From gregory.ietf@gmail.com Sat Oct 17 13:11:08 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B582F3A695C for ; Sat, 17 Oct 2009 13:11:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.699 X-Spam-Level: X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[AWL=0.900, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DtojP0-8ZWIO for ; Sat, 17 Oct 2009 13:11:07 -0700 (PDT) Received: from mail-ew0-f208.google.com (mail-ew0-f208.google.com [209.85.219.208]) by core3.amsl.com (Postfix) with ESMTP id 44AE13A689C for ; Sat, 17 Oct 2009 13:11:04 -0700 (PDT) Received: by ewy4 with SMTP id 4so381716ewy.37 for ; Sat, 17 Oct 2009 13:11:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:mime-version:content-type; bh=9IjFx67U/U7gW2kAuXkbnExol1rGKs+npcGPzZZ4/uI=; b=v/KQ7iaAIn+LpO16yoJK/I8AmmjTmeX9h1NwAQUlM8gYkN2I8kbfBaslCzyiFYqs5D Wy8TiirFc4LtkVAFoOUgmWXoJ8H/6eKKxwx6zaZUEEK2aj7cRGI7resfRkeiuHxIpkaz hDyafGAnF24T1cGteZFKXS0SjZhW6qI2H0j1E= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:mime-version:content-type; b=Lcs4zGUy7NuB0xsmVQ6pc/Xsklrl4Z3OZ96mBiQd2CCMrJcRLT2hdKpfrVUC1jncWO b6QBdJkpQeIuL5BqQQCwdpKQQjAwM/VnBnOeOVziOGNtBS3TclVFOh6P3LDVKf8lf9c/ Chb9NaBkImz830jsAde4WgkMVyIVJ9FGY5oJc= Received: by 10.216.93.68 with SMTP id k46mr1169908wef.161.1255810266258; Sat, 17 Oct 2009 13:11:06 -0700 (PDT) Received: from Gregory-T60.gmail.com (nat-service4.juniper.net [66.129.225.151]) by mx.google.com with ESMTPS id p37sm6994536gvf.24.2009.10.17.13.11.04 (version=SSLv3 cipher=RC4-MD5); Sat, 17 Oct 2009 13:11:05 -0700 (PDT) Message-ID: <4ada24d9.25c0100a.37a7.6e69@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sat, 17 Oct 2009 13:11:00 -0700 To: karp@ietf.org From: "Gregory M. Lebovitz" Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: [karp] Fwd: [kmart] Draft KARP BoF charter X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Oct 2009 20:11:08 -0000 Now that KARP mail list is set up, I'm forwarding the current draft charter there, for good hygiene. Gregory. >Delivered-To: gregory.ietf@gmail.com > >From: Brian Weis >To: kmart@ietf.org >Date: Wed, 14 Oct 2009 11:04:59 -0700 >Subject: [kmart] Draft KARP BoF charter > > >Greetings, > >The change of mailing list name from "kmart" to "karp" is in progress. >In the meantime, we have a draft KARP BoF charter based on the >original draft KMART BoF charter. Please send your comments to this >list, until such time as we can announce the formation of the new list. > >Thanks, >Joel & Brian > >======== > >Description of Working Group >---------------------------- > >The KARP working group is tasked to work with the routing protocol >working groups in order to improve the communication security of the >packets on the wire used by the routing protocols. Of the five basic >goals that may sought relative to securing any piece of data as it is >transmitted over the wire: privacy (or encryption), message >authentication, message integrity, non-repudiation, and denial of >service protection, three are considered relevant for this working >group. This working group is concerned with message authentication, >packet integrity, and denial of service (DoS) protection. At present, >this charter explicitly excludes privacy and non-repudiation concerns. > >Authenticating the routing peer sending a message, and message >integrity protection will be provided through the use of per-packet >cryptographic message authentication. Peer authentication will protect >against unrecognized peers, imposter peers, and some DoS attacks aimed >at routers. Protecting against misbehavior of an otherwise allowed >peer router is outside the scope of this working group. > >Many routing protocols (or groups of protocols) already have some >method for accomplishing cryptographic message authentication. In >most cases the existing methods are vulnerable to known attack, and/or >employ cryptographic algorithms that have been deprecated. Internet >security practices have progressed in the last 10 years when many of >the first generation routing authentication mechanisms were created. >It is time to review and update those mechanisms to use modern >security practices. Ensuring algorithm agility within routing >protocols is of particular importance. A goal of the working group is >to add incremental security to existing mechanisms rather than >replacing them. Better deployable solutions that vendors and >operators can migrate to is more important than getting a perfect >security solution. > >The working group will coordinate very closely with the protocol >development working groups for any routing protocol being evaluated. >This coordination will include cooperatively determining the current >or already planned state of the security work in the protocol. It >will also include ensuring that any proposed mechanisms are consistent >with with architecture and use of the protocol. And any specific >proposal will be developed in cooperation with the concerned protocol >working group. > >Many different routing protocols exist. These protocols use a range >of transport mechanisms and communication relationships. There are >also differences in details among the various protocols. Clearly, no >one solution will work for all protocols, and even general solutions >that are applicable across protocols will need tailoring for each >case. The working group will attempt to describe the security >relevant characteristics of routings protocols, such as the use or >non- use of TCP, or the frequent use of group communication versus purely >pairwise communication. Using these characteristics, the working >group will then provide suitable common frameworks that can be >applied, and tailored, to improve the communication security of the >routing protocols. In later phases, it is expected that the working >group will investigate the suitably of defining conceptual structures >and APIs, so as to enable further work to be more effective. > >One area for study is the applicability of automated key management to >these environments. It is anticipated that at least the techniques >for separating session keys from key established keys will be >applicable. This charter provides for preliminary work in this space, >although it is expected that detailed work items will be added to the >charter when the problem has been better analyzed. > >Routing protocols in scope include BGP, OSPF, OSPFv3, ISIS, RIPv2, >RIPng, MSDP, PCE, PIM (SM and DM), LSP, RSVP-TE, and BFP. The working >group will not be working on emerging routing protocls such as ROLL or >MANET. The WG will not work on control protocol such as GSMP or >ForCES, nor on Network Management protocols such as SNMP or NETCONF. > >Current WG work items are: > >- Determine current threats to the routing protocol operation, and >define general requirements for cryptographic authentication of >routing protocols > >- Identify deficiencies of each routing protocol in scope, and specify >mechanisms that bring them in line with the general requirements > >- Define one or more frameworks describing the common elements for >modern authentication in routing protocols > >- Specify automated key management needs for routing protocols > >Goals and Milestones >--------------------- > >TBD - Separate current roadmap document (a place holder document) into >General Framework, General Requirements, Priorities/Work-Plan documents > >TBD - Specification document for each protocol > >TBD - Framework document on protocol groups and the common techniques >and interfaces that apply to them. > > > > >_______________________________________________ >kmart mailing list >kmart@ietf.org >https://www.ietf.org/mailman/listinfo/kmart +++++++++++++++++++++++ IETF-related email from Gregory M. Lebovitz Juniper Networks g r e go r y d o t i e tf a t g m a i l do t c o m From gregory.ietf@gmail.com Sat Oct 17 13:14:30 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 66BC33A6980 for ; Sat, 17 Oct 2009 13:14:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.924 X-Spam-Level: X-Spam-Status: No, score=-1.924 tagged_above=-999 required=5 tests=[AWL=0.675, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W3q2KJhFeXLq for ; Sat, 17 Oct 2009 13:14:28 -0700 (PDT) Received: from mail-ew0-f208.google.com (mail-ew0-f208.google.com [209.85.219.208]) by core3.amsl.com (Postfix) with ESMTP id 39F313A691B for ; Sat, 17 Oct 2009 13:14:28 -0700 (PDT) Received: by ewy4 with SMTP id 4so383297ewy.37 for ; Sat, 17 Oct 2009 13:14:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:cc:mime-version:content-type; bh=NZl+dm9mZVfaNbbIWYITsrVYjwruzMHffnndp6A/Rh0=; b=va6Dz5WP/vsvZjp55UqrUSDVKf6nYT8jOU5YS5P14wgviWZGMpJkTqJgfsAqF/sitI uzyEFO48WWstakenaiZtEhjA5U0ipLiCcTJ9RSAb2cdBnDAskbmzYrubRHyoT4MSwW9f R38lz9DL7Unic7KVQDUzTwBGaImP229hvUYro= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:cc:mime-version :content-type; b=rIDfgbJzGfGd5CrNo1wTrV+69jLmqOSVHkMqvo38DUCyDGkfjpaQFL5gdOAOEyi06+ /LHVGICPV7m6G5f8JQfLk3dxSTLo8SdyBSeRgdD29GDqdQbqM+6g4SOGujsx4E+OeVIO fkIn1xjYyxya3fdf/y40rqQ4Pj7s2r0bi0P+E= Received: by 10.216.88.144 with SMTP id a16mr1087879wef.208.1255810471120; Sat, 17 Oct 2009 13:14:31 -0700 (PDT) Received: from Gregory-T60.gmail.com (nat-service4.juniper.net [66.129.225.151]) by mx.google.com with ESMTPS id i34sm6954182gve.8.2009.10.17.13.14.28 (version=SSLv3 cipher=RC4-MD5); Sat, 17 Oct 2009 13:14:30 -0700 (PDT) Message-ID: <4ada25a6.22a0100a.408f.7475@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sat, 17 Oct 2009 13:14:25 -0700 To: Brian Weis From: "Gregory M. Lebovitz" Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Cc: karp@ietf.org Subject: [karp] FW: comments on proposed KMART charter X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Oct 2009 20:14:30 -0000 Hey Brian, I got these at my juniper email address from David, and I wasn't sure if you had seen it on the mail list. I wanted to make sure everyone saw it, and that his feedback could be included in any up-coming charter revision, if not already in the most recent one. Gregory. >-----Original Message----- >From: David McGrew [mailto:mcgrew@cisco.com] >Sent: Thursday, September 24, 2009 7:48 AM >To: Gregory Lebovitz; kmart@ietf.org >Subject: comments on proposed KMART charter > >Hi Gregory, > >here are some comments on the proposed charter. I think this is a >good start, but in general, it needs to be more specific; it leaves >open the questions of charter overlap with TCPM, whether IPsec >solutions are in scope, what exactly the goals of the framework are, >and what the goals of the KMP are. Also, I don't see any discussion >about the establishment of long-term keys (public or secret) used in >authentication, and that strikes me as a crucial omission. It would >be regrettable to have the working group succeed in defining how to >establish session keys but then see the work go unused due to the >lack of router-to-router authentication. > >Some detailed comments inline: > > > > ===== BEGIN KMART-CHARTER-00 ===== > > This working group will focus on securing routing protocols' packets- > > on-the-wire by the use of cryptographic authentication modern > > cryptographic algorithms to provide > > > > In the March of 2006 the IAB held a workshop on the topic of "Unwanted > > Internet Traffic". The report from that workshop is documented in RFC > > 4948 [RFC4948]. Section 8.2 of RFC 4948 calls for > > "[t]ightening the security of the core routing infrastructure." > > Four main steps were identified for improving the security of the > > routing infrastructure. One of those steps was "securing the routing > > protocols' packets on the wire." > > > > Four basic tactics may be employed in order to secure any piece of > > data as it is transmitted over the wire: privacy (or encryption), > > authentication, message integrity, and non-repudiation. > >Those tactics are really security services; I suggest calling them >that. Many people prefer the term "confidentiality" to "privacy". > > > The goal of this WG is message authentication and packet integrity. > > At present, this work explicitly excludes privacy and non-repudiation. > > > > Routing peer authentication and message integrity will be provided > > through the use of per-packet cryptographic message authentication. > > Peer authentication will protect against rogue peers, imposter peers, > > and some denial of service (DoS) attacks aimed at routers. > >I understand the value of authentication in this context, but I do >not understand how authentication can possibly protect against rogue >peers. I assume that a rogue peer is a trusted device that has been >subverted; what good does cryptographic authentication do in such a >case? I suggest that "rogue peers" be taken off the list, or >clarified, if it means something other than what it seems. > > > > > > > Many different routing protocols exist and they employ a range of > > different transport subsystems. Therefore there is no specific one- > > size-fits-all authentication format that will work for all routing > > protocols. Groups of routing protocols with similar transports will be > > able to use the same authentication mechanism. Though there will be > > multiple specific authentication mechanisms to meet the needs of the > > various transport subsystems, we can create a common framework by > > which interfaces and modules may be re-used across different routing > > protocols. > >The above paragraph sounds reasonable, though it is lacking >specifics. I suggest adding an explicit list of routing protocols >that are of interest. > >Also, what is an "authentication format"? Does that mean >"authentication mechanism, such as AH, TCP-AO, or an application-layer >Message Authentication Code?" I suggest clarifying. Perhaps use >"mechanism", which appears in the paragraph below, for consistency. > > > > > > > Many routing protocols (or groups of protocols) already have some > > method for accomplishing cryptographic message authentication. In > > most cases the existing methods are dated, vulnerable to known attack, > > and/or employ cryptographic algorithms that have been deprecated. > > Internet security practices have progressed in the last 10 years when > > many of the first generation routing authentication mechanisms were > > created. > > It is time to review and update those mechanisms to use modern > > security practices. > > > > > >I agree with the gist here, but I suggest adding specific references. > > > > MISSON & OBJECTIVES > > > > Misson: > > Deliver specifications that empower an incrementally secure routing > > infrastructure for the Internet by delivering cryptographic > > authentication and message integrity for packets transmitted between > > routing protocol peers. > >The term empower is vague; what all does it entail? Analysis? >Requirements? Specifications for new protocols or systems? BCPs on >use of existing protocols? > > > > > Incremental Security: > > Routing systems are highly tuned, having been refined by years of > > operation for interoperability, scale and efficiency. Operators will > > not deploy something too complex, something with too large a > > perfomance impact or which they cannot readily characterize, nor > > something too far removed from existing operational practices. The > > "best" authentication for a group of routing protocols may not > > always be reasonably deployable in one step. The WG will remain > > sensitive to this dynamic. It will be cautious of over reaching, and > > will strive for incremental security improvements rather than > > perfection. "More is better than none" and "crawl, walk, run" are > > guiding principles here. > >Nicely put. > > > > > > > It is possible for routing protocol packets to be transmitted > > employing all four security tactics mentioned above using existing > > standards. For example, one could run unicast, layer 3 or above > > routing protocol packets through an IPsec ESP [RFC4303] or AH > > [RFC4304??]