From kitten-bounces@ietf.org Wed Dec 1 01:05:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA05673; Wed, 1 Dec 2004 01:05:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZNh5-0007Qr-6j; Wed, 01 Dec 2004 01:10:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZNSA-0004yE-AS; Wed, 01 Dec 2004 00:55:02 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZNMU-0003HJ-28 for kitten@megatron.ietf.org; Wed, 01 Dec 2004 00:49:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA04835 for ; Wed, 1 Dec 2004 00:49:06 -0500 (EST) Received: from serrano.cc.columbia.edu ([128.59.206.20] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZNRh-00079I-3N for kitten@ietf.org; Wed, 01 Dec 2004 00:54:36 -0500 Received: from [192.168.1.10] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by serrano.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iB15n3ZU014411 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Wed, 1 Dec 2004 00:49:03 -0500 (EST) Message-ID: <41AD5B9C.3090002@columbia.edu> Date: Wed, 01 Dec 2004 00:50:20 -0500 From: Jeffrey Altman Organization: Mass User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org References: In-Reply-To: X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.20 X-Spam-Score: 0.0 (/) X-Scan-Signature: 2ed806e2f53ff1a061ad4f97e00345ac Subject: Re: Spnego and interoperability--Running code X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0015085035==" Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 21be852dc93f0971708678c18d38c096 This is a cryptographically signed message in MIME format. --===============0015085035== Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms020502040502080004060209" This is a cryptographically signed message in MIME format. --------------ms020502040502080004060209 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Speaking as chair, I believe that this is a rationale argument in favor of the changes made to RFC 2478. I believe that this argument should be summarized and included in "Appendix B" of the document. I would appreciate it if someone could post such text for consideration. Jeffrey Altman Sam Hartman wrote: > Especially in working groups where I'm fairly active as an individual > contributor, I'l try and explicitly lable when I'm speaking as area > director. I'll also generally label when I'm speaking as an > individual, but if there is doubt I'm probably speaking as an > individual. This message is definitely my individual opinion. I'm > hoping to try and explain why the interoperability approach we're > adopting in the new SPNEGO protocol is correct. > > Martin brought up a good point in the SPNEGO discussion. Roughly as I > understand it, he is concerned that we're catering to the Microsoft > implementation rather than what RFC 2478 says. > > An implementation that conforms to Larry's draft will not interoperate > with a strict 2748 implementation. Even if the new implementation > always sends a MIC, it will still fail to interop. If it is a server, > it will fail because it requests a MIC using an option that older > implementations simply do not support. I believe clients will tend to > fail too. > > This is not ideal. I'm going to try and justify why I believe this is > the right course of action for the IETF. > > The IETf is about producing a working Internet--running code is at the > core of our mission statement. We write specs for two reasons. > First, without having a written document to discuss, we find it hard > to judge rough consensus. Second, we have found that clear > specifications are the best way to get running code. > > As a practical matter, the SPNEGO implementers within the IETF have > valued interoperability with the Microsoft implementation. > > SPNEGO is at proposed standard; it is reasonable for us to modify or > withdraw the specification based on implementation experience. It's > unfortunate that it has been sitting at proposed standard so long, but > that's where we are. martin made an argument that the base GSS-API > and C bindings spec are actually more mature than their standars level > indicates. I agree with that argument but do not think it applies for > SPNEGO. For one thing, the spec is critically flawed in that it > doesn't tell you what encoding to use. Tom indicated that there are > at least three possible encodings; discussion on the list suggested > that the choice of encoding is rather arbitrary. Even if there are > RFC 2478 implementations out there, they may end up not interoperating > with themselves because of this defect in the spec. > > Martin proposed that we document correct behavior and include an > appendix on how to interoperate with existing incorrect > implementations. In principle that seems like a fine idea. However > without changing what correct behavior is somewhat, there is no way to > be secure and to interoperate with existing implementations. If we > are willing to adopt Larry's approach, we get security between new > implementations all the time while maintaining interoperability with > the implementations we have within the IETF community. > > In my mind this is the best of the available bad solutions. > > --Sam > > > _______________________________________________ > Kitten mailing list > Kitten@lists.ietf.org > https://www1.ietf.org/mailman/listinfo/kitten --------------ms020502040502080004060209 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJPzCC AvowggJjoAMCAQICAwxk8TANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UE ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNv bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDQwNTI3MTc1ODU4WhcNMDUwNTI3MTc1ODU4 WjBrMQ8wDQYDVQQEEwZBbHRtYW4xFTATBgNVBCoTDEplZmZyZXkgRXJpYzEcMBoGA1UEAxMT SmVmZnJleSBFcmljIEFsdG1hbjEjMCEGCSqGSIb3DQEJARYUamFsdG1hbkBjb2x1bWJpYS5l ZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc3JqO5AsZrozd+mJ2mPuCTYo2 +nJ9Qq6jtUYtp7YTMW4d2Q6GLhNaHb1l9m74SxuY4f5vP6JtZjr6p9+LCCxD0w0NVLKRgUDp z+tKFitbkJe9BSCxCURRvY3vdWA71gSCUvZAN3346hHb4oGVqgdpmfFJXYAHWpC46wiL72N9 WxySzY17/0eU0c8+r9dNoLpPQeL43O66O80jCl1qnXMaXaakZPsfm+5W90MYXhpQ1WIQpv02 lBn3BH5YE8xwbsNrw5AF4v7pjMuW85GI6FrDmfbpJX473Rpl5rmv3TpXkJ+7UsIIO1puyS8r 1o7kjDZ5EUYJxxglTGR6XL/RNzqHAgMBAAGjMTAvMB8GA1UdEQQYMBaBFGphbHRtYW5AY29s dW1iaWEuZWR1MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAZYeVFCMP0iV+UVa0 eFoXkzMVl61CNAVY2YQ9/QQazO3G4qNiif35ArrnjPRDRj5M7WTeOCFqPVuvCttyJRiDKsEe L4Yah22mRA3mR7x52j2FquPYZ9qCr1IhrNGzsMk+gopX5G0fTHZb6+uDu5SeMPNNcIznGA7M CMpXAJ2PcKgwggL6MIICY6ADAgECAgMMZPEwDQYJKoZIhvcNAQEEBQAwYjELMAkGA1UEBhMC WkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1Ro YXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA0MDUyNzE3NTg1OFoXDTA1 MDUyNzE3NTg1OFowazEPMA0GA1UEBBMGQWx0bWFuMRUwEwYDVQQqEwxKZWZmcmV5IEVyaWMx HDAaBgNVBAMTE0plZmZyZXkgRXJpYyBBbHRtYW4xIzAhBgkqhkiG9w0BCQEWFGphbHRtYW5A Y29sdW1iaWEuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3NyajuQLGa6M 3fpidpj7gk2KNvpyfUKuo7VGLae2EzFuHdkOhi4TWh29ZfZu+EsbmOH+bz+ibWY6+qffiwgs Q9MNDVSykYFA6c/rShYrW5CXvQUgsQlEUb2N73VgO9YEglL2QDd9+OoR2+KBlaoHaZnxSV2A B1qQuOsIi+9jfVscks2Ne/9HlNHPPq/XTaC6T0Hi+NzuujvNIwpdap1zGl2mpGT7H5vuVvdD GF4aUNViEKb9NpQZ9wR+WBPMcG7Da8OQBeL+6YzLlvORiOhaw5n26SV+O90aZea5r906V5Cf u1LCCDtabskvK9aO5Iw2eRFGCccYJUxkely/0Tc6hwIDAQABozEwLzAfBgNVHREEGDAWgRRq YWx0bWFuQGNvbHVtYmlhLmVkdTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBAGWH lRQjD9IlflFWtHhaF5MzFZetQjQFWNmEPf0EGsztxuKjYon9+QK654z0Q0Y+TO1k3jghaj1b rwrbciUYgyrBHi+GGodtpkQN5ke8edo9harj2Gfagq9SIazRs7DJPoKKV+RtH0x2W+vrg7uU njDzTXCM5xgOzAjKVwCdj3CoMIIDPzCCAqigAwIBAgIBDTANBgkqhkiG9w0BAQUFADCB0TEL MAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3du MRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENB MSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTAzMDcx NzAwMDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0 ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVl bWFpbCBJc3N1aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEpjxVc1X7TrnK mVoeaMB1BHCd3+n/ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuFWqo/ cVbLrzwLB+fxH5E2JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8 YQRAHmQZcmC3+wIDAQABo4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4 oDagNIYyaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS5j cmwwCwYDVR0PBAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwy LTEzODANBgkqhkiG9w0BAQUFAAOBgQBIjNFQg+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4 Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZfoSxmRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowg T2Vfldr394fWxghOrvbqNOUQGls1TXfjViF4gtwhGTXeJLHTHUb/XV9lTzGCAzswggM3AgEB MGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0 ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMMZPEw CQYFKw4DAhoFAKCCAacwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUx DxcNMDQxMjAxMDU1MDIwWjAjBgkqhkiG9w0BCQQxFgQUoJkFPPPKOSMKuBf35hhrBFMDCjUw UgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcN AwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgweAYJKwYBBAGCNxAEMWswaTBiMQswCQYD VQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAwxk8TB6BgsqhkiG9w0B CRACCzFroGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB AgMMZPEwDQYJKoZIhvcNAQEBBQAEggEAPBkjB8uyJuYSS9iXHGX7VRES6KqLK3IWvZLiMxAA az7hEBgX92RCTY10EUf7VXmoth6p5o5FHc5/Z5h29+64usAng1NhF6T1feCN2yYUMa5xw5sQ NxBo1y3yt1vZzzP3+ajrOKHQ0nnsUy+Y8h4Msgv6djDzrGaaZqP3mcc8Y+GGf0ucSHeGNQDh Eo7B5tn+LTWJxJQmcSfZitJw6imkBiybbzilmXfh94oZJ0vbpJI9O4Qgtd+bMvC3XXfpdDw4 iUL0kIASTQTgR6UXtjoNBRL2EJYiNepKaSzll9U++gQ9G1sNYpt3dG4cvNIsqy1U9+xNZnzo M2e83EzHLPApeAAAAAAAAA== --------------ms020502040502080004060209-- --===============0015085035== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --===============0015085035==-- From mailman-bounces@ietf.org Wed Dec 1 06:00:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA12821 for ; Wed, 1 Dec 2004 06:00:16 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZSIt-0005PN-2R for kitten-archive@ietf.org; Wed, 01 Dec 2004 06:05:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZRhm-0006rL-VH for kitten-archive@ietf.org; Wed, 01 Dec 2004 05:27:27 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: lists.ietf.org mailing list memberships reminder From: mailman-owner@ietf.org To: kitten-archive@ietf.org X-No-Archive: yes Message-ID: Date: Wed, 01 Dec 2004 05:05:56 -0500 Precedence: bulk X-BeenThere: mailman@lists.ietf.org X-Mailman-Version: 2.1.5 List-Id: Mailman site list X-List-Administrivia: yes Sender: mailman-bounces@ietf.org Errors-To: mailman-bounces@ietf.org X-Spam-Score: 0.3 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Content-Transfer-Encoding: 7bit This is a reminder, sent out once a month, about your lists.ietf.org mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list. You can visit the URLs to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. In addition to the URL interfaces, you can also use email to make such changes. For more info, send a message to the '-request' address of the list (for example, mailman-request@lists.ietf.org) containing just the word 'help' in the message body, and an email message will be sent to you with instructions. ********************************************************************** NOTE WELL: Any submission to the IETF intended by the Contributor for publication as all or part of an IETF Internet-Draft or RFC and any statement made within the context of an IETF activity is considered an "IETF Contribution". Such statements include oral statements in IETF sessions, as well as written and electronic communications made at any time or place, which are addressed to: o the IETF plenary session, o any IETF working group or portion thereof, o the IESG, or any member thereof on behalf of the IESG, o the IAB or any member thereof on behalf of the IAB, o any IETF mailing list, including the IETF list itself, any working group or design team list, or any other list functioning under IETF auspices, o the RFC Editor or the Internet-Drafts function All IETF Contributions are subject to the rules of RFC 3667 and RFC 3668. Statements made outside of an IETF session, mailing list or other function, that are clearly not intended to be input to an IETF activity, group or function, are not IETF Contributions in the context of this notice. Please consult RFC 3667 for details. ******************************************************************************* If you have questions, problems, comments, etc, send them to mailman-owner@lists.ietf.org. Thanks! Passwords for kitten-archive@ietf.org: List Password // URL ---- -------- kitten@lists.ietf.org boikur https://www1.ietf.org/mailman/options/kitten/kitten-archive%40ietf.org From kitten-bounces@ietf.org Wed Dec 1 16:48:36 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29630; Wed, 1 Dec 2004 16:48:36 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZcQN-0005gx-B7; Wed, 01 Dec 2004 16:54:12 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZbgg-0004Wy-T8; Wed, 01 Dec 2004 16:06:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZbI8-00053T-Km for kitten@megatron.ietf.org; Wed, 01 Dec 2004 15:41:36 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA21889 for ; Wed, 1 Dec 2004 15:41:33 -0500 (EST) Received: from minbar.fac.cs.cmu.edu ([128.2.185.161]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CZbNV-0003EG-UJ for kitten@ietf.org; Wed, 01 Dec 2004 15:47:11 -0500 Received: from minbar.fac.cs.cmu.edu ([127.0.0.1]) by minbar.fac.cs.cmu.edu id aa08049; 1 Dec 2004 15:41 EST Date: Wed, 01 Dec 2004 15:40:55 -0500 From: Jeffrey Hutzelman To: Sam Hartman , kitten@ietf.org Message-ID: <48320000.1101933655@minbar.fac.cs.cmu.edu> In-Reply-To: References: X-Mailer: Mulberry/3.0.3 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Content-Transfer-Encoding: 7bit Subject: Re: Spnego and interoperability--Running code X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Content-Transfer-Encoding: 7bit On Tuesday, November 30, 2004 22:14:15 -0500 Sam Hartman wrote: > Martin brought up a good point in the SPNEGO discussion. Roughly as I > understand it, he is concerned that we're catering to the Microsoft > implementation rather than what RFC 2478 says. This is really very similar to what we just did with Kerberos: - There is an existing specification which is vague and underspecified. - There is a widely-deployed reference implementation which disagrees with the existing specification in several ways. - The reference implemenation was developed prior to or in parallel with the existing specification. - It is impossible to both comply with the existing specification and interoperate with the reference implementation. - There are multiple existing implementations which do interoperate with the reference implementation and with each other. In the case of Kerberos, it turns out to be difficult-to-impossible to interoperate with both the reference implementation and a strictly conformant one. In this situation, we chose to update and correct the specification to reflect the behavior of the reference implementation and others that interoperate with it, even though we knew of the existence of strictly-RFC1510-conformant implementations (deployed mostly on private networks). Interoperability with existing implementations won out over 100% compatibility with a broken specification which was not widely deployed on the public Internet. This was the correct course of action for Kerberos, and I believe it is the correct course of action for SPNEGO. -- Jeff _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 1 17:53:37 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05591; Wed, 1 Dec 2004 17:53:37 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZdRJ-0007Xt-UR; Wed, 01 Dec 2004 17:59:15 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZcSu-0005XY-FF; Wed, 01 Dec 2004 16:56:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZbmY-0000ZZ-Ma for kitten@megatron.ietf.org; Wed, 01 Dec 2004 16:13:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA24940 for ; Wed, 1 Dec 2004 16:13:01 -0500 (EST) Received: from mail2.microsoft.com ([131.107.3.124]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZbrw-0004WG-QU for kitten@ietf.org; Wed, 01 Dec 2004 16:18:37 -0500 Received: from mailout2.microsoft.com ([157.54.1.120]) by mail2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 1 Dec 2004 13:12:30 -0800 Received: from red-hub-02.redmond.corp.microsoft.com ([157.54.7.100]) by mailout2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 1 Dec 2004 13:12:29 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-02.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 1 Dec 2004 13:12:29 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Wed, 1 Dec 2004 13:12:29 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Wed, 1 Dec 2004 13:12:28 -0800 Message-ID: Thread-Topic: Spnego and interoperability--Running code thread-index: AcTXa7uk4xqDYUHeR1Sv+lzqkoGYQgAfojGA From: "Liqiang\(Larry\) Zhu" To: "Jeffrey Altman" , X-OriginalArrivalTime: 01 Dec 2004 21:12:29.0275 (UTC) FILETIME=[770B12B0:01C4D7EA] X-Spam-Score: 0.0 (/) X-Scan-Signature: 2086112c730e13d5955355df27e3074b Content-Transfer-Encoding: quoted-printable Subject: RE: Spnego and interoperability--Running code X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 22bbb45ef41b733eb2d03ee71ece8243 Content-Transfer-Encoding: quoted-printable Here is the proposed text to be appended to appendix B. -------------------------------------------------------------------- An implementation that conforms to this specification will not interoperate with a strict 2748 implementation. Even if the new implementation always sends a mechlistMIC token, it will still fail to interoperate. If it is a server, it will fail because it requests a mechlistMIC token using an option that older implementations simply do not support. Clients will tend to fail as well. As an alternative to the approach chosen in this specification, we could have documented a correct behavior that is fully backward compatible with RFC 2478 and included an appendix on how to interoperate with existing incorrect implementations of RFC 2478. As a practical matter, the SPNEGO implementers within the IETF have valued interoperability with the Microsoft implementations. We were unable to choose to maintain reasonable security guarantees, maintain interoperability with the Microsoft implementations and maintain interoperability with correct implementations of RFC 2478. The working group was not aware of any RFC 2478 implementations. Even if there are RFC 2478 implementations, it is unlikely that they will interoperate because of a critical flaw in the description of the encoding of the mechanism list in RFC 2478. With the approach taken in this specification, we get security between new implementations all the time while maintaining interoperability with the implementations we have within the IETF community. The working group believes that this justifies breaking compatibility with a correct implementation of RFC 2478.=20 ----------------------------------------------------------------- -- Larry -----Original Message----- From: kitten-bounces@lists.ietf.org [mailto:kitten-bounces@lists.ietf.org] On Behalf Of Jeffrey Altman Sent: Tuesday, November 30, 2004 9:50 PM To: kitten@ietf.org Subject: Re: Spnego and interoperability--Running code Speaking as chair, I believe that this is a rationale argument in favor of the changes made to RFC 2478. I believe that this argument should be summarized and included in "Appendix B" of the document. I would appreciate it if someone could post such text for consideration. Jeffrey Altman Sam Hartman wrote: > Especially in working groups where I'm fairly active as an individual=20 > contributor, I'l try and explicitly lable when I'm speaking as area=20 > director. I'll also generally label when I'm speaking as an=20 > individual, but if there is doubt I'm probably speaking as an=20 > individual. This message is definitely my individual opinion. I'm=20 > hoping to try and explain why the interoperability approach we're=20 > adopting in the new SPNEGO protocol is correct. >=20 > Martin brought up a good point in the SPNEGO discussion. Roughly as I > understand it, he is concerned that we're catering to the Microsoft=20 > implementation rather than what RFC 2478 says. >=20 > An implementation that conforms to Larry's draft will not interoperate > with a strict 2748 implementation. Even if the new implementation=20 > always sends a MIC, it will still fail to interop. If it is a server, > it will fail because it requests a MIC using an option that older=20 > implementations simply do not support. I believe clients will tend to > fail too. >=20 > This is not ideal. I'm going to try and justify why I believe this is > the right course of action for the IETF. >=20 > The IETf is about producing a working Internet--running code is at the > core of our mission statement. We write specs for two reasons. > First, without having a written document to discuss, we find it hard=20 > to judge rough consensus. Second, we have found that clear=20 > specifications are the best way to get running code. >=20 > As a practical matter, the SPNEGO implementers within the IETF have=20 > valued interoperability with the Microsoft implementation. >=20 > SPNEGO is at proposed standard; it is reasonable for us to modify or=20 > withdraw the specification based on implementation experience. It's=20 > unfortunate that it has been sitting at proposed standard so long, but > that's where we are. martin made an argument that the base GSS-API=20 > and C bindings spec are actually more mature than their standars level > indicates. I agree with that argument but do not think it applies for > SPNEGO. For one thing, the spec is critically flawed in that it=20 > doesn't tell you what encoding to use. Tom indicated that there are=20 > at least three possible encodings; discussion on the list suggested=20 > that the choice of encoding is rather arbitrary. Even if there are=20 > RFC 2478 implementations out there, they may end up not interoperating > with themselves because of this defect in the spec. >=20 > Martin proposed that we document correct behavior and include an=20 > appendix on how to interoperate with existing incorrect=20 > implementations. In principle that seems like a fine idea. However=20 > without changing what correct behavior is somewhat, there is no way to > be secure and to interoperate with existing implementations. If we=20 > are willing to adopt Larry's approach, we get security between new=20 > implementations all the time while maintaining interoperability with=20 > the implementations we have within the IETF community. >=20 > In my mind this is the best of the available bad solutions. >=20 > --Sam >=20 >=20 > _______________________________________________ > Kitten mailing list > Kitten@lists.ietf.org > https://www1.ietf.org/mailman/listinfo/kitten _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 1 18:11:20 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07686; Wed, 1 Dec 2004 18:11:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZdiT-00086x-37; Wed, 01 Dec 2004 18:16:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZdTO-0003OW-Mm; Wed, 01 Dec 2004 18:01:22 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZcbR-0001XM-0H for kitten@megatron.ietf.org; Wed, 01 Dec 2004 17:05:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02150 for ; Wed, 1 Dec 2004 17:05:35 -0500 (EST) Received: from jalapeno.cc.columbia.edu ([128.59.206.19] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZcgp-0006Qr-Ps for kitten@ietf.org; Wed, 01 Dec 2004 17:11:12 -0500 Received: from [192.168.1.10] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by jalapeno.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iB1M5Zkp001839 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Wed, 1 Dec 2004 17:05:35 -0500 (EST) Message-ID: <41AE4081.2010009@columbia.edu> Date: Wed, 01 Dec 2004 17:06:57 -0500 From: Jeffrey Altman Organization: Mass User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org References: In-Reply-To: X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.19 X-Spam-Score: 0.0 (/) X-Scan-Signature: 2857c5c041d6c02d7181d602c22822c8 Subject: Appendix B text was Re: Spnego and interoperability--Running code X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0633021458==" Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: dbb8771284c7a36189745aa720dc20ab This is a cryptographically signed message in MIME format. --===============0633021458== Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms000809030105040904080009" This is a cryptographically signed message in MIME format. --------------ms000809030105040904080009 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Liqiang(Larry) Zhu wrote: > Here is the proposed text to be appended to appendix B. > > -------------------------------------------------------------------- > An implementation that conforms to this specification will not > interoperate with a strict 2748 implementation. Even if the new > implementation always sends a mechlistMIC token, it will still fail > to interoperate. If it is a server, it will fail because it requests > a mechlistMIC token using an option that older implementations simply > do not support. Clients will tend to fail as well. > > As an alternative to the approach chosen in this specification, we > could have documented a correct behavior that is fully backward > compatible with RFC 2478 and included an appendix on how to > interoperate with existing incorrect implementations of RFC 2478. > > As a practical matter, the SPNEGO implementers within the IETF have > valued interoperability with the Microsoft implementations. We were > unable to choose to maintain reasonable security guarantees, maintain > interoperability with the Microsoft implementations and maintain > interoperability with correct implementations of RFC 2478. The > working group was not aware of any RFC 2478 implementations. Even if > there are RFC 2478 implementations, it is unlikely that they will > interoperate because of a critical flaw in the description of the > encoding of the mechanism list in RFC 2478. > > With the approach taken in this specification, we get security > between new implementations all the time while maintaining > interoperability with the implementations we have within the IETF > community. The working group believes that this justifies breaking > compatibility with a correct implementation of RFC 2478. > > ----------------------------------------------------------------- > > -- Larry Thank you. This is what I am looking for. Jeffrey Altman --------------ms000809030105040904080009 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJPzCC AvowggJjoAMCAQICAwxk8TANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UE ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNv bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDQwNTI3MTc1ODU4WhcNMDUwNTI3MTc1ODU4 WjBrMQ8wDQYDVQQEEwZBbHRtYW4xFTATBgNVBCoTDEplZmZyZXkgRXJpYzEcMBoGA1UEAxMT SmVmZnJleSBFcmljIEFsdG1hbjEjMCEGCSqGSIb3DQEJARYUamFsdG1hbkBjb2x1bWJpYS5l ZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc3JqO5AsZrozd+mJ2mPuCTYo2 +nJ9Qq6jtUYtp7YTMW4d2Q6GLhNaHb1l9m74SxuY4f5vP6JtZjr6p9+LCCxD0w0NVLKRgUDp z+tKFitbkJe9BSCxCURRvY3vdWA71gSCUvZAN3346hHb4oGVqgdpmfFJXYAHWpC46wiL72N9 WxySzY17/0eU0c8+r9dNoLpPQeL43O66O80jCl1qnXMaXaakZPsfm+5W90MYXhpQ1WIQpv02 lBn3BH5YE8xwbsNrw5AF4v7pjMuW85GI6FrDmfbpJX473Rpl5rmv3TpXkJ+7UsIIO1puyS8r 1o7kjDZ5EUYJxxglTGR6XL/RNzqHAgMBAAGjMTAvMB8GA1UdEQQYMBaBFGphbHRtYW5AY29s dW1iaWEuZWR1MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAZYeVFCMP0iV+UVa0 eFoXkzMVl61CNAVY2YQ9/QQazO3G4qNiif35ArrnjPRDRj5M7WTeOCFqPVuvCttyJRiDKsEe L4Yah22mRA3mR7x52j2FquPYZ9qCr1IhrNGzsMk+gopX5G0fTHZb6+uDu5SeMPNNcIznGA7M CMpXAJ2PcKgwggL6MIICY6ADAgECAgMMZPEwDQYJKoZIhvcNAQEEBQAwYjELMAkGA1UEBhMC WkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1Ro YXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA0MDUyNzE3NTg1OFoXDTA1 MDUyNzE3NTg1OFowazEPMA0GA1UEBBMGQWx0bWFuMRUwEwYDVQQqEwxKZWZmcmV5IEVyaWMx HDAaBgNVBAMTE0plZmZyZXkgRXJpYyBBbHRtYW4xIzAhBgkqhkiG9w0BCQEWFGphbHRtYW5A Y29sdW1iaWEuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3NyajuQLGa6M 3fpidpj7gk2KNvpyfUKuo7VGLae2EzFuHdkOhi4TWh29ZfZu+EsbmOH+bz+ibWY6+qffiwgs Q9MNDVSykYFA6c/rShYrW5CXvQUgsQlEUb2N73VgO9YEglL2QDd9+OoR2+KBlaoHaZnxSV2A B1qQuOsIi+9jfVscks2Ne/9HlNHPPq/XTaC6T0Hi+NzuujvNIwpdap1zGl2mpGT7H5vuVvdD GF4aUNViEKb9NpQZ9wR+WBPMcG7Da8OQBeL+6YzLlvORiOhaw5n26SV+O90aZea5r906V5Cf u1LCCDtabskvK9aO5Iw2eRFGCccYJUxkely/0Tc6hwIDAQABozEwLzAfBgNVHREEGDAWgRRq YWx0bWFuQGNvbHVtYmlhLmVkdTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBAGWH lRQjD9IlflFWtHhaF5MzFZetQjQFWNmEPf0EGsztxuKjYon9+QK654z0Q0Y+TO1k3jghaj1b rwrbciUYgyrBHi+GGodtpkQN5ke8edo9harj2Gfagq9SIazRs7DJPoKKV+RtH0x2W+vrg7uU njDzTXCM5xgOzAjKVwCdj3CoMIIDPzCCAqigAwIBAgIBDTANBgkqhkiG9w0BAQUFADCB0TEL MAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3du MRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENB MSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTAzMDcx NzAwMDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0 ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVl bWFpbCBJc3N1aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEpjxVc1X7TrnK mVoeaMB1BHCd3+n/ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuFWqo/ cVbLrzwLB+fxH5E2JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8 YQRAHmQZcmC3+wIDAQABo4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4 oDagNIYyaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS5j cmwwCwYDVR0PBAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwy LTEzODANBgkqhkiG9w0BAQUFAAOBgQBIjNFQg+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4 Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZfoSxmRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowg T2Vfldr394fWxghOrvbqNOUQGls1TXfjViF4gtwhGTXeJLHTHUb/XV9lTzGCAzswggM3AgEB MGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0 ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMMZPEw CQYFKw4DAhoFAKCCAacwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUx DxcNMDQxMjAxMjIwNjU3WjAjBgkqhkiG9w0BCQQxFgQUucdtmFnKTLv4BHZjbU6Wk8XKUPMw UgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcN AwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgweAYJKwYBBAGCNxAEMWswaTBiMQswCQYD VQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAwxk8TB6BgsqhkiG9w0B CRACCzFroGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB AgMMZPEwDQYJKoZIhvcNAQEBBQAEggEASSTIr16TKo5dw1ebrwQhqT/6+xM2sBwz2+VlMMeS SJ+/IMZr84fzjfH5HBL/zTZ9OwpTpNfpNxcdN7VojQlHzAM+pUKHfHOCu0ngXZ8ozJFm5yMn pt3xGjDM/ZTyFktj9WUmVVTciO7L8M4sN6MGiC//jBYaMm3qaVkroMqgzgQFxHD40iHdNQMa d8+QIC1pkvVOfqVyBRtY4+xHQLuIZPbNV3P3ej/vf8mRClqLwM1kwE3mWtkQ3mAyJ2RGA+1P nJYGBcOJvMjWxkI3k1AjC4aBPOiPRsocxbjJyuJ96raUbT3EizwICRh773ZMqckQg9zfDaY/ hLN9c4qIAKb7vAAAAAAAAA== --------------ms000809030105040904080009-- --===============0633021458== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --===============0633021458==-- From kitten-bounces@ietf.org Wed Dec 1 18:20:49 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09099; Wed, 1 Dec 2004 18:20:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZdre-0008My-MS; Wed, 01 Dec 2004 18:26:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZdcd-0003nl-S8; Wed, 01 Dec 2004 18:10:55 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZdSc-0002Nw-SV for kitten@megatron.ietf.org; Wed, 01 Dec 2004 18:00:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06330 for ; Wed, 1 Dec 2004 18:00:30 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZdXy-0007nv-UR for kitten@ietf.org; Wed, 01 Dec 2004 18:06:08 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iB1N0UVu013259 for ; Wed, 1 Dec 2004 16:00:30 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iB1N0TjY003657 for ; Wed, 1 Dec 2004 16:00:29 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB1MxgPw561974; Wed, 1 Dec 2004 16:59:42 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iB1Mxbbn561973; Wed, 1 Dec 2004 16:59:37 -0600 (CST) Date: Wed, 1 Dec 2004 16:59:37 -0600 From: Nicolas Williams To: "Liqiang(Larry) Zhu" Message-ID: <20041201225937.GS556007@binky.central.sun.com> Mail-Followup-To: "Liqiang(Larry) Zhu" , Jeffrey Altman , kitten@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Cc: kitten@ietf.org Subject: Re: Spnego and interoperability--Running code X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 On Wed, Dec 01, 2004 at 01:12:28PM -0800, Liqiang(Larry) Zhu wrote: > Here is the proposed text to be appended to appendix B. > > -------------------------------------------------------------------- > An implementation that conforms to this specification will not > interoperate with a strict 2748 implementation. Even if the new > implementation always sends a mechlistMIC token, it will still fail > to interoperate. If it is a server, it will fail because it requests > a mechlistMIC token using an option that older implementations simply > do not support. Clients will tend to fail as well. > > As an alternative to the approach chosen in this specification, we > could have documented a correct behavior that is fully backward > compatible with RFC 2478 and included an appendix on how to > interoperate with existing incorrect implementations of RFC 2478. > > As a practical matter, the SPNEGO implementers within the IETF have > valued interoperability with the Microsoft implementations. We were > unable to choose to maintain reasonable security guarantees, maintain > interoperability with the Microsoft implementations and maintain > interoperability with correct implementations of RFC 2478. The > working group was not aware of any RFC 2478 implementations. Even if > there are RFC 2478 implementations, it is unlikely that they will > interoperate because of a critical flaw in the description of the > encoding of the mechanism list in RFC 2478. > > With the approach taken in this specification, we get security > between new implementations all the time while maintaining > interoperability with the implementations we have within the IETF > community. The working group believes that this justifies breaking > compatibility with a correct implementation of RFC 2478. > > ----------------------------------------------------------------- The only change I would recommend is to add a clause to the first sentence of the last paragraph: "With the approach taken ... all the time while maintaining interoperability with some implementations ... in common, but not all, cases." I support this text. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 1 18:57:32 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA12782; Wed, 1 Dec 2004 18:57:32 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZeRC-00012A-4j; Wed, 01 Dec 2004 19:03:10 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZdsj-0004ra-W5; Wed, 01 Dec 2004 18:27:34 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZdDe-0004IK-DN; Wed, 01 Dec 2004 17:45:06 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05001; Wed, 1 Dec 2004 17:44:52 -0500 (EST) Received: from mail3.microsoft.com ([131.107.3.123]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZdIp-0007Kx-QV; Wed, 01 Dec 2004 17:50:29 -0500 Received: from mailout2.microsoft.com ([157.54.1.120]) by mail3.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 1 Dec 2004 14:44:20 -0800 Received: from red-hub-03.redmond.corp.microsoft.com ([157.54.2.25]) by mailout2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 1 Dec 2004 14:44:20 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-03.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Wed, 1 Dec 2004 14:44:20 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Wed, 1 Dec 2004 14:44:19 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C4D7F7.4AD44846" Date: Wed, 1 Dec 2004 14:44:18 -0800 Message-ID: X-MS-Has-Attach: yes Thread-Topic: ID-submission:draft-ietf-kitten-2478bis-02.txt thread-index: AcTQs3j/cb9xF6Q+Q+uPNk2+At7ebAAJrebAABUliSABLWSzcACEgV8Q From: "Liqiang\(Larry\) Zhu" To: X-OriginalArrivalTime: 01 Dec 2004 22:44:19.0865 (UTC) FILETIME=[4B9C6090:01C4D7F7] X-Spam-Score: 0.0 (/) X-Scan-Signature: baa5f0d7df7d67a6bff4df65bb02daf5 X-Mailman-Approved-At: Wed, 01 Dec 2004 18:27:31 -0500 Cc: kitten@ietf.org Subject: ID-submission:draft-ietf-kitten-2478bis-02.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a760c82fa28c4c53b9b163788fb3a40b This is a multi-part message in MIME format. ------_=_NextPart_001_01C4D7F7.4AD44846 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable =20 RFC editors, This is an update for our existing document. This is a workinggroup document for the KITTEN workinggroup. ----------------------------------------------------------------- Title: The Simple and Protected GSS-API Negotiation Mechanism Authors: Zhu, L., Leach, P.J., Jaganathan, K., Ingersoll, W. Filename: draft-ietf-kitten-2478bis-02.txt Abstract: This document specifies a negotiation mechanism for the Generic Security Service Application Program Interface (GSS-API) which is described in RFC 2743. GSS-API peers can use this negotiation mechanism to choose from a common set of security mechanisms. Size: 25 pages Expiry: June 1, 2005 -------------------------------------------------------------- Changes since -01: mostly editorial changes proposed by Jeff, plus the proposed text in the end of appendix B. Thanks, -- Larry ------_=_NextPart_001_01C4D7F7.4AD44846 Content-Type: text/plain; name="draft-ietf-kitten-2478bis-02.txt" Content-Description: draft-ietf-kitten-2478bis-02.txt Content-Disposition: attachment; filename="draft-ietf-kitten-2478bis-02.txt" Content-Transfer-Encoding: base64 DQoNCk5FVFdPUksgV09SS0lORyBHUk9VUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEwuIFpodQ0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFAuIExlYWNoDQpPYnNvbGV0ZXM6IDI0NzggKGlm IGFwcHJvdmVkKSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEsuIEphZ2FuYXRoYW4NCkV4 cGlyZXM6IEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1pY3Jvc29m dCBDb3Jwb3JhdGlvbg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgVy4gSW5nZXJzb2xsDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFN1biBNaWNyb3N5c3RlbXMNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRGVjZW1iZXIg MSwgMjAwNA0KDQoNCiAgICAgICAgIFRoZSBTaW1wbGUgYW5kIFByb3RlY3RlZCBHU1MtQVBJIE5l Z290aWF0aW9uIE1lY2hhbmlzbQ0KICAgICAgICAgICAgICAgICAgICAgICBkcmFmdC1pZXRmLWtp dHRlbi0yNDc4YmlzDQoNClN0YXR1cyBvZiB0aGlzIE1lbW8NCg0KICAgVGhpcyBkb2N1bWVudCBp cyBhbiBJbnRlcm5ldC1EcmFmdCBhbmQgaXMgc3ViamVjdCB0byBhbGwgcHJvdmlzaW9ucw0KICAg b2Ygc2VjdGlvbiAzIG9mIFJGQyAzNjY3LiAgQnkgc3VibWl0dGluZyB0aGlzIEludGVybmV0LURy YWZ0LCBlYWNoDQogICBhdXRob3IgcmVwcmVzZW50cyB0aGF0IGFueSBhcHBsaWNhYmxlIHBhdGVu dCBvciBvdGhlciBJUFIgY2xhaW1zIG9mDQogICB3aGljaCBoZSBvciBzaGUgaXMgYXdhcmUgaGF2 ZSBiZWVuIG9yIHdpbGwgYmUgZGlzY2xvc2VkLCBhbmQgYW55IG9mDQogICB3aGljaCBoZSBvciBz aGUgYmVjb21lIGF3YXJlIHdpbGwgYmUgZGlzY2xvc2VkLCBpbiBhY2NvcmRhbmNlIHdpdGgNCiAg IFJGQyAzNjY4Lg0KDQogICBJbnRlcm5ldC1EcmFmdHMgYXJlIHdvcmtpbmcgZG9jdW1lbnRzIG9m IHRoZSBJbnRlcm5ldCBFbmdpbmVlcmluZw0KICAgVGFzayBGb3JjZSAoSUVURiksIGl0cyBhcmVh cywgYW5kIGl0cyB3b3JraW5nIGdyb3Vwcy4gIE5vdGUgdGhhdA0KICAgb3RoZXIgZ3JvdXBzIG1h eSBhbHNvIGRpc3RyaWJ1dGUgd29ya2luZyBkb2N1bWVudHMgYXMNCiAgIEludGVybmV0LURyYWZ0 cy4NCg0KICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBkcmFmdCBkb2N1bWVudHMgdmFsaWQgZm9yIGEg bWF4aW11bSBvZiBzaXggbW9udGhzDQogICBhbmQgbWF5IGJlIHVwZGF0ZWQsIHJlcGxhY2VkLCBv ciBvYnNvbGV0ZWQgYnkgb3RoZXIgZG9jdW1lbnRzIGF0IGFueQ0KICAgdGltZS4gIEl0IGlzIGlu YXBwcm9wcmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBhcyByZWZlcmVuY2UNCiAgIG1hdGVy aWFsIG9yIHRvIGNpdGUgdGhlbSBvdGhlciB0aGFuIGFzICJ3b3JrIGluIHByb2dyZXNzLiINCg0K ICAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC1EcmFmdHMgY2FuIGJlIGFjY2Vzc2VkIGF0 DQogICBodHRwOi8vd3d3LmlldGYub3JnL2lldGYvMWlkLWFic3RyYWN0cy50eHQuDQoNCiAgIFRo ZSBsaXN0IG9mIEludGVybmV0LURyYWZ0IFNoYWRvdyBEaXJlY3RvcmllcyBjYW4gYmUgYWNjZXNz ZWQgYXQNCiAgIGh0dHA6Ly93d3cuaWV0Zi5vcmcvc2hhZG93Lmh0bWwuDQoNCiAgIFRoaXMgSW50 ZXJuZXQtRHJhZnQgd2lsbCBleHBpcmUgb24gSnVuZSAxLCAyMDA1Lg0KDQpDb3B5cmlnaHQgTm90 aWNlDQoNCiAgIENvcHlyaWdodCAoQykgVGhlIEludGVybmV0IFNvY2lldHkgKDIwMDQpLg0KDQpB YnN0cmFjdA0KDQogICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBhIG5lZ290aWF0aW9uIG1lY2hh bmlzbSBmb3IgdGhlIEdlbmVyaWMNCiAgIFNlY3VyaXR5IFNlcnZpY2UgQXBwbGljYXRpb24gUHJv Z3JhbSBJbnRlcmZhY2UgKEdTUy1BUEkpIHdoaWNoIGlzDQogICBkZXNjcmliZWQgaW4gUkZDIDI3 NDMuDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIw MDUgICAgICAgICAgICAgICAgICBbUGFnZSAxXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NT LUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAg R1NTLUFQSSBwZWVycyBjYW4gdXNlIHRoaXMgbmVnb3RpYXRpb24gbWVjaGFuaXNtIHRvIGNob29z ZSBmcm9tIGENCiAgIGNvbW1vbiBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcy4NCg0KVGFibGUg b2YgQ29udGVudHMNCg0KICAgMS4gIEludHJvZHVjdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAzDQogICAyLiAgQ29udmVudGlvbnMgVXNlZCBp biBUaGlzIERvY3VtZW50ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDUNCiAgIDMuICBO ZWdvdGlhdGlvbiBQcm90b2NvbCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAgNg0KICAgICAzLjEgICBOZWdvdGlhdGlvbiBEZXNjcmlwdGlvbiAgLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuICA2DQogICAgIDMuMiAgIE5lZ290aWF0aW9uIFByb2NlZHVy ZSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDcNCiAgIDQuICBUb2tlbiBE ZWZpbml0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAg OQ0KICAgICA0LjEgICBNZWNoYW5pc20gVHlwZXMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuICA5DQogICAgIDQuMiAgIE5lZ290aWF0aW9uIFRva2VucyAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDkNCiAgICAgICA0LjIuMSAgIG5lZ1Rv a2VuSW5pdCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxMA0KICAg ICAgIDQuMi4yICAgbmVnVG9rZW5SZXNwIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIDExDQogICA1LiAgUHJvY2Vzc2luZyBvZiBtZWNoTGlzdE1JQyAgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTMNCiAgIDYuICBFeHRlbnNpYmlsaXR5ICAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxNg0KICAgNy4gIFNl Y3VyaXR5IENvbnNpZGVyYXRpb25zICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIDE3DQogICA4LiAgSUFOQSBDb25zaWRlcmF0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gMTgNCiAgIDkuICBBY2tub3dsZWRnbWVudHMgIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxOQ0KICAgMTAuICAgTm9ybWF0 aXZlIFJlZmVyZW5jZXMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDE5 DQogICAgICAgQXV0aG9ycycgQWRkcmVzc2VzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gMTkNCiAgIEEuICBHU1MtQVBJIE5lZ290aWF0aW9uIFN1cHBvcnQgQVBJ ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyMQ0KICAgICBBLjEgICBHU1NfU2V0X25l Z19tZWNocyBjYWxsIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIxDQogICAg IEEuMiAgIEdTU19HZXRfbmVnX21lY2hzIGNhbGwgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gMjENCiAgIEIuICBDaGFuZ2VzIHNpbmNlIFJGQzI0NzggIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyMw0KICAgICAgIEludGVsbGVjdHVhbCBQcm9wZXJ0 eSBhbmQgQ29weXJpZ2h0IFN0YXRlbWVudHMgLiAuIC4gLiAuIC4gLiAuIDI1DQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAg ICAgICAgIEV4cGlyZXMgSnVuZSAxLCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgMl0NCgwN CkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAg ICAgRGVjZW1iZXIgMjAwNA0KDQoNCjEuICBJbnRyb2R1Y3Rpb24NCg0KICAgVGhlIEdTUy1BUEkg W1JGQzI3NDNdIHByb3ZpZGVzIGEgZ2VuZXJpYyBpbnRlcmZhY2Ugd2hpY2ggY2FuIGJlDQogICBs YXllcmVkIGF0b3AgZGlmZmVyZW50IHNlY3VyaXR5IG1lY2hhbmlzbXMgc3VjaCB0aGF0IGlmIGNv bW11bmljYXRpbmcNCiAgIHBlZXJzIGFjcXVpcmUgR1NTLUFQSSBjcmVkZW50aWFscyBmb3IgdGhl IHNhbWUgc2VjdXJpdHkgbWVjaGFuaXNtLA0KICAgdGhlbiBhIHNlY3VyaXR5IGNvbnRleHQgbWF5 IGJlIGVzdGFibGlzaGVkIGJldHdlZW4gdGhlbSAoc3ViamVjdCB0bw0KICAgcG9saWN5KS4gIEhv d2V2ZXIsIEdTUy1BUEkgZG9lcyBub3QgcHJlc2NyaWJlIHRoZSBtZXRob2QgYnkgd2hpY2gNCiAg IEdTUy1BUEkgcGVlcnMgY2FuIGVzdGFibGlzaCB3aGV0aGVyIHRoZXkgaGF2ZSBhIGNvbW1vbiBz ZWN1cml0eQ0KICAgbWVjaGFuaXNtLg0KDQogICBUaGUgU2ltcGxlIGFuZCBQcm90ZWN0ZWQgR1NT LUFQSSBOZWdvdGlhdGlvbiAoU1BORUdPKSBtZWNoYW5pc20NCiAgIGRlZmluZWQgaGVyZSBpcyBh IHBzZXVkbyBzZWN1cml0eSBtZWNoYW5pc20sIHJlcHJlc2VudGVkIGJ5IHRoZQ0KICAgT2JqZWN0 IElkZW50aWZpZXIgaXNvLm9yZy5kb2QuaW50ZXJuZXQuc2VjdXJpdHkubWVjaGFuaXNtLnNuZWdv DQogICAoMS4zLjYuMS41LjUuMiksIHdoaWNoIGVuYWJsZXMgR1NTLUFQSSBwZWVycyB0byBkZXRl cm1pbmUgaW4tYmFuZA0KICAgd2hldGhlciB0aGVpciBjcmVkZW50aWFscyBzaGFyZSBjb21tb24g R1NTLUFQSSBzZWN1cml0eSBtZWNoYW5pc20ocyksDQogICBhbmQgaWYgc28sIHRvIGludm9rZSBu b3JtYWwgc2VjdXJpdHkgY29udGV4dCBlc3RhYmxpc2htZW50IGZvciBhDQogICBzZWxlY3RlZCBj b21tb24gc2VjdXJpdHkgbWVjaGFuaXNtLiAgVGhpcyBpcyBtb3N0IHVzZWZ1bCBmb3INCiAgIGFw cGxpY2F0aW9ucyB3aGljaCBhcmUgYmFzZWQgb24gR1NTLUFQSSBpbXBsZW1lbnRhdGlvbnMgYW5k IHNoYXJlDQogICBtdWx0aXBsZSBtZWNoYW5pc21zIGJldHdlZW4gdGhlIHBlZXJzLg0KDQogICBU aGUgU1BORUdPIG1lY2hhbmlzbSBuZWdvdGlhdGlvbiBpcyBiYXNlZCBvbiB0aGUgZm9sbG93aW5n DQogICBuZWdvdGlhdGlvbiBtb2RlbDogdGhlIGluaXRpYXRvciBwcm9wb3NlcyBhIGxpc3Qgb2Yg c2VjdXJpdHkNCiAgIG1lY2hhbmlzbShzKSwgaW4gZGVjcmVhc2luZyBwcmVmZXJlbmNlIG9yZGVy IChmYXZvcml0ZSBjaG9pY2UgZmlyc3QpLA0KICAgdGhlIGFjY2VwdG9yIChhbHNvIGtub3duIGFz IHRoZSB0YXJnZXQpIGVpdGhlciBhY2NlcHRzIHRoZQ0KICAgaW5pdGlhdG9yJ3MgcHJlZmVycmVk IHNlY3VyaXR5IG1lY2hhbmlzbSAodGhlIGZpcnN0IGluIHRoZSBsaXN0KSwgb3INCiAgIGNob29z ZXMgb25lIHRoYXQgaXMgYXZhaWxhYmxlIGZyb20gdGhlIG9mZmVyZWQgbGlzdCwgb3IgcmVqZWN0 cyB0aGUNCiAgIHByb3Bvc2VkIHZhbHVlKHMpLiAgVGhlIHRhcmdldCB0aGVuIGluZm9ybXMgdGhl IGluaXRpYXRvciBvZiBpdHMNCiAgIGNob2ljZS4NCg0KICAgT25jZSBhIGNvbW1vbiBzZWN1cml0 eSBtZWNoYW5pc20gaXMgY2hvc2VuLCBtZWNoYW5pc20tc3BlY2lmaWMNCiAgIG9wdGlvbnMgTUFZ IGJlIG5lZ290aWF0ZWQgYXMgcGFydCBvZiB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtJ3MgY29udGV4 dA0KICAgZXN0YWJsaXNobWVudC4gIFRoZXNlIG5lZ290aWF0aW9ucyAoaWYgYW55KSBhcmUgaW50 ZXJuYWwgdG8gdGhlDQogICBtZWNoYW5pc20gYW5kIG9wYXF1ZSB0byB0aGUgU1BORUdPIHByb3Rv Y29sLiAgQXMgc3VjaCB0aGV5IGFyZQ0KICAgb3V0c2lkZSB0aGUgc2NvcGUgb2YgdGhpcyBkb2N1 bWVudC4NCg0KICAgSWYgcGVyLW1lc3NhZ2UgaW50ZWdyaXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFi bGUgb24gdGhlIGVzdGFibGlzaGVkDQogICBtZWNoYW5pc20gc2VjdXJpdHkgY29udGV4dCwgdGhl biB0aGUgcGVlcnMgY2FuIGV4Y2hhbmdlIE1JQyB0b2tlbnMgdG8NCiAgIGVuc3VyZSB0aGF0IHRo ZSBtZWNoYW5pc20gbGlzdCB3YXMgbm90IHRhbXBlcmVkIHdpdGguICBUaGlzIE1JQyB0b2tlbg0K ICAgZXhjaGFuZ2UgaXMgT1BUSU9OQUwgaWYgdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSBpcyB0aGUg bW9zdCBwcmVmZXJyZWQNCiAgIGNob2ljZSBvZiBib3RoIHBlZXJzIChzZWUgU2VjdGlvbiA1KS4N Cg0KICAgSW4gb3JkZXIgdG8gYXZvaWQgYW4gZXh0cmEgcm91bmQgdHJpcCwgdGhlIGZpcnN0IHNl Y3VyaXR5IHRva2VuIG9mDQogICB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSBT SE9VTEQgYmUgZW1iZWRkZWQgaW4gdGhlIGluaXRpYWwNCiAgIG5lZ290aWF0aW9uIG1lc3NhZ2Ug KGFzIGRlZmluZWQgaW4gU2VjdGlvbiA0LjIpLiAgVGhpcyBtZWNoYW5pc20NCiAgIHRva2VuIGlz IHJlZmVycmVkIHRvIGFzIHRoZSBvcHRpbWlzdGljIG1lY2hhbmlzbSB0b2tlbiBpbiB0aGlzDQog ICBkb2N1bWVudC4gIElmIHRoZSBzZWxlY3RlZCBtZWNoYW5pc20gbWF0Y2hlcyB0aGUgaW5pdGlh dG9yJ3MNCiAgIHByZWZlcnJlZCBtZWNoYW5pc20sIG5vIGFkZGl0aW9uYWwgcm91bmQgdHJpcHMg bmVlZCBiZSBpbmN1cnJlZCBieQ0KICAgdXNpbmcgdGhpcyBwcm90b2NvbC4gIEluIGFkZGl0aW9u LCB1c2luZyB0aGUgb3B0aW1pc3RpYyBtZWNoYW5pc20NCg0KDQoNClpodSwgZXQgYWwuICAgICAg ICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAgICAgICAgICAgICBbUGFnZSAzXQ0K DA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAg ICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAgdG9rZW4gYWxsb3dzIHRoZSBpbml0aWF0b3IgdG8g cmVjb3ZlciBmcm9tIG5vbi1mYXRhbCBlcnJvcnMgd2hpbGUNCiAgIHByb2R1Y2luZyB0aGUgZmly c3QgbWVjaGFuaXNtIHRva2VuIGJlZm9yZSBhIG1lY2hhbmlzbSBjYW4gYmUNCiAgIHNlbGVjdGVk LiAgSW1wbGVtZW50YXRpb25zIE1BWSBvbWl0IHRoZSBvcHRpbWlzdGljIG1lY2hhbmlzbSB0b2tl biB0bw0KICAgYXZvaWQgdGhlIGNvc3Qgb2YgZ2VuZXJhdGluZyBpdCBpbiBjYXNlcyB3aGVyZSB0 aGUgaW5pdGlhdG9yJ3MNCiAgIHByZWZlcnJlZCBtZWNoYW5pc20gaXMgbm90IHNlbGVjdGVkIGJ5 IHRoZSBhY2NlcHRvci4NCg0KICAgU1BORUdPIHJlbGllcyB0aGUgY29uY2VwdHMgZGV2ZWxvcGVk IGluIHRoZSBHU1MtQVBJIHNwZWNpZmljYXRpb24NCiAgIFtSRkMyNzQzXS4gIFRoZSBuZWdvdGlh dGlvbiBkYXRhIGlzIGVuY2Fwc3VsYXRlZCBpbiBjb250ZXh0LWxldmVsDQogICB0b2tlbnMuICBU aGVyZWZvcmUsIGNhbGxlcnMgb2YgdGhlIEdTUy1BUEkgZG8gbm90IG5lZWQgdG8gYmUgYXdhcmUg b2YNCiAgIHRoZSBleGlzdGVuY2Ugb2YgdGhlIG5lZ290aWF0aW9uIHRva2VucyBidXQgb25seSBv ZiB0aGUgbmV3DQogICBwc2V1ZG8tc2VjdXJpdHkgbWVjaGFuaXNtLiAgQSBmYWlsdXJlIGluIHRo ZSBuZWdvdGlhdGlvbiBwaGFzZSBjYXVzZXMNCiAgIGEgbWFqb3Igc3RhdHVzIGNvZGUgdG8gYmUg cmV0dXJuZWQ6IEdTU19TX0JBRF9NRUNILg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBh bC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgIFtQ YWdlIDRdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hh bmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQoyLiAgQ29udmVudGlvbnMgVXNlZCBpbiBU aGlzIERvY3VtZW50DQoNCiAgIFRoZSBrZXkgd29yZHMgIk1VU1QiLCAiTVVTVCBOT1QiLCAiUkVR VUlSRUQiLCAiU0hBTEwiLCAiU0hBTEwgTk9UIiwNCiAgICJTSE9VTEQiLCAiU0hPVUxEIE5PVCIs ICJSRUNPTU1FTkRFRCIsICJNQVkiLCBhbmQgIk9QVElPTkFMIiBpbiB0aGlzDQogICBkb2N1bWVu dCBhcmUgdG8gYmUgaW50ZXJwcmV0ZWQgYXMgZGVzY3JpYmVkIGluIFtSRkMyMTE5XS4NCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBF eHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgIFtQYWdlIDVdDQoMDQpJbnRlcm5l dC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2Vt YmVyIDIwMDQNCg0KDQozLiAgTmVnb3RpYXRpb24gUHJvdG9jb2wNCg0KICAgV2hlbiB0aGUgZXN0 YWJsaXNoZWQgbWVjaGFuaXNtIGNvbnRleHQgcHJvdmlkZXMgaW50ZWdyaXR5IHByb3RlY3Rpb24s DQogICB0aGUgbWVjaGFuaXNtIG5lZ290aWF0aW9uIGNhbiBiZSBwcm90ZWN0ZWQuICBXaGVuIGFj cXVpcmluZw0KICAgbmVnb3RpYXRlZCBzZWN1cml0eSBtZWNoYW5pc20gdG9rZW5zLCBwZXItbWVz c2FnZSBpbnRlZ3JpdHkgc2VydmljZXMNCiAgIGFyZSBhbHdheXMgcmVxdWVzdGVkIGJ5IHRoZSBT UE5FR08gbWVjaGFuaXNtLg0KDQogICBXaGVuIHRoZSBlc3RhYmxpc2hlZCBtZWNoYW5pc20gY29u dGV4dCBzdXBwb3J0cyBwZXItbWVzc2FnZSBpbnRlZ3JpdHkNCiAgIHNlcnZpY2VzLCBTUE5FR08g Z3VhcmFudGVlcyB0aGF0IHRoZSBzZWxlY3RlZCBtZWNoYW5pc20gaXMgbXV0dWFsbHkNCiAgIHBy ZWZlcnJlZC4NCg0KICAgVGhpcyBzZWN0aW9uIGRlc2NyaWJlcyB0aGUgbmVnb3RpYXRpb24gcHJv Y2VzcyBvZiB0aGlzIHByb3RvY29sLg0KDQozLjEgIE5lZ290aWF0aW9uIERlc2NyaXB0aW9uDQoN CiAgIFRoZSBmaXJzdCBuZWdvdGlhdGlvbiB0b2tlbiBzZW50IGJ5IHRoZSBpbml0aWF0b3IgY29u dGFpbnMgYW4gb3JkZXJlZA0KICAgbGlzdCBvZiBtZWNoYW5pc21zIChpbiBkZWNyZWFzaW5nIHBy ZWZlcmVuY2Ugb3JkZXIsIGZhdm9yaXRlDQogICBtZWNoYW5pc20gZmlyc3QpLCBhbmQgb3B0aW9u YWxseSB0aGUgaW5pdGlhbCBtZWNoYW5pc20gdG9rZW4gZm9yIHRoZQ0KICAgcHJlZmVycmVkIG1l Y2hhbmlzbSBvZiB0aGUgaW5pdGlhdG9yIChpLmUuLCB0aGUgZmlyc3QgaW4gdGhlIGxpc3QpLg0K ICAgVGhlIGxpc3Qgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcyBhdmFpbGFibGUgZm9yIG5lZ290aWF0 aW9uIGlzIGJhc2VkIG9uDQogICB0aGUgY3JlZGVudGlhbHMgYmVpbmcgdXNlZC4NCg0KICAgVGhl IHRhcmdldCB0aGVuIHByb2Nlc3NlcyB0aGUgdG9rZW4gZnJvbSB0aGUgaW5pdGlhdG9yLiAgVGhp cyB3aWxsDQogICByZXN1bHQgaW4gb25lIG9mIGZvdXIgcG9zc2libGUgc3RhdGVzIChhcyBkZWZp bmVkIGluIFNlY3Rpb24gNC4yLjIpOg0KICAgYWNjZXB0X2NvbXBsZXRlZCwgYWNjZXB0X2luY29t cGxldGUsIHJlamVjdCwgb3IgcmVxdWVzdF9taWMuICBBDQogICByZWplY3Qgc3RhdGUgd2lsbCB0 ZXJtaW5hdGUgdGhlIG5lZ290aWF0aW9uOyAgYW4gYWNjZXB0X2NvbXBsZXRlZA0KICAgc3RhdGUg aW5kaWNhdGVzIHRoYXQgbm90IG9ubHkgd2FzIHRoZSBpbml0aWF0b3Itc2VsZWN0ZWQgbWVjaGFu aXNtDQogICBhY2NlcHRhYmxlIHRvIHRoZSB0YXJnZXQsIGJ1dCBhbHNvIHRoYXQgdGhlIGluaXRp YWwgbWVjaGFuaXNtIHRva2VuDQogICB3YXMgc3VmZmljaWVudCB0byBjb21wbGV0ZSB0aGUgYXV0 aGVudGljYXRpb247ICBhbiBhY2NlcHRfaW5jb21wbGV0ZQ0KICAgc3RhdGUgaW5kaWNhdGVzIHRo YXQgZnVydGhlciBtZXNzYWdlIGV4Y2hhbmdlIGlzIG5lZWRlZCBidXQgdGhlIE1JQw0KICAgdG9r ZW4gZXhjaGFuZ2UgYXMgZGVzY3JpYmVkIGluIFNlY3Rpb24gNSBpcyBPUFRJT05BTDsgIGEgcmVx dWVzdF9taWMNCiAgIHN0YXRlICh0aGlzIHN0YXRlIGNhbiBvbmx5IGJlIHByZXNlbnQgaW4gdGhl IGZpcnN0IHJlcGx5IG1lc3NhZ2UgZnJvbQ0KICAgdGhlIHRhcmdldCkgaW5kaWNhdGVzIHRoZSBN SUMgdG9rZW4gZXhjaGFuZ2UgaXMgUkVRVUlSRUQgaWYNCiAgIHBlci1tZXNzYWdlIGludGVncml0 eSBzZXJ2aWNlcyBhcmUgYXZhaWxhYmxlLg0KDQogICBVbmxlc3MgdGhlIHByZWZlcmVuY2Ugb3Jk ZXIgaXMgc3BlY2lmaWVkIGJ5IHRoZSBhcHBsaWNhdGlvbiAoc2VlDQogICBBcHBlbmRpeCBBKSwg dGhlIHBvbGljeSBieSB3aGljaCB0aGUgdGFyZ2V0IGNob29zZXMgYSBtZWNoYW5pc20gaXMgYW4N CiAgIGltcGxlbWVudGF0aW9uLXNwZWNpZmljIGxvY2FsIG1hdHRlci4gIEluIHRoZSBhYnNlbmNl IG9mIGFuDQogICBhcHBsaWNhdGlvbiBzcGVjaWZpZWQgcHJlZmVyZW5jZSBvcmRlciBvciBvdGhl ciBwb2xpY3ksIHRoZSB0YXJnZXQNCiAgIFNIQUxMIGNob29zZSB0aGUgZmlyc3QgbWVjaGFuaXNt IGluIHRoZSBpbml0aWF0b3IgcHJvcG9zZWQgbGlzdCBmb3INCiAgIHdoaWNoIGl0IGhhcyB2YWxp ZCBjcmVkZW50aWFscy4NCg0KICAgSW4gY2FzZSBvZiBhIHN1Y2Nlc3NmdWwgbmVnb3RpYXRpb24s IHRoZSBzZWN1cml0eSBtZWNoYW5pc20gaW4gdGhlDQogICBmaXJzdCByZXBseSBtZXNzYWdlIHJl cHJlc2VudHMgdGhlIHZhbHVlIHN1aXRhYmxlIGZvciB0aGUgdGFyZ2V0LA0KICAgcGlja2VkIHVw IGZyb20gdGhlIGxpc3Qgb2ZmZXJlZCBieSB0aGUgaW5pdGlhdG9yLiAgQSBjb250ZXh0IGxldmVs DQogICB0b2tlbiBmb3IgYSByZWplY3Qgc3RhdGUgaXMgT1BUSU9OQUwuDQoNCiAgIE9uY2UgYSBt ZWNoYW5pc20gaGFzIGJlZW4gc2VsZWN0ZWQsIHRoZSB0b2tlbnMgc3BlY2lmaWMgdG8gdGhlDQoN Cg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxLCAyMDA1ICAgICAg ICAgICAgICAgICAgW1BhZ2UgNl0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVn b3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCiAgIHNlbGVjdGVk IG1lY2hhbmlzbSBhcmUgY2FycmllZCB3aXRoaW4gdGhlIG5lZ290aWF0aW9uIHRva2Vucy4NCg0K ICAgTGFzdGx5LCBNSUMgdG9rZW5zIE1BWSBiZSBleGNoYW5nZWQgdG8gZW5zdXJlIHRoZSBhdXRo ZW50aWNpdHkgb2YgdGhlDQogICBtZWNoYW5pc20gbGlzdCByZWNlaXZlZCBieSB0aGUgdGFyZ2V0 Lg0KDQogICBUbyBhdm9pZCBjb25mbGljdHMgd2l0aCB0aGUgdXNlIG9mIE1JQyB0b2tlbnMgYnkg U1BORUdPLA0KICAgcGFydGlhbGx5LWVzdGFibGlzaGVkIGNvbnRleHRzIGFyZSBub3QgdXNlZCBm b3IgcGVyLW1lc3NhZ2UgY2FsbHM6DQogICB0aGUgcHJvdF9yZWFkeV9zdGF0ZSBbUkZDMjc0M10g d2lsbCBiZSBmYWxzZSBldmVuIGlmIHRoZSB1bmRlcmx5aW5nDQogICBtZWNoYW5pc20gd291bGQg cmV0dXJuIHRydWUgbmF0aXZlbHkuDQoNCjMuMiAgTmVnb3RpYXRpb24gUHJvY2VkdXJlDQoNCiAg IFRoZSBiYXNpYyBmb3JtIG9mIHRoZSBwcm9jZWR1cmUgYXNzdW1lcyB0aGF0IHBlci1tZXNzYWdl IGludGVncml0eQ0KICAgc2VydmljZXMgYXJlIGF2YWlsYWJsZSBvbiB0aGUgZXN0YWJsaXNoZWQg bWVjaGFuaXNtIGNvbnRleHQsIGFuZCBpdA0KICAgaXMgc3VtbWFyaXplZCBhcyBmb2xsb3dzOg0K DQogICAoYSkgVGhlIEdTUy1BUEkgaW5pdGlhdG9yIGludm9rZXMgR1NTX0luaXRfc2VjX2NvbnRl eHQoKSBhcyBub3JtYWwsDQogICAgICBidXQgcmVxdWVzdHMgdGhhdCBTUE5FR08gYmUgdXNlZC4g IFNQTkVHTyBjYW4gZWl0aGVyIGJlIGV4cGxpY2l0eQ0KICAgICAgcmVxdWVzdGVkIG9yIGFjY2Vw dGVkIGFzIHRoZSBkZWZhdWx0IG1lY2hhbmlzbS4NCg0KICAgKGIpIFRoZSBpbml0aWF0b3IgR1NT LUFQSSBpbXBsZW1lbnRhdGlvbiBlbWl0cyBhIG5lZ290aWF0aW9uIHRva2VuDQogICAgICBjb250 YWluaW5nIGEgbGlzdCBvZiBvbmUgb3IgbW9yZSBzZWN1cml0eSBtZWNoYW5pc21zIHRoYXQgYXJl DQogICAgICBhdmFpbGFibGUgYmFzZWQgb24gdGhlIGNyZWRlbnRpYWxzIHVzZWQgZm9yIHRoaXMg Y29udGV4dA0KICAgICAgZXN0YWJsaXNobWVudCwgYW5kIG9wdGlvbmFsbHkgdGhlIGluaXRpYWwg bWVjaGFuaXNtIHRva2VuIGZvciB0aGUNCiAgICAgIGZpcnN0IG1lY2hhbmlzbSBpbiB0aGUgbGlz dC4NCg0KICAgKGMpIFRoZSBHU1MtQVBJIGluaXRpYXRvciBhcHBsaWNhdGlvbiBzZW5kcyB0aGUg dG9rZW4gdG8gdGhlIHRhcmdldA0KICAgICAgYXBwbGljYXRpb24uICBUaGUgR1NTLUFQSSB0YXJn ZXQgYXBwbGljYXRpb24gZGVwb3NpdHMgdGhlIHRva2VuIGJ5DQogICAgICBpbnZva2luZyBHU1Nf QWNjZXB0X3NlY19jb250ZXh0KCkuICBUaGUgYWNjZXB0b3Igd2lsbCBkbyBvbmUgb2YNCiAgICAg IHRoZSBmb2xsb3dpbmc6DQoNCiAgICAgIChJKSBJZiBub25lIG9mIHRoZSBwcm9wb3NlZCBtZWNo YW5pc21zIGFyZSBhY2NlcHRhYmxlLCB0aGUNCiAgICAgICAgIG5lZ290aWF0aW9uIFNIQUxMIGJl IHRlcm1pbmF0ZWQuICBHU1NfQWNjZXB0X3NlY19jb250ZXh0DQogICAgICAgICBpbmRpY2F0ZXMg R1NTX1NfQkFEX01FQ0guICBUaGUgYWNjZXB0b3IgTUFZIG91dHB1dCBhDQogICAgICAgICBuZWdv dGlhdGlvbiB0b2tlbiBjb250YWluaW5nIGEgcmVqZWN0IHN0YXRlLg0KDQogICAgICAoSUkpIElm IGVpdGhlciB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSBpcyBub3QgYWNjZXB0 ZWQNCiAgICAgICAgIGJ5IHRoZSB0YXJnZXQgb3IgdGhpcyBtZWNoYW5pc20gaXMgYWNjZXB0ZWQg YnV0IGl0IGlzIG5vdCB0aGUNCiAgICAgICAgIGFjY2VwdG9yJ3MgbW9zdCBwcmVmZXJyZWQgbWVj aGFuaXNtIChzZWUgU2VjdGlvbiAzLjEgYW5kDQogICAgICAgICBTZWN0aW9uIDUpLCBHU1NfQWNj ZXB0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzDQogICAgICAgICBHU1NfU19DT05USU5VRV9ORUVE RUQuICBUaGUgYWNjZXB0b3IgTVVTVCBvdXRwdXQgYSBuZWdvdGlhdGlvbg0KICAgICAgICAgdG9r ZW4gY29udGFpbmluZyBhIHJlcXVlc3RfbWljIHN0YXRlLg0KDQogICAgICAoSUlJKSBPdGhlcndp c2UsIEdTU19BY2NlcHRfc2VjX2NvbmV4dCgpIGluZGljYXRlcyBHU1NfU19DT01QTEVURQ0KICAg ICAgICAgb3IgR1NTX1NfQ09OVElOVUVfTkVFREVEIGRlcGVuZGluZyBvbiBpZiBhdCBsZWFzdCBv bmUNCiAgICAgICAgIGFkZGl0aW9uYWwgbmVnb3RpYXRpb24gdG9rZW4gZnJvbSB0aGUgaW5pdGlh dG9yIGlzIG5lZWRlZCB0bw0KICAgICAgICAgZXN0YWJsaXNoIHRoaXMgY29udGV4dC4gIFRoZSBh Y2NlcHRvciBvdXRwdXRzIGEgbmVnb3RpYXRpb24NCiAgICAgICAgIHRva2VuIGNvbnRhaW5pbmcg YW4gYWNjZXB0X2NvbXBsZXRlIG9yIGFjY2VwdF9pbmNvbXBsZXRlIHN0YXRlLA0KDQoNCg0KWmh1 LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAg ICAgIFtQYWdlIDddDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9u IE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICAgICAgICByZXNwZWN0aXZl bHkuDQoNCiAgICAgIElmIHRoZSBpbml0aWF0b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNtIGlzIGFj Y2VwdGVkLCBhbmQgYW4NCiAgICAgIG9wdGltaXN0aWMgbWVjaGFuaXNtIHRva2VuIHdhcyBpbmNs dWRlZCwgdGhpcyBtZWNoYW5pc20gdG9rZW4gTVVTVA0KICAgICAgYmUgZGVwb3NpdGVkIHRvIHRo ZSBzZWxlY3RlZCBtZWNoYW5pc20gYnkgaW52b2tpbmcNCiAgICAgIEdTU19BY2NlcHRfc2VjX2Nv bnRleHQoKSBhbmQgaWYgYSByZXNwb25zZSBtZWNoYW5pc20gdG9rZW4gaXMNCiAgICAgIGVtaXR0 ZWQsIGl0IE1VU1QgYmUgaW5jbHVkZWQgaW4gdGhlIHJlc3BvbnNlIG5lZ290aWF0aW9uIHRva2Vu Lg0KICAgICAgT3RoZXJ3aXNlLCB0aGUgdGFyZ2V0IHdpbGwgbm90IGVtaXQgYSByZXNwb25zZSBt ZWNoYW5pc20gdG9rZW4gaW4NCiAgICAgIHRoZSBmaXJzdCByZXBseS4NCg0KICAgKGQpIFRoZSBH U1MtQVBJIHRhcmdldCBhcHBsaWNhdGlvbiByZXR1cm5zIHRoZSBuZWdvdGlhdGlvbiB0b2tlbiB0 bw0KICAgICAgdGhlIGluaXRpYXRvciBhcHBsaWNhdGlvbi4gIFRoZSBHU1MtQVBJIGluaXRpYXRv ciBhcHBsaWNhdGlvbg0KICAgICAgZGVwb3NpdHMgdGhlIHRva2VuIGJ5IGludm9raW5nIEdTU19J bml0X3NlY19jb250ZXh0KCkuICBUaGUNCiAgICAgIHNlY3VyaXR5IGNvbnRleHQgaW5pdGlhbGl6 YXRpb24gaXMgdGhlbiBjb250aW51ZWQgYWNjb3JkaW5nIHRvIHRoZQ0KICAgICAgc3RhbmRhcmQg R1NTLUFQSSBjb252ZW50aW9ucyBmb3IgdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSwgd2hlcmUgdGhl DQogICAgICB0b2tlbnMgb2YgdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSBhcmUgZW5jYXBzdWxhdGVk IHVudGlsIHRoZQ0KICAgICAgR1NTX1NfQ09NUExFVEUgaXMgcmV0dXJuZWQgZm9yIGJvdGggdGhl IGluaXRpYXRvciBhbmQgdGhlIHRhcmdldA0KICAgICAgYnkgdGhlIHNlbGVjdGVkIHNlY3VyaXR5 IG1lY2hhbmlzbS4NCg0KICAgKGUpIE1JQyB0b2tlbnMgYXJlIHRoZW4gZWl0aGVyIHNraXBwZWQg b3IgZXhjaGFuZ2VkIGFjY29yZGluZyB0bw0KICAgICAgU2VjdGlvbiA1Lg0KDQogICBOb3RlIHRo YXQgdGhlICpfcmVxX2ZsYWcgaW5wdXQgcGFyYW1ldGVycyBmb3IgY29udGV4dCBlc3RhYmxpc2ht ZW50DQogICBhcmUgcmVsYXRpdmUgdG8gdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSwgYXMgYXJlIHRo ZSAqX3N0YXRlIG91dHB1dA0KICAgcGFyYW1ldGVycy4gIGkuZS4sIHRoZXNlIHBhcmFtZXRlcnMg YXJlIG5vdCBhcHBsaWNhYmxlIHRvIHRoZQ0KICAgbmVnb3RpYXRpb24gcHJvY2VzcyBwZXIgc2Uu DQoNCiAgIE9uIHJlY2VpcHQgb2YgYSBuZWdvdGlhdGlvbiB0b2tlbiBvbiB0aGUgdGFyZ2V0IHNp ZGUsIGEgR1NTLUFQSQ0KICAgaW1wbGVtZW50YXRpb24gdGhhdCBkb2VzIG5vdCBzdXBwb3J0IG5l Z290aWF0aW9uIHdvdWxkIGluZGljYXRlIHRoZQ0KICAgR1NTX1NfQkFEX01FQ0ggc3RhdHVzIGFz IGlmIGEgcGFydGljdWxhciBiYXNpYyBzZWN1cml0eSBtZWNoYW5pc20gaGFkDQogICBiZWVuIHJl cXVlc3RlZCBhbmQgd2FzIG5vdCBzdXBwb3J0ZWQuDQoNCiAgIFdoZW4gR1NTX0FjcXVpcmVfY3Jl ZCBpcyBpbnZva2VkIHdpdGggdGhpcyBuZWdvdGlhdGlvbiBtZWNoYW5pc20gaW4NCiAgIHRoZSBk ZXNpcmVkX21lY2hzLCBhbiBpbXBsZW1lbnRhdGlvbi1zcGVjaWZpYyBkZWZhdWx0IGNyZWRlbnRp YWwgaXMNCiAgIHVzZWQgdG8gY2Fycnkgb24gdGhlIG5lZ290aWF0aW9uLiAgQSBzZXQgb2YgbWVj aGFuaXNtcyBhcyBzcGVjaWZpZWQNCiAgIGxvY2FsbHkgYnkgdGhlIHN5c3RlbSBhZG1pbmlzdHJh dG9yIGlzIHRoZW4gYXZhaWxhYmxlIGZvcg0KICAgbmVnb3RpYXRpb24uICBJZiB0aGVyZSBpcyBh IGRlc2lyZSBmb3IgdGhlIGNhbGxlciB0byBtYWtlIGl0cyBvd24NCiAgIGNob2ljZSwgdGhlbiBh biBhZGRpdGlvbmFsIEFQSSBoYXMgdG8gYmUgdXNlZCAoc2VlIEFwcGVuZGl4IEEpLg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgIEV4cGlyZXMgSnVu ZSAxLCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgOF0NCgwNCkludGVybmV0LURyYWZ0ICAg ICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0K DQoNCjQuICBUb2tlbiBEZWZpbml0aW9ucw0KDQogICBUaGUgdHlwZSBkZWZpbml0aW9ucyBpbiB0 aGlzIHNlY3Rpb24gYXNzdW1lIGFuIEFTTi4xIG1vZHVsZQ0KICAgZGVmaW5pdGlvbiBvZiB0aGUg Zm9sbG93aW5nIGZvcm06DQoNCg0KICAgICAgU1BORUdPQVNOT25lU3BlYyB7DQogICAgICAgICAg aXNvKDEpIGlkZW50aWZpZWQtb3JnYW5pemF0aW9uKDMpIGRvZCg2KSBpbnRlcm5ldCgxKQ0KICAg ICAgICAgIHNlY3VyaXR5KDUpIG1lY2hhbmlzbSg1KSBzbmVnbyAoMikgbW9kdWxlcyg0KSBzcGVj MigyKQ0KICAgICAgfSBERUZJTklUSU9OUyBFWFBMSUNJVCBUQUdTIDo6PSBCRUdJTg0KDQogICAg ICAtLSByZXN0IG9mIGRlZmluaXRpb25zIGhlcmUNCg0KICAgICAgRU5EDQoNCg0KICAgVGhpcyBz cGVjaWZpZXMgdGhhdCB0aGUgdGFnZ2luZyBjb250ZXh0IGZvciB0aGUgbW9kdWxlIHdpbGwgYmUN CiAgIGV4cGxpY2l0IGFuZCBub24tYXV0b21hdGljLg0KDQogICBUaGUgZW5jb2Rpbmcgb2YgU1BO RUdPIHByb3RvY29sIG1lc3NhZ2VzIHNoYWxsIG9iZXkgdGhlIERpc3Rpbmd1aXNoZWQNCiAgIEVu Y29kaW5nIFJ1bGVzIChERVIpIG9mIEFTTi4xIGFzIGRlc2NyaWJlZCBpbiBbWDY5MF0uDQoNCjQu MSAgTWVjaGFuaXNtIFR5cGVzDQoNCiAgIEluIHRoaXMgbmVnb3RpYXRpb24gbW9kZWwsIGVhY2gg T0lEIHJlcHJlc2VudHMgb25lIEdTUy1BUEkgbWVjaGFuaXNtDQogICBvciBvbmUgdmFyaWFudCAo c2VlIFNlY3Rpb24gNikgb2YgaXQgYWNjb3JkaW5nIHRvIFtSRkMyNzQzXS4NCg0KDQogICAgICAg TWVjaFR5cGUgOjo9IE9CSkVDVCBJREVOVElGSUVSDQogICAgICAgICAgIC0tIE9JRCByZXByZXNl bnRzIGVhY2ggc2VjdXJpdHkgbWVjaGFuaXNtIGFzIHN1Z2dlc3RlZCBieQ0KICAgICAgICAgICAt LSBbUkZDMjc0M10NCg0KICAgICAgIE1lY2hUeXBlTGlzdCA6Oj0gU0VRVUVOQ0UgT0YgTWVjaFR5 cGUNCg0KDQo0LjIgIE5lZ290aWF0aW9uIFRva2Vucw0KDQogICBUaGUgc3ludGF4IG9mIHRoZSBp bml0aWFsIG5lZ290aWF0aW9uIHRva2VucyBmb2xsb3dzIHRoZQ0KICAgaW5pdGlhbENvbnRleHRU b2tlbiBzeW50YXggZGVmaW5lZCBpbiBTZWN0aW9uIDMuMSBvZiBbUkZDMjc0M10uICBUaGUNCiAg IFNQTkVHTyBwc2V1ZG8gbWVjaGFuaXNtIGlzIGlkZW50aWZpZWQgYnkgdGhlIE9iamVjdCBJZGVu dGlmaWVyDQogICBzcGVjaWZpZWQgaW4gU2VjdGlvbiAxLiAgU3Vic2VxdWVudCB0b2tlbnMgYXJl IG5vdCBlbmNhcHN1bGF0ZWQgaW4NCiAgIHRoaXMgR1NTLUFQSSBnZW5lcmljIHRva2VuIGZyYW1p bmcuDQoNCiAgIFRoaXMgc2VjdGlvbiBzcGVjaWZpZXMgdGhlIHN5bnRheCBvZiB0aGUgaW5uZXIg dG9rZW4gZm9yIHRoZSBpbml0aWFsDQogICBtZXNzYWdlIGFuZCB0aGUgc3ludGF4IG9mIHN1YnNl cXVlbnQgY29udGV4dCBlc3RhYmxpc2htZW50IHRva2Vucy4NCg0KICAgICAgIE5lZ290aWF0aW9u VG9rZW4gOjo9IENIT0lDRSB7DQogICAgICAgICAgIG5lZ1Rva2VuSW5pdCAgICBbMF0gTmVnVG9r ZW5Jbml0LA0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwg MjAwNSAgICAgICAgICAgICAgICAgIFtQYWdlIDldDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBH U1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQog ICAgICAgICAgIG5lZ1Rva2VuUmVzcCAgICBbMV0gbmVnVG9rZW5SZXNwDQogICAgICAgfQ0KDQoN Cg0KNC4yLjEgIG5lZ1Rva2VuSW5pdA0KDQogICAgICAgTmVnVG9rZW5Jbml0IDo6PSBTRVFVRU5D RSB7DQogICAgICAgICAgIG1lY2hUeXBlcyAgICAgICBbMF0gTWVjaFR5cGVMaXN0LA0KICAgICAg ICAgICByZXFGbGFncyAgICAgICAgWzFdIENvbnRleHRGbGFncyAgT1BUSU9OQUwsDQogICAgICAg ICAgIG1lY2hUb2tlbiAgICAgICBbMl0gT0NURVQgU1RSSU5HICBPUFRJT05BTCwNCiAgICAgICAg ICAgbWVjaExpc3RNSUMgICAgIFszXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLA0KICAgICAgICAg ICAuLi4NCiAgICAgICB9DQogICAgICAgQ29udGV4dEZsYWdzIDo6PSBCSVQgU1RSSU5HIHsNCiAg ICAgICAgICAgZGVsZWdGbGFnICAgICAgICgwKSwNCiAgICAgICAgICAgbXV0dWFsRmxhZyAgICAg ICgxKSwNCiAgICAgICAgICAgcmVwbGF5RmxhZyAgICAgICgyKSwNCiAgICAgICAgICAgc2VxdWVu Y2VGbGFnICAgICgzKSwNCiAgICAgICAgICAgYW5vbkZsYWcgICAgICAgICg0KSwNCiAgICAgICAg ICAgY29uZkZsYWcgICAgICAgICg1KSwNCiAgICAgICAgICAgaW50ZWdGbGFnICAgICAgICg2KQ0K ICAgICAgIH0NCg0KICAgVGhpcyBpcyB0aGUgc3ludGF4IGZvciB0aGUgaW5uZXIgdG9rZW4gb2Yg dGhlIGluaXRpYWwgbmVnb3RpYXRpb24NCiAgIG1lc3NhZ2UuDQoNCiAgIG1lY2hUeXBlcw0KDQog ICAgICAgICBUaGlzIGZpZWxkIGNvbnRhaW5zIG9uZSBvciBtb3JlIHNlY3VyaXR5IG1lY2hhbmlz bXMgYXZhaWxhYmxlDQogICAgICAgICBmb3IgdGhlIGluaXRpYXRvciBpbiBkZWNyZWFzaW5nIHBy ZWZlcmVuY2Ugb3JkZXIgKGZhdm9yaXRlDQogICAgICAgICBjaG9pY2UgZmlyc3QpLg0KDQogICBy ZXFGbGFncw0KDQogICAgICAgICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyB0aGUg c2VydmljZSBvcHRpb25zIHRoYXQgYXJlDQogICAgICAgICByZXF1ZXN0ZWQgdG8gZXN0YWJsaXNo IHRoZSBjb250ZXh0LiAgVGhlIGNvbnRleHQgZmxhZ3MgU0hPVUxEDQogICAgICAgICBiZSBmaWxs ZWQgaW4gZnJvbSB0aGUgcmVxX2ZsYWdzIHBhcmFtZXRlciBvZg0KICAgICAgICAgR1NTX0luaXRf c2VjX2NvbnRleHQoKS4gIFRoaXMgZmllbGQgU0hBTEwgTk9UIGhhdmUgaW1wYWN0IG9uDQogICAg ICAgICB0aGUgbmVnb3RpYXRpb24uDQoNCiAgIG1lY2hUb2tlbg0KDQogICAgICAgICBUaGlzIGZp ZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyB0aGUgb3B0aW1pc3RpYyBtZWNoYW5pc20NCiAgICAg ICAgIHRva2VuLg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVz IEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMTBdDQoMDQpJbnRlcm5ldC1EcmFm dCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIw MDQNCg0KDQogICBtZWNobGlzdE1JQw0KDQogICAgICAgICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50 LCBjb250YWlucyBhIE1JQyB0b2tlbiBmb3IgdGhlIG1lY2hhbmlzbQ0KICAgICAgICAgbGlzdCBp biB0aGUgaW5pdGlhbCBuZWdvdGlhdGlvbiBtZXNzYWdlLiAgVGhpcyBNSUMgdG9rZW4gaXMNCiAg ICAgICAgIGNvbXB1dGVkIGFjY29yZGluZyB0byBTZWN0aW9uIDUuDQoNCg0KNC4yLjIgIG5lZ1Rv a2VuUmVzcA0KDQogICAgICAgTmVnVG9rZW5SZXNwIDo6PSBTRVFVRU5DRSB7DQogICAgICAgICAg IG5lZ1Jlc3VsdCAgICAgICBbMF0gRU5VTUVSQVRFRCB7DQogICAgICAgICAgICAgICBhY2NlcHRf Y29tcGxldGVkICAgICgwKSwNCiAgICAgICAgICAgICAgIGFjY2VwdF9pbmNvbXBsZXRlICAgKDEp LA0KICAgICAgICAgICAgICAgcmVqZWN0ICAgICAgICAgICAgICAoMiksDQogICAgICAgICAgICAg ICByZXF1ZXN0X21pYyAgICAgICAgICgzKQ0KICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgT1BUSU9OQUwsDQogICAgICAgICAgICAgLS0gUkVRVUlSRUQgaW4gdGhl IGZpcnN0IHJlcGx5IGZyb20gdGhlIHRhcmdldA0KICAgICAgICAgICBzdXBwb3J0ZWRNZWNoICAg WzFdIE1lY2hUeXBlICAgICAgT1BUSU9OQUwsDQogICAgICAgICAgICAgLS0gcHJlc2VudCBvbmx5 IGluIHRoZSBmaXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQNCiAgICAgICAgICAgcmVzcG9uc2VU b2tlbiAgIFsyXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLA0KICAgICAgICAgICBtZWNoTGlzdE1J QyAgICAgWzNdIE9DVEVUIFNUUklORyAgT1BUSU9OQUwsDQogICAgICAgICAgIC4uLg0KICAgICAg IH0NCg0KICAgVGhpcyBpcyB0aGUgc3ludGF4IGZvciBhbGwgc3Vic2VxdWVudCBuZWdvdGlhdGlv biBtZXNzYWdlcy4NCg0KICAgbmVnUmVzdWx0DQoNCiAgICAgICAgIFRoaXMgZmllbGQsIGlmIHBy ZXNlbnQsIGNvbnRhaW5zIHRoZSBzdGF0ZSBvZiB0aGUgbmVnb3RpYXRpb24uDQogICAgICAgICBU aGlzIGNhbiBiZToNCg0KICAgICAgICAgYWNjZXB0X2NvbXBsZXRlZA0KDQogICAgICAgICAgICBO byBmdXJ0aGVyIG5lZ290aWF0aW9uIG1lc3NhZ2UgZnJvbSB0aGUgcGVlciBpcyBleHBlY3RlZCwN CiAgICAgICAgICAgIGFuZCB0aGUgc2VjdXJpdHkgY29udGV4dCBpcyBlc3RhYmxpc2hlZCBmb3Ig dGhlIHNlbmRlci4NCg0KICAgICAgICAgYWNjZXB0X2luY29tcGxldGUNCg0KICAgICAgICAgICAg QXQgbGVhc3Qgb25lIG1vcmUgbmVnb3RpYXRpb24gbWVzc2FnZSBmcm9tIHRoZSBwZWVyIGlzDQog ICAgICAgICAgICBuZWVkZWQgdG8gZXN0YWJsaXNoIHRoZSBzZWN1cml0eSBjb250ZXh0Lg0KDQog ICAgICAgICByZWplY3QNCg0KICAgICAgICAgICAgVGhlIHNlbmRlciB0ZXJtaW5hdGVzIHRoZSBu ZWdvdGlhdGlvbi4NCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBp cmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMTFdDQoMDQpJbnRlcm5ldC1E cmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVy IDIwMDQNCg0KDQogICAgICAgICByZXF1ZXN0X21pYw0KDQogICAgICAgICAgICBUaGUgc2VuZGVy IGluZGljYXRlcyB0aGF0IHRoZSBleGNoYW5nZSBvZiBNSUMgdG9rZW5zLCBhcw0KICAgICAgICAg ICAgZGVzY3JpYmVkIGluIFNlY3Rpb24gNSwgd2lsbCBiZSBSRVFVSVJFRCBpZiBwZXItbWVzc2Fn ZQ0KICAgICAgICAgICAgaW50ZWdyaXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhlIG1l Y2hhbmlzbSBjb250ZXh0IHRvDQogICAgICAgICAgICBiZSBlc3RhYmxpc2hlZC4gIFRoaXMgdmFs dWUgU0hBTEwgb25seSBiZSBwcmVzZW50IGluIHRoZQ0KICAgICAgICAgICAgZmlyc3QgcmVwbHkg ZnJvbSB0aGUgdGFyZ2V0Lg0KDQogICAgICAgICBUaGlzIGZpZWxkIGlzIFJFUVVJUkVEIGluIHRo ZSBmaXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQsIGFuZA0KICAgICAgICAgaXQgaXMgT1BUSU9O QUwgdGhlcmVhZnRlci4NCg0KICAgc3VwcG9ydGVkTWVjaA0KDQogICAgICAgICBUaGlzIGZpZWxk IFNIQUxMIG9ubHkgYmUgcHJlc2VudCBpbiB0aGUgZmlyc3QgcmVwbHkgZnJvbSB0aGUNCiAgICAg ICAgIHRhcmdldC4gIEl0IE1VU1QgYmUgb25lIG9mIHRoZSBtZWNoYW5pc20ocykgb2ZmZXJlZCBi eSB0aGUNCiAgICAgICAgIGluaXRpYXRvci4NCg0KICAgUmVzcG9uc2VUb2tlbg0KDQogICAgICAg ICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyB0b2tlbnMgc3BlY2lmaWMgdG8gdGhl DQogICAgICAgICBtZWNoYW5pc20gc2VsZWN0ZWQuDQoNCiAgIG1lY2hsaXN0TUlDDQoNCiAgICAg ICAgIFRoaXMgZmllbGQsIGlmIHByZXNlbnQsIGNvbnRhaW5zIGEgTUlDIHRva2VuIGZvciB0aGUg bWVjaGFuaXNtDQogICAgICAgICBsaXN0IGluIHRoZSBpbml0aWFsIG5lZ290aWF0aW9uIG1lc3Nh Z2UuICBUaGlzIE1JQyB0b2tlbiBpcw0KICAgICAgICAgY29tcHV0ZWQgYWNjb3JkaW5nIHRvIFNl Y3Rpb24gNS4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN ClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAgICAg ICAgICAgIFtQYWdlIDEyXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlh dGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KNS4gIFByb2Nlc3Npbmcg b2YgbWVjaExpc3RNSUMNCg0KICAgSWYgdGhlIG1lY2hhbmlzbSBzZWxlY3RlZCBieSB0aGUgbmVn b3RpYXRpb24gZG9lcyBub3Qgc3VwcG9ydA0KICAgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHRoZW4g bm8gbWVjaGxpc3RNSUMgdG9rZW4gaXMgdXNlZC4NCg0KICAgT3RoZXJ3aXNlIGlmIHRoZSBhY2Nl cHRlZCBtZWNoYW5pc20gaXMgdGhlIG1vc3QgcHJlZmVycmVkIG1lY2hhbmlzbQ0KICAgb2YgYm90 aCB0aGUgaW5pdGlhdG9yIGFuZCB0aGUgYWNjZXB0b3IsIHRoZW4gdGhlIE1JQyB0b2tlbiBleGNo YW5nZSwNCiAgIGFzIGRlc2NyaWJlZCBsYXRlciBpbiB0aGlzIHNlY3Rpb24sIGlzIE9QVElPTkFM LiAgQSBtZWNoYW5pc20gaXMgdGhlDQogICBhY2NlcHRvcidzIG1vc3QgcHJlZmVycmVkIG1lY2hh bmlzbSBpZiB0aGVyZSBpcyBubyBvdGhlciBtZWNoYW5pc20NCiAgIHdoaWNoIHdvdWxkIGhhdmUg YmVlbiBwcmVmZXJyZWQgb3ZlciB0aGUgYWNjZXB0ZWQgbWVjaGFuaXNtIGlmIGl0IGhhZA0KICAg YmVlbiBwcmVzZW50IGluIHRoZSByZWNlaXZlZCBtZWNoYW5pc20gbGlzdC4NCg0KICAgSW4gYWxs IG90aGVyIGNhc2VzLCBNSUMgdG9rZW5zIE1VU1QgYmUgZXhjaGFuZ2VkIGFmdGVyIHRoZSBtZWNo YW5pc20NCiAgIGNvbnRleHQgaXMgZnVsbHkgZXN0YWJsaXNoZWQuDQoNCiAgIEl0IGlzIGFzc3Vt ZWQgdGhhdCBwZXItbWVzc2FnZSBpbnRlZ3JpdHkgc2VydmljZXMgYXJlIGF2YWlsYWJsZSBvbg0K ICAgdGhlIGVzdGFibGlzaGVkIG1lY2hhbmlzbSBjb250ZXh0IGluIHRoZSBmb2xsb3dpbmcgcHJv Y2VkdXJlIGZvcg0KICAgcHJvY2Vzc2luZyBNSUMgdG9rZW5zIG9mIHRoZSBpbml0aWF0b3IncyBt ZWNoYW5pc20gbGlzdC4NCg0KICAgYSkgVGhlIG1lY2hsaXN0TUlDIHRva2VuIChvciBzaW1wbHkg dGhlIE1JQyB0b2tlbikgaXMgY29tcHV0ZWQgYnkNCiAgICAgIGludm9raW5nIEdTU19HZXRNSUMo KTogdGhlIGlucHV0IGNvbnRleHRfaGFuZGxlIGlzIHRoZSBlc3RhYmxpc2hlZA0KICAgICAgbWVj aGFuaXNtIGNvbnRleHQsIHRoZSBpbnB1dCBxb3BfcmVxIGlzIDAsIGFuZCB0aGUgaW5wdXQgbWVz c2FnZQ0KICAgICAgaXMgdGhlIG1lY2hUeXBlcyBmaWVsZCBpbiB0aGUgaW5pdGlhbCBuZWdvdGlh dGlvbiBtZXNzYWdlIChvbmx5DQogICAgICB0aGUgREVSIGVuY29kaW5nIG9mIHRoZSB0eXBlIE1l Y2hUeXBlTGlzdCBpcyBpbmNsdWRlZCkuDQoNCiAgIGIpIElmIHRoZSBzZWxlY3RlZCBtZWNoYW5p c20gdXNlcyBhbiBldmVuIG51bWJlciBvZiBtZWNoYW5pc20gdG9rZW5zDQogICAgICAobmFtZWx5 IHRoZSBhY2NlcHRvciBzZW5kcyB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW4pLCB0aGUgYWNjZXB0 b3INCiAgICAgIGRvZXMgdGhlIGZvbGxvd2luZyB3aGVuIGVtaXR0aW5nIHRoZSBuZWdvdGlhdGlv biBtZXNzYWdlDQogICAgICBjb250YWluaW5nIHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tlbjogaWYg dGhlIE1JQyB0b2tlbiBleGNoYW5nZSBpcw0KICAgICAgbm90IHJlcXVpcmVkLCBHU1NfQWNjZXB0 X3NlY19jb250ZXh0KCkgZWl0aGVyIGluZGljYXRlcw0KICAgICAgR1NTX1NfQ09NUExFVEUgYW5k IGRvZXMgbm90IGluY2x1ZGUgYSBtZWNobGlzdE1JQyB0b2tlbiwgb3INCiAgICAgIGluZGljYXRl cyBHU1NfU19DT05USU5VRV9ORUVERUQgYW5kIGluY2x1ZGVzIGEgbWVjaGxpc3RNSUMgdG9rZW4N CiAgICAgIGFuZCBhbiBhY2NlcHRfaW5jb21wbGV0ZSBzdGF0ZTsgaWYgdGhlIE1JQyB0b2tlbiBl eGNoYW5nZSBpcw0KICAgICAgcmVxdWlyZWQsIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRp Y2F0ZXMNCiAgICAgIEdTU19TX0NPTlRJTlVFX05FRURFRCwgYW5kIGluY2x1ZGVzIGEgbWVjaGxp c3RNSUMgdG9rZW4uDQogICAgICBBY2NlcHRvcnMgdGhhdCB3aXNoIHRvIGJlIGNvbXBhdGlibGUg d2l0aCBsZWdhY3kgV2luZG93cyBTUE5FR08NCiAgICAgIGltcGxlbWVudGF0aW9ucyBhcyBkZXNj cmliZWQgaW4gQXBwZW5kaXggQiBzaGFsbCBub3QgZ2VuZXJhdGUgYQ0KICAgICAgbWVjaGxpc3RN SUMgdG9rZW4gd2hlbiB0aGUgTUlDIHRva2VuIGV4Y2hhbmdlIGlzIG5vdCByZXF1aXJlZC4NCiAg ICAgIFRoZSBpbml0aWF0b3IgdGhlbiBwcm9jZXNzZXMgdGhlIGxhc3QgbWVjaGFuaXNtIHRva2Vu LCBhbmQgZG9lcw0KICAgICAgb25lIG9mIHRoZSBmb2xsb3dpbmc6DQoNCiAgICAgIChJKSBJZiBh IG1lY2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCwgYW5kIGlzIGNvcnJlY3RseQ0KICAgICAg ICAgdmVyaWZpZWQsIEdTU19Jbml0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzIEdTU19TX0NPTVBM RVRFLiAgVGhlDQogICAgICAgICBvdXRwdXQgbmVnb3RpYXRpb24gbWVzc2FnZSBjb250YWlucyBh IG1lY2hsaXN0TUlDIHRva2VuLCBhbmQgYW4NCiAgICAgICAgIGFjY2VwdF9jb21wbGV0ZSBzdGF0 ZS4gIFRoZSBhY2NlcHRvciBNVVNUIHRoZW4gdmVyaWZ5IHRoaXMNCiAgICAgICAgIG1lY2hsaXN0 TUlDIHRva2VuLg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBK dW5lIDEsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDEzXQ0KDA0KSW50ZXJuZXQtRHJhZnQg ICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0 DQoNCg0KICAgICAgKElJKSBJZiBhIG1lY2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCBidXQg aXMgaW5jb3JyZWN0LCB0aGUNCiAgICAgICAgIG5lZ290aWF0aW9uIFNIQUxMIGJlIHRlcm1pbmF0 ZWQuICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkNCiAgICAgICAgIGluZGljYXRlcyBHU1NfU19E RUZFQ1RJVkVfVE9LRU4uDQoNCiAgICAgIChJSUkpIElmIG5vIG1lY2hsaXN0TUlDIHRva2VuIHdh cyBpbmNsdWRlZCwgYW5kIHRoZSBNSUMgdG9rZW4NCiAgICAgICAgIGV4Y2hhbmdlIGlzIG5vdCBy ZXF1aXJlZCwgR1NTX0luaXRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMNCiAgICAgICAgIEdTU19T X0NPTVBMRVRFIHdpdGggbm8gb3V0cHV0IHRva2VuLg0KDQogICAgICAoSVYpIElmIG5vIG1lY2hs aXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCwgYnV0IHRoZSBNSUMgdG9rZW4NCiAgICAgICAgIGV4 Y2hhbmdlIGlzIHJlcXVpcmVkLCB0aGUgbmVnb3RpYXRpb24gU0hBTEwgYmUgdGVybWluYXRlZC4N CiAgICAgICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfREVGRUNU SVZFX1RPS0VOLg0KDQogICBjKSBJbiB0aGUgY2FzZSB0aGF0IHRoZSBjaG9zZW4gbWVjaGFuaXNt IHVzZXMgYW4gb2RkIG51bWJlciBvZg0KICAgICAgbWVjaGFuaXNtIHRva2VucyAobmFtZWx5IHRo ZSBpbml0aWF0b3Igc2VuZHMgdGhlIGxhc3QgbWVjaGFuaXNtDQogICAgICB0b2tlbiksIHRoZSBp bml0aWF0b3IgZG9lcyB0aGUgZm9sbG93aW5nIHdoZW4gZW1pdHRpbmcgdGhlDQogICAgICBuZWdv dGlhdGlvbiBtZXNzYWdlIGNvbnRhaW5pbmcgdGhlIGxhc3QgbWVjaGFuaXNtIHRva2VuOiBpZiB0 aGUNCiAgICAgIG5lZ1Jlc3VsdCBzdGF0ZSB3YXMgcmVxdWVzdF9taWMgaW4gdGhlIGZpcnN0IHJl cGx5IGZyb20gdGhlDQogICAgICB0YXJnZXQsIGEgbWVjaGxpc3RNSUMgdG9rZW4gTVVTVCBiZSBp bmNsdWRlZCwgb3RoZXJ3aXNlIHRoZQ0KICAgICAgbWVjaGxpc3RNSUMgdG9rZW4gaXMgT1BUSU9O QUwuICBJbiB0aGUgY2FzZSB0aGF0IHRoZSBvcHRpbWlzdGljDQogICAgICBtZWNoYW5pc20gdG9r ZW4gaXMgdGhlIG9ubHkgbWVjaGFuaXNtIHRva2VuIGZvciB0aGUgaW5pdGlhdG9yJ3MNCiAgICAg IHByZWZlcnJlZCBtZWNoYW5pc20sIHRoZSBtZWNobGlzdE1JQyB0b2tlbiBpcyBPUFRJT05BTC4N CiAgICAgIEdTU19Jbml0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzIEdTU19TX0NPTlRJTlVFX05F RURFRC4NCiAgICAgIEluaXRpYXRvcnMgdGhhdCB3aXNoIHRvIGJlIGNvbXBhdGlibGUgd2l0aCBs ZWdhY3kgV2luZG93cyBTUE5FR08NCiAgICAgIGltcGxlbWVudGF0aW9ucyBhcyBkZXNjcmliZWQg aW4gQXBwZW5kaXggQiBzaGFsbCBub3QgZ2VuZXJhdGUgYQ0KICAgICAgbWVjaGxpc3RNSUMgdG9r ZW4gd2hlbiB0aGUgTUlDIHRva2VuIGV4Y2hhbmdlIGlzIG5vdCByZXF1aXJlZC4NCiAgICAgIFRo ZSBhY2NlcHRvciB0aGVuIHByb2Nlc3NlcyB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW4gYW5kIGRv ZXMgb25lDQogICAgICBvZiB0aGUgZm9sbG93aW5nOg0KDQogICAgICAoSSkgSWYgYSBtZWNobGlz dE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQgYW5kIGlzIGNvcnJlY3RseSB2ZXJpZmllZCwNCiAgICAg ICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfQ09NUExFVEUuICBU aGUgb3V0cHV0DQogICAgICAgICBuZWdvdGlhdGlvbiBtZXNzYWdlIGNvbnRhaW5zIGEgbWVjaGxp c3RNSUMgdG9rZW4gYW5kIGFuDQogICAgICAgICBhY2NlcHRfY29tcGxldGUgc3RhdGUuICBUaGUg aW5pdGlhdG9yIE1VU1QgdGhlbiB2ZXJpZnkgdGhpcw0KICAgICAgICAgbWVjaGxpc3RNSUMgdG9r ZW4uDQoNCiAgICAgIChJSSkgSWYgYSBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQgYnV0 IGlzIGluY29ycmVjdCwgdGhlDQogICAgICAgICBuZWdvdGlhdGlvbiBTSEFMTCBiZSB0ZXJtaW5h dGVkLiAgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgpDQogICAgICAgICBpbmRpY2F0ZXMgR1NTX1Nf REVGRUNUSVZFX1RPS0VOLg0KDQogICAgICAoSUlJKSBJZiBubyBtZWNobGlzdE1JQyB0b2tlbiB3 YXMgaW5jbHVkZWQgYnV0IHRoZSBtZWNobGlzdE1JQw0KICAgICAgICAgdG9rZW4gZXhjaGFuZ2Ug aXMgbm90IHJlcXVpcmVkLCBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkNCiAgICAgICAgIGluZGlj YXRlcyBHU1NfU19DT01QTEVURS4gIFRoZSBvdXRwdXQgbmVnb3RpYXRpb24gbWVzc2FnZQ0KICAg ICAgICAgY29udGFpbnMgYW4gYWNjZXB0X2NvbXBsZXRlIHN0YXRlLg0KDQogICAgICAoSVYpIElu IHRoZSBjYXNlIHRoYXQgdGhlIG9wdGltaXN0aWMgbWVjaGFuaXNtIHRva2VuIGlzIGFsc28gdGhl DQogICAgICAgICBsYXN0IG1lY2hhbmlzbSB0b2tlbiAod2hlbiB0aGUgaW5pdGlhdG9yJ3MgcHJl ZmVycmVkIG1lY2hhbmlzbQ0KICAgICAgICAgaXMgYWNjZXB0ZWQgYnkgdGhlIHRhcmdldCkgYW5k IHRoZSB0YXJnZXQgc2VuZHMgYSByZXF1ZXN0X21pYw0KICAgICAgICAgc3RhdGUgYnV0IHRoZSBp bml0aWF0b3IgZGlkIG5vdCBzZW5kIGEgbWVjaGxpc3RNSUMgdG9rZW4sIHRoZQ0KICAgICAgICAg dGFyZ2V0IHRoZW4gTVVTVCBpbmNsdWRlIGEgbWVjaGxpc3RNSUMgdG9rZW4gaW4gdGhhdCBmaXJz dA0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAg ICAgICAgICAgICAgICAgW1BhZ2UgMTRdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJ IE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICAgICAg ICByZXBseS4gIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMNCiAgICAgICAgIEdT U19TX0NPTlRJTlVFX05FRURFRC4gIFRoZSBpbml0aWF0b3IgTVVTVCB2ZXJpZnkgdGhlIHJlY2Vp dmVkDQogICAgICAgICBtZWNobGlzdE1JQyB0b2tlbiBhbmQgZ2VuZXJhdGUgYSBtZWNobGlzdE1J QyB0b2tlbiB0byBzZW5kIGJhY2sNCiAgICAgICAgIHRvIHRoZSB0YXJnZXQuICBUaGUgdGFyZ2V0 IFNIQUxMIGluIHR1cm4gdmVyaWZ5IHRoZSByZXR1cm5lZA0KICAgICAgICAgbWVjaGxpc3RNSUMg dG9rZW4gYW5kIGNvbXBsZXRlIHRoZSBuZWdvdGlhdGlvbi4NCg0KICAgICAgKFYpIElmIG5vIG1l Y2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCBhbmQgdGhlIGFjY2VwdG9yIHNlbnQgYQ0KICAg ICAgICAgcmVxdWVzdF9taWMgc3RhdGUgaW4gdGhlIGZpcnN0IHJlcGx5IG1lc3NhZ2UgKHRoZSBl eGNoYW5nZSBvZg0KICAgICAgICAgTUlDIHRva2VucyBpcyByZXF1aXJlZCksIHRoZSBuZWdvdGlh dGlvbiBTSEFMTCBiZSB0ZXJtaW5hdGVkLg0KICAgICAgICAgR1NTX0FjY2VwdF9zZWNfY29udGV4 dCgpIGluZGljYXRlcyBHU1NfU19ERUZFQ1RJVkVfVE9LRU4uDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAg ICAgICAgICAgICAgW1BhZ2UgMTVdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5l Z290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQo2LiAgRXh0ZW5z aWJpbGl0eQ0KDQogICBUd28gbWVjaGFuaXNtcyBhcmUgcHJvdmlkZWQgZm9yIGV4dGVuc2liaWxp dHkuICBGaXJzdCwgdGhlIEFTTi4xDQogICBzdHJ1Y3R1cmVzIGluIHRoaXMgc3BlY2lmaWNhdGlv biBNQVkgYmUgZXhwYW5kZWQgYnkgSUVURiBzdGFuZGFyZHMNCiAgIGFjdGlvbi4gIEltcGxlbWVu dGF0aW9ucyByZWNlaXZpbmcgdW5rbm93biBmaWVsZHMgTVVTVCBpZ25vcmUgdGhlc2UNCiAgIGZp ZWxkcy4NCg0KICAgU2Vjb25kbHksIE9JRHMgY29ycmVzcG9uZGluZyB0byBhIGRlc2lyZWQgbWVj aGFuaXNtIGF0dHJpYnV0ZSBtYXkgYmUNCiAgIGluY2x1ZGVkIGluIHRoZSBzZXQgb2YgcHJlZmVy cmVkIG1lY2hhbmlzbXMgYnkgYW4gaW5pdGlhdG9yLiAgVGhlDQogICBhY2NlcHRvciBjYW4gY2hv b3NlIHRvIGhvbm9yIHRoaXMgcmVxdWVzdCBieSBwcmVmZXJyaW5nIG1lY2hhbmlzbXMNCiAgIHRo YXQgaGF2ZSB0aGUgaW5jbHVkZWQgYXR0cmlidXRlcy4gIEZ1dHVyZSB3b3JrIHdpdGhpbiB0aGUg S2l0dGVuDQogICB3b3JraW5nIGdyb3VwIGlzIGV4cGVjdGVkIHRvIHN0YW5kYXJkaXplIGNvbW1v biBhdHRyaWJ1dGVzIHRoYXQNCiAgIFNQTkVHTyBtZWNoYW5pc21zIG1heSB3aXNoIHRvIHN1cHBv cnQuICBBdCB0aGlzIHRpbWUgaXQgaXMgc3VmZmljaWVudA0KICAgdG8gc2F5IHRoYXQgaW5pdGlh dG9ycyBNQVkgaW5jbHVkZSBPSURzIHRoYXQgZG8gbm90IGNvcnJlc3BvbmQgdG8NCiAgIG1lY2hh bmlzbXMgYnV0IGluc3RlYWQgY29ycmVzcG9uZCB0byBkZXNpcmVkIG1lY2hhbmlzbSBhdHRyaWJ1 dGVzIGluDQogICB0aGVpciByZXF1ZXN0cy4gIFN1Y2ggT0lEcyBNQVkgaW5mbHVlbmNlIHRoZSBh Y2NlcHRvcidzIGNob2ljZSBvZg0KICAgbWVjaGFuaXNtLiAgQXMgZGlzY3Vzc2VkIGluIFNlY3Rp b24gNSwgaWYgdGhlcmUgYXJlIG1lY2hhbmlzbXMgdGhhdA0KICAgaWYgcHJlc2VudCBpbiB0aGUg aW5pdGlhdG9yJ3MgbGlzdCBvZiBtZWNoYW5pc21zIG1pZ2h0IGJlIHByZWZlcnJlZA0KICAgYnkg dGhlIGFjY2VwdG9yIHRvIHRoZSBpbml0aWF0b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNtLCB0aGUg YWNjZXB0b3INCiAgIE1VU1QgZGVtYW5kIHRoZSBNSUMgdG9rZW4gZXhjaGFuZ2UuICBBcyBhIGNv bnNlcXVlbmNlLCBhY2NlcHRvcnMgTVVTVA0KICAgZGVtYW5kIHRoZSBNSUMgdG9rZW4gZXhjaGFu Z2UgaWYgdGhleSBzdXBwb3J0IG5lZ290aWF0aW9uIG9mDQogICBhdHRyaWJ1dGVzIG5vdCBhdmFp bGFibGUgaW4gdGhlIGluaXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5pc20NCiAgIHJlZ2FyZGxl c3Mgb2Ygd2hldGhlciB0aGUgaW5pdGlhdG9yIGFjdHVhbGx5IHJlcXVlc3RlZCB0aGVzZQ0KICAg YXR0cmlidXRlcy4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUg ICAgICAgICAgICAgICAgIFtQYWdlIDE2XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQ SSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KNy4gIFNl Y3VyaXR5IENvbnNpZGVyYXRpb25zDQoNCiAgIEluIG9yZGVyIHRvIHByb2R1Y2UgdGhlIE1JQyB0 b2tlbiBmb3IgdGhlIG1lY2hhbmlzbSBsaXN0LCB0aGUNCiAgIG1lY2hhbmlzbSBtdXN0IHByb3Zp ZGUgaW50ZWdyaXR5IHByb3RlY3Rpb24uICBXaGVuIHRoZSBzZWxlY3RlZA0KICAgbWVjaGFuaXNt IGRvZXMgbm90IHN1cHBvcnQgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHRoZSBuZWdvdGlhdGlvbiBp cw0KICAgdnVsbmVyYWJsZTogYW4gYWN0aXZlIGF0dGFja2VyIGNhbiBmb3JjZSBpdCB0byB1c2Ug YSBzZWN1cml0eQ0KICAgbWVjaGFuaXNtIHRoYXQgaXMgbm90IG11dHVhbGx5IHByZWZlcnJlZCBi dXQgaXMgYWNjZXB0YWJsZSB0byB0aGUNCiAgIHRhcmdldC4NCg0KICAgVGhpcyBwcm90b2NvbCBw cm92aWRlcyB0aGUgZm9sbG93aW5nIGd1YXJhbnRlZXMgd2hlbiBwZXItbWVzc2FnZQ0KICAgaW50 ZWdyaXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhlIGVzdGFibGlzaGVkIG1lY2hhbmlz bSBjb250ZXh0DQogICBhbmQgdGhlIG1lY2hhbmlzbSBsaXN0IHdhcyBhbHRlcmVkIGJ5IGFuIGFk dmVyc2FyeSBzdWNoIHRoYXQgYQ0KICAgbWVjaGFuaXNtIHdoaWNoIGlzIG5vdCBtdXR1YWxseSBw cmVmZXJyZWQgY291bGQgYmUgc2VsZWN0ZWQ6DQoNCiAgIG8gIGlmIHRoZSBsYXN0IG1lY2hhbmlz bSB0b2tlbiBpcyBzZW50IGJ5IHRoZSBpbml0aWF0b3IsIGJvdGggcGVlcnMNCiAgICAgIHNoYWxs IGZhaWw7DQogICBvICBpZiB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW4gaXMgc2VudCBieSB0aGUg YWNjZXB0b3IsIHRoZSBhY2NlcHRvcg0KICAgICAgc2hhbGwgbm90IGNvbXBsZXRlIGFuZCB0aGUg aW5pdGlhdG9yIGF0IHdvcnN0IHNoYWxsIGNvbXBsZXRlIHdpdGgNCiAgICAgIGl0cyBwcmVmZXJy ZWQgbWVjaGFuaXNtIGJlaW5nIHNlbGVjdGVkLg0KDQogICBUaGUgbmVnb3RpYXRpb24gbWF5IG5v dCBiZSB0ZXJtaW5hdGVkIGlmIGFuIGFsdGVyYXRpb24gd2FzIG1hZGUgYnV0DQogICBpdCBoYWQg bm8gbWF0ZXJpYWwgaW1wYWN0Lg0KDQogICBUaGUgcHJvdGVjdGlvbiBvZiB0aGUgbmVnb3RpYXRp b24gZGVwZW5kcyBvbiB0aGUgc3RyZW5ndGggb2YgdGhlDQogICBpbnRlZ3JpdHkgcHJvdGVjdGlv bi4gIEluIHBhcnRpY3VsYXIsIHRoZSBzdHJlbmd0aCBvZiBTUE5FR08gaXMgbm8NCiAgIHN0cm9u Z2VyIHRoYW4gdGhlIGludGVncml0eSBwcm90ZWN0aW9uIG9mIHRoZSB3ZWFrZXN0IG1lY2hhbmlz bQ0KICAgYWNjZXB0YWJsZSB0byBHU1MtQVBJIHBlZXJzLg0KDQogICBJbiBhbGwgY2FzZXMsIHRo ZSBjb21tdW5pY2F0aW5nIHBlZXJzIGFyZSBleHBvc2VkIHRvIHRoZSBkZW5pYWwgb2YNCiAgIHNl cnZpY2UgdGhyZWF0Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K Wmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAg ICAgICAgW1BhZ2UgMTddDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0 aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQo4LiAgSUFOQSBDb25zaWRl cmF0aW9ucw0KDQogICBUaGlzIGRvY3VtZW50IGhhcyBubyBhY3Rpb25zIGZvciBJQU5BLg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAg ICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMThdDQoMDQpJ bnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAg IERlY2VtYmVyIDIwMDQNCg0KDQo5LiAgQWNrbm93bGVkZ21lbnRzDQoNCiAgIFRoZSBhdXRob3Jz IHdpc2ggdG8gdGhhbmsgU2FtIEhhcnRtYW4sIE5pY29sYXMgV2lsbGlhbXMsIEtlbiBSYWVidXJu LA0KICAgSmVmZiBBbHRtYW4sIFRvbSBZdSwgQ3Jpc3RpYW4gSWxhYyBhbmQgTWFydGluIFJleCBm b3IgdGhlaXIgY29tbWVudHMNCiAgIGFuZCBzdWdnZXN0aW9ucyBkdXJpbmcgZGV2ZWxvcG1lbnQg b2YgdGhpcyBkb2N1bWVudC4NCg0KICAgTHVrZSBIb3dhcmQgcHJvdmlkZWQgYSBwcm90b3R5cGUg b2YgdGhpcyBwcm90b2NvbCBpbiBIZWltZGFsIGFuZA0KICAgcmVzb2x2ZWQgc2V2ZXJhbCBpc3N1 ZXMgaW4gdGhlIGluaXRpYWwgZHJhZnQuDQoNCiAgIEVyaWMgQmFpemUgYW5kIERlbmlzIFBpbmth cyB3cm90ZSB0aGUgb3JpZ2luYWwgU1BORUdPIHNwZWNpZmljYXRpb24NCiAgIFtSRkMyNDc4XSBv ZiB3aGljaCBzb21lIG9mIHRoZSB0ZXh0IGhhcyBiZWVuIHJldGFpbmVkIGluIHRoaXMNCiAgIGRv Y3VtZW50Lg0KDQoxMCAgTm9ybWF0aXZlIFJlZmVyZW5jZXMNCg0KICAgW1JGQzIxMTldICBCcmFk bmVyLCBTLiwgIktleSB3b3JkcyBmb3IgdXNlIGluIFJGQ3MgdG8gSW5kaWNhdGUNCiAgICAgICAg ICAgICAgUmVxdWlyZW1lbnQgTGV2ZWxzIiwgQkNQIDE0LCBSRkMgMjExOSwgTWFyY2ggMTk5Ny4N Cg0KICAgW1JGQzI0NzhdICBCYWl6ZSwgRS4gYW5kIEQuIFBpbmthcywgIlRoZSBTaW1wbGUgYW5k IFByb3RlY3RlZCBHU1MtQVBJDQogICAgICAgICAgICAgIE5lZ290aWF0aW9uIE1lY2hhbmlzbSIs IFJGQyAyNDc4LCBEZWNlbWJlciAxOTk4Lg0KDQogICBbUkZDMjc0M10gIExpbm4sIEouLCAiR2Vu ZXJpYyBTZWN1cml0eSBTZXJ2aWNlIEFwcGxpY2F0aW9uIFByb2dyYW0NCiAgICAgICAgICAgICAg SW50ZXJmYWNlIFZlcnNpb24gMiwgVXBkYXRlIDEiLCBSRkMgMjc0MywgSmFudWFyeSAyMDAwLg0K DQogICBbWDY5MF0gICAgIEFTTi4xIGVuY29kaW5nIHJ1bGVzOiBTcGVjaWZpY2F0aW9uIG9mIEJh c2ljIEVuY29kaW5nIA0KICAgICAgICAgICAgICBSdWxlcyAoQkVSKSwgQ2Fub25pY2FsIEVuY29k aW5nIFJ1bGVzIChDRVIpIGFuZCANCiAgICAgICAgICAgICAgRGlzdGluZ3Vpc2hlZCBFbmNvZGlu ZyBSdWxlcyAoREVSKSwgSVRVLVQgUmVjb21tZW5kYXRpb24gDQogICAgICAgICAgICAgIFguNjkw ICgxOTk3KSB8IElTTy9JRUMgSW50ZXJuYXRpb25hbCBTdGFuZGFyZCA4ODI1LTE6MTk5OC4NCg0K QXV0aG9ycycgQWRkcmVzc2VzDQoNCiAgIExhcnJ5IFpodQ0KICAgTWljcm9zb2Z0IENvcnBvcmF0 aW9uDQogICBPbmUgTWljcm9zb2Z0IFdheQ0KICAgUmVkbW9uZCwgV0EgIDk4MDUyDQogICBVUw0K DQogICBFTWFpbDogbHpodUBtaWNyb3NvZnQuY29tDQoNCg0KICAgUGF1bCBMZWFjaA0KICAgTWlj cm9zb2Z0IENvcnBvcmF0aW9uDQogICBPbmUgTWljcm9zb2Z0IFdheQ0KICAgUmVkbW9uZCwgV0Eg IDk4MDUyDQogICBVUw0KDQogICBFTWFpbDogcGF1bGxlQG1pY3Jvc29mdC5jb20NCg0KDQoNCg0K DQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxLCAyMDA1ICAg ICAgICAgICAgICAgICBbUGFnZSAxOV0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkg TmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCiAgIEthcnRo aWsgSmFnYW5hdGhhbg0KICAgTWljcm9zb2Z0IENvcnBvcmF0aW9uDQogICBPbmUgTWljcm9zb2Z0 IFdheQ0KICAgUmVkbW9uZCwgV0EgIDk4MDUyDQogICBVUw0KDQogICBFTWFpbDoga2FydGhpa2pA bWljcm9zb2Z0LmNvbQ0KDQoNCiAgIFd5bGx5cyBJbmdlcnNvbGwNCiAgIFN1biBNaWNyb3N5c3Rl bXMNCiAgIDE3NzUgV2llaGxlIEF2ZW51ZSwgMm5kIEZsb29yDQogICBSZXN0b24sIFZBICAyMDE5 MA0KICAgVVMNCg0KICAgRU1haWw6IHd5bGx5cy5pbmdlcnNvbGxAc3VuLmNvbQ0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAg ICAgICAgICAgIFtQYWdlIDIwXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdv dGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KQXBwZW5kaXggQS4g IEdTUy1BUEkgTmVnb3RpYXRpb24gU3VwcG9ydCBBUEkNCg0KICAgSW4gb3JkZXIgdG8gcHJvdmlk ZSB0byBhIEdTUy1BUEkgY2FsbGVyIChlaXRoZXIgdGhlIGluaXRpYXRvciBvciB0aGUNCiAgIHRh cmdldCBvciBib3RoKSB0aGUgYWJpbGl0eSB0byBjaG9vc2UgYW1vbmcgdGhlIHNldCBvZiBzdXBw b3J0ZWQNCiAgIG1lY2hhbmlzbXMgYSByZWR1Y2VkIHNldCBvZiBtZWNoYW5pc21zIGZvciBuZWdv dGlhdGlvbiwgdHdvDQogICBhZGRpdGlvbmFsIEFQSXMgYXJlIGRlZmluZWQ6DQoNCiAgIG8gIEdT U19HZXRfbmVnX21lY2hzKCkgaW5kaWNhdGVzIHRoZSBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNt cw0KICAgICAgYXZhaWxhYmxlIG9uIHRoZSBsb2NhbCBzeXN0ZW0gdG8gdGhlIGNhbGxlciBmb3Ig bmVnb3RpYXRpb24sIGJhc2VkDQogICAgICBvbiB0aGUgY3JlZGVudGlhbHMgYmVpbmcgdXNlZC4N CiAgIG8gIEdTU19TZXRfbmVnX21lY2hzKCkgc3BlY2lmaWVzIHRoZSBzZXQgb2Ygc2VjdXJpdHkg bWVjaGFuaXNtcyB0byBiZQ0KICAgICAgdXNlZCBvbiB0aGUgbG9jYWwgc3lzdGVtIGJ5IHRoZSBj YWxsZXIgZm9yIG5lZ290aWF0aW9uLCBmb3IgdGhlDQogICAgICBnaXZlbiBjcmVkZW50aWFscy4N Cg0KQS4xICBHU1NfU2V0X25lZ19tZWNocyBjYWxsDQoNCiAgIElucHV0czoNCg0KICAgbyAgY3Jl ZF9oYW5kbGUgQ1JFREVOVElBTCBIQU5ETEUsIC0tIE5VTEwgc3BlY2lmaWVzIGRlZmF1bHQNCiAg ICAgIC0tIGNyZWRlbnRpYWxzDQogICBvICBtZWNoX3NldCBTRVQgT0YgT0JKRUNUIElERU5USUZJ RVINCg0KICAgT3V0cHV0czoNCg0KICAgbyAgbWFqb3Jfc3RhdHVzIElOVEVHRVIsDQogICBvICBt aW5vcl9zdGF0dXMgSU5URUdFUg0KDQogICBSZXR1cm4gbWFqb3Jfc3RhdHVzIGNvZGVzOg0KDQog ICBvICBHU1NfU19DT01QTEVURSBpbmRpY2F0ZXMgdGhhdCB0aGUgc2V0IG9mIHNlY3VyaXR5IG1l Y2hhbmlzbXMNCiAgICAgIGF2YWlsYWJsZSBmb3IgbmVnb3RpYXRpb24gaGFzIGJlZW4gc2V0IHRv IG1lY2hfc2V0Lg0KICAgbyAgR1NTX1NfRkFJTFVSRSBpbmRpY2F0ZXMgdGhhdCB0aGUgcmVxdWVz dGVkIG9wZXJhdGlvbiBjb3VsZCBub3QgYmUNCiAgICAgIHBlcmZvcm1lZCBmb3IgcmVhc29ucyB1 bnNwZWNpZmllZCBhdCB0aGUgR1NTLUFQSSBsZXZlbC4NCg0KICAgQWxsb3dzIGNhbGxlcnMgdG8g c3BlY2lmeSB0aGUgc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMgdGhhdCBtYXkgYmUNCiAgIG5l Z290aWF0ZWQgd2l0aCB0aGUgY3JlZGVudGlhbCBpZGVudGlmaWVkIGJ5IGNyZWRfaGFuZGxlLiAg VGhpcyBjYWxsDQogICBpcyBpbnRlbmRlZCBmb3Igc3VwcG9ydCBvZiBzcGVjaWFsaXplZCBjYWxs ZXJzIHdobyBuZWVkIHRvIHJlc3RyaWN0DQogICB0aGUgc2V0IG9mIG5lZ290aWFibGUgc2VjdXJp dHkgbWVjaGFuaXNtcyBmcm9tIHRoZSBzZXQgb2YgYWxsDQogICBzZWN1cml0eSBtZWNoYW5pc21z IGF2YWlsYWJsZSB0byB0aGUgY2FsbGVyIChiYXNlZCBvbiBhdmFpbGFibGUNCiAgIGNyZWRlbnRp YWxzKS4gIE5vdGUgdGhhdCBpZiBtb3JlIHRoYW4gb25lIG1lY2hhbmlzbSBpcyBzcGVjaWZpZWQg aW4NCiAgIG1lY2hfc2V0LCB0aGUgb3JkZXIgaW4gd2hpY2ggdGhvc2UgbWVjaGFuaXNtcyBhcmUg c3BlY2lmaWVkIGltcGxpZXMgYQ0KICAgcmVsYXRpdmUgcHJlZmVyZW5jZS4NCg0KQS4yICBHU1Nf R2V0X25lZ19tZWNocyBjYWxsDQoNCiAgIElucHV0Og0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAg ICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDIx XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20g ICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAgbyAgY3JlZF9oYW5kbGUgQ1JFREVOVElBTCBI QU5ETEUgLS0gTlVMTCBzcGVjaWZpZXMgZGVmYXVsdA0KICAgICAgLS0gY3JlZGVudGlhbHMNCg0K ICAgT3V0cHV0czoNCg0KICAgbyAgbWFqb3Jfc3RhdHVzIElOVEVHRVIsDQogICBvICBtaW5vcl9z dGF0dXMgSU5URUdFUiwNCiAgIG8gIG1lY2hfc2V0IFNFVCBPRiBPQkpFQ1QgSURFTlRJRklFUg0K DQogICBSZXR1cm4gbWFqb3Jfc3RhdHVzIGNvZGVzOg0KDQogICBvICBHU1NfU19DT01QTEVURSBp bmRpY2F0ZXMgdGhhdCB0aGUgc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMNCiAgICAgIGF2YWls YWJsZSBmb3IgbmVnb3RpYXRpb24gaGFzIGJlZW4gcmV0dXJuZWQgaW4gbWVjaF9zZXQuDQogICBv ICBHU1NfU19GQUlMVVJFIGluZGljYXRlcyB0aGF0IHRoZSByZXF1ZXN0ZWQgb3BlcmF0aW9uIGNv dWxkIG5vdCBiZQ0KICAgICAgcGVyZm9ybWVkIGZvciByZWFzb25zIHVuc3BlY2lmaWVkIGF0IHRo ZSBHU1MtQVBJIGxldmVsLg0KDQogICBBbGxvd3MgY2FsbGVycyB0byBkZXRlcm1pbmUgdGhlIHNl dCBvZiBzZWN1cml0eSBtZWNoYW5pc21zIGF2YWlsYWJsZQ0KICAgZm9yIG5lZ290aWF0aW9uIHdp dGggdGhlIGNyZWRlbnRpYWwgaWRlbnRpZmllZCBieSBjcmVkX2hhbmRsZS4gIFRoaXMNCiAgIGNh bGwgaXMgaW50ZW5kZWQgZm9yIHN1cHBvcnQgb2Ygc3BlY2lhbGl6ZWQgY2FsbGVycyB3aG8gbmVl ZCB0bw0KICAgcmVkdWNlIHRoZSBzZXQgb2YgbmVnb3RpYWJsZSBzZWN1cml0eSBtZWNoYW5pc21z IGZyb20gdGhlIHNldCBvZg0KICAgc3VwcG9ydGVkIHNlY3VyaXR5IG1lY2hhbmlzbXMgYXZhaWxh YmxlIHRvIHRoZSBjYWxsZXIgKGJhc2VkIG9uDQogICBhdmFpbGFibGUgY3JlZGVudGlhbHMpLg0K DQogICBOb3RlOiBUaGUgR1NTX0luZGljYXRlX21lY2hzKCkgZnVuY3Rpb24gaW5kaWNhdGVzIHRo ZSBmdWxsIHNldCBvZg0KICAgbWVjaGFuaXNtIHR5cGVzIGF2YWlsYWJsZSBvbiB0aGUgbG9jYWwg c3lzdGVtLiAgU2luY2UgdGhpcyBjYWxsIGhhcw0KICAgbm8gaW5wdXQgcGFyYW1ldGVyLCB0aGUg cmV0dXJuZWQgc2V0IGlzIG5vdCBuZWNlc3NhcmlseSBhdmFpbGFibGUgZm9yDQogICBhbGwgY3Jl ZGVudGlhbHMuDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxLCAyMDA1ICAgICAgICAg ICAgICAgICBbUGFnZSAyMl0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3Rp YXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCkFwcGVuZGl4IEIuICBD aGFuZ2VzIHNpbmNlIFJGQzI0NzgNCg0KICAgICAgU1BORUdPIGltcGxlbWVudGF0aW9ucyBpbiBX aW5kb3dzIDIwMDAvV2luZG93cyBYUC9XaW5kb3dzIFNlcnZlcg0KICAgICAgMjAwMyBoYXZlIHRo ZSBmb2xsb3dpbmcgYmVoYXZpb3I6IG5vIG1lY2hsaXN0TUlDIGlzIHByb2R1Y2VkIGFuZA0KICAg ICAgbWVjaGxpc3RNSUMgaXMgbm90IHByb2Nlc3NlZCBpZiBvbmUgaXMgcHJvdmlkZWQ7IGlmIHRo ZSBpbml0aWF0b3INCiAgICAgIHNlbmRzIHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tlbiwgdGhlIGFj Y2VwdG9yIHdpbGwgc2VuZCBiYWNrIGENCiAgICAgIG5lZ290aWF0aW9uIHRva2VuIHdpdGggYW4g YWNjZXB0X2NvbXBsZXRlIHN0YXRlIGFuZCBubyBtZWNobGlzdE1JQw0KICAgICAgdG9rZW4uICBJ biBhZGRpdGlvbiwgdGhlIE9JRCAoMS4yLjg0MC40ODAxOC4xLjIuMikgY2FuIGJlIHVzZWQgdG8N CiAgICAgIGlkZW50aWZ5IHRoZSBHU1MtQVBJIEtlcmJlcm9zIFZlcnNpb24gNSBtZWNoYW5pc20u DQoNCiAgICAgIFRoZSBmb2xsb3dpbmcgY2hhbmdlcyBoYXZlIGJlZW4gbWFkZSB0byBiZSBjb21w YXRpYmxlIHdpdGggdGhlc2UNCiAgICAgIGxlZ2FjeSBpbXBsZW1lbnRhdGlvbnMuDQoNCiAgICAg ICogIE5lZ1Rva2VuVGFyZyBpcyBjaGFuZ2VkIHRvIG5lZ1Rva2VuUmVzcCBhbmQgaXQgaXMgdGhl IG1lc3NhZ2UNCiAgICAgICAgIGZvcm1hdCBmb3IgYWxsIHN1YnNlcXVlbnQgbmVnb3RpYXRpb24g dG9rZW5zLg0KICAgICAgKiAgTmVnVG9rZW5Jbml0IGlzIHRoZSBtZXNzYWdlIGZvciB0aGUgaW5p dGlhbCBuZWdvdGlhdGlvbiBtZXNzYWdlDQogICAgICAgICBhbmQgdGhhdCBtZXNzYWdlIG9ubHku DQogICAgICAqICBtZWNoVHlwZXMgaW4gbmVnVG9rZW5Jbml0IGlzIG5vdCBvcHRpb25hbC4NCiAg ICAgICogIFR3byBNSUMgdG9rZW5zIGFyZSBleGNoYW5nZWQsIG9uZSBpbiBlYWNoIGRpcmVjdGlv bi4NCiAgICAgICogIElmIHRoZSBzZWxlY3RlZCBtZWNoYW5pc20gaXMgYWxzbyB0aGUgbW9zdCBw cmVmZXJyZWQgbWVjaGFuaXNtDQogICAgICAgICBmb3IgYm90aCBwZWVycywgaXQgaXMgc2FmZSB0 byBvbWl0IHRoZSBNSUMgdG9rZW5zLg0KDQogICAgICBJZiBhdCBsZWFzdCBvbmUgb2YgdGhlIHR3 byBwZWVycyBpbXBsZW1lbnRzIHRoZSBwc2V1ZG8gbWVjaGFuaXNtDQogICAgICBpbiB0aGlzIGRv Y3VtZW50LCB0aGUgbmVnb3RpYXRpb24gaXMgcHJvdGVjdGVkLg0KDQogICAgICBUaGUgZm9sbG93 aW5nIGNoYW5nZXMgYXJlIHRvIGFkZHJlc3MgdGhlIHByb2JsZW1zIGluIFJGQyAyNDc4Lg0KDQog ICAgICAqICByZXFGbGFncyBpcyBub3QgcHJvdGVjdGVkIHRoZXJlZm9yZSBpdCBzaG91bGQgbm90 IGltcGFjdCB0aGUNCiAgICAgICAgIG5lZ290aWF0aW9uLg0KICAgICAgKiAgREVSIGVuY29kaW5n IGlzIHJlcXVpcmVkLg0KICAgICAgKiAgR1NTX0dldE1JQygpIGlucHV0IGlzIGNsYXJpZmllZC4N CiAgICAgICogIFBlci1tZXNzYWdlIGludGVncml0eSBzZXJ2aWNlcyBhcmUgcmVxdWVzdGVkIGZv ciB0aGUgbmVnb3RpYXRlZA0KICAgICAgICAgbWVjaGFuaXNtLg0KDQogICBBbiBpbXBsZW1lbnRh dGlvbiB0aGF0IGNvbmZvcm1zIHRvIHRoaXMgc3BlY2lmaWNhdGlvbiAgd2lsbCBub3QNCiAgIGlu dGVyb3BlcmF0ZSB3aXRoIGEgc3RyaWN0IDI3NDggaW1wbGVtZW50YXRpb24uICBFdmVuIGlmIHRo ZSBuZXcNCiAgIGltcGxlbWVudGF0aW9uIGFsd2F5cyBzZW5kcyBhIG1lY2hsaXN0TUlDIHRva2Vu LCBpdCB3aWxsIHN0aWxsIGZhaWwNCiAgIHRvIGludGVyb3BlcmF0ZS4gIElmIGl0IGlzIGEgc2Vy dmVyLCBpdCB3aWxsIGZhaWwgYmVjYXVzZSBpdCByZXF1ZXN0cw0KICAgYSBtZWNobGlzdE1JQyB0 b2tlbiB1c2luZyBhbiBvcHRpb24gdGhhdCBvbGRlciBpbXBsZW1lbnRhdGlvbnMgc2ltcGx5DQog ICBkbyBub3Qgc3VwcG9ydC4gIENsaWVudHMgd2lsbCB0ZW5kIHRvIGZhaWwgYXMgd2VsbC4NCg0K ICAgQXMgYW4gYWx0ZXJuYXRpdmUgdG8gdGhlIGFwcHJvYWNoIGNob3NlbiBpbiB0aGlzIHNwZWNp ZmljYXRpb24sIHdlDQogICBjb3VsZCBoYXZlIGRvY3VtZW50ZWQgYSBjb3JyZWN0IGJlaGF2aW9y IHRoYXQgaXMgZnVsbHkgYmFja3dhcmQNCiAgIGNvbXBhdGlibGUgd2l0aCBSRkMgMjQ3OCBhbmQg aW5jbHVkZWQgYW4gYXBwZW5kaXggb24gaG93IHRvDQogICBpbnRlcm9wZXJhdGUgd2l0aCBleGlz dGluZyBpbmNvcnJlY3QgaW1wbGVtZW50YXRpb25zIG9mIFJGQyAyNDc4Lg0KDQogICBBcyBhIHBy YWN0aWNhbCBtYXR0ZXIsIHRoZSBTUE5FR08gaW1wbGVtZW50ZXJzIHdpdGhpbiB0aGUgSUVURiBo YXZlDQogICB2YWx1ZWQgaW50ZXJvcGVyYWJpbGl0eSB3aXRoIHRoZSBNaWNyb3NvZnQgaW1wbGVt ZW50YXRpb25zLiAgV2Ugd2VyZQ0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBp cmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMjNdDQoMDQpJbnRlcm5ldC1E cmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVy IDIwMDQNCg0KDQogICB1bmFibGUgdG8gY2hvb3NlIHRvIG1haW50YWluIHJlYXNvbmFibGUgc2Vj dXJpdHkgZ3VhcmFudGVlcywgbWFpbnRhaW4NCiAgIGludGVyb3BlcmFiaWxpdHkgd2l0aCB0aGUg TWljcm9zb2Z0IGltcGxlbWVudGF0aW9ucyBhbmQgbWFpbnRhaW4NCiAgIGludGVyb3BlcmFiaWxp dHkgd2l0aCBjb3JyZWN0IGltcGxlbWVudGF0aW9ucyBvZiBSRkMgMjQ3OC4gIFRoZQ0KICAgd29y a2luZyBncm91cCB3YXMgbm90IGF3YXJlIG9mIGFueSBSRkMgMjQ3OCBpbXBsZW1lbnRhdGlvbnMu ICBFdmVuIGlmDQogICB0aGVyZSBhcmUgUkZDIDI0NzggaW1wbGVtZW50YXRpb25zLCBpdCBpcyB1 bmxpa2VseSB0aGF0IHRoZXkgd2lsbA0KICAgaW50ZXJvcGVyYXRlIGJlY2F1c2Ugb2YgYSBjcml0 aWNhbCBmbGF3IGluIHRoZSBkZXNjcmlwdGlvbiBvZiB0aGUNCiAgIGVuY29kaW5nIG9mIHRoZSBt ZWNoYW5pc20gbGlzdCBpbiBSRkMgMjQ3OC4NCg0KICAgV2l0aCB0aGUgYXBwcm9hY2ggdGFrZW4g aW4gdGhpcyBzcGVjaWZpY2F0aW9uLCB3ZSBnZXQgc2VjdXJpdHkNCiAgIGJldHdlZW4gbmV3IGlt cGxlbWVudGF0aW9ucyBhbGwgdGhlIHRpbWUgd2hpbGUgbWFpbnRhaW5pbmcNCiAgIGludGVyb3Bl cmFiaWxpdHkgd2l0aCB0aGUgaW1wbGVtZW50YXRpb25zIHdlIGhhdmUgd2l0aGluIHRoZSBJRVRG DQogICBjb21tdW5pdHkuICBUaGUgd29ya2luZyBncm91cCBiZWxpZXZlcyB0aGF0IHRoaXMganVz dGlmaWVzIGJyZWFraW5nDQogICBjb21wYXRpYmlsaXR5IHdpdGggYSBjb3JyZWN0IGltcGxlbWVu dGF0aW9uIG9mIFJGQyAyNDc4Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAg ICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDI0XQ0K DA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAg ICAgICBEZWNlbWJlciAyMDA0DQoNCg0KSW50ZWxsZWN0dWFsIFByb3BlcnR5IFN0YXRlbWVudA0K DQogICBUaGUgSUVURiB0YWtlcyBubyBwb3NpdGlvbiByZWdhcmRpbmcgdGhlIHZhbGlkaXR5IG9y IHNjb3BlIG9mIGFueQ0KICAgSW50ZWxsZWN0dWFsIFByb3BlcnR5IFJpZ2h0cyBvciBvdGhlciBy aWdodHMgdGhhdCBtaWdodCBiZSBjbGFpbWVkIHRvDQogICBwZXJ0YWluIHRvIHRoZSBpbXBsZW1l bnRhdGlvbiBvciB1c2Ugb2YgdGhlIHRlY2hub2xvZ3kgZGVzY3JpYmVkIGluDQogICB0aGlzIGRv Y3VtZW50IG9yIHRoZSBleHRlbnQgdG8gd2hpY2ggYW55IGxpY2Vuc2UgdW5kZXIgc3VjaCByaWdo dHMNCiAgIG1pZ2h0IG9yIG1pZ2h0IG5vdCBiZSBhdmFpbGFibGU7IG5vciBkb2VzIGl0IHJlcHJl c2VudCB0aGF0IGl0IGhhcw0KICAgbWFkZSBhbnkgaW5kZXBlbmRlbnQgZWZmb3J0IHRvIGlkZW50 aWZ5IGFueSBzdWNoIHJpZ2h0cy4gIEluZm9ybWF0aW9uDQogICBvbiB0aGUgcHJvY2VkdXJlcyB3 aXRoIHJlc3BlY3QgdG8gcmlnaHRzIGluIFJGQyBkb2N1bWVudHMgY2FuIGJlDQogICBmb3VuZCBp biBCQ1AgNzggYW5kIEJDUCA3OS4NCg0KICAgQ29waWVzIG9mIElQUiBkaXNjbG9zdXJlcyBtYWRl IHRvIHRoZSBJRVRGIFNlY3JldGFyaWF0IGFuZCBhbnkNCiAgIGFzc3VyYW5jZXMgb2YgbGljZW5z ZXMgdG8gYmUgbWFkZSBhdmFpbGFibGUsIG9yIHRoZSByZXN1bHQgb2YgYW4NCiAgIGF0dGVtcHQg bWFkZSB0byBvYnRhaW4gYSBnZW5lcmFsIGxpY2Vuc2Ugb3IgcGVybWlzc2lvbiBmb3IgdGhlIHVz ZSBvZg0KICAgc3VjaCBwcm9wcmlldGFyeSByaWdodHMgYnkgaW1wbGVtZW50ZXJzIG9yIHVzZXJz IG9mIHRoaXMNCiAgIHNwZWNpZmljYXRpb24gY2FuIGJlIG9idGFpbmVkIGZyb20gdGhlIElFVEYg b24tbGluZSBJUFIgcmVwb3NpdG9yeSBhdA0KICAgaHR0cDovL3d3dy5pZXRmLm9yZy9pcHIuDQoN CiAgIFRoZSBJRVRGIGludml0ZXMgYW55IGludGVyZXN0ZWQgcGFydHkgdG8gYnJpbmcgdG8gaXRz IGF0dGVudGlvbiBhbnkNCiAgIGNvcHlyaWdodHMsIHBhdGVudHMgb3IgcGF0ZW50IGFwcGxpY2F0 aW9ucywgb3Igb3RoZXIgcHJvcHJpZXRhcnkNCiAgIHJpZ2h0cyB0aGF0IG1heSBjb3ZlciB0ZWNo bm9sb2d5IHRoYXQgbWF5IGJlIHJlcXVpcmVkIHRvIGltcGxlbWVudA0KICAgdGhpcyBzdGFuZGFy ZC4gIFBsZWFzZSBhZGRyZXNzIHRoZSBpbmZvcm1hdGlvbiB0byB0aGUgSUVURiBhdA0KICAgaWV0 Zi1pcHJAaWV0Zi5vcmcuDQoNCg0KRGlzY2xhaW1lciBvZiBWYWxpZGl0eQ0KDQogICBUaGlzIGRv Y3VtZW50IGFuZCB0aGUgaW5mb3JtYXRpb24gY29udGFpbmVkIGhlcmVpbiBhcmUgcHJvdmlkZWQg b24gYW4NCiAgICJBUyBJUyIgYmFzaXMgYW5kIFRIRSBDT05UUklCVVRPUiwgVEhFIE9SR0FOSVpB VElPTiBIRS9TSEUgUkVQUkVTRU5UUw0KICAgT1IgSVMgU1BPTlNPUkVEIEJZIChJRiBBTlkpLCBU SEUgSU5URVJORVQgU09DSUVUWSBBTkQgVEhFIElOVEVSTkVUDQogICBFTkdJTkVFUklORyBUQVNL IEZPUkNFIERJU0NMQUlNIEFMTCBXQVJSQU5USUVTLCBFWFBSRVNTIE9SIElNUExJRUQsDQogICBJ TkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIEFOWSBXQVJSQU5UWSBUSEFUIFRIRSBVU0UgT0Yg VEhFDQogICBJTkZPUk1BVElPTiBIRVJFSU4gV0lMTCBOT1QgSU5GUklOR0UgQU5ZIFJJR0hUUyBP UiBBTlkgSU1QTElFRA0KICAgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgT1IgRklUTkVT UyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuDQoNCg0KQ29weXJpZ2h0IFN0YXRlbWVudA0KDQog ICBDb3B5cmlnaHQgKEMpIFRoZSBJbnRlcm5ldCBTb2NpZXR5ICgyMDA0KS4gIFRoaXMgZG9jdW1l bnQgaXMgc3ViamVjdA0KICAgdG8gdGhlIHJpZ2h0cywgbGljZW5zZXMgYW5kIHJlc3RyaWN0aW9u cyBjb250YWluZWQgaW4gQkNQIDc4LCBhbmQNCiAgIGV4Y2VwdCBhcyBzZXQgZm9ydGggdGhlcmVp biwgdGhlIGF1dGhvcnMgcmV0YWluIGFsbCB0aGVpciByaWdodHMuDQoNCg0KQWNrbm93bGVkZ21l bnQNCg0KICAgRnVuZGluZyBmb3IgdGhlIFJGQyBFZGl0b3IgZnVuY3Rpb24gaXMgY3VycmVudGx5 IHByb3ZpZGVkIGJ5IHRoZQ0KICAgSW50ZXJuZXQgU29jaWV0eS4NCg0KDQoNCg0KWmh1LCBldCBh bC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1Bh Z2UgMjVdDQoMDQoNCg== ------_=_NextPart_001_01C4D7F7.4AD44846 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten ------_=_NextPart_001_01C4D7F7.4AD44846-- From kitten-bounces@ietf.org Thu Dec 2 03:31:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA19417; Thu, 2 Dec 2004 03:31:15 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZmSO-0003bM-NB; Thu, 02 Dec 2004 03:36:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZlhg-0006Kd-H6; Thu, 02 Dec 2004 02:48:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZlSN-0003v7-4H for kitten@megatron.ietf.org; Thu, 02 Dec 2004 02:32:51 -0500 Received: from brazilnut.cc.columbia.edu (IDENT:cu41754@brazilnut.cc.columbia.edu [128.59.206.18]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA14311 for ; Thu, 2 Dec 2004 02:32:48 -0500 (EST) Received: from [192.168.1.10] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by brazilnut.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iB27WksW016756 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 2 Dec 2004 02:32:47 -0500 (EST) Message-ID: <41AEC571.3080502@columbia.edu> Date: Thu, 02 Dec 2004 02:34:09 -0500 From: Jeffrey Altman Organization: Mass User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: multipart/mixed; boundary="------------020402050907030303070208" X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.18 Subject: ID-submission:draft-ietf-kitten-2478bis-02.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: fabb04ee8d4d770ee4a46bb3c8a6eb1a This is a multi-part message in MIME format. --------------020402050907030303070208 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Larry posted this -02 draft to the list at 5pm EST and it has yet to arrive so I am forwarding it again. Jeffrey Altman --------------020402050907030303070208 Content-Type: message/rfc822; name="ID-submission:draft-ietf-kitten-2478bis-02.txt" Content-Disposition: inline; filename="ID-submission:draft-ietf-kitten-2478bis-02.txt" Return-Path: Received: from mail3.microsoft.com (mail3.microsoft.com [131.107.3.123]) by cranberry.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iB1MiNfk026995 for ; Wed, 1 Dec 2004 17:44:23 -0500 (EST) Received: from mailout2.microsoft.com ([157.54.1.120]) by mail3.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 1 Dec 2004 14:44:20 -0800 Received: from red-hub-03.redmond.corp.microsoft.com ([157.54.2.25]) by mailout2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 1 Dec 2004 14:44:20 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-03.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Wed, 1 Dec 2004 14:44:20 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Wed, 1 Dec 2004 14:44:19 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C4D7F7.4AD44846" Subject: ID-submission:draft-ietf-kitten-2478bis-02.txt Date: Wed, 1 Dec 2004 14:44:18 -0800 Message-ID: X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: ID-submission:draft-ietf-kitten-2478bis-02.txt thread-index: AcTQs3j/cb9xF6Q+Q+uPNk2+At7ebAAJrebAABUliSABLWSzcACEgV8Q From: "Liqiang\(Larry\) Zhu" To: Cc: "Jeffrey Altman" , "Wyllys Ingersoll" , X-OriginalArrivalTime: 01 Dec 2004 22:44:19.0865 (UTC) FILETIME=[4B9C6090:01C4D7F7] X-Spam-Score: 0 () X-Scanned-By: MIMEDefang 2.48 on 128.59.59.133 This is a multi-part message in MIME format. ------_=_NextPart_001_01C4D7F7.4AD44846 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable =20 RFC editors, This is an update for our existing document. This is a workinggroup document for the KITTEN workinggroup. ----------------------------------------------------------------- Title: The Simple and Protected GSS-API Negotiation Mechanism Authors: Zhu, L., Leach, P.J., Jaganathan, K., Ingersoll, W. Filename: draft-ietf-kitten-2478bis-02.txt Abstract: This document specifies a negotiation mechanism for the Generic Security Service Application Program Interface (GSS-API) which is described in RFC 2743. GSS-API peers can use this negotiation mechanism to choose from a common set of security mechanisms. Size: 25 pages Expiry: June 1, 2005 -------------------------------------------------------------- Changes since -01: mostly editorial changes proposed by Jeff, plus the proposed text in the end of appendix B. Thanks, -- Larry ------_=_NextPart_001_01C4D7F7.4AD44846 Content-Type: text/plain; name="draft-ietf-kitten-2478bis-02.txt" Content-Description: draft-ietf-kitten-2478bis-02.txt Content-Disposition: attachment; filename="draft-ietf-kitten-2478bis-02.txt" Content-Transfer-Encoding: base64 DQoNCk5FVFdPUksgV09SS0lORyBHUk9VUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEwuIFpodQ0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFAuIExlYWNoDQpPYnNvbGV0ZXM6IDI0NzggKGlm IGFwcHJvdmVkKSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEsuIEphZ2FuYXRoYW4NCkV4 cGlyZXM6IEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1pY3Jvc29m dCBDb3Jwb3JhdGlvbg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgVy4gSW5nZXJzb2xsDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFN1biBNaWNyb3N5c3RlbXMNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRGVjZW1iZXIg MSwgMjAwNA0KDQoNCiAgICAgICAgIFRoZSBTaW1wbGUgYW5kIFByb3RlY3RlZCBHU1MtQVBJIE5l Z290aWF0aW9uIE1lY2hhbmlzbQ0KICAgICAgICAgICAgICAgICAgICAgICBkcmFmdC1pZXRmLWtp dHRlbi0yNDc4YmlzDQoNClN0YXR1cyBvZiB0aGlzIE1lbW8NCg0KICAgVGhpcyBkb2N1bWVudCBp cyBhbiBJbnRlcm5ldC1EcmFmdCBhbmQgaXMgc3ViamVjdCB0byBhbGwgcHJvdmlzaW9ucw0KICAg b2Ygc2VjdGlvbiAzIG9mIFJGQyAzNjY3LiAgQnkgc3VibWl0dGluZyB0aGlzIEludGVybmV0LURy YWZ0LCBlYWNoDQogICBhdXRob3IgcmVwcmVzZW50cyB0aGF0IGFueSBhcHBsaWNhYmxlIHBhdGVu dCBvciBvdGhlciBJUFIgY2xhaW1zIG9mDQogICB3aGljaCBoZSBvciBzaGUgaXMgYXdhcmUgaGF2 ZSBiZWVuIG9yIHdpbGwgYmUgZGlzY2xvc2VkLCBhbmQgYW55IG9mDQogICB3aGljaCBoZSBvciBz aGUgYmVjb21lIGF3YXJlIHdpbGwgYmUgZGlzY2xvc2VkLCBpbiBhY2NvcmRhbmNlIHdpdGgNCiAg IFJGQyAzNjY4Lg0KDQogICBJbnRlcm5ldC1EcmFmdHMgYXJlIHdvcmtpbmcgZG9jdW1lbnRzIG9m IHRoZSBJbnRlcm5ldCBFbmdpbmVlcmluZw0KICAgVGFzayBGb3JjZSAoSUVURiksIGl0cyBhcmVh cywgYW5kIGl0cyB3b3JraW5nIGdyb3Vwcy4gIE5vdGUgdGhhdA0KICAgb3RoZXIgZ3JvdXBzIG1h eSBhbHNvIGRpc3RyaWJ1dGUgd29ya2luZyBkb2N1bWVudHMgYXMNCiAgIEludGVybmV0LURyYWZ0 cy4NCg0KICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBkcmFmdCBkb2N1bWVudHMgdmFsaWQgZm9yIGEg bWF4aW11bSBvZiBzaXggbW9udGhzDQogICBhbmQgbWF5IGJlIHVwZGF0ZWQsIHJlcGxhY2VkLCBv ciBvYnNvbGV0ZWQgYnkgb3RoZXIgZG9jdW1lbnRzIGF0IGFueQ0KICAgdGltZS4gIEl0IGlzIGlu YXBwcm9wcmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBhcyByZWZlcmVuY2UNCiAgIG1hdGVy aWFsIG9yIHRvIGNpdGUgdGhlbSBvdGhlciB0aGFuIGFzICJ3b3JrIGluIHByb2dyZXNzLiINCg0K ICAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC1EcmFmdHMgY2FuIGJlIGFjY2Vzc2VkIGF0 DQogICBodHRwOi8vd3d3LmlldGYub3JnL2lldGYvMWlkLWFic3RyYWN0cy50eHQuDQoNCiAgIFRo ZSBsaXN0IG9mIEludGVybmV0LURyYWZ0IFNoYWRvdyBEaXJlY3RvcmllcyBjYW4gYmUgYWNjZXNz ZWQgYXQNCiAgIGh0dHA6Ly93d3cuaWV0Zi5vcmcvc2hhZG93Lmh0bWwuDQoNCiAgIFRoaXMgSW50 ZXJuZXQtRHJhZnQgd2lsbCBleHBpcmUgb24gSnVuZSAxLCAyMDA1Lg0KDQpDb3B5cmlnaHQgTm90 aWNlDQoNCiAgIENvcHlyaWdodCAoQykgVGhlIEludGVybmV0IFNvY2lldHkgKDIwMDQpLg0KDQpB YnN0cmFjdA0KDQogICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBhIG5lZ290aWF0aW9uIG1lY2hh bmlzbSBmb3IgdGhlIEdlbmVyaWMNCiAgIFNlY3VyaXR5IFNlcnZpY2UgQXBwbGljYXRpb24gUHJv Z3JhbSBJbnRlcmZhY2UgKEdTUy1BUEkpIHdoaWNoIGlzDQogICBkZXNjcmliZWQgaW4gUkZDIDI3 NDMuDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIw MDUgICAgICAgICAgICAgICAgICBbUGFnZSAxXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NT LUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAg R1NTLUFQSSBwZWVycyBjYW4gdXNlIHRoaXMgbmVnb3RpYXRpb24gbWVjaGFuaXNtIHRvIGNob29z ZSBmcm9tIGENCiAgIGNvbW1vbiBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcy4NCg0KVGFibGUg b2YgQ29udGVudHMNCg0KICAgMS4gIEludHJvZHVjdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAzDQogICAyLiAgQ29udmVudGlvbnMgVXNlZCBp biBUaGlzIERvY3VtZW50ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDUNCiAgIDMuICBO ZWdvdGlhdGlvbiBQcm90b2NvbCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAgNg0KICAgICAzLjEgICBOZWdvdGlhdGlvbiBEZXNjcmlwdGlvbiAgLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuICA2DQogICAgIDMuMiAgIE5lZ290aWF0aW9uIFByb2NlZHVy ZSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDcNCiAgIDQuICBUb2tlbiBE ZWZpbml0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAg OQ0KICAgICA0LjEgICBNZWNoYW5pc20gVHlwZXMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuICA5DQogICAgIDQuMiAgIE5lZ290aWF0aW9uIFRva2VucyAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDkNCiAgICAgICA0LjIuMSAgIG5lZ1Rv a2VuSW5pdCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxMA0KICAg ICAgIDQuMi4yICAgbmVnVG9rZW5SZXNwIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIDExDQogICA1LiAgUHJvY2Vzc2luZyBvZiBtZWNoTGlzdE1JQyAgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTMNCiAgIDYuICBFeHRlbnNpYmlsaXR5ICAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxNg0KICAgNy4gIFNl Y3VyaXR5IENvbnNpZGVyYXRpb25zICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIDE3DQogICA4LiAgSUFOQSBDb25zaWRlcmF0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gMTgNCiAgIDkuICBBY2tub3dsZWRnbWVudHMgIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxOQ0KICAgMTAuICAgTm9ybWF0 aXZlIFJlZmVyZW5jZXMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDE5 DQogICAgICAgQXV0aG9ycycgQWRkcmVzc2VzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gMTkNCiAgIEEuICBHU1MtQVBJIE5lZ290aWF0aW9uIFN1cHBvcnQgQVBJ ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyMQ0KICAgICBBLjEgICBHU1NfU2V0X25l Z19tZWNocyBjYWxsIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIxDQogICAg IEEuMiAgIEdTU19HZXRfbmVnX21lY2hzIGNhbGwgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gMjENCiAgIEIuICBDaGFuZ2VzIHNpbmNlIFJGQzI0NzggIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyMw0KICAgICAgIEludGVsbGVjdHVhbCBQcm9wZXJ0 eSBhbmQgQ29weXJpZ2h0IFN0YXRlbWVudHMgLiAuIC4gLiAuIC4gLiAuIDI1DQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAg ICAgICAgIEV4cGlyZXMgSnVuZSAxLCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgMl0NCgwN CkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAg ICAgRGVjZW1iZXIgMjAwNA0KDQoNCjEuICBJbnRyb2R1Y3Rpb24NCg0KICAgVGhlIEdTUy1BUEkg W1JGQzI3NDNdIHByb3ZpZGVzIGEgZ2VuZXJpYyBpbnRlcmZhY2Ugd2hpY2ggY2FuIGJlDQogICBs YXllcmVkIGF0b3AgZGlmZmVyZW50IHNlY3VyaXR5IG1lY2hhbmlzbXMgc3VjaCB0aGF0IGlmIGNv bW11bmljYXRpbmcNCiAgIHBlZXJzIGFjcXVpcmUgR1NTLUFQSSBjcmVkZW50aWFscyBmb3IgdGhl IHNhbWUgc2VjdXJpdHkgbWVjaGFuaXNtLA0KICAgdGhlbiBhIHNlY3VyaXR5IGNvbnRleHQgbWF5 IGJlIGVzdGFibGlzaGVkIGJldHdlZW4gdGhlbSAoc3ViamVjdCB0bw0KICAgcG9saWN5KS4gIEhv d2V2ZXIsIEdTUy1BUEkgZG9lcyBub3QgcHJlc2NyaWJlIHRoZSBtZXRob2QgYnkgd2hpY2gNCiAg IEdTUy1BUEkgcGVlcnMgY2FuIGVzdGFibGlzaCB3aGV0aGVyIHRoZXkgaGF2ZSBhIGNvbW1vbiBz ZWN1cml0eQ0KICAgbWVjaGFuaXNtLg0KDQogICBUaGUgU2ltcGxlIGFuZCBQcm90ZWN0ZWQgR1NT LUFQSSBOZWdvdGlhdGlvbiAoU1BORUdPKSBtZWNoYW5pc20NCiAgIGRlZmluZWQgaGVyZSBpcyBh IHBzZXVkbyBzZWN1cml0eSBtZWNoYW5pc20sIHJlcHJlc2VudGVkIGJ5IHRoZQ0KICAgT2JqZWN0 IElkZW50aWZpZXIgaXNvLm9yZy5kb2QuaW50ZXJuZXQuc2VjdXJpdHkubWVjaGFuaXNtLnNuZWdv DQogICAoMS4zLjYuMS41LjUuMiksIHdoaWNoIGVuYWJsZXMgR1NTLUFQSSBwZWVycyB0byBkZXRl cm1pbmUgaW4tYmFuZA0KICAgd2hldGhlciB0aGVpciBjcmVkZW50aWFscyBzaGFyZSBjb21tb24g R1NTLUFQSSBzZWN1cml0eSBtZWNoYW5pc20ocyksDQogICBhbmQgaWYgc28sIHRvIGludm9rZSBu b3JtYWwgc2VjdXJpdHkgY29udGV4dCBlc3RhYmxpc2htZW50IGZvciBhDQogICBzZWxlY3RlZCBj b21tb24gc2VjdXJpdHkgbWVjaGFuaXNtLiAgVGhpcyBpcyBtb3N0IHVzZWZ1bCBmb3INCiAgIGFw cGxpY2F0aW9ucyB3aGljaCBhcmUgYmFzZWQgb24gR1NTLUFQSSBpbXBsZW1lbnRhdGlvbnMgYW5k IHNoYXJlDQogICBtdWx0aXBsZSBtZWNoYW5pc21zIGJldHdlZW4gdGhlIHBlZXJzLg0KDQogICBU aGUgU1BORUdPIG1lY2hhbmlzbSBuZWdvdGlhdGlvbiBpcyBiYXNlZCBvbiB0aGUgZm9sbG93aW5n DQogICBuZWdvdGlhdGlvbiBtb2RlbDogdGhlIGluaXRpYXRvciBwcm9wb3NlcyBhIGxpc3Qgb2Yg c2VjdXJpdHkNCiAgIG1lY2hhbmlzbShzKSwgaW4gZGVjcmVhc2luZyBwcmVmZXJlbmNlIG9yZGVy IChmYXZvcml0ZSBjaG9pY2UgZmlyc3QpLA0KICAgdGhlIGFjY2VwdG9yIChhbHNvIGtub3duIGFz IHRoZSB0YXJnZXQpIGVpdGhlciBhY2NlcHRzIHRoZQ0KICAgaW5pdGlhdG9yJ3MgcHJlZmVycmVk IHNlY3VyaXR5IG1lY2hhbmlzbSAodGhlIGZpcnN0IGluIHRoZSBsaXN0KSwgb3INCiAgIGNob29z ZXMgb25lIHRoYXQgaXMgYXZhaWxhYmxlIGZyb20gdGhlIG9mZmVyZWQgbGlzdCwgb3IgcmVqZWN0 cyB0aGUNCiAgIHByb3Bvc2VkIHZhbHVlKHMpLiAgVGhlIHRhcmdldCB0aGVuIGluZm9ybXMgdGhl IGluaXRpYXRvciBvZiBpdHMNCiAgIGNob2ljZS4NCg0KICAgT25jZSBhIGNvbW1vbiBzZWN1cml0 eSBtZWNoYW5pc20gaXMgY2hvc2VuLCBtZWNoYW5pc20tc3BlY2lmaWMNCiAgIG9wdGlvbnMgTUFZ IGJlIG5lZ290aWF0ZWQgYXMgcGFydCBvZiB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtJ3MgY29udGV4 dA0KICAgZXN0YWJsaXNobWVudC4gIFRoZXNlIG5lZ290aWF0aW9ucyAoaWYgYW55KSBhcmUgaW50 ZXJuYWwgdG8gdGhlDQogICBtZWNoYW5pc20gYW5kIG9wYXF1ZSB0byB0aGUgU1BORUdPIHByb3Rv Y29sLiAgQXMgc3VjaCB0aGV5IGFyZQ0KICAgb3V0c2lkZSB0aGUgc2NvcGUgb2YgdGhpcyBkb2N1 bWVudC4NCg0KICAgSWYgcGVyLW1lc3NhZ2UgaW50ZWdyaXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFi bGUgb24gdGhlIGVzdGFibGlzaGVkDQogICBtZWNoYW5pc20gc2VjdXJpdHkgY29udGV4dCwgdGhl biB0aGUgcGVlcnMgY2FuIGV4Y2hhbmdlIE1JQyB0b2tlbnMgdG8NCiAgIGVuc3VyZSB0aGF0IHRo ZSBtZWNoYW5pc20gbGlzdCB3YXMgbm90IHRhbXBlcmVkIHdpdGguICBUaGlzIE1JQyB0b2tlbg0K ICAgZXhjaGFuZ2UgaXMgT1BUSU9OQUwgaWYgdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSBpcyB0aGUg bW9zdCBwcmVmZXJyZWQNCiAgIGNob2ljZSBvZiBib3RoIHBlZXJzIChzZWUgU2VjdGlvbiA1KS4N Cg0KICAgSW4gb3JkZXIgdG8gYXZvaWQgYW4gZXh0cmEgcm91bmQgdHJpcCwgdGhlIGZpcnN0IHNl Y3VyaXR5IHRva2VuIG9mDQogICB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSBT SE9VTEQgYmUgZW1iZWRkZWQgaW4gdGhlIGluaXRpYWwNCiAgIG5lZ290aWF0aW9uIG1lc3NhZ2Ug KGFzIGRlZmluZWQgaW4gU2VjdGlvbiA0LjIpLiAgVGhpcyBtZWNoYW5pc20NCiAgIHRva2VuIGlz IHJlZmVycmVkIHRvIGFzIHRoZSBvcHRpbWlzdGljIG1lY2hhbmlzbSB0b2tlbiBpbiB0aGlzDQog ICBkb2N1bWVudC4gIElmIHRoZSBzZWxlY3RlZCBtZWNoYW5pc20gbWF0Y2hlcyB0aGUgaW5pdGlh dG9yJ3MNCiAgIHByZWZlcnJlZCBtZWNoYW5pc20sIG5vIGFkZGl0aW9uYWwgcm91bmQgdHJpcHMg bmVlZCBiZSBpbmN1cnJlZCBieQ0KICAgdXNpbmcgdGhpcyBwcm90b2NvbC4gIEluIGFkZGl0aW9u LCB1c2luZyB0aGUgb3B0aW1pc3RpYyBtZWNoYW5pc20NCg0KDQoNClpodSwgZXQgYWwuICAgICAg ICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAgICAgICAgICAgICBbUGFnZSAzXQ0K DA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAg ICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAgdG9rZW4gYWxsb3dzIHRoZSBpbml0aWF0b3IgdG8g cmVjb3ZlciBmcm9tIG5vbi1mYXRhbCBlcnJvcnMgd2hpbGUNCiAgIHByb2R1Y2luZyB0aGUgZmly c3QgbWVjaGFuaXNtIHRva2VuIGJlZm9yZSBhIG1lY2hhbmlzbSBjYW4gYmUNCiAgIHNlbGVjdGVk LiAgSW1wbGVtZW50YXRpb25zIE1BWSBvbWl0IHRoZSBvcHRpbWlzdGljIG1lY2hhbmlzbSB0b2tl biB0bw0KICAgYXZvaWQgdGhlIGNvc3Qgb2YgZ2VuZXJhdGluZyBpdCBpbiBjYXNlcyB3aGVyZSB0 aGUgaW5pdGlhdG9yJ3MNCiAgIHByZWZlcnJlZCBtZWNoYW5pc20gaXMgbm90IHNlbGVjdGVkIGJ5 IHRoZSBhY2NlcHRvci4NCg0KICAgU1BORUdPIHJlbGllcyB0aGUgY29uY2VwdHMgZGV2ZWxvcGVk IGluIHRoZSBHU1MtQVBJIHNwZWNpZmljYXRpb24NCiAgIFtSRkMyNzQzXS4gIFRoZSBuZWdvdGlh dGlvbiBkYXRhIGlzIGVuY2Fwc3VsYXRlZCBpbiBjb250ZXh0LWxldmVsDQogICB0b2tlbnMuICBU aGVyZWZvcmUsIGNhbGxlcnMgb2YgdGhlIEdTUy1BUEkgZG8gbm90IG5lZWQgdG8gYmUgYXdhcmUg b2YNCiAgIHRoZSBleGlzdGVuY2Ugb2YgdGhlIG5lZ290aWF0aW9uIHRva2VucyBidXQgb25seSBv ZiB0aGUgbmV3DQogICBwc2V1ZG8tc2VjdXJpdHkgbWVjaGFuaXNtLiAgQSBmYWlsdXJlIGluIHRo ZSBuZWdvdGlhdGlvbiBwaGFzZSBjYXVzZXMNCiAgIGEgbWFqb3Igc3RhdHVzIGNvZGUgdG8gYmUg cmV0dXJuZWQ6IEdTU19TX0JBRF9NRUNILg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBh bC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgIFtQ YWdlIDRdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hh bmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQoyLiAgQ29udmVudGlvbnMgVXNlZCBpbiBU aGlzIERvY3VtZW50DQoNCiAgIFRoZSBrZXkgd29yZHMgIk1VU1QiLCAiTVVTVCBOT1QiLCAiUkVR VUlSRUQiLCAiU0hBTEwiLCAiU0hBTEwgTk9UIiwNCiAgICJTSE9VTEQiLCAiU0hPVUxEIE5PVCIs ICJSRUNPTU1FTkRFRCIsICJNQVkiLCBhbmQgIk9QVElPTkFMIiBpbiB0aGlzDQogICBkb2N1bWVu dCBhcmUgdG8gYmUgaW50ZXJwcmV0ZWQgYXMgZGVzY3JpYmVkIGluIFtSRkMyMTE5XS4NCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBF eHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgIFtQYWdlIDVdDQoMDQpJbnRlcm5l dC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2Vt YmVyIDIwMDQNCg0KDQozLiAgTmVnb3RpYXRpb24gUHJvdG9jb2wNCg0KICAgV2hlbiB0aGUgZXN0 YWJsaXNoZWQgbWVjaGFuaXNtIGNvbnRleHQgcHJvdmlkZXMgaW50ZWdyaXR5IHByb3RlY3Rpb24s DQogICB0aGUgbWVjaGFuaXNtIG5lZ290aWF0aW9uIGNhbiBiZSBwcm90ZWN0ZWQuICBXaGVuIGFj cXVpcmluZw0KICAgbmVnb3RpYXRlZCBzZWN1cml0eSBtZWNoYW5pc20gdG9rZW5zLCBwZXItbWVz c2FnZSBpbnRlZ3JpdHkgc2VydmljZXMNCiAgIGFyZSBhbHdheXMgcmVxdWVzdGVkIGJ5IHRoZSBT UE5FR08gbWVjaGFuaXNtLg0KDQogICBXaGVuIHRoZSBlc3RhYmxpc2hlZCBtZWNoYW5pc20gY29u dGV4dCBzdXBwb3J0cyBwZXItbWVzc2FnZSBpbnRlZ3JpdHkNCiAgIHNlcnZpY2VzLCBTUE5FR08g Z3VhcmFudGVlcyB0aGF0IHRoZSBzZWxlY3RlZCBtZWNoYW5pc20gaXMgbXV0dWFsbHkNCiAgIHBy ZWZlcnJlZC4NCg0KICAgVGhpcyBzZWN0aW9uIGRlc2NyaWJlcyB0aGUgbmVnb3RpYXRpb24gcHJv Y2VzcyBvZiB0aGlzIHByb3RvY29sLg0KDQozLjEgIE5lZ290aWF0aW9uIERlc2NyaXB0aW9uDQoN CiAgIFRoZSBmaXJzdCBuZWdvdGlhdGlvbiB0b2tlbiBzZW50IGJ5IHRoZSBpbml0aWF0b3IgY29u dGFpbnMgYW4gb3JkZXJlZA0KICAgbGlzdCBvZiBtZWNoYW5pc21zIChpbiBkZWNyZWFzaW5nIHBy ZWZlcmVuY2Ugb3JkZXIsIGZhdm9yaXRlDQogICBtZWNoYW5pc20gZmlyc3QpLCBhbmQgb3B0aW9u YWxseSB0aGUgaW5pdGlhbCBtZWNoYW5pc20gdG9rZW4gZm9yIHRoZQ0KICAgcHJlZmVycmVkIG1l Y2hhbmlzbSBvZiB0aGUgaW5pdGlhdG9yIChpLmUuLCB0aGUgZmlyc3QgaW4gdGhlIGxpc3QpLg0K ICAgVGhlIGxpc3Qgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcyBhdmFpbGFibGUgZm9yIG5lZ290aWF0 aW9uIGlzIGJhc2VkIG9uDQogICB0aGUgY3JlZGVudGlhbHMgYmVpbmcgdXNlZC4NCg0KICAgVGhl IHRhcmdldCB0aGVuIHByb2Nlc3NlcyB0aGUgdG9rZW4gZnJvbSB0aGUgaW5pdGlhdG9yLiAgVGhp cyB3aWxsDQogICByZXN1bHQgaW4gb25lIG9mIGZvdXIgcG9zc2libGUgc3RhdGVzIChhcyBkZWZp bmVkIGluIFNlY3Rpb24gNC4yLjIpOg0KICAgYWNjZXB0X2NvbXBsZXRlZCwgYWNjZXB0X2luY29t cGxldGUsIHJlamVjdCwgb3IgcmVxdWVzdF9taWMuICBBDQogICByZWplY3Qgc3RhdGUgd2lsbCB0 ZXJtaW5hdGUgdGhlIG5lZ290aWF0aW9uOyAgYW4gYWNjZXB0X2NvbXBsZXRlZA0KICAgc3RhdGUg aW5kaWNhdGVzIHRoYXQgbm90IG9ubHkgd2FzIHRoZSBpbml0aWF0b3Itc2VsZWN0ZWQgbWVjaGFu aXNtDQogICBhY2NlcHRhYmxlIHRvIHRoZSB0YXJnZXQsIGJ1dCBhbHNvIHRoYXQgdGhlIGluaXRp YWwgbWVjaGFuaXNtIHRva2VuDQogICB3YXMgc3VmZmljaWVudCB0byBjb21wbGV0ZSB0aGUgYXV0 aGVudGljYXRpb247ICBhbiBhY2NlcHRfaW5jb21wbGV0ZQ0KICAgc3RhdGUgaW5kaWNhdGVzIHRo YXQgZnVydGhlciBtZXNzYWdlIGV4Y2hhbmdlIGlzIG5lZWRlZCBidXQgdGhlIE1JQw0KICAgdG9r ZW4gZXhjaGFuZ2UgYXMgZGVzY3JpYmVkIGluIFNlY3Rpb24gNSBpcyBPUFRJT05BTDsgIGEgcmVx dWVzdF9taWMNCiAgIHN0YXRlICh0aGlzIHN0YXRlIGNhbiBvbmx5IGJlIHByZXNlbnQgaW4gdGhl IGZpcnN0IHJlcGx5IG1lc3NhZ2UgZnJvbQ0KICAgdGhlIHRhcmdldCkgaW5kaWNhdGVzIHRoZSBN SUMgdG9rZW4gZXhjaGFuZ2UgaXMgUkVRVUlSRUQgaWYNCiAgIHBlci1tZXNzYWdlIGludGVncml0 eSBzZXJ2aWNlcyBhcmUgYXZhaWxhYmxlLg0KDQogICBVbmxlc3MgdGhlIHByZWZlcmVuY2Ugb3Jk ZXIgaXMgc3BlY2lmaWVkIGJ5IHRoZSBhcHBsaWNhdGlvbiAoc2VlDQogICBBcHBlbmRpeCBBKSwg dGhlIHBvbGljeSBieSB3aGljaCB0aGUgdGFyZ2V0IGNob29zZXMgYSBtZWNoYW5pc20gaXMgYW4N CiAgIGltcGxlbWVudGF0aW9uLXNwZWNpZmljIGxvY2FsIG1hdHRlci4gIEluIHRoZSBhYnNlbmNl IG9mIGFuDQogICBhcHBsaWNhdGlvbiBzcGVjaWZpZWQgcHJlZmVyZW5jZSBvcmRlciBvciBvdGhl ciBwb2xpY3ksIHRoZSB0YXJnZXQNCiAgIFNIQUxMIGNob29zZSB0aGUgZmlyc3QgbWVjaGFuaXNt IGluIHRoZSBpbml0aWF0b3IgcHJvcG9zZWQgbGlzdCBmb3INCiAgIHdoaWNoIGl0IGhhcyB2YWxp ZCBjcmVkZW50aWFscy4NCg0KICAgSW4gY2FzZSBvZiBhIHN1Y2Nlc3NmdWwgbmVnb3RpYXRpb24s IHRoZSBzZWN1cml0eSBtZWNoYW5pc20gaW4gdGhlDQogICBmaXJzdCByZXBseSBtZXNzYWdlIHJl cHJlc2VudHMgdGhlIHZhbHVlIHN1aXRhYmxlIGZvciB0aGUgdGFyZ2V0LA0KICAgcGlja2VkIHVw IGZyb20gdGhlIGxpc3Qgb2ZmZXJlZCBieSB0aGUgaW5pdGlhdG9yLiAgQSBjb250ZXh0IGxldmVs DQogICB0b2tlbiBmb3IgYSByZWplY3Qgc3RhdGUgaXMgT1BUSU9OQUwuDQoNCiAgIE9uY2UgYSBt ZWNoYW5pc20gaGFzIGJlZW4gc2VsZWN0ZWQsIHRoZSB0b2tlbnMgc3BlY2lmaWMgdG8gdGhlDQoN Cg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxLCAyMDA1ICAgICAg ICAgICAgICAgICAgW1BhZ2UgNl0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVn b3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCiAgIHNlbGVjdGVk IG1lY2hhbmlzbSBhcmUgY2FycmllZCB3aXRoaW4gdGhlIG5lZ290aWF0aW9uIHRva2Vucy4NCg0K ICAgTGFzdGx5LCBNSUMgdG9rZW5zIE1BWSBiZSBleGNoYW5nZWQgdG8gZW5zdXJlIHRoZSBhdXRo ZW50aWNpdHkgb2YgdGhlDQogICBtZWNoYW5pc20gbGlzdCByZWNlaXZlZCBieSB0aGUgdGFyZ2V0 Lg0KDQogICBUbyBhdm9pZCBjb25mbGljdHMgd2l0aCB0aGUgdXNlIG9mIE1JQyB0b2tlbnMgYnkg U1BORUdPLA0KICAgcGFydGlhbGx5LWVzdGFibGlzaGVkIGNvbnRleHRzIGFyZSBub3QgdXNlZCBm b3IgcGVyLW1lc3NhZ2UgY2FsbHM6DQogICB0aGUgcHJvdF9yZWFkeV9zdGF0ZSBbUkZDMjc0M10g d2lsbCBiZSBmYWxzZSBldmVuIGlmIHRoZSB1bmRlcmx5aW5nDQogICBtZWNoYW5pc20gd291bGQg cmV0dXJuIHRydWUgbmF0aXZlbHkuDQoNCjMuMiAgTmVnb3RpYXRpb24gUHJvY2VkdXJlDQoNCiAg IFRoZSBiYXNpYyBmb3JtIG9mIHRoZSBwcm9jZWR1cmUgYXNzdW1lcyB0aGF0IHBlci1tZXNzYWdl IGludGVncml0eQ0KICAgc2VydmljZXMgYXJlIGF2YWlsYWJsZSBvbiB0aGUgZXN0YWJsaXNoZWQg bWVjaGFuaXNtIGNvbnRleHQsIGFuZCBpdA0KICAgaXMgc3VtbWFyaXplZCBhcyBmb2xsb3dzOg0K DQogICAoYSkgVGhlIEdTUy1BUEkgaW5pdGlhdG9yIGludm9rZXMgR1NTX0luaXRfc2VjX2NvbnRl eHQoKSBhcyBub3JtYWwsDQogICAgICBidXQgcmVxdWVzdHMgdGhhdCBTUE5FR08gYmUgdXNlZC4g IFNQTkVHTyBjYW4gZWl0aGVyIGJlIGV4cGxpY2l0eQ0KICAgICAgcmVxdWVzdGVkIG9yIGFjY2Vw dGVkIGFzIHRoZSBkZWZhdWx0IG1lY2hhbmlzbS4NCg0KICAgKGIpIFRoZSBpbml0aWF0b3IgR1NT LUFQSSBpbXBsZW1lbnRhdGlvbiBlbWl0cyBhIG5lZ290aWF0aW9uIHRva2VuDQogICAgICBjb250 YWluaW5nIGEgbGlzdCBvZiBvbmUgb3IgbW9yZSBzZWN1cml0eSBtZWNoYW5pc21zIHRoYXQgYXJl DQogICAgICBhdmFpbGFibGUgYmFzZWQgb24gdGhlIGNyZWRlbnRpYWxzIHVzZWQgZm9yIHRoaXMg Y29udGV4dA0KICAgICAgZXN0YWJsaXNobWVudCwgYW5kIG9wdGlvbmFsbHkgdGhlIGluaXRpYWwg bWVjaGFuaXNtIHRva2VuIGZvciB0aGUNCiAgICAgIGZpcnN0IG1lY2hhbmlzbSBpbiB0aGUgbGlz dC4NCg0KICAgKGMpIFRoZSBHU1MtQVBJIGluaXRpYXRvciBhcHBsaWNhdGlvbiBzZW5kcyB0aGUg dG9rZW4gdG8gdGhlIHRhcmdldA0KICAgICAgYXBwbGljYXRpb24uICBUaGUgR1NTLUFQSSB0YXJn ZXQgYXBwbGljYXRpb24gZGVwb3NpdHMgdGhlIHRva2VuIGJ5DQogICAgICBpbnZva2luZyBHU1Nf QWNjZXB0X3NlY19jb250ZXh0KCkuICBUaGUgYWNjZXB0b3Igd2lsbCBkbyBvbmUgb2YNCiAgICAg IHRoZSBmb2xsb3dpbmc6DQoNCiAgICAgIChJKSBJZiBub25lIG9mIHRoZSBwcm9wb3NlZCBtZWNo YW5pc21zIGFyZSBhY2NlcHRhYmxlLCB0aGUNCiAgICAgICAgIG5lZ290aWF0aW9uIFNIQUxMIGJl IHRlcm1pbmF0ZWQuICBHU1NfQWNjZXB0X3NlY19jb250ZXh0DQogICAgICAgICBpbmRpY2F0ZXMg R1NTX1NfQkFEX01FQ0guICBUaGUgYWNjZXB0b3IgTUFZIG91dHB1dCBhDQogICAgICAgICBuZWdv dGlhdGlvbiB0b2tlbiBjb250YWluaW5nIGEgcmVqZWN0IHN0YXRlLg0KDQogICAgICAoSUkpIElm IGVpdGhlciB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSBpcyBub3QgYWNjZXB0 ZWQNCiAgICAgICAgIGJ5IHRoZSB0YXJnZXQgb3IgdGhpcyBtZWNoYW5pc20gaXMgYWNjZXB0ZWQg YnV0IGl0IGlzIG5vdCB0aGUNCiAgICAgICAgIGFjY2VwdG9yJ3MgbW9zdCBwcmVmZXJyZWQgbWVj aGFuaXNtIChzZWUgU2VjdGlvbiAzLjEgYW5kDQogICAgICAgICBTZWN0aW9uIDUpLCBHU1NfQWNj ZXB0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzDQogICAgICAgICBHU1NfU19DT05USU5VRV9ORUVE RUQuICBUaGUgYWNjZXB0b3IgTVVTVCBvdXRwdXQgYSBuZWdvdGlhdGlvbg0KICAgICAgICAgdG9r ZW4gY29udGFpbmluZyBhIHJlcXVlc3RfbWljIHN0YXRlLg0KDQogICAgICAoSUlJKSBPdGhlcndp c2UsIEdTU19BY2NlcHRfc2VjX2NvbmV4dCgpIGluZGljYXRlcyBHU1NfU19DT01QTEVURQ0KICAg ICAgICAgb3IgR1NTX1NfQ09OVElOVUVfTkVFREVEIGRlcGVuZGluZyBvbiBpZiBhdCBsZWFzdCBv bmUNCiAgICAgICAgIGFkZGl0aW9uYWwgbmVnb3RpYXRpb24gdG9rZW4gZnJvbSB0aGUgaW5pdGlh dG9yIGlzIG5lZWRlZCB0bw0KICAgICAgICAgZXN0YWJsaXNoIHRoaXMgY29udGV4dC4gIFRoZSBh Y2NlcHRvciBvdXRwdXRzIGEgbmVnb3RpYXRpb24NCiAgICAgICAgIHRva2VuIGNvbnRhaW5pbmcg YW4gYWNjZXB0X2NvbXBsZXRlIG9yIGFjY2VwdF9pbmNvbXBsZXRlIHN0YXRlLA0KDQoNCg0KWmh1 LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAg ICAgIFtQYWdlIDddDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9u IE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICAgICAgICByZXNwZWN0aXZl bHkuDQoNCiAgICAgIElmIHRoZSBpbml0aWF0b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNtIGlzIGFj Y2VwdGVkLCBhbmQgYW4NCiAgICAgIG9wdGltaXN0aWMgbWVjaGFuaXNtIHRva2VuIHdhcyBpbmNs dWRlZCwgdGhpcyBtZWNoYW5pc20gdG9rZW4gTVVTVA0KICAgICAgYmUgZGVwb3NpdGVkIHRvIHRo ZSBzZWxlY3RlZCBtZWNoYW5pc20gYnkgaW52b2tpbmcNCiAgICAgIEdTU19BY2NlcHRfc2VjX2Nv bnRleHQoKSBhbmQgaWYgYSByZXNwb25zZSBtZWNoYW5pc20gdG9rZW4gaXMNCiAgICAgIGVtaXR0 ZWQsIGl0IE1VU1QgYmUgaW5jbHVkZWQgaW4gdGhlIHJlc3BvbnNlIG5lZ290aWF0aW9uIHRva2Vu Lg0KICAgICAgT3RoZXJ3aXNlLCB0aGUgdGFyZ2V0IHdpbGwgbm90IGVtaXQgYSByZXNwb25zZSBt ZWNoYW5pc20gdG9rZW4gaW4NCiAgICAgIHRoZSBmaXJzdCByZXBseS4NCg0KICAgKGQpIFRoZSBH U1MtQVBJIHRhcmdldCBhcHBsaWNhdGlvbiByZXR1cm5zIHRoZSBuZWdvdGlhdGlvbiB0b2tlbiB0 bw0KICAgICAgdGhlIGluaXRpYXRvciBhcHBsaWNhdGlvbi4gIFRoZSBHU1MtQVBJIGluaXRpYXRv ciBhcHBsaWNhdGlvbg0KICAgICAgZGVwb3NpdHMgdGhlIHRva2VuIGJ5IGludm9raW5nIEdTU19J bml0X3NlY19jb250ZXh0KCkuICBUaGUNCiAgICAgIHNlY3VyaXR5IGNvbnRleHQgaW5pdGlhbGl6 YXRpb24gaXMgdGhlbiBjb250aW51ZWQgYWNjb3JkaW5nIHRvIHRoZQ0KICAgICAgc3RhbmRhcmQg R1NTLUFQSSBjb252ZW50aW9ucyBmb3IgdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSwgd2hlcmUgdGhl DQogICAgICB0b2tlbnMgb2YgdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSBhcmUgZW5jYXBzdWxhdGVk IHVudGlsIHRoZQ0KICAgICAgR1NTX1NfQ09NUExFVEUgaXMgcmV0dXJuZWQgZm9yIGJvdGggdGhl IGluaXRpYXRvciBhbmQgdGhlIHRhcmdldA0KICAgICAgYnkgdGhlIHNlbGVjdGVkIHNlY3VyaXR5 IG1lY2hhbmlzbS4NCg0KICAgKGUpIE1JQyB0b2tlbnMgYXJlIHRoZW4gZWl0aGVyIHNraXBwZWQg b3IgZXhjaGFuZ2VkIGFjY29yZGluZyB0bw0KICAgICAgU2VjdGlvbiA1Lg0KDQogICBOb3RlIHRo YXQgdGhlICpfcmVxX2ZsYWcgaW5wdXQgcGFyYW1ldGVycyBmb3IgY29udGV4dCBlc3RhYmxpc2ht ZW50DQogICBhcmUgcmVsYXRpdmUgdG8gdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSwgYXMgYXJlIHRo ZSAqX3N0YXRlIG91dHB1dA0KICAgcGFyYW1ldGVycy4gIGkuZS4sIHRoZXNlIHBhcmFtZXRlcnMg YXJlIG5vdCBhcHBsaWNhYmxlIHRvIHRoZQ0KICAgbmVnb3RpYXRpb24gcHJvY2VzcyBwZXIgc2Uu DQoNCiAgIE9uIHJlY2VpcHQgb2YgYSBuZWdvdGlhdGlvbiB0b2tlbiBvbiB0aGUgdGFyZ2V0IHNp ZGUsIGEgR1NTLUFQSQ0KICAgaW1wbGVtZW50YXRpb24gdGhhdCBkb2VzIG5vdCBzdXBwb3J0IG5l Z290aWF0aW9uIHdvdWxkIGluZGljYXRlIHRoZQ0KICAgR1NTX1NfQkFEX01FQ0ggc3RhdHVzIGFz IGlmIGEgcGFydGljdWxhciBiYXNpYyBzZWN1cml0eSBtZWNoYW5pc20gaGFkDQogICBiZWVuIHJl cXVlc3RlZCBhbmQgd2FzIG5vdCBzdXBwb3J0ZWQuDQoNCiAgIFdoZW4gR1NTX0FjcXVpcmVfY3Jl ZCBpcyBpbnZva2VkIHdpdGggdGhpcyBuZWdvdGlhdGlvbiBtZWNoYW5pc20gaW4NCiAgIHRoZSBk ZXNpcmVkX21lY2hzLCBhbiBpbXBsZW1lbnRhdGlvbi1zcGVjaWZpYyBkZWZhdWx0IGNyZWRlbnRp YWwgaXMNCiAgIHVzZWQgdG8gY2Fycnkgb24gdGhlIG5lZ290aWF0aW9uLiAgQSBzZXQgb2YgbWVj aGFuaXNtcyBhcyBzcGVjaWZpZWQNCiAgIGxvY2FsbHkgYnkgdGhlIHN5c3RlbSBhZG1pbmlzdHJh dG9yIGlzIHRoZW4gYXZhaWxhYmxlIGZvcg0KICAgbmVnb3RpYXRpb24uICBJZiB0aGVyZSBpcyBh IGRlc2lyZSBmb3IgdGhlIGNhbGxlciB0byBtYWtlIGl0cyBvd24NCiAgIGNob2ljZSwgdGhlbiBh biBhZGRpdGlvbmFsIEFQSSBoYXMgdG8gYmUgdXNlZCAoc2VlIEFwcGVuZGl4IEEpLg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgIEV4cGlyZXMgSnVu ZSAxLCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgOF0NCgwNCkludGVybmV0LURyYWZ0ICAg ICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0K DQoNCjQuICBUb2tlbiBEZWZpbml0aW9ucw0KDQogICBUaGUgdHlwZSBkZWZpbml0aW9ucyBpbiB0 aGlzIHNlY3Rpb24gYXNzdW1lIGFuIEFTTi4xIG1vZHVsZQ0KICAgZGVmaW5pdGlvbiBvZiB0aGUg Zm9sbG93aW5nIGZvcm06DQoNCg0KICAgICAgU1BORUdPQVNOT25lU3BlYyB7DQogICAgICAgICAg aXNvKDEpIGlkZW50aWZpZWQtb3JnYW5pemF0aW9uKDMpIGRvZCg2KSBpbnRlcm5ldCgxKQ0KICAg ICAgICAgIHNlY3VyaXR5KDUpIG1lY2hhbmlzbSg1KSBzbmVnbyAoMikgbW9kdWxlcyg0KSBzcGVj MigyKQ0KICAgICAgfSBERUZJTklUSU9OUyBFWFBMSUNJVCBUQUdTIDo6PSBCRUdJTg0KDQogICAg ICAtLSByZXN0IG9mIGRlZmluaXRpb25zIGhlcmUNCg0KICAgICAgRU5EDQoNCg0KICAgVGhpcyBz cGVjaWZpZXMgdGhhdCB0aGUgdGFnZ2luZyBjb250ZXh0IGZvciB0aGUgbW9kdWxlIHdpbGwgYmUN CiAgIGV4cGxpY2l0IGFuZCBub24tYXV0b21hdGljLg0KDQogICBUaGUgZW5jb2Rpbmcgb2YgU1BO RUdPIHByb3RvY29sIG1lc3NhZ2VzIHNoYWxsIG9iZXkgdGhlIERpc3Rpbmd1aXNoZWQNCiAgIEVu Y29kaW5nIFJ1bGVzIChERVIpIG9mIEFTTi4xIGFzIGRlc2NyaWJlZCBpbiBbWDY5MF0uDQoNCjQu MSAgTWVjaGFuaXNtIFR5cGVzDQoNCiAgIEluIHRoaXMgbmVnb3RpYXRpb24gbW9kZWwsIGVhY2gg T0lEIHJlcHJlc2VudHMgb25lIEdTUy1BUEkgbWVjaGFuaXNtDQogICBvciBvbmUgdmFyaWFudCAo c2VlIFNlY3Rpb24gNikgb2YgaXQgYWNjb3JkaW5nIHRvIFtSRkMyNzQzXS4NCg0KDQogICAgICAg TWVjaFR5cGUgOjo9IE9CSkVDVCBJREVOVElGSUVSDQogICAgICAgICAgIC0tIE9JRCByZXByZXNl bnRzIGVhY2ggc2VjdXJpdHkgbWVjaGFuaXNtIGFzIHN1Z2dlc3RlZCBieQ0KICAgICAgICAgICAt LSBbUkZDMjc0M10NCg0KICAgICAgIE1lY2hUeXBlTGlzdCA6Oj0gU0VRVUVOQ0UgT0YgTWVjaFR5 cGUNCg0KDQo0LjIgIE5lZ290aWF0aW9uIFRva2Vucw0KDQogICBUaGUgc3ludGF4IG9mIHRoZSBp bml0aWFsIG5lZ290aWF0aW9uIHRva2VucyBmb2xsb3dzIHRoZQ0KICAgaW5pdGlhbENvbnRleHRU b2tlbiBzeW50YXggZGVmaW5lZCBpbiBTZWN0aW9uIDMuMSBvZiBbUkZDMjc0M10uICBUaGUNCiAg IFNQTkVHTyBwc2V1ZG8gbWVjaGFuaXNtIGlzIGlkZW50aWZpZWQgYnkgdGhlIE9iamVjdCBJZGVu dGlmaWVyDQogICBzcGVjaWZpZWQgaW4gU2VjdGlvbiAxLiAgU3Vic2VxdWVudCB0b2tlbnMgYXJl IG5vdCBlbmNhcHN1bGF0ZWQgaW4NCiAgIHRoaXMgR1NTLUFQSSBnZW5lcmljIHRva2VuIGZyYW1p bmcuDQoNCiAgIFRoaXMgc2VjdGlvbiBzcGVjaWZpZXMgdGhlIHN5bnRheCBvZiB0aGUgaW5uZXIg dG9rZW4gZm9yIHRoZSBpbml0aWFsDQogICBtZXNzYWdlIGFuZCB0aGUgc3ludGF4IG9mIHN1YnNl cXVlbnQgY29udGV4dCBlc3RhYmxpc2htZW50IHRva2Vucy4NCg0KICAgICAgIE5lZ290aWF0aW9u VG9rZW4gOjo9IENIT0lDRSB7DQogICAgICAgICAgIG5lZ1Rva2VuSW5pdCAgICBbMF0gTmVnVG9r ZW5Jbml0LA0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwg MjAwNSAgICAgICAgICAgICAgICAgIFtQYWdlIDldDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBH U1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQog ICAgICAgICAgIG5lZ1Rva2VuUmVzcCAgICBbMV0gbmVnVG9rZW5SZXNwDQogICAgICAgfQ0KDQoN Cg0KNC4yLjEgIG5lZ1Rva2VuSW5pdA0KDQogICAgICAgTmVnVG9rZW5Jbml0IDo6PSBTRVFVRU5D RSB7DQogICAgICAgICAgIG1lY2hUeXBlcyAgICAgICBbMF0gTWVjaFR5cGVMaXN0LA0KICAgICAg ICAgICByZXFGbGFncyAgICAgICAgWzFdIENvbnRleHRGbGFncyAgT1BUSU9OQUwsDQogICAgICAg ICAgIG1lY2hUb2tlbiAgICAgICBbMl0gT0NURVQgU1RSSU5HICBPUFRJT05BTCwNCiAgICAgICAg ICAgbWVjaExpc3RNSUMgICAgIFszXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLA0KICAgICAgICAg ICAuLi4NCiAgICAgICB9DQogICAgICAgQ29udGV4dEZsYWdzIDo6PSBCSVQgU1RSSU5HIHsNCiAg ICAgICAgICAgZGVsZWdGbGFnICAgICAgICgwKSwNCiAgICAgICAgICAgbXV0dWFsRmxhZyAgICAg ICgxKSwNCiAgICAgICAgICAgcmVwbGF5RmxhZyAgICAgICgyKSwNCiAgICAgICAgICAgc2VxdWVu Y2VGbGFnICAgICgzKSwNCiAgICAgICAgICAgYW5vbkZsYWcgICAgICAgICg0KSwNCiAgICAgICAg ICAgY29uZkZsYWcgICAgICAgICg1KSwNCiAgICAgICAgICAgaW50ZWdGbGFnICAgICAgICg2KQ0K ICAgICAgIH0NCg0KICAgVGhpcyBpcyB0aGUgc3ludGF4IGZvciB0aGUgaW5uZXIgdG9rZW4gb2Yg dGhlIGluaXRpYWwgbmVnb3RpYXRpb24NCiAgIG1lc3NhZ2UuDQoNCiAgIG1lY2hUeXBlcw0KDQog ICAgICAgICBUaGlzIGZpZWxkIGNvbnRhaW5zIG9uZSBvciBtb3JlIHNlY3VyaXR5IG1lY2hhbmlz bXMgYXZhaWxhYmxlDQogICAgICAgICBmb3IgdGhlIGluaXRpYXRvciBpbiBkZWNyZWFzaW5nIHBy ZWZlcmVuY2Ugb3JkZXIgKGZhdm9yaXRlDQogICAgICAgICBjaG9pY2UgZmlyc3QpLg0KDQogICBy ZXFGbGFncw0KDQogICAgICAgICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyB0aGUg c2VydmljZSBvcHRpb25zIHRoYXQgYXJlDQogICAgICAgICByZXF1ZXN0ZWQgdG8gZXN0YWJsaXNo IHRoZSBjb250ZXh0LiAgVGhlIGNvbnRleHQgZmxhZ3MgU0hPVUxEDQogICAgICAgICBiZSBmaWxs ZWQgaW4gZnJvbSB0aGUgcmVxX2ZsYWdzIHBhcmFtZXRlciBvZg0KICAgICAgICAgR1NTX0luaXRf c2VjX2NvbnRleHQoKS4gIFRoaXMgZmllbGQgU0hBTEwgTk9UIGhhdmUgaW1wYWN0IG9uDQogICAg ICAgICB0aGUgbmVnb3RpYXRpb24uDQoNCiAgIG1lY2hUb2tlbg0KDQogICAgICAgICBUaGlzIGZp ZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyB0aGUgb3B0aW1pc3RpYyBtZWNoYW5pc20NCiAgICAg ICAgIHRva2VuLg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVz IEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMTBdDQoMDQpJbnRlcm5ldC1EcmFm dCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIw MDQNCg0KDQogICBtZWNobGlzdE1JQw0KDQogICAgICAgICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50 LCBjb250YWlucyBhIE1JQyB0b2tlbiBmb3IgdGhlIG1lY2hhbmlzbQ0KICAgICAgICAgbGlzdCBp biB0aGUgaW5pdGlhbCBuZWdvdGlhdGlvbiBtZXNzYWdlLiAgVGhpcyBNSUMgdG9rZW4gaXMNCiAg ICAgICAgIGNvbXB1dGVkIGFjY29yZGluZyB0byBTZWN0aW9uIDUuDQoNCg0KNC4yLjIgIG5lZ1Rv a2VuUmVzcA0KDQogICAgICAgTmVnVG9rZW5SZXNwIDo6PSBTRVFVRU5DRSB7DQogICAgICAgICAg IG5lZ1Jlc3VsdCAgICAgICBbMF0gRU5VTUVSQVRFRCB7DQogICAgICAgICAgICAgICBhY2NlcHRf Y29tcGxldGVkICAgICgwKSwNCiAgICAgICAgICAgICAgIGFjY2VwdF9pbmNvbXBsZXRlICAgKDEp LA0KICAgICAgICAgICAgICAgcmVqZWN0ICAgICAgICAgICAgICAoMiksDQogICAgICAgICAgICAg ICByZXF1ZXN0X21pYyAgICAgICAgICgzKQ0KICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgT1BUSU9OQUwsDQogICAgICAgICAgICAgLS0gUkVRVUlSRUQgaW4gdGhl IGZpcnN0IHJlcGx5IGZyb20gdGhlIHRhcmdldA0KICAgICAgICAgICBzdXBwb3J0ZWRNZWNoICAg WzFdIE1lY2hUeXBlICAgICAgT1BUSU9OQUwsDQogICAgICAgICAgICAgLS0gcHJlc2VudCBvbmx5 IGluIHRoZSBmaXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQNCiAgICAgICAgICAgcmVzcG9uc2VU b2tlbiAgIFsyXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLA0KICAgICAgICAgICBtZWNoTGlzdE1J QyAgICAgWzNdIE9DVEVUIFNUUklORyAgT1BUSU9OQUwsDQogICAgICAgICAgIC4uLg0KICAgICAg IH0NCg0KICAgVGhpcyBpcyB0aGUgc3ludGF4IGZvciBhbGwgc3Vic2VxdWVudCBuZWdvdGlhdGlv biBtZXNzYWdlcy4NCg0KICAgbmVnUmVzdWx0DQoNCiAgICAgICAgIFRoaXMgZmllbGQsIGlmIHBy ZXNlbnQsIGNvbnRhaW5zIHRoZSBzdGF0ZSBvZiB0aGUgbmVnb3RpYXRpb24uDQogICAgICAgICBU aGlzIGNhbiBiZToNCg0KICAgICAgICAgYWNjZXB0X2NvbXBsZXRlZA0KDQogICAgICAgICAgICBO byBmdXJ0aGVyIG5lZ290aWF0aW9uIG1lc3NhZ2UgZnJvbSB0aGUgcGVlciBpcyBleHBlY3RlZCwN CiAgICAgICAgICAgIGFuZCB0aGUgc2VjdXJpdHkgY29udGV4dCBpcyBlc3RhYmxpc2hlZCBmb3Ig dGhlIHNlbmRlci4NCg0KICAgICAgICAgYWNjZXB0X2luY29tcGxldGUNCg0KICAgICAgICAgICAg QXQgbGVhc3Qgb25lIG1vcmUgbmVnb3RpYXRpb24gbWVzc2FnZSBmcm9tIHRoZSBwZWVyIGlzDQog ICAgICAgICAgICBuZWVkZWQgdG8gZXN0YWJsaXNoIHRoZSBzZWN1cml0eSBjb250ZXh0Lg0KDQog ICAgICAgICByZWplY3QNCg0KICAgICAgICAgICAgVGhlIHNlbmRlciB0ZXJtaW5hdGVzIHRoZSBu ZWdvdGlhdGlvbi4NCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBp cmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMTFdDQoMDQpJbnRlcm5ldC1E cmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVy IDIwMDQNCg0KDQogICAgICAgICByZXF1ZXN0X21pYw0KDQogICAgICAgICAgICBUaGUgc2VuZGVy IGluZGljYXRlcyB0aGF0IHRoZSBleGNoYW5nZSBvZiBNSUMgdG9rZW5zLCBhcw0KICAgICAgICAg ICAgZGVzY3JpYmVkIGluIFNlY3Rpb24gNSwgd2lsbCBiZSBSRVFVSVJFRCBpZiBwZXItbWVzc2Fn ZQ0KICAgICAgICAgICAgaW50ZWdyaXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhlIG1l Y2hhbmlzbSBjb250ZXh0IHRvDQogICAgICAgICAgICBiZSBlc3RhYmxpc2hlZC4gIFRoaXMgdmFs dWUgU0hBTEwgb25seSBiZSBwcmVzZW50IGluIHRoZQ0KICAgICAgICAgICAgZmlyc3QgcmVwbHkg ZnJvbSB0aGUgdGFyZ2V0Lg0KDQogICAgICAgICBUaGlzIGZpZWxkIGlzIFJFUVVJUkVEIGluIHRo ZSBmaXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQsIGFuZA0KICAgICAgICAgaXQgaXMgT1BUSU9O QUwgdGhlcmVhZnRlci4NCg0KICAgc3VwcG9ydGVkTWVjaA0KDQogICAgICAgICBUaGlzIGZpZWxk IFNIQUxMIG9ubHkgYmUgcHJlc2VudCBpbiB0aGUgZmlyc3QgcmVwbHkgZnJvbSB0aGUNCiAgICAg ICAgIHRhcmdldC4gIEl0IE1VU1QgYmUgb25lIG9mIHRoZSBtZWNoYW5pc20ocykgb2ZmZXJlZCBi eSB0aGUNCiAgICAgICAgIGluaXRpYXRvci4NCg0KICAgUmVzcG9uc2VUb2tlbg0KDQogICAgICAg ICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyB0b2tlbnMgc3BlY2lmaWMgdG8gdGhl DQogICAgICAgICBtZWNoYW5pc20gc2VsZWN0ZWQuDQoNCiAgIG1lY2hsaXN0TUlDDQoNCiAgICAg ICAgIFRoaXMgZmllbGQsIGlmIHByZXNlbnQsIGNvbnRhaW5zIGEgTUlDIHRva2VuIGZvciB0aGUg bWVjaGFuaXNtDQogICAgICAgICBsaXN0IGluIHRoZSBpbml0aWFsIG5lZ290aWF0aW9uIG1lc3Nh Z2UuICBUaGlzIE1JQyB0b2tlbiBpcw0KICAgICAgICAgY29tcHV0ZWQgYWNjb3JkaW5nIHRvIFNl Y3Rpb24gNS4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN ClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAgICAg ICAgICAgIFtQYWdlIDEyXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlh dGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KNS4gIFByb2Nlc3Npbmcg b2YgbWVjaExpc3RNSUMNCg0KICAgSWYgdGhlIG1lY2hhbmlzbSBzZWxlY3RlZCBieSB0aGUgbmVn b3RpYXRpb24gZG9lcyBub3Qgc3VwcG9ydA0KICAgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHRoZW4g bm8gbWVjaGxpc3RNSUMgdG9rZW4gaXMgdXNlZC4NCg0KICAgT3RoZXJ3aXNlIGlmIHRoZSBhY2Nl cHRlZCBtZWNoYW5pc20gaXMgdGhlIG1vc3QgcHJlZmVycmVkIG1lY2hhbmlzbQ0KICAgb2YgYm90 aCB0aGUgaW5pdGlhdG9yIGFuZCB0aGUgYWNjZXB0b3IsIHRoZW4gdGhlIE1JQyB0b2tlbiBleGNo YW5nZSwNCiAgIGFzIGRlc2NyaWJlZCBsYXRlciBpbiB0aGlzIHNlY3Rpb24sIGlzIE9QVElPTkFM LiAgQSBtZWNoYW5pc20gaXMgdGhlDQogICBhY2NlcHRvcidzIG1vc3QgcHJlZmVycmVkIG1lY2hh bmlzbSBpZiB0aGVyZSBpcyBubyBvdGhlciBtZWNoYW5pc20NCiAgIHdoaWNoIHdvdWxkIGhhdmUg YmVlbiBwcmVmZXJyZWQgb3ZlciB0aGUgYWNjZXB0ZWQgbWVjaGFuaXNtIGlmIGl0IGhhZA0KICAg YmVlbiBwcmVzZW50IGluIHRoZSByZWNlaXZlZCBtZWNoYW5pc20gbGlzdC4NCg0KICAgSW4gYWxs IG90aGVyIGNhc2VzLCBNSUMgdG9rZW5zIE1VU1QgYmUgZXhjaGFuZ2VkIGFmdGVyIHRoZSBtZWNo YW5pc20NCiAgIGNvbnRleHQgaXMgZnVsbHkgZXN0YWJsaXNoZWQuDQoNCiAgIEl0IGlzIGFzc3Vt ZWQgdGhhdCBwZXItbWVzc2FnZSBpbnRlZ3JpdHkgc2VydmljZXMgYXJlIGF2YWlsYWJsZSBvbg0K ICAgdGhlIGVzdGFibGlzaGVkIG1lY2hhbmlzbSBjb250ZXh0IGluIHRoZSBmb2xsb3dpbmcgcHJv Y2VkdXJlIGZvcg0KICAgcHJvY2Vzc2luZyBNSUMgdG9rZW5zIG9mIHRoZSBpbml0aWF0b3IncyBt ZWNoYW5pc20gbGlzdC4NCg0KICAgYSkgVGhlIG1lY2hsaXN0TUlDIHRva2VuIChvciBzaW1wbHkg dGhlIE1JQyB0b2tlbikgaXMgY29tcHV0ZWQgYnkNCiAgICAgIGludm9raW5nIEdTU19HZXRNSUMo KTogdGhlIGlucHV0IGNvbnRleHRfaGFuZGxlIGlzIHRoZSBlc3RhYmxpc2hlZA0KICAgICAgbWVj aGFuaXNtIGNvbnRleHQsIHRoZSBpbnB1dCBxb3BfcmVxIGlzIDAsIGFuZCB0aGUgaW5wdXQgbWVz c2FnZQ0KICAgICAgaXMgdGhlIG1lY2hUeXBlcyBmaWVsZCBpbiB0aGUgaW5pdGlhbCBuZWdvdGlh dGlvbiBtZXNzYWdlIChvbmx5DQogICAgICB0aGUgREVSIGVuY29kaW5nIG9mIHRoZSB0eXBlIE1l Y2hUeXBlTGlzdCBpcyBpbmNsdWRlZCkuDQoNCiAgIGIpIElmIHRoZSBzZWxlY3RlZCBtZWNoYW5p c20gdXNlcyBhbiBldmVuIG51bWJlciBvZiBtZWNoYW5pc20gdG9rZW5zDQogICAgICAobmFtZWx5 IHRoZSBhY2NlcHRvciBzZW5kcyB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW4pLCB0aGUgYWNjZXB0 b3INCiAgICAgIGRvZXMgdGhlIGZvbGxvd2luZyB3aGVuIGVtaXR0aW5nIHRoZSBuZWdvdGlhdGlv biBtZXNzYWdlDQogICAgICBjb250YWluaW5nIHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tlbjogaWYg dGhlIE1JQyB0b2tlbiBleGNoYW5nZSBpcw0KICAgICAgbm90IHJlcXVpcmVkLCBHU1NfQWNjZXB0 X3NlY19jb250ZXh0KCkgZWl0aGVyIGluZGljYXRlcw0KICAgICAgR1NTX1NfQ09NUExFVEUgYW5k IGRvZXMgbm90IGluY2x1ZGUgYSBtZWNobGlzdE1JQyB0b2tlbiwgb3INCiAgICAgIGluZGljYXRl cyBHU1NfU19DT05USU5VRV9ORUVERUQgYW5kIGluY2x1ZGVzIGEgbWVjaGxpc3RNSUMgdG9rZW4N CiAgICAgIGFuZCBhbiBhY2NlcHRfaW5jb21wbGV0ZSBzdGF0ZTsgaWYgdGhlIE1JQyB0b2tlbiBl eGNoYW5nZSBpcw0KICAgICAgcmVxdWlyZWQsIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRp Y2F0ZXMNCiAgICAgIEdTU19TX0NPTlRJTlVFX05FRURFRCwgYW5kIGluY2x1ZGVzIGEgbWVjaGxp c3RNSUMgdG9rZW4uDQogICAgICBBY2NlcHRvcnMgdGhhdCB3aXNoIHRvIGJlIGNvbXBhdGlibGUg d2l0aCBsZWdhY3kgV2luZG93cyBTUE5FR08NCiAgICAgIGltcGxlbWVudGF0aW9ucyBhcyBkZXNj cmliZWQgaW4gQXBwZW5kaXggQiBzaGFsbCBub3QgZ2VuZXJhdGUgYQ0KICAgICAgbWVjaGxpc3RN SUMgdG9rZW4gd2hlbiB0aGUgTUlDIHRva2VuIGV4Y2hhbmdlIGlzIG5vdCByZXF1aXJlZC4NCiAg ICAgIFRoZSBpbml0aWF0b3IgdGhlbiBwcm9jZXNzZXMgdGhlIGxhc3QgbWVjaGFuaXNtIHRva2Vu LCBhbmQgZG9lcw0KICAgICAgb25lIG9mIHRoZSBmb2xsb3dpbmc6DQoNCiAgICAgIChJKSBJZiBh IG1lY2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCwgYW5kIGlzIGNvcnJlY3RseQ0KICAgICAg ICAgdmVyaWZpZWQsIEdTU19Jbml0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzIEdTU19TX0NPTVBM RVRFLiAgVGhlDQogICAgICAgICBvdXRwdXQgbmVnb3RpYXRpb24gbWVzc2FnZSBjb250YWlucyBh IG1lY2hsaXN0TUlDIHRva2VuLCBhbmQgYW4NCiAgICAgICAgIGFjY2VwdF9jb21wbGV0ZSBzdGF0 ZS4gIFRoZSBhY2NlcHRvciBNVVNUIHRoZW4gdmVyaWZ5IHRoaXMNCiAgICAgICAgIG1lY2hsaXN0 TUlDIHRva2VuLg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBK dW5lIDEsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDEzXQ0KDA0KSW50ZXJuZXQtRHJhZnQg ICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0 DQoNCg0KICAgICAgKElJKSBJZiBhIG1lY2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCBidXQg aXMgaW5jb3JyZWN0LCB0aGUNCiAgICAgICAgIG5lZ290aWF0aW9uIFNIQUxMIGJlIHRlcm1pbmF0 ZWQuICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkNCiAgICAgICAgIGluZGljYXRlcyBHU1NfU19E RUZFQ1RJVkVfVE9LRU4uDQoNCiAgICAgIChJSUkpIElmIG5vIG1lY2hsaXN0TUlDIHRva2VuIHdh cyBpbmNsdWRlZCwgYW5kIHRoZSBNSUMgdG9rZW4NCiAgICAgICAgIGV4Y2hhbmdlIGlzIG5vdCBy ZXF1aXJlZCwgR1NTX0luaXRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMNCiAgICAgICAgIEdTU19T X0NPTVBMRVRFIHdpdGggbm8gb3V0cHV0IHRva2VuLg0KDQogICAgICAoSVYpIElmIG5vIG1lY2hs aXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCwgYnV0IHRoZSBNSUMgdG9rZW4NCiAgICAgICAgIGV4 Y2hhbmdlIGlzIHJlcXVpcmVkLCB0aGUgbmVnb3RpYXRpb24gU0hBTEwgYmUgdGVybWluYXRlZC4N CiAgICAgICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfREVGRUNU SVZFX1RPS0VOLg0KDQogICBjKSBJbiB0aGUgY2FzZSB0aGF0IHRoZSBjaG9zZW4gbWVjaGFuaXNt IHVzZXMgYW4gb2RkIG51bWJlciBvZg0KICAgICAgbWVjaGFuaXNtIHRva2VucyAobmFtZWx5IHRo ZSBpbml0aWF0b3Igc2VuZHMgdGhlIGxhc3QgbWVjaGFuaXNtDQogICAgICB0b2tlbiksIHRoZSBp bml0aWF0b3IgZG9lcyB0aGUgZm9sbG93aW5nIHdoZW4gZW1pdHRpbmcgdGhlDQogICAgICBuZWdv dGlhdGlvbiBtZXNzYWdlIGNvbnRhaW5pbmcgdGhlIGxhc3QgbWVjaGFuaXNtIHRva2VuOiBpZiB0 aGUNCiAgICAgIG5lZ1Jlc3VsdCBzdGF0ZSB3YXMgcmVxdWVzdF9taWMgaW4gdGhlIGZpcnN0IHJl cGx5IGZyb20gdGhlDQogICAgICB0YXJnZXQsIGEgbWVjaGxpc3RNSUMgdG9rZW4gTVVTVCBiZSBp bmNsdWRlZCwgb3RoZXJ3aXNlIHRoZQ0KICAgICAgbWVjaGxpc3RNSUMgdG9rZW4gaXMgT1BUSU9O QUwuICBJbiB0aGUgY2FzZSB0aGF0IHRoZSBvcHRpbWlzdGljDQogICAgICBtZWNoYW5pc20gdG9r ZW4gaXMgdGhlIG9ubHkgbWVjaGFuaXNtIHRva2VuIGZvciB0aGUgaW5pdGlhdG9yJ3MNCiAgICAg IHByZWZlcnJlZCBtZWNoYW5pc20sIHRoZSBtZWNobGlzdE1JQyB0b2tlbiBpcyBPUFRJT05BTC4N CiAgICAgIEdTU19Jbml0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzIEdTU19TX0NPTlRJTlVFX05F RURFRC4NCiAgICAgIEluaXRpYXRvcnMgdGhhdCB3aXNoIHRvIGJlIGNvbXBhdGlibGUgd2l0aCBs ZWdhY3kgV2luZG93cyBTUE5FR08NCiAgICAgIGltcGxlbWVudGF0aW9ucyBhcyBkZXNjcmliZWQg aW4gQXBwZW5kaXggQiBzaGFsbCBub3QgZ2VuZXJhdGUgYQ0KICAgICAgbWVjaGxpc3RNSUMgdG9r ZW4gd2hlbiB0aGUgTUlDIHRva2VuIGV4Y2hhbmdlIGlzIG5vdCByZXF1aXJlZC4NCiAgICAgIFRo ZSBhY2NlcHRvciB0aGVuIHByb2Nlc3NlcyB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW4gYW5kIGRv ZXMgb25lDQogICAgICBvZiB0aGUgZm9sbG93aW5nOg0KDQogICAgICAoSSkgSWYgYSBtZWNobGlz dE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQgYW5kIGlzIGNvcnJlY3RseSB2ZXJpZmllZCwNCiAgICAg ICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfQ09NUExFVEUuICBU aGUgb3V0cHV0DQogICAgICAgICBuZWdvdGlhdGlvbiBtZXNzYWdlIGNvbnRhaW5zIGEgbWVjaGxp c3RNSUMgdG9rZW4gYW5kIGFuDQogICAgICAgICBhY2NlcHRfY29tcGxldGUgc3RhdGUuICBUaGUg aW5pdGlhdG9yIE1VU1QgdGhlbiB2ZXJpZnkgdGhpcw0KICAgICAgICAgbWVjaGxpc3RNSUMgdG9r ZW4uDQoNCiAgICAgIChJSSkgSWYgYSBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQgYnV0 IGlzIGluY29ycmVjdCwgdGhlDQogICAgICAgICBuZWdvdGlhdGlvbiBTSEFMTCBiZSB0ZXJtaW5h dGVkLiAgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgpDQogICAgICAgICBpbmRpY2F0ZXMgR1NTX1Nf REVGRUNUSVZFX1RPS0VOLg0KDQogICAgICAoSUlJKSBJZiBubyBtZWNobGlzdE1JQyB0b2tlbiB3 YXMgaW5jbHVkZWQgYnV0IHRoZSBtZWNobGlzdE1JQw0KICAgICAgICAgdG9rZW4gZXhjaGFuZ2Ug aXMgbm90IHJlcXVpcmVkLCBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkNCiAgICAgICAgIGluZGlj YXRlcyBHU1NfU19DT01QTEVURS4gIFRoZSBvdXRwdXQgbmVnb3RpYXRpb24gbWVzc2FnZQ0KICAg ICAgICAgY29udGFpbnMgYW4gYWNjZXB0X2NvbXBsZXRlIHN0YXRlLg0KDQogICAgICAoSVYpIElu IHRoZSBjYXNlIHRoYXQgdGhlIG9wdGltaXN0aWMgbWVjaGFuaXNtIHRva2VuIGlzIGFsc28gdGhl DQogICAgICAgICBsYXN0IG1lY2hhbmlzbSB0b2tlbiAod2hlbiB0aGUgaW5pdGlhdG9yJ3MgcHJl ZmVycmVkIG1lY2hhbmlzbQ0KICAgICAgICAgaXMgYWNjZXB0ZWQgYnkgdGhlIHRhcmdldCkgYW5k IHRoZSB0YXJnZXQgc2VuZHMgYSByZXF1ZXN0X21pYw0KICAgICAgICAgc3RhdGUgYnV0IHRoZSBp bml0aWF0b3IgZGlkIG5vdCBzZW5kIGEgbWVjaGxpc3RNSUMgdG9rZW4sIHRoZQ0KICAgICAgICAg dGFyZ2V0IHRoZW4gTVVTVCBpbmNsdWRlIGEgbWVjaGxpc3RNSUMgdG9rZW4gaW4gdGhhdCBmaXJz dA0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAg ICAgICAgICAgICAgICAgW1BhZ2UgMTRdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJ IE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICAgICAg ICByZXBseS4gIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMNCiAgICAgICAgIEdT U19TX0NPTlRJTlVFX05FRURFRC4gIFRoZSBpbml0aWF0b3IgTVVTVCB2ZXJpZnkgdGhlIHJlY2Vp dmVkDQogICAgICAgICBtZWNobGlzdE1JQyB0b2tlbiBhbmQgZ2VuZXJhdGUgYSBtZWNobGlzdE1J QyB0b2tlbiB0byBzZW5kIGJhY2sNCiAgICAgICAgIHRvIHRoZSB0YXJnZXQuICBUaGUgdGFyZ2V0 IFNIQUxMIGluIHR1cm4gdmVyaWZ5IHRoZSByZXR1cm5lZA0KICAgICAgICAgbWVjaGxpc3RNSUMg dG9rZW4gYW5kIGNvbXBsZXRlIHRoZSBuZWdvdGlhdGlvbi4NCg0KICAgICAgKFYpIElmIG5vIG1l Y2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCBhbmQgdGhlIGFjY2VwdG9yIHNlbnQgYQ0KICAg ICAgICAgcmVxdWVzdF9taWMgc3RhdGUgaW4gdGhlIGZpcnN0IHJlcGx5IG1lc3NhZ2UgKHRoZSBl eGNoYW5nZSBvZg0KICAgICAgICAgTUlDIHRva2VucyBpcyByZXF1aXJlZCksIHRoZSBuZWdvdGlh dGlvbiBTSEFMTCBiZSB0ZXJtaW5hdGVkLg0KICAgICAgICAgR1NTX0FjY2VwdF9zZWNfY29udGV4 dCgpIGluZGljYXRlcyBHU1NfU19ERUZFQ1RJVkVfVE9LRU4uDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAg ICAgICAgICAgICAgW1BhZ2UgMTVdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5l Z290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQo2LiAgRXh0ZW5z aWJpbGl0eQ0KDQogICBUd28gbWVjaGFuaXNtcyBhcmUgcHJvdmlkZWQgZm9yIGV4dGVuc2liaWxp dHkuICBGaXJzdCwgdGhlIEFTTi4xDQogICBzdHJ1Y3R1cmVzIGluIHRoaXMgc3BlY2lmaWNhdGlv biBNQVkgYmUgZXhwYW5kZWQgYnkgSUVURiBzdGFuZGFyZHMNCiAgIGFjdGlvbi4gIEltcGxlbWVu dGF0aW9ucyByZWNlaXZpbmcgdW5rbm93biBmaWVsZHMgTVVTVCBpZ25vcmUgdGhlc2UNCiAgIGZp ZWxkcy4NCg0KICAgU2Vjb25kbHksIE9JRHMgY29ycmVzcG9uZGluZyB0byBhIGRlc2lyZWQgbWVj aGFuaXNtIGF0dHJpYnV0ZSBtYXkgYmUNCiAgIGluY2x1ZGVkIGluIHRoZSBzZXQgb2YgcHJlZmVy cmVkIG1lY2hhbmlzbXMgYnkgYW4gaW5pdGlhdG9yLiAgVGhlDQogICBhY2NlcHRvciBjYW4gY2hv b3NlIHRvIGhvbm9yIHRoaXMgcmVxdWVzdCBieSBwcmVmZXJyaW5nIG1lY2hhbmlzbXMNCiAgIHRo YXQgaGF2ZSB0aGUgaW5jbHVkZWQgYXR0cmlidXRlcy4gIEZ1dHVyZSB3b3JrIHdpdGhpbiB0aGUg S2l0dGVuDQogICB3b3JraW5nIGdyb3VwIGlzIGV4cGVjdGVkIHRvIHN0YW5kYXJkaXplIGNvbW1v biBhdHRyaWJ1dGVzIHRoYXQNCiAgIFNQTkVHTyBtZWNoYW5pc21zIG1heSB3aXNoIHRvIHN1cHBv cnQuICBBdCB0aGlzIHRpbWUgaXQgaXMgc3VmZmljaWVudA0KICAgdG8gc2F5IHRoYXQgaW5pdGlh dG9ycyBNQVkgaW5jbHVkZSBPSURzIHRoYXQgZG8gbm90IGNvcnJlc3BvbmQgdG8NCiAgIG1lY2hh bmlzbXMgYnV0IGluc3RlYWQgY29ycmVzcG9uZCB0byBkZXNpcmVkIG1lY2hhbmlzbSBhdHRyaWJ1 dGVzIGluDQogICB0aGVpciByZXF1ZXN0cy4gIFN1Y2ggT0lEcyBNQVkgaW5mbHVlbmNlIHRoZSBh Y2NlcHRvcidzIGNob2ljZSBvZg0KICAgbWVjaGFuaXNtLiAgQXMgZGlzY3Vzc2VkIGluIFNlY3Rp b24gNSwgaWYgdGhlcmUgYXJlIG1lY2hhbmlzbXMgdGhhdA0KICAgaWYgcHJlc2VudCBpbiB0aGUg aW5pdGlhdG9yJ3MgbGlzdCBvZiBtZWNoYW5pc21zIG1pZ2h0IGJlIHByZWZlcnJlZA0KICAgYnkg dGhlIGFjY2VwdG9yIHRvIHRoZSBpbml0aWF0b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNtLCB0aGUg YWNjZXB0b3INCiAgIE1VU1QgZGVtYW5kIHRoZSBNSUMgdG9rZW4gZXhjaGFuZ2UuICBBcyBhIGNv bnNlcXVlbmNlLCBhY2NlcHRvcnMgTVVTVA0KICAgZGVtYW5kIHRoZSBNSUMgdG9rZW4gZXhjaGFu Z2UgaWYgdGhleSBzdXBwb3J0IG5lZ290aWF0aW9uIG9mDQogICBhdHRyaWJ1dGVzIG5vdCBhdmFp bGFibGUgaW4gdGhlIGluaXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5pc20NCiAgIHJlZ2FyZGxl c3Mgb2Ygd2hldGhlciB0aGUgaW5pdGlhdG9yIGFjdHVhbGx5IHJlcXVlc3RlZCB0aGVzZQ0KICAg YXR0cmlidXRlcy4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUg ICAgICAgICAgICAgICAgIFtQYWdlIDE2XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQ SSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KNy4gIFNl Y3VyaXR5IENvbnNpZGVyYXRpb25zDQoNCiAgIEluIG9yZGVyIHRvIHByb2R1Y2UgdGhlIE1JQyB0 b2tlbiBmb3IgdGhlIG1lY2hhbmlzbSBsaXN0LCB0aGUNCiAgIG1lY2hhbmlzbSBtdXN0IHByb3Zp ZGUgaW50ZWdyaXR5IHByb3RlY3Rpb24uICBXaGVuIHRoZSBzZWxlY3RlZA0KICAgbWVjaGFuaXNt IGRvZXMgbm90IHN1cHBvcnQgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHRoZSBuZWdvdGlhdGlvbiBp cw0KICAgdnVsbmVyYWJsZTogYW4gYWN0aXZlIGF0dGFja2VyIGNhbiBmb3JjZSBpdCB0byB1c2Ug YSBzZWN1cml0eQ0KICAgbWVjaGFuaXNtIHRoYXQgaXMgbm90IG11dHVhbGx5IHByZWZlcnJlZCBi dXQgaXMgYWNjZXB0YWJsZSB0byB0aGUNCiAgIHRhcmdldC4NCg0KICAgVGhpcyBwcm90b2NvbCBw cm92aWRlcyB0aGUgZm9sbG93aW5nIGd1YXJhbnRlZXMgd2hlbiBwZXItbWVzc2FnZQ0KICAgaW50 ZWdyaXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhlIGVzdGFibGlzaGVkIG1lY2hhbmlz bSBjb250ZXh0DQogICBhbmQgdGhlIG1lY2hhbmlzbSBsaXN0IHdhcyBhbHRlcmVkIGJ5IGFuIGFk dmVyc2FyeSBzdWNoIHRoYXQgYQ0KICAgbWVjaGFuaXNtIHdoaWNoIGlzIG5vdCBtdXR1YWxseSBw cmVmZXJyZWQgY291bGQgYmUgc2VsZWN0ZWQ6DQoNCiAgIG8gIGlmIHRoZSBsYXN0IG1lY2hhbmlz bSB0b2tlbiBpcyBzZW50IGJ5IHRoZSBpbml0aWF0b3IsIGJvdGggcGVlcnMNCiAgICAgIHNoYWxs IGZhaWw7DQogICBvICBpZiB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW4gaXMgc2VudCBieSB0aGUg YWNjZXB0b3IsIHRoZSBhY2NlcHRvcg0KICAgICAgc2hhbGwgbm90IGNvbXBsZXRlIGFuZCB0aGUg aW5pdGlhdG9yIGF0IHdvcnN0IHNoYWxsIGNvbXBsZXRlIHdpdGgNCiAgICAgIGl0cyBwcmVmZXJy ZWQgbWVjaGFuaXNtIGJlaW5nIHNlbGVjdGVkLg0KDQogICBUaGUgbmVnb3RpYXRpb24gbWF5IG5v dCBiZSB0ZXJtaW5hdGVkIGlmIGFuIGFsdGVyYXRpb24gd2FzIG1hZGUgYnV0DQogICBpdCBoYWQg bm8gbWF0ZXJpYWwgaW1wYWN0Lg0KDQogICBUaGUgcHJvdGVjdGlvbiBvZiB0aGUgbmVnb3RpYXRp b24gZGVwZW5kcyBvbiB0aGUgc3RyZW5ndGggb2YgdGhlDQogICBpbnRlZ3JpdHkgcHJvdGVjdGlv bi4gIEluIHBhcnRpY3VsYXIsIHRoZSBzdHJlbmd0aCBvZiBTUE5FR08gaXMgbm8NCiAgIHN0cm9u Z2VyIHRoYW4gdGhlIGludGVncml0eSBwcm90ZWN0aW9uIG9mIHRoZSB3ZWFrZXN0IG1lY2hhbmlz bQ0KICAgYWNjZXB0YWJsZSB0byBHU1MtQVBJIHBlZXJzLg0KDQogICBJbiBhbGwgY2FzZXMsIHRo ZSBjb21tdW5pY2F0aW5nIHBlZXJzIGFyZSBleHBvc2VkIHRvIHRoZSBkZW5pYWwgb2YNCiAgIHNl cnZpY2UgdGhyZWF0Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K Wmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAg ICAgICAgW1BhZ2UgMTddDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0 aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQo4LiAgSUFOQSBDb25zaWRl cmF0aW9ucw0KDQogICBUaGlzIGRvY3VtZW50IGhhcyBubyBhY3Rpb25zIGZvciBJQU5BLg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAg ICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMThdDQoMDQpJ bnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAg IERlY2VtYmVyIDIwMDQNCg0KDQo5LiAgQWNrbm93bGVkZ21lbnRzDQoNCiAgIFRoZSBhdXRob3Jz IHdpc2ggdG8gdGhhbmsgU2FtIEhhcnRtYW4sIE5pY29sYXMgV2lsbGlhbXMsIEtlbiBSYWVidXJu LA0KICAgSmVmZiBBbHRtYW4sIFRvbSBZdSwgQ3Jpc3RpYW4gSWxhYyBhbmQgTWFydGluIFJleCBm b3IgdGhlaXIgY29tbWVudHMNCiAgIGFuZCBzdWdnZXN0aW9ucyBkdXJpbmcgZGV2ZWxvcG1lbnQg b2YgdGhpcyBkb2N1bWVudC4NCg0KICAgTHVrZSBIb3dhcmQgcHJvdmlkZWQgYSBwcm90b3R5cGUg b2YgdGhpcyBwcm90b2NvbCBpbiBIZWltZGFsIGFuZA0KICAgcmVzb2x2ZWQgc2V2ZXJhbCBpc3N1 ZXMgaW4gdGhlIGluaXRpYWwgZHJhZnQuDQoNCiAgIEVyaWMgQmFpemUgYW5kIERlbmlzIFBpbmth cyB3cm90ZSB0aGUgb3JpZ2luYWwgU1BORUdPIHNwZWNpZmljYXRpb24NCiAgIFtSRkMyNDc4XSBv ZiB3aGljaCBzb21lIG9mIHRoZSB0ZXh0IGhhcyBiZWVuIHJldGFpbmVkIGluIHRoaXMNCiAgIGRv Y3VtZW50Lg0KDQoxMCAgTm9ybWF0aXZlIFJlZmVyZW5jZXMNCg0KICAgW1JGQzIxMTldICBCcmFk bmVyLCBTLiwgIktleSB3b3JkcyBmb3IgdXNlIGluIFJGQ3MgdG8gSW5kaWNhdGUNCiAgICAgICAg ICAgICAgUmVxdWlyZW1lbnQgTGV2ZWxzIiwgQkNQIDE0LCBSRkMgMjExOSwgTWFyY2ggMTk5Ny4N Cg0KICAgW1JGQzI0NzhdICBCYWl6ZSwgRS4gYW5kIEQuIFBpbmthcywgIlRoZSBTaW1wbGUgYW5k IFByb3RlY3RlZCBHU1MtQVBJDQogICAgICAgICAgICAgIE5lZ290aWF0aW9uIE1lY2hhbmlzbSIs IFJGQyAyNDc4LCBEZWNlbWJlciAxOTk4Lg0KDQogICBbUkZDMjc0M10gIExpbm4sIEouLCAiR2Vu ZXJpYyBTZWN1cml0eSBTZXJ2aWNlIEFwcGxpY2F0aW9uIFByb2dyYW0NCiAgICAgICAgICAgICAg SW50ZXJmYWNlIFZlcnNpb24gMiwgVXBkYXRlIDEiLCBSRkMgMjc0MywgSmFudWFyeSAyMDAwLg0K DQogICBbWDY5MF0gICAgIEFTTi4xIGVuY29kaW5nIHJ1bGVzOiBTcGVjaWZpY2F0aW9uIG9mIEJh c2ljIEVuY29kaW5nIA0KICAgICAgICAgICAgICBSdWxlcyAoQkVSKSwgQ2Fub25pY2FsIEVuY29k aW5nIFJ1bGVzIChDRVIpIGFuZCANCiAgICAgICAgICAgICAgRGlzdGluZ3Vpc2hlZCBFbmNvZGlu ZyBSdWxlcyAoREVSKSwgSVRVLVQgUmVjb21tZW5kYXRpb24gDQogICAgICAgICAgICAgIFguNjkw ICgxOTk3KSB8IElTTy9JRUMgSW50ZXJuYXRpb25hbCBTdGFuZGFyZCA4ODI1LTE6MTk5OC4NCg0K QXV0aG9ycycgQWRkcmVzc2VzDQoNCiAgIExhcnJ5IFpodQ0KICAgTWljcm9zb2Z0IENvcnBvcmF0 aW9uDQogICBPbmUgTWljcm9zb2Z0IFdheQ0KICAgUmVkbW9uZCwgV0EgIDk4MDUyDQogICBVUw0K DQogICBFTWFpbDogbHpodUBtaWNyb3NvZnQuY29tDQoNCg0KICAgUGF1bCBMZWFjaA0KICAgTWlj cm9zb2Z0IENvcnBvcmF0aW9uDQogICBPbmUgTWljcm9zb2Z0IFdheQ0KICAgUmVkbW9uZCwgV0Eg IDk4MDUyDQogICBVUw0KDQogICBFTWFpbDogcGF1bGxlQG1pY3Jvc29mdC5jb20NCg0KDQoNCg0K DQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxLCAyMDA1ICAg ICAgICAgICAgICAgICBbUGFnZSAxOV0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkg TmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCiAgIEthcnRo aWsgSmFnYW5hdGhhbg0KICAgTWljcm9zb2Z0IENvcnBvcmF0aW9uDQogICBPbmUgTWljcm9zb2Z0 IFdheQ0KICAgUmVkbW9uZCwgV0EgIDk4MDUyDQogICBVUw0KDQogICBFTWFpbDoga2FydGhpa2pA bWljcm9zb2Z0LmNvbQ0KDQoNCiAgIFd5bGx5cyBJbmdlcnNvbGwNCiAgIFN1biBNaWNyb3N5c3Rl bXMNCiAgIDE3NzUgV2llaGxlIEF2ZW51ZSwgMm5kIEZsb29yDQogICBSZXN0b24sIFZBICAyMDE5 MA0KICAgVVMNCg0KICAgRU1haWw6IHd5bGx5cy5pbmdlcnNvbGxAc3VuLmNvbQ0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAg ICAgICAgICAgIFtQYWdlIDIwXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdv dGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KQXBwZW5kaXggQS4g IEdTUy1BUEkgTmVnb3RpYXRpb24gU3VwcG9ydCBBUEkNCg0KICAgSW4gb3JkZXIgdG8gcHJvdmlk ZSB0byBhIEdTUy1BUEkgY2FsbGVyIChlaXRoZXIgdGhlIGluaXRpYXRvciBvciB0aGUNCiAgIHRh cmdldCBvciBib3RoKSB0aGUgYWJpbGl0eSB0byBjaG9vc2UgYW1vbmcgdGhlIHNldCBvZiBzdXBw b3J0ZWQNCiAgIG1lY2hhbmlzbXMgYSByZWR1Y2VkIHNldCBvZiBtZWNoYW5pc21zIGZvciBuZWdv dGlhdGlvbiwgdHdvDQogICBhZGRpdGlvbmFsIEFQSXMgYXJlIGRlZmluZWQ6DQoNCiAgIG8gIEdT U19HZXRfbmVnX21lY2hzKCkgaW5kaWNhdGVzIHRoZSBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNt cw0KICAgICAgYXZhaWxhYmxlIG9uIHRoZSBsb2NhbCBzeXN0ZW0gdG8gdGhlIGNhbGxlciBmb3Ig bmVnb3RpYXRpb24sIGJhc2VkDQogICAgICBvbiB0aGUgY3JlZGVudGlhbHMgYmVpbmcgdXNlZC4N CiAgIG8gIEdTU19TZXRfbmVnX21lY2hzKCkgc3BlY2lmaWVzIHRoZSBzZXQgb2Ygc2VjdXJpdHkg bWVjaGFuaXNtcyB0byBiZQ0KICAgICAgdXNlZCBvbiB0aGUgbG9jYWwgc3lzdGVtIGJ5IHRoZSBj YWxsZXIgZm9yIG5lZ290aWF0aW9uLCBmb3IgdGhlDQogICAgICBnaXZlbiBjcmVkZW50aWFscy4N Cg0KQS4xICBHU1NfU2V0X25lZ19tZWNocyBjYWxsDQoNCiAgIElucHV0czoNCg0KICAgbyAgY3Jl ZF9oYW5kbGUgQ1JFREVOVElBTCBIQU5ETEUsIC0tIE5VTEwgc3BlY2lmaWVzIGRlZmF1bHQNCiAg ICAgIC0tIGNyZWRlbnRpYWxzDQogICBvICBtZWNoX3NldCBTRVQgT0YgT0JKRUNUIElERU5USUZJ RVINCg0KICAgT3V0cHV0czoNCg0KICAgbyAgbWFqb3Jfc3RhdHVzIElOVEVHRVIsDQogICBvICBt aW5vcl9zdGF0dXMgSU5URUdFUg0KDQogICBSZXR1cm4gbWFqb3Jfc3RhdHVzIGNvZGVzOg0KDQog ICBvICBHU1NfU19DT01QTEVURSBpbmRpY2F0ZXMgdGhhdCB0aGUgc2V0IG9mIHNlY3VyaXR5IG1l Y2hhbmlzbXMNCiAgICAgIGF2YWlsYWJsZSBmb3IgbmVnb3RpYXRpb24gaGFzIGJlZW4gc2V0IHRv IG1lY2hfc2V0Lg0KICAgbyAgR1NTX1NfRkFJTFVSRSBpbmRpY2F0ZXMgdGhhdCB0aGUgcmVxdWVz dGVkIG9wZXJhdGlvbiBjb3VsZCBub3QgYmUNCiAgICAgIHBlcmZvcm1lZCBmb3IgcmVhc29ucyB1 bnNwZWNpZmllZCBhdCB0aGUgR1NTLUFQSSBsZXZlbC4NCg0KICAgQWxsb3dzIGNhbGxlcnMgdG8g c3BlY2lmeSB0aGUgc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMgdGhhdCBtYXkgYmUNCiAgIG5l Z290aWF0ZWQgd2l0aCB0aGUgY3JlZGVudGlhbCBpZGVudGlmaWVkIGJ5IGNyZWRfaGFuZGxlLiAg VGhpcyBjYWxsDQogICBpcyBpbnRlbmRlZCBmb3Igc3VwcG9ydCBvZiBzcGVjaWFsaXplZCBjYWxs ZXJzIHdobyBuZWVkIHRvIHJlc3RyaWN0DQogICB0aGUgc2V0IG9mIG5lZ290aWFibGUgc2VjdXJp dHkgbWVjaGFuaXNtcyBmcm9tIHRoZSBzZXQgb2YgYWxsDQogICBzZWN1cml0eSBtZWNoYW5pc21z IGF2YWlsYWJsZSB0byB0aGUgY2FsbGVyIChiYXNlZCBvbiBhdmFpbGFibGUNCiAgIGNyZWRlbnRp YWxzKS4gIE5vdGUgdGhhdCBpZiBtb3JlIHRoYW4gb25lIG1lY2hhbmlzbSBpcyBzcGVjaWZpZWQg aW4NCiAgIG1lY2hfc2V0LCB0aGUgb3JkZXIgaW4gd2hpY2ggdGhvc2UgbWVjaGFuaXNtcyBhcmUg c3BlY2lmaWVkIGltcGxpZXMgYQ0KICAgcmVsYXRpdmUgcHJlZmVyZW5jZS4NCg0KQS4yICBHU1Nf R2V0X25lZ19tZWNocyBjYWxsDQoNCiAgIElucHV0Og0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAg ICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDIx XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20g ICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAgbyAgY3JlZF9oYW5kbGUgQ1JFREVOVElBTCBI QU5ETEUgLS0gTlVMTCBzcGVjaWZpZXMgZGVmYXVsdA0KICAgICAgLS0gY3JlZGVudGlhbHMNCg0K ICAgT3V0cHV0czoNCg0KICAgbyAgbWFqb3Jfc3RhdHVzIElOVEVHRVIsDQogICBvICBtaW5vcl9z dGF0dXMgSU5URUdFUiwNCiAgIG8gIG1lY2hfc2V0IFNFVCBPRiBPQkpFQ1QgSURFTlRJRklFUg0K DQogICBSZXR1cm4gbWFqb3Jfc3RhdHVzIGNvZGVzOg0KDQogICBvICBHU1NfU19DT01QTEVURSBp bmRpY2F0ZXMgdGhhdCB0aGUgc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMNCiAgICAgIGF2YWls YWJsZSBmb3IgbmVnb3RpYXRpb24gaGFzIGJlZW4gcmV0dXJuZWQgaW4gbWVjaF9zZXQuDQogICBv ICBHU1NfU19GQUlMVVJFIGluZGljYXRlcyB0aGF0IHRoZSByZXF1ZXN0ZWQgb3BlcmF0aW9uIGNv dWxkIG5vdCBiZQ0KICAgICAgcGVyZm9ybWVkIGZvciByZWFzb25zIHVuc3BlY2lmaWVkIGF0IHRo ZSBHU1MtQVBJIGxldmVsLg0KDQogICBBbGxvd3MgY2FsbGVycyB0byBkZXRlcm1pbmUgdGhlIHNl dCBvZiBzZWN1cml0eSBtZWNoYW5pc21zIGF2YWlsYWJsZQ0KICAgZm9yIG5lZ290aWF0aW9uIHdp dGggdGhlIGNyZWRlbnRpYWwgaWRlbnRpZmllZCBieSBjcmVkX2hhbmRsZS4gIFRoaXMNCiAgIGNh bGwgaXMgaW50ZW5kZWQgZm9yIHN1cHBvcnQgb2Ygc3BlY2lhbGl6ZWQgY2FsbGVycyB3aG8gbmVl ZCB0bw0KICAgcmVkdWNlIHRoZSBzZXQgb2YgbmVnb3RpYWJsZSBzZWN1cml0eSBtZWNoYW5pc21z IGZyb20gdGhlIHNldCBvZg0KICAgc3VwcG9ydGVkIHNlY3VyaXR5IG1lY2hhbmlzbXMgYXZhaWxh YmxlIHRvIHRoZSBjYWxsZXIgKGJhc2VkIG9uDQogICBhdmFpbGFibGUgY3JlZGVudGlhbHMpLg0K DQogICBOb3RlOiBUaGUgR1NTX0luZGljYXRlX21lY2hzKCkgZnVuY3Rpb24gaW5kaWNhdGVzIHRo ZSBmdWxsIHNldCBvZg0KICAgbWVjaGFuaXNtIHR5cGVzIGF2YWlsYWJsZSBvbiB0aGUgbG9jYWwg c3lzdGVtLiAgU2luY2UgdGhpcyBjYWxsIGhhcw0KICAgbm8gaW5wdXQgcGFyYW1ldGVyLCB0aGUg cmV0dXJuZWQgc2V0IGlzIG5vdCBuZWNlc3NhcmlseSBhdmFpbGFibGUgZm9yDQogICBhbGwgY3Jl ZGVudGlhbHMuDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxLCAyMDA1ICAgICAgICAg ICAgICAgICBbUGFnZSAyMl0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3Rp YXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCkFwcGVuZGl4IEIuICBD aGFuZ2VzIHNpbmNlIFJGQzI0NzgNCg0KICAgICAgU1BORUdPIGltcGxlbWVudGF0aW9ucyBpbiBX aW5kb3dzIDIwMDAvV2luZG93cyBYUC9XaW5kb3dzIFNlcnZlcg0KICAgICAgMjAwMyBoYXZlIHRo ZSBmb2xsb3dpbmcgYmVoYXZpb3I6IG5vIG1lY2hsaXN0TUlDIGlzIHByb2R1Y2VkIGFuZA0KICAg ICAgbWVjaGxpc3RNSUMgaXMgbm90IHByb2Nlc3NlZCBpZiBvbmUgaXMgcHJvdmlkZWQ7IGlmIHRo ZSBpbml0aWF0b3INCiAgICAgIHNlbmRzIHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tlbiwgdGhlIGFj Y2VwdG9yIHdpbGwgc2VuZCBiYWNrIGENCiAgICAgIG5lZ290aWF0aW9uIHRva2VuIHdpdGggYW4g YWNjZXB0X2NvbXBsZXRlIHN0YXRlIGFuZCBubyBtZWNobGlzdE1JQw0KICAgICAgdG9rZW4uICBJ biBhZGRpdGlvbiwgdGhlIE9JRCAoMS4yLjg0MC40ODAxOC4xLjIuMikgY2FuIGJlIHVzZWQgdG8N CiAgICAgIGlkZW50aWZ5IHRoZSBHU1MtQVBJIEtlcmJlcm9zIFZlcnNpb24gNSBtZWNoYW5pc20u DQoNCiAgICAgIFRoZSBmb2xsb3dpbmcgY2hhbmdlcyBoYXZlIGJlZW4gbWFkZSB0byBiZSBjb21w YXRpYmxlIHdpdGggdGhlc2UNCiAgICAgIGxlZ2FjeSBpbXBsZW1lbnRhdGlvbnMuDQoNCiAgICAg ICogIE5lZ1Rva2VuVGFyZyBpcyBjaGFuZ2VkIHRvIG5lZ1Rva2VuUmVzcCBhbmQgaXQgaXMgdGhl IG1lc3NhZ2UNCiAgICAgICAgIGZvcm1hdCBmb3IgYWxsIHN1YnNlcXVlbnQgbmVnb3RpYXRpb24g dG9rZW5zLg0KICAgICAgKiAgTmVnVG9rZW5Jbml0IGlzIHRoZSBtZXNzYWdlIGZvciB0aGUgaW5p dGlhbCBuZWdvdGlhdGlvbiBtZXNzYWdlDQogICAgICAgICBhbmQgdGhhdCBtZXNzYWdlIG9ubHku DQogICAgICAqICBtZWNoVHlwZXMgaW4gbmVnVG9rZW5Jbml0IGlzIG5vdCBvcHRpb25hbC4NCiAg ICAgICogIFR3byBNSUMgdG9rZW5zIGFyZSBleGNoYW5nZWQsIG9uZSBpbiBlYWNoIGRpcmVjdGlv bi4NCiAgICAgICogIElmIHRoZSBzZWxlY3RlZCBtZWNoYW5pc20gaXMgYWxzbyB0aGUgbW9zdCBw cmVmZXJyZWQgbWVjaGFuaXNtDQogICAgICAgICBmb3IgYm90aCBwZWVycywgaXQgaXMgc2FmZSB0 byBvbWl0IHRoZSBNSUMgdG9rZW5zLg0KDQogICAgICBJZiBhdCBsZWFzdCBvbmUgb2YgdGhlIHR3 byBwZWVycyBpbXBsZW1lbnRzIHRoZSBwc2V1ZG8gbWVjaGFuaXNtDQogICAgICBpbiB0aGlzIGRv Y3VtZW50LCB0aGUgbmVnb3RpYXRpb24gaXMgcHJvdGVjdGVkLg0KDQogICAgICBUaGUgZm9sbG93 aW5nIGNoYW5nZXMgYXJlIHRvIGFkZHJlc3MgdGhlIHByb2JsZW1zIGluIFJGQyAyNDc4Lg0KDQog ICAgICAqICByZXFGbGFncyBpcyBub3QgcHJvdGVjdGVkIHRoZXJlZm9yZSBpdCBzaG91bGQgbm90 IGltcGFjdCB0aGUNCiAgICAgICAgIG5lZ290aWF0aW9uLg0KICAgICAgKiAgREVSIGVuY29kaW5n IGlzIHJlcXVpcmVkLg0KICAgICAgKiAgR1NTX0dldE1JQygpIGlucHV0IGlzIGNsYXJpZmllZC4N CiAgICAgICogIFBlci1tZXNzYWdlIGludGVncml0eSBzZXJ2aWNlcyBhcmUgcmVxdWVzdGVkIGZv ciB0aGUgbmVnb3RpYXRlZA0KICAgICAgICAgbWVjaGFuaXNtLg0KDQogICBBbiBpbXBsZW1lbnRh dGlvbiB0aGF0IGNvbmZvcm1zIHRvIHRoaXMgc3BlY2lmaWNhdGlvbiAgd2lsbCBub3QNCiAgIGlu dGVyb3BlcmF0ZSB3aXRoIGEgc3RyaWN0IDI3NDggaW1wbGVtZW50YXRpb24uICBFdmVuIGlmIHRo ZSBuZXcNCiAgIGltcGxlbWVudGF0aW9uIGFsd2F5cyBzZW5kcyBhIG1lY2hsaXN0TUlDIHRva2Vu LCBpdCB3aWxsIHN0aWxsIGZhaWwNCiAgIHRvIGludGVyb3BlcmF0ZS4gIElmIGl0IGlzIGEgc2Vy dmVyLCBpdCB3aWxsIGZhaWwgYmVjYXVzZSBpdCByZXF1ZXN0cw0KICAgYSBtZWNobGlzdE1JQyB0 b2tlbiB1c2luZyBhbiBvcHRpb24gdGhhdCBvbGRlciBpbXBsZW1lbnRhdGlvbnMgc2ltcGx5DQog ICBkbyBub3Qgc3VwcG9ydC4gIENsaWVudHMgd2lsbCB0ZW5kIHRvIGZhaWwgYXMgd2VsbC4NCg0K ICAgQXMgYW4gYWx0ZXJuYXRpdmUgdG8gdGhlIGFwcHJvYWNoIGNob3NlbiBpbiB0aGlzIHNwZWNp ZmljYXRpb24sIHdlDQogICBjb3VsZCBoYXZlIGRvY3VtZW50ZWQgYSBjb3JyZWN0IGJlaGF2aW9y IHRoYXQgaXMgZnVsbHkgYmFja3dhcmQNCiAgIGNvbXBhdGlibGUgd2l0aCBSRkMgMjQ3OCBhbmQg aW5jbHVkZWQgYW4gYXBwZW5kaXggb24gaG93IHRvDQogICBpbnRlcm9wZXJhdGUgd2l0aCBleGlz dGluZyBpbmNvcnJlY3QgaW1wbGVtZW50YXRpb25zIG9mIFJGQyAyNDc4Lg0KDQogICBBcyBhIHBy YWN0aWNhbCBtYXR0ZXIsIHRoZSBTUE5FR08gaW1wbGVtZW50ZXJzIHdpdGhpbiB0aGUgSUVURiBo YXZlDQogICB2YWx1ZWQgaW50ZXJvcGVyYWJpbGl0eSB3aXRoIHRoZSBNaWNyb3NvZnQgaW1wbGVt ZW50YXRpb25zLiAgV2Ugd2VyZQ0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBp cmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMjNdDQoMDQpJbnRlcm5ldC1E cmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVy IDIwMDQNCg0KDQogICB1bmFibGUgdG8gY2hvb3NlIHRvIG1haW50YWluIHJlYXNvbmFibGUgc2Vj dXJpdHkgZ3VhcmFudGVlcywgbWFpbnRhaW4NCiAgIGludGVyb3BlcmFiaWxpdHkgd2l0aCB0aGUg TWljcm9zb2Z0IGltcGxlbWVudGF0aW9ucyBhbmQgbWFpbnRhaW4NCiAgIGludGVyb3BlcmFiaWxp dHkgd2l0aCBjb3JyZWN0IGltcGxlbWVudGF0aW9ucyBvZiBSRkMgMjQ3OC4gIFRoZQ0KICAgd29y a2luZyBncm91cCB3YXMgbm90IGF3YXJlIG9mIGFueSBSRkMgMjQ3OCBpbXBsZW1lbnRhdGlvbnMu ICBFdmVuIGlmDQogICB0aGVyZSBhcmUgUkZDIDI0NzggaW1wbGVtZW50YXRpb25zLCBpdCBpcyB1 bmxpa2VseSB0aGF0IHRoZXkgd2lsbA0KICAgaW50ZXJvcGVyYXRlIGJlY2F1c2Ugb2YgYSBjcml0 aWNhbCBmbGF3IGluIHRoZSBkZXNjcmlwdGlvbiBvZiB0aGUNCiAgIGVuY29kaW5nIG9mIHRoZSBt ZWNoYW5pc20gbGlzdCBpbiBSRkMgMjQ3OC4NCg0KICAgV2l0aCB0aGUgYXBwcm9hY2ggdGFrZW4g aW4gdGhpcyBzcGVjaWZpY2F0aW9uLCB3ZSBnZXQgc2VjdXJpdHkNCiAgIGJldHdlZW4gbmV3IGlt cGxlbWVudGF0aW9ucyBhbGwgdGhlIHRpbWUgd2hpbGUgbWFpbnRhaW5pbmcNCiAgIGludGVyb3Bl cmFiaWxpdHkgd2l0aCB0aGUgaW1wbGVtZW50YXRpb25zIHdlIGhhdmUgd2l0aGluIHRoZSBJRVRG DQogICBjb21tdW5pdHkuICBUaGUgd29ya2luZyBncm91cCBiZWxpZXZlcyB0aGF0IHRoaXMganVz dGlmaWVzIGJyZWFraW5nDQogICBjb21wYXRpYmlsaXR5IHdpdGggYSBjb3JyZWN0IGltcGxlbWVu dGF0aW9uIG9mIFJGQyAyNDc4Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAg ICAgICAgICAgRXhwaXJlcyBKdW5lIDEsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDI0XQ0K DA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAg ICAgICBEZWNlbWJlciAyMDA0DQoNCg0KSW50ZWxsZWN0dWFsIFByb3BlcnR5IFN0YXRlbWVudA0K DQogICBUaGUgSUVURiB0YWtlcyBubyBwb3NpdGlvbiByZWdhcmRpbmcgdGhlIHZhbGlkaXR5IG9y IHNjb3BlIG9mIGFueQ0KICAgSW50ZWxsZWN0dWFsIFByb3BlcnR5IFJpZ2h0cyBvciBvdGhlciBy aWdodHMgdGhhdCBtaWdodCBiZSBjbGFpbWVkIHRvDQogICBwZXJ0YWluIHRvIHRoZSBpbXBsZW1l bnRhdGlvbiBvciB1c2Ugb2YgdGhlIHRlY2hub2xvZ3kgZGVzY3JpYmVkIGluDQogICB0aGlzIGRv Y3VtZW50IG9yIHRoZSBleHRlbnQgdG8gd2hpY2ggYW55IGxpY2Vuc2UgdW5kZXIgc3VjaCByaWdo dHMNCiAgIG1pZ2h0IG9yIG1pZ2h0IG5vdCBiZSBhdmFpbGFibGU7IG5vciBkb2VzIGl0IHJlcHJl c2VudCB0aGF0IGl0IGhhcw0KICAgbWFkZSBhbnkgaW5kZXBlbmRlbnQgZWZmb3J0IHRvIGlkZW50 aWZ5IGFueSBzdWNoIHJpZ2h0cy4gIEluZm9ybWF0aW9uDQogICBvbiB0aGUgcHJvY2VkdXJlcyB3 aXRoIHJlc3BlY3QgdG8gcmlnaHRzIGluIFJGQyBkb2N1bWVudHMgY2FuIGJlDQogICBmb3VuZCBp biBCQ1AgNzggYW5kIEJDUCA3OS4NCg0KICAgQ29waWVzIG9mIElQUiBkaXNjbG9zdXJlcyBtYWRl IHRvIHRoZSBJRVRGIFNlY3JldGFyaWF0IGFuZCBhbnkNCiAgIGFzc3VyYW5jZXMgb2YgbGljZW5z ZXMgdG8gYmUgbWFkZSBhdmFpbGFibGUsIG9yIHRoZSByZXN1bHQgb2YgYW4NCiAgIGF0dGVtcHQg bWFkZSB0byBvYnRhaW4gYSBnZW5lcmFsIGxpY2Vuc2Ugb3IgcGVybWlzc2lvbiBmb3IgdGhlIHVz ZSBvZg0KICAgc3VjaCBwcm9wcmlldGFyeSByaWdodHMgYnkgaW1wbGVtZW50ZXJzIG9yIHVzZXJz IG9mIHRoaXMNCiAgIHNwZWNpZmljYXRpb24gY2FuIGJlIG9idGFpbmVkIGZyb20gdGhlIElFVEYg b24tbGluZSBJUFIgcmVwb3NpdG9yeSBhdA0KICAgaHR0cDovL3d3dy5pZXRmLm9yZy9pcHIuDQoN CiAgIFRoZSBJRVRGIGludml0ZXMgYW55IGludGVyZXN0ZWQgcGFydHkgdG8gYnJpbmcgdG8gaXRz IGF0dGVudGlvbiBhbnkNCiAgIGNvcHlyaWdodHMsIHBhdGVudHMgb3IgcGF0ZW50IGFwcGxpY2F0 aW9ucywgb3Igb3RoZXIgcHJvcHJpZXRhcnkNCiAgIHJpZ2h0cyB0aGF0IG1heSBjb3ZlciB0ZWNo bm9sb2d5IHRoYXQgbWF5IGJlIHJlcXVpcmVkIHRvIGltcGxlbWVudA0KICAgdGhpcyBzdGFuZGFy ZC4gIFBsZWFzZSBhZGRyZXNzIHRoZSBpbmZvcm1hdGlvbiB0byB0aGUgSUVURiBhdA0KICAgaWV0 Zi1pcHJAaWV0Zi5vcmcuDQoNCg0KRGlzY2xhaW1lciBvZiBWYWxpZGl0eQ0KDQogICBUaGlzIGRv Y3VtZW50IGFuZCB0aGUgaW5mb3JtYXRpb24gY29udGFpbmVkIGhlcmVpbiBhcmUgcHJvdmlkZWQg b24gYW4NCiAgICJBUyBJUyIgYmFzaXMgYW5kIFRIRSBDT05UUklCVVRPUiwgVEhFIE9SR0FOSVpB VElPTiBIRS9TSEUgUkVQUkVTRU5UUw0KICAgT1IgSVMgU1BPTlNPUkVEIEJZIChJRiBBTlkpLCBU SEUgSU5URVJORVQgU09DSUVUWSBBTkQgVEhFIElOVEVSTkVUDQogICBFTkdJTkVFUklORyBUQVNL IEZPUkNFIERJU0NMQUlNIEFMTCBXQVJSQU5USUVTLCBFWFBSRVNTIE9SIElNUExJRUQsDQogICBJ TkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIEFOWSBXQVJSQU5UWSBUSEFUIFRIRSBVU0UgT0Yg VEhFDQogICBJTkZPUk1BVElPTiBIRVJFSU4gV0lMTCBOT1QgSU5GUklOR0UgQU5ZIFJJR0hUUyBP UiBBTlkgSU1QTElFRA0KICAgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgT1IgRklUTkVT UyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuDQoNCg0KQ29weXJpZ2h0IFN0YXRlbWVudA0KDQog ICBDb3B5cmlnaHQgKEMpIFRoZSBJbnRlcm5ldCBTb2NpZXR5ICgyMDA0KS4gIFRoaXMgZG9jdW1l bnQgaXMgc3ViamVjdA0KICAgdG8gdGhlIHJpZ2h0cywgbGljZW5zZXMgYW5kIHJlc3RyaWN0aW9u cyBjb250YWluZWQgaW4gQkNQIDc4LCBhbmQNCiAgIGV4Y2VwdCBhcyBzZXQgZm9ydGggdGhlcmVp biwgdGhlIGF1dGhvcnMgcmV0YWluIGFsbCB0aGVpciByaWdodHMuDQoNCg0KQWNrbm93bGVkZ21l bnQNCg0KICAgRnVuZGluZyBmb3IgdGhlIFJGQyBFZGl0b3IgZnVuY3Rpb24gaXMgY3VycmVudGx5 IHByb3ZpZGVkIGJ5IHRoZQ0KICAgSW50ZXJuZXQgU29jaWV0eS4NCg0KDQoNCg0KWmh1LCBldCBh bC4gICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMSwgMjAwNSAgICAgICAgICAgICAgICAgW1Bh Z2UgMjVdDQoMDQoNCg== ------_=_NextPart_001_01C4D7F7.4AD44846-- --------------020402050907030303070208 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --------------020402050907030303070208-- From kitten-bounces@ietf.org Thu Dec 2 08:14:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA13095; Thu, 2 Dec 2004 08:14:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZqsg-0001xH-CD; Thu, 02 Dec 2004 08:20:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZqDv-0004mn-Uw; Thu, 02 Dec 2004 07:38:15 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZq0L-0002aZ-0c for kitten@megatron.ietf.org; Thu, 02 Dec 2004 07:24:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA07737 for ; Thu, 2 Dec 2004 07:24:11 -0500 (EST) Received: from brazilnut.cc.columbia.edu ([128.59.206.18] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZq5r-0000XE-Ee for kitten@ietf.org; Thu, 02 Dec 2004 07:29:55 -0500 Received: from [192.168.1.10] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by brazilnut.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iB2COBo2009093 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 2 Dec 2004 07:24:11 -0500 (EST) Message-ID: <41AF09BE.2030809@columbia.edu> Date: Thu, 02 Dec 2004 07:25:34 -0500 From: Jeffrey Altman Organization: Mass User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.18 X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit Subject: Working Group Last Call: The Simple and Protected GSS-API Negotiation Mechanism X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 7bit The authors of "The Simple and Protected GSS-API Negotiation Mechanism" have informed me that they believe that draft -02 is ready for last call. I have reviewed the document and agree. I believe the remaining issues on the list are editorial in nature. A Working Group Last Call period will start today to determine whether or not it is the consensus of this group to submit the document to the IESG for consideration as a Proposed Standard. As the -02 draft has not been published by the Secretariat as yet, a copy of the draft may be found in the Kitten mailing list archives at: http://www1.ietf.org/mail-archive/web/kitten/current/msg00281.html This Working Group Last Call will expire on 16-Dec-2004. Please send comments on this document to "kitten@ietf.org". ----------------------------------------------------------------- Title: The Simple and Protected GSS-API Negotiation Mechanism Authors: Zhu, L., Leach, P.J., Jaganathan, K., Ingersoll, W. Filename: draft-ietf-kitten-2478bis-02.txt Abstract: This document specifies a negotiation mechanism for the Generic Security Service Application Program Interface (GSS-API) which is described in RFC 2743. GSS-API peers can use this negotiation mechanism to choose from a common set of security mechanisms. Size: 25 pages Expiry: June 1, 2005 -------------------------------------------------------------- Jeffrey Altman Chair, IETF Kitten Working Group Secure Endpoints Inc. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 2 08:19:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA13475; Thu, 2 Dec 2004 08:19:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZqxk-00025Z-18; Thu, 02 Dec 2004 08:25:37 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZqEA-0005NY-By; Thu, 02 Dec 2004 07:38:30 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZq6R-0006Di-QA for kitten@megatron.ietf.org; Thu, 02 Dec 2004 07:30:31 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA08214 for ; Thu, 2 Dec 2004 07:30:30 -0500 (EST) Received: from serrano.cc.columbia.edu ([128.59.206.20] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZqBx-0000eK-II for kitten@ietf.org; Thu, 02 Dec 2004 07:36:14 -0500 Received: from [192.168.1.10] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by serrano.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iB2CUT4s016689 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 2 Dec 2004 07:30:29 -0500 (EST) Message-ID: <41AF0B39.8070307@columbia.edu> Date: Thu, 02 Dec 2004 07:31:53 -0500 From: Jeffrey Altman Organization: Mass User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org References: <419579F2.1040608@columbia.edu> In-Reply-To: <419579F2.1040608@columbia.edu> X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.20 X-Spam-Score: 0.0 (/) X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014 Content-Transfer-Encoding: 7bit Subject: Re: Draft Minutes for Kitten (IETF61) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Content-Transfer-Encoding: 7bit Does anyone have any comments on the draft minutes submitted to this list on 12 Nov 2004? http://www1.ietf.org/mail-archive/web/kitten/current/msg00194.html Jeffrey Altman Chair, IETF Kitten Working Group _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 2 11:53:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA07931; Thu, 2 Dec 2004 11:53:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZuIp-0000mO-ER; Thu, 02 Dec 2004 11:59:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZqG3-00066x-Qs; Thu, 02 Dec 2004 07:40:27 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZqCM-0003N3-1E; Thu, 02 Dec 2004 07:36:38 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA09140; Thu, 2 Dec 2004 07:36:36 -0500 (EST) Message-Id: <200412021236.HAA09140@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Thu, 02 Dec 2004 07:36:36 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-gss-naming-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: a8a20a483a84f747e56475e290ee868e --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : Desired Enhancements to GSSAPI Naming Author(s) : S. Hartman Filename : draft-ietf-kitten-gss-naming-00.txt Pages : 13 Date : 2004-12-1 The Generic Security Services API (GSS-API) provides a naming architecture that supports name-based authorization. GSS-API authenticates two named parties to each other. Names can be stored on access control lists to make authorization decisions. Advances in security mechanisms and the way implementers wish to use GSS-API require this model to be extended. Some mechanisms such as public-key mechanisms do not have a single name to be used across all environments. Other mechanisms such as Kerberos allow names to change as people move around organizations. This document proposes expanding the definition of GSS-API names to deal with these situations. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-gss-naming-00.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-gss-naming-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-gss-naming-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-2080438.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-gss-naming-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-gss-naming-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-2080438.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Thu Dec 2 15:30:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25330; Thu, 2 Dec 2004 15:30:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZxgO-00064a-4H; Thu, 02 Dec 2004 15:36:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZuuL-0002yU-M8; Thu, 02 Dec 2004 12:38:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZqyi-00033t-BH for kitten@megatron.ietf.org; Thu, 02 Dec 2004 08:26:36 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA14659 for ; Thu, 2 Dec 2004 08:26:34 -0500 (EST) Received: from luminous.mit.edu ([18.101.1.61]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZr4E-0002TM-9o for kitten@ietf.org; Thu, 02 Dec 2004 08:32:19 -0500 Received: by luminous.mit.edu (Postfix, from userid 1000) id 44C5876BE2; Thu, 2 Dec 2004 08:26:33 -0500 (EST) To: Jeffrey Altman References: <419579F2.1040608@columbia.edu> <41AF0B39.8070307@columbia.edu> From: Sam Hartman Date: Thu, 02 Dec 2004 08:26:32 -0500 In-Reply-To: <41AF0B39.8070307@columbia.edu> (Jeffrey Altman's message of "Thu, 02 Dec 2004 07:31:53 -0500") Message-ID: <87d5xsde5z.fsf@luminous.mit.edu> User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014 Cc: kitten@ietf.org Subject: Re: Draft Minutes for Kitten (IETF61) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 >>>>> "Jeffrey" == Jeffrey Altman writes: Jeffrey> Does anyone have any comments on the draft minutes Jeffrey> submitted to this list on 12 Nov 2004? You indicated these were a bit rough and my reading agreed. Any chance you could let us review a more polished draft before submitting? _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 2 17:07:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04467; Thu, 2 Dec 2004 17:07:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZzCn-0000Ek-HT; Thu, 02 Dec 2004 17:13:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZuy8-0006jS-Pn; Thu, 02 Dec 2004 12:42:16 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZsHn-00019Y-9E for kitten@megatron.ietf.org; Thu, 02 Dec 2004 09:50:23 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA23648 for ; Thu, 2 Dec 2004 09:50:21 -0500 (EST) Received: from nwkea-mail-2.sun.com ([192.18.42.14]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZsNK-000513-2P for kitten@ietf.org; Thu, 02 Dec 2004 09:56:07 -0500 Received: from jurassic.eng.sun.com ([129.146.83.130]) by nwkea-mail-2.sun.com (8.12.10/8.12.9) with ESMTP id iB2EoKpv027623 for ; Thu, 2 Dec 2004 06:50:20 -0800 (PST) Received: from [192.9.61.32] (punchin-wyllys.SFBay.Sun.COM [192.9.61.32]) by jurassic.eng.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB2EoKvx881389 for ; Thu, 2 Dec 2004 06:50:20 -0800 (PST) Message-ID: <41AF2BAB.6020304@sun.com> Date: Thu, 02 Dec 2004 09:50:19 -0500 From: Wyllys Ingersoll User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7) Gecko/20041028 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit Subject: Last word on MechListMIC encoding X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit The latest draft submitted (-02) specifically states how the MechListMIC is to be encoded: Section 5, item 'a' says: [...] only the DER encoding of the type MechTypeList is included. I interpret this to mean the following in the case where the MechList contains the Kerberos OID (as an example): 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... This is acceptable to me (even though it breaks our current implementation, which I seriously doubt that anyone is interoperating with anyway since its not yet released). Is everyone else in agreement about the definition of how to encode the MIC and with the text as it is written? -Wyllys Ingersoll _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 2 21:58:32 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA01359; Thu, 2 Dec 2004 21:58:32 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca3k6-0007GT-Nf; Thu, 02 Dec 2004 22:04:25 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca0TH-0005Jk-6C; Thu, 02 Dec 2004 18:34:47 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZziQ-0000Wg-HR for kitten@megatron.ietf.org; Thu, 02 Dec 2004 17:46:22 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA09132 for ; Thu, 2 Dec 2004 17:46:19 -0500 (EST) Received: from au.padl.com ([203.13.32.1]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CZzo1-0001MU-AB for kitten@ietf.org; Thu, 02 Dec 2004 17:52:10 -0500 Received: from au.padl.com (localhost.padl.com [127.0.0.1]) by au.padl.com (8.12.11/8.12.11) with ESMTP id iB2MjUkL095466; Fri, 3 Dec 2004 09:45:30 +1100 (EST) (envelope-from lukeh@au.padl.com) Received: (from lukeh@localhost) by au.padl.com (8.12.11/8.12.11/Submit) id iB2MjUjV095465; Fri, 3 Dec 2004 09:45:30 +1100 (EST) (envelope-from lukeh) From: Luke Howard Message-Id: <200412022245.iB2MjUjV095465@au.padl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Organization: PADL Software Pty Ltd To: wyllys.ingersoll@sun.com Date: Fri, 3 Dec 2004 09:45:30 +1100 Versions: dmail (bsd44) 2.6d/makemail 2.10 X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on au.padl.com X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Cc: kitten@ietf.org Subject: Re: Last word on MechListMIC encoding X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: lukeh@padl.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 > 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... I agree (eg. 30 0b 06 09 2a 86 48 86 f7 12 01 02 02 for just the Kerberos mech) >This is acceptable to me (even though it breaks our current >implementation, which I seriously doubt that anyone is >interoperating with anyway since its not yet released). What does your implementation do? -- Luke -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 2 22:05:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA02042; Thu, 2 Dec 2004 22:05:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca3r1-0007Sr-6W; Thu, 02 Dec 2004 22:11:31 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca0at-0006bS-Ax; Thu, 02 Dec 2004 18:42:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CZzwY-0000ep-Jp for kitten@megatron.ietf.org; Thu, 02 Dec 2004 18:00:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10561 for ; Thu, 2 Dec 2004 18:00:55 -0500 (EST) Received: from imr5.us.db.com ([160.83.65.196]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca026-0001k8-OH for kitten@ietf.org; Thu, 02 Dec 2004 18:06:46 -0500 Received: from sdbo1005.db.com by imr5.us.db.com id iB2N0n0k009300; Thu, 2 Dec 2004 18:00:50 -0500 (EST) To: "Wyllys Ingersoll X-Mailer: Lotus Notes Release 5.0.8 June 18, 2001 Message-ID: From: "Frank Balluffi" Date: Thu, 2 Dec 2004 18:00:47 -0500 X-MIMETrack: Serialize by Router on sdbo1005/DBNA/DeuBaInt/DeuBa(5013aHF19 | July 26, 2004) at 12/02/2004 06:00:50 PM MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii X-Spam-Score: 2.6 (++) X-Scan-Signature: bdc523f9a54890b8a30dd6fd53d5d024 Cc: kitten@ietf.org Subject: Re: Last word on MechListMIC encoding X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 2.6 (++) X-Scan-Signature: 3002fc2e661cd7f114cb6bae92fe88f1 Wyllys, Because draft-ietf-kitten-2478bis-02.txt says EXPLICIT: SPNEGOASNOneSpec { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanism(5) snego (2) modules(4) spec2(2) } DEFINITIONS EXPLICIT TAGS ::= BEGIN -- rest of definitions here END I would expect a mechTypes element in a NegTokenInit to be prefixed with A0 nn -- mechTypes is EXPLICITly tagged with 0: NegTokenInit ::= SEQUENCE { mechTypes [0] MechTypeList, reqFlags [1] ContextFlags OPTIONAL, mechToken [2] OCTET STRING OPTIONAL, mechListMIC [3] OCTET STRING OPTIONAL, ... } Frank Wyllys Ingersoll cc: Sent by: Subject: Last word on MechListMIC encoding kitten-bounces@lis ts.ietf.org 12/02/2004 09:50 AM The latest draft submitted (-02) specifically states how the MechListMIC is to be encoded: Section 5, item 'a' says: [...] only the DER encoding of the type MechTypeList is included. I interpret this to mean the following in the case where the MechList contains the Kerberos OID (as an example): 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... This is acceptable to me (even though it breaks our current implementation, which I seriously doubt that anyone is interoperating with anyway since its not yet released). Is everyone else in agreement about the definition of how to encode the MIC and with the text as it is written? -Wyllys Ingersoll _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten -- This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 2 22:11:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA02673; Thu, 2 Dec 2004 22:11:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca3wa-0007dx-Jg; Thu, 02 Dec 2004 22:17:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca0bZ-0006uY-8P; Thu, 02 Dec 2004 18:43:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca08X-00067P-DK for kitten@megatron.ietf.org; Thu, 02 Dec 2004 18:13:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA12177 for ; Thu, 2 Dec 2004 18:13:18 -0500 (EST) Received: from mail3.microsoft.com ([131.107.3.123]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca0E9-000226-NK for kitten@ietf.org; Thu, 02 Dec 2004 18:19:10 -0500 Received: from mailout1.microsoft.com ([157.54.1.117]) by mail3.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 2 Dec 2004 15:12:46 -0800 Received: from red-hub-04.redmond.corp.microsoft.com ([157.54.3.6]) by mailout1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Thu, 2 Dec 2004 15:12:46 -0800 Received: from win-imc-01.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.39]) by red-hub-04.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 2 Dec 2004 15:12:46 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-01.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Thu, 2 Dec 2004 15:12:45 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Thu, 2 Dec 2004 15:12:44 -0800 Message-ID: Thread-Topic: LAST CALL COMMENT: Section 5 (was RE: Last word on MechListMIC encoding) thread-index: AcTYu2mgR/QCGT7BQbOckmlnHFviIgACDB0A From: "Liqiang\(Larry\) Zhu" To: "Wyllys Ingersoll" , X-OriginalArrivalTime: 02 Dec 2004 23:12:45.0775 (UTC) FILETIME=[6ED355F0:01C4D8C4] X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: quoted-printable Subject: LAST CALL COMMENT: Section 5 (was RE: Last word on MechListMIC encoding) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: quoted-printable I agree with you and the understanding below is correct, perhaps we should provide an example encoding to demonstrate what is included? That will make it easier for casual readers who might not understand the rather obscure ASN.1 terminology. -- Larry -----Original Message----- From: kitten-bounces@lists.ietf.org [mailto:kitten-bounces@lists.ietf.org] On Behalf Of Wyllys Ingersoll Sent: Thursday, December 02, 2004 6:50 AM To: kitten@ietf.org Subject: Last word on MechListMIC encoding The latest draft submitted (-02) specifically states how the MechListMIC is to be encoded: Section 5, item 'a' says: [...] only the DER encoding of the type MechTypeList is included. I interpret this to mean the following in the case where the MechList contains the Kerberos OID (as an example): 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... This is acceptable to me (even though it breaks our current implementation, which I seriously doubt that anyone is interoperating with anyway since its not yet released). Is everyone else in agreement about the definition of how to encode the MIC and with the text as it is written? -Wyllys Ingersoll _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 3 03:09:37 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA08997; Fri, 3 Dec 2004 03:09:37 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca8bC-0005DA-Uw; Fri, 03 Dec 2004 03:15:32 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca6pj-0000en-3z; Fri, 03 Dec 2004 01:22:23 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca4Cb-0001xT-Jy for kitten@megatron.ietf.org; Thu, 02 Dec 2004 22:33:49 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA04653 for ; Thu, 2 Dec 2004 22:33:47 -0500 (EST) Received: from luminous.mit.edu ([18.101.1.61]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca4IF-00088P-Ei for kitten@ietf.org; Thu, 02 Dec 2004 22:39:40 -0500 Received: by luminous.mit.edu (Postfix, from userid 1000) id F123076C51; Thu, 2 Dec 2004 22:33:45 -0500 (EST) To: "Frank Balluffi" References: From: Sam Hartman Date: Thu, 02 Dec 2004 22:33:45 -0500 In-Reply-To: (Frank Balluffi's message of "Thu, 2 Dec 2004 18:00:47 -0500") Message-ID: <874qj4caxy.fsf@luminous.mit.edu> User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Cc: kitten@ietf.org Subject: Re: Last word on MechListMIC encoding X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d >>>>> "Frank" == Frank Balluffi writes: Frank> Wyllys, Frank> Because draft-ietf-kitten-2478bis-02.txt says EXPLICIT: Frank> SPNEGOASNOneSpec { iso(1) identified-organization(3) Frank> dod(6) internet(1) security(5) mechanism(5) snego (2) Frank> modules(4) spec2(2) } DEFINITIONS EXPLICIT TAGS ::= BEGIN Frank> -- rest of definitions here Frank> END Frank> I would expect a mechTypes element in a NegTokenInit to be Frank> prefixed with A0 nn -- mechTypes is EXPLICITly tagged with Frank> 0: Note that we are talking about the MIC, not the field in the sequence. Do you believe based on section 5 that your comment applies to the MIC? --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 3 03:10:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA09026; Fri, 3 Dec 2004 03:10:06 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca8bh-0005DQ-4F; Fri, 03 Dec 2004 03:16:01 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca6pz-0000mJ-Ap; Fri, 03 Dec 2004 01:22:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca4UK-0004F6-Tc for kitten@megatron.ietf.org; Thu, 02 Dec 2004 22:52:09 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA05874 for ; Thu, 2 Dec 2004 22:52:06 -0500 (EST) Received: from mail1.microsoft.com ([131.107.3.125]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca4Zy-0008Sc-K0 for kitten@ietf.org; Thu, 02 Dec 2004 22:58:00 -0500 Received: from mailout1.microsoft.com ([157.54.1.117]) by mail1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Thu, 2 Dec 2004 19:51:35 -0800 Received: from red-hub-02.redmond.corp.microsoft.com ([157.54.7.100]) by mailout1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Thu, 2 Dec 2004 19:51:30 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-02.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 2 Dec 2004 19:51:30 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1277); Thu, 2 Dec 2004 19:51:29 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Thu, 2 Dec 2004 19:51:29 -0800 Message-ID: Thread-Topic: LAST CALL COMMENT: draft-ietf-kitten-2478bis-02: section 4 (was : Last word on MechListMIC encoding) thread-index: AcTY5PwMWaynJIs7Rc6XYEA+mdL4AwABZwsw From: "Liqiang\(Larry\) Zhu" To: "Frank Balluffi" , "Wyllys Ingersoll X-OriginalArrivalTime: 03 Dec 2004 03:51:29.0695 (UTC) FILETIME=[5F0F02F0:01C4D8EB] X-Spam-Score: 0.2 (/) X-Scan-Signature: 2086112c730e13d5955355df27e3074b Content-Transfer-Encoding: quoted-printable Cc: kitten@ietf.org Subject: LAST CALL COMMENT: draft-ietf-kitten-2478bis-02: section 4 (was : Last word on MechListMIC encoding) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.2 (/) X-Scan-Signature: 22bbb45ef41b733eb2d03ee71ece8243 Content-Transfer-Encoding: quoted-printable Frank Balluffi wrote: > I would expect a mechTypes element in a NegTokenInit to be prefixed with A0 Incorrect, can you take a look at Tom's posting on the encoding? Thanks, -- Larry -----Original Message----- From: kitten-bounces@lists.ietf.org [mailto:kitten-bounces@lists.ietf.org] On Behalf Of Frank Balluffi Sent: Thursday, December 02, 2004 3:01 PM To: Wyllys Ingersoll cc: Sent by: Subject: Last word on MechListMIC encoding =20 kitten-bounces@lis ts.ietf.org =20 =20 12/02/2004 09:50 AM =20 =20 The latest draft submitted (-02) specifically states how the MechListMIC is to be encoded: Section 5, item 'a' says: [...] only the DER encoding of the type MechTypeList is included. I interpret this to mean the following in the case where the MechList contains the Kerberos OID (as an example): 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... This is acceptable to me (even though it breaks our current implementation, which I seriously doubt that anyone is interoperating with anyway since its not yet released). Is everyone else in agreement about the definition of how to encode the MIC and with the text as it is written? -Wyllys Ingersoll _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten -- This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 3 12:44:33 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA05375; Fri, 3 Dec 2004 12:44:33 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaHZi-0003T3-1b; Fri, 03 Dec 2004 12:50:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaDQt-0001a7-2h; Fri, 03 Dec 2004 08:25:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaCKj-0003Ir-W1; Fri, 03 Dec 2004 07:14:46 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA27848; Fri, 3 Dec 2004 07:14:43 -0500 (EST) Message-Id: <200412031214.HAA27848@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Fri, 03 Dec 2004 07:14:43 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-2478bis-02.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: cf3becbbd6d1a45acbe2ffd4ab88bdc2 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : The Simple and Protected GSS-API Negotiation Mechanism Author(s) : L. Zhu, et al. Filename : draft-ietf-kitten-2478bis-02.txt Pages : 25 Date : 2004-12-2 This document specifies a negotiation mechanism for the Generic Security Service Application Program Interface (GSS-API) which is described in RFC 2743. GSS-API peers can use this negotiation mechanism to choose from a common set of security mechanisms. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-2478bis-02.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-2478bis-02.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-2478bis-02.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-2115415.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-2478bis-02.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-2478bis-02.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-2115415.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Fri Dec 3 13:26:15 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15363; Fri, 3 Dec 2004 13:26:15 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaIE2-0006l2-SX; Fri, 03 Dec 2004 13:32:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaEdE-0005lg-Ja; Fri, 03 Dec 2004 09:42:00 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaEAL-0001Dq-VJ for kitten@megatron.ietf.org; Fri, 03 Dec 2004 09:12:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA07419 for ; Fri, 3 Dec 2004 09:12:08 -0500 (EST) Received: from imr7.us.db.com ([160.83.77.105]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaEG3-0004PO-Oc for kitten@ietf.org; Fri, 03 Dec 2004 09:18:06 -0500 Received: from sdbo1005.db.com by imr7.us.db.com id iB3EBwQf025773; Fri, 3 Dec 2004 09:11:59 -0500 To: lzhu@windows.microsoft.com X-Mailer: Lotus Notes Release 5.0.8 June 18, 2001 Message-ID: From: "Frank Balluffi" Date: Fri, 3 Dec 2004 09:11:50 -0500 X-MIMETrack: Serialize by Router on sdbo1005/DBNA/DeuBaInt/DeuBa(5013aHF19 | July 26, 2004) at 12/03/2004 09:11:59 AM MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii X-Spam-Score: 0.2 (/) X-Scan-Signature: 6ba8aaf827dcb437101951262f69b3de Cc: kitten@ietf.org Subject: Re: LAST CALL COMMENT: draft-ietf-kitten-2478bis-02: section 4 (was : Last word on MechListMIC encoding) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.2 (/) X-Scan-Signature: 827a2a57ca7ab0837847220f447e8d56 Got it -- my bad. You might want to add something like the following to 5. a): "excluding the outer [0] EXPLICIT tag and length" Frank "Liqiang\(Larry\) Zhu" To: Frank Balluffi/NewYork/DBNA/DeuBa@DBNA, "Wyllys Ingersoll , "Tom Yu" rosoft.com> Subject: LAST CALL COMMENT: draft-ietf-kitten-2478bis-02: section 4 (was : Last word on MechListMIC encoding) 12/02/2004 10:51 PM Frank Balluffi wrote: > I would expect a mechTypes element in a NegTokenInit to be prefixed with A0 Incorrect, can you take a look at Tom's posting on the encoding? Thanks, -- Larry -----Original Message----- From: kitten-bounces@lists.ietf.org [mailto:kitten-bounces@lists.ietf.org] On Behalf Of Frank Balluffi Sent: Thursday, December 02, 2004 3:01 PM To: Wyllys Ingersoll cc: Sent by: Subject: Last word on MechListMIC encoding kitten-bounces@lis ts.ietf.org 12/02/2004 09:50 AM The latest draft submitted (-02) specifically states how the MechListMIC is to be encoded: Section 5, item 'a' says: [...] only the DER encoding of the type MechTypeList is included. I interpret this to mean the following in the case where the MechList contains the Kerberos OID (as an example): 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... This is acceptable to me (even though it breaks our current implementation, which I seriously doubt that anyone is interoperating with anyway since its not yet released). Is everyone else in agreement about the definition of how to encode the MIC and with the text as it is written? -Wyllys Ingersoll _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten -- This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten -- This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 3 14:45:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27545; Fri, 3 Dec 2004 14:45:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaJSY-00023S-Ss; Fri, 03 Dec 2004 14:51:20 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaIqb-0008Sd-JL; Fri, 03 Dec 2004 14:12:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaHeC-0008GO-Pr for kitten@megatron.ietf.org; Fri, 03 Dec 2004 12:55:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA08179 for ; Fri, 3 Dec 2004 12:55:09 -0500 (EST) Received: from cathode-dark-space.mit.edu ([18.18.1.96]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaHjx-0004Oh-Hw for kitten@ietf.org; Fri, 03 Dec 2004 13:01:10 -0500 Received: (from tlyu@localhost) by cathode-dark-space.mit.edu (8.12.9) id iB3Ht66I015400; Fri, 3 Dec 2004 12:55:06 -0500 (EST) To: "Liqiang\(Larry\) Zhu" References: From: Tom Yu Date: Fri, 03 Dec 2004 12:55:06 -0500 In-Reply-To: (Liqiang Zhu's message of "Thu, 2 Dec 2004 15:12:44 -0800") Message-ID: Lines: 35 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Cc: kitten@ietf.org Subject: Re: LAST CALL COMMENT: Section 5 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b >>>>> "lzhu" == Liqiang\(Larry\) Zhu writes: lzhu> I agree with you and the understanding below is correct, perhaps we lzhu> should provide an example encoding to demonstrate what is included? That lzhu> will make it easier for casual readers who might not understand the lzhu> rather obscure ASN.1 terminology. 5. Processing of mechListMIC [...] a) The mechlistMIC token (or simply the MIC token) is computed by invoking GSS_GetMIC(): the input context_handle is the established mechanism context, the input qop_req is 0, and the input message is the mechTypes field in the initial negotiation message (only the DER encoding of the type MechTypeList is included). The above text still uses the term "mechTypes field" in an ambiguous way, and relegates the important details to a parenthetical comment. I reiterate my view that it is ambiguous to speak of the encoding of a field; complete ASN.1 encodings are of _types_. I would change the text to something like: a) The mechlistMIC token (or simply the MIC token) is computed by invoking GSS_GetMIC(): the input context_handle is the established mechanism context, the input qop_req is 0, and the input message is the DER encoding of the value of type MechTypeList which is contained in the "mechTypes" field of the NegTokenInit. The input message is NOT the DER encoding of the type "[0] MechTypeList". (Previous versions of this document were ambiguous about which ASN.1 type was to be DER-encoded for the MIC.) The wording could be cleaned up some more, but I thought it was important to get this correction out quickly. ---Tom _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 3 15:38:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04440; Fri, 3 Dec 2004 15:38:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaKIO-0004A3-3M; Fri, 03 Dec 2004 15:44:53 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaKA5-0001S1-8O; Fri, 03 Dec 2004 15:36:17 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaJwx-0008GU-Sh for kitten@megatron.ietf.org; Fri, 03 Dec 2004 15:22:44 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02519 for ; Fri, 3 Dec 2004 15:22:42 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaK2k-0003X6-9M for kitten@ietf.org; Fri, 03 Dec 2004 15:28:43 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iB3KMe6O029531 for ; Fri, 3 Dec 2004 12:22:40 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iB3KMejW006463 for ; Fri, 3 Dec 2004 13:22:40 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB3KLqa2101986; Fri, 3 Dec 2004 14:21:52 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iB3KLpwh101985; Fri, 3 Dec 2004 14:21:51 -0600 (CST) Date: Fri, 3 Dec 2004 14:21:51 -0600 From: Nicolas Williams To: Tom Yu Message-ID: <20041203202150.GB101940@binky.central.sun.com> Mail-Followup-To: Tom Yu , "Liqiang(Larry) Zhu" , kitten@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Cc: kitten@ietf.org, "Liqiang\(Larry\) Zhu" Subject: Re: LAST CALL COMMENT: Section 5 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f On Fri, Dec 03, 2004 at 12:55:06PM -0500, Tom Yu wrote: > I would change the text to something like: > > a) The mechlistMIC token (or simply the MIC token) is computed by > invoking GSS_GetMIC(): the input context_handle is the established > mechanism context, the input qop_req is 0, and the input message > is the DER encoding of the value of type MechTypeList which is > contained in the "mechTypes" field of the NegTokenInit. The input > message is NOT the DER encoding of the type "[0] MechTypeList". > (Previous versions of this document were ambiguous about which > ASN.1 type was to be DER-encoded for the MIC.) I like that. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 3 15:58:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA05924; Fri, 3 Dec 2004 15:58:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaKbg-0004n3-V0; Fri, 03 Dec 2004 16:04:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaKN2-0007rK-Gy; Fri, 03 Dec 2004 15:49:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaKJm-0006NK-LJ for kitten@megatron.ietf.org; Fri, 03 Dec 2004 15:46:18 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA05002 for ; Fri, 3 Dec 2004 15:46:17 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaKPZ-0004L3-Ij for kitten@ietf.org; Fri, 03 Dec 2004 15:52:18 -0500 Received: from jurassic.eng.sun.com ([129.146.81.36]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iB3KkGVu001212; Fri, 3 Dec 2004 13:46:16 -0700 (MST) Received: from [192.9.61.32] (punchin-wyllys.SFBay.Sun.COM [192.9.61.32]) by jurassic.eng.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB3KkFKa525426; Fri, 3 Dec 2004 12:46:15 -0800 (PST) Message-ID: <41B0D096.8050900@sun.com> Date: Fri, 03 Dec 2004 15:46:14 -0500 From: Wyllys Ingersoll User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7) Gecko/20041028 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Nicolas Williams References: <20041203202150.GB101940@binky.central.sun.com> In-Reply-To: <20041203202150.GB101940@binky.central.sun.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org, "Liqiang\(Larry\) Zhu" Subject: Re: LAST CALL COMMENT: Section 5 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit Nicolas Williams wrote: > On Fri, Dec 03, 2004 at 12:55:06PM -0500, Tom Yu wrote: > >>I would change the text to something like: >> >> a) The mechlistMIC token (or simply the MIC token) is computed by >> invoking GSS_GetMIC(): the input context_handle is the established >> mechanism context, the input qop_req is 0, and the input message >> is the DER encoding of the value of type MechTypeList which is >> contained in the "mechTypes" field of the NegTokenInit. The input >> message is NOT the DER encoding of the type "[0] MechTypeList". >> (Previous versions of this document were ambiguous about which >> ASN.1 type was to be DER-encoded for the MIC.) I agree, I also think this is a good change. I was also going to write some text to try and illusrate this in an example, does anyone think that is necessary or is this new text good enough? -Wyllys _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 3 17:21:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA11104; Fri, 3 Dec 2004 17:21:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaLtK-0006XQ-9A; Fri, 03 Dec 2004 17:27:07 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaLb3-0004ve-Fl; Fri, 03 Dec 2004 17:08:13 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaKws-0002pI-9q for kitten@megatron.ietf.org; Fri, 03 Dec 2004 16:26:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08147 for ; Fri, 3 Dec 2004 16:26:40 -0500 (EST) Received: from carter-zimmerman.mit.edu ([18.18.3.197] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaL2f-0005WB-9j for kitten@ietf.org; Fri, 03 Dec 2004 16:32:42 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id F0569E0063; Fri, 3 Dec 2004 16:26:56 -0500 (EST) To: Wyllys Ingersoll References: <20041203202150.GB101940@binky.central.sun.com> <41B0D096.8050900@sun.com> From: Sam Hartman Date: Fri, 03 Dec 2004 16:26:56 -0500 In-Reply-To: <41B0D096.8050900@sun.com> (Wyllys Ingersoll's message of "Fri, 03 Dec 2004 15:46:14 -0500") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Cc: kitten@ietf.org, "Liqiang\(Larry\) Zhu" , Nicolas Williams Subject: Re: LAST CALL COMMENT: Section 5 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 >>>>> "Wyllys" == Wyllys Ingersoll writes: Wyllys> Nicolas Williams wrote: >> On Fri, Dec 03, 2004 at 12:55:06PM -0500, Tom Yu wrote: >>> I would change the text to something like: >>> >>> a) The mechlistMIC token (or simply the MIC token) is computed >>> by invoking GSS_GetMIC(): the input context_handle is the >>> established mechanism context, the input qop_req is 0, and the >>> input message is the DER encoding of the value of type >>> MechTypeList which is contained in the "mechTypes" field of >>> the NegTokenInit. The input message is NOT the DER encoding >>> of the type "[0] MechTypeList". (Previous versions of this >>> document were ambiguous about which ASN.1 type was to be >>> DER-encoded for the MIC.) Wyllys> I agree, I also think this is a good change. Wyllys> I was also going to write some text to try and illusrate Wyllys> this in an example, does anyone think that is necessary or Wyllys> is this new text good enough? Based on comments on this list and the confusion, I will insist on an example during AD review. It would be great if we already had text for one. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 3 17:44:50 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA14622; Fri, 3 Dec 2004 17:44:50 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaMGL-0007db-VD; Fri, 03 Dec 2004 17:50:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaLnD-0003Y7-MP; Fri, 03 Dec 2004 17:20:47 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaLIl-0007pY-Fi for kitten@megatron.ietf.org; Fri, 03 Dec 2004 16:49:19 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09278 for ; Fri, 3 Dec 2004 16:49:17 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaLOY-0005us-T6 for kitten@ietf.org; Fri, 03 Dec 2004 16:55:20 -0500 Received: from jurassic.eng.sun.com ([129.146.82.166]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iB3LnGVu014453; Fri, 3 Dec 2004 14:49:17 -0700 (MST) Received: from [192.9.61.32] (punchin-wyllys.SFBay.Sun.COM [192.9.61.32]) by jurassic.eng.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB3LnFU8544658; Fri, 3 Dec 2004 13:49:16 -0800 (PST) Message-ID: <41B0DF5B.5030803@sun.com> Date: Fri, 03 Dec 2004 16:49:15 -0500 From: Wyllys Ingersoll User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7) Gecko/20041028 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Sam Hartman References: <20041203202150.GB101940@binky.central.sun.com> <41B0D096.8050900@sun.com> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org, "Liqiang\(Larry\) Zhu" , Nicolas Williams Subject: Re: LAST CALL COMMENT: Section 5 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit Sam Hartman wrote: > Wyllys> I agree, I also think this is a good change. > > Wyllys> I was also going to write some text to try and illusrate > Wyllys> this in an example, does anyone think that is necessary or > Wyllys> is this new text good enough? > > Based on comments on this list and the confusion, I will insist on an > example during AD review. It would be great if we already had text > for one. OK, I'll write some up and submit it to the list early next week. -Wyllys _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 3 17:44:59 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA14651; Fri, 3 Dec 2004 17:44:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaMGU-0007dt-DR; Fri, 03 Dec 2004 17:51:02 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaLnE-0003Yr-Bu; Fri, 03 Dec 2004 17:20:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaLIu-0007rE-3H for kitten@megatron.ietf.org; Fri, 03 Dec 2004 16:49:28 -0500 Received: from jalapeno.cc.columbia.edu (IDENT:cu41754@jalapeno.cc.columbia.edu [128.59.206.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09282 for ; Fri, 3 Dec 2004 16:49:25 -0500 (EST) Received: from [192.168.0.184] (user-0cev2ll.cable.mindspring.com [24.239.138.181]) (user=jaltman mech=PLAIN bits=0) by jalapeno.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iB3LnOkC004002 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 3 Dec 2004 16:49:26 -0500 (EST) Message-ID: <41B09889.6070001@columbia.edu> Date: Fri, 03 Dec 2004 11:47:05 -0500 From: Jeffrey Altman Organization: Not Affliliated with Columbia University in the City of New York User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: multipart/mixed; boundary="------------030600040306000008070403" X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.19 Subject: Last Call for Comments on IETF 61 Kitten Minutes X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 1.5 (+) X-Scan-Signature: 7e267523e0685e5aa2dbbdde4b659686 This is a multi-part message in MIME format. --------------030600040306000008070403 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Attached is the latest draft of the minutes for the IETF 61 Kitten Meeting. I would like to thank Ken Hornstein for acting as Jabber Scribe. Please review. If there are no additional comments, I will submit these minutes as they are. Thanks. Jeffrey Altman --------------030600040306000008070403 Content-Type: text/plain; name="ietf61-kitten-minutes-01.txt" Content-Disposition: inline; filename="ietf61-kitten-minutes-01.txt" X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id QAA09282 Content-Transfer-Encoding: quoted-printable IETF 61: Kitten Working Group Summary Monday, November 8, 2004 Jeffrey Altman [chair] Presentations:=20 http://web.mit.edu/jaltman/Public/Kitten/ietf61/ietf61-kitten.pdf The chair announced the creation of the working group by the IESG; review= ed=20 the charter and the group's initial milestones. (please see the presentat= ion=20 slides for details). Since the BOF at IETF 60 there has been significant progress on: + describing the GSS Naming problem + solving the interoperability problems between protected SPNEGO=20 and implementations which have been widely deployed + defining the requirements and interfaces for PRFs + C# bindings + producing a roadmap document Nico Williams gave a presentation on Pseudo-random function API: Many=20 applications would like to obtain an encryption key from the GSSAPI conte= xt. =20 Breaking the abstraction layer to obtain the negotiated key is dangerous.= To=20 solve the problem we are proposing the use of a new PRF seeded with inter= nal=20 keying material. Calls to GSS_Pseudo_Random() will be deterministic. Whe= n=20 initialized with the same context and input it will produce the same outp= ut. Nico Williams gave a presentation on a Kerberos v5 GSS Mech PRF: We will=20 construct the Krb5 PRF based on the Kerberos v5 crypto framework PRF. Fo= r new=20 mechanisms we will always use the acceptor's subkey. For 1964 mechs the=20 initiator subkey can be used. Key usage to be determined. Nico Williams gave a presentation on Domain based Service Names for GSS and the Krb5 Mechanism: Domain based Service names are meant mitigate against attacks caused by t= he=20 use of insecure DNS SRV to obtain the host/service pair for a given domai= n. The generic name syntax is:=20 @@ an OID for GSS_C_NT_DOMAINBASED_SERVICE needs to be allocated. Since the = I-Ds=20 were published the Krb5 name form was changed to=20 //@ An open question is "how do we determine the realm of the domain?" We do = not=20 want the realm to be that of the host. + Must fold edits in for: =96 Domain name not optional in 'query' name form =96 Switch order of krb5 princ name components - Add Security considerations Both I-Ds will soon be ready for WG Last Call Chair presented Corby Morris' presentation on C# Bindings: # bindings will be very similar to the Java bindings except for some mino= r=20 differences in the method declarations due to language requirements. =20 draft-morris-java-gssapi-update-for-csharp Note: Java Security team will soon submit an update to RFC 2853 which wil= l=20 correct differences between the rfc and the implemented org.ietf.jgss pac= kage. Larry Zhu gave a presentation on SPNEGO: The goals for this work is to update 2478 to restore the 'P' in SPNEGO wh= ile=20 maintaining backwards compatibility with the existing Windows SPNEGO=20 implementation. Initial draft published: draft-zhu-spnego-2478bis-00 The= =20 basis of the backwards compatibility is provided by a set of rules called= :=20 Safe-To-Omit-MIC rules. =20 Significant issues:=20 + Safe-to-omit MIC rules: what are they? and when can they be used? + should we protect reqFlags? + SHOULD or MAY use optimistic token?=20 + How is the MIC token computed? + Do we need out -of-band negotiation with down-level clients and server= s? There was heavy discussion on the need for negotiation and the case for=20 maintaining compatibility with existing implementations even though they = do=20 not implement the existing RFC. Conclusions were that negotiation is=20 important and there is a need to provide protected negotiation while=20 maintaining interoperability if it can be done securely. The discussion o= n the=20 use of the optimistic token did not produce an opinion on the use of SHOU= LD vs=20 MAY. There were strong feelings against supporting the use of mechanisms= =20 which do not provide integrity protection. No conclusion was reached on = how=20 the MIC token is to be computed. Is it over the OCTET-STREAM, with or wi= thout=20 the OID. =20 =20 Sam Hartman gave a presentation on GSS Naming: The immediate goal of this document has been to describe problems that we= 're=20 trying to solve to prevent scope creep. We want to support authentication= of=20 internal identities (uuids) and allow applications to work with parts of=20 composite names. Applications should be able to query available credenti= als=20 and presented names based on components and thereby find the most appropr= iate=20 credential for a target. (Martin Rex points out that you can't do=20 authentication of internal identities portably today) We think it can be=20 portable, and Nico and I think at least we can do a lot better than we ca= n do=20 today. There are several levels of GSSAPI v2 compatibility we need to lo= ok=20 at. + New mechanisms used by old applications (should they be visible? =20 Or only do GSSAPI v2 features?) + File formats for ACLs containing names Possible Solutions include name attributes, GSSAPI credential extensions,= =20 client given ability to assert a name, a facility for enumerating the=20 credentials that we have, choose different credential depending on the pa= rty=20 that they're talking to. name attributes: names are composed of attributes. attributes are OID lab= el=20 plus ?????? =20 client aserted names: allow clients to assert part of a name to be export= ed.=20 tell implementation what part of the name that it gets. this would provid= e=20 better compatibility with older applications credential extensions: add labelled extensions to credentials similar in=20 functionality to name attirubutes, but requires more changes to contexts. credential enumeration: Basically a "GSSAPI klist" facility to find=20 credentials that are available. Consensus was reached that we will have a document describing the solutio= n=20 space. Chair lead discussion on whether or not implementation of Kerberos 5=20 mechanism support for PRF and Domain Names should take place in kitten or krb-wg. Close of Meeting. DECISIONS (to be validated on the list): + Maintaining interoperability with existing deployed SPNEGO implementat= ions is more important then the ability to add new features such as protect= =20 reqFlags + No consensus was reached on whether the use of an optimistic token in = SPNEGO will be SHOULD or MAY. + There are strong feelings against the relaxing the MUST NOT applied to= the negotiation of mechanisms which do not support integrity protection + The GSS Naming document will describe the problem space and not just=20 solutions + The Kerberos 5 mechanism documents will working group documents of Kit= ten. We will work closely with the Kerberos WG to ensure proper review and = we we last call in both. This decision was made by flipping a coin. ACTION ITEMS: + Larry Zhu will follow up on the outstanding issues with SPNEGO and rep= ort to the list by Fri Nov 19 + The chair will send a list of working group documents to the secretari= at + Nico Williams will publish new I-Ds for PRF and Domain Names including= =20 results of recent on-list discussions + The Chair will contact Sun Java Security team to obtain a draft descri= bing the incompatibilities between RFC and org.ietf.jgss + Sam Hartman will revise GSS Naming document and then hand it off to a = new editor MILESTONES: Nov 04 First Meeting Dec 04 Prepare SPNEGO for Last Call Mar 05 Submit SPNEGO to the IESG as Proposed Standard Mar 05 First drafts of either 'Clarifications to GSSAPIv2' as=20 Informational OR submit 'Generic Security Service Applica= tion=20 Program Interface Version 2, Update 2' and 'Generic Secur= ity=20 Service API Version 2, Update 2 : C-bindings' to the IESG= as=20 Proposed Standard =20 Jul 05 Submit either 'Clarifications to GSSAPIv2' as Informational OR=20 submit 'Generic Security Service Application Program Inte= rface=20 Version 2, Update 2' and 'Generic Security Service API Ve= rsion=20 2, Update 2 : C-bindings' to the IESG as Proposed Standar= d =20 Jul 05 Submit 'The Channel Conjunction Mechanism (CCM) for the=20 GSSAPI' to the IESG as Proposed Standard=20 Jul 05 Submit 'The Simple and Protected GSS-API Negotiation Mechanism=20 (Revised)' to the IESG as Proposed Standard=20 Nov 05 Submit 'GSSAPI Mechanisms without a Unique Canonical Name' to=20 the IESG as Proposed Standard=20 Jul 06 Submit 'Generic Security Service Application Program Interface=20 Version 3' to the IESG as Proposed Standard =20 Jul 06 Submit 'Generic Security Service API Version 3 : C-bindings'=20 to the IESG as Proposed Standard=20 Jul 06 Submit 'Generic Security Service API Version 3 : Java and C#=20 bindings' to the IESG as Proposed Standard=20 Nov 06 Charter Review --------------030600040306000008070403 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --------------030600040306000008070403-- From kitten-bounces@ietf.org Fri Dec 3 17:57:30 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA16859; Fri, 3 Dec 2004 17:57:29 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaMSb-0008O5-Kh; Fri, 03 Dec 2004 18:03:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaMKg-0003kO-DR; Fri, 03 Dec 2004 17:55:22 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaLql-0005XE-13 for kitten@megatron.ietf.org; Fri, 03 Dec 2004 17:24:27 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA11469 for ; Fri, 3 Dec 2004 17:24:24 -0500 (EST) Received: from pecan.cc.columbia.edu ([128.59.206.21] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaLwY-0006db-6L for kitten@ietf.org; Fri, 03 Dec 2004 17:30:27 -0500 Received: from [192.168.0.141] (user-0cev2ll.cable.mindspring.com [24.239.138.181]) (user=jaltman mech=PLAIN bits=0) by pecan.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iB3MONoQ021050 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 3 Dec 2004 17:24:23 -0500 (EST) Message-ID: <41B0E7ED.1080907@columbia.edu> Date: Fri, 03 Dec 2004 17:25:49 -0500 From: Jeffrey Altman Organization: Not Affliliated with Columbia University in the City of New York User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org References: <20041203202150.GB101940@binky.central.sun.com> <41B0D096.8050900@sun.com> In-Reply-To: <41B0D096.8050900@sun.com> X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.21 X-Spam-Score: 0.1 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: 7bit Subject: Re: LAST CALL COMMENT: Section 5 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Content-Transfer-Encoding: 7bit Wyllys Ingersoll wrote: > Nicolas Williams wrote: > >> On Fri, Dec 03, 2004 at 12:55:06PM -0500, Tom Yu wrote: >> >>> I would change the text to something like: >>> >>> a) The mechlistMIC token (or simply the MIC token) is computed by >>> invoking GSS_GetMIC(): the input context_handle is the >>> established >>> mechanism context, the input qop_req is 0, and the input >>> message >>> is the DER encoding of the value of type MechTypeList which is >>> contained in the "mechTypes" field of the NegTokenInit. The >>> input >>> message is NOT the DER encoding of the type "[0] MechTypeList". >>> (Previous versions of this document were ambiguous about which >>> ASN.1 type was to be DER-encoded for the MIC.) > > > I agree, I also think this is a good change. > > I was also going to write some text to try and illusrate this in an > example, does anyone think that is necessary or is this new text > good enough? > > -Wyllys Given the incompatibilities and confusion between 2478 and this protocol revision, I believe an example is absolutely necessary. I consider the addition of such an example an editorial change to the document. Jeffrey Altman _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 6 07:33:12 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA04142; Mon, 6 Dec 2004 07:33:12 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbI9c-0002Gl-1p; Mon, 06 Dec 2004 07:39:48 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbHcq-00015E-R0; Mon, 06 Dec 2004 07:05:56 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbHbn-0000on-4I; Mon, 06 Dec 2004 07:04:51 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA28918; Mon, 6 Dec 2004 07:04:48 -0500 (EST) Message-Id: <200412061204.HAA28918@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Mon, 06 Dec 2004 07:04:48 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: 5011df3e2a27abcc044eaa15befcaa87 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : A PRF API extension for the GSS-API Author(s) : N. Williams Filename : draft-ietf-kitten-gssapi-prf-00.txt Pages : 8 Date : 2004-12-3 This document defines a Pseudo-Random Function (PRF) extension to the Generic Security Service Applicatoin Programming Interface (GSS-API) for keying application protocols given an established GSS-API security context. The primary intended use of this function is to key secure session layers that don't or cannot use GSS-API per-message MIC (message integrity check) and wrap tokens for session protection. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-gssapi-prf-00.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-gssapi-prf-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-gssapi-prf-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-6073324.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-gssapi-prf-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-gssapi-prf-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-6073324.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Mon Dec 6 07:35:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA04886; Mon, 6 Dec 2004 07:35:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbIC7-0002WG-2S; Mon, 06 Dec 2004 07:42:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbHct-00015n-Os; Mon, 06 Dec 2004 07:05:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbHbr-0000os-Kt; Mon, 06 Dec 2004 07:04:55 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA28925; Mon, 6 Dec 2004 07:04:52 -0500 (EST) Message-Id: <200412061204.HAA28925@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Mon, 06 Dec 2004 07:04:52 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: 8de5f93cb2b4e3bee75302e9eacc33db --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : A PRF for the Kerberos V GSS-API Mechanism Author(s) : N. Williams Filename : draft-ietf-kitten-krb5-gssapi-prf-00.txt Pages : 6 Date : 2004-12-3 This document defines the Pseudo-Random Function (PRF) for the Kerberos V GSS-API mechanism, based on the PRF defined for the Kerberos V cryptographic framework, for keying application protocols given an established Kerberos V GSS-API security context. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-krb5-gssapi-prf-00.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-krb5-gssapi-prf-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-krb5-gssapi-prf-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-6073335.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-krb5-gssapi-prf-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-krb5-gssapi-prf-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-6073335.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Mon Dec 6 07:37:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA05269; Mon, 6 Dec 2004 07:37:06 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbIDN-0002f0-Dy; Mon, 06 Dec 2004 07:43:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbHcw-000166-BL; Mon, 06 Dec 2004 07:06:02 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbHc3-0000px-NO; Mon, 06 Dec 2004 07:05:07 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA28938; Mon, 6 Dec 2004 07:05:04 -0500 (EST) Message-Id: <200412061205.HAA28938@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Mon, 06 Dec 2004 07:05:04 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-gssapi-domain-based-names-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: a87a9cdae4ac5d3fbeee75cd0026d632 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : GSS-API Domain-Based Service Names and Name Type Author(s) : N. Williams Filename : draft-ietf-kitten-gssapi-domain-based-names-00.txt Pages : 10 Date : 2004-12-3 This document describes domainname-based service principal names and the corresponding name type for the Generic Security Service Application Programming Interface (GSS-API). Domain-based service names are similar to host-based service names, but using a domain name (not necessarily and Internat domain name) instead of or in addition to a hostname. The primary purpose of domain-based service names is to provide a way to name clustered services after the domain which they service, thereby allowing their clients to authorize the service's servers based on authentication of their names. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-gssapi-domain-based-names-00.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-gssapi-domain-based-names-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-gssapi-domain-based-names-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-6073343.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-gssapi-domain-based-names-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-gssapi-domain-based-names-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-6073343.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Mon Dec 6 07:39:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA06289; Mon, 6 Dec 2004 07:39:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbIFV-0002x6-2z; Mon, 06 Dec 2004 07:45:53 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbHcz-00016V-7f; Mon, 06 Dec 2004 07:06:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbHc8-0000r3-6a; Mon, 06 Dec 2004 07:05:12 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA28952; Mon, 6 Dec 2004 07:05:09 -0500 (EST) Message-Id: <200412061205.HAA28952@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Mon, 06 Dec 2004 07:05:09 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-krb5-gssapi-domain-based-names-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : GSS-API Domain-Based Service Names Mapping for the Kerberos V GSS Mechanism Author(s) : N. Williams Filename : draft-ietf-kitten-krb5-gssapi-domain-based-names-00.txt Pages : 7 Date : 2004-12-3 This document describes the mapping of GSS-API domainname-based service principal names onto Kerberos V principal names. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-krb5-gssapi-domain-based-names-00.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-krb5-gssapi-domain-based-names-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-krb5-gssapi-domain-based-names-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-6073352.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-krb5-gssapi-domain-based-names-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-krb5-gssapi-domain-based-names-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-6073352.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Mon Dec 6 13:02:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05147; Mon, 6 Dec 2004 13:02:03 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbNHv-0002cG-WF; Mon, 06 Dec 2004 13:08:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbN3C-0002Pl-SS; Mon, 06 Dec 2004 12:53:30 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbMxF-0001R6-Qw for kitten@megatron.ietf.org; Mon, 06 Dec 2004 12:47:22 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA03962 for ; Mon, 6 Dec 2004 12:47:18 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbN3c-0002IN-ON for kitten@ietf.org; Mon, 06 Dec 2004 12:53:58 -0500 Received: from jurassic.eng.sun.com ([129.146.82.166]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iB6HlHdt027358; Mon, 6 Dec 2004 10:47:18 -0700 (MST) Received: from [192.9.61.32] (punchin-wyllys.SFBay.Sun.COM [192.9.61.32]) by jurassic.eng.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB6HlHk7624631; Mon, 6 Dec 2004 09:47:17 -0800 (PST) Message-ID: <41B49B24.9060802@sun.com> Date: Mon, 06 Dec 2004 12:47:16 -0500 From: Wyllys Ingersoll User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7) Gecko/20041028 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org, "Liqiang(Larry) Zhu" Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: 7bit Subject: MechListMIC example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Content-Transfer-Encoding: 7bit I'm proposing the following text as an example of how the MechListMIC is computed. I tried to keep it simple and just focus on the computation of the MIC (as opposed to talking about the SOMIC rules and how they would or would not appy). -Wyllys ===== A.3 MechListMIC Computation Example The following is an example to illustrate how the MechListMIC field would be computed. The initiator sent the following mechanisms (in order of preference): NTLMSSP (1.3.6.1.4.1.311.2.2.10) and Kerberos V5 (1.2.840.113554.1.2.2). mechTypes: a0 15 30 13 0A 2B 06 01 04 01 82 37 02 02 0A 09 2A 86 48 86 F7 12 01 02 02 ReqFlags: ... mechToken: ... mechTokenMIC: (not included in initial token) If a mechlistMIC needs to be generated (according to the rules in section 5), it is computed by using the DER encoding of the type MechTypeList field from the initiator's NegTokenInit token as input to the gss_GetMIC function. In this case, the MIC would be computed over the following bytes: 30 13 0A 2B 06 01 04 01 82 37 02 02 0A 09 2A 86 48 86 F7 12 01 02 02 Note that the identifier octet and length octet for constructed [0] (A0 15) are not included in the MIC computation. The output token from gss_GetMIC would then be used as the mechTokenMIC field in subsequent token exchanges. ===== _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 6 13:21:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07691; Mon, 6 Dec 2004 13:21:56 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbNbB-0003AP-2i; Mon, 06 Dec 2004 13:28:37 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbNSQ-0000nk-Q5; Mon, 06 Dec 2004 13:19:34 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbNQA-0000BX-H2 for kitten@megatron.ietf.org; Mon, 06 Dec 2004 13:17:14 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07384 for ; Mon, 6 Dec 2004 13:17:11 -0500 (EST) Received: from smtpde02.sap-ag.de ([155.56.68.170]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbNWP-00033m-Ao for kitten@ietf.org; Mon, 06 Dec 2004 13:23:51 -0500 Received: from sap-ag.de (smtpde02) by smtpde02.sap-ag.de (out) with ESMTP id TAA17132; Mon, 6 Dec 2004 19:16:25 +0100 (MEZ) From: Martin Rex Message-Id: <200412061816.TAA11832@uw1048.wdf.sap.corp> To: wyllys.ingersoll@sun.com (Wyllys Ingersoll) Date: Mon, 6 Dec 2004 19:16:25 +0100 (MET) In-Reply-To: <41B49B24.9060802@sun.com> from "Wyllys Ingersoll" at Dec 6, 4 12:47:16 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: 6cca30437e2d04f45110f2ff8dc1b1d5 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org, lzhu@windows.microsoft.com Subject: Re: MechListMIC example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 31247fb3be228bb596db9127becad0bc Content-Transfer-Encoding: 8bit I'm confused. Is there really a difference between what goes into signature and what goes onto the wire? As I wrote in my Email to the list on Nov 23th, the mech list in a Microsoft SPNEGO token looks like this: : : I was a little confused by your description (of OIDs and descriptions of : those OIDs) therefore I rechecked quickly. Here's what I get inside : an initial context token when requesting the "Negotiate" SSP on W2K3 IA64: : : a0 24 30 22 : 06 09 2a 86 48 82 f7 12 01 02 02 unknown OID (MS Kerberos bug?) : 06 09 2a 86 48 86 f7 12 01 02 02 Kerberos rfc-1964 gssapi : 06 0a 2b 06 01 04 01 82 37 02 02 0a Microsoft non-IETF NTLM SSP mechanism Your proposed example is: > 30 13 0A 2B 06 01 04 01 82 37 02 02 0A > 09 2A 86 48 86 F7 12 01 02 02 I think that your length field is incorrect, but also that the OID tags should be there. I would have expected: 30 17 06 0A 2B 06 01 04 01 82 37 02 02 0A 06 09 2A 86 48 86 F7 12 01 02 02 -Martin Wyllys Ingersoll wrote: > > > I'm proposing the following text as an example of how the MechListMIC > is computed. I tried to keep it simple and just focus on the computation > of the MIC (as opposed to talking about the SOMIC rules and how > they would or would not appy). > > -Wyllys > > ===== > A.3 MechListMIC Computation Example > > The following is an example to illustrate how the MechListMIC field > would be computed. > > The initiator sent the following mechanisms (in order of preference): > NTLMSSP (1.3.6.1.4.1.311.2.2.10) and Kerberos V5 > (1.2.840.113554.1.2.2). > > mechTypes: a0 15 30 13 0A 2B 06 01 04 01 82 37 02 02 0A > 09 2A 86 48 86 F7 12 01 02 02 > ReqFlags: ... > mechToken: ... > mechTokenMIC: (not included in initial token) > > If a mechlistMIC needs to be generated (according to the rules in > section 5), it is computed by using the DER encoding of the type > MechTypeList field from the initiator's NegTokenInit token as input > to the gss_GetMIC function. In this case, the MIC would be computed > over the following bytes: > > 30 13 0A 2B 06 01 04 01 82 37 02 02 0A > 09 2A 86 48 86 F7 12 01 02 02 > > Note that the identifier octet and length octet for constructed [0] > (A0 15) are not included in the MIC computation. The output token > from gss_GetMIC would then be used as the mechTokenMIC field in > subsequent token exchanges. > > ===== > > _______________________________________________ > Kitten mailing list > Kitten@lists.ietf.org > https://www1.ietf.org/mailman/listinfo/kitten > _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 6 13:56:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA11837; Mon, 6 Dec 2004 13:56:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbO8X-000483-49; Mon, 06 Dec 2004 14:03:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbNxW-0000Sy-0C; Mon, 06 Dec 2004 13:51:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbNoT-0006SL-SF for kitten@megatron.ietf.org; Mon, 06 Dec 2004 13:42:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA10049 for ; Mon, 6 Dec 2004 13:42:20 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbNus-0003c5-6w for kitten@ietf.org; Mon, 06 Dec 2004 13:48:59 -0500 Received: from jurassic.eng.sun.com ([129.146.88.31]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iB6IgI6O024390; Mon, 6 Dec 2004 10:42:18 -0800 (PST) Received: from [192.9.61.32] (punchin-wyllys.SFBay.Sun.COM [192.9.61.32]) by jurassic.eng.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB6IgIHl641535; Mon, 6 Dec 2004 10:42:18 -0800 (PST) Message-ID: <41B4A809.4010102@sun.com> Date: Mon, 06 Dec 2004 13:42:17 -0500 From: Wyllys Ingersoll User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7) Gecko/20041028 X-Accept-Language: en-us, en MIME-Version: 1.0 To: martin.rex@sap.com References: <200412061816.TAA11832@uw1048.wdf.sap.corp> In-Reply-To: <200412061816.TAA11832@uw1048.wdf.sap.corp> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org, lzhu@windows.microsoft.com Subject: Re: MechListMIC example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit Martin Rex wrote: > I'm confused. > Your proposed example is: > >> 30 13 0A 2B 06 01 04 01 82 37 02 02 0A >> 09 2A 86 48 86 F7 12 01 02 02 > > > I think that your length field is incorrect, but also that the OID tags > should be there. I would have expected: > 30 17 06 0A 2B 06 01 04 01 82 37 02 02 0A > 06 09 2A 86 48 86 F7 12 01 02 02 You are correct, I forgot the OID tag (0x06) in my example. I will fix it and resend the text after I get more comments. thanks, Wyllys _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 6 13:58:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA12035; Mon, 6 Dec 2004 13:58:06 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbOA9-0004Au-Mg; Mon, 06 Dec 2004 14:04:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbO1U-0001fB-DX; Mon, 06 Dec 2004 13:55:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbNpe-0006qG-TS for kitten@megatron.ietf.org; Mon, 06 Dec 2004 13:43:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA10174 for ; Mon, 6 Dec 2004 13:43:33 -0500 (EST) Received: from dhcp-221-130.pdc.kth.se ([130.237.221.130] helo=liandra.pc.cs.cmu.edu) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CbNw3-0003eh-Bh for kitten@ietf.org; Mon, 06 Dec 2004 13:50:12 -0500 Received: from liandra.pc.cs.cmu.edu ([127.0.0.1]) by liandra.pc.cs.cmu.edu id aa19945; 6 Dec 2004 13:43 EST Date: Mon, 06 Dec 2004 13:43:10 -0500 From: Jeffrey Hutzelman To: martin.rex@sap.com, Wyllys Ingersoll Message-ID: <69370000.1102358590@liandra.pc.cs.cmu.edu> In-Reply-To: <200412061816.TAA11832@uw1048.wdf.sap.corp> References: <200412061816.TAA11832@uw1048.wdf.sap.corp> X-Mailer: Mulberry/3.0.3 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org, lzhu@windows.microsoft.com Subject: Re: MechListMIC example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit On Monday, December 06, 2004 19:16:25 +0100 Martin Rex wrote: > I'm confused. > > Is there really a difference between what goes into signature > and what goes onto the wire? > > As I wrote in my Email to the list on Nov 23th, the mech list in > a Microsoft SPNEGO token looks like this: > > : > : I was a little confused by your description (of OIDs and descriptions of > : those OIDs) therefore I rechecked quickly. Here's what I get inside > : an initial context token when requesting the "Negotiate" SSP on W2K3 > IA64: : > : a0 24 30 22 > : 06 09 2a 86 48 82 f7 12 01 02 02 unknown OID (MS Kerberos bug?) > : 06 09 2a 86 48 86 f7 12 01 02 02 Kerberos rfc-1964 gssapi > : 06 0a 2b 06 01 04 01 82 37 02 02 0a Microsoft non-IETF NTLM SSP > mechanism > > > Your proposed example is: >> 30 13 0A 2B 06 01 04 01 82 37 02 02 0A >> 09 2A 86 48 86 F7 12 01 02 02 > > I think that your length field is incorrect, but also that the OID tags > should be there. I would have expected: > 30 17 06 0A 2B 06 01 04 01 82 37 02 02 0A > 06 09 2A 86 48 86 F7 12 01 02 02 I think you're right here. Wyllys's example is missing the type-and-flags octet on both OID's, and undercounts the total length by a total of two. -- Jeff _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 7 12:33:54 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA27801; Tue, 7 Dec 2004 12:33:54 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbjKQ-0001BV-Qo; Tue, 07 Dec 2004 12:40:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbj3M-0002Og-CY; Tue, 07 Dec 2004 12:23:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbikK-0003vA-8Z for kitten@megatron.ietf.org; Tue, 07 Dec 2004 12:03:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24829 for ; Tue, 7 Dec 2004 12:03:25 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbiqu-0000SY-MB for kitten@ietf.org; Tue, 07 Dec 2004 12:10:18 -0500 Received: from jurassic.eng.sun.com ([129.146.17.55]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iB7H3NiI023584 for ; Tue, 7 Dec 2004 09:03:23 -0800 (PST) Received: from [192.9.61.32] (punchin-wyllys.SFBay.Sun.COM [192.9.61.32]) by jurassic.eng.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB7H3MV9148579 for ; Tue, 7 Dec 2004 09:03:22 -0800 (PST) Message-ID: <41B5E259.4070905@sun.com> Date: Tue, 07 Dec 2004 12:03:21 -0500 From: Wyllys Ingersoll User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7) Gecko/20041028 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 Content-Transfer-Encoding: 7bit Subject: updated MIC computation example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca Content-Transfer-Encoding: 7bit I've updated the text for the MIC computation example based on comments received. I reused some text from Tom Yu's email from a couple of weeks ago to try and clarify how each part is put together. -Wyllys Ingersoll ===== A.3 MechListMIC Computation Example The following is an example to illustrate how the MechListMIC field would be computed. The NegTokenInit sequence is constructed as follows: 30 -- identifier octet for constructed SEQUENCE (NegTokenInit) nn -- length -- contents of SEQUENCE are: A0 -- identifier octet for constructed [0] nn -- length -- contents of the constructed [0] are: 30 -- identifier octet for constructed SEQUENCE nn -- length -- contents of the SEQUENCE are: 06 -- identifier octet for primitive OBJECT IDENTIFIER 09 -- length 2A 86 48 86 F7 12 01 02 02 -- Kerberos V5 { 1 2 840 113554 1 2 2 } If a mechlistMIC needs to be generated (according to the rules in section 5), it is computed by using the DER encoding of the type MechTypeList field from the initiator's NegTokenInit token as input to the gss_GetMIC function. In this case, the MIC would be computed over the following bytes: Contents of constructed [0] + contents of SEQUENCE: 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... Note that the identifier octet and length octet for constructed [0] (A0 nn) are not included in the MIC computation, just the contents. The output token from gss_GetMIC would then be used as the mechTokenMIC field in subsequent token exchanges. ====== _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 7 13:38:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04402; Tue, 7 Dec 2004 13:38:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbkKq-0002lA-HQ; Tue, 07 Dec 2004 13:45:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbk7b-0007lk-OR; Tue, 07 Dec 2004 13:31:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbjoz-00044c-D0 for kitten@megatron.ietf.org; Tue, 07 Dec 2004 13:12:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA01980 for ; Tue, 7 Dec 2004 13:12:18 -0500 (EST) Received: from dhcp-221-133.pdc.kth.se ([130.237.221.133] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbjva-0002AR-B3 for kitten@ietf.org; Tue, 07 Dec 2004 13:19:11 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id 7B7E9E0063; Tue, 7 Dec 2004 13:12:42 -0500 (EST) To: Wyllys Ingersoll References: <41B5E259.4070905@sun.com> From: Sam Hartman Date: Tue, 07 Dec 2004 13:12:42 -0500 In-Reply-To: <41B5E259.4070905@sun.com> (Wyllys Ingersoll's message of "Tue, 07 Dec 2004 12:03:21 -0500") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 01485d64dfa90b45a74269b3ca9d5574 Cc: kitten@ietf.org Subject: Re: updated MIC computation example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 08e48e05374109708c00c6208b534009 Why does this example focus on the NegTokenInit instead of on the MecListMIC? _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 7 14:22:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08968; Tue, 7 Dec 2004 14:22:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbl1q-0003rM-RV; Tue, 07 Dec 2004 14:29:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbknK-0003p8-4t; Tue, 07 Dec 2004 14:14:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbkkg-0002zU-JJ for kitten@megatron.ietf.org; Tue, 07 Dec 2004 14:11:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07700 for ; Tue, 7 Dec 2004 14:11:57 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbkrH-0003ah-Lw for kitten@ietf.org; Tue, 07 Dec 2004 14:18:49 -0500 Received: from jurassic.eng.sun.com ([129.146.85.31]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iB7JBrdt028394; Tue, 7 Dec 2004 12:11:53 -0700 (MST) Received: from [192.9.61.32] (punchin-wyllys.SFBay.Sun.COM [192.9.61.32]) by jurassic.eng.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB7JBqgt194983; Tue, 7 Dec 2004 11:11:52 -0800 (PST) Message-ID: <41B60077.5080300@sun.com> Date: Tue, 07 Dec 2004 14:11:51 -0500 From: Wyllys Ingersoll User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7) Gecko/20041028 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Sam Hartman References: <41B5E259.4070905@sun.com> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org Subject: Re: updated MIC computation example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Content-Transfer-Encoding: 7bit Sam Hartman wrote: > Why does this example focus on the NegTokenInit instead of on the > MecListMIC? The focus is supposed to be on the MechListMIC, but I felt that it was more helpful to show the context surrounding the MechList in order to clearly illustrate the bytes that the MIC would (and would not) include. Does anyone find the example helpful or does it just add more confusion? -Wyllys _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 7 18:38:55 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA15217; Tue, 7 Dec 2004 18:38:55 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbp1j-0004Tf-6p; Tue, 07 Dec 2004 18:45:51 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CboaH-0003rA-68; Tue, 07 Dec 2004 18:17:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CboM9-0001lE-S1 for kitten@megatron.ietf.org; Tue, 07 Dec 2004 18:02:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10643 for ; Tue, 7 Dec 2004 18:02:51 -0500 (EST) Received: from customer-relay.songnetworks.se ([195.42.210.9]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CboSm-0003XV-Ak for kitten@ietf.org; Tue, 07 Dec 2004 18:09:46 -0500 Received: from cz.mit.edu (8121664178-QUADRIGA-SVENSKA-NET.host.songnetworks.se [81.216.64.178]) by customer-relay.songnetworks.se (Postfix) with ESMTP id 0AE5F9ACC2 for ; Wed, 8 Dec 2004 00:02:19 +0100 (CET) Received: by cz.mit.edu (Postfix, from userid 8042) id 38647E0063; Tue, 7 Dec 2004 18:02:44 -0500 (EST) To: Wyllys Ingersoll References: <41B5E259.4070905@sun.com> <41B60077.5080300@sun.com> From: Sam Hartman Date: Tue, 07 Dec 2004 18:02:43 -0500 In-Reply-To: <41B60077.5080300@sun.com> (Wyllys Ingersoll's message of "Tue, 07 Dec 2004 14:11:51 -0500") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 Cc: kitten@ietf.org Subject: Re: updated MIC computation example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 >>>>> "Wyllys" == Wyllys Ingersoll writes: Wyllys> Sam Hartman wrote: >> Why does this example focus on the NegTokenInit instead of on >> the MecListMIC? Wyllys> The focus is supposed to be on the MechListMIC, but I felt Wyllys> that it was more helpful to show the context surrounding Wyllys> the MechList in order to clearly illustrate the bytes that Wyllys> the MIC would (and would not) include. O, I see. Concern withdrawn; I see both why I would find it confusing and why I suspect most readers would not. --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 7 19:54:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA23180; Tue, 7 Dec 2004 19:54:16 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbqCd-0006Ds-Oc; Tue, 07 Dec 2004 20:01:11 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbq3i-0000WP-Pu; Tue, 07 Dec 2004 19:51:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbq1D-0007sh-Vs for kitten@megatron.ietf.org; Tue, 07 Dec 2004 19:49:24 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22750 for ; Tue, 7 Dec 2004 19:49:20 -0500 (EST) Received: from au.padl.com ([203.13.32.1]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbq7s-00065g-26 for kitten@ietf.org; Tue, 07 Dec 2004 19:56:17 -0500 Received: from au.padl.com (localhost.padl.com [127.0.0.1]) by au.padl.com (8.12.11/8.12.11) with ESMTP id iB80mZL2092745; Wed, 8 Dec 2004 11:48:35 +1100 (EST) (envelope-from lukeh@au.padl.com) Received: (from lukeh@localhost) by au.padl.com (8.12.11/8.12.11/Submit) id iB80mZV4092744; Wed, 8 Dec 2004 11:48:35 +1100 (EST) (envelope-from lukeh) From: Luke Howard Message-Id: <200412080048.iB80mZV4092744@au.padl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Organization: PADL Software Pty Ltd To: wyllys.ingersoll@sun.com Date: Wed, 8 Dec 2004 11:48:35 +1100 Versions: dmail (bsd44) 2.6d/makemail 2.10 X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on au.padl.com X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Cc: kitten@ietf.org Subject: Re: updated MIC computation example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: lukeh@padl.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 >A.3 MechListMIC Computation Example > The following is an example to illustrate how the MechListMIC field > would be computed. > > The NegTokenInit sequence is constructed as follows: Just so we're clear that this is an example, perhaps you could add something like: In this example, the mechTypes field contains a single OID, { 1 2 840 113554 1 2 2 }. The NegTokenInit sequence is constructed as follows: > If a mechlistMIC needs to be generated (according to the rules in > section 5), it is computed by using the DER encoding of the type > MechTypeList field from the initiator's NegTokenInit token as input > to the gss_GetMIC function. In this case, the MIC would be computed > over the following bytes: > > Contents of constructed [0] + contents of SEQUENCE: > 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... Something like "Contents of field mechTypes" would make more sense to me given that the [0] type and length octets are not included. But perhaps this is just me. -- Luke -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 7 20:20:43 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA25770; Tue, 7 Dec 2004 20:20:43 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbqcE-0006sC-US; Tue, 07 Dec 2004 20:27:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbqTa-0006dV-O3; Tue, 07 Dec 2004 20:18:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbqM4-0005C3-GC for kitten@megatron.ietf.org; Tue, 07 Dec 2004 20:10:56 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24954 for ; Tue, 7 Dec 2004 20:10:55 -0500 (EST) Received: from cathode-dark-space.mit.edu ([18.18.1.96]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbqSk-0006ec-BU for kitten@ietf.org; Tue, 07 Dec 2004 20:17:50 -0500 Received: (from tlyu@localhost) by cathode-dark-space.mit.edu (8.12.9) id iB81AtMn022347; Tue, 7 Dec 2004 20:10:55 -0500 (EST) To: Wyllys Ingersoll References: <41B5E259.4070905@sun.com> From: Tom Yu Date: Tue, 07 Dec 2004 20:10:54 -0500 In-Reply-To: <41B5E259.4070905@sun.com> (Wyllys Ingersoll's message of "Tue, 07 Dec 2004 12:03:21 -0500") Message-ID: Lines: 82 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8 Cc: kitten@ietf.org Subject: Re: updated MIC computation example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 73734d43604d52d23b3eba644a169745 >>>>> "Wyllys" == Wyllys Ingersoll writes: Wyllys> A.3 MechListMIC Computation Example Wyllys> The following is an example to illustrate how the MechListMIC field Wyllys> would be computed. Wyllys> The NegTokenInit sequence is constructed as follows: I would replace the above with The initial part of the DER encoding of NegTokenInit is constructed as follows (the "nn" are length encodings, possibly longer than one octet): Wyllys> 30 -- identifier octet for constructed SEQUENCE (NegTokenInit) Wyllys> nn -- length Wyllys> -- contents of SEQUENCE are: replace above with -- contents octets of the SEQUENCE begin with -- DER encoding of "[0] MechTypeList": Wyllys> A0 -- identifier octet for constructed [0] Wyllys> nn -- length Wyllys> -- contents of the constructed [0] are: replace above with -- contents of constructed [0] are -- DER encoding of MechTypeList (which is a SEQUENCE): Wyllys> 30 -- identifier octet for constructed SEQUENCE Wyllys> nn -- length Wyllys> -- contents of the SEQUENCE are: replace above with -- contents octets of the SEQUENCE begin with -- DER encoding of OBJECT IDENTIFIER: Wyllys> 06 -- identifier octet for primitive OBJECT IDENTIFIER Wyllys> 09 -- length Wyllys> 2A 86 48 86 F7 12 01 02 02 -- Kerberos V5 { 1 2 840 113554 1 2 2 } Wyllys> If a mechlistMIC needs to be generated (according to the rules in Wyllys> section 5), it is computed by using the DER encoding of the type Wyllys> MechTypeList field from the initiator's NegTokenInit token as input Wyllys> to the gss_GetMIC function. In this case, the MIC would be computed Wyllys> over the following bytes: Wyllys> Contents of constructed [0] + contents of SEQUENCE: I really don't like the "contents of ..." phrasing, and would replace the above with: DER encoding of MechTypeList: Wyllys> 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... Wyllys> Note that the identifier octet and length octet for constructed [0] Wyllys> (A0 nn) are not included in the MIC computation, just the contents. I would replace the above text with: Note that the identifier octet and lengh octet(s) for constructed [0] (A0 nn) are not included in the MIC computation. The MIC is computed over the encoding of the MechTypeList which is enclosed in the constructed [0] encoding. Wyllys> The output token from gss_GetMIC would then be used as the Wyllys> mechTokenMIC field in subsequent token exchanges. Hopefully that helps to make things a bit more clear. Is there any particular reason that there is not indentation of the different levels of encodings? ---Tom _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 7 21:11:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA01193; Tue, 7 Dec 2004 21:11:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbrOx-0008GB-Sh; Tue, 07 Dec 2004 21:18:01 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbr9A-0000kL-Hp; Tue, 07 Dec 2004 21:01:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbr6W-00087R-Ng for kitten@megatron.ietf.org; Tue, 07 Dec 2004 20:58:57 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA00258 for ; Tue, 7 Dec 2004 20:58:54 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbrDB-00081T-Ru for kitten@ietf.org; Tue, 07 Dec 2004 21:05:51 -0500 Received: from jurassic.eng.sun.com ([129.146.88.31]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iB81wsiI011567; Tue, 7 Dec 2004 17:58:54 -0800 (PST) Received: from [192.9.61.32] (punchin-wyllys.SFBay.Sun.COM [192.9.61.32]) by jurassic.eng.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iB81wrYw375005; Tue, 7 Dec 2004 17:58:53 -0800 (PST) Message-ID: <41B65FDC.70405@sun.com> Date: Tue, 07 Dec 2004 20:58:52 -0500 From: Wyllys Ingersoll User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7) Gecko/20041028 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Tom Yu References: <41B5E259.4070905@sun.com> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org Subject: Re: updated MIC computation example text X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 538aad3a3c4f01d8b6a6477ca4248793 Content-Transfer-Encoding: 7bit Here is an update with Tom's (and others) comments taken into consideration: ==== A.3 MechListMIC Computation Example The following is an example to illustrate how the MechListMIC field would be computed. The initial part of the DER encoding of NegTokenInit is constructed as follows (the "nn" are length encodings, possibly longer than one octet): 30 -- identifier octet for constructed SEQUENCE (NegTokenInit) nn -- length -- contents octets of the SEQUENCE begin with -- DER encoding of "[0] MechTypeList": A0 -- identifier octet for constructed [0] nn -- length -- contents of the constructed [0] are DER encoding -- of MechTypeList (which is a SEQUENCE): 30 -- identifier octet for constructed SEQUENCE nn -- length -- contents octets of the SEQUENCE begin with -- DER encoding of OBJECT IDENTIFIER: 06 -- identifier octet for primitive OBJECT IDENTIFIER 09 -- length 2A 86 48 86 F7 12 01 02 02 -- Kerberos V5 -- {1 2 840 113554 1 2 2} If a mechlistMIC needs to be generated (according to the rules in section 5), it is computed by using the DER encoding of the type MechTypeList data from the initiator's NegTokenInit token as input to the gss_GetMIC function. In this case, the MIC would be computed over the following bytes: DER encoding of MechTypeList: 30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ... Note that the identifier octet and lengh octet(s) for constructed [0] (A0 nn) are not included in the MIC computation. The MIC is computed over the encoding of the MechTypeList which is enclosed in the constructed [0] encoding. The output token from gss_GetMIC would then be used as the mechTokenMIC field in subsequent token exchanges. ==== _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 10 06:17:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA04387; Fri, 10 Dec 2004 06:17:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcitD-000284-0M; Fri, 10 Dec 2004 06:24:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ccibv-0006M7-Me; Fri, 10 Dec 2004 06:06:55 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CciVN-0005Dz-Fj for kitten@megatron.ietf.org; Fri, 10 Dec 2004 06:00:09 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA03328 for ; Fri, 10 Dec 2004 06:00:07 -0500 (EST) Received: from smtp1.su.se ([130.237.162.112]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcicY-0001nu-B0 for kitten@ietf.org; Fri, 10 Dec 2004 06:07:34 -0500 Received: from localhost (smtp1.su.se [127.0.0.1]) by smtp1.su.se (Postfix) with ESMTP id 251D138110 for ; Fri, 10 Dec 2004 12:00:08 +0100 (CET) Received: from smtp1.su.se ([127.0.0.1]) by localhost (smtp1.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 25923-01-97 for ; Fri, 10 Dec 2004 12:00:08 +0100 (CET) Received: from cz.mit.edu (dhcp-wavelan-sh-63.publik.su.se [193.11.30.63]) by smtp1.su.se (Postfix) with ESMTP id 0F7B038059 for ; Fri, 10 Dec 2004 12:00:08 +0100 (CET) Received: by cz.mit.edu (Postfix, from userid 8042) id AB529E007A; Fri, 10 Dec 2004 05:54:50 -0500 (EST) To: kitten@ietf.org From: Sam Hartman Date: Fri, 10 Dec 2004 05:54:50 -0500 Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Virus-Scanned: by amavisd-new at su.se X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Subject: Comments on draft-ietf-kitten-gssapi-prf-00 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 1) The spec must require that gss_pseudo_random with the same input will produce the same output within one context. I.E. if I call the function multiple times with the same input I get the same result. 2) The spec must require that the probability that I get the same output given the same input with different contexts is exponentially small 3) The requirement that the function be called at most once per context needs to be dropped. 4) A reference to a definition of PRFs needs to be added. 5) The section titled "normative" should either become a subsection of a section titled "References" or should be retitled "Normative References" --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 10 06:30:49 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05597; Fri, 10 Dec 2004 06:30:49 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ccj6G-0002SZ-NE; Fri, 10 Dec 2004 06:38:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcisZ-0004Ta-B2; Fri, 10 Dec 2004 06:24:07 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcipG-0003Tz-E2 for kitten@megatron.ietf.org; Fri, 10 Dec 2004 06:20:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA04918 for ; Fri, 10 Dec 2004 06:20:39 -0500 (EST) Received: from smtp1.su.se ([130.237.162.112]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CciwQ-0002EM-FW for kitten@ietf.org; Fri, 10 Dec 2004 06:28:07 -0500 Received: from localhost (smtp1.su.se [127.0.0.1]) by smtp1.su.se (Postfix) with ESMTP id 38A3D38072 for ; Fri, 10 Dec 2004 12:20:40 +0100 (CET) Received: from smtp1.su.se ([127.0.0.1]) by localhost (smtp1.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 32383-01-5 for ; Fri, 10 Dec 2004 12:20:40 +0100 (CET) Received: from cz.mit.edu (dhcp-wavelan-sh-63.publik.su.se [193.11.30.63]) by smtp1.su.se (Postfix) with ESMTP id 2444D38059 for ; Fri, 10 Dec 2004 12:20:40 +0100 (CET) Received: by cz.mit.edu (Postfix, from userid 8042) id 398F1E0063; Fri, 10 Dec 2004 06:17:40 -0500 (EST) To: kitten@ietf.org From: Sam Hartman Date: Fri, 10 Dec 2004 06:17:40 -0500 Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Virus-Scanned: by amavisd-new at su.se X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Subject: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a I think all the Kerberos enctypes support at least 2**32 blocks, although admittedly that's getting dangerous for DES. I'd propose a four-byte length rather than a two-byte length. I think the call to random-to-key and k-truncate are misplaced. random-to-key is just wrong in the context of a PRF; you want random strings not keys out. You do need to truncate the output, but I don't think k-truncate is all that well understood in this context. I'd recommend explicitly saying that we truncate to the output length. The text is not clear on which key is used. Keep in mind that CFX involves subkeys and the keying for RFC 1964 is kind of complicated. You need to cover both cases. I think that the security considerations text should explicitly call out concerns with DES. --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Sun Dec 12 20:57:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA26211; Sun, 12 Dec 2004 20:57:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdfaE-0006YA-1j; Sun, 12 Dec 2004 21:05:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdfLg-0001K1-64; Sun, 12 Dec 2004 20:50:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdf9v-00070G-6v for kitten@megatron.ietf.org; Sun, 12 Dec 2004 20:37:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24373 for ; Sun, 12 Dec 2004 20:37:53 -0500 (EST) Received: from stratton-three-thirty-three.mit.edu ([18.187.6.78] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdfHd-0005zB-IO for kitten@ietf.org; Sun, 12 Dec 2004 20:45:53 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id C94BAE0063; Sun, 12 Dec 2004 20:38:31 -0500 (EST) To: kitten@ietf.org From: Sam Hartman Message-Id: <20041213013831.C94BAE0063@cz.mit.edu> Date: Sun, 12 Dec 2004 20:38:31 -0500 (EST) X-Spam-Score: 0.0 (/) X-Scan-Signature: 22bbb45ef41b733eb2d03ee71ece8243 Subject: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 68ba2b07ef271dba6ee42a93832cfa4c Between a time a document is submitted for publication and the time the IETF last call is issued, the AD responsible for the document reviews the specification and provides the AD's comments. The authors of this specification are interested in seeing it move relatively quickly and I had some extra time so I've pushed up my review of the document to happen during the WG last call. The following issues must be addressed before the IETF last call can be issued. As always, the chair judges consensus on how the working group wants to respond to the issue. Responses can include accepting proposed changes or a response arguing that the comment should be dropped for some reason. abstract: Suggested new text: If the available security mechanisms provide for integrity protection, then the negotiation is protected against an attacker forcing the selection of a mechanism not desired by the peers. This mechanism replaces RFC 2478 in order to fix defects in that specification and to describe how to interoperate with actual implementations of that specification. section 1: old: If per-message integrity services are available on the established mechanism security context, then the peers can exchange MIC tokens to ensure that the mechanism list was not tampered with. This MIC token exchange is OPTIONAL if the selected mechanism is the most preferred choice of both peers (see Section 5). new : If per-message integrity services are available on the established mechanism security context, then the negotiation is protected to ensure that the mechanism list has not been modified. In cases where an attacker could have materially influenced the negotiation, peers exchange message integrity code (MIC) tokens to confirm the mechanism list has not been modified. If no action of an attacker could have materially modified the outcome of the negotiation, the exchange of MIC tokens is optional. Allowing MIC tokens to be optional in this case provides interoperability with existing implementations while still protecting the negotiation. This interoperability comes at the cost of increased complexity. (Perhaps we still want a reference to section 5) The document claims that using the optimistic token you can avoid additional round-trips. I'm not sure this is true in the fullness of time if people start using feature oids per the extensibility section. SPNEGO relies the concepts developed in the GSS-API specification s/relies/relies on/ Section 3: The text seems to imply that the SPNEGO implementation uses another mechanism's credentials. This is only sort of true and I'm concerned the current text could confuse readers. It seems fairly clear from RFC 2743 that SPNEGO has its own credentials. These credentials may (and almost certainly are) be composed of credentials for other mechanisms. However the set of mechanisms in the gss credentials exposed to the application does not influence what mechanisms SPNEGO can negotiate. Do others think the text in section 3 is confusing on this issue? Lastly, MIC tokens MAY be exchanged to ensure the authenticity of the mechanism list received by the target. s/MAY/may/ That's a non-normative may. If it is MAY, then it means that implementations optionally can exchange these tokens. Whether that's true depends on rules in section 5. the prot_ready_state [RFC2743] will be false even if the underlying mechanism would return true natively. s/will/MUST/ (III) Otherwise, GSS_Accept_sec_conext() indicates GSS_S_COMPLETE Fix typo Section 4: A publication request for this document should be accompanied by a true assertion that the ASN.1 module has been validated. Please include the name of the person doing the validation and the tool used. In this negotiation model, each OID represents one GSS-API mechanism or one variant (see Section 6) of it according to [RFC2743]. I see nothing in section 6 that speaks to variants. This field is REQUIRED in the first reply from the target, and it is OPTIONAL thereafter. What happens if it is absent? Section 5: It is assumed that per-message integrity services are available on the established mechanism context in the following procedure for processing MIC tokens of the initiator's mechanism list. This text is redundant. Acceptors that wish to be compatible with legacy Windows SPNEGO implementations as described in Appendix B shall not generate a mechlistMIC token when the MIC token exchange is not required. I'd rather not have a 2119 SHALL subordinate to a "wish to" clause suggest s/SHALL/should/ c) In the case that the chosen mechanism uses an odd number of mechanism tokens (namely the initiator sends the last mechanism token), the initiator does the following when emitting the negotiation message containing the last mechanism token: if the negResult state was request_mic in the first reply from the Isn't the mechlistmic also required if a mechanism other than the initiator's first choice chosen? Same comment about SHALL as above. Section 10: RFC 2478 cannot be a normative reference if this spec replaces it. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 04:07:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA12314; Mon, 13 Dec 2004 04:07:16 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdmIZ-0007pK-VT; Mon, 13 Dec 2004 04:15:20 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdm5a-0005nI-23; Mon, 13 Dec 2004 04:01:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdm5D-0005dt-8Y for kitten@megatron.ietf.org; Mon, 13 Dec 2004 04:01:32 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA11878 for ; Mon, 13 Dec 2004 04:01:29 -0500 (EST) Received: from mail2.microsoft.com ([131.107.3.124]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdmCx-0007hu-VB for kitten@ietf.org; Mon, 13 Dec 2004 04:09:33 -0500 Received: from mailout1.microsoft.com ([157.54.1.117]) by mail2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 13 Dec 2004 01:00:50 -0800 Received: from red-hub-03.redmond.corp.microsoft.com ([157.54.2.25]) by mailout1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 01:00:57 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-03.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 01:00:58 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 01:00:56 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C4E0F2.3DEB01A3" Date: Mon, 13 Dec 2004 01:00:49 -0800 Message-ID: X-MS-Has-Attach: yes Thread-Topic: AD review: draft-ietf-kitten-2478bis-02 Thread-Index: AcTgtw2MluuyUcf+SteSCRUEnuvodwAOFOCw From: "Liqiang\(Larry\) Zhu" To: "Sam Hartman" , X-OriginalArrivalTime: 13 Dec 2004 09:00:56.0425 (UTC) FILETIME=[41D2AD90:01C4E0F2] X-Spam-Score: 0.0 (/) X-Scan-Signature: 17f3fe1c4bc9ac88f6fb2eb30c70dacb Subject: RE: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4fc29e2e8b3813568f35f66a17743e3b This is a multi-part message in MIME format. ------_=_NextPart_001_01C4E0F2.3DEB01A3 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Sam wrote: =20 > abstract: Suggested new text: If the available security mechanisms provide for integrity protection, then the negotiation > is protected against an attacker forcing the selection of a mechanism not desired by the peers. This mechanism replaces > RFC 2478 in order to fix defects in that specification and to describe how to interoperate with actual implementations of > that specification. This looks good, but I adjusted it slightly to exclude security contexts that do not support integrity protection. If per-message integrity services are available on the established mechanism context, then the negotiation is protected against an attacker forcing the selection of a mechanism not desired by the peers. This mechanism replaces RFC 2478 in order to fix defects in that specification and to describe how to interoperate with actual implementations of that specification. > section 1: > old: > If per-message integrity services are available on the established > mechanism security context, then the peers can exchange MIC tokens to > ensure that the mechanism list was not tampered with. This MIC token > exchange is OPTIONAL if the selected mechanism is the most preferred > choice of both peers (see Section 5). > new : > If per-message integrity services are available on the established > mechanism security context, then the negotiation is protected to ensure that the mechanism list has not been modified. > In cases where an attacker could have materially influenced the negotiation, peers exchange message integrity code (MIC) > tokens to confirm the mechanism list has not been modified. If no action of an attacker could have materially modified=20 > the outcome of the negotiation, the exchange of MIC tokens is optional. Allowing MIC tokens to be optional in this case=20 > provides interoperability with existing implementations while still protecting the negotiation. This interoperability > > comes at the cost of increased complexity.=20 > (Perhaps we still want a reference to section 5) Agreed. It is now in -03 with a reference to section 5. > The document claims that using the optimistic token you can avoid additional round-trips. I'm not sure this is true in > > the fullness of time if people start using feature oids per the extensibility section. It is not needed here and it is removed now. > SPNEGO relies the concepts developed in the GSS-API specification s/relies/relies on/ Fixed > The text seems to imply that the SPNEGO implementation uses another mechanism's credentials. This is only sort of true=20 > and I'm concerned the current text could confuse readers. It seems fairly clear from RFC 2743 that SPNEGO has its own=20 > credentials. These credentials may (and almost certainly are) be composed of credentials for other mechanisms. However=20 > the set of mechanisms in the gss credentials exposed to the application does not influence what mechanisms SPNEGO > can negotiate. Do others think the text in section 3 is confusing > on this issue? It was meant to emphasize that the list should not contains mechanisms that the initiator does not have credentials for. New text The first negotiation token sent by the initiator contains an ordered list of mechanisms (in decreasing preference order, favorite mechanism first), and optionally the initial mechanism token for the preferred mechanism of the initiator (i.e., the first in the list). (Note that the list MUST NOT contain mechanisms for which the client does not have appropriate credentials.) Is this a bit clearer? > Lastly, MIC tokens MAY be exchanged to ensure the authenticity of the > mechanism list received by the target. > s/MAY/may/ Fixed > the prot_ready_state [RFC2743] will be false even if the underlying > mechanism would return true natively. > s/will/MUST/ Fixed > A publication request for this document should be accompanied by a true assertion that the ASN.1 module has been=20 > validated. Please include the name of the person doing the validation and the tool used. Larry Zhu, Microsoft ASN.1 Compiler V1.0. I will also ask Luke to post which tool he used. > In this negotiation model, each OID represents one GSS-API mechanism > or one variant (see Section 6) of it according to [RFC2743]. > I see nothing in section 6 that speaks to variants. Fixed > This field is REQUIRED in the first reply from the target, and > it is OPTIONAL thereafter. > What happens if it is absent? Fixed. GSS_Init_sec_context() should indicate GSS_S_DEFECTIVE_TOKEN. > It is assumed that per-message integrity services are available on > the established mechanism context in the following procedure for > processing MIC tokens of the initiator's mechanism list. > This text is redundant. Agreed. > Acceptors that wish to be compatible with legacy Windows SPNEGO > implementations as described in Appendix B shall not generate a > mechlistMIC token when the MIC token exchange is not required. > I'd rather not have a 2119 SHALL subordinate to a "wish to" clause suggest s/SHALL/should/ Fixed > c) In the case that the chosen mechanism uses an odd number of > mechanism tokens (namely the initiator sends the last mechanism > token), the initiator does the following when emitting the > negotiation message containing the last mechanism token: if the > negResult state was request_mic in the first reply from the > Isn't the mechlistmic also required if a mechanism other than the initiator's first choice chosen? Yes, but the acceptor must send reqest_mic in that case too > Same comment about SHALL as above. Fixed > Section 10: > RFC 2478 cannot be a normative reference if this spec replaces it. Moved to informative references. For your convenience, I also attached the full version that should contain all these changes. Thanks, -- Larry -----Original Message----- From: kitten-bounces@lists.ietf.org [mailto:kitten-bounces@lists.ietf.org] On Behalf Of Sam Hartman Sent: Sunday, December 12, 2004 5:39 PM To: kitten@ietf.org Subject: AD review: draft-ietf-kitten-2478bis-02 Between a time a document is submitted for publication and the time the IETF last call is issued, the AD responsible for the document reviews the specification and provides the AD's comments. The authors of this specification are interested in seeing it move relatively quickly and I had some extra time so I've pushed up my review of the document to happen during the WG last call. The following issues must be addressed before the IETF last call can be issued. As always, the chair judges consensus on how the working group wants to respond to the issue. Responses can include accepting proposed changes or a response arguing that the comment should be dropped for some reason. abstract: Suggested new text: If the available security mechanisms provide for integrity protection, then the negotiation is protected against an attacker forcing the selection of a mechanism not desired by the peers. This mechanism replaces RFC 2478 in order to fix defects in that specification and to describe how to interoperate with actual implementations of that specification. section 1: old: If per-message integrity services are available on the established mechanism security context, then the peers can exchange MIC tokens to ensure that the mechanism list was not tampered with. This MIC token exchange is OPTIONAL if the selected mechanism is the most preferred choice of both peers (see Section 5). new : If per-message integrity services are available on the established mechanism security context, then the negotiation is protected to ensure that the mechanism list has not been modified. In cases where an attacker could have materially influenced the negotiation, peers exchange message integrity code (MIC) tokens to confirm the mechanism list has not been modified. If no action of an attacker could have materially modified the outcome of the negotiation, the exchange of MIC tokens is optional. Allowing MIC tokens to be optional in this case provides interoperability with existing implementations while still protecting the negotiation. This interoperability comes at the cost of increased complexity.=20 (Perhaps we still want a reference to section 5) The document claims that using the optimistic token you can avoid additional round-trips. I'm not sure this is true in the fullness of time if people start using feature oids per the extensibility section. SPNEGO relies the concepts developed in the GSS-API specification s/relies/relies on/ Section 3: The text seems to imply that the SPNEGO implementation uses another mechanism's credentials. This is only sort of true and I'm concerned the current text could confuse readers. It seems fairly clear from RFC 2743 that SPNEGO has its own credentials. These credentials may (and almost certainly are) be composed of credentials for other mechanisms. However the set of mechanisms in the gss credentials exposed to the application does not influence what mechanisms SPNEGO can negotiate. Do others think the text in section 3 is confusing on this issue? Lastly, MIC tokens MAY be exchanged to ensure the authenticity of the mechanism list received by the target. s/MAY/may/ That's a non-normative may. If it is MAY, then it means that implementations optionally can exchange these tokens. Whether that's true depends on rules in section 5. the prot_ready_state [RFC2743] will be false even if the underlying mechanism would return true natively. s/will/MUST/ (III) Otherwise, GSS_Accept_sec_conext() indicates GSS_S_COMPLETE Fix typo Section 4: A publication request for this document should be accompanied by a true assertion that the ASN.1 module has been validated. Please include the name of the person doing the validation and the tool used. In this negotiation model, each OID represents one GSS-API mechanism or one variant (see Section 6) of it according to [RFC2743]. I see nothing in section 6 that speaks to variants. This field is REQUIRED in the first reply from the target, and it is OPTIONAL thereafter. What happens if it is absent? Section 5: It is assumed that per-message integrity services are available on the established mechanism context in the following procedure for processing MIC tokens of the initiator's mechanism list. This text is redundant. Acceptors that wish to be compatible with legacy Windows SPNEGO implementations as described in Appendix B shall not generate a mechlistMIC token when the MIC token exchange is not required. I'd rather not have a 2119 SHALL subordinate to a "wish to" clause suggest s/SHALL/should/ c) In the case that the chosen mechanism uses an odd number of mechanism tokens (namely the initiator sends the last mechanism token), the initiator does the following when emitting the negotiation message containing the last mechanism token: if the negResult state was request_mic in the first reply from the Isn't the mechlistmic also required if a mechanism other than the initiator's first choice chosen? Same comment about SHALL as above. Section 10: RFC 2478 cannot be a normative reference if this spec replaces it. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten ------_=_NextPart_001_01C4E0F2.3DEB01A3 Content-Type: text/plain; name="draft-ietf-kitten-2478bis-03.txt" Content-Description: draft-ietf-kitten-2478bis-03.txt Content-Disposition: attachment; filename="draft-ietf-kitten-2478bis-03.txt" Content-Transfer-Encoding: base64 DQoNCk5FVFdPUksgV09SS0lORyBHUk9VUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEwuIFpodQ0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFAuIExlYWNoDQpPYnNvbGV0ZXM6IDI0NzggKGlm IGFwcHJvdmVkKSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEsuIEphZ2FuYXRoYW4NCkV4 cGlyZXM6IEp1bmUgMTIsIDIwMDUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1pY3Jvc29m dCBDb3Jwb3JhdGlvbg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgVy4gSW5nZXJzb2xsDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFN1biBNaWNyb3N5c3RlbXMNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEZWNlbWJlciAx MiwgMjAwNA0KDQoNCiAgICAgICAgIFRoZSBTaW1wbGUgYW5kIFByb3RlY3RlZCBHU1MtQVBJIE5l Z290aWF0aW9uIE1lY2hhbmlzbQ0KICAgICAgICAgICAgICAgICAgICAgICBkcmFmdC1pZXRmLWtp dHRlbi0yNDc4YmlzDQoNClN0YXR1cyBvZiB0aGlzIE1lbW8NCg0KICAgVGhpcyBkb2N1bWVudCBp cyBhbiBJbnRlcm5ldC1EcmFmdCBhbmQgaXMgc3ViamVjdCB0byBhbGwgcHJvdmlzaW9ucw0KICAg b2Ygc2VjdGlvbiAzIG9mIFJGQyAzNjY3LiAgQnkgc3VibWl0dGluZyB0aGlzIEludGVybmV0LURy YWZ0LCBlYWNoDQogICBhdXRob3IgcmVwcmVzZW50cyB0aGF0IGFueSBhcHBsaWNhYmxlIHBhdGVu dCBvciBvdGhlciBJUFIgY2xhaW1zIG9mDQogICB3aGljaCBoZSBvciBzaGUgaXMgYXdhcmUgaGF2 ZSBiZWVuIG9yIHdpbGwgYmUgZGlzY2xvc2VkLCBhbmQgYW55IG9mDQogICB3aGljaCBoZSBvciBz aGUgYmVjb21lIGF3YXJlIHdpbGwgYmUgZGlzY2xvc2VkLCBpbiBhY2NvcmRhbmNlIHdpdGgNCiAg IFJGQyAzNjY4Lg0KDQogICBJbnRlcm5ldC1EcmFmdHMgYXJlIHdvcmtpbmcgZG9jdW1lbnRzIG9m IHRoZSBJbnRlcm5ldCBFbmdpbmVlcmluZw0KICAgVGFzayBGb3JjZSAoSUVURiksIGl0cyBhcmVh cywgYW5kIGl0cyB3b3JraW5nIGdyb3Vwcy4gIE5vdGUgdGhhdA0KICAgb3RoZXIgZ3JvdXBzIG1h eSBhbHNvIGRpc3RyaWJ1dGUgd29ya2luZyBkb2N1bWVudHMgYXMNCiAgIEludGVybmV0LURyYWZ0 cy4NCg0KICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBkcmFmdCBkb2N1bWVudHMgdmFsaWQgZm9yIGEg bWF4aW11bSBvZiBzaXggbW9udGhzDQogICBhbmQgbWF5IGJlIHVwZGF0ZWQsIHJlcGxhY2VkLCBv ciBvYnNvbGV0ZWQgYnkgb3RoZXIgZG9jdW1lbnRzIGF0IGFueQ0KICAgdGltZS4gIEl0IGlzIGlu YXBwcm9wcmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBhcyByZWZlcmVuY2UNCiAgIG1hdGVy aWFsIG9yIHRvIGNpdGUgdGhlbSBvdGhlciB0aGFuIGFzICJ3b3JrIGluIHByb2dyZXNzLiINCg0K ICAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC1EcmFmdHMgY2FuIGJlIGFjY2Vzc2VkIGF0 DQogICBodHRwOi8vd3d3LmlldGYub3JnL2lldGYvMWlkLWFic3RyYWN0cy50eHQuDQoNCiAgIFRo ZSBsaXN0IG9mIEludGVybmV0LURyYWZ0IFNoYWRvdyBEaXJlY3RvcmllcyBjYW4gYmUgYWNjZXNz ZWQgYXQNCiAgIGh0dHA6Ly93d3cuaWV0Zi5vcmcvc2hhZG93Lmh0bWwuDQoNCiAgIFRoaXMgSW50 ZXJuZXQtRHJhZnQgd2lsbCBleHBpcmUgb24gSnVuZSAxMiwgMjAwNS4NCg0KQ29weXJpZ2h0IE5v dGljZQ0KDQogICBDb3B5cmlnaHQgKEMpIFRoZSBJbnRlcm5ldCBTb2NpZXR5ICgyMDA0KS4NCg0K QWJzdHJhY3QNCg0KICAgVGhpcyBkb2N1bWVudCBzcGVjaWZpZXMgYSBuZWdvdGlhdGlvbiBtZWNo YW5pc20gZm9yIHRoZSBHZW5lcmljDQogICBTZWN1cml0eSBTZXJ2aWNlIEFwcGxpY2F0aW9uIFBy b2dyYW0gSW50ZXJmYWNlIChHU1MtQVBJKSB3aGljaCBpcw0KICAgZGVzY3JpYmVkIGluIFJGQyAy NzQzLg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEyLCAy MDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgMV0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdT Uy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCiAg IEdTUy1BUEkgcGVlcnMgY2FuIHVzZSB0aGlzIG5lZ290aWF0aW9uIG1lY2hhbmlzbSB0byBjaG9v c2UgZnJvbSBhDQogICBjb21tb24gc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMuDQoNCiAgIElm IHBlci1tZXNzYWdlIGludGVncml0eSBzZXJ2aWNlcyBhcmUgYXZhaWxhYmxlIG9uIHRoZSBlc3Rh Ymxpc2hlZA0KICAgbWVjaGFuaXNtIGNvbnRleHQsIHRoZW4gdGhlIG5lZ290aWF0aW9uIGlzIHBy b3RlY3RlZCBhZ2FpbnN0IGFuDQogICBhdHRhY2tlciBmb3JjaW5nIHRoZSBzZWxlY3Rpb24gb2Yg YSBtZWNoYW5pc20gbm90IGRlc2lyZWQgYnkgdGhlDQogICBwZWVycy4NCg0KICAgVGhpcyBtZWNo YW5pc20gcmVwbGFjZXMgUkZDIDI0NzggaW4gb3JkZXIgdG8gZml4IGRlZmVjdHMgaW4gdGhhdA0K ICAgc3BlY2lmaWNhdGlvbiBhbmQgdG8gZGVzY3JpYmUgaG93IHRvIGludGVyb3BlcmF0ZSB3aXRo IGFjdHVhbA0KICAgaW1wbGVtZW50YXRpb25zIG9mIHRoYXQgc3BlY2lmaWNhdGlvbi4NCg0KVGFi bGUgb2YgQ29udGVudHMNCg0KICAgMS4gIEludHJvZHVjdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAzDQogICAyLiAgQ29udmVudGlvbnMgVXNl ZCBpbiBUaGlzIERvY3VtZW50ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDUNCiAgIDMu ICBOZWdvdGlhdGlvbiBQcm90b2NvbCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAgNg0KICAgICAzLjEgICBOZWdvdGlhdGlvbiBEZXNjcmlwdGlvbiAgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA2DQogICAgIDMuMiAgIE5lZ290aWF0aW9uIFByb2Nl ZHVyZSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDcNCiAgIDQuICBUb2tl biBEZWZpbml0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAxMA0KICAgICA0LjEgICBNZWNoYW5pc20gVHlwZXMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIDEwDQogICAgIDQuMiAgIE5lZ290aWF0aW9uIFRva2VucyAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTANCiAgICAgICA0LjIuMSAgIG5l Z1Rva2VuSW5pdCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxMQ0K ICAgICAgIDQuMi4yICAgbmVnVG9rZW5SZXNwIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIDEyDQogICA1LiAgUHJvY2Vzc2luZyBvZiBtZWNoTGlzdE1JQyAgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTQNCiAgIDYuICBFeHRlbnNpYmlsaXR5ICAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxNw0KICAgNy4g IFNlY3VyaXR5IENvbnNpZGVyYXRpb25zICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIDE4DQogICA4LiAgSUFOQSBDb25zaWRlcmF0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTkNCiAgIDkuICBBY2tub3dsZWRnbWVudHMgIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyMA0KICAgMTAuICAgUmVm ZXJlbmNlcyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IDIxDQogICAxMC4xICBOb3JtYXRpdmUgUmVmZXJlbmNlcyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gMjENCiAgIDEwLjIgIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMgLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyMQ0KICAgICAgIEF1dGhvcnMnIEFk ZHJlc3NlcyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIxDQog ICBBLiAgR1NTLUFQSSBOZWdvdGlhdGlvbiBTdXBwb3J0IEFQSSAgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gMjMNCiAgICAgQS4xICAgR1NTX1NldF9uZWdfbWVjaHMgY2FsbCAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyMw0KICAgICBBLjIgICBHU1NfR2V0X25lZ19t ZWNocyBjYWxsIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIzDQogICBCLiAg Q2hhbmdlcyBzaW5jZSBSRkMyNDc4ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gMjUNCiAgIEMuICBNZWNoTGlzdE1JQyBDb21wdXRhdGlvbiBFeGFtcGxlICAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyNw0KICAgICAgIEludGVsbGVjdHVhbCBQcm9wZXJ0eSBh bmQgQ29weXJpZ2h0IFN0YXRlbWVudHMgLiAuIC4gLiAuIC4gLiAuIDI4DQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEyLCAyMDA1 ICAgICAgICAgICAgICAgICAgW1BhZ2UgMl0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1B UEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCjEuICBJ bnRyb2R1Y3Rpb24NCg0KICAgVGhlIEdTUy1BUEkgW1JGQzI3NDNdIHByb3ZpZGVzIGEgZ2VuZXJp YyBpbnRlcmZhY2Ugd2hpY2ggY2FuIGJlDQogICBsYXllcmVkIGF0b3AgZGlmZmVyZW50IHNlY3Vy aXR5IG1lY2hhbmlzbXMgc3VjaCB0aGF0IGlmIGNvbW11bmljYXRpbmcNCiAgIHBlZXJzIGFjcXVp cmUgR1NTLUFQSSBjcmVkZW50aWFscyBmb3IgdGhlIHNhbWUgc2VjdXJpdHkgbWVjaGFuaXNtLA0K ICAgdGhlbiBhIHNlY3VyaXR5IGNvbnRleHQgbWF5IGJlIGVzdGFibGlzaGVkIGJldHdlZW4gdGhl bSAoc3ViamVjdCB0bw0KICAgcG9saWN5KS4gIEhvd2V2ZXIsIEdTUy1BUEkgZG9lcyBub3QgcHJl c2NyaWJlIHRoZSBtZXRob2QgYnkgd2hpY2gNCiAgIEdTUy1BUEkgcGVlcnMgY2FuIGVzdGFibGlz aCB3aGV0aGVyIHRoZXkgaGF2ZSBhIGNvbW1vbiBzZWN1cml0eQ0KICAgbWVjaGFuaXNtLg0KDQog ICBUaGUgU2ltcGxlIGFuZCBQcm90ZWN0ZWQgR1NTLUFQSSBOZWdvdGlhdGlvbiAoU1BORUdPKSBt ZWNoYW5pc20NCiAgIGRlZmluZWQgaGVyZSBpcyBhIHBzZXVkbyBzZWN1cml0eSBtZWNoYW5pc20s IHJlcHJlc2VudGVkIGJ5IHRoZQ0KICAgT2JqZWN0IElkZW50aWZpZXIgaXNvLm9yZy5kb2QuaW50 ZXJuZXQuc2VjdXJpdHkubWVjaGFuaXNtLnNuZWdvDQogICAoMS4zLjYuMS41LjUuMiksIHdoaWNo IGVuYWJsZXMgR1NTLUFQSSBwZWVycyB0byBkZXRlcm1pbmUgaW4tYmFuZA0KICAgd2hldGhlciB0 aGVpciBjcmVkZW50aWFscyBzdXBwb3J0IGNvbW1vbiBHU1MtQVBJIHNlY3VyaXR5DQogICBtZWNo YW5pc20ocyksIGFuZCBpZiBzbywgdG8gaW52b2tlIG5vcm1hbCBzZWN1cml0eSBjb250ZXh0DQog ICBlc3RhYmxpc2htZW50IGZvciBhIHNlbGVjdGVkIGNvbW1vbiBzZWN1cml0eSBtZWNoYW5pc20u ICBUaGlzIGlzIG1vc3QNCiAgIHVzZWZ1bCBmb3IgYXBwbGljYXRpb25zIHdoaWNoIGFyZSBiYXNl ZCBvbiBHU1MtQVBJIGltcGxlbWVudGF0aW9ucw0KICAgYW5kIHNoYXJlIG11bHRpcGxlIG1lY2hh bmlzbXMgYmV0d2VlbiB0aGUgcGVlcnMuDQoNCiAgIFRoZSBTUE5FR08gbWVjaGFuaXNtIG5lZ290 aWF0aW9uIGlzIGJhc2VkIG9uIHRoZSBmb2xsb3dpbmcNCiAgIG5lZ290aWF0aW9uIG1vZGVsOiB0 aGUgaW5pdGlhdG9yIHByb3Bvc2VzIGEgbGlzdCBvZiBzZWN1cml0eQ0KICAgbWVjaGFuaXNtKHMp LCBpbiBkZWNyZWFzaW5nIHByZWZlcmVuY2Ugb3JkZXIgKGZhdm9yaXRlIGNob2ljZSBmaXJzdCks DQogICB0aGUgYWNjZXB0b3IgKGFsc28ga25vd24gYXMgdGhlIHRhcmdldCkgZWl0aGVyIGFjY2Vw dHMgdGhlDQogICBpbml0aWF0b3IncyBwcmVmZXJyZWQgc2VjdXJpdHkgbWVjaGFuaXNtICh0aGUg Zmlyc3QgaW4gdGhlIGxpc3QpLCBvcg0KICAgY2hvb3NlcyBvbmUgdGhhdCBpcyBhdmFpbGFibGUg ZnJvbSB0aGUgb2ZmZXJlZCBsaXN0LCBvciByZWplY3RzIHRoZQ0KICAgcHJvcG9zZWQgdmFsdWUo cykuICBUaGUgdGFyZ2V0IHRoZW4gaW5mb3JtcyB0aGUgaW5pdGlhdG9yIG9mIGl0cw0KICAgY2hv aWNlLg0KDQogICBPbmNlIGEgY29tbW9uIHNlY3VyaXR5IG1lY2hhbmlzbSBpcyBjaG9zZW4sIG1l Y2hhbmlzbS1zcGVjaWZpYw0KICAgb3B0aW9ucyBNQVkgYmUgbmVnb3RpYXRlZCBhcyBwYXJ0IG9m IHRoZSBzZWxlY3RlZCBtZWNoYW5pc20ncyBjb250ZXh0DQogICBlc3RhYmxpc2htZW50LiAgVGhl c2UgbmVnb3RpYXRpb25zIChpZiBhbnkpIGFyZSBpbnRlcm5hbCB0byB0aGUNCiAgIG1lY2hhbmlz bSBhbmQgb3BhcXVlIHRvIHRoZSBTUE5FR08gcHJvdG9jb2wuICBBcyBzdWNoIHRoZXkgYXJlDQog ICBvdXRzaWRlIHRoZSBzY29wZSBvZiB0aGlzIGRvY3VtZW50Lg0KDQogICBJZiBwZXItbWVzc2Fn ZSBpbnRlZ3JpdHkgc2VydmljZXMgYXJlIGF2YWlsYWJsZSBvbiB0aGUgZXN0YWJsaXNoZWQNCiAg IG1lY2hhbmlzbSBzZWN1cml0eSBjb250ZXh0LCB0aGVuIHRoZSBuZWdvdGlhdGlvbiBpcyBwcm90 ZWN0ZWQgdG8NCiAgIGVuc3VyZSB0aGF0IHRoZSBtZWNoYW5pc20gbGlzdCBoYXMgbm90IGJlZW4g bW9kaWZpZWQuICBJbiBjYXNlcyB3aGVyZQ0KICAgYW4gYXR0YWNrZXIgY291bGQgaGF2ZSBtYXRl cmlhbGx5IGluZmx1ZW5jZWQgdGhlIG5lZ290aWF0aW9uLCBwZWVycw0KICAgZXhjaGFuZ2UgbWVz c2FnZSBpbnRlZ3JpdHkgY29kZSAoTUlDKSB0b2tlbnMgdG8gY29uZmlybSB0aGUgbWVjaGFuaXNt DQogICBsaXN0IGhhcyBub3QgYmVlbiBtb2RpZmllZC4gIElmIG5vIGFjdGlvbiBvZiBhbiBhdHRh Y2tlciBjb3VsZCBoYXZlDQogICBtYXRlcmlhbGx5IG1vZGlmaWVkIHRoZSBvdXRjb21lIG9mIHRo ZSBuZWdvdGlhdGlvbiwgdGhlIGV4Y2hhbmdlIG9mDQogICBNSUMgdG9rZW5zIGlzIG9wdGlvbmFs IFNlY3Rpb24gNS4gIEFsbG93aW5nIE1JQyB0b2tlbnMgdG8gYmUgb3B0aW9uYWwNCiAgIGluIHRo aXMgY2FzZSBwcm92aWRlcyBpbnRlcm9wZXJhYmlsaXR5IHdpdGggZXhpc3RpbmcgaW1wbGVtZW50 YXRpb25zDQogICB3aGlsZSBzdGlsbCBwcm90ZWN0aW5nIHRoZSBuZWdvdGlhdGlvbi4gIFRoaXMg aW50ZXJvcGVyYWJpbGl0eSBjb21lcw0KICAgYXQgdGhlIGNvc3Qgb2YgaW5jcmVhc2VkIGNvbXBs ZXhpdHkuDQoNCiAgIEluIG9yZGVyIHRvIGF2b2lkIGFuIGV4dHJhIHJvdW5kIHRyaXAsIHRoZSBm aXJzdCBjb250ZXh0DQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5l IDEyLCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgM10NCgwNCkludGVybmV0LURyYWZ0ICAg ICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0K DQoNCiAgIGVzdGFibGlzaG1lbnQgdG9rZW4gb2YgdGhlIGluaXRpYXRvcidzIHByZWZlcnJlZCBt ZWNoYW5pc20gU0hPVUxEIGJlDQogICBlbWJlZGRlZCBpbiB0aGUgaW5pdGlhbCBuZWdvdGlhdGlv biBtZXNzYWdlIChhcyBkZWZpbmVkIGluIFNlY3Rpb24NCiAgIDQuMikuICAoVGhpcyBtZWNoYW5p c20gdG9rZW4gaXMgcmVmZXJyZWQgdG8gYXMgdGhlIG9wdGltaXN0aWMNCiAgIG1lY2hhbmlzbSB0 b2tlbiBpbiB0aGlzIGRvY3VtZW50LikgSW4gYWRkaXRpb24sIHVzaW5nIHRoZSBvcHRpbWlzdGlj DQogICBtZWNoYW5pc20gdG9rZW4gYWxsb3dzIHRoZSBpbml0aWF0b3IgdG8gcmVjb3ZlciBmcm9t IG5vbi1mYXRhbCBlcnJvcnMNCiAgIGVuY291bnRlcmVkIHRyeWluZyB0byBwcm9kdWNlIHRoZSBm aXJzdCBtZWNoYW5pc20gdG9rZW4gYmVmb3JlIGENCiAgIG1lY2hhbmlzbSBjYW4gYmUgc2VsZWN0 ZWQuICBJbXBsZW1lbnRhdGlvbnMgTUFZIG9taXQgdGhlIG9wdGltaXN0aWMNCiAgIG1lY2hhbmlz bSB0b2tlbiBpbiBjYXNlcyB3aGVyZSB0aGUgbGlrZWxpaG9vZCBvZiB0aGUgaW5pdGlhdG9yJ3MN CiAgIHByZWZlcnJlZCBtZWNoYW5pc20gbm90IGJlaW5nIHNlbGVjdGVkIGJ5IHRoZSBhY2NlcHRv ciBpcyBzaWduaWZpY2FudA0KICAgZ2l2ZW4gdGhlIGNvc3Qgb2YgZ2VuZXJhdGluZyBpdC4NCg0K ICAgU1BORUdPIHJlbGllcyBvbiB0aGUgY29uY2VwdHMgZGV2ZWxvcGVkIGluIHRoZSBHU1MtQVBJ IHNwZWNpZmljYXRpb24NCiAgIFtSRkMyNzQzXS4gIFRoZSBuZWdvdGlhdGlvbiBkYXRhIGlzIGVu Y2Fwc3VsYXRlZCBpbiBjb250ZXh0LWxldmVsDQogICB0b2tlbnMuICBUaGVyZWZvcmUsIGNhbGxl cnMgb2YgdGhlIEdTUy1BUEkgZG8gbm90IG5lZWQgdG8gYmUgYXdhcmUgb2YNCiAgIHRoZSBleGlz dGVuY2Ugb2YgdGhlIG5lZ290aWF0aW9uIHRva2VucyBidXQgb25seSBvZiB0aGUgbmV3DQogICBw c2V1ZG8tc2VjdXJpdHkgbWVjaGFuaXNtLiAgQSBmYWlsdXJlIGluIHRoZSBuZWdvdGlhdGlvbiBw aGFzZSBjYXVzZXMNCiAgIGEgbWFqb3Igc3RhdHVzIGNvZGUgdG8gYmUgcmV0dXJuZWQ6IEdTU19T X0JBRF9NRUNILg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBK dW5lIDEyLCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgNF0NCgwNCkludGVybmV0LURyYWZ0 ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAw NA0KDQoNCjIuICBDb252ZW50aW9ucyBVc2VkIGluIFRoaXMgRG9jdW1lbnQNCg0KICAgVGhlIGtl eSB3b3JkcyAiTVVTVCIsICJNVVNUIE5PVCIsICJSRVFVSVJFRCIsICJTSEFMTCIsICJTSEFMTCBO T1QiLA0KICAgIlNIT1VMRCIsICJTSE9VTEQgTk9UIiwgIlJFQ09NTUVOREVEIiwgIk1BWSIsIGFu ZCAiT1BUSU9OQUwiIGluIHRoaXMNCiAgIGRvY3VtZW50IGFyZSB0byBiZSBpbnRlcnByZXRlZCBh cyBkZXNjcmliZWQgaW4gW1JGQzIxMTldLg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEyLCAyMDA1ICAgICAg ICAgICAgICAgICAgW1BhZ2UgNV0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVn b3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCjMuICBOZWdvdGlh dGlvbiBQcm90b2NvbA0KDQogICBXaGVuIHRoZSBlc3RhYmxpc2hlZCBtZWNoYW5pc20gY29udGV4 dCBwcm92aWRlcyBpbnRlZ3JpdHkgcHJvdGVjdGlvbiwNCiAgIHRoZSBtZWNoYW5pc20gbmVnb3Rp YXRpb24gY2FuIGJlIHByb3RlY3RlZC4gIFdoZW4gYWNxdWlyaW5nDQogICBuZWdvdGlhdGVkIHNl Y3VyaXR5IG1lY2hhbmlzbSB0b2tlbnMsIHBlci1tZXNzYWdlIGludGVncml0eSBzZXJ2aWNlcw0K ICAgYXJlIGFsd2F5cyByZXF1ZXN0ZWQgYnkgdGhlIFNQTkVHTyBtZWNoYW5pc20uDQoNCiAgIFdo ZW4gdGhlIGVzdGFibGlzaGVkIG1lY2hhbmlzbSBjb250ZXh0IHN1cHBvcnRzIHBlci1tZXNzYWdl IGludGVncml0eQ0KICAgc2VydmljZXMsIFNQTkVHTyBndWFyYW50ZWVzIHRoYXQgdGhlIHNlbGVj dGVkIG1lY2hhbmlzbSBpcyBtdXR1YWxseQ0KICAgcHJlZmVycmVkLg0KDQogICBUaGlzIHNlY3Rp b24gZGVzY3JpYmVzIHRoZSBuZWdvdGlhdGlvbiBwcm9jZXNzIG9mIHRoaXMgcHJvdG9jb2wuDQoN CjMuMSAgTmVnb3RpYXRpb24gRGVzY3JpcHRpb24NCg0KICAgVGhlIGZpcnN0IG5lZ290aWF0aW9u IHRva2VuIHNlbnQgYnkgdGhlIGluaXRpYXRvciBjb250YWlucyBhbiBvcmRlcmVkDQogICBsaXN0 IG9mIG1lY2hhbmlzbXMgKGluIGRlY3JlYXNpbmcgcHJlZmVyZW5jZSBvcmRlciwgZmF2b3JpdGUN CiAgIG1lY2hhbmlzbSBmaXJzdCksIGFuZCBvcHRpb25hbGx5IHRoZSBpbml0aWFsIG1lY2hhbmlz bSB0b2tlbiBmb3IgdGhlDQogICBwcmVmZXJyZWQgbWVjaGFuaXNtIG9mIHRoZSBpbml0aWF0b3Ig KGkuZS4sIHRoZSBmaXJzdCBpbiB0aGUgbGlzdCkuDQogICAoTm90ZSB0aGF0IHRoZSBsaXN0IE1V U1QgTk9UIGNvbnRhaW4gbWVjaGFuaXNtcyBmb3Igd2hpY2ggdGhlIGNsaWVudA0KICAgZG9lcyBu b3QgaGF2ZSBhcHByb3ByaWF0ZSBjcmVkZW50aWFscy4pDQoNCiAgIFRoZSB0YXJnZXQgdGhlbiBw cm9jZXNzZXMgdGhlIHRva2VuIGZyb20gdGhlIGluaXRpYXRvci4gIFRoaXMgd2lsbA0KICAgcmVz dWx0IGluIG9uZSBvZiBmb3VyIHBvc3NpYmxlIHN0YXRlcyAoYXMgZGVmaW5lZCBpbiBTZWN0aW9u IDQuMi4yKQ0KICAgYmVpbmcgcmV0dXJuZWQgaW4gdGhlIHJlcGx5IG1lc3NhZ2U6IGFjY2VwdF9j b21wbGV0ZWQsDQogICBhY2NlcHRfaW5jb21wbGV0ZSwgcmVqZWN0LCBvciByZXF1ZXN0X21pYy4g IEEgcmVqZWN0IHN0YXRlIHdpbGwNCiAgIHRlcm1pbmF0ZSB0aGUgbmVnb3RpYXRpb247ICBhbiBh Y2NlcHRfY29tcGxldGVkIHN0YXRlIGluZGljYXRlcyB0aGF0DQogICBub3Qgb25seSB3YXMgdGhl IGluaXRpYXRvci1zZWxlY3RlZCBtZWNoYW5pc20gYWNjZXB0YWJsZSB0byB0aGUNCiAgIHRhcmdl dCwgYnV0IGFsc28gdGhhdCB0aGUgb3B0aW1pc3RpYyBtZWNoYW5pc20gdG9rZW4gd2FzIHN1ZmZp Y2llbnQNCiAgIHRvIGNvbXBsZXRlIHRoZSBhdXRoZW50aWNhdGlvbjsgIGFuIGFjY2VwdF9pbmNv bXBsZXRlIHN0YXRlIGluZGljYXRlcw0KICAgdGhhdCBmdXJ0aGVyIG1lc3NhZ2UgZXhjaGFuZ2Ug aXMgbmVlZGVkIGJ1dCB0aGUgTUlDIHRva2VuIGV4Y2hhbmdlIGFzDQogICBkZXNjcmliZWQgaW4g U2VjdGlvbiA1IGlzIE9QVElPTkFMOyAgYSByZXF1ZXN0X21pYyBzdGF0ZSAodGhpcyBzdGF0ZQ0K ICAgY2FuIG9ubHkgYmUgcHJlc2VudCBpbiB0aGUgZmlyc3QgcmVwbHkgbWVzc2FnZSBmcm9tIHRo ZSB0YXJnZXQpDQogICBpbmRpY2F0ZXMgdGhlIE1JQyB0b2tlbiBleGNoYW5nZSBpcyBSRVFVSVJF RCBpZiBwZXItbWVzc2FnZSBpbnRlZ3JpdHkNCiAgIHNlcnZpY2VzIGFyZSBhdmFpbGFibGUuDQoN CiAgIFVubGVzcyB0aGUgcHJlZmVyZW5jZSBvcmRlciBpcyBzcGVjaWZpZWQgYnkgdGhlIGFwcGxp Y2F0aW9uIChzZWUNCiAgIEFwcGVuZGl4IEEpLCB0aGUgcG9saWN5IGJ5IHdoaWNoIHRoZSB0YXJn ZXQgY2hvb3NlcyBhIG1lY2hhbmlzbSBpcyBhbg0KICAgaW1wbGVtZW50YXRpb24tc3BlY2lmaWMg bG9jYWwgbWF0dGVyLiAgSW4gdGhlIGFic2VuY2Ugb2YgYW4NCiAgIGFwcGxpY2F0aW9uIHNwZWNp ZmllZCBwcmVmZXJlbmNlIG9yZGVyIG9yIG90aGVyIHBvbGljeSwgdGhlIHRhcmdldA0KICAgU0hB TEwgY2hvb3NlIHRoZSBmaXJzdCBtZWNoYW5pc20gaW4gdGhlIGluaXRpYXRvciBwcm9wb3NlZCBs aXN0IGZvcg0KICAgd2hpY2ggaXQgaGFzIHZhbGlkIGNyZWRlbnRpYWxzLg0KDQogICBJbiBjYXNl IG9mIGEgc3VjY2Vzc2Z1bCBuZWdvdGlhdGlvbiwgdGhlIHNlY3VyaXR5IG1lY2hhbmlzbSBpbiB0 aGUNCiAgIGZpcnN0IHJlcGx5IG1lc3NhZ2UgcmVwcmVzZW50cyB0aGUgdmFsdWUgc3VpdGFibGUg Zm9yIHRoZSB0YXJnZXQsDQogICBjaG9zZW4gZnJvbSB0aGUgbGlzdCBvZmZlcmVkIGJ5IHRoZSBp bml0aWF0b3IuDQoNCiAgIEluIGNhc2Ugb2YgYW4gdW5zdWNjZXNzZnVsIG5lZ290aWF0aW9uLCB0 aGUgcmVqZWN0IHN0YXRlIGlzIHJldHVybmVkDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAg ICAgRXhwaXJlcyBKdW5lIDEyLCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgNl0NCgwNCklu dGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAg RGVjZW1iZXIgMjAwNA0KDQoNCiAgIGFuZCBpdCBpcyBPUFRJT05BTCB0byBlbWl0IGEgY29udGV4 dCBsZXZlbCBuZWdvdGlhdGlvbiB0b2tlbi4NCg0KICAgT25jZSBhIG1lY2hhbmlzbSBoYXMgYmVl biBzZWxlY3RlZCwgY29udGV4dCBlc3RhYmxpc2htZW50IHRva2Vucw0KICAgc3BlY2lmaWMgdG8g dGhlIHNlbGVjdGVkIG1lY2hhbmlzbSBhcmUgY2FycmllZCB3aXRoaW4gdGhlIG5lZ290aWF0aW9u DQogICB0b2tlbnMuDQoNCiAgIExhc3RseSwgTUlDIHRva2VucyBtYXkgYmUgZXhjaGFuZ2VkIHRv IGVuc3VyZSB0aGUgYXV0aGVudGljaXR5IG9mIHRoZQ0KICAgbWVjaGFuaXNtIGxpc3QgcmVjZWl2 ZWQgYnkgdGhlIHRhcmdldC4NCg0KICAgVG8gYXZvaWQgY29uZmxpY3RzIHdpdGggdGhlIHVzZSBv ZiBNSUMgdG9rZW5zIGJ5IFNQTkVHTywNCiAgIHBhcnRpYWxseS1lc3RhYmxpc2hlZCBjb250ZXh0 cyBNVVNUIE5PVCBiZSB1c2VkIGZvciBwZXItbWVzc2FnZQ0KICAgY2FsbHMuICBUbyBndWFyYW50 ZWUgdGhpcywgdGhlIHByb3RfcmVhZHlfc3RhdGUgW1JGQzI3NDNdIE1VU1QgYmUgc2V0DQogICB0 byBmYWxzZSBvbiByZXR1cm4gZnJvbSBHU1NfSW5pdF9zZWNfY29udGV4dCgpIGFuZA0KICAgR1NT X0FjY2VwdF9zZWNfY29udGV4dCgpIGV2ZW4gaWYgdGhlIHVuZGVybHlpbmcgbWVjaGFuaXNtIHJl dHVybmVkDQogICB0cnVlLg0KDQozLjIgIE5lZ290aWF0aW9uIFByb2NlZHVyZQ0KDQogICBUaGUg YmFzaWMgZm9ybSBvZiB0aGUgcHJvY2VkdXJlIGFzc3VtZXMgdGhhdCBwZXItbWVzc2FnZSBpbnRl Z3JpdHkNCiAgIHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhlIGVzdGFibGlzaGVkIG1lY2hh bmlzbSBjb250ZXh0LCBhbmQgaXQNCiAgIGlzIHN1bW1hcml6ZWQgYXMgZm9sbG93czoNCg0KICAg KGEpIFRoZSBHU1MtQVBJIGluaXRpYXRvciBpbnZva2VzIEdTU19Jbml0X3NlY19jb250ZXh0KCkg YXMgbm9ybWFsLA0KICAgICAgYnV0IHJlcXVlc3RzIHRoYXQgU1BORUdPIGJlIHVzZWQuICBTUE5F R08gY2FuIGVpdGhlciBiZSBleHBsaWNpdHkNCiAgICAgIHJlcXVlc3RlZCBvciBhY2NlcHRlZCBh cyB0aGUgZGVmYXVsdCBtZWNoYW5pc20uDQoNCiAgIChiKSBUaGUgaW5pdGlhdG9yIEdTUy1BUEkg aW1wbGVtZW50YXRpb24gZW1pdHMgYSBuZWdvdGlhdGlvbiB0b2tlbg0KICAgICAgY29udGFpbmlu ZyBhIGxpc3Qgb2Ygb25lIG9yIG1vcmUgc2VjdXJpdHkgbWVjaGFuaXNtcyB0aGF0IGFyZQ0KICAg ICAgYXZhaWxhYmxlIGJhc2VkIG9uIHRoZSBjcmVkZW50aWFscyB1c2VkIGZvciB0aGlzIGNvbnRl eHQNCiAgICAgIGVzdGFibGlzaG1lbnQsIGFuZCBvcHRpb25hbGx5IHRoZSBpbml0aWFsIG1lY2hh bmlzbSB0b2tlbiBmb3IgdGhlDQogICAgICBmaXJzdCBtZWNoYW5pc20gaW4gdGhlIGxpc3QuDQoN CiAgIChjKSBUaGUgR1NTLUFQSSBpbml0aWF0b3IgYXBwbGljYXRpb24gc2VuZHMgdGhlIHRva2Vu IHRvIHRoZSB0YXJnZXQNCiAgICAgIGFwcGxpY2F0aW9uLiAgVGhlIEdTUy1BUEkgdGFyZ2V0IGFw cGxpY2F0aW9uIGRlcG9zaXRzIHRoZSB0b2tlbiBieQ0KICAgICAgaW52b2tpbmcgR1NTX0FjY2Vw dF9zZWNfY29udGV4dCgpLiAgVGhlIGFjY2VwdG9yIHdpbGwgZG8gb25lIG9mDQogICAgICB0aGUg Zm9sbG93aW5nOg0KDQoNCiAgICAgICAgIChJKSBJZiBub25lIG9mIHRoZSBwcm9wb3NlZCBtZWNo YW5pc21zIGFyZSBhY2NlcHRhYmxlLCB0aGUNCiAgICAgICAgICAgIG5lZ290aWF0aW9uIFNIQUxM IGJlIHRlcm1pbmF0ZWQuICBHU1NfQWNjZXB0X3NlY19jb250ZXh0DQogICAgICAgICAgICBpbmRp Y2F0ZXMgR1NTX1NfQkFEX01FQ0guICBUaGUgYWNjZXB0b3IgTUFZIG91dHB1dCBhDQogICAgICAg ICAgICBuZWdvdGlhdGlvbiB0b2tlbiBjb250YWluaW5nIGEgcmVqZWN0IHN0YXRlLg0KDQogICAg ICAgICAoSUkpIElmIGVpdGhlciB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSBp cyBub3QNCiAgICAgICAgICAgIGFjY2VwdGVkIGJ5IHRoZSB0YXJnZXQgb3IgdGhpcyBtZWNoYW5p c20gaXMgYWNjZXB0ZWQgYnV0IGl0DQogICAgICAgICAgICBpcyBub3QgdGhlIGFjY2VwdG9yJ3Mg bW9zdCBwcmVmZXJyZWQgbWVjaGFuaXNtIChpLmUuLCB0aGUNCiAgICAgICAgICAgIE1JQyB0b2tl biBleGNoYW5nZSBhcyBkZXNjcmliZWQgaW4gU2VjdGlvbiA1IGlzIHJlcXVpcmVkKSwNCiAgICAg ICAgICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfQ09OVElOVUVf TkVFREVELg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxMiwg MjAwNSAgICAgICAgICAgICAgICAgIFtQYWdlIDddDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBH U1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQog ICAgICAgICAgICBUaGUgYWNjZXB0b3IgTVVTVCBvdXRwdXQgYSBuZWdvdGlhdGlvbiB0b2tlbiBj b250YWluaW5nIGENCiAgICAgICAgICAgIHJlcXVlc3RfbWljIHN0YXRlLg0KDQogICAgICAgICAo SUlJKSBPdGhlcndpc2UgaWYgYXQgbGVhc3Qgb25lIGFkZGl0aW9uYWwgbmVnb3RpYXRpb24gdG9r ZW4NCiAgICAgICAgICAgIGZyb20gdGhlIGluaXRpYXRvciBpcyBuZWVkZWQgdG8gZXN0YWJsaXNo IHRoaXMgY29udGV4dCwNCiAgICAgICAgICAgIEdTU19BY2NlcHRfc2VjX2NvbmV4dCgpIGluZGlj YXRlcyBHU1NfU19DT05USU5VRV9ORUVERUQgYW5kDQogICAgICAgICAgICBvdXRwdXRzIGEgbmVn b3RpYXRpb24gdG9rZW4gY29udGFpbmluZyBhbiBhY2NlcHRfaW5jb21wbGV0ZQ0KICAgICAgICAg ICAgc3RhdGUuDQoNCiAgICAgICAgIChJVikgT3RoZXJ3aXNlIG5vIGFkZGl0aW9uYWwgbmVnb3Rp YXRpb24gdG9rZW4gZnJvbSB0aGUNCiAgICAgICAgICAgIGluaXRpYXRvciBpcyBuZWVkZWQgdG8g ZXN0YWJsaXNoIHRoaXMgY29udGV4dCwNCiAgICAgICAgICAgIEdTU19BY2NlcHRfc2VjX2NvbmV4 dCgpIGluZGljYXRlcyBHU1NfU19DT01QTEVURSBhbmQgb3V0cHV0cw0KICAgICAgICAgICAgYSBu ZWdvdGlhdGlvbiB0b2tlbiBjb250YWluaW5nIGFuIGFjY2VwdF9jb21wbGV0ZSBzdGF0ZS4NCg0K ICAgICAgSWYgdGhlIGluaXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5pc20gaXMgYWNjZXB0ZWQs IGFuZCBhbg0KICAgICAgb3B0aW1pc3RpYyBtZWNoYW5pc20gdG9rZW4gd2FzIGluY2x1ZGVkLCB0 aGlzIG1lY2hhbmlzbSB0b2tlbiBNVVNUDQogICAgICBiZSBkZXBvc2l0ZWQgdG8gdGhlIHNlbGVj dGVkIG1lY2hhbmlzbSBieSBpbnZva2luZw0KICAgICAgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgp IGFuZCBpZiBhIHJlc3BvbnNlIG1lY2hhbmlzbSB0b2tlbiBpcw0KICAgICAgZW1pdHRlZCwgaXQg TVVTVCBiZSBpbmNsdWRlZCBpbiB0aGUgcmVzcG9uc2UgbmVnb3RpYXRpb24gdG9rZW4uDQogICAg ICBPdGhlcndpc2UsIHRoZSB0YXJnZXQgd2lsbCBub3QgZW1pdCBhIHJlc3BvbnNlIG1lY2hhbmlz bSB0b2tlbiBpbg0KICAgICAgdGhlIGZpcnN0IHJlcGx5Lg0KDQogICAoZCkgVGhlIEdTUy1BUEkg dGFyZ2V0IGFwcGxpY2F0aW9uIHJldHVybnMgdGhlIG5lZ290aWF0aW9uIHRva2VuIHRvDQogICAg ICB0aGUgaW5pdGlhdG9yIGFwcGxpY2F0aW9uLiAgVGhlIEdTUy1BUEkgaW5pdGlhdG9yIGFwcGxp Y2F0aW9uDQogICAgICBkZXBvc2l0cyB0aGUgdG9rZW4gYnkgaW52b2tpbmcgR1NTX0luaXRfc2Vj X2NvbnRleHQoKS4gIFRoZQ0KICAgICAgc2VjdXJpdHkgY29udGV4dCBpbml0aWFsaXphdGlvbiBp cyB0aGVuIGNvbnRpbnVlZCBhY2NvcmRpbmcgdG8gdGhlDQogICAgICBzdGFuZGFyZCBHU1MtQVBJ IGNvbnZlbnRpb25zIGZvciB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtLCB3aGVyZSB0aGUNCiAgICAg IHRva2VucyBvZiB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtIGFyZSBlbmNhcHN1bGF0ZWQgdW50aWwg dGhlDQogICAgICBHU1NfU19DT01QTEVURSBpcyByZXR1cm5lZCBmb3IgYm90aCB0aGUgaW5pdGlh dG9yIGFuZCB0aGUgdGFyZ2V0DQogICAgICBieSB0aGUgc2VsZWN0ZWQgc2VjdXJpdHkgbWVjaGFu aXNtLg0KDQogICAoZSkgTUlDIHRva2VucyBhcmUgdGhlbiBlaXRoZXIgc2tpcHBlZCBvciBleGNo YW5nZWQgYWNjb3JkaW5nIHRvDQogICAgICBTZWN0aW9uIDUuDQoNCiAgIE5vdGUgdGhhdCB0aGUg Kl9yZXFfZmxhZyBpbnB1dCBwYXJhbWV0ZXJzIGZvciBjb250ZXh0IGVzdGFibGlzaG1lbnQNCiAg IGFyZSByZWxhdGl2ZSB0byB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtLCBhcyBhcmUgdGhlICpfc3Rh dGUgb3V0cHV0DQogICBwYXJhbWV0ZXJzLiAgaS5lLiwgdGhlc2UgcGFyYW1ldGVycyBhcmUgbm90 IGFwcGxpY2FibGUgdG8gdGhlDQogICBuZWdvdGlhdGlvbiBwcm9jZXNzIHBlciBzZS4NCg0KICAg T24gcmVjZWlwdCBvZiBhIG5lZ290aWF0aW9uIHRva2VuIG9uIHRoZSB0YXJnZXQgc2lkZSwgYSBH U1MtQVBJDQogICBpbXBsZW1lbnRhdGlvbiB0aGF0IGRvZXMgbm90IHN1cHBvcnQgbmVnb3RpYXRp b24gd291bGQgaW5kaWNhdGUgdGhlDQogICBHU1NfU19CQURfTUVDSCBzdGF0dXMgYXMgaWYgYSBw YXJ0aWN1bGFyIGJhc2ljIHNlY3VyaXR5IG1lY2hhbmlzbSBoYWQNCiAgIGJlZW4gcmVxdWVzdGVk IGFuZCB3YXMgbm90IHN1cHBvcnRlZC4NCg0KICAgV2hlbiBHU1NfQWNxdWlyZV9jcmVkIGlzIGlu dm9rZWQgd2l0aCB0aGlzIG5lZ290aWF0aW9uIG1lY2hhbmlzbSBpbg0KICAgdGhlIGRlc2lyZWRf bWVjaHMsIGFuIGltcGxlbWVudGF0aW9uLXNwZWNpZmljIGRlZmF1bHQgY3JlZGVudGlhbCBpcw0K ICAgdXNlZCB0byBjYXJyeSBvbiB0aGUgbmVnb3RpYXRpb24uICBBIHNldCBvZiBtZWNoYW5pc21z IGFzIHNwZWNpZmllZA0KICAgbG9jYWxseSBieSB0aGUgc3lzdGVtIGFkbWluaXN0cmF0b3IgaXMg dGhlbiBhdmFpbGFibGUgZm9yDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJl cyBKdW5lIDEyLCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgOF0NCgwNCkludGVybmV0LURy YWZ0ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIg MjAwNA0KDQoNCiAgIG5lZ290aWF0aW9uLiAgSWYgdGhlcmUgaXMgYSBkZXNpcmUgZm9yIHRoZSBj YWxsZXIgdG8gbWFrZSBpdHMgb3duDQogICBjaG9pY2UsIHRoZW4gYW4gYWRkaXRpb25hbCBBUEkg aGFzIHRvIGJlIHVzZWQgKHNlZSBBcHBlbmRpeCBBKS4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAx MiwgMjAwNSAgICAgICAgICAgICAgICAgIFtQYWdlIDldDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAg ICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0K DQo0LiAgVG9rZW4gRGVmaW5pdGlvbnMNCg0KICAgVGhlIHR5cGUgZGVmaW5pdGlvbnMgaW4gdGhp cyBzZWN0aW9uIGFzc3VtZSBhbiBBU04uMSBtb2R1bGUNCiAgIGRlZmluaXRpb24gb2YgdGhlIGZv bGxvd2luZyBmb3JtOg0KDQoNCiAgICAgIFNQTkVHT0FTTk9uZVNwZWMgew0KICAgICAgICAgIGlz bygxKSBpZGVudGlmaWVkLW9yZ2FuaXphdGlvbigzKSBkb2QoNikgaW50ZXJuZXQoMSkNCiAgICAg ICAgICBzZWN1cml0eSg1KSBtZWNoYW5pc20oNSkgc25lZ28gKDIpIG1vZHVsZXMoNCkgc3BlYzIo MikNCiAgICAgIH0gREVGSU5JVElPTlMgRVhQTElDSVQgVEFHUyA6Oj0gQkVHSU4NCg0KICAgICAg LS0gcmVzdCBvZiBkZWZpbml0aW9ucyBoZXJlDQoNCiAgICAgIEVORA0KDQoNCiAgIFRoaXMgc3Bl Y2lmaWVzIHRoYXQgdGhlIHRhZ2dpbmcgY29udGV4dCBmb3IgdGhlIG1vZHVsZSB3aWxsIGJlDQog ICBleHBsaWNpdCBhbmQgbm9uLWF1dG9tYXRpYy4NCg0KICAgVGhlIGVuY29kaW5nIG9mIFNQTkVH TyBwcm90b2NvbCBtZXNzYWdlcyBzaGFsbCBvYmV5IHRoZSBEaXN0aW5ndWlzaGVkDQogICBFbmNv ZGluZyBSdWxlcyAoREVSKSBvZiBBU04uMSBhcyBkZXNjcmliZWQgaW4gW1g2OTBdLg0KDQo0LjEg IE1lY2hhbmlzbSBUeXBlcw0KDQogICBJbiB0aGlzIG5lZ290aWF0aW9uIG1vZGVsLCBlYWNoIE9J RCByZXByZXNlbnRzIG9uZSBHU1MtQVBJIG1lY2hhbmlzbQ0KICAgb3Igb25lIHZhcmlhbnQgKHNl ZSBTZWN0aW9uIDYpIG9mIGl0IGFjY29yZGluZyB0byBbUkZDMjc0M10uDQoNCg0KICAgICAgIE1l Y2hUeXBlIDo6PSBPQkpFQ1QgSURFTlRJRklFUg0KICAgICAgICAgICAtLSBPSUQgcmVwcmVzZW50 cyBlYWNoIHNlY3VyaXR5IG1lY2hhbmlzbSBhcyBzdWdnZXN0ZWQgYnkNCiAgICAgICAgICAgLS0g W1JGQzI3NDNdDQoNCiAgICAgICBNZWNoVHlwZUxpc3QgOjo9IFNFUVVFTkNFIE9GIE1lY2hUeXBl DQoNCg0KNC4yICBOZWdvdGlhdGlvbiBUb2tlbnMNCg0KICAgVGhlIHN5bnRheCBvZiB0aGUgaW5p dGlhbCBuZWdvdGlhdGlvbiB0b2tlbnMgZm9sbG93cyB0aGUNCiAgIGluaXRpYWxDb250ZXh0VG9r ZW4gc3ludGF4IGRlZmluZWQgaW4gU2VjdGlvbiAzLjEgb2YgW1JGQzI3NDNdLiAgVGhlDQogICBT UE5FR08gcHNldWRvIG1lY2hhbmlzbSBpcyBpZGVudGlmaWVkIGJ5IHRoZSBPYmplY3QgSWRlbnRp Zmllcg0KICAgc3BlY2lmaWVkIGluIFNlY3Rpb24gMS4gIFN1YnNlcXVlbnQgdG9rZW5zIGFyZSBu b3QgZW5jYXBzdWxhdGVkIGluDQogICB0aGlzIEdTUy1BUEkgZ2VuZXJpYyB0b2tlbiBmcmFtaW5n Lg0KDQogICBUaGlzIHNlY3Rpb24gc3BlY2lmaWVzIHRoZSBzeW50YXggb2YgdGhlIGlubmVyIHRv a2VuIGZvciB0aGUgaW5pdGlhbA0KICAgbWVzc2FnZSBhbmQgdGhlIHN5bnRheCBvZiBzdWJzZXF1 ZW50IGNvbnRleHQgZXN0YWJsaXNobWVudCB0b2tlbnMuDQoNCiAgICAgICBOZWdvdGlhdGlvblRv a2VuIDo6PSBDSE9JQ0Ugew0KICAgICAgICAgICBuZWdUb2tlbkluaXQgICAgWzBdIE5lZ1Rva2Vu SW5pdCwNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTIsIDIw MDUgICAgICAgICAgICAgICAgIFtQYWdlIDEwXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NT LUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAg ICAgICAgICBuZWdUb2tlblJlc3AgICAgWzFdIG5lZ1Rva2VuUmVzcA0KICAgICAgIH0NCg0KDQoN CjQuMi4xICBuZWdUb2tlbkluaXQNCg0KICAgICAgIE5lZ1Rva2VuSW5pdCA6Oj0gU0VRVUVOQ0Ug ew0KICAgICAgICAgICBtZWNoVHlwZXMgICAgICAgWzBdIE1lY2hUeXBlTGlzdCwNCiAgICAgICAg ICAgcmVxRmxhZ3MgICAgICAgIFsxXSBDb250ZXh0RmxhZ3MgIE9QVElPTkFMLA0KICAgICAgICAg ICBtZWNoVG9rZW4gICAgICAgWzJdIE9DVEVUIFNUUklORyAgT1BUSU9OQUwsDQogICAgICAgICAg IG1lY2hMaXN0TUlDICAgICBbM10gT0NURVQgU1RSSU5HICBPUFRJT05BTCwNCiAgICAgICAgICAg Li4uDQogICAgICAgfQ0KICAgICAgIENvbnRleHRGbGFncyA6Oj0gQklUIFNUUklORyB7DQogICAg ICAgICAgIGRlbGVnRmxhZyAgICAgICAoMCksDQogICAgICAgICAgIG11dHVhbEZsYWcgICAgICAo MSksDQogICAgICAgICAgIHJlcGxheUZsYWcgICAgICAoMiksDQogICAgICAgICAgIHNlcXVlbmNl RmxhZyAgICAoMyksDQogICAgICAgICAgIGFub25GbGFnICAgICAgICAoNCksDQogICAgICAgICAg IGNvbmZGbGFnICAgICAgICAoNSksDQogICAgICAgICAgIGludGVnRmxhZyAgICAgICAoNikNCiAg ICAgICB9DQoNCiAgIFRoaXMgaXMgdGhlIHN5bnRheCBmb3IgdGhlIGlubmVyIHRva2VuIG9mIHRo ZSBpbml0aWFsIG5lZ290aWF0aW9uDQogICBtZXNzYWdlLg0KDQogICBtZWNoVHlwZXMNCg0KICAg ICAgICAgVGhpcyBmaWVsZCBjb250YWlucyBvbmUgb3IgbW9yZSBzZWN1cml0eSBtZWNoYW5pc21z IGF2YWlsYWJsZQ0KICAgICAgICAgZm9yIHRoZSBpbml0aWF0b3IgaW4gZGVjcmVhc2luZyBwcmVm ZXJlbmNlIG9yZGVyIChmYXZvcml0ZQ0KICAgICAgICAgY2hvaWNlIGZpcnN0KS4NCg0KICAgcmVx RmxhZ3MNCg0KICAgICAgICAgVGhpcyBmaWVsZCwgaWYgcHJlc2VudCwgY29udGFpbnMgdGhlIHNl cnZpY2Ugb3B0aW9ucyB0aGF0IGFyZQ0KICAgICAgICAgcmVxdWVzdGVkIHRvIGVzdGFibGlzaCB0 aGUgY29udGV4dC4gIFRoZSBjb250ZXh0IGZsYWdzIFNIT1VMRA0KICAgICAgICAgYmUgZmlsbGVk IGluIGZyb20gdGhlIHJlcV9mbGFncyBwYXJhbWV0ZXIgb2YNCiAgICAgICAgIEdTU19Jbml0X3Nl Y19jb250ZXh0KCkuICBUaGlzIGZpZWxkIFNIQUxMIE5PVCBoYXZlIGltcGFjdCBvbg0KICAgICAg ICAgdGhlIG5lZ290aWF0aW9uLg0KDQogICBtZWNoVG9rZW4NCg0KICAgICAgICAgVGhpcyBmaWVs ZCwgaWYgcHJlc2VudCwgY29udGFpbnMgdGhlIG9wdGltaXN0aWMgbWVjaGFuaXNtDQogICAgICAg ICB0b2tlbi4NCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1 bmUgMTIsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDExXQ0KDA0KSW50ZXJuZXQtRHJhZnQg ICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0 DQoNCg0KICAgbWVjaGxpc3RNSUMNCg0KICAgICAgICAgVGhpcyBmaWVsZCwgaWYgcHJlc2VudCwg Y29udGFpbnMgYSBNSUMgdG9rZW4gZm9yIHRoZSBtZWNoYW5pc20NCiAgICAgICAgIGxpc3QgaW4g dGhlIGluaXRpYWwgbmVnb3RpYXRpb24gbWVzc2FnZS4gIFRoaXMgTUlDIHRva2VuIGlzDQogICAg ICAgICBjb21wdXRlZCBhY2NvcmRpbmcgdG8gU2VjdGlvbiA1Lg0KDQoNCjQuMi4yICBuZWdUb2tl blJlc3ANCg0KICAgICAgIE5lZ1Rva2VuUmVzcCA6Oj0gU0VRVUVOQ0Ugew0KICAgICAgICAgICBu ZWdTdGF0ZSAgICAgICBbMF0gRU5VTUVSQVRFRCB7DQogICAgICAgICAgICAgICBhY2NlcHRfY29t cGxldGVkICAgICgwKSwNCiAgICAgICAgICAgICAgIGFjY2VwdF9pbmNvbXBsZXRlICAgKDEpLA0K ICAgICAgICAgICAgICAgcmVqZWN0ICAgICAgICAgICAgICAoMiksDQogICAgICAgICAgICAgICBy ZXF1ZXN0X21pYyAgICAgICAgICgzKQ0KICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgT1BUSU9OQUwsDQogICAgICAgICAgICAgLS0gUkVRVUlSRUQgaW4gdGhlIGZp cnN0IHJlcGx5IGZyb20gdGhlIHRhcmdldA0KICAgICAgICAgICBzdXBwb3J0ZWRNZWNoICAgWzFd IE1lY2hUeXBlICAgICAgT1BUSU9OQUwsDQogICAgICAgICAgICAgLS0gcHJlc2VudCBvbmx5IGlu IHRoZSBmaXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQNCiAgICAgICAgICAgcmVzcG9uc2VUb2tl biAgIFsyXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLA0KICAgICAgICAgICBtZWNoTGlzdE1JQyAg ICAgWzNdIE9DVEVUIFNUUklORyAgT1BUSU9OQUwsDQogICAgICAgICAgIC4uLg0KICAgICAgIH0N Cg0KICAgVGhpcyBpcyB0aGUgc3ludGF4IGZvciBhbGwgc3Vic2VxdWVudCBuZWdvdGlhdGlvbiBt ZXNzYWdlcy4NCg0KICAgbmVnU3RhdGUNCg0KICAgICAgICAgVGhpcyBmaWVsZCwgaWYgcHJlc2Vu dCwgY29udGFpbnMgdGhlIHN0YXRlIG9mIHRoZSBuZWdvdGlhdGlvbi4NCiAgICAgICAgIFRoaXMg Y2FuIGJlOg0KDQogICAgICAgICBhY2NlcHRfY29tcGxldGVkDQoNCiAgICAgICAgICAgIE5vIGZ1 cnRoZXIgbmVnb3RpYXRpb24gbWVzc2FnZSBmcm9tIHRoZSBwZWVyIGlzIGV4cGVjdGVkLA0KICAg ICAgICAgICAgYW5kIHRoZSBzZWN1cml0eSBjb250ZXh0IGlzIGVzdGFibGlzaGVkIGZvciB0aGUg c2VuZGVyLg0KDQogICAgICAgICBhY2NlcHRfaW5jb21wbGV0ZQ0KDQogICAgICAgICAgICBBdCBs ZWFzdCBvbmUgbW9yZSBuZWdvdGlhdGlvbiBtZXNzYWdlIGZyb20gdGhlIHBlZXIgaXMNCiAgICAg ICAgICAgIG5lZWRlZCB0byBlc3RhYmxpc2ggdGhlIHNlY3VyaXR5IGNvbnRleHQuDQoNCiAgICAg ICAgIHJlamVjdA0KDQogICAgICAgICAgICBUaGUgc2VuZGVyIHRlcm1pbmF0ZXMgdGhlIG5lZ290 aWF0aW9uLg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBK dW5lIDEyLCAyMDA1ICAgICAgICAgICAgICAgICBbUGFnZSAxMl0NCgwNCkludGVybmV0LURyYWZ0 ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAw NA0KDQoNCiAgICAgICAgIHJlcXVlc3RfbWljDQoNCiAgICAgICAgICAgIFRoZSBzZW5kZXIgaW5k aWNhdGVzIHRoYXQgdGhlIGV4Y2hhbmdlIG9mIE1JQyB0b2tlbnMsIGFzDQogICAgICAgICAgICBk ZXNjcmliZWQgaW4gU2VjdGlvbiA1LCB3aWxsIGJlIFJFUVVJUkVEIGlmIHBlci1tZXNzYWdlDQog ICAgICAgICAgICBpbnRlZ3JpdHkgc2VydmljZXMgYXJlIGF2YWlsYWJsZSBvbiB0aGUgbWVjaGFu aXNtIGNvbnRleHQgdG8NCiAgICAgICAgICAgIGJlIGVzdGFibGlzaGVkLiAgVGhpcyB2YWx1ZSBT SEFMTCBvbmx5IGJlIHByZXNlbnQgaW4gdGhlDQogICAgICAgICAgICBmaXJzdCByZXBseSBmcm9t IHRoZSB0YXJnZXQuDQoNCiAgICAgICAgIFRoaXMgZmllbGQgaXMgUkVRVUlSRUQgaW4gdGhlIGZp cnN0IHJlcGx5IGZyb20gdGhlIHRhcmdldCAoaWYNCiAgICAgICAgIG1pc3NpbmcsIEdTU19Jbml0 X3NlY19jb250ZXh0KCkgTVVTVCBpbmRpY2F0ZQ0KICAgICAgICAgR1NTX1NfREVGRUNUSVZFX1RP S0VOKSwgYW5kIGl0IGlzIE9QVElPTkFMIHRoZXJlYWZ0ZXIuDQoNCiAgIHN1cHBvcnRlZE1lY2gN Cg0KICAgICAgICAgVGhpcyBmaWVsZCBTSEFMTCBvbmx5IGJlIHByZXNlbnQgaW4gdGhlIGZpcnN0 IHJlcGx5IGZyb20gdGhlDQogICAgICAgICB0YXJnZXQuICBJdCBNVVNUIGJlIG9uZSBvZiB0aGUg bWVjaGFuaXNtKHMpIG9mZmVyZWQgYnkgdGhlDQogICAgICAgICBpbml0aWF0b3IuDQoNCiAgIFJl c3BvbnNlVG9rZW4NCg0KICAgICAgICAgVGhpcyBmaWVsZCwgaWYgcHJlc2VudCwgY29udGFpbnMg dG9rZW5zIHNwZWNpZmljIHRvIHRoZQ0KICAgICAgICAgbWVjaGFuaXNtIHNlbGVjdGVkLg0KDQog ICBtZWNobGlzdE1JQw0KDQogICAgICAgICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlu cyBhIE1JQyB0b2tlbiBmb3IgdGhlIG1lY2hhbmlzbQ0KICAgICAgICAgbGlzdCBpbiB0aGUgaW5p dGlhbCBuZWdvdGlhdGlvbiBtZXNzYWdlLiAgVGhpcyBNSUMgdG9rZW4gaXMNCiAgICAgICAgIGNv bXB1dGVkIGFjY29yZGluZyB0byBTZWN0aW9uIDUuDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVu ZSAxMiwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMTNdDQoMDQpJbnRlcm5ldC1EcmFmdCAg ICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQN Cg0KDQo1LiAgUHJvY2Vzc2luZyBvZiBtZWNoTGlzdE1JQw0KDQogICBJZiB0aGUgbWVjaGFuaXNt IHNlbGVjdGVkIGJ5IHRoZSBuZWdvdGlhdGlvbiBkb2VzIG5vdCBzdXBwb3J0DQogICBpbnRlZ3Jp dHkgcHJvdGVjdGlvbiwgdGhlbiBubyBtZWNobGlzdE1JQyB0b2tlbiBpcyB1c2VkLg0KDQogICBP dGhlcndpc2UgaWYgdGhlIGFjY2VwdGVkIG1lY2hhbmlzbSBpcyB0aGUgbW9zdCBwcmVmZXJyZWQg bWVjaGFuaXNtDQogICBvZiBib3RoIHRoZSBpbml0aWF0b3IgYW5kIHRoZSBhY2NlcHRvciwgdGhl biB0aGUgTUlDIHRva2VuIGV4Y2hhbmdlLA0KICAgYXMgZGVzY3JpYmVkIGxhdGVyIGluIHRoaXMg c2VjdGlvbiwgaXMgT1BUSU9OQUwuICBBIG1lY2hhbmlzbSBpcw0KICAgYWNjZXB0b3IncyBtb3N0 IHByZWZlcnJlZCBtZWNoYW5pc20gaWYgdGhlcmUgaXMgbm8gb3RoZXIgbWVjaGFuaXNtDQogICB3 aGljaCwgaGFkIGl0IGJlZW4gcHJlc2VudCBpbiB0aGUgbWVjaGFuaXNtIGxpc3QsIHRoZSBhY2Nl cHRvciB3b3VsZA0KICAgaGF2ZSBwcmVmZXJyZWQgb3ZlciB0aGUgYWNjZXB0ZWQgbWVjaGFuaXNt Lg0KDQogICBJbiBhbGwgb3RoZXIgY2FzZXMsIE1JQyB0b2tlbnMgTVVTVCBiZSBleGNoYW5nZWQg YWZ0ZXIgdGhlIG1lY2hhbmlzbQ0KICAgY29udGV4dCBpcyBmdWxseSBlc3RhYmxpc2hlZC4NCg0K ICAgYSkgVGhlIG1lY2hsaXN0TUlDIHRva2VuIChvciBzaW1wbHkgdGhlIE1JQyB0b2tlbikgaXMg Y29tcHV0ZWQgb3Zlcg0KICAgICAgdGhlIG1lY2hhbmlzbSBsaXN0IGluIHRoZSBpbml0aWFsIG5l Z290aWF0aW9uIG1lc3NhZ2UgYnkgaW52b2tpbmcNCiAgICAgIEdTU19HZXRNSUMoKSBhcyBmb2xs b3dzOiB0aGUgaW5wdXQgY29udGV4dF9oYW5kbGUgaXMgdGhlDQogICAgICBlc3RhYmxpc2hlZCBt ZWNoYW5pc20gY29udGV4dCwgdGhlIGlucHV0IHFvcF9yZXEgaXMgMCwgYW5kIHRoZQ0KICAgICAg aW5wdXQgbWVzc2FnZSBpcyB0aGUgREVSIGVuY29kaW5nIG9mIHRoZSB2YWx1ZSBvZiB0eXBlDQog ICAgICBNZWNoVHlwZUxpc3Qgd2hpY2ggaXMgY29udGFpbmVkIGluIHRoZSAibWVjaFR5cGVzIiBm aWVsZCBvZiB0aGUNCiAgICAgIE5lZ1Rva2VuSW5pdC4gIFRoZSBpbnB1dCBtZXNzYWdlIGlzIE5P VCB0aGUgREVSIGVuY29kaW5nIG9mIHRoZQ0KICAgICAgdHlwZSAiWzBdIE1lY2hUeXBlTGlzdCIu DQoNCiAgIGIpIElmIHRoZSBzZWxlY3RlZCBtZWNoYW5pc20gZXhjaGFuZ2VzIGFuIGV2ZW4gbnVt YmVyIG9mIG1lY2hhbmlzbQ0KICAgICAgdG9rZW5zIChpLmUuLCB0aGUgYWNjZXB0b3Igc2VuZHMg dGhlIGxhc3QgbWVjaGFuaXNtIHRva2VuKSwgdGhlDQogICAgICBhY2NlcHRvciBkb2VzIHRoZSBm b2xsb3dpbmcgd2hlbiBlbWl0dGluZyB0aGUgbmVnb3RpYXRpb24gbWVzc2FnZQ0KICAgICAgY29u dGFpbmluZyB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW46IGlmIHRoZSBNSUMgdG9rZW4gZXhjaGFu Z2UgaXMNCiAgICAgIG9wdGlvbmFsLCBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgZWl0aGVyIGlu ZGljYXRlcyBHU1NfU19DT01QTEVURQ0KICAgICAgYW5kIGRvZXMgbm90IGluY2x1ZGUgYSBtZWNo bGlzdE1JQyB0b2tlbiwgb3IgaW5kaWNhdGVzDQogICAgICBHU1NfU19DT05USU5VRV9ORUVERUQg YW5kIGluY2x1ZGVzIGEgbWVjaGxpc3RNSUMgdG9rZW4gYW5kIGFuDQogICAgICBhY2NlcHRfaW5j b21wbGV0ZSBzdGF0ZTsgaWYgdGhlIE1JQyB0b2tlbiBleGNoYW5nZSBpcyByZXF1aXJlZCwNCiAg ICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfQ09OVElOVUVfTkVF REVELCBhbmQNCiAgICAgIGluY2x1ZGVzIGEgbWVjaGxpc3RNSUMgdG9rZW4uICBBY2NlcHRvcnMg dGhhdCB3aXNoIHRvIGJlDQogICAgICBjb21wYXRpYmxlIHdpdGggbGVnYWN5IFdpbmRvd3MgU1BO RUdPIGltcGxlbWVudGF0aW9ucyBhcyBkZXNjcmliZWQNCiAgICAgIGluIEFwcGVuZGl4IEIgc2hv dWxkIG5vdCBnZW5lcmF0ZSBhIG1lY2hsaXN0TUlDIHRva2VuIHdoZW4gdGhlIE1JQw0KICAgICAg dG9rZW4gZXhjaGFuZ2UgaXMgbm90IHJlcXVpcmVkLiAgVGhlIGluaXRpYXRvciB0aGVuIHByb2Nl c3NlcyB0aGUNCiAgICAgIGxhc3QgbWVjaGFuaXNtIHRva2VuLCBhbmQgZG9lcyBvbmUgb2YgdGhl IGZvbGxvd2luZzoNCg0KICAgICAgKEkpIElmIGEgbWVjaGxpc3RNSUMgdG9rZW4gd2FzIGluY2x1 ZGVkLCBhbmQgaXMgY29ycmVjdGx5DQogICAgICAgICB2ZXJpZmllZCwgR1NTX0luaXRfc2VjX2Nv bnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfQ09NUExFVEUuICBUaGUNCiAgICAgICAgIG91dHB1dCBu ZWdvdGlhdGlvbiBtZXNzYWdlIGNvbnRhaW5zIGEgbWVjaGxpc3RNSUMgdG9rZW4sIGFuZCBhbg0K ICAgICAgICAgYWNjZXB0X2NvbXBsZXRlIHN0YXRlLiAgVGhlIGFjY2VwdG9yIE1VU1QgdGhlbiB2 ZXJpZnkgdGhpcw0KICAgICAgICAgbWVjaGxpc3RNSUMgdG9rZW4uDQoNCg0KDQoNCg0KDQoNClpo dSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTIsIDIwMDUgICAgICAgICAgICAg ICAgIFtQYWdlIDE0XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlv biBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAgICAgKElJKSBJZiBhIG1l Y2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCBidXQgaXMgaW5jb3JyZWN0LCB0aGUNCiAgICAg ICAgIG5lZ290aWF0aW9uIFNIQUxMIGJlIHRlcm1pbmF0ZWQuICBHU1NfSW5pdF9zZWNfY29udGV4 dCgpDQogICAgICAgICBpbmRpY2F0ZXMgR1NTX1NfREVGRUNUSVZFX1RPS0VOLg0KDQogICAgICAo SUlJKSBJZiBubyBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQsIGFuZCB0aGUgTUlDIHRv a2VuDQogICAgICAgICBleGNoYW5nZSBpcyBub3QgcmVxdWlyZWQsIEdTU19Jbml0X3NlY19jb250 ZXh0KCkgaW5kaWNhdGVzDQogICAgICAgICBHU1NfU19DT01QTEVURSB3aXRoIG5vIG91dHB1dCB0 b2tlbi4NCg0KICAgICAgKElWKSBJZiBubyBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQs IGJ1dCB0aGUgTUlDIHRva2VuDQogICAgICAgICBleGNoYW5nZSBpcyByZXF1aXJlZCwgdGhlIG5l Z290aWF0aW9uIFNIQUxMIGJlIHRlcm1pbmF0ZWQuDQogICAgICAgICBHU1NfQWNjZXB0X3NlY19j b250ZXh0KCkgaW5kaWNhdGVzIEdTU19TX0RFRkVDVElWRV9UT0tFTi4NCg0KICAgYykgSW4gdGhl IGNhc2UgdGhhdCB0aGUgY2hvc2VuIG1lY2hhbmlzbSBleGNoYW5nZXMgYW4gb2RkIG51bWJlciBv Zg0KICAgICAgbWVjaGFuaXNtIHRva2VucyAoaS5lLiwgdGhlIGluaXRpYXRvciBzZW5kcyB0aGUg bGFzdCBtZWNoYW5pc20NCiAgICAgIHRva2VuKSwgdGhlIGluaXRpYXRvciBkb2VzIHRoZSBmb2xs b3dpbmcgd2hlbiBlbWl0dGluZyB0aGUNCiAgICAgIG5lZ290aWF0aW9uIG1lc3NhZ2UgY29udGFp bmluZyB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW46IGlmIHRoZQ0KICAgICAgbmVnU3RhdGUgd2Fz IHJlcXVlc3RfbWljIGluIHRoZSBmaXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQsIGENCiAgICAg IG1lY2hsaXN0TUlDIHRva2VuIE1VU1QgYmUgaW5jbHVkZWQsIG90aGVyd2lzZSB0aGUgbWVjaGxp c3RNSUMNCiAgICAgIHRva2VuIGlzIE9QVElPTkFMLiAgSW4gdGhlIGNhc2UgdGhhdCB0aGUgb3B0 aW1pc3RpYyBtZWNoYW5pc20NCiAgICAgIHRva2VuIGlzIHRoZSBvbmx5IG1lY2hhbmlzbSB0b2tl biBmb3IgdGhlIGluaXRpYXRvcidzIHByZWZlcnJlZA0KICAgICAgbWVjaGFuaXNtLCB0aGUgbWVj aGxpc3RNSUMgdG9rZW4gaXMgT1BUSU9OQUwuICBXaGV0aGVyIG9yIG5vdCB0aGUNCiAgICAgIG1l Y2hsaXN0TUlDIHRva2VuIGlzIGluY2x1ZGVkLCBHU1NfSW5pdF9zZWNfY29udGV4dCgpIGluZGlj YXRlcw0KICAgICAgR1NTX1NfQ09OVElOVUVfTkVFREVELiAgSW5pdGlhdG9ycyB0aGF0IHdpc2gg dG8gYmUgY29tcGF0aWJsZSB3aXRoDQogICAgICBsZWdhY3kgV2luZG93cyBTUE5FR08gaW1wbGVt ZW50YXRpb25zIGFzIGRlc2NyaWJlZCBpbiBBcHBlbmRpeCBCDQogICAgICBzaG91bGQgbm90IGdl bmVyYXRlIGEgbWVjaGxpc3RNSUMgdG9rZW4gd2hlbiB0aGUgTUlDIHRva2VuDQogICAgICBleGNo YW5nZSBpcyBub3QgcmVxdWlyZWQuICBUaGUgYWNjZXB0b3IgdGhlbiBwcm9jZXNzZXMgdGhlIGxh c3QNCiAgICAgIG1lY2hhbmlzbSB0b2tlbiBhbmQgZG9lcyBvbmUgb2YgdGhlIGZvbGxvd2luZzoN Cg0KICAgICAgKEkpIElmIGEgbWVjaGxpc3RNSUMgdG9rZW4gd2FzIGluY2x1ZGVkIGFuZCBpcyBj b3JyZWN0bHkgdmVyaWZpZWQsDQogICAgICAgICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgaW5k aWNhdGVzIEdTU19TX0NPTVBMRVRFLiAgVGhlIG91dHB1dA0KICAgICAgICAgbmVnb3RpYXRpb24g bWVzc2FnZSBjb250YWlucyBhIG1lY2hsaXN0TUlDIHRva2VuIGFuZCBhbg0KICAgICAgICAgYWNj ZXB0X2NvbXBsZXRlIHN0YXRlLiAgVGhlIGluaXRpYXRvciBNVVNUIHRoZW4gdmVyaWZ5IHRoaXMN CiAgICAgICAgIG1lY2hsaXN0TUlDIHRva2VuLg0KDQogICAgICAoSUkpIElmIGEgbWVjaGxpc3RN SUMgdG9rZW4gd2FzIGluY2x1ZGVkIGJ1dCBpcyBpbmNvcnJlY3QsIHRoZQ0KICAgICAgICAgbmVn b3RpYXRpb24gU0hBTEwgYmUgdGVybWluYXRlZC4gIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKQ0K ICAgICAgICAgaW5kaWNhdGVzIEdTU19TX0RFRkVDVElWRV9UT0tFTi4NCg0KICAgICAgKElJSSkg SWYgbm8gbWVjaGxpc3RNSUMgdG9rZW4gd2FzIGluY2x1ZGVkIGJ1dCB0aGUgbWVjaGxpc3RNSUMN CiAgICAgICAgIHRva2VuIGV4Y2hhbmdlIGlzIG5vdCByZXF1aXJlZCwgR1NTX0FjY2VwdF9zZWNf Y29udGV4dCgpDQogICAgICAgICBpbmRpY2F0ZXMgR1NTX1NfQ09NUExFVEUuICBUaGUgb3V0cHV0 IG5lZ290aWF0aW9uIG1lc3NhZ2UNCiAgICAgICAgIGNvbnRhaW5zIGFuIGFjY2VwdF9jb21wbGV0 ZSBzdGF0ZS4NCg0KICAgICAgKElWKSBJbiB0aGUgY2FzZSB0aGF0IHRoZSBvcHRpbWlzdGljIG1l Y2hhbmlzbSB0b2tlbiBpcyBhbHNvIHRoZQ0KICAgICAgICAgbGFzdCBtZWNoYW5pc20gdG9rZW4g KHdoZW4gdGhlIGluaXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5pc20NCiAgICAgICAgIGlzIGFj Y2VwdGVkIGJ5IHRoZSB0YXJnZXQpIGFuZCB0aGUgdGFyZ2V0IHNlbmRzIGEgcmVxdWVzdF9taWMN CiAgICAgICAgIHN0YXRlIGJ1dCB0aGUgaW5pdGlhdG9yIGRpZCBub3Qgc2VuZCBhIG1lY2hsaXN0 TUlDIHRva2VuLCB0aGUNCiAgICAgICAgIHRhcmdldCB0aGVuIE1VU1QgaW5jbHVkZSBhIG1lY2hs aXN0TUlDIHRva2VuIGluIHRoYXQgZmlyc3QNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAg ICBFeHBpcmVzIEp1bmUgMTIsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDE1XQ0KDA0KSW50 ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBE ZWNlbWJlciAyMDA0DQoNCg0KICAgICAgICAgcmVwbHkuICBHU1NfQWNjZXB0X3NlY19jb250ZXh0 KCkgaW5kaWNhdGVzDQogICAgICAgICBHU1NfU19DT05USU5VRV9ORUVERUQuICBUaGUgaW5pdGlh dG9yIE1VU1QgdmVyaWZ5IHRoZSByZWNlaXZlZA0KICAgICAgICAgbWVjaGxpc3RNSUMgdG9rZW4g YW5kIGdlbmVyYXRlIGEgbWVjaGxpc3RNSUMgdG9rZW4gdG8gc2VuZCBiYWNrDQogICAgICAgICB0 byB0aGUgdGFyZ2V0LiAgVGhlIHRhcmdldCBTSEFMTCBpbiB0dXJuIHZlcmlmeSB0aGUgcmV0dXJu ZWQNCiAgICAgICAgIG1lY2hsaXN0TUlDIHRva2VuIGFuZCBjb21wbGV0ZSB0aGUgbmVnb3RpYXRp b24uDQoNCiAgICAgIChWKSBJZiBubyBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQgYW5k IHRoZSBhY2NlcHRvciBzZW50IGENCiAgICAgICAgIHJlcXVlc3RfbWljIHN0YXRlIGluIHRoZSBm aXJzdCByZXBseSBtZXNzYWdlICh0aGUgZXhjaGFuZ2Ugb2YNCiAgICAgICAgIE1JQyB0b2tlbnMg aXMgcmVxdWlyZWQpLCB0aGUgbmVnb3RpYXRpb24gU0hBTEwgYmUgdGVybWluYXRlZC4NCiAgICAg ICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfREVGRUNUSVZFX1RP S0VOLg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBF eHBpcmVzIEp1bmUgMTIsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDE2XQ0KDA0KSW50ZXJu ZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNl bWJlciAyMDA0DQoNCg0KNi4gIEV4dGVuc2liaWxpdHkNCg0KICAgVHdvIG1lY2hhbmlzbXMgYXJl IHByb3ZpZGVkIGZvciBleHRlbnNpYmlsaXR5LiAgRmlyc3QsIHRoZSBBU04uMQ0KICAgc3RydWN0 dXJlcyBpbiB0aGlzIHNwZWNpZmljYXRpb24gTUFZIGJlIGV4cGFuZGVkIGJ5IElFVEYgc3RhbmRh cmRzDQogICBhY3Rpb24uICBJbXBsZW1lbnRhdGlvbnMgcmVjZWl2aW5nIHVua25vd24gZmllbGRz IE1VU1QgaWdub3JlIHRoZXNlDQogICBmaWVsZHMuDQoNCiAgIFNlY29uZGx5LCBPSURzIGNvcnJl c3BvbmRpbmcgdG8gYSBkZXNpcmVkIG1lY2hhbmlzbSBhdHRyaWJ1dGUgKGkuZS4sDQogICBtZWNo YW5pc20gdmFyaWFudHMpIG1heSBiZSBpbmNsdWRlZCBpbiB0aGUgc2V0IG9mIHByZWZlcnJlZA0K ICAgbWVjaGFuaXNtcyBieSBhbiBpbml0aWF0b3IuICBUaGUgYWNjZXB0b3IgY2FuIGNob29zZSB0 byBob25vciB0aGlzDQogICByZXF1ZXN0IGJ5IHByZWZlcnJpbmcgbWVjaGFuaXNtcyB0aGF0IGhh dmUgdGhlIGluY2x1ZGVkIGF0dHJpYnV0ZXMuDQogICBGdXR1cmUgd29yayB3aXRoaW4gdGhlIEtp dHRlbiB3b3JraW5nIGdyb3VwIGlzIGV4cGVjdGVkIHRvDQogICBzdGFuZGFyZGl6ZSBjb21tb24g YXR0cmlidXRlcyB0aGF0IFNQTkVHTyBtZWNoYW5pc21zIG1heSB3aXNoIHRvDQogICBzdXBwb3J0 LiAgQXQgdGhpcyB0aW1lIGl0IGlzIHN1ZmZpY2llbnQgdG8gc2F5IHRoYXQgaW5pdGlhdG9ycyBN QVkNCiAgIGluY2x1ZGUgT0lEcyB0aGF0IGRvIG5vdCBjb3JyZXNwb25kIHRvIG1lY2hhbmlzbXMg YnV0IGluc3RlYWQNCiAgIGNvcnJlc3BvbmQgdG8gZGVzaXJlZCBtZWNoYW5pc20gYXR0cmlidXRl cyBpbiB0aGVpciByZXF1ZXN0cy4gIFN1Y2gNCiAgIE9JRHMgTUFZIGluZmx1ZW5jZSB0aGUgYWNj ZXB0b3IncyBjaG9pY2Ugb2YgbWVjaGFuaXNtLiAgQXMgZGlzY3Vzc2VkDQogICBpbiBTZWN0aW9u IDUsIGlmIHRoZXJlIGFyZSBtZWNoYW5pc21zIHRoYXQgaWYgcHJlc2VudCBpbiB0aGUNCiAgIGlu aXRpYXRvcidzIGxpc3Qgb2YgbWVjaGFuaXNtcyBtaWdodCBiZSBwcmVmZXJyZWQgYnkgdGhlIGFj Y2VwdG9yIHRvDQogICB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSwgdGhlIGFj Y2VwdG9yIE1VU1QgZGVtYW5kIHRoZSBNSUMNCiAgIHRva2VuIGV4Y2hhbmdlLiAgQXMgYSBjb25z ZXF1ZW5jZSwgYWNjZXB0b3JzIE1VU1QgZGVtYW5kIHRoZSBNSUMNCiAgIHRva2VuIGV4Y2hhbmdl IGlmIHRoZXkgc3VwcG9ydCBuZWdvdGlhdGlvbiBvZiBhdHRyaWJ1dGVzIG5vdA0KICAgYXZhaWxh YmxlIGluIHRoZSBpbml0aWF0b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNtIHJlZ2FyZGxlc3Mgb2YN CiAgIHdoZXRoZXIgdGhlIGluaXRpYXRvciBhY3R1YWxseSByZXF1ZXN0ZWQgdGhlc2UgYXR0cmli dXRlcy4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTIsIDIwMDUgICAgICAg ICAgICAgICAgIFtQYWdlIDE3XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdv dGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KNy4gIFNlY3VyaXR5 IENvbnNpZGVyYXRpb25zDQoNCiAgIEluIG9yZGVyIHRvIHByb2R1Y2UgdGhlIE1JQyB0b2tlbiBm b3IgdGhlIG1lY2hhbmlzbSBsaXN0LCB0aGUNCiAgIG1lY2hhbmlzbSBtdXN0IHByb3ZpZGUgaW50 ZWdyaXR5IHByb3RlY3Rpb24uICBXaGVuIHRoZSBzZWxlY3RlZA0KICAgbWVjaGFuaXNtIGRvZXMg bm90IHN1cHBvcnQgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHRoZSBuZWdvdGlhdGlvbiBpcw0KICAg dnVsbmVyYWJsZTogYW4gYWN0aXZlIGF0dGFja2VyIGNhbiBmb3JjZSBpdCB0byB1c2UgYSBzZWN1 cml0eQ0KICAgbWVjaGFuaXNtIHRoYXQgaXMgbm90IG11dHVhbGx5IHByZWZlcnJlZCBidXQgaXMg YWNjZXB0YWJsZSB0byB0aGUNCiAgIHRhcmdldC4NCg0KICAgVGhpcyBwcm90b2NvbCBwcm92aWRl cyB0aGUgZm9sbG93aW5nIGd1YXJhbnRlZXMgd2hlbiBwZXItbWVzc2FnZQ0KICAgaW50ZWdyaXR5 IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhlIGVzdGFibGlzaGVkIG1lY2hhbmlzbSBjb250 ZXh0DQogICBhbmQgdGhlIG1lY2hhbmlzbSBsaXN0IHdhcyBhbHRlcmVkIGJ5IGFuIGFkdmVyc2Fy eSBzdWNoIHRoYXQgYQ0KICAgbWVjaGFuaXNtIHdoaWNoIGlzIG5vdCBtdXR1YWxseSBwcmVmZXJy ZWQgY291bGQgYmUgc2VsZWN0ZWQ6DQoNCiAgIGEpIElmIHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tl biBpcyBzZW50IGJ5IHRoZSBpbml0aWF0b3IsIGJvdGggcGVlcnMNCiAgICAgIHNoYWxsIGZhaWw7 DQogICBiKSBJZiB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW4gaXMgc2VudCBieSB0aGUgYWNjZXB0 b3IsIHRoZSBhY2NlcHRvcg0KICAgICAgc2hhbGwgbm90IGNvbXBsZXRlIGFuZCB0aGUgaW5pdGlh dG9yIGF0IHdvcnN0IHNoYWxsIGNvbXBsZXRlIHdpdGgNCiAgICAgIGl0cyBwcmVmZXJyZWQgbWVj aGFuaXNtIGJlaW5nIHNlbGVjdGVkLg0KDQogICBUaGUgbmVnb3RpYXRpb24gbWF5IG5vdCBiZSB0 ZXJtaW5hdGVkIGlmIGFuIGFsdGVyYXRpb24gd2FzIG1hZGUgYnV0DQogICBpdCBoYWQgbm8gbWF0 ZXJpYWwgaW1wYWN0Lg0KDQogICBUaGUgcHJvdGVjdGlvbiBvZiB0aGUgbmVnb3RpYXRpb24gZGVw ZW5kcyBvbiB0aGUgc3RyZW5ndGggb2YgdGhlDQogICBpbnRlZ3JpdHkgcHJvdGVjdGlvbi4gIElu IHBhcnRpY3VsYXIsIHRoZSBzdHJlbmd0aCBvZiBTUE5FR08gaXMgbm8NCiAgIHN0cm9uZ2VyIHRo YW4gdGhlIGludGVncml0eSBwcm90ZWN0aW9uIG9mIHRoZSB3ZWFrZXN0IG1lY2hhbmlzbQ0KICAg YWNjZXB0YWJsZSB0byBHU1MtQVBJIHBlZXJzLg0KDQogICBJbiBhbGwgY2FzZXMsIHRoZSBjb21t dW5pY2F0aW5nIHBlZXJzIGFyZSBleHBvc2VkIHRvIHRoZSBkZW5pYWwgb2YNCiAgIHNlcnZpY2Ug dGhyZWF0Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBl dCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxMiwgMjAwNSAgICAgICAgICAgICAgICAg W1BhZ2UgMThdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1l Y2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQo4LiAgSUFOQSBDb25zaWRlcmF0aW9u cw0KDQogICBUaGlzIGRvY3VtZW50IGhhcyBubyBhY3Rpb25zIGZvciBJQU5BLg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4 cGlyZXMgSnVuZSAxMiwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMTldDQoMDQpJbnRlcm5l dC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2Vt YmVyIDIwMDQNCg0KDQo5LiAgQWNrbm93bGVkZ21lbnRzDQoNCiAgIFRoZSBhdXRob3JzIHdpc2gg dG8gdGhhbmsgU2FtIEhhcnRtYW4sIE5pY29sYXMgV2lsbGlhbXMsIEtlbiBSYWVidXJuLA0KICAg SmVmZiBBbHRtYW4sIFRvbSBZdSwgQ3Jpc3RpYW4gSWxhYyBhbmQgTWFydGluIFJleCBmb3IgdGhl aXIgY29tbWVudHMNCiAgIGFuZCBzdWdnZXN0aW9ucyBkdXJpbmcgZGV2ZWxvcG1lbnQgb2YgdGhp cyBkb2N1bWVudC4NCg0KICAgTHVrZSBIb3dhcmQgcHJvdmlkZWQgYSBwcm90b3R5cGUgb2YgdGhp cyBwcm90b2NvbCBpbiBIZWltZGFsIGFuZA0KICAgcmVzb2x2ZWQgc2V2ZXJhbCBpc3N1ZXMgaW4g dGhlIGluaXRpYWwgZHJhZnQuDQoNCiAgIEVyaWMgQmFpemUgYW5kIERlbmlzIFBpbmthcyB3cm90 ZSB0aGUgb3JpZ2luYWwgU1BORUdPIHNwZWNpZmljYXRpb24NCiAgIFtSRkMyNDc4XSBvZiB3aGlj aCBzb21lIG9mIHRoZSB0ZXh0IGhhcyBiZWVuIHJldGFpbmVkIGluIHRoaXMNCiAgIGRvY3VtZW50 Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMg SnVuZSAxMiwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMjBdDQoMDQpJbnRlcm5ldC1EcmFm dCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIw MDQNCg0KDQoxMC4gIFJlZmVyZW5jZXMNCg0KMTAuMSAgTm9ybWF0aXZlIFJlZmVyZW5jZXMNCg0K ICAgW1JGQzIxMTldICBCcmFkbmVyLCBTLiwgIktleSB3b3JkcyBmb3IgdXNlIGluIFJGQ3MgdG8g SW5kaWNhdGUNCiAgICAgICAgICAgICAgUmVxdWlyZW1lbnQgTGV2ZWxzIiwgQkNQIDE0LCBSRkMg MjExOSwgTWFyY2ggMTk5Ny4NCg0KICAgW1JGQzI3NDNdICBMaW5uLCBKLiwgIkdlbmVyaWMgU2Vj dXJpdHkgU2VydmljZSBBcHBsaWNhdGlvbiBQcm9ncmFtDQogICAgICAgICAgICAgIEludGVyZmFj ZSBWZXJzaW9uIDIsIFVwZGF0ZSAxIiwgUkZDIDI3NDMsIEphbnVhcnkgMjAwMC4NCg0KICAgW1g2 OTBdICAgICBBU04uMSBlbmNvZGluZyBydWxlczogU3BlY2lmaWNhdGlvbiBvZiBCYXNpYyBFbmNv ZGluZyANCiAgICAgICAgICAgICAgUnVsZXMgKEJFUiksIENhbm9uaWNhbCBFbmNvZGluZyBSdWxl cyAoQ0VSKSBhbmQgDQogICAgICAgICAgICAgIERpc3Rpbmd1aXNoZWQgRW5jb2RpbmcgUnVsZXMg KERFUiksIElUVS1UIFJlY29tbWVuZGF0aW9uIA0KICAgICAgICAgICAgICBYLjY5MCAoMTk5Nykg fCBJU08vSUVDIEludGVybmF0aW9uYWwgU3RhbmRhcmQgODgyNS0xOjE5OTguDQoNCjEwLjIgIElu Zm9ybWF0aXZlIFJlZmVyZW5jZXMNCg0KICAgW1JGQzI0NzhdICBCYWl6ZSwgRS4gYW5kIEQuIFBp bmthcywgIlRoZSBTaW1wbGUgYW5kIFByb3RlY3RlZCBHU1MtQVBJDQogICAgICAgICAgICAgIE5l Z290aWF0aW9uIE1lY2hhbmlzbSIsIFJGQyAyNDc4LCBEZWNlbWJlciAxOTk4Lg0KDQoNCkF1dGhv cnMnIEFkZHJlc3Nlcw0KDQogICBMYXJyeSBaaHUNCiAgIE1pY3Jvc29mdCBDb3Jwb3JhdGlvbg0K ICAgT25lIE1pY3Jvc29mdCBXYXkNCiAgIFJlZG1vbmQsIFdBICA5ODA1Mg0KICAgVVMNCg0KICAg RU1haWw6IGx6aHVAbWljcm9zb2Z0LmNvbQ0KDQoNCiAgIFBhdWwgTGVhY2gNCiAgIE1pY3Jvc29m dCBDb3Jwb3JhdGlvbg0KICAgT25lIE1pY3Jvc29mdCBXYXkNCiAgIFJlZG1vbmQsIFdBICA5ODA1 Mg0KICAgVVMNCg0KICAgRU1haWw6IHBhdWxsZUBtaWNyb3NvZnQuY29tDQoNCg0KICAgS2FydGhp ayBKYWdhbmF0aGFuDQogICBNaWNyb3NvZnQgQ29ycG9yYXRpb24NCiAgIE9uZSBNaWNyb3NvZnQg V2F5DQogICBSZWRtb25kLCBXQSAgOTgwNTINCiAgIFVTDQoNCiAgIEVNYWlsOiBrYXJ0aGlrakBt aWNyb3NvZnQuY29tDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1 bmUgMTIsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDIxXQ0KDA0KSW50ZXJuZXQtRHJhZnQg ICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0 DQoNCg0KICAgV3lsbHlzIEluZ2Vyc29sbA0KICAgU3VuIE1pY3Jvc3lzdGVtcw0KICAgMTc3NSBX aWVobGUgQXZlbnVlLCAybmQgRmxvb3INCiAgIFJlc3RvbiwgVkEgIDIwMTkwDQogICBVUw0KDQog ICBFTWFpbDogd3lsbHlzLmluZ2Vyc29sbEBzdW4uY29tDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxMiwgMjAwNSAg ICAgICAgICAgICAgICAgW1BhZ2UgMjJdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJ IE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQpBcHBlbmRp eCBBLiAgR1NTLUFQSSBOZWdvdGlhdGlvbiBTdXBwb3J0IEFQSQ0KDQogICBJbiBvcmRlciB0byBw cm92aWRlIHRvIGEgR1NTLUFQSSBjYWxsZXIgKGVpdGhlciB0aGUgaW5pdGlhdG9yIG9yIHRoZQ0K ICAgdGFyZ2V0IG9yIGJvdGgpIHRoZSBhYmlsaXR5IHRvIGNob29zZSBhbW9uZyB0aGUgc2V0IG9m IHN1cHBvcnRlZA0KICAgbWVjaGFuaXNtcyBhIHJlZHVjZWQgc2V0IG9mIG1lY2hhbmlzbXMgZm9y IG5lZ290aWF0aW9uLCB0d28NCiAgIGFkZGl0aW9uYWwgQVBJcyBhcmUgZGVmaW5lZDoNCg0KICAg byAgR1NTX0dldF9uZWdfbWVjaHMoKSBpbmRpY2F0ZXMgdGhlIHNldCBvZiBzZWN1cml0eSBtZWNo YW5pc21zDQogICAgICBhdmFpbGFibGUgb24gdGhlIGxvY2FsIHN5c3RlbSB0byB0aGUgY2FsbGVy IGZvciBuZWdvdGlhdGlvbiwgZm9yDQogICAgICB3aGljaCBhcHByb3ByaWF0ZSBjcmVkZW50aWFs cyBhcmUgYXZhaWxhYmxlLg0KICAgbyAgR1NTX1NldF9uZWdfbWVjaHMoKSBzcGVjaWZpZXMgdGhl IHNldCBvZiBzZWN1cml0eSBtZWNoYW5pc21zIHRvIGJlDQogICAgICB1c2VkIG9uIHRoZSBsb2Nh bCBzeXN0ZW0gYnkgdGhlIGNhbGxlciBmb3IgbmVnb3RpYXRpb24sIGZvciB0aGUNCiAgICAgIGdp dmVuIGNyZWRlbnRpYWxzLg0KDQpBLjEgIEdTU19TZXRfbmVnX21lY2hzIGNhbGwNCg0KICAgSW5w dXRzOg0KDQogICBvICBjcmVkX2hhbmRsZSBDUkVERU5USUFMIEhBTkRMRSwgLS0gTlVMTCBzcGVj aWZpZXMgZGVmYXVsdA0KICAgICAgLS0gY3JlZGVudGlhbHMNCiAgIG8gIG1lY2hfc2V0IFNFVCBP RiBPQkpFQ1QgSURFTlRJRklFUg0KDQogICBPdXRwdXRzOg0KDQogICBvICBtYWpvcl9zdGF0dXMg SU5URUdFUiwNCiAgIG8gIG1pbm9yX3N0YXR1cyBJTlRFR0VSDQoNCiAgIFJldHVybiBtYWpvcl9z dGF0dXMgY29kZXM6DQoNCiAgIG8gIEdTU19TX0NPTVBMRVRFIGluZGljYXRlcyB0aGF0IHRoZSBz ZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcw0KICAgICAgYXZhaWxhYmxlIGZvciBuZWdvdGlhdGlv biBoYXMgYmVlbiBzZXQgdG8gbWVjaF9zZXQuDQogICBvICBHU1NfU19GQUlMVVJFIGluZGljYXRl cyB0aGF0IHRoZSByZXF1ZXN0ZWQgb3BlcmF0aW9uIGNvdWxkIG5vdCBiZQ0KICAgICAgcGVyZm9y bWVkIGZvciByZWFzb25zIHVuc3BlY2lmaWVkIGF0IHRoZSBHU1MtQVBJIGxldmVsLg0KDQogICBB bGxvd3MgY2FsbGVycyB0byBzcGVjaWZ5IHRoZSBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcyB0 aGF0IG1heSBiZQ0KICAgbmVnb3RpYXRlZCB3aXRoIHRoZSBjcmVkZW50aWFsIGlkZW50aWZpZWQg YnkgY3JlZF9oYW5kbGUuICBUaGlzIGNhbGwNCiAgIGlzIGludGVuZGVkIGZvciBzdXBwb3J0IG9m IHNwZWNpYWxpemVkIGNhbGxlcnMgd2hvIG5lZWQgdG8gcmVzdHJpY3QNCiAgIHRoZSBzZXQgb2Yg bmVnb3RpYWJsZSBzZWN1cml0eSBtZWNoYW5pc21zIGZyb20gdGhlIHNldCBvZiBhbGwNCiAgIHNl Y3VyaXR5IG1lY2hhbmlzbXMgYXZhaWxhYmxlIHRvIHRoZSBjYWxsZXIgKGJhc2VkIG9uIGF2YWls YWJsZQ0KICAgY3JlZGVudGlhbHMpLiAgTm90ZSB0aGF0IGlmIG1vcmUgdGhhbiBvbmUgbWVjaGFu aXNtIGlzIHNwZWNpZmllZCBpbg0KICAgbWVjaF9zZXQsIHRoZSBvcmRlciBpbiB3aGljaCB0aG9z ZSBtZWNoYW5pc21zIGFyZSBzcGVjaWZpZWQgaW1wbGllcyBhDQogICByZWxhdGl2ZSBwcmVmZXJl bmNlLg0KDQpBLjIgIEdTU19HZXRfbmVnX21lY2hzIGNhbGwNCg0KICAgSW5wdXQ6DQoNCg0KDQoN Cg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxMiwgMjAwNSAgICAgICAg ICAgICAgICAgW1BhZ2UgMjNdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290 aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICBvICBjcmVkX2hh bmRsZSBDUkVERU5USUFMIEhBTkRMRSAtLSBOVUxMIHNwZWNpZmllcyBkZWZhdWx0DQogICAgICAt LSBjcmVkZW50aWFscw0KDQogICBPdXRwdXRzOg0KDQogICBvICBtYWpvcl9zdGF0dXMgSU5URUdF UiwNCiAgIG8gIG1pbm9yX3N0YXR1cyBJTlRFR0VSLA0KICAgbyAgbWVjaF9zZXQgU0VUIE9GIE9C SkVDVCBJREVOVElGSUVSDQoNCiAgIFJldHVybiBtYWpvcl9zdGF0dXMgY29kZXM6DQoNCiAgIG8g IEdTU19TX0NPTVBMRVRFIGluZGljYXRlcyB0aGF0IHRoZSBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFu aXNtcw0KICAgICAgYXZhaWxhYmxlIGZvciBuZWdvdGlhdGlvbiBoYXMgYmVlbiByZXR1cm5lZCBp biBtZWNoX3NldC4NCiAgIG8gIEdTU19TX0ZBSUxVUkUgaW5kaWNhdGVzIHRoYXQgdGhlIHJlcXVl c3RlZCBvcGVyYXRpb24gY291bGQgbm90IGJlDQogICAgICBwZXJmb3JtZWQgZm9yIHJlYXNvbnMg dW5zcGVjaWZpZWQgYXQgdGhlIEdTUy1BUEkgbGV2ZWwuDQoNCiAgIEFsbG93cyBjYWxsZXJzIHRv IGRldGVybWluZSB0aGUgc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMgYXZhaWxhYmxlDQogICBm b3IgbmVnb3RpYXRpb24gd2l0aCB0aGUgY3JlZGVudGlhbCBpZGVudGlmaWVkIGJ5IGNyZWRfaGFu ZGxlLiAgVGhpcw0KICAgY2FsbCBpcyBpbnRlbmRlZCBmb3Igc3VwcG9ydCBvZiBzcGVjaWFsaXpl ZCBjYWxsZXJzIHdobyBuZWVkIHRvDQogICByZWR1Y2UgdGhlIHNldCBvZiBuZWdvdGlhYmxlIHNl Y3VyaXR5IG1lY2hhbmlzbXMgZnJvbSB0aGUgc2V0IG9mDQogICBzdXBwb3J0ZWQgc2VjdXJpdHkg bWVjaGFuaXNtcyBhdmFpbGFibGUgdG8gdGhlIGNhbGxlciAoYmFzZWQgb24NCiAgIGF2YWlsYWJs ZSBjcmVkZW50aWFscykuDQoNCiAgIE5vdGU6IFRoZSBHU1NfSW5kaWNhdGVfbWVjaHMoKSBmdW5j dGlvbiBpbmRpY2F0ZXMgdGhlIGZ1bGwgc2V0IG9mDQogICBtZWNoYW5pc20gdHlwZXMgYXZhaWxh YmxlIG9uIHRoZSBsb2NhbCBzeXN0ZW0uICBTaW5jZSB0aGlzIGNhbGwgaGFzDQogICBubyBpbnB1 dCBwYXJhbWV0ZXIsIHRoZSByZXR1cm5lZCBzZXQgaXMgbm90IG5lY2Vzc2FyaWx5IGF2YWlsYWJs ZSBmb3INCiAgIGFsbCBjcmVkZW50aWFscy4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUg MTIsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDI0XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAg ICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoN Cg0KQXBwZW5kaXggQi4gIENoYW5nZXMgc2luY2UgUkZDMjQ3OA0KDQogICAgICBTUE5FR08gaW1w bGVtZW50YXRpb25zIGluIFdpbmRvd3MgMjAwMC9XaW5kb3dzIFhQL1dpbmRvd3MgU2VydmVyDQog ICAgICAyMDAzIGhhdmUgdGhlIGZvbGxvd2luZyBiZWhhdmlvcjogbm8gbWVjaGxpc3RNSUMgaXMg cHJvZHVjZWQgYW5kDQogICAgICBtZWNobGlzdE1JQyBpcyBub3QgcHJvY2Vzc2VkIGlmIG9uZSBp cyBwcm92aWRlZDsgaWYgdGhlIGluaXRpYXRvcg0KICAgICAgc2VuZHMgdGhlIGxhc3QgbWVjaGFu aXNtIHRva2VuLCB0aGUgYWNjZXB0b3Igd2lsbCBzZW5kIGJhY2sgYQ0KICAgICAgbmVnb3RpYXRp b24gdG9rZW4gd2l0aCBhbiBhY2NlcHRfY29tcGxldGUgc3RhdGUgYW5kIG5vIG1lY2hsaXN0TUlD DQogICAgICB0b2tlbi4gIEluIGFkZGl0aW9uLCBhbiBpbmNvcnJlY3QgT0lEICgxLjIuODQwLjQ4 MDE4LjEuMi4yKSBjYW4gYmUNCiAgICAgIHVzZWQgdG8gaWRlbnRpZnkgdGhlIEdTUy1BUEkgS2Vy YmVyb3MgVmVyc2lvbiA1IG1lY2hhbmlzbS4NCg0KICAgICAgVGhlIGZvbGxvd2luZyBjaGFuZ2Vz IGhhdmUgYmVlbiBtYWRlIHRvIGJlIGNvbXBhdGlibGUgd2l0aCB0aGVzZQ0KICAgICAgbGVnYWN5 IGltcGxlbWVudGF0aW9ucy4NCg0KICAgICAgKiAgTmVnVG9rZW5UYXJnIGlzIGNoYW5nZWQgdG8g bmVnVG9rZW5SZXNwIGFuZCBpdCBpcyB0aGUgbWVzc2FnZQ0KICAgICAgICAgZm9ybWF0IGZvciBh bGwgc3Vic2VxdWVudCBuZWdvdGlhdGlvbiB0b2tlbnMuDQogICAgICAqICBOZWdUb2tlbkluaXQg aXMgdGhlIG1lc3NhZ2UgZm9yIHRoZSBpbml0aWFsIG5lZ290aWF0aW9uIG1lc3NhZ2UNCiAgICAg ICAgIGFuZCB0aGF0IG1lc3NhZ2Ugb25seS4NCiAgICAgICogIG1lY2hUeXBlcyBpbiBuZWdUb2tl bkluaXQgaXMgbm90IG9wdGlvbmFsLg0KICAgICAgKiAgSWYgdGhlIHNlbGVjdGVkIG1lY2hhbmlz bSBpcyBhbHNvIHRoZSBtb3N0IHByZWZlcnJlZCBtZWNoYW5pc20NCiAgICAgICAgIGZvciBib3Ro IHBlZXJzLCBpdCBpcyBzYWZlIHRvIG9taXQgdGhlIE1JQyB0b2tlbnMuDQoNCiAgICAgIElmIGF0 IGxlYXN0IG9uZSBvZiB0aGUgdHdvIHBlZXJzIGltcGxlbWVudHMgdGhlIHVwZGF0ZWQgcHNldWRv DQogICAgICBtZWNoYW5pc20gaW4gdGhpcyBkb2N1bWVudCwgdGhlIG5lZ290aWF0aW9uIGlzIHBy b3RlY3RlZC4NCg0KICAgICAgVGhlIGZvbGxvd2luZyBjaGFuZ2VzIGFyZSB0byBhZGRyZXNzIHRo ZSBwcm9ibGVtcyBpbiBSRkMgMjQ3OC4NCg0KICAgICAgKiAgcmVxRmxhZ3MgaXMgbm90IHByb3Rl Y3RlZCB0aGVyZWZvcmUgaXQgc2hvdWxkIG5vdCBpbXBhY3QgdGhlDQogICAgICAgICBuZWdvdGlh dGlvbi4NCiAgICAgICogIERFUiBlbmNvZGluZyBpcyByZXF1aXJlZC4NCiAgICAgICogIEdTU19H ZXRNSUMoKSBpbnB1dCBpcyBjbGFyaWZpZWQuDQogICAgICAqICBQZXItbWVzc2FnZSBpbnRlZ3Jp dHkgc2VydmljZXMgYXJlIHJlcXVlc3RlZCBmb3IgdGhlIG5lZ290aWF0ZWQNCiAgICAgICAgIG1l Y2hhbmlzbS4NCiAgICAgICogIFR3byBNSUMgdG9rZW5zIGFyZSBleGNoYW5nZWQsIG9uZSBpbiBl YWNoIGRpcmVjdGlvbi4NCg0KICAgQW4gaW1wbGVtZW50YXRpb24gdGhhdCBjb25mb3JtcyB0byB0 aGlzIHNwZWNpZmljYXRpb24gd2lsbCBub3QNCiAgIGludGVyb3BlcmF0ZSB3aXRoIGEgc3RyaWN0 IDI3NDggaW1wbGVtZW50YXRpb24uICBFdmVuIGlmIHRoZSBuZXcNCiAgIGltcGxlbWVudGF0aW9u IGFsd2F5cyBzZW5kcyBhIG1lY2hsaXN0TUlDIHRva2VuLCBpdCB3aWxsIHN0aWxsIGZhaWwNCiAg IHRvIGludGVyb3BlcmF0ZS4gIElmIGl0IGlzIGEgc2VydmVyLCBpdCB3aWxsIGZhaWwgYmVjYXVz ZSBpdCByZXF1ZXN0cw0KICAgYSBtZWNobGlzdE1JQyB0b2tlbiB1c2luZyBhbiBvcHRpb24gdGhh dCBvbGRlciBpbXBsZW1lbnRhdGlvbnMgc2ltcGx5DQogICBkbyBub3Qgc3VwcG9ydC4gIENsaWVu dHMgd2lsbCB0ZW5kIHRvIGZhaWwgYXMgd2VsbC4NCg0KICAgQXMgYW4gYWx0ZXJuYXRpdmUgdG8g dGhlIGFwcHJvYWNoIGNob3NlbiBpbiB0aGlzIHNwZWNpZmljYXRpb24sIHdlDQogICBjb3VsZCBo YXZlIGRvY3VtZW50ZWQgYSBjb3JyZWN0IGJlaGF2aW9yIHRoYXQgaXMgZnVsbHkgYmFja3dhcmQN CiAgIGNvbXBhdGlibGUgd2l0aCBSRkMgMjQ3OCBhbmQgaW5jbHVkZWQgYW4gYXBwZW5kaXggb24g aG93IHRvDQogICBpbnRlcm9wZXJhdGUgd2l0aCBleGlzdGluZyBpbmNvcnJlY3QgaW1wbGVtZW50 YXRpb25zIG9mIFJGQyAyNDc4Lg0KDQogICBBcyBhIHByYWN0aWNhbCBtYXR0ZXIsIHRoZSBTUE5F R08gaW1wbGVtZW50ZXJzIHdpdGhpbiB0aGUgSUVURiBoYXZlDQogICB2YWx1ZWQgaW50ZXJvcGVy YWJpbGl0eSB3aXRoIHRoZSBNaWNyb3NvZnQgaW1wbGVtZW50YXRpb25zLiAgV2Ugd2VyZQ0KDQoN Cg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxMiwgMjAwNSAgICAgICAg ICAgICAgICAgW1BhZ2UgMjVdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290 aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICB1bmFibGUgdG8g Y2hvb3NlIHRvIG1haW50YWluIHJlYXNvbmFibGUgc2VjdXJpdHkgZ3VhcmFudGVlcywgbWFpbnRh aW4NCiAgIGludGVyb3BlcmFiaWxpdHkgd2l0aCB0aGUgTWljcm9zb2Z0IGltcGxlbWVudGF0aW9u cyBhbmQgbWFpbnRhaW4NCiAgIGludGVyb3BlcmFiaWxpdHkgd2l0aCBjb3JyZWN0IGltcGxlbWVu dGF0aW9ucyBvZiBSRkMgMjQ3OC4gIFRoZQ0KICAgd29ya2luZyBncm91cCB3YXMgbm90IGF3YXJl IG9mIGFueSBSRkMgMjQ3OCBpbXBsZW1lbnRhdGlvbnMuICBFdmVuIGlmDQogICB0aGVyZSBhcmUg UkZDIDI0NzggaW1wbGVtZW50YXRpb25zLCBpdCBpcyB1bmxpa2VseSB0aGF0IHRoZXkgd2lsbA0K ICAgaW50ZXJvcGVyYXRlIGJlY2F1c2Ugb2YgYSBjcml0aWNhbCBmbGF3IGluIHRoZSBkZXNjcmlw dGlvbiBvZiB0aGUNCiAgIGVuY29kaW5nIG9mIHRoZSBtZWNoYW5pc20gbGlzdCBpbiBSRkMgMjQ3 OC4NCg0KICAgV2l0aCB0aGUgYXBwcm9hY2ggdGFrZW4gaW4gdGhpcyBzcGVjaWZpY2F0aW9uLCB3 ZSBnZXQgc2VjdXJpdHkNCiAgIGJldHdlZW4gbmV3IGltcGxlbWVudGF0aW9ucyBhbGwgdGhlIHRp bWUgd2hpbGUgbWFpbnRhaW5pbmcNCiAgIGludGVyb3BlcmFiaWxpdHkgd2l0aCB0aGUgaW1wbGVt ZW50YXRpb25zIHdlIGhhdmUgd2l0aGluIHRoZSBJRVRGDQogICBjb21tdW5pdHkuICBUaGUgd29y a2luZyBncm91cCBiZWxpZXZlcyB0aGF0IHRoaXMganVzdGlmaWVzIGJyZWFraW5nDQogICBjb21w YXRpYmlsaXR5IHdpdGggYSBjb3JyZWN0IGltcGxlbWVudGF0aW9uIG9mIFJGQyAyNDc4Lg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTIs IDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDI2XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAg R1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0K QXBwZW5kaXggQy4gIE1lY2hMaXN0TUlDIENvbXB1dGF0aW9uIEV4YW1wbGUNCg0KICAgVGhlIGZv bGxvd2luZyBpcyBhbiBleGFtcGxlIHRvIGlsbHVzdHJhdGUgaG93IHRoZSBNZWNoTGlzdE1JQyBm aWVsZA0KICAgd291bGQgYmUgY29tcHV0ZWQuDQoNCiAgIFRoZSBpbml0aWFsIHBhcnQgb2YgdGhl IERFUiBlbmNvZGluZyBvZiBOZWdUb2tlbkluaXQgaXMgY29uc3RydWN0ZWQNCiAgIGFzIGZvbGxv d3MgKHRoZSAibm4iIGFyZSBsZW5ndGggZW5jb2RpbmdzLCBwb3NzaWJseSBsb25nZXIgdGhhbiBv bmUNCiAgIG9jdGV0KToNCg0KICAgICAgMzAgLS0gaWRlbnRpZmllciBvY3RldCBmb3IgY29uc3Ry dWN0ZWQgU0VRVUVOQ0UgKE5lZ1Rva2VuSW5pdCkNCiAgICAgIG5uIC0tIGxlbmd0aA0KDQogICAg ICAgICAtLSBjb250ZW50cyBvY3RldHMgb2YgdGhlIFNFUVVFTkNFIGJlZ2luIHdpdGgNCiAgICAg ICAgIC0tIERFUiBlbmNvZGluZyBvZiAiWzBdIE1lY2hUeXBlTGlzdCI6DQogICAgICAgICBBMCAt LSBpZGVudGlmaWVyIG9jdGV0IGZvciBjb25zdHJ1Y3RlZCBbMF0NCiAgICAgICAgIG5uIC0tIGxl bmd0aA0KDQogICAgICAgICAgICAgLS0gY29udGVudHMgb2YgdGhlIGNvbnN0cnVjdGVkIFswXSBh cmUgREVSIGVuY29kaW5nDQogICAgICAgICAgICAgLS0gb2YgTWVjaFR5cGVMaXN0ICh3aGljaCBp cyBhIFNFUVVFTkNFKToNCiAgICAgICAgICAgICAzMCAtLSBpZGVudGlmaWVyIG9jdGV0IGZvciBj b25zdHJ1Y3RlZCBTRVFVRU5DRQ0KICAgICAgICAgICAgIG5uIC0tIGxlbmd0aA0KDQogICAgICAg ICAgICAgICAgLS0gY29udGVudHMgb2N0ZXRzIG9mIHRoZSBTRVFVRU5DRSBiZWdpbiB3aXRoDQog ICAgICAgICAgICAgICAgLS0gREVSIGVuY29kaW5nIG9mIE9CSkVDVCBJREVOVElGSUVSOg0KICAg ICAgICAgICAgICAgIDA2IC0tIGlkZW50aWZpZXIgb2N0ZXQgZm9yIHByaW1pdGl2ZSBPQkpFQ1Qg SURFTlRJRklFUg0KICAgICAgICAgICAgICAgIDA5IC0tIGxlbmd0aA0KICAgICAgICAgICAgICAg IDJBIDg2IDQ4IDg2IEY3IDEyIDAxIDAyIDAyIC0tIEtlcmJlcm9zIFY1DQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gezEgMiA4NDAgMTEzNTU0IDEgMiAyfQ0K DQogICBJZiBhIG1lY2hsaXN0TUlDIG5lZWRzIHRvIGJlIGdlbmVyYXRlZCAoYWNjb3JkaW5nIHRv IHRoZSBydWxlcyBpbg0KICAgU2VjdGlvbiA1KSwgaXQgaXMgY29tcHV0ZWQgYnkgdXNpbmcgdGhl IERFUiBlbmNvZGluZyBvZiB0aGUgdHlwZQ0KICAgTWVjaFR5cGVMaXN0IGRhdGEgZnJvbSB0aGUg aW5pdGlhdG9yJ3MgTmVnVG9rZW5Jbml0IHRva2VuIGFzIGlucHV0IHRvDQogICB0aGUgR1NTX0dl dE1JQygpIGZ1bmN0aW9uLiAgSW4gdGhpcyBjYXNlLCB0aGUgTUlDIHdvdWxkIGJlIGNvbXB1dGVk DQogICBvdmVyIHRoZSBmb2xsb3dpbmcgb2N0ZXRzOg0KDQogICAgICBERVIgZW5jb2Rpbmcgb2Yg TWVjaFR5cGVMaXN0Og0KICAgICAgMzAgbm4gMDYgMDkgMkEgODYgNDggODYgRjcgMTIgMDEgMDIg MDIgLi4uDQoNCiAgIE5vdGUgdGhhdCB0aGUgaWRlbnRpZmllciBvY3RldCBhbmQgbGVuZ2ggb2N0 ZXQocykgZm9yIGNvbnN0cnVjdGVkIFswXQ0KICAgKEEwIG5uKSBhcmUgbm90IGluY2x1ZGVkIGlu IHRoZSBNSUMgY29tcHV0YXRpb24uDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4g ICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxMiwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2Ug MjddDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlz bSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQpJbnRlbGxlY3R1YWwgUHJvcGVydHkgU3RhdGVt ZW50DQoNCiAgIFRoZSBJRVRGIHRha2VzIG5vIHBvc2l0aW9uIHJlZ2FyZGluZyB0aGUgdmFsaWRp dHkgb3Igc2NvcGUgb2YgYW55DQogICBJbnRlbGxlY3R1YWwgUHJvcGVydHkgUmlnaHRzIG9yIG90 aGVyIHJpZ2h0cyB0aGF0IG1pZ2h0IGJlIGNsYWltZWQgdG8NCiAgIHBlcnRhaW4gdG8gdGhlIGlt cGxlbWVudGF0aW9uIG9yIHVzZSBvZiB0aGUgdGVjaG5vbG9neSBkZXNjcmliZWQgaW4NCiAgIHRo aXMgZG9jdW1lbnQgb3IgdGhlIGV4dGVudCB0byB3aGljaCBhbnkgbGljZW5zZSB1bmRlciBzdWNo IHJpZ2h0cw0KICAgbWlnaHQgb3IgbWlnaHQgbm90IGJlIGF2YWlsYWJsZTsgbm9yIGRvZXMgaXQg cmVwcmVzZW50IHRoYXQgaXQgaGFzDQogICBtYWRlIGFueSBpbmRlcGVuZGVudCBlZmZvcnQgdG8g aWRlbnRpZnkgYW55IHN1Y2ggcmlnaHRzLiAgSW5mb3JtYXRpb24NCiAgIG9uIHRoZSBwcm9jZWR1 cmVzIHdpdGggcmVzcGVjdCB0byByaWdodHMgaW4gUkZDIGRvY3VtZW50cyBjYW4gYmUNCiAgIGZv dW5kIGluIEJDUCA3OCBhbmQgQkNQIDc5Lg0KDQogICBDb3BpZXMgb2YgSVBSIGRpc2Nsb3N1cmVz IG1hZGUgdG8gdGhlIElFVEYgU2VjcmV0YXJpYXQgYW5kIGFueQ0KICAgYXNzdXJhbmNlcyBvZiBs aWNlbnNlcyB0byBiZSBtYWRlIGF2YWlsYWJsZSwgb3IgdGhlIHJlc3VsdCBvZiBhbg0KICAgYXR0 ZW1wdCBtYWRlIHRvIG9idGFpbiBhIGdlbmVyYWwgbGljZW5zZSBvciBwZXJtaXNzaW9uIGZvciB0 aGUgdXNlIG9mDQogICBzdWNoIHByb3ByaWV0YXJ5IHJpZ2h0cyBieSBpbXBsZW1lbnRlcnMgb3Ig dXNlcnMgb2YgdGhpcw0KICAgc3BlY2lmaWNhdGlvbiBjYW4gYmUgb2J0YWluZWQgZnJvbSB0aGUg SUVURiBvbi1saW5lIElQUiByZXBvc2l0b3J5IGF0DQogICBodHRwOi8vd3d3LmlldGYub3JnL2lw ci4NCg0KICAgVGhlIElFVEYgaW52aXRlcyBhbnkgaW50ZXJlc3RlZCBwYXJ0eSB0byBicmluZyB0 byBpdHMgYXR0ZW50aW9uIGFueQ0KICAgY29weXJpZ2h0cywgcGF0ZW50cyBvciBwYXRlbnQgYXBw bGljYXRpb25zLCBvciBvdGhlciBwcm9wcmlldGFyeQ0KICAgcmlnaHRzIHRoYXQgbWF5IGNvdmVy IHRlY2hub2xvZ3kgdGhhdCBtYXkgYmUgcmVxdWlyZWQgdG8gaW1wbGVtZW50DQogICB0aGlzIHN0 YW5kYXJkLiAgUGxlYXNlIGFkZHJlc3MgdGhlIGluZm9ybWF0aW9uIHRvIHRoZSBJRVRGIGF0DQog ICBpZXRmLWlwckBpZXRmLm9yZy4NCg0KDQpEaXNjbGFpbWVyIG9mIFZhbGlkaXR5DQoNCiAgIFRo aXMgZG9jdW1lbnQgYW5kIHRoZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaGVyZWluIGFyZSBwcm92 aWRlZCBvbiBhbg0KICAgIkFTIElTIiBiYXNpcyBhbmQgVEhFIENPTlRSSUJVVE9SLCBUSEUgT1JH QU5JWkFUSU9OIEhFL1NIRSBSRVBSRVNFTlRTDQogICBPUiBJUyBTUE9OU09SRUQgQlkgKElGIEFO WSksIFRIRSBJTlRFUk5FVCBTT0NJRVRZIEFORCBUSEUgