnlHG42k_dDatVYguj9I-Tdf-tMTF4kfL_3Wlmw-N3w&e=3D


Please note that it may take a = couple of minutes from the time of submission
until the = htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by = anonymous FTP at:
https://urldefense.proofpoint.com/v2/url?u=3Dftp-3A__ftp.ietf.o= rg_internet-2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qI= rMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D= YVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3Dg2q0nvtYwyVHQ82FuJvjJM= HnTmxiKTYIs5qtVYFeYHw&e=3D

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DZ1U5RerOt4= KIpZVUmC1gFkZ1gYDd0cEHIjy4warxMfA&e=3D

= --Apple-Mail=_8B32A8B8-8777-47D5-8E34-997B5D92A798-- From nobody Wed May 9 17:34:05 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0879F12E057 for ; Wed, 9 May 2018 17:34:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.028 X-Spam-Level: X-Spam-Status: No, score=-2.028 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LZ0nRIb6iv7J for ; Wed, 9 May 2018 17:34:01 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0065.outbound.protection.outlook.com [104.47.42.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BC431200A0 for ; Wed, 9 May 2018 17:34:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=CTNkYI7WB+TtmN7CgV9nFGMdREV+LKGZb08f1hOazVk=; b=RpBtKJWDwDT3yysdOHXZTBUvVOVezIATqG+NEi81yCclsFmEU1aypuSmoLf13BTsmZdsRr8hKHuCfm7TtBRQcWSSEZt9hE4xVRaSNdvupA1qD0L7Yao+IwKvR4F2smC1gPTpcPjtLiN+zFQ1DIlU0SS+/0+QAvW33s1K5m7Rxsw= Received: from SN6PR00MB0304.namprd00.prod.outlook.com (2603:10b6:805:b::30) by SN6PR00MB0413.namprd00.prod.outlook.com (2603:10b6:805:c::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.793.0; Thu, 10 May 2018 00:33:59 +0000 Received: from SN6PR00MB0304.namprd00.prod.outlook.com ([fe80::78c2:1262:2203:b29]) by SN6PR00MB0304.namprd00.prod.outlook.com ([fe80::78c2:1262:2203:b29%4]) with mapi id 15.20.0796.000; Thu, 10 May 2018 00:33:59 +0000 From: Mike Jones To: Martin Vigoureux CC: Phil Hunt , "id-event@ietf.org" Thread-Topic: [Id-event] I-D Action: draft-ietf-secevent-token-13.txt Thread-Index: AQHT5/WKv6ptH877SU2uGXT7HR+S+aQoHEKAgAAAh6A= Date: Thu, 10 May 2018 00:33:59 +0000 Message-ID: References: <152591197871.10259.4492445207095813392@ietfa.amsl.com> <9EC99EBB-2B98-40C4-AFA4-2CAD919DE385@oracle.com> In-Reply-To: <9EC99EBB-2B98-40C4-AFA4-2CAD919DE385@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-05-10T00:33:58.1496862Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:b::145] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; SN6PR00MB0413; 7:qamhwjakHuQV6HohViuOeCJnnDkhZ4UdsmVuGLVqxXYAkIw/zeKyP0VstPuxsLv2ydCcrF8mVRke8XNarXW4+bUwTkBUMM4qBqhtdDmJdYdBhj8wpIe9hyxU912i8QsUmd6G3PAMX4SI84RQBrLg6WA8+AW9Jj8DGvTAeT/3n+qQPADG8u+vcNEoWYAldTO859cFFeEQizSW+83HbPMxDnpFwajDfy343a56IEcl+IpAqEiUqdOLRkinlngxZLx0; 20:By6irpe+AdwKwy/0F7BDMHpdcNrP8KL75xlyzo97I2MAE+5qRay0fwSjLioeYZCv/vHVrXC3tKm39535slnq34JfQ/zr9QYALW6V/7VSvAsm3Qn5MwEKmmC/bEKnLAZdxGqNiTcz6gwb96LuHjA/5JTe73p7JV7NdD+Ibcq28Pk= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(4534165)(4627221)(201703031133081)(201702281549075)(5600026)(48565401081)(2017052603328)(7193020); SRVR:SN6PR00MB0413; x-ms-traffictypediagnostic: SN6PR00MB0413: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(10436049006162)(192374486261705)(21748063052155)(146099531331640); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(2017102700009)(2017102701064)(6040522)(2401047)(8121501046)(5005006)(2017102702064)(20171027021009)(20171027022009)(20171027023009)(20171027024009)(20171027025009)(20171027026009)(2017102703076)(3002001)(93006095)(93001095)(10201501046)(3231254)(2018427008)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123558120)(201703131423095)(201703031522075)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123560045)(20161123562045)(6072148)(201708071742011); SRVR:SN6PR00MB0413; BCL:0; PCL:0; RULEID:; SRVR:SN6PR00MB0413; x-forefront-prvs: 066898046A x-forefront-antispam-report: =?us-ascii?Q?SFV:NSPM; SFS:(10009001)(428001)(377454003)(43784003)(2445400?= =?us-ascii?Q?2)(377424004)(199002)(189002)(20776003)(69226001)(63696002)(?= =?us-ascii?Q?19609705001)(74876001)(74706001)(54606006)(33656001)(7709600?= =?us-ascii?Q?1)(76786001)(76796001)(81542001)(54356001)(93136001)(9256600?= =?us-ascii?Q?1)(46102001)(64706001)(76576001)(81342001)(92726001)(1597544?= =?us-ascii?Q?5006)(77982001)(59766001)(16236675002)(56816005)(80022001)(7?= =?us-ascii?Q?6482001)(74316001)(90146001)(65816001)(87936001)(19300405004?= =?us-ascii?Q?)(56776001)(15202345003)(54316002)(74366001)(44376005)(87266?= =?us-ascii?Q?001)(54206007)(2656002)(4396001)(47976001)(50986001)(9566600?= =?us-ascii?Q?3)(49866001)(47736001)(51856001)(85306002)(79102001)(8585200?= =?us-ascii?Q?3)(16601075003)(83072002)(21056001)(97336001)(94946001)(9351?= =?us-ascii?Q?6002)(95416001)(94316002)(86362001)(97186001)(80976001)(5757?= =?us-ascii?Q?84001)(81686001)(83322001)(19580405001)(81816001)(86612001)(?= =?us-ascii?Q?31966008)(74662001)(19580395003)(53806001)(74502001)(4744600?= =?us-ascii?Q?2)(3826001);DIR:OUT;SFP:1101;SCL:1;SRVR:SN6PR00MB0413;H:SN6P?= =?us-ascii?Q?R00MB0304.namprd00.prod.outlook.com;FPR:;SPF:None;LANG:en;PT?= =?us-ascii?Q?R:InfoNoRecords;A:1;MX:1;?= received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: /l8ELDLAI+EdYlwaKkzkCla4pO11pmhBp0k2vAi9nbxJyMeWRvisIUy1rcMaRebR4ToryCWvAYYI7+SHRJm7xQx2+WLbBZP5JBVRgdtP9Fs4nRAjFkuvvU63y7Ss0tmu3UGhogxkdIlQ3wRk53ZXsYmJRrAZ/axdl4J+e8G59Xq1TQLzTSm2XZzRQU6Lfu19 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_SN6PR00MB0304F88C0F8F4B94614E6CB1F5980SN6PR00MB0304namp_" MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 0b8eab75-2ac6-4a66-2ae4-08d5b60db915 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0b8eab75-2ac6-4a66-2ae4-08d5b60db915 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 May 2018 00:33:59.7594 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR00MB0413 Archived-At: Subject: Re: [Id-event] I-D Action: draft-ietf-secevent-token-13.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 00:34:04 -0000 --_000_SN6PR00MB0304F88C0F8F4B94614E6CB1F5980SN6PR00MB0304namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Martin, for some reason we hadn't seen your comment until I looked at the I= ESG status in the datatracker. The change you suggested has been made and = we acknowledged your contribution. Thanks agai= n, -- Mike and= Phil From: Id-event On Behalf Of Phil Hunt Sent: Wednesday, May 9, 2018 5:30 PM To: internet-drafts@ietf.org Cc: id-event@ietf.org; i-d-announce@ietf.org Subject: Re: [Id-event] I-D Action: draft-ietf-secevent-token-13.txt Apologies for 2 drafts today. Draft 13 addresses a comment from Martin Vigo= ureux regarding a non-normative MAY. Thanks to Mike who noticed it on the d= ocument status. We wanted to get this nit addressed ahead of tomorrow's tel= echat. Regards, Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com phil.hunt@oracle.com On May 9, 2018, at 5:26 PM, internet-drafts@ietf.org wrote: A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Security Events WG of the IETF. Title : Security Event Token (SET) Authors : Phil Hunt Michael B. Jones William Denniss Morteza Ansari Filename : draft-ietf-secevent-token-13.txt Pages : 31 Date : 2018-05-09 Abstract: This specification defines the Security Event Token (SET) data structure. A SET describes statements of fact from the perspective of an issuer about a subject. These statements of fact represent an event that occurred directly to or about a security subject, for example, a statement about the issuance or revocation of a token on behalf of a subject. This specification is intended to enable representing security- and identity-related events. A SET is a JSON Web Token (JWT), which can be optionally signed and/or encrypted. SETs can be distributed via protocols such as HTTP. The IETF datatracker status page for this draft is: https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org= _doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZ= h8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DY= VELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DTKCt4s8_UAzD0LKg3XRy1ArveQ4K= z4AF7AUgOFPQOrE&e=3D There are also htmlized versions available at: https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__tools.ietf.org_html_= draft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh= 8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYV= ELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3Duj9ERlh8rz9AmLq1jI3iNDT7idBLi= jfPqLATbME0rwk&e=3D https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org= _doc_html_draft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&c=3DRoP1YumCXCgaW= HvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DtHlycQjNI-NTpHHR5FW= N08hbbtLOxF4ikw7QGDdv2BM&e=3D A diff from the previous version is available at: https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf..org_rfcdif= f-3Furl2-3Ddraft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&c=3DRoP1YumCXCga= WHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4= KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DlnlHG42k_dDatVYguj= 9I-Tdf-tMTF4kfL_3Wlmw-N3w&e=3D Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: https://urldefense.proofpoint.com/v2/url?u=3Dftp-3A__ftp.ietf.org_internet-= 2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna= 5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-= FqnUrEJlREH7Uw&s=3Dg2q0nvtYwyVHQ82FuJvjJMHnTmxiKTYIs5qtVYFeYHw&e=3D _______________________________________________ Id-event mailing list Id-event@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf..org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eap= I_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYVELA0RpOT--40Tf5= 4lOELsgAxNO-FqnUrEJlREH7Uw&s=3DZ1U5RerOt4KIpZVUmC1gFkZ1gYDd0cEHIjy4warxMfA&= e=3D --_000_SN6PR00MB0304F88C0F8F4B94614E6CB1F5980SN6PR00MB0304namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Martin, for some reaso= n we hadn’t seen your comment until I looked at the IESG status in th= e datatracker.  The change you suggested has been made and we acknowle= dged your contribution.