. encapsulation. However, routing products have been fine > > tuned over the years for the specific processing necessary for these > > routing protocols non-encapsulated formats. Operators are, > > therefore, quite unwilling to explore new packet encapsulations for > > these tried and true routing protocols. Rather, operators have a > > strong preference for authentication options in the routing > > protocols instead of encapsulation. As stated previously, many > > routing protocols already have existing mechanisms for cryptogrpahic > > authentication.Products with these mechanisms have already been > > produced, code has already been written and deployed, and both have > > been optimized for the existing mechanisms. Rather than turn away > > from these mechanisms, we want to enhance them, updating them to > > modern and secure levels. > >It is good to explicitly state that enhancements to app/transport >layer authentication protocols are in scope, but this leaves open the >question of what else is in scope. Are IPsec-based proposals not in >scope? > > > > > > > Work Blocks/Phases: > > 1) Enahance Existing Mechanisms - The first step is to enhance the > > routing protocols' (groups') authentication mechanism, ensuring it > > employs modern cryptographic algorithms and methods for its basic > > operational model. > >Isn't this already in scope for TCPM WG? That sounds like serious >charter overlap to me. TCPM is producing "The TCP Authentication >Option" and "Cryptographic Algorithms, Use, & Implementation >Requirments for TCP Authentication Option". Is the intent here to >just support the TCP-AO work? > > > > Ideally the updated mechanism will protect against as many threats > > as possible. Many of the protocols' use manual keys currently, so > > the first phase will focus on shoring up the manual key mechanisms > > that exist. > > > > > > 2) A framework (DOI?) will be defined for common elements and their > > use, such that implementation on systems with many routing protocols > > can easily re-use common structures and functions. The framework > > will account for the future use of a key management protocol (KMP) > > that can be layered onto a protocl's manual key mechanism. > > >Item (1) aims to shore up manual keying; how does the framework for >key management in (2) differ from that? I suggest moving key >management out of the original goal, or otherwise clarifying. > >I assume that "common elements" refers to keys, identifiers, >cryptoperiods, and suchlike. I suggest making this explicit. > >There are many different goals for key management, including the >establishment of session keys from long-term keys, and the >distribution of long-term keys. IKE does the former, Kerberos and >KEYPROV do the latter, and GDOI can do both. Are both in scope? > > > > > 3) Layer in KMP - The second work phase is to define the use of an > > existing KMP (e.g. IKE) for generating keys and security association > > parameters for use any routing protocol (group). It is hoped that a > > general KMP framework -- or a small number of frameworks -- can be > > defined and leveraged for many routing protcols (groups). > >Why does the charter assume IKE, which is solely point-to-point? Are >protocols that use multicast not in scope, or have a secondary status? > >Are protocols for the distribution of secret long-term keys in >scope? For example, would the use of KEYPROV, KMIP, Kerberos, or >GDOI to distribute keys from a central server be in scope? It is a >sensible thing to consider for securing interior BGP, for example. > >In any case, long-term authentication belongs on the charter. If >there is an expectation that x.509 certificates can be used to provide >it, then some mention should be added to the charter. Issues like >how certificates get issued and how CAs become trusted will be very >important in this case. > >I get heartburn from the "small number of frameworks" statement - if >there really are multiple frameworks, it seems the goals of generality >and reusability that motivate a framework will never be met. > > > > > > > > > > SCOPE > > > > The scope of this roadmap of work includes: > > > > o Making use of existing routing protocol security protocols, where > > they exist, and enhancing or updating them as necessary for > > modern cryptographic best practices and expanded threat protection. > > > > o Specifying authentication mechanisms in routing protocols where > > they do not currently exist. > > > > o Developing a framework that will be able to layer in use of KMP > > in order to ease deployment, lower cost of operation, and allow for > > rapid > > responses to security breaches, and > > > > o Specifying the automated KMP that may be > > combined with the bits-on-the-wire mechanisms. > > > > > > o [List of routing protocols we will work on]. These are the > > priorities at the moment. The WG may re-charter later to take on > > additional protocols. > > > > > >Has the list of protocols been posted somewhere else? > > > > OUT OF SCOPE > > > > o Protection of route message content or payload. > >"confidentiality" is a good word to use here. > > > > > - Route orignation authorization (ROAs). This is being addressed > > in SIDR WG. > > - Route path validation. > > o Route message privacy. > > o Authentication for anything but routing protcols. > > o [List of routing protocols we will not work on]. The WG may re- > > charter later to address these, once current work items are completed. > > > > > > > > > > SPECIFIC WORK ITEMS > > > > o Grouping the routing protocols with like transports/requirements > > o Prioritize the the work of addressing the groups > > o General requirements document for cryptographic authentication of > > routing protocols. This document will start with a threat model > > which will then drive the requirements. > > o Framework document describing the common elements for modern > > authentication in routing protcols. This will include a framework > > "manual" key modes for routing protocols, but done in a way that > > allows for the future layering-on of an automated key management > > protocol (KMP). > > o Security review of existing groups of routing protocols, > > resulting in a requirements document for each protocol group > > detailing what is needed to modernize (or provide) authentication > > for that protocol group > > o Specification document for each routing protocol updating how > > each will employ modern authentication. > > o General KMP usage - specification document(s) defining a KMP and > > its use for generating keys and security association parameters for > > any routing protocol (group). > > o Specification document for the use of KMP with each routing > > protocol. > >This list provides more detail, which is great, but it still leaves >open the questions of charter overlap with TCPM, whether IPsec >solutions are in scope, what exactly the framework is, and what the >goals of the KMP are. Also, there ought to be some discussion about >the establishment of long-term keys (public or secret) used in >authentication. > >best, > >David > > > > > > > MILESTONES (TBD) > > > > TBD - BoF > > TBD - WG formed > > TBD - separate current roadmap document (a place holder document) > > into General Framework, General Requirements, Priorities/Work-Plan > > documents > > TBD - Requirements document for each protocol group > > TBD - Specification document for each protocol > > > > > > WG LOCATION & OPERATION > > > > By suggestion of the Routing and Security AD's, this work will be > > housed in the Routing Area, but will have an explicit Security Area > > advisor assigned. In addition, members of the security community > > will be recruited to participate in the truly cross-area WG effort. > > This sort of authentication work has proven to be very tedious and > > experience has shown it easily overwhelms a WG's available air time > > for other topics (i.e. this topic can DoS a routing protocol's WG). > > Therefore the AD's suggest that authentication work on the routing > > protos (groups) will be done in one WG just for that purpose, > > instead of in each routing protocol's WG themselves, but with > > committed participation from that (those) routing protocols' working > > groups' members, and with frequent status updates being liaised > > between this WG and the protocols WGs. +++++++++++++++++++++++ IETF-related email from Gregory M. Lebovitz Juniper Networks g r e go r y d o t i e tf a t g m a i l do t c o m From gregory.ietf@gmail.com Sat Oct 17 13:40:55 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3DE4528C0CF for ; Sat, 17 Oct 2009 13:40:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.149 X-Spam-Level: X-Spam-Status: No, score=-2.149 tagged_above=-999 required=5 tests=[AWL=0.450, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7aJ-uurDvBI8 for ; Sat, 17 Oct 2009 13:40:54 -0700 (PDT) Received: from mail-ew0-f208.google.com (mail-ew0-f208.google.com [209.85.219.208]) by core3.amsl.com (Postfix) with ESMTP id 1A5323A6998 for ; Sat, 17 Oct 2009 13:40:53 -0700 (PDT) Received: by ewy4 with SMTP id 4so395066ewy.37 for ; Sat, 17 Oct 2009 13:40:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:cc:mime-version:content-type; bh=UWh9GtO6cK2MisVDhwNUZu2PjZjegcBUmlz5ks9bgdU=; b=fs4Y1nOPj6ULBrd2N0AmKE0dGhjdgkKGFRJwGmJVfchb/OrF9YU/TTiEaT8M626RTG DFFUwbaRneSn/R7P2Rl67GpBvSMFMDKI6NqN+SoktZhbpcTsa1Md+DmY2dx08M+nvUbq Y/Ham85Q5equ7g4AsdxAJkLv+S2cedmUuegpc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:cc:mime-version :content-type; b=nxFFPPiTW/yxaHtRMKD9zX577uKu9zB+YP5uuTKg43EIxOL/tIRCyW0lydwIuPbTak OMS1ruRhKaBjRrNfXjD1rBgewrOw7F/GRg6apK+KMohn2XaBEQAMGFUwrGJ1eWgu9YUR 07Myme6vMpeBaThroterbhga+BdYg2E/TZJ1k= Received: by 10.216.86.213 with SMTP id w63mr1164883wee.71.1255812057455; Sat, 17 Oct 2009 13:40:57 -0700 (PDT) Received: from Gregory-T60.gmail.com (nat-service4.juniper.net [66.129.225.151]) by mx.google.com with ESMTPS id g11sm7069786gve.20.2009.10.17.13.40.52 (version=SSLv3 cipher=RC4-MD5); Sat, 17 Oct 2009 13:40:56 -0700 (PDT) Message-ID: <4ada2bd8.0b9e100a.1134.7e04@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sat, 17 Oct 2009 13:40:48 -0700 To: karp@ietf.org,Brian Weis , "Joel M. Halpern" From: "Gregory M. Lebovitz" Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Cc: Vishwas Manral , "Bhatia, Manav \(Manav\)" Subject: [karp] Drafts to consider for KARP work X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Oct 2009 20:40:55 -0000 Team, pls see this list below for drafts that have work/info relevant to the KARP effort: >Delivered-To: gregory.ietf@gmail.com >Received: by 10.231.33.132 with SMTP id h4cs226388ibd; > Sun, 29 Mar 2009 13:19:27 -0700 (PDT) >MIME-Version: 1.0 >Received: by 10.142.107.1 with SMTP id f1mr1814015wfc.140.1238357967355; Sun, > 29 Mar 2009 13:19:27 -0700 (PDT) >Date: Sun, 29 Mar 2009 13:19:27 -0700 >Message-ID: <77ead0ec0903291319y70e01c61rfe8f21c0292a3d69@mail.gmail.com> >Subject: KMART draft >From: Vishwas Manral >To: "Gregory M. Lebovitz" >Cc: "Bhatia, Manav (Manav)" >Content-Type: text/plain; charset=ISO-8859-1 >Content-Transfer-Encoding: 7bit > >Hi Greg, > >Here are the set of drafts we could use for the KMART work: > >1. >http://www.ietf.org/internet-drafts/draft-ietf-opsec-routing-protocols-crypto-issues-00.txt >is the draft I was talking about. >2. http://tools.ietf.org/html/rfc5310 is the IS-IS RFC. >3. http://tools.ietf.org/html/draft-ietf-ospf-hmac-sha-03 is the >equivalent OSPF draft >4. http://tools.ietf.org/html/draft-bhatia-manral-igp-crypto-requirements-03 >is the draft for Crypto requirements. > >It will be great to get your opinion about the same. > >Thanks, >Vishwas +++++++++++++++++++++++ IETF-related email from Gregory M. Lebovitz Juniper Networks g r e go r y d o t i e tf a t g m a i l do t c o m From jmh@joelhalpern.com Mon Oct 19 11:27:48 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51C7B3A6954 for ; Mon, 19 Oct 2009 11:27:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.466 X-Spam-Level: X-Spam-Status: No, score=-2.466 tagged_above=-999 required=5 tests=[AWL=0.133, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aOSv94yxP55W for ; Mon, 19 Oct 2009 11:27:47 -0700 (PDT) Received: from hgblob.mail.tigertech.net (hgblob.mail.tigertech.net [64.62.209.71]) by core3.amsl.com (Postfix) with ESMTP id AB1B33A6781 for ; Mon, 19 Oct 2009 11:27:44 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 245EC32317AA for ; Mon, 19 Oct 2009 11:27:52 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hgblob.tigertech.net Received: from [10.10.10.101] (pool-71-161-50-68.clppva.btas.verizon.net [71.161.50.68]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hgblob.tigertech.net (Postfix) with ESMTP id BBEA63228026 for ; Mon, 19 Oct 2009 11:27:51 -0700 (PDT) Message-ID: <4ADCAFA8.70202@joelhalpern.com> Date: Mon, 19 Oct 2009 14:27:52 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.23 (Windows/20090812) MIME-Version: 1.0 To: karp@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [karp] Meeting? X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Oct 2009 18:27:48 -0000 We have a BoF in Hiroshima. We have circulated a charter. There has been a little bit of discussion of the charter. Are folks happy with it? We have had almost no agenda requests. Brian and I have gotten in touch with a few people, but mostly the agenda is supposed to come from you. We will have a charter discussion. I hope that there are other folks who have material they want to present / discuss? Please, let us know. Either on list or individually. Yours, Joel M. Halpern w/ Brian Weis From gregory.ietf@gmail.com Mon Oct 19 12:27:16 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B27D33A680F for ; Mon, 19 Oct 2009 12:27:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.213 X-Spam-Level: X-Spam-Status: No, score=-2.213 tagged_above=-999 required=5 tests=[AWL=0.386, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2vehg2FacmUg for ; Mon, 19 Oct 2009 12:27:15 -0700 (PDT) Received: from mail-fx0-f218.google.com (mail-fx0-f218.google.com [209.85.220.218]) by core3.amsl.com (Postfix) with ESMTP id 9479C3A67B3 for ; Mon, 19 Oct 2009 12:27:12 -0700 (PDT) Received: by fxm18 with SMTP id 18so5474616fxm.37 for ; Mon, 19 Oct 2009 12:27:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:cc:in-reply-to:references:mime-version:content-type; bh=r8/6Wd/6i/G9wenmJpk8qrWuX+5LO3hKNwEHHXw6Pbk=; b=JerYjV0QEWRbjLswDGQcyydkRanwtrlgx6zb1IzJt76RaByJN6j5yH/wdN1csm60I2 oE2pr9Yd1w+iGOqYrfnBwo5aWGOTcaOCK0zRAnt6u/Vce0vg+uTp61b/W4mKXEemm2Uq 55DCn56ThztP10MN6rAgQxiMwNozGZ3ZIOdlc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:cc:in-reply-to:references :mime-version:content-type; b=lAzpZXi8t7gXU1yIqY8zi98ZjvNK0e1OumNcF4vMNPuQf8QX11MbZpt3DPdTIDaqYc imuXNtgrx23kOKeWfBD2DfLtGIDsiWulSAOemNQbbpmETNW3dt0EBqNl5ImFQVnUJ3Ux Av4z3BlGO0VY3gATcG0c4jQG7FNHqN4Skak74= Received: by 10.204.153.217 with SMTP id l25mr5354145bkw.108.1255980435761; Mon, 19 Oct 2009 12:27:15 -0700 (PDT) Received: from Gregory-T60.gmail.com (nat-service4.juniper.net [66.129.225.151]) by mx.google.com with ESMTPS id z10sm142635fka.33.2009.10.19.12.27.13 (version=SSLv3 cipher=RC4-MD5); Mon, 19 Oct 2009 12:27:15 -0700 (PDT) Message-ID: <4adcbd93.0a4d5e0a.4c48.2a56@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 19 Oct 2009 12:27:09 -0700 To: "Joel M. Halpern" ,karp@ietf.org From: "Gregory M. Lebovitz" In-Reply-To: <4ADCAFA8.70202@joelhalpern.com> References: <4ADCAFA8.70202@joelhalpern.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Cc: Russ Housley Subject: Re: [karp] Meeting? X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Oct 2009 19:27:16 -0000 At 11:27 AM 10/19/2009, Joel M. Halpern wrote: >We have a BoF in Hiroshima. >We have circulated a charter. > >There has been a little bit of discussion of the charter. Are folks >happy with it? > >We have had almost no agenda requests. Brian and I have gotten in >touch with a few people, but mostly the agenda is supposed to come from you. I thought it was a given that I would present the roadmap document as it stands. This would be a very similar presentation to the one I gave in Stockholm during the Routing Area mtg. It would be on five different topics: - Goals / Overview - 10 min - Threat Model - 10 min - Requirements - 10 min - Framework - 10 min - Protocol groupings - 5 min (could be done by the chairs, I think.) Seem reasonable? I would like to see Russ/Tim present their I-D on the Key_Store part of the framework, as I believe it informs the framework. I'd like to see that happen after the framework discussion, before the protocol groupings discussion. I also think we need a discussion, led by someone else other than me, on: - Priorities for routing protocols to be addressed by KARP, assuming finite resource of the WG - Definition of the process of what work will be done in KARP vs in routing WG's and how the overlaps will be handled. - Any work in progress >We will have a charter discussion. > >I hope that there are other folks who have material they want to >present / discuss? Please, let us know. Either on list or individually. > >Yours, >Joel M. Halpern >w/ Brian Weis >_______________________________________________ >karp mailing list >karp@ietf.org >https://www.ietf.org/mailman/listinfo/karp From bew@cisco.com Mon Oct 26 20:12:42 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CBF763A695C for ; Mon, 26 Oct 2009 20:12:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WlDKB8vxYlfo for ; Mon, 26 Oct 2009 20:12:42 -0700 (PDT) Received: from sj-iport-1.cisco.com (sj-iport-1.cisco.com [171.71.176.70]) by core3.amsl.com (Postfix) with ESMTP id 0F6023A6863 for ; Mon, 26 Oct 2009 20:12:42 -0700 (PDT) Authentication-Results: sj-iport-1.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AswSAN4B5kqrRN+K/2dsb2JhbACUCwGsPpdyhD8E X-IronPort-AV: E=Sophos;i="4.44,629,1249257600"; d="scan'208";a="261836867" Received: from sj-core-4.cisco.com ([171.68.223.138]) by sj-iport-1.cisco.com with ESMTP; 27 Oct 2009 03:12:56 +0000 Received: from stealth-10-32-244-214.cisco.com (stealth-10-32-244-214.cisco.com [10.32.244.214]) by sj-core-4.cisco.com (8.13.8/8.14.3) with ESMTP id n9R3CrtS004922 for ; Tue, 27 Oct 2009 03:12:55 GMT Message-Id: <02562157-F43A-4151-9D11-7D0EB3151B16@cisco.com> From: Brian Weis To: karp@ietf.org Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Mon, 26 Oct 2009 20:12:52 -0700 X-Mailer: Apple Mail (2.936) Subject: [karp] KARP Agenda at IETF 76 X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Oct 2009 03:12:42 -0000 Folks, The draft agenda for the BoF has been posted: . Thanks, Joel & Brian From gregory.ietf@gmail.com Tue Oct 27 17:57:48 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0B8583A6861 for ; Tue, 27 Oct 2009 17:57:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.399 X-Spam-Level: X-Spam-Status: No, score=-2.399 tagged_above=-999 required=5 tests=[AWL=0.200, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2bnrzkQsneTi for ; Tue, 27 Oct 2009 17:57:47 -0700 (PDT) Received: from mail-pw0-f50.google.com (mail-pw0-f50.google.com [209.85.160.50]) by core3.amsl.com (Postfix) with ESMTP id 320743A6359 for ; Tue, 27 Oct 2009 17:57:44 -0700 (PDT) Received: by pwi4 with SMTP id 4so523120pwi.29 for ; Tue, 27 Oct 2009 17:57:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:in-reply-to:references:mime-version:content-type; bh=WCvY/VuVa7d8SglcY2E3Rl4LNbbKU7eUjCpwPzfrJnQ=; b=SEb8oaBhcLcwsZ40zM6eAdc7yXWoRRXU6TZ+VYjWtn2kkEsSGvDoSCssMK7j8aa0c9 CwRSZIP9vF9qjUmV+bTzxAWEYPMty2lk+SrvWpPl5w1P/FZmdBONYKYw+ANYCtP6ooeu 8UkrAp/0O7oOmN+bOXYksWG9EMSlyjoi1Lris= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:in-reply-to:references :mime-version:content-type; b=hFxzMYtZattU2srJk2r++CRZK9qlNlva6aSLJzELNUK5DuctrlIcIxSvTR9JzPOYZy SRt7X+o5FFO9iq3+F0sNFWNzl6M162LOG47GFerguZvPVGbVfLPVw4xZGscuKrLBdOiA 85ReM6wzlnrYEALyoZGe3LGTuzFzhJIpKFGoI= Received: by 10.114.187.7 with SMTP id k7mr1829941waf.106.1256691475765; Tue, 27 Oct 2009 17:57:55 -0700 (PDT) Received: from Gregory-T60.gmail.com (nat-service4.juniper.net [66.129.225.151]) by mx.google.com with ESMTPS id 22sm251636pzk.2.2009.10.27.17.57.53 (version=SSLv3 cipher=RC4-MD5); Tue, 27 Oct 2009 17:57:54 -0700 (PDT) Message-ID: <4ae79712.9613f30a.5387.159a@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Tue, 27 Oct 2009 17:57:50 -0700 To: Brian Weis ,karp@ietf.org From: "Gregory M. Lebovitz" In-Reply-To: <02562157-F43A-4151-9D11-7D0EB3151B16@cisco.com> References: <02562157-F43A-4151-9D11-7D0EB3151B16@cisco.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [karp] KARP Agenda at IETF 76 X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 00:57:48 -0000 At 08:12 PM 10/26/2009, Brian Weis wrote: >Folks, > >The draft agenda for the BoF has been posted: >. Thanks a ton, Joel and Brian, for getting this out. Looks great. A few comments: The current versions will be: draft-ietf-tcpm-tcp-auth-opt-08 draft-ietf-tcpm-tcp-ao-crypto-01 They should publish today or tomorrow. I'd like to see the roadmap discussion (my part) broken down into it's more explanative piece parts, as these are the parts that a BoF really needs to discuss separately, and don't rightfully belong in one huge document as I have them today. Rather, they belong in 3 different documents, I would think. - Goals / Overview - 5 min - Threat Model - 7 min - Requirements - 8 min - Framework - 10 min Could we add this to the charter: - Definition of the process of what work will be done in KARP vs in routing WG's and how the overlaps will be handled. - 10 min To get more time for this process discussion, I'd suggest the example preso of TCP-AO be shortened to 10 min. Justification: we don't need to teach on -AO, just quickly show how we got from MD5 to -AO as an example. Then we can take 5 min from the discussion at the end, to create a total of 10 min for the definition of process part. Last, I'd like to see some of brief examples of work in progress on KARP-like topics from the community. Several of you have sent me things like these, from Vishwas: 1. http://www.ietf.org/internet-drafts/draft-ietf-opsec-routing-protocols-crypto-issues-00.txt is the draft I was talking about. 2. http://tools.ietf.org/html/rfc5310 is the IS-IS RFC. 3. http://tools.ietf.org/html/draft-ietf-ospf-hmac-sha-03 is the equivalent OSPF draft 4. http://tools.ietf.org/html/draft-bhatia-manral-igp-crypto-requirements-03 is the draft for Crypto requirements. Would anyone like to give a 5 min preso on any of these things? Or any other related work? Gregory. >Thanks, >Joel & Brian >_______________________________________________ >karp mailing list >karp@ietf.org >https://www.ietf.org/mailman/listinfo/karp From bew@cisco.com Tue Oct 27 18:16:56 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A2EF83A6A90 for ; Tue, 27 Oct 2009 18:16:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ltXKu3467c7p for ; Tue, 27 Oct 2009 18:16:55 -0700 (PDT) Received: from sj-iport-1.cisco.com (sj-iport-1.cisco.com [171.71.176.70]) by core3.amsl.com (Postfix) with ESMTP id 9A8893A67B0 for ; Tue, 27 Oct 2009 18:16:55 -0700 (PDT) Authentication-Results: sj-iport-1.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEAGs450qrR7Ht/2dsb2JhbADBM4koCY8dglWBagQ X-IronPort-AV: E=Sophos;i="4.44,636,1249257600"; d="scan'208";a="262455523" Received: from sj-core-1.cisco.com ([171.71.177.237]) by sj-iport-1.cisco.com with ESMTP; 28 Oct 2009 01:15:46 +0000 Received: from dhcp-128-107-163-77.cisco.com (dhcp-128-107-163-77.cisco.com [128.107.163.77]) by sj-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n9S1F2jL020382; Wed, 28 Oct 2009 01:15:46 GMT Message-Id: <592901D5-7B45-4001-A784-3E341AFDB863@cisco.com> From: Brian Weis To: "Gregory M. Lebovitz" In-Reply-To: <4ae79712.9613f30a.5387.159a@mx.google.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Tue, 27 Oct 2009 18:15:33 -0700 References: <02562157-F43A-4151-9D11-7D0EB3151B16@cisco.com> <4ae79712.9613f30a.5387.159a@mx.google.com> X-Mailer: Apple Mail (2.936) Cc: karp@ietf.org Subject: Re: [karp] KARP Agenda at IETF 76 X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 01:16:56 -0000 Hi Gregory, On Oct 27, 2009, at 5:57 PM, Gregory M. Lebovitz wrote: > At 08:12 PM 10/26/2009, Brian Weis wrote: >> Folks, >> >> The draft agenda for the BoF has been posted: > >. > > Thanks a ton, Joel and Brian, for getting this out. Looks great. A > few comments: > > The current versions will be: > draft-ietf-tcpm-tcp-auth-opt-08 > draft-ietf-tcpm-tcp-ao-crypto-01 > They should publish today or tomorrow. Thanks. > > I'd like to see the roadmap discussion (my part) broken down into > it's more explanative piece parts, as these are the parts that a BoF > really needs to discuss separately, and don't rightfully belong in > one huge document as I have them today. Rather, they belong in 3 > different documents, I would think. > - Goals / Overview - 5 min > - Threat Model - 7 min > - Requirements - 8 min > - Framework - 10 min Will do. > Could we add this to the charter: > - Definition of the process of what work will be done in KARP vs in > routing WG's and how the overlaps will be handled. - 10 min My expectation is that this will be naturally covered during the Charter Discussion and Open Discussion, as there are likely to be many opinions. I don't think 10 minutes would be long enough, but I'll confer with Joel on this request. > To get more time for this process discussion, I'd suggest the > example preso of TCP-AO be shortened to 10 min. Justification: we > don't need to teach on -AO, just quickly show how we got from MD5 to > -AO as an example. Then we can take 5 min from the discussion at the > end, to create a total of 10 min for the definition of process part. > > Last, I'd like to see some of brief examples of work in progress on > KARP-like topics from the community. Several of you have sent me > things like these, from Vishwas: > > 1. http://www.ietf.org/internet-drafts/draft-ietf-opsec-routing-protocols-crypto-issues-00.txt > is the draft I was talking about. > 2. http://tools.ietf.org/html/rfc5310 is the IS-IS RFC. > 3. http://tools.ietf.org/html/draft-ietf-ospf-hmac-sha-03 is the > equivalent OSPF draft > 4. http://tools.ietf.org/html/draft-bhatia-manral-igp-crypto-requirements-03 > is the draft for Crypto requirements. > > Would anyone like to give a 5 min preso on any of these things? Or > any other related work? There are actually more protocol documents available, and I don't think we'd have time to discuss them all in detail. It's my plan to cover them all lightly during the Survey agenda item. Does that sound reasonable to you? Thanks, Brian > > Gregory. > > > > >> Thanks, >> Joel & Brian >> _______________________________________________ >> karp mailing list >> karp@ietf.org >> https://www.ietf.org/mailman/listinfo/karp > -- Brian Weis Router/Switch Security Group, ARTG, Cisco Systems Telephone: +1 408 526 4796 Email: bew@cisco.com From gregory.ietf@gmail.com Tue Oct 27 18:19:51 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C07603A694D for ; Tue, 27 Oct 2009 18:19:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.417 X-Spam-Level: X-Spam-Status: No, score=-2.417 tagged_above=-999 required=5 tests=[AWL=0.182, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l75LB1VbP2Rk for ; Tue, 27 Oct 2009 18:19:50 -0700 (PDT) Received: from mail-pz0-f204.google.com (mail-pz0-f204.google.com [209.85.222.204]) by core3.amsl.com (Postfix) with ESMTP id 3F8A63A69E2 for ; Tue, 27 Oct 2009 18:19:50 -0700 (PDT) Received: by pzk42 with SMTP id 42so254615pzk.31 for ; Tue, 27 Oct 2009 18:20:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:mime-version:content-type; bh=ETaeNj6COFZccOwhLaKob8oCuieVJeDnywSPCfYMGU0=; b=KRy+2AcWx/ZhUtrwZJ9KawFhGsZm3B1tpkIEtH+BynAVX1lJf13QR3lpHm3xdASl3F gh5nVW16FfslYMKXbghJbHU6sRTuL+SP6hMS7y3V3mBond4ieB7GyEIqgOVpOzi+/sDT YzTNw3t51VRIyh2iaelrDdmXgikcgxY3r62pc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:mime-version:content-type; b=Ci9QR8V7jaKJ0/nYd+02FHfUJBQC21H7zNcDbCP45UnB3i8nsrW+OoYvRq/p2IkVd7 ekdkrJ4fIsKp2jS6KUZkVb5YakYug+L1A4GGDiLqh9I5PwQ4qPo3qbIiCVOg/3eCvVxd HlCNQzKAYxhGPXtqlJh+lWO0J4zzieeGUl/V0= Received: by 10.114.86.2 with SMTP id j2mr11462724wab.159.1256692799640; Tue, 27 Oct 2009 18:19:59 -0700 (PDT) Received: from Gregory-T60.gmail.com (nat-service4.juniper.net [66.129.225.151]) by mx.google.com with ESMTPS id 21sm258041pzk.15.2009.10.27.18.19.57 (version=SSLv3 cipher=RC4-MD5); Tue, 27 Oct 2009 18:19:58 -0700 (PDT) Message-ID: <4ae79c3e.9513f30a.4766.17b6@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Tue, 27 Oct 2009 18:19:53 -0700 To: karp@ietf.org,liuya@huawei.com,Brian Weis From: "Gregory M. Lebovitz" Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: [karp] another work in progress X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 01:19:51 -0000 Here is another document with work in progress in the KARP area: http://www.watersprings.org/pub/id/draft-liu-ospfv3-automated-keying-req-01.txt Ya Liu, or Brian, would you be interested in resurrecting this work and presenting it at the BoF as relevant? Gregory. +++++++++++++++++++++++ IETF-related email from Gregory M. Lebovitz Juniper Networks g r e go r y d o t i e tf a t g m a i l do t c o m From gregory.ietf@gmail.com Tue Oct 27 18:21:37 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0002D28B23E for ; Tue, 27 Oct 2009 18:21:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.432 X-Spam-Level: X-Spam-Status: No, score=-2.432 tagged_above=-999 required=5 tests=[AWL=0.167, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NK2Kn85Vva82 for ; Tue, 27 Oct 2009 18:21:36 -0700 (PDT) Received: from mail-pz0-f204.google.com (mail-pz0-f204.google.com [209.85.222.204]) by core3.amsl.com (Postfix) with ESMTP id 0B12B3A67B0 for ; Tue, 27 Oct 2009 18:21:35 -0700 (PDT) Received: by pzk42 with SMTP id 42so255605pzk.31 for ; Tue, 27 Oct 2009 18:21:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:in-reply-to:references:mime-version:content-type; bh=6GrwPhLnYF5nKGxG0jHA2KNJbWxsqPrytTj44n5+WUA=; b=iaLNybV1xZexJ5tbKckaFiz14HYFWXMh64XSSBnXaT/DKRymHIuUoBG+yHsp8f81aF yiQdAWch1QkyXezyrfdwYGXUrBl9u0b6v4siGHsnuHidYq4T85vNrZopitCf4CdDf0M9 AmH2Y4+HEeJO2xHp5sDm3oBrYlyir3PflidYQ= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:in-reply-to:references :mime-version:content-type; b=VaHlrTmOCOcO57qDLWacWptGPZgYZqrxrraOwYoZomiqftGiozeDgIuF3BP+nUKlYn LKzY8Om1pzA4LbVesNgkbWpusVmSvgUyd7cjkMgdNh7ZcuNZeuEtex556t+PaJrzH2HC S7upZZcoZOLy1wQb4hbeUAOQL32gN+IjZaoSc= Received: by 10.114.44.14 with SMTP id r14mr1984193war.196.1256692907877; Tue, 27 Oct 2009 18:21:47 -0700 (PDT) Received: from Gregory-T60.gmail.com (nat-service4.juniper.net [66.129.225.151]) by mx.google.com with ESMTPS id 21sm259211pzk.11.2009.10.27.18.21.45 (version=SSLv3 cipher=RC4-MD5); Tue, 27 Oct 2009 18:21:46 -0700 (PDT) Message-ID: <4ae79caa.9513f30a.454d.1582@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Tue, 27 Oct 2009 18:21:42 -0700 To: Bill Atwood ,karp@ietf.org From: "Gregory M. Lebovitz" In-Reply-To: <4A6923C1.9080609@cse.concordia.ca> References: <4A6923C1.9080609@cse.concordia.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [karp] [kmart] Automated Key Management for Router Updates X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 01:21:37 -0000 Bill, Did you want to present this at the KARP BOF in Hiroshima? It is definitely related work in progress. Have you published this as an I-D yet? Better speak up now, as the agenda is solidifying quickly. Gregory. At 08:00 PM 7/23/2009, Bill Atwood wrote: >Dear all, > >I have written a paper that outlines the requirements for the >distributed key management part of the "kmart" roadmap, and proposes a >distributed Key Server solution. It has been accepted for >publication/presentation at Emerging 2009 in Malta, October 11--16. > >A preprint of the paper can be accessed via >http://users.encs.concordia.ca/~bill/papers/emerging2009-akm.html > >I welcome comments from any participant in the kmart mailing list (or >anyone else!). > > Bill Atwood > >-- > >Dr. J.W. Atwood, Eng. tel: +1 (514) 848-2424 x3046 >Distinguished Professor Emeritus fax: +1 (514) 848-2830 >Department of Computer Science > and Software Engineering >Concordia University EV 3.185 email: bill@cse.concordia.ca >1455 de Maisonneuve Blvd. West http: //users.encs.concordia.ca/~bill >Montreal, Quebec Canada H3G 1M8 >_______________________________________________ >kmart mailing list >kmart@ietf.org >https://www.ietf.org/mailman/listinfo/kmart From gregory.ietf@gmail.com Tue Oct 27 18:28:25 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3365E3A6860 for ; Tue, 27 Oct 2009 18:28:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.445 X-Spam-Level: X-Spam-Status: No, score=-2.445 tagged_above=-999 required=5 tests=[AWL=0.154, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JHku7V5HImsg for ; Tue, 27 Oct 2009 18:28:24 -0700 (PDT) Received: from mail-pz0-f204.google.com (mail-pz0-f204.google.com [209.85.222.204]) by core3.amsl.com (Postfix) with ESMTP id 57AF13A67F7 for ; Tue, 27 Oct 2009 18:28:24 -0700 (PDT) Received: by pzk42 with SMTP id 42so259461pzk.31 for ; Tue, 27 Oct 2009 18:28:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:cc:in-reply-to:references:mime-version:content-type; bh=k7RquK1u9hJkp5EMlcrqycdzdG06UnPq7OA51tKfxqM=; b=vjKoEhPnfjqCJTgVt27g+TpeHtYQsKkHSSekYBmWTt8q63LRUCKj8otTdMpZz0AY/M oscAyBrkBmJUZ5+z02TzOTK9ZqvReZTWDLGxMKRW4VaYjVdpsggT3P042R0E0m+2a9Mz U2lCDHP7icOqL/SvxG9mzneebDZT5dWuKtfwE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:cc:in-reply-to:references :mime-version:content-type; b=JOj/eRf035+xx7uHUOQLqIjDLpyBmiLBUL9Xz2k3UqV9sG/kHtlAcvyRvrdmb1241w B9Tiwnpu6lwML74NW+98Gn7H4iTcyxK2FsgHb/X+zxMD2j4V3VfC3Vj/QDAzgrbPSdzQ +QE8TmEfWX+N9CsbLWq6Q8ZwyhD6CrAjHgH8s= Received: by 10.114.237.37 with SMTP id k37mr5256872wah.31.1256693316825; Tue, 27 Oct 2009 18:28:36 -0700 (PDT) Received: from Gregory-T60.gmail.com (nat-service4.juniper.net [66.129.225.151]) by mx.google.com with ESMTPS id 20sm264314pzk.1.2009.10.27.18.28.33 (version=SSLv3 cipher=RC4-MD5); Tue, 27 Oct 2009 18:28:35 -0700 (PDT) Message-ID: <4ae79e43.9413f30a.187e.1623@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Tue, 27 Oct 2009 18:28:30 -0700 To: Brian Weis From: "Gregory M. Lebovitz" In-Reply-To: <592901D5-7B45-4001-A784-3E341AFDB863@cisco.com> References: <02562157-F43A-4151-9D11-7D0EB3151B16@cisco.com> <4ae79712.9613f30a.5387.159a@mx.google.com> <592901D5-7B45-4001-A784-3E341AFDB863@cisco.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Cc: karp@ietf.org Subject: Re: [karp] KARP Agenda at IETF 76 X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 01:28:25 -0000 At 06:15 PM 10/27/2009, Brian Weis wrote: >Hi Gregory, > >On Oct 27, 2009, at 5:57 PM, Gregory M. Lebovitz wrote: > >>At 08:12 PM 10/26/2009, Brian Weis wrote: >>>Folks, --snip-- >>Could we add this to the charter: >>- Definition of the process of what work will be done in KARP vs in >>routing WG's and how the overlaps will be handled. - 10 min > >My expectation is that this will be naturally covered during the >Charter Discussion and Open Discussion, as there are likely to be many >opinions. I don't think 10 minutes would be long enough, but I'll >confer with Joel on this request. Either way is fine; I just want to ensure we address this issue explicitly, because people keep bringing it up. >>To get more time for this process discussion, I'd suggest the >>example preso of TCP-AO be shortened to 10 min. Justification: we >>don't need to teach on -AO, just quickly show how we got from MD5 to >>-AO as an example. Then we can take 5 min from the discussion at the >>end, to create a total of 10 min for the definition of process part. >> >>Last, I'd like to see some of brief examples of work in progress on >>KARP-like topics from the community. Several of you have sent me >>things like these, from Vishwas: >> >>1. >>http://www.ietf.org/internet-drafts/draft-ietf-opsec-routing-protocols-crypto-issues-00.txt >>is the draft I was talking about. >>2. http://tools.ietf.org/html/rfc5310 is the IS-IS RFC. >>3. http://tools.ietf.org/html/draft-ietf-ospf-hmac-sha-03 is the >>equivalent OSPF draft >>4. http://tools.ietf.org/html/draft-bhatia-manral-igp-crypto-requirements-03 >>is the draft for Crypto requirements. >> >>Would anyone like to give a 5 min preso on any of these things? Or >>any other related work? > >There are actually more protocol documents available, and I don't >think we'd have time to discuss them all in detail. It's my plan to >cover them all lightly during the Survey agenda item. Does that sound >reasonable to you? Sure. I think we are trying to achieve the same thing here, which is to draw together all the different efforts going on all over the rtg and security areas, show that there is indeed a lot of interest and work in progress, and get them all going in somewhat the same direction. I think having one other presentation other than TCP-AO would be good, as an example. The work on multicast protocols or the OSPF would be good, because they share many similar issues. But I'm fine either way. Your call. Gregory. >Thanks, >Brian > >> >>Gregory. >> >> >> >> >>>Thanks, >>>Joel & Brian >>>_______________________________________________ >>>karp mailing list >>>karp@ietf.org >>>https://www.ietf.org/mailman/listinfo/karp > > >-- >Brian Weis >Router/Switch Security Group, ARTG, Cisco Systems >Telephone: +1 408 526 4796 >Email: bew@cisco.com > > From bill@cse.concordia.ca Tue Oct 27 18:35:28 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EF93228C174 for ; Tue, 27 Oct 2009 18:35:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.855 X-Spam-Level: X-Spam-Status: No, score=-1.855 tagged_above=-999 required=5 tests=[AWL=0.745, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BtXPchxeAojW for ; Tue, 27 Oct 2009 18:35:28 -0700 (PDT) Received: from perseverance.services.encs.concordia.ca (perseverance-96.encs.concordia.ca [132.205.96.94]) by core3.amsl.com (Postfix) with ESMTP id D5F2428C159 for ; Tue, 27 Oct 2009 18:35:27 -0700 (PDT) Received: from localhost (nul-web@newtact.encs.concordia.ca [132.205.96.45]) by perseverance.services.encs.concordia.ca (envelope-from bill@cse.concordia.ca) (8.13.7/8.13.7) with ESMTP id n9S1ZedU011796; Tue, 27 Oct 2009 21:35:40 -0400 X-Received-HTTP: from authenticated user bill on bas4-montreal45-1176236580.dsl.bell.ca (bas4-montreal45-1176236580.dsl.bell.ca [70.27.242.36]) by mail.encs.concordia.ca (Horde MIME library) with HTTP; Tue, 27 Oct 2009 21:35:39 -0400 Message-ID: <20091027213539.efls0s3pi00kcw0w@mail.encs.concordia.ca> Date: Tue, 27 Oct 2009 21:35:39 -0400 From: William Atwood To: "Gregory M. Lebovitz" References: <4A6923C1.9080609@cse.concordia.ca> <4ae79caa.9513f30a.454d.1582@mx.google.com> In-Reply-To: <4ae79caa.9513f30a.454d.1582@mx.google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; format="flowed" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable User-Agent: Internet Messaging Program (IMP) H3 (4.1.6) X-Scanned-By: MIMEDefang 2.58 on perseverance.encs.concordia.ca at 2009/10/27 21:35:40 EDT Cc: karp@ietf.org Subject: Re: [karp] [kmart] Automated Key Management for Router Updates X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 01:35:29 -0000 Gregory, Yes, I would love to present it, but unfortunately I will not be at =20 Hiroshima. It's not in an Internet Draft yet, either. Hopefully, =20 someone will at least read the paper, and give me comments. I will =20 send Brian and Joel some notes on draft-ietf-pim-sm-linklocal and the =20 AKM framework paper, which they can use at their discretion. Bill Quoting "Gregory M. Lebovitz" : > Bill, > Did you want to present this at the KARP BOF in Hiroshima? It is > definitely related work in progress. Have you published this as an I-D > yet? Better speak up now, as the agenda is solidifying quickly. > > Gregory. > > At 08:00 PM 7/23/2009, Bill Atwood wrote: >> Dear all, >> >> I have written a paper that outlines the requirements for the >> distributed key management part of the "kmart" roadmap, and proposes a >> distributed Key Server solution. It has been accepted for >> publication/presentation at Emerging 2009 in Malta, October 11--16. >> >> A preprint of the paper can be accessed via >> http://users.encs.concordia.ca/~bill/papers/emerging2009-akm.html >> >> I welcome comments from any participant in the kmart mailing list (or >> anyone else!). >> >> Bill Atwood >> >> -- >> >> Dr. J.W. Atwood, Eng. tel: +1 (514) 848-2424 x3046 >> Distinguished Professor Emeritus fax: +1 (514) 848-2830 >> Department of Computer Science >> and Software Engineering >> Concordia University EV 3.185 email: bill@cse.concordia.ca >> 1455 de Maisonneuve Blvd. West http: //users.encs.concordia.ca/~bill >> Montreal, Quebec Canada H3G 1M8 >> _______________________________________________ >> kmart mailing list >> kmart@ietf.org >> https://www.ietf.org/mailman/listinfo/kmart --=20 Dr. J.W. Atwood, Eng. tel: +1 (514) 848-2424 x3046 Professor Emeritus fax: +1 (514) 848-2830 Department of Computer Science and Software Engineering Concordia University EV 3.185 email: bill@cse.concordia.ca 1455 de Maisonneuve Blvd. West http://www.cse.concordia.ca/~bill Montreal, Quebec Canada H3G 1M8 From manavbhatia@gmail.com Tue Oct 27 21:17:16 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F1013A6959 for ; Tue, 27 Oct 2009 21:17:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a0oOSGwAhZfk for ; Tue, 27 Oct 2009 21:17:15 -0700 (PDT) Received: from mail-qy0-f203.google.com (mail-qy0-f203.google.com [209.85.221.203]) by core3.amsl.com (Postfix) with ESMTP id 1BDC03A676A for ; Tue, 27 Oct 2009 21:17:15 -0700 (PDT) Received: by qyk41 with SMTP id 41so285292qyk.29 for ; Tue, 27 Oct 2009 21:17:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=RvnWyANB8mQvlfOggA5yxLjDE33GH8MNc8HJJJ6ju80=; b=Raf9cEneqgiP3WWY5lCf6gpG6Vv7hR4hA0d7XenxVeCHUGrG2++hr/1s+f3iqvKRy+ Rki1UtNGEYXEQVmzwtQ4xov18y99bX2uRODgMSJMsBZ/7l+aDtMrVRP5YQyJvrSdycfN spC94yjjQ/XO2dXk/Sx+BrW71CzJxDbr8PfJ8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=bacYkJDszR+cCIjM+cLabEiCCbgyFnRMkEOGxAYUNF6vlFg6vcIYsDJ+jm8KxTPufT T+O5Jsq0z7Z8MCcBLsuTs9mX+kZ9xNPubs+rIcIWuCabEIb7e1IgjQc1UNUmNTu0Zfa3 577Rc2WoP1ye+nZcnb1oCrTUtyqIZjFvZNDbU= MIME-Version: 1.0 Received: by 10.224.5.135 with SMTP id 7mr9014577qav.148.1256703447208; Tue, 27 Oct 2009 21:17:27 -0700 (PDT) In-Reply-To: <4ae79712.9613f30a.5387.159a@mx.google.com> References: <02562157-F43A-4151-9D11-7D0EB3151B16@cisco.com> <4ae79712.9613f30a.5387.159a@mx.google.com> Date: Wed, 28 Oct 2009 09:47:27 +0530 Message-ID: From: Manav Bhatia To: "Gregory M. Lebovitz" Content-Type: text/plain; charset=ISO-8859-1 Cc: karp@ietf.org Subject: Re: [karp] KARP Agenda at IETF 76 X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 04:17:16 -0000 Hi Gregory, > Last, I'd like to see some of brief examples > of work in progress on KARP-like topics from > the community. Several of you have sent me things > like these, from Vishwas: > > 1. http://www.ietf.org/internet-drafts/draft-ietf-opsec-routing-protocols-crypto-issues-00.txt > is the draft I was talking about. This draft was updated based on the feedback that we received in OPSEC and the new revision can be found here: http://tools.ietf.org/html/draft-ietf-opsec-routing-protocols-crypto-issues-01 There are issues with the formatting which will be fixed in the next revision. > 2. http://tools.ietf.org/html/rfc5310 is the IS-IS RFC. > 3. http://tools.ietf.org/html/draft-ietf-ospf-hmac-sha-03 is the > equivalent OSPF draft This is RFC 5709 now. > 4. http://tools.ietf.org/html/draft-bhatia-manral-igp-crypto-requirements-03 > is the draft for Crypto requirements. There is one for BFD too - http://www.potaroo.net/ietf/all-ids/draft-bhatia-bfd-crypto-auth-00.txt I will be posting the revised and the updated ID after this IETF once draft submission reopens. Cheers, Manav From ietf@hardjono.net Wed Oct 28 08:00:59 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E73743A682B for ; Wed, 28 Oct 2009 08:00:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.265 X-Spam-Level: X-Spam-Status: No, score=-2.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2-kcInLgNzfD for ; Wed, 28 Oct 2009 08:00:58 -0700 (PDT) Received: from outbound-mail-130.bluehost.com (outbound-mail-130.bluehost.com [67.222.38.30]) by core3.amsl.com (Postfix) with SMTP id 9C65028C1B7 for ; Wed, 28 Oct 2009 08:00:56 -0700 (PDT) Received: (qmail 7525 invoked by uid 0); 28 Oct 2009 15:01:11 -0000 Received: from unknown (HELO box251.bluehost.com) (69.89.31.51) by outboundproxy4.bluehost.com with SMTP; 28 Oct 2009 15:01:11 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=hardjono.net; h=Received:From:To:Cc:References:In-Reply-To:Subject:Date:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:Thread-Index:Content-Language:X-Identified-User; b=kYhhzrxT/aIAjLb+1+TBbLl66CEHanUUkNz6FWg6WwJZxja5oaA5JSvBD932bXPlkYTOXFZYMFsyKkIbCNuF1BJ6q0tyxKEwKmMuQw7VGbONh0mKUeIDFVowh8viUyEj; Received: from dhcp-18-111-94-234.dyn.mit.edu ([18.111.94.234] helo=thomasvnf1ekrv) by box251.bluehost.com with esmtpsa (TLSv1:RC4-MD5:128) (Exim 4.69) (envelope-from ) id 1N3A1O-0005Mt-Jc; Wed, 28 Oct 2009 09:01:10 -0600 From: "Thomas Hardjono" To: "'William Atwood'" , "'Gregory M. Lebovitz'" References: <4A6923C1.9080609@cse.concordia.ca> <4ae79caa.9513f30a.454d.1582@mx.google.com> <20091027213539.efls0s3pi00kcw0w@mail.encs.concordia.ca> In-Reply-To: <20091027213539.efls0s3pi00kcw0w@mail.encs.concordia.ca> Date: Wed, 28 Oct 2009 11:00:52 -0400 Message-ID: <002101ca57df$790dc6f0$6b2954d0$@net> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcpXbvdFMnx5gMPaQiuZHEtbwe8v8AAa48EA Content-Language: en-us X-Identified-User: {727:box251.bluehost.com:hardjono:hardjono.net} {sentby:smtp auth 18.111.94.234 authed with ietf+hardjono.net} Cc: karp@ietf.org Subject: Re: [karp] [kmart] Automated Key Management for Router Updates X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 15:01:00 -0000 Bill, folks, I read through the paper -- interesting use of GDOI. I'm kind of thinking that the KARP problem has multiple faces/phases (similar if not identical to the NIST 800-57 lifecycle): (a) Initialization phase, where all the entities (routers) somehow obtains the relevant keying material. (b) Operational phases, where the routers use or exercise the keys. (c) Maintenance phase, where security maintenance is performed (eg. backup of keys, migration to new router, re-initialization, etc. etc). (d) Decommissioning phase, where routers are taken off the network in a graceful (and secure) way, and their keys logged elsewhere (for legal purposes) and then nuked. Many IT folks in medium to large Enterprises dislike having to install and operate yet another management console (for another part or aspect of their network and IT). So it would a good design goal for the KARP WG to allow the resulting KARP protocol to be "integrate-able" to existing network management consoles (read products) that implement device-management protocols (eg. WS-Man, DMTF DASH/MASH, etc etc). Some of these existing protocols could be used for one or more of the phases above. For key management specifically, perhaps the KARP WG could look at re-using the Oasis KMIP work (Key Management Interoperability Protocol). Something like a router-specific profile could be created. The KMIT spec already support a number of key formats (packing format), as well as transport methods. Thoughts? cheers, /thomas/ > -----Original Message----- > From: karp-bounces@ietf.org [mailto:karp-bounces@ietf.org] On Behalf Of > William Atwood > Sent: Tuesday, October 27, 2009 9:36 PM > To: Gregory M. Lebovitz > Cc: karp@ietf.org > Subject: Re: [karp] [kmart] Automated Key Management for Router Updates > > Gregory, > > Yes, I would love to present it, but unfortunately I will not be at > Hiroshima. It's not in an Internet Draft yet, either. Hopefully, > someone will at least read the paper, and give me comments. I will > send Brian and Joel some notes on draft-ietf-pim-sm-linklocal and the > AKM framework paper, which they can use at their discretion. > > Bill > > Quoting "Gregory M. Lebovitz" : > > > Bill, > > Did you want to present this at the KARP BOF in Hiroshima? It is > > definitely related work in progress. Have you published this as an I-D > > yet? Better speak up now, as the agenda is solidifying quickly. > > > > Gregory. > > > > At 08:00 PM 7/23/2009, Bill Atwood wrote: > >> Dear all, > >> > >> I have written a paper that outlines the requirements for the > >> distributed key management part of the "kmart" roadmap, and proposes > a > >> distributed Key Server solution. It has been accepted for > >> publication/presentation at Emerging 2009 in Malta, October 11--16. > >> > >> A preprint of the paper can be accessed via > >> http://users.encs.concordia.ca/~bill/papers/emerging2009-akm.html > >> > >> I welcome comments from any participant in the kmart mailing list (or > >> anyone else!). > >> > >> Bill Atwood > >> > >> -- > >> > >> Dr. J.W. Atwood, Eng. tel: +1 (514) 848-2424 x3046 > >> Distinguished Professor Emeritus fax: +1 (514) 848-2830 > >> Department of Computer Science > >> and Software Engineering > >> Concordia University EV 3.185 email: bill@cse.concordia.ca > >> 1455 de Maisonneuve Blvd. West http: > //users.encs.concordia.ca/~bill > >> Montreal, Quebec Canada H3G 1M8 > >> _______________________________________________ > >> kmart mailing list > >> kmart@ietf.org > >> https://www.ietf.org/mailman/listinfo/kmart > > > > -- > Dr. J.W. Atwood, Eng. tel: +1 (514) 848-2424 x3046 > Professor Emeritus fax: +1 (514) 848-2830 > Department of Computer Science > and Software Engineering > Concordia University EV 3.185 email: bill@cse.concordia.ca > 1455 de Maisonneuve Blvd. West http://www.cse.concordia.ca/~bill > Montreal, Quebec Canada H3G 1M8 > > _______________________________________________ > karp mailing list > karp@ietf.org > https://www.ietf.org/mailman/listinfo/karp From bew@cisco.com Wed Oct 28 08:33:10 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C164828C1D9 for ; Wed, 28 Oct 2009 08:33:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VeQ6c-EAPORe for ; Wed, 28 Oct 2009 08:33:09 -0700 (PDT) Received: from sj-iport-1.cisco.com (sj-iport-1.cisco.com [171.71.176.70]) by core3.amsl.com (Postfix) with ESMTP id 319C128C1D6 for ; Wed, 28 Oct 2009 08:33:09 -0700 (PDT) Authentication-Results: sj-iport-1.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEANMA6EqrR7Ht/2dsb2JhbADBfIkoCY8AglWBagSBYQ X-IronPort-AV: E=Sophos;i="4.44,640,1249257600"; d="scan'208";a="262783545" Received: from sj-core-1.cisco.com ([171.71.177.237]) by sj-iport-1.cisco.com with ESMTP; 28 Oct 2009 15:33:24 +0000 Received: from stealth-10-32-244-210.cisco.com (stealth-10-32-244-210.cisco.com [10.32.244.210]) by sj-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n9SFXOU2000244; Wed, 28 Oct 2009 15:33:24 GMT Message-Id: From: Brian Weis To: "Gregory M. Lebovitz" In-Reply-To: <4ae79c3e.9513f30a.4766.17b6@mx.google.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Wed, 28 Oct 2009 08:33:23 -0700 References: <4ae79c3e.9513f30a.4766.17b6@mx.google.com> X-Mailer: Apple Mail (2.936) Cc: Liu Ya , karp@ietf.org Subject: Re: [karp] another work in progress X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 15:33:10 -0000 Hi Gregory, On Oct 27, 2009, at 6:19 PM, Gregory M. Lebovitz wrote: > Here is another document with work in progress in the KARP area: > > http://www.watersprings.org/pub/id/draft-liu-ospfv3-automated-keying-req-01.txt > > Ya Liu, or Brian, would you be interested in resurrecting this work > and presenting it at the BoF as relevant? Thanks for pointing out this draft. This is very preliminary investigating ways of using the MSEC WG automated key management protocols with OSPF. We can mention it in the Survey agenda item as working having been done in this area, but discussion should take place when there's an actual working group. Thanks, Brian > > Gregory. > > > +++++++++++++++++++++++ > IETF-related email from > Gregory M. Lebovitz > Juniper Networks > g r e go r y d o t i e tf a t g m a i l do t c o m -- Brian Weis Router/Switch Security Group, ARTG, Cisco Systems Telephone: +1 408 526 4796 Email: bew@cisco.com From gregory.ietf@gmail.com Wed Oct 28 09:09:42 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2C9B23A6949 for ; Wed, 28 Oct 2009 09:09:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.932 X-Spam-Level: X-Spam-Status: No, score=-2.932 tagged_above=-999 required=5 tests=[AWL=-0.333, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dJN7IPaRVY3w for ; Wed, 28 Oct 2009 09:09:41 -0700 (PDT) Received: from mail-bw0-f223.google.com (mail-bw0-f223.google.com [209.85.218.223]) by core3.amsl.com (Postfix) with ESMTP id 016DC3A6858 for ; Wed, 28 Oct 2009 09:09:40 -0700 (PDT) Received: by bwz23 with SMTP id 23so1178375bwz.29 for ; Wed, 28 Oct 2009 09:09:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:cc:in-reply-to:references:mime-version:content-type; bh=Naed3J192JeBZWsmPVxVg8SLtpY3DNMV92CT3xUcO/o=; b=Xlt8D2ku5bHDlzCaiRPsfJYFqE6OvH0ofW3D+o7bxTlKepgxflt4UcRmLQ0yXVWjcr M36bT2WDm0WCpnFgk8z856qk62CwBzf2/9E2JoUG6ukSWL0Cz/2IMwTnWD5kg7cqNqGM yGdne7AOHgqLk28rKxo9ykGMZagGyV6ANZNys= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:cc:in-reply-to:references :mime-version:content-type; b=G+j7mJKqXzdT0XtrTy+T61ez0gKH0nTy0fh47rCEVraWQisMSVOyPQS3aJAdgoz2jR vtBO+RPc5lphzpG4XlQG/lhgjOHSlNwXV4gohTNxz51WCTzXYGQuRm4Owkju86nKM9km jCrEnqde34bQ+jfKMykvxIidRBXMpi4x2nmvc= Received: by 10.204.156.3 with SMTP id u3mr4586550bkw.179.1256746194667; Wed, 28 Oct 2009 09:09:54 -0700 (PDT) Received: from Gregory-T60.gmail.com (c-98-248-97-91.hsd1.ca.comcast.net [98.248.97.91]) by mx.google.com with ESMTPS id 21sm2038500fks.39.2009.10.28.09.09.52 (version=SSLv3 cipher=RC4-MD5); Wed, 28 Oct 2009 09:09:53 -0700 (PDT) Message-ID: <4ae86cd1.15135e0a.1942.ffffc542@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Wed, 28 Oct 2009 09:09:48 -0700 To: Brian Weis From: "Gregory M. Lebovitz" In-Reply-To: References: <4ae79c3e.9513f30a.4766.17b6@mx.google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Cc: Liu Ya , karp@ietf.org Subject: Re: [karp] another work in progress X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 16:09:42 -0000 At 08:33 AM 10/28/2009, Brian Weis wrote: >Hi Gregory, > >On Oct 27, 2009, at 6:19 PM, Gregory M. Lebovitz wrote: > >>Here is another document with work in progress in the KARP area: >> >>http://www.watersprings.org/pub/id/draft-liu-ospfv3-automated-keying-req-01.txt >> >>Ya Liu, or Brian, would you be interested in resurrecting this work >>and presenting it at the BoF as relevant? > >Thanks for pointing out this draft. This is very preliminary >investigating ways of using the MSEC WG automated key management >protocols with OSPF. We can mention it in the Survey agenda item as >working having been done in this area, but discussion should take >place when there's an actual working group. Agreed. The goal was to ensure in the BoF that people see the girth of working being done on the topic, realize that it is sizable, and realize that the various efforts have all been spread around in various corners of the IETF where they don't get much bandwidth. One of the goals of forming a BoF is consolidating the various efforts into one place with bandwidth and focus. Gregory. >Thanks, >Brian > >> >>Gregory. >> >> >>+++++++++++++++++++++++ >>IETF-related email from >>Gregory M. Lebovitz >>Juniper Networks >>g r e go r y d o t i e tf a t g m a i l do t c o m > > >-- >Brian Weis >Router/Switch Security Group, ARTG, Cisco Systems >Telephone: +1 408 526 4796 >Email: bew@cisco.com > > From bew@cisco.com Wed Oct 28 11:03:26 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D7A0328C0F0 for ; Wed, 28 Oct 2009 11:03:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N2-T6MvbgusB for ; Wed, 28 Oct 2009 11:03:25 -0700 (PDT) Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) by core3.amsl.com (Postfix) with ESMTP id C03FC3A6A38 for ; Wed, 28 Oct 2009 11:03:25 -0700 (PDT) Authentication-Results: sj-iport-2.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEADQk6EqrR7Ht/2dsb2JhbADCJYkoCY59glWBagQ X-IronPort-AV: E=Sophos;i="4.44,641,1249257600"; d="scan'208";a="218827134" Received: from sj-core-1.cisco.com ([171.71.177.237]) by sj-iport-2.cisco.com with ESMTP; 28 Oct 2009 18:03:41 +0000 Received: from dhcp-128-107-163-77.cisco.com (dhcp-128-107-163-77.cisco.com [128.107.163.77]) by sj-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n9SI3fMH029514; Wed, 28 Oct 2009 18:03:41 GMT Message-Id: From: Brian Weis To: Thomas Hardjono In-Reply-To: <002101ca57df$790dc6f0$6b2954d0$@net> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Wed, 28 Oct 2009 11:03:39 -0700 References: <4A6923C1.9080609@cse.concordia.ca> <4ae79caa.9513f30a.454d.1582@mx.google.com> <20091027213539.efls0s3pi00kcw0w@mail.encs.concordia.ca> <002101ca57df$790dc6f0$6b2954d0$@net> X-Mailer: Apple Mail (2.936) Cc: karp@ietf.org Subject: Re: [karp] [kmart] Automated Key Management for Router Updates X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 18:03:26 -0000 Hi Thomas, On Oct 28, 2009, at 8:00 AM, Thomas Hardjono wrote: > Bill, folks, > > I read through the paper -- interesting use of GDOI. > > I'm kind of thinking that the KARP problem has multiple faces/phases > (similar if not identical to the NIST 800-57 lifecycle): > > (a) Initialization phase, where all the entities (routers) somehow > obtains > the relevant keying material. > > (b) Operational phases, where the routers use or exercise the keys. > > (c) Maintenance phase, where security maintenance is performed (eg. > backup > of keys, migration to new router, re-initialization, etc. etc). > > (d) Decommissioning phase, where routers are taken off the network > in a > graceful (and secure) way, and their keys logged elsewhere (for legal > purposes) and then nuked. That's a good overview of life cycle key management, and it might be a good topic for the OPSEC WG. > > Many IT folks in medium to large Enterprises dislike having to > install and > operate yet another management console (for another part or aspect > of their > network and IT). So it would a good design goal for the KARP WG to > allow the > resulting KARP protocol to be "integrate-able" to existing network > management consoles (read products) that implement device-management > protocols (eg. WS-Man, DMTF DASH/MASH, etc etc). Some of these > existing > protocols could be used for one or more of the phases above. > > For key management specifically, perhaps the KARP WG could look at > re-using > the Oasis KMIP work (Key Management Interoperability Protocol). > Something > like a router-specific profile could be created. The KMIT spec already > support a number of key formats (packing format), as well as transport > methods. Thanks for pointing out this work. A KARP WG (should it be formed) could consider the KMIP key when it begins work on automated key management. However, specifying the use of (or changes to) protocols developed outside of the IETF might be an issue. I'd welcome further thoughts on this once a WG is formed and thinking about automated key management. Thanks, Brian > > Thoughts? > > cheers, > > /thomas/ > > > > > >> -----Original Message----- >> From: karp-bounces@ietf.org [mailto:karp-bounces@ietf.org] On >> Behalf Of >> William Atwood >> Sent: Tuesday, October 27, 2009 9:36 PM >> To: Gregory M. Lebovitz >> Cc: karp@ietf.org >> Subject: Re: [karp] [kmart] Automated Key Management for Router >> Updates >> >> Gregory, >> >> Yes, I would love to present it, but unfortunately I will not be at >> Hiroshima. It's not in an Internet Draft yet, either. Hopefully, >> someone will at least read the paper, and give me comments. I will >> send Brian and Joel some notes on draft-ietf-pim-sm-linklocal and the >> AKM framework paper, which they can use at their discretion. >> >> Bill >> >> Quoting "Gregory M. Lebovitz" : >> >>> Bill, >>> Did you want to present this at the KARP BOF in Hiroshima? It is >>> definitely related work in progress. Have you published this as an >>> I-D >>> yet? Better speak up now, as the agenda is solidifying quickly. >>> >>> Gregory. >>> >>> At 08:00 PM 7/23/2009, Bill Atwood wrote: >>>> Dear all, >>>> >>>> I have written a paper that outlines the requirements for the >>>> distributed key management part of the "kmart" roadmap, and >>>> proposes >> a >>>> distributed Key Server solution. It has been accepted for >>>> publication/presentation at Emerging 2009 in Malta, October 11--16. >>>> >>>> A preprint of the paper can be accessed via >>>> http://users.encs.concordia.ca/~bill/papers/emerging2009-akm.html >>>> >>>> I welcome comments from any participant in the kmart mailing list >>>> (or >>>> anyone else!). >>>> >>>> Bill Atwood >>>> >>>> -- >>>> >>>> Dr. J.W. Atwood, Eng. tel: +1 (514) 848-2424 x3046 >>>> Distinguished Professor Emeritus fax: +1 (514) 848-2830 >>>> Department of Computer Science >>>> and Software Engineering >>>> Concordia University EV 3.185 email: bill@cse.concordia.ca >>>> 1455 de Maisonneuve Blvd. West http: >> //users.encs.concordia.ca/~bill >>>> Montreal, Quebec Canada H3G 1M8 >>>> _______________________________________________ >>>> kmart mailing list >>>> kmart@ietf.org >>>> https://www.ietf.org/mailman/listinfo/kmart >> >> >> >> -- >> Dr. J.W. Atwood, Eng. tel: +1 (514) 848-2424 x3046 >> Professor Emeritus fax: +1 (514) 848-2830 >> Department of Computer Science >> and Software Engineering >> Concordia University EV 3.185 email: bill@cse.concordia.ca >> 1455 de Maisonneuve Blvd. West http://www.cse.concordia.ca/~bill >> Montreal, Quebec Canada H3G 1M8 >> >> _______________________________________________ >> karp mailing list >> karp@ietf.org >> https://www.ietf.org/mailman/listinfo/karp > > _______________________________________________ > karp mailing list > karp@ietf.org > https://www.ietf.org/mailman/listinfo/karp -- Brian Weis Router/Switch Security Group, ARTG, Cisco Systems Telephone: +1 408 526 4796 Email: bew@cisco.com From manavbhatia@gmail.com Wed Oct 28 17:52:53 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8C3703A6A7B for ; Wed, 28 Oct 2009 17:52:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.349 X-Spam-Level: X-Spam-Status: No, score=-2.349 tagged_above=-999 required=5 tests=[AWL=-0.250, BAYES_00=-2.599, MIME_BAD_LINEBREAK=0.5] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w0tzULpx-hlg for ; Wed, 28 Oct 2009 17:52:50 -0700 (PDT) Received: from mail-qy0-f203.google.com (mail-qy0-f203.google.com [209.85.221.203]) by core3.amsl.com (Postfix) with ESMTP id D40443A6A72 for ; Wed, 28 Oct 2009 17:52:49 -0700 (PDT) Received: by qyk41 with SMTP id 41so920784qyk.29 for ; Wed, 28 Oct 2009 17:53:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=cqYTzv+BbOpjHTybHpghPjZxnPNRmZtsMDrZz6qR12g=; b=PehyMEgQd8ypqtkLiLLPW9zdTf73U1C4W38ovpDYIUGF906OtowP2LGy4/sIYQu5lv 3dHQObrTOnfkv4wqqK6zcjDRzmuQhT9wQaQQ/Vv8vX/ex0L81lforCDjD5xVF9c3uczw un/p48T9Rg2lecryqCRn+wA041/HizhYQjP5M= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=Eii3tZ9G7ux4M/ZF142YlUc9KrJUBF1A6PYVnpgDrgfWZG7e/rfff6BSzdnmTnSXY3 ZrDsZQs7H6cIkf3rPXbciw/qWjsJ5Vokv3THr7i0GABZaORAu/gSx1aHLP8qmlmiwfnS VjWubwrL2xS1SxIDA+oIGJmiFjXF+++qYb688= MIME-Version: 1.0 Received: by 10.224.100.13 with SMTP id w13mr9623965qan.292.1256777582573; Wed, 28 Oct 2009 17:53:02 -0700 (PDT) Date: Thu, 29 Oct 2009 06:23:02 +0530 Message-ID: From: Manav Bhatia To: karp@ietf.org Content-Type: multipart/mixed; boundary=00c09fa217a75f02d1047708553a Subject: [karp] draft-ietf-opsec-routing-protocols-crypto-issues-01.txt X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2009 00:52:53 -0000 --00c09fa217a75f02d1047708553a Content-Type: text/plain; charset=ISO-8859-1 Hi, I am attaching a formatted copy of the above draft as the one that was submitted has some formatting issues. http://tools.ietf.org/id/draft-ietf-opsec-routing-protocols-crypto-issues-01.txt Abstract Routing protocols have over time been extended to use cryptographic mechanisms to validate data being received from a neighboring router to ensure that: o it has not been modified in transit. o actually originated from an authorized neighboring router . The cryptographic mechanisms defined to date and described in this document rely on a digest produced with a hash algorithm applied to the payload encapsulated in the routing protocol packet. This document outlines some of the limitations of the current mechanism, problems with manual keying of these cryptographic algorithms, and possible vectors for the exploitation of these limitations. Cheers, Manav --00c09fa217a75f02d1047708553a Content-Type: text/plain; charset=US-ASCII; name="draft-ietf-opsec-routing-protocols-crypto-issues-01.txt" Content-Disposition: attachment; filename="draft-ietf-opsec-routing-protocols-crypto-issues-01.txt" Content-Transfer-Encoding: base64 X-Attachment-Id: f_g1csqga60 SW50ZXJuZXQtRHJhZnQgICAgICBSb3V0aW5nIFByb3RvY29sIFByb3RlY3Rpb24gSXNzdWVzICAg ICAgT2N0b2JlciAyMDA5IA0KIA0KIA0KICAgTmV0d29yayBXb3JraW5nIEdyb3VwICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgVmlzaHdhcyBNYW5yYWwgDQogICBJbnRlcm5ldC1EcmFm dCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJUCBJbmZ1c2lvbiAN CiAgIEV4cGlyZXM6IE1hcmNoIDIwMTAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgTWFuYXYgQmhhdGlhIA0KICAgSW50ZW5kZWQgU3RhdHVzOiBJbmZvcm1hdGlvbmFsICAgICAg ICAgICAgICAgICAgICAgICAgQWxjYXRlbC1MdWNlbnQgDQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpvZWwgSmFlZ2dsaSANCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGVja3BvaW50 IFNvZnR3YXJlIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIFJ1c3MgV2hpdGUgDQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2lzY28gU3lzdGVtcyANCiAgICANCiAgICAg SXNzdWVzIHdpdGggZXhpc3RpbmcgQ3J5cHRvZ3JhcGhpYyBQcm90ZWN0aW9uIE1ldGhvZHMgZm9y IFJvdXRpbmcgDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQcm90b2NvbHMgDQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0KICAgICAgICAgIGRyYWZ0LWll dGYtb3BzZWMtcm91dGluZy1wcm90b2NvbHMtY3J5cHRvLWlzc3Vlcy0wMS50eHQgDQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0KU3RhdHVzIG9mIHRoaXMgTWVtbyANCiAg ICANCiAgIERpc3RyaWJ1dGlvbiBvZiB0aGlzIG1lbW8gaXMgdW5saW1pdGVkLiANCiAgICANCiAg IEJ5IHN1Ym1pdHRpbmcgdGhpcyBJbnRlcm5ldC1EcmFmdCwgZWFjaCBhdXRob3IgcmVwcmVzZW50 cyB0aGF0IGFueSANCiAgIGFwcGxpY2FibGUgcGF0ZW50IG9yIG90aGVyIElQUiBjbGFpbXMgb2Yg d2hpY2ggaGUgb3Igc2hlIGlzIGF3YXJlIA0KICAgaGF2ZSBiZWVuIG9yIHdpbGwgYmUgZGlzY2xv c2VkLCBhbmQgYW55IG9mIHdoaWNoIGhlIG9yIHNoZSBiZWNvbWVzIA0KICAgYXdhcmUgd2lsbCBi ZSBkaXNjbG9zZWQsIGluIGFjY29yZGFuY2Ugd2l0aCBTZWN0aW9uIDYgb2YgQkNQIDc5LiANCiAg ICANCiAgIEludGVybmV0LURyYWZ0cyBhcmUgd29ya2luZyBkb2N1bWVudHMgb2YgdGhlIEludGVy bmV0IEVuZ2luZWVyaW5nIA0KICAgVGFzayBGb3JjZSAoSUVURiksIGl0cyBhcmVhcywgYW5kIGl0 cyB3b3JraW5nIGdyb3Vwcy4gTm90ZSB0aGF0IG90aGVyIA0KICAgZ3JvdXBzIG1heSBhbHNvIGRp c3RyaWJ1dGUgd29ya2luZyBkb2N1bWVudHMgYXMgSW50ZXJuZXQtRHJhZnRzLiANCiAgICANCiAg IEludGVybmV0LURyYWZ0cyBhcmUgZHJhZnQgZG9jdW1lbnRzIHZhbGlkIGZvciBhIG1heGltdW0g b2Ygc2l4IG1vbnRocyANCiAgIGFuZCBtYXkgYmUgdXBkYXRlZCwgcmVwbGFjZWQsIG9yIG9ic29s ZXRlZCBieSBvdGhlciBkb2N1bWVudHMgYXQgYW55IA0KICAgdGltZS4gIEl0IGlzIGluYXBwcm9w cmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBhcyByZWZlcmVuY2UgDQogICBtYXRlcmlhbCBv ciB0byBjaXRlIHRoZW0gb3RoZXIgdGhhbiBhcyAid29yayBpbiBwcm9ncmVzcy4iIA0KICAgIA0K ICAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC1EcmFmdHMgY2FuIGJlIGFjY2Vzc2VkIGF0 IA0KICAgaHR0cDovL3d3dy5pZXRmLm9yZy8xaWQtYWJzdHJhY3RzLmh0bWwgDQogICAgDQogICBU aGUgbGlzdCBvZiBJbnRlcm5ldC1EcmFmdCBTaGFkb3cgRGlyZWN0b3JpZXMgY2FuIGJlIGFjY2Vz c2VkIGF0IA0KICAgaHR0cDovL3d3dy5pZXRmLm9yZy9zaGFkb3cuaHRtbC4gDQogICAgDQogICAg DQpDb3B5cmlnaHQgTm90aWNlIA0KIA0KICAgQ29weXJpZ2h0IChjKSAyMDA5IElFVEYgVHJ1c3Qg YW5kIHRoZSBwZXJzb25zIGlkZW50aWZpZWQgYXMgdGhlIA0KICAgZG9jdW1lbnQgYXV0aG9ycy4g IEFsbCByaWdodHMgcmVzZXJ2ZWQuIA0KICAgIA0KICAgVGhpcyBkb2N1bWVudCBpcyBzdWJqZWN0 IHRvIEJDUCA3OCBhbmQgdGhlIElFVEYgVHJ1c3QncyBMZWdhbCANCiAgIFByb3Zpc2lvbnMgUmVs YXRpbmcgdG8gSUVURiBEb2N1bWVudHMgDQogICBodHRwOi8vdHJ1c3RlZS5pZXRmLm9yZy9saWNl bmNlLWluZm8pIGluIGVmZmVjdCBvbiB0aGUgZGF0ZSBvZiAgIA0KICAgcHVibGljYXRpb24gb2Yg dGhpcyBkb2N1bWVudC4gIFBsZWFzZSByZXZpZXcgdGhlc2UgZG9jdW1lbnRzICANCiAgIGNhcmVm dWxseSwgYXMgdGhleSBkZXNjcmliZSB5b3VyIHJpZ2h0cyBhbmQgcmVzdHJpY3Rpb25zIHdpdGgg cmVzcGVjdCAgIA0KICAgdG8gdGhpcyBkb2N1bWVudC4gIENvZGUgQ29tcG9uZW50cyBleHRyYWN0 ZWQgZnJvbSB0aGlzIGRvY3VtZW50IG11c3QgIA0KICAgaW5jbHVkZSBTaW1wbGlmaWVkIEJTRCBM aWNlbnNlIHRleHQgYXMgZGVzY3JpYmVkIGluIFNlY3Rpb24gNC5lIG9mIA0KTWFucmFsLCBldC4g YWwuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgW1BhZ2Ug MV0gDQoMSW50ZXJuZXQtRHJhZnQgICAgICBSb3V0aW5nIFByb3RvY29sIFByb3RlY3Rpb24gSXNz dWVzICAgICAgT2N0b2JlciAyMDA5IA0KIA0KIA0KICAgdGhlIFRydXN0IExlZ2FsIFByb3Zpc2lv bnMgYW5kIGFyZSBwcm92aWRlZCB3aXRob3V0IHdhcnJhbnR5IGFzICANCiAgIGRlc2NyaWJlZCBp biB0aGUgQlNEIExpY2Vuc2UuIA0KIA0KQWJzdHJhY3QgDQogICAgDQogICBSb3V0aW5nIHByb3Rv Y29scyBoYXZlIG92ZXIgdGltZSBiZWVuIGV4dGVuZGVkIHRvIHVzZSBjcnlwdG9ncmFwaGljIA0K ICAgbWVjaGFuaXNtcyB0byB2YWxpZGF0ZSBkYXRhIGJlaW5nIHJlY2VpdmVkIGZyb20gYSBuZWln aGJvcmluZyByb3V0ZXIgDQogICB0byBlbnN1cmUgdGhhdDogIA0KICAgIA0KICAgbyBpdCBoYXMg bm90IGJlZW4gbW9kaWZpZWQgaW4gdHJhbnNpdC4gICANCiAgIG8gYWN0dWFsbHkgb3JpZ2luYXRl ZCBmcm9tIGFuIGF1dGhvcml6ZWQgbmVpZ2hib3Jpbmcgcm91dGVyIC4gICANCiAgICANCiAgIFRo ZSBjcnlwdG9ncmFwaGljIG1lY2hhbmlzbXMgZGVmaW5lZCB0byBkYXRlIGFuZCBkZXNjcmliZWQg aW4gdGhpcyANCiAgIGRvY3VtZW50IHJlbHkgb24gYSBkaWdlc3QgcHJvZHVjZWQgd2l0aCBhIGhh c2ggYWxnb3JpdGhtIGFwcGxpZWQgdG8gDQogICB0aGUgcGF5bG9hZCBlbmNhcHN1bGF0ZWQgaW4g dGhlIHJvdXRpbmcgcHJvdG9jb2wgcGFja2V0LiAgICAgIA0KICAgIA0KICAgVGhpcyBkb2N1bWVu dCBvdXRsaW5lcyBzb21lIG9mIHRoZSBsaW1pdGF0aW9ucyBvZiB0aGUgY3VycmVudCANCiAgIG1l Y2hhbmlzbSwgcHJvYmxlbXMgd2l0aCBtYW51YWwga2V5aW5nIG9mIHRoZXNlIGNyeXB0b2dyYXBo aWMgDQogICBhbGdvcml0aG1zLCBhbmQgcG9zc2libGUgdmVjdG9ycyBmb3IgdGhlIGV4cGxvaXRh dGlvbiBvZiB0aGVzZSANCiAgIGxpbWl0YXRpb25zLiANCiAgICANCkNvbnZlbnRpb25zIHVzZWQg aW4gdGhpcyBkb2N1bWVudCANCiAgICANCiAgIFRoZSBrZXkgd29yZHMgIk1VU1QiLCAiTVVTVCBO T1QiLCAiUkVRVUlSRUQiLCAiU0hBTEwiLCAiU0hBTEwgTk9UIiwgDQogICAiU0hPVUxEIiwgIlNI T1VMRCBOT1QiLCAiUkVDT01NRU5ERUQiLCAiTUFZIiwgYW5kICJPUFRJT05BTCIgaW4gdGhpcyAg DQogICBkb2N1bWVudCBhcmUgdG8gYmUgaW50ZXJwcmV0ZWQgYXMgZGVzY3JpYmVkIGluIFJGQyAy MTE5IFtSRkMyMTE5XSANCiANClRhYmxlIG9mIENvbnRlbnRzIA0KIA0KICAgMS4gUHJvYmxlbSBT dGF0ZW1lbnQuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uMyAN CiAgICAgIDEuMSBNRDUgUHJlLUltYWdlIHZzIENvbGxpc2lvbiBBdHRhY2tzLi4uLi4uLi4uLi4u Li4uLi4uLi4uLi4uLjQgDQogICAyLiBPcGVuIFNob3J0ZXN0IFBhdGggRmlyc3QgKE9TUEZ2Miku Li4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi40IA0KICAgICAgMi4xIE1hbmFnZW1lbnQgSXNz dWVzIHdpdGggT1NQRi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uNCANCiAgICAgIDIu MiBUZWNobmljYWwgSXNzdWVzIHdpdGggT1NQRi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4u Li4uLjUgDQogICAzLiBPcGVuIFNob3J0ZXN0IFBhdGggRmlyc3QgKE9TUEZ2MykuLi4uLi4uLi4u Li4uLi4uLi4uLi4uLi4uLi4uLi42IA0KICAgICAgMy4xIE1hbmFnZW1lbnQgSXNzdWVzIHdpdGgg T1NQRnYzLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uNiANCiAgICAgIDMuMiBUZWNobmlj YWwgSXNzdWVzIHdpdGggT1NQRnYzLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLjcgDQog ICA0LiBJbnRlcm1lZGlhdGUgU3lzdGVtIHRvIEludGVybWVkaWF0ZSBTeXN0ZW0gUm91dGluZyBQ cm90b2NvbCAoSVMtDQogICBJUykuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4u Li4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi44IA0KICAgICAgNC4xIE1hbmFnZW1lbnQgSXNzdWVz IHdpdGggSVMtSVMuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uOCANCiAgICAgIDQuMiBU ZWNobmljYWwgSXNzdWVzIHdpdGggSVMtSVMuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4u LjkgDQogICA1LiBCb3JkZXIgR2F0ZXdheSBQcm90b2NvbCAoQkdQLTQpLi4uLi4uLi4uLi4uLi4u Li4uLi4uLi4uLi4uLi4uLjEwIA0KICAgICAgNS4xIE1hbmFnZW1lbnQgSXNzdWVzIHdpdGggQkdQ LTQuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4xMCANCiAgICAgIDUuMiBUZWNobmljYWwg SXNzdWVzIHdpdGggQkdQLTQuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uMTEgDQogICA2 LiBUaGUgUm91dGluZyBJbmZvcm1hdGlvbiBQcm90b2NvbCAoUklQKS4uLi4uLi4uLi4uLi4uLi4u Li4uLi4uLjExIA0KICAgICAgNi4xIFRlY2huaWNhbCBJc3N1ZXMgd2l0aCBSSVAuLi4uLi4uLi4u Li4uLi4uLi4uLi4uLi4uLi4uLi4uLi4xMiANCiAgIDcuIEJpZGlyZWN0aW9uYWwgRm9yd2FyZGlu ZyBEZXRlY3Rpb24gKEJGRCkuLi4uLi4uLi4uLi4uLi4uLi4uLi4uMTMgDQogICAgICA3LjEgVGVj aG5pY2FsIElzc3VlcyB3aXRoIEJGRC4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLjEz IA0KICAgOC4gU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4u Li4uLi4uLi4uLi4uLi4xNCANCiAgIDkuIEFja25vd2xlZGdlbWVudHMuLi4uLi4uLi4uLi4uLi4u Li4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uMTQgDQogICAxMC4gSUFOQSBDb25zaWRlcmF0 aW9ucy4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLjE0IA0KTWFucmFs LCBldC4gYWwuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg W1BhZ2UgMl0gDQoMSW50ZXJuZXQtRHJhZnQgICAgICBSb3V0aW5nIFByb3RvY29sIFByb3RlY3Rp b24gSXNzdWVzICAgICAgT2N0b2JlciAyMDA5IA0KIA0KIA0KICAgMTEuIFJlZmVyZW5jZXMuLi4u Li4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4xNCANCiAgICAg IDExLjEgTm9ybWF0aXZlIFJlZmVyZW5jZXMuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4u Li4uLi4uMTQgDQogICAgICAxMS4yIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMuLi4uLi4uLi4uLi4u Li4uLi4uLi4uLi4uLi4uLi4uLi4uLjE1IA0KICAgMTIuIENvbnRyaWJ1dG9yJ3MgQWRkcmVzcy4u Li4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4xNiANCiAgIDEzLiBBdXRob3In cyBBZGRyZXNzZXMuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uMTYg DQogDQogICAgDQoxLiBQcm9ibGVtIFN0YXRlbWVudCANCiAgICANCiAgIFJvdXRpbmcgcHJvdG9j b2xzLCBzdWNoIGFzIE9TUEYgdmVyc2lvbiAyIFtSRkMyMzI4XSwgdmVyc2lvbiAzIA0KICAgW1JG QzUzNDBdLCBJUy1JUyBbUkZDMTE5NV0sIGFuZCBCR1AtNCBbUkZDNDI3MV0sIGVtcGxveSB2YXJp b3VzIA0KICAgbWVjaGFuaXNtcyB0byBjcmVhdGUgYSBjcnlwdG9ncmFwaGljIGRpZ2VzdCBvZiBl YWNoIHRyYW5zbWl0dGVkIA0KICAgcm91dGluZyBwcm90b2NvbC4gVHJhZGl0aW9uYWxseSwgdGhl c2UgZGlnZXN0cyBhcmUgdGhlIHJlc3VsdHMgb2YgYSANCiAgIG9uZS13YXkgaGFzaCBhbGdvcml0 aG0sIHN1Y2ggYXMgTUQ1IFtSRkMxMzIxXSwgYWNyb3NzIHRoZSBjb250ZW50cyBvZiANCiAgIHRo ZSBwYWNrZXQgYmVpbmcgdHJhbnNtaXR0ZWQuIEEgc2VjcmV0IGtleSBpcyB1c2VkIGFzIHRoZSBo YXNoIGJhc2UgDQogICAob3Igc2VlZCkuICBUaGUgZGlnZXN0IGlzIHRoZW4gcmVjb21wdXRlZCBi eSB0aGUgcmVjZWl2aW5nIHJvdXRlciwgDQogICB1c2luZyB0aGUgc2FtZSBrZXkgYXMgdGhlIG9y aWdpbmFsIHJvdXRlciB1c2VkIHRvIGNyZWF0ZSB0aGUgaGFzaCwgDQogICB0aGVuIGNvbXBhcmVk IHdpdGggdGhlIHRyYW5zbWl0dGVkIGRpZ2VzdCB0byB2ZXJpZnk6IA0KICAgIA0KICAgbyBUaGF0 IHRoZSByb3V0ZXIgb3JpZ2luYXRpbmcgdGhpcyBwYWNrZXQgaXMgYXV0aG9yaXplZCB2aWEgdGhl ICAgICAgDQogICAgIHNoYXJlZCBrZXkgbWVjaGFuaXNtIHRvIHBlZXIgd2l0aCB0aGUgbG9jYWwg cm91dGVyLCBhbmQgZXhjaGFuZ2UgIA0KICAgICByb3V0aW5nIGRhdGEuICBUaGUgaW1wbGljaXQg dHJ1c3Qgb2Ygcm91dGluZyBwcm90b2NvbCBleGNoYW5nZSAgDQogICAgIHByb3RlY3RlZCBieSBh IHNoYXJlZCBzZWNyZXQgaXMgaW50ZW5kZWQgdG8gcHJvdGVjdCBhZ2FpbnN0IHRoZSAgDQogICAg IGluamVjdGlvbiBvZiBmYWxzZWx5IGdlbmVyYXRlZCByb3V0aW5nIGRhdGEgYmVpbmcgaW5qZWN0 ZWQgaW50byAgDQogICAgIHRoZSByb3V0aW5nIHN5c3RlbSBieSB1bmF1dGhvcml6ZWQgc3lzdGVt cy4gDQogICAgDQogICBvIFRoYXQgdGhlIGRhdGEgaGFzIG5vdCBiZWVuICBhbHRlcmVkIGluIHRy YW5zaXQgYmV0d2VlbiB0aGUgDQogICAgIHR3byBuZWlnaGJvcmluZyByb3V0ZXJzLiANCiAgICAN CiAgIERpZ2VzdCB2ZXJpZmljYXRpb24gc2NoZW1lcyBhcmUgbm90IGludGVuZGVkIHRvIHByb3Rl Y3QgdGhlIA0KICAgY29uZmlkZW50aWFsaXR5IG9mIGluZm9ybWF0aW9uIGJlaW5nIGV4Y2hhbmdl ZCBiZXR3ZWVuIHJvdXRlcnMuIFRoZSANCiAgIGluZm9ybWF0aW9uIChlbnRyaWVzIGluIHRoZSBy b3V0aW5nIHRhYmxlKSBpcyBwb3RlbnRpYWxseSBhdmFpbGFibGUgDQogICB0aHJvdWdoIG90aGVy IG1lY2hhbmlzbXMgOyBNb3JldmVyLCBhY2Nlc3MgdG8gdGhlIHBoeXNpY2FsIG1lZGlhIA0KICAg YmV0d2VlbiB0d28gcm91dGVycyBleGNoYW5naW5nIHJvdXRpbmcgZGF0YSwgIHdpbGwgICBjb25m ZXIgICB0aGUgDQogICBhYmlsaXR5IHRvIGNhcHR1cmUgb3Igb3RoZXJ3aXNlIGRpc2NvdmVyIHRo ZSBjb250ZW50cyBvZiB0aGUgcm91dGluZyANCiAgIHRhYmxlcyBpbiB0aG9zZSByb3V0ZXJzLiAN CiAgICANCiAgIEF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbXMgZGVmaW5lZCB0b2RheSBoYXZlIG5v dGFibGUgbGltaXRhdGlvbnM6IA0KICAgIA0KICAgbyBNYW51YWwgY29uZmlndXJhdGlvbiBvZiBz aGFyZWQgc2VjcmV0IGtleXMsIGVzcGVjaWFsbHkgaW4gbGFyZ2UgDQogICAgIG5ldHdvcmtzIGFu ZCBiZXR3ZWVuIG5ldHdvcmtzLCBwb3NlcyBhIG1ham9yIG1hbmFnZW1lbnQgcHJvYmxlbS4gICAN CiAgICAgSW4gbWFueSBjYXNlcyBpdCBpcyBjaGFsbGVuZ2luZyB0byByZXBsYWNlIGtleXMgd2l0 aG91dCBzaWduaWZpY2FudCAgDQogICAgIGNvb3JkaW5hdGlvbiBvciBkaXNydXB0aW9uLiAgIA0K ICAgIA0KICAgbyBJbiBzb21lIGNhc2VzLCB3aGVuIG1hbnVhbCBrZXlzIGFyZSBjb25maWd1cmVk LCBzb21lIGZvcm1zIG9mIA0KICAgICByZXBsYXkgcHJvdGVjdGlvbiBhcmUgbm8gbG9uZ2VyIHBv c3NpYmxlICwgYWxsb3dpbmcgdGhlIHJvdXRpbmcgIA0KICAgICBwcm90b2NvbCB0byBiZSBhdHRh Y2tlZCB0aG91Z2ggdGhlIHJlcGxheSBvZiBjYXB0dXJlZCByb3V0aW5nICANCiAgICAgbWVzc2Fn ZXMuIA0KICAgIA0KICAgbyBUaGUgTUQ1IGRpZ2VzdCBhbGdvcml0aG0gd2FzIG5vdCBkZXNpZ25l ZCB0byBiZSB1c2VkIGluIHRoZSB3YXkgIA0KICAgICBtb3N0IHJvdXRpbmcgcHJvdG9jb2xzIGFy ZSB1c2luZyBpdC4gd2hpY2ggaGFzICBwb3RlbnRpYWxseSBzZXJpb3VzICAgIA0KTWFucmFsLCBl dC4gYWwuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgW1Bh Z2UgM10gDQoMSW50ZXJuZXQtRHJhZnQgICAgICBSb3V0aW5nIFByb3RvY29sIFByb3RlY3Rpb24g SXNzdWVzICAgICAgT2N0b2JlciAyMDA5IA0KIA0KIA0KICAgICBmdXR1cmUgaW1wbGljYXRpb25z LiANCiAgICANCiAgIFRoaXMgZG9jdW1lbnQgb3V0bGluZXMgc29tZSBvZiB0aGUgcHJvYmxlbXMg d2l0aCBtYW51YWwga2V5aW5nIG9mIA0KICAgdGhlc2UgY3J5cHRvZ3JhcGhpYyBhbGdvcml0aG1z LiANCiAgICANCjEuMSBNRDUgUHJlLUltYWdlIHZzIENvbGxpc2lvbiBBdHRhY2tzICANCiAgICAN CiAgIEEgcHJlaW1hZ2UgYXR0YWNrIChBbiBhdHRlbXB0IHRvIGZpbmQgbmV3IGRhdGEgd2l0aCB0 aGUgc2FtZSBoYXNoIA0KICAgdmFsdWUpIHdvdWxkIGVuYWJsZSBzb21lb25lIHRvIGZpbmQgYW4g aW5wdXQgbWVzc2FnZSB0aGF0IA0KICAgY2F1c2VzIGEgaGFzaCBmdW5jdGlvbiB0byBwcm9kdWNl IGEgcGFydGljdWxhciBvdXRwdXQuIEluIGNvbnRyYXN0LCBhIA0KICAgY29sbGlzaW9uIGF0dGFj ayBmaW5kcyB0d28gbWVzc2FnZXMgd2l0aCB0aGUgc2FtZSBoYXNoLCBidXQgdGhlIA0KICAgYXR0 YWNrZXIgY2FuJ3QgcGljayB3aGF0IHRoZSBtZXNzYWdlICB3aWxsIGJlLiBGZWFzaWJsZSBjb2xs aXNpb24gDQogICBhdHRhY2tzIGFnYWluc3QgTUQ0LCBNRDUsIEhBVkFMLTEyOCwgYW5kIFJJUEVN RCB3ZXJlIGZvdW5kIGJ5IHRoZSANCiAgIENoaW5lc2UgcmVzZWFyY2hlciBYaWFveXVuIFdhbmcg d2l0aCBjby1hdXRob3JzIERlbmdndW8gRmVuZywgWHVlamlhIA0KICAgTGFpLCBhbmQgSG9uZ2Jv IFl1LiAgDQogICAgDQogICBUaGUgYWJpbGl0eSB0byBwcm9kdWNlIGEgY29sbGlzaW9uICBkb2Vz IG5vdCBjdXJyZW50bHkgaW50cm9kdWNlIGFueSANCiAgIG9idmlvdXMgb3Iga25vd24gYXR0YWNr cyBvbiByb3V0aW5nIHByb3RvY29scy4gUHJlLWltYWdlIGF0dGFja3MgaGF2ZSANCiAgIHRoZSBw b3RlbnRpYWwgdG8gIGNhdXNlIHByb2JsZW1zIGluIHRoZSBmdXR1cmUgYWxiaWV0IGR1ZSB0byB0 aGUgDQogICBtZXNzYWdlIGxlbmd0aCB0aGVyZSBhcmUgc2VyaW91cyBsaW1pdGF0aW9ucyB0byB0 aGUgZmVhc2liaWxpdHkgb2YgDQogICBtb3VudGluZyBzdWNoIGFuIGF0dGFjay4gDQogICAgDQog ICBQcm90b2NvbHMgdGhlbXNlbHZlcyBoYXZlIHNvbWUgYnVpbHQtaW4gcHJvdGVjdGlvbiBhZ2Fp bnN0IGNvbGxpc2lvbi4gDQogICBBIGxvdCBvZiB2YWx1ZXMgZm9yIGZpZWxkcyBpbiBhIHByb3Rv Y29sIGFyZSBpbnZhbGlkIG9yIHdpbGwgcHJvZHVjZSANCiAgIGFuIHVudXNhYmxlIHBhY2tldC4g Rm9yIGV4YW1wbGUsIGluIE9TUEYgdGhlIExTQSB0eXBlIGNhbiBiZSBmcm9tIDEgDQogICB0byAx MS4gQW55IG90aGVyIHZhbHVlIGluIHRoZSBmaWVsZCB3aWxsIHJlc3VsdCBpbiB0aGUgcGFja2V0 IGJlaW5nIA0KICAgZGlzY2FyZGVkLiANCiAgICANCiAgIEFzc3VtZSB0d28gcGFja2V0cyBNIGFu ZCBNJyBhcmUgZ2VuZXJhdGVkIHdoaWNoIGhhdmUgdGhlIHNhbWUgaGFzaC4gDQogICBUaGUgYWJv dmUgY29uZGl0aW9uIHdpbGwgZnVydGhlciByZWR1Y2UgdGhlIGFiaWxpdHkgdG8gcHJvZHVjZSBh IA0KICAgbWVzc2FnZSB3aGljaCBpcyBhbHNvIGEgY29ycmVjdCBtZXNzYWdlIGZyb20gdGhlIHBy b3RvY29sIA0KICAgcGVyc3BlY3RpdmUsIGFzIGEgbG90IG9mIHBvdGVudGlhbCB2YWx1ZXMgYXJl IHRoZW1zZWx2ZXMgbm90IHZhbGlkLiANCiAgICANCjIuIE9wZW4gU2hvcnRlc3QgUGF0aCBGaXJz dCAoT1NQRnYyKSANCiAgDQogICBPU1BGIFtSRkMyMzI4XSBkZXNjcmliZXMgdGhlIHVzZSBvZiBh biBNRDUgZGlnZXN0IHdpdGggT1NQRiBwYWNrZXRzLiANCiAgIE1ENSBrZXlzIGFyZSBtYW51YWxs eSBjb25maWd1cmVkLiBUaGUgT1NQRiBwYWNrZXQgSGVhZGVyIGluY2x1ZGVzIGFuICAgDQogICBh dXRoZW50aWNhdGlvbiB0eXBlIGZpZWxkIGFzIHdlbGwgYXMgNjQgYml0cyBvZiBkYXRhIGZvciB1 c2UgYnkgdGhlIA0KICAgYXBwcm9wcmlhdGUgYXV0aGVudGljYXRpb24gc2NoZW1lLiBPU1BGIGFs c28gcHJvdmlkZXMgZm9yIGEgbm9uLSAgIA0KICAgZGVjcmVhc2luZyBzZXF1ZW5jZSBudW1iZXIg dG8gYmUgaW5jbHVkZWQgaW4gZWFjaCBPU1BGIHByb3RvY29sICAgDQogICBwYWNrZXQgdG8gcHJv dGVjdCBhZ2FpbnN0IHJlcGxheSBhdHRhY2tzLiANCiAgICANCjIuMSANTWFuYWdlbWVudCBJc3N1 ZXMgd2l0aCBPU1BGIA0KICAgIA0KICAgQWNjb3JkaW5nIHRvIHRoZSBPU1BGIHNwZWNpZmljYXRp b24gW1JGQzIzMjhdLCBkaWdlc3RzIGFyZSBhcHBsaWVkIA0KICAgdG8gcGFja2V0cyB0cmFuc21p dHRlZCBiZXR3ZWVuIGFkamFjZW50IG5laWdoYm9ycywgcmF0aGVyIHRoYW4gYmVpbmcgDQogICBh cHBsaWVkIHRvIHRoZSByb3V0aW5nIGluZm9ybWF0aW9uIG9yaWdpbmF0ZWQgYnkgYSByb3V0ZXIg KGRpZ2VzdHMgDQogICBhcmUgbm90IGFwcGxpZWQgYXQgdGhlIExTQSBsZXZlbCwgYnV0IHJhdGhl ciBhdCB0aGUgcGFja2V0IGxldmVsKS4gDQogICBbUkZDMjMyOF0gc3RhdGVzIHRoYXQgYW55IHNl dCBvZiBPU1BGIHJvdXRlcnMgYWRqYWNlbnQgYWNyb3NzIGEgDQogICBzaW5nbGUgbGluayBtYXkg dXNlIGEgZGlmZmVyZW50IGtleSB0byBidWlsZCBNRDUgZGlnZXN0cyB0aGFuIHRoZSBrZXkgDQog ICB1c2VkIHRvIGJ1aWxkIE1ENSBkaWdlc3RzIG9uIGFueSBvdGhlciBsaW5rLiAgVGh1cywgTUQ1 IGtleXMgbWF5IGJlIA0KTWFucmFsLCBldC4gYWwuICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgW1BhZ2UgNF0gDQoMSW50ZXJuZXQtRHJhZnQgICAgICBSb3V0 aW5nIFByb3RvY29sIFByb3RlY3Rpb24gSXNzdWVzICAgICAgT2N0b2JlciAyMDA5IA0KIA0KIA0K ICAgY29uZmlndXJlZCwgYW5kIGNoYW5nZWQsIG9uIGEgcGVyLWxpbmsgYmFzaXMgaW4gYW4gT1NQ RiBuZXR3b3JrLiANCiAgICANCiAgIE9TUEYgZG9lcyBub3Qgc3BlY2lmeSBhIG1lY2hhbmlzbXMg dG8gbmVnb3RpYXRlIGtleXMsIG5vciBkb2VzIGl0ICANCiAgIHNwZWNpZnkgYW55IG1lY2hhbmlz bSB0byBuZWdvdGlhdGUgdGhlIGhhc2ggYWxnb3JpdGhtcyB0byBiZSB1c2VkLiANCiAgICANCiAg IFdpdGggdGhlIHByb2xpZmVyYXRpb24gb2YgdGhlIG51bWJlciBvZiBoYXNoIGFsZ29yaXRobXMs IGFzIHdlbGwgYXMgIA0KICAgdGhlIG5lZWQgdG8gY29udGludW91c2x5IHVwZ3JhZGUgdGhlIGFs Z29yaXRobXMsIG1hbnVhbGx5IGNvbmZpZ3VyaW5nICANCiAgIHRoZSBpbmZvcm1hdGlvbiBiZWNv bWVzIHZlcnkgdGVkaW91cy4gSXQgc2hvdWxkIGFsc28gYmUgbm90ZWQgdGhhdCANCiAgIHJla2V5 aW5nIE9TRlAgcmVxdWlyZXMgY29vcmRpbmF0aW9uIGFtb25nIHRoZSBhZGphY2VudCByb3V0ZXJz LiANCiAgICANCjIuMiBUZWNobmljYWwgSXNzdWVzIHdpdGggT1NQRiANCiAgICANCiAgIFdoaWxl IE9TUEYgcHJvdmlkZXMgcmVsYXRpdmVseSBzdHJvbmcgcHJvdGVjdGlvbiB0aHJvdWdoIHRoZSAN CiAgIGluY2x1c2lvbiBvZiBNRDUgc2lnbmF0dXJlcywgd2l0aCBhZGRpdGlvbmFsIGRhdGEgYW5k IGEgc2VxdWVuY2UgDQogICBudW1iZXJzIGluIHRyYW5zbWl0dGVkIHBhY2tldHMsIHRoZXJlIGFy ZSBzdGlsbCBhdHRhY2tzIGFnYWluc3QgT1NQRjogDQogICAgDQogICBvICBUaGUgc2VxdWVuY2Ug bnVtYmVyIGlzIGluaXRpYWxpemVkIHRvIHplcm8gd2hlbiBmb3JtaW5nIGFuIA0KICAgICAgYWRq YWNlbmN5IHdpdGggYSBuZXdseSBkaXNjb3ZlcmVkIG5laWdoYm9yLiBXaGVuIGFuIGFkamFjZW5j eSBpcyAgDQogICAgICBicm91Z2h0IGRvd24gdGhlIHNlcXVlbmNlIG51bWJlciBpcyBhbHNvIHNl dCB0byB6ZXJvLiBJZiB0aGUgDQogICAgICBjcnlwdG9ncmFwaGljYWxseSBwcm90ZWN0ZWQgcGFj a2V0cyBvZiBhIHJvdXRlciB0aGF0IGlzIGJyb3VnaHQgDQogICAgICBkb3duIChmb3IgYWRtaW5p c3RyYXRpdmUgb3Igb3RoZXIgcmVhc29ucykgYXJlIHJlcGxheWVkIGJ5IGEgDQogICAgICBtYWxp Y2lvdXMgcm91dGVyIHRyYWZmaWMgY291bGQgYmUgZm9yY2VkIHRocm91Z2ggdGhlIG1hbGljaW91 cyANCiAgICAgIHJvdXRlci4gIEEgbWFsaWNpb3VzIHJvdXRlciBtaWdodCB0aGVuIGluZHVjZSBy b3V0aW5nIGxvb3BzLCAgDQogICAgICBpbnRlcmNlcHQgb3IgYmxhY2tob2xlIHRoZSB0cmFmZmlj LiANCiAgICANCiAgIG8gIE9TUEYgYWxsb3dzIG11bHRpcGxlIHBhY2tldHMgd2l0aCB0aGUgc2Ft ZSBzZXF1ZW5jZSBudW1iZXIuIA0KICAgICAgVGhpcyBtZWFucyB0aGF0IHRoZSBwb3NzaWJpbGl0 eSBleGlzdHMgdG8gcmVwbGF5IHRoZSBzYW1lIHBhY2tldCANCiAgICAgIG1hbnkgdGltZXMgYmVm b3JlIHRoZSBuZXh0IGxlZ2l0aW1hdGUgcGFja2V0IGlzIHNlbnQuICBBbiBhdHRhY2tlciAgDQog ICAgICBtYXkgcmVzZW5kIHRoZSAgc2FtZSBwYWNrZXQgcmVwZWF0ZWRseSB1bnRpbCB0aGUgbmV4 dCBoZWxsbyBwYWNrZXQgIA0KICAgICAgaXMgdHJhbnNtaXR0ZWQgYW5kIHJlY2VpdmVkLiBUaGUg SGVsbG8gaW50ZXJ2YWwgd2hpY2ggaXMgdW5rbm93biANCiAgICAgIGRldGVybWluZXMgdGhlIGF0 dGFjayB3aW5kb3cuIA0KICAgIA0KICAgbyAgT1NQRiBkb2VzIG5vdCByZXF1aXJlIHRoZSB1c2Ug b2YgYW55IHBhcnRpY3VsYXIgaGFzaCBhbGdvcml0aG0sIA0KICAgICAgaG93ZXZlciB0aGUgdXNl IG9mIG9ubHkgTUQ1IGRpZ2VzdHMgZm9yIGF1dGhlbnRpY2F0aW9uIGFuZCByZXBsYXkgIA0KICAg ICAgcHJvdGVjdGlvbiBpcyBzcGVjaWZpZWQgaW4gdGhlIGRvY3VtZW50LiBNb3N0IE9TUEYgaW1w bGVtZW50YXRpb25zICANCiAgICAgIG9ubHkgc3VwcG9ydCBNRDUgaW4gYWRkaXRpb24gdG8gTnVs bCBhbmQgU2ltcGxlIFBhc3N3b3JkICANCiAgICAgIGF1dGhlbnRpY2F0aW9uLiANCiAgICANCiAg ICAgIFJlY2VudGx5LCBsaW1pdGF0aW9ucyBpbiBjb2xsaXNpb24tcmVzaXN0YW5jZSBwcm9wZXJ0 aWVzIG9mIHRoZSAgDQogICAgICBNRDUgYW5kIFNIQS0xIGhhc2ggZnVuY3Rpb25zIGhhdmUgYmVl biBkaXNjb3ZlcmVkOyBbUkZDNDI3MF0gIA0KICAgICAgc3VtbWFyaXplcyB0aGUgZGlzY292ZXJp ZXMuIEF0dGFja3Mgb24gbWFueSBhcHBsaWNhdGlvbnMgb2YgTUQ1ICANCiAgICAgIGFyZSBwcmFj dGljYWwgb24gbW9kZXJuIGNvbXB1dGVycy4gRm9yIHRoaXMgcmVhc29uIHRoZSBnZW5lcmFsIHVz ZSAgDQogICAgICBvZiB0aGVzZSBhbGdvcml0aG1zIHNob3VsZCB0byBiZSBkaXNjb3VyYWdlZC4g DQogICAgDQogICBvICBPU1BGIG9uIGEgYnJvYWRjYXN0IG5ldHdvcmsgc2hhcmVzIHRoZSBzYW1l IGtleSBiZXR3ZWVuIGFsbCAgDQogICAgICBuZWlnaGJvcnMgb24gdGhhdCBicm9hZGNhc3QgbmV0 d29yay4gU29tZSBPU1BGIHBhY2tldHMgYXJlIHNlbnQgdG8gDQogICAgICBhIG11bHRpY2FzdCBh ZGRyZXNzLiAgDQogICAgDQogICAgICBTcG9vZmluZyBieSBhbnkgbWFsaWNpb3VzIG5laWdoYm9y IHBvc3Nlc3NpbmcgY3JlZGVudGlhbHMgb3IgIA0KICAgICAgcmVwbGF5YWJsZSBwYWNrZXRzIGlz IHRoZXJlZm9yZSB2ZXJ5IGVhc3kuIFBvc3Nlc3Npb24gb2YgdGhlIGtleSAgDQogICAgICBpdHNl bGYgaXMgdXNlZCBhcyBhbiBpZGVudGl0eSB2YWxpZGF0aW9uIGFuZCBubyBvdGhlciBpZGVudGl0 eSANCk1hbnJhbCwgZXQuIGFsLiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIFtQYWdlIDVdIA0KDEludGVybmV0LURyYWZ0ICAgICAgUm91dGluZyBQcm90b2Nv bCBQcm90ZWN0aW9uIElzc3VlcyAgICAgIE9jdG9iZXIgMjAwOSANCiANCiANCiAgICAgIGNoZWNr IGlzIHVzZWQuIEEgbWFsaWNpb3VzIG5laWdoYm9yIGNvdWxkIHNlbmQgYSBwYWNrZXQgZm9yZ2lu ZyAgDQogICAgICB0aGUgaWRlbnRpdHkgYXMgYmVpbmcgZnJvbSBhbiBvdGhlciBuZWlnaGJvci4g VGhlcmUgd291bGQgYmUgbm8gIA0KICAgICAgd2F5IGluIHdoaWNoIHRoZSB2aWN0aW0gY291bGQg ZGlzdGluZ3Vpc2ggdGhlIGlkZW50aXR5IG9mIHRoZSAgDQogICAgICBwYWNrZXQgc2VuZGVyLiAN CiAgICANCiAgIG8gIE9TUEYgbmVpZ2hib3JzIG9uIGJyb2FkY2FzdCwgTkJNQSBhbmQgcG9pbnQt dG8tbXVsdGlwb2ludCAgDQogICAgICBuZXR3b3JrcyBhcmUgaWRlbnRpZmllZCBieSB0aGUgSVAg YWRkcmVzcyBpbiB0aGUgSVAgaGVhZGVyLiAgDQogICAgICBUaGUgSVAgaGVhZGVyIGlzIG5vdCBj b3ZlcmVkIGJ5IHRoZSBNQUMgaW4gdGhlIGNyeXB0b2dyYXBoaWMgIA0KICAgICAgYXV0aGVudGlj YXRpb24gc2NoZW1lIGFzIGRlc2NyaWJlZCBpbiBSRkMgMjMyOCwgYW5kIGFuIGF0dGFjayBjYW4g DQogICAgICBiZSBtYWRlIHRvIGV4cGxvaXQgdGhpcyBvbWlzc2lvbi4gDQogDQogICAgICBBc3N1 bWUgdGhlIGZvbGxvd2luZyBzY2VuYXJpby4gDQogDQogICAgICBSMSBzZW5kcyBhbiBhdXRoZW50 aWNhdGVkIEhFTExPIHRvIFIyLiBUaGlzIEhFTExPIGlzIGNhcHR1cmVkICANCiAgICAgIGFuZCBy ZXBsYXllZCBiYWNrIHRvIFIxLiBUaGUgc291cmNlIElQIGluIHRoZSBJUCBoZWFkZXIgb2YgdGhl IA0KICAgICAgcmVwbGF5ZWQgcGFja2V0IGlzIGNoYW5nZWQgdG8gdGhhdCBvZiBSMi4gDQogDQog ICAgICBSMSwgbm90IGZpbmRpbmcgaXRzZWxmIGluIEhFTExPIHdvdWxkIGRlZHVjZSB0aGF0IHRo ZSBjb25uZWN0aW9uICANCiAgICAgIGlzIG5vdCBiaWRpcmVjdGlvbmFsIGFuZCB3b3VsZCBicmlu ZyBkb3duIHRoZSBhZGphY2VuY3kuIA0KICAgIA0KMy4gDU9wZW4gU2hvcnRlc3QgUGF0aCBGaXJz dCAoT1NQRnYzKSANCiANCiAgIE9TUEZ2MyBbUkZDNTM0MF0gcmVsaWVzIG9uIHRoZSBJUCBBdXRo ZW50aWNhdGlvbiBIZWFkZXIgW1JGQzQzMDJdICANCiAgIGFuZCB0aGUgSVAgRW5jYXBzdWxhdGlu ZyBQYXlsb2FkIFtSRkM0MzAzXSB0byBjcnlwdG9ncmFwaGljYWxseSBzaWduIA0KICAgcm91dGlu ZyBpbmZvcm1hdGlvbiBwYXNzZWQgYmV0d2VlbiByb3V0ZXJzLiANCiAgICANCiAgIFdoZW4gdXNp bmcgRVNQLCB0aGUgbnVsbCBlbmNyeXB0aW9uIGFsZ29yaXRobSBbUkZDMjQxMF0gaXMgdXNlZCwg c28gDQogICB0aGUgZGF0YSBjYXJyaWVkIGluIHRoZSBPU1BGdjMgcGFja2V0cyBpcyBzaWduZWQs IGJ1dCBub3QgZW5jcnlwdGVkLiAgDQogICBUaGlzIHByb3ZpZGVzIGRhdGEgb3JpZ2luIGF1dGhl bnRpY2F0aW9uIGZvciBhZGphY2VudCByb3V0ZXJzLCBhbmQgDQogICBkYXRhIGludGVncml0eSB3 aGljaCBnaXZlcyB0aGUgYXNzdXJhbmNlIGRhdGEgdHJhbnNtaXR0ZWQgYnkgYSByb3V0ZXIgDQog ICBoYXMgbm90IGNoYW5nZWQgaW4gdHJhbnNpdC4gDQogICAgDQogICBIb3dldmVyIGl0IGRvZXMg bm90IHByb3ZpZGUgY29uZmlkZW50aWFsaXR5IG9mIHRoZSBpbmZvcm1hdGlvbiANCiAgIHRyYW5z bWl0dGVkLiBbUkZDNDU1Ml0gbWFuZGF0ZXMgdGhlIHVzZSBvZiBFU1Agd2l0aCBudWxsIGVuY3J5 cHRpb24gDQogICBmb3IgYXV0aGVudGljYXRpb24gYW5kIGFsc28gZG9lcyBlbmNvdXJhZ2UgdGhl IHVzZSBvZiBjb25maWRlbnRpYWxpdHkgDQogICB0byBwcm90ZWN0IHRoZSBwcml2YWN5IG9mIHRo ZSByb3V0aW5nIGluZm9ybWF0aW9uIHRyYW5zbWl0dGVkLCB1c2luZyANCiAgIEVTUCBlbmNyeXB0 aW9uLiANCiAgICANCiAgIEF1dGhlbnRpY2F0aW9uL0NvbmZpZGVudGlhbGl0eSBmb3IgT1NQRnYz IFtSRkM0NTUyXSBtYW5kYXRlcyB0aGUgdXNlIA0KICAgb2YgRVNQIHdpdGggbnVsbCBlbmNyeXB0 aW9uIGZvciBhdXRoZW50aWNhdGlvbiBhbmQgYWxzbyBkb2VzIA0KICAgZW5jb3VyYWdlIHRoZSB1 c2Ugb2YgY29uZmlkZW50aWFsaXR5IHRvIHByb3RlY3QgdGhlIHByaXZhY3kgb2YgdGhlIA0KICAg cm91dGluZyBpbmZvcm1hdGlvbiB0cmFuc21pdHRlZCwgdXNpbmcgRVNQIGVuY3J5cHRpb24uIEl0 IGhvd2V2ZXIgDQogICBvbmx5IHNwZWNpZmllcyB0aGUgdXNlIG9mIG1hbnVhbCBrZXlpbmcgb2Yg cm91dGluZyBpbmZvcm1hdGlvbiBhcyANCiAgIGRpc2N1c3NlZCBpbiB0aGUgZm9sbG93aW5nIHNl Y3Rpb24uIA0KICAgIA0KMy4xIA1NYW5hZ2VtZW50IElzc3VlcyB3aXRoIE9TUEZ2MyANCiAgICAN CiAgIFRoZSBPU1BGdjMgc2VjdXJpdHkgZG9jdW1lbnQgLSBBdXRoZW50aWNhdGlvbi9Db25maWRl bnRpYWxpdHkgZm9yIA0KICAgT1NQRnYzIFtSRkM0NTUyXSBkaXNjdXNzZXMsIGF0IGxlbmd0aCwg dGhlIHJlYXNvbmluZyBiZWhpbmQgdXNpbmcgDQpNYW5yYWwsIGV0LiBhbC4gICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBbUGFnZSA2XSANCgxJbnRlcm5ldC1E cmFmdCAgICAgIFJvdXRpbmcgUHJvdG9jb2wgUHJvdGVjdGlvbiBJc3N1ZXMgICAgICBPY3RvYmVy IDIwMDkgDQogDQogDQogICBtYW51YWxseSBjb25maWd1cmVkIGtleXMsIHJhdGhlciB0aGFuIHNv bWUgYXV0b21hdGVkIGtleSBtYW5hZ2VtZW50IA0KICAgcHJvdG9jb2wgc3VjaCBhcyBJS0V2MiBb UkZDNDMwNl0uIFRoZSBwcmltYXJ5IHByb2JsZW0gaXMgdGhhdCBhbGwgDQogICBjdXJyZW50IGtl eSBtYW5hZ2VtZW50IG1lY2hhbmlzbXMgYXJlIGRlc2lnbmVkIGZvciBhIG9uZS10by1vbmUgDQog ICBjb3JyZWxhdGlvbiBvZiBrZXlzLCB3aGlsZSBPU1BGIGFkamFjZW5jaWVzIGFyZSBmb3JtZWQg b24gYSBvbmUtdG8tDQogICBtYW55IGJhc2lzLiAgVGhpcyBmb3JjZXMgdGhlIHN5c3RlbSBhZG1p bmlzdHJhdG9yIHRvIHVzZSBtYW51YWxseSANCiAgIGNvbmZpZ3VyZWQgU0FzIGFuZCBjcnlwdG9n cmFwaGljIGtleXMgdG8gcHJvdmlkZSB0aGUgYXV0aGVudGljYXRpb24gDQogICBhbmQsIGlmIGRl c2lyZWQsIGNvbmZpZGVudGlhbGl0eSBzZXJ2aWNlcy4gDQogICAgDQogICBSZWdhcmRpbmcgcmVw bGF5IHByb3RlY3Rpb24gW1JGQzQ1NTJdIHN0YXRlcyB0aGF0OiANCiAgICANCiAgICAgIEFzIGl0 IGlzIG5vdCBwb3NzaWJsZSBhcyBwZXIgdGhlIGN1cnJlbnQgc3RhbmRhcmRzIHRvIHByb3ZpZGUg DQogICAgICBjb21wbGV0ZSByZXBsYXkgcHJvdGVjdGlvbiB3aGlsZSB1c2luZyBtYW51YWwga2V5 aW5nLCB0aGUgcHJvcG9zZWQgDQogICAgICBzb2x1dGlvbiB3aWxsIG5vdCBwcm92aWRlIHByb3Rl Y3Rpb24gYWdhaW5zdCByZXBsYXkgYXR0YWNrcy4gDQogICAgDQogICBUaGUgcHJpbWFyeSBhZG1p bmlzdHJhdGl2ZSBpc3N1ZSB3aXRoIG1hbnVhbGx5IGNvbmZpZ3VyZWQgU0FzIGFuZCANCiAgIGtl eXMgaW4gdGhlIE9TUEZ2MyBjYXNlIGlzIHRoZSBtYW5hZ2VtZW50IGlzc3VlcywgbWFpbnRhaW5p bmcgc2hhcmVkIA0KICAgc2V0cyBvZiBrZXlzIG9uIGFsbCByb3V0ZXJzIHdpdGhpbiBhIG5ldHdv cmsuICBBcyB3aXRoIE9TUEZ2MiANCiAgIHJla2V5aW5nIGlzIGFuIGluZnJlcXVlbnQgZXZlbnQg cmVxdWlyaW5nIGNvb3JkaW5hdGlvbi4gW1JGQzQ1NTJdIA0KICAgZG9lcyBub3QgcmVxdWlyZSB0 aGF0IGFsbCBPU1BGdjMgcm91dGVycyBoYXZlIHRoZSBzYW1lIGtleSBjb25maWd1cmVkIA0KICAg Zm9yIGV2ZXJ5IG5laWdoYm9yLCBzbyBlYWNoIHNldCBvZiBuZWlnaGJvcnMgY29ubmVjdGVkIHRv IGEgZ2l2ZW4gDQogICBsaW5rIGNvdWxkIGhhdmUgYSBkaWZmZXJlbnQga2V5IGNvbmZpZ3VyZWQu ICBXaGlsZSB0aGlzIG1ha2VzIGl0IA0KICAgZWFzaWVyIHRvIGNoYW5nZSB0aGUga2V5cywgYnkg Zm9yY2luZyB0aGUgc3lzdGVtIGFkbWluaXN0cmF0b3IgdG8gDQogICBvbmx5IGNoYW5nZSB0aGUg a2V5cyBvbiB0aGUgcm91dGVycyBvbiBhIHNpbmdsZSBsaW5rLCB0aGUgcHJvY2VzcyBvZiANCiAg IG1hbnVhbCBjb25maWd1cmF0aW9uIGZvciBhbGwgdGhlIHJvdXRlcnMgaW4gYSBuZXR3b3JrIHRv IGNoYW5nZSB0aGUgDQogICBrZXlzIHVzZWQgZm9yIE9TUEZ2MyBkaWdlc3RzIGFuZCBjb25maWRl bnRpYWxpdHkgb24gYSBwZXJpb2RpYyBiYXNpcyANCiAgIGNhbiBiZSBkaWZmaWN1bHQuIA0KICAg IA0KMy4yDSBUZWNobmljYWwgSXNzdWVzIHdpdGggT1NQRnYzIA0KICAgIA0KICAgVGhlIHByaW1h cnkgdGVjaG5pY2FsIGNvbmNlcm4gd2l0aCB0aGUgY3VycmVudCBzcGVjaWZpY2F0aW9ucyBmb3Ig DQogICBPU1BGdjMgaXMgdGhhdCB3aGVuIG1hbnVhbCBTQSBhbmQga2V5IG1hbmFnZW1lbnQgaXMg dXNlZCBhcyBbUkZDNDMwMl0gDQogICBzcGVjaWZpZXMsIGluIHNlY3Rpb24gMy4zLjIsIFNlcXVl bmNlIE51bWJlciBHZW5lcmF0aW9uOiAiVGhlIHNlbmRlciANCiAgIGFzc3VtZXMgYW50aS1yZXBs YXkgaXMgZW5hYmxlZCBhcyBhIGRlZmF1bHQsIHVubGVzcyBvdGhlcndpc2UgDQogICBub3RpZmll ZCBieSB0aGUgcmVjZWl2ZXIgKHNlZSAzLjQuMykgb3IgaWYgdGhlIFNBIHdhcyBjb25maWd1cmVk IA0KICAgdXNpbmcgbWFudWFsIGtleSBtYW5hZ2VtZW50LiIgUmVwbGF5aW5nIE9TUEZ2MyBwYWNr ZXRzIGNhbiBpbmR1Y2UgDQogICBzZXZlcmFsIGZhaWx1cmVzIGluIGEgbmV0d29yaywgaW5jbHVk aW5nOiANCiAgICANCiAgIG8gIFJlcGxheWluZyBoZWxsbyBwYWNrZXRzIHdpdGggYW4gZW1wdHkg bmVpZ2hib3IgbGlzdCBjYW4gY2F1c2UgYWxsIA0KICAgICAgdGhlIG5laWdoYm9yIGFkamFjZW5j aWVzIHdpdGggdGhlIHNlbmRpbmcgcm91dGVyIHRvIGJlIHJlc2V0LCANCiAgICAgIGRpc3J1cHRp bmcgbmV0d29yayBjb21tdW5pY2F0aW9ucy4gDQogICAgDQogICBvICBSZXBsYXlpbmcgaGVsbG8g cGFja2V0cyBmcm9tIGVhcmx5IGluIHRoZSBkZXNpZ25hdGVkIHJvdXRlciANCiAgICAgIGVsZWN0 aW9uIHByb2Nlc3Mgb24gYnJvYWRjYXN0IGxpbmtzIGNhbiBjYXVzZSBhbGwgdGhlIG5laWdoYm9y IA0KICAgICAgYWRqYWNlbmNpZXMgd2l0aCB0aGUgc2VuZGluZyByb3V0ZXIgdG8gYmUgcmVzZXQs IGRpc3J1cHRpbmcgDQogICAgICBuZXR3b3JrIGNvbW11bmljYXRpb25zLiANCiAgICANCiAgIG8g IFJlcGxheWluZyBkYXRhYmFzZSBkZXNjcmlwdGlvbiAoREItRGVzY3JpcHRpb24pIHBhY2tldHMg Y2FuIGNhdXNlIA0KICAgICAgYWxsIEZVTEwgbmVpZ2hib3IgYWRqYWNlbmNpZXMgd2l0aCB0aGUg c2VuZGluZyByb3V0ZXIgdG8gYmUgcmVzZXQsIA0KICAgICAgZGlzcnVwdGluZyBuZXR3b3JrIGNv bW11bmljYXRpb25zLiANCiAgICANCiAgIG8gIFJlcGxheWluZyBsaW5rIHN0YXRlIHJlcXVlc3Qg KExTLVJlcXVlc3QpIHBhY2tldHMgY2FuIGNhdXNlIGFsbCANCk1hbnJhbCwgZXQuIGFsLiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFtQYWdlIDddIA0KDElu dGVybmV0LURyYWZ0ICAgICAgUm91dGluZyBQcm90b2NvbCBQcm90ZWN0aW9uIElzc3VlcyAgICAg IE9jdG9iZXIgMjAwOSANCiANCiANCiAgICAgIEZVTEwgbmVpZ2hib3IgYWRqYWNlbmNpZXMgd2l0 aCB0aGUgc2VuZGluZyByb3V0ZXIgdG8gYmUgcmVzZXQsIA0KICAgICAgZGlzcnVwdGluZyBuZXR3 b3JrIGNvbW11bmljYXRpb25zLiANCiAgICANCiAgIG8gIENhcHR1cmluZyBhIGZ1bGwgYWRqYWNl bmN5IHByb2Nlc3MgKGZyb20gdHdvLXdheSBhbGwgdGhlIHdheSB0byANCiAgICAgIEZVTEwgc3Rh dGUpLCBhbmQgdGhlbiByZXBsYXlpbmcgdGhpcyBwcm9jZXNzIHdoZW4gdGhlIHJvdXRlciBpcyBu byANCiAgICAgIGxvbmdlciBhdHRhY2hlZCBjYW4gY2F1c2UgYSBmYWxzZSBhZGphY2VuY3kgdG8g YmUgZm9ybWVkLCBhbGxvd2luZyANCiAgICAgIGFuIGF0dGFja2VyIHRvIGF0dHJhY3QgdHJhZmZp Yy4gDQogICAgDQogICBvICBPU1BGdjMgb24gYSBicm9hZGNhc3QgbmV0d29yayBzaGFyZXMgdGhl IHNhbWUga2V5IGJldHdlZW4gYWxsICANCiAgICAgIG5laWdoYm9ycyBvbiB0aGF0IG5ldHdvcmsu IFNvbWUgT1NQRiBwYWNrZXRzIGFyZSBzZW50IHRvIGEgIA0KICAgICAgbXVsdGljYXN0IGFkZHJl c3MuICANCiAgICANCiAgICAgIFNwb29maW5nIGJ5IGEgbWFsaWNpb3VzIG5laWdoYm9yIGlzIHZl cnkgZWFzeS4gUG9zc2Vzc2lvbiBvZiB0aGUgIA0KICAgICAga2V5IGl0c2VsZiBpcyB1c2VkIGFz IGFuIGlkZW50aXR5IGNoZWNrLiBUaGVyZSBpcyBubyBvdGhlciAgDQogICAgICBpZGVudGl0eSBj aGVjayB1c2VkLiBBIG5laWdoYm9yIGNvdWxkIHNlbmQgYSBwYWNrZXQgc3BlY2lmeWluZyB0aGUg IA0KICAgICAgcGFja2V0IGNhbWUgZnJvbSBzb21lIG90aGVyIG5laWdoYm9yIGFuZCB0aGVyZSB3 b3VsZCBiZSBubyB3YXkgaW4gIA0KICAgICAgd2hpY2ggdGhlIGF0dGFja2VkIHJvdXRlciBjb3Vs ZCBmaWd1cmUgb3V0IHRoZSBpZGVudGl0eSBvZiB0aGUgIA0KICAgICAgcGFja2V0IHNlbmRlci4g DQogICAgDQo0LiBJbnRlcm1lZGlhdGUgU3lzdGVtIHRvIEludGVybWVkaWF0ZSBTeXN0ZW0gUm91 dGluZyBQcm90b2NvbCAoSVMtSVMpIA0KICAgIA0KICAgSW50ZWdyYXRlZCBJUy1JUyBbUkZDMTE5 NV0gdXNlcyBITUFDLU1ENSAoSGFzaGVkIE1lc3NhZ2UgDQogICBBdXRoZW50aWNhdGlvbiBDb2Rl IE1ENSkgYXV0aGVudGljYXRpb24gd2l0aCBtYW51YWwga2V5aW5nLCBhcyANCiAgIGRlc2NyaWJl ZCBpbiBbUkZDNTMwNF0gYW5kIGhhcyByZWNlbnRseSBiZWVuIGV4dGVuZGVkIHRvIHByb3ZpZGUg DQogICBzdXBwb3J0IGZvciB1c2luZyB0aGUgSE1BQyBjb25zdHJ1Y3QgYWxvbmcgd2l0aCB0aGUg U2VjdXJlIEhhc2ggDQogICBBbGdvcml0aG0gKFNIQSkgW1JGQzUzMTBdIGZhbWlseSBvZiBjcnlw dG9ncmFwaGljIGhhc2ggZnVuY3Rpb25zLiANCiAgIFRoZXJlIGlzIG5vIHByb3Zpc2lvbiB3aXRo aW4gSVMtSVMgdG8gZW5jcnlwdCB0aGUgYm9keSBvZiBhIHJvdXRpbmcgDQogICBwcm90b2NvbCBt ZXNzYWdlLiANCiAgICANCjQuMSBNYW5hZ2VtZW50IElzc3VlcyB3aXRoIElTLUlTIA0KICAgIA0K ICAgW1JGQzUzMDRdIHN0YXRlcyB0aGF0IGVhY2ggTFNQIGdlbmVyYXRlZCBieSBhbiBpbnRlcm1l ZGlhdGUgc3lzdGVtIGlzIA0KICAgc2lnbmVkIHdpdGggdGhlIEhNQUMtTUQ1IGFsZ29yaXRobSB1 c2luZyBhIGtleSBtYW51YWxseSBkZWZpbmVkIGJ5IA0KICAgdGhlIG5ldHdvcmsgYWRtaW5pc3Ry YXRvci4gIFNpbmNlIGF1dGhlbnRpY2F0aW9uIGlzIHBlcmZvcm1lZCBvbiB0aGUgDQogICBMU1Bz IHRyYW5zbWl0dGVkIGJ5IGFuIGludGVybWVkaWF0ZSBzeXN0ZW0sIHJhdGhlciB0aGFuIG9uIHRo ZSANCiAgIHBhY2tldHMgdHJhbnNtaXR0ZWQgdG8gYSBzcGVjaWZpYyBuZWlnaGJvciwgaXQgaXMg aW1wbGllZCB0aGF0IGFsbCANCiAgIHRoZSBpbnRlcm1lZGlhdGUgc3lzdGVtcyB3aXRoaW4gYSBz aW5nbGUgZmxvb2RpbmcgZG9tYWluIG11c3QgYmUgDQogICBjb25maWd1cmVkIHdpdGggdGhlIHNh bWUga2V5IGZvciBhdXRoZW50aWNhdGlvbiB0byB3b3JrIGNvcnJlY3RseS4gDQogICBUaGUgaW5p dGlhbCBjb25maWd1cmF0aW9uIG9mIG1hbnVhbCBrZXlzIGZvciBhdXRoZW50aWNhdGlvbiB3aXRo aW4gYW4gDQogICBJUy1JUyBuZXR3b3JrIGlzIHNpbXBsaWZpZWQgYnkgYSBzdGF0ZSB3aGVyZSBM U1BzIGNvbnRhaW5pbmcgSE1BQy1NRDUgDQogICBhdXRoZW50aWNhdGlvbiBUTFZzIGFyZSBhY2Nl cHRlZCBieSBpbnRlcm5tZWRpYXRlIHN5c3RlbXMgd2l0aG91dCB0aGUgDQogICBrZXlzLCBidXQg dGhlIGRpZ2VzdCBpcyBub3QgdmFsaWRhdGVkLiBPbmNlIGtleXMgYXJlIGNvbmZpZ3VyZWQgb24g IA0KICAgYWxsIHJvdXRlcnMsIGNoYW5naW5nIHRob3NlIGtleXMgYmVjb21lcyBtdWNoIG1vcmUg ZGlmZmljdWx0LiANCiAgICANCiAgIElTLUlTIFtSRkMxMTk1XSBkb2VzIG5vdCBzcGVjaWZ5IGEg bWVjaGFuaXNtIHRvIG5lZ290aWF0ZSBrZXlzLCBub3IgDQogICBkb2VzIGl0IHNwZWNpZnkgYW55 IG1lY2hhbmlzbSB0byBuZWdvdGlhdGUgdGhlIGhhc2ggYWxnb3JpdGhtcyB0byBiZSANCiAgIHVz ZWQuIA0KICAgIA0KICAgV2l0aCB0aGUgcHJvbGlmZXJhdGlvbiBvZiBhdmFpbGFibGUgaGFzaCBh bGdvcml0aG1zLCBhcyB3ZWxsIGFzICANCiAgIHRoZSBuZWVkIHRvIHVwZ3JhZGUgdGhlIGFsZ29y aXRobXMsIG1hbnVhbGx5IGNvbmZpZ3VyYXRpb24gcmVxdWlyZXMgDQogICBjb29yZGluYXRpb24g YW1vbmcgaW50ZXJtZWRpYXRlIHN5c3RlbXMgd2hpY2ggY2FuIGJlY29tZSB0ZWRpb3VzLiANCk1h bnJhbCwgZXQuIGFsLiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIFtQYWdlIDhdIA0KDEludGVybmV0LURyYWZ0ICAgICAgUm91dGluZyBQcm90b2NvbCBQcm90 ZWN0aW9uIElzc3VlcyAgICAgIE9jdG9iZXIgMjAwOSANCiANCiANCiAgICANCjQuMiANVGVjaG5p Y2FsIElzc3VlcyB3aXRoIElTLUlTIA0KICAgIA0KICAgW1JGQzUzMDRdIHN0YXRlczogIlRoaXMg bWVjaGFuaXNtIGRvZXMgbm90IHByZXZlbnQgcmVwbGF5IGF0dGFja3MsIA0KICAgaG93ZXZlciwg aW4gbW9zdCBjYXNlcywgc3VjaCBhdHRhY2tzIHdvdWxkIHRyaWdnZXIgZXhpc3RpbmcgDQogICBt ZWNoYW5pc21zIGluIHRoZSBJUy1JUyBwcm90b2NvbCB0aGF0IHdvdWxkIGVmZmVjdGl2ZWx5IHJl amVjdCBvbGQgDQogICBpbmZvcm1hdGlvbi4iIA0KICAgIA0KICAgVGhlcmUgYXJlIGEgZmV3IGNh c2VzIHdoZXJlIGV4aXN0aW5nIG1lY2hhbmlzbXMgaW4gdGhlIElTLUlTIA0KICAgcHJvdG9jb2wg d291bGQgbm90IGVmZmVjdGl2ZWx5IHJlamVjdCBvbGQgaW5mb3JtYXRpb24gaXMgdGhlIGNhc2Ug b2YgDQogICBoZWxsbyBwYWNrZXRzIChJSUhzKSB1c2VkIHRvIGRpc2NvdmVyIG5laWdoYm9ycywg YW5kIFNOUCBwYWNrZXRzLiANCiAgICANCiAgIEFzIGRlc2NyaWJlZCBpbiBJUy1JUyBbUkZDMTE5 NV0sIGEgbGlzdCBvZiBrbm93biBuZWlnaGJvcnMgaXMgDQogICBpbmNsdWRlZCBpbiBlYWNoIGhl bGxvIHRyYW5zbWl0dGVkIGJ5IGFuIGludGVybWVkaWF0ZSBzeXN0ZW0sIHRvIA0KICAgZW5zdXJl IHR3by13YXkgY29tbXVuaWNhdGlvbnMgd2l0aCBhbnkgc3BlY2lmaWMgbmVpZ2hib3IgYmVmb3Jl IA0KICAgZXhjaGFuZ2luZyBsaW5rIHN0YXRlIGRhdGFiYXNlcy4gICANCiAgICANCiAgIElTLUlT IGRvZXMgbm90IHByb3ZpZGUgYSBzZXF1ZW5jZSBudW1iZXIuIElTLUlTIHBhY2tldHMgYXJlICAN CiAgIHZ1bG5lcmFibGUgdG8gcmVwbGF5IGF0dGFja3M7IGFueSBwYWNrZXQgY2FuIGJlIHJlcGxh eWVkIGF0IGFueSBwb2ludCAgDQogICBvZiB0aW1lLiBTbyBsb25nIGFzIHRoZSBrZXlzIHVzZWQg YXJlIHRoZSBzYW1lLCBwcm90b2NvbCBlbGVtZW50cyANCiAgIHRoYXQgd291bGQgbm90IGJlIHJl amVjdGVkIHdpbGwgYWZmZWN0IGV4aXN0aW5nIHNlc3Npb25zLiANCiAgICANCiAgIEEgaGVsbG8g cGFja2V0IGNvbnRhaW5pbmcgYSBkaWdlc3Qgd2l0aGluIGEgVExWLCBhbmQgYW4gZW1wdHkgIA0K ICAgbmVpZ2hib3IgbGlzdCwgY291bGQgYmUgcmVwbGF5ZWQsIHJlc3VsdGluZyBpbiBhbGwgYWRq YWNlbmNpZXMgd2l0aCAgDQogICB0aGUgb3JpZ2luYWwgdHJhbnNtaXR0aW5nIGludGVybWVkaWF0 ZSBzeXN0ZW0gdG8gYmUgcmVzdGFydGVkLiANCiAgICANCiAgIEEgcmVwbGF5IG9mIGFuIG9sZCBD U05QIHBhY2tldHMgY291bGQgY2F1c2UgTFNQcyB0byBiZSBmbG9vZGVkLCB0aHVzIA0KICAgY2F1 c2luZyBhbiBMU1Agc3Rvcm0uIA0KICAgIA0KICAgSVMtSVMgc3BlY2lmaWVzIHRoZSB1c2Ugb2Yg dGhlIGhhc2ggYWxnb3JpdGhtIEhNQUMtTUQ1IHRvIHByb3RlY3QgIA0KICAgSVMtSVMgUERVcy4g DQogICAgDQogICBJUy1JUyBkb2VzIG5vdCBoYXZlIGEgbm90aW9uIG9mIEtleSBJRC4gRHVyaW5n IGtleSByb2xsb3ZlciwgZWFjaCAgDQogICBtZXNzYWdlIHJlY2VpdmVkIGhhcyB0byBiZSBjaGVj a2VkIGZvciBpbnRlZ3JpdHkgYWdhaW5zdCBhbGwga2V5cyANCiAgIHRoYXQgYXJlIHZhbGlkLiBB IERvUyBhdHRhY2sgbWF5IGJlIGluZHVjZWQgYnkgc2VuZGluZyBJUy1JUyBwYWNrZXRzIA0KICAg d2l0aCByYW5kb20gaGFzaGVzLiBUaGlzIHdpbGwgY2F1c2UgdGhlIElTLUlTIHBhY2tldCB0byBi ZSBjaGVja2VkIA0KICAgZm9yIGF1dGhlbnRpY2F0aW9uIHdpdGggYWxsIHBvc3NpYmxlIGtleXMs IGluY3JlYXNpbmcgdGhlIGFtb3VudCBvZiANCiAgIHByb2Nlc3NpbmcgcmVxdWlyZWQuICANCiAg ICANCiAgIFJlY2VudGx5LCBhdHRhY2tzIG9uIHRoZSBjb2xsaXNpb24tcmVzaXN0YW5jZSBwcm9w ZXJ0eSBvZiB0aGUgTUQ1IGFuZCANCiAgIFNIQS0xIGhhc2ggZnVuY3Rpb25zIGhhdmUgYmVlbiBk aXNjb3ZlcmVkOyBbUkZDNDI3MF0gc3VtbWFyaXplcyB0aGUgIA0KICAgZGlzY292ZXJpZXMuIFRo ZSBhdHRhY2tzIG9uIE1ENSBhcmUgcHJhY3RpY2FsIG9uIGFueSBtb2Rlcm4gY29tcHV0ZXIuIA0K ICAgRm9yIHRoaXMgcmVhc29uLCB0aGUgdXNlIG9mIHRoZXNlIGFsZ29yaXRobXMgc2hvdWxkIGJl IGRlcHJlY2F0ZWQuIA0KICAgIA0KICAgSE1BQ3MgYXJlIG5vdCBzdXNjZXB0aWJsZSB0byBrbm93 biBjb2xsaXNpb24tcmVkdWN0aW9uIGF0dGFja3MuICANCiAgIElTLUlTIGltcGxlbWVudGF0aW9u cyBzaG91bGQgcHJvdmlkZSBhIHdheSB0byB1cGdyYWRlIHRvIG90aGVyICANCiAgIGFsZ29yaXRo bXMgc2hvdWxkIHRoZSBuZWVkIGFyaXNlLiANCiAgICANCiAgIElTLUlTIG9uIGEgYnJvYWRjYXN0 IG5ldHdvcmsgc2hhcmVzIHRoZSBzYW1lIGtleSBiZXR3ZWVuIGFsbCANCiAgIG5laWdoYm9ycyBv biB0aGF0IG5ldHdvcmsuICANCiAgICANCk1hbnJhbCwgZXQuIGFsLiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFtQYWdlIDldIA0KDEludGVybmV0LURyYWZ0 ICAgICAgUm91dGluZyBQcm90b2NvbCBQcm90ZWN0aW9uIElzc3VlcyAgICAgIE9jdG9iZXIgMjAw OSANCiANCiANCiAgIFRoaXMgbWFrZXMgc3Bvb2ZpbmcgYnkgYSBtYWxpY2lvdXMgbmVpZ2hib3Ig ZWFzeSBzaW5jZSBJUy1JUyBQRFVzIGFyZSANCiAgIHNlbnQgdG8gYSBsaW5rIGxheWVyIG11bHRp Y2FzdCBhZGRyZXNzLiBQb3NzZXNzaW9uIG9mIHRoZSBrZXkgaXRzZWxmIA0KICAgaXMgdXNlZCBh cyBhbiBhdXRob3JpemF0aW9uIGNoZWNrLiBBIG5laWdoYm9yIGNvdWxkIHNlbmQgYSBwYWNrZXQg DQogICBzcG9vZmluZyB0aGUgaWRlbnRpdHkgb2YgYSBuZWlnaGJvciBhbmQgdGhlcmUgd291bGQg YmUgbm8gd2F5IGluIA0KICAgd2hpY2ggdGhlIGF0dGFja2VkIHJvdXRlciBjb3VsZCBkaXNjZXJu IHRoZSBpZGVudGl0eSBvZiB0aGUgbWFsaWNpb3VzIA0KICAgcGFja2V0IHNlbmRlci4gIA0KICAg IA0KICAgVGhlIFJlbWFpbmluZyBMaWZldGltZSBmaWVsZCBpbiB0aGUgTFNQIGlzIG5vdCBjb3Zl cmVkIGJ5IHRoZSANCiAgIGF1dGhlbnRpY2F0aW9uLiBBbiBJUy1JUyByb3V0ZXIgY2FuIHJlY2Vp dmUgaXRzIG93biBzZWxmIGdlbmVyYXRlZCANCiAgIExTUCBzZWdtZW50IHdpdGggemVybyBsaWZl dGltZSByZW1haW5pbmcuIEluIHRoYXQgY2FzZSwgaWYgaXQgaGFzIGEgDQogICBjb3B5IHdpdGgg bm9uLXplcm8gbGlmZXRpbWUsIGl0IHB1cmdlcyB0aGF0IExTUCBpLmUuLCBpdCBpbmNyZW1lbnRz IA0KICAgdGhlIGN1cnJlbnQgc2VxdWVuY2UgbnVtYmVyIGFuZCBmbG9vZHMgYWxsIHRoZSBzZWdt ZW50cyBhZ2Fpbi4gVGhpcyANCiAgIGlzIG11Y2ggd29yc2UgaW4gSVMtSVMgY29tcGFyZWQgdG8g T1NQRiwgYmVjYXVzZSB0aGVyZSBpcyBvbmx5IG9uZSANCiAgIExTUCBvdGhlciB0aGFuIHRoZSBw c2V1ZG9ub2RlIExTUHMgZm9yIHRoZSBMQU5zIG9uIHdoaWNoIGl0IGlzIHRoZSANCiAgIERlc2ln bmF0ZWQgSW50ZXJtZWRpYXRlIFN5c3RlbSAoRElTKS4gDQogICAgDQogICBUaGlzIHdheSBhbiBh dHRhY2tlciBjYW4gZm9yY2UgdGhlIHJvdXRlciB0byBmbG9vZCBhbGwgc2VnbWVudHMsIA0KICAg cG90ZW50aWFsbHkgYSBsYXJnZSBudW1iZXIgaWYgdGhlIG51bWJlciBvZiByb3V0ZXMgaXMgbGFy Z2UuIEl0IGFsc28gDQogICBjYXVzZXMgdGhlIHNlcXVlbmNlIG51bWJlciBvZiBhbGwgdGhlIExT UHMgdG8gaW5jcmVhc2UgZmFzdC4gSWYgdGhlIA0KICAgc2VxdWVuY2UgbnVtYmVyIGluY3JlYXNl cyB0byB0aGUgbWF4aW11bSAoMHhGRkZGRkZGRiksIHRoZSBJUy1JUyANCiAgIHByb2Nlc3MgbXVz dCBzaHV0IGRvd24gZm9yIGFyb3VuZCAyMCsgbWludXRlcyAodGhlIHByb2R1Y3Qgb2YgTWF4QWdl IA0KICAgKyBaZXJvQWdlTGlmZXRpbWUpIHRvIGFsbG93IHRoZSBvbGQgTFNQcyB0byBhZ2Ugb3V0 IG9mIGFsbCB0aGUgcm91dGVyIA0KICAgZGF0YWJhc2VzLiANCiAgICANCjUuIEJvcmRlciBHYXRl d2F5IFByb3RvY29sIChCR1AtNCkgDQogDQogICBCR1AtNCBbUkZDNDI3MV0gdXNlcyBUQ1AgW1JG QzA3OTNdIGZvciB0cmFuc3BvcnRpbmcgcm91dGluZyANCiAgIGluZm9ybWF0aW9uIGJldHdlZW4g QkdQIHNwZWFrZXJzIHdoaWNoIGhhdmUgZm9ybWVkIGFuIGFkamFjZW5jeS4gDQogICAgDQogICBb UkZDMjM4NV0gZGVzY3JpYmVzIHRoZSB1c2Ugb2YgVENQIE1ENSBzaWduYXR1cmUgb3B0aW9uIGZv ciBwcm92aWRpbmcgDQogICBwYWNrZXQgb3JpZ2luIGF1dGhlbnRpY2F0aW9uIGFuZCBkYXRhIGlu dGVncml0eSBwcm90ZWN0aW9uIG9mIEJHUCANCiAgIHBhY2tldHMuIFtSRkMzNTYyXSBwcm92aWRl cyBzdWdnZXN0aW9ucyBmb3IgY2hvb3NpbmcgdGhlIGtleSBsZW5ndGggDQogICBvZiB0aGUgYWQt aG9jIGtleWVkLU1ENSBtZWNoYW5pc20gc3BlY2lmaWVkIGluIFtSRkMyMzg1XS4gVGhlcmUgaXMg bm8gDQogICBwcm92aXNpb24gZm9yIGNvbmZpZGVudGlhbGl0eSBmb3IgYW55IG9mIHRoZXNlIEJH UCBtZXNzYWdlcy4gDQogICAgDQogICBCR1AgcmVsYXRpdmUgdG8gcHJldmlvdXNseSBkZXNjcmli ZWQgSUdQIHByb3RvY29scyBoYXMgYWRkaXRpb25hbCANCiAgIGV4cG9zdXJlIGR1ZSB0byAgdGhl IG5hdHVyZSBvZiB0aGUgZW52aXJvbm1lbnQgd2hlcmUgIGl0IGlzIHR5cGljYWxseSANCiAgIHVz ZWQsIG5hbWVseSBiZXR3ZWVuIGF1dG9ub21vdXMgbmV0d29ya3MgKHVuZGVyIGRpZmZlcmVudCAg DQogICBhZG1pbmlzdHJhdGl2ZSBjb250cm9sKS4gV2hpbGUgcm91dGVycyBydW5uaW5nIGludGVy aW9yIGdhdGV3YXkgDQogICBwcm90b2NvbHMgbWF5IGFsbCBiZSBjb25maWd1cmVkIHdpdGggdGhl IHNhbWUgYWRtaW5pc3RyYXRpdmUgDQogICBhdXRob3JpdHksIHR3byBCR1AgcGVlcnMgbWF5IGJl IGluIGRpZmZlcmVudCBhZG1pbmlzdHJhdGl2ZSBkb21haW5zLCANCiAgIGhhdmluZyBkaWZmZXJl bnQgcG9saWNpZXMgZm9yIGtleSBzdHJlbmd0aCwgcm9sbG92ZXIgZnJlcXVlbmN5LCBldGMuIA0K ICAgQW4gYXV0b25vbW91cyBzeXN0ZW0gbXVzdCBvZnRlbiBzdXBwb3J0IGEgbGFyZ2UgbnVtYmVy IG9mIGtleXMgYXQgDQogICBkaWZmZXJlbnQgQkdQIGJvdW5kcmllcywgYXMgZWFjaCBjb25uZWN0 aW5nIEFTIHJlcHJlc2VudHMgYSBkaWZmZXJlbnQgDQogICBhZG1pbmlzdHJhdGl2ZSBlbnRpdHku IEluIHByYWN0aWNlIG9uY2Ugc2V0LCBzaGFyZWQgc2VjcmV0cyBiZXR3ZWVuIA0KICAgQkdQIHBl ZXJzIGFyZSByYXJlbHkgaWYgZXZlciBjaGFuZ2VkLiANCiAgICANCjUuMSBNYW5hZ2VtZW50IElz c3VlcyB3aXRoIEJHUC00IA0KICAgIA0KICAgRWFjaCBwYWlyIG9mIEJHUCBzcGVha2VycyBmb3Jt aW5nIGFuIGFkamFjZW5jeSBtYXkgaGF2ZSBhIGRpZmZlcmVudCANCg0KTWFucmFsLCBldC4gYWwu ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgW1BhZ2UgMTBd IA0KDEludGVybmV0LURyYWZ0ICAgICAgUm91dGluZyBQcm90b2NvbCBQcm90ZWN0aW9uIElzc3Vl cyAgICAgIE9jdG9iZXIgMjAwOSANCiANCiANCiAgIE1ENSBzaGFyZWQga2V5IGZhY2lsaXRhdGlu ZyB0aGUgaW5kZXBlbmRlbnQgY29uZmlndXJhdGlvbiBhbmQgDQogICBjaGFuZ2luZyBvZiBrZXlz IGFjcm9zcyBhIGxhcmdlIHNjYWxlIG5ldHdvcmsuICBNYW51YWwgY29uZmlndXJhdGlvbiANCiAg IGFuZCBtYWludGVuYW5jZSBvZiBjcnlwdG9ncmFwaGljIGtleXMgYWNyb3NzIGFsbCBCR1Agc2Vz c2lvbnMgaXMgYSANCiAgIGNoYWxsZW5nZSBpbiBhbnkgbGFyZ2Ugc2NhbGUgZW52aXJvbm1lbnQu ICAgDQogICAgDQogICBNb3N0IEJHUCBpbXBsZW1lbnRhdGlvbnMgd2lsbCBhY2NlcHQgQkdQIHBh Y2tldHMgd2l0aCBhIGJhZCBkaWdlc3QgdXAgDQogICB0byB0aGUgaG9sZCBpbnRlcnZhbCBuZWdv dGlhdGVkIGJldHdlZW4gQkdQIHBlZXJzIGF0IHBlZXJpbmcgc3RhcnR1cCwgDQogICBpbiBvcmRl ciB0byBhbGxvdyBmb3IgTUQ1IGtleXMgdG8gYmUgY2hhbmdlZCB3aXRoIG1pbmltYWwgaW1wYWN0 IG9uIA0KICAgb3BlcmF0aW9uIG9mIHRoZSBuZXR3b3JrLiAgVGhpcyB0ZWNobmlxdWUgZG9lcywg aG93ZXZlciwgYWxsb3cgc29tZSANCiAgIHNob3J0IHBlcmlvZCBvZiB0aW1lLCBkdXJpbmcgd2hp Y2ggYW4gYXR0YWNrZXIgbWF5IGluamVjdCBCR1AgcGFja2V0cyANCiAgIHdpdGggZmFsc2UgTUQ1 IGRpZ2VzdHMgaW50byB0aGUgbmV0d29yayBhbmQgY2FuIGV4cGVjdCB0aG9zZSBwYWNrZXRzIA0K ICAgdG8gYmUgYWNjZXB0ZWQsIGV2ZW4gdGhvdWdoIHRoZSBNRDUgZGlnZXN0IGlzIG5vdCB2YWxp ZC4gDQogICAgDQo1LjIgVGVjaG5pY2FsIElzc3VlcyB3aXRoIEJHUC00IA0KICAgIA0KICAgQkdQ IHJlbGllcyBvbiBUQ1AgW1JGQzA3OTNdIGZvciB0cmFuc3BvcnRpbmcgZGF0YSBiZXR3ZWVuIEJH UCANCiAgIHNwZWFrZXJzLiBCR1AgY2FuIHJlbHkgb24gVENQJ3MgcHJvdGVjdGlvbnMgYWdhaW5z dCBkYXRhIGNvcnJ1cHRpb24gDQogICBhbmQgcmVwbGF5IHRvIHByZWNsdWRlIHJlcGxheSBhdHRh Y2tzIGFnYWluc3QgQkdQIHNlc3Npb25zLiAgQSBncmVhdCANCiAgIGRlYWwgb2YgcmVzZWFyY2gg aGFzIGdvbmUgaW50byB0aGUgZmVhc2liaWxpdHkgb2YgYW4gYXR0YWNrZXIgDQogICBvdmVyY29t aW5nIHRoZXNlIHByb3RlY3Rpb25zLCBpbmNsdWRpbmcgW1RDUC1XSU5ET1ddIGFuZCANCiAgIFtC R1AtQVRUQUNLXS4gIE1vc3Qgcm91dGVyIGFuZCBPcGVyYXRpbmcgU3lzdGVtIChPUykgdmVuZG9y cyBoYXZlIA0KICAgbW9kaWZpZWQgdGhlaXIgVENQIGltcGxlbWVudGF0aW9ucyB0byByZXNvbHZl IHRoZSBzZWN1cml0eSANCiAgIHZ1bG5lcmFiaWxpdGllcyBkZXNjcmliZWQgaW4gdGhlc2UgcmVm ZXJlbmNlcywgd2hlcmUgcG9zc2libGUuIA0KICAgIA0KICAgQXMgbWVudGlvbmVkIGVhcmxpZXIs IE1ENSBpcyB2dWxuZXJhYmxlIHRvIGNvbGxpc2lvbiBhdHRhY2tzLCBhbmQgY2FuIA0KICAgYmUg YXR0YWNrZWQgdGhyb3VnaCBzZXZlcmFsIG1lYW5zLCBzdWNoIGFzIHRob3NlIGV4cGxvcmVkIGlu IFtNRDUtDQogICBBVFRBQ0tdLiANCiAgICANCiAgIFRob3VnaCBpdCBjYW4gYmUgYXJndWVkIHRo YXQgdGhlIGNvbGxpc2lvbiBhdHRhY2tzIGRvIG5vdCBoYXZlIGEgDQogICBwcmFjdGljYWwgYXBw bGljYXRpb24gaW4gdGhpcyBzY2VuYXJpbywgdGhlIHVzZSBvZiBNRDUgc2hvdWxkIGJlIA0KICAg ZGlzY291cmFnZWQuICANCiAgICANCiAgIFJvdXRlcnMgcGVyZm9ybWluZyBjcnlwdG9ncmFwaGlj IHByb2Nlc3Npbmcgb2YgcGFja2V0cyBpbiBzb2Z0d2FyZSANCiAgIG1heSBiZSBleHBvc2VkIHRv IGFkZGl0aW9uYWwgb3Bwb3J0dW5pdGllcyBmb3IgRG9TIGF0dGFja3MuIEFuIA0KICAgYXR0YWNr ZXIgbWF5IGJlIGFibGUgdG8gdHJhbnNtaXQgZW5vdWdoIHNwb29mZWQgdHJhZmZpYyB3aXRoIGZh bHNlIA0KICAgZGlnZXN0cyB0aGF0IHRoZSByb3V0ZXIncyBwcm9jZXNzb3IgYW5kIG1lbW9yeSBy ZXNvdXJjZXMgYXJlIA0KICAgY29uc3VtZWQsIGNhdXNpbmcgdGhlIHJvdXRlciB0byBiZSB1bmFi bGUgdG8gcGVyZm9ybSBub3JtYWwgDQogICBwcm9jZXNzaW5nLiBUaGlzIGV4cG9zdXJlIGlzIHBh cnRpY3VsYXJseSBwcm9ibGVtYXRpYyBiZXR3ZWVuIHJvdXRlcnMgIA0KICAgbm90IHVuZGVyIHVu aWZpZWQgYWRtaW5pc3RyYXRpdmUgY29udHJvbC4gDQogICAgDQo2LiBUaGUgUm91dGluZyBJbmZv cm1hdGlvbiBQcm90b2NvbCAoUklQKSANCiANCiAgIFRoZSBpbml0aWFsIHZlcnNpb24gb2YgUklQ IHdhcyBzcGVjaWZpZWQgaW4gU1REMzQgW1JGQzEwNThdLiBUaGlzIA0KICAgdmVyc2lvbiBkaWQg bm90IHByb3ZpZGUgZm9yIGFueSBhdXRoZW50aWNhdGlvbiBvciBhdXRob3JpemF0aW9uIG9mIA0K ICAgcm91dGluZyBkYXRhLCBhbmQgdGh1cyB3YXMgdnVsbmVyYWJsZSB0byBhbnkgb2YgYSBudW1i ZXIgb2YgYXR0YWNrcyANCiAgIGFnYWluc3Qgcm91dGluZyBwcm90b2NvbHMuIFRoaXMgbGltaXRh dGlvbiB3YXMgb25lIHJlYXNvbiB3aHkgdGhpcyANCiAgIHByb3RvY29sIHdhcyBtb3ZlZCB0byBI aXN0b3JpYyBzdGF0dXMgW1JGQzE5MjNdLiANCiAgICANCiAgIFJJUHYyLCBvcmlnaW5hbGx5IHNw ZWNpZmllZCBpbiBbUkZDMTM4OF0sIHRoZW4gW1JGQzE3MjNdLCB3YXMgDQogICBmaW5hbGl6ZWQg aW4gU1RENTYgW1JGQzI0NTNdLiBUaGlzIHZlcnNpb24gb2YgdGhlIHByb3RvY29sIHByb3ZpZGVz IA0KICAgZm9yIGF1dGhlbnRpY2F0aW5nIHBhY2tldHMgd2l0aCBhIGRpZ2VzdC4gVGhlIGRldGFp bHMgdGhlcmVvZiANCk1hbnJhbCwgZXQuIGFsLiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIFtQYWdlIDExXSANCgxJbnRlcm5ldC1EcmFmdCAgICAgIFJvdXRp bmcgUHJvdG9jb2wgUHJvdGVjdGlvbiBJc3N1ZXMgICAgICBPY3RvYmVyIDIwMDkgDQogDQogDQog ICBoYXZlIGluaXRpYWxseSBiZWVuIHByb3ZpZGVkIGluICJSSVAtMiBNRDUgQXV0aGVudGljYXRp b24iIFtSRkMyMDgyXTsgDQogICAiUklQdjIgQ3J5cHRvZ3JhcGhpYyBBdXRoZW50aWNhdGlvbiIg W1JGQzQ4MjJdIG9ic29sZXRlcyBbUkZDMjA4Ml0gDQogICBhbmQgYWRkcyBkZXRhaWxzIG9mIGhv dyB0aGUgU0hBIGZhbWlseSBvZiBoYXNoIGFsZ29yaXRobXMgY2FuIGJlIHVzZWQgDQogICB0byBw cm90ZWN0IFJJUHYyLiBbUkZDMjA4Ml0gb25seSBzcGVjaWZpZWQgdGhlIHVzZSBvZiBLZXllZCBN RDUuIA0KICAgIA0KNi4xIA1UZWNobmljYWwgSXNzdWVzIHdpdGggUklQIA0KICAgIA0KICAgbyAg VGhlIHNlcXVlbmNlIG51bWJlciB1c2VkIGJ5IGEgcm91dGVyIGlzIGluaXRpYWxpemVkIHRvIHpl cm8sIGF0IA0KICAgICAgc3RhcnR1cCwgYW5kIGlzIGFsc28gc2V0IHRvIHplcm8gd2hlbmV2ZXIg dGhlIG5laWdoYm9yIGlzIGJyb3VnaHQgIA0KICAgICAgZG93bi4gSWYgdGhlIGNyeXB0b2dyYXBo aWNhbGx5IHByb3RlY3RlZCBwYWNrZXRzIG9mIGEgcm91dGVyIHRoYXQgIA0KICAgICAgaXMgYnJv dWdodCBkb3duIChmb3IgYWRtaW5pc3RyYXRpdmUgb3Igb3RoZXIgcmVhc29ucykgYXJlIHN0b3Jl ZCAgDQogICAgICBieSBhIG1hbGljaW91cyByb3V0ZXIsIHRoZSBuZXcgcm91dGVyIGNvdWxkIHJl cGxheSB0aGUgcGFja2V0cyAgDQogICAgICBmcm9tIHRoZSBwcmV2aW91cyBzZXNzaW9uIHRodXMg Zm9yY2luZyB0cmFmZmljIHRocm91Z2ggdGhlICANCiAgICAgIG1hbGljaW91cyByb3V0ZXIuICBE cm9wcGluZyBvZiBzdWNoIHBhY2tldHMgYnkgdGhlIHJvdXRlciBjb3VsZCAgDQogICAgICByZXN1 bHQgaW4gYmxhY2tob2xlcy4gIEFsc28gZm9yd2FyZGluZyB3cm9uZyBwYWNrZXRzIGNvdWxkICAg ICAgDQogICAgICByZXN1bHQgaW4gcm91dGluZyBsb29wcy4gDQogICAgDQogICBvICBSSVB2MiBh bGxvd3MgbXVsdGlwbGUgcGFja2V0cyB3aXRoIHRoZSBzYW1lIHNlcXVlbmNlIG51bWJlci4gDQog ICAgICBUaGlzIGNvdWxkIG1lYW4gdGhlIHNhbWUgcGFja2V0IG1heSBiZSByZXBsYXllZCBtYW55 IHRpbWVzIGJlZm9yZSANCiAgICAgIHRoZSBuZXh0IGxlZ2l0aW1hdGUgcGFja2V0IGlzIHNlbnQu ICBBbiBhdHRhY2tlciBtYXkgcmVzZW5kIHRoZSANCiAgICAgIHNhbWUgcGFja2V0IHJlcGVhdGVk bHkgdW50aWwgdGhlIG5leHQgaGVsbG8gcGFja2V0IGlzIHRyYW5zbWl0dGVkIA0KICAgICAgYW5k IHJlY2VpdmVkLCB3aGljaCBtZWFucyB0aGUgaGVsbG8gaW50ZXJ2YWwgdGhlcmVmb3JlIGRldGVy bWluZXMgIA0KICAgICAgdGhlIGF0dGFjayB3aW5kb3cuIA0KICAgIA0KICAgbyAgUklQdjIgW1JG QzI0NTNdIGRvZXMgbm90IHNwZWNpZnkgdGhlIHVzZSBvZiBhbnkgcGFydGljdWxhciBoYXNoICAN CiAgICAgIGFsZ29yaXRobS4gQ3VycmVudGx5LCBSSVAgaW1wbGVtZW50YXRpb25zIG9ubHkgc3Vw cG9ydCBrZXllZCBNRDUgIA0KICAgICAgW1JGQzIwODJdLiANCiAgICAgDQogICBvICBSSVB2MiBD cnlwdG9ncmFwaGljIEF1dGhlbnRpY2F0aW9uIFtSRkM0ODIyXSBkb2VzIG5vdCBjb3ZlciB0aGUg DQogICAgICBVRFAgYW5kIHRoZSBJUCBoZWFkZXJzLiBJdCBpcyB0aGVyZWZvcmUgcG9zc2libGUg Zm9yIGFuIGF0dGFja2VyICANCiAgICAgIHRvIG1vZGlmeSBzb21lIGZpZWxkcyBpbiB0aGUgYWJv dmUgaGVhZGVycyB3aXRob3V0IHJvdXRlcnMgIA0KICAgICAgYmVjb21pbmcgYXdhcmUgb2YgaXQu IA0KICAgIA0KICAgICAgVGhlcmUgaXMgbGltaXRlZCBleHBvc3VyZSB0byBtb2RpZmljYXRpb24g b2YgdGhlIFVEUCBoZWFkZXIgYXMgDQogICAgICB0aGUgUklQIHByb3RvY29sICB1c2VzIG9ubHkg aXQgdG8gY29tcHV0ZSB0aGUgbGVuZ3RoIG9mIHRoZSBSSVAgIA0KICAgICAgcGFja2V0LiBDaGFu Z2VzIGludHJvZHVjZWQgaW4gdGhlIFVEUCBoZWFkZXIgd291bGQgY2F1c2UgUklQICANCiAgICAg IGF1dGhlbnRpY2F0aW9uIHRvIGZhaWwgdGhlIFJJUCBhdXRoZW50aWNhdGlvbiwgIGxpbWl0aW5n IGV4cG9zdXJlLiANCiAgICANCiAgICAgIFJJUCB1c2VzIHRoZSBzb3VyY2UgSVAgYWRkcmVzcyBm cm9tIHRoZSBJUCBoZWFkZXIgdG8gZGV0ZXJtaW5lICANCiAgICAgIHdoaWNoIFJJUCBuZWlnaGJv ciBpdCBoYXMgbGVhcm50IHRoZSBSSVAgVXBkYXRlIGZyb20uICBDaGFuZ2luZyAgDQogICAgICB0 aGUgc291cmNlIElQIGFkZHJlc3MgY2FuIGJlIHVzZWQgYnkgYW4gYXR0YWNrZXIgdG8gZGlzcnVw dCB0aGUgIA0KICAgICAgUklQIHJvdXRpbmcgc2Vzc2lvbnMgYmV0d2VlbiB0d28gcm91dGVycyBS MSBhbmQgUjIsIGFzIHNob3duIGluICANCiAgICAgIHRoZSBmb2xsb3dpbmcgZXhhbXBsZXM6IA0K ICAgIA0KICAgICAgU2NlbmFyaW8gMTogDQogICAgICANCiAgICAgIFIxIHNlbmRzIGFuIGF1dGhl bnRpY2F0ZWQgUklQIG1lc3NhZ2UgdG8gUjIgd2l0aCBhIGNyeXB0b2dyYXBoaWMgIA0KICAgICAg c2VxdWVuY2UgbnVtIFguIA0KICAgIA0KICAgICAgVGhlIGF0dGFja2VyIHRoZW4gbmVlZHMgYSBo aWdoZXIgc2VxdWVuY2UgbnVtYmVyIHBhY2tldCBmcm9tIHRoZSAgDQogICAgICBMQU4uIEl0IGNv dWxkIGFsc28gYmUgYSBwYWNrZXQgb3JpZ2luYXRlZCBieSBSMiBlaXRoZXIgZnJvbSB0aGlzICAN Ck1hbnJhbCwgZXQuIGFsLiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIFtQYWdlIDEyXSANCgxJbnRlcm5ldC1EcmFmdCAgICAgIFJvdXRpbmcgUHJvdG9jb2wg UHJvdGVjdGlvbiBJc3N1ZXMgICAgICBPY3RvYmVyIDIwMDkgDQogDQogDQogICAgICBzZXNzaW9u LCBvciBmcm9tIHNvbWUgZWFybGllciBzZXNzaW9uLiANCiAgICANCiAgICAgIFRoZSBhdHRhY2tl ciBjYW4gdGhlbiByZXBsYXkgdGhpcyBwYWNrZXQgdG8gUjIgYnkgY2hhbmdpbmcgdGhlICANCiAg ICAgIHNvdXJjZSBJUCB0byB0aGF0IG9mIFIxLiANCiAgICANCiAgICAgIFIyIHdvdWxkIHRoZW4g bm8gbG9uZ2VyIGFjY2VwdCBhbnkgbW9yZSBSSVAgVXBkYXRlcyBmcm9tIFIxIGFzICANCiAgICAg IHRob3NlIHdvdWxkIGhhdmUgYSBsb3dlciBjcnlwdG9ncmFwaGljIHNlcXVlbmNlIG51bWJlci4g QWZ0ZXIgMTgwICANCiAgICAgIHNlY29uZHMgKG9yIGxlc3MpLCBSMiB3b3VsZCBjb25zaWRlciBS MSB0aW1lZCBvdXQgYW5kIGJyaW5nIGRvd24gIA0KICAgICAgdGhlIFJJUCBzZXNzaW9uLiANCiAg ICANCiAgICAgIFNjZW5hcmlvIDI6IA0KICAgIA0KICAgICAgUjEgYW5ub3VuY2VzIGEgcm91dGUg d2l0aCBjb3N0IEMxIHRvIFIyLiBUaGlzIHBhY2tldCBjYW4gYmUgIA0KICAgICAgY2FwdHVyZWQg YnkgYW4gYXR0YWNrZXIuIExhdGVyLCBpZiB0aGlzIGNvc3QgY2hhbmdlcyBhbmQgUjEgIA0KICAg ICAgYW5ub3VuY2VzIHRoaXMgd2l0aCBhIGRpZmZlcmVudCBjb3N0IEMyLCB0aGUgYXR0YWNrZXIg Y2FuIHJlcGxheSAgDQogICAgICB0aGUgY2FwdHVyZWQgcGFja2V0LCBtb2RpZnlpbmcgdGhlIHNv dXJjZSBJUCB0byBhIG5ldyAgDQogICAgICBhcmJpdHJhcnkgSVAgYWRkcmVzcyB0aGVyZWJ5IG1h c3F1ZXJhZGluZyBhcyBhIGRpZmZlcmVudCByb3V0ZXIuICANCiAgICANCiAgICAgIFIyIHdpbGwg YWNjZXB0IHRoaXMgcm91dGUgYW5kIHRoZSByb3V0ZXIgYXMgYSBuZXcgZ2F0ZXdheSwgYW5kICAN CiAgICAgIFIyIHdvdWxkIHRoZW4gdXNlIHRoZSBub24gZXhpc3RlbnQgcm91dGVyIGFzIGEgbmV4 dCBob3AgZm9yIHRoYXQgIA0KICAgICAgbmV0d29yay4gVGhpcyB3b3VsZCBvbmx5IGJlIGVmZmVj dGl2ZSBpZiB0aGUgY29zdCBDMSBpcyBsZXNzIHRoYW4gIA0KICAgICAgQzIuIA0KICAgIA0KNy4g QmlkaXJlY3Rpb25hbCBGb3J3YXJkaW5nIERldGVjdGlvbiAoQkZEKSANCiAgICAgICAgICAgICAg ICAgDQogICBCRkQgaXMgc3BlY2lmaWVkIGluIHRoZSBkb2N1bWVudCBbQkZELUJBU0VdLiBFeHRl bnNpb25zIHRvIEJGRCBmb3IgDQogICBNdWx0aS1ob3AgW0JGRC1NVUxUSV0gYW5kIHNpbmdsZSBo b3AgW0JGRC0xSE9QXSBhcmUgZGVmaW5lZCBmb3IgSVB2NCANCiAgIGFuZCBJUHY2LiBJdCBpcyBk ZXNpZ25lZCB0byBkZXRlY3QgZmFpbHVyZSB3aXRoIHRoZSBmb3J3YXJkaW5nIHBsYW5lIA0KICAg bmV4dGhvcC4gDQogICAgDQogICBCRkQgYmFzZSBzcGVjaWZpZXMgYW4gb3B0aW9uYWwgYXV0aGVu dGljYXRpb24gbWVjaGFuaXNtIHdoaWNoIGNhbiBiZSANCiAgIHVzZWQgYnkgcmVjZWl2ZXIgb2Yg YSBwYWNrZXQgdG8gYmUgYWJsZSB0byBhdXRoZW50aWNhdGUgdGhlIHNvdXJjZSBvZiANCiAgIHRo ZSBwYWNrZXQuIEl0IHJlbGllcyBvbiB0aGUgZmFjdCB0aGF0IHRoZSBrZXlzIGFyZSBzaGFyZWQg YmV0d2VlbiANCiAgIHRoZSBwZWVycyBhbmQgbm8gbWVjaGFuaXNtIGlzIGRlZmluZWQgZm9yIHRo ZSBhY3R1YWwgS2V5IGdlbmVyYXRpb24uIA0KICAgIA0KNy4xIA1UZWNobmljYWwgSXNzdWVzIHdp dGggQkZEIA0KICAgIA0KICAgbyBUaGUgbGV2ZWwgb2Ygc2VjdXJpdHkgcHJvdmlkZWQgaXMgYmFz ZWQgb24gdGhlIEF1dGhlbnRpY2F0aW9uIFR5cGUgICANCiAgICAgdXNlZC4gSG93ZXZlciB0aGUg YXV0aGVudGljYXRpb24gYWxnb3JpdGhtcyBkZWZpbmVkIGFyZSBNRDUgb3IgIA0KICAgICBTSEEt MSBiYXNlZC4gQXMgbWVudGlvbmVkIGVhcmxpZXIgTUQ1IGFuZCBTSEEtMSBhcmUgYm90aCBrbm93 biB0byAgDQogICAgIGJlIHZ1bG5lcmFibGUgdG8gY29sbGlzaW9uIGF0dGFja3MuIA0KICAgIA0K ICAgbyBCRkQgc3BlYyBtZW50aW9ucyBtZWNoYW5pc21zIHRvIGFsbG93IGZvciB0aGUgY2hhbmdl IG9mIA0KICAgICBhdXRoZW50aWNhdGlvbiBzdGF0ZSBiYXNlZCBvbiB0aGUgc3RhdGUgb2YgYSBy ZWNlaXZlZCBwYWNrZXQuIFRoaXMgDQogICAgIGNhbiBjYXVzZSBhIGRlbmlhbCBvZiBzZXJ2aWNl IGF0dGFjayB3aGVyZSBhIG1hbGljaW91cyANCiAgICAgYXV0aGVudGljYXRlZCBwYWNrZXQgKHN0 b3JlZCBmcm9tIGEgcGFzdCBzZXNzaW9uKSBjYW4gYmUgcmVsYXllZCANCiAgICAgb3ZlciBhIHNl c3Npb24gd2hpY2ggZG9lcyBub3QgdXNlIGF1dGhlbnRpY2F0aW9uLiBUaGlzIGNhdXNlcyBvbmUg DQogICAgIGVuZCB0byBhc3N1bWUgdGhhdCBhdXRoZW50aWNhdGlvbiBpcyBlbmFibGVkIGF0IHRo ZSBvdGhlciBlbmQgYW5kIA0KICAgICBoZW5jZSB0aGUgQkZEIGFkamFjZW5jeSBpcyBkcm9wcGVk LiBUaGlzIHdvdWxkIGJlIGEgaGFyZGVyIGF0dGFjayANCiAgICAgdG8gcHV0IGZvcnRoIHdoZW4g bWV0aWN1bG91c2x5IGtleWVkIGF1dGhlbnRpY2F0aW9uIGlzIGluIHVzZS4gDQogICAgDQpNYW5y YWwsIGV0LiBhbC4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBbUGFnZSAxM10gDQoMSW50ZXJuZXQtRHJhZnQgICAgICBSb3V0aW5nIFByb3RvY29sIFByb3Rl Y3Rpb24gSXNzdWVzICAgICAgT2N0b2JlciAyMDA5IA0KIA0KIA0KICAgbyBCRkQgd29ya3Mgb24g bWljcm9zZWNvbmQgdGltZXJzLiBXaGVuIG1hbGljaW91cyBwYWNrZXRzIGFyZSBzZW50IA0KICAg ICBhdCB2ZXJ5IHNtYWxsIGR1cmF0aW9uIG9mIHRpbWUsIHdpdGggdGhlIGF1dGhlbnRpY2F0aW9u IGJpdCBzZXQsIA0KICAgICBpdCBjYW4gY2F1c2UgYSBEb1MgYXR0YWNrLiANCiANCiAgIG8gQkZE IGFsbG93cyBhIG1vZGUgY2FsbGVkIHRoZSBlY2hvIG1vZGUuIEVjaG8gcGFja2V0cyBhcmUgbm90 IA0KICAgICBkZWZpbmVkIGluIHRoZSBCRkQgc3BlY2lmaWNhdGlvbiwgdGhvdWdoIHRoZXkgY2Fu IGtlZXAgdGhlIEJGRCANCiAgICAgc2Vzc2lvbiBVUC4gVGhlcmUgYXJlIG5vIGd1aWRlbGluZXMg b24gdGhlIHByb3BlcnRpZXMgb2YgdGhlIGVjaG8gDQogICAgIHBhY2tldHMuIEFueSBzZWN1cml0 eSBpc3N1ZXMgaW4gdGhlIGVjaG8gbW9kZSBvciBwYWNrZXRzIHdpbGwgDQogICAgIGRpcmVjdGx5 IGVmZmVjdCB0aGUgQkZEIHByb3RvY29sIGFuZCBzZXNzaW9uIHN0YXRlcyBhbmQgaGVuY2UgdGhl IA0KICAgICBuZXR3b3JrIHN0YWJpbGl0eS4gDQogDQogICBvIEJGRCBwYWNrZXRzIGNhbiBiZSBz ZW50IGF0IG1pbGxpc2Vjb25kIGludGVydmFscyAodGhlIHByb3RvY29sIA0KICAgICB1c2VzIHRp bWVycyBhdCBtaWNyb3NlY29uZCBpbnRlcnZhbHMpLiBXaGVuIHVzaW5nIGF1dGhlbnRpY2F0aW9u IA0KICAgICB0aGlzIGNhbiBjYXVzZSBmcmVxdWVudCBTZXF1ZW5jZSBOdW1iZXIgd3JhcC1hcm91 bmQgYXMgYSAzMi1iaXQgDQogICAgIHNlcXVlbmNlIG51bWJlciBpcyB1c2VkLCB0aHVzIGNvbnNp ZGVyYWJseSByZWR1Y2luZyB0aGUgc2VjdXJpdHkgDQogICAgIG9mIHRoZSBhdXRoZW50aWNhdGlv biBhbGdvcml0aG1zLiANCiAgICANCiAgICANCjguIA1TZWN1cml0eSBDb25zaWRlcmF0aW9ucyAg DQogICAgDQogICBUaGlzIGRyYWZ0IG91dGxpbmVzIHNlY3VyaXR5IGlzc3VlcyBhcmlzaW5nIGZy b20gdGhlIGN1cnJlbnQgDQogICBtZXRob2RvbG9neSBmb3IgbWFudWFsIGtleWluZyBvZiB2YXJp b3VzIHJvdXRpbmcgcHJvdG9jb2xzLiAgTm8gDQogICBzcGVjaWZpYyBjaGFuZ2VzIHRvIHJvdXRp bmcgcHJvdG9jb2xzIGFyZSBwcm9wb3NlZCBpbiB0aGlzIGRyYWZ0LCANCiAgIGxpa2V3aXNlIG5v IG5ldyBzZWN1cml0eSByZXF1aXJlbWVudHMgcmVzdWx0LiAgDQogICAgICAgDQo5LiBBY2tub3ds ZWRnZW1lbnRzICANCiAgICAgDQogICBXZSB3b3VsZCBsaWtlIHRvIGFja25vd2xlZGdlIFNhbSBI YXJ0bWFuLCBSYW4gQXRraW5zb24sIFN0ZXZlIEtlbnQgDQogICBhbmQgQnJpYW4gV2VpcyBmb3Ig dGhlaXIgaW5pdGlhbCBjb21tZW50cyBvbiB0aGlzIGRyYWZ0LiAgVGhhbmtzIHRvIA0KICAgTWVy aWtlIEthZW8gYW5kIEFsZnJlZCBIb2VuZXMgZm9yIHJldmlld2luZyBtYW55IHNlY3Rpb25zIG9m IHRoZSANCiAgIGRyYWZ0IGFuZCBwcm92aWRpbmcgbG90IG9mIHVzZWZ1bCBjb21tZW50cy4gDQog ICAgDQoxMC4gSUFOQSBDb25zaWRlcmF0aW9ucyAgDQogDQogICBUaGlzIGRvY3VtZW50IHBsYWNl cyBubyByZXF1ZXN0cyB0byBJQU5BLiANCiAgICANCiAgIE5vdGUgdG8gUkZDIEVkaXRvcjogdGhp cyBzZWN0aW9uIG1heSBiZSByZW1vdmVkIG9uIHB1YmxpY2F0aW9uIGFzIGFuIA0KICAgUkZDLiAN CiAgICANCjExLiBSZWZlcmVuY2VzIA0KIA0KMTEuMSANIE5vcm1hdGl2ZSBSZWZlcmVuY2VzIA0K ICAgIA0KICAgW1JGQzA3OTNdICAgUG9zdGVsLCBKLiwgIlRyYW5zbWlzc2lvbiBDb250cm9sIFBy b3RvY29sIiwgU1REIDcsIA0KICAgICAgICAgICAgICAgUkZDIDc5MywgU2VwdGVtYmVyIDE5ODEu IA0KICAgIA0KICAgW1JGQzExOTVdICAgQ2FsbG9uLCBSLiwgIlVzZSBvZiBPU0kgSVMtSVMgZm9y IHJvdXRpbmcgaW4gVENQL0lQIGFuZCANCiAgICAgICAgICAgICAgIGR1YWwgZW52aXJvbm1lbnRz IiwgUkZDIDExOTUsIERlY2VtYmVyIDE5OTAuIA0KICAgIA0KICAgW1JGQzIxMTldICAgQnJhZG5l ciwgUy4sICJLZXkgd29yZHMgZm9yIHVzZSBpbiBSRkNzIHRvIEluZGljYXRlIA0KICAgICAgICAg ICAgICAgUmVxdWlyZW1lbnQgTGV2ZWxzIiwgQkNQIDE0LCBSRkMgMjExOSwgTWFyY2ggMTk5Ny4g DQoMTWFucmFsLCBldC4gYWwuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgW1BhZ2UgMTRdIA0KDEludGVybmV0LURyYWZ0ICAgICAgUm91dGluZyBQcm90b2Nv bCBQcm90ZWN0aW9uIElzc3VlcyAgICAgIE9jdG9iZXIgMjAwOSANCiANCiANCiAgICANCiAgIFtS RkMyMzI4XSAgIE1veSwgSi4sICJPU1BGIFZlcnNpb24gMiIsIFNURCA1NCwgUkZDIDIzMjgsIEFw cmlsIDE5OTguIA0KICAgIA0KICAgW1JGQzIzODVdICAgSGVmZmVybmFuLCBBLiwgIlByb3RlY3Rp b24gb2YgQkdQIFNlc3Npb25zIHZpYSB0aGUgVENQICANCiAgICAgICAgICAgICAgIE1ENSBTaWdu YXR1cmUgT3B0aW9uIiwgUkZDIDIzODUsIEF1Z3VzdCAxOTk4LiANCiAgICANCiAgIFtSRkMyNDUz XSAgIE1hbGtpbiwgRy4sICJSSVAgVmVyc2lvbiAyIiwgUkZDIDI0NTMsIE5vdmVtYmVyIDE5OTgg DQogICAgDQogICBbUkZDNTM0MF0gICBDb2x0dW4sIFIuLCBGZXJndXNvbiwgRC4sIE1veSwgSi4s IGFuZCBMaW5kZW0sIEEuLCAiT1NQRiAgDQogICAgICAgICAgICAgICBmb3IgSVB2NiIsIFJGQyA1 MzQwLCBKdWx5IDIwMDguIA0KICAgIA0KICAgW1JGQzUzMDRdICAgTGksIFQuIGFuZCBBdGtpbnNv biwgUi4sICJJbnRlcm1lZGlhdGUgU3lzdGVtIHRvIA0KICAgICAgICAgICAgICAgSW50ZXJtZWRp YXRlIFN5c3RlbSAoSVMtSVMpIENyeXB0b2dyYXBoaWMgIA0KICAgICAgICAgICAgICAgQXV0aGVu dGljYXRpb24iLCBSRkMgNTMwNCwgT2N0b2JlciAyMDA4LiANCiAgICANCiAgIFtSRkM1MzEwXSAg IEJoYXRpYSwgTS4sIGV0LiBhbC4sICJJUy1JUyBHZW5lcmljIENyeXB0b2dyYXBoaWMgDQogICAg ICAgICAgICAgICBBdXRoZW50aWNhdGlvbiIsIFJGQyA1MzEwLCBGZWJydWFyeSAyMDA5IA0KICAg IA0KICAgW1JGQzQyNzFdICAgUmVraHRlciAsIFkuLCBMaSwgVC4sIGFuZCBTLiBIYXJlcywgIkEg Qm9yZGVyIEdhdGV3YXkgDQogICAgICAgICAgICAgICBQcm90b2NvbCA0IChCR1AtNCkiLCBSRkMg NDI3MSwgSmFudWFyeSAyMDA2LiANCiAgICANCiAgIFtSRkM0MzAyXSAgIEtlbnQsIFMuLCAiSVAg QXV0aGVudGljYXRpb24gSGVhZGVyIiwgDQogICAgICAgICAgICAgICBSRkMgNDMwMiwgRGVjZW1i ZXIgMjAwNS4gDQogICAgDQogICBbUkZDNDMwM10gICBLZW50LCBTLiwgIklQIEVuY2Fwc3VsYXRp bmcgU2VjdXJpdHkgUGF5bG9hZCAoRVNQKSIsIA0KICAgICAgICAgICAgICAgUkZDIDQzMDMsIERl Y2VtYmVyIDIwMDUuIA0KICAgIA0KICAgW1JGQzQ1NTJdICAgR3VwdGEsIE0uIGFuZCBOLiBNZWxh bSwgIkF1dGhlbnRpY2F0aW9uL0NvbmZpZGVudGlhbGl0eSANCiAgICAgICAgICAgICAgIGZvciBP U1BGdjMiLCBSRkMgNDU1MiwgSmFudWFyeSAyMDA2IA0KICAgIA0KICAgW1JGQzQ4MjJdICAgUi4g QXRraW5zb24gYW5kIE0uIEZhbnRvLCAiUklQdjIgQ3J5cHRvZ3JhcGhpYyAgDQogICAgICAgICAg ICAgICBBdXRoZW50aWNhdGlvbiIsIFJGQyA0ODIyLCBGZWJydWFyeSAyMDA3IA0KICAgIA0KMTEu MiANIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMgDQogICAgDQogICBbUkZDMTA1OF0gICBIZWRyaWNr LCBDLiwgIlJvdXRpbmcgSW5mb3JtYXRpb24gUHJvdG9jb2wiLCBSRkMgMTA1OCwgDQogICAgICAg ICAgICAgICBKdW5lIDE5ODguIA0KICAgIA0KICAgW1JGQzEzMjFdICAgUml2ZXN0LCBSLiwgIlRo ZSBNRDUgTWVzc2FnZS1EaWdlc3QgQWxnb3JpdGhtIiwgUkZDICANCiAgICAgICAgICAgICAgIDEz MjEsIEFwcmlsIDE5OTIgDQogICAgDQogICBbUkZDMTM4OF0gICBNYWxraW4sIEcuLCAiUklQIFZl cnNpb24gMiBDYXJyeWluZyBBZGRpdGlvbmFsIA0KICAgICAgICAgICAgICAgSW5mb3JtYXRpb24i LCBSRkMgMTM4OCwgSmFudWFyeSAxOTkzLiANCiAgICANCiAgIFtSRkMxNzIzXSAgIE1hbGtpbiwg Ry4sICJSSVAgVmVyc2lvbiAyIC0gQ2FycnlpbmcgQWRkaXRpb25hbCANCiAgICAgICAgICAgICAg IEluZm9ybWF0aW9uIiwgU1REIDU2LCBSRkMgMTcyMywgTm92ZW1iZXIgMTk5NC4gDQogICBbUkZD MTkyM10gICBIYWxwZXJuLCBKLiBhbmQgQnJhZG5lciwgUy4sICJSSVB2MSBBcHBsaWNhYmlsaXR5 ICANCiAgICAgICAgICAgICAgIFN0YXRlbWVudCBmb3IgSGlzdG9yaWMgU3RhdHVzIiwgUkZDIDE5 MjMsIE1hcmNoIDE5OTYgDQogICAgDQogICBbUkZDMjA4Ml0gICBCYWtlciwgRi4gYW5kIEF0a2lu c29uLCBSLiwgIlJJUC0yIE1ENSAgDQogICAgICAgICAgICAgICBBdXRoZW50aWNhdGlvbiIsIFJG QyAyMDgyLCBKYW51YXJ5IDE5OTcgDQpNYW5yYWwsIGV0LiBhbC4gICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBbUGFnZSAxNV0gDQoMSW50ZXJuZXQtRHJhZnQg ICAgICBSb3V0aW5nIFByb3RvY29sIFByb3RlY3Rpb24gSXNzdWVzICAgICAgT2N0b2JlciAyMDA5 IA0KIA0KIA0KICAgIA0KICAgW1JGQzI0MTBdICAgS2VudCwgUy4gYW5kIEdsZW5uLCBSLiwgIlRo ZSBOVUxMIEVuY3J5cHRpb24gQWxnb3JpdGhtICANCiAgICAgICAgICAgICAgIGFuZCBJdHMgVXNl IFdpdGggSVBzZWMiLCBSRkMgMjQxMCwgTm92ZW1iZXIgMTk5OCANCiAgICANCiAgIFtSRkMzNTYy XSAgIExlZWNoLCBNLiwgIktleSBNYW5hZ2VtZW50IENvbnNpZGVyYXRpb25zIGZvciB0aGUgVENQ ICANCiAgICAgICAgICAgICAgIE1ENSBTaWduYXR1cmUgT3B0aW9uIiwgUkZDIDM1NjIsIEp1bHkg MjAwMy4gDQogICAgDQogICBbUkZDNDI3MF0gICBIb2ZmbWFuLCBQLiBhbmQgQi4gU2NobmVpZXIs ICJBdHRhY2tzIG9uIENyeXB0b2dyYXBoaWMgDQogICAgICAgICAgICAgICBIYXNoZXMgaW4gSW50 ZXJuZXQgUHJvdG9jb2xzIiwgUkZDIDQyNzAsIE5vdmVtYmVyIDIwMDUuIA0KICAgIA0KICAgW1JG QzQzMDZdICAgS2F1Zm1hbiwgQy4sICJUaGUgSW50ZXJuZXQgS2V5IEV4Y2hhbmdlIChJS0V2Mikg IA0KICAgICAgICAgICAgICAgUHJvdG9jb2wiLCBSRkMgNDMwNiwgRGVjZW1iZXIgMjAwNSANCiAg ICANCiAgIFtCR1AtQVRUQUNLXSAgQ29udmVyeSwgUy4gYW5kIE0uIEZyYW56LCAiQkdQIFZ1bG5l cmFiaWxpdHkgVGVzdGluZzogDQogICAgICAgICAgICAgICAgIFNlcGFyYXRpbmcgRmFjdCBmcm9t IEZVRCB2MS4wMCIsIEp1bmUgMjAwMy4gDQogICAgDQogICBbVENQLVdJTkRPV10gIFdhdHNvbiwg VC4sICJUQ1AgUmVzZXQgU3Bvb2ZpbmciLCBPY3RvYmVyIDIwMDMuIA0KICAgIA0KICAgW01ENS1B VFRBQ0tdICAgV2FuZywgWC4gZXQgYWwuLCAiQ29sbGlzaW9ucyBmb3IgSGFzaCBGdW5jdGlvbnMg TUQ0LCANCiAgICAgICAgICAgICAgICAgIE1ENSwgSEFWQUwtMTI4IGFuZCBSSVBFTUQiLCBBdWd1 c3QgMjAwNCwgICANCiAgICAgICAgICAgICAgICAgIGh0dHA6Ly9lcHJpbnQuaWFjci5vcmcvMjAw NC8xOTkgIA0KICAgICANCiAgIFtCRkQtQkFTRV0gIEthdHosIEQuIGFuZCBELiBXYXJkLCAiQmlk aXJlY3Rpb25hbCBGb3J3YXJkaW5nIA0KICAgICAgICAgICAgICAgRGV0ZWN0aW9uIiwgZHJhZnQt aWV0Zi1iZmQtYmFzZSwgQXVndXN0IDIwMDkgDQogICAgDQogICBbQkZELTFIT1BdICBLYXR6LCBE LiBhbmQgRC4gV2FyZCwgIkJGRCBmb3IgSVB2NCBhbmQgSVB2NiAoU2luZ2xlIA0KICAgICAgICAg ICAgICAgSG9wKSwgZHJhZnQtaWV0Zi1iZmQtdjR2Ni0xaG9wLCBBdWd1c3QgMjAwOSANCiANCiAg IFtCRkQtTVVMVEldIEthdHosIEQuIGFuZCBELiBXYXJkLCAiQkZEIGZvciBNdWx0aWhvcCBQYXRo cyIsICANCiAgICAgICAgICAgICAgIGRyYWZ0LWlldGYtYmZkLW11bHRpaG9wLCBBdWd1c3QgMjAw OSANCiANCiANCjEyLiBDb250cmlidXRvcidzIEFkZHJlc3MgDQogDQogICBTdWUgSGFyZXMgDQog ICBOZXh0SG9wIA0KICAgVVNBIA0KICAgRW1haWw6IHNoYXJlc0BuZXh0aG9wLmNvbSANCiANCjEz LiBBdXRob3IncyBBZGRyZXNzZXMgDQogDQogICBWaXNod2FzIE1hbnJhbCAgDQogICBJUCBJbmZ1 c2lvbiAgDQogICBBbG1vcmEsIFV0dGFyYWtoYW5kIA0KICAgSW5kaWEgIA0KICAgRW1haWw6IHZp c2h3YXNAaXBpbmZ1c2lvbi5jb20gIA0KICAgIA0KICAgTWFuYXYgQmhhdGlhICANCiAgIEFsY2F0 ZWwtTHVjZW50IA0KICAgQmFuZ2Fsb3JlLCBJbmRpYSAgDQogICBFbWFpbDogbWFuYXZAYWxjYXRl bC1sdWNlbnQuY29tICANCk1hbnJhbCwgZXQuIGFsLiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIFtQYWdlIDE2XSANCgxJbnRlcm5ldC1EcmFmdCAgICAgIFJv dXRpbmcgUHJvdG9jb2wgUHJvdGVjdGlvbiBJc3N1ZXMgICAgICBPY3RvYmVyIDIwMDkgDQogDQog DQogICAgDQogICBKb2VsIFAuIEphZWdnbGkgDQogICBDaGVjayBQb2ludCBTb2Z0d2FyZSAgDQog ICBFbWFpbDogamphZWdnbGlAY2hlY2twb2ludC5jb20gDQogICAgDQogICBSdXNzIFdoaXRlIA0K ICAgQ2lzY28gU3lzdGVtcyANCiAgIFJUUCBOb3J0aCBDYXJvbGluYSAgDQogICBVU0EgDQogICBF bWFpbDogcml3QGNpc2NvLmNvbSANCiAgICANCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KTWFucmFs LCBldC4gYWwuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg W1BhZ2UgMTddIA0KDA== --00c09fa217a75f02d1047708553a-- From ietf@hardjono.net Thu Oct 29 13:13:33 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DE81B3A69A1 for ; Thu, 29 Oct 2009 13:13:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.265 X-Spam-Level: X-Spam-Status: No, score=-2.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FW8Taqke-BTw for ; Thu, 29 Oct 2009 13:13:33 -0700 (PDT) Received: from outbound-mail-311.bluehost.com (outbound-mail-311.bluehost.com [67.222.54.4]) by core3.amsl.com (Postfix) with SMTP id 0B8893A694A for ; Thu, 29 Oct 2009 13:13:33 -0700 (PDT) Received: (qmail 5446 invoked by uid 0); 29 Oct 2009 20:13:49 -0000 Received: from unknown (HELO box251.bluehost.com) (69.89.31.51) by outboundproxy6.bluehost.com with SMTP; 29 Oct 2009 20:13:49 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=hardjono.net; h=Received:From:To:Cc:References:In-Reply-To:Subject:Date:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:thread-index:Content-Language:X-Identified-User; b=Ye78ckaOIhenmagG40qLm7c4crynmNPD8GU0d3vzQeUEGfGBz8TiVvjj7WYO4S1EHkY99Ez4EyDmC4uLZZRrN9ACFew7MXCDkjWCHBVf7uXd3JVMEvuHsR+Kh82S/IB6; Received: from dhcp-18-111-94-234.dyn.mit.edu ([18.111.94.234] helo=thomasvnf1ekrv) by box251.bluehost.com with esmtpsa (TLSv1:RC4-MD5:128) (Exim 4.69) (envelope-from ) id 1N3bNU-0001zO-Of; Thu, 29 Oct 2009 14:13:49 -0600 From: "Thomas Hardjono" To: "'Brian Weis'" References: <4A6923C1.9080609@cse.concordia.ca> <4ae79caa.9513f30a.454d.1582@mx.google.com> <20091027213539.efls0s3pi00kcw0w@mail.encs.concordia.ca> <002101ca57df$790dc6f0$6b2954d0$@net> In-Reply-To: Date: Thu, 29 Oct 2009 16:13:36 -0400 Message-ID: <009001ca58d4$50b09020$f211b060$@net> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 thread-index: AcpX+Pu24saPqVvWSAmUrxh7LokwIgA2YXEA Content-Language: en-us X-Identified-User: {727:box251.bluehost.com:hardjono:hardjono.net} {sentby:smtp auth 18.111.94.234 authed with ietf+hardjono.net} Cc: karp@ietf.org Subject: Re: [karp] [kmart] Automated Key Management for Router Updates X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2009 20:13:34 -0000 Hi Brian, Comments inline. > -----Original Message----- > From: Brian Weis [mailto:bew@cisco.com] > Sent: Wednesday, October 28, 2009 2:04 PM > To: Thomas Hardjono > Cc: 'William Atwood'; 'Gregory M. Lebovitz'; karp@ietf.org > Subject: Re: [karp] [kmart] Automated Key Management for Router Updates > > Hi Thomas, > > On Oct 28, 2009, at 8:00 AM, Thomas Hardjono wrote: > > > Bill, folks, > > > > I read through the paper -- interesting use of GDOI. > > > > I'm kind of thinking that the KARP problem has multiple faces/phases > > (similar if not identical to the NIST 800-57 lifecycle): > > > > (a) Initialization phase, where all the entities (routers) somehow > > obtains > > the relevant keying material. > > > > (b) Operational phases, where the routers use or exercise the keys. > > > > (c) Maintenance phase, where security maintenance is performed (eg. > > backup > > of keys, migration to new router, re-initialization, etc. etc). > > > > (d) Decommissioning phase, where routers are taken off the network > > in a > > graceful (and secure) way, and their keys logged elsewhere (for legal > > purposes) and then nuked. > > That's a good overview of life cycle key management, and it might be a > good topic for the OPSEC WG. > > > > > Many IT folks in medium to large Enterprises dislike having to > > install and > > operate yet another management console (for another part or aspect > > of their > > network and IT). So it would a good design goal for the KARP WG to > > allow the > > resulting KARP protocol to be "integrate-able" to existing network > > management consoles (read products) that implement device-management > > protocols (eg. WS-Man, DMTF DASH/MASH, etc etc). Some of these > > existing > > protocols could be used for one or more of the phases above. > > > > For key management specifically, perhaps the KARP WG could look at > > re-using > > the Oasis KMIP work (Key Management Interoperability Protocol). > > Something > > like a router-specific profile could be created. The KMIT spec already > > support a number of key formats (packing format), as well as transport > > methods. > > Thanks for pointing out this work. A KARP WG (should it be formed) > could consider the KMIP key when it begins work on automated key > management. However, specifying the use of (or changes to) protocols > developed outside of the IETF might be an issue. I'd welcome further > thoughts on this once a WG is formed and thinking about automated key > management. > > Thanks, > Brian > Hi Brian, I believe the IETF already has a Liaison agreement with Oasis. The IP rules of both orgs are very similar. The IEEE 1619.3 folks plan to produce a *profile* of KMIP specifically for storage devices (e.g. storage controllers that have crypto). A "profile" in Oasis language means a narrow-down and selection of various available options. So the 1619.3 folks would be working in their own world and doing their own approving of the resulting profile. KARP could also adopt the same approach, preventing re-invention and allowing interoperability of devices. Thus, if an Enterprise has a key back-up service/server, it could received backup-blobs from storage devices, routers, app servers and even clients (ie. agnostic to source of keys). I think a number of vendors already have products that have some degree of compatibility with KMIP. So its not just a spec, but actual product. Just a thought. cheers, /thomas/ From gregory.ietf@gmail.com Thu Oct 29 18:42:44 2009 Return-Path: X-Original-To: karp@core3.amsl.com Delivered-To: karp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF2543A6950 for ; Thu, 29 Oct 2009 18:42:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.456 X-Spam-Level: X-Spam-Status: No, score=-2.456 tagged_above=-999 required=5 tests=[AWL=0.142, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5edm8W79IvaS for ; Thu, 29 Oct 2009 18:42:43 -0700 (PDT) Received: from mail-yw0-f183.google.com (mail-yw0-f183.google.com [209.85.211.183]) by core3.amsl.com (Postfix) with ESMTP id 4E2AE3A686A for ; Thu, 29 Oct 2009 18:42:43 -0700 (PDT) Received: by ywh13 with SMTP id 13so2587371ywh.29 for ; Thu, 29 Oct 2009 18:42:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:x-mailer:date:to :from:subject:cc:mime-version:content-type; bh=GAngVjBiMaEO0/F1lKJGLL9IJHbyD5zBfKKWNE3LB20=; b=ewfK8+rwRNFP5Ezg+qMBEfka7Qs2aDk1LaTk/UujaN7AlJDAbnQnSN+cQdh7cGXIw/ 0zrigWcwVtctWF7XC1AR9VpTkl/Kxeo2LM4CzWdqABzccTs5rn9Ph8puzxE543koI4Gz zrBs7bwvdR1Ia8bo/g6HOO3+N4aaUtgc8ro14= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:x-mailer:date:to:from:subject:cc:mime-version :content-type; b=qWv5npuJ44EBnHz7t5/tzaN9B1ipm9OYon74UZN5YQVGwiPDlnIC05LnEq0mONAi+A SayAQufxwyToyFEIWfYpKD+W1gsE1yDyIVkdq959TpBNCBaLhHRx3DZ2DJfFm7WZjBax NBIxbUDI8Kt7fq8IJd+NK8Fg6+crPyAc+KEpE= Received: by 10.150.19.5 with SMTP id 5mr1751229ybs.103.1256866976065; Thu, 29 Oct 2009 18:42:56 -0700 (PDT) Received: from Gregory-T60.gmail.com (nat-service4.juniper.net [66.129.225.151]) by mx.google.com with ESMTPS id 23sm937505ywh.3.2009.10.29.18.42.54 (version=SSLv3 cipher=RC4-MD5); Thu, 29 Oct 2009 18:42:55 -0700 (PDT) Message-ID: <4aea449f.1708c00a.6e64.6fae@mx.google.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Thu, 29 Oct 2009 18:42:48 -0700 To: Brian Weis ,"Joel M. Halpern" From: "Gregory M. Lebovitz" Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=====================_253063437==.ALT" Cc: karp@ietf.org Subject: [karp] s/kmart/karp on BoF page X-BeenThere: karp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for key management for routing and transport protocols List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Oct 2009 01:42:44 -0000 --=====================_253063437==.ALT Content-Type: text/plain; charset="us-ascii"; format=flowed Chairs, The BoF page for IETF76 (http://trac.tools.ietf.org/bof/trac/wiki/BifIETF76 ) currently uses "KMART" and lists the kmart@ietf.org mail list. Perhaps we should s/kmart/karp on this? We may also want to link to the most recent charter update on the list. Hope it helps, Gregory +++++++++++++++++++++++ IETF-related email from Gregory M. Lebovitz Juniper Networks g r e go r y d o t i e tf a t g m a i l do t c o m --=====================_253063437==.ALT Content-Type: text/html; charset="us-ascii" Chairs,
The BoF page for IETF76 ( http://trac.tools.ietf.org/bof/trac/wiki/BifIETF76 ) currently uses "KMART" and lists the kmart@ietf.org mail list. Perhaps we should s/kmart/karp on this?

We may also want to link to the most recent charter update on the list.

Hope it helps,
Gregory

+++++++++++++++++++++++
IETF-related email from
Gregory M. Lebovitz
Juniper Networks
g r e go r  y d o t  i e tf a t  g m a i l  do t c o  m --=====================_253063437==.ALT--