From nobody Thu Jul 2 15:59:40 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96E303A0C9A for ; Thu, 2 Jul 2020 15:59:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.597 X-Spam-Level: X-Spam-Status: No, score=-9.597 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tqQFyiesPC7i for ; Thu, 2 Jul 2020 15:59:37 -0700 (PDT) Received: from smtp-fw-9101.amazon.com (smtp-fw-9101.amazon.com [207.171.184.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C92F3A0C98 for ; Thu, 2 Jul 2020 15:59:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1593730778; x=1625266778; h=from:to:date:message-id:references:in-reply-to: mime-version:subject; bh=3Y75STCyREP3CF24NK6JZvmcx8mevbZ8IS3DlGUcaow=; b=fcWl+HZp6mVLTXitCNa2AOwP4eAImlv+s7kBVAPPR67Oe5K6MLi+KBO7 5Z2EXZ9jfUY99A7HPk76XZ+GeKgKiMmNYnGoIBq47QPhQx8boGR8va88Y ul8nL2/2+b0mmn61+d6KW6tn/pWbawG/MVPu+RxS2qa2LT0JWxz45FeQy I=; IronPort-SDR: C7Jf+TP5GOPIr+l+QtfV/AOYr/+UCr5eB7thDSDyJ057W/hM39py6ldMt6EEQPjky/iIHM1Szg aYcvViQumQWg== X-IronPort-AV: E=Sophos; i="5.75,305,1589241600"; d="scan'208,217"; a="48785454" Thread-Topic: [Id-event] Closing the SecEvent working group Received: from sea32-co-svc-lb4-vlan3.sea.corp.amazon.com (HELO email-inbound-relay-1a-807d4a99.us-east-1.amazon.com) ([10.47.23.38]) by smtp-border-fw-out-9101.sea19.amazon.com with ESMTP; 02 Jul 2020 22:59:33 +0000 Received: from EX13MTAUWC001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan2.iad.amazon.com [10.40.159.162]) by email-inbound-relay-1a-807d4a99.us-east-1.amazon.com (Postfix) with ESMTPS id F0A40A17B6; Thu, 2 Jul 2020 22:59:31 +0000 (UTC) Received: from EX13D11UWC003.ant.amazon.com (10.43.162.162) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 2 Jul 2020 22:59:31 +0000 Received: from EX13D11UWC003.ant.amazon.com (10.43.162.162) by EX13D11UWC003.ant.amazon.com (10.43.162.162) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 2 Jul 2020 22:59:31 +0000 Received: from EX13D11UWC003.ant.amazon.com ([10.43.162.162]) by EX13D11UWC003.ant.amazon.com ([10.43.162.162]) with mapi id 15.00.1497.006; Thu, 2 Jul 2020 22:59:31 +0000 From: "Richard Backman, Annabelle" To: Yaron Sheffer , "id-event@ietf.org" Thread-Index: AQHWTr206EeraCNRHkaQGU2DcUrEl6j0dg4A Date: Thu, 2 Jul 2020 22:59:31 +0000 Message-ID: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.156] Content-Type: multipart/alternative; boundary="_000_40DFE1FEB18343A59CF1464C1342C937amazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2020 22:59:39 -0000 --_000_40DFE1FEB18343A59CF1464C1342C937amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmWQgbGlrZSB0byBoZWFyIGZyb20gdGhlIHdvcmtpbmcgZ3JvdXAgb24gd2hldGhlciBvciBu b3QgdGhlcmUgaXMgaW50ZXJlc3QgaW4gY29tcGxldGluZyB0aGUgU3ViamVjdCBJZGVudGlmaWVy cyBkcmFmdCAgd2l0aGluIHNlY2V2ZW50cy4gVGhpcyB3b3JrIGhhcyBtb3JlIG9yIGxlc3MgYmVl biBwdXQgb24gaGlhdHVzIGdpdmVuIHRoZSBjaGFpcnPigJkgcHJldmlvdXMgZGVjaXNpb24gbm90 IHRvIGNvbnRpbnVlIHdpdGggaXQgd2l0aGluIHRoZSB3b3JraW5nIGdyb3VwLCBidXQgaXQgcmVt YWlucyBhIGRlcGVuZGVuY3kgZm9yIG90aGVyIHdvcmssIGFuZCBhIG51bWJlciBvZiBwZW9wbGUg d2l0aGluIHRoZSB3b3JraW5nIGdyb3VwIGhhdmUgZXhwcmVzc2VkIGludGVyZXN0IGFuZCBzdXBw b3J0IGZvciBpdCBwcmV2aW91c2x5LiBJZiB0aGVyZSBpcyBzdXBwb3J0IHdpdGhpbiB0aGUgd29y a2luZyBncm91cCBmb3IgcmVzdW1pbmcgYW5kIGNvbXBsZXRpbmcgU3ViamVjdCBJZGVudGlmaWVy cywgdGhlbiBpdCB3b3VsZCBzZWVtIHJlYXNvbmFibGUgdG8gbWUgdG8gZG8gc28gd2l0aGluIHNl Y2V2ZW50cy4NCg0K4oCTDQpBbm5hYmVsbGUgQmFja21hbiAoc2hlL2hlcikNCkFXUyBJZGVudGl0 eQ0KaHR0cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS8NCg0KDQpGcm9tOiBJZC1ldmVudCA8 aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIFlhcm9uIFNoZWZmZXIgPHlh cm9uZi5pZXRmQGdtYWlsLmNvbT4NCkRhdGU6IFR1ZXNkYXksIEp1bmUgMzAsIDIwMjAgYXQgMjow NiBBTQ0KVG86ICJpZC1ldmVudEBpZXRmLm9yZyIgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVj dDogW0VYVEVSTkFMXSBbSWQtZXZlbnRdIENsb3NpbmcgdGhlIFNlY0V2ZW50IHdvcmtpbmcgZ3Jv dXANCg0KDQpDQVVUSU9OOiBUaGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRo ZSBvcmdhbml6YXRpb24uIERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVu bGVzcyB5b3UgY2FuIGNvbmZpcm0gdGhlIHNlbmRlciBhbmQga25vdyB0aGUgY29udGVudCBpcyBz YWZlLg0KDQoNCkRlYXIgV0cgcGFydGljaXBhbnRzLA0KDQpBcyB5b3XigJl2ZSBhbGwgc2Vlbiwg b3VyIGxhc3QgdHdvIGRlbGl2ZXJhYmxlcywgdGhlIFNFVCBIVFRQIGRlbGl2ZXJ5IHNwZWNzLCBo YXZlIGJvdGggYmVlbiBhcHByb3ZlZCBmb3IgcHVibGljYXRpb24gYXMgUkZDcy4NCg0KU2luY2Ug dGhlIGdyb3VwIGhhcyBub3cgY29tcGxldGVkIGl0cyBtaXNzaW9uLCB3ZSBwcm9wb3NlIHRvIGNs b3NlIGl0IGRvd24uIFVubGVzcyB0aGVyZSBhcmUgb2JqZWN0aW9ucyAoYWNjb21wYW5pZWQgYnkg Y3JlZGlibGUgd29yayBpdGVtcykgd2l0aGluIGEgd2Vlaywgd2Ugd2lsbCBhc2sgdGhlIEFEIHRv IGRvIGp1c3QgdGhhdC4gRXZlbiB3aXRoIHRoZSBXRyBzaHV0IGRvd24sIHRoZSBtYWlsaW5nIGxp c3Qgd2lsbCByZW1haW4gb3BlbiBmb3IgcmVsZXZhbnQgZGlzY3Vzc2lvbnMuDQoNCldlIHdvdWxk IGxpa2UgdG8gdGhhbmsgdGhlIGF1dGhvcnMgb2YgdGhlIFB1c2ggYW5kIFBvbGwgc29vbi10by1i ZSBSRkNzLCBBbm5hYmVsbGUsIE1pa2UsIE1hcml1cywgTW9ydGV6YSBhbmQgQW50aG9ueS4gTWFu eSB0aGFua3MgYWxzbyB0byB0aGUgbWFueSBvdGhlciB3b3JraW5nIGdyb3VwIG1lbWJlcnMgd2hv IGNvbnRyaWJ1dGVkIHRvIHRoZXNlIHF1YWxpdHkgZG9jdW1lbnRzLg0KDQpSZWdhcmRzLA0KDQog ICAgICAgICAgICAgICAgRGljayBhbmQgWWFyb24NCg== --_000_40DFE1FEB18343A59CF1464C1342C937amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <1120719D427C3D419FDEC4EF657BF676@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiTVMgTWluY2hvIjsNCglwYW5vc2UtMToyIDIgNiA5IDQgMiA1IDgg MyA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3Nl LTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGli cmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250 LWZhbWlseToiXEBNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0K LyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5N c29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1z aXplOjEyLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVt YWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjND MSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5J4oCZZCBsaWtlIHRv IGhlYXIgZnJvbSB0aGUgd29ya2luZyBncm91cCBvbiB3aGV0aGVyIG9yIG5vdCB0aGVyZSBpcyBp bnRlcmVzdCBpbiBjb21wbGV0aW5nIHRoZSBTdWJqZWN0IElkZW50aWZpZXJzIGRyYWZ0Jm5ic3A7 IHdpdGhpbiBzZWNldmVudHMuIFRoaXMgd29yayBoYXMgbW9yZSBvciBsZXNzIGJlZW4gcHV0IG9u IGhpYXR1cyBnaXZlbiB0aGUgY2hhaXJz4oCZIHByZXZpb3VzDQogZGVjaXNpb24gbm90IHRvIGNv bnRpbnVlIHdpdGggaXQgd2l0aGluIHRoZSB3b3JraW5nIGdyb3VwLCBidXQgaXQgcmVtYWlucyBh IGRlcGVuZGVuY3kgZm9yIG90aGVyIHdvcmssIGFuZCBhIG51bWJlciBvZiBwZW9wbGUgd2l0aGlu IHRoZSB3b3JraW5nIGdyb3VwIGhhdmUgZXhwcmVzc2VkIGludGVyZXN0IGFuZCBzdXBwb3J0IGZv ciBpdCBwcmV2aW91c2x5LiBJZiB0aGVyZSBpcyBzdXBwb3J0IHdpdGhpbiB0aGUgd29ya2luZyBn cm91cCBmb3IgcmVzdW1pbmcNCiBhbmQgY29tcGxldGluZyBTdWJqZWN0IElkZW50aWZpZXJzLCB0 aGVuIGl0IHdvdWxkIHNlZW0gcmVhc29uYWJsZSB0byBtZSB0byBkbyBzbyB3aXRoaW4gc2VjZXZl bnRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+4oCTPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5Bbm5hYmVsbGUgQmFja21hbiAoc2hlL2hlcik8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkFXUyBJZGVudGl0eTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS8iPjxzcGFu IHN0eWxlPSJjb2xvcjojMDU2M0MxIj5odHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5Lzwv c3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxl PSJjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPg0KPC9iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFj ayI+SWQtZXZlbnQgJmx0O2lkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7IG9uIGJlaGFsZiBv ZiBZYXJvbiBTaGVmZmVyICZsdDt5YXJvbmYuaWV0ZkBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+RGF0 ZTogPC9iPlR1ZXNkYXksIEp1bmUgMzAsIDIwMjAgYXQgMjowNiBBTTxicj4NCjxiPlRvOiA8L2I+ JnF1b3Q7aWQtZXZlbnRAaWV0Zi5vcmcmcXVvdDsgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0Ozxi cj4NCjxiPlN1YmplY3Q6IDwvYj5bRVhURVJOQUxdIFtJZC1ldmVudF0gQ2xvc2luZyB0aGUgU2Vj RXZlbnQgd29ya2luZyBncm91cDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8dGFibGUgY2xhc3M9Ik1zb05vcm1hbFRhYmxlIiBib3JkZXI9IjAiIGNlbGxzcGFjaW5nPSIw IiBjZWxscGFkZGluZz0iMCIgd2lkdGg9IjYyMiIgc3R5bGU9IndpZHRoOjQ2Ni41cHQ7bWFyZ2lu LWxlZnQ6LjVpbjtib3JkZXItY29sbGFwc2U6Y29sbGFwc2UiPg0KPHRib2R5Pg0KPHRyIHN0eWxl PSJoZWlnaHQ6MTUuMjVwdCI+DQo8dGQgd2lkdGg9IjYyMiIgdmFsaWduPSJ0b3AiIHN0eWxlPSJ3 aWR0aDo0NjYuNXB0O2JvcmRlcjpzb2xpZCAjRUQ3RDMxIDEuNXB0O3BhZGRpbmc6MGluIDUuNHB0 IDBpbiA1LjRwdDtoZWlnaHQ6MTUuMjVwdCI+DQo8cD48c3Ryb25nPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2s7YmFja2dy b3VuZDojRkZGRjk5Ij5DQVVUSU9OPC9zcGFuPjwvc3Ryb25nPjxzcGFuIHN0eWxlPSJjb2xvcjpi bGFjaztiYWNrZ3JvdW5kOiNGRkZGOTkiPjogVGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZyb20gb3V0 c2lkZSBvZiB0aGUgb3JnYW5pemF0aW9uLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Igb3BlbiBhdHRh Y2htZW50cyB1bmxlc3MNCiB5b3UgY2FuIGNvbmZpcm0gdGhlIHNlbmRlciBhbmQga25vdyB0aGUg Y29udGVudCBpcyBzYWZlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvdGQ+DQo8L3RyPg0KPC90 Ym9keT4NCjwvdGFibGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkRlYXIgV0cgcGFydGljaXBhbnRz LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ QXMgeW914oCZdmUgYWxsIHNlZW4sIG91ciBsYXN0IHR3byBkZWxpdmVyYWJsZXMsIHRoZSBTRVQg SFRUUCBkZWxpdmVyeSBzcGVjcywgaGF2ZSBib3RoIGJlZW4gYXBwcm92ZWQgZm9yIHB1YmxpY2F0 aW9uIGFzIFJGQ3MuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlNpbmNlIHRo ZSBncm91cCBoYXMgbm93IGNvbXBsZXRlZCBpdHMgbWlzc2lvbiwgd2UgcHJvcG9zZSB0byBjbG9z ZSBpdCBkb3duLiBVbmxlc3MgdGhlcmUgYXJlIG9iamVjdGlvbnMgKGFjY29tcGFuaWVkIGJ5IGNy ZWRpYmxlIHdvcmsgaXRlbXMpIHdpdGhpbiBhIHdlZWssIHdlIHdpbGwgYXNrIHRoZSBBRCB0byBk bw0KIGp1c3QgdGhhdC4gRXZlbiB3aXRoIHRoZSBXRyBzaHV0IGRvd24sIHRoZSBtYWlsaW5nIGxp c3Qgd2lsbCByZW1haW4gb3BlbiBmb3IgcmVsZXZhbnQgZGlzY3Vzc2lvbnMuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPldlIHdvdWxkIGxpa2UgdG8gdGhhbmsgdGhlIGF1dGhv cnMgb2YgdGhlIFB1c2ggYW5kIFBvbGwgc29vbi10by1iZSBSRkNzLCBBbm5hYmVsbGUsIE1pa2Us IE1hcml1cywgTW9ydGV6YSBhbmQgQW50aG9ueS4gTWFueSB0aGFua3MgYWxzbyB0byB0aGUgbWFu eSBvdGhlciB3b3JraW5nIGdyb3VwIG1lbWJlcnMgd2hvDQogY29udHJpYnV0ZWQgdG8gdGhlc2Ug cXVhbGl0eSBkb2N1bWVudHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlJl Z2FyZHMsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyBEaWNrIGFuZCBZYXJvbjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_40DFE1FEB18343A59CF1464C1342C937amazoncom_-- From nobody Thu Jul 2 16:33:24 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 287193A0822 for ; Thu, 2 Jul 2020 16:33:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U7tJTtu90quq for ; Thu, 2 Jul 2020 16:33:20 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650097.outbound.protection.outlook.com [40.107.65.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3ED213A0820 for ; Thu, 2 Jul 2020 16:33:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IFZQvVzjyJpNJF/GpIVDHo8XpJ4xkSgZJHKLsTho8V4/vUhW6vyTXgz0uaW6tQzIJ4mqO83BqDuK4yBbHsgZRqsvMo4n2CfMn43jtYXmupNf2YrrneEbMkc4mNFbfHmtqTMP0QL+7Ov0BGm2oPikNeWJVXc+RfaP3zx/BQlZgnY94obt+PjxhmQSyzg4V281rJwILT3sa0ZzWJcAsgJqNZhCl/HnDUvgLYMz27GBhf9DViT8jDzEqvJ8WoDJPPpV5eqbqNXCoTWAQTN7O3AEvWdiJlW2bg0HFmJESBbN8ic4iYwDu7yf79RVoXKGosY4B8J2SLjAaSZwXQEplGbVoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=D4zmdVYCD1RHNG+wkzetD9lqbF7noEZkGOxw+9vH5QU=; b=etP894GL/HD4O6CdPE6Dhma0hsdF3gvJnvklieFiq/C5WWPh2BD7bWUsBIm9egI3iqCBEZcDdwW8WDeIJPpKXF+hj2ZdOxxVGhs1gw88vh3zFxhjx3QGnbF04NmmHDLtCDNQpLBzLOBY0GAPTxfMrOOqWlpowdDgc1KIXy41xIZbF0EA+2mklJWs1wVkkJaWRZNStiiIhTqcAMVFvpWvpLLDQKiYK2ZH9PBsxUSIjynL7ka60WZu/b6jEqORthtBG4dF1KsVCbh7XbEEqyLgeMNO2QrzONFIml5+wm62gXYmrKglvulnCDXvtoEe42f67j9zbI6bdKmJ8F5nkQN/9A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=D4zmdVYCD1RHNG+wkzetD9lqbF7noEZkGOxw+9vH5QU=; b=gPBNoxze2X0TsJdKy/92uM3JgcMBcxOLI655oA1JkoBQCfh5oI46p4wBM61tcRcCck2GySJRcBirFbdDGrsVZD3Y6jG8fXvWfuOp1Y/GSB2HoBzsbGbvkvbGHaLjeuZTeiI0GNkVoCvlodH2zBA01oMvLb63SMEhEc4DJQUd81U= Received: from DM6PR00MB0682.namprd00.prod.outlook.com (2603:10b6:5:213::24) by DM5PR00MB0421.namprd00.prod.outlook.com (2603:10b6:4:a0::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.0; Thu, 2 Jul 2020 23:33:12 +0000 Received: from DM6PR00MB0682.namprd00.prod.outlook.com ([fe80::7844:cc3c:aa7f:cf51]) by DM6PR00MB0682.namprd00.prod.outlook.com ([fe80::7844:cc3c:aa7f:cf51%6]) with mapi id 15.20.3196.000; Thu, 2 Jul 2020 23:33:12 +0000 From: Mike Jones To: "Richard Backman, Annabelle" , Yaron Sheffer , "id-event@ietf.org" Thread-Topic: [Id-event] Closing the SecEvent working group Thread-Index: AQHWTr2gwWrTFh/HDU2dGZXzQ2Sua6j062iAgAAIPmA= Date: Thu, 2 Jul 2020 23:33:12 +0000 Message-ID: References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> In-Reply-To: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=f1594d4c-27f1-44c5-b1a8-bd8d72760b0c; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-02T23:29:02Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: c04457ef-e5be-4bbd-46fc-08d81ee0492a x-ms-traffictypediagnostic: DM5PR00MB0421: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 0D4/SAXgs2JIEslHKCtMyqPK719WIJJe+MP73HqQIILxUqrNvb2FWt85bPAgVYmhfr1o6u8PWD6e7upJyrFIHPZKShBQkezFZruQQQWnsVpAZc1vAYTMKTiDhGuF0j8M+EmkaslWcPJ6WEo/0CQx28j0YxYw664qa4w/sEMYWCu5R9mFz1ULgFZUAcYlHEsh2b7hTfIJalNv8wr95iwJxzNAx/y1sQlcjbt5u4cPSR7igzAX19DC5xCrahXPWbt9XdJXhZ+qdl/hxWxi+flPA0I7pQooA1gg92XAT6UYAuLVesw19CpG8ndeEQwuD/AbVoIv79ajZ7+hWDEjNN4WCGlcAwVqHKSa6tB0d/unhv5HMx7gss+qjtS7pYycVGoIAKskn1bU2p1ART3OyJnYow== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR00MB0682.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(376002)(39860400002)(396003)(136003)(366004)(166002)(316002)(186003)(66476007)(66556008)(64756008)(66446008)(76116006)(110136005)(5660300002)(66946007)(26005)(53546011)(6506007)(9686003)(82950400001)(52536014)(82960400001)(7696005)(86362001)(10290500003)(33656002)(8990500004)(966005)(55016002)(478600001)(8936002)(83380400001)(71200400001)(2906002)(8676002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: wVWvR8rylok+eiFa2GkGudRLN0r+9xXa1lkFhIH8KbxqFg27XX9eXsJnG7oGhszcZS14wOC1eX3xArUih8lEVaOE47ASL/T8M6t7benbrND3D83ZfoF0g7lDirLCIgIIssOMayGzy+aAcWhATRR/3XqS6Ei6YuAUYtiIF5NHmL8q0DOKbbeo0sPuWHoqLe5QNyN3O2Ff5S6CVUn5OJ00MuhyY5pps02XnHesvjBI0JcxfwlcLQwKof4u7EqB5v+S1no9swzHI2B9d/viw9sXN0WosihZm0wMut0dOAygFG7l8/2NcmwmR+6yRyi+DeWdX5ZZ/lqhxAiLYH70hjDwzQPR+LfTsh/8apnvujuC/Psr1FWg0nFIj8T1G1UxMs9Wr8kAxiV2AK0DLClSYZWTpG924d/GBek7H1NyOr0O/d60OStmBbOY9bzXnp7i5XcnTKQFqRP/Ha1m55J4hb6L01ubGYWehRbYVllT7M3u/Cg= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB068263A31A6F7A22C2E55F67F56D0DM6PR00MB0682namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR00MB0682.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c04457ef-e5be-4bbd-46fc-08d81ee0492a X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Jul 2020 23:33:12.0845 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: qo5W48XD55ynJ9oyO5LTkIQUmoBbxjcFvkPvKCONXpZTodfNv5OA80WWbkCSkfHqmP7VOx5eWdIV1b+53+NiuA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR00MB0421 Archived-At: Subject: Re: [Id-event] Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2020 23:33:22 -0000 --_000_DM6PR00MB068263A31A6F7A22C2E55F67F56D0DM6PR00MB0682namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciByYWlzaW5nIHRoaXMgcG9pbnQsIEFubmFiZWxsZS4NCg0KSSBzdXBwb3J0IGZp bmlzaGluZyBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1zZWNldmVudC1z dWJqZWN0LWlkZW50aWZpZXJzIGluIHRoaXMgd29ya2luZyBncm91cC4gIEl04oCZcyBhbiBpbXBv cnRhbnQgc3BlY2lmaWNhdGlvbiBhbmQgdGhlIHJpZ2h0IHBlb3BsZSB0byBwcm92aWRlIGFjdGlv bmFibGUgcmV2aWV3cyBhcmUgYWxyZWFkeSBpbiB0aGlzIHdvcmtpbmcgZ3JvdXAuICBJZiB0aGlz IG1vdmVzIGVsc2V3aGVyZSwgaXQgd29u4oCZdCBnZXQgdGhlIHNhbWUgbGV2ZWwgb2YgZXhwZXJ0 IHJldmlldyB0aGF0IGl0IHdpbGwgaGVyZS4NCg0KSeKAmWxsIGFsc28gbm90ZSB0aGF0IGF0IGxl YXN0IHNldmVuIHBlb3BsZSByZXNwb25kZWQgcG9zaXRpdmVseSB0byB0aGUgV0dMQyBhbmQgbm9u ZSBvcHBvc2VkLg0KDQpJIGFncmVlIHRoYXQgaXTigJlzIHRpbWUgdG8gZmluaXNoIHRoaXMgd29y ay4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC0tIE1pa2UNCg0KRnJvbTogSWQtZXZlbnQgPGlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5v cmc+IE9uIEJlaGFsZiBPZiBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZQ0KU2VudDogVGh1cnNk YXksIEp1bHkgMiwgMjAyMCA0OjAwIFBNDQpUbzogWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZA Z21haWwuY29tPjsgaWQtZXZlbnRAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIENs b3NpbmcgdGhlIFNlY0V2ZW50IHdvcmtpbmcgZ3JvdXANCg0KSeKAmWQgbGlrZSB0byBoZWFyIGZy b20gdGhlIHdvcmtpbmcgZ3JvdXAgb24gd2hldGhlciBvciBub3QgdGhlcmUgaXMgaW50ZXJlc3Qg aW4gY29tcGxldGluZyB0aGUgU3ViamVjdCBJZGVudGlmaWVycyBkcmFmdCAgd2l0aGluIHNlY2V2 ZW50cy4gVGhpcyB3b3JrIGhhcyBtb3JlIG9yIGxlc3MgYmVlbiBwdXQgb24gaGlhdHVzIGdpdmVu IHRoZSBjaGFpcnPigJkgcHJldmlvdXMgZGVjaXNpb24gbm90IHRvIGNvbnRpbnVlIHdpdGggaXQg d2l0aGluIHRoZSB3b3JraW5nIGdyb3VwLCBidXQgaXQgcmVtYWlucyBhIGRlcGVuZGVuY3kgZm9y IG90aGVyIHdvcmssIGFuZCBhIG51bWJlciBvZiBwZW9wbGUgd2l0aGluIHRoZSB3b3JraW5nIGdy b3VwIGhhdmUgZXhwcmVzc2VkIGludGVyZXN0IGFuZCBzdXBwb3J0IGZvciBpdCBwcmV2aW91c2x5 LiBJZiB0aGVyZSBpcyBzdXBwb3J0IHdpdGhpbiB0aGUgd29ya2luZyBncm91cCBmb3IgcmVzdW1p bmcgYW5kIGNvbXBsZXRpbmcgU3ViamVjdCBJZGVudGlmaWVycywgdGhlbiBpdCB3b3VsZCBzZWVt IHJlYXNvbmFibGUgdG8gbWUgdG8gZG8gc28gd2l0aGluIHNlY2V2ZW50cy4NCg0K4oCTDQpBbm5h YmVsbGUgQmFja21hbiAoc2hlL2hlcikNCkFXUyBJZGVudGl0eQ0KaHR0cHM6Ly9hd3MuYW1hem9u LmNvbS9pZGVudGl0eS8NCg0KDQpGcm9tOiBJZC1ldmVudCA8aWQtZXZlbnQtYm91bmNlc0BpZXRm Lm9yZzxtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiBZYXJv biBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWls LmNvbT4+DQpEYXRlOiBUdWVzZGF5LCBKdW5lIDMwLCAyMDIwIGF0IDI6MDYgQU0NClRvOiAiaWQt ZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPiIgPGlkLWV2ZW50QGlldGYu b3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFtJZC1l dmVudF0gQ2xvc2luZyB0aGUgU2VjRXZlbnQgd29ya2luZyBncm91cA0KDQoNCkNBVVRJT046IFRo aXMgZW1haWwgb3JpZ2luYXRlZCBmcm9tIG91dHNpZGUgb2YgdGhlIG9yZ2FuaXphdGlvbi4gRG8g bm90IGNsaWNrIGxpbmtzIG9yIG9wZW4gYXR0YWNobWVudHMgdW5sZXNzIHlvdSBjYW4gY29uZmly bSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuDQoNCkRlYXIgV0cgcGFy dGljaXBhbnRzLA0KDQpBcyB5b3XigJl2ZSBhbGwgc2Vlbiwgb3VyIGxhc3QgdHdvIGRlbGl2ZXJh YmxlcywgdGhlIFNFVCBIVFRQIGRlbGl2ZXJ5IHNwZWNzLCBoYXZlIGJvdGggYmVlbiBhcHByb3Zl ZCBmb3IgcHVibGljYXRpb24gYXMgUkZDcy4NCg0KU2luY2UgdGhlIGdyb3VwIGhhcyBub3cgY29t cGxldGVkIGl0cyBtaXNzaW9uLCB3ZSBwcm9wb3NlIHRvIGNsb3NlIGl0IGRvd24uIFVubGVzcyB0 aGVyZSBhcmUgb2JqZWN0aW9ucyAoYWNjb21wYW5pZWQgYnkgY3JlZGlibGUgd29yayBpdGVtcykg d2l0aGluIGEgd2Vlaywgd2Ugd2lsbCBhc2sgdGhlIEFEIHRvIGRvIGp1c3QgdGhhdC4gRXZlbiB3 aXRoIHRoZSBXRyBzaHV0IGRvd24sIHRoZSBtYWlsaW5nIGxpc3Qgd2lsbCByZW1haW4gb3BlbiBm b3IgcmVsZXZhbnQgZGlzY3Vzc2lvbnMuDQoNCldlIHdvdWxkIGxpa2UgdG8gdGhhbmsgdGhlIGF1 dGhvcnMgb2YgdGhlIFB1c2ggYW5kIFBvbGwgc29vbi10by1iZSBSRkNzLCBBbm5hYmVsbGUsIE1p a2UsIE1hcml1cywgTW9ydGV6YSBhbmQgQW50aG9ueS4gTWFueSB0aGFua3MgYWxzbyB0byB0aGUg bWFueSBvdGhlciB3b3JraW5nIGdyb3VwIG1lbWJlcnMgd2hvIGNvbnRyaWJ1dGVkIHRvIHRoZXNl IHF1YWxpdHkgZG9jdW1lbnRzLg0KDQpSZWdhcmRzLA0KDQogICAgICAgICAgICAgICAgRGljayBh bmQgWWFyb24NCg== --_000_DM6PR00MB068263A31A6F7A22C2E55F67F56D0DM6PR00MB0682namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0 aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJz b25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjoj MDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0K CWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEu MGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24x DQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94 bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2 OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFw ZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBs aW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29s b3I6IzAwMjA2MCI+VGhhbmtzIGZvciByYWlzaW5nIHRoaXMgcG9pbnQsIEFubmFiZWxsZS48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xv cjojMDAyMDYwIj5JIHN1cHBvcnQgZmluaXNoaW5nDQo8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVjdC1pZGVudGlmaWVy cyI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVj dC1pZGVudGlmaWVyczwvYT4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOiMw MDIwNjAiPmluIHRoaXMgd29ya2luZyBncm91cC4mbmJzcDsgSXTigJlzIGFuIGltcG9ydGFudCBz cGVjaWZpY2F0aW9uIGFuZCB0aGUgcmlnaHQgcGVvcGxlIHRvIHByb3ZpZGUgYWN0aW9uYWJsZSBy ZXZpZXdzIGFyZSBhbHJlYWR5IGluIHRoaXMgd29ya2luZyBncm91cC4mbmJzcDsgSWYgdGhpcyBt b3ZlcyBlbHNld2hlcmUsIGl0IHdvbuKAmXQgZ2V0IHRoZSBzYW1lIGxldmVsIG9mIGV4cGVydCBy ZXZpZXcNCiB0aGF0IGl0IHdpbGwgaGVyZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjojMDAyMDYw Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjojMDAyMDYwIj5J4oCZbGwgYWxzbyBub3Rl IHRoYXQgYXQgbGVhc3Qgc2V2ZW4gcGVvcGxlIHJlc3BvbmRlZCBwb3NpdGl2ZWx5IHRvIHRoZSBX R0xDIGFuZCBub25lIG9wcG9zZWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6IzAwMjA2MCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6IzAwMjA2MCI+SSBhZ3JlZSB0aGF0IGl04oCZcyB0 aW1lIHRvIGZpbmlzaCB0aGlzIHdvcmsuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6IzAwMjA2MCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+IElkLWV2ZW50ICZsdDtpZC1ldmVudC1ib3VuY2VzQGlldGYub3Jn Jmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5SaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZTxicj4N CjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwgSnVseSAyLCAyMDIwIDQ6MDAgUE08YnI+DQo8Yj5Ubzo8 L2I+IFlhcm9uIFNoZWZmZXIgJmx0O3lhcm9uZi5pZXRmQGdtYWlsLmNvbSZndDs7IGlkLWV2ZW50 QGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIENsb3NpbmcgdGhl IFNlY0V2ZW50IHdvcmtpbmcgZ3JvdXA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SeKAmWQgbGlrZSB0 byBoZWFyIGZyb20gdGhlIHdvcmtpbmcgZ3JvdXAgb24gd2hldGhlciBvciBub3QgdGhlcmUgaXMg aW50ZXJlc3QgaW4gY29tcGxldGluZyB0aGUgU3ViamVjdCBJZGVudGlmaWVycyBkcmFmdCZuYnNw OyB3aXRoaW4gc2VjZXZlbnRzLiBUaGlzIHdvcmsgaGFzIG1vcmUgb3IgbGVzcyBiZWVuIHB1dCBv biBoaWF0dXMgZ2l2ZW4gdGhlIGNoYWlyc+KAmSBwcmV2aW91cw0KIGRlY2lzaW9uIG5vdCB0byBj b250aW51ZSB3aXRoIGl0IHdpdGhpbiB0aGUgd29ya2luZyBncm91cCwgYnV0IGl0IHJlbWFpbnMg YSBkZXBlbmRlbmN5IGZvciBvdGhlciB3b3JrLCBhbmQgYSBudW1iZXIgb2YgcGVvcGxlIHdpdGhp biB0aGUgd29ya2luZyBncm91cCBoYXZlIGV4cHJlc3NlZCBpbnRlcmVzdCBhbmQgc3VwcG9ydCBm b3IgaXQgcHJldmlvdXNseS4gSWYgdGhlcmUgaXMgc3VwcG9ydCB3aXRoaW4gdGhlIHdvcmtpbmcg Z3JvdXAgZm9yIHJlc3VtaW5nDQogYW5kIGNvbXBsZXRpbmcgU3ViamVjdCBJZGVudGlmaWVycywg dGhlbiBpdCB3b3VsZCBzZWVtIHJlYXNvbmFibGUgdG8gbWUgdG8gZG8gc28gd2l0aGluIHNlY2V2 ZW50cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPuKAkzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+QW5uYWJlbGxlIEJhY2ttYW4gKHNoZS9oZXIpPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5BV1MgSWRlbnRpdHk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvIj5odHRw czovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5LzwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzoz LjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PGI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+DQo8L2I+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5JZC1ldmVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlk LWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciPmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0 OyBvbiBiZWhhbGYgb2YgWWFyb24gU2hlZmZlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOnlhcm9uZi5p ZXRmQGdtYWlsLmNvbSI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZndDs8YnI+DQo8Yj5EYXRl OiA8L2I+VHVlc2RheSwgSnVuZSAzMCwgMjAyMCBhdCAyOjA2IEFNPGJyPg0KPGI+VG86IDwvYj4m cXVvdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciPmlkLWV2ZW50QGlldGYub3Jn PC9hPiZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIj5pZC1ldmVu dEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPltFWFRFUk5BTF0gW0lkLWV2 ZW50XSBDbG9zaW5nIHRoZSBTZWNFdmVudCB3b3JraW5nIGdyb3VwPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUiIGJvcmRl cj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0aD0iNjIyIiBzdHlsZT0i d2lkdGg6NDY2LjVwdDttYXJnaW4tbGVmdDouNWluO2JvcmRlci1jb2xsYXBzZTpjb2xsYXBzZSI+ DQo8dGJvZHk+DQo8dHIgc3R5bGU9ImhlaWdodDoxNS4yNXB0Ij4NCjx0ZCB3aWR0aD0iNjIyIiB2 YWxpZ249InRvcCIgc3R5bGU9IndpZHRoOjQ2Ni41cHQ7Ym9yZGVyOnNvbGlkICNFRDdEMzEgMS41 cHQ7cGFkZGluZzowaW4gNS40cHQgMGluIDUuNHB0O2hlaWdodDoxNS4yNXB0Ij4NCjxwPjxzdHJv bmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkZGOTkiPkNBVVRJT048L3NwYW4+PC9zdHJvbmc+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQ6I0ZGRkY5OSI+OiBUaGlzIGVtYWls IG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRpb24uIERvIG5vdCBjbGlj ayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcw0KIHlvdSBjYW4gY29uZmlybSB0aGUg c2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ RGVhciBXRyBwYXJ0aWNpcGFudHMsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij5BcyB5b3XigJl2ZSBhbGwgc2Vlbiwgb3VyIGxhc3QgdHdvIGRl bGl2ZXJhYmxlcywgdGhlIFNFVCBIVFRQIGRlbGl2ZXJ5IHNwZWNzLCBoYXZlIGJvdGggYmVlbiBh cHByb3ZlZCBmb3IgcHVibGljYXRpb24gYXMgUkZDcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+U2luY2UgdGhlIGdyb3VwIGhhcyBub3cgY29tcGxldGVkIGl0cyBtaXNzaW9u LCB3ZSBwcm9wb3NlIHRvIGNsb3NlIGl0IGRvd24uIFVubGVzcyB0aGVyZSBhcmUgb2JqZWN0aW9u cyAoYWNjb21wYW5pZWQgYnkgY3JlZGlibGUgd29yayBpdGVtcykgd2l0aGluIGEgd2Vlaywgd2Ug d2lsbCBhc2sgdGhlIEFEIHRvIGRvDQoganVzdCB0aGF0LiBFdmVuIHdpdGggdGhlIFdHIHNodXQg ZG93biwgdGhlIG1haWxpbmcgbGlzdCB3aWxsIHJlbWFpbiBvcGVuIGZvciByZWxldmFudCBkaXNj dXNzaW9ucy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+V2Ugd291bGQgbGlr ZSB0byB0aGFuayB0aGUgYXV0aG9ycyBvZiB0aGUgUHVzaCBhbmQgUG9sbCBzb29uLXRvLWJlIFJG Q3MsIEFubmFiZWxsZSwgTWlrZSwgTWFyaXVzLCBNb3J0ZXphIGFuZCBBbnRob255LiBNYW55IHRo YW5rcyBhbHNvIHRvIHRoZSBtYW55IG90aGVyIHdvcmtpbmcgZ3JvdXAgbWVtYmVycyB3aG8NCiBj b250cmlidXRlZCB0byB0aGVzZSBxdWFsaXR5IGRvY3VtZW50cy48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+UmVnYXJkcyw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IERpY2sgYW5kIFlhcm9uPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM6PR00MB068263A31A6F7A22C2E55F67F56D0DM6PR00MB0682namp_-- From nobody Thu Jul 2 16:38:34 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A9103A084C for ; Thu, 2 Jul 2020 16:38:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Igfebh46DiHu for ; Thu, 2 Jul 2020 16:38:31 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640115.outbound.protection.outlook.com [40.107.64.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DE2B3A083E for ; Thu, 2 Jul 2020 16:38:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MKvJkt7hAbMCcE5ga15wLYj98lGMa2UYuvd2vf9jtYswIbaLovTaIY5XDcWFSuWtGlWTgpxU2BGPO4yAGGaQTRNc+Rx3z4rIidNaur1fTAKmP4elkoKT6VSPcHWl+0W/rw9QGSnVUjk6U1RAbc9HiZIP0tgmDvKKsicyrrbTAZrDazJ5D2Em0Gh5fRnf9P65RsD2Hbs4qhcz6Mn4Z2yJxR9eDAz9cocbbeHrvlw7dYXZVtGjUM8VfdZk6DM77VyCgXTyAezUAq3/xhMLj0lgbkCTp+5Lsn7l6srYfz5t3omPFgzTcjZeDO3HvCUC9AlqZBCgiJlWf2G6iJcsIKe7hA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AgNue7o5SQrWCRfqWWkVi1oeN3yFbZsKXIFE65S66vk=; b=ObmlLdM9awgfuP7oaVaxSC/VodDcb3xMcwdYeUhLVv9kLHs3RALl1M1pBqccSYHAb1tVmBHHwXG8faiqyPovzB+QW3zJAPGeMz/5bOngWA+tzMJoLsxFyePkHcRAw4knsdtsW5nrLHHwahv/krSryrSmcuHz8esErgDRh2FF1Guk+y8D/pmZpNcIswumwyUiJGIcuRum2a0MZZWojDvtuHfM7a8Wbu0rhTbaTSvy8A/i5QXPxnCd0JUk1YWGTFQPHidUxdFCYOLOSzhIgDmOp223hKWzzGa5zy65m+7aqRng+ZTdumaDFklT5JkNV1RdQjkLIb4x7Ei/7jB6cBLvMQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AgNue7o5SQrWCRfqWWkVi1oeN3yFbZsKXIFE65S66vk=; b=DhrWau4uSW05983gvE1uXUu2uTIGwaD8fiKbZlQhWgT7sXhaun0N1ZnXQMP5H5APby5nwao/FfapISR/i1zkkrEF412VgVKWbXOOnDjKrVB2elrLJsBLKrvaO1MIFfsQI95kgEDaM1yA47mLbuadA2rpEUs0Rkjnh6TEvow9wYQ= Received: from DM6PR00MB0814.namprd00.prod.outlook.com (2603:10b6:5:1b8::7) by DM6PR00MB0617.namprd00.prod.outlook.com (2603:10b6:5:164::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3193.0; Thu, 2 Jul 2020 23:38:29 +0000 Received: from DM6PR00MB0814.namprd00.prod.outlook.com ([fe80::9d54:babb:6c28:857a]) by DM6PR00MB0814.namprd00.prod.outlook.com ([fe80::9d54:babb:6c28:857a%3]) with mapi id 15.20.3194.000; Thu, 2 Jul 2020 23:38:29 +0000 From: Tim Cappalli To: "Richard Backman, Annabelle" , Yaron Sheffer , "id-event@ietf.org" , Mike Jones Thread-Topic: [Id-event] Closing the SecEvent working group Thread-Index: AQHWTr2js/7xj8t/Y063gRPmvhcxbaj062iAgAAJaQCAAAETRQ== Date: Thu, 2 Jul 2020 23:38:29 +0000 Message-ID: References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-02T23:29:02.0000000Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [100.0.202.188] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 63ecb358-8910-45a9-68b4-08d81ee10638 x-ms-traffictypediagnostic: DM6PR00MB0617: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: pIhMQmX9ZA3CunE+EzkD0Ii5ofugOsS2110NW3Tacmm4Pbazba+S2/XK6OBj411fI0rd+1nYAryDtxwtq6IeTn3zkOo7DUXpCmSXSRsoDjUnaUYBOpVuViratWiI0qsDxxonRNfKbCxZhBmRgW0Qc3lm/PreDaeibS+3GwtDmpObsLqwo7n8Gpga6rYNRqShi3Lq5HjX+r8v87kcBCcpWNOjoNEsy5GIPmIv11DJZ83N7ir+Xbt6wyn1/9t3IUBfrDU4MURu1aJuvj8NM8y10eb9VWumVZrxXrEEhh70Lu+b+hTUhpLReWHxjP8qJ0AuBdlxNaoNPhpiVzL6hRx2O+7tjgOXrX/Q7xyrg5juO4fvaCeWLsI+nGNbttGJ7Y1w/g4x3LGPSfpCR5XMBBwjbQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR00MB0814.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(346002)(39860400002)(136003)(376002)(396003)(76116006)(91956017)(8676002)(82960400001)(82950400001)(55016002)(8990500004)(33656002)(966005)(7696005)(166002)(52536014)(8936002)(186003)(71200400001)(9686003)(478600001)(110136005)(26005)(66446008)(6506007)(64756008)(316002)(5660300002)(66556008)(86362001)(66476007)(19627235002)(10290500003)(2906002)(66946007)(53546011)(83380400001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: Oz0lGIH02OAkGfKwP37AYzW1D87A98w+yajh0qTe//IGPY4vl5HKu3aC0lflniqi3TWfzJKJPxjMEBPbSf0mGWis6nrJ2B1L9GGE07scB6jB8HjvOjO1zcLWz7hiQzYbfxk4CQtt8x6IjZbm/QUn16umBSuWfmSKFYaELEvgDkb9KNZrPQaAzCmWdyfQBA4yHA0esc6qSjbFdO2sjwml++q3B0uknHxMQIrGiafr2LZNjrzb/jCvTRYOZ6IjcpfMsfgh33D8xRvZvoSjTsEBQ9DGXeT5Eq4MrvgraBszoeNo3mPhEzetSnEVRq/zaIUQYlbGQeHugSGLsTQ7lKU8eVYwjRygZLrVjfw0EPJX1og5+uIU1rTnxYI5ujgk979MPAqyLw3bZptECU1odRTGN7V2hu8bfCMujNrrvhli08A= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB0814AA4CF9918C13497B84DB956D0DM6PR00MB0814namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR00MB0814.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 63ecb358-8910-45a9-68b4-08d81ee10638 X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Jul 2020 23:38:29.2117 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 1Bs0jpgEh/TlNYQrcvFP4fydKjFcU8u9N0q9a5es8HQGO3r0Pt6a8igBUaNSzqsRUlzOF1iWXJ3pMyocwje9Sw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0617 Archived-At: Subject: Re: [Id-event] Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2020 23:38:33 -0000 --_000_DM6PR00MB0814AA4CF9918C13497B84DB956D0DM6PR00MB0814namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable +1 I would like to see https://tools.ietf.org/html/draft-ietf-secevent-subject-ident= ifiers= finished in this group. Tim ________________________________ From: Id-event on behalf of Mike Jones Sent: Thursday, July 2, 2020 7:33:12 PM To: Richard Backman, Annabelle ; Ya= ron Sheffer ; id-event@ietf.org Subject: Re: [Id-event] Closing the SecEvent working group Thanks for raising this point, Annabelle. I support finishing https://tools.ietf.org/html/draft-ietf-secevent-subject= -identifiers in this worki= ng group. It=92s an important specification and the right people to provid= e actionable reviews are already in this working group. If this moves else= where, it won=92t get the same level of expert review that it will here. I=92ll also note that at least seven people responded positively to the WGL= C and none opposed. I agree that it=92s time to finish this work. -- Mike From: Id-event On Behalf Of Richard Backman, An= nabelle Sent: Thursday, July 2, 2020 4:00 PM To: Yaron Sheffer ; id-event@ietf.org Subject: Re: [Id-event] Closing the SecEvent working group I=92d like to hear from the working group on whether or not there is intere= st in completing the Subject Identifiers draft within secevents. This work= has more or less been put on hiatus given the chairs=92 previous decision = not to continue with it within the working group, but it remains a dependen= cy for other work, and a number of people within the working group have exp= ressed interest and support for it previously. If there is support within t= he working group for resuming and completing Subject Identifiers, then it w= ould seem reasonable to me to do so within secevents. =96 Annabelle Backman (she/her) AWS Identity https://aws.amazon.com/identity/ From: Id-event = > on behalf of Yaron Sheffer > Date: Tuesday, June 30, 2020 at 2:06 AM To: "id-event@ietf.org" > Subject: [EXTERNAL] [Id-event] Closing the SecEvent working group CAUTION: This email originated from outside of the organization. Do not cli= ck links or open attachments unless you can confirm the sender and know the= content is safe. Dear WG participants, As you=92ve all seen, our last two deliverables, the SET HTTP delivery spec= s, have both been approved for publication as RFCs. Since the group has now completed its mission, we propose to close it down.= Unless there are objections (accompanied by credible work items) within a = week, we will ask the AD to do just that. Even with the WG shut down, the m= ailing list will remain open for relevant discussions. We would like to thank the authors of the Push and Poll soon-to-be RFCs, An= nabelle, Mike, Marius, Morteza and Anthony. Many thanks also to the many ot= her working group members who contributed to these quality documents. Regards, Dick and Yaron --_000_DM6PR00MB0814AA4CF9918C13497B84DB956D0DM6PR00MB0814namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
+1

I would like to see https://tools.ietf.org/html/draft-ie= tf-secevent-subject-identifiers finished in this group.

Tim
From: Id-event <id-event= -bounces@ietf.org> on behalf of Mike Jones <Michael.Jones=3D40microso= ft.com@dmarc.ietf.org>
Sent: Thursday, July 2, 2020 7:33:12 PM
To: Richard Backman, Annabelle <richanna=3D40amazon.com@dmarc.iet= f.org>; Yaron Sheffer <yaronf.ietf@gmail.com>; id-event@ietf.org &= lt;id-event@ietf.org>
Subject: Re: [Id-event] Closing the SecEvent working group
 

Th= anks for raising this point, Annabelle.

&n= bsp;

I = support finishing https://tools.ietf.o= rg/html/draft-ietf-secevent-subject-identifiers in this working group. = ; It=92s an important specification and the right people to provide actiona= ble reviews are already in this working group.  If this moves elsewher= e, it won=92t get the same level of expert review that it will here.

&n= bsp;

I= =92ll also note that at least seven people responded positively to the WGLC= and none opposed.

&n= bsp;

I = agree that it=92s time to finish this work.

&n= bsp;

&n= bsp;            = ;            &n= bsp;            = ;            &n= bsp;       -- Mike

&n= bsp;

From: Id-event <id-event-bounces@ietf.org&= gt; On Behalf Of Richard Backman, Annabelle
Sent: Thursday, July 2, 2020 4:00 PM
To: Yaron Sheffer <yaronf.ietf@gmail.com>; id-event@ietf.org Subject: Re: [Id-event] Closing the SecEvent working group

 

I=92d like to hea= r from the working group on whether or not there is interest in completing = the Subject Identifiers draft  within secevents. This work has more or= less been put on hiatus given the chairs=92 previous decision not to continue with it within the working group, but it= remains a dependency for other work, and a number of people within the wor= king group have expressed interest and support for it previously. If there = is support within the working group for resuming and completing Subject Identifiers, then it would seem reason= able to me to do so within secevents.

 

=96

Annabelle Backman (she/her)

AWS Identity

https://aws.amazon.com/identity/

 

 

From: Id-event <id-event-bounces@ietf.org> on behalf of Yaron = Sheffer <yaronf.ietf@gmail.com<= /a>>
Date: Tuesday, June 30, 2020 at 2:06 AM
To: "id-event@ietf.org= " <id-event@ietf.org> Subject: [EXTERNAL] [Id-event] Closing the SecEvent working group

 

CAUTION: This email originated from outside of the organiz= ation. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

 

Dear WG participants,

 

As you=92ve all seen, our last two deliverables, the SET HTTP del= ivery specs, have both been approved for publication as RFCs.

 

Since the group has now completed its mission, we propose to clos= e it down. Unless there are objections (accompanied by credible work items)= within a week, we will ask the AD to do just that. Even with the WG shut down, the mailing list will remain ope= n for relevant discussions.

 

We would like to thank the authors of the Push and Poll soon-to-b= e RFCs, Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to t= he many other working group members who contributed to these quality documents.

 

Regards,

 

           = ;     Dick and Yaron

--_000_DM6PR00MB0814AA4CF9918C13497B84DB956D0DM6PR00MB0814namp_-- From nobody Thu Jul 2 17:03:48 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 814623A0895 for ; Thu, 2 Jul 2020 17:03:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.795 X-Spam-Level: X-Spam-Status: No, score=-1.795 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=independentid-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id edB6dHczoJlF for ; Thu, 2 Jul 2020 17:03:45 -0700 (PDT) Received: from mail-pj1-x1035.google.com (mail-pj1-x1035.google.com [IPv6:2607:f8b0:4864:20::1035]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DABB3A0890 for ; Thu, 2 Jul 2020 17:03:45 -0700 (PDT) Received: by mail-pj1-x1035.google.com with SMTP id l6so10015888pjq.1 for ; Thu, 02 Jul 2020 17:03:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=independentid-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=vmbuncWBIyRrRYVuuK5B52FwgTdE6ie9qe7PFfLXGf4=; b=ySco1/So9E24WmagwaGTKNbt5QVUOmZpIEmD2QN6/yabhaY9+GZtZXaP81UkjXMbBl E9OH7SFmgAxPEWccMgmE8GkSASiL7WNbSE2Op67i5/8msjlYEkgVil6y6GQF5kQ3vBIU O8Le576sC3w/6dxoJYhGMc6fduqhQTA1Nj9p834WqKxyjJoL+APTWGFZdYFCJH6tdBIr nVpWBS28MdSnAIg/3qvWMSnB6zQfcguyJNUesUNG7J11h6MsgHjeDwHi8OAWsYP5YHzD iWW8XC4aFc/gdZa0VWfklpJTVjlO4Bzn7h+35Aj4JXT4CqiYpNHTn8HrlxvAD41YMgVD bshg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=vmbuncWBIyRrRYVuuK5B52FwgTdE6ie9qe7PFfLXGf4=; b=FOtz6QL5hp8quL7GLMaLBcd9pgDIr1bFcY5WQzKl6otuSsvW3wDdaE26iwfIa1czhP p9Gn387GkCOkjPBprXjFwdmJTa+sAT/So2g1DcA6gurXjDav0uCbBHvFFtJHk5USKboH /MpOiOKdeVXLAfkxoy5AgVxMuj2+tcX4PtM8fNQhzP36JPReDZDl8FAay+R2qI2KQ1zc MNcn7OHO0xka2iN8wOlNZToMo8UZRTI8m9YdzXglq4x2UTNk4CJW2Wxw5vV2ajMSJmlQ dJyQQ/G6H2fPkzGgHNNuqGOOlM1bgXFpGJ0m/OyeIyp0lxmxtSh7qMD99QbUHmMwyFY9 04KQ== X-Gm-Message-State: AOAM533neLlPtwDvl85RhU+tHOeKBY+2qtGrF077plP4b2z+T+AmYK80 T7iwxRhes2xP3xVl56Gvck3+WQ== X-Google-Smtp-Source: ABdhPJyLM8rHcCzKTjnkdWLvz3cCmUIjSbmWJsjsa2iPNSsWYS858Xq3yzAblPVaPHYizv1UMWynKw== X-Received: by 2002:a17:90a:db8a:: with SMTP id h10mr19491072pjv.197.1593734624709; Thu, 02 Jul 2020 17:03:44 -0700 (PDT) Received: from node-1w7jr9qrfoxx8tr4ob9woq6cj.ipv6.telus.net (node-1w7jr9qrfoxx8tr4ob9woq6cj.ipv6.telus.net. [2001:569:7a71:1d00:559a:ce71:71aa:8aa3]) by smtp.gmail.com with ESMTPSA id 6sm9708017pfi.170.2020.07.02.17.03.43 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 02 Jul 2020 17:03:44 -0700 (PDT) From: Phillip Hunt Message-Id: <697B0D79-63DC-41B4-A2B0-6F388003AFB2@independentid.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_D91250DA-C872-4F4B-938F-41379341121F" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Thu, 2 Jul 2020 17:03:43 -0700 In-Reply-To: Cc: "Richard Backman, Annabelle" , Yaron Sheffer , ID Events Mailing List , Mike Jones To: Tim Cappalli References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [Id-event] Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2020 00:03:48 -0000 --Apple-Mail=_D91250DA-C872-4F4B-938F-41379341121F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 +1 I would like to see this finished. Phillip Hunt phil.hunt@independentid.com > On Jul 2, 2020, at 4:38 PM, Tim Cappalli = wrote: >=20 > +1 >=20 > I would like to see https://tools.ietf.org/html/ = draft= -ietf-secevent-subject-identifiers = = finished in this group. >=20 > Tim > From: Id-event on behalf of Mike Jones = > Sent: Thursday, July 2, 2020 7:33:12 PM > To: Richard Backman, Annabelle ;= Yaron Sheffer ; id-event@ietf.org = > Subject: Re: [Id-event] Closing the SecEvent working group > =20 > Thanks for raising this point, Annabelle. > =20 > I support finishing = https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers = in this working = group. It=E2=80=99s an important specification and the right people to = provide actionable reviews are already in this working group. If this = moves elsewhere, it won=E2=80=99t get the same level of expert review = that it will here. > =20 > I=E2=80=99ll also note that at least seven people responded positively = to the WGLC and none opposed. > =20 > I agree that it=E2=80=99s time to finish this work. > =20 > -- Mike > =20 > From: Id-event On Behalf Of Richard = Backman, Annabelle > Sent: Thursday, July 2, 2020 4:00 PM > To: Yaron Sheffer ; id-event@ietf.org > Subject: Re: [Id-event] Closing the SecEvent working group > =20 > I=E2=80=99d like to hear from the working group on whether or not = there is interest in completing the Subject Identifiers draft within = secevents. This work has more or less been put on hiatus given the = chairs=E2=80=99 previous decision not to continue with it within the = working group, but it remains a dependency for other work, and a number = of people within the working group have expressed interest and support = for it previously. If there is support within the working group for = resuming and completing Subject Identifiers, then it would seem = reasonable to me to do so within secevents. > =20 > =E2=80=93 > Annabelle Backman (she/her) > AWS Identity > https://aws.amazon.com/identity/ = > =20 > =20 > From: Id-event > on behalf of Yaron Sheffer = > > Date: Tuesday, June 30, 2020 at 2:06 AM > To: "id-event@ietf.org " > > Subject: [EXTERNAL] [Id-event] Closing the SecEvent working group > =20 > CAUTION: This email originated from outside of the organization. Do = not click links or open attachments unless you can confirm the sender = and know the content is safe. >=20 > =20 > Dear WG participants, > =20 > As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP = delivery specs, have both been approved for publication as RFCs. > =20 > Since the group has now completed its mission, we propose to close it = down. Unless there are objections (accompanied by credible work items) = within a week, we will ask the AD to do just that. Even with the WG shut = down, the mailing list will remain open for relevant discussions. > =20 > We would like to thank the authors of the Push and Poll soon-to-be = RFCs, Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to = the many other working group members who contributed to these quality = documents. > =20 > Regards, > =20 > Dick and Yaron > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_D91250DA-C872-4F4B-938F-41379341121F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 +1 = I would like to see this finished.

Phillip Hunt



On Jul 2, 2020, at 4:38 PM, Tim Cappalli <Tim.Cappalli=3D40microsoft.com@dmarc.ietf.org> = wrote:

+1

I would like to see https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers finished in this group.

Tim
From: Id-event <id-event-bounces@ietf.org> on behalf of Mike Jones = <Michael.Jones=3D40microsoft.com@dmarc.ietf.org>
Sent: Thursday, July 2, 2020 = 7:33:12 PM
To: Richard Backman, Annabelle = <richanna=3D40amazon.com@dmarc.ietf.org>; Yaron Sheffer = <yaronf.ietf@gmail.com>; id-event@ietf.org = <id-event@ietf.org>
Subject: Re: [Id-event] Closing the = SecEvent working group
 
Thanks for raising this point, = Annabelle.

 

I support finishing https://tools.ietf.org/html/draft-ietf-secevent-subject-identif= iers in this = working group.  It=E2=80=99s an important specification and the = right people to provide actionable reviews are already in this working = group.  If this moves elsewhere, it won=E2=80=99t get the same = level of expert review that it will here.

 

I=E2=80=99ll = also note that at least seven people responded positively to the WGLC = and none opposed.

 

I agree that it=E2=80=99s time = to finish this work.

 

          &nb= sp;            = ;            &= nbsp;           &nb= sp;          -- = Mike

 

From: Id-event = <id-event-bounces@ietf.org> On Behalf = Of Richard = Backman, Annabelle
Sent: Thursday, July 2, 2020 4:00 = PM
To: Yaron Sheffer <yaronf.ietf@gmail.com>; id-event@ietf.org
Subject: Re: [Id-event] Closing the = SecEvent working group

 

I=E2=80=99d like to hear from the working group on = whether or not there is interest in completing the Subject Identifiers = draft  within secevents. This work has more or less been put on = hiatus given the chairs=E2=80=99 previous decision not to continue with = it within the working group, but it remains a dependency for other work, = and a number of people within the working group have expressed interest = and support for it previously. If there is support within the working = group for resuming and completing Subject Identifiers, then it would = seem reasonable to me to do so within secevents.

 

=E2=80=93
Annabelle Backman = (she/her)
AWS Identity
https://aws.amazon.com/identity/

 

 

From: Id-event <id-event-bounces@ietf.org> on behalf of Yaron Sheffer = <yaronf.ietf@gmail.com>
Date: Tuesday, June 30, 2020 = at 2:06 AM
To: "id-event@ietf.org" <id-event@ietf.org>
Subject: [EXTERNAL] [Id-event] = Closing the SecEvent working group

 

CAUTION: This email originated from outside of = the organization. Do not click links or open attachments unless you can = confirm the sender and know the content is = safe.

 

Dear WG = participants,

 

As you=E2=80=99ve all seen, our = last two deliverables, the SET HTTP delivery specs, have both been = approved for publication as RFCs.

 

Since the group has now completed = its mission, we propose to close it down. Unless there are objections = (accompanied by credible work items) within a week, we will ask the AD = to do just that. Even with the WG shut down, the mailing list will = remain open for relevant discussions.

 

We would like to thank the authors = of the Push and Poll soon-to-be RFCs, Annabelle, Mike, Marius, Morteza = and Anthony. Many thanks also to the many other working group members = who contributed to these quality documents.

 

Regards,

 

          &nb= sp;     Dick and = Yaron
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
=

= --Apple-Mail=_D91250DA-C872-4F4B-938F-41379341121F-- From nobody Thu Jul 2 19:29:12 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8464E3A0B39 for ; Thu, 2 Jul 2020 19:29:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.995 X-Spam-Level: X-Spam-Status: No, score=-1.995 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=verizonwireless.com header.b=FcCIA5aR; dkim=pass (2048-bit key) header.d=verizonwireless-com.20150623.gappssmtp.com header.b=l00JVukd Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7SwdXzQBhtto for ; Thu, 2 Jul 2020 19:29:09 -0700 (PDT) Received: from mx0b-0024a201.pphosted.com (mx0b-0024a201.pphosted.com [148.163.153.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DACA13A0B3A for ; Thu, 2 Jul 2020 19:29:08 -0700 (PDT) Received: from pps.filterd (m0098282.ppops.net [127.0.0.1]) by mx0a-0024a201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0632QbhM091081 for ; Thu, 2 Jul 2020 22:29:08 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verizonwireless.com; h=from : mime-version : references : in-reply-to : date : message-id : subject : to : cc : content-type; s=prodmail; bh=wndgqUi0CGFMY2UQgaDnklS+rVD2E7jNEU4pPygmquM=; b=FcCIA5aRnyQ/CZ+FhLiJSeMChRN/jKIjRjrelkt+xrQLQCJhA2SVTcf7SxSKY683+4aW u7BARLut7kEhplsEKbiy9MnOAd2ukYP4+XOb5Lo46UxwSfFg/zicavo36xTdtDrkwJHl /LaBFxoFZPU70maCGJ1ccMeDpp9H5Xws/To= Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) by mx0a-0024a201.pphosted.com with ESMTP id 320qpyxvaf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Thu, 02 Jul 2020 22:29:07 -0400 Received: by mail-pj1-f71.google.com with SMTP id t12so20165977pju.8 for ; Thu, 02 Jul 2020 19:29:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verizonwireless-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:references:in-reply-to:date:message-id:subject:to :cc; bh=wndgqUi0CGFMY2UQgaDnklS+rVD2E7jNEU4pPygmquM=; b=l00JVukdfgRujAwoCXkLeIsvsJ6YzQFSIhUsBRicoy8iWN+RB31RMmOLuwvqaScA0h GMF+KaE0BzXO5N1guPbCQ/qloVzpkdJnjlMaoX4ZmTvqKYi8P3qSg8v2tXQNIk6VS2Vk zCAOPxCWEQiVgh37jxHNvRuft7VMXZjsAJO6JP1PZ2hAhXmT4oAwi94dACiC/DzudOlw W8Yz+pk2vq8i3qv6HAwE9YsGbSO9PSZjGeWx/prVsL86JJzBu0qO98UzKA+ycmIK5sQN X3MsDjHBNf3aPC0h4qUnLvlBkSiCx1i52WzTYnk33dDsxknstXIXs5FEkidwGuJbHOVj gR8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:references:in-reply-to:date :message-id:subject:to:cc; bh=wndgqUi0CGFMY2UQgaDnklS+rVD2E7jNEU4pPygmquM=; b=gPPGeYk2wQajNYlFZ6gmr7SXcd+eBpHCQSAvH+xu6/zZ962q+Nhxa/rQcvHkkvaDX7 EHp2rb0WfGC7mtUMptSGrhAc9RAovJOsIEsS30hb0mqSw9pizmfpRubGyv+eSIPRl0DE pnGJuNgjxRuid18Ef1QkYLCWk4oQBUbOTn15/3GlCVTDVH7VuYQBQbd6Ddr+wCk01FIt hkZzwgn+5XrmFLekxzLoyFgGRcG7bgYfOwRGZ1pOMiLKCeJEhZNfvkCmcEbup4E9TwI/ qg9Z89s9V+sDLA/DSgG2yjLk4AXX+OUWf5na0yAn/TfP3I+smq8U4vgiy7NxpoE3nTEl it1Q== X-Gm-Message-State: AOAM533YGk7TD5Hd0hGwie1jpwfyPRuo5wl/oO+OkwdFGmFF26RVcd2+ lYcUpeGBoEsKYS18EwmE6v6n9t9nlw8VIhYVG46b2EVP4TIvAa4cdlzeiWlvE/GPdJm3PbKP3A5 ZdMvYX5QqXGlKuSu5vKPks0VzIQ== X-Received: by 2002:a63:80c8:: with SMTP id j191mr25872380pgd.38.1593743346048; Thu, 02 Jul 2020 19:29:06 -0700 (PDT) X-Google-Smtp-Source: ABdhPJw0UexNv+8JIsQ42s9WZyIM4mZqbF4fWnYvm5/OY4A/7HaiWDro+OOhI0OMTOpq3cgi24Y9d9pqsP5w3Ovr7LE= X-Received: by 2002:a63:80c8:: with SMTP id j191mr25872349pgd.38.1593743345208; Thu, 02 Jul 2020 19:29:05 -0700 (PDT) Received: from unknown named unknown by gmailapi.google.com with HTTPREST; Thu, 2 Jul 2020 22:29:04 -0400 From: Bjorn Hjelm Mime-Version: 1.0 (1.0) References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> In-Reply-To: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> Date: Thu, 2 Jul 2020 22:29:04 -0400 Message-ID: To: "Richard Backman, Annabelle" Cc: Yaron Sheffer , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f4658405a98049ec" X-mailroute: internal X-Proofpoint-Spam-Details: rule=out_spam_notspam policy=out_spam score=0 suspectscore=0 clxscore=1011 cotscore=-2147483648 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 mlxlogscore=999 phishscore=0 lowpriorityscore=0 spamscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2007030015 Archived-At: Subject: Re: [Id-event] [E] Re: Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2020 02:29:11 -0000 --000000000000f4658405a98049ec Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Annabelle, I would like to see this work being completed. BR, Bjorn On Jul 2, 2020, at 3:59 PM, Richard Backman, Annabelle wrote: =EF=BB=BF I=E2=80=99d like to hear from the working group on whether or not there is = interest in completing the Subject Identifiers draft within secevents. This work has more or less been put on hiatus given the chairs=E2=80=99 previous deci= sion not to continue with it within the working group, but it remains a dependency for other work, and a number of people within the working group have expressed interest and support for it previously. If there is support within the working group for resuming and completing Subject Identifiers, then it would seem reasonable to me to do so within secevents. =E2=80=93 Annabelle Backman (she/her) AWS Identity https://aws.amazon.com/identity/ *From: *Id-event on behalf of Yaron Sheffer < yaronf.ietf@gmail.com> *Date: *Tuesday, June 30, 2020 at 2:06 AM *To: *"id-event@ietf.org" *Subject: *[EXTERNAL] [Id-event] Closing the SecEvent working group *CAUTION*: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. Dear WG participants, As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP deliver= y specs, have both been approved for publication as RFCs. Since the group has now completed its mission, we propose to close it down. Unless there are objections (accompanied by credible work items) within a week, we will ask the AD to do just that. Even with the WG shut down, the mailing list will remain open for relevant discussions. We would like to thank the authors of the Push and Poll soon-to-be RFCs, Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to the many other working group members who contributed to these quality documents. Regards, Dick and Yaron _______________________________________________ Id-event mailing list Id-event@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_id-2Devent&d=3DDwICAg&c=3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0Po= mBTQ&r=3DNMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=3DJdLD0MPKiH-cnYaRWq= 00dc9RaqFuwKAR2s9Y6qctmCY&s=3DruzxNhwgDEh8N2N1ayOzTrCx8t1W3gLrz39-Jny_mhc&e= =3D --000000000000f4658405a98049ec Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Annabelle,
I would like to see this= work being completed.

BR,
Bjorn

On Jul 2, 2020, at 3:59 PM, Ric= hard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org> wrote:

<= /div>
=EF=BB=BF

I=E2=80=99d like to= hear from the working group on whether or not there is interest in complet= ing the Subject Identifiers draft=C2=A0 within secevents. This work has mor= e or less been put on hiatus given the chairs=E2=80=99 previous decision not to continue with it within the working group, but it remains = a dependency for other work, and a number of people within the working grou= p have expressed interest and support for it previously. If there is suppor= t within the working group for resuming and completing Subject Identifiers, then it would seem reasonable to me to= do so within secevents.

=C2=A0

=E2=80=93

Annabelle Backman (she/her)

AWS Identity

https://aws.amazon.com/identity/

=C2=A0

=C2=A0

From: Id-event <id-event-bounces@ietf.org> on behalf of Yaron Sheffer= <yaronf.ietf@gmail.com>=
Date: Tuesday, June 30, 2020 at 2:06 AM
To: "id-event@ietf.org= " <id-event@ietf.org> Subject: [EXTERNAL] [Id-event] Closing the SecEvent working group

=C2=A0

CAUTION: This email originated from outside of the organizati= on. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

=C2=A0

Dear WG participants,

=C2=A0

As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP= delivery specs, have both been approved for publication as RFCs.

=C2=A0

Since the group has now completed its mission, we propose to close = it down. Unless there are objections (accompanied by credible work items) w= ithin a week, we will ask the AD to do just that. Even with the WG shut down, the mailing list will remain open f= or relevant discussions.

=C2=A0

We would like to thank the authors of the Push and Poll soon-to-be = RFCs, Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to the= many other working group members who contributed to these quality documents.

=C2=A0

Regards,

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 Dick and Yaron

_______________________________________________
Id-ev= ent mailing list
Id-ev= ent@ietf.org
ht= tps://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_l= istinfo_id-2Devent&d=3DDwICAg&c=3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb= 6__0PomBTQ&r=3DNMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=3DJdLD= 0MPKiH-cnYaRWq00dc9RaqFuwKAR2s9Y6qctmCY&s=3DruzxNhwgDEh8N2N1ayOzTrCx8t1= W3gLrz39-Jny_mhc&e=3D
--000000000000f4658405a98049ec-- From nobody Fri Jul 3 02:47:43 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71D3C3A0B84 for ; Fri, 3 Jul 2020 02:47:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pA6U4jlKZF1j for ; Fri, 3 Jul 2020 02:47:39 -0700 (PDT) Received: from mail-wr1-x431.google.com (mail-wr1-x431.google.com [IPv6:2a00:1450:4864:20::431]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84ECE3A0B82 for ; Fri, 3 Jul 2020 02:47:39 -0700 (PDT) Received: by mail-wr1-x431.google.com with SMTP id f2so4018089wrp.7 for ; Fri, 03 Jul 2020 02:47:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version; bh=3Mrp5Gcl434HNqE76GvI2HIIyZDX/SIA4PWe+Q4JFhg=; b=o9O797ePruoQNWI1D9DhdvIcq9iEdi3aA5yl0QcKUKwrQRaFzZTDVD99Ld00QXadou Q+AQESMJx2YN4w07i/EBmQEj6TH6SlZei1Pj34OlQNtRnkDHA5vlvyqL8Uiyv4061veD FR6m0Felb7iqeYPlJeJVv7RS/LxUlAqzOh7XqLS/0AUG/83+1cq0JmG0gZY4bvYNRIX0 4sby+1kg0LIa54KwpMo6CYgeC7976MGMnnV3SH2zP6H403n/I5x7+04644apIsIQU9D6 bVCR/nLfkICSD6sH6YGUOAq8gWXfhVfa0qA/UtH5Y4JePmcXVF4iEuFwiuKIZeugyvNz /KSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version; bh=3Mrp5Gcl434HNqE76GvI2HIIyZDX/SIA4PWe+Q4JFhg=; b=S0iMj6DIerZjXU3i4A1LLq4ExcGdrBHv26EpJYGk4KMsvG47YT/uhlsiG/mdsgURRw uLkxiB4CR/GSYt2N+VmNWmb9bqvTFIxiaLvIMeDemlHK34z58Q36VzpWKuDTNORb6hOi xhpIAZjaBA2KiKMOx0nxn788YcilnH+kV044hzZFMXyGNoGxgIceI9yHtml/tYDcIP6C X6p3+YtKWQgEEirnPRI5geZQZWhquO/AhLu3/c7EgDnEAu1J6gbs/0020MNr8VvmsYGY eljeTs2hpPVSsi0GutlVoxtb9eLd+Kb3M8pm29dLvMRAz4wwkOxNkV+2Dy7ZQqPmsb00 fsHg== X-Gm-Message-State: AOAM531k150ZxncGdeyO74TIAcXwg6FKDHjkZ1Qu5/imjTnE4daipxv/ /Rkwsg4I6GHj/G8hC+bpQ7w= X-Google-Smtp-Source: ABdhPJxsYc9pPZlKHXFoecfqScU3OoxKgmKayvDWHDNI96PS6bJGbqSdKp4AtrHOyPMUHZ7AYwlctQ== X-Received: by 2002:adf:b608:: with SMTP id f8mr38868475wre.363.1593769657901; Fri, 03 Jul 2020 02:47:37 -0700 (PDT) Received: from [172.26.61.225] (pub-corp-42-8.intuit.com. [91.102.42.8]) by smtp.gmail.com with ESMTPSA id u8sm12969657wrt.28.2020.07.03.02.47.36 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 03 Jul 2020 02:47:37 -0700 (PDT) User-Agent: Microsoft-MacOutlook/16.38.20061401 Date: Fri, 03 Jul 2020 12:47:35 +0300 From: Yaron Sheffer To: Bjorn Hjelm , "Richard Backman, Annabelle" CC: "id-event@ietf.org" Message-ID: <4B017BF4-B56F-462F-8C61-1D942E145244@gmail.com> Thread-Topic: [E] Re: [Id-event] Closing the SecEvent working group References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3676625256_211134282" Archived-At: Subject: Re: [Id-event] [E] Re: Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2020 09:47:41 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3676625256_211134282 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Sorry folks. We decided that this draft does not have WG support back in Au= gust, because it clearly did not have such support. Yes there are obviously = people who want to see it published as an RFC. But not enough for any meanin= gful discussion during the WG last call (or even a positive response before = the WGLC expired, we had exactly one). Nor any discussion since then. Nor a = new draft version published since late July 2019. =20 Let me remind the group that the IETF offers two alternatives for publicati= on, either AD-sponsored or through the ISE. =20 Thanks, =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron =20 From: Bjorn Hjelm Date: Friday, July 3, 2020 at 05:29 To: "Richard Backman, Annabelle" Cc: Yaron Sheffer , "id-event@ietf.org" Subject: Re: [E] Re: [Id-event] Closing the SecEvent working group =20 Annabelle, I would like to see this work being completed. BR, Bjorn On Jul 2, 2020, at 3:59 PM, Richard Backman, Annabelle wrote: =EF=BB=BF=20 I=E2=80=99d like to hear from the working group on whether or not there is intere= st in completing the Subject Identifiers draft within secevents. This work = has more or less been put on hiatus given the chairs=E2=80=99 previous decision no= t to continue with it within the working group, but it remains a dependency = for other work, and a number of people within the working group have express= ed interest and support for it previously. If there is support within the wo= rking group for resuming and completing Subject Identifiers, then it would s= eem reasonable to me to do so within secevents. =20 =E2=80=93 Annabelle Backman (she/her) AWS Identity https://aws.amazon.com/identity/ =20 =20 From: Id-event on behalf of Yaron Sheffer Date: Tuesday, June 30, 2020 at 2:06 AM To: "id-event@ietf.org" Subject: [EXTERNAL] [Id-event] Closing the SecEvent working group =20 CAUTION: This email originated from outside of the organization. Do not cli= ck links or open attachments unless you can confirm the sender and know the = content is safe. =20 Dear WG participants, =20 As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP delivery spec= s, have both been approved for publication as RFCs. =20 Since the group has now completed its mission, we propose to close it down.= Unless there are objections (accompanied by credible work items) within a w= eek, we will ask the AD to do just that. Even with the WG shut down, the mai= ling list will remain open for relevant discussions. =20 We would like to thank the authors of the Push and Poll soon-to-be RFCs, An= nabelle, Mike, Marius, Morteza and Anthony. Many thanks also to the many oth= er working group members who contributed to these quality documents. =20 Regards, =20 Dick and Yaron _______________________________________________ Id-event mailing list Id-event@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_l= istinfo_id-2Devent&d=3DDwICAg&c=3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=3D= NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=3DJdLD0MPKiH-cnYaRWq00dc9RaqFuwK= AR2s9Y6qctmCY&s=3DruzxNhwgDEh8N2N1ayOzTrCx8t1W3gLrz39-Jny_mhc&e=3D=20 --B_3676625256_211134282 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Sorry folks. We dec= ided that this draft does not have WG support back in August, because it cle= arly did not have such support. Yes there are obviously people who want to s= ee it published as an RFC. But not enough for any meaningful discussion duri= ng the WG last call (or even a positive response before the WGLC expired, we= had exactly one). Nor any discussion since then. Nor a new draft version pu= blished since late July 2019.

 

Let me remind the group that the IETF offers two = alternatives for publication, either AD-sponsored or through the ISE.

 =

Thanks,

=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

 

From: B= jorn Hjelm <bjorn.hjelm@verizonwireless.com>
Date: Friday, J= uly 3, 2020 at 05:29
To: "Richard Backman, Annabelle" &l= t;richanna=3D40amazon.com@dmarc.ietf.org>
Cc: Yaron Sheffer <y= aronf.ietf@gmail.com>, "id-event@ietf.org" <id-event@ietf.or= g>
Subject: Re: [E] Re: [Id-event] Closing the SecEvent working= group

 

Annabelle,=

I would = like to see this work being completed.

BR,

Bjorn

<= div>



O= n Jul 2, 2020, at 3:59 PM, Richard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org> wrot= e:

=EF=BB=BF =

I=E2=80=99= d like to hear from the working group on whether or not there is interest in= completing the Subject Identifiers draft  within secevents. This work = has more or less been put on hiatus given the chairs=E2=80=99 previous decision no= t to continue with it within the working group, but it remains a dependency = for other work, and a number of people within the working group have express= ed interest and support for it previously. If there is support within the wo= rking group for resuming and completing Subject Identifiers, then it would s= eem reasonable to me to do so within secevents.

 

=

=E2=80=93

Annabelle Backman (s= he/her)

AWS Identity

https://aws.amazon.com/identity/<= /span>

 

 

From: Id-event <id-event-bounce= s@ietf.org> on behalf of Yaron Sheffer <yaronf.ietf@gmail.com>
Date: Tuesday, June 30,= 2020 at 2:06 AM
To: "id-e= vent@ietf.org" <id-event@ietf= .org>
Subject: [EXTERNAL] [Id-event] Closing the SecEvent w= orking group

 

CAUTIO= N: This email o= riginated from outside of the organization. Do not click links or open attac= hments unless you can confirm the sender and know the content is safe.

 

Dear WG par= ticipants,

=  

As you=E2=80=99ve all seen, our last two deliverables, the SET= HTTP delivery specs, have both been approved for publication as RFCs.

 

Since the group has now completed = its mission, we propose to close it down. Unless there are objections (accom= panied by credible work items) within a week, we will ask the AD to do just = that. Even with the WG shut down, the mailing list will remain open for rele= vant discussions.

 

We would li= ke to thank the authors of the Push and Poll soon-to-be RFCs, Annabelle, Mik= e, Marius, Morteza and Anthony. Many thanks also to the many other working g= roup members who contributed to these quality documents.

 

Regards,

 <= /o:p>

           &n= bsp;    Dick and Yaron

_____________________________________= __________
Id-event mailing list
Id= -event@ietf.org
https://urldefense.proofpoint.com= /v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&am= p;c=3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=3DNMZJHCV8pjvGIH2fTx9z6l= 7g7-V-a2xW7ISf9uHdz0A&m=3DJdLD0MPKiH-cnYaRWq00dc9RaqFuwKAR2s9Y6qctmCY&= s=3DruzxNhwgDEh8N2N1ayOzTrCx8t1W3gLrz39-Jny_mhc&e=3D <= /p>

--B_3676625256_211134282-- From nobody Fri Jul 3 10:07:14 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5D1F3A0A0B for ; Fri, 3 Jul 2020 10:07:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aCIlt4o7Lbuv for ; Fri, 3 Jul 2020 10:07:11 -0700 (PDT) Received: from mail-yb1-xb2d.google.com (mail-yb1-xb2d.google.com [IPv6:2607:f8b0:4864:20::b2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D47D93A0A09 for ; Fri, 3 Jul 2020 10:07:10 -0700 (PDT) Received: by mail-yb1-xb2d.google.com with SMTP id x9so2915757ybd.4 for ; Fri, 03 Jul 2020 10:07:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2ensOi2R8FrQ4vYK9ZDxRV+jnZ78d+3umklYhoDJVyg=; b=dwtbzehmtWNnoWcpU0+AeRjV+sqIfmGmG7RJCSnKrB0oDzfO9D4fTUoiJzpVcAUNy/ K2vZbK+X91Jwq7tBMGYJ8iRWGunowho/3ch8NYJiP2MADSCP2zW6ytmIMhWTFDR9nCTq wHkdW3ar7LwGWON6hV+rNQdj28HvCZlFkmfp/Y3+JqKgG+sbLIYgWQHcacRv1dBwR45y xH9yAYc2Q1Dsu1s7c0gRuA1nWWYt54h59Q7UWa+pquKJxSlropykRKxbMKFB13fFK7jg oU91LQwCayfq6dniMjy/3GgbCFBb58M4SsIyirKQN1JBDHGIsmT3sVDxEj5jwTmfz7V9 E7bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2ensOi2R8FrQ4vYK9ZDxRV+jnZ78d+3umklYhoDJVyg=; b=s2FOYDgpRYI+Cz1bJNIifkxrxlVDtb6fP61ZxGOMC3SfOc/uoXR4dwtXuANNYS/+KI ea2/jsZ+RV4CGPqeWt/jGLfOqQ5sYSiONP71P3DaHFOdhgu3RKaUf9boZk2bLQWmFtdY I6Nfzebb/o9Dw5DLt7roQLD0EG1vinEGvx8LAzqieUM/FCUGLV42EgRtM+79iJ5dh+Ti 35AzE8JjCn+SyB92EY7kmfGaGK6c03dWhdTPpuIdp/tgMVItyn2ZPnTqnWOJOxaXJ5NG 3mzlLSC5kgh/MZyXT9OV7yQ6iwML6eidQSA7ZUNOTKSDgdS/tA1yvOY3QlOZ17XFr06h eFrA== X-Gm-Message-State: AOAM532F6thGf5dpNPezG2+1HcUi1QFf4WP3EJ34vkoUzVwkfRf3As9V KOrU1x8pRhvRAuzTEONnvFGXkSsxVK/ffh4d5jAheA== X-Google-Smtp-Source: ABdhPJwjx9efPoGGdlCUXgeXWd2nDbzhkwMWauwU69gL9Vl6aZChrIncvZlDbDjyLLXnDl336bb/pciLZkmfz1onyyM= X-Received: by 2002:a25:2805:: with SMTP id o5mr11139797ybo.97.1593796029459; Fri, 03 Jul 2020 10:07:09 -0700 (PDT) MIME-Version: 1.0 References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> <4B017BF4-B56F-462F-8C61-1D942E145244@gmail.com> In-Reply-To: <4B017BF4-B56F-462F-8C61-1D942E145244@gmail.com> From: Atul Tulshibagwale Date: Fri, 3 Jul 2020 10:06:57 -0700 Message-ID: To: Yaron Sheffer Cc: Bjorn Hjelm , "Richard Backman, Annabelle" , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="0000000000002ecdcd05a98c8e12" Archived-At: Subject: Re: [Id-event] [E] Re: Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2020 17:07:13 -0000 --0000000000002ecdcd05a98c8e12 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I would also like this work to be completed. We're working on subject-type changes in the SSE spec, so those can be incorporated into this spec. I'm happy to do this work within the SecEvents group. Thanks, Atul On Fri, Jul 3, 2020 at 2:47 AM Yaron Sheffer wrote: > Sorry folks. We decided that this draft does not have WG support back in > August, because it clearly did not have such support. Yes there are > obviously people who want to see it published as an RFC. But not enough f= or > any meaningful discussion during the WG last call (or even a positive > response before the WGLC expired, we had exactly one). Nor any discussion > since then. Nor a new draft version published since late July 2019. > > > > Let me remind the group that the IETF offers two alternatives for > publication, either AD-sponsored or through the ISE. > > > > Thanks, > > Yaron > > > > *From: *Bjorn Hjelm > *Date: *Friday, July 3, 2020 at 05:29 > *To: *"Richard Backman, Annabelle" > *Cc: *Yaron Sheffer , "id-event@ietf.org" < > id-event@ietf.org> > *Subject: *Re: [E] Re: [Id-event] Closing the SecEvent working group > > > > Annabelle, > > I would like to see this work being completed. > > BR, > > Bjorn > > > > On Jul 2, 2020, at 3:59 PM, Richard Backman, Annabelle 40amazon.com@dmarc.ietf.org> wrote: > > =EF=BB=BF > > I=E2=80=99d like to hear from the working group on whether or not there i= s > interest in completing the Subject Identifiers draft within secevents. > This work has more or less been put on hiatus given the chairs=E2=80=99 p= revious > decision not to continue with it within the working group, but it remains= a > dependency for other work, and a number of people within the working grou= p > have expressed interest and support for it previously. If there is suppor= t > within the working group for resuming and completing Subject Identifiers, > then it would seem reasonable to me to do so within secevents. > > > > =E2=80=93 > > Annabelle Backman (she/her) > > AWS Identity > > https://aws.amazon.com/identity/ > > > > > > > *From: *Id-event on behalf of Yaron Sheffer < > yaronf.ietf@gmail.com> > *Date: *Tuesday, June 30, 2020 at 2:06 AM > *To: *"id-event@ietf.org" > > *Subject: *[EXTERNAL] [Id-event] Closing the SecEvent working group > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and kno= w > the content is safe. > > > > Dear WG participants, > > > > As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP deliv= ery > specs, have both been approved for publication as RFCs. > > > > Since the group has now completed its mission, we propose to close it > down. Unless there are objections (accompanied by credible work items) > within a week, we will ask the AD to do just that. Even with the WG shut > down, the mailing list will remain open for relevant discussions. > > > > We would like to thank the authors of the Push and Poll soon-to-be RFCs, > Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to the man= y > other working group members who contributed to these quality documents. > > > > Regards, > > > > Dick and Yaron > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailm= an_listinfo_id-2Devent&d=3DDwICAg&c=3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0= PomBTQ&r=3DNMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=3DJdLD0MPKiH-cnYaR= Wq00dc9RaqFuwKAR2s9Y6qctmCY&s=3DruzxNhwgDEh8N2N1ayOzTrCx8t1W3gLrz39-Jny_mhc= &e=3D > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --0000000000002ecdcd05a98c8e12 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I would also like this work to be completed. We're wor= king on subject-type changes in the SSE spec, so those can be incorporated = into this spec.

I'm happy to do this work within the= SecEvents group.

Thanks,
Atul


On Fri, Jul 3, 2020 at 2:47 AM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

Sorry folks. We decided = that this draft does not have WG support back in August, because it clearly= did not have such support. Yes there are obviously people who want to see = it published as an RFC. But not enough for any meaningful discussion during= the WG last call (or even a positive response before the WGLC expired, we = had exactly one). Nor any discussion since then. Nor a new draft version pu= blished since late July 2019.

=C2=A0

Let me remind the group that the= IETF offers two alternatives for publication, either AD-sponsored or throu= gh the ISE.

=C2=A0

Thanks,

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

=C2=A0<= u>

From: Bjorn Hjelm <bjorn.hjelm@verizonwireless.com>
D= ate: Friday, July 3, 2020 at 05:29
To: "Richard Backman,= Annabelle" <richanna=3D40amazon.com@dmarc.ietf.org>
Cc: Yar= on Sheffer <y= aronf.ietf@gmail.com>, "id-event@ietf.org" <id-event@ietf.org>
Subject: Re= : [E] Re: [Id-event] Closing the SecEvent working group

=C2=A0

Annabelle,=

I would li= ke to see this work being completed.

BR,

Bjorn=



On Jul 2, 2020, at 3:59 PM, Richard Backman, Ann= abelle <richanna=3D40amazon.com@dmarc.ietf.org> wrote:

=EF=BB=BF =

I=E2= =80=99d like to hear from the working group on whether or not there is inte= rest in completing the Subject Identifiers draft=C2=A0 within secevents. Th= is work has more or less been put on hiatus given the chairs=E2=80=99 previ= ous decision not to continue with it within the working group, but it remai= ns a dependency for other work, and a number of people within the working g= roup have expressed interest and support for it previously. If there is sup= port within the working group for resuming and completing Subject Identifie= rs, then it would seem reasonable to me to do so within secevents.

=C2= =A0

=E2=80=93=

Annabelle Backman (she/her)

AWS Identity

https://aws.amazon.com/identity/

=C2=A0=

=C2=A0=

From: Id-event <id-event-bounces@ietf.org> on behalf of Yaron Sheffer <yaronf.ietf@gmail.com>
Date: Tuesday= , June 30, 2020 at 2:06 AM
To: "id-event@ietf.org" <id-event@ietf..org>
Sub= ject: [EXTERNAL] [Id-event] Closing the SecEvent working group

=C2=A0

CAUTION: This email originated from outside of the organizat= ion. Do not click links or open attachments unless you can confirm the send= er and know the content is safe.

=

=C2=A0

Dear WG participa= nts,

=C2=A0

As you=E2=80=99ve all seen, our last tw= o deliverables, the SET HTTP delivery specs, have both been approved for pu= blication as RFCs.

=C2=A0

Since the group has now completed its mission, we propose to c= lose it down. Unless there are objections (accompanied by credible work ite= ms) within a week, we will ask the AD to do just that. Even with the WG shu= t down, the mailing list will remain open for relevant discussions.<= u>

=C2=A0

We would like= to thank the authors of the Push and Poll soon-to-be RFCs, Annabelle, Mike= , Marius, Morteza and Anthony. Many thanks also to the many other working g= roup members who contributed to these quality documents.

=C2=A0

Regards,

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Dick = and Yaron

_______________________________________________
Id-e= vent mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.or= g_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DudBTRvFvXC5Dhqg7UHpJlP= ps3mZ3LRxpb6__0PomBTQ&r=3DNMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&a= mp;m=3DJdLD0MPKiH-cnYaRWq00dc9RaqFuwKAR2s9Y6qctmCY&s=3DruzxNhwgDEh8N2N1= ayOzTrCx8t1W3gLrz39-Jny_mhc&e=3D

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--0000000000002ecdcd05a98c8e12-- From nobody Mon Jul 6 10:01:03 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 085703A09BE for ; Mon, 6 Jul 2020 10:01:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id niox-mLWcXnl for ; Mon, 6 Jul 2020 10:00:59 -0700 (PDT) Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09F393A171B for ; Mon, 6 Jul 2020 10:00:59 -0700 (PDT) Received: by mail-lj1-x229.google.com with SMTP id z24so21386777ljn.8 for ; Mon, 06 Jul 2020 10:00:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4+36a1JWj84CJSubjWNiG4uhs3aBZkT40LOw9eifauE=; b=WyEU/43erckwuiCHkQ6szPTPamzYdQEdql92K8fGatmMYWAzK5xVUjFeWl6mUBHlyK 7XcMtv4cs8pPiziEA+WX21KuJNu5bnJ/Wa2nC1TLvAjtxtIV/DFzEUagAoooUA0N8CH3 MkgE6FU9LuwIygFsQTaJ1x0HM+K1JXwv0PGSd2+rxVo7ID+dXMraotdpvIcOb4/nOs9d l8ZnlLBpTGqo+YHde0K068V0MwH6hNO+FOwWtduoEnYAM+5DIh4Jt6M8r+GujhCRUc89 WUlVPWCGV9khA2c5gwLxY8z63W90UxKq4VbEYong/P93G9oqefQuRosi8pVxtZW5KRh9 ZVuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4+36a1JWj84CJSubjWNiG4uhs3aBZkT40LOw9eifauE=; b=Wbzg1DD2kH1GJtW2/uWssSWbwMEytTElo9Rg2Qkdj5JSXdSeynau5XWnfYaP0P43t7 Mq0iBj2LPgiZS8OpFvD8lOytDGoXXc8Ln00YGRfPPCP72CI67KHCGbdWSYmqPPUBH0or 6Z/kT2cTGSKQrZu1+7bBLV2BfzBCa0X6qSAe2oUCBH9BN9ZqN9uKEp5Rsg73+fCaQomc 2xBSLF5Qb7Xwz5376V4pLGTOD/GAOA74mDo6HPTEBNK1mt5XK/fKvlO/pp2fpSCLWPhB tE1qQdn8fkTZHTNLPhSL0Et5JBh/esrjwGKjcpZoKucbhpRwWNh30kITov9xs7Sbowld qx2g== X-Gm-Message-State: AOAM532HpIrPiANksuTpYdX/c1VrqhPRXjhlK8lvnaddTWMeLEL1WPZy 6+jG2c92pJA/NqFp7MBCFL96QFjPH5scTkbWsRYwek7m X-Google-Smtp-Source: ABdhPJweQT6sIVlLoAOxE5bTl2yT1p+BuuF5xXWLx/SMo7Tm319cKgchIJd7Yz0CphP2O112cqVnSxo5a998XfnIBSE= X-Received: by 2002:a05:651c:547:: with SMTP id q7mr26257481ljp.437.1594054856982; Mon, 06 Jul 2020 10:00:56 -0700 (PDT) MIME-Version: 1.0 References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> <4B017BF4-B56F-462F-8C61-1D942E145244@gmail.com> In-Reply-To: From: Dick Hardt Date: Mon, 6 Jul 2020 10:00:21 -0700 Message-ID: To: Atul Tulshibagwale Cc: Yaron Sheffer , Bjorn Hjelm , "id-event@ietf.org" , "Richard Backman, Annabelle" Content-Type: multipart/alternative; boundary="00000000000080c68505a9c8d1cb" Archived-At: Subject: Re: [Id-event] subject-identifers WG interest (Was: Closing the SecEvent working group) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2020 17:01:02 -0000 --00000000000080c68505a9c8d1cb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Yaron and I have discussed keeping the WG going to work on the subject-identifiers draft. We were both disappointed in the previous feedback from the WG in the two WGLCs we had for the document. With more people chiming in at this time, we have decided to check if there is renewed WG interest in subject-identifiers. To gauge the interest, we would like to see substantive feedback on the latest draft[1] from numerous people in the next two weeks. The cutoff will be July 20, 18:00 PDT. If we do not see substantial feedback, we will close the WG and assist Annabelle in publishing with the ISE. Dick and Yaron [1] https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05 Note this draft has expired, but still suits our purpose of gauging interest. On Fri, Jul 3, 2020 at 10:07 AM Atul Tulshibagwale wrote: > I would also like this work to be completed. We're working on subject-typ= e > changes in the SSE spec, so those can be incorporated into this spec. > > I'm happy to do this work within the SecEvents group. > > Thanks, > Atul > > > On Fri, Jul 3, 2020 at 2:47 AM Yaron Sheffer > wrote: > >> Sorry folks. We decided that this draft does not have WG support back in >> August, because it clearly did not have such support. Yes there are >> obviously people who want to see it published as an RFC. But not enough = for >> any meaningful discussion during the WG last call (or even a positive >> response before the WGLC expired, we had exactly one). Nor any discussio= n >> since then. Nor a new draft version published since late July 2019. >> >> >> >> Let me remind the group that the IETF offers two alternatives for >> publication, either AD-sponsored or through the ISE. >> >> >> >> Thanks, >> >> Yaron >> >> >> >> *From: *Bjorn Hjelm >> *Date: *Friday, July 3, 2020 at 05:29 >> *To: *"Richard Backman, Annabelle" >> *Cc: *Yaron Sheffer , "id-event@ietf.org" < >> id-event@ietf.org> >> *Subject: *Re: [E] Re: [Id-event] Closing the SecEvent working group >> >> >> >> Annabelle, >> >> I would like to see this work being completed. >> >> BR, >> >> Bjorn >> >> >> >> On Jul 2, 2020, at 3:59 PM, Richard Backman, Annabelle > 40amazon.com@dmarc.ietf.org> wrote: >> >> =EF=BB=BF >> >> I=E2=80=99d like to hear from the working group on whether or not there = is >> interest in completing the Subject Identifiers draft within secevents. >> This work has more or less been put on hiatus given the chairs=E2=80=99 = previous >> decision not to continue with it within the working group, but it remain= s a >> dependency for other work, and a number of people within the working gro= up >> have expressed interest and support for it previously. If there is suppo= rt >> within the working group for resuming and completing Subject Identifiers= , >> then it would seem reasonable to me to do so within secevents. >> >> >> >> =E2=80=93 >> >> Annabelle Backman (she/her) >> >> AWS Identity >> >> https://aws.amazon.com/identity/ >> >> >> >> >> >> >> *From: *Id-event on behalf of Yaron Sheffer = < >> yaronf.ietf@gmail.com> >> *Date: *Tuesday, June 30, 2020 at 2:06 AM >> *To: *"id-event@ietf.org" > >> *Subject: *[EXTERNAL] [Id-event] Closing the SecEvent working group >> >> >> >> *CAUTION*: This email originated from outside of the organization. Do >> not click links or open attachments unless you can confirm the sender an= d >> know the content is safe. >> >> >> >> Dear WG participants, >> >> >> >> As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP deli= very >> specs, have both been approved for publication as RFCs. >> >> >> >> Since the group has now completed its mission, we propose to close it >> down. Unless there are objections (accompanied by credible work items) >> within a week, we will ask the AD to do just that. Even with the WG shut >> down, the mailing list will remain open for relevant discussions. >> >> >> >> We would like to thank the authors of the Push and Poll soon-to-be RFCs, >> Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to the ma= ny >> other working group members who contributed to these quality documents. >> >> >> >> Regards, >> >> >> >> Dick and Yaron >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mail= man_listinfo_id-2Devent&d=3DDwICAg&c=3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__= 0PomBTQ&r=3DNMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=3DJdLD0MPKiH-cnYa= RWq00dc9RaqFuwKAR2s9Y6qctmCY&s=3DruzxNhwgDEh8N2N1ayOzTrCx8t1W3gLrz39-Jny_mh= c&e=3D >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --00000000000080c68505a9c8d1cb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Yaron and I have di= scussed keeping the WG going to work on the subject-identifiers draft. We w= ere both disappointed in the previous feedback from the WG in the two WGLCs= we had for the document.

With more people chiming= in at this time, we have decided to check if there is renewed WG interest = in subject-identifiers. To gauge=C2=A0the interest, we would like to see su= bstantive feedback on the latest draft[1] from numerous people in the next = two weeks. The cutoff will be July 20, 18:00 PDT. If we do not see substant= ial feedback, we will close the WG and assist Annabelle in publishing with = the ISE.

Dick and Yaron


Note this= draft has expired, but still suits our purpose of gauging=C2=A0interest.

On Fri, Jul 3, 2020 at 10:07 AM Atul Tulshibagwale <atultulshi= =3D40google.com@dmarc.ietf.o= rg> wrote:
I would also like this work to be completed. We're w= orking on subject-type changes in the SSE spec, so those can be incorporate= d into this spec.

I'm happy to do this work within t= he SecEvents group.

Thanks,
Atul


On Fri, Jul 3, 2020 at 2:47 AM Yaron Sheffer <yaronf.ietf@gmail.com>= wrote:

Sorr= y folks. We decided that this draft does not have WG support back in August= , because it clearly did not have such support. Yes there are obviously peo= ple who want to see it published as an RFC. But not enough for any meaningf= ul discussion during the WG last call (or even a positive response before t= he WGLC expired, we had exactly one). Nor any discussion since then. Nor a = new draft version published since late July 2019.

<= p class=3D"MsoNormal">=C2=A0

Let me remin= d the group that the IETF offers two alternatives for publication, either A= D-sponsored or through the ISE.

=C2=A0

Thanks,<= /p>

=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Ya= ron

=C2=A0

From: = Bjorn Hjelm <bjorn.hjelm@verizonwireles= s.com>
Date: Friday, July 3, 2020 at 05:29
To: &= quot;Richard Backman, Annabelle" <richanna=3D40amazon.com@dmarc.ietf.org&= gt;
Cc: Yaron Sheffer <yaronf.ietf@gmail.com>, "id-event@ietf.org" <id-event@ietf.org><= br>Subject: Re: [E] Re: [Id-event] Closing the SecEvent working grou= p

=C2=A0

Annabelle,

I would like to see this work being completed.

=

BR,

Bjorn



On Jul 2, 2020, at 3:59 PM,= Richard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org> wrote:=

=EF=BB=BF

I=E2=80=99d like to hear from the working group on whether o= r not there is interest in completing the Subject Identifiers draft=C2=A0 w= ithin secevents. This work has more or less been put on hiatus given the ch= airs=E2=80=99 previous decision not to continue with it within the working = group, but it remains a dependency for other work, and a number of people w= ithin the working group have expressed interest and support for it previous= ly. If there is support within the working group for resuming and completin= g Subject Identifiers, then it would seem reasonable to me to do so within = secevents.

=C2=A0

= =E2=80=93

Annabelle Backman (she/he= r)

AWS Identity

https://aws.amazon.com/identity/

=C2= =A0

=C2=A0

From: Id-event= <id-even= t-bounces@ietf.org> on behalf of Yaron Sheffer <yaronf.ietf@gmail.com>
= Date: Tuesday, June 30, 2020 at 2:06 AM
To: "id-event@ietf.org"= <id-event@ietf..= org>
Subject: [EXTERNAL] [Id-event] Closing the SecEvent w= orking group

=C2=A0=

CAUTION: This email originated from outs= ide of the organization. Do not click links or open attachments unless you = can confirm the sender and know the content is safe.

=C2=A0

Dear WG participants,

=C2=A0

As you=E2=80=99ve a= ll seen, our last two deliverables, the SET HTTP delivery specs, have both = been approved for publication as RFCs.

=C2= =A0

Since the group has now completed its mi= ssion, we propose to close it down. Unless there are objections (accompanie= d by credible work items) within a week, we will ask the AD to do just that= . Even with the WG shut down, the mailing list will remain open for relevan= t discussions.

=C2=A0

We would like to thank the authors of the Push and Poll soon-to-be= RFCs, Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to th= e many other working group members who contributed to these quality documen= ts.

=C2=A0

R= egards,

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Dick and Yaron

________________________________= _______________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u= =3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c= =3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=3DNMZJHCV8pjvGIH2fTx9z= 6l7g7-V-a2xW7ISf9uHdz0A&m=3DJdLD0MPKiH-cnYaRWq00dc9RaqFuwKAR2s9Y6qctmCY= &s=3DruzxNhwgDEh8N2N1ayOzTrCx8t1W3gLrz39-Jny_mhc&e=3D

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--00000000000080c68505a9c8d1cb-- From nobody Wed Jul 8 10:15:31 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C6D53A0FF8 for ; Wed, 8 Jul 2020 10:15:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=independentid-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id crlEBibsPj9V for ; Wed, 8 Jul 2020 10:15:26 -0700 (PDT) Received: from mail-pj1-x102d.google.com (mail-pj1-x102d.google.com [IPv6:2607:f8b0:4864:20::102d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56B223A0FA6 for ; Wed, 8 Jul 2020 10:15:25 -0700 (PDT) Received: by mail-pj1-x102d.google.com with SMTP id k71so1507110pje.0 for ; Wed, 08 Jul 2020 10:15:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=independentid-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:subject:message-id:references:to:date; bh=btnEr+yieNLMX6J8HUjJg9B8BnIPrfuAVFaF8/5hGpo=; b=N0xw25QhFdVHXE9OW8s5FU/IyHOaW0LRmyUcgdqaE5aG4JHrzDrDQDY4WCLBb9OCEU gzrhs+ORqf82DYwGvB5aWqLEGP746/tkIJo4wWS2QCk1s1orYYXtVLkWT+c+P40t2oAt HkAplJYUQb0bTb5D/YWt0fv2z+fnAuvUZKXHEaalSUsuVXOUjxel3z1bEkDABEdilOZP KJxD9ZhPVXmrsqZ/ARZcghTI/LL5SkA2eFZ0F1MOwccQiNo5J2KP9kRZ3M460g3DjTQE GV2v5fDlT8kHIWLanDNsxOoLOqOm9xkfVT/4TV+4vlrUVFncXQxgseNZHVXIP+3YaDXM poow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:message-id:references :to:date; bh=btnEr+yieNLMX6J8HUjJg9B8BnIPrfuAVFaF8/5hGpo=; b=rjyHrGI3XRONH6SuGMC84ICp3VryT84+gKK3J6pJE7xZhtbeA5gXtgv/BQl221jZPd 9I5PF3fQhHR9AHt+lHaWYZ7Mx6TgneTdO3MS7ZvLPr21NG63a3ZEOoa3eEb4IR3wf8fZ ZO7aJ3e0e7bdZimqvFDcrOQ/Q8Ie36Ys6rQJuS4Ju4IVsYUhJRJaUOUQMlgGmYcH2XaD 82k/RZa8ufsghEYmyym+HZr2g1WqgowQVKxlmOAQmPMVgOo2xtWmCFU1RCAffSSqmErs znxhS1xVFu+elcwrXQznPcuOBegiKyWjkjX0FRJpZA3Ir3g63tu8Et8axflUvKIMI+JN t8mQ== X-Gm-Message-State: AOAM530RerAf5HcWPUpVqY+I1GbwGI3vFlrryMqAWyN5xcBk7wIKNJUH EeiVmtzXJCw6N8itePa8OJPAXCClwsg= X-Google-Smtp-Source: ABdhPJzfRt/hfYE7OF9uW5ND/2iBFCsZ5uZPOCo0I1ZtaEQxmf5QwvnasDaSovbeiWUbF0sRywA/wQ== X-Received: by 2002:a17:90a:d3cf:: with SMTP id d15mr10150009pjw.202.1594228524139; Wed, 08 Jul 2020 10:15:24 -0700 (PDT) Received: from node-1w7jr9qrfoxx9f3mfpqa5gkkj.ipv6.telus.net (node-1w7jr9qrfoxx9f3mfpqa5gkkj.ipv6.telus.net. [2001:569:7a71:1d00:7c98:fc2d:a989:3923]) by smtp.gmail.com with ESMTPSA id h6sm363960pfo.123.2020.07.08.10.15.23 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 08 Jul 2020 10:15:23 -0700 (PDT) From: Phillip Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_ECBEE8F2-CE14-4679-8793-A2488A6CB876" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Message-Id: <3E1CA464-C59B-47D9-B8DD-F1D49FF349C2@independentid.com> References: <329FDE98-A8F3-43D0-AAA6-5E71C68A7C1C@independentid.com> To: ID Events Mailing List Date: Wed, 8 Jul 2020 10:15:22 -0700 X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jul 2020 17:15:29 -0000 --Apple-Mail=_ECBEE8F2-CE14-4679-8793-A2488A6CB876 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Per the chairs request, here are my initial comments on the draft. Technically I am ok with the proposal. I do however have some = suggestions that should improve the flow of the document regarding Secs = 3 and 4. Section 1.0 I think breaking into two paragraphs makes it a bit clearer. Replace: ...depending on the nature and needs of the transmitter and receiver. Even within the context of a given transmitter and receiver relationship, it may be appropriate to identify different accounts in different ways, for example if some accounts only have email addresses associated with them while others only have phone numbers. Therefore it can be necessary to indicate within a SET the mechanism by which the subject of the security event is being identified. =09 With: ...depending on the nature and needs of the transmitter and receiver. Within the context of a given transmitter and receiver relationship,=20= accounts may be identified in different ways. For example, some=20 accounts only have email addresses associated with them while others=20= only have phone numbers. Because of the variability in ways of=20 identification across entities, this specification provides a = mechanism=20 to indicate the mechanism by which the subject of the security event = is=20 being identified. Having a combination of figures 5 and 6 in the introduction as an = example might be helpful to give the reader a quick look at what is = being defined. Section 3 and 4: General: Terms: The terms =E2=80=9Cschema=E2=80=9D and =E2=80=9Cpayload claim=E2=80=9D = are not defined or referenced. The use seems inconsistent with RFC8417. = A =E2=80=9Cpayload" is not just a jSON object, but rather in 8417 the = payload was a set of sub-claims placed within an event uri value object. = Payload claims don=E2=80=99t have to be registered JWT claims because = they fall within their own event-uri object space. In contrast, = =E2=80=9Csub_id=E2=80=9D is a registered claim to be placed in the top = level of the JWT/SET. For example: { "iss": "https://server.example.com ", "sub": "248289761001", "aud": "s6BhdRkqt3", "iat": 1471566154, "jti": "bWJq", =E2=80=9Csub_id=E2=80=9D|"sid": , "events": { =E2=80=9Ce = vent-uri": { } } } Flow: I was confused reading section 3 before section 4. I think spec might = flow better with 3 and 4 reversed. Note: I believe it is ok to have = examples with parts that are not yet defined. Or, you can do something = like =E2=80=9C=E2=80=9D in place of the value = of a =E2=80=9Csub_id=E2=80=9D in the example.=20 Figure 7 seems confusing. Why would a duplicate identifier be sent in = both sub and sub_id? Does figure 7 imply that the identifiers are = aliases? Some explanatory text (e.g. backwards compatibility) might be = helpful. Also, is sub_id intended to replace =E2=80=9Csub=E2=80=9D? Figure 8, seems incorrectly composed. Why not use the alias subject type = to express there are multiple email aliases? =20 Sec 4.1. The sub claim should be referenced to Sec 4.1.2 of RFC7519. I would prefer a SHOULD that implementers should operationally use = either =E2=80=9Csub=E2=80=9D or =E2=80=9Csub_id=E2=80=9D in any single = JWT or SET. This avoids confusing situations and logic around = =E2=80=9Cimplied=E2=80=9D aliases such as in Figure 7 or 8. It feels = like a better practice to use the alias subject identifier when = explicitly saying two emails are aliases for the same subject. Section 5 You may want some more general advice on transmission PII and = identifiers in general rather than just the alias case. Aside: it may be worth while spending more time on Alias. Is the point = to convey multiple identifiers of the same type? Why wouldn=E2=80=99t = an issuer not know how the receiver identifies a subject? Some of the = use of alias may seem to be =E2=80=9Cspaghetti on the wall=E2=80=9D = event matching. =E2=80=94> I=E2=80=99m not against alias. I just suspect we need to = justify and clarify its appropriate uses. Reference RFC8417 Section 6 and Sec 5.1 as applying here? Section 6 - assuming RFC8417 (SET) and RFC7797 (JWT) as foundational = considerations? Hope this helps. Phil Hunt @independentid phil.hunt@independentid.com --Apple-Mail=_ECBEE8F2-CE14-4679-8793-A2488A6CB876 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Per the chairs request, here are my initial = comments on the draft.

Technically I am ok with the proposal. I do however have some = suggestions that should improve the flow of the document regarding Secs = 3 and 4.

Section = 1.0

I think = breaking into two paragraphs makes it a bit clearer.

Replace:
   =
...depending on the nature and needs of the transmitter and
   receiver. Even within the context of a given =
transmitter and
   receiver relationship, it =
may be appropriate to identify different
   =
accounts in different ways, for example if some accounts only have

   email addresses associated with them while =
others only have phone
   numbers.  Therefore it can be necessary to indicate within a SET the
   mechanism by which the subject of the security event is being
   identified.

With:
   ...depending on the nature and needs of the =
transmitter and
   =
receiver.
  <new =
paragraph>
   Within the context of a =
given transmitter and receiver relationship, 
   accounts may be identified in different ways. =
For example, some 
   accounts only have =
email addresses associated with them while others 
   only have phone numbers. Because of the =
variability in ways of 
   =
identification across entities, this specification provides a =
mechanism 
   to indicate the mechanism by =
which the subject of the security event is 
   being identified.

Having a combination =
of figures 5 and 6 in the introduction as an example might be helpful to =
give the reader a quick look at what is being defined.

Section 3 and = 4:

General:

Terms:
The terms =E2=80=9Cschema=E2=80=9D = and =E2=80=9Cpayload claim=E2=80=9D are not defined or referenced. =  The use seems inconsistent with RFC8417. A =E2=80=9Cpayload" is = not just a jSON object, but rather in 8417 the payload was a set of = sub-claims placed within an event uri value object. Payload claims = don=E2=80=99t have to be registered JWT claims because they fall within = their own event-uri object space. In contrast, =E2=80=9Csub_id=E2=80=9D = is a registered claim to be placed in the top level of the JWT/SET. =  For example:
{
     "iss": "https://server.example.com",
     "sub": "248289761001",
     "aud": "s6BhdRkqt3",
     "iat": 1471566154,
     "jti": "bWJq",
     =E2=80=9Csub_id=E2=80=9D|"sid": <JSON Value>,
     "events": {
       =E2=80=9Cevent-uri": {
       <payload claims =
here>
        }
     }
}

Flow:
I was = confused reading section 3 before section 4. I think spec might flow = better with 3 and 4 reversed.  Note: I believe it is ok to have = examples with parts that are not yet defined.  Or, you can do = something like =E2=80=9C<subject-identifier-object>=E2=80=9D in = place of the value of a =E2=80=9Csub_id=E2=80=9D in the = example. 

Figure 7 seems confusing. Why would a duplicate identifier be = sent in both sub and sub_id?  Does figure 7 imply that the = identifiers are aliases? Some explanatory text (e.g. backwards = compatibility) might be helpful. Also, is sub_id intended to replace = =E2=80=9Csub=E2=80=9D?

Figure 8, seems incorrectly composed. Why not use the alias = subject type to express there are multiple email aliases? =  

Sec 4.1.  The sub claim should be referenced to Sec = 4.1.2 of RFC7519.

I would prefer a SHOULD that implementers should = operationally use either =E2=80=9Csub=E2=80=9D or =E2=80=9Csub_id=E2=80=9D= in any single JWT or SET. This avoids confusing situations and logic = around =E2=80=9Cimplied=E2=80=9D aliases such as in Figure 7 or 8. It = feels like a better practice to use the alias subject identifier when = explicitly saying two emails are aliases for the same subject.

Section 5

You may want some more = general advice on transmission PII and identifiers in general rather = than just the alias case.

Aside: it may be worth while spending more time on Alias. Is = the point to convey multiple identifiers of the same type?  Why = wouldn=E2=80=99t an issuer not know how the receiver identifies a = subject?  Some of the use of alias may seem to be =E2=80=9Cspaghetti = on the wall=E2=80=9D event matching.
=E2=80=94> = I=E2=80=99m not against alias. I just suspect we need to justify and = clarify its appropriate uses.

Reference RFC8417 Section 6 and Sec 5.1 = as applying here?

Section 6 - assuming RFC8417 (SET) and RFC7797 (JWT) as = foundational considerations?

Hope this helps.
Phil Hunt
@independentid
phil.hunt@independentid.com






= --Apple-Mail=_ECBEE8F2-CE14-4679-8793-A2488A6CB876-- From nobody Thu Jul 9 15:23:18 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0C803A0789 for ; Thu, 9 Jul 2020 15:23:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.6 X-Spam-Level: X-Spam-Status: No, score=-9.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 570nxvGX9lKb for ; Thu, 9 Jul 2020 15:23:13 -0700 (PDT) Received: from smtp-fw-9102.amazon.com (smtp-fw-9102.amazon.com [207.171.184.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83D203A0938 for ; Thu, 9 Jul 2020 15:23:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1594333391; x=1625869391; h=from:to:date:message-id:references:in-reply-to: mime-version:subject; bh=tSkbGLSp7iGY6dpWfkmAj4WsbGZSQ5qrH+mQR1zqRI0=; b=AT+4qbGsOXIc/z1Oxb6xox+JoRCS5onQFLTV91Wz2AYlI58zOjTyTsl5 XjRAkIjsBGQxzHBYslavo/t4HyvjJw5QV+fh+0z8JhXLdVMG/AqVYOrhI 7gcnYMIpuaE8H1j8SoTY2o76s60Y+3Sa8nGwgCKtmgrVk+g3RvcSm7suG s=; IronPort-SDR: DnF/wMiJtU5eE0pom4mYoOZm2L8giyWLYAU5uq+G2aIbF8WrQZgNfZy/V0FZlH6G7D6YZ3Eb8e g1ufqhrJE75g== X-IronPort-AV: E=Sophos; i="5.75,332,1589241600"; d="scan'208,217"; a="58711918" Thread-Topic: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 Received: from sea32-co-svc-lb4-vlan3.sea.corp.amazon.com (HELO email-inbound-relay-1d-9ec21598.us-east-1.amazon.com) ([10.47.23.38]) by smtp-border-fw-out-9102.sea19.amazon.com with ESMTP; 09 Jul 2020 22:23:07 +0000 Received: from EX13MTAUWC001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan3.iad.amazon.com [10.40.159.166]) by email-inbound-relay-1d-9ec21598.us-east-1.amazon.com (Postfix) with ESMTPS id 3159FA19F3; Thu, 9 Jul 2020 22:23:05 +0000 (UTC) Received: from EX13D11UWC002.ant.amazon.com (10.43.162.174) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 9 Jul 2020 22:23:04 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC002.ant.amazon.com (10.43.162.174) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 9 Jul 2020 22:23:04 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Thu, 9 Jul 2020 22:23:04 +0000 From: "Richard Backman, Annabelle" To: Phillip Hunt , ID Events Mailing List Thread-Index: AQHWVUvFYswFMid6rUaDM1L+b8SUf6j/XxYA Date: Thu, 9 Jul 2020 22:23:04 +0000 Message-ID: <7B29E306-9C28-4D10-B5D4-A54888698153@amazon.com> References: <329FDE98-A8F3-43D0-AAA6-5E71C68A7C1C@independentid.com> <3E1CA464-C59B-47D9-B8DD-F1D49FF349C2@independentid.com> In-Reply-To: <3E1CA464-C59B-47D9-B8DD-F1D49FF349C2@independentid.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.100] Content-Type: multipart/alternative; boundary="_000_7B29E3069C284D10B5D4A54888698153amazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2020 22:23:16 -0000 --_000_7B29E3069C284D10B5D4A54888698153amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aGUgcmV2aWV3LCBQaGlsISBDb21tZW50cy9mb2xsb3cgdXBzIFtyaWNoYW5u YV0gaW5saW5lIFsvcmljaGFubmFdLg0KDQrigJMNCkFubmFiZWxsZSBCYWNrbWFuIChzaGUvaGVy KQ0KQVdTIElkZW50aXR5DQpodHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5Lw0KDQoNCkZy b206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgUGhp bGxpcCBIdW50IDxwaGlsLmh1bnRAaW5kZXBlbmRlbnRpZC5jb20+DQpEYXRlOiBXZWRuZXNkYXks IEp1bHkgOCwgMjAyMCBhdCAxMDoxOCBBTQ0KVG86IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlk LWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogW0VYVEVSTkFMXSBbSWQtZXZlbnRdIFJldmlldyBv ZiBkcmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmllcnMtMDUNCg0KDQpDQVVUSU9O OiBUaGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRpb24u IERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcyB5b3UgY2FuIGNv bmZpcm0gdGhlIHNlbmRlciBhbmQga25vdyB0aGUgY29udGVudCBpcyBzYWZlLg0KDQoNCg0KUGVy IHRoZSBjaGFpcnMgcmVxdWVzdCwgaGVyZSBhcmUgbXkgaW5pdGlhbCBjb21tZW50cyBvbiB0aGUg ZHJhZnQuDQoNClRlY2huaWNhbGx5IEkgYW0gb2sgd2l0aCB0aGUgcHJvcG9zYWwuIEkgZG8gaG93 ZXZlciBoYXZlIHNvbWUgc3VnZ2VzdGlvbnMgdGhhdCBzaG91bGQgaW1wcm92ZSB0aGUgZmxvdyBv ZiB0aGUgZG9jdW1lbnQgcmVnYXJkaW5nIFNlY3MgMyBhbmQgNC4NCg0KU2VjdGlvbiAxLjANCg0K SSB0aGluayBicmVha2luZyBpbnRvIHR3byBwYXJhZ3JhcGhzIG1ha2VzIGl0IGEgYml0IGNsZWFy ZXIuDQoNClJlcGxhY2U6DQoNCiAgIC4uLi5kZXBlbmRpbmcgb24gdGhlIG5hdHVyZSBhbmQgbmVl ZHMgb2YgdGhlIHRyYW5zbWl0dGVyIGFuZA0KDQogICByZWNlaXZlci4gRXZlbiB3aXRoaW4gdGhl IGNvbnRleHQgb2YgYSBnaXZlbiB0cmFuc21pdHRlciBhbmQNCg0KICAgcmVjZWl2ZXIgcmVsYXRp b25zaGlwLCBpdCBtYXkgYmUgYXBwcm9wcmlhdGUgdG8gaWRlbnRpZnkgZGlmZmVyZW50DQoNCiAg IGFjY291bnRzIGluIGRpZmZlcmVudCB3YXlzLCBmb3IgZXhhbXBsZSBpZiBzb21lIGFjY291bnRz IG9ubHkgaGF2ZQ0KDQogICBlbWFpbCBhZGRyZXNzZXMgYXNzb2NpYXRlZCB3aXRoIHRoZW0gd2hp bGUgb3RoZXJzIG9ubHkgaGF2ZSBwaG9uZQ0KDQogICBudW1iZXJzLiAgVGhlcmVmb3JlIGl0IGNh biBiZSBuZWNlc3NhcnkgdG8gaW5kaWNhdGUgd2l0aGluIGEgU0VUIHRoZQ0KDQogICBtZWNoYW5p c20gYnkgd2hpY2ggdGhlIHN1YmplY3Qgb2YgdGhlIHNlY3VyaXR5IGV2ZW50IGlzIGJlaW5nDQoN CiAgIGlkZW50aWZpZWQuDQoNCg0KDQpXaXRoOg0KDQogICAuLi5kZXBlbmRpbmcgb24gdGhlIG5h dHVyZSBhbmQgbmVlZHMgb2YgdGhlIHRyYW5zbWl0dGVyIGFuZA0KDQogICByZWNlaXZlci4NCg0K ICA8bmV3IHBhcmFncmFwaD4NCg0KICAgV2l0aGluIHRoZSBjb250ZXh0IG9mIGEgZ2l2ZW4gdHJh bnNtaXR0ZXIgYW5kIHJlY2VpdmVyIHJlbGF0aW9uc2hpcCwNCg0KICAgYWNjb3VudHMgbWF5IGJl IGlkZW50aWZpZWQgaW4gZGlmZmVyZW50IHdheXMuIEZvciBleGFtcGxlLCBzb21lDQoNCiAgIGFj Y291bnRzIG9ubHkgaGF2ZSBlbWFpbCBhZGRyZXNzZXMgYXNzb2NpYXRlZCB3aXRoIHRoZW0gd2hp bGUgb3RoZXJzDQoNCiAgIG9ubHkgaGF2ZSBwaG9uZSBudW1iZXJzLiBCZWNhdXNlIG9mIHRoZSB2 YXJpYWJpbGl0eSBpbiB3YXlzIG9mDQoNCiAgIGlkZW50aWZpY2F0aW9uIGFjcm9zcyBlbnRpdGll cywgdGhpcyBzcGVjaWZpY2F0aW9uIHByb3ZpZGVzIGEgbWVjaGFuaXNtDQoNCiAgIHRvIGluZGlj YXRlIHRoZSBtZWNoYW5pc20gYnkgd2hpY2ggdGhlIHN1YmplY3Qgb2YgdGhlIHNlY3VyaXR5IGV2 ZW50IGlzDQoNCiAgIGJlaW5nIGlkZW50aWZpZWQuDQoNCg0KDQpIYXZpbmcgYSBjb21iaW5hdGlv biBvZiBmaWd1cmVzIDUgYW5kIDYgaW4gdGhlIGludHJvZHVjdGlvbiBhcyBhbiBleGFtcGxlIG1p Z2h0IGJlIGhlbHBmdWwgdG8gZ2l2ZSB0aGUgcmVhZGVyIGEgcXVpY2sgbG9vayBhdCB3aGF0IGlz IGJlaW5nIGRlZmluZWQuDQoNCg0KU2VjdGlvbiAzIGFuZCA0Og0KDQpHZW5lcmFsOg0KDQpUZXJt czoNClRoZSB0ZXJtcyDigJxzY2hlbWHigJ0gYW5kIOKAnHBheWxvYWQgY2xhaW3igJ0gYXJlIG5v dCBkZWZpbmVkIG9yIHJlZmVyZW5jZWQuICBUaGUgdXNlIHNlZW1zIGluY29uc2lzdGVudCB3aXRo IFJGQzg0MTcuIEEg4oCccGF5bG9hZCIgaXMgbm90IGp1c3QgYSBqU09OIG9iamVjdCwgYnV0IHJh dGhlciBpbiA4NDE3IHRoZSBwYXlsb2FkIHdhcyBhIHNldCBvZiBzdWItY2xhaW1zIHBsYWNlZCB3 aXRoaW4gYW4gZXZlbnQgdXJpIHZhbHVlIG9iamVjdC4gUGF5bG9hZCBjbGFpbXMgZG9u4oCZdCBo YXZlIHRvIGJlIHJlZ2lzdGVyZWQgSldUIGNsYWltcyBiZWNhdXNlIHRoZXkgZmFsbCB3aXRoaW4g dGhlaXIgb3duIGV2ZW50LXVyaSBvYmplY3Qgc3BhY2UuIEluIGNvbnRyYXN0LCDigJxzdWJfaWTi gJ0gaXMgYSByZWdpc3RlcmVkIGNsYWltIHRvIGJlIHBsYWNlZCBpbiB0aGUgdG9wIGxldmVsIG9m IHRoZSBKV1QvU0VULiAgRm9yIGV4YW1wbGU6DQoNCnsNCg0KICAgICAiaXNzIjogImh0dHBzOi8v c2VydmVyLmV4YW1wbGUuY29tPGh0dHBzOi8vc2VydmVyLmV4YW1wbGUuY29tLz4iLA0KDQogICAg ICJzdWIiOiAiMjQ4Mjg5NzYxMDAxIiwNCg0KICAgICAiYXVkIjogInM2QmhkUmtxdDMiLA0KDQog ICAgICJpYXQiOiAxNDcxNTY2MTU0LA0KDQogICAgICJqdGkiOiAiYldKcSIsDQoNCiAgICAg4oCc c3ViX2lk4oCdfCJzaWQiOiA8SlNPTiBWYWx1ZT4sDQoNCiAgICAgImV2ZW50cyI6IHsNCg0KICAg ICAgIOKAnGU8aHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9ldmVudC9iYWNrY2hhbm5lbC1sb2dv dXQ+dmVudC11cmkiOiB7DQoNCiAgICAgICA8cGF5bG9hZCBjbGFpbXMgaGVyZT4NCg0KICAgICAg ICB9DQoNCiAgICAgfQ0KDQp9DQoNCltyaWNoYW5uYV0NCkFncmVlZCwgSSB0aGluayDigJxjbGFp beKAnSBhbmQg4oCccGF5bG9hZCBjbGFpbeKAnSBjYW4gYmUgcmVwbGFjZWQgbGVzcyBzZW1hbnRp Y2FsbHktbG9hZGVkIHRlcm1zIChlLmcuLCDigJxwcm9wZXJ0eeKAnSksIG9yIOKAnG1lbWJlcuKA nSB3aGVyZSB3ZSBhcmUgYWN0dWFsbHkgcmVmZXJyaW5nIHRvIG1lbWJlcnMgb2YgYSBKU09OIG9i amVjdC4gQW5kIHdlIGNhbiByZXdvcmQgdGhlIFN1YmplY3QgSWRlbnRpZmllciBUeXBlIGRlZmlu aXRpb24gdG8gYXZvaWQgdXNlIG9mIHRoZSB3b3JkIOKAnHNjaGVtYeKAnSBhbHRvZ2V0aGVyLg0K Wy9yaWNoYW5uYV0NCg0KRmxvdzoNCkkgd2FzIGNvbmZ1c2VkIHJlYWRpbmcgc2VjdGlvbiAzIGJl Zm9yZSBzZWN0aW9uIDQuIEkgdGhpbmsgc3BlYyBtaWdodCBmbG93IGJldHRlciB3aXRoIDMgYW5k IDQgcmV2ZXJzZWQuICBOb3RlOiBJIGJlbGlldmUgaXQgaXMgb2sgdG8gaGF2ZSBleGFtcGxlcyB3 aXRoIHBhcnRzIHRoYXQgYXJlIG5vdCB5ZXQgZGVmaW5lZC4gIE9yLCB5b3UgY2FuIGRvIHNvbWV0 aGluZyBsaWtlIOKAnDxzdWJqZWN0LWlkZW50aWZpZXItb2JqZWN0PuKAnSBpbiBwbGFjZSBvZiB0 aGUgdmFsdWUgb2YgYSDigJxzdWJfaWTigJ0gaW4gdGhlIGV4YW1wbGUuDQoNCltyaWNoYW5uYV0N ClNpbmNlIHRoZSDigJxzdWJfaWTigJ0gSldUIGNsYWltIGlzIGp1c3Qgb25lIHdheSB0aGF0IFN1 YmplY3QgSWRlbnRpZmllcnMgbWF5IGJlIHVzZWQsIEkgZG9u4oCZdCB0aGluayBpdCBtYWtlcyBz ZW5zZSB0byBkZWZpbmUgaXQgZmlyc3QuIEFyZSB5b3UgbG9va2luZyBmb3IgdGhlIGRvYyB0byBw cm92aWRlIGEgYml0IG1vcmUgY29uY3JldGUgZ3JvdW5kaW5nIGZvciBTdWJqZWN0IElkZW50aWZp ZXJzIGJlZm9yZSBqdW1waW5nIGludG8gdGhlIGRlZmluaXRpb24/IFdlIGNvdWxkIGFkZCBleGFt cGxlcyB0byB0aGUgaW50cm9kdWN0aW9uLCBzaG93aW5nIFN1YmplY3QgSWRlbnRpZmllcnMgaW4g YSBjb3VwbGUgb2YgZGlmZmVyZW50IHVzZSBjYXNlcy4NClsvcmljaGFubmFdDQoNCkZpZ3VyZSA3 IHNlZW1zIGNvbmZ1c2luZy4gV2h5IHdvdWxkIGEgZHVwbGljYXRlIGlkZW50aWZpZXIgYmUgc2Vu dCBpbiBib3RoIHN1YiBhbmQgc3ViX2lkPyAgRG9lcyBmaWd1cmUgNyBpbXBseSB0aGF0IHRoZSBp ZGVudGlmaWVycyBhcmUgYWxpYXNlcz8gU29tZSBleHBsYW5hdG9yeSB0ZXh0IChlLmcuIGJhY2t3 YXJkcyBjb21wYXRpYmlsaXR5KSBtaWdodCBiZSBoZWxwZnVsLiBBbHNvLCBpcyBzdWJfaWQgaW50 ZW5kZWQgdG8gcmVwbGFjZSDigJxzdWLigJ0/DQoNCltyaWNoYW5uYV0NCkkgcHJpbWFyaWx5IHNl ZSB0aGlzIGFzIGJlaW5nIHVzZWQgZm9yIGludGVyb3BlcmFiaWxpdHkvYmFja3dhcmRzIGNvbXBh dGliaWxpdHksIGluIHBhcnRpY3VsYXIgd2hlbiBtaWdyYXRpbmcgc3lzdGVtcyB0byB1c2Ugb25l IHZlcnN1cyB0aGUgb3RoZXIuDQpbL3JpY2hhbm5hXQ0KDQpGaWd1cmUgOCwgc2VlbXMgaW5jb3Jy ZWN0bHkgY29tcG9zZWQuIFdoeSBub3QgdXNlIHRoZSBhbGlhcyBzdWJqZWN0IHR5cGUgdG8gZXhw cmVzcyB0aGVyZSBhcmUgbXVsdGlwbGUgZW1haWwgYWxpYXNlcz8NCg0KW3JpY2hhbm5hXQ0KRmln dXJlIDggZG9lcyBub3QgZXhwcmVzcyB0aGF0IHRoZXJlIGFyZSBtdWx0aXBsZSBlbWFpbCBhZGRy ZXNzZXMuIFdoaWxlIHRoZSB2YWx1ZSBvZiB0aGUg4oCcc3Vi4oCdIGNsYWltIHJlc2VtYmxlcyBh biBlbWFpbCBhZGRyZXNzLCBub3RoaW5nIGluIHRoZSBKV1QgaW5kaWNhdGVzIHRoYXQgaXQgYWN0 dWFsbHkgaXMgb25lLiBTaW5jZSBhIHJlY2lwaWVudCBvZiB0aGUgSldUIGNhbm5vdCBiZSBjZXJ0 YWluIHRoYXQgdGhlIOKAnHN1YuKAnSB2YWx1ZSBpcyBhbiBlbWFpbCBhZGRyZXNzIHdpdGhvdXQg cmVseWluZyBvbiBpbmZvcm1hdGlvbiBvYnRhaW5lZCB0aHJvdWdoIHNvbWUgbm9uLXN0YW5kYXJk IG91dC1vZi1iYW5kIG1lY2hhbmlzbSwgc2ltdWx0YW5lb3VzIHVzYWdlIG9mIOKAnHN1YuKAnSBh bmQg4oCcc3ViX2lk4oCdIGNhbm5vdCBiZSB1c2VkIHRvIGV4cHJlc3MgbXVsdGlwbGUgZW1haWwg c3ViamVjdCBpZGVudGlmaWVycyBmb3IgdGhlIHN1YmplY3QgaW4gYW4gaW50ZXJvcGVyYWJsZSBm YXNoaW9uLg0KDQpGaWd1cmUgOCBpcyBhbiBhZG1pdHRlZGx5IGNvbnRyaXZlZCBleGFtcGxlIGZv ciBhIGNvcm5lciBjYXNlIHRoYXQgaXMgcGVybWl0dGVkIGJ5IHRoZSBzeW50YXguIE9uZSB1c2Ug Y2FzZSBtaWdodCBiZSBhbiBvcmdhbml6YXRpb24gdGFraW5nIHRoZSBzdWItdG8tc3ViX2lkIG1p Z3JhdGlvbiBhcyBhbiBvcHBvcnR1bml0eSB0byBhbHNvIG1ha2UgY2hhbmdlcyB0byB0aGVpciBp ZGVudGlmaWVycywgZS5nLiwgbm9ybWFsaXppbmcgZW1haWwgYWRkcmVzc2VzIGZyb20gQHRlYW0x LmV4YW1wbGUuY29tLCBAdGVhbTIuZXhhbXBsZS5jb20sIGV0Yy4gdG8gQGV4YW1wbGUuY29tKS4N ClsvcmljaGFubmFdDQoNClNlYyA0LjEuICBUaGUgc3ViIGNsYWltIHNob3VsZCBiZSByZWZlcmVu Y2VkIHRvIFNlYyA0LjEuMiBvZiBSRkM3NTE5Lg0KDQpJIHdvdWxkIHByZWZlciBhIFNIT1VMRCB0 aGF0IGltcGxlbWVudGVycyBzaG91bGQgb3BlcmF0aW9uYWxseSB1c2UgZWl0aGVyIOKAnHN1YuKA nSBvciDigJxzdWJfaWTigJ0gaW4gYW55IHNpbmdsZSBKV1Qgb3IgU0VULiBUaGlzIGF2b2lkcyBj b25mdXNpbmcgc2l0dWF0aW9ucyBhbmQgbG9naWMgYXJvdW5kIOKAnGltcGxpZWTigJ0gYWxpYXNl cyBzdWNoIGFzIGluIEZpZ3VyZSA3IG9yIDguIEl0IGZlZWxzIGxpa2UgYSBiZXR0ZXIgcHJhY3Rp Y2UgdG8gdXNlIHRoZSBhbGlhcyBzdWJqZWN0IGlkZW50aWZpZXIgd2hlbiBleHBsaWNpdGx5IHNh eWluZyB0d28gZW1haWxzIGFyZSBhbGlhc2VzIGZvciB0aGUgc2FtZSBzdWJqZWN0Lg0KDQpbcmlj aGFubmFdDQpBIFNIT1VMRCBvbiB0aGUgaXNzdWVyIHNpZGUgaW50cm9kdWNlcyByb29tIGZvciBp bnRlcm9wZXJhYmlsaXR5IGlzc3VlcyBhcyBzeXN0ZW1zIHdpdGggbGVnaXRpbWF0ZSBuZWVkcyBm b3IgaXNzdWluZyBKV1RzIHdpdGggYm90aCBydW4gdXAgYWdhaW5zdCBwcm9jZXNzb3JzIHRoYXQg dHJlYXQgdGhhdCBhcyBhbiBlcnJvciBjYXNlLiBIb3dldmVyIEkgdGhpbmsgaXQgd291bGQgYmUg YXBwcm9wcmlhdGUgdG8gY29uc3RyYWluIGNvbnN1bWVyIGJlaGF2aW9yLCBlLmcuLDoNCg0K4oCc V2hlbiBwcm9jZXNzaW5nIGEgSldUIGltcGxlbWVudGF0aW9ucyBTSE9VTEQgZGV0ZXJtaW5lIHRo ZSBzdWJqZWN0IHVzaW5nIG9uZSBvZiB0aGUg4oCcc3Vi4oCdIG9yIOKAnHN1Yl9pZOKAnSBjbGFp bXMsIGFuZCBTSE9VTEQgTk9UIGRlcGVuZCBvbiBib3RoIGZvciB0aGlzIHB1cnBvc2Uu4oCdDQoN Ck1heWJlIGl04oCZcyB3b3J0aCBleHBsaWNpdGx5IGNhbGxpbmcgb3V0IHRoZSDigJxib3Ro4oCd IHVzZSBjYXNlIGFzIGludGVuZGVkIHRvIHN1cHBvcnQgaW50ZXJvcD8NClsvcmljaGFubmFdDQoN ClNlY3Rpb24gNQ0KDQpZb3UgbWF5IHdhbnQgc29tZSBtb3JlIGdlbmVyYWwgYWR2aWNlIG9uIHRy YW5zbWlzc2lvbiBQSUkgYW5kIGlkZW50aWZpZXJzIGluIGdlbmVyYWwgcmF0aGVyIHRoYW4ganVz dCB0aGUgYWxpYXMgY2FzZS4NCg0KQXNpZGU6IGl0IG1heSBiZSB3b3J0aCB3aGlsZSBzcGVuZGlu ZyBtb3JlIHRpbWUgb24gQWxpYXMuIElzIHRoZSBwb2ludCB0byBjb252ZXkgbXVsdGlwbGUgaWRl bnRpZmllcnMgb2YgdGhlIHNhbWUgdHlwZT8gIFdoeSB3b3VsZG7igJl0IGFuIGlzc3VlciBub3Qg a25vdyBob3cgdGhlIHJlY2VpdmVyIGlkZW50aWZpZXMgYSBzdWJqZWN0PyAgU29tZSBvZiB0aGUg dXNlIG9mIGFsaWFzIG1heSBzZWVtIHRvIGJlIOKAnHNwYWdoZXR0aSBvbiB0aGUgd2FsbOKAnSBl dmVudCBtYXRjaGluZy4NCuKAlD4gSeKAmW0gbm90IGFnYWluc3QgYWxpYXMuIEkganVzdCBzdXNw ZWN0IHdlIG5lZWQgdG8ganVzdGlmeSBhbmQgY2xhcmlmeSBpdHMgYXBwcm9wcmlhdGUgdXNlcy4N Cg0KW3JpY2hhbm5hXQ0KSXTigJlzIHByZXR0eSBjb21tb24gaW4gdGhlIGNvbnN1bWVyIElkUCBz cGFjZSwgYmVjYXVzZSBjbGllbnRzIGRvbuKAmXQgYWx3YXlzIGRvIHRoZSDigJxyaWdodOKAnSB0 aGluZyBhbmQgbGluayBpZGVudGl0aWVzIGJhc2VkIG9uIOKAnGlzc+KAnSvigJ1zdWLigJ0uIE9y IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgbWF5IGJlIGdvaW5nIGludG8gYSBtZXNzYWdlIHRoYXQg aXMgaW50ZW5kZWQgZm9yIGEgdmFyaWV0eSBvZiBwYXJ0aWVzLCB3aGljaCBuZWVkIGRpZmZlcmVu dCBzdWJqZWN0IGlkZW50aWZpZXJzICAoZS5nLiwgZGlmZmVyZW50IGZvcm1hdHMgZm9yIHRoZSBz YW1lIGlkZW50aWZpZXIgdmFsdWUpLg0KWy9yaWNoYW5uYV0NCg0KUmVmZXJlbmNlIFJGQzg0MTcg U2VjdGlvbiA2IGFuZCBTZWMgNS4xIGFzIGFwcGx5aW5nIGhlcmU/DQoNClNlY3Rpb24gNiAtIGFz c3VtaW5nIFJGQzg0MTcgKFNFVCkgYW5kIFJGQzc3OTcgKEpXVCkgYXMgZm91bmRhdGlvbmFsIGNv bnNpZGVyYXRpb25zPw0KDQpIb3BlIHRoaXMgaGVscHMuDQoNClBoaWwgSHVudA0KQGluZGVwZW5k ZW50aWQNCnBoaWwuaHVudEBpbmRlcGVuZGVudGlkLmNvbTxtYWlsdG86cGhpbC5odW50QGluZGVw ZW5kZW50aWQuY29tPg0KDQoNCg0KDQoNCg0K --_000_7B29E3069C284D10B5D4A54888698153amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIg MiA2IDkgNCAyIDUgOCAzIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBN YXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9u dC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9u dC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQE1TIE1pbmNobyI7DQoJcGFub3NlLTE6MiAyIDYgOSA0 IDIgNSA4IDMgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCXBhbm9z ZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1z b05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFy Z2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5 bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5l O30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwg UHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0 Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpzcGFu LkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRl ZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwg UHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseTpDb25zb2xhczt9DQpzcGFuLmFwcGxlLXRhYi1z cGFuDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLXRhYi1zcGFuO30NCnNwYW4uRW1haWxTdHlsZTIz DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNv LXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3Jk U2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGlu IDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9z dHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGFua3MgZm9yIHRoZSByZXZpZXcsIFBoaWwhIENvbW1lbnRzL2ZvbGxvdyB1cHMgPHNwYW4gc3R5 bGU9ImNvbG9yOiNFQjM5RjYiPg0KW3JpY2hhbm5hXSBpbmxpbmUgWy9yaWNoYW5uYV08L3NwYW4+ LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQiPuKAkzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5Bbm5hYmVsbGUgQmFja21hbiAoc2hlL2hlcik8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+QVdTIElkZW50aXR5PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxhIGhyZWY9 Imh0dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvIj48c3BhbiBzdHlsZT0iY29sb3I6IzA1 NjNDMSI+aHR0cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS88L3NwYW4+PC9hPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFj ayI+RnJvbToNCjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6 YmxhY2siPklkLWV2ZW50ICZsdDtpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBiZWhh bGYgb2YgUGhpbGxpcCBIdW50ICZsdDtwaGlsLmh1bnRAaW5kZXBlbmRlbnRpZC5jb20mZ3Q7PGJy Pg0KPGI+RGF0ZTogPC9iPldlZG5lc2RheSwgSnVseSA4LCAyMDIwIGF0IDEwOjE4IEFNPGJyPg0K PGI+VG86IDwvYj5JRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZn dDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+W0VYVEVSTkFMXSBbSWQtZXZlbnRdIFJldmlldyBvZiBk cmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmllcnMtMDU8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8dGFibGUg Y2xhc3M9Ik1zb05vcm1hbFRhYmxlIiBib3JkZXI9IjAiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFk ZGluZz0iMCIgd2lkdGg9IjYyMiIgc3R5bGU9IndpZHRoOjQ2Ni41cHQ7bWFyZ2luLWxlZnQ6LjVp bjtib3JkZXItY29sbGFwc2U6Y29sbGFwc2UiPg0KPHRib2R5Pg0KPHRyIHN0eWxlPSJoZWlnaHQ6 MTUuMjVwdCI+DQo8dGQgd2lkdGg9IjYyMiIgdmFsaWduPSJ0b3AiIHN0eWxlPSJ3aWR0aDo0NjYu NXB0O2JvcmRlcjpzb2xpZCAjRUQ3RDMxIDEuNXB0O3BhZGRpbmc6MGluIDUuNHB0IDBpbiA1LjRw dDtoZWlnaHQ6MTUuMjVwdCI+DQo8cD48c3Ryb25nPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDojRkZG Rjk5Ij5DQVVUSU9OPC9zcGFuPjwvc3Ryb25nPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjaztiYWNr Z3JvdW5kOiNGRkZGOTkiPjogVGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZyb20gb3V0c2lkZSBvZiB0 aGUgb3JnYW5pemF0aW9uLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Igb3BlbiBhdHRhY2htZW50cyB1 bmxlc3MNCiB5b3UgY2FuIGNvbmZpcm0gdGhlIHNlbmRlciBhbmQga25vdyB0aGUgY29udGVudCBp cyBzYWZlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvdGQ+DQo8L3RyPg0KPC90Ym9keT4NCjwv dGFibGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlBlciB0aGUgY2hhaXJzIHJlcXVlc3QsIGhlcmUg YXJlIG15IGluaXRpYWwgY29tbWVudHMgb24gdGhlIGRyYWZ0LjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlRlY2huaWNhbGx5IEkgYW0gb2sgd2l0aCB0aGUg cHJvcG9zYWwuIEkgZG8gaG93ZXZlciBoYXZlIHNvbWUgc3VnZ2VzdGlvbnMgdGhhdCBzaG91bGQg aW1wcm92ZSB0aGUgZmxvdyBvZiB0aGUgZG9jdW1lbnQgcmVnYXJkaW5nIFNlY3MgMyBhbmQgNC48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj5TZWN0aW9uIDEuMDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPkkgdGhpbmsgYnJlYWtpbmcgaW50byB0d28gcGFyYWdyYXBocyBtYWtlcyBp dCBhIGJpdCBjbGVhcmVyLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPlJlcGxhY2U6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluO2JyZWFrLWJlZm9yZTogcGFnZTtjYXJldC1jb2xvcjogcmdiKDAs IDAsIDApIj4mbmJzcDsmbmJzcDsgLi4uLmRlcGVuZGluZyBvbiB0aGUgbmF0dXJlIGFuZCBuZWVk cyBvZiB0aGUgdHJhbnNtaXR0ZXIgYW5kPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47YnJlYWstYmVmb3JlOiBwYWdlIj4mbmJzcDsmbmJzcDsgcmVjZWl2ZXIu IEV2ZW4gd2l0aGluIHRoZSBjb250ZXh0IG9mIGEgZ2l2ZW4gdHJhbnNtaXR0ZXIgYW5kPG86cD48 L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YnJlYWstYmVmb3JlOiBw YWdlIj4mbmJzcDsmbmJzcDsgcmVjZWl2ZXIgcmVsYXRpb25zaGlwLCBpdCBtYXkgYmUgYXBwcm9w cmlhdGUgdG8gaWRlbnRpZnkgZGlmZmVyZW50PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW47YnJlYWstYmVmb3JlOiBwYWdlIj4mbmJzcDsmbmJzcDsgYWNjb3Vu dHMgaW4gZGlmZmVyZW50IHdheXMsIGZvciBleGFtcGxlIGlmIHNvbWUgYWNjb3VudHMgb25seSBo YXZlPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YnJlYWst YmVmb3JlOiBwYWdlIj4mbmJzcDsmbmJzcDsgZW1haWwgYWRkcmVzc2VzIGFzc29jaWF0ZWQgd2l0 aCB0aGVtIHdoaWxlIG90aGVycyBvbmx5IGhhdmUgcGhvbmU8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7Jm5ic3A7IG51bWJlcnMuJm5ic3A7IFRo ZXJlZm9yZSBpdCBjYW4gYmUgbmVjZXNzYXJ5IHRvIGluZGljYXRlIHdpdGhpbiBhIFNFVCB0aGU8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7Jm5i c3A7IG1lY2hhbmlzbSBieSB3aGljaCB0aGUgc3ViamVjdCBvZiB0aGUgc2VjdXJpdHkgZXZlbnQg aXMgYmVpbmc8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ Jm5ic3A7Jm5ic3A7IGlkZW50aWZpZWQuPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cHJlIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBjbGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNw OyA8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPldpdGg6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluO2JyZWFrLWJlZm9yZTogcGFnZTtjYXJldC1jb2xvcjogcmdiKDAs IDAsIDApIj4mbmJzcDsmbmJzcDsgLi4uZGVwZW5kaW5nIG9uIHRoZSBuYXR1cmUgYW5kIG5lZWRz IG9mIHRoZSB0cmFuc21pdHRlciBhbmQ8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjticmVhay1iZWZvcmU6IHBhZ2UiPiZuYnNwOyZuYnNwOyByZWNlaXZlci48 bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjticmVhay1iZWZv cmU6IHBhZ2UiPiZuYnNwOyAmbHQ7bmV3IHBhcmFncmFwaCZndDs8bzpwPjwvbzpwPjwvcHJlPg0K PHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjticmVhay1iZWZvcmU6IHBhZ2UiPiZuYnNwOyZu YnNwOyBXaXRoaW4gdGhlIGNvbnRleHQgb2YgYSBnaXZlbiB0cmFuc21pdHRlciBhbmQgcmVjZWl2 ZXIgcmVsYXRpb25zaGlwLCZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluO2JyZWFrLWJlZm9yZTogcGFnZSI+Jm5ic3A7Jm5ic3A7IGFjY291bnRzIG1h eSBiZSBpZGVudGlmaWVkIGluIGRpZmZlcmVudCB3YXlzLiBGb3IgZXhhbXBsZSwgc29tZSZuYnNw OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JyZWFrLWJl Zm9yZTogcGFnZSI+Jm5ic3A7Jm5ic3A7IGFjY291bnRzIG9ubHkgaGF2ZSBlbWFpbCBhZGRyZXNz ZXMgYXNzb2NpYXRlZCB3aXRoIHRoZW0gd2hpbGUgb3RoZXJzJm5ic3A7PG86cD48L286cD48L3By ZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YnJlYWstYmVmb3JlOiBwYWdlIj4mbmJz cDsmbmJzcDsgb25seSBoYXZlIHBob25lIG51bWJlcnMuIEJlY2F1c2Ugb2YgdGhlIHZhcmlhYmls aXR5IGluIHdheXMgb2YmbmJzcDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbjticmVhay1iZWZvcmU6IHBhZ2UiPiZuYnNwOyZuYnNwOyBpZGVudGlmaWNhdGlv biBhY3Jvc3MgZW50aXRpZXMsIHRoaXMmbmJzcDtzcGVjaWZpY2F0aW9uIHByb3ZpZGVzIGEgbWVj aGFuaXNtJm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW47YnJlYWstYmVmb3JlOiBwYWdlIj4mbmJzcDsmbmJzcDsgdG8gaW5kaWNhdGUgdGhlIG1lY2hh bmlzbSBieSB3aGljaCB0aGUgc3ViamVjdCBvZiB0aGUgc2VjdXJpdHkgZXZlbnQgaXMmbmJzcDs8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjticmVhay1iZWZv cmU6IHBhZ2UiPiZuYnNwOyZuYnNwOyBiZWluZyBpZGVudGlmaWVkLjxvOnA+PC9vOnA+PC9wcmU+ DQo8ZGl2Pg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48 L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5IYXZpbmcgYSBj b21iaW5hdGlvbiBvZiBmaWd1cmVzIDUgYW5kIDYgaW4gdGhlIGludHJvZHVjdGlvbiBhcyBhbiBl eGFtcGxlIG1pZ2h0IGJlIGhlbHBmdWwgdG8gZ2l2ZSB0aGUgcmVhZGVyIGEgcXVpY2sgbG9vayBh dCB3aGF0IGlzIGJlaW5nIGRlZmluZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8L2Rpdj4N CjxkaXY+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwv cHJlPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPlNlY3Rpb24gMyBhbmQgNDo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj5HZW5lcmFsOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPlRlcm1zOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlRoZSB0ZXJtcyDigJxz Y2hlbWHigJ0gYW5kIOKAnHBheWxvYWQgY2xhaW3igJ0gYXJlIG5vdCBkZWZpbmVkIG9yIHJlZmVy ZW5jZWQuICZuYnNwO1RoZSB1c2Ugc2VlbXMgaW5jb25zaXN0ZW50IHdpdGggUkZDODQxNy4gQSDi gJxwYXlsb2FkJnF1b3Q7IGlzIG5vdCBqdXN0IGEgalNPTiBvYmplY3QsIGJ1dCByYXRoZXIgaW4g ODQxNyB0aGUgcGF5bG9hZCB3YXMgYSBzZXQgb2Ygc3ViLWNsYWltcyBwbGFjZWQNCiB3aXRoaW4g YW4gZXZlbnQgdXJpIHZhbHVlIG9iamVjdC4gUGF5bG9hZCBjbGFpbXMgZG9u4oCZdCBoYXZlIHRv IGJlIHJlZ2lzdGVyZWQgSldUIGNsYWltcyBiZWNhdXNlIHRoZXkgZmFsbCB3aXRoaW4gdGhlaXIg b3duIGV2ZW50LXVyaSBvYmplY3Qgc3BhY2UuIEluIGNvbnRyYXN0LCDigJxzdWJfaWTigJ0gaXMg YSByZWdpc3RlcmVkIGNsYWltIHRvIGJlIHBsYWNlZCBpbiB0aGUgdG9wIGxldmVsIG9mIHRoZSBK V1QvU0VULiAmbmJzcDtGb3IgZXhhbXBsZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YnJlYWstYmVmb3JlOiBwYWdlIj57PG86cD48 L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vc2VydmVy LmV4YW1wbGUuY29tLyI+aHR0cHM6Ly9zZXJ2ZXIuZXhhbXBsZS5jb208L2E+JnF1b3Q7LDxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgJnF1b3Q7c3ViJnF1b3Q7OiAmcXVvdDsyNDgyODk3NjEwMDEmcXVvdDssPG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyAmcXVvdDthdWQmcXVvdDs6ICZxdW90O3M2QmhkUmtxdDMmcXVvdDssPG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NzE1NjYxNTQsPG86cD48L286cD48L3By ZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyAmcXVvdDtqdGkmcXVvdDs6ICZxdW90O2JXSnEmcXVvdDssPG86cD48L286cD48L3ByZT4NCjxw cmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxz dWJfaWTigJ18JnF1b3Q7c2lkJnF1b3Q7OiAmbHQ7SlNPTiBWYWx1ZSZndDssPG86cD48L286cD48 L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyAmcXVvdDtldmVudHMmcXVvdDs6IHs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKA nDxhIGhyZWY9Imh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvZXZlbnQvYmFja2NoYW5uZWwtbG9n b3V0Ij5lPC9hPnZlbnQtdXJpJnF1b3Q7OiB7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW47YnJlYWstYmVmb3JlOiBwYWdlIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgJmx0O3BheWxvYWQgY2xhaW1zIGhlcmUmZ3Q7PG86cD48L286cD48 L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YnJlYWstYmVmb3JlOiBwYWdlIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JyZWFrLWJlZm9yZTogcGFnZSI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjticmVhay1iZWZvcmU6IHBhZ2UiPn08bzpwPjwvbzpwPjwvcHJlPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjoj RUIzOUY2Ij5bcmljaGFubmFdPGJyPg0KQWdyZWVkLCBJIHRoaW5rIOKAnGNsYWlt4oCdIGFuZCDi gJxwYXlsb2FkIGNsYWlt4oCdIGNhbiBiZSByZXBsYWNlZCBsZXNzIHNlbWFudGljYWxseS1sb2Fk ZWQgdGVybXMgKGUuZy4sIOKAnHByb3BlcnR54oCdKSwgb3Ig4oCcbWVtYmVy4oCdIHdoZXJlIHdl IGFyZSBhY3R1YWxseSByZWZlcnJpbmcgdG8gbWVtYmVycyBvZiBhIEpTT04gb2JqZWN0LiBBbmQg d2UgY2FuIHJld29yZCB0aGUgU3ViamVjdCBJZGVudGlmaWVyIFR5cGUgZGVmaW5pdGlvbiB0byBh dm9pZCB1c2Ugb2YNCiB0aGUgd29yZCDigJxzY2hlbWHigJ0gYWx0b2dldGhlci48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0VC MzlGNiI+Wy9yaWNoYW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5GbG93OjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i Pkkgd2FzIGNvbmZ1c2VkIHJlYWRpbmcgc2VjdGlvbiAzIGJlZm9yZSBzZWN0aW9uIDQuIEkgdGhp bmsgc3BlYyBtaWdodCBmbG93IGJldHRlciB3aXRoIDMgYW5kIDQgcmV2ZXJzZWQuICZuYnNwO05v dGU6IEkgYmVsaWV2ZSBpdCBpcyBvayB0byBoYXZlIGV4YW1wbGVzIHdpdGggcGFydHMgdGhhdCBh cmUgbm90IHlldCBkZWZpbmVkLiAmbmJzcDtPciwgeW91IGNhbiBkbyBzb21ldGhpbmcNCiBsaWtl IOKAnCZsdDtzdWJqZWN0LWlkZW50aWZpZXItb2JqZWN0Jmd0O+KAnSBpbiBwbGFjZSBvZiB0aGUg dmFsdWUgb2YgYSDigJxzdWJfaWTigJ0gaW4gdGhlIGV4YW1wbGUuJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6I0VCMzlGNiI+W3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5TaW5jZSB0 aGUg4oCcc3ViX2lk4oCdIEpXVCBjbGFpbSBpcyBqdXN0IG9uZSB3YXkgdGhhdCBTdWJqZWN0IElk ZW50aWZpZXJzIG1heSBiZSB1c2VkLCBJIGRvbuKAmXQgdGhpbmsgaXQgbWFrZXMgc2Vuc2UgdG8g ZGVmaW5lIGl0IGZpcnN0LiBBcmUgeW91IGxvb2tpbmcgZm9yIHRoZSBkb2MgdG8gcHJvdmlkZSBh IGJpdCBtb3JlIGNvbmNyZXRlIGdyb3VuZGluZyBmb3IgU3ViamVjdA0KIElkZW50aWZpZXJzIGJl Zm9yZSBqdW1waW5nIGludG8gdGhlIGRlZmluaXRpb24/IFdlIGNvdWxkIGFkZCBleGFtcGxlcyB0 byB0aGUgaW50cm9kdWN0aW9uLCBzaG93aW5nIFN1YmplY3QgSWRlbnRpZmllcnMgaW4gYSBjb3Vw bGUgb2YgZGlmZmVyZW50IHVzZSBjYXNlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0VCMzlGNiI+Wy9yaWNoYW5uYV08bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj5GaWd1cmUgNyBzZWVtcyBjb25mdXNpbmcuIFdoeSB3b3VsZCBhIGR1cGxpY2F0 ZSBpZGVudGlmaWVyIGJlIHNlbnQgaW4gYm90aCBzdWIgYW5kIHN1Yl9pZD8gJm5ic3A7RG9lcyBm aWd1cmUgNyBpbXBseSB0aGF0IHRoZSBpZGVudGlmaWVycyBhcmUgYWxpYXNlcz8gU29tZSBleHBs YW5hdG9yeSB0ZXh0IChlLmcuIGJhY2t3YXJkcyBjb21wYXRpYmlsaXR5KSBtaWdodCBiZSBoZWxw ZnVsLg0KIEFsc28sIGlzIHN1Yl9pZCBpbnRlbmRlZCB0byByZXBsYWNlIOKAnHN1YuKAnT88bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5bcmljaGFubmFdPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYi PkkgcHJpbWFyaWx5IHNlZSB0aGlzIGFzIGJlaW5nIHVzZWQgZm9yIGludGVyb3BlcmFiaWxpdHkv YmFja3dhcmRzIGNvbXBhdGliaWxpdHksIGluIHBhcnRpY3VsYXIgd2hlbiBtaWdyYXRpbmcgc3lz dGVtcyB0byB1c2Ugb25lIHZlcnN1cyB0aGUgb3RoZXIuPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPlsvcmljaGFu bmFdPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+RmlndXJlIDgsIHNlZW1zIGluY29ycmVjdGx5IGNvbXBvc2VkLiBX aHkgbm90IHVzZSB0aGUgYWxpYXMgc3ViamVjdCB0eXBlIHRvIGV4cHJlc3MgdGhlcmUgYXJlIG11 bHRpcGxlIGVtYWlsIGFsaWFzZXM/ICZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNF QjM5RjYiPltyaWNoYW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0VCMzlGNiI+RmlndXJlIDggZG9lcyBub3QgZXhwcmVz cyB0aGF0IHRoZXJlIGFyZSBtdWx0aXBsZSBlbWFpbCBhZGRyZXNzZXMuIFdoaWxlIHRoZSB2YWx1 ZSBvZiB0aGUg4oCcc3Vi4oCdIGNsYWltIHJlc2VtYmxlcyBhbiBlbWFpbCBhZGRyZXNzLCBub3Ro aW5nIGluIHRoZSBKV1QgaW5kaWNhdGVzIHRoYXQgaXQgYWN0dWFsbHkgaXMgb25lLiBTaW5jZSBh IHJlY2lwaWVudCBvZiB0aGUNCiBKV1QgY2Fubm90IGJlIGNlcnRhaW4gdGhhdCB0aGUg4oCcc3Vi 4oCdIHZhbHVlIGlzIGFuIGVtYWlsIGFkZHJlc3Mgd2l0aG91dCByZWx5aW5nIG9uIGluZm9ybWF0 aW9uIG9idGFpbmVkIHRocm91Z2ggc29tZSBub24tc3RhbmRhcmQgb3V0LW9mLWJhbmQgbWVjaGFu aXNtLCBzaW11bHRhbmVvdXMgdXNhZ2Ugb2Yg4oCcc3Vi4oCdIGFuZCDigJxzdWJfaWTigJ0gY2Fu bm90IGJlIHVzZWQgdG8gZXhwcmVzcyBtdWx0aXBsZSBlbWFpbCBzdWJqZWN0IGlkZW50aWZpZXJz IGZvcg0KIHRoZSBzdWJqZWN0IGluIGFuIGludGVyb3BlcmFibGUgZmFzaGlvbi48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0VC MzlGNiI+PGJyPg0KRmlndXJlIDggaXMgYW4gYWRtaXR0ZWRseSBjb250cml2ZWQgZXhhbXBsZSBm b3IgYSBjb3JuZXIgY2FzZSB0aGF0IGlzIHBlcm1pdHRlZCBieSB0aGUgc3ludGF4LiBPbmUgdXNl IGNhc2UgbWlnaHQgYmUgYW4gb3JnYW5pemF0aW9uIHRha2luZyB0aGUgc3ViLXRvLXN1Yl9pZCBt aWdyYXRpb24gYXMgYW4gb3Bwb3J0dW5pdHkgdG8gYWxzbyBtYWtlIGNoYW5nZXMgdG8gdGhlaXIg aWRlbnRpZmllcnMsIGUuZy4sIG5vcm1hbGl6aW5nIGVtYWlsIGFkZHJlc3Nlcw0KIGZyb20gQHRl YW0xLmV4YW1wbGUuY29tLCBAdGVhbTIuZXhhbXBsZS5jb20sIGV0Yy4gdG8gQGV4YW1wbGUuY29t KS48YnI+DQpbL3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5TZWMgNC4x LiAmbmJzcDtUaGUgc3ViIGNsYWltIHNob3VsZCBiZSByZWZlcmVuY2VkIHRvIFNlYyA0LjEuMiBv ZiBSRkM3NTE5LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i Pkkgd291bGQgcHJlZmVyIGEgU0hPVUxEIHRoYXQgaW1wbGVtZW50ZXJzIHNob3VsZCBvcGVyYXRp b25hbGx5IHVzZSBlaXRoZXIg4oCcc3Vi4oCdIG9yIOKAnHN1Yl9pZOKAnSBpbiBhbnkgc2luZ2xl IEpXVCBvciBTRVQuIFRoaXMgYXZvaWRzIGNvbmZ1c2luZyBzaXR1YXRpb25zIGFuZCBsb2dpYyBh cm91bmQg4oCcaW1wbGllZOKAnSBhbGlhc2VzIHN1Y2ggYXMgaW4gRmlndXJlIDcgb3IgOC4NCiBJ dCBmZWVscyBsaWtlIGEgYmV0dGVyIHByYWN0aWNlIHRvIHVzZSB0aGUgYWxpYXMgc3ViamVjdCBp ZGVudGlmaWVyIHdoZW4gZXhwbGljaXRseSBzYXlpbmcgdHdvIGVtYWlscyBhcmUgYWxpYXNlcyBm b3IgdGhlIHNhbWUgc3ViamVjdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5b cmljaGFubmFdPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPkEgU0hPVUxEIG9uIHRoZSBpc3N1ZXIgc2lkZSBpbnRy b2R1Y2VzIHJvb20gZm9yIGludGVyb3BlcmFiaWxpdHkgaXNzdWVzIGFzIHN5c3RlbXMgd2l0aCBs ZWdpdGltYXRlIG5lZWRzIGZvciBpc3N1aW5nIEpXVHMgd2l0aCBib3RoIHJ1biB1cCBhZ2FpbnN0 IHByb2Nlc3NvcnMgdGhhdCB0cmVhdCB0aGF0IGFzIGFuIGVycm9yIGNhc2UuIEhvd2V2ZXIgSSB0 aGluaw0KIGl0IHdvdWxkIGJlIGFwcHJvcHJpYXRlIHRvIGNvbnN0cmFpbiBjb25zdW1lciBiZWhh dmlvciwgZS5nLiw6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPuKAnFdoZW4gcHJvY2Vz c2luZyBhIEpXVCBpbXBsZW1lbnRhdGlvbnMgU0hPVUxEIGRldGVybWluZSB0aGUgc3ViamVjdCB1 c2luZyBvbmUgb2YgdGhlIOKAnHN1YuKAnSBvciDigJxzdWJfaWTigJ0gY2xhaW1zLCBhbmQgU0hP VUxEIE5PVCBkZXBlbmQgb24gYm90aCBmb3IgdGhpcyBwdXJwb3NlLuKAnTxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6I0VCMzlGNiI+TWF5YmUgaXTigJlzIHdvcnRoIGV4cGxpY2l0bHkgY2Fs bGluZyBvdXQgdGhlIOKAnGJvdGjigJ0gdXNlIGNhc2UgYXMgaW50ZW5kZWQgdG8gc3VwcG9ydCBp bnRlcm9wPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5bL3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlNlY3Rpb24g NTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPllvdSBtYXkg d2FudCBzb21lIG1vcmUgZ2VuZXJhbCBhZHZpY2Ugb24gdHJhbnNtaXNzaW9uIFBJSSBhbmQgaWRl bnRpZmllcnMgaW4gZ2VuZXJhbCByYXRoZXIgdGhhbiBqdXN0IHRoZSBhbGlhcyBjYXNlLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+QXNpZGU6IGl0IG1heSBiZSB3b3J0aCB3aGlsZSBzcGVuZGluZyBtb3JlIHRpbWUgb24gQWxp YXMuIElzIHRoZSBwb2ludCB0byBjb252ZXkgbXVsdGlwbGUgaWRlbnRpZmllcnMgb2YgdGhlIHNh bWUgdHlwZT8gJm5ic3A7V2h5IHdvdWxkbuKAmXQgYW4gaXNzdWVyIG5vdCBrbm93IGhvdyB0aGUg cmVjZWl2ZXIgaWRlbnRpZmllcyBhIHN1YmplY3Q/ICZuYnNwO1NvbWUgb2YgdGhlIHVzZSBvZg0K IGFsaWFzIG1heSBzZWVtIHRvIGJlIOKAnHNwYWdoZXR0aSBvbiB0aGUgd2FsbOKAnSBldmVudCBt YXRjaGluZy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj7igJQmZ3Q7IEnigJltIG5vdCBhZ2FpbnN0IGFs aWFzLiBJIGp1c3Qgc3VzcGVjdCB3ZSBuZWVkIHRvIGp1c3RpZnkgYW5kIGNsYXJpZnkgaXRzIGFw cHJvcHJpYXRlIHVzZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2 Ij5bcmljaGFubmFdPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPkl04oCZcyBwcmV0dHkgY29tbW9uIGluIHRoZSBj b25zdW1lciBJZFAgc3BhY2UsIGJlY2F1c2UgY2xpZW50cyBkb27igJl0IGFsd2F5cyBkbyB0aGUg 4oCccmlnaHTigJ0gdGhpbmcgYW5kIGxpbmsgaWRlbnRpdGllcyBiYXNlZCBvbiDigJxpc3PigJ0m IzQzO+KAnXN1YuKAnS4gT3IgdGhlIHN1YmplY3QgaWRlbnRpZmllciBtYXkgYmUgZ29pbmcgaW50 byBhIG1lc3NhZ2UgdGhhdCBpcyBpbnRlbmRlZA0KIGZvciBhIHZhcmlldHkgb2YgcGFydGllcywg d2hpY2ggbmVlZCBkaWZmZXJlbnQgc3ViamVjdCBpZGVudGlmaWVycyAmbmJzcDsoZS5nLiwgZGlm ZmVyZW50IGZvcm1hdHMgZm9yIHRoZSBzYW1lIGlkZW50aWZpZXIgdmFsdWUpLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIz OUY2Ij5bL3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj5SZWZlcmVuY2UgUkZDODQxNyBTZWN0aW9uIDYgYW5kIFNl YyA1LjEgYXMgYXBwbHlpbmcgaGVyZT88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj5TZWN0aW9uIDYgLSBhc3N1bWluZyBSRkM4NDE3IChTRVQpIGFuZCBSRkM3 Nzk3IChKV1QpIGFzIGZvdW5kYXRpb25hbCBjb25zaWRlcmF0aW9ucz88bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5Ib3BlIHRoaXMgaGVscHMuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5QaGls IEh1bnQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5AaW5kZXBlbmRlbnRpZDxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAaW5kZXBlbmRlbnRpZC5jb20iPnBoaWwuaHVu dEBpbmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_7B29E3069C284D10B5D4A54888698153amazoncom_-- From nobody Thu Jul 9 20:55:24 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 358E23A0BE7 for ; Thu, 9 Jul 2020 20:55:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q6Cb8Np8JOAM for ; Thu, 9 Jul 2020 20:55:21 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650118.outbound.protection.outlook.com [40.107.65.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 256C33A0BD7 for ; Thu, 9 Jul 2020 20:55:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Pln5Jl5aampzRmyDrmHu2JGnvaBUlhqN0CuF17q4ghped7CKKrCEQztUxjLKEkhFXdYD+nTzFW06FDSynVqQI9RW7uqxyHjfKsTJ3znCsjdOYg2IvjOArIWubklza7BigJTJCjxpJAQTKU0Liz1i+fxiXoeP1P2xA1R//BwZz9vRwJGKgTDbQujBLRiPCKf8vWH7xN+DhltRPqCk5+KFJKt2SKlsMrt4yMHTkZw0EH9Oix2PjeXlXJwu/emnr7cnaFBZcrEfU72mSQU8x9rtV3RIVeXkltlKSgvoRURv4+kQ8GBxDB9aqgIN7kGOOMalPt84O4Busa3o2jfhS9oxXQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=x7t6xlfF2jKB4iUjmaCQ2cLnL3p8ugcERcpHLJsSec0=; b=kWnuA3+Bme9ngJP3wuRuJRrxfUTURSlm4HD3oB4dhP0BaRASDNx4MPHi6pZ6WqvpX9j7W9Bt9NQjeyo7O8mGrU3xs0PEKPY/1uakvYvySlx1vC80hC+ksfUk3Xzw4QjVbIgvdynpULAnbfz4frRVrTtEARNv6I2P4MS73z+S2rLi8++loRE5IS3cdfqLHgii+iO1i+ahIj8bixZXBNP1o5UZ21/99CVk4ADehv/WYr7dqMOjqqzq44Yvlmrfps/ujTLqbdBTujZpk+8VTdeF2OoElY8SYBsxSHgmKhwlHQgEiTlBNpJSpwaZGOZirqIBKFFhw97BoNpSIuFsngggXg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=x7t6xlfF2jKB4iUjmaCQ2cLnL3p8ugcERcpHLJsSec0=; b=TC2/WE9w5Bu59RoSO/W0rTqIjCAejs2FKvoL6x2QQ1tSixpuWeuvdw/eYDHjMp/hNqQCi6oWcWmph5e03Dg9MZt+459PTT7IvUXILXhk1JsYpzjOWuqrTFW8lIWLREcU681TAQKPvtNhg3KuTCzuRXQ+YO7pmaTe1jVJRiIjWWs= Received: from BY5PR00MB0676.namprd00.prod.outlook.com (2603:10b6:a03:20c::15) by BY5PR00MB0676.namprd00.prod.outlook.com (2603:10b6:a03:20c::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3215.0; Fri, 10 Jul 2020 03:55:18 +0000 Received: from BY5PR00MB0676.namprd00.prod.outlook.com ([fe80::3dd4:611a:6b63:15fe]) by BY5PR00MB0676.namprd00.prod.outlook.com ([fe80::3dd4:611a:6b63:15fe%3]) with mapi id 15.20.3215.000; Fri, 10 Jul 2020 03:55:18 +0000 From: Mike Jones To: "id-event@ietf.org" Thread-Topic: Review of draft-ietf-secevent-subject-identifiers-05 by Michael Jones Thread-Index: AdZWXhwXIwwWD9McR5OirUlEvStrBA== Date: Fri, 10 Jul 2020 03:55:18 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=54fc7f77-c97e-4611-8e8b-16e99c3bca74; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-09T18:29:48Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 056a4258-9076-45b3-5106-08d824850fea x-ms-traffictypediagnostic: BY5PR00MB0676: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: xMl2Bs8J5eskYoXDoSvpjjojEgwgfkAYon1gEzmdSPwrRKyf1jStDcECX4cV5WNAs38sUMWFEc7dDeEkjZWqVLbtMbizqviB77q+1b2eBNKDXNZ+Vd/j/lEQL9+wM9iWWUy6GvGK0P1ifHHJ1Bd7DctO/0uYCSwUxE37lLjaWkKJK+HEcuhMa55joHNaf2NhQdqqM8+58w/0QkPj7S2onX3jpxneWlpJvZaLHAYORmAh78g7X3Szh8n6E2loei0WZrlRznqGXjzcpn+xd0rKAzFjiqmEaWTZWHjFyDqpIUrVhjeXD5XqTgUF7suC4raxgzMsCJ08GSTZC1WnK3zZUuemRds0DUan4qR1iJMuSAgAwwjnEkglrYGAa2GEBW1A7zU6HoW/hbzX1m3ParilkQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR00MB0676.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(366004)(136003)(346002)(396003)(376002)(186003)(7696005)(33656002)(26005)(83380400001)(166002)(9686003)(71200400001)(86362001)(82960400001)(8936002)(8676002)(82950400001)(55016002)(2906002)(316002)(10290500003)(8990500004)(6916009)(6506007)(478600001)(5660300002)(66946007)(966005)(52536014)(76116006)(64756008)(66556008)(66476007)(66446008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: fRRN0UAYAjO+JgELCehQtVvDEn//NMBnRcQz9kmM3xtx9SJc3mwXGZclVIprauzNOhdbciQdiX9dwt+NbiKioJkXjpOlJex8kcSmqUMEhKuvFDaCLLMDcHXazjwLDaibWY/VsZbmp08cLvNnwhaTGgH4IxPJiDunQaDXS0h7GqONV3Di7Hf3i3qpg95XBy7qYScaMP0sJeIsLgRQz6cQx7yCY0HviCA+8KTcnjtBRcBVXPxRvwTMSFmOUitXSgFFyHJ9lwW0Xr+XLPq4vh317QgUbijJ9ylV1Rw+sgjsEdvJ+tIsADGXIVF9yAehRkjeij6fTALt5d5Gt0BT6CtIj44jCQg8JyfO5vubDgplp9M17xT+RWaw/+lUzh4eEpiJZs/sd1g52wzkFT+LdnG9d8Pc+avaZzjTxvwwygR3/HSXtZWgJs1aglZbCCILLRrTobDmNot5Z0I9wvWM2eB9HO+gHUjCIDVftvTor+XaR74= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BY5PR00MB0676DAA4C5ECC281853BDA15F5650BY5PR00MB0676namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR00MB0676.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 056a4258-9076-45b3-5106-08d824850fea X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Jul 2020 03:55:18.7208 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: O7k80duS/zi6tE217ZWP9X5q8usY7EPJPX1/jYsjiz5XZ+69wzkeaNK6Bs+sttd0pvssSf/Dq/JOOwpVyHaTxw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR00MB0676 Archived-At: Subject: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 by Michael Jones X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jul 2020 03:55:23 -0000 --_000_BY5PR00MB0676DAA4C5ECC281853BDA15F5650BY5PR00MB0676namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I did a cover-to-cover read of draft-ietf-secevent-subject-identifiers-05. = My resulting review comments follow, grouped into substantive and editoria= l sections. SUBSTANTIVE COMMENTS Abstract - Remove [JSON], [JWT], and [SET] references. Past IESG reviews o= f other specs have told me that citations are not allowed in abstracts, sin= ce they need to stand alone without the rest of the specification. 2. Notational Conventions Copy https://tools.ietf.org/html/draft-ietf-secevent-http-poll-12#section-1= .2 and make it a Definitions or Terminology sub-section under the current N= otational Conventions section. 3. Subject Identifiers - The language "Every Subject Identifier Type MUST = have a unique name registered..." is surprisingly different that the corres= ponding JWT spec language with also allows Private identifiers and Collisio= n-Resistant identifiers. Why not also allow them here? 3. Subject Identifiers - The term "payload claims" is confusing. Please c= hange this term to "Subject Identification Claims" throughout the specifica= tion. 3.1. Account Subject Identifier Type - Figure 1 - This figure is confusing = because it makes it seem like "subject_type" and "uri" are top-level JWT cl= aims. Please correct this possible confusion by adding "sub_id": to the ex= ample. The updated example would look like this: "sub_id": { "subject_type": "account", "uri": "acct:example.user@service.example.com", } Also add "sub_id": to all other examples, such as those in 3.2, 3.3, 3.4, e= tc. 3.2.1 Email Canonicalization - Please add a note that the domain portion of= an RFC 5322 addr-spec already must be treated in a case-insensitive manner= , per RFC 1034. 3.3. Phone Number Subject Identifier - Please change all instances of "phon= e-number" to "phone_number" to match the JWT claim of the same name. This = occurs multiple times throughout the specification. 3.4. Issuer and Subject Subject Type Identifier - Add a note that this is t= he way that subjects are identified in OpenID Connect ID Tokens. 5.1. Identifier Correlation - Add this phrase to the end of the last senten= ce "or when correlation is essential to the use case". 6. Security Considerations - Talk about integrity-protecting SETs. Borrow = or reference security considerations from the other SecEvent specs. 7.1. Security Even Subject Identifier Types Registry - Please add a suggest= ion to IANA that this registry be located at https://www.iana.org/assignmen= ts/secevent/. 7.1.1. Registration Template - Add underscore "_" to the set of acceptable = characters. 7.1.1. Registration Template - Change Controller - Remove OpenID statements= and replace them by IETF specifications and "IETF". 7.1.1. Registration Template - Defining Document(s) - Also add "prohibited"= to the list of conditions to be described. 7.1.3. Guidance for Expert Reviewers - State that multiple Expert Reviewers= should be appointed. You can borrow language about that from RFC 7519.. 7.2. JSON Web Token Claims Registration - Change "established by [SET]" to = "established by "[JWT]". Acknowledgements - Also acknowledge the SecEvent working group and its memb= ers. EDITORIAL COMMENTS 1. Introduction - Change "section 1.2" to "Section 1.2" (and similarly chan= ge to Title Case for any other occurrences of "section", "figure", or "tabl= e"). 1. Introduction - Add a comma after "but not limited to". 1. Introduction - Add a comma after "for example". 2. Notational Conventions - Update to use RFC 8417 language. 3. Subject Identifiers - Change "which" to "that" in "which are to be inte= rpreted" 3.1. Account Subject Identifier Type - Figure 1 - It's odd to have a period= ending a sentence fragment. Delete the period at the end of the figure ca= ption. Do this for all other figures when the caption is also a sentence f= ragment, such as Figure 2, Figure 3, Figure 4, etc. 4.1. "sub_id" Claim - Change "sub_id" to sub_id in the source so that the formatting is correctly applied across all out= put representations. Similarly, use spanx style verb for all other instanc= es of literals in the specification. 4.1. "sub_id" Claim - Likewise, change `sub` to sub and `sub_id` to sub_id. Search for ot= her similar instances of uses of " ' or ` in the spec and correct them to s= panx style verb. 4.2. "sub_id" and "iss-sub" Subject Identifiers - This section seems to rep= eat information in Section 3.4 (Issuer and Subject Subject Identifier Type)= . Please consolidate them. 8.1. Normative References - IANA.JWT.Claims - Delete the odd text "n.d.,". 8.1. Normative References - Choose one of [JWT] or [RFC7519] and delete the= other one. 8.1. Informative References - Change [OIDC] to the standard reference name = [OpenID.Core]. -- Mike --_000_BY5PR00MB0676DAA4C5ECC281853BDA15F5650BY5PR00MB0676namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I did a cover-to-cover read of draft-ietf-secevent-s= ubject-identifiers-05.  My resulting review comments follow, grouped i= nto substantive and editorial sections.

 

SUBSTANTIVE COMMENTS

 

Abstract – Remove [JSON], [JWT], and [SET] ref= erences.  Past IESG reviews of other specs have told me that citations= are not allowed in abstracts, since they need to stand alone without the r= est of the specification.

 

2.  Notational Conventions

 

Copy https://tools.ietf.org/html/draft-ietf-secevent-http-poll-12#section-1.2 and make it a Definitions or Terminology sub-section under the current No= tational Conventions section.

 

3.  Subject Identifiers – The language &#= 8220;Every Subject Identifier Type MUST have a unique name registered…= ;” is surprisingly different that the corresponding JWT spec language= with also allows Private identifiers and Collision-Resistant identifiers.&= nbsp; Why not also allow them here?

 

3.  Subject Identifiers – The term “= ;payload claims” is confusing.  Please change this term to ̶= 0;Subject Identification Claims” throughout the specification.

 

3.1. Account Subject Identifier Type – Figure = 1 – This figure is confusing because it makes it seem like “sub= ject_type” and “uri” are top-level JWT claims.  Plea= se correct this possible confusion by adding "sub_id": to the example.  The updated example = would look like this:

 

   "sub_id": {<= /span>

     "subject_type&qu= ot;: "account",

     "uri": &quo= t;acct:example.user@service.example.com",

   }

 

Also add "sub_id": to all other examples, such as those in 3.2, 3.3= , 3.4, etc.

 

3.2.1 Email Canonicalization – Please add a no= te that the domain portion of an RFC 5322 addr-spec already must be treated= in a case-insensitive manner, per RFC 1034.

 

3.3. Phone Number Subject Identifier – Please = change all instances of “phone-number” to “phone_number&#= 8221; to match the JWT claim of the same name.  This occurs multiple t= imes throughout the specification.

 

3.4. Issuer and Subject Subject Type Identifier R= 11; Add a note that this is the way that subjects are identified in OpenID = Connect ID Tokens.

 

5.1. Identifier Correlation – Add this phrase = to the end of the last sentence “or when correlation is essential to = the use case”.

 

6. Security Considerations – Talk about integr= ity-protecting SETs.  Borrow or reference security considerations from= the other SecEvent specs.

 

7.1. Security Even Subject Identifier Types Registry= – Please add a suggestion to IANA that this registry be located at https://www.iana.org= /assignments/secevent/.

 

7.1.1. Registration Template – Add underscore = “_” to the set of acceptable characters.

 

7.1.1. Registration Template – Change Controll= er – Remove OpenID statements and replace them by IETF specifications= and “IETF”.

 

7.1.1. Registration Template – Defining Docume= nt(s) – Also add “prohibited” to the list of conditions t= o be described.

 

7.1.3. Guidance for Expert Reviewers – State t= hat multiple Expert Reviewers should be appointed.  You can borrow lan= guage about that from RFC 7519..

 

7.2. JSON Web Token Claims Registration – Chan= ge “established by [SET]” to “established by “[JWT]= ”.

 

Acknowledgements – Also acknowledge the SecEve= nt working group and its members.

 

EDITORIAL COMMENTS

 

1. Introduction – Change “section 1.2= 221; to “Section 1.2” (and similarly change to Title Case for a= ny other occurrences of “section”, “figure”, or = 220;table”).

 

1. Introduction – Add a comma after “but= not limited to”.

 

1. Introduction – Add a comma after “for= example”.

 

2.  Notational Conventions – Update to us= e RFC 8417 language.

 

3.  Subject Identifiers – Change “w= hich” to “that” in “which are to be interpretedR= 21;

 

3.1. Account Subject Identifier Type – Figure = 1 – It’s odd to have a period ending a sentence fragment. = Delete the period at the end of the figure caption.  Do this for all = other figures when the caption is also a sentence fragment, such as Figure 2, Figure 3, Figure 4, etc.

 

4.1. "sub_id" Claim – Change "s= ub_id" to <spanx style=3D"verb">sub_id</spanx> i= n the source so that the formatting is correctly applied across all output = representations.  Similarly, use spanx style verb for all other instan= ces of literals in the specification.

 

4.1. "sub_id" Claim – Likewise, chan= ge `sub` to <spanx style=3D"verb">sub</spanx> and `su= b_id` to <spanx style=3D"verb">sub_id</spanx>.  = Search for other similar instances of uses of " ' or ` in the spec and= correct them to spanx style verb.

 

4.2. “sub_id” and “iss-sub” = Subject Identifiers – This section seems to repeat information in Sec= tion 3.4 (Issuer and Subject Subject Identifier Type).  Please consoli= date them.

 

8.1. Normative References – IANA.JWT.Claims &#= 8211; Delete the odd text “n.d.,”.

 

8.1. Normative References – Choose one of [JWT= ] or [RFC7519] and delete the other one.

 

8.1. Informative References – Change [OIDC] to= the standard reference name [OpenID.Core].

 

        &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;        -- Mike

 

 

--_000_BY5PR00MB0676DAA4C5ECC281853BDA15F5650BY5PR00MB0676namp_-- From nobody Fri Jul 10 14:56:48 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C67B83A0B5B for ; Fri, 10 Jul 2020 14:56:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.597 X-Spam-Level: X-Spam-Status: No, score=-9.597 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XNej-trcmw7F for ; Fri, 10 Jul 2020 14:56:37 -0700 (PDT) Received: from smtp-fw-6001.amazon.com (smtp-fw-6001.amazon.com [52.95.48.154]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66EFD3A0C22 for ; Fri, 10 Jul 2020 14:56:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1594418193; x=1625954193; h=from:to:date:message-id:references:in-reply-to: mime-version:subject; bh=hFILIXVQTR1pH3hUHnhWJsodoqkEKYuPmw5ZHOF207I=; b=fRMGMcrRNX6ve+pbgZmeSwfiH+cq9UubvAp1NEAGy07S1I4Qx9mCJw5+ 60Bx8/BPtNgJ+uGe/iBg05U/rYblFX8nrx1aUb173TrDFm2n8rECV7TV4 EG2Mneeoq4EuTFm7iV4inBqO0vzb/11aUJbaHLbzY+DMcwwJlHrS9bwKa 0=; IronPort-SDR: VlcZ0GSTExYG4421PVDTcbXmk/VZYEn6Gt0L0YIGZDhAhp6NF+VhiqMRWofoNTJAi1BOEolrZR G74CQsCzyvEg== X-IronPort-AV: E=Sophos; i="5.75,336,1589241600"; d="scan'208,217"; a="42668473" Thread-Topic: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 by Michael Jones Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-1a-821c648d.us-east-1.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6001.iad6.amazon.com with ESMTP; 10 Jul 2020 21:56:32 +0000 Received: from EX13MTAUWC001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan2.iad.amazon.com [10.40.159.162]) by email-inbound-relay-1a-821c648d.us-east-1.amazon.com (Postfix) with ESMTPS id 2DEC1A17B4; Fri, 10 Jul 2020 21:56:30 +0000 (UTC) Received: from EX13D11UWC003.ant.amazon.com (10.43.162.162) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 10 Jul 2020 21:56:30 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC003.ant.amazon.com (10.43.162.162) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 10 Jul 2020 21:56:30 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Fri, 10 Jul 2020 21:56:30 +0000 From: "Richard Backman, Annabelle" To: Mike Jones , "id-event@ietf.org" Thread-Index: AdZWXhwXIwwWD9McR5OirUlEvStrBAAbC6SA Date: Fri, 10 Jul 2020 21:56:30 +0000 Message-ID: <3B0F8089-26CD-46F6-ACC4-B239358BF051@amazon.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.65] Content-Type: multipart/alternative; boundary="_000_3B0F808926CD46F6ACC4B239358BF051amazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 by Michael Jones X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jul 2020 21:56:46 -0000 --_000_3B0F808926CD46F6ACC4B239358BF051amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aGUgcmV2aWV3LCBNaWtlLiBJIGhhZCBhIGZldyBmb2xsb3cgdXAgcXVlc3Rp b25zIFtyaWNoYW5uYV0gaW5saW5lIFsvcmljaGFubmFdLg0KDQrigJMNCkFubmFiZWxsZSBCYWNr bWFuIChzaGUvaGVyKQ0KQVdTIElkZW50aXR5DQpodHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50 aXR5Lw0KDQoNCkZyb206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPiBvbiBi ZWhhbGYgb2YgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lcz00MG1pY3Jvc29mdC5jb21AZG1hcmMu aWV0Zi5vcmc+DQpEYXRlOiBUaHVyc2RheSwgSnVseSA5LCAyMDIwIGF0IDg6NTUgUE0NClRvOiAi aWQtZXZlbnRAaWV0Zi5vcmciIDxpZC1ldmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFtFWFRFUk5B TF0gW0lkLWV2ZW50XSBSZXZpZXcgb2YgZHJhZnQtaWV0Zi1zZWNldmVudC1zdWJqZWN0LWlkZW50 aWZpZXJzLTA1IGJ5IE1pY2hhZWwgSm9uZXMNCg0KDQpDQVVUSU9OOiBUaGlzIGVtYWlsIG9yaWdp bmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRpb24uIERvIG5vdCBjbGljayBsaW5r cyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcyB5b3UgY2FuIGNvbmZpcm0gdGhlIHNlbmRlciBh bmQga25vdyB0aGUgY29udGVudCBpcyBzYWZlLg0KDQoNCkkgZGlkIGEgY292ZXItdG8tY292ZXIg cmVhZCBvZiBkcmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmllcnMtMDUuICBNeSBy ZXN1bHRpbmcgcmV2aWV3IGNvbW1lbnRzIGZvbGxvdywgZ3JvdXBlZCBpbnRvIHN1YnN0YW50aXZl IGFuZCBlZGl0b3JpYWwgc2VjdGlvbnMuDQoNClNVQlNUQU5USVZFIENPTU1FTlRTDQoNCkFic3Ry YWN0IOKAkyBSZW1vdmUgW0pTT05dLCBbSldUXSwgYW5kIFtTRVRdIHJlZmVyZW5jZXMuICBQYXN0 IElFU0cgcmV2aWV3cyBvZiBvdGhlciBzcGVjcyBoYXZlIHRvbGQgbWUgdGhhdCBjaXRhdGlvbnMg YXJlIG5vdCBhbGxvd2VkIGluIGFic3RyYWN0cywgc2luY2UgdGhleSBuZWVkIHRvIHN0YW5kIGFs b25lIHdpdGhvdXQgdGhlIHJlc3Qgb2YgdGhlIHNwZWNpZmljYXRpb24uDQoNCjIuICBOb3RhdGlv bmFsIENvbnZlbnRpb25zDQoNCkNvcHkgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0 LWlldGYtc2VjZXZlbnQtaHR0cC1wb2xsLTEyI3NlY3Rpb24tMS4yIGFuZCBtYWtlIGl0IGEgRGVm aW5pdGlvbnMgb3IgVGVybWlub2xvZ3kgc3ViLXNlY3Rpb24gdW5kZXIgdGhlIGN1cnJlbnQgTm90 YXRpb25hbCBDb252ZW50aW9ucyBzZWN0aW9uLg0KDQozLiAgU3ViamVjdCBJZGVudGlmaWVycyDi gJMgVGhlIGxhbmd1YWdlIOKAnEV2ZXJ5IFN1YmplY3QgSWRlbnRpZmllciBUeXBlIE1VU1QgaGF2 ZSBhIHVuaXF1ZSBuYW1lIHJlZ2lzdGVyZWTigKbigJ0gaXMgc3VycHJpc2luZ2x5IGRpZmZlcmVu dCB0aGF0IHRoZSBjb3JyZXNwb25kaW5nIEpXVCBzcGVjIGxhbmd1YWdlIHdpdGggYWxzbyBhbGxv d3MgUHJpdmF0ZSBpZGVudGlmaWVycyBhbmQgQ29sbGlzaW9uLVJlc2lzdGFudCBpZGVudGlmaWVy cy4gIFdoeSBub3QgYWxzbyBhbGxvdyB0aGVtIGhlcmU/DQoNCltyaWNoYW5uYV0NCkZ1bm5pbHkg ZW5vdWdoLCB0aGlzIGV4YWN0IHRoaW5nIGNhbWUgdXAgb24gdGhlIE9JREYgU1NFIGNhbGwgdGhp cyB3ZWVrLiDwn5iDDQpbL3JpY2hhbm5hXQ0KDQozLiAgU3ViamVjdCBJZGVudGlmaWVycyDigJMg VGhlIHRlcm0g4oCccGF5bG9hZCBjbGFpbXPigJ0gaXMgY29uZnVzaW5nLiAgUGxlYXNlIGNoYW5n ZSB0aGlzIHRlcm0gdG8g4oCcU3ViamVjdCBJZGVudGlmaWNhdGlvbiBDbGFpbXPigJ0gdGhyb3Vn aG91dCB0aGUgc3BlY2lmaWNhdGlvbi4NCg0KW3JpY2hhbm5hXQ0KQWdyZWVkIG9uIG5vdCB1c2lu ZyDigJxwYXlsb2FkIGNsYWltc+KAnS4gUmVwbGFjZW1lbnQgaXMgVEJELCBidXQgSSB0aGluayB3 ZSBjYW4gYW5kIHNob3VsZCBhdm9pZCB0aGUgd29yZCDigJxjbGFpbeKAnSBoZXJlLCBzaW5jZSB0 aGF0IGlzIGEgdmVyeSBzcGVjaWZpYyB0aGluZyBpbiB0aGUgSldUIHdvcmxkLg0KWy9yaWNoYW5u YV0NCg0KMy4xLiBBY2NvdW50IFN1YmplY3QgSWRlbnRpZmllciBUeXBlIOKAkyBGaWd1cmUgMSDi gJMgVGhpcyBmaWd1cmUgaXMgY29uZnVzaW5nIGJlY2F1c2UgaXQgbWFrZXMgaXQgc2VlbSBsaWtl IOKAnHN1YmplY3RfdHlwZeKAnSBhbmQg4oCcdXJp4oCdIGFyZSB0b3AtbGV2ZWwgSldUIGNsYWlt cy4gIFBsZWFzZSBjb3JyZWN0IHRoaXMgcG9zc2libGUgY29uZnVzaW9uIGJ5IGFkZGluZyAic3Vi X2lkIjogdG8gdGhlIGV4YW1wbGUuICBUaGUgdXBkYXRlZCBleGFtcGxlIHdvdWxkIGxvb2sgbGlr ZSB0aGlzOg0KDQogICAic3ViX2lkIjogew0KICAgICAic3ViamVjdF90eXBlIjogImFjY291bnQi LA0KICAgICAidXJpIjogImFjY3Q6ZXhhbXBsZS51c2VyQHNlcnZpY2UuZXhhbXBsZS5jb20iLA0K ICAgfQ0KDQpBbHNvIGFkZCAic3ViX2lkIjogdG8gYWxsIG90aGVyIGV4YW1wbGVzLCBzdWNoIGFz IHRob3NlIGluIDMuMiwgMy4zLCAzLjQsIGV0Yy4NCg0KW3JpY2hhbm5hXQ0KU3ViamVjdCBJZGVu dGlmaWVycyBjYW4gb2NjdXIgb3V0c2lkZSBvZiBKV1RzLCBhbmQgbm90IG9ubHkgYXMgdGhlIHZh bHVlIG9mIHRoZSBKV1Qg4oCcc3ViX2lk4oCdIGNsYWltLiBBZGRpbmcgY29udGV4dCByZXByZXNl bnRpbmcgb25lIHVzZSBjYXNlIGZvciBTdWJqZWN0IElkZW50aWZpZXJzIG1ha2VzIHRoZXNlIGV4 YW1wbGVzIHVubmVjZXNzYXJpbHkgY29tcGxpY2F0ZWQuIEkgc3VnZ2VzdGVkIG9uIFBoaWzigJlz IHJldmlldyB0aGF0IHdlIGNvdWxkIGFkZCBleGFtcGxlcyBvZiBTdWJqZWN0IElkZW50aWZpZXJz IGJlaW5nIHVzZWQgaW4gY29udGV4dCAoZS5nLiwgYXMgYSDigJxzdWJfaWTigJ0gY2xhaW0gb3Ig ZW1iZWRkZWQgd2l0aGluIGEgU0VUIGV2ZW50IHBheWxvYWQpIGVhcmxpZXIgaW4gdGhlIGRvYywg YW5kIG1vdmUgYXdheSBmcm9tIHVzaW5nIOKAnGNsYWlt4oCdIHRvIHJlZmVyIHRvIHRoZSBtZW1i ZXJzIHdpdGhpbiBhIFN1YmplY3QgSWRlbnRpZmllciBKU09OIG9iamVjdC4gV291bGQgdGhhdCBh ZGRyZXNzIHlvdXIgY29uY2Vybj8NClsvcmljaGFubmFdDQoNCjMuMi4xIEVtYWlsIENhbm9uaWNh bGl6YXRpb24g4oCTIFBsZWFzZSBhZGQgYSBub3RlIHRoYXQgdGhlIGRvbWFpbiBwb3J0aW9uIG9m IGFuIFJGQyA1MzIyIGFkZHItc3BlYyBhbHJlYWR5IG11c3QgYmUgdHJlYXRlZCBpbiBhIGNhc2Ut aW5zZW5zaXRpdmUgbWFubmVyLCBwZXIgUkZDIDEwMzQuDQoNCltyaWNoYW5uYV0NCkl0IHN0cmlr ZXMgbWUgYXMgd2VpcmQgdG8gcHVsbCB0aGlzIGludG8gdGhlIGRvYy4gSWYgd2UgY2hhbmdlZCB0 aGUgc2Vjb25kIHNlbnRlbmNlIG9mIDMuMi4xIHRvIHNwZWNpZnkgdGhlIGxvY2FsIHBhcnQsIGUu Zy4sIOKAnHNvbWUgcHJvdmlkZXJzIHRyZWF0IHRoZSBsb2NhbCBwYXJ0IG9mIGVtYWlsIGFkZHJl c3NlcyBhcyBjYXNlLWluc2Vuc2l0aXZl4oCdIHdvdWxkIHRoYXQgYWRkcmVzcyB5b3VyIGNvbmNl cm4/DQpbL3JpY2hhbm5hXQ0KDQozLjMuIFBob25lIE51bWJlciBTdWJqZWN0IElkZW50aWZpZXIg 4oCTIFBsZWFzZSBjaGFuZ2UgYWxsIGluc3RhbmNlcyBvZiDigJxwaG9uZS1udW1iZXLigJ0gdG8g 4oCccGhvbmVfbnVtYmVy4oCdIHRvIG1hdGNoIHRoZSBKV1QgY2xhaW0gb2YgdGhlIHNhbWUgbmFt ZS4gIFRoaXMgb2NjdXJzIG11bHRpcGxlIHRpbWVzIHRocm91Z2hvdXQgdGhlIHNwZWNpZmljYXRp b24uDQoNCjMuNC4gSXNzdWVyIGFuZCBTdWJqZWN0IFN1YmplY3QgVHlwZSBJZGVudGlmaWVyIOKA kyBBZGQgYSBub3RlIHRoYXQgdGhpcyBpcyB0aGUgd2F5IHRoYXQgc3ViamVjdHMgYXJlIGlkZW50 aWZpZWQgaW4gT3BlbklEIENvbm5lY3QgSUQgVG9rZW5zLg0KDQo1LjEuIElkZW50aWZpZXIgQ29y cmVsYXRpb24g4oCTIEFkZCB0aGlzIHBocmFzZSB0byB0aGUgZW5kIG9mIHRoZSBsYXN0IHNlbnRl bmNlIOKAnG9yIHdoZW4gY29ycmVsYXRpb24gaXMgZXNzZW50aWFsIHRvIHRoZSB1c2UgY2FzZeKA nS4NCg0KNi4gU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMg4oCTIFRhbGsgYWJvdXQgaW50ZWdyaXR5 LXByb3RlY3RpbmcgU0VUcy4gIEJvcnJvdyBvciByZWZlcmVuY2Ugc2VjdXJpdHkgY29uc2lkZXJh dGlvbnMgZnJvbSB0aGUgb3RoZXIgU2VjRXZlbnQgc3BlY3MuDQoNCjcuMS4gU2VjdXJpdHkgRXZl biBTdWJqZWN0IElkZW50aWZpZXIgVHlwZXMgUmVnaXN0cnkg4oCTIFBsZWFzZSBhZGQgYSBzdWdn ZXN0aW9uIHRvIElBTkEgdGhhdCB0aGlzIHJlZ2lzdHJ5IGJlIGxvY2F0ZWQgYXQgaHR0cHM6Ly93 d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvc2VjZXZlbnQvLg0KDQo3LjEuMS4gUmVnaXN0cmF0aW9u IFRlbXBsYXRlIOKAkyBBZGQgdW5kZXJzY29yZSDigJxf4oCdIHRvIHRoZSBzZXQgb2YgYWNjZXB0 YWJsZSBjaGFyYWN0ZXJzLg0KDQo3LjEuMS4gUmVnaXN0cmF0aW9uIFRlbXBsYXRlIOKAkyBDaGFu Z2UgQ29udHJvbGxlciDigJMgUmVtb3ZlIE9wZW5JRCBzdGF0ZW1lbnRzIGFuZCByZXBsYWNlIHRo ZW0gYnkgSUVURiBzcGVjaWZpY2F0aW9ucyBhbmQg4oCcSUVURuKAnS4NCg0KNy4xLjEuIFJlZ2lz dHJhdGlvbiBUZW1wbGF0ZSDigJMgRGVmaW5pbmcgRG9jdW1lbnQocykg4oCTIEFsc28gYWRkIOKA nHByb2hpYml0ZWTigJ0gdG8gdGhlIGxpc3Qgb2YgY29uZGl0aW9ucyB0byBiZSBkZXNjcmliZWQu DQoNCjcuMS4zLiBHdWlkYW5jZSBmb3IgRXhwZXJ0IFJldmlld2VycyDigJMgU3RhdGUgdGhhdCBt dWx0aXBsZSBFeHBlcnQgUmV2aWV3ZXJzIHNob3VsZCBiZSBhcHBvaW50ZWQuICBZb3UgY2FuIGJv cnJvdyBsYW5ndWFnZSBhYm91dCB0aGF0IGZyb20gUkZDIDc1MTkuLg0KDQo3LjIuIEpTT04gV2Vi IFRva2VuIENsYWltcyBSZWdpc3RyYXRpb24g4oCTIENoYW5nZSDigJxlc3RhYmxpc2hlZCBieSBb U0VUXeKAnSB0byDigJxlc3RhYmxpc2hlZCBieSDigJxbSldUXeKAnS4NCg0KQWNrbm93bGVkZ2Vt ZW50cyDigJMgQWxzbyBhY2tub3dsZWRnZSB0aGUgU2VjRXZlbnQgd29ya2luZyBncm91cCBhbmQg aXRzIG1lbWJlcnMuDQoNCkVESVRPUklBTCBDT01NRU5UUw0KDQoxLiBJbnRyb2R1Y3Rpb24g4oCT IENoYW5nZSDigJxzZWN0aW9uIDEuMuKAnSB0byDigJxTZWN0aW9uIDEuMuKAnSAoYW5kIHNpbWls YXJseSBjaGFuZ2UgdG8gVGl0bGUgQ2FzZSBmb3IgYW55IG90aGVyIG9jY3VycmVuY2VzIG9mIOKA nHNlY3Rpb27igJ0sIOKAnGZpZ3VyZeKAnSwgb3Ig4oCcdGFibGXigJ0pLg0KDQoxLiBJbnRyb2R1 Y3Rpb24g4oCTIEFkZCBhIGNvbW1hIGFmdGVyIOKAnGJ1dCBub3QgbGltaXRlZCB0b+KAnS4NCg0K MS4gSW50cm9kdWN0aW9uIOKAkyBBZGQgYSBjb21tYSBhZnRlciDigJxmb3IgZXhhbXBsZeKAnS4N Cg0KMi4gIE5vdGF0aW9uYWwgQ29udmVudGlvbnMg4oCTIFVwZGF0ZSB0byB1c2UgUkZDIDg0MTcg bGFuZ3VhZ2UuDQoNCjMuICBTdWJqZWN0IElkZW50aWZpZXJzIOKAkyBDaGFuZ2Ug4oCcd2hpY2ji gJ0gdG8g4oCcdGhhdOKAnSBpbiDigJx3aGljaCBhcmUgdG8gYmUgaW50ZXJwcmV0ZWTigJ0NCg0K My4xLiBBY2NvdW50IFN1YmplY3QgSWRlbnRpZmllciBUeXBlIOKAkyBGaWd1cmUgMSDigJMgSXTi gJlzIG9kZCB0byBoYXZlIGEgcGVyaW9kIGVuZGluZyBhIHNlbnRlbmNlIGZyYWdtZW50LiAgRGVs ZXRlIHRoZSBwZXJpb2QgYXQgdGhlIGVuZCBvZiB0aGUgZmlndXJlIGNhcHRpb24uICBEbyB0aGlz IGZvciBhbGwgb3RoZXIgZmlndXJlcyB3aGVuIHRoZSBjYXB0aW9uIGlzIGFsc28gYSBzZW50ZW5j ZSBmcmFnbWVudCwgc3VjaCBhcyBGaWd1cmUgMiwgRmlndXJlIDMsIEZpZ3VyZSA0LCBldGMuDQoN CjQuMS4gInN1Yl9pZCIgQ2xhaW0g4oCTIENoYW5nZSAic3ViX2lkIiB0byA8c3Bhbnggc3R5bGU9 InZlcmIiPnN1Yl9pZDwvc3Bhbng+IGluIHRoZSBzb3VyY2Ugc28gdGhhdCB0aGUgZm9ybWF0dGlu ZyBpcyBjb3JyZWN0bHkgYXBwbGllZCBhY3Jvc3MgYWxsIG91dHB1dCByZXByZXNlbnRhdGlvbnMu ICBTaW1pbGFybHksIHVzZSBzcGFueCBzdHlsZSB2ZXJiIGZvciBhbGwgb3RoZXIgaW5zdGFuY2Vz IG9mIGxpdGVyYWxzIGluIHRoZSBzcGVjaWZpY2F0aW9uLg0KDQo0LjEuICJzdWJfaWQiIENsYWlt IOKAkyBMaWtld2lzZSwgY2hhbmdlIGBzdWJgIHRvIDxzcGFueCBzdHlsZT0idmVyYiI+c3ViPC9z cGFueD4gYW5kIGBzdWJfaWRgIHRvIDxzcGFueCBzdHlsZT0idmVyYiI+c3ViX2lkPC9zcGFueD4u ICBTZWFyY2ggZm9yIG90aGVyIHNpbWlsYXIgaW5zdGFuY2VzIG9mIHVzZXMgb2YgIiAnIG9yIGAg aW4gdGhlIHNwZWMgYW5kIGNvcnJlY3QgdGhlbSB0byBzcGFueCBzdHlsZSB2ZXJiLg0KDQo0LjIu IOKAnHN1Yl9pZOKAnSBhbmQg4oCcaXNzLXN1YuKAnSBTdWJqZWN0IElkZW50aWZpZXJzIOKAkyBU aGlzIHNlY3Rpb24gc2VlbXMgdG8gcmVwZWF0IGluZm9ybWF0aW9uIGluIFNlY3Rpb24gMy40IChJ c3N1ZXIgYW5kIFN1YmplY3QgU3ViamVjdCBJZGVudGlmaWVyIFR5cGUpLiAgUGxlYXNlIGNvbnNv bGlkYXRlIHRoZW0uDQoNCjguMS4gTm9ybWF0aXZlIFJlZmVyZW5jZXMg4oCTIElBTkEuSldULkNs YWltcyDigJMgRGVsZXRlIHRoZSBvZGQgdGV4dCDigJxuLmQuLOKAnS4NCg0KOC4xLiBOb3JtYXRp dmUgUmVmZXJlbmNlcyDigJMgQ2hvb3NlIG9uZSBvZiBbSldUXSBvciBbUkZDNzUxOV0gYW5kIGRl bGV0ZSB0aGUgb3RoZXIgb25lLg0KDQo4LjEuIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMg4oCTIENo YW5nZSBbT0lEQ10gdG8gdGhlIHN0YW5kYXJkIHJlZmVyZW5jZSBuYW1lIFtPcGVuSUQuQ29yZV0u DQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAtLSBNaWtlDQoNCg0K --_000_3B0F808926CD46F6ACC4B239358BF051amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <9470F91724A2CC49B31720978C53491D@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Ik1TIE1pbmNobyI7DQoJcGFub3NlLTE6MiAyIDYgOSA0IDIgNSA4IDMgNDt9DQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIg MTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IlxATVMgTWlu Y2hvIjsNCglwYW5vc2UtMToyIDIgNiA5IDQgMiA1IDggMyA0O30NCkBmb250LWZhY2UNCgl7Zm9u dC1mYW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7fQ0KLyog U3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29O b3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXpl OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNw YW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojMDU2M0Mx Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUt dHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9u MQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47 fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3Bp ZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1s Pg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRh dGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8 Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNs YXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhbmtzIGZvciB0aGUg cmV2aWV3LCBNaWtlLiBJIGhhZCBhIGZldyBmb2xsb3cgdXAgcXVlc3Rpb25zDQo8c3BhbiBzdHls ZT0iY29sb3I6I0VCMzlGNiI+W3JpY2hhbm5hXSBpbmxpbmUgWy9yaWNoYW5uYV08L3NwYW4+Ljxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNF QjM5RjYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+4oCTPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4w cHQiPkFubmFiZWxsZSBCYWNrbWFuIChzaGUvaGVyKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5BV1MgSWRl bnRpdHk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PGEgaHJlZj0iaHR0cHM6Ly9hd3MuYW1hem9uLmNvbS9p ZGVudGl0eS8iPmh0dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvPC9hPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXYg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5n OjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+ RnJvbToNCjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6Ymxh Y2siPklkLWV2ZW50ICZsdDtpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBiZWhhbGYg b2YgTWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lcz00MG1pY3Jvc29mdC5jb21AZG1hcmMuaWV0 Zi5vcmcmZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlRodXJzZGF5LCBKdWx5IDksIDIwMjAgYXQgODo1 NSBQTTxicj4NCjxiPlRvOiA8L2I+JnF1b3Q7aWQtZXZlbnRAaWV0Zi5vcmcmcXVvdDsgJmx0O2lk LWV2ZW50QGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5bRVhURVJOQUxdIFtJZC1l dmVudF0gUmV2aWV3IG9mIGRyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVjdC1pZGVudGlmaWVycy0w NSBieSBNaWNoYWVsIEpvbmVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8dGFibGUgY2xhc3M9Ik1zb05vcm1hbFRhYmxlIiBib3JkZXI9 IjAiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgd2lkdGg9IjYyMiIgc3R5bGU9Indp ZHRoOjQ2Ni41cHQ7bWFyZ2luLWxlZnQ6LjVpbjtib3JkZXItY29sbGFwc2U6Y29sbGFwc2UiPg0K PHRib2R5Pg0KPHRyIHN0eWxlPSJoZWlnaHQ6MTUuMjVwdCI+DQo8dGQgd2lkdGg9IjYyMiIgdmFs aWduPSJ0b3AiIHN0eWxlPSJ3aWR0aDo0NjYuNXB0O2JvcmRlcjpzb2xpZCAjRUQ3RDMxIDEuNXB0 O3BhZGRpbmc6MGluIDUuNHB0IDBpbiA1LjRwdDtoZWlnaHQ6MTUuMjVwdCI+DQo8cD48c3Ryb25n PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6YmxhY2s7YmFja2dyb3VuZDojRkZGRjk5Ij5DQVVUSU9OPC9zcGFuPjwvc3Ryb25nPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkZGOTkiPjogVGhpcyBlbWFpbCBv cmlnaW5hdGVkIGZyb20gb3V0c2lkZSBvZiB0aGUgb3JnYW5pemF0aW9uLiBEbyBub3QgY2xpY2sg bGlua3Mgb3Igb3BlbiBhdHRhY2htZW50cyB1bmxlc3MNCiB5b3UgY2FuIGNvbmZpcm0gdGhlIHNl bmRlciBhbmQga25vdyB0aGUgY29udGVudCBpcyBzYWZlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvdGQ+DQo8L3RyPg0KPC90Ym9keT4NCjwvdGFibGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkkgZGlkIGEgY292ZXIt dG8tY292ZXIgcmVhZCBvZiBkcmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmllcnMt MDUuJm5ic3A7IE15IHJlc3VsdGluZyByZXZpZXcgY29tbWVudHMgZm9sbG93LCBncm91cGVkIGlu dG8gc3Vic3RhbnRpdmUgYW5kIGVkaXRvcmlhbCBzZWN0aW9ucy48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5T VUJTVEFOVElWRSBDT01NRU5UUzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkFic3RyYWN0IOKAkyBSZW1vdmUg W0pTT05dLCBbSldUXSwgYW5kIFtTRVRdIHJlZmVyZW5jZXMuJm5ic3A7IFBhc3QgSUVTRyByZXZp ZXdzIG9mIG90aGVyIHNwZWNzIGhhdmUgdG9sZCBtZSB0aGF0IGNpdGF0aW9ucyBhcmUgbm90IGFs bG93ZWQgaW4gYWJzdHJhY3RzLCBzaW5jZSB0aGV5IG5lZWQgdG8gc3RhbmQgYWxvbmUgd2l0aG91 dCB0aGUgcmVzdCBvZiB0aGUgc3BlY2lmaWNhdGlvbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4yLiZuYnNw OyBOb3RhdGlvbmFsIENvbnZlbnRpb25zPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Q29weSA8YSBocmVmPSJo dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1zZWNldmVudC1odHRwLXBvbGwt MTIjc2VjdGlvbi0xLjIiPg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYt c2VjZXZlbnQtaHR0cC1wb2xsLTEyI3NlY3Rpb24tMS4yPC9hPiBhbmQgbWFrZSBpdCBhIERlZmlu aXRpb25zIG9yIFRlcm1pbm9sb2d5IHN1Yi1zZWN0aW9uIHVuZGVyIHRoZSBjdXJyZW50IE5vdGF0 aW9uYWwgQ29udmVudGlvbnMgc2VjdGlvbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4zLiZuYnNwOyBTdWJq ZWN0IElkZW50aWZpZXJzIOKAkyBUaGUgbGFuZ3VhZ2Ug4oCcRXZlcnkgU3ViamVjdCBJZGVudGlm aWVyIFR5cGUgTVVTVCBoYXZlIGEgdW5pcXVlIG5hbWUgcmVnaXN0ZXJlZOKApuKAnSBpcyBzdXJw cmlzaW5nbHkgZGlmZmVyZW50IHRoYXQgdGhlIGNvcnJlc3BvbmRpbmcgSldUIHNwZWMgbGFuZ3Vh Z2Ugd2l0aCBhbHNvIGFsbG93cyBQcml2YXRlIGlkZW50aWZpZXJzDQogYW5kIENvbGxpc2lvbi1S ZXNpc3RhbnQgaWRlbnRpZmllcnMuJm5ic3A7IFdoeSBub3QgYWxzbyBhbGxvdyB0aGVtIGhlcmU/ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6I0VCMzlGNiI+W3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5GdW5uaWx5IGVu b3VnaCwgdGhpcyBleGFjdCB0aGluZyBjYW1lIHVwIG9uIHRoZSBPSURGIFNTRSBjYWxsIHRoaXMg d2Vlay4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXBwbGUgQ29sb3Ig RW1vamkmcXVvdDs7Y29sb3I6I0VCMzlGNiI+JiMxMjg1MTU7PC9zcGFuPjxzcGFuIHN0eWxlPSJj b2xvcjojRUIzOUY2Ij48YnI+DQpbL3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjMuJm5ic3A7IFN1YmplY3QgSWRlbnRpZmll cnMg4oCTIFRoZSB0ZXJtIOKAnHBheWxvYWQgY2xhaW1z4oCdIGlzIGNvbmZ1c2luZy4mbmJzcDsg UGxlYXNlIGNoYW5nZSB0aGlzIHRlcm0gdG8g4oCcU3ViamVjdCBJZGVudGlmaWNhdGlvbiBDbGFp bXPigJ0gdGhyb3VnaG91dCB0aGUgc3BlY2lmaWNhdGlvbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5b cmljaGFubmFdPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPkFncmVlZCBvbiBub3QgdXNpbmcg4oCccGF5bG9hZCBj bGFpbXPigJ0uIFJlcGxhY2VtZW50IGlzIFRCRCwgYnV0IEkgdGhpbmsgd2UgY2FuIGFuZCBzaG91 bGQgYXZvaWQgdGhlIHdvcmQg4oCcY2xhaW3igJ0gaGVyZSwgc2luY2UgdGhhdCBpcyBhIHZlcnkg c3BlY2lmaWMgdGhpbmcgaW4gdGhlIEpXVCB3b3JsZC48YnI+DQpbL3JpY2hhbm5hXTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjMuMS4gQWNj b3VudCBTdWJqZWN0IElkZW50aWZpZXIgVHlwZSDigJMgRmlndXJlIDEg4oCTIFRoaXMgZmlndXJl IGlzIGNvbmZ1c2luZyBiZWNhdXNlIGl0IG1ha2VzIGl0IHNlZW0gbGlrZSDigJxzdWJqZWN0X3R5 cGXigJ0gYW5kIOKAnHVyaeKAnSBhcmUgdG9wLWxldmVsIEpXVCBjbGFpbXMuICZuYnNwO1BsZWFz ZSBjb3JyZWN0IHRoaXMgcG9zc2libGUgY29uZnVzaW9uIGJ5IGFkZGluZw0KPHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29s b3I6YmxhY2siPiZxdW90O3N1Yl9pZCZxdW90Ozo8L3NwYW4+IHRvIHRoZSBleGFtcGxlLiZuYnNw OyBUaGUgdXBkYXRlZCBleGFtcGxlIHdvdWxkIGxvb2sgbGlrZSB0aGlzOjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgJnF1b3Q7c3ViX2lkJnF1b3Q7 OiB7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgJnF1b3Q7c3ViamVjdF90eXBlJnF1b3Q7OiAmcXVvdDthY2NvdW50JnF1b3Q7LDwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZx dW90O3VyaSZxdW90OzogJnF1b3Q7YWNjdDpleGFtcGxlLnVzZXJAc2VydmljZS5leGFtcGxlLmNv bSZxdW90Oyw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyB9 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkFsc28gYWRkIDxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4N CiZxdW90O3N1Yl9pZCZxdW90Ozo8L3NwYW4+IHRvIGFsbCBvdGhlciBleGFtcGxlcywgc3VjaCBh cyB0aG9zZSBpbiAzLjIsIDMuMywgMy40LCBldGMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48YnI+DQo8c3BhbiBzdHlsZT0iY29sb3I6I0VCMzlGNiI+W3JpY2hhbm5hXTxi cj4NClN1YmplY3QgSWRlbnRpZmllcnMgY2FuIG9jY3VyIG91dHNpZGUgb2YgSldUcywgYW5kIG5v dCBvbmx5IGFzIHRoZSB2YWx1ZSBvZiB0aGUgSldUIOKAnHN1Yl9pZOKAnSBjbGFpbS4gQWRkaW5n IGNvbnRleHQgcmVwcmVzZW50aW5nIG9uZSB1c2UgY2FzZSBmb3IgU3ViamVjdCBJZGVudGlmaWVy cyBtYWtlcyB0aGVzZSBleGFtcGxlcyB1bm5lY2Vzc2FyaWx5IGNvbXBsaWNhdGVkLiBJIHN1Z2dl c3RlZCBvbiBQaGls4oCZcyByZXZpZXcgdGhhdCB3ZSBjb3VsZCBhZGQNCiBleGFtcGxlcyBvZiBT dWJqZWN0IElkZW50aWZpZXJzIGJlaW5nIHVzZWQgaW4gY29udGV4dCAoZS5nLiwgYXMgYSDigJxz dWJfaWTigJ0gY2xhaW0gb3IgZW1iZWRkZWQgd2l0aGluIGEgU0VUIGV2ZW50IHBheWxvYWQpIGVh cmxpZXIgaW4gdGhlIGRvYywgYW5kIG1vdmUgYXdheSBmcm9tIHVzaW5nIOKAnGNsYWlt4oCdIHRv IHJlZmVyIHRvIHRoZSBtZW1iZXJzIHdpdGhpbiBhIFN1YmplY3QgSWRlbnRpZmllciBKU09OIG9i amVjdC4gV291bGQgdGhhdCBhZGRyZXNzDQogeW91ciBjb25jZXJuPzxicj4NClsvcmljaGFubmFd PC9zcGFuPjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjMuMi4xIEVtYWlsIENhbm9uaWNhbGl6YXRpb24g4oCT IFBsZWFzZSBhZGQgYSBub3RlIHRoYXQgdGhlIGRvbWFpbiBwb3J0aW9uIG9mIGFuIFJGQyA1MzIy IGFkZHItc3BlYyBhbHJlYWR5IG11c3QgYmUgdHJlYXRlZCBpbiBhIGNhc2UtaW5zZW5zaXRpdmUg bWFubmVyLCBwZXIgUkZDIDEwMzQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0VCMzlGNiI+W3JpY2hhbm5hXTxicj4N Ckl0IHN0cmlrZXMgbWUgYXMgd2VpcmQgdG8gcHVsbCB0aGlzIGludG8gdGhlIGRvYy4gSWYgd2Ug Y2hhbmdlZCB0aGUgc2Vjb25kIHNlbnRlbmNlIG9mIDMuMi4xIHRvIHNwZWNpZnkgdGhlIGxvY2Fs IHBhcnQsIGUuZy4sIOKAnHNvbWUgcHJvdmlkZXJzIHRyZWF0IHRoZSBsb2NhbCBwYXJ0IG9mIGVt YWlsIGFkZHJlc3NlcyBhcyBjYXNlLWluc2Vuc2l0aXZl4oCdIHdvdWxkIHRoYXQgYWRkcmVzcyB5 b3VyIGNvbmNlcm4/PGJyPg0KWy9yaWNoYW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4zLjMuIFBob25lIE51bWJlciBTdWJqZWN0IElk ZW50aWZpZXIg4oCTIFBsZWFzZSBjaGFuZ2UgYWxsIGluc3RhbmNlcyBvZiDigJxwaG9uZS1udW1i ZXLigJ0gdG8g4oCccGhvbmVfbnVtYmVy4oCdIHRvIG1hdGNoIHRoZSBKV1QgY2xhaW0gb2YgdGhl IHNhbWUgbmFtZS4mbmJzcDsgVGhpcyBvY2N1cnMgbXVsdGlwbGUgdGltZXMgdGhyb3VnaG91dCB0 aGUgc3BlY2lmaWNhdGlvbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4zLjQuIElzc3VlciBhbmQgU3ViamVj dCBTdWJqZWN0IFR5cGUgSWRlbnRpZmllciDigJMgQWRkIGEgbm90ZSB0aGF0IHRoaXMgaXMgdGhl IHdheSB0aGF0IHN1YmplY3RzIGFyZSBpZGVudGlmaWVkIGluIE9wZW5JRCBDb25uZWN0IElEIFRv a2Vucy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj41LjEuIElkZW50aWZpZXIgQ29ycmVsYXRpb24g4oCTIEFk ZCB0aGlzIHBocmFzZSB0byB0aGUgZW5kIG9mIHRoZSBsYXN0IHNlbnRlbmNlIOKAnG9yIHdoZW4g Y29ycmVsYXRpb24gaXMgZXNzZW50aWFsIHRvIHRoZSB1c2UgY2FzZeKAnS48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj42LiBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyDigJMgVGFsayBhYm91dCBpbnRlZ3JpdHkt cHJvdGVjdGluZyBTRVRzLiZuYnNwOyBCb3Jyb3cgb3IgcmVmZXJlbmNlIHNlY3VyaXR5IGNvbnNp ZGVyYXRpb25zIGZyb20gdGhlIG90aGVyIFNlY0V2ZW50IHNwZWNzLjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PjcuMS4gU2VjdXJpdHkgRXZlbiBTdWJqZWN0IElkZW50aWZpZXIgVHlwZXMgUmVnaXN0cnkg4oCT IFBsZWFzZSBhZGQgYSBzdWdnZXN0aW9uIHRvIElBTkEgdGhhdCB0aGlzIHJlZ2lzdHJ5IGJlIGxv Y2F0ZWQgYXQNCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL3NlY2V2 ZW50LyI+aHR0cHM6Ly93d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvc2VjZXZlbnQvPC9hPi48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj43LjEuMS4gUmVnaXN0cmF0aW9uIFRlbXBsYXRlIOKAkyBBZGQgdW5kZXJz Y29yZSDigJxf4oCdIHRvIHRoZSBzZXQgb2YgYWNjZXB0YWJsZSBjaGFyYWN0ZXJzLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjcuMS4xLiBSZWdpc3RyYXRpb24gVGVtcGxhdGUg4oCTIENoYW5nZSBDb250cm9s bGVyIOKAkyBSZW1vdmUgT3BlbklEIHN0YXRlbWVudHMgYW5kIHJlcGxhY2UgdGhlbSBieSBJRVRG IHNwZWNpZmljYXRpb25zIGFuZCDigJxJRVRG4oCdLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjcuMS4xLiBS ZWdpc3RyYXRpb24gVGVtcGxhdGUg4oCTIERlZmluaW5nIERvY3VtZW50KHMpIOKAkyBBbHNvIGFk ZCDigJxwcm9oaWJpdGVk4oCdIHRvIHRoZSBsaXN0IG9mIGNvbmRpdGlvbnMgdG8gYmUgZGVzY3Jp YmVkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjcuMS4zLiBHdWlkYW5jZSBmb3IgRXhwZXJ0IFJldmlld2Vy cyDigJMgU3RhdGUgdGhhdCBtdWx0aXBsZSBFeHBlcnQgUmV2aWV3ZXJzIHNob3VsZCBiZSBhcHBv aW50ZWQuJm5ic3A7IFlvdSBjYW4gYm9ycm93IGxhbmd1YWdlIGFib3V0IHRoYXQgZnJvbSBSRkMg NzUxOS4uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Ny4yLiBKU09OIFdlYiBUb2tlbiBDbGFpbXMgUmVnaXN0 cmF0aW9uIOKAkyBDaGFuZ2Ug4oCcZXN0YWJsaXNoZWQgYnkgW1NFVF3igJ0gdG8g4oCcZXN0YWJs aXNoZWQgYnkg4oCcW0pXVF3igJ0uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+QWNrbm93bGVkZ2VtZW50cyDi gJMgQWxzbyBhY2tub3dsZWRnZSB0aGUgU2VjRXZlbnQgd29ya2luZyBncm91cCBhbmQgaXRzIG1l bWJlcnMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+RURJVE9SSUFMIENPTU1FTlRTPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+MS4gSW50cm9kdWN0aW9uIOKAkyBDaGFuZ2Ug4oCcc2VjdGlvbiAxLjLigJ0gdG8g4oCcU2Vj dGlvbiAxLjLigJ0gKGFuZCBzaW1pbGFybHkgY2hhbmdlIHRvIFRpdGxlIENhc2UgZm9yIGFueSBv dGhlciBvY2N1cnJlbmNlcyBvZiDigJxzZWN0aW9u4oCdLCDigJxmaWd1cmXigJ0sIG9yIOKAnHRh Ymxl4oCdKS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4xLiBJbnRyb2R1Y3Rpb24g4oCTIEFkZCBhIGNvbW1h IGFmdGVyIOKAnGJ1dCBub3QgbGltaXRlZCB0b+KAnS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4xLiBJbnRy b2R1Y3Rpb24g4oCTIEFkZCBhIGNvbW1hIGFmdGVyIOKAnGZvciBleGFtcGxl4oCdLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjIuJm5ic3A7IE5vdGF0aW9uYWwgQ29udmVudGlvbnMg4oCTIFVwZGF0ZSB0byB1 c2UgUkZDIDg0MTcgbGFuZ3VhZ2UuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+My4mbmJzcDsgU3ViamVjdCBJ ZGVudGlmaWVycyDigJMgQ2hhbmdlIOKAnHdoaWNo4oCdIHRvIOKAnHRoYXTigJ0gaW4g4oCcd2hp Y2ggYXJlIHRvIGJlIGludGVycHJldGVk4oCdPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+My4xLiBBY2NvdW50 IFN1YmplY3QgSWRlbnRpZmllciBUeXBlIOKAkyBGaWd1cmUgMSDigJMgSXTigJlzIG9kZCB0byBo YXZlIGEgcGVyaW9kIGVuZGluZyBhIHNlbnRlbmNlIGZyYWdtZW50LiZuYnNwOyBEZWxldGUgdGhl IHBlcmlvZCBhdCB0aGUgZW5kIG9mIHRoZSBmaWd1cmUgY2FwdGlvbi4mbmJzcDsgRG8gdGhpcyBm b3IgYWxsIG90aGVyIGZpZ3VyZXMgd2hlbiB0aGUgY2FwdGlvbiBpcyBhbHNvDQogYSBzZW50ZW5j ZSBmcmFnbWVudCwgc3VjaCBhcyBGaWd1cmUgMiwgRmlndXJlIDMsIEZpZ3VyZSA0LCBldGMuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+NC4xLiAmcXVvdDtzdWJfaWQmcXVvdDsgQ2xhaW0g4oCTIENoYW5nZSAm cXVvdDtzdWJfaWQmcXVvdDsgdG8gJmx0O3NwYW54IHN0eWxlPSZxdW90O3ZlcmImcXVvdDsmZ3Q7 c3ViX2lkJmx0Oy9zcGFueCZndDsgaW4gdGhlIHNvdXJjZSBzbyB0aGF0IHRoZSBmb3JtYXR0aW5n IGlzIGNvcnJlY3RseSBhcHBsaWVkIGFjcm9zcyBhbGwgb3V0cHV0IHJlcHJlc2VudGF0aW9ucy4m bmJzcDsgU2ltaWxhcmx5LCB1c2Ugc3Bhbnggc3R5bGUgdmVyYiBmb3IgYWxsIG90aGVyDQogaW5z dGFuY2VzIG9mIGxpdGVyYWxzIGluIHRoZSBzcGVjaWZpY2F0aW9uLjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PjQuMS4gJnF1b3Q7c3ViX2lkJnF1b3Q7IENsYWltIOKAkyBMaWtld2lzZSwgY2hhbmdlIGBzdWJg IHRvICZsdDtzcGFueCBzdHlsZT0mcXVvdDt2ZXJiJnF1b3Q7Jmd0O3N1YiZsdDsvc3BhbngmZ3Q7 IGFuZCBgc3ViX2lkYCB0byAmbHQ7c3Bhbnggc3R5bGU9JnF1b3Q7dmVyYiZxdW90OyZndDtzdWJf aWQmbHQ7L3NwYW54Jmd0Oy4mbmJzcDsgU2VhcmNoIGZvciBvdGhlciBzaW1pbGFyIGluc3RhbmNl cyBvZiB1c2VzIG9mICZxdW90OyAnIG9yIGAgaW4gdGhlIHNwZWMgYW5kIGNvcnJlY3QNCiB0aGVt IHRvIHNwYW54IHN0eWxlIHZlcmIuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+NC4yLiDigJxzdWJfaWTigJ0g YW5kIOKAnGlzcy1zdWLigJ0gU3ViamVjdCBJZGVudGlmaWVycyDigJMgVGhpcyBzZWN0aW9uIHNl ZW1zIHRvIHJlcGVhdCBpbmZvcm1hdGlvbiBpbiBTZWN0aW9uIDMuNCAoSXNzdWVyIGFuZCBTdWJq ZWN0IFN1YmplY3QgSWRlbnRpZmllciBUeXBlKS4mbmJzcDsgUGxlYXNlIGNvbnNvbGlkYXRlIHRo ZW0uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+OC4xLiBOb3JtYXRpdmUgUmVmZXJlbmNlcyDigJMgSUFOQS5K V1QuQ2xhaW1zIOKAkyBEZWxldGUgdGhlIG9kZCB0ZXh0IOKAnG4uZC4s4oCdLjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjguMS4gTm9ybWF0aXZlIFJlZmVyZW5jZXMg4oCTIENob29zZSBvbmUgb2YgW0pXVF0g b3IgW1JGQzc1MTldIGFuZCBkZWxldGUgdGhlIG90aGVyIG9uZS48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj44 LjEuIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMg4oCTIENoYW5nZSBbT0lEQ10gdG8gdGhlIHN0YW5k YXJkIHJlZmVyZW5jZSBuYW1lIFtPcGVuSUQuQ29yZV0uPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_3B0F808926CD46F6ACC4B239358BF051amazoncom_-- From nobody Fri Jul 10 16:57:46 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E1D33A08FE for ; Fri, 10 Jul 2020 16:57:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.598 X-Spam-Level: X-Spam-Status: No, score=-9.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vfg3rLsfA1v0 for ; Fri, 10 Jul 2020 16:57:42 -0700 (PDT) Received: from smtp-fw-9101.amazon.com (smtp-fw-9101.amazon.com [207.171.184.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 51D113A08FA for ; Fri, 10 Jul 2020 16:57:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1594425463; x=1625961463; h=from:to:subject:date:message-id:mime-version; bh=hhmEEQwDY5BJQQPs+yKwJ6qfcde18pFYXGRVifHZ6pM=; b=hDL9f2lmzXrS8BXkk8ryR174ibpgxZ0DXiocvEqECqMkBN8kPBIc7XDX wvEG/cqxwHqslPkZVLms+NZ8+W/iodWKjyl7p0jk3/HnK6TlFG+nIcyqE /oGg51WtAZPmMF3OQP/xbsmpdlImpmYpx816vEQLeuqUhztSPOo+cwRJk g=; IronPort-SDR: VazLinI2i5wd9bR0sVnJLTZoKX16svN4DST7sQC+43wiOMUPXEYxnkMzICvHNGXfPyiZSz8BMY kr9aLySL5sgA== X-IronPort-AV: E=Sophos; i="5.75,336,1589241600"; d="scan'208,217"; a="50745692" Received: from sea32-co-svc-lb4-vlan3.sea.corp.amazon.com (HELO email-inbound-relay-2a-c5104f52.us-west-2.amazon.com) ([10.47.23.38]) by smtp-border-fw-out-9101.sea19.amazon.com with ESMTP; 10 Jul 2020 23:57:37 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan3.pdx.amazon.com [10.170.41.166]) by email-inbound-relay-2a-c5104f52.us-west-2.amazon.com (Postfix) with ESMTPS id F0CB1A1C05 for ; Fri, 10 Jul 2020 23:57:35 +0000 (UTC) Received: from EX13D11UWC002.ant.amazon.com (10.43.162.174) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 10 Jul 2020 23:57:34 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC002.ant.amazon.com (10.43.162.174) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 10 Jul 2020 23:57:34 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Fri, 10 Jul 2020 23:57:34 +0000 From: "Richard Backman, Annabelle" To: "id-event@ietf.org" Thread-Topic: Review of draft-ietf-secevent-subject-identifiers-05 Thread-Index: AQHWVxXhFvCnUJuFQ0OPO54E0+gV9g== Date: Fri, 10 Jul 2020 23:57:34 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.26] Content-Type: multipart/alternative; boundary="_000_CE2F691B0BC8411D8A357603B1754834amazoncom_" MIME-Version: 1.0 Archived-At: Subject: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jul 2020 23:57:45 -0000 --_000_CE2F691B0BC8411D8A357603B1754834amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmXZlIHJldmlld2VkIHRoZSBjdXJyZW50IGRyYWZ0LCBhbmQgaGF2ZSBhIGZldyBub3ZlbCBj b21tZW50cy90b3BpY3MgZm9yIGRpc2N1c3Npb24gdGhhdCBoYXZlbuKAmXQgYmVlbiByYWlzZWQg YWxyZWFkeSBieSBvdGhlciByZXZpZXdlcnM6DQoNCg0KICAxLiAgU2hvdWxkIHdlIHJlbW92ZSDi gJxmb3IgU2VjdXJpdHkgRXZlbnQgVG9rZW5z4oCdIGZyb20gdGhlIHRpdGxlPyBOb3RoaW5nIGFi b3V0IHRoZSBzcGVjIGlzIHNwZWNpZmljIHRvIFNFVHMgb3IgZXZlbiBKV1RzLCBleGNlcHQgcGVy aGFwcyB0aGUgZGVmaW5pdGlvbiBvZiDigJxzdWJqZWN04oCdLiBJdOKAmXMgdGVsbGluZyB0aGF0 IHdoaWxlIHRoZSBhYnN0cmFjdCBhbmQgaW50cm9kdWN0aW9uIHdvdWxkIG5lZWQgdG8gYmUgcmV3 b3JrZWQsIHRoZSByZXN0IG9mIHRoZSB0ZXh0IHdvdWxkIG5vdCByZXF1aXJlIGFueSBjaGFuZ2Vz Lg0KDQogIDIuICBTZWN0aW9uIDQ6IEFkZCBjb250ZXh0IGZvciB3aHkg4oCcc3ViX2lk4oCdIGlz IG5lZWRlZCwgZ2l2ZW4gdGhhdCDigJxzdWLigJ0gYWxyZWFkeSBleGlzdHMuIEkuZS4sIOKAnHN1 YuKAnSBpcyBhIHNpbmdsZSBzdHJpbmcgdmFsdWUgc28gY2Fubm90IHJlcHJlc2VudCBjb21wbGV4 IHN1YmplY3QgaWRlbnRpZmllcnMuDQoNCiAgMy4gIFNlY3Rpb24gNC4yOiBDbGFyaWZ5IHRoYXQg dGhlIOKAnGlzc+KAnSBwcm9wZXJ0eSBvZiB0aGUgU3ViamVjdCBJZGVudGlmaWVyIGlzIFJFUVVJ UkVEIHJlZ2FyZGxlc3Mgb2Ygd2hldGhlciBpdHMgdmFsdWUgaXMgdGhlIHNhbWUgYXMgdGhlIEpX VOKAmXMg4oCcaXNz4oCdIGNsYWltLg0KDQoNCg0KICAxLiAgU2VjdGlvbiA0LjI6IElzIHRoZXJl IGEgdXNlIGNhc2Ugd2hlcmUgdGhlIOKAnGlzc+KAnSBtYXkgYmUgdGhlIHNhbWUgZm9yIHRoZSBK V1QgYW5kIFN1YmplY3QgSWRlbnRpZmllciwgYnV0IOKAnHN1YuKAnSBtYXkgYmUgZGlmZmVyZW50 PyBNb3JlIGltcG9ydGFudGx5LCBpcyB0aGVyZSBhIHJlYXNvbiB3aHkgdGhpcyB3b3VsZCBuZWVk IHRvIGJlIHByb2hpYml0ZWQ/DQoNCg0KDQogIDEuICBTZWN0aW9uIDY6IENhbGwgb3V0IHRoYXQg U3ViamVjdCBJZGVudGlmaWVycyBkbyBub3QgcHJvdmlkZSBhbnkgbWVjaGFuaXNtIGZvciBpbnN1 cmluZyBjb25maWRlbnRpYWxpdHkgYW5kL29yIGludGVncml0eSBwcm90ZWN0aW9uLCBhbmQgdGh1 cyByZWx5IG9uIHRoZSBtZWNoYW5pc21zIG9mZmVyZWQgYnkgdGhlIGNvbnRhaW5pbmcgZm9ybWF0 cyBhbmQvb3IgcHJvdG9jb2xzIHdpdGhpbiB3aGljaCB0aGV5IGFyZSB1c2VkLg0KDQrigJMNCkFu bmFiZWxsZSBCYWNrbWFuIChzaGUvaGVyKQ0KQVdTIElkZW50aXR5DQpodHRwczovL2F3cy5hbWF6 b24uY29tL2lkZW50aXR5Lw0KDQo= --_000_CE2F691B0BC8411D8A357603B1754834amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <4FC19CB7A0E2E44BA7D2A18532C3C50D@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Ik1TIE1pbmNobyI7DQoJcGFub3NlLTE6MiAyIDYgOSA0IDIgNSA4IDMgNDt9DQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIg MTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IlxATVMgTWlu Y2hvIjsNCglwYW5vc2UtMToyIDIgNiA5IDQgMiA1IDggMyA0O30NCi8qIFN0eWxlIERlZmluaXRp b25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdp bjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5N c29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3Jp dHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90 dG9tOjBpbjsNCgltYXJnaW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglm b250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNw YW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLWNvbXBvc2U7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNv Q2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERl ZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxNjg1NzM1NTsNCgltc28tbGlz dC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTEzNzIzNzU5OCA2NzY5ODcw MyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2 NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEt bG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4w cHQ7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3Qg bDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGww OmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsOA0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1s b3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1p ZDoxMjg2OTMwNDUxOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRl LWlkczo3Mjk0Mjk2NDAgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3 MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTU7fQ0KQGxpc3QgbDE6bGV2ZWwx DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0K QGxpc3QgbDE6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmln aHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVs Ng0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5k ZW50Oi05LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9 DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0K b2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+ PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9 ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0 PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0K PC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0Rjcy Ij4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SeKAmXZlIHJldmlld2VkIHRoZSBjdXJyZW50IGRy YWZ0LCBhbmQgaGF2ZSBhIGZldyBub3ZlbCBjb21tZW50cy90b3BpY3MgZm9yIGRpc2N1c3Npb24g dGhhdCBoYXZlbuKAmXQgYmVlbiByYWlzZWQgYWxyZWFkeSBieSBvdGhlciByZXZpZXdlcnM6PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxvbCBzdHlsZT0i bWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMSBsZXZlbDEgbGZvMiI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlNob3VsZCB3ZSByZW1vdmUg4oCcZm9yIFNl Y3VyaXR5IEV2ZW50IFRva2Vuc+KAnSBmcm9tIHRoZSB0aXRsZT8gTm90aGluZyBhYm91dCB0aGUg c3BlYyBpcyBzcGVjaWZpYyB0byBTRVRzIG9yIGV2ZW4gSldUcywgZXhjZXB0IHBlcmhhcHMgdGhl IGRlZmluaXRpb24gb2YNCiDigJxzdWJqZWN04oCdLiBJdOKAmXMgdGVsbGluZyB0aGF0IHdoaWxl IHRoZSBhYnN0cmFjdCBhbmQgaW50cm9kdWN0aW9uIHdvdWxkIG5lZWQgdG8gYmUgcmV3b3JrZWQs IHRoZSByZXN0IG9mIHRoZSB0ZXh0IHdvdWxkIG5vdCByZXF1aXJlIGFueSBjaGFuZ2VzLjxicj4N Cjxicj4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBo IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluO21zby1saXN0OmwxIGxldmVsMSBsZm8yIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+U2VjdGlvbiA0OiBBZGQgY29udGV4dCBmb3Igd2h5IOKA nHN1Yl9pZOKAnSBpcyBuZWVkZWQsIGdpdmVuIHRoYXQg4oCcc3Vi4oCdIGFscmVhZHkgZXhpc3Rz LiBJLmUuLCDigJxzdWLigJ0gaXMgYSBzaW5nbGUgc3RyaW5nIHZhbHVlIHNvIGNhbm5vdCByZXBy ZXNlbnQgY29tcGxleA0KIHN1YmplY3QgaWRlbnRpZmllcnMuPGJyPg0KPGJyPg0KPG86cD48L286 cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4t bGVmdDowaW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzIiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij5TZWN0aW9uIDQuMjogQ2xhcmlmeSB0aGF0IHRoZSDigJxpc3PigJ0gcHJvcGVydHkg b2YgdGhlIFN1YmplY3QgSWRlbnRpZmllciBpcyBSRVFVSVJFRCByZWdhcmRsZXNzIG9mIHdoZXRo ZXIgaXRzIHZhbHVlIGlzIHRoZSBzYW1lIGFzIHRoZSBKV1TigJlzIOKAnGlzc+KAnSBjbGFpbS48 bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvb2w+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxvbCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSI0IiB0eXBlPSIxIj4NCjxsaSBj bGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDps MSBsZXZlbDEgbGZvMiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlNlY3Rpb24gNC4y OiBJcyB0aGVyZSBhIHVzZSBjYXNlIHdoZXJlIHRoZSDigJxpc3PigJ0gbWF5IGJlIHRoZSBzYW1l IGZvciB0aGUgSldUIGFuZCBTdWJqZWN0IElkZW50aWZpZXIsIGJ1dCDigJxzdWLigJ0gbWF5IGJl IGRpZmZlcmVudD8gTW9yZSBpbXBvcnRhbnRseSwgaXMNCiB0aGVyZSBhIHJlYXNvbiB3aHkgdGhp cyB3b3VsZCBuZWVkIHRvIGJlIHByb2hpYml0ZWQ/PG86cD48L286cD48L3NwYW4+PC9saT48L29s Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8b2wgc3R5bGU9Im1hcmdpbi10b3A6 MGluIiBzdGFydD0iNSIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzIiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij5TZWN0aW9uIDY6IENhbGwgb3V0IHRoYXQgU3ViamVjdCBJZGVu dGlmaWVycyBkbyBub3QgcHJvdmlkZSBhbnkgbWVjaGFuaXNtIGZvciBpbnN1cmluZyBjb25maWRl bnRpYWxpdHkgYW5kL29yIGludGVncml0eSBwcm90ZWN0aW9uLCBhbmQgdGh1cyByZWx5IG9uDQog dGhlIG1lY2hhbmlzbXMgb2ZmZXJlZCBieSB0aGUgY29udGFpbmluZyBmb3JtYXRzIGFuZC9vciBw cm90b2NvbHMgd2l0aGluIHdoaWNoIHRoZXkgYXJlIHVzZWQuPG86cD48L286cD48L3NwYW4+PC9s aT48L29sPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPuKA kzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW5uYWJlbGxlIEJhY2ttYW4g KHNoZS9oZXIpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BV1MgSWRlbnRp dHk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8v YXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvIj48c3BhbiBzdHlsZT0iY29sb3I6IzA1NjNDMSI+aHR0 cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS88L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvYm9k eT4NCjwvaHRtbD4NCg== --_000_CE2F691B0BC8411D8A357603B1754834amazoncom_-- From nobody Fri Jul 10 17:49:01 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0127A3A0985 for ; Fri, 10 Jul 2020 17:49:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.895 X-Spam-Level: X-Spam-Status: No, score=-1.895 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=independentid-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pUqhMFbb3tzv for ; Fri, 10 Jul 2020 17:48:57 -0700 (PDT) Received: from mail-pl1-x636.google.com (mail-pl1-x636.google.com [IPv6:2607:f8b0:4864:20::636]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A95853A0983 for ; Fri, 10 Jul 2020 17:48:57 -0700 (PDT) Received: by mail-pl1-x636.google.com with SMTP id p1so2927724pls.4 for ; Fri, 10 Jul 2020 17:48:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=independentid-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=jXyBbEd+Fi+mW8qZbQaPXBAeUMai8khKDReBI9orEQ0=; b=owTk4BGSQcvk+fwixObI5ORi34dR8rciVTwTto5aHDcLuk8GceeCFMPCB4tjJapON2 tgpGP9mPgnDKejZU/vKzgQ4YHgWryhsYPZPTKJEp7bbVxKc2I4R1FlNpklUNCbO7t15T bsKS7eoaAQCfb5i6C6th1GjOfAMeHh4lNa6tqMHvaCGUmlL99BKOjInwQlraeSWIBXDT Y6jgC2mccZUG2YZ1mqQpaTxEBLpz+T2HFUsCybe/CS0RxIJQwQ4CbA1TC+bqOm36WU6m 1l5vpvChsITOtKdTKHeUwnNFsLEYqo0F/uKkq7Q69jXsg1soKOrmrRtV3KGwMq+lBMM9 yX4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=jXyBbEd+Fi+mW8qZbQaPXBAeUMai8khKDReBI9orEQ0=; b=igBWWa3hbWj81gYOjwYk3HTsnI/bRFvCiPOxwH/FAzzMdPZOmVGL2plsO45OWcdvLD Y+M9UFZJ7FRvJ4vjw+KbFT9rkmHrNHER5rX+tmcdyA2ygCF0VzW0spHSbEjlWqrhWn0o bW0HoQEhSVn8VRHOufmkhpJd0f5HxmHdi7piZDVMziZXjW1TR6n+PEMZaxJTDKViLyR5 B4oXQdX6mTzUa+lJitfntbbkWgARFE5SczZeVR+iy5+N6LlkQcypReUVh4XnN+a7MyRL a2QKStQx7yHFZNpfvO5PIH7GLlUUKTatAi66zu3UOzQNH+gfABXop6OJ+7fV43+Tmsdu iC1w== X-Gm-Message-State: AOAM5335F+EBGQuwGBu/5jhdyXKqf7TTNZRzprfvHg8sZa0mWeIXSEXH FuCLA1pvmF1cfIRoPZnB5Sugyg== X-Google-Smtp-Source: ABdhPJz3OP2UXCpt5OkSIzE0MFkIivP9/d7Tww8Zn0RqW4HN8iF7uaBEg6kaQdRurklkuzXOGNS2Ug== X-Received: by 2002:a17:90a:2048:: with SMTP id n66mr8677169pjc.71.1594428536818; Fri, 10 Jul 2020 17:48:56 -0700 (PDT) Received: from ?IPv6:2001:569:7a71:1d00:6c76:7dc8:625:fa2e? (node-1w7jr9qrfoxx969mpjwt7h7am.ipv6.telus.net. [2001:569:7a71:1d00:6c76:7dc8:625:fa2e]) by smtp.gmail.com with ESMTPSA id x10sm6580757pgp.47.2020.07.10.17.48.55 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 10 Jul 2020 17:48:56 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-1BEAEC7B-BE00-49E3-B70C-E412C9948675 Content-Transfer-Encoding: 7bit From: Phillip Hunt Mime-Version: 1.0 (1.0) Date: Fri, 10 Jul 2020 17:48:55 -0700 Message-Id: References: Cc: "id-event@ietf.org" In-Reply-To: To: "Richard Backman, Annabelle" X-Mailer: iPhone Mail (17F80) Archived-At: Subject: Re: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Jul 2020 00:49:00 -0000 --Apple-Mail-1BEAEC7B-BE00-49E3-B70C-E412C9948675 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable In line.=20 Phil > On Jul 10, 2020, at 4:57 PM, Richard Backman, Annabelle wrote: >=20 > =EF=BB=BF > I=E2=80=99ve reviewed the current draft, and have a few novel comments/top= ics for discussion that haven=E2=80=99t been raised already by other reviewe= rs: > =20 > Should we remove =E2=80=9Cfor Security Event Tokens=E2=80=9D from the titl= e? Nothing about the spec is specific to SETs or even JWTs, except perhaps t= he definition of =E2=80=9Csubject=E2=80=9D. It=E2=80=99s telling that while t= he abstract and introduction would need to be reworked, the rest of the text= would not require any changes. This spec was supposed to solve the =E2=80=9Csub=E2=80=9D ambiguity problem f= or set and jwt. And the issue of collision around =E2=80=9Ciss=E2=80=9D whic= h is supposed to be the issuer of the SET.=20 Opening the scope beyond that would delay finalizing this draft as broader c= onsiderations and need discussion.=20 >=20 > Section 4: Add context for why =E2=80=9Csub_id=E2=80=9D is needed, given t= hat =E2=80=9Csub=E2=80=9D already exists. I.e., =E2=80=9Csub=E2=80=9D is a s= ingle string value so cannot represent complex subject identifiers. Agreed. This needs more clarification. I remain concerned about duplication a= nd interop issues.=20 >=20 > Section 4.2: Clarify that the =E2=80=9Ciss=E2=80=9D property of the Subjec= t Identifier is REQUIRED regardless of whether its value is the same as the J= WT=E2=80=99s =E2=80=9Ciss=E2=80=9D claim. This is a serious problem is the =E2=80=9Ciss=E2=80=9D of the set is not the= =E2=80=9Ciss=E2=80=9D of =E2=80=9Csub=E2=80=9D. I thought that was why we w= anted a json object expression.=20 This was also why way back when when i published the original draft proposal= that I proposed sub and iss be embedded in the payload so as not to be conf= used by top level claims which are about the container (ie set) =E2=80=9Cmes= sage=E2=80=9D.=20 > =20 > Section 4.2: Is there a use case where the =E2=80=9Ciss=E2=80=9D may be th= e same for the JWT and Subject Identifier, but =E2=80=9Csub=E2=80=9D may be d= ifferent? More importantly, is there a reason why this would need to be proh= ibited? See above. > =20 > Section 6: Call out that Subject Identifiers do not provide any mechanism f= or insuring confidentiality and/or integrity protection, and thus rely on th= e mechanisms offered by the containing formats and/or protocols within which= they are used. > =20 > =E2=80=93 > Annabelle Backman (she/her) > AWS Identity > https://aws.amazon.com/identity/ > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail-1BEAEC7B-BE00-49E3-B70C-E412C9948675 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable In line. 