 

   &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;          Thanks again,=

   &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;          -- Mike and Phil

 

From: Id-event <id-event-bounces@ietf.org&= gt; On Behalf Of Phil Hunt
Sent: Wednesday, May 9, 2018 5:30 PM
To: internet-drafts@ietf.org
Cc: id-event@ietf.org; i-d-announce@ietf.org
Subject: Re: [Id-event] I-D Action: draft-ietf-secevent-token-13.txt=

 

Apologies for 2 drafts today. Draft 13 addresses a c= omment from Martin Vigoureux regarding a non-normative MAY. Thanks to Mike = who noticed it on the document status. We wanted to get this nit addressed = ahead of tomorrow's telechat.

 

Regards,

 

Phil

 =

Oracle Corporation, Iden= tity Cloud Services Architect

@independentid

phil.hunt@oracle.com



On May 9, 2018, at 5:26 PM, internet-drafts@ietf.org wrote:

 


A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Security Events WG of the IETF.

       Title     &nb= sp;     : Security Event Token (SET)
       Authors     &= nbsp;   : Phil Hunt
            &nb= sp;            = Michael B. Jones
            &nb= sp;            = William Denniss
            &nb= sp;            = Morteza Ansari
       &n= bsp;        Filename   =      : draft-ietf-secevent-token-13.txt
       &n= bsp;        Pages   &nb= sp;       : 31
       &n= bsp;        Date   &nbs= p;        : 2018-05-09

Abstract:
  This specification defines the Security Event Token (SET) data<= br>   structure.  A SET describes statements of fact from the pe= rspective
  of an issuer about a subject.  These statements of fact re= present an
  event that occurred directly to or about a security subject, fo= r
  example, a statement about the issuance or revocation of a toke= n on
  behalf of a subject.  This specification is intended to en= able
  representing security- and identity-related events.  A SET= is a JSON
  Web Token (JWT), which can be optionally signed and/or encrypte= d.
  SETs can be distributed via protocols such as HTTP.


The IETF datatracker status page for this draft is:
https://urldefens= e.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf= -2Dsecevent-2Dtoken_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrM= UB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYV= ELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DTKCt4s8_UAzD0LKg3XRy1Arve= Q4Kz4AF7AUgOFPQOrE&e=3D

There are also htmlized versions available at:
https://urldefense.pr= oofpoint.com/v2/url?u=3Dhttps-3A__tools.ietf.org_html_draft-2Dietf-2Dseceve= nt-2Dtoken-2D13&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65e= apI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYVELA0R= pOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3Duj9ERlh8rz9AmLq1jI3iNDT7idBLij= fPqLATbME0rwk&e=3D
https://urld= efense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_html_dr= aft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZ= YR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DtHlycQjNI-N= TpHHR5FWN08hbbtLOxF4ikw7QGDdv2BM&e=3D

A diff from the previous version is available at:
https://url= defense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf..org_rfcdiff-3Furl2-3D= draft-2Dietf-2Dsecevent-2Dtoken-2D13&d=3DDwICAg&c=3DRoP1YumCXCgaWHv= lZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN= 4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3DlnlHG42k_= dDatVYguj9I-Tdf-tMTF4kfL_3Wlmw-N3w&e=3D


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
https://urldefense.proofpoint.com/v2/url?u=3Dftp-= 3A__ftp.ietf.org_internet-2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvl= ZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4= KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlREH7Uw&s=3Dg2q0nvtYwy= VHQ82FuJvjJMHnTmxiKTYIs5qtVYFeYHw&e=3D

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/= url?u=3Dhttps-3A__www.ietf..org_mailman_listinfo_id-2Devent&d=3DDwICAg&= amp;c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWN= y4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYVELA0RpOT--40Tf54lOELsgAxNO-FqnUrEJlR= EH7Uw&s=3DZ1U5RerOt4KIpZVUmC1gFkZ1gYDd0cEHIjy4warxMfA&e=3D=

 

--_000_SN6PR00MB0304F88C0F8F4B94614E6CB1F5980SN6PR00MB0304namp_-- From nobody Wed May 9 17:44:03 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A050012426E; Wed, 9 May 2018 17:44:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=cooperw.in header.b=YC3zxHJu; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=d3XzQ1Z9 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GatMZQ04YMsw; Wed, 9 May 2018 17:43:59 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 93D841200A0; Wed, 9 May 2018 17:43:59 -0700 (PDT) Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id EB15E20DBD; Wed, 9 May 2018 20:43:58 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute7.internal (MEProxy); Wed, 09 May 2018 20:43:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cooperw.in; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; bh=toKNeYNKJhXTGJhavRwGMrxMqkFca4bgNyr3z9P9M9Q=; b=YC3zxHJu dFaDclN+Q9Etr3eaw+HFxrysK0RtAvP93lxNX1Np00Qv4b7glKzxfFQakfeN6/dR /vJROEG5OwOG4YCBDJTiWgoFn4iwwrcuY2Au9Kcxv10oPUNxl19GGRcvQugYNMIC +l5CUMhqPZTEH55MxMgUVJBa3hZq/Ng/t+1XoaQR1jQnV8kFz7ToDkTI1s/aY6Kk FJHHuJKZTNSYwcPEP67uQ1yM4JTjfHGFbME4dMnEelNy3F0m4e9um0PjIQgE6U6O 7EuJQFCwa0OJ1RxYOsAQY+IKjiob27ikBtj4l9NAPi4ML98kDvTOVlznHlGvJTq7 pnIhgrhRCgFPcw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; bh=toKNeYNKJhXTGJhavRwGMrxMqkFca 4bgNyr3z9P9M9Q=; b=d3XzQ1Z9nSesw15fW/97WYzQ5L3DRnzJk0coUz5DAPCd/ e0cHNxCIuKhbBdJb3QZPitMpZOwz2GspS7qge2eVpz1LBIoUKreaMQswAqzpyDUX XaFVnYvt8fRE59FwZhwh3n4Szqmmo3EuXKKe/y+ERVuDyRUg53rWvF8j4kVokVvD nstf0OWuPjfZCCWk4X7SKQr/NqmQ0uq6jDg2/1AvNkC6rM0oCzwIHkUh1cnQKu21 9G/6rLCziyIRG/JveDfskL67R/bqCEuO8OvbAHoSo9ImIHyz4XhmwbbLe7FRO4xt +RjRKy3an3U2HtsgB5cxmRGDeXe70SlJrmcDrQkNA== X-ME-Sender: Received: from rtp-alcoop-nitro2.cisco.com (unknown [173.38.117.81]) by mail.messagingengine.com (Postfix) with ESMTPA id 55004E4ED0; Wed, 9 May 2018 20:43:58 -0400 (EDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_1CBFA7C7-4129-411D-8FE7-FF79FA208F98" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alissa Cooper In-Reply-To: <993988C7-0C27-465D-9BEE-9BD40861F93B@oracle.com> Date: Wed, 9 May 2018 20:43:57 -0400 Cc: IESG , draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, id-event@ietf.org Message-Id: References: <152589422080.3937.17278656045470630984.idtracker@ietfa.amsl.com> <993988C7-0C27-465D-9BEE-9BD40861F93B@oracle.com> To: Phil Hunt X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [Id-event] Alissa Cooper's No Objection on draft-ietf-secevent-token-11: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 00:44:01 -0000 --Apple-Mail=_1CBFA7C7-4129-411D-8FE7-FF79FA208F98 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Thanks! > On May 9, 2018, at 7:25 PM, Phil Hunt wrote: >=20 > Alissa, >=20 > Your feedback is now posted in draft 12.=20 >=20 > Thanks again, >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com = phil.hunt@oracle.com = >=20 >> On May 9, 2018, at 12:30 PM, Alissa Cooper > wrote: >>=20 >> Alissa Cooper has entered the following ballot position for >> draft-ietf-secevent-token-11: No Objection >>=20 >> When responding, please keep the subject line intact and reply to all >> email addresses included in the To and CC lines. (Feel free to cut = this >> introductory paragraph, however.) >>=20 >>=20 >> Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html = >> for more information about IESG DISCUSS and COMMENT positions. >>=20 >>=20 >> The document, along with other ballot positions, can be found here: >> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ = >>=20 >>=20 >>=20 >> = ---------------------------------------------------------------------- >> COMMENT: >> = ---------------------------------------------------------------------- >>=20 >> =3D Sec. 5.1 =3D >>=20 >> "Security events distributed through third parties or that carry >> personally identifiable information SHOULD be encrypted using JWE >> [RFC7516] or secured for confidentiality by other means." >>=20 >> The SHOULD here seems like it should be a MUST unless there are = obvious exception cases. >>=20 >> =3D Sec. 5.2 =3D >>=20 >> "In >> addition to confidentiality and integrity (discussed above), >> implementers and profiling specifications MUST consider the >> consequences of delivery mechanisms that are not secure and/or not >> assured." >>=20 >> The "implementers ... MUST consider" construction seems like an odd = use of normative language. >>=20 >>=20 >=20 --Apple-Mail=_1CBFA7C7-4129-411D-8FE7-FF79FA208F98 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
Thanks!

On May 9, 2018, at 7:25 PM, = Phil Hunt <phil.hunt@oracle.com> wrote:

Alissa,

Your feedback is now = posted in draft 12. 

Thanks again,

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 9, 2018, at 12:30 PM, Alissa Cooper <alissa@cooperw.in> = wrote:

Alissa Cooper has entered the following ballot position = for
draft-ietf-secevent-token-11: No Objection

When responding, please keep the subject line = intact and reply to all
email addresses included in the To = and CC lines. (Feel free to cut this
introductory = paragraph, however.)


Please = refer to https://www.ietf.org/iesg/statement/discuss-criteria.htmlfor more information about IESG DISCUSS and COMMENT = positions.


The document, = along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-token/=



---------------------------------------------------------------= -------
COMMENT:
---------------------------------------------------------------= -------

=3D Sec. 5.1 =3D

"Security events distributed through third parties or that = carry
  personally identifiable information = SHOULD be encrypted using JWE
  [RFC7516] or = secured for confidentiality by other means."

The SHOULD here seems like it should be a MUST unless there = are obvious exception cases.

=3D Sec. 5.2 = =3D

"In
  addition = to confidentiality and integrity (discussed above),
=   implementers and profiling specifications MUST consider = the
  consequences of delivery mechanisms that = are not secure and/or not
  assured."

The "implementers ... MUST consider" = construction seems like an odd use of normative language.




= --Apple-Mail=_1CBFA7C7-4129-411D-8FE7-FF79FA208F98-- From nobody Wed May 9 18:05:36 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AF1B12E741 for ; Wed, 9 May 2018 18:05:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MtE9L1QW0XdA for ; Wed, 9 May 2018 18:05:33 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0137.outbound.protection.outlook.com [104.47.36.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB44C12DA2C for ; Wed, 9 May 2018 18:05:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=k4VzmkjhDSQIdhqwC6rnGDF0QH0Um+eL9CUWzMmkPNs=; b=n6zMXSJhIFI1M97auI0DZKemcOe7oWZA3wjMoJD3yuWN4om6Mxmrdrv0TyVpa23b88yNFKTMi580JHkidfVVaoYZTe5FP7JcIeV8JRrTYkdsUy8ENsodONMvobrR98OR/YB4GirtbVGdeYxqFvVrCnx6phHDFBlBv4UhrMQhoas= Received: from SN6PR00MB0304.namprd00.prod.outlook.com (2603:10b6:805:b::30) by SN6PR00MB0400.namprd00.prod.outlook.com (2603:10b6:805:c::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.793.0; Thu, 10 May 2018 01:05:31 +0000 Received: from SN6PR00MB0304.namprd00.prod.outlook.com ([fe80::78c2:1262:2203:b29]) by SN6PR00MB0304.namprd00.prod.outlook.com ([fe80::78c2:1262:2203:b29%4]) with mapi id 15.20.0796.000; Thu, 10 May 2018 01:05:31 +0000 From: Mike Jones To: "id-event@ietf.org" Thread-Topic: Security Event Token (SET) updates addressing IESG feedback Thread-Index: AdPn+pyzza6YouP5S8mIxmjcIUguqQ== Date: Thu, 10 May 2018 01:05:30 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-05-10T01:05:29.8247549Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:b::145] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; SN6PR00MB0400; 7:qeR5YwwPkfpVghdReOyenhyUbptdb4OccLWnVkcxewxh514bMhtAa+mDptHmxy2piLshnqt6P0W6Ik7rqHXwg4wemnUAIYGqKr64IjKAtQEXzBYvYdzFAb71BnB9co3Ui80UmuE7pRnP/dyIJiUiZNWgKtgniB/RAiiMaYuvw2LYMG5cWjUbIJcMBMRL2GtZUV1KncmQkzbjRmerBbHMclvRCoZf0UR2vWI9s9L+7g9+HOaRMTbL1Ix+dTzCUGen; 20:5wW8VgKBPM9uneHj4DsDBhBfjz2E/Jf/3gyvBWENnNXMS8MsKYB3uuLXikZaxrBGY0vqef/2VRw6mOBFDqxAsXtYIIKuEkN2GHh6mSB9Ri0ZTlBikO8y+17IgS7yaypBk6p3qbSQ4Uc92z/W/Pjv2j+kPkZxrCmyFnFu5hGImAw= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(4534165)(4627221)(201703031133081)(201702281549075)(5600026)(48565401081)(2017052603328)(7193020); SRVR:SN6PR00MB0400; x-ms-traffictypediagnostic: SN6PR00MB0400: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(192374486261705)(31418570063057)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(2017102700009)(2017102701064)(6040522)(2401047)(5005006)(8121501046)(2017102702064)(20171027021009)(20171027022009)(20171027023009)(20171027024009)(20171027025009)(20171027026009)(2017102703076)(3002001)(3231254)(2018427008)(944501410)(52105095)(10201501046)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123562045)(20161123564045)(20161123558120)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011); SRVR:SN6PR00MB0400; BCL:0; PCL:0; RULEID:; SRVR:SN6PR00MB0400; x-forefront-prvs: 066898046A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(376002)(346002)(39380400002)(39860400002)(366004)(209900001)(199004)(189003)(10290500003)(6116002)(5250100002)(6916009)(790700001)(6506007)(478600001)(97736004)(8990500004)(7110500001)(2900100001)(2501003)(606006)(86612001)(486006)(558084003)(7696005)(68736007)(966005)(72206003)(102836004)(46003)(25786009)(52396003)(14454004)(5660300001)(15650500001)(2420400007)(5630700001)(99286004)(476003)(86362001)(74316002)(236005)(53936002)(3280700002)(3660700001)(53376002)(6436002)(54896002)(6306002)(5640700003)(55016002)(9686003)(2906002)(33656002)(186003)(2351001)(10090500001)(22452003)(106356001)(105586002)(8676002)(81156014)(81166006)(316002)(8936002)(7736002)(6606295002); DIR:OUT; SFP:1102; SCL:1; SRVR:SN6PR00MB0400; H:SN6PR00MB0304.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: rUsTAF79BxfjJ25CacvuLAEaDj8r8rjamMAUP5dpBkAs52jSM1Mib4YT7f4Ze2ButgSKVC2aPuGBweHBlICHuX3+00gLyfQGB2TsqWKVizoAO8H/mQlD8pFydRDGbRj7NM/rN5zb02JXWiTCIU1OBWbpkqTqMAHuQ503+QobjQrqd7MBxpbWKrs6gHKcAOro spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_SN6PR00MB03047A9E9EA7B00DE0E5EDDAF5980SN6PR00MB0304namp_" MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 645bc874-9789-4ec3-3aa5-08d5b612205b X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 645bc874-9789-4ec3-3aa5-08d5b612205b X-MS-Exchange-CrossTenant-originalarrivaltime: 10 May 2018 01:05:30.9218 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR00MB0400 Archived-At: Subject: [Id-event] Security Event Token (SET) updates addressing IESG feedback X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 01:05:35 -0000 --_000_SN6PR00MB03047A9E9EA7B00DE0E5EDDAF5980SN6PR00MB0304namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I posted a synopsis of the updates in the spec to address IESG feedback at = http://self-issued.info/?p=3D1849 and at @selfissued. Thanks to Phil Hunt for doing the bulk of the work to publish t= hree updates in quick succession in preparation for tomorrow's IESG telecha= t! -- Mike --_000_SN6PR00MB03047A9E9EA7B00DE0E5EDDAF5980SN6PR00MB0304namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I posted a synopsis of the updates in the spec to ad= dress IESG feedback at http://self-issued.info/?p=3D= 1849 and at @selfissued.  Thanks to= Phil Hunt for doing the bulk of the work to publish three updates in quick= succession in preparation for tomorrow’s IESG telechat!

 

        &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;     -- Mike

 

--_000_SN6PR00MB03047A9E9EA7B00DE0E5EDDAF5980SN6PR00MB0304namp_-- From nobody Wed May 9 19:12:12 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CDF561200C5; Wed, 9 May 2018 19:12:10 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Ben Campbell To: "The IESG" Cc: draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, yaronf.ietf@gmail.com, id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152591833082.10331.12472586431636953799.idtracker@ietfa.amsl.com> Date: Wed, 09 May 2018 19:12:10 -0700 Archived-At: Subject: [Id-event] Ben Campbell's No Objection on draft-ietf-secevent-token-13: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 02:12:11 -0000 Ben Campbell has entered the following ballot position for draft-ietf-secevent-token-13: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thanks for the work on this. Most of my comments have already been captured by others. I have one remaining observation, which I don't expect to be addressed: "SET" is going to be an exceptionally difficult Google search term. (I speak from experience as the one-time chair of the "SIMPLE" working group). From nobody Wed May 9 22:00:41 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FE8C12EA55; Wed, 9 May 2018 22:00:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OVAWqWnEQLNY; Wed, 9 May 2018 22:00:37 -0700 (PDT) Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75EC612EA52; Wed, 9 May 2018 22:00:37 -0700 (PDT) Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w4A4tu3R192937; Thu, 10 May 2018 05:00:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=corp-2017-10-26; bh=Bnzcf6I5m39v+h6A+p0mekkvYBEeO76VaEP4Z4dr8F0=; b=QExspb7U82LTr6HUJHxKUQGyZlUlxFrAH/I6UZRVkXEw6b78dnmqZtDX1VKFWVB9BOqn B1O733VVnXwdguBhTCS/SUBKnkkodDl4wvytn4obdyeJ72puJUFuU+mkoAuwuqxzhFio On+swCXno+inK5BreJ69NaO50YoHkcrPIK3pcHF4fEIJwoAf3/0JC8aRv+xOfZaWHuPJ iAM/1mmQM0IINwvtfa5NzbKQK/GwYQEo44DUNT0TnLZJNp2jK+o40NGU7kNpGLWKP9Kz v9qa9LmJyDwsYlpPqK0W3H7x0DyQdw3VTTAwc/EnzNPypg1klPg6pSf/RcsswyZNOUQH yQ== Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp2130.oracle.com with ESMTP id 2hv6kp9s3j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 10 May 2018 05:00:35 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w4A50YLB032662 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 10 May 2018 05:00:34 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w4A50X60009270; Thu, 10 May 2018 05:00:34 GMT Received: from [10.0.1.20] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 09 May 2018 22:00:33 -0700 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Phil Hunt X-Mailer: iPhone Mail (15E302) In-Reply-To: <152591833082.10331.12472586431636953799.idtracker@ietfa.amsl.com> Date: Wed, 9 May 2018 22:00:32 -0700 Cc: The IESG , draft-ietf-secevent-token@ietf.org, Yaron Sheffer , secevent-chairs@ietf.org, id-event@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <3619CBB1-6856-48C9-BB21-0731CE2224F2@oracle.com> References: <152591833082.10331.12472586431636953799.idtracker@ietfa.amsl.com> To: Ben Campbell X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8888 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805100049 Archived-At: Subject: Re: [Id-event] Ben Campbell's No Objection on draft-ietf-secevent-token-13: (with COMMENT) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 05:00:39 -0000 Ben, Thanks for your review and comment. It seems we are SET. ;-) Cheers, Phil > On May 9, 2018, at 7:12 PM, Ben Campbell wrote: >=20 > Ben Campbell has entered the following ballot position for > draft-ietf-secevent-token-13: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this > introductory paragraph, however.) >=20 >=20 > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > Thanks for the work on this. >=20 > Most of my comments have already been captured by others. I have one remai= ning > observation, which I don't expect to be addressed: "SET" is going to be an= > exceptionally difficult Google search term. (I speak from experience as th= e > one-time chair of the "SIMPLE" working group). >=20 >=20 From nobody Thu May 10 07:45:14 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6287612EB05 for ; Thu, 10 May 2018 07:45:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 93kRfWhXqXmM for ; Thu, 10 May 2018 07:45:12 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0119.outbound.protection.outlook.com [104.47.38.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AED4F12EB00 for ; Thu, 10 May 2018 07:45:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Wi4e6G+cdQ3rLlKyIlpDmB8bHXdc0cPW8/BVqhR1sK8=; b=K447BZ+fXKKJtcdnVCNnA5W54/aM4S7ytQILoqBCJipgSbz5qJ2zZqd6/JAZh4q8u7y/v3IbIXs3ZRcUYYwPshQW4vxvJLjA4mk2KbFWJjwM2sixvyVDYb8o8auyjnF5UloOOctFTcTIxx9w3NCreyKjLfqCFDfjneSISLEUbLo= Received: from SN6PR00MB0304.namprd00.prod.outlook.com (2603:10b6:805:b::30) by SN6PR00MB0382.namprd00.prod.outlook.com (2603:10b6:805:c::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.795.0; Thu, 10 May 2018 14:45:05 +0000 Received: from SN6PR00MB0304.namprd00.prod.outlook.com ([fe80::78c2:1262:2203:b29]) by SN6PR00MB0304.namprd00.prod.outlook.com ([fe80::78c2:1262:2203:b29%4]) with mapi id 15.20.0796.000; Thu, 10 May 2018 14:45:05 +0000 From: Mike Jones To: "id-event@ietf.org" Thread-Topic: IESG telechat approval for draft-ietf-secevent-token-13 Thread-Index: AdPobVWKPN55KI5RT/uu91wv85oPOg== Date: Thu, 10 May 2018 14:45:05 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [50.47.80.188] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; SN6PR00MB0382; 7:Cs2B9yjdcTzvI9UBFigXvb26VZssbl08N/nTjXeuS9v0BluYFq3lWcYP8OUGAHCqoANbXzqb42n0Z75A25HXfxIcN74E/vJRxdxqtFvJq2d2gg12rXei3n6x6jzbO7tYCjX7S0xf0WJ72QvjvCsclUsF2aEDLpoQSBW0DAZz5u0eRq1rHE4ygj6Y9oiHDRZ9gjhgJ/yxaY3zlAobYU6se10zAdaX5AGvSkIqnOn2qIbW365rJaUOmE4rJSSqFJI8; 20:wcxwxCTqiCoKoNs/4NTRiUH+zdfS4wDFv1w8aM8BD3kYevMqRjIpAw1roVbxy962ouSYuZ5csT34YW6gaLQxy3lZn/+UsFvdi3mQooSjDyfu5IGAdKqGh7xvefb76Ndp3Ie49yUBafJyUzHZuaR5cTEVJcUnUDl/ZMcoVkv5CGk= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7193020); SRVR:SN6PR00MB0382; x-ms-traffictypediagnostic: SN6PR00MB0382: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(192374486261705)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(2017102700009)(2017102701064)(6040522)(2401047)(8121501046)(5005006)(2017102702064)(20171027021009)(20171027022009)(20171027023009)(20171027024009)(20171027025009)(20171027026009)(2017102703076)(93006095)(93001095)(3231254)(2018427008)(944501410)(52105095)(10201501046)(3002001)(6055026)(149027)(150027)(6041310)(20161123558120)(20161123560045)(20161123564045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011); SRVR:SN6PR00MB0382; BCL:0; PCL:0; RULEID:; SRVR:SN6PR00MB0382; x-forefront-prvs: 066898046A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(39380400002)(366004)(346002)(376002)(396003)(199004)(189003)(59450400001)(6506007)(8676002)(81156014)(476003)(102836004)(99286004)(74316002)(5880100001)(5660300001)(8936002)(2351001)(3280700002)(2906002)(86612001)(10090500001)(6916009)(3660700001)(25786009)(5250100002)(8990500004)(81166006)(7696005)(2501003)(52396003)(486006)(26005)(86362001)(2900100001)(478600001)(105586002)(6436002)(10290500003)(66066001)(55016002)(316002)(9686003)(68736007)(106356001)(5640700003)(72206003)(33656002)(14454004)(22452003)(97736004)(7736002)(6306002)(54896002)(53936002)(5630700001)(186003)(6116002)(790700001)(3846002); DIR:OUT; SFP:1102; SCL:1; SRVR:SN6PR00MB0382; H:SN6PR00MB0304.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:3; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: qGqRohbRneOV77Rm/vzvUG6gIZOFmvk4wRUGczfQaJVVXS9WF4Ir99ikanjNFeBAHSoi1E8XJK8V671DpLLEms/hQhNSMQBPWdqM/+aSOvoXzvVZhRnlSDleqE3xYtC+HynxHg/7ZfQ4MHxFfsSYR3xNzH5t8I80cGW9CP0rs3ZG6FBdPUNDFnbZDMOe5nJP spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_SN6PR00MB03043A35922EC8D81D3729F7F5980SN6PR00MB0304namp_" MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: e07f8e12-7e0e-4b16-798b-08d5b6849e87 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: e07f8e12-7e0e-4b16-798b-08d5b6849e87 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 May 2018 14:45:05.2899 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR00MB0382 Archived-At: Subject: [Id-event] IESG telechat approval for draft-ietf-secevent-token-13 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 14:45:13 -0000 --_000_SN6PR00MB03043A35922EC8D81D3729F7F5980SN6PR00MB0304namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The Security Event Token (SET) specification was just discussed by the Inte= rnet Engineering Steering Group (IESG) on their telechat. All area directo= rs taking a position were in favor of the document being published as an RF= C. Our area director Benjamin Kaduk stated that the authors were proactive= in addressing the comments received. It is now in the "Approved - Announc= ement to be sent" state. Congratulations, working group! -- Mike --_000_SN6PR00MB03043A35922EC8D81D3729F7F5980SN6PR00MB0304namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