Phil=

On Jul 10, 2020, at 4:5= 7 PM, Richard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org&= gt; wrote:

=EF=BB=BF

I=E2=80=99ve reviewe= d the current draft, and have a few novel comments/topics for discussion tha= t haven=E2=80=99t been raised already by other reviewers:<= /p>

 

  1. Should we remove =E2=80=9Cfor Security= Event Tokens=E2=80=9D from the title? Nothing about the spec is specific to= SETs or even JWTs, except perhaps the definition of =E2=80=9Csubject=E2=80=9D. It=E2=80=99s telling that while the abstract and= introduction would need to be reworked, the rest of the text would not requ= ire any changes.

This spec was supposed to solve the =E2=80=9Csub=E2=80=9D ambiguity problem= for set and jwt. And the issue of collision around =E2=80=9Ciss=E2=80=9D wh= ich is supposed to be the issuer of the SET. 

Openin= g the scope beyond that would delay finalizing this draft as broader conside= rations and need discussion. 

  2. Section 4: Add c= ontext for why =E2=80=9Csub_id=E2=80=9D is needed, given that =E2=80=9Csub=E2= =80=9D already exists. I.e., =E2=80=9Csub=E2=80=9D is a single string value s= o cannot represent complex subject identifiers.
Agreed. T= his needs more clarification. I remain concerned about duplication and inter= op issues. 

  2. Section 4.2: Cl= arify that the =E2=80=9Ciss=E2=80=9D property of the Subject Identifier is R= EQUIRED regardless of whether its value is the same as the JWT=E2=80=99s =E2= =80=9Ciss=E2=80=9D claim.

=
This is a serious problem is the =E2=80=9Ciss=E2=80=9D of the set is n= ot the =E2=80=9Ciss=E2=80=9D of =E2=80=9Csub=E2=80=9D. I thought that was wh= y we wanted a json object expression. 

This wa= s also why way back when when i published the original draft proposal that I= proposed sub and iss be embedded in the payload so as not to be confused by= top level claims which are about the container (ie set) =E2=80=9Cmessage=E2= =80=9D. 

 

  1. Section 4.2: Is there a use case where= the =E2=80=9Ciss=E2=80=9D may be the same for the JWT and Subject Identifie= r, but =E2=80=9Csub=E2=80=9D may be different? More importantly, is there a reason why this would need to be prohibited?
=
See above.
=

 

  1. Section 6: Call out that Subject Ident= ifiers do not provide any mechanism for insuring confidentiality and/or inte= grity protection, and thus rely on the mechanisms offered by the containing formats and/or protocols within wh= ich they are used.

 

=E2=80=93

Annabelle Backman (she/her)

AWS Identity

https://aws.amazon.com/identity/=

 

_______________________________________________
Id-eve= nt mailing list
Id-event@ietf.org
https://ww= w.ietf.org/mailman/listinfo/id-event
= --Apple-Mail-1BEAEC7B-BE00-49E3-B70C-E412C9948675-- From nobody Fri Jul 10 18:24:16 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42A133A09E9 for ; Fri, 10 Jul 2020 18:24:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GF5uemmzqA1k for ; Fri, 10 Jul 2020 18:24:12 -0700 (PDT) Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 789333A09E1 for ; Fri, 10 Jul 2020 18:24:11 -0700 (PDT) Received: by mail-lf1-x12b.google.com with SMTP id o4so4173260lfi.7 for ; Fri, 10 Jul 2020 18:24:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lAJEbXKSKoiQ47HbpPC4srSz3TSh88Spn9U82CCAEa4=; b=km7YJ4aByCqh6mL+t6R7SWxiZQyrsdY4yLVnYgxfAPt1xmX2YLGbaw7FCjR5W54TIh 0m4KGa2whOtBYgS68odUkP0+IJ09ed0dUtT0yrd5jBQY7hNDFdLcH2hp6n7vvUy96/1T WOBXfYcWoK9dGhB5v/fPVeEVvLADg1rlKzR1cTTzrGWR4nLJ3Z/p1s2a4D9fjxf5pF06 j3enVVXXVQxYVQ8+QXguSe2CUHLqOgkaCpikUNAzR9/bHCoXYcK3C4IXDX4XInRHZmGD ZVgjQ5NjIrbpe+4zHaLO1JSsBdl5/bMrheb0RGLdzGCT0wV7bDrfDlo46y0KUvGpkznv dIJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lAJEbXKSKoiQ47HbpPC4srSz3TSh88Spn9U82CCAEa4=; b=lxOF3wCqM/L0GKit+lMLaFTsi/NOgTx8E0IRdoOvt30JZ4bAb1I+MrWKWTfCB+m16N x97pfJIDYtdeiJArA/9qKyWbFuIGy2jFmj0GsaSn3p1JQp6DB64OZ74s8pDPz+Nbr1+u 6X+8UYWH0Q4LzJ/bRSYQU2D7SB139lLH0pkjwu/sbWAp776vrc1+Hj57sJxnEyck9FvN EG1he1oSM4v/1MBkiYbcFTSWEmWLoo5+/06lgL3nv/ikQ5BqLSU4PkH9nHERmCmsYObz oScor93JjGsQtgBSNfvAdiXM1Pb5/BES+5UJAAMEdCy34Dgm0QcjhPD57s2wuhJRe3hD LCHA== X-Gm-Message-State: AOAM53273xTWo3BZ3e61j8MyKhRUFYkAyG2lC5iuvDIkyUvci/eTdUrd C5kwnFNSv8tPIeXgbHNo41lN7SjfG4oDnsqbrxz2AS91MI8= X-Google-Smtp-Source: ABdhPJxDopexEla81gYdyop3eINKtPVBVXe6Am5tgIEFmXn/R1GPZShDTI+tSMpfQ2iDOVdy4EXUv68BwnndKTDgYa8= X-Received: by 2002:ac2:518c:: with SMTP id u12mr44987758lfi.91.1594430649466; Fri, 10 Jul 2020 18:24:09 -0700 (PDT) MIME-Version: 1.0 References: <3B0F8089-26CD-46F6-ACC4-B239358BF051@amazon.com> In-Reply-To: <3B0F8089-26CD-46F6-ACC4-B239358BF051@amazon.com> From: Dick Hardt Date: Fri, 10 Jul 2020 18:23:33 -0700 Message-ID: To: "Richard Backman, Annabelle" Cc: Mike Jones , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="0000000000007b04c705aa205041" Archived-At: Subject: Re: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 by Michael Jones X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Jul 2020 01:24:14 -0000 --0000000000007b04c705aa205041 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Email canonicalization is a big can of worms. I think adding in what is standardized per Mike's suggestion is useful. Below is a suggested revision for the second sentence. 3.2.1. Email Canonicalization Many email providers will treat multiple email addresses as equivalent. *W= hile the domain portion of the an RFC 5322 email address is consistently treated as case-insensitive per RFC 1034, some providers treat local part of the email address as case-insensitive, and consider "user@example.com ", "User@example.com ", and "USER@example.com " as equivalent email addresses. * On Fri, Jul 10, 2020 at 2:57 PM Richard Backman, Annabelle wrote: > Thanks for the review, Mike. I had a few follow up questions [richanna] > inline [/richanna]. > > > > =E2=80=93 > > Annabelle Backman (she/her) > > AWS Identity > > https://aws.amazon.com/identity/ > > > > > > *From: *Id-event on behalf of Mike Jones > > *Date: *Thursday, July 9, 2020 at 8:55 PM > *To: *"id-event@ietf.org" > *Subject: *[EXTERNAL] [Id-event] Review of > draft-ietf-secevent-subject-identifiers-05 by Michael Jones > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and kno= w > the content is safe. > > > > I did a cover-to-cover read of > draft-ietf-secevent-subject-identifiers-05. My resulting review comments > follow, grouped into substantive and editorial sections. > > > > SUBSTANTIVE COMMENTS > > > > Abstract =E2=80=93 Remove [JSON], [JWT], and [SET] references. Past IESG= reviews > of other specs have told me that citations are not allowed in abstracts, > since they need to stand alone without the rest of the specification. > > > > 2. Notational Conventions > > > > Copy > https://tools.ietf.org/html/draft-ietf-secevent-http-poll-12#section-1.2 > and make it a Definitions or Terminology sub-section under the current > Notational Conventions section. > > > > 3. Subject Identifiers =E2=80=93 The language =E2=80=9CEvery Subject Ide= ntifier Type MUST > have a unique name registered=E2=80=A6=E2=80=9D is surprisingly different= that the > corresponding JWT spec language with also allows Private identifiers and > Collision-Resistant identifiers. Why not also allow them here? > > > > [richanna] > > Funnily enough, this exact thing came up on the OIDF SSE call this week. > =F0=9F=98=83 > [/richanna] > > > > 3. Subject Identifiers =E2=80=93 The term =E2=80=9Cpayload claims=E2=80= =9D is confusing. Please > change this term to =E2=80=9CSubject Identification Claims=E2=80=9D throu= ghout the > specification. > > > > [richanna] > > Agreed on not using =E2=80=9Cpayload claims=E2=80=9D. Replacement is TBD,= but I think we > can and should avoid the word =E2=80=9Cclaim=E2=80=9D here, since that is= a very specific > thing in the JWT world. > [/richanna] > > > > 3.1. Account Subject Identifier Type =E2=80=93 Figure 1 =E2=80=93 This fi= gure is confusing > because it makes it seem like =E2=80=9Csubject_type=E2=80=9D and =E2=80= =9Curi=E2=80=9D are top-level JWT > claims. Please correct this possible confusion by adding "sub_id": to > the example. The updated example would look like this: > > > > "sub_id": { > > "subject_type": "account", > > "uri": "acct:example.user@service.example.com", > > } > > > > Also add "sub_id": to all other examples, such as those in 3.2, 3.3, 3.4, > etc. > > > [richanna] > Subject Identifiers can occur outside of JWTs, and not only as the value > of the JWT =E2=80=9Csub_id=E2=80=9D claim. Adding context representing on= e use case for > Subject Identifiers makes these examples unnecessarily complicated. I > suggested on Phil=E2=80=99s review that we could add examples of Subject > Identifiers being used in context (e.g., as a =E2=80=9Csub_id=E2=80=9D cl= aim or embedded > within a SET event payload) earlier in the doc, and move away from using > =E2=80=9Cclaim=E2=80=9D to refer to the members within a Subject Identifi= er JSON object. > Would that address your concern? > [/richanna] > > 3.2.1 Email Canonicalization =E2=80=93 Please add a note that the domain = portion > of an RFC 5322 addr-spec already must be treated in a case-insensitive > manner, per RFC 1034. > > > > [richanna] > It strikes me as weird to pull this into the doc. If we changed the secon= d > sentence of 3.2.1 to specify the local part, e.g., =E2=80=9Csome provider= s treat > the local part of email addresses as case-insensitive=E2=80=9D would that= address > your concern? > [/richanna] > > > > 3.3. Phone Number Subject Identifier =E2=80=93 Please change all instance= s of > =E2=80=9Cphone-number=E2=80=9D to =E2=80=9Cphone_number=E2=80=9D to match= the JWT claim of the same name. > This occurs multiple times throughout the specification. > > > > 3.4. Issuer and Subject Subject Type Identifier =E2=80=93 Add a note that= this is > the way that subjects are identified in OpenID Connect ID Tokens. > > > > 5.1. Identifier Correlation =E2=80=93 Add this phrase to the end of the l= ast > sentence =E2=80=9Cor when correlation is essential to the use case=E2=80= =9D. > > > > 6. Security Considerations =E2=80=93 Talk about integrity-protecting SETs= . Borrow > or reference security considerations from the other SecEvent specs. > > > > 7.1. Security Even Subject Identifier Types Registry =E2=80=93 Please add= a > suggestion to IANA that this registry be located at > https://www.iana.org/assignments/secevent/. > > > > 7.1.1. Registration Template =E2=80=93 Add underscore =E2=80=9C_=E2=80=9D= to the set of acceptable > characters. > > > > 7.1.1. Registration Template =E2=80=93 Change Controller =E2=80=93 Remove= OpenID > statements and replace them by IETF specifications and =E2=80=9CIETF=E2= =80=9D. > > > > 7.1.1. Registration Template =E2=80=93 Defining Document(s) =E2=80=93 Als= o add > =E2=80=9Cprohibited=E2=80=9D to the list of conditions to be described. > > > > 7.1.3. Guidance for Expert Reviewers =E2=80=93 State that multiple Expert > Reviewers should be appointed. You can borrow language about that from R= FC > 7519.. > > > > 7.2. JSON Web Token Claims Registration =E2=80=93 Change =E2=80=9Cestabli= shed by [SET]=E2=80=9D to > =E2=80=9Cestablished by =E2=80=9C[JWT]=E2=80=9D. > > > > Acknowledgements =E2=80=93 Also acknowledge the SecEvent working group an= d its > members. > > > > EDITORIAL COMMENTS > > > > 1. Introduction =E2=80=93 Change =E2=80=9Csection 1.2=E2=80=9D to =E2=80= =9CSection 1.2=E2=80=9D (and similarly > change to Title Case for any other occurrences of =E2=80=9Csection=E2=80= =9D, =E2=80=9Cfigure=E2=80=9D, or > =E2=80=9Ctable=E2=80=9D). > > > > 1. Introduction =E2=80=93 Add a comma after =E2=80=9Cbut not limited to= =E2=80=9D. > > > > 1. Introduction =E2=80=93 Add a comma after =E2=80=9Cfor example=E2=80=9D= . > > > > 2. Notational Conventions =E2=80=93 Update to use RFC 8417 language. > > > > 3. Subject Identifiers =E2=80=93 Change =E2=80=9Cwhich=E2=80=9D to =E2= =80=9Cthat=E2=80=9D in =E2=80=9Cwhich are to be > interpreted=E2=80=9D > > > > 3.1. Account Subject Identifier Type =E2=80=93 Figure 1 =E2=80=93 It=E2= =80=99s odd to have a > period ending a sentence fragment. Delete the period at the end of the > figure caption. Do this for all other figures when the caption is also a > sentence fragment, such as Figure 2, Figure 3, Figure 4, etc. > > > > 4.1. "sub_id" Claim =E2=80=93 Change "sub_id" to style=3D"verb">sub_id in the source so that the formatting is > correctly applied across all output representations. Similarly, use span= x > style verb for all other instances of literals in the specification. > > > > 4.1. "sub_id" Claim =E2=80=93 Likewise, change `sub` to style=3D"verb">sub and `sub_id` to style=3D"verb">sub_id. Search for other similar instances of use= s of > " ' or ` in the spec and correct them to spanx style verb. > > > > 4.2. =E2=80=9Csub_id=E2=80=9D and =E2=80=9Ciss-sub=E2=80=9D Subject Ident= ifiers =E2=80=93 This section seems to > repeat information in Section 3.4 (Issuer and Subject Subject Identifier > Type). Please consolidate them. > > > > 8.1. Normative References =E2=80=93 IANA.JWT.Claims =E2=80=93 Delete the = odd text =E2=80=9Cn.d.,=E2=80=9D. > > > > 8.1. Normative References =E2=80=93 Choose one of [JWT] or [RFC7519] and = delete > the other one. > > > > 8.1. Informative References =E2=80=93 Change [OIDC] to the standard refer= ence name > [OpenID.Core]. > > > > -- Mike > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --0000000000007b04c705aa205041 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
<personal hat>
Email canonicalization is a big can of worms. I think addin= g in what is standardized per Mike's suggestion is useful. Below is a s= uggested revision for the second sentence.

3.= 2.1.=C2=A0 Email Canonicalization

Many email provi= ders will treat multiple email addresses as equivalent.=C2=A0 While the = domain portion of the an RFC 5322 email address is consistently treated as = case-insensitive per RFC 1034, some providers treat local part of the email= address as case-insensitive, and consider "user@example.com", "User@example.com", and "USER@example.com" as equivalent email addresses.=C2=A0
<snip>

On Fri, Jul 10, 2020 at 2:57 P= M Richard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org> wrote:
<= /div>

Thanks for the review, Mike. I had a few follow up q= uestions [richanna] inline [/richanna].=

=C2=A0<= u>

=E2=80=93

Annabelle Backman (sh= e/her)

AWS Identity

https://aws.amazon.com/identity/<= /a>

=C2=A0

=C2=A0

From: Id-event <id-event-bounces@ie= tf.org> on behalf of Mike Jones <Michael.Jones=3D40microsoft.com@dmarc.i= etf.org>
Date: Thursday, July 9, 2020 at 8:55 PM
To: "id-= event@ietf.org" <id-event@ietf.org>
Subject: [EXTERNAL] [Id-event] Review of draft-ietf-secevent-subject= -identifiers-05 by Michael Jones

=C2=A0

CAUTION: This email originated from outside of the orga= nization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.<= /u>

=C2=A0

I did a cover-to-cover r= ead of draft-ietf-secevent-subject-identifiers-05.=C2=A0 My resulting revie= w comments follow, grouped into substantive and editorial sections.<= u>

=C2=A0

SUBSTANTIVE COMMENTS<= /u>

=C2=A0

Abstract =E2=80=93 Remov= e [JSON], [JWT], and [SET] references.=C2=A0 Past IESG reviews of other spe= cs have told me that citations are not allowed in abstracts, since they nee= d to stand alone without the rest of the specification.

=C2=A0

2.=C2=A0 Notational Conv= entions

=C2=A0

Copy https://tools.ietf.org/html/draft-ietf-secevent-http-poll-12#section-1.2 and make it a Definitions or Terminology sub-section under the current No= tational Conventions section.

=C2=A0

3.=C2=A0 Subject Identif= iers =E2=80=93 The language =E2=80=9CEvery Subject Identifier Type MUST hav= e a unique name registered=E2=80=A6=E2=80=9D is surprisingly different that= the corresponding JWT spec language with also allows Private identifiers and Collision-Resistant identifiers.=C2=A0 Why not also allow them here?

=C2=A0

[richanna]<= /u>

Funnily enough= , this exact thing came up on the OIDF SSE call this week. =F0=9F=98=83
[/richanna]

=C2=A0

3.=C2=A0 Subject Identif= iers =E2=80=93 The term =E2=80=9Cpayload claims=E2=80=9D is confusing.=C2= =A0 Please change this term to =E2=80=9CSubject Identification Claims=E2=80= =9D throughout the specification.

=C2=A0

[richanna]<= /u>

Agreed on not = using =E2=80=9Cpayload claims=E2=80=9D. Replacement is TBD, but I think we = can and should avoid the word =E2=80=9Cclaim=E2=80=9D here, since that is a= very specific thing in the JWT world.
[/richanna]

=C2=A0

3.1. Account Subject Ide= ntifier Type =E2=80=93 Figure 1 =E2=80=93 This figure is confusing because = it makes it seem like =E2=80=9Csubject_type=E2=80=9D and =E2=80=9Curi=E2=80= =9D are top-level JWT claims.=C2=A0 Please correct this possible confusion = by adding "sub_id": to the example.=C2=A0 The updated example wo= uld look like this:

=C2=A0

=C2=A0=C2=A0 "s= ub_id": {

=C2=A0=C2=A0=C2=A0= =C2=A0 "subject_type": "account",<= /p>

=C2=A0=C2=A0=C2=A0= =C2=A0 "uri": "acct:example.user@service.example.com&q= uot;,

=C2=A0=C2=A0 }

=C2=A0

Also add "sub_id": to all other examples, such as those in 3.2, 3.3= , 3.4, etc.


[richanna]
Subject Identifiers can occur outside of JWTs, and not only as the value of= the JWT =E2=80=9Csub_id=E2=80=9D claim. Adding context representing one us= e case for Subject Identifiers makes these examples unnecessarily complicat= ed. I suggested on Phil=E2=80=99s review that we could add examples of Subject Identifiers being used in context (e.g., as a =E2=80= =9Csub_id=E2=80=9D claim or embedded within a SET event payload) earlier in= the doc, and move away from using =E2=80=9Cclaim=E2=80=9D to refer to the = members within a Subject Identifier JSON object. Would that address your concern?
[/richanna]

3.2.1 Email Canonicaliza= tion =E2=80=93 Please add a note that the domain portion of an RFC 5322 add= r-spec already must be treated in a case-insensitive manner, per RFC 1034.<= u>

=C2=A0

[richanna]
It strikes me as weird to pull this into the doc. If we changed the second = sentence of 3.2.1 to specify the local part, e.g., =E2=80=9Csome providers = treat the local part of email addresses as case-insensitive=E2=80=9D would = that address your concern?
[/richanna]

=C2=A0

3.3. Phone Number Subjec= t Identifier =E2=80=93 Please change all instances of =E2=80=9Cphone-number= =E2=80=9D to =E2=80=9Cphone_number=E2=80=9D to match the JWT claim of the s= ame name.=C2=A0 This occurs multiple times throughout the specification.=

=C2=A0

3.4. Issuer and Subject = Subject Type Identifier =E2=80=93 Add a note that this is the way that subj= ects are identified in OpenID Connect ID Tokens.

=C2=A0

5.1. Identifier Correlat= ion =E2=80=93 Add this phrase to the end of the last sentence =E2=80=9Cor w= hen correlation is essential to the use case=E2=80=9D.

=C2=A0

6. Security Consideratio= ns =E2=80=93 Talk about integrity-protecting SETs.=C2=A0 Borrow or referenc= e security considerations from the other SecEvent specs.

=C2=A0

7.1. Security Even Subje= ct Identifier Types Registry =E2=80=93 Please add a suggestion to IANA that= this registry be located at ht= tps://www.iana.org/assignments/secevent/.

=C2=A0

7.1.1. Registration Temp= late =E2=80=93 Add underscore =E2=80=9C_=E2=80=9D to the set of acceptable = characters.

=C2=A0

7.1.1. Registration Temp= late =E2=80=93 Change Controller =E2=80=93 Remove OpenID statements and rep= lace them by IETF specifications and =E2=80=9CIETF=E2=80=9D.<= /p>

=C2=A0

7.1.1. Registration Temp= late =E2=80=93 Defining Document(s) =E2=80=93 Also add =E2=80=9Cprohibited= =E2=80=9D to the list of conditions to be described.

=C2=A0

7.1.3. Guidance for Expe= rt Reviewers =E2=80=93 State that multiple Expert Reviewers should be appoi= nted.=C2=A0 You can borrow language about that from RFC 7519..

=C2=A0

7.2. JSON Web Token Clai= ms Registration =E2=80=93 Change =E2=80=9Cestablished by [SET]=E2=80=9D to = =E2=80=9Cestablished by =E2=80=9C[JWT]=E2=80=9D.

=C2=A0

Acknowledgements =E2=80= =93 Also acknowledge the SecEvent working group and its members.<= /u>

=C2=A0

EDITORIAL COMMENTS

=C2=A0

1. Introduction =E2=80= =93 Change =E2=80=9Csection 1.2=E2=80=9D to =E2=80=9CSection 1.2=E2=80=9D (= and similarly change to Title Case for any other occurrences of =E2=80=9Cse= ction=E2=80=9D, =E2=80=9Cfigure=E2=80=9D, or =E2=80=9Ctable=E2=80=9D).

=C2=A0

1. Introduction =E2=80= =93 Add a comma after =E2=80=9Cbut not limited to=E2=80=9D.

=C2=A0

1. Introduction =E2=80= =93 Add a comma after =E2=80=9Cfor example=E2=80=9D.

=C2=A0

2.=C2=A0 Notational Conv= entions =E2=80=93 Update to use RFC 8417 language.

=C2=A0

3.=C2=A0 Subject Identif= iers =E2=80=93 Change =E2=80=9Cwhich=E2=80=9D to =E2=80=9Cthat=E2=80=9D in = =E2=80=9Cwhich are to be interpreted=E2=80=9D

=C2=A0

3.1. Account Subject Ide= ntifier Type =E2=80=93 Figure 1 =E2=80=93 It=E2=80=99s odd to have a period= ending a sentence fragment.=C2=A0 Delete the period at the end of the figu= re caption.=C2=A0 Do this for all other figures when the caption is also a sentence fragment, such as Figure 2, Figure 3, Figure 4, etc.<= /u>

=C2=A0

4.1. "sub_id" = Claim =E2=80=93 Change "sub_id" to <spanx style=3D"verb&q= uot;>sub_id</spanx> in the source so that the formatting is correc= tly applied across all output representations.=C2=A0 Similarly, use spanx s= tyle verb for all other instances of literals in the specification.

=C2=A0

4.1. "sub_id" = Claim =E2=80=93 Likewise, change `sub` to <spanx style=3D"verb"= ;>sub</spanx> and `sub_id` to <spanx style=3D"verb"&g= t;sub_id</spanx>.=C2=A0 Search for other similar instances of uses of= " ' or ` in the spec and correct them to spanx style verb.

=C2=A0

4.2. =E2=80=9Csub_id=E2= =80=9D and =E2=80=9Ciss-sub=E2=80=9D Subject Identifiers =E2=80=93 This sec= tion seems to repeat information in Section 3.4 (Issuer and Subject Subject= Identifier Type).=C2=A0 Please consolidate them.

=C2=A0

8.1. Normative Reference= s =E2=80=93 IANA.JWT.Claims =E2=80=93 Delete the odd text =E2=80=9Cn.d.,=E2= =80=9D.

=C2=A0

8.1. Normative Reference= s =E2=80=93 Choose one of [JWT] or [RFC7519] and delete the other one.

=C2=A0

8.1. Informative Referen= ces =E2=80=93 Change [OIDC] to the standard reference name [OpenID.Core].

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= -- Mike

=C2=A0

=C2=A0

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--0000000000007b04c705aa205041-- From nobody Sat Jul 11 01:50:21 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05D223A08F8 for ; Sat, 11 Jul 2020 01:50:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0n-AxjPNU39X for ; Sat, 11 Jul 2020 01:50:17 -0700 (PDT) Received: from mail-wm1-x32c.google.com (mail-wm1-x32c.google.com [IPv6:2a00:1450:4864:20::32c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 501F03A08F4 for ; Sat, 11 Jul 2020 01:50:17 -0700 (PDT) Received: by mail-wm1-x32c.google.com with SMTP id l17so8436220wmj.0 for ; Sat, 11 Jul 2020 01:50:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version; bh=zt6Xdgryh6KBXKqgvEanft4joewhigQr2Yl1nGVIcos=; b=bln/mPU/+4+FltnZ4DA2ngPU3i5TZTqKUjFagIK4dCA+0QpBRqJEbZzbtlqYsfaI35 cpThZIjHIenV5tORP3QiQQxdPmFxQxWbf6nddwBZg+1IfmsjSKXByQ4wxUW9XConh+Y1 6eFEmEa09M6twdEbTJ4g624QysRF1azbHk0SWRef5xyDXjeomiq6V+/zw4TY1QIbiClo 1vxqn7eEQeE0pQsofbi1WtYply6etw5aEZaGX0EzlkITKRcQsF6Yf3lNQBdwA3TznLVf be+lKzHbsI9Bf3YbsMmyQPU4+sBJm4DaO+x+tClifOCW7b4amZ8hZeoaFRndTA8Ufviz BhAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version; bh=zt6Xdgryh6KBXKqgvEanft4joewhigQr2Yl1nGVIcos=; b=re0ltqsxACUP0P04E/DuZWi8TPJ8rNPW3oGLgX2NkA2zbiLR9y16QVBsBH2K3ION2l CGtd2qVCBTy2bHpayQwOAMaHXMmDEuWz0hux74YNnYRlen9tA38GSHcWXtw+NwZfGdYK Q4FxrVHG2ykPOduchZ0G829U4tF2BScFBG5u9kYQDXXSAsi8DIoURhQtmY6PWfahFuzx Ca2qzN/J66cEjy5IFzYQg6t9gQvqxIc7W6uosiiAICXt66bqiItE/iPFDODfUV1idrPn btGk1hAZB5tQqKeisSRwc/cb3nMrXtQm4UboM2totFvomwEsMuhr1Nd5e7i07B9sPV2r 1SVw== X-Gm-Message-State: AOAM533f6Fj3Np177r+Ei3VFIbD0LVVV3PulaTkmrmJHUh8PL7xZUyOr SzGeVDj03mkob8auXgtpZs0= X-Google-Smtp-Source: ABdhPJw4znWlFMgv2FX6ZD/TeELiSY4IfnpXgx/sa+MGx2AYGF3zIGexAsFVeIqV5JrnMHtE2xaknw== X-Received: by 2002:a05:600c:2152:: with SMTP id v18mr9605835wml.5.1594457415776; Sat, 11 Jul 2020 01:50:15 -0700 (PDT) Received: from [172.26.49.35] (pub-corp-42-8.intuit.com. [91.102.42.8]) by smtp.gmail.com with ESMTPSA id n3sm1334080wrm.87.2020.07.11.01.50.14 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 11 Jul 2020 01:50:15 -0700 (PDT) User-Agent: Microsoft-MacOutlook/16.38.20061401 Date: Sat, 11 Jul 2020 11:50:13 +0300 From: Yaron Sheffer To: Phillip Hunt , "Richard Backman, Annabelle" CC: "id-event@ietf.org" Message-ID: <4D5A3396-12E1-42DE-8B93-B9E65545C3DD@gmail.com> Thread-Topic: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 References: In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3677313014_31954415" Archived-At: Subject: Re: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Jul 2020 08:50:20 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3677313014_31954415 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Fully agree with Phil about the scope. If some other spec wants to reuse th= is document, they can refer to it after ensuring that this solution is appro= priate for them. But let=E2=80=99s not try to boil the ocean with this draft. =20 Thanks, =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron =20 From: Id-event on behalf of Phillip Hunt Date: Saturday, July 11, 2020 at 03:49 To: "Richard Backman, Annabelle" Cc: "id-event@ietf.org" Subject: Re: [Id-event] Review of draft-ietf-secevent-subject-identifiers-0= 5 =20 In line.=20 Phil On Jul 10, 2020, at 4:57 PM, Richard Backman, Annabelle wrote: =EF=BB=BF=20 I=E2=80=99ve reviewed the current draft, and have a few novel comments/topics for= discussion that haven=E2=80=99t been raised already by other reviewers: =20 Should we remove =E2=80=9Cfor Security Event Tokens=E2=80=9D from the title? Nothing ab= out the spec is specific to SETs or even JWTs, except perhaps the definition= of =E2=80=9Csubject=E2=80=9D. It=E2=80=99s telling that while the abstract and introduction w= ould need to be reworked, the rest of the text would not require any changes= . =20 This spec was supposed to solve the =E2=80=9Csub=E2=80=9D ambiguity problem for set and= jwt. And the issue of collision around =E2=80=9Ciss=E2=80=9D which is supposed to be th= e issuer of the SET.=20 =20 Opening the scope beyond that would delay finalizing this draft as broader = considerations and need discussion.=20 Section 4: Add context for why =E2=80=9Csub_id=E2=80=9D is needed, given that =E2=80=9Csub=E2=80=9D= already exists. I.e., =E2=80=9Csub=E2=80=9D is a single string value so cannot represen= t complex subject identifiers. Agreed. This needs more clarification. I remain concerned about duplication= and interop issues.=20 Section 4.2: Clarify that the =E2=80=9Ciss=E2=80=9D property of the Subject Identifier = is REQUIRED regardless of whether its value is the same as the JWT=E2=80=99s =E2=80=9Cis= s=E2=80=9D claim. =20 This is a serious problem is the =E2=80=9Ciss=E2=80=9D of the set is not the =E2=80=9Ciss=E2=80=9D = of =E2=80=9Csub=E2=80=9D. I thought that was why we wanted a json object expression.=20 =20 This was also why way back when when i published the original draft proposa= l that I proposed sub and iss be embedded in the payload so as not to be con= fused by top level claims which are about the container (ie set) =E2=80=9Cmessage=E2= =80=9D.=20 =20 =20 Section 4.2: Is there a use case where the =E2=80=9Ciss=E2=80=9D may be the same for th= e JWT and Subject Identifier, but =E2=80=9Csub=E2=80=9D may be different? More important= ly, is there a reason why this would need to be prohibited? See above. =20 =20 Section 6: Call out that Subject Identifiers do not provide any mechanism f= or insuring confidentiality and/or integrity protection, and thus rely on th= e mechanisms offered by the containing formats and/or protocols within which= they are used. =20 =E2=80=93 Annabelle Backman (she/her) AWS Identity https://aws.amazon.com/identity/ =20 _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event _______________________________________________ Id-event mailing list Id-ev= ent@ietf.org https://www.ietf.org/mailman/listinfo/id-event=20 --B_3677313014_31954415 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Fully agree with Ph= il about the scope. If some other spec wants to reuse this document, they ca= n refer to it after ensuring that this solution is appropriate for them. But= let=E2=80=99s not try to boil the ocean with this draft.

 

<= p class=3DMsoNormal>Thanks,

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Yaron

 

From: Id-event <id-eve= nt-bounces@ietf.org> on behalf of Phillip Hunt <phil.hunt@independenti= d.com>
Date: Saturday, July 11, 2020 at 03:49
To: &qu= ot;Richard Backman, Annabelle" <richanna=3D40amazon.com@dmarc.ietf.org= >
Cc: "id-event@ietf.org" <id-event@ietf.org>Subject: Re: [Id-event] Review of draft-ietf-secevent-subject-ident= ifiers-05

 

In line. 

P= hil



On Jul 10, 2020, at 4:57 PM, Richard Backman, Annabe= lle <richanna=3D40amazon.com@dmarc.ietf.org> wrote:

<= p class=3DMsoNormal>=EF=BB=BF

<= p class=3DMsoNormal>I=E2=80=99ve reviewed the current= draft, and have a few novel comments/topics for discussion that haven=E2=80=99t b= een raised already by other reviewers:

 

  1. Should we remove =E2= =80=9Cfor Security Event Tokens=E2=80=9D from the title? Nothing about the spec is spe= cific to SETs or even JWTs, except perhaps the definition of =E2=80=9Csubject=E2=80=9D. = It=E2=80=99s telling that while the abstract and introduction would need to be rew= orked, the rest of the text would not require any changes.=

 

This spec was supposed to solve the =E2=80=9Csub=E2=80=9D ambiguity prob= lem for set and jwt. And the issue of collision around =E2=80=9Ciss=E2=80=9D which is su= pposed to be the issuer of the SET. 

 

=

Opening the scope bey= ond that would delay finalizing this draft as broader considerations and nee= d discussion. 

  1. =

  2. Section 4: Add context for why =E2=80=9Csub_id=E2=80=9D is needed, given= that =E2=80=9Csub=E2=80=9D already exists. I.e., =E2=80=9Csub=E2=80=9D is a single string value so = cannot represent complex subject identifiers.

Agreed. Th= is needs more clarification. I remain concerned about duplication and intero= p issues. 



  1. Section 4.2: Clarify that the =E2=80=9Ciss=E2=80=9D property of the Subject = Identifier is REQUIRED regardless of whether its value is the same as the JW= T=E2=80=99s =E2=80=9Ciss=E2=80=9D claim.
 

=

This is a serious pr= oblem is the =E2=80=9Ciss=E2=80=9D of the set is not the =E2=80=9Ciss=E2=80=9D of =E2=80=9Csub=E2=80=9D. I thoug= ht that was why we wanted a json object expression. <= /p>

 <= /o:p>

This was also why way back when when i published the original draft proposa= l that I proposed sub and iss be embedded in the payload so as not to be con= fused by top level claims which are about the container (ie set) =E2=80=9Cmessage=E2= =80=9D. 

  1.  = ;

&n= bsp;

  1. Section 4.2: Is there a use case where the =E2=80=9Ciss=E2=80=9D m= ay be the same for the JWT and Subject Identifier, but =E2=80=9Csub=E2=80=9D may be diff= erent? More importantly, is there a reason why this would need to be prohibi= ted?

See above.

  1.  

 

  1. Section 6: Call out that Sub= ject Identifiers do not provide any mechanism for insuring confidentiality a= nd/or integrity protection, and thus rely on the mechanisms offered by the c= ontaining formats and/or protocols within which they are used.

 

=E2=80=93

Anna= belle Backman (she/her)

AWS Identity

https://aws.amazon.com/identity/=

 

_______________________________________________
Id-even= t mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo= /id-event

<= span style=3D'font-size:11.0pt'>______________________________________________= _ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listi= nfo/id-event

--B_3677313014_31954415-- From nobody Sun Jul 12 19:38:47 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CAEA3A0915 for ; Sun, 12 Jul 2020 19:38:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.7 X-Spam-Level: X-Spam-Status: No, score=-15.7 tagged_above=-999 required=5 tests=[DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wxpLVRbLxN2Y for ; Sun, 12 Jul 2020 19:38:45 -0700 (PDT) Received: from mail-yb1-xb35.google.com (mail-yb1-xb35.google.com [IPv6:2607:f8b0:4864:20::b35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E346B3A08E6 for ; Sun, 12 Jul 2020 19:38:44 -0700 (PDT) Received: by mail-yb1-xb35.google.com with SMTP id x138so4126442ybg.9 for ; Sun, 12 Jul 2020 19:38:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=NUwGOvhepfLE7TEd7eZlu8Fq9y/ZKsp8wMXR/4clWY8=; b=ja8k3V8Iy4DpktgccOLBxV3U+3PGgHk08k0AG0uK1Xn75K3aoPbQZhtjSPY7ODvg7P AMZSoGridcZAR7zRIsB50lUd1jzUA0MkgD1S2Zcuvka3rNHURnUCqOzXP1VQ7tvySWdG +aXtSQHbZS9/V7HtehQ09wYDqxs09MflwF6wJLGFkMjHtFW2IutvugmEj93Y8iYFh0Rd I+SoxpPlBLisKH2Nbc7pKGZTCAQoXw041IPzZRR1YWgKZoarXtjgJGGgWnQWD9bpUVDe 5iazC6VqjBLJS35vWqMSKIlAUECmemuAOSORjYXwLaLi5Oyu1LR92jtCld4tVg3TBc6p XFTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=NUwGOvhepfLE7TEd7eZlu8Fq9y/ZKsp8wMXR/4clWY8=; b=X5UtldDABhOAKBc1dZW3t3cDjCLbeZzRaAwv+HbB3MOR1UedL9hswmJQQhdE8kowhs QmCnuS1jOuaC0CR8lceRGBz4AJuv/rKyyPkWmosh0FYvrsclycfAk9xOGCWP52wKMtNp Svc7DxihyPBk5LqLk9XQFvcA4NZpljKzjZ6iiNSSeaANqYS/L3+IPkCstW+NZs1e53IC SyGbEbCyYKa5xrxdZ8oc02ZCniRcz0z8WMYOBebE094LxRdxQdMBOrtJ4W3wDM5tJghg uGKHRWtoLW+6F4Ab7hEPJiUMX6XlZeMRVdL0Dfw4sbie2HbhAZEnmPhn0lMl+oip8+OA D1xA== X-Gm-Message-State: AOAM5307sp5nppWkY/hKBKnawLf8qzp3cE0TXQXMKgcJbFL9Sshvr/Qv vGDL1qA7IpAEDfwaLDE1u6XYBmSeARK/+oDcHPOO9WITI9Q= X-Google-Smtp-Source: ABdhPJzCZbTtfUtc8SY98ttz9fxUh3rKex3RFMmF+mPziIvj/DDld/sy3y9cZLoZK9c7liTqdfRN650KU24ErB2fwxE= X-Received: by 2002:a25:5ac5:: with SMTP id o188mr58847681ybb.322.1594607923483; Sun, 12 Jul 2020 19:38:43 -0700 (PDT) MIME-Version: 1.0 From: Atul Tulshibagwale Date: Sun, 12 Jul 2020 19:38:32 -0700 Message-ID: To: id-event@ietf.org, Openid-specs-risc Cc: Annabelle Richard , Marius Scurtescu , michaeljones_fwd Content-Type: multipart/alternative; boundary="000000000000d633e105aa499691" Archived-At: Subject: [Id-event] SSE changes to the Subject Identifiers Spec X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 02:38:46 -0000 --000000000000d633e105aa499691 Content-Type: text/plain; charset="UTF-8" Hi all, We've made a number of changes to the subject-identifiers spec in the OpenID "Shared Signals and Events" working group. I have incorporated these changes in a pull request to the present draft in the repository https://github.com/richanna/secevent. Please review the changes here: https://github.com/richanna/secevent/pull/1 Summary of the changes: 1. Defined "Subject Principals" as management entities that are represented by the subject identifiers 2. Defined "Subject Principal Administrative Groupings" or SPAGs that may be used for certain events that pertain to the entire grouping. IRL Spags may be tenants in a multi-tenanted host or may be OUs or groups within a tenant. 3. Defined the following Common Claims that may be applied to any subject identifier: 1. spag_id: An optional claim that can be used to ensure uniqueness of the subject identifier within the SPAG. 2. category: An optional claim that can be used to define the scope of the subject identifier. E.g., Does a phone number represent the user or the device the user is using. The category can disambiguate this. 4. Added a SAML subject identifier type as was needed by some use cases in SSE. 5. Added myself as a co-author, given the scope of these changes. Thanks, Atul --000000000000d633e105aa499691 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,
We've made a number of changes to the subj= ect-identifiers spec in the OpenID "Shared Signals and Events" wo= rking group. I have incorporated these changes in a pull request to the pre= sent draft in the repository https://github.com/richanna/secevent.

Pleas= e review the changes here:
=

Summary of the changes:
  1. Defined "= ;Subject Principals" as management entities that are represented by th= e subject identifiers
  2. Defined "Subject Principal Administrativ= e Groupings" or SPAGs that may be used for certain events that pertain= to the entire grouping. IRL Spags may be tenants in a multi-tenanted host = or may be OUs or groups within a tenant.
  3. Defined the following Comm= on Claims that may be applied to any subject identifier:
    1. spag_i= d: An optional claim that can be used to ensure uniqueness of the subject i= dentifier within the SPAG.
    2. category: An optional claim that can be = used to define the scope of the subject identifier. E.g., Does a phone numb= er represent the user or the device the user is using. The category can dis= ambiguate this.
  4. Added a SAML subject identifier type as was ne= eded by some use cases in SSE.
  5. Added myself as a co-author, given t= he scope of these changes.
Thanks,
Atul
=

--000000000000d633e105aa499691-- From nobody Sun Jul 12 22:15:26 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA00F3A0D0C for ; Sun, 12 Jul 2020 22:15:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.097 X-Spam-Level: X-Spam-Status: No, score=-0.097 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=momentumft.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GOKhkUIJjdvl for ; Sun, 12 Jul 2020 22:15:23 -0700 (PDT) Received: from mail-oi1-x22e.google.com (mail-oi1-x22e.google.com [IPv6:2607:f8b0:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4AADC3A0D08 for ; Sun, 12 Jul 2020 22:15:23 -0700 (PDT) Received: by mail-oi1-x22e.google.com with SMTP id k6so9974757oij.11 for ; Sun, 12 Jul 2020 22:15:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=momentumft.co.uk; s=google; h=mime-version:from:date:message-id:subject:to; bh=mqcIr8YCUoURNkby9WXb7U4wZQ7EGla7hdI8eRpnfY0=; b=deI7V1xL5B1gsuIMxlAvGhM47alK953DqJnRf51cd+10w1Q8d6j1ma0KtTeQW22EDf 04OyOh9G6SwMEJZ9Jv6Gg0bHwWeCMBc5KEstw47yVJhPWbV9FXaXHF7F+/9Aa9D7hVED 8FQfQM59NiQMuhBUkQ/5e8vBArCbcq/9BiDnM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=mqcIr8YCUoURNkby9WXb7U4wZQ7EGla7hdI8eRpnfY0=; b=rcrm17ntugWkAWfxu5IK7DNwwHd7AjIzN7cWeeAT0nUJmwl/b/npyLbYWAtmWE63lT Cvpp9y68kY2edZeSHC3fYJJde7aApcu1ZXpnN6te17m9kerFYpX/ZGIsP+uamge++X8o +0RdXYPMqmgEBJim6ALLai0DCwuJam+KuTAs1D6aYleU3yiJnskSWxvFUyHh4ca2zBDc 2xqnmd255Xn3VFVOKzGt4vNmTtJh415sUBj7P8388vidAjYPWvvySGbxNseEKrvoicft IRE2N1LpmDE8eKl7lPiVaxxvUk5GC9ANaMAgWeJBFkndwDhsmUJpV1xSlhasgbNfhpIl CMaw== X-Gm-Message-State: AOAM5315uP2Wq/UeVDZ9bOgfCc/MPvzqj0dx975BqiroJ3y+JlZH/995 w6tYSowFS4+A76FTuLIoL1Nd0PicG2VBakstlf0YWogEC3m7Rt3WFekx+0EjwPrMQplqtICqgN4 MImcKJGE5kwrmmywLc9ZPRInMIQ== X-Google-Smtp-Source: ABdhPJxPndq/ZvQdsSJZeQH/FlMfjtfnJHcDofbkl2cby1iC8tbzcT+vPnEcy4FFLvLSWwJMqE6e7j1Al6519DHLe6c= X-Received: by 2002:aca:edc1:: with SMTP id l184mr13389190oih.99.1594617316997; Sun, 12 Jul 2020 22:15:16 -0700 (PDT) MIME-Version: 1.0 From: Dave Tonge Date: Mon, 13 Jul 2020 07:15:06 +0200 Message-ID: To: SecEvent Content-Type: multipart/alternative; boundary="000000000000bb906e05aa4bc6b8" Archived-At: Subject: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 05:15:25 -0000 --000000000000bb906e05aa4bc6b8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I'm really keen to see this draft progress and so have reviewed the current text. *Introduction* I think it would be good to add some text to make it clear that while the initial use case fo this spec is for SETs, there is nothing stopping it being used in other contexts where parties need to communicate the identity of a subject.For example we were looking at using this spec to have structured a `login_hint` or `login_hint_token` in OIDC or CIBA flows. *3.5. Aliases Subject Identifier Type* I definitely see this as a useful feature, however would it not be simpler to define `sub_id` as an array, rather than have a specific "alias" type? *Privacy Considerations* Given that subject identifiers will often be personally identifiable information, I think that there should be a sentence stating that if this schema is used in any front-channel communication, then the token in which the identifiers are embedded should be encrypted. Thanks --=20 Dave Tonge --=20 Moneyhub Enterprise is a trading style of Moneyhub Financial Technology=20 Limited which is authorised and regulated by the Financial Conduct=20 Authority ("FCA"). Moneyhub Financial Technology is entered on the=20 Financial Services Register (FRN 809360) at https://register.fca.org.uk/=20 . Moneyhub Financial Technology is registered= =20 in England & Wales, company registration number 06909772. Moneyhub=20 Financial Technology Limited 2020 =C2=A9 Moneyhub Enterprise, Regus Buildin= g,=20 Temple Quay, 1 Friary, Bristol, BS1 6EA.=C2=A0 DISCLAIMER: This email=20 (including any attachments) is subject to copyright, and the information in= =20 it is confidential. Use of this email or of any information in it other=20 than by the addressee is unauthorised and unlawful. Whilst reasonable=20 efforts are made to ensure that any attachments are virus-free, it is the= =20 recipient's sole responsibility to scan all attachments for viruses. All=20 calls and emails to and from this company may be monitored and recorded for= =20 legitimate purposes relating to this company's business. Any opinions=20 expressed in this email (or in any attachments) are those of the author and= =20 do not necessarily represent the opinions of Moneyhub Financial Technology= =20 Limited or of any other group company. --000000000000bb906e05aa4bc6b8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Thanks,
Atul

--00000000000074d6f805aa54cd3b-- From nobody Mon Jul 13 09:09:43 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E8BE3A141D for ; Mon, 13 Jul 2020 09:09:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.98 X-Spam-Level: X-Spam-Status: No, score=-1.98 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MALFORMED_FREEMAIL=0.116, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JJautTsMohYz for ; Mon, 13 Jul 2020 09:09:40 -0700 (PDT) Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com [IPv6:2a00:1450:4864:20::432]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF52A3A14EC for ; Mon, 13 Jul 2020 09:09:14 -0700 (PDT) Received: by mail-wr1-x432.google.com with SMTP id r12so17097586wrj.13 for ; Mon, 13 Jul 2020 09:09:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version; bh=tkA/lCPBeXJqclomuLGnditOMjrqi68T4Gav//EHmYk=; b=qJXKFJa8EcDm958MjCOtMOztqWM9PwvvW4iFA4jFZkYHCtmoua3rp3DhXRoxRUY5sQ +b0Zh31H2CVLLEbhEdfWRE5Ns52FQTUhrwaSf+2JXNeYlVqYcvnHaQJ87WjcRJRzki0f bu+HAV8Lfqpz/YbtqS+mPqJDf9PwxjyZ3VRPzu8O6wE2JZbX6T3OjMfprXcKvK2+kVjg HL2Jy+DT2hZAjYJNXLgmFxfTo/QWFMvViRcSba7m8KmDLciZVYOa1m4HvmeRszdt9AjI mipIV5Xt0YkiFX1YFjtNgeL5VkO9oMcqwz8c8gpcwJ+sOS+jSAwxcuM4TMFMjpSD7TPp U0Ww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version; bh=tkA/lCPBeXJqclomuLGnditOMjrqi68T4Gav//EHmYk=; b=Ynt+lS2ADFO5w3a3yQw/SKsg7Psr813tFcLMMd9iIPHcO2WhpuyByYyJwhOfItuJIn kDrey3ltvcenfYmfaUWuRIGKftHJcdKuJHyA0mKIUKchnD5c/oLaaFe4XZdjKcM4SIx2 QsQ7hwWfKwijmuNwPhnkOSaAj2QgSRwHsSWbLdaYwkbBREVQOiDtoODNKx2zxLJ+gODu jyqe/Unz3WHt6bb5IiQkFSd3tedstQkQlG3XUupg8PwiVCfkxIlUEIXLpbYzoSecBLTQ VlRs+YE6cp8vizhX4b9pCXMLPQm/n3FA5W8PMV4rmyzSxKIJYT31W+elq5PCbenTO9ok V17g== X-Gm-Message-State: AOAM531nMEPM2g+SqWvGEa24koOmZliZcT/JjehcdvjHGcTrEYt/FEwj IgC6PxdbO6mlCmJogO3k4tc= X-Google-Smtp-Source: ABdhPJxJbzNjKFcDfj6Z1EGqPuuHJJBIw4/rdEsAbfsCU9tLs6lCUISAPENCW+o38MmdnwhoUvYXmw== X-Received: by 2002:a5d:4c91:: with SMTP id z17mr35940wrs.267.1594656553234; Mon, 13 Jul 2020 09:09:13 -0700 (PDT) Received: from [172.26.49.35] (pub-corp-42-8.intuit.com. [91.102.42.8]) by smtp.gmail.com with ESMTPSA id k4sm2741895wrp.86.2020.07.13.09.09.11 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 Jul 2020 09:09:12 -0700 (PDT) User-Agent: Microsoft-MacOutlook/16.38.20061401 Date: Mon, 13 Jul 2020 19:09:10 +0300 From: Yaron Sheffer To: Atul Tulshibagwale CC: , Openid-specs-risc , Annabelle Richard , Marius Scurtescu , michaeljones_fwd Message-ID: Thread-Topic: [Id-event] SSE changes to the Subject Identifiers Spec References: <1D584A11-F583-4E25-940A-F4F89C9A6BD1@gmail.com> In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3677512152_192843941" Archived-At: Subject: Re: [Id-event] SSE changes to the Subject Identifiers Spec X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 16:09:42 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3677512152_192843941 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Hi Atul, =20 Formally, if this is a working group document (which it currently is not, b= ut the editors would like it to be), then the working group needs to decide = on any significant changes to the document. The SSE discussion is very relev= ant background, but it does not replace SecEvent working group discussion/co= nsensus. =20 Thanks, =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron =20 From: Atul Tulshibagwale Date: Monday, July 13, 2020 at 18:40 To: Yaron Sheffer Cc: , Openid-specs-risc , Annabelle Richard , Marius Scurtescu , michaeljones_fwd Subject: Re: [Id-event] SSE changes to the Subject Identifiers Spec =20 Hi Yaron, Thanks for the suggestion, I will start a new thread for each topic. Just F= YI as background: We have discussed these changes in the OpenID Shared Signa= ls and Events group, but happy to discuss them here again. =20 Atul =20 =20 On Mon, Jul 13, 2020 at 1:44 AM Yaron Sheffer wrote= : Hi Atul, =20 Thank you for your contribution! =20 You are introducing 3-4 new concepts into this draft (including the notion = of =E2=80=9Cconformance=E2=80=9D which you have not listed below). I think it would be m= ore appropriate to start an email thread on this list on each one, in order = to gauge the working group=E2=80=99s interest. In general the IETF reserves the PR= process for smaller, editorial changes, or else for changes that had alread= y been discussed by the mailing list. =20 Thanks, Yaron =20 From: Id-event on behalf of Atul Tulshibagwale = Date: Monday, July 13, 2020 at 05:38 To: , Openid-specs-risc Cc: Annabelle Richard , Marius Scurtescu , michaeljones_fwd Subject: [Id-event] SSE changes to the Subject Identifiers Spec =20 Hi all, We've made a number of changes to the subject-identifiers spec in the OpenI= D "Shared Signals and Events" working group. I have incorporated these chang= es in a pull request to the present draft in the repository https://github.c= om/richanna/secevent. =20 Please review the changes here: https://github.com/richanna/secevent/pull/1 =20 Summary of the changes: Defined "Subject Principals" as management entities that are represented by= the subject identifiers Defined "Subject Principal Administrative Groupings" or SPAGs that may be u= sed for certain events that pertain to the entire grouping. IRL Spags may be= tenants in a multi-tenanted host or may be OUs or groups within a tenant. Defined the following Common Claims that may be applied to any subject iden= tifier: spag_id: An optional claim that can be used to ensure uniqueness of the sub= ject identifier within the SPAG. category: An optional claim that can be used to define the scope of the sub= ject identifier. E.g., Does a phone number represent the user or the device = the user is using. The category can disambiguate this. Added a SAML subject identifier type as was needed by some use cases in SSE= . Added myself as a co-author, given the scope of these changes. Thanks, Atul =20 _______________________________________________ Id-event mailing list Id-ev= ent@ietf.org https://www.ietf.org/mailman/listinfo/id-event=20 --B_3677512152_192843941 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Hi Atul,

&nb= sp;

Formally, if this is a working group documen= t (which it currently is not, but the editors would like it to be), then the= working group needs to decide on any significant changes to the document. T= he SSE discussion is very relevant background, but it does not replace SecEv= ent working group discussion/consensus.

 

Thanks,

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

 

From: Atul= Tulshibagwale <atultulshi@google.com>
Date: Monday, July 13= , 2020 at 18:40
To: Yaron Sheffer <yaronf.ietf@gmail.com>Cc: <id-event@ietf.org>, Openid-specs-risc <openid-specs-ri= sc@lists.openid.net>, Annabelle Richard <richanna@amazon.com>, Mari= us Scurtescu <marius.scurtescu@coinbase.com>, michaeljones_fwd <Mic= hael.Jones@microsoft.com>
Subject: Re: [Id-event] SSE changes t= o the Subject Identifiers Spec

 

Hi Yaron,

Thanks for the suggestion, I will start a new t= hread for each topic. Just FYI as background: We have discussed these change= s in the OpenID Shared Signals and Events group, but happy to discuss them h= ere again.

 

=

Atul

 

 

=

On Mon, Jul 13, 2020 at 1:44 AM Yaron Sheffer &= lt;yaronf.ietf@gmail.com> wrot= e:

Hi Atul,

 

Thank you for your c= ontribution!

 

You are introducing 3-4 = new concepts into this draft (including the notion of =E2=80=9Cconformance=E2=80=9D whic= h you have not listed below). I think it would be more appropriate to start = an email thread on this list on each one, in order to gauge the working grou= p=E2=80=99s interest. In general the IETF reserves the PR process for smaller, edi= torial changes, or else for changes that had already been discussed by the m= ailing list.

 

Thanks,

=             &nbs= p;   Yaron

 

From: Id-event <id-event-bounces@ietf.org> on behalf of Atul Tulshiba= gwale <atultulshi=3D40google.com@dmarc.ietf.org>
Date: Monday, July 13, 2= 020 at 05:38
To: <id-event@ietf.org>, Openid-specs-risc <openid-specs-risc@lists.openi= d.net>
Cc: Annabelle Richard <richanna@amazon.com>, Marius Scurtescu <= ;marius.scurt= escu@coinbase.com>, michaeljones_fwd <Michael.Jones@microsoft.com>
S= ubject: [Id-event] SSE changes to the Subject Identifiers Spec

 

Hi all,

We've made a number of changes to the subject-identifiers spec i= n the OpenID "Shared Signals and Events" working group. I have inc= orporated these changes in a pull request to the present draft in the reposi= tory https://= github.com/richanna/secevent.

 

Please review the changes here:

 = ;

Summary of the changes:

  1. Defined "Subject Princi= pals" as management entities that are represented by the subject identi= fiers
  2. Defined "Subject Princi= pal Administrative Groupings" or SPAGs that may be used for certain eve= nts that pertain to the entire grouping. IRL Spags may be tenants in a multi= -tenanted host or may be OUs or groups within a tenant.
  3. Defined the following Common Claims that may be applie= d to any subject identifier:
    1. spag_id: An optional claim that can be= used to ensure uniqueness of the subject identifier within the SPAG.
    2. category: An optional claim that can be = used to define the scope of the subject identifier. E.g., Does a phone numbe= r represent the user or the device the user is using. The category can disam= biguate this.
  1. Added a SAML subject identifier type as was needed by some use case= s in SSE.
  2. Added myself as a co-aut= hor, given the scope of these changes.

Thanks,

Atul

 

_______________________________________________ Id-eve= nt mailing list Id-event@= ietf.org https://www.ietf.org/mailman/listinfo/id-event

=
Hi,

I'm really keen to see this draft p= rogress and so have reviewed the current text.

Introducti= on
I think it would be good to add some text to make it clear that= while the initial use case fo this spec is for SETs, there is nothing stop= ping it being used in other contexts where parties need to communicate the = identity of a subject.For example we were looking at using this spec to hav= e structured a `login_hint` or `login_hint_token` in OIDC or CIBA flows.

3.5.=C2=A0 Aliases Subject Identifier Type
I definitely see this as a useful feature, however would it not be= simpler to define `sub_id` as an array, rather than have a specific "= alias" type?

Privacy Conside= rations
Given that subject identifiers will often be p= ersonally identifiable information, I think that there should be a sentence= stating that if this schema is used in any front-channel communication, th= en the token in which the identifiers are embedded should be encrypted.


Thanks

--
Dave Tonge

<= /div>

Moneyhub Enterprise is a trading style of Moneyhub Financi= al Technology Limited which is authorised and regulated by the Financial Co= nduct Authority ("FCA"). Moneyhub Financial Technology is entered= on the Financial Services Register (FRN 809360) at https://register.fca.org.uk/. Moneyhub Financial Technology is registered in England & Wales,= company registration number 06909772. Moneyhub Financial Technology Limite= d 2020 =C2=A9 Moneyhub Enterprise, Regus Building, Temple Quay, 1 Friary, B= ristol, BS1 6EA.=C2=A0

= DISCLAIMER: This email (including any attachments) is subjec= t to copyright, and the information in it is confidential. Use of this emai= l or of any information in it other than by the addressee is unauthorised a= nd unlawful. Whilst reasonable efforts are made to ensure that any attachme= nts are virus-free, it is the recipient's sole responsibility to scan a= ll attachments for viruses. All calls and emails to and from this company m= ay be monitored and recorded for legitimate purposes relating to this compa= ny's business. Any opinions expressed in this email (or in any attachme= nts) are those of the author and do not necessarily represent the opinions = of Moneyhub Financial Technology Limited or of any other group company.


--000000000000bb906e05aa4bc6b8-- From nobody Mon Jul 13 01:08:28 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 578DC3A0AFE for ; Mon, 13 Jul 2020 01:08:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.196 X-Spam-Level: X-Spam-Status: No, score=-0.196 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=alkaline-solutions.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bp95-wp3zjcg for ; Mon, 13 Jul 2020 01:08:26 -0700 (PDT) Received: from mail.alkaline-solutions.com (caesium6.alkaline.solutions [157.230.133.164]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B6733A0ACD for ; Mon, 13 Jul 2020 01:08:25 -0700 (PDT) Received: from authenticated-user (PRIMARY_HOSTNAME [PUBLIC_IP]) by mail.alkaline-solutions.com (Postfix) with ESMTPA id 098D838486F for ; Mon, 13 Jul 2020 08:08:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alkaline-solutions.com; s=dkim; t=1594627704; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=tiCF4a9Fc/qRdzltgW1VABY3Vq88U0v5hssCktbaBh8=; b=BrPYVkbXLtfYrezB0Etgk0XjsUwYhFBcR6WW/w9DPUe+rPzJB3Jdj7pjy2DfpFLE7qGC1B 6y3IRuPrCSwKRcOHWhqwYQdWSG5YqvN02dHnYIHhai0iVygZDxnZmXPjSRrIqOpECQ4uu2 I46Lt/sxn3XHk1cGrROuQ4Cx+vUiMYE= From: David Waite Content-Type: multipart/alternative; boundary="Apple-Mail=_E8175061-3BEF-40A2-BEDE-56DE6D6A5FD1" Mime-Version: 1.0 Message-Id: Date: Mon, 13 Jul 2020 02:08:22 -0600 To: SecEvent ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=alkaline-solutions.com; s=dkim; t=1594627705; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=tiCF4a9Fc/qRdzltgW1VABY3Vq88U0v5hssCktbaBh8=; b=VO9+zpDpCgn3LMo+5AYTEHE0y6QF9iRIHJl7UhP/uPBWFymdEj22Nyj++Yr1w09tAWtd7y vtoVrH2TEpAJ54WWkvuii3DLz0aFDpt58KBVY+tV5AfrFWck2yZA4fsvlaHOWx4yCpWnfw aZucCsa6UGQ2wT1RyTOQqdcGwkqBeJw= ARC-Seal: i=1; s=dkim; d=alkaline-solutions.com; t=1594627705; a=rsa-sha256; cv=none; b=NXZ0mD//qKGfZifHiGPb+PhwANnD5iKxXx6chMkLFq4QVM1DeGt4AqEUjpMUN0wk+tzCPf fI3iRl5Yj+7LP7xOjdEYWNd9ynsTTS6KEtLxdln6a+BeKG+cNpTK8Gx+j6KkoJfr6xOOxT fRWXQgsKAhyh+CuxuscNFUmb4+C3geU= ARC-Authentication-Results: i=1; mail.alkaline-solutions.com; auth=pass smtp.auth=david@alkaline-solutions.com smtp.mailfrom=david@alkaline-solutions.com Authentication-Results: mail.alkaline-solutions.com; auth=pass smtp.auth=david@alkaline-solutions.com smtp.mailfrom=david@alkaline-solutions.com X-Spamd-Bar: / Archived-At: Subject: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 08:08:27 -0000 --Apple-Mail=_E8175061-3BEF-40A2-BEDE-56DE6D6A5FD1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 In the majority of cases I would prefer a subject identifier which is = simply a string of the appropriate URI rather than a polymorphic = structured object, e.g.: 3.1 Account Subject Identifier type:=20 "acct:user@example.com =E2=80=9D 3.2. Email Subject Identifier Type =E2=80=9Cmailto:user@example.com =E2=80=9D 3.3. Phone Number Subject Identifier Type =E2=80=9Ccallto:+1.234.456.7890=E2=80=9D The iss-sub and aliases types appear to be the ones which do not have a = pre-existing URI forms The issuer, subject type unfortunately may have a canonical form (such = as acct:@), but there is neither a set of = canonicalization rules nor an existing endpoint (like an inverse = webfinger) to perform this mapping. =E2=80=9Csub" may also not be reproducible or correlatable amongst = different parties sending events. An example would be when using = pairwise pseudonyms. Due to the common-place nature of pairwise = pseudonyms in large public deployments, this appears to limit use cases = that can leverage this identifier type to events between a single = relying organization and a single OP. In 3.5, as Dave Tonge suggested this could be an array rather than a = composite polymorphic type. However, a more significant issue is what a = recipient should do with this information. An event received with an = alias list implies that the sender believes these identifiers all = correspond to the same subject, are there behaviors to prescribe to the = recipient when they receive a list with aliases they do not know, or = receive an event with aliases corresponding with what the recipient = believes to be multiple subjects? -DW= --Apple-Mail=_E8175061-3BEF-40A2-BEDE-56DE6D6A5FD1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
In the majority of cases I would prefer a subject identifier = which is simply a string of the appropriate URI rather than a = polymorphic structured object, e.g.:

3.1 Account Subject Identifier = type: 
"acct:user@example.com=E2=80=9D

3.2.  Email Subject Identifier = Type
=E2=80=9Cmailto:user@example.com=E2=80=9D

3.3. Phone Number Subject = Identifier Type
=E2=80=9Ccallto:+1.234.456.7890=E2=80=9D

The iss-sub and aliases types appear to = be the ones which do not have a pre-existing URI forms

The issuer, subject type = unfortunately may have a canonical form (such as = acct:<subject>@<issuer.domain>), but there is neither a set = of canonicalization rules nor an existing endpoint (like an inverse = webfinger) to perform this mapping.

=E2=80=9Csub" may also not be = reproducible or correlatable amongst different parties sending events. = An example would be when using pairwise pseudonyms. Due to the = common-place nature of pairwise pseudonyms in large public deployments, = this appears to limit  use cases that can leverage this identifier = type to events between a single relying organization and a single = OP.

In 3.5, as = Dave Tonge suggested this could be an array rather than a composite = polymorphic type. However, a more significant issue is what a recipient = should do with this information. An event received with an alias list = implies that the sender believes these identifiers all correspond to the = same subject, are there behaviors to prescribe to the recipient when = they receive a list with aliases they do not know, or receive an event = with aliases corresponding with what the recipient believes to be = multiple subjects?

-DW
= --Apple-Mail=_E8175061-3BEF-40A2-BEDE-56DE6D6A5FD1-- From nobody Mon Jul 13 01:44:23 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C4473A0C23 for ; Mon, 13 Jul 2020 01:44:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.08 X-Spam-Level: X-Spam-Status: No, score=-0.08 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MALFORMED_FREEMAIL=0.116, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EoZK3E9MS0dU for ; Mon, 13 Jul 2020 01:44:19 -0700 (PDT) Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com [IPv6:2a00:1450:4864:20::42f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AB0C3A0C1B for ; Mon, 13 Jul 2020 01:44:19 -0700 (PDT) Received: by mail-wr1-x42f.google.com with SMTP id b6so15005280wrs.11 for ; Mon, 13 Jul 2020 01:44:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version; bh=1OYOq9tfRVYxOWLfMOnYnhEGS7xGhKIBTK0JXaxYEk4=; b=fIxTarETM0faYEMyhkc/WJ1GN/N2SjwPI5y8ZfWbVwQBBZ7ISMkGEh9x2vCWGap/+K zrNhY59FLgokjoZ9DLO0vK6MA1ZOFQl8HV/MzrNylVX0dFLqirEG8LcjKeGsJ/Zy+dOV ttbjtY0k/ZW7L2/CoN38DQ7botvN+yWY0x9UNiSnedSX5o6GPqFrok4AxVqQnNdapZsO vRf992ifefysgVwZqj6U34en4w26renfVK/n7E1OZTWlIHy2gJD++M+2FUN1ZA3e2PXE lSdLiCyajorTdWkqmvBNvV7neMqrjFhpR9RW9cPruMEC3aN7UfP2qlsokCGw1TBWwjwb N5RA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version; bh=1OYOq9tfRVYxOWLfMOnYnhEGS7xGhKIBTK0JXaxYEk4=; b=ubBaU9mf4kgBtjtMLMkZlj+ftKZIa7y1pssP5HQAf3AdrNkgjTpodGGOnlLsov2ixP Wgra8AcD9+Mw/YREtajbcn0exX+0aPtC+X4C9QyVEwMQTP4omaWUsjCARjF3l9de045D CTL7NNW7J0HtimcLQazeKMVPGc7Qkc4n3GvhmDg/S0qi11HxdJSzLBpfa6gxHegIzL/X vHuC8NuuogZNV/nBEpJZka/Twz/c3moRHhCQhOgDw81V0QMNi9e+GaS5U7iQUnNPTKND s+z9/uGIJnXtYmxgaozhjf4Wv2As7Rw5KmykXSKbNWKb1OmO7G0wZtOYjT7WbO/ON7ey OWzQ== X-Gm-Message-State: AOAM533uWwOKCqbyEd1O22jGCdZFjSDvRVHO5OmCBuPJyS/HvrELA10u 43XDNejndkzh7aap5T47aDg= X-Google-Smtp-Source: ABdhPJwVoBAMwc/3xHdWE2TBdEZa+r4JPWJdzhAjGL0RoejwPbIcRTM/NeUt8nfpkatP+cjKRA9//A== X-Received: by 2002:a5d:55cf:: with SMTP id i15mr85692788wrw.204.1594629857799; Mon, 13 Jul 2020 01:44:17 -0700 (PDT) Received: from [172.26.49.35] (pub-corp-42-8.intuit.com. [91.102.42.8]) by smtp.gmail.com with ESMTPSA id o9sm22339374wrs.1.2020.07.13.01.44.16 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 Jul 2020 01:44:17 -0700 (PDT) User-Agent: Microsoft-MacOutlook/16.38.20061401 Date: Mon, 13 Jul 2020 11:44:15 +0300 From: Yaron Sheffer To: Atul Tulshibagwale , , Openid-specs-risc CC: Annabelle Richard , Marius Scurtescu , michaeljones_fwd Message-ID: <1D584A11-F583-4E25-940A-F4F89C9A6BD1@gmail.com> Thread-Topic: [Id-event] SSE changes to the Subject Identifiers Spec References: In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3677485456_597768644" Archived-At: Subject: Re: [Id-event] SSE changes to the Subject Identifiers Spec X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 08:44:21 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3677485456_597768644 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Hi Atul, =20 Thank you for your contribution! =20 You are introducing 3-4 new concepts into this draft (including the notion = of =E2=80=9Cconformance=E2=80=9D which you have not listed below). I think it would be m= ore appropriate to start an email thread on this list on each one, in order = to gauge the working group=E2=80=99s interest. In general the IETF reserves the PR= process for smaller, editorial changes, or else for changes that had alread= y been discussed by the mailing list. =20 Thanks, =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron =20 From: Id-event on behalf of Atul Tulshibagwale = Date: Monday, July 13, 2020 at 05:38 To: , Openid-specs-risc Cc: Annabelle Richard , Marius Scurtescu , michaeljones_fwd Subject: [Id-event] SSE changes to the Subject Identifiers Spec =20 Hi all, We've made a number of changes to the subject-identifiers spec in the OpenI= D "Shared Signals and Events" working group. I have incorporated these chang= es in a pull request to the present draft in the repository https://github.c= om/richanna/secevent. =20 Please review the changes here: https://github.com/richanna/secevent/pull/1 =20 Summary of the changes: Defined "Subject Principals" as management entities that are represented by= the subject identifiers Defined "Subject Principal Administrative Groupings" or SPAGs that may be u= sed for certain events that pertain to the entire grouping. IRL Spags may be= tenants in a multi-tenanted host or may be OUs or groups within a tenant. Defined the following Common Claims that may be applied to any subject iden= tifier: spag_id: An optional claim that can be used to ensure uniqueness of the sub= ject identifier within the SPAG. category: An optional claim that can be used to define the scope of the sub= ject identifier. E.g., Does a phone number represent the user or the device = the user is using. The category can disambiguate this. Added a SAML subject identifier type as was needed by some use cases in SSE= . Added myself as a co-author, given the scope of these changes. Thanks, Atul =20 _______________________________________________ Id-event mailing list Id-ev= ent@ietf.org https://www.ietf.org/mailman/listinfo/id-event=20 --B_3677485456_597768644 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Hi Atul,

&nb= sp;

Thank you for your contribution!<= /p>

 

You are introd= ucing 3-4 new concepts into this draft (including the notion of =E2=80=9Cconforman= ce=E2=80=9D which you have not listed below). I think it would be more appropriate= to start an email thread on this list on each one, in order to gauge the wo= rking group=E2=80=99s interest. In general the IETF reserves the PR process for sm= aller, editorial changes, or else for changes that had already been discusse= d by the mailing list.

 

Thanks,

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

 

=

From:= Id-event <id-event= -bounces@ietf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40googl= e.com@dmarc.ietf.org>
Date: Monday, July 13, 2020 at 05:38
<= b>To: <id-event@ietf.org>, Openid-specs-risc <openid-specs-risc= @lists.openid.net>
Cc: Annabelle Richard <richanna@amazon.co= m>, Marius Scurtescu <marius.scurtescu@coinbase.com>, michaeljones_= fwd <Michael.Jones@microsoft.com>
Subject: [Id-event] SSE ch= anges to the Subject Identifiers Spec

 

Hi all,=

We've made a number of changes to the subj= ect-identifiers spec in the OpenID "Shared Signals and Events" wor= king group. I have incorporated these changes in a pull request to the prese= nt draft in the repository ht= tps://github.com/richanna/secevent.

 

Please review the= changes here:

 

Summary of the changes:

  1. Defined "Subject Princip= als" as management entities that are represented by the subject identif= iers
  2. Defined "Subject Princip= al Administrative Groupings" or SPAGs that may be used for certain even= ts that pertain to the entire grouping. IRL Spags may be tenants in a multi-= tenanted host or may be OUs or groups within a tenant.
  3. Defined the following Common Claims that may be applied= to any subject identifier:
    1. spag_id: An optional claim that can be = used to ensure uniqueness of the subject identifier within the SPAG.
    2. category: An optional claim that can be u= sed to define the scope of the subject identifier. E.g., Does a phone number= represent the user or the device the user is using. The category can disamb= iguate this.
  1. Added a SAML subject identifier type as was needed by some use cases= in SSE.
  2. Added myself as a co-auth= or, given the scope of these changes.

Thanks,

Atul

 

_______________________________________________ Id-event mailin= g list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event

--B_3677485456_597768644-- From nobody Mon Jul 13 08:40:30 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76C2A3A132F for ; Mon, 13 Jul 2020 08:40:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HmIrSHeJiG-K for ; Mon, 13 Jul 2020 08:40:27 -0700 (PDT) Received: from mail-yb1-xb32.google.com (mail-yb1-xb32.google.com [IPv6:2607:f8b0:4864:20::b32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50FD23A133F for ; Mon, 13 Jul 2020 08:40:27 -0700 (PDT) Received: by mail-yb1-xb32.google.com with SMTP id a15so6597292ybs.8 for ; Mon, 13 Jul 2020 08:40:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5Pb25uN6S+5DwYJ3LzqPP5w3jPzPvo4+V47I+MdrZjs=; b=YCcFZpnP2z742pz3zh2RFJC95PvhqO9CT+rNxj8HMupPjUcWmKvc+L9lRXzypod9b7 hydu3I/7mL0noguzMNAMdMV3grMW+tu3DFbG1zQA47oByG/jfWgto0wrzWbgWA3CIxcX 8c7vxEHI7fj75s4AVbXSocAFMdR+iR12svxD8BHXxpyEu0qNNySTCsttttcjTxOGM5TN SO3KP4IPCDQylhk2aQcfFSj0HUZL4FeEP4PL2vStgfo/i1JMMgv7zItSIamKfaI/GyZa bol741FUuSGf0xWPr9lD3QD3ApB6sXRiaZDJg2UK67gDRACwYDiDYY5dVuUdq/knKa6T sljg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5Pb25uN6S+5DwYJ3LzqPP5w3jPzPvo4+V47I+MdrZjs=; b=fAYnwYzCm2s+dPrUEJkkywolPFMCX04d/qX03DBjmtxD0xKAU2KDKr91oQVSJxx6Sc uvb0OvGdV96zdNL+JN60JYLyy3gKh5k+Y6xpZASJfp/jMXWwGHcAeSC8aQYCZjmhll2k vzxB0YmX/nVTvVWTdhSPkZIU9T/o26umWJRXUKxtCSQ2pmybiEnDGrXGQT1UxElUpIGd aheIpMeenscB/5duYHuv1yQSQn39aEMrNdSAyEfwd9kA9VjhHySxhfDXKhLI4BQtOmvZ 7JPIoq9c1Z52WvF60LVotQ9ORmlcDO7swwiz+v5xeU2rpLEXkWTmCoS0Kd2QiKChxEzG uZyw== X-Gm-Message-State: AOAM5305zqA1g5w6dkgIfIh0L2FdtKz88YPjMaejfRWKiiCRvBA7gto3 vIXhluwyRNWqVBgKYXdCD1a6bFhomwzBCM9BFI8VMA== X-Google-Smtp-Source: ABdhPJxF9dPDYGftazrW58rHqleHTATVdaC74ENXBToKJRzHH9yJ7qOhsAMZ7nmKFJmjpl1MRvMtzGYa4dl1PDdbbPk= X-Received: by 2002:a25:2805:: with SMTP id o5mr852209ybo.97.1594654825990; Mon, 13 Jul 2020 08:40:25 -0700 (PDT) MIME-Version: 1.0 References: <1D584A11-F583-4E25-940A-F4F89C9A6BD1@gmail.com> In-Reply-To: <1D584A11-F583-4E25-940A-F4F89C9A6BD1@gmail.com> From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 08:40:14 -0700 Message-ID: To: Yaron Sheffer Cc: id-event@ietf.org, Openid-specs-risc , Annabelle Richard , Marius Scurtescu , michaeljones_fwd Content-Type: multipart/alternative; boundary="00000000000071b5fb05aa54828e" Archived-At: Subject: Re: [Id-event] SSE changes to the Subject Identifiers Spec X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 15:40:29 -0000 --00000000000071b5fb05aa54828e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Yaron, Thanks for the suggestion, I will start a new thread for each topic. Just FYI as background: We have discussed these changes in the OpenID Shared Signals and Events group, but happy to discuss them here again. Atul On Mon, Jul 13, 2020 at 1:44 AM Yaron Sheffer wrote= : > Hi Atul, > > > > Thank you for your contribution! > > > > You are introducing 3-4 new concepts into this draft (including the notio= n > of =E2=80=9Cconformance=E2=80=9D which you have not listed below). I thin= k it would be more > appropriate to start an email thread on this list on each one, in order t= o > gauge the working group=E2=80=99s interest. In general the IETF reserves = the PR > process for smaller, editorial changes, or else for changes that had > already been discussed by the mailing list. > > > > Thanks, > > Yaron > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Monday, July 13, 2020 at 05:38 > *To: *, Openid-specs-risc < > openid-specs-risc@lists.openid.net> > *Cc: *Annabelle Richard , Marius Scurtescu < > marius.scurtescu@coinbase.com>, michaeljones_fwd < > Michael.Jones@microsoft.com> > *Subject: *[Id-event] SSE changes to the Subject Identifiers Spec > > > > Hi all, > > We've made a number of changes to the subject-identifiers spec in the > OpenID "Shared Signals and Events" working group. I have incorporated the= se > changes in a pull request to the present draft in the repository > https://github.com/richanna/secevent. > > > > Please review the changes here: > > https://github.com/richanna/secevent/pull/1 > > > > Summary of the changes: > > 1. Defined "Subject Principals" as management entities that are > represented by the subject identifiers > 2. Defined "Subject Principal Administrative Groupings" or SPAGs that > may be used for certain events that pertain to the entire grouping. IR= L > Spags may be tenants in a multi-tenanted host or may be OUs or groups > within a tenant. > 3. Defined the following Common Claims that may be applied to any > subject identifier: > > > 1. spag_id: An optional claim that can be used to ensure uniqueness of > the subject identifier within the SPAG. > 2. category: An optional claim that can be used to define the scope > of the subject identifier. E.g., Does a phone number represent the = user or > the device the user is using. The category can disambiguate this. > > > 1. Added a SAML subject identifier type as was needed by some use > cases in SSE. > 2. Added myself as a co-author, given the scope of these changes. > > Thanks, > > Atul > > > > _______________________________________________ Id-event mailing list > Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event > --00000000000071b5fb05aa54828e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Yaron,
Thanks for the suggestion, I will start a ne= w thread for each topic. Just FYI as background: We have discussed these ch= anges in the OpenID Shared Signals and Events group, but happy to discuss t= hem here again.

Atul

On Mon, J= ul 13, 2020 at 1:44 AM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

Hi Atul,

=C2=A0

<= p class=3D"MsoNormal">Thank you for your contribution!

=C2=A0

You are = introducing 3-4 new concepts into this draft (including the notion of =E2= =80=9Cconformance=E2=80=9D which you have not listed below). I think it wou= ld be more appropriate to start an email thread on this list on each one, i= n order to gauge the working group=E2=80=99s interest. In general the IETF = reserves the PR process for smaller, editorial changes, or else for changes= that had already been discussed by the mailing list.

=C2=A0

Thanks,

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron<= /p>

=C2=A0

From: Id-event <id-event-bounces@ietf.org> on behalf of Atul Tulshibagwale &l= t;atultulshi=3D40google.com@dmarc.ietf.org>
Date: Monday, July 13, 2= 020 at 05:38
To: <id-event@ietf.org>, Openid-specs-risc <openid-specs-risc= @lists.openid.net>
Cc: Annabelle Richard <richanna@amazon.com>, Ma= rius Scurtescu <marius.scurtescu@coinbase.com>, michaeljones_fwd <Michael.Jones= @microsoft.com>
Subject: [Id-event] SSE changes to the Sub= ject Identifiers Spec

=C2=A0

Hi all,

We've made a number of changes= to the subject-identifiers spec in the OpenID "Shared Signals and Eve= nts" working group. I have incorporated these changes in a pull reques= t to the present draft in the repository https://github.com/richanna/secevent.<= u>

=C2=A0

=

Please review the changes here:=

=C2= =A0

Summary of the changes:<= /u>

  1. Defined "Subject Principals" as management entities that are rep= resented by the subject identifiers
  2. Defined "Subject Principal Administrative Groupings" or SPAGs = that may be used for certain events that pertain to the entire grouping. IR= L Spags may be tenants in a multi-tenanted host or may be OUs or groups wit= hin a tenant.
  3. Defined the followi= ng Common Claims that may be applied to any subject identifier:
    1. spag_id: An optional claim that can be used to ensure unique= ness of the subject identifier within the SPAG.
    2. category: An optional claim that can be used to define the s= cope of the subject identifier. E.g., Does a phone number represent the use= r or the device the user is using. The category can disambiguate this.
  1. = Added a SAML subject identifier type as was needed by some use cases in SSE= .
  2. Added myself as a co-author, gi= ven the scope of these changes.

Thanks,

At= ul

=C2=A0<= /p>

_____________________________________= __________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/= id-event

--00000000000071b5fb05aa54828e-- From nobody Mon Jul 13 09:01:32 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47A573A13CD for ; Mon, 13 Jul 2020 09:01:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.6 X-Spam-Level: X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0jmHLX-U77V5 for ; Mon, 13 Jul 2020 09:01:28 -0700 (PDT) Received: from mail-yb1-xb32.google.com (mail-yb1-xb32.google.com [IPv6:2607:f8b0:4864:20::b32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A4A93A13B4 for ; Mon, 13 Jul 2020 09:01:26 -0700 (PDT) Received: by mail-yb1-xb32.google.com with SMTP id 2so6625033ybr.13 for ; Mon, 13 Jul 2020 09:01:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=ARQ4I64s6jLpLyTnJoH75vEOA7fg5exTIhyePcmyLr8=; b=mSLhz5eeSZVmR9UcBioF7zR8rawWQJcIW5HXJT+MslWeZ10pRvGCy7p0nIUWmDiQBm ZgPQHEjYmprzttHcDtP8F9jG4qoysUBR31Z12Pn4H31Di6zV8O6w3+QanlLVYwQMXqrG TZ3bPuVaF8cvD9OBRbMysFbliTlDnNW6WqPANj8KjglBldn+p3KsYoFgejuqMUNUHv5t KSi3zMp5CGzRCInSqyKPx82FOYV29INK6ffMARalw+VeuLGOz/kk9mntbFcAJccFTdav cK6LT5nLJFDeIS/dI5rDsVHjdbXnvUfFBlnSnUHRvazxSn98EQZfG4BsqzSJVaRaJw3z znAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=ARQ4I64s6jLpLyTnJoH75vEOA7fg5exTIhyePcmyLr8=; b=GwSjh7RuSCZsRVNen5cWJ0GJV0KqLTJAaNHnnNvc9wEzq1PTojLkv+OsBBjlLhdgDq ZYrzJrQun+HJAJhQ/P6wp07uuFIqlDTTjR3Gg4f55cYrY0kfoL0BpEVAw3B4og1Hzpzd 9coUE3WcVgNgVPh4J27JNpmTiGynSZN/9Bi6yxncMMXqVxzRrOMvp40Rys0XFkbhRmhX MCnAxvsWdq9HU61SwmakBxoVbx3iJ2i85bPzkn9SjgPAmIDAHmgpewLXjJZqDknVjHp1 44E28Mk2iMto4vt1x+FE5bQUtT2kqPV5KNUHrMnIzjPZNcJxUQsf1ADf6c9ahH1BLh3K aeTg== X-Gm-Message-State: AOAM532drM2uCpt0ivF2l68Gyru/r+3oeFV8xsFp5nzphaVq/DFzMXAm 7XWsp8pB48BL/eL/pQPMGQ3/qyTEWy5FP509toFEvWBx X-Google-Smtp-Source: ABdhPJx6Gi5bi5k1LChlDa1JDtXtjFtfeGObVClpptoNE+i+fFpWFHDmGlYvY3Q4OIPmqXzKS0TfswJoKkapZM0NBwY= X-Received: by 2002:a25:3155:: with SMTP id x82mr1042785ybx.492.1594656084479; Mon, 13 Jul 2020 09:01:24 -0700 (PDT) MIME-Version: 1.0 From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 09:01:13 -0700 Message-ID: To: id-event@ietf.org Content-Type: multipart/alternative; boundary="00000000000074d6f805aa54cd3b" Archived-At: Subject: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 16:01:30 -0000 --00000000000074d6f805aa54cd3b Content-Type: text/plain; charset="UTF-8" Hi all, Here's a quick background for the proposal for including Subject Principals and Subject Principal Administrative Groupings or SPAGs in the Subject Identifiers spec. *Use of Subject Identifiers in Shared Signals and Events*: The Shared Signals and Events (SSE) profile of SETs specifies that transmitters and receivers send and receive SETs that contain Subject Identifiers. These subject identifiers have the format that is now being discussed as a separate specification here. *Transmitters and Receivers in SSE* The SSE profile defines transmitters and receivers as hosts that manage streams between peers. The receiver authenticates to the transmitter using OAuth, requiring the use of a secret per receiver. In a multi-tenanted host that handles hundreds of thousands or millions of independent tenants, maintaining such a secret per instance of a receiver is cumbersome. Furthermore, since a transmitter and a receiver has to maintain a stream per pair, creating such per-tenant streams can add significant implementation overhead. *SPAGs* Therefore, we need a notion of a grouping of subjects within the same transmitter and receiver to distinguish between various administrative groupings that exist within a host. These groupings could include tenants, organizational units or user groups. This grouping is captured in the notion of a SPAG. The uniqueness of a user identifier (subject identifier) may also be limited to a SPAG. For example, if a random unique ID represents a user, then that ID may be unique within a SPAG and not universally across a transmitter or receiver. This is because each transmitter and receiver may have multiple connections to other transmitters and receivers, and ensuring uniqueness across all such peers is probably an intractable problem. *Subject Principals* While what is represented within a subject identifier may be only an aspect of the management entity, the administrative grouping is about the management entity itself. This could be the user, device or other principal that the subject identifier represents. Therefore, an abstract notion of a Subject Principal is also required in order specify what the grouping within a SPAG is about. The above is captured in the "Subject Principal" and "SPAG" sections within the proposed PR . Thanks, Atul --00000000000074d6f805aa54cd3b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,=C2=A0
Here's a quick background for the proposal for incl= uding Subject Principals and Subject Principal Administrative Groupings or = SPAGs in the Subject Identifiers spec.

Use of S= ubject Identifiers in Shared Signals and Events:
The Shared S= ignals and Events (SSE) profile of SETs specifies that transmitters and rec= eivers send and receive SETs that contain Subject Identifiers. These subjec= t identifiers have the format that is now being discussed as a separate spe= cification here.

Transmitters and Receivers= in SSE
The SSE profile defines transmitters and receivers as= hosts that manage streams between peers. The receiver authenticates to the= transmitter using OAuth, requiring the use of a secret per receiver. In a = multi-tenanted host that handles hundreds of thousands or millions of indep= endent tenants, maintaining such a secret per instance of a receiver is cum= bersome. Furthermore, since a transmitter and a receiver has to maintain a = stream per pair, creating such per-tenant streams can add significant imple= mentation overhead.

SPAGs
Therefo= re, we need a notion of a grouping of subjects within the same transmitter = and receiver to distinguish between various administrative groupings that e= xist within a host. These groupings could include tenants, organizational u= nits or user groups. This grouping is captured in the notion of a SPAG. The= uniqueness of a user identifier (subject identifier) may also be limited t= o a SPAG. For example, if a random unique ID represents a user, then that I= D may be unique within a SPAG and not universally across a transmitter or r= eceiver. This is because each transmitter and receiver may have multiple co= nnections to other transmitters and receivers, and ensuring uniqueness acro= ss all such peers is probably an intractable problem.

<= div>Subject Principals
While what is represented within a = subject identifier may be only an aspect of the management entity, the admi= nistrative grouping is about the management entity itself. This could be th= e user, device or other principal that the subject identifier represents. T= herefore, an abstract notion of a Subject Principal is also required in ord= er specify what the grouping within a SPAG is about.

The above is captured in the "Subject Principal" and "SPA= G" sections within the proposed PR.
--B_3677512152_192843941-- From nobody Mon Jul 13 09:09:49 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 974943A1518 for ; Mon, 13 Jul 2020 09:09:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.6 X-Spam-Level: X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NKofBcRSW8bP for ; Mon, 13 Jul 2020 09:09:44 -0700 (PDT) Received: from mail-yb1-xb2f.google.com (mail-yb1-xb2f.google.com [IPv6:2607:f8b0:4864:20::b2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7F403A1529 for ; Mon, 13 Jul 2020 09:09:16 -0700 (PDT) Received: by mail-yb1-xb2f.google.com with SMTP id y13so6639850ybj.10 for ; Mon, 13 Jul 2020 09:09:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=La1zombYHISo0U3IQJXMoXleNAFe+DTpKOkEDEozkjU=; b=cibRt53EsUGeObB+5bwUz0Uo6aB6ummgac97ojMX1CiSkffKb5P7ao4xxDKKyVNcJN peNYsuNyC/JoOTZpKQupqEu7ZRTJy/+yxlF+zyRr4O+RdM4C64KYxScwMoH4HVCUEQMP 87iNyS9E1Q3kPVtXNP4xyRlxEugJjjx2XeBrGNJwdJt8k7a3i70fR2ChSKN5/gQzlx5g 1UTn5JLAovnA0ayyWa9bLyfKeIQ5MkQwRs/kn2+WiRXVkXW/DDVjbl2yGg1Du6EeUm3B XlXur808aiObyg0tt1Hg2qlhm5Pzz0l7/EgBIMIumsiNZL2dyjEyoRVTTc6ZBYl2yk2M I6Ww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=La1zombYHISo0U3IQJXMoXleNAFe+DTpKOkEDEozkjU=; b=NHtV+zeo8+umdbbSQLE6T6pHyBvPzRLwwuUVUh8jzWFU7ox1UguvNDpaPr42NNgQe8 C8RhGhW11wIMgmCdl/PmocB+IcQRfOuD/8eeoeZWTvW+rO61DFE4c51GGhWVIolwPNgg D2bjpVCezsZLER+pZdW29uDG3vmJuQhEHgfpk2LI90Lq64bGZcU7WH694pnph//INKjG 0bZJanadrbUGalismB+7J5bVeL11H5JhXi9xPp65socc+RCoZ9ztqUMDeDJus+I/5huS 6NWPrB8Su5/haB+7pAO6yx8iO1YHe3V1UJxgj0TdMTgybnarzDtUdDluA0aAGfHjL7sC TVLQ== X-Gm-Message-State: AOAM5317q8ZFCC/c183J9p0cIbNHjdSoHLqdjKQJvhL3Sg+RVVhKfHxS 6Re3TgBn0oAFy+TearqGPJIjKCldbsQ8xPhWM0zyP03A X-Google-Smtp-Source: ABdhPJyktsO2TY26DWKrq+atv5lQtil7kAtWWGfhaKalUIvwa1AdvvjB13W4ihC2NaJGh6LTfr8546My1M3iXyS1UoQ= X-Received: by 2002:a25:5ac5:: with SMTP id o188mr1158496ybb.322.1594656555461; Mon, 13 Jul 2020 09:09:15 -0700 (PDT) MIME-Version: 1.0 From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 09:09:04 -0700 Message-ID: To: id-event@ietf.org Content-Type: multipart/alternative; boundary="00000000000087654e05aa54e9d9" Archived-At: Subject: [Id-event] Subject Categories in Subject Identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 16:09:47 -0000 --00000000000087654e05aa54e9d9 Content-Type: text/plain; charset="UTF-8" Hi all, Subject Identifiers will be used in various specifications about events pertaining to those subject identifiers. In order to determine the scope of the event, it is important to know what the transmitter of the event that includes the subject identifier refers to. For example, when a subject identifier specifies a phone number as the identifier, is the transmitter of the event that includes such a subject identifier specifying the user or the device represented by the subject identifier. Since this is a property of the subject rather than the event, it should be logically included in the subject identifier spec. Therefore, I'm proposing that we include a "subject category" claim within the subject identifier. The subject category could have one of the following values: - *User* - *Device* - *Session* The above values are sufficient for the SSE profile, but other values may be possible (although such a possibility is not a part of my proposal ). Thanks, Atul --00000000000087654e05aa54e9d9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,
Subject Identifiers will be used in various sp= ecifications about events pertaining to those subject identifiers. In order= to determine the scope of the event, it is important=C2=A0to know what the= transmitter of the event that includes the subject identifier refers to.

For example, when a subject identifier specifies a = phone number as the identifier, is the transmitter of the event that includ= es such a subject identifier specifying the user or the device represented = by the subject identifier.

Since this is a propert= y of the subject rather than the event, it should be logically included in = the subject identifier spec. Therefore, I'm proposing that we include a= "subject category" claim within the subject identifier. The subj= ect category could have one of the following values:
  • U= ser
  • Device
  • Session
The abov= e values are sufficient for the SSE profile, but other values may be possib= le (although such a possibility is not a part of my proposal).

<= div>Thanks,
Atul

--00000000000087654e05aa54e9d9-- From nobody Mon Jul 13 09:15:03 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 289D03A1408 for ; Mon, 13 Jul 2020 09:15:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.6 X-Spam-Level: X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g59h8QgxeAOf for ; Mon, 13 Jul 2020 09:15:00 -0700 (PDT) Received: from mail-yb1-xb29.google.com (mail-yb1-xb29.google.com [IPv6:2607:f8b0:4864:20::b29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC99E3A13FC for ; Mon, 13 Jul 2020 09:14:49 -0700 (PDT) Received: by mail-yb1-xb29.google.com with SMTP id y13so6648235ybj.10 for ; Mon, 13 Jul 2020 09:14:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=fTRwUaUT3N1I4UnsoDOaHrrfgbcBguBpm96MHLN1haY=; b=DnOH1SKpyAgw93spv1vKWiQk0eCEZmCksrMC7MMLMkdHGyiwjTj0bvi3lNHUOQSa38 k2xM9GjNXJzQnE47zEksfdXnRmAb+KHONW+++tJfDdygJea4GdY+lc/h8Zm4iASUTNrB fQIESov8FBEWwsUS6HwqAtohM77xWlptorochgiWD8G3VkfNqqPc7B2XkTl9qlXo5D7X WGlRJDEZ5WQ59faqbbcPZWDstqG40U9WoN+hXbQTx5dxFD/rCXsEhZljdEcDuvb4IDCO 3SJEWGM4JuehYzb65azZT/icnKfLLXRYnk5HOxk247jegenqQKlAjulkKGHo+eguPq8s /4/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=fTRwUaUT3N1I4UnsoDOaHrrfgbcBguBpm96MHLN1haY=; b=cehXsunEh1xiAeUzdIMzkrBdjBj0/em3LuwMhF3LdrpOolkwaLJnnAqqYFjmhLWj37 M7Fmxl8Suvn52H1t+WmI7e0NlR+WPgkYbNYsIH9H00thdEkcLXKhLd6KNMJGNcBXJ3s0 ivtDl2f9MDlcvzBOFbc5/eMOtF5AsOEhit/kuDee+ThB9o6TdjzOp8/xksw9cPtuCjhm Ibt7l7Nh1wJoC8blH3IeuqQXUQ83IjJZLW1LYcAjtd4xX/7VJ6eZPu82qSuIhVc3ZorL 8tVxfIa1laEajTVinz+pQD4eHJgDoP1s40dlFrzQBAp4GFxUcLDZDuVxdC8tb781Lp08 MDWQ== X-Gm-Message-State: AOAM532XMPDb2U9varAb5YueSU+pzH5nmOGCdj4b9P9S2Jo68T40yRQo sCY4Puz5/AHcJdScmjyTRivf873kZF9GfP6jEkBwVwSm X-Google-Smtp-Source: ABdhPJxVkkdDLnYQbYLtildO+Cq6BJ7tZXEl1gXX034maNV/ComMPmFWbBe6FA5lm382a+etPupOKUuOFvldeug4RgE= X-Received: by 2002:a25:5ac5:: with SMTP id o188mr1200532ybb.322.1594656888205; Mon, 13 Jul 2020 09:14:48 -0700 (PDT) MIME-Version: 1.0 From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 09:14:36 -0700 Message-ID: To: id-event@ietf.org Content-Type: multipart/alternative; boundary="0000000000005ca85a05aa54fd33" Archived-At: Subject: [Id-event] Common claims in subject identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 16:15:02 -0000 --0000000000005ca85a05aa54fd33 Content-Type: text/plain; charset="UTF-8" Hi all, The proposed subject identifiers specification today requires that each claim within a subject identifier be specified by the individual subject identifier type. However, there may be some common claims that could be defined across all subject identifier types. These are captured within the "common claims" section of my proposal. All such common claims may be optional unless a specific subject identifier type requires any of them (there is no example of that today). These claims include: - *SPAG Identifier*: Identifies the "Subject Principal Administrative Grouping" or SPAG that the subject identifier belongs to - *Subject Category*: identifies the category that the subject identifier refers to (whether user, device or session) To avoid having to define these claims within each subject identifier type, I have extracted them into a separate section called "common claims" in my proposal . Thanks, Atul --0000000000005ca85a05aa54fd33 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,
The proposed subject identifiers specification= today requires that each claim within a subject identifier be specified by= the individual subject identifier type. However, there may be some common = claims that could be defined across all subject identifier types. These are= captured within the "common claims" section of my proposal. All = such common claims may be optional unless a specific subject identifier typ= e requires any of them (there is no example of that today). These claims in= clude:
  • SPAG Identifier: Identifies the "Subje= ct Principal Administrative Grouping" or SPAG that the subject identif= ier belongs to
  • Subject Category: identifies the category tha= t the subject identifier refers to (whether user, device or session)
    • To avoid having to define these claims within each subject identifi= er type, I have extracted them into a separate section called "common = claims" in my = proposal.

Thanks,
Atul
--0000000000005ca85a05aa54fd33-- From nobody Mon Jul 13 09:17:48 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 983123A14BF for ; Mon, 13 Jul 2020 09:17:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.6 X-Spam-Level: X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t28BdG8R8YCz for ; Mon, 13 Jul 2020 09:17:45 -0700 (PDT) Received: from mail-yb1-xb31.google.com (mail-yb1-xb31.google.com [IPv6:2607:f8b0:4864:20::b31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C05733A14BB for ; Mon, 13 Jul 2020 09:17:44 -0700 (PDT) Received: by mail-yb1-xb31.google.com with SMTP id v9so6662937ybe.3 for ; Mon, 13 Jul 2020 09:17:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=f+sHdhUMwbWiLOO0g2MP1S8ZaAI2LtW8acr8U9WFmN8=; b=tqJ5S6U/q7QQqQKuQqjjEmHajllZkh87ugLsLrGtJ3Nzdf86B/O/hLi05UbUokwKHe bm66jT4w7a+Psa8mm8IEr4J2OkxJblWtDX2tAdoo62ziOBvF2aWT3f0Bl4n+ReuyKn3Y pLMaE08U/B0l6MFhgKaw8eRqp5mMqRPKveUifMIG8X3d2nbM8ubACg6PkaIg0+/wjEKU wKz4S0R904KtlDRbBCRLzSwpG5Y6rSYMCYQCCxrByUp+mHSoP6kUjdKVywLCjLPH9Tq4 w/4GAueZBdaMhNCl4ArdhMF1Yjj5IZN5Rb3nSKDarznw14Y0HR54amSY98ylXaF2255m jBeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=f+sHdhUMwbWiLOO0g2MP1S8ZaAI2LtW8acr8U9WFmN8=; b=tss3tXozydCRv8zHOKPIuW8CcOGnGm62OOCatzWdm7NcYUIVQma+Rmi5shclNwN+dB jhZnCBaxtKVr0rA7TNiYgqCy/gaMbsyZ7QdtJuIV4iA/qcdCVVmU2synjqdUiSY8HsCo LJrJu7C5sqCPMfBs+8af99KZ0JVPqR6OnPtnbDdnLOORy50ghGn5sAInnkyoLeg9u8PK iCiDWFnfVOYre5+thaA+1gKMM90ZxT2teXOEjaQWnsYfXIb3Jdiy8c6TGKAF2gOVgA8e sRpEfbNWuHDJ5zNKmenUfoVFz2O6ERA+NPpwLTKSjrgw9FqZh8P+PLgQdFCIcUq5oIkC RJug== X-Gm-Message-State: AOAM533ZQExvvtttcfBr0TCxcEYL+EdgBk+RZ692+M3tXACjmQqSgU3A 3xp1Q/wdQfM7zhoxe+AR04u4jFXQ7eyWLUURvc1BU2uz X-Google-Smtp-Source: ABdhPJyfdVu9PY+p0JwkQK8Nxbu90ck16THGxiCV/3VYVLOYZ9yzCran1iLbMfdJBaxhG4Cg75Xpm3unrevnVTC5HRU= X-Received: by 2002:a25:2805:: with SMTP id o5mr1100096ybo.97.1594657063232; Mon, 13 Jul 2020 09:17:43 -0700 (PDT) MIME-Version: 1.0 From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 09:17:32 -0700 Message-ID: To: id-event@ietf.org Content-Type: multipart/alternative; boundary="000000000000cb74a405aa5507bb" Archived-At: Subject: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 16:17:47 -0000 --000000000000cb74a405aa5507bb Content-Type: text/plain; charset="UTF-8" Hi all, Based on the discussions in the SSE working group within the OpenID Foundation, we would like to propose that the subject identifier specification include a SAML subject identifier type. This is so that sessions established across peers using SAML may be identified in events that include the subject identifier. A SAML subject identifier has only one claim within it, the assertion id of the SAML assertion used to establish the single sign-on session. This change is also included in my proposal here . Thanks, Atul --000000000000cb74a405aa5507bb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,
Based on the discussions in the SSE working gr= oup within the OpenID Foundation, we would like to propose that the subject= identifier specification include a SAML subject identifier type. This is s= o that sessions established across peers using SAML may be identified in ev= ents that include the subject identifier.

=C2= =A0A SAML subject identifier has only one claim within it, the assertion id= of the SAML assertion used to establish the single sign-on session.
<= div>
This change is also included in my proposal here.

<= div>Thanks,
Atul

--000000000000cb74a405aa5507bb-- From nobody Mon Jul 13 09:30:16 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F8B73A1425 for ; Mon, 13 Jul 2020 09:30:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dDp0X-gh4qaF for ; Mon, 13 Jul 2020 09:30:12 -0700 (PDT) Received: from mail-yb1-xb30.google.com (mail-yb1-xb30.google.com [IPv6:2607:f8b0:4864:20::b30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B16993A143C for ; Mon, 13 Jul 2020 09:30:03 -0700 (PDT) Received: by mail-yb1-xb30.google.com with SMTP id g6so6662421ybo.11 for ; Mon, 13 Jul 2020 09:30:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=8etGKqWeI7CY9fHTDzRp0xuAWcG0Sfq3cUbrL4kl8Gw=; b=p8YIThrwRmEYmx7WS0C3T+Luuvl1XoxBiuMztnsmz2dOpr18fElRxItD+VMoMYB+TE zmcqXJy9KDmXRDlEIPsPOQDYOjKjtCCKscs+eC/BdUXSnK1839gjKDUV0Yic4aIAygFG LVhOyGEhIm3SqdaMoK5EzOT64P1pUqaFQq8xHSOr0cUPi4AROjbSytMntj3G0It3Kf3/ p5OMUqJ1ZA12TCMU6UtpT1o+NfyFyZdnC2Z7DtAGjpn03iXbIhS/9srp3ZYWB60J5hWg pVry9CtEGC2husFh6vbIV4oj+6+x3dzolGHDzX3h6NFoReNj3UxurtbVMW+aMOgxXPqs cU7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=8etGKqWeI7CY9fHTDzRp0xuAWcG0Sfq3cUbrL4kl8Gw=; b=Fp0DslIT6WVxFLsJ+ChqOyAK6Rxr/hjxQ1C7UvZ74q35x4ftFDErNS0t734lIzAf0p FiZmncC9fLHkUvg0n7/K8AAK4pJNlfW5MyGHaVFbO8p0JEHrJHzWE+/YGfy+z/gQhkvc AZ1vZg1d6V08ScUfxmybLh5irEiu8+U+kBckWv2zKc6Sd4LhhAn7weHHoroD2usw7PTX UmjlPIpcRBr33iFMoR602MfXnwBW+w8/4uhWalGmEffkb4fPPropqwrD4arlB2RkaXfu G06UYYHc8CqPjFm3HxFw4lzePhx1aZZOz19GEIj0d+RAD2SbHo7TjkzaJSGQl2xTPAWC nrKA== X-Gm-Message-State: AOAM531+Bdp6sYD6B5xn/2MF0vnpgFNxXDJyFEUqCBszQnuKjXhedk89 8Xl1zfr/C/OGhfnp60ibqzPh0vVoMWWzAtUQpbLe04yO X-Google-Smtp-Source: ABdhPJwdchKBCtMRY4NnnU6YxtQfPP4pRgP+Xwip/xvGxp2WWMN9aiNnQwylfJr5YPn2Jw3obvZeKTjNdRKxObSx9oI= X-Received: by 2002:a25:b90e:: with SMTP id x14mr1376389ybj.8.1594657802266; Mon, 13 Jul 2020 09:30:02 -0700 (PDT) MIME-Version: 1.0 From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 09:29:51 -0700 Message-ID: To: Openid-specs-risc Cc: id-event@ietf.org, caep-discuss Content-Type: multipart/alternative; boundary="000000000000d83d9d05aa5533b8" Archived-At: Subject: [Id-event] Discussion about subject identifiers - action requested X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 16:30:14 -0000 --000000000000d83d9d05aa5533b8 Content-Type: text/plain; charset="UTF-8" Hi all, The SSE profile of SETs being drafted in the OpenID SSE Working Group includes changes to the "subject identifiers" section of the previous RISC specification . The subject identifiers section is being considered to be extracted as a separate specification in IETF. Since we have already discussed this within the working group, it is important that we participate in the discussion within the "Security Events" working group within IETF . I have created a single pull-request to the previous spec draft that captures all our changes, and also created individual email threads about specific aspects that the pull-request includes. It will help to do the following: 1. Review the individual topics in the archive of the Security Events working group mailing list. 2. Provide an opinion of whether the topic is important to you by emailing that list. 3. Provide feedback on anything that is being proposed needs to change by emailing that list. If you subscribe to the SecEvents mailing list, it will help you keep up-to-date on the discussion. Thanks, Atul --000000000000d83d9d05aa5533b8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,

The SSE profile of SETs being drafted in the OpenID SSE Working Group in= cludes changes to the "subject identifiers" section=C2=A0of the p= revious RISC specification.=C2=A0The subject identifiers sect= ion=C2=A0is being considered to be extracted as a separate specification in= =C2=A0IETF.

Since we have already discussed this w= ithin the working group, it is important that we participate in the discuss= ion within the = "Security Events" working group within IETF.

I have created a single pull-request to the previous spec draft that captures all= our changes, and also created individual email threads about specific aspe= cts that the pull-request includes. It will help to do the following:
=
  1. Review the individual topics in the archive of the Security Events wor= king group mailing list.
  2. Provide an opinion of whether the topic is= important to you by emailing that list.
  3. Provide feedback on anythi= ng that is being proposed needs to change by emailing that list.
<= div>If you subsc= ribe to the SecEvents mailing list, it will help you keep up-to-date on= the discussion.

Thanks,
Atul

--000000000000d83d9d05aa5533b8-- From nobody Mon Jul 13 10:30:50 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E857C3A15E8 for ; Mon, 13 Jul 2020 10:30:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=canarie.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hg5K_N_ykD9W for ; Mon, 13 Jul 2020 10:30:46 -0700 (PDT) Received: from NAM10-MW2-obe.outbound.protection.outlook.com (mail-mw2nam10on2127.outbound.protection.outlook.com [40.107.94.127]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30F003A1402 for ; Mon, 13 Jul 2020 10:29:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dBcrtN/OsnqqmaTzv3lhkaK6cSC9RV1T7/En3aIL5f8CcM0wmUgZMkk2LSTkcQ8PXBaNnKV/9z6yFRkLmCkPo5jex8iST1HKn8XOvbqxxVUKXOE5iqPeOmmeIWHeri+Udhc0KFdBj4f1RbPntVLA6QZxfO5jxBuKL6nURk2GZJ8LI2VJFs++fzsmYIWdVeYIALCfBnUrfX91dED0IuXwXPs5d+hZCSuMd2HlIDlyQ0V0lNr/XOdKO7kcXqruaRLpPTEv3MASN9YjA91x/fS68bF6THxfeXn5Q0rZssoPZmCh0xG75238rJyWPgtJqSIlHmftv3T5c8jUb8kU1n73Dg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UsORufi9aXTKTYPDxjOqKlh5NnD6dTFt4hss/9SjRg4=; b=TS8S84Ubc0VL0iGI8a2vprhMduXuDAsc6s1WZdG8Dt3PAvvEyFTuarGkxQJRkVL66I8O0pz7Hg2IfAaw9aZ98mB0G3i/8RwLaFftO/F61tvDaD7iijxUMaPsL8pkVTsIxcr4IsCsoCxXq3WDLysti05Jg1Zg0i+FxYDLECL27T0vDirVdYo03rkhINguZ8RuePKvjFt1L3aftPO0tTi/8x6axUdKbCEiLjZ5nPVmTTXs+3eXtnSkJujM8bbWvMKvlGb7YRIhi3oM4ERhCZ4vv5yiY41X4TiPeitsjfrC9nyWWv+ucvOPGxT7FLQhN0rl+uxTA/Hi/5zId+fCE9A8WQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=canarie.ca; dmarc=pass action=none header.from=canarie.ca; dkim=pass header.d=canarie.ca; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=CANARIE.onmicrosoft.com; s=selector2-CANARIE-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UsORufi9aXTKTYPDxjOqKlh5NnD6dTFt4hss/9SjRg4=; b=IftZmv3D+dXPTyS5nm8T43A4L2XmkzpQdd+Ov0N/KccLY4b7pOBodWlDpODaUXZA38VtugnTOR+jDhGxHfb2f6SnkmjO/SrAXwFJ3anown+Cy05nrhpdQRu/x4mIHsIQzeWkzLM0jSsFhpt78H9FE+1vDHMRl70q2sAAIwxhHxM= Received: from DM6PR12MB3179.namprd12.prod.outlook.com (2603:10b6:5:183::18) by DM5PR12MB2359.namprd12.prod.outlook.com (2603:10b6:4:b4::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3174.20; Mon, 13 Jul 2020 17:29:52 +0000 Received: from DM6PR12MB3179.namprd12.prod.outlook.com ([fe80::b4c6:4f2d:4862:8a20]) by DM6PR12MB3179.namprd12.prod.outlook.com ([fe80::b4c6:4f2d:4862:8a20%4]) with mapi id 15.20.3174.025; Mon, 13 Jul 2020 17:29:51 +0000 From: Chris Phillips To: Atul Tulshibagwale , "id-event@ietf.org" Thread-Topic: [Id-event] SAML subject identifier type Thread-Index: AQHWWTEqoJLqeWbaeEO7DX3O8CNDIKkFgPyA Date: Mon, 13 Jul 2020 17:29:51 +0000 Message-ID: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.38.20061401 authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=canarie.ca; x-originating-ip: [24.212.220.78] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 12f92f2c-c013-4dd2-2d4f-08d8275259c6 x-ms-traffictypediagnostic: DM5PR12MB2359: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 0C+7W158ktZelTBpIz63JAdCQTS4L/+sP2UYjXAViP1ekxodyHJAcsC7JoZ+ms0iVrT1lYWqxqTrEmy547FIQT0h/9G+EK6GwJkK/SbIwcHE6RtafJrl6c6YGHHi0d7kZKe/TNOmBpV78MzMSxBdhR0mHnZglaEHHxFzCrtgU3H2TOrkdH33YL4+zewxgALBxIlFG9ClkFOuC9Y7exRh9w//O0L10TLuP0/dcpJ6mLv7rbuX46RBlcwWEzLrYSjpRpNchvtY3KajXVSSCGGZFdXAA+j86U4FCP2L8aNaWWbu4wG9jIVUwD57qP7LTkp5lwsBUV/wKl3ioZEHX0r0ET9ZRL0MqkOaPPT7l4FqKSpsCMIU+SqfVlOuZErsb5AyboSY0FxTO6usyWsWqHwVXw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR12MB3179.namprd12.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(396003)(376002)(136003)(39840400004)(366004)(5660300002)(86362001)(36756003)(66946007)(66616009)(66476007)(66556008)(66446008)(64756008)(91956017)(76116006)(186003)(6486002)(26005)(2616005)(83380400001)(166002)(99936003)(71200400001)(33656002)(2906002)(478600001)(53546011)(6506007)(8936002)(8676002)(6512007)(110136005)(966005)(316002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: j2w6og1WiDzRa1HSNn/xuMgsuqBJM/Rh87OUcFI7NzkC/H14epmrwftKgROfAQwO7pnnS57iou9AncEwKOEEIvH64DqIto1inLRXReM+67OEQvm0F4KvvqU/xqkTaolXB0hX7U74xdTJ27CGdG9iYwdbOz+mtTl8FnVyMZ3nUzkcEVvPfHSbbQYHkiQFfLq5kCWF6tN/mxJSMkymNL7lF0pLU7l0h4YOeAHdBVicRQX+DiHFLzrVyIRuPaadaJxiHP9ZnFxhL61NnEyRAM3Riik6aEz3Wn6kVDAHzSUw68SeMrqr14MPDULadQ3s1VdBl3cn6/piTeGDMJGhQEd86F2fUZvda3jf087Dw5BPpDr7IQaQGKfWfXNcxQMCIxgb/jPuCtsuaR0SW6ladc0TxHaacuig7dZAwIbMpwFf4/2dPQvLBhCkouRA/X92vP52T2suFlUTSM/ajhCObGm9R5saM/8db27wlmDhyKYBnlwehq5b4NmBqW8GQMewzV1Y x-ms-exchange-transport-forked: True Content-type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="B_3677491791_861672707" MIME-Version: 1.0 X-OriginatorOrg: canarie.ca X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR12MB3179.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 12f92f2c-c013-4dd2-2d4f-08d8275259c6 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2020 17:29:51.8067 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 1cf546ed-f2c8-46ea-b122-2340e67b37a0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: AgnRC/3DJOcI1++C080jtqMykqgDuaCxfAL8C2h4H2d6/Mgg4lRtc/fI50r8l9DRkJX1Sw6yRvb/AIsCi49/bw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB2359 Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 17:30:49 -0000 --B_3677491791_861672707 Content-type: multipart/alternative; boundary="B_3677491791_1981002192" --B_3677491791_1981002192 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Hi. Quiet lurker observing.. Thanks for consider the SAML elements..=20 =20 Atul, are you referring to the actual session identifier that someone may h= ave where the Subject-Id was exchanged OR the actual Subject-id itself in yo= ur reference in the proposal with the github link? =20 I=E2=80=99m trying to square what I see on the git delta on line 294-296 in https= ://github.com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be= 077ace88994 =20 =20 And a Subject-id as shown in the example in 3.3.3 here: https://docs.oasis-= open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-c= s01.html#_Toc536097229 =20 What you offered in the example is not a Subject-id =C2=A0per the OASIS SAML sp= ec as written in section 3.3.1 =20 Am I mis-interpreting something? =20 C =20 =20 From: Id-event on behalf of Atul Tulshibagwale = Date: Monday, July 13, 2020 at 12:17 PM To: "id-event@ietf.org" Subject: [Id-event] SAML subject identifier type =20 Hi all, Based on the discussions in the SSE working group within the OpenID Foundat= ion, we would like to propose that the subject identifier specification incl= ude a SAML subject identifier type. This is so that sessions established acr= oss peers using SAML may be identified in events that include the subject id= entifier. =20 A SAML subject identifier has only one claim within it, the assertion id o= f the SAML assertion used to establish the single sign-on session. =20 This change is also included in my proposal here. =20 Thanks, Atul =20 --B_3677491791_1981002192 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Hi.

Quiet lurker = observing..

Thanks for consider the SAML el= ements..

 

Atul, are you referring to the actual session identifier that someone= may have where the Subject-Id was exchanged OR the actual Subject-id itself= in your reference in the proposal with the github link?

 

I=E2=80=99m trying to square= what I see on the git delta on line 294-296 in h= ttps://github.com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78= f9be077ace88994

 

 

And a Subject-id as= shown in the example in 3.3.3 here: https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/= cs01/saml-subject-id-attr-v1.0-cs01.html#_Toc536097229

 

What you offered in = the example is not a Subject-id =C2=A0per the OASIS SAML spec as written in sect= ion 3.3.1

 

Am I mis-interpreting something?

 

C

 

 

From: Id-event <id-event-bounces@ietf.org&g= t; on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.or= g>
Date: Monday, July 13, 2020 at 12:17 PM
To: "= id-event@ietf.org" <id-event@ietf.org>
Subject: [Id-eve= nt] SAML subject identifier type

 

Hi all,

Based on the discussions in the SSE working gro= up within the OpenID Foundation, we would like to propose that the subject i= dentifier specification include a SAML subject identifier type. This is so t= hat sessions established across peers using SAML may be identified in events= that include the subject identifier.

 

 A SAML subjec= t identifier has only one claim within it, the assertion id of the SAML asse= rtion used to establish the single sign-on session.

 

This = change is also included in my proposal here.

=  

Thanks,

Atul

=  

--B_3677491791_1981002192-- --B_3677491791_861672707 Content-type: application/pkcs7-signature; name="smime.p7s" Content-transfer-encoding: base64 Content-disposition: attachment; filename="smime.p7s" MIIQ8AYJKoZIhvcNAQcCoIIQ4TCCEN0CAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B BwGggg5jMIIFRDCCBCygAwIBAgIQPKyw01T6F3YAAAAATDd50zANBgkqhkiG9w0BAQsFADCB pTELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5l bnRydXN0Lm5ldC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMW KGMpIDIwMTAgRW50cnVzdCwgSW5jLjEiMCAGA1UEAxMZRW50cnVzdCBDbGFzcyAyIENsaWVu dCBDQTAeFw0xOTAxMzExNjA2MTNaFw0yMjAxMzExNjM2MTJaMIGHMQswCQYDVQQGEwJDQTEQ MA4GA1UECBMHT250YXJpbzEPMA0GA1UEBxMGT3R0YXdhMRQwEgYDVQQKEwtDYW5hcmllIElu YzE/MBUGA1UEAxMOQ2hyaXMgUGhpbGxpcHMwJgYJKoZIhvcNAQkBFhljaHJpcy5waGlsbGlw c0BjYW5hcmllLmNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApV1Z+iN5R0+Z i1tdCMkIpwrw45duB9MWl2l1ts8oebUYcQu++fDC2tWhyzHI174E5dXTEE0d9Mt9EZvK+tjn L3cYxfM5IeeYGigRlXj5/K/xb4ItEo+rPmH0vGSQji5ir/vXJjGPdXUeOAPe7SeLW2omOQm/ 8yJgGZsyFtjw7ATrUke7b2InFqaGuq9SG/0jLn+vNWBaR6jTF4Uix5qXgHd1EF1eVMkVdE/g x+C8DQ6egeqXNoacuvEnoDmo86fsz5S36KNQ20FNeILy8qgwLhDpQ9HYXEupWErso0vqjqGN OKTnwr8+FmUAs9Gw6W0FHCeAuKo+Sjm4YaELJGIrLwIDAQABo4IBijCCAYYwDgYDVR0PAQH/ BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDBCBgNVHSAEOzA5MDcGC2CG SAGG+mwKAQQCMCgwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuZW50cnVzdC5uZXQvcnBhMGoG CCsGAQUFBwEBBF4wXDAjBggrBgEFBQcwAYYXaHR0cDovL29jc3AuZW50cnVzdC5uZXQwNQYI KwYBBQUHMAKGKWh0dHA6Ly9haWEuZW50cnVzdC5uZXQvMjA0OGNsYXNzMnNoYTIuY2VyMDQG A1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwuZW50cnVzdC5uZXQvY2xhc3MyY2EuY3JsMCQG A1UdEQQdMBuBGWNocmlzLnBoaWxsaXBzQGNhbmFyaWUuY2EwHwYDVR0jBBgwFoAUCZGluuny Lip1381+/nfK8t5rmyQwHQYDVR0OBBYEFM6ilEMuYEBfelMn1tqmwOqTYkFCMAkGA1UdEwQC MAAwDQYJKoZIhvcNAQELBQADggEBAGhqfcxj3tqlQdEOL42qVODMJEKdsc4oKqJpHNSaSP14 1NafQppwwC1/qSHgtNKmce+VP6DtgyT5GKK+p5QrymmvPjla242dmFX7gVAcnWCRZI1jDYtd WMpm0T5jQ5JSgNlJtG1aKX46WsTup7Hplui89TqG3zK9Eb71Ia3o/Ev86NefAcrABHlsvbYu Ik10Fe6OJLcvnDIzlT1b3Tx1CVejHymBme1QN/ElFlqvNzlKwzRj6Tpv+sTzQqJfDmLN9jCi 58XlplypmjHjsKn3xyEPtpNAzCH/kZeNKGe3h8oNtCR7zRJyOkYyubBupBNL26ZcGqm7Qh6Q oRFHf7IQE04wggTpMIID0aADAgECAgRMDowcMA0GCSqGSIb3DQEBCwUAMIG0MRQwEgYDVQQK EwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29y cC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5u ZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3Jp dHkgKDIwNDgpMB4XDTExMTExMTE1MjYwNVoXDTIxMTExMjAwMTgzNVowgaUxCzAJBgNVBAYT AlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMTkwNwYDVQQLEzB3d3cuZW50cnVzdC5uZXQv Q1BTIGlzIGluY29ycG9yYXRlZCBieSByZWZlcmVuY2UxHzAdBgNVBAsTFihjKSAyMDEwIEVu dHJ1c3QsIEluYy4xIjAgBgNVBAMTGUVudHJ1c3QgQ2xhc3MgMiBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEMo1C0J4ZnVuQWhBMtRAAIbkHSN6uboDW/xRQ Buh1r2tGjuelT63DjLD6e+AZkf3wY61xSfOoHB+rNBkgTktU6QCTvnAIMd6JU6xXvCTvKo9C 1PfqlSVdFHbSzacS+huytFxhQL1f3VebRFXYxYkZPGU9uejUpS3CLNPqgzGiCDxeWa4SLioK jF7zszGuCq1+7LBJCfynLiIeaGQ0nRbjpj0DMUAW95T2Sxk0yZfmIpxI3mSggwtYBZjEIkaJ Bf2jvvZJTGEDFqT4Cpkc4sDGfmkCMleQA68AlKG53M6v7/R8GM4wC8qH+NVfH1lR2IsLuTjG WMJTfNom1NvyvZDNAgMBAAGjggEOMIIBCjAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgw BgEB/wIBADAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmVudHJ1 c3QubmV0MDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwuZW50cnVzdC5uZXQvMjA0OGNh LmNybDA7BgNVHSAENDAyMDAGBFUdIAAwKDAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5lbnRy dXN0Lm5ldC9ycGEwHQYDVR0OBBYEFAmRpbrp8i4qdd/Nfv53yvLea5skMB8GA1UdIwQYMBaA FFXkgdERgL7YibkIozH5oSQJFrlwMA0GCSqGSIb3DQEBCwUAA4IBAQCRsMfAKFoTvK1lIT5g bXARndtzkYQpzBpveirTjR9JdXtQh28PFTCUm69QMZmjRSXgQ1opZffl2pr9JL6CPArhSdrM YxQneWn+ioPgrnucGFEhU9CkWYaEAgnDpOLMvPlqInCG63hkMngy2wHPX5HFo3Yxrrynws+0 MKsgutAJvzg8BlACp5h4nWol4aJwp48/p0Y/hQEu4EdwFRI64m7SDrJeKAbyeBC5F0/zA+ia nNfJ0ngA+DIGwotCU33k1Al+XnrxTx3aLS47IuUrUIGL86H0BKKhWoYc0eUjjCuZmQpx3c/f grM0bFYofzg+ek4FYlM7gtRGes1hkkiR2OZ5MIIEKjCCAxKgAwIBAgIEOGPe+DANBgkqhkiG 9w0BAQUFADCBtDEUMBIGA1UEChMLRW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0 Lm5ldC9DUFNfMjA0OCBpbmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsT HChjKSAxOTk5IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENl cnRpZmljYXRpb24gQXV0aG9yaXR5ICgyMDQ4KTAeFw05OTEyMjQxNzUwNTFaFw0yOTA3MjQx NDE1MTJaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3LmVudHJ1c3Qu bmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50cnVzdC5uZXQgQ2Vy dGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEArU1LqRKGsuqjIAcVFmQqK0vRvwtKTY7tgHalZ7d4QMBzQshowNtTK91euHaYNZOL Gp18EzoOH1u3Hs/lJBQesYGpjX24zGtLA/ECDNyrpUAkAH90lKGdCCmziAv1h3edVc3kw37X amSrhRSGlVuXMlBvPci6Zgzj/L24ScF2iUkZ/cCovYmjZy/Gn7xxGWC4LeksyZB2ZnuU4q94 1mVTXTzWnLLPKQP5L6RQstRIzgUyVYr9smRMDuSYB3Xbf9+5CFVghTAp+XtIpGmG4zU/HoZd enoVve8AjhUiVBcAkCaTvA5JaJG/+EfTnZVCwQ5N328mz8MYIWJmQ3DW1cAH4QIDAQABo0Iw QDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVeSB0RGAvtiJ uQijMfmhJAkWuXAwDQYJKoZIhvcNAQEFBQADggEBADubj1abMOdTmXx6eadNl9cZlZD7Bh/K M3xGY4+WZiT6QBshJ8rmcnPyT/4xmf3IDExoU8aAghOY+rat2l098c5u9hURlIIM7j+VrxGr D9cv3h8Dj1csHsm7mhpElesYT6YfzX1XEC+bBAlahLVu2B064dae0Wx5XnkcFMXj0EyTO2U8 7d89vqbllRrDtRnDvV5bu/8j72gZyxKTJ1wDLW8w0B62GqzeWvfRqqgnpv55gcR5mTNXuhKw qeBCbJPKVt7+bYQLCIt+jerXmCHG8+c8eS9enNFMFY3h7CI3zJpDC5fcgJCNs2ebb0gIFVbP v/ErfF6adulZkMV8gzURZVExggJRMIICTQIBATCBujCBpTELMAkGA1UEBhMCVVMxFjAUBgNV BAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0Lm5ldC9DUFMgaXMgaW5j b3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMWKGMpIDIwMTAgRW50cnVzdCwgSW5j LjEiMCAGA1UEAxMZRW50cnVzdCBDbGFzcyAyIENsaWVudCBDQQIQPKyw01T6F3YAAAAATDd5 0zANBglghkgBZQMEAgEFAKBpMC8GCSqGSIb3DQEJBDEiBCB0TJSL2hgK9FddTvi97PqtM/ls jAqKeqgvMpCs4fWdLzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0yMDA3MTMxNzI5NTFaMA0GCSqGSIb3DQEBAQUABIIBACpcm/Lk57BeZfLyAA/pp856FYj4 9TDIgjz2GXYzFuSwhyK9P+HnBykdpLFUUun9DpaYiq9OopOFUtDlGr1hxFYBb+Gafq3+xmHo bCmaJN0VVyctZZEOIhUF2JFjWhULYobfUzoYQ2XQUQ6M5nVBkBq1W7P2ChitEvSeN70gdJSM XCGvnThhm+O2HnKrqfJMNgrtRek19Fkcm1dx4Cxbp6FFoCzkHHdkF4tNf0B0iOJI0bFZIqi/ X9erIuJmKLY+mQzC9oHJp+Abjb4fcNUSYlnY1QddjQ8UtP9la2JrsIc/hna5XwqVxaF+qPnE QqIDL5oxqVEyza4FQ27nBFXWXlY= --B_3677491791_861672707-- From nobody Mon Jul 13 10:37:14 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 939473A15C5 for ; Mon, 13 Jul 2020 10:37:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cPAJGo7D_Vlq for ; Mon, 13 Jul 2020 10:37:12 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640108.outbound.protection.outlook.com [40.107.64.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0DA783A12C3 for ; Mon, 13 Jul 2020 10:37:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Gwt1rqyiK1HiV1+oMC6eATJ/QRPzWBMdgbhFjEk2Ti5eLJSy60RIOKZLVxHxEpCP7IcTfsiMxSv2JjhbTZuH8XjSaofo8KMztJGVxskTYHi6f0/7OmnckhJvU1rU6NkSxPXjWsPekDbxauJZZB/2/Vgfjr8gCpNSVQuw0/kXx4iYLYDCaEp4YO6PgKdSER069jNNdyg5t9inXep7ociYdF5DV+egjDzqAWv4Vs/QRPscVtvk5/KVDGrtjE+qxgzaNn9qJ7QB5PZjZDwEUhpslqX9nlPNQKG87cJMc88s+aEqrmio8sKmHUXexcvmmR+at2TMFSXO478aGb+oZjwfuQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uRIJI4iiUvRPB5aeYe5tX+HwC243WFQ7jVrpddXDykc=; b=mV4O1szBHxKTCNVMCG71vNc6FmudCaxv90qU3rgyR5uKYRdQspMVl3bRoHsfpyLRjO3JV3wdu50/OpI3ZVHMEcltvlDqAcOV0ToHQELNtsg5PPyDyBLTIgnWr3ool4C82or7x4AKblby5IgxQQOUh0r3An0H4FpHiYNBQXuxQE3cAMKk7y9ecOhP7SLO5QK8A6TFXJUPtAx0aO2++3k2VBihAkeoTpKi4uUZFHEiHQnXg/cRNMULZPWItbOcIc6E7hHoVMktNOmFNR9p9q4lX97vNcQ9YrSDWIj9hoRA+8lIpDqA0U++g4T1QG5Wp+BlnsbgCOXPHmXAV/6zo+VIWQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uRIJI4iiUvRPB5aeYe5tX+HwC243WFQ7jVrpddXDykc=; b=Z4rt+NXQb/1GW62muUhi5+UsPxDG+JfCO32+tkiH592aZJFz4uSiQGrZiPfxwyVOo+ne11NEEEuH+epH2sUnSs/pgcI1U+dEVUpRXO9hIzGrD64bJPrzuKwvnCjRthiJzSOQ1rtpk00ruPMkCfYLPkSun9QobagzsSNsQEPT6oI= Received: from DM6PR00MB0816.namprd00.prod.outlook.com (2603:10b6:5:208::12) by DM6PR00MB0831.namprd00.prod.outlook.com (2603:10b6:5:20d::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3224.0; Mon, 13 Jul 2020 17:37:10 +0000 Received: from DM6PR00MB0816.namprd00.prod.outlook.com ([fe80::f138:129:83ad:8071]) by DM6PR00MB0816.namprd00.prod.outlook.com ([fe80::f138:129:83ad:8071%8]) with mapi id 15.20.3230.000; Mon, 13 Jul 2020 17:37:10 +0000 From: Tim Cappalli To: "id-event@ietf.org" Thread-Topic: Feedback: draft-ietf-secevent-subject-identifiers-05 (Tim Cappalli) Thread-Index: AQHWWTwM2wdMqVFhB0+kNKxypDuLow== Date: Mon, 13 Jul 2020 17:37:10 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-13T17:35:50.1472087Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Privileged authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [100.0.202.188] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 09f32610-727d-409a-1482-08d827535f40 x-ms-traffictypediagnostic: DM6PR00MB0831: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: fbDXkgwQdXSSmEr8oipPG6Fm/NGjgYvyou6bSuKQV9H4fK1vnr7GdtuF/vAQFFfbqU5kFRbh7OxVCwTk2lAVkxo2F28h6dIfu3cxBqAkJaTneb2e0gU7Za2dCro3eoRwodkOGl60lcJXmLl68JDExFi7qZBDVlP64lbxv2127Dwiy+pcykJ2xo2OCneiq0dvlrgG1wUN1gKxjYDgLf1Eb33PONrZRmuZ6YyhH0RN0lFjPWRk1i2y4Eng5Te6tPR7MuG3zBQWCNpJg3KAEJbJj5stOiFFr9RPTz+27tva7L9P4kedE9qmoTB72/PLn+OFaiKfQNnoqZaUqMlt03+zRA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR00MB0816.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(39860400002)(396003)(366004)(376002)(346002)(8936002)(8676002)(478600001)(52536014)(4744005)(71200400001)(5660300002)(7696005)(6506007)(83380400001)(26005)(86362001)(10290500003)(316002)(8990500004)(186003)(6916009)(2906002)(76116006)(66946007)(66446008)(66476007)(66556008)(82950400001)(82960400001)(33656002)(55016002)(9686003)(64756008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: fYZB+SDB3u8s7++H/1M6JOmhq1twMBTJcZNkqEayvM1BMNJh5lhHwp/iNzvm3t83223vYSQHgZMoCETUerQNBSIP9/OSJ+QnywCybR+NznhV8d87UF5Py66Zaprof7mQZiRP5PJjKvACguNiNZBlZrWhfhI3SbTeZqRM+yBAdZyHLKVuHeucUcEU+in6oGTdbPOZkFRLkhbiBxkQIxTseWacQdj1+IbpUupsBP+VZJjc1Fc0TYv2ZwXtHb5/IrXsJsEXqN47g3tWnn9YCwIiMYi5iWW6NHkKn/XO1hEKYWcOKbhfqXJhl5/Jhy70OXMJ+vtDVY95wMcAb91gAvjVIr5PK25UiViGORAc1CFpUKIHquXxmWdDchm/YVMEJfaYPZEI1wSp2xIbtZJkj01BWv7Vnnet7mivHzGz1y/k6bI= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB08162FA2A449A78F0E49C20895600DM6PR00MB0816namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR00MB0816.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 09f32610-727d-409a-1482-08d827535f40 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2020 17:37:10.6330 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: /HVlSs3iiy3gNCHsO38TJ/JCxFEhahe49Xj44Uv0IZXf9oi5/flXSqXtyhR73TFDwQGdg3X+5fK+GpZKZtm3hQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0831 Archived-At: Subject: [Id-event] Feedback: draft-ietf-secevent-subject-identifiers-05 (Tim Cappalli) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 17:37:14 -0000 --_000_DM6PR00MB08162FA2A449A78F0E49C20895600DM6PR00MB0816namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Sorry for the delay, I sent this last week but to the -bounces address by a= ccident. Here=92s my feedback: 3. There are definitely use cases for locally significant subject identifi= er types between two parties (example: first party platforms). The current = text mandates registration with IANA. There should be flexibility to use in= ternal/private/local subject identifier types. 3.1 If this identifier type is going to be restricted to user accounts (by = RFC7565), then I think it should be called the "User Account Subject Identi= fier Type" with a "subject_type" value of "user-account". Devices can also = have accounts. 7.1.1 Should the controller be updated to "OpenID Foundation Shared Signals a= nd Events Working Group" to reflect the new name of the group? 7.1.2.1 See feedback for 3.1 Tim --_000_DM6PR00MB08162FA2A449A78F0E49C20895600DM6PR00MB0816namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Sorry for the delay, I sent this last wee= k but to the -bounces address by accident.

 

Here=92s my feedback:

 =

3.

    There are definitely u= se cases for locally significant subject identifier types between two parti= es (example: first party platforms). The current text mandates registration with IANA. There should be flexibility to use internal/privat= e/local subject identifier types.

 =

3.1 

 =

    If this identifier typ= e is going to be restricted to user accounts (by RFC7565), then I think it = should be called the "User Account Subject Identifier Type" with a "subject_type" value of "user-account". Devices can = also have accounts.

 =

 =

7.1.1<= o:p>

    Should the controller = be updated to "OpenID Foundation Shared Signals and Events Working Gro= up" to reflect the new name of the group?

 =

 =

7.1.2.1

    See feedback for 3.1

 

 

Tim

 

--_000_DM6PR00MB08162FA2A449A78F0E49C20895600DM6PR00MB0816namp_-- From nobody Mon Jul 13 11:22:41 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 342BE3A1651 for ; Mon, 13 Jul 2020 11:22:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.468 X-Spam-Level: X-Spam-Status: No, score=-0.468 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XDjVATOJRjb4 for ; Mon, 13 Jul 2020 11:22:38 -0700 (PDT) Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3501C3A1780 for ; Mon, 13 Jul 2020 11:22:26 -0700 (PDT) Received: by mail-lj1-x22b.google.com with SMTP id e4so19101734ljn.4 for ; Mon, 13 Jul 2020 11:22:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tOzelKDlT6YmClpU8B6k9kXJYOkglPRDP4TKB0OUgtQ=; b=rOPEpzqJ7NUFdkk/GpOeoczxEmP+bFy9bjqcfzYrP2EBanSZFMQGF8IQSVebIwwZN3 qK0WK8lnaKs8RXYCnpCcjWFxhRot9X6gh1wC58pBhiVsJHV0cOaEqGtK+MCEHy8ts/X1 ahqZMsyip0VVJncidbMTrctBR6FZWhY8xeM0zZrFZqqDEWpljUx1CFvVlcVoqDHN6XRs pAjNNoBVpl6ezHmpKXyqh11g9crGWkSlEepmWAzXhnn/UTUxS/vENi4Znj2fnYpWNYbL 6Y3Y5F2nqvEdmFQhMrOYB2j9hX1ZQPlRRcPndTG+2dMvxLZcTyW8OYdES3tpgKPL8Q36 /gLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tOzelKDlT6YmClpU8B6k9kXJYOkglPRDP4TKB0OUgtQ=; b=IzK+DonIATwOmcGSGdq861FnsBS5+wZHum/xBcEOGz+yg+Vwj5vSLioVujRVcI2rk/ 0PIG42ulGjyd5gJAshhuI26ghnX+7VkcUpOfoHKagxPw5GIQAZDJBMBLHg96nlGT5rZ7 biO0MjFvmgUTBeaTbhMBE1cOziZh4RGk36WBfavyCl+PPRWbfN2hxj3WBeBdOQ3ozAh9 LNSF07mDLPAdBpvdXN+4O6FslRBfn+fqpQtce7ec3T6ccmnlEKqUPXkHvFURaS+pAW9N 01fncO/LgCsCWYpM3MMO/GdRYQPmSVcfBKKCtVNWdzQBmjyBT8LrSmkfp8mlcn5vpvjL SYOA== X-Gm-Message-State: AOAM531WnxToTEA7m15L9VyTd/vJBah65CjGWjneCdkfWW1+Pg606uqg KRJIEna2hfUPm3l+2bQjhnjbTtTTluRO7pZC6NCU46wh X-Google-Smtp-Source: ABdhPJxBb3WM2Kgx9vWKbTEOjHJ69uFoDfLtnhTfboiJWPTDDWqgTt+w/d6b5OdbzZ7tvDHf3aYzOBdJ5pjrEkUx7B0= X-Received: by 2002:a2e:b607:: with SMTP id r7mr473224ljn.5.1594664544236; Mon, 13 Jul 2020 11:22:24 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Mon, 13 Jul 2020 11:21:48 -0700 Message-ID: To: Atul Tulshibagwale Cc: SecEvent Content-Type: multipart/alternative; boundary="000000000000b202ca05aa56c50a" Archived-At: Subject: Re: [Id-event] Common claims in subject identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 18:22:39 -0000 --000000000000b202ca05aa56c50a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Atul: would you provide a couple use cases and examples to explain your proposal? =E1=90=A7 On Mon, Jul 13, 2020 at 9:15 AM Atul Tulshibagwale wrote: > Hi all, > The proposed subject identifiers specification today requires that each > claim within a subject identifier be specified by the individual subject > identifier type. However, there may be some common claims that could be > defined across all subject identifier types. These are captured within th= e > "common claims" section of my proposal. All such common claims may be > optional unless a specific subject identifier type requires any of them > (there is no example of that today). These claims include: > > - *SPAG Identifier*: Identifies the "Subject Principal Administrative > Grouping" or SPAG that the subject identifier belongs to > - *Subject Category*: identifies the category that the subject > identifier refers to (whether user, device or session) > > To avoid having to define these claims within each subject identifier > type, I have extracted them into a separate section called "common claims= " > in my proposal . > > Thanks, > Atul > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --000000000000b202ca05aa56c50a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Atul: would you provide a couple use cases and examples to= explain your proposal?=C2=A0
3D""=E1=90=A7

On Mon, Jul 13,= 2020 at 9:15 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
Hi all= ,
The proposed subject identifiers specification today requires that ea= ch claim within a subject identifier be specified by the individual subject= identifier type. However, there may be some common claims that could be de= fined across all subject identifier types. These are captured within the &q= uot;common claims" section of my proposal. All such common claims may = be optional unless a specific subject identifier type requires any of them = (there is no example of that today). These claims include:
    SPAG Identifier: Identifies the "Subject Principal Administra= tive Grouping" or SPAG that the subject identifier belongs to
  • = Subject Category: identifies the category that the subject identifie= r refers to (whether user, device or session)
To avoid having= to define these claims within each subject identifier type, I have extract= ed them into a separate section called "common claims" in my propo= sal.

Thanks,
Atul
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--000000000000b202ca05aa56c50a-- From nobody Mon Jul 13 11:25:15 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4D473A166E for ; Mon, 13 Jul 2020 11:25:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.682 X-Spam-Level: X-Spam-Status: No, score=-0.682 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QBvydy1ahymO for ; Mon, 13 Jul 2020 11:25:12 -0700 (PDT) Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E5C73A1666 for ; Mon, 13 Jul 2020 11:25:11 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id d17so19139857ljl.3 for ; Mon, 13 Jul 2020 11:25:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=K3iiBQ6NYqgcJRSzcQ0DZdVNin6t8aohSv+Kjq7quYQ=; b=nfoqpdP2SlCk4svsrr31lQ1MjM8tE65obuL3PZdSsmod1zq9z6e2K2fY0F7TFnSgsy tlZHPGUY5w+Kw0uFfqw4xu+pdx9LiugpfKaj69CbTFD9RqNuqC2iVgB/9rAkDYsKRPdR jHLfQyF75lL2yz8EJKwTygWHbCFO5o0geUhHbtEUUypPYEnRTtmG2NmURRTotq1YzdCg f6aStCJKeKaU1WAprMhevPMMmbHuOV2/wNRINonm+aa5a11gY3eHRIF14WlZGfKNSvi4 qVBz/zMK/TRMuB/xLICvVQocnI0dDwc5dwAwtm4NeOr8cRl+N0hr9uRelS+7kv2rzfBc 1qOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=K3iiBQ6NYqgcJRSzcQ0DZdVNin6t8aohSv+Kjq7quYQ=; b=pqlM1q+xYvM8LmLj2hOs2fHxDn9pHqVNsFdMPAQgYdh2/ePzlIQaYA+4dvBlzY4BCU LA/WhCtOHDkz/pqTofHKQn8xubTPY+VQjuxMUjxhjCwcp5jCHwRxiUd+n2EHNSpBu+Nu ipfhtO+9xb+bYGNfpwfMgz61DhZA4UkuznXTjQb0nXao3xNgN2FO3QUoNH47yjKoN503 GmQNg/EAkR7PbR9jkE+/Xv7fwn4U50A8z6gsHpEwoKI4nhvBxJOKaEj8cbVe8kbvusCm RUqO35wWvM7EPYntCbcyjPv3qU0cKyClRs7rOqQAx5sYzhbD1JS3pEII5rcFhV/MSSe9 bKaA== X-Gm-Message-State: AOAM530/P/c0Vsws30nhGn4z7Fm0iwE9uHizgIPDhE6oNhH4NOq7o8gX 3ga2UCoSIZtjQUa+eqDFvzDIDkIhldU0V1LPOCGuuQOdl6s= X-Google-Smtp-Source: ABdhPJzkczjNo+sQ77gVNcXQDOAMLCZ/Ljpa6rVil3FnPNpmmbl7liXUT6ObwFXUk1tsRFSb8jkopAJTCJst77Lp38E= X-Received: by 2002:a2e:8316:: with SMTP id a22mr436416ljh.246.1594664710000; Mon, 13 Jul 2020 11:25:10 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Mon, 13 Jul 2020 11:24:33 -0700 Message-ID: To: Atul Tulshibagwale Cc: SecEvent Content-Type: multipart/alternative; boundary="00000000000093546505aa56cff2" Archived-At: Subject: Re: [Id-event] Subject Categories in Subject Identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 18:25:14 -0000 --00000000000093546505aa56cff2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Atul I don't follow why this statement is true: "Since this is a property of the subject rather than the event" I would come to the opposite conclusion. =E1=90=A7 On Mon, Jul 13, 2020 at 9:10 AM Atul Tulshibagwale wrote: > Hi all, > Subject Identifiers will be used in various specifications about events > pertaining to those subject identifiers. In order to determine the scope = of > the event, it is important to know what the transmitter of the event that > includes the subject identifier refers to. > > For example, when a subject identifier specifies a phone number as the > identifier, is the transmitter of the event that includes such a subject > identifier specifying the user or the device represented by the subject > identifier. > > Since this is a property of the subject rather than the event, it should > be logically included in the subject identifier spec. Therefore, I'm > proposing that we include a "subject category" claim within the subject > identifier. The subject category could have one of the following values: > > - *User* > - *Device* > - *Session* > > The above values are sufficient for the SSE profile, but other values may > be possible (although such a possibility is not a part of my proposal > ). > > Thanks, > Atul > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --00000000000093546505aa56cff2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi=C2=A0Atul

I don't follow why thi= s statement is true:

"Since this is a propert= y of the subject rather than the event"

I wou= ld come to the opposite conclusion.

3D""= =E1=90=A7

On Mon, Jul 13, 2020 at 9:10 AM Atul Tulshibagwale <atul= tulshi=3D40google.com@dmarc.= ietf.org> wrote:
Hi all,
Subject Identifiers will be used in va= rious specifications about events pertaining to those subject identifiers. = In order to determine the scope of the event, it is important=C2=A0to know = what the transmitter of the event that includes the subject identifier refe= rs to.

For example, when a subject identifier spec= ifies a phone number as the identifier, is the transmitter of the event tha= t includes such a subject identifier specifying the user or the device repr= esented by the subject identifier.

Since this is a= property of the subject rather than the event, it should be logically incl= uded in the subject identifier spec. Therefore, I'm proposing that we i= nclude a "subject category" claim within the subject identifier. = The subject category could have one of the following values:
    =
  • User
  • Device
  • Session
= The above values are sufficient for the SSE profile, but other values may b= e possible (although such a possibility is not a part of my proposal).

Thanks,
Atul

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--00000000000093546505aa56cff2-- From nobody Mon Jul 13 11:32:17 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 548C63A1692 for ; Mon, 13 Jul 2020 11:32:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lbKid_Nsd1Tf for ; Mon, 13 Jul 2020 11:32:13 -0700 (PDT) Received: from mail-lf1-x131.google.com (mail-lf1-x131.google.com [IPv6:2a00:1450:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 531C33A169D for ; Mon, 13 Jul 2020 11:32:02 -0700 (PDT) Received: by mail-lf1-x131.google.com with SMTP id k15so9677380lfc.4 for ; Mon, 13 Jul 2020 11:32:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MXRDjX2ROPTteADIfo6F8/b9/np6ZdY3lZD/cI/rroE=; b=KWwkcq9elyC71yh1DLCG2PXx4P/FAJ/fUSc8Z3gSMBja7UA2fJnxlxPlBHNLCGyrOE y44Hl4qT8s2GOHLzCW8l9TzTubJMzpl/+iuaeFR5MQx7O6Lq3tXInuNgiS3TM0odiZd2 fG3BA0w80x7jaYddcE093kFb+L2GqEAPA0eMRHooR/IB2OErwr/13F7vLos1AZC/Fv70 QEzQA5jSCyC9cPImmtcuD0PS09pcsN8WdpiQB6XccfKzfbyJ69W8uvsme0PBPRVlj3OY lJNa9KYC5RjupfeIbYO55Z4LHiwfFmxeg05mOc97zTWEqhNqxEqEGVfeGLZCzuL62N3t 5/PQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MXRDjX2ROPTteADIfo6F8/b9/np6ZdY3lZD/cI/rroE=; b=YIlToNxSpFqY5Ye6bh0Lrgn+9taCJD9RNG4knFJWsomb7gYBtKAwKIc5hlYTk9QAPX 6van/pvDC7uPsxeLgELnP064f6OUb6AxuPGtEPS498EMqfRshHvfGhbpp3JwrNG0Rvuw g9yQWJyrGL2C1jDoQkA/T0IFORtO1n6LSnJFp4pAQBIwvoX86pXWxkkLWcf1uOWxEzk1 v1+0H1Y8/0DHVw+qIY0sjkpMf5uou8DRITvGU5XEfzLDUdPGlrTbluYEi1dBY5WIuTWb bVilGVx3LIKePGsKDNOVj4cUdlQzqHLTwDeGGRAvNlxFof9c/hpqm3qMs7qwGDAvqXhE NSkA== X-Gm-Message-State: AOAM532AjS+gE4McioJu77AT6Te6XwFkEmv+a+NwiQCV4G2mFXJnOjAa bRUF/hpxDVzGY0Vf1asz13lA5sZjV8LQ05x4PT1hBVp1 X-Google-Smtp-Source: ABdhPJzjPVmR5Jd50jgCPWncJYXyBfrSbGcJbgiAHXcDtjpCCsKr479RCNdivFBSZB+e1sbfVe9z6hpxma54BKBuIOs= X-Received: by 2002:a19:ac03:: with SMTP id g3mr243470lfc.164.1594665120284; Mon, 13 Jul 2020 11:32:00 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Mon, 13 Jul 2020 11:31:24 -0700 Message-ID: To: Atul Tulshibagwale Cc: SecEvent Content-Type: multipart/alternative; boundary="00000000000007c50f05aa56e867" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 18:32:15 -0000 --00000000000007c50f05aa56e867 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable To clarify, your proposal is driven by the implementation burden of maintaining separate secrets / streams between a transmitter and receiver? =E1=90=A7 On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale wrote: > Hi all, > Here's a quick background for the proposal > for including Subject > Principals and Subject Principal Administrative Groupings or SPAGs in the > Subject Identifiers spec. > > *Use of Subject Identifiers in Shared Signals and Events*: > The Shared Signals and Events (SSE) profile of SETs specifies that > transmitters and receivers send and receive SETs that contain Subject > Identifiers. These subject identifiers have the format that is now being > discussed as a separate specification here. > > *Transmitters and Receivers in SSE* > The SSE profile defines transmitters and receivers as hosts that manage > streams between peers. The receiver authenticates to the transmitter usin= g > OAuth, requiring the use of a secret per receiver. In a multi-tenanted ho= st > that handles hundreds of thousands or millions of independent tenants, > maintaining such a secret per instance of a receiver is cumbersome. > Furthermore, since a transmitter and a receiver has to maintain a stream > per pair, creating such per-tenant streams can add significant > implementation overhead. > > *SPAGs* > Therefore, we need a notion of a grouping of subjects within the same > transmitter and receiver to distinguish between various administrative > groupings that exist within a host. These groupings could include tenants= , > organizational units or user groups. This grouping is captured in the > notion of a SPAG. The uniqueness of a user identifier (subject identifier= ) > may also be limited to a SPAG. For example, if a random unique ID > represents a user, then that ID may be unique within a SPAG and not > universally across a transmitter or receiver. This is because each > transmitter and receiver may have multiple connections to other > transmitters and receivers, and ensuring uniqueness across all such peers > is probably an intractable problem. > > *Subject Principals* > While what is represented within a subject identifier may be only an > aspect of the management entity, the administrative grouping is about the > management entity itself. This could be the user, device or other princip= al > that the subject identifier represents. Therefore, an abstract notion of = a > Subject Principal is also required in order specify what the grouping > within a SPAG is about. > > The above is captured in the "Subject Principal" and "SPAG" sections > within the proposed PR . > > Thanks, > Atul > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --00000000000007c50f05aa56e867 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
To clarify, your proposal is driven by the implementation= =C2=A0burden of maintaining separate secrets / streams between a transmitte= r and receiver?
3D""=E1=90=A7

On Mon, Jul 13, 2020 at 9:01 = AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
Hi all,=C2=A0
He= re's a quick background for the proposal for including Subject Princ= ipals and Subject Principal Administrative Groupings or SPAGs in the Subjec= t Identifiers spec.

Use of Subject Identifiers = in Shared Signals and Events:
The Shared Signals and Events (= SSE) profile of SETs specifies that transmitters and receivers send and rec= eive SETs that contain Subject Identifiers. These subject identifiers have = the format that is now being discussed as a separate specification here.

Transmitters and Receivers in SSE
The SSE profile defines transmitters and receivers as hosts that manage = streams between peers. The receiver authenticates to the transmitter using = OAuth, requiring the use of a secret per receiver. In a multi-tenanted host= that handles hundreds of thousands or millions of independent tenants, mai= ntaining such a secret per instance of a receiver is cumbersome. Furthermor= e, since a transmitter and a receiver has to maintain a stream per pair, cr= eating such per-tenant streams can add significant implementation overhead.=

SPAGs
Therefore, we need a notio= n of a grouping of subjects within the same transmitter and receiver to dis= tinguish between various administrative groupings that exist within a host.= These groupings could include tenants, organizational units or user groups= . This grouping is captured in the notion of a SPAG. The uniqueness of a us= er identifier (subject identifier) may also be limited to a SPAG. For examp= le, if a random unique ID represents a user, then that ID may be unique wit= hin a SPAG and not universally across a transmitter or receiver. This is be= cause each transmitter and receiver may have multiple connections to other = transmitters and receivers, and ensuring uniqueness across all such peers i= s probably an intractable problem.

Subject Prin= cipals
While what is represented within a subject identifier = may be only an aspect of the management entity, the administrative grouping= is about the management entity itself. This could be the user, device or o= ther principal that the subject identifier represents. Therefore, an abstra= ct notion of a Subject Principal is also required in order specify what the= grouping within a SPAG is about.

The above is cap= tured in the "Subject Principal" and "SPAG" sections wi= thin the proposed PR.

Thanks,
Atul

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--00000000000007c50f05aa56e867-- From nobody Mon Jul 13 11:35:54 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9289A3A1864 for ; Mon, 13 Jul 2020 11:35:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WM4MUJKZjtDq for ; Mon, 13 Jul 2020 11:35:46 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650136.outbound.protection.outlook.com [40.107.65.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D69C03A17EC for ; Mon, 13 Jul 2020 11:35:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SFuOUeqZU1LgyFNLEEUnyWuuIAOw0AY1JFsyAiLSdO+RkVBZ2iWQJX5DvHhuLUk5GNZwXfaUBntOFLnieNh7HBNxhHGN11Tc8gRjKh/TMmQ1kAcTS/dt65P4+LlPcs74We4jbapzII87iDamFTeJqQ9yUUN14EdcAh3gmKL6w01BpT9F6DyycRyUuW3ErjDDc9iiyh4OcMkh7NpZwlQegPkvlLwt9Ucr3uBk1IiRqtJwBntT2PqornEePRttuHuiko7fWelxlQQMdsPnFGZ75gqts2kqsBtsfpl9MQb1h2z8y7+kvt39DaTP9lbHQJ8LvSzW4jmSbYsTHTho04RjMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G13Yo8SZWLIJko4Q1i1qZqqMiD2owByUNkZL1/y220c=; b=OUHquFERGNRslSubx0C+1KUob8LwnAVotFgct0/Xjg1/5z5b50OORGBUvYg9D/BJi6cWI7bD/8SbNESfdLr9KqA5wM6Lf43peAkCEY65o3McVwUjjRwjMukPnV5vLSOOaAyD2/ngwSP6+nqq2D8UDE3MM1sekZ3Ilf1dypE1DIDEuXUlVJRck9EBnVwnx+qyDwkhG719PUhmWmaWcTGyre3xXFd3XXgo+uNjPb+1rpxipofwyJrf4AsT/lXeBnGpHaO7e3Dw6vXcjkP2OrSkuJF9ymnwEhigsc3Erfmovvh7Vx+otew1LLdafKbwc+17l8HW9g+SMhlAaSCZJG0I8Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G13Yo8SZWLIJko4Q1i1qZqqMiD2owByUNkZL1/y220c=; b=A34nFOR0U6QMSyi4+Q7wQGp4sqHCsny2QEgJtEa2nQCzjWFuAHHqhyb5x14vuvJR0l28qnaQh/Y/y5sFYY86G/H9rDBbou8n5JlZJR8+wRgWTSRe5FEwitu2sG9rnJCKAMmuunp3hl1RKGOHVwjhjAD7tANckzl+JB3/RoZqBkc= Received: from CH2PR00MB0678.namprd00.prod.outlook.com (2603:10b6:610:a9::23) by CH2PR00MB0712.namprd00.prod.outlook.com (2603:10b6:610:ad::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3229.0; Mon, 13 Jul 2020 18:35:31 +0000 Received: from CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::29f8:dc4a:8aac:e889]) by CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::29f8:dc4a:8aac:e889%8]) with mapi id 15.20.3230.000; Mon, 13 Jul 2020 18:35:31 +0000 From: Mike Jones To: Atul Tulshibagwale , "id-event@ietf.org" Thread-Topic: [Id-event] Subject Principals and Subject Principal Administrative Groupings Thread-Index: AdZZRGGcVWCxCxmJQaG9cG1UI05+Yw== Date: Mon, 13 Jul 2020 18:35:31 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-13T18:26:28Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=277f7394-0298-46aa-a29b-d28aae7860d0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0 authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 5a89178a-8fe7-4be1-dab0-08d8275b85e8 x-ms-traffictypediagnostic: CH2PR00MB0712: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:3631; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: fKEP9N5K/7FnteOCzpg1/VPxOrw2qo6PcUq9Kl6IM+ZxV76PIQy/CIhNQRBsuCNhIabuf3Hig9tiNv3aAf6JEgEioEHYlZxurMl9bhL0/ipJ+T+eFJaKSxkHs/YMsSOcMJwiw8zQHr7XUjh1eA2nRMMEg1RJhY00S1CuSgGRkJZsyELH61/zu+j1/F/3st14uW1Sa97ctzAvzKzNzREb7E9QkMr0hkngKX+3GuLuUmyl52xfHvlDVRGkldBcQqN9RyVJx6Gsx8xwCqyQMauQ1Y+vH39TbIlmcHyOu1CFhdn2hYqhCnLsjannHajyIRAJUjaJhbos4QX+mQW2JtgkvLgfOFt9qMT8hVP7CQJK1EXmVNZEiuYoODDWo06RPrB3zwrjibK6r+hhYclYDP1Gyw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR00MB0678.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(136003)(396003)(376002)(39860400002)(346002)(316002)(8676002)(82950400001)(82960400001)(5660300002)(8990500004)(66446008)(66946007)(66556008)(66476007)(64756008)(76116006)(2906002)(10290500003)(8936002)(52536014)(478600001)(86362001)(6506007)(53546011)(9686003)(33656002)(110136005)(26005)(55016002)(83380400001)(166002)(7696005)(186003)(71200400001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: z5xGe81yPgQi/gLaI5Hm6VxecFvANJ38tQ16qGrys4qV4imztb+gyUA0MyUyQNv3eplXKBFKaeodvu99zv0DDnd8vHTNw+ncVbpkyoLx+tnqZeq291+G114EG/6msxr5BfnLD8kC/1sHtaT5q1y/e1AfJ1z3+CWzTMJxX99aVb4ZsHPBzkXyAm9Ho33Ztq0Q7kQkKDEujouQSUcXPIC1l4jEK+1eJaRjq3McjENHPVKZc1RNnaKyrNBb85gY/buhbqv1+VA6v2wRq1vFn8LlK/fJka3i6l+MyIAQ+e4GRX8OICOrKsj8NvcgBWR690EXzrQ62FHcPwUs3h9OVTE69TbUUx+BENL01n+S4phld81GUTXrsE6O3Pbv10Dx9LxMkF1Zi2jKybp6Kg/bImOSXm97eqzfoPk79a14uCDNrdKJupwQJzvbZ98mTZpVuoSpnSCG+taJw/Vxtapb8dsc0RNZtq+xtboUAcq92x3ZjnE= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR00MB0678FC47430BF56441D1F202F5600CH2PR00MB0678namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CH2PR00MB0678.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5a89178a-8fe7-4be1-dab0-08d8275b85e8 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2020 18:35:31.4514 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: UdpKMI9YSmW6ntjxMOeaYwoBKWk9e56fr+F7agrjsih3cj9AFCfd7gd2958fHXrWGqVa8f7XFevGcoDv74OSPg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0712 Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 18:35:53 -0000 --_000_CH2PR00MB0678FC47430BF56441D1F202F5600CH2PR00MB0678namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QXR1bCDigJMgd2hhdCB5b3Ugd3JvdGUgYmVsb3cgc2F5cyAqd2h5KiB5b3UgbmVlZCB0aGVzZSB0 aGluZ3MgYnV0IG5vICp3aGF0KiB0aGV5IGFyZS4gIFlvdXIgb3RoZXIgaW5kaXZpZHVhbCBub3Rl cyB3ZXJlIHNpbWlsYXIuICBDb3VsZCB5b3UgcGxlYXNlIHJlcGx5LWFsbCB0byBlYWNoIG9mIHlv dXIgbmV3IHRocmVhZHMgYWRkaW5nIHRoZSBzcGVjaWZpY3Mgb2Ygd2hhdCBpcyBiZWluZyBwcm9w b3NlZCwgZGVzY3JpYmluZyBib3RoIHRoZSBzeW50YXggYW5kIHNlbWFudGljcz8NCg0KWWVzLCBw ZW9wbGUgY291bGQgcmVhZCB5b3VyIFBSLCBidXQgcmVhbGlzdGljYWxseSwgbW9zdCBwZW9wbGUg d29u4oCZdC4gIEFuZCB0aGUgUFIgY292ZXJzIGEgYnVuY2ggb2YgZGlmZmVyZW50IHRvcGljcywg c28gaXQgd291bGRu4oCZdCBiZSBjbGVhciB0byBtYW55IHJlYWRlcnMgd2hpY2ggcGFydHMgYXJl IHJlbGV2YW50IGFuZCB3aGljaCBhcmVu4oCZdC4NCg0KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoYW5rcywNCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IElk LWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgQXR1bCBUdWxz aGliYWd3YWxlDQpTZW50OiBNb25kYXksIEp1bHkgMTMsIDIwMjAgOTowMSBBTQ0KVG86IGlkLWV2 ZW50QGlldGYub3JnDQpTdWJqZWN0OiBbSWQtZXZlbnRdIFN1YmplY3QgUHJpbmNpcGFscyBhbmQg U3ViamVjdCBQcmluY2lwYWwgQWRtaW5pc3RyYXRpdmUgR3JvdXBpbmdzDQoNCkhpIGFsbCwNCkhl cmUncyBhIHF1aWNrIGJhY2tncm91bmQgZm9yIHRoZSBwcm9wb3NhbDxodHRwczovL2dpdGh1Yi5j b20vcmljaGFubmEvc2VjZXZlbnQvcHVsbC8xPiBmb3IgaW5jbHVkaW5nIFN1YmplY3QgUHJpbmNp cGFscyBhbmQgU3ViamVjdCBQcmluY2lwYWwgQWRtaW5pc3RyYXRpdmUgR3JvdXBpbmdzIG9yIFNQ QUdzIGluIHRoZSBTdWJqZWN0IElkZW50aWZpZXJzIHNwZWMuDQoNClVzZSBvZiBTdWJqZWN0IElk ZW50aWZpZXJzIGluIFNoYXJlZCBTaWduYWxzIGFuZCBFdmVudHM6DQpUaGUgU2hhcmVkIFNpZ25h bHMgYW5kIEV2ZW50cyAoU1NFKSBwcm9maWxlIG9mIFNFVHMgc3BlY2lmaWVzIHRoYXQgdHJhbnNt aXR0ZXJzIGFuZCByZWNlaXZlcnMgc2VuZCBhbmQgcmVjZWl2ZSBTRVRzIHRoYXQgY29udGFpbiBT dWJqZWN0IElkZW50aWZpZXJzLiBUaGVzZSBzdWJqZWN0IGlkZW50aWZpZXJzIGhhdmUgdGhlIGZv cm1hdCB0aGF0IGlzIG5vdyBiZWluZyBkaXNjdXNzZWQgYXMgYSBzZXBhcmF0ZSBzcGVjaWZpY2F0 aW9uIGhlcmUuDQoNClRyYW5zbWl0dGVycyBhbmQgUmVjZWl2ZXJzIGluIFNTRQ0KVGhlIFNTRSBw cm9maWxlIGRlZmluZXMgdHJhbnNtaXR0ZXJzIGFuZCByZWNlaXZlcnMgYXMgaG9zdHMgdGhhdCBt YW5hZ2Ugc3RyZWFtcyBiZXR3ZWVuIHBlZXJzLiBUaGUgcmVjZWl2ZXIgYXV0aGVudGljYXRlcyB0 byB0aGUgdHJhbnNtaXR0ZXIgdXNpbmcgT0F1dGgsIHJlcXVpcmluZyB0aGUgdXNlIG9mIGEgc2Vj cmV0IHBlciByZWNlaXZlci4gSW4gYSBtdWx0aS10ZW5hbnRlZCBob3N0IHRoYXQgaGFuZGxlcyBo dW5kcmVkcyBvZiB0aG91c2FuZHMgb3IgbWlsbGlvbnMgb2YgaW5kZXBlbmRlbnQgdGVuYW50cywg bWFpbnRhaW5pbmcgc3VjaCBhIHNlY3JldCBwZXIgaW5zdGFuY2Ugb2YgYSByZWNlaXZlciBpcyBj dW1iZXJzb21lLiBGdXJ0aGVybW9yZSwgc2luY2UgYSB0cmFuc21pdHRlciBhbmQgYSByZWNlaXZl ciBoYXMgdG8gbWFpbnRhaW4gYSBzdHJlYW0gcGVyIHBhaXIsIGNyZWF0aW5nIHN1Y2ggcGVyLXRl bmFudCBzdHJlYW1zIGNhbiBhZGQgc2lnbmlmaWNhbnQgaW1wbGVtZW50YXRpb24gb3ZlcmhlYWQu DQoNClNQQUdzDQpUaGVyZWZvcmUsIHdlIG5lZWQgYSBub3Rpb24gb2YgYSBncm91cGluZyBvZiBz dWJqZWN0cyB3aXRoaW4gdGhlIHNhbWUgdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyIHRvIGRpc3Rp bmd1aXNoIGJldHdlZW4gdmFyaW91cyBhZG1pbmlzdHJhdGl2ZSBncm91cGluZ3MgdGhhdCBleGlz dCB3aXRoaW4gYSBob3N0LiBUaGVzZSBncm91cGluZ3MgY291bGQgaW5jbHVkZSB0ZW5hbnRzLCBv cmdhbml6YXRpb25hbCB1bml0cyBvciB1c2VyIGdyb3Vwcy4gVGhpcyBncm91cGluZyBpcyBjYXB0 dXJlZCBpbiB0aGUgbm90aW9uIG9mIGEgU1BBRy4gVGhlIHVuaXF1ZW5lc3Mgb2YgYSB1c2VyIGlk ZW50aWZpZXIgKHN1YmplY3QgaWRlbnRpZmllcikgbWF5IGFsc28gYmUgbGltaXRlZCB0byBhIFNQ QUcuIEZvciBleGFtcGxlLCBpZiBhIHJhbmRvbSB1bmlxdWUgSUQgcmVwcmVzZW50cyBhIHVzZXIs IHRoZW4gdGhhdCBJRCBtYXkgYmUgdW5pcXVlIHdpdGhpbiBhIFNQQUcgYW5kIG5vdCB1bml2ZXJz YWxseSBhY3Jvc3MgYSB0cmFuc21pdHRlciBvciByZWNlaXZlci4gVGhpcyBpcyBiZWNhdXNlIGVh Y2ggdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyIG1heSBoYXZlIG11bHRpcGxlIGNvbm5lY3Rpb25z IHRvIG90aGVyIHRyYW5zbWl0dGVycyBhbmQgcmVjZWl2ZXJzLCBhbmQgZW5zdXJpbmcgdW5pcXVl bmVzcyBhY3Jvc3MgYWxsIHN1Y2ggcGVlcnMgaXMgcHJvYmFibHkgYW4gaW50cmFjdGFibGUgcHJv YmxlbS4NCg0KU3ViamVjdCBQcmluY2lwYWxzDQpXaGlsZSB3aGF0IGlzIHJlcHJlc2VudGVkIHdp dGhpbiBhIHN1YmplY3QgaWRlbnRpZmllciBtYXkgYmUgb25seSBhbiBhc3BlY3Qgb2YgdGhlIG1h bmFnZW1lbnQgZW50aXR5LCB0aGUgYWRtaW5pc3RyYXRpdmUgZ3JvdXBpbmcgaXMgYWJvdXQgdGhl IG1hbmFnZW1lbnQgZW50aXR5IGl0c2VsZi4gVGhpcyBjb3VsZCBiZSB0aGUgdXNlciwgZGV2aWNl IG9yIG90aGVyIHByaW5jaXBhbCB0aGF0IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgcmVwcmVzZW50 cy4gVGhlcmVmb3JlLCBhbiBhYnN0cmFjdCBub3Rpb24gb2YgYSBTdWJqZWN0IFByaW5jaXBhbCBp cyBhbHNvIHJlcXVpcmVkIGluIG9yZGVyIHNwZWNpZnkgd2hhdCB0aGUgZ3JvdXBpbmcgd2l0aGlu IGEgU1BBRyBpcyBhYm91dC4NCg0KVGhlIGFib3ZlIGlzIGNhcHR1cmVkIGluIHRoZSAiU3ViamVj dCBQcmluY2lwYWwiIGFuZCAiU1BBRyIgc2VjdGlvbnMgd2l0aGluIHRoZSBwcm9wb3NlZCBQUjxo dHRwczovL2dpdGh1Yi5jb20vcmljaGFubmEvc2VjZXZlbnQvcHVsbC8xPi4NCg0KVGhhbmtzLA0K QXR1bA0KDQo= --_000_CH2PR00MB0678FC47430BF56441D1F202F5600CH2PR00MB0678namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25h bC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAy MDYwO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtz aXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2 LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0i MTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86 c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEi IC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3Jk U2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIw NjAiPkF0dWwg4oCTIHdoYXQgeW91IHdyb3RlIGJlbG93IHNheXMgKjxiPndoeTwvYj4qIHlvdSBu ZWVkIHRoZXNlIHRoaW5ncyBidXQgbm8gKjxiPndoYXQ8L2I+KiB0aGV5IGFyZS4mbmJzcDsgWW91 ciBvdGhlciBpbmRpdmlkdWFsIG5vdGVzIHdlcmUgc2ltaWxhci4mbmJzcDsgQ291bGQgeW91IHBs ZWFzZSByZXBseS1hbGwgdG8gZWFjaCBvZiB5b3VyIG5ldyB0aHJlYWRzIGFkZGluZyB0aGUNCiBz cGVjaWZpY3Mgb2Ygd2hhdCBpcyBiZWluZyBwcm9wb3NlZCwgZGVzY3JpYmluZyBib3RoIHRoZSBz eW50YXggYW5kIHNlbWFudGljcz88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PlllcywgcGVvcGxlIGNvdWxkIHJlYWQgeW91ciBQUiwgYnV0IHJlYWxpc3RpY2FsbHksIG1vc3Qg cGVvcGxlIHdvbuKAmXQuJm5ic3A7IEFuZCB0aGUgUFIgY292ZXJzIGEgYnVuY2ggb2YgZGlmZmVy ZW50IHRvcGljcywgc28gaXQgd291bGRu4oCZdCBiZSBjbGVhciB0byBtYW55IHJlYWRlcnMgd2hp Y2ggcGFydHMgYXJlIHJlbGV2YW50IGFuZCB3aGljaCBhcmVu4oCZdC48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyBUaGFua3MsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAx LjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PkZyb206PC9iPiBJZC1ldmVudCAmbHQ7aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyZndDsgPGI+ T24gQmVoYWxmIE9mDQo8L2I+QXR1bCBUdWxzaGliYWd3YWxlPGJyPg0KPGI+U2VudDo8L2I+IE1v bmRheSwgSnVseSAxMywgMjAyMCA5OjAxIEFNPGJyPg0KPGI+VG86PC9iPiBpZC1ldmVudEBpZXRm Lm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBbSWQtZXZlbnRdIFN1YmplY3QgUHJpbmNpcGFscyBh bmQgU3ViamVjdCBQcmluY2lwYWwgQWRtaW5pc3RyYXRpdmUgR3JvdXBpbmdzPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIGFsbCwmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IZXJlJ3MgYSBxdWljayBiYWNrZ3JvdW5kIGZv ciB0aGUgPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL3JpY2hhbm5hL3NlY2V2ZW50L3B1bGwv MSI+DQpwcm9wb3NhbDwvYT4gZm9yIGluY2x1ZGluZyBTdWJqZWN0IFByaW5jaXBhbHMgYW5kIFN1 YmplY3QgUHJpbmNpcGFsIEFkbWluaXN0cmF0aXZlIEdyb3VwaW5ncyBvciBTUEFHcyBpbiB0aGUg U3ViamVjdCBJZGVudGlmaWVycyBzcGVjLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Vc2Ugb2YgU3ViamVjdCBJZGVudGlmaWVycyBpbiBT aGFyZWQgU2lnbmFscyBhbmQgRXZlbnRzPC9iPjo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBTaGFyZWQgU2lnbmFscyBhbmQgRXZlbnRzIChT U0UpIHByb2ZpbGUgb2YgU0VUcyBzcGVjaWZpZXMgdGhhdCB0cmFuc21pdHRlcnMgYW5kIHJlY2Vp dmVycyBzZW5kIGFuZCByZWNlaXZlIFNFVHMgdGhhdCBjb250YWluIFN1YmplY3QgSWRlbnRpZmll cnMuIFRoZXNlIHN1YmplY3QgaWRlbnRpZmllcnMgaGF2ZSB0aGUgZm9ybWF0IHRoYXQgaXMgbm93 IGJlaW5nIGRpc2N1c3NlZCBhcyBhIHNlcGFyYXRlIHNwZWNpZmljYXRpb24NCiBoZXJlLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5UcmFu c21pdHRlcnMgYW5kIFJlY2VpdmVycyBpbiBTU0U8L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgU1NFIHByb2ZpbGUgZGVmaW5lcyB0cmFu c21pdHRlcnMgYW5kIHJlY2VpdmVycyBhcyBob3N0cyB0aGF0IG1hbmFnZSBzdHJlYW1zIGJldHdl ZW4gcGVlcnMuIFRoZSByZWNlaXZlciBhdXRoZW50aWNhdGVzIHRvIHRoZSB0cmFuc21pdHRlciB1 c2luZyBPQXV0aCwgcmVxdWlyaW5nIHRoZSB1c2Ugb2YgYSBzZWNyZXQgcGVyIHJlY2VpdmVyLiBJ biBhIG11bHRpLXRlbmFudGVkIGhvc3QgdGhhdCBoYW5kbGVzDQogaHVuZHJlZHMgb2YgdGhvdXNh bmRzIG9yIG1pbGxpb25zIG9mIGluZGVwZW5kZW50IHRlbmFudHMsIG1haW50YWluaW5nIHN1Y2gg YSBzZWNyZXQgcGVyIGluc3RhbmNlIG9mIGEgcmVjZWl2ZXIgaXMgY3VtYmVyc29tZS4gRnVydGhl cm1vcmUsIHNpbmNlIGEgdHJhbnNtaXR0ZXIgYW5kIGEgcmVjZWl2ZXIgaGFzIHRvIG1haW50YWlu IGEgc3RyZWFtIHBlciBwYWlyLCBjcmVhdGluZyBzdWNoIHBlci10ZW5hbnQgc3RyZWFtcyBjYW4g YWRkIHNpZ25pZmljYW50DQogaW1wbGVtZW50YXRpb24gb3ZlcmhlYWQuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPlNQQUdzPC9iPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlcmVmb3Jl LCB3ZSBuZWVkIGEgbm90aW9uIG9mIGEgZ3JvdXBpbmcgb2Ygc3ViamVjdHMgd2l0aGluIHRoZSBz YW1lIHRyYW5zbWl0dGVyIGFuZCByZWNlaXZlciB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIHZhcmlv dXMgYWRtaW5pc3RyYXRpdmUgZ3JvdXBpbmdzIHRoYXQgZXhpc3Qgd2l0aGluIGEgaG9zdC4gVGhl c2UgZ3JvdXBpbmdzIGNvdWxkIGluY2x1ZGUgdGVuYW50cywgb3JnYW5pemF0aW9uYWwgdW5pdHMN CiBvciB1c2VyIGdyb3Vwcy4gVGhpcyBncm91cGluZyBpcyBjYXB0dXJlZCBpbiB0aGUgbm90aW9u IG9mIGEgU1BBRy4gVGhlIHVuaXF1ZW5lc3Mgb2YgYSB1c2VyIGlkZW50aWZpZXIgKHN1YmplY3Qg aWRlbnRpZmllcikgbWF5IGFsc28gYmUgbGltaXRlZCB0byBhIFNQQUcuIEZvciBleGFtcGxlLCBp ZiBhIHJhbmRvbSB1bmlxdWUgSUQgcmVwcmVzZW50cyBhIHVzZXIsIHRoZW4gdGhhdCBJRCBtYXkg YmUgdW5pcXVlIHdpdGhpbiBhIFNQQUcgYW5kIG5vdA0KIHVuaXZlcnNhbGx5IGFjcm9zcyBhIHRy YW5zbWl0dGVyIG9yIHJlY2VpdmVyLiBUaGlzIGlzIGJlY2F1c2UgZWFjaCB0cmFuc21pdHRlciBh bmQgcmVjZWl2ZXIgbWF5IGhhdmUgbXVsdGlwbGUgY29ubmVjdGlvbnMgdG8gb3RoZXIgdHJhbnNt aXR0ZXJzIGFuZCByZWNlaXZlcnMsIGFuZCBlbnN1cmluZyB1bmlxdWVuZXNzIGFjcm9zcyBhbGwg c3VjaCBwZWVycyBpcyBwcm9iYWJseSBhbiBpbnRyYWN0YWJsZSBwcm9ibGVtLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5TdWJqZWN0IFBy aW5jaXBhbHM8L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5XaGlsZSB3aGF0IGlzIHJlcHJlc2VudGVkIHdpdGhpbiBhIHN1YmplY3QgaWRlbnRp ZmllciBtYXkgYmUgb25seSBhbiBhc3BlY3Qgb2YgdGhlIG1hbmFnZW1lbnQgZW50aXR5LCB0aGUg YWRtaW5pc3RyYXRpdmUgZ3JvdXBpbmcgaXMgYWJvdXQgdGhlIG1hbmFnZW1lbnQgZW50aXR5IGl0 c2VsZi4gVGhpcyBjb3VsZCBiZSB0aGUgdXNlciwgZGV2aWNlIG9yIG90aGVyIHByaW5jaXBhbCB0 aGF0IHRoZSBzdWJqZWN0DQogaWRlbnRpZmllciByZXByZXNlbnRzLiBUaGVyZWZvcmUsIGFuIGFi c3RyYWN0IG5vdGlvbiBvZiBhIFN1YmplY3QgUHJpbmNpcGFsIGlzIGFsc28gcmVxdWlyZWQgaW4g b3JkZXIgc3BlY2lmeSB3aGF0IHRoZSBncm91cGluZyB3aXRoaW4gYSBTUEFHIGlzIGFib3V0Ljxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUg YWJvdmUgaXMgY2FwdHVyZWQgaW4gdGhlICZxdW90O1N1YmplY3QgUHJpbmNpcGFsJnF1b3Q7IGFu ZCAmcXVvdDtTUEFHJnF1b3Q7IHNlY3Rpb25zIHdpdGhpbiB0aGUgcHJvcG9zZWQNCjxhIGhyZWY9 Imh0dHBzOi8vZ2l0aHViLmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzEiPlBSPC9hPi48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhbmtz LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXR1 bDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_CH2PR00MB0678FC47430BF56441D1F202F5600CH2PR00MB0678namp_-- From nobody Mon Jul 13 12:35:10 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A2053A03F3 for ; Mon, 13 Jul 2020 12:35:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Oyu0v8NLeGm0 for ; Mon, 13 Jul 2020 12:35:06 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 444003A03F2 for ; Mon, 13 Jul 2020 12:34:30 -0700 (PDT) Received: from [192.168.1.7] (static-71-174-62-56.bstnma.fios.verizon.net [71.174.62.56]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 06DJYRR5018235 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2020 15:34:27 -0400 From: Justin Richer Message-Id: <3E0E61F6-0AB1-490C-B46D-F32D1E95B163@mit.edu> Content-Type: multipart/alternative; boundary="Apple-Mail=_17EE117A-3B45-44D8-93B4-F581838B62D9" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Mon, 13 Jul 2020 15:34:27 -0400 In-Reply-To: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> Cc: Yaron Sheffer , "id-event@ietf.org" To: "Richard Backman, Annabelle" References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [Id-event] Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 19:35:09 -0000 --Apple-Mail=_17EE117A-3B45-44D8-93B4-F581838B62D9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 +1 to finishing it and I=E2=80=99ll add my review to the pile this week. = Apologies for the delays in doing so. =E2=80=94 Justin > On Jul 2, 2020, at 6:59 PM, Richard Backman, Annabelle = wrote: >=20 > I=E2=80=99d like to hear from the working group on whether or not = there is interest in completing the Subject Identifiers draft within = secevents. This work has more or less been put on hiatus given the = chairs=E2=80=99 previous decision not to continue with it within the = working group, but it remains a dependency for other work, and a number = of people within the working group have expressed interest and support = for it previously. If there is support within the working group for = resuming and completing Subject Identifiers, then it would seem = reasonable to me to do so within secevents. > =20 > =E2=80=93 > Annabelle Backman (she/her) > AWS Identity > https://aws.amazon.com/identity/ > =20 > =20 > From: Id-event > on behalf of Yaron Sheffer = > > Date: Tuesday, June 30, 2020 at 2:06 AM > To: "id-event@ietf.org " > > Subject: [EXTERNAL] [Id-event] Closing the SecEvent working group > =20 > CAUTION: This email originated from outside of the organization. Do = not click links or open attachments unless you can confirm the sender = and know the content is safe. > =20 > Dear WG participants, > =20 > As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP = delivery specs, have both been approved for publication as RFCs. > =20 > Since the group has now completed its mission, we propose to close it = down. Unless there are objections (accompanied by credible work items) = within a week, we will ask the AD to do just that. Even with the WG shut = down, the mailing list will remain open for relevant discussions. > =20 > We would like to thank the authors of the Push and Poll soon-to-be = RFCs, Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to = the many other working group members who contributed to these quality = documents. > =20 > Regards, > =20 > Dick and Yaron > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_17EE117A-3B45-44D8-93B4-F581838B62D9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 +1 = to finishing it and I=E2=80=99ll add my review to the pile this week. = Apologies for the delays in doing so.

 =E2=80=94 Justin

On Jul 2, 2020, at 6:59 PM, Richard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org> = wrote:

I=E2=80=99d like to hear from the = working group on whether or not there is interest in completing the = Subject Identifiers draft  within secevents. This work has more or = less been put on hiatus given the chairs=E2=80=99 previous decision not = to continue with it within the working group, but it remains a = dependency for other work, and a number of people within the working = group have expressed interest and support for it previously. If there is = support within the working group for resuming and completing Subject = Identifiers, then it would seem reasonable to me to do so within = secevents.
 
=E2=80=93
Annabelle Backman (she/her)
AWS Identity
https://aws.amazon.com/identity/
 
 
From: Id-event <id-event-bounces@ietf.org> on behalf of Yaron Sheffer = <yaronf.ietf@gmail.com>
Date: Tuesday, June 30, 2020 = at 2:06 AM
To: "id-event@ietf.org" = <id-event@ietf.org>
Subject: [EXTERNAL] [Id-event] = Closing the SecEvent working group
 
CAUTION: This email originated from outside of = the organization. Do not click links or open attachments unless you can = confirm the sender and know the content is safe.
 
Dear = WG participants,
 
As you=E2=80=99ve all seen, our last two deliverables, the = SET HTTP delivery specs, have both been approved for publication as = RFCs.
 
Since the group has now completed = its mission, we propose to close it down. Unless there are objections = (accompanied by credible work items) within a week, we will ask the AD = to do just that. Even with the WG shut down, the mailing list will = remain open for relevant discussions.
 
We would like to thank the authors = of the Push and Poll soon-to-be RFCs, Annabelle, Mike, Marius, Morteza = and Anthony. Many thanks also to the many other working group members = who contributed to these quality documents.
 
Regards,
 
          &nb= sp;     Dick and Yaron
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
=

= --Apple-Mail=_17EE117A-3B45-44D8-93B4-F581838B62D9-- From nobody Mon Jul 13 12:42:41 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C78B43A07EE for ; Mon, 13 Jul 2020 12:42:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.619 X-Spam-Level: X-Spam-Status: No, score=-9.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qJO4Z5mmjf-x for ; Mon, 13 Jul 2020 12:42:31 -0700 (PDT) Received: from smtp-fw-6002.amazon.com (smtp-fw-6002.amazon.com [52.95.49.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 232B83A07ED for ; Mon, 13 Jul 2020 12:42:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1594669347; x=1626205347; h=from:to:date:message-id:references:in-reply-to: mime-version:subject; bh=AZSPh/QHxTjTP7z7WmCO3nzRnLy2P3eF+fXD9vdRSGk=; b=XAkpBhAENeH1L+eh2Lvl5NvAYLBRH2dolFoZwTi8TrAolHboaWMLK/9r xMq4KdH9Bf8nuSaPWa8dz5X7H8TsJGUJXdGnxcjfuDH2J4r+55cRaQkFb qYVFl6f7hvRUfR3oRjX7dq3Yljne6t7/f94InyBrmcj/0NKhB7CTs2QFj g=; IronPort-SDR: rsjEi289iHj39Ixa0bABtAcpLRYkwlw2i0S0H8Oaj+u57z+B3DqKHXNuUXVFQ1vJiBCI6DPdwm IEKA9diRQu0g== X-IronPort-AV: E=Sophos; i="5.75,348,1589241600"; d="scan'208,217"; a="41646390" Thread-Topic: [Id-event] Feedback: draft-ietf-secevent-subject-identifiers-05 (Tim Cappalli) Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-1e-97fdccfd.us-east-1.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6002.iad6.amazon.com with ESMTP; 13 Jul 2020 19:42:26 +0000 Received: from EX13MTAUWC001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan2.iad.amazon.com [10.40.159.162]) by email-inbound-relay-1e-97fdccfd.us-east-1.amazon.com (Postfix) with ESMTPS id 292C4A17F0; Mon, 13 Jul 2020 19:42:24 +0000 (UTC) Received: from EX13D11UWC001.ant.amazon.com (10.43.162.151) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 13 Jul 2020 19:42:24 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC001.ant.amazon.com (10.43.162.151) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 13 Jul 2020 19:42:23 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Mon, 13 Jul 2020 19:42:24 +0000 From: "Richard Backman, Annabelle" To: Tim Cappalli , "id-event@ietf.org" Thread-Index: AQHWWTwM2wdMqVFhB0+kNKxypDuLo6kFc6SA Date: Mon, 13 Jul 2020 19:42:24 +0000 Message-ID: <2DBA1C53-4CB8-4D6B-A928-68FA718E3ECB@amazon.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.100] Content-Type: multipart/alternative; boundary="_000_2DBA1C534CB84D6BA92868FA718E3ECBamazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Feedback: draft-ietf-secevent-subject-identifiers-05 (Tim Cappalli) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 19:42:39 -0000 --_000_2DBA1C534CB84D6BA92868FA718E3ECBamazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aGUgcmV2aWV3LCBUaW0hIFJlcGxpZXMgYXJlIFtyaWNoYW5uYV0gaW5saW5l IFsvcmljaGFubmFdLg0KDQrigJMNCkFubmFiZWxsZSBCYWNrbWFuIChzaGUvaGVyKQ0KQVdTIElk ZW50aXR5DQpodHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5Lw0KDQoNCkZyb206IElkLWV2 ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgVGltIENhcHBhbGxp IDxUaW0uQ2FwcGFsbGk9NDBtaWNyb3NvZnQuY29tQGRtYXJjLmlldGYub3JnPg0KRGF0ZTogTW9u ZGF5LCBKdWx5IDEzLCAyMDIwIGF0IDExOjExIEFNDQpUbzogImlkLWV2ZW50QGlldGYub3JnIiA8 aWQtZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFtJZC1ldmVudF0gRmVlZGJh Y2s6IGRyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVjdC1pZGVudGlmaWVycy0wNSAoVGltIENhcHBh bGxpKQ0KDQoNCkNBVVRJT046IFRoaXMgZW1haWwgb3JpZ2luYXRlZCBmcm9tIG91dHNpZGUgb2Yg dGhlIG9yZ2FuaXphdGlvbi4gRG8gbm90IGNsaWNrIGxpbmtzIG9yIG9wZW4gYXR0YWNobWVudHMg dW5sZXNzIHlvdSBjYW4gY29uZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlz IHNhZmUuDQoNCg0KU29ycnkgZm9yIHRoZSBkZWxheSwgSSBzZW50IHRoaXMgbGFzdCB3ZWVrIGJ1 dCB0byB0aGUgLWJvdW5jZXMgYWRkcmVzcyBieSBhY2NpZGVudC4NCg0KSGVyZeKAmXMgbXkgZmVl ZGJhY2s6DQoNCjMuDQogICAgVGhlcmUgYXJlIGRlZmluaXRlbHkgdXNlIGNhc2VzIGZvciBsb2Nh bGx5IHNpZ25pZmljYW50IHN1YmplY3QgaWRlbnRpZmllciB0eXBlcyBiZXR3ZWVuIHR3byBwYXJ0 aWVzIChleGFtcGxlOiBmaXJzdCBwYXJ0eSBwbGF0Zm9ybXMpLiBUaGUgY3VycmVudCB0ZXh0IG1h bmRhdGVzIHJlZ2lzdHJhdGlvbiB3aXRoIElBTkEuIFRoZXJlIHNob3VsZCBiZSBmbGV4aWJpbGl0 eSB0byB1c2UgaW50ZXJuYWwvcHJpdmF0ZS9sb2NhbCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZXMu DQoNCiAgICAgICAgICAgICAgICBbcmljaGFubmFdDQpBZ3JlZWQuIFRoaXMgaGFzIGJlZW4gYnJv dWdodCB1cCBhIGZldyB0aW1lcyBub3csIHNvIHRoZXJl4oCZcyBwcmV0dHkgY2xlYXJseSBhIG5l ZWQgZm9yIGl0LiBXZSBjYW4gYWxsb3cgZm9yIHVucmVnaXN0ZXJlZCBuYW1lcyBzaW1pbGFyIHRv IGhvdyBKV1QgYWxsb3dzIGZvciB1bnJlZ2lzdGVyZWQgY2xhaW1zLg0KWy9yaWNoYW5uYV0NCg0K My4xDQoNCiAgICBJZiB0aGlzIGlkZW50aWZpZXIgdHlwZSBpcyBnb2luZyB0byBiZSByZXN0cmlj dGVkIHRvIHVzZXIgYWNjb3VudHMgKGJ5IFJGQzc1NjUpLCB0aGVuIEkgdGhpbmsgaXQgc2hvdWxk IGJlIGNhbGxlZCB0aGUgIlVzZXIgQWNjb3VudCBTdWJqZWN0IElkZW50aWZpZXIgVHlwZSIgd2l0 aCBhICJzdWJqZWN0X3R5cGUiIHZhbHVlIG9mICJ1c2VyLWFjY291bnQiLiBEZXZpY2VzIGNhbiBh bHNvIGhhdmUgYWNjb3VudHMuDQoNCiAgICAgICAgICAgICAgICBbcmljaGFubmFdDQogICAgICAg ICAgICAgICAgSSBkb27igJl0IHNlZSBhIHJlYXNvbiB3aHkgdGhpcyBuZWVkcyB0byBiZSByZXN0 cmljdGVkIHRvIHVzZXIgYWNjb3VudHMuIFdlIHNob3VsZCBqdXN0IHN0cmlrZSDigJx1c2Vy4oCd IGZyb20gdGhlIGZpcnN0IHNlbnRlbmNlLg0KWy9yaWNoYW5uYV0NCg0KDQo3LjEuMQ0KICAgIFNo b3VsZCB0aGUgY29udHJvbGxlciBiZSB1cGRhdGVkIHRvICJPcGVuSUQgRm91bmRhdGlvbiBTaGFy ZWQgU2lnbmFscyBhbmQgRXZlbnRzIFdvcmtpbmcgR3JvdXAiIHRvIHJlZmxlY3QgdGhlIG5ldyBu YW1lIG9mIHRoZSBncm91cD8NCg0KICAgICAgICAgICAgICAgIFtyaWNoYW5uYV0NCiAgICAgICAg ICAgICAgICBUaGlzIG5ldmVyIGdvdCBlZGl0ZWQgd2hlbiB3ZSBtb3ZlZCB0aGlzIHdvcmsgZnJv bSBPSURGIHRvIGhlcmUuIFNob3VsZCBiZSB1cGRhdGVkIHRvIElFVEYuDQpbL3JpY2hhbm5hXQ0K DQo3LjEuMi4xDQogICAgU2VlIGZlZWRiYWNrIGZvciAzLjENCg0KDQpUaW0NCg0K --_000_2DBA1C534CB84D6BA92868FA718E3ECBamazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <9AA6669A2FF1FE4892810559E655B42F@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiTVMgTWluY2hvIjsNCglwYW5vc2UtMToyIDIgNiA5IDQgMiA1IDgg MyA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3Nl LTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGli cmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250 LWZhbWlseToiXEBNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0K LyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5N c29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1z aXplOjEyLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVt YWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjND MSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGFua3MgZm9yIHRo ZSByZXZpZXcsIFRpbSEgUmVwbGllcyBhcmUNCjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5b cmljaGFubmFdIGlubGluZSBbL3JpY2hhbm5hXTwvc3Bhbj4uPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj7i gJM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFubmFiZWxsZSBCYWNrbWFu IChzaGUvaGVyKTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QVdTIElkZW50 aXR5PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBocmVmPSJodHRwczov L2F3cy5hbWF6b24uY29tL2lkZW50aXR5LyI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwNTYzQzEiPmh0 dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PGI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5Gcm9tOiA8L3Nw YW4+DQo8L2I+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5JZC1ldmVudCAmbHQ7aWQtZXZlbnQt Ym91bmNlc0BpZXRmLm9yZyZndDsgb24gYmVoYWxmIG9mIFRpbSBDYXBwYWxsaSAmbHQ7VGltLkNh cHBhbGxpPTQwbWljcm9zb2Z0LmNvbUBkbWFyYy5pZXRmLm9yZyZndDs8YnI+DQo8Yj5EYXRlOiA8 L2I+TW9uZGF5LCBKdWx5IDEzLCAyMDIwIGF0IDExOjExIEFNPGJyPg0KPGI+VG86IDwvYj4mcXVv dDtpZC1ldmVudEBpZXRmLm9yZyZxdW90OyAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0K PGI+U3ViamVjdDogPC9iPltFWFRFUk5BTF0gW0lkLWV2ZW50XSBGZWVkYmFjazogZHJhZnQtaWV0 Zi1zZWNldmVudC1zdWJqZWN0LWlkZW50aWZpZXJzLTA1IChUaW0gQ2FwcGFsbGkpPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFi bGUiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0aD0iNjIy IiBzdHlsZT0id2lkdGg6NDY2LjVwdDttYXJnaW4tbGVmdDouNWluO2JvcmRlci1jb2xsYXBzZTpj b2xsYXBzZSI+DQo8dGJvZHk+DQo8dHIgc3R5bGU9ImhlaWdodDoxNS4yNXB0Ij4NCjx0ZCB3aWR0 aD0iNjIyIiB2YWxpZ249InRvcCIgc3R5bGU9IndpZHRoOjQ2Ni41cHQ7Ym9yZGVyOnNvbGlkICNF RDdEMzEgMS41cHQ7cGFkZGluZzowaW4gNS40cHQgMGluIDUuNHB0O2hlaWdodDoxNS4yNXB0Ij4N CjxwPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkZGOTkiPkNBVVRJT048L3NwYW4+ PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQ6I0ZGRkY5OSI+OiBU aGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRpb24uIERv IG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcw0KIHlvdSBjYW4gY29u ZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJs YWNrIj5Tb3JyeSBmb3IgdGhlIGRlbGF5LCBJIHNlbnQgdGhpcyBsYXN0IHdlZWsgYnV0IHRvIHRo ZSAtYm91bmNlcyBhZGRyZXNzIGJ5IGFjY2lkZW50Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+SGVyZeKAmXMgbXkgZmVlZGJhY2s6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4zLjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsg VGhlcmUgYXJlIGRlZmluaXRlbHkgdXNlIGNhc2VzIGZvciBsb2NhbGx5IHNpZ25pZmljYW50IHN1 YmplY3QgaWRlbnRpZmllciB0eXBlcyBiZXR3ZWVuIHR3byBwYXJ0aWVzIChleGFtcGxlOiBmaXJz dCBwYXJ0eSBwbGF0Zm9ybXMpLg0KIFRoZSBjdXJyZW50IHRleHQgbWFuZGF0ZXMgcmVnaXN0cmF0 aW9uIHdpdGggSUFOQS4gVGhlcmUgc2hvdWxkIGJlIGZsZXhpYmlsaXR5IHRvIHVzZSBpbnRlcm5h bC9wcml2YXRlL2xvY2FsIHN1YmplY3QgaWRlbnRpZmllciB0eXBlcy48L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4mbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPg0K W3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Y29sb3I6I0VCMzlGNiI+QWdyZWVkLiBUaGlzIGhhcyBiZWVuIGJyb3VnaHQgdXAgYSBmZXcg dGltZXMgbm93LCBzbyB0aGVyZeKAmXMgcHJldHR5IGNsZWFybHkgYSBuZWVkIGZvciBpdC4gV2Ug Y2FuIGFsbG93IGZvciB1bnJlZ2lzdGVyZWQgbmFtZXMgc2ltaWxhciB0byBob3cgSldUIGFsbG93 cyBmb3IgdW5yZWdpc3RlcmVkDQogY2xhaW1zLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtjb2xvcjojRUIzOUY2Ij5bL3JpY2hhbm5hXTwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4zLjEmbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyZuYnNwOyBJZiB0aGlz IGlkZW50aWZpZXIgdHlwZSBpcyBnb2luZyB0byBiZSByZXN0cmljdGVkIHRvIHVzZXIgYWNjb3Vu dHMgKGJ5IFJGQzc1NjUpLCB0aGVuIEkgdGhpbmsgaXQgc2hvdWxkIGJlIGNhbGxlZCB0aGUgJnF1 b3Q7VXNlciBBY2NvdW50IFN1YmplY3QNCiBJZGVudGlmaWVyIFR5cGUmcXVvdDsgd2l0aCBhICZx dW90O3N1YmplY3RfdHlwZSZxdW90OyB2YWx1ZSBvZiAmcXVvdDt1c2VyLWFjY291bnQmcXVvdDsu IERldmljZXMgY2FuIGFsc28gaGF2ZSBhY2NvdW50cy48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZiI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgPHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPg0KW3JpY2hhbm5h XTxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBJIGRvbuKAmXQgc2VlIGEg cmVhc29uIHdoeSB0aGlzIG5lZWRzIHRvIGJlIHJlc3RyaWN0ZWQgdG8gdXNlciBhY2NvdW50cy4g V2Ugc2hvdWxkIGp1c3Qgc3RyaWtlIOKAnHVzZXLigJ0gZnJvbSB0aGUgZmlyc3Qgc2VudGVuY2Uu PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJ0ZXh0LWluZGVudDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjoj RUIzOUY2Ij5bL3JpY2hhbm5hXTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjpibGFjayI+Ny4xLjE8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IFNob3VsZCB0aGUgY29udHJvbGxlciBiZSB1cGRhdGVk IHRvICZxdW90O09wZW5JRCBGb3VuZGF0aW9uIFNoYXJlZCBTaWduYWxzIGFuZCBFdmVudHMgV29y a2luZyBHcm91cCZxdW90OyB0byByZWZsZWN0IHRoZSBuZXcgbmFtZSBvZiB0aGUgZ3JvdXA/PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IDxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij4NCltyaWNoYW5uYV08bzpwPjwvbzpwPjwv c3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Y29sb3I6I0VCMzlGNiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IFRoaXMgbmV2ZXIgZ290IGVkaXRlZCB3aGVuIHdlIG1vdmVkIHRoaXMgd29yayBmcm9tIE9J REYgdG8gaGVyZS4gU2hvdWxkIGJlIHVwZGF0ZWQgdG8gSUVURi48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0idGV4dC1pbmRlbnQ6LjVpbiI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6I0VCMzlGNiI+Wy9yaWNoYW5uYV08L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+Ny4xLjIuMTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mbmJzcDsm bmJzcDsmbmJzcDsgU2VlIGZlZWRiYWNrIGZvciAzLjE8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PGI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMDA3OEQ0Ij4mbmJzcDs8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzAwNzhENCI+Jm5ic3A7PC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOmJsYWNrIj5UaW08L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_2DBA1C534CB84D6BA92868FA718E3ECBamazoncom_-- From nobody Mon Jul 13 13:07:34 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 350B43A00B3 for ; Mon, 13 Jul 2020 13:07:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.618 X-Spam-Level: X-Spam-Status: No, score=-9.618 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yWK8D3vw6y-Y for ; Mon, 13 Jul 2020 13:07:31 -0700 (PDT) Received: from smtp-fw-6002.amazon.com (smtp-fw-6002.amazon.com [52.95.49.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2B2F3A00B0 for ; Mon, 13 Jul 2020 13:07:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1594670852; x=1626206852; h=from:to:date:message-id:references:in-reply-to: mime-version:subject; bh=QugtzelOKQjAQKKLyPnMiBn0/cmN+cZK3/9SlDlVq68=; b=aOoFpVnJLJ1WKFmcdxLOOewdpcoqc0PwEovwghDDhn8q0GO3T1us13ZI TIYISPD7y8SuK741cJy3CbX1CX+mtahYDvEobBcEfmtLExpXdYcAWpyeJ uU0MraWQzhpbSmCa7PmGcUx8gVeaMCur88PQgk+sTZvxT52jAindXxTHN 0=; IronPort-SDR: U6O3u9w48VGrpwQVAvduiuShuEOv2S/Jn9pdqtn2qYzWaSEyqjbW+8N9916eRY630Ynt5Mw1xR MrGf6J4pjlYA== X-IronPort-AV: E=Sophos; i="5.75,348,1589241600"; d="scan'208,217"; a="41649997" Thread-Topic: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-2c-2225282c.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6002.iad6.amazon.com with ESMTP; 13 Jul 2020 20:07:30 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan3.pdx.amazon.com [10.170.41.166]) by email-inbound-relay-2c-2225282c.us-west-2.amazon.com (Postfix) with ESMTPS id BBBB0A2685; Mon, 13 Jul 2020 20:07:28 +0000 (UTC) Received: from EX13D11UWC002.ant.amazon.com (10.43.162.174) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 13 Jul 2020 20:07:28 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC002.ant.amazon.com (10.43.162.174) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 13 Jul 2020 20:07:27 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Mon, 13 Jul 2020 20:07:28 +0000 From: "Richard Backman, Annabelle" To: Dave Tonge , SecEvent Thread-Index: AQHWWNSoRFfXO31MAU+CdcDiKDWdqqkFe3OA Date: Mon, 13 Jul 2020 20:07:27 +0000 Message-ID: <60181911-37AC-4038-8DB0-843BDB3FA59A@amazon.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.162.140] Content-Type: multipart/alternative; boundary="_000_6018191137AC40388DB0843BDB3FA59Aamazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 20:07:33 -0000 --_000_6018191137AC40388DB0843BDB3FA59Aamazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aGUgcmV2aWV3LCBEYXZlISBSZXBsaWVzIGFyZSBbcmljaGFubmFdIGlubGlu ZSBbL3JpY2hhbm5hXS4NCg0K4oCTDQpBbm5hYmVsbGUgQmFja21hbiAoc2hlL2hlcikNCkFXUyBJ ZGVudGl0eQ0KaHR0cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS8NCg0KDQpGcm9tOiBJZC1l dmVudCA8aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIERhdmUgVG9uZ2Ug PGRhdmUudG9uZ2VAbW9tZW50dW1mdC5jby51az4NCkRhdGU6IFN1bmRheSwgSnVseSAxMiwgMjAy MCBhdCAxMDoxNSBQTQ0KVG86IFNlY0V2ZW50IDxpZC1ldmVudEBpZXRmLm9yZz4NClN1YmplY3Q6 IFtFWFRFUk5BTF0gW0lkLWV2ZW50XSBSZXZpZXcgb2YgZHJhZnQtaWV0Zi1zZWNldmVudC1zdWJq ZWN0LWlkZW50aWZpZXJzLTA1DQoNCg0KQ0FVVElPTjogVGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZy b20gb3V0c2lkZSBvZiB0aGUgb3JnYW5pemF0aW9uLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Igb3Bl biBhdHRhY2htZW50cyB1bmxlc3MgeW91IGNhbiBjb25maXJtIHRoZSBzZW5kZXIgYW5kIGtub3cg dGhlIGNvbnRlbnQgaXMgc2FmZS4NCg0KDQpIaSwNCg0KSSdtIHJlYWxseSBrZWVuIHRvIHNlZSB0 aGlzIGRyYWZ0IHByb2dyZXNzIGFuZCBzbyBoYXZlIHJldmlld2VkIHRoZSBjdXJyZW50IHRleHQu DQoNCkludHJvZHVjdGlvbg0KSSB0aGluayBpdCB3b3VsZCBiZSBnb29kIHRvIGFkZCBzb21lIHRl eHQgdG8gbWFrZSBpdCBjbGVhciB0aGF0IHdoaWxlIHRoZSBpbml0aWFsIHVzZSBjYXNlIGZvIHRo aXMgc3BlYyBpcyBmb3IgU0VUcywgdGhlcmUgaXMgbm90aGluZyBzdG9wcGluZyBpdCBiZWluZyB1 c2VkIGluIG90aGVyIGNvbnRleHRzIHdoZXJlIHBhcnRpZXMgbmVlZCB0byBjb21tdW5pY2F0ZSB0 aGUgaWRlbnRpdHkgb2YgYSBzdWJqZWN0LkZvciBleGFtcGxlIHdlIHdlcmUgbG9va2luZyBhdCB1 c2luZyB0aGlzIHNwZWMgdG8gaGF2ZSBzdHJ1Y3R1cmVkIGEgYGxvZ2luX2hpbnRgIG9yIGBsb2dp bl9oaW50X3Rva2VuYCBpbiBPSURDIG9yIENJQkEgZmxvd3MuDQoNCltyaWNoYW5uYV0NCkdvb2Qg c3VnZ2VzdGlvbi4gSSB0aGluayBhZGRpbmcgYSBjb3VwbGUgZXhhbXBsZXMgb2YgU3ViamVjdCBJ ZGVudGlmaWVyIHVzYWdlIHdvdWxkIGhlbHAgdG9vLg0KWy9yaWNoYW5uYV0NCg0KMy41LiAgQWxp YXNlcyBTdWJqZWN0IElkZW50aWZpZXIgVHlwZQ0KSSBkZWZpbml0ZWx5IHNlZSB0aGlzIGFzIGEg dXNlZnVsIGZlYXR1cmUsIGhvd2V2ZXIgd291bGQgaXQgbm90IGJlIHNpbXBsZXIgdG8gZGVmaW5l IGBzdWJfaWRgIGFzIGFuIGFycmF5LCByYXRoZXIgdGhhbiBoYXZlIGEgc3BlY2lmaWMgImFsaWFz IiB0eXBlPw0KDQpbcmljaGFubmFdDQpUaHJlZSByZWFzb25zIGZvciDigJxhbGlhc+KAnSBhcyBh IGZvcm1hbGx5IGRlZmluZWQgdHlwZToNCg0KICAxLiAgQW4gYXJyYXkgc3ludGF4IGZvciDigJxz dWJfaWTigJ0gd291bGQgYWxsb3dzIHVzIHRvIHNwZWNpZnkgbXVsdGlwbGUgU3ViamVjdCBJZGVu dGlmaWVycywgYnV0IGl0IHdvdWxkbuKAmXQgZGVmaW5lIHRoZSBzZW1hbnRpY3Mgb2YgdGhhdCAo aS5lLiwgdGhleSBhbGwgcmVmZXIgdG8gdGhlIHNhbWUgc3ViamVjdCkuIFdlIGNvdWxkIGRlZmlu ZSBzZW1hbnRpY3MsIGJ1dCB0aGF0IHdvdWxkIG9ubHkgY292ZXIg4oCcc3ViX2lk4oCdLCBhbmQg d291bGQgaGF2ZSB0byBiZSByZXBlYXRlZCBieSBhbnkgc3BlYyB0aGF0IHdhbnRzIHRvIHVzZSBT dWJqZWN0IElkZW50aWZpZXJzIGVsc2V3aGVyZS4NCg0KICAyLiAgQW4gYXJyYXkgc3ludGF4IGFs c28gZm9yY2VzIGV2ZXJ5b25lIHRvIGRlYWwgd2l0aCB0aGUgYWRkaXRpb25hbCBjb21wbGV4aXR5 IG9mIHdoYXQgaXMgbGlrZWx5IHRvIGJlIGEgZmFpcmx5IG5pY2hlIHVzZSBjYXNlLiBJZiB3ZSBk ZWZpbmUg4oCcc3ViX2lk4oCdIGFzIGFsd2F5cyBiZWluZyBhbiBhcnJheSwgd2XigJlsbCBsaWtl bHkgZW5kIHVwIHdpdGggYSBidW5jaCBvZiBub25jb25mb3JtYW50IGltcGxlbWVudGF0aW9ucyB0 aGF0IHNldCBpdCB0byBhIHNpbmdsZSBTdWJqZWN0IElkZW50aWZpZXIgb2JqZWN0IGJlY2F1c2Ug dGhhdOKAmXMgdGhlaXIgdXNlIGNhc2UuIElmIHdlIG1ha2UgaXQgYW4gb2JqZWN0IG9yIGFycmF5 LCB3ZeKAmXJlIGluIHRoZSB3b3JsZCBvZiBwb2x5bW9ycGhpYyBKU09OIHdoaWNoIG1ha2VzIHBh cnNpbmcgYSBsb3QgbW9yZSBjb21wbGV4Lg0KDQogIDMuICBUaGUg4oCcYWxpYXPigJ0gdHlwZSBs ZWF2ZXMgb3BlbiB0aGUgZG9vciBmb3Igb3RoZXIgd2F5cyB0byBpbmNsdWRlIG11bHRpcGxlIFN1 YmplY3QgSWRlbnRpZmllcnMgdGhhdCBoYXZlIGRpZmZlcmVudCBzZW1hbnRpY3MuIEZvciBleGFt cGxlLCBpbiB0aGUgZnV0dXJlIHNvbWVvbmUgbWF5IGZpbmQgaXQgdXNlZnVsIHRvIGRlZmluZSBh IOKAnGNvbGxlY3Rpb27igJ0gdHlwZSB0aGF0IGNvbnRhaW5zIGEgY29sbGVjdGlvbiBvZiBTdWJq ZWN0IElkZW50aWZpZXJzIHJlZmVycmluZyB0byBkaWZmZXJlbnQgZW50aXRpZXMuDQpbL3JpY2hh bm5hXQ0KDQpQcml2YWN5IENvbnNpZGVyYXRpb25zDQpHaXZlbiB0aGF0IHN1YmplY3QgaWRlbnRp ZmllcnMgd2lsbCBvZnRlbiBiZSBwZXJzb25hbGx5IGlkZW50aWZpYWJsZSBpbmZvcm1hdGlvbiwg SSB0aGluayB0aGF0IHRoZXJlIHNob3VsZCBiZSBhIHNlbnRlbmNlIHN0YXRpbmcgdGhhdCBpZiB0 aGlzIHNjaGVtYSBpcyB1c2VkIGluIGFueSBmcm9udC1jaGFubmVsIGNvbW11bmljYXRpb24sIHRo ZW4gdGhlIHRva2VuIGluIHdoaWNoIHRoZSBpZGVudGlmaWVycyBhcmUgZW1iZWRkZWQgc2hvdWxk IGJlIGVuY3J5cHRlZC4NCg0KW3JpY2hhbm5hXQ0KVGhpcyBoYXMgYmVlbiBjYWxsZWQgb3V0IGEg ZmV3IHRpbWVzIG5vdzsgaXTigJlzIGNsZWFyIHRoZXJlIGlzIGEgbmVlZCBmb3IgdGhpcyBzcGVj IHRvIGV4cGxpY2l0bHkgY2FsbCBvdXQgdGhlc2UgY29uY2VybnMsIGV2ZW4gaWYgdGhlIGd1aWRh bmNlIGlzIGp1c3Qg4oCcZml4IHRoaXMgYXQgYW5vdGhlciBsZXZlbC7igJ0NClsvcmljaGFubmFd DQoNClRoYW5rcw0KDQotLQ0KRGF2ZSBUb25nZQ0KDQoNCg0KTW9uZXlodWIgRW50ZXJwcmlzZSBp cyBhIHRyYWRpbmcgc3R5bGUgb2YgTW9uZXlodWIgRmluYW5jaWFsIFRlY2hub2xvZ3kgTGltaXRl ZCB3aGljaCBpcyBhdXRob3Jpc2VkIGFuZCByZWd1bGF0ZWQgYnkgdGhlIEZpbmFuY2lhbCBDb25k dWN0IEF1dGhvcml0eSAoIkZDQSIpLiBNb25leWh1YiBGaW5hbmNpYWwgVGVjaG5vbG9neSBpcyBl bnRlcmVkIG9uIHRoZSBGaW5hbmNpYWwgU2VydmljZXMgUmVnaXN0ZXIgKEZSTiA4MDkzNjApIGF0 IGh0dHBzOi8vcmVnaXN0ZXIuZmNhLm9yZy51ay8uIE1vbmV5aHViIEZpbmFuY2lhbCBUZWNobm9s b2d5IGlzIHJlZ2lzdGVyZWQgaW4gRW5nbGFuZCAmIFdhbGVzLCBjb21wYW55IHJlZ2lzdHJhdGlv biBudW1iZXIgMDY5MDk3NzIuIE1vbmV5aHViIEZpbmFuY2lhbCBUZWNobm9sb2d5IExpbWl0ZWQg MjAyMCDCqSBNb25leWh1YiBFbnRlcnByaXNlLCBSZWd1cyBCdWlsZGluZywgVGVtcGxlIFF1YXks IDEgRnJpYXJ5LCBCcmlzdG9sLCBCUzEgNkVBLg0KDQpESVNDTEFJTUVSOiBUaGlzIGVtYWlsIChp bmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzKSBpcyBzdWJqZWN0IHRvIGNvcHlyaWdodCwgYW5kIHRo ZSBpbmZvcm1hdGlvbiBpbiBpdCBpcyBjb25maWRlbnRpYWwuIFVzZSBvZiB0aGlzIGVtYWlsIG9y IG9mIGFueSBpbmZvcm1hdGlvbiBpbiBpdCBvdGhlciB0aGFuIGJ5IHRoZSBhZGRyZXNzZWUgaXMg dW5hdXRob3Jpc2VkIGFuZCB1bmxhd2Z1bC4gV2hpbHN0IHJlYXNvbmFibGUgZWZmb3J0cyBhcmUg bWFkZSB0byBlbnN1cmUgdGhhdCBhbnkgYXR0YWNobWVudHMgYXJlIHZpcnVzLWZyZWUsIGl0IGlz IHRoZSByZWNpcGllbnQncyBzb2xlIHJlc3BvbnNpYmlsaXR5IHRvIHNjYW4gYWxsIGF0dGFjaG1l bnRzIGZvciB2aXJ1c2VzLiBBbGwgY2FsbHMgYW5kIGVtYWlscyB0byBhbmQgZnJvbSB0aGlzIGNv bXBhbnkgbWF5IGJlIG1vbml0b3JlZCBhbmQgcmVjb3JkZWQgZm9yIGxlZ2l0aW1hdGUgcHVycG9z ZXMgcmVsYXRpbmcgdG8gdGhpcyBjb21wYW55J3MgYnVzaW5lc3MuIEFueSBvcGluaW9ucyBleHBy ZXNzZWQgaW4gdGhpcyBlbWFpbCAob3IgaW4gYW55IGF0dGFjaG1lbnRzKSBhcmUgdGhvc2Ugb2Yg dGhlIGF1dGhvciBhbmQgZG8gbm90IG5lY2Vzc2FyaWx5IHJlcHJlc2VudCB0aGUgb3BpbmlvbnMg b2YgTW9uZXlodWIgRmluYW5jaWFsIFRlY2hub2xvZ3kgTGltaXRlZCBvciBvZiBhbnkgb3RoZXIg Z3JvdXAgY29tcGFueS4NCg0K --_000_6018191137AC40388DB0843BDB3FA59Aamazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiTVMgTWluY2hvIjsNCglwYW5vc2UtMToyIDIgNiA5IDQgMiA1IDgg MyA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3Nl LTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGli cmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250 LWZhbWlseToiXEBNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiVHJlYnVjaGV0IE1TIjsNCglwYW5vc2UtMToyIDEx IDYgMyAyIDIgMiAyIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJPcGVuIFNhbnMi Ow0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2 Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6 MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxl ZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHls ZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rp b24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBp bjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVm aW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjYwNzIwMjM5NzsNCgltc28tbGlz dC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE3NDE2ODE3MTIgNjc2OTg3 MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMg Njc2OTg3MTMgNjc2OTg3MTU7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhh LWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTku MHB0O30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0 IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBs MDpsZXZlbDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4t bG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3Qt aWQ6MTM5MjY1NzkxNDsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0 ZS1pZHM6MTcxMDU0MTA1NiA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5 ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMTpsZXZl bDENCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9 DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpy aWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2 ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1p bmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu O30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dl cjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9 DQpAbGlzdCBsMg0KCXttc28tbGlzdC1pZDoyMTE3NjI5NjQwOw0KCW1zby1saXN0LXR5cGU6aHli cmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMjE0MDg3MjI0MCAyMTEwOTQ0Mzk2IDY3Njk4 NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEz IDY3Njk4NzE1O30NCkBsaXN0IGwyOmxldmVsMQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWNvbG9yOiNFQjM5RjY7fQ0KQGxpc3QgbDI6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDI6bGV2 ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1p bmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwyOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu O30NCkBsaXN0IGwyOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dl cjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwyOmxldmVsNg0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9 DQpAbGlzdCBsMjpsZXZlbDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMjps ZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMjpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0Kb2wNCgl7bWFyZ2lu LWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MgZm9y IHRoZSByZXZpZXcsIERhdmUhIFJlcGxpZXMgYXJlIDxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2 Ij4NCltyaWNoYW5uYV0gaW5saW5lIFsvcmljaGFubmFdPC9zcGFuPi48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij7igJM8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+QW5uYWJlbGxlIEJhY2ttYW4gKHNoZS9oZXIpPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQi PkFXUyBJZGVudGl0eTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48YSBocmVmPSJodHRwczovL2F3cy5hbWF6 b24uY29tL2lkZW50aXR5LyI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwNTYzQzEiPmh0dHBzOi8vYXdz LmFtYXpvbi5jb20vaWRlbnRpdHkvPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGlu IDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PGI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206DQo8L3NwYW4+ PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5JZC1ldmVudCAm bHQ7aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyZndDsgb24gYmVoYWxmIG9mIERhdmUgVG9uZ2Ug Jmx0O2RhdmUudG9uZ2VAbW9tZW50dW1mdC5jby51ayZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+U3Vu ZGF5LCBKdWx5IDEyLCAyMDIwIGF0IDEwOjE1IFBNPGJyPg0KPGI+VG86IDwvYj5TZWNFdmVudCAm bHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPltFWFRFUk5BTF0g W0lkLWV2ZW50XSBSZXZpZXcgb2YgZHJhZnQtaWV0Zi1zZWNldmVudC1zdWJqZWN0LWlkZW50aWZp ZXJzLTA1PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIwIiBj ZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAiIHdpZHRoPSI2MjIiIHN0eWxlPSJ3aWR0aDo0 NjYuNXB0O21hcmdpbi1sZWZ0Oi41aW47Ym9yZGVyLWNvbGxhcHNlOmNvbGxhcHNlIj4NCjx0Ym9k eT4NCjx0ciBzdHlsZT0iaGVpZ2h0OjE1LjI1cHQiPg0KPHRkIHdpZHRoPSI2MjIiIHZhbGlnbj0i dG9wIiBzdHlsZT0id2lkdGg6NDY2LjVwdDtib3JkZXI6c29saWQgI0VEN0QzMSAxLjVwdDtwYWRk aW5nOjBpbiA1LjRwdCAwaW4gNS40cHQ7aGVpZ2h0OjE1LjI1cHQiPg0KPHA+PHN0cm9uZz48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrO2JhY2tncm91bmQ6I0ZGRkY5OSI+Q0FVVElPTjwvc3Bhbj48L3N0cm9uZz48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2s7YmFja2dyb3VuZDojRkZGRjk5Ij46IFRoaXMgZW1haWwgb3JpZ2lu YXRlZCBmcm9tIG91dHNpZGUgb2YgdGhlIG9yZ2FuaXphdGlvbi4gRG8gbm90IGNsaWNrIGxpbmtz IG9yIG9wZW4gYXR0YWNobWVudHMgdW5sZXNzDQogeW91IGNhbiBjb25maXJtIHRoZSBzZW5kZXIg YW5kIGtub3cgdGhlIGNvbnRlbnQgaXMgc2FmZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L3Rk Pg0KPC90cj4NCjwvdGJvZHk+DQo8L3RhYmxlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90OyxzYW5z LXNlcmlmIj5IaSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1 Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj5JJ20gcmVhbGx5IGtlZW4gdG8gc2VlIHRoaXMgZHJh ZnQgcHJvZ3Jlc3MgYW5kIHNvIGhhdmUgcmV2aWV3ZWQgdGhlIGN1cnJlbnQgdGV4dC48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1 Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90Oyxz YW5zLXNlcmlmIj5JbnRyb2R1Y3Rpb248L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVv dDssc2Fucy1zZXJpZiI+SSB0aGluayBpdCB3b3VsZCBiZSBnb29kIHRvIGFkZCBzb21lIHRleHQg dG8gbWFrZSBpdCBjbGVhciB0aGF0IHdoaWxlIHRoZSBpbml0aWFsIHVzZSBjYXNlIGZvIHRoaXMg c3BlYyBpcyBmb3IgU0VUcywgdGhlcmUgaXMgbm90aGluZyBzdG9wcGluZyBpdCBiZWluZyB1c2Vk IGluDQogb3RoZXIgY29udGV4dHMgd2hlcmUgcGFydGllcyBuZWVkIHRvIGNvbW11bmljYXRlIHRo ZSBpZGVudGl0eSBvZiBhIHN1YmplY3QuRm9yIGV4YW1wbGUgd2Ugd2VyZSBsb29raW5nIGF0IHVz aW5nIHRoaXMgc3BlYyB0byBoYXZlIHN0cnVjdHVyZWQgYSBgbG9naW5faGludGAgb3IgYGxvZ2lu X2hpbnRfdG9rZW5gIGluIE9JREMgb3IgQ0lCQSBmbG93cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5bcmljaGFubmFdPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNF QjM5RjYiPkdvb2Qgc3VnZ2VzdGlvbi4gSSB0aGluayBhZGRpbmcgYSBjb3VwbGUgZXhhbXBsZXMg b2YgU3ViamVjdCBJZGVudGlmaWVyIHVzYWdlIHdvdWxkIGhlbHAgdG9vLg0KPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5 RjYiPlsvcmljaGFubmFdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+My41LiZuYnNwOyBBbGlhc2VzIFN1Ympl Y3QgSWRlbnRpZmllciBUeXBlPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNh bnMtc2VyaWYiPkkgZGVmaW5pdGVseSBzZWUgdGhpcyBhcyBhIHVzZWZ1bCBmZWF0dXJlLCBob3dl dmVyIHdvdWxkIGl0IG5vdCBiZSBzaW1wbGVyIHRvIGRlZmluZSBgc3ViX2lkYCBhcyBhbiBhcnJh eSwgcmF0aGVyIHRoYW4gaGF2ZSBhIHNwZWNpZmljICZxdW90O2FsaWFzJnF1b3Q7IHR5cGU/PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtU cmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPltyaWNo YW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6I0VCMzlGNiI+VGhyZWUgcmVhc29ucyBmb3Ig4oCcYWxpYXPigJ0gYXMgYSBm b3JtYWxseSBkZWZpbmVkIHR5cGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPG9sIHN0eWxlPSJt YXJnaW4tdG9wOjBpbiIgc3RhcnQ9IjEiIHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29MaXN0UGFy YWdyYXBoIiBzdHlsZT0iY29sb3I6I0VCMzlGNjttYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzMiPg0KQW4gYXJyYXkgc3ludGF4IGZvciDigJxzdWJfaWTigJ0gd291bGQgYWxs b3dzIHVzIHRvIHNwZWNpZnkgbXVsdGlwbGUgU3ViamVjdCBJZGVudGlmaWVycywgYnV0IGl0IHdv dWxkbuKAmXQgZGVmaW5lIHRoZSBzZW1hbnRpY3Mgb2YgdGhhdCAoaS5lLiwgdGhleSBhbGwgcmVm ZXIgdG8gdGhlIHNhbWUgc3ViamVjdCkuIFdlIGNvdWxkIGRlZmluZSBzZW1hbnRpY3MsIGJ1dCB0 aGF0IHdvdWxkIG9ubHkgY292ZXIg4oCcc3ViX2lk4oCdLCBhbmQgd291bGQgaGF2ZSB0byBiZQ0K IHJlcGVhdGVkIGJ5IGFueSBzcGVjIHRoYXQgd2FudHMgdG8gdXNlIFN1YmplY3QgSWRlbnRpZmll cnMgZWxzZXdoZXJlLjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb0xp c3RQYXJhZ3JhcGgiIHN0eWxlPSJjb2xvcjojRUIzOUY2O21hcmdpbi1sZWZ0OjBpbjttc28tbGlz dDpsMCBsZXZlbDEgbGZvMyI+DQpBbiBhcnJheSBzeW50YXggYWxzbyBmb3JjZXMgZXZlcnlvbmUg dG8gZGVhbCB3aXRoIHRoZSBhZGRpdGlvbmFsIGNvbXBsZXhpdHkgb2Ygd2hhdCBpcyBsaWtlbHkg dG8gYmUgYSBmYWlybHkgbmljaGUgdXNlIGNhc2UuIElmIHdlIGRlZmluZSDigJxzdWJfaWTigJ0g YXMgYWx3YXlzIGJlaW5nIGFuIGFycmF5LCB3ZeKAmWxsIGxpa2VseSBlbmQgdXAgd2l0aCBhIGJ1 bmNoIG9mIG5vbmNvbmZvcm1hbnQgaW1wbGVtZW50YXRpb25zIHRoYXQgc2V0IGl0IHRvIGEgc2lu Z2xlDQogU3ViamVjdCBJZGVudGlmaWVyIG9iamVjdCBiZWNhdXNlIHRoYXTigJlzIHRoZWlyIHVz ZSBjYXNlLiBJZiB3ZSBtYWtlIGl0IGFuIG9iamVjdCBvciBhcnJheSwgd2XigJlyZSBpbiB0aGUg d29ybGQgb2YgcG9seW1vcnBoaWMgSlNPTiB3aGljaCBtYWtlcyBwYXJzaW5nIGEgbG90IG1vcmUg Y29tcGxleC48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFy YWdyYXBoIiBzdHlsZT0iY29sb3I6I0VCMzlGNjttYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzMiPg0KVGhlIOKAnGFsaWFz4oCdIHR5cGUgbGVhdmVzIG9wZW4gdGhlIGRvb3Ig Zm9yIG90aGVyIHdheXMgdG8gaW5jbHVkZSBtdWx0aXBsZSBTdWJqZWN0IElkZW50aWZpZXJzIHRo YXQgaGF2ZSBkaWZmZXJlbnQgc2VtYW50aWNzLiBGb3IgZXhhbXBsZSwgaW4gdGhlIGZ1dHVyZSBz b21lb25lIG1heSBmaW5kIGl0IHVzZWZ1bCB0byBkZWZpbmUgYSDigJxjb2xsZWN0aW9u4oCdIHR5 cGUgdGhhdCBjb250YWlucyBhIGNvbGxlY3Rpb24gb2YgU3ViamVjdCBJZGVudGlmaWVycw0KIHJl ZmVycmluZyB0byBkaWZmZXJlbnQgZW50aXRpZXMuPG86cD48L286cD48L2xpPjwvb2w+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0VCMzlGNiI+Wy9yaWNoYW5uYV08 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6I0VCMzlGNiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+ UHJpdmFjeSBDb25zaWRlcmF0aW9uczwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90 OyxzYW5zLXNlcmlmIj5HaXZlbiB0aGF0IHN1YmplY3QgaWRlbnRpZmllcnMgd2lsbCBvZnRlbiBi ZSBwZXJzb25hbGx5IGlkZW50aWZpYWJsZSBpbmZvcm1hdGlvbiwgSSB0aGluayB0aGF0IHRoZXJl IHNob3VsZCBiZSBhIHNlbnRlbmNlIHN0YXRpbmcgdGhhdCBpZiB0aGlzIHNjaGVtYSBpcyB1c2Vk IGluDQogYW55IGZyb250LWNoYW5uZWwgY29tbXVuaWNhdGlvbiwgdGhlbiB0aGUgdG9rZW4gaW4g d2hpY2ggdGhlIGlkZW50aWZpZXJzIGFyZSBlbWJlZGRlZCBzaG91bGQgYmUgZW5jcnlwdGVkLg0K PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPlty aWNoYW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6I0VCMzlGNiI+VGhpcyBoYXMgYmVlbiBjYWxsZWQgb3V0IGEgZmV3IHRp bWVzIG5vdzsgaXTigJlzIGNsZWFyIHRoZXJlIGlzIGEgbmVlZCBmb3IgdGhpcyBzcGVjIHRvIGV4 cGxpY2l0bHkgY2FsbCBvdXQgdGhlc2UgY29uY2VybnMsIGV2ZW4gaWYgdGhlIGd1aWRhbmNlIGlz IGp1c3Qg4oCcZml4IHRoaXMgYXQgYW5vdGhlciBsZXZlbC7igJ08bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0VCMzlGNiI+Wy9y aWNoYW5uYV08L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1Y2hl dCBNUyZxdW90OyxzYW5zLXNlcmlmIj5UaGFua3M8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5 OiZxdW90O09wZW4gU2FucyZxdW90OyxzZXJpZjtjb2xvcjojMDBBNEI3Ij5EYXZlIFRvbmdlPG86 cD48L286cD48L3NwYW4+PC9iPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0 O2ZvbnQtZmFtaWx5OiZxdW90O09wZW4gU2FucyZxdW90OyxzZXJpZjtjb2xvcjojMzMzMzMzIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjVwdDtmb250LWZh bWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmdyYXkiPk1vbmV5aHViIEVu dGVycHJpc2UgaXMgYSB0cmFkaW5nIHN0eWxlIG9mIE1vbmV5aHViIEZpbmFuY2lhbCBUZWNobm9s b2d5IExpbWl0ZWQgd2hpY2ggaXMgYXV0aG9yaXNlZCBhbmQgcmVndWxhdGVkIGJ5IHRoZSBGaW5h bmNpYWwgQ29uZHVjdCBBdXRob3JpdHkgKCZxdW90O0ZDQSZxdW90OykuDQogTW9uZXlodWIgRmlu YW5jaWFsIFRlY2hub2xvZ3kgaXMgZW50ZXJlZCBvbiB0aGUgRmluYW5jaWFsIFNlcnZpY2VzIFJl Z2lzdGVyIChGUk4gODA5MzYwKSBhdA0KPGEgaHJlZj0iaHR0cHM6Ly9yZWdpc3Rlci5mY2Eub3Jn LnVrLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vcmVnaXN0ZXIuZmNhLm9yZy51ay88L2E+LiBN b25leWh1YiBGaW5hbmNpYWwgVGVjaG5vbG9neSBpcyByZWdpc3RlcmVkIGluIEVuZ2xhbmQgJmFt cDsgV2FsZXMsIGNvbXBhbnkgcmVnaXN0cmF0aW9uIG51bWJlciAwNjkwOTc3Mi4gTW9uZXlodWIg RmluYW5jaWFsIFRlY2hub2xvZ3kgTGltaXRlZCAyMDIwIMKpIE1vbmV5aHViIEVudGVycHJpc2Us DQogUmVndXMgQnVpbGRpbmcsIFRlbXBsZSBRdWF5LCAxIEZyaWFyeSwgQnJpc3RvbCwgQlMxIDZF QS4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L2I+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpncmF5Ij5ESVNDTEFJTUVSOiBUaGlzIGVtYWlsIChp bmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzKSBpcyBzdWJqZWN0IHRvIGNvcHlyaWdodCwgYW5kIHRo ZSBpbmZvcm1hdGlvbiBpbiBpdCBpcyBjb25maWRlbnRpYWwuIFVzZSBvZiB0aGlzIGVtYWlsIG9y IG9mIGFueSBpbmZvcm1hdGlvbg0KIGluIGl0IG90aGVyIHRoYW4gYnkgdGhlIGFkZHJlc3NlZSBp cyB1bmF1dGhvcmlzZWQgYW5kIHVubGF3ZnVsLiBXaGlsc3QgcmVhc29uYWJsZSBlZmZvcnRzIGFy ZSBtYWRlIHRvIGVuc3VyZSB0aGF0IGFueSBhdHRhY2htZW50cyBhcmUgdmlydXMtZnJlZSwgaXQg aXMgdGhlIHJlY2lwaWVudCdzIHNvbGUgcmVzcG9uc2liaWxpdHkgdG8gc2NhbiBhbGwgYXR0YWNo bWVudHMgZm9yIHZpcnVzZXMuIEFsbCBjYWxscyBhbmQgZW1haWxzIHRvIGFuZCBmcm9tDQogdGhp cyBjb21wYW55IG1heSBiZSBtb25pdG9yZWQgYW5kIHJlY29yZGVkIGZvciBsZWdpdGltYXRlIHB1 cnBvc2VzIHJlbGF0aW5nIHRvIHRoaXMgY29tcGFueSdzIGJ1c2luZXNzLiBBbnkgb3BpbmlvbnMg ZXhwcmVzc2VkIGluIHRoaXMgZW1haWwgKG9yIGluIGFueSBhdHRhY2htZW50cykgYXJlIHRob3Nl IG9mIHRoZSBhdXRob3IgYW5kIGRvIG5vdCBuZWNlc3NhcmlseSByZXByZXNlbnQgdGhlIG9waW5p b25zIG9mIE1vbmV5aHViIEZpbmFuY2lhbA0KIFRlY2hub2xvZ3kgTGltaXRlZCBvciBvZiBhbnkg b3RoZXIgZ3JvdXAgY29tcGFueS48L3NwYW4+PGI+PG86cD48L286cD48L2I+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_6018191137AC40388DB0843BDB3FA59Aamazoncom_-- From nobody Mon Jul 13 13:22:53 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05F483A0C8E for ; Mon, 13 Jul 2020 13:22:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vW3OD7Mg8J6B for ; Mon, 13 Jul 2020 13:22:49 -0700 (PDT) Received: from mail-yb1-xb31.google.com (mail-yb1-xb31.google.com [IPv6:2607:f8b0:4864:20::b31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F390A3A0D38 for ; Mon, 13 Jul 2020 13:22:15 -0700 (PDT) Received: by mail-yb1-xb31.google.com with SMTP id y17so7042952ybm.12 for ; Mon, 13 Jul 2020 13:22:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YO9XgLpQNX8k1hO/mw1+uTCGD2oL9osp3tFt0J6WAQ8=; b=SY5yE8rm8I58vtD12TFp6HS7bTKoGuOQ4NZZDUoHMAuI7Toz6TimT9tBmA+o0TdeUU EQRMkBzWjCBixfXdutSIb//psUEWTiuW5cdlWkLvgnmI4Z3E3P/5z0tx4whGAsmBhL0p kF5WZPaN6sLvmUlpVqWPXRAXjoYDaLLG/8NVO2KgO+7e5v0lzGzW5u6ahM4bbJoQEQHL kqhaLJF8yThxh5MyTDmCAYKRuQRHNwCD1m909U4hPlh7feSVl8UQm3iVYvILfypK5QOe RzjsHqiqt1R9BkoX25rkf/zIESf7Xp8aLAu6ncgazQbgbOCyHMfpo2Ow2iMuE6JCGaZ1 XG6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YO9XgLpQNX8k1hO/mw1+uTCGD2oL9osp3tFt0J6WAQ8=; b=qCRhrQBhMTBUw/T5SpX4b6CSqwyhuA27xqDKg7I/zHA9i8jh5TkKWvneIqhvTBvOkj yXjUzuTowBrGgdMtHcWGDcOeXBGo5Xc5MdOSMdZD1dPbps2FPxgqQfBaCgJg7PLPVqMF twEnNKP3FTgPwLMAsuI2b4wteD1SuXWnqu7G3VAlwTjDXOKLsXjAnkTMr8cyUC1FyKNY NyM9dDVFPAotFKlwGdkZzxHwFcmiDXtJfizJ81zB3GVYk5stkjt5cW0Xll8SSbawo0zC ALIKSFm5mS+Z8+RDMvhRCMdPBrmEBuq3YUZX/vursmbsXeZEwmpwdg6n7VKQUcHUEeTE FQfw== X-Gm-Message-State: AOAM533PEZp7ytzbflSNa77DbrOEJF/bZU8QXbhyu4O69/hq5HG/Smyj 0MAHGpgBXI6yTti7MFDBopUYJbC9RKTRLZEKjErrWc6L X-Google-Smtp-Source: ABdhPJz1hoVCMtxpdzAB6kOvVPdNlOmT9niSy8VKDmKi2vgjfnL3uIscm8iN3Tjt72jMp0VN47vIiWLmSkT94dlDI3M= X-Received: by 2002:a25:5ac5:: with SMTP id o188mr2995873ybb.322.1594671734714; Mon, 13 Jul 2020 13:22:14 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> In-Reply-To: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 13:22:03 -0700 Message-ID: To: Chris Phillips Cc: "id-event@ietf.org" Content-Type: multipart/alternative; boundary="000000000000484a3305aa5872da" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 20:22:51 -0000 --000000000000484a3305aa5872da Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Chris, I was proposing using the "assertion id" (SAML Core spec, line 553) in the proposal, not the "subject-id" as defined in SAML (spec section 3.3). The main reason was to be able to refer to a session that was established using a specific assertion. If it's useful, we could perhaps extend the SAML subject identifier type in this spec to include either the assertion_id or the subject_id claim. Thanks, Atul On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips wrote: > Hi. > > Quiet lurker observing.. > > Thanks for consider the SAML elements.. > > > > Atul, are you referring to the actual session identifier that someone may > have where the Subject-Id was exchanged OR the actual Subject-id itself i= n > your reference in the proposal with the github link? > > > > I=E2=80=99m trying to square what I see on the git delta on line 294-296 = in > https://github.com/richanna/secevent/pull/1/commits/b20b6692eb50628927476= ca78f9be077ace88994 > > > > > > And a Subject-id as shown in the example in 3.3.3 here: > https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-= subject-id-attr-v1.0-cs01.html#_Toc536097229 > > > > What you offered in the example is not a Subject-id per the OASIS SAML > spec as written in section 3.3.1 > > > > Am I mis-interpreting something? > > > > C > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Monday, July 13, 2020 at 12:17 PM > *To: *"id-event@ietf.org" > *Subject: *[Id-event] SAML subject identifier type > > > > Hi all, > > Based on the discussions in the SSE working group within the OpenID > Foundation, we would like to propose that the subject identifier > specification include a SAML subject identifier type. This is so that > sessions established across peers using SAML may be identified in events > that include the subject identifier. > > > > A SAML subject identifier has only one claim within it, the assertion id > of the SAML assertion used to establish the single sign-on session. > > > > This change is also included in my proposal here > . > > > > Thanks, > > Atul > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --000000000000484a3305aa5872da Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Chris,
I was proposing using the "assertion id= " (SAML Core spec, line 553) in the proposal, not the "su= bject-id" as defined in SAML (spec section 3.3). The main reason was t= o be able to refer to a session that was established using a specific asser= tion. If it's useful, we could perhaps extend the SAML subject identifi= er type in this spec to include either the assertion_id or the subject_id c= laim.

Thanks,
Atul

<= /div>
O= n Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca> wrote:

Hi.

Quiet lurker= observing..

Thanks for consider th= e SAML elements..

=C2=A0=

Atul, are you referring to the actual sessio= n identifier that someone may have where the Subject-Id was exchanged OR th= e actual Subject-id itself in your reference in the proposal with the githu= b link?

=C2=A0

I=E2=80=99m trying to square what I see on the git delt= a on line 294-296 in https:= //github.com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be= 077ace88994

=C2=A0

=C2=A0

= And a Subject-id as shown in the example in 3.3.3 here: https://docs.oasis-op= en.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs= 01.html#_Toc536097229

= =C2=A0

What you offered in the example is = not a Subject-id =C2=A0per the OASIS SAML spec as written in section 3.3.1<= u>

=C2=A0

Am I mis-interpreting something?

=C2=A0

C

=C2=A0

<= /u>=C2=A0

From: Id-event <id-event-bounces@ietf.o= rg> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.o= rg>
Date: Monday, July 13, 2020 at 12:17 PM
To: = "id-event@ietf.= org" <id= -event@ietf.org>
Subject: [Id-event] SAML subject identifi= er type

= =C2=A0

Hi all,

Based on the discussions in the SSE working gr= oup within the OpenID Foundation, we would like to propose that the subject= identifier specification include a SAML subject identifier type. This is s= o that sessions established across peers using SAML may be identified in ev= ents that include the subject identifier.

=C2=A0

=C2=A0A SAML subject identifier has only one claim within it, the assertio= n id of the SAML assertion used to establish the single sign-on session.=

=C2=A0

This change is also included in my proposal= here.

=C2=A0=

Thanks,

Atul

=C2=A0

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--000000000000484a3305aa5872da-- From nobody Mon Jul 13 13:37:52 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49C4F3A08C7 for ; Mon, 13 Jul 2020 13:37:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.598 X-Spam-Level: X-Spam-Status: No, score=-17.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4j9kAyWjPQ_Q for ; Mon, 13 Jul 2020 13:37:49 -0700 (PDT) Received: from mail-yb1-xb36.google.com (mail-yb1-xb36.google.com [IPv6:2607:f8b0:4864:20::b36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E7413A0930 for ; Mon, 13 Jul 2020 13:37:08 -0700 (PDT) Received: by mail-yb1-xb36.google.com with SMTP id c14so1158431ybj.0 for ; Mon, 13 Jul 2020 13:37:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZlHD//y83Ww/gj9QGKSOE3egONkAFvTtDfBKBtGRalw=; b=gXrkW7s2B2tsEH34VmWEhIHovccAlIWGsxjG9FP5blGEJiJYKE0HJGO1mLj5wsC85t r6CEyP7D3GZZjcRtccJD0GUIhEfVKf1F2zMWyB/+FYfSc/Zg9K11eGUFk46bL7gTIna7 EVSxomydetdMTJ0S3yRssNMb3qmte9G1VbfLKy+iYIfSXpQFdH8BNx/Ba4UsexpHKgVE AUx0MZtYslaAJey/WCF0u1tH2GYSBko+OLH/vue7VGw+bMpdVka3JJ3eWw+8Vi3IE6mr lslPe5nrFIZw4QAQkrDgA4onr5tAWi/kWPbMhjJg7hzMrkl8kciTWpWFAifbWxHfIUiI 4qMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZlHD//y83Ww/gj9QGKSOE3egONkAFvTtDfBKBtGRalw=; b=TMSDZAMFYuD6ViOAnys1xq7Zy/XYd0N+Lx7q6lBsbcjTB6JJKdb/VnxAFwnLPw5O1r pK4rfZXf2aoiHkgYiEt1ri0uNnbgwTk9GyjCY+dqCn8KPzLoPXcr/B6rnHPl7bRPovHj biEpvI9oSMgLW4nw2iNFdWwfo1xG1AX+o4cnKkm4VDHN0FeXqLTtNmqbGBDYtj1vILTy d4g7pah/R42fng5o+bRTF3tDTNGpkWAcwu9E4WTIgKMDd+Wfsj324UaXCiGZhfQdLdhg kwrR6O5/zYg909ye+d7SkFwK6RfZFcZC/hxtJg22emzAGiJHyuXPOtk+vsC8rgRhFgnB 5XkA== X-Gm-Message-State: AOAM531qgGJC+tB0b8dqAXIqXZ5cBPHeqaQclf9asr5gVBj0wKJQmhBx SFNXJWxz+ZVyULCxAgeyRgoc3OiN3MTorJ0vluASAQ== X-Google-Smtp-Source: ABdhPJzGtLKs7ewXdunVirvDQtB6Z6rpPrM4fWLjt9PKf3OaQt9dAXFG1NNLPt4+XT1HppPggwhUZqivd9HjUhJsjXQ= X-Received: by 2002:a25:b90e:: with SMTP id x14mr3159138ybj.8.1594672627373; Mon, 13 Jul 2020 13:37:07 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 13:36:55 -0700 Message-ID: To: Dick Hardt Cc: SecEvent Content-Type: multipart/alternative; boundary="0000000000007d39c505aa58a709" Archived-At: Subject: Re: [Id-event] Common claims in subject identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 20:37:51 -0000 --0000000000007d39c505aa58a709 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Dick, Here's an example of a subject identifier with common claims: { "subject_type": "phone-number", "cateogry": "device", "spag_id" : " https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a", "phone_number": "+1 (408) 555-1212", } In the above example, the "category" claim and the "spag_id" claim are not defined in the phone_number subject identifier type, but they are defined as common claims that may appear in subject identifiers of any type. To disambiguate whether the subject refers to the user that is identified by the phone number or the device that has that phone number, the category claim is important. To disambiguate which management unit the user is being referred to, the spag_id is important. The above example is in the PR. Another example (not in the PR) is: { "subject_type": "email", "spag_id" : " https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a", "email": "user@example.org", } In the above example, it might be important for the "spag_id" to be specified if the same user exists in multiple SPAGs in the receiver of the event. For example, the same user may belong to multiple groups and an event like, say, "access rights SoD conflict" may relate to their presence in one group and not another. Thanks, Atul On Mon, Jul 13, 2020 at 11:22 AM Dick Hardt wrote: > Atul: would you provide a couple use cases and examples to explain your > proposal? > =E1=90=A7 > > On Mon, Jul 13, 2020 at 9:15 AM Atul Tulshibagwale 40google.com@dmarc.ietf.org> wrote: > >> Hi all, >> The proposed subject identifiers specification today requires that each >> claim within a subject identifier be specified by the individual subject >> identifier type. However, there may be some common claims that could be >> defined across all subject identifier types. These are captured within t= he >> "common claims" section of my proposal. All such common claims may be >> optional unless a specific subject identifier type requires any of them >> (there is no example of that today). These claims include: >> >> - *SPAG Identifier*: Identifies the "Subject Principal Administrative >> Grouping" or SPAG that the subject identifier belongs to >> - *Subject Category*: identifies the category that the subject >> identifier refers to (whether user, device or session) >> >> To avoid having to define these claims within each subject identifier >> type, I have extracted them into a separate section called "common claim= s" >> in my proposal . >> >> Thanks, >> Atul >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > --0000000000007d39c505aa58a709 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Dick,
Here's an example of a subject identifier= with common claims:

{=C2=A0 "subject_type": "phone-number",
=C2=A0 "= ;cateogry": "device",
=C2=A0 "spag_id" : "= https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a&= quot;,
=C2=A0 "phone_number": "+1 (408) 555-1212",}

In the above example, the "cat= egory" claim and the "spag_id" claim are not defined in the = phone_number subject identifier type, but they are defined as common claims= that may appear in subject identifiers of any type. To disambiguate whethe= r the subject refers to the user that is identified by the phone number or = the device that has that phone number, the category claim is important. To = disambiguate which management unit the user is being referred to, the spag_= id is important.

The above example is in the PR. A= nother example (not in the PR) is:
=
{
=C2=A0 "subject_ty= pe": "email",
=C2=A0 "spag_id" : "htt= ps://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",<= br>=C2=A0 "email": "user= @example.org",
}

In the above example, it might be important for the "spag_id&qu= ot; to be specified if the same user exists in multiple SPAGs in the receiv= er of the event. For example, the same user may belong to multiple groups a= nd an event like, say, "access rights SoD conflict" may relate to= their presence in one group and not another.

Than= ks,
Atul


On Mon, Jul 13, 2020 at 11:22 AM Dic= k Hardt <dick.hardt@gmail.com> wrote:
Atul: would you provide a couple use cases and examples to ex= plain your proposal?=C2=A0

On Mon, Jul = 13, 2020 at 9:15 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
Hi all,
The proposed subject identifiers specification t= oday requires that each claim within a subject identifier be specified by t= he individual subject identifier type. However, there may be some common cl= aims that could be defined across all subject identifier types. These are c= aptured within the "common claims" section of my proposal. All su= ch common claims may be optional unless a specific subject identifier type = requires any of them (there is no example of that today). These claims incl= ude:

Thanks,
<= div>Atul
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--0000000000007d39c505aa58a709-- From nobody Mon Jul 13 13:48:06 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36A933A09D5 for ; Mon, 13 Jul 2020 13:48:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.588 X-Spam-Level: X-Spam-Status: No, score=-17.588 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bY-2Zg_2Tr4l for ; Mon, 13 Jul 2020 13:48:03 -0700 (PDT) Received: from mail-yb1-xb30.google.com (mail-yb1-xb30.google.com [IPv6:2607:f8b0:4864:20::b30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E912A3A0B90 for ; Mon, 13 Jul 2020 13:47:49 -0700 (PDT) Received: by mail-yb1-xb30.google.com with SMTP id v9so7095147ybe.3 for ; Mon, 13 Jul 2020 13:47:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=nBgzMVOsgRtJZ3kicBtORAB4zLmvq0Ryb1pE7dB7kTs=; b=RnrHdiM6BVjusHBce4cM94nTTPiCf9uRYhRZq8sJLIR8NYEnjSp8v3hlLqN97NJ/t8 wFl+yLSz5kwEN46052a7ntzBxCtcHc5NwUApuKgtlEZd5L0vg4e7XXJetNS2ZTyoOlR8 TrHVtapNakIeFTcO7fMKKw6hUsKFMKpedohO3KMc0m5insjQwNr0JzxnVXZPgJLwsB0A fULY1IPggqWMoUrSLTa2pd53msWTqxCXJKpHyzAqlZcN0Q4D91JPx8XDtcZx/+ivdzkX zqfuIjRyFnR35EcIWN10l3MgWIFaFTeWYG0/GwMxX7qjH3p7/aTmS89JbCCTKfVD/N0D S0GQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=nBgzMVOsgRtJZ3kicBtORAB4zLmvq0Ryb1pE7dB7kTs=; b=K4LdJw5nr29+OevEqY5MFC7qZaAt6ai/KQZGSyyVAoRVbjOrnauHa2v/sDl0P2tjUx SXfdYY9WP2JsuOD+bMNrptYPmd98W1LjlORebBQFkirB43AdgPdB4e9g0IpLG8LckLKL qMGOJWnIVLqSkCKV4zAPWBvWdYRn3hmWprWMNo43dBg7xFtS+7ZT0cNM1J8YOMy3f2PG mA4VaulNjQONavZ22mk9igwK0sb+cLGSWwAOdDEdtqeXjH4DZE0GzrrdUufLHTyIr+A7 HYCQ+krfS1nC6XiGjOUEdnlQCwijKGj2k8XrnODgNZbLOiRBn9e81TWCuPeWgNDRXJXi 51Fg== X-Gm-Message-State: AOAM533FJJycD9WRDSdi0swYVuNf+PdwO1YOg9APiT/d7LOj+9IqyC2c FZRy9N7iXSRn2hfQm06ZuYYt7EAxy9BNsIiRgKw6MQ8iTGA= X-Google-Smtp-Source: ABdhPJyfuQ6Q7q2uxi3oxvBW1JXITFQHmVpZouLfSpcEK0D7E4TKzRROgGqnlh6Q96fijtGlEBe6bdGpqoXKERTPh9w= X-Received: by 2002:a25:2805:: with SMTP id o5mr2893457ybo.97.1594673268725; Mon, 13 Jul 2020 13:47:48 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 13:47:37 -0700 Message-ID: To: Dick Hardt Cc: Atul Tulshibagwale , SecEvent Content-Type: multipart/alternative; boundary="000000000000b7c20205aa58cdec" Archived-At: Subject: Re: [Id-event] Subject Categories in Subject Identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 20:48:05 -0000 --000000000000b7c20205aa58cdec Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable To address Mike's point I'm clarifying the proposal syntax here. I'm proposing that we add a "categories" claim to subject identifiers, regardless of the subject-identifier type (i.e. a common claim), with the following text: Subject Categories Subjects may be categorized as users, devices or sessions. To specify the category of a subject, a "category" claim MAY be included. If present, the claim MUST have a value that is one of: user Specifies that the subject category is a user. device Specifies that the subject category is a device. session Specifies that the subject category is a session. To address Dick's question: I suppose one could think of it either way. I am neutral to adding it within subject identifiers or at a higher-level in the event that includes the subject identifier claim. This was also a point of discussion in the SSE working group, so I'll let others comment on this. This may be dropped if no one has strong reasons to include it in the subject identifiers claim= . Thanks, Atul On Mon, Jul 13, 2020 at 11:25 AM Dick Hardt wrote: > Hi Atul > > I don't follow why this statement is true: > > "Since this is a property of the subject rather than the event" > > I would come to the opposite conclusion. > > =E1=90=A7 > > On Mon, Jul 13, 2020 at 9:10 AM Atul Tulshibagwale 40google.com@dmarc.ietf.org> wrote: > >> Hi all, >> Subject Identifiers will be used in various specifications about events >> pertaining to those subject identifiers. In order to determine the scope= of >> the event, it is important to know what the transmitter of the event tha= t >> includes the subject identifier refers to. >> >> For example, when a subject identifier specifies a phone number as the >> identifier, is the transmitter of the event that includes such a subject >> identifier specifying the user or the device represented by the subject >> identifier. >> >> Since this is a property of the subject rather than the event, it should >> be logically included in the subject identifier spec. Therefore, I'm >> proposing that we include a "subject category" claim within the subject >> identifier. The subject category could have one of the following values: >> >> - *User* >> - *Device* >> - *Session* >> >> The above values are sufficient for the SSE profile, but other values ma= y >> be possible (although such a possibility is not a part of my proposal >> ). >> >> Thanks, >> Atul >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --000000000000b7c20205aa58cdec Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
To address Mike's point I'm clarifying the proposa= l syntax=C2=A0here.

I'm proposing that we add a &quo= t;categories" claim to subject identifiers, regardless of the subject-= identifier type (i.e. a common claim), with the following text:
<= span id=3D"gmail-docs-internal-guid-bd0f4fdf-7fff-aa52-9d13-1993cc235fcf"><= p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><= span style=3D"font-size:8pt;font-family:"Roboto Mono",monospace;c= olor:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;fo= nt-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">= Subject Categories


=C2=A0=C2=A0=C2=A0Subjects may be categor= ized as users, devices or sessions.=C2=A0 To

=C2=A0=C2=A0=C2=A0s= pecify the category of a subject, a "category" claim MAY be

=C2=A0=C2=A0=C2=A0included.=C2=A0 If present, the claim MUST have a v= alue that is one of:


=C2=A0=C2=A0=C2=A0user=C2=A0 Specifies = that the subject category is a user.


=C2=A0=C2=A0=C2=A0devic= e=C2=A0 Specifies that the subject category is a device.


=C2= =A0=C2=A0=C2=A0session=C2=A0 Specifies that the subject category is a sessi= on.


To address Dick's question:
I suppose one could think of i= t either way. I am neutral to adding it within subject identifiers or at a = higher-level in the event that includes the subject identifier claim. This = was also a point of discussion in the SSE working group, so I'll let ot= hers comment on this. This may be dropped if no one has strong reasons to i= nclude it in the subject identifiers claim.

Thanks= ,
Atul

On Mon, Jul 13, 2020 at 11:25 AM Dick Hardt <dick.hardt@gmail.com> wrote:
<= /div>
Hi= =C2=A0Atul

I don't follow why this statement is true= :

"Since this is a property of the subject ra= ther than the event"

I would come to the oppo= site conclusion.

3D""=E1=90=A7<= /div>
O= n Mon, Jul 13, 2020 at 9:10 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmar= c.ietf.org> wrote:
Hi all,
Subject Identifiers will be used in= various specifications about events pertaining to those subject identifier= s. In order to determine the scope of the event, it is important=C2=A0to kn= ow what the transmitter of the event that includes the subject identifier r= efers to.

For example, when a subject identifier s= pecifies a phone number as the identifier, is the transmitter of the event = that includes such a subject identifier specifying the user or the device r= epresented by the subject identifier.

Since this i= s a property of the subject rather than the event, it should be logically i= ncluded in the subject identifier spec. Therefore, I'm proposing that w= e include a "subject category" claim within the subject identifie= r. The subject category could have one of the following values:
<= ul>
  • User
  • Device
  • Session
    • The above values are sufficient for the SSE profile, but other values ma= y be possible (although such a possibility is not a part of my proposal)= .

    Thanks,
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --000000000000b7c20205aa58cdec-- From nobody Mon Jul 13 14:01:12 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 008F73A09BA for ; Mon, 13 Jul 2020 14:01:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AQX00OJwReNS for ; Mon, 13 Jul 2020 14:01:08 -0700 (PDT) Received: from mail-lj1-x22c.google.com (mail-lj1-x22c.google.com [IPv6:2a00:1450:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26B823A081F for ; Mon, 13 Jul 2020 14:01:06 -0700 (PDT) Received: by mail-lj1-x22c.google.com with SMTP id d17so19753442ljl.3 for ; Mon, 13 Jul 2020 14:01:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YUE3NfAv6sKJz4OwEfn1lyvi4OsJhhgmB3egI6Bd9RE=; b=mwwsuNYRGsXPvWNqTDEBUpyWbgqZZaWGH2WWM5b1wmo3fNcfy3M1FoGEdC1taKkqLq 4HqcJOcC74Chdp0Wjk3bsrSGozqVrQMuFzdKgoAsxH+GENo87cNEs5FjZJ5oJIoCjQ/l tEjfOBIzjbXk0FPJlRFJKJtNvDjbUheuy5pUvlRl96BqjTwZkFAacLUsz2gCaYGUE0yO SJ7MuWRnaaKGFiAfxutS73Sa8MzVO9GgUIoZC3qT4IloAZn2xsQFtEM79Xb5S09XUSjo qHc6hpKPW0jgJd/AMiHfoDEPAFHZVDb+5Qctu0Y2/VzcHPsB7wLLUqqr5BJ/V4befsJl hh4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YUE3NfAv6sKJz4OwEfn1lyvi4OsJhhgmB3egI6Bd9RE=; b=LRxILrC/rhj+W2l2pTaxLuaa6VQf0kTROlplOjPtvGowTgIkZxOdzDJUa2D60del6e iNPbTQvUVKa6xh65QdYbq9x/D19FEIVmrkfj9KSfcK0fOP4Doc5MmhtIEigoSgwboRIu Pk7Ja3t1dROmUH9idX9IkQTm4qqYzC8JYA9AuGzBKaaPx8F7TtqLQG5vYY3I9QtZVzJS PqGRU9xVk/vT6c53kplPUZ0eg5QUMnKWOLdWFqbGCqBodmfKJPt81mhJlbvy9G7tivHQ +ByUtFPRIXtQCeXJ6rupGp9UEPGa8y0ZdAUn5GfkDUDNWbPIjgfKl0rgirTBfYbmHs/W 5ZLw== X-Gm-Message-State: AOAM5325C96BJtKLj4H3d428JAbDA1mTzIEHdQj3AgwmnzNDTUuhbHns A6X/8gZUfYhYWSzqoBQPfYDsQ0OBVnrivvYVWXU= X-Google-Smtp-Source: ABdhPJx1JGb6GJKjxCu1mEBSkdXxamN0itJ2Mz5r1xDr79dAmcb6YFCFw3LdyGgs7Rm5xVZhjcCKJFOfSpmOsEUD2fU= X-Received: by 2002:a2e:80c9:: with SMTP id r9mr704613ljg.69.1594674064117; Mon, 13 Jul 2020 14:01:04 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Mon, 13 Jul 2020 14:00:28 -0700 Message-ID: To: Atul Tulshibagwale Cc: SecEvent Content-Type: multipart/alternative; boundary="0000000000001fd38d05aa58fd95" Archived-At: Subject: Re: [Id-event] Common claims in subject identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 21:01:11 -0000 --0000000000001fd38d05aa58fd95 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Got it, thanks! =E1=90=A7 On Mon, Jul 13, 2020 at 1:37 PM Atul Tulshibagwale wrote: > Hi Dick, > Here's an example of a subject identifier with common claims: > > { > "subject_type": "phone-number", > "cateogry": "device", > "spag_id" : " > https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a", > "phone_number": "+1 (408) 555-1212", > } > > In the above example, the "category" claim and the "spag_id" claim are no= t > defined in the phone_number subject identifier type, but they are defined > as common claims that may appear in subject identifiers of any type. To > disambiguate whether the subject refers to the user that is identified by > the phone number or the device that has that phone number, the category > claim is important. To disambiguate which management unit the user is bei= ng > referred to, the spag_id is important. > > The above example is in the PR. Another example (not in the PR) is: > > { > "subject_type": "email", > "spag_id" : " > https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a", > "email": "user@example.org", > } > > In the above example, it might be important for the "spag_id" to be > specified if the same user exists in multiple SPAGs in the receiver of th= e > event. For example, the same user may belong to multiple groups and an > event like, say, "access rights SoD conflict" may relate to their presenc= e > in one group and not another. > > Thanks, > Atul > > > On Mon, Jul 13, 2020 at 11:22 AM Dick Hardt wrote: > >> Atul: would you provide a couple use cases and examples to explain your >> proposal? >> =E1=90=A7 >> >> On Mon, Jul 13, 2020 at 9:15 AM Atul Tulshibagwale > 40google.com@dmarc.ietf.org> wrote: >> >>> Hi all, >>> The proposed subject identifiers specification today requires that each >>> claim within a subject identifier be specified by the individual subjec= t >>> identifier type. However, there may be some common claims that could be >>> defined across all subject identifier types. These are captured within = the >>> "common claims" section of my proposal. All such common claims may be >>> optional unless a specific subject identifier type requires any of them >>> (there is no example of that today). These claims include: >>> >>> - *SPAG Identifier*: Identifies the "Subject Principal >>> Administrative Grouping" or SPAG that the subject identifier belongs= to >>> - *Subject Category*: identifies the category that the subject >>> identifier refers to (whether user, device or session) >>> >>> To avoid having to define these claims within each subject identifier >>> type, I have extracted them into a separate section called "common clai= ms" >>> in my proposal . >>> >>> Thanks, >>> Atul >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >> --0000000000001fd38d05aa58fd95 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Got it, thanks!=C2=A0
    3D""=E1=90=A7
    On= Mon, Jul 13, 2020 at 1:37 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    Hi Dick,
    Here&= #39;s an example of a subject identifier with common claims:

    =
    {
    =C2=A0 "subject_type": &= quot;phone-number",
    =C2=A0 "cateogry": "device"= ,
    =C2=A0 "spag_id" : "https://examp= le.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",
    =C2=A0 = "phone_number": "+1 (408) 555-1212",
    }

    In the above example, the "category" claim= and the "spag_id" claim are not defined in the phone_number subj= ect identifier type, but they are defined as common claims that may appear = in subject identifiers of any type. To disambiguate whether the subject ref= ers to the user that is identified by the phone number or the device that h= as that phone number, the category claim is important. To disambiguate whic= h management unit the user is being referred to, the spag_id is important.<= /div>

    The above example is in the PR. Another example (n= ot in the PR) is:

    =
    {
    =C2=A0 "subject_type": "e= mail",
    =C2=A0 "spag_id" : "htt= ps://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",<= br>=C2=A0 "email": "user@example.org",
    }
    <= /div>

    In the above example, it might be important for th= e "spag_id" to be specified if the same user exists in multiple S= PAGs in the receiver of the event. For example, the same user may belong to= multiple groups and an event like, say, "access rights SoD conflict&q= uot; may relate to their presence in one group and not another.
    <= br>
    Thanks,
    Atul


    On Mon, Jul 13, 20= 20 at 11:22 AM Dick Hardt <dick.hardt@gmail.com> wrote:
    Atul: would you provide a= couple use cases and examples to explain your proposal?=C2=A0
    3D""=E1=90=A7

    On Mon, Jul 13, 2020 at 9:15 AM Atul Tulshibagwale = <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
    Hi all,
    The proposed= subject identifiers specification today requires that each claim within a = subject identifier be specified by the individual subject identifier type. = However, there may be some common claims that could be defined across all s= ubject identifier types. These are captured within the "common claims&= quot; section of my proposal. All such common claims may be optional unless= a specific subject identifier type requires any of them (there is no examp= le of that today). These claims include:
    • SPAG Identifi= er: Identifies the "Subject Principal Administrative Grouping"= ; or SPAG that the subject identifier belongs to
    • Subject Categor= y: identifies the category that the subject identifier refers to (wheth= er user, device or session)
    To avoid having to define these c= laims within each subject identifier type, I have extracted them into a sep= arate section called "common claims" in my proposal.

    Thanks,
    Atul
    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --0000000000001fd38d05aa58fd95-- From nobody Mon Jul 13 14:08:45 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46B5C3A0A49 for ; Mon, 13 Jul 2020 14:08:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.598 X-Spam-Level: X-Spam-Status: No, score=-17.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fgUtDT1PhiOR for ; Mon, 13 Jul 2020 14:08:42 -0700 (PDT) Received: from mail-yb1-xb2a.google.com (mail-yb1-xb2a.google.com [IPv6:2607:f8b0:4864:20::b2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A7823A0A2E for ; Mon, 13 Jul 2020 14:08:42 -0700 (PDT) Received: by mail-yb1-xb2a.google.com with SMTP id v9so7121991ybe.3 for ; Mon, 13 Jul 2020 14:08:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=94ON1Ow1I18c3Ra2AERNBLTJwixtAy87C9BWFiaZVgQ=; b=GN1NCgsjoYuzz8p+CfMoJFH6XVHAH0mvlYL9jRedy/hMRjEfzpPYJi1NdRDN43QvVg LkiR+pA/QLV5pQxdWPZ1T8gQgvrlhJUo0ZlgBDj8pMeCQG7vA5+F0SMVe8K7KocM10om qkTBOwTrsYySsIEIEdA7Qr0JSrs0mu7XC4JckDlE4BhpQGtLtDepBnpxUOKKLi3iHMI3 GdzS0Yn2EYYxqOhOyDSdk8JqoAaLS8ajNe5diM4ueLW8OciuTw+YJWpbTYcuYGH1wIXE pgTbPJYAxAB4i7tIBV8kZpIJ8dHo6b4ThujB7gIHpdWyHtJJ4WVxtDYflZxOuAxVWIQF PmJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=94ON1Ow1I18c3Ra2AERNBLTJwixtAy87C9BWFiaZVgQ=; b=OdydwHPzMYVfAKEYBZ9Bd10Y5ITqFv0/IA7UHjuv1fMK347+HdJVeVfcvbMvTN10L3 9CIYpUvDnfj9U0qI+34gJ6uu/JTq2TDbOsYknY3OqKnPlS1NA+kfx06f12mD9igziXqx WE5imvUEZ3fuANJMKpbtl2pjxvgCyEt6RjhHzxxAaG6qY24UDZCDYvyq+diA9LAquadN iQiftrqfgaRO0mYBXHOmKfqpjNC7rY6Rbu+spyTVWJhqtCVkHsFQbiVdWbSm3jC4T2g5 YZbasSwVEo3SSjZtLh7kR298PmZm1cTvEKakp+0pgGY3ZP6rRsmTep4p6M/3N9Hb4JcR 3VGQ== X-Gm-Message-State: AOAM532n/cW/o3nR3S18glo8GNPrshJvITN0uW44v7aVXLR33qG5JMVm RbSmwHKvTYc71mmo66VQMDEFELngFRsEt2asvPCzFOqkzXs= X-Google-Smtp-Source: ABdhPJzhtx/E3fRN6uFBP0k8c01tPbSsKsnfC7C2OYZfvtLU9cFtmINPtTOg9vCCwm0VQWA1pkPifUrl8mG+ultoqto= X-Received: by 2002:a25:73d6:: with SMTP id o205mr3205341ybc.31.1594674521116; Mon, 13 Jul 2020 14:08:41 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 14:08:29 -0700 Message-ID: To: Dick Hardt Cc: SecEvent Content-Type: multipart/alternative; boundary="0000000000005d7d6305aa59183e" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 21:08:44 -0000 --0000000000005d7d6305aa59183e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Dick, your understanding is correct. To clarify the proposal here, Here's the text I'm proposing to be added: 3. Subject Principals Subject Principals are the management entities associated with Subjects. These may be human or robotic principals or devices or other entities that are managed by transmitters and receivers. For example, the same Subject Principal may be referred to by an email address or a phone number. A transmitter or receiver will typically manage subject principals and organize them into sub-groupings such as tenants, groups, organizational units, etc. Subjects are identified by Subject Identifiers defined below. 3.1. SPAGs Subject Principals MAY be grouped for administrative purposes into "Subject Principal Administrative Groupings" or SPAGs. For example, all users belonging to one customer of a "multi-tenanted" Transmitter may be in one SPAG. Alternatively, an Organizational Unit or a group of Subjects within a customer of a Transmitter (whether multi- tenanted or not) may be one SPAG. SPAGs may have overlapping sets of Subjects. A SPAG MAY be the Subject of certain stream update events defined later in this spec, hence is defined as a Subject Type of its own below. A SPAG identifier MAY be included in other subject types to disambiguate the subject. A SPAG subject identifier is agreed to offline between a transmitter and a receiver. The benefits of doing this are: 1. Multi-tenanted hosts do not need to maintain secrets per tenant and per transmitter tenant if each tenant has to be an event transmitter and= an event receiver of its own. 2. An event stream may be established between two multi-tenanted hosts, and so does not need to be managed at a per-tenant level 3. The same subject or subject principal may be a part of multiple SPAGs, and identifying the SPAG that an event relates to can be achieved= if the standard allows for the SPAGs to be identified. On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt wrote: > To clarify, your proposal is driven by the implementation burden of > maintaining separate secrets / streams between a transmitter and receiver= ? > =E1=90=A7 > > On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: > >> Hi all, >> Here's a quick background for the proposal >> for including Subject >> Principals and Subject Principal Administrative Groupings or SPAGs in th= e >> Subject Identifiers spec. >> >> *Use of Subject Identifiers in Shared Signals and Events*: >> The Shared Signals and Events (SSE) profile of SETs specifies that >> transmitters and receivers send and receive SETs that contain Subject >> Identifiers. These subject identifiers have the format that is now being >> discussed as a separate specification here. >> >> *Transmitters and Receivers in SSE* >> The SSE profile defines transmitters and receivers as hosts that manage >> streams between peers. The receiver authenticates to the transmitter usi= ng >> OAuth, requiring the use of a secret per receiver. In a multi-tenanted h= ost >> that handles hundreds of thousands or millions of independent tenants, >> maintaining such a secret per instance of a receiver is cumbersome. >> Furthermore, since a transmitter and a receiver has to maintain a stream >> per pair, creating such per-tenant streams can add significant >> implementation overhead. >> >> *SPAGs* >> Therefore, we need a notion of a grouping of subjects within the same >> transmitter and receiver to distinguish between various administrative >> groupings that exist within a host. These groupings could include tenant= s, >> organizational units or user groups.. This grouping is captured in the >> notion of a SPAG. The uniqueness of a user identifier (subject identifie= r) >> may also be limited to a SPAG. For example, if a random unique ID >> represents a user, then that ID may be unique within a SPAG and not >> universally across a transmitter or receiver. This is because each >> transmitter and receiver may have multiple connections to other >> transmitters and receivers, and ensuring uniqueness across all such peer= s >> is probably an intractable problem. >> >> *Subject Principals* >> While what is represented within a subject identifier may be only an >> aspect of the management entity, the administrative grouping is about th= e >> management entity itself. This could be the user, device or other princi= pal >> that the subject identifier represents. Therefore, an abstract notion of= a >> Subject Principal is also required in order specify what the grouping >> within a SPAG is about. >> >> The above is captured in the "Subject Principal" and "SPAG" sections >> within the proposed PR . >> >> Thanks, >> Atul >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > --0000000000005d7d6305aa59183e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Dick, your understanding is correct.

    To clarify the proposal here, Here's the text I'm proposing to = be added:

    3.=C2=A0 Subject Principals
    <= br>=C2=A0 =C2=A0Subject Principals are the management entities associated w= ith
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or robotic principal= s or devices or
    =C2=A0 =C2=A0other entities that are managed by transmit= ters and receivers.=C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Pri= ncipal may be referred to by an email
    =C2=A0 =C2=A0address or a phone nu= mber.=C2=A0 A transmitter or receiver will typically
    =C2=A0 =C2=A0manage= subject principals and organize them into sub-groupings such
    =C2=A0 =C2= =A0as tenants, groups, organizational units, etc.

    =C2=A0 =C2=A0Subje= cts are identified by Subject Identifiers defined below.

    3.1.=C2=A0 = SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be grouped for administrat= ive purposes into
    =C2=A0 =C2=A0"Subject Principal Administrative Gr= oupings" or SPAGs.=C2=A0 For example,
    =C2=A0 =C2=A0all users belong= ing to one customer of a "multi-tenanted" Transmitter
    =C2=A0 = =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organizational Unit or a = group
    =C2=A0 =C2=A0of Subjects within a customer of a Transmitter (wheth= er multi-
    =C2=A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs may= have overlapping sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A S= PAG MAY be the Subject of certain stream update events defined
    =C2=A0 = =C2=A0later in this spec, hence is defined as a Subject Type of its own
    = =C2=A0 =C2=A0below.=C2=A0 A SPAG identifier MAY be included in other subjec= t types to
    =C2=A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2=A0A = SPAG subject identifier is agreed to offline between a transmitter
    =C2= =A0 =C2=A0and a receiver.

    The benefits of doing th= is are:
    1. Multi-tenanted hosts do not need to maintain secr= ets per tenant and per transmitter tenant if each tenant has to be an event= transmitter and an event receiver of its own.
    2. An event stream may = be established between two multi-tenanted hosts, and so does not need to be= managed at a per-tenant level
    3. The same subject or subject principa= l may be a part of multiple SPAGs, and identifying the SPAG that an event r= elates to can be achieved if the standard allows for the SPAGs to be identi= fied.


    On Mon, Jul 13, 2020 at 11:32 AM Dick H= ardt <dick.har= dt@gmail.com> wrote:
    To clarify, your proposal is driven by the imp= lementation=C2=A0burden of maintaining separate secrets / streams between a= transmitter and receiver?
    3D""=E1=90=A7

    On Mon, Jul = 13, 2020 at 9:01 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org<= /a>> wrote:
    <= div dir=3D"ltr">Hi all,=C2=A0
    Here's a quick background for the prop= osal for including Subject Principals and Subject Principal Administrat= ive Groupings or SPAGs in the Subject Identifiers spec.

    Use of Subject Identifiers in Shared Signals and Events:
    =
    The Shared Signals and Events (SSE) profile of SETs specifies that tra= nsmitters and receivers send and receive SETs that contain Subject Identifi= ers. These subject identifiers have the format that is now being discussed = as a separate specification here.

    Transmitt= ers and Receivers in SSE
    The SSE profile defines transmitters= and receivers as hosts that manage streams between peers. The receiver aut= henticates to the transmitter using OAuth, requiring the use of a secret pe= r receiver. In a multi-tenanted host that handles hundreds of thousands or = millions of independent tenants, maintaining such a secret per instance of = a receiver is cumbersome. Furthermore, since a transmitter and a receiver h= as to maintain a stream per pair, creating such per-tenant streams can add = significant implementation overhead.

    SPAGs<= /div>
    Therefore, we need a notion of a grouping of subjects within the = same transmitter and receiver to distinguish between various administrative= groupings that exist within a host. These groupings could include tenants,= organizational units or user groups.. This grouping is captured in the not= ion of a SPAG. The uniqueness of a user identifier (subject identifier) may= also be limited to a SPAG. For example, if a random unique ID represents a= user, then that ID may be unique within a SPAG and not universally across = a transmitter or receiver. This is because each transmitter and receiver ma= y have multiple connections to other transmitters and receivers, and ensuri= ng uniqueness across all such peers is probably an intractable problem.

    Subject Principals
    While what is rep= resented within a subject identifier may be only an aspect of the managemen= t entity, the administrative grouping is about the management entity itself= . This could be the user, device or other principal that the subject identi= fier represents. Therefore, an abstract notion of a Subject Principal is al= so required in order specify what the grouping within a SPAG is about.

    The above is captured in the "Subject Principal&q= uot; and "SPAG" sections within the proposed PR.
    Thanks,
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --0000000000005d7d6305aa59183e-- From nobody Mon Jul 13 14:12:57 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3C0D3A0D2E for ; Mon, 13 Jul 2020 14:12:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uNgOqmoJq_F4 for ; Mon, 13 Jul 2020 14:12:46 -0700 (PDT) Received: from mail-yb1-xb31.google.com (mail-yb1-xb31.google.com [IPv6:2607:f8b0:4864:20::b31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2A4F3A0B6B for ; Mon, 13 Jul 2020 14:12:26 -0700 (PDT) Received: by mail-yb1-xb31.google.com with SMTP id a30so7129687ybj.5 for ; Mon, 13 Jul 2020 14:12:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Zdm+5gXetR5EXq1N0n0F0dfW1PbpgEFwW0iHvkmWGhM=; b=OuOlCuq2V+YTIsE8Sl6iF3UNARru1FqjJwIKC5ZI+Zo3SwKZFtmM8OYCGpppw9Elta nYDN+ITVR4H3wmdlNJECegxRAoCogSp4oWPezzZVQ+b2weXoljDfr0si5ZVYUELakjdl HUkxtPsqjR124SQk+o08AiRib+/tnhL5BuLPnTF6x+madcMFCXD+DMJlKUYVrlFKlI14 Bavscses9wTBH8SWhcK/CV9YzrODgxkARCDRVSXjh709YIpJsyHejKNJQB1CXo5XOGw8 BogcgfpUITDbznUl8r5qNrVZ8pbqHIiMYd72fN/3B6awVUwXUZDFgqDzPtdKwpVa+O4n NLRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Zdm+5gXetR5EXq1N0n0F0dfW1PbpgEFwW0iHvkmWGhM=; b=BjkS5FbkSmRIRAH1ov1Y8+04RBEjIVPbjF98vgEuyNcMK22yWz/T3RJ7IwHH5SF/5/ PNSnzhYBsscruDJ+hHgg3Bj0azIKAX2OBo/Jl35n29GvbRQIb+RaJvwubc0rGRaDqUix +sBXb5CGYm0Wmua0NGt0tIzWlRFERto+tPXUJ/Ei97CliGLmGeLPdnUDaCK7dxcN0Af6 58SvT6GTvfoM/WYNo39KGWTe70Ym5cMyq8a9wPg0O3scHBFQPFBqE1Yt/4r/sCxOwhHJ gvENf/tZ9PiFLMCqU68URcFtaYlhm+n2UFLbAHDmd3TdxXT5Tz+y5BVwmhwoT6ScI942 JKtA== X-Gm-Message-State: AOAM5305wNIuRSpUh/FuCwW5hSDh3o36hXf6JYcpHI5YBxBfzJkpOzrh XIL+9LQ/toSea3TpfvTqo4wbmw48JyyGO7bXuReSJaxS7fs= X-Google-Smtp-Source: ABdhPJzYSjLnYYEPKNNPtYSPyveR64sTkqpFrwAkW6Qr0GOVinVj/q6/l5+gXPyf9efr9cW6kxOadUFMvjbi08zes+E= X-Received: by 2002:a25:5ac5:: with SMTP id o188mr3288095ybb.322.1594674745787; Mon, 13 Jul 2020 14:12:25 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> In-Reply-To: From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 14:12:14 -0700 Message-ID: To: Chris Phillips Cc: "id-event@ietf.org" Content-Type: multipart/alternative; boundary="000000000000c1bcd605aa5925c9" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 21:12:54 -0000 --000000000000c1bcd605aa5925c9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Just clarifying the proposal as it stands today (before incorporating Chris's input): The following section should be added in the "Subject Identifier Types" section: 4.9. SAML Subject Identifier Type The SAML [SAML.REF] Subject Identifier Type describes a subject by the assertion identifier in the SAML assertion that was used to convey the subject's information to the Receiver. Subject Identifiers of this type MUST contain an ` assertion_id"claim. The value of this claim is a string that is equal to the Assertion Identifier in the SAML assertion. The SAML Subject Identifier Type is identified by the name "saml`. Below is a non-normative example Subject Identifier for the SAML Subject Identifier Type: { "subject_type": "saml", "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", } Figure 8: Example: Subject Identifier for SAML Subject Identifier Type. On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale wrote: > Hi Chris, > I was proposing using the "assertion id" (SAML Core > > spec, line 553) in the proposal, not the "subject-id" as defined in SAML > (spec section 3.3). The main reason was to be able to refer to a session > that was established using a specific assertion. If it's useful, we could > perhaps extend the SAML subject identifier type in this spec to include > either the assertion_id or the subject_id claim. > > Thanks, > Atul > > > On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips > wrote: > >> Hi. >> >> Quiet lurker observing.. >> >> Thanks for consider the SAML elements.. >> >> >> >> Atul, are you referring to the actual session identifier that someone ma= y >> have where the Subject-Id was exchanged OR the actual Subject-id itself = in >> your reference in the proposal with the github link? >> >> >> >> I=E2=80=99m trying to square what I see on the git delta on line 294-296= in >> https://github.com/richanna/secevent/pull/1/commits/b20b6692eb5062892747= 6ca78f9be077ace88994 >> >> >> >> >> >> And a Subject-id as shown in the example in 3.3.3 here: >> https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml= -subject-id-attr-v1.0-cs01.html#_Toc536097229 >> >> >> >> What you offered in the example is not a Subject-id per the OASIS SAML >> spec as written in section 3.3.1 >> >> >> >> Am I mis-interpreting something? >> >> >> >> C >> >> >> >> >> >> *From: *Id-event on behalf of Atul >> Tulshibagwale >> *Date: *Monday, July 13, 2020 at 12:17 PM >> *To: *"id-event@ietf.org" >> *Subject: *[Id-event] SAML subject identifier type >> >> >> >> Hi all, >> >> Based on the discussions in the SSE working group within the OpenID >> Foundation, we would like to propose that the subject identifier >> specification include a SAML subject identifier type. This is so that >> sessions established across peers using SAML may be identified in events >> that include the subject identifier. >> >> >> >> A SAML subject identifier has only one claim within it, the assertion i= d >> of the SAML assertion used to establish the single sign-on session. >> >> >> >> This change is also included in my proposal here >> . >> >> >> >> Thanks, >> >> Atul >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > --000000000000c1bcd605aa5925c9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Just clarifying the proposal as it stands today (before in= corporating Chris's input):
    The following section should be added i= n the "Subject Identifier Types" section:
    4.9.=C2=A0 SAML Subject Identifier Type

    =C2=A0 =C2=A0The= SAML [SAML.REF] Subject Identifier Type describes a subject by
    =C2=A0 = =C2=A0the assertion identifier in the SAML assertion that was used to
    = =C2=A0 =C2=A0convey the subject's information to the Receiver.=C2=A0 Su= bject
    =C2=A0 =C2=A0Identifiers of this type MUST contain an ` assertion_= id"claim.=C2=A0 The
    =C2=A0 =C2=A0value of this claim is a string th= at is equal to the Assertion
    =C2=A0 =C2=A0Identifier in the SAML asserti= on.=C2=A0 The SAML Subject Identifier Type
    =C2=A0 =C2=A0is identified by= the name "saml`.

    =C2=A0 =C2=A0Below is a non-normative example= Subject Identifier for the SAML
    =C2=A0 =C2=A0Subject Identifier Type:
    =C2=A0 =C2=A0{
    =C2=A0 =C2=A0 =C2=A0"subject_type": "= ;saml",
    =C2=A0 =C2=A0 =C2=A0"assertion_id": "_f551d8= 8963ab4e3decb7cfe8f4dcc3f5",
    =C2=A0 =C2=A0}

    =C2=A0 =C2=A0 = =C2=A0Figure 8: Example: Subject Identifier for SAML Subject Identifier
    = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Type.
    <= div>

    On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    = Hi Chris,
    I was proposing using the "assertion id" (SAML Core spec, line 553) in the proposal, not the "= ;subject-id" as defined in SAML (spec section 3.3). The main reason wa= s to be able to refer to a session that was established using a specific as= sertion. If it's useful, we could perhaps extend the SAML subject ident= ifier type in this spec to include either the assertion_id or the subject_i= d claim.

    Thanks,
    Atul


    On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca>= wrote:

    Hi.

    Quiet lurker observing..

    T= hanks for consider the SAML elements..

    =C2=A0

    Atul, are you referring= to the actual session identifier that someone may have where the Subject-I= d was exchanged OR the actual Subject-id itself in your reference in the pr= oposal with the github link?

    =C2=A0

    I=E2=80=99m trying to square what = I see on the git delta on line 294-296 in https://github.com/richanna/secevent/pull/1/commits/b20b6692= eb50628927476ca78f9be077ace88994

    =C2=A0

    =C2=A0

    And a Subject-id as shown in the example in 3.3.3 here= : = https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-su= bject-id-attr-v1.0-cs01.html#_Toc536097229

    =C2=A0

    What you offered= in the example is not a Subject-id =C2=A0per the OASIS SAML spec as writte= n in section 3.3.1

    =C2=A0=

    Am I mis-interpreting something?

    =C2=A0

    C

    =C2=A0

    =C2=A0

    From: Id-ev= ent <id-e= vent-bounces@ietf.org> on behalf of Atul Tulshibagwale <atultulsh= i=3D40goog= le.com@dmarc.ietf.org>
    Date: Monday, July 13, 2020 at 12:1= 7 PM
    To: "id-event@ietf.org" <id-event@ietf.org>
    Subject: [Id-event] SA= ML subject identifier type

    =C2=A0

    Hi all,=

    Based on the discussions in t= he SSE working group within the OpenID Foundation, we would like to propose= that the subject identifier specification include a SAML subject identifie= r type. This is so that sessions established across peers using SAML may be= identified in events that include the subject identifier.

    =C2=A0

    =C2=A0A SAML subject identifier has only one claim within= it, the assertion id of the SAML assertion used to establish the single si= gn-on session.

    = =C2=A0

    This change is also incl= uded in my proposal here.

    =C2=A0

    Thanks,=

    Atul

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --000000000000c1bcd605aa5925c9-- From nobody Mon Jul 13 14:20:16 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7548C3A0A49 for ; Mon, 13 Jul 2020 14:20:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.6 X-Spam-Level: X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c6rBW7dQXCUQ for ; Mon, 13 Jul 2020 14:20:11 -0700 (PDT) Received: from mail-yb1-xb30.google.com (mail-yb1-xb30.google.com [IPv6:2607:f8b0:4864:20::b30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45AA93A0789 for ; Mon, 13 Jul 2020 14:19:59 -0700 (PDT) Received: by mail-yb1-xb30.google.com with SMTP id 133so7136607ybu.7 for ; Mon, 13 Jul 2020 14:19:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=VEzTegkVrtp16xZaYSZ++nHIidsrkXUYVJtMgHgVCFY=; b=kYSCwLV1bkxvT6uMW0+g48A0qdSkJlhrySAs5z5/9ge4Xqb/o6c7GN9YoDJMsC39MH mxc699sLh5q7cun2n8NZmXBpEsQaIXKS9x8AqCRCnXOFb0JZiMyZQUEsX9oF024V1x09 xaEkqoDUPXO/24Qq9FPDC26GgFrlOTYKkPJL93ddCK9ZV5wyeOpHLgxttun/92D0WdMY 5p97wCuUAee7TLLi6+LWOsKY6gGoycp1OJH5TscIixmb3vuy93xOMy+Mhno9q4f/8iCq FKpK7nbiWcshIldqKrRAUe5Jscje4JSjEa21O+O4Ikp3SRsy0mDu3f/5yfiOXVRTnj1i uzHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=VEzTegkVrtp16xZaYSZ++nHIidsrkXUYVJtMgHgVCFY=; b=NAqjg/Ao5574GOo/hKzbTcIKu/NDZvt0yUnYATt+YOCwddy5r8FS/3y4z687Oe6H68 D1gFJ1BIz0nmz4v+2fAYtQTMsIrv4ySLc3LoJTsTDHT8BZUW3HTFb1kPHQXPKJSnQQgU esou84EWjGd0zT2AwonZRIhmZcE9OSTObvWr8wqjLUNCYYm39AsU1fO2b4uztncJV+/a uR0JIrDLlSnRHfUK/13Lhp1rpD94iESyQlyAe3U3vLQpRd2AdWE+0B+hryuE9JskUGp7 u+qGoSmOr4FIqtq+rwwH8U/KDGe19wyJ7ohErMT8wYg0e+XQ3vtprECx8hFsceXKVukQ VI/w== X-Gm-Message-State: AOAM53187IwmCzAaMBmwvfy80DXhhkf9VH5AD2VTRkEePy7y13ye6g3s NEA/AEzGXxX3k8/u2/kuY6nUFrQv5xrvCD15Eciuixyxjbo= X-Google-Smtp-Source: ABdhPJx2FnIQfRQaMcfFcoZOqomci59MAzENKe+cl7Yw+FvgT7a3o+GClfhG24KwicHug6UW+aD/VRrDfFSSAim8jgE= X-Received: by 2002:a25:2805:: with SMTP id o5mr3078684ybo.97.1594675197869; Mon, 13 Jul 2020 14:19:57 -0700 (PDT) MIME-Version: 1.0 From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 14:19:46 -0700 Message-ID: To: SecEvent Content-Type: multipart/alternative; boundary="000000000000b4411205aa5940c4" Archived-At: Subject: [Id-event] SPAG as a subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 21:20:13 -0000 --000000000000b4411205aa5940c4 Content-Type: text/plain; charset="UTF-8" Hi all, One thing that hasn't come out in the other email threads I started here today, is that the SPAG may itself be a subject identifier type. This is in cases where an event relates to the SPAG and not any subject within the SPAG. This is already a part of the PR, but copied here for easy reference: 4.8. SPAG Subject Identifier Type The SPAG Subject Identifier Type describes a Subject Principal Administrative Grouping or SPAG (Section 3.1). Subject Identifiers of this type MUST contain a "spag_id" claim, a unique identifier agreed to offline between a Transmitter and a Receiver that identifies a SPAG uniquely within the Transmitter. The "spag_id" claim MUST NOT be null or empty. The SPAG Subject Identifier Type is identified by the name "spag". Below is an non-normative example Subject Identifier for the SPAG Subject Identifier Type: { "subject_type": "spag", "spag_id" : " https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a", } Figure 7: Example: Subject Identifier for SPAG Subject Identifier Type. An example of an event that could have SPAG as a subject type is: "stream disabled", wherein a transmitter unilaterally decides to stop sending events about a SPAG. This can happen in case the SPAG represents a tenant, and that tenant has been disabled / removed from the transmitter. Atul --000000000000b4411205aa5940c4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Hi all,

    One thing that hasn't come = out in the other email threads I started here today, is that the SPAG may i= tself be a subject identifier type. This is in cases where an event relates= to the SPAG and not any subject within the SPAG. This is already a part of= the PR, but copied here for easy reference:

    4.8.=C2=A0 SPAG Subject Identifier Type

    =C2=A0 = =C2=A0The SPAG Subject Identifier Type describes a Subject Principal
    =C2= =A0 =C2=A0Administrative Grouping or SPAG (Section 3.1).=C2=A0 Subject Iden= tifiers
    =C2=A0 =C2=A0of this type MUST contain a "spag_id" cla= im, a unique identifier
    =C2=A0 =C2=A0agreed to offline between a Transmi= tter and a Receiver that
    =C2=A0 =C2=A0identifies a SPAG uniquely within = the Transmitter.=C2=A0 The "spag_id"
    =C2=A0 =C2=A0claim MUST N= OT be null or empty.=C2=A0 The SPAG Subject Identifier Type is
    =C2=A0 = =C2=A0identified by the name "spag".

    =C2=A0 =C2=A0Below is= an non-normative example Subject Identifier for the SPAG
    =C2=A0 =C2=A0S= ubject Identifier Type:

    {
    =C2=A0 "subject_type": "= spag",
    =C2=A0 "spag_id" : "https://example.com/v= 2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",
    }

    =C2=A0= =C2=A0 =C2=A0Figure 7: Example: Subject Identifier for SPAG Subject Identi= fier
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Type.
    =

    An example of an event that could have SPAG as a = subject type is: "stream disabled", wherein a transmitter unilate= rally decides to stop sending events about a SPAG. This can happen in case = the SPAG represents a tenant, and that tenant has been disabled / removed f= rom the transmitter.

    Atul
    --000000000000b4411205aa5940c4-- From nobody Mon Jul 13 14:35:30 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9562C3A0C75 for ; Mon, 13 Jul 2020 14:35:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.095 X-Spam-Level: X-Spam-Status: No, score=-2.095 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id idQnK-tlNY2U for ; Mon, 13 Jul 2020 14:35:24 -0700 (PDT) Received: from mail-lj1-x232.google.com (mail-lj1-x232.google.com [IPv6:2a00:1450:4864:20::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2F1D3A07F7 for ; Mon, 13 Jul 2020 14:34:52 -0700 (PDT) Received: by mail-lj1-x232.google.com with SMTP id b25so19828584ljp.6 for ; Mon, 13 Jul 2020 14:34:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Gwj6BwBMulu/VlO8Ie511JvBNhlvQCoczo2WHBCBudo=; b=JP8iOwvweEUYB6rZKXEHRExYbyAYmvPuX0laiXWVQ1tjmHKMNywwCsbpdk8ynsKiaI e9u4sV78QD1jKhqqMm5rnFF/T6FQzxLZyC1BPFF3qbWBf/OIaFv/GUyUdb/xaRXgut+9 ScfHNvkhf+QK89ONIjAKk59rlxYMKjwdx5Ja/0Y5Lh/71Ht35RPZDaFRoPzkvt38IAqz OFps09Naf4muSxUVvvlP+DVs6IiHQAu9pue4lPc+yBchcHzwKGjFbLMmNWKenl+VXWb+ SO5Sx6NofjPopLYDUpXDCbsEbPUDYEGbMEU80jmJPBVXN6xZksglYP01zWQxvJShaU6H y5qQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Gwj6BwBMulu/VlO8Ie511JvBNhlvQCoczo2WHBCBudo=; b=pzM42FDW82ancVcqkQa7lDqJTKyy00UknKk0jjiZ+HE+Xc2Qm6hsB2WJ7UbW3rdvq1 W6NjlqpLT73iW6Kajk7b/mYnVNr1o6nlLa9ppXotEm3XnCBwxy3iJY2rE8ScQgcCRPKJ 5Q7XHBC/XjuPUk5rq3wo2YPYA4U5pFNZfC/wyhQ8t19ZUFbc0/rCQDTxI1icvf7ORI5t HnB3pZFQoGMDkG2rtiZezVxUMfCxIsCEG4z4pRMBjPVVs4C4TVMtETeDDgCJLWnp9hL8 aHqTpFhTivVJMgXLRe/4jJwHAlWMxMSXXu1UM1D87V1pM2LX+3LhYuZFnL9arm/MqDPe nFZw== X-Gm-Message-State: AOAM530VUHnLmj8qGaEUooSAGyG6njjlzhOktKHnZhyNUXVJS60jtOF4 vKjCx33v2UvxMH2K2ZA3EQoAfcQF0/vduVIIDbk4j3ea X-Google-Smtp-Source: ABdhPJxw47gUNSFRjNrXoQlTGri+fLxj6Yycdd9Squ552MAmzIfm/HM8ebRYS/JW98wOszTaz/uekql5517eDcNToFU= X-Received: by 2002:a2e:8316:: with SMTP id a22mr709724ljh.246.1594676090842; Mon, 13 Jul 2020 14:34:50 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Mon, 13 Jul 2020 14:34:14 -0700 Message-ID: To: Atul Tulshibagwale Cc: SecEvent Content-Type: multipart/alternative; boundary="000000000000ed337e05aa5975db" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 21:35:28 -0000 --000000000000ed337e05aa5975db Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I see the SPAG lets the transmitter and receiver provide context, as the subject identifier may be the same across SPAGs. Now I'm trying to understand how the transmitter authenticates to the receiver if it does not have it's own secret (assuming that authentication model) -- IE, how does the receiver know the transmitter is authorized for that SPAG? On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale wrote: > Dick, your understanding is correct. > > To clarify the proposal here, Here's the text I'm proposing to be added: > > 3. Subject Principals > > Subject Principals are the management entities associated with > Subjects. These may be human or robotic principals or devices or > other entities that are managed by transmitters and receivers. For > example, the same Subject Principal may be referred to by an email > address or a phone number. A transmitter or receiver will typically > manage subject principals and organize them into sub-groupings such > as tenants, groups, organizational units, etc. > > Subjects are identified by Subject Identifiers defined below. > > 3.1. SPAGs > > Subject Principals MAY be grouped for administrative purposes into > "Subject Principal Administrative Groupings" or SPAGs. For example, > all users belonging to one customer of a "multi-tenanted" Transmitter > may be in one SPAG. Alternatively, an Organizational Unit or a group > of Subjects within a customer of a Transmitter (whether multi- > tenanted or not) may be one SPAG. SPAGs may have overlapping sets of > Subjects. > > A SPAG MAY be the Subject of certain stream update events defined > later in this spec, hence is defined as a Subject Type of its own > below. A SPAG identifier MAY be included in other subject types to > disambiguate the subject. > > A SPAG subject identifier is agreed to offline between a transmitter > and a receiver. > > The benefits of doing this are: > > 1. Multi-tenanted hosts do not need to maintain secrets per tenant and > per transmitter tenant if each tenant has to be an event transmitter a= nd an > event receiver of its own. > 2. An event stream may be established between two multi-tenanted > hosts, and so does not need to be managed at a per-tenant level > 3. The same subject or subject principal may be a part of multiple > SPAGs, and identifying the SPAG that an event relates to can be achiev= ed if > the standard allows for the SPAGs to be identified. > > > > On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt wrote: > >> To clarify, your proposal is driven by the implementation burden of >> maintaining separate secrets / streams between a transmitter and receive= r? >> =E1=90=A7 >> >> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale > 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >> >>> Hi all, >>> Here's a quick background for the proposal >>> for including Subject >>> Principals and Subject Principal Administrative Groupings or SPAGs in t= he >>> Subject Identifiers spec. >>> >>> *Use of Subject Identifiers in Shared Signals and Events*: >>> The Shared Signals and Events (SSE) profile of SETs specifies that >>> transmitters and receivers send and receive SETs that contain Subject >>> Identifiers. These subject identifiers have the format that is now bein= g >>> discussed as a separate specification here. >>> >>> *Transmitters and Receivers in SSE* >>> The SSE profile defines transmitters and receivers as hosts that manage >>> streams between peers. The receiver authenticates to the transmitter us= ing >>> OAuth, requiring the use of a secret per receiver. In a multi-tenanted = host >>> that handles hundreds of thousands or millions of independent tenants, >>> maintaining such a secret per instance of a receiver is cumbersome. >>> Furthermore, since a transmitter and a receiver has to maintain a strea= m >>> per pair, creating such per-tenant streams can add significant >>> implementation overhead. >>> >>> *SPAGs* >>> Therefore, we need a notion of a grouping of subjects within the same >>> transmitter and receiver to distinguish between various administrative >>> groupings that exist within a host. These groupings could include tenan= ts, >>> organizational units or user groups.. This grouping is captured in the >>> notion of a SPAG. The uniqueness of a user identifier (subject identifi= er) >>> may also be limited to a SPAG. For example, if a random unique ID >>> represents a user, then that ID may be unique within a SPAG and not >>> universally across a transmitter or receiver. This is because each >>> transmitter and receiver may have multiple connections to other >>> transmitters and receivers, and ensuring uniqueness across all such pee= rs >>> is probably an intractable problem. >>> >>> *Subject Principals* >>> While what is represented within a subject identifier may be only an >>> aspect of the management entity, the administrative grouping is about t= he >>> management entity itself. This could be the user, device or other princ= ipal >>> that the subject identifier represents. Therefore, an abstract notion o= f a >>> Subject Principal is also required in order specify what the grouping >>> within a SPAG is about. >>> >>> The above is captured in the "Subject Principal" and "SPAG" sections >>> within the proposed PR . >>> >>> Thanks, >>> Atul >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >> --000000000000ed337e05aa5975db Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    I see the SPAG lets the transmitter and receiver provide c= ontext, as the subject identifier may be the same across SPAGs.

    Now I'm trying to understand how the transmitter authenticates = to the receiver if it does not have it's own secret (assuming that auth= entication model) -- IE, how does the receiver know the transmitter is auth= orized=C2=A0for that SPAG?


    On Mon, Jul 13, 2020 at 2:08= PM Atul Tulshibagwale <atultul= shi@google.com> wrote:
    Dick, your understanding is correct.

    To clarify the proposal here, Here's the text I'm= proposing to be added:

    3.=C2=A0 Subject P= rincipals

    =C2=A0 =C2=A0Subject Principals are the management entitie= s associated with
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or rob= otic principals or devices or
    =C2=A0 =C2=A0other entities that are manag= ed by transmitters and receivers.=C2=A0 For
    =C2=A0 =C2=A0example, the sa= me Subject Principal may be referred to by an email
    =C2=A0 =C2=A0address= or a phone number.=C2=A0 A transmitter or receiver will typically
    =C2= =A0 =C2=A0manage subject principals and organize them into sub-groupings su= ch
    =C2=A0 =C2=A0as tenants, groups, organizational units, etc.

    = =C2=A0 =C2=A0Subjects are identified by Subject Identifiers defined below.<= br>
    3.1.=C2=A0 SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be group= ed for administrative purposes into
    =C2=A0 =C2=A0"Subject Principal= Administrative Groupings" or SPAGs.=C2=A0 For example,
    =C2=A0 =C2= =A0all users belonging to one customer of a "multi-tenanted" Tran= smitter
    =C2=A0 =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organiz= ational Unit or a group
    =C2=A0 =C2=A0of Subjects within a customer of a = Transmitter (whether multi-
    =C2=A0 =C2=A0tenanted or not) may be one SPA= G.=C2=A0 SPAGs may have overlapping sets of
    =C2=A0 =C2=A0Subjects.
    =C2=A0 =C2=A0A SPAG MAY be the Subject of certain stream update events de= fined
    =C2=A0 =C2=A0later in this spec, hence is defined as a Subject Typ= e of its own
    =C2=A0 =C2=A0below.=C2=A0 A SPAG identifier MAY be included= in other subject types to
    =C2=A0 =C2=A0disambiguate the subject.
    =C2=A0 =C2=A0A SPAG subject identifier is agreed to offline between a tran= smitter
    =C2=A0 =C2=A0and a receiver.

    The benefi= ts of doing this are:
    1. Multi-tenanted hosts do not need to= maintain secrets per tenant and per transmitter tenant if each tenant has = to be an event transmitter and an event receiver of its own.
    2. An eve= nt stream may be established between two multi-tenanted hosts, and so does = not need to be managed at a per-tenant level
    3. The same subject or su= bject principal may be a part of multiple SPAGs, and identifying the SPAG t= hat an event relates to can be achieved if the standard allows for the SPAG= s to be identified.


    On Mon, Jul 13, 2020 at 1= 1:32 AM Dick Hardt <dick.hardt@gmail.com> wrote:
    To clarify, your proposal is dri= ven by the implementation=C2=A0burden of maintaining separate secrets / str= eams between a transmitter and receiver?
    3D""=E1=90=A7

    On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale <atultulshi=3D40google.com@d= marc.ietf.org> wrote:
    Hi all,=C2=A0
    Here's a quick backgrou= nd for the proposal for including Subject Principals and Subject Princ= ipal Administrative Groupings or SPAGs in the Subject Identifiers spec.

    Use of Subject Identifiers in Shared Signals and E= vents:
    The Shared Signals and Events (SSE) profile of SETs sp= ecifies that transmitters and receivers send and receive SETs that contain = Subject Identifiers. These subject identifiers have the format that is now = being discussed as a separate specification here.

    <= div>Transmitters and Receivers in SSE
    The SSE profile defi= nes transmitters and receivers as hosts that manage streams between peers. = The receiver authenticates to the transmitter using OAuth, requiring the us= e of a secret per receiver. In a multi-tenanted host that handles hundreds = of thousands or millions of independent tenants, maintaining such a secret = per instance of a receiver is cumbersome. Furthermore, since a transmitter = and a receiver has to maintain a stream per pair, creating such per-tenant = streams can add significant implementation overhead.

    SPAGs
    Therefore, we need a notion of a grouping of subj= ects within the same transmitter and receiver to distinguish between variou= s administrative groupings that exist within a host. These groupings could = include tenants, organizational units or user groups.. This grouping is cap= tured in the notion of a SPAG. The uniqueness of a user identifier (subject= identifier) may also be limited to a SPAG. For example, if a random unique= ID represents a user, then that ID may be unique within a SPAG and not uni= versally across a transmitter or receiver. This is because each transmitter= and receiver may have multiple connections to other transmitters and recei= vers, and ensuring uniqueness across all such peers is probably an intracta= ble problem.

    Subject Principals
    W= hile what is represented within a subject identifier may be only an aspect = of the management entity, the administrative grouping is about the manageme= nt entity itself. This could be the user, device or other principal that th= e subject identifier represents. Therefore, an abstract notion of a Subject= Principal is also required in order specify what the grouping within a SPA= G is about.

    The above is captured in the "Sub= ject Principal" and "SPAG" sections within the proposed PR.


    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --000000000000ed337e05aa5975db-- From nobody Mon Jul 13 14:55:29 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 204673A0EE9 for ; Mon, 13 Jul 2020 14:55:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.885 X-Spam-Level: X-Spam-Status: No, score=-1.885 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=independentid-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WLqyv7pyDMbM for ; Mon, 13 Jul 2020 14:55:20 -0700 (PDT) Received: from mail-pg1-x52d.google.com (mail-pg1-x52d.google.com [IPv6:2607:f8b0:4864:20::52d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 137E23A0E9E for ; Mon, 13 Jul 2020 14:55:04 -0700 (PDT) Received: by mail-pg1-x52d.google.com with SMTP id p3so6659286pgh.3 for ; Mon, 13 Jul 2020 14:55:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=independentid-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=auiJ1wBF52oGAgqMf2n/VGuoJlw7gC3lVbTibCo9T+A=; b=cmqe1o1nBFGiDbh8Uvo+VU2HbLWiPr9LBVzjFb9hmR1rarccHOvDdpBuIRcfv2SGBf CYnQa9BxsoOeprh5oN+/bmxskt1aNlQYaesdfDWIm6Dwywe5QKSYbjqiH+6V5wn4tQse hqjasVqZ5aVTuMESOThENHv8GIpTHFm0GApT+c/TKINGD6WSRpgr5/Gd5j5oyH+4AUle Sul9Z+J90fgxEYIKewxT6eHUO2XVV9m0kROIUa3Ts69NQUXf9Qma96R5DFtNc7YpiJsm 4mV1Ikf/9nWHmyHrEO4g4HgAOAl7gpbevxqN/J1xT7/OWVKZx1Wkdtp8RzJ20IH9vJmu ciGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=auiJ1wBF52oGAgqMf2n/VGuoJlw7gC3lVbTibCo9T+A=; b=L9VdDmVekBPXg9Yj059nHNWA47vJCOU6ZdB84lYULapG3SIIUbJ6mAFjY3SQUcDeWZ xNI7jX1Nul6GZ246uI7zdIJXx+g3FdNkh4SgGH7cpEHkW43Y15Tne8jg0AFCnI2ob94h uLgw9MPH5bEZJqhF5vFetaMu7r8J0G7BnxLGWrvarDVnvcV7IhKWEE99Em8BY8urQqN7 KP8Eu7BhBvCdkuLqosx58a2S3OsYUQr303awnGx3Zao797WyUR2+3yXqJF6XjT0/MqUd hu3TLYWQsSf4Jm/7f0Eu1ZQpDevvwoAceO/Us1jv0Iz6VUhOQBBh0NV1KPHwiIYDQxVl u5fA== X-Gm-Message-State: AOAM530MQmpFMqYLn5C9ErL+1LQT7UgPCcLqhsW11wINnX80zMxGYm9l sAk0J78oh8IoWxWY8m+WX7wvjkHiGRg= X-Google-Smtp-Source: ABdhPJxGkklb6bSFYCOnJzncc5tNV0DCd0y2bFbxiWHtc/5iXwGyPG0tvPJ7brTTrP4jPY02hQxr2A== X-Received: by 2002:a63:457:: with SMTP id 84mr949085pge.219.1594677304363; Mon, 13 Jul 2020 14:55:04 -0700 (PDT) Received: from node-1w7jr9qrfoxx8mcksqtcf83xl.ipv6.telus.net (node-1w7jr9qrfoxx8mcksqtcf83xl.ipv6.telus.net. [2001:569:7a71:1d00:4814:7c28:a629:34e9]) by smtp.gmail.com with ESMTPSA id c134sm15135404pfc.115.2020.07.13.14.55.03 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 Jul 2020 14:55:03 -0700 (PDT) From: Phil Hunt Message-Id: <5C854271-BC02-47EE-814C-D8270681BF33@independentid.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_7DB09B35-3AE5-4EFE-8727-26596362CDB1" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Mon, 13 Jul 2020 14:55:03 -0700 In-Reply-To: Cc: Dick Hardt , ID Events Mailing List To: Atul Tulshibagwale References: X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [Id-event] Subject Categories in Subject Identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 21:55:28 -0000 --Apple-Mail=_7DB09B35-3AE5-4EFE-8727-26596362CDB1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Why is the category not part of the eventuri / event definition? Why = have one event that applies to a session, a device, a person, and an = account at the same time as opposed to 4 different event uris? It feels like you may be trying define a combined, multi-purpose event = to cover many actual events. Is that the goal? My expectation for defining SETs and eventuris was that the eventuri = conveys 90% of the information content of a SET. The subject identifier = indicates who or what the event is about and the occasional use of = payload claims to provide =E2=80=9Cuseful=E2=80=9D additional = information (like a counter). E.g. if you want to convey how many = account resets and not just the fact the account was reset. It makes = sense to re-use the same URI even though the actions taken on the 3rd = reset might be different then on the first. IMO, a wide number of event uris paired with lightweight SETs means = policy systems and SET routers can make quick decisions on where and how = to act upon an event for a particular subject. Phillip Hunt phil.hunt@independentid.com > On Jul 13, 2020, at 1:47 PM, Atul Tulshibagwale = wrote: >=20 > To address Mike's point I'm clarifying the proposal syntax here. >=20 > I'm proposing that we add a "categories" claim to subject identifiers, = regardless of the subject-identifier type (i.e. a common claim), with = the following text: > Subject Categories >=20 > Subjects may be categorized as users, devices or sessions. To > specify the category of a subject, a "category" claim MAY be > included. If present, the claim MUST have a value that is one of: >=20 > user Specifies that the subject category is a user. >=20 > device Specifies that the subject category is a device. >=20 > session Specifies that the subject category is a session. >=20 > To address Dick's question: > I suppose one could think of it either way. I am neutral to adding it = within subject identifiers or at a higher-level in the event that = includes the subject identifier claim. This was also a point of = discussion in the SSE working group, so I'll let others comment on this. = This may be dropped if no one has strong reasons to include it in the = subject identifiers claim. >=20 > Thanks, > Atul >=20 > On Mon, Jul 13, 2020 at 11:25 AM Dick Hardt > wrote: > Hi Atul >=20 > I don't follow why this statement is true: >=20 > "Since this is a property of the subject rather than the event" >=20 > I would come to the opposite conclusion. >=20 > =E1=90=A7 >=20 > On Mon, Jul 13, 2020 at 9:10 AM Atul Tulshibagwale = > wrote: > Hi all, > Subject Identifiers will be used in various specifications about = events pertaining to those subject identifiers. In order to determine = the scope of the event, it is important to know what the transmitter of = the event that includes the subject identifier refers to. >=20 > For example, when a subject identifier specifies a phone number as the = identifier, is the transmitter of the event that includes such a subject = identifier specifying the user or the device represented by the subject = identifier. >=20 > Since this is a property of the subject rather than the event, it = should be logically included in the subject identifier spec. Therefore, = I'm proposing that we include a "subject category" claim within the = subject identifier. The subject category could have one of the following = values: > User > Device > Session > The above values are sufficient for the SSE profile, but other values = may be possible (although such a possibility is not a part of my = proposal ).. >=20 > Thanks, > Atul >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_7DB09B35-3AE5-4EFE-8727-26596362CDB1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Why = is the category not part of the eventuri / event definition?  Why = have one event that applies to a session, a device, a person, and an = account at the same time as opposed to 4 different event uris?

    It feels like you may be = trying define a  combined, multi-purpose event to cover many actual = events. Is that the goal?

    My expectation for defining SETs and = eventuris was that the eventuri conveys 90% of the information content = of a SET. The subject identifier indicates who or what the event is = about and the occasional use of payload claims to provide =E2=80=9Cuseful=E2= =80=9D additional information (like a counter).  E.g. if you want = to convey how many account resets and not just the fact the account was = reset. It makes sense to re-use the same URI even though the actions = taken on the 3rd reset might be different then on the first.

    IMO, a wide number of = event uris paired with lightweight SETs means policy systems and SET = routers can make quick decisions on where and how to act upon an event = for a particular subject.

    Phillip Hunt



    On Jul 13, 2020, at 1:47 PM, Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> = wrote:

    To address Mike's point I'm clarifying the = proposal syntax here.

    I'm proposing that we add a "categories" claim to subject = identifiers, regardless of the subject-identifier type (i.e. a common = claim), with the following text:
    Subject Categories

       Subjects may be categorized as users, = devices or sessions.  To
       specify the category of a = subject, a "category" claim MAY be
       included.  If present, the = claim MUST have a value that is one of:

       user  Specifies that the subject = category is a user.

       device  Specifies that the = subject category is a device.

       session  Specifies that the subject = category is a session.

    To = address Dick's question:
    I suppose one could think = of it either way. I am neutral to adding it within subject identifiers = or at a higher-level in the event that includes the subject identifier = claim. This was also a point of discussion in the SSE working group, so = I'll let others comment on this. This may be dropped if no one has = strong reasons to include it in the subject identifiers claim.

    Thanks,
    Atul

    On Mon, Jul 13, 2020 at 11:25 AM Dick = Hardt <dick.hardt@gmail.com> wrote:
    Hi Atul

    I don't follow why this statement is true:

    "Since this is a = property of the subject rather than the event"

    I would come to the opposite = conclusion.

    3D""=E1=90=A7

    On Mon, Jul = 13, 2020 at 9:10 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
    Hi = all,
    Subject Identifiers will be used in various = specifications about events pertaining to those subject identifiers. In = order to determine the scope of the event, it is important to know = what the transmitter of the event that includes the subject identifier = refers to.

    For = example, when a subject identifier specifies a phone number as the = identifier, is the transmitter of the event that includes such a subject = identifier specifying the user or the device represented by the subject = identifier.

    Since this is a property of the subject rather than the = event, it should be logically included in the subject identifier spec. = Therefore, I'm proposing that we include a "subject category" claim = within the subject identifier. The subject category could have one of = the following values:
    • User
    • Device
    • Session
    The above values are = sufficient for the SSE profile, but other values may be possible = (although such a possibility is not a part of my proposal)..

    Thanks,
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    _______________________________________________
    Id-event = mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    = --Apple-Mail=_7DB09B35-3AE5-4EFE-8727-26596362CDB1-- From nobody Mon Jul 13 15:03:48 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 293D53A0D36 for ; Mon, 13 Jul 2020 15:03:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.895 X-Spam-Level: X-Spam-Status: No, score=-1.895 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=independentid-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QiBgDoq_8BnI for ; Mon, 13 Jul 2020 15:03:38 -0700 (PDT) Received: from mail-pj1-x1033.google.com (mail-pj1-x1033.google.com [IPv6:2607:f8b0:4864:20::1033]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B5A643A0D1A for ; Mon, 13 Jul 2020 15:03:38 -0700 (PDT) Received: by mail-pj1-x1033.google.com with SMTP id gc15so379200pjb.0 for ; Mon, 13 Jul 2020 15:03:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=independentid-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=29rxkI855dPuTKWIheel9ucp/iV754ZQqzJAd7HLN+Q=; b=Wn9jHWMWeZKkR1J8Vt8PWLa40sBz5xjqJ2d2IdXuk8uf+tCS320b/ZBK3CY7zVMt/x k+cTSXY6NmuVp+jXpMEqu+hsCiT7TvUeFMcffIQIdBqjJ+ujHBPMa8yDmUk5WYy45qZU mW4eRITl9aBYDqQhwbLroUkpvc1GcZn0K4MtYA7AvT+3P0Of6uI1ZXcwrx0By4piixPN 0p6E+Q9JUI/8ExILXoR/ernGx8hweSUV4gMy3t/Gpuehj1SqKw0zra99jwz3iau5KPhH svGxSMi+A6Dq3fM3DmdpNoX6Gq5kJXlcJgoGVAjica+kFyatiN6KH+YLOfmQjD/5fgGd ISNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=29rxkI855dPuTKWIheel9ucp/iV754ZQqzJAd7HLN+Q=; b=ZBjCMrITwULzeOBxhlfZssSGQgEEbmsBagONWgzNXjaVl7/XGUWy5O+5jY3nCYu6oN aNhSbCDZxnldXCH6DaGN4oGcLfKcyDoIjxm/U9W66WtwKvAx4tARloPk2mdvkGq93CUM f0c+00gymalpRQN4GvR8e3K3JO9e9BrlOGP0iG/3hRy27xgKDLM0eo/hSSXg6kDFbmeG fn3f7uSteLIH5mW2Go7gjoPQX1qf9qiULK8ySVPCVbuNuQFfKe8ZhDcGXmO/J30TaMQR FI5pBQdzF0HhBcz4vktBVfog44Kbi1mImiSMdPwsVUuRdf+Bn9hmNKU9arii398Uuh0d eAiQ== X-Gm-Message-State: AOAM5315BhRIlZhMlYlH4z+wfMUUAH8CEPDH0q5Pk/wtARFsIOghU1Es lYlthVsA2kg5DRJDywcN+KGGQQ== X-Google-Smtp-Source: ABdhPJwgqmbFp5GCVEhLMBLsRWJ/DNk+/FEV9c4iAmg9j0l80lPBYshVZDi6AZIGt5W84aQQwjTUwA== X-Received: by 2002:a17:902:c142:: with SMTP id 2mr1446018plj.222.1594677818091; Mon, 13 Jul 2020 15:03:38 -0700 (PDT) Received: from node-1w7jr9qrfoxx8mcksqtcf83xl.ipv6.telus.net (node-1w7jr9qrfoxx8mcksqtcf83xl.ipv6.telus.net. [2001:569:7a71:1d00:4814:7c28:a629:34e9]) by smtp.gmail.com with ESMTPSA id n63sm13901989pfd.209.2020.07.13.15.03.36 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 Jul 2020 15:03:37 -0700 (PDT) From: Phil Hunt Message-Id: <6C1CC0F4-2440-470A-BA3E-053726A0DB28@independentid.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_2C6063B1-06D3-46CC-8D4D-F9D703007486" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Mon, 13 Jul 2020 15:03:35 -0700 In-Reply-To: Cc: Dick Hardt , ID Events Mailing List To: Atul Tulshibagwale References: X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 22:03:41 -0000 --Apple-Mail=_2C6063B1-06D3-46CC-8D4D-F9D703007486 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Atul, I not understanding why a receiver needs to differentiate between an OP = issuer of a subject and a SPAG? What is the difference? Are we talking about an event from a relying party adminitrator domain? =20= E.g. Phil Hunt=E2=80=99s Azure issued OP account used within the Google = adminstratvie domain had this event? Could the receiver not already figure this our by noting that the issuer = of the SET is not the issuer of the subject identifier? Phillip Hunt phil.hunt@independentid.com > On Jul 13, 2020, at 2:08 PM, Atul Tulshibagwale = wrote: >=20 > Dick, your understanding is correct. >=20 > To clarify the proposal here, Here's the text I'm proposing to be = added: >=20 > 3. Subject Principals >=20 > Subject Principals are the management entities associated with > Subjects. These may be human or robotic principals or devices or > other entities that are managed by transmitters and receivers. For > example, the same Subject Principal may be referred to by an email > address or a phone number. A transmitter or receiver will = typically > manage subject principals and organize them into sub-groupings such > as tenants, groups, organizational units, etc. >=20 > Subjects are identified by Subject Identifiers defined below. >=20 > 3.1. SPAGs >=20 > Subject Principals MAY be grouped for administrative purposes into > "Subject Principal Administrative Groupings" or SPAGs. For = example, > all users belonging to one customer of a "multi-tenanted" = Transmitter > may be in one SPAG. Alternatively, an Organizational Unit or a = group > of Subjects within a customer of a Transmitter (whether multi- > tenanted or not) may be one SPAG. SPAGs may have overlapping sets = of > Subjects. >=20 > A SPAG MAY be the Subject of certain stream update events defined > later in this spec, hence is defined as a Subject Type of its own > below. A SPAG identifier MAY be included in other subject types to > disambiguate the subject. >=20 > A SPAG subject identifier is agreed to offline between a = transmitter > and a receiver. >=20 > The benefits of doing this are: > Multi-tenanted hosts do not need to maintain secrets per tenant and = per transmitter tenant if each tenant has to be an event transmitter and = an event receiver of its own. > An event stream may be established between two multi-tenanted hosts, = and so does not need to be managed at a per-tenant level > The same subject or subject principal may be a part of multiple SPAGs, = and identifying the SPAG that an event relates to can be achieved if the = standard allows for the SPAGs to be identified. >=20 >=20 > On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt > wrote: > To clarify, your proposal is driven by the implementation burden of = maintaining separate secrets / streams between a transmitter and = receiver? > =E1=90=A7 >=20 > On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale = > wrote: > Hi all,=20 > Here's a quick background for the proposal = for including Subject = Principals and Subject Principal Administrative Groupings or SPAGs in = the Subject Identifiers spec. >=20 > Use of Subject Identifiers in Shared Signals and Events: > The Shared Signals and Events (SSE) profile of SETs specifies that = transmitters and receivers send and receive SETs that contain Subject = Identifiers. These subject identifiers have the format that is now being = discussed as a separate specification here. >=20 > Transmitters and Receivers in SSE > The SSE profile defines transmitters and receivers as hosts that = manage streams between peers. The receiver authenticates to the = transmitter using OAuth, requiring the use of a secret per receiver. In = a multi-tenanted host that handles hundreds of thousands or millions of = independent tenants, maintaining such a secret per instance of a = receiver is cumbersome. Furthermore, since a transmitter and a receiver = has to maintain a stream per pair, creating such per-tenant streams can = add significant implementation overhead. >=20 > SPAGs > Therefore, we need a notion of a grouping of subjects within the same = transmitter and receiver to distinguish between various administrative = groupings that exist within a host. These groupings could include = tenants, organizational units or user groups.. This grouping is captured = in the notion of a SPAG. The uniqueness of a user identifier (subject = identifier) may also be limited to a SPAG. For example, if a random = unique ID represents a user, then that ID may be unique within a SPAG = and not universally across a transmitter or receiver. This is because = each transmitter and receiver may have multiple connections to other = transmitters and receivers, and ensuring uniqueness across all such = peers is probably an intractable problem. >=20 > Subject Principals > While what is represented within a subject identifier may be only an = aspect of the management entity, the administrative grouping is about = the management entity itself.. This could be the user, device or other = principal that the subject identifier represents. Therefore, an abstract = notion of a Subject Principal is also required in order specify what the = grouping within a SPAG is about. >=20 > The above is captured in the "Subject Principal" and "SPAG" sections = within the proposed PR . >=20 > Thanks, > Atul >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_2C6063B1-06D3-46CC-8D4D-F9D703007486 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Atul,

    I = not understanding why a receiver needs to differentiate between an OP = issuer of a subject and a SPAG?

    What is the difference?

    Are we talking about an = event from a relying party adminitrator domain?  

    E.g. Phil Hunt=E2=80=99s = Azure issued OP account used within the Google adminstratvie domain had = this event?

    Could the receiver not already figure this our by noting that = the issuer of the SET is not the issuer of the subject = identifier?

    Phillip Hunt



    On Jul 13, 2020, at 2:08 PM, Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> = wrote:

    Dick, your understanding is = correct.

    To clarify the = proposal here, Here's the text I'm proposing to be added:

    3.  = Subject Principals

       Subject = Principals are the management entities associated with
       Subjects.  These may be human or robotic = principals or devices or
       other entities that = are managed by transmitters and receivers.  For
      =  example, the same Subject Principal may be referred to by an = email
       address or a phone number.  A = transmitter or receiver will typically
       manage = subject principals and organize them into sub-groupings such
       as tenants, groups, organizational units, = etc.

       Subjects are identified = by Subject Identifiers defined below.

    3.1.  SPAGs

      =  Subject Principals MAY be grouped for administrative purposes = into
       "Subject Principal Administrative = Groupings" or SPAGs.  For example,
       all = users belonging to one customer of a "multi-tenanted" Transmitter
       may be in one SPAG.  Alternatively, an = Organizational Unit or a group
       of Subjects = within a customer of a Transmitter (whether multi-
      =  tenanted or not) may be one SPAG.  SPAGs may have overlapping = sets of
       Subjects.

       A SPAG MAY be the Subject of certain stream = update events defined
       later in this spec, = hence is defined as a Subject Type of its own
      =  below.  A SPAG identifier MAY be included in other subject = types to
       disambiguate the subject.

       A SPAG subject identifier is = agreed to offline between a transmitter
       and a = receiver.

    The = benefits of doing this are:
    1. Multi-tenanted hosts do not need to maintain secrets per = tenant and per transmitter tenant if each tenant has to be an event = transmitter and an event receiver of its own.
    2. An = event stream may be established between two multi-tenanted hosts, and so = does not need to be managed at a per-tenant level
    3. The = same subject or subject principal may be a part of multiple SPAGs, and = identifying the SPAG that an event relates to can be achieved if the = standard allows for the SPAGs to be identified.


    On Mon, Jul = 13, 2020 at 11:32 AM Dick Hardt <dick.hardt@gmail.com> wrote:
    To = clarify, your proposal is driven by the implementation burden of = maintaining separate secrets / streams between a transmitter and = receiver?
    3D""=E1=90=A7

    On Mon, Jul = 13, 2020 at 9:01 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
    Hi = all, 
    Here's a quick background for the proposal for including Subject Principals and Subject = Principal Administrative Groupings or SPAGs in the Subject Identifiers = spec.

    Use of Subject Identifiers in Shared Signals and = Events:
    The Shared Signals and Events (SSE) = profile of SETs specifies that transmitters and receivers send and = receive SETs that contain Subject Identifiers. These subject identifiers = have the format that is now being discussed as a separate specification = here.

    Transmitters and Receivers in SSE
    The SSE profile defines transmitters and receivers as hosts = that manage streams between peers. The receiver authenticates to the = transmitter using OAuth, requiring the use of a secret per receiver. In = a multi-tenanted host that handles hundreds of thousands or millions of = independent tenants, maintaining such a secret per instance of a = receiver is cumbersome. Furthermore, since a transmitter and a receiver = has to maintain a stream per pair, creating such per-tenant streams can = add significant implementation overhead.

    SPAGs
    Therefore, we need a notion of a grouping of subjects within = the same transmitter and receiver to distinguish between various = administrative groupings that exist within a host. These groupings could = include tenants, organizational units or user groups.. This grouping is = captured in the notion of a SPAG. The uniqueness of a user identifier = (subject identifier) may also be limited to a SPAG. For example, if a = random unique ID represents a user, then that ID may be unique within a = SPAG and not universally across a transmitter or receiver. This is = because each transmitter and receiver may have multiple connections to = other transmitters and receivers, and ensuring uniqueness across all = such peers is probably an intractable problem.

    Subject = Principals
    While what is represented within a = subject identifier may be only an aspect of the management entity, the = administrative grouping is about the management entity itself.. This = could be the user, device or other principal that the subject identifier = represents. Therefore, an abstract notion of a Subject Principal is also = required in order specify what the grouping within a SPAG is = about.

    The = above is captured in the "Subject Principal" and "SPAG" sections within = the proposed PR.

    Thanks,
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    _______________________________________________
    Id-event = mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    = --Apple-Mail=_2C6063B1-06D3-46CC-8D4D-F9D703007486-- From nobody Mon Jul 13 15:06:03 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 875973A0E6D for ; Mon, 13 Jul 2020 15:05:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.598 X-Spam-Level: X-Spam-Status: No, score=-17.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B7ERAt07CzB2 for ; Mon, 13 Jul 2020 15:05:54 -0700 (PDT) Received: from mail-yb1-xb33.google.com (mail-yb1-xb33.google.com [IPv6:2607:f8b0:4864:20::b33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8CDB3A0E45 for ; Mon, 13 Jul 2020 15:05:51 -0700 (PDT) Received: by mail-yb1-xb33.google.com with SMTP id 2so7184521ybr.13 for ; Mon, 13 Jul 2020 15:05:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GqmADpEWsQw7xw/KMnumhtl/LL3uK3QX1UEytwEwQ+o=; b=VMnbGDqTynvF38HfwH6kAjbkRC3G2CF+8C4pHQXJGnj9YFecuHHXqmtYSggdPH4ADE 6gh9Z0GYqVHXUAsuLWr7x0Yh2gWSvwkWPffN0/60u/Huj5jiMOq+2i9mwlA+6+ZFigNP Ro8cDa/8me7QpGppOAOi31XwqlBw0d/Us7XsuAdbifeDxW2Mz+Vw5t/eGHUh/wY91iaV vAum4lvpwrsBJz2jqzohpJ0Q/bKwc3nE1/aNOqnDcsmkYVWXqlg689aHBCgyK2U9DpuE 8Xb003HgMHSJXXVkNQyCSp+6O7cMS+Brp1ZkFAHTdz0bbk5z/aOEH3YMkVnd7L0pCeIk dWjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GqmADpEWsQw7xw/KMnumhtl/LL3uK3QX1UEytwEwQ+o=; b=cYo7E20r44Nx7P9ZPYd1sgayqf/FKnKHMwBxkspXSFAXEExqFAZ6K6HzBOb3BZksNC 7x7TCgfKLaSoqrus7iPlxSXzgTIYzfyEomvW1Dyhcce29oG/jYrcHHZF/Fn6K6Zwsx1V eHXPThdC/2MmoOPU11eg6W3sntqz9aFDxOyeBKLEqTXpWi5OwHNFO4uYoFv+aKw58BlS 3mb0SIyDXL2kW4Wpi9k04kj/2m5j5u6p+AjoDyBE51bv7pNCXLQI5URLJrfa1rL+AZB+ xPyXV5J/dPuJyifzoKf1iX9rpfliz5itoyVlcwMM2YuBjdgsWWZCsV2h445DiWQZYWsD fWCQ== X-Gm-Message-State: AOAM5328gV3SWPR5tFqGTYCyPjzcmnP3vh1gLf7k4Ckj9Dnu2YHrzhb+ qEPTLuHaOBUgEBrDUSaBG62eDUp+nWA574mccx8Zjgad X-Google-Smtp-Source: ABdhPJxppSByTBwlNn9kFj/7sAiPdk2HNt3v7LlUyOD4h1BZmqHjpb1MwFDnAYPbrmSVSBSlePCPWsq9+7M4m4KbUsw= X-Received: by 2002:a25:bc13:: with SMTP id i19mr3279375ybh.391.1594677950517; Mon, 13 Jul 2020 15:05:50 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 15:05:38 -0700 Message-ID: To: Dick Hardt Cc: SecEvent Content-Type: multipart/alternative; boundary="000000000000c6026105aa59e4a5" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 22:06:02 -0000 --000000000000c6026105aa59e4a5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable That could be true but there are a few ways in which it can be avoided: 1. The peers leverage some higher-level trust to accept / decline events relating to lower level SPAGs. For example, if trust is established at a tenant level, then an OU level SPAG need not have its own authorization. 2. The secret required for establishing the authorization of a SPAG may be temporary. For example: 1. An administrator signs in to their tenant in the transmitter's administrator console 2. The admin obtains a temporary authorization (one-time code) 3. The admin signs in to their tenant in the receiver's administration console and pastes in the one-time code 4. The receiver sends a request to enable the stream for the specified SPAG with that one-time authorization. In the first case, there are no additional secrets required. In the second case, the secret is temporary. On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt wrote: > I see the SPAG lets the transmitter and receiver provide context, as the > subject identifier may be the same across SPAGs. > > Now I'm trying to understand how the transmitter authenticates to the > receiver if it does not have it's own secret (assuming that authenticatio= n > model) -- IE, how does the receiver know the transmitter is authorized fo= r > that SPAG? > > > On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale > wrote: > >> Dick, your understanding is correct. >> >> To clarify the proposal here, Here's the text I'm proposing to be added: >> >> 3. Subject Principals >> >> Subject Principals are the management entities associated with >> Subjects. These may be human or robotic principals or devices or >> other entities that are managed by transmitters and receivers. For >> example, the same Subject Principal may be referred to by an email >> address or a phone number. A transmitter or receiver will typically >> manage subject principals and organize them into sub-groupings such >> as tenants, groups, organizational units, etc. >> >> Subjects are identified by Subject Identifiers defined below. >> >> 3.1. SPAGs >> >> Subject Principals MAY be grouped for administrative purposes into >> "Subject Principal Administrative Groupings" or SPAGs. For example, >> all users belonging to one customer of a "multi-tenanted" Transmitter >> may be in one SPAG. Alternatively, an Organizational Unit or a group >> of Subjects within a customer of a Transmitter (whether multi- >> tenanted or not) may be one SPAG. SPAGs may have overlapping sets of >> Subjects. >> >> A SPAG MAY be the Subject of certain stream update events defined >> later in this spec, hence is defined as a Subject Type of its own >> below. A SPAG identifier MAY be included in other subject types to >> disambiguate the subject. >> >> A SPAG subject identifier is agreed to offline between a transmitter >> and a receiver. >> >> The benefits of doing this are: >> >> 1. Multi-tenanted hosts do not need to maintain secrets per tenant >> and per transmitter tenant if each tenant has to be an event transmit= ter >> and an event receiver of its own. >> 2. An event stream may be established between two multi-tenanted >> hosts, and so does not need to be managed at a per-tenant level >> 3. The same subject or subject principal may be a part of multiple >> SPAGs, and identifying the SPAG that an event relates to can be achie= ved if >> the standard allows for the SPAGs to be identified. >> >> >> >> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt wrote= : >> >>> To clarify, your proposal is driven by the implementation burden of >>> maintaining separate secrets / streams between a transmitter and receiv= er? >>> =E1=90=A7 >>> >>> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale >> 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >>> >>>> Hi all, >>>> Here's a quick background for the proposal >>>> for including Subject >>>> Principals and Subject Principal Administrative Groupings or SPAGs in = the >>>> Subject Identifiers spec. >>>> >>>> *Use of Subject Identifiers in Shared Signals and Events*: >>>> The Shared Signals and Events (SSE) profile of SETs specifies that >>>> transmitters and receivers send and receive SETs that contain Subject >>>> Identifiers. These subject identifiers have the format that is now bei= ng >>>> discussed as a separate specification here. >>>> >>>> *Transmitters and Receivers in SSE* >>>> The SSE profile defines transmitters and receivers as hosts that manag= e >>>> streams between peers. The receiver authenticates to the transmitter u= sing >>>> OAuth, requiring the use of a secret per receiver. In a multi-tenanted= host >>>> that handles hundreds of thousands or millions of independent tenants, >>>> maintaining such a secret per instance of a receiver is cumbersome. >>>> Furthermore, since a transmitter and a receiver has to maintain a stre= am >>>> per pair, creating such per-tenant streams can add significant >>>> implementation overhead. >>>> >>>> *SPAGs* >>>> Therefore, we need a notion of a grouping of subjects within the same >>>> transmitter and receiver to distinguish between various administrative >>>> groupings that exist within a host. These groupings could include tena= nts, >>>> organizational units or user groups.. This grouping is captured in the >>>> notion of a SPAG. The uniqueness of a user identifier (subject identif= ier) >>>> may also be limited to a SPAG. For example, if a random unique ID >>>> represents a user, then that ID may be unique within a SPAG and not >>>> universally across a transmitter or receiver. This is because each >>>> transmitter and receiver may have multiple connections to other >>>> transmitters and receivers, and ensuring uniqueness across all such pe= ers >>>> is probably an intractable problem. >>>> >>>> *Subject Principals* >>>> While what is represented within a subject identifier may be only an >>>> aspect of the management entity, the administrative grouping is about = the >>>> management entity itself. This could be the user, device or other prin= cipal >>>> that the subject identifier represents. Therefore, an abstract notion = of a >>>> Subject Principal is also required in order specify what the grouping >>>> within a SPAG is about. >>>> >>>> The above is captured in the "Subject Principal" and "SPAG" sections >>>> within the proposed PR . >>>> >>>> Thanks, >>>> Atul >>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://www.ietf.org/mailman/listinfo/id-event >>>> >>> --000000000000c6026105aa59e4a5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    That could be true but there are a few ways in which it ca= n be avoided:
    1. The peers leverage some higher-level trust to acc= ept / decline events relating to lower level SPAGs. For example, if trust i= s established at a tenant level, then an OU level SPAG need not have its ow= n authorization.
    2. The secret required for establishing the authoriza= tion of a SPAG may be temporary. For example:
      1. An administrator = signs in to their tenant in the transmitter's administrator console
      2. The admin obtains a temporary authorization (one-time code)
      3. Th= e admin signs in to their tenant in the receiver's administration conso= le and pastes in the one-time code
      4. The receiver sends a request to = enable the stream for the specified SPAG with that one-time authorization.<= /li>
    In the first case, there are no additional secrets requi= red. In the second case, the secret is temporary.



    On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    I see the = SPAG lets the transmitter and receiver provide context, as the subject iden= tifier may be the same across SPAGs.

    Now I'm trying = to understand how the transmitter authenticates to the receiver if it does = not have it's own secret (assuming that authentication model) -- IE, ho= w does the receiver know the transmitter is authorized=C2=A0for that SPAG?<= /div>


    On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale <= atultulshi@googl= e.com> wrote:
    Dick, your understanding is correct.
    <= br>
    To clarify the proposal here, Here's the text I'm proposin= g to be added:

    3.=C2=A0 Subject Principals=

    =C2=A0 =C2=A0Subject Principals are the management entities associa= ted with
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or robotic prin= cipals or devices or
    =C2=A0 =C2=A0other entities that are managed by tra= nsmitters and receivers.=C2=A0 For
    =C2=A0 =C2=A0example, the same Subjec= t Principal may be referred to by an email
    =C2=A0 =C2=A0address or a pho= ne number.=C2=A0 A transmitter or receiver will typically
    =C2=A0 =C2=A0m= anage subject principals and organize them into sub-groupings such
    =C2= =A0 =C2=A0as tenants, groups, organizational units, etc.

    =C2=A0 =C2= =A0Subjects are identified by Subject Identifiers defined below.

    3.1= .=C2=A0 SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be grouped for adm= inistrative purposes into
    =C2=A0 =C2=A0"Subject Principal Administr= ative Groupings" or SPAGs.=C2=A0 For example,
    =C2=A0 =C2=A0all user= s belonging to one customer of a "multi-tenanted" Transmitter
    = =C2=A0 =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organizational Uni= t or a group
    =C2=A0 =C2=A0of Subjects within a customer of a Transmitter= (whether multi-
    =C2=A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SP= AGs may have overlapping sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 = =C2=A0A SPAG MAY be the Subject of certain stream update events defined
    = =C2=A0 =C2=A0later in this spec, hence is defined as a Subject Type of its = own
    =C2=A0 =C2=A0below.=C2=A0 A SPAG identifier MAY be included in other= subject types to
    =C2=A0 =C2=A0disambiguate the subject.

    =C2=A0 = =C2=A0A SPAG subject identifier is agreed to offline between a transmitter<= br>=C2=A0 =C2=A0and a receiver.

    The benefits of do= ing this are:
    1. Multi-tenanted hosts do not need to maintai= n secrets per tenant and per transmitter tenant if each tenant has to be an= event transmitter and an event receiver of its own.
    2. An event strea= m may be established between two multi-tenanted hosts, and so does not need= to be managed at a per-tenant level
    3. The same subject or subject pr= incipal may be a part of multiple SPAGs, and identifying the SPAG that an e= vent relates to can be achieved if the standard allows for the SPAGs to be = identified.


    On Mon, Jul 13, 2020 at 11:32 AM = Dick Hardt <di= ck.hardt@gmail.com> wrote:
    To clarify, your proposal is driven by t= he implementation=C2=A0burden of maintaining separate secrets / streams bet= ween a transmitter and receiver?
    3D""=E1=90=A7
    On Mo= n, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ie= tf.org> wrote:
    Hi all,=C2=A0
    Here's a quick background for = the proposal for including Subject Principals and Subject Principal Admi= nistrative Groupings or SPAGs in the Subject Identifiers spec.
    Use of Subject Identifiers in Shared Signals and Events= :
    The Shared Signals and Events (SSE) profile of SETs specifies t= hat transmitters and receivers send and receive SETs that contain Subject I= dentifiers. These subject identifiers have the format that is now being dis= cussed as a separate specification here.

    Tr= ansmitters and Receivers in SSE
    The SSE profile defines trans= mitters and receivers as hosts that manage streams between peers. The recei= ver authenticates to the transmitter using OAuth, requiring the use of a se= cret per receiver. In a multi-tenanted host that handles hundreds of thousa= nds or millions of independent tenants, maintaining such a secret per insta= nce of a receiver is cumbersome. Furthermore, since a transmitter and a rec= eiver has to maintain a stream per pair, creating such per-tenant streams c= an add significant implementation overhead.

    SPA= Gs
    Therefore, we need a notion of a grouping of subjects with= in the same transmitter and receiver to distinguish between various adminis= trative groupings that exist within a host. These groupings could include t= enants, organizational units or user groups.. This grouping is captured in = the notion of a SPAG. The uniqueness of a user identifier (subject identifi= er) may also be limited to a SPAG. For example, if a random unique ID repre= sents a user, then that ID may be unique within a SPAG and not universally = across a transmitter or receiver. This is because each transmitter and rece= iver may have multiple connections to other transmitters and receivers, and= ensuring uniqueness across all such peers is probably an intractable probl= em.

    Subject Principals
    While what= is represented within a subject identifier may be only an aspect of the ma= nagement entity, the administrative grouping is about the management entity= itself. This could be the user, device or other principal that the subject= identifier represents. Therefore, an abstract notion of a Subject Principa= l is also required in order specify what the grouping within a SPAG is abou= t.

    The above is captured in the "Subject Prin= cipal" and "SPAG" sections within the proposed PR.
    <= div>
    Thanks,
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --000000000000c6026105aa59e4a5-- From nobody Mon Jul 13 15:09:08 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 110533A098D for ; Mon, 13 Jul 2020 15:09:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.118 X-Spam-Level: X-Spam-Status: No, score=-2.118 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=verizonwireless.com header.b=CKaXMu7A; dkim=pass (2048-bit key) header.d=verizonwireless-com.20150623.gappssmtp.com header.b=Rck6Jwei Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OaInYhId9sNy for ; Mon, 13 Jul 2020 15:09:06 -0700 (PDT) Received: from mx0b-0024a201.pphosted.com (mx0b-0024a201.pphosted.com [148.163.153.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F14113A0917 for ; Mon, 13 Jul 2020 15:09:05 -0700 (PDT) Received: from pps.filterd (m0115887.ppops.net [127.0.0.1]) by mx0b-0024a201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06DM4PY1177516 for ; Mon, 13 Jul 2020 18:09:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verizonwireless.com; h=mime-version : from : date : message-id : subject : to : cc : content-type; s=prodmail; bh=QHHII3j2K3mj/r1JZxNO06YnBhQlNXM5yj7QZIVMzhI=; b=CKaXMu7ATE2a0qKfV9YzYR8Mq4sV55X6YvFTsX7V+XcZMLd9suuqb/qVjuFRKO6bY4W0 5AevF1Q5z0KRcatV71Ng0wMvYOpOohVLMoLj4eZDrEWoZ2cUbydhuCJzgOPygD74D+AJ opytx3v27YQ4eZI5CQvLNOp5FV8MzegGCps= Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by mx0b-0024a201.pphosted.com with ESMTP id 3277ykuj40-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Mon, 13 Jul 2020 18:09:05 -0400 Received: by mail-pf1-f200.google.com with SMTP id o5so10259981pfg.10 for ; Mon, 13 Jul 2020 15:09:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verizonwireless-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to:cc; bh=QHHII3j2K3mj/r1JZxNO06YnBhQlNXM5yj7QZIVMzhI=; b=Rck6Jweim6o4EDGw+fq+jGtU1Ovq9y+bpK/g6mZvTVhnYkaE0wSldpBMFguGpgVBuW 0sCsL0rHglsjRQjQKSLKkDwiCtocOfHaUTOczHIahqyz+Qxhuf5f/9+CkkrzBZ9nEvj0 AS0pdI+SDJYpk68uTpy/leADWwzEsLkD6pJ9qwOR9JZ4AR1jmcSsUHT/I6Fi64BThaud Sj9PfcIKfg0xK5U8irUA6Yu4rR4V5viW+4TmQGG75mJ7kyS4r22OWomqhOi+tmJduLg8 MFN4rf5mzdE4w7cZhRXOBfGfYEFmj31Z78wUuAHl59o7NIxULpOsmRokiMuyOY4l9jRF eKfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=QHHII3j2K3mj/r1JZxNO06YnBhQlNXM5yj7QZIVMzhI=; b=pRaN5bvf/HMrgd8g5x95fwWGboQRl/7OLn5y2rY2AmjRKLEFgaB/2/SH+W8W43qoB2 yMK0toman+bUlnJpb/xNe0Tbkm3iUVowbuCdFoPi8B8phXpa+go189psAzmRxWIK2Zt1 HldoOODeCcYcKOjpuwW4ndW3RRxseCAjiQbG8ngcXFrS1me/z9oiRFq76qRxq7NFY4g8 7sBfRC6QcFwWOynPuLlqP6BNK2rJk8oHa81T+TXDPGfKsfclf+EYplgpjO/mW2y6PEAo 37vf3HjlDzHe7BiwjO66dbx/WNMr1M8zAsYgHY6eParlVZeQt6rWqphaC9Ep8QnrNJPP KfTQ== X-Gm-Message-State: AOAM532KZEfV89vpXFbECasP1jPe1+KEQhPS7Cd4u8XHrtt2eYT6lvHD A1BuH+vP5AUjh9qvmPiEJZrEn89aocuzHeclKt+V5IA/M7P8jqekCBLCgG8BwgIn0OINQ0VAF9r BIheBsyrj5GHNiqJbyJAO1GdO7A== X-Received: by 2002:a17:90b:213:: with SMTP id fy19mr1415534pjb.41.1594678143523; Mon, 13 Jul 2020 15:09:03 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzFYYcajRJCFcOfJeFLi9xCt3yRNWc0CrFo56/VDib/TxBr/G6xA+g+kOpZCv/Ekn16fPfEcufPDCxg7JJ+wew= X-Received: by 2002:a17:90b:213:: with SMTP id fy19mr1415490pjb.41.1594678142820; Mon, 13 Jul 2020 15:09:02 -0700 (PDT) MIME-Version: 1.0 From: "Hjelm, Bjorn" Date: Mon, 13 Jul 2020 15:08:51 -0700 Message-ID: To: id-event@ietf.org Cc: "Richard Backman, Annabelle" Content-Type: multipart/alternative; boundary="0000000000003c016505aa59f00e" X-mailroute: internal X-Proofpoint-Spam-Details: rule=out_spam_notspam policy=out_spam score=0 priorityscore=1501 suspectscore=0 mlxlogscore=895 phishscore=0 spamscore=0 bulkscore=0 clxscore=1015 malwarescore=0 adultscore=0 mlxscore=0 lowpriorityscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007130157 Archived-At: Subject: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 22:09:08 -0000 --0000000000003c016505aa59f00e Content-Type: text/plain; charset="UTF-8" I've reviewed this version of the draft a couple of times and I only have a minor comment related to section 7.1.1 that makes a reference to "OpenID Foundation RISC Working Group" that has been renamed to Shared Signals and Events Working Group . My previous review comments related to the "phone_number" claim have already been addressed in this version. It may be worth noting that the claim "msisdn" has been proposed in the draft OpenID Connect for Identity Assurance specification and represents an en-user's mobile phone number (formatted according to ITU-T recommendation E.164). Though not yet registered in IANA, it may be proposed as a "Mobile Phone Number Subject Identifier Type" in the next version of this document. BR, Bjorn --0000000000003c016505aa59f00e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    I've reviewed this version of the draft a couple = of times and I only have a minor comment related to s= ection 7.1.1 that makes a reference to "OpenID Foundation RISC Wor= king Group" that has been renamed to Shared Signals and Events Working Group.

    My previous review comments related to the "phone_number" claim = have already been addressed in this version.

    I= t may be worth noting that the claim "msisdn" has been proposed i= n the draft OpenID Connect for Identity Assurance=C2=A0specifica= tion and represents an en-user's=C2=A0mobile phone number (formatted ac= cording to ITU-T recommendation E.164). Though not yet registered in IANA, = it may be proposed as a "Mobile Phone Number Subject Identifier Type&q= uot; in the next version of this=C2=A0document.

    BR,
    Bjorn
    --0000000000003c016505aa59f00e-- From nobody Mon Jul 13 15:26:15 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BE353A0A29 for ; Mon, 13 Jul 2020 15:26:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7BFaz5kpOFou for ; Mon, 13 Jul 2020 15:26:06 -0700 (PDT) Received: from mail-lj1-x231.google.com (mail-lj1-x231.google.com [IPv6:2a00:1450:4864:20::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D05623A0A26 for ; Mon, 13 Jul 2020 15:25:45 -0700 (PDT) Received: by mail-lj1-x231.google.com with SMTP id e8so20043761ljb.0 for ; Mon, 13 Jul 2020 15:25:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MnRjXKymShRkBdFcnh04vYnTS3v1AlqZZso8fWTI2BM=; b=L8h9og2QC98/ut34t0zz0/Nb1On9+Viv6KirMEuqTTMEcjMAdIfG/igl/FOV/i0amK +yG3xFTi4Oz8eppNmDzv2QgxxJ+eIQPM+AW7HHLDmGA3MUNNR6dMt3A7yryO5A2OqjDV zhaL0ib4e8YB25APSXT4eAHmdVXGkH5LlNw6SlCpCKpnxn/5OeS0+WCdRONEfqOYbWr8 jnwUHPAaGzagU+Ff1KHNxM0SkGpe1GHNkaCWjYuJQ5IpMoh3WGAVu4gN+uPUL7Zjt1kd Qi++0hPvXROLuxxj0JI4Slp9YRZcyaWxlncVbmlme8gz8irYoCbeVlVUPg7rBv4JW62G 6+Ag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MnRjXKymShRkBdFcnh04vYnTS3v1AlqZZso8fWTI2BM=; b=RziTL+qdDsQZWbtzk+CpBm1UghFJoBIWELnKRIugZRhDJHmD4xjgmDjCRRl2Wb7XPZ eDMbF7QpwkFzEFBkec9p/L8HSupdzEHnqFwpA4hRL7mAuvrkQp3zMyydGpp8lV5tzHRi 5nFRA1eomRh9hO9DWaVjvsrazrTXUcML8/ytPhvXkWhGpTsGL+wygprMXZzdLcRuTPOn cCxQo4YSoqGGdoLrWFvi3rqe0jHlPJT98J3PYvaHKIK8PN/DqCaIHVY+VYxTLwWzd5ig 2IPpT3k7PdBJhlegjWNC9j4WjfPIdr1iobtremJ43XUz1dgMWFlB+hW7dhMoaXfxBvjB wWhA== X-Gm-Message-State: AOAM533FDa/LY5u5P9llLIL5R3s4YbWYnKOD2mO+0Y3IbDoQIov73Vu+ HmK8rsreVDZoox8Q6oSJctphqXUJGgRYvHKiu7c= X-Google-Smtp-Source: ABdhPJxK1zedCpJAoidRdmwB72wBBGaeql+BkX25OBQeVaZICydmPK507DO1F3Lct/RdnyoER7goW3OUHJ1fIdlLKkw= X-Received: by 2002:a2e:b70b:: with SMTP id j11mr844863ljo.142.1594679143652; Mon, 13 Jul 2020 15:25:43 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Mon, 13 Jul 2020 15:25:07 -0700 Message-ID: To: Atul Tulshibagwale Cc: SecEvent Content-Type: multipart/alternative; boundary="000000000000e35f9f05aa5a2b46" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 22:26:14 -0000 --000000000000e35f9f05aa5a2b46 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Would a transmitter that is only in one SPAG (a single tenant system) have to include its SPAG id in events sent to a receiver that accepts events from multiple SPAGs? But it would not include it in sending events to other receivers that have separate credentials for each relationship? =E1=90=A7 On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale wrote: > That could be true but there are a few ways in which it can be avoided: > > 1. The peers leverage some higher-level trust to accept / decline > events relating to lower level SPAGs. For example, if trust is establi= shed > at a tenant level, then an OU level SPAG need not have its own > authorization. > 2. The secret required for establishing the authorization of a SPAG > may be temporary. For example: > 1. An administrator signs in to their tenant in the transmitter's > administrator console > 2. The admin obtains a temporary authorization (one-time code) > 3. The admin signs in to their tenant in the receiver's > administration console and pastes in the one-time code > 4. The receiver sends a request to enable the stream for the > specified SPAG with that one-time authorization. > > In the first case, there are no additional secrets required. In the secon= d > case, the secret is temporary. > > > > On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt wrote: > >> I see the SPAG lets the transmitter and receiver provide context, as the >> subject identifier may be the same across SPAGs. >> >> Now I'm trying to understand how the transmitter authenticates to the >> receiver if it does not have it's own secret (assuming that authenticati= on >> model) -- IE, how does the receiver know the transmitter is authorized f= or >> that SPAG? >> >> >> On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale >> wrote: >> >>> Dick, your understanding is correct. >>> >>> To clarify the proposal here, Here's the text I'm proposing to be added= : >>> >>> 3. Subject Principals >>> >>> Subject Principals are the management entities associated with >>> Subjects. These may be human or robotic principals or devices or >>> other entities that are managed by transmitters and receivers. For >>> example, the same Subject Principal may be referred to by an email >>> address or a phone number. A transmitter or receiver will typically >>> manage subject principals and organize them into sub-groupings such >>> as tenants, groups, organizational units, etc. >>> >>> Subjects are identified by Subject Identifiers defined below. >>> >>> 3.1. SPAGs >>> >>> Subject Principals MAY be grouped for administrative purposes into >>> "Subject Principal Administrative Groupings" or SPAGs. For example, >>> all users belonging to one customer of a "multi-tenanted" Transmitte= r >>> may be in one SPAG. Alternatively, an Organizational Unit or a grou= p >>> of Subjects within a customer of a Transmitter (whether multi- >>> tenanted or not) may be one SPAG. SPAGs may have overlapping sets o= f >>> Subjects. >>> >>> A SPAG MAY be the Subject of certain stream update events defined >>> later in this spec, hence is defined as a Subject Type of its own >>> below. A SPAG identifier MAY be included in other subject types to >>> disambiguate the subject. >>> >>> A SPAG subject identifier is agreed to offline between a transmitter >>> and a receiver. >>> >>> The benefits of doing this are: >>> >>> 1. Multi-tenanted hosts do not need to maintain secrets per tenant >>> and per transmitter tenant if each tenant has to be an event transmi= tter >>> and an event receiver of its own. >>> 2. An event stream may be established between two multi-tenanted >>> hosts, and so does not need to be managed at a per-tenant level >>> 3. The same subject or subject principal may be a part of multiple >>> SPAGs, and identifying the SPAG that an event relates to can be achi= eved if >>> the standard allows for the SPAGs to be identified. >>> >>> >>> >>> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt >>> wrote: >>> >>>> To clarify, your proposal is driven by the implementation burden of >>>> maintaining separate secrets / streams between a transmitter and recei= ver? >>>> =E1=90=A7 >>>> >>>> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale >>> 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >>>> >>>>> Hi all, >>>>> Here's a quick background for the proposal >>>>> for including Subject >>>>> Principals and Subject Principal Administrative Groupings or SPAGs in= the >>>>> Subject Identifiers spec. >>>>> >>>>> *Use of Subject Identifiers in Shared Signals and Events*: >>>>> The Shared Signals and Events (SSE) profile of SETs specifies that >>>>> transmitters and receivers send and receive SETs that contain Subject >>>>> Identifiers. These subject identifiers have the format that is now be= ing >>>>> discussed as a separate specification here. >>>>> >>>>> *Transmitters and Receivers in SSE* >>>>> The SSE profile defines transmitters and receivers as hosts that >>>>> manage streams between peers. The receiver authenticates to the trans= mitter >>>>> using OAuth, requiring the use of a secret per receiver. In a >>>>> multi-tenanted host that handles hundreds of thousands or millions of >>>>> independent tenants, maintaining such a secret per instance of a rece= iver >>>>> is cumbersome. Furthermore, since a transmitter and a receiver has to >>>>> maintain a stream per pair, creating such per-tenant streams can add >>>>> significant implementation overhead. >>>>> >>>>> *SPAGs* >>>>> Therefore, we need a notion of a grouping of subjects within the same >>>>> transmitter and receiver to distinguish between various administrativ= e >>>>> groupings that exist within a host. These groupings could include ten= ants, >>>>> organizational units or user groups.. This grouping is captured in th= e >>>>> notion of a SPAG. The uniqueness of a user identifier (subject identi= fier) >>>>> may also be limited to a SPAG. For example, if a random unique ID >>>>> represents a user, then that ID may be unique within a SPAG and not >>>>> universally across a transmitter or receiver. This is because each >>>>> transmitter and receiver may have multiple connections to other >>>>> transmitters and receivers, and ensuring uniqueness across all such p= eers >>>>> is probably an intractable problem. >>>>> >>>>> *Subject Principals* >>>>> While what is represented within a subject identifier may be only an >>>>> aspect of the management entity, the administrative grouping is about= the >>>>> management entity itself. This could be the user, device or other pri= ncipal >>>>> that the subject identifier represents. Therefore, an abstract notion= of a >>>>> Subject Principal is also required in order specify what the grouping >>>>> within a SPAG is about. >>>>> >>>>> The above is captured in the "Subject Principal" and "SPAG" sections >>>>> within the proposed PR . >>>>> >>>>> Thanks, >>>>> Atul >>>>> >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>> >>>> --000000000000e35f9f05aa5a2b46 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Would a transmitter that is only in one SPAG (a single ten= ant system) have to include its SPAG id in events sent to a receiver that a= ccepts events from multiple SPAGs? But it would not include it in sending e= vents to other receivers=C2=A0that have separate credentials for each relat= ionship?



    3D""=E1=90= =A7

    On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    That c= ould be true but there are a few ways in which it can be avoided:
      <= li>The peers leverage some higher-level trust to accept / decline events re= lating to lower level SPAGs. For example, if trust is established at a tena= nt level, then an OU level SPAG need not have its own authorization.The secret required for establishing the authorization of a SPAG may be t= emporary. For example:
      1. An administrator signs in to their tenan= t in the transmitter's administrator console
      2. The admin obtains = a temporary authorization (one-time code)
      3. The admin signs in to the= ir tenant in the receiver's administration console and pastes in the on= e-time code
      4. The receiver sends a request to enable the stream for t= he specified SPAG with that one-time authorization.
    In t= he first case, there are no additional secrets required. In the second case= , the secret is temporary.


    <= br>
    On Mon,= Jul 13, 2020 at 2:34 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    I see the SPAG = lets the transmitter and receiver provide context, as the subject identifie= r may be the same across SPAGs.

    Now I'm trying to un= derstand how the transmitter authenticates to the receiver if it does not h= ave it's own secret (assuming that authentication model) -- IE, how doe= s the receiver know the transmitter is authorized=C2=A0for that SPAG?
    =


    On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale <atultulshi@google.co= m> wrote:
    Dick, your understanding is correct.

    <= /div>To clarify the proposal here, Here's the text I'm proposing to= be added:

    3.=C2=A0 Subject Principals
    =
    =C2=A0 =C2=A0Subject Principals are the management entities associated = with
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or robotic principa= ls or devices or
    =C2=A0 =C2=A0other entities that are managed by transmi= tters and receivers.=C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Pr= incipal may be referred to by an email
    =C2=A0 =C2=A0address or a phone n= umber.=C2=A0 A transmitter or receiver will typically
    =C2=A0 =C2=A0manag= e subject principals and organize them into sub-groupings such
    =C2=A0 = =C2=A0as tenants, groups, organizational units, etc.

    =C2=A0 =C2=A0Su= bjects are identified by Subject Identifiers defined below.

    3.1.=C2= =A0 SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be grouped for adminis= trative purposes into
    =C2=A0 =C2=A0"Subject Principal Administrativ= e Groupings" or SPAGs.=C2=A0 For example,
    =C2=A0 =C2=A0all users be= longing to one customer of a "multi-tenanted" Transmitter
    =C2= =A0 =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organizational Unit o= r a group
    =C2=A0 =C2=A0of Subjects within a customer of a Transmitter (w= hether multi-
    =C2=A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs= may have overlapping sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2= =A0A SPAG MAY be the Subject of certain stream update events defined
    =C2= =A0 =C2=A0later in this spec, hence is defined as a Subject Type of its own=
    =C2=A0 =C2=A0below.=C2=A0 A SPAG identifier MAY be included in other su= bject types to
    =C2=A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2= =A0A SPAG subject identifier is agreed to offline between a transmitter
    = =C2=A0 =C2=A0and a receiver.

    The benefits of doing= this are:
    1. Multi-tenanted hosts do not need to maintain s= ecrets per tenant and per transmitter tenant if each tenant has to be an ev= ent transmitter and an event receiver of its own.
    2. An event stream m= ay be established between two multi-tenanted hosts, and so does not need to= be managed at a per-tenant level
    3. The same subject or subject princ= ipal may be a part of multiple SPAGs, and identifying the SPAG that an even= t relates to can be achieved if the standard allows for the SPAGs to be ide= ntified.


    On Mon, Jul 13, 2020 at 11:32 AM Dic= k Hardt <dick.= hardt@gmail.com> wrote:
    To clarify, your proposal is driven by the = implementation=C2=A0burden of maintaining separate secrets / streams betwee= n a transmitter and receiver?
    3D""=E1=90=A7
    On Mon, J= ul 13, 2020 at 9:01 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.o= rg> wrote:
    Hi all,=C2=A0
    Here's a quick background for the = p= roposal for including Subject Principals and Subject Principal Administ= rative Groupings or SPAGs in the Subject Identifiers spec.

    Use of Subject Identifiers in Shared Signals and Events:
    The Shared Signals and Events (SSE) profile of SETs specifies that = transmitters and receivers send and receive SETs that contain Subject Ident= ifiers. These subject identifiers have the format that is now being discuss= ed as a separate specification here.

    Transm= itters and Receivers in SSE
    The SSE profile defines transmitt= ers and receivers as hosts that manage streams between peers. The receiver = authenticates to the transmitter using OAuth, requiring the use of a secret= per receiver. In a multi-tenanted host that handles hundreds of thousands = or millions of independent tenants, maintaining such a secret per instance = of a receiver is cumbersome. Furthermore, since a transmitter and a receive= r has to maintain a stream per pair, creating such per-tenant streams can a= dd significant implementation overhead.

    SPAGs
    Therefore, we need a notion of a grouping of subjects within t= he same transmitter and receiver to distinguish between various administrat= ive groupings that exist within a host. These groupings could include tenan= ts, organizational units or user groups.. This grouping is captured in the = notion of a SPAG. The uniqueness of a user identifier (subject identifier) = may also be limited to a SPAG. For example, if a random unique ID represent= s a user, then that ID may be unique within a SPAG and not universally acro= ss a transmitter or receiver. This is because each transmitter and receiver= may have multiple connections to other transmitters and receivers, and ens= uring uniqueness across all such peers is probably an intractable problem.<= /div>

    Subject Principals
    While what is = represented within a subject identifier may be only an aspect of the manage= ment entity, the administrative grouping is about the management entity its= elf. This could be the user, device or other principal that the subject ide= ntifier represents. Therefore, an abstract notion of a Subject Principal is= also required in order specify what the grouping within a SPAG is about.

    The above is captured in the "Subject Principa= l" and "SPAG" sections within the proposed PR.
    =
    Thanks,
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --000000000000e35f9f05aa5a2b46-- From nobody Mon Jul 13 15:33:49 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBB8B3A08D7 for ; Mon, 13 Jul 2020 15:33:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.598 X-Spam-Level: X-Spam-Status: No, score=-17.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M5_PFWOXgiZC for ; Mon, 13 Jul 2020 15:33:45 -0700 (PDT) Received: from mail-yb1-xb32.google.com (mail-yb1-xb32.google.com [IPv6:2607:f8b0:4864:20::b32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 988A43A0AEE for ; Mon, 13 Jul 2020 15:33:18 -0700 (PDT) Received: by mail-yb1-xb32.google.com with SMTP id x138so5650501ybg.9 for ; Mon, 13 Jul 2020 15:33:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Qn2bRCAQvHlSqJIQcEZ0OWa3oWPQ2k0+toQBXIE6v0A=; b=wOK4htYrmHilNHE6sIu6DKRYTVRSAFREOoIj1k1lsBhi/g2ojl/mIKBPpz9MB8lRdQ Qx0unh4BXouXyLRe1Ezhjj18vrz0DNS+CNq4j5+/s/v5divOVA6ccwhz6zRyp/G9F9qN G8jGFB23RwaCxqwMFhhplUKAFLjAlOmC//FOSpjYZt2ze7On+l2kQL0HOcfeT6f8O5CX JpLQEgOJJgt00v8ZR434Wcy5IBw+uYETMnW7pPHL4Qs08/3mLBPffSrakjprTsxmtnAI p4VALxeuvtXaM6JXGrI3Ugd4WqX+WbY3Sp2pHj477rVNjHvOO54BrcJaqc2FmUpYO6i1 0XHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Qn2bRCAQvHlSqJIQcEZ0OWa3oWPQ2k0+toQBXIE6v0A=; b=O2fzVZhB7quV5QbQtmmoJS5taCsEVX5bX/byT5RkiuBbOkaMftLYRvk2tGkp+S/cW+ V74iQbfcZG+acmIwU+tQQ624vsSKIGmM0rPNuCQmNxTebTwvpJdHEJGldoWCyFIqTkBS PSxU+LBqYeR85ZjgHlMHy1WsZCw2GZlhI2hB3q8gi64m/hHKHO2su/UTgC+gVpaswvDb q6eSftqUH6PsSAnHqbAsQKL5rp4HqeGAcDoIKIQpGF8bew6Vl5SawZmlvo/z82dcdkAn RSPBZ1bgFpUqcOdth0SjokVybek33qVM8Inh2DrPxu5SX7cAeI4Og6dwLHj+FEnwI4w2 DwZA== X-Gm-Message-State: AOAM531AMAYf7lGqCqgpQio/FyvlumwfBw7MpywEG1Pz+b7h4Z2c2yxk G8ZtwKHdKyh6b8BgSC3v9EeIJydydlDU7/3nAWl/Pw== X-Google-Smtp-Source: ABdhPJz9qtsfVIti1ixRdSv5PfYWECQpWh1LBjwr7TVSJDgseOyKkzr/TFvemdwxgaL1g4Ht9qT5uxy/thg/grGhqPA= X-Received: by 2002:a25:bc13:: with SMTP id i19mr3427784ybh.391.1594679597371; Mon, 13 Jul 2020 15:33:17 -0700 (PDT) MIME-Version: 1.0 References: <6C1CC0F4-2440-470A-BA3E-053726A0DB28@independentid.com> In-Reply-To: <6C1CC0F4-2440-470A-BA3E-053726A0DB28@independentid.com> From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 15:33:05 -0700 Message-ID: To: Phil Hunt Cc: Dick Hardt , ID Events Mailing List Content-Type: multipart/alternative; boundary="000000000000eef68105aa5a4682" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 22:33:48 -0000 --000000000000eef68105aa5a4682 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Phil, Not sure I fully grasp your question, but let me address the part I understood: I'm assuming "OP" means "OAuth Provider". It's true that the "iss-sub" subject type may be used in place of a SPAG, wherein the "iss" claim identifies the SPAG. There are a few issues with this: 1. Transmitters and receivers will have to come up with (proprietary) ways of encoding SPAGs at various levels. Each one may not have their ow= n OAuth provider (one reason why we need a SPAG), so the "iss" URL may be constructed as some sub-space of the OAuth provider URL. 2. All subject-types would have to be of "iss-sub" type, and transmitters and receivers would have to define their own proprietary wa= ys of interpreting the content of a "sub" claim. For example, if one wanted= to use email as a subject type, they would: - Use the "iss-sub" subject type - Encode the SPAG in the "iss" claim - Encode the email address in the "sub" claim as say: " email:user@example.org" Just to clarify: A SPAG may not just be a tenant-id, it could be an OU or a group within a tenant (or a host in case of a single-tenant system) Not sure I understand the question about the "event from a relying party administrator domain". I think we are talking about the same thing (tenant =3D administrator domain), but the tenant may exist in the issuer and the relying party. The issuer of the SETs may be the same for a large number of tenants. On Mon, Jul 13, 2020 at 3:03 PM Phil Hunt wrote: > Atul, > > I not understanding why a receiver needs to differentiate between an OP > issuer of a subject and a SPAG? > > What is the difference? > > Are we talking about an event from a relying party adminitrator domain? > > E.g. Phil Hunt=E2=80=99s Azure issued OP account used within the Google > adminstratvie domain had this event? > > Could the receiver not already figure this our by noting that the issuer > of the SET is not the issuer of the subject identifier? > > Phillip Hunt > phil.hunt@independentid.com > > > > On Jul 13, 2020, at 2:08 PM, Atul Tulshibagwale < > atultulshi=3D40google.com@dmarc.ietf.org> wrote: > > Dick, your understanding is correct. > > To clarify the proposal here, Here's the text I'm proposing to be added: > > 3. Subject Principals > > Subject Principals are the management entities associated with > Subjects. These may be human or robotic principals or devices or > other entities that are managed by transmitters and receivers. For > example, the same Subject Principal may be referred to by an email > address or a phone number. A transmitter or receiver will typically > manage subject principals and organize them into sub-groupings such > as tenants, groups, organizational units, etc. > > Subjects are identified by Subject Identifiers defined below. > > 3.1. SPAGs > > Subject Principals MAY be grouped for administrative purposes into > "Subject Principal Administrative Groupings" or SPAGs. For example, > all users belonging to one customer of a "multi-tenanted" Transmitter > may be in one SPAG. Alternatively, an Organizational Unit or a group > of Subjects within a customer of a Transmitter (whether multi- > tenanted or not) may be one SPAG. SPAGs may have overlapping sets of > Subjects. > > A SPAG MAY be the Subject of certain stream update events defined > later in this spec, hence is defined as a Subject Type of its own > below. A SPAG identifier MAY be included in other subject types to > disambiguate the subject. > > A SPAG subject identifier is agreed to offline between a transmitter > and a receiver. > > The benefits of doing this are: > > 1. Multi-tenanted hosts do not need to maintain secrets per tenant and > per transmitter tenant if each tenant has to be an event transmitter a= nd an > event receiver of its own. > 2. An event stream may be established between two multi-tenanted > hosts, and so does not need to be managed at a per-tenant level > 3. The same subject or subject principal may be a part of multiple > SPAGs, and identifying the SPAG that an event relates to can be achiev= ed if > the standard allows for the SPAGs to be identified. > > > > On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt wrote: > >> To clarify, your proposal is driven by the implementation burden of >> maintaining separate secrets / streams between a transmitter and receive= r? >> =E1=90=A7 >> >> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale > 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >> >>> Hi all, >>> Here's a quick background for the proposal >>> for including Subject >>> Principals and Subject Principal Administrative Groupings or SPAGs in t= he >>> Subject Identifiers spec. >>> >>> *Use of Subject Identifiers in Shared Signals and Events*: >>> The Shared Signals and Events (SSE) profile of SETs specifies that >>> transmitters and receivers send and receive SETs that contain Subject >>> Identifiers. These subject identifiers have the format that is now bein= g >>> discussed as a separate specification here. >>> >>> *Transmitters and Receivers in SSE* >>> The SSE profile defines transmitters and receivers as hosts that manage >>> streams between peers. The receiver authenticates to the transmitter us= ing >>> OAuth, requiring the use of a secret per receiver. In a multi-tenanted = host >>> that handles hundreds of thousands or millions of independent tenants, >>> maintaining such a secret per instance of a receiver is cumbersome. >>> Furthermore, since a transmitter and a receiver has to maintain a strea= m >>> per pair, creating such per-tenant streams can add significant >>> implementation overhead. >>> >>> *SPAGs* >>> Therefore, we need a notion of a grouping of subjects within the same >>> transmitter and receiver to distinguish between various administrative >>> groupings that exist within a host. These groupings could include tenan= ts, >>> organizational units or user groups.. This grouping is captured in the >>> notion of a SPAG. The uniqueness of a user identifier (subject identifi= er) >>> may also be limited to a SPAG. For example, if a random unique ID >>> represents a user, then that ID may be unique within a SPAG and not >>> universally across a transmitter or receiver. This is because each >>> transmitter and receiver may have multiple connections to other >>> transmitters and receivers, and ensuring uniqueness across all such pee= rs >>> is probably an intractable problem. >>> >>> *Subject Principals* >>> While what is represented within a subject identifier may be only an >>> aspect of the management entity, the administrative grouping is about t= he >>> management entity itself.. This could be the user, device or other >>> principal that the subject identifier represents. Therefore, an abstrac= t >>> notion of a Subject Principal is also required in order specify what th= e >>> grouping within a SPAG is about. >>> >>> The above is captured in the "Subject Principal" and "SPAG" sections >>> within the proposed PR . >>> >>> Thanks, >>> Atul >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >> _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > --000000000000eef68105aa5a4682 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Hi Phil,
    Not sure I fully grasp your question, but let= me address the part I understood:

    I'm ass= uming "OP" means "OAuth Provider". It's true that t= he "iss-sub" subject type may be used in place of a SPAG, wherein= the "iss" claim identifies the SPAG. There are a few issues with= this:
    1. Transmitters and receivers will have to come up wi= th (proprietary) ways of encoding SPAGs at various levels. Each one may not= have their own OAuth provider (one reason why we need a SPAG), so the &quo= t;iss" URL may be constructed as some sub-space of the OAuth provider = URL.
    2. All subject-types would have to be of "iss-sub" type= , and transmitters and receivers would have to define their own proprietary= ways of interpreting the content of a "sub" claim. For example, = if one wanted to use email as a subject type, they would:
      • Use t= he "iss-sub" subject type
      • Encode the SPAG in the "is= s" claim
      • Encode the email address in the "sub" claim= as say: "email:user@example.org"
    Just to clarify: A SP= AG may not just be a tenant-id, it could be an OU or a group within a tenan= t (or a host in case of a single-tenant system)

    <= div>Not sure I understand the question about the "event from a relying= party administrator domain". I think we are talking about the same th= ing (tenant =3D administrator domain), but the tenant may exist in the issu= er and the relying party.

    The issuer of the SETs m= ay be the same for a large number of tenants.

    On Mon, Jul 13, 2020 at = 3:03 PM Phil Hunt <phil.hunt@independentid.com> wrote:
    Atul,

    I not = understanding why a receiver needs to differentiate between an OP issuer of= a subject and a SPAG?

    What is the difference?

    Are we talking about an event from a relying party ad= minitrator domain? =C2=A0

    E.g. Phil Hunt=E2=80=99s= Azure issued OP account used within the Google adminstratvie domain had th= is event?

    Could the receiver not already figure th= is our by noting that the issuer of the SET is not the issuer of the subjec= t identifier?


    On Jul 13, 2020, at 2:08 PM, Atul T= ulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> wrote:=

    Dick, your understanding is correct.

    To clarify the proposal here, Here's the text I'= m proposing to be added:

    3.=C2=A0 Subject = Principals

    =C2=A0 =C2=A0Subject Principals are the management entiti= es associated with
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or ro= botic principals or devices or
    =C2=A0 =C2=A0other entities that are mana= ged by transmitters and receivers.=C2=A0 For
    =C2=A0 =C2=A0example, the s= ame Subject Principal may be referred to by an email
    =C2=A0 =C2=A0addres= s or a phone number.=C2=A0 A transmitter or receiver will typically
    =C2= =A0 =C2=A0manage subject principals and organize them into sub-groupings su= ch
    =C2=A0 =C2=A0as tenants, groups, organizational units, etc.

    = =C2=A0 =C2=A0Subjects are identified by Subject Identifiers defined below.<= br>
    3.1.=C2=A0 SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be group= ed for administrative purposes into
    =C2=A0 =C2=A0"Subject Principal= Administrative Groupings" or SPAGs.=C2=A0 For example,
    =C2=A0 =C2= =A0all users belonging to one customer of a "multi-tenanted" Tran= smitter
    =C2=A0 =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organiz= ational Unit or a group
    =C2=A0 =C2=A0of Subjects within a customer of a = Transmitter (whether multi-
    =C2=A0 =C2=A0tenanted or not) may be one SPA= G.=C2=A0 SPAGs may have overlapping sets of
    =C2=A0 =C2=A0Subjects.
    =C2=A0 =C2=A0A SPAG MAY be the Subject of certain stream update events de= fined
    =C2=A0 =C2=A0later in this spec, hence is defined as a Subject Typ= e of its own
    =C2=A0 =C2=A0below.=C2=A0 A SPAG identifier MAY be included= in other subject types to
    =C2=A0 =C2=A0disambiguate the subject.
    =C2=A0 =C2=A0A SPAG subject identifier is agreed to offline between a tran= smitter
    =C2=A0 =C2=A0and a receiver.

    The benefi= ts of doing this are:
    1. Multi-tenanted hosts do not need to= maintain secrets per tenant and per transmitter tenant if each tenant has = to be an event transmitter and an event receiver of its own.
    2. An eve= nt stream may be established between two multi-tenanted hosts, and so does = not need to be managed at a per-tenant level
    3. The same subject or su= bject principal may be a part of multiple SPAGs, and identifying the SPAG t= hat an event relates to can be achieved if the standard allows for the SPAG= s to be identified.


    On Mon, Jul 13, 2020 at 1= 1:32 AM Dick Hardt <dick.hardt@gmail.com> wrote:
    To clarify, your proposal is dri= ven by the implementation=C2=A0burden of maintaining separate secrets / str= eams between a transmitter and receiver?
    3D""=E1=90=A7

    On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale <atultulshi=3D40google.com@d= marc.ietf.org> wrote:
    Hi all,=C2=A0
    Here's a quick backgrou= nd for the proposal for including Subject Principals and Subject Princ= ipal Administrative Groupings or SPAGs in the Subject Identifiers spec.

    Use of Subject Identifiers in Shared Signals and E= vents:
    The Shared Signals and Events (SSE) profile of SETs sp= ecifies that transmitters and receivers send and receive SETs that contain = Subject Identifiers. These subject identifiers have the format that is now = being discussed as a separate specification here.

    <= div>Transmitters and Receivers in SSE
    The SSE profile defi= nes transmitters and receivers as hosts that manage streams between peers. = The receiver authenticates to the transmitter using OAuth, requiring the us= e of a secret per receiver. In a multi-tenanted host that handles hundreds = of thousands or millions of independent tenants, maintaining such a secret = per instance of a receiver is cumbersome. Furthermore, since a transmitter = and a receiver has to maintain a stream per pair, creating such per-tenant = streams can add significant implementation overhead.

    SPAGs
    Therefore, we need a notion of a grouping of subj= ects within the same transmitter and receiver to distinguish between variou= s administrative groupings that exist within a host. These groupings could = include tenants, organizational units or user groups.. This grouping is cap= tured in the notion of a SPAG. The uniqueness of a user identifier (subject= identifier) may also be limited to a SPAG. For example, if a random unique= ID represents a user, then that ID may be unique within a SPAG and not uni= versally across a transmitter or receiver. This is because each transmitter= and receiver may have multiple connections to other transmitters and recei= vers, and ensuring uniqueness across all such peers is probably an intracta= ble problem.

    Subject Principals
    W= hile what is represented within a subject identifier may be only an aspect = of the management entity, the administrative grouping is about the manageme= nt entity itself.. This could be the user, device or other principal that t= he subject identifier represents. Therefore, an abstract notion of a Subjec= t Principal is also required in order specify what the grouping within a SP= AG is about.

    The above is captured in the "Su= bject Principal" and "SPAG" sections within the proposed PR.


    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    _______________________________________________
    Id-event mailing listId-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    --000000000000eef68105aa5a4682-- From nobody Mon Jul 13 15:34:02 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 69F623A096D for ; Mon, 13 Jul 2020 15:33:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.598 X-Spam-Level: X-Spam-Status: No, score=-17.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VEK-9_ErtFnQ for ; Mon, 13 Jul 2020 15:33:48 -0700 (PDT) Received: from mail-yb1-xb2c.google.com (mail-yb1-xb2c.google.com [IPv6:2607:f8b0:4864:20::b2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C7CC3A08CD for ; Mon, 13 Jul 2020 15:33:42 -0700 (PDT) Received: by mail-yb1-xb2c.google.com with SMTP id g6so7206496ybo.11 for ; Mon, 13 Jul 2020 15:33:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WeRO6rjXvvHW20tjJhOERt5T5rNiwXtlsjg49CK/SyE=; b=WZmNzGQ5CmCL/uYEUg3jGKh+xHsahlq20w2fJ8IlLEFp8FcH+EvSkKXcEqv8zLF/eK +wz3by1kykDfXxbrFgNHJCBlsGdbT2wUT9/LUTz3wBERBdhcxfuFJcnm5fE5MzNJal6z Cm1Y7CBa4kKx5yPdPKC4CIEl08ai+U3oQjvDvPbHGb1/h7nk4xD5NhVVlNjBqu5NKLRy 1QMRHW1Z5HEBS+OLznbFocfwJEpQO7T50uD387oh8cLXaBpDfYIy7dbRxFWTmWXkARKU UZ+HfNJyb6FofeImKUhvcj0ROpBBvSvWR52E3ydEsDe2ghmlQc/ns/cyOVwHFTj2BQxA 4KQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WeRO6rjXvvHW20tjJhOERt5T5rNiwXtlsjg49CK/SyE=; b=N2TWXlZsL31REYjRGmVU9OOXIZzOnXyWm1PMFvQWsI/Huw1nfzUM8aAQm+swkGeFbV 4s3HOhrzjzgvJ7wlZxtUVGzW54DBl2RfA4GwhXx3b4MQa0rdihNgnn6/FOz2R/OyznOE XoMTRn57E1V0nHFH0RMZ0K03YeBdnFwoWMH2DFnEb1oF8iAuhzu9H60JF64xjm5f83rK oi0Ogs57HPcZRzKfoR2dfA2t3fN4mkPDAViWTAfUziNYxZ/6hqJ/RcysJgn7h6rScIcE js7zUxk98JAyOzkcdCRu1KBNLUvy5i2DN8ortsOxR8XCjLrhrkhJZybGaIr5ouQObKLy LdEA== X-Gm-Message-State: AOAM5310q+MGtchR/HBuKL3HfIjKZ2hAxCfjj6ZdoP9HhdmFm2naGtgs SKGstQK4+Kh0Vir6ekOCqeJZGXm1+tFxTG93+ELvgw== X-Google-Smtp-Source: ABdhPJzAsj8URDCRh1/93SXF4LYKJ7qmPpeXrZjPPG0Jzzif7uuciZsN1J6Ow3+9FR4ackJhUtIXccLomYXgHKf712E= X-Received: by 2002:a25:d807:: with SMTP id p7mr3674472ybg.229.1594679621116; Mon, 13 Jul 2020 15:33:41 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 15:33:29 -0700 Message-ID: To: Dick Hardt Cc: SecEvent Content-Type: multipart/alternative; boundary="00000000000059599e05aa5a481c" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 22:33:53 -0000 --00000000000059599e05aa5a481c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Not required, since the claim is optional. On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt wrote: > Would a transmitter that is only in one SPAG (a single tenant system) hav= e > to include its SPAG id in events sent to a receiver that accepts events > from multiple SPAGs? But it would not include it in sending events to oth= er > receivers that have separate credentials for each relationship? > > > > =E1=90=A7 > > On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale > wrote: > >> That could be true but there are a few ways in which it can be avoided: >> >> 1. The peers leverage some higher-level trust to accept / decline >> events relating to lower level SPAGs. For example, if trust is establ= ished >> at a tenant level, then an OU level SPAG need not have its own >> authorization. >> 2. The secret required for establishing the authorization of a SPAG >> may be temporary. For example: >> 1. An administrator signs in to their tenant in the transmitter's >> administrator console >> 2. The admin obtains a temporary authorization (one-time code) >> 3. The admin signs in to their tenant in the receiver's >> administration console and pastes in the one-time code >> 4. The receiver sends a request to enable the stream for the >> specified SPAG with that one-time authorization. >> >> In the first case, there are no additional secrets required. In the >> second case, the secret is temporary. >> >> >> >> On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt wrote: >> >>> I see the SPAG lets the transmitter and receiver provide context, as th= e >>> subject identifier may be the same across SPAGs. >>> >>> Now I'm trying to understand how the transmitter authenticates to the >>> receiver if it does not have it's own secret (assuming that authenticat= ion >>> model) -- IE, how does the receiver know the transmitter is authorized = for >>> that SPAG? >>> >>> >>> On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale < >>> atultulshi@google.com> wrote: >>> >>>> Dick, your understanding is correct. >>>> >>>> To clarify the proposal here, Here's the text I'm proposing to be adde= d: >>>> >>>> 3. Subject Principals >>>> >>>> Subject Principals are the management entities associated with >>>> Subjects. These may be human or robotic principals or devices or >>>> other entities that are managed by transmitters and receivers. For >>>> example, the same Subject Principal may be referred to by an email >>>> address or a phone number. A transmitter or receiver will typicall= y >>>> manage subject principals and organize them into sub-groupings such >>>> as tenants, groups, organizational units, etc. >>>> >>>> Subjects are identified by Subject Identifiers defined below. >>>> >>>> 3.1. SPAGs >>>> >>>> Subject Principals MAY be grouped for administrative purposes into >>>> "Subject Principal Administrative Groupings" or SPAGs. For example= , >>>> all users belonging to one customer of a "multi-tenanted" Transmitt= er >>>> may be in one SPAG. Alternatively, an Organizational Unit or a gro= up >>>> of Subjects within a customer of a Transmitter (whether multi- >>>> tenanted or not) may be one SPAG. SPAGs may have overlapping sets = of >>>> Subjects. >>>> >>>> A SPAG MAY be the Subject of certain stream update events defined >>>> later in this spec, hence is defined as a Subject Type of its own >>>> below. A SPAG identifier MAY be included in other subject types to >>>> disambiguate the subject. >>>> >>>> A SPAG subject identifier is agreed to offline between a transmitte= r >>>> and a receiver. >>>> >>>> The benefits of doing this are: >>>> >>>> 1. Multi-tenanted hosts do not need to maintain secrets per tenant >>>> and per transmitter tenant if each tenant has to be an event transm= itter >>>> and an event receiver of its own. >>>> 2. An event stream may be established between two multi-tenanted >>>> hosts, and so does not need to be managed at a per-tenant level >>>> 3. The same subject or subject principal may be a part of multiple >>>> SPAGs, and identifying the SPAG that an event relates to can be ach= ieved if >>>> the standard allows for the SPAGs to be identified. >>>> >>>> >>>> >>>> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt >>>> wrote: >>>> >>>>> To clarify, your proposal is driven by the implementation burden of >>>>> maintaining separate secrets / streams between a transmitter and rece= iver? >>>>> =E1=90=A7 >>>>> >>>>> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale >>>> 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >>>>> >>>>>> Hi all, >>>>>> Here's a quick background for the proposal >>>>>> for including Subject >>>>>> Principals and Subject Principal Administrative Groupings or SPAGs i= n the >>>>>> Subject Identifiers spec. >>>>>> >>>>>> *Use of Subject Identifiers in Shared Signals and Events*: >>>>>> The Shared Signals and Events (SSE) profile of SETs specifies that >>>>>> transmitters and receivers send and receive SETs that contain Subjec= t >>>>>> Identifiers. These subject identifiers have the format that is now b= eing >>>>>> discussed as a separate specification here. >>>>>> >>>>>> *Transmitters and Receivers in SSE* >>>>>> The SSE profile defines transmitters and receivers as hosts that >>>>>> manage streams between peers. The receiver authenticates to the tran= smitter >>>>>> using OAuth, requiring the use of a secret per receiver. In a >>>>>> multi-tenanted host that handles hundreds of thousands or millions o= f >>>>>> independent tenants, maintaining such a secret per instance of a rec= eiver >>>>>> is cumbersome. Furthermore, since a transmitter and a receiver has t= o >>>>>> maintain a stream per pair, creating such per-tenant streams can add >>>>>> significant implementation overhead. >>>>>> >>>>>> *SPAGs* >>>>>> Therefore, we need a notion of a grouping of subjects within the sam= e >>>>>> transmitter and receiver to distinguish between various administrati= ve >>>>>> groupings that exist within a host. These groupings could include te= nants, >>>>>> organizational units or user groups.. This grouping is captured in t= he >>>>>> notion of a SPAG. The uniqueness of a user identifier (subject ident= ifier) >>>>>> may also be limited to a SPAG. For example, if a random unique ID >>>>>> represents a user, then that ID may be unique within a SPAG and not >>>>>> universally across a transmitter or receiver. This is because each >>>>>> transmitter and receiver may have multiple connections to other >>>>>> transmitters and receivers, and ensuring uniqueness across all such = peers >>>>>> is probably an intractable problem. >>>>>> >>>>>> *Subject Principals* >>>>>> While what is represented within a subject identifier may be only an >>>>>> aspect of the management entity, the administrative grouping is abou= t the >>>>>> management entity itself. This could be the user, device or other pr= incipal >>>>>> that the subject identifier represents. Therefore, an abstract notio= n of a >>>>>> Subject Principal is also required in order specify what the groupin= g >>>>>> within a SPAG is about. >>>>>> >>>>>> The above is captured in the "Subject Principal" and "SPAG" sections >>>>>> within the proposed PR = . >>>>>> >>>>>> Thanks, >>>>>> Atul >>>>>> >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>> >>>>> --00000000000059599e05aa5a481c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Not required, since the claim is optional.

    On Mon, Jul 13, = 2020 at 3:25 PM Dick Hardt <dick= .hardt@gmail.com> wrote:
    Would a transmitter that is only in one SP= AG (a single tenant system) have to include its SPAG id in events sent to a= receiver that accepts events from multiple SPAGs? But it would not include= it in sending events to other receivers=C2=A0that have separate credential= s for each relationship?



    =
    3D""=E1=90=A7

    On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshib= agwale <atult= ulshi@google.com> wrote:
    That could be true but there are a few way= s in which it can be avoided:
    1. The peers leverage some higher-le= vel trust to accept / decline events relating to lower level SPAGs. For exa= mple, if trust is established at a tenant level, then an OU level SPAG need= not have its own authorization.
    2. The secret required for establishi= ng the authorization of a SPAG may be temporary. For example:
      1. A= n administrator signs in to their tenant in the transmitter's administr= ator console
      2. The admin obtains a temporary authorization (one-time = code)
      3. The admin signs in to their tenant in the receiver's admi= nistration console and pastes in the one-time code
      4. The receiver sen= ds a request to enable the stream for the specified SPAG with that one-time= authorization.
    In the first case, there are no addition= al secrets required. In the second case, the secret is temporary.



    On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt = <dick.hardt@gm= ail.com> wrote:
    I see the SPAG lets the transmitter and receiver pr= ovide context, as the subject identifier may be the same across SPAGs.
    =
    Now I'm trying to understand how the transmitter authent= icates to the receiver if it does not have it's own secret (assuming th= at authentication model) -- IE, how does the receiver know the transmitter = is authorized=C2=A0for that SPAG?


    On Mon, Jul 13, 2020= at 2:08 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    Dick, your un= derstanding is correct.

    To clarify the proposal here, H= ere's the text I'm proposing to be added:

    3.=C2=A0 Subject Principals

    =C2=A0 =C2=A0Subject Principals = are the management entities associated with
    =C2=A0 =C2=A0Subjects.=C2=A0= These may be human or robotic principals or devices or
    =C2=A0 =C2=A0oth= er entities that are managed by transmitters and receivers.=C2=A0 For
    = =C2=A0 =C2=A0example, the same Subject Principal may be referred to by an e= mail
    =C2=A0 =C2=A0address or a phone number.=C2=A0 A transmitter or rece= iver will typically
    =C2=A0 =C2=A0manage subject principals and organize = them into sub-groupings such
    =C2=A0 =C2=A0as tenants, groups, organizati= onal units, etc.

    =C2=A0 =C2=A0Subjects are identified by Subject Ide= ntifiers defined below.

    3.1.=C2=A0 SPAGs

    =C2=A0 =C2=A0Subject= Principals MAY be grouped for administrative purposes into
    =C2=A0 =C2= =A0"Subject Principal Administrative Groupings" or SPAGs.=C2=A0 F= or example,
    =C2=A0 =C2=A0all users belonging to one customer of a "= multi-tenanted" Transmitter
    =C2=A0 =C2=A0may be in one SPAG.=C2=A0 = Alternatively, an Organizational Unit or a group
    =C2=A0 =C2=A0of Subject= s within a customer of a Transmitter (whether multi-
    =C2=A0 =C2=A0tenant= ed or not) may be one SPAG.=C2=A0 SPAGs may have overlapping sets of
    =C2= =A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A SPAG MAY be the Subject of certai= n stream update events defined
    =C2=A0 =C2=A0later in this spec, hence is= defined as a Subject Type of its own
    =C2=A0 =C2=A0below.=C2=A0 A SPAG i= dentifier MAY be included in other subject types to
    =C2=A0 =C2=A0disambi= guate the subject.

    =C2=A0 =C2=A0A SPAG subject identifier is agreed = to offline between a transmitter
    =C2=A0 =C2=A0and a receiver.
    =
    The benefits of doing this are:
    1. Multi-tena= nted hosts do not need to maintain secrets per tenant and per transmitter t= enant if each tenant has to be an event transmitter and an event receiver o= f its own.
    2. An event stream may be established between two multi-ten= anted hosts, and so does not need to be managed at a per-tenant level
      3. <= li>The same subject or subject principal may be a part of multiple SPAGs, a= nd identifying the SPAG that an event relates to can be achieved if the sta= ndard allows for the SPAGs to be identified.

    =

    = On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt <dick.hardt@gmail.com> wrote:
    To clar= ify, your proposal is driven by the implementation=C2=A0burden of maintaini= ng separate secrets / streams between a transmitter and receiver?
    3D""=E1=90=A7

    On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwa= le <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
    Hi all,=C2=A0
    H= ere's a quick background for the proposal for including Subject Prin= cipals and Subject Principal Administrative Groupings or SPAGs in the Subje= ct Identifiers spec.

    Use of Subject Identifiers= in Shared Signals and Events:
    The Shared Signals and Events = (SSE) profile of SETs specifies that transmitters and receivers send and re= ceive SETs that contain Subject Identifiers. These subject identifiers have= the format that is now being discussed as a separate specification here.

    Transmitters and Receivers in SSE
    <= div>The SSE profile defines transmitters and receivers as hosts that manage= streams between peers. The receiver authenticates to the transmitter using= OAuth, requiring the use of a secret per receiver. In a multi-tenanted hos= t that handles hundreds of thousands or millions of independent tenants, ma= intaining such a secret per instance of a receiver is cumbersome. Furthermo= re, since a transmitter and a receiver has to maintain a stream per pair, c= reating such per-tenant streams can add significant implementation overhead= .

    SPAGs
    Therefore, we need a noti= on of a grouping of subjects within the same transmitter and receiver to di= stinguish between various administrative groupings that exist within a host= . These groupings could include tenants, organizational units or user group= s.. This grouping is captured in the notion of a SPAG. The uniqueness of a = user identifier (subject identifier) may also be limited to a SPAG. For exa= mple, if a random unique ID represents a user, then that ID may be unique w= ithin a SPAG and not universally across a transmitter or receiver. This is = because each transmitter and receiver may have multiple connections to othe= r transmitters and receivers, and ensuring uniqueness across all such peers= is probably an intractable problem.

    Subject Pr= incipals
    While what is represented within a subject identifie= r may be only an aspect of the management entity, the administrative groupi= ng is about the management entity itself. This could be the user, device or= other principal that the subject identifier represents. Therefore, an abst= ract notion of a Subject Principal is also required in order specify what t= he grouping within a SPAG is about.

    The above is c= aptured in the "Subject Principal" and "SPAG" sections = within the proposed PR.

    Thanks,
    Atul<= /div>

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --00000000000059599e05aa5a481c-- From nobody Mon Jul 13 15:38:04 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9AA53A07B6 for ; Mon, 13 Jul 2020 15:38:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 822q74Mlw0vq for ; Mon, 13 Jul 2020 15:37:59 -0700 (PDT) Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C3283A07AF for ; Mon, 13 Jul 2020 15:37:59 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id h19so20034135ljg.13 for ; Mon, 13 Jul 2020 15:37:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JyTtPOaS4ReWsfDGfqK2mG+VWd3knQR+QuKDhdtQ5zk=; b=uaINl5MP0nfch3MUt6VlHt+T4G4iRi7B4pANPy5mrtMfeVIHNbYmcEH/bmu/8XFIIy rLCo31+ABj2mk5ooJko6mPm1xAASysPwBU7X83WMppu0ft9t8PFsSZw8eoc9nwNvjUkp 1uOyk71XoiBQVuxnBozsSOVDSnRD2TAEqeP7lTpS4rv/E6yyq2G2B0oYWuMl9GcoX2gL SpZZyhxan2PU4Tp7CN+m7l58tHCsiVExsKYdBDmBrcbxBL6E2/taoXkmsvP7uViDH3ju vtAnNEvz/aES+0Qij02bf6vjIFQXZ9Hhq6vlAili/n7N6gu8RDvecKi571RjC2B5rFok 5XKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JyTtPOaS4ReWsfDGfqK2mG+VWd3knQR+QuKDhdtQ5zk=; b=Fu35Ny3maJGNeX3ovAk4b6G5HX//TN/K1DSENe/6hvJbxh+h27/dM25yqu8GMYZTFE b19DQ4K5cLdrbY6xU2uTTwRJpAoILEZP2zrOOxkT0LyRJ4AT/TvROWi8uEKSVrMASi/R UBxWVbFQxZbnel6vHCpP5JUwON96kUqgulG86/iLTiKnyM+SSV2jv57aVxITFbOwRIj8 pMCX0Z3vy3jeRpu/74U4WjGBWlCTdUhihKZhlVEan5nV2ZT24PqGinBIkPtV5ygDHKEP SufIZy5PfiXmz3uV+Sp3pHxoyVQ+FRxBFeUmdrDVXKtloHfXVwI3Vgq1cmhpCg2B2YyW LRZg== X-Gm-Message-State: AOAM532QdhiZxkBYTOGjT2xwlcVEHAtzgEbCRnbTWXfK9xQoluGGPRZv 4TILinDQwu1eXPIvbeGe7Z6F7Vl4StogdZ72eW0= X-Google-Smtp-Source: ABdhPJwIJy3ZyZcJWmooNjNI9KD8S+fmhzjU7aRDowcsCJ3buM/BcvYeRD37VjqSN1DPGyoHmR9Vdr57+AoRAqBc9P4= X-Received: by 2002:a2e:80c9:: with SMTP id r9mr847410ljg.69.1594679877078; Mon, 13 Jul 2020 15:37:57 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Mon, 13 Jul 2020 15:37:21 -0700 Message-ID: To: Atul Tulshibagwale Cc: SecEvent Content-Type: multipart/alternative; boundary="0000000000009a92ca05aa5a5745" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 22:38:02 -0000 --0000000000009a92ca05aa5a5745 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Which part is not required? On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale wrote: > Not required, since the claim is optional. > > On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt wrote: > >> Would a transmitter that is only in one SPAG (a single tenant system) >> have to include its SPAG id in events sent to a receiver that accepts >> events from multiple SPAGs? But it would not include it in sending event= s >> to other receivers that have separate credentials for each relationship? >> >> >> >> =E1=90=A7 >> >> On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale >> wrote: >> >>> That could be true but there are a few ways in which it can be avoided: >>> >>> 1. The peers leverage some higher-level trust to accept / decline >>> events relating to lower level SPAGs. For example, if trust is estab= lished >>> at a tenant level, then an OU level SPAG need not have its own >>> authorization. >>> 2. The secret required for establishing the authorization of a SPAG >>> may be temporary. For example: >>> 1. An administrator signs in to their tenant in the transmitter's >>> administrator console >>> 2. The admin obtains a temporary authorization (one-time code) >>> 3. The admin signs in to their tenant in the receiver's >>> administration console and pastes in the one-time code >>> 4. The receiver sends a request to enable the stream for the >>> specified SPAG with that one-time authorization. >>> >>> In the first case, there are no additional secrets required. In the >>> second case, the secret is temporary. >>> >>> >>> >>> On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt wrote= : >>> >>>> I see the SPAG lets the transmitter and receiver provide context, as >>>> the subject identifier may be the same across SPAGs. >>>> >>>> Now I'm trying to understand how the transmitter authenticates to the >>>> receiver if it does not have it's own secret (assuming that authentica= tion >>>> model) -- IE, how does the receiver know the transmitter is authorized= for >>>> that SPAG? >>>> >>>> >>>> On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale < >>>> atultulshi@google.com> wrote: >>>> >>>>> Dick, your understanding is correct. >>>>> >>>>> To clarify the proposal here, Here's the text I'm proposing to be >>>>> added: >>>>> >>>>> 3. Subject Principals >>>>> >>>>> Subject Principals are the management entities associated with >>>>> Subjects. These may be human or robotic principals or devices or >>>>> other entities that are managed by transmitters and receivers. Fo= r >>>>> example, the same Subject Principal may be referred to by an email >>>>> address or a phone number. A transmitter or receiver will typical= ly >>>>> manage subject principals and organize them into sub-groupings suc= h >>>>> as tenants, groups, organizational units, etc. >>>>> >>>>> Subjects are identified by Subject Identifiers defined below. >>>>> >>>>> 3.1. SPAGs >>>>> >>>>> Subject Principals MAY be grouped for administrative purposes into >>>>> "Subject Principal Administrative Groupings" or SPAGs. For exampl= e, >>>>> all users belonging to one customer of a "multi-tenanted" >>>>> Transmitter >>>>> may be in one SPAG. Alternatively, an Organizational Unit or a >>>>> group >>>>> of Subjects within a customer of a Transmitter (whether multi- >>>>> tenanted or not) may be one SPAG. SPAGs may have overlapping sets >>>>> of >>>>> Subjects. >>>>> >>>>> A SPAG MAY be the Subject of certain stream update events defined >>>>> later in this spec, hence is defined as a Subject Type of its own >>>>> below. A SPAG identifier MAY be included in other subject types t= o >>>>> disambiguate the subject. >>>>> >>>>> A SPAG subject identifier is agreed to offline between a transmitt= er >>>>> and a receiver. >>>>> >>>>> The benefits of doing this are: >>>>> >>>>> 1. Multi-tenanted hosts do not need to maintain secrets per tenant >>>>> and per transmitter tenant if each tenant has to be an event trans= mitter >>>>> and an event receiver of its own. >>>>> 2. An event stream may be established between two multi-tenanted >>>>> hosts, and so does not need to be managed at a per-tenant level >>>>> 3. The same subject or subject principal may be a part of multiple >>>>> SPAGs, and identifying the SPAG that an event relates to can be ac= hieved if >>>>> the standard allows for the SPAGs to be identified. >>>>> >>>>> >>>>> >>>>> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt >>>>> wrote: >>>>> >>>>>> To clarify, your proposal is driven by the implementation burden of >>>>>> maintaining separate secrets / streams between a transmitter and rec= eiver? >>>>>> =E1=90=A7 >>>>>> >>>>>> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale >>>>> 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >>>>>> >>>>>>> Hi all, >>>>>>> Here's a quick background for the proposal >>>>>>> for including Subject >>>>>>> Principals and Subject Principal Administrative Groupings or SPAGs = in the >>>>>>> Subject Identifiers spec. >>>>>>> >>>>>>> *Use of Subject Identifiers in Shared Signals and Events*: >>>>>>> The Shared Signals and Events (SSE) profile of SETs specifies that >>>>>>> transmitters and receivers send and receive SETs that contain Subje= ct >>>>>>> Identifiers. These subject identifiers have the format that is now = being >>>>>>> discussed as a separate specification here. >>>>>>> >>>>>>> *Transmitters and Receivers in SSE* >>>>>>> The SSE profile defines transmitters and receivers as hosts that >>>>>>> manage streams between peers. The receiver authenticates to the tra= nsmitter >>>>>>> using OAuth, requiring the use of a secret per receiver. In a >>>>>>> multi-tenanted host that handles hundreds of thousands or millions = of >>>>>>> independent tenants, maintaining such a secret per instance of a re= ceiver >>>>>>> is cumbersome. Furthermore, since a transmitter and a receiver has = to >>>>>>> maintain a stream per pair, creating such per-tenant streams can ad= d >>>>>>> significant implementation overhead. >>>>>>> >>>>>>> *SPAGs* >>>>>>> Therefore, we need a notion of a grouping of subjects within the >>>>>>> same transmitter and receiver to distinguish between various admini= strative >>>>>>> groupings that exist within a host. These groupings could include t= enants, >>>>>>> organizational units or user groups.. This grouping is captured in = the >>>>>>> notion of a SPAG. The uniqueness of a user identifier (subject iden= tifier) >>>>>>> may also be limited to a SPAG. For example, if a random unique ID >>>>>>> represents a user, then that ID may be unique within a SPAG and not >>>>>>> universally across a transmitter or receiver. This is because each >>>>>>> transmitter and receiver may have multiple connections to other >>>>>>> transmitters and receivers, and ensuring uniqueness across all such= peers >>>>>>> is probably an intractable problem. >>>>>>> >>>>>>> *Subject Principals* >>>>>>> While what is represented within a subject identifier may be only a= n >>>>>>> aspect of the management entity, the administrative grouping is abo= ut the >>>>>>> management entity itself. This could be the user, device or other p= rincipal >>>>>>> that the subject identifier represents. Therefore, an abstract noti= on of a >>>>>>> Subject Principal is also required in order specify what the groupi= ng >>>>>>> within a SPAG is about. >>>>>>> >>>>>>> The above is captured in the "Subject Principal" and "SPAG" section= s >>>>>>> within the proposed PR >>>>>>> . >>>>>>> >>>>>>> Thanks, >>>>>>> Atul >>>>>>> >>>>>>> _______________________________________________ >>>>>>> Id-event mailing list >>>>>>> Id-event@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>> >>>>>> --0000000000009a92ca05aa5a5745 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Which part is not required?

    On Mon, Jul 13, 2020 at 3:33 PM= Atul Tulshibagwale <atultulshi= @google.com> wrote:
    Not required, since the claim is optional.
    On Mo= n, Jul 13, 2020 at 3:25 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    Would a trans= mitter that is only in one SPAG (a single tenant system) have to include it= s SPAG id in events sent to a receiver that accepts events from multiple SP= AGs? But it would not include it in sending events to other receivers=C2=A0= that have separate credentials for each relationship?


    3D""=E1=90=A7

    On Mon, Jul 13,= 2020 at 3:05 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    That could be= true but there are a few ways in which it can be avoided:
    1. The = peers leverage some higher-level trust to accept / decline events relating = to lower level SPAGs. For example, if trust is established at a tenant leve= l, then an OU level SPAG need not have its own authorization.
    2. The s= ecret required for establishing the authorization of a SPAG may be temporar= y. For example:
      1. An administrator signs in to their tenant in th= e transmitter's administrator console
      2. The admin obtains a tempo= rary authorization (one-time code)
      3. The admin signs in to their tena= nt in the receiver's administration console and pastes in the one-time = code
      4. The receiver sends a request to enable the stream for the spec= ified SPAG with that one-time authorization.
    In the firs= t case, there are no additional secrets required. In the second case, the s= ecret is temporary.



    On Mon, Jul 13= , 2020 at 2:34 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    I see the SPAG lets th= e transmitter and receiver provide context, as the subject identifier may b= e the same across SPAGs.

    Now I'm trying to understan= d how the transmitter authenticates to the receiver if it does not have it&= #39;s own secret (assuming that authentication model) -- IE, how does the r= eceiver know the transmitter is authorized=C2=A0for that SPAG?

    On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale <atultulshi@google.com>= ; wrote:
    Dick, your understanding is correct.

    To = clarify the proposal here, Here's the text I'm proposing to be adde= d:

    3.=C2=A0 Subject Principals

    =C2= =A0 =C2=A0Subject Principals are the management entities associated with=C2=A0 =C2=A0Subjects.=C2=A0 These may be human or robotic principals or d= evices or
    =C2=A0 =C2=A0other entities that are managed by transmitters a= nd receivers.=C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Principal= may be referred to by an email
    =C2=A0 =C2=A0address or a phone number.= =C2=A0 A transmitter or receiver will typically
    =C2=A0 =C2=A0manage subj= ect principals and organize them into sub-groupings such
    =C2=A0 =C2=A0as= tenants, groups, organizational units, etc.

    =C2=A0 =C2=A0Subjects a= re identified by Subject Identifiers defined below.

    3.1.=C2=A0 SPAGs=

    =C2=A0 =C2=A0Subject Principals MAY be grouped for administrative p= urposes into
    =C2=A0 =C2=A0"Subject Principal Administrative Groupin= gs" or SPAGs.=C2=A0 For example,
    =C2=A0 =C2=A0all users belonging t= o one customer of a "multi-tenanted" Transmitter
    =C2=A0 =C2=A0= may be in one SPAG.=C2=A0 Alternatively, an Organizational Unit or a group<= br>=C2=A0 =C2=A0of Subjects within a customer of a Transmitter (whether mul= ti-
    =C2=A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs may have = overlapping sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A SPAG MA= Y be the Subject of certain stream update events defined
    =C2=A0 =C2=A0la= ter in this spec, hence is defined as a Subject Type of its own
    =C2=A0 = =C2=A0below.=C2=A0 A SPAG identifier MAY be included in other subject types= to
    =C2=A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2=A0A SPAG su= bject identifier is agreed to offline between a transmitter
    =C2=A0 =C2= =A0and a receiver.

    The benefits of doing this are:=
    1. Multi-tenanted hosts do not need to maintain secrets per= tenant and per transmitter tenant if each tenant has to be an event transm= itter and an event receiver of its own.
    2. An event stream may be esta= blished between two multi-tenanted hosts, and so does not need to be manage= d at a per-tenant level
    3. The same subject or subject principal may b= e a part of multiple SPAGs, and identifying the SPAG that an event relates = to can be achieved if the standard allows for the SPAGs to be identified.


    On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt &= lt;dick.hardt@gma= il.com> wrote:
    To clarify, your proposal is driven by the implement= ation=C2=A0burden of maintaining separate secrets / streams between a trans= mitter and receiver?
    =E1=90=A7

    On Mon, Jul 13, 20= 20 at 9:01 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>= ; wrote:
    Hi all,=C2=A0
    Here's a quick background for the proposal= for including Subject Principals and Subject Principal Administrative = Groupings or SPAGs in the Subject Identifiers spec.

    Use of Subject Identifiers in Shared Signals and Events:
    The Shared Signals and Events (SSE) profile of SETs specifies that transmi= tters and receivers send and receive SETs that contain Subject Identifiers.= These subject identifiers have the format that is now being discussed as a= separate specification here.

    Transmitters = and Receivers in SSE
    The SSE profile defines transmitters and= receivers as hosts that manage streams between peers. The receiver authent= icates to the transmitter using OAuth, requiring the use of a secret per re= ceiver. In a multi-tenanted host that handles hundreds of thousands or mill= ions of independent tenants, maintaining such a secret per instance of a re= ceiver is cumbersome. Furthermore, since a transmitter and a receiver has t= o maintain a stream per pair, creating such per-tenant streams can add sign= ificant implementation overhead.

    SPAGs
    Therefore, we need a notion of a grouping of subjects within the same= transmitter and receiver to distinguish between various administrative gro= upings that exist within a host. These groupings could include tenants, org= anizational units or user groups.. This grouping is captured in the notion = of a SPAG. The uniqueness of a user identifier (subject identifier) may als= o be limited to a SPAG. For example, if a random unique ID represents a use= r, then that ID may be unique within a SPAG and not universally across a tr= ansmitter or receiver. This is because each transmitter and receiver may ha= ve multiple connections to other transmitters and receivers, and ensuring u= niqueness across all such peers is probably an intractable problem.

    Subject Principals
    While what is represe= nted within a subject identifier may be only an aspect of the management en= tity, the administrative grouping is about the management entity itself. Th= is could be the user, device or other principal that the subject identifier= represents. Therefore, an abstract notion of a Subject Principal is also r= equired in order specify what the grouping within a SPAG is about.

    The above is captured in the "Subject Principal"= and "SPAG" sections within the proposed PR.

    Thanks,
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --0000000000009a92ca05aa5a5745-- From nobody Mon Jul 13 15:54:53 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E802A3A00C4 for ; Mon, 13 Jul 2020 15:54:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.598 X-Spam-Level: X-Spam-Status: No, score=-17.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Jyo5kIc5BPa for ; Mon, 13 Jul 2020 15:54:49 -0700 (PDT) Received: from mail-yb1-xb34.google.com (mail-yb1-xb34.google.com [IPv6:2607:f8b0:4864:20::b34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16CB63A0A7D for ; Mon, 13 Jul 2020 15:54:20 -0700 (PDT) Received: by mail-yb1-xb34.google.com with SMTP id l19so7264547ybl.1 for ; Mon, 13 Jul 2020 15:54:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JsGcQRmO9Fy5t7pVQ2TzIjewg6cXOSib2u5XgA9tprs=; b=E7+iSi1X2OZSx4JcopOVUZYN4b9tK/4yH4P7kVxfZFlKe4tsCeQF/pzqM2/fjlDHH0 8VGXGRws+S0hIApzrKVHOuAi+NYIEuJNu69oxH681UmBKMS813bYLNPZfpsYLOx+Y+bL 0tdDmJgHB2uVbWhMet+OpSK4cJk5U5wGAGAG4CYoLDPz7x2V8b/F3KhuPKMCLvmwHK5H dnFgR0n1uQUHNxMI1+ZuDwKcmfLaol3T+0P+uk6WDp+RHFWWZOu6NIRw5E9chLRHNJyC NW+qN2snTu0IQcojG64z4CEQ6SfXrLcUM6WG+T5Dm9ePlQ5s6czxlNA+sVDaCPH4YTVy yTJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JsGcQRmO9Fy5t7pVQ2TzIjewg6cXOSib2u5XgA9tprs=; b=qMRfpmVFnC3RussP1ObBcUm3arKIh6EhlKs6eMv/la3qYSCnHCI1G91OXqRzvEUT9N zHjCAEpU2wh79xgFd6M++DGXDk3m4GVoH2n8oJW6yDBMaSX/Ihfstsdb/lnXgUnzxVMr CHvUPUvx6YGuKzz8IlbiWfkHongMJqb93T1WMq6Auw7nT1+nxUBxJd+YB//RJtoAI7DV dvbVIoSGLHRW6lM9s0CncutwHlNM67DFZ/gxTJLQgRenPwA4I3f0MiovzLB+swE6y6eo qbaGT5RX3jS3FD7CjfqWEiUzw/CM4CjQ6KWNo0S1fywcEzyF9lB2IrBuMZzT4v9ivaAV Q44A== X-Gm-Message-State: AOAM530Eo5hXAT43cVR5cmyqM00C+mi3lB4mH1saJ231cd78jFHGtJsY Qxbd8s3QgWYef9beaORh9DeIYJJHmXaXjBH+/Eo2+w== X-Google-Smtp-Source: ABdhPJymdB3tbq7wAYchpiLUBuzGxoLprM9+no0IIsMlKHBxue+XECG+hs6iBCZ/xGGDeJJhx0YHEKoYEagyo9YWxC0= X-Received: by 2002:a25:2805:: with SMTP id o5mr3587503ybo.97.1594680858880; Mon, 13 Jul 2020 15:54:18 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 15:54:07 -0700 Message-ID: To: Dick Hardt Cc: SecEvent Content-Type: multipart/alternative; boundary="0000000000002011eb05aa5a9230" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 22:54:52 -0000 --0000000000002011eb05aa5a9230 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Sorry for the terse message. If a single tenant transmitter is trusted by a multi-tenanted receiver for a specific tenant, then the SPAG-id need not be included if the subject is unique at the tenant level, because the receiver will automatically identify SPAG that the subject belongs to on its end (based on the authentication). On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt wrote: > Which part is not required? > > On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale > wrote: > >> Not required, since the claim is optional. >> >> On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt wrote: >> >>> Would a transmitter that is only in one SPAG (a single tenant system) >>> have to include its SPAG id in events sent to a receiver that accepts >>> events from multiple SPAGs? But it would not include it in sending even= ts >>> to other receivers that have separate credentials for each relationship= ? >>> >>> >>> >>> =E1=90=A7 >>> >>> On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale < >>> atultulshi@google.com> wrote: >>> >>>> That could be true but there are a few ways in which it can be avoided= : >>>> >>>> 1. The peers leverage some higher-level trust to accept / decline >>>> events relating to lower level SPAGs. For example, if trust is esta= blished >>>> at a tenant level, then an OU level SPAG need not have its own >>>> authorization. >>>> 2. The secret required for establishing the authorization of a SPAG >>>> may be temporary. For example: >>>> 1. An administrator signs in to their tenant in the >>>> transmitter's administrator console >>>> 2. The admin obtains a temporary authorization (one-time code) >>>> 3. The admin signs in to their tenant in the receiver's >>>> administration console and pastes in the one-time code >>>> 4. The receiver sends a request to enable the stream for the >>>> specified SPAG with that one-time authorization. >>>> >>>> In the first case, there are no additional secrets required. In the >>>> second case, the secret is temporary. >>>> >>>> >>>> >>>> On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt >>>> wrote: >>>> >>>>> I see the SPAG lets the transmitter and receiver provide context, as >>>>> the subject identifier may be the same across SPAGs. >>>>> >>>>> Now I'm trying to understand how the transmitter authenticates to the >>>>> receiver if it does not have it's own secret (assuming that authentic= ation >>>>> model) -- IE, how does the receiver know the transmitter is authorize= d for >>>>> that SPAG? >>>>> >>>>> >>>>> On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale < >>>>> atultulshi@google.com> wrote: >>>>> >>>>>> Dick, your understanding is correct. >>>>>> >>>>>> To clarify the proposal here, Here's the text I'm proposing to be >>>>>> added: >>>>>> >>>>>> 3. Subject Principals >>>>>> >>>>>> Subject Principals are the management entities associated with >>>>>> Subjects. These may be human or robotic principals or devices or >>>>>> other entities that are managed by transmitters and receivers. F= or >>>>>> example, the same Subject Principal may be referred to by an emai= l >>>>>> address or a phone number. A transmitter or receiver will >>>>>> typically >>>>>> manage subject principals and organize them into sub-groupings su= ch >>>>>> as tenants, groups, organizational units, etc. >>>>>> >>>>>> Subjects are identified by Subject Identifiers defined below. >>>>>> >>>>>> 3.1. SPAGs >>>>>> >>>>>> Subject Principals MAY be grouped for administrative purposes int= o >>>>>> "Subject Principal Administrative Groupings" or SPAGs. For >>>>>> example, >>>>>> all users belonging to one customer of a "multi-tenanted" >>>>>> Transmitter >>>>>> may be in one SPAG. Alternatively, an Organizational Unit or a >>>>>> group >>>>>> of Subjects within a customer of a Transmitter (whether multi- >>>>>> tenanted or not) may be one SPAG. SPAGs may have overlapping set= s >>>>>> of >>>>>> Subjects. >>>>>> >>>>>> A SPAG MAY be the Subject of certain stream update events defined >>>>>> later in this spec, hence is defined as a Subject Type of its own >>>>>> below. A SPAG identifier MAY be included in other subject types = to >>>>>> disambiguate the subject. >>>>>> >>>>>> A SPAG subject identifier is agreed to offline between a >>>>>> transmitter >>>>>> and a receiver. >>>>>> >>>>>> The benefits of doing this are: >>>>>> >>>>>> 1. Multi-tenanted hosts do not need to maintain secrets per >>>>>> tenant and per transmitter tenant if each tenant has to be an eve= nt >>>>>> transmitter and an event receiver of its own. >>>>>> 2. An event stream may be established between two multi-tenanted >>>>>> hosts, and so does not need to be managed at a per-tenant level >>>>>> 3. The same subject or subject principal may be a part of >>>>>> multiple SPAGs, and identifying the SPAG that an event relates to= can be >>>>>> achieved if the standard allows for the SPAGs to be identified. >>>>>> >>>>>> >>>>>> >>>>>> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt >>>>>> wrote: >>>>>> >>>>>>> To clarify, your proposal is driven by the implementation burden of >>>>>>> maintaining separate secrets / streams between a transmitter and re= ceiver? >>>>>>> =E1=90=A7 >>>>>>> >>>>>>> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale >>>>>> 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >>>>>>> >>>>>>>> Hi all, >>>>>>>> Here's a quick background for the proposal >>>>>>>> for including >>>>>>>> Subject Principals and Subject Principal Administrative Groupings = or SPAGs >>>>>>>> in the Subject Identifiers spec. >>>>>>>> >>>>>>>> *Use of Subject Identifiers in Shared Signals and Events*: >>>>>>>> The Shared Signals and Events (SSE) profile of SETs specifies that >>>>>>>> transmitters and receivers send and receive SETs that contain Subj= ect >>>>>>>> Identifiers. These subject identifiers have the format that is now= being >>>>>>>> discussed as a separate specification here. >>>>>>>> >>>>>>>> *Transmitters and Receivers in SSE* >>>>>>>> The SSE profile defines transmitters and receivers as hosts that >>>>>>>> manage streams between peers. The receiver authenticates to the tr= ansmitter >>>>>>>> using OAuth, requiring the use of a secret per receiver. In a >>>>>>>> multi-tenanted host that handles hundreds of thousands or millions= of >>>>>>>> independent tenants, maintaining such a secret per instance of a r= eceiver >>>>>>>> is cumbersome. Furthermore, since a transmitter and a receiver has= to >>>>>>>> maintain a stream per pair, creating such per-tenant streams can a= dd >>>>>>>> significant implementation overhead. >>>>>>>> >>>>>>>> *SPAGs* >>>>>>>> Therefore, we need a notion of a grouping of subjects within the >>>>>>>> same transmitter and receiver to distinguish between various admin= istrative >>>>>>>> groupings that exist within a host. These groupings could include = tenants, >>>>>>>> organizational units or user groups.. This grouping is captured in= the >>>>>>>> notion of a SPAG. The uniqueness of a user identifier (subject ide= ntifier) >>>>>>>> may also be limited to a SPAG. For example, if a random unique ID >>>>>>>> represents a user, then that ID may be unique within a SPAG and no= t >>>>>>>> universally across a transmitter or receiver. This is because each >>>>>>>> transmitter and receiver may have multiple connections to other >>>>>>>> transmitters and receivers, and ensuring uniqueness across all suc= h peers >>>>>>>> is probably an intractable problem. >>>>>>>> >>>>>>>> *Subject Principals* >>>>>>>> While what is represented within a subject identifier may be only >>>>>>>> an aspect of the management entity, the administrative grouping is= about >>>>>>>> the management entity itself. This could be the user, device or ot= her >>>>>>>> principal that the subject identifier represents. Therefore, an ab= stract >>>>>>>> notion of a Subject Principal is also required in order specify wh= at the >>>>>>>> grouping within a SPAG is about. >>>>>>>> >>>>>>>> The above is captured in the "Subject Principal" and "SPAG" >>>>>>>> sections within the proposed PR >>>>>>>> . >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Atul >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>>> >>>>>>> --0000000000002011eb05aa5a9230 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Sorry for the terse message.

    If a singl= e tenant transmitter is trusted by a multi-tenanted receiver for a specific= tenant, then the SPAG-id need not be included if the subject is unique at = the tenant level, because the receiver will automatically identify SPAG tha= t the subject belongs to on its end (based on the authentication).



    On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt <<= a href=3D"mailto:dick.hardt@gmail.com" target=3D"_blank">dick.hardt@gmail.c= om> wrote:
    Which part is not required?

    On Mon, Jul 13, 2020 at 3:33 = PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    Not required, since the c= laim is optional.

    On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt <dick.hardt@gmail.com>= wrote:
    Would a transmitter that is only in one SPAG (a single tenant syst= em) have to include its SPAG id in events sent to a receiver that accepts e= vents from multiple SPAGs? But it would not include it in sending events to= other receivers=C2=A0that have separate credentials for each relationship?=



    3D""=E1=90= =A7

    On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale <atultulshi@google.com&= gt; wrote:
    That could be true but there are a few ways in which it can be = avoided:
    1. The peers leverage some higher-level trust to accept /= decline events relating to lower level SPAGs. For example, if trust is est= ablished at a tenant level, then an OU level SPAG need not have its own aut= horization.
    2. The secret required for establishing the authorization = of a SPAG may be temporary. For example:
      1. An administrator signs= in to their tenant in the transmitter's administrator console
      2. = The admin obtains a temporary authorization (one-time code)
      3. The adm= in signs in to their tenant in the receiver's administration console an= d pastes in the one-time code
      4. The receiver sends a request to enabl= e the stream for the specified SPAG with that one-time authorization.
        5. <= /ol>
      In the first case, there are no additional secrets required. = In the second case, the secret is temporary.



    On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt <dick.hardt@gmail.com> wrote= :
    I see the SPAG lets the transmitter and receiver provide context, as the= subject identifier may be the same across SPAGs.

    Now I&= #39;m trying to understand how the transmitter authenticates to the receive= r if it does not have it's own secret (assuming that authentication mod= el) -- IE, how does the receiver know the transmitter is authorized=C2=A0fo= r that SPAG?


    On Mon, Jul 13, 2020 at 2:08 PM Atul Tulsh= ibagwale <atu= ltulshi@google.com> wrote:
    Dick, your understanding is correct= .

    To clarify the proposal here, Here's the text I&#= 39;m proposing to be added:

    3.=C2=A0 Subje= ct Principals

    =C2=A0 =C2=A0Subject Principals are the management ent= ities associated with
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or= robotic principals or devices or
    =C2=A0 =C2=A0other entities that are m= anaged by transmitters and receivers.=C2=A0 For
    =C2=A0 =C2=A0example, th= e same Subject Principal may be referred to by an email
    =C2=A0 =C2=A0add= ress or a phone number.=C2=A0 A transmitter or receiver will typically
    = =C2=A0 =C2=A0manage subject principals and organize them into sub-groupings= such
    =C2=A0 =C2=A0as tenants, groups, organizational units, etc.
    =C2=A0 =C2=A0Subjects are identified by Subject Identifiers defined below.=

    3.1.=C2=A0 SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be grou= ped for administrative purposes into
    =C2=A0 =C2=A0"Subject Principa= l Administrative Groupings" or SPAGs.=C2=A0 For example,
    =C2=A0 =C2= =A0all users belonging to one customer of a "multi-tenanted" Tran= smitter
    =C2=A0 =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organiz= ational Unit or a group
    =C2=A0 =C2=A0of Subjects within a customer of a = Transmitter (whether multi-
    =C2=A0 =C2=A0tenanted or not) may be one SPA= G.=C2=A0 SPAGs may have overlapping sets of
    =C2=A0 =C2=A0Subjects.
    =C2=A0 =C2=A0A SPAG MAY be the Subject of certain stream update events de= fined
    =C2=A0 =C2=A0later in this spec, hence is defined as a Subject Typ= e of its own
    =C2=A0 =C2=A0below.=C2=A0 A SPAG identifier MAY be included= in other subject types to
    =C2=A0 =C2=A0disambiguate the subject.
    =C2=A0 =C2=A0A SPAG subject identifier is agreed to offline between a tran= smitter
    =C2=A0 =C2=A0and a receiver.

    The benefi= ts of doing this are:
    1. Multi-tenanted hosts do not need to= maintain secrets per tenant and per transmitter tenant if each tenant has = to be an event transmitter and an event receiver of its own.
    2. An eve= nt stream may be established between two multi-tenanted hosts, and so does = not need to be managed at a per-tenant level
    3. The same subject or su= bject principal may be a part of multiple SPAGs, and identifying the SPAG t= hat an event relates to can be achieved if the standard allows for the SPAG= s to be identified.


    On Mon, Jul 13, 2020 at 1= 1:32 AM Dick Hardt <dick.hardt@gmail.com> wrote:
    To clarify, your proposal is dri= ven by the implementation=C2=A0burden of maintaining separate secrets / str= eams between a transmitter and receiver?
    3D""=E1=90=A7

    On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale <atultulshi=3D40google.com@d= marc.ietf.org> wrote:
    Hi all,=C2=A0
    Here's a quick backgrou= nd for the proposal for including Subject Principals and Subject Princ= ipal Administrative Groupings or SPAGs in the Subject Identifiers spec.

    Use of Subject Identifiers in Shared Signals and E= vents:
    The Shared Signals and Events (SSE) profile of SETs sp= ecifies that transmitters and receivers send and receive SETs that contain = Subject Identifiers. These subject identifiers have the format that is now = being discussed as a separate specification here.

    <= div>Transmitters and Receivers in SSE
    The SSE profile defi= nes transmitters and receivers as hosts that manage streams between peers. = The receiver authenticates to the transmitter using OAuth, requiring the us= e of a secret per receiver. In a multi-tenanted host that handles hundreds = of thousands or millions of independent tenants, maintaining such a secret = per instance of a receiver is cumbersome. Furthermore, since a transmitter = and a receiver has to maintain a stream per pair, creating such per-tenant = streams can add significant implementation overhead.

    SPAGs
    Therefore, we need a notion of a grouping of subj= ects within the same transmitter and receiver to distinguish between variou= s administrative groupings that exist within a host. These groupings could = include tenants, organizational units or user groups.. This grouping is cap= tured in the notion of a SPAG. The uniqueness of a user identifier (subject= identifier) may also be limited to a SPAG. For example, if a random unique= ID represents a user, then that ID may be unique within a SPAG and not uni= versally across a transmitter or receiver. This is because each transmitter= and receiver may have multiple connections to other transmitters and recei= vers, and ensuring uniqueness across all such peers is probably an intracta= ble problem.

    Subject Principals
    W= hile what is represented within a subject identifier may be only an aspect = of the management entity, the administrative grouping is about the manageme= nt entity itself. This could be the user, device or other principal that th= e subject identifier represents. Therefore, an abstract notion of a Subject= Principal is also required in order specify what the grouping within a SPA= G is about.

    The above is captured in the "Sub= ject Principal" and "SPAG" sections within the proposed PR.


    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --0000000000002011eb05aa5a9230-- From nobody Mon Jul 13 16:01:27 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0E303A0101 for ; Mon, 13 Jul 2020 16:01:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PrJ6sBZrLYeM for ; Mon, 13 Jul 2020 16:01:23 -0700 (PDT) Received: from mail-lj1-x22c.google.com (mail-lj1-x22c.google.com [IPv6:2a00:1450:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0940F3A00D3 for ; Mon, 13 Jul 2020 16:01:22 -0700 (PDT) Received: by mail-lj1-x22c.google.com with SMTP id h19so20103099ljg.13 for ; Mon, 13 Jul 2020 16:01:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hNXUMe4iwBq18KsdG9MXbpB/qnlV0dHfbMwnX8+4jOE=; b=mEkLRopDEJJqwREwcQrmQr6EkCw8H1lL5mj1Vqcxb+RvlWmSGDy2hLLGa65QkIIT1O LqNPvwFjOTcDNveebhu+d771CF4yk+d2bqtkX6JWx+iMUnYYcQjul4cclDZynOAV7+o5 Be0KrGS8SM7f8uM4a8pA5csvQnNTeKdxJnQV4vI7tB5syQBrh7qJ7ZbrDwTL8KoN2KKo Q5J08zEN9kG7/sZCZdKswCCKWeJV6G3+DWl+MIYTnAGScAyTmzm2Jfub5pgzYFxaEdKP LwkjHnQqkEIKoiQCWa/ucDnjAeRsfZeoLRVo32EOK00AfuS+QH3aHEKJQaZulqwfG80V nfBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hNXUMe4iwBq18KsdG9MXbpB/qnlV0dHfbMwnX8+4jOE=; b=aWwsZskRmCiHPlyxVIZ+4YeCwcE+n+HY8JagRtyWGfdvP1k6lP3bJgLCclx6FTACI/ VTC9GkM/hIffERVIiDWMktRVX6i38HqP3Mlm6kt/oHcD+TgEO/ccAC/nvObzn94+TTEw D7n6oAhJxHpqllGBSLs1qD2YUVIydrEeD2EXxURkxCWX/f++GIfyppYkK9vfLMOt75C0 pYojbg2PXo+d0KwaHAtKpUtBjs0qLNBfRAacsz3gaTfREdqWMJMVhIwINWfOEnKM6vzp AutJdS3QZm3PNA1RgmSWGGkIko2sREZoZwkIse2YIKFp4schny2NWB2sNj3hWn7VVIhk AsEw== X-Gm-Message-State: AOAM530seq0X/izrMrZORn7vum1tul1eFNdzBb62C2ItRS21Cbx72jIm y/RsLSJHX65xphSoF1eshnMWK1EQwWCvaumN3l4= X-Google-Smtp-Source: ABdhPJwt8df3F7uLBeO8bmwGH4Imm84daqX3XBzVqna6LjAnSgbU/Iew54G7AwSoZJh3ddqOOWeRjKwSBV/acuR8zCQ= X-Received: by 2002:a2e:900a:: with SMTP id h10mr923104ljg.242.1594681280855; Mon, 13 Jul 2020 16:01:20 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Mon, 13 Jul 2020 16:00:44 -0700 Message-ID: To: Atul Tulshibagwale Cc: SecEvent Content-Type: multipart/alternative; boundary="0000000000004681d105aa5aabea" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 23:01:26 -0000 --0000000000004681d105aa5aabea Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable So the receiver is using authentication sometimes to determine SPAG, and not at other times? I'm digging into this as I had always thought of the event being between two parties, where they are identified by the endpoint and/or the credentials. Adding a relationship identifier seems to be solving the problem at the wrong layer, unless it is in all events. On Mon, Jul 13, 2020 at 3:54 PM Atul Tulshibagwale wrote: > Sorry for the terse message. > > If a single tenant transmitter is trusted by a multi-tenanted receiver fo= r > a specific tenant, then the SPAG-id need not be included if the subject i= s > unique at the tenant level, because the receiver will automatically > identify SPAG that the subject belongs to on its end (based on the > authentication). > > > > On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt wrote: > >> Which part is not required? >> >> On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale >> wrote: >> >>> Not required, since the claim is optional. >>> >>> On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt wrote= : >>> >>>> Would a transmitter that is only in one SPAG (a single tenant system) >>>> have to include its SPAG id in events sent to a receiver that accepts >>>> events from multiple SPAGs? But it would not include it in sending eve= nts >>>> to other receivers that have separate credentials for each relationshi= p? >>>> >>>> >>>> >>>> =E1=90=A7 >>>> >>>> On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale < >>>> atultulshi@google.com> wrote: >>>> >>>>> That could be true but there are a few ways in which it can be avoide= d: >>>>> >>>>> 1. The peers leverage some higher-level trust to accept / decline >>>>> events relating to lower level SPAGs. For example, if trust is est= ablished >>>>> at a tenant level, then an OU level SPAG need not have its own >>>>> authorization. >>>>> 2. The secret required for establishing the authorization of a >>>>> SPAG may be temporary. For example: >>>>> 1. An administrator signs in to their tenant in the >>>>> transmitter's administrator console >>>>> 2. The admin obtains a temporary authorization (one-time code) >>>>> 3. The admin signs in to their tenant in the receiver's >>>>> administration console and pastes in the one-time code >>>>> 4. The receiver sends a request to enable the stream for the >>>>> specified SPAG with that one-time authorization. >>>>> >>>>> In the first case, there are no additional secrets required. In the >>>>> second case, the secret is temporary. >>>>> >>>>> >>>>> >>>>> On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt >>>>> wrote: >>>>> >>>>>> I see the SPAG lets the transmitter and receiver provide context, as >>>>>> the subject identifier may be the same across SPAGs. >>>>>> >>>>>> Now I'm trying to understand how the transmitter authenticates to th= e >>>>>> receiver if it does not have it's own secret (assuming that authenti= cation >>>>>> model) -- IE, how does the receiver know the transmitter is authoriz= ed for >>>>>> that SPAG? >>>>>> >>>>>> >>>>>> On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale < >>>>>> atultulshi@google.com> wrote: >>>>>> >>>>>>> Dick, your understanding is correct. >>>>>>> >>>>>>> To clarify the proposal here, Here's the text I'm proposing to be >>>>>>> added: >>>>>>> >>>>>>> 3. Subject Principals >>>>>>> >>>>>>> Subject Principals are the management entities associated with >>>>>>> Subjects. These may be human or robotic principals or devices o= r >>>>>>> other entities that are managed by transmitters and receivers. >>>>>>> For >>>>>>> example, the same Subject Principal may be referred to by an ema= il >>>>>>> address or a phone number. A transmitter or receiver will >>>>>>> typically >>>>>>> manage subject principals and organize them into sub-groupings >>>>>>> such >>>>>>> as tenants, groups, organizational units, etc. >>>>>>> >>>>>>> Subjects are identified by Subject Identifiers defined below. >>>>>>> >>>>>>> 3.1. SPAGs >>>>>>> >>>>>>> Subject Principals MAY be grouped for administrative purposes in= to >>>>>>> "Subject Principal Administrative Groupings" or SPAGs. For >>>>>>> example, >>>>>>> all users belonging to one customer of a "multi-tenanted" >>>>>>> Transmitter >>>>>>> may be in one SPAG. Alternatively, an Organizational Unit or a >>>>>>> group >>>>>>> of Subjects within a customer of a Transmitter (whether multi- >>>>>>> tenanted or not) may be one SPAG. SPAGs may have overlapping >>>>>>> sets of >>>>>>> Subjects. >>>>>>> >>>>>>> A SPAG MAY be the Subject of certain stream update events define= d >>>>>>> later in this spec, hence is defined as a Subject Type of its ow= n >>>>>>> below. A SPAG identifier MAY be included in other subject types >>>>>>> to >>>>>>> disambiguate the subject. >>>>>>> >>>>>>> A SPAG subject identifier is agreed to offline between a >>>>>>> transmitter >>>>>>> and a receiver. >>>>>>> >>>>>>> The benefits of doing this are: >>>>>>> >>>>>>> 1. Multi-tenanted hosts do not need to maintain secrets per >>>>>>> tenant and per transmitter tenant if each tenant has to be an ev= ent >>>>>>> transmitter and an event receiver of its own. >>>>>>> 2. An event stream may be established between two multi-tenanted >>>>>>> hosts, and so does not need to be managed at a per-tenant level >>>>>>> 3. The same subject or subject principal may be a part of >>>>>>> multiple SPAGs, and identifying the SPAG that an event relates t= o can be >>>>>>> achieved if the standard allows for the SPAGs to be identified. >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt >>>>>>> wrote: >>>>>>> >>>>>>>> To clarify, your proposal is driven by the implementation burden o= f >>>>>>>> maintaining separate secrets / streams between a transmitter and r= eceiver? >>>>>>>> =E1=90=A7 >>>>>>>> >>>>>>>> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale >>>>>>> 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >>>>>>>> >>>>>>>>> Hi all, >>>>>>>>> Here's a quick background for the proposal >>>>>>>>> for including >>>>>>>>> Subject Principals and Subject Principal Administrative Groupings= or SPAGs >>>>>>>>> in the Subject Identifiers spec. >>>>>>>>> >>>>>>>>> *Use of Subject Identifiers in Shared Signals and Events*: >>>>>>>>> The Shared Signals and Events (SSE) profile of SETs specifies tha= t >>>>>>>>> transmitters and receivers send and receive SETs that contain Sub= ject >>>>>>>>> Identifiers. These subject identifiers have the format that is no= w being >>>>>>>>> discussed as a separate specification here. >>>>>>>>> >>>>>>>>> *Transmitters and Receivers in SSE* >>>>>>>>> The SSE profile defines transmitters and receivers as hosts that >>>>>>>>> manage streams between peers. The receiver authenticates to the t= ransmitter >>>>>>>>> using OAuth, requiring the use of a secret per receiver. In a >>>>>>>>> multi-tenanted host that handles hundreds of thousands or million= s of >>>>>>>>> independent tenants, maintaining such a secret per instance of a = receiver >>>>>>>>> is cumbersome. Furthermore, since a transmitter and a receiver ha= s to >>>>>>>>> maintain a stream per pair, creating such per-tenant streams can = add >>>>>>>>> significant implementation overhead. >>>>>>>>> >>>>>>>>> *SPAGs* >>>>>>>>> Therefore, we need a notion of a grouping of subjects within the >>>>>>>>> same transmitter and receiver to distinguish between various admi= nistrative >>>>>>>>> groupings that exist within a host. These groupings could include= tenants, >>>>>>>>> organizational units or user groups.. This grouping is captured i= n the >>>>>>>>> notion of a SPAG. The uniqueness of a user identifier (subject id= entifier) >>>>>>>>> may also be limited to a SPAG. For example, if a random unique ID >>>>>>>>> represents a user, then that ID may be unique within a SPAG and n= ot >>>>>>>>> universally across a transmitter or receiver. This is because eac= h >>>>>>>>> transmitter and receiver may have multiple connections to other >>>>>>>>> transmitters and receivers, and ensuring uniqueness across all su= ch peers >>>>>>>>> is probably an intractable problem. >>>>>>>>> >>>>>>>>> *Subject Principals* >>>>>>>>> While what is represented within a subject identifier may be only >>>>>>>>> an aspect of the management entity, the administrative grouping i= s about >>>>>>>>> the management entity itself. This could be the user, device or o= ther >>>>>>>>> principal that the subject identifier represents. Therefore, an a= bstract >>>>>>>>> notion of a Subject Principal is also required in order specify w= hat the >>>>>>>>> grouping within a SPAG is about. >>>>>>>>> >>>>>>>>> The above is captured in the "Subject Principal" and "SPAG" >>>>>>>>> sections within the proposed PR >>>>>>>>> . >>>>>>>>> >>>>>>>>> Thanks, >>>>>>>>> Atul >>>>>>>>> >>>>>>>>> _______________________________________________ >>>>>>>>> Id-event mailing list >>>>>>>>> Id-event@ietf.org >>>>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>>>> >>>>>>>> --0000000000004681d105aa5aabea Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    So the receiver is using authentication sometimes to deter= mine SPAG, and not at other times?

    I'm digging into = this as I had always thought of the event being between two parties, where = they are identified=C2=A0by the endpoint and/or the credentials.
    =
    Adding a relationship identifier seems to be solving the pro= blem at the wrong layer, unless it is in all events.


    On= Mon, Jul 13, 2020 at 3:54 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    Sorry for the ters= e message.

    If a single tenant transmitter is trusted by = a multi-tenanted receiver for a specific tenant, then the SPAG-id need not = be included if the subject is unique at the tenant level, because the recei= ver will automatically identify SPAG that the subject belongs to on its end= (based on the authentication).


    On Mon, = Jul 13, 2020 at 3:37 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    Which part is no= t required?

    On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    Not required, since the claim is optional.

    On Mon, Jul 13, 20= 20 at 3:25 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    Would a transmitter that = is only in one SPAG (a single tenant system) have to include its SPAG id in= events sent to a receiver that accepts events from multiple SPAGs? But it = would not include it in sending events to other receivers=C2=A0that have se= parate credentials for each relationship?



    <= /div>
    =E1=90=A7

    On Mon, Jul 13, 2020 at 3:0= 5 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    That could be true but th= ere are a few ways in which it can be avoided:
    1. The peers levera= ge some higher-level trust to accept / decline events relating to lower lev= el SPAGs. For example, if trust is established at a tenant level, then an O= U level SPAG need not have its own authorization.
    2. The secret requir= ed for establishing the authorization of a SPAG may be temporary. For examp= le:
      1. An administrator signs in to their tenant in the transmitte= r's administrator console
      2. The admin obtains a temporary authori= zation (one-time code)
      3. The admin signs in to their tenant in the re= ceiver's administration console and pastes in the one-time code
        4. The receiver sends a request to enable the stream for the specified SPAG w= ith that one-time authorization.
    In the first case, ther= e are no additional secrets required. In the second case, the secret is tem= porary.



    On Mon, Jul 13, 2020 at 2:= 34 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    I see the SPAG lets the transmitte= r and receiver provide context, as the subject identifier may be the same a= cross SPAGs.

    Now I'm trying to understand how the tr= ansmitter authenticates to the receiver if it does not have it's own se= cret (assuming that authentication model) -- IE, how does the receiver know= the transmitter is authorized=C2=A0for that SPAG?


    On M= on, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    =
    Dick, your understanding is correct.

    To clarify the = proposal here, Here's the text I'm proposing to be added:

    <= font face=3D"monospace">3.=C2=A0 Subject Principals

    =C2=A0 =C2=A0Sub= ject Principals are the management entities associated with
    =C2=A0 =C2= =A0Subjects.=C2=A0 These may be human or robotic principals or devices or=C2=A0 =C2=A0other entities that are managed by transmitters and receiver= s.=C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Principal may be ref= erred to by an email
    =C2=A0 =C2=A0address or a phone number.=C2=A0 A tra= nsmitter or receiver will typically
    =C2=A0 =C2=A0manage subject principa= ls and organize them into sub-groupings such
    =C2=A0 =C2=A0as tenants, gr= oups, organizational units, etc.

    =C2=A0 =C2=A0Subjects are identifie= d by Subject Identifiers defined below.

    3.1.=C2=A0 SPAGs

    =C2= =A0 =C2=A0Subject Principals MAY be grouped for administrative purposes int= o
    =C2=A0 =C2=A0"Subject Principal Administrative Groupings" or= SPAGs.=C2=A0 For example,
    =C2=A0 =C2=A0all users belonging to one custo= mer of a "multi-tenanted" Transmitter
    =C2=A0 =C2=A0may be in o= ne SPAG.=C2=A0 Alternatively, an Organizational Unit or a group
    =C2=A0 = =C2=A0of Subjects within a customer of a Transmitter (whether multi-
    =C2= =A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs may have overlappin= g sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A SPAG MAY be the S= ubject of certain stream update events defined
    =C2=A0 =C2=A0later in thi= s spec, hence is defined as a Subject Type of its own
    =C2=A0 =C2=A0below= .=C2=A0 A SPAG identifier MAY be included in other subject types to
    =C2= =A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2=A0A SPAG subject iden= tifier is agreed to offline between a transmitter
    =C2=A0 =C2=A0and a rec= eiver.

    The benefits of doing this are:
    <= ol>
  • Multi-tenanted hosts do not need to maintain secrets per tenant and = per transmitter tenant if each tenant has to be an event transmitter and an= event receiver of its own.
  • An event stream may be established betw= een two multi-tenanted hosts, and so does not need to be managed at a per-t= enant level
  • The same subject or subject principal may be a part of = multiple SPAGs, and identifying the SPAG that an event relates to can be ac= hieved if the standard allows for the SPAGs to be identified.


    • On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt <dick.hardt@gmail.com>= ; wrote:
    To clarify, your proposal is driven by the implementation=C2=A0bu= rden of maintaining separate secrets / streams between a transmitter and re= ceiver?
    =E1=90=A7

    On Mon, Jul 13, 2020 at 9:01 AM= Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
    <= /div>
    Hi = all,=C2=A0
    Here's a quick background for the proposal for includ= ing Subject Principals and Subject Principal Administrative Groupings or SP= AGs in the Subject Identifiers spec.

    Use of Sub= ject Identifiers in Shared Signals and Events:
    The Shared Sig= nals and Events (SSE) profile of SETs specifies that transmitters and recei= vers send and receive SETs that contain Subject Identifiers. These subject = identifiers have the format that is now being discussed as a separate speci= fication here.

    Transmitters and Receivers i= n SSE
    The SSE profile defines transmitters and receivers as h= osts that manage streams between peers. The receiver authenticates to the t= ransmitter using OAuth, requiring the use of a secret per receiver. In a mu= lti-tenanted host that handles hundreds of thousands or millions of indepen= dent tenants, maintaining such a secret per instance of a receiver is cumbe= rsome. Furthermore, since a transmitter and a receiver has to maintain a st= ream per pair, creating such per-tenant streams can add significant impleme= ntation overhead.

    SPAGs
    Therefore= , we need a notion of a grouping of subjects within the same transmitter an= d receiver to distinguish between various administrative groupings that exi= st within a host. These groupings could include tenants, organizational uni= ts or user groups.. This grouping is captured in the notion of a SPAG. The = uniqueness of a user identifier (subject identifier) may also be limited to= a SPAG. For example, if a random unique ID represents a user, then that ID= may be unique within a SPAG and not universally across a transmitter or re= ceiver. This is because each transmitter and receiver may have multiple con= nections to other transmitters and receivers, and ensuring uniqueness acros= s all such peers is probably an intractable problem.

    Subject Principals
    While what is represented within a s= ubject identifier may be only an aspect of the management entity, the admin= istrative grouping is about the management entity itself. This could be the= user, device or other principal that the subject identifier represents. Th= erefore, an abstract notion of a Subject Principal is also required in orde= r specify what the grouping within a SPAG is about.

    The above is captured in the "Subject Principal" and "SPAG= " sections within the proposed PR.

    Thanks,=
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --0000000000004681d105aa5aabea-- From nobody Mon Jul 13 17:08:36 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFE3B3A08D4 for ; Mon, 13 Jul 2020 17:08:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.598 X-Spam-Level: X-Spam-Status: No, score=-17.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LLKDofqdiKyz for ; Mon, 13 Jul 2020 17:08:32 -0700 (PDT) Received: from mail-yb1-xb2c.google.com (mail-yb1-xb2c.google.com [IPv6:2607:f8b0:4864:20::b2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9AF23A08B9 for ; Mon, 13 Jul 2020 17:08:31 -0700 (PDT) Received: by mail-yb1-xb2c.google.com with SMTP id v9so7330436ybe.3 for ; Mon, 13 Jul 2020 17:08:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oD3IMSFHqUpVufWtvT++QY2PGvi6OcKLwF4Hzy+03t8=; b=ltIHsdMajWhmnDc/ZIfFO1Rc/W4OcSZh8iblubzAnMEa6sTAvH+5lvPJTBAIbeZViw 0N9OUYV5IfddAdcmOcBwI+I06qjTLbN85Ee5npsWgm5nDS+Fn5iGG7/DIA7peeOYf4ZU PYM/uZs0LysoxbhYMnhHdXX0qWdD+6lPRASOjvaDdnUnTh3OTtwAunsj/RlcTdmHOA9f 2SYHwzOl5GxHb3pM3xq9d6bJOkOAPeZxrKDFHox/7cPFOwVUNafXe9vJ4R1b24mruZ8/ q9+/8HjUXexjsQZAOXrGDxRFbSsPwgHlXjkpk3xrRB+0UHwwI3oFGn++7z6uDIBg6Ffr 358Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oD3IMSFHqUpVufWtvT++QY2PGvi6OcKLwF4Hzy+03t8=; b=IFUt+GDIOPhAvYDnlrEnMuoyTX6TGzeCN+BpZMwGKp6IKSAmOyBRwzOfQOhPbkv6Ky JW1HeD0l12uW3hi+I2B1kfb2vGLxostNy9I/mrbxQtdQXABo3NlhdzSyljCxfL2kOp0i 9Iz8pxW4XeabRxA49v5EvLDfXtbXhImPvZfahZ63wCqItdf8X9UYiOaD2zuW9eoTlmx6 KmTuVK6otfNi3rgDbj3wTjqRwc4DbRrwSDjfgzU/QQgNF5zE/J/i9V0k5Jj80APr7Vey yuqLN4ylEISBe989CQQLyddD2K7tZX12VplnJva8nG4uKpKggA5hyvpBEDumpUgDyWh7 VKVw== X-Gm-Message-State: AOAM5314vX9NljrKlr6Tgj7K7TpPMZNA27dVE4pAngHi41ENiTQo0Oj5 Aq+0IxIB6PrQERiLw87BvDV1yfVb+TEBrY0DTcCvQg== X-Google-Smtp-Source: ABdhPJyGdSRdc8lmJIYMQ6Y7FFPXt8nLAJOOGXhAh4IA76yYfeJ5qFlCq4o8tsfWlao8sn2Yg+X/3+SWl1Okn2lQjUk= X-Received: by 2002:a25:c713:: with SMTP id w19mr4168715ybe.130.1594685310660; Mon, 13 Jul 2020 17:08:30 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Atul Tulshibagwale Date: Mon, 13 Jul 2020 17:08:19 -0700 Message-ID: To: Dick Hardt Cc: SecEvent Content-Type: multipart/alternative; boundary="00000000000078cdaa05aa5b9b78" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 00:08:35 -0000 --00000000000078cdaa05aa5b9b78 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I am OK with making the spag_id a required claim in every subject identifier. For single tenanted transmitters, it would be a constant value for all events they generate. On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt wrote: > So the receiver is using authentication sometimes to determine SPAG, and > not at other times? > > I'm digging into this as I had always thought of the event being between > two parties, where they are identified by the endpoint and/or the > credentials. > > Adding a relationship identifier seems to be solving the problem at the > wrong layer, unless it is in all events. > > > On Mon, Jul 13, 2020 at 3:54 PM Atul Tulshibagwale > wrote: > >> Sorry for the terse message. >> >> If a single tenant transmitter is trusted by a multi-tenanted receiver >> for a specific tenant, then the SPAG-id need not be included if the subj= ect >> is unique at the tenant level, because the receiver will automatically >> identify SPAG that the subject belongs to on its end (based on the >> authentication). >> >> >> >> On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt wrote: >> >>> Which part is not required? >>> >>> On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale < >>> atultulshi@google.com> wrote: >>> >>>> Not required, since the claim is optional. >>>> >>>> On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt >>>> wrote: >>>> >>>>> Would a transmitter that is only in one SPAG (a single tenant system) >>>>> have to include its SPAG id in events sent to a receiver that accepts >>>>> events from multiple SPAGs? But it would not include it in sending ev= ents >>>>> to other receivers that have separate credentials for each relationsh= ip? >>>>> >>>>> >>>>> >>>>> =E1=90=A7 >>>>> >>>>> On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale < >>>>> atultulshi@google.com> wrote: >>>>> >>>>>> That could be true but there are a few ways in which it can be >>>>>> avoided: >>>>>> >>>>>> 1. The peers leverage some higher-level trust to accept / decline >>>>>> events relating to lower level SPAGs. For example, if trust is es= tablished >>>>>> at a tenant level, then an OU level SPAG need not have its own >>>>>> authorization. >>>>>> 2. The secret required for establishing the authorization of a >>>>>> SPAG may be temporary. For example: >>>>>> 1. An administrator signs in to their tenant in the >>>>>> transmitter's administrator console >>>>>> 2. The admin obtains a temporary authorization (one-time code) >>>>>> 3. The admin signs in to their tenant in the receiver's >>>>>> administration console and pastes in the one-time code >>>>>> 4. The receiver sends a request to enable the stream for the >>>>>> specified SPAG with that one-time authorization. >>>>>> >>>>>> In the first case, there are no additional secrets required. In the >>>>>> second case, the secret is temporary. >>>>>> >>>>>> >>>>>> >>>>>> On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt >>>>>> wrote: >>>>>> >>>>>>> I see the SPAG lets the transmitter and receiver provide context, a= s >>>>>>> the subject identifier may be the same across SPAGs. >>>>>>> >>>>>>> Now I'm trying to understand how the transmitter authenticates to >>>>>>> the receiver if it does not have it's own secret (assuming that >>>>>>> authentication model) -- IE, how does the receiver know the transmi= tter is >>>>>>> authorized for that SPAG? >>>>>>> >>>>>>> >>>>>>> On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale < >>>>>>> atultulshi@google.com> wrote: >>>>>>> >>>>>>>> Dick, your understanding is correct. >>>>>>>> >>>>>>>> To clarify the proposal here, Here's the text I'm proposing to be >>>>>>>> added: >>>>>>>> >>>>>>>> 3. Subject Principals >>>>>>>> >>>>>>>> Subject Principals are the management entities associated with >>>>>>>> Subjects. These may be human or robotic principals or devices = or >>>>>>>> other entities that are managed by transmitters and receivers. >>>>>>>> For >>>>>>>> example, the same Subject Principal may be referred to by an >>>>>>>> email >>>>>>>> address or a phone number. A transmitter or receiver will >>>>>>>> typically >>>>>>>> manage subject principals and organize them into sub-groupings >>>>>>>> such >>>>>>>> as tenants, groups, organizational units, etc. >>>>>>>> >>>>>>>> Subjects are identified by Subject Identifiers defined below. >>>>>>>> >>>>>>>> 3.1. SPAGs >>>>>>>> >>>>>>>> Subject Principals MAY be grouped for administrative purposes >>>>>>>> into >>>>>>>> "Subject Principal Administrative Groupings" or SPAGs. For >>>>>>>> example, >>>>>>>> all users belonging to one customer of a "multi-tenanted" >>>>>>>> Transmitter >>>>>>>> may be in one SPAG. Alternatively, an Organizational Unit or a >>>>>>>> group >>>>>>>> of Subjects within a customer of a Transmitter (whether multi- >>>>>>>> tenanted or not) may be one SPAG. SPAGs may have overlapping >>>>>>>> sets of >>>>>>>> Subjects. >>>>>>>> >>>>>>>> A SPAG MAY be the Subject of certain stream update events defin= ed >>>>>>>> later in this spec, hence is defined as a Subject Type of its o= wn >>>>>>>> below. A SPAG identifier MAY be included in other subject type= s >>>>>>>> to >>>>>>>> disambiguate the subject. >>>>>>>> >>>>>>>> A SPAG subject identifier is agreed to offline between a >>>>>>>> transmitter >>>>>>>> and a receiver. >>>>>>>> >>>>>>>> The benefits of doing this are: >>>>>>>> >>>>>>>> 1. Multi-tenanted hosts do not need to maintain secrets per >>>>>>>> tenant and per transmitter tenant if each tenant has to be an e= vent >>>>>>>> transmitter and an event receiver of its own. >>>>>>>> 2. An event stream may be established between two >>>>>>>> multi-tenanted hosts, and so does not need to be managed at a p= er-tenant >>>>>>>> level >>>>>>>> 3. The same subject or subject principal may be a part of >>>>>>>> multiple SPAGs, and identifying the SPAG that an event relates = to can be >>>>>>>> achieved if the standard allows for the SPAGs to be identified. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt >>>>>>>> wrote: >>>>>>>> >>>>>>>>> To clarify, your proposal is driven by the implementation burden >>>>>>>>> of maintaining separate secrets / streams between a transmitter a= nd >>>>>>>>> receiver? >>>>>>>>> =E1=90=A7 >>>>>>>>> >>>>>>>>> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale >>>>>>>> 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote= : >>>>>>>>> >>>>>>>>>> Hi all, >>>>>>>>>> Here's a quick background for the proposal >>>>>>>>>> for including >>>>>>>>>> Subject Principals and Subject Principal Administrative Grouping= s or SPAGs >>>>>>>>>> in the Subject Identifiers spec. >>>>>>>>>> >>>>>>>>>> *Use of Subject Identifiers in Shared Signals and Events*: >>>>>>>>>> The Shared Signals and Events (SSE) profile of SETs specifies >>>>>>>>>> that transmitters and receivers send and receive SETs that conta= in Subject >>>>>>>>>> Identifiers. These subject identifiers have the format that is n= ow being >>>>>>>>>> discussed as a separate specification here. >>>>>>>>>> >>>>>>>>>> *Transmitters and Receivers in SSE* >>>>>>>>>> The SSE profile defines transmitters and receivers as hosts that >>>>>>>>>> manage streams between peers. The receiver authenticates to the = transmitter >>>>>>>>>> using OAuth, requiring the use of a secret per receiver. In a >>>>>>>>>> multi-tenanted host that handles hundreds of thousands or millio= ns of >>>>>>>>>> independent tenants, maintaining such a secret per instance of a= receiver >>>>>>>>>> is cumbersome. Furthermore, since a transmitter and a receiver h= as to >>>>>>>>>> maintain a stream per pair, creating such per-tenant streams can= add >>>>>>>>>> significant implementation overhead. >>>>>>>>>> >>>>>>>>>> *SPAGs* >>>>>>>>>> Therefore, we need a notion of a grouping of subjects within the >>>>>>>>>> same transmitter and receiver to distinguish between various adm= inistrative >>>>>>>>>> groupings that exist within a host. These groupings could includ= e tenants, >>>>>>>>>> organizational units or user groups.. This grouping is captured = in the >>>>>>>>>> notion of a SPAG. The uniqueness of a user identifier (subject i= dentifier) >>>>>>>>>> may also be limited to a SPAG. For example, if a random unique I= D >>>>>>>>>> represents a user, then that ID may be unique within a SPAG and = not >>>>>>>>>> universally across a transmitter or receiver. This is because ea= ch >>>>>>>>>> transmitter and receiver may have multiple connections to other >>>>>>>>>> transmitters and receivers, and ensuring uniqueness across all s= uch peers >>>>>>>>>> is probably an intractable problem. >>>>>>>>>> >>>>>>>>>> *Subject Principals* >>>>>>>>>> While what is represented within a subject identifier may be onl= y >>>>>>>>>> an aspect of the management entity, the administrative grouping = is about >>>>>>>>>> the management entity itself. This could be the user, device or = other >>>>>>>>>> principal that the subject identifier represents. Therefore, an = abstract >>>>>>>>>> notion of a Subject Principal is also required in order specify = what the >>>>>>>>>> grouping within a SPAG is about. >>>>>>>>>> >>>>>>>>>> The above is captured in the "Subject Principal" and "SPAG" >>>>>>>>>> sections within the proposed PR >>>>>>>>>> . >>>>>>>>>> >>>>>>>>>> Thanks, >>>>>>>>>> Atul >>>>>>>>>> >>>>>>>>>> _______________________________________________ >>>>>>>>>> Id-event mailing list >>>>>>>>>> Id-event@ietf.org >>>>>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>>>>> >>>>>>>>> --00000000000078cdaa05aa5b9b78 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    I am OK with making the spag_id a required claim in every = subject identifier. For single tenanted transmitters, it would be a constan= t value for all events they generate.

    <= div dir=3D"ltr" class=3D"gmail_attr">On Mon, Jul 13, 2020 at 4:01 PM Dick H= ardt <dick.hardt@gmail.com&g= t; wrote:
    So the receiver is using authentication sometimes to determine S= PAG, and not at other times?

    I'm digging into this a= s I had always thought of the event being between two parties, where they a= re identified=C2=A0by the endpoint and/or the credentials.

    Adding a relationship identifier seems to be solving the problem a= t the wrong layer, unless it is in all events.

    On Mon, = Jul 13, 2020 at 3:54 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    Sorry = for the terse message.

    If a single tenant transmitter is= trusted by a multi-tenanted receiver for a specific tenant, then the SPAG-= id need not be included if the subject is unique at the tenant level, becau= se the receiver will automatically identify SPAG that the subject belongs t= o on its end (based on the authentication).



    On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    Whic= h part is not required?

    On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale &= lt;atultulshi@go= ogle.com> wrote:
    Not required, since the claim is optional.
    On Mon, = Jul 13, 2020 at 3:25 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    Would a transmit= ter that is only in one SPAG (a single tenant system) have to include its S= PAG id in events sent to a receiver that accepts events from multiple SPAGs= ? But it would not include it in sending events to other receivers=C2=A0tha= t have separate credentials for each relationship?


    <= div>
    =E1=90=A7

    On Mon, Jul 13, 20= 20 at 3:05 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    That could be tr= ue but there are a few ways in which it can be avoided:
    1. The pee= rs leverage some higher-level trust to accept / decline events relating to = lower level SPAGs. For example, if trust is established at a tenant level, = then an OU level SPAG need not have its own authorization.
    2. The secr= et required for establishing the authorization of a SPAG may be temporary. = For example:
      1. An administrator signs in to their tenant in the t= ransmitter's administrator console
      2. The admin obtains a temporar= y authorization (one-time code)
      3. The admin signs in to their tenant = in the receiver's administration console and pastes in the one-time cod= e
      4. The receiver sends a request to enable the stream for the specifi= ed SPAG with that one-time authorization.
    In the first c= ase, there are no additional secrets required. In the second case, the secr= et is temporary.



    On Mon, Jul 13, 2= 020 at 2:34 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    I see the SPAG lets the t= ransmitter and receiver provide context, as the subject identifier may be t= he same across SPAGs.

    Now I'm trying to understand h= ow the transmitter authenticates to the receiver if it does not have it'= ;s own secret (assuming that authentication model) -- IE, how does the rece= iver know the transmitter is authorized=C2=A0for that SPAG?

    <= /div>

    On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale <atultulshi@google.com> w= rote:
    Dick, your understanding is correct.

    To c= larify the proposal here, Here's the text I'm proposing to be added= :

    3.=C2=A0 Subject Principals

    =C2= =A0 =C2=A0Subject Principals are the management entities associated with=C2=A0 =C2=A0Subjects.=C2=A0 These may be human or robotic principals or d= evices or
    =C2=A0 =C2=A0other entities that are managed by transmitters a= nd receivers.=C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Principal= may be referred to by an email
    =C2=A0 =C2=A0address or a phone number.= =C2=A0 A transmitter or receiver will typically
    =C2=A0 =C2=A0manage subj= ect principals and organize them into sub-groupings such
    =C2=A0 =C2=A0as= tenants, groups, organizational units, etc.

    =C2=A0 =C2=A0Subjects a= re identified by Subject Identifiers defined below.

    3.1.=C2=A0 SPAGs=

    =C2=A0 =C2=A0Subject Principals MAY be grouped for administrative p= urposes into
    =C2=A0 =C2=A0"Subject Principal Administrative Groupin= gs" or SPAGs.=C2=A0 For example,
    =C2=A0 =C2=A0all users belonging t= o one customer of a "multi-tenanted" Transmitter
    =C2=A0 =C2=A0= may be in one SPAG.=C2=A0 Alternatively, an Organizational Unit or a group<= br>=C2=A0 =C2=A0of Subjects within a customer of a Transmitter (whether mul= ti-
    =C2=A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs may have = overlapping sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A SPAG MA= Y be the Subject of certain stream update events defined
    =C2=A0 =C2=A0la= ter in this spec, hence is defined as a Subject Type of its own
    =C2=A0 = =C2=A0below.=C2=A0 A SPAG identifier MAY be included in other subject types= to
    =C2=A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2=A0A SPAG su= bject identifier is agreed to offline between a transmitter
    =C2=A0 =C2= =A0and a receiver.

    The benefits of doing this are:=
    1. Multi-tenanted hosts do not need to maintain secrets per= tenant and per transmitter tenant if each tenant has to be an event transm= itter and an event receiver of its own.
    2. An event stream may be esta= blished between two multi-tenanted hosts, and so does not need to be manage= d at a per-tenant level
    3. The same subject or subject principal may b= e a part of multiple SPAGs, and identifying the SPAG that an event relates = to can be achieved if the standard allows for the SPAGs to be identified.


    On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt &= lt;dick.hardt@gma= il.com> wrote:
    To clarify, your proposal is driven by the implement= ation=C2=A0burden of maintaining separate secrets / streams between a trans= mitter and receiver?
    =E1=90=A7

    On Mon, Jul 13, 20= 20 at 9:01 AM Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>= ; wrote:
    Hi all,=C2=A0
    Here's a quick background for the proposal= for including Subject Principals and Subject Principal Administrative = Groupings or SPAGs in the Subject Identifiers spec.

    Use of Subject Identifiers in Shared Signals and Events:
    The Shared Signals and Events (SSE) profile of SETs specifies that transmi= tters and receivers send and receive SETs that contain Subject Identifiers.= These subject identifiers have the format that is now being discussed as a= separate specification here.

    Transmitters = and Receivers in SSE
    The SSE profile defines transmitters and= receivers as hosts that manage streams between peers. The receiver authent= icates to the transmitter using OAuth, requiring the use of a secret per re= ceiver. In a multi-tenanted host that handles hundreds of thousands or mill= ions of independent tenants, maintaining such a secret per instance of a re= ceiver is cumbersome. Furthermore, since a transmitter and a receiver has t= o maintain a stream per pair, creating such per-tenant streams can add sign= ificant implementation overhead.

    SPAGs
    Therefore, we need a notion of a grouping of subjects within the same= transmitter and receiver to distinguish between various administrative gro= upings that exist within a host. These groupings could include tenants, org= anizational units or user groups.. This grouping is captured in the notion = of a SPAG. The uniqueness of a user identifier (subject identifier) may als= o be limited to a SPAG. For example, if a random unique ID represents a use= r, then that ID may be unique within a SPAG and not universally across a tr= ansmitter or receiver. This is because each transmitter and receiver may ha= ve multiple connections to other transmitters and receivers, and ensuring u= niqueness across all such peers is probably an intractable problem.

    Subject Principals
    While what is represe= nted within a subject identifier may be only an aspect of the management en= tity, the administrative grouping is about the management entity itself. Th= is could be the user, device or other principal that the subject identifier= represents. Therefore, an abstract notion of a Subject Principal is also r= equired in order specify what the grouping within a SPAG is about.

    The above is captured in the "Subject Principal"= and "SPAG" sections within the proposed PR.

    Thanks,
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --00000000000078cdaa05aa5b9b78-- From nobody Mon Jul 13 17:13:49 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4ACF3A0DFA for ; Mon, 13 Jul 2020 17:13:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vz0vMAEW5PmV for ; Mon, 13 Jul 2020 17:13:39 -0700 (PDT) Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3BB83A0DD7 for ; Mon, 13 Jul 2020 17:13:26 -0700 (PDT) Received: by mail-lj1-x229.google.com with SMTP id s9so20294222ljm.11 for ; Mon, 13 Jul 2020 17:13:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Xao1lrWlmAUDwEfhq7GoUMwLjLpxZoT8eo9KFnMiemA=; b=X3GB8o1C7JCnuFe8NchlyVKK9ErM0+ZtbEDuPoZt8zbkAp/DBAuRThCsjapr14JGxE 58fnuAY1DYv4LG45PfSFZd0V9kBjRQmI1Nw3SlImyacbof4+YdJkOJQWuOxZ0I7UF7VT RAetYVhqRzP907zw7Dljbylh89vuHq/UeYjolfNSjFbhcghdzle6pSWf9yX3afYiMI8g UsoDM1JicPC+dTogvuhmdaPUx5w0Q+3ijpGGqvxBLVBczcRpKx46KBRLNBvQkrEUk/Z2 JSEwj2q+5DqJcveydY8ac8bprc7Gc+NSCmw8ngeZwRTEKS53bYBGJj2bmclWyyqC8CUg dYAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Xao1lrWlmAUDwEfhq7GoUMwLjLpxZoT8eo9KFnMiemA=; b=kqdApO9Zo1pr2MST7rrdvszCXNAZftsVOfDWy83k+NXNMKZOfh8NRFecQR2zxeOdXR O5pbtx9nQGNVMJU35pjxdTwYJsMJEYFJlv0o7OBxcbpY9FUSuRE4knl4VGsf/pLlOh/X +GLpSEvE6p8JJesL3u9xkJAGebnC8sY9MT3aTHHguxFZTXHvytjzRgXJT/8IPry3j824 04FCMoO9yAx489hXNvQWiOar1ig83o+cCbFtG6V5LagH3DSEF5EHIZWCpN2LhZlmzgyx ZVU6+ykmo0WB/YHzLJYrR3L5b3oAqMNYG312bTJVXW3QIkdGGCNvh3UGwvHqtYlt+fg2 DWCw== X-Gm-Message-State: AOAM533KtMvdwyFCybSD0iALGtYXHMD8zSoEap3Xqa5Cv+KDOUlo2MLf 39ucS6NwyToDRoVwSguIapJxadug31XrODKhM98= X-Google-Smtp-Source: ABdhPJyYyRBpS3TOvJsujTqx888ZCabEMWnpKrVf23XMoxE1bVzkJGO1S5+HdYNQYEwB8a3CxJkHNoD9/ZbvFF6u03E= X-Received: by 2002:a2e:9611:: with SMTP id v17mr1033332ljh.110.1594685604790; Mon, 13 Jul 2020 17:13:24 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Mon, 13 Jul 2020 17:12:48 -0700 Message-ID: To: Atul Tulshibagwale Cc: SecEvent Content-Type: multipart/alternative; boundary="00000000000000873205aa5bad91" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 00:13:48 -0000 --00000000000000873205aa5bad91 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Would different URLs for each relationship not solve your issue of maintaining secrets for each SPAG? For example: https:/example.com/secevent/SPAG_ID_1 https:/example.com/secevent/SPAG_ID_2 https:/example.com/secevent/SPAG_ID_3 Then the credential is independent of the SPAG, but we are not injecting an identifier (spag_id) that is only relevant to orgs that want to use the same credentials across SPAG relationships. On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale wrote: > I am OK with making the spag_id a required claim in every subject > identifier. For single tenanted transmitters, it would be a constant valu= e > for all events they generate. > > On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt wrote: > >> So the receiver is using authentication sometimes to determine SPAG, and >> not at other times? >> >> I'm digging into this as I had always thought of the event being between >> two parties, where they are identified by the endpoint and/or the >> credentials. >> >> Adding a relationship identifier seems to be solving the problem at the >> wrong layer, unless it is in all events. >> >> >> On Mon, Jul 13, 2020 at 3:54 PM Atul Tulshibagwale >> wrote: >> >>> Sorry for the terse message. >>> >>> If a single tenant transmitter is trusted by a multi-tenanted receiver >>> for a specific tenant, then the SPAG-id need not be included if the sub= ject >>> is unique at the tenant level, because the receiver will automatically >>> identify SPAG that the subject belongs to on its end (based on the >>> authentication). >>> >>> >>> >>> On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt wrote= : >>> >>>> Which part is not required? >>>> >>>> On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale < >>>> atultulshi@google.com> wrote: >>>> >>>>> Not required, since the claim is optional. >>>>> >>>>> On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt >>>>> wrote: >>>>> >>>>>> Would a transmitter that is only in one SPAG (a single tenant system= ) >>>>>> have to include its SPAG id in events sent to a receiver that accept= s >>>>>> events from multiple SPAGs? But it would not include it in sending e= vents >>>>>> to other receivers that have separate credentials for each relations= hip? >>>>>> >>>>>> >>>>>> >>>>>> =E1=90=A7 >>>>>> >>>>>> On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale < >>>>>> atultulshi@google.com> wrote: >>>>>> >>>>>>> That could be true but there are a few ways in which it can be >>>>>>> avoided: >>>>>>> >>>>>>> 1. The peers leverage some higher-level trust to accept / >>>>>>> decline events relating to lower level SPAGs. For example, if tr= ust is >>>>>>> established at a tenant level, then an OU level SPAG need not ha= ve its own >>>>>>> authorization. >>>>>>> 2. The secret required for establishing the authorization of a >>>>>>> SPAG may be temporary. For example: >>>>>>> 1. An administrator signs in to their tenant in the >>>>>>> transmitter's administrator console >>>>>>> 2. The admin obtains a temporary authorization (one-time code= ) >>>>>>> 3. The admin signs in to their tenant in the receiver's >>>>>>> administration console and pastes in the one-time code >>>>>>> 4. The receiver sends a request to enable the stream for the >>>>>>> specified SPAG with that one-time authorization. >>>>>>> >>>>>>> In the first case, there are no additional secrets required. In the >>>>>>> second case, the secret is temporary. >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt >>>>>>> wrote: >>>>>>> >>>>>>>> I see the SPAG lets the transmitter and receiver provide context, >>>>>>>> as the subject identifier may be the same across SPAGs. >>>>>>>> >>>>>>>> Now I'm trying to understand how the transmitter authenticates to >>>>>>>> the receiver if it does not have it's own secret (assuming that >>>>>>>> authentication model) -- IE, how does the receiver know the transm= itter is >>>>>>>> authorized for that SPAG? >>>>>>>> >>>>>>>> >>>>>>>> On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale < >>>>>>>> atultulshi@google.com> wrote: >>>>>>>> >>>>>>>>> Dick, your understanding is correct. >>>>>>>>> >>>>>>>>> To clarify the proposal here, Here's the text I'm proposing to be >>>>>>>>> added: >>>>>>>>> >>>>>>>>> 3. Subject Principals >>>>>>>>> >>>>>>>>> Subject Principals are the management entities associated with >>>>>>>>> Subjects. These may be human or robotic principals or devices >>>>>>>>> or >>>>>>>>> other entities that are managed by transmitters and receivers. >>>>>>>>> For >>>>>>>>> example, the same Subject Principal may be referred to by an >>>>>>>>> email >>>>>>>>> address or a phone number. A transmitter or receiver will >>>>>>>>> typically >>>>>>>>> manage subject principals and organize them into sub-groupings >>>>>>>>> such >>>>>>>>> as tenants, groups, organizational units, etc. >>>>>>>>> >>>>>>>>> Subjects are identified by Subject Identifiers defined below. >>>>>>>>> >>>>>>>>> 3.1. SPAGs >>>>>>>>> >>>>>>>>> Subject Principals MAY be grouped for administrative purposes >>>>>>>>> into >>>>>>>>> "Subject Principal Administrative Groupings" or SPAGs. For >>>>>>>>> example, >>>>>>>>> all users belonging to one customer of a "multi-tenanted" >>>>>>>>> Transmitter >>>>>>>>> may be in one SPAG. Alternatively, an Organizational Unit or = a >>>>>>>>> group >>>>>>>>> of Subjects within a customer of a Transmitter (whether multi- >>>>>>>>> tenanted or not) may be one SPAG. SPAGs may have overlapping >>>>>>>>> sets of >>>>>>>>> Subjects. >>>>>>>>> >>>>>>>>> A SPAG MAY be the Subject of certain stream update events >>>>>>>>> defined >>>>>>>>> later in this spec, hence is defined as a Subject Type of its >>>>>>>>> own >>>>>>>>> below. A SPAG identifier MAY be included in other subject >>>>>>>>> types to >>>>>>>>> disambiguate the subject. >>>>>>>>> >>>>>>>>> A SPAG subject identifier is agreed to offline between a >>>>>>>>> transmitter >>>>>>>>> and a receiver. >>>>>>>>> >>>>>>>>> The benefits of doing this are: >>>>>>>>> >>>>>>>>> 1. Multi-tenanted hosts do not need to maintain secrets per >>>>>>>>> tenant and per transmitter tenant if each tenant has to be an = event >>>>>>>>> transmitter and an event receiver of its own. >>>>>>>>> 2. An event stream may be established between two >>>>>>>>> multi-tenanted hosts, and so does not need to be managed at a = per-tenant >>>>>>>>> level >>>>>>>>> 3. The same subject or subject principal may be a part of >>>>>>>>> multiple SPAGs, and identifying the SPAG that an event relates= to can be >>>>>>>>> achieved if the standard allows for the SPAGs to be identified= . >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>>> To clarify, your proposal is driven by the implementation burden >>>>>>>>>> of maintaining separate secrets / streams between a transmitter = and >>>>>>>>>> receiver? >>>>>>>>>> =E1=90=A7 >>>>>>>>>> >>>>>>>>>> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale >>>>>>>>> 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>>> Hi all, >>>>>>>>>>> Here's a quick background for the proposal >>>>>>>>>>> for including >>>>>>>>>>> Subject Principals and Subject Principal Administrative Groupin= gs or SPAGs >>>>>>>>>>> in the Subject Identifiers spec. >>>>>>>>>>> >>>>>>>>>>> *Use of Subject Identifiers in Shared Signals and Events*: >>>>>>>>>>> The Shared Signals and Events (SSE) profile of SETs specifies >>>>>>>>>>> that transmitters and receivers send and receive SETs that cont= ain Subject >>>>>>>>>>> Identifiers. These subject identifiers have the format that is = now being >>>>>>>>>>> discussed as a separate specification here. >>>>>>>>>>> >>>>>>>>>>> *Transmitters and Receivers in SSE* >>>>>>>>>>> The SSE profile defines transmitters and receivers as hosts tha= t >>>>>>>>>>> manage streams between peers. The receiver authenticates to the= transmitter >>>>>>>>>>> using OAuth, requiring the use of a secret per receiver. In a >>>>>>>>>>> multi-tenanted host that handles hundreds of thousands or milli= ons of >>>>>>>>>>> independent tenants, maintaining such a secret per instance of = a receiver >>>>>>>>>>> is cumbersome. Furthermore, since a transmitter and a receiver = has to >>>>>>>>>>> maintain a stream per pair, creating such per-tenant streams ca= n add >>>>>>>>>>> significant implementation overhead. >>>>>>>>>>> >>>>>>>>>>> *SPAGs* >>>>>>>>>>> Therefore, we need a notion of a grouping of subjects within th= e >>>>>>>>>>> same transmitter and receiver to distinguish between various ad= ministrative >>>>>>>>>>> groupings that exist within a host. These groupings could inclu= de tenants, >>>>>>>>>>> organizational units or user groups.. This grouping is captured= in the >>>>>>>>>>> notion of a SPAG. The uniqueness of a user identifier (subject = identifier) >>>>>>>>>>> may also be limited to a SPAG. For example, if a random unique = ID >>>>>>>>>>> represents a user, then that ID may be unique within a SPAG and= not >>>>>>>>>>> universally across a transmitter or receiver. This is because e= ach >>>>>>>>>>> transmitter and receiver may have multiple connections to other >>>>>>>>>>> transmitters and receivers, and ensuring uniqueness across all = such peers >>>>>>>>>>> is probably an intractable problem. >>>>>>>>>>> >>>>>>>>>>> *Subject Principals* >>>>>>>>>>> While what is represented within a subject identifier may be >>>>>>>>>>> only an aspect of the management entity, the administrative gro= uping is >>>>>>>>>>> about the management entity itself. This could be the user, dev= ice or other >>>>>>>>>>> principal that the subject identifier represents. Therefore, an= abstract >>>>>>>>>>> notion of a Subject Principal is also required in order specify= what the >>>>>>>>>>> grouping within a SPAG is about. >>>>>>>>>>> >>>>>>>>>>> The above is captured in the "Subject Principal" and "SPAG" >>>>>>>>>>> sections within the proposed PR >>>>>>>>>>> . >>>>>>>>>>> >>>>>>>>>>> Thanks, >>>>>>>>>>> Atul >>>>>>>>>>> >>>>>>>>>>> _______________________________________________ >>>>>>>>>>> Id-event mailing list >>>>>>>>>>> Id-event@ietf.org >>>>>>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>>>>>> >>>>>>>>>> --00000000000000873205aa5bad91 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Would different URLs for= each relationship not solve your issue of maintaining secrets for each SPA= G? For example:




    Then the credential = is independent=C2=A0of the SPAG, but we are not injecting an identifier (sp= ag_id) that is only relevant=C2=A0to orgs that want to use the same credent= ials across SPAG relationships.



    On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    I am OK with= making the spag_id a required claim in every subject identifier. For singl= e tenanted transmitters, it would be a constant value for all events they g= enerate.

    On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    = So the receiver is using authentication sometimes to determine SPAG, and no= t at other times?

    I'm digging into this as I had alw= ays thought of the event being between two parties, where they are identifi= ed=C2=A0by the endpoint and/or the credentials.

    Ad= ding a relationship identifier seems to be solving the problem at the wrong= layer, unless it is in all events.


    On Mon, Jul 13, 202= 0 at 3:54 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    Sorry for the ter= se message.

    If a single tenant transmitter is trusted by= a multi-tenanted receiver for a specific tenant, then the SPAG-id need not= be included if the subject is unique at the tenant level, because the rece= iver will automatically identify SPAG that the subject belongs to on its en= d (based on the authentication).


    <= br>
    On Mon,= Jul 13, 2020 at 3:37 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    Which part is n= ot required?

    On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    Not required, since the claim is optional.

    On Mon, Jul 13, 20= 20 at 3:25 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    Would a transmitter that = is only in one SPAG (a single tenant system) have to include its SPAG id in= events sent to a receiver that accepts events from multiple SPAGs? But it = would not include it in sending events to other receivers=C2=A0that have se= parate credentials for each relationship?



    <= /div>
    =E1=90=A7

    On Mon, Jul 13, 2020 at 3:0= 5 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    That could be true but th= ere are a few ways in which it can be avoided:
    1. The peers levera= ge some higher-level trust to accept / decline events relating to lower lev= el SPAGs. For example, if trust is established at a tenant level, then an O= U level SPAG need not have its own authorization.
    2. The secret requir= ed for establishing the authorization of a SPAG may be temporary. For examp= le:
      1. An administrator signs in to their tenant in the transmitte= r's administrator console
      2. The admin obtains a temporary authori= zation (one-time code)
      3. The admin signs in to their tenant in the re= ceiver's administration console and pastes in the one-time code
        4. The receiver sends a request to enable the stream for the specified SPAG w= ith that one-time authorization.
    In the first case, ther= e are no additional secrets required. In the second case, the secret is tem= porary.



    On Mon, Jul 13, 2020 at 2:= 34 PM Dick Hardt <dick.hardt@gmail.com> wrote:
    I see the SPAG lets the transmitte= r and receiver provide context, as the subject identifier may be the same a= cross SPAGs.

    Now I'm trying to understand how the tr= ansmitter authenticates to the receiver if it does not have it's own se= cret (assuming that authentication model) -- IE, how does the receiver know= the transmitter is authorized=C2=A0for that SPAG?


    On M= on, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale <atultulshi@google.com> wrote:
    =
    Dick, your understanding is correct.

    To clarify the = proposal here, Here's the text I'm proposing to be added:

    <= font face=3D"monospace">3.=C2=A0 Subject Principals

    =C2=A0 =C2=A0Sub= ject Principals are the management entities associated with
    =C2=A0 =C2= =A0Subjects.=C2=A0 These may be human or robotic principals or devices or=C2=A0 =C2=A0other entities that are managed by transmitters and receiver= s.=C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Principal may be ref= erred to by an email
    =C2=A0 =C2=A0address or a phone number.=C2=A0 A tra= nsmitter or receiver will typically
    =C2=A0 =C2=A0manage subject principa= ls and organize them into sub-groupings such
    =C2=A0 =C2=A0as tenants, gr= oups, organizational units, etc.

    =C2=A0 =C2=A0Subjects are identifie= d by Subject Identifiers defined below.

    3.1.=C2=A0 SPAGs

    =C2= =A0 =C2=A0Subject Principals MAY be grouped for administrative purposes int= o
    =C2=A0 =C2=A0"Subject Principal Administrative Groupings" or= SPAGs.=C2=A0 For example,
    =C2=A0 =C2=A0all users belonging to one custo= mer of a "multi-tenanted" Transmitter
    =C2=A0 =C2=A0may be in o= ne SPAG.=C2=A0 Alternatively, an Organizational Unit or a group
    =C2=A0 = =C2=A0of Subjects within a customer of a Transmitter (whether multi-
    =C2= =A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs may have overlappin= g sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A SPAG MAY be the S= ubject of certain stream update events defined
    =C2=A0 =C2=A0later in thi= s spec, hence is defined as a Subject Type of its own
    =C2=A0 =C2=A0below= .=C2=A0 A SPAG identifier MAY be included in other subject types to
    =C2= =A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2=A0A SPAG subject iden= tifier is agreed to offline between a transmitter
    =C2=A0 =C2=A0and a rec= eiver.

    The benefits of doing this are:
    <= ol>
  • Multi-tenanted hosts do not need to maintain secrets per tenant and = per transmitter tenant if each tenant has to be an event transmitter and an= event receiver of its own.
  • An event stream may be established betw= een two multi-tenanted hosts, and so does not need to be managed at a per-t= enant level
  • The same subject or subject principal may be a part of = multiple SPAGs, and identifying the SPAG that an event relates to can be ac= hieved if the standard allows for the SPAGs to be identified.


    • On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt <dick.hardt@gmail.com>= ; wrote:
    To clarify, your proposal is driven by the implementation=C2=A0bu= rden of maintaining separate secrets / streams between a transmitter and re= ceiver?
    =E1=90=A7

    On Mon, Jul 13, 2020 at 9:01 AM= Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
    <= /div>
    Hi = all,=C2=A0
    Here's a quick background for the proposal for includ= ing Subject Principals and Subject Principal Administrative Groupings or SP= AGs in the Subject Identifiers spec.

    Use of Sub= ject Identifiers in Shared Signals and Events:
    The Shared Sig= nals and Events (SSE) profile of SETs specifies that transmitters and recei= vers send and receive SETs that contain Subject Identifiers. These subject = identifiers have the format that is now being discussed as a separate speci= fication here.

    Transmitters and Receivers i= n SSE
    The SSE profile defines transmitters and receivers as h= osts that manage streams between peers. The receiver authenticates to the t= ransmitter using OAuth, requiring the use of a secret per receiver. In a mu= lti-tenanted host that handles hundreds of thousands or millions of indepen= dent tenants, maintaining such a secret per instance of a receiver is cumbe= rsome. Furthermore, since a transmitter and a receiver has to maintain a st= ream per pair, creating such per-tenant streams can add significant impleme= ntation overhead.

    SPAGs
    Therefore= , we need a notion of a grouping of subjects within the same transmitter an= d receiver to distinguish between various administrative groupings that exi= st within a host. These groupings could include tenants, organizational uni= ts or user groups.. This grouping is captured in the notion of a SPAG. The = uniqueness of a user identifier (subject identifier) may also be limited to= a SPAG. For example, if a random unique ID represents a user, then that ID= may be unique within a SPAG and not universally across a transmitter or re= ceiver. This is because each transmitter and receiver may have multiple con= nections to other transmitters and receivers, and ensuring uniqueness acros= s all such peers is probably an intractable problem.

    Subject Principals
    While what is represented within a s= ubject identifier may be only an aspect of the management entity, the admin= istrative grouping is about the management entity itself. This could be the= user, device or other principal that the subject identifier represents. Th= erefore, an abstract notion of a Subject Principal is also required in orde= r specify what the grouping within a SPAG is about.

    The above is captured in the "Subject Principal" and "SPAG= " sections within the proposed PR.

    Thanks,=
    Atul

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --00000000000000873205aa5bad91-- From nobody Mon Jul 13 17:23:51 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 040803A0C2A for ; Mon, 13 Jul 2020 17:23:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v_Fy8BqBbJSK for ; Mon, 13 Jul 2020 17:23:47 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640095.outbound.protection.outlook.com [40.107.64.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B58C3A0C03 for ; Mon, 13 Jul 2020 17:23:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BgvnVxIRBSI1p73+eMRFPwTffoyOcEeJDgh5DsZduPNn27jjRm3GZqUaFpFiQGTHqwnchl3ljrIM6I4IAoDVLk+JOh85ZV8czzYEPAumTZJEiiZ7qJx1sbiNzs0sltudHEPg0odxiwup6qtuo/jszqat8yGg23nGHf/Bz5GDJy90U7uf5g3xIy0sw38JZBbE8cx56H4UYeoTvc92gNeKbimTI7CgAzpON6vNgpNqnpDSRRV/7CG+MdoyNDP00vUN6kJL5rNW0W0MC0G6o1zKdb/u6GJqtWtwNwWGU4T3LqQw0I/8apLLo3UkyexEwLxyS3GEUbJrk9OA7hWmYf1qpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4rwvtEIhp0WUx/L24JzyyBw2RlzUwQxk120Amtoyr6Q=; b=UzrHjB+ic7P5Apy8Hk/WarFTCA6gLwIpo9xuzOSnJlG5sL5cDRszlFGtvfWcy7o8Y9JB0sC7qeegLYwqDvE94LBnhvNGcGxgbUX7xHBwdRtXB7GU3Mf4JT+Phx4SEA2UyQuyBugFNhTroPnBbyq2pRI/4FG9NOf5tq+SZNvsVuLork5ViSHRv8xKl27MsPg42701HvaTaV3MHN6W1zbuwGCYk1U7ppVjTJ/bgT2DsRkjyIbB/pFRfMizTLXyxSJZ56Hty3nWFkzM20EMmGx9UAsQqKL5iR2jEOawpevkQkjl4RA3tZRY9JqX/GRrzGnzJkhCB/3olamS3kn97Yuolg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4rwvtEIhp0WUx/L24JzyyBw2RlzUwQxk120Amtoyr6Q=; b=jn+eCBdiYYo25s2/fVHRImPE87GYIs60+TBleyxUsq3j0WtkPBeJQtNJqpRWX8NoVK1uW/dRThaWn7YvtaENjzW1fOGJ0ZQh90kZdvdFMzFP/D2MPBeg0UNMFFsuJu/R0Bo0axxSuF1f1/cKmBW34u0WhqcUVYusmhd2XTKba3w= Received: from CH2PR00MB0678.namprd00.prod.outlook.com (2603:10b6:610:a9::23) by CH2PR00MB0662.namprd00.prod.outlook.com (2603:10b6:610:ab::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3230.0; Tue, 14 Jul 2020 00:23:43 +0000 Received: from CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::29f8:dc4a:8aac:e889]) by CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::29f8:dc4a:8aac:e889%8]) with mapi id 15.20.3231.000; Tue, 14 Jul 2020 00:23:43 +0000 From: Mike Jones To: Dick Hardt , Atul Tulshibagwale CC: SecEvent Thread-Topic: [Id-event] Subject Principals and Subject Principal Administrative Groupings Thread-Index: AdZZdQCtdiOOYOmMSIKP7V+31IqM3A== Date: Tue, 14 Jul 2020 00:23:43 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-14T00:22:11Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=ce7456bd-a3c2-4e97-a02c-e01d50c62caa; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 5352ce7c-e0b4-412e-d124-08d8278c2ab8 x-ms-traffictypediagnostic: CH2PR00MB0662: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 4zDPSRXeQKa9wJ1GwIzWTZXpSW1XXunQaWKlt3H5czT/bdsiyjEEM3qJj/n5kKlW534oVd7IsNLmqOK8VjylDgYbIRZw6P3kuSuxfuYLiZh2gNHMzdcom9kEq53YdF7pEBtZX8j2POGPH3MlYLd8HttFeXHrMlB20vhZRutGKEbGBq0UNWEEuhr5V2suNz1sPXrNjET9RR18/Dn+qnXafbH1n8hvQ30rPuR6GfRYT5hk/Jathqby2ll1am9R2S+OwPTgVV1FBPWUGLoFtby8KwTuJbBoia6rlqneRI5Ua+A7oCRPo5TkPppOgp844XknJvCHISGR3Rr6PbzaGvc/uY+lSGYRvTh9OWFstl4ZI0Q5LgZwRLdBuXW1+fUxYWn1CvoCU127OX2yjdVQeb9BKd7vZ0zx6k85WJ0MQT/BaeGBastf+zDPqgPTMmIZQGrj5TsJxPYz59QtCdZqjw7dYA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR00MB0678.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(39860400002)(136003)(396003)(376002)(366004)(53546011)(6506007)(86362001)(8676002)(83380400001)(9686003)(8990500004)(7696005)(5660300002)(8936002)(2906002)(55016002)(82950400001)(82960400001)(52536014)(66476007)(66556008)(76236003)(66446008)(64756008)(316002)(4326008)(966005)(478600001)(66946007)(26005)(33656002)(110136005)(76116006)(186003)(166002)(71200400001)(10290500003)(99710200001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: nQ38tToIjJ4LF6eOXVD8oKK+Nxzy77tQ14rrPu4VlCbXzesi3vJeuJO3kn6puMmYQoYlCg6YIPiNMi6JdAyK9cdVDqIRecCB5StM8F0ED1RMfx/GXkifNwGyXdLh/4pcrAZ8H5P27hkGKXS70xjy75ZjwbG69ruvHNMdpwIMzSF6i4z06fNzK97p5ptPrDtXIQ9hQoc3xlm2tMiEop13h/62Z8gqIOcKD9cPDdls3cyfYdJxo/j1LGBnmOmo0lP4fM6Cl1vsrj4d/3i6gp0refQ1aUE55FVAUEbqno1OcVqkxd6FxR5RBJoVZp93SBEhF6lyAnaalVaDsUpI3Djfa0NqnwBTN20qVw1ZGlNWhW3zdfRFd/oxpm/iEv793x0snyyj9/gwo1LeSi9Aobfe/gIly8IlBup2hIHsRo5t5xe2LnM+pZ9Dp2y2JqVvxhjFd05Ojsv17eA7Awrx+e9b6I2erXf9SfmbntAA4elQEOU= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR00MB06786BC0E20E4CF98170AA54F5610CH2PR00MB0678namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CH2PR00MB0678.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5352ce7c-e0b4-412e-d124-08d8278c2ab8 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2020 00:23:43.7300 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: uDDCefDkjc02nvK50e/6GGml5N78q25/5Z40x8yFzl1pS9Lwt5WQxfwh9GqEODRlwS2GQy5pTAka/qeOggKmog== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0662 Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 00:23:50 -0000 --_000_CH2PR00MB06786BC0E20E4CF98170AA54F5610CH2PR00MB0678namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QXMgSSBzZWUgaXQsIHRoZSB1c2UgY2FzZXMgdGhhdCByZXF1aXJlIGEgc3BhZ19pZCBjYW4gdXNl IHRoZW0gd2hlbiBuZWNlc3NhcnkgKHVubGVzcyB0aGUgd29ya2luZyBncm91cCBkZWNpZGVzIG9u IGFub3RoZXIgd2F5IHRvIGRvIHRoaXMpIGJ1dCBJIGNlcnRhaW5seSB3b3VsZCBvcHBvc2UgcmVx dWlyaW5nIGl0IHdoZW4gaXTigJlzIHVubmVjZXNzYXJ5Lg0KDQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBJZC1l dmVudCA8aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIERpY2sgSGFyZHQN ClNlbnQ6IE1vbmRheSwgSnVseSAxMywgMjAyMCA1OjEzIFBNDQpUbzogQXR1bCBUdWxzaGliYWd3 YWxlIDxhdHVsdHVsc2hpQGdvb2dsZS5jb20+DQpDYzogU2VjRXZlbnQgPGlkLWV2ZW50QGlldGYu b3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gU3ViamVjdCBQcmluY2lwYWxzIGFuZCBTdWJq ZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJhdGl2ZSBHcm91cGluZ3MNCg0KV291bGQgZGlmZmVyZW50 IFVSTHMgZm9yIGVhY2ggcmVsYXRpb25zaGlwIG5vdCBzb2x2ZSB5b3VyIGlzc3VlIG9mIG1haW50 YWluaW5nIHNlY3JldHMgZm9yIGVhY2ggU1BBRz8gRm9yIGV4YW1wbGU6DQoNCmh0dHBzOi9leGFt cGxlLmNvbS9zZWNldmVudC9TUEFHX0lEXzE8aHR0cDovL2V4YW1wbGUuY29tL3NlY2V2ZW50L1NQ QUdfSURfMT4NCg0KaHR0cHM6L2V4YW1wbGUuY29tL3NlY2V2ZW50L1NQQUdfSURfMjxodHRwOi8v ZXhhbXBsZS5jb20vc2VjZXZlbnQvU1BBR19JRF8yPg0KDQpodHRwczovZXhhbXBsZS5jb20vc2Vj ZXZlbnQvU1BBR19JRF8zPGh0dHA6Ly9leGFtcGxlLmNvbS9zZWNldmVudC9TUEFHX0lEXzM+DQoN ClRoZW4gdGhlIGNyZWRlbnRpYWwgaXMgaW5kZXBlbmRlbnQgb2YgdGhlIFNQQUcsIGJ1dCB3ZSBh cmUgbm90IGluamVjdGluZyBhbiBpZGVudGlmaWVyIChzcGFnX2lkKSB0aGF0IGlzIG9ubHkgcmVs ZXZhbnQgdG8gb3JncyB0aGF0IHdhbnQgdG8gdXNlIHRoZSBzYW1lIGNyZWRlbnRpYWxzIGFjcm9z cyBTUEFHIHJlbGF0aW9uc2hpcHMuDQoNCg0KDQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCA1OjA4 IFBNIEF0dWwgVHVsc2hpYmFnd2FsZSA8YXR1bHR1bHNoaUBnb29nbGUuY29tPG1haWx0bzphdHVs dHVsc2hpQGdvb2dsZS5jb20+PiB3cm90ZToNCkkgYW0gT0sgd2l0aCBtYWtpbmcgdGhlIHNwYWdf aWQgYSByZXF1aXJlZCBjbGFpbSBpbiBldmVyeSBzdWJqZWN0IGlkZW50aWZpZXIuIEZvciBzaW5n bGUgdGVuYW50ZWQgdHJhbnNtaXR0ZXJzLCBpdCB3b3VsZCBiZSBhIGNvbnN0YW50IHZhbHVlIGZv ciBhbGwgZXZlbnRzIHRoZXkgZ2VuZXJhdGUuDQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDQ6 MDEgUE0gRGljayBIYXJkdCA8ZGljay5oYXJkdEBnbWFpbC5jb208bWFpbHRvOmRpY2suaGFyZHRA Z21haWwuY29tPj4gd3JvdGU6DQpTbyB0aGUgcmVjZWl2ZXIgaXMgdXNpbmcgYXV0aGVudGljYXRp b24gc29tZXRpbWVzIHRvIGRldGVybWluZSBTUEFHLCBhbmQgbm90IGF0IG90aGVyIHRpbWVzPw0K DQpJJ20gZGlnZ2luZyBpbnRvIHRoaXMgYXMgSSBoYWQgYWx3YXlzIHRob3VnaHQgb2YgdGhlIGV2 ZW50IGJlaW5nIGJldHdlZW4gdHdvIHBhcnRpZXMsIHdoZXJlIHRoZXkgYXJlIGlkZW50aWZpZWQg YnkgdGhlIGVuZHBvaW50IGFuZC9vciB0aGUgY3JlZGVudGlhbHMuDQoNCkFkZGluZyBhIHJlbGF0 aW9uc2hpcCBpZGVudGlmaWVyIHNlZW1zIHRvIGJlIHNvbHZpbmcgdGhlIHByb2JsZW0gYXQgdGhl IHdyb25nIGxheWVyLCB1bmxlc3MgaXQgaXMgaW4gYWxsIGV2ZW50cy4NCg0KDQpPbiBNb24sIEp1 bCAxMywgMjAyMCBhdCAzOjU0IFBNIEF0dWwgVHVsc2hpYmFnd2FsZSA8YXR1bHR1bHNoaUBnb29n bGUuY29tPG1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5jb20+PiB3cm90ZToNClNvcnJ5IGZvciB0 aGUgdGVyc2UgbWVzc2FnZS4NCg0KSWYgYSBzaW5nbGUgdGVuYW50IHRyYW5zbWl0dGVyIGlzIHRy dXN0ZWQgYnkgYSBtdWx0aS10ZW5hbnRlZCByZWNlaXZlciBmb3IgYSBzcGVjaWZpYyB0ZW5hbnQs IHRoZW4gdGhlIFNQQUctaWQgbmVlZCBub3QgYmUgaW5jbHVkZWQgaWYgdGhlIHN1YmplY3QgaXMg dW5pcXVlIGF0IHRoZSB0ZW5hbnQgbGV2ZWwsIGJlY2F1c2UgdGhlIHJlY2VpdmVyIHdpbGwgYXV0 b21hdGljYWxseSBpZGVudGlmeSBTUEFHIHRoYXQgdGhlIHN1YmplY3QgYmVsb25ncyB0byBvbiBp dHMgZW5kIChiYXNlZCBvbiB0aGUgYXV0aGVudGljYXRpb24pLg0KDQoNCg0KT24gTW9uLCBKdWwg MTMsIDIwMjAgYXQgMzozNyBQTSBEaWNrIEhhcmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNvbTxtYWls dG86ZGljay5oYXJkdEBnbWFpbC5jb20+PiB3cm90ZToNCldoaWNoIHBhcnQgaXMgbm90IHJlcXVp cmVkPw0KDQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCAzOjMzIFBNIEF0dWwgVHVsc2hpYmFnd2Fs ZSA8YXR1bHR1bHNoaUBnb29nbGUuY29tPG1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5jb20+PiB3 cm90ZToNCk5vdCByZXF1aXJlZCwgc2luY2UgdGhlIGNsYWltIGlzIG9wdGlvbmFsLg0KDQpPbiBN b24sIEp1bCAxMywgMjAyMCBhdCAzOjI1IFBNIERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21haWwu Y29tPG1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+IHdyb3RlOg0KV291bGQgYSB0cmFuc21p dHRlciB0aGF0IGlzIG9ubHkgaW4gb25lIFNQQUcgKGEgc2luZ2xlIHRlbmFudCBzeXN0ZW0pIGhh dmUgdG8gaW5jbHVkZSBpdHMgU1BBRyBpZCBpbiBldmVudHMgc2VudCB0byBhIHJlY2VpdmVyIHRo YXQgYWNjZXB0cyBldmVudHMgZnJvbSBtdWx0aXBsZSBTUEFHcz8gQnV0IGl0IHdvdWxkIG5vdCBp bmNsdWRlIGl0IGluIHNlbmRpbmcgZXZlbnRzIHRvIG90aGVyIHJlY2VpdmVycyB0aGF0IGhhdmUg c2VwYXJhdGUgY3JlZGVudGlhbHMgZm9yIGVhY2ggcmVsYXRpb25zaGlwPw0KDQoNCg0K4ZCnDQoN Ck9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDM6MDUgUE0gQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVs dHVsc2hpQGdvb2dsZS5jb208bWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbT4+IHdyb3RlOg0K VGhhdCBjb3VsZCBiZSB0cnVlIGJ1dCB0aGVyZSBhcmUgYSBmZXcgd2F5cyBpbiB3aGljaCBpdCBj YW4gYmUgYXZvaWRlZDoNCg0KICAxLiAgVGhlIHBlZXJzIGxldmVyYWdlIHNvbWUgaGlnaGVyLWxl dmVsIHRydXN0IHRvIGFjY2VwdCAvIGRlY2xpbmUgZXZlbnRzIHJlbGF0aW5nIHRvIGxvd2VyIGxl dmVsIFNQQUdzLiBGb3IgZXhhbXBsZSwgaWYgdHJ1c3QgaXMgZXN0YWJsaXNoZWQgYXQgYSB0ZW5h bnQgbGV2ZWwsIHRoZW4gYW4gT1UgbGV2ZWwgU1BBRyBuZWVkIG5vdCBoYXZlIGl0cyBvd24gYXV0 aG9yaXphdGlvbi4NCiAgMi4gIFRoZSBzZWNyZXQgcmVxdWlyZWQgZm9yIGVzdGFibGlzaGluZyB0 aGUgYXV0aG9yaXphdGlvbiBvZiBhIFNQQUcgbWF5IGJlIHRlbXBvcmFyeS4gRm9yIGV4YW1wbGU6 DQoNCiAgICAgKiAgIEFuIGFkbWluaXN0cmF0b3Igc2lnbnMgaW4gdG8gdGhlaXIgdGVuYW50IGlu IHRoZSB0cmFuc21pdHRlcidzIGFkbWluaXN0cmF0b3IgY29uc29sZQ0KICAgICAqICAgVGhlIGFk bWluIG9idGFpbnMgYSB0ZW1wb3JhcnkgYXV0aG9yaXphdGlvbiAob25lLXRpbWUgY29kZSkNCiAg ICAgKiAgIFRoZSBhZG1pbiBzaWducyBpbiB0byB0aGVpciB0ZW5hbnQgaW4gdGhlIHJlY2VpdmVy J3MgYWRtaW5pc3RyYXRpb24gY29uc29sZSBhbmQgcGFzdGVzIGluIHRoZSBvbmUtdGltZSBjb2Rl DQogICAgICogICBUaGUgcmVjZWl2ZXIgc2VuZHMgYSByZXF1ZXN0IHRvIGVuYWJsZSB0aGUgc3Ry ZWFtIGZvciB0aGUgc3BlY2lmaWVkIFNQQUcgd2l0aCB0aGF0IG9uZS10aW1lIGF1dGhvcml6YXRp b24uDQpJbiB0aGUgZmlyc3QgY2FzZSwgdGhlcmUgYXJlIG5vIGFkZGl0aW9uYWwgc2VjcmV0cyBy ZXF1aXJlZC4gSW4gdGhlIHNlY29uZCBjYXNlLCB0aGUgc2VjcmV0IGlzIHRlbXBvcmFyeS4NCg0K DQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDI6MzQgUE0gRGljayBIYXJkdCA8ZGljay5oYXJk dEBnbWFpbC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tPj4gd3JvdGU6DQpJIHNlZSB0 aGUgU1BBRyBsZXRzIHRoZSB0cmFuc21pdHRlciBhbmQgcmVjZWl2ZXIgcHJvdmlkZSBjb250ZXh0 LCBhcyB0aGUgc3ViamVjdCBpZGVudGlmaWVyIG1heSBiZSB0aGUgc2FtZSBhY3Jvc3MgU1BBR3Mu DQoNCk5vdyBJJ20gdHJ5aW5nIHRvIHVuZGVyc3RhbmQgaG93IHRoZSB0cmFuc21pdHRlciBhdXRo ZW50aWNhdGVzIHRvIHRoZSByZWNlaXZlciBpZiBpdCBkb2VzIG5vdCBoYXZlIGl0J3Mgb3duIHNl Y3JldCAoYXNzdW1pbmcgdGhhdCBhdXRoZW50aWNhdGlvbiBtb2RlbCkgLS0gSUUsIGhvdyBkb2Vz IHRoZSByZWNlaXZlciBrbm93IHRoZSB0cmFuc21pdHRlciBpcyBhdXRob3JpemVkIGZvciB0aGF0 IFNQQUc/DQoNCg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMjowOCBQTSBBdHVsIFR1bHNoaWJh Z3dhbGUgPGF0dWx0dWxzaGlAZ29vZ2xlLmNvbTxtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29t Pj4gd3JvdGU6DQpEaWNrLCB5b3VyIHVuZGVyc3RhbmRpbmcgaXMgY29ycmVjdC4NCg0KVG8gY2xh cmlmeSB0aGUgcHJvcG9zYWwgaGVyZSwgSGVyZSdzIHRoZSB0ZXh0IEknbSBwcm9wb3NpbmcgdG8g YmUgYWRkZWQ6DQoNCjMuICBTdWJqZWN0IFByaW5jaXBhbHMNCg0KICAgU3ViamVjdCBQcmluY2lw YWxzIGFyZSB0aGUgbWFuYWdlbWVudCBlbnRpdGllcyBhc3NvY2lhdGVkIHdpdGgNCiAgIFN1Ympl Y3RzLiAgVGhlc2UgbWF5IGJlIGh1bWFuIG9yIHJvYm90aWMgcHJpbmNpcGFscyBvciBkZXZpY2Vz IG9yDQogICBvdGhlciBlbnRpdGllcyB0aGF0IGFyZSBtYW5hZ2VkIGJ5IHRyYW5zbWl0dGVycyBh bmQgcmVjZWl2ZXJzLiAgRm9yDQogICBleGFtcGxlLCB0aGUgc2FtZSBTdWJqZWN0IFByaW5jaXBh bCBtYXkgYmUgcmVmZXJyZWQgdG8gYnkgYW4gZW1haWwNCiAgIGFkZHJlc3Mgb3IgYSBwaG9uZSBu dW1iZXIuICBBIHRyYW5zbWl0dGVyIG9yIHJlY2VpdmVyIHdpbGwgdHlwaWNhbGx5DQogICBtYW5h Z2Ugc3ViamVjdCBwcmluY2lwYWxzIGFuZCBvcmdhbml6ZSB0aGVtIGludG8gc3ViLWdyb3VwaW5n cyBzdWNoDQogICBhcyB0ZW5hbnRzLCBncm91cHMsIG9yZ2FuaXphdGlvbmFsIHVuaXRzLCBldGMu DQoNCiAgIFN1YmplY3RzIGFyZSBpZGVudGlmaWVkIGJ5IFN1YmplY3QgSWRlbnRpZmllcnMgZGVm aW5lZCBiZWxvdy4NCg0KMy4xLiAgU1BBR3MNCg0KICAgU3ViamVjdCBQcmluY2lwYWxzIE1BWSBi ZSBncm91cGVkIGZvciBhZG1pbmlzdHJhdGl2ZSBwdXJwb3NlcyBpbnRvDQogICAiU3ViamVjdCBQ cmluY2lwYWwgQWRtaW5pc3RyYXRpdmUgR3JvdXBpbmdzIiBvciBTUEFHcy4gIEZvciBleGFtcGxl LA0KICAgYWxsIHVzZXJzIGJlbG9uZ2luZyB0byBvbmUgY3VzdG9tZXIgb2YgYSAibXVsdGktdGVu YW50ZWQiIFRyYW5zbWl0dGVyDQogICBtYXkgYmUgaW4gb25lIFNQQUcuICBBbHRlcm5hdGl2ZWx5 LCBhbiBPcmdhbml6YXRpb25hbCBVbml0IG9yIGEgZ3JvdXANCiAgIG9mIFN1YmplY3RzIHdpdGhp biBhIGN1c3RvbWVyIG9mIGEgVHJhbnNtaXR0ZXIgKHdoZXRoZXIgbXVsdGktDQogICB0ZW5hbnRl ZCBvciBub3QpIG1heSBiZSBvbmUgU1BBRy4gIFNQQUdzIG1heSBoYXZlIG92ZXJsYXBwaW5nIHNl dHMgb2YNCiAgIFN1YmplY3RzLg0KDQogICBBIFNQQUcgTUFZIGJlIHRoZSBTdWJqZWN0IG9mIGNl cnRhaW4gc3RyZWFtIHVwZGF0ZSBldmVudHMgZGVmaW5lZA0KICAgbGF0ZXIgaW4gdGhpcyBzcGVj LCBoZW5jZSBpcyBkZWZpbmVkIGFzIGEgU3ViamVjdCBUeXBlIG9mIGl0cyBvd24NCiAgIGJlbG93 Li4gIEEgU1BBRyBpZGVudGlmaWVyIE1BWSBiZSBpbmNsdWRlZCBpbiBvdGhlciBzdWJqZWN0IHR5 cGVzIHRvDQogICBkaXNhbWJpZ3VhdGUgdGhlIHN1YmplY3QuDQoNCiAgIEEgU1BBRyBzdWJqZWN0 IGlkZW50aWZpZXIgaXMgYWdyZWVkIHRvIG9mZmxpbmUgYmV0d2VlbiBhIHRyYW5zbWl0dGVyDQog ICBhbmQgYSByZWNlaXZlci4NClRoZSBiZW5lZml0cyBvZiBkb2luZyB0aGlzIGFyZToNCg0KICAx LiAgTXVsdGktdGVuYW50ZWQgaG9zdHMgZG8gbm90IG5lZWQgdG8gbWFpbnRhaW4gc2VjcmV0cyBw ZXIgdGVuYW50IGFuZCBwZXIgdHJhbnNtaXR0ZXIgdGVuYW50IGlmIGVhY2ggdGVuYW50IGhhcyB0 byBiZSBhbiBldmVudCB0cmFuc21pdHRlciBhbmQgYW4gZXZlbnQgcmVjZWl2ZXIgb2YgaXRzIG93 bi4NCiAgMi4gIEFuIGV2ZW50IHN0cmVhbSBtYXkgYmUgZXN0YWJsaXNoZWQgYmV0d2VlbiB0d28g bXVsdGktdGVuYW50ZWQgaG9zdHMsIGFuZCBzbyBkb2VzIG5vdCBuZWVkIHRvIGJlIG1hbmFnZWQg YXQgYSBwZXItdGVuYW50IGxldmVsDQogIDMuICBUaGUgc2FtZSBzdWJqZWN0IG9yIHN1YmplY3Qg cHJpbmNpcGFsIG1heSBiZSBhIHBhcnQgb2YgbXVsdGlwbGUgU1BBR3MsIGFuZCBpZGVudGlmeWlu ZyB0aGUgU1BBRyB0aGF0IGFuIGV2ZW50IHJlbGF0ZXMgdG8gY2FuIGJlIGFjaGlldmVkIGlmIHRo ZSBzdGFuZGFyZCBhbGxvd3MgZm9yIHRoZSBTUEFHcyB0byBiZSBpZGVudGlmaWVkLg0KDQoNCk9u IE1vbiwgSnVsIDEzLCAyMDIwIGF0IDExOjMyIEFNIERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21h aWwuY29tPG1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+IHdyb3RlOg0KVG8gY2xhcmlmeSwg eW91ciBwcm9wb3NhbCBpcyBkcml2ZW4gYnkgdGhlIGltcGxlbWVudGF0aW9uIGJ1cmRlbiBvZiBt YWludGFpbmluZyBzZXBhcmF0ZSBzZWNyZXRzIC8gc3RyZWFtcyBiZXR3ZWVuIGEgdHJhbnNtaXR0 ZXIgYW5kIHJlY2VpdmVyPw0K4ZCnDQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDk6MDEgQU0g QXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpPTQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9y ZzxtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLi5pZXRmLm9yZz4+IHdyb3RlOg0KSGkgYWxsLA0K SGVyZSdzIGEgcXVpY2sgYmFja2dyb3VuZCBmb3IgdGhlIHByb3Bvc2FsPGh0dHBzOi8vZ2l0aHVi LmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzE+IGZvciBpbmNsdWRpbmcgU3ViamVjdCBQcmlu Y2lwYWxzIGFuZCBTdWJqZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJhdGl2ZSBHcm91cGluZ3Mgb3Ig U1BBR3MgaW4gdGhlIFN1YmplY3QgSWRlbnRpZmllcnMgc3BlYy4NCg0KVXNlIG9mIFN1YmplY3Qg SWRlbnRpZmllcnMgaW4gU2hhcmVkIFNpZ25hbHMgYW5kIEV2ZW50czoNClRoZSBTaGFyZWQgU2ln bmFscyBhbmQgRXZlbnRzIChTU0UpIHByb2ZpbGUgb2YgU0VUcyBzcGVjaWZpZXMgdGhhdCB0cmFu c21pdHRlcnMgYW5kIHJlY2VpdmVycyBzZW5kIGFuZCByZWNlaXZlIFNFVHMgdGhhdCBjb250YWlu IFN1YmplY3QgSWRlbnRpZmllcnMuIFRoZXNlIHN1YmplY3QgaWRlbnRpZmllcnMgaGF2ZSB0aGUg Zm9ybWF0IHRoYXQgaXMgbm93IGJlaW5nIGRpc2N1c3NlZCBhcyBhIHNlcGFyYXRlIHNwZWNpZmlj YXRpb24gaGVyZS4NCg0KVHJhbnNtaXR0ZXJzIGFuZCBSZWNlaXZlcnMgaW4gU1NFDQpUaGUgU1NF IHByb2ZpbGUgZGVmaW5lcyB0cmFuc21pdHRlcnMgYW5kIHJlY2VpdmVycyBhcyBob3N0cyB0aGF0 IG1hbmFnZSBzdHJlYW1zIGJldHdlZW4gcGVlcnMuIFRoZSByZWNlaXZlciBhdXRoZW50aWNhdGVz IHRvIHRoZSB0cmFuc21pdHRlciB1c2luZyBPQXV0aCwgcmVxdWlyaW5nIHRoZSB1c2Ugb2YgYSBz ZWNyZXQgcGVyIHJlY2VpdmVyLiBJbiBhIG11bHRpLXRlbmFudGVkIGhvc3QgdGhhdCBoYW5kbGVz IGh1bmRyZWRzIG9mIHRob3VzYW5kcyBvciBtaWxsaW9ucyBvZiBpbmRlcGVuZGVudCB0ZW5hbnRz LCBtYWludGFpbmluZyBzdWNoIGEgc2VjcmV0IHBlciBpbnN0YW5jZSBvZiBhIHJlY2VpdmVyIGlz IGN1bWJlcnNvbWUuIEZ1cnRoZXJtb3JlLCBzaW5jZSBhIHRyYW5zbWl0dGVyIGFuZCBhIHJlY2Vp dmVyIGhhcyB0byBtYWludGFpbiBhIHN0cmVhbSBwZXIgcGFpciwgY3JlYXRpbmcgc3VjaCBwZXIt dGVuYW50IHN0cmVhbXMgY2FuIGFkZCBzaWduaWZpY2FudCBpbXBsZW1lbnRhdGlvbiBvdmVyaGVh ZC4NCg0KU1BBR3MNClRoZXJlZm9yZSwgd2UgbmVlZCBhIG5vdGlvbiBvZiBhIGdyb3VwaW5nIG9m IHN1YmplY3RzIHdpdGhpbiB0aGUgc2FtZSB0cmFuc21pdHRlciBhbmQgcmVjZWl2ZXIgdG8gZGlz dGluZ3Vpc2ggYmV0d2VlbiB2YXJpb3VzIGFkbWluaXN0cmF0aXZlIGdyb3VwaW5ncyB0aGF0IGV4 aXN0IHdpdGhpbiBhIGhvc3QuIFRoZXNlIGdyb3VwaW5ncyBjb3VsZCBpbmNsdWRlIHRlbmFudHMs IG9yZ2FuaXphdGlvbmFsIHVuaXRzIG9yIHVzZXIgZ3JvdXBzLi4gVGhpcyBncm91cGluZyBpcyBj YXB0dXJlZCBpbiB0aGUgbm90aW9uIG9mIGEgU1BBRy4gVGhlIHVuaXF1ZW5lc3Mgb2YgYSB1c2Vy IGlkZW50aWZpZXIgKHN1YmplY3QgaWRlbnRpZmllcikgbWF5IGFsc28gYmUgbGltaXRlZCB0byBh IFNQQUcuIEZvciBleGFtcGxlLCBpZiBhIHJhbmRvbSB1bmlxdWUgSUQgcmVwcmVzZW50cyBhIHVz ZXIsIHRoZW4gdGhhdCBJRCBtYXkgYmUgdW5pcXVlIHdpdGhpbiBhIFNQQUcgYW5kIG5vdCB1bml2 ZXJzYWxseSBhY3Jvc3MgYSB0cmFuc21pdHRlciBvciByZWNlaXZlci4gVGhpcyBpcyBiZWNhdXNl IGVhY2ggdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyIG1heSBoYXZlIG11bHRpcGxlIGNvbm5lY3Rp b25zIHRvIG90aGVyIHRyYW5zbWl0dGVycyBhbmQgcmVjZWl2ZXJzLCBhbmQgZW5zdXJpbmcgdW5p cXVlbmVzcyBhY3Jvc3MgYWxsIHN1Y2ggcGVlcnMgaXMgcHJvYmFibHkgYW4gaW50cmFjdGFibGUg cHJvYmxlbS4NCg0KU3ViamVjdCBQcmluY2lwYWxzDQpXaGlsZSB3aGF0IGlzIHJlcHJlc2VudGVk IHdpdGhpbiBhIHN1YmplY3QgaWRlbnRpZmllciBtYXkgYmUgb25seSBhbiBhc3BlY3Qgb2YgdGhl IG1hbmFnZW1lbnQgZW50aXR5LCB0aGUgYWRtaW5pc3RyYXRpdmUgZ3JvdXBpbmcgaXMgYWJvdXQg dGhlIG1hbmFnZW1lbnQgZW50aXR5IGl0c2VsZi4gVGhpcyBjb3VsZCBiZSB0aGUgdXNlciwgZGV2 aWNlIG9yIG90aGVyIHByaW5jaXBhbCB0aGF0IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgcmVwcmVz ZW50cy4gVGhlcmVmb3JlLCBhbiBhYnN0cmFjdCBub3Rpb24gb2YgYSBTdWJqZWN0IFByaW5jaXBh bCBpcyBhbHNvIHJlcXVpcmVkIGluIG9yZGVyIHNwZWNpZnkgd2hhdCB0aGUgZ3JvdXBpbmcgd2l0 aGluIGEgU1BBRyBpcyBhYm91dC4NCg0KVGhlIGFib3ZlIGlzIGNhcHR1cmVkIGluIHRoZSAiU3Vi amVjdCBQcmluY2lwYWwiIGFuZCAiU1BBRyIgc2VjdGlvbnMgd2l0aGluIHRoZSBwcm9wb3NlZCBQ UjxodHRwczovL2dpdGh1Yi5jb20vcmljaGFubmEvc2VjZXZlbnQvcHVsbC8xPi4NCg0KVGhhbmtz LA0KQXR1bA0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZl bnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2 ZW50DQo= --_000_CH2PR00MB06786BC0E20E4CF98170AA54F5610CH2PR00MB0678namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIg MTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6R2FkdWdpOw0K CXBhbm9zZS0xOjIgMTEgNSAyIDQgMiA0IDIgMiAzO30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEu MGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2Vj dGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6 NjU5MDQwMDE4Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczozODA3NzEyNTI7fQ0KQGxpc3QgbDEN Cgl7bXNvLWxpc3QtaWQ6OTE5NDA3MTM3Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxODUyOTk1 Mzg2O30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGlu O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+QXMgSSBzZWUgaXQsIHRoZSB1c2UgY2FzZXMgdGhh dCByZXF1aXJlIGEgc3BhZ19pZCBjYW4gdXNlIHRoZW0gd2hlbiBuZWNlc3NhcnkgKHVubGVzcyB0 aGUgd29ya2luZyBncm91cCBkZWNpZGVzIG9uIGFub3RoZXIgd2F5IHRvIGRvIHRoaXMpIGJ1dCBJ IGNlcnRhaW5seSB3b3VsZCBvcHBvc2UgcmVxdWlyaW5nIGl0IHdoZW4gaXTigJlzIHVubmVjZXNz YXJ5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpz b2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IElkLWV2ZW50ICZsdDtpZC1ldmVudC1ib3VuY2VzQGll dGYub3JnJmd0OyA8Yj5PbiBCZWhhbGYgT2YNCjwvYj5EaWNrIEhhcmR0PGJyPg0KPGI+U2VudDo8 L2I+IE1vbmRheSwgSnVseSAxMywgMjAyMCA1OjEzIFBNPGJyPg0KPGI+VG86PC9iPiBBdHVsIFR1 bHNoaWJhZ3dhbGUgJmx0O2F0dWx0dWxzaGlAZ29vZ2xlLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+ IFNlY0V2ZW50ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4g UmU6IFtJZC1ldmVudF0gU3ViamVjdCBQcmluY2lwYWxzIGFuZCBTdWJqZWN0IFByaW5jaXBhbCBB ZG1pbmlzdHJhdGl2ZSBHcm91cGluZ3M8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5Xb3VsZCBkaWZmZXJlbnQgVVJMcyBmb3IgZWFjaCByZWxhdGlv bnNoaXAgbm90IHNvbHZlIHlvdXIgaXNzdWUgb2YgbWFpbnRhaW5pbmcgc2VjcmV0cyBmb3IgZWFj aCBTUEFHPyBGb3IgZXhhbXBsZTo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPmh0dHBzOi88YSBocmVmPSJodHRwOi8vZXhhbXBsZS5jb20vc2VjZXZlbnQvU1BB R19JRF8xIj5leGFtcGxlLmNvbS9zZWNldmVudC9TUEFHX0lEXzE8L2E+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5odHRwczovPGEg aHJlZj0iaHR0cDovL2V4YW1wbGUuY29tL3NlY2V2ZW50L1NQQUdfSURfMiI+ZXhhbXBsZS5jb20v c2VjZXZlbnQvU1BBR19JRF8yPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+aHR0cHM6LzxhIGhyZWY9Imh0dHA6Ly9leGFtcGxl LmNvbS9zZWNldmVudC9TUEFHX0lEXzMiPmV4YW1wbGUuY29tL3NlY2V2ZW50L1NQQUdfSURfMzwv YT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlRoZW4gdGhlIGNyZWRlbnRpYWwgaXMgaW5kZXBlbmRlbnQmbmJzcDtv ZiB0aGUgU1BBRywgYnV0IHdlIGFyZSBub3QgaW5qZWN0aW5nIGFuIGlkZW50aWZpZXIgKHNwYWdf aWQpIHRoYXQgaXMgb25seSByZWxldmFudCZuYnNwO3RvIG9yZ3MgdGhhdCB3YW50IHRvIHVzZSB0 aGUgc2FtZSBjcmVkZW50aWFscyBhY3Jvc3MgU1BBRyByZWxhdGlvbnNoaXBzLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDU6MDggUE0gQXR1bCBUdWxzaGliYWd3YWxl ICZsdDs8YSBocmVmPSJtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tIj5hdHVsdHVsc2hpQGdv b2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGlu Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFtIE9LIHdpdGggbWFraW5nIHRoZSBz cGFnX2lkIGEgcmVxdWlyZWQgY2xhaW0gaW4gZXZlcnkgc3ViamVjdCBpZGVudGlmaWVyLiBGb3Ig c2luZ2xlIHRlbmFudGVkIHRyYW5zbWl0dGVycywgaXQgd291bGQgYmUgYSBjb25zdGFudCB2YWx1 ZSBmb3IgYWxsIGV2ZW50cyB0aGV5IGdlbmVyYXRlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgNDowMSBQTSBEaWNr IEhhcmR0ICZsdDs8YSBocmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iIHRhcmdldD0i X2JsYW5rIj5kaWNrLmhhcmR0QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQu OHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNvIHRo ZSByZWNlaXZlciBpcyB1c2luZyBhdXRoZW50aWNhdGlvbiBzb21ldGltZXMgdG8gZGV0ZXJtaW5l IFNQQUcsIGFuZCBub3QgYXQgb3RoZXIgdGltZXM/PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5JJ20gZGlnZ2luZyBpbnRvIHRoaXMgYXMgSSBoYWQgYWx3YXlz IHRob3VnaHQgb2YgdGhlIGV2ZW50IGJlaW5nIGJldHdlZW4gdHdvIHBhcnRpZXMsIHdoZXJlIHRo ZXkgYXJlIGlkZW50aWZpZWQmbmJzcDtieSB0aGUgZW5kcG9pbnQgYW5kL29yIHRoZSBjcmVkZW50 aWFscy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+QWRkaW5nIGEgcmVsYXRpb25zaGlwIGlkZW50aWZpZXIgc2VlbXMgdG8gYmUgc29sdmluZyB0 aGUgcHJvYmxlbSBhdCB0aGUgd3JvbmcgbGF5ZXIsIHVubGVzcyBpdCBpcyBpbiBhbGwgZXZlbnRz LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDM6NTQgUE0gQXR1bCBUdWxzaGliYWd3YWxlICZsdDs8 YSBocmVmPSJtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+YXR1 bHR1bHNoaUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0ND IDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2lu LXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U29ycnkgZm9yIHRoZSB0 ZXJzZSBtZXNzYWdlLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SWYgYSBzaW5nbGUgdGVuYW50IHRyYW5zbWl0dGVyIGlzIHRydXN0ZWQgYnkgYSBtdWx0aS10 ZW5hbnRlZCByZWNlaXZlciBmb3IgYSBzcGVjaWZpYyB0ZW5hbnQsIHRoZW4gdGhlIFNQQUctaWQg bmVlZCBub3QgYmUgaW5jbHVkZWQgaWYgdGhlIHN1YmplY3QgaXMgdW5pcXVlIGF0IHRoZSB0ZW5h bnQgbGV2ZWwsIGJlY2F1c2UgdGhlIHJlY2VpdmVyIHdpbGwgYXV0b21hdGljYWxseSBpZGVudGlm eSBTUEFHIHRoYXQNCiB0aGUgc3ViamVjdCBiZWxvbmdzIHRvIG9uIGl0cyBlbmQgKGJhc2VkIG9u IHRoZSBhdXRoZW50aWNhdGlvbikuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBNb24sIEp1bCAxMywgMjAyMCBhdCAzOjM3IFBNIERp Y2sgSGFyZHQgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmRpY2suaGFyZHRAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpz b2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6 NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2hp Y2ggcGFydCBpcyBub3QgcmVxdWlyZWQ/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5PbiBNb24sIEp1bCAxMywgMjAyMCBhdCAzOjMzIFBNIEF0dWwgVHVsc2hp YmFnd2FsZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmF0dWx0dWxzaGlAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0 OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5v dCByZXF1aXJlZCwgc2luY2UgdGhlIGNsYWltIGlzIG9wdGlvbmFsLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMzoy NSBQTSBEaWNrIEhhcmR0ICZsdDs8YSBocmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20i IHRhcmdldD0iX2JsYW5rIj5kaWNrLmhhcmR0QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdp bi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPldvdWxkIGEgdHJhbnNtaXR0ZXIgdGhhdCBpcyBvbmx5IGluIG9uZSBTUEFHIChhIHNpbmds ZSB0ZW5hbnQgc3lzdGVtKSBoYXZlIHRvIGluY2x1ZGUgaXRzIFNQQUcgaWQgaW4gZXZlbnRzIHNl bnQgdG8gYSByZWNlaXZlciB0aGF0IGFjY2VwdHMgZXZlbnRzIGZyb20gbXVsdGlwbGUgU1BBR3M/ IEJ1dCBpdCB3b3VsZCBub3QgaW5jbHVkZSBpdCBpbiBzZW5kaW5nIGV2ZW50cyB0byBvdGhlciBy ZWNlaXZlcnMmbmJzcDt0aGF0DQogaGF2ZSBzZXBhcmF0ZSBjcmVkZW50aWFscyBmb3IgZWFjaCBy ZWxhdGlvbnNoaXA/PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48aW1nIGJvcmRlcj0iMCIgd2lkdGg9IjEiIGhlaWdodD0iMSIgc3R5bGU9 IndpZHRoOi4wMTA0aW47aGVpZ2h0Oi4wMTA0aW4iIGlkPSJfeDAwMDBfaTEwMjYiIHNyYz0iaHR0 cHM6Ly9tYWlsZm9vZ2FlLmFwcHNwb3QuY29tL3Q/c2VuZGVyPWFaR2xqYXk1b1lYSmtkRUJuYldG cGJDNWpiMjAlM0QmYW1wO3R5cGU9emVyb2NvbnRlbnQmYW1wO2d1aWQ9ZTRkMTk2MmUtNTk0ZC00 ZDQ1LThjYTUtMWM2MzI0ZmU3MDBjIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuNXB0O2ZvbnQt ZmFtaWx5OiZxdW90O0dhZHVnaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndoaXRlIj7hkKc8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBNb24s IEp1bCAxMywgMjAyMCBhdCAzOjA1IFBNIEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7PGEgaHJlZj0i bWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmF0dWx0dWxzaGlA Z29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDow aW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYXQgY291bGQgYmUgdHJ1ZSBidXQg dGhlcmUgYXJlIGEgZmV3IHdheXMgaW4gd2hpY2ggaXQgY2FuIGJlIGF2b2lkZWQ6PG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPG9sIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzEiPg0KVGhlIHBlZXJzIGxldmVyYWdlIHNvbWUg aGlnaGVyLWxldmVsIHRydXN0IHRvIGFjY2VwdCAvIGRlY2xpbmUgZXZlbnRzIHJlbGF0aW5nIHRv IGxvd2VyIGxldmVsIFNQQUdzLiBGb3IgZXhhbXBsZSwgaWYgdHJ1c3QgaXMgZXN0YWJsaXNoZWQg YXQgYSB0ZW5hbnQgbGV2ZWwsIHRoZW4gYW4gT1UgbGV2ZWwgU1BBRyBuZWVkIG5vdCBoYXZlIGl0 cyBvd24gYXV0aG9yaXphdGlvbi48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttc28tbGlzdDpsMSBsZXZlbDEgbGZvMSI+DQpUaGUgc2VjcmV0IHJlcXVpcmVkIGZvciBlc3Rh Ymxpc2hpbmcgdGhlIGF1dGhvcml6YXRpb24gb2YgYSBTUEFHIG1heSBiZSB0ZW1wb3JhcnkuIEZv ciBleGFtcGxlOjxvOnA+PC9vOnA+PC9saT48L29sPg0KPG9sIHN0YXJ0PSIyIiB0eXBlPSIxIj4N CjxvbCBzdGFydD0iMSIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0 OmwxIGxldmVsMiBsZm8xIj4NCkFuIGFkbWluaXN0cmF0b3Igc2lnbnMgaW4gdG8gdGhlaXIgdGVu YW50IGluIHRoZSB0cmFuc21pdHRlcidzIGFkbWluaXN0cmF0b3IgY29uc29sZTxvOnA+PC9vOnA+ PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwxIGxldmVsMiBsZm8xIj4NClRo ZSBhZG1pbiBvYnRhaW5zIGEgdGVtcG9yYXJ5IGF1dGhvcml6YXRpb24gKG9uZS10aW1lIGNvZGUp PG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwy IGxmbzEiPg0KVGhlIGFkbWluIHNpZ25zIGluIHRvIHRoZWlyIHRlbmFudCBpbiB0aGUgcmVjZWl2 ZXIncyBhZG1pbmlzdHJhdGlvbiBjb25zb2xlIGFuZCBwYXN0ZXMgaW4gdGhlIG9uZS10aW1lIGNv ZGU8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMSBsZXZl bDIgbGZvMSI+DQpUaGUgcmVjZWl2ZXIgc2VuZHMgYSByZXF1ZXN0IHRvIGVuYWJsZSB0aGUgc3Ry ZWFtIGZvciB0aGUgc3BlY2lmaWVkIFNQQUcgd2l0aCB0aGF0IG9uZS10aW1lIGF1dGhvcml6YXRp b24uPG86cD48L286cD48L2xpPjwvb2w+DQo8L29sPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkluIHRoZSBmaXJzdCBjYXNlLCB0aGVyZSBhcmUgbm8gYWRkaXRpb25hbCBzZWNyZXRzIHJl cXVpcmVkLiBJbiB0aGUgc2Vjb25kIGNhc2UsIHRoZSBzZWNyZXQgaXMgdGVtcG9yYXJ5LjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5PbiBNb24sIEp1bCAxMywgMjAyMCBhdCAyOjM0IFBNIERpY2sgSGFyZHQgJmx0OzxhIGhy ZWY9Im1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmRpY2suaGFy ZHRAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0 O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0 OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBzZWUgdGhlIFNQQUcgbGV0cyB0 aGUgdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyIHByb3ZpZGUgY29udGV4dCwgYXMgdGhlIHN1Ympl Y3QgaWRlbnRpZmllciBtYXkgYmUgdGhlIHNhbWUgYWNyb3NzIFNQQUdzLjxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Tm93IEknbSB0cnlpbmcgdG8gdW5kZXJz dGFuZCBob3cgdGhlIHRyYW5zbWl0dGVyIGF1dGhlbnRpY2F0ZXMgdG8gdGhlIHJlY2VpdmVyIGlm IGl0IGRvZXMgbm90IGhhdmUgaXQncyBvd24gc2VjcmV0IChhc3N1bWluZyB0aGF0IGF1dGhlbnRp Y2F0aW9uIG1vZGVsKSAtLSBJRSwgaG93IGRvZXMgdGhlIHJlY2VpdmVyIGtub3cgdGhlIHRyYW5z bWl0dGVyIGlzIGF1dGhvcml6ZWQmbmJzcDtmb3IgdGhhdCBTUEFHPzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIE1vbiwgSnVsIDEzLCAy MDIwIGF0IDI6MDggUE0gQXR1bCBUdWxzaGliYWd3YWxlICZsdDs8YSBocmVmPSJtYWlsdG86YXR1 bHR1bHNoaUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+YXR1bHR1bHNoaUBnb29nbGUuY29t PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRpY2ssIHlvdXIgdW5kZXJzdGFuZGluZyBp cyBjb3JyZWN0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlRvIGNsYXJpZnkgdGhlIHByb3Bvc2FsIGhlcmUsIEhlcmUncyB0aGUgdGV4dCBJJ20gcHJvcG9z aW5nIHRvIGJlIGFkZGVkOjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KPHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4zLiZuYnNwOyBTdWJqZWN0IFByaW5jaXBh bHM8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7U3ViamVjdCBQcmluY2lwYWxzIGFyZSB0aGUgbWFu YWdlbWVudCBlbnRpdGllcyBhc3NvY2lhdGVkIHdpdGg8YnI+DQombmJzcDsgJm5ic3A7U3ViamVj dHMuJm5ic3A7IFRoZXNlIG1heSBiZSBodW1hbiBvciByb2JvdGljIHByaW5jaXBhbHMgb3IgZGV2 aWNlcyBvcjxicj4NCiZuYnNwOyAmbmJzcDtvdGhlciBlbnRpdGllcyB0aGF0IGFyZSBtYW5hZ2Vk IGJ5IHRyYW5zbWl0dGVycyBhbmQgcmVjZWl2ZXJzLiZuYnNwOyBGb3I8YnI+DQombmJzcDsgJm5i c3A7ZXhhbXBsZSwgdGhlIHNhbWUgU3ViamVjdCBQcmluY2lwYWwgbWF5IGJlIHJlZmVycmVkIHRv IGJ5IGFuIGVtYWlsPGJyPg0KJm5ic3A7ICZuYnNwO2FkZHJlc3Mgb3IgYSBwaG9uZSBudW1iZXIu Jm5ic3A7IEEgdHJhbnNtaXR0ZXIgb3IgcmVjZWl2ZXIgd2lsbCB0eXBpY2FsbHk8YnI+DQombmJz cDsgJm5ic3A7bWFuYWdlIHN1YmplY3QgcHJpbmNpcGFscyBhbmQgb3JnYW5pemUgdGhlbSBpbnRv IHN1Yi1ncm91cGluZ3Mgc3VjaDxicj4NCiZuYnNwOyAmbmJzcDthcyB0ZW5hbnRzLCBncm91cHMs IG9yZ2FuaXphdGlvbmFsIHVuaXRzLCBldGMuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1N1Ympl Y3RzIGFyZSBpZGVudGlmaWVkIGJ5IFN1YmplY3QgSWRlbnRpZmllcnMgZGVmaW5lZCBiZWxvdy48 YnI+DQo8YnI+DQozLjEuJm5ic3A7IFNQQUdzPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1N1Ympl Y3QgUHJpbmNpcGFscyBNQVkgYmUgZ3JvdXBlZCBmb3IgYWRtaW5pc3RyYXRpdmUgcHVycG9zZXMg aW50bzxicj4NCiZuYnNwOyAmbmJzcDsmcXVvdDtTdWJqZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJh dGl2ZSBHcm91cGluZ3MmcXVvdDsgb3IgU1BBR3MuJm5ic3A7IEZvciBleGFtcGxlLDxicj4NCiZu YnNwOyAmbmJzcDthbGwgdXNlcnMgYmVsb25naW5nIHRvIG9uZSBjdXN0b21lciBvZiBhICZxdW90 O211bHRpLXRlbmFudGVkJnF1b3Q7IFRyYW5zbWl0dGVyPGJyPg0KJm5ic3A7ICZuYnNwO21heSBi ZSBpbiBvbmUgU1BBRy4mbmJzcDsgQWx0ZXJuYXRpdmVseSwgYW4gT3JnYW5pemF0aW9uYWwgVW5p dCBvciBhIGdyb3VwPGJyPg0KJm5ic3A7ICZuYnNwO29mIFN1YmplY3RzIHdpdGhpbiBhIGN1c3Rv bWVyIG9mIGEgVHJhbnNtaXR0ZXIgKHdoZXRoZXIgbXVsdGktPGJyPg0KJm5ic3A7ICZuYnNwO3Rl bmFudGVkIG9yIG5vdCkgbWF5IGJlIG9uZSBTUEFHLiZuYnNwOyBTUEFHcyBtYXkgaGF2ZSBvdmVy bGFwcGluZyBzZXRzIG9mPGJyPg0KJm5ic3A7ICZuYnNwO1N1YmplY3RzLjxicj4NCjxicj4NCiZu YnNwOyAmbmJzcDtBIFNQQUcgTUFZIGJlIHRoZSBTdWJqZWN0IG9mIGNlcnRhaW4gc3RyZWFtIHVw ZGF0ZSBldmVudHMgZGVmaW5lZDxicj4NCiZuYnNwOyAmbmJzcDtsYXRlciBpbiB0aGlzIHNwZWMs IGhlbmNlIGlzIGRlZmluZWQgYXMgYSBTdWJqZWN0IFR5cGUgb2YgaXRzIG93bjxicj4NCiZuYnNw OyAmbmJzcDtiZWxvdy4uJm5ic3A7IEEgU1BBRyBpZGVudGlmaWVyIE1BWSBiZSBpbmNsdWRlZCBp biBvdGhlciBzdWJqZWN0IHR5cGVzIHRvPGJyPg0KJm5ic3A7ICZuYnNwO2Rpc2FtYmlndWF0ZSB0 aGUgc3ViamVjdC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7QSBTUEFHIHN1YmplY3QgaWRlbnRp ZmllciBpcyBhZ3JlZWQgdG8gb2ZmbGluZSBiZXR3ZWVuIGEgdHJhbnNtaXR0ZXI8YnI+DQombmJz cDsgJm5ic3A7YW5kIGEgcmVjZWl2ZXIuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGJlbmVmaXRzIG9mIGRvaW5nIHRoaXMgYXJl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPG9sIHN0YXJ0PSIxIiB0eXBlPSIxIj4N CjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPg0KTXVsdGkt dGVuYW50ZWQgaG9zdHMgZG8gbm90IG5lZWQgdG8gbWFpbnRhaW4gc2VjcmV0cyBwZXIgdGVuYW50 IGFuZCBwZXIgdHJhbnNtaXR0ZXIgdGVuYW50IGlmIGVhY2ggdGVuYW50IGhhcyB0byBiZSBhbiBl dmVudCB0cmFuc21pdHRlciBhbmQgYW4gZXZlbnQgcmVjZWl2ZXIgb2YgaXRzIG93bi48bzpwPjwv bzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMCBsZXZlbDEgbGZvMiI+ DQpBbiBldmVudCBzdHJlYW0gbWF5IGJlIGVzdGFibGlzaGVkIGJldHdlZW4gdHdvIG11bHRpLXRl bmFudGVkIGhvc3RzLCBhbmQgc28gZG9lcyBub3QgbmVlZCB0byBiZSBtYW5hZ2VkIGF0IGEgcGVy LXRlbmFudCBsZXZlbDxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1s aXN0OmwwIGxldmVsMSBsZm8yIj4NClRoZSBzYW1lIHN1YmplY3Qgb3Igc3ViamVjdCBwcmluY2lw YWwgbWF5IGJlIGEgcGFydCBvZiBtdWx0aXBsZSBTUEFHcywgYW5kIGlkZW50aWZ5aW5nIHRoZSBT UEFHIHRoYXQgYW4gZXZlbnQgcmVsYXRlcyB0byBjYW4gYmUgYWNoaWV2ZWQgaWYgdGhlIHN0YW5k YXJkIGFsbG93cyBmb3IgdGhlIFNQQUdzIHRvIGJlIGlkZW50aWZpZWQuPG86cD48L286cD48L2xp Pjwvb2w+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTW9uLCBK dWwgMTMsIDIwMjAgYXQgMTE6MzIgQU0gRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRp Y2suaGFyZHRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+ZGljay5oYXJkdEBnbWFpbC5jb208 L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4g MGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UbyBjbGFyaWZ5LCB5b3VyIHByb3Bvc2FsIGlzIGRyaXZl biBieSB0aGUgaW1wbGVtZW50YXRpb24mbmJzcDtidXJkZW4gb2YgbWFpbnRhaW5pbmcgc2VwYXJh dGUgc2VjcmV0cyAvIHN0cmVhbXMgYmV0d2VlbiBhIHRyYW5zbWl0dGVyIGFuZCByZWNlaXZlcj88 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxpbWcg Ym9yZGVyPSIwIiB3aWR0aD0iMSIgaGVpZ2h0PSIxIiBzdHlsZT0id2lkdGg6LjAxMDRpbjtoZWln aHQ6LjAxMDRpbiIgaWQ9Il94MDAwMF9pMTAyNSIgc3JjPSJodHRwczovL21haWxmb29nYWUuYXBw c3BvdC5jb20vdD9zZW5kZXI9YVpHbGpheTVvWVhKa2RFQm5iV0ZwYkM1amIyMCUzRCZhbXA7dHlw ZT16ZXJvY29udGVudCZhbXA7Z3VpZD03MTRiMmUwMy1iMTEyLTRmMzItYTA4MC1mNzhlZThjMGJj MjAiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7R2FkdWdp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2hpdGUiPuGQpzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDk6 MDEgQU0gQXR1bCBUdWxzaGliYWd3YWxlICZsdDthdHVsdHVsc2hpPTxhIGhyZWY9Im1haWx0bzo0 MGdvb2dsZS5jb21AZG1hcmMuLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+NDBnb29nbGUuY29t QGRtYXJjLmlldGYub3JnPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJp Z2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgYWxsLCZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhlcmUncyBhIHF1aWNrIGJh Y2tncm91bmQgZm9yIHRoZSA8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vcmljaGFubmEvc2Vj ZXZlbnQvcHVsbC8xIiB0YXJnZXQ9Il9ibGFuayI+DQpwcm9wb3NhbDwvYT4gZm9yIGluY2x1ZGlu ZyBTdWJqZWN0IFByaW5jaXBhbHMgYW5kIFN1YmplY3QgUHJpbmNpcGFsIEFkbWluaXN0cmF0aXZl IEdyb3VwaW5ncyBvciBTUEFHcyBpbiB0aGUgU3ViamVjdCBJZGVudGlmaWVycyBzcGVjLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Vc2Ug b2YgU3ViamVjdCBJZGVudGlmaWVycyBpbiBTaGFyZWQgU2lnbmFscyBhbmQgRXZlbnRzPC9iPjo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBT aGFyZWQgU2lnbmFscyBhbmQgRXZlbnRzIChTU0UpIHByb2ZpbGUgb2YgU0VUcyBzcGVjaWZpZXMg dGhhdCB0cmFuc21pdHRlcnMgYW5kIHJlY2VpdmVycyBzZW5kIGFuZCByZWNlaXZlIFNFVHMgdGhh dCBjb250YWluIFN1YmplY3QgSWRlbnRpZmllcnMuIFRoZXNlIHN1YmplY3QgaWRlbnRpZmllcnMg aGF2ZSB0aGUgZm9ybWF0IHRoYXQgaXMgbm93IGJlaW5nIGRpc2N1c3NlZCBhcyBhIHNlcGFyYXRl IHNwZWNpZmljYXRpb24NCiBoZXJlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5UcmFuc21pdHRlcnMgYW5kIFJlY2VpdmVycyBpbiBTU0U8 L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGUgU1NFIHByb2ZpbGUgZGVmaW5lcyB0cmFuc21pdHRlcnMgYW5kIHJlY2VpdmVycyBhcyBob3N0 cyB0aGF0IG1hbmFnZSBzdHJlYW1zIGJldHdlZW4gcGVlcnMuIFRoZSByZWNlaXZlciBhdXRoZW50 aWNhdGVzIHRvIHRoZSB0cmFuc21pdHRlciB1c2luZyBPQXV0aCwgcmVxdWlyaW5nIHRoZSB1c2Ug b2YgYSBzZWNyZXQgcGVyIHJlY2VpdmVyLiBJbiBhIG11bHRpLXRlbmFudGVkIGhvc3QgdGhhdCBo YW5kbGVzDQogaHVuZHJlZHMgb2YgdGhvdXNhbmRzIG9yIG1pbGxpb25zIG9mIGluZGVwZW5kZW50 IHRlbmFudHMsIG1haW50YWluaW5nIHN1Y2ggYSBzZWNyZXQgcGVyIGluc3RhbmNlIG9mIGEgcmVj ZWl2ZXIgaXMgY3VtYmVyc29tZS4gRnVydGhlcm1vcmUsIHNpbmNlIGEgdHJhbnNtaXR0ZXIgYW5k IGEgcmVjZWl2ZXIgaGFzIHRvIG1haW50YWluIGEgc3RyZWFtIHBlciBwYWlyLCBjcmVhdGluZyBz dWNoIHBlci10ZW5hbnQgc3RyZWFtcyBjYW4gYWRkIHNpZ25pZmljYW50DQogaW1wbGVtZW50YXRp b24gb3ZlcmhlYWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPlNQQUdzPC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+VGhlcmVmb3JlLCB3ZSBuZWVkIGEgbm90aW9uIG9mIGEgZ3JvdXBp bmcgb2Ygc3ViamVjdHMgd2l0aGluIHRoZSBzYW1lIHRyYW5zbWl0dGVyIGFuZCByZWNlaXZlciB0 byBkaXN0aW5ndWlzaCBiZXR3ZWVuIHZhcmlvdXMgYWRtaW5pc3RyYXRpdmUgZ3JvdXBpbmdzIHRo YXQgZXhpc3Qgd2l0aGluIGEgaG9zdC4gVGhlc2UgZ3JvdXBpbmdzIGNvdWxkIGluY2x1ZGUgdGVu YW50cywgb3JnYW5pemF0aW9uYWwgdW5pdHMNCiBvciB1c2VyIGdyb3Vwcy4uIFRoaXMgZ3JvdXBp bmcgaXMgY2FwdHVyZWQgaW4gdGhlIG5vdGlvbiBvZiBhIFNQQUcuIFRoZSB1bmlxdWVuZXNzIG9m IGEgdXNlciBpZGVudGlmaWVyIChzdWJqZWN0IGlkZW50aWZpZXIpIG1heSBhbHNvIGJlIGxpbWl0 ZWQgdG8gYSBTUEFHLiBGb3IgZXhhbXBsZSwgaWYgYSByYW5kb20gdW5pcXVlIElEIHJlcHJlc2Vu dHMgYSB1c2VyLCB0aGVuIHRoYXQgSUQgbWF5IGJlIHVuaXF1ZSB3aXRoaW4gYSBTUEFHIGFuZCBu b3QNCiB1bml2ZXJzYWxseSBhY3Jvc3MgYSB0cmFuc21pdHRlciBvciByZWNlaXZlci4gVGhpcyBp cyBiZWNhdXNlIGVhY2ggdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyIG1heSBoYXZlIG11bHRpcGxl IGNvbm5lY3Rpb25zIHRvIG90aGVyIHRyYW5zbWl0dGVycyBhbmQgcmVjZWl2ZXJzLCBhbmQgZW5z dXJpbmcgdW5pcXVlbmVzcyBhY3Jvc3MgYWxsIHN1Y2ggcGVlcnMgaXMgcHJvYmFibHkgYW4gaW50 cmFjdGFibGUgcHJvYmxlbS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+U3ViamVjdCBQcmluY2lwYWxzPC9iPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2hpbGUgd2hhdCBpcyByZXByZXNl bnRlZCB3aXRoaW4gYSBzdWJqZWN0IGlkZW50aWZpZXIgbWF5IGJlIG9ubHkgYW4gYXNwZWN0IG9m IHRoZSBtYW5hZ2VtZW50IGVudGl0eSwgdGhlIGFkbWluaXN0cmF0aXZlIGdyb3VwaW5nIGlzIGFi b3V0IHRoZSBtYW5hZ2VtZW50IGVudGl0eSBpdHNlbGYuIFRoaXMgY291bGQgYmUgdGhlIHVzZXIs IGRldmljZSBvciBvdGhlciBwcmluY2lwYWwgdGhhdCB0aGUgc3ViamVjdA0KIGlkZW50aWZpZXIg cmVwcmVzZW50cy4gVGhlcmVmb3JlLCBhbiBhYnN0cmFjdCBub3Rpb24gb2YgYSBTdWJqZWN0IFBy aW5jaXBhbCBpcyBhbHNvIHJlcXVpcmVkIGluIG9yZGVyIHNwZWNpZnkgd2hhdCB0aGUgZ3JvdXBp bmcgd2l0aGluIGEgU1BBRyBpcyBhYm91dC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGFib3ZlIGlzIGNhcHR1cmVkIGluIHRoZSAmcXVv dDtTdWJqZWN0IFByaW5jaXBhbCZxdW90OyBhbmQgJnF1b3Q7U1BBRyZxdW90OyBzZWN0aW9ucyB3 aXRoaW4gdGhlIHByb3Bvc2VkDQo8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vcmljaGFubmEv c2VjZXZlbnQvcHVsbC8xIiB0YXJnZXQ9Il9ibGFuayI+UFI8L2E+LjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MsPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BdHVsPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcg bGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxh bmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYmxvY2txdW90 ZT4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CH2PR00MB06786BC0E20E4CF98170AA54F5610CH2PR00MB0678namp_-- From nobody Mon Jul 13 21:47:21 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C41FF3A0F7F for ; Mon, 13 Jul 2020 21:47:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.986 X-Spam-Level: X-Spam-Status: No, score=-1.986 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=momentumft.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hRXKiKDeR0Cm for ; Mon, 13 Jul 2020 21:47:17 -0700 (PDT) Received: from mail-ot1-x329.google.com (mail-ot1-x329.google.com [IPv6:2607:f8b0:4864:20::329]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1BFC43A0F7B for ; Mon, 13 Jul 2020 21:47:16 -0700 (PDT) Received: by mail-ot1-x329.google.com with SMTP id 72so11986380otc.3 for ; Mon, 13 Jul 2020 21:47:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=momentumft.co.uk; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1iLwR5jq5ajjIvv6/m7gFJjH2ONnmwwkWM0Chs8myxw=; b=ZWgQ3K+FS4n3qlqNNJ1iQeRTL8635RQ16gD5DQySvn9DHAIsUnJFoQgG8ej3tB1HlL o0QeuLEp+FFagRp2etyViCRUH26pDgzK5xeKCejj0qp7LDBmz3CBGzW91EQIw2QznVVF PCGgZqeVA7kYaLQXM+8LFw88PKZgF3sAQd9J8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1iLwR5jq5ajjIvv6/m7gFJjH2ONnmwwkWM0Chs8myxw=; b=Dwgag2Ia2/46AHx4IH4f0YUiCRuIFGxR/C9KfJWDvgziNrTZC7tPK7sHRu1uzI4Bzd JwVdw3p+0qcSK5Zl5qtM0UaZz4Te5grAXH9ydxPJ+DWzQMwCVCJSlpdGZaRRduQJ3cI1 QdiGVU9wE8C3hRFRM1U8WvuwYFwJQXINL0q75IOl4AGY1hwESlQCrSSlNJHLeSkGtF0+ UgRWFt0cGBCrvK8tMkQsU9scx0sodBHXRaOjdtB68eHTsavB+H6c4tTv5UJmMzZElenB NKUSuWTBkU6sOs3tpM5WOofxD7cTfQPx3FsqqSQcjb2xB0jJseljwyo4exWIT6kHipZ0 XXjg== X-Gm-Message-State: AOAM533rpFs9o+5moelWvxQsGj+w55W4bD8teTITMwajqxiNjjwliTIJ o8wBS2aU2bXuwYO5M8LjkTYyDg70bTkLKqIknRb1F92l5xaR7gX6fUHiLeUqsGUKz9MUpeI73/K VzAnQ9nXoFYFiSXOlTA== X-Google-Smtp-Source: ABdhPJxdgoN04SrsZvUglu4XJoj2a2JpZOEzOw9433qBYVvET7ce2B2+BABB1dhyM5bXMqCW2pUvMvWk8YnHA3gtjtk= X-Received: by 2002:a9d:ee2:: with SMTP id 89mr2761580otj.260.1594702036156; Mon, 13 Jul 2020 21:47:16 -0700 (PDT) MIME-Version: 1.0 References: <60181911-37AC-4038-8DB0-843BDB3FA59A@amazon.com> In-Reply-To: <60181911-37AC-4038-8DB0-843BDB3FA59A@amazon.com> From: Dave Tonge Date: Tue, 14 Jul 2020 06:47:05 +0200 Message-ID: To: "Richard Backman, Annabelle" Cc: SecEvent Content-Type: multipart/alternative; boundary="000000000000635d5b05aa5f80f6" Archived-At: Subject: Re: [Id-event] Review of draft-ietf-secevent-subject-identifiers-05 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 04:47:20 -0000 --000000000000635d5b05aa5f80f6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks Annabelle The explanation around the `alias` type is helpful and I agree with your approach. Dave On Mon, 13 Jul 2020 at 22:07, Richard Backman, Annabelle < richanna@amazon.com> wrote: > Thanks for the review, Dave! Replies are [richanna] inline [/richanna]. > > > > =E2=80=93 > > Annabelle Backman (she/her) > > AWS Identity > > https://aws.amazon.com/identity/ > > > > > > *From: *Id-event on behalf of Dave Tonge < > dave.tonge@momentumft.co.uk> > *Date: *Sunday, July 12, 2020 at 10:15 PM > *To: *SecEvent > *Subject: *[EXTERNAL] [Id-event] Review of > draft-ietf-secevent-subject-identifiers-05 > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and kno= w > the content is safe. > > > > Hi, > > > > I'm really keen to see this draft progress and so have reviewed the > current text. > > > > *Introduction* > > I think it would be good to add some text to make it clear that while the > initial use case fo this spec is for SETs, there is nothing stopping it > being used in other contexts where parties need to communicate the identi= ty > of a subject.For example we were looking at using this spec to have > structured a `login_hint` or `login_hint_token` in OIDC or CIBA flows. > > > > [richanna] > > Good suggestion. I think adding a couple examples of Subject Identifier > usage would help too. > > [/richanna] > > > > *3.5. Aliases Subject Identifier Type* > > I definitely see this as a useful feature, however would it not be simple= r > to define `sub_id` as an array, rather than have a specific "alias" type? > > > > [richanna] > > Three reasons for =E2=80=9Calias=E2=80=9D as a formally defined type: > > 1. An array syntax for =E2=80=9Csub_id=E2=80=9D would allows us to spe= cify multiple > Subject Identifiers, but it wouldn=E2=80=99t define the semantics of t= hat (i.e., > they all refer to the same subject). We could define semantics, but th= at > would only cover =E2=80=9Csub_id=E2=80=9D, and would have to be repeat= ed by any spec that > wants to use Subject Identifiers elsewhere. > > 2. An array syntax also forces everyone to deal with the additional > complexity of what is likely to be a fairly niche use case. If we defi= ne > =E2=80=9Csub_id=E2=80=9D as always being an array, we=E2=80=99ll likel= y end up with a bunch of > nonconformant implementations that set it to a single Subject Identifi= er > object because that=E2=80=99s their use case. If we make it an object = or array, > we=E2=80=99re in the world of polymorphic JSON which makes parsing a l= ot more > complex. > > 3. The =E2=80=9Calias=E2=80=9D type leaves open the door for other way= s to include > multiple Subject Identifiers that have different semantics. For exampl= e, in > the future someone may find it useful to define a =E2=80=9Ccollection= =E2=80=9D type that > contains a collection of Subject Identifiers referring to different > entities. > > [/richanna] > > > > *Privacy Considerations* > > Given that subject identifiers will often be personally identifiable > information, I think that there should be a sentence stating that if this > schema is used in any front-channel communication, then the token in whic= h > the identifiers are embedded should be encrypted. > > > > [richanna] > > This has been called out a few times now; it=E2=80=99s clear there is a n= eed for > this spec to explicitly call out these concerns, even if the guidance is > just =E2=80=9Cfix this at another level.=E2=80=9D > > [/richanna] > > > > Thanks > > > > -- > > *Dave Tonge* > > > > > > *Moneyhub Enterprise is a trading style of Moneyhub Financial Technology > Limited which is authorised and regulated by the Financial Conduct > Authority ("FCA"). Moneyhub Financial Technology is entered on the > Financial Services Register (FRN 809360) at https://register.fca.org.uk/ > . Moneyhub Financial Technology is register= ed > in England & Wales, company registration number 06909772. Moneyhub > Financial Technology Limited 2020 =C2=A9 Moneyhub Enterprise, Regus Build= ing, > Temple Quay, 1 Friary, Bristol, BS1 6EA. * > > DISCLAIMER: This email (including any attachments) is subject to > copyright, and the information in it is confidential. Use of this email o= r > of any information in it other than by the addressee is unauthorised and > unlawful. Whilst reasonable efforts are made to ensure that any attachmen= ts > are virus-free, it is the recipient's sole responsibility to scan all > attachments for viruses. All calls and emails to and from this company ma= y > be monitored and recorded for legitimate purposes relating to this > company's business. Any opinions expressed in this email (or in any > attachments) are those of the author and do not necessarily represent the > opinions of Moneyhub Financial Technology Limited or of any other group > company. > > > --=20 Dave Tonge CTO [image: Moneyhub Enterprise] Moneyhub Financial Technology, 5th Floor, 10 Temple Back, Bristol, BS1 6FL t: +44 (0)117 280 5120 Moneyhub Enterprise is a trading style of Moneyhub Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority ("FCA"). Moneyhub Financial Technology is entered on the Financial Services Register (FRN 809360) at fca.org.uk/register. Moneyhub Financial Technology is registered in England & Wales, company registration number 06909772 . Moneyhub Financial Technology Limited 2018 =C2=A9 DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Moneyhub Financial Technology Limited or of any other group company. --=20 Moneyhub Enterprise is a trading style of Moneyhub Financial Technology=20 Limited which is authorised and regulated by the Financial Conduct=20 Authority ("FCA"). Moneyhub Financial Technology is entered on the=20 Financial Services Register (FRN 809360) at https://register.fca.org.uk/=20 . Moneyhub Financial Technology is registered= =20 in England & Wales, company registration number 06909772. Moneyhub=20 Financial Technology Limited 2020 =C2=A9 Moneyhub Enterprise, Regus Buildin= g,=20 Temple Quay, 1 Friary, Bristol, BS1 6EA.=C2=A0 DISCLAIMER: This email=20 (including any attachments) is subject to copyright, and the information in= =20 it is confidential. Use of this email or of any information in it other=20 than by the addressee is unauthorised and unlawful. Whilst reasonable=20 efforts are made to ensure that any attachments are virus-free, it is the= =20 recipient's sole responsibility to scan all attachments for viruses. All=20 calls and emails to and from this company may be monitored and recorded for= =20 legitimate purposes relating to this company's business. Any opinions=20 expressed in this email (or in any attachments) are those of the author and= =20 do not necessarily represent the opinions of Moneyhub Financial Technology= =20 Limited or of any other group company. --000000000000635d5b05aa5f80f6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Thanks=C2=A0Annabelle

    The explanation=C2=A0= around the `alias` type is helpful and I agree with your approach.
    Dave

    On Mon, 13 Jul 2020 at 22:07, Richard Backman, Annabelle &= lt;richanna@amazon.com> wrote= :

    Thanks for the review, Dave! Replies are [richanna] inline [/richanna].

    =C2=A0

    =E2=80=93

    Annabelle Backman (sh= e/her)

    AWS Identity

    https://aws.amazon.com/identity/

    =C2=A0

    =C2=A0

    From: Id-event <id-event-bounces@ie= tf.org> on behalf of Dave Tonge <dave.tonge@momentumft.co.uk>
    Date: Sunday, July 12, 2020 at 10:15 PM
    To: SecEvent <id-event@ietf.org>
    Subject: [EXTERNAL] [Id-event] Review of draft-ietf-secevent-subject= -identifiers-05

    =C2=A0

    CAUTION: This email originated from outside of the orga= nization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.<= /u>

    =C2=A0

    Hi,

    =C2=A0

    I'm really keen to see this dra= ft progress and so have reviewed the current text.

    =C2=A0

    Introduction

    I think it would be good to add som= e text to make it clear that while the initial use case fo this spec is for= SETs, there is nothing stopping it being used in other contexts where parties need to communicate the identity of a subject= .For example we were looking at using this spec to have structured a `login= _hint` or `login_hint_token` in OIDC or CIBA flows.

    =C2=A0

    [richanna]<= /u>

    Good suggestio= n. I think adding a couple examples of Subject Identifier usage would help = too.

    [/richanna]

    =C2=A0

    3.5.=C2=A0 Aliases Subject Ident= ifier Type

    I definitely see this as a useful f= eature, however would it not be simpler to define `sub_id` as an array, rat= her than have a specific "alias" type?

    =C2=A0

    [richanna]<= /u>

    Three reasons = for =E2=80=9Calias=E2=80=9D as a formally defined type:

    1. An array syntax for =E2=80=9Csub_id=E2=80=9D would allows us to specify mul= tiple Subject Identifiers, but it wouldn=E2=80=99t define the semantics of = that (i.e., they all refer to the same subject). We could define semantics,= but that would only cover =E2=80=9Csub_id=E2=80=9D, and would have to be repeated by any spec that wants to use Subject Identifiers elsewhere.

    2. An array syntax also forces everyone to deal with the additional complexity= of what is likely to be a fairly niche use case. If we define =E2=80=9Csub= _id=E2=80=9D as always being an array, we=E2=80=99ll likely end up with a b= unch of nonconformant implementations that set it to a single Subject Identifier object because that=E2=80=99s their use case. If we mak= e it an object or array, we=E2=80=99re in the world of polymorphic JSON whi= ch makes parsing a lot more complex.

    3. The =E2=80=9Calias=E2=80=9D type leaves open the door for other ways to inc= lude multiple Subject Identifiers that have different semantics. For exampl= e, in the future someone may find it useful to define a =E2=80=9Ccollection= =E2=80=9D type that contains a collection of Subject Identifiers referring to different entities.

    [/richanna]=

    =C2=A0<= u>

    Privacy Considerations=

    Given that subject identifiers will= often be personally identifiable information, I think that there should be= a sentence stating that if this schema is used in any front-channel communication, then the token in which the identifiers a= re embedded should be encrypted.

    =C2=A0

    [richanna]<= /u>

    This has been = called out a few times now; it=E2=80=99s clear there is a need for this spe= c to explicitly call out these concerns, even if the guidance is just =E2= =80=9Cfix this at another level.=E2=80=9D

    [/richanna]

    =C2=A0

    Thanks

    =C2=A0

    --

    Da= ve Tonge

    = =C2=A0

    =C2=A0

    Moneyhub Enterprise is a trading style of Mo= neyhub Financial Technology Limited which is authorised and regulated by th= e Financial Conduct Authority ("FCA"). Moneyhub Financial Technology is entered on the Financial Services Registe= r (FRN 809360) at https://register= .fca.org.uk/. Moneyhub Financial Technology is registered in England &a= mp; Wales, company registration number 06909772. Moneyhub Financial Technol= ogy Limited 2020 =C2=A9 Moneyhub Enterprise, Regus Building, Temple Quay, 1 Friary, Bristol, BS1 6EA.=C2=A0

    DISCLAIMER: This email (including any attachmen= ts) is subject to copyright, and the information in it is confidential. Use= of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst rea= sonable efforts are made to ensure that any attachments are virus-free, it = is the recipient's sole responsibility to scan all attachments for viru= ses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relatin= g to this company's business. Any opinions expressed in this email (or = in any attachments) are those of the author and do not necessarily represen= t the opinions of Moneyhub Financial Technology Limited or of any other group company.<= /b>

    =C2=A0



    --
    Da= ve Tonge
    CTO
    3D"Moneyhub
    Moneyhub Financial Technology, 5th Fl= oor, 10 Temple Back, Bristol, BS1 6FL
    t:=C2=A0+44 (0)117 280 512= 0

    Moneyhub = Enterprise is a trading style of Moneyhub Financial Technology Limited whic= h is authorised and regulated by the Financial Conduct Authority ("FCA= ").=C2=A0Moneyhub Financial Technology is entered on the Financial Ser= vices Register=C2=A0(FRN=C2=A0809360) at fca.= org.uk/register. Moneyhub=C2=A0Financial Technology is registered in England &= ; Wales, company registration number=C2=A0=C2=A006909772=C2=A0.<= /span>
    Moneyhub=C2=A0Financial Technology L= imited 2018=C2=A0=C2=A9<= /div>

    DISCLAIMER: This email (including any attachments) is subject to co= pyright, and the information in it is confidential. Use of this email or of= any information in it other than by the addressee is unauthorised and unla= wful. Whilst reasonable efforts are made to ensure that any attachments are= virus-free, it is the recipient's sole responsibility to scan all atta= chments for viruses. All calls and emails to and from this company may be m= onitored and recorded for legitimate purposes relating to this company'= s business. Any opinions expressed in this email (or in any attachments) ar= e those of the author and do not necessarily represent the opinions of Mone= yhub Financial Technology Limited or of any other group company.
    <= /div>

    Moneyhub Enterprise is a trading style of Moneyhub Financi= al Technology Limited which is authorised and regulated by the Financial Co= nduct Authority ("FCA"). Moneyhub Financial Technology is entered= on the Financial Services Register (FRN 809360) at https://register.fca.org.uk/. Moneyhub Financial Technology is registered in England & Wales,= company registration number 06909772. Moneyhub Financial Technology Limite= d 2020 =C2=A9 Moneyhub Enterprise, Regus Building, Temple Quay, 1 Friary, B= ristol, BS1 6EA.=C2=A0

    = DISCLAIMER: This email (including any attachments) is subjec= t to copyright, and the information in it is confidential. Use of this emai= l or of any information in it other than by the addressee is unauthorised a= nd unlawful. Whilst reasonable efforts are made to ensure that any attachme= nts are virus-free, it is the recipient's sole responsibility to scan a= ll attachments for viruses. All calls and emails to and from this company m= ay be monitored and recorded for legitimate purposes relating to this compa= ny's business. Any opinions expressed in this email (or in any attachme= nts) are those of the author and do not necessarily represent the opinions = of Moneyhub Financial Technology Limited or of any other group company.


    --000000000000635d5b05aa5f80f6-- From nobody Tue Jul 14 07:55:37 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C94253A092F for ; Tue, 14 Jul 2020 07:55:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.598 X-Spam-Level: X-Spam-Status: No, score=-17.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UpOsU20w6u4B for ; Tue, 14 Jul 2020 07:55:32 -0700 (PDT) Received: from mail-yb1-xb2f.google.com (mail-yb1-xb2f.google.com [IPv6:2607:f8b0:4864:20::b2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B972D3A091A for ; Tue, 14 Jul 2020 07:55:32 -0700 (PDT) Received: by mail-yb1-xb2f.google.com with SMTP id 2so8301202ybr.13 for ; Tue, 14 Jul 2020 07:55:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=S7GmPTFMU9+kKNODpVBev2vIoaFY3waqUwqcZFM0cIM=; b=pcjZH+m5ZFqa1pi9Kcwi9XzBSGYaPHyXY2dhuAutHmPLWWLa4Ir2oHv3OA0IjWzqMP i/5cje8AajmBkWd8Dh+E9iVPOJEGLLLAThLy7rkbU4bO0tJxxntnx6NsnbN87UtlS8+x SRVLRwUxHU0Yg+UiWzCHZfVycBBQTv+ivLl8+G0PaTIUecHrYEmHC9GFvQOiGxL0izhw k/2PjrqEs2FSZbNAaGb5vZcAOHSG6YCvaGibfQYhgeb/WbYg9cLPdNCpquJim2EpkoRq FxMzEKo28eqLe2dEFrHOoiKkmQNkA3W5z+/nbbF0SsAzy1OO7SMn+By2+5jlzV/bEgIp KbJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=S7GmPTFMU9+kKNODpVBev2vIoaFY3waqUwqcZFM0cIM=; b=VpZ09q2qx7nusNwdZFm45UCdm/tGlYL6Wx3m6qC7pP5//pee/lW9CFKpG/fVCx5GN5 itHuaJLrjtxv7B7uXtfIN/Oum1e+RlOV5L0wuBJ9X5pdj21Hja5jkaPTEEX3CwQPXvaH biVZkJsO/JUswWH3M7f9phe4tBcPhlM4hgROzslBsWDXAggGjHN3Lv6djYsBJjwSlfHo t1mVnXhCVyOCzsDkUdB7LNuiwyv/HbSn5og+67aBj1BBe0hgNZ6Mh82S/GRtElNzzI1k RU46ZJxHd35BfxdSemeJigmwTJMCHNfTxkAxSRUm1DVWraZzv/0/7nh6mXKCr+2XG2Hm 01mQ== X-Gm-Message-State: AOAM532v+QdLys94fomN5suiyvlcaC/65lehsdMlURm3BJAybdxrZJmr ZPYgM37MKFTFDNOzUPRKTnivDxkTWDAVurJnR0P2fg== X-Google-Smtp-Source: ABdhPJyCcbC+EPha1PcYvHoDkeeAXrcBBI+Gt8a/WkPnuCEe8lJtRyhn0b/ST3x1lXWanTjwbrYs6q7QVZACInHFDK8= X-Received: by 2002:a25:5ac5:: with SMTP id o188mr8928172ybb.322.1594738531419; Tue, 14 Jul 2020 07:55:31 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Atul Tulshibagwale Date: Tue, 14 Jul 2020 07:55:20 -0700 Message-ID: To: Mike Jones Cc: Dick Hardt , SecEvent Content-Type: multipart/alternative; boundary="000000000000ad344b05aa67fff7" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 14:55:36 -0000 --000000000000ad344b05aa67fff7 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable A few points / responses: 1. Agree with Mike that spag_id should not be a required claim unless it's actually required for every subject. So keeping it optional (if we decide to have it at all) is the right thing to do. 2. IMO it will be far simpler for multi-tenanted hosts to use SPAGs rather than manage multiple event streams (i.e. one per tenant) 3. A multi-tenanted architecture is increasingly very common, so this will apply to a large number of organizations. 4. For single tenanted transmitters, the SPAG id may be inferred by receivers. Single tenanted receivers may ignore the SPAG ids in the subjects. So processing SPAGs in hybrid situations does not appear to be cumbersome. 5. The use of SPAGs is not limited to tenant-level information, since it may be applied to OUs or groups 6. If we agree that SPAG is a "meta concept" that applies in most situations, then capturing it in the spec is probably important. What Di= ck is proposing is a way to implement SPAGs without specifying them in a standard, so each entity is free to define it the way they want. This approach can cause incompatibilities. 7. Without SPAGs in the spec, if peers need to send events about SPAGs, then they need to use the "iss-sub" catch all to send events about enabl= ing or disabling events about SPAGs. Since this is not standardized, it coul= d also cause proprietary and incompatible implementations. Atul On Mon, Jul 13, 2020 at 5:23 PM Mike Jones wrote: > As I see it, the use cases that require a spag_id can use them when > necessary (unless the working group decides on another way to do this) bu= t > I certainly would oppose requiring it when it=E2=80=99s unnecessary. > > > > -- Mike > > > > *From:* Id-event *On Behalf Of *Dick Hardt > *Sent:* Monday, July 13, 2020 5:13 PM > *To:* Atul Tulshibagwale > *Cc:* SecEvent > *Subject:* Re: [Id-event] Subject Principals and Subject Principal > Administrative Groupings > > > > Would different URLs for each relationship not solve your issue of > maintaining secrets for each SPAG? For example: > > > > https:/example.com/secevent/SPAG_ID_1 > > > > https:/example.com/secevent/SPAG_ID_2 > > > > https:/example.com/secevent/SPAG_ID_3 > > > > Then the credential is independent of the SPAG, but we are not injecting > an identifier (spag_id) that is only relevant to orgs that want to use th= e > same credentials across SPAG relationships. > > > > > > > > On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale > wrote: > > I am OK with making the spag_id a required claim in every subject > identifier. For single tenanted transmitters, it would be a constant valu= e > for all events they generate. > > > > On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt wrote: > > So the receiver is using authentication sometimes to determine SPAG, and > not at other times? > > > > I'm digging into this as I had always thought of the event being between > two parties, where they are identified by the endpoint and/or the > credentials. > > > > Adding a relationship identifier seems to be solving the problem at the > wrong layer, unless it is in all events. > > > > > > On Mon, Jul 13, 2020 at 3:54 PM Atul Tulshibagwale > wrote: > > Sorry for the terse message. > > > > If a single tenant transmitter is trusted by a multi-tenanted receiver fo= r > a specific tenant, then the SPAG-id need not be included if the subject i= s > unique at the tenant level, because the receiver will automatically > identify SPAG that the subject belongs to on its end (based on the > authentication). > > > > > > > > On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt wrote: > > Which part is not required? > > > > On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale > wrote: > > Not required, since the claim is optional. > > > > On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt wrote: > > Would a transmitter that is only in one SPAG (a single tenant system) hav= e > to include its SPAG id in events sent to a receiver that accepts events > from multiple SPAGs? But it would not include it in sending events to oth= er > receivers that have separate credentials for each relationship? > > > > > > > > =E1=90=A7 > > > > On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale > wrote: > > That could be true but there are a few ways in which it can be avoided: > > 1. The peers leverage some higher-level trust to accept / decline > events relating to lower level SPAGs. For example, if trust is establi= shed > at a tenant level, then an OU level SPAG need not have its own > authorization. > 2. The secret required for establishing the authorization of a SPAG > may be temporary. For example: > > > 1. An administrator signs in to their tenant in the transmitter's > administrator console > 2. The admin obtains a temporary authorization (one-time code) > 3. The admin signs in to their tenant in the receiver's > administration console and pastes in the one-time code > 4. The receiver sends a request to enable the stream for the > specified SPAG with that one-time authorization. > > In the first case, there are no additional secrets required. In the secon= d > case, the secret is temporary. > > > > > > > > On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt wrote: > > I see the SPAG lets the transmitter and receiver provide context, as the > subject identifier may be the same across SPAGs. > > > > Now I'm trying to understand how the transmitter authenticates to the > receiver if it does not have it's own secret (assuming that authenticatio= n > model) -- IE, how does the receiver know the transmitter is authorized fo= r > that SPAG? > > > > > > On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale > wrote: > > Dick, your understanding is correct. > > > > To clarify the proposal here, Here's the text I'm proposing to be added: > > > 3. Subject Principals > > Subject Principals are the management entities associated with > Subjects. These may be human or robotic principals or devices or > other entities that are managed by transmitters and receivers. For > example, the same Subject Principal may be referred to by an email > address or a phone number. A transmitter or receiver will typically > manage subject principals and organize them into sub-groupings such > as tenants, groups, organizational units, etc. > > Subjects are identified by Subject Identifiers defined below. > > 3.1. SPAGs > > Subject Principals MAY be grouped for administrative purposes into > "Subject Principal Administrative Groupings" or SPAGs. For example, > all users belonging to one customer of a "multi-tenanted" Transmitter > may be in one SPAG. Alternatively, an Organizational Unit or a group > of Subjects within a customer of a Transmitter (whether multi- > tenanted or not) may be one SPAG. SPAGs may have overlapping sets of > Subjects. > > A SPAG MAY be the Subject of certain stream update events defined > later in this spec, hence is defined as a Subject Type of its own > below.. A SPAG identifier MAY be included in other subject types to > disambiguate the subject. > > A SPAG subject identifier is agreed to offline between a transmitter > and a receiver. > > The benefits of doing this are: > > 1. Multi-tenanted hosts do not need to maintain secrets per tenant and > per transmitter tenant if each tenant has to be an event transmitter a= nd an > event receiver of its own. > 2. An event stream may be established between two multi-tenanted > hosts, and so does not need to be managed at a per-tenant level > 3. The same subject or subject principal may be a part of multiple > SPAGs, and identifying the SPAG that an event relates to can be achiev= ed if > the standard allows for the SPAGs to be identified. > > > > > > On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt wrote: > > To clarify, your proposal is driven by the implementation burden of > maintaining separate secrets / streams between a transmitter and receiver= ? > > =E1=90=A7 > > > > On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: > > Hi all, > > Here's a quick background for the proposal > for including Subject > Principals and Subject Principal Administrative Groupings or SPAGs in the > Subject Identifiers spec. > > > > *Use of Subject Identifiers in Shared Signals and Events*: > > The Shared Signals and Events (SSE) profile of SETs specifies that > transmitters and receivers send and receive SETs that contain Subject > Identifiers. These subject identifiers have the format that is now being > discussed as a separate specification here. > > > > *Transmitters and Receivers in SSE* > > The SSE profile defines transmitters and receivers as hosts that manage > streams between peers. The receiver authenticates to the transmitter usin= g > OAuth, requiring the use of a secret per receiver. In a multi-tenanted ho= st > that handles hundreds of thousands or millions of independent tenants, > maintaining such a secret per instance of a receiver is cumbersome. > Furthermore, since a transmitter and a receiver has to maintain a stream > per pair, creating such per-tenant streams can add significant > implementation overhead. > > > > *SPAGs* > > Therefore, we need a notion of a grouping of subjects within the same > transmitter and receiver to distinguish between various administrative > groupings that exist within a host. These groupings could include tenants= , > organizational units or user groups.. This grouping is captured in the > notion of a SPAG. The uniqueness of a user identifier (subject identifier= ) > may also be limited to a SPAG. For example, if a random unique ID > represents a user, then that ID may be unique within a SPAG and not > universally across a transmitter or receiver. This is because each > transmitter and receiver may have multiple connections to other > transmitters and receivers, and ensuring uniqueness across all such peers > is probably an intractable problem. > > > > *Subject Principals* > > While what is represented within a subject identifier may be only an > aspect of the management entity, the administrative grouping is about the > management entity itself. This could be the user, device or other princip= al > that the subject identifier represents. Therefore, an abstract notion of = a > Subject Principal is also required in order specify what the grouping > within a SPAG is about. > > > > The above is captured in the "Subject Principal" and "SPAG" sections > within the proposed PR . > > > > Thanks, > > Atul > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --000000000000ad344b05aa67fff7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    A few points / responses:
    1. Agree with Mike that= spag_id should not be a required=C2=A0claim unless it's actually requi= red for every subject. So keeping it optional (if we decide to have it at a= ll) is the right thing to do.
    2. IMO it will be far simpler for multi-= tenanted hosts to use SPAGs rather than manage multiple event streams (i.e.= one per tenant)
    3. A multi-tenanted architecture is increasingly very= common, so this will apply to a large number of organizations.
    4. For= single tenanted transmitters, the SPAG id may be inferred by receivers. Si= ngle tenanted receivers may ignore the SPAG ids in the subjects. So process= ing SPAGs in hybrid situations does not appear to be cumbersome.
    5. Th= e use of SPAGs is not limited to tenant-level information, since it may be = applied to OUs or groups
    6. If we agree that SPAG is a "meta conc= ept" that applies in most situations, then capturing it in the spec is= probably important. What Dick is proposing is a way to implement SPAGs wit= hout specifying them in a standard, so each entity is free to define it the= way they want. This approach can cause incompatibilities.
    7. Without = SPAGs in the spec, if peers need to send events about SPAGs, then they need= to use the "iss-sub" catch all to send events about enabling or = disabling events about SPAGs. Since this is not standardized, it could also= cause proprietary and incompatible implementations.
    Atul

    On Mon, Jul 13, 2020 at 5:23 PM Mike Jones <Michael.Jones@microsoft.com> wrote:

    As I see it, the = use cases that require a spag_id can use them when necessary (unless the wo= rking group decides on another way to do this) but I certainly would oppose= requiring it when it=E2=80=99s unnecessary.

    =C2=A0<= /u>

    =C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0<= /u>

    From: Id-event <id-event-bounces@ietf.org> O= n Behalf Of Dick Hardt
    Sent: Monday, July 13, 2020 5:13 PM
    To: Atul Tulshibagwale <atultulshi@google.com>
    Cc: SecEvent <id-event@ietf.org>
    Subject: Re: [Id-event] Subject Principals and Subject Principal Adm= inistrative Groupings

    =C2=A0

    Would different URLs for each relationship not solve= your issue of maintaining secrets for each SPAG? For example:

    =C2=A0

    =C2=A0

    =C2=A0

    Then the credential is independent=C2=A0of the SPAG,= but we are not injecting an identifier (spag_id) that is only relevant=C2= =A0to orgs that want to use the same credentials across SPAG relationships.=

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale &= lt;atultulshi@go= ogle.com> wrote:

    I am OK with making the spag_id a required claim in = every subject identifier. For single tenanted transmitters, it would be a c= onstant value for all events they generate.

    =C2=A0

    On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    So the receiver is using authentication sometimes to= determine SPAG, and not at other times?

    =C2=A0

    I'm digging into this as I had always thought of= the event being between two parties, where they are identified=C2=A0by the= endpoint and/or the credentials.

    =C2=A0

    Adding a relationship identifier seems to be solving= the problem at the wrong layer, unless it is in all events.<= /p>

    =C2=A0

    =C2=A0

    Sorry for the terse message.

    =C2=A0

    If a single tenant transmitter is trusted by a multi= -tenanted receiver for a specific tenant, then the SPAG-id need not be incl= uded if the subject is unique at the tenant level, because the receiver wil= l automatically identify SPAG that the subject belongs to on its end (based on the authentication).=

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    Which part is not required?

    =C2=A0

    Not required, since the claim is optional.=

    =C2=A0

    On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    Would a transmitter that is only in one SPAG (a sing= le tenant system) have to include its SPAG id in events sent to a receiver = that accepts events from multiple SPAGs? But it would not include it in sen= ding events to other receivers=C2=A0that have separate credentials for each relationship?

    =C2=A0

    =C2=A0

    =C2=A0

    =E1=90=A7

    =C2=A0

    That could be true but there are a few ways in which= it can be avoided:

    1. The peers leverage some higher-level trust to accept / decline events relat= ing to lower level SPAGs. For example, if trust is established at a tenant = level, then an OU level SPAG need not have its own authorization.=
    2. The secret required for establishing the authorization of a SPAG may be tem= porary. For example:
      1. An administrator signs in to their tenant in the transmitter's administ= rator console
      2. The admin obtains a temporary authorization (one-time code)
      3. The admin signs in to their tenant in the receiver's administration con= sole and pastes in the one-time code
      4. The receiver sends a request to enable the stream for the specified SPAG wi= th that one-time authorization.

    In the first case, there are no additional secrets r= equired. In the second case, the secret is temporary.

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    I see the SPAG lets the transmitter and receiver pro= vide context, as the subject identifier may be the same across SPAGs.

    =C2=A0

    Now I'm trying to understand how the transmitter= authenticates to the receiver if it does not have it's own secret (ass= uming that authentication model) -- IE, how does the receiver know the tran= smitter is authorized=C2=A0for that SPAG?

    =C2=A0

    =C2=A0

    Dick, your understanding is correct.

    =C2=A0

    To clarify the proposal here, Here's the text I&= #39;m proposing to be added:


    3.=C2=A0 Subject Princi= pals

    =C2=A0 =C2=A0Subject Principals are the management entities associated with=
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or robotic principals or de= vices or
    =C2=A0 =C2=A0other entities that are managed by transmitters and receivers.= =C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Principal may be referred to by an e= mail
    =C2=A0 =C2=A0address or a phone number.=C2=A0 A transmitter or receiver wil= l typically
    =C2=A0 =C2=A0manage subject principals and organize them into sub-groupings= such
    =C2=A0 =C2=A0as tenants, groups, organizational units, etc.

    =C2=A0 =C2=A0Subjects are identified by Subject Identifiers defined below.<= br>
    3.1.=C2=A0 SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be grouped for administrative purposes = into
    =C2=A0 =C2=A0"Subject Principal Administrative Groupings" or SPAG= s.=C2=A0 For example,
    =C2=A0 =C2=A0all users belonging to one customer of a "multi-tenanted&= quot; Transmitter
    =C2=A0 =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organizational Uni= t or a group
    =C2=A0 =C2=A0of Subjects within a customer of a Transmitter (whether multi-=
    =C2=A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs may have overlap= ping sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A SPAG MAY be the Subject of certain stream update events defi= ned
    =C2=A0 =C2=A0later in this spec, hence is defined as a Subject Type of its = own
    =C2=A0 =C2=A0below..=C2=A0 A SPAG identifier MAY be included in other subje= ct types to
    =C2=A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2=A0A SPAG subject identifier is agreed to offline between a trans= mitter
    =C2=A0 =C2=A0and a receiver.

    The benefits of doing this are:

    1. Multi-tenanted hosts do not need to maintain secrets per tenant and per tra= nsmitter tenant if each tenant has to be an event transmitter and an event = receiver of its own.
    2. An event stream may be established between two multi-tenanted hosts, and so= does not need to be managed at a per-tenant level
    3. The same subject or subject principal may be a part of multiple SPAGs, and = identifying the SPAG that an event relates to can be achieved if the standa= rd allows for the SPAGs to be identified.

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt <dick.hardt@gmail.com<= /a>> wrote:

    To clarify, your proposal is driven by the implement= ation=C2=A0burden of maintaining separate secrets / streams between a trans= mitter and receiver?

    =E1=90=A7

    =C2=A0

    Hi all,=C2=A0

    Here's a quick background for the proposal for including Subject Principals and Subject Principal Adminis= trative Groupings or SPAGs in the Subject Identifiers spec.

    =C2=A0

    Use of Subject Identifiers in Shared Signals and = Events:

    The Shared Signals and Events (SSE) profile of SETs = specifies that transmitters and receivers send and receive SETs that contai= n Subject Identifiers. These subject identifiers have the format that is no= w being discussed as a separate specification here.

    =C2=A0

    Transmitters and Receivers in SSE

    The SSE profile defines transmitters and receivers a= s hosts that manage streams between peers. The receiver authenticates to th= e transmitter using OAuth, requiring the use of a secret per receiver. In a= multi-tenanted host that handles hundreds of thousands or millions of independent tenants, maintaining such= a secret per instance of a receiver is cumbersome. Furthermore, since a tr= ansmitter and a receiver has to maintain a stream per pair, creating such p= er-tenant streams can add significant implementation overhead.

    =C2=A0

    SPAGs

    Therefore, we need a notion of a grouping of subject= s within the same transmitter and receiver to distinguish between various a= dministrative groupings that exist within a host. These groupings could inc= lude tenants, organizational units or user groups.. This grouping is captured in the notion of a SPAG. The un= iqueness of a user identifier (subject identifier) may also be limited to a= SPAG. For example, if a random unique ID represents a user, then that ID m= ay be unique within a SPAG and not universally across a transmitter or receiver. This is because each transmi= tter and receiver may have multiple connections to other transmitters and r= eceivers, and ensuring uniqueness across all such peers is probably an intr= actable problem.

    =C2=A0

    Subject Principals

    While what is represented within a subject identifie= r may be only an aspect of the management entity, the administrative groupi= ng is about the management entity itself. This could be the user, device or= other principal that the subject identifier represents. Therefore, an abstract notion of a Subject Principa= l is also required in order specify what the grouping within a SPAG is abou= t.

    =C2=A0

    The above is captured in the "Subject Principal= " and "SPAG" sections within the proposed P= R.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    --000000000000ad344b05aa67fff7-- From nobody Tue Jul 14 08:53:29 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E6623A08D6 for ; Tue, 14 Jul 2020 08:53:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iUe8xysmE6b7 for ; Tue, 14 Jul 2020 08:53:25 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640098.outbound.protection.outlook.com [40.107.64.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 244B93A08D4 for ; Tue, 14 Jul 2020 08:53:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aqRDwwiDIRWbv5xvvVI6kOhppPGS6XgW/ueH+7JUpEKbRiIowny0eQ0hkhQs3EuoL1+ojXDFgCuHTNF9w4kntg3HWxPaW/U3WPxkurPAwXhRPyVenXm0vjJYPd3RhrTV2GUkkfBOVyV8QDDQx35M5IpkmHwP/5rsfIAeX92NVOtFxZKRF6HixlCiPmZPRL41Y3qefSKYq4fja5Ro4Zx7Dfqo1b7zT/AbAgTJ6e/s7CWcfXH2xP6vAEpk3tYLTgMw71fvkeOeyPSuhd0EVJswc4m3qwYknHNr4gB8pK4XKrEd7Rp3INAIPOIwGpc9jkrEodKcCMbPmWoZxl9OoABIHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8HjivB8P4B6xU/+5L94pwSFIXS23Wt/3GFwCjxIAHrs=; b=IoBBmjcCEh7cyE9wdc/YVV4rdyNekrEILB3cCRRIlaEunw8TO/6/LEPLoK1Sdgn1Xf/q8XGRsPpIZ81owBlwf+xHn11src/lKfGFqPC3IBOPKUK0QQLl4TDkBENrO8wpoRpsdrIn1m6jFhh9rrmlWxzBoFY0h67cr1Sy7nSxuoLQTUz4GVXB6GKpHIUzgZm7k/aL7qbFcd+0cNz4jzG3hnDJ/ZbwyhGdRnumnuuj0DKl7AGSa5k8XDNKT7ZNmdynkZOJqTJ5tdrOOmClnvtFw+LIn4o3foM7XXtnkXZQNe4FnlI9A9LG/1LLV3XKQQcnwYtbapXy1kjF99qyRPvPBg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8HjivB8P4B6xU/+5L94pwSFIXS23Wt/3GFwCjxIAHrs=; b=G2Iu5rsFyaxv/To20QRLtdvRZNOTzsa/TKxFf8gKfQ931kMDsf/Y4cmJnGo1LDe+4f/ugZabONLKhKbuj+KMGvazNq+6y/4ep1QJiCqiYKBgCUM33IqukojWHj7Fd1ms7FrFbrJ+Ch+yhDsakuQY4y7PALMLHWG7GEDUaM9/P9E= Received: from DM6PR00MB0816.namprd00.prod.outlook.com (2603:10b6:5:208::12) by DM6PR00MB0846.namprd00.prod.outlook.com (2603:10b6:5:1b5::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3233.0; Tue, 14 Jul 2020 15:53:20 +0000 Received: from DM6PR00MB0816.namprd00.prod.outlook.com ([fe80::f138:129:83ad:8071]) by DM6PR00MB0816.namprd00.prod.outlook.com ([fe80::f138:129:83ad:8071%8]) with mapi id 15.20.3231.000; Tue, 14 Jul 2020 15:53:20 +0000 From: Tim Cappalli To: Atul Tulshibagwale , Mike Jones CC: SecEvent , Dick Hardt Thread-Topic: [Id-event] Subject Principals and Subject Principal Administrative Groupings Thread-Index: AdZZdQCtdiOOYOmMSIKP7V+31IqM3AAecqAAAAIEbU8= Date: Tue, 14 Jul 2020 15:53:19 +0000 Message-ID: References: , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-14T15:53:05.3899414Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Privileged authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [100.0.202.188] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: dedc326f-0fd1-4836-51a6-08d8280e07f8 x-ms-traffictypediagnostic: DM6PR00MB0846: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: UHJ6ajTgypfp8hf80tDT1x0RmPa+LH4gcojbja5JMvQ5JHi4wEN1OAktkKDADOgtwIwxkA8MpzdV2iqMomU2y9F2M/VMmxBWZAI75voOHE3dEGjDffZ4daiP83Fr0zP+NzXlROqSNS7UwdEgCKrQZl9uo31BT+Elft7eXV/95Ov5lxxK1QQAJ6daYcEEWTjphcLwO9UNTS/zu4Awc6axERnizjyKRIzwNnK3UsAuQq3VZi0CHSnhtss1mpdThDFY4uq6xfo9Ta/Ho/EEXP2+Rpj2WU1FBK7rR8AMI6dz3lldjJhpn255jI+Fk+sKcN2Rr32U0z8uouhY3iJfjMZfZ6b3SBba/4rn+4D5y1hZkdOXKq6i8Hwo3llc+qwH5B5J9GaWLZ5djKDEcURuOz+8YruzYnZoUK/t7DjiI3WIthAOglLgCjxDHETJ1q/2cSqBgDJuCZ2k1bttne6u6OFnow== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR00MB0816.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(396003)(136003)(346002)(376002)(366004)(82960400001)(82950400001)(8936002)(7696005)(52536014)(71200400001)(54906003)(53546011)(6506007)(10290500003)(4326008)(55016002)(9686003)(6636002)(110136005)(8676002)(8990500004)(186003)(76236003)(83380400001)(478600001)(966005)(5660300002)(86362001)(166002)(2906002)(33656002)(66946007)(30864003)(76116006)(26005)(91956017)(66476007)(64756008)(66556008)(66446008)(316002)(99710200001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: 76qOOoMBpUJoAflZ2Y8Z8HmG1RUM/v6qggDM//yrc94EHVA3udf+U26khKfhZdsQKBs3aCVpeWT5Q/QehBp/MxoBFqZDIl7+RKIihbaCGTTKS12GGVgkqqlQvyjUrNDZfNUYOtuKbSOWQSLuMxWn8keNXd1aRZyFpgyQMHWqqyniboj61GOgid6HS0NIC3EvDaQ33mgvBUMFzYdVopTbKeiTol0Yj99o3AWJ7U2Q5l4N14O2yYZW38VeLvJ723ar1sZ/LChdTkIMZGJAY0HxiEQUwLfw1t/+rxx5GxCWkDjkfiPq/u/dN4K6BIx+01yGaiSB3j2PckZv6dA3zkTeYXNIMgJ34EmrO+nd8uNMHq43hnduBe+aAVE0sfyBVEW2+h6DWk47t45NdypZ0PN9bupgHc3+nrYJ19We6NHBsVQTsi1dXndicAhxV7/nNhhCyThJ9HYMHw9yOE2yHIjBYwC4ANL1NFiEKvyCNvy2qhOAOK1zocI1HXuiUH/drPyqJLgiRHU6ueyAMFr5Qae4l7b23xhLgfmGkae8lHHFePNfo+/73LYYKcdDTLHu0I45/r+5C972YI0B9uljIDKCnQ== Content-Type: multipart/alternative; boundary="_000_DM6PR00MB081613C5937AAE8494A2826E95610DM6PR00MB0816namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR00MB0816.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: dedc326f-0fd1-4836-51a6-08d8280e07f8 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2020 15:53:19.9988 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: /feNwdBriNtcZBKiuQ7s7iwhn/vyWw6yQvgYE+LpztEEh1TdJmQRux+OXwPV7yNTxsFxhBbBpG3Ulbb2cQ3tgw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0846 Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 15:53:28 -0000 --_000_DM6PR00MB081613C5937AAE8494A2826E95610DM6PR00MB0816namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBhZ3JlZSB0aGF0IFNQQUdzIHNob3VsZCBiZSBkZWZpbmVkIGluIHRoZSBzcGVjLg0KDQp0aW0N Cg0KRnJvbTogSWQtZXZlbnQgPGlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc+DQpEYXRlOiBUdWVz ZGF5LCBKdWx5IDE0LCAyMDIwIGF0IDEwOjU1DQpUbzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPg0KQ2M6IFNlY0V2ZW50IDxpZC1ldmVudEBpZXRmLm9yZz4sIERpY2sg SGFyZHQgPGRpY2suaGFyZHRAZ21haWwuY29tPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gU3Vi amVjdCBQcmluY2lwYWxzIGFuZCBTdWJqZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJhdGl2ZSBHcm91 cGluZ3MNCkEgZmV3IHBvaW50cyAvIHJlc3BvbnNlczoNCg0KICAxLiAgQWdyZWUgd2l0aCBNaWtl IHRoYXQgc3BhZ19pZCBzaG91bGQgbm90IGJlIGEgcmVxdWlyZWQgY2xhaW0gdW5sZXNzIGl0J3Mg YWN0dWFsbHkgcmVxdWlyZWQgZm9yIGV2ZXJ5IHN1YmplY3QuIFNvIGtlZXBpbmcgaXQgb3B0aW9u YWwgKGlmIHdlIGRlY2lkZSB0byBoYXZlIGl0IGF0IGFsbCkgaXMgdGhlIHJpZ2h0IHRoaW5nIHRv IGRvLg0KICAyLiAgSU1PIGl0IHdpbGwgYmUgZmFyIHNpbXBsZXIgZm9yIG11bHRpLXRlbmFudGVk IGhvc3RzIHRvIHVzZSBTUEFHcyByYXRoZXIgdGhhbiBtYW5hZ2UgbXVsdGlwbGUgZXZlbnQgc3Ry ZWFtcyAoaS5lLiBvbmUgcGVyIHRlbmFudCkNCiAgMy4gIEEgbXVsdGktdGVuYW50ZWQgYXJjaGl0 ZWN0dXJlIGlzIGluY3JlYXNpbmdseSB2ZXJ5IGNvbW1vbiwgc28gdGhpcyB3aWxsIGFwcGx5IHRv IGEgbGFyZ2UgbnVtYmVyIG9mIG9yZ2FuaXphdGlvbnMuDQogIDQuICBGb3Igc2luZ2xlIHRlbmFu dGVkIHRyYW5zbWl0dGVycywgdGhlIFNQQUcgaWQgbWF5IGJlIGluZmVycmVkIGJ5IHJlY2VpdmVy cy4gU2luZ2xlIHRlbmFudGVkIHJlY2VpdmVycyBtYXkgaWdub3JlIHRoZSBTUEFHIGlkcyBpbiB0 aGUgc3ViamVjdHMuIFNvIHByb2Nlc3NpbmcgU1BBR3MgaW4gaHlicmlkIHNpdHVhdGlvbnMgZG9l cyBub3QgYXBwZWFyIHRvIGJlIGN1bWJlcnNvbWUuDQogIDUuICBUaGUgdXNlIG9mIFNQQUdzIGlz IG5vdCBsaW1pdGVkIHRvIHRlbmFudC1sZXZlbCBpbmZvcm1hdGlvbiwgc2luY2UgaXQgbWF5IGJl IGFwcGxpZWQgdG8gT1VzIG9yIGdyb3Vwcw0KICA2LiAgSWYgd2UgYWdyZWUgdGhhdCBTUEFHIGlz IGEgIm1ldGEgY29uY2VwdCIgdGhhdCBhcHBsaWVzIGluIG1vc3Qgc2l0dWF0aW9ucywgdGhlbiBj YXB0dXJpbmcgaXQgaW4gdGhlIHNwZWMgaXMgcHJvYmFibHkgaW1wb3J0YW50LiBXaGF0IERpY2sg aXMgcHJvcG9zaW5nIGlzIGEgd2F5IHRvIGltcGxlbWVudCBTUEFHcyB3aXRob3V0IHNwZWNpZnlp bmcgdGhlbSBpbiBhIHN0YW5kYXJkLCBzbyBlYWNoIGVudGl0eSBpcyBmcmVlIHRvIGRlZmluZSBp dCB0aGUgd2F5IHRoZXkgd2FudC4gVGhpcyBhcHByb2FjaCBjYW4gY2F1c2UgaW5jb21wYXRpYmls aXRpZXMuDQogIDcuICBXaXRob3V0IFNQQUdzIGluIHRoZSBzcGVjLCBpZiBwZWVycyBuZWVkIHRv IHNlbmQgZXZlbnRzIGFib3V0IFNQQUdzLCB0aGVuIHRoZXkgbmVlZCB0byB1c2UgdGhlICJpc3Mt c3ViIiBjYXRjaCBhbGwgdG8gc2VuZCBldmVudHMgYWJvdXQgZW5hYmxpbmcgb3IgZGlzYWJsaW5n IGV2ZW50cyBhYm91dCBTUEFHcy4gU2luY2UgdGhpcyBpcyBub3Qgc3RhbmRhcmRpemVkLCBpdCBj b3VsZCBhbHNvIGNhdXNlIHByb3ByaWV0YXJ5IGFuZCBpbmNvbXBhdGlibGUgaW1wbGVtZW50YXRp b25zLg0KQXR1bA0KDQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCA1OjIzIFBNIE1pa2UgSm9uZXMg PE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPj4gd3JvdGU6DQpBcyBJIHNlZSBpdCwgdGhlIHVzZSBjYXNlcyB0aGF0IHJlcXVpcmUg YSBzcGFnX2lkIGNhbiB1c2UgdGhlbSB3aGVuIG5lY2Vzc2FyeSAodW5sZXNzIHRoZSB3b3JraW5n IGdyb3VwIGRlY2lkZXMgb24gYW5vdGhlciB3YXkgdG8gZG8gdGhpcykgYnV0IEkgY2VydGFpbmx5 IHdvdWxkIG9wcG9zZSByZXF1aXJpbmcgaXQgd2hlbiBpdOKAmXMgdW5uZWNlc3NhcnkuDQoNCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBN aWtlDQoNCkZyb206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpp ZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIERpY2sgSGFyZHQNClNlbnQ6 IE1vbmRheSwgSnVseSAxMywgMjAyMCA1OjEzIFBNDQpUbzogQXR1bCBUdWxzaGliYWd3YWxlIDxh dHVsdHVsc2hpQGdvb2dsZS5jb208bWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbT4+DQpDYzog U2VjRXZlbnQgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpT dWJqZWN0OiBSZTogW0lkLWV2ZW50XSBTdWJqZWN0IFByaW5jaXBhbHMgYW5kIFN1YmplY3QgUHJp bmNpcGFsIEFkbWluaXN0cmF0aXZlIEdyb3VwaW5ncw0KDQpXb3VsZCBkaWZmZXJlbnQgVVJMcyBm b3IgZWFjaCByZWxhdGlvbnNoaXAgbm90IHNvbHZlIHlvdXIgaXNzdWUgb2YgbWFpbnRhaW5pbmcg c2VjcmV0cyBmb3IgZWFjaCBTUEFHPyBGb3IgZXhhbXBsZToNCg0KaHR0cHM6L2V4YW1wbGUuY29t L3NlY2V2ZW50L1NQQUdfSURfMTxodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91 dGxvb2suY29tLz91cmw9aHR0cCUzQSUyRiUyRmV4YW1wbGUuY29tJTJGc2VjZXZlbnQlMkZTUEFH X0lEXzEmZGF0YT0wMiU3QzAxJTdDdGltLmNhcHBhbGxpJTQwbWljcm9zb2Z0LmNvbSU3QzljY2Q4 ZDJiZTI4MTRhYjg4MGUyMDhkODI4MDVmYTExJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAx MWRiNDclN0MxJTdDMCU3QzYzNzMwMzM1MzQzMTA3NTA2MyZzZGF0YT1ESkwxQ0ZRWHhBbEglMkZF Q3VvZlgyNmpIbE1sJTJGM1paa3pzeDhDcGFXcVhkSSUzRCZyZXNlcnZlZD0wPg0KDQpodHRwczov ZXhhbXBsZS5jb20vc2VjZXZlbnQvU1BBR19JRF8yPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnBy b3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwJTNBJTJGJTJGZXhhbXBsZS5jb20lMkZzZWNl dmVudCUyRlNQQUdfSURfMiZkYXRhPTAyJTdDMDElN0N0aW0uY2FwcGFsbGklNDBtaWNyb3NvZnQu Y29tJTdDOWNjZDhkMmJlMjgxNGFiODgwZTIwOGQ4MjgwNWZhMTElN0M3MmY5ODhiZjg2ZjE0MWFm OTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MzAzMzUzNDMxMDc1MDYzJnNkYXRhPXR2ZlNS eDFhd3VkbzZ6JTJCM3dIZFFiaHNza0tUcDlnSHhwJTJCdDAxUFZLQXhjJTNEJnJlc2VydmVkPTA+ DQoNCmh0dHBzOi9leGFtcGxlLmNvbS9zZWNldmVudC9TUEFHX0lEXzM8aHR0cHM6Ly9uYW0wNi5z YWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHAlM0ElMkYlMkZleGFtcGxl LmNvbSUyRnNlY2V2ZW50JTJGU1BBR19JRF8zJmRhdGE9MDIlN0MwMSU3Q3RpbS5jYXBwYWxsaSU0 MG1pY3Jvc29mdC5jb20lN0M5Y2NkOGQyYmUyODE0YWI4ODBlMjA4ZDgyODA1ZmExMSU3QzcyZjk4 OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzczMDMzNTM0MzEwODUwNTcm c2RhdGE9QWx4U0tuU3YlMkJVeU9tWjAzUGdaRiUyQkhMZnBSbmFkY2RMTUpDeXJUa3lhWDAlM0Qm cmVzZXJ2ZWQ9MD4NCg0KVGhlbiB0aGUgY3JlZGVudGlhbCBpcyBpbmRlcGVuZGVudCBvZiB0aGUg U1BBRywgYnV0IHdlIGFyZSBub3QgaW5qZWN0aW5nIGFuIGlkZW50aWZpZXIgKHNwYWdfaWQpIHRo YXQgaXMgb25seSByZWxldmFudCB0byBvcmdzIHRoYXQgd2FudCB0byB1c2UgdGhlIHNhbWUgY3Jl ZGVudGlhbHMgYWNyb3NzIFNQQUcgcmVsYXRpb25zaGlwcy4NCg0KDQoNCk9uIE1vbiwgSnVsIDEz LCAyMDIwIGF0IDU6MDggUE0gQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpQGdvb2dsZS5j b208bWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KSSBhbSBPSyB3aXRoIG1h a2luZyB0aGUgc3BhZ19pZCBhIHJlcXVpcmVkIGNsYWltIGluIGV2ZXJ5IHN1YmplY3QgaWRlbnRp Zmllci4gRm9yIHNpbmdsZSB0ZW5hbnRlZCB0cmFuc21pdHRlcnMsIGl0IHdvdWxkIGJlIGEgY29u c3RhbnQgdmFsdWUgZm9yIGFsbCBldmVudHMgdGhleSBnZW5lcmF0ZS4NCg0KT24gTW9uLCBKdWwg MTMsIDIwMjAgYXQgNDowMSBQTSBEaWNrIEhhcmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNvbTxtYWls dG86ZGljay5oYXJkdEBnbWFpbC5jb20+PiB3cm90ZToNClNvIHRoZSByZWNlaXZlciBpcyB1c2lu ZyBhdXRoZW50aWNhdGlvbiBzb21ldGltZXMgdG8gZGV0ZXJtaW5lIFNQQUcsIGFuZCBub3QgYXQg b3RoZXIgdGltZXM/DQoNCkknbSBkaWdnaW5nIGludG8gdGhpcyBhcyBJIGhhZCBhbHdheXMgdGhv dWdodCBvZiB0aGUgZXZlbnQgYmVpbmcgYmV0d2VlbiB0d28gcGFydGllcywgd2hlcmUgdGhleSBh cmUgaWRlbnRpZmllZCBieSB0aGUgZW5kcG9pbnQgYW5kL29yIHRoZSBjcmVkZW50aWFscy4NCg0K QWRkaW5nIGEgcmVsYXRpb25zaGlwIGlkZW50aWZpZXIgc2VlbXMgdG8gYmUgc29sdmluZyB0aGUg cHJvYmxlbSBhdCB0aGUgd3JvbmcgbGF5ZXIsIHVubGVzcyBpdCBpcyBpbiBhbGwgZXZlbnRzLg0K DQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDM6NTQgUE0gQXR1bCBUdWxzaGliYWd3YWxlIDxh dHVsdHVsc2hpQGdvb2dsZS5jb208bWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbT4+IHdyb3Rl Og0KU29ycnkgZm9yIHRoZSB0ZXJzZSBtZXNzYWdlLg0KDQpJZiBhIHNpbmdsZSB0ZW5hbnQgdHJh bnNtaXR0ZXIgaXMgdHJ1c3RlZCBieSBhIG11bHRpLXRlbmFudGVkIHJlY2VpdmVyIGZvciBhIHNw ZWNpZmljIHRlbmFudCwgdGhlbiB0aGUgU1BBRy1pZCBuZWVkIG5vdCBiZSBpbmNsdWRlZCBpZiB0 aGUgc3ViamVjdCBpcyB1bmlxdWUgYXQgdGhlIHRlbmFudCBsZXZlbCwgYmVjYXVzZSB0aGUgcmVj ZWl2ZXIgd2lsbCBhdXRvbWF0aWNhbGx5IGlkZW50aWZ5IFNQQUcgdGhhdCB0aGUgc3ViamVjdCBi ZWxvbmdzIHRvIG9uIGl0cyBlbmQgKGJhc2VkIG9uIHRoZSBhdXRoZW50aWNhdGlvbikuDQoNCg0K DQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCAzOjM3IFBNIERpY2sgSGFyZHQgPGRpY2suaGFyZHRA Z21haWwuY29tPG1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+IHdyb3RlOg0KV2hpY2ggcGFy dCBpcyBub3QgcmVxdWlyZWQ/DQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDM6MzMgUE0gQXR1 bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpQGdvb2dsZS5jb208bWFpbHRvOmF0dWx0dWxzaGlA Z29vZ2xlLmNvbT4+IHdyb3RlOg0KTm90IHJlcXVpcmVkLCBzaW5jZSB0aGUgY2xhaW0gaXMgb3B0 aW9uYWwuDQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDM6MjUgUE0gRGljayBIYXJkdCA8ZGlj ay5oYXJkdEBnbWFpbC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tPj4gd3JvdGU6DQpX b3VsZCBhIHRyYW5zbWl0dGVyIHRoYXQgaXMgb25seSBpbiBvbmUgU1BBRyAoYSBzaW5nbGUgdGVu YW50IHN5c3RlbSkgaGF2ZSB0byBpbmNsdWRlIGl0cyBTUEFHIGlkIGluIGV2ZW50cyBzZW50IHRv IGEgcmVjZWl2ZXIgdGhhdCBhY2NlcHRzIGV2ZW50cyBmcm9tIG11bHRpcGxlIFNQQUdzPyBCdXQg aXQgd291bGQgbm90IGluY2x1ZGUgaXQgaW4gc2VuZGluZyBldmVudHMgdG8gb3RoZXIgcmVjZWl2 ZXJzIHRoYXQgaGF2ZSBzZXBhcmF0ZSBjcmVkZW50aWFscyBmb3IgZWFjaCByZWxhdGlvbnNoaXA/ DQoNCg0KDQrhkKcNCg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMzowNSBQTSBBdHVsIFR1bHNo aWJhZ3dhbGUgPGF0dWx0dWxzaGlAZ29vZ2xlLmNvbTxtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUu Y29tPj4gd3JvdGU6DQpUaGF0IGNvdWxkIGJlIHRydWUgYnV0IHRoZXJlIGFyZSBhIGZldyB3YXlz IGluIHdoaWNoIGl0IGNhbiBiZSBhdm9pZGVkOg0KDQogIDEuICBUaGUgcGVlcnMgbGV2ZXJhZ2Ug c29tZSBoaWdoZXItbGV2ZWwgdHJ1c3QgdG8gYWNjZXB0IC8gZGVjbGluZSBldmVudHMgcmVsYXRp bmcgdG8gbG93ZXIgbGV2ZWwgU1BBR3MuIEZvciBleGFtcGxlLCBpZiB0cnVzdCBpcyBlc3RhYmxp c2hlZCBhdCBhIHRlbmFudCBsZXZlbCwgdGhlbiBhbiBPVSBsZXZlbCBTUEFHIG5lZWQgbm90IGhh dmUgaXRzIG93biBhdXRob3JpemF0aW9uLg0KICAyLiAgVGhlIHNlY3JldCByZXF1aXJlZCBmb3Ig ZXN0YWJsaXNoaW5nIHRoZSBhdXRob3JpemF0aW9uIG9mIGEgU1BBRyBtYXkgYmUgdGVtcG9yYXJ5 LiBGb3IgZXhhbXBsZToNCg0KICAgICAqICAgQW4gYWRtaW5pc3RyYXRvciBzaWducyBpbiB0byB0 aGVpciB0ZW5hbnQgaW4gdGhlIHRyYW5zbWl0dGVyJ3MgYWRtaW5pc3RyYXRvciBjb25zb2xlDQog ICAgICogICBUaGUgYWRtaW4gb2J0YWlucyBhIHRlbXBvcmFyeSBhdXRob3JpemF0aW9uIChvbmUt dGltZSBjb2RlKQ0KICAgICAqICAgVGhlIGFkbWluIHNpZ25zIGluIHRvIHRoZWlyIHRlbmFudCBp biB0aGUgcmVjZWl2ZXIncyBhZG1pbmlzdHJhdGlvbiBjb25zb2xlIGFuZCBwYXN0ZXMgaW4gdGhl IG9uZS10aW1lIGNvZGUNCiAgICAgKiAgIFRoZSByZWNlaXZlciBzZW5kcyBhIHJlcXVlc3QgdG8g ZW5hYmxlIHRoZSBzdHJlYW0gZm9yIHRoZSBzcGVjaWZpZWQgU1BBRyB3aXRoIHRoYXQgb25lLXRp bWUgYXV0aG9yaXphdGlvbi4NCkluIHRoZSBmaXJzdCBjYXNlLCB0aGVyZSBhcmUgbm8gYWRkaXRp b25hbCBzZWNyZXRzIHJlcXVpcmVkLiBJbiB0aGUgc2Vjb25kIGNhc2UsIHRoZSBzZWNyZXQgaXMg dGVtcG9yYXJ5Lg0KDQoNCg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMjozNCBQTSBEaWNrIEhh cmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNvbTxtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20+PiB3 cm90ZToNCkkgc2VlIHRoZSBTUEFHIGxldHMgdGhlIHRyYW5zbWl0dGVyIGFuZCByZWNlaXZlciBw cm92aWRlIGNvbnRleHQsIGFzIHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgbWF5IGJlIHRoZSBzYW1l IGFjcm9zcyBTUEFHcy4NCg0KTm93IEknbSB0cnlpbmcgdG8gdW5kZXJzdGFuZCBob3cgdGhlIHRy YW5zbWl0dGVyIGF1dGhlbnRpY2F0ZXMgdG8gdGhlIHJlY2VpdmVyIGlmIGl0IGRvZXMgbm90IGhh dmUgaXQncyBvd24gc2VjcmV0IChhc3N1bWluZyB0aGF0IGF1dGhlbnRpY2F0aW9uIG1vZGVsKSAt LSBJRSwgaG93IGRvZXMgdGhlIHJlY2VpdmVyIGtub3cgdGhlIHRyYW5zbWl0dGVyIGlzIGF1dGhv cml6ZWQgZm9yIHRoYXQgU1BBRz8NCg0KDQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCAyOjA4IFBN IEF0dWwgVHVsc2hpYmFnd2FsZSA8YXR1bHR1bHNoaUBnb29nbGUuY29tPG1haWx0bzphdHVsdHVs c2hpQGdvb2dsZS5jb20+PiB3cm90ZToNCkRpY2ssIHlvdXIgdW5kZXJzdGFuZGluZyBpcyBjb3Jy ZWN0Lg0KDQpUbyBjbGFyaWZ5IHRoZSBwcm9wb3NhbCBoZXJlLCBIZXJlJ3MgdGhlIHRleHQgSSdt IHByb3Bvc2luZyB0byBiZSBhZGRlZDoNCg0KMy4gIFN1YmplY3QgUHJpbmNpcGFscw0KDQogICBT dWJqZWN0IFByaW5jaXBhbHMgYXJlIHRoZSBtYW5hZ2VtZW50IGVudGl0aWVzIGFzc29jaWF0ZWQg d2l0aA0KICAgU3ViamVjdHMuICBUaGVzZSBtYXkgYmUgaHVtYW4gb3Igcm9ib3RpYyBwcmluY2lw YWxzIG9yIGRldmljZXMgb3INCiAgIG90aGVyIGVudGl0aWVzIHRoYXQgYXJlIG1hbmFnZWQgYnkg dHJhbnNtaXR0ZXJzIGFuZCByZWNlaXZlcnMuICBGb3INCiAgIGV4YW1wbGUsIHRoZSBzYW1lIFN1 YmplY3QgUHJpbmNpcGFsIG1heSBiZSByZWZlcnJlZCB0byBieSBhbiBlbWFpbA0KICAgYWRkcmVz cyBvciBhIHBob25lIG51bWJlci4gIEEgdHJhbnNtaXR0ZXIgb3IgcmVjZWl2ZXIgd2lsbCB0eXBp Y2FsbHkNCiAgIG1hbmFnZSBzdWJqZWN0IHByaW5jaXBhbHMgYW5kIG9yZ2FuaXplIHRoZW0gaW50 byBzdWItZ3JvdXBpbmdzIHN1Y2gNCiAgIGFzIHRlbmFudHMsIGdyb3Vwcywgb3JnYW5pemF0aW9u YWwgdW5pdHMsIGV0Yy4NCg0KICAgU3ViamVjdHMgYXJlIGlkZW50aWZpZWQgYnkgU3ViamVjdCBJ ZGVudGlmaWVycyBkZWZpbmVkIGJlbG93Lg0KDQozLjEuICBTUEFHcw0KDQogICBTdWJqZWN0IFBy aW5jaXBhbHMgTUFZIGJlIGdyb3VwZWQgZm9yIGFkbWluaXN0cmF0aXZlIHB1cnBvc2VzIGludG8N CiAgICJTdWJqZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJhdGl2ZSBHcm91cGluZ3MiIG9yIFNQQUdz LiAgRm9yIGV4YW1wbGUsDQogICBhbGwgdXNlcnMgYmVsb25naW5nIHRvIG9uZSBjdXN0b21lciBv ZiBhICJtdWx0aS10ZW5hbnRlZCIgVHJhbnNtaXR0ZXINCiAgIG1heSBiZSBpbiBvbmUgU1BBRy4g IEFsdGVybmF0aXZlbHksIGFuIE9yZ2FuaXphdGlvbmFsIFVuaXQgb3IgYSBncm91cA0KICAgb2Yg U3ViamVjdHMgd2l0aGluIGEgY3VzdG9tZXIgb2YgYSBUcmFuc21pdHRlciAod2hldGhlciBtdWx0 aS0NCiAgIHRlbmFudGVkIG9yIG5vdCkgbWF5IGJlIG9uZSBTUEFHLiAgU1BBR3MgbWF5IGhhdmUg b3ZlcmxhcHBpbmcgc2V0cyBvZg0KICAgU3ViamVjdHMuDQoNCiAgIEEgU1BBRyBNQVkgYmUgdGhl IFN1YmplY3Qgb2YgY2VydGFpbiBzdHJlYW0gdXBkYXRlIGV2ZW50cyBkZWZpbmVkDQogICBsYXRl ciBpbiB0aGlzIHNwZWMsIGhlbmNlIGlzIGRlZmluZWQgYXMgYSBTdWJqZWN0IFR5cGUgb2YgaXRz IG93bg0KICAgYmVsb3cuLiAgQSBTUEFHIGlkZW50aWZpZXIgTUFZIGJlIGluY2x1ZGVkIGluIG90 aGVyIHN1YmplY3QgdHlwZXMgdG8NCiAgIGRpc2FtYmlndWF0ZSB0aGUgc3ViamVjdC4NCg0KICAg QSBTUEFHIHN1YmplY3QgaWRlbnRpZmllciBpcyBhZ3JlZWQgdG8gb2ZmbGluZSBiZXR3ZWVuIGEg dHJhbnNtaXR0ZXINCiAgIGFuZCBhIHJlY2VpdmVyLg0KVGhlIGJlbmVmaXRzIG9mIGRvaW5nIHRo aXMgYXJlOg0KDQogIDEuICBNdWx0aS10ZW5hbnRlZCBob3N0cyBkbyBub3QgbmVlZCB0byBtYWlu dGFpbiBzZWNyZXRzIHBlciB0ZW5hbnQgYW5kIHBlciB0cmFuc21pdHRlciB0ZW5hbnQgaWYgZWFj aCB0ZW5hbnQgaGFzIHRvIGJlIGFuIGV2ZW50IHRyYW5zbWl0dGVyIGFuZCBhbiBldmVudCByZWNl aXZlciBvZiBpdHMgb3duLg0KICAyLiAgQW4gZXZlbnQgc3RyZWFtIG1heSBiZSBlc3RhYmxpc2hl ZCBiZXR3ZWVuIHR3byBtdWx0aS10ZW5hbnRlZCBob3N0cywgYW5kIHNvIGRvZXMgbm90IG5lZWQg dG8gYmUgbWFuYWdlZCBhdCBhIHBlci10ZW5hbnQgbGV2ZWwNCiAgMy4gIFRoZSBzYW1lIHN1Ympl Y3Qgb3Igc3ViamVjdCBwcmluY2lwYWwgbWF5IGJlIGEgcGFydCBvZiBtdWx0aXBsZSBTUEFHcywg YW5kIGlkZW50aWZ5aW5nIHRoZSBTUEFHIHRoYXQgYW4gZXZlbnQgcmVsYXRlcyB0byBjYW4gYmUg YWNoaWV2ZWQgaWYgdGhlIHN0YW5kYXJkIGFsbG93cyBmb3IgdGhlIFNQQUdzIHRvIGJlIGlkZW50 aWZpZWQuDQoNCg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMTE6MzIgQU0gRGljayBIYXJkdCA8 ZGljay5oYXJkdEBnbWFpbC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tPj4gd3JvdGU6 DQpUbyBjbGFyaWZ5LCB5b3VyIHByb3Bvc2FsIGlzIGRyaXZlbiBieSB0aGUgaW1wbGVtZW50YXRp b24gYnVyZGVuIG9mIG1haW50YWluaW5nIHNlcGFyYXRlIHNlY3JldHMgLyBzdHJlYW1zIGJldHdl ZW4gYSB0cmFuc21pdHRlciBhbmQgcmVjZWl2ZXI/DQrhkKcNCg0KT24gTW9uLCBKdWwgMTMsIDIw MjAgYXQgOTowMSBBTSBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0dWxzaGk9NDBnb29nbGUuY29t QGRtYXJjLmlldGYub3JnPG1haWx0bzo0MGdvb2dsZS5jb21AZG1hcmMuLmlldGYub3JnPj4gd3Jv dGU6DQpIaSBhbGwsDQpIZXJlJ3MgYSBxdWljayBiYWNrZ3JvdW5kIGZvciB0aGUgcHJvcG9zYWw8 aHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBz JTNBJTJGJTJGZ2l0aHViLmNvbSUyRnJpY2hhbm5hJTJGc2VjZXZlbnQlMkZwdWxsJTJGMSZkYXRh PTAyJTdDMDElN0N0aW0uY2FwcGFsbGklNDBtaWNyb3NvZnQuY29tJTdDOWNjZDhkMmJlMjgxNGFi ODgwZTIwOGQ4MjgwNWZhMTElN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzEl N0MwJTdDNjM3MzAzMzUzNDMxMDg1MDU3JnNkYXRhPThrWiUyRkU2Njdtelc5Tm9IdVdDMFVqSWNp ViUyQkVGRGpYWFBRY2NWb29mU1NrJTNEJnJlc2VydmVkPTA+IGZvciBpbmNsdWRpbmcgU3ViamVj dCBQcmluY2lwYWxzIGFuZCBTdWJqZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJhdGl2ZSBHcm91cGlu Z3Mgb3IgU1BBR3MgaW4gdGhlIFN1YmplY3QgSWRlbnRpZmllcnMgc3BlYy4NCg0KVXNlIG9mIFN1 YmplY3QgSWRlbnRpZmllcnMgaW4gU2hhcmVkIFNpZ25hbHMgYW5kIEV2ZW50czoNClRoZSBTaGFy ZWQgU2lnbmFscyBhbmQgRXZlbnRzIChTU0UpIHByb2ZpbGUgb2YgU0VUcyBzcGVjaWZpZXMgdGhh dCB0cmFuc21pdHRlcnMgYW5kIHJlY2VpdmVycyBzZW5kIGFuZCByZWNlaXZlIFNFVHMgdGhhdCBj b250YWluIFN1YmplY3QgSWRlbnRpZmllcnMuIFRoZXNlIHN1YmplY3QgaWRlbnRpZmllcnMgaGF2 ZSB0aGUgZm9ybWF0IHRoYXQgaXMgbm93IGJlaW5nIGRpc2N1c3NlZCBhcyBhIHNlcGFyYXRlIHNw ZWNpZmljYXRpb24gaGVyZS4NCg0KVHJhbnNtaXR0ZXJzIGFuZCBSZWNlaXZlcnMgaW4gU1NFDQpU aGUgU1NFIHByb2ZpbGUgZGVmaW5lcyB0cmFuc21pdHRlcnMgYW5kIHJlY2VpdmVycyBhcyBob3N0 cyB0aGF0IG1hbmFnZSBzdHJlYW1zIGJldHdlZW4gcGVlcnMuIFRoZSByZWNlaXZlciBhdXRoZW50 aWNhdGVzIHRvIHRoZSB0cmFuc21pdHRlciB1c2luZyBPQXV0aCwgcmVxdWlyaW5nIHRoZSB1c2Ug b2YgYSBzZWNyZXQgcGVyIHJlY2VpdmVyLiBJbiBhIG11bHRpLXRlbmFudGVkIGhvc3QgdGhhdCBo YW5kbGVzIGh1bmRyZWRzIG9mIHRob3VzYW5kcyBvciBtaWxsaW9ucyBvZiBpbmRlcGVuZGVudCB0 ZW5hbnRzLCBtYWludGFpbmluZyBzdWNoIGEgc2VjcmV0IHBlciBpbnN0YW5jZSBvZiBhIHJlY2Vp dmVyIGlzIGN1bWJlcnNvbWUuIEZ1cnRoZXJtb3JlLCBzaW5jZSBhIHRyYW5zbWl0dGVyIGFuZCBh IHJlY2VpdmVyIGhhcyB0byBtYWludGFpbiBhIHN0cmVhbSBwZXIgcGFpciwgY3JlYXRpbmcgc3Vj aCBwZXItdGVuYW50IHN0cmVhbXMgY2FuIGFkZCBzaWduaWZpY2FudCBpbXBsZW1lbnRhdGlvbiBv dmVyaGVhZC4NCg0KU1BBR3MNClRoZXJlZm9yZSwgd2UgbmVlZCBhIG5vdGlvbiBvZiBhIGdyb3Vw aW5nIG9mIHN1YmplY3RzIHdpdGhpbiB0aGUgc2FtZSB0cmFuc21pdHRlciBhbmQgcmVjZWl2ZXIg dG8gZGlzdGluZ3Vpc2ggYmV0d2VlbiB2YXJpb3VzIGFkbWluaXN0cmF0aXZlIGdyb3VwaW5ncyB0 aGF0IGV4aXN0IHdpdGhpbiBhIGhvc3QuIFRoZXNlIGdyb3VwaW5ncyBjb3VsZCBpbmNsdWRlIHRl bmFudHMsIG9yZ2FuaXphdGlvbmFsIHVuaXRzIG9yIHVzZXIgZ3JvdXBzLi4gVGhpcyBncm91cGlu ZyBpcyBjYXB0dXJlZCBpbiB0aGUgbm90aW9uIG9mIGEgU1BBRy4gVGhlIHVuaXF1ZW5lc3Mgb2Yg YSB1c2VyIGlkZW50aWZpZXIgKHN1YmplY3QgaWRlbnRpZmllcikgbWF5IGFsc28gYmUgbGltaXRl ZCB0byBhIFNQQUcuIEZvciBleGFtcGxlLCBpZiBhIHJhbmRvbSB1bmlxdWUgSUQgcmVwcmVzZW50 cyBhIHVzZXIsIHRoZW4gdGhhdCBJRCBtYXkgYmUgdW5pcXVlIHdpdGhpbiBhIFNQQUcgYW5kIG5v dCB1bml2ZXJzYWxseSBhY3Jvc3MgYSB0cmFuc21pdHRlciBvciByZWNlaXZlci4gVGhpcyBpcyBi ZWNhdXNlIGVhY2ggdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyIG1heSBoYXZlIG11bHRpcGxlIGNv bm5lY3Rpb25zIHRvIG90aGVyIHRyYW5zbWl0dGVycyBhbmQgcmVjZWl2ZXJzLCBhbmQgZW5zdXJp bmcgdW5pcXVlbmVzcyBhY3Jvc3MgYWxsIHN1Y2ggcGVlcnMgaXMgcHJvYmFibHkgYW4gaW50cmFj dGFibGUgcHJvYmxlbS4NCg0KU3ViamVjdCBQcmluY2lwYWxzDQpXaGlsZSB3aGF0IGlzIHJlcHJl c2VudGVkIHdpdGhpbiBhIHN1YmplY3QgaWRlbnRpZmllciBtYXkgYmUgb25seSBhbiBhc3BlY3Qg b2YgdGhlIG1hbmFnZW1lbnQgZW50aXR5LCB0aGUgYWRtaW5pc3RyYXRpdmUgZ3JvdXBpbmcgaXMg YWJvdXQgdGhlIG1hbmFnZW1lbnQgZW50aXR5IGl0c2VsZi4gVGhpcyBjb3VsZCBiZSB0aGUgdXNl ciwgZGV2aWNlIG9yIG90aGVyIHByaW5jaXBhbCB0aGF0IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIg cmVwcmVzZW50cy4gVGhlcmVmb3JlLCBhbiBhYnN0cmFjdCBub3Rpb24gb2YgYSBTdWJqZWN0IFBy aW5jaXBhbCBpcyBhbHNvIHJlcXVpcmVkIGluIG9yZGVyIHNwZWNpZnkgd2hhdCB0aGUgZ3JvdXBp bmcgd2l0aGluIGEgU1BBRyBpcyBhYm91dC4NCg0KVGhlIGFib3ZlIGlzIGNhcHR1cmVkIGluIHRo ZSAiU3ViamVjdCBQcmluY2lwYWwiIGFuZCAiU1BBRyIgc2VjdGlvbnMgd2l0aGluIHRoZSBwcm9w b3NlZCBQUjxodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91 cmw9aHR0cHMlM0ElMkYlMkZnaXRodWIuY29tJTJGcmljaGFubmElMkZzZWNldmVudCUyRnB1bGwl MkYxJmRhdGE9MDIlN0MwMSU3Q3RpbS5jYXBwYWxsaSU0MG1pY3Jvc29mdC5jb20lN0M5Y2NkOGQy YmUyODE0YWI4ODBlMjA4ZDgyODA1ZmExMSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFk YjQ3JTdDMSU3QzAlN0M2MzczMDMzNTM0MzEwOTUwNTEmc2RhdGE9cGo0V0JIbU04VnFpelF5ZFZu bXNHWnRoczZBSjlJZ0pUZ25PcG5NRGUzVSUzRCZyZXNlcnZlZD0wPi4NCg0KVGhhbmtzLA0KQXR1 bA0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQt ZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0 dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmlkLWV2ZW50JmRhdGE9 MDIlN0MwMSU3Q3RpbS5jYXBwYWxsaSU0MG1pY3Jvc29mdC5jb20lN0M5Y2NkOGQyYmUyODE0YWI4 ODBlMjA4ZDgyODA1ZmExMSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3 QzAlN0M2MzczMDMzNTM0MzEwOTUwNTEmc2RhdGE9NGxueVFVY0dMZm9Na3R1TmhYRENuJTJCNDNL ZyUyRmpoeUlhTmlINk9sTzdyMlElM0QmcmVzZXJ2ZWQ9MD4NCg== --_000_DM6PR00MB081613C5937AAE8494A2826E95610DM6PR00MB0816namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIg MTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IlRpbWVzIE5l dyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAyIDIgMiAyIDQ7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpHYWR1Z2k7DQoJcGFub3NlLTE6MiAxMSA1IDIgNCAy IDQgMiAyIDM7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29O b3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0K CWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQXJpYWwiLHNhbnMtc2VyaWY7DQoJY29sb3I6 d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25s eTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWlu IDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0 aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlz dCBsMA0KCXttc28tbGlzdC1pZDoyMjQ1OTk2Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxMDMz MjgyNzA7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6MzkwNDYzOTY0Ow0KCW1zby1saXN0LXRl bXBsYXRlLWlkczoyNTc0ODg5ODY7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFy dC1hdDoyOw0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDINCgl7bXNvLWxpc3Qt aWQ6NTU1MDQ4NDY3Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMjA1ODA2ODIzMDt9DQpAbGlz dCBsMw0KCXttc28tbGlzdC1pZDoxOTY4Mjc1MjIwOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczot NDA1MTM3MTQwO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0 b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRl ZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8 bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48 IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGlu az0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp ZiI+SSBhZ3JlZSB0aGF0IFNQQUdzIHNob3VsZCBiZSBkZWZpbmVkIGluIHRoZSBzcGVjLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZiI+dGltPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMu MHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90 dG9tOjEyLjBwdCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2si PkZyb206DQo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJs YWNrIj5JZC1ldmVudCAmbHQ7aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyZndDs8YnI+DQo8Yj5E YXRlOiA8L2I+VHVlc2RheSwgSnVseSAxNCwgMjAyMCBhdCAxMDo1NTxicj4NCjxiPlRvOiA8L2I+ TWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0Ozxicj4NCjxiPkNj OiA8L2I+U2VjRXZlbnQgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0OywgRGljayBIYXJkdCAmbHQ7 ZGljay5oYXJkdEBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbSWQtZXZl bnRdIFN1YmplY3QgUHJpbmNpcGFscyBhbmQgU3ViamVjdCBQcmluY2lwYWwgQWRtaW5pc3RyYXRp dmUgR3JvdXBpbmdzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+QSBmZXcgcG9pbnRzIC8gcmVzcG9uc2VzOjxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxvbCBzdGFydD0iMSIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21z by1saXN0OmwwIGxldmVsMSBsZm8xIj4NCkFncmVlIHdpdGggTWlrZSB0aGF0IHNwYWdfaWQgc2hv dWxkIG5vdCBiZSBhIHJlcXVpcmVkJm5ic3A7Y2xhaW0gdW5sZXNzIGl0J3MgYWN0dWFsbHkgcmVx dWlyZWQgZm9yIGV2ZXJ5IHN1YmplY3QuIFNvIGtlZXBpbmcgaXQgb3B0aW9uYWwgKGlmIHdlIGRl Y2lkZSB0byBoYXZlIGl0IGF0IGFsbCkgaXMgdGhlIHJpZ2h0IHRoaW5nIHRvIGRvLjxvOnA+PC9v OnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj4N CklNTyBpdCB3aWxsIGJlIGZhciBzaW1wbGVyIGZvciBtdWx0aS10ZW5hbnRlZCBob3N0cyB0byB1 c2UgU1BBR3MgcmF0aGVyIHRoYW4gbWFuYWdlIG11bHRpcGxlIGV2ZW50IHN0cmVhbXMgKGkuZS4g b25lIHBlciB0ZW5hbnQpPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNv LWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KQSBtdWx0aS10ZW5hbnRlZCBhcmNoaXRlY3R1cmUgaXMg aW5jcmVhc2luZ2x5IHZlcnkgY29tbW9uLCBzbyB0aGlzIHdpbGwgYXBwbHkgdG8gYSBsYXJnZSBu dW1iZXIgb2Ygb3JnYW5pemF0aW9ucy48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQpGb3Igc2luZ2xlIHRlbmFudGVkIHRyYW5z bWl0dGVycywgdGhlIFNQQUcgaWQgbWF5IGJlIGluZmVycmVkIGJ5IHJlY2VpdmVycy4gU2luZ2xl IHRlbmFudGVkIHJlY2VpdmVycyBtYXkgaWdub3JlIHRoZSBTUEFHIGlkcyBpbiB0aGUgc3ViamVj dHMuIFNvIHByb2Nlc3NpbmcgU1BBR3MgaW4gaHlicmlkIHNpdHVhdGlvbnMgZG9lcyBub3QgYXBw ZWFyIHRvIGJlIGN1bWJlcnNvbWUuPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KVGhlIHVzZSBvZiBTUEFHcyBpcyBub3QgbGlt aXRlZCB0byB0ZW5hbnQtbGV2ZWwgaW5mb3JtYXRpb24sIHNpbmNlIGl0IG1heSBiZSBhcHBsaWVk IHRvIE9VcyBvciBncm91cHM8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt c28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQpJZiB3ZSBhZ3JlZSB0aGF0IFNQQUcgaXMgYSAmcXVv dDttZXRhIGNvbmNlcHQmcXVvdDsgdGhhdCBhcHBsaWVzIGluIG1vc3Qgc2l0dWF0aW9ucywgdGhl biBjYXB0dXJpbmcgaXQgaW4gdGhlIHNwZWMgaXMgcHJvYmFibHkgaW1wb3J0YW50LiBXaGF0IERp Y2sgaXMgcHJvcG9zaW5nIGlzIGEgd2F5IHRvIGltcGxlbWVudCBTUEFHcyB3aXRob3V0IHNwZWNp ZnlpbmcgdGhlbSBpbiBhIHN0YW5kYXJkLCBzbyBlYWNoIGVudGl0eSBpcyBmcmVlIHRvIGRlZmlu ZSBpdCB0aGUNCiB3YXkgdGhleSB3YW50LiBUaGlzIGFwcHJvYWNoIGNhbiBjYXVzZSBpbmNvbXBh dGliaWxpdGllcy48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlz dDpsMCBsZXZlbDEgbGZvMSI+DQpXaXRob3V0IFNQQUdzIGluIHRoZSBzcGVjLCBpZiBwZWVycyBu ZWVkIHRvIHNlbmQgZXZlbnRzIGFib3V0IFNQQUdzLCB0aGVuIHRoZXkgbmVlZCB0byB1c2UgdGhl ICZxdW90O2lzcy1zdWImcXVvdDsgY2F0Y2ggYWxsIHRvIHNlbmQgZXZlbnRzIGFib3V0IGVuYWJs aW5nIG9yIGRpc2FibGluZyBldmVudHMgYWJvdXQgU1BBR3MuIFNpbmNlIHRoaXMgaXMgbm90IHN0 YW5kYXJkaXplZCwgaXQgY291bGQgYWxzbyBjYXVzZSBwcm9wcmlldGFyeSBhbmQgaW5jb21wYXRp YmxlDQogaW1wbGVtZW50YXRpb25zLjxvOnA+PC9vOnA+PC9saT48L29sPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkF0dWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBNb24sIEp1bCAxMywgMjAyMCBhdCA1OjIzIFBN IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5j b20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0 OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5BcyBJIHNlZSBpdCwgdGhlIHVzZSBj YXNlcyB0aGF0IHJlcXVpcmUgYSBzcGFnX2lkIGNhbiB1c2UgdGhlbSB3aGVuIG5lY2Vzc2FyeSAo dW5sZXNzIHRoZSB3b3JraW5nIGdyb3VwIGRlY2lkZXMgb24gYW5vdGhlciB3YXkgdG8gZG8gdGhp cykgYnV0IEkgY2VydGFpbmx5DQogd291bGQgb3Bwb3NlIHJlcXVpcmluZyBpdCB3aGVuIGl04oCZ cyB1bm5lY2Vzc2FyeS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMw MDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4g MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+RnJvbTo8L2I+IElkLWV2ZW50ICZsdDs8 YSBocmVmPSJtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsi PmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5E aWNrIEhhcmR0PGJyPg0KPGI+U2VudDo8L2I+IE1vbmRheSwgSnVseSAxMywgMjAyMCA1OjEzIFBN PGJyPg0KPGI+VG86PC9iPiBBdHVsIFR1bHNoaWJhZ3dhbGUgJmx0OzxhIGhyZWY9Im1haWx0bzph dHVsdHVsc2hpQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5hdHVsdHVsc2hpQGdvb2dsZS5j b208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gU2VjRXZlbnQgJmx0OzxhIGhyZWY9Im1haWx0bzpp ZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3JnPC9hPiZn dDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gU3ViamVjdCBQcmluY2lwYWxz IGFuZCBTdWJqZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJhdGl2ZSBHcm91cGluZ3M8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+V291bGQgZGlm ZmVyZW50IFVSTHMgZm9yIGVhY2ggcmVsYXRpb25zaGlwIG5vdCBzb2x2ZSB5b3VyIGlzc3VlIG9m IG1haW50YWluaW5nIHNlY3JldHMgZm9yIGVhY2ggU1BBRz8gRm9yIGV4YW1wbGU6PG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+aHR0cHM6LzxhIGhyZWY9 Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRw JTNBJTJGJTJGZXhhbXBsZS5jb20lMkZzZWNldmVudCUyRlNQQUdfSURfMSZhbXA7ZGF0YT0wMiU3 QzAxJTdDdGltLmNhcHBhbGxpJTQwbWljcm9zb2Z0LmNvbSU3QzljY2Q4ZDJiZTI4MTRhYjg4MGUy MDhkODI4MDVmYTExJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3 QzYzNzMwMzM1MzQzMTA3NTA2MyZhbXA7c2RhdGE9REpMMUNGUVh4QWxIJTJGRUN1b2ZYMjZqSGxN bCUyRjNaWmt6c3g4Q3BhV3FYZEklM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5l eGFtcGxlLmNvbS9zZWNldmVudC9TUEFHX0lEXzE8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+aHR0cHM6LzxhIGhyZWY9 Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRw JTNBJTJGJTJGZXhhbXBsZS5jb20lMkZzZWNldmVudCUyRlNQQUdfSURfMiZhbXA7ZGF0YT0wMiU3 QzAxJTdDdGltLmNhcHBhbGxpJTQwbWljcm9zb2Z0LmNvbSU3QzljY2Q4ZDJiZTI4MTRhYjg4MGUy MDhkODI4MDVmYTExJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3 QzYzNzMwMzM1MzQzMTA3NTA2MyZhbXA7c2RhdGE9dHZmU1J4MWF3dWRvNnolMkIzd0hkUWJoc3Nr S1RwOWdIeHAlMkJ0MDFQVktBeGMlM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5l eGFtcGxlLmNvbS9zZWNldmVudC9TUEFHX0lEXzI8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+aHR0cHM6LzxhIGhyZWY9 Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRw JTNBJTJGJTJGZXhhbXBsZS5jb20lMkZzZWNldmVudCUyRlNQQUdfSURfMyZhbXA7ZGF0YT0wMiU3 QzAxJTdDdGltLmNhcHBhbGxpJTQwbWljcm9zb2Z0LmNvbSU3QzljY2Q4ZDJiZTI4MTRhYjg4MGUy MDhkODI4MDVmYTExJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3 QzYzNzMwMzM1MzQzMTA4NTA1NyZhbXA7c2RhdGE9QWx4U0tuU3YlMkJVeU9tWjAzUGdaRiUyQkhM ZnBSbmFkY2RMTUpDeXJUa3lhWDAlM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5l eGFtcGxlLmNvbS9zZWNldmVudC9TUEFHX0lEXzM8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+VGhlbiB0 aGUgY3JlZGVudGlhbCBpcyBpbmRlcGVuZGVudCZuYnNwO29mIHRoZSBTUEFHLCBidXQgd2UgYXJl IG5vdCBpbmplY3RpbmcgYW4gaWRlbnRpZmllciAoc3BhZ19pZCkgdGhhdCBpcyBvbmx5IHJlbGV2 YW50Jm5ic3A7dG8gb3JncyB0aGF0IHdhbnQgdG8gdXNlIHRoZSBzYW1lIGNyZWRlbnRpYWxzIGFj cm9zcyBTUEFHDQogcmVsYXRpb25zaGlwcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uIE1v biwgSnVsIDEzLCAyMDIwIGF0IDU6MDggUE0gQXR1bCBUdWxzaGliYWd3YWxlICZsdDs8YSBocmVm PSJtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+YXR1bHR1bHNo aUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0 O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6 MGluO21hcmdpbi1ib3R0b206NS4wcHQ7bWFyZ2luLWxlZnQ6NC4uOHB0Ij4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPkkgYW0gT0sgd2l0aCBtYWtpbmcgdGhlIHNwYWdfaWQgYSByZXF1 aXJlZCBjbGFpbSBpbiBldmVyeSBzdWJqZWN0IGlkZW50aWZpZXIuIEZvciBzaW5nbGUgdGVuYW50 ZWQgdHJhbnNtaXR0ZXJzLCBpdCB3b3VsZCBiZSBhIGNvbnN0YW50IHZhbHVlIGZvciBhbGwgZXZl bnRzIHRoZXkgZ2VuZXJhdGUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgNDowMSBQTSBEaWNrIEhhcmR0ICZs dDs8YSBocmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5k aWNrLmhhcmR0QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2lu LXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0O21hcmdpbi1sZWZ0OjQuLjhwdCI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5TbyB0aGUgcmVjZWl2ZXIgaXMgdXNpbmcgYXV0aGVu dGljYXRpb24gc29tZXRpbWVzIHRvIGRldGVybWluZSBTUEFHLCBhbmQgbm90IGF0IG90aGVyIHRp bWVzPzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkkn bSBkaWdnaW5nIGludG8gdGhpcyBhcyBJIGhhZCBhbHdheXMgdGhvdWdodCBvZiB0aGUgZXZlbnQg YmVpbmcgYmV0d2VlbiB0d28gcGFydGllcywgd2hlcmUgdGhleSBhcmUgaWRlbnRpZmllZCZuYnNw O2J5IHRoZSBlbmRwb2ludCBhbmQvb3IgdGhlIGNyZWRlbnRpYWxzLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+QWRkaW5nIGEgcmVsYXRp b25zaGlwIGlkZW50aWZpZXIgc2VlbXMgdG8gYmUgc29sdmluZyB0aGUgcHJvYmxlbSBhdCB0aGUg d3JvbmcgbGF5ZXIsIHVubGVzcyBpdCBpcyBpbiBhbGwgZXZlbnRzLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uIE1vbiwgSnVs IDEzLCAyMDIwIGF0IDM6NTQgUE0gQXR1bCBUdWxzaGliYWd3YWxlICZsdDs8YSBocmVmPSJtYWls dG86YXR1bHR1bHNoaUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+YXR1bHR1bHNoaUBnb29n bGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21h cmdpbi1ib3R0b206NS4wcHQ7bWFyZ2luLWxlZnQ6NC4uOHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPlNvcnJ5IGZvciB0aGUgdGVyc2UgbWVzc2FnZS48bzpwPjwvbzpwPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JZiBhIHNpbmdsZSB0ZW5hbnQgdHJh bnNtaXR0ZXIgaXMgdHJ1c3RlZCBieSBhIG11bHRpLXRlbmFudGVkIHJlY2VpdmVyIGZvciBhIHNw ZWNpZmljIHRlbmFudCwgdGhlbiB0aGUgU1BBRy1pZCBuZWVkIG5vdCBiZSBpbmNsdWRlZCBpZiB0 aGUgc3ViamVjdCBpcyB1bmlxdWUgYXQgdGhlIHRlbmFudCBsZXZlbCwNCiBiZWNhdXNlIHRoZSBy ZWNlaXZlciB3aWxsIGF1dG9tYXRpY2FsbHkgaWRlbnRpZnkgU1BBRyB0aGF0IHRoZSBzdWJqZWN0 IGJlbG9uZ3MgdG8gb24gaXRzIGVuZCAoYmFzZWQgb24gdGhlIGF1dGhlbnRpY2F0aW9uKS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMzozNyBQTSBEaWNrIEhhcmR0ICZsdDs8YSBo cmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5kaWNrLmhh cmR0QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0 OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0O21hcmdpbi1sZWZ0OjQuLjhwdCI+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj5XaGljaCBwYXJ0IGlzIG5vdCByZXF1aXJlZD88bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBNb24sIEp1bCAxMywg MjAyMCBhdCAzOjMzIFBNIEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmF0 dWx0dWxzaGlAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmF0dWx0dWxzaGlAZ29vZ2xlLmNv bTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBp biAwaW4gMGluIDYuMHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4t Ym90dG9tOjUuMHB0O21hcmdpbi1sZWZ0OjQuLjhwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj5Ob3QgcmVxdWlyZWQsIHNpbmNlIHRoZSBjbGFpbSBpcyBvcHRpb25hbC48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBNb24sIEp1bCAx MywgMjAyMCBhdCAzOjI1IFBNIERpY2sgSGFyZHQgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrLmhh cmR0QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmRpY2suaGFyZHRAZ21haWwuY29tPC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206 NS4wcHQ7bWFyZ2luLWxlZnQ6NC4uOHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PldvdWxkIGEgdHJhbnNtaXR0ZXIgdGhhdCBpcyBvbmx5IGluIG9uZSBTUEFHIChhIHNpbmdsZSB0 ZW5hbnQgc3lzdGVtKSBoYXZlIHRvIGluY2x1ZGUgaXRzIFNQQUcgaWQgaW4gZXZlbnRzIHNlbnQg dG8gYSByZWNlaXZlciB0aGF0IGFjY2VwdHMgZXZlbnRzIGZyb20gbXVsdGlwbGUgU1BBR3M/IEJ1 dCBpdCB3b3VsZA0KIG5vdCBpbmNsdWRlIGl0IGluIHNlbmRpbmcgZXZlbnRzIHRvIG90aGVyIHJl Y2VpdmVycyZuYnNwO3RoYXQgaGF2ZSBzZXBhcmF0ZSBjcmVkZW50aWFscyBmb3IgZWFjaCByZWxh dGlvbnNoaXA/PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPjxpbWcgYm9yZGVyPSIwIiB3aWR0aD0iMSIgaGVpZ2h0PSIxIiBz dHlsZT0id2lkdGg6LjAxMDRpbjtoZWlnaHQ6LjAxMDRpbiIgaWQ9ImdtYWlsLW1fLTI3ODIxNTc5 ODMyMTM4MTM4N194MDA1Zl94MDAwMF9pMTAyNiIgc3JjPSJodHRwczovL21haWxmb29nYWUuYXBw c3BvdC5jb20vdD9zZW5kZXI9YVpHbGpheTVvWVhKa2RFQm5iV0ZwYkM1amIyMCUzRCZhbXA7dHlw ZT16ZXJvY29udGVudCZhbXA7Z3VpZD1lNGQxOTYyZS01OTRkLTRkNDUtOGNhNS0xYzYzMjRmZTcw MGMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7R2FkdWdp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2hpdGUiPuGQpzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBNb24sIEp1bCAxMywgMjAyMCBh dCAzOjA1IFBNIEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmF0dWx0dWxz aGlAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmF0dWx0dWxzaGlAZ29vZ2xlLmNvbTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4g MGluIDYuMHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9t OjUuMHB0O21hcmdpbi1sZWZ0OjQuLjhwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij5UaGF0IGNvdWxkIGJlIHRydWUgYnV0IHRoZXJlIGFyZSBhIGZldyB3YXlzIGluIHdoaWNoIGl0 IGNhbiBiZSBhdm9pZGVkOjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxvbCBzdGFydD0iMSIgdHlw ZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwyIGxldmVsMSBsZm8yIj4N ClRoZSBwZWVycyBsZXZlcmFnZSBzb21lIGhpZ2hlci1sZXZlbCB0cnVzdCB0byBhY2NlcHQgLyBk ZWNsaW5lIGV2ZW50cyByZWxhdGluZyB0byBsb3dlciBsZXZlbCBTUEFHcy4gRm9yIGV4YW1wbGUs IGlmIHRydXN0IGlzIGVzdGFibGlzaGVkIGF0IGEgdGVuYW50IGxldmVsLCB0aGVuIGFuIE9VIGxl dmVsIFNQQUcgbmVlZCBub3QgaGF2ZSBpdHMgb3duIGF1dGhvcml6YXRpb24uPG86cD48L286cD48 L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDIgbGV2ZWwxIGxmbzIiPg0KVGhl IHNlY3JldCByZXF1aXJlZCBmb3IgZXN0YWJsaXNoaW5nIHRoZSBhdXRob3JpemF0aW9uIG9mIGEg U1BBRyBtYXkgYmUgdGVtcG9yYXJ5LiBGb3IgZXhhbXBsZTo8bzpwPjwvbzpwPjwvbGk+PC9vbD4N CjxvbCBzdGFydD0iMiIgdHlwZT0iMSI+DQo8b2wgc3RhcnQ9IjEiIHR5cGU9IjEiPg0KPGxpIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMSBsZXZlbDIgbGZvMyI+DQpBbiBhZG1pbmlzdHJh dG9yIHNpZ25zIGluIHRvIHRoZWlyIHRlbmFudCBpbiB0aGUgdHJhbnNtaXR0ZXIncyBhZG1pbmlz dHJhdG9yIGNvbnNvbGU8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28t bGlzdDpsMSBsZXZlbDIgbGZvMyI+DQpUaGUgYWRtaW4gb2J0YWlucyBhIHRlbXBvcmFyeSBhdXRo b3JpemF0aW9uIChvbmUtdGltZSBjb2RlKTxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21zby1saXN0OmwxIGxldmVsMiBsZm8zIj4NClRoZSBhZG1pbiBzaWducyBpbiB0byB0 aGVpciB0ZW5hbnQgaW4gdGhlIHJlY2VpdmVyJ3MgYWRtaW5pc3RyYXRpb24gY29uc29sZSBhbmQg cGFzdGVzIGluIHRoZSBvbmUtdGltZSBjb2RlPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwyIGxmbzMiPg0KVGhlIHJlY2VpdmVyIHNlbmRzIGEg cmVxdWVzdCB0byBlbmFibGUgdGhlIHN0cmVhbSBmb3IgdGhlIHNwZWNpZmllZCBTUEFHIHdpdGgg dGhhdCBvbmUtdGltZSBhdXRob3JpemF0aW9uLjxvOnA+PC9vOnA+PC9saT48L29sPg0KPC9vbD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkluIHRoZSBmaXJzdCBjYXNlLCB0aGVyZSBh cmUgbm8gYWRkaXRpb25hbCBzZWNyZXRzIHJlcXVpcmVkLiBJbiB0aGUgc2Vjb25kIGNhc2UsIHRo ZSBzZWNyZXQgaXMgdGVtcG9yYXJ5LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uIE1vbiwgSnVsIDEzLCAy MDIwIGF0IDI6MzQgUE0gRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2suaGFyZHRA Z21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+ZGljay5oYXJkdEBnbWFpbC5jb208L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2 LjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBw dDttYXJnaW4tbGVmdDo0Li44cHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SSBz ZWUgdGhlIFNQQUcgbGV0cyB0aGUgdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyIHByb3ZpZGUgY29u dGV4dCwgYXMgdGhlIHN1YmplY3QgaWRlbnRpZmllciBtYXkgYmUgdGhlIHNhbWUgYWNyb3NzIFNQ QUdzLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk5v dyBJJ20gdHJ5aW5nIHRvIHVuZGVyc3RhbmQgaG93IHRoZSB0cmFuc21pdHRlciBhdXRoZW50aWNh dGVzIHRvIHRoZSByZWNlaXZlciBpZiBpdCBkb2VzIG5vdCBoYXZlIGl0J3Mgb3duIHNlY3JldCAo YXNzdW1pbmcgdGhhdCBhdXRoZW50aWNhdGlvbiBtb2RlbCkgLS0gSUUsIGhvdyBkb2VzIHRoZSBy ZWNlaXZlcg0KIGtub3cgdGhlIHRyYW5zbWl0dGVyIGlzIGF1dGhvcml6ZWQmbmJzcDtmb3IgdGhh dCBTUEFHPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDI6MDggUE0gQXR1bCBUdWxzaGli YWd3YWxlICZsdDs8YSBocmVmPSJtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tIiB0YXJnZXQ9 Il9ibGFuayI+YXR1bHR1bHNoaUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpz b2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQ7bWFyZ2luLWxlZnQ6NC4u OHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5EaWNrLCB5b3VyIHVu ZGVyc3RhbmRpbmcgaXMgY29ycmVjdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+VG8gY2xhcmlmeSB0aGUgcHJvcG9zYWwgaGVyZSwgSGVyZSdzIHRo ZSB0ZXh0IEknbSBwcm9wb3NpbmcgdG8gYmUgYWRkZWQ6PG86cD48L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdp bi1ib3R0b206MTIuMHB0Ij48YnI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDsiPjMuJm5ic3A7IFN1YmplY3QgUHJpbmNpcGFsczxicj4NCjxicj4NCiZu YnNwOyAmbmJzcDtTdWJqZWN0IFByaW5jaXBhbHMgYXJlIHRoZSBtYW5hZ2VtZW50IGVudGl0aWVz IGFzc29jaWF0ZWQgd2l0aDxicj4NCiZuYnNwOyAmbmJzcDtTdWJqZWN0cy4mbmJzcDsgVGhlc2Ug bWF5IGJlIGh1bWFuIG9yIHJvYm90aWMgcHJpbmNpcGFscyBvciBkZXZpY2VzIG9yPGJyPg0KJm5i c3A7ICZuYnNwO290aGVyIGVudGl0aWVzIHRoYXQgYXJlIG1hbmFnZWQgYnkgdHJhbnNtaXR0ZXJz IGFuZCByZWNlaXZlcnMuJm5ic3A7IEZvcjxicj4NCiZuYnNwOyAmbmJzcDtleGFtcGxlLCB0aGUg c2FtZSBTdWJqZWN0IFByaW5jaXBhbCBtYXkgYmUgcmVmZXJyZWQgdG8gYnkgYW4gZW1haWw8YnI+ DQombmJzcDsgJm5ic3A7YWRkcmVzcyBvciBhIHBob25lIG51bWJlci4mbmJzcDsgQSB0cmFuc21p dHRlciBvciByZWNlaXZlciB3aWxsIHR5cGljYWxseTxicj4NCiZuYnNwOyAmbmJzcDttYW5hZ2Ug c3ViamVjdCBwcmluY2lwYWxzIGFuZCBvcmdhbml6ZSB0aGVtIGludG8gc3ViLWdyb3VwaW5ncyBz dWNoPGJyPg0KJm5ic3A7ICZuYnNwO2FzIHRlbmFudHMsIGdyb3Vwcywgb3JnYW5pemF0aW9uYWwg dW5pdHMsIGV0Yy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7U3ViamVjdHMgYXJlIGlkZW50aWZp ZWQgYnkgU3ViamVjdCBJZGVudGlmaWVycyBkZWZpbmVkIGJlbG93Ljxicj4NCjxicj4NCjMuMS4m bmJzcDsgU1BBR3M8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7U3ViamVjdCBQcmluY2lwYWxzIE1B WSBiZSBncm91cGVkIGZvciBhZG1pbmlzdHJhdGl2ZSBwdXJwb3NlcyBpbnRvPGJyPg0KJm5ic3A7 ICZuYnNwOyZxdW90O1N1YmplY3QgUHJpbmNpcGFsIEFkbWluaXN0cmF0aXZlIEdyb3VwaW5ncyZx dW90OyBvciBTUEFHcy4mbmJzcDsgRm9yIGV4YW1wbGUsPGJyPg0KJm5ic3A7ICZuYnNwO2FsbCB1 c2VycyBiZWxvbmdpbmcgdG8gb25lIGN1c3RvbWVyIG9mIGEgJnF1b3Q7bXVsdGktdGVuYW50ZWQm cXVvdDsgVHJhbnNtaXR0ZXI8YnI+DQombmJzcDsgJm5ic3A7bWF5IGJlIGluIG9uZSBTUEFHLiZu YnNwOyBBbHRlcm5hdGl2ZWx5LCBhbiBPcmdhbml6YXRpb25hbCBVbml0IG9yIGEgZ3JvdXA8YnI+ DQombmJzcDsgJm5ic3A7b2YgU3ViamVjdHMgd2l0aGluIGEgY3VzdG9tZXIgb2YgYSBUcmFuc21p dHRlciAod2hldGhlciBtdWx0aS08YnI+DQombmJzcDsgJm5ic3A7dGVuYW50ZWQgb3Igbm90KSBt YXkgYmUgb25lIFNQQUcuJm5ic3A7IFNQQUdzIG1heSBoYXZlIG92ZXJsYXBwaW5nIHNldHMgb2Y8 YnI+DQombmJzcDsgJm5ic3A7U3ViamVjdHMuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0EgU1BB RyBNQVkgYmUgdGhlIFN1YmplY3Qgb2YgY2VydGFpbiBzdHJlYW0gdXBkYXRlIGV2ZW50cyBkZWZp bmVkPGJyPg0KJm5ic3A7ICZuYnNwO2xhdGVyIGluIHRoaXMgc3BlYywgaGVuY2UgaXMgZGVmaW5l ZCBhcyBhIFN1YmplY3QgVHlwZSBvZiBpdHMgb3duPGJyPg0KJm5ic3A7ICZuYnNwO2JlbG93Li4m bmJzcDsgQSBTUEFHIGlkZW50aWZpZXIgTUFZIGJlIGluY2x1ZGVkIGluIG90aGVyIHN1YmplY3Qg dHlwZXMgdG88YnI+DQombmJzcDsgJm5ic3A7ZGlzYW1iaWd1YXRlIHRoZSBzdWJqZWN0Ljxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDtBIFNQQUcgc3ViamVjdCBpZGVudGlmaWVyIGlzIGFncmVlZCB0 byBvZmZsaW5lIGJldHdlZW4gYSB0cmFuc21pdHRlcjxicj4NCiZuYnNwOyAmbmJzcDthbmQgYSBy ZWNlaXZlci48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPlRoZSBiZW5lZml0cyBvZiBkb2luZyB0aGlzIGFyZTo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxvbCBzdGFydD0iMSIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21zby1saXN0OmwzIGxldmVsMSBsZm80Ij4NCk11bHRpLXRlbmFudGVkIGhvc3Rz IGRvIG5vdCBuZWVkIHRvIG1haW50YWluIHNlY3JldHMgcGVyIHRlbmFudCBhbmQgcGVyIHRyYW5z bWl0dGVyIHRlbmFudCBpZiBlYWNoIHRlbmFudCBoYXMgdG8gYmUgYW4gZXZlbnQgdHJhbnNtaXR0 ZXIgYW5kIGFuIGV2ZW50IHJlY2VpdmVyIG9mIGl0cyBvd24uPG86cD48L286cD48L2xpPjxsaSBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDMgbGV2ZWwxIGxmbzQiPg0KQW4gZXZlbnQgc3Ry ZWFtIG1heSBiZSBlc3RhYmxpc2hlZCBiZXR3ZWVuIHR3byBtdWx0aS10ZW5hbnRlZCBob3N0cywg YW5kIHNvIGRvZXMgbm90IG5lZWQgdG8gYmUgbWFuYWdlZCBhdCBhIHBlci10ZW5hbnQgbGV2ZWw8 bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMyBsZXZlbDEg bGZvNCI+DQpUaGUgc2FtZSBzdWJqZWN0IG9yIHN1YmplY3QgcHJpbmNpcGFsIG1heSBiZSBhIHBh cnQgb2YgbXVsdGlwbGUgU1BBR3MsIGFuZCBpZGVudGlmeWluZyB0aGUgU1BBRyB0aGF0IGFuIGV2 ZW50IHJlbGF0ZXMgdG8gY2FuIGJlIGFjaGlldmVkIGlmIHRoZSBzdGFuZGFyZCBhbGxvd3MgZm9y IHRoZSBTUEFHcyB0byBiZSBpZGVudGlmaWVkLjxvOnA+PC9vOnA+PC9saT48L29sPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uIE1vbiwgSnVsIDEzLCAy MDIwIGF0IDExOjMyIEFNIERpY2sgSGFyZHQgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrLmhhcmR0 QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmRpY2suaGFyZHRAZ21haWwuY29tPC9hPiZndDsg d3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4g Ni4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4w cHQ7bWFyZ2luLWxlZnQ6NC4uOHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlRv IGNsYXJpZnksIHlvdXIgcHJvcG9zYWwgaXMgZHJpdmVuIGJ5IHRoZSBpbXBsZW1lbnRhdGlvbiZu YnNwO2J1cmRlbiBvZiBtYWludGFpbmluZyBzZXBhcmF0ZSBzZWNyZXRzIC8gc3RyZWFtcyBiZXR3 ZWVuIGEgdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48aW1nIGJvcmRlcj0iMCIgd2lkdGg9IjEiIGhl aWdodD0iMSIgc3R5bGU9IndpZHRoOi4wMTA0aW47aGVpZ2h0Oi4wMTA0aW4iIGlkPSJnbWFpbC1t Xy0yNzgyMTU3OTgzMjEzODEzODdfeDAwNWZfeDAwMDBfaTEwMjUiIHNyYz0iaHR0cHM6Ly9tYWls Zm9vZ2FlLmFwcHNwb3QuY29tL3Q/c2VuZGVyPWFaR2xqYXk1b1lYSmtkRUJuYldGcGJDNWpiMjAl M0QmYW1wO3R5cGU9emVyb2NvbnRlbnQmYW1wO2d1aWQ9NzE0YjJlMDMtYjExMi00ZjMyLWEwODAt Zjc4ZWU4YzBiYzIwIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuNXB0O2ZvbnQtZmFtaWx5OiZx dW90O0dhZHVnaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndoaXRlIj7hkKc8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gTW9uLCBKdWwg MTMsIDIwMjAgYXQgOTowMSBBTSBBdHVsIFR1bHNoaWJhZ3dhbGUgJmx0O2F0dWx0dWxzaGk9PGEg aHJlZj0ibWFpbHRvOjQwZ29vZ2xlLmNvbUBkbWFyYy4uaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij40MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdDttYXJnaW4tbGVmdDo0Li44 cHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SGkgYWxsLCZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SGVyZSdzIGEgcXVpY2sgYmFj a2dyb3VuZCBmb3IgdGhlDQo8YSBocmVmPSJodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0 aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZnaXRodWIuY29tJTJGcmljaGFubmEl MkZzZWNldmVudCUyRnB1bGwlMkYxJmFtcDtkYXRhPTAyJTdDMDElN0N0aW0uY2FwcGFsbGklNDBt aWNyb3NvZnQuY29tJTdDOWNjZDhkMmJlMjgxNGFiODgwZTIwOGQ4MjgwNWZhMTElN0M3MmY5ODhi Zjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MzAzMzUzNDMxMDg1MDU3JmFt cDtzZGF0YT04a1olMkZFNjY3bXpXOU5vSHVXQzBVakljaVYlMkJFRkRqWFhQUWNjVm9vZlNTayUz RCZhbXA7cmVzZXJ2ZWQ9MCIgdGFyZ2V0PSJfYmxhbmsiPg0KcHJvcG9zYWw8L2E+IGZvciBpbmNs dWRpbmcgU3ViamVjdCBQcmluY2lwYWxzIGFuZCBTdWJqZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJh dGl2ZSBHcm91cGluZ3Mgb3IgU1BBR3MgaW4gdGhlIFN1YmplY3QgSWRlbnRpZmllcnMgc3BlYy48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxiPlVzZSBvZiBTdWJqZWN0IElkZW50aWZpZXJzIGluIFNoYXJlZCBTaWduYWxzIGFuZCBFdmVu dHM8L2I+OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj5UaGUgU2hhcmVkIFNpZ25hbHMgYW5kIEV2ZW50cyAoU1NFKSBwcm9maWxlIG9mIFNFVHMg c3BlY2lmaWVzIHRoYXQgdHJhbnNtaXR0ZXJzIGFuZCByZWNlaXZlcnMgc2VuZCBhbmQgcmVjZWl2 ZSBTRVRzIHRoYXQgY29udGFpbiBTdWJqZWN0IElkZW50aWZpZXJzLiBUaGVzZSBzdWJqZWN0IGlk ZW50aWZpZXJzIGhhdmUNCiB0aGUgZm9ybWF0IHRoYXQgaXMgbm93IGJlaW5nIGRpc2N1c3NlZCBh cyBhIHNlcGFyYXRlIHNwZWNpZmljYXRpb24gaGVyZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPlRyYW5zbWl0dGVycyBhbmQgUmVj ZWl2ZXJzIGluIFNTRTwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+VGhlIFNTRSBwcm9maWxlIGRlZmluZXMgdHJhbnNtaXR0ZXJzIGFuZCBy ZWNlaXZlcnMgYXMgaG9zdHMgdGhhdCBtYW5hZ2Ugc3RyZWFtcyBiZXR3ZWVuIHBlZXJzLiBUaGUg cmVjZWl2ZXIgYXV0aGVudGljYXRlcyB0byB0aGUgdHJhbnNtaXR0ZXIgdXNpbmcgT0F1dGgsIHJl cXVpcmluZyB0aGUgdXNlIG9mIGENCiBzZWNyZXQgcGVyIHJlY2VpdmVyLiBJbiBhIG11bHRpLXRl bmFudGVkIGhvc3QgdGhhdCBoYW5kbGVzIGh1bmRyZWRzIG9mIHRob3VzYW5kcyBvciBtaWxsaW9u cyBvZiBpbmRlcGVuZGVudCB0ZW5hbnRzLCBtYWludGFpbmluZyBzdWNoIGEgc2VjcmV0IHBlciBp bnN0YW5jZSBvZiBhIHJlY2VpdmVyIGlzIGN1bWJlcnNvbWUuIEZ1cnRoZXJtb3JlLCBzaW5jZSBh IHRyYW5zbWl0dGVyIGFuZCBhIHJlY2VpdmVyIGhhcyB0byBtYWludGFpbiBhIHN0cmVhbQ0KIHBl ciBwYWlyLCBjcmVhdGluZyBzdWNoIHBlci10ZW5hbnQgc3RyZWFtcyBjYW4gYWRkIHNpZ25pZmlj YW50IGltcGxlbWVudGF0aW9uIG92ZXJoZWFkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+U1BBR3M8L2I+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlRoZXJlZm9yZSwgd2UgbmVl ZCBhIG5vdGlvbiBvZiBhIGdyb3VwaW5nIG9mIHN1YmplY3RzIHdpdGhpbiB0aGUgc2FtZSB0cmFu c21pdHRlciBhbmQgcmVjZWl2ZXIgdG8gZGlzdGluZ3Vpc2ggYmV0d2VlbiB2YXJpb3VzIGFkbWlu aXN0cmF0aXZlIGdyb3VwaW5ncyB0aGF0IGV4aXN0IHdpdGhpbiBhIGhvc3QuDQogVGhlc2UgZ3Jv dXBpbmdzIGNvdWxkIGluY2x1ZGUgdGVuYW50cywgb3JnYW5pemF0aW9uYWwgdW5pdHMgb3IgdXNl ciBncm91cHMuLiBUaGlzIGdyb3VwaW5nIGlzIGNhcHR1cmVkIGluIHRoZSBub3Rpb24gb2YgYSBT UEFHLiBUaGUgdW5pcXVlbmVzcyBvZiBhIHVzZXIgaWRlbnRpZmllciAoc3ViamVjdCBpZGVudGlm aWVyKSBtYXkgYWxzbyBiZSBsaW1pdGVkIHRvIGEgU1BBRy4gRm9yIGV4YW1wbGUsIGlmIGEgcmFu ZG9tIHVuaXF1ZSBJRCByZXByZXNlbnRzDQogYSB1c2VyLCB0aGVuIHRoYXQgSUQgbWF5IGJlIHVu aXF1ZSB3aXRoaW4gYSBTUEFHIGFuZCBub3QgdW5pdmVyc2FsbHkgYWNyb3NzIGEgdHJhbnNtaXR0 ZXIgb3IgcmVjZWl2ZXIuIFRoaXMgaXMgYmVjYXVzZSBlYWNoIHRyYW5zbWl0dGVyIGFuZCByZWNl aXZlciBtYXkgaGF2ZSBtdWx0aXBsZSBjb25uZWN0aW9ucyB0byBvdGhlciB0cmFuc21pdHRlcnMg YW5kIHJlY2VpdmVycywgYW5kIGVuc3VyaW5nIHVuaXF1ZW5lc3MgYWNyb3NzIGFsbCBzdWNoDQog cGVlcnMgaXMgcHJvYmFibHkgYW4gaW50cmFjdGFibGUgcHJvYmxlbS48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPlN1YmplY3QgUHJp bmNpcGFsczwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+V2hpbGUgd2hhdCBpcyByZXByZXNlbnRlZCB3aXRoaW4gYSBzdWJqZWN0IGlkZW50 aWZpZXIgbWF5IGJlIG9ubHkgYW4gYXNwZWN0IG9mIHRoZSBtYW5hZ2VtZW50IGVudGl0eSwgdGhl IGFkbWluaXN0cmF0aXZlIGdyb3VwaW5nIGlzIGFib3V0IHRoZSBtYW5hZ2VtZW50IGVudGl0eSBp dHNlbGYuIFRoaXMgY291bGQNCiBiZSB0aGUgdXNlciwgZGV2aWNlIG9yIG90aGVyIHByaW5jaXBh bCB0aGF0IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgcmVwcmVzZW50cy4gVGhlcmVmb3JlLCBhbiBh YnN0cmFjdCBub3Rpb24gb2YgYSBTdWJqZWN0IFByaW5jaXBhbCBpcyBhbHNvIHJlcXVpcmVkIGlu IG9yZGVyIHNwZWNpZnkgd2hhdCB0aGUgZ3JvdXBpbmcgd2l0aGluIGEgU1BBRyBpcyBhYm91dC48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PlRoZSBhYm92ZSBpcyBjYXB0dXJlZCBpbiB0aGUgJnF1b3Q7U3ViamVjdCBQcmluY2lwYWwmcXVv dDsgYW5kICZxdW90O1NQQUcmcXVvdDsgc2VjdGlvbnMgd2l0aGluIHRoZSBwcm9wb3NlZA0KPGEg aHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJs PWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRnJpY2hhbm5hJTJGc2VjZXZlbnQlMkZwdWxsJTJG MSZhbXA7ZGF0YT0wMiU3QzAxJTdDdGltLmNhcHBhbGxpJTQwbWljcm9zb2Z0LmNvbSU3QzljY2Q4 ZDJiZTI4MTRhYjg4MGUyMDhkODI4MDVmYTExJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAx MWRiNDclN0MxJTdDMCU3QzYzNzMwMzM1MzQzMTA5NTA1MSZhbXA7c2RhdGE9cGo0V0JIbU04VnFp elF5ZFZubXNHWnRoczZBSjlJZ0pUZ25PcG5NRGUzVSUzRCZhbXA7cmVzZXJ2ZWQ9MCIgdGFyZ2V0 PSJfYmxhbmsiPg0KUFI8L2E+LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+VGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5BdHVsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+X19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8 YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5JZC1ldmVu dEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90 ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWls bWFuJTJGbGlzdGluZm8lMkZpZC1ldmVudCZhbXA7ZGF0YT0wMiU3QzAxJTdDdGltLmNhcHBhbGxp JTQwbWljcm9zb2Z0LmNvbSU3QzljY2Q4ZDJiZTI4MTRhYjg4MGUyMDhkODI4MDVmYTExJTdDNzJm OTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzMwMzM1MzQzMTA5NTA1 MSZhbXA7c2RhdGE9NGxueVFVY0dMZm9Na3R1TmhYRENuJTJCNDNLZyUyRmpoeUlhTmlINk9sTzdy MlElM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1 b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rp dj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_DM6PR00MB081613C5937AAE8494A2826E95610DM6PR00MB0816namp_-- From nobody Tue Jul 14 08:55:07 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4955C3A08CD for ; Tue, 14 Jul 2020 08:55:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1V7HNGoMXR3j for ; Tue, 14 Jul 2020 08:55:03 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650093.outbound.protection.outlook.com [40.107.65.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52A443A08D4 for ; Tue, 14 Jul 2020 08:55:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=CM1kH9/gdPRz7wNcFihwnTGCy3AGllsa8U/kTU8BCumMhBbfouflZAUKy9c4oJNp7ubGce1aBXVdps1b6KOG1jzcsOkYSHjFh+pzDarr60Zug3MSJfFt7kaYLQx6bWJ1CCcVG6ZYBtowzMFfNmiHUaDFd70+LEMJpv9xO3tE/LCgVcC18YYfUpHnDtlm5vXy84U1k5+r2AjwI2mCNeQYMZzd7q41AuiExLCOCyglXq66+SLy4z1kgSGo+EfY2NzzilSgCmY1/ehTPyl9IeIV5nG2aQQvvjJjAbP4H8pblbr1UERohCGkidDmsZhcjymC1BH5mBZB03fVXp48DvRIUw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2sLvbBMEA561aEh/m95/hewnb3JhxjroPy5zksM1/IQ=; b=i3KA+N3pQaCVA2c+xitLGH7JfOMwzriKnRMVqED9KRF/z4TxTii+Ryh1XbYPMJtL8fyGR8JPeGvpx5kEz+//UDA+njdOKqKNT17Bj/DA0yF4IrheN56CrSrI1dZBg3MMOWga4CZDYOCUaO4JjSVtiLiu2ScSm1yCH+GQiJtxGFvKQtb8X8KddVFdRjlZB4IaNB+I0TQwxu1CS01Fy3/ZU7cze6RIxZiAyfDy/IO8kAIKmzhPL1E4G0XRiP6IyxgkFYtiaZP4ZLtTwghbrlNyWDGsQmBimvVx5y0+aZH+UwVgLMFuDqEf2N8IS73fk7k3JxwUfC57qdV4LDFecZHj2w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2sLvbBMEA561aEh/m95/hewnb3JhxjroPy5zksM1/IQ=; b=QCMOpP1vpqyJR+e5pNec2n5RXNoJRg739ho4/Rpl3mczUQPaq8Ec98X2TH/Cbg/SH8oLF/h8K14Bj/vSelperIntYrQ6mDp8nebG5ai1v+VmzI+OKqxvZ/HdT8Iz68ALMjvxcGbwuAS3gtuiH5A7nRB8W7xDmUqWnDEqEgJo5CM= Received: from DM6PR00MB0816.namprd00.prod.outlook.com (2603:10b6:5:208::12) by DM6PR00MB0859.namprd00.prod.outlook.com (2603:10b6:5:220::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3227.0; Tue, 14 Jul 2020 15:55:01 +0000 Received: from DM6PR00MB0816.namprd00.prod.outlook.com ([fe80::f138:129:83ad:8071]) by DM6PR00MB0816.namprd00.prod.outlook.com ([fe80::f138:129:83ad:8071%8]) with mapi id 15.20.3231.000; Tue, 14 Jul 2020 15:55:01 +0000 From: Tim Cappalli To: "Richard Backman, Annabelle" , "id-event@ietf.org" Thread-Topic: [Id-event] Feedback: draft-ietf-secevent-subject-identifiers-05 (Tim Cappalli) Thread-Index: AQHWWTwM2wdMqVFhB0+kNKxypDuLo6kFc6SAgAHH3pQ= Date: Tue, 14 Jul 2020 15:55:01 +0000 Message-ID: References: , <2DBA1C53-4CB8-4D6B-A928-68FA718E3ECB@amazon.com> In-Reply-To: <2DBA1C53-4CB8-4D6B-A928-68FA718E3ECB@amazon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-14T15:53:59.3830408Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Privileged authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [100.0.202.188] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: e61f2276-815f-4246-8664-08d8280e4492 x-ms-traffictypediagnostic: DM6PR00MB0859: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: FLp2+9q//lX0U01zeWGWVZzZG+oOoUAyJYkpi2uAtc+AYQSlZoGQ30fkiEyfLPgoVMnQXKr5YJDhsdkrs0ASm211iFfFHla4JekWc1yOWttVO36qLqCpAY4taTzcewGBZLB0CPO7Kp2sMU6Y+EWPwctHTdHdwwFEN19RPGcjKLrdfWye+dnwd3+lE1naLcOdRAKNKGqgk32S3TdVa9wvfkxI0kPFekbSfLamTa7ltNAb3La6+RXSs9EPE9jBgzlc2RWegIgnPSjftgoLmteSZ022xvQkOdSrwiOxEl5hnF1zvleGJfcUL8UIzATOWAmhlWbq6SYVSsxg2pb0C0v0lab/A+axESuawA6myigu8GatcagfyoZ0TuPFCrpIskT8CsegxFnqnVCw9zKF2nhymg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR00MB0816.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(396003)(39860400002)(376002)(346002)(136003)(76116006)(8990500004)(9686003)(55016002)(2906002)(83380400001)(82960400001)(166002)(82950400001)(66946007)(478600001)(10290500003)(86362001)(966005)(66446008)(66476007)(64756008)(91956017)(66556008)(8936002)(8676002)(186003)(71200400001)(52536014)(26005)(53546011)(7696005)(6506007)(5660300002)(316002)(33656002)(110136005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: f/V1RUMNvn19JL4WY2cdMd7h9xQC0A/vxScXawf8rbV9wM2mwEpyDcAlCm33IV01EmHWxT5IQDmD6pmDrwM0ZQViDrXqbXLtT5nL24eY0V2oUrPkiEyzDcO/osCqgm2MurpfYsbEdjkXcMZy9v8nxtNounQtIc196Widk/WhU85UCcxhpQeZWb/ac5Y5l5hh9yxbVB1RsR8t2yd9yeGJx02Ot4iNM7Yf5lBNmBI1R034SZOqbiFrQj9C6xma5wgSBMkcZX6hFQTco1MXe2/Xap/gaUr27m0/P6w4Xd8ED5wAHo8exjQvMhN066g+g3u1dFpFWCv4fkpIwkNxUR3+QT6xNNrPMVGW4q6fYr7lDBvIS5i0gY9SF8vYEDMQoQ5+IsU9gS5Q8uYIQwJ7bMIFsyDQYqBP39qhGgFHp/2WmyU= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB0816D0DE5A6F4E83E2C6A3AF95610DM6PR00MB0816namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR00MB0816.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e61f2276-815f-4246-8664-08d8280e4492 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2020 15:55:01.6339 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: NF4GlL4QPGfbqwK8GuroTA4NLQNIoSPx0L5xeY4BtmZAvYvxqvvDS5TRkbf17Ycv+SDTmirbIaKlfET/QmHaGg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0859 Archived-At: Subject: Re: [Id-event] Feedback: draft-ietf-secevent-subject-identifiers-05 (Tim Cappalli) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 15:55:05 -0000 --_000_DM6PR00MB0816D0DE5A6F4E83E2C6A3AF95610DM6PR00MB0816namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Just removing =93User=94 and making it =93Account Subject Identifier=94 mak= es sense to me! tim From: Richard Backman, Annabelle Date: Monday, July 13, 2020 at 15:43 To: Tim Cappalli , id-event@ietf.org Subject: Re: [Id-event] Feedback: draft-ietf-secevent-subject-identifiers-0= 5 (Tim Cappalli) Thanks for the review, Tim! Replies are [richanna] inline [/richanna]. =96 Annabelle Backman (she/her) AWS Identity https://aws.amazon.com/identity/ From: Id-event on behalf of Tim Cappalli Date: Monday, July 13, 2020 at 11:11 AM To: "id-event@ietf.org" Subject: [EXTERNAL] [Id-event] Feedback: draft-ietf-secevent-subject-identi= fiers-05 (Tim Cappalli) CAUTION: This email originated from outside of the organization. Do not cli= ck links or open attachments unless you can confirm the sender and know the= content is safe. Sorry for the delay, I sent this last week but to the -bounces address by a= ccident. Here=92s my feedback: 3. There are definitely use cases for locally significant subject identifi= er types between two parties (example: first party platforms). The current = text mandates registration with IANA. There should be flexibility to use in= ternal/private/local subject identifier types. [richanna] Agreed. This has been brought up a few times now, so there=92s pretty clear= ly a need for it. We can allow for unregistered names similar to how JWT al= lows for unregistered claims. [/richanna] 3.1 If this identifier type is going to be restricted to user accounts (by = RFC7565), then I think it should be called the "User Account Subject Identi= fier Type" with a "subject_type" value of "user-account". Devices can also = have accounts. [richanna] I don=92t see a reason why this needs to be restricted to u= ser accounts. We should just strike =93user=94 from the first sentence. [/richanna] 7.1.1 Should the controller be updated to "OpenID Foundation Shared Signals a= nd Events Working Group" to reflect the new name of the group? [richanna] This never got edited when we moved this work from OIDF to = here. Should be updated to IETF. [/richanna] 7.1.2.1 See feedback for 3.1 Tim --_000_DM6PR00MB0816D0DE5A6F4E83E2C6A3AF95610DM6PR00MB0816namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

    Just removing =93User=94 and making it =93Account Sub= ject Identifier=94 makes sense to me!

     

    tim

     

    From: Richard Backman, Annabelle <richa= nna=3D40amazon.com@dmarc.ietf.org>
    Date: Monday, July 13, 2020 at 15:43
    To: Tim Cappalli <Tim.Cappalli@microsoft.com>, id-event@ietf.o= rg <id-event@ietf.org>
    Subject: Re: [Id-event] Feedback: draft-ietf-secevent-subject-identi= fiers-05 (Tim Cappalli)

    Thanks for the revi= ew, Tim! Replies are [richanna] inline [/richanna].<= o:p>

     <= /o:p>

    =96

    Annabelle Backman (she/her)

    AWS Identity

    https://aws.amazon.com/identity/

     <= /o:p>

     <= /o:p>

    From: Id-event <id-event-bounces@ietf.org> = on behalf of Tim Cappalli <Tim.Cappalli=3D40microsoft.com@dmarc.ietf.org= >
    Date: Monday, July 13, 2020 at 11:11 AM
    To: "id-event@ietf.org" <id-event@ietf.org>
    Subject: [EXTERNAL] [Id-event] Feedback: draft-ietf-secevent-subject= -identifiers-05 (Tim Cappalli)

     

    CAUTION: This email originated from outside of the organizati= on. Do not click links or open attachments unless you can confirm the sender and know the content is safe.=

     

    Sorry for the = delay, I sent this last week but to the -bounces address by accident.

     <= o:p>

    Here=92s my fe= edback:

     <= o:p>

    3.=

      &n= bsp; There are definitely use cases for locally significant subject identif= ier types between two parties (example: first party platforms). The current text mandates registration with IANA. There should be flexibil= ity to use internal/private/local subject identifier types.

     <= /o:p>

       &= nbsp;            [richanna]

    Agreed. This has been brought up a few times now, so = there=92s pretty clearly a need for it. We can allow for unregistered names= similar to how JWT allows for unregistered claims.

    [/richanna]

     <= o:p>

    3.1 

     <= o:p>

      &n= bsp; If this identifier type is going to be restricted to user accounts (by= RFC7565), then I think it should be called the "User Account Subject Identifier Type" with a "subject_type" value of "user-= account". Devices can also have accounts.

     <= /o:p>

       &= nbsp;            [richanna]
                &nb= sp;   I don=92t see a reason why this needs to be restricted to u= ser accounts. We should just strike =93user=94 from the first sentence.

    [/richanna]

     <= o:p>

     <= o:p>

    7.1.1

      &n= bsp; Should the controller be updated to "OpenID Foundation Shared Sig= nals and Events Working Group" to reflect the new name of the group?

     <= o:p>

       &= nbsp;            [richanna]

     = ;            &n= bsp;  This never got edited when we moved this work from OIDF to here.= Should be updated to IETF.

    [/richanna]

     <= o:p>

    7.1.2.1=

      &n= bsp; See feedback for 3.1

     

     

    Tim

     

    --_000_DM6PR00MB0816D0DE5A6F4E83E2C6A3AF95610DM6PR00MB0816namp_-- From nobody Tue Jul 14 08:57:06 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 245B83A08D7 for ; Tue, 14 Jul 2020 08:57:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fgT8EcgYAnmg for ; Tue, 14 Jul 2020 08:57:02 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0F673A08D4 for ; Tue, 14 Jul 2020 08:57:01 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id t9so12088361lfl.5 for ; Tue, 14 Jul 2020 08:57:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jiwhu7psYbuT2t9Wk98E0QSgTyP8XFlZ6AhsonuO5X0=; b=Vj3Z0nn3uhDZuib0lQeWexcmCiEuO3cBwlhXaWXp6FmSbAd4yENE6rKFWf32QtVp+r 2zO6XXkMMbqnW8M5qNeWCr140oxvRjvwF9qXImVwfgKbQ85cMWv/7bbyq9Pefy6A9j1V dze/b7On/XCVnqQjcymBvzGhOsuJ8fK7bI+A+Y8NXNNSt0bdmnWq1dP8R3KbiiUlYdOW z0jbe9iFijUho4BSMM2ngU1ELROuCz8+8eth2VbGiOPB8j2asKvcosAD7dYxHo7REcK5 4rX/DI265V99h4rSW+siu7DjN08IP0xQo/yKxK01r4wXwDgiK3oW+ydET/CMLsdDP2u8 +hIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jiwhu7psYbuT2t9Wk98E0QSgTyP8XFlZ6AhsonuO5X0=; b=V91LugWaOqIjH6LF2c1ceHPD9wzMwCef63zbCNKiB9rgDrq18QhotASuaXC6Bmzi0N +nv3hHUx7LuA3AkIPBQfIeBNNB9LIm+uV+gmqe2hWNbmx774ANvX/yTHM9vTpXeC4sh8 HtD8VHk6p1QxDYmplL5zYnZT8Bpo+JthuT1bM4WEDrsMNBXIQWHkCZQkwoZ0JEJNLjzD z+Co8RYANRDeInRn2kry/IisGEt+VXVUAB0dNSbE+BTngyuChjpJ1vH6rqE5PfvfG1PS FP3rixOueYaZ1BnTv8ypn2MsWgFjYKL0OFfl4iFhN7WkNJWQzIUso8h7Tv39KRy33Uxo WWjQ== X-Gm-Message-State: AOAM530zm7ApYu+sGtdXXzLafpohqibCOmg1oloLPzYhLs2G/EOi1CoQ NKc1bJehqe4ruppTxGU9k720/SdlZZUqdAhKbA4= X-Google-Smtp-Source: ABdhPJwvk+xAXOmDKcspM2SbTTRSrQe6mQGMhcXlTcs8ZDj+UZBl7PaVIlKg4btng9viF4+b13hN5QMQBhwcNFODZZc= X-Received: by 2002:a19:ac03:: with SMTP id g3mr2503386lfc.164.1594742219534; Tue, 14 Jul 2020 08:56:59 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Tue, 14 Jul 2020 08:56:23 -0700 Message-ID: To: Atul Tulshibagwale Cc: Mike Jones , SecEvent Content-Type: multipart/alternative; boundary="00000000000080f60b05aa68db1d" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 15:57:05 -0000 --00000000000080f60b05aa68db1d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Atul If the SPAG has value in the event message, then it should be specified. I was proposing that the SPAG be determined at the transport layer rather then the event/message layer. An advantage of being in the event is that it is independent of transport. In a multi-tenant situation, where different components do different parts of the processing, and the original transport is no longer available, the SPAG would be always available rather than wrapping the event to include the SPAG. On Tue, Jul 14, 2020 at 7:55 AM Atul Tulshibagwale wrote: > A few points / responses: > > 1. Agree with Mike that spag_id should not be a required claim unless > it's actually required for every subject. So keeping it optional (if w= e > decide to have it at all) is the right thing to do. > 2. IMO it will be far simpler for multi-tenanted hosts to use SPAGs > rather than manage multiple event streams (i.e. one per tenant) > 3. A multi-tenanted architecture is increasingly very common, so this > will apply to a large number of organizations. > 4. For single tenanted transmitters, the SPAG id may be inferred by > receivers. Single tenanted receivers may ignore the SPAG ids in the > subjects. So processing SPAGs in hybrid situations does not appear to = be > cumbersome. > 5. The use of SPAGs is not limited to tenant-level information, since > it may be applied to OUs or groups > 6. If we agree that SPAG is a "meta concept" that applies in most > situations, then capturing it in the spec is probably important. What = Dick > is proposing is a way to implement SPAGs without specifying them in a > standard, so each entity is free to define it the way they want. This > approach can cause incompatibilities. > 7. Without SPAGs in the spec, if peers need to send events about > SPAGs, then they need to use the "iss-sub" catch all to send events ab= out > enabling or disabling events about SPAGs. Since this is not standardiz= ed, > it could also cause proprietary and incompatible implementations. > > Atul > > On Mon, Jul 13, 2020 at 5:23 PM Mike Jones > wrote: > >> As I see it, the use cases that require a spag_id can use them when >> necessary (unless the working group decides on another way to do this) b= ut >> I certainly would oppose requiring it when it=E2=80=99s unnecessary. >> >> >> >> -- Mike >> >> >> >> *From:* Id-event *On Behalf Of *Dick Hardt >> *Sent:* Monday, July 13, 2020 5:13 PM >> *To:* Atul Tulshibagwale >> *Cc:* SecEvent >> *Subject:* Re: [Id-event] Subject Principals and Subject Principal >> Administrative Groupings >> >> >> >> Would different URLs for each relationship not solve your issue of >> maintaining secrets for each SPAG? For example: >> >> >> >> https:/example.com/secevent/SPAG_ID_1 >> >> >> >> https:/example.com/secevent/SPAG_ID_2 >> >> >> >> https:/example.com/secevent/SPAG_ID_3 >> >> >> >> Then the credential is independent of the SPAG, but we are not injecting >> an identifier (spag_id) that is only relevant to orgs that want to use t= he >> same credentials across SPAG relationships. >> >> >> >> >> >> >> >> On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale >> wrote: >> >> I am OK with making the spag_id a required claim in every subject >> identifier. For single tenanted transmitters, it would be a constant val= ue >> for all events they generate. >> >> >> >> On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt wrote: >> >> So the receiver is using authentication sometimes to determine SPAG, and >> not at other times? >> >> >> >> I'm digging into this as I had always thought of the event being between >> two parties, where they are identified by the endpoint and/or the >> credentials. >> >> >> >> Adding a relationship identifier seems to be solving the problem at the >> wrong layer, unless it is in all events. >> >> >> >> >> >> On Mon, Jul 13, 2020 at 3:54 PM Atul Tulshibagwale >> wrote: >> >> Sorry for the terse message. >> >> >> >> If a single tenant transmitter is trusted by a multi-tenanted receiver >> for a specific tenant, then the SPAG-id need not be included if the subj= ect >> is unique at the tenant level, because the receiver will automatically >> identify SPAG that the subject belongs to on its end (based on the >> authentication). >> >> >> >> >> >> >> >> On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt wrote: >> >> Which part is not required? >> >> >> >> On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale >> wrote: >> >> Not required, since the claim is optional. >> >> >> >> On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt wrote: >> >> Would a transmitter that is only in one SPAG (a single tenant system) >> have to include its SPAG id in events sent to a receiver that accepts >> events from multiple SPAGs? But it would not include it in sending event= s >> to other receivers that have separate credentials for each relationship? >> >> >> >> >> >> >> >> =E1=90=A7 >> >> >> >> On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale >> wrote: >> >> That could be true but there are a few ways in which it can be avoided: >> >> 1. The peers leverage some higher-level trust to accept / decline >> events relating to lower level SPAGs. For example, if trust is establ= ished >> at a tenant level, then an OU level SPAG need not have its own >> authorization. >> 2. The secret required for establishing the authorization of a SPAG >> may be temporary. For example: >> >> >> 1. An administrator signs in to their tenant in the transmitter's >> administrator console >> 2. The admin obtains a temporary authorization (one-time code) >> 3. The admin signs in to their tenant in the receiver's >> administration console and pastes in the one-time code >> 4. The receiver sends a request to enable the stream for the >> specified SPAG with that one-time authorization. >> >> In the first case, there are no additional secrets required. In the >> second case, the secret is temporary. >> >> >> >> >> >> >> >> On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt wrote: >> >> I see the SPAG lets the transmitter and receiver provide context, as the >> subject identifier may be the same across SPAGs. >> >> >> >> Now I'm trying to understand how the transmitter authenticates to the >> receiver if it does not have it's own secret (assuming that authenticati= on >> model) -- IE, how does the receiver know the transmitter is authorized f= or >> that SPAG? >> >> >> >> >> >> On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale >> wrote: >> >> Dick, your understanding is correct. >> >> >> >> To clarify the proposal here, Here's the text I'm proposing to be added: >> >> >> 3. Subject Principals >> >> Subject Principals are the management entities associated with >> Subjects. These may be human or robotic principals or devices or >> other entities that are managed by transmitters and receivers. For >> example, the same Subject Principal may be referred to by an email >> address or a phone number. A transmitter or receiver will typically >> manage subject principals and organize them into sub-groupings such >> as tenants, groups, organizational units, etc. >> >> Subjects are identified by Subject Identifiers defined below. >> >> 3.1. SPAGs >> >> Subject Principals MAY be grouped for administrative purposes into >> "Subject Principal Administrative Groupings" or SPAGs. For example, >> all users belonging to one customer of a "multi-tenanted" Transmitter >> may be in one SPAG. Alternatively, an Organizational Unit or a group >> of Subjects within a customer of a Transmitter (whether multi- >> tenanted or not) may be one SPAG. SPAGs may have overlapping sets of >> Subjects. >> >> A SPAG MAY be the Subject of certain stream update events defined >> later in this spec, hence is defined as a Subject Type of its own >> below.. A SPAG identifier MAY be included in other subject types to >> disambiguate the subject. >> >> A SPAG subject identifier is agreed to offline between a transmitter >> and a receiver. >> >> The benefits of doing this are: >> >> 1. Multi-tenanted hosts do not need to maintain secrets per tenant >> and per transmitter tenant if each tenant has to be an event transmit= ter >> and an event receiver of its own. >> 2. An event stream may be established between two multi-tenanted >> hosts, and so does not need to be managed at a per-tenant level >> 3. The same subject or subject principal may be a part of multiple >> SPAGs, and identifying the SPAG that an event relates to can be achie= ved if >> the standard allows for the SPAGs to be identified. >> >> >> >> >> >> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt wrote= : >> >> To clarify, your proposal is driven by the implementation burden of >> maintaining separate secrets / streams between a transmitter and receive= r? >> >> =E1=90=A7 >> >> >> >> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale > 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >> >> Hi all, >> >> Here's a quick background for the proposal >> for including Subject >> Principals and Subject Principal Administrative Groupings or SPAGs in th= e >> Subject Identifiers spec. >> >> >> >> *Use of Subject Identifiers in Shared Signals and Events*: >> >> The Shared Signals and Events (SSE) profile of SETs specifies that >> transmitters and receivers send and receive SETs that contain Subject >> Identifiers. These subject identifiers have the format that is now being >> discussed as a separate specification here. >> >> >> >> *Transmitters and Receivers in SSE* >> >> The SSE profile defines transmitters and receivers as hosts that manage >> streams between peers. The receiver authenticates to the transmitter usi= ng >> OAuth, requiring the use of a secret per receiver. In a multi-tenanted h= ost >> that handles hundreds of thousands or millions of independent tenants, >> maintaining such a secret per instance of a receiver is cumbersome. >> Furthermore, since a transmitter and a receiver has to maintain a stream >> per pair, creating such per-tenant streams can add significant >> implementation overhead. >> >> >> >> *SPAGs* >> >> Therefore, we need a notion of a grouping of subjects within the same >> transmitter and receiver to distinguish between various administrative >> groupings that exist within a host. These groupings could include tenant= s, >> organizational units or user groups.. This grouping is captured in the >> notion of a SPAG. The uniqueness of a user identifier (subject identifie= r) >> may also be limited to a SPAG. For example, if a random unique ID >> represents a user, then that ID may be unique within a SPAG and not >> universally across a transmitter or receiver. This is because each >> transmitter and receiver may have multiple connections to other >> transmitters and receivers, and ensuring uniqueness across all such peer= s >> is probably an intractable problem. >> >> >> >> *Subject Principals* >> >> While what is represented within a subject identifier may be only an >> aspect of the management entity, the administrative grouping is about th= e >> management entity itself. This could be the user, device or other princi= pal >> that the subject identifier represents. Therefore, an abstract notion of= a >> Subject Principal is also required in order specify what the grouping >> within a SPAG is about. >> >> >> >> The above is captured in the "Subject Principal" and "SPAG" sections >> within the proposed PR . >> >> >> >> Thanks, >> >> Atul >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> --00000000000080f60b05aa68db1d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Hi Atul

    If the SPAG has value in the ev= ent message, then it should be specified.

    I was pr= oposing that the SPAG be determined at the transport layer rather then the = event/message layer.

    An advantage of being in the = event is that it is independent of transport. In a multi-tenant situation, = where different components do different parts of the processing, and the or= iginal transport is no longer available, the SPAG would be always available= rather than wrapping the event to include the SPAG.





    On Tue, Jul 14, 2020 at 7:55 AM = Atul Tulshibagwale <atultulshi@= google.com> wrote:
    A few points / responses:
    1. Agree wit= h Mike that spag_id should not be a required=C2=A0claim unless it's act= ually required for every subject. So keeping it optional (if we decide to h= ave it at all) is the right thing to do.
    2. IMO it will be far simpler= for multi-tenanted hosts to use SPAGs rather than manage multiple event st= reams (i.e. one per tenant)
    3. A multi-tenanted architecture is increa= singly very common, so this will apply to a large number of organizations.<= /li>
    4. For single tenanted transmitters, the SPAG id may be inferred by re= ceivers. Single tenanted receivers may ignore the SPAG ids in the subjects.= So processing SPAGs in hybrid situations does not appear to be cumbersome.=
    5. The use of SPAGs is not limited to tenant-level information, since= it may be applied to OUs or groups
    6. If we agree that SPAG is a &quo= t;meta concept" that applies in most situations, then capturing it in = the spec is probably important. What Dick is proposing is a way to implemen= t SPAGs without specifying them in a standard, so each entity is free to de= fine it the way they want. This approach can cause incompatibilities.
      7. <= li>Without SPAGs in the spec, if peers need to send events about SPAGs, the= n they need to use the "iss-sub" catch all to send events about e= nabling or disabling events about SPAGs. Since this is not standardized, it= could also cause proprietary and incompatible implementations.
    Atul

    On Mon, Jul 13, 2020 at 5:23 PM Mike Jones <Michael.Jones@mic= rosoft.com> wrote:

    As I see it, the = use cases that require a spag_id can use them when necessary (unless the wo= rking group decides on another way to do this) but I certainly would oppose= requiring it when it=E2=80=99s unnecessary.

    =C2=A0<= /u>

    =C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0<= /u>

    From: Id-event <id-event-bounces@ietf.org> O= n Behalf Of Dick Hardt
    Sent: Monday, July 13, 2020 5:13 PM
    To: Atul Tulshibagwale <atultulshi@google.com>
    Cc: SecEvent <id-event@ietf.org>
    Subject: Re: [Id-event] Subject Principals and Subject Principal Adm= inistrative Groupings

    =C2=A0

    Would different URLs for each relationship not solve= your issue of maintaining secrets for each SPAG? For example:

    =C2=A0

    =C2=A0

    =C2=A0

    Then the credential is independent=C2=A0of the SPAG,= but we are not injecting an identifier (spag_id) that is only relevant=C2= =A0to orgs that want to use the same credentials across SPAG relationships.=

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale &= lt;atultulshi@go= ogle.com> wrote:

    I am OK with making the spag_id a required claim in = every subject identifier. For single tenanted transmitters, it would be a c= onstant value for all events they generate.

    =C2=A0

    On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    So the receiver is using authentication sometimes to= determine SPAG, and not at other times?

    =C2=A0

    I'm digging into this as I had always thought of= the event being between two parties, where they are identified=C2=A0by the= endpoint and/or the credentials.

    =C2=A0

    Adding a relationship identifier seems to be solving= the problem at the wrong layer, unless it is in all events.<= /p>

    =C2=A0

    =C2=A0

    Sorry for the terse message.

    =C2=A0

    If a single tenant transmitter is trusted by a multi= -tenanted receiver for a specific tenant, then the SPAG-id need not be incl= uded if the subject is unique at the tenant level, because the receiver wil= l automatically identify SPAG that the subject belongs to on its end (based on the authentication).=

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    Which part is not required?

    =C2=A0

    Not required, since the claim is optional.=

    =C2=A0

    On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    Would a transmitter that is only in one SPAG (a sing= le tenant system) have to include its SPAG id in events sent to a receiver = that accepts events from multiple SPAGs? But it would not include it in sen= ding events to other receivers=C2=A0that have separate credentials for each relationship?

    =C2=A0

    =C2=A0

    =C2=A0

    =E1=90=A7

    =C2=A0

    That could be true but there are a few ways in which= it can be avoided:

    1. The peers leverage some higher-level trust to accept / decline events relat= ing to lower level SPAGs. For example, if trust is established at a tenant = level, then an OU level SPAG need not have its own authorization.=
    2. The secret required for establishing the authorization of a SPAG may be tem= porary. For example:
      1. An administrator signs in to their tenant in the transmitter's administ= rator console
      2. The admin obtains a temporary authorization (one-time code)
      3. The admin signs in to their tenant in the receiver's administration con= sole and pastes in the one-time code
      4. The receiver sends a request to enable the stream for the specified SPAG wi= th that one-time authorization.

    In the first case, there are no additional secrets r= equired. In the second case, the secret is temporary.

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    I see the SPAG lets the transmitter and receiver pro= vide context, as the subject identifier may be the same across SPAGs.

    =C2=A0

    Now I'm trying to understand how the transmitter= authenticates to the receiver if it does not have it's own secret (ass= uming that authentication model) -- IE, how does the receiver know the tran= smitter is authorized=C2=A0for that SPAG?

    =C2=A0

    =C2=A0

    Dick, your understanding is correct.

    =C2=A0

    To clarify the proposal here, Here's the text I&= #39;m proposing to be added:


    3.=C2=A0 Subject Princi= pals

    =C2=A0 =C2=A0Subject Principals are the management entities associated with=
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or robotic principals or de= vices or
    =C2=A0 =C2=A0other entities that are managed by transmitters and receivers.= =C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Principal may be referred to by an e= mail
    =C2=A0 =C2=A0address or a phone number.=C2=A0 A transmitter or receiver wil= l typically
    =C2=A0 =C2=A0manage subject principals and organize them into sub-groupings= such
    =C2=A0 =C2=A0as tenants, groups, organizational units, etc.

    =C2=A0 =C2=A0Subjects are identified by Subject Identifiers defined below.<= br>
    3.1.=C2=A0 SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be grouped for administrative purposes = into
    =C2=A0 =C2=A0"Subject Principal Administrative Groupings" or SPAG= s.=C2=A0 For example,
    =C2=A0 =C2=A0all users belonging to one customer of a "multi-tenanted&= quot; Transmitter
    =C2=A0 =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organizational Uni= t or a group
    =C2=A0 =C2=A0of Subjects within a customer of a Transmitter (whether multi-=
    =C2=A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs may have overlap= ping sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A SPAG MAY be the Subject of certain stream update events defi= ned
    =C2=A0 =C2=A0later in this spec, hence is defined as a Subject Type of its = own
    =C2=A0 =C2=A0below..=C2=A0 A SPAG identifier MAY be included in other subje= ct types to
    =C2=A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2=A0A SPAG subject identifier is agreed to offline between a trans= mitter
    =C2=A0 =C2=A0and a receiver.

    The benefits of doing this are:

    1. Multi-tenanted hosts do not need to maintain secrets per tenant and per tra= nsmitter tenant if each tenant has to be an event transmitter and an event = receiver of its own.
    2. An event stream may be established between two multi-tenanted hosts, and so= does not need to be managed at a per-tenant level
    3. The same subject or subject principal may be a part of multiple SPAGs, and = identifying the SPAG that an event relates to can be achieved if the standa= rd allows for the SPAGs to be identified.

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt <dick.hardt@gmail.com<= /a>> wrote:

    To clarify, your proposal is driven by the implement= ation=C2=A0burden of maintaining separate secrets / streams between a trans= mitter and receiver?

    =E1=90=A7

    =C2=A0

    Hi all,=C2=A0

    Here's a quick background for the proposal for including Subject Principals and Subject Principal Adminis= trative Groupings or SPAGs in the Subject Identifiers spec.

    =C2=A0

    Use of Subject Identifiers in Shared Signals and = Events:

    The Shared Signals and Events (SSE) profile of SETs = specifies that transmitters and receivers send and receive SETs that contai= n Subject Identifiers. These subject identifiers have the format that is no= w being discussed as a separate specification here.

    =C2=A0

    Transmitters and Receivers in SSE

    The SSE profile defines transmitters and receivers a= s hosts that manage streams between peers. The receiver authenticates to th= e transmitter using OAuth, requiring the use of a secret per receiver. In a= multi-tenanted host that handles hundreds of thousands or millions of independent tenants, maintaining such= a secret per instance of a receiver is cumbersome. Furthermore, since a tr= ansmitter and a receiver has to maintain a stream per pair, creating such p= er-tenant streams can add significant implementation overhead.

    =C2=A0

    SPAGs

    Therefore, we need a notion of a grouping of subject= s within the same transmitter and receiver to distinguish between various a= dministrative groupings that exist within a host. These groupings could inc= lude tenants, organizational units or user groups.. This grouping is captured in the notion of a SPAG. The un= iqueness of a user identifier (subject identifier) may also be limited to a= SPAG. For example, if a random unique ID represents a user, then that ID m= ay be unique within a SPAG and not universally across a transmitter or receiver. This is because each transmi= tter and receiver may have multiple connections to other transmitters and r= eceivers, and ensuring uniqueness across all such peers is probably an intr= actable problem.

    =C2=A0

    Subject Principals

    While what is represented within a subject identifie= r may be only an aspect of the management entity, the administrative groupi= ng is about the management entity itself. This could be the user, device or= other principal that the subject identifier represents. Therefore, an abstract notion of a Subject Principa= l is also required in order specify what the grouping within a SPAG is abou= t.

    =C2=A0

    The above is captured in the "Subject Principal= " and "SPAG" sections within the proposed P= R.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    --00000000000080f60b05aa68db1d-- From nobody Tue Jul 14 09:25:20 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3677D3A0A02 for ; Tue, 14 Jul 2020 09:25:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DjiNHSdEIR6M for ; Tue, 14 Jul 2020 09:25:15 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640130.outbound.protection.outlook.com [40.107.64.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD20E3A09F1 for ; Tue, 14 Jul 2020 09:25:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=S7tYUaczUsyhtcB5BxZO5UiSI+RbMeRKX5vUWold9Pz0UMPkZ4/nfxBcLokbfcpelUpRPPdJ0AYL84puQ2jKwxK3B8jF363J2VrReYdoMeFF9cAIDIcIDRAcuzJswXZDLIDE594lpiyuRev270i5MbeOCpeiqC8wmNxYo0piAAgrids69uDNjt1Tkc1PjhApzhtiZe8ePY3G67kXRS3Odqt8cAjZTYNWdcSWjgd2TJ/r8BYuzOzSXD+zdnvbF/e6t+J+JpkBH6Zot379nbW8BAygVgdf86LQ3WdELApfzQjakqnAgn2VpOwmrdf5V7cUjAWlaPr24qvdhlOyNYdxkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lfl4f+xLO1GByFcSuc2tQePZqMjC7kqFvzyLO0ZpAJ0=; b=WEdArwgn96ruaIsXZFqh2eENPMhqb4FkkaVfEtAZz43Xyi7ZIvNUeXl7Ng3frER3wGvTg4KomG0wpnt1WrsScmdyD/we91kQ1z/S3xkpCWZwQt68mT3CYrqc1XnKJD5pYQG8Fpi4lTk29hJN9U1K1vDZFULpHyxbKYxsGWVIV+y6APrnuvc4p4S8LCUD44O6nB0DHz7idi/YPqr+A7ELIKZtW5QdpEEoPNrGvfFFDVidIHIpuY91Vtxw1Himn8OyC/MNP/YCnnoG0+xIqElfW1Lz+czyaFKWm/CsEr623SmCnucM/wjRcIFJ5LqRscmDt4rgu/UBhOxfH8Uba4pO8g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lfl4f+xLO1GByFcSuc2tQePZqMjC7kqFvzyLO0ZpAJ0=; b=WaiUDWgS0TnwsXymo3kvhO1ree32T9fKWHKc5NDfQoU88WSra2MdoLw8KuNN0GKkNMW/MDlyb0eHT6Ga0OWftLTLqY89xrghJ12e1Akfwc3IobHtExPywwyO5c8l8zsHbJGmv8Ar+oLU2vZx2XZguLiadJ4Ie38cVk18SNgDC+Y= Received: from CH2PR00MB0678.namprd00.prod.outlook.com (2603:10b6:610:a9::23) by CH2PR00MB0841.namprd00.prod.outlook.com (2603:10b6:610:6f::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3233.0; Tue, 14 Jul 2020 16:25:11 +0000 Received: from CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::29f8:dc4a:8aac:e889]) by CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::29f8:dc4a:8aac:e889%8]) with mapi id 15.20.3234.000; Tue, 14 Jul 2020 16:25:11 +0000 From: Mike Jones To: Dick Hardt , Atul Tulshibagwale CC: SecEvent Thread-Topic: [Id-event] Subject Principals and Subject Principal Administrative Groupings Thread-Index: AdZZ+1cArGBwTIiWSue74LSj8NaQfQ== Date: Tue, 14 Jul 2020 16:25:11 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-14T16:23:01Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=c5f97369-6d21-44ac-8a0c-a14c1bac28b7; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 4ba0b3fe-73c7-4132-cf7b-08d828127b7c x-ms-traffictypediagnostic: CH2PR00MB0841: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Qreo+00ZxRpIW3B7QyQcWwuY0dEN1RCh6NLGa3eQksLq1jJIy4iD26svFKw6ltvsudGCT3jVxqRu380UaQDAti1+OKLpsy5XI4DXq7Gje4NDSr9y5vGfavbslSi4ZEvwxyQ9nfN6V9gCFW5jJ3v4BtPlf2iBVzd5oU5qxhqmikUnXi5FYt0e8YGRdVKii0DHX622fGygHdrCA1w2xqjG3R0pR6KHrDwEH8OR8Z2smvB8LO3fnM2kb6yZjyIdPIbYEJU4cgVVVz/frJk7OzeAnrgNlzxmzur+hINvpGZEFxib7tPE6aRhuMob8o8LEl8UfGiHH2FcTLneOCQfIiIHCdqbrARYYQhSaXyN3CXtffWPhrNt48yCeW5dUvP2g26mjFvwY9pGTqNfQpy9TarUb816r8n35/QTD+M2+UGxf9RW+OmmeZK39szv6Icx9sJ+Ame8qibltMkkvlK5YNCUtA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR00MB0678.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(396003)(136003)(346002)(376002)(366004)(82960400001)(82950400001)(8936002)(7696005)(52536014)(71200400001)(53546011)(6506007)(10290500003)(4326008)(55016002)(110136005)(9686003)(8676002)(8990500004)(186003)(76236003)(83380400001)(478600001)(966005)(86362001)(5660300002)(166002)(33656002)(2906002)(66946007)(30864003)(76116006)(26005)(66476007)(64756008)(66446008)(316002)(66556008)(99710200001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: mEDza6cPH1gyW1C6LM1HrBeV857qlNODVZs6TqO04VkZDaP5hcjMGjQRZtLC1Fz0oCBBexvXVdVDDG22bK6J7RlV3Ny6LzBPpke6a/bfBsnZzkppwle0msaN1txUzYgxr5R5RnNJgZ4Xg94Oe4CyBzE+7BHJJoP6r1NSq9Gr3vOx0UUyZZFqVDlp03tlCPDUgxEuGKqiIN0ClRrJQp4HRMxfRSITW1YYG58xa5HILllup1xXU71kcDQc2xnIhQ1aOBEqhPlsDFwKj/EH0xYeDcNSvyyfzgicgAtSGlSlTGZ2Q1zmvYUGaRotj38hQu32CsCDgiN5UZT6wK6njvpAWhUyId5Gs0Ge5nz0zZwnNhXnC7VC5TMkKkddaqStESjaOiAjfviXMN7MXPkNFcmSP6BDbbNBi+GglaPsiIWTt+tiazdL61Z+hsxhWhm9HhOuAdb0zHVSYOLdkmwbqn/Dxi8WKe7BUFvuTI7LF1HS83mbr9/MhJMscM/re4awn1I52njm4v2igzSI1aIOW6q9VEPndXfJjTnYEOMmJJ18Fmsl5o1Mbyh8y7DnlHvifP3+bfuLbn9LAjoPPT720LNLpaxSMj8zzyw3JBGcjuHwGn4akhdkI89tdfTuLlS+bKVh+9/SiLMAxQFKQuP5Xy1gXg== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR00MB067812E3F5D58E5B1F029137F5610CH2PR00MB0678namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CH2PR00MB0678.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4ba0b3fe-73c7-4132-cf7b-08d828127b7c X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2020 16:25:11.7840 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: f1xzXjeNdxT6VxjWFN9MZMFPZ94lb3yTU1Qrt4eDebnykH089EXF+GTpEY60OYca46vvE29LWnydu167rI8/Sg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0841 Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 16:25:18 -0000 --_000_CH2PR00MB067812E3F5D58E5B1F029137F5610CH2PR00MB0678namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBhZ3JlZSB3aXRoIERpY2sgdGhhdCBhIGtleSBxdWVzdGlvbiBpcyB3aGV0aGVyIHRoZSBTUEFH IGJlbG9uZ3MgaW4gdGhlIGV2ZW50IG9yIGluIHRoZSBzdWJqZWN0IGlkZW50aWZpZXIuDQoNCk5v dGUgdGhhdCB0aGlzIHNwZWNpZmljYXRpb24gY291bGQgc3RpbGwgZGVmaW5lIGEgU1BBRyBmb3Ig aW5jbHVzaW9uIGluIFNFVCBldmVudHMsIGV2ZW4gdGhvdWdoIGl0cyBwcmltYXJ5IHB1cnBvc2Ug aXMgZGVmaW5pbmcgc3ViamVjdCBpZGVudGlmaWVycyBmb3IgdXNlIGluIFNFVHMuDQoNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtl DQoNCkZyb206IERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21haWwuY29tPg0KU2VudDogVHVlc2Rh eSwgSnVseSAxNCwgMjAyMCA4OjU2IEFNDQpUbzogQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVs c2hpQGdvb2dsZS5jb20+DQpDYzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPjsgU2VjRXZlbnQgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVu dF0gU3ViamVjdCBQcmluY2lwYWxzIGFuZCBTdWJqZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJhdGl2 ZSBHcm91cGluZ3MNCg0KSGkgQXR1bA0KDQpJZiB0aGUgU1BBRyBoYXMgdmFsdWUgaW4gdGhlIGV2 ZW50IG1lc3NhZ2UsIHRoZW4gaXQgc2hvdWxkIGJlIHNwZWNpZmllZC4NCg0KSSB3YXMgcHJvcG9z aW5nIHRoYXQgdGhlIFNQQUcgYmUgZGV0ZXJtaW5lZCBhdCB0aGUgdHJhbnNwb3J0IGxheWVyIHJh dGhlciB0aGVuIHRoZSBldmVudC9tZXNzYWdlIGxheWVyLg0KDQpBbiBhZHZhbnRhZ2Ugb2YgYmVp bmcgaW4gdGhlIGV2ZW50IGlzIHRoYXQgaXQgaXMgaW5kZXBlbmRlbnQgb2YgdHJhbnNwb3J0LiBJ biBhIG11bHRpLXRlbmFudCBzaXR1YXRpb24sIHdoZXJlIGRpZmZlcmVudCBjb21wb25lbnRzIGRv IGRpZmZlcmVudCBwYXJ0cyBvZiB0aGUgcHJvY2Vzc2luZywgYW5kIHRoZSBvcmlnaW5hbCB0cmFu c3BvcnQgaXMgbm8gbG9uZ2VyIGF2YWlsYWJsZSwgdGhlIFNQQUcgd291bGQgYmUgYWx3YXlzIGF2 YWlsYWJsZSByYXRoZXIgdGhhbiB3cmFwcGluZyB0aGUgZXZlbnQgdG8gaW5jbHVkZSB0aGUgU1BB Ry4NCg0KDQoNCg0KDQpPbiBUdWUsIEp1bCAxNCwgMjAyMCBhdCA3OjU1IEFNIEF0dWwgVHVsc2hp YmFnd2FsZSA8YXR1bHR1bHNoaUBnb29nbGUuY29tPG1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5j b20+PiB3cm90ZToNCkEgZmV3IHBvaW50cyAvIHJlc3BvbnNlczoNCg0KICAxLiAgQWdyZWUgd2l0 aCBNaWtlIHRoYXQgc3BhZ19pZCBzaG91bGQgbm90IGJlIGEgcmVxdWlyZWQgY2xhaW0gdW5sZXNz IGl0J3MgYWN0dWFsbHkgcmVxdWlyZWQgZm9yIGV2ZXJ5IHN1YmplY3QuIFNvIGtlZXBpbmcgaXQg b3B0aW9uYWwgKGlmIHdlIGRlY2lkZSB0byBoYXZlIGl0IGF0IGFsbCkgaXMgdGhlIHJpZ2h0IHRo aW5nIHRvIGRvLg0KICAyLiAgSU1PIGl0IHdpbGwgYmUgZmFyIHNpbXBsZXIgZm9yIG11bHRpLXRl bmFudGVkIGhvc3RzIHRvIHVzZSBTUEFHcyByYXRoZXIgdGhhbiBtYW5hZ2UgbXVsdGlwbGUgZXZl bnQgc3RyZWFtcyAoaS5lLiBvbmUgcGVyIHRlbmFudCkNCiAgMy4gIEEgbXVsdGktdGVuYW50ZWQg YXJjaGl0ZWN0dXJlIGlzIGluY3JlYXNpbmdseSB2ZXJ5IGNvbW1vbiwgc28gdGhpcyB3aWxsIGFw cGx5IHRvIGEgbGFyZ2UgbnVtYmVyIG9mIG9yZ2FuaXphdGlvbnMuDQogIDQuICBGb3Igc2luZ2xl IHRlbmFudGVkIHRyYW5zbWl0dGVycywgdGhlIFNQQUcgaWQgbWF5IGJlIGluZmVycmVkIGJ5IHJl Y2VpdmVycy4gU2luZ2xlIHRlbmFudGVkIHJlY2VpdmVycyBtYXkgaWdub3JlIHRoZSBTUEFHIGlk cyBpbiB0aGUgc3ViamVjdHMuIFNvIHByb2Nlc3NpbmcgU1BBR3MgaW4gaHlicmlkIHNpdHVhdGlv bnMgZG9lcyBub3QgYXBwZWFyIHRvIGJlIGN1bWJlcnNvbWUuDQogIDUuICBUaGUgdXNlIG9mIFNQ QUdzIGlzIG5vdCBsaW1pdGVkIHRvIHRlbmFudC1sZXZlbCBpbmZvcm1hdGlvbiwgc2luY2UgaXQg bWF5IGJlIGFwcGxpZWQgdG8gT1VzIG9yIGdyb3Vwcw0KICA2LiAgSWYgd2UgYWdyZWUgdGhhdCBT UEFHIGlzIGEgIm1ldGEgY29uY2VwdCIgdGhhdCBhcHBsaWVzIGluIG1vc3Qgc2l0dWF0aW9ucywg dGhlbiBjYXB0dXJpbmcgaXQgaW4gdGhlIHNwZWMgaXMgcHJvYmFibHkgaW1wb3J0YW50LiBXaGF0 IERpY2sgaXMgcHJvcG9zaW5nIGlzIGEgd2F5IHRvIGltcGxlbWVudCBTUEFHcyB3aXRob3V0IHNw ZWNpZnlpbmcgdGhlbSBpbiBhIHN0YW5kYXJkLCBzbyBlYWNoIGVudGl0eSBpcyBmcmVlIHRvIGRl ZmluZSBpdCB0aGUgd2F5IHRoZXkgd2FudC4gVGhpcyBhcHByb2FjaCBjYW4gY2F1c2UgaW5jb21w YXRpYmlsaXRpZXMuDQogIDcuICBXaXRob3V0IFNQQUdzIGluIHRoZSBzcGVjLCBpZiBwZWVycyBu ZWVkIHRvIHNlbmQgZXZlbnRzIGFib3V0IFNQQUdzLCB0aGVuIHRoZXkgbmVlZCB0byB1c2UgdGhl ICJpc3Mtc3ViIiBjYXRjaCBhbGwgdG8gc2VuZCBldmVudHMgYWJvdXQgZW5hYmxpbmcgb3IgZGlz YWJsaW5nIGV2ZW50cyBhYm91dCBTUEFHcy4gU2luY2UgdGhpcyBpcyBub3Qgc3RhbmRhcmRpemVk LCBpdCBjb3VsZCBhbHNvIGNhdXNlIHByb3ByaWV0YXJ5IGFuZCBpbmNvbXBhdGlibGUgaW1wbGVt ZW50YXRpb25zLg0KQXR1bA0KDQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCA1OjIzIFBNIE1pa2Ug Sm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tPj4gd3JvdGU6DQpBcyBJIHNlZSBpdCwgdGhlIHVzZSBjYXNlcyB0aGF0IHJl cXVpcmUgYSBzcGFnX2lkIGNhbiB1c2UgdGhlbSB3aGVuIG5lY2Vzc2FyeSAodW5sZXNzIHRoZSB3 b3JraW5nIGdyb3VwIGRlY2lkZXMgb24gYW5vdGhlciB3YXkgdG8gZG8gdGhpcykgYnV0IEkgY2Vy dGFpbmx5IHdvdWxkIG9wcG9zZSByZXF1aXJpbmcgaXQgd2hlbiBpdOKAmXMgdW5uZWNlc3Nhcnku DQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAtLSBNaWtlDQoNCkZyb206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPG1h aWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIERpY2sgSGFyZHQN ClNlbnQ6IE1vbmRheSwgSnVseSAxMywgMjAyMCA1OjEzIFBNDQpUbzogQXR1bCBUdWxzaGliYWd3 YWxlIDxhdHVsdHVsc2hpQGdvb2dsZS5jb208bWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbT4+ DQpDYzogU2VjRXZlbnQgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9y Zz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBTdWJqZWN0IFByaW5jaXBhbHMgYW5kIFN1Ympl Y3QgUHJpbmNpcGFsIEFkbWluaXN0cmF0aXZlIEdyb3VwaW5ncw0KDQpXb3VsZCBkaWZmZXJlbnQg VVJMcyBmb3IgZWFjaCByZWxhdGlvbnNoaXAgbm90IHNvbHZlIHlvdXIgaXNzdWUgb2YgbWFpbnRh aW5pbmcgc2VjcmV0cyBmb3IgZWFjaCBTUEFHPyBGb3IgZXhhbXBsZToNCg0KaHR0cHM6L2V4YW1w bGUuY29tL3NlY2V2ZW50L1NQQUdfSURfMTxodHRwOi8vZXhhbXBsZS5jb20vc2VjZXZlbnQvU1BB R19JRF8xPg0KDQpodHRwczovZXhhbXBsZS5jb20vc2VjZXZlbnQvU1BBR19JRF8yPGh0dHA6Ly9l eGFtcGxlLmNvbS9zZWNldmVudC9TUEFHX0lEXzI+DQoNCmh0dHBzOi9leGFtcGxlLmNvbS9zZWNl dmVudC9TUEFHX0lEXzM8aHR0cDovL2V4YW1wbGUuY29tL3NlY2V2ZW50L1NQQUdfSURfMz4NCg0K VGhlbiB0aGUgY3JlZGVudGlhbCBpcyBpbmRlcGVuZGVudCBvZiB0aGUgU1BBRywgYnV0IHdlIGFy ZSBub3QgaW5qZWN0aW5nIGFuIGlkZW50aWZpZXIgKHNwYWdfaWQpIHRoYXQgaXMgb25seSByZWxl dmFudCB0byBvcmdzIHRoYXQgd2FudCB0byB1c2UgdGhlIHNhbWUgY3JlZGVudGlhbHMgYWNyb3Nz IFNQQUcgcmVsYXRpb25zaGlwcy4NCg0KDQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDU6MDgg UE0gQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpQGdvb2dsZS5jb208bWFpbHRvOmF0dWx0 dWxzaGlAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KSSBhbSBPSyB3aXRoIG1ha2luZyB0aGUgc3BhZ19p ZCBhIHJlcXVpcmVkIGNsYWltIGluIGV2ZXJ5IHN1YmplY3QgaWRlbnRpZmllci4gRm9yIHNpbmds ZSB0ZW5hbnRlZCB0cmFuc21pdHRlcnMsIGl0IHdvdWxkIGJlIGEgY29uc3RhbnQgdmFsdWUgZm9y IGFsbCBldmVudHMgdGhleSBnZW5lcmF0ZS4NCg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgNDow MSBQTSBEaWNrIEhhcmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNvbTxtYWlsdG86ZGljay5oYXJkdEBn bWFpbC5jb20+PiB3cm90ZToNClNvIHRoZSByZWNlaXZlciBpcyB1c2luZyBhdXRoZW50aWNhdGlv biBzb21ldGltZXMgdG8gZGV0ZXJtaW5lIFNQQUcsIGFuZCBub3QgYXQgb3RoZXIgdGltZXM/DQoN CkknbSBkaWdnaW5nIGludG8gdGhpcyBhcyBJIGhhZCBhbHdheXMgdGhvdWdodCBvZiB0aGUgZXZl bnQgYmVpbmcgYmV0d2VlbiB0d28gcGFydGllcywgd2hlcmUgdGhleSBhcmUgaWRlbnRpZmllZCBi eSB0aGUgZW5kcG9pbnQgYW5kL29yIHRoZSBjcmVkZW50aWFscy4NCg0KQWRkaW5nIGEgcmVsYXRp b25zaGlwIGlkZW50aWZpZXIgc2VlbXMgdG8gYmUgc29sdmluZyB0aGUgcHJvYmxlbSBhdCB0aGUg d3JvbmcgbGF5ZXIsIHVubGVzcyBpdCBpcyBpbiBhbGwgZXZlbnRzLg0KDQoNCk9uIE1vbiwgSnVs IDEzLCAyMDIwIGF0IDM6NTQgUE0gQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpQGdvb2ds ZS5jb208bWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KU29ycnkgZm9yIHRo ZSB0ZXJzZSBtZXNzYWdlLg0KDQpJZiBhIHNpbmdsZSB0ZW5hbnQgdHJhbnNtaXR0ZXIgaXMgdHJ1 c3RlZCBieSBhIG11bHRpLXRlbmFudGVkIHJlY2VpdmVyIGZvciBhIHNwZWNpZmljIHRlbmFudCwg dGhlbiB0aGUgU1BBRy1pZCBuZWVkIG5vdCBiZSBpbmNsdWRlZCBpZiB0aGUgc3ViamVjdCBpcyB1 bmlxdWUgYXQgdGhlIHRlbmFudCBsZXZlbCwgYmVjYXVzZSB0aGUgcmVjZWl2ZXIgd2lsbCBhdXRv bWF0aWNhbGx5IGlkZW50aWZ5IFNQQUcgdGhhdCB0aGUgc3ViamVjdCBiZWxvbmdzIHRvIG9uIGl0 cyBlbmQgKGJhc2VkIG9uIHRoZSBhdXRoZW50aWNhdGlvbikuDQoNCg0KDQpPbiBNb24sIEp1bCAx MywgMjAyMCBhdCAzOjM3IFBNIERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21haWwuY29tPG1haWx0 bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+IHdyb3RlOg0KV2hpY2ggcGFydCBpcyBub3QgcmVxdWly ZWQ/DQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDM6MzMgUE0gQXR1bCBUdWxzaGliYWd3YWxl IDxhdHVsdHVsc2hpQGdvb2dsZS5jb208bWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbT4+IHdy b3RlOg0KTm90IHJlcXVpcmVkLCBzaW5jZSB0aGUgY2xhaW0gaXMgb3B0aW9uYWwuDQoNCk9uIE1v biwgSnVsIDEzLCAyMDIwIGF0IDM6MjUgUE0gRGljayBIYXJkdCA8ZGljay5oYXJkdEBnbWFpbC5j b208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tPj4gd3JvdGU6DQpXb3VsZCBhIHRyYW5zbWl0 dGVyIHRoYXQgaXMgb25seSBpbiBvbmUgU1BBRyAoYSBzaW5nbGUgdGVuYW50IHN5c3RlbSkgaGF2 ZSB0byBpbmNsdWRlIGl0cyBTUEFHIGlkIGluIGV2ZW50cyBzZW50IHRvIGEgcmVjZWl2ZXIgdGhh dCBhY2NlcHRzIGV2ZW50cyBmcm9tIG11bHRpcGxlIFNQQUdzPyBCdXQgaXQgd291bGQgbm90IGlu Y2x1ZGUgaXQgaW4gc2VuZGluZyBldmVudHMgdG8gb3RoZXIgcmVjZWl2ZXJzIHRoYXQgaGF2ZSBz ZXBhcmF0ZSBjcmVkZW50aWFscyBmb3IgZWFjaCByZWxhdGlvbnNoaXA/DQoNCg0KDQrhkKcNCg0K T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMzowNSBQTSBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0 dWxzaGlAZ29vZ2xlLmNvbTxtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tPj4gd3JvdGU6DQpU aGF0IGNvdWxkIGJlIHRydWUgYnV0IHRoZXJlIGFyZSBhIGZldyB3YXlzIGluIHdoaWNoIGl0IGNh biBiZSBhdm9pZGVkOg0KDQogIDEuICBUaGUgcGVlcnMgbGV2ZXJhZ2Ugc29tZSBoaWdoZXItbGV2 ZWwgdHJ1c3QgdG8gYWNjZXB0IC8gZGVjbGluZSBldmVudHMgcmVsYXRpbmcgdG8gbG93ZXIgbGV2 ZWwgU1BBR3MuIEZvciBleGFtcGxlLCBpZiB0cnVzdCBpcyBlc3RhYmxpc2hlZCBhdCBhIHRlbmFu dCBsZXZlbCwgdGhlbiBhbiBPVSBsZXZlbCBTUEFHIG5lZWQgbm90IGhhdmUgaXRzIG93biBhdXRo b3JpemF0aW9uLg0KICAyLiAgVGhlIHNlY3JldCByZXF1aXJlZCBmb3IgZXN0YWJsaXNoaW5nIHRo ZSBhdXRob3JpemF0aW9uIG9mIGEgU1BBRyBtYXkgYmUgdGVtcG9yYXJ5LiBGb3IgZXhhbXBsZToN Cg0KICAgICAqICAgQW4gYWRtaW5pc3RyYXRvciBzaWducyBpbiB0byB0aGVpciB0ZW5hbnQgaW4g dGhlIHRyYW5zbWl0dGVyJ3MgYWRtaW5pc3RyYXRvciBjb25zb2xlDQogICAgICogICBUaGUgYWRt aW4gb2J0YWlucyBhIHRlbXBvcmFyeSBhdXRob3JpemF0aW9uIChvbmUtdGltZSBjb2RlKQ0KICAg ICAqICAgVGhlIGFkbWluIHNpZ25zIGluIHRvIHRoZWlyIHRlbmFudCBpbiB0aGUgcmVjZWl2ZXIn cyBhZG1pbmlzdHJhdGlvbiBjb25zb2xlIGFuZCBwYXN0ZXMgaW4gdGhlIG9uZS10aW1lIGNvZGUN CiAgICAgKiAgIFRoZSByZWNlaXZlciBzZW5kcyBhIHJlcXVlc3QgdG8gZW5hYmxlIHRoZSBzdHJl YW0gZm9yIHRoZSBzcGVjaWZpZWQgU1BBRyB3aXRoIHRoYXQgb25lLXRpbWUgYXV0aG9yaXphdGlv bi4NCkluIHRoZSBmaXJzdCBjYXNlLCB0aGVyZSBhcmUgbm8gYWRkaXRpb25hbCBzZWNyZXRzIHJl cXVpcmVkLiBJbiB0aGUgc2Vjb25kIGNhc2UsIHRoZSBzZWNyZXQgaXMgdGVtcG9yYXJ5Lg0KDQoN Cg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMjozNCBQTSBEaWNrIEhhcmR0IDxkaWNrLmhhcmR0 QGdtYWlsLmNvbTxtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20+PiB3cm90ZToNCkkgc2VlIHRo ZSBTUEFHIGxldHMgdGhlIHRyYW5zbWl0dGVyIGFuZCByZWNlaXZlciBwcm92aWRlIGNvbnRleHQs IGFzIHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgbWF5IGJlIHRoZSBzYW1lIGFjcm9zcyBTUEFHcy4N Cg0KTm93IEknbSB0cnlpbmcgdG8gdW5kZXJzdGFuZCBob3cgdGhlIHRyYW5zbWl0dGVyIGF1dGhl bnRpY2F0ZXMgdG8gdGhlIHJlY2VpdmVyIGlmIGl0IGRvZXMgbm90IGhhdmUgaXQncyBvd24gc2Vj cmV0IChhc3N1bWluZyB0aGF0IGF1dGhlbnRpY2F0aW9uIG1vZGVsKSAtLSBJRSwgaG93IGRvZXMg dGhlIHJlY2VpdmVyIGtub3cgdGhlIHRyYW5zbWl0dGVyIGlzIGF1dGhvcml6ZWQgZm9yIHRoYXQg U1BBRz8NCg0KDQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCAyOjA4IFBNIEF0dWwgVHVsc2hpYmFn d2FsZSA8YXR1bHR1bHNoaUBnb29nbGUuY29tPG1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5jb20+ PiB3cm90ZToNCkRpY2ssIHlvdXIgdW5kZXJzdGFuZGluZyBpcyBjb3JyZWN0Lg0KDQpUbyBjbGFy aWZ5IHRoZSBwcm9wb3NhbCBoZXJlLCBIZXJlJ3MgdGhlIHRleHQgSSdtIHByb3Bvc2luZyB0byBi ZSBhZGRlZDoNCg0KMy4gIFN1YmplY3QgUHJpbmNpcGFscw0KDQogICBTdWJqZWN0IFByaW5jaXBh bHMgYXJlIHRoZSBtYW5hZ2VtZW50IGVudGl0aWVzIGFzc29jaWF0ZWQgd2l0aA0KICAgU3ViamVj dHMuICBUaGVzZSBtYXkgYmUgaHVtYW4gb3Igcm9ib3RpYyBwcmluY2lwYWxzIG9yIGRldmljZXMg b3INCiAgIG90aGVyIGVudGl0aWVzIHRoYXQgYXJlIG1hbmFnZWQgYnkgdHJhbnNtaXR0ZXJzIGFu ZCByZWNlaXZlcnMuICBGb3INCiAgIGV4YW1wbGUsIHRoZSBzYW1lIFN1YmplY3QgUHJpbmNpcGFs IG1heSBiZSByZWZlcnJlZCB0byBieSBhbiBlbWFpbA0KICAgYWRkcmVzcyBvciBhIHBob25lIG51 bWJlci4gIEEgdHJhbnNtaXR0ZXIgb3IgcmVjZWl2ZXIgd2lsbCB0eXBpY2FsbHkNCiAgIG1hbmFn ZSBzdWJqZWN0IHByaW5jaXBhbHMgYW5kIG9yZ2FuaXplIHRoZW0gaW50byBzdWItZ3JvdXBpbmdz IHN1Y2gNCiAgIGFzIHRlbmFudHMsIGdyb3Vwcywgb3JnYW5pemF0aW9uYWwgdW5pdHMsIGV0Yy4N Cg0KICAgU3ViamVjdHMgYXJlIGlkZW50aWZpZWQgYnkgU3ViamVjdCBJZGVudGlmaWVycyBkZWZp bmVkIGJlbG93Lg0KDQozLjEuICBTUEFHcw0KDQogICBTdWJqZWN0IFByaW5jaXBhbHMgTUFZIGJl IGdyb3VwZWQgZm9yIGFkbWluaXN0cmF0aXZlIHB1cnBvc2VzIGludG8NCiAgICJTdWJqZWN0IFBy aW5jaXBhbCBBZG1pbmlzdHJhdGl2ZSBHcm91cGluZ3MiIG9yIFNQQUdzLiAgRm9yIGV4YW1wbGUs DQogICBhbGwgdXNlcnMgYmVsb25naW5nIHRvIG9uZSBjdXN0b21lciBvZiBhICJtdWx0aS10ZW5h bnRlZCIgVHJhbnNtaXR0ZXINCiAgIG1heSBiZSBpbiBvbmUgU1BBRy4gIEFsdGVybmF0aXZlbHks IGFuIE9yZ2FuaXphdGlvbmFsIFVuaXQgb3IgYSBncm91cA0KICAgb2YgU3ViamVjdHMgd2l0aGlu IGEgY3VzdG9tZXIgb2YgYSBUcmFuc21pdHRlciAod2hldGhlciBtdWx0aS0NCiAgIHRlbmFudGVk IG9yIG5vdCkgbWF5IGJlIG9uZSBTUEFHLiAgU1BBR3MgbWF5IGhhdmUgb3ZlcmxhcHBpbmcgc2V0 cyBvZg0KICAgU3ViamVjdHMuDQoNCiAgIEEgU1BBRyBNQVkgYmUgdGhlIFN1YmplY3Qgb2YgY2Vy dGFpbiBzdHJlYW0gdXBkYXRlIGV2ZW50cyBkZWZpbmVkDQogICBsYXRlciBpbiB0aGlzIHNwZWMs IGhlbmNlIGlzIGRlZmluZWQgYXMgYSBTdWJqZWN0IFR5cGUgb2YgaXRzIG93bg0KICAgYmVsb3cu LiAgQSBTUEFHIGlkZW50aWZpZXIgTUFZIGJlIGluY2x1ZGVkIGluIG90aGVyIHN1YmplY3QgdHlw ZXMgdG8NCiAgIGRpc2FtYmlndWF0ZSB0aGUgc3ViamVjdC4NCg0KICAgQSBTUEFHIHN1YmplY3Qg aWRlbnRpZmllciBpcyBhZ3JlZWQgdG8gb2ZmbGluZSBiZXR3ZWVuIGEgdHJhbnNtaXR0ZXINCiAg IGFuZCBhIHJlY2VpdmVyLg0KVGhlIGJlbmVmaXRzIG9mIGRvaW5nIHRoaXMgYXJlOg0KDQogIDEu ICBNdWx0aS10ZW5hbnRlZCBob3N0cyBkbyBub3QgbmVlZCB0byBtYWludGFpbiBzZWNyZXRzIHBl ciB0ZW5hbnQgYW5kIHBlciB0cmFuc21pdHRlciB0ZW5hbnQgaWYgZWFjaCB0ZW5hbnQgaGFzIHRv IGJlIGFuIGV2ZW50IHRyYW5zbWl0dGVyIGFuZCBhbiBldmVudCByZWNlaXZlciBvZiBpdHMgb3du Lg0KICAyLiAgQW4gZXZlbnQgc3RyZWFtIG1heSBiZSBlc3RhYmxpc2hlZCBiZXR3ZWVuIHR3byBt dWx0aS10ZW5hbnRlZCBob3N0cywgYW5kIHNvIGRvZXMgbm90IG5lZWQgdG8gYmUgbWFuYWdlZCBh dCBhIHBlci10ZW5hbnQgbGV2ZWwNCiAgMy4gIFRoZSBzYW1lIHN1YmplY3Qgb3Igc3ViamVjdCBw cmluY2lwYWwgbWF5IGJlIGEgcGFydCBvZiBtdWx0aXBsZSBTUEFHcywgYW5kIGlkZW50aWZ5aW5n IHRoZSBTUEFHIHRoYXQgYW4gZXZlbnQgcmVsYXRlcyB0byBjYW4gYmUgYWNoaWV2ZWQgaWYgdGhl IHN0YW5kYXJkIGFsbG93cyBmb3IgdGhlIFNQQUdzIHRvIGJlIGlkZW50aWZpZWQuDQoNCg0KT24g TW9uLCBKdWwgMTMsIDIwMjAgYXQgMTE6MzIgQU0gRGljayBIYXJkdCA8ZGljay5oYXJkdEBnbWFp bC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tPj4gd3JvdGU6DQpUbyBjbGFyaWZ5LCB5 b3VyIHByb3Bvc2FsIGlzIGRyaXZlbiBieSB0aGUgaW1wbGVtZW50YXRpb24gYnVyZGVuIG9mIG1h aW50YWluaW5nIHNlcGFyYXRlIHNlY3JldHMgLyBzdHJlYW1zIGJldHdlZW4gYSB0cmFuc21pdHRl ciBhbmQgcmVjZWl2ZXI/DQrhkKcNCg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgOTowMSBBTSBB dHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0dWxzaGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3Jn PG1haWx0bzo0MGdvb2dsZS5jb21AZG1hcmMuLmlldGYub3JnPj4gd3JvdGU6DQpIaSBhbGwsDQpI ZXJlJ3MgYSBxdWljayBiYWNrZ3JvdW5kIGZvciB0aGUgcHJvcG9zYWw8aHR0cHM6Ly9naXRodWIu Y29tL3JpY2hhbm5hL3NlY2V2ZW50L3B1bGwvMT4gZm9yIGluY2x1ZGluZyBTdWJqZWN0IFByaW5j aXBhbHMgYW5kIFN1YmplY3QgUHJpbmNpcGFsIEFkbWluaXN0cmF0aXZlIEdyb3VwaW5ncyBvciBT UEFHcyBpbiB0aGUgU3ViamVjdCBJZGVudGlmaWVycyBzcGVjLg0KDQpVc2Ugb2YgU3ViamVjdCBJ ZGVudGlmaWVycyBpbiBTaGFyZWQgU2lnbmFscyBhbmQgRXZlbnRzOg0KVGhlIFNoYXJlZCBTaWdu YWxzIGFuZCBFdmVudHMgKFNTRSkgcHJvZmlsZSBvZiBTRVRzIHNwZWNpZmllcyB0aGF0IHRyYW5z bWl0dGVycyBhbmQgcmVjZWl2ZXJzIHNlbmQgYW5kIHJlY2VpdmUgU0VUcyB0aGF0IGNvbnRhaW4g U3ViamVjdCBJZGVudGlmaWVycy4gVGhlc2Ugc3ViamVjdCBpZGVudGlmaWVycyBoYXZlIHRoZSBm b3JtYXQgdGhhdCBpcyBub3cgYmVpbmcgZGlzY3Vzc2VkIGFzIGEgc2VwYXJhdGUgc3BlY2lmaWNh dGlvbiBoZXJlLg0KDQpUcmFuc21pdHRlcnMgYW5kIFJlY2VpdmVycyBpbiBTU0UNClRoZSBTU0Ug cHJvZmlsZSBkZWZpbmVzIHRyYW5zbWl0dGVycyBhbmQgcmVjZWl2ZXJzIGFzIGhvc3RzIHRoYXQg bWFuYWdlIHN0cmVhbXMgYmV0d2VlbiBwZWVycy4gVGhlIHJlY2VpdmVyIGF1dGhlbnRpY2F0ZXMg dG8gdGhlIHRyYW5zbWl0dGVyIHVzaW5nIE9BdXRoLCByZXF1aXJpbmcgdGhlIHVzZSBvZiBhIHNl Y3JldCBwZXIgcmVjZWl2ZXIuIEluIGEgbXVsdGktdGVuYW50ZWQgaG9zdCB0aGF0IGhhbmRsZXMg aHVuZHJlZHMgb2YgdGhvdXNhbmRzIG9yIG1pbGxpb25zIG9mIGluZGVwZW5kZW50IHRlbmFudHMs IG1haW50YWluaW5nIHN1Y2ggYSBzZWNyZXQgcGVyIGluc3RhbmNlIG9mIGEgcmVjZWl2ZXIgaXMg Y3VtYmVyc29tZS4gRnVydGhlcm1vcmUsIHNpbmNlIGEgdHJhbnNtaXR0ZXIgYW5kIGEgcmVjZWl2 ZXIgaGFzIHRvIG1haW50YWluIGEgc3RyZWFtIHBlciBwYWlyLCBjcmVhdGluZyBzdWNoIHBlci10 ZW5hbnQgc3RyZWFtcyBjYW4gYWRkIHNpZ25pZmljYW50IGltcGxlbWVudGF0aW9uIG92ZXJoZWFk Lg0KDQpTUEFHcw0KVGhlcmVmb3JlLCB3ZSBuZWVkIGEgbm90aW9uIG9mIGEgZ3JvdXBpbmcgb2Yg c3ViamVjdHMgd2l0aGluIHRoZSBzYW1lIHRyYW5zbWl0dGVyIGFuZCByZWNlaXZlciB0byBkaXN0 aW5ndWlzaCBiZXR3ZWVuIHZhcmlvdXMgYWRtaW5pc3RyYXRpdmUgZ3JvdXBpbmdzIHRoYXQgZXhp c3Qgd2l0aGluIGEgaG9zdC4gVGhlc2UgZ3JvdXBpbmdzIGNvdWxkIGluY2x1ZGUgdGVuYW50cywg b3JnYW5pemF0aW9uYWwgdW5pdHMgb3IgdXNlciBncm91cHMuLiBUaGlzIGdyb3VwaW5nIGlzIGNh cHR1cmVkIGluIHRoZSBub3Rpb24gb2YgYSBTUEFHLiBUaGUgdW5pcXVlbmVzcyBvZiBhIHVzZXIg aWRlbnRpZmllciAoc3ViamVjdCBpZGVudGlmaWVyKSBtYXkgYWxzbyBiZSBsaW1pdGVkIHRvIGEg U1BBRy4gRm9yIGV4YW1wbGUsIGlmIGEgcmFuZG9tIHVuaXF1ZSBJRCByZXByZXNlbnRzIGEgdXNl ciwgdGhlbiB0aGF0IElEIG1heSBiZSB1bmlxdWUgd2l0aGluIGEgU1BBRyBhbmQgbm90IHVuaXZl cnNhbGx5IGFjcm9zcyBhIHRyYW5zbWl0dGVyIG9yIHJlY2VpdmVyLiBUaGlzIGlzIGJlY2F1c2Ug ZWFjaCB0cmFuc21pdHRlciBhbmQgcmVjZWl2ZXIgbWF5IGhhdmUgbXVsdGlwbGUgY29ubmVjdGlv bnMgdG8gb3RoZXIgdHJhbnNtaXR0ZXJzIGFuZCByZWNlaXZlcnMsIGFuZCBlbnN1cmluZyB1bmlx dWVuZXNzIGFjcm9zcyBhbGwgc3VjaCBwZWVycyBpcyBwcm9iYWJseSBhbiBpbnRyYWN0YWJsZSBw cm9ibGVtLg0KDQpTdWJqZWN0IFByaW5jaXBhbHMNCldoaWxlIHdoYXQgaXMgcmVwcmVzZW50ZWQg d2l0aGluIGEgc3ViamVjdCBpZGVudGlmaWVyIG1heSBiZSBvbmx5IGFuIGFzcGVjdCBvZiB0aGUg bWFuYWdlbWVudCBlbnRpdHksIHRoZSBhZG1pbmlzdHJhdGl2ZSBncm91cGluZyBpcyBhYm91dCB0 aGUgbWFuYWdlbWVudCBlbnRpdHkgaXRzZWxmLiBUaGlzIGNvdWxkIGJlIHRoZSB1c2VyLCBkZXZp Y2Ugb3Igb3RoZXIgcHJpbmNpcGFsIHRoYXQgdGhlIHN1YmplY3QgaWRlbnRpZmllciByZXByZXNl bnRzLiBUaGVyZWZvcmUsIGFuIGFic3RyYWN0IG5vdGlvbiBvZiBhIFN1YmplY3QgUHJpbmNpcGFs IGlzIGFsc28gcmVxdWlyZWQgaW4gb3JkZXIgc3BlY2lmeSB3aGF0IHRoZSBncm91cGluZyB3aXRo aW4gYSBTUEFHIGlzIGFib3V0Lg0KDQpUaGUgYWJvdmUgaXMgY2FwdHVyZWQgaW4gdGhlICJTdWJq ZWN0IFByaW5jaXBhbCIgYW5kICJTUEFHIiBzZWN0aW9ucyB3aXRoaW4gdGhlIHByb3Bvc2VkIFBS PGh0dHBzOi8vZ2l0aHViLmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzE+Lg0KDQpUaGFua3Ms DQpBdHVsDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f DQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVu dEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZl bnQNCg== --_000_CH2PR00MB067812E3F5D58E5B1F029137F5610CH2PR00MB0678namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIg MTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6R2FkdWdpOw0K CXBhbm9zZS0xOjIgMTEgNSAyIDQgMiA0IDIgMiAzO30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEu MGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2Vj dGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6 NDIyMTg1MzUzOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotNDU2MDkzNTIwO30NCkBsaXN0IGww OmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu O30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjEwMTE1NjIzMDc7DQoJbXNvLWxpc3QtdGVtcGxh dGUtaWRzOi0yMTMxMDY2ODEyO30NCkBsaXN0IGwyDQoJe21zby1saXN0LWlkOjE0NzEzNjYxNzc7 DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi00NjY5NTk5OTI7fQ0KQGxpc3QgbDMNCgl7bXNvLWxp c3QtaWQ6MjExNjI0MjMxMDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MjI4NTA5NDcwO30NCm9s DQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwv c3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJl ZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0i ZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzAwMjA2MCI+SSBhZ3JlZSB3aXRoIERpY2sgdGhhdCBhIGtleSBxdWVzdGlvbiBp cyB3aGV0aGVyIHRoZSBTUEFHIGJlbG9uZ3MgaW4gdGhlIGV2ZW50IG9yIGluIHRoZSBzdWJqZWN0 IGlkZW50aWZpZXIuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5Ob3RlIHRo YXQgdGhpcyBzcGVjaWZpY2F0aW9uIGNvdWxkIHN0aWxsIGRlZmluZSBhIFNQQUcgZm9yIGluY2x1 c2lvbiBpbiBTRVQgZXZlbnRzLCBldmVuIHRob3VnaCBpdHMgcHJpbWFyeSBwdXJwb3NlIGlzIGRl ZmluaW5nIHN1YmplY3QgaWRlbnRpZmllcnMgZm9yIHVzZSBpbiBTRVRzLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYw Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJv bTo8L2I+IERpY2sgSGFyZHQgJmx0O2RpY2suaGFyZHRAZ21haWwuY29tJmd0OyA8YnI+DQo8Yj5T ZW50OjwvYj4gVHVlc2RheSwgSnVseSAxNCwgMjAyMCA4OjU2IEFNPGJyPg0KPGI+VG86PC9iPiBB dHVsIFR1bHNoaWJhZ3dhbGUgJmx0O2F0dWx0dWxzaGlAZ29vZ2xlLmNvbSZndDs8YnI+DQo8Yj5D Yzo8L2I+IE1pa2UgSm9uZXMgJmx0O01pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSZndDs7IFNl Y0V2ZW50ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6 IFtJZC1ldmVudF0gU3ViamVjdCBQcmluY2lwYWxzIGFuZCBTdWJqZWN0IFByaW5jaXBhbCBBZG1p bmlzdHJhdGl2ZSBHcm91cGluZ3M8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SGkgQXR1bDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SWYgdGhlIFNQQUcgaGFzIHZhbHVlIGluIHRoZSBldmVudCBtZXNzYWdlLCB0aGVuIGl0IHNob3Vs ZCBiZSBzcGVjaWZpZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkkgd2FzIHByb3Bvc2luZyB0aGF0IHRoZSBTUEFHIGJlIGRldGVybWluZWQg YXQgdGhlIHRyYW5zcG9ydCBsYXllciByYXRoZXIgdGhlbiB0aGUgZXZlbnQvbWVzc2FnZSBsYXll ci48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ QW4gYWR2YW50YWdlIG9mIGJlaW5nIGluIHRoZSBldmVudCBpcyB0aGF0IGl0IGlzIGluZGVwZW5k ZW50IG9mIHRyYW5zcG9ydC4gSW4gYSBtdWx0aS10ZW5hbnQgc2l0dWF0aW9uLCB3aGVyZSBkaWZm ZXJlbnQgY29tcG9uZW50cyBkbyBkaWZmZXJlbnQgcGFydHMgb2YgdGhlIHByb2Nlc3NpbmcsIGFu ZCB0aGUgb3JpZ2luYWwgdHJhbnNwb3J0IGlzIG5vIGxvbmdlciBhdmFpbGFibGUsIHRoZSBTUEFH IHdvdWxkIGJlDQogYWx3YXlzIGF2YWlsYWJsZSByYXRoZXIgdGhhbiB3cmFwcGluZyB0aGUgZXZl bnQgdG8gaW5jbHVkZSB0aGUgU1BBRy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUdWUsIEp1bCAxNCwgMjAyMCBhdCA3OjU1 IEFNIEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmF0dWx0dWxzaGlAZ29v Z2xlLmNvbSI+YXR1bHR1bHNoaUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpz b2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6 NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QSBm ZXcgcG9pbnRzIC8gcmVzcG9uc2VzOjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxvbCBzdGFydD0i MSIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwyIGxldmVsMSBs Zm8xIj4NCkFncmVlIHdpdGggTWlrZSB0aGF0IHNwYWdfaWQgc2hvdWxkIG5vdCBiZSBhIHJlcXVp cmVkJm5ic3A7Y2xhaW0gdW5sZXNzIGl0J3MgYWN0dWFsbHkgcmVxdWlyZWQgZm9yIGV2ZXJ5IHN1 YmplY3QuIFNvIGtlZXBpbmcgaXQgb3B0aW9uYWwgKGlmIHdlIGRlY2lkZSB0byBoYXZlIGl0IGF0 IGFsbCkgaXMgdGhlIHJpZ2h0IHRoaW5nIHRvIGRvLjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21zby1saXN0OmwyIGxldmVsMSBsZm8xIj4NCklNTyBpdCB3aWxsIGJlIGZh ciBzaW1wbGVyIGZvciBtdWx0aS10ZW5hbnRlZCBob3N0cyB0byB1c2UgU1BBR3MgcmF0aGVyIHRo YW4gbWFuYWdlIG11bHRpcGxlIGV2ZW50IHN0cmVhbXMgKGkuZS4gb25lIHBlciB0ZW5hbnQpPG86 cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDIgbGV2ZWwxIGxm bzEiPg0KQSBtdWx0aS10ZW5hbnRlZCBhcmNoaXRlY3R1cmUgaXMgaW5jcmVhc2luZ2x5IHZlcnkg Y29tbW9uLCBzbyB0aGlzIHdpbGwgYXBwbHkgdG8gYSBsYXJnZSBudW1iZXIgb2Ygb3JnYW5pemF0 aW9ucy48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMiBs ZXZlbDEgbGZvMSI+DQpGb3Igc2luZ2xlIHRlbmFudGVkIHRyYW5zbWl0dGVycywgdGhlIFNQQUcg aWQgbWF5IGJlIGluZmVycmVkIGJ5IHJlY2VpdmVycy4gU2luZ2xlIHRlbmFudGVkIHJlY2VpdmVy cyBtYXkgaWdub3JlIHRoZSBTUEFHIGlkcyBpbiB0aGUgc3ViamVjdHMuIFNvIHByb2Nlc3Npbmcg U1BBR3MgaW4gaHlicmlkIHNpdHVhdGlvbnMgZG9lcyBub3QgYXBwZWFyIHRvIGJlIGN1bWJlcnNv bWUuPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDIgbGV2 ZWwxIGxmbzEiPg0KVGhlIHVzZSBvZiBTUEFHcyBpcyBub3QgbGltaXRlZCB0byB0ZW5hbnQtbGV2 ZWwgaW5mb3JtYXRpb24sIHNpbmNlIGl0IG1heSBiZSBhcHBsaWVkIHRvIE9VcyBvciBncm91cHM8 bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMiBsZXZlbDEg bGZvMSI+DQpJZiB3ZSBhZ3JlZSB0aGF0IFNQQUcgaXMgYSAmcXVvdDttZXRhIGNvbmNlcHQmcXVv dDsgdGhhdCBhcHBsaWVzIGluIG1vc3Qgc2l0dWF0aW9ucywgdGhlbiBjYXB0dXJpbmcgaXQgaW4g dGhlIHNwZWMgaXMgcHJvYmFibHkgaW1wb3J0YW50LiBXaGF0IERpY2sgaXMgcHJvcG9zaW5nIGlz IGEgd2F5IHRvIGltcGxlbWVudCBTUEFHcyB3aXRob3V0IHNwZWNpZnlpbmcgdGhlbSBpbiBhIHN0 YW5kYXJkLCBzbyBlYWNoIGVudGl0eSBpcyBmcmVlIHRvIGRlZmluZSBpdCB0aGUNCiB3YXkgdGhl eSB3YW50LiBUaGlzIGFwcHJvYWNoIGNhbiBjYXVzZSBpbmNvbXBhdGliaWxpdGllcy48bzpwPjwv bzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMiBsZXZlbDEgbGZvMSI+ DQpXaXRob3V0IFNQQUdzIGluIHRoZSBzcGVjLCBpZiBwZWVycyBuZWVkIHRvIHNlbmQgZXZlbnRz IGFib3V0IFNQQUdzLCB0aGVuIHRoZXkgbmVlZCB0byB1c2UgdGhlICZxdW90O2lzcy1zdWImcXVv dDsgY2F0Y2ggYWxsIHRvIHNlbmQgZXZlbnRzIGFib3V0IGVuYWJsaW5nIG9yIGRpc2FibGluZyBl dmVudHMgYWJvdXQgU1BBR3MuIFNpbmNlIHRoaXMgaXMgbm90IHN0YW5kYXJkaXplZCwgaXQgY291 bGQgYWxzbyBjYXVzZSBwcm9wcmlldGFyeSBhbmQgaW5jb21wYXRpYmxlDQogaW1wbGVtZW50YXRp b25zLjxvOnA+PC9vOnA+PC9saT48L29sPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkF0 dWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiBNb24sIEp1bCAxMywgMjAyMCBhdCA1OjIzIFBNIE1pa2UgSm9uZXMgJmx0Ozxh IGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5r Ij5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0 LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+QXMgSSBzZWUgaXQsIHRoZSB1c2UgY2Fz ZXMgdGhhdCByZXF1aXJlIGEgc3BhZ19pZCBjYW4gdXNlIHRoZW0gd2hlbiBuZWNlc3NhcnkgKHVu bGVzcyB0aGUgd29ya2luZyBncm91cCBkZWNpZGVzIG9uIGFub3RoZXIgd2F5IHRvIGRvIHRoaXMp IGJ1dCBJIGNlcnRhaW5seQ0KIHdvdWxkIG9wcG9zZSByZXF1aXJpbmcgaXQgd2hlbiBpdOKAmXMg dW5uZWNlc3NhcnkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAy MDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPkZyb206PC9iPiBJZC1ldmVudCAmbHQ7PGEg aHJlZj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5p ZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+RGlj ayBIYXJkdDxicj4NCjxiPlNlbnQ6PC9iPiBNb25kYXksIEp1bHkgMTMsIDIwMjAgNToxMyBQTTxi cj4NCjxiPlRvOjwvYj4gQXR1bCBUdWxzaGliYWd3YWxlICZsdDs8YSBocmVmPSJtYWlsdG86YXR1 bHR1bHNoaUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+YXR1bHR1bHNoaUBnb29nbGUuY29t PC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IFNlY0V2ZW50ICZsdDs8YSBocmVmPSJtYWlsdG86aWQt ZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7 PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFN1YmplY3QgUHJpbmNpcGFscyBh bmQgU3ViamVjdCBQcmluY2lwYWwgQWRtaW5pc3RyYXRpdmUgR3JvdXBpbmdzPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPldvdWxkIGRpZmZl cmVudCBVUkxzIGZvciBlYWNoIHJlbGF0aW9uc2hpcCBub3Qgc29sdmUgeW91ciBpc3N1ZSBvZiBt YWludGFpbmluZyBzZWNyZXRzIGZvciBlYWNoIFNQQUc/IEZvciBleGFtcGxlOjxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPmh0dHBzOi88YSBocmVmPSJo dHRwOi8vZXhhbXBsZS5jb20vc2VjZXZlbnQvU1BBR19JRF8xIiB0YXJnZXQ9Il9ibGFuayI+ZXhh bXBsZS5jb20vc2VjZXZlbnQvU1BBR19JRF8xPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPmh0dHBzOi88YSBocmVmPSJo dHRwOi8vZXhhbXBsZS5jb20vc2VjZXZlbnQvU1BBR19JRF8yIiB0YXJnZXQ9Il9ibGFuayI+ZXhh bXBsZS5jb20vc2VjZXZlbnQvU1BBR19JRF8yPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPmh0dHBzOi88YSBocmVmPSJo dHRwOi8vZXhhbXBsZS5jb20vc2VjZXZlbnQvU1BBR19JRF8zIiB0YXJnZXQ9Il9ibGFuayI+ZXhh bXBsZS5jb20vc2VjZXZlbnQvU1BBR19JRF8zPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlRoZW4gdGhl IGNyZWRlbnRpYWwgaXMgaW5kZXBlbmRlbnQmbmJzcDtvZiB0aGUgU1BBRywgYnV0IHdlIGFyZSBu b3QgaW5qZWN0aW5nIGFuIGlkZW50aWZpZXIgKHNwYWdfaWQpIHRoYXQgaXMgb25seSByZWxldmFu dCZuYnNwO3RvIG9yZ3MgdGhhdCB3YW50IHRvIHVzZSB0aGUgc2FtZSBjcmVkZW50aWFscyBhY3Jv c3MgU1BBRw0KIHJlbGF0aW9uc2hpcHMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBNb24s IEp1bCAxMywgMjAyMCBhdCA1OjA4IFBNIEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7PGEgaHJlZj0i bWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmF0dWx0dWxzaGlA Z29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPkkgYW0gT0sgd2l0aCBtYWtpbmcgdGhlIHNwYWdfaWQgYSByZXF1aXJl ZCBjbGFpbSBpbiBldmVyeSBzdWJqZWN0IGlkZW50aWZpZXIuIEZvciBzaW5nbGUgdGVuYW50ZWQg dHJhbnNtaXR0ZXJzLCBpdCB3b3VsZCBiZSBhIGNvbnN0YW50IHZhbHVlIGZvciBhbGwgZXZlbnRz IHRoZXkgZ2VuZXJhdGUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgNDowMSBQTSBEaWNrIEhhcmR0ICZsdDs8 YSBocmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5kaWNr LmhhcmR0QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAx LjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPlNvIHRoZSByZWNlaXZlciBpcyB1c2luZyBhdXRoZW50aWNh dGlvbiBzb21ldGltZXMgdG8gZGV0ZXJtaW5lIFNQQUcsIGFuZCBub3QgYXQgb3RoZXIgdGltZXM/ PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SSdtIGRp Z2dpbmcgaW50byB0aGlzIGFzIEkgaGFkIGFsd2F5cyB0aG91Z2h0IG9mIHRoZSBldmVudCBiZWlu ZyBiZXR3ZWVuIHR3byBwYXJ0aWVzLCB3aGVyZSB0aGV5IGFyZSBpZGVudGlmaWVkJm5ic3A7Ynkg dGhlIGVuZHBvaW50IGFuZC9vciB0aGUgY3JlZGVudGlhbHMuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5BZGRpbmcgYSByZWxhdGlvbnNo aXAgaWRlbnRpZmllciBzZWVtcyB0byBiZSBzb2x2aW5nIHRoZSBwcm9ibGVtIGF0IHRoZSB3cm9u ZyBsYXllciwgdW5sZXNzIGl0IGlzIGluIGFsbCBldmVudHMuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gTW9uLCBKdWwgMTMs IDIwMjAgYXQgMzo1NCBQTSBBdHVsIFR1bHNoaWJhZ3dhbGUgJmx0OzxhIGhyZWY9Im1haWx0bzph dHVsdHVsc2hpQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5hdHVsdHVsc2hpQGdvb2dsZS5j b208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzow aW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdp bi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj5Tb3JyeSBmb3IgdGhlIHRlcnNlIG1lc3NhZ2UuPG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SWYgYSBzaW5nbGUgdGVuYW50IHRyYW5zbWl0 dGVyIGlzIHRydXN0ZWQgYnkgYSBtdWx0aS10ZW5hbnRlZCByZWNlaXZlciBmb3IgYSBzcGVjaWZp YyB0ZW5hbnQsIHRoZW4gdGhlIFNQQUctaWQgbmVlZCBub3QgYmUgaW5jbHVkZWQgaWYgdGhlIHN1 YmplY3QgaXMgdW5pcXVlIGF0IHRoZSB0ZW5hbnQgbGV2ZWwsDQogYmVjYXVzZSB0aGUgcmVjZWl2 ZXIgd2lsbCBhdXRvbWF0aWNhbGx5IGlkZW50aWZ5IFNQQUcgdGhhdCB0aGUgc3ViamVjdCBiZWxv bmdzIHRvIG9uIGl0cyBlbmQgKGJhc2VkIG9uIHRoZSBhdXRoZW50aWNhdGlvbikuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i Pk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDM6MzcgUE0gRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0i bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+ZGljay5oYXJkdEBn bWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj5XaGljaCBwYXJ0IGlzIG5vdCByZXF1aXJlZD88bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBNb24sIEp1bCAxMywgMjAyMCBh dCAzOjMzIFBNIEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmF0dWx0dWxz aGlAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmF0dWx0dWxzaGlAZ29vZ2xlLmNvbTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4g MGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0 OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i Pk5vdCByZXF1aXJlZCwgc2luY2UgdGhlIGNsYWltIGlzIG9wdGlvbmFsLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uIE1vbiwgSnVsIDEzLCAyMDIw IGF0IDM6MjUgUE0gRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2suaGFyZHRAZ21h aWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+ZGljay5oYXJkdEBnbWFpbC5jb208L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5Xb3VsZCBh IHRyYW5zbWl0dGVyIHRoYXQgaXMgb25seSBpbiBvbmUgU1BBRyAoYSBzaW5nbGUgdGVuYW50IHN5 c3RlbSkgaGF2ZSB0byBpbmNsdWRlIGl0cyBTUEFHIGlkIGluIGV2ZW50cyBzZW50IHRvIGEgcmVj ZWl2ZXIgdGhhdCBhY2NlcHRzIGV2ZW50cyBmcm9tIG11bHRpcGxlIFNQQUdzPyBCdXQgaXQgd291 bGQNCiBub3QgaW5jbHVkZSBpdCBpbiBzZW5kaW5nIGV2ZW50cyB0byBvdGhlciByZWNlaXZlcnMm bmJzcDt0aGF0IGhhdmUgc2VwYXJhdGUgY3JlZGVudGlhbHMgZm9yIGVhY2ggcmVsYXRpb25zaGlw PzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj48aW1nIGJvcmRlcj0iMCIgd2lkdGg9IjEiIGhlaWdodD0iMSIgc3R5bGU9Indp ZHRoOi4wMTA0aW47aGVpZ2h0Oi4wMTA0aW4iIGlkPSJfeDAwMDBfaTEwMjYiIHNyYz0iaHR0cHM6 Ly9tYWlsZm9vZ2FlLmFwcHNwb3QuY29tL3Q/c2VuZGVyPWFaR2xqYXk1b1lYSmtkRUJuYldGcGJD NWpiMjAlM0QmYW1wO3R5cGU9emVyb2NvbnRlbnQmYW1wO2d1aWQ9ZTRkMTk2MmUtNTk0ZC00ZDQ1 LThjYTUtMWM2MzI0ZmU3MDBjIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuNXB0O2ZvbnQtZmFt aWx5OiZxdW90O0dhZHVnaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndoaXRlIj7hkKc8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gTW9u LCBKdWwgMTMsIDIwMjAgYXQgMzowNSBQTSBBdHVsIFR1bHNoaWJhZ3dhbGUgJmx0OzxhIGhyZWY9 Im1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5hdHVsdHVsc2hp QGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2Nr cXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7 cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj5UaGF0IGNvdWxkIGJlIHRydWUgYnV0IHRoZXJlIGFyZSBhIGZldyB3 YXlzIGluIHdoaWNoIGl0IGNhbiBiZSBhdm9pZGVkOjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxv bCBzdGFydD0iMSIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0Omwx IGxldmVsMSBsZm8yIj4NClRoZSBwZWVycyBsZXZlcmFnZSBzb21lIGhpZ2hlci1sZXZlbCB0cnVz dCB0byBhY2NlcHQgLyBkZWNsaW5lIGV2ZW50cyByZWxhdGluZyB0byBsb3dlciBsZXZlbCBTUEFH cy4gRm9yIGV4YW1wbGUsIGlmIHRydXN0IGlzIGVzdGFibGlzaGVkIGF0IGEgdGVuYW50IGxldmVs LCB0aGVuIGFuIE9VIGxldmVsIFNQQUcgbmVlZCBub3QgaGF2ZSBpdHMgb3duIGF1dGhvcml6YXRp b24uPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2 ZWwxIGxmbzIiPg0KVGhlIHNlY3JldCByZXF1aXJlZCBmb3IgZXN0YWJsaXNoaW5nIHRoZSBhdXRo b3JpemF0aW9uIG9mIGEgU1BBRyBtYXkgYmUgdGVtcG9yYXJ5LiBGb3IgZXhhbXBsZTo8bzpwPjwv bzpwPjwvbGk+PC9vbD4NCjxvbCBzdGFydD0iMiIgdHlwZT0iMSI+DQo8b2wgc3RhcnQ9IjEiIHR5 cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMCBsZXZlbDIgbGZvMyI+ DQpBbiBhZG1pbmlzdHJhdG9yIHNpZ25zIGluIHRvIHRoZWlyIHRlbmFudCBpbiB0aGUgdHJhbnNt aXR0ZXIncyBhZG1pbmlzdHJhdG9yIGNvbnNvbGU8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttc28tbGlzdDpsMCBsZXZlbDIgbGZvMyI+DQpUaGUgYWRtaW4gb2J0YWlucyBh IHRlbXBvcmFyeSBhdXRob3JpemF0aW9uIChvbmUtdGltZSBjb2RlKTxvOnA+PC9vOnA+PC9saT48 bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxldmVsMiBsZm8zIj4NClRoZSBhZG1p biBzaWducyBpbiB0byB0aGVpciB0ZW5hbnQgaW4gdGhlIHJlY2VpdmVyJ3MgYWRtaW5pc3RyYXRp b24gY29uc29sZSBhbmQgcGFzdGVzIGluIHRoZSBvbmUtdGltZSBjb2RlPG86cD48L286cD48L2xp PjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwyIGxmbzMiPg0KVGhlIHJl Y2VpdmVyIHNlbmRzIGEgcmVxdWVzdCB0byBlbmFibGUgdGhlIHN0cmVhbSBmb3IgdGhlIHNwZWNp ZmllZCBTUEFHIHdpdGggdGhhdCBvbmUtdGltZSBhdXRob3JpemF0aW9uLjxvOnA+PC9vOnA+PC9s aT48L29sPg0KPC9vbD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkluIHRoZSBmaXJz dCBjYXNlLCB0aGVyZSBhcmUgbm8gYWRkaXRpb25hbCBzZWNyZXRzIHJlcXVpcmVkLiBJbiB0aGUg c2Vjb25kIGNhc2UsIHRoZSBzZWNyZXQgaXMgdGVtcG9yYXJ5LjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk9u IE1vbiwgSnVsIDEzLCAyMDIwIGF0IDI6MzQgUE0gRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFp bHRvOmRpY2suaGFyZHRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+ZGljay5oYXJkdEBnbWFp bC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj5JIHNlZSB0aGUgU1BBRyBsZXRzIHRoZSB0cmFuc21pdHRlciBhbmQgcmVjZWl2 ZXIgcHJvdmlkZSBjb250ZXh0LCBhcyB0aGUgc3ViamVjdCBpZGVudGlmaWVyIG1heSBiZSB0aGUg c2FtZSBhY3Jvc3MgU1BBR3MuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+Tm93IEknbSB0cnlpbmcgdG8gdW5kZXJzdGFuZCBob3cgdGhlIHRyYW5zbWl0 dGVyIGF1dGhlbnRpY2F0ZXMgdG8gdGhlIHJlY2VpdmVyIGlmIGl0IGRvZXMgbm90IGhhdmUgaXQn cyBvd24gc2VjcmV0IChhc3N1bWluZyB0aGF0IGF1dGhlbnRpY2F0aW9uIG1vZGVsKSAtLSBJRSwg aG93IGRvZXMgdGhlIHJlY2VpdmVyDQoga25vdyB0aGUgdHJhbnNtaXR0ZXIgaXMgYXV0aG9yaXpl ZCZuYnNwO2ZvciB0aGF0IFNQQUc/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMjowOCBQ TSBBdHVsIFR1bHNoaWJhZ3dhbGUgJmx0OzxhIGhyZWY9Im1haWx0bzphdHVsdHVsc2hpQGdvb2ds ZS5jb20iIHRhcmdldD0iX2JsYW5rIj5hdHVsdHVsc2hpQGdvb2dsZS5jb208L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ RGljaywgeW91ciB1bmRlcnN0YW5kaW5nIGlzIGNvcnJlY3QuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlRvIGNsYXJpZnkgdGhlIHByb3Bvc2FsIGhl cmUsIEhlcmUncyB0aGUgdGV4dCBJJ20gcHJvcG9zaW5nIHRvIGJlIGFkZGVkOjxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4zLiZuYnNwOyBTdWJqZWN0IFByaW5jaXBhbHM8 YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7U3ViamVjdCBQcmluY2lwYWxzIGFyZSB0aGUgbWFuYWdl bWVudCBlbnRpdGllcyBhc3NvY2lhdGVkIHdpdGg8YnI+DQombmJzcDsgJm5ic3A7U3ViamVjdHMu Jm5ic3A7IFRoZXNlIG1heSBiZSBodW1hbiBvciByb2JvdGljIHByaW5jaXBhbHMgb3IgZGV2aWNl cyBvcjxicj4NCiZuYnNwOyAmbmJzcDtvdGhlciBlbnRpdGllcyB0aGF0IGFyZSBtYW5hZ2VkIGJ5 IHRyYW5zbWl0dGVycyBhbmQgcmVjZWl2ZXJzLiZuYnNwOyBGb3I8YnI+DQombmJzcDsgJm5ic3A7 ZXhhbXBsZSwgdGhlIHNhbWUgU3ViamVjdCBQcmluY2lwYWwgbWF5IGJlIHJlZmVycmVkIHRvIGJ5 IGFuIGVtYWlsPGJyPg0KJm5ic3A7ICZuYnNwO2FkZHJlc3Mgb3IgYSBwaG9uZSBudW1iZXIuJm5i c3A7IEEgdHJhbnNtaXR0ZXIgb3IgcmVjZWl2ZXIgd2lsbCB0eXBpY2FsbHk8YnI+DQombmJzcDsg Jm5ic3A7bWFuYWdlIHN1YmplY3QgcHJpbmNpcGFscyBhbmQgb3JnYW5pemUgdGhlbSBpbnRvIHN1 Yi1ncm91cGluZ3Mgc3VjaDxicj4NCiZuYnNwOyAmbmJzcDthcyB0ZW5hbnRzLCBncm91cHMsIG9y Z2FuaXphdGlvbmFsIHVuaXRzLCBldGMuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1N1YmplY3Rz IGFyZSBpZGVudGlmaWVkIGJ5IFN1YmplY3QgSWRlbnRpZmllcnMgZGVmaW5lZCBiZWxvdy48YnI+ DQo8YnI+DQozLjEuJm5ic3A7IFNQQUdzPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1N1YmplY3Qg UHJpbmNpcGFscyBNQVkgYmUgZ3JvdXBlZCBmb3IgYWRtaW5pc3RyYXRpdmUgcHVycG9zZXMgaW50 bzxicj4NCiZuYnNwOyAmbmJzcDsmcXVvdDtTdWJqZWN0IFByaW5jaXBhbCBBZG1pbmlzdHJhdGl2 ZSBHcm91cGluZ3MmcXVvdDsgb3IgU1BBR3MuJm5ic3A7IEZvciBleGFtcGxlLDxicj4NCiZuYnNw OyAmbmJzcDthbGwgdXNlcnMgYmVsb25naW5nIHRvIG9uZSBjdXN0b21lciBvZiBhICZxdW90O211 bHRpLXRlbmFudGVkJnF1b3Q7IFRyYW5zbWl0dGVyPGJyPg0KJm5ic3A7ICZuYnNwO21heSBiZSBp biBvbmUgU1BBRy4mbmJzcDsgQWx0ZXJuYXRpdmVseSwgYW4gT3JnYW5pemF0aW9uYWwgVW5pdCBv ciBhIGdyb3VwPGJyPg0KJm5ic3A7ICZuYnNwO29mIFN1YmplY3RzIHdpdGhpbiBhIGN1c3RvbWVy IG9mIGEgVHJhbnNtaXR0ZXIgKHdoZXRoZXIgbXVsdGktPGJyPg0KJm5ic3A7ICZuYnNwO3RlbmFu dGVkIG9yIG5vdCkgbWF5IGJlIG9uZSBTUEFHLiZuYnNwOyBTUEFHcyBtYXkgaGF2ZSBvdmVybGFw cGluZyBzZXRzIG9mPGJyPg0KJm5ic3A7ICZuYnNwO1N1YmplY3RzLjxicj4NCjxicj4NCiZuYnNw OyAmbmJzcDtBIFNQQUcgTUFZIGJlIHRoZSBTdWJqZWN0IG9mIGNlcnRhaW4gc3RyZWFtIHVwZGF0 ZSBldmVudHMgZGVmaW5lZDxicj4NCiZuYnNwOyAmbmJzcDtsYXRlciBpbiB0aGlzIHNwZWMsIGhl bmNlIGlzIGRlZmluZWQgYXMgYSBTdWJqZWN0IFR5cGUgb2YgaXRzIG93bjxicj4NCiZuYnNwOyAm bmJzcDtiZWxvdy4uJm5ic3A7IEEgU1BBRyBpZGVudGlmaWVyIE1BWSBiZSBpbmNsdWRlZCBpbiBv dGhlciBzdWJqZWN0IHR5cGVzIHRvPGJyPg0KJm5ic3A7ICZuYnNwO2Rpc2FtYmlndWF0ZSB0aGUg c3ViamVjdC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7QSBTUEFHIHN1YmplY3QgaWRlbnRpZmll ciBpcyBhZ3JlZWQgdG8gb2ZmbGluZSBiZXR3ZWVuIGEgdHJhbnNtaXR0ZXI8YnI+DQombmJzcDsg Jm5ic3A7YW5kIGEgcmVjZWl2ZXIuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5UaGUgYmVuZWZpdHMgb2YgZG9pbmcgdGhpcyBhcmU6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8b2wgc3RhcnQ9IjEiIHR5cGU9IjEiPg0K PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMyBsZXZlbDEgbGZvNCI+DQpNdWx0aS10 ZW5hbnRlZCBob3N0cyBkbyBub3QgbmVlZCB0byBtYWludGFpbiBzZWNyZXRzIHBlciB0ZW5hbnQg YW5kIHBlciB0cmFuc21pdHRlciB0ZW5hbnQgaWYgZWFjaCB0ZW5hbnQgaGFzIHRvIGJlIGFuIGV2 ZW50IHRyYW5zbWl0dGVyIGFuZCBhbiBldmVudCByZWNlaXZlciBvZiBpdHMgb3duLjxvOnA+PC9v OnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwzIGxldmVsMSBsZm80Ij4N CkFuIGV2ZW50IHN0cmVhbSBtYXkgYmUgZXN0YWJsaXNoZWQgYmV0d2VlbiB0d28gbXVsdGktdGVu YW50ZWQgaG9zdHMsIGFuZCBzbyBkb2VzIG5vdCBuZWVkIHRvIGJlIG1hbmFnZWQgYXQgYSBwZXIt dGVuYW50IGxldmVsPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxp c3Q6bDMgbGV2ZWwxIGxmbzQiPg0KVGhlIHNhbWUgc3ViamVjdCBvciBzdWJqZWN0IHByaW5jaXBh bCBtYXkgYmUgYSBwYXJ0IG9mIG11bHRpcGxlIFNQQUdzLCBhbmQgaWRlbnRpZnlpbmcgdGhlIFNQ QUcgdGhhdCBhbiBldmVudCByZWxhdGVzIHRvIGNhbiBiZSBhY2hpZXZlZCBpZiB0aGUgc3RhbmRh cmQgYWxsb3dzIGZvciB0aGUgU1BBR3MgdG8gYmUgaWRlbnRpZmllZC48bzpwPjwvbzpwPjwvbGk+ PC9vbD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBN b24sIEp1bCAxMywgMjAyMCBhdCAxMTozMiBBTSBEaWNrIEhhcmR0ICZsdDs8YSBocmVmPSJtYWls dG86ZGljay5oYXJkdEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5kaWNrLmhhcmR0QGdtYWls LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5n OjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPlRvIGNsYXJpZnksIHlvdXIgcHJvcG9zYWwgaXMgZHJpdmVuIGJ5IHRoZSBpbXBs ZW1lbnRhdGlvbiZuYnNwO2J1cmRlbiBvZiBtYWludGFpbmluZyBzZXBhcmF0ZSBzZWNyZXRzIC8g c3RyZWFtcyBiZXR3ZWVuIGEgdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyPzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48aW1nIGJvcmRlcj0iMCIg d2lkdGg9IjEiIGhlaWdodD0iMSIgc3R5bGU9IndpZHRoOi4wMTA0aW47aGVpZ2h0Oi4wMTA0aW4i IGlkPSJfeDAwMDBfaTEwMjUiIHNyYz0iaHR0cHM6Ly9tYWlsZm9vZ2FlLmFwcHNwb3QuY29tL3Q/ c2VuZGVyPWFaR2xqYXk1b1lYSmtkRUJuYldGcGJDNWpiMjAlM0QmYW1wO3R5cGU9emVyb2NvbnRl bnQmYW1wO2d1aWQ9NzE0YjJlMDMtYjExMi00ZjMyLWEwODAtZjc4ZWU4YzBiYzIwIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjcuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0dhZHVnaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOndoaXRlIj7hkKc8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgOTowMSBBTSBB dHVsIFR1bHNoaWJhZ3dhbGUgJmx0O2F0dWx0dWxzaGk9PGEgaHJlZj0ibWFpbHRvOjQwZ29vZ2xl LmNvbUBkbWFyYy4uaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj40MGdvb2dsZS5jb21AZG1hcmMu aWV0Zi5vcmc8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj5IaSBhbGwsJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj5IZXJlJ3MgYSBxdWljayBiYWNrZ3JvdW5kIGZvciB0aGUNCjxhIGhy ZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzEiIHRhcmdldD0i X2JsYW5rIj5wcm9wb3NhbDwvYT4gZm9yIGluY2x1ZGluZyBTdWJqZWN0IFByaW5jaXBhbHMgYW5k IFN1YmplY3QgUHJpbmNpcGFsIEFkbWluaXN0cmF0aXZlIEdyb3VwaW5ncyBvciBTUEFHcyBpbiB0 aGUgU3ViamVjdCBJZGVudGlmaWVycyBzcGVjLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+VXNlIG9mIFN1YmplY3QgSWRlbnRpZmll cnMgaW4gU2hhcmVkIFNpZ25hbHMgYW5kIEV2ZW50czwvYj46PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlRoZSBTaGFyZWQgU2lnbmFscyBhbmQg RXZlbnRzIChTU0UpIHByb2ZpbGUgb2YgU0VUcyBzcGVjaWZpZXMgdGhhdCB0cmFuc21pdHRlcnMg YW5kIHJlY2VpdmVycyBzZW5kIGFuZCByZWNlaXZlIFNFVHMgdGhhdCBjb250YWluIFN1YmplY3Qg SWRlbnRpZmllcnMuIFRoZXNlIHN1YmplY3QgaWRlbnRpZmllcnMgaGF2ZQ0KIHRoZSBmb3JtYXQg dGhhdCBpcyBub3cgYmVpbmcgZGlzY3Vzc2VkIGFzIGEgc2VwYXJhdGUgc3BlY2lmaWNhdGlvbiBo ZXJlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PGI+VHJhbnNtaXR0ZXJzIGFuZCBSZWNlaXZlcnMgaW4gU1NFPC9iPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5UaGUgU1NFIHByb2Zp bGUgZGVmaW5lcyB0cmFuc21pdHRlcnMgYW5kIHJlY2VpdmVycyBhcyBob3N0cyB0aGF0IG1hbmFn ZSBzdHJlYW1zIGJldHdlZW4gcGVlcnMuIFRoZSByZWNlaXZlciBhdXRoZW50aWNhdGVzIHRvIHRo ZSB0cmFuc21pdHRlciB1c2luZyBPQXV0aCwgcmVxdWlyaW5nIHRoZSB1c2Ugb2YgYQ0KIHNlY3Jl dCBwZXIgcmVjZWl2ZXIuIEluIGEgbXVsdGktdGVuYW50ZWQgaG9zdCB0aGF0IGhhbmRsZXMgaHVu ZHJlZHMgb2YgdGhvdXNhbmRzIG9yIG1pbGxpb25zIG9mIGluZGVwZW5kZW50IHRlbmFudHMsIG1h aW50YWluaW5nIHN1Y2ggYSBzZWNyZXQgcGVyIGluc3RhbmNlIG9mIGEgcmVjZWl2ZXIgaXMgY3Vt YmVyc29tZS4gRnVydGhlcm1vcmUsIHNpbmNlIGEgdHJhbnNtaXR0ZXIgYW5kIGEgcmVjZWl2ZXIg aGFzIHRvIG1haW50YWluIGEgc3RyZWFtDQogcGVyIHBhaXIsIGNyZWF0aW5nIHN1Y2ggcGVyLXRl bmFudCBzdHJlYW1zIGNhbiBhZGQgc2lnbmlmaWNhbnQgaW1wbGVtZW50YXRpb24gb3ZlcmhlYWQu PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij48Yj5TUEFHczwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+VGhlcmVmb3JlLCB3ZSBuZWVkIGEgbm90aW9uIG9mIGEgZ3JvdXBpbmcgb2Yg c3ViamVjdHMgd2l0aGluIHRoZSBzYW1lIHRyYW5zbWl0dGVyIGFuZCByZWNlaXZlciB0byBkaXN0 aW5ndWlzaCBiZXR3ZWVuIHZhcmlvdXMgYWRtaW5pc3RyYXRpdmUgZ3JvdXBpbmdzIHRoYXQgZXhp c3Qgd2l0aGluIGEgaG9zdC4NCiBUaGVzZSBncm91cGluZ3MgY291bGQgaW5jbHVkZSB0ZW5hbnRz LCBvcmdhbml6YXRpb25hbCB1bml0cyBvciB1c2VyIGdyb3Vwcy4uIFRoaXMgZ3JvdXBpbmcgaXMg Y2FwdHVyZWQgaW4gdGhlIG5vdGlvbiBvZiBhIFNQQUcuIFRoZSB1bmlxdWVuZXNzIG9mIGEgdXNl ciBpZGVudGlmaWVyIChzdWJqZWN0IGlkZW50aWZpZXIpIG1heSBhbHNvIGJlIGxpbWl0ZWQgdG8g YSBTUEFHLiBGb3IgZXhhbXBsZSwgaWYgYSByYW5kb20gdW5pcXVlIElEIHJlcHJlc2VudHMNCiBh IHVzZXIsIHRoZW4gdGhhdCBJRCBtYXkgYmUgdW5pcXVlIHdpdGhpbiBhIFNQQUcgYW5kIG5vdCB1 bml2ZXJzYWxseSBhY3Jvc3MgYSB0cmFuc21pdHRlciBvciByZWNlaXZlci4gVGhpcyBpcyBiZWNh dXNlIGVhY2ggdHJhbnNtaXR0ZXIgYW5kIHJlY2VpdmVyIG1heSBoYXZlIG11bHRpcGxlIGNvbm5l Y3Rpb25zIHRvIG90aGVyIHRyYW5zbWl0dGVycyBhbmQgcmVjZWl2ZXJzLCBhbmQgZW5zdXJpbmcg dW5pcXVlbmVzcyBhY3Jvc3MgYWxsIHN1Y2gNCiBwZWVycyBpcyBwcm9iYWJseSBhbiBpbnRyYWN0 YWJsZSBwcm9ibGVtLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PGI+U3ViamVjdCBQcmluY2lwYWxzPC9iPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5XaGlsZSB3aGF0IGlzIHJlcHJl c2VudGVkIHdpdGhpbiBhIHN1YmplY3QgaWRlbnRpZmllciBtYXkgYmUgb25seSBhbiBhc3BlY3Qg b2YgdGhlIG1hbmFnZW1lbnQgZW50aXR5LCB0aGUgYWRtaW5pc3RyYXRpdmUgZ3JvdXBpbmcgaXMg YWJvdXQgdGhlIG1hbmFnZW1lbnQgZW50aXR5IGl0c2VsZi4gVGhpcyBjb3VsZA0KIGJlIHRoZSB1 c2VyLCBkZXZpY2Ugb3Igb3RoZXIgcHJpbmNpcGFsIHRoYXQgdGhlIHN1YmplY3QgaWRlbnRpZmll ciByZXByZXNlbnRzLiBUaGVyZWZvcmUsIGFuIGFic3RyYWN0IG5vdGlvbiBvZiBhIFN1YmplY3Qg UHJpbmNpcGFsIGlzIGFsc28gcmVxdWlyZWQgaW4gb3JkZXIgc3BlY2lmeSB3aGF0IHRoZSBncm91 cGluZyB3aXRoaW4gYSBTUEFHIGlzIGFib3V0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+VGhlIGFib3ZlIGlzIGNhcHR1cmVkIGluIHRo ZSAmcXVvdDtTdWJqZWN0IFByaW5jaXBhbCZxdW90OyBhbmQgJnF1b3Q7U1BBRyZxdW90OyBzZWN0 aW9ucyB3aXRoaW4gdGhlIHByb3Bvc2VkDQo8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vcmlj aGFubmEvc2VjZXZlbnQvcHVsbC8xIiB0YXJnZXQ9Il9ibGFuayI+UFI8L2E+LjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+VGhhbmtzLDxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5BdHVs PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJ ZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50IiB0YXJnZXQ9Il9i bGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48 bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_CH2PR00MB067812E3F5D58E5B1F029137F5610CH2PR00MB0678namp_-- From nobody Tue Jul 14 09:32:32 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8C6D3A0A83 for ; Tue, 14 Jul 2020 09:32:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.095 X-Spam-Level: X-Spam-Status: No, score=-2.095 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OHNxBvsuWkwL for ; Tue, 14 Jul 2020 09:32:27 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59F653A0A7D for ; Tue, 14 Jul 2020 09:32:26 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id j11so23627341ljo.7 for ; Tue, 14 Jul 2020 09:32:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+G3RoRlYp+pq2y0vRS4xTVsZ5n77QkJAlreUoH2qBA8=; b=sbtXbM1XaqUJvprFYbWnJIKk7qKh317V7qyB+T74MeCmShivVK2fGENh/RI+VbB5rB omkh1Cur/I7aNpvn005MLXI1QDGb7FbACxpRe7g4SW8yneGZXEIrVuo9LRuHrD29vAxP bnAFJ36accsrz3uSYugtlOob01HKiI/Uu40ZBAf04XPd2+6QvVe/p01QG45MYTU9/XK7 aaHVGmZS+siXwGm8t6gM+RzhPE9EbcJCkY8NsQySJfboMIaAuxPFRXozoaYricPTD/c9 YRZZPpwEvjb7SNqgA3Y5T+0LnUH18UXO0u8N+rie6LWxqDZzDvs+zw7v3tL4WtCH49Oq Gpxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+G3RoRlYp+pq2y0vRS4xTVsZ5n77QkJAlreUoH2qBA8=; b=ZmVVciNFRBYilPlDHbHBB/KPzUkIcllQo8M0hqWh1AzQSIDrx1Aoej0iC6/rPFDQhC Gk5Lc7D0UOiWeQ+eezKE6h7GjTfzHfhvpDrpVkYbQGSnXR5VpnYizp91EBq3XI4y/rfT rEkmmXXg7ZVirM0Gn/W683az9iwAIZIkmvus/fsC4Rz22JdYcgLhgUfQSwpx0K2QP1wu 9o8u78scFPsMnyBW4FPHMUh9sHuGb5PyxeG5rovIyfJNOTpK0UAV6tx/RfG/+xUQj0jt gbozA7Btr9lDv0E8mzWdTvY1tGNqIPNlF3PtbQ4mUsszon0yfeoexVIEdPL+dT1UvrA+ gqkg== X-Gm-Message-State: AOAM531oZ4RwQJTY1r/abBzkrQQcnthMfBiKaZoJ1mw4UH/DJmm1h/em AskEs2kA17u0BBdj813y+YYbb6lhCIZbC/XkM+Q= X-Google-Smtp-Source: ABdhPJwy8YN66Ar6Anv/f9304N0O07JDKr9A67ReKQOYRyzhtPw5/gg7udFLiUY9BPfeyJ1dquiX6WWrB5iTqPRGeWk= X-Received: by 2002:a2e:80c9:: with SMTP id r9mr2777659ljg.69.1594744344251; Tue, 14 Jul 2020 09:32:24 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Tue, 14 Jul 2020 09:31:47 -0700 Message-ID: To: Mike Jones Cc: Atul Tulshibagwale , SecEvent Content-Type: multipart/alternative; boundary="00000000000025a2fd05aa695a57" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 16:32:30 -0000 --00000000000025a2fd05aa695a57 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Well ... that was not quite what I was saying :) ... but it is another question to ask. I would lean towards it being a subject modifier (a property of the subject object) rather than somewhere else. On Tue, Jul 14, 2020 at 9:25 AM Mike Jones wrote: > I agree with Dick that a key question is whether the SPAG belongs in the > event or in the subject identifier. > > > > Note that this specification could still define a SPAG for inclusion in > SET events, even though its primary purpose is defining subject identifie= rs > for use in SETs. > > > > -- Mike > > > > *From:* Dick Hardt > *Sent:* Tuesday, July 14, 2020 8:56 AM > *To:* Atul Tulshibagwale > *Cc:* Mike Jones ; SecEvent < > id-event@ietf.org> > *Subject:* Re: [Id-event] Subject Principals and Subject Principal > Administrative Groupings > > > > Hi Atul > > > > If the SPAG has value in the event message, then it should be specified. > > > > I was proposing that the SPAG be determined at the transport layer rather > then the event/message layer. > > > > An advantage of being in the event is that it is independent of transport= . > In a multi-tenant situation, where different components do different part= s > of the processing, and the original transport is no longer available, the > SPAG would be always available rather than wrapping the event to include > the SPAG. > > > > > > > > > > > > On Tue, Jul 14, 2020 at 7:55 AM Atul Tulshibagwale > wrote: > > A few points / responses: > > 1. Agree with Mike that spag_id should not be a required claim unless > it's actually required for every subject. So keeping it optional (if w= e > decide to have it at all) is the right thing to do. > 2. IMO it will be far simpler for multi-tenanted hosts to use SPAGs > rather than manage multiple event streams (i.e. one per tenant) > 3. A multi-tenanted architecture is increasingly very common, so this > will apply to a large number of organizations. > 4. For single tenanted transmitters, the SPAG id may be inferred by > receivers. Single tenanted receivers may ignore the SPAG ids in the > subjects. So processing SPAGs in hybrid situations does not appear to = be > cumbersome. > 5. The use of SPAGs is not limited to tenant-level information, since > it may be applied to OUs or groups > 6. If we agree that SPAG is a "meta concept" that applies in most > situations, then capturing it in the spec is probably important. What = Dick > is proposing is a way to implement SPAGs without specifying them in a > standard, so each entity is free to define it the way they want. This > approach can cause incompatibilities. > 7. Without SPAGs in the spec, if peers need to send events about > SPAGs, then they need to use the "iss-sub" catch all to send events ab= out > enabling or disabling events about SPAGs. Since this is not standardiz= ed, > it could also cause proprietary and incompatible implementations. > > Atul > > > > On Mon, Jul 13, 2020 at 5:23 PM Mike Jones > wrote: > > As I see it, the use cases that require a spag_id can use them when > necessary (unless the working group decides on another way to do this) bu= t > I certainly would oppose requiring it when it=E2=80=99s unnecessary. > > > > -- Mike > > > > *From:* Id-event *On Behalf Of *Dick Hardt > *Sent:* Monday, July 13, 2020 5:13 PM > *To:* Atul Tulshibagwale > *Cc:* SecEvent > *Subject:* Re: [Id-event] Subject Principals and Subject Principal > Administrative Groupings > > > > Would different URLs for each relationship not solve your issue of > maintaining secrets for each SPAG? For example: > > > > https:/example.com/secevent/SPAG_ID_1 > > > > https:/example.com/secevent/SPAG_ID_2 > > > > https:/example.com/secevent/SPAG_ID_3 > > > > Then the credential is independent of the SPAG, but we are not injecting > an identifier (spag_id) that is only relevant to orgs that want to use th= e > same credentials across SPAG relationships. > > > > > > > > On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale > wrote: > > I am OK with making the spag_id a required claim in every subject > identifier. For single tenanted transmitters, it would be a constant valu= e > for all events they generate. > > > > On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt wrote: > > So the receiver is using authentication sometimes to determine SPAG, and > not at other times? > > > > I'm digging into this as I had always thought of the event being between > two parties, where they are identified by the endpoint and/or the > credentials. > > > > Adding a relationship identifier seems to be solving the problem at the > wrong layer, unless it is in all events. > > > > > > On Mon, Jul 13, 2020 at 3:54 PM Atul Tulshibagwale > wrote: > > Sorry for the terse message. > > > > If a single tenant transmitter is trusted by a multi-tenanted receiver fo= r > a specific tenant, then the SPAG-id need not be included if the subject i= s > unique at the tenant level, because the receiver will automatically > identify SPAG that the subject belongs to on its end (based on the > authentication). > > > > > > > > On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt wrote: > > Which part is not required? > > > > On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale > wrote: > > Not required, since the claim is optional. > > > > On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt wrote: > > Would a transmitter that is only in one SPAG (a single tenant system) hav= e > to include its SPAG id in events sent to a receiver that accepts events > from multiple SPAGs? But it would not include it in sending events to oth= er > receivers that have separate credentials for each relationship? > > > > > > > > =E1=90=A7 > > > > On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale > wrote: > > That could be true but there are a few ways in which it can be avoided: > > 1. The peers leverage some higher-level trust to accept / decline > events relating to lower level SPAGs. For example, if trust is establi= shed > at a tenant level, then an OU level SPAG need not have its own > authorization. > 2. The secret required for establishing the authorization of a SPAG > may be temporary. For example: > > > 1. An administrator signs in to their tenant in the transmitter's > administrator console > 2. The admin obtains a temporary authorization (one-time code) > 3. The admin signs in to their tenant in the receiver's > administration console and pastes in the one-time code > 4. The receiver sends a request to enable the stream for the > specified SPAG with that one-time authorization. > > In the first case, there are no additional secrets required. In the secon= d > case, the secret is temporary. > > > > > > > > On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt wrote: > > I see the SPAG lets the transmitter and receiver provide context, as the > subject identifier may be the same across SPAGs. > > > > Now I'm trying to understand how the transmitter authenticates to the > receiver if it does not have it's own secret (assuming that authenticatio= n > model) -- IE, how does the receiver know the transmitter is authorized fo= r > that SPAG? > > > > > > On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale > wrote: > > Dick, your understanding is correct. > > > > To clarify the proposal here, Here's the text I'm proposing to be added: > > > 3. Subject Principals > > Subject Principals are the management entities associated with > Subjects. These may be human or robotic principals or devices or > other entities that are managed by transmitters and receivers. For > example, the same Subject Principal may be referred to by an email > address or a phone number. A transmitter or receiver will typically > manage subject principals and organize them into sub-groupings such > as tenants, groups, organizational units, etc. > > Subjects are identified by Subject Identifiers defined below. > > 3.1. SPAGs > > Subject Principals MAY be grouped for administrative purposes into > "Subject Principal Administrative Groupings" or SPAGs. For example, > all users belonging to one customer of a "multi-tenanted" Transmitter > may be in one SPAG. Alternatively, an Organizational Unit or a group > of Subjects within a customer of a Transmitter (whether multi- > tenanted or not) may be one SPAG. SPAGs may have overlapping sets of > Subjects. > > A SPAG MAY be the Subject of certain stream update events defined > later in this spec, hence is defined as a Subject Type of its own > below.. A SPAG identifier MAY be included in other subject types to > disambiguate the subject. > > A SPAG subject identifier is agreed to offline between a transmitter > and a receiver. > > The benefits of doing this are: > > 1. Multi-tenanted hosts do not need to maintain secrets per tenant and > per transmitter tenant if each tenant has to be an event transmitter a= nd an > event receiver of its own. > 2. An event stream may be established between two multi-tenanted > hosts, and so does not need to be managed at a per-tenant level > 3. The same subject or subject principal may be a part of multiple > SPAGs, and identifying the SPAG that an event relates to can be achiev= ed if > the standard allows for the SPAGs to be identified. > > > > > > On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt wrote: > > To clarify, your proposal is driven by the implementation burden of > maintaining separate secrets / streams between a transmitter and receiver= ? > > =E1=90=A7 > > > > On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: > > Hi all, > > Here's a quick background for the proposal > for including Subject > Principals and Subject Principal Administrative Groupings or SPAGs in the > Subject Identifiers spec. > > > > *Use of Subject Identifiers in Shared Signals and Events*: > > The Shared Signals and Events (SSE) profile of SETs specifies that > transmitters and receivers send and receive SETs that contain Subject > Identifiers. These subject identifiers have the format that is now being > discussed as a separate specification here. > > > > *Transmitters and Receivers in SSE* > > The SSE profile defines transmitters and receivers as hosts that manage > streams between peers. The receiver authenticates to the transmitter usin= g > OAuth, requiring the use of a secret per receiver. In a multi-tenanted ho= st > that handles hundreds of thousands or millions of independent tenants, > maintaining such a secret per instance of a receiver is cumbersome. > Furthermore, since a transmitter and a receiver has to maintain a stream > per pair, creating such per-tenant streams can add significant > implementation overhead. > > > > *SPAGs* > > Therefore, we need a notion of a grouping of subjects within the same > transmitter and receiver to distinguish between various administrative > groupings that exist within a host. These groupings could include tenants= , > organizational units or user groups.. This grouping is captured in the > notion of a SPAG. The uniqueness of a user identifier (subject identifier= ) > may also be limited to a SPAG. For example, if a random unique ID > represents a user, then that ID may be unique within a SPAG and not > universally across a transmitter or receiver. This is because each > transmitter and receiver may have multiple connections to other > transmitters and receivers, and ensuring uniqueness across all such peers > is probably an intractable problem. > > > > *Subject Principals* > > While what is represented within a subject identifier may be only an > aspect of the management entity, the administrative grouping is about the > management entity itself. This could be the user, device or other princip= al > that the subject identifier represents. Therefore, an abstract notion of = a > Subject Principal is also required in order specify what the grouping > within a SPAG is about. > > > > The above is captured in the "Subject Principal" and "SPAG" sections > within the proposed PR . > > > > Thanks, > > Atul > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --00000000000025a2fd05aa695a57 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Well ... that was not quite what I was saying :) ... but i= t is another question to ask. I would lean towards it being a subject modif= ier (a property of the subject object) rather than somewhere else.
    On Tue, J= ul 14, 2020 at 9:25 AM Mike Jones <Michael.Jones@microsoft.com> wrote:

    I agree with Dick= that a key question is whether the SPAG belongs in the event or in the sub= ject identifier.

    =C2=A0<= /u>

    Note that this sp= ecification could still define a SPAG for inclusion in SET events, even tho= ugh its primary purpose is defining subject identifiers for use in SETs.=

    =C2=A0<= /u>

    =C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0<= /u>

    From: Dick Hardt <dick.hardt@gmail.com>
    Sent: Tuesday, July 14, 2020 8:56 AM
    To: Atul Tulshibagwale <atultulshi@google.com>
    Cc: Mike Jones <Michael.Jones@microsoft.com>; SecEvent <id-event@ietf.org> Subject: Re: [Id-event] Subject Principals and Subject Principal Adm= inistrative Groupings

    =C2=A0

    Hi Atul

    =C2=A0

    If the SPAG has value in the event message, then it = should be specified.

    =C2=A0

    I was proposing that the SPAG be determined at the t= ransport layer rather then the event/message layer.

    =C2=A0

    An advantage of being in the event is that it is ind= ependent of transport. In a multi-tenant situation, where different compone= nts do different parts of the processing, and the original transport is no = longer available, the SPAG would be always available rather than wrapping the event to include the SPAG.

    =C2=A0

    =C2=A0

    =C2=A0

    =C2=A0

    =C2=A0

    On Tue, Jul 14, 2020 at 7:55 AM Atul Tulshibagwale &= lt;atultulshi@go= ogle.com> wrote:

    A few points / responses:

    1. Agree with Mike that spag_id should not be a required=C2=A0claim unless it&= #39;s actually required for every subject. So keeping it optional (if we de= cide to have it at all) is the right thing to do.
    2. IMO it will be far simpler for multi-tenanted hosts to use SPAGs rather tha= n manage multiple event streams (i.e. one per tenant)
      3. A multi-tenanted architecture is increasingly very common, so this will app= ly to a large number of organizations.
    3. For single tenanted transmitters, the SPAG id may be inferred by receivers.= Single tenanted receivers may ignore the SPAG ids in the subjects. So proc= essing SPAGs in hybrid situations does not appear to be cumbersome.<= u>
    4. The use of SPAGs is not limited to tenant-level information, since it may b= e applied to OUs or groups
    5. If we agree that SPAG is a "meta concept" that applies in most si= tuations, then capturing it in the spec is probably important. What Dick is= proposing is a way to implement SPAGs without specifying them in a standar= d, so each entity is free to define it the way they want. This approach can cause incompatibilities.
    6. Without SPAGs in the spec, if peers need to send events about SPAGs, then t= hey need to use the "iss-sub" catch all to send events about enab= ling or disabling events about SPAGs. Since this is not standardized, it co= uld also cause proprietary and incompatible implementations.

    Atul

    =C2=A0

    On Mon, Jul 13, 2020 at 5:23 PM Mike Jones <Michael.Jones@m= icrosoft.com> wrote:

    As I see it, the = use cases that require a spag_id can use them when necessary (unless the wo= rking group decides on another way to do this) but I certainly would oppose requiring it when it=E2=80=99s unnecessary.<= /u>

    =C2=A0<= /u>

    =C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0<= /u>

    From: Id-event <id-event-bounces@ietf.org> On Behalf Of Dick Hardt
    Sent: Monday, July 13, 2020 5:13 PM
    To: Atul Tulshibagwale <atultulshi@google.com>
    Cc: SecEvent <id-event@ietf.org>
    Subject: Re: [Id-event] Subject Principals and Subject Principal Adm= inistrative Groupings

    =C2=A0

    Would different URLs for each relationship not solve= your issue of maintaining secrets for each SPAG? For example:

    =C2=A0

    =C2=A0

    =C2=A0

    Then the credential is independent=C2=A0of the SPAG,= but we are not injecting an identifier (spag_id) that is only relevant=C2= =A0to orgs that want to use the same credentials across SPAG relationships.

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale &= lt;atultulshi@go= ogle.com> wrote:

    I am OK with making the spag_id a required claim in = every subject identifier. For single tenanted transmitters, it would be a c= onstant value for all events they generate.

    =C2=A0

    On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    So the receiver is using authentication sometimes to= determine SPAG, and not at other times?

    =C2=A0

    I'm digging into this as I had always thought of= the event being between two parties, where they are identified=C2=A0by the= endpoint and/or the credentials.

    =C2=A0

    Adding a relationship identifier seems to be solving= the problem at the wrong layer, unless it is in all events.<= /p>

    =C2=A0

    =C2=A0

    Sorry for the terse message.

    =C2=A0

    If a single tenant transmitter is trusted by a multi= -tenanted receiver for a specific tenant, then the SPAG-id need not be incl= uded if the subject is unique at the tenant level, because the receiver will automatically identify SPAG that the subject bel= ongs to on its end (based on the authentication).

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    Which part is not required?

    =C2=A0

    Not required, since the claim is optional.=

    =C2=A0

    On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    Would a transmitter that is only in one SPAG (a sing= le tenant system) have to include its SPAG id in events sent to a receiver = that accepts events from multiple SPAGs? But it would not include it in sending events to other receivers=C2=A0that have separat= e credentials for each relationship?

    =C2=A0

    =C2=A0

    =C2=A0

    =E1=90=A7

    =C2=A0

    That could be true but there are a few ways in which= it can be avoided:

    1. The peers leverage some higher-level trust to accept / decline events relat= ing to lower level SPAGs. For example, if trust is established at a tenant = level, then an OU level SPAG need not have its own authorization.=
    2. The secret required for establishing the authorization of a SPAG may be tem= porary. For example:
      1. An administrator signs in to their tenant in the transmitter's administ= rator console
      2. The admin obtains a temporary authorization (one-time code)
      3. The admin signs in to their tenant in the receiver's administration con= sole and pastes in the one-time code
      4. The receiver sends a request to enable the stream for the specified SPAG wi= th that one-time authorization.

    In the first case, there are no additional secrets r= equired. In the second case, the secret is temporary.

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    I see the SPAG lets the transmitter and receiver pro= vide context, as the subject identifier may be the same across SPAGs.

    =C2=A0

    Now I'm trying to understand how the transmitter= authenticates to the receiver if it does not have it's own secret (ass= uming that authentication model) -- IE, how does the receiver know the transmitter is authorized=C2=A0for that SPAG?

    =C2=A0

    =C2=A0

    Dick, your understanding is correct.

    =C2=A0

    To clarify the proposal here, Here's the text I&= #39;m proposing to be added:


    3.=C2=A0 Subject Princi= pals

    =C2=A0 =C2=A0Subject Principals are the management entities associated with=
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or robotic principals or de= vices or
    =C2=A0 =C2=A0other entities that are managed by transmitters and receivers.= =C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Principal may be referred to by an e= mail
    =C2=A0 =C2=A0address or a phone number.=C2=A0 A transmitter or receiver wil= l typically
    =C2=A0 =C2=A0manage subject principals and organize them into sub-groupings= such
    =C2=A0 =C2=A0as tenants, groups, organizational units, etc.

    =C2=A0 =C2=A0Subjects are identified by Subject Identifiers defined below.<= br>
    3.1.=C2=A0 SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be grouped for administrative purposes = into
    =C2=A0 =C2=A0"Subject Principal Administrative Groupings" or SPAG= s.=C2=A0 For example,
    =C2=A0 =C2=A0all users belonging to one customer of a "multi-tenanted&= quot; Transmitter
    =C2=A0 =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organizational Uni= t or a group
    =C2=A0 =C2=A0of Subjects within a customer of a Transmitter (whether multi-=
    =C2=A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs may have overlap= ping sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A SPAG MAY be the Subject of certain stream update events defi= ned
    =C2=A0 =C2=A0later in this spec, hence is defined as a Subject Type of its = own
    =C2=A0 =C2=A0below..=C2=A0 A SPAG identifier MAY be included in other subje= ct types to
    =C2=A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2=A0A SPAG subject identifier is agreed to offline between a trans= mitter
    =C2=A0 =C2=A0and a receiver.

    The benefits of doing this are:

    1. Multi-tenanted hosts do not need to maintain secrets per tenant and per tra= nsmitter tenant if each tenant has to be an event transmitter and an event = receiver of its own.
    2. An event stream may be established between two multi-tenanted hosts, and so= does not need to be managed at a per-tenant level
    3. The same subject or subject principal may be a part of multiple SPAGs, and = identifying the SPAG that an event relates to can be achieved if the standa= rd allows for the SPAGs to be identified.

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt <dick.hardt@gmail.com<= /a>> wrote:

    To clarify, your proposal is driven by the implement= ation=C2=A0burden of maintaining separate secrets / streams between a trans= mitter and receiver?

    =E1=90=A7

    =C2=A0

    Hi all,=C2=A0

    Here's a quick background for the p= roposal for including Subject Principals and Subject Principal Administ= rative Groupings or SPAGs in the Subject Identifiers spec.

    =C2=A0

    Use of Subject Identifiers in Shared Signals and = Events:

    The Shared Signals and Events (SSE) profile of SETs = specifies that transmitters and receivers send and receive SETs that contai= n Subject Identifiers. These subject identifiers have the format that is now being discussed as a separate specification here.

    =C2=A0

    Transmitters and Receivers in SSE

    The SSE profile defines transmitters and receivers a= s hosts that manage streams between peers. The receiver authenticates to th= e transmitter using OAuth, requiring the use of a secret per receiver. In a multi-tenanted host that handles hundreds of tho= usands or millions of independent tenants, maintaining such a secret per in= stance of a receiver is cumbersome. Furthermore, since a transmitter and a = receiver has to maintain a stream per pair, creating such per-tenant streams can add significant implementat= ion overhead.

    =C2=A0

    SPAGs

    Therefore, we need a notion of a grouping of subject= s within the same transmitter and receiver to distinguish between various a= dministrative groupings that exist within a host. These groupings could include tenants, organizational units or user groups= .. This grouping is captured in the notion of a SPAG. The uniqueness of a u= ser identifier (subject identifier) may also be limited to a SPAG. For exam= ple, if a random unique ID represents a user, then that ID may be unique within a SPAG and not universally acros= s a transmitter or receiver. This is because each transmitter and receiver = may have multiple connections to other transmitters and receivers, and ensu= ring uniqueness across all such peers is probably an intractable problem.

    =C2=A0

    Subject Principals

    While what is represented within a subject identifie= r may be only an aspect of the management entity, the administrative groupi= ng is about the management entity itself. This could be the user, device or other principal that the subject identifier represe= nts. Therefore, an abstract notion of a Subject Principal is also required = in order specify what the grouping within a SPAG is about.

    =C2=A0

    The above is captured in the "Subject Principal= " and "SPAG" sections within the proposed P= R.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    --00000000000025a2fd05aa695a57-- From nobody Tue Jul 14 09:34:36 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 847B63A0A85 for ; Tue, 14 Jul 2020 09:34:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.92 X-Spam-Level: X-Spam-Status: No, score=-1.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qs-03j1Btmbs for ; Tue, 14 Jul 2020 09:34:32 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 943CA3A0A84 for ; Tue, 14 Jul 2020 09:34:32 -0700 (PDT) Received: from [192.168.1.7] (static-71-174-62-56.bstnma.fios.verizon.net [71.174.62.56]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 06EGYUAj029737 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 14 Jul 2020 12:34:31 -0400 From: Justin Richer Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Message-Id: <272E9638-3FBC-45DF-8203-B52F86D3E211@mit.edu> Date: Tue, 14 Jul 2020 12:34:30 -0400 To: id-event@ietf.org X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: [Id-event] Review: Subject Identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 16:34:34 -0000 I=E2=80=99ve read through draft-ietf-secevent-subject-identifiers and = for the most part it=E2=80=99s in good shape. Apologies if any of these = points have been thoroughly covered in other reviews.=20 =C2=A71: While this is a SET-focused spec, I would like to see more = discussion about how this identifier structure can be used outside of a = SET or a JWT in general.=20 =C2=A73.3: small typo, =E2=80=9Cemail=E2=80=9D should be =E2=80=9Cphone = number=E2=80=9D in introducing example. =C2=A73: I=E2=80=99m wondering if there=E2=80=99s worth in defining = semantic flags that can be used across types. Like =E2=80=9Cpseudonymous=E2= =80=9D or =E2=80=9Cper-provider-id=E2=80=9D or the like? That might be a = step beyond what this is trying to do, though the current definitions do = not allow extension of existing types with new fields. I=E2=80=99d also like to see a note that multiple subject types could be = presented together without using the =E2=80=9Caliases=E2=80=9D = structure. This mostly would apply outside of SET which defines a single = =E2=80=9Csub-id=E2=80=9D container, but as above I think this can be = more generally used. Overall, I think it=E2=80=99s a pretty simple and straightforward spec = and should go forward. Thanks, =E2=80=94 Justin= From nobody Tue Jul 14 09:50:29 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE1533A0A64 for ; Tue, 14 Jul 2020 09:50:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.598 X-Spam-Level: X-Spam-Status: No, score=-17.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id scQJqPWoAjht for ; Tue, 14 Jul 2020 09:50:23 -0700 (PDT) Received: from mail-yb1-xb32.google.com (mail-yb1-xb32.google.com [IPv6:2607:f8b0:4864:20::b32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 004613A08C0 for ; Tue, 14 Jul 2020 09:50:22 -0700 (PDT) Received: by mail-yb1-xb32.google.com with SMTP id y13so8475085ybj.10 for ; Tue, 14 Jul 2020 09:50:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CnMdbdxhDVYg9UAx5bSrYOMQl3v2NaxKcpA/3O91iDE=; b=WcF7FjN4pQFofH3cvFWG1VyHuZyLd1FPRA5NwPtZ2fX6T2EDpgzWcPMPO0cHlIglwN ErQqy1kXIE9mxpRKUEU5pZkYK0WSKc3me6B3XBOhwKJPrNR4/LhnAMBnNzGE74EwRSZ9 G3/MDNwsjLfQp9RioamNzgHV4orq0LdObi6su+H6ls2JeGO9LLlWoisGJZsLP36j6Dsf UpCn8FfDQWCnkm+RLHhtL2gEledOTnDGghDIaR7WYemQOdRhCG2RZPg+JKhHsToLB/gZ wzxUZ/WEaiXprep7uJlaL7zZGPlbQVnzoILOO9DzxpRnqzuNm2/4ZFhwLj058swjH0zD 67wg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CnMdbdxhDVYg9UAx5bSrYOMQl3v2NaxKcpA/3O91iDE=; b=mRrYT1wd6iIQl6x7pZ3/tSnxWaBJ/KJnJ/m5nqrZTQdlgfDCKrxsxcZBqYKjFSOQ8H +JYfI65ThnkBNxPzrOdJyBgABtmJgZ9qeiNSlPSNNFD5jlun2HGfZEAULOaXKPsPTiUx jjZlNTSsncycenATDI22Uik/CLrpWDkg0Pc4FYSvBMYSBEVXSeNclgnBZ/R8PkQSVJUB fX/mnYlMq2xYfar5lmO5rMI+CBKqFzn22qvRdOhGAMAMx0jr2MDbZ32Qe//OVL2HTXEm mQeo8vYr001A7Z0ZXYZt808EV3TPcxd51y2K4A8g8kFt+YjNm/mzGneDbaJF8jNTsVzF y9jQ== X-Gm-Message-State: AOAM531eSa4Nd+rBhHFFhJ1jToUXxj3xfT2Y2LnPYEDKtFTXcaraEHCW LGcL9FP3GEwqHmOUweIRsjBtmwhR9z+03Z4Vi19fxA== X-Google-Smtp-Source: ABdhPJynWPIs0wmLSyU9hd6fdyIwUKUtQ7UlvyiAiX8+cmlfpJ41JKwy/4NX80gs+RRtG1mrhT0jkTnXjHOwwVtWqC8= X-Received: by 2002:a25:3155:: with SMTP id x82mr9331201ybx.492.1594745421561; Tue, 14 Jul 2020 09:50:21 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Atul Tulshibagwale Date: Tue, 14 Jul 2020 09:50:10 -0700 Message-ID: To: Dick Hardt Cc: Mike Jones , SecEvent Content-Type: multipart/alternative; boundary="0000000000005c89e905aa699a17" Archived-At: Subject: Re: [Id-event] Subject Principals and Subject Principal Administrative Groupings X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 16:50:26 -0000 --0000000000005c89e905aa699a17 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable That's how I was thinking about it too. It's a property of the subject, so it could be a part of the subject-identifier. On Tue, Jul 14, 2020 at 9:32 AM Dick Hardt wrote: > Well ... that was not quite what I was saying :) ... but it is another > question to ask. I would lean towards it being a subject modifier (a > property of the subject object) rather than somewhere else. > > On Tue, Jul 14, 2020 at 9:25 AM Mike Jones > wrote: > >> I agree with Dick that a key question is whether the SPAG belongs in the >> event or in the subject identifier. >> >> >> >> Note that this specification could still define a SPAG for inclusion in >> SET events, even though its primary purpose is defining subject identifi= ers >> for use in SETs. >> >> >> >> -- Mike >> >> >> >> *From:* Dick Hardt >> *Sent:* Tuesday, July 14, 2020 8:56 AM >> *To:* Atul Tulshibagwale >> *Cc:* Mike Jones ; SecEvent < >> id-event@ietf.org> >> *Subject:* Re: [Id-event] Subject Principals and Subject Principal >> Administrative Groupings >> >> >> >> Hi Atul >> >> >> >> If the SPAG has value in the event message, then it should be specified. >> >> >> >> I was proposing that the SPAG be determined at the transport layer rathe= r >> then the event/message layer. >> >> >> >> An advantage of being in the event is that it is independent of >> transport. In a multi-tenant situation, where different components do >> different parts of the processing, and the original transport is no long= er >> available, the SPAG would be always available rather than wrapping the >> event to include the SPAG. >> >> >> >> >> >> >> >> >> >> >> >> On Tue, Jul 14, 2020 at 7:55 AM Atul Tulshibagwale >> wrote: >> >> A few points / responses: >> >> 1. Agree with Mike that spag_id should not be a required claim unless >> it's actually required for every subject. So keeping it optional (if = we >> decide to have it at all) is the right thing to do. >> 2. IMO it will be far simpler for multi-tenanted hosts to use SPAGs >> rather than manage multiple event streams (i.e. one per tenant) >> 3. A multi-tenanted architecture is increasingly very common, so this >> will apply to a large number of organizations. >> 4. For single tenanted transmitters, the SPAG id may be inferred by >> receivers. Single tenanted receivers may ignore the SPAG ids in the >> subjects. So processing SPAGs in hybrid situations does not appear to= be >> cumbersome. >> 5. The use of SPAGs is not limited to tenant-level information, since >> it may be applied to OUs or groups >> 6. If we agree that SPAG is a "meta concept" that applies in most >> situations, then capturing it in the spec is probably important. What= Dick >> is proposing is a way to implement SPAGs without specifying them in a >> standard, so each entity is free to define it the way they want. This >> approach can cause incompatibilities. >> 7. Without SPAGs in the spec, if peers need to send events about >> SPAGs, then they need to use the "iss-sub" catch all to send events a= bout >> enabling or disabling events about SPAGs. Since this is not standardi= zed, >> it could also cause proprietary and incompatible implementations. >> >> Atul >> >> >> >> On Mon, Jul 13, 2020 at 5:23 PM Mike Jones >> wrote: >> >> As I see it, the use cases that require a spag_id can use them when >> necessary (unless the working group decides on another way to do this) b= ut >> I certainly would oppose requiring it when it=E2=80=99s unnecessary. >> >> >> >> -- Mike >> >> >> >> *From:* Id-event *On Behalf Of *Dick Hardt >> *Sent:* Monday, July 13, 2020 5:13 PM >> *To:* Atul Tulshibagwale >> *Cc:* SecEvent >> *Subject:* Re: [Id-event] Subject Principals and Subject Principal >> Administrative Groupings >> >> >> >> Would different URLs for each relationship not solve your issue of >> maintaining secrets for each SPAG? For example: >> >> >> >> https:/example.com/secevent/SPAG_ID_1 >> >> >> >> https:/example.com/secevent/SPAG_ID_2 >> >> >> >> https:/example.com/secevent/SPAG_ID_3 >> >> >> >> Then the credential is independent of the SPAG, but we are not injecting >> an identifier (spag_id) that is only relevant to orgs that want to use t= he >> same credentials across SPAG relationships. >> >> >> >> >> >> >> >> On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale >> wrote: >> >> I am OK with making the spag_id a required claim in every subject >> identifier. For single tenanted transmitters, it would be a constant val= ue >> for all events they generate. >> >> >> >> On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt wrote: >> >> So the receiver is using authentication sometimes to determine SPAG, and >> not at other times? >> >> >> >> I'm digging into this as I had always thought of the event being between >> two parties, where they are identified by the endpoint and/or the >> credentials. >> >> >> >> Adding a relationship identifier seems to be solving the problem at the >> wrong layer, unless it is in all events. >> >> >> >> >> >> On Mon, Jul 13, 2020 at 3:54 PM Atul Tulshibagwale >> wrote: >> >> Sorry for the terse message. >> >> >> >> If a single tenant transmitter is trusted by a multi-tenanted receiver >> for a specific tenant, then the SPAG-id need not be included if the subj= ect >> is unique at the tenant level, because the receiver will automatically >> identify SPAG that the subject belongs to on its end (based on the >> authentication). >> >> >> >> >> >> >> >> On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt wrote: >> >> Which part is not required? >> >> >> >> On Mon, Jul 13, 2020 at 3:33 PM Atul Tulshibagwale >> wrote: >> >> Not required, since the claim is optional. >> >> >> >> On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt wrote: >> >> Would a transmitter that is only in one SPAG (a single tenant system) >> have to include its SPAG id in events sent to a receiver that accepts >> events from multiple SPAGs? But it would not include it in sending event= s >> to other receivers that have separate credentials for each relationship? >> >> >> >> >> >> >> >> =E1=90=A7 >> >> >> >> On Mon, Jul 13, 2020 at 3:05 PM Atul Tulshibagwale >> wrote: >> >> That could be true but there are a few ways in which it can be avoided: >> >> 1. The peers leverage some higher-level trust to accept / decline >> events relating to lower level SPAGs. For example, if trust is establ= ished >> at a tenant level, then an OU level SPAG need not have its own >> authorization. >> 2. The secret required for establishing the authorization of a SPAG >> may be temporary. For example: >> >> >> 1. An administrator signs in to their tenant in the transmitter's >> administrator console >> 2. The admin obtains a temporary authorization (one-time code) >> 3. The admin signs in to their tenant in the receiver's >> administration console and pastes in the one-time code >> 4. The receiver sends a request to enable the stream for the >> specified SPAG with that one-time authorization. >> >> In the first case, there are no additional secrets required. In the >> second case, the secret is temporary. >> >> >> >> >> >> >> >> On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt wrote: >> >> I see the SPAG lets the transmitter and receiver provide context, as the >> subject identifier may be the same across SPAGs. >> >> >> >> Now I'm trying to understand how the transmitter authenticates to the >> receiver if it does not have it's own secret (assuming that authenticati= on >> model) -- IE, how does the receiver know the transmitter is authorized f= or >> that SPAG? >> >> >> >> >> >> On Mon, Jul 13, 2020 at 2:08 PM Atul Tulshibagwale >> wrote: >> >> Dick, your understanding is correct. >> >> >> >> To clarify the proposal here, Here's the text I'm proposing to be added: >> >> >> 3. Subject Principals >> >> Subject Principals are the management entities associated with >> Subjects. These may be human or robotic principals or devices or >> other entities that are managed by transmitters and receivers. For >> example, the same Subject Principal may be referred to by an email >> address or a phone number. A transmitter or receiver will typically >> manage subject principals and organize them into sub-groupings such >> as tenants, groups, organizational units, etc. >> >> Subjects are identified by Subject Identifiers defined below. >> >> 3.1. SPAGs >> >> Subject Principals MAY be grouped for administrative purposes into >> "Subject Principal Administrative Groupings" or SPAGs. For example, >> all users belonging to one customer of a "multi-tenanted" Transmitter >> may be in one SPAG. Alternatively, an Organizational Unit or a group >> of Subjects within a customer of a Transmitter (whether multi- >> tenanted or not) may be one SPAG. SPAGs may have overlapping sets of >> Subjects. >> >> A SPAG MAY be the Subject of certain stream update events defined >> later in this spec, hence is defined as a Subject Type of its own >> below.. A SPAG identifier MAY be included in other subject types to >> disambiguate the subject. >> >> A SPAG subject identifier is agreed to offline between a transmitter >> and a receiver. >> >> The benefits of doing this are: >> >> 1. Multi-tenanted hosts do not need to maintain secrets per tenant >> and per transmitter tenant if each tenant has to be an event transmit= ter >> and an event receiver of its own. >> 2. An event stream may be established between two multi-tenanted >> hosts, and so does not need to be managed at a per-tenant level >> 3. The same subject or subject principal may be a part of multiple >> SPAGs, and identifying the SPAG that an event relates to can be achie= ved if >> the standard allows for the SPAGs to be identified. >> >> >> >> >> >> On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt wrote= : >> >> To clarify, your proposal is driven by the implementation burden of >> maintaining separate secrets / streams between a transmitter and receive= r? >> >> =E1=90=A7 >> >> >> >> On Mon, Jul 13, 2020 at 9:01 AM Atul Tulshibagwale > 40google.com@dmarc.ietf.org <40google.com@dmarc..ietf.org>> wrote: >> >> Hi all, >> >> Here's a quick background for the proposal >> for including Subject >> Principals and Subject Principal Administrative Groupings or SPAGs in th= e >> Subject Identifiers spec. >> >> >> >> *Use of Subject Identifiers in Shared Signals and Events*: >> >> The Shared Signals and Events (SSE) profile of SETs specifies that >> transmitters and receivers send and receive SETs that contain Subject >> Identifiers. These subject identifiers have the format that is now being >> discussed as a separate specification here. >> >> >> >> *Transmitters and Receivers in SSE* >> >> The SSE profile defines transmitters and receivers as hosts that manage >> streams between peers. The receiver authenticates to the transmitter usi= ng >> OAuth, requiring the use of a secret per receiver. In a multi-tenanted h= ost >> that handles hundreds of thousands or millions of independent tenants, >> maintaining such a secret per instance of a receiver is cumbersome. >> Furthermore, since a transmitter and a receiver has to maintain a stream >> per pair, creating such per-tenant streams can add significant >> implementation overhead. >> >> >> >> *SPAGs* >> >> Therefore, we need a notion of a grouping of subjects within the same >> transmitter and receiver to distinguish between various administrative >> groupings that exist within a host. These groupings could include tenant= s, >> organizational units or user groups.. This grouping is captured in the >> notion of a SPAG. The uniqueness of a user identifier (subject identifie= r) >> may also be limited to a SPAG. For example, if a random unique ID >> represents a user, then that ID may be unique within a SPAG and not >> universally across a transmitter or receiver. This is because each >> transmitter and receiver may have multiple connections to other >> transmitters and receivers, and ensuring uniqueness across all such peer= s >> is probably an intractable problem. >> >> >> >> *Subject Principals* >> >> While what is represented within a subject identifier may be only an >> aspect of the management entity, the administrative grouping is about th= e >> management entity itself. This could be the user, device or other princi= pal >> that the subject identifier represents. Therefore, an abstract notion of= a >> Subject Principal is also required in order specify what the grouping >> within a SPAG is about. >> >> >> >> The above is captured in the "Subject Principal" and "SPAG" sections >> within the proposed PR . >> >> >> >> Thanks, >> >> Atul >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> --0000000000005c89e905aa699a17 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    That's how I was thinking about it too. It's a pro= perty of the subject, so it could be a part of the subject-identifier.
    On Tu= e, Jul 14, 2020 at 9:32 AM Dick Hardt <dick.hardt@gmail.com> wrote:
    Well ... that was not quite wha= t I was saying :) ... but it is another question to ask. I would lean towar= ds it being a subject modifier (a property of the subject object) rather th= an somewhere else.

    On Tue, Jul 14, 2020 at 9:25 AM Mike Jones <Michael.Jones@micros= oft.com> wrote:

    I agree with Dick= that a key question is whether the SPAG belongs in the event or in the sub= ject identifier.

    =C2=A0<= /u>

    Note that this sp= ecification could still define a SPAG for inclusion in SET events, even tho= ugh its primary purpose is defining subject identifiers for use in SETs.=

    =C2=A0<= /u>

    =C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0<= /u>

    From: Dick Hardt <dick.hardt@gmail.com>
    Sent: Tuesday, July 14, 2020 8:56 AM
    To: Atul Tulshibagwale <atultulshi@google.com>
    Cc: Mike Jones <Michael.Jones@microsoft.com>; SecEvent <id-event@ietf.org> Subject: Re: [Id-event] Subject Principals and Subject Principal Adm= inistrative Groupings

    =C2=A0

    Hi Atul

    =C2=A0

    If the SPAG has value in the event message, then it = should be specified.

    =C2=A0

    I was proposing that the SPAG be determined at the t= ransport layer rather then the event/message layer.

    =C2=A0

    An advantage of being in the event is that it is ind= ependent of transport. In a multi-tenant situation, where different compone= nts do different parts of the processing, and the original transport is no = longer available, the SPAG would be always available rather than wrapping the event to include the SPAG.

    =C2=A0

    =C2=A0

    =C2=A0

    =C2=A0

    =C2=A0

    On Tue, Jul 14, 2020 at 7:55 AM Atul Tulshibagwale &= lt;atultulshi@go= ogle.com> wrote:

    A few points / responses:

    1. Agree with Mike that spag_id should not be a required=C2=A0claim unless it&= #39;s actually required for every subject. So keeping it optional (if we de= cide to have it at all) is the right thing to do.
    2. IMO it will be far simpler for multi-tenanted hosts to use SPAGs rather tha= n manage multiple event streams (i.e. one per tenant)
      3. A multi-tenanted architecture is increasingly very common, so this will app= ly to a large number of organizations.
    3. For single tenanted transmitters, the SPAG id may be inferred by receivers.= Single tenanted receivers may ignore the SPAG ids in the subjects. So proc= essing SPAGs in hybrid situations does not appear to be cumbersome.<= u>
    4. The use of SPAGs is not limited to tenant-level information, since it may b= e applied to OUs or groups
    5. If we agree that SPAG is a "meta concept" that applies in most si= tuations, then capturing it in the spec is probably important. What Dick is= proposing is a way to implement SPAGs without specifying them in a standar= d, so each entity is free to define it the way they want. This approach can cause incompatibilities.
    6. Without SPAGs in the spec, if peers need to send events about SPAGs, then t= hey need to use the "iss-sub" catch all to send events about enab= ling or disabling events about SPAGs. Since this is not standardized, it co= uld also cause proprietary and incompatible implementations.

    Atul

    =C2=A0

    On Mon, Jul 13, 2020 at 5:23 PM Mike Jones <Michael.Jones@m= icrosoft.com> wrote:

    As I see it, the = use cases that require a spag_id can use them when necessary (unless the wo= rking group decides on another way to do this) but I certainly would oppose requiring it when it=E2=80=99s unnecessary.<= /u>

    =C2=A0<= /u>

    =C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0<= /u>

    From: Id-event <id-event-bounces@ietf.org> On Behalf Of Dick Hardt
    Sent: Monday, July 13, 2020 5:13 PM
    To: Atul Tulshibagwale <atultulshi@google.com>
    Cc: SecEvent <id-event@ietf.org>
    Subject: Re: [Id-event] Subject Principals and Subject Principal Adm= inistrative Groupings

    =C2=A0

    Would different URLs for each relationship not solve= your issue of maintaining secrets for each SPAG? For example:

    =C2=A0

    =C2=A0

    =C2=A0

    Then the credential is independent=C2=A0of the SPAG,= but we are not injecting an identifier (spag_id) that is only relevant=C2= =A0to orgs that want to use the same credentials across SPAG relationships.

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 5:08 PM Atul Tulshibagwale &= lt;atultulshi@go= ogle.com> wrote:

    I am OK with making the spag_id a required claim in = every subject identifier. For single tenanted transmitters, it would be a c= onstant value for all events they generate.

    =C2=A0

    On Mon, Jul 13, 2020 at 4:01 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    So the receiver is using authentication sometimes to= determine SPAG, and not at other times?

    =C2=A0

    I'm digging into this as I had always thought of= the event being between two parties, where they are identified=C2=A0by the= endpoint and/or the credentials.

    =C2=A0

    Adding a relationship identifier seems to be solving= the problem at the wrong layer, unless it is in all events.<= /p>

    =C2=A0

    =C2=A0

    Sorry for the terse message.

    =C2=A0

    If a single tenant transmitter is trusted by a multi= -tenanted receiver for a specific tenant, then the SPAG-id need not be incl= uded if the subject is unique at the tenant level, because the receiver will automatically identify SPAG that the subject bel= ongs to on its end (based on the authentication).

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 3:37 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    Which part is not required?

    =C2=A0

    Not required, since the claim is optional.=

    =C2=A0

    On Mon, Jul 13, 2020 at 3:25 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    Would a transmitter that is only in one SPAG (a sing= le tenant system) have to include its SPAG id in events sent to a receiver = that accepts events from multiple SPAGs? But it would not include it in sending events to other receivers=C2=A0that have separat= e credentials for each relationship?

    =C2=A0

    =C2=A0

    =C2=A0

    =E1=90=A7

    =C2=A0

    That could be true but there are a few ways in which= it can be avoided:

    1. The peers leverage some higher-level trust to accept / decline events relat= ing to lower level SPAGs. For example, if trust is established at a tenant = level, then an OU level SPAG need not have its own authorization.=
    2. The secret required for establishing the authorization of a SPAG may be tem= porary. For example:
      1. An administrator signs in to their tenant in the transmitter's administ= rator console
      2. The admin obtains a temporary authorization (one-time code)
      3. The admin signs in to their tenant in the receiver's administration con= sole and pastes in the one-time code
      4. The receiver sends a request to enable the stream for the specified SPAG wi= th that one-time authorization.

    In the first case, there are no additional secrets r= equired. In the second case, the secret is temporary.

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 2:34 PM Dick Hardt <dick.hardt@gmail.com> wrote:

    I see the SPAG lets the transmitter and receiver pro= vide context, as the subject identifier may be the same across SPAGs.

    =C2=A0

    Now I'm trying to understand how the transmitter= authenticates to the receiver if it does not have it's own secret (ass= uming that authentication model) -- IE, how does the receiver know the transmitter is authorized=C2=A0for that SPAG?

    =C2=A0

    =C2=A0

    Dick, your understanding is correct.

    =C2=A0

    To clarify the proposal here, Here's the text I&= #39;m proposing to be added:


    3.=C2=A0 Subject Princi= pals

    =C2=A0 =C2=A0Subject Principals are the management entities associated with=
    =C2=A0 =C2=A0Subjects.=C2=A0 These may be human or robotic principals or de= vices or
    =C2=A0 =C2=A0other entities that are managed by transmitters and receivers.= =C2=A0 For
    =C2=A0 =C2=A0example, the same Subject Principal may be referred to by an e= mail
    =C2=A0 =C2=A0address or a phone number.=C2=A0 A transmitter or receiver wil= l typically
    =C2=A0 =C2=A0manage subject principals and organize them into sub-groupings= such
    =C2=A0 =C2=A0as tenants, groups, organizational units, etc.

    =C2=A0 =C2=A0Subjects are identified by Subject Identifiers defined below.<= br>
    3.1.=C2=A0 SPAGs

    =C2=A0 =C2=A0Subject Principals MAY be grouped for administrative purposes = into
    =C2=A0 =C2=A0"Subject Principal Administrative Groupings" or SPAG= s.=C2=A0 For example,
    =C2=A0 =C2=A0all users belonging to one customer of a "multi-tenanted&= quot; Transmitter
    =C2=A0 =C2=A0may be in one SPAG.=C2=A0 Alternatively, an Organizational Uni= t or a group
    =C2=A0 =C2=A0of Subjects within a customer of a Transmitter (whether multi-=
    =C2=A0 =C2=A0tenanted or not) may be one SPAG.=C2=A0 SPAGs may have overlap= ping sets of
    =C2=A0 =C2=A0Subjects.

    =C2=A0 =C2=A0A SPAG MAY be the Subject of certain stream update events defi= ned
    =C2=A0 =C2=A0later in this spec, hence is defined as a Subject Type of its = own
    =C2=A0 =C2=A0below..=C2=A0 A SPAG identifier MAY be included in other subje= ct types to
    =C2=A0 =C2=A0disambiguate the subject.

    =C2=A0 =C2=A0A SPAG subject identifier is agreed to offline between a trans= mitter
    =C2=A0 =C2=A0and a receiver.

    The benefits of doing this are:

    1. Multi-tenanted hosts do not need to maintain secrets per tenant and per tra= nsmitter tenant if each tenant has to be an event transmitter and an event = receiver of its own.
    2. An event stream may be established between two multi-tenanted hosts, and so= does not need to be managed at a per-tenant level
    3. The same subject or subject principal may be a part of multiple SPAGs, and = identifying the SPAG that an event relates to can be achieved if the standa= rd allows for the SPAGs to be identified.

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 11:32 AM Dick Hardt <dick.hardt@gmail.com<= /a>> wrote:

    To clarify, your proposal is driven by the implement= ation=C2=A0burden of maintaining separate secrets / streams between a trans= mitter and receiver?

    =E1=90=A7

    =C2=A0

    Hi all,=C2=A0

    Here's a quick background for the p= roposal for including Subject Principals and Subject Principal Administ= rative Groupings or SPAGs in the Subject Identifiers spec.

    =C2=A0

    Use of Subject Identifiers in Shared Signals and = Events:

    The Shared Signals and Events (SSE) profile of SETs = specifies that transmitters and receivers send and receive SETs that contai= n Subject Identifiers. These subject identifiers have the format that is now being discussed as a separate specification here.

    =C2=A0

    Transmitters and Receivers in SSE

    The SSE profile defines transmitters and receivers a= s hosts that manage streams between peers. The receiver authenticates to th= e transmitter using OAuth, requiring the use of a secret per receiver. In a multi-tenanted host that handles hundreds of tho= usands or millions of independent tenants, maintaining such a secret per in= stance of a receiver is cumbersome. Furthermore, since a transmitter and a = receiver has to maintain a stream per pair, creating such per-tenant streams can add significant implementat= ion overhead.

    =C2=A0

    SPAGs

    Therefore, we need a notion of a grouping of subject= s within the same transmitter and receiver to distinguish between various a= dministrative groupings that exist within a host. These groupings could include tenants, organizational units or user groups= .. This grouping is captured in the notion of a SPAG. The uniqueness of a u= ser identifier (subject identifier) may also be limited to a SPAG. For exam= ple, if a random unique ID represents a user, then that ID may be unique within a SPAG and not universally acros= s a transmitter or receiver. This is because each transmitter and receiver = may have multiple connections to other transmitters and receivers, and ensu= ring uniqueness across all such peers is probably an intractable problem.

    =C2=A0

    Subject Principals

    While what is represented within a subject identifie= r may be only an aspect of the management entity, the administrative groupi= ng is about the management entity itself. This could be the user, device or other principal that the subject identifier represe= nts. Therefore, an abstract notion of a Subject Principal is also required = in order specify what the grouping within a SPAG is about.

    =C2=A0

    The above is captured in the "Subject Principal= " and "SPAG" sections within the proposed P= R.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    --0000000000005c89e905aa699a17-- From nobody Tue Jul 14 12:32:19 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 781233A09BA for ; Tue, 14 Jul 2020 12:32:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.97 X-Spam-Level: X-Spam-Status: No, score=-1.97 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MALFORMED_FREEMAIL=0.116, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QXhNr9BnBEN0 for ; Tue, 14 Jul 2020 12:32:16 -0700 (PDT) Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com [IPv6:2a00:1450:4864:20::432]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B7593A0CEC for ; Tue, 14 Jul 2020 12:32:00 -0700 (PDT) Received: by mail-wr1-x432.google.com with SMTP id s10so24269016wrw.12 for ; Tue, 14 Jul 2020 12:32:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version; bh=RfLr4fFEI1taX2L8Z/RO47jyZ7Cqz9sAR2T0WZn7Ce8=; b=tgZjZOGLkwoI5N/ViA6Lvs5sBT279idUa6BeU3cXxWJ/KHml4Q/agQMYfZQHvl3fi0 b9BruP4MGeuVitrsSSGtUi7j9zwO8UYPD0JOPtxsDaUrHpUcNR7rRx5O11SudLFMlaOr tHidXh/bZtSV8yDYbatF2JJRKe2CZ4MTP0B4+Dukz9bnHRKiB5FNdaOuH+nniREdQ/u5 uyVLzU7RvQSc3c8PVfXEArFu2Je717uy/UKhWJn5dTVM6esV8UQSrvWYAPU9IicpTG6t buCYbPdg9BKq6dDs+b9Ud4dvWVPpIlJSYxUD5N7lxivUJwJb9okcce8IfjSKeGzjMRV8 D6/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version; bh=RfLr4fFEI1taX2L8Z/RO47jyZ7Cqz9sAR2T0WZn7Ce8=; b=LEvUPOZCPiR+dZUnhHyGsQoZ+37pp/59hqYjMcqO6mVce0tivyW+tdLDlPLn5emDBJ CDrbsjbgfn30roVDleTrfuPexnRwWNUamRlzYe8kJ1ogwdasJQ4v+M19QwgriRellUzs GJ02E4kytbb9heEhJVxaSHSRqauFjy/nW9Iyhynfp4VasfQR3Pt2z7u7jAS3KEpQY2L7 sm7wpioTf4hndhgIrfCJboVL74BVSHgihsC7nEBaTLTmArtqNH+SICsWqlSq/zpYRauy HlobKsVZbr2XAg85YZTXrRp/0epkxqf9bWK5rE/ahU211Anx0hkAfQCsK+zQE/6YczYo r2FA== X-Gm-Message-State: AOAM530Esu376pBf3WngfzAUd1jHAbjDr1Pd/s2ByhMkL9e4JY8PTgLm covM2yBReseBaE9qBG8xHVA= X-Google-Smtp-Source: ABdhPJwWYq6gIzavfDOqzKqAV5UJE84GViLseND9Wcw8jZ4gmRb+Ye/si8+JmBD1YcCew+uuPyuwxg== X-Received: by 2002:a5d:5187:: with SMTP id k7mr8139603wrv.39.1594755118917; Tue, 14 Jul 2020 12:31:58 -0700 (PDT) Received: from [172.26.49.35] (pub-corp-42-8.intuit.com. [91.102.42.8]) by smtp.gmail.com with ESMTPSA id w7sm5991502wmc.32.2020.07.14.12.31.57 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Jul 2020 12:31:58 -0700 (PDT) User-Agent: Microsoft-MacOutlook/16.38.20061401 Date: Tue, 14 Jul 2020 22:31:56 +0300 From: Yaron Sheffer To: Atul Tulshibagwale , Chris Phillips CC: "id-event@ietf.org" Message-ID: Thread-Topic: [Id-event] SAML subject identifier type References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3677610717_1125105698" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 19:32:18 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3677610717_1125105698 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable I need a lot more context here. So far, subject IDs have denoted durable en= tities, such as email addresses, phone numbers, account. This is adding a su= bject ID that denotes an ephemeral entity, basically similar to a session ID= . This looks weird from an architectural point of view, and also begs the qu= estion, why specifically SAML and not other session types. =20 Thanks, =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron=20 =20 From: Id-event on behalf of Atul Tulshibagwale = Date: Tuesday, July 14, 2020 at 00:14 To: Chris Phillips Cc: "id-event@ietf.org" Subject: Re: [Id-event] SAML subject identifier type =20 Just clarifying the proposal as it stands today (before incorporating Chris= 's input): The following section should be added in the "Subject Identifier Types" sec= tion: 4.9. SAML Subject Identifier Type The SAML [SAML.REF] Subject Identifier Type describes a subject by the assertion identifier in the SAML assertion that was used to convey the subject's information to the Receiver. Subject Identifiers of this type MUST contain an ` assertion_id"claim. The value of this claim is a string that is equal to the Assertion Identifier in the SAML assertion. The SAML Subject Identifier Type is identified by the name "saml`. Below is a non-normative example Subject Identifier for the SAML Subject Identifier Type: { "subject_type": "saml", "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", } Figure 8: Example: Subject Identifier for SAML Subject Identifier Type. =20 =20 On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale = wrote: Hi Chris, I was proposing using the "assertion id" (SAML Core spec, line 553) in the = proposal, not the "subject-id" as defined in SAML (spec section 3.3). The ma= in reason was to be able to refer to a session that was established using a = specific assertion. If it's useful, we could perhaps extend the SAML subject= identifier type in this spec to include either the assertion_id or the subj= ect_id claim. =20 Thanks, Atul =20 =20 On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips = wrote: Hi. Quiet lurker observing.. Thanks for consider the SAML elements..=20 =20 Atul, are you referring to the actual session identifier that someone may h= ave where the Subject-Id was exchanged OR the actual Subject-id itself in yo= ur reference in the proposal with the github link? =20 I=E2=80=99m trying to square what I see on the git delta on line 294-296 in https= ://github.com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be= 077ace88994 =20 =20 And a Subject-id as shown in the example in 3.3.3 here: https://docs.oasis-= open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-c= s01.html#_Toc536097229 =20 What you offered in the example is not a Subject-id per the OASIS SAML spe= c as written in section 3.3.1 =20 Am I mis-interpreting something? =20 C =20 =20 From: Id-event on behalf of Atul Tulshibagwale = Date: Monday, July 13, 2020 at 12:17 PM To: "id-event@ietf.org" Subject: [Id-event] SAML subject identifier type =20 Hi all, Based on the discussions in the SSE working group within the OpenID Foundat= ion, we would like to propose that the subject identifier specification incl= ude a SAML subject identifier type. This is so that sessions established acr= oss peers using SAML may be identified in events that include the subject id= entifier. =20 A SAML subject identifier has only one claim within it, the assertion id o= f the SAML assertion used to establish the single sign-on session. =20 This change is also included in my proposal here. =20 Thanks, Atul =20 _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event _______________________________________________ Id-event mailing list Id-ev= ent@ietf.org https://www.ietf.org/mailman/listinfo/id-event=20 --B_3677610717_1125105698 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

    I need a lot more context here. So far, subject ID= s have denoted durable entities, such as email addresses, phone numbers, acc= ount. This is adding a subject ID that denotes an ephemeral entity, basicall= y similar to a session ID. This looks weird from an architectural point of v= iew, and also begs the question, why specifically SAML and not other session= types.

     

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= Yaron

     

    From: Id-event <id-event-bounces@ietf.= org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ie= tf.org>
    Date: Tuesday, July 14, 2020 at 00:14
    To: Chr= is Phillips <Chris.Phillips@canarie.ca>
    Cc: "id-event@i= etf.org" <id-event@ietf.org>
    Subject: Re: [Id-event] SA= ML subject identifier type

     

    Just clarifying the pro= posal as it stands today (before incorporating Chris's input):

    The following section should be added in the "= Subject Identifier Types" section:

    4.9.  SAML Subject Iden= tifier Type

       The SAML [SAML.REF] Subject Identifier Type = describes a subject by
       the assertion identifier in the SAML = assertion that was used to
       convey the subject's information = to the Receiver.  Subject
       Identifiers of this type MUST= contain an ` assertion_id"claim.  The
       value of th= is claim is a string that is equal to the Assertion
       Identifi= er in the SAML assertion.  The SAML Subject Identifier Type
      &= nbsp;is identified by the name "saml`.

       Below is a n= on-normative example Subject Identifier for the SAML
       Subject= Identifier Type:

       {
         "subject= _type": "saml",
         "assertion_id&quo= t;: "_f551d88963ab4e3decb7cfe8f4dcc3f5",
       }

    =      Figure 8: Example: Subject Identifier for SAML Subject I= dentifier
                      =                  Type.

     

    =

     

    On Mon,= Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com> wrote:

    Hi Chris,

    I was proposing using the "asserti= on id" (SAML Core spec, line 553) in the proposal,= not the "subject-id" as defined in SAML (spec section 3.3). The m= ain reason was to be able to refer to a session that was established using a= specific assertion. If it's useful, we could perhaps extend the SAML subjec= t identifier type in this spec to include either the assertion_id or the sub= ject_id claim.

     =

    Thanks,

    Atul

     =

     

    On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca>= ; wrote:

    Hi.

    Q= uiet lurker observing..

    Thanks for c= onsider the SAML elements..

     <= o:p>

    Atul, are you referring to the actua= l session identifier that someone may have where the Subject-Id was exchange= d OR the actual Subject-id itself in your reference in the proposal with the= github link?

     

    I=E2=80=99m trying to square what I see on the git delta = on line 294-296 in https://github= .com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be077ace889= 94

     

    <= p class=3DMsoNormal style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'= > 

    And a Subje= ct-id as shown in the example in 3.3.3 here: https://docs.oasis-open.org/security/sa= ml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.html#_Toc5360972= 29

     

    <= p class=3DMsoNormal style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'= >What you offered in the example is not a Subject-id  = per the OASIS SAML spec as written in section 3.3.1

    <= span lang=3DEN-CA> 

    Am I mis-inte= rpreting something?

     

    C

    &nb= sp;

     

    From: Id-event <id-event-bounces@ietf.or= g> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>= ;
    Date: Monday, July 13, 2020 at 12:17 PM
    To: "id-event@ietf.org" &= lt;id-event@ietf.org&= gt;
    Subject: [Id-event] SAML subject identifier type

     

    Hi all,

    Based on the discussions in the SSE working group withi= n the OpenID Foundation, we would like to propose that the subject identifie= r specification include a SAML subject identifier type. This is so that sess= ions established across peers using SAML may be identified in events that in= clude the subject identifier.

     

     A SAML = subject identifier has only one claim within it, the assertion id of the SAM= L assertion used to establish the single sign-on session.<= /p>

     

    This change is also included in my proposal here.

     

    Thanks,

    Atul

     =

    ______________________= _________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mail= man/listinfo/id-event

    _______________________________________________ Id-even= t mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-ev= ent

    --B_3677610717_1125105698-- From nobody Tue Jul 14 13:26:46 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DF623A0CCF for ; Tue, 14 Jul 2020 13:26:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.589 X-Spam-Level: X-Spam-Status: No, score=-17.589 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MjQJeuR3XVod for ; Tue, 14 Jul 2020 13:26:36 -0700 (PDT) Received: from mail-yb1-xb32.google.com (mail-yb1-xb32.google.com [IPv6:2607:f8b0:4864:20::b32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A19CF3A0BF3 for ; Tue, 14 Jul 2020 13:26:36 -0700 (PDT) Received: by mail-yb1-xb32.google.com with SMTP id a30so49356ybj.5 for ; Tue, 14 Jul 2020 13:26:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NrTHmb3Z8A/FuJ1JoDHdPu1quBDAqy3l3n0YrNo6gWw=; b=Y/vxXc1M0aC4Tr6GnhGQGKRKrKyTsya7tCgrxOgmaOn+y97tkJ5NxmKSLSnHFJJERs 0SMdROhbyyJVAjSXXpmrFAKguRzFuxUSjlUrCP4Z7yKctplUb9z9wt+WGQD8umcD3UdH MVMJh9Wo05ggHn8yfNy3tWfKjh9JbGTz21q6/YImO8cgYT7lMc9mECt4KEISU6TegfoK HovFcJO6/jkK9TmmwaalaHRU459FwLWlfq/4FwC3pJ8AamGo+Aj7+Tkiv+dO6gp1DBV+ iq2vX8NpM62aowrxsurpHohkliAt94gMoKLPn0LOahit6gkSkaNyWDPTvjtjmttzi0Qn /F/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NrTHmb3Z8A/FuJ1JoDHdPu1quBDAqy3l3n0YrNo6gWw=; b=Joe0ERn2nz10XXr1hE2v6lZUNlRXIrtTylMpdLKxa3VbrNuWUVPfb8JApU/ZjkKBt/ ewfMw77zlMb5z+o8dEj3NK4TpddGXNnaQJynN3vsMZtVu2ne9JZR1+EaQSkvfHWVyOU1 uhU/Nbr/GKFQ9km/UxD+x44WgeNQoHHbtOe22WbwmiGpT5PBnHWEzpnKSFkn0wnwJfVI jGpd8QKUyOT8m6jThfLh8h5PUR5SzodLQ2eC3pdmvBxQ6d4VqtktHRMCptAWyL1oKZDL 5Z56oEuX9P6ksr44hXHRUoNCoASEgR8Qyr8I3AalRLZw1Xp8yWjrHmPEYxRML7t+xXJA OY4Q== X-Gm-Message-State: AOAM532Mv3LIUwZfPa18JJNGIpnXUT9B0bRURTlseJD81WDTzHLRPknD BhVdKmtLLSfajGhZDCZn9aUANmN/X3dYoEpuJdSaMw== X-Google-Smtp-Source: ABdhPJxyFS+Q59C45uf0zYjMY07c7pZsMKGLWX6vd7BKCKbtdz7RB/ZFIuJq/AHr3TM0fg8hHios4wp1/xjN5ejCIbg= X-Received: by 2002:a25:b90e:: with SMTP id x14mr11449125ybj.8.1594758395303; Tue, 14 Jul 2020 13:26:35 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> In-Reply-To: From: Atul Tulshibagwale Date: Tue, 14 Jul 2020 13:26:23 -0700 Message-ID: To: Yaron Sheffer Cc: Chris Phillips , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="000000000000a804b105aa6c9f21" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 20:26:44 -0000 --000000000000a804b105aa6c9f21 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Yaron, There are a few SSE use cases where the events are about a specific single sign-on session. You're right that this should not be limited to SAML. The RISC profile of SETs (based on which we are doing the SSE work) had the ID Token subject identifier type, which for some reason is missing in this spec (I did not realize until now). The specific events that need to refer to sessions are: - Identity provider context change: The conditions under which a SAML assertion or OIDC token was generated are no longer valid. This can be d= ue to various things, including a password change. - Session property change: A session has been determined to have been compromised - Revocation: The issuer of the single sign-on SAML assertion or ID Token needs to be revoke I can also add the ID Token claim from the RISC profile to my pull request. Thanks, Atul On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer wrote: > I need a lot more context here. So far, subject IDs have denoted durable > entities, such as email addresses, phone numbers, account. This is adding= a > subject ID that denotes an ephemeral entity, basically similar to a sessi= on > ID. This looks weird from an architectural point of view, and also begs t= he > question, why specifically SAML and not other session types. > > > > Thanks, > > Yaron > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Tuesday, July 14, 2020 at 00:14 > *To: *Chris Phillips > *Cc: *"id-event@ietf.org" > *Subject: *Re: [Id-event] SAML subject identifier type > > > > Just clarifying the proposal as it stands today (before incorporating > Chris's input): > > The following section should be added in the "Subject Identifier Types" > section: > > 4.9. SAML Subject Identifier Type > > The SAML [SAML.REF] Subject Identifier Type describes a subject by > the assertion identifier in the SAML assertion that was used to > convey the subject's information to the Receiver. Subject > Identifiers of this type MUST contain an ` assertion_id"claim. The > value of this claim is a string that is equal to the Assertion > Identifier in the SAML assertion. The SAML Subject Identifier Type > is identified by the name "saml`. > > Below is a non-normative example Subject Identifier for the SAML > Subject Identifier Type: > > { > "subject_type": "saml", > "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", > } > > Figure 8: Example: Subject Identifier for SAML Subject Identifier > Type. > > > > > > On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale > wrote: > > Hi Chris, > > I was proposing using the "assertion id" (SAML Core > > spec, line 553) in the proposal, not the "subject-id" as defined in SAML > (spec section 3.3). The main reason was to be able to refer to a session > that was established using a specific assertion. If it's useful, we could > perhaps extend the SAML subject identifier type in this spec to include > either the assertion_id or the subject_id claim. > > > > Thanks, > > Atul > > > > > > On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips > wrote: > > Hi. > > Quiet lurker observing.. > > Thanks for consider the SAML elements.. > > > > Atul, are you referring to the actual session identifier that someone may > have where the Subject-Id was exchanged OR the actual Subject-id itself i= n > your reference in the proposal with the github link? > > > > I=E2=80=99m trying to square what I see on the git delta on line 294-296 = in > https://github..com/richanna/secevent/pull/1/commits/b20b6692eb5062892747= 6ca78f9be077ace88994 > > > > > > > And a Subject-id as shown in the example in 3.3.3 here: > https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-= subject-id-attr-v1.0-cs01.html#_Toc536097229 > > > > > What you offered in the example is not a Subject-id per the OASIS SAML > spec as written in section 3.3.1 > > > > Am I mis-interpreting something? > > > > C > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Monday, July 13, 2020 at 12:17 PM > *To: *"id-event@ietf.org" > *Subject: *[Id-event] SAML subject identifier type > > > > Hi all, > > Based on the discussions in the SSE working group within the OpenID > Foundation, we would like to propose that the subject identifier > specification include a SAML subject identifier type. This is so that > sessions established across peers using SAML may be identified in events > that include the subject identifier. > > > > A SAML subject identifier has only one claim within it, the assertion id > of the SAML assertion used to establish the single sign-on session. > > > > This change is also included in my proposal here > . > > > > Thanks, > > Atul > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > _______________________________________________ Id-event mailing list > Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event > --000000000000a804b105aa6c9f21 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Hi=C2=A0Yaron,
    There are a few SSE use cases where the= events are about a specific single sign-on session. You're right that = this should not be limited to SAML. The RISC profile of SETs (based on whic= h we are doing the SSE work) had the ID Token subject identifier type, whic= h for some reason is missing in this spec (I did not realize until now). Th= e specific events that need to refer to sessions are:
    • Ide= ntity provider context change: The conditions under which a SAML assertion = or OIDC token was generated are no longer=C2=A0valid. This can be due to va= rious things, including a password change.
    • Session property change:= A session has been determined to have been compromised
    • Revocation:= The issuer of the single sign-on SAML assertion or ID Token needs to be re= voke
    I can also add the ID Token claim fr= om the RISC profile to my pull request.

    = Thanks,
    Atul


    On Tue, Jul 14, 2020 at 12:32 PM= Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

    I n= eed a lot more context here. So far, subject IDs have denoted durable entit= ies, such as email addresses, phone numbers, account. This is adding a subj= ect ID that denotes an ephemeral entity, basically similar to a session ID.= This looks weird from an architectural point of view, and also begs the qu= estion, why specifically SAML and not other session types.

    =C2=A0

    Than= ks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron <= u>

    =C2=A0

    From: Id-event <id-event-bounces@ietf.org> on behalf of Atul Tulshibag= wale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Tuesday, Ju= ly 14, 2020 at 00:14
    To: Chris Phillips <Chris.Phillips@canarie.ca>=
    Cc: "id-event@ietf.org" <id-event@ietf.org>
    Subject: Re: [Id-event] SA= ML subject identifier type

    =C2=A0

    Just cl= arifying the proposal as it stands today (before incorporating Chris's = input):

    The following section = should be added in the "Subject Identifier Types" section:=

    4.9.=C2=A0 SAML Subject Identifier Type

    =C2=A0= =C2=A0The SAML [SAML.REF] Subject Identifier Type describes a subject by=C2=A0 =C2=A0the assertion identifier in the SAML assertion that was used= to
    =C2=A0 =C2=A0convey the subject's information to the Receiver.= =C2=A0 Subject
    =C2=A0 =C2=A0Identifiers of this type MUST contain an ` a= ssertion_id"claim.=C2=A0 The
    =C2=A0 =C2=A0value of this claim is a = string that is equal to the Assertion
    =C2=A0 =C2=A0Identifier in the SAM= L assertion.=C2=A0 The SAML Subject Identifier Type
    =C2=A0 =C2=A0is iden= tified by the name "saml`.

    =C2=A0 =C2=A0Below is a non-normativ= e example Subject Identifier for the SAML
    =C2=A0 =C2=A0Subject Identifie= r Type:

    =C2=A0 =C2=A0{
    =C2=A0 =C2=A0 =C2=A0"subject_type&quo= t;: "saml",
    =C2=A0 =C2=A0 =C2=A0"assertion_id": &quo= t;_f551d88963ab4e3decb7cfe8f4dcc3f5",
    =C2=A0 =C2=A0}

    =C2=A0 = =C2=A0 =C2=A0Figure 8: Example: Subject Identifier for SAML Subject Identif= ier
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Type.    <= /u>

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com= > wrote:

    Hi Chris,

    I was proposing = using the "assertion id" (SAML Core spe= c, line 553) in the proposal, not the "subject-id" as defined in = SAML (spec section 3.3). The main reason was to be able to refer to a sessi= on that was established using a specific assertion. If it's useful, we = could perhaps extend the SAML subject identifier type in this spec to inclu= de either the assertion_id or the subject_id claim.

    =

    =C2=A0

    Thanks,

    Atul<= u>

    =C2=A0

    =

    =C2=A0

    On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@can= arie.ca> wrote:

    <= div>

    Hi.

    Quiet lurker observing..

    Thanks for c= onsider the SAML elements..

    =C2=A0

    Atul, are you referring to the actual session identif= ier that someone may have where the Subject-Id was exchanged OR the actual = Subject-id itself in your reference in the proposal with the github link?

    =C2=A0

    I=E2=80= =99m trying to square what I see on the git delta on line 294-296 in https://github..com/richanna/sece= vent/pull/1/commits/b20b6692eb50628927476ca78f9be077ace88994<= /u>

    =C2=A0<= /u>

    =C2=A0<= /u>

    And a Subject-id = as shown in the example in 3.3.3 here: https://docs.oasis-open.org/security/= saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.html#_Toc5360= 97229

    =C2=A0

    What you offered in the example is not a Subject-id =C2=A0per the OASIS = SAML spec as written in section 3.3.1

    =C2=A0

    Am I mis-interpreting something?

    =C2=A0

    C

    =C2=A0

    =C2=A0

    From: = Id-eve= nt <id-ev= ent-bounces@ietf.org> on behalf of Atul Tulshibagwale <atultulshi= =3D40googl= e.com@dmarc.ietf.org>
    Date: Monday, July 13, 2020 at 12:17= PM
    To: "id-event@ietf.org" <id-event@ietf.org>
    Subject: [Id-event] SAM= L subject identifier type    <= /p>

    =C2=A0<= /u>

    Hi all= ,

    = Based on the discussions in the SSE working group within the OpenID Foundat= ion, we would like to propose that the subject identifier specification inc= lude a SAML subject identifier type. This is so that sessions established a= cross peers using SAML may be identified in events that include the subject= identifier.

    =C2=A0

    =C2=A0A SAML subject identifier has only one cl= aim within it, the assertion id of the SAML assertion used to establish the= single sign-on session.

    =C2=A0

    This change is also included in my = p= roposal here.

    =C2=A0

    Thanks,

    Atul

    <= /div>

    =C2=A0<= /span>

    __________________= _____________________________
    Id-event mailing list
    Id-event@ietf.org
    https://ww= w.ietf.org/mailman/listinfo/id-event

    _______________________________= ________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/lis= tinfo/id-event

    --000000000000a804b105aa6c9f21-- From nobody Tue Jul 14 15:01:38 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 122193A07E5 for ; Tue, 14 Jul 2020 15:01:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.97 X-Spam-Level: X-Spam-Status: No, score=-1.97 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MALFORMED_FREEMAIL=0.116, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xI7ZTXlkU6S0 for ; Tue, 14 Jul 2020 15:01:35 -0700 (PDT) Received: from mail-wr1-x42a.google.com (mail-wr1-x42a.google.com [IPv6:2a00:1450:4864:20::42a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 880A53A07F0 for ; Tue, 14 Jul 2020 15:01:34 -0700 (PDT) Received: by mail-wr1-x42a.google.com with SMTP id z2so354764wrp.2 for ; Tue, 14 Jul 2020 15:01:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version; bh=xX1y911UNF7ZVkpvSmHEQ69u/ZYt/vADBMlGk6onqF8=; b=I867I3qU1xCxXfaETg51FC0kaj2ohv3Okl1MEja0EZUcMH2PJpYE0el/1K3pEvSuuN QWc/gYSr6n/UE0T8DxcmpUOWEbDCtyJ+sQBAGH3mYlwuBbW8/5OFlsdWt3tZlPwuEDBK S4yybkVh6CUc3yV/W4UKIOdf9y6ADk8Xb5HgYR2DxQB0H3V1JHPvH4vVpKcj4cENipG0 WErgUxWBwmooPCrzXBYxIJuOs/1VdGViGtVXNzAnWznv8zkm8wZ04xAo1NWrTYiC76tc 9hQxJSRuaVh2JTCxYYFj4+fQ+qRxspgEy82C6EJ2iRJ+89Lu27adxqcHxs8g6SMSuEuT Ya/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version; bh=xX1y911UNF7ZVkpvSmHEQ69u/ZYt/vADBMlGk6onqF8=; b=kz6fhQ5tHZJHY0kaQ+Btl9zKcBAlvVpIZyEC5P9RHYl7DhwAGwwJKrMGWhvY0/6rHL 6sOKU5vPF0zRGUzdNoFeUv4qp+e4XJ4/wV9KpzxgObqMr1kA33AXrXwK++3WnR8xK3B0 vZwCn9hT/1UKNklJmg+CMYFI+YyE3QVj0NqGBSJksDu316VUJ/D2f/eSn2UvDnHywkKf xqeKAcKFao6SBRfC5p2yQMRO95YAUOMVvxQCnec3JqH8M6olALqk+s2UbPid3XnBrwAY iZefbg9Cs/novoAAWzF9+EW9ilX1Ry9mpMmHKrysBM+GTp44pprOdU1E0DzK8/nZ8ogy oydQ== X-Gm-Message-State: AOAM532n7TbPmu6PgYTg2vN+ghfxFNl+BubwfELmszcWnaZRO+2zSWTy wvgRjD/39VN4LOl+rNPExIU= X-Google-Smtp-Source: ABdhPJxe+Dch6e25AGUHyVCT7WN+pR48RLigZxNxGCgjpDEtPVFTvOmLDm/G9hnIzEyrfBUocyHd3Q== X-Received: by 2002:adf:c142:: with SMTP id w2mr7645434wre.337.1594764093037; Tue, 14 Jul 2020 15:01:33 -0700 (PDT) Received: from [10.0.0.140] (bzq-79-176-11-75.red.bezeqint.net. [79.176.11.75]) by smtp.gmail.com with ESMTPSA id l67sm300495wml.13.2020.07.14.15.01.31 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Jul 2020 15:01:32 -0700 (PDT) User-Agent: Microsoft-MacOutlook/16.38.20061401 Date: Wed, 15 Jul 2020 01:01:31 +0300 From: Yaron Sheffer To: Atul Tulshibagwale CC: Chris Phillips , "id-event@ietf.org" Message-ID: <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> Thread-Topic: [Id-event] SAML subject identifier type References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3677619692_1403051929" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 22:01:37 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3677619692_1403051929 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Hi Atul, =20 The ID Token subject type, as described in the document you are referencing= , does not add any semantics, compared to a =E2=80=9Cphone number=E2=80=9D or =E2=80=9Cemail=E2=80= =9D subject type. So I don=E2=80=99t see the value in adding it. =20 In addition, it does not, actually, describe an ID Token. In fact the text = is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable entity) rather th= an a session, and does it by citing various claims included in the ID token.= So as a subject identifier type, it is not at all equivalent to a SAML asse= rtion. =20 As to the SAML Assertion subject type, I think these use cases could be add= ressed by adding information to the event. =20 Thanks, =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron =20 From: Atul Tulshibagwale Date: Tuesday, July 14, 2020 at 23:26 To: Yaron Sheffer Cc: Chris Phillips , "id-event@ietf.org" Subject: Re: [Id-event] SAML subject identifier type =20 Hi Yaron, There are a few SSE use cases where the events are about a specific single = sign-on session. You're right that this should not be limited to SAML. The R= ISC profile of SETs (based on which we are doing the SSE work) had the ID To= ken subject identifier type, which for some reason is missing in this spec (= I did not realize until now). The specific events that need to refer to sess= ions are: Identity provider context change: The conditions under which a SAML asserti= on or OIDC token was generated are no longer valid. This can be due to vario= us things, including a password change. Session property change: A session has been determined to have been comprom= ised Revocation: The issuer of the single sign-on SAML assertion or ID Token nee= ds to be revoke I can also add the ID Token claim from the RISC profile to my pull request. =20 Thanks, Atul =20 =20 On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer wrot= e: I need a lot more context here. So far, subject IDs have denoted durable en= tities, such as email addresses, phone numbers, account. This is adding a su= bject ID that denotes an ephemeral entity, basically similar to a session ID= . This looks weird from an architectural point of view, and also begs the qu= estion, why specifically SAML and not other session types. =20 Thanks, Yaron=20 =20 From: Id-event on behalf of Atul Tulshibagwale = Date: Tuesday, July 14, 2020 at 00:14 To: Chris Phillips Cc: "id-event@ietf.org" Subject: Re: [Id-event] SAML subject identifier type =20 Just clarifying the proposal as it stands today (before incorporating Chris= 's input): The following section should be added in the "Subject Identifier Types" sec= tion: 4.9. SAML Subject Identifier Type The SAML [SAML.REF] Subject Identifier Type describes a subject by the assertion identifier in the SAML assertion that was used to convey the subject's information to the Receiver. Subject Identifiers of this type MUST contain an ` assertion_id"claim. The value of this claim is a string that is equal to the Assertion Identifier in the SAML assertion. The SAML Subject Identifier Type is identified by the name "saml`. Below is a non-normative example Subject Identifier for the SAML Subject Identifier Type: { "subject_type": "saml", "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", } Figure 8: Example: Subject Identifier for SAML Subject Identifier Type. =20 =20 On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale = wrote: Hi Chris, I was proposing using the "assertion id" (SAML Core spec, line 553) in the = proposal, not the "subject-id" as defined in SAML (spec section 3.3). The ma= in reason was to be able to refer to a session that was established using a = specific assertion. If it's useful, we could perhaps extend the SAML subject= identifier type in this spec to include either the assertion_id or the subj= ect_id claim. =20 Thanks, Atul =20 =20 On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips = wrote: Hi. Quiet lurker observing.. Thanks for consider the SAML elements..=20 =20 Atul, are you referring to the actual session identifier that someone may h= ave where the Subject-Id was exchanged OR the actual Subject-id itself in yo= ur reference in the proposal with the github link? =20 I=E2=80=99m trying to square what I see on the git delta on line 294-296 in https= ://github..com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9b= e077ace88994 =20 =20 And a Subject-id as shown in the example in 3.3.3 here: https://docs.oasis-= open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-c= s01.html#_Toc536097229 =20 What you offered in the example is not a Subject-id per the OASIS SAML spe= c as written in section 3.3.1 =20 Am I mis-interpreting something? =20 C =20 =20 From: Id-event on behalf of Atul Tulshibagwale = Date: Monday, July 13, 2020 at 12:17 PM To: "id-event@ietf.org" Subject: [Id-event] SAML subject identifier type =20 Hi all, Based on the discussions in the SSE working group within the OpenID Foundat= ion, we would like to propose that the subject identifier specification incl= ude a SAML subject identifier type. This is so that sessions established acr= oss peers using SAML may be identified in events that include the subject id= entifier. =20 A SAML subject identifier has only one claim within it, the assertion id o= f the SAML assertion used to establish the single sign-on session. =20 This change is also included in my proposal here. =20 Thanks, Atul =20 _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event _______________________________________________ Id-event mailing list Id-ev= ent@ietf.org https://www.ietf.org/mailman/listinfo/id-event=20 --B_3677619692_1403051929 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

    Hi Atul,

    &nb= sp;

    The ID Token subject type, as described in t= he document you are referencing, does not add any semantics, compared to a =E2= =80=9Cphone number=E2=80=9D or =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value in= adding it.

     

    In addition, it does not, actually, describe an ID Token. In fact t= he text is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable entity) r= ather than a session, and does it by citing various claims included in the I= D token. So as a subject identifier type, it is not at all equivalent to a S= AML assertion.

     

    As to the SAML Assertion subject type, I think these use cases c= ould be addressed by adding information to the event.

     

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

     

    From: Atul Tulshibagwale <atultulshi@google.com>
    Date: T= uesday, July 14, 2020 at 23:26
    To: Yaron Sheffer <yaronf.ietf@g= mail.com>
    Cc: Chris Phillips <Chris.Phillips@canarie.ca>,= "id-event@ietf.org" <id-event@ietf.org>
    Subject: = Re: [Id-event] SAML subject identifier type

    =

     

    Hi&nbs= p;Yaron,

    There are a few SSE use cases= where the events are about a specific single sign-on session. You're right = that this should not be limited to SAML. The RISC profile of SETs (based on = which we are doing the SSE work) had the ID Token subject identifier type, w= hich for some reason is missing in this spec (I did not realize until now). = The specific events that need to refer to sessions are:

    =
    • Identity provider context chan= ge: The conditions under which a SAML assertion or OIDC token was generated = are no longer valid. This can be due to various things, including a pas= sword change.
    • Session property cha= nge: A session has been determined to have been compromised
      • <= li class=3DMsoNormal style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto= ;mso-list:l1 level1 lfo1'>Revocation: The issuer of the single sign-on SAML = assertion or ID Token needs to be revoke

    I can also add the ID Token claim from the RISC pr= ofile to my pull request.

     

    Thanks,

    Atul

     

     

    On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer= <yaronf.ietf@gmai= l.com> wrote:

    I need a lot more context here. So far, subject ID= s have denoted durable entities, such as email addresses, phone numbers, acc= ount. This is adding a subject ID that denotes an ephemeral entity, basicall= y similar to a session ID. This looks weird from an architectural point of v= iew, and also begs the question, why specifically SAML and not other session= types.

     

    Thanks,

     = ;            &nb= sp;  Yaron

     

    From: Id-event <id-event-bounces@ietf.org> on behalf of Atul Tulshibagwal= e <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Tuesday, July 14, 2020= at 00:14
    To: Chris Phillips <Chris.Phillips@canarie.ca>
    Cc: &q= uot;id-event@ietf.org= " <id-event@ietf.= org>
    Subject: Re: [Id-event] SAML subject identifier type

     

    Just clar= ifying the proposal as it stands today (before incorporating Chris's input):=

    The following section should be added in the "Sub= ject Identifier Types" section:

    4.9.  SAML Subject Identifier Type

    &= nbsp;  The SAML [SAML.REF] Subject Identifier Type describes a subject = by
       the assertion identifier in the SAML assertion that was u= sed to
       convey the subject's information to the Receiver.&nbs= p; Subject
       Identifiers of this type MUST contain an ` assert= ion_id"claim.  The
       value of this claim is a string= that is equal to the Assertion
       Identifier in the SAML asser= tion.  The SAML Subject Identifier Type
       is identified b= y the name "saml`.

       Below is a non-normative example= Subject Identifier for the SAML
       Subject Identifier Type:
       {
         "subject_type": "s= aml",
         "assertion_id": "_f551d8896= 3ab4e3decb7cfe8f4dcc3f5",
       }

         = Figure 8: Example: Subject Identifier for SAML Subject Identifier
      =                      =            Type.

    <= div>

     

     

    On= Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com> wrote:

    <= p class=3DMsoNormal style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'= >Hi Chris,

    I was proposing using the "assertion id= " (SAML Core spec, line 553) in the proposal, not = the "subject-id" as defined in SAML (spec section 3.3). The main r= eason was to be able to refer to a session that was established using a spec= ific assertion. If it's useful, we could perhaps extend the SAML subject ide= ntifier type in this spec to include either the assertion_id or the subject_= id claim.

     

    Thank= s,

    Atul

     

     

    On Mon, Jul 13, 2020 a= t 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca> wrote:

    Hi.

    Quiet lurker observing..

    Thanks= for consider the SAML elements..

    &= nbsp;

    Atul, are you referring to the= actual session identifier that someone may have where the Subject-Id was ex= changed OR the actual Subject-id itself in your reference in the proposal wi= th the github link?

     

    I=E2=80=99m trying to square what I see on the git = delta on line 294-296 in https://= github..com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be07= 7ace88994

     

     

    And = a Subject-id as shown in the example in 3.3.3 here: https://docs.oasis-open.org/sec= urity/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.html#_To= c536097229

     

    What you offered in the example is not a Subject-i= d  per the OASIS SAML spec as written in section 3.3.1

     

    Am I = mis-interpreting something?

     

    C

     

     =

    From: <= /span>Id-event <= ;id-event-bounces= @ietf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.or= g>
    Date: Monday, July 13, 2020 at 12:17 PM
    To: &q= uot;id-event@ietf.org= " <id-event@ietf.= org>
    Subject: [Id-event] SAML subject identifier type

     

    Hi all,

    Based on the discussions in the SSE working group within the OpenID Fou= ndation, we would like to propose that the subject identifier specification = include a SAML subject identifier type. This is so that sessions established= across peers using SAML may be identified in events that include the subjec= t identifier.

     

     A SAML subject identifi= er has only one claim within it, the assertion id of the SAML assertion used= to establish the single sign-on session.

    =  

    T= his change is also included in my proposal here.

     

    Thanks,

    Atul

     

    _______________________________________________
    Id-e= vent mailing list
    Id-e= vent@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    _____________________________= __________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-= event

    --B_3677619692_1403051929-- From nobody Tue Jul 14 16:09:10 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C11C63A0033 for ; Tue, 14 Jul 2020 16:09:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.088 X-Spam-Level: X-Spam-Status: No, score=-2.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0lrqhtfRsG0S for ; Tue, 14 Jul 2020 16:09:03 -0700 (PDT) Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 775513A0028 for ; Tue, 14 Jul 2020 16:09:02 -0700 (PDT) Received: by mail-lf1-x136.google.com with SMTP id y13so23487lfe.9 for ; Tue, 14 Jul 2020 16:09:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cQKnFGlm33+XltCUreYrKgmZf40huwNmVl29om1ksC4=; b=NlhKl9xln6ijW5CJkQVoljmiAUkxoU0JZbjctqls419SG2MEN7ljBF9yVpEmhkEj39 5HlEp+7l14tuSQQf223T7Mfpb/3kQRwe04as5udMfgVbGb5uZzMz+gT8D7nBbPxqyse8 EVkfd6J7oRKF92dfuHqbvz5lEq1Vvmi42SsCcBubIvADyBsGtuUe6QA3MrumsWV5AysK dwiRqKY1Epp/TqwZ4ZQY6iSZrDWs2Qz0OY5sLW4e3nyYmcWug6DqrHx8QE95MqNldJ7t A4iw9zJecgYeIyifD0ANfBZRCXv1ypjwkdE6ciYIaFqu8kjcb519GA6PZwnRhnL808yK Oyyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cQKnFGlm33+XltCUreYrKgmZf40huwNmVl29om1ksC4=; b=S2bPnkPsTqGJw1Gi8BIBwvlUwmlluvk1Cqy4mxR9eqXXhniR3H+jQOiUq/tFnQsBnh CARN7UJDEoNYo9yEs5Cwwe2uQ1u1MIqQ6LyxxKRBSHBCWDhAiAU9ZpXUsPSUQ39BhstB SNHxsobCouUO85Gc9z+bIsHtIDNybfFwaSkdq+aKQfLpqIndbN3L47waNvPk8e+aWZ1q Q6p3LC0c48Mr254WEvlmutdzHrShnbX+jmh79l4ZBKJqe6ERp7bdcPNmsVOMkwCaKLpJ ZUXqejYnR7o4WzpXOXA31Y7dPnop69JBFLLYoApCeoYP+77XWe3jdFt7lCRJf+kYrgCt EePg== X-Gm-Message-State: AOAM532xfIQCXM4eviTKpb0u1mFjt+KdAbLa0g2hwQbzlcWwBooHfGQB mKNnCcVYc3ncd+iKk3unpCSifqzQMnw0vJLsQus/bNuqRTruuGIKj6IXfTWDDWBX52bGqFINcr8 dTIdZNcYrsL2wOaeOAA== X-Google-Smtp-Source: ABdhPJyfNjRvRf5tNRyolr5XPc+GKUuyrAMnIIrd7eTELcOLUZlPVJzcTEIEK/BmLxHlJznmXbJ9XL+2JGDfr2zCfRg= X-Received: by 2002:ac2:4db2:: with SMTP id h18mr3259353lfe.167.1594768140479; Tue, 14 Jul 2020 16:09:00 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> In-Reply-To: <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> From: Brian Campbell Date: Tue, 14 Jul 2020 17:08:34 -0600 Message-ID: To: Yaron Sheffer Cc: Atul Tulshibagwale , Chris Phillips , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="000000000000834b4f05aa6ee4ab" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 23:09:08 -0000 --000000000000834b4f05aa6ee4ab Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable + 1 to what Yaron is saying here. I'd include also the "iss-sub" subject identifier type https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#sect= ion-3.4 as already having semantics covering what's described in the ID Token Claims Subject Identifier Type in the RISC document referenced. And all those things represent a durable subject rather than a session, which strikes me as appropriate for a document that describes identifying subjects. A SAML assertion ID, however, which is an identifier of an XML document that is only indirectly related to a session by an association that likely isn't maintained, does not seem appropriate as a "subject identifier". On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer wrote= : > Hi Atul, > > > > The ID Token subject type, as described in the document you are > referencing, does not add any semantics, compared to a =E2=80=9Cphone num= ber=E2=80=9D or > =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value in= adding it. > > > > In addition, it does not, actually, describe an ID Token. In fact the tex= t > is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable en= tity) rather than > a session, and does it by citing various claims included in the ID token. > So as a subject identifier type, it is not at all equivalent to a SAML > assertion. > > > > As to the SAML Assertion subject type, I think these use cases could be > addressed by adding information to the event. > > > > Thanks, > > Yaron > > > > *From: *Atul Tulshibagwale > *Date: *Tuesday, July 14, 2020 at 23:26 > *To: *Yaron Sheffer > *Cc: *Chris Phillips , "id-event@ietf.org" < > id-event@ietf.org> > *Subject: *Re: [Id-event] SAML subject identifier type > > > > Hi Yaron, > > There are a few SSE use cases where the events are about a specific singl= e > sign-on session. You're right that this should not be limited to SAML. Th= e > RISC profile of SETs (based on which we are doing the SSE work) had the I= D > Token subject identifier type, which for some reason is missing in this > spec (I did not realize until now). The specific events that need to refe= r > to sessions are: > > - Identity provider context change: The conditions under which a SAML > assertion or OIDC token was generated are no longer valid. This can be= due > to various things, including a password change. > - Session property change: A session has been determined to have been > compromised > - Revocation: The issuer of the single sign-on SAML assertion or ID > Token needs to be revoke > > I can also add the ID Token claim from the RISC profile > > to my pull request. > > > > Thanks, > > Atul > > > > > > On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer > wrote: > > I need a lot more context here. So far, subject IDs have denoted durable > entities, such as email addresses, phone numbers, account. This is adding= a > subject ID that denotes an ephemeral entity, basically similar to a sessi= on > ID. This looks weird from an architectural point of view, and also begs t= he > question, why specifically SAML and not other session types. > > > > Thanks, > > Yaron > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Tuesday, July 14, 2020 at 00:14 > *To: *Chris Phillips > *Cc: *"id-event@ietf.org" > *Subject: *Re: [Id-event] SAML subject identifier type > > > > Just clarifying the proposal as it stands today (before incorporating > Chris's input): > > The following section should be added in the "Subject Identifier Types" > section: > > 4.9. SAML Subject Identifier Type > > The SAML [SAML.REF] Subject Identifier Type describes a subject by > the assertion identifier in the SAML assertion that was used to > convey the subject's information to the Receiver. Subject > Identifiers of this type MUST contain an ` assertion_id"claim. The > value of this claim is a string that is equal to the Assertion > Identifier in the SAML assertion. The SAML Subject Identifier Type > is identified by the name "saml`. > > Below is a non-normative example Subject Identifier for the SAML > Subject Identifier Type: > > { > "subject_type": "saml", > "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", > } > > Figure 8: Example: Subject Identifier for SAML Subject Identifier > Type. > > > > > > On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale > wrote: > > Hi Chris, > > I was proposing using the "assertion id" (SAML Core > > spec, line 553) in the proposal, not the "subject-id" as defined in SAML > (spec section 3.3). The main reason was to be able to refer to a session > that was established using a specific assertion. If it's useful, we could > perhaps extend the SAML subject identifier type in this spec to include > either the assertion_id or the subject_id claim. > > > > Thanks, > > Atul > > > > > > On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips > wrote: > > Hi. > > Quiet lurker observing.. > > Thanks for consider the SAML elements.. > > > > Atul, are you referring to the actual session identifier that someone may > have where the Subject-Id was exchanged OR the actual Subject-id itself i= n > your reference in the proposal with the github link? > > > > I=E2=80=99m trying to square what I see on the git delta on line 294-296 = in > https://github..com/richanna/secevent/pull/1/commits/b20b6692eb5062892747= 6ca78f9be077ace88994 > > > > > > > And a Subject-id as shown in the example in 3.3.3 here: > https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-= subject-id-attr-v1.0-cs01.html#_Toc536097229 > > > > > What you offered in the example is not a Subject-id per the OASIS SAML > spec as written in section 3.3.1 > > > > Am I mis-interpreting something? > > > > C > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Monday, July 13, 2020 at 12:17 PM > *To: *"id-event@ietf.org" > *Subject: *[Id-event] SAML subject identifier type > > > > Hi all, > > Based on the discussions in the SSE working group within the OpenID > Foundation, we would like to propose that the subject identifier > specification include a SAML subject identifier type. This is so that > sessions established across peers using SAML may be identified in events > that include the subject identifier. > > > > A SAML subject identifier has only one claim within it, the assertion id > of the SAML assertion used to establish the single sign-on session. > > > > This change is also included in my proposal here > . > > > > Thanks, > > Atul > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > _______________________________________________ Id-event mailing list > Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --=20 _CONFIDENTIALITY NOTICE: This email may contain confidential and privileged= =20 material for the sole use of the intended recipient(s). Any review, use,=20 distribution or disclosure by others is strictly prohibited.=C2=A0 If you h= ave=20 received this communication in error, please notify the sender immediately= =20 by e-mail and delete the message and any file attachments from your=20 computer. Thank you._ --000000000000834b4f05aa6ee4ab Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    + 1 to what Yaron is saying here. I'd include als= o the "iss-sub" subject identifier type https://tools.ietf.org/html/draft-ietf-secevent-subject-identi= fiers-05#section-3.4 as already having semantics covering what's de= scribed in the ID Token Claims Subject Identifier Type in the RISC document= referenced. And all those things represent a durable subject rather than a= session, which strikes me as appropriate for a document that describes ide= ntifying subjects. A SAML assertion ID, however, which is an identifier of = an XML document that is only indirectly related to a session by an associat= ion that likely isn't maintained, does not seem appropriate as a "= subject identifier".

    On Tue, Jul 14, 2020 at 4:01 PM Yaron S= heffer <yaron= f.ietf@gmail.com> wrote:

    Hi Atul,=

    =C2=A0

    The ID Token subject type, as described in the document you are r= eferencing, does not add any semantics, compared to a =E2=80=9Cphone number= =E2=80=9D or =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see t= he value in adding it.

    =C2= =A0

    In addition, it does not, actually, de= scribe an ID Token. In fact the text is very clear that it describes a =E2= =80=9Csubject=E2=80=9D (a durable entity) rather than a session, and does i= t by citing various claims included in the ID token. So as a subject identi= fier type, it is not at all equivalent to a SAML assertion.

    =C2=A0

    As = to the SAML Assertion subject type, I think these use cases could be addres= sed by adding information to the event.

    =C2=A0

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Atul Tulshibagwale <atultulshi@google.com>
    Date: Tue= sday, July 14, 2020 at 23:26
    To: Yaron Sheffer <yaronf.ietf@gmail.com><= br>Cc: Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf.org" <<= a href=3D"mailto:id-event@ietf.org" target=3D"_blank">id-event@ietf.org= >
    Subject: Re: [Id-event] SAML subject identifier type<= u>

    =C2=A0

    =

    Hi=C2=A0Yaron,

    There are a few SSE use cases where the events are about= a specific single sign-on session. You're right that this should not b= e limited to SAML. The RISC profile of SETs (based on which we are doing th= e SSE work) had the ID Token subject identifier type, which for some reason= is missing in this spec (I did not realize until now). The specific events= that need to refer to sessions are:

    • Identity provider context change: The con= ditions under which a SAML assertion or OIDC token was generated are no lon= ger=C2=A0valid. This can be due to various things, including a password cha= nge.
    • Session property change: A s= ession has been determined to have been compromised
    • Revocation: The issuer of the single sign-on SAML assert= ion or ID Token needs to be revoke

    I can also add the ID Toke= n claim from the RISC profile to my pull request.

    =C2=A0

    Thanks,

    Atul

    =C2=A0=

    =C2=A0

    On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer <= ;yaronf.ietf@gma= il.com> wrote:

    = I need a lot more context here. So far, subject IDs have denoted durable en= tities, such as email addresses, phone numbers, account. This is adding a s= ubject ID that denotes an ephemeral entity, basically similar to a session = ID. This looks weird from an architectural point of view, and also begs the= question, why specifically SAML and not other session types.=

    =C2=A0

    T= hanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Id-event <id-event-bounces@ietf.org> = on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org><= br>Date: Tuesday, July 14, 2020 at 00:14
    To: Chris Phillip= s <Chris.= Phillips@canarie.ca>
    Cc: "id-event@ietf.org" <id-event@ietf.org>
    Sub= ject: Re: [Id-event] SAML subject identifier type<= /p>

    =C2=A0

    Just clarifying the proposal as it stands today (before= incorporating Chris's input):

    The following section should be added in the "Subject Identifier = Types" section:

    4.9.=C2=A0 SAML Subject Id= entifier Type

    =C2=A0 =C2=A0The SAML [SAML.REF] Subject Identifier Ty= pe describes a subject by
    =C2=A0 =C2=A0the assertion identifier in the S= AML assertion that was used to
    =C2=A0 =C2=A0convey the subject's inf= ormation to the Receiver.=C2=A0 Subject
    =C2=A0 =C2=A0Identifiers of this= type MUST contain an ` assertion_id"claim.=C2=A0 The
    =C2=A0 =C2=A0= value of this claim is a string that is equal to the Assertion
    =C2=A0 = =C2=A0Identifier in the SAML assertion.=C2=A0 The SAML Subject Identifier T= ype
    =C2=A0 =C2=A0is identified by the name "saml`.

    =C2=A0 = =C2=A0Below is a non-normative example Subject Identifier for the SAML
    = =C2=A0 =C2=A0Subject Identifier Type:

    =C2=A0 =C2=A0{
    =C2=A0 =C2= =A0 =C2=A0"subject_type": "saml",
    =C2=A0 =C2=A0 =C2= =A0"assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5",=
    =C2=A0 =C2=A0}

    =C2=A0 =C2=A0 =C2=A0Figure 8: Example: Subject Id= entifier for SAML Subject Identifier
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0Type.

    =C2=A0

    =C2=A0<= /u>

    On Mon, Jul 13, 2020 at 1:22= PM Atul Tulshibagwale <atultulshi@google.com> wrote:

    Hi Chris,

    I was proposing= using the "assertion id" (SAML Core sp= ec, line 553) in the proposal, not the "subject-id" as defined in= SAML (spec section 3.3). The main reason was to be able to refer to a sess= ion that was established using a specific assertion. If it's useful, we= could perhaps extend the SAML subject identifier type in this spec to incl= ude either the assertion_id or the subject_id claim.

    =C2=A0

    Thanks,

    Atul=

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@ca= narie.ca> wrote:

    Hi.

    Quiet lurker observing..

    Thanks for consider the SAML elements..

    =C2=A0

    Atul, are yo= u referring to the actual session identifier that someone may have where th= e Subject-Id was exchanged OR the actual Subject-id itself in your referenc= e in the proposal with the github link?

    =C2=A0

    I=E2=80=99m trying to square what I see on= the git delta on line 294-296 in https://github..com/richanna/secevent/pull/1/commits/b20b6692eb50628= 927476ca78f9be077ace88994

    =C2=A0

    =C2=A0

    And a Subject-id as shown in the example in 3.3.3 he= re: https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/sam= l-subject-id-attr-v1.0-cs01.html#_Toc536097229

    =

    =C2=A0

    =

    What you offered in the example= is not a Subject-id =C2=A0per the OASIS SAML spec as written in section 3.= 3.1

    =C2= =A0

    Am = I mis-interpreting something?

    =C2=A0

    C

    =C2=A0

    =C2=A0

    From: Id-event <id-event-bounce= s@ietf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmar= c.ietf.org>
    Date: Monday, July 13, 2020 at 12:17 PM
    = To: "id-eve= nt@ietf.org" <id-event@ietf.org>
    Subject: [Id-event] SAML subject = identifier type

    <= span lang=3D"EN-CA">=C2=A0

    Hi all,

    Based on the discussions in the SSE wo= rking group within the OpenID Foundation, we would like to propose that the= subject identifier specification include a SAML subject identifier type. T= his is so that sessions established across peers using SAML may be identifi= ed in events that include the subject identifier.

    <= /div>

    =C2=A0<= u>

    =C2=A0A SA= ML subject identifier has only one claim within it, the assertion id of the= SAML assertion used to establish the single sign-on session.=

    =C2=A0

    This change is also included in my proposal here.=

    =C2=A0=

    Thank= s,

    Atul

    =C2=A0

    _______________________________________________
    Id-ev= ent mailing list
    = Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    _______________________________________________ Id-event mailing list= Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event

    <= /div>
    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    <= span style=3D"margin:0px;padding:0px;border:0px;outline:0px;vertical-align:= baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,= -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ub= untu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600"= >CONFIDENTIALITY NOTICE: This email may contain confidenti= al and privileged material for the sole use of the intended recipient(s). A= ny review, use, distribution or disclosure by others is strictly prohibited= .=C2=A0 If you have received this communication in error, please notify the= sender immediately by e-mail and delete the message and any file attachmen= ts from your computer. Thank you. --000000000000834b4f05aa6ee4ab-- From nobody Tue Jul 14 16:31:12 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D13DF3A0657 for ; Tue, 14 Jul 2020 16:31:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.588 X-Spam-Level: X-Spam-Status: No, score=-17.588 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pFOHcBuACXhX for ; Tue, 14 Jul 2020 16:31:07 -0700 (PDT) Received: from mail-yb1-xb34.google.com (mail-yb1-xb34.google.com [IPv6:2607:f8b0:4864:20::b34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 551953A0745 for ; Tue, 14 Jul 2020 16:31:07 -0700 (PDT) Received: by mail-yb1-xb34.google.com with SMTP id l19so259842ybl.1 for ; Tue, 14 Jul 2020 16:31:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=66iF+/hc0Q9qj4JiVgCrbHHqh/Jt1rZh2JRZVKrrxw4=; b=sTDSQJQR8Gd3IF7F2zWojjoqFhfus6eu0kDvsW1PCW7p7VDUEffqgmSFgQqT1uKjTM tsqQTCcLkM2Hv38U9TJtFw9wzyCU05wzoqSHi3M1XP+9w3XdFIZ4xv2zSdvj9KTki0wC 7WfXG78ufIIFryJRced77Mf/W6zthLlM5txBka7G+hcI++jhpiW8n/Ue4sRIkbzSj+kq R1bPO0paNd+2CuateBJx2632ypbzxu09MaOksHocDNIcT4eOinEM5FnOWPnAIw2dSdgC roU8zJokbce8YpWmkVLk1x+ySnga/tP1nyuHbcRV3u4m0oNaU4KKzFPq+LKcWyJyJzM/ E1Rg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=66iF+/hc0Q9qj4JiVgCrbHHqh/Jt1rZh2JRZVKrrxw4=; b=ZwPs881hbefiHYwiCYPe1yusIC3++mKZV8zAvPRJLtAoDQYT1vpLG6rMYi/DYAKai4 5C7gzdfJdrR8vM6Tso0f2bjahehH7s6AIvk6lB1KfMwJRPr2KEdti3O0Wv/ajnJTvwb3 AldMx3VR8dIa3k5Z8IIeAjCQYWsdELklfBhlyTxIcXJg+dn7mnqKBoFyMAx0e5o2LRrr eD4Q/7iMmQTpOoxN6VxWOmpbTCiNgmeSdSoFJB9Q7OLrIJP8IvXKLoA50u10nNoYvXEh 6nUh0GtntP3lQnWFX8e9PHu+1EbAC5pKtnf60K4dLVVCAGiBVcr7C7BUD11ER5GHpPdD D/RA== X-Gm-Message-State: AOAM530m2goGDV8pFkih0RpxNZndcnxA8L2gVI7M8kgpptwRFe6TtORe tWxGiX19JtdlGQAeMB40jrvDOj4LovA034j4fYcHEg== X-Google-Smtp-Source: ABdhPJyW17I4mXGEG8P2zhAq2f+pP5gdfeEE/YXuLrJ8H0fbYzioITaXE7riW/xE4ktLNXYgdLhiq/4gSE5cIk22heQ= X-Received: by 2002:a25:b90e:: with SMTP id x14mr12596277ybj.8.1594769466120; Tue, 14 Jul 2020 16:31:06 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> In-Reply-To: From: Atul Tulshibagwale Date: Tue, 14 Jul 2020 16:30:54 -0700 Message-ID: To: Brian Campbell Cc: Yaron Sheffer , Chris Phillips , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="00000000000087442c05aa6f335a" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 23:31:10 -0000 --00000000000087442c05aa6f335a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable IMO if we have a common enough use-case that requires a specific type to be defined, then we should define that type in the spec rather than rely on an interpretation of the "iss-sub" type, since that interpretation can cause incompatibilities. In this specific case however I feel that the use cases outlined in my previous email can be achieved (with limitations) using the durable subject types such as email. I'd like the members of the SSE working group to chime in (since that is where this got added), or we can drop the SAML subject identifier type. On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell wrote: > + 1 to what Yaron is saying here. I'd include also the "iss-sub" subject > identifier type > https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#se= ction-3.4 > as already having semantics covering what's described in the ID Token > Claims Subject Identifier Type in the RISC document referenced. And all > those things represent a durable subject rather than a session, which > strikes me as appropriate for a document that describes identifying > subjects. A SAML assertion ID, however, which is an identifier of an XML > document that is only indirectly related to a session by an association > that likely isn't maintained, does not seem appropriate as a "subject > identifier". > > On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer > wrote: > >> Hi Atul, >> >> >> >> The ID Token subject type, as described in the document you are >> referencing, does not add any semantics, compared to a =E2=80=9Cphone nu= mber=E2=80=9D or >> =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value i= n adding it. >> >> >> >> In addition, it does not, actually, describe an ID Token. In fact the >> text is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a dura= ble entity) rather >> than a session, and does it by citing various claims included in the ID >> token. So as a subject identifier type, it is not at all equivalent to a >> SAML assertion. >> >> >> >> As to the SAML Assertion subject type, I think these use cases could be >> addressed by adding information to the event. >> >> >> >> Thanks, >> >> Yaron >> >> >> >> *From: *Atul Tulshibagwale >> *Date: *Tuesday, July 14, 2020 at 23:26 >> *To: *Yaron Sheffer >> *Cc: *Chris Phillips , "id-event@ietf.org" < >> id-event@ietf.org> >> *Subject: *Re: [Id-event] SAML subject identifier type >> >> >> >> Hi Yaron, >> >> There are a few SSE use cases where the events are about a specific >> single sign-on session. You're right that this should not be limited to >> SAML. The RISC profile of SETs (based on which we are doing the SSE work= ) >> had the ID Token subject identifier type, which for some reason is missi= ng >> in this spec (I did not realize until now). The specific events that nee= d >> to refer to sessions are: >> >> - Identity provider context change: The conditions under which a SAML >> assertion or OIDC token was generated are no longer valid. This can b= e due >> to various things, including a password change. >> - Session property change: A session has been determined to have been >> compromised >> - Revocation: The issuer of the single sign-on SAML assertion or ID >> Token needs to be revoke >> >> I can also add the ID Token claim from the RISC profile >> >> to my pull request. >> >> >> >> Thanks, >> >> Atul >> >> >> >> >> >> On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer >> wrote: >> >> I need a lot more context here. So far, subject IDs have denoted durable >> entities, such as email addresses, phone numbers, account. This is addin= g a >> subject ID that denotes an ephemeral entity, basically similar to a sess= ion >> ID. This looks weird from an architectural point of view, and also begs = the >> question, why specifically SAML and not other session types. >> >> >> >> Thanks, >> >> Yaron >> >> >> >> *From: *Id-event on behalf of Atul >> Tulshibagwale >> *Date: *Tuesday, July 14, 2020 at 00:14 >> *To: *Chris Phillips >> *Cc: *"id-event@ietf.org" >> *Subject: *Re: [Id-event] SAML subject identifier type >> >> >> >> Just clarifying the proposal as it stands today (before incorporating >> Chris's input): >> >> The following section should be added in the "Subject Identifier Types" >> section: >> >> 4.9. SAML Subject Identifier Type >> >> The SAML [SAML.REF] Subject Identifier Type describes a subject by >> the assertion identifier in the SAML assertion that was used to >> convey the subject's information to the Receiver. Subject >> Identifiers of this type MUST contain an ` assertion_id"claim. The >> value of this claim is a string that is equal to the Assertion >> Identifier in the SAML assertion. The SAML Subject Identifier Type >> is identified by the name "saml`. >> >> Below is a non-normative example Subject Identifier for the SAML >> Subject Identifier Type: >> >> { >> "subject_type": "saml", >> "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", >> } >> >> Figure 8: Example: Subject Identifier for SAML Subject Identifier >> Type. >> >> >> >> >> >> On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale >> wrote: >> >> Hi Chris, >> >> I was proposing using the "assertion id" (SAML Core >> >> spec, line 553) in the proposal, not the "subject-id" as defined in SAML >> (spec section 3.3). The main reason was to be able to refer to a session >> that was established using a specific assertion. If it's useful, we coul= d >> perhaps extend the SAML subject identifier type in this spec to include >> either the assertion_id or the subject_id claim. >> >> >> >> Thanks, >> >> Atul >> >> >> >> >> >> On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips < >> Chris.Phillips@canarie.ca> wrote: >> >> Hi. >> >> Quiet lurker observing.. >> >> Thanks for consider the SAML elements.. >> >> >> >> Atul, are you referring to the actual session identifier that someone ma= y >> have where the Subject-Id was exchanged OR the actual Subject-id itself = in >> your reference in the proposal with the github link? >> >> >> >> I=E2=80=99m trying to square what I see on the git delta on line 294-296= in >> https://github..com/richanna/secevent/pull/1/commits/b20b6692eb506289274= 76ca78f9be077ace88994 >> >> >> >> >> >> >> And a Subject-id as shown in the example in 3.3.3 here: >> https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml= -subject-id-attr-v1.0-cs01.html#_Toc536097229 >> >> >> >> >> What you offered in the example is not a Subject-id per the OASIS SAML >> spec as written in section 3.3.1 >> >> >> >> Am I mis-interpreting something? >> >> >> >> C >> >> >> >> >> >> *From: *Id-event on behalf of Atul >> Tulshibagwale >> *Date: *Monday, July 13, 2020 at 12:17 PM >> *To: *"id-event@ietf.org" >> *Subject: *[Id-event] SAML subject identifier type >> >> >> >> Hi all, >> >> Based on the discussions in the SSE working group within the OpenID >> Foundation, we would like to propose that the subject identifier >> specification include a SAML subject identifier type. This is so that >> sessions established across peers using SAML may be identified in events >> that include the subject identifier. >> >> >> >> A SAML subject identifier has only one claim within it, the assertion i= d >> of the SAML assertion used to establish the single sign-on session. >> >> >> >> This change is also included in my proposal here >> . >> >> >> >> Thanks, >> >> Atul >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> _______________________________________________ Id-event mailing list >> Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > > *CONFIDENTIALITY NOTICE: This email may contain confidential and > privileged material for the sole use of the intended recipient(s). Any > review, use, distribution or disclosure by others is strictly prohibited. > If you have received this communication in error, please notify the sende= r > immediately by e-mail and delete the message and any file attachments fro= m > your computer. Thank you.* --00000000000087442c05aa6f335a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    IMO if we have a common enough use-case that requires a sp= ecific type to be defined, then we should define that type in the spec rath= er than rely on an interpretation of the "iss-sub" type, since th= at interpretation can cause incompatibilities.

    In this s= pecific case however I feel that the use cases outlined in my previous emai= l can be achieved (with limitations) using the durable subject types such a= s email. I'd like the members of the SSE working group to chime in (sin= ce that is where this got added), or we can drop the SAML subject identifie= r type.

    On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell <bcampbell@pingidentity.com> wrote= :
    + 1 to what Yaron is saying here. I'd include also the "is= s-sub" subject identifier type h= ttps://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#secti= on-3.4 as already having semantics covering what's described in the= ID Token Claims Subject Identifier Type in the RISC document referenced. A= nd all those things represent a durable subject rather than a session, whic= h strikes me as appropriate for a document that describes identifying subje= cts. A SAML assertion ID, however, which is an identifier of an XML documen= t that is only indirectly related to a session by an association that likel= y isn't maintained, does not seem appropriate as a "subject identi= fier".

    On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer <yaronf.ietf@gmail.c= om> wrote:

    Hi Atul,

    =C2=A0

    The = ID Token subject type, as described in the document you are referencing, do= es not add any semantics, compared to a =E2=80=9Cphone number=E2=80=9D or = =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value in a= dding it.

    =C2=A0

    <= p class=3D"MsoNormal">In addition, it does not, actually, describe an ID To= ken. In fact the text is very clear that it describes a =E2=80=9Csubject=E2= =80=9D (a durable entity) rather than a session, and does it by citing vari= ous claims included in the ID token. So as a subject identifier type, it is= not at all equivalent to a SAML assertion.

    =C2=A0

    As to the SAML Asse= rtion subject type, I think these use cases could be addressed by adding in= formation to the event.

    =C2= =A0

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

    <= u>=C2=A0

    From: Atul Tulshibagwale <atultulshi@google.com>
    Date: Tuesday, July 14,= 2020 at 23:26
    To: Yaron Sheffer <yaronf.ietf@gmail.com>
    Cc: = Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf.org" <id-event@ietf.org>
    Sub= ject: Re: [Id-event] SAML subject identifier type    <= /p>

    =C2=A0

    Hi=C2=A0Yaron,

    There are a few SSE use cases where the events are about a specific si= ngle sign-on session. You're right that this should not be limited to S= AML. The RISC profile of SETs (based on which we are doing the SSE work) ha= d the ID Token subject identifier type, which for some reason is missing in= this spec (I did not realize until now). The specific events that need to = refer to sessions are:

    • Identity provider context change: The conditions under wh= ich a SAML assertion or OIDC token was generated are no longer=C2=A0valid. = This can be due to various things, including a password change.
    • Session property change: A session has been = determined to have been compromised
    • Revocation: The issuer of the single sign-on SAML assertion or ID Token = needs to be revoke

    I can= also add the ID Token claim from the= RISC profile to my pull request.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    =C2=A0

    On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer <yaronf.ietf@gmail.com> w= rote:

    I need a lot mor= e context here. So far, subject IDs have denoted durable entities, such as = email addresses, phone numbers, account. This is adding a subject ID that d= enotes an ephemeral entity, basically similar to a session ID. This looks w= eird from an architectural point of view, and also begs the question, why s= pecifically SAML and not other session types.

    =C2=A0

    Thanks,=

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Id-event <id-event-bounces@ietf.org> on behalf of At= ul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Tuesday, July 14, 2020 at 00:14
    To: Chris Phillips <Chris.Phillips@cana= rie.ca>
    Cc: "id-event@ietf.org" <id-event@ietf.org>
    Subject: Re:= [Id-event] SAML subject identifier type

    =C2=A0

    Just clarifying the proposal as it stands today (before incorporatin= g Chris's input):

    The foll= owing section should be added in the "Subject Identifier Types" s= ection:

    4.9.=C2=A0 SAML Subject Identifier Type=

    =C2=A0 =C2=A0The SAML [SAML.REF] Subject Identifier Type describes = a subject by
    =C2=A0 =C2=A0the assertion identifier in the SAML assertion= that was used to
    =C2=A0 =C2=A0convey the subject's information to t= he Receiver.=C2=A0 Subject
    =C2=A0 =C2=A0Identifiers of this type MUST co= ntain an ` assertion_id"claim.=C2=A0 The
    =C2=A0 =C2=A0value of this= claim is a string that is equal to the Assertion
    =C2=A0 =C2=A0Identifie= r in the SAML assertion.=C2=A0 The SAML Subject Identifier Type
    =C2=A0 = =C2=A0is identified by the name "saml`.

    =C2=A0 =C2=A0Below is a= non-normative example Subject Identifier for the SAML
    =C2=A0 =C2=A0Subj= ect Identifier Type:

    =C2=A0 =C2=A0{
    =C2=A0 =C2=A0 =C2=A0"sub= ject_type": "saml",
    =C2=A0 =C2=A0 =C2=A0"assertion_i= d": "_f551d88963ab4e3decb7cfe8f4dcc3f5",
    =C2=A0 =C2=A0}
    =C2=A0 =C2=A0 =C2=A0Figure 8: Example: Subject Identifier for SAML Su= bject Identifier
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Type.=

    =C2=A0=

    =C2=A0

    On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale= <atultulshi@= google.com> wrote:

    Hi Chris,

    I was proposing using the "assert= ion id" (SAML Core spec, line 553) in the pr= oposal, not the "subject-id" as defined in SAML (spec section 3.3= ). The main reason was to be able to refer to a session that was establishe= d using a specific assertion. If it's useful, we could perhaps extend t= he SAML subject identifier type in this spec to include either the assertio= n_id or the subject_id claim.

    =C2=A0

    Thanks,<= /u>

    Atul

    =C2=A0

    =C2=A0

    On = Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca> wrot= e:

    Hi.

    Quiet lurke= r observing..

    Thanks for consider the SAML elements..

    =C2=A0

    Atul, are you referring to the act= ual session identifier that someone may have where the Subject-Id was excha= nged OR the actual Subject-id itself in your reference in the proposal with= the github link?

    =C2=A0

    I=E2=80=99m trying to square what I see on the git delta on line= 294-296 in https://github.= .com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be077ace88= 994

    =C2=A0

    =C2=A0

    And a Subject-id as shown in the example in 3.3.3 here: https://docs.oasis= -open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0= -cs01.html#_Toc536097229

    =C2=A0

    What you offered in the example is not a Subject-id = =C2=A0per the OASIS SAML spec as written in section 3.3.1<= /u>

    =C2=A0<= /u>

    Am I mis-interpreting so= mething?

    =C2=A0

    C

    =C2= =A0

    =C2= =A0

    From: Id-event <id-event-bounces@ietf.org> on= behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>Date: Monday, July 13, 2020 at 12:17 PM
    To: "id-event@ietf.org"= <id-event@ietf.o= rg>
    Subject: [Id-event] SAML subject identifier type

    = =C2=A0

    Hi all,

    Based on the discussions in the SSE working group within t= he OpenID Foundation, we would like to propose that the subject identifier = specification include a SAML subject identifier type. This is so that sessi= ons established across peers using SAML may be identified in events that in= clude the subject identifier.

    =C2=A0

    =C2=A0A SAML subject identif= ier has only one claim within it, the assertion id of the SAML assertion us= ed to establish the single sign-on session.

    <= div>

    =C2=A0=

    This change is a= lso included in my proposal here.

    =C2=A0

    Thanks,

    Atul=

    = =C2=A0

    _______________________________________________
    Id-event mailing list=
    Id-event@ietf.or= g
    https://www.ietf.org/mailman/listinfo/id-event

    _________= ______________________________________ Id-event mailing list Id-event@ietf.org https://ww= w.ietf.org/mailman/listinfo/id-event

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    <= span style=3D"margin:0px;padding:0px;border:0px;outline:0px;vertical-align:= baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,= -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ub= untu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600"= >CONFIDENTIALITY NOTICE: This email may contain confidenti= al and privileged material for the sole use of the intended recipient(s). A= ny review, use, distribution or disclosure by others is strictly prohibited= .=C2=A0 If you have received this communication in error, please notify the= sender immediately by e-mail and delete the message and any file attachmen= ts from your computer. Thank you. --00000000000087442c05aa6f335a-- From nobody Tue Jul 14 16:31:58 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3F293A0769 for ; Tue, 14 Jul 2020 16:31:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.589 X-Spam-Level: X-Spam-Status: No, score=-17.589 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8A6EFCzZbc9G for ; Tue, 14 Jul 2020 16:31:53 -0700 (PDT) Received: from mail-yb1-xb29.google.com (mail-yb1-xb29.google.com [IPv6:2607:f8b0:4864:20::b29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7BBA03A0745 for ; Tue, 14 Jul 2020 16:31:53 -0700 (PDT) Received: by mail-yb1-xb29.google.com with SMTP id x138so234880ybg.9 for ; Tue, 14 Jul 2020 16:31:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6ou3426CSW352BI2OIE9KuNqCwquJzyBRnn/j7/xHZg=; b=HFoHUtlfune5dftqyYIdYGbKy3tfwRz6gU6tdDCbCFTIUCE3Yuu8hxiEsUA5GTOirJ N8tDceBI8RiBaLcJBJ7hN4mr+GaNwmQpTYII7jebg1uZKysYZ50kSxBQDWKkkR23E9Ep gctVHkUzBByh5o9cHVdavcKbIzqdNrS5hcT+U4y7RZRQiTFkyG72/Q/u297Z4j6BLZ1o IsVBx88GpAGE4BTa4zFjmnrbB8GVZMXMb1wzUlF5YqrhpRxf0GiqTjlB3e8kyqWsfE1Q veLFEorG/55ab6KRHGx9GUZiIoytvEXEa2ls9R6bZxJtlbNyCS1+WlhGCi/cKNWIY/xh 8bTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6ou3426CSW352BI2OIE9KuNqCwquJzyBRnn/j7/xHZg=; b=f57pNjj4mNBKnNFq+GiUdjwcweei97/rewoue/fV6zuCe2bsJRm+8pJR6+fb8ZyOcL D4CatluNGvOQ+6LEzmX64aLB6y94Ylh8jeGpmVeIP0xY+ajdq2X9RsJV3+vGu6K6X5iB WX6m2zYeqTt1Aeyp8qz4tUzGQHdjKfwzGRDMEyF5he+kJsU1VwZPD4637XHDvCwnOrGt Q96NpbLSNehY1liu9Kk85kFbu47Bb585VsH72PZXqMUFJcaSxMItdOv2CobPQL5aBmkX S6pKPQ5pmebb5gFOyTDOp1JunolQeMHI+jNw09UqQB+0UVc6OgK7Frvh2AHrehUXI9E8 fyGA== X-Gm-Message-State: AOAM533gvxS+5bbeBdMg0f9TNcne2KdBCgnQVBHeVHaW4v4CHd1/LPq5 Y8/ju+eP6JhMKlg7xCd+ZCz3BA2BYl42n4XYA2PwdA== X-Google-Smtp-Source: ABdhPJyr/qI/Ch4G6ErDbK/UWVrMXb57mrYz5wZxygvi0+n+u4ViaAV/B8fR3+oSBl4Sdl97Q/Szdfm6gXizoakhIV4= X-Received: by 2002:a25:c713:: with SMTP id w19mr12016148ybe.130.1594769512335; Tue, 14 Jul 2020 16:31:52 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> In-Reply-To: From: Atul Tulshibagwale Date: Tue, 14 Jul 2020 16:31:40 -0700 Message-ID: To: Brian Campbell , Openid-specs-risc Cc: Yaron Sheffer , Chris Phillips , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="000000000000488c0105aa6f3612" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 23:31:56 -0000 --000000000000488c0105aa6f3612 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable +Openid-specs-risc On Tue, Jul 14, 2020 at 4:30 PM Atul Tulshibagwale wrote: > IMO if we have a common enough use-case that requires a specific type to > be defined, then we should define that type in the spec rather than rely = on > an interpretation of the "iss-sub" type, since that interpretation can > cause incompatibilities. > > In this specific case however I feel that the use cases outlined in my > previous email can be achieved (with limitations) using the durable subje= ct > types such as email. I'd like the members of the SSE working group to chi= me > in (since that is where this got added), or we can drop the SAML subject > identifier type. > > On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell > wrote: > >> + 1 to what Yaron is saying here. I'd include also the "iss-sub" subject >> identifier type >> https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#s= ection-3.4 >> as already having semantics covering what's described in the ID Token >> Claims Subject Identifier Type in the RISC document referenced. And all >> those things represent a durable subject rather than a session, which >> strikes me as appropriate for a document that describes identifying >> subjects. A SAML assertion ID, however, which is an identifier of an XML >> document that is only indirectly related to a session by an association >> that likely isn't maintained, does not seem appropriate as a "subject >> identifier". >> >> On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer >> wrote: >> >>> Hi Atul, >>> >>> >>> >>> The ID Token subject type, as described in the document you are >>> referencing, does not add any semantics, compared to a =E2=80=9Cphone n= umber=E2=80=9D or >>> =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value = in adding it. >>> >>> >>> >>> In addition, it does not, actually, describe an ID Token. In fact the >>> text is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a dur= able entity) rather >>> than a session, and does it by citing various claims included in the ID >>> token. So as a subject identifier type, it is not at all equivalent to = a >>> SAML assertion. >>> >>> >>> >>> As to the SAML Assertion subject type, I think these use cases could be >>> addressed by adding information to the event. >>> >>> >>> >>> Thanks, >>> >>> Yaron >>> >>> >>> >>> *From: *Atul Tulshibagwale >>> *Date: *Tuesday, July 14, 2020 at 23:26 >>> *To: *Yaron Sheffer >>> *Cc: *Chris Phillips , "id-event@ietf.org" < >>> id-event@ietf.org> >>> *Subject: *Re: [Id-event] SAML subject identifier type >>> >>> >>> >>> Hi Yaron, >>> >>> There are a few SSE use cases where the events are about a specific >>> single sign-on session. You're right that this should not be limited to >>> SAML. The RISC profile of SETs (based on which we are doing the SSE wor= k) >>> had the ID Token subject identifier type, which for some reason is miss= ing >>> in this spec (I did not realize until now). The specific events that ne= ed >>> to refer to sessions are: >>> >>> - Identity provider context change: The conditions under which a >>> SAML assertion or OIDC token was generated are no longer valid. This= can be >>> due to various things, including a password change. >>> - Session property change: A session has been determined to have >>> been compromised >>> - Revocation: The issuer of the single sign-on SAML assertion or ID >>> Token needs to be revoke >>> >>> I can also add the ID Token claim from the RISC profile >>> >>> to my pull request. >>> >>> >>> >>> Thanks, >>> >>> Atul >>> >>> >>> >>> >>> >>> On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer >>> wrote: >>> >>> I need a lot more context here. So far, subject IDs have denoted durabl= e >>> entities, such as email addresses, phone numbers, account. This is addi= ng a >>> subject ID that denotes an ephemeral entity, basically similar to a ses= sion >>> ID. This looks weird from an architectural point of view, and also begs= the >>> question, why specifically SAML and not other session types. >>> >>> >>> >>> Thanks, >>> >>> Yaron >>> >>> >>> >>> *From: *Id-event on behalf of Atul >>> Tulshibagwale >>> *Date: *Tuesday, July 14, 2020 at 00:14 >>> *To: *Chris Phillips >>> *Cc: *"id-event@ietf.org" >>> *Subject: *Re: [Id-event] SAML subject identifier type >>> >>> >>> >>> Just clarifying the proposal as it stands today (before incorporating >>> Chris's input): >>> >>> The following section should be added in the "Subject Identifier Types" >>> section: >>> >>> 4.9. SAML Subject Identifier Type >>> >>> The SAML [SAML.REF] Subject Identifier Type describes a subject by >>> the assertion identifier in the SAML assertion that was used to >>> convey the subject's information to the Receiver. Subject >>> Identifiers of this type MUST contain an ` assertion_id"claim. The >>> value of this claim is a string that is equal to the Assertion >>> Identifier in the SAML assertion. The SAML Subject Identifier Type >>> is identified by the name "saml`. >>> >>> Below is a non-normative example Subject Identifier for the SAML >>> Subject Identifier Type: >>> >>> { >>> "subject_type": "saml", >>> "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", >>> } >>> >>> Figure 8: Example: Subject Identifier for SAML Subject Identifier >>> Type. >>> >>> >>> >>> >>> >>> On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale < >>> atultulshi@google.com> wrote: >>> >>> Hi Chris, >>> >>> I was proposing using the "assertion id" (SAML Core >>> >>> spec, line 553) in the proposal, not the "subject-id" as defined in SAM= L >>> (spec section 3.3). The main reason was to be able to refer to a sessio= n >>> that was established using a specific assertion. If it's useful, we cou= ld >>> perhaps extend the SAML subject identifier type in this spec to include >>> either the assertion_id or the subject_id claim. >>> >>> >>> >>> Thanks, >>> >>> Atul >>> >>> >>> >>> >>> >>> On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips < >>> Chris.Phillips@canarie.ca> wrote: >>> >>> Hi. >>> >>> Quiet lurker observing.. >>> >>> Thanks for consider the SAML elements.. >>> >>> >>> >>> Atul, are you referring to the actual session identifier that someone >>> may have where the Subject-Id was exchanged OR the actual Subject-id it= self >>> in your reference in the proposal with the github link? >>> >>> >>> >>> I=E2=80=99m trying to square what I see on the git delta on line 294-29= 6 in >>> https://github..com/richanna/secevent/pull/1/commits/b20b6692eb50628927= 476ca78f9be077ace88994 >>> >>> >>> >>> >>> >>> >>> And a Subject-id as shown in the example in 3.3.3 here: >>> https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/sam= l-subject-id-attr-v1.0-cs01.html#_Toc536097229 >>> >>> >>> >>> >>> What you offered in the example is not a Subject-id per the OASIS SAML >>> spec as written in section 3.3.1 >>> >>> >>> >>> Am I mis-interpreting something? >>> >>> >>> >>> C >>> >>> >>> >>> >>> >>> *From: *Id-event on behalf of Atul >>> Tulshibagwale >>> *Date: *Monday, July 13, 2020 at 12:17 PM >>> *To: *"id-event@ietf.org" >>> *Subject: *[Id-event] SAML subject identifier type >>> >>> >>> >>> Hi all, >>> >>> Based on the discussions in the SSE working group within the OpenID >>> Foundation, we would like to propose that the subject identifier >>> specification include a SAML subject identifier type. This is so that >>> sessions established across peers using SAML may be identified in event= s >>> that include the subject identifier. >>> >>> >>> >>> A SAML subject identifier has only one claim within it, the assertion >>> id of the SAML assertion used to establish the single sign-on session. >>> >>> >>> >>> This change is also included in my proposal here >>> . >>> >>> >>> >>> Thanks, >>> >>> Atul >>> >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >>> _______________________________________________ Id-event mailing list >>> Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >> >> *CONFIDENTIALITY NOTICE: This email may contain confidential and >> privileged material for the sole use of the intended recipient(s). Any >> review, use, distribution or disclosure by others is strictly prohibited= . >> If you have received this communication in error, please notify the send= er >> immediately by e-mail and delete the message and any file attachments fr= om >> your computer. Thank you.* > > --000000000000488c0105aa6f3612 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Tue, Jul 14, 2020 at 4:30 PM Atul Tulshibagwale <= atultulshi@google.com> wrot= e:
    IMO if we have a common enough use-case that requires a specific type t= o be defined, then we should define that type in the spec rather than rely = on an interpretation of the "iss-sub" type, since that interpreta= tion can cause incompatibilities.

    In this specific case = however I feel that the use cases outlined in my previous email can be achi= eved (with limitations) using the durable subject types such as email. I= 9;d like the members of the SSE working group to chime in (since that is wh= ere this got added), or we can drop the SAML subject identifier type.
    =

    = On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell <bcampbell@pingidentity.com> = wrote:
    + 1 to what Yaron is saying here. I'd include also the &q= uot;iss-sub" subject identifier type https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05= #section-3.4 as already having semantics covering what's described = in the ID Token Claims Subject Identifier Type in the RISC document referen= ced. And all those things represent a durable subject rather than a session= , which strikes me as appropriate for a document that describes identifying= subjects. A SAML assertion ID, however, which is an identifier of an XML d= ocument that is only indirectly related to a session by an association that= likely isn't maintained, does not seem appropriate as a "subject = identifier".

    On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer= <yaronf.ietf= @gmail.com> wrote:

    Hi Atul,<= u>

    =C2=A0

    The ID Token subject type, as described in the document you are refere= ncing, does not add any semantics, compared to a =E2=80=9Cphone number=E2= =80=9D or =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the = value in adding it.

    =C2=A0

    In addition, it does not, actually, describ= e an ID Token. In fact the text is very clear that it describes a =E2=80=9C= subject=E2=80=9D (a durable entity) rather than a session, and does it by c= iting various claims included in the ID token. So as a subject identifier t= ype, it is not at all equivalent to a SAML assertion.

    =C2=A0

    As to the= SAML Assertion subject type, I think these use cases could be addressed by= adding information to the event.

    <= u>=C2=A0

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Atul Tulshibagwale <atultulshi@google.com>
    Date: Tuesday, J= uly 14, 2020 at 23:26
    To: Yaron Sheffer <yaronf.ietf@gmail.com>
    C= c: Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf.org" <id-event@ietf.org>Subject: Re: [Id-event] SAML subject identifier type=

    =C2=A0

    =

    Hi=C2=A0Yaron,

    There are a few SSE use cases where the events are about a s= pecific single sign-on session. You're right that this should not be li= mited to SAML. The RISC profile of SETs (based on which we are doing the SS= E work) had the ID Token subject identifier type, which for some reason is = missing in this spec (I did not realize until now). The specific events tha= t need to refer to sessions are:

    • Identity provider context change: The condition= s under which a SAML assertion or OIDC token was generated are no longer=C2= =A0valid. This can be due to various things, including a password change.
    • Session property change: A session= has been determined to have been compromised
    • Revocation: The issuer of the single sign-on SAML assertion = or ID Token needs to be revoke

    I can also add the ID Token cl= aim from the RISC profile to my pull request.

    =C2=A0

    Thanks,

    A= tul

    =C2=A0=

    =C2=A0

    On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer <yaronf.ietf@gmail.c= om> wrote:

    I ne= ed a lot more context here. So far, subject IDs have denoted durable entiti= es, such as email addresses, phone numbers, account. This is adding a subje= ct ID that denotes an ephemeral entity, basically similar to a session ID. = This looks weird from an architectural point of view, and also begs the que= stion, why specifically SAML and not other session types.

    =

    =C2=A0

    Thank= s,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Yaron <= u>

    =C2=A0

    From: Id-event <id-event-bounces@ietf.org> on = behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    = Date: Tuesday, July 14, 2020 at 00:14
    To: Chris Phillips &= lt;Chris.Phi= llips@canarie.ca>
    Cc: "id-event@ietf.org" <id-event@ietf.org>
    Subjec= t: Re: [Id-event] SAML subject identifier type

    =

    =C2=A0

    Just clarifying the proposal as it stands today (before in= corporating Chris's input):

    The following section should be added in the "Subject Identifier Typ= es" section:

    4.9.=C2=A0 SAML Subject Ident= ifier Type

    =C2=A0 =C2=A0The SAML [SAML.REF] Subject Identifier Type = describes a subject by
    =C2=A0 =C2=A0the assertion identifier in the SAML= assertion that was used to
    =C2=A0 =C2=A0convey the subject's inform= ation to the Receiver.=C2=A0 Subject
    =C2=A0 =C2=A0Identifiers of this ty= pe MUST contain an ` assertion_id"claim.=C2=A0 The
    =C2=A0 =C2=A0val= ue of this claim is a string that is equal to the Assertion
    =C2=A0 =C2= =A0Identifier in the SAML assertion.=C2=A0 The SAML Subject Identifier Type=
    =C2=A0 =C2=A0is identified by the name "saml`.

    =C2=A0 =C2= =A0Below is a non-normative example Subject Identifier for the SAML
    =C2= =A0 =C2=A0Subject Identifier Type:

    =C2=A0 =C2=A0{
    =C2=A0 =C2=A0 = =C2=A0"subject_type": "saml",
    =C2=A0 =C2=A0 =C2=A0&q= uot;assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5",
    = =C2=A0 =C2=A0}

    =C2=A0 =C2=A0 =C2=A0Figure 8: Example: Subject Identi= fier for SAML Subject Identifier
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0Type.

    =C2=A0

    =C2=A0<= u>

    On Mon, Jul 13, 2020 at 1:22 PM = Atul Tulshibagwale <atultulshi@google.com> wrote:

    = Hi Chris,

    I was proposing usin= g the "assertion id" (SAML Core spec, l= ine 553) in the proposal, not the "subject-id" as defined in SAML= (spec section 3.3). The main reason was to be able to refer to a session t= hat was established using a specific assertion. If it's useful, we coul= d perhaps extend the SAML subject identifier type in this spec to include e= ither the assertion_id or the subject_id claim.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@cana= rie.ca> wrote:

    Hi.

    Quiet lurker observing..

    Thanks for consider the SAML elements..

    =C2=A0

    Atul, are you r= eferring to the actual session identifier that someone may have where the S= ubject-Id was exchanged OR the actual Subject-id itself in your reference i= n the proposal with the github link?

    =C2=A0

    I=E2=80=99m trying to square what I see on th= e git delta on line 294-296 in https://github..com/richanna/secevent/pull/1/commits/b20b6692eb50628927= 476ca78f9be077ace88994

    <= span lang=3D"EN-CA">=C2=A0

    <= span lang=3D"EN-CA">=C2=A0

    <= span lang=3D"EN-CA">And a Subject-id as shown in the example in 3.3.3 here:= https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-s= ubject-id-attr-v1.0-cs01.html#_Toc536097229

    =C2=A0

    What you offered in the example is= not a Subject-id =C2=A0per the OASIS SAML spec as written in section 3.3.1=

    =C2=A0=

    Am I m= is-interpreting something?

    <= span lang=3D"EN-CA">=C2=A0

    <= span lang=3D"EN-CA">C

    =C2=A0

    =C2=A0

    From: Id-event <id-event-bounces@i= etf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.i= etf.org>
    Date: Monday, July 13, 2020 at 12:17 PM
    To:= "id-event@= ietf.org" <id-event@ietf.org>
    Subject: [Id-event] SAML subject ide= ntifier type

    =C2=A0

    Hi all,

    Based on the discussions in the SSE wor= king group within the OpenID Foundation, we would like to propose that the = subject identifier specification include a SAML subject identifier type. Th= is is so that sessions established across peers using SAML may be identifie= d in events that include the subject identifier.

    =C2=A0

    =C2=A0A SAM= L subject identifier has only one claim within it, the assertion id of the = SAML assertion used to establish the single sign-on session.<= u>

    =C2=A0

    This change is also included in my proposal here.<= /p>

    =C2=A0<= /u>

    Thanks= ,

    Atul

    =C2=A0

    _______________________________________________
    Id-eve= nt mailing list
    I= d-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    _______________________________________________ Id-event mailing list = Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    <= span style=3D"margin:0px;padding:0px;border:0px;outline:0px;vertical-align:= baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,= -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ub= untu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600"= >CONFIDENTIALITY NOTICE: This email may contain confidenti= al and privileged material for the sole use of the intended recipient(s). A= ny review, use, distribution or disclosure by others is strictly prohibited= .=C2=A0 If you have received this communication in error, please notify the= sender immediately by e-mail and delete the message and any file attachmen= ts from your computer. Thank you. --000000000000488c0105aa6f3612-- From nobody Tue Jul 14 16:54:10 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98E773A08AF for ; Tue, 14 Jul 2020 16:54:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.59 X-Spam-Level: X-Spam-Status: No, score=-9.59 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 68JDKSqO3yv5 for ; Tue, 14 Jul 2020 16:54:06 -0700 (PDT) Received: from smtp-fw-9102.amazon.com (smtp-fw-9102.amazon.com [207.171.184.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 449523A08A7 for ; Tue, 14 Jul 2020 16:54:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1594770847; x=1626306847; h=from:to:cc:date:message-id:references:in-reply-to: mime-version:subject; bh=AhgyT2j9XaDUOJJn2KqKQQq6TdW645LXgLGa4wwSRsM=; b=cLQodQg46Chbx5UeSzwbHS09QYNSIC4yiTVLl2aygJSSfzY9awh+SVVg 0H3AlgZraKlfAE4V1m7O9VYpgZ+EfnThG1OwHWj5nBmQ6ToSRTMVBlics CzSbrhIP2bONfalCIEs9utNNjNh2US6m43Xf8FScsP0kvBaIkZws+unqH 4=; IronPort-SDR: B69MacAv1l/9Nvm8W32KtKfG5i6I6sS9E0Epq4zYXMbh6yV6qwZIhbRX9+T3csUb4R7AMPc2jZ Kzb5+eqvQcHg== X-IronPort-AV: E=Sophos; i="5.75,353,1589241600"; d="scan'208,217"; a="59875670" Thread-Topic: [Id-event] SAML subject identifier type Received: from sea32-co-svc-lb4-vlan3.sea.corp.amazon.com (HELO email-inbound-relay-2b-81e76b79.us-west-2.amazon.com) ([10.47.23.38]) by smtp-border-fw-out-9102.sea19.amazon.com with ESMTP; 14 Jul 2020 23:53:54 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan3.pdx.amazon.com [10.170.41.166]) by email-inbound-relay-2b-81e76b79.us-west-2.amazon.com (Postfix) with ESMTPS id 4702CA1C0A; Tue, 14 Jul 2020 23:53:53 +0000 (UTC) Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 14 Jul 2020 23:53:52 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC004.ant.amazon.com (10.43.162.101) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 14 Jul 2020 23:53:52 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Tue, 14 Jul 2020 23:53:52 +0000 From: "Richard Backman, Annabelle" To: Atul Tulshibagwale , "Brian Campbell" CC: Yaron Sheffer , Chris Phillips , "id-event@ietf.org" Thread-Index: AQHWWTErqa1UOmYxD0aXofDEeWMAPqkFxAuAgAAwHICAAA4GAIABdk8AgAAPNoCAABqVgIAAGVRf//+QtoA= Date: Tue, 14 Jul 2020 23:53:52 +0000 Message-ID: References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.26] Content-Type: multipart/alternative; boundary="_000_C62035F9E7D84CA489A32BE6DE941CE3amazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 23:54:09 -0000 --_000_C62035F9E7D84CA489A32BE6DE941CE3amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlIFJJU0MgUHJvZmlsZeKAmXMg4oCcSUQgVG9rZW4gQ2xhaW1z4oCdIHR5cGUgZG9lcyBub3Qg aWRlbnRpZnkgYSBzdWJqZWN0IHRoYXQgaXMgYW4gSUQgVG9rZW4sIGl0IGlkZW50aWZpZXMgYSBz dWJqZWN0IHRoYXQgd2FzIHRoZSBzdWJqZWN0IG9mIGFuIElEIFRva2VuLiBJdCB3YXMgaW50ZW5k ZWQgZm9yIGNhc2VzIHdoZXJlIHRoZSBPUCBzZW50IG11bHRpcGxlIGlkZW50aWZpZXJzIG9mIGRp ZmZlcmVudCB0eXBlcyBpbiB0aGUgSUQgVG9rZW4gKGUuZy4sIGlzcytzdWIgYW5kIGVtYWlsKSwg YW5kIGRvZXMgbm90IGtub3cgd2hpY2ggb2YgdGhlbSB0aGUgY2xpZW50IHdpbGwgcmVjb2duaXpl ICh5ZXMsIHRoZSBzaG91bGQgdXNlIGlzcytzdWI7IG5vLCB0aGV5IGRvZXNu4oCZdCBhbHdheXMg ZG8gc28pLiBUaGlzIHR5cGUgd2FzIHJlcGxhY2VkIGluIGRyYWZ0LWlldGYtc2VjZXZlbnQtc3Vi amVjdC1pZGVudGlmaWVycy0wMyB3aXRoIHRoZSDigJxhbGlhc2Vz4oCdIHR5cGUsIHdoaWNoIGlz IGEgZ2VuZXJhbCBzb2x1dGlvbiB0byB0aGlzIHByb2JsZW0gdGhhdCBpcyBub3QgZGVmaW5lZCBp biB0ZXJtcyBvZiBvbmUgcGFydGljdWxhciB1c2UgY2FzZSAoaS5lLiwgSUQgVG9rZW5zKS4NCg0K VGhlIE9JREYgU1NFIHdvcmtpbmcgZ3JvdXDigJlzIE9BdXRoIEV2ZW50IFR5cGVzIGRyYWZ0PGh0 dHBzOi8vb3BlbmlkLm5ldC9zcGVjcy9vYXV0aC1ldmVudC10eXBlcy0xXzAtSUQxLmh0bWwjcmZj LnNlY3Rpb24uMi4xPiBkZWZpbmVzIGEg4oCcb2F1dGhfdG9rZW7igJ0gdHlwZSB0aGF0IGlkZW50 aWZpZXMgYSBzdWJqZWN0IHRoYXQgaXMgYW4gT0F1dGggMi4wIHRva2VuLCBhbmQgZG9lcyBzbyB1 c2luZyBlaXRoZXIgdGhlIGZ1bGwgb3IgcGFydGlhbCBwbGFpbiB0ZXh0IHZhbHVlIG9mIHRoZSB0 b2tlbiwgb3IgYSBoYXNoIG9mIHRoZSB0b2tlbi4NCg0KSXQgaXMgcGVyZmVjdGx5IGZpbmUgZm9y IGEgdG9rZW4gdG8gYmUgdGhlIHN1YmplY3Qgb2YgYSBzZWN1cml0eSBldmVudC4gODQxNzxodHRw czovL3d3dy5yZmMtZWRpdG9yLm9yZy9yZmMvcmZjODQxNy5odG1sI3NlY3Rpb24tMi4yPiBhY3R1 YWxseSBpbmNsdWRlcyB0aGUgZm9sbG93aW5nIGFzIGFuIGV4YW1wbGUgb2YgYSBwb3NzaWJsZSB2 YWx1ZSBmb3IgdGhlIOKAnHN1YuKAnSBjbGFpbToNCiogIGEgdG9rZW4gaWRlbnRpZmllciAoZS5n LiAianRpIikgZm9yIGEgcmV2b2tlZCB0b2tlbi4NCg0K4oCTDQpBbm5hYmVsbGUgQmFja21hbiAo c2hlL2hlcikNCkFXUyBJZGVudGl0eQ0KaHR0cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS8N Cg0KDQpGcm9tOiBJZC1ldmVudCA8aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxm IG9mIEF0dWwgVHVsc2hpYmFnd2FsZSA8YXR1bHR1bHNoaT00MGdvb2dsZS5jb21AZG1hcmMuaWV0 Zi5vcmc+DQpEYXRlOiBUdWVzZGF5LCBKdWx5IDE0LCAyMDIwIGF0IDQ6MzIgUE0NClRvOiBCcmlh biBDYW1wYmVsbCA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20+DQpDYzogWWFyb24gU2hlZmZl ciA8eWFyb25mLmlldGZAZ21haWwuY29tPiwgQ2hyaXMgUGhpbGxpcHMgPENocmlzLlBoaWxsaXBz QGNhbmFyaWUuY2E+LCAiaWQtZXZlbnRAaWV0Zi5vcmciIDxpZC1ldmVudEBpZXRmLm9yZz4NClN1 YmplY3Q6IFJFOiBbRVhURVJOQUxdIFtJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIg dHlwZQ0KDQoNCkNBVVRJT046IFRoaXMgZW1haWwgb3JpZ2luYXRlZCBmcm9tIG91dHNpZGUgb2Yg dGhlIG9yZ2FuaXphdGlvbi4gRG8gbm90IGNsaWNrIGxpbmtzIG9yIG9wZW4gYXR0YWNobWVudHMg dW5sZXNzIHlvdSBjYW4gY29uZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlz IHNhZmUuDQoNCg0KSU1PIGlmIHdlIGhhdmUgYSBjb21tb24gZW5vdWdoIHVzZS1jYXNlIHRoYXQg cmVxdWlyZXMgYSBzcGVjaWZpYyB0eXBlIHRvIGJlIGRlZmluZWQsIHRoZW4gd2Ugc2hvdWxkIGRl ZmluZSB0aGF0IHR5cGUgaW4gdGhlIHNwZWMgcmF0aGVyIHRoYW4gcmVseSBvbiBhbiBpbnRlcnBy ZXRhdGlvbiBvZiB0aGUgImlzcy1zdWIiIHR5cGUsIHNpbmNlIHRoYXQgaW50ZXJwcmV0YXRpb24g Y2FuIGNhdXNlIGluY29tcGF0aWJpbGl0aWVzLg0KDQpJbiB0aGlzIHNwZWNpZmljIGNhc2UgaG93 ZXZlciBJIGZlZWwgdGhhdCB0aGUgdXNlIGNhc2VzIG91dGxpbmVkIGluIG15IHByZXZpb3VzIGVt YWlsIGNhbiBiZSBhY2hpZXZlZCAod2l0aCBsaW1pdGF0aW9ucykgdXNpbmcgdGhlIGR1cmFibGUg c3ViamVjdCB0eXBlcyBzdWNoIGFzIGVtYWlsLiBJJ2QgbGlrZSB0aGUgbWVtYmVycyBvZiB0aGUg U1NFIHdvcmtpbmcgZ3JvdXAgdG8gY2hpbWUgaW4gKHNpbmNlIHRoYXQgaXMgd2hlcmUgdGhpcyBn b3QgYWRkZWQpLCBvciB3ZSBjYW4gZHJvcCB0aGUgU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlw ZS4NCg0KT24gVHVlLCBKdWwgMTQsIDIwMjAgYXQgNDowOSBQTSBCcmlhbiBDYW1wYmVsbCA8YmNh bXBiZWxsQHBpbmdpZGVudGl0eS5jb208bWFpbHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29t Pj4gd3JvdGU6DQorIDEgdG8gd2hhdCBZYXJvbiBpcyBzYXlpbmcgaGVyZS4gSSdkIGluY2x1ZGUg YWxzbyB0aGUgImlzcy1zdWIiIHN1YmplY3QgaWRlbnRpZmllciB0eXBlIGh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmllcnMtMDUj c2VjdGlvbi0zLjQgYXMgYWxyZWFkeSBoYXZpbmcgc2VtYW50aWNzIGNvdmVyaW5nIHdoYXQncyBk ZXNjcmliZWQgaW4gdGhlIElEIFRva2VuIENsYWltcyBTdWJqZWN0IElkZW50aWZpZXIgVHlwZSBp biB0aGUgUklTQyBkb2N1bWVudCByZWZlcmVuY2VkLiBBbmQgYWxsIHRob3NlIHRoaW5ncyByZXBy ZXNlbnQgYSBkdXJhYmxlIHN1YmplY3QgcmF0aGVyIHRoYW4gYSBzZXNzaW9uLCB3aGljaCBzdHJp a2VzIG1lIGFzIGFwcHJvcHJpYXRlIGZvciBhIGRvY3VtZW50IHRoYXQgZGVzY3JpYmVzIGlkZW50 aWZ5aW5nIHN1YmplY3RzLiBBIFNBTUwgYXNzZXJ0aW9uIElELCBob3dldmVyLCB3aGljaCBpcyBh biBpZGVudGlmaWVyIG9mIGFuIFhNTCBkb2N1bWVudCB0aGF0IGlzIG9ubHkgaW5kaXJlY3RseSBy ZWxhdGVkIHRvIGEgc2Vzc2lvbiBieSBhbiBhc3NvY2lhdGlvbiB0aGF0IGxpa2VseSBpc24ndCBt YWludGFpbmVkLCBkb2VzIG5vdCBzZWVtIGFwcHJvcHJpYXRlIGFzIGEgInN1YmplY3QgaWRlbnRp ZmllciIuDQoNCk9uIFR1ZSwgSnVsIDE0LCAyMDIwIGF0IDQ6MDEgUE0gWWFyb24gU2hlZmZlciA8 eWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20+PiB3cm90 ZToNCkhpIEF0dWwsDQoNClRoZSBJRCBUb2tlbiBzdWJqZWN0IHR5cGUsIGFzIGRlc2NyaWJlZCBp biB0aGUgZG9jdW1lbnQgeW91IGFyZSByZWZlcmVuY2luZywgZG9lcyBub3QgYWRkIGFueSBzZW1h bnRpY3MsIGNvbXBhcmVkIHRvIGEg4oCccGhvbmUgbnVtYmVy4oCdIG9yIOKAnGVtYWls4oCdIHN1 YmplY3QgdHlwZS4gU28gSSBkb27igJl0IHNlZSB0aGUgdmFsdWUgaW4gYWRkaW5nIGl0Lg0KDQpJ biBhZGRpdGlvbiwgaXQgZG9lcyBub3QsIGFjdHVhbGx5LCBkZXNjcmliZSBhbiBJRCBUb2tlbi4g SW4gZmFjdCB0aGUgdGV4dCBpcyB2ZXJ5IGNsZWFyIHRoYXQgaXQgZGVzY3JpYmVzIGEg4oCcc3Vi amVjdOKAnSAoYSBkdXJhYmxlIGVudGl0eSkgcmF0aGVyIHRoYW4gYSBzZXNzaW9uLCBhbmQgZG9l cyBpdCBieSBjaXRpbmcgdmFyaW91cyBjbGFpbXMgaW5jbHVkZWQgaW4gdGhlIElEIHRva2VuLiBT byBhcyBhIHN1YmplY3QgaWRlbnRpZmllciB0eXBlLCBpdCBpcyBub3QgYXQgYWxsIGVxdWl2YWxl bnQgdG8gYSBTQU1MIGFzc2VydGlvbi4NCg0KQXMgdG8gdGhlIFNBTUwgQXNzZXJ0aW9uIHN1Ympl Y3QgdHlwZSwgSSB0aGluayB0aGVzZSB1c2UgY2FzZXMgY291bGQgYmUgYWRkcmVzc2VkIGJ5IGFk ZGluZyBpbmZvcm1hdGlvbiB0byB0aGUgZXZlbnQuDQoNClRoYW5rcywNCiAgICAgICAgICAgICAg ICBZYXJvbg0KDQpGcm9tOiBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0dWxzaGlAZ29vZ2xlLmNv bTxtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tPj4NCkRhdGU6IFR1ZXNkYXksIEp1bHkgMTQs IDIwMjAgYXQgMjM6MjYNClRvOiBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb208 bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbT4+DQpDYzogQ2hyaXMgUGhpbGxpcHMgPENocmlz LlBoaWxsaXBzQGNhbmFyaWUuY2E8bWFpbHRvOkNocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E+Piwg ImlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4iIDxpZC1ldmVudEBp ZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtJZC1ldmVu dF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZQ0KDQpIaSBZYXJvbiwNClRoZXJlIGFyZSBh IGZldyBTU0UgdXNlIGNhc2VzIHdoZXJlIHRoZSBldmVudHMgYXJlIGFib3V0IGEgc3BlY2lmaWMg c2luZ2xlIHNpZ24tb24gc2Vzc2lvbi4gWW91J3JlIHJpZ2h0IHRoYXQgdGhpcyBzaG91bGQgbm90 IGJlIGxpbWl0ZWQgdG8gU0FNTC4gVGhlIFJJU0MgcHJvZmlsZSBvZiBTRVRzIChiYXNlZCBvbiB3 aGljaCB3ZSBhcmUgZG9pbmcgdGhlIFNTRSB3b3JrKSBoYWQgdGhlIElEIFRva2VuIHN1YmplY3Qg aWRlbnRpZmllciB0eXBlLCB3aGljaCBmb3Igc29tZSByZWFzb24gaXMgbWlzc2luZyBpbiB0aGlz IHNwZWMgKEkgZGlkIG5vdCByZWFsaXplIHVudGlsIG5vdykuIFRoZSBzcGVjaWZpYyBldmVudHMg dGhhdCBuZWVkIHRvIHJlZmVyIHRvIHNlc3Npb25zIGFyZToNCsK3ICAgICAgICAgSWRlbnRpdHkg cHJvdmlkZXIgY29udGV4dCBjaGFuZ2U6IFRoZSBjb25kaXRpb25zIHVuZGVyIHdoaWNoIGEgU0FN TCBhc3NlcnRpb24gb3IgT0lEQyB0b2tlbiB3YXMgZ2VuZXJhdGVkIGFyZSBubyBsb25nZXIgdmFs aWQuIFRoaXMgY2FuIGJlIGR1ZSB0byB2YXJpb3VzIHRoaW5ncywgaW5jbHVkaW5nIGEgcGFzc3dv cmQgY2hhbmdlLg0KwrcgICAgICAgICBTZXNzaW9uIHByb3BlcnR5IGNoYW5nZTogQSBzZXNzaW9u IGhhcyBiZWVuIGRldGVybWluZWQgdG8gaGF2ZSBiZWVuIGNvbXByb21pc2VkDQrCtyAgICAgICAg IFJldm9jYXRpb246IFRoZSBpc3N1ZXIgb2YgdGhlIHNpbmdsZSBzaWduLW9uIFNBTUwgYXNzZXJ0 aW9uIG9yIElEIFRva2VuIG5lZWRzIHRvIGJlIHJldm9rZQ0KSSBjYW4gYWxzbyBhZGQgdGhlIElE IFRva2VuIGNsYWltIGZyb20gdGhlIFJJU0MgcHJvZmlsZTxodHRwczovL2JpdGJ1Y2tldC5vcmcv b3BlbmlkL3Jpc2Mvc3JjL21hc3Rlci9vcGVuaWQtcmlzYy1wcm9maWxlLTFfMC50eHQjbGluZXMt MjUwPiB0byBteSBwdWxsIHJlcXVlc3QuDQoNClRoYW5rcywNCkF0dWwNCg0KDQpPbiBUdWUsIEp1 bCAxNCwgMjAyMCBhdCAxMjozMiBQTSBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5j b208bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbT4+IHdyb3RlOg0KSSBuZWVkIGEgbG90IG1v cmUgY29udGV4dCBoZXJlLiBTbyBmYXIsIHN1YmplY3QgSURzIGhhdmUgZGVub3RlZCBkdXJhYmxl IGVudGl0aWVzLCBzdWNoIGFzIGVtYWlsIGFkZHJlc3NlcywgcGhvbmUgbnVtYmVycywgYWNjb3Vu dC4gVGhpcyBpcyBhZGRpbmcgYSBzdWJqZWN0IElEIHRoYXQgZGVub3RlcyBhbiBlcGhlbWVyYWwg ZW50aXR5LCBiYXNpY2FsbHkgc2ltaWxhciB0byBhIHNlc3Npb24gSUQuIFRoaXMgbG9va3Mgd2Vp cmQgZnJvbSBhbiBhcmNoaXRlY3R1cmFsIHBvaW50IG9mIHZpZXcsIGFuZCBhbHNvIGJlZ3MgdGhl IHF1ZXN0aW9uLCB3aHkgc3BlY2lmaWNhbGx5IFNBTUwgYW5kIG5vdCBvdGhlciBzZXNzaW9uIHR5 cGVzLg0KDQpUaGFua3MsDQogICAgICAgICAgICAgICAgWWFyb24NCg0KRnJvbTogSWQtZXZlbnQg PGlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5v cmc+PiBvbiBiZWhhbGYgb2YgQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpPTQwZ29vZ2xl LmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmlldGYuLm9yZz4+ DQpEYXRlOiBUdWVzZGF5LCBKdWx5IDE0LCAyMDIwIGF0IDAwOjE0DQpUbzogQ2hyaXMgUGhpbGxp cHMgPENocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E8bWFpbHRvOkNocmlzLlBoaWxsaXBzQGNhbmFy aWUuY2E+Pg0KQ2M6ICJpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+ IiA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6 IFJlOiBbSWQtZXZlbnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGUNCg0KSnVzdCBjbGFy aWZ5aW5nIHRoZSBwcm9wb3NhbCBhcyBpdCBzdGFuZHMgdG9kYXkgKGJlZm9yZSBpbmNvcnBvcmF0 aW5nIENocmlzJ3MgaW5wdXQpOg0KVGhlIGZvbGxvd2luZyBzZWN0aW9uIHNob3VsZCBiZSBhZGRl ZCBpbiB0aGUgIlN1YmplY3QgSWRlbnRpZmllciBUeXBlcyIgc2VjdGlvbjoNCjQuOS4gIFNBTUwg U3ViamVjdCBJZGVudGlmaWVyIFR5cGUNCg0KICAgVGhlIFNBTUwgW1NBTUwuUkVGXSBTdWJqZWN0 IElkZW50aWZpZXIgVHlwZSBkZXNjcmliZXMgYSBzdWJqZWN0IGJ5DQogICB0aGUgYXNzZXJ0aW9u IGlkZW50aWZpZXIgaW4gdGhlIFNBTUwgYXNzZXJ0aW9uIHRoYXQgd2FzIHVzZWQgdG8NCiAgIGNv bnZleSB0aGUgc3ViamVjdCdzIGluZm9ybWF0aW9uIHRvIHRoZSBSZWNlaXZlci4gIFN1YmplY3QN CiAgIElkZW50aWZpZXJzIG9mIHRoaXMgdHlwZSBNVVNUIGNvbnRhaW4gYW4gYCBhc3NlcnRpb25f aWQiY2xhaW0uICBUaGUNCiAgIHZhbHVlIG9mIHRoaXMgY2xhaW0gaXMgYSBzdHJpbmcgdGhhdCBp cyBlcXVhbCB0byB0aGUgQXNzZXJ0aW9uDQogICBJZGVudGlmaWVyIGluIHRoZSBTQU1MIGFzc2Vy dGlvbi4gIFRoZSBTQU1MIFN1YmplY3QgSWRlbnRpZmllciBUeXBlDQogICBpcyBpZGVudGlmaWVk IGJ5IHRoZSBuYW1lICJzYW1sYC4NCg0KICAgQmVsb3cgaXMgYSBub24tbm9ybWF0aXZlIGV4YW1w bGUgU3ViamVjdCBJZGVudGlmaWVyIGZvciB0aGUgU0FNTA0KICAgU3ViamVjdCBJZGVudGlmaWVy IFR5cGU6DQoNCiAgIHsNCiAgICAgInN1YmplY3RfdHlwZSI6ICJzYW1sIiwNCiAgICAgImFzc2Vy dGlvbl9pZCI6ICJfZjU1MWQ4ODk2M2FiNGUzZGVjYjdjZmU4ZjRkY2MzZjUiLA0KICAgfQ0KDQog ICAgIEZpZ3VyZSA4OiBFeGFtcGxlOiBTdWJqZWN0IElkZW50aWZpZXIgZm9yIFNBTUwgU3ViamVj dCBJZGVudGlmaWVyDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFR5cGUuDQoN Cg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMToyMiBQTSBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0 dWx0dWxzaGlAZ29vZ2xlLmNvbTxtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tPj4gd3JvdGU6 DQpIaSBDaHJpcywNCkkgd2FzIHByb3Bvc2luZyB1c2luZyB0aGUgImFzc2VydGlvbiBpZCIgKFNB TUwgQ29yZTxodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9zZWN1cml0eS9zYW1sL3YyLjAvc2Ft bC1jb3JlLTIuMC1vcy5wZGY+IHNwZWMsIGxpbmUgNTUzKSBpbiB0aGUgcHJvcG9zYWwsIG5vdCB0 aGUgInN1YmplY3QtaWQiIGFzIGRlZmluZWQgaW4gU0FNTCAoc3BlYyBzZWN0aW9uIDMuMykuIFRo ZSBtYWluIHJlYXNvbiB3YXMgdG8gYmUgYWJsZSB0byByZWZlciB0byBhIHNlc3Npb24gdGhhdCB3 YXMgZXN0YWJsaXNoZWQgdXNpbmcgYSBzcGVjaWZpYyBhc3NlcnRpb24uIElmIGl0J3MgdXNlZnVs LCB3ZSBjb3VsZCBwZXJoYXBzIGV4dGVuZCB0aGUgU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlw ZSBpbiB0aGlzIHNwZWMgdG8gaW5jbHVkZSBlaXRoZXIgdGhlIGFzc2VydGlvbl9pZCBvciB0aGUg c3ViamVjdF9pZCBjbGFpbS4NCg0KVGhhbmtzLA0KQXR1bA0KDQoNCk9uIE1vbiwgSnVsIDEzLCAy MDIwIGF0IDEwOjMwIEFNIENocmlzIFBoaWxsaXBzIDxDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNh PG1haWx0bzpDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPj4gd3JvdGU6DQpIaS4NClF1aWV0IGx1 cmtlciBvYnNlcnZpbmcuLg0KVGhhbmtzIGZvciBjb25zaWRlciB0aGUgU0FNTCBlbGVtZW50cy4u DQoNCkF0dWwsIGFyZSB5b3UgcmVmZXJyaW5nIHRvIHRoZSBhY3R1YWwgc2Vzc2lvbiBpZGVudGlm aWVyIHRoYXQgc29tZW9uZSBtYXkgaGF2ZSB3aGVyZSB0aGUgU3ViamVjdC1JZCB3YXMgZXhjaGFu Z2VkIE9SIHRoZSBhY3R1YWwgU3ViamVjdC1pZCBpdHNlbGYgaW4geW91ciByZWZlcmVuY2UgaW4g dGhlIHByb3Bvc2FsIHdpdGggdGhlIGdpdGh1YiBsaW5rPw0KDQpJ4oCZbSB0cnlpbmcgdG8gc3F1 YXJlIHdoYXQgSSBzZWUgb24gdGhlIGdpdCBkZWx0YSBvbiBsaW5lIDI5NC0yOTYgaW4gaHR0cHM6 Ly9naXRodWIuLi5jb20vcmljaGFubmEvc2VjZXZlbnQvcHVsbC8xL2NvbW1pdHMvYjIwYjY2OTJl YjUwNjI4OTI3NDc2Y2E3OGY5YmUwNzdhY2U4ODk5NDxodHRwczovL2dpdGh1Yi5jb20vcmljaGFu bmEvc2VjZXZlbnQvcHVsbC8xL2NvbW1pdHMvYjIwYjY2OTJlYjUwNjI4OTI3NDc2Y2E3OGY5YmUw NzdhY2U4ODk5ND4NCg0KDQpBbmQgYSBTdWJqZWN0LWlkIGFzIHNob3duIGluIHRoZSBleGFtcGxl IGluIDMuMy4zIGhlcmU6IGh0dHBzOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9zZWN1cml0eS9zYW1s LXN1YmplY3QtaWQtYXR0ci92MS4wL2NzMDEvc2FtbC1zdWJqZWN0LWlkLWF0dHItdjEuMC1jczAx Lmh0bWwjX1RvYzUzNjA5NzIyOTxodHRwczovL2RvY3Mub2FzaXMtb3Blbi5vcmcvc2VjdXJpdHkv c2FtbC1zdWJqZWN0LWlkLWF0dHIvdjEuMC9jczAxL3NhbWwtc3ViamVjdC1pZC1hdHRyLXYxLi4w LWNzMDEuLmh0bWwjX1RvYzUzNjA5NzIyOT4NCg0KV2hhdCB5b3Ugb2ZmZXJlZCBpbiB0aGUgZXhh bXBsZSBpcyBub3QgYSBTdWJqZWN0LWlkICBwZXIgdGhlIE9BU0lTIFNBTUwgc3BlYyBhcyB3cml0 dGVuIGluIHNlY3Rpb24gMy4zLjENCg0KQW0gSSBtaXMtaW50ZXJwcmV0aW5nIHNvbWV0aGluZz8N Cg0KQw0KDQoNCkZyb206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPG1haWx0 bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPj4gb24gYmVoYWxmIG9mIEF0dWwgVHVsc2hpYmFn d2FsZSA8YXR1bHR1bHNoaT00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc8bWFpbHRvOjQwZ29v Z2xlLmNvbUBkbWFyYy5pZXRmLm9yZz4+DQpEYXRlOiBNb25kYXksIEp1bHkgMTMsIDIwMjAgYXQg MTI6MTcgUE0NClRvOiAiaWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3Jn PiIgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0 OiBbSWQtZXZlbnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGUNCg0KSGkgYWxsLA0KQmFz ZWQgb24gdGhlIGRpc2N1c3Npb25zIGluIHRoZSBTU0Ugd29ya2luZyBncm91cCB3aXRoaW4gdGhl IE9wZW5JRCBGb3VuZGF0aW9uLCB3ZSB3b3VsZCBsaWtlIHRvIHByb3Bvc2UgdGhhdCB0aGUgc3Vi amVjdCBpZGVudGlmaWVyIHNwZWNpZmljYXRpb24gaW5jbHVkZSBhIFNBTUwgc3ViamVjdCBpZGVu dGlmaWVyIHR5cGUuIFRoaXMgaXMgc28gdGhhdCBzZXNzaW9ucyBlc3RhYmxpc2hlZCBhY3Jvc3Mg cGVlcnMgdXNpbmcgU0FNTCBtYXkgYmUgaWRlbnRpZmllZCBpbiBldmVudHMgdGhhdCBpbmNsdWRl IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIuDQoNCiBBIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIGhh cyBvbmx5IG9uZSBjbGFpbSB3aXRoaW4gaXQsIHRoZSBhc3NlcnRpb24gaWQgb2YgdGhlIFNBTUwg YXNzZXJ0aW9uIHVzZWQgdG8gZXN0YWJsaXNoIHRoZSBzaW5nbGUgc2lnbi1vbiBzZXNzaW9uLg0K DQpUaGlzIGNoYW5nZSBpcyBhbHNvIGluY2x1ZGVkIGluIG15IHByb3Bvc2FsIGhlcmU8aHR0cHM6 Ly9naXRodWIuY29tL3JpY2hhbm5hL3NlY2V2ZW50L3B1bGwvMT4uDQoNClRoYW5rcywNCkF0dWwN Cg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2 ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYu b3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18gSWQtZXZlbnQgbWFp bGluZyBsaXN0IElkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4gaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlz dA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQpDT05GSURFTlRJQUxJVFkg Tk9USUNFOiBUaGlzIGVtYWlsIG1heSBjb250YWluIGNvbmZpZGVudGlhbCBhbmQgcHJpdmlsZWdl ZCBtYXRlcmlhbCBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSBpbnRlbmRlZCByZWNpcGllbnQocyku IEFueSByZXZpZXcsIHVzZSwgZGlzdHJpYnV0aW9uIG9yIGRpc2Nsb3N1cmUgYnkgb3RoZXJzIGlz IHN0cmljdGx5IHByb2hpYml0ZWQuLiAgSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBjb21tdW5p Y2F0aW9uIGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYnkg ZS1tYWlsIGFuZCBkZWxldGUgdGhlIG1lc3NhZ2UgYW5kIGFueSBmaWxlIGF0dGFjaG1lbnRzIGZy b20geW91ciBjb21wdXRlci4gVGhhbmsgeW91Lg0K --_000_C62035F9E7D84CA489A32BE6DE941CE3amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <7C9F9988A869764DB6A2B51E9EE49958@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiTVMgTWluY2hvIjsNCglwYW5vc2UtMToyIDIgNiA5IDQgMiA1IDgg MyA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3Nl LTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGli cmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250 LWZhbWlseToiXEBNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTotYXBwbGUtc3lzdGVtOw0KCXBhbm9zZS0xOjIgMTEg NiA0IDIgMiAyIDIgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwg bGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRv bTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3Jp dHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnNwYW4u RW1haWxTdHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERl ZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9 DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGlu IDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlv bjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6NTMy MzA4OTM5Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxMjE4MzMxMDA4O30NCkBsaXN0IGwwOmxl dmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpT eW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6 bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0Kb2wN Cgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9z dHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGUgUklTQyBQcm9maWxl4oCZcyDigJxJRCBUb2tlbiBDbGFpbXPigJ0gdHlwZSBkb2VzIG5vdCBp ZGVudGlmeSBhIHN1YmplY3QgdGhhdCBpcyBhbiBJRCBUb2tlbiwgaXQgaWRlbnRpZmllcyBhIHN1 YmplY3QgdGhhdCB3YXMgdGhlIHN1YmplY3Qgb2YgYW4gSUQgVG9rZW4uIEl0IHdhcyBpbnRlbmRl ZCBmb3IgY2FzZXMgd2hlcmUgdGhlIE9QIHNlbnQgbXVsdGlwbGUgaWRlbnRpZmllcnMgb2YgZGlm ZmVyZW50IHR5cGVzDQogaW4gdGhlIElEIFRva2VuIChlLmcuLCBpc3MmIzQzO3N1YiBhbmQgZW1h aWwpLCBhbmQgZG9lcyBub3Qga25vdyB3aGljaCBvZiB0aGVtIHRoZSBjbGllbnQgd2lsbCByZWNv Z25pemUgKHllcywgdGhlDQo8aT5zaG91bGQ8L2k+IHVzZSBpc3MmIzQzO3N1Yjsgbm8sIHRoZXkg ZG9lc27igJl0IGFsd2F5cyBkbyBzbykuIFRoaXMgdHlwZSB3YXMgcmVwbGFjZWQgaW4gZHJhZnQt aWV0Zi1zZWNldmVudC1zdWJqZWN0LWlkZW50aWZpZXJzLTAzIHdpdGggdGhlIOKAnGFsaWFzZXPi gJ0gdHlwZSwgd2hpY2ggaXMgYSBnZW5lcmFsIHNvbHV0aW9uIHRvIHRoaXMgcHJvYmxlbSB0aGF0 IGlzIG5vdCBkZWZpbmVkIGluIHRlcm1zIG9mIG9uZSBwYXJ0aWN1bGFyIHVzZSBjYXNlIChpLmUu LA0KIElEIFRva2VucykuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBPSURGIFNTRSB3b3Jr aW5nIGdyb3Vw4oCZcyA8YSBocmVmPSJodHRwczovL29wZW5pZC5uZXQvc3BlY3Mvb2F1dGgtZXZl bnQtdHlwZXMtMV8wLUlEMS5odG1sI3JmYy5zZWN0aW9uLjIuMSI+DQpPQXV0aCBFdmVudCBUeXBl cyBkcmFmdDwvYT4gZGVmaW5lcyBhIOKAnG9hdXRoX3Rva2Vu4oCdIHR5cGUgdGhhdCBpZGVudGlm aWVzIGEgc3ViamVjdCB0aGF0IGlzIGFuIE9BdXRoIDIuMCB0b2tlbiwgYW5kIGRvZXMgc28gdXNp bmcgZWl0aGVyIHRoZSBmdWxsIG9yIHBhcnRpYWwgcGxhaW4gdGV4dCB2YWx1ZSBvZiB0aGUgdG9r ZW4sIG9yIGEgaGFzaCBvZiB0aGUgdG9rZW4uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl0IGlz IHBlcmZlY3RseSBmaW5lIGZvciBhIHRva2VuIHRvIGJlIHRoZSBzdWJqZWN0IG9mIGEgc2VjdXJp dHkgZXZlbnQuDQo8YSBocmVmPSJodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9yZmMvcmZjODQx Ny5odG1sI3NlY3Rpb24tMi4yIj44NDE3PC9hPiBhY3R1YWxseSBpbmNsdWRlcyB0aGUgZm9sbG93 aW5nIGFzIGFuIGV4YW1wbGUgb2YgYSBwb3NzaWJsZSB2YWx1ZSBmb3IgdGhlIOKAnHN1YuKAnSBj bGFpbTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+KiZuYnNwOyBhIHRva2VuIGlkZW50aWZp ZXIgKGUuZy4gJnF1b3Q7anRpJnF1b3Q7KSBmb3IgYSByZXZva2VkIHRva2VuLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0 Ij7igJM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdCI+QW5uYWJlbGxlIEJhY2ttYW4gKHNoZS9oZXIpPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQiPkFXUyBJZGVudGl0eTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48YSBocmVmPSJodHRw czovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5LyI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwNTYzQzEi Pmh0dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzoz LjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZy b206DQo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNr Ij5JZC1ldmVudCAmbHQ7aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyZndDsgb24gYmVoYWxmIG9m IEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7YXR1bHR1bHNoaT00MGdvb2dsZS5jb21AZG1hcmMuaWV0 Zi5vcmcmZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlR1ZXNkYXksIEp1bHkgMTQsIDIwMjAgYXQgNDoz MiBQTTxicj4NCjxiPlRvOiA8L2I+QnJpYW4gQ2FtcGJlbGwgJmx0O2JjYW1wYmVsbEBwaW5naWRl bnRpdHkuY29tJmd0Ozxicj4NCjxiPkNjOiA8L2I+WWFyb24gU2hlZmZlciAmbHQ7eWFyb25mLmll dGZAZ21haWwuY29tJmd0OywgQ2hyaXMgUGhpbGxpcHMgJmx0O0NocmlzLlBoaWxsaXBzQGNhbmFy aWUuY2EmZ3Q7LCAmcXVvdDtpZC1ldmVudEBpZXRmLm9yZyZxdW90OyAmbHQ7aWQtZXZlbnRAaWV0 Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJFOiBbRVhURVJOQUxdIFtJZC1ldmVudF0g U0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9y bWFsVGFibGUiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0 aD0iNjIyIiBzdHlsZT0id2lkdGg6NDY2LjVwdDttYXJnaW4tbGVmdDouNWluO2JvcmRlci1jb2xs YXBzZTpjb2xsYXBzZSI+DQo8dGJvZHk+DQo8dHIgc3R5bGU9ImhlaWdodDoxNS4yNXB0Ij4NCjx0 ZCB3aWR0aD0iNjIyIiB2YWxpZ249InRvcCIgc3R5bGU9IndpZHRoOjQ2Ni41cHQ7Ym9yZGVyOnNv bGlkICNFRDdEMzEgMS41cHQ7cGFkZGluZzowaW4gNS40cHQgMGluIDUuNHB0O2hlaWdodDoxNS4y NXB0Ij4NCjxwPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkZGOTkiPkNBVVRJT048 L3NwYW4+PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQ6I0ZGRkY5 OSI+OiBUaGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRp b24uIERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcw0KIHlvdSBj YW4gY29uZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+SU1PIGlmIHdlIGhhdmUgYSBjb21tb24gZW5vdWdoIHVzZS1jYXNl IHRoYXQgcmVxdWlyZXMgYSBzcGVjaWZpYyB0eXBlIHRvIGJlIGRlZmluZWQsIHRoZW4gd2Ugc2hv dWxkIGRlZmluZSB0aGF0IHR5cGUgaW4gdGhlIHNwZWMgcmF0aGVyIHRoYW4gcmVseSBvbiBhbiBp bnRlcnByZXRhdGlvbiBvZiB0aGUgJnF1b3Q7aXNzLXN1YiZxdW90OyB0eXBlLCBzaW5jZSB0aGF0 IGludGVycHJldGF0aW9uDQogY2FuIGNhdXNlIGluY29tcGF0aWJpbGl0aWVzLiA8bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+SW4gdGhpcyBzcGVjaWZpYyBjYXNlIGhvd2V2 ZXIgSSBmZWVsIHRoYXQgdGhlIHVzZSBjYXNlcyBvdXRsaW5lZCBpbiBteSBwcmV2aW91cyBlbWFp bCBjYW4gYmUgYWNoaWV2ZWQgKHdpdGggbGltaXRhdGlvbnMpIHVzaW5nIHRoZSBkdXJhYmxlIHN1 YmplY3QgdHlwZXMgc3VjaCBhcyBlbWFpbC4gSSdkIGxpa2UgdGhlIG1lbWJlcnMgb2YgdGhlIFNT RSB3b3JraW5nIGdyb3VwDQogdG8gY2hpbWUgaW4gKHNpbmNlIHRoYXQgaXMgd2hlcmUgdGhpcyBn b3QgYWRkZWQpLCBvciB3ZSBjYW4gZHJvcCB0aGUgU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlw ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5PbiBUdWUs IEp1bCAxNCwgMjAyMCBhdCA0OjA5IFBNIEJyaWFuIENhbXBiZWxsICZsdDs8YSBocmVmPSJtYWls dG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20iPmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29t PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4m IzQzOyAxIHRvIHdoYXQgWWFyb24gaXMgc2F5aW5nIGhlcmUuIEknZCBpbmNsdWRlIGFsc28gdGhl ICZxdW90O2lzcy1zdWImcXVvdDsgc3ViamVjdCBpZGVudGlmaWVyIHR5cGUNCjxhIGhyZWY9Imh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRl bnRpZmllcnMtMDUjc2VjdGlvbi0zLjQiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmllcnMtMDUj c2VjdGlvbi0zLjQ8L2E+IGFzIGFscmVhZHkgaGF2aW5nIHNlbWFudGljcyBjb3ZlcmluZyB3aGF0 J3MgZGVzY3JpYmVkIGluIHRoZSBJRCBUb2tlbiBDbGFpbXMgU3ViamVjdCBJZGVudGlmaWVyIFR5 cGUgaW4gdGhlIFJJU0MgZG9jdW1lbnQgcmVmZXJlbmNlZC4gQW5kIGFsbCB0aG9zZSB0aGluZ3Mg cmVwcmVzZW50IGEgZHVyYWJsZQ0KIHN1YmplY3QgcmF0aGVyIHRoYW4gYSBzZXNzaW9uLCB3aGlj aCBzdHJpa2VzIG1lIGFzIGFwcHJvcHJpYXRlIGZvciBhIGRvY3VtZW50IHRoYXQgZGVzY3JpYmVz IGlkZW50aWZ5aW5nIHN1YmplY3RzLiBBIFNBTUwgYXNzZXJ0aW9uIElELCBob3dldmVyLCB3aGlj aCBpcyBhbiBpZGVudGlmaWVyIG9mIGFuIFhNTCBkb2N1bWVudCB0aGF0IGlzIG9ubHkgaW5kaXJl Y3RseSByZWxhdGVkIHRvIGEgc2Vzc2lvbiBieSBhbiBhc3NvY2lhdGlvbiB0aGF0IGxpa2VseQ0K IGlzbid0IG1haW50YWluZWQsIGRvZXMgbm90IHNlZW0gYXBwcm9wcmlhdGUgYXMgYSAmcXVvdDtz dWJqZWN0IGlkZW50aWZpZXImcXVvdDsuIDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPk9uIFR1ZSwgSnVsIDE0LCAyMDIwIGF0IDQ6MDEgUE0gWWFyb24gU2hl ZmZlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPnlhcm9uZi5pZXRmQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQu OHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpIaSBBdHVsLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpUaGUgSUQgVG9rZW4gc3Vi amVjdCB0eXBlLCBhcyBkZXNjcmliZWQgaW4gdGhlIGRvY3VtZW50IHlvdSBhcmUgcmVmZXJlbmNp bmcsIGRvZXMgbm90IGFkZCBhbnkgc2VtYW50aWNzLCBjb21wYXJlZCB0byBhIOKAnHBob25lIG51 bWJlcuKAnSBvciDigJxlbWFpbOKAnSBzdWJqZWN0IHR5cGUuIFNvIEkgZG9u4oCZdCBzZWUgdGhl IHZhbHVlIGluIGFkZGluZyBpdC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KSW4gYWRkaXRpb24sIGl0IGRvZXMgbm90LCBh Y3R1YWxseSwgZGVzY3JpYmUgYW4gSUQgVG9rZW4uIEluIGZhY3QgdGhlIHRleHQgaXMgdmVyeSBj bGVhciB0aGF0IGl0IGRlc2NyaWJlcyBhIOKAnHN1YmplY3TigJ0gKGEgZHVyYWJsZSBlbnRpdHkp IHJhdGhlciB0aGFuIGEgc2Vzc2lvbiwgYW5kIGRvZXMgaXQgYnkgY2l0aW5nIHZhcmlvdXMgY2xh aW1zIGluY2x1ZGVkIGluIHRoZSBJRCB0b2tlbi4gU28gYXMgYSBzdWJqZWN0IGlkZW50aWZpZXIg dHlwZSwNCiBpdCBpcyBub3QgYXQgYWxsIGVxdWl2YWxlbnQgdG8gYSBTQU1MIGFzc2VydGlvbi48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4N CiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 Oi41aW4iPg0KQXMgdG8gdGhlIFNBTUwgQXNzZXJ0aW9uIHN1YmplY3QgdHlwZSwgSSB0aGluayB0 aGVzZSB1c2UgY2FzZXMgY291bGQgYmUgYWRkcmVzc2VkIGJ5IGFkZGluZyBpbmZvcm1hdGlvbiB0 byB0aGUgZXZlbnQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDouNWluIj4NClRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyBZYXJvbjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItdG9wOnNvbGlkIHdpbmRvd3RleHQgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4g MGluIDBpbjtib3JkZXItY29sb3I6Y3VycmVudGNvbG9yIGN1cnJlbnRjb2xvciI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8Yj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+QXR1bCBUdWxzaGliYWd3YWxlICZsdDs8YSBocmVm PSJtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+YXR1bHR1bHNo aUBnb29nbGUuY29tPC9hPiZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+VHVlc2RheSwgSnVseSAxNCwg MjAyMCBhdCAyMzoyNjxicj4NCjxiPlRvOiA8L2I+WWFyb24gU2hlZmZlciAmbHQ7PGEgaHJlZj0i bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnlhcm9uZi5pZXRm QGdtYWlsLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6IDwvYj5DaHJpcyBQaGlsbGlwcyAmbHQ7PGEg aHJlZj0ibWFpbHRvOkNocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2EiIHRhcmdldD0iX2JsYW5rIj5D aHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPC9hPiZndDssICZxdW90OzxhIGhyZWY9Im1haWx0bzpp ZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3JnPC9hPiZx dW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFu ayI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW0lk LWV2ZW50XSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4i Pg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpIaSZuYnNwO1lhcm9uLDxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NClRoZXJlIGFy ZSBhIGZldyBTU0UgdXNlIGNhc2VzIHdoZXJlIHRoZSBldmVudHMgYXJlIGFib3V0IGEgc3BlY2lm aWMgc2luZ2xlIHNpZ24tb24gc2Vzc2lvbi4gWW91J3JlIHJpZ2h0IHRoYXQgdGhpcyBzaG91bGQg bm90IGJlIGxpbWl0ZWQgdG8gU0FNTC4gVGhlIFJJU0MgcHJvZmlsZSBvZiBTRVRzIChiYXNlZCBv biB3aGljaCB3ZSBhcmUgZG9pbmcgdGhlIFNTRSB3b3JrKSBoYWQgdGhlIElEIFRva2VuIHN1Ympl Y3QgaWRlbnRpZmllciB0eXBlLCB3aGljaA0KIGZvciBzb21lIHJlYXNvbiBpcyBtaXNzaW5nIGlu IHRoaXMgc3BlYyAoSSBkaWQgbm90IHJlYWxpemUgdW50aWwgbm93KS4gVGhlIHNwZWNpZmljIGV2 ZW50cyB0aGF0IG5lZWQgdG8gcmVmZXIgdG8gc2Vzc2lvbnMgYXJlOjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO3Rl eHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQo8IVtpZiAhc3VwcG9y dExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpTeW1ib2wi PjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsK3PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQg JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5JZGVu dGl0eSBwcm92aWRlciBjb250ZXh0IGNoYW5nZTogVGhlIGNvbmRpdGlvbnMgdW5kZXIgd2hpY2gg YSBTQU1MIGFzc2VydGlvbiBvciBPSURDIHRva2VuIHdhcyBnZW5lcmF0ZWQgYXJlIG5vIGxvbmdl ciZuYnNwO3ZhbGlkLiBUaGlzIGNhbiBiZSBkdWUgdG8gdmFyaW91cyB0aGluZ3MsIGluY2x1ZGlu ZyBhIHBhc3N3b3JkIGNoYW5nZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwx IGxmbzEiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6U3ltYm9sIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7Ctzxz cGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFu Pjwvc3Bhbj48IVtlbmRpZl0+U2Vzc2lvbiBwcm9wZXJ0eSBjaGFuZ2U6IEEgc2Vzc2lvbiBoYXMg YmVlbiBkZXRlcm1pbmVkIHRvIGhhdmUgYmVlbiBjb21wcm9taXNlZDxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVp bjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpTeW1ib2wiPjxzcGFuIHN0eWxlPSJt c28tbGlzdDpJZ25vcmUiPsK3PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3 IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5SZXZvY2F0aW9uOiBUaGUgaXNz dWVyIG9mIHRoZSBzaW5nbGUgc2lnbi1vbiBTQU1MIGFzc2VydGlvbiBvciBJRCBUb2tlbiBuZWVk cyB0byBiZSByZXZva2U8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpJIGNhbiBhbHNvIGFkZCB0aGUgPGEgaHJlZj0iaHR0cHM6 Ly9iaXRidWNrZXQub3JnL29wZW5pZC9yaXNjL3NyYy9tYXN0ZXIvb3BlbmlkLXJpc2MtcHJvZmls ZS0xXzAudHh0I2xpbmVzLTI1MCIgdGFyZ2V0PSJfYmxhbmsiPg0KSUQgVG9rZW4gY2xhaW0gZnJv bSB0aGUgUklTQyBwcm9maWxlPC9hPiB0byBteSBwdWxsIHJlcXVlc3QuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KVGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0K QXR1bDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDouNWluIj4NCk9uIFR1ZSwgSnVsIDE0LCAyMDIwIGF0IDEyOjMyIFBNIFlhcm9uIFNoZWZmZXIg Jmx0OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5r Ij55YXJvbmYuaWV0ZkBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIHdp bmRvd3RleHQgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdDti b3JkZXItY29sb3I6Y3VycmVudGNvbG9yIGN1cnJlbnRjb2xvciBjdXJyZW50Y29sb3IgcmdiKDIw NCwyMDQsMjA0KSI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDouNWluIj4NCkkgbmVlZCBhIGxvdCBtb3JlIGNvbnRleHQgaGVyZS4gU28gZmFyLCBzdWJq ZWN0IElEcyBoYXZlIGRlbm90ZWQgZHVyYWJsZSBlbnRpdGllcywgc3VjaCBhcyBlbWFpbCBhZGRy ZXNzZXMsIHBob25lIG51bWJlcnMsIGFjY291bnQuIFRoaXMgaXMgYWRkaW5nIGEgc3ViamVjdCBJ RCB0aGF0IGRlbm90ZXMgYW4gZXBoZW1lcmFsIGVudGl0eSwgYmFzaWNhbGx5IHNpbWlsYXIgdG8g YSBzZXNzaW9uIElELiBUaGlzIGxvb2tzIHdlaXJkIGZyb20gYW4gYXJjaGl0ZWN0dXJhbA0KIHBv aW50IG9mIHZpZXcsIGFuZCBhbHNvIGJlZ3MgdGhlIHF1ZXN0aW9uLCB3aHkgc3BlY2lmaWNhbGx5 IFNBTUwgYW5kIG5vdCBvdGhlciBzZXNzaW9uIHR5cGVzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpUaGFua3MsPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgWWFyb24gPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgd2luZG93dGV4dCAx LjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluO2JvcmRlci1jb2xvcjpjdXJyZW50Y29sb3Ig Y3VycmVudGNvbG9yIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4N CjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5JZC1ldmVu dCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIj5pZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgb24gYmVoYWxmIG9mIEF0 dWwgVHVsc2hpYmFnd2FsZSAmbHQ7YXR1bHR1bHNoaT08YSBocmVmPSJtYWlsdG86NDBnb29nbGUu Y29tQGRtYXJjLmlldGYuLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjQwZ29vZ2xlLmNvbUBkbWFyYy5p ZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlR1ZXNkYXksIEp1bHkgMTQsIDIwMjAg YXQgMDA6MTQ8YnI+DQo8Yj5UbzogPC9iPkNocmlzIFBoaWxsaXBzICZsdDs8YSBocmVmPSJtYWls dG86Q2hyaXMuUGhpbGxpcHNAY2FuYXJpZS5jYSIgdGFyZ2V0PSJfYmxhbmsiPkNocmlzLlBoaWxs aXBzQGNhbmFyaWUuY2E8L2E+Jmd0Ozxicj4NCjxiPkNjOiA8L2I+JnF1b3Q7PGEgaHJlZj0ibWFp bHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5vcmc8 L2E+JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJl OiBbSWQtZXZlbnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGU8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCkp1c3QgY2xhcmlmeWluZyB0aGUgcHJvcG9z YWwgYXMgaXQgc3RhbmRzIHRvZGF5IChiZWZvcmUgaW5jb3Jwb3JhdGluZyBDaHJpcydzIGlucHV0 KTo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6LjVpbiI+DQpUaGUgZm9sbG93aW5nIHNlY3Rpb24gc2hvdWxkIGJlIGFkZGVkIGluIHRoZSAm cXVvdDtTdWJqZWN0IElkZW50aWZpZXIgVHlwZXMmcXVvdDsgc2VjdGlvbjo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWlu Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+NC45 LiZuYnNwOyBTQU1MIFN1YmplY3QgSWRlbnRpZmllciBUeXBlPGJyPg0KPGJyPg0KJm5ic3A7ICZu YnNwO1RoZSBTQU1MIFtTQU1MLlJFRl0gU3ViamVjdCBJZGVudGlmaWVyIFR5cGUgZGVzY3JpYmVz IGEgc3ViamVjdCBieTxicj4NCiZuYnNwOyAmbmJzcDt0aGUgYXNzZXJ0aW9uIGlkZW50aWZpZXIg aW4gdGhlIFNBTUwgYXNzZXJ0aW9uIHRoYXQgd2FzIHVzZWQgdG88YnI+DQombmJzcDsgJm5ic3A7 Y29udmV5IHRoZSBzdWJqZWN0J3MgaW5mb3JtYXRpb24gdG8gdGhlIFJlY2VpdmVyLiZuYnNwOyBT dWJqZWN0PGJyPg0KJm5ic3A7ICZuYnNwO0lkZW50aWZpZXJzIG9mIHRoaXMgdHlwZSBNVVNUIGNv bnRhaW4gYW4gYCBhc3NlcnRpb25faWQmcXVvdDtjbGFpbS4mbmJzcDsgVGhlPGJyPg0KJm5ic3A7 ICZuYnNwO3ZhbHVlIG9mIHRoaXMgY2xhaW0gaXMgYSBzdHJpbmcgdGhhdCBpcyBlcXVhbCB0byB0 aGUgQXNzZXJ0aW9uPGJyPg0KJm5ic3A7ICZuYnNwO0lkZW50aWZpZXIgaW4gdGhlIFNBTUwgYXNz ZXJ0aW9uLiZuYnNwOyBUaGUgU0FNTCBTdWJqZWN0IElkZW50aWZpZXIgVHlwZTxicj4NCiZuYnNw OyAmbmJzcDtpcyBpZGVudGlmaWVkIGJ5IHRoZSBuYW1lICZxdW90O3NhbWxgLjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDtCZWxvdyBpcyBhIG5vbi1ub3JtYXRpdmUgZXhhbXBsZSBTdWJqZWN0IElk ZW50aWZpZXIgZm9yIHRoZSBTQU1MPGJyPg0KJm5ic3A7ICZuYnNwO1N1YmplY3QgSWRlbnRpZmll ciBUeXBlOjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDt7PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJz cDsmcXVvdDtzdWJqZWN0X3R5cGUmcXVvdDs6ICZxdW90O3NhbWwmcXVvdDssPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsmcXVvdDthc3NlcnRpb25faWQmcXVvdDs6ICZxdW90O19mNTUxZDg4OTYz YWI0ZTNkZWNiN2NmZThmNGRjYzNmNSZxdW90Oyw8YnI+DQombmJzcDsgJm5ic3A7fTxicj4NCjxi cj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7RmlndXJlIDg6IEV4YW1wbGU6IFN1YmplY3QgSWRlbnRp ZmllciBmb3IgU0FNTCBTdWJqZWN0IElkZW50aWZpZXI8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO1R5cGUuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDouNWluIj4NCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDE6MjIgUE0gQXR1bCBUdWxzaGliYWd3 YWxlICZsdDs8YSBocmVmPSJtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tIiB0YXJnZXQ9Il9i bGFuayI+YXR1bHR1bHNoaUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0 b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWlu Ij4NCkhpIENocmlzLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDouNWluIj4NCkkgd2FzIHByb3Bvc2luZyB1c2luZyB0aGUgJnF1b3Q7YXNz ZXJ0aW9uIGlkJnF1b3Q7ICg8YSBocmVmPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9zZWN1 cml0eS9zYW1sL3YyLjAvc2FtbC1jb3JlLTIuMC1vcy5wZGYiIHRhcmdldD0iX2JsYW5rIj5TQU1M IENvcmU8L2E+IHNwZWMsIGxpbmUgNTUzKSBpbiB0aGUgcHJvcG9zYWwsIG5vdCB0aGUgJnF1b3Q7 c3ViamVjdC1pZCZxdW90OyBhcyBkZWZpbmVkIGluIFNBTUwgKHNwZWMgc2VjdGlvbiAzLjMpLiBU aGUgbWFpbiByZWFzb24NCiB3YXMgdG8gYmUgYWJsZSB0byByZWZlciB0byBhIHNlc3Npb24gdGhh dCB3YXMgZXN0YWJsaXNoZWQgdXNpbmcgYSBzcGVjaWZpYyBhc3NlcnRpb24uIElmIGl0J3MgdXNl ZnVsLCB3ZSBjb3VsZCBwZXJoYXBzIGV4dGVuZCB0aGUgU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIg dHlwZSBpbiB0aGlzIHNwZWMgdG8gaW5jbHVkZSBlaXRoZXIgdGhlIGFzc2VydGlvbl9pZCBvciB0 aGUgc3ViamVjdF9pZCBjbGFpbS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4i Pg0KVGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KQXR1bDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCk9uIE1vbiwgSnVsIDEzLCAyMDIw IGF0IDEwOjMwIEFNIENocmlzIFBoaWxsaXBzICZsdDs8YSBocmVmPSJtYWlsdG86Q2hyaXMuUGhp bGxpcHNAY2FuYXJpZS5jYSIgdGFyZ2V0PSJfYmxhbmsiPkNocmlzLlBoaWxsaXBzQGNhbmFyaWUu Y2E8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIHdpbmRvd3RleHQgMS4wcHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdDtib3JkZXItY29sb3I6Y3VycmVudGNv bG9yIGN1cnJlbnRjb2xvciBjdXJyZW50Y29sb3IgcmdiKDIwNCwyMDQsMjA0KSI+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIGxh bmc9IkVOLUNBIj5IaS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+UXVpZXQgbHVya2VyIG9i c2VydmluZy4uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPlRoYW5rcyBmb3IgY29uc2lkZXIg dGhlIFNBTUwgZWxlbWVudHMuLiA8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41 aW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPkF0dWwsIGFyZSB5b3UgcmVmZXJyaW5nIHRvIHRoZSBh Y3R1YWwgc2Vzc2lvbiBpZGVudGlmaWVyIHRoYXQgc29tZW9uZSBtYXkgaGF2ZSB3aGVyZSB0aGUg U3ViamVjdC1JZCB3YXMgZXhjaGFuZ2VkIE9SIHRoZSBhY3R1YWwgU3ViamVjdC1pZCBpdHNlbGYg aW4geW91ciByZWZlcmVuY2UgaW4gdGhlIHByb3Bvc2FsIHdpdGggdGhlIGdpdGh1YiBsaW5rPzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDou NWluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1D QSI+SeKAmW0gdHJ5aW5nIHRvIHNxdWFyZSB3aGF0IEkgc2VlIG9uIHRoZSBnaXQgZGVsdGEgb24g bGluZSAyOTQtMjk2IGluDQo8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vcmljaGFubmEvc2Vj ZXZlbnQvcHVsbC8xL2NvbW1pdHMvYjIwYjY2OTJlYjUwNjI4OTI3NDc2Y2E3OGY5YmUwNzdhY2U4 ODk5NCIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly9naXRodWIuLi5jb20vcmljaGFubmEvc2Vj ZXZlbnQvcHVsbC8xL2NvbW1pdHMvYjIwYjY2OTJlYjUwNjI4OTI3NDc2Y2E3OGY5YmUwNzdhY2U4 ODk5NDwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4g bGFuZz0iRU4tQ0EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5BbmQgYSBTdWJq ZWN0LWlkIGFzIHNob3duIGluIHRoZSBleGFtcGxlIGluIDMuMy4zIGhlcmU6IDxhIGhyZWY9Imh0 dHBzOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9zZWN1cml0eS9zYW1sLXN1YmplY3QtaWQtYXR0ci92 MS4wL2NzMDEvc2FtbC1zdWJqZWN0LWlkLWF0dHItdjEuLjAtY3MwMS4uaHRtbCNfVG9jNTM2MDk3 MjI5IiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL2RvY3Mub2FzaXMtb3Blbi5vcmcvc2VjdXJp dHkvc2FtbC1zdWJqZWN0LWlkLWF0dHIvdjEuMC9jczAxL3NhbWwtc3ViamVjdC1pZC1hdHRyLXYx LjAtY3MwMS5odG1sI19Ub2M1MzYwOTcyMjk8L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0Ei PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5XaGF0IHlvdSBvZmZlcmVkIGluIHRo ZSBleGFtcGxlIGlzIG5vdCBhIFN1YmplY3QtaWQgJm5ic3A7cGVyIHRoZSBPQVNJUyBTQU1MIHNw ZWMgYXMgd3JpdHRlbiBpbiBzZWN0aW9uIDMuMy4xPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0Ei PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5BbSBJIG1pcy1pbnRlcnByZXRpbmcg c29tZXRoaW5nPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3Bh biBsYW5nPSJFTi1DQSI+Qzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+ DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdiBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCB3aW5kb3d0ZXh0IDEuMHB0O3BhZGRp bmc6My4wcHQgMGluIDBpbiAwaW47Ym9yZGVyLWNvbG9yOmN1cnJlbnRjb2xvciBjdXJyZW50Y29s b3IiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPGI+PHNwYW4g bGFuZz0iRU4tQ0EiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8 L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUNBIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xv cjpibGFjayI+SWQtZXZlbnQgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudC1ib3VuY2VzQGll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7 IG9uIGJlaGFsZiBvZiBBdHVsIFR1bHNoaWJhZ3dhbGUNCiAmbHQ7YXR1bHR1bHNoaT08YSBocmVm PSJtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+NDBn b29nbGUuY29tQGRtYXJjLmlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+TW9uZGF5 LCBKdWx5IDEzLCAyMDIwIGF0IDEyOjE3IFBNPGJyPg0KPGI+VG86IDwvYj4mcXVvdDs8YSBocmVm PSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRm Lm9yZzwvYT4mcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8 L2I+W0lkLWV2ZW50XSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 Oi41aW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4N CjxzcGFuIGxhbmc9IkVOLUNBIj5IaSBhbGwsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIGxhbmc9IkVO LUNBIj5CYXNlZCBvbiB0aGUgZGlzY3Vzc2lvbnMgaW4gdGhlIFNTRSB3b3JraW5nIGdyb3VwIHdp dGhpbiB0aGUgT3BlbklEIEZvdW5kYXRpb24sIHdlIHdvdWxkIGxpa2UgdG8gcHJvcG9zZSB0aGF0 IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgc3BlY2lmaWNhdGlvbiBpbmNsdWRlIGEgU0FNTCBzdWJq ZWN0IGlkZW50aWZpZXIgdHlwZS4gVGhpcyBpcyBzbyB0aGF0IHNlc3Npb25zIGVzdGFibGlzaGVk IGFjcm9zcyBwZWVycyB1c2luZw0KIFNBTUwgbWF5IGJlIGlkZW50aWZpZWQgaW4gZXZlbnRzIHRo YXQgaW5jbHVkZSB0aGUgc3ViamVjdCBpZGVudGlmaWVyLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4N CjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBs YW5nPSJFTi1DQSI+Jm5ic3A7QSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciBoYXMgb25seSBvbmUg Y2xhaW0gd2l0aGluIGl0LCB0aGUgYXNzZXJ0aW9uIGlkIG9mIHRoZSBTQU1MIGFzc2VydGlvbiB1 c2VkIHRvIGVzdGFibGlzaCB0aGUgc2luZ2xlIHNpZ24tb24gc2Vzc2lvbi48L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4i Pg0KPHNwYW4gbGFuZz0iRU4tQ0EiPlRoaXMgY2hhbmdlIGlzIGFsc28gaW5jbHVkZWQgaW4gbXkg PGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL3JpY2hhbm5hL3NlY2V2ZW50L3B1bGwvMSIgdGFy Z2V0PSJfYmxhbmsiPg0KcHJvcG9zYWwgaGVyZTwvYT4uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0K PHNwYW4gbGFuZz0iRU4tQ0EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIGxh bmc9IkVOLUNBIj5UaGFua3MsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gbGFuZz0iRU4t Q0EiPkF0dWw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlz dDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsi PklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9i bG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fIElkLWV2ZW50IG1haWxpbmcgbGlzdCA8YSBocmVmPSJtYWlsdG86 SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj4NCklkLWV2ZW50QGlldGYub3JnPC9h PiA8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50 IiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L2lkLWV2ZW50PC9hPiA8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86 SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48 YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2 ZW50IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxicj4NCjxiPjxpPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5Oi1hcHBsZS1zeXN0ZW07Y29s b3I6IzU1NTU1NTtib3JkZXI6bm9uZSB3aW5kb3d0ZXh0IDEuMHB0O3BhZGRpbmc6MGluIj5DT05G SURFTlRJQUxJVFkgTk9USUNFOiBUaGlzIGVtYWlsIG1heSBjb250YWluIGNvbmZpZGVudGlhbCBh bmQgcHJpdmlsZWdlZCBtYXRlcmlhbCBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSBpbnRlbmRlZCBy ZWNpcGllbnQocykuIEFueSByZXZpZXcsDQogdXNlLCBkaXN0cmlidXRpb24gb3IgZGlzY2xvc3Vy ZSBieSBvdGhlcnMgaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4uJm5ic3A7IElmIHlvdSBoYXZlIHJl Y2VpdmVkIHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2Vu ZGVyIGltbWVkaWF0ZWx5IGJ5IGUtbWFpbCBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlIGFuZCBhbnkg ZmlsZSBhdHRhY2htZW50cyBmcm9tIHlvdXIgY29tcHV0ZXIuIFRoYW5rIHlvdS48L3NwYW4+PC9p PjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_C62035F9E7D84CA489A32BE6DE941CE3amazoncom_-- From nobody Tue Jul 14 16:59:39 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 391373A08FA for ; Tue, 14 Jul 2020 16:59:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.6 X-Spam-Level: X-Spam-Status: No, score=-9.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id phTPxN_P1uFO for ; Tue, 14 Jul 2020 16:59:35 -0700 (PDT) Received: from smtp-fw-9102.amazon.com (smtp-fw-9102.amazon.com [207.171.184.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEAFC3A08DB for ; Tue, 14 Jul 2020 16:59:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1594771176; x=1626307176; h=from:to:date:message-id:references:in-reply-to: mime-version:subject; bh=1nKHtSuX+U5CtoSdWBYPwnH3BYw2C6SjFwHU/aTtD14=; b=Wo8FRELH+HIkpC/tXM5unw1O2YV9rju9RdZgUkCRbkeeFK05thfKosqp E5n71shhzIPyh6o7OSF5QT9BXAfRk1ZXhpnCaRLx9MWfcjkrNcBCLlMQu Pkgy6uuxWWAA2o2/yKrgoGX5OiQhWebig1FinvzKxxg7TOHHsBO4B0Pxy s=; IronPort-SDR: vaWL929BUZkqnYZ8xfVkvAzMed3WEMiMA0/ZN/69ZTxy8J7n1XlHVPV+QS4TgdcvLjmup5EJcv /9Pk102KhPnQ== X-IronPort-AV: E=Sophos; i="5.75,353,1589241600"; d="scan'208,217"; a="59876416" Thread-Topic: [Id-event] Review: Subject Identifiers Received: from sea32-co-svc-lb4-vlan3.sea.corp.amazon.com (HELO email-inbound-relay-2c-c6afef2e.us-west-2.amazon.com) ([10.47.23.38]) by smtp-border-fw-out-9102.sea19.amazon.com with ESMTP; 14 Jul 2020 23:59:36 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan2.pdx.amazon.com [10.170.41.162]) by email-inbound-relay-2c-c6afef2e.us-west-2.amazon.com (Postfix) with ESMTPS id 4EA3CA1BF7; Tue, 14 Jul 2020 23:59:35 +0000 (UTC) Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 14 Jul 2020 23:59:34 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC004.ant.amazon.com (10.43.162.101) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 14 Jul 2020 23:59:34 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Tue, 14 Jul 2020 23:59:34 +0000 From: "Richard Backman, Annabelle" To: Justin Richer , "id-event@ietf.org" Thread-Index: AQHWWgacR9uiWq3tpEChXX+siSJ6W6kHTD2A Date: Tue, 14 Jul 2020 23:59:34 +0000 Message-ID: References: <272E9638-3FBC-45DF-8203-B52F86D3E211@mit.edu> In-Reply-To: <272E9638-3FBC-45DF-8203-B52F86D3E211@mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.162.85] Content-Type: multipart/alternative; boundary="_000_AE15B3F67CD34C3FBEDC63C524ACF0C5amazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Review: Subject Identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 23:59:37 -0000 --_000_AE15B3F67CD34C3FBEDC63C524ACF0C5amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aGUgcmV2aWV3LCBKdXN0aW4hIFJlcGxpZXMgYXJlIFtyaWNoYW5uYV0gaW5s aW5lIFsvcmljaGFubmFdLg0KDQoNCg0K4oCTDQoNCkFubmFiZWxsZSBCYWNrbWFuIChzaGUvaGVy KQ0KDQpBV1MgSWRlbnRpdHkNCg0KaHR0cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS8NCg0K DQoNCu+7v09uIDcvMTQvMjAsIDEwOjQ1IEFNLCAiSWQtZXZlbnQgb24gYmVoYWxmIG9mIEp1c3Rp biBSaWNoZXIiIDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBqcmljaGVy QG1pdC5lZHU+IHdyb3RlOg0KDQoNCg0KQ0FVVElPTjogVGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZy b20gb3V0c2lkZSBvZiB0aGUgb3JnYW5pemF0aW9uLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Igb3Bl biBhdHRhY2htZW50cyB1bmxlc3MgeW91IGNhbiBjb25maXJtIHRoZSBzZW5kZXIgYW5kIGtub3cg dGhlIGNvbnRlbnQgaXMgc2FmZS4NCg0KDQoNCg0KDQoNCg0KSeKAmXZlIHJlYWQgdGhyb3VnaCBk cmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmllcnMgYW5kIGZvciB0aGUgbW9zdCBw YXJ0IGl04oCZcyBpbiBnb29kIHNoYXBlLiBBcG9sb2dpZXMgaWYgYW55IG9mIHRoZXNlIHBvaW50 cyBoYXZlIGJlZW4gdGhvcm91Z2hseSBjb3ZlcmVkIGluIG90aGVyIHJldmlld3MuDQoNCg0KDQrC pzE6IFdoaWxlIHRoaXMgaXMgYSBTRVQtZm9jdXNlZCBzcGVjLCBJIHdvdWxkIGxpa2UgdG8gc2Vl IG1vcmUgZGlzY3Vzc2lvbiBhYm91dCBob3cgdGhpcyBpZGVudGlmaWVyIHN0cnVjdHVyZSBjYW4g YmUgdXNlZCBvdXRzaWRlIG9mIGEgU0VUIG9yIGEgSldUIGluIGdlbmVyYWwuDQoNCg0KDQpbcmlj aGFubmFdDQoNCkFncmVlZC4NCg0KWy9yaWNoYW5uYV0NCg0KDQoNCsKnMy4zOiBzbWFsbCB0eXBv LCDigJxlbWFpbOKAnSBzaG91bGQgYmUg4oCccGhvbmUgbnVtYmVy4oCdIGluIGludHJvZHVjaW5n IGV4YW1wbGUuDQoNCg0KDQrCpzM6IEnigJltIHdvbmRlcmluZyBpZiB0aGVyZeKAmXMgd29ydGgg aW4gZGVmaW5pbmcgc2VtYW50aWMgZmxhZ3MgdGhhdCBjYW4gYmUgdXNlZCBhY3Jvc3MgdHlwZXMu IExpa2Ug4oCccHNldWRvbnltb3Vz4oCdIG9yIOKAnHBlci1wcm92aWRlci1pZOKAnSBvciB0aGUg bGlrZT8gVGhhdCBtaWdodCBiZSBhIHN0ZXAgYmV5b25kIHdoYXQgdGhpcyBpcyB0cnlpbmcgdG8g ZG8sIHRob3VnaCB0aGUgY3VycmVudCBkZWZpbml0aW9ucyBkbyBub3QgYWxsb3cgZXh0ZW5zaW9u IG9mIGV4aXN0aW5nIHR5cGVzIHdpdGggbmV3IGZpZWxkcy4NCg0KDQoNCltyaWNoYW5uYV0NCg0K VGhlIE9JREYgU1NFIHdvcmtpbmcgZ3JvdXAgaGFzIHByb3Bvc2VkIGEgY291cGxlIG9mIHByb3Bl cnRpZXMgbGlrZSB0aGlzLiBJIHRoaW5rIGl04oCZcyB3b3J0aCBkaXNjdXNzaW5nLCBwcm92aWRl ZCB0aGVyZSBhcmUgdXNlIGNhc2VzIGZvciB0aGVtLg0KDQpbL3JpY2hhbm5hXQ0KDQoNCg0KSeKA mWQgYWxzbyBsaWtlIHRvIHNlZSBhIG5vdGUgdGhhdCBtdWx0aXBsZSBzdWJqZWN0IHR5cGVzIGNv dWxkIGJlIHByZXNlbnRlZCB0b2dldGhlciB3aXRob3V0IHVzaW5nIHRoZSDigJxhbGlhc2Vz4oCd IHN0cnVjdHVyZS4gVGhpcyBtb3N0bHkgd291bGQgYXBwbHkgb3V0c2lkZSBvZiBTRVQgd2hpY2gg ZGVmaW5lcyBhIHNpbmdsZSDigJxzdWItaWTigJ0gY29udGFpbmVyLCBidXQgYXMgYWJvdmUgSSB0 aGluayB0aGlzIGNhbiBiZSBtb3JlIGdlbmVyYWxseSB1c2VkLg0KDQoNCg0KW3JpY2hhbm5hXQ0K DQpBZ3JlZWQuDQoNClsvcmljaGFubmFdDQoNCg0KDQpPdmVyYWxsLCBJIHRoaW5rIGl04oCZcyBh IHByZXR0eSBzaW1wbGUgYW5kIHN0cmFpZ2h0Zm9yd2FyZCBzcGVjIGFuZCBzaG91bGQgZ28gZm9y d2FyZC4NCg0KDQoNClRoYW5rcywNCg0K4oCUIEp1c3Rpbg0KDQpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCg0K SWQtZXZlbnRAaWV0Zi5vcmcNCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9pZC1ldmVudA0K --_000_AE15B3F67CD34C3FBEDC63C524ACF0C5amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiTVMgTWluY2hvIjsNCglwYW5vc2UtMToyIDIgNiA5IDQgMiA1IDgg MyA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3Nl LTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGli cmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250 LWZhbWlseToiXEBNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAy IDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29QbGFpblRleHQsIGxp Lk1zb1BsYWluVGV4dCwgZGl2Lk1zb1BsYWluVGV4dA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJbXNvLXN0eWxlLWxpbms6IlBsYWluIFRleHQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLlBsYWluVGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6 IlBsYWluIFRleHQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1s aW5rOiJQbGFpbiBUZXh0IjsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQou TXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6 MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRT ZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4g MS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0 eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIj OTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij5UaGFua3MgZm9yIHRoZSByZXZpZXcsIEp1c3RpbiEgUmVwbGllcyBhcmUgPHNwYW4gc3R5 bGU9ImNvbG9yOiNFQjM5RjYiPg0KW3JpY2hhbm5hXSBpbmxpbmUgWy9yaWNoYW5uYV08L3NwYW4+ LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij7igJM8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPkFubmFiZWxsZSBCYWNrbWFuIChzaGUvaGVyKTxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+QVdTIElkZW50aXR5PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5odHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5 LzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPu+7v09uIDcvMTQvMjAsIDEwOjQ1IEFNLCAmcXVvdDtJZC1ldmVudCBv biBiZWhhbGYgb2YgSnVzdGluIFJpY2hlciZxdW90OyAmbHQ7aWQtZXZlbnQtYm91bmNlc0BpZXRm Lm9yZyBvbiBiZWhhbGYgb2YganJpY2hlckBtaXQuZWR1Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+Q0FVVElPTjogVGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZyb20gb3V0 c2lkZSBvZiB0aGUgb3JnYW5pemF0aW9uLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Igb3BlbiBhdHRh Y2htZW50cyB1bmxlc3MgeW91IGNhbiBjb25maXJtIHRoZSBzZW5kZXIgYW5kIGtub3cgdGhlIGNv bnRlbnQgaXMgc2FmZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPknigJl2ZSByZWFkIHRocm91Z2ggZHJhZnQtaWV0Zi1z ZWNldmVudC1zdWJqZWN0LWlkZW50aWZpZXJzIGFuZCBmb3IgdGhlIG1vc3QgcGFydCBpdOKAmXMg aW4gZ29vZCBzaGFwZS4gQXBvbG9naWVzIGlmIGFueSBvZiB0aGVzZSBwb2ludHMgaGF2ZSBiZWVu IHRob3JvdWdobHkgY292ZXJlZCBpbiBvdGhlciByZXZpZXdzLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij7CpzE6IFdoaWxlIHRoaXMgaXMgYSBTRVQtZm9jdXNlZCBzcGVjLCBJIHdvdWxk IGxpa2UgdG8gc2VlIG1vcmUgZGlzY3Vzc2lvbiBhYm91dCBob3cgdGhpcyBpZGVudGlmaWVyIHN0 cnVjdHVyZSBjYW4gYmUgdXNlZCBvdXRzaWRlIG9mIGEgU0VUIG9yIGEgSldUIGluIGdlbmVyYWwu PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBzdHlsZT0iY29s b3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5bcmljaGFubmFdPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNF QjM5RjYiPkFncmVlZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBzdHlsZT0iY29sb3I6I0VCMzlGNiI+Wy9yaWNoYW5uYV08L3NwYW4+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PsKnMy4zOiBzbWFsbCB0eXBvLCDigJxlbWFpbOKAnSBzaG91bGQgYmUg4oCccGhvbmUgbnVtYmVy 4oCdIGluIGludHJvZHVjaW5nIGV4YW1wbGUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PsKnMzogSeKAmW0gd29uZGVyaW5nIGlmIHRoZXJl4oCZcyB3b3J0aCBpbiBkZWZpbmluZyBzZW1h bnRpYyBmbGFncyB0aGF0IGNhbiBiZSB1c2VkIGFjcm9zcyB0eXBlcy4gTGlrZSDigJxwc2V1ZG9u eW1vdXPigJ0gb3Ig4oCccGVyLXByb3ZpZGVyLWlk4oCdIG9yIHRoZSBsaWtlPyBUaGF0IG1pZ2h0 IGJlIGEgc3RlcCBiZXlvbmQgd2hhdCB0aGlzIGlzIHRyeWluZyB0byBkbywgdGhvdWdoIHRoZSBj dXJyZW50IGRlZmluaXRpb25zDQogZG8gbm90IGFsbG93IGV4dGVuc2lvbiBvZiBleGlzdGluZyB0 eXBlcyB3aXRoIG5ldyBmaWVsZHMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5bcmljaGFubmFdPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPlRoZSBP SURGIFNTRSB3b3JraW5nIGdyb3VwIGhhcyBwcm9wb3NlZCBhIGNvdXBsZSBvZiBwcm9wZXJ0aWVz IGxpa2UgdGhpcy4gSSB0aGluayBpdOKAmXMgd29ydGggZGlzY3Vzc2luZywgcHJvdmlkZWQgdGhl cmUgYXJlIHVzZSBjYXNlcyBmb3IgdGhlbS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBzdHlsZT0iY29sb3I6I0VCMzlGNiI+Wy9yaWNoYW5uYV08 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPknigJlkIGFsc28gbGlrZSB0byBzZWUgYSBub3RlIHRoYXQgbXVsdGlwbGUg c3ViamVjdCB0eXBlcyBjb3VsZCBiZSBwcmVzZW50ZWQgdG9nZXRoZXIgd2l0aG91dCB1c2luZyB0 aGUg4oCcYWxpYXNlc+KAnSBzdHJ1Y3R1cmUuIFRoaXMgbW9zdGx5IHdvdWxkIGFwcGx5IG91dHNp ZGUgb2YgU0VUIHdoaWNoIGRlZmluZXMgYSBzaW5nbGUg4oCcc3ViLWlk4oCdIGNvbnRhaW5lciwg YnV0IGFzIGFib3ZlIEkgdGhpbmsgdGhpcyBjYW4NCiBiZSBtb3JlIGdlbmVyYWxseSB1c2VkLjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBzdHlsZT0iY29sb3I6I0VCMzlGNiI+ W3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIHN0eWxlPSJjb2xvcjojRUIzOUY2Ij5BZ3JlZWQuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNFQjM5RjYiPlsv cmljaGFubmFdPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5PdmVyYWxsLCBJIHRoaW5rIGl04oCZcyBhIHByZXR0eSBz aW1wbGUgYW5kIHN0cmFpZ2h0Zm9yd2FyZCBzcGVjIGFuZCBzaG91bGQgZ28gZm9yd2FyZC48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+VGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+4oCUIEp1c3RpbjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X188bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPklkLWV2ZW50IG1haWxp bmcgbGlzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+SWQtZXZlbnRA aWV0Zi5vcmc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPmh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_AE15B3F67CD34C3FBEDC63C524ACF0C5amazoncom_-- From nobody Wed Jul 15 12:46:19 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7E4B3A0F60 for ; Wed, 15 Jul 2020 12:46:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.589 X-Spam-Level: X-Spam-Status: No, score=-17.589 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mnUCx-4ivscO for ; Wed, 15 Jul 2020 12:46:16 -0700 (PDT) Received: from mail-yb1-xb2d.google.com (mail-yb1-xb2d.google.com [IPv6:2607:f8b0:4864:20::b2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E69F63A0F5D for ; Wed, 15 Jul 2020 12:46:15 -0700 (PDT) Received: by mail-yb1-xb2d.google.com with SMTP id c14so1721277ybj.0 for ; Wed, 15 Jul 2020 12:46:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Z5V1qSIZ6vGudnk84jA5rJ+rQdbmmVc8uMVfHp08iWA=; b=R5HDJCh1Sj3vDO5CBKHB5KE3BAQZvaz9gD8827Wp+Zu41nnXnYA7NCE0YRBISeu/Ox AufL8Vu7ctkZObPz641CY3n+cpjaX037zmvZDqxxH0lRpaqqN2F7MDGx+hXGdPDWoopw V7CY2WnXNGeCNcyoesYg8FtLpB/2sT9I6LMqiVkZkuDIH9stdy0sGS3iR3BEw/kKFwuX r/glLcQ0LeiBqJD7a83m1ZR+LwmalwI1nPEsVF6GNVK7ty6SCtn8X+SN/PBOJs3MqCP+ QE99DHIR+Ca/gpRvwok6QCos9KSAl3KOcwpzjCYrdDl6Ub7knn4YIhKSBZlYiqdOKySK g5zg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Z5V1qSIZ6vGudnk84jA5rJ+rQdbmmVc8uMVfHp08iWA=; b=AmxTGQs+QwbrVoNkzNdph8ph+Wn5Wb3ypOUfxvXHtOlvLCygWfN+f+21VK+ZiHy0mt 4C0wDooTZ6lPf0jnoiLvplzizN54bnfX/JbOqUj3c8Xdnm1WAU8MkmF9dk+ODhq1NMrv gGsQTFCwq4beXTYqe2iIcRY5CjUng6gP+92kb8mpEXeJblCBjKUS9upEWI/qWIBKWxrG JQy4NHIj5lhbbLIP/KyoZa20ehx44QTq1ldE592LmutdJZt5RQj8AEarCPIP5QrbQ6PU 7f7jSMgtqHN2R7rhZVpjODl3VhKjNQu7MvrA0E2bIp3YcyHICAUGOWCzdn8lKnCXzTok J33Q== X-Gm-Message-State: AOAM530sipX7c2xspLv13gvxmTuctyYbJdMz9ON96h/eO4RLUnT2MFro vwWjZUMYmFj5uTBjUZRkoEAAiux4y0hUytk8Y20jcQ== X-Google-Smtp-Source: ABdhPJyqm3njJhySOgFeV6FRa0VmOtfrQnSLXBOovmeH144kt/KQEI+Bpyp9LPq4Q3MA3lkYiFqk8VvB9pEsAQ9iQLU= X-Received: by 2002:a25:d807:: with SMTP id p7mr957802ybg.229.1594842374690; Wed, 15 Jul 2020 12:46:14 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> In-Reply-To: From: Atul Tulshibagwale Date: Wed, 15 Jul 2020 12:46:03 -0700 Message-ID: To: "Richard Backman, Annabelle" Cc: Brian Campbell , Yaron Sheffer , Chris Phillips , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="00000000000037c91805aa802d4d" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 19:46:19 -0000 --00000000000037c91805aa802d4d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable How do we propose to support the two subject types defined in the OAuth Event Types spec here? On Tue, Jul 14, 2020 at 4:54 PM Richard Backman, Annabelle wrote: > The RISC Profile=E2=80=99s =E2=80=9CID Token Claims=E2=80=9D type does no= t identify a subject that > is an ID Token, it identifies a subject that was the subject of an ID > Token. It was intended for cases where the OP sent multiple identifiers o= f > different types in the ID Token (e.g., iss+sub and email), and does not > know which of them the client will recognize (yes, the *should* use > iss+sub; no, they doesn=E2=80=99t always do so). This type was replaced i= n > draft-ietf-secevent-subject-identifiers-03 with the =E2=80=9Caliases=E2= =80=9D type, which > is a general solution to this problem that is not defined in terms of one > particular use case (i.e., ID Tokens). > > > > The OIDF SSE working group=E2=80=99s OAuth Event Types draft > > defines a =E2=80=9Coauth_token=E2=80=9D type that identifies a subject th= at is an OAuth 2.0 > token, and does so using either the full or partial plain text value of t= he > token, or a hash of the token. > > > > It is perfectly fine for a token to be the subject of a security event. > 8417 actually > includes the following as an example of a possible value for the =E2=80= =9Csub=E2=80=9D > claim: > > * a token identifier (e.g. "jti") for a revoked token. > > > > =E2=80=93 > > Annabelle Backman (she/her) > > AWS Identity > > https://aws.amazon.com/identity/ > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Tuesday, July 14, 2020 at 4:32 PM > *To: *Brian Campbell > *Cc: *Yaron Sheffer , Chris Phillips < > Chris.Phillips@canarie.ca>, "id-event@ietf.org" > *Subject: *RE: [EXTERNAL] [Id-event] SAML subject identifier type > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and kno= w > the content is safe. > > > > IMO if we have a common enough use-case that requires a specific type to > be defined, then we should define that type in the spec rather than rely = on > an interpretation of the "iss-sub" type, since that interpretation can > cause incompatibilities. > > > > In this specific case however I feel that the use cases outlined in my > previous email can be achieved (with limitations) using the durable subje= ct > types such as email. I'd like the members of the SSE working group to chi= me > in (since that is where this got added), or we can drop the SAML subject > identifier type. > > > > On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell > wrote: > > + 1 to what Yaron is saying here. I'd include also the "iss-sub" subject > identifier type > https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#se= ction-3.4 > as already having semantics covering what's described in the ID Token > Claims Subject Identifier Type in the RISC document referenced. And all > those things represent a durable subject rather than a session, which > strikes me as appropriate for a document that describes identifying > subjects. A SAML assertion ID, however, which is an identifier of an XML > document that is only indirectly related to a session by an association > that likely isn't maintained, does not seem appropriate as a "subject > identifier". > > > > On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer > wrote: > > Hi Atul, > > > > The ID Token subject type, as described in the document you are > referencing, does not add any semantics, compared to a =E2=80=9Cphone num= ber=E2=80=9D or > =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value in= adding it. > > > > In addition, it does not, actually, describe an ID Token. In fact the tex= t > is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable en= tity) rather than > a session, and does it by citing various claims included in the ID token. > So as a subject identifier type, it is not at all equivalent to a SAML > assertion. > > > > As to the SAML Assertion subject type, I think these use cases could be > addressed by adding information to the event. > > > > Thanks, > > Yaron > > > > *From: *Atul Tulshibagwale > *Date: *Tuesday, July 14, 2020 at 23:26 > *To: *Yaron Sheffer > *Cc: *Chris Phillips , "id-event@ietf.org" < > id-event@ietf.org> > *Subject: *Re: [Id-event] SAML subject identifier type > > > > Hi Yaron, > > There are a few SSE use cases where the events are about a specific singl= e > sign-on session. You're right that this should not be limited to SAML. Th= e > RISC profile of SETs (based on which we are doing the SSE work) had the I= D > Token subject identifier type, which for some reason is missing in this > spec (I did not realize until now). The specific events that need to refe= r > to sessions are: > > =C2=B7 Identity provider context change: The conditions under whi= ch a > SAML assertion or OIDC token was generated are no longer valid. This can = be > due to various things, including a password change. > > =C2=B7 Session property change: A session has been determined to = have > been compromised > > =C2=B7 Revocation: The issuer of the single sign-on SAML assertio= n or > ID Token needs to be revoke > > I can also add the ID Token claim from the RISC profile > > to my pull request. > > > > Thanks, > > Atul > > > > > > On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer > wrote: > > I need a lot more context here. So far, subject IDs have denoted durable > entities, such as email addresses, phone numbers, account. This is adding= a > subject ID that denotes an ephemeral entity, basically similar to a sessi= on > ID. This looks weird from an architectural point of view, and also begs t= he > question, why specifically SAML and not other session types. > > > > Thanks, > > Yaron > > > > *From: *Id-event on behalf of Atul > Tulshibagwale <40google.com@dmarc.ietf..org>> > *Date: *Tuesday, July 14, 2020 at 00:14 > *To: *Chris Phillips > *Cc: *"id-event@ietf.org" > *Subject: *Re: [Id-event] SAML subject identifier type > > > > Just clarifying the proposal as it stands today (before incorporating > Chris's input): > > The following section should be added in the "Subject Identifier Types" > section: > > 4.9. SAML Subject Identifier Type > > The SAML [SAML.REF] Subject Identifier Type describes a subject by > the assertion identifier in the SAML assertion that was used to > convey the subject's information to the Receiver. Subject > Identifiers of this type MUST contain an ` assertion_id"claim. The > value of this claim is a string that is equal to the Assertion > Identifier in the SAML assertion. The SAML Subject Identifier Type > is identified by the name "saml`. > > Below is a non-normative example Subject Identifier for the SAML > Subject Identifier Type: > > { > "subject_type": "saml", > "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", > } > > Figure 8: Example: Subject Identifier for SAML Subject Identifier > Type. > > > > > > On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale > wrote: > > Hi Chris, > > I was proposing using the "assertion id" (SAML Core > > spec, line 553) in the proposal, not the "subject-id" as defined in SAML > (spec section 3.3). The main reason was to be able to refer to a session > that was established using a specific assertion. If it's useful, we could > perhaps extend the SAML subject identifier type in this spec to include > either the assertion_id or the subject_id claim. > > > > Thanks, > > Atul > > > > > > On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips > wrote: > > Hi. > > Quiet lurker observing.. > > Thanks for consider the SAML elements.. > > > > Atul, are you referring to the actual session identifier that someone may > have where the Subject-Id was exchanged OR the actual Subject-id itself i= n > your reference in the proposal with the github link? > > > > I=E2=80=99m trying to square what I see on the git delta on line 294-296 = in > https://github...com/richanna/secevent/pull/1/commits/b20b6692eb506289274= 76ca78f9be077ace88994 > > > > > > > And a Subject-id as shown in the example in 3.3.3 here: > https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-= subject-id-attr-v1.0-cs01.html#_Toc536097229 > > > > > What you offered in the example is not a Subject-id per the OASIS SAML > spec as written in section 3.3.1 > > > > Am I mis-interpreting something? > > > > C > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Monday, July 13, 2020 at 12:17 PM > *To: *"id-event@ietf.org" > *Subject: *[Id-event] SAML subject identifier type > > > > Hi all, > > Based on the discussions in the SSE working group within the OpenID > Foundation, we would like to propose that the subject identifier > specification include a SAML subject identifier type. This is so that > sessions established across peers using SAML may be identified in events > that include the subject identifier. > > > > A SAML subject identifier has only one claim within it, the assertion id > of the SAML assertion used to establish the single sign-on session. > > > > This change is also included in my proposal here > . > > > > Thanks, > > Atul > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > _______________________________________________ Id-event mailing list > Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > *CONFIDENTIALITY NOTICE: This email may contain confidential and > privileged material for the sole use of the intended recipient(s). Any > review, use, distribution or disclosure by others is strictly prohibited.= . > If you have received this communication in error, please notify the sende= r > immediately by e-mail and delete the message and any file attachments fro= m > your computer. Thank you.* > > --00000000000037c91805aa802d4d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    How do we propose to support the two subject types defined= in the OAuth Event Types spec here?

    On Tue, Jul 14, 2020 at 4:54 PM Richard Ba= ckman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org> wrote:

    The RISC Profile=E2=80=99s =E2=80=9CID Token Claims= =E2=80=9D type does not identify a subject that is an ID Token, it identifi= es a subject that was the subject of an ID Token. It was intended for cases= where the OP sent multiple identifiers of different types in the ID Token (e.g., iss+sub and email), and does not know which of them= the client will recognize (yes, the should use iss+sub; no, they doesn=E2=80=99t always do so). This typ= e was replaced in draft-ietf-secevent-subject-identifiers-03 with the =E2= =80=9Caliases=E2=80=9D type, which is a general solution to this problem th= at is not defined in terms of one particular use case (i.e., ID Tokens).

    =C2=A0

    The OIDF SSE working group=E2=80=99s OAuth Event Types draft defines a =E2=80=9Coauth_token=E2=80=9D type th= at identifies a subject that is an OAuth 2.0 token, and does so using eithe= r the full or partial plain text value of the token, or a hash of the token= .

    =C2=A0

    It is perfectly fine for a token to be the subject o= f a security event. 8417 actually includes the following as an example of a pos= sible value for the =E2=80=9Csub=E2=80=9D claim:

    *=C2=A0 a token iden= tifier (e.g. "jti") for a revoked token.

    =C2=A0

    =E2=80=93

    Annabelle Backman (sh= e/her)

    AWS Identity

    https://aws.amazon.com/identity/

    =C2=A0

    =C2=A0

    From: Id-event <id-event-bounces@ie= tf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ie= tf.org>
    Date: Tuesday, July 14, 2020 at 4:32 PM
    To: Brian Campbell <bcampbell@pingidentity.com>
    Cc: Yaron Sheffer <yaronf.ietf@gmail.com>, Chris Phillips <Chris.Phillips@canarie.c= a>, "id-= event@ietf.org" <id-event@ietf.org>
    Subject: RE: [EXTERNAL] [Id-event] SAML subject identifier type

    =C2=A0

    CAUTION: This email originated from outside of the orga= nization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.<= /u>

    =C2=A0

    IMO if we have a common = enough use-case that requires a specific type to be defined, then we should= define that type in the spec rather than rely on an interpretation of the = "iss-sub" type, since that interpretation can cause incompatibilities.

    =C2=A0

    In this specific case ho= wever I feel that the use cases outlined in my previous email can be achiev= ed (with limitations) using the durable subject types such as email. I'= d like the members of the SSE working group to chime in (since that is where this got added), or we can drop the SAML = subject identifier type.

    =C2=A0

    On Tue, Jul 14, 2020 at = 4:09 PM Brian Campbell <bcampbell@pingidentity.com> wrote:

    + 1 to what Yaron is say= ing here. I'd include also the "iss-sub" subject identifier t= ype https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#sect= ion-3.4 as already having semantics covering what's described in th= e ID Token Claims Subject Identifier Type in the RISC document referenced. = And all those things represent a durable subject rather than a session, which strikes me as appropriate for a docum= ent that describes identifying subjects. A SAML assertion ID, however, whic= h is an identifier of an XML document that is only indirectly related to a = session by an association that likely isn't maintained, does not seem appropriate as a "subject identif= ier".

    =C2=A0

    On Tue, Jul 14, 2020 at = 4:01 PM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

    Hi Atul,

    =C2=A0

    The ID Token subject type, as described in the document you are referencing= , does not add any semantics, compared to a =E2=80=9Cphone number=E2=80=9D = or =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value i= n adding it.

    =C2=A0

    In addition, it does not, actually, describe an ID Token. In fact the text = is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable enti= ty) rather than a session, and does it by citing various claims included in= the ID token. So as a subject identifier type, it is not at all equivalent to a SAML assertion.

    =C2=A0

    As to the SAML Assertion subject type, I think these use cases could be add= ressed by adding information to the event.

    =C2=A0

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Atul Tulshibagwale <atultulshi@google.com>
    Date: Tuesday, July 14, 2020 at 23:26
    To: Yaron Sheffer <yaronf.ietf@gmail.com>
    Cc: Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf.org" <id-event@ietf.org>= ;
    Subject: Re: [Id-event] SAML subject identifier type

    =C2=A0

    Hi=C2=A0Yaron,

    There are a few SSE use cases where the events are about a specific single = sign-on session. You're right that this should not be limited to SAML. = The RISC profile of SETs (based on which we are doing the SSE work) had the= ID Token subject identifier type, which for some reason is missing in this spec (I did not realize until now). The= specific events that need to refer to sessions are:

    =C2=B7=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 Identity provider context change: The condition= s under which a SAML assertion or OIDC token was generated are no longer=C2= =A0valid. This can be due to various things, including a password change.

    =C2=B7=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 Session property change: A session has been det= ermined to have been compromised

    =C2=B7=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 Revocation: The issuer of the single sign-on SA= ML assertion or ID Token needs to be revoke

    I can also add the ID Token claim from the RISC profile to my pull request.<= /p>

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    =C2=A0

    On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:<= /u>

    I need a lot more context here. So far, subject IDs have denoted durable en= tities, such as email addresses, phone numbers, account. This is adding a s= ubject ID that denotes an ephemeral entity, basically similar to a session = ID. This looks weird from an architectural point of view, and also begs the question, why specifically SAML and not o= ther session types.

    =C2=A0

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Id-event <id-event-bounces@ietf.org> on behal= f of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Tuesday, July 14, 2020 at 00:14
    To: Chris Phillips <Chris.Phillips@canarie.ca>
    Cc: "id-= event@ietf.org" <id-event@ietf.org>
    Subject: Re: [Id-event] SAML subject identifier type

    =C2=A0

    Just clarifying the proposal as it stands today (before incorporating Chris= 's input):

    The following section should be added in the "Subject Identifier Types= " section:

    4.9.=C2=A0 SAML Subject= Identifier Type

    =C2=A0 =C2=A0The SAML [SAML.REF] Subject Identifier Type describes a subjec= t by
    =C2=A0 =C2=A0the assertion identifier in the SAML assertion that was used t= o
    =C2=A0 =C2=A0convey the subject's information to the Receiver.=C2=A0 Su= bject
    =C2=A0 =C2=A0Identifiers of this type MUST contain an ` assertion_id"c= laim.=C2=A0 The
    =C2=A0 =C2=A0value of this claim is a string that is equal to the Assertion=
    =C2=A0 =C2=A0Identifier in the SAML assertion.=C2=A0 The SAML Subject Ident= ifier Type
    =C2=A0 =C2=A0is identified by the name "saml`.

    =C2=A0 =C2=A0Below is a non-normative example Subject Identifier for the SA= ML
    =C2=A0 =C2=A0Subject Identifier Type:

    =C2=A0 =C2=A0{
    =C2=A0 =C2=A0 =C2=A0"subject_type": "saml",
    =C2=A0 =C2=A0 =C2=A0"assertion_id": "_f551d88963ab4e3decb7cf= e8f4dcc3f5",
    =C2=A0 =C2=A0}

    =C2=A0 =C2=A0 =C2=A0Figure 8: Example: Subject Identifier for SAML Subject = Identifier
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Type.    <= /u>

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com> wrote:=

    Hi Chris,

    I was proposing using the "assertion id" (S= AML Core spec, line 553) in the proposal, not the "subject-id"= ; as defined in SAML (spec section 3.3). The main reason was to be able to refer to a session that was established using a specific= assertion. If it's useful, we could perhaps extend the SAML subject id= entifier type in this spec to include either the assertion_id or the subjec= t_id claim.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca> w= rote:

    Hi.

    Quiet lurker observing..

    Thanks for consider the SAML elements.. =

    =C2=A0

    Atul, are you referring to the actual session identifi= er that someone may have where the Subject-Id was exchanged OR the actual S= ubject-id itself in your reference in the proposal with the github link?

    =C2=A0

    I=E2=80=99m trying to square what I see on the git del= ta on line 294-296 in https://github...com/richanna/secevent/pull/1/commits/b20b6692eb50628927476= ca78f9be077ace88994

    =C2=A0

    =C2=A0

    And a Subject-id as shown in the example in 3.3.3 here= : https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-su= bject-id-attr-v1.0-cs01.html#_Toc536097229

    =C2=A0

    What you offered in the example is not a Subject-id = =C2=A0per the OASIS SAML spec as written in section 3.3.1<= /u>

    =C2=A0

    Am I mis-interpreting something?<= /p>

    =C2=A0

    C

    =C2=A0

    =C2=A0

    From: <= /b>Id-event <<= a href=3D"mailto:id-event-bounces@ietf.org" target=3D"_blank">id-event-boun= ces@ietf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Monday, July 13, 2020 at 12:17 PM
    To: "id-= event@ietf.org" <id-event@ietf.org>
    Subject: [Id-event] SAML subject identifier type

    =C2=A0

    Hi all,

    Based on the discussions in the SSE working group with= in the OpenID Foundation, we would like to propose that the subject identif= ier specification include a SAML subject identifier type. This is so that s= essions established across peers using SAML may be identified in events that include the subject identifier.

    =C2=A0

    =C2=A0A SAML subject identifier has only one claim wit= hin it, the assertion id of the SAML assertion used to establish the single= sign-on session.

    =C2=A0

    This change is also included in my proposal here.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event

    ________________________= _______________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event


    CONFIDENTIALITY NOTICE: This= email may contain confidential and privileged material for the sole use of= the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..=C2=A0 I= f you have received this communication in error, please notify the sender i= mmediately by e-mail and delete the message and any file attachments from y= our computer. Thank you.

    --00000000000037c91805aa802d4d-- From nobody Wed Jul 15 14:25:06 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 687193A093B for ; Wed, 15 Jul 2020 14:25:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.609 X-Spam-Level: X-Spam-Status: No, score=-9.609 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XowTRtU4PH8M for ; Wed, 15 Jul 2020 14:25:00 -0700 (PDT) Received: from smtp-fw-6002.amazon.com (smtp-fw-6002.amazon.com [52.95.49.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68DDC3A0928 for ; Wed, 15 Jul 2020 14:25:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1594848300; x=1626384300; h=from:to:cc:date:message-id:references:in-reply-to: mime-version:subject; bh=cdwOJ0lSoEX1aTKfePKp2elJkApouWDqHr2i25j2EHQ=; b=vW3S73MslYHuhHbS9/xyHd37j1e+OHgrz7poxd8e88s5K367D20+RIxc NAjNL5zO71w3foVNqXOfcy335chaEA41Gscab+qarO281ypYzvk0pHrcI WcF91o8RFBkRBd8tys/34yp/LKz7TKtiAC1QYM4ZEpI54aeT3E5M1+UTz s=; IronPort-SDR: kWTow55/D9H8hO0YCgXWPLZBI3RX+d6uVAxjKBOyoQZUqf7xp86knY3hKv1dqb8WlhQq94SdBj o2CYc3kP/FbQ== X-IronPort-AV: E=Sophos; i="5.75,356,1589241600"; d="scan'208,217"; a="42142443" Thread-Topic: [Id-event] SAML subject identifier type Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-2a-1c1b5cdd.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6002.iad6.amazon.com with ESMTP; 15 Jul 2020 21:24:57 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan2.pdx.amazon.com [10.170.41.162]) by email-inbound-relay-2a-1c1b5cdd.us-west-2.amazon.com (Postfix) with ESMTPS id 5B519A1D7A; Wed, 15 Jul 2020 21:24:56 +0000 (UTC) Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 15 Jul 2020 21:24:55 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC004.ant.amazon.com (10.43.162.101) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 15 Jul 2020 21:24:55 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Wed, 15 Jul 2020 21:24:55 +0000 From: "Richard Backman, Annabelle" To: Atul Tulshibagwale , "Richard Backman, Annabelle" CC: Yaron Sheffer , Brian Campbell , Chris Phillips , "id-event@ietf.org" Thread-Index: AQHWWTErqa1UOmYxD0aXofDEeWMAPqkFxAuAgAAwHICAAA4GAIABdk8AgAAPNoCAABqVgIAAGVRf//+QtoCAAcJxgP//pkYA Date: Wed, 15 Jul 2020 21:24:55 +0000 Message-ID: <9CC41112-7947-41E1-9584-6DEB625BBEEA@amazon.com> References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.65] Content-Type: multipart/alternative; boundary="_000_9CC41112794741E195846DEB625BBEEAamazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 21:25:05 -0000 --_000_9CC41112794741E195846DEB625BBEEAamazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSB0aGluayB0aGUgdHdvIHN1YmplY3QgdHlwZXMg4oCTIHRoZSDigJxvYXV0aF90b2tlbuKAnSB0 eXBlIGRlc2NyaWJlZCBpbiBteSBwcmlvciBlbWFpbCwgYW5kIGEg4oCcb2F1dGhfY2xpZW504oCd IHR5cGUgdGhhdCBpZGVudGlmaWVzIGEgc3ViamVjdCBieSBpdHMgT0F1dGggMi4wIGNsaWVudCBJ RCDigJMgYXJlIHJlYXNvbmFibGUgdHlwZXMgdG8gZGVmaW5lLiBJIGRvbuKAmXQgc2VlIGEgcGFy dGljdWxhciBuZWVkIHRvIG1vdmUgdGhlbSBpbnRvIHRoZSBiYXNlIHNwZWMg4oCTIHdlIGRlZmlu ZSBhbiBJQU5BIHJlZ2lzdHJ5IHByZWNpc2VseSBzbyB3ZSBkb27igJl0IGhhdmUgdG8gdHJ5IHRv IGRlZmluZSBldmVyeXRoaW5nIHVwIGZyb250IOKAkyBidXQgSeKAmW0gbm90IG9wcG9zZWQgdG8g dGhlIGlkZWEuDQoNCknigJltIG5vdCBzdXJlIHdoZXJlIHRoaXMgbm90aW9uIG9mIGEg4oCcZHVy YWJsZSBzdWJqZWN04oCdIGNhbWUgZnJvbS4gUmlnaHQgaW4gdGhlIGludHJvZHVjdGlvbiwgUkZD IDg0MTc8aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvcmZjL3JmYzg0MTcuaHRtbCNzZWN0aW9u LTE+IHNheXMgdGhlIHN1YmplY3Qgb2YgYSBzZWN1cml0eSBldmVudCDigJxtYXkgYmUgcGVybWFu ZW50IChlLmcuLCBhIHVzZXIgYWNjb3VudCkgb3IgdGVtcG9yYXJ5IChlLmcuLCBhbiBIVFRQIHNl c3Npb24pIGluIG5hdHVyZS7igJ0gVGhlcmUgYXJlIHBsZW50eSBvZiB1c2UgY2FzZXMgZm9yIGV2 ZW50cyB3aGVyZSB0aGUgc3ViamVjdHMgYXJlIHRlbXBvcmFyeS9lcGhlbWVyYWw6DQoNCiAgMS4g IFNlc3Npb24gdGVybWluYXRpb24NCiAgMi4gIENoYW5nZXMgaW4gdGhlIHNlY3VyaXR5IHBvc3R1 cmUgZm9yIGEgc2Vzc2lvbg0KICAzLiAgVG9rZW4gcmV2b2NhdGlvbg0KICA0LiAgQXN5bmNocm9u b3VzIGFwcHJvdmFsIG9mIGEgcmVxdWVzdA0KICA1LiAgQ2hhbmdlcyBpbiB0aGUgc3RhdGUgb2Yg YSB0cmFuc2FjdGlvbg0K4oCmZXRjLg0KDQpXaGV0aGVyIG9yIG5vdCBpdCBtYWtlcyBzZW5zZSB0 byBpZGVudGlmeSBhIHNlc3Npb24gc3ViamVjdCB1c2luZyBhIFNBTUwgYXNzZXJ0aW9uIElEIChv ciBhbiBJRCBUb2tlbiDigJxqdGnigJ0gY2xhaW0sIGluIHRoZSBPSURDIHdvcmxkKSBpcyBhIHNl cGFyYXRlIHF1ZXN0aW9uLiBBZGRpbmcgc2VtYW50aWNzIHRvIGV4aXN0aW5nIGlkZW50aWZpZXJz IHRlbmRzIHRvIGxlYWQgdG8gbG90cyBvZiB1bmZvcmVzZWVuIGNvbXBsaWNhdGlvbnMsIGFuZCBk ZXBlbmQgb24gYXNzdW1wdGlvbnMgdGhhdCBkb27igJl0IGFsd2F5cyBob2xkIHRydWUuIEluIHRo aXMgY2FzZSwgdGhlcmUgc2VlbXMgdG8gYmUgYW4gYXNzdW1wdGlvbiB0aGF0IHRoZXJlIGlzIGEg MToxIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIGEgU0FNTCBhc3NlcnRpb24gYW5kIGEgc2Vzc2lvbi4g VGhpcyBpcyBub3QgYWx3YXlzIHRoZSBjYXNlLg0KDQpSZWdhcmRsZXNzLCBhIFNBTUwgYXNzZXJ0 aW9uIElEIGlzIGNsZWFybHkgYW4gYXBwcm9wcmlhdGUgaWRlbnRpZmllciB3aGVuIHRoZSBzdWJq ZWN0IGlzIGEgU0FNTCBhc3NlcnRpb24uIEkgZG9u4oCZdCBrbm93IG9mZmhhbmQgaWYgdGhlcmUg YXJlIGFueSB1c2UgY2FzZXMgZm9yIGV2ZW50cyByZWxhdGluZyB0byBhIFNBTUwgYXNzZXJ0aW9u IGl0c2VsZi4gSSBjYW4gY2VydGFpbmx5IHNlZSB1c2UgY2FzZXMgZm9yIGV2ZW50cyByZWxhdGVk IHRvIEpXVHMgKGUuZy4sIHJldm9jYXRpb24gb2YgYSBKV1QgYWNjZXNzIHRva2VuKSwgd2hlcmUg YSDigJxqdGnigJ0gc3ViamVjdCBpZGVudGlmaWVyIHR5cGUgd291bGQgYmUgYXBwcm9wcmlhdGUu IEnigJltIGluY2xpbmVkIHRvIGFkZCBpdCB0byB0aGUgZHJhZnQsIGlmIGZvciBubyBvdGhlciBy ZWFzb24gdGhhbiB0byBwcm92aWRlIGEgbm9ybWF0aXZlIGRlbW9uc3RyYXRpb24gb2YgYSBzdWJq ZWN0IGlkZW50aWZpZXIgdGhhdCB3b3VsZCBiZSB1c2VkIHRvIGlkZW50aWZ5IGEgbW9yZSBlcGhl bWVyYWwgc3ViamVjdC4NCg0K4oCTDQpBbm5hYmVsbGUgQmFja21hbiAoc2hlL2hlcikNCkFXUyBJ ZGVudGl0eQ0KaHR0cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS8NCg0KDQpGcm9tOiBJZC1l dmVudCA8aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIEF0dWwgVHVsc2hp YmFnd2FsZSA8YXR1bHR1bHNoaT00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc+DQpEYXRlOiBX ZWRuZXNkYXksIEp1bHkgMTUsIDIwMjAgYXQgMTI6NDcgUE0NClRvOiAiUmljaGFyZCBCYWNrbWFu LCBBbm5hYmVsbGUiIDxyaWNoYW5uYT00MGFtYXpvbi5jb21AZG1hcmMuaWV0Zi5vcmc+DQpDYzog WWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPiwgQnJpYW4gQ2FtcGJlbGwgPGJj YW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPiwgQ2hyaXMgUGhpbGxpcHMgPENocmlzLlBoaWxsaXBz QGNhbmFyaWUuY2E+LCAiaWQtZXZlbnRAaWV0Zi5vcmciIDxpZC1ldmVudEBpZXRmLm9yZz4NClN1 YmplY3Q6IFJFOiBbRVhURVJOQUxdIFtJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIg dHlwZQ0KDQoNCkNBVVRJT046IFRoaXMgZW1haWwgb3JpZ2luYXRlZCBmcm9tIG91dHNpZGUgb2Yg dGhlIG9yZ2FuaXphdGlvbi4gRG8gbm90IGNsaWNrIGxpbmtzIG9yIG9wZW4gYXR0YWNobWVudHMg dW5sZXNzIHlvdSBjYW4gY29uZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlz IHNhZmUuDQoNCg0KSG93IGRvIHdlIHByb3Bvc2UgdG8gc3VwcG9ydCB0aGUgdHdvIHN1YmplY3Qg dHlwZXMgZGVmaW5lZCBpbiB0aGUgT0F1dGggRXZlbnQgVHlwZXM8aHR0cHM6Ly9vcGVuaWQubmV0 L3NwZWNzL29hdXRoLWV2ZW50LXR5cGVzLTFfMC1JRDEuaHRtbD4gc3BlYyBoZXJlPw0KDQpPbiBU dWUsIEp1bCAxNCwgMjAyMCBhdCA0OjU0IFBNIFJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlIDxy aWNoYW5uYT00MGFtYXpvbi5jb21AZG1hcmMuaWV0Zi5vcmc8bWFpbHRvOjQwYW1hem9uLmNvbUBk bWFyYy5pZXRmLm9yZz4+IHdyb3RlOg0KVGhlIFJJU0MgUHJvZmlsZeKAmXMg4oCcSUQgVG9rZW4g Q2xhaW1z4oCdIHR5cGUgZG9lcyBub3QgaWRlbnRpZnkgYSBzdWJqZWN0IHRoYXQgaXMgYW4gSUQg VG9rZW4sIGl0IGlkZW50aWZpZXMgYSBzdWJqZWN0IHRoYXQgd2FzIHRoZSBzdWJqZWN0IG9mIGFu IElEIFRva2VuLiBJdCB3YXMgaW50ZW5kZWQgZm9yIGNhc2VzIHdoZXJlIHRoZSBPUCBzZW50IG11 bHRpcGxlIGlkZW50aWZpZXJzIG9mIGRpZmZlcmVudCB0eXBlcyBpbiB0aGUgSUQgVG9rZW4gKGUu Zy4sIGlzcytzdWIgYW5kIGVtYWlsKSwgYW5kIGRvZXMgbm90IGtub3cgd2hpY2ggb2YgdGhlbSB0 aGUgY2xpZW50IHdpbGwgcmVjb2duaXplICh5ZXMsIHRoZSBzaG91bGQgdXNlIGlzcytzdWI7IG5v LCB0aGV5IGRvZXNu4oCZdCBhbHdheXMgZG8gc28pLiBUaGlzIHR5cGUgd2FzIHJlcGxhY2VkIGlu IGRyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVjdC1pZGVudGlmaWVycy0wMyB3aXRoIHRoZSDigJxh bGlhc2Vz4oCdIHR5cGUsIHdoaWNoIGlzIGEgZ2VuZXJhbCBzb2x1dGlvbiB0byB0aGlzIHByb2Js ZW0gdGhhdCBpcyBub3QgZGVmaW5lZCBpbiB0ZXJtcyBvZiBvbmUgcGFydGljdWxhciB1c2UgY2Fz ZSAoaS5lLiwgSUQgVG9rZW5zKS4NCg0KVGhlIE9JREYgU1NFIHdvcmtpbmcgZ3JvdXDigJlzIE9B dXRoIEV2ZW50IFR5cGVzIGRyYWZ0PGh0dHBzOi8vb3BlbmlkLm5ldC9zcGVjcy9vYXV0aC1ldmVu dC10eXBlcy0xXzAtSUQxLmh0bWwjcmZjLnNlY3Rpb24uMi4xPiBkZWZpbmVzIGEg4oCcb2F1dGhf dG9rZW7igJ0gdHlwZSB0aGF0IGlkZW50aWZpZXMgYSBzdWJqZWN0IHRoYXQgaXMgYW4gT0F1dGgg Mi4wIHRva2VuLCBhbmQgZG9lcyBzbyB1c2luZyBlaXRoZXIgdGhlIGZ1bGwgb3IgcGFydGlhbCBw bGFpbiB0ZXh0IHZhbHVlIG9mIHRoZSB0b2tlbiwgb3IgYSBoYXNoIG9mIHRoZSB0b2tlbi4uDQoN Ckl0IGlzIHBlcmZlY3RseSBmaW5lIGZvciBhIHRva2VuIHRvIGJlIHRoZSBzdWJqZWN0IG9mIGEg c2VjdXJpdHkgZXZlbnQuIDg0MTc8aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvcmZjL3JmYzg0 MTcuaHRtbCNzZWN0aW9uLTIuMj4gYWN0dWFsbHkgaW5jbHVkZXMgdGhlIGZvbGxvd2luZyBhcyBh biBleGFtcGxlIG9mIGEgcG9zc2libGUgdmFsdWUgZm9yIHRoZSDigJxzdWLigJ0gY2xhaW06DQoq ICBhIHRva2VuIGlkZW50aWZpZXIgKGUuZy4gImp0aSIpIGZvciBhIHJldm9rZWQgdG9rZW4uDQoN CuKAkw0KQW5uYWJlbGxlIEJhY2ttYW4gKHNoZS9oZXIpDQpBV1MgSWRlbnRpdHkNCmh0dHBzOi8v YXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvDQoNCg0KRnJvbTogSWQtZXZlbnQgPGlkLWV2ZW50LWJv dW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBiZWhh bGYgb2YgQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpPTQwZ29vZ2xlLmNvbUBkbWFyYy5p ZXRmLm9yZzxtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPj4NCkRhdGU6IFR1ZXNk YXksIEp1bHkgMTQsIDIwMjAgYXQgNDozMiBQTQ0KVG86IEJyaWFuIENhbXBiZWxsIDxiY2FtcGJl bGxAcGluZ2lkZW50aXR5LmNvbTxtYWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20+Pg0K Q2M6IFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNvbTxtYWlsdG86eWFyb25mLmll dGZAZ21haWwuY29tPj4sIENocmlzIFBoaWxsaXBzIDxDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNh PG1haWx0bzpDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPj4sICJpZC1ldmVudEBpZXRmLm9yZzxt YWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+IiA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2 ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJFOiBbRVhURVJOQUxdIFtJZC1ldmVudF0gU0FNTCBz dWJqZWN0IGlkZW50aWZpZXIgdHlwZQ0KDQoNCkNBVVRJT046IFRoaXMgZW1haWwgb3JpZ2luYXRl ZCBmcm9tIG91dHNpZGUgb2YgdGhlIG9yZ2FuaXphdGlvbi4gRG8gbm90IGNsaWNrIGxpbmtzIG9y IG9wZW4gYXR0YWNobWVudHMgdW5sZXNzIHlvdSBjYW4gY29uZmlybSB0aGUgc2VuZGVyIGFuZCBr bm93IHRoZSBjb250ZW50IGlzIHNhZmUuDQoNCg0KSU1PIGlmIHdlIGhhdmUgYSBjb21tb24gZW5v dWdoIHVzZS1jYXNlIHRoYXQgcmVxdWlyZXMgYSBzcGVjaWZpYyB0eXBlIHRvIGJlIGRlZmluZWQs IHRoZW4gd2Ugc2hvdWxkIGRlZmluZSB0aGF0IHR5cGUgaW4gdGhlIHNwZWMgcmF0aGVyIHRoYW4g cmVseSBvbiBhbiBpbnRlcnByZXRhdGlvbiBvZiB0aGUgImlzcy1zdWIiIHR5cGUsIHNpbmNlIHRo YXQgaW50ZXJwcmV0YXRpb24gY2FuIGNhdXNlIGluY29tcGF0aWJpbGl0aWVzLg0KDQpJbiB0aGlz IHNwZWNpZmljIGNhc2UgaG93ZXZlciBJIGZlZWwgdGhhdCB0aGUgdXNlIGNhc2VzIG91dGxpbmVk IGluIG15IHByZXZpb3VzIGVtYWlsIGNhbiBiZSBhY2hpZXZlZCAod2l0aCBsaW1pdGF0aW9ucykg dXNpbmcgdGhlIGR1cmFibGUgc3ViamVjdCB0eXBlcyBzdWNoIGFzIGVtYWlsLiBJJ2QgbGlrZSB0 aGUgbWVtYmVycyBvZiB0aGUgU1NFIHdvcmtpbmcgZ3JvdXAgdG8gY2hpbWUgaW4gKHNpbmNlIHRo YXQgaXMgd2hlcmUgdGhpcyBnb3QgYWRkZWQpLCBvciB3ZSBjYW4gZHJvcCB0aGUgU0FNTCBzdWJq ZWN0IGlkZW50aWZpZXIgdHlwZS4NCg0KT24gVHVlLCBKdWwgMTQsIDIwMjAgYXQgNDowOSBQTSBC cmlhbiBDYW1wYmVsbCA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb208bWFpbHRvOmJjYW1wYmVs bEBwaW5naWRlbnRpdHkuY29tPj4gd3JvdGU6DQorIDEgdG8gd2hhdCBZYXJvbiBpcyBzYXlpbmcg aGVyZS4gSSdkIGluY2x1ZGUgYWxzbyB0aGUgImlzcy1zdWIiIHN1YmplY3QgaWRlbnRpZmllciB0 eXBlIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXN1Ympl Y3QtaWRlbnRpZmllcnMtMDUjc2VjdGlvbi0zLjQgYXMgYWxyZWFkeSBoYXZpbmcgc2VtYW50aWNz IGNvdmVyaW5nIHdoYXQncyBkZXNjcmliZWQgaW4gdGhlIElEIFRva2VuIENsYWltcyBTdWJqZWN0 IElkZW50aWZpZXIgVHlwZSBpbiB0aGUgUklTQyBkb2N1bWVudCByZWZlcmVuY2VkLiBBbmQgYWxs IHRob3NlIHRoaW5ncyByZXByZXNlbnQgYSBkdXJhYmxlIHN1YmplY3QgcmF0aGVyIHRoYW4gYSBz ZXNzaW9uLCB3aGljaCBzdHJpa2VzIG1lIGFzIGFwcHJvcHJpYXRlIGZvciBhIGRvY3VtZW50IHRo YXQgZGVzY3JpYmVzIGlkZW50aWZ5aW5nIHN1YmplY3RzLiBBIFNBTUwgYXNzZXJ0aW9uIElELCBo b3dldmVyLCB3aGljaCBpcyBhbiBpZGVudGlmaWVyIG9mIGFuIFhNTCBkb2N1bWVudCB0aGF0IGlz IG9ubHkgaW5kaXJlY3RseSByZWxhdGVkIHRvIGEgc2Vzc2lvbiBieSBhbiBhc3NvY2lhdGlvbiB0 aGF0IGxpa2VseSBpc24ndCBtYWludGFpbmVkLCBkb2VzIG5vdCBzZWVtIGFwcHJvcHJpYXRlIGFz IGEgInN1YmplY3QgaWRlbnRpZmllciIuDQoNCk9uIFR1ZSwgSnVsIDE0LCAyMDIwIGF0IDQ6MDEg UE0gWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0bzp5YXJvbmYuaWV0 ZkBnbWFpbC5jb20+PiB3cm90ZToNCkhpIEF0dWwsDQoNClRoZSBJRCBUb2tlbiBzdWJqZWN0IHR5 cGUsIGFzIGRlc2NyaWJlZCBpbiB0aGUgZG9jdW1lbnQgeW91IGFyZSByZWZlcmVuY2luZywgZG9l cyBub3QgYWRkIGFueSBzZW1hbnRpY3MsIGNvbXBhcmVkIHRvIGEg4oCccGhvbmUgbnVtYmVy4oCd IG9yIOKAnGVtYWls4oCdIHN1YmplY3QgdHlwZS4gU28gSSBkb27igJl0IHNlZSB0aGUgdmFsdWUg aW4gYWRkaW5nIGl0Lg0KDQpJbiBhZGRpdGlvbiwgaXQgZG9lcyBub3QsIGFjdHVhbGx5LCBkZXNj cmliZSBhbiBJRCBUb2tlbi4gSW4gZmFjdCB0aGUgdGV4dCBpcyB2ZXJ5IGNsZWFyIHRoYXQgaXQg ZGVzY3JpYmVzIGEg4oCcc3ViamVjdOKAnSAoYSBkdXJhYmxlIGVudGl0eSkgcmF0aGVyIHRoYW4g YSBzZXNzaW9uLCBhbmQgZG9lcyBpdCBieSBjaXRpbmcgdmFyaW91cyBjbGFpbXMgaW5jbHVkZWQg aW4gdGhlIElEIHRva2VuLiBTbyBhcyBhIHN1YmplY3QgaWRlbnRpZmllciB0eXBlLCBpdCBpcyBu b3QgYXQgYWxsIGVxdWl2YWxlbnQgdG8gYSBTQU1MIGFzc2VydGlvbi4NCg0KQXMgdG8gdGhlIFNB TUwgQXNzZXJ0aW9uIHN1YmplY3QgdHlwZSwgSSB0aGluayB0aGVzZSB1c2UgY2FzZXMgY291bGQg YmUgYWRkcmVzc2VkIGJ5IGFkZGluZyBpbmZvcm1hdGlvbiB0byB0aGUgZXZlbnQuDQoNClRoYW5r cywNCiAgICAgICAgICAgICAgICBZYXJvbg0KDQpGcm9tOiBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0 dWx0dWxzaGlAZ29vZ2xlLmNvbTxtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tPj4NCkRhdGU6 IFR1ZXNkYXksIEp1bHkgMTQsIDIwMjAgYXQgMjM6MjYNClRvOiBZYXJvbiBTaGVmZmVyIDx5YXJv bmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbT4+DQpDYzogQ2hy aXMgUGhpbGxpcHMgPENocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E8bWFpbHRvOkNocmlzLlBoaWxs aXBzQGNhbmFyaWUuY2E+PiwgImlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRm Lm9yZz4iIDxpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KU3Vi amVjdDogUmU6IFtJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZQ0KDQpIaSBZ YXJvbiwNClRoZXJlIGFyZSBhIGZldyBTU0UgdXNlIGNhc2VzIHdoZXJlIHRoZSBldmVudHMgYXJl IGFib3V0IGEgc3BlY2lmaWMgc2luZ2xlIHNpZ24tb24gc2Vzc2lvbi4gWW91J3JlIHJpZ2h0IHRo YXQgdGhpcyBzaG91bGQgbm90IGJlIGxpbWl0ZWQgdG8gU0FNTC4gVGhlIFJJU0MgcHJvZmlsZSBv ZiBTRVRzIChiYXNlZCBvbiB3aGljaCB3ZSBhcmUgZG9pbmcgdGhlIFNTRSB3b3JrKSBoYWQgdGhl IElEIFRva2VuIHN1YmplY3QgaWRlbnRpZmllciB0eXBlLCB3aGljaCBmb3Igc29tZSByZWFzb24g aXMgbWlzc2luZyBpbiB0aGlzIHNwZWMgKEkgZGlkIG5vdCByZWFsaXplIHVudGlsIG5vdykuIFRo ZSBzcGVjaWZpYyBldmVudHMgdGhhdCBuZWVkIHRvIHJlZmVyIHRvIHNlc3Npb25zIGFyZToNCuKA oiAgICAgICAgIElkZW50aXR5IHByb3ZpZGVyIGNvbnRleHQgY2hhbmdlOiBUaGUgY29uZGl0aW9u cyB1bmRlciB3aGljaCBhIFNBTUwgYXNzZXJ0aW9uIG9yIE9JREMgdG9rZW4gd2FzIGdlbmVyYXRl ZCBhcmUgbm8gbG9uZ2VyIHZhbGlkLiBUaGlzIGNhbiBiZSBkdWUgdG8gdmFyaW91cyB0aGluZ3Ms IGluY2x1ZGluZyBhIHBhc3N3b3JkIGNoYW5nZS4NCuKAoiAgICAgICAgIFNlc3Npb24gcHJvcGVy dHkgY2hhbmdlOiBBIHNlc3Npb24gaGFzIGJlZW4gZGV0ZXJtaW5lZCB0byBoYXZlIGJlZW4gY29t cHJvbWlzZWQNCuKAoiAgICAgICAgIFJldm9jYXRpb246IFRoZSBpc3N1ZXIgb2YgdGhlIHNpbmds ZSBzaWduLW9uIFNBTUwgYXNzZXJ0aW9uIG9yIElEIFRva2VuIG5lZWRzIHRvIGJlIHJldm9rZQ0K SSBjYW4gYWxzbyBhZGQgdGhlIElEIFRva2VuIGNsYWltIGZyb20gdGhlIFJJU0MgcHJvZmlsZTxo dHRwczovL2JpdGJ1Y2tldC5vcmcvb3BlbmlkL3Jpc2Mvc3JjL21hc3Rlci9vcGVuaWQtcmlzYy1w cm9maWxlLTFfMC50eHQjbGluZXMtMjUwPiB0byBteSBwdWxsIHJlcXVlc3QuDQoNClRoYW5rcywN CkF0dWwNCg0KDQpPbiBUdWUsIEp1bCAxNCwgMjAyMCBhdCAxMjozMiBQTSBZYXJvbiBTaGVmZmVy IDx5YXJvbmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9uZi4uaWV0ZkBnbWFpbC5jb20+PiB3 cm90ZToNCkkgbmVlZCBhIGxvdCBtb3JlIGNvbnRleHQgaGVyZS4gU28gZmFyLCBzdWJqZWN0IElE cyBoYXZlIGRlbm90ZWQgZHVyYWJsZSBlbnRpdGllcywgc3VjaCBhcyBlbWFpbCBhZGRyZXNzZXMs IHBob25lIG51bWJlcnMsIGFjY291bnQuIFRoaXMgaXMgYWRkaW5nIGEgc3ViamVjdCBJRCB0aGF0 IGRlbm90ZXMgYW4gZXBoZW1lcmFsIGVudGl0eSwgYmFzaWNhbGx5IHNpbWlsYXIgdG8gYSBzZXNz aW9uIElELiBUaGlzIGxvb2tzIHdlaXJkIGZyb20gYW4gYXJjaGl0ZWN0dXJhbCBwb2ludCBvZiB2 aWV3LCBhbmQgYWxzbyBiZWdzIHRoZSBxdWVzdGlvbiwgd2h5IHNwZWNpZmljYWxseSBTQU1MIGFu ZCBub3Qgb3RoZXIgc2Vzc2lvbiB0eXBlcy4NCg0KVGhhbmtzLA0KICAgICAgICAgICAgICAgIFlh cm9uDQoNCkZyb206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpp ZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPj4gb24gYmVoYWxmIG9mIEF0dWwgVHVsc2hpYmFnd2Fs ZSA8YXR1bHR1bHNoaT00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc8bWFpbHRvOjQwZ29vZ2xl LmNvbUBkbWFyYy5pZXRmLi5vcmc+Pg0KRGF0ZTogVHVlc2RheSwgSnVseSAxNCwgMjAyMCBhdCAw MDoxNA0KVG86IENocmlzIFBoaWxsaXBzIDxDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPG1haWx0 bzpDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPj4NCkNjOiAiaWQtZXZlbnRAaWV0Zi5vcmc8bWFp bHRvOmlkLWV2ZW50QGlldGYub3JnPiIgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVu dEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBTQU1MIHN1YmplY3QgaWRlbnRp ZmllciB0eXBlDQoNCkp1c3QgY2xhcmlmeWluZyB0aGUgcHJvcG9zYWwgYXMgaXQgc3RhbmRzIHRv ZGF5IChiZWZvcmUgaW5jb3Jwb3JhdGluZyBDaHJpcydzIGlucHV0KToNClRoZSBmb2xsb3dpbmcg c2VjdGlvbiBzaG91bGQgYmUgYWRkZWQgaW4gdGhlICJTdWJqZWN0IElkZW50aWZpZXIgVHlwZXMi IHNlY3Rpb246DQo0LjkuICBTQU1MIFN1YmplY3QgSWRlbnRpZmllciBUeXBlDQoNCiAgIFRoZSBT QU1MIFtTQU1MLlJFRl0gU3ViamVjdCBJZGVudGlmaWVyIFR5cGUgZGVzY3JpYmVzIGEgc3ViamVj dCBieQ0KICAgdGhlIGFzc2VydGlvbiBpZGVudGlmaWVyIGluIHRoZSBTQU1MIGFzc2VydGlvbiB0 aGF0IHdhcyB1c2VkIHRvDQogICBjb252ZXkgdGhlIHN1YmplY3QncyBpbmZvcm1hdGlvbiB0byB0 aGUgUmVjZWl2ZXIuICBTdWJqZWN0DQogICBJZGVudGlmaWVycyBvZiB0aGlzIHR5cGUgTVVTVCBj b250YWluIGFuIGAgYXNzZXJ0aW9uX2lkImNsYWltLiAgVGhlDQogICB2YWx1ZSBvZiB0aGlzIGNs YWltIGlzIGEgc3RyaW5nIHRoYXQgaXMgZXF1YWwgdG8gdGhlIEFzc2VydGlvbg0KICAgSWRlbnRp ZmllciBpbiB0aGUgU0FNTCBhc3NlcnRpb24uICBUaGUgU0FNTCBTdWJqZWN0IElkZW50aWZpZXIg VHlwZQ0KICAgaXMgaWRlbnRpZmllZCBieSB0aGUgbmFtZSAic2FtbGAuDQoNCiAgIEJlbG93IGlz IGEgbm9uLW5vcm1hdGl2ZSBleGFtcGxlIFN1YmplY3QgSWRlbnRpZmllciBmb3IgdGhlIFNBTUwN CiAgIFN1YmplY3QgSWRlbnRpZmllciBUeXBlOg0KDQogICB7DQogICAgICJzdWJqZWN0X3R5cGUi OiAic2FtbCIsDQogICAgICJhc3NlcnRpb25faWQiOiAiX2Y1NTFkODg5NjNhYjRlM2RlY2I3Y2Zl OGY0ZGNjM2Y1IiwNCiAgIH0NCg0KICAgICBGaWd1cmUgODogRXhhbXBsZTogU3ViamVjdCBJZGVu dGlmaWVyIGZvciBTQU1MIFN1YmplY3QgSWRlbnRpZmllcg0KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBUeXBlLg0KDQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIwIGF0IDE6MjIgUE0g QXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpQGdvb2dsZS5jb208bWFpbHRvOmF0dWx0dWxz aGlAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KSGkgQ2hyaXMsDQpJIHdhcyBwcm9wb3NpbmcgdXNpbmcg dGhlICJhc3NlcnRpb24gaWQiIChTQU1MIENvcmU8aHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcv c2VjdXJpdHkvc2FtbC92Mi4wL3NhbWwtY29yZS0yLjAtb3MucGRmPiBzcGVjLCBsaW5lIDU1Mykg aW4gdGhlIHByb3Bvc2FsLCBub3QgdGhlICJzdWJqZWN0LWlkIiBhcyBkZWZpbmVkIGluIFNBTUwg KHNwZWMgc2VjdGlvbiAzLjMpLiBUaGUgbWFpbiByZWFzb24gd2FzIHRvIGJlIGFibGUgdG8gcmVm ZXIgdG8gYSBzZXNzaW9uIHRoYXQgd2FzIGVzdGFibGlzaGVkIHVzaW5nIGEgc3BlY2lmaWMgYXNz ZXJ0aW9uLiBJZiBpdCdzIHVzZWZ1bCwgd2UgY291bGQgcGVyaGFwcyBleHRlbmQgdGhlIFNBTUwg c3ViamVjdCBpZGVudGlmaWVyIHR5cGUgaW4gdGhpcyBzcGVjIHRvIGluY2x1ZGUgZWl0aGVyIHRo ZSBhc3NlcnRpb25faWQgb3IgdGhlIHN1YmplY3RfaWQgY2xhaW0uDQoNClRoYW5rcywNCkF0dWwN Cg0KDQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCAxMDozMCBBTSBDaHJpcyBQaGlsbGlwcyA8Q2hy aXMuUGhpbGxpcHNAY2FuYXJpZS5jYTxtYWlsdG86Q2hyaXMuLlBoaWxsaXBzQGNhbmFyaWUuY2E+ PiB3cm90ZToNCkhpLg0KUXVpZXQgbHVya2VyIG9ic2VydmluZy4uDQpUaGFua3MgZm9yIGNvbnNp ZGVyIHRoZSBTQU1MIGVsZW1lbnRzLi4NCg0KQXR1bCwgYXJlIHlvdSByZWZlcnJpbmcgdG8gdGhl IGFjdHVhbCBzZXNzaW9uIGlkZW50aWZpZXIgdGhhdCBzb21lb25lIG1heSBoYXZlIHdoZXJlIHRo ZSBTdWJqZWN0LUlkIHdhcyBleGNoYW5nZWQgT1IgdGhlIGFjdHVhbCBTdWJqZWN0LWlkIGl0c2Vs ZiBpbiB5b3VyIHJlZmVyZW5jZSBpbiB0aGUgcHJvcG9zYWwgd2l0aCB0aGUgZ2l0aHViIGxpbms/ DQoNCknigJltIHRyeWluZyB0byBzcXVhcmUgd2hhdCBJIHNlZSBvbiB0aGUgZ2l0IGRlbHRhIG9u IGxpbmUgMjk0LTI5NiBpbiBodHRwczovL2dpdGh1Yi4uLmNvbS9yaWNoYW5uYS9zZWNldmVudC9w dWxsLzEvY29tbWl0cy9iMjBiNjY5MmViNTA2Mjg5Mjc0NzZjYTc4ZjliZTA3N2FjZTg4OTk0PGh0 dHBzOi8vZ2l0aHViLmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzEvY29tbWl0cy9iMjBiNjY5 MmViNTA2Mjg5Mjc0NzZjYTc4ZjliZTA3N2FjZTg4OTk0Pg0KDQoNCkFuZCBhIFN1YmplY3QtaWQg YXMgc2hvd24gaW4gdGhlIGV4YW1wbGUgaW4gMy4zLjMgaGVyZTogaHR0cHM6Ly9kb2NzLm9hc2lz LW9wZW4ub3JnL3NlY3VyaXR5L3NhbWwtc3ViamVjdC1pZC1hdHRyL3YxLjAvY3MwMS9zYW1sLXN1 YmplY3QtaWQtYXR0ci12MS4wLWNzMDEuaHRtbCNfVG9jNTM2MDk3MjI5PGh0dHBzOi8vZG9jcy5v YXNpcy1vcGVuLm9yZy9zZWN1cml0eS9zYW1sLXN1YmplY3QtaWQtYXR0ci92MS4wL2NzMDEvc2Ft bC1zdWJqZWN0LWlkLWF0dHItdjEuLjAtY3MwMS4uaHRtbCNfVG9jNTM2MDk3MjI5Pg0KDQpXaGF0 IHlvdSBvZmZlcmVkIGluIHRoZSBleGFtcGxlIGlzIG5vdCBhIFN1YmplY3QtaWQgIHBlciB0aGUg T0FTSVMgU0FNTCBzcGVjIGFzIHdyaXR0ZW4gaW4gc2VjdGlvbiAzLjMuMQ0KDQpBbSBJIG1pcy1p bnRlcnByZXRpbmcgc29tZXRoaW5nPw0KDQpDDQoNCg0KRnJvbTogSWQtZXZlbnQgPGlkLWV2ZW50 LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBi ZWhhbGYgb2YgQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpPTQwZ29vZ2xlLmNvbUBkbWFy Yy5pZXRmLm9yZzxtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPj4NCkRhdGU6IE1v bmRheSwgSnVseSAxMywgMjAyMCBhdCAxMjoxNyBQTQ0KVG86ICJpZC1ldmVudEBpZXRmLm9yZzxt YWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+IiA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2 ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFtJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50aWZp ZXIgdHlwZQ0KDQpIaSBhbGwsDQpCYXNlZCBvbiB0aGUgZGlzY3Vzc2lvbnMgaW4gdGhlIFNTRSB3 b3JraW5nIGdyb3VwIHdpdGhpbiB0aGUgT3BlbklEIEZvdW5kYXRpb24sIHdlIHdvdWxkIGxpa2Ug dG8gcHJvcG9zZSB0aGF0IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgc3BlY2lmaWNhdGlvbiBpbmNs dWRlIGEgU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZS4gVGhpcyBpcyBzbyB0aGF0IHNlc3Np b25zIGVzdGFibGlzaGVkIGFjcm9zcyBwZWVycyB1c2luZyBTQU1MIG1heSBiZSBpZGVudGlmaWVk IGluIGV2ZW50cyB0aGF0IGluY2x1ZGUgdGhlIHN1YmplY3QgaWRlbnRpZmllci4NCg0KIEEgU0FN TCBzdWJqZWN0IGlkZW50aWZpZXIgaGFzIG9ubHkgb25lIGNsYWltIHdpdGhpbiBpdCwgdGhlIGFz c2VydGlvbiBpZCBvZiB0aGUgU0FNTCBhc3NlcnRpb24gdXNlZCB0byBlc3RhYmxpc2ggdGhlIHNp bmdsZSBzaWduLW9uIHNlc3Npb24uDQoNClRoaXMgY2hhbmdlIGlzIGFsc28gaW5jbHVkZWQgaW4g bXkgcHJvcG9zYWwgaGVyZTxodHRwczovL2dpdGh1Yi5jb20vcmljaGFubmEvc2VjZXZlbnQvcHVs bC8xPi4NCg0KVGhhbmtzLA0KQXR1bA0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9y ZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2lkLWV2ZW50DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXyBJZC1ldmVudCBtYWlsaW5nIGxpc3QgSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRv OklkLWV2ZW50QGlldGYub3JnPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L2lkLWV2ZW50DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZl bnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2 ZW50DQoNCkNPTkZJREVOVElBTElUWSBOT1RJQ0U6IFRoaXMgZW1haWwgbWF5IGNvbnRhaW4gY29u ZmlkZW50aWFsIGFuZCBwcml2aWxlZ2VkIG1hdGVyaWFsIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhl IGludGVuZGVkIHJlY2lwaWVudChzKS4gQW55IHJldmlldywgdXNlLCBkaXN0cmlidXRpb24gb3Ig ZGlzY2xvc3VyZSBieSBvdGhlcnMgaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4uICBJZiB5b3UgaGF2 ZSByZWNlaXZlZCB0aGlzIGNvbW11bmljYXRpb24gaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhl IHNlbmRlciBpbW1lZGlhdGVseSBieSBlLW1haWwgYW5kIGRlbGV0ZSB0aGUgbWVzc2FnZSBhbmQg YW55IGZpbGUgYXR0YWNobWVudHMgZnJvbSB5b3VyIGNvbXB1dGVyLiBUaGFuayB5b3UuDQo= --_000_9CC41112794741E195846DEB625BBEEAamazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIg MiA2IDkgNCAyIDUgOCAzIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBN YXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9u dC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9u dC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQE1TIE1pbmNobyI7DQoJcGFub3NlLTE6MiAyIDYgOSA0 IDIgNSA4IDMgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCXBhbm9z ZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6LWFw cGxlLXN5c3RlbTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIgNDt9DQovKiBTdHlsZSBE ZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0K CXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29I eXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1k ZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJh Z3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsNCglt YXJnaW4tdG9wOjBpbjsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1hcmdpbi1ib3R0b206MGluOw0K CW1hcmdpbi1sZWZ0Oi41aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0 eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4g MS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQov KiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo5MjgxOTQ1NDU7 DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjk1MTQ2MzY4 NiA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2 NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZl bDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWlu ZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2Vy Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30N CkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxl dmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMQ0KCXtt c28tbGlzdC1pZDoxOTEyMzQ1NzA3Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0 LXRlbXBsYXRlLWlkczotMTU5NDk5NTQ2OCAxODk0MzQyOTQgNjc2OTg2OTEgNjc2OTg2OTMgNjc2 OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxp c3QgbDE6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1i b2w7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Ik1TIE1pbmNobyI7DQoJbXNvLWJpZGktZm9u dC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZl bDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpA bGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5 bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZh bWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVs OA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0K QGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpX aW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRv bTowaW47fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJi bHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5JIHRoaW5rIHRoZSB0d28gc3ViamVjdCB0eXBlcyDigJMgdGhlIOKAnG9h dXRoX3Rva2Vu4oCdIHR5cGUgZGVzY3JpYmVkIGluIG15IHByaW9yIGVtYWlsLCBhbmQgYSDigJxv YXV0aF9jbGllbnTigJ0gdHlwZSB0aGF0IGlkZW50aWZpZXMgYSBzdWJqZWN0IGJ5IGl0cyBPQXV0 aCAyLjAgY2xpZW50IElEIOKAkyBhcmUgcmVhc29uYWJsZSB0eXBlcyB0byBkZWZpbmUuIEkgZG9u 4oCZdCBzZWUgYSBwYXJ0aWN1bGFyIG5lZWQgdG8gbW92ZSB0aGVtDQogaW50byB0aGUgYmFzZSBz cGVjIOKAkyB3ZSBkZWZpbmUgYW4gSUFOQSByZWdpc3RyeSBwcmVjaXNlbHkgc28gd2UgZG9u4oCZ dCBoYXZlIHRvIHRyeSB0byBkZWZpbmUgZXZlcnl0aGluZyB1cCBmcm9udCDigJMgYnV0IEnigJlt IG5vdCBvcHBvc2VkIHRvIHRoZSBpZGVhLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J4oCZbSBu b3Qgc3VyZSB3aGVyZSB0aGlzIG5vdGlvbiBvZiBhIOKAnGR1cmFibGUgc3ViamVjdOKAnSBjYW1l IGZyb20uIFJpZ2h0IGluIHRoZSBpbnRyb2R1Y3Rpb24sDQo8YSBocmVmPSJodHRwczovL3d3dy5y ZmMtZWRpdG9yLm9yZy9yZmMvcmZjODQxNy5odG1sI3NlY3Rpb24tMSI+UkZDIDg0MTc8L2E+IHNh eXMgdGhlIHN1YmplY3Qgb2YgYSBzZWN1cml0eSBldmVudCDigJxtYXkgYmUgcGVybWFuZW50IChl LmcuLCBhIHVzZXIgYWNjb3VudCkgb3IgdGVtcG9yYXJ5IChlLmcuLCBhbiBIVFRQIHNlc3Npb24p IGluIG5hdHVyZS7igJ0gVGhlcmUgYXJlIHBsZW50eSBvZiB1c2UgY2FzZXMgZm9yIGV2ZW50cyB3 aGVyZSB0aGUgc3ViamVjdHMNCiBhcmUgdGVtcG9yYXJ5L2VwaGVtZXJhbDo8bzpwPjwvbzpwPjwv cD4NCjxvbCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBj bGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDps MCBsZXZlbDEgbGZvMiI+U2Vzc2lvbiB0ZXJtaW5hdGlvbjxvOnA+PC9vOnA+PC9saT48bGkgY2xh c3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzIiPkNoYW5nZXMgaW4gdGhlIHNlY3VyaXR5IHBvc3R1cmUgZm9yIGEgc2Vzc2lv bjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJn aW4tbGVmdDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPlRva2VuIHJldm9jYXRpb248bzpw PjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MGluO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj5Bc3luY2hyb25vdXMgYXBwcm92YWwgb2Yg YSByZXF1ZXN0PG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMiI+Q2hhbmdlcyBpbiB0 aGUgc3RhdGUgb2YgYSB0cmFuc2FjdGlvbjxvOnA+PC9vOnA+PC9saT48L29sPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+4oCmZXRjLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XaGV0aGVyIG9yIG5v dCBpdCBtYWtlcyBzZW5zZSB0byBpZGVudGlmeSBhIHNlc3Npb24gc3ViamVjdCB1c2luZyBhIFNB TUwgYXNzZXJ0aW9uIElEIChvciBhbiBJRCBUb2tlbiDigJxqdGnigJ0gY2xhaW0sIGluIHRoZSBP SURDIHdvcmxkKSBpcyBhIHNlcGFyYXRlIHF1ZXN0aW9uLiBBZGRpbmcgc2VtYW50aWNzIHRvIGV4 aXN0aW5nIGlkZW50aWZpZXJzIHRlbmRzIHRvIGxlYWQgdG8gbG90cyBvZiB1bmZvcmVzZWVuIGNv bXBsaWNhdGlvbnMsDQogYW5kIGRlcGVuZCBvbiBhc3N1bXB0aW9ucyB0aGF0IGRvbuKAmXQgYWx3 YXlzIGhvbGQgdHJ1ZS4gSW4gdGhpcyBjYXNlLCB0aGVyZSBzZWVtcyB0byBiZSBhbiBhc3N1bXB0 aW9uIHRoYXQgdGhlcmUgaXMgYSAxOjEgcmVsYXRpb25zaGlwIGJldHdlZW4gYSBTQU1MIGFzc2Vy dGlvbiBhbmQgYSBzZXNzaW9uLiBUaGlzIGlzIG5vdCBhbHdheXMgdGhlIGNhc2UuPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlJlZ2FyZGxlc3MsIGEgU0FNTCBhc3NlcnRpb24gSUQgaXMgY2xlYXJs eSBhbiBhcHByb3ByaWF0ZSBpZGVudGlmaWVyIHdoZW4gdGhlIHN1YmplY3QgaXMgYSBTQU1MIGFz c2VydGlvbi4gSSBkb27igJl0IGtub3cgb2ZmaGFuZCBpZiB0aGVyZSBhcmUgYW55IHVzZSBjYXNl cyBmb3IgZXZlbnRzIHJlbGF0aW5nIHRvIGEgU0FNTCBhc3NlcnRpb24gaXRzZWxmLiBJIGNhbiBj ZXJ0YWlubHkgc2VlIHVzZSBjYXNlcyBmb3INCiBldmVudHMgcmVsYXRlZCB0byBKV1RzIChlLmcu LCByZXZvY2F0aW9uIG9mIGEgSldUIGFjY2VzcyB0b2tlbiksIHdoZXJlIGEg4oCcanRp4oCdIHN1 YmplY3QgaWRlbnRpZmllciB0eXBlIHdvdWxkIGJlIGFwcHJvcHJpYXRlLiBJ4oCZbSBpbmNsaW5l ZCB0byBhZGQgaXQgdG8gdGhlIGRyYWZ0LCBpZiBmb3Igbm8gb3RoZXIgcmVhc29uIHRoYW4gdG8g cHJvdmlkZSBhIG5vcm1hdGl2ZSBkZW1vbnN0cmF0aW9uIG9mIGEgc3ViamVjdCBpZGVudGlmaWVy IHRoYXQNCiB3b3VsZCBiZSB1c2VkIHRvIGlkZW50aWZ5IGEgbW9yZSBlcGhlbWVyYWwgc3ViamVj dC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0Ij7igJM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+QW5uYWJlbGxlIEJhY2ttYW4gKHNoZS9oZXIp PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPkFXUyBJZGVudGl0eTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjx1PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9y OiMwNTYzQzEiPjxhIGhyZWY9Imh0dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvIj5odHRw czovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5LzwvYT48L3NwYW4+PC91PjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9w OnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206DQo8L3NwYW4+PC9iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5JZC1ldmVudCAmbHQ7aWQtZXZlbnQtYm91 bmNlc0BpZXRmLm9yZyZndDsgb24gYmVoYWxmIG9mIEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7YXR1 bHR1bHNoaT00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+RGF0ZTogPC9i PldlZG5lc2RheSwgSnVseSAxNSwgMjAyMCBhdCAxMjo0NyBQTTxicj4NCjxiPlRvOiA8L2I+JnF1 b3Q7UmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUmcXVvdDsgJmx0O3JpY2hhbm5hPTQwYW1hem9u LmNvbUBkbWFyYy5pZXRmLm9yZyZndDs8YnI+DQo8Yj5DYzogPC9iPllhcm9uIFNoZWZmZXIgJmx0 O3lhcm9uZi5pZXRmQGdtYWlsLmNvbSZndDssIEJyaWFuIENhbXBiZWxsICZsdDtiY2FtcGJlbGxA cGluZ2lkZW50aXR5LmNvbSZndDssIENocmlzIFBoaWxsaXBzICZsdDtDaHJpcy5QaGlsbGlwc0Bj YW5hcmllLmNhJmd0OywgJnF1b3Q7aWQtZXZlbnRAaWV0Zi5vcmcmcXVvdDsgJmx0O2lkLWV2ZW50 QGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SRTogW0VYVEVSTkFMXSBbSWQtZXZl bnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8dGFibGUgY2xhc3M9Ik1z b05vcm1hbFRhYmxlIiBib3JkZXI9IjAiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIg d2lkdGg9IjYyMiIgc3R5bGU9IndpZHRoOjQ2Ni41cHQ7bWFyZ2luLWxlZnQ6LjVpbjtib3JkZXIt Y29sbGFwc2U6Y29sbGFwc2UiPg0KPHRib2R5Pg0KPHRyIHN0eWxlPSJoZWlnaHQ6MTUuMjVwdCI+ DQo8dGQgd2lkdGg9IjYyMiIgdmFsaWduPSJ0b3AiIHN0eWxlPSJ3aWR0aDo0NjYuNXB0O2JvcmRl cjpzb2xpZCAjRUQ3RDMxIDEuNXB0O3BhZGRpbmc6MGluIDUuNHB0IDBpbiA1LjRwdDtoZWlnaHQ6 MTUuMjVwdCI+DQo8cD48c3Ryb25nPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDojRkZGRjk5Ij5DQVVU SU9OPC9zcGFuPjwvc3Ryb25nPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNG RkZGOTkiPjogVGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZyb20gb3V0c2lkZSBvZiB0aGUgb3JnYW5p emF0aW9uLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Igb3BlbiBhdHRhY2htZW50cyB1bmxlc3MNCiB5 b3UgY2FuIGNvbmZpcm0gdGhlIHNlbmRlciBhbmQga25vdyB0aGUgY29udGVudCBpcyBzYWZlLjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvdGQ+DQo8L3RyPg0KPC90Ym9keT4NCjwvdGFibGU+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkhvdyBkbyB3ZSBwcm9wb3NlIHRvIHN1cHBvcnQgdGhlIHR3 byBzdWJqZWN0IHR5cGVzIGRlZmluZWQgaW4gdGhlDQo8YSBocmVmPSJodHRwczovL29wZW5pZC5u ZXQvc3BlY3Mvb2F1dGgtZXZlbnQtdHlwZXMtMV8wLUlEMS5odG1sIj5PQXV0aCBFdmVudCBUeXBl czwvYT4gc3BlYyBoZXJlPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5P biBUdWUsIEp1bCAxNCwgMjAyMCBhdCA0OjU0IFBNIFJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxl ICZsdDtyaWNoYW5uYT08YSBocmVmPSJtYWlsdG86NDBhbWF6b24uY29tQGRtYXJjLmlldGYub3Jn Ij40MGFtYXpvbi5jb21AZG1hcmMuaWV0Zi5vcmc8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0 LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KVGhlIFJJU0MgUHJvZmlsZeKAmXMg4oCcSUQgVG9rZW4g Q2xhaW1z4oCdIHR5cGUgZG9lcyBub3QgaWRlbnRpZnkgYSBzdWJqZWN0IHRoYXQgaXMgYW4gSUQg VG9rZW4sIGl0IGlkZW50aWZpZXMgYSBzdWJqZWN0IHRoYXQgd2FzIHRoZSBzdWJqZWN0IG9mIGFu IElEIFRva2VuLiBJdCB3YXMgaW50ZW5kZWQgZm9yIGNhc2VzIHdoZXJlIHRoZSBPUCBzZW50IG11 bHRpcGxlIGlkZW50aWZpZXJzIG9mIGRpZmZlcmVudCB0eXBlcyBpbiB0aGUgSUQgVG9rZW4gKGUu Zy4sDQogaXNzJiM0MztzdWIgYW5kIGVtYWlsKSwgYW5kIGRvZXMgbm90IGtub3cgd2hpY2ggb2Yg dGhlbSB0aGUgY2xpZW50IHdpbGwgcmVjb2duaXplICh5ZXMsIHRoZQ0KPGk+c2hvdWxkPC9pPiB1 c2UgaXNzJiM0MztzdWI7IG5vLCB0aGV5IGRvZXNu4oCZdCBhbHdheXMgZG8gc28pLiBUaGlzIHR5 cGUgd2FzIHJlcGxhY2VkIGluIGRyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVjdC1pZGVudGlmaWVy cy0wMyB3aXRoIHRoZSDigJxhbGlhc2Vz4oCdIHR5cGUsIHdoaWNoIGlzIGEgZ2VuZXJhbCBzb2x1 dGlvbiB0byB0aGlzIHByb2JsZW0gdGhhdCBpcyBub3QgZGVmaW5lZCBpbiB0ZXJtcyBvZiBvbmUg cGFydGljdWxhciB1c2UgY2FzZSAoaS5lLiwNCiBJRCBUb2tlbnMpLjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpUaGUgT0lE RiBTU0Ugd29ya2luZyBncm91cOKAmXMgPGEgaHJlZj0iaHR0cHM6Ly9vcGVuaWQubmV0L3NwZWNz L29hdXRoLWV2ZW50LXR5cGVzLTFfMC1JRDEuaHRtbCNyZmMuc2VjdGlvbi4yLjEiIHRhcmdldD0i X2JsYW5rIj4NCk9BdXRoIEV2ZW50IFR5cGVzIGRyYWZ0PC9hPiBkZWZpbmVzIGEg4oCcb2F1dGhf dG9rZW7igJ0gdHlwZSB0aGF0IGlkZW50aWZpZXMgYSBzdWJqZWN0IHRoYXQgaXMgYW4gT0F1dGgg Mi4wIHRva2VuLCBhbmQgZG9lcyBzbyB1c2luZyBlaXRoZXIgdGhlIGZ1bGwgb3IgcGFydGlhbCBw bGFpbiB0ZXh0IHZhbHVlIG9mIHRoZSB0b2tlbiwgb3IgYSBoYXNoIG9mIHRoZSB0b2tlbi4uPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQom bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDou NWluIj4NCkl0IGlzIHBlcmZlY3RseSBmaW5lIGZvciBhIHRva2VuIHRvIGJlIHRoZSBzdWJqZWN0 IG9mIGEgc2VjdXJpdHkgZXZlbnQuIDxhIGhyZWY9Imh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3Jn L3JmYy9yZmM4NDE3Lmh0bWwjc2VjdGlvbi0yLjIiIHRhcmdldD0iX2JsYW5rIj4NCjg0MTc8L2E+ IGFjdHVhbGx5IGluY2x1ZGVzIHRoZSBmb2xsb3dpbmcgYXMgYW4gZXhhbXBsZSBvZiBhIHBvc3Np YmxlIHZhbHVlIGZvciB0aGUg4oCcc3Vi4oCdIGNsYWltOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNr Ij4qJm5ic3A7IGEgdG9rZW4gaWRlbnRpZmllciAoZS5nLiAmcXVvdDtqdGkmcXVvdDspIGZvciBh IHJldm9rZWQgdG9rZW4uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQiPuKAkzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5B bm5hYmVsbGUgQmFja21hbiAoc2hlL2hlcik8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+QVdTIElkZW50aXR5PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4w cHQiPjxhIGhyZWY9Imh0dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvIiB0YXJnZXQ9Il9i bGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwNTYzQzEiPmh0dHBzOi8vYXdzLmFtYXpvbi5jb20v aWRlbnRpdHkvPC9zcGFuPjwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0 REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7 Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4w cHQ7Y29sb3I6YmxhY2siPklkLWV2ZW50ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnQtYm91 bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8 L2E+Jmd0OyBvbiBiZWhhbGYgb2YgQXR1bCBUdWxzaGliYWd3YWxlICZsdDthdHVsdHVsc2hpPTxh IGhyZWY9Im1haWx0bzo0MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij40MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5U dWVzZGF5LCBKdWx5IDE0LCAyMDIwIGF0IDQ6MzIgUE08YnI+DQo8Yj5UbzogPC9iPkJyaWFuIENh bXBiZWxsICZsdDs8YSBocmVmPSJtYWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20iIHRh cmdldD0iX2JsYW5rIj5iY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbTwvYT4mZ3Q7PGJyPg0KPGI+ Q2M6IDwvYj5ZYXJvbiBTaGVmZmVyICZsdDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmlldGZAZ21h aWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZndDssIENo cmlzIFBoaWxsaXBzICZsdDs8YSBocmVmPSJtYWlsdG86Q2hyaXMuUGhpbGxpcHNAY2FuYXJpZS5j YSIgdGFyZ2V0PSJfYmxhbmsiPkNocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E8L2E+Jmd0OywgJnF1 b3Q7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQt ZXZlbnRAaWV0Zi5vcmc8L2E+JnF1b3Q7DQogJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBp ZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3JnPC9hPiZndDs8YnI+DQo8 Yj5TdWJqZWN0OiA8L2I+UkU6IFtFWFRFUk5BTF0gW0lkLWV2ZW50XSBTQU1MIHN1YmplY3QgaWRl bnRpZmllciB0eXBlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIw IiBjZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAiIHdpZHRoPSI2MjIiIHN0eWxlPSJ3aWR0 aDo0NjYuNXB0O21hcmdpbi1sZWZ0OjEuMGluO2JvcmRlci1jb2xsYXBzZTpjb2xsYXBzZSI+DQo8 dGJvZHk+DQo8dHIgc3R5bGU9ImhlaWdodDoxNS4yNXB0Ij4NCjx0ZCB3aWR0aD0iNjIyIiB2YWxp Z249InRvcCIgc3R5bGU9IndpZHRoOjQ2Ni41cHQ7Ym9yZGVyOnNvbGlkICNFRDdEMzEgMS41cHQ7 cGFkZGluZzowaW4gNS40cHQgMGluIDUuNHB0O2hlaWdodDoxNS4yNXB0Ij4NCjxwPjxzdHJvbmc+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkZGOTkiPkNBVVRJT048L3NwYW4+PC9zdHJvbmc+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQ6I0ZGRkY5OSI+OiBUaGlzIGVtYWlsIG9y aWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRpb24uIERvIG5vdCBjbGljayBs aW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcw0KIHlvdSBjYW4gY29uZmlybSB0aGUgc2Vu ZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KSU1PIGlm IHdlIGhhdmUgYSBjb21tb24gZW5vdWdoIHVzZS1jYXNlIHRoYXQgcmVxdWlyZXMgYSBzcGVjaWZp YyB0eXBlIHRvIGJlIGRlZmluZWQsIHRoZW4gd2Ugc2hvdWxkIGRlZmluZSB0aGF0IHR5cGUgaW4g dGhlIHNwZWMgcmF0aGVyIHRoYW4gcmVseSBvbiBhbiBpbnRlcnByZXRhdGlvbiBvZiB0aGUgJnF1 b3Q7aXNzLXN1YiZxdW90OyB0eXBlLCBzaW5jZSB0aGF0IGludGVycHJldGF0aW9uIGNhbiBjYXVz ZSBpbmNvbXBhdGliaWxpdGllcy4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpJ biB0aGlzIHNwZWNpZmljIGNhc2UgaG93ZXZlciBJIGZlZWwgdGhhdCB0aGUgdXNlIGNhc2VzIG91 dGxpbmVkIGluIG15IHByZXZpb3VzIGVtYWlsIGNhbiBiZSBhY2hpZXZlZCAod2l0aCBsaW1pdGF0 aW9ucykgdXNpbmcgdGhlIGR1cmFibGUgc3ViamVjdCB0eXBlcyBzdWNoIGFzIGVtYWlsLiBJJ2Qg bGlrZSB0aGUgbWVtYmVycyBvZiB0aGUgU1NFIHdvcmtpbmcgZ3JvdXAgdG8gY2hpbWUgaW4gKHNp bmNlIHRoYXQgaXMgd2hlcmUgdGhpcyBnb3QgYWRkZWQpLA0KIG9yIHdlIGNhbiBkcm9wIHRoZSBT QU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuMGluIj4NCk9uIFR1ZSwgSnVsIDE0LCAyMDIwIGF0IDQ6MDkgUE0gQnJpYW4gQ2FtcGJl bGwgJmx0OzxhIGhyZWY9Im1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQ7bWFyZ2luLWxl ZnQ6NC4uOHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuMGluIj4NCiYjNDM7IDEgdG8gd2hhdCBZYXJvbiBpcyBzYXlpbmcgaGVyZS4gSSdkIGlu Y2x1ZGUgYWxzbyB0aGUgJnF1b3Q7aXNzLXN1YiZxdW90OyBzdWJqZWN0IGlkZW50aWZpZXIgdHlw ZQ0KPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZl bnQtc3ViamVjdC1pZGVudGlmaWVycy0wNSNzZWN0aW9uLTMuNCIgdGFyZ2V0PSJfYmxhbmsiPg0K aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVjdC1p ZGVudGlmaWVycy0wNSNzZWN0aW9uLTMuNDwvYT4gYXMgYWxyZWFkeSBoYXZpbmcgc2VtYW50aWNz IGNvdmVyaW5nIHdoYXQncyBkZXNjcmliZWQgaW4gdGhlIElEIFRva2VuIENsYWltcyBTdWJqZWN0 IElkZW50aWZpZXIgVHlwZSBpbiB0aGUgUklTQyBkb2N1bWVudCByZWZlcmVuY2VkLiBBbmQgYWxs IHRob3NlIHRoaW5ncyByZXByZXNlbnQgYSBkdXJhYmxlDQogc3ViamVjdCByYXRoZXIgdGhhbiBh IHNlc3Npb24sIHdoaWNoIHN0cmlrZXMgbWUgYXMgYXBwcm9wcmlhdGUgZm9yIGEgZG9jdW1lbnQg dGhhdCBkZXNjcmliZXMgaWRlbnRpZnlpbmcgc3ViamVjdHMuIEEgU0FNTCBhc3NlcnRpb24gSUQs IGhvd2V2ZXIsIHdoaWNoIGlzIGFuIGlkZW50aWZpZXIgb2YgYW4gWE1MIGRvY3VtZW50IHRoYXQg aXMgb25seSBpbmRpcmVjdGx5IHJlbGF0ZWQgdG8gYSBzZXNzaW9uIGJ5IGFuIGFzc29jaWF0aW9u IHRoYXQgbGlrZWx5DQogaXNuJ3QgbWFpbnRhaW5lZCwgZG9lcyBub3Qgc2VlbSBhcHByb3ByaWF0 ZSBhcyBhICZxdW90O3N1YmplY3QgaWRlbnRpZmllciZxdW90Oy4gPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4N CiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KT24gVHVlLCBKdWwgMTQsIDIwMjAgYXQgNDowMSBQTSBZ YXJvbiBTaGVmZmVyICZsdDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmlldGZAZ21haWwuY29tIiB0 YXJnZXQ9Il9ibGFuayI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQ7bWFyZ2luLWxl ZnQ6NC4uOHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuMGluIj4NCkhpIEF0dWwsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhlIElEIFRva2VuIHN1YmplY3QgdHlw ZSwgYXMgZGVzY3JpYmVkIGluIHRoZSBkb2N1bWVudCB5b3UgYXJlIHJlZmVyZW5jaW5nLCBkb2Vz IG5vdCBhZGQgYW55IHNlbWFudGljcywgY29tcGFyZWQgdG8gYSDigJxwaG9uZSBudW1iZXLigJ0g b3Ig4oCcZW1haWzigJ0gc3ViamVjdCB0eXBlLiBTbyBJIGRvbuKAmXQgc2VlIHRoZSB2YWx1ZSBp biBhZGRpbmcgaXQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KSW4gYWRkaXRpb24sIGl0IGRvZXMgbm90LCBhY3R1YWxs eSwgZGVzY3JpYmUgYW4gSUQgVG9rZW4uIEluIGZhY3QgdGhlIHRleHQgaXMgdmVyeSBjbGVhciB0 aGF0IGl0IGRlc2NyaWJlcyBhIOKAnHN1YmplY3TigJ0gKGEgZHVyYWJsZSBlbnRpdHkpIHJhdGhl ciB0aGFuIGEgc2Vzc2lvbiwgYW5kIGRvZXMgaXQgYnkgY2l0aW5nIHZhcmlvdXMgY2xhaW1zIGlu Y2x1ZGVkIGluIHRoZSBJRCB0b2tlbi4gU28gYXMgYSBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZSwN CiBpdCBpcyBub3QgYXQgYWxsIGVxdWl2YWxlbnQgdG8gYSBTQU1MIGFzc2VydGlvbi48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp biI+DQpBcyB0byB0aGUgU0FNTCBBc3NlcnRpb24gc3ViamVjdCB0eXBlLCBJIHRoaW5rIHRoZXNl IHVzZSBjYXNlcyBjb3VsZCBiZSBhZGRyZXNzZWQgYnkgYWRkaW5nIGluZm9ybWF0aW9uIHRvIHRo ZSBldmVudC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQpUaGFua3MsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IFlhcm9uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOmJsYWNrIj5BdHVsIFR1bHNoaWJhZ3dhbGUgJmx0OzxhIGhyZWY9Im1h aWx0bzphdHVsdHVsc2hpQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5hdHVsdHVsc2hpQGdv b2dsZS5jb208L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UdWVzZGF5LCBKdWx5IDE0LCAyMDIw IGF0IDIzOjI2PGJyPg0KPGI+VG86IDwvYj5ZYXJvbiBTaGVmZmVyICZsdDs8YSBocmVmPSJtYWls dG86eWFyb25mLmlldGZAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+eWFyb25mLmlldGZAZ21h aWwuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzogPC9iPkNocmlzIFBoaWxsaXBzICZsdDs8YSBocmVm PSJtYWlsdG86Q2hyaXMuUGhpbGxpcHNAY2FuYXJpZS5jYSIgdGFyZ2V0PSJfYmxhbmsiPkNocmlz LlBoaWxsaXBzQGNhbmFyaWUuY2E8L2E+Jmd0OywgJnF1b3Q7PGEgaHJlZj0ibWFpbHRvOmlkLWV2 ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+JnF1b3Q7 ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5p ZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbSWQtZXZl bnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGU8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0K Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KSGkmbmJzcDtZYXJvbiw8bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhlcmUgYXJl IGEgZmV3IFNTRSB1c2UgY2FzZXMgd2hlcmUgdGhlIGV2ZW50cyBhcmUgYWJvdXQgYSBzcGVjaWZp YyBzaW5nbGUgc2lnbi1vbiBzZXNzaW9uLiBZb3UncmUgcmlnaHQgdGhhdCB0aGlzIHNob3VsZCBu b3QgYmUgbGltaXRlZCB0byBTQU1MLiBUaGUgUklTQyBwcm9maWxlIG9mIFNFVHMgKGJhc2VkIG9u IHdoaWNoIHdlIGFyZSBkb2luZyB0aGUgU1NFIHdvcmspIGhhZCB0aGUgSUQgVG9rZW4gc3ViamVj dCBpZGVudGlmaWVyIHR5cGUsIHdoaWNoDQogZm9yIHNvbWUgcmVhc29uIGlzIG1pc3NpbmcgaW4g dGhpcyBzcGVjIChJIGRpZCBub3QgcmVhbGl6ZSB1bnRpbCBub3cpLiBUaGUgc3BlY2lmaWMgZXZl bnRzIHRoYXQgbmVlZCB0byByZWZlciB0byBzZXNzaW9ucyBhcmU6PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0K PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6U3ltYm9sIj7Ctzwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5l dyBSb21hbiZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+SWRlbnRpdHkgcHJvdmlkZXIgY29udGV4dCBjaGFuZ2U6IFRo ZSBjb25kaXRpb25zIHVuZGVyIHdoaWNoIGEgU0FNTCBhc3NlcnRpb24gb3IgT0lEQyB0b2tlbiB3 YXMgZ2VuZXJhdGVkIGFyZSBubyBsb25nZXImbmJzcDt2YWxpZC4gVGhpcyBjYW4gYmUgZHVlIHRv IHZhcmlvdXMgdGhpbmdzLCBpbmNsdWRpbmcgYSBwYXNzd29yZCBjaGFuZ2UuPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KPHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6U3ltYm9sIj7Ctzwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjcuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7DQo8L3NwYW4+U2Vzc2lvbiBwcm9wZXJ0eSBjaGFuZ2U6IEEgc2Vzc2lvbiBoYXMgYmVlbiBk ZXRlcm1pbmVkIHRvIGhhdmUgYmVlbiBjb21wcm9taXNlZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OlN5bWJvbCI+wrc8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo3LjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFu PlJldm9jYXRpb246IFRoZSBpc3N1ZXIgb2YgdGhlIHNpbmdsZSBzaWduLW9uIFNBTUwgYXNzZXJ0 aW9uIG9yIElEIFRva2VuIG5lZWRzIHRvIGJlIHJldm9rZTxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpJIGNhbiBhbHNvIGFk ZCB0aGUgPGEgaHJlZj0iaHR0cHM6Ly9iaXRidWNrZXQub3JnL29wZW5pZC9yaXNjL3NyYy9tYXN0 ZXIvb3BlbmlkLXJpc2MtcHJvZmlsZS0xXzAudHh0I2xpbmVzLTI1MCIgdGFyZ2V0PSJfYmxhbmsi Pg0KSUQgVG9rZW4gY2xhaW0gZnJvbSB0aGUgUklTQyBwcm9maWxlPC9hPiB0byBteSBwdWxsIHJl cXVlc3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpU aGFua3MsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KQXR1bDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIFR1ZSwgSnVsIDE0LCAyMDIw IGF0IDEyOjMyIFBNIFlhcm9uIFNoZWZmZXIgJmx0OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuLmll dGZAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6 MGluO21hcmdpbi1ib3R0b206NS4wcHQ7Ym9yZGVyLXRvcDpjdXJyZW50Y29sb3I7Ym9yZGVyLXJp Z2h0OmN1cnJlbnRjb2xvcjtib3JkZXItYm90dG9tOmN1cnJlbnRjb2xvciI+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpJIG5lZWQgYSBs b3QgbW9yZSBjb250ZXh0IGhlcmUuIFNvIGZhciwgc3ViamVjdCBJRHMgaGF2ZSBkZW5vdGVkIGR1 cmFibGUgZW50aXRpZXMsIHN1Y2ggYXMgZW1haWwgYWRkcmVzc2VzLCBwaG9uZSBudW1iZXJzLCBh Y2NvdW50LiBUaGlzIGlzIGFkZGluZyBhIHN1YmplY3QgSUQgdGhhdCBkZW5vdGVzIGFuIGVwaGVt ZXJhbCBlbnRpdHksIGJhc2ljYWxseSBzaW1pbGFyIHRvIGEgc2Vzc2lvbiBJRC4gVGhpcyBsb29r cyB3ZWlyZCBmcm9tIGFuIGFyY2hpdGVjdHVyYWwNCiBwb2ludCBvZiB2aWV3LCBhbmQgYWxzbyBi ZWdzIHRoZSBxdWVzdGlvbiwgd2h5IHNwZWNpZmljYWxseSBTQU1MIGFuZCBub3Qgb3RoZXIgc2Vz c2lvbiB0eXBlcy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpUaGFua3MsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IFlhcm9uIDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8Yj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+SWQtZXZlbnQgJmx0OzxhIGhyZWY9Im1haWx0bzpp ZC1ldmVudC1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnQtYm91bmNl c0BpZXRmLm9yZzwvYT4mZ3Q7IG9uIGJlaGFsZiBvZiBBdHVsIFR1bHNoaWJhZ3dhbGUgJmx0O2F0 dWx0dWxzaGk9PGEgaHJlZj0ibWFpbHRvOjQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLi5vcmciIHRh cmdldD0iX2JsYW5rIj40MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxi PkRhdGU6IDwvYj5UdWVzZGF5LCBKdWx5IDE0LCAyMDIwIGF0IDAwOjE0PGJyPg0KPGI+VG86IDwv Yj5DaHJpcyBQaGlsbGlwcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkNocmlzLlBoaWxsaXBzQGNhbmFy aWUuY2EiIHRhcmdldD0iX2JsYW5rIj5DaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPC9hPiZndDs8 YnI+DQo8Yj5DYzogPC9iPiZxdW90OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3JnPC9hPiZxdW90OyAmbHQ7PGEgaHJlZj0i bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5v cmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW0lkLWV2ZW50XSBTQU1MIHN1Ympl Y3QgaWRlbnRpZmllciB0eXBlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluIj4NCkp1c3QgY2xhcmlmeWluZyB0aGUgcHJvcG9zYWwgYXMgaXQgc3RhbmRzIHRvZGF5 IChiZWZvcmUgaW5jb3Jwb3JhdGluZyBDaHJpcydzIGlucHV0KTo8bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhlIGZvbGxv d2luZyBzZWN0aW9uIHNob3VsZCBiZSBhZGRlZCBpbiB0aGUgJnF1b3Q7U3ViamVjdCBJZGVudGlm aWVyIFR5cGVzJnF1b3Q7IHNlY3Rpb246PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij40LjkuJm5ic3A7IFNBTUwgU3ViamVj dCBJZGVudGlmaWVyIFR5cGU8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhlIFNBTUwgW1NBTUwu UkVGXSBTdWJqZWN0IElkZW50aWZpZXIgVHlwZSBkZXNjcmliZXMgYSBzdWJqZWN0IGJ5PGJyPg0K Jm5ic3A7ICZuYnNwO3RoZSBhc3NlcnRpb24gaWRlbnRpZmllciBpbiB0aGUgU0FNTCBhc3NlcnRp b24gdGhhdCB3YXMgdXNlZCB0bzxicj4NCiZuYnNwOyAmbmJzcDtjb252ZXkgdGhlIHN1YmplY3Qn cyBpbmZvcm1hdGlvbiB0byB0aGUgUmVjZWl2ZXIuJm5ic3A7IFN1YmplY3Q8YnI+DQombmJzcDsg Jm5ic3A7SWRlbnRpZmllcnMgb2YgdGhpcyB0eXBlIE1VU1QgY29udGFpbiBhbiBgIGFzc2VydGlv bl9pZCZxdW90O2NsYWltLiZuYnNwOyBUaGU8YnI+DQombmJzcDsgJm5ic3A7dmFsdWUgb2YgdGhp cyBjbGFpbSBpcyBhIHN0cmluZyB0aGF0IGlzIGVxdWFsIHRvIHRoZSBBc3NlcnRpb248YnI+DQom bmJzcDsgJm5ic3A7SWRlbnRpZmllciBpbiB0aGUgU0FNTCBhc3NlcnRpb24uJm5ic3A7IFRoZSBT QU1MIFN1YmplY3QgSWRlbnRpZmllciBUeXBlPGJyPg0KJm5ic3A7ICZuYnNwO2lzIGlkZW50aWZp ZWQgYnkgdGhlIG5hbWUgJnF1b3Q7c2FtbGAuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0JlbG93 IGlzIGEgbm9uLW5vcm1hdGl2ZSBleGFtcGxlIFN1YmplY3QgSWRlbnRpZmllciBmb3IgdGhlIFNB TUw8YnI+DQombmJzcDsgJm5ic3A7U3ViamVjdCBJZGVudGlmaWVyIFR5cGU6PGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwO3s8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O3N1YmplY3RfdHlw ZSZxdW90OzogJnF1b3Q7c2FtbCZxdW90Oyw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90 O2Fzc2VydGlvbl9pZCZxdW90OzogJnF1b3Q7X2Y1NTFkODg5NjNhYjRlM2RlY2I3Y2ZlOGY0ZGNj M2Y1JnF1b3Q7LDxicj4NCiZuYnNwOyAmbmJzcDt9PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDtGaWd1cmUgODogRXhhbXBsZTogU3ViamVjdCBJZGVudGlmaWVyIGZvciBTQU1MIFN1Ympl Y3QgSWRlbnRpZmllcjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7VHlwZS48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4i Pg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KT24gTW9u LCBKdWwgMTMsIDIwMjAgYXQgMToyMiBQTSBBdHVsIFR1bHNoaWJhZ3dhbGUgJmx0OzxhIGhyZWY9 Im1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5hdHVsdHVsc2hp QGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkhpIENocmlzLDxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQpJIHdhcyBwcm9wb3NpbmcgdXNpbmcgdGhlICZxdW90O2Fzc2VydGlvbiBpZCZxdW90 OyAoPGEgaHJlZj0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvc2VjdXJpdHkvc2FtbC92Mi4w L3NhbWwtY29yZS0yLjAtb3MucGRmIiB0YXJnZXQ9Il9ibGFuayI+U0FNTCBDb3JlPC9hPiBzcGVj LCBsaW5lIDU1MykgaW4gdGhlIHByb3Bvc2FsLCBub3QgdGhlICZxdW90O3N1YmplY3QtaWQmcXVv dDsgYXMgZGVmaW5lZCBpbiBTQU1MIChzcGVjIHNlY3Rpb24gMy4zKS4gVGhlIG1haW4gcmVhc29u DQogd2FzIHRvIGJlIGFibGUgdG8gcmVmZXIgdG8gYSBzZXNzaW9uIHRoYXQgd2FzIGVzdGFibGlz aGVkIHVzaW5nIGEgc3BlY2lmaWMgYXNzZXJ0aW9uLiBJZiBpdCdzIHVzZWZ1bCwgd2UgY291bGQg cGVyaGFwcyBleHRlbmQgdGhlIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGUgaW4gdGhpcyBz cGVjIHRvIGluY2x1ZGUgZWl0aGVyIHRoZSBhc3NlcnRpb25faWQgb3IgdGhlIHN1YmplY3RfaWQg Y2xhaW0uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhhbmtzLDxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0OjEuMGluIj4NCkF0dWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCAxMDoz MCBBTSBDaHJpcyBQaGlsbGlwcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkNocmlzLi5QaGlsbGlwc0Bj YW5hcmllLmNhIiB0YXJnZXQ9Il9ibGFuayI+Q2hyaXMuUGhpbGxpcHNAY2FuYXJpZS5jYTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4g MGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0 OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0O2JvcmRlci10b3A6Y3VycmVudGNvbG9yO2JvcmRlci1y aWdodDpjdXJyZW50Y29sb3I7Ym9yZGVyLWJvdHRvbTpjdXJyZW50Y29sb3IiPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFu Zz0iRU4tQ0EiPkhpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+UXVpZXQgbHVya2VyIG9i c2VydmluZy4uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5UaGFua3MgZm9yIGNvbnNpZGVy IHRoZSBTQU1MIGVsZW1lbnRzLi4gPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPkF0dWwsIGFyZSB5b3UgcmVmZXJyaW5nIHRvIHRo ZSBhY3R1YWwgc2Vzc2lvbiBpZGVudGlmaWVyIHRoYXQgc29tZW9uZSBtYXkgaGF2ZSB3aGVyZSB0 aGUgU3ViamVjdC1JZCB3YXMgZXhjaGFuZ2VkIE9SIHRoZSBhY3R1YWwgU3ViamVjdC1pZCBpdHNl bGYgaW4geW91ciByZWZlcmVuY2UgaW4gdGhlIHByb3Bvc2FsIHdpdGggdGhlIGdpdGh1YiBsaW5r Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9 IkVOLUNBIj5J4oCZbSB0cnlpbmcgdG8gc3F1YXJlIHdoYXQgSSBzZWUgb24gdGhlIGdpdCBkZWx0 YSBvbiBsaW5lIDI5NC0yOTYgaW4NCjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9yaWNoYW5u YS9zZWNldmVudC9wdWxsLzEvY29tbWl0cy9iMjBiNjY5MmViNTA2Mjg5Mjc0NzZjYTc4ZjliZTA3 N2FjZTg4OTk0IiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL2dpdGh1Yi4uLmNvbS9yaWNoYW5u YS9zZWNldmVudC9wdWxsLzEvY29tbWl0cy9iMjBiNjY5MmViNTA2Mjg5Mjc0NzZjYTc4ZjliZTA3 N2FjZTg4OTk0PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4N CjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPkFu ZCBhIFN1YmplY3QtaWQgYXMgc2hvd24gaW4gdGhlIGV4YW1wbGUgaW4gMy4zLjMgaGVyZTogPGEg aHJlZj0iaHR0cHM6Ly9kb2NzLm9hc2lzLW9wZW4ub3JnL3NlY3VyaXR5L3NhbWwtc3ViamVjdC1p ZC1hdHRyL3YxLjAvY3MwMS9zYW1sLXN1YmplY3QtaWQtYXR0ci12MS4uMC1jczAxLi5odG1sI19U b2M1MzYwOTcyMjkiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vZG9jcy5vYXNpcy1vcGVuLm9y Zy9zZWN1cml0eS9zYW1sLXN1YmplY3QtaWQtYXR0ci92MS4wL2NzMDEvc2FtbC1zdWJqZWN0LWlk LWF0dHItdjEuMC1jczAxLmh0bWwjX1RvYzUzNjA5NzIyOTwvYT48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFu Zz0iRU4tQ0EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+V2hhdCB5b3Ugb2Zm ZXJlZCBpbiB0aGUgZXhhbXBsZSBpcyBub3QgYSBTdWJqZWN0LWlkICZuYnNwO3BlciB0aGUgT0FT SVMgU0FNTCBzcGVjIGFzIHdyaXR0ZW4gaW4gc2VjdGlvbiAzLjMuMTwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBs YW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5BbSBJIG1pcy1p bnRlcnByZXRpbmcgc29tZXRoaW5nPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5DPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNB Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4i Pg0KPGI+PHNwYW4gbGFuZz0iRU4tQ0EiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJs YWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUNBIiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdDtjb2xvcjpibGFjayI+SWQtZXZlbnQgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVu dC1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnQtYm91bmNlc0BpZXRm Lm9yZzwvYT4mZ3Q7IG9uIGJlaGFsZiBvZiBBdHVsIFR1bHNoaWJhZ3dhbGUNCiAmbHQ7YXR1bHR1 bHNoaT08YSBocmVmPSJtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9 Il9ibGFuayI+NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5EYXRl OiA8L2I+TW9uZGF5LCBKdWx5IDEzLCAyMDIwIGF0IDEyOjE3IFBNPGJyPg0KPGI+VG86IDwvYj4m cXVvdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5p ZC1ldmVudEBpZXRmLm9yZzwvYT4mcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBp ZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3JnPC9hPiZndDs8YnI+DQo8 Yj5TdWJqZWN0OiA8L2I+W0lkLWV2ZW50XSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPkhpIGFsbCw8L3NwYW4+PG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4N CjxzcGFuIGxhbmc9IkVOLUNBIj5CYXNlZCBvbiB0aGUgZGlzY3Vzc2lvbnMgaW4gdGhlIFNTRSB3 b3JraW5nIGdyb3VwIHdpdGhpbiB0aGUgT3BlbklEIEZvdW5kYXRpb24sIHdlIHdvdWxkIGxpa2Ug dG8gcHJvcG9zZSB0aGF0IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgc3BlY2lmaWNhdGlvbiBpbmNs dWRlIGEgU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZS4gVGhpcyBpcyBzbyB0aGF0IHNlc3Np b25zIGVzdGFibGlzaGVkIGFjcm9zcyBwZWVycyB1c2luZw0KIFNBTUwgbWF5IGJlIGlkZW50aWZp ZWQgaW4gZXZlbnRzIHRoYXQgaW5jbHVkZSB0aGUgc3ViamVjdCBpZGVudGlmaWVyLjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDtBIFNBTUwgc3ViamVjdCBpZGVudGlm aWVyIGhhcyBvbmx5IG9uZSBjbGFpbSB3aXRoaW4gaXQsIHRoZSBhc3NlcnRpb24gaWQgb2YgdGhl IFNBTUwgYXNzZXJ0aW9uIHVzZWQgdG8gZXN0YWJsaXNoIHRoZSBzaW5nbGUgc2lnbi1vbiBzZXNz aW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5UaGlzIGNoYW5nZSBpcyBh bHNvIGluY2x1ZGVkIGluIG15IDxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9yaWNoYW5uYS9z ZWNldmVudC9wdWxsLzEiIHRhcmdldD0iX2JsYW5rIj4NCnByb3Bvc2FsIGhlcmU8L2E+Ljwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5UaGFua3MsPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEu MGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5BdHVsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxz cGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxi cj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBp ZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhy ZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50 PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyBJZC1ldmVudCBtYWls aW5nIGxpc3QgPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFu ayI+DQpJZC1ldmVudEBpZXRmLm9yZzwvYT4gPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT4gPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0 PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48L286cD48L3A+DQo8L2Js b2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp biI+DQo8YnI+DQo8Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTotYXBwbGUtc3lzdGVtO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOm5vbmUgd2luZG93dGV4dCAxLjBw dDtwYWRkaW5nOjBpbiI+Q09ORklERU5USUFMSVRZIE5PVElDRTogVGhpcyBlbWFpbCBtYXkgY29u dGFpbiBjb25maWRlbnRpYWwgYW5kIHByaXZpbGVnZWQgbWF0ZXJpYWwgZm9yIHRoZSBzb2xlIHVz ZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpLiBBbnkgcmV2aWV3LA0KIHVzZSwgZGlzdHJp YnV0aW9uIG9yIGRpc2Nsb3N1cmUgYnkgb3RoZXJzIGlzIHN0cmljdGx5IHByb2hpYml0ZWQuLiZu YnNwOyBJZiB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIGNvbW11bmljYXRpb24gaW4gZXJyb3IsIHBs ZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBieSBlLW1haWwgYW5kIGRlbGV0ZSB0 aGUgbWVzc2FnZSBhbmQgYW55IGZpbGUgYXR0YWNobWVudHMgZnJvbSB5b3VyIGNvbXB1dGVyLiBU aGFuayB5b3UuPC9zcGFuPjwvaT48L2I+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_9CC41112794741E195846DEB625BBEEAamazoncom_-- From nobody Wed Jul 15 15:21:02 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDD903A0F4D for ; Wed, 15 Jul 2020 15:20:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.09 X-Spam-Level: X-Spam-Status: No, score=-2.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6YudDOt4d69L for ; Wed, 15 Jul 2020 15:20:48 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640110.outbound.protection.outlook.com [40.107.64.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66E043A0EF4 for ; Wed, 15 Jul 2020 15:20:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=LXDdzo1gbtL0QMP5wAkxz75489IGLx5vEfq/MXa/cgwQIE3ZNURMd6OfWHrjLUEtwnF2deJkUrRmgQ5Jb6x1lTn3gkZ9lCZowFqEBMiJ1HU2QJ1aKGglA5luIujuK09b+nYj1LicZWKqvIMaTiuY7C5FM/aL4lCaR6qpSJY+E+FBjMBgB6vAR4ZVzUdTE87KTlMeih4qgCZBo2NmQ78yObyiCy0449Aa4CAs1wRLLRkH87Z5xdMDgAIKcd3+KbBihJyvfZfX71N5GXtaY1MuDtNZjeGHTiNsq9FEAjN21jk6ffF4PrOn799rGSLAdEaBv3/N0haxGiKOJLv6shrbyg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pUKkkLU3pA8YtElyhu6wIZ3ucrLFrVSzimOyZ8bO4vU=; b=doJiSZuuZPVwaAMp96k8ASj5F2KvvyYMdwbF/vlS3SSfWImS9ppyt5W5iYytXjBmsc7t9QLFVHQplZRn53JsRZmON8PRO/EVygI96Gb103Jqy19ZdphjMJI9IOMbBAfkNapiOYFX5uhUY5JGW30xrdxzotmBRrBnP5EzHGkj/NVHhxrcKtO0DazOfIaIPYgH62GlNLiD5KaWwveKwO0Ds+P64YS7knL5BcArmUYpGbaQZdlY842zfrxRXePFYtQ5lLjXr+75PwnPiIlotSbdo44wQTgJ56DuhHzSEQPWuGrLHMatNTigk123aNpatt5Xi28OEzSC35QQbO+wdnPC0w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pUKkkLU3pA8YtElyhu6wIZ3ucrLFrVSzimOyZ8bO4vU=; b=VI29meihVsf16xEm1VT/Y1RvaZ/BxTgL/f0mwD/ahpjLRDKAtYVSyOVn5slrhwx84w0rwuxRWJSmOKHcE/dXBTiPwTNbQqfFB/OtD6oUT9UbZHQvLxhh5TBhdMsmyRoOGM8HXD6jwvA73IZ7Fb1SxFZ8HGpqS+LVD1UalLq3Iy4= Received: from MN2PR00MB0686.namprd00.prod.outlook.com (2603:10b6:208:15f::13) by MN2PR00MB0640.namprd00.prod.outlook.com (2603:10b6:208:3a::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3235.0; Wed, 15 Jul 2020 22:20:45 +0000 Received: from MN2PR00MB0686.namprd00.prod.outlook.com ([fe80::2886:ee14:6806:ec4]) by MN2PR00MB0686.namprd00.prod.outlook.com ([fe80::2886:ee14:6806:ec4%4]) with mapi id 15.20.3237.000; Wed, 15 Jul 2020 22:20:45 +0000 From: Mike Jones To: "Richard Backman, Annabelle" , Atul Tulshibagwale CC: Yaron Sheffer , Brian Campbell , Chris Phillips , "id-event@ietf.org" Thread-Topic: [Id-event] SAML subject identifier type Thread-Index: AQHWWu5wSHawNgbSLEecHYRPRNig8qkJNefw Date: Wed, 15 Jul 2020 22:20:45 +0000 Message-ID: References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> <9CC41112-7947-41E1-9584-6DEB625BBEEA@amazon.com> In-Reply-To: <9CC41112-7947-41E1-9584-6DEB625BBEEA@amazon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-15T22:18:37Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=d6fca6b8-cf80-4bed-a00c-899d1c544eff; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0 authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: c1226772-3ad5-4ced-10e8-08d8290d518d x-ms-traffictypediagnostic: MN2PR00MB0640: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 0+A5g14E/oyQXJVidTLBLhbbtr4SlKWqzI/wvWFUkkGxtEVDsoVyUfT/l5gr8hBdgFVofrDIsSfG0gMrD75yi4lUKCmj8Uqf6u4TTjkhWHWTm1tZTLNSEJOjk1LyFt5w/kGNxdd4ge2Uq6OjWAeRi0Ou99EzHvUJIn3ZosZZd7090F+ugVuv56CKTyBS3RSTPLXYI5Dll6MI5cDAGF1i5G9/1AmxNEO/gimn9w24MfhbXi5S1FzLDe2Hy1PxNHut02bK1x7eZatJn6NW2RP1j6cr9p/Wd2UwR1Dkkze08UjxVnLUhXaIHrTTa8XLCp1up8OXudVnZq2NkyI/1Ys5uN4+UX/ildJVQOonvwQTK3ZWfUFLPHiUvRlaC1kwLOIjKojBQpdSdub5DB+IsmQmHQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR00MB0686.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(346002)(366004)(376002)(136003)(39860400002)(66446008)(966005)(82950400001)(316002)(86362001)(10290500003)(26005)(8676002)(82960400001)(53546011)(8936002)(9686003)(186003)(6506007)(110136005)(7696005)(4326008)(2906002)(66946007)(54906003)(83380400001)(5660300002)(66476007)(8990500004)(55016002)(76116006)(21615005)(33656002)(7066003)(166002)(64756008)(71200400001)(52536014)(66556008)(478600001)(30864003)(579004); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: wR6l/z8jAETijJ4egthvLsKh5UQDHRbG7zNTefbb9i8z0fep/Ib3BJfcA+9kd12VXiOIYKDvX3/5M3pawBhosRcXQ8ZOMknAHHoOMgl1oaB4/Jnd0MadgEiCI2djKITX16H6SnDCwoZSIQle88QdXDT5CrYroSREIulOZ0UUzGVGG2HahlXLiLB0nzH5xdrawDfN7kNpkCH3k3+oDu2Gr1boemGmapBHKdIh9daug2vLS9X0ojvaWEaVH+xtqUXeT1cu8m9QnTApViNz+Q8oX91P3uQB1yBrpwTSfLYDTz1H0NfFLFMt6agq312B9ZtT9aNvcUx5U6+NfgPvyIgx35xpnCsGWBL2r8HHb24ift/MkQGBuJ8oqd3OdDLay/iG9N4cos72f1deoIuZU9WwwPtv0SqyLPHTtqebFRthzMYcVlUsbDxNviZSVPHRZ7V5b3aYPmPNsh/Pd5r0Oo5g3B++xdiSwagyNQvi5es/Tj4jFvLmfs9Qbq+oUw9TSu8xGmv4ra3mTtqI+rQxDsAxsLy+CWihN5JJtLgrITHjgHZPLQALXRSXK3h3tUu1eDh9Zag1vAkxYtWigjo+8El9WaKZHB9xT5rioehrB2C5mPd2VJUnPtP/P+YHOZmGoaN+eW3bMn7rNkTRFGp86nS+KQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR00MB068653B00930B9E02E2286E5F57E0MN2PR00MB0686namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN2PR00MB0686.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c1226772-3ad5-4ced-10e8-08d8290d518d X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jul 2020 22:20:45.1651 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: S9lepuRA9t+2b7/0fwdxvgLUyGVRIjAEI8uSxLeYzLF5wjpF1bZV8Z2BHjoC2S4+Xjb6qzLQoeFbRTDiqu/Dig== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR00MB0640 Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 22:20:59 -0000 --_000_MN2PR00MB068653B00930B9E02E2286E5F57E0MN2PR00MB0686namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmWQgc3VnZ2VzdCBub3QgZGVmaW5pbmcgYW55IHN1YmplY3QgdHlwZXMgdGhhdCB3ZSBkb27i gJl0IGhhdmUgaW1tZWRpYXRlIHVzZSBjYXNlcyBmb3IsIGFzIHdlIG1pZ2h0IGdldCB0aGUgZGV0 YWlscyB3cm9uZy4gIFdl4oCZcmUgY3JlYXRpbmcgYSByZWdpc3RyeSB0byBhZGQgbmV3IG9uZXMs IHNvIHRoZXkgY2FuIGFsd2F5cyBiZSBhZGRlZCBsYXRlciB3aGVuIHRoZXnigJlyZSBhY3R1YWxs eSBuZWVkZWQuDQoNCkxldOKAmXMga2VlcCB0aGlzIHNpbXBsZSwgd2hpbGUgbWVldGluZyB0aGUg aW1tZWRpYXRlbHkga25vd24gbmVlZHMuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IElkLWV2ZW50IDxpZC1l dmVudC1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgUmljaGFyZCBCYWNrbWFuLCBBbm5h YmVsbGUNClNlbnQ6IFdlZG5lc2RheSwgSnVseSAxNSwgMjAyMCAyOjI1IFBNDQpUbzogQXR1bCBU dWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpPTQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9yZz47IFJp Y2hhcmQgQmFja21hbiwgQW5uYWJlbGxlIDxyaWNoYW5uYT00MGFtYXpvbi5jb21AZG1hcmMuaWV0 Zi5vcmc+DQpDYzogWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPjsgQnJpYW4g Q2FtcGJlbGwgPGJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPjsgQ2hyaXMgUGhpbGxpcHMgPENo cmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E+OyBpZC1ldmVudEBpZXRmLm9yZw0KU3ViamVjdDogUmU6 IFtJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZQ0KDQpJIHRoaW5rIHRoZSB0 d28gc3ViamVjdCB0eXBlcyDigJMgdGhlIOKAnG9hdXRoX3Rva2Vu4oCdIHR5cGUgZGVzY3JpYmVk IGluIG15IHByaW9yIGVtYWlsLCBhbmQgYSDigJxvYXV0aF9jbGllbnTigJ0gdHlwZSB0aGF0IGlk ZW50aWZpZXMgYSBzdWJqZWN0IGJ5IGl0cyBPQXV0aCAyLjAgY2xpZW50IElEIOKAkyBhcmUgcmVh c29uYWJsZSB0eXBlcyB0byBkZWZpbmUuIEkgZG9u4oCZdCBzZWUgYSBwYXJ0aWN1bGFyIG5lZWQg dG8gbW92ZSB0aGVtIGludG8gdGhlIGJhc2Ugc3BlYyDigJMgd2UgZGVmaW5lIGFuIElBTkEgcmVn aXN0cnkgcHJlY2lzZWx5IHNvIHdlIGRvbuKAmXQgaGF2ZSB0byB0cnkgdG8gZGVmaW5lIGV2ZXJ5 dGhpbmcgdXAgZnJvbnQg4oCTIGJ1dCBJ4oCZbSBub3Qgb3Bwb3NlZCB0byB0aGUgaWRlYS4NCg0K SeKAmW0gbm90IHN1cmUgd2hlcmUgdGhpcyBub3Rpb24gb2YgYSDigJxkdXJhYmxlIHN1YmplY3Ti gJ0gY2FtZSBmcm9tLiBSaWdodCBpbiB0aGUgaW50cm9kdWN0aW9uLCBSRkMgODQxNzxodHRwczov L3d3dy5yZmMtZWRpdG9yLm9yZy9yZmMvcmZjODQxNy5odG1sI3NlY3Rpb24tMT4gc2F5cyB0aGUg c3ViamVjdCBvZiBhIHNlY3VyaXR5IGV2ZW50IOKAnG1heSBiZSBwZXJtYW5lbnQgKGUuZy4sIGEg dXNlciBhY2NvdW50KSBvciB0ZW1wb3JhcnkgKGUuZy4sIGFuIEhUVFAgc2Vzc2lvbikgaW4gbmF0 dXJlLuKAnSBUaGVyZSBhcmUgcGxlbnR5IG9mIHVzZSBjYXNlcyBmb3IgZXZlbnRzIHdoZXJlIHRo ZSBzdWJqZWN0cyBhcmUgdGVtcG9yYXJ5L2VwaGVtZXJhbDoNCg0KICAxLiAgU2Vzc2lvbiB0ZXJt aW5hdGlvbg0KICAyLiAgQ2hhbmdlcyBpbiB0aGUgc2VjdXJpdHkgcG9zdHVyZSBmb3IgYSBzZXNz aW9uDQogIDMuICBUb2tlbiByZXZvY2F0aW9uDQogIDQuICBBc3luY2hyb25vdXMgYXBwcm92YWwg b2YgYSByZXF1ZXN0DQogIDUuICBDaGFuZ2VzIGluIHRoZSBzdGF0ZSBvZiBhIHRyYW5zYWN0aW9u DQrigKZldGMuDQoNCldoZXRoZXIgb3Igbm90IGl0IG1ha2VzIHNlbnNlIHRvIGlkZW50aWZ5IGEg c2Vzc2lvbiBzdWJqZWN0IHVzaW5nIGEgU0FNTCBhc3NlcnRpb24gSUQgKG9yIGFuIElEIFRva2Vu IOKAnGp0aeKAnSBjbGFpbSwgaW4gdGhlIE9JREMgd29ybGQpIGlzIGEgc2VwYXJhdGUgcXVlc3Rp b24uIEFkZGluZyBzZW1hbnRpY3MgdG8gZXhpc3RpbmcgaWRlbnRpZmllcnMgdGVuZHMgdG8gbGVh ZCB0byBsb3RzIG9mIHVuZm9yZXNlZW4gY29tcGxpY2F0aW9ucywgYW5kIGRlcGVuZCBvbiBhc3N1 bXB0aW9ucyB0aGF0IGRvbuKAmXQgYWx3YXlzIGhvbGQgdHJ1ZS4gSW4gdGhpcyBjYXNlLCB0aGVy ZSBzZWVtcyB0byBiZSBhbiBhc3N1bXB0aW9uIHRoYXQgdGhlcmUgaXMgYSAxOjEgcmVsYXRpb25z aGlwIGJldHdlZW4gYSBTQU1MIGFzc2VydGlvbiBhbmQgYSBzZXNzaW9uLiBUaGlzIGlzIG5vdCBh bHdheXMgdGhlIGNhc2UuDQoNClJlZ2FyZGxlc3MsIGEgU0FNTCBhc3NlcnRpb24gSUQgaXMgY2xl YXJseSBhbiBhcHByb3ByaWF0ZSBpZGVudGlmaWVyIHdoZW4gdGhlIHN1YmplY3QgaXMgYSBTQU1M IGFzc2VydGlvbi4gSSBkb27igJl0IGtub3cgb2ZmaGFuZCBpZiB0aGVyZSBhcmUgYW55IHVzZSBj YXNlcyBmb3IgZXZlbnRzIHJlbGF0aW5nIHRvIGEgU0FNTCBhc3NlcnRpb24gaXRzZWxmLiBJIGNh biBjZXJ0YWlubHkgc2VlIHVzZSBjYXNlcyBmb3IgZXZlbnRzIHJlbGF0ZWQgdG8gSldUcyAoZS5n LiwgcmV2b2NhdGlvbiBvZiBhIEpXVCBhY2Nlc3MgdG9rZW4pLCB3aGVyZSBhIOKAnGp0aeKAnSBz dWJqZWN0IGlkZW50aWZpZXIgdHlwZSB3b3VsZCBiZSBhcHByb3ByaWF0ZS4gSeKAmW0gaW5jbGlu ZWQgdG8gYWRkIGl0IHRvIHRoZSBkcmFmdCwgaWYgZm9yIG5vIG90aGVyIHJlYXNvbiB0aGFuIHRv IHByb3ZpZGUgYSBub3JtYXRpdmUgZGVtb25zdHJhdGlvbiBvZiBhIHN1YmplY3QgaWRlbnRpZmll ciB0aGF0IHdvdWxkIGJlIHVzZWQgdG8gaWRlbnRpZnkgYSBtb3JlIGVwaGVtZXJhbCBzdWJqZWN0 Lg0KDQrigJMNCkFubmFiZWxsZSBCYWNrbWFuIChzaGUvaGVyKQ0KQVdTIElkZW50aXR5DQpodHRw czovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5Lw0KDQoNCkZyb206IElkLWV2ZW50IDxpZC1ldmVu dC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPj4gb24g YmVoYWxmIG9mIEF0dWwgVHVsc2hpYmFnd2FsZSA8YXR1bHR1bHNoaT00MGdvb2dsZS5jb21AZG1h cmMuaWV0Zi5vcmc8bWFpbHRvOmF0dWx0dWxzaGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3Jn Pj4NCkRhdGU6IFdlZG5lc2RheSwgSnVseSAxNSwgMjAyMCBhdCAxMjo0NyBQTQ0KVG86ICJSaWNo YXJkIEJhY2ttYW4sIEFubmFiZWxsZSIgPHJpY2hhbm5hPTQwYW1hem9uLmNvbUBkbWFyYy5pZXRm Lm9yZzxtYWlsdG86cmljaGFubmE9NDBhbWF6b24uY29tQGRtYXJjLmlldGYub3JnPj4NCkNjOiBZ YXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9uZi5pZXRmQGdt YWlsLmNvbT4+LCBCcmlhbiBDYW1wYmVsbCA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb208bWFp bHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPj4sIENocmlzIFBoaWxsaXBzIDxDaHJpcy5Q aGlsbGlwc0BjYW5hcmllLmNhPG1haWx0bzpDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPj4sICJp ZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+IiA8aWQtZXZlbnRAaWV0 Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJFOiBbRVhURVJOQUxd IFtJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZQ0KDQoNCkNBVVRJT046IFRo aXMgZW1haWwgb3JpZ2luYXRlZCBmcm9tIG91dHNpZGUgb2YgdGhlIG9yZ2FuaXphdGlvbi4gRG8g bm90IGNsaWNrIGxpbmtzIG9yIG9wZW4gYXR0YWNobWVudHMgdW5sZXNzIHlvdSBjYW4gY29uZmly bSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuDQoNCkhvdyBkbyB3ZSBw cm9wb3NlIHRvIHN1cHBvcnQgdGhlIHR3byBzdWJqZWN0IHR5cGVzIGRlZmluZWQgaW4gdGhlIE9B dXRoIEV2ZW50IFR5cGVzPGh0dHBzOi8vb3BlbmlkLm5ldC9zcGVjcy9vYXV0aC1ldmVudC10eXBl cy0xXzAtSUQxLmh0bWw+IHNwZWMgaGVyZT8NCg0KT24gVHVlLCBKdWwgMTQsIDIwMjAgYXQgNDo1 NCBQTSBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSA8cmljaGFubmE9NDBhbWF6b24uY29tQGRt YXJjLmlldGYub3JnPG1haWx0bzo0MGFtYXpvbi5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToN ClRoZSBSSVNDIFByb2ZpbGXigJlzIOKAnElEIFRva2VuIENsYWltc+KAnSB0eXBlIGRvZXMgbm90 IGlkZW50aWZ5IGEgc3ViamVjdCB0aGF0IGlzIGFuIElEIFRva2VuLCBpdCBpZGVudGlmaWVzIGEg c3ViamVjdCB0aGF0IHdhcyB0aGUgc3ViamVjdCBvZiBhbiBJRCBUb2tlbi4gSXQgd2FzIGludGVu ZGVkIGZvciBjYXNlcyB3aGVyZSB0aGUgT1Agc2VudCBtdWx0aXBsZSBpZGVudGlmaWVycyBvZiBk aWZmZXJlbnQgdHlwZXMgaW4gdGhlIElEIFRva2VuIChlLmcuLCBpc3Mrc3ViIGFuZCBlbWFpbCks IGFuZCBkb2VzIG5vdCBrbm93IHdoaWNoIG9mIHRoZW0gdGhlIGNsaWVudCB3aWxsIHJlY29nbml6 ZSAoeWVzLCB0aGUgc2hvdWxkIHVzZSBpc3Mrc3ViOyBubywgdGhleSBkb2VzbuKAmXQgYWx3YXlz IGRvIHNvKS4gVGhpcyB0eXBlIHdhcyByZXBsYWNlZCBpbiBkcmFmdC1pZXRmLXNlY2V2ZW50LXN1 YmplY3QtaWRlbnRpZmllcnMtMDMgd2l0aCB0aGUg4oCcYWxpYXNlc+KAnSB0eXBlLCB3aGljaCBp cyBhIGdlbmVyYWwgc29sdXRpb24gdG8gdGhpcyBwcm9ibGVtIHRoYXQgaXMgbm90IGRlZmluZWQg aW4gdGVybXMgb2Ygb25lIHBhcnRpY3VsYXIgdXNlIGNhc2UgKGkuZS4sIElEIFRva2VucykuDQoN ClRoZSBPSURGIFNTRSB3b3JraW5nIGdyb3Vw4oCZcyBPQXV0aCBFdmVudCBUeXBlcyBkcmFmdDxo dHRwczovL29wZW5pZC5uZXQvc3BlY3Mvb2F1dGgtZXZlbnQtdHlwZXMtMV8wLUlEMS5odG1sI3Jm Yy5zZWN0aW9uLjIuMT4gZGVmaW5lcyBhIOKAnG9hdXRoX3Rva2Vu4oCdIHR5cGUgdGhhdCBpZGVu dGlmaWVzIGEgc3ViamVjdCB0aGF0IGlzIGFuIE9BdXRoIDIuMCB0b2tlbiwgYW5kIGRvZXMgc28g dXNpbmcgZWl0aGVyIHRoZSBmdWxsIG9yIHBhcnRpYWwgcGxhaW4gdGV4dCB2YWx1ZSBvZiB0aGUg dG9rZW4sIG9yIGEgaGFzaCBvZiB0aGUgdG9rZW4uLg0KDQpJdCBpcyBwZXJmZWN0bHkgZmluZSBm b3IgYSB0b2tlbiB0byBiZSB0aGUgc3ViamVjdCBvZiBhIHNlY3VyaXR5IGV2ZW50LiA4NDE3PGh0 dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL3JmYy9yZmM4NDE3Lmh0bWwjc2VjdGlvbi0yLjI+IGFj dHVhbGx5IGluY2x1ZGVzIHRoZSBmb2xsb3dpbmcgYXMgYW4gZXhhbXBsZSBvZiBhIHBvc3NpYmxl IHZhbHVlIGZvciB0aGUg4oCcc3Vi4oCdIGNsYWltOg0KKiAgYSB0b2tlbiBpZGVudGlmaWVyIChl LmcuICJqdGkiKSBmb3IgYSByZXZva2VkIHRva2VuLg0KDQrigJMNCkFubmFiZWxsZSBCYWNrbWFu IChzaGUvaGVyKQ0KQVdTIElkZW50aXR5DQpodHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5 Lw0KDQoNCkZyb206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpp ZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPj4gb24gYmVoYWxmIG9mIEF0dWwgVHVsc2hpYmFnd2Fs ZSA8YXR1bHR1bHNoaT00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc8bWFpbHRvOjQwZ29vZ2xl LmNvbUBkbWFyYy5pZXRmLm9yZz4+DQpEYXRlOiBUdWVzZGF5LCBKdWx5IDE0LCAyMDIwIGF0IDQ6 MzIgUE0NClRvOiBCcmlhbiBDYW1wYmVsbCA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb208bWFp bHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPj4NCkNjOiBZYXJvbiBTaGVmZmVyIDx5YXJv bmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbT4+LCBDaHJpcyBQ aGlsbGlwcyA8Q2hyaXMuUGhpbGxpcHNAY2FuYXJpZS5jYTxtYWlsdG86Q2hyaXMuUGhpbGxpcHNA Y2FuYXJpZS5jYT4+LCAiaWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3Jn PiIgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0 OiBSRTogW0VYVEVSTkFMXSBbSWQtZXZlbnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGUN Cg0KDQpDQVVUSU9OOiBUaGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBv cmdhbml6YXRpb24uIERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVz cyB5b3UgY2FuIGNvbmZpcm0gdGhlIHNlbmRlciBhbmQga25vdyB0aGUgY29udGVudCBpcyBzYWZl Lg0KDQpJTU8gaWYgd2UgaGF2ZSBhIGNvbW1vbiBlbm91Z2ggdXNlLWNhc2UgdGhhdCByZXF1aXJl cyBhIHNwZWNpZmljIHR5cGUgdG8gYmUgZGVmaW5lZCwgdGhlbiB3ZSBzaG91bGQgZGVmaW5lIHRo YXQgdHlwZSBpbiB0aGUgc3BlYyByYXRoZXIgdGhhbiByZWx5IG9uIGFuIGludGVycHJldGF0aW9u IG9mIHRoZSAiaXNzLXN1YiIgdHlwZSwgc2luY2UgdGhhdCBpbnRlcnByZXRhdGlvbiBjYW4gY2F1 c2UgaW5jb21wYXRpYmlsaXRpZXMuDQoNCkluIHRoaXMgc3BlY2lmaWMgY2FzZSBob3dldmVyIEkg ZmVlbCB0aGF0IHRoZSB1c2UgY2FzZXMgb3V0bGluZWQgaW4gbXkgcHJldmlvdXMgZW1haWwgY2Fu IGJlIGFjaGlldmVkICh3aXRoIGxpbWl0YXRpb25zKSB1c2luZyB0aGUgZHVyYWJsZSBzdWJqZWN0 IHR5cGVzIHN1Y2ggYXMgZW1haWwuIEknZCBsaWtlIHRoZSBtZW1iZXJzIG9mIHRoZSBTU0Ugd29y a2luZyBncm91cCB0byBjaGltZSBpbiAoc2luY2UgdGhhdCBpcyB3aGVyZSB0aGlzIGdvdCBhZGRl ZCksIG9yIHdlIGNhbiBkcm9wIHRoZSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlLg0KDQpP biBUdWUsIEp1bCAxNCwgMjAyMCBhdCA0OjA5IFBNIEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxA cGluZ2lkZW50aXR5LmNvbTxtYWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20+PiB3cm90 ZToNCisgMSB0byB3aGF0IFlhcm9uIGlzIHNheWluZyBoZXJlLiBJJ2QgaW5jbHVkZSBhbHNvIHRo ZSAiaXNzLXN1YiIgc3ViamVjdCBpZGVudGlmaWVyIHR5cGUgaHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVjdC1pZGVudGlmaWVycy0wNSNzZWN0aW9u LTMuNCBhcyBhbHJlYWR5IGhhdmluZyBzZW1hbnRpY3MgY292ZXJpbmcgd2hhdCdzIGRlc2NyaWJl ZCBpbiB0aGUgSUQgVG9rZW4gQ2xhaW1zIFN1YmplY3QgSWRlbnRpZmllciBUeXBlIGluIHRoZSBS SVNDIGRvY3VtZW50IHJlZmVyZW5jZWQuIEFuZCBhbGwgdGhvc2UgdGhpbmdzIHJlcHJlc2VudCBh IGR1cmFibGUgc3ViamVjdCByYXRoZXIgdGhhbiBhIHNlc3Npb24sIHdoaWNoIHN0cmlrZXMgbWUg YXMgYXBwcm9wcmlhdGUgZm9yIGEgZG9jdW1lbnQgdGhhdCBkZXNjcmliZXMgaWRlbnRpZnlpbmcg c3ViamVjdHMuIEEgU0FNTCBhc3NlcnRpb24gSUQsIGhvd2V2ZXIsIHdoaWNoIGlzIGFuIGlkZW50 aWZpZXIgb2YgYW4gWE1MIGRvY3VtZW50IHRoYXQgaXMgb25seSBpbmRpcmVjdGx5IHJlbGF0ZWQg dG8gYSBzZXNzaW9uIGJ5IGFuIGFzc29jaWF0aW9uIHRoYXQgbGlrZWx5IGlzbid0IG1haW50YWlu ZWQsIGRvZXMgbm90IHNlZW0gYXBwcm9wcmlhdGUgYXMgYSAic3ViamVjdCBpZGVudGlmaWVyIi4N Cg0KT24gVHVlLCBKdWwgMTQsIDIwMjAgYXQgNDowMSBQTSBZYXJvbiBTaGVmZmVyIDx5YXJvbmYu aWV0ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbT4+IHdyb3RlOg0KSGkg QXR1bCwNCg0KVGhlIElEIFRva2VuIHN1YmplY3QgdHlwZSwgYXMgZGVzY3JpYmVkIGluIHRoZSBk b2N1bWVudCB5b3UgYXJlIHJlZmVyZW5jaW5nLCBkb2VzIG5vdCBhZGQgYW55IHNlbWFudGljcywg Y29tcGFyZWQgdG8gYSDigJxwaG9uZSBudW1iZXLigJ0gb3Ig4oCcZW1haWzigJ0gc3ViamVjdCB0 eXBlLiBTbyBJIGRvbuKAmXQgc2VlIHRoZSB2YWx1ZSBpbiBhZGRpbmcgaXQuDQoNCkluIGFkZGl0 aW9uLCBpdCBkb2VzIG5vdCwgYWN0dWFsbHksIGRlc2NyaWJlIGFuIElEIFRva2VuLiBJbiBmYWN0 IHRoZSB0ZXh0IGlzIHZlcnkgY2xlYXIgdGhhdCBpdCBkZXNjcmliZXMgYSDigJxzdWJqZWN04oCd IChhIGR1cmFibGUgZW50aXR5KSByYXRoZXIgdGhhbiBhIHNlc3Npb24sIGFuZCBkb2VzIGl0IGJ5 IGNpdGluZyB2YXJpb3VzIGNsYWltcyBpbmNsdWRlZCBpbiB0aGUgSUQgdG9rZW4uIFNvIGFzIGEg c3ViamVjdCBpZGVudGlmaWVyIHR5cGUsIGl0IGlzIG5vdCBhdCBhbGwgZXF1aXZhbGVudCB0byBh IFNBTUwgYXNzZXJ0aW9uLg0KDQpBcyB0byB0aGUgU0FNTCBBc3NlcnRpb24gc3ViamVjdCB0eXBl LCBJIHRoaW5rIHRoZXNlIHVzZSBjYXNlcyBjb3VsZCBiZSBhZGRyZXNzZWQgYnkgYWRkaW5nIGlu Zm9ybWF0aW9uIHRvIHRoZSBldmVudC4NCg0KVGhhbmtzLA0KICAgICAgICAgICAgICAgIFlhcm9u DQoNCkZyb206IEF0dWwgVHVsc2hpYmFnd2FsZSA8YXR1bHR1bHNoaUBnb29nbGUuY29tPG1haWx0 bzphdHVsdHVsc2hpQGdvb2dsZS5jb20+Pg0KRGF0ZTogVHVlc2RheSwgSnVseSAxNCwgMjAyMCBh dCAyMzoyNg0KVG86IFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNvbTxtYWlsdG86 eWFyb25mLmlldGZAZ21haWwuY29tPj4NCkNjOiBDaHJpcyBQaGlsbGlwcyA8Q2hyaXMuUGhpbGxp cHNAY2FuYXJpZS5jYTxtYWlsdG86Q2hyaXMuUGhpbGxpcHNAY2FuYXJpZS5jYT4+LCAiaWQtZXZl bnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPiIgPGlkLWV2ZW50QGlldGYub3Jn PG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBTQU1M IHN1YmplY3QgaWRlbnRpZmllciB0eXBlDQoNCkhpIFlhcm9uLA0KVGhlcmUgYXJlIGEgZmV3IFNT RSB1c2UgY2FzZXMgd2hlcmUgdGhlIGV2ZW50cyBhcmUgYWJvdXQgYSBzcGVjaWZpYyBzaW5nbGUg c2lnbi1vbiBzZXNzaW9uLiBZb3UncmUgcmlnaHQgdGhhdCB0aGlzIHNob3VsZCBub3QgYmUgbGlt aXRlZCB0byBTQU1MLiBUaGUgUklTQyBwcm9maWxlIG9mIFNFVHMgKGJhc2VkIG9uIHdoaWNoIHdl IGFyZSBkb2luZyB0aGUgU1NFIHdvcmspIGhhZCB0aGUgSUQgVG9rZW4gc3ViamVjdCBpZGVudGlm aWVyIHR5cGUsIHdoaWNoIGZvciBzb21lIHJlYXNvbiBpcyBtaXNzaW5nIGluIHRoaXMgc3BlYyAo SSBkaWQgbm90IHJlYWxpemUgdW50aWwgbm93KS4gVGhlIHNwZWNpZmljIGV2ZW50cyB0aGF0IG5l ZWQgdG8gcmVmZXIgdG8gc2Vzc2lvbnMgYXJlOg0K4oCiICAgICAgICAgSWRlbnRpdHkgcHJvdmlk ZXIgY29udGV4dCBjaGFuZ2U6IFRoZSBjb25kaXRpb25zIHVuZGVyIHdoaWNoIGEgU0FNTCBhc3Nl cnRpb24gb3IgT0lEQyB0b2tlbiB3YXMgZ2VuZXJhdGVkIGFyZSBubyBsb25nZXIgdmFsaWQuIFRo aXMgY2FuIGJlIGR1ZSB0byB2YXJpb3VzIHRoaW5ncywgaW5jbHVkaW5nIGEgcGFzc3dvcmQgY2hh bmdlLg0K4oCiICAgICAgICAgU2Vzc2lvbiBwcm9wZXJ0eSBjaGFuZ2U6IEEgc2Vzc2lvbiBoYXMg YmVlbiBkZXRlcm1pbmVkIHRvIGhhdmUgYmVlbiBjb21wcm9taXNlZA0K4oCiICAgICAgICAgUmV2 b2NhdGlvbjogVGhlIGlzc3VlciBvZiB0aGUgc2luZ2xlIHNpZ24tb24gU0FNTCBhc3NlcnRpb24g b3IgSUQgVG9rZW4gbmVlZHMgdG8gYmUgcmV2b2tlDQpJIGNhbiBhbHNvIGFkZCB0aGUgSUQgVG9r ZW4gY2xhaW0gZnJvbSB0aGUgUklTQyBwcm9maWxlPGh0dHBzOi8vYml0YnVja2V0Lm9yZy9vcGVu aWQvcmlzYy9zcmMvbWFzdGVyL29wZW5pZC1yaXNjLXByb2ZpbGUtMV8wLnR4dCNsaW5lcy0yNTA+ IHRvIG15IHB1bGwgcmVxdWVzdC4NCg0KVGhhbmtzLA0KQXR1bA0KDQoNCk9uIFR1ZSwgSnVsIDE0 LCAyMDIwIGF0IDEyOjMyIFBNIFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNvbTxt YWlsdG86eWFyb25mLi5pZXRmQGdtYWlsLmNvbT4+IHdyb3RlOg0KSSBuZWVkIGEgbG90IG1vcmUg Y29udGV4dCBoZXJlLiBTbyBmYXIsIHN1YmplY3QgSURzIGhhdmUgZGVub3RlZCBkdXJhYmxlIGVu dGl0aWVzLCBzdWNoIGFzIGVtYWlsIGFkZHJlc3NlcywgcGhvbmUgbnVtYmVycywgYWNjb3VudC4g VGhpcyBpcyBhZGRpbmcgYSBzdWJqZWN0IElEIHRoYXQgZGVub3RlcyBhbiBlcGhlbWVyYWwgZW50 aXR5LCBiYXNpY2FsbHkgc2ltaWxhciB0byBhIHNlc3Npb24gSUQuIFRoaXMgbG9va3Mgd2VpcmQg ZnJvbSBhbiBhcmNoaXRlY3R1cmFsIHBvaW50IG9mIHZpZXcsIGFuZCBhbHNvIGJlZ3MgdGhlIHF1 ZXN0aW9uLCB3aHkgc3BlY2lmaWNhbGx5IFNBTUwgYW5kIG5vdCBvdGhlciBzZXNzaW9uIHR5cGVz Lg0KDQpUaGFua3MsDQogICAgICAgICAgICAgICAgWWFyb24NCg0KRnJvbTogSWQtZXZlbnQgPGlk LWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc+ PiBvbiBiZWhhbGYgb2YgQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpPTQwZ29vZ2xlLmNv bUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmlldGYuLm9yZz4+DQpE YXRlOiBUdWVzZGF5LCBKdWx5IDE0LCAyMDIwIGF0IDAwOjE0DQpUbzogQ2hyaXMgUGhpbGxpcHMg PENocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E8bWFpbHRvOkNocmlzLlBoaWxsaXBzQGNhbmFyaWUu Y2E+Pg0KQ2M6ICJpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+IiA8 aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJl OiBbSWQtZXZlbnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGUNCg0KSnVzdCBjbGFyaWZ5 aW5nIHRoZSBwcm9wb3NhbCBhcyBpdCBzdGFuZHMgdG9kYXkgKGJlZm9yZSBpbmNvcnBvcmF0aW5n IENocmlzJ3MgaW5wdXQpOg0KVGhlIGZvbGxvd2luZyBzZWN0aW9uIHNob3VsZCBiZSBhZGRlZCBp biB0aGUgIlN1YmplY3QgSWRlbnRpZmllciBUeXBlcyIgc2VjdGlvbjoNCjQuOS4gIFNBTUwgU3Vi amVjdCBJZGVudGlmaWVyIFR5cGUNCg0KICAgVGhlIFNBTUwgW1NBTUwuUkVGXSBTdWJqZWN0IElk ZW50aWZpZXIgVHlwZSBkZXNjcmliZXMgYSBzdWJqZWN0IGJ5DQogICB0aGUgYXNzZXJ0aW9uIGlk ZW50aWZpZXIgaW4gdGhlIFNBTUwgYXNzZXJ0aW9uIHRoYXQgd2FzIHVzZWQgdG8NCiAgIGNvbnZl eSB0aGUgc3ViamVjdCdzIGluZm9ybWF0aW9uIHRvIHRoZSBSZWNlaXZlci4gIFN1YmplY3QNCiAg IElkZW50aWZpZXJzIG9mIHRoaXMgdHlwZSBNVVNUIGNvbnRhaW4gYW4gYCBhc3NlcnRpb25faWQi Y2xhaW0uICBUaGUNCiAgIHZhbHVlIG9mIHRoaXMgY2xhaW0gaXMgYSBzdHJpbmcgdGhhdCBpcyBl cXVhbCB0byB0aGUgQXNzZXJ0aW9uDQogICBJZGVudGlmaWVyIGluIHRoZSBTQU1MIGFzc2VydGlv bi4gIFRoZSBTQU1MIFN1YmplY3QgSWRlbnRpZmllciBUeXBlDQogICBpcyBpZGVudGlmaWVkIGJ5 IHRoZSBuYW1lICJzYW1sYC4NCg0KICAgQmVsb3cgaXMgYSBub24tbm9ybWF0aXZlIGV4YW1wbGUg U3ViamVjdCBJZGVudGlmaWVyIGZvciB0aGUgU0FNTA0KICAgU3ViamVjdCBJZGVudGlmaWVyIFR5 cGU6DQoNCiAgIHsNCiAgICAgInN1YmplY3RfdHlwZSI6ICJzYW1sIiwNCiAgICAgImFzc2VydGlv bl9pZCI6ICJfZjU1MWQ4ODk2M2FiNGUzZGVjYjdjZmU4ZjRkY2MzZjUiLA0KICAgfQ0KDQogICAg IEZpZ3VyZSA4OiBFeGFtcGxlOiBTdWJqZWN0IElkZW50aWZpZXIgZm9yIFNBTUwgU3ViamVjdCBJ ZGVudGlmaWVyDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFR5cGUuDQoNCg0K T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMToyMiBQTSBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0 dWxzaGlAZ29vZ2xlLmNvbTxtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tPj4gd3JvdGU6DQpI aSBDaHJpcywNCkkgd2FzIHByb3Bvc2luZyB1c2luZyB0aGUgImFzc2VydGlvbiBpZCIgKFNBTUwg Q29yZTxodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9zZWN1cml0eS9zYW1sL3YyLjAvc2FtbC1j b3JlLTIuMC1vcy5wZGY+IHNwZWMsIGxpbmUgNTUzKSBpbiB0aGUgcHJvcG9zYWwsIG5vdCB0aGUg InN1YmplY3QtaWQiIGFzIGRlZmluZWQgaW4gU0FNTCAoc3BlYyBzZWN0aW9uIDMuMykuIFRoZSBt YWluIHJlYXNvbiB3YXMgdG8gYmUgYWJsZSB0byByZWZlciB0byBhIHNlc3Npb24gdGhhdCB3YXMg ZXN0YWJsaXNoZWQgdXNpbmcgYSBzcGVjaWZpYyBhc3NlcnRpb24uIElmIGl0J3MgdXNlZnVsLCB3 ZSBjb3VsZCBwZXJoYXBzIGV4dGVuZCB0aGUgU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZSBp biB0aGlzIHNwZWMgdG8gaW5jbHVkZSBlaXRoZXIgdGhlIGFzc2VydGlvbl9pZCBvciB0aGUgc3Vi amVjdF9pZCBjbGFpbS4NCg0KVGhhbmtzLA0KQXR1bA0KDQoNCk9uIE1vbiwgSnVsIDEzLCAyMDIw IGF0IDEwOjMwIEFNIENocmlzIFBoaWxsaXBzIDxDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPG1h aWx0bzpDaHJpcy4uUGhpbGxpcHNAY2FuYXJpZS5jYT4+IHdyb3RlOg0KSGkuDQpRdWlldCBsdXJr ZXIgb2JzZXJ2aW5nLi4NClRoYW5rcyBmb3IgY29uc2lkZXIgdGhlIFNBTUwgZWxlbWVudHMuLg0K DQpBdHVsLCBhcmUgeW91IHJlZmVycmluZyB0byB0aGUgYWN0dWFsIHNlc3Npb24gaWRlbnRpZmll ciB0aGF0IHNvbWVvbmUgbWF5IGhhdmUgd2hlcmUgdGhlIFN1YmplY3QtSWQgd2FzIGV4Y2hhbmdl ZCBPUiB0aGUgYWN0dWFsIFN1YmplY3QtaWQgaXRzZWxmIGluIHlvdXIgcmVmZXJlbmNlIGluIHRo ZSBwcm9wb3NhbCB3aXRoIHRoZSBnaXRodWIgbGluaz8NCg0KSeKAmW0gdHJ5aW5nIHRvIHNxdWFy ZSB3aGF0IEkgc2VlIG9uIHRoZSBnaXQgZGVsdGEgb24gbGluZSAyOTQtMjk2IGluIGh0dHBzOi8v Z2l0aHViLi4uY29tL3JpY2hhbm5hL3NlY2V2ZW50L3B1bGwvMS9jb21taXRzL2IyMGI2NjkyZWI1 MDYyODkyNzQ3NmNhNzhmOWJlMDc3YWNlODg5OTQ8aHR0cHM6Ly9naXRodWIuY29tL3JpY2hhbm5h L3NlY2V2ZW50L3B1bGwvMS9jb21taXRzL2IyMGI2NjkyZWI1MDYyODkyNzQ3NmNhNzhmOWJlMDc3 YWNlODg5OTQ+DQoNCg0KQW5kIGEgU3ViamVjdC1pZCBhcyBzaG93biBpbiB0aGUgZXhhbXBsZSBp biAzLjMuMyBoZXJlOiBodHRwczovL2RvY3Mub2FzaXMtb3Blbi5vcmcvc2VjdXJpdHkvc2FtbC1z dWJqZWN0LWlkLWF0dHIvdjEuMC9jczAxL3NhbWwtc3ViamVjdC1pZC1hdHRyLXYxLjAtY3MwMS5o dG1sI19Ub2M1MzYwOTcyMjk8aHR0cHM6Ly9kb2NzLm9hc2lzLW9wZW4ub3JnL3NlY3VyaXR5L3Nh bWwtc3ViamVjdC1pZC1hdHRyL3YxLjAvY3MwMS9zYW1sLXN1YmplY3QtaWQtYXR0ci12MS4uMC1j czAxLi5odG1sI19Ub2M1MzYwOTcyMjk+DQoNCldoYXQgeW91IG9mZmVyZWQgaW4gdGhlIGV4YW1w bGUgaXMgbm90IGEgU3ViamVjdC1pZCAgcGVyIHRoZSBPQVNJUyBTQU1MIHNwZWMgYXMgd3JpdHRl biBpbiBzZWN0aW9uIDMuMy4xDQoNCkFtIEkgbWlzLWludGVycHJldGluZyBzb21ldGhpbmc/DQoN CkMNCg0KDQpGcm9tOiBJZC1ldmVudCA8aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86 aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiBBdHVsIFR1bHNoaWJhZ3dh bGUgPGF0dWx0dWxzaGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPG1haWx0bzo0MGdvb2ds ZS5jb21AZG1hcmMuaWV0Zi5vcmc+Pg0KRGF0ZTogTW9uZGF5LCBKdWx5IDEzLCAyMDIwIGF0IDEy OjE3IFBNDQpUbzogImlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4i IDxpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KU3ViamVjdDog W0lkLWV2ZW50XSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlDQoNCkhpIGFsbCwNCkJhc2Vk IG9uIHRoZSBkaXNjdXNzaW9ucyBpbiB0aGUgU1NFIHdvcmtpbmcgZ3JvdXAgd2l0aGluIHRoZSBP cGVuSUQgRm91bmRhdGlvbiwgd2Ugd291bGQgbGlrZSB0byBwcm9wb3NlIHRoYXQgdGhlIHN1Ympl Y3QgaWRlbnRpZmllciBzcGVjaWZpY2F0aW9uIGluY2x1ZGUgYSBTQU1MIHN1YmplY3QgaWRlbnRp ZmllciB0eXBlLiBUaGlzIGlzIHNvIHRoYXQgc2Vzc2lvbnMgZXN0YWJsaXNoZWQgYWNyb3NzIHBl ZXJzIHVzaW5nIFNBTUwgbWF5IGJlIGlkZW50aWZpZWQgaW4gZXZlbnRzIHRoYXQgaW5jbHVkZSB0 aGUgc3ViamVjdCBpZGVudGlmaWVyLg0KDQogQSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciBoYXMg b25seSBvbmUgY2xhaW0gd2l0aGluIGl0LCB0aGUgYXNzZXJ0aW9uIGlkIG9mIHRoZSBTQU1MIGFz c2VydGlvbiB1c2VkIHRvIGVzdGFibGlzaCB0aGUgc2luZ2xlIHNpZ24tb24gc2Vzc2lvbi4NCg0K VGhpcyBjaGFuZ2UgaXMgYWxzbyBpbmNsdWRlZCBpbiBteSBwcm9wb3NhbCBoZXJlPGh0dHBzOi8v Z2l0aHViLmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzE+Lg0KDQpUaGFua3MsDQpBdHVsDQoN Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVu dCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9y Zz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIElkLWV2ZW50IG1haWxp bmcgbGlzdCBJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+IGh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QN CklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0KQ09ORklERU5USUFMSVRZIE5P VElDRTogVGhpcyBlbWFpbCBtYXkgY29udGFpbiBjb25maWRlbnRpYWwgYW5kIHByaXZpbGVnZWQg bWF0ZXJpYWwgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpLiBB bnkgcmV2aWV3LCB1c2UsIGRpc3RyaWJ1dGlvbiBvciBkaXNjbG9zdXJlIGJ5IG90aGVycyBpcyBz dHJpY3RseSBwcm9oaWJpdGVkLi4gIElmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgY29tbXVuaWNh dGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGJ5IGUt bWFpbCBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlIGFuZCBhbnkgZmlsZSBhdHRhY2htZW50cyBmcm9t IHlvdXIgY29tcHV0ZXIuIFRoYW5rIHlvdS4NCg== --_000_MN2PR00MB068653B00930B9E02E2286E5F57E0MN2PR00MB0686namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTotYXBwbGUtc3lzdGVtO30NCi8qIFN0eWxl IERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFs DQoJe21hcmdpbjowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0K cC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFn cmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47DQoJbWFyZ2lu LXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDouNWluOw0KCWZv bnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bh bi5FbWFpbFN0eWxlMjMNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo5Mjgx OTQ1NDU7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjk1 MTQ2MzY4NiA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5 ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBs MDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0 ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhh LWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTku MHB0O30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0 IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBs MQ0KCXttc28tbGlzdC1pZDoxNDEwNTQ0ODU2Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczo1MzQ3 OTE3NTA7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTow aW47fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVs dHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0t W2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlk bWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2Vu ZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJw dXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5J4oCZZCBzdWdnZXN0IG5vdCBkZWZpbmluZyBh bnkgc3ViamVjdCB0eXBlcyB0aGF0IHdlIGRvbuKAmXQgaGF2ZSBpbW1lZGlhdGUgdXNlIGNhc2Vz IGZvciwgYXMgd2UgbWlnaHQgZ2V0IHRoZSBkZXRhaWxzIHdyb25nLiZuYnNwOyBXZeKAmXJlIGNy ZWF0aW5nIGEgcmVnaXN0cnkgdG8gYWRkIG5ldyBvbmVzLCBzbyB0aGV5IGNhbiBhbHdheXMgYmUg YWRkZWQgbGF0ZXIgd2hlbiB0aGV54oCZcmUNCiBhY3R1YWxseSBuZWVkZWQuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIw NjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5MZXTigJlzIGtlZXAgdGhpcyBzaW1wbGUsIHdoaWxl IG1lZXRpbmcgdGhlIGltbWVkaWF0ZWx5IGtub3duIG5lZWRzLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZy b206PC9iPiBJZC1ldmVudCAmbHQ7aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyZndDsgPGI+T24g QmVoYWxmIE9mDQo8L2I+UmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGU8YnI+DQo8Yj5TZW50Ojwv Yj4gV2VkbmVzZGF5LCBKdWx5IDE1LCAyMDIwIDI6MjUgUE08YnI+DQo8Yj5Ubzo8L2I+IEF0dWwg VHVsc2hpYmFnd2FsZSAmbHQ7YXR1bHR1bHNoaT00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmcm Z3Q7OyBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSAmbHQ7cmljaGFubmE9NDBhbWF6b24uY29t QGRtYXJjLmlldGYub3JnJmd0Ozxicj4NCjxiPkNjOjwvYj4gWWFyb24gU2hlZmZlciAmbHQ7eWFy b25mLmlldGZAZ21haWwuY29tJmd0OzsgQnJpYW4gQ2FtcGJlbGwgJmx0O2JjYW1wYmVsbEBwaW5n aWRlbnRpdHkuY29tJmd0OzsgQ2hyaXMgUGhpbGxpcHMgJmx0O0NocmlzLlBoaWxsaXBzQGNhbmFy aWUuY2EmZ3Q7OyBpZC1ldmVudEBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lk LWV2ZW50XSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5rIHRoZSB0d28gc3ViamVjdCB0eXBlcyDigJMgdGhl IOKAnG9hdXRoX3Rva2Vu4oCdIHR5cGUgZGVzY3JpYmVkIGluIG15IHByaW9yIGVtYWlsLCBhbmQg YSDigJxvYXV0aF9jbGllbnTigJ0gdHlwZSB0aGF0IGlkZW50aWZpZXMgYSBzdWJqZWN0IGJ5IGl0 cyBPQXV0aCAyLjAgY2xpZW50IElEIOKAkyBhcmUgcmVhc29uYWJsZSB0eXBlcyB0byBkZWZpbmUu IEkgZG9u4oCZdCBzZWUgYSBwYXJ0aWN1bGFyIG5lZWQgdG8gbW92ZSB0aGVtDQogaW50byB0aGUg YmFzZSBzcGVjIOKAkyB3ZSBkZWZpbmUgYW4gSUFOQSByZWdpc3RyeSBwcmVjaXNlbHkgc28gd2Ug ZG9u4oCZdCBoYXZlIHRvIHRyeSB0byBkZWZpbmUgZXZlcnl0aGluZyB1cCBmcm9udCDigJMgYnV0 IEnigJltIG5vdCBvcHBvc2VkIHRvIHRoZSBpZGVhLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J 4oCZbSBub3Qgc3VyZSB3aGVyZSB0aGlzIG5vdGlvbiBvZiBhIOKAnGR1cmFibGUgc3ViamVjdOKA nSBjYW1lIGZyb20uIFJpZ2h0IGluIHRoZSBpbnRyb2R1Y3Rpb24sDQo8YSBocmVmPSJodHRwczov L3d3dy5yZmMtZWRpdG9yLm9yZy9yZmMvcmZjODQxNy5odG1sI3NlY3Rpb24tMSI+UkZDIDg0MTc8 L2E+IHNheXMgdGhlIHN1YmplY3Qgb2YgYSBzZWN1cml0eSBldmVudCDigJxtYXkgYmUgcGVybWFu ZW50IChlLmcuLCBhIHVzZXIgYWNjb3VudCkgb3IgdGVtcG9yYXJ5IChlLmcuLCBhbiBIVFRQIHNl c3Npb24pIGluIG5hdHVyZS7igJ0gVGhlcmUgYXJlIHBsZW50eSBvZiB1c2UgY2FzZXMgZm9yIGV2 ZW50cyB3aGVyZSB0aGUgc3ViamVjdHMNCiBhcmUgdGVtcG9yYXJ5L2VwaGVtZXJhbDo8bzpwPjwv bzpwPjwvcD4NCjxvbCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIxIiB0eXBlPSIxIj4N CjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28t bGlzdDpsMCBsZXZlbDEgbGZvMyI+U2Vzc2lvbiB0ZXJtaW5hdGlvbjxvOnA+PC9vOnA+PC9saT48 bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxp c3Q6bDAgbGV2ZWwxIGxmbzMiPkNoYW5nZXMgaW4gdGhlIHNlY3VyaXR5IHBvc3R1cmUgZm9yIGEg c2Vzc2lvbjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxl PSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzMiPlRva2VuIHJldm9jYXRp b248bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MGluO21zby1saXN0OmwwIGxldmVsMSBsZm8zIj5Bc3luY2hyb25vdXMgYXBwcm92 YWwgb2YgYSByZXF1ZXN0PG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMyI+Q2hhbmdl cyBpbiB0aGUgc3RhdGUgb2YgYSB0cmFuc2FjdGlvbjxvOnA+PC9vOnA+PC9saT48L29sPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+4oCmZXRjLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XaGV0aGVy IG9yIG5vdCBpdCBtYWtlcyBzZW5zZSB0byBpZGVudGlmeSBhIHNlc3Npb24gc3ViamVjdCB1c2lu ZyBhIFNBTUwgYXNzZXJ0aW9uIElEIChvciBhbiBJRCBUb2tlbiDigJxqdGnigJ0gY2xhaW0sIGlu IHRoZSBPSURDIHdvcmxkKSBpcyBhIHNlcGFyYXRlIHF1ZXN0aW9uLiBBZGRpbmcgc2VtYW50aWNz IHRvIGV4aXN0aW5nIGlkZW50aWZpZXJzIHRlbmRzIHRvIGxlYWQgdG8gbG90cyBvZiB1bmZvcmVz ZWVuIGNvbXBsaWNhdGlvbnMsDQogYW5kIGRlcGVuZCBvbiBhc3N1bXB0aW9ucyB0aGF0IGRvbuKA mXQgYWx3YXlzIGhvbGQgdHJ1ZS4gSW4gdGhpcyBjYXNlLCB0aGVyZSBzZWVtcyB0byBiZSBhbiBh c3N1bXB0aW9uIHRoYXQgdGhlcmUgaXMgYSAxOjEgcmVsYXRpb25zaGlwIGJldHdlZW4gYSBTQU1M IGFzc2VydGlvbiBhbmQgYSBzZXNzaW9uLiBUaGlzIGlzIG5vdCBhbHdheXMgdGhlIGNhc2UuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJlZ2FyZGxlc3MsIGEgU0FNTCBhc3NlcnRpb24gSUQgaXMg Y2xlYXJseSBhbiBhcHByb3ByaWF0ZSBpZGVudGlmaWVyIHdoZW4gdGhlIHN1YmplY3QgaXMgYSBT QU1MIGFzc2VydGlvbi4gSSBkb27igJl0IGtub3cgb2ZmaGFuZCBpZiB0aGVyZSBhcmUgYW55IHVz ZSBjYXNlcyBmb3IgZXZlbnRzIHJlbGF0aW5nIHRvIGEgU0FNTCBhc3NlcnRpb24gaXRzZWxmLiBJ IGNhbiBjZXJ0YWlubHkgc2VlIHVzZSBjYXNlcyBmb3INCiBldmVudHMgcmVsYXRlZCB0byBKV1Rz IChlLmcuLCByZXZvY2F0aW9uIG9mIGEgSldUIGFjY2VzcyB0b2tlbiksIHdoZXJlIGEg4oCcanRp 4oCdIHN1YmplY3QgaWRlbnRpZmllciB0eXBlIHdvdWxkIGJlIGFwcHJvcHJpYXRlLiBJ4oCZbSBp bmNsaW5lZCB0byBhZGQgaXQgdG8gdGhlIGRyYWZ0LCBpZiBmb3Igbm8gb3RoZXIgcmVhc29uIHRo YW4gdG8gcHJvdmlkZSBhIG5vcm1hdGl2ZSBkZW1vbnN0cmF0aW9uIG9mIGEgc3ViamVjdCBpZGVu dGlmaWVyIHRoYXQNCiB3b3VsZCBiZSB1c2VkIHRvIGlkZW50aWZ5IGEgbW9yZSBlcGhlbWVyYWwg c3ViamVjdC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0Ij7igJM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+QW5uYWJlbGxlIEJhY2ttYW4gKHNo ZS9oZXIpPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkFXUyBJZGVudGl0eTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx1PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0 O2NvbG9yOiMwNTYzQzEiPjxhIGhyZWY9Imh0dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRpdHkv Ij5odHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5LzwvYT48L3NwYW4+PC91PjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PGI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206DQo8L3NwYW4+PC9iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5JZC1ldmVudCAmbHQ7PGEgaHJl Zj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciPmlkLWV2ZW50LWJvdW5jZXNAaWV0 Zi5vcmc8L2E+Jmd0OyBvbiBiZWhhbGYgb2YgQXR1bCBUdWxzaGliYWd3YWxlICZsdDs8YSBocmVm PSJtYWlsdG86YXR1bHR1bHNoaT00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmciPmF0dWx0dWxz aGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+ V2VkbmVzZGF5LCBKdWx5IDE1LCAyMDIwIGF0IDEyOjQ3IFBNPGJyPg0KPGI+VG86IDwvYj4mcXVv dDtSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJp Y2hhbm5hPTQwYW1hem9uLmNvbUBkbWFyYy5pZXRmLm9yZyI+cmljaGFubmE9NDBhbWF6b24uY29t QGRtYXJjLmlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5DYzogPC9iPllhcm9uIFNoZWZmZXIgJmx0 OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20iPnlhcm9uZi5pZXRmQGdtYWls LmNvbTwvYT4mZ3Q7LCBCcmlhbiBDYW1wYmVsbCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJjYW1wYmVs bEBwaW5naWRlbnRpdHkuY29tIj5iY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbTwvYT4mZ3Q7LCBD aHJpcyBQaGlsbGlwcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkNocmlzLlBoaWxsaXBzQGNhbmFyaWUu Y2EiPkNocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E8L2E+Jmd0OywNCiAmcXVvdDs8YSBocmVmPSJt YWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciPmlkLWV2ZW50QGlldGYub3JnPC9hPiZxdW90OyAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4m Z3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJFOiBbRVhURVJOQUxdIFtJZC1ldmVudF0gU0FNTCBz dWJqZWN0IGlkZW50aWZpZXIgdHlwZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFi bGUiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0aD0iNjIy IiBzdHlsZT0id2lkdGg6NDY2LjVwdDttYXJnaW4tbGVmdDouNWluO2JvcmRlci1jb2xsYXBzZTpj b2xsYXBzZSI+DQo8dGJvZHk+DQo8dHIgc3R5bGU9ImhlaWdodDoxNS4yNXB0Ij4NCjx0ZCB3aWR0 aD0iNjIyIiB2YWxpZ249InRvcCIgc3R5bGU9IndpZHRoOjQ2Ni41cHQ7Ym9yZGVyOnNvbGlkICNF RDdEMzEgMS41cHQ7cGFkZGluZzowaW4gNS40cHQgMGluIDUuNHB0O2hlaWdodDoxNS4yNXB0Ij4N CjxwPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkZGOTkiPkNBVVRJT048L3NwYW4+ PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQ6I0ZGRkY5OSI+OiBU aGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRpb24uIERv IG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcw0KIHlvdSBjYW4gY29u ZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+SG93IGRvIHdlIHByb3Bvc2UgdG8gc3VwcG9ydCB0aGUgdHdvIHN1YmplY3Qg dHlwZXMgZGVmaW5lZCBpbiB0aGUNCjxhIGhyZWY9Imh0dHBzOi8vb3BlbmlkLm5ldC9zcGVjcy9v YXV0aC1ldmVudC10eXBlcy0xXzAtSUQxLmh0bWwiPk9BdXRoIEV2ZW50IFR5cGVzPC9hPiBzcGVj IGhlcmU/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk9uIFR1ZSwgSnVs IDE0LCAyMDIwIGF0IDQ6NTQgUE0gUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgJmx0O3JpY2hh bm5hPTxhIGhyZWY9Im1haWx0bzo0MGFtYXpvbi5jb21AZG1hcmMuaWV0Zi5vcmciPjQwYW1hem9u LmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KVGhlIFJJ U0MgUHJvZmlsZeKAmXMg4oCcSUQgVG9rZW4gQ2xhaW1z4oCdIHR5cGUgZG9lcyBub3QgaWRlbnRp ZnkgYSBzdWJqZWN0IHRoYXQgaXMgYW4gSUQgVG9rZW4sIGl0IGlkZW50aWZpZXMgYSBzdWJqZWN0 IHRoYXQgd2FzIHRoZSBzdWJqZWN0IG9mIGFuIElEIFRva2VuLiBJdCB3YXMgaW50ZW5kZWQgZm9y IGNhc2VzIHdoZXJlIHRoZSBPUCBzZW50IG11bHRpcGxlIGlkZW50aWZpZXJzIG9mIGRpZmZlcmVu dCB0eXBlcyBpbiB0aGUgSUQgVG9rZW4gKGUuZy4sDQogaXNzK3N1YiBhbmQgZW1haWwpLCBhbmQg ZG9lcyBub3Qga25vdyB3aGljaCBvZiB0aGVtIHRoZSBjbGllbnQgd2lsbCByZWNvZ25pemUgKHll cywgdGhlDQo8aT5zaG91bGQ8L2k+IHVzZSBpc3Mrc3ViOyBubywgdGhleSBkb2VzbuKAmXQgYWx3 YXlzIGRvIHNvKS4gVGhpcyB0eXBlIHdhcyByZXBsYWNlZCBpbiBkcmFmdC1pZXRmLXNlY2V2ZW50 LXN1YmplY3QtaWRlbnRpZmllcnMtMDMgd2l0aCB0aGUg4oCcYWxpYXNlc+KAnSB0eXBlLCB3aGlj aCBpcyBhIGdlbmVyYWwgc29sdXRpb24gdG8gdGhpcyBwcm9ibGVtIHRoYXQgaXMgbm90IGRlZmlu ZWQgaW4gdGVybXMgb2Ygb25lIHBhcnRpY3VsYXIgdXNlIGNhc2UgKGkuZS4sDQogSUQgVG9rZW5z KS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWlu Ij4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0Oi41aW4iPg0KVGhlIE9JREYgU1NFIHdvcmtpbmcgZ3JvdXDigJlzIDxhIGhyZWY9Imh0dHBz Oi8vb3BlbmlkLm5ldC9zcGVjcy9vYXV0aC1ldmVudC10eXBlcy0xXzAtSUQxLmh0bWwjcmZjLnNl Y3Rpb24uMi4xIiB0YXJnZXQ9Il9ibGFuayI+DQpPQXV0aCBFdmVudCBUeXBlcyBkcmFmdDwvYT4g ZGVmaW5lcyBhIOKAnG9hdXRoX3Rva2Vu4oCdIHR5cGUgdGhhdCBpZGVudGlmaWVzIGEgc3ViamVj dCB0aGF0IGlzIGFuIE9BdXRoIDIuMCB0b2tlbiwgYW5kIGRvZXMgc28gdXNpbmcgZWl0aGVyIHRo ZSBmdWxsIG9yIHBhcnRpYWwgcGxhaW4gdGV4dCB2YWx1ZSBvZiB0aGUgdG9rZW4sIG9yIGEgaGFz aCBvZiB0aGUgdG9rZW4uLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpJdCBpcyBwZXJmZWN0bHkgZmluZSBmb3IgYSB0b2tl biB0byBiZSB0aGUgc3ViamVjdCBvZiBhIHNlY3VyaXR5IGV2ZW50LiA8YSBocmVmPSJodHRwczov L3d3dy5yZmMtZWRpdG9yLm9yZy9yZmMvcmZjODQxNy5odG1sI3NlY3Rpb24tMi4yIiB0YXJnZXQ9 Il9ibGFuayI+DQo4NDE3PC9hPiBhY3R1YWxseSBpbmNsdWRlcyB0aGUgZm9sbG93aW5nIGFzIGFu IGV4YW1wbGUgb2YgYSBwb3NzaWJsZSB2YWx1ZSBmb3IgdGhlIOKAnHN1YuKAnSBjbGFpbTo8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90Oztjb2xvcjpibGFjayI+KiZuYnNwOyBhIHRva2VuIGlkZW50aWZpZXIgKGUuZy4gJnF1 b3Q7anRpJnF1b3Q7KSBmb3IgYSByZXZva2VkIHRva2VuLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4N CjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij7igJM8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+QW5uYWJlbGxlIEJhY2ttYW4gKHNoZS9oZXIpPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkFXUyBJZGVudGl0eTwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48YSBocmVmPSJodHRwczovL2F3cy5hbWF6b24uY29tL2lk ZW50aXR5LyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDU2M0MxIj5odHRw czovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5Lzwvc3Bhbj48L2E+PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQom bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDou NWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5JZC1ldmVudCAmbHQ7PGEgaHJlZj0i bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVu dC1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgb24gYmVoYWxmIG9mIEF0dWwgVHVsc2hpYmFnd2Fs ZSAmbHQ7YXR1bHR1bHNoaT08YSBocmVmPSJtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmlldGYu b3JnIiB0YXJnZXQ9Il9ibGFuayI+NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPC9hPiZndDs8 YnI+DQo8Yj5EYXRlOiA8L2I+VHVlc2RheSwgSnVseSAxNCwgMjAyMCBhdCA0OjMyIFBNPGJyPg0K PGI+VG86IDwvYj5CcmlhbiBDYW1wYmVsbCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJjYW1wYmVsbEBw aW5naWRlbnRpdHkuY29tIiB0YXJnZXQ9Il9ibGFuayI+YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5j b208L2E+Jmd0Ozxicj4NCjxiPkNjOiA8L2I+WWFyb24gU2hlZmZlciAmbHQ7PGEgaHJlZj0ibWFp bHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnlhcm9uZi5pZXRmQGdt YWlsLmNvbTwvYT4mZ3Q7LCBDaHJpcyBQaGlsbGlwcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkNocmlz LlBoaWxsaXBzQGNhbmFyaWUuY2EiIHRhcmdldD0iX2JsYW5rIj5DaHJpcy5QaGlsbGlwc0BjYW5h cmllLmNhPC9hPiZndDssICZxdW90OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3JnPC9hPiZxdW90Ow0KICZsdDs8YSBocmVm PSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRm Lm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJFOiBbRVhURVJOQUxdIFtJZC1ldmVu dF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQom bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9y bWFsVGFibGUiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0 aD0iNjIyIiBzdHlsZT0id2lkdGg6NDY2LjVwdDttYXJnaW4tbGVmdDoxLjBpbjtib3JkZXItY29s bGFwc2U6Y29sbGFwc2UiPg0KPHRib2R5Pg0KPHRyIHN0eWxlPSJoZWlnaHQ6MTUuMjVwdCI+DQo8 dGQgd2lkdGg9IjYyMiIgdmFsaWduPSJ0b3AiIHN0eWxlPSJ3aWR0aDo0NjYuNXB0O2JvcmRlcjpz b2xpZCAjRUQ3RDMxIDEuNXB0O3BhZGRpbmc6MGluIDUuNHB0IDBpbiA1LjRwdDtoZWlnaHQ6MTUu MjVwdCI+DQo8cD48c3Ryb25nPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDojRkZGRjk5Ij5DQVVUSU9O PC9zcGFuPjwvc3Ryb25nPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkZG OTkiPjogVGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZyb20gb3V0c2lkZSBvZiB0aGUgb3JnYW5pemF0 aW9uLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Igb3BlbiBhdHRhY2htZW50cyB1bmxlc3MNCiB5b3Ug Y2FuIGNvbmZpcm0gdGhlIHNlbmRlciBhbmQga25vdyB0aGUgY29udGVudCBpcyBzYWZlLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvdGQ+DQo8L3RyPg0KPC90Ym9keT4NCjwvdGFibGU+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuMGluIj4NCklNTyBpZiB3ZSBoYXZlIGEgY29tbW9uIGVub3VnaCB1c2UtY2FzZSB0aGF0 IHJlcXVpcmVzIGEgc3BlY2lmaWMgdHlwZSB0byBiZSBkZWZpbmVkLCB0aGVuIHdlIHNob3VsZCBk ZWZpbmUgdGhhdCB0eXBlIGluIHRoZSBzcGVjIHJhdGhlciB0aGFuIHJlbHkgb24gYW4gaW50ZXJw cmV0YXRpb24gb2YgdGhlICZxdW90O2lzcy1zdWImcXVvdDsgdHlwZSwgc2luY2UgdGhhdCBpbnRl cnByZXRhdGlvbiBjYW4gY2F1c2UgaW5jb21wYXRpYmlsaXRpZXMuDQo8bzpwPjwvbzpwPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW4iPg0KSW4gdGhpcyBzcGVjaWZpYyBjYXNlIGhvd2V2ZXIgSSBmZWVsIHRo YXQgdGhlIHVzZSBjYXNlcyBvdXRsaW5lZCBpbiBteSBwcmV2aW91cyBlbWFpbCBjYW4gYmUgYWNo aWV2ZWQgKHdpdGggbGltaXRhdGlvbnMpIHVzaW5nIHRoZSBkdXJhYmxlIHN1YmplY3QgdHlwZXMg c3VjaCBhcyBlbWFpbC4gSSdkIGxpa2UgdGhlIG1lbWJlcnMgb2YgdGhlIFNTRSB3b3JraW5nIGdy b3VwIHRvIGNoaW1lIGluIChzaW5jZSB0aGF0IGlzIHdoZXJlIHRoaXMgZ290IGFkZGVkKSwNCiBv ciB3ZSBjYW4gZHJvcCB0aGUgU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZS48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpPbiBUdWUsIEp1bCAxNCwgMjAyMCBhdCA0 OjA5IFBNIEJyaWFuIENhbXBiZWxsICZsdDs8YSBocmVmPSJtYWlsdG86YmNhbXBiZWxsQHBpbmdp ZGVudGl0eS5jb20iIHRhcmdldD0iX2JsYW5rIj5iY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbTwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAw aW4gMGluIDYuMHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90 dG9tOjUuMHB0O21hcmdpbi1sZWZ0OjQuLjhwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQorIDEgdG8gd2hhdCBZYXJvbiBpcyBzYXlp bmcgaGVyZS4gSSdkIGluY2x1ZGUgYWxzbyB0aGUgJnF1b3Q7aXNzLXN1YiZxdW90OyBzdWJqZWN0 IGlkZW50aWZpZXIgdHlwZQ0KPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LWlldGYtc2VjZXZlbnQtc3ViamVjdC1pZGVudGlmaWVycy0wNSNzZWN0aW9uLTMuNCIgdGFy Z2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2Vj ZXZlbnQtc3ViamVjdC1pZGVudGlmaWVycy0wNSNzZWN0aW9uLTMuNDwvYT4gYXMgYWxyZWFkeSBo YXZpbmcgc2VtYW50aWNzIGNvdmVyaW5nIHdoYXQncyBkZXNjcmliZWQgaW4gdGhlIElEIFRva2Vu IENsYWltcyBTdWJqZWN0IElkZW50aWZpZXIgVHlwZSBpbiB0aGUgUklTQyBkb2N1bWVudCByZWZl cmVuY2VkLiBBbmQgYWxsIHRob3NlIHRoaW5ncyByZXByZXNlbnQgYSBkdXJhYmxlDQogc3ViamVj dCByYXRoZXIgdGhhbiBhIHNlc3Npb24sIHdoaWNoIHN0cmlrZXMgbWUgYXMgYXBwcm9wcmlhdGUg Zm9yIGEgZG9jdW1lbnQgdGhhdCBkZXNjcmliZXMgaWRlbnRpZnlpbmcgc3ViamVjdHMuIEEgU0FN TCBhc3NlcnRpb24gSUQsIGhvd2V2ZXIsIHdoaWNoIGlzIGFuIGlkZW50aWZpZXIgb2YgYW4gWE1M IGRvY3VtZW50IHRoYXQgaXMgb25seSBpbmRpcmVjdGx5IHJlbGF0ZWQgdG8gYSBzZXNzaW9uIGJ5 IGFuIGFzc29jaWF0aW9uIHRoYXQgbGlrZWx5DQogaXNuJ3QgbWFpbnRhaW5lZCwgZG9lcyBub3Qg c2VlbSBhcHByb3ByaWF0ZSBhcyBhICZxdW90O3N1YmplY3QgaWRlbnRpZmllciZxdW90Oy4gPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KT24gVHVlLCBKdWwgMTQsIDIw MjAgYXQgNDowMSBQTSBZYXJvbiBTaGVmZmVyICZsdDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmll dGZAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206 NS4wcHQ7bWFyZ2luLWxlZnQ6NC4uOHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkhpIEF0dWwsPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhlIElEIFRv a2VuIHN1YmplY3QgdHlwZSwgYXMgZGVzY3JpYmVkIGluIHRoZSBkb2N1bWVudCB5b3UgYXJlIHJl ZmVyZW5jaW5nLCBkb2VzIG5vdCBhZGQgYW55IHNlbWFudGljcywgY29tcGFyZWQgdG8gYSDigJxw aG9uZSBudW1iZXLigJ0gb3Ig4oCcZW1haWzigJ0gc3ViamVjdCB0eXBlLiBTbyBJIGRvbuKAmXQg c2VlIHRoZSB2YWx1ZSBpbiBhZGRpbmcgaXQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KSW4gYWRkaXRpb24sIGl0IGRv ZXMgbm90LCBhY3R1YWxseSwgZGVzY3JpYmUgYW4gSUQgVG9rZW4uIEluIGZhY3QgdGhlIHRleHQg aXMgdmVyeSBjbGVhciB0aGF0IGl0IGRlc2NyaWJlcyBhIOKAnHN1YmplY3TigJ0gKGEgZHVyYWJs ZSBlbnRpdHkpIHJhdGhlciB0aGFuIGEgc2Vzc2lvbiwgYW5kIGRvZXMgaXQgYnkgY2l0aW5nIHZh cmlvdXMgY2xhaW1zIGluY2x1ZGVkIGluIHRoZSBJRCB0b2tlbi4gU28gYXMgYSBzdWJqZWN0IGlk ZW50aWZpZXIgdHlwZSwNCiBpdCBpcyBub3QgYXQgYWxsIGVxdWl2YWxlbnQgdG8gYSBTQU1MIGFz c2VydGlvbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQpBcyB0byB0aGUgU0FNTCBBc3NlcnRpb24gc3ViamVjdCB0eXBl LCBJIHRoaW5rIHRoZXNlIHVzZSBjYXNlcyBjb3VsZCBiZSBhZGRyZXNzZWQgYnkgYWRkaW5nIGlu Zm9ybWF0aW9uIHRvIHRoZSBldmVudC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpUaGFua3MsPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFlhcm9uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5BdHVsIFR1bHNoaWJhZ3dhbGUg Jmx0OzxhIGhyZWY9Im1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5r Ij5hdHVsdHVsc2hpQGdvb2dsZS5jb208L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UdWVzZGF5 LCBKdWx5IDE0LCAyMDIwIGF0IDIzOjI2PGJyPg0KPGI+VG86IDwvYj5ZYXJvbiBTaGVmZmVyICZs dDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmlldGZAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+ eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzogPC9iPkNocmlzIFBoaWxs aXBzICZsdDs8YSBocmVmPSJtYWlsdG86Q2hyaXMuUGhpbGxpcHNAY2FuYXJpZS5jYSIgdGFyZ2V0 PSJfYmxhbmsiPkNocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E8L2E+Jmd0OywgJnF1b3Q7PGEgaHJl Zj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0 Zi5vcmc8L2E+JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRh cmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDog PC9iPlJlOiBbSWQtZXZlbnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGU8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KSGkmbmJzcDtZYXJvbiw8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW4iPg0KVGhlcmUgYXJlIGEgZmV3IFNTRSB1c2UgY2FzZXMgd2hlcmUgdGhlIGV2ZW50cyBhcmUg YWJvdXQgYSBzcGVjaWZpYyBzaW5nbGUgc2lnbi1vbiBzZXNzaW9uLiBZb3UncmUgcmlnaHQgdGhh dCB0aGlzIHNob3VsZCBub3QgYmUgbGltaXRlZCB0byBTQU1MLiBUaGUgUklTQyBwcm9maWxlIG9m IFNFVHMgKGJhc2VkIG9uIHdoaWNoIHdlIGFyZSBkb2luZyB0aGUgU1NFIHdvcmspIGhhZCB0aGUg SUQgVG9rZW4gc3ViamVjdCBpZGVudGlmaWVyIHR5cGUsIHdoaWNoDQogZm9yIHNvbWUgcmVhc29u IGlzIG1pc3NpbmcgaW4gdGhpcyBzcGVjIChJIGRpZCBub3QgcmVhbGl6ZSB1bnRpbCBub3cpLiBU aGUgc3BlY2lmaWMgZXZlbnRzIHRoYXQgbmVlZCB0byByZWZlciB0byBzZXNzaW9ucyBhcmU6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 U3ltYm9sIj7Ctzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+SWRlbnRpdHkgcHJvdmlkZXIgY29u dGV4dCBjaGFuZ2U6IFRoZSBjb25kaXRpb25zIHVuZGVyIHdoaWNoIGEgU0FNTCBhc3NlcnRpb24g b3IgT0lEQyB0b2tlbiB3YXMgZ2VuZXJhdGVkIGFyZSBubyBsb25nZXImbmJzcDt2YWxpZC4gVGhp cyBjYW4gYmUgZHVlIHRvIHZhcmlvdXMgdGhpbmdzLCBpbmNsdWRpbmcgYSBwYXNzd29yZCBjaGFu Z2UuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41 aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6U3ltYm9sIj7C tzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Rp bWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+U2Vzc2lvbiBwcm9wZXJ0eSBjaGFuZ2U6IEEgc2Vz c2lvbiBoYXMgYmVlbiBkZXRlcm1pbmVkIHRvIGhhdmUgYmVlbiBjb21wcm9taXNlZDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OlN5bWJvbCI+wrc8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9t YW4mcXVvdDssc2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOw0KPC9zcGFuPlJldm9jYXRpb246IFRoZSBpc3N1ZXIgb2YgdGhlIHNpbmdsZSBzaWdu LW9uIFNBTUwgYXNzZXJ0aW9uIG9yIElEIFRva2VuIG5lZWRzIHRvIGJlIHJldm9rZTxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+ DQpJIGNhbiBhbHNvIGFkZCB0aGUgPGEgaHJlZj0iaHR0cHM6Ly9iaXRidWNrZXQub3JnL29wZW5p ZC9yaXNjL3NyYy9tYXN0ZXIvb3BlbmlkLXJpc2MtcHJvZmlsZS0xXzAudHh0I2xpbmVzLTI1MCIg dGFyZ2V0PSJfYmxhbmsiPg0KSUQgVG9rZW4gY2xhaW0gZnJvbSB0aGUgUklTQyBwcm9maWxlPC9h PiB0byBteSBwdWxsIHJlcXVlc3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDoxLjBpbiI+DQpUaGFua3MsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KQXR1bDxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGlu Ij4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIFR1 ZSwgSnVsIDE0LCAyMDIwIGF0IDEyOjMyIFBNIFlhcm9uIFNoZWZmZXIgJmx0OzxhIGhyZWY9Im1h aWx0bzp5YXJvbmYuLmlldGZAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+eWFyb25mLmlldGZA Z21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1 b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3Bh ZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQ7Ym9yZGVyLXRvcDpjdXJyZW50 Y29sb3I7Ym9yZGVyLXJpZ2h0OmN1cnJlbnRjb2xvcjtib3JkZXItYm90dG9tOmN1cnJlbnRjb2xv ciI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp biI+DQpJIG5lZWQgYSBsb3QgbW9yZSBjb250ZXh0IGhlcmUuIFNvIGZhciwgc3ViamVjdCBJRHMg aGF2ZSBkZW5vdGVkIGR1cmFibGUgZW50aXRpZXMsIHN1Y2ggYXMgZW1haWwgYWRkcmVzc2VzLCBw aG9uZSBudW1iZXJzLCBhY2NvdW50LiBUaGlzIGlzIGFkZGluZyBhIHN1YmplY3QgSUQgdGhhdCBk ZW5vdGVzIGFuIGVwaGVtZXJhbCBlbnRpdHksIGJhc2ljYWxseSBzaW1pbGFyIHRvIGEgc2Vzc2lv biBJRC4gVGhpcyBsb29rcyB3ZWlyZCBmcm9tIGFuIGFyY2hpdGVjdHVyYWwNCiBwb2ludCBvZiB2 aWV3LCBhbmQgYWxzbyBiZWdzIHRoZSBxdWVzdGlvbiwgd2h5IHNwZWNpZmljYWxseSBTQU1MIGFu ZCBub3Qgb3RoZXIgc2Vzc2lvbiB0eXBlcy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpUaGFua3MsPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFlhcm9uIDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+SWQtZXZlbnQgJmx0Ozxh IGhyZWY9Im1haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7IG9uIGJlaGFsZiBvZiBBdHVsIFR1bHNo aWJhZ3dhbGUgJmx0O2F0dWx0dWxzaGk9PGEgaHJlZj0ibWFpbHRvOjQwZ29vZ2xlLmNvbUBkbWFy Yy5pZXRmLi5vcmciIHRhcmdldD0iX2JsYW5rIj40MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc8 L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UdWVzZGF5LCBKdWx5IDE0LCAyMDIwIGF0IDAwOjE0 PGJyPg0KPGI+VG86IDwvYj5DaHJpcyBQaGlsbGlwcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkNocmlz LlBoaWxsaXBzQGNhbmFyaWUuY2EiIHRhcmdldD0iX2JsYW5rIj5DaHJpcy5QaGlsbGlwc0BjYW5h cmllLmNhPC9hPiZndDs8YnI+DQo8Yj5DYzogPC9iPiZxdW90OzxhIGhyZWY9Im1haWx0bzppZC1l dmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3JnPC9hPiZxdW90 OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW0lkLWV2 ZW50XSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4N CiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkp1c3QgY2xhcmlmeWluZyB0aGUgcHJvcG9zYWwgYXMg aXQgc3RhbmRzIHRvZGF5IChiZWZvcmUgaW5jb3Jwb3JhdGluZyBDaHJpcydzIGlucHV0KTo8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW4iPg0KVGhlIGZvbGxvd2luZyBzZWN0aW9uIHNob3VsZCBiZSBhZGRlZCBpbiB0aGUgJnF1b3Q7 U3ViamVjdCBJZGVudGlmaWVyIFR5cGVzJnF1b3Q7IHNlY3Rpb246PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0K PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij40LjkuJm5i c3A7IFNBTUwgU3ViamVjdCBJZGVudGlmaWVyIFR5cGU8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 VGhlIFNBTUwgW1NBTUwuUkVGXSBTdWJqZWN0IElkZW50aWZpZXIgVHlwZSBkZXNjcmliZXMgYSBz dWJqZWN0IGJ5PGJyPg0KJm5ic3A7ICZuYnNwO3RoZSBhc3NlcnRpb24gaWRlbnRpZmllciBpbiB0 aGUgU0FNTCBhc3NlcnRpb24gdGhhdCB3YXMgdXNlZCB0bzxicj4NCiZuYnNwOyAmbmJzcDtjb252 ZXkgdGhlIHN1YmplY3QncyBpbmZvcm1hdGlvbiB0byB0aGUgUmVjZWl2ZXIuJm5ic3A7IFN1Ympl Y3Q8YnI+DQombmJzcDsgJm5ic3A7SWRlbnRpZmllcnMgb2YgdGhpcyB0eXBlIE1VU1QgY29udGFp biBhbiBgIGFzc2VydGlvbl9pZCZxdW90O2NsYWltLiZuYnNwOyBUaGU8YnI+DQombmJzcDsgJm5i c3A7dmFsdWUgb2YgdGhpcyBjbGFpbSBpcyBhIHN0cmluZyB0aGF0IGlzIGVxdWFsIHRvIHRoZSBB c3NlcnRpb248YnI+DQombmJzcDsgJm5ic3A7SWRlbnRpZmllciBpbiB0aGUgU0FNTCBhc3NlcnRp b24uJm5ic3A7IFRoZSBTQU1MIFN1YmplY3QgSWRlbnRpZmllciBUeXBlPGJyPg0KJm5ic3A7ICZu YnNwO2lzIGlkZW50aWZpZWQgYnkgdGhlIG5hbWUgJnF1b3Q7c2FtbGAuPGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwO0JlbG93IGlzIGEgbm9uLW5vcm1hdGl2ZSBleGFtcGxlIFN1YmplY3QgSWRlbnRp ZmllciBmb3IgdGhlIFNBTUw8YnI+DQombmJzcDsgJm5ic3A7U3ViamVjdCBJZGVudGlmaWVyIFR5 cGU6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO3s8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyZx dW90O3N1YmplY3RfdHlwZSZxdW90OzogJnF1b3Q7c2FtbCZxdW90Oyw8YnI+DQombmJzcDsgJm5i c3A7ICZuYnNwOyZxdW90O2Fzc2VydGlvbl9pZCZxdW90OzogJnF1b3Q7X2Y1NTFkODg5NjNhYjRl M2RlY2I3Y2ZlOGY0ZGNjM2Y1JnF1b3Q7LDxicj4NCiZuYnNwOyAmbmJzcDt9PGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDtGaWd1cmUgODogRXhhbXBsZTogU3ViamVjdCBJZGVudGlmaWVy IGZvciBTQU1MIFN1YmplY3QgSWRlbnRpZmllcjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7VHlwZS48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMToyMiBQTSBBdHVsIFR1bHNoaWJhZ3dh bGUgJmx0OzxhIGhyZWY9Im1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5jb20iIHRhcmdldD0iX2Js YW5rIj5hdHVsdHVsc2hpQGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGlu Ij4NCkhpIENocmlzLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpJIHdhcyBwcm9wb3NpbmcgdXNpbmcgdGhlICZxdW90O2Fz c2VydGlvbiBpZCZxdW90OyAoPGEgaHJlZj0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvc2Vj dXJpdHkvc2FtbC92Mi4wL3NhbWwtY29yZS0yLjAtb3MucGRmIiB0YXJnZXQ9Il9ibGFuayI+U0FN TCBDb3JlPC9hPiBzcGVjLCBsaW5lIDU1MykgaW4gdGhlIHByb3Bvc2FsLCBub3QgdGhlICZxdW90 O3N1YmplY3QtaWQmcXVvdDsgYXMgZGVmaW5lZCBpbiBTQU1MIChzcGVjIHNlY3Rpb24gMy4zKS4g VGhlIG1haW4gcmVhc29uDQogd2FzIHRvIGJlIGFibGUgdG8gcmVmZXIgdG8gYSBzZXNzaW9uIHRo YXQgd2FzIGVzdGFibGlzaGVkIHVzaW5nIGEgc3BlY2lmaWMgYXNzZXJ0aW9uLiBJZiBpdCdzIHVz ZWZ1bCwgd2UgY291bGQgcGVyaGFwcyBleHRlbmQgdGhlIFNBTUwgc3ViamVjdCBpZGVudGlmaWVy IHR5cGUgaW4gdGhpcyBzcGVjIHRvIGluY2x1ZGUgZWl0aGVyIHRoZSBhc3NlcnRpb25faWQgb3Ig dGhlIHN1YmplY3RfaWQgY2xhaW0uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW4iPg0KVGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkF0dWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpPbiBNb24sIEp1bCAx MywgMjAyMCBhdCAxMDozMCBBTSBDaHJpcyBQaGlsbGlwcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkNo cmlzLi5QaGlsbGlwc0BjYW5hcmllLmNhIiB0YXJnZXQ9Il9ibGFuayI+Q2hyaXMuUGhpbGxpcHNA Y2FuYXJpZS5jYTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0O2JvcmRlci10b3A6Y3VycmVu dGNvbG9yO2JvcmRlci1yaWdodDpjdXJyZW50Y29sb3I7Ym9yZGVyLWJvdHRvbTpjdXJyZW50Y29s b3IiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPkhpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+ UXVpZXQgbHVya2VyIG9ic2VydmluZy4uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5UaGFu a3MgZm9yIGNvbnNpZGVyIHRoZSBTQU1MIGVsZW1lbnRzLi4gPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9 IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPkF0dWwsIGFyZSB5b3Ug cmVmZXJyaW5nIHRvIHRoZSBhY3R1YWwgc2Vzc2lvbiBpZGVudGlmaWVyIHRoYXQgc29tZW9uZSBt YXkgaGF2ZSB3aGVyZSB0aGUgU3ViamVjdC1JZCB3YXMgZXhjaGFuZ2VkIE9SIHRoZSBhY3R1YWwg U3ViamVjdC1pZCBpdHNlbGYgaW4geW91ciByZWZlcmVuY2UgaW4gdGhlIHByb3Bvc2FsIHdpdGgg dGhlIGdpdGh1YiBsaW5rPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGlu Ij4NCjxzcGFuIGxhbmc9IkVOLUNBIj5J4oCZbSB0cnlpbmcgdG8gc3F1YXJlIHdoYXQgSSBzZWUg b24gdGhlIGdpdCBkZWx0YSBvbiBsaW5lIDI5NC0yOTYgaW4NCjxhIGhyZWY9Imh0dHBzOi8vZ2l0 aHViLmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzEvY29tbWl0cy9iMjBiNjY5MmViNTA2Mjg5 Mjc0NzZjYTc4ZjliZTA3N2FjZTg4OTk0IiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL2dpdGh1 Yi4uLmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzEvY29tbWl0cy9iMjBiNjY5MmViNTA2Mjg5 Mjc0NzZjYTc4ZjliZTA3N2FjZTg4OTk0PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4g bGFuZz0iRU4tQ0EiPkFuZCBhIFN1YmplY3QtaWQgYXMgc2hvd24gaW4gdGhlIGV4YW1wbGUgaW4g My4zLjMgaGVyZTogPGEgaHJlZj0iaHR0cHM6Ly9kb2NzLm9hc2lzLW9wZW4ub3JnL3NlY3VyaXR5 L3NhbWwtc3ViamVjdC1pZC1hdHRyL3YxLjAvY3MwMS9zYW1sLXN1YmplY3QtaWQtYXR0ci12MS4u MC1jczAxLi5odG1sI19Ub2M1MzYwOTcyMjkiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vZG9j cy5vYXNpcy1vcGVuLm9yZy9zZWN1cml0eS9zYW1sLXN1YmplY3QtaWQtYXR0ci92MS4wL2NzMDEv c2FtbC1zdWJqZWN0LWlkLWF0dHItdjEuMC1jczAxLmh0bWwjX1RvYzUzNjA5NzIyOTwvYT48L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1D QSI+V2hhdCB5b3Ugb2ZmZXJlZCBpbiB0aGUgZXhhbXBsZSBpcyBub3QgYSBTdWJqZWN0LWlkICZu YnNwO3BlciB0aGUgT0FTSVMgU0FNTCBzcGVjIGFzIHdyaXR0ZW4gaW4gc2VjdGlvbiAzLjMuMTwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVO LUNBIj5BbSBJIG1pcy1pbnRlcnByZXRpbmcgc29tZXRoaW5nPzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5n PSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5DPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxz cGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW4iPg0KPGI+PHNwYW4gbGFuZz0iRU4tQ0EiIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUNBIiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+SWQtZXZlbnQgJmx0OzxhIGhyZWY9 Im1haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZl bnQtYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7IG9uIGJlaGFsZiBvZiBBdHVsIFR1bHNoaWJhZ3dh bGUNCiAmbHQ7YXR1bHR1bHNoaT08YSBocmVmPSJtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPC9hPiZn dDs8YnI+DQo8Yj5EYXRlOiA8L2I+TW9uZGF5LCBKdWx5IDEzLCAyMDIwIGF0IDEyOjE3IFBNPGJy Pg0KPGI+VG86IDwvYj4mcXVvdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRh cmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mcXVvdDsgJmx0OzxhIGhyZWY9Im1h aWx0bzppZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3Jn PC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+W0lkLWV2ZW50XSBTQU1MIHN1YmplY3QgaWRl bnRpZmllciB0eXBlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPkhpIGFsbCw8 L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5CYXNlZCBvbiB0aGUgZGlzY3Vzc2lv bnMgaW4gdGhlIFNTRSB3b3JraW5nIGdyb3VwIHdpdGhpbiB0aGUgT3BlbklEIEZvdW5kYXRpb24s IHdlIHdvdWxkIGxpa2UgdG8gcHJvcG9zZSB0aGF0IHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgc3Bl Y2lmaWNhdGlvbiBpbmNsdWRlIGEgU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZS4gVGhpcyBp cyBzbyB0aGF0IHNlc3Npb25zIGVzdGFibGlzaGVkIGFjcm9zcyBwZWVycyB1c2luZw0KIFNBTUwg bWF5IGJlIGlkZW50aWZpZWQgaW4gZXZlbnRzIHRoYXQgaW5jbHVkZSB0aGUgc3ViamVjdCBpZGVu dGlmaWVyLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDtBIFNBTUwg c3ViamVjdCBpZGVudGlmaWVyIGhhcyBvbmx5IG9uZSBjbGFpbSB3aXRoaW4gaXQsIHRoZSBhc3Nl cnRpb24gaWQgb2YgdGhlIFNBTUwgYXNzZXJ0aW9uIHVzZWQgdG8gZXN0YWJsaXNoIHRoZSBzaW5n bGUgc2lnbi1vbiBzZXNzaW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJF Ti1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5U aGlzIGNoYW5nZSBpcyBhbHNvIGluY2x1ZGVkIGluIG15IDxhIGhyZWY9Imh0dHBzOi8vZ2l0aHVi LmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzEiIHRhcmdldD0iX2JsYW5rIj4NCnByb3Bvc2Fs IGhlcmU8L2E+Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5UaGFua3MsPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5BdHVsPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1h aWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3Jn PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v aWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjBpbiI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XyBJZC1ldmVudCBtYWlsaW5nIGxpc3QgPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayI+DQpJZC1ldmVudEBpZXRmLm9yZzwvYT4gPGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsi Pg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT4gPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZl bnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0 YXJnZXQ9Il9ibGFuayI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48 L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQo8YnI+DQo8Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTotYXBwbGUtc3lzdGVtO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOm5vbmUg d2luZG93dGV4dCAxLjBwdDtwYWRkaW5nOjBpbiI+Q09ORklERU5USUFMSVRZIE5PVElDRTogVGhp cyBlbWFpbCBtYXkgY29udGFpbiBjb25maWRlbnRpYWwgYW5kIHByaXZpbGVnZWQgbWF0ZXJpYWwg Zm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpLiBBbnkgcmV2aWV3 LA0KIHVzZSwgZGlzdHJpYnV0aW9uIG9yIGRpc2Nsb3N1cmUgYnkgb3RoZXJzIGlzIHN0cmljdGx5 IHByb2hpYml0ZWQuLiZuYnNwOyBJZiB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIGNvbW11bmljYXRp b24gaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBieSBlLW1h aWwgYW5kIGRlbGV0ZSB0aGUgbWVzc2FnZSBhbmQgYW55IGZpbGUgYXR0YWNobWVudHMgZnJvbSB5 b3VyIGNvbXB1dGVyLiBUaGFuayB5b3UuPC9zcGFuPjwvaT48L2I+PG86cD48L286cD48L3A+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90 ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_MN2PR00MB068653B00930B9E02E2286E5F57E0MN2PR00MB0686namp_-- From nobody Wed Jul 15 15:22:49 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C55D3A0E54 for ; Wed, 15 Jul 2020 15:22:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.087 X-Spam-Level: X-Spam-Status: No, score=-2.087 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0lCyQ3hVwSeN for ; Wed, 15 Jul 2020 15:22:43 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9CE283A0E47 for ; Wed, 15 Jul 2020 15:22:42 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id z24so4536086ljn.8 for ; Wed, 15 Jul 2020 15:22:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=s0kJ4kg6MWdj+5fslT3JucuaAtRYz5YWFlC5lTWp1rA=; b=ed+gaJ57oNaxNGUtnNQOubSoANwRl8zLJ2YKAxDmLq1bB7eD4ffd+dO4dnuB1KCLvy 8VjdraiR3NhpCbtLPfWRiQhs+a69ceHkRp8gXPjz9J6jD01JNKA6BG4Jq7ZVMzc5rpDu 2pJW+w+o7Bkj2ThpD1+0gpp3kB/sUAe3g+sOLJYjkUlb2/8trDuTxRNYBa60YOkl66DH PBQHvf+0L0d5Z9sqh6weOYfCW5TU+PZz7czulCnxMIVNkkXGAcCsRqXABHv1Q0H9HRx9 NEygXTPiY8j/zh9FhRKhc2Yr7faGW3bpK8NsGJv2193c52Lb4T67G/d8z40YsSsvOCiW 8lQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=s0kJ4kg6MWdj+5fslT3JucuaAtRYz5YWFlC5lTWp1rA=; b=dOtKVqkFjQoWEnzRBR3PpQKHeHCT0VHLO/UhN8LIXs3GDpmAZ1jvLxkBAz2CV0fhL1 pR71Pv4AVmZS1G10mRIiekJyjWCxQ8oGW1MDaFc2Mm1A9jMF9rOGqL0+tEDy92/q4x/h fiQm9L92gtK6YtoxmahTRoLdnZ1h99rDMU7QEcpTGwIKWTPWOPH7b7AInyt+g0ST5LqK a29ps3eYW4PAKQINcUQoUpdDwizkanCU/UykeSggC2umKXkFH0LrbMVEcBrhEqYUbtd+ R1+1SnoqfjQ5Trcx1ef0RnfPVRMKxntrXx1rmJbQOZxuSXFtNotkMlOH9w55h43hfsYg /uMQ== X-Gm-Message-State: AOAM531vM+CgA0IISo42gy8MF/0HYkzbLxBBiqp/mRnnZCBna0mMu8JW vhXg+86vv5tYIUjyQDkWho3htr2XAJIa3i0wZX8= X-Google-Smtp-Source: ABdhPJxlEsQ1G2D+HPCKeKGpL9J8U8UxWbP1oGAAwrEKT3HJYNbWefQESwZSLyHgz/Z88v1+MfyHZneTEbFPFpm55Xc= X-Received: by 2002:a2e:b70b:: with SMTP id j11mr578367ljo.142.1594851760296; Wed, 15 Jul 2020 15:22:40 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> <9CC41112-7947-41E1-9584-6DEB625BBEEA@amazon.com> In-Reply-To: From: Dick Hardt Date: Wed, 15 Jul 2020 15:22:03 -0700 Message-ID: To: Mike Jones Cc: "Richard Backman, Annabelle" , Atul Tulshibagwale , Yaron Sheffer , Brian Campbell , Chris Phillips , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="000000000000a4579505aa825cda" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 22:22:47 -0000 --000000000000a4579505aa825cda Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable +1 On Wed, Jul 15, 2020 at 3:21 PM Mike Jones wrote: > I=E2=80=99d suggest not defining any subject types that we don=E2=80=99t = have immediate > use cases for, as we might get the details wrong. We=E2=80=99re creating= a > registry to add new ones, so they can always be added later when they=E2= =80=99re > actually needed. > > > > Let=E2=80=99s keep this simple, while meeting the immediately known needs= . > > > > -- Mike > > > > *From:* Id-event *On Behalf Of *Richard > Backman, Annabelle > *Sent:* Wednesday, July 15, 2020 2:25 PM > *To:* Atul Tulshibagwale ; > Richard Backman, Annabelle > *Cc:* Yaron Sheffer ; Brian Campbell < > bcampbell@pingidentity.com>; Chris Phillips ; > id-event@ietf.org > *Subject:* Re: [Id-event] SAML subject identifier type > > > > I think the two subject types =E2=80=93 the =E2=80=9Coauth_token=E2=80=9D= type described in my > prior email, and a =E2=80=9Coauth_client=E2=80=9D type that identifies a = subject by its > OAuth 2.0 client ID =E2=80=93 are reasonable types to define. I don=E2=80= =99t see a > particular need to move them into the base spec =E2=80=93 we define an IA= NA > registry precisely so we don=E2=80=99t have to try to define everything u= p front =E2=80=93 > but I=E2=80=99m not opposed to the idea. > > > > I=E2=80=99m not sure where this notion of a =E2=80=9Cdurable subject=E2= =80=9D came from. Right in > the introduction, RFC 8417 > says the subject > of a security event =E2=80=9Cmay be permanent (e.g., a user account) or t= emporary > (e.g., an HTTP session) in nature.=E2=80=9D There are plenty of use cases= for > events where the subjects are temporary/ephemeral: > > 1. Session termination > 2. Changes in the security posture for a session > 3. Token revocation > 4. Asynchronous approval of a request > 5. Changes in the state of a transaction > > =E2=80=A6etc. > > > > Whether or not it makes sense to identify a session subject using a SAML > assertion ID (or an ID Token =E2=80=9Cjti=E2=80=9D claim, in the OIDC wor= ld) is a separate > question. Adding semantics to existing identifiers tends to lead to lots = of > unforeseen complications, and depend on assumptions that don=E2=80=99t al= ways hold > true. In this case, there seems to be an assumption that there is a 1:1 > relationship between a SAML assertion and a session. This is not always t= he > case. > > > > Regardless, a SAML assertion ID is clearly an appropriate identifier when > the subject is a SAML assertion. I don=E2=80=99t know offhand if there ar= e any use > cases for events relating to a SAML assertion itself. I can certainly see > use cases for events related to JWTs (e.g., revocation of a JWT access > token), where a =E2=80=9Cjti=E2=80=9D subject identifier type would be ap= propriate. I=E2=80=99m > inclined to add it to the draft, if for no other reason than to provide a > normative demonstration of a subject identifier that would be used to > identify a more ephemeral subject. > > > > =E2=80=93 > > Annabelle Backman (she/her) > > AWS Identity > > *https://aws.amazon.com/identity/ * > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Wednesday, July 15, 2020 at 12:47 PM > *To: *"Richard Backman, Annabelle" > *Cc: *Yaron Sheffer , Brian Campbell < > bcampbell@pingidentity.com>, Chris Phillips , = " > id-event@ietf.org" > *Subject: *RE: [EXTERNAL] [Id-event] SAML subject identifier type > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and kno= w > the content is safe. > > > > How do we propose to support the two subject types defined in the OAuth > Event Types > spec here? > > > > On Tue, Jul 14, 2020 at 4:54 PM Richard Backman, Annabelle 40amazon.com@dmarc.ietf.org> wrote: > > The RISC Profile=E2=80=99s =E2=80=9CID Token Claims=E2=80=9D type does no= t identify a subject that > is an ID Token, it identifies a subject that was the subject of an ID > Token. It was intended for cases where the OP sent multiple identifiers o= f > different types in the ID Token (e.g., iss+sub and email), and does not > know which of them the client will recognize (yes, the *should* use > iss+sub; no, they doesn=E2=80=99t always do so). This type was replaced i= n > draft-ietf-secevent-subject-identifiers-03 with the =E2=80=9Caliases=E2= =80=9D type, which > is a general solution to this problem that is not defined in terms of one > particular use case (i.e., ID Tokens). > > > > The OIDF SSE working group=E2=80=99s OAuth Event Types draft > > defines a =E2=80=9Coauth_token=E2=80=9D type that identifies a subject th= at is an OAuth 2.0 > token, and does so using either the full or partial plain text value of t= he > token, or a hash of the token.. > > > > It is perfectly fine for a token to be the subject of a security event. > 8417 actually > includes the following as an example of a possible value for the =E2=80= =9Csub=E2=80=9D > claim: > > * a token identifier (e.g. "jti") for a revoked token. > > > > =E2=80=93 > > Annabelle Backman (she/her) > > AWS Identity > > https://aws.amazon.com/identity/ > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Tuesday, July 14, 2020 at 4:32 PM > *To: *Brian Campbell > *Cc: *Yaron Sheffer , Chris Phillips < > Chris.Phillips@canarie.ca>, "id-event@ietf.org" > *Subject: *RE: [EXTERNAL] [Id-event] SAML subject identifier type > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and kno= w > the content is safe. > > > > IMO if we have a common enough use-case that requires a specific type to > be defined, then we should define that type in the spec rather than rely = on > an interpretation of the "iss-sub" type, since that interpretation can > cause incompatibilities. > > > > In this specific case however I feel that the use cases outlined in my > previous email can be achieved (with limitations) using the durable subje= ct > types such as email. I'd like the members of the SSE working group to chi= me > in (since that is where this got added), or we can drop the SAML subject > identifier type. > > > > On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell > wrote: > > + 1 to what Yaron is saying here. I'd include also the "iss-sub" subject > identifier type > https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#se= ction-3.4 > as already having semantics covering what's described in the ID Token > Claims Subject Identifier Type in the RISC document referenced. And all > those things represent a durable subject rather than a session, which > strikes me as appropriate for a document that describes identifying > subjects. A SAML assertion ID, however, which is an identifier of an XML > document that is only indirectly related to a session by an association > that likely isn't maintained, does not seem appropriate as a "subject > identifier". > > > > On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer > wrote: > > Hi Atul, > > > > The ID Token subject type, as described in the document you are > referencing, does not add any semantics, compared to a =E2=80=9Cphone num= ber=E2=80=9D or > =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value in= adding it. > > > > In addition, it does not, actually, describe an ID Token. In fact the tex= t > is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable en= tity) rather than > a session, and does it by citing various claims included in the ID token. > So as a subject identifier type, it is not at all equivalent to a SAML > assertion. > > > > As to the SAML Assertion subject type, I think these use cases could be > addressed by adding information to the event. > > > > Thanks, > > Yaron > > > > *From: *Atul Tulshibagwale > *Date: *Tuesday, July 14, 2020 at 23:26 > *To: *Yaron Sheffer > *Cc: *Chris Phillips , "id-event@ietf.org" < > id-event@ietf.org> > *Subject: *Re: [Id-event] SAML subject identifier type > > > > Hi Yaron, > > There are a few SSE use cases where the events are about a specific singl= e > sign-on session. You're right that this should not be limited to SAML. Th= e > RISC profile of SETs (based on which we are doing the SSE work) had the I= D > Token subject identifier type, which for some reason is missing in this > spec (I did not realize until now). The specific events that need to refe= r > to sessions are: > > =C2=B7 Identity provider context change: The conditions under whi= ch a > SAML assertion or OIDC token was generated are no longer valid. This can = be > due to various things, including a password change. > > =C2=B7 Session property change: A session has been determined to = have > been compromised > > =C2=B7 Revocation: The issuer of the single sign-on SAML assertio= n or > ID Token needs to be revoke > > I can also add the ID Token claim from the RISC profile > > to my pull request. > > > > Thanks, > > Atul > > > > > > On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer > wrote: > > I need a lot more context here. So far, subject IDs have denoted durable > entities, such as email addresses, phone numbers, account. This is adding= a > subject ID that denotes an ephemeral entity, basically similar to a sessi= on > ID. This looks weird from an architectural point of view, and also begs t= he > question, why specifically SAML and not other session types. > > > > Thanks, > > Yaron > > > > *From: *Id-event on behalf of Atul > Tulshibagwale <40google.com@dmarc.ietf..org>> > *Date: *Tuesday, July 14, 2020 at 00:14 > *To: *Chris Phillips > *Cc: *"id-event@ietf.org" > *Subject: *Re: [Id-event] SAML subject identifier type > > > > Just clarifying the proposal as it stands today (before incorporating > Chris's input): > > The following section should be added in the "Subject Identifier Types" > section: > > 4.9. SAML Subject Identifier Type > > The SAML [SAML.REF] Subject Identifier Type describes a subject by > the assertion identifier in the SAML assertion that was used to > convey the subject's information to the Receiver. Subject > Identifiers of this type MUST contain an ` assertion_id"claim. The > value of this claim is a string that is equal to the Assertion > Identifier in the SAML assertion. The SAML Subject Identifier Type > is identified by the name "saml`. > > Below is a non-normative example Subject Identifier for the SAML > Subject Identifier Type: > > { > "subject_type": "saml", > "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", > } > > Figure 8: Example: Subject Identifier for SAML Subject Identifier > Type. > > > > > > On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale > wrote: > > Hi Chris, > > I was proposing using the "assertion id" (SAML Core > > spec, line 553) in the proposal, not the "subject-id" as defined in SAML > (spec section 3.3). The main reason was to be able to refer to a session > that was established using a specific assertion. If it's useful, we could > perhaps extend the SAML subject identifier type in this spec to include > either the assertion_id or the subject_id claim. > > > > Thanks, > > Atul > > > > > > On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips > wrote: > > Hi. > > Quiet lurker observing.. > > Thanks for consider the SAML elements.. > > > > Atul, are you referring to the actual session identifier that someone may > have where the Subject-Id was exchanged OR the actual Subject-id itself i= n > your reference in the proposal with the github link? > > > > I=E2=80=99m trying to square what I see on the git delta on line 294-296 = in > https://github...com/richanna/secevent/pull/1/commits/b20b6692eb506289274= 76ca78f9be077ace88994 > > > > > > > And a Subject-id as shown in the example in 3.3.3 here: > https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-= subject-id-attr-v1.0-cs01.html#_Toc536097229 > > > > > What you offered in the example is not a Subject-id per the OASIS SAML > spec as written in section 3.3.1 > > > > Am I mis-interpreting something? > > > > C > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Monday, July 13, 2020 at 12:17 PM > *To: *"id-event@ietf.org" > *Subject: *[Id-event] SAML subject identifier type > > > > Hi all, > > Based on the discussions in the SSE working group within the OpenID > Foundation, we would like to propose that the subject identifier > specification include a SAML subject identifier type. This is so that > sessions established across peers using SAML may be identified in events > that include the subject identifier. > > > > A SAML subject identifier has only one claim within it, the assertion id > of the SAML assertion used to establish the single sign-on session. > > > > This change is also included in my proposal here > . > > > > Thanks, > > Atul > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > _______________________________________________ Id-event mailing list > Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > *CONFIDENTIALITY NOTICE: This email may contain confidential and > privileged material for the sole use of the intended recipient(s). Any > review, use, distribution or disclosure by others is strictly prohibited.= . > If you have received this communication in error, please notify the sende= r > immediately by e-mail and delete the message and any file attachments fro= m > your computer. Thank you.* > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --000000000000a4579505aa825cda Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    +1

    On Wed, Jul 15, 2020 at 3:21 PM Mike Jones <Micha= el.Jones=3D40microsoft.co= m@dmarc.ietf.org> wrote:

    I=E2=80=99d sugge= st not defining any subject types that we don=E2=80=99t have immediate use = cases for, as we might get the details wrong.=C2=A0 We=E2=80=99re creating = a registry to add new ones, so they can always be added later when they=E2= =80=99re actually needed.

    =C2=A0<= /u>

    Let=E2=80=99s kee= p this simple, while meeting the immediately known needs.

    =C2=A0<= /u>

    =C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0<= /u>

    From: Id-event <id-event-bounces@ietf.org> O= n Behalf Of Richard Backman, Annabelle
    Sent: Wednesday, July 15, 2020 2:25 PM
    To: Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>; R= ichard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org>
    Cc: Yaron Sheffer <yaronf.ietf@gmail.com>; Brian Campbell <bcampbell@pingidentity.= com>; Chris Phillips <Chris.Phillips@canarie.ca>; id-event@ietf.org
    Subject: Re: [Id-event] SAML subject identifier type

    =C2=A0

    I think the two subject types =E2=80=93 the =E2=80= =9Coauth_token=E2=80=9D type described in my prior email, and a =E2=80=9Coa= uth_client=E2=80=9D type that identifies a subject by its OAuth 2.0 client = ID =E2=80=93 are reasonable types to define. I don=E2=80=99t see a particul= ar need to move them into the base spec =E2=80=93 we define an IANA registry precisely so we do= n=E2=80=99t have to try to define everything up front =E2=80=93 but I=E2=80= =99m not opposed to the idea.

    =C2=A0

    I=E2=80=99m not sure where this notion of a =E2=80= =9Cdurable subject=E2=80=9D came from. Right in the introduction, RFC 8417 says the subject of a security event =E2=80=9Cmay be = permanent (e.g., a user account) or temporary (e.g., an HTTP session) in na= ture.=E2=80=9D There are plenty of use cases for events where the subjects are temporary/ephemeral:

    1. Session termination
    2. Changes in the se= curity posture for a session
    3. Token revocation
    4. Asynchronous approval of a request=
    5. Changes in the state of a transaction

      6. =E2=80=A6etc.

      =C2=A0

      Whether or not it makes sense to identify a session = subject using a SAML assertion ID (or an ID Token =E2=80=9Cjti=E2=80=9D cla= im, in the OIDC world) is a separate question. Adding semantics to existing= identifiers tends to lead to lots of unforeseen complications, and depend on assumptions that don=E2=80=99t always hold true. In this cas= e, there seems to be an assumption that there is a 1:1 relationship between= a SAML assertion and a session. This is not always the case.=

      =C2=A0

      Regardless, a SAML assertion ID is clearly an approp= riate identifier when the subject is a SAML assertion. I don=E2=80=99t know= offhand if there are any use cases for events relating to a SAML assertion= itself. I can certainly see use cases for events related to JWTs (e.g., revocation of a JWT access token), where a = =E2=80=9Cjti=E2=80=9D subject identifier type would be appropriate. I=E2=80= =99m inclined to add it to the draft, if for no other reason than to provid= e a normative demonstration of a subject identifier that would be used to identify a more ephemeral subject.

      =C2=A0

      =E2=80=93

      Annabelle Backman (sh= e/her)

      AWS Identity

      https://aw= s.amazon.com/identity/=

      =C2=A0

      =C2=A0

      From: Id-event <id-event-bounces@ie= tf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google= .com@dmarc.ietf.org>
      Date: Wednesday, July 15, 2020 at 12:47 PM
      To: "Richard Backman, Annabelle" <richanna=3D40amazon.= com@dmarc.ietf.org>
      Cc: Yaron Sheffer <yaronf.ietf@gmail.com>, Brian Campbell <bcampbell@pingidentity.= com>, Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf= .org" <i= d-event@ietf.org>
      Subject: RE: [EXTERNAL] [Id-event] SAML subject identifier type

      =C2=A0

      CAUTION: This email originated from outside of the orga= nization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.<= /u>

      =C2=A0

      How do we propose to sup= port the two subject types defined in the OAuth Event Types spec here?

      =C2=A0

      On Tue, Jul 14, 2020 at = 4:54 PM Richard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org>= wrote:

      The RISC Profile=E2=80=99s =E2=80=9CID Token Claims=E2=80=9D type does not = identify a subject that is an ID Token, it identifies a subject that was th= e subject of an ID Token. It was intended for cases where the OP sent multi= ple identifiers of different types in the ID Token (e.g., iss+sub and email), and does not know which of them the client will recogn= ize (yes, the should use iss+sub; no, they doesn=E2=80=99t always do so). This typ= e was replaced in draft-ietf-secevent-subject-identifiers-03 with the =E2= =80=9Caliases=E2=80=9D type, which is a general solution to this problem th= at is not defined in terms of one particular use case (i.e., ID Tokens).

      =C2=A0

      The OIDF SSE working group=E2=80=99s OAuth Event Types draft defines a =E2=80=9Coauth_token=E2=80=9D type th= at identifies a subject that is an OAuth 2.0 token, and does so using eithe= r the full or partial plain text value of the token, or a hash of the token= ..

      =C2=A0

      It is perfectly fine for a token to be the subject of a security event. 8417 actually includes the following as an example of a possible value = for the =E2=80=9Csub=E2=80=9D claim:

      *=C2=A0 a token identifier (e.g. "jti") for a revoked token.<= /span>

      =C2=A0

      =E2=80=93

      Annabelle Backman (she/her)=

      AWS Identity

      https://aws.amazon.c= om/identity/

      =C2=A0

      =C2=A0

      From: Id-event <id-event-bounces@ietf.org> on behal= f of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
      Date: Tuesday, July 14, 2020 at 4:32 PM
      To: Brian Campbell <bcampbell@pingidentity.com>
      Cc: Yaron Sheffer <yaronf.ietf@gmail.com>, Chris Phillips <Chris.Phillips@canarie.c= a>, "id-= event@ietf.org" <id-event@ietf.o= rg>
      Subject: RE: [EXTERNAL] [Id-event] SAML subject identifier type

      =C2=A0

      CAUTION: This email originated from outside of the orga= nization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.<= /u>

      =C2=A0

      IMO if we have a common enough use-case that requires a specific type to be= defined, then we should define that type in the spec rather than rely on a= n interpretation of the "iss-sub" type, since that interpretation= can cause incompatibilities.

      =C2=A0

      In this specific case however I feel that the use cases outlined in my prev= ious email can be achieved (with limitations) using the durable subject typ= es such as email. I'd like the members of the SSE working group to chim= e in (since that is where this got added), or we can drop the SAML subject identifier type.

      =C2=A0

      On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell <bcampbell@pingidentity.com> = wrote:

      + 1 to what Yaron is saying here. I'd include also the "iss-sub&qu= ot; subject identifier type https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#sect= ion-3.4 as already having semantics covering what's described in th= e ID Token Claims Subject Identifier Type in the RISC document referenced. = And all those things represent a durable subject rather than a session, which strikes me as appropriate for a docum= ent that describes identifying subjects. A SAML assertion ID, however, whic= h is an identifier of an XML document that is only indirectly related to a = session by an association that likely isn't maintained, does not seem appropriate as a "subject identif= ier".

      =C2=A0

      On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

      Hi Atul,

      =C2=A0

      The ID Token subject type, as described in the document you are referencing= , does not add any semantics, compared to a =E2=80=9Cphone number=E2=80=9D = or =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value i= n adding it.

      =C2=A0

      In addition, it does not, actually, describe an ID Token. In fact the text = is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable enti= ty) rather than a session, and does it by citing various claims included in= the ID token. So as a subject identifier type, it is not at all equivalent to a SAML assertion.

      =C2=A0

      As to the SAML Assertion subject type, I think these use cases could be add= ressed by adding information to the event.

      =C2=A0

      Thanks,

      =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 Yaron

      =C2=A0

      From: Atul Tulshibagwale <atultulshi@google.com>
      Date: Tuesday, July 14, 2020 at 23:26
      To: Yaron Sheffer <yaronf.ietf@gmail.com>
      Cc: Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf.org" <id-event@ietf.org>= ;
      Subject: Re: [Id-event] SAML subject identifier type

      =C2=A0

      Hi=C2=A0Yaron,

      There are a few SSE use cases where the events are about a specific single = sign-on session. You're right that this should not be limited to SAML. = The RISC profile of SETs (based on which we are doing the SSE work) had the= ID Token subject identifier type, which for some reason is missing in this spec (I did not realize until now). The= specific events that need to refer to sessions are:

      =C2=B7=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Identity provider context change: The conditions under which a SAML = assertion or OIDC token was generated are no longer=C2=A0valid. This can be= due to various things, including a password change.

      =C2=B7=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Session property change: A session has been determined to have been = compromised

      =C2=B7=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Revocation: The issuer of the single sign-on SAML assertion or ID To= ken needs to be revoke

      I can also add the ID Token claim from the RISC profile to my pull request.<= /p>

      =C2=A0

      Thanks,

      Atul

      =C2=A0

      =C2=A0

      On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:=

      I need a lot more context here. So far, subject IDs have denoted durable en= tities, such as email addresses, phone numbers, account. This is adding a s= ubject ID that denotes an ephemeral entity, basically similar to a session = ID. This looks weird from an architectural point of view, and also begs the question, why specifically SAML and not o= ther session types.

      =C2=A0

      Thanks,

      =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 Yaron

      =C2=A0

      From: Id-event <id-event-bounces@ietf.org> on behal= f of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
      Date: Tuesday, July 14, 2020 at 00:14
      To: Chris Phillips <Chris.Phillips@canarie.ca>
      Cc: "id-= event@ietf.org" <id-event@ietf.org>
      Subject: Re: [Id-event] SAML subject identifier type

      =C2=A0

      Just clarifying the proposal as it stands today (before incorporating Chris= 's input):

      The following section should be added in the "Subject Identifier Types= " section:

      4.9.=C2=A0 SAML Subject= Identifier Type

      =C2=A0 =C2=A0The SAML [SAML.REF] Subject Identifier Type describes a subjec= t by
      =C2=A0 =C2=A0the assertion identifier in the SAML assertion that was used t= o
      =C2=A0 =C2=A0convey the subject's information to the Receiver.=C2=A0 Su= bject
      =C2=A0 =C2=A0Identifiers of this type MUST contain an ` assertion_id"c= laim.=C2=A0 The
      =C2=A0 =C2=A0value of this claim is a string that is equal to the Assertion=
      =C2=A0 =C2=A0Identifier in the SAML assertion.=C2=A0 The SAML Subject Ident= ifier Type
      =C2=A0 =C2=A0is identified by the name "saml`.

      =C2=A0 =C2=A0Below is a non-normative example Subject Identifier for the SA= ML
      =C2=A0 =C2=A0Subject Identifier Type:

      =C2=A0 =C2=A0{
      =C2=A0 =C2=A0 =C2=A0"subject_type": "saml",
      =C2=A0 =C2=A0 =C2=A0"assertion_id": "_f551d88963ab4e3decb7cf= e8f4dcc3f5",
      =C2=A0 =C2=A0}

      =C2=A0 =C2=A0 =C2=A0Figure 8: Example: Subject Identifier for SAML Subject = Identifier
      =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Type.      <= /u>

      =C2=A0

      =C2=A0

      On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com> wrote:=

      Hi Chris,

      I was proposing using the "assertion id" (S= AML Core spec, line 553) in the proposal, not the "subject-id"= ; as defined in SAML (spec section 3.3). The main reason was to be able to refer to a session that was established using a specific= assertion. If it's useful, we could perhaps extend the SAML subject id= entifier type in this spec to include either the assertion_id or the subjec= t_id claim.

      =C2=A0

      Thanks,

      Atul

      =C2=A0

      =C2=A0

      On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca> = wrote:

      Hi.

      Quiet lurker observing..

      Thanks for consider the SAML elements.. =

      =C2=A0

      Atul, are you referring to the actual session identifi= er that someone may have where the Subject-Id was exchanged OR the actual S= ubject-id itself in your reference in the proposal with the github link?

      =C2=A0

      I=E2=80=99m trying to square what I see on the git del= ta on line 294-296 in https://github...com/richanna/secevent/pull/1/commits/b20b6692eb50628927476= ca78f9be077ace88994

      =C2=A0

      =C2=A0

      And a Subject-id as shown in the example in 3.3.3 here= : https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-su= bject-id-attr-v1.0-cs01.html#_Toc536097229

      =C2=A0

      What you offered in the example is not a Subject-id = =C2=A0per the OASIS SAML spec as written in section 3.3.1<= /u>

      =C2=A0

      Am I mis-interpreting something?<= /p>

      =C2=A0

      C

      =C2=A0

      =C2=A0

      From: <= /b>Id-event <<= a href=3D"mailto:id-event-bounces@ietf.org" target=3D"_blank">id-event-boun= ces@ietf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
      Date: Monday, July 13, 2020 at 12:17 PM
      To: "id-= event@ietf.org" <id-event@ietf.org>
      Subject: [Id-event] SAML subject identifier type

      =C2=A0

      Hi all,

      Based on the discussions in the SSE working group with= in the OpenID Foundation, we would like to propose that the subject identif= ier specification include a SAML subject identifier type. This is so that s= essions established across peers using SAML may be identified in events that include the subject identifier.

      =C2=A0

      =C2=A0A SAML subject identifier has only one claim wit= hin it, the assertion id of the SAML assertion used to establish the single= sign-on session.

      =C2=A0

      This change is also included in my proposal here.

      =C2=A0

      Thanks,

      Atul

      =C2=A0

      _______________________________________________
      Id-event mailing list
      Id-event@ietf.org
      https://www.ietf.org/mailman/listinfo/id-event

      _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event

      _______________________________________________
      Id-event mailing list
      Id-event@ietf.org
      https://www.ietf.org/mailman/listinfo/id-event


      CONFIDENTIALITY NOTICE: This= email may contain confidential and privileged material for the sole use of= the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..=C2=A0 I= f you have received this communication in error, please notify the sender i= mmediately by e-mail and delete the message and any file attachments from y= our computer. Thank you.

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --000000000000a4579505aa825cda-- From nobody Wed Jul 15 15:49:42 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AF523A0AB8 for ; Wed, 15 Jul 2020 15:49:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.589 X-Spam-Level: X-Spam-Status: No, score=-17.589 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p1tEJW3p7qg9 for ; Wed, 15 Jul 2020 15:49:37 -0700 (PDT) Received: from mail-yb1-xb2b.google.com (mail-yb1-xb2b.google.com [IPv6:2607:f8b0:4864:20::b2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 227233A0ABB for ; Wed, 15 Jul 2020 15:49:37 -0700 (PDT) Received: by mail-yb1-xb2b.google.com with SMTP id l19so1937261ybl.1 for ; Wed, 15 Jul 2020 15:49:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=HFDgmbTHz9EwGM3oAvOXvJY1w6cKMEb3fYw9TDd25ls=; b=QtuO5PhMMomfFMYVznK5aYrI3liHqxpw1dNNN3pfih2bB0gaykFWArEYZvTCGat6AL WVmQx2+fD2OTwpCFYrxkx/QbaCJu/gumUZuzuLOSeGJmyxupm/XGUpnBwcSFNUDDeSps oyRi87h5QZZCGNs3rQxQWKX5WXbwAcfV/5TJ+FINtGmKLKBhrFU/UifQwiGJKrnaYhYJ TUqUuzSBLBl10LjURQbnxHJLgTRVmMZVgd6jPgsdoACuARsWwsdf5ypU9L84VxdG6mLd 5lTF20DxhXZXpyMHy7BTeBQhcw4nDqqK2PGI2lckfY6qzc03Az7LGOMPCwGRnIRL5379 ZCkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=HFDgmbTHz9EwGM3oAvOXvJY1w6cKMEb3fYw9TDd25ls=; b=ngOb7k9xs9ppFKJNVLSXSUfxk22Y78uZyHy7GAGXBsj2LZuDvub3r+eQ8I4PevZhrr gfT7IyWPPjiR4W0J6zbtgioMcPWrhG9BsQChkPIKuMVdf67p1Eh4g77TvWhkGH62LsS+ 3eNk7fNtEoqqKpg2heR9IyvtGkzHg+SPkcm1KJHPtBpI3ZmgWd1645k55AHgDhgDvb8r PWynsu7S5TLJE6XDQDmjy1woD7ziOtjH8ycqErs7HMQ+EgmhOZHtO6tojvW/kyPmjox4 dg0Qnq+/N+eVkz80ZGfrVMPLfNl2vZ9LU7bjtr/GdyEmBOLpoxIo491FjfD/4a0xsch4 zVCA== X-Gm-Message-State: AOAM5314CAyvPnYCOA+L6lKqOxRJPZz1OjqO14+fOAnfAjpS7u2HrWRT YH5Icxp7oLD8W5xhv1/KCvYiyk6gHqwgE8DtC0T5GA== X-Google-Smtp-Source: ABdhPJxPrQkd9u/jJ9HPvCeyMWsw8M2SDSXdsyKkV52ql4nYL9eGc1azMftu7bU08OStiB3lFUcrTnNO03QtUWAblAY= X-Received: by 2002:a25:bc13:: with SMTP id i19mr1864373ybh.391.1594853375879; Wed, 15 Jul 2020 15:49:35 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> <9CC41112-7947-41E1-9584-6DEB625BBEEA@amazon.com> In-Reply-To: From: Atul Tulshibagwale Date: Wed, 15 Jul 2020 15:49:24 -0700 Message-ID: To: Dick Hardt Cc: Mike Jones , "Richard Backman, Annabelle" , Yaron Sheffer , Brian Campbell , Chris Phillips , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f0944105aa82bcb1" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 22:49:40 -0000 --000000000000f0944105aa82bcb1 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Agreed. We could drop the SAML subject type in this spec with that rationale, and it can be defined as needed later. On Wed, Jul 15, 2020 at 3:22 PM Dick Hardt wrote: > +1 > > On Wed, Jul 15, 2020 at 3:21 PM Mike Jones 40microsoft.com@dmarc.ietf.org> wrote: > >> I=E2=80=99d suggest not defining any subject types that we don=E2=80=99t= have immediate >> use cases for, as we might get the details wrong. We=E2=80=99re creatin= g a >> registry to add new ones, so they can always be added later when they=E2= =80=99re >> actually needed. >> >> >> >> Let=E2=80=99s keep this simple, while meeting the immediately known need= s. >> >> >> >> -- Mike >> >> >> >> *From:* Id-event *On Behalf Of *Richard >> Backman, Annabelle >> *Sent:* Wednesday, July 15, 2020 2:25 PM >> *To:* Atul Tulshibagwale ; >> Richard Backman, Annabelle >> *Cc:* Yaron Sheffer ; Brian Campbell < >> bcampbell@pingidentity.com>; Chris Phillips ; >> id-event@ietf.org >> *Subject:* Re: [Id-event] SAML subject identifier type >> >> >> >> I think the two subject types =E2=80=93 the =E2=80=9Coauth_token=E2=80= =9D type described in my >> prior email, and a =E2=80=9Coauth_client=E2=80=9D type that identifies a= subject by its >> OAuth 2.0 client ID =E2=80=93 are reasonable types to define. I don=E2= =80=99t see a >> particular need to move them into the base spec =E2=80=93 we define an I= ANA >> registry precisely so we don=E2=80=99t have to try to define everything = up front =E2=80=93 >> but I=E2=80=99m not opposed to the idea. >> >> >> >> I=E2=80=99m not sure where this notion of a =E2=80=9Cdurable subject=E2= =80=9D came from. Right in >> the introduction, RFC 8417 >> says the subject >> of a security event =E2=80=9Cmay be permanent (e.g., a user account) or = temporary >> (e.g., an HTTP session) in nature.=E2=80=9D There are plenty of use case= s for >> events where the subjects are temporary/ephemeral: >> >> 1. Session termination >> 2. Changes in the security posture for a session >> 3. Token revocation >> 4. Asynchronous approval of a request >> 5. Changes in the state of a transaction >> >> =E2=80=A6etc. >> >> >> >> Whether or not it makes sense to identify a session subject using a SAML >> assertion ID (or an ID Token =E2=80=9Cjti=E2=80=9D claim, in the OIDC wo= rld) is a separate >> question. Adding semantics to existing identifiers tends to lead to lots= of >> unforeseen complications, and depend on assumptions that don=E2=80=99t a= lways hold >> true. In this case, there seems to be an assumption that there is a 1:1 >> relationship between a SAML assertion and a session. This is not always = the >> case. >> >> >> >> Regardless, a SAML assertion ID is clearly an appropriate identifier whe= n >> the subject is a SAML assertion. I don=E2=80=99t know offhand if there a= re any use >> cases for events relating to a SAML assertion itself. I can certainly se= e >> use cases for events related to JWTs (e.g., revocation of a JWT access >> token), where a =E2=80=9Cjti=E2=80=9D subject identifier type would be a= ppropriate. I=E2=80=99m >> inclined to add it to the draft, if for no other reason than to provide = a >> normative demonstration of a subject identifier that would be used to >> identify a more ephemeral subject. >> >> >> >> =E2=80=93 >> >> Annabelle Backman (she/her) >> >> AWS Identity >> >> *https://aws.amazon.com/identity/ * >> >> >> >> >> >> *From: *Id-event on behalf of Atul >> Tulshibagwale > > >> *Date: *Wednesday, July 15, 2020 at 12:47 PM >> *To: *"Richard Backman, Annabelle" >> *Cc: *Yaron Sheffer , Brian Campbell < >> bcampbell@pingidentity.com>, Chris Phillips , >> "id-event@ietf..org " >> *Subject: *RE: [EXTERNAL] [Id-event] SAML subject identifier type >> >> >> >> *CAUTION*: This email originated from outside of the organization. Do >> not click links or open attachments unless you can confirm the sender an= d >> know the content is safe. >> >> >> >> How do we propose to support the two subject types defined in the OAuth >> Event Types >> spec here? >> >> >> >> On Tue, Jul 14, 2020 at 4:54 PM Richard Backman, Annabelle > 40amazon.com@dmarc.ietf.org> wrote: >> >> The RISC Profile=E2=80=99s =E2=80=9CID Token Claims=E2=80=9D type does n= ot identify a subject >> that is an ID Token, it identifies a subject that was the subject of an = ID >> Token. It was intended for cases where the OP sent multiple identifiers = of >> different types in the ID Token (e.g., iss+sub and email), and does not >> know which of them the client will recognize (yes, the *should* use >> iss+sub; no, they doesn=E2=80=99t always do so). This type was replaced = in >> draft-ietf-secevent-subject-identifiers-03 with the =E2=80=9Caliases=E2= =80=9D type, which >> is a general solution to this problem that is not defined in terms of on= e >> particular use case (i.e., ID Tokens). >> >> >> >> The OIDF SSE working group=E2=80=99s OAuth Event Types draft >> >> defines a =E2=80=9Coauth_token=E2=80=9D type that identifies a subject t= hat is an OAuth 2.0 >> token, and does so using either the full or partial plain text value of = the >> token, or a hash of the token... >> >> >> >> It is perfectly fine for a token to be the subject of a security event. >> 8417 actually >> includes the following as an example of a possible value for the =E2=80= =9Csub=E2=80=9D >> claim: >> >> * a token identifier (e.g. "jti") for a revoked token. >> >> >> >> =E2=80=93 >> >> Annabelle Backman (she/her) >> >> AWS Identity >> >> https://aws.amazon.com/identity/ >> >> >> >> >> >> *From: *Id-event on behalf of Atul >> Tulshibagwale >> *Date: *Tuesday, July 14, 2020 at 4:32 PM >> *To: *Brian Campbell >> *Cc: *Yaron Sheffer , Chris Phillips < >> Chris.Phillips@canarie.ca>, "id-event@ietf.org" >> *Subject: *RE: [EXTERNAL] [Id-event] SAML subject identifier type >> >> >> >> *CAUTION*: This email originated from outside of the organization. Do >> not click links or open attachments unless you can confirm the sender an= d >> know the content is safe. >> >> >> >> IMO if we have a common enough use-case that requires a specific type to >> be defined, then we should define that type in the spec rather than rely= on >> an interpretation of the "iss-sub" type, since that interpretation can >> cause incompatibilities. >> >> >> >> In this specific case however I feel that the use cases outlined in my >> previous email can be achieved (with limitations) using the durable subj= ect >> types such as email. I'd like the members of the SSE working group to ch= ime >> in (since that is where this got added), or we can drop the SAML subject >> identifier type. >> >> >> >> On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell < >> bcampbell@pingidentity.com> wrote: >> >> + 1 to what Yaron is saying here. I'd include also the "iss-sub" subject >> identifier type >> https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#s= ection-3.4 >> as already having semantics covering what's described in the ID Token >> Claims Subject Identifier Type in the RISC document referenced. And all >> those things represent a durable subject rather than a session, which >> strikes me as appropriate for a document that describes identifying >> subjects. A SAML assertion ID, however, which is an identifier of an XML >> document that is only indirectly related to a session by an association >> that likely isn't maintained, does not seem appropriate as a "subject >> identifier". >> >> >> >> On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer >> wrote: >> >> Hi Atul, >> >> >> >> The ID Token subject type, as described in the document you are >> referencing, does not add any semantics, compared to a =E2=80=9Cphone nu= mber=E2=80=9D or >> =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value i= n adding it. >> >> >> >> In addition, it does not, actually, describe an ID Token. In fact the >> text is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a dura= ble entity) rather >> than a session, and does it by citing various claims included in the ID >> token. So as a subject identifier type, it is not at all equivalent to a >> SAML assertion. >> >> >> >> As to the SAML Assertion subject type, I think these use cases could be >> addressed by adding information to the event. >> >> >> >> Thanks, >> >> Yaron >> >> >> >> *From: *Atul Tulshibagwale >> *Date: *Tuesday, July 14, 2020 at 23:26 >> *To: *Yaron Sheffer >> *Cc: *Chris Phillips , "id-event@ietf.org" < >> id-event@ietf.org> >> *Subject: *Re: [Id-event] SAML subject identifier type >> >> >> >> Hi Yaron, >> >> There are a few SSE use cases where the events are about a specific >> single sign-on session. You're right that this should not be limited to >> SAML. The RISC profile of SETs (based on which we are doing the SSE work= ) >> had the ID Token subject identifier type, which for some reason is missi= ng >> in this spec (I did not realize until now). The specific events that nee= d >> to refer to sessions are: >> >> =C2=B7 Identity provider context change: The conditions under wh= ich a >> SAML assertion or OIDC token was generated are no longer valid. This can= be >> due to various things, including a password change. >> >> =C2=B7 Session property change: A session has been determined to= have >> been compromised >> >> =C2=B7 Revocation: The issuer of the single sign-on SAML asserti= on or >> ID Token needs to be revoke >> >> I can also add the ID Token claim from the RISC profile >> >> to my pull request. >> >> >> >> Thanks, >> >> Atul >> >> >> >> >> >> On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer > > wrote: >> >> I need a lot more context here. So far, subject IDs have denoted durable >> entities, such as email addresses, phone numbers, account. This is addin= g a >> subject ID that denotes an ephemeral entity, basically similar to a sess= ion >> ID. This looks weird from an architectural point of view, and also begs = the >> question, why specifically SAML and not other session types. >> >> >> >> Thanks, >> >> Yaron >> >> >> >> *From: *Id-event on behalf of Atul >> Tulshibagwale > <40google.com@dmarc.ietf..org>> >> *Date: *Tuesday, July 14, 2020 at 00:14 >> *To: *Chris Phillips >> *Cc: *"id-event@ietf.org" >> *Subject: *Re: [Id-event] SAML subject identifier type >> >> >> >> Just clarifying the proposal as it stands today (before incorporating >> Chris's input): >> >> The following section should be added in the "Subject Identifier Types" >> section: >> >> 4.9. SAML Subject Identifier Type >> >> The SAML [SAML.REF] Subject Identifier Type describes a subject by >> the assertion identifier in the SAML assertion that was used to >> convey the subject's information to the Receiver. Subject >> Identifiers of this type MUST contain an ` assertion_id"claim. The >> value of this claim is a string that is equal to the Assertion >> Identifier in the SAML assertion. The SAML Subject Identifier Type >> is identified by the name "saml`. >> >> Below is a non-normative example Subject Identifier for the SAML >> Subject Identifier Type: >> >> { >> "subject_type": "saml", >> "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", >> } >> >> Figure 8: Example: Subject Identifier for SAML Subject Identifier >> Type. >> >> >> >> >> >> On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale >> wrote: >> >> Hi Chris, >> >> I was proposing using the "assertion id" (SAML Core >> >> spec, line 553) in the proposal, not the "subject-id" as defined in SAML >> (spec section 3.3). The main reason was to be able to refer to a session >> that was established using a specific assertion. If it's useful, we coul= d >> perhaps extend the SAML subject identifier type in this spec to include >> either the assertion_id or the subject_id claim. >> >> >> >> Thanks, >> >> Atul >> >> >> >> >> >> On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips < >> Chris.Phillips@canarie.ca > wrote: >> >> Hi. >> >> Quiet lurker observing.. >> >> Thanks for consider the SAML elements.. >> >> >> >> Atul, are you referring to the actual session identifier that someone ma= y >> have where the Subject-Id was exchanged OR the actual Subject-id itself = in >> your reference in the proposal with the github link? >> >> >> >> I=E2=80=99m trying to square what I see on the git delta on line 294-296= in >> https://github...com/richanna/secevent/pull/1/commits/b20b6692eb50628927= 476ca78f9be077ace88994 >> >> >> >> >> >> >> And a Subject-id as shown in the example in 3.3.3 here: >> https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml= -subject-id-attr-v1.0-cs01.html#_Toc536097229 >> >> >> >> >> What you offered in the example is not a Subject-id per the OASIS SAML >> spec as written in section 3.3.1 >> >> >> >> Am I mis-interpreting something? >> >> >> >> C >> >> >> >> >> >> *From: *Id-event on behalf of Atul >> Tulshibagwale >> *Date: *Monday, July 13, 2020 at 12:17 PM >> *To: *"id-event@ietf.org" >> *Subject: *[Id-event] SAML subject identifier type >> >> >> >> Hi all, >> >> Based on the discussions in the SSE working group within the OpenID >> Foundation, we would like to propose that the subject identifier >> specification include a SAML subject identifier type. This is so that >> sessions established across peers using SAML may be identified in events >> that include the subject identifier. >> >> >> >> A SAML subject identifier has only one claim within it, the assertion i= d >> of the SAML assertion used to establish the single sign-on session. >> >> >> >> This change is also included in my proposal here >> . >> >> >> >> Thanks, >> >> Atul >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> _______________________________________________ Id-event mailing list >> Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> *CONFIDENTIALITY NOTICE: This email may contain confidential and >> privileged material for the sole use of the intended recipient(s). Any >> review, use, distribution or disclosure by others is strictly prohibited= .. >> If you have received this communication in error, please notify the send= er >> immediately by e-mail and delete the message and any file attachments fr= om >> your computer. Thank you.* >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > --000000000000f0944105aa82bcb1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Agreed. We could drop the SAML subject type in this spec w= ith that rationale, and it can be defined as needed later.

    On Wed, Jul 15, 2= 020 at 3:22 PM Dick Hardt <dick.= hardt@gmail.com> wrote:
    +1

    =
    On Wed, Jul 15, 2020 at 3:21 PM Mike = Jones <Michael.Jones=3D40microsoft.com@dmarc.ietf.org> wrote:
    <= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">

    I=E2=80=99d sugge= st not defining any subject types that we don=E2=80=99t have immediate use = cases for, as we might get the details wrong.=C2=A0 We=E2=80=99re creating = a registry to add new ones, so they can always be added later when they=E2= =80=99re actually needed.

    =C2=A0<= /u>

    Let=E2=80=99s kee= p this simple, while meeting the immediately known needs.

    =C2=A0<= /u>

    =C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0<= /u>

    From: Id-event <id-event-bounces@ietf.org> O= n Behalf Of Richard Backman, Annabelle
    Sent: Wednesday, July 15, 2020 2:25 PM
    To: Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>; R= ichard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org>
    Cc: Yaron Sheffer <yaronf.ietf@gmail.com>; Brian Campbell <bcampbell@pingidentity.= com>; Chris Phillips <Chris.Phillips@canarie.ca>; id-event@ietf.org
    Subject: Re: [Id-event] SAML subject identifier type

    =C2=A0

    I think the two subject types =E2=80=93 the =E2=80= =9Coauth_token=E2=80=9D type described in my prior email, and a =E2=80=9Coa= uth_client=E2=80=9D type that identifies a subject by its OAuth 2.0 client = ID =E2=80=93 are reasonable types to define. I don=E2=80=99t see a particul= ar need to move them into the base spec =E2=80=93 we define an IANA registry precisely so we do= n=E2=80=99t have to try to define everything up front =E2=80=93 but I=E2=80= =99m not opposed to the idea.

    =C2=A0

    I=E2=80=99m not sure where this notion of a =E2=80= =9Cdurable subject=E2=80=9D came from. Right in the introduction, RFC 8417 says the subject of a security event =E2=80=9Cmay be = permanent (e.g., a user account) or temporary (e.g., an HTTP session) in na= ture.=E2=80=9D There are plenty of use cases for events where the subjects are temporary/ephemeral:

    1. Session termination
    2. Changes in the security posture for a session=
    3. Token revocation
    4. Asynchronous approval of a request
    5. Changes in the state of a transacti= on

    =E2=80=A6etc.

    =C2=A0

    Whether or not it makes sense to identify a session = subject using a SAML assertion ID (or an ID Token =E2=80=9Cjti=E2=80=9D cla= im, in the OIDC world) is a separate question. Adding semantics to existing= identifiers tends to lead to lots of unforeseen complications, and depend on assumptions that don=E2=80=99t always hold true. In this cas= e, there seems to be an assumption that there is a 1:1 relationship between= a SAML assertion and a session. This is not always the case.=

    =C2=A0

    Regardless, a SAML assertion ID is clearly an approp= riate identifier when the subject is a SAML assertion. I don=E2=80=99t know= offhand if there are any use cases for events relating to a SAML assertion= itself. I can certainly see use cases for events related to JWTs (e.g., revocation of a JWT access token), where a = =E2=80=9Cjti=E2=80=9D subject identifier type would be appropriate. I=E2=80= =99m inclined to add it to the draft, if for no other reason than to provid= e a normative demonstration of a subject identifier that would be used to identify a more ephemeral subject.

    =C2=A0

    =E2=80=93

    Annabelle Backman (sh= e/her)

    AWS Identity

    https://aw= s.amazon.com/identity/=

    =C2=A0

    =C2=A0

    From: Id-event <id-event-bounces@ie= tf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google= ..com@dmarc.ietf.org>
    Date: Wednesday, July 15, 2020 at 12:47 PM
    To: "Richard Backman, Annabelle" <richanna=3D40amazon.= com@dmarc.ietf.org>
    Cc: Yaron Sheffer <yaronf.ietf@gmail.com>, Brian Campbell <bcampbell@pingidentity.= com>, Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf= ..org" <= id-event@ietf.org>
    Subject: RE: [EXTERNAL] [Id-event] SAML subject identifier type

    =C2=A0

    CAUTION: This email originated from outside of the orga= nization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.<= /u>

    =C2=A0

    How do we propose to sup= port the two subject types defined in the OAuth Event Types spec here?

    =C2=A0

    On Tue, Jul 14, 2020 at = 4:54 PM Richard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org>= wrote:

    The RISC Profile=E2=80=99s =E2=80=9CID Token Claims=E2=80=9D type does not = identify a subject that is an ID Token, it identifies a subject that was th= e subject of an ID Token. It was intended for cases where the OP sent multi= ple identifiers of different types in the ID Token (e.g., iss+sub and email), and does not know which of them the client will recogn= ize (yes, the should use iss+sub; no, they doesn=E2=80=99t always do so). This typ= e was replaced in draft-ietf-secevent-subject-identifiers-03 with the =E2= =80=9Caliases=E2=80=9D type, which is a general solution to this problem th= at is not defined in terms of one particular use case (i.e., ID Tokens).

    =C2=A0

    The OIDF SSE working group=E2=80=99s OAuth Event Types draft defines a =E2=80=9Coauth_token=E2=80=9D type th= at identifies a subject that is an OAuth 2.0 token, and does so using eithe= r the full or partial plain text value of the token, or a hash of the token= ...

    =C2=A0

    It is perfectly fine for a token to be the subject of a security event. 8417 actually includes the following as an example of a possible value = for the =E2=80=9Csub=E2=80=9D claim:

    *=C2=A0 a token identifier (e.g. "jti") for a revoked token.<= /span>

    =C2=A0

    =E2=80=93

    Annabelle Backman (she/her)=

    AWS Identity

    https://aws.amazon.c= om/identity/

    =C2=A0

    =C2=A0

    From: Id-event <id-event-bounces@ietf.org> on behal= f of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Tuesday, July 14, 2020 at 4:32 PM
    To: Brian Campbell <bcampbell@pingidentity.com>
    Cc: Yaron Sheffer <yaronf.ietf@gmail.com>, Chris Phillips <Chris.Phillips@canarie.c= a>, "id-= event@ietf.org" <id-event@ietf.o= rg>
    Subject: RE: [EXTERNAL] [Id-event] SAML subject identifier type

    =C2=A0

    CAUTION: This email originated from outside of the orga= nization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.<= /u>

    =C2=A0

    IMO if we have a common enough use-case that requires a specific type to be= defined, then we should define that type in the spec rather than rely on a= n interpretation of the "iss-sub" type, since that interpretation= can cause incompatibilities.

    =C2=A0

    In this specific case however I feel that the use cases outlined in my prev= ious email can be achieved (with limitations) using the durable subject typ= es such as email. I'd like the members of the SSE working group to chim= e in (since that is where this got added), or we can drop the SAML subject identifier type.

    =C2=A0

    On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell <bcampbell@pingidentity.com> = wrote:

    + 1 to what Yaron is saying here. I'd include also the "iss-sub&qu= ot; subject identifier type https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#sect= ion-3.4 as already having semantics covering what's described in th= e ID Token Claims Subject Identifier Type in the RISC document referenced. = And all those things represent a durable subject rather than a session, which strikes me as appropriate for a docum= ent that describes identifying subjects. A SAML assertion ID, however, whic= h is an identifier of an XML document that is only indirectly related to a = session by an association that likely isn't maintained, does not seem appropriate as a "subject identif= ier".

    =C2=A0

    On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

    Hi Atul,

    =C2=A0

    The ID Token subject type, as described in the document you are referencing= , does not add any semantics, compared to a =E2=80=9Cphone number=E2=80=9D = or =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value i= n adding it.

    =C2=A0

    In addition, it does not, actually, describe an ID Token. In fact the text = is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable enti= ty) rather than a session, and does it by citing various claims included in= the ID token. So as a subject identifier type, it is not at all equivalent to a SAML assertion.

    =C2=A0

    As to the SAML Assertion subject type, I think these use cases could be add= ressed by adding information to the event.

    =C2=A0

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Atul Tulshibagwale <atultulshi@google.com>
    Date: Tuesday, July 14, 2020 at 23:26
    To: Yaron Sheffer <yaronf.ietf@gmail.com>
    Cc: Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf.org" <id-event@ietf.org>= ;
    Subject: Re: [Id-event] SAML subject identifier type

    =C2=A0

    Hi=C2=A0Yaron,

    There are a few SSE use cases where the events are about a specific single = sign-on session. You're right that this should not be limited to SAML. = The RISC profile of SETs (based on which we are doing the SSE work) had the= ID Token subject identifier type, which for some reason is missing in this spec (I did not realize until now). The= specific events that need to refer to sessions are:

    =C2=B7=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Identity provider context change: The conditions under which a SAML = assertion or OIDC token was generated are no longer=C2=A0valid. This can be= due to various things, including a password change.

    =C2=B7=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Session property change: A session has been determined to have been = compromised

    =C2=B7=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Revocation: The issuer of the single sign-on SAML assertion or ID To= ken needs to be revoke

    I can also add the ID Token claim from the RISC profile to my pull request.<= /p>

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    =C2=A0

    On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

    I need a lot more context here. So far, subject IDs have denoted durable en= tities, such as email addresses, phone numbers, account. This is adding a s= ubject ID that denotes an ephemeral entity, basically similar to a session = ID. This looks weird from an architectural point of view, and also begs the question, why specifically SAML and not o= ther session types.

    =C2=A0

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Id-event <id-event-bounces@ietf.org> on behal= f of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Tuesday, July 14, 2020 at 00:14
    To: Chris Phillips <Chris.Phillips@canarie.ca>
    Cc: "id-= event@ietf.org" <id-event@ietf.org>
    Subject: Re: [Id-event] SAML subject identifier type

    =C2=A0

    Just clarifying the proposal as it stands today (before incorporating Chris= 's input):

    The following section should be added in the "Subject Identifier Types= " section:

    4.9.=C2=A0 SAML Subject= Identifier Type

    =C2=A0 =C2=A0The SAML [SAML.REF] Subject Identifier Type describes a subjec= t by
    =C2=A0 =C2=A0the assertion identifier in the SAML assertion that was used t= o
    =C2=A0 =C2=A0convey the subject's information to the Receiver.=C2=A0 Su= bject
    =C2=A0 =C2=A0Identifiers of this type MUST contain an ` assertion_id"c= laim.=C2=A0 The
    =C2=A0 =C2=A0value of this claim is a string that is equal to the Assertion=
    =C2=A0 =C2=A0Identifier in the SAML assertion.=C2=A0 The SAML Subject Ident= ifier Type
    =C2=A0 =C2=A0is identified by the name "saml`.

    =C2=A0 =C2=A0Below is a non-normative example Subject Identifier for the SA= ML
    =C2=A0 =C2=A0Subject Identifier Type:

    =C2=A0 =C2=A0{
    =C2=A0 =C2=A0 =C2=A0"subject_type": "saml",
    =C2=A0 =C2=A0 =C2=A0"assertion_id": "_f551d88963ab4e3decb7cf= e8f4dcc3f5",
    =C2=A0 =C2=A0}

    =C2=A0 =C2=A0 =C2=A0Figure 8: Example: Subject Identifier for SAML Subject = Identifier
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Type.    <= /u>

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com> wrote:=

    Hi Chris,

    I was proposing using the "assertion id" (S= AML Core spec, line 553) in the proposal, not the "subject-id"= ; as defined in SAML (spec section 3.3). The main reason was to be able to refer to a session that was established using a specific= assertion. If it's useful, we could perhaps extend the SAML subject id= entifier type in this spec to include either the assertion_id or the subjec= t_id claim.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca>= wrote:

    Hi.

    Quiet lurker observing..

    Thanks for consider the SAML elements.. =

    =C2=A0

    Atul, are you referring to the actual session identifi= er that someone may have where the Subject-Id was exchanged OR the actual S= ubject-id itself in your reference in the proposal with the github link?

    =C2=A0

    I=E2=80=99m trying to square what I see on the git del= ta on line 294-296 in https://github...com/richanna/secevent/pull/1/commits/b20b6692eb50628927476= ca78f9be077ace88994

    =C2=A0

    =C2=A0

    And a Subject-id as shown in the example in 3.3.3 here= : https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-su= bject-id-attr-v1.0-cs01.html#_Toc536097229

    =C2=A0

    What you offered in the example is not a Subject-id = =C2=A0per the OASIS SAML spec as written in section 3.3.1<= /u>

    =C2=A0

    Am I mis-interpreting something?<= /p>

    =C2=A0

    C

    =C2=A0

    =C2=A0

    From: <= /b>Id-event <<= a href=3D"mailto:id-event-bounces@ietf.org" target=3D"_blank">id-event-boun= ces@ietf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Monday, July 13, 2020 at 12:17 PM
    To: "id-= event@ietf.org" <id-event@ietf.org>
    Subject: [Id-event] SAML subject identifier type

    =C2=A0

    Hi all,

    Based on the discussions in the SSE working group with= in the OpenID Foundation, we would like to propose that the subject identif= ier specification include a SAML subject identifier type. This is so that s= essions established across peers using SAML may be identified in events that include the subject identifier.

    =C2=A0

    =C2=A0A SAML subject identifier has only one claim wit= hin it, the assertion id of the SAML assertion used to establish the single= sign-on session.

    =C2=A0

    This change is also included in my proposal here.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event


    CONFIDENTIALITY NOTICE: This= email may contain confidential and privileged material for the sole use of= the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..=C2=A0 I= f you have received this communication in error, please notify the sender i= mmediately by e-mail and delete the message and any file attachments from y= our computer. Thank you.

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --000000000000f0944105aa82bcb1-- From nobody Wed Jul 15 16:03:32 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DD063A0B2B for ; Wed, 15 Jul 2020 16:03:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.088 X-Spam-Level: X-Spam-Status: No, score=-2.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xkWcfAVsRnSC for ; Wed, 15 Jul 2020 16:03:27 -0700 (PDT) Received: from mail-lj1-x22c.google.com (mail-lj1-x22c.google.com [IPv6:2a00:1450:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D89723A0B2D for ; Wed, 15 Jul 2020 16:03:26 -0700 (PDT) Received: by mail-lj1-x22c.google.com with SMTP id h22so4666322lji.9 for ; Wed, 15 Jul 2020 16:03:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=nn0ypC1KWp8McbLzzJQ/7L4QsIt/WrDCF/T3oq6aDys=; b=E0Zp5CeeXrt1v3IbQrryzKQNHr7XHE18kMDSUF+izXQKScaTSh02Pnf2lzzFp+K9Bt DkcCAVsZd+Xp1AZV0p2BY9fIymYJz4K3Lbh4gBnAp5yQV8WTH4FlpdmoiE+oK1gJd184 RJA0/PRdstqbZ1iCKIOu5yHx3JqUYUF+IRD0wpHU4jFf/kTzKi/fcVhb4cPW2LUFAn0q 7KeXjRK0JuMSX5vTqGC7Px1szXl++OymDoaFelz5iwZKNKeoZJWYyKXd9Am1NBSTrxEP Vleyg0TF5j7q7JAWlL0jHnm7tBGugwLd+x5TyZ0V3kTVt5EtSgQCCk0PxryVzQxhCL/z ntbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=nn0ypC1KWp8McbLzzJQ/7L4QsIt/WrDCF/T3oq6aDys=; b=hJPhGLfJyYk7X8xWJhXpclnn/mpp2XZ+X3i2pa37dk01LTT43VCs7FiR3xfGmAQ0Hr XLfnG66nHIu1KewZMsJOx4i6uuP7ogjBiZa8j9jmAQ7PQ0rnf1qmuHY7FHHGmr1fW+4k iamZCV86JqNU+NI2bYUFakTuj+XZrAR5vfCJp5EgyibStGzOPePPuZuNyC18NQ86r7Ql 09y8RYlmYavpmNI4wT41UPiVsRfkpDi/7SQIEe0dI185O88j2vUwWyFdOU8zQJ1p8XIK LwwoopUbl6kDS+ug9sN9o+dy9qkurO9HwK5sZHVVIVi4IWyX+Egi/STSskIK07wJ9p69 kvmw== X-Gm-Message-State: AOAM533gnU0A3WND6jsWEac/oVKNg3kpGJ+ZddAbhWFtjqrqvif+NdoX veidMxII1/MrbRf3Ta1bSNq7VW9vMS4eQN98EpldZgmSuaRB3tqF+4zE38NuW6TzaCALEAIEh+5 leD/U3vZ85Vjn6lBKuA== X-Google-Smtp-Source: ABdhPJzSALcK0CKbq8R0M+vYN60cboIgoGcvIc0T/mW18cv/wYU61YMjyXHNrbNM2OV1BY6fkYjDSosadhDaVn1hR14= X-Received: by 2002:a2e:9943:: with SMTP id r3mr555949ljj.280.1594854204373; Wed, 15 Jul 2020 16:03:24 -0700 (PDT) MIME-Version: 1.0 References: <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <8B77A27C-D5B3-477A-BD0D-8B3D3B818BB0@gmail.com> <9CC41112-7947-41E1-9584-6DEB625BBEEA@amazon.com> In-Reply-To: <9CC41112-7947-41E1-9584-6DEB625BBEEA@amazon.com> From: Brian Campbell Date: Wed, 15 Jul 2020 17:02:57 -0600 Message-ID: To: "Richard Backman, Annabelle" Cc: Atul Tulshibagwale , "Richard Backman, Annabelle" , Yaron Sheffer , Chris Phillips , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="0000000000005247e805aa82ee30" Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 23:03:31 -0000 --0000000000005247e805aa82ee30 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Stepping back a little, I'd venture that the notion of a =E2=80=9Cdurable s= ubject=E2=80=9D came from the fact that all the subject identifier types in the draft-ietf-secevent-subject-identifiers draft do identify relatively more permanent subjects. This new type for a session established by a SAML assertion ID was proposed (nearly 11 months after what was supposed to be WG last call) and Yaron noted that it was fundamentally pretty different than what's in the draft now. And he also asked the very reasonable question of why this specifically for SAML and not other session types. To which Atul mentioned and proposed adding the RISC ID Token subject identifier type seemingly suggesting that it was similar to the SAML type. That, I think, confused the discussion because the RISC ID Token subject identifier type is not at all like the SAML type. And attempts to point that out by Yaron and myself while not realizing that it was a precursor to the alias type further confused the discussion. I apologize for my part in propagating the confusion. I gave a +1 to Yaron's because it seemed like the simplest way to try and deter the WG from adding this type. Simpler anyway than trying to type out why describing "a subject by the assertion identifier in the SAML assertion that was used to convey the subject's information" is problematic on numerous levels. The incorrect assumption that there's a 1:1 relationship between a SAML assertion and a session, as you point out, being just one of the problems. There are big tradeoffs and considerations around what kind of thing is identified as the subject. I hope and assume the RISC/CAPE/SSE WG is managing all that. But this draft-ietf-secevent-subject-identifiers is or will be extensible with a registry so as to allow additional types to be defined there, if they are needed and are sensible. I'd suggest we avoid adding new types to this draft (or really any major changes) at this stage short of a really compelling reason to do so. On Wed, Jul 15, 2020 at 3:24 PM Richard Backman, Annabelle < richanna@amazon.com> wrote: > I think the two subject types =E2=80=93 the =E2=80=9Coauth_token=E2=80=9D= type described in my > prior email, and a =E2=80=9Coauth_client=E2=80=9D type that identifies a = subject by its > OAuth 2.0 client ID =E2=80=93 are reasonable types to define. I don=E2=80= =99t see a > particular need to move them into the base spec =E2=80=93 we define an IA= NA > registry precisely so we don=E2=80=99t have to try to define everything u= p front =E2=80=93 > but I=E2=80=99m not opposed to the idea. > > > > I=E2=80=99m not sure where this notion of a =E2=80=9Cdurable subject=E2= =80=9D came from. Right in > the introduction, RFC 8417 > says the subject > of a security event =E2=80=9Cmay be permanent (e.g., a user account) or t= emporary > (e.g., an HTTP session) in nature.=E2=80=9D There are plenty of use cases= for > events where the subjects are temporary/ephemeral: > > 1. Session termination > 2. Changes in the security posture for a session > 3. Token revocation > 4. Asynchronous approval of a request > 5. Changes in the state of a transaction > > =E2=80=A6etc. > > > > Whether or not it makes sense to identify a session subject using a SAML > assertion ID (or an ID Token =E2=80=9Cjti=E2=80=9D claim, in the OIDC wor= ld) is a separate > question. Adding semantics to existing identifiers tends to lead to lots = of > unforeseen complications, and depend on assumptions that don=E2=80=99t al= ways hold > true. In this case, there seems to be an assumption that there is a 1:1 > relationship between a SAML assertion and a session. This is not always t= he > case. > > > > Regardless, a SAML assertion ID is clearly an appropriate identifier when > the subject is a SAML assertion. I don=E2=80=99t know offhand if there ar= e any use > cases for events relating to a SAML assertion itself. I can certainly see > use cases for events related to JWTs (e.g., revocation of a JWT access > token), where a =E2=80=9Cjti=E2=80=9D subject identifier type would be ap= propriate. I=E2=80=99m > inclined to add it to the draft, if for no other reason than to provide a > normative demonstration of a subject identifier that would be used to > identify a more ephemeral subject. > > > > =E2=80=93 > > Annabelle Backman (she/her) > > AWS Identity > > *https://aws.amazon.com/identity/ * > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Wednesday, July 15, 2020 at 12:47 PM > *To: *"Richard Backman, Annabelle" > *Cc: *Yaron Sheffer , Brian Campbell < > bcampbell@pingidentity.com>, Chris Phillips , = " > id-event@ietf.org" > *Subject: *RE: [EXTERNAL] [Id-event] SAML subject identifier type > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and kno= w > the content is safe. > > > > How do we propose to support the two subject types defined in the OAuth > Event Types > spec here? > > > > On Tue, Jul 14, 2020 at 4:54 PM Richard Backman, Annabelle 40amazon.com@dmarc.ietf.org> wrote: > > The RISC Profile=E2=80=99s =E2=80=9CID Token Claims=E2=80=9D type does no= t identify a subject that > is an ID Token, it identifies a subject that was the subject of an ID > Token. It was intended for cases where the OP sent multiple identifiers o= f > different types in the ID Token (e.g., iss+sub and email), and does not > know which of them the client will recognize (yes, the *should* use > iss+sub; no, they doesn=E2=80=99t always do so). This type was replaced i= n > draft-ietf-secevent-subject-identifiers-03 with the =E2=80=9Caliases=E2= =80=9D type, which > is a general solution to this problem that is not defined in terms of one > particular use case (i.e., ID Tokens). > > > > The OIDF SSE working group=E2=80=99s OAuth Event Types draft > > defines a =E2=80=9Coauth_token=E2=80=9D type that identifies a subject th= at is an OAuth 2.0 > token, and does so using either the full or partial plain text value of t= he > token, or a hash of the token.. > > > > It is perfectly fine for a token to be the subject of a security event. > 8417 actually > includes the following as an example of a possible value for the =E2=80= =9Csub=E2=80=9D > claim: > > * a token identifier (e.g. "jti") for a revoked token. > > > > =E2=80=93 > > Annabelle Backman (she/her) > > AWS Identity > > https://aws.amazon.com/identity/ > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Tuesday, July 14, 2020 at 4:32 PM > *To: *Brian Campbell > *Cc: *Yaron Sheffer , Chris Phillips < > Chris.Phillips@canarie.ca>, "id-event@ietf.org" > *Subject: *RE: [EXTERNAL] [Id-event] SAML subject identifier type > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and kno= w > the content is safe. > > > > IMO if we have a common enough use-case that requires a specific type to > be defined, then we should define that type in the spec rather than rely = on > an interpretation of the "iss-sub" type, since that interpretation can > cause incompatibilities. > > > > In this specific case however I feel that the use cases outlined in my > previous email can be achieved (with limitations) using the durable subje= ct > types such as email. I'd like the members of the SSE working group to chi= me > in (since that is where this got added), or we can drop the SAML subject > identifier type. > > > > On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell > wrote: > > + 1 to what Yaron is saying here. I'd include also the "iss-sub" subject > identifier type > https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#se= ction-3.4 > as already having semantics covering what's described in the ID Token > Claims Subject Identifier Type in the RISC document referenced. And all > those things represent a durable subject rather than a session, which > strikes me as appropriate for a document that describes identifying > subjects. A SAML assertion ID, however, which is an identifier of an XML > document that is only indirectly related to a session by an association > that likely isn't maintained, does not seem appropriate as a "subject > identifier". > > > > On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer > wrote: > > Hi Atul, > > > > The ID Token subject type, as described in the document you are > referencing, does not add any semantics, compared to a =E2=80=9Cphone num= ber=E2=80=9D or > =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value in= adding it. > > > > In addition, it does not, actually, describe an ID Token. In fact the tex= t > is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable en= tity) rather than > a session, and does it by citing various claims included in the ID token. > So as a subject identifier type, it is not at all equivalent to a SAML > assertion. > > > > As to the SAML Assertion subject type, I think these use cases could be > addressed by adding information to the event. > > > > Thanks, > > Yaron > > > > *From: *Atul Tulshibagwale > *Date: *Tuesday, July 14, 2020 at 23:26 > *To: *Yaron Sheffer > *Cc: *Chris Phillips , "id-event@ietf.org" < > id-event@ietf.org> > *Subject: *Re: [Id-event] SAML subject identifier type > > > > Hi Yaron, > > There are a few SSE use cases where the events are about a specific singl= e > sign-on session. You're right that this should not be limited to SAML. Th= e > RISC profile of SETs (based on which we are doing the SSE work) had the I= D > Token subject identifier type, which for some reason is missing in this > spec (I did not realize until now). The specific events that need to refe= r > to sessions are: > > =C2=B7 Identity provider context change: The conditions under whi= ch a > SAML assertion or OIDC token was generated are no longer valid. This can = be > due to various things, including a password change. > > =C2=B7 Session property change: A session has been determined to = have > been compromised > > =C2=B7 Revocation: The issuer of the single sign-on SAML assertio= n or > ID Token needs to be revoke > > I can also add the ID Token claim from the RISC profile > > to my pull request. > > > > Thanks, > > Atul > > > > > > On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer > wrote: > > I need a lot more context here. So far, subject IDs have denoted durable > entities, such as email addresses, phone numbers, account. This is adding= a > subject ID that denotes an ephemeral entity, basically similar to a sessi= on > ID. This looks weird from an architectural point of view, and also begs t= he > question, why specifically SAML and not other session types. > > > > Thanks, > > Yaron > > > > *From: *Id-event on behalf of Atul > Tulshibagwale <40google.com@dmarc.ietf..org>> > *Date: *Tuesday, July 14, 2020 at 00:14 > *To: *Chris Phillips > *Cc: *"id-event@ietf.org" > *Subject: *Re: [Id-event] SAML subject identifier type > > > > Just clarifying the proposal as it stands today (before incorporating > Chris's input): > > The following section should be added in the "Subject Identifier Types" > section: > > 4.9. SAML Subject Identifier Type > > The SAML [SAML.REF] Subject Identifier Type describes a subject by > the assertion identifier in the SAML assertion that was used to > convey the subject's information to the Receiver. Subject > Identifiers of this type MUST contain an ` assertion_id"claim. The > value of this claim is a string that is equal to the Assertion > Identifier in the SAML assertion. The SAML Subject Identifier Type > is identified by the name "saml`. > > Below is a non-normative example Subject Identifier for the SAML > Subject Identifier Type: > > { > "subject_type": "saml", > "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", > } > > Figure 8: Example: Subject Identifier for SAML Subject Identifier > Type. > > > > > > On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale > wrote: > > Hi Chris, > > I was proposing using the "assertion id" (SAML Core > > spec, line 553) in the proposal, not the "subject-id" as defined in SAML > (spec section 3.3). The main reason was to be able to refer to a session > that was established using a specific assertion. If it's useful, we could > perhaps extend the SAML subject identifier type in this spec to include > either the assertion_id or the subject_id claim. > > > > Thanks, > > Atul > > > > > > On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips > wrote: > > Hi. > > Quiet lurker observing.. > > Thanks for consider the SAML elements.. > > > > Atul, are you referring to the actual session identifier that someone may > have where the Subject-Id was exchanged OR the actual Subject-id itself i= n > your reference in the proposal with the github link? > > > > I=E2=80=99m trying to square what I see on the git delta on line 294-296 = in > https://github...com/richanna/secevent/pull/1/commits/b20b6692eb506289274= 76ca78f9be077ace88994 > > > > > > > And a Subject-id as shown in the example in 3.3.3 here: > https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-= subject-id-attr-v1.0-cs01.html#_Toc536097229 > > > > > What you offered in the example is not a Subject-id per the OASIS SAML > spec as written in section 3.3.1 > > > > Am I mis-interpreting something? > > > > C > > > > > > *From: *Id-event on behalf of Atul > Tulshibagwale > *Date: *Monday, July 13, 2020 at 12:17 PM > *To: *"id-event@ietf.org" > *Subject: *[Id-event] SAML subject identifier type > > > > Hi all, > > Based on the discussions in the SSE working group within the OpenID > Foundation, we would like to propose that the subject identifier > specification include a SAML subject identifier type. This is so that > sessions established across peers using SAML may be identified in events > that include the subject identifier. > > > > A SAML subject identifier has only one claim within it, the assertion id > of the SAML assertion used to establish the single sign-on session. > > > > This change is also included in my proposal here > . > > > > Thanks, > > Atul > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > _______________________________________________ Id-event mailing list > Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > *CONFIDENTIALITY NOTICE: This email may contain confidential and > privileged material for the sole use of the intended recipient(s). Any > review, use, distribution or disclosure by others is strictly prohibited.= . > If you have received this communication in error, please notify the sende= r > immediately by e-mail and delete the message and any file attachments fro= m > your computer. Thank you.* > > --=20 _CONFIDENTIALITY NOTICE: This email may contain confidential and privileged= =20 material for the sole use of the intended recipient(s). Any review, use,=20 distribution or disclosure by others is strictly prohibited.=C2=A0 If you h= ave=20 received this communication in error, please notify the sender immediately= =20 by e-mail and delete the message and any file attachments from your=20 computer. Thank you._ --0000000000005247e805aa82ee30 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Stepping back a little, I'd venture that the noti= on of a =E2=80=9Cdurable subject=E2=80=9D came from the fact that all the s= ubject identifier types in the draft-ietf-secevent-subject-identifiers draf= t do identify relatively more permanent subjects. This new type for a sessi= on established by a SAML assertion ID was proposed (nearly 11 months after = what was supposed to be WG last call) and Yaron noted that it was fundament= ally pretty different than what's in the draft now. And he also asked t= he very reasonable question of why this specifically for SAML and not other= session types. To which Atul mentioned and proposed adding the RISC ID Tok= en subject identifier type seemingly suggesting that it was similar to the = SAML type. That, I think, confused the discussion because the RISC ID Token= subject identifier type is not at all like the SAML type. And attempts to = point that out by Yaron and myself while not realizing that it was a precur= sor to the alias type further confused the discussion. I apologize for my p= art in propagating the confusion.

    I gave a +1= to Yaron's because it seemed like the simplest way to try and deter th= e WG from adding this type. Simpler anyway than trying to type out why desc= ribing "a subject by the assertion identifier in the SAML assertion th= at was used to convey the subject's information" is problematic on= numerous levels. The incorrect assumption that there's a 1:1 relations= hip between a SAML assertion and a session, as you point out, being just on= e of the problems.

    There are big tradeoffs an= d considerations around what kind of thing is identified as the subject.=C2= =A0 I hope and assume the RISC/CAPE/SSE WG is managing all that. But this d= raft-ietf-secevent-subject-identifiers is or will be extensible with a regi= stry so as to allow additional types to be defined there, if they are neede= d and are sensible. I'd suggest we avoid adding new types to this draft= (or really any major changes) at this stage short of a really compelling r= eason to do so.

    On Wed, Jul 15, 2020 at 3:24 PM Richard Backman, = Annabelle <rich= anna@amazon.com> wrote:

    I think the two subject types =E2=80=93 the =E2=80= =9Coauth_token=E2=80=9D type described in my prior email, and a =E2=80=9Coa= uth_client=E2=80=9D type that identifies a subject by its OAuth 2.0 client = ID =E2=80=93 are reasonable types to define. I don=E2=80=99t see a particul= ar need to move them into the base spec =E2=80=93 we define an IANA registry precisely so we do= n=E2=80=99t have to try to define everything up front =E2=80=93 but I=E2=80= =99m not opposed to the idea.

    =C2=A0

    I=E2=80=99m not sure where this notion of a =E2=80= =9Cdurable subject=E2=80=9D came from. Right in the introduction, RFC 8417 says the subject of a security event =E2=80=9Cmay be = permanent (e.g., a user account) or temporary (e.g., an HTTP session) in na= ture.=E2=80=9D There are plenty of use cases for events where the subjects are temporary/ephemeral:

    1. Session termination
    2. Changes in the security posture for a session=
    3. Token revocation
    4. Asynchronous approval of a request
    5. Changes in the state of a transacti= on

    =E2=80=A6etc.

    =C2=A0

    Whether or not it makes sense to identify a session = subject using a SAML assertion ID (or an ID Token =E2=80=9Cjti=E2=80=9D cla= im, in the OIDC world) is a separate question. Adding semantics to existing= identifiers tends to lead to lots of unforeseen complications, and depend on assumptions that don=E2=80=99t always hold true. In this cas= e, there seems to be an assumption that there is a 1:1 relationship between= a SAML assertion and a session. This is not always the case.=

    =C2=A0

    Regardless, a SAML assertion ID is clearly an approp= riate identifier when the subject is a SAML assertion. I don=E2=80=99t know= offhand if there are any use cases for events relating to a SAML assertion= itself. I can certainly see use cases for events related to JWTs (e.g., revocation of a JWT access token), where a = =E2=80=9Cjti=E2=80=9D subject identifier type would be appropriate. I=E2=80= =99m inclined to add it to the draft, if for no other reason than to provid= e a normative demonstration of a subject identifier that would be used to identify a more ephemeral subject.

    =C2=A0

    =E2=80=93

    Annabelle Backman (sh= e/her)

    AWS Identity

    https://aw= s.amazon.com/identity/=

    =C2=A0

    =C2=A0

    From: Id-event <id-event-bounces@ie= tf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ie= tf.org>
    Date: Wednesday, July 15, 2020 at 12:47 PM
    To: "Richard Backman, Annabelle" <richanna=3D40amazon.com@dmarc.i= etf.org>
    Cc: Yaron Sheffer <yaronf.ietf@gmail.com>, Brian Campbell <bcampbell@pingidentity.= com>, Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf.org" <id-event@ietf.org&= gt;
    Subject: RE: [EXTERNAL] [Id-event] SAML subject identifier type

    =C2=A0

    CAUTION<= /strong>: This email originated from outside of the organization. Do = not click links or open attachments unless you can confirm the sender and know the content is safe.<= /u>

    =C2=A0

    How do we propose to sup= port the two subject types defined in the OAuth Event Types spec here?

    =C2=A0

    On Tue, Jul 14, 2020 at = 4:54 PM Richard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org>= wrote:

    The RISC Profile=E2=80=99s =E2=80=9CID Token Claims=E2=80=9D type does not = identify a subject that is an ID Token, it identifies a subject that was th= e subject of an ID Token. It was intended for cases where the OP sent multi= ple identifiers of different types in the ID Token (e.g., iss+sub and email), and does not know which of them the client will recogn= ize (yes, the should use iss+sub; no, they doesn=E2=80=99t always do so). This typ= e was replaced in draft-ietf-secevent-subject-identifiers-03 with the =E2= =80=9Caliases=E2=80=9D type, which is a general solution to this problem th= at is not defined in terms of one particular use case (i.e., ID Tokens).

    =C2=A0

    The OIDF SSE working group=E2=80=99s OAuth Event Types draft defines a =E2=80=9Coauth_token=E2=80=9D type th= at identifies a subject that is an OAuth 2.0 token, and does so using eithe= r the full or partial plain text value of the token, or a hash of the token= ..

    =C2=A0

    It is perfectly fine for a token to be the subject of a security event. 8417 actually includes the following as an example of a possible value = for the =E2=80=9Csub=E2=80=9D claim:

    *=C2=A0 a token identifier (e.g. "jti") for a revoked token.<= /span>

    =C2=A0

    =E2=80=93

    Annabelle Backman (she/her)=

    AWS Identity

    https://aws.amazon.c= om/identity/

    =C2=A0

    =C2=A0

    From: Id-event <id-event-bounces@ietf.org> on behal= f of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Tuesday, July 14, 2020 at 4:32 PM
    To: Brian Campbell <bcampbell@pingidentity.com>
    Cc: Yaron Sheffer <yaronf.ietf@gmail.com>, Chris Phillips <Chris.Phillips@canarie.c= a>, "id-= event@ietf.org" <id-event@ietf.o= rg>
    Subject: RE: [EXTERNAL] [Id-event] SAML subject identifier type

    =C2=A0

    CAUTION<= /strong>: This email originated from outside of the organization. Do = not click links or open attachments unless you can confirm the sender and know the content is safe.<= /u>

    =C2=A0

    IMO if we have a common enough use-case that requires a specific type to be= defined, then we should define that type in the spec rather than rely on a= n interpretation of the "iss-sub" type, since that interpretation= can cause incompatibilities.

    =C2=A0

    In this specific case however I feel that the use cases outlined in my prev= ious email can be achieved (with limitations) using the durable subject typ= es such as email. I'd like the members of the SSE working group to chim= e in (since that is where this got added), or we can drop the SAML subject identifier type.

    =C2=A0

    On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell <bcampbell@pingidentity.com> = wrote:

    + 1 to what Yaron is saying here. I'd include also the "iss-sub&qu= ot; subject identifier type https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#sect= ion-3.4 as already having semantics covering what's described in th= e ID Token Claims Subject Identifier Type in the RISC document referenced. = And all those things represent a durable subject rather than a session, which strikes me as appropriate for a docum= ent that describes identifying subjects. A SAML assertion ID, however, whic= h is an identifier of an XML document that is only indirectly related to a = session by an association that likely isn't maintained, does not seem appropriate as a "subject identif= ier".

    =C2=A0

    On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

    Hi Atul,

    =C2=A0

    The ID Token subject type, as described in the document you are referencing= , does not add any semantics, compared to a =E2=80=9Cphone number=E2=80=9D = or =E2=80=9Cemail=E2=80=9D subject type. So I don=E2=80=99t see the value i= n adding it.

    =C2=A0

    In addition, it does not, actually, describe an ID Token. In fact the text = is very clear that it describes a =E2=80=9Csubject=E2=80=9D (a durable enti= ty) rather than a session, and does it by citing various claims included in= the ID token. So as a subject identifier type, it is not at all equivalent to a SAML assertion.

    =C2=A0

    As to the SAML Assertion subject type, I think these use cases could be add= ressed by adding information to the event.

    =C2=A0

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Atul Tulshibagwale <atultulshi@google.com>
    Date: Tuesday, July 14, 2020 at 23:26
    To: Yaron Sheffer <yaronf.ietf@gmail.com>
    Cc: Chris Phillips <Chris.Phillips@canarie.ca>, "id-event@ietf.org" <id-event@ietf.org>= ;
    Subject: Re: [Id-event] SAML subject identifier type

    =C2=A0

    Hi=C2=A0Yaron,

    There are a few SSE use cases where the events are about a specific single = sign-on session. You're right that this should not be limited to SAML. = The RISC profile of SETs (based on which we are doing the SSE work) had the= ID Token subject identifier type, which for some reason is missing in this spec (I did not realize until now). The= specific events that need to refer to sessions are:

    =C2=B7=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Identity provider context change: The conditions under which a SAML = assertion or OIDC token was generated are no longer=C2=A0valid. This can be= due to various things, including a password change.

    =C2=B7=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Session property change: A session has been determined to have been = compromised

    =C2=B7=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Revocation: The issuer of the single sign-on SAML assertion or ID To= ken needs to be revoke

    I can also add the ID Token claim from the RISC profile to my pull request.<= /p>

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    =C2=A0

    On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer <yaronf.ietf@gmail.com> wrote:=

    I need a lot more context here. So far, subject IDs have denoted durable en= tities, such as email addresses, phone numbers, account. This is adding a s= ubject ID that denotes an ephemeral entity, basically similar to a session = ID. This looks weird from an architectural point of view, and also begs the question, why specifically SAML and not o= ther session types.

    =C2=A0

    Thanks,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 Yaron

    =C2=A0

    From: Id-event <id-event-bounces@ietf.org> on behal= f of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Tuesday, July 14, 2020 at 00:14
    To: Chris Phillips <Chris.Phillips@canarie.ca>
    Cc: "id-= event@ietf.org" <id-event@ietf.org>
    Subject: Re: [Id-event] SAML subject identifier type

    =C2=A0

    Just clarifying the proposal as it stands today (before incorporating Chris= 's input):

    The following section should be added in the "Subject Identifier Types= " section:

    4.9.=C2=A0 SAML Subject= Identifier Type

    =C2=A0 =C2=A0The SAML [SAML.REF] Subject Identifier Type describes a subjec= t by
    =C2=A0 =C2=A0the assertion identifier in the SAML assertion that was used t= o
    =C2=A0 =C2=A0convey the subject's information to the Receiver.=C2=A0 Su= bject
    =C2=A0 =C2=A0Identifiers of this type MUST contain an ` assertion_id"c= laim.=C2=A0 The
    =C2=A0 =C2=A0value of this claim is a string that is equal to the Assertion=
    =C2=A0 =C2=A0Identifier in the SAML assertion.=C2=A0 The SAML Subject Ident= ifier Type
    =C2=A0 =C2=A0is identified by the name "saml`.

    =C2=A0 =C2=A0Below is a non-normative example Subject Identifier for the SA= ML
    =C2=A0 =C2=A0Subject Identifier Type:

    =C2=A0 =C2=A0{
    =C2=A0 =C2=A0 =C2=A0"subject_type": "saml",
    =C2=A0 =C2=A0 =C2=A0"assertion_id": "_f551d88963ab4e3decb7cf= e8f4dcc3f5",
    =C2=A0 =C2=A0}

    =C2=A0 =C2=A0 =C2=A0Figure 8: Example: Subject Identifier for SAML Subject = Identifier
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Type.    <= /u>

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com> wrote:=

    Hi Chris,

    I was proposing using the "assertion id" (S= AML Core spec, line 553) in the proposal, not the "subject-id"= ; as defined in SAML (spec section 3.3). The main reason was to be able to refer to a session that was established using a specific= assertion. If it's useful, we could perhaps extend the SAML subject id= entifier type in this spec to include either the assertion_id or the subjec= t_id claim.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    =C2=A0

    On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca> = wrote:

    Hi.

    Quiet lurker observing..

    Thanks for consider the SAML elements.. =

    =C2=A0

    Atul, are you referring to the actual session identifi= er that someone may have where the Subject-Id was exchanged OR the actual S= ubject-id itself in your reference in the proposal with the github link?

    =C2=A0

    I=E2=80=99m trying to square what I see on the git del= ta on line 294-296 in https://github...com/richanna/secevent/pull/1/commits/b20b6692eb50628927476= ca78f9be077ace88994

    =C2=A0

    =C2=A0

    And a Subject-id as shown in the example in 3.3.3 here= : https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-su= bject-id-attr-v1.0-cs01.html#_Toc536097229

    =C2=A0

    What you offered in the example is not a Subject-id = =C2=A0per the OASIS SAML spec as written in section 3.3.1<= /u>

    =C2=A0

    Am I mis-interpreting something?<= /p>

    =C2=A0

    C

    =C2=A0

    =C2=A0

    From: <= /b>Id-event <<= a href=3D"mailto:id-event-bounces@ietf.org" target=3D"_blank">id-event-boun= ces@ietf.org> on behalf of Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
    Date: Monday, July 13, 2020 at 12:17 PM
    To: "id-= event@ietf.org" <id-event@ietf.org>
    Subject: [Id-event] SAML subject identifier type

    =C2=A0

    Hi all,

    Based on the discussions in the SSE working group with= in the OpenID Foundation, we would like to propose that the subject identif= ier specification include a SAML subject identifier type. This is so that s= essions established across peers using SAML may be identified in events that include the subject identifier.

    =C2=A0

    =C2=A0A SAML subject identifier has only one claim wit= hin it, the assertion id of the SAML assertion used to establish the single= sign-on session.

    =C2=A0

    This change is also included in my proposal here.

    =C2=A0

    Thanks,

    Atul

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event

    _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event


    CONFIDENTIALITY NOTICE: This= email may contain confidential and privileged material for the sole use of= the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..=C2=A0 I= f you have received this communication in error, please notify the sender i= mmediately by e-mail and delete the message and any file attachments from y= our computer. Thank you.


    <= span style=3D"margin:0px;padding:0px;border:0px;outline:0px;vertical-align:= baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,= -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ub= untu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600"= >CONFIDENTIALITY NOTICE: This email may contain confidenti= al and privileged material for the sole use of the intended recipient(s). A= ny review, use, distribution or disclosure by others is strictly prohibited= .=C2=A0 If you have received this communication in error, please notify the= sender immediately by e-mail and delete the message and any file attachmen= ts from your computer. Thank you. --0000000000005247e805aa82ee30-- From nobody Wed Jul 15 16:38:02 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5B363A0B6C for ; Wed, 15 Jul 2020 16:38:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.09 X-Spam-Level: X-Spam-Status: No, score=-2.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JFMeWYzl1YMf for ; Wed, 15 Jul 2020 16:37:57 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640106.outbound.protection.outlook.com [40.107.64.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC0EF3A0B64 for ; Wed, 15 Jul 2020 16:37:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YO3TC4b1pJaq0fHgGMzh2RlfLeWzeDnYk68JbZmTNMYt8eI92A7aj5EX633UiM/sfB1Gno48MfORoki4UQd0Tc7sqhLXFsUkqklGKC/WRRzBbqU3gHGaBeP/zwyzIts0U1NP2TkARdgI6L6Dj9yZpwRvkzRnoiFnRpwMTvxCnYoOZHLBdShazGeJs/X/Vts0EuyYM1IPJ9criPBHoDNnXXCuj2J5Pr8kV4H16iv84ZebyNSCuaOMrYGBQSTzFxBormDXnmPtaqm9E5Mb7S9BPkZIFLxYDV6hqa3pN9ZG1e9e8gwcXxZETDoVgFWk3i2bYp0bDM314avSprOEaZDq3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oGbDgU5RQ2crsVTfC8ovI3jXD1xgmycvSlgivIc+aNI=; b=hUtCngiu0ZetY8HshFcHQ2HF2hyiO3UQvMMWcvUIGLN4ph8kGE4uL1KYWZqrSkYv8dy5fZ+myYR8M4pdb/EPtRoxxzQ+Qza8+l7eA7+qRbflHhNl9DKqKy7LgRz5yfljJYnvkpL5LV8DM7efwUesASRfSrjlaTjqRyDXaX/dH3ZuEEF+GHzseHMXCV5E/GtSOAePAH7lVOqDLQcX9XF6FDYwWmMsTub4EgKEZwDjRKtJ6CSWkEaEhJNXm+nxtHw5p53NJJ8/hgrnI57Le/wtAGKVe8edXJedlV+6EHhIm8clKhT04R7YHnlfH1RxwMlH1+WRR1v7vCbX/qeEwd6RxQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oGbDgU5RQ2crsVTfC8ovI3jXD1xgmycvSlgivIc+aNI=; b=WzWniCKPg8qfYEeSxFmd0bn27Tg9ZhFuYAcEbAl+y0pjB4aP4Sg+lnNCazDUWmrERRJZ0kNa7PLKZXAt04rhp8jlRzPZUsV5VEV5gWBY1e3j1bj5qYTYn0dJ4WiQ+sbZNi6vDT4X7rD4+xdbglOBagtlWrY3VhYJLXyDgJUPWRs= Received: from CH2PR00MB0679.namprd00.prod.outlook.com (2603:10b6:610:af::7) by CH2PR00MB0710.namprd00.prod.outlook.com (2603:10b6:610:a9::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3231.0; Wed, 15 Jul 2020 23:37:54 +0000 Received: from CH2PR00MB0679.namprd00.prod.outlook.com ([fe80::5821:2d92:80e8:85d5]) by CH2PR00MB0679.namprd00.prod.outlook.com ([fe80::5821:2d92:80e8:85d5%9]) with mapi id 15.20.3238.000; Wed, 15 Jul 2020 23:37:54 +0000 From: Mike Jones To: Brian Campbell , "Richard Backman, Annabelle" CC: Atul Tulshibagwale , Yaron Sheffer , Chris Phillips , "id-event@ietf.org" , "Richard Backman, Annabelle" Thread-Topic: [Id-event] SAML subject identifier type Thread-Index: AdZbAO50jsZovhkpSzWsateJNKMIAQ== Date: Wed, 15 Jul 2020 23:37:54 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-15T23:36:54Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=0394dbe3-5184-4c76-bf47-69e131b6b526; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0 authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 96daa94e-d0bc-4861-bc5b-08d82918190a x-ms-traffictypediagnostic: CH2PR00MB0710: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5797; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: foQfU0BEu/uORB3gqwDIirG2MwaGoH+MG2FoUk/MWW2UVaU8D9bzl1tzheG71dkT7lfXU9LGhI+xu3kQWVOBm5kUVLM1X9ZR2OWUEKrQbKmT+OXcs929aJsP/gb7DGViUhG9hNDwxL7kgEQbc2e0RygfPPpkPbYJGwBZvcW/BPr31Co3NLr5wXyBOUf0Yjq+B02QB02cSOCyOhyp3zVzvUaVAUGec7poY9XytnkTljAJ/a7hOd0xCWSTxXePYVIOxWxfUXTrEIL/7vrJ1WqIxxXG49j2DjCdsScOApfKdLD94Q1QDXuGW0z0slFU0lZ7uUJG8sfPM8BeVEjXpIwqhRt/73FMxMU+D1wjQZtulgR/tEoQuH0CXTqsUVWIavcHH/vHlWokPhCARmDPfP4Jnw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR00MB0679.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(376002)(366004)(396003)(39860400002)(136003)(21615005)(166002)(83380400001)(2906002)(64756008)(76116006)(7066003)(8676002)(66446008)(186003)(82960400001)(26005)(4326008)(66556008)(10290500003)(30864003)(66946007)(478600001)(66476007)(82950400001)(33656002)(54906003)(110136005)(55016002)(86362001)(52536014)(8990500004)(7696005)(9686003)(53546011)(71200400001)(8936002)(5660300002)(966005)(316002)(6506007)(579004); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: xxKIdvRElV54Z5jdvQWMZNzGrEkI03EVjUpoePjdZgrIAzw1S+O8Sixktc6bSnGDMzPEuYmoW2i2Ms+hJC2BL7lL1+3lmbx8BH7Kan0rYRS9xyGeD3waxsBQA1U13foDMZO/A7tJ7m99jEdMlzx+Z7Ipa9I/d/NIkMABkwjxmyk8Lfbuxa5GEX4J3c/qE1gN4YrVJtwm81ZRnRcgOYiXpG1oaT5f/MqcK2HQcdlo5DPB10yLRtnDry8Le7UZ6uh/iRiSbLVO6U5Q3lZy0ulmA/+6BcmNXGjlU/jwKweLiFc2+5ZCuATQ8TqqIfXSW6dVuYGMj/96q1nERLBXuANZorXAMUrr+BYxCQiqmX5eT1gJcP38hpPtcKXJMMLkKVTUxh9V/dVGysvFJZ7QOr0gffc52EaKyQUYDH2LiJVBnyQhNWxaIkmyGA4vBRC46agx4w+cBj3/nh5BnBj5bVP1zH+AZ8Br2D5rXXCB4TReck8= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR00MB0679C47908D1EA76D7B31164F57E0CH2PR00MB0679namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CH2PR00MB0679.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 96daa94e-d0bc-4861-bc5b-08d82918190a X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jul 2020 23:37:54.7211 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: b0HJ41TMef/jhFGbHXss7o16YPZLG7dDiaLIgnHLI4Fh81I6nQfVBTZ9GTQCskw+3nQB6uB/oPJBROfbTmHIDA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0710 Archived-At: Subject: Re: [Id-event] SAML subject identifier type X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 23:38:01 -0000 --_000_CH2PR00MB0679C47908D1EA76D7B31164F57E0CH2PR00MB0679namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aGlzIGFuYWx5c2lzLCBCcmlhbi4gIEkgYmVsaWV2ZSB0aGF0IGl0IGlzIHNw b3Qgb24hDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAtLSBNaWtlDQoNCkZyb206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYu b3JnPiBPbiBCZWhhbGYgT2YgQnJpYW4gQ2FtcGJlbGwNClNlbnQ6IFdlZG5lc2RheSwgSnVseSAx NSwgMjAyMCA0OjAzIFBNDQpUbzogUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgPHJpY2hhbm5h QGFtYXpvbi5jb20+DQpDYzogQXR1bCBUdWxzaGliYWd3YWxlIDxhdHVsdHVsc2hpPTQwZ29vZ2xl LmNvbUBkbWFyYy5pZXRmLm9yZz47IFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNv bT47IENocmlzIFBoaWxsaXBzIDxDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPjsgaWQtZXZlbnRA aWV0Zi5vcmc7IFJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlIDxyaWNoYW5uYT00MGFtYXpvbi5j b21AZG1hcmMuaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBTQU1MIHN1YmplY3Qg aWRlbnRpZmllciB0eXBlDQoNClN0ZXBwaW5nIGJhY2sgYSBsaXR0bGUsIEknZCB2ZW50dXJlIHRo YXQgdGhlIG5vdGlvbiBvZiBhIOKAnGR1cmFibGUgc3ViamVjdOKAnSBjYW1lIGZyb20gdGhlIGZh Y3QgdGhhdCBhbGwgdGhlIHN1YmplY3QgaWRlbnRpZmllciB0eXBlcyBpbiB0aGUgZHJhZnQtaWV0 Zi1zZWNldmVudC1zdWJqZWN0LWlkZW50aWZpZXJzIGRyYWZ0IGRvIGlkZW50aWZ5IHJlbGF0aXZl bHkgbW9yZSBwZXJtYW5lbnQgc3ViamVjdHMuIFRoaXMgbmV3IHR5cGUgZm9yIGEgc2Vzc2lvbiBl c3RhYmxpc2hlZCBieSBhIFNBTUwgYXNzZXJ0aW9uIElEIHdhcyBwcm9wb3NlZCAobmVhcmx5IDEx IG1vbnRocyBhZnRlciB3aGF0IHdhcyBzdXBwb3NlZCB0byBiZSBXRyBsYXN0IGNhbGwpIGFuZCBZ YXJvbiBub3RlZCB0aGF0IGl0IHdhcyBmdW5kYW1lbnRhbGx5IHByZXR0eSBkaWZmZXJlbnQgdGhh biB3aGF0J3MgaW4gdGhlIGRyYWZ0IG5vdy4gQW5kIGhlIGFsc28gYXNrZWQgdGhlIHZlcnkgcmVh c29uYWJsZSBxdWVzdGlvbiBvZiB3aHkgdGhpcyBzcGVjaWZpY2FsbHkgZm9yIFNBTUwgYW5kIG5v dCBvdGhlciBzZXNzaW9uIHR5cGVzLiBUbyB3aGljaCBBdHVsIG1lbnRpb25lZCBhbmQgcHJvcG9z ZWQgYWRkaW5nIHRoZSBSSVNDIElEIFRva2VuIHN1YmplY3QgaWRlbnRpZmllciB0eXBlIHNlZW1p bmdseSBzdWdnZXN0aW5nIHRoYXQgaXQgd2FzIHNpbWlsYXIgdG8gdGhlIFNBTUwgdHlwZS4gVGhh dCwgSSB0aGluaywgY29uZnVzZWQgdGhlIGRpc2N1c3Npb24gYmVjYXVzZSB0aGUgUklTQyBJRCBU b2tlbiBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZSBpcyBub3QgYXQgYWxsIGxpa2UgdGhlIFNBTUwg dHlwZS4gQW5kIGF0dGVtcHRzIHRvIHBvaW50IHRoYXQgb3V0IGJ5IFlhcm9uIGFuZCBteXNlbGYg d2hpbGUgbm90IHJlYWxpemluZyB0aGF0IGl0IHdhcyBhIHByZWN1cnNvciB0byB0aGUgYWxpYXMg dHlwZSBmdXJ0aGVyIGNvbmZ1c2VkIHRoZSBkaXNjdXNzaW9uLiBJIGFwb2xvZ2l6ZSBmb3IgbXkg cGFydCBpbiBwcm9wYWdhdGluZyB0aGUgY29uZnVzaW9uLg0KDQpJIGdhdmUgYSArMSB0byBZYXJv bidzIGJlY2F1c2UgaXQgc2VlbWVkIGxpa2UgdGhlIHNpbXBsZXN0IHdheSB0byB0cnkgYW5kIGRl dGVyIHRoZSBXRyBmcm9tIGFkZGluZyB0aGlzIHR5cGUuIFNpbXBsZXIgYW55d2F5IHRoYW4gdHJ5 aW5nIHRvIHR5cGUgb3V0IHdoeSBkZXNjcmliaW5nICJhIHN1YmplY3QgYnkgdGhlIGFzc2VydGlv biBpZGVudGlmaWVyIGluIHRoZSBTQU1MIGFzc2VydGlvbiB0aGF0IHdhcyB1c2VkIHRvIGNvbnZl eSB0aGUgc3ViamVjdCdzIGluZm9ybWF0aW9uIiBpcyBwcm9ibGVtYXRpYyBvbiBudW1lcm91cyBs ZXZlbHMuIFRoZSBpbmNvcnJlY3QgYXNzdW1wdGlvbiB0aGF0IHRoZXJlJ3MgYSAxOjEgcmVsYXRp b25zaGlwIGJldHdlZW4gYSBTQU1MIGFzc2VydGlvbiBhbmQgYSBzZXNzaW9uLCBhcyB5b3UgcG9p bnQgb3V0LCBiZWluZyBqdXN0IG9uZSBvZiB0aGUgcHJvYmxlbXMuDQoNClRoZXJlIGFyZSBiaWcg dHJhZGVvZmZzIGFuZCBjb25zaWRlcmF0aW9ucyBhcm91bmQgd2hhdCBraW5kIG9mIHRoaW5nIGlz IGlkZW50aWZpZWQgYXMgdGhlIHN1YmplY3QuICBJIGhvcGUgYW5kIGFzc3VtZSB0aGUgUklTQy9D QVBFL1NTRSBXRyBpcyBtYW5hZ2luZyBhbGwgdGhhdC4gQnV0IHRoaXMgZHJhZnQtaWV0Zi1zZWNl dmVudC1zdWJqZWN0LWlkZW50aWZpZXJzIGlzIG9yIHdpbGwgYmUgZXh0ZW5zaWJsZSB3aXRoIGEg cmVnaXN0cnkgc28gYXMgdG8gYWxsb3cgYWRkaXRpb25hbCB0eXBlcyB0byBiZSBkZWZpbmVkIHRo ZXJlLCBpZiB0aGV5IGFyZSBuZWVkZWQgYW5kIGFyZSBzZW5zaWJsZS4gSSdkIHN1Z2dlc3Qgd2Ug YXZvaWQgYWRkaW5nIG5ldyB0eXBlcyB0byB0aGlzIGRyYWZ0IChvciByZWFsbHkgYW55IG1ham9y IGNoYW5nZXMpIGF0IHRoaXMgc3RhZ2Ugc2hvcnQgb2YgYSByZWFsbHkgY29tcGVsbGluZyByZWFz b24gdG8gZG8gc28uDQoNCk9uIFdlZCwgSnVsIDE1LCAyMDIwIGF0IDM6MjQgUE0gUmljaGFyZCBC YWNrbWFuLCBBbm5hYmVsbGUgPHJpY2hhbm5hQGFtYXpvbi5jb208bWFpbHRvOnJpY2hhbm5hQGFt YXpvbi5jb20+PiB3cm90ZToNCkkgdGhpbmsgdGhlIHR3byBzdWJqZWN0IHR5cGVzIOKAkyB0aGUg 4oCcb2F1dGhfdG9rZW7igJ0gdHlwZSBkZXNjcmliZWQgaW4gbXkgcHJpb3IgZW1haWwsIGFuZCBh IOKAnG9hdXRoX2NsaWVudOKAnSB0eXBlIHRoYXQgaWRlbnRpZmllcyBhIHN1YmplY3QgYnkgaXRz IE9BdXRoIDIuMCBjbGllbnQgSUQg4oCTIGFyZSByZWFzb25hYmxlIHR5cGVzIHRvIGRlZmluZS4g SSBkb27igJl0IHNlZSBhIHBhcnRpY3VsYXIgbmVlZCB0byBtb3ZlIHRoZW0gaW50byB0aGUgYmFz ZSBzcGVjIOKAkyB3ZSBkZWZpbmUgYW4gSUFOQSByZWdpc3RyeSBwcmVjaXNlbHkgc28gd2UgZG9u 4oCZdCBoYXZlIHRvIHRyeSB0byBkZWZpbmUgZXZlcnl0aGluZyB1cCBmcm9udCDigJMgYnV0IEni gJltIG5vdCBvcHBvc2VkIHRvIHRoZSBpZGVhLg0KDQpJ4oCZbSBub3Qgc3VyZSB3aGVyZSB0aGlz IG5vdGlvbiBvZiBhIOKAnGR1cmFibGUgc3ViamVjdOKAnSBjYW1lIGZyb20uIFJpZ2h0IGluIHRo ZSBpbnRyb2R1Y3Rpb24sIFJGQyA4NDE3PGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL3JmYy9y ZmM4NDE3Lmh0bWwjc2VjdGlvbi0xPiBzYXlzIHRoZSBzdWJqZWN0IG9mIGEgc2VjdXJpdHkgZXZl bnQg4oCcbWF5IGJlIHBlcm1hbmVudCAoZS5nLiwgYSB1c2VyIGFjY291bnQpIG9yIHRlbXBvcmFy eSAoZS5nLiwgYW4gSFRUUCBzZXNzaW9uKSBpbiBuYXR1cmUu4oCdIFRoZXJlIGFyZSBwbGVudHkg b2YgdXNlIGNhc2VzIGZvciBldmVudHMgd2hlcmUgdGhlIHN1YmplY3RzIGFyZSB0ZW1wb3Jhcnkv ZXBoZW1lcmFsOg0KDQogIDEuICBTZXNzaW9uIHRlcm1pbmF0aW9uDQogIDIuICBDaGFuZ2VzIGlu IHRoZSBzZWN1cml0eSBwb3N0dXJlIGZvciBhIHNlc3Npb24NCiAgMy4gIFRva2VuIHJldm9jYXRp b24NCiAgNC4gIEFzeW5jaHJvbm91cyBhcHByb3ZhbCBvZiBhIHJlcXVlc3QNCiAgNS4gIENoYW5n ZXMgaW4gdGhlIHN0YXRlIG9mIGEgdHJhbnNhY3Rpb24NCuKApmV0Yy4NCg0KV2hldGhlciBvciBu b3QgaXQgbWFrZXMgc2Vuc2UgdG8gaWRlbnRpZnkgYSBzZXNzaW9uIHN1YmplY3QgdXNpbmcgYSBT QU1MIGFzc2VydGlvbiBJRCAob3IgYW4gSUQgVG9rZW4g4oCcanRp4oCdIGNsYWltLCBpbiB0aGUg T0lEQyB3b3JsZCkgaXMgYSBzZXBhcmF0ZSBxdWVzdGlvbi4gQWRkaW5nIHNlbWFudGljcyB0byBl eGlzdGluZyBpZGVudGlmaWVycyB0ZW5kcyB0byBsZWFkIHRvIGxvdHMgb2YgdW5mb3Jlc2VlbiBj b21wbGljYXRpb25zLCBhbmQgZGVwZW5kIG9uIGFzc3VtcHRpb25zIHRoYXQgZG9u4oCZdCBhbHdh eXMgaG9sZCB0cnVlLiBJbiB0aGlzIGNhc2UsIHRoZXJlIHNlZW1zIHRvIGJlIGFuIGFzc3VtcHRp b24gdGhhdCB0aGVyZSBpcyBhIDE6MSByZWxhdGlvbnNoaXAgYmV0d2VlbiBhIFNBTUwgYXNzZXJ0 aW9uIGFuZCBhIHNlc3Npb24uIFRoaXMgaXMgbm90IGFsd2F5cyB0aGUgY2FzZS4NCg0KUmVnYXJk bGVzcywgYSBTQU1MIGFzc2VydGlvbiBJRCBpcyBjbGVhcmx5IGFuIGFwcHJvcHJpYXRlIGlkZW50 aWZpZXIgd2hlbiB0aGUgc3ViamVjdCBpcyBhIFNBTUwgYXNzZXJ0aW9uLiBJIGRvbuKAmXQga25v dyBvZmZoYW5kIGlmIHRoZXJlIGFyZSBhbnkgdXNlIGNhc2VzIGZvciBldmVudHMgcmVsYXRpbmcg dG8gYSBTQU1MIGFzc2VydGlvbiBpdHNlbGYuIEkgY2FuIGNlcnRhaW5seSBzZWUgdXNlIGNhc2Vz IGZvciBldmVudHMgcmVsYXRlZCB0byBKV1RzIChlLmcuLCByZXZvY2F0aW9uIG9mIGEgSldUIGFj Y2VzcyB0b2tlbiksIHdoZXJlIGEg4oCcanRp4oCdIHN1YmplY3QgaWRlbnRpZmllciB0eXBlIHdv dWxkIGJlIGFwcHJvcHJpYXRlLiBJ4oCZbSBpbmNsaW5lZCB0byBhZGQgaXQgdG8gdGhlIGRyYWZ0 LCBpZiBmb3Igbm8gb3RoZXIgcmVhc29uIHRoYW4gdG8gcHJvdmlkZSBhIG5vcm1hdGl2ZSBkZW1v bnN0cmF0aW9uIG9mIGEgc3ViamVjdCBpZGVudGlmaWVyIHRoYXQgd291bGQgYmUgdXNlZCB0byBp ZGVudGlmeSBhIG1vcmUgZXBoZW1lcmFsIHN1YmplY3QuDQoNCuKAkw0KQW5uYWJlbGxlIEJhY2tt YW4gKHNoZS9oZXIpDQpBV1MgSWRlbnRpdHkNCmh0dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRp dHkvDQoNCg0KRnJvbTogSWQtZXZlbnQgPGlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRv OmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBiZWhhbGYgb2YgQXR1bCBUdWxzaGliYWd3 YWxlIDxhdHVsdHVsc2hpPTQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86NDBnb29n bGUuY29tQGRtYXJjLmlldGYub3JnPj4NCkRhdGU6IFdlZG5lc2RheSwgSnVseSAxNSwgMjAyMCBh dCAxMjo0NyBQTQ0KVG86ICJSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSIgPHJpY2hhbm5hPTQw YW1hem9uLmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86NDBhbWF6b24uY29tQGRtYXJjLmlldGYu b3JnPj4NCkNjOiBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlh cm9uZi5pZXRmQGdtYWlsLmNvbT4+LCBCcmlhbiBDYW1wYmVsbCA8YmNhbXBiZWxsQHBpbmdpZGVu dGl0eS5jb208bWFpbHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPj4sIENocmlzIFBoaWxs aXBzIDxDaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPG1haWx0bzpDaHJpcy5QaGlsbGlwc0BjYW5h cmllLmNhPj4sICJpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+IiA8 aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJF OiBbRVhURVJOQUxdIFtJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZQ0KDQoN CkNBVVRJT046IFRoaXMgZW1haWwgb3JpZ2luYXRlZCBmcm9tIG91dHNpZGUgb2YgdGhlIG9yZ2Fu aXphdGlvbi4gRG8gbm90IGNsaWNrIGxpbmtzIG9yIG9wZW4gYXR0YWNobWVudHMgdW5sZXNzIHlv dSBjYW4gY29uZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuDQoN CkhvdyBkbyB3ZSBwcm9wb3NlIHRvIHN1cHBvcnQgdGhlIHR3byBzdWJqZWN0IHR5cGVzIGRlZmlu ZWQgaW4gdGhlIE9BdXRoIEV2ZW50IFR5cGVzPGh0dHBzOi8vb3BlbmlkLm5ldC9zcGVjcy9vYXV0 aC1ldmVudC10eXBlcy0xXzAtSUQxLmh0bWw+IHNwZWMgaGVyZT8NCg0KT24gVHVlLCBKdWwgMTQs IDIwMjAgYXQgNDo1NCBQTSBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSA8cmljaGFubmE9NDBh bWF6b24uY29tQGRtYXJjLmlldGYub3JnPG1haWx0bzo0MGFtYXpvbi5jb21AZG1hcmMuaWV0Zi5v cmc+PiB3cm90ZToNClRoZSBSSVNDIFByb2ZpbGXigJlzIOKAnElEIFRva2VuIENsYWltc+KAnSB0 eXBlIGRvZXMgbm90IGlkZW50aWZ5IGEgc3ViamVjdCB0aGF0IGlzIGFuIElEIFRva2VuLCBpdCBp ZGVudGlmaWVzIGEgc3ViamVjdCB0aGF0IHdhcyB0aGUgc3ViamVjdCBvZiBhbiBJRCBUb2tlbi4g SXQgd2FzIGludGVuZGVkIGZvciBjYXNlcyB3aGVyZSB0aGUgT1Agc2VudCBtdWx0aXBsZSBpZGVu dGlmaWVycyBvZiBkaWZmZXJlbnQgdHlwZXMgaW4gdGhlIElEIFRva2VuIChlLmcuLCBpc3Mrc3Vi IGFuZCBlbWFpbCksIGFuZCBkb2VzIG5vdCBrbm93IHdoaWNoIG9mIHRoZW0gdGhlIGNsaWVudCB3 aWxsIHJlY29nbml6ZSAoeWVzLCB0aGUgc2hvdWxkIHVzZSBpc3Mrc3ViOyBubywgdGhleSBkb2Vz buKAmXQgYWx3YXlzIGRvIHNvKS4gVGhpcyB0eXBlIHdhcyByZXBsYWNlZCBpbiBkcmFmdC1pZXRm LXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmllcnMtMDMgd2l0aCB0aGUg4oCcYWxpYXNlc+KAnSB0 eXBlLCB3aGljaCBpcyBhIGdlbmVyYWwgc29sdXRpb24gdG8gdGhpcyBwcm9ibGVtIHRoYXQgaXMg bm90IGRlZmluZWQgaW4gdGVybXMgb2Ygb25lIHBhcnRpY3VsYXIgdXNlIGNhc2UgKGkuZS4sIElE IFRva2VucykuDQoNClRoZSBPSURGIFNTRSB3b3JraW5nIGdyb3Vw4oCZcyBPQXV0aCBFdmVudCBU eXBlcyBkcmFmdDxodHRwczovL29wZW5pZC5uZXQvc3BlY3Mvb2F1dGgtZXZlbnQtdHlwZXMtMV8w LUlEMS5odG1sI3JmYy5zZWN0aW9uLjIuMT4gZGVmaW5lcyBhIOKAnG9hdXRoX3Rva2Vu4oCdIHR5 cGUgdGhhdCBpZGVudGlmaWVzIGEgc3ViamVjdCB0aGF0IGlzIGFuIE9BdXRoIDIuMCB0b2tlbiwg YW5kIGRvZXMgc28gdXNpbmcgZWl0aGVyIHRoZSBmdWxsIG9yIHBhcnRpYWwgcGxhaW4gdGV4dCB2 YWx1ZSBvZiB0aGUgdG9rZW4sIG9yIGEgaGFzaCBvZiB0aGUgdG9rZW4uLi4NCg0KSXQgaXMgcGVy ZmVjdGx5IGZpbmUgZm9yIGEgdG9rZW4gdG8gYmUgdGhlIHN1YmplY3Qgb2YgYSBzZWN1cml0eSBl dmVudC4gODQxNzxodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9yZmMvcmZjODQxNy5odG1sI3Nl Y3Rpb24tMi4yPiBhY3R1YWxseSBpbmNsdWRlcyB0aGUgZm9sbG93aW5nIGFzIGFuIGV4YW1wbGUg b2YgYSBwb3NzaWJsZSB2YWx1ZSBmb3IgdGhlIOKAnHN1YuKAnSBjbGFpbToNCiogIGEgdG9rZW4g aWRlbnRpZmllciAoZS5nLiAianRpIikgZm9yIGEgcmV2b2tlZCB0b2tlbi4NCg0K4oCTDQpBbm5h YmVsbGUgQmFja21hbiAoc2hlL2hlcikNCkFXUyBJZGVudGl0eQ0KaHR0cHM6Ly9hd3MuYW1hem9u LmNvbS9pZGVudGl0eS8NCg0KDQpGcm9tOiBJZC1ldmVudCA8aWQtZXZlbnQtYm91bmNlc0BpZXRm Lm9yZzxtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiBBdHVs IFR1bHNoaWJhZ3dhbGUgPGF0dWx0dWxzaGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPG1h aWx0bzo0MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc+Pg0KRGF0ZTogVHVlc2RheSwgSnVseSAx NCwgMjAyMCBhdCA0OjMyIFBNDQpUbzogQnJpYW4gQ2FtcGJlbGwgPGJjYW1wYmVsbEBwaW5naWRl bnRpdHkuY29tPG1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbT4+DQpDYzogWWFyb24g U2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5j b20+PiwgQ2hyaXMgUGhpbGxpcHMgPENocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E8bWFpbHRvOkNo cmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E+PiwgImlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1l dmVudEBpZXRmLm9yZz4iIDxpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5v cmc+Pg0KU3ViamVjdDogUkU6IFtFWFRFUk5BTF0gW0lkLWV2ZW50XSBTQU1MIHN1YmplY3QgaWRl bnRpZmllciB0eXBlDQoNCg0KQ0FVVElPTjogVGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZyb20gb3V0 c2lkZSBvZiB0aGUgb3JnYW5pemF0aW9uLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Igb3BlbiBhdHRh Y2htZW50cyB1bmxlc3MgeW91IGNhbiBjb25maXJtIHRoZSBzZW5kZXIgYW5kIGtub3cgdGhlIGNv bnRlbnQgaXMgc2FmZS4NCg0KSU1PIGlmIHdlIGhhdmUgYSBjb21tb24gZW5vdWdoIHVzZS1jYXNl IHRoYXQgcmVxdWlyZXMgYSBzcGVjaWZpYyB0eXBlIHRvIGJlIGRlZmluZWQsIHRoZW4gd2Ugc2hv dWxkIGRlZmluZSB0aGF0IHR5cGUgaW4gdGhlIHNwZWMgcmF0aGVyIHRoYW4gcmVseSBvbiBhbiBp bnRlcnByZXRhdGlvbiBvZiB0aGUgImlzcy1zdWIiIHR5cGUsIHNpbmNlIHRoYXQgaW50ZXJwcmV0 YXRpb24gY2FuIGNhdXNlIGluY29tcGF0aWJpbGl0aWVzLg0KDQpJbiB0aGlzIHNwZWNpZmljIGNh c2UgaG93ZXZlciBJIGZlZWwgdGhhdCB0aGUgdXNlIGNhc2VzIG91dGxpbmVkIGluIG15IHByZXZp b3VzIGVtYWlsIGNhbiBiZSBhY2hpZXZlZCAod2l0aCBsaW1pdGF0aW9ucykgdXNpbmcgdGhlIGR1 cmFibGUgc3ViamVjdCB0eXBlcyBzdWNoIGFzIGVtYWlsLiBJJ2QgbGlrZSB0aGUgbWVtYmVycyBv ZiB0aGUgU1NFIHdvcmtpbmcgZ3JvdXAgdG8gY2hpbWUgaW4gKHNpbmNlIHRoYXQgaXMgd2hlcmUg dGhpcyBnb3QgYWRkZWQpLCBvciB3ZSBjYW4gZHJvcCB0aGUgU0FNTCBzdWJqZWN0IGlkZW50aWZp ZXIgdHlwZS4NCg0KT24gVHVlLCBKdWwgMTQsIDIwMjAgYXQgNDowOSBQTSBCcmlhbiBDYW1wYmVs bCA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb208bWFpbHRvOmJjYW1wYmVsbEBwaW5naWRlbnRp dHkuY29tPj4gd3JvdGU6DQorIDEgdG8gd2hhdCBZYXJvbiBpcyBzYXlpbmcgaGVyZS4gSSdkIGlu Y2x1ZGUgYWxzbyB0aGUgImlzcy1zdWIiIHN1YmplY3QgaWRlbnRpZmllciB0eXBlIGh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmll cnMtMDUjc2VjdGlvbi0zLjQgYXMgYWxyZWFkeSBoYXZpbmcgc2VtYW50aWNzIGNvdmVyaW5nIHdo YXQncyBkZXNjcmliZWQgaW4gdGhlIElEIFRva2VuIENsYWltcyBTdWJqZWN0IElkZW50aWZpZXIg VHlwZSBpbiB0aGUgUklTQyBkb2N1bWVudCByZWZlcmVuY2VkLiBBbmQgYWxsIHRob3NlIHRoaW5n cyByZXByZXNlbnQgYSBkdXJhYmxlIHN1YmplY3QgcmF0aGVyIHRoYW4gYSBzZXNzaW9uLCB3aGlj aCBzdHJpa2VzIG1lIGFzIGFwcHJvcHJpYXRlIGZvciBhIGRvY3VtZW50IHRoYXQgZGVzY3JpYmVz IGlkZW50aWZ5aW5nIHN1YmplY3RzLiBBIFNBTUwgYXNzZXJ0aW9uIElELCBob3dldmVyLCB3aGlj aCBpcyBhbiBpZGVudGlmaWVyIG9mIGFuIFhNTCBkb2N1bWVudCB0aGF0IGlzIG9ubHkgaW5kaXJl Y3RseSByZWxhdGVkIHRvIGEgc2Vzc2lvbiBieSBhbiBhc3NvY2lhdGlvbiB0aGF0IGxpa2VseSBp c24ndCBtYWludGFpbmVkLCBkb2VzIG5vdCBzZWVtIGFwcHJvcHJpYXRlIGFzIGEgInN1YmplY3Qg aWRlbnRpZmllciIuDQoNCk9uIFR1ZSwgSnVsIDE0LCAyMDIwIGF0IDQ6MDEgUE0gWWFyb24gU2hl ZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20+ PiB3cm90ZToNCkhpIEF0dWwsDQoNClRoZSBJRCBUb2tlbiBzdWJqZWN0IHR5cGUsIGFzIGRlc2Ny aWJlZCBpbiB0aGUgZG9jdW1lbnQgeW91IGFyZSByZWZlcmVuY2luZywgZG9lcyBub3QgYWRkIGFu eSBzZW1hbnRpY3MsIGNvbXBhcmVkIHRvIGEg4oCccGhvbmUgbnVtYmVy4oCdIG9yIOKAnGVtYWls 4oCdIHN1YmplY3QgdHlwZS4gU28gSSBkb27igJl0IHNlZSB0aGUgdmFsdWUgaW4gYWRkaW5nIGl0 Lg0KDQpJbiBhZGRpdGlvbiwgaXQgZG9lcyBub3QsIGFjdHVhbGx5LCBkZXNjcmliZSBhbiBJRCBU b2tlbi4gSW4gZmFjdCB0aGUgdGV4dCBpcyB2ZXJ5IGNsZWFyIHRoYXQgaXQgZGVzY3JpYmVzIGEg 4oCcc3ViamVjdOKAnSAoYSBkdXJhYmxlIGVudGl0eSkgcmF0aGVyIHRoYW4gYSBzZXNzaW9uLCBh bmQgZG9lcyBpdCBieSBjaXRpbmcgdmFyaW91cyBjbGFpbXMgaW5jbHVkZWQgaW4gdGhlIElEIHRv a2VuLiBTbyBhcyBhIHN1YmplY3QgaWRlbnRpZmllciB0eXBlLCBpdCBpcyBub3QgYXQgYWxsIGVx dWl2YWxlbnQgdG8gYSBTQU1MIGFzc2VydGlvbi4NCg0KQXMgdG8gdGhlIFNBTUwgQXNzZXJ0aW9u IHN1YmplY3QgdHlwZSwgSSB0aGluayB0aGVzZSB1c2UgY2FzZXMgY291bGQgYmUgYWRkcmVzc2Vk IGJ5IGFkZGluZyBpbmZvcm1hdGlvbiB0byB0aGUgZXZlbnQuDQoNClRoYW5rcywNCiAgICAgICAg ICAgICAgICBZYXJvbg0KDQpGcm9tOiBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0dWxzaGlAZ29v Z2xlLmNvbTxtYWlsdG86YXR1bHR1bHNoaUBnb29nbGUuY29tPj4NCkRhdGU6IFR1ZXNkYXksIEp1 bHkgMTQsIDIwMjAgYXQgMjM6MjYNClRvOiBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFp bC5jb208bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbT4+DQpDYzogQ2hyaXMgUGhpbGxpcHMg PENocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E8bWFpbHRvOkNocmlzLlBoaWxsaXBzQGNhbmFyaWUu Y2E+PiwgImlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4iIDxpZC1l dmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtJ ZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZQ0KDQpIaSBZYXJvbiwNClRoZXJl IGFyZSBhIGZldyBTU0UgdXNlIGNhc2VzIHdoZXJlIHRoZSBldmVudHMgYXJlIGFib3V0IGEgc3Bl Y2lmaWMgc2luZ2xlIHNpZ24tb24gc2Vzc2lvbi4gWW91J3JlIHJpZ2h0IHRoYXQgdGhpcyBzaG91 bGQgbm90IGJlIGxpbWl0ZWQgdG8gU0FNTC4gVGhlIFJJU0MgcHJvZmlsZSBvZiBTRVRzIChiYXNl ZCBvbiB3aGljaCB3ZSBhcmUgZG9pbmcgdGhlIFNTRSB3b3JrKSBoYWQgdGhlIElEIFRva2VuIHN1 YmplY3QgaWRlbnRpZmllciB0eXBlLCB3aGljaCBmb3Igc29tZSByZWFzb24gaXMgbWlzc2luZyBp biB0aGlzIHNwZWMgKEkgZGlkIG5vdCByZWFsaXplIHVudGlsIG5vdykuIFRoZSBzcGVjaWZpYyBl dmVudHMgdGhhdCBuZWVkIHRvIHJlZmVyIHRvIHNlc3Npb25zIGFyZToNCuKAoiAgICAgICAgIElk ZW50aXR5IHByb3ZpZGVyIGNvbnRleHQgY2hhbmdlOiBUaGUgY29uZGl0aW9ucyB1bmRlciB3aGlj aCBhIFNBTUwgYXNzZXJ0aW9uIG9yIE9JREMgdG9rZW4gd2FzIGdlbmVyYXRlZCBhcmUgbm8gbG9u Z2VyIHZhbGlkLiBUaGlzIGNhbiBiZSBkdWUgdG8gdmFyaW91cyB0aGluZ3MsIGluY2x1ZGluZyBh IHBhc3N3b3JkIGNoYW5nZS4NCuKAoiAgICAgICAgIFNlc3Npb24gcHJvcGVydHkgY2hhbmdlOiBB IHNlc3Npb24gaGFzIGJlZW4gZGV0ZXJtaW5lZCB0byBoYXZlIGJlZW4gY29tcHJvbWlzZWQNCuKA oiAgICAgICAgIFJldm9jYXRpb246IFRoZSBpc3N1ZXIgb2YgdGhlIHNpbmdsZSBzaWduLW9uIFNB TUwgYXNzZXJ0aW9uIG9yIElEIFRva2VuIG5lZWRzIHRvIGJlIHJldm9rZQ0KSSBjYW4gYWxzbyBh ZGQgdGhlIElEIFRva2VuIGNsYWltIGZyb20gdGhlIFJJU0MgcHJvZmlsZTxodHRwczovL2JpdGJ1 Y2tldC5vcmcvb3BlbmlkL3Jpc2Mvc3JjL21hc3Rlci9vcGVuaWQtcmlzYy1wcm9maWxlLTFfMC50 eHQjbGluZXMtMjUwPiB0byBteSBwdWxsIHJlcXVlc3QuDQoNClRoYW5rcywNCkF0dWwNCg0KDQpP biBUdWUsIEp1bCAxNCwgMjAyMCBhdCAxMjozMiBQTSBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0 ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9uZi4uLmlldGZAZ21haWwuY29tPj4gd3JvdGU6DQpJIG5l ZWQgYSBsb3QgbW9yZSBjb250ZXh0IGhlcmUuIFNvIGZhciwgc3ViamVjdCBJRHMgaGF2ZSBkZW5v dGVkIGR1cmFibGUgZW50aXRpZXMsIHN1Y2ggYXMgZW1haWwgYWRkcmVzc2VzLCBwaG9uZSBudW1i ZXJzLCBhY2NvdW50LiBUaGlzIGlzIGFkZGluZyBhIHN1YmplY3QgSUQgdGhhdCBkZW5vdGVzIGFu IGVwaGVtZXJhbCBlbnRpdHksIGJhc2ljYWxseSBzaW1pbGFyIHRvIGEgc2Vzc2lvbiBJRC4gVGhp cyBsb29rcyB3ZWlyZCBmcm9tIGFuIGFyY2hpdGVjdHVyYWwgcG9pbnQgb2YgdmlldywgYW5kIGFs c28gYmVncyB0aGUgcXVlc3Rpb24sIHdoeSBzcGVjaWZpY2FsbHkgU0FNTCBhbmQgbm90IG90aGVy IHNlc3Npb24gdHlwZXMuDQoNClRoYW5rcywNCiAgICAgICAgICAgICAgICBZYXJvbg0KDQpGcm9t OiBJZC1ldmVudCA8aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnQtYm91 bmNlc0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0dWxz aGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPG1haWx0bzo0MGdvb2dsZS5jb21AZG1hcmMu aWV0Zi4ub3JnPj4NCkRhdGU6IFR1ZXNkYXksIEp1bHkgMTQsIDIwMjAgYXQgMDA6MTQNClRvOiBD aHJpcyBQaGlsbGlwcyA8Q2hyaXMuUGhpbGxpcHNAY2FuYXJpZS5jYTxtYWlsdG86Q2hyaXMuUGhp bGxpcHNAY2FuYXJpZS5jYT4+DQpDYzogImlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVu dEBpZXRmLm9yZz4iIDxpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+ Pg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50aWZpZXIgdHlwZQ0K DQpKdXN0IGNsYXJpZnlpbmcgdGhlIHByb3Bvc2FsIGFzIGl0IHN0YW5kcyB0b2RheSAoYmVmb3Jl IGluY29ycG9yYXRpbmcgQ2hyaXMncyBpbnB1dCk6DQpUaGUgZm9sbG93aW5nIHNlY3Rpb24gc2hv dWxkIGJlIGFkZGVkIGluIHRoZSAiU3ViamVjdCBJZGVudGlmaWVyIFR5cGVzIiBzZWN0aW9uOg0K NC45LiAgU0FNTCBTdWJqZWN0IElkZW50aWZpZXIgVHlwZQ0KDQogICBUaGUgU0FNTCBbU0FNTC5S RUZdIFN1YmplY3QgSWRlbnRpZmllciBUeXBlIGRlc2NyaWJlcyBhIHN1YmplY3QgYnkNCiAgIHRo ZSBhc3NlcnRpb24gaWRlbnRpZmllciBpbiB0aGUgU0FNTCBhc3NlcnRpb24gdGhhdCB3YXMgdXNl ZCB0bw0KICAgY29udmV5IHRoZSBzdWJqZWN0J3MgaW5mb3JtYXRpb24gdG8gdGhlIFJlY2VpdmVy LiAgU3ViamVjdA0KICAgSWRlbnRpZmllcnMgb2YgdGhpcyB0eXBlIE1VU1QgY29udGFpbiBhbiBg IGFzc2VydGlvbl9pZCJjbGFpbS4gIFRoZQ0KICAgdmFsdWUgb2YgdGhpcyBjbGFpbSBpcyBhIHN0 cmluZyB0aGF0IGlzIGVxdWFsIHRvIHRoZSBBc3NlcnRpb24NCiAgIElkZW50aWZpZXIgaW4gdGhl IFNBTUwgYXNzZXJ0aW9uLiAgVGhlIFNBTUwgU3ViamVjdCBJZGVudGlmaWVyIFR5cGUNCiAgIGlz IGlkZW50aWZpZWQgYnkgdGhlIG5hbWUgInNhbWxgLg0KDQogICBCZWxvdyBpcyBhIG5vbi1ub3Jt YXRpdmUgZXhhbXBsZSBTdWJqZWN0IElkZW50aWZpZXIgZm9yIHRoZSBTQU1MDQogICBTdWJqZWN0 IElkZW50aWZpZXIgVHlwZToNCg0KICAgew0KICAgICAic3ViamVjdF90eXBlIjogInNhbWwiLA0K ICAgICAiYXNzZXJ0aW9uX2lkIjogIl9mNTUxZDg4OTYzYWI0ZTNkZWNiN2NmZThmNGRjYzNmNSIs DQogICB9DQoNCiAgICAgRmlndXJlIDg6IEV4YW1wbGU6IFN1YmplY3QgSWRlbnRpZmllciBmb3Ig U0FNTCBTdWJqZWN0IElkZW50aWZpZXINCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgVHlwZS4NCg0KDQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCAxOjIyIFBNIEF0dWwgVHVsc2hp YmFnd2FsZSA8YXR1bHR1bHNoaUBnb29nbGUuY29tPG1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5j b20+PiB3cm90ZToNCkhpIENocmlzLA0KSSB3YXMgcHJvcG9zaW5nIHVzaW5nIHRoZSAiYXNzZXJ0 aW9uIGlkIiAoU0FNTCBDb3JlPGh0dHA6Ly9kb2NzLm9hc2lzLW9wZW4ub3JnL3NlY3VyaXR5L3Nh bWwvdjIuMC9zYW1sLWNvcmUtMi4wLW9zLnBkZj4gc3BlYywgbGluZSA1NTMpIGluIHRoZSBwcm9w b3NhbCwgbm90IHRoZSAic3ViamVjdC1pZCIgYXMgZGVmaW5lZCBpbiBTQU1MIChzcGVjIHNlY3Rp b24gMy4zKS4gVGhlIG1haW4gcmVhc29uIHdhcyB0byBiZSBhYmxlIHRvIHJlZmVyIHRvIGEgc2Vz c2lvbiB0aGF0IHdhcyBlc3RhYmxpc2hlZCB1c2luZyBhIHNwZWNpZmljIGFzc2VydGlvbi4gSWYg aXQncyB1c2VmdWwsIHdlIGNvdWxkIHBlcmhhcHMgZXh0ZW5kIHRoZSBTQU1MIHN1YmplY3QgaWRl bnRpZmllciB0eXBlIGluIHRoaXMgc3BlYyB0byBpbmNsdWRlIGVpdGhlciB0aGUgYXNzZXJ0aW9u X2lkIG9yIHRoZSBzdWJqZWN0X2lkIGNsYWltLg0KDQpUaGFua3MsDQpBdHVsDQoNCg0KT24gTW9u LCBKdWwgMTMsIDIwMjAgYXQgMTA6MzAgQU0gQ2hyaXMgUGhpbGxpcHMgPENocmlzLlBoaWxsaXBz QGNhbmFyaWUuY2E8bWFpbHRvOkNocmlzLi4uUGhpbGxpcHNAY2FuYXJpZS5jYT4+IHdyb3RlOg0K SGkuDQpRdWlldCBsdXJrZXIgb2JzZXJ2aW5nLi4NClRoYW5rcyBmb3IgY29uc2lkZXIgdGhlIFNB TUwgZWxlbWVudHMuLg0KDQpBdHVsLCBhcmUgeW91IHJlZmVycmluZyB0byB0aGUgYWN0dWFsIHNl c3Npb24gaWRlbnRpZmllciB0aGF0IHNvbWVvbmUgbWF5IGhhdmUgd2hlcmUgdGhlIFN1YmplY3Qt SWQgd2FzIGV4Y2hhbmdlZCBPUiB0aGUgYWN0dWFsIFN1YmplY3QtaWQgaXRzZWxmIGluIHlvdXIg cmVmZXJlbmNlIGluIHRoZSBwcm9wb3NhbCB3aXRoIHRoZSBnaXRodWIgbGluaz8NCg0KSeKAmW0g dHJ5aW5nIHRvIHNxdWFyZSB3aGF0IEkgc2VlIG9uIHRoZSBnaXQgZGVsdGEgb24gbGluZSAyOTQt Mjk2IGluIGh0dHBzOi8vZ2l0aHViLi4uY29tL3JpY2hhbm5hL3NlY2V2ZW50L3B1bGwvMS9jb21t aXRzL2IyMGI2NjkyZWI1MDYyODkyNzQ3NmNhNzhmOWJlMDc3YWNlODg5OTQ8aHR0cHM6Ly9naXRo dWIuY29tL3JpY2hhbm5hL3NlY2V2ZW50L3B1bGwvMS9jb21taXRzL2IyMGI2NjkyZWI1MDYyODky NzQ3NmNhNzhmOWJlMDc3YWNlODg5OTQ+DQoNCg0KQW5kIGEgU3ViamVjdC1pZCBhcyBzaG93biBp biB0aGUgZXhhbXBsZSBpbiAzLjMuMyBoZXJlOiBodHRwczovL2RvY3Mub2FzaXMtb3Blbi5vcmcv c2VjdXJpdHkvc2FtbC1zdWJqZWN0LWlkLWF0dHIvdjEuMC9jczAxL3NhbWwtc3ViamVjdC1pZC1h dHRyLXYxLjAtY3MwMS5odG1sI19Ub2M1MzYwOTcyMjk8aHR0cHM6Ly9kb2NzLm9hc2lzLW9wZW4u b3JnL3NlY3VyaXR5L3NhbWwtc3ViamVjdC1pZC1hdHRyL3YxLjAvY3MwMS9zYW1sLXN1YmplY3Qt aWQtYXR0ci12MS4uMC1jczAxLi5odG1sI19Ub2M1MzYwOTcyMjk+DQoNCldoYXQgeW91IG9mZmVy ZWQgaW4gdGhlIGV4YW1wbGUgaXMgbm90IGEgU3ViamVjdC1pZCAgcGVyIHRoZSBPQVNJUyBTQU1M IHNwZWMgYXMgd3JpdHRlbiBpbiBzZWN0aW9uIDMuMy4xDQoNCkFtIEkgbWlzLWludGVycHJldGlu ZyBzb21ldGhpbmc/DQoNCkMNCg0KDQpGcm9tOiBJZC1ldmVudCA8aWQtZXZlbnQtYm91bmNlc0Bp ZXRmLm9yZzxtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiBB dHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0dWxzaGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3Jn PG1haWx0bzo0MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc+Pg0KRGF0ZTogTW9uZGF5LCBKdWx5 IDEzLCAyMDIwIGF0IDEyOjE3IFBNDQpUbzogImlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1l dmVudEBpZXRmLm9yZz4iIDxpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5v cmc+Pg0KU3ViamVjdDogW0lkLWV2ZW50XSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlDQoN CkhpIGFsbCwNCkJhc2VkIG9uIHRoZSBkaXNjdXNzaW9ucyBpbiB0aGUgU1NFIHdvcmtpbmcgZ3Jv dXAgd2l0aGluIHRoZSBPcGVuSUQgRm91bmRhdGlvbiwgd2Ugd291bGQgbGlrZSB0byBwcm9wb3Nl IHRoYXQgdGhlIHN1YmplY3QgaWRlbnRpZmllciBzcGVjaWZpY2F0aW9uIGluY2x1ZGUgYSBTQU1M IHN1YmplY3QgaWRlbnRpZmllciB0eXBlLiBUaGlzIGlzIHNvIHRoYXQgc2Vzc2lvbnMgZXN0YWJs aXNoZWQgYWNyb3NzIHBlZXJzIHVzaW5nIFNBTUwgbWF5IGJlIGlkZW50aWZpZWQgaW4gZXZlbnRz IHRoYXQgaW5jbHVkZSB0aGUgc3ViamVjdCBpZGVudGlmaWVyLg0KDQogQSBTQU1MIHN1YmplY3Qg aWRlbnRpZmllciBoYXMgb25seSBvbmUgY2xhaW0gd2l0aGluIGl0LCB0aGUgYXNzZXJ0aW9uIGlk IG9mIHRoZSBTQU1MIGFzc2VydGlvbiB1c2VkIHRvIGVzdGFibGlzaCB0aGUgc2luZ2xlIHNpZ24t b24gc2Vzc2lvbi4NCg0KVGhpcyBjaGFuZ2UgaXMgYWxzbyBpbmNsdWRlZCBpbiBteSBwcm9wb3Nh bCBoZXJlPGh0dHBzOi8vZ2l0aHViLmNvbS9yaWNoYW5uYS9zZWNldmVudC9wdWxsLzE+Lg0KDQpU aGFua3MsDQpBdHVsDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJ ZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v aWQtZXZlbnQNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f IElkLWV2ZW50IG1haWxpbmcgbGlzdCBJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRA aWV0Zi5vcmc+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQN Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVu dCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9y Zz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0KQ09O RklERU5USUFMSVRZIE5PVElDRTogVGhpcyBlbWFpbCBtYXkgY29udGFpbiBjb25maWRlbnRpYWwg YW5kIHByaXZpbGVnZWQgbWF0ZXJpYWwgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50ZW5kZWQg cmVjaXBpZW50KHMpLiBBbnkgcmV2aWV3LCB1c2UsIGRpc3RyaWJ1dGlvbiBvciBkaXNjbG9zdXJl IGJ5IG90aGVycyBpcyBzdHJpY3RseSBwcm9oaWJpdGVkLi4gIElmIHlvdSBoYXZlIHJlY2VpdmVk IHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGlt bWVkaWF0ZWx5IGJ5IGUtbWFpbCBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlIGFuZCBhbnkgZmlsZSBh dHRhY2htZW50cyBmcm9tIHlvdXIgY29tcHV0ZXIuIFRoYW5rIHlvdS4NCg0KQ09ORklERU5USUFM SVRZIE5PVElDRTogVGhpcyBlbWFpbCBtYXkgY29udGFpbiBjb25maWRlbnRpYWwgYW5kIHByaXZp bGVnZWQgbWF0ZXJpYWwgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50 KHMpLiBBbnkgcmV2aWV3LCB1c2UsIGRpc3RyaWJ1dGlvbiBvciBkaXNjbG9zdXJlIGJ5IG90aGVy cyBpcyBzdHJpY3RseSBwcm9oaWJpdGVkLi4gIElmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgY29t bXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5 IGJ5IGUtbWFpbCBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlIGFuZCBhbnkgZmlsZSBhdHRhY2htZW50 cyBmcm9tIHlvdXIgY29tcHV0ZXIuIFRoYW5rIHlvdS4NCg== --_000_CH2PR00MB0679C47908D1EA76D7B31164F57E0CH2PR00MB0679namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTotYXBwbGUtc3lzdGVtO30NCi8qIFN0eWxl IERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFs DQoJe21hcmdpbjowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0K c3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hw RGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4w aW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjEN Cgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDAN Cgl7bXNvLWxpc3QtaWQ6MzgxNDQ3ODU2Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczo2MzM3NjY3 MzQ7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47 fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMg djpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lm IGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFw IHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlm XS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJw bGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5UaGFua3MgZm9yIHRoaXMgYW5hbHlzaXMsIEJyaWFu LiZuYnNwOyBJIGJlbGlldmUgdGhhdCBpdCBpcyBzcG90IG9uITxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRp bmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+ IElkLWV2ZW50ICZsdDtpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnJmd0OyA8Yj5PbiBCZWhhbGYg T2YNCjwvYj5CcmlhbiBDYW1wYmVsbDxicj4NCjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXksIEp1bHkg MTUsIDIwMjAgNDowMyBQTTxicj4NCjxiPlRvOjwvYj4gUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVs bGUgJmx0O3JpY2hhbm5hQGFtYXpvbi5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBBdHVsIFR1bHNo aWJhZ3dhbGUgJmx0O2F0dWx0dWxzaGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnJmd0Ozsg WWFyb24gU2hlZmZlciAmbHQ7eWFyb25mLmlldGZAZ21haWwuY29tJmd0OzsgQ2hyaXMgUGhpbGxp cHMgJmx0O0NocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2EmZ3Q7OyBpZC1ldmVudEBpZXRmLm9yZzsg UmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgJmx0O3JpY2hhbm5hPTQwYW1hem9uLmNvbUBkbWFy Yy5pZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gU0FNTCBz dWJqZWN0IGlkZW50aWZpZXIgdHlwZTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+U3RlcHBpbmcgYmFjayBhIGxpdHRsZSwgSSdkIHZlbnR1cmUgdGhhdCB0aGUg bm90aW9uIG9mIGEg4oCcZHVyYWJsZSBzdWJqZWN04oCdIGNhbWUgZnJvbSB0aGUgZmFjdCB0aGF0 IGFsbCB0aGUgc3ViamVjdCBpZGVudGlmaWVyIHR5cGVzIGluIHRoZSBkcmFmdC1pZXRmLXNlY2V2 ZW50LXN1YmplY3QtaWRlbnRpZmllcnMgZHJhZnQgZG8gaWRlbnRpZnkgcmVsYXRpdmVseSBtb3Jl IHBlcm1hbmVudCBzdWJqZWN0cy4gVGhpcw0KIG5ldyB0eXBlIGZvciBhIHNlc3Npb24gZXN0YWJs aXNoZWQgYnkgYSBTQU1MIGFzc2VydGlvbiBJRCB3YXMgcHJvcG9zZWQgKG5lYXJseSAxMSBtb250 aHMgYWZ0ZXIgd2hhdCB3YXMgc3VwcG9zZWQgdG8gYmUgV0cgbGFzdCBjYWxsKSBhbmQgWWFyb24g bm90ZWQgdGhhdCBpdCB3YXMgZnVuZGFtZW50YWxseSBwcmV0dHkgZGlmZmVyZW50IHRoYW4gd2hh dCdzIGluIHRoZSBkcmFmdCBub3cuIEFuZCBoZSBhbHNvIGFza2VkIHRoZSB2ZXJ5IHJlYXNvbmFi bGUNCiBxdWVzdGlvbiBvZiB3aHkgdGhpcyBzcGVjaWZpY2FsbHkgZm9yIFNBTUwgYW5kIG5vdCBv dGhlciBzZXNzaW9uIHR5cGVzLiBUbyB3aGljaCBBdHVsIG1lbnRpb25lZCBhbmQgcHJvcG9zZWQg YWRkaW5nIHRoZSBSSVNDIElEIFRva2VuIHN1YmplY3QgaWRlbnRpZmllciB0eXBlIHNlZW1pbmds eSBzdWdnZXN0aW5nIHRoYXQgaXQgd2FzIHNpbWlsYXIgdG8gdGhlIFNBTUwgdHlwZS4gVGhhdCwg SSB0aGluaywgY29uZnVzZWQgdGhlIGRpc2N1c3Npb24NCiBiZWNhdXNlIHRoZSBSSVNDIElEIFRv a2VuIHN1YmplY3QgaWRlbnRpZmllciB0eXBlIGlzIG5vdCBhdCBhbGwgbGlrZSB0aGUgU0FNTCB0 eXBlLiBBbmQgYXR0ZW1wdHMgdG8gcG9pbnQgdGhhdCBvdXQgYnkgWWFyb24gYW5kIG15c2VsZiB3 aGlsZSBub3QgcmVhbGl6aW5nIHRoYXQgaXQgd2FzIGEgcHJlY3Vyc29yIHRvIHRoZSBhbGlhcyB0 eXBlIGZ1cnRoZXIgY29uZnVzZWQgdGhlIGRpc2N1c3Npb24uIEkgYXBvbG9naXplIGZvciBteSBw YXJ0IGluDQogcHJvcGFnYXRpbmcgdGhlIGNvbmZ1c2lvbi4gPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgZ2F2ZSBhICsxIHRvIFlhcm9uJ3Mg YmVjYXVzZSBpdCBzZWVtZWQgbGlrZSB0aGUgc2ltcGxlc3Qgd2F5IHRvIHRyeSBhbmQgZGV0ZXIg dGhlIFdHIGZyb20gYWRkaW5nIHRoaXMgdHlwZS4gU2ltcGxlciBhbnl3YXkgdGhhbiB0cnlpbmcg dG8gdHlwZSBvdXQgd2h5IGRlc2NyaWJpbmcgJnF1b3Q7YSBzdWJqZWN0IGJ5IHRoZSBhc3NlcnRp b24gaWRlbnRpZmllciBpbiB0aGUgU0FNTCBhc3NlcnRpb24gdGhhdCB3YXMgdXNlZA0KIHRvIGNv bnZleSB0aGUgc3ViamVjdCdzIGluZm9ybWF0aW9uJnF1b3Q7IGlzIHByb2JsZW1hdGljIG9uIG51 bWVyb3VzIGxldmVscy4gVGhlIGluY29ycmVjdCBhc3N1bXB0aW9uIHRoYXQgdGhlcmUncyBhIDE6 MSByZWxhdGlvbnNoaXAgYmV0d2VlbiBhIFNBTUwgYXNzZXJ0aW9uIGFuZCBhIHNlc3Npb24sIGFz IHlvdSBwb2ludCBvdXQsIGJlaW5nIGp1c3Qgb25lIG9mIHRoZSBwcm9ibGVtcy4NCjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGVyZSBhcmUg YmlnIHRyYWRlb2ZmcyBhbmQgY29uc2lkZXJhdGlvbnMgYXJvdW5kIHdoYXQga2luZCBvZiB0aGlu ZyBpcyBpZGVudGlmaWVkIGFzIHRoZSBzdWJqZWN0LiZuYnNwOyBJIGhvcGUgYW5kIGFzc3VtZSB0 aGUgUklTQy9DQVBFL1NTRSBXRyBpcyBtYW5hZ2luZyBhbGwgdGhhdC4gQnV0IHRoaXMgZHJhZnQt aWV0Zi1zZWNldmVudC1zdWJqZWN0LWlkZW50aWZpZXJzIGlzIG9yIHdpbGwgYmUgZXh0ZW5zaWJs ZSB3aXRoDQogYSByZWdpc3RyeSBzbyBhcyB0byBhbGxvdyBhZGRpdGlvbmFsIHR5cGVzIHRvIGJl IGRlZmluZWQgdGhlcmUsIGlmIHRoZXkgYXJlIG5lZWRlZCBhbmQgYXJlIHNlbnNpYmxlLiBJJ2Qg c3VnZ2VzdCB3ZSBhdm9pZCBhZGRpbmcgbmV3IHR5cGVzIHRvIHRoaXMgZHJhZnQgKG9yIHJlYWxs eSBhbnkgbWFqb3IgY2hhbmdlcykgYXQgdGhpcyBzdGFnZSBzaG9ydCBvZiBhIHJlYWxseSBjb21w ZWxsaW5nIHJlYXNvbiB0byBkbyBzby4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBXZWQsIEp1bCAxNSwgMjAyMCBhdCAzOjI0IFBNIFJp Y2hhcmQgQmFja21hbiwgQW5uYWJlbGxlICZsdDs8YSBocmVmPSJtYWlsdG86cmljaGFubmFAYW1h em9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJpY2hhbm5hQGFtYXpvbi5jb208L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj5JIHRoaW5rIHRoZSB0d28gc3ViamVjdCB0eXBlcyDigJMgdGhl IOKAnG9hdXRoX3Rva2Vu4oCdIHR5cGUgZGVzY3JpYmVkIGluIG15IHByaW9yIGVtYWlsLCBhbmQg YSDigJxvYXV0aF9jbGllbnTigJ0gdHlwZSB0aGF0IGlkZW50aWZpZXMgYSBzdWJqZWN0IGJ5IGl0 cyBPQXV0aCAyLjAgY2xpZW50IElEIOKAkyBhcmUgcmVhc29uYWJsZQ0KIHR5cGVzIHRvIGRlZmlu ZS4gSSBkb27igJl0IHNlZSBhIHBhcnRpY3VsYXIgbmVlZCB0byBtb3ZlIHRoZW0gaW50byB0aGUg YmFzZSBzcGVjIOKAkyB3ZSBkZWZpbmUgYW4gSUFOQSByZWdpc3RyeSBwcmVjaXNlbHkgc28gd2Ug ZG9u4oCZdCBoYXZlIHRvIHRyeSB0byBkZWZpbmUgZXZlcnl0aGluZyB1cCBmcm9udCDigJMgYnV0 IEnigJltIG5vdCBvcHBvc2VkIHRvIHRoZSBpZGVhLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+SeKAmW0gbm90IHN1cmUgd2hlcmUgdGhpcyBub3Rpb24gb2YgYSDigJxkdXJhYmxlIHN1Ympl Y3TigJ0gY2FtZSBmcm9tLiBSaWdodCBpbiB0aGUgaW50cm9kdWN0aW9uLA0KPGEgaHJlZj0iaHR0 cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvcmZjL3JmYzg0MTcuaHRtbCNzZWN0aW9uLTEiIHRhcmdl dD0iX2JsYW5rIj5SRkMgODQxNzwvYT4gc2F5cyB0aGUgc3ViamVjdCBvZiBhIHNlY3VyaXR5IGV2 ZW50IOKAnG1heSBiZSBwZXJtYW5lbnQgKGUuZy4sIGEgdXNlciBhY2NvdW50KSBvciB0ZW1wb3Jh cnkgKGUuZy4sIGFuIEhUVFAgc2Vzc2lvbikgaW4gbmF0dXJlLuKAnSBUaGVyZSBhcmUgcGxlbnR5 IG9mIHVzZSBjYXNlcyBmb3IgZXZlbnRzDQogd2hlcmUgdGhlIHN1YmplY3RzIGFyZSB0ZW1wb3Jh cnkvZXBoZW1lcmFsOjxvOnA+PC9vOnA+PC9wPg0KPG9sIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxs aSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KU2Vzc2lvbiB0 ZXJtaW5hdGlvbjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0 OmwwIGxldmVsMSBsZm8xIj4NCkNoYW5nZXMgaW4gdGhlIHNlY3VyaXR5IHBvc3R1cmUgZm9yIGEg c2Vzc2lvbjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0Omww IGxldmVsMSBsZm8xIj4NClRva2VuIHJldm9jYXRpb248bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQpBc3luY2hyb25vdXMgYXBw cm92YWwgb2YgYSByZXF1ZXN0PG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KQ2hhbmdlcyBpbiB0aGUgc3RhdGUgb2YgYSB0cmFu c2FjdGlvbjxvOnA+PC9vOnA+PC9saT48L29sPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj7igKZl dGMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5XaGV0aGVyIG9yIG5vdCBpdCBtYWtlcyBz ZW5zZSB0byBpZGVudGlmeSBhIHNlc3Npb24gc3ViamVjdCB1c2luZyBhIFNBTUwgYXNzZXJ0aW9u IElEIChvciBhbiBJRCBUb2tlbiDigJxqdGnigJ0gY2xhaW0sIGluIHRoZSBPSURDIHdvcmxkKSBp cyBhIHNlcGFyYXRlIHF1ZXN0aW9uLiBBZGRpbmcgc2VtYW50aWNzIHRvDQogZXhpc3RpbmcgaWRl bnRpZmllcnMgdGVuZHMgdG8gbGVhZCB0byBsb3RzIG9mIHVuZm9yZXNlZW4gY29tcGxpY2F0aW9u cywgYW5kIGRlcGVuZCBvbiBhc3N1bXB0aW9ucyB0aGF0IGRvbuKAmXQgYWx3YXlzIGhvbGQgdHJ1 ZS4gSW4gdGhpcyBjYXNlLCB0aGVyZSBzZWVtcyB0byBiZSBhbiBhc3N1bXB0aW9uIHRoYXQgdGhl cmUgaXMgYSAxOjEgcmVsYXRpb25zaGlwIGJldHdlZW4gYSBTQU1MIGFzc2VydGlvbiBhbmQgYSBz ZXNzaW9uLiBUaGlzIGlzIG5vdA0KIGFsd2F5cyB0aGUgY2FzZS48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPlJlZ2FyZGxlc3MsIGEgU0FNTCBhc3NlcnRpb24gSUQgaXMgY2xlYXJseSBhbiBh cHByb3ByaWF0ZSBpZGVudGlmaWVyIHdoZW4gdGhlIHN1YmplY3QgaXMgYSBTQU1MIGFzc2VydGlv bi4gSSBkb27igJl0IGtub3cgb2ZmaGFuZCBpZiB0aGVyZSBhcmUgYW55IHVzZSBjYXNlcyBmb3Ig ZXZlbnRzIHJlbGF0aW5nIHRvDQogYSBTQU1MIGFzc2VydGlvbiBpdHNlbGYuIEkgY2FuIGNlcnRh aW5seSBzZWUgdXNlIGNhc2VzIGZvciBldmVudHMgcmVsYXRlZCB0byBKV1RzIChlLmcuLCByZXZv Y2F0aW9uIG9mIGEgSldUIGFjY2VzcyB0b2tlbiksIHdoZXJlIGEg4oCcanRp4oCdIHN1YmplY3Qg aWRlbnRpZmllciB0eXBlIHdvdWxkIGJlIGFwcHJvcHJpYXRlLiBJ4oCZbSBpbmNsaW5lZCB0byBh ZGQgaXQgdG8gdGhlIGRyYWZ0LCBpZiBmb3Igbm8gb3RoZXIgcmVhc29uIHRoYW4gdG8gcHJvdmlk ZQ0KIGEgbm9ybWF0aXZlIGRlbW9uc3RyYXRpb24gb2YgYSBzdWJqZWN0IGlkZW50aWZpZXIgdGhh dCB3b3VsZCBiZSB1c2VkIHRvIGlkZW50aWZ5IGEgbW9yZSBlcGhlbWVyYWwgc3ViamVjdC48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+4oCTPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+QW5uYWJlbGxlIEJhY2ttYW4gKHNoZS9oZXIp PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdCI+QVdTIElkZW50aXR5PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48dT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtj b2xvcjojMDU2M0MxIj48YSBocmVmPSJodHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5LyIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vYXdzLmFtYXpvbi5jb20vaWRlbnRpdHkvPC9hPjwvc3Bh bj48L3U+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCB3aW5kb3d0 ZXh0IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW47Ym9yZGVyLWNvbG9yOmN1cnJlbnRj b2xvciBjdXJyZW50Y29sb3IiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41 aW4iPg0KPGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206 IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPklk LWV2ZW50ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBvbiBiZWhhbGYg b2YgQXR1bCBUdWxzaGliYWd3YWxlICZsdDthdHVsdHVsc2hpPTxhIGhyZWY9Im1haWx0bzo0MGdv b2dsZS5jb21AZG1hcmMuaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj40MGdvb2dsZS5jb21AZG1h cmMuaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5XZWRuZXNkYXksIEp1bHkgMTUs IDIwMjAgYXQgMTI6NDcgUE08YnI+DQo8Yj5UbzogPC9iPiZxdW90O1JpY2hhcmQgQmFja21hbiwg QW5uYWJlbGxlJnF1b3Q7ICZsdDtyaWNoYW5uYT08YSBocmVmPSJtYWlsdG86NDBhbWF6b24uY29t QGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+NDBhbWF6b24uY29tQGRtYXJjLmlldGYu b3JnPC9hPiZndDs8YnI+DQo8Yj5DYzogPC9iPllhcm9uIFNoZWZmZXIgJmx0OzxhIGhyZWY9Im1h aWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj55YXJvbmYuaWV0ZkBn bWFpbC5jb208L2E+Jmd0OywgQnJpYW4gQ2FtcGJlbGwgJmx0OzxhIGhyZWY9Im1haWx0bzpiY2Ft cGJlbGxAcGluZ2lkZW50aXR5LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmJjYW1wYmVsbEBwaW5naWRl bnRpdHkuY29tPC9hPiZndDssIENocmlzIFBoaWxsaXBzICZsdDs8YSBocmVmPSJtYWlsdG86Q2hy aXMuUGhpbGxpcHNAY2FuYXJpZS5jYSIgdGFyZ2V0PSJfYmxhbmsiPkNocmlzLlBoaWxsaXBzQGNh bmFyaWUuY2E8L2E+Jmd0OywNCiAmcXVvdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mcXVvdDsgJmx0OzxhIGhy ZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGll dGYub3JnPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UkU6IFtFWFRFUk5BTF0gW0lkLWV2 ZW50XSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0K Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8dGFibGUgY2xhc3M9Ik1zb05v cm1hbFRhYmxlIiBib3JkZXI9IjAiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgd2lk dGg9IjYyMiIgc3R5bGU9IndpZHRoOjQ2Ni41cHQ7bWFyZ2luLWxlZnQ6LjVpbjtib3JkZXItY29s bGFwc2U6Y29sbGFwc2UiPg0KPHRib2R5Pg0KPHRyIHN0eWxlPSJoZWlnaHQ6MTUuMjVwdCI+DQo8 dGQgd2lkdGg9IjYyMiIgdmFsaWduPSJ0b3AiIHN0eWxlPSJ3aWR0aDo0NjYuNXB0O2JvcmRlcjpz b2xpZCAjRUQ3RDMxIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gMGluO2hlaWdodDoxNS4yNXB0 O3BhZGRpbmc6NS4uNHB0Ij4NCjxwPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkZG OTkiPkNBVVRJT048L3NwYW4+PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tn cm91bmQ6I0ZGRkY5OSI+OiBUaGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRo ZSBvcmdhbml6YXRpb24uIERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVu bGVzcw0KIHlvdSBjYW4gY29uZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlz IHNhZmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90 YWJsZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0K Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDouNWluIj4NCkhvdyBkbyB3ZSBwcm9wb3NlIHRvIHN1cHBvcnQgdGhlIHR3 byBzdWJqZWN0IHR5cGVzIGRlZmluZWQgaW4gdGhlIDxhIGhyZWY9Imh0dHBzOi8vb3BlbmlkLm5l dC9zcGVjcy9vYXV0aC1ldmVudC10eXBlcy0xXzAtSUQxLmh0bWwiIHRhcmdldD0iX2JsYW5rIj4N Ck9BdXRoIEV2ZW50IFR5cGVzPC9hPiBzcGVjIGhlcmU/PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 LjVpbiI+DQpPbiBUdWUsIEp1bCAxNCwgMjAyMCBhdCA0OjU0IFBNIFJpY2hhcmQgQmFja21hbiwg QW5uYWJlbGxlICZsdDtyaWNoYW5uYT08YSBocmVmPSJtYWlsdG86NDBhbWF6b24uY29tQGRtYXJj LmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+NDBhbWF6b24uY29tQGRtYXJjLmlldGYub3JnPC9h PiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCB3aW5kb3d0ZXh0IDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4t cmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQ7Ym9yZGVyLWNvbG9yOmN1cnJlbnRjb2xvciBj dXJyZW50Y29sb3IgY3VycmVudGNvbG9yIHJnYigyMDQsMjA0LDIwNCkiPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpUaGUgUklTQyBQcm9m aWxl4oCZcyDigJxJRCBUb2tlbiBDbGFpbXPigJ0gdHlwZSBkb2VzIG5vdCBpZGVudGlmeSBhIHN1 YmplY3QgdGhhdCBpcyBhbiBJRCBUb2tlbiwgaXQgaWRlbnRpZmllcyBhIHN1YmplY3QgdGhhdCB3 YXMgdGhlIHN1YmplY3Qgb2YgYW4gSUQgVG9rZW4uIEl0IHdhcyBpbnRlbmRlZCBmb3IgY2FzZXMg d2hlcmUgdGhlIE9QIHNlbnQgbXVsdGlwbGUgaWRlbnRpZmllcnMgb2YgZGlmZmVyZW50IHR5cGVz IGluIHRoZSBJRCBUb2tlbiAoZS5nLiwNCiBpc3Mrc3ViIGFuZCBlbWFpbCksIGFuZCBkb2VzIG5v dCBrbm93IHdoaWNoIG9mIHRoZW0gdGhlIGNsaWVudCB3aWxsIHJlY29nbml6ZSAoeWVzLCB0aGUN CjxpPnNob3VsZDwvaT4gdXNlIGlzcytzdWI7IG5vLCB0aGV5IGRvZXNu4oCZdCBhbHdheXMgZG8g c28pLiBUaGlzIHR5cGUgd2FzIHJlcGxhY2VkIGluIGRyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVj dC1pZGVudGlmaWVycy0wMyB3aXRoIHRoZSDigJxhbGlhc2Vz4oCdIHR5cGUsIHdoaWNoIGlzIGEg Z2VuZXJhbCBzb2x1dGlvbiB0byB0aGlzIHByb2JsZW0gdGhhdCBpcyBub3QgZGVmaW5lZCBpbiB0 ZXJtcyBvZiBvbmUgcGFydGljdWxhciB1c2UgY2FzZSAoaS5lLiwNCiBJRCBUb2tlbnMpLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5i c3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVp biI+DQpUaGUgT0lERiBTU0Ugd29ya2luZyBncm91cOKAmXMgPGEgaHJlZj0iaHR0cHM6Ly9vcGVu aWQubmV0L3NwZWNzL29hdXRoLWV2ZW50LXR5cGVzLTFfMC1JRDEuaHRtbCNyZmMuc2VjdGlvbi4y LjEiIHRhcmdldD0iX2JsYW5rIj4NCk9BdXRoIEV2ZW50IFR5cGVzIGRyYWZ0PC9hPiBkZWZpbmVz IGEg4oCcb2F1dGhfdG9rZW7igJ0gdHlwZSB0aGF0IGlkZW50aWZpZXMgYSBzdWJqZWN0IHRoYXQg aXMgYW4gT0F1dGggMi4wIHRva2VuLCBhbmQgZG9lcyBzbyB1c2luZyBlaXRoZXIgdGhlIGZ1bGwg b3IgcGFydGlhbCBwbGFpbiB0ZXh0IHZhbHVlIG9mIHRoZSB0b2tlbiwgb3IgYSBoYXNoIG9mIHRo ZSB0b2tlbi4uLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6LjVpbiI+DQpJdCBpcyBwZXJmZWN0bHkgZmluZSBmb3IgYSB0b2tlbiB0byBi ZSB0aGUgc3ViamVjdCBvZiBhIHNlY3VyaXR5IGV2ZW50LiA8YSBocmVmPSJodHRwczovL3d3dy5y ZmMtZWRpdG9yLm9yZy9yZmMvcmZjODQxNy5odG1sI3NlY3Rpb24tMi4yIiB0YXJnZXQ9Il9ibGFu ayI+DQo4NDE3PC9hPiBhY3R1YWxseSBpbmNsdWRlcyB0aGUgZm9sbG93aW5nIGFzIGFuIGV4YW1w bGUgb2YgYSBwb3NzaWJsZSB2YWx1ZSBmb3IgdGhlIOKAnHN1YuKAnSBjbGFpbTo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 Oztjb2xvcjpibGFjayI+KiZuYnNwOyBhIHRva2VuIGlkZW50aWZpZXIgKGUuZy4gJnF1b3Q7anRp JnF1b3Q7KSBmb3IgYSByZXZva2VkIHRva2VuLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij7igJM8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+QW5uYWJlbGxlIEJhY2ttYW4gKHNoZS9oZXIpPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkFXUyBJZGVudGl0eTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij48YSBocmVmPSJodHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5 LyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDU2M0MxIj5odHRwczovL2F3 cy5hbWF6b24uY29tL2lkZW50aXR5Lzwvc3Bhbj48L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4N CiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRv cDpzb2xpZCB3aW5kb3d0ZXh0IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW47Ym9yZGVy LWNvbG9yOmN1cnJlbnRjb2xvciBjdXJyZW50Y29sb3IiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluIj4NCjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2Nv bG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0 O2NvbG9yOmJsYWNrIj5JZC1ldmVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5j ZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPC9h PiZndDsgb24gYmVoYWxmIG9mIEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7YXR1bHR1bHNoaT08YSBo cmVmPSJtYWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+VHVl c2RheSwgSnVseSAxNCwgMjAyMCBhdCA0OjMyIFBNPGJyPg0KPGI+VG86IDwvYj5CcmlhbiBDYW1w YmVsbCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tIiB0YXJn ZXQ9Il9ibGFuayI+YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb208L2E+Jmd0Ozxicj4NCjxiPkNj OiA8L2I+WWFyb24gU2hlZmZlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOnlhcm9uZi5pZXRmQGdtYWls LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnlhcm9uZi5pZXRmQGdtYWlsLmNvbTwvYT4mZ3Q7LCBDaHJp cyBQaGlsbGlwcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkNocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2Ei IHRhcmdldD0iX2JsYW5rIj5DaHJpcy5QaGlsbGlwc0BjYW5hcmllLmNhPC9hPiZndDssICZxdW90 OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2 ZW50QGlldGYub3JnPC9hPiZxdW90Ow0KICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+ U3ViamVjdDogPC9iPlJFOiBbRVhURVJOQUxdIFtJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50 aWZpZXIgdHlwZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUiIGJvcmRlcj0iMCIg Y2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0aD0iNjIyIiBzdHlsZT0id2lkdGg6 NDY2LjVwdDttYXJnaW4tbGVmdDoxLjBpbjtib3JkZXItY29sbGFwc2U6Y29sbGFwc2UiPg0KPHRi b2R5Pg0KPHRyIHN0eWxlPSJoZWlnaHQ6MTUuMjVwdCI+DQo8dGQgd2lkdGg9IjYyMiIgdmFsaWdu PSJ0b3AiIHN0eWxlPSJ3aWR0aDo0NjYuNXB0O2JvcmRlcjpzb2xpZCAjRUQ3RDMxIDEuNXB0O3Bh ZGRpbmc6MGluIDBpbiAwaW4gMGluO2hlaWdodDoxNS4yNXB0O3BhZGRpbmc6NS4uNHB0Ij4NCjxw PjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkZGOTkiPkNBVVRJT048L3NwYW4+PC9z dHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQ6I0ZGRkY5OSI+OiBUaGlz IGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRpb24uIERvIG5v dCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcw0KIHlvdSBjYW4gY29uZmly bSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4i Pg0KSU1PIGlmIHdlIGhhdmUgYSBjb21tb24gZW5vdWdoIHVzZS1jYXNlIHRoYXQgcmVxdWlyZXMg YSBzcGVjaWZpYyB0eXBlIHRvIGJlIGRlZmluZWQsIHRoZW4gd2Ugc2hvdWxkIGRlZmluZSB0aGF0 IHR5cGUgaW4gdGhlIHNwZWMgcmF0aGVyIHRoYW4gcmVseSBvbiBhbiBpbnRlcnByZXRhdGlvbiBv ZiB0aGUgJnF1b3Q7aXNzLXN1YiZxdW90OyB0eXBlLCBzaW5jZSB0aGF0IGludGVycHJldGF0aW9u IGNhbiBjYXVzZSBpbmNvbXBhdGliaWxpdGllcy4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQpJbiB0aGlzIHNwZWNpZmljIGNhc2UgaG93ZXZlciBJIGZlZWwgdGhhdCB0aGUgdXNl IGNhc2VzIG91dGxpbmVkIGluIG15IHByZXZpb3VzIGVtYWlsIGNhbiBiZSBhY2hpZXZlZCAod2l0 aCBsaW1pdGF0aW9ucykgdXNpbmcgdGhlIGR1cmFibGUgc3ViamVjdCB0eXBlcyBzdWNoIGFzIGVt YWlsLiBJJ2QgbGlrZSB0aGUgbWVtYmVycyBvZiB0aGUgU1NFIHdvcmtpbmcgZ3JvdXAgdG8gY2hp bWUgaW4gKHNpbmNlIHRoYXQgaXMgd2hlcmUgdGhpcyBnb3QgYWRkZWQpLA0KIG9yIHdlIGNhbiBk cm9wIHRoZSBTQU1MIHN1YmplY3QgaWRlbnRpZmllciB0eXBlLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQom bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIFR1ZSwgSnVsIDE0LCAyMDIwIGF0IDQ6MDkgUE0gQnJp YW4gQ2FtcGJlbGwgJmx0OzxhIGhyZWY9Im1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNv bSIgdGFyZ2V0PSJfYmxhbmsiPmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KKyAxIHRvIHdoYXQgWWFyb24gaXMgc2F5aW5n IGhlcmUuIEknZCBpbmNsdWRlIGFsc28gdGhlICZxdW90O2lzcy1zdWImcXVvdDsgc3ViamVjdCBp ZGVudGlmaWVyIHR5cGUNCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFm dC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmllcnMtMDUjc2VjdGlvbi0zLjQiIHRhcmdl dD0iX2JsYW5rIj4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2 ZW50LXN1YmplY3QtaWRlbnRpZmllcnMtMDUjc2VjdGlvbi0zLjQ8L2E+IGFzIGFscmVhZHkgaGF2 aW5nIHNlbWFudGljcyBjb3ZlcmluZyB3aGF0J3MgZGVzY3JpYmVkIGluIHRoZSBJRCBUb2tlbiBD bGFpbXMgU3ViamVjdCBJZGVudGlmaWVyIFR5cGUgaW4gdGhlIFJJU0MgZG9jdW1lbnQgcmVmZXJl bmNlZC4gQW5kIGFsbCB0aG9zZSB0aGluZ3MgcmVwcmVzZW50IGEgZHVyYWJsZQ0KIHN1YmplY3Qg cmF0aGVyIHRoYW4gYSBzZXNzaW9uLCB3aGljaCBzdHJpa2VzIG1lIGFzIGFwcHJvcHJpYXRlIGZv ciBhIGRvY3VtZW50IHRoYXQgZGVzY3JpYmVzIGlkZW50aWZ5aW5nIHN1YmplY3RzLiBBIFNBTUwg YXNzZXJ0aW9uIElELCBob3dldmVyLCB3aGljaCBpcyBhbiBpZGVudGlmaWVyIG9mIGFuIFhNTCBk b2N1bWVudCB0aGF0IGlzIG9ubHkgaW5kaXJlY3RseSByZWxhdGVkIHRvIGEgc2Vzc2lvbiBieSBh biBhc3NvY2lhdGlvbiB0aGF0IGxpa2VseQ0KIGlzbid0IG1haW50YWluZWQsIGRvZXMgbm90IHNl ZW0gYXBwcm9wcmlhdGUgYXMgYSAmcXVvdDtzdWJqZWN0IGlkZW50aWZpZXImcXVvdDsuIDxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIFR1ZSwgSnVsIDE0LCAyMDIw IGF0IDQ6MDEgUE0gWWFyb24gU2hlZmZlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOnlhcm9uZi5pZXRm QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnlhcm9uZi5pZXRmQGdtYWlsLmNvbTwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkhpIEF0dWwsPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhl IElEIFRva2VuIHN1YmplY3QgdHlwZSwgYXMgZGVzY3JpYmVkIGluIHRoZSBkb2N1bWVudCB5b3Ug YXJlIHJlZmVyZW5jaW5nLCBkb2VzIG5vdCBhZGQgYW55IHNlbWFudGljcywgY29tcGFyZWQgdG8g YSDigJxwaG9uZSBudW1iZXLigJ0gb3Ig4oCcZW1haWzigJ0gc3ViamVjdCB0eXBlLiBTbyBJIGRv buKAmXQgc2VlIHRoZSB2YWx1ZSBpbiBhZGRpbmcgaXQuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KSW4gYWRkaXRpb24s IGl0IGRvZXMgbm90LCBhY3R1YWxseSwgZGVzY3JpYmUgYW4gSUQgVG9rZW4uIEluIGZhY3QgdGhl IHRleHQgaXMgdmVyeSBjbGVhciB0aGF0IGl0IGRlc2NyaWJlcyBhIOKAnHN1YmplY3TigJ0gKGEg ZHVyYWJsZSBlbnRpdHkpIHJhdGhlciB0aGFuIGEgc2Vzc2lvbiwgYW5kIGRvZXMgaXQgYnkgY2l0 aW5nIHZhcmlvdXMgY2xhaW1zIGluY2x1ZGVkIGluIHRoZSBJRCB0b2tlbi4gU28gYXMgYSBzdWJq ZWN0IGlkZW50aWZpZXIgdHlwZSwNCiBpdCBpcyBub3QgYXQgYWxsIGVxdWl2YWxlbnQgdG8gYSBT QU1MIGFzc2VydGlvbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpBcyB0byB0aGUgU0FNTCBBc3NlcnRpb24gc3ViamVj dCB0eXBlLCBJIHRoaW5rIHRoZXNlIHVzZSBjYXNlcyBjb3VsZCBiZSBhZGRyZXNzZWQgYnkgYWRk aW5nIGluZm9ybWF0aW9uIHRvIHRoZSBldmVudC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpUaGFua3MsPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFlhcm9uPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5BdHVsIFR1bHNoaWJh Z3dhbGUgJmx0OzxhIGhyZWY9Im1haWx0bzphdHVsdHVsc2hpQGdvb2dsZS5jb20iIHRhcmdldD0i X2JsYW5rIj5hdHVsdHVsc2hpQGdvb2dsZS5jb208L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5U dWVzZGF5LCBKdWx5IDE0LCAyMDIwIGF0IDIzOjI2PGJyPg0KPGI+VG86IDwvYj5ZYXJvbiBTaGVm ZmVyICZsdDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmlldGZAZ21haWwuY29tIiB0YXJnZXQ9Il9i bGFuayI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzogPC9iPkNocmlz IFBoaWxsaXBzICZsdDs8YSBocmVmPSJtYWlsdG86Q2hyaXMuUGhpbGxpcHNAY2FuYXJpZS5jYSIg dGFyZ2V0PSJfYmxhbmsiPkNocmlzLlBoaWxsaXBzQGNhbmFyaWUuY2E8L2E+Jmd0OywgJnF1b3Q7 PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZl bnRAaWV0Zi5vcmc8L2E+JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3Vi amVjdDogPC9iPlJlOiBbSWQtZXZlbnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGU8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KSGkmbmJzcDtZYXJv biw8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6MS4waW4iPg0KVGhlcmUgYXJlIGEgZmV3IFNTRSB1c2UgY2FzZXMgd2hlcmUgdGhlIGV2ZW50 cyBhcmUgYWJvdXQgYSBzcGVjaWZpYyBzaW5nbGUgc2lnbi1vbiBzZXNzaW9uLiBZb3UncmUgcmln aHQgdGhhdCB0aGlzIHNob3VsZCBub3QgYmUgbGltaXRlZCB0byBTQU1MLiBUaGUgUklTQyBwcm9m aWxlIG9mIFNFVHMgKGJhc2VkIG9uIHdoaWNoIHdlIGFyZSBkb2luZyB0aGUgU1NFIHdvcmspIGhh ZCB0aGUgSUQgVG9rZW4gc3ViamVjdCBpZGVudGlmaWVyIHR5cGUsIHdoaWNoDQogZm9yIHNvbWUg cmVhc29uIGlzIG1pc3NpbmcgaW4gdGhpcyBzcGVjIChJIGRpZCBub3QgcmVhbGl6ZSB1bnRpbCBu b3cpLiBUaGUgc3BlY2lmaWMgZXZlbnRzIHRoYXQgbmVlZCB0byByZWZlciB0byBzZXNzaW9ucyBh cmU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6U3ltYm9sIj7Ctzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+SWRlbnRpdHkgcHJvdmlk ZXIgY29udGV4dCBjaGFuZ2U6IFRoZSBjb25kaXRpb25zIHVuZGVyIHdoaWNoIGEgU0FNTCBhc3Nl cnRpb24gb3IgT0lEQyB0b2tlbiB3YXMgZ2VuZXJhdGVkIGFyZSBubyBsb25nZXImbmJzcDt2YWxp ZC4gVGhpcyBjYW4gYmUgZHVlIHRvIHZhcmlvdXMgdGhpbmdzLCBpbmNsdWRpbmcgYSBwYXNzd29y ZCBjaGFuZ2UuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6MS41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6U3lt Ym9sIj7Ctzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+U2Vzc2lvbiBwcm9wZXJ0eSBjaGFuZ2U6 IEEgc2Vzc2lvbiBoYXMgYmVlbiBkZXRlcm1pbmVkIHRvIGhhdmUgYmVlbiBjb21wcm9taXNlZDxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4N CjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OlN5bWJvbCI+wrc8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBO ZXcgUm9tYW4mcXVvdDssc2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOw0KPC9zcGFuPlJldm9jYXRpb246IFRoZSBpc3N1ZXIgb2YgdGhlIHNpbmds ZSBzaWduLW9uIFNBTUwgYXNzZXJ0aW9uIG9yIElEIFRva2VuIG5lZWRzIHRvIGJlIHJldm9rZTxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQpJIGNhbiBhbHNvIGFkZCB0aGUgPGEgaHJlZj0iaHR0cHM6Ly9iaXRidWNrZXQub3Jn L29wZW5pZC9yaXNjL3NyYy9tYXN0ZXIvb3BlbmlkLXJpc2MtcHJvZmlsZS0xXzAudHh0I2xpbmVz LTI1MCIgdGFyZ2V0PSJfYmxhbmsiPg0KSUQgVG9rZW4gY2xhaW0gZnJvbSB0aGUgUklTQyBwcm9m aWxlPC9hPiB0byBteSBwdWxsIHJlcXVlc3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQpUaGFua3MsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KQXR1bDxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4N Ck9uIFR1ZSwgSnVsIDE0LCAyMDIwIGF0IDEyOjMyIFBNIFlhcm9uIFNoZWZmZXIgJmx0OzxhIGhy ZWY9Im1haWx0bzp5YXJvbmYuLi5pZXRmQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnlhcm9u Zi5pZXRmQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4 dCAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0O2JvcmRlci1j b2xvcjpjdXJyZW50Y29sb3IgY3VycmVudGNvbG9yIGN1cnJlbnRjb2xvciByZ2IoMjA0LDIwNCwy MDQpIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEu MGluIj4NCkkgbmVlZCBhIGxvdCBtb3JlIGNvbnRleHQgaGVyZS4gU28gZmFyLCBzdWJqZWN0IElE cyBoYXZlIGRlbm90ZWQgZHVyYWJsZSBlbnRpdGllcywgc3VjaCBhcyBlbWFpbCBhZGRyZXNzZXMs IHBob25lIG51bWJlcnMsIGFjY291bnQuIFRoaXMgaXMgYWRkaW5nIGEgc3ViamVjdCBJRCB0aGF0 IGRlbm90ZXMgYW4gZXBoZW1lcmFsIGVudGl0eSwgYmFzaWNhbGx5IHNpbWlsYXIgdG8gYSBzZXNz aW9uIElELiBUaGlzIGxvb2tzIHdlaXJkIGZyb20gYW4gYXJjaGl0ZWN0dXJhbA0KIHBvaW50IG9m IHZpZXcsIGFuZCBhbHNvIGJlZ3MgdGhlIHF1ZXN0aW9uLCB3aHkgc3BlY2lmaWNhbGx5IFNBTUwg YW5kIG5vdCBvdGhlciBzZXNzaW9uIHR5cGVzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NClRoYW5rcyw8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgWWFyb24gPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5JZC1ldmVudCAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5pZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgb24gYmVoYWxmIG9mIEF0dWwgVHVs c2hpYmFnd2FsZSAmbHQ7YXR1bHR1bHNoaT08YSBocmVmPSJtYWlsdG86NDBnb29nbGUuY29tQGRt YXJjLmlldGYuLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9y ZzwvYT4mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlR1ZXNkYXksIEp1bHkgMTQsIDIwMjAgYXQgMDA6 MTQ8YnI+DQo8Yj5UbzogPC9iPkNocmlzIFBoaWxsaXBzICZsdDs8YSBocmVmPSJtYWlsdG86Q2hy aXMuUGhpbGxpcHNAY2FuYXJpZS5jYSIgdGFyZ2V0PSJfYmxhbmsiPkNocmlzLlBoaWxsaXBzQGNh bmFyaWUuY2E8L2E+Jmd0Ozxicj4NCjxiPkNjOiA8L2I+JnF1b3Q7PGEgaHJlZj0ibWFpbHRvOmlk LWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+JnF1 b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbSWQt ZXZlbnRdIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGU8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4i Pg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KSnVzdCBjbGFyaWZ5aW5nIHRoZSBwcm9wb3NhbCBh cyBpdCBzdGFuZHMgdG9kYXkgKGJlZm9yZSBpbmNvcnBvcmF0aW5nIENocmlzJ3MgaW5wdXQpOjxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQpUaGUgZm9sbG93aW5nIHNlY3Rpb24gc2hvdWxkIGJlIGFkZGVkIGluIHRoZSAmcXVv dDtTdWJqZWN0IElkZW50aWZpZXIgVHlwZXMmcXVvdDsgc2VjdGlvbjo8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+ DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjQuOS4m bmJzcDsgU0FNTCBTdWJqZWN0IElkZW50aWZpZXIgVHlwZTxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDtUaGUgU0FNTCBbU0FNTC5SRUZdIFN1YmplY3QgSWRlbnRpZmllciBUeXBlIGRlc2NyaWJlcyBh IHN1YmplY3QgYnk8YnI+DQombmJzcDsgJm5ic3A7dGhlIGFzc2VydGlvbiBpZGVudGlmaWVyIGlu IHRoZSBTQU1MIGFzc2VydGlvbiB0aGF0IHdhcyB1c2VkIHRvPGJyPg0KJm5ic3A7ICZuYnNwO2Nv bnZleSB0aGUgc3ViamVjdCdzIGluZm9ybWF0aW9uIHRvIHRoZSBSZWNlaXZlci4mbmJzcDsgU3Vi amVjdDxicj4NCiZuYnNwOyAmbmJzcDtJZGVudGlmaWVycyBvZiB0aGlzIHR5cGUgTVVTVCBjb250 YWluIGFuIGAgYXNzZXJ0aW9uX2lkJnF1b3Q7Y2xhaW0uJm5ic3A7IFRoZTxicj4NCiZuYnNwOyAm bmJzcDt2YWx1ZSBvZiB0aGlzIGNsYWltIGlzIGEgc3RyaW5nIHRoYXQgaXMgZXF1YWwgdG8gdGhl IEFzc2VydGlvbjxicj4NCiZuYnNwOyAmbmJzcDtJZGVudGlmaWVyIGluIHRoZSBTQU1MIGFzc2Vy dGlvbi4mbmJzcDsgVGhlIFNBTUwgU3ViamVjdCBJZGVudGlmaWVyIFR5cGU8YnI+DQombmJzcDsg Jm5ic3A7aXMgaWRlbnRpZmllZCBieSB0aGUgbmFtZSAmcXVvdDtzYW1sYC48YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7QmVsb3cgaXMgYSBub24tbm9ybWF0aXZlIGV4YW1wbGUgU3ViamVjdCBJZGVu dGlmaWVyIGZvciB0aGUgU0FNTDxicj4NCiZuYnNwOyAmbmJzcDtTdWJqZWN0IElkZW50aWZpZXIg VHlwZTo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ezxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 JnF1b3Q7c3ViamVjdF90eXBlJnF1b3Q7OiAmcXVvdDtzYW1sJnF1b3Q7LDxicj4NCiZuYnNwOyAm bmJzcDsgJm5ic3A7JnF1b3Q7YXNzZXJ0aW9uX2lkJnF1b3Q7OiAmcXVvdDtfZjU1MWQ4ODk2M2Fi NGUzZGVjYjdjZmU4ZjRkY2MzZjUmcXVvdDssPGJyPg0KJm5ic3A7ICZuYnNwO308YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7ICZuYnNwO0ZpZ3VyZSA4OiBFeGFtcGxlOiBTdWJqZWN0IElkZW50aWZp ZXIgZm9yIFNBTUwgU3ViamVjdCBJZGVudGlmaWVyPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtUeXBlLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjBpbiI+DQpPbiBNb24sIEp1bCAxMywgMjAyMCBhdCAxOjIyIFBNIEF0dWwgVHVsc2hpYmFn d2FsZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmF0dWx0dWxzaGlAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPmF0dWx0dWxzaGlAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW4iPg0KSGkgQ2hyaXMsPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkkgd2FzIHByb3Bvc2luZyB1c2luZyB0aGUgJnF1b3Q7 YXNzZXJ0aW9uIGlkJnF1b3Q7ICg8YSBocmVmPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9z ZWN1cml0eS9zYW1sL3YyLjAvc2FtbC1jb3JlLTIuMC1vcy5wZGYiIHRhcmdldD0iX2JsYW5rIj5T QU1MIENvcmU8L2E+IHNwZWMsIGxpbmUgNTUzKSBpbiB0aGUgcHJvcG9zYWwsIG5vdCB0aGUgJnF1 b3Q7c3ViamVjdC1pZCZxdW90OyBhcyBkZWZpbmVkIGluIFNBTUwgKHNwZWMgc2VjdGlvbiAzLjMp LiBUaGUgbWFpbiByZWFzb24NCiB3YXMgdG8gYmUgYWJsZSB0byByZWZlciB0byBhIHNlc3Npb24g dGhhdCB3YXMgZXN0YWJsaXNoZWQgdXNpbmcgYSBzcGVjaWZpYyBhc3NlcnRpb24uIElmIGl0J3Mg dXNlZnVsLCB3ZSBjb3VsZCBwZXJoYXBzIGV4dGVuZCB0aGUgU0FNTCBzdWJqZWN0IGlkZW50aWZp ZXIgdHlwZSBpbiB0aGlzIHNwZWMgdG8gaW5jbHVkZSBlaXRoZXIgdGhlIGFzc2VydGlvbl9pZCBv ciB0aGUgc3ViamVjdF9pZCBjbGFpbS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQpUaGFua3MsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KQXR1bDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIE1vbiwgSnVs IDEzLCAyMDIwIGF0IDEwOjMwIEFNIENocmlzIFBoaWxsaXBzICZsdDs8YSBocmVmPSJtYWlsdG86 Q2hyaXMuLi5QaGlsbGlwc0BjYW5hcmllLmNhIiB0YXJnZXQ9Il9ibGFuayI+Q2hyaXMuUGhpbGxp cHNAY2FuYXJpZS5jYTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4dCAx LjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0O2JvcmRlci1jb2xv cjpjdXJyZW50Y29sb3IgY3VycmVudGNvbG9yIGN1cnJlbnRjb2xvciByZ2IoMjA0LDIwNCwyMDQp Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGlu Ij4NCjxzcGFuIGxhbmc9IkVOLUNBIj5IaS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPlF1 aWV0IGx1cmtlciBvYnNlcnZpbmcuLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+VGhhbmtz IGZvciBjb25zaWRlciB0aGUgU0FNTCBlbGVtZW50cy4uIDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJF Ti1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5BdHVsLCBhcmUgeW91IHJl ZmVycmluZyB0byB0aGUgYWN0dWFsIHNlc3Npb24gaWRlbnRpZmllciB0aGF0IHNvbWVvbmUgbWF5 IGhhdmUgd2hlcmUgdGhlIFN1YmplY3QtSWQgd2FzIGV4Y2hhbmdlZCBPUiB0aGUgYWN0dWFsIFN1 YmplY3QtaWQgaXRzZWxmIGluIHlvdXIgcmVmZXJlbmNlIGluIHRoZSBwcm9wb3NhbCB3aXRoIHRo ZSBnaXRodWIgbGluaz88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+ DQo8c3BhbiBsYW5nPSJFTi1DQSI+SeKAmW0gdHJ5aW5nIHRvIHNxdWFyZSB3aGF0IEkgc2VlIG9u IHRoZSBnaXQgZGVsdGEgb24gbGluZSAyOTQtMjk2IGluDQo8YSBocmVmPSJodHRwczovL2dpdGh1 Yi5jb20vcmljaGFubmEvc2VjZXZlbnQvcHVsbC8xL2NvbW1pdHMvYjIwYjY2OTJlYjUwNjI4OTI3 NDc2Y2E3OGY5YmUwNzdhY2U4ODk5NCIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly9naXRodWIu Li5jb20vcmljaGFubmEvc2VjZXZlbnQvcHVsbC8xL2NvbW1pdHMvYjIwYjY2OTJlYjUwNjI4OTI3 NDc2Y2E3OGY5YmUwNzdhY2U4ODk5NDwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxh bmc9IkVOLUNBIj5BbmQgYSBTdWJqZWN0LWlkIGFzIHNob3duIGluIHRoZSBleGFtcGxlIGluIDMu My4zIGhlcmU6IDxhIGhyZWY9Imh0dHBzOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9zZWN1cml0eS9z YW1sLXN1YmplY3QtaWQtYXR0ci92MS4wL2NzMDEvc2FtbC1zdWJqZWN0LWlkLWF0dHItdjEuLjAt Y3MwMS4uaHRtbCNfVG9jNTM2MDk3MjI5IiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL2RvY3Mu b2FzaXMtb3Blbi5vcmcvc2VjdXJpdHkvc2FtbC1zdWJqZWN0LWlkLWF0dHIvdjEuMC9jczAxL3Nh bWwtc3ViamVjdC1pZC1hdHRyLXYxLjAtY3MwMS5odG1sI19Ub2M1MzYwOTcyMjk8L2E+PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGlu Ij4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0Ei PldoYXQgeW91IG9mZmVyZWQgaW4gdGhlIGV4YW1wbGUgaXMgbm90IGEgU3ViamVjdC1pZCAmbmJz cDtwZXIgdGhlIE9BU0lTIFNBTUwgc3BlYyBhcyB3cml0dGVuIGluIHNlY3Rpb24gMy4zLjE8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1D QSI+QW0gSSBtaXMtaW50ZXJwcmV0aW5nIHNvbWV0aGluZz88L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0i RU4tQ0EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Qzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3Bh biBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0OjEuMGluIj4NCjxiPjxzcGFuIGxhbmc9IkVOLUNBIiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1DQSIgc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPklkLWV2ZW50ICZsdDs8YSBocmVmPSJt YWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50 LWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBvbiBiZWhhbGYgb2YgQXR1bCBUdWxzaGliYWd3YWxl DQogJmx0O2F0dWx0dWxzaGk9PGEgaHJlZj0ibWFpbHRvOjQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7 PGJyPg0KPGI+RGF0ZTogPC9iPk1vbmRheSwgSnVseSAxMywgMjAyMCBhdCAxMjoxNyBQTTxicj4N CjxiPlRvOiA8L2I+JnF1b3Q7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJn ZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWls dG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwv YT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPltJZC1ldmVudF0gU0FNTCBzdWJqZWN0IGlkZW50 aWZpZXIgdHlwZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGxhbmc9IkVOLUNBIj5IaSBhbGwsPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+QmFzZWQgb24gdGhlIGRpc2N1c3Npb25z IGluIHRoZSBTU0Ugd29ya2luZyBncm91cCB3aXRoaW4gdGhlIE9wZW5JRCBGb3VuZGF0aW9uLCB3 ZSB3b3VsZCBsaWtlIHRvIHByb3Bvc2UgdGhhdCB0aGUgc3ViamVjdCBpZGVudGlmaWVyIHNwZWNp ZmljYXRpb24gaW5jbHVkZSBhIFNBTUwgc3ViamVjdCBpZGVudGlmaWVyIHR5cGUuIFRoaXMgaXMg c28gdGhhdCBzZXNzaW9ucyBlc3RhYmxpc2hlZCBhY3Jvc3MgcGVlcnMgdXNpbmcNCiBTQU1MIG1h eSBiZSBpZGVudGlmaWVkIGluIGV2ZW50cyB0aGF0IGluY2x1ZGUgdGhlIHN1YmplY3QgaWRlbnRp Zmllci48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7QSBTQU1MIHN1 YmplY3QgaWRlbnRpZmllciBoYXMgb25seSBvbmUgY2xhaW0gd2l0aGluIGl0LCB0aGUgYXNzZXJ0 aW9uIGlkIG9mIHRoZSBTQU1MIGFzc2VydGlvbiB1c2VkIHRvIGVzdGFibGlzaCB0aGUgc2luZ2xl IHNpZ24tb24gc2Vzc2lvbi48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4t Q0EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+VGhp cyBjaGFuZ2UgaXMgYWxzbyBpbmNsdWRlZCBpbiBteSA8YSBocmVmPSJodHRwczovL2dpdGh1Yi5j b20vcmljaGFubmEvc2VjZXZlbnQvcHVsbC8xIiB0YXJnZXQ9Il9ibGFuayI+DQpwcm9wb3NhbCBo ZXJlPC9hPi48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gbGFuZz0iRU4tQ0EiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+VGhhbmtzLDwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+QXR1bDwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjBpbiI+DQo8c3BhbiBsYW5nPSJFTi1DQSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW4iPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWls dG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5JZC1ldmVudEBpZXRmLm9yZzwv YT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lk LWV2ZW50IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18g SWQtZXZlbnQgbWFpbGluZyBsaXN0IDxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPg0KSWQtZXZlbnRAaWV0Zi5vcmc8L2E+IDxhIGhyZWY9Imh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj4N Cmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+IDxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50 IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5o dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9v OnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW4iPg0KPGJyPg0KPGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6LWFwcGxlLXN5c3RlbTtjb2xvcjojNTU1NTU1O2JvcmRlcjpub25lIHdp bmRvd3RleHQgMS4wcHQ7cGFkZGluZzowaW4iPkNPTkZJREVOVElBTElUWSBOT1RJQ0U6IFRoaXMg ZW1haWwgbWF5IGNvbnRhaW4gY29uZmlkZW50aWFsIGFuZCBwcml2aWxlZ2VkIG1hdGVyaWFsIGZv ciB0aGUgc29sZSB1c2Ugb2YgdGhlIGludGVuZGVkIHJlY2lwaWVudChzKS4gQW55IHJldmlldywN CiB1c2UsIGRpc3RyaWJ1dGlvbiBvciBkaXNjbG9zdXJlIGJ5IG90aGVycyBpcyBzdHJpY3RseSBw cm9oaWJpdGVkLi4mbmJzcDsgSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBjb21tdW5pY2F0aW9u IGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYnkgZS1tYWls IGFuZCBkZWxldGUgdGhlIG1lc3NhZ2UgYW5kIGFueSBmaWxlIGF0dGFjaG1lbnRzIGZyb20geW91 ciBjb21wdXRlci4gVGhhbmsgeW91Ljwvc3Bhbj48L2k+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9i bG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQ7Zm9udC1mYW1pbHk6LWFwcGxlLXN5c3RlbTtjb2xvcjojNTU1NTU1O2JvcmRlcjpub25l IHdpbmRvd3RleHQgMS4wcHQ7cGFkZGluZzowaW4iPkNPTkZJREVOVElBTElUWSBOT1RJQ0U6IFRo aXMgZW1haWwgbWF5IGNvbnRhaW4gY29uZmlkZW50aWFsIGFuZCBwcml2aWxlZ2VkIG1hdGVyaWFs IGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIGludGVuZGVkIHJlY2lwaWVudChzKS4gQW55IHJldmll dywNCiB1c2UsIGRpc3RyaWJ1dGlvbiBvciBkaXNjbG9zdXJlIGJ5IG90aGVycyBpcyBzdHJpY3Rs eSBwcm9oaWJpdGVkLi4mbmJzcDsgSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBjb21tdW5pY2F0 aW9uIGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYnkgZS1t YWlsIGFuZCBkZWxldGUgdGhlIG1lc3NhZ2UgYW5kIGFueSBmaWxlIGF0dGFjaG1lbnRzIGZyb20g eW91ciBjb21wdXRlci4gVGhhbmsgeW91Ljwvc3Bhbj48L2k+PC9iPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CH2PR00MB0679C47908D1EA76D7B31164F57E0CH2PR00MB0679namp_-- From nobody Wed Jul 15 16:56:14 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F0553A0B84 for ; Wed, 15 Jul 2020 16:56:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s9p1SZRztMtI for ; Wed, 15 Jul 2020 16:56:11 -0700 (PDT) Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A693F3A0B8C for ; Wed, 15 Jul 2020 16:56:11 -0700 (PDT) Received: by mail-wm1-x32b.google.com with SMTP id j18so7681390wmi.3 for ; Wed, 15 Jul 2020 16:56:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NqvEoy3kNJcVjkjk6YTnHEXbUUTwKUDd40QYyRmpJ+4=; b=UfX5j7crLrb5BeBi21T6bY+uQmX77sXE9czJfJaAsd2Wu+seDe5a6aPSWkvTVSEbvH HQdRQLEkWpAEXzfD6ZXPF9wd9taXT+moPfv+X0oWNB1S17Bct0s0/zQ3nQFp6nox0aEg Xg7a4wkOpwNwlH3Hg7pY/3oaZkvdu4cbKhZkbCpk48weFUK3U4NxfVtxTULV8BYm9UAY Tp4rFkb3l2DF0mSjiT7M9T91RW9jRB6ipvkyAwcfFubLALeatYQahbUZwcvJ8uJf71YZ ++MVHhS/8ieA8AmkwvtdOj9Op5j6W1bRLkfNPp50t8dRgvnoG03AwMBUO3v9axFLR8mZ HdUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NqvEoy3kNJcVjkjk6YTnHEXbUUTwKUDd40QYyRmpJ+4=; b=mXn8CycXiZng+QXGxDy4XMvO8RwPJkEpMXGezoyQZlh7uKDlpU/QJ2eiimUJy1EphM zDcgyXAR0+64rKr02ynLVkb8jgfehUw3rLAnsj9rF5mHY1gOujIjJf/Vm8nuTzHrYvD+ GaeaabUh9yBv6zkuuUGG+GtNm1jtNRE9gNO1rRQBz5wxDySYBORY7oWbtV7a3ekJXLtB I8GLfW6DBSfG6b4t1YColkFKk2IcUES1BWdmDYUehPYb9EmOUJJ3dsJgy4sQ1Ct2FcZe 5Kzotan4ngU2rXuDlaldQWIGtQukhkTocSav+uk8n1KN+udCLFtiLr2Zmi/368hBs7rn AHjw== X-Gm-Message-State: AOAM531KSmRQlVC5mtRG/MQcyFBlGFlBU31sBPxo3r3EeMDpF312h16V 7NeayULd8RHbtrs/rHUwyzmNLxvApQuzVuaCWPbVPg== X-Google-Smtp-Source: ABdhPJxA/NuRcvoC7S73HDOO9Z3pR3NAfGsppMxbGzocLw4vnS3xwkf1TCHizEz7aHzO2UcpfNaGq0Je8q0BHVUF0mM= X-Received: by 2002:a1c:2109:: with SMTP id h9mr1791037wmh.174.1594857369804; Wed, 15 Jul 2020 16:56:09 -0700 (PDT) MIME-Version: 1.0 References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> <3E0E61F6-0AB1-490C-B46D-F32D1E95B163@mit.edu> In-Reply-To: <3E0E61F6-0AB1-490C-B46D-F32D1E95B163@mit.edu> From: William Denniss Date: Wed, 15 Jul 2020 16:55:51 -0700 Message-ID: To: Justin Richer Cc: "Richard Backman, Annabelle" , Yaron Sheffer , "id-event@ietf.org" Content-Type: multipart/alternative; boundary="000000000000ff152205aa83aa2c" Archived-At: Subject: Re: [Id-event] Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 23:56:14 -0000 --000000000000ff152205aa83aa2c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable +1 to finish the work on secevent-subject-identifiers On Mon, Jul 13, 2020 at 12:35 PM Justin Richer wrote: > +1 to finishing it and I=E2=80=99ll add my review to the pile this week. = Apologies > for the delays in doing so. > > =E2=80=94 Justin > > On Jul 2, 2020, at 6:59 PM, Richard Backman, Annabelle < > richanna=3D40amazon.com@dmarc.ietf.org> wrote: > > I=E2=80=99d like to hear from the working group on whether or not there i= s > interest in completing the Subject Identifiers draft within secevents. > This work has more or less been put on hiatus given the chairs=E2=80=99 p= revious > decision not to continue with it within the working group, but it remains= a > dependency for other work, and a number of people within the working grou= p > have expressed interest and support for it previously. If there is suppor= t > within the working group for resuming and completing Subject Identifiers, > then it would seem reasonable to me to do so within secevents. > > =E2=80=93 > Annabelle Backman (she/her) > AWS Identity > https://aws.amazon.com/identity/ > > > *From: *Id-event on behalf of Yaron Sheffer < > yaronf.ietf@gmail.com> > *Date: *Tuesday, June 30, 2020 at 2:06 AM > *To: *"id-event@ietf.org" > *Subject: *[EXTERNAL] [Id-event] Closing the SecEvent working group > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and kno= w > the content is safe. > > Dear WG participants, > > As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP deliv= ery > specs, have both been approved for publication as RFCs. > > Since the group has now completed its mission, we propose to close it > down. Unless there are objections (accompanied by credible work items) > within a week, we will ask the AD to do just that. Even with the WG shut > down, the mailing list will remain open for relevant discussions. > > We would like to thank the authors of the Push and Poll soon-to-be RFCs, > Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to the man= y > other working group members who contributed to these quality documents. > > Regards, > > Dick and Yaron > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --000000000000ff152205aa83aa2c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    +1 to finish the work on=C2=A0secevent-subject-identifiers=

    On Mon, Jul 13, 2020 at 12:35 PM Justin Richer <jricher@mit.edu> wrote:
    +1 = to finishing it and I=E2=80=99ll add my review to the pile this week. Apolo= gies for the delays in doing so.

    =C2=A0=E2=80=94 Justin<= br>

    On Jul 2, 2020, at 6:59 PM, Rich= ard Backman, Annabelle <richanna=3D40amazon.com@dmarc.ietf.org> = wrote:

    I=E2=80=99d like to hear from the working group on whether or not t= here is interest in completing the Subject Identifiers draft=C2=A0 within s= ecevents. This work has more or less been put on hiatus given the chairs=E2= =80=99 previous decision not to continue with it within the working group, = but it remains a dependency for other work, and a number of people within t= he working group have expressed interest and support for it previously. If = there is support within the working group for resuming and completing Subje= ct Identifiers, then it would seem reasonable to me to do so within seceven= ts.
    <= /u>=C2=A0
    =E2=80=93
    Annabelle Backman (she/her)
    AWS Identi= ty
    =C2=A0
    =C2=A0
    From:=C2=A0Id-event <id-event-bounces@ietf.org> on behalf of Yaron Sheffer <<= a href=3D"mailto:yaronf.ietf@gmail.com" target=3D"_blank">yaronf.ietf@gmail= .com>
    Date:=C2=A0Tuesday, June 30, 2020 at 2:= 06 AM
    To:=C2=A0"id-event@ietf.org" <id-event@ietf.org>
    Subject= :=C2=A0[EXTERNAL] [Id-event] Closing the SecEvent working = group
    =C2=A0
    CAUT= ION: This= email originated from outside of the organization. Do not click links or o= pen attachments unless you can confirm the sender and know the content is s= afe.
    =C2=A0
    Dear WG participants,<= u>
    =C2=A0
    As you=E2=80=99ve all seen, our last two delivera= bles, the SET HTTP delivery specs, have both been approved for publication = as RFCs.
    =C2=A0
    Since the group has now completed its mission, we propose to cl= ose it down. Unless there are objections (accompanied by credible work item= s) within a week, we will ask the AD to do just that. Even with the WG shut= down, the mailing list will remain open for relevant discussions.
    =C2=A0
    We wo= uld like to thank the authors of the Push and Poll soon-to-be RFCs, Annabel= le, Mike, Marius, Morteza and Anthony. Many thanks also to the many other w= orking group members who contributed to these quality documents.<= /u>
    =C2=A0
    Regards= ,
    = =C2=A0
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 Dick and Yaron
    = ___________________________= ____________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/li= stinfo/id-event

    ________= _______________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --000000000000ff152205aa83aa2c-- From nobody Wed Jul 15 17:00:20 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 000B13A0BD1 for ; Wed, 15 Jul 2020 17:00:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r3CM5QCKdwcz for ; Wed, 15 Jul 2020 17:00:11 -0700 (PDT) Received: from mail-lj1-x233.google.com (mail-lj1-x233.google.com [IPv6:2a00:1450:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F251B3A0BB2 for ; Wed, 15 Jul 2020 17:00:10 -0700 (PDT) Received: by mail-lj1-x233.google.com with SMTP id x9so4883718ljc.5 for ; Wed, 15 Jul 2020 17:00:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YmMQlZAy4P8qb7AO1nzmQF1w245GAiRI9KpWL1V+6Ss=; b=NJlNRrmvkPnP0LmZJgK4xkND42/ADy65dSdXgDUenb6J3d3P8cI/BZOhQgriaDThOG HSTjEVB6TaPzH4MjPqRapGav1Eyec8RGcipZcIuEvOBlZ/Q18kd2hBMB/vQTwb6inD9q Qw5hpgmRxyfw7ZPOzTTqKvP1+Vc+dqAGIgx2f1ks45I6eJZxA0rN30xVmeUiMeJ0jtvV eYP5sdA2X/8zzMN2LRWmaKGx5lxVJ52dK46aHNVhDr0jEtODgAtchavk15bvubxcNl9O Mbbue95X09jikjJOm02W6XU55k67xb/l0kkbHi+to+UU5rCphhTbAsu/2GIU8bv4mZ0D Nh0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YmMQlZAy4P8qb7AO1nzmQF1w245GAiRI9KpWL1V+6Ss=; b=eieZi+vjU2K2YXDdsGRQEK6jr/K3pT3qYqsTXjdPxSy2Q6y2zgxNeciSMRqT1st8VK NTEW9JZlEaz2ey7vgLCWaZgsf314rUBkhDH9ChShqi/4zYB+/0VDHkIGElSUNEnX8gZz rZrmbsJE1YORU7IN9I+0qNo09AOg8Id2JgEbWJ+iKzZ9ux/ae+Qv4n4td6CXOd//cwLW SHwMaEI+9TKyIq6q1fNJ/fmEfwGB0XYrkl5vLs58zYDiiAYXTQ+C0dK5BIwtwG8zDIN6 OuI5BMGvJYjKiB7mlJGpT+MYavyedQq1k8SCFhJYAZsPdoZla4E6mpiNt9cumL/Yr0FC HhLQ== X-Gm-Message-State: AOAM530YJm/mPKekEzAtrxLjALzRIZmYFOs2VBCmA0jX5FQXelpa82if HEe6EWcIdEavhVYnIFTxluLMX0HcIC1uuOAEtNE= X-Google-Smtp-Source: ABdhPJzE8u8xnHCKKX03zHbeEOchOXSJo3yMmUqnkGBubi8MejavsYqmOvL7UJ+JvV75zCrYqX1zfnU0Ar//KBZjN9Y= X-Received: by 2002:a2e:8316:: with SMTP id a22mr671699ljh.246.1594857608995; Wed, 15 Jul 2020 17:00:08 -0700 (PDT) MIME-Version: 1.0 References: <40DFE1FE-B183-43A5-9CF1-464C1342C937@amazon.com> <3E0E61F6-0AB1-490C-B46D-F32D1E95B163@mit.edu> In-Reply-To: From: Dick Hardt Date: Wed, 15 Jul 2020 16:59:33 -0700 Message-ID: To: William Denniss Cc: Justin Richer , Yaron Sheffer , "id-event@ietf.org" , "Richard Backman, Annabelle" Content-Type: multipart/alternative; boundary="00000000000040669705aa83b9a9" Archived-At: Subject: Re: [Id-event] Closing the SecEvent working group X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jul 2020 00:00:18 -0000 --00000000000040669705aa83b9a9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hey Denniss, please see this email for current status: https://mailarchive.ietf.org/arch/msg/id-event/A8L6ZSvw5szuPNXf2HBVRTifr44/ =E1=90=A7 On Wed, Jul 15, 2020 at 4:56 PM William Denniss wrote: > +1 to finish the work on secevent-subject-identifiers > > On Mon, Jul 13, 2020 at 12:35 PM Justin Richer wrote: > >> +1 to finishing it and I=E2=80=99ll add my review to the pile this week. >> Apologies for the delays in doing so. >> >> =E2=80=94 Justin >> >> On Jul 2, 2020, at 6:59 PM, Richard Backman, Annabelle < >> richanna=3D40amazon.com@dmarc.ietf.org> wrote: >> >> I=E2=80=99d like to hear from the working group on whether or not there = is >> interest in completing the Subject Identifiers draft within secevents. >> This work has more or less been put on hiatus given the chairs=E2=80=99 = previous >> decision not to continue with it within the working group, but it remain= s a >> dependency for other work, and a number of people within the working gro= up >> have expressed interest and support for it previously. If there is suppo= rt >> within the working group for resuming and completing Subject Identifiers= , >> then it would seem reasonable to me to do so within secevents. >> >> =E2=80=93 >> Annabelle Backman (she/her) >> AWS Identity >> https://aws.amazon.com/identity/ >> >> >> *From: *Id-event on behalf of Yaron Sheffer = < >> yaronf.ietf@gmail..com > >> *Date: *Tuesday, June 30, 2020 at 2:06 AM >> *To: *"id-event@ietf.org " >> *Subject: *[EXTERNAL] [Id-event] Closing the SecEvent working group >> >> *CAUTION*: This email originated from outside of the organization. Do >> not click links or open attachments unless you can confirm the sender an= d >> know the content is safe. >> >> Dear WG participants, >> >> As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP deli= very >> specs, have both been approved for publication as RFCs. >> >> Since the group has now completed its mission, we propose to close it >> down. Unless there are objections (accompanied by credible work items) >> within a week, we will ask the AD to do just that. Even with the WG shut >> down, the mailing list will remain open for relevant discussions. >> >> We would like to thank the authors of the Push and Poll soon-to-be RFCs, >> Annabelle, Mike, Marius, Morteza and Anthony. Many thanks also to the ma= ny >> other working group members who contributed to these quality documents. >> >> Regards, >> >> Dick and Yaron >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --00000000000040669705aa83b9a9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Hey Denniss, please see this email for current status:
    3D""=E1=90=A7<= /div>
    O= n Wed, Jul 15, 2020 at 4:56 PM William Denniss <wdenniss=3D40google.com@dmarc.ietf.org> wrote= :
    +1 to finish the work on=C2=A0secevent-subject-identifiers

    =
    On Mon, Ju= l 13, 2020 at 12:35 PM Justin Richer <jricher@mit.edu> wrote:
    +1 to finishing it and I=E2=80=99ll = add my review to the pile this week. Apologies for the delays in doing so.<= div>
    =C2=A0=E2=80=94 Justin

    On Jul 2, 2020, at 6:59 PM, Richard Backman, Annabelle <richa= nna=3D40amazon.com@dmarc.ietf.org> wrote:

    I=E2=80=99d like to hea= r from the working group on whether or not there is interest in completing = the Subject Identifiers draft=C2=A0 within secevents. This work has more or= less been put on hiatus given the chairs=E2=80=99 previous decision not to= continue with it within the working group, but it remains a dependency for= other work, and a number of people within the working group have expressed= interest and support for it previously. If there is support within the wor= king group for resuming and completing Subject Identifiers, then it would s= eem reasonable to me to do so within secevents.
    <= div style=3D"margin:0in 0in 0.0001pt;font-size:12pt;font-family:Calibri,san= s-serif">=C2=A0
    =E2=80=93
    Annabelle Backman (she/= her)
    AWS Identity
    =C2=A0
    =C2=A0=
    id-event-bounces@ietf.= org> on behalf of Yaron Sheffer <yaronf.ietf@gmail..com>
    Date:= =C2=A0Tuesday, June 30, 2020 at 2:06 AM
    To:=C2=A0"id-ev= ent@ietf.org" <id-event@ietf.org>
    Subject:=C2=A0[EXTE= RNAL] [Id-event] Closing the SecEvent working group
    =C2=A0<= u>
    CAUTION: This email originated from out= side of the organization. Do not click links or open attachments unless you= can confirm the sender and know the content is safe.<= /div>
    =C2=A0
    Dear WG participants,
    = As you=E2=80=99ve all seen, our last two deliverables, the SET HTTP deliver= y specs, have both been approved for publication as RFCs.<= /u>
    =C2=A0
    Since the grou= p has now completed its mission, we propose to close it down. Unless there = are objections (accompanied by credible work items) within a week, we will = ask the AD to do just that. Even with the WG shut down, the mailing list wi= ll remain open for relevant discussions.
    =C2=A0
    We would like to thank the auth= ors of the Push and Poll soon-to-be RFCs, Annabelle, Mike, Marius, Morteza = and Anthony. Many thanks also to the many other working group members who c= ontributed to these quality documents.
    =C2=A0
    Regards,
    =C2=A0
    =C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Dick = and Yaron
    _______________________________________________=
    Id-even= t mailing list
    Id-eve= nt@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event<= /div>

    ___________________________________= ____________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event
    --00000000000040669705aa83b9a9-- From nobody Mon Jul 20 14:56:11 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 759A53A0FE4 for ; Mon, 20 Jul 2020 14:56:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k1MG7DWAyJ6T for ; Mon, 20 Jul 2020 14:56:07 -0700 (PDT) Received: from mail-wm1-x330.google.com (mail-wm1-x330.google.com [IPv6:2a00:1450:4864:20::330]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62AD83A0FE3 for ; Mon, 20 Jul 2020 14:56:07 -0700 (PDT) Received: by mail-wm1-x330.google.com with SMTP id o2so941637wmh.2 for ; Mon, 20 Jul 2020 14:56:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=WXqNYQnABUuzWKwiS71mGpIQOOy+5JZCfBBZJKJZgbM=; b=u5qlCtpsSfrFHYK5ZXyDr+/ityOtNp5kvjbk5arCoA5zhirWkldUoxhP3GmGN/cVTv 4IQsCTUfBmFWv3SzYJl37TFSTg5VVcP1T7/evzeAahHVao60oKTkN5d5+Fi3He2ENWRA XY11wNmv/76WF+MM2R4H9/Me7icv6kSUHBvjgBpg+nzfOSj34nABZyoHpWqubVCm82jP cDN+mrukXZLwhASBYIW7nzopO1IRvgI6ziIOZeXv2sihNh0Y0o2vZuab/p4ZXLqHZEpJ 6272ipkMSs3W3120VuyVBSWUD6zE4/UATXkWi5XrWhHDNSXyurFavJethWn09zHlZeBg 8h9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=WXqNYQnABUuzWKwiS71mGpIQOOy+5JZCfBBZJKJZgbM=; b=cYPzA7LcYUo+LpicddvjniJR3Vw8qt10Mql16pkd5mSHfOmJbJpq/oEcUji6TonRNx YxLT3ao5CzkEiyuZqMUbon907CoI3hUe6uG0wCrpTS+iQHxas0KldM/VW98FPWrRHjPJ FoiyXwY5F7oGSlRcj6CrscZkayCj5w0KRF/h4SsoIdXEvW/R22yQF8M3i0R8b+ByyYHV kJl9WuXXHzO3FkunF8+ChjWGkW1T/Adkx54PWz/F6KcKUoJianLII8q1BBu2kQqMY7IS 3/uvp30gVr3zU99qz69wRjCSwGwt+gVR76JMKaPiOh9aJXbbVExIVlLSpAlrcx7CcHFU aHBg== X-Gm-Message-State: AOAM531E6WyIJBtXCE+RlFKCcv7eEKM+U/fwIJRagbJ8CK7dPxI7x4Qp dtp2xPYofX9PBQYSOhTnxhI+tcyoigutkAH6qHVt+5GxXAmywg== X-Google-Smtp-Source: ABdhPJwVYkAlJqLkH45K+Cqj+L7Z49VNmJYujC3KkEBaEXIa72pdFsfEjCH/tqBngxY/UHvnXQqSH4Q5swzWGw2SURE= X-Received: by 2002:a1c:2109:: with SMTP id h9mr1095804wmh.174.1595282164986; Mon, 20 Jul 2020 14:56:04 -0700 (PDT) MIME-Version: 1.0 From: William Denniss Date: Mon, 20 Jul 2020 14:55:53 -0700 Message-ID: To: ID Events Mailing List Content-Type: multipart/alternative; boundary="000000000000c339bd05aae692d2" Archived-At: Subject: [Id-event] Review of Subject Identifiers for Security Event Tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 21:56:09 -0000 --000000000000c339bd05aae692d2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I reviewed Subject Identifiers for Security Event Tokens v05 ( https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05 ). Summary & Benefits: The draft standardizes a way to represent the subjects when they may be of different types (e.g. some with email, some with ID). It does this in a way that allows the type and the value to be encoded together. JWT by itself doesn't define the type of subjects (it's defined as a case-sensitive string containing a StringOrURI value), leaving this to implementers which works in many situations, but can cause problems for the application of JWTs as security events. Also included is a way to present multiple identifiers for the same subject. Standidizing this is relevant in Security Event Token environments like RISC involving multiple parties where some mapping of identifiers between the systems is needed. For example, when two email systems share SETs to mitigate email recovery related risks, one party might identify users by ID, whereas the other by email address. The one-size-fits-all typeless "sub" can fall short in this situation. Traditional use of JWT is unidirectional, with one issuer and multiple consumers whereby the subject itself can be more or less an opaque index. The SET application of JWT sees multiple issuers who consume each other's tokens and need to identify subjects across identity provider boundaries. Being able to communicate the subject type, as well as potentially multiple subject identifiers for the same subject is useful in this type of environment. Using JWT claims without the subject identifier approach defined in this draft, the issuer may put an opaque value in "sub", and an email address in "email", but without a way to indicate what the type of the sub is, or if it's reasonable to use "email" as the subject rather than just an attribute of the user. This draft allows for multiple subject identifiers to be communicated as such and removes the guesswork by consumers as to what should be considered a subject identifier and what should not. Feedback: Abstract: Nit: I normally see RFC's referred to by number, so rather than "within a [JSON] object", I would expect to see "within a JSON [RFC 7159] object". Same for JWT and SET. I think this style reads better, as it separates the name of the draft from the reference. =C2=A7 3: One thing that I feel is missing is an example of a full SET or JWT with the subject identifier. I'm a big believer in examples, as it gives the reader an easy way to picture the final application of what is being specified. Like what we did in RFC 8417, Section 2.1.4: https://tools.ietf.org/html/rfc8417#section-2.1.4. There are some non-normative examples in this draft later for non-SET JWTs, which is great, so I think it would be useful to have ones for SET as well. =C2=A7 3: " A Subject Identifier is a [JSON] object containing a "subject_type" claim" Nit: I'm troubled slightly by the phrase "JSON object containing a claim" here. In JSON terms, these are key/value pairs not "claims" which is a JWT term. I think it's fine for the doc to mostly use "claims", since the context is JWT, but since we're designing a new type here, I'd suggest at first use to say something like "JSON object with multiple key/value pairs representing the subject's claims", after which you can just use "claim". =C2=A7 4.1: Document defines a "sub_id" JWT claim, but it doesn't really explain why or when to use it. I think the doc would benefit from an introduction in this section that talks about why this is a useful construct, and where we expect it to be used. My understanding is that we expect subject identifiers to be used in SETs (e.g. in RISC) and in non-SET JWTs. It makes sense to me to have a "pure JWT" option here, and I'm sure it was added for good reason (including perhaps some that I enumerated in my benefits summary above), I think it would help to have those reasons listed. =C2=A7 6: I feel like there are always security considerations :-) Maybe this could document some of the security considerations of sending subject as JWT claims without using this spec (e.g. that maybe someone could rely on a claim more strongly to identify a subject than was intended). =C2=A7 7: Just a comment: I agree with the choice of "Expert Review" for IANA. "Specification Required" would be too heavyweight here. Best, William --000000000000c339bd05aae692d2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    I reviewed Subject Identifiers for Security Event Tok= ens v05 (https://tools.ietf.org/html/draft-ietf-secevent-su= bject-identifiers-05).

    Summary & Benefits:=

    The draft standardizes a way to represent the sub= jects when they may be of different types (e.g. some with email, some with = ID). It does this in a way that allows the type and the value to be encoded= together. JWT by itself doesn't define the type of subjects (it's = defined as a case-sensitive string containing a StringOrURI value), leaving= this to implementers=C2=A0which works in many situations, but can cause pr= oblems for the application of JWTs as security events. Also included is a w= ay to present multiple identifiers for the same subject. Standidizing this = is relevant in Security Event Token environments like RISC involving multip= le parties where some mapping of identifiers between the systems is needed.= For example, when two email systems share SETs to mitigate email recovery = related risks, one party might identify users by ID, whereas the other by e= mail address. The one-size-fits-all typeless "sub" can fall short= in this situation.

    Traditional use of JWT is unid= irectional, with one issuer and multiple consumers whereby the subject itse= lf can be more or less an opaque=C2=A0index. The SET application of JWT see= s multiple issuers who consume each other's tokens and need to identify= subjects across=C2=A0identity provider boundaries. Being able to communica= te=C2=A0the subject type, as well as potentially multiple subject identifie= rs for the same subject is useful in this type of environment. Using JWT cl= aims without the subject identifier approach defined in this draft, the iss= uer may put an opaque value in "sub", and an email address in &qu= ot;email", but without a way to indicate what the type of the sub is, = or if it's reasonable to use "email" as the subject rather th= an just an attribute of the user. This draft allows for multiple subject id= entifiers to be communicated as such and removes the guesswork by consumers= as to what should be considered a subject identifier and what should not.<= /div>

    Feedback:

    Abstract:
    =

    Nit: I normally see RFC's referred to by number, so= rather than "within a [JSON] object", I would=C2=A0 expect to se= e "within a JSON [RFC 7159] object". Same for JWT and SET. I thin= k this style reads better, as it separates the name of the draft from the r= eference.

    =C2=A7 3:

    One t= hing that I feel is missing is an example of a full SET or JWT with the sub= ject identifier. I'm a big believer in examples, as it gives the reader= an easy way to picture the final application of what is being specified. L= ike what we did in RFC 8417, Section 2.1.4:=C2=A0https://tools.ietf.org/html/rfc8417#sec= tion-2.1.4.=C2=A0 There are some non-normative examples in this draft l= ater for non-SET JWTs, which is great, so I think it would be useful to hav= e ones for SET as well.

    =C2=A7 3:
    "=C2=A0 =C2=A0A Subject Identifier is a [JSON] object con= taining a "subject_type"
    =C2=A0 =C2=A0claim"

    Nit: I'm troubled slightly by the phrase "JSON ob= ject containing a claim" here. In JSON terms, these are key/value pair= s not "claims" which is a JWT term. I think it's fine for the= doc to mostly use "claims", since the context is JWT, but since = we're designing a new type here, I'd suggest at first use to say so= mething like "JSON object with multiple key/value pairs representing t= he subject's claims", after which you can just use "claim&quo= t;.

    =C2=A7 4.1:

    Document defines a "sub_id" JWT claim, but it do= esn't really explain why or when to use it.=C2=A0

    <= div>I think the doc would benefit from an introduction in this section that= talks about why this is a useful construct, and where we expect it to be u= sed. My understanding is that we expect subject=C2=A0identifiers to be used= in SETs=C2=A0 (e.g. in RISC) and in non-SET JWTs.=C2=A0 It makes sense to = me to have a "pure JWT" option here, and I'm sure it was adde= d for good reason (including perhaps some that I enumerated in my benefits = summary above), I think it would help to have those reasons listed.
    =C2=A7 6:

    <= div>I feel like there are always security considerations :-)

    =
    Maybe this could document some of the security considerations of= sending subject as JWT claims without using this spec (e.g. that maybe som= eone could rely on a claim more strongly to identify a subject than was int= ended).

    =C2=A7 7:
    <= div>
    Just a comment: I agree with the choice of "Expert = Review" for IANA. "Specification Required" would be too heav= yweight here.


    Best,
    Willi= am

    --000000000000c339bd05aae692d2-- From nobody Mon Jul 20 15:50:30 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AB1A3A106C for ; Mon, 20 Jul 2020 15:50:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.6 X-Spam-Level: X-Spam-Status: No, score=-9.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7LPITfNacSrn for ; Mon, 20 Jul 2020 15:50:26 -0700 (PDT) Received: from smtp-fw-9102.amazon.com (smtp-fw-9102.amazon.com [207.171.184.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C1573A106F for ; Mon, 20 Jul 2020 15:50:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1595285427; x=1626821427; h=from:to:date:message-id:references:in-reply-to: mime-version:subject; bh=/Rm5e1tp4FHxbF/S/iQAyfu3espZ0jDMQTnZX55/7WY=; b=MulwZxYRfZddrJHXysfunxNvyMbCcodhesXjfS4+1T73DL9Ql9ifFURB iSKF654sWiZ4lMjAajwVuz/6F5rkm4zCYhkOzYE42izmNhfcx9mUvn1f9 sOKu5uC1NXlE2I6yXqv8tEUpCQb0TEz9WGuQ/YNkHdGaevueEfWYK+4Ib s=; IronPort-SDR: xMkdHQilXG4VxPxrGJcvx/sUQQrldJwRcyAOaw1TWnk1aIL4fFmsUD+zjn1pm8/RFfhwMl5qxH Rxee84sSl1YQ== X-IronPort-AV: E=Sophos; i="5.75,375,1589241600"; d="scan'208,217"; a="61307086" Thread-Topic: [Id-event] Review of Subject Identifiers for Security Event Tokens Received: from sea32-co-svc-lb4-vlan3.sea.corp.amazon.com (HELO email-inbound-relay-2b-4e24fd92.us-west-2.amazon.com) ([10.47.23.38]) by smtp-border-fw-out-9102.sea19.amazon.com with ESMTP; 20 Jul 2020 22:50:24 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan2.pdx.amazon.com [10.170.41.162]) by email-inbound-relay-2b-4e24fd92.us-west-2.amazon.com (Postfix) with ESMTPS id B8D98A1FE2; Mon, 20 Jul 2020 22:50:23 +0000 (UTC) Received: from EX13D11UWC001.ant.amazon.com (10.43.162.151) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 20 Jul 2020 22:50:23 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC001.ant.amazon.com (10.43.162.151) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 20 Jul 2020 22:50:22 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Mon, 20 Jul 2020 22:50:22 +0000 From: "Richard Backman, Annabelle" To: William Denniss , "ID Events Mailing List" Thread-Index: AQHWXuCpR57/OAA87kmVNa/pRTO+fakQnTIA Date: Mon, 20 Jul 2020 22:50:22 +0000 Message-ID: <3F52CB79-3003-4862-B1C8-95DAE38FC9B4@amazon.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.65] Content-Type: multipart/alternative; boundary="_000_3F52CB7930034862B1C895DAE38FC9B4amazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Review of Subject Identifiers for Security Event Tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 22:50:29 -0000 --_000_3F52CB7930034862B1C895DAE38FC9B4amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmsgeW91IGZvciB0aGUgcmV2aWV3LCBXaWxsaWFtLiBObyBpbmxpbmUgY29tbWVudHMgb3Ig cXVlc3Rpb25zIGZyb20gbWUsIGFzIEkgYWdyZWUgd2l0aCBhbGwgb2YgeW91ciBmZWVkYmFjay4g OikNCg0K4oCTDQpBbm5hYmVsbGUgQmFja21hbiAoc2hlL2hlcikNCkFXUyBJZGVudGl0eQ0KaHR0 cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS8NCg0KDQpGcm9tOiBJZC1ldmVudCA8aWQtZXZl bnQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIFdpbGxpYW0gRGVubmlzcyA8d2Rlbm5p c3M9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPg0KRGF0ZTogTW9uZGF5LCBKdWx5IDIwLCAy MDIwIGF0IDI6NTYgUE0NClRvOiBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRm Lm9yZz4NClN1YmplY3Q6IFtFWFRFUk5BTF0gW0lkLWV2ZW50XSBSZXZpZXcgb2YgU3ViamVjdCBJ ZGVudGlmaWVycyBmb3IgU2VjdXJpdHkgRXZlbnQgVG9rZW5zDQoNCg0KQ0FVVElPTjogVGhpcyBl bWFpbCBvcmlnaW5hdGVkIGZyb20gb3V0c2lkZSBvZiB0aGUgb3JnYW5pemF0aW9uLiBEbyBub3Qg Y2xpY2sgbGlua3Mgb3Igb3BlbiBhdHRhY2htZW50cyB1bmxlc3MgeW91IGNhbiBjb25maXJtIHRo ZSBzZW5kZXIgYW5kIGtub3cgdGhlIGNvbnRlbnQgaXMgc2FmZS4NCg0KDQpJIHJldmlld2VkIFN1 YmplY3QgSWRlbnRpZmllcnMgZm9yIFNlY3VyaXR5IEV2ZW50IFRva2VucyB2MDUgKGh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXN1YmplY3QtaWRlbnRpZmll cnMtMDU8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtc3Vi amVjdC1pZGVudGlmaWVycy0wNSNyZWYtSldUPikuDQoNClN1bW1hcnkgJiBCZW5lZml0czoNCg0K VGhlIGRyYWZ0IHN0YW5kYXJkaXplcyBhIHdheSB0byByZXByZXNlbnQgdGhlIHN1YmplY3RzIHdo ZW4gdGhleSBtYXkgYmUgb2YgZGlmZmVyZW50IHR5cGVzIChlLmcuIHNvbWUgd2l0aCBlbWFpbCwg c29tZSB3aXRoIElEKS4gSXQgZG9lcyB0aGlzIGluIGEgd2F5IHRoYXQgYWxsb3dzIHRoZSB0eXBl IGFuZCB0aGUgdmFsdWUgdG8gYmUgZW5jb2RlZCB0b2dldGhlci4gSldUIGJ5IGl0c2VsZiBkb2Vz bid0IGRlZmluZSB0aGUgdHlwZSBvZiBzdWJqZWN0cyAoaXQncyBkZWZpbmVkIGFzIGEgY2FzZS1z ZW5zaXRpdmUgc3RyaW5nIGNvbnRhaW5pbmcgYSBTdHJpbmdPclVSSSB2YWx1ZSksIGxlYXZpbmcg dGhpcyB0byBpbXBsZW1lbnRlcnMgd2hpY2ggd29ya3MgaW4gbWFueSBzaXR1YXRpb25zLCBidXQg Y2FuIGNhdXNlIHByb2JsZW1zIGZvciB0aGUgYXBwbGljYXRpb24gb2YgSldUcyBhcyBzZWN1cml0 eSBldmVudHMuIEFsc28gaW5jbHVkZWQgaXMgYSB3YXkgdG8gcHJlc2VudCBtdWx0aXBsZSBpZGVu dGlmaWVycyBmb3IgdGhlIHNhbWUgc3ViamVjdC4gU3RhbmRpZGl6aW5nIHRoaXMgaXMgcmVsZXZh bnQgaW4gU2VjdXJpdHkgRXZlbnQgVG9rZW4gZW52aXJvbm1lbnRzIGxpa2UgUklTQyBpbnZvbHZp bmcgbXVsdGlwbGUgcGFydGllcyB3aGVyZSBzb21lIG1hcHBpbmcgb2YgaWRlbnRpZmllcnMgYmV0 d2VlbiB0aGUgc3lzdGVtcyBpcyBuZWVkZWQuIEZvciBleGFtcGxlLCB3aGVuIHR3byBlbWFpbCBz eXN0ZW1zIHNoYXJlIFNFVHMgdG8gbWl0aWdhdGUgZW1haWwgcmVjb3ZlcnkgcmVsYXRlZCByaXNr cywgb25lIHBhcnR5IG1pZ2h0IGlkZW50aWZ5IHVzZXJzIGJ5IElELCB3aGVyZWFzIHRoZSBvdGhl ciBieSBlbWFpbCBhZGRyZXNzLiBUaGUgb25lLXNpemUtZml0cy1hbGwgdHlwZWxlc3MgInN1YiIg Y2FuIGZhbGwgc2hvcnQgaW4gdGhpcyBzaXR1YXRpb24uDQoNClRyYWRpdGlvbmFsIHVzZSBvZiBK V1QgaXMgdW5pZGlyZWN0aW9uYWwsIHdpdGggb25lIGlzc3VlciBhbmQgbXVsdGlwbGUgY29uc3Vt ZXJzIHdoZXJlYnkgdGhlIHN1YmplY3QgaXRzZWxmIGNhbiBiZSBtb3JlIG9yIGxlc3MgYW4gb3Bh cXVlIGluZGV4LiBUaGUgU0VUIGFwcGxpY2F0aW9uIG9mIEpXVCBzZWVzIG11bHRpcGxlIGlzc3Vl cnMgd2hvIGNvbnN1bWUgZWFjaCBvdGhlcidzIHRva2VucyBhbmQgbmVlZCB0byBpZGVudGlmeSBz dWJqZWN0cyBhY3Jvc3MgaWRlbnRpdHkgcHJvdmlkZXIgYm91bmRhcmllcy4gQmVpbmcgYWJsZSB0 byBjb21tdW5pY2F0ZSB0aGUgc3ViamVjdCB0eXBlLCBhcyB3ZWxsIGFzIHBvdGVudGlhbGx5IG11 bHRpcGxlIHN1YmplY3QgaWRlbnRpZmllcnMgZm9yIHRoZSBzYW1lIHN1YmplY3QgaXMgdXNlZnVs IGluIHRoaXMgdHlwZSBvZiBlbnZpcm9ubWVudC4gVXNpbmcgSldUIGNsYWltcyB3aXRob3V0IHRo ZSBzdWJqZWN0IGlkZW50aWZpZXIgYXBwcm9hY2ggZGVmaW5lZCBpbiB0aGlzIGRyYWZ0LCB0aGUg aXNzdWVyIG1heSBwdXQgYW4gb3BhcXVlIHZhbHVlIGluICJzdWIiLCBhbmQgYW4gZW1haWwgYWRk cmVzcyBpbiAiZW1haWwiLCBidXQgd2l0aG91dCBhIHdheSB0byBpbmRpY2F0ZSB3aGF0IHRoZSB0 eXBlIG9mIHRoZSBzdWIgaXMsIG9yIGlmIGl0J3MgcmVhc29uYWJsZSB0byB1c2UgImVtYWlsIiBh cyB0aGUgc3ViamVjdCByYXRoZXIgdGhhbiBqdXN0IGFuIGF0dHJpYnV0ZSBvZiB0aGUgdXNlci4g VGhpcyBkcmFmdCBhbGxvd3MgZm9yIG11bHRpcGxlIHN1YmplY3QgaWRlbnRpZmllcnMgdG8gYmUg Y29tbXVuaWNhdGVkIGFzIHN1Y2ggYW5kIHJlbW92ZXMgdGhlIGd1ZXNzd29yayBieSBjb25zdW1l cnMgYXMgdG8gd2hhdCBzaG91bGQgYmUgY29uc2lkZXJlZCBhIHN1YmplY3QgaWRlbnRpZmllciBh bmQgd2hhdCBzaG91bGQgbm90Lg0KDQpGZWVkYmFjazoNCg0KQWJzdHJhY3Q6DQoNCk5pdDogSSBu b3JtYWxseSBzZWUgUkZDJ3MgcmVmZXJyZWQgdG8gYnkgbnVtYmVyLCBzbyByYXRoZXIgdGhhbiAi d2l0aGluIGEgW0pTT05dIG9iamVjdCIsIEkgd291bGQgIGV4cGVjdCB0byBzZWUgIndpdGhpbiBh IEpTT04gW1JGQyA3MTU5XSBvYmplY3QiLiBTYW1lIGZvciBKV1QgYW5kIFNFVC4gSSB0aGluayB0 aGlzIHN0eWxlIHJlYWRzIGJldHRlciwgYXMgaXQgc2VwYXJhdGVzIHRoZSBuYW1lIG9mIHRoZSBk cmFmdCBmcm9tIHRoZSByZWZlcmVuY2UuDQoNCsKnIDM6DQoNCk9uZSB0aGluZyB0aGF0IEkgZmVl bCBpcyBtaXNzaW5nIGlzIGFuIGV4YW1wbGUgb2YgYSBmdWxsIFNFVCBvciBKV1Qgd2l0aCB0aGUg c3ViamVjdCBpZGVudGlmaWVyLiBJJ20gYSBiaWcgYmVsaWV2ZXIgaW4gZXhhbXBsZXMsIGFzIGl0 IGdpdmVzIHRoZSByZWFkZXIgYW4gZWFzeSB3YXkgdG8gcGljdHVyZSB0aGUgZmluYWwgYXBwbGlj YXRpb24gb2Ygd2hhdCBpcyBiZWluZyBzcGVjaWZpZWQuIExpa2Ugd2hhdCB3ZSBkaWQgaW4gUkZD IDg0MTcsIFNlY3Rpb24gMi4xLjQ6IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4NDE3 I3NlY3Rpb24tMi4xLjQuICBUaGVyZSBhcmUgc29tZSBub24tbm9ybWF0aXZlIGV4YW1wbGVzIGlu IHRoaXMgZHJhZnQgbGF0ZXIgZm9yIG5vbi1TRVQgSldUcywgd2hpY2ggaXMgZ3JlYXQsIHNvIEkg dGhpbmsgaXQgd291bGQgYmUgdXNlZnVsIHRvIGhhdmUgb25lcyBmb3IgU0VUIGFzIHdlbGwuDQoN CsKnIDM6DQoNCiIgICBBIFN1YmplY3QgSWRlbnRpZmllciBpcyBhIFtKU09OXSBvYmplY3QgY29u dGFpbmluZyBhICJzdWJqZWN0X3R5cGUiDQogICBjbGFpbSINCg0KTml0OiBJJ20gdHJvdWJsZWQg c2xpZ2h0bHkgYnkgdGhlIHBocmFzZSAiSlNPTiBvYmplY3QgY29udGFpbmluZyBhIGNsYWltIiBo ZXJlLiBJbiBKU09OIHRlcm1zLCB0aGVzZSBhcmUga2V5L3ZhbHVlIHBhaXJzIG5vdCAiY2xhaW1z IiB3aGljaCBpcyBhIEpXVCB0ZXJtLiBJIHRoaW5rIGl0J3MgZmluZSBmb3IgdGhlIGRvYyB0byBt b3N0bHkgdXNlICJjbGFpbXMiLCBzaW5jZSB0aGUgY29udGV4dCBpcyBKV1QsIGJ1dCBzaW5jZSB3 ZSdyZSBkZXNpZ25pbmcgYSBuZXcgdHlwZSBoZXJlLCBJJ2Qgc3VnZ2VzdCBhdCBmaXJzdCB1c2Ug dG8gc2F5IHNvbWV0aGluZyBsaWtlICJKU09OIG9iamVjdCB3aXRoIG11bHRpcGxlIGtleS92YWx1 ZSBwYWlycyByZXByZXNlbnRpbmcgdGhlIHN1YmplY3QncyBjbGFpbXMiLCBhZnRlciB3aGljaCB5 b3UgY2FuIGp1c3QgdXNlICJjbGFpbSIuDQoNCsKnIDQuMToNCg0KRG9jdW1lbnQgZGVmaW5lcyBh ICJzdWJfaWQiIEpXVCBjbGFpbSwgYnV0IGl0IGRvZXNuJ3QgcmVhbGx5IGV4cGxhaW4gd2h5IG9y IHdoZW4gdG8gdXNlIGl0Lg0KDQpJIHRoaW5rIHRoZSBkb2Mgd291bGQgYmVuZWZpdCBmcm9tIGFu IGludHJvZHVjdGlvbiBpbiB0aGlzIHNlY3Rpb24gdGhhdCB0YWxrcyBhYm91dCB3aHkgdGhpcyBp cyBhIHVzZWZ1bCBjb25zdHJ1Y3QsIGFuZCB3aGVyZSB3ZSBleHBlY3QgaXQgdG8gYmUgdXNlZC4g TXkgdW5kZXJzdGFuZGluZyBpcyB0aGF0IHdlIGV4cGVjdCBzdWJqZWN0IGlkZW50aWZpZXJzIHRv IGJlIHVzZWQgaW4gU0VUcyAgKGUuZy4gaW4gUklTQykgYW5kIGluIG5vbi1TRVQgSldUcy4gIEl0 IG1ha2VzIHNlbnNlIHRvIG1lIHRvIGhhdmUgYSAicHVyZSBKV1QiIG9wdGlvbiBoZXJlLCBhbmQg SSdtIHN1cmUgaXQgd2FzIGFkZGVkIGZvciBnb29kIHJlYXNvbiAoaW5jbHVkaW5nIHBlcmhhcHMg c29tZSB0aGF0IEkgZW51bWVyYXRlZCBpbiBteSBiZW5lZml0cyBzdW1tYXJ5IGFib3ZlKSwgSSB0 aGluayBpdCB3b3VsZCBoZWxwIHRvIGhhdmUgdGhvc2UgcmVhc29ucyBsaXN0ZWQuDQoNCsKnIDY6 DQoNCkkgZmVlbCBsaWtlIHRoZXJlIGFyZSBhbHdheXMgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMg Oi0pDQoNCk1heWJlIHRoaXMgY291bGQgZG9jdW1lbnQgc29tZSBvZiB0aGUgc2VjdXJpdHkgY29u c2lkZXJhdGlvbnMgb2Ygc2VuZGluZyBzdWJqZWN0IGFzIEpXVCBjbGFpbXMgd2l0aG91dCB1c2lu ZyB0aGlzIHNwZWMgKGUuZy4gdGhhdCBtYXliZSBzb21lb25lIGNvdWxkIHJlbHkgb24gYSBjbGFp bSBtb3JlIHN0cm9uZ2x5IHRvIGlkZW50aWZ5IGEgc3ViamVjdCB0aGFuIHdhcyBpbnRlbmRlZCku DQoNCsKnIDc6DQoNCkp1c3QgYSBjb21tZW50OiBJIGFncmVlIHdpdGggdGhlIGNob2ljZSBvZiAi RXhwZXJ0IFJldmlldyIgZm9yIElBTkEuICJTcGVjaWZpY2F0aW9uIFJlcXVpcmVkIiB3b3VsZCBi ZSB0b28gaGVhdnl3ZWlnaHQgaGVyZS4NCg0KDQpCZXN0LA0KV2lsbGlhbQ0KDQo= --_000_3F52CB7930034862B1C895DAE38FC9B4amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <99A6C4D8CFFF2B49B986A5C4E682BDB0@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiTVMgTWluY2hvIjsNCglwYW5vc2UtMToyIDIgNiA5IDQgMiA1IDgg MyA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3Nl LTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGli cmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250 LWZhbWlseToiXEBNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0K LyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5N c29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1z aXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmss IHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUt dHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9u MQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47 fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0K PC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0K PGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rIHlv dSBmb3IgdGhlIHJldmlldywgV2lsbGlhbS4gTm8gaW5saW5lIGNvbW1lbnRzIG9yIHF1ZXN0aW9u cyBmcm9tIG1lLCBhcyBJIGFncmVlIHdpdGggYWxsIG9mIHlvdXIgZmVlZGJhY2suIDopPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ 4oCTPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkFubmFiZWxsZSBCYWNrbWFuIChzaGUvaGVyKTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij5BV1MgSWRlbnRpdHk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PGEgaHJlZj0iaHR0cHM6 Ly9hd3MuYW1hem9uLmNvbS9pZGVudGl0eS8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDU2M0MxIj5o dHRwczovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5Lzwvc3Bhbj48L2E+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4w cHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9t Og0KPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+ SWQtZXZlbnQgJmx0O2lkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7IG9uIGJlaGFsZiBvZiBX aWxsaWFtIERlbm5pc3MgJmx0O3dkZW5uaXNzPTQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9yZyZn dDs8YnI+DQo8Yj5EYXRlOiA8L2I+TW9uZGF5LCBKdWx5IDIwLCAyMDIwIGF0IDI6NTYgUE08YnI+ DQo8Yj5UbzogPC9iPklEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0O2lkLWV2ZW50QGlldGYub3Jn Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5bRVhURVJOQUxdIFtJZC1ldmVudF0gUmV2aWV3IG9m IFN1YmplY3QgSWRlbnRpZmllcnMgZm9yIFNlY3VyaXR5IEV2ZW50IFRva2VuczxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjx0 YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNl bGxwYWRkaW5nPSIwIiB3aWR0aD0iNjIyIiBzdHlsZT0id2lkdGg6NDY2LjVwdDttYXJnaW4tbGVm dDouNWluO2JvcmRlci1jb2xsYXBzZTpjb2xsYXBzZSI+DQo8dGJvZHk+DQo8dHIgc3R5bGU9Imhl aWdodDoxNS4yNXB0Ij4NCjx0ZCB3aWR0aD0iNjIyIiB2YWxpZ249InRvcCIgc3R5bGU9IndpZHRo OjQ2Ni41cHQ7Ym9yZGVyOnNvbGlkICNFRDdEMzEgMS41cHQ7cGFkZGluZzowaW4gNS40cHQgMGlu IDUuNHB0O2hlaWdodDoxNS4yNXB0Ij4NCjxwPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjaztiYWNrZ3JvdW5k OiNGRkZGOTkiPkNBVVRJT048L3NwYW4+PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr O2JhY2tncm91bmQ6I0ZGRkY5OSI+OiBUaGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRl IG9mIHRoZSBvcmdhbml6YXRpb24uIERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1l bnRzIHVubGVzcw0KIHlvdSBjYW4gY29uZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250 ZW50IGlzIHNhZmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5 Pg0KPC90YWJsZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkkgcmV2aWV3ZWQgU3Vi amVjdCBJZGVudGlmaWVycyBmb3IgU2VjdXJpdHkgRXZlbnQgVG9rZW5zIHYwNSAoPGEgaHJlZj0i aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtc3ViamVjdC1p ZGVudGlmaWVycy0wNSNyZWYtSldUIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt aWV0Zi1zZWNldmVudC1zdWJqZWN0LWlkZW50aWZpZXJzLTA1PC9hPikuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+U3VtbWFyeSAmYW1wOyBCZW5lZml0czo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5UaGUgZHJhZnQg c3RhbmRhcmRpemVzIGEgd2F5IHRvIHJlcHJlc2VudCB0aGUgc3ViamVjdHMgd2hlbiB0aGV5IG1h eSBiZSBvZiBkaWZmZXJlbnQgdHlwZXMgKGUuZy4gc29tZSB3aXRoIGVtYWlsLCBzb21lIHdpdGgg SUQpLiBJdCBkb2VzIHRoaXMgaW4gYSB3YXkgdGhhdCBhbGxvd3MgdGhlIHR5cGUgYW5kIHRoZSB2 YWx1ZSB0byBiZSBlbmNvZGVkIHRvZ2V0aGVyLiBKV1QNCiBieSBpdHNlbGYgZG9lc24ndCBkZWZp bmUgdGhlIHR5cGUgb2Ygc3ViamVjdHMgKGl0J3MgZGVmaW5lZCBhcyBhIGNhc2Utc2Vuc2l0aXZl IHN0cmluZyBjb250YWluaW5nIGEgU3RyaW5nT3JVUkkgdmFsdWUpLCBsZWF2aW5nIHRoaXMgdG8g aW1wbGVtZW50ZXJzJm5ic3A7d2hpY2ggd29ya3MgaW4gbWFueSBzaXR1YXRpb25zLCBidXQgY2Fu IGNhdXNlIHByb2JsZW1zIGZvciB0aGUgYXBwbGljYXRpb24gb2YgSldUcyBhcyBzZWN1cml0eSBl dmVudHMuIEFsc28NCiBpbmNsdWRlZCBpcyBhIHdheSB0byBwcmVzZW50IG11bHRpcGxlIGlkZW50 aWZpZXJzIGZvciB0aGUgc2FtZSBzdWJqZWN0LiBTdGFuZGlkaXppbmcgdGhpcyBpcyByZWxldmFu dCBpbiBTZWN1cml0eSBFdmVudCBUb2tlbiBlbnZpcm9ubWVudHMgbGlrZSBSSVNDIGludm9sdmlu ZyBtdWx0aXBsZSBwYXJ0aWVzIHdoZXJlIHNvbWUgbWFwcGluZyBvZiBpZGVudGlmaWVycyBiZXR3 ZWVuIHRoZSBzeXN0ZW1zIGlzIG5lZWRlZC4gRm9yIGV4YW1wbGUsIHdoZW4NCiB0d28gZW1haWwg c3lzdGVtcyBzaGFyZSBTRVRzIHRvIG1pdGlnYXRlIGVtYWlsIHJlY292ZXJ5IHJlbGF0ZWQgcmlz a3MsIG9uZSBwYXJ0eSBtaWdodCBpZGVudGlmeSB1c2VycyBieSBJRCwgd2hlcmVhcyB0aGUgb3Ro ZXIgYnkgZW1haWwgYWRkcmVzcy4gVGhlIG9uZS1zaXplLWZpdHMtYWxsIHR5cGVsZXNzICZxdW90 O3N1YiZxdW90OyBjYW4gZmFsbCBzaG9ydCBpbiB0aGlzIHNpdHVhdGlvbi48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5UcmFkaXRpb25hbCB1c2Ugb2YgSldU IGlzIHVuaWRpcmVjdGlvbmFsLCB3aXRoIG9uZSBpc3N1ZXIgYW5kIG11bHRpcGxlIGNvbnN1bWVy cyB3aGVyZWJ5IHRoZSBzdWJqZWN0IGl0c2VsZiBjYW4gYmUgbW9yZSBvciBsZXNzIGFuIG9wYXF1 ZSZuYnNwO2luZGV4LiBUaGUgU0VUIGFwcGxpY2F0aW9uIG9mIEpXVCBzZWVzIG11bHRpcGxlIGlz c3VlcnMgd2hvIGNvbnN1bWUgZWFjaA0KIG90aGVyJ3MgdG9rZW5zIGFuZCBuZWVkIHRvIGlkZW50 aWZ5IHN1YmplY3RzIGFjcm9zcyZuYnNwO2lkZW50aXR5IHByb3ZpZGVyIGJvdW5kYXJpZXMuIEJl aW5nIGFibGUgdG8gY29tbXVuaWNhdGUmbmJzcDt0aGUgc3ViamVjdCB0eXBlLCBhcyB3ZWxsIGFz IHBvdGVudGlhbGx5IG11bHRpcGxlIHN1YmplY3QgaWRlbnRpZmllcnMgZm9yIHRoZSBzYW1lIHN1 YmplY3QgaXMgdXNlZnVsIGluIHRoaXMgdHlwZSBvZiBlbnZpcm9ubWVudC4gVXNpbmcgSldUIGNs YWltcyB3aXRob3V0DQogdGhlIHN1YmplY3QgaWRlbnRpZmllciBhcHByb2FjaCBkZWZpbmVkIGlu IHRoaXMgZHJhZnQsIHRoZSBpc3N1ZXIgbWF5IHB1dCBhbiBvcGFxdWUgdmFsdWUgaW4gJnF1b3Q7 c3ViJnF1b3Q7LCBhbmQgYW4gZW1haWwgYWRkcmVzcyBpbiAmcXVvdDtlbWFpbCZxdW90OywgYnV0 IHdpdGhvdXQgYSB3YXkgdG8gaW5kaWNhdGUgd2hhdCB0aGUgdHlwZSBvZiB0aGUgc3ViIGlzLCBv ciBpZiBpdCdzIHJlYXNvbmFibGUgdG8gdXNlICZxdW90O2VtYWlsJnF1b3Q7IGFzIHRoZSBzdWJq ZWN0IHJhdGhlciB0aGFuDQoganVzdCBhbiBhdHRyaWJ1dGUgb2YgdGhlIHVzZXIuIFRoaXMgZHJh ZnQgYWxsb3dzIGZvciBtdWx0aXBsZSBzdWJqZWN0IGlkZW50aWZpZXJzIHRvIGJlIGNvbW11bmlj YXRlZCBhcyBzdWNoIGFuZCByZW1vdmVzIHRoZSBndWVzc3dvcmsgYnkgY29uc3VtZXJzIGFzIHRv IHdoYXQgc2hvdWxkIGJlIGNvbnNpZGVyZWQgYSBzdWJqZWN0IGlkZW50aWZpZXIgYW5kIHdoYXQg c2hvdWxkIG5vdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij5GZWVkYmFjazo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij5BYnN0cmFjdDo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij5OaXQ6IEkgbm9ybWFsbHkgc2VlIFJGQydzIHJlZmVycmVkIHRvIGJ5IG51bWJlciwgc28gcmF0 aGVyIHRoYW4gJnF1b3Q7d2l0aGluIGEgW0pTT05dIG9iamVjdCZxdW90OywgSSB3b3VsZCZuYnNw OyBleHBlY3QgdG8gc2VlICZxdW90O3dpdGhpbiBhIEpTT04gW1JGQyA3MTU5XSBvYmplY3QmcXVv dDsuIFNhbWUgZm9yIEpXVCBhbmQgU0VULiBJIHRoaW5rIHRoaXMgc3R5bGUgcmVhZHMgYmV0dGVy LCBhcyBpdCBzZXBhcmF0ZXMNCiB0aGUgbmFtZSBvZiB0aGUgZHJhZnQgZnJvbSB0aGUgcmVmZXJl bmNlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPsKnIDM6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+T25lIHRoaW5n IHRoYXQgSSBmZWVsIGlzIG1pc3NpbmcgaXMgYW4gZXhhbXBsZSBvZiBhIGZ1bGwgU0VUIG9yIEpX VCB3aXRoIHRoZSBzdWJqZWN0IGlkZW50aWZpZXIuIEknbSBhIGJpZyBiZWxpZXZlciBpbiBleGFt cGxlcywgYXMgaXQgZ2l2ZXMgdGhlIHJlYWRlciBhbiBlYXN5IHdheSB0byBwaWN0dXJlIHRoZSBm aW5hbCBhcHBsaWNhdGlvbiBvZiB3aGF0IGlzIGJlaW5nDQogc3BlY2lmaWVkLiBMaWtlIHdoYXQg d2UgZGlkIGluIFJGQyA4NDE3LCBTZWN0aW9uIDIuMS40OiZuYnNwOzxhIGhyZWY9Imh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4NDE3I3NlY3Rpb24tMi4xLjQiPmh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9yZmM4NDE3I3NlY3Rpb24tMi4xLjQ8L2E+LiZuYnNwOyBUaGVyZSBhcmUg c29tZSBub24tbm9ybWF0aXZlIGV4YW1wbGVzIGluIHRoaXMgZHJhZnQgbGF0ZXIgZm9yIG5vbi1T RVQgSldUcywgd2hpY2ggaXMNCiBncmVhdCwgc28gSSB0aGluayBpdCB3b3VsZCBiZSB1c2VmdWwg dG8gaGF2ZSBvbmVzIGZvciBTRVQgYXMgd2VsbC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj7CpyAzOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPiZxdW90OyZuYnNwOyAmbmJzcDtBIFN1YmplY3QgSWRlbnRpZmllciBp cyBhIFtKU09OXSBvYmplY3QgY29udGFpbmluZyBhICZxdW90O3N1YmplY3RfdHlwZSZxdW90Ozxi cj4NCiZuYnNwOyAmbmJzcDtjbGFpbSZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPk5pdDogSSdtIHRyb3VibGVkIHNsaWdodGx5IGJ5IHRoZSBwaHJh c2UgJnF1b3Q7SlNPTiBvYmplY3QgY29udGFpbmluZyBhIGNsYWltJnF1b3Q7IGhlcmUuIEluIEpT T04gdGVybXMsIHRoZXNlIGFyZSBrZXkvdmFsdWUgcGFpcnMgbm90ICZxdW90O2NsYWltcyZxdW90 OyB3aGljaCBpcyBhIEpXVCB0ZXJtLiBJIHRoaW5rIGl0J3MgZmluZSBmb3IgdGhlIGRvYyB0byBt b3N0bHkgdXNlICZxdW90O2NsYWltcyZxdW90Oywgc2luY2UNCiB0aGUgY29udGV4dCBpcyBKV1Qs IGJ1dCBzaW5jZSB3ZSdyZSBkZXNpZ25pbmcgYSBuZXcgdHlwZSBoZXJlLCBJJ2Qgc3VnZ2VzdCBh dCBmaXJzdCB1c2UgdG8gc2F5IHNvbWV0aGluZyBsaWtlICZxdW90O0pTT04gb2JqZWN0IHdpdGgg bXVsdGlwbGUga2V5L3ZhbHVlIHBhaXJzIHJlcHJlc2VudGluZyB0aGUgc3ViamVjdCdzIGNsYWlt cyZxdW90OywgYWZ0ZXIgd2hpY2ggeW91IGNhbiBqdXN0IHVzZSAmcXVvdDtjbGFpbSZxdW90Oy48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+wqcg NC4xOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+RG9jdW1lbnQgZGVmaW5lcyBhICZxdW90O3N1Yl9pZCZxdW90OyBKV1QgY2xhaW0sIGJ1dCBp dCBkb2Vzbid0IHJlYWxseSBleHBsYWluIHdoeSBvciB3aGVuIHRvIHVzZSBpdC4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5JIHRoaW5rIHRoZSBk b2Mgd291bGQgYmVuZWZpdCBmcm9tIGFuIGludHJvZHVjdGlvbiBpbiB0aGlzIHNlY3Rpb24gdGhh dCB0YWxrcyBhYm91dCB3aHkgdGhpcyBpcyBhIHVzZWZ1bCBjb25zdHJ1Y3QsIGFuZCB3aGVyZSB3 ZSBleHBlY3QgaXQgdG8gYmUgdXNlZC4gTXkgdW5kZXJzdGFuZGluZyBpcyB0aGF0IHdlIGV4cGVj dCBzdWJqZWN0Jm5ic3A7aWRlbnRpZmllcnMgdG8gYmUNCiB1c2VkIGluIFNFVHMmbmJzcDsgKGUu Zy4gaW4gUklTQykgYW5kIGluIG5vbi1TRVQgSldUcy4mbmJzcDsgSXQgbWFrZXMgc2Vuc2UgdG8g bWUgdG8gaGF2ZSBhICZxdW90O3B1cmUgSldUJnF1b3Q7IG9wdGlvbiBoZXJlLCBhbmQgSSdtIHN1 cmUgaXQgd2FzIGFkZGVkIGZvciBnb29kIHJlYXNvbiAoaW5jbHVkaW5nIHBlcmhhcHMgc29tZSB0 aGF0IEkgZW51bWVyYXRlZCBpbiBteSBiZW5lZml0cyBzdW1tYXJ5IGFib3ZlKSwgSSB0aGluayBp dCB3b3VsZCBoZWxwIHRvIGhhdmUgdGhvc2UNCiByZWFzb25zIGxpc3RlZC48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj7CpyA2OjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkkgZmVlbCBsaWtlIHRoZXJlIGFyZSBhbHdh eXMgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgOi0pPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+TWF5YmUgdGhpcyBjb3VsZCBkb2N1bWVudCBzb21lIG9mIHRo ZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBvZiBzZW5kaW5nIHN1YmplY3QgYXMgSldUIGNsYWlt cyB3aXRob3V0IHVzaW5nIHRoaXMgc3BlYyAoZS5nLiB0aGF0IG1heWJlIHNvbWVvbmUgY291bGQg cmVseSBvbiBhIGNsYWltIG1vcmUgc3Ryb25nbHkgdG8gaWRlbnRpZnkgYSBzdWJqZWN0IHRoYW4g d2FzDQogaW50ZW5kZWQpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj7CpyA3OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+SnVzdCBhIGNvbW1lbnQ6IEkgYWdyZWUgd2l0aCB0aGUgY2hvaWNl IG9mICZxdW90O0V4cGVydCBSZXZpZXcmcXVvdDsgZm9yIElBTkEuICZxdW90O1NwZWNpZmljYXRp b24gUmVxdWlyZWQmcXVvdDsgd291bGQgYmUgdG9vIGhlYXZ5d2VpZ2h0IGhlcmUuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+QmVzdCw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5XaWxsaWFtPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_3F52CB7930034862B1C895DAE38FC9B4amazoncom_-- From nobody Tue Jul 28 12:29:29 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 730E43A0AB3 for ; Tue, 28 Jul 2020 12:29:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1h9yWZ6Vhv3X for ; Tue, 28 Jul 2020 12:29:22 -0700 (PDT) Received: from mail-lf1-x132.google.com (mail-lf1-x132.google.com [IPv6:2a00:1450:4864:20::132]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92F113A0BA1 for ; Tue, 28 Jul 2020 12:29:22 -0700 (PDT) Received: by mail-lf1-x132.google.com with SMTP id i19so11634060lfj.8 for ; Tue, 28 Jul 2020 12:29:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=BS/nrwsRAd/lw5ZwCrVjDpmVaxZajWM1Eul3PsA8EiA=; b=NGMTlK2oCItq2ozow1nAzz+GW/ZYUn3DUC8qKihWjjC6fwifglGMUzu/Ru4nlrZvR5 ntz4AU9lFW0EXFzVyJbjq2XA/HP7jAb95RMoABKjYE1GHYYdWgypvczwQuZwt8HvzgNU A9EnuAho51ZSPRFgNTRhuOKb9LmZZh12yZLX0K7kFQjzl7uEqLCQFAhJYHyofuHEhvxK KIwKZWD/a7+Sqa5GBjkydbM6N9N1kDTCiclyVUAjcePLtX0F4BxaEf2Ke7yWADARERS1 WUyms60947zU6vpXrItxZ1GQreN3OnB9K4WBBGvfucusT8ZF75NbW7uRJOfedkdcDKTM oPAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=BS/nrwsRAd/lw5ZwCrVjDpmVaxZajWM1Eul3PsA8EiA=; b=cVWDF2PVIvay8B3dXKBDAr0hwlWjXKNygp1cM/AMTEJiaeXpa+pEC++o0bhaA8jTRy aiS2ZI81JvvAtGW34PQRFZdoBrJ9uCq4WVZXd7MRl2KWgQ3Simlqza554+x0lkzwus9f DmqLkE0nl220n3Np1r/qJTUoMLWqOdmZMsysrcrU2/OWwI0EVAEg9Wh8bb6e5jt8G62M 3djyWClp9rFmGQk5GXbcBKVQNDwY+8dSeIkfeMifYr/LGJNYdxOvBcXHgD2qvAuuiX9w FAkEWYVm9XaTGZJi6+Z0UWfWsPtNhLXjg2WLsDHfULC+wQFeJC0OBxrGe9XO+aVRIja1 l7uQ== X-Gm-Message-State: AOAM530QqSAAup25FJcn+3JL2Em78eEWZuq2NBy/h8pZlgKjZt5mWMuZ K1208yoTdhkJrbWa/KKyTaGh+aMpmJq9VgZjtg/ciqbA X-Google-Smtp-Source: ABdhPJyyT2nK4nMwp49D1nDEMQscNpuOION5IZ7hESPsMx1E8z6HvwiHVswqvRSC45NxV5ISd8RfmXoDBZ6h9MxqKrY= X-Received: by 2002:a19:fc14:: with SMTP id a20mr15241707lfi.0.1595964560149; Tue, 28 Jul 2020 12:29:20 -0700 (PDT) MIME-Version: 1.0 From: Dick Hardt Date: Tue, 28 Jul 2020 12:28:44 -0700 Message-ID: To: SecEvent Cc: Yaron Sheffer , Annabelle Richard , Marius Scurtescu Content-Type: multipart/alternative; boundary="000000000000aeccc605ab857467" Archived-At: Subject: [Id-event] Subject Identifiers & SecEvent WG X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 19:29:25 -0000 --000000000000aeccc605ab857467 Content-Type: text/plain; charset="UTF-8" Yaron and I were happy to see the feedback on the Subject Identifiers document, and that we can progress working on the document in this WG. Annabelle / Marius: would you update the document based on the feedback? Would be great for that to happen soon while the energy in the group has been revived! Dick and Yaron --000000000000aeccc605ab857467 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Yaron and I were happy to see the feedback on the Subject = Identifiers document, and that we can progress working on the document in t= his WG.

    Annabelle / Marius: would you update the documen= t based on the feedback? Would be great for that to happen soon while the e= nergy in the group has been revived!

    Dick and Yaro= n
    --000000000000aeccc605ab857467-- From nobody Tue Jul 28 14:18:56 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65B983A0924 for ; Tue, 28 Jul 2020 14:18:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.619 X-Spam-Level: X-Spam-Status: No, score=-9.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 73r1rWzS7k4e for ; Tue, 28 Jul 2020 14:18:46 -0700 (PDT) Received: from smtp-fw-9101.amazon.com (smtp-fw-9101.amazon.com [207.171.184.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA9313A09A8 for ; Tue, 28 Jul 2020 14:18:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1595971127; x=1627507127; h=from:to:cc:date:message-id:references:in-reply-to: mime-version:subject; bh=TTLn4xn5ZQkPTHt6mft/eElKNeexlyK1pIELA82DtD8=; b=N/TT5yB793yWRWfLKilHnOeU1N7MY86D89kXs12Nae2xF6cgXjXzaShM 5ZKg6svICjWv1vabMIZNfLAF0VnZ75k7lIuD0CYWLXDE2IYFpGmCKhy/T PvpKouK3sdWRLaJ3CQztEey5D7BqLcw6kS3XhYI1z8tsjAZ2jKCLyUz6i s=; IronPort-SDR: HeXO3YAAQg73AlRoSUMEM72cqfaqhdMm9NO/VriPEe5yFDgiM+fBxr1vM98+9d8OI09AkPgfhI cjbRVzaK3ECQ== X-IronPort-AV: E=Sophos; i="5.75,407,1589241600"; d="scan'208,217"; a="55533562" Thread-Topic: Subject Identifiers & SecEvent WG Received: from sea32-co-svc-lb4-vlan3.sea.corp.amazon.com (HELO email-inbound-relay-2b-859fe132.us-west-2.amazon.com) ([10.47.23.38]) by smtp-border-fw-out-9101.sea19.amazon.com with ESMTP; 28 Jul 2020 21:18:41 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan2.pdx.amazon.com [10.170.41.162]) by email-inbound-relay-2b-859fe132.us-west-2.amazon.com (Postfix) with ESMTPS id 8AD712249A6; Tue, 28 Jul 2020 21:18:40 +0000 (UTC) Received: from EX13D11UWC001.ant.amazon.com (10.43.162.151) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 28 Jul 2020 21:18:40 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC001.ant.amazon.com (10.43.162.151) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 28 Jul 2020 21:18:39 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1497.006; Tue, 28 Jul 2020 21:18:39 +0000 From: "Richard Backman, Annabelle" To: Dick Hardt , SecEvent CC: Yaron Sheffer , Marius Scurtescu Thread-Index: AQHWZRV2lDgki+2wpku1RcZjjQVypqkdCc+A Date: Tue, 28 Jul 2020 21:18:39 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.65] Content-Type: multipart/alternative; boundary="_000_EE53026847EA49C98CF9ECFFE48C1144amazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Subject Identifiers & SecEvent WG X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 21:18:55 -0000 --_000_EE53026847EA49C98CF9ECFFE48C1144amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WWVzLCBJIHdpbGwgZ2V0IGFuIHVwZGF0ZSBvdXQgc29vbi4NCg0K4oCTDQpBbm5hYmVsbGUgQmFj a21hbiAoc2hlL2hlcikNCkFXUyBJZGVudGl0eQ0KaHR0cHM6Ly9hd3MuYW1hem9uLmNvbS9pZGVu dGl0eS8NCg0KDQpGcm9tOiBEaWNrIEhhcmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNvbT4NCkRhdGU6 IFR1ZXNkYXksIEp1bHkgMjgsIDIwMjAgYXQgMTI6MjkgUE0NClRvOiBTZWNFdmVudCA8aWQtZXZl bnRAaWV0Zi5vcmc+DQpDYzogWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPiwg IlJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlIiA8cmljaGFubmFAYW1hem9uLmNvbT4sIE1hcml1 cyBTY3VydGVzY3UgPG1hcml1cy5zY3VydGVzY3VAZ21haWwuY29tPg0KU3ViamVjdDogW0VYVEVS TkFMXSBTdWJqZWN0IElkZW50aWZpZXJzICYgU2VjRXZlbnQgV0cNCg0KDQpDQVVUSU9OOiBUaGlz IGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRpb24uIERvIG5v dCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcyB5b3UgY2FuIGNvbmZpcm0g dGhlIHNlbmRlciBhbmQga25vdyB0aGUgY29udGVudCBpcyBzYWZlLg0KDQoNCllhcm9uIGFuZCBJ IHdlcmUgaGFwcHkgdG8gc2VlIHRoZSBmZWVkYmFjayBvbiB0aGUgU3ViamVjdCBJZGVudGlmaWVy cyBkb2N1bWVudCwgYW5kIHRoYXQgd2UgY2FuIHByb2dyZXNzIHdvcmtpbmcgb24gdGhlIGRvY3Vt ZW50IGluIHRoaXMgV0cuDQoNCkFubmFiZWxsZSAvIE1hcml1czogd291bGQgeW91IHVwZGF0ZSB0 aGUgZG9jdW1lbnQgYmFzZWQgb24gdGhlIGZlZWRiYWNrPyBXb3VsZCBiZSBncmVhdCBmb3IgdGhh dCB0byBoYXBwZW4gc29vbiB3aGlsZSB0aGUgZW5lcmd5IGluIHRoZSBncm91cCBoYXMgYmVlbiBy ZXZpdmVkIQ0KDQpEaWNrIGFuZCBZYXJvbg0K --_000_EE53026847EA49C98CF9ECFFE48C1144amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiTVMgTWluY2hvIjsNCglwYW5vc2UtMToyIDIgNiA5IDQgMiA1IDgg MyA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3Nl LTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGli cmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250 LWZhbWlseToiXEBNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0K LyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5N c29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1z aXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVt YWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjND MSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPlllcywgSSB3aWxsIGdldCBhbiB1cGRhdGUgb3V0IHNvb24uPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+4oCT PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPkFubmFiZWxsZSBCYWNrbWFuIChzaGUvaGVyKTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0Ij5BV1MgSWRlbnRpdHk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PGEgaHJlZj0iaHR0cHM6Ly9h d3MuYW1hem9uLmNvbS9pZGVudGl0eS8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDU2M0MxIj5odHRw czovL2F3cy5hbWF6b24uY29tL2lkZW50aXR5Lzwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQg MGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOg0K PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RGlj ayBIYXJkdCAmbHQ7ZGljay5oYXJkdEBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlR1 ZXNkYXksIEp1bHkgMjgsIDIwMjAgYXQgMTI6MjkgUE08YnI+DQo8Yj5UbzogPC9iPlNlY0V2ZW50 ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5DYzogPC9iPllhcm9uIFNoZWZmZXIg Jmx0O3lhcm9uZi5pZXRmQGdtYWlsLmNvbSZndDssICZxdW90O1JpY2hhcmQgQmFja21hbiwgQW5u YWJlbGxlJnF1b3Q7ICZsdDtyaWNoYW5uYUBhbWF6b24uY29tJmd0OywgTWFyaXVzIFNjdXJ0ZXNj dSAmbHQ7bWFyaXVzLnNjdXJ0ZXNjdUBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9i PltFWFRFUk5BTF0gU3ViamVjdCBJZGVudGlmaWVycyAmYW1wOyBTZWNFdmVudCBXRzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N Cjx0YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAi IGNlbGxwYWRkaW5nPSIwIiB3aWR0aD0iNjIyIiBzdHlsZT0id2lkdGg6NDY2LjVwdDttYXJnaW4t bGVmdDouNWluO2JvcmRlci1jb2xsYXBzZTpjb2xsYXBzZSI+DQo8dGJvZHk+DQo8dHIgc3R5bGU9 ImhlaWdodDoxNS4yNXB0Ij4NCjx0ZCB3aWR0aD0iNjIyIiB2YWxpZ249InRvcCIgc3R5bGU9Indp ZHRoOjQ2Ni41cHQ7Ym9yZGVyOnNvbGlkICNFRDdEMzEgMS41cHQ7cGFkZGluZzowaW4gNS40cHQg MGluIDUuNHB0O2hlaWdodDoxNS4yNXB0Ij4NCjxwPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjaztiYWNrZ3Jv dW5kOiNGRkZGOTkiPkNBVVRJT048L3NwYW4+PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOmJs YWNrO2JhY2tncm91bmQ6I0ZGRkY5OSI+OiBUaGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRz aWRlIG9mIHRoZSBvcmdhbml6YXRpb24uIERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFj aG1lbnRzIHVubGVzcw0KIHlvdSBjYW4gY29uZmlybSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBj b250ZW50IGlzIHNhZmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Ri b2R5Pg0KPC90YWJsZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+WWFyb24gYW5kIEkgd2VyZSBo YXBweSB0byBzZWUgdGhlIGZlZWRiYWNrIG9uIHRoZSBTdWJqZWN0IElkZW50aWZpZXJzIGRvY3Vt ZW50LCBhbmQgdGhhdCB3ZSBjYW4gcHJvZ3Jlc3Mgd29ya2luZyBvbiB0aGUgZG9jdW1lbnQgaW4g dGhpcyBXRy4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5Bbm5hYmVs bGUgLyBNYXJpdXM6IHdvdWxkIHlvdSB1cGRhdGUgdGhlIGRvY3VtZW50IGJhc2VkIG9uIHRoZSBm ZWVkYmFjaz8gV291bGQgYmUgZ3JlYXQgZm9yIHRoYXQgdG8gaGFwcGVuIHNvb24gd2hpbGUgdGhl IGVuZXJneSBpbiB0aGUgZ3JvdXAgaGFzIGJlZW4gcmV2aXZlZCE8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5EaWNrIGFuZCBZYXJvbjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_EE53026847EA49C98CF9ECFFE48C1144amazoncom_--