The Security Event Token (SET) specification was jus= t discussed by the Internet Engineering Steering Group (IESG) on their tele= chat.  All area directors taking a position were in favor of the docum= ent being published as an RFC.  Our area director Benjamin Kaduk stated that the authors were proactive in addressi= ng the comments received.  It is now in the “Approved - Announce= ment to be sent” state.

 

Congratulations, working group!

 

        &nbs= p;            &= nbsp;            &nb= sp;            =        -- Mike

 

--_000_SN6PR00MB03043A35922EC8D81D3729F7F5980SN6PR00MB0304namp_-- From nobody Mon May 14 12:39:55 2018 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B229B120454; Mon, 14 May 2018 12:39:52 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Cc: The IESG , secevent-chairs@ietf.org, Yaron Sheffer , yaronf.ietf@gmail.com, draft-ietf-secevent-token@ietf.org, kaduk@mit.edu, id-event@ietf.org, rfc-editor@rfc-editor.org MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <152632679268.10065.5765822960974885303.idtracker@ietfa.amsl.com> Date: Mon, 14 May 2018 12:39:52 -0700 Archived-At: Subject: [Id-event] Protocol Action: 'Security Event Token (SET)' to Proposed Standard (draft-ietf-secevent-token-13.txt) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2018 19:39:53 -0000 The IESG has approved the following document: - 'Security Event Token (SET)' (draft-ietf-secevent-token-13.txt) as Proposed Standard This document is the product of the Security Events Working Group. The IESG contact persons are Benjamin Kaduk and Eric Rescorla. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ Technical Summary The document defines the format of Security Event Tokens (SETs), which allow multiple entities to communicate about identity-related events. The format is intended to be common to multiple higher-level profiling specifications, at leas some of which are expected to be defined outside the IETF. Working Group Summary The working group had to go through a second last call, after we failed to reach consensus in the first LC. The second last call did result in consensus that the draft is ready and usable for our "customers", i.e. the specifications that will be profiling it. Document Quality We are not aware of current implementations, other than those that implement a trivial subset of the format. A large number of major vendors took part in discussions, and multiple industry groups are expected to use this format. Personnel Yaron Sheffer is the document shepherd. Benjamin Kaduk is the responsible AD. From nobody Mon May 14 17:58:14 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A9A9126FB3 for ; Mon, 14 May 2018 17:58:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PkCarWwadksh for ; Mon, 14 May 2018 17:58:10 -0700 (PDT) Received: from mail-pl0-x231.google.com (mail-pl0-x231.google.com [IPv6:2607:f8b0:400e:c01::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE9991270A3 for ; Mon, 14 May 2018 17:58:10 -0700 (PDT) Received: by mail-pl0-x231.google.com with SMTP id w19-v6so5737230plq.4 for ; Mon, 14 May 2018 17:58:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:references:to:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=8bc5imEXiDDNMsiTegOmuMu4ZUVorS38c52qMZDi2fg=; b=BHWw13VIrrp8ppkW/ARC2k6loLTy+pv3Filb+nRuOmOfMjoTfEoIEfMeGR8UAex+HQ An/oFI6BCL3cXLuWkRsk9q5b+YpHpDvu80R3QYr9PY9YAWB0kn6OZWdfENNC5fUlYqmR 9WnlzlCoJN6+HFl3psc0YmBDl+bawOtw8u48EtBr8VzKJMaGCHnC2/+L2BF4uJUZBRGl lpwERwCtWrJNx/lia49HcLcZfwvtr7MmKBm68ojSl1MjyKJD8RYD6tpp6/5FPAyJR/jd Ips7AU/C4ZMlmJBWN09GFM2b8talsM5RbZa37GrCwIjdOqadif3PWOmGGqdMV6R1RPDg 9igg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:references:to:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=8bc5imEXiDDNMsiTegOmuMu4ZUVorS38c52qMZDi2fg=; b=ACZf8F3kgCIoUiOxW6MHhoMLd3XnxHzRUMaqkxajbtgJo4HL9CpZlHs/yfIuOotDkU 1sAr70qy4tqy5EOZo54zqTTeaJJpWCbVV6E6Jk68v+RmeSUexXqP3gLiG5hhY4+Xy5MD AS/YyYunHr+I41853zkTbNGSJSmtVTimiPAEHlx5QkdcC+Kk+E2zH53cXe7jZPxVL4B5 6cV4+BqmGWSQ7lO16TG2OHMp8abLRVCtir4LNa9rL3qskWx3QU2Jqcaw0P1/Iuni/TeH dbwF4tokbgVFYBPaZjACvvOagfrF0KIN2Mt2BjWLWH7lWLPk/bP15JPLhojLSJPmVzdf 6nyA== X-Gm-Message-State: ALKqPwdOdHHH3iPAQQ/02dNNweT4vrtSpi8L6q15ehxcRlkJruB4/Pf+ pjIQ+ssJ+nEpThNEhBcG90czq667 X-Google-Smtp-Source: AB8JxZqcIowa6GVODv+TXpSfXC/rtO8uLTyIZOU/8whvSEiH2rQ9vAzQHf+bvLE30xLf23afLI4TJw== X-Received: by 2002:a17:902:6549:: with SMTP id d9-v6mr12142029pln.196.1526345889910; Mon, 14 May 2018 17:58:09 -0700 (PDT) Received: from [172.28.32.135] ([65.204.229.97]) by smtp.gmail.com with ESMTPSA id h8-v6sm14252829pgq.56.2018.05.14.17.58.09 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 14 May 2018 17:58:09 -0700 (PDT) References: <152632679268.10065.5765822960974885303.idtracker@ietfa.amsl.com> To: SecEvent From: Yaron Sheffer X-Forwarded-Message-Id: <152632679268.10065.5765822960974885303.idtracker@ietfa.amsl.com> Message-ID: Date: Mon, 14 May 2018 17:58:08 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 In-Reply-To: <152632679268.10065.5765822960974885303.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [Id-event] Fwd: Protocol Action: 'Security Event Token (SET)' to Proposed Standard (draft-ietf-secevent-token-13.txt) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 May 2018 00:58:13 -0000 Congratulations to the working group - our first document was approved for publication. And a big Thank You to the authors! Dick and Yaron -------- Forwarded Message -------- Subject: Protocol Action: 'Security Event Token (SET)' to Proposed Standard (draft-ietf-secevent-token-13.txt) Date: Mon, 14 May 2018 12:39:52 -0700 From: The IESG To: IETF-Announce CC: The IESG , secevent-chairs@ietf.org, Yaron Sheffer , yaronf.ietf@gmail.com, draft-ietf-secevent-token@ietf.org, kaduk@mit.edu, id-event@ietf.org, rfc-editor@rfc-editor.org The IESG has approved the following document: - 'Security Event Token (SET)' (draft-ietf-secevent-token-13.txt) as Proposed Standard This document is the product of the Security Events Working Group. The IESG contact persons are Benjamin Kaduk and Eric Rescorla. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ Technical Summary The document defines the format of Security Event Tokens (SETs), which allow multiple entities to communicate about identity-related events. The format is intended to be common to multiple higher-level profiling specifications, at leas some of which are expected to be defined outside the IETF. Working Group Summary The working group had to go through a second last call, after we failed to reach consensus in the first LC. The second last call did result in consensus that the draft is ready and usable for our "customers", i.e. the specifications that will be profiling it. Document Quality We are not aware of current implementations, other than those that implement a trivial subset of the format. A large number of major vendors took part in discussions, and multiple industry groups are expected to use this format. Personnel Yaron Sheffer is the document shepherd. Benjamin Kaduk is the responsible AD. From nobody Thu May 17 08:53:00 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02C9312D887 for ; Thu, 17 May 2018 08:52:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aIkot5qwyxaH for ; Thu, 17 May 2018 08:52:56 -0700 (PDT) Received: from mail-pf0-x235.google.com (mail-pf0-x235.google.com [IPv6:2607:f8b0:400e:c00::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 64B591270A7 for ; Thu, 17 May 2018 08:52:56 -0700 (PDT) Received: by mail-pf0-x235.google.com with SMTP id q22-v6so2298328pff.11 for ; Thu, 17 May 2018 08:52:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=lW5n6uKOIwb18ZiQBRZPPw3uhSWoAZ+butYAtnjmhv0=; b=Cupb89OBX4g7ttCEou1uaDcLlePsT18h2ciooVmfD1Dx9GevlWt0nwXe1GtMWWdFXr Tvz/2mdDucURopesJbN2MbURGuQha94XOpMZ2E+AFo9CCrT3e7Y/naQHqj2ki3qb4iuf FMgQNUgYUEPOBG/8uY+ebI45vjOyW/WsIptfu8saER/lCfkngOJnqAfUqUUl629/4zKI ft9s2xv7pphRE4fpwrTd2fZW4NOmSGi3AtOKq6tEVIIBUT7vFSAY1mjxPz8TVJMOwJ8p 5NCUHGWpHA9fYM4gxh9s8v5nLmYsairtCauM3mxm46gmC1gbJrqafF0pl7H00nw94vd9 r7YQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=lW5n6uKOIwb18ZiQBRZPPw3uhSWoAZ+butYAtnjmhv0=; b=FQhnE7eDQb4HgKLnZEb9edrYvV1b5ywTvf5/eMlukwmKlIHNRcEWJnzhuXBtCUesRU ZJi2vq9cMzJ6f3RcpdGT4JhYGYNP4c1Ku/gK5iN12GavOuPfk8OILXGdyqtcpoG6lxlQ O9QFhxGxCvVoZUuz2qxxDZjKU8k6Je5mmkdkxPhCKU2VuqmmZGUQi3HUXGMUU/Ei2hwD SNY4Re9yGJXI2NJAIXYdf485MmpTlZlkyPWDMPFap5yYVsspDG1XAJ/Zatb3JkKNII1n 6+cc985f2mpdtCUjtPQ033JGz5Az9XtgmwoW3pt+iPM3jIWuTDrdc/xSwcqSYKa5XSnf hfjA== X-Gm-Message-State: ALKqPwd6WBSIYpkcM0Qy6SyEhFEb+x0L8g/FS1tSZkhySfkf92TEZu4+ PnFyJPJqgv9rjZJ+arfBKv0qShrVMf89RTwbO0Q= X-Google-Smtp-Source: AB8JxZr+H5SnZlw4lbuQ8GYLfoB5VtP48f+wZpFDP27bngNBX8Zs8uAaljIhdG4JMLYRclNNuNL2BrPCmnBsj1Okl+U= X-Received: by 2002:a62:828c:: with SMTP id w134-v6mr5642031pfd.138.1526572375769; Thu, 17 May 2018 08:52:55 -0700 (PDT) MIME-Version: 1.0 Received: by 10.236.179.13 with HTTP; Thu, 17 May 2018 08:52:35 -0700 (PDT) From: Dick Hardt Date: Thu, 17 May 2018 08:52:35 -0700 Message-ID: To: SecEvent Cc: Yaron Sheffer Content-Type: multipart/alternative; boundary="0000000000002e89de056c68d46e" Archived-At: Subject: [Id-event] sessions for IETF 102? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 May 2018 15:52:58 -0000 --0000000000002e89de056c68d46e Content-Type: text/plain; charset="UTF-8" Hello WG We currently have the Poll and Push delivery docs. My understanding is that these are replacing the delivery doc. I believe there was interest in a secevent subject document as well. Did anyone want to present a session on another topic? /Dick --0000000000002e89de056c68d46e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello WG

We currently have the Poll and= Push delivery docs. My understanding is that these are replacing the deliv= ery doc. I believe there was interest in a secevent subject document as wel= l.

Did anyone want to present a ses= sion on another topic?=C2=A0

/Dick

<= /div>

--0000000000002e89de056c68d46e-- From nobody Fri May 25 12:12:41 2018 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5028127867 for ; Fri, 25 May 2018 12:12:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OQoZPHV04pEp for ; Fri, 25 May 2018 12:12:37 -0700 (PDT) Received: from mail-pf0-x22b.google.com (mail-pf0-x22b.google.com [IPv6:2607:f8b0:400e:c00::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C03612711A for ; Fri, 25 May 2018 12:12:37 -0700 (PDT) Received: by mail-pf0-x22b.google.com with SMTP id c10-v6so3003651pfi.12 for ; Fri, 25 May 2018 12:12:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=sOyowtxlxkGEhyBf5DYEoXYfeWw547HCSdO68DsWtT4=; b=F1B7vZcMFMbotsO+HiwEvxDO+PfumV/evrUPrfWhtqjSDt6g43YkSxFT8ODQ3AXKtD QGrgZBl9XFH/1iDTmC75JgH9MgTCz+G9vfwursAxBVrJdghekYQ6UpVI1zojaS8YnD/i MY30b9U4gsXlobDEu8g0OMOhdQepiscMJi/Hdz5/rCdbV1yARDo5MfGIRjpwa9Smwc9b Xf69QotNnK8T5x4ZUKb6yIQ7NdcH/4hdaCHoXLzxgA3oM2cBn75Ml0lKIKfe7M2oKiW5 9gm/9VHkg7UbRs4nagmbZJ5hlHaL/K/fMH2GAYCHb+hiOoHy9i3aXf52UNi1aHFphBPG MmzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=sOyowtxlxkGEhyBf5DYEoXYfeWw547HCSdO68DsWtT4=; b=S5jfA92vMDfHM2/k+GwgYh6ZOBgjJiJOpn5CNrf7D4eUpJQti+T5H+wudgPIT26Fmo Xf0kSEushLq2iSCnxclVw5JawXJKxdl/CrW+rYe6YdXFJBOCL2q7rf1NYsIiY1r9dS9g rDsMO4o/9n1Cj1d8IEwKv84NhW3jfAXw/M1Jv4oCQ4Oxyxz+oIizFc/OCP8od1qBzY2a YrFJnjNgyvUu++vAp7QlMiHa9t6lC6ba+MrPHPdy6ZA5twQar2nsXK7bJNXzA9tLkqqI LdeCX9TvDeAP7AJvqTEObdmkTeZFgmxr+lJJyVREGiVYaeD/2aqEsptCwiGQ7vSFL48A 5YsQ== X-Gm-Message-State: ALKqPwcPiD5JUYlSrtkbGiq/c2QPqSjzFEHhEWCwyM6c8gNWuWjbktCM 1fea7uLsn7DQs3F2DAeCEFXyztZBeloEtFhHTCU= X-Google-Smtp-Source: AB8JxZqe1Y/ycX9WFxiiEpyoCPyGuUs167VBru7xnfxeYJz3+ZYtd2kxFpWRg2D+3ZY6wgKA9KrdKwbpUUwM/snp60A= X-Received: by 2002:a65:62d9:: with SMTP id m25-v6mr2954726pgv.407.1527275556096; Fri, 25 May 2018 12:12:36 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a17:90a:b30d:0:0:0:0 with HTTP; Fri, 25 May 2018 12:12:15 -0700 (PDT) In-Reply-To: References: From: Dick Hardt Date: Fri, 25 May 2018 12:12:15 -0700 Message-ID: To: SecEvent Cc: Yaron Sheffer Content-Type: multipart/alternative; boundary="000000000000fecfa3056d0c8ce1" Archived-At: Subject: Re: [Id-event] sessions for IETF 102? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 May 2018 19:12:39 -0000 --000000000000fecfa3056d0c8ce1 Content-Type: text/plain; charset="UTF-8" I have not gotten any requests for additional sessions. Currently there is only going to be sessions on the Poll and Push delivery docs. On Thu, May 17, 2018 at 8:52 AM, Dick Hardt wrote: > Hello WG > > We currently have the Poll and Push delivery docs. My understanding is > that these are replacing the delivery doc. I believe there was interest in > a secevent subject document as well. > > Did anyone want to present a session on another topic? > > /Dick > > > --000000000000fecfa3056d0c8ce1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I have not gotten any requests for additional sessions. Cu= rrently there is only going to be sessions on the Poll and Push delivery do= cs.

On Thu, = May 17, 2018 at 8:52 AM, Dick Hardt <dick.hardt@gmail.com> wrote:
Hello WG
We currently have the Poll and Push delivery docs. My understa= nding is that these are replacing the delivery doc. I believe there was int= erest in a secevent subject document as well.

=
Did anyone want to present a session on another topic?=C2=A0

/Dick<= /div>



--000000000000fecfa3056d0c8ce1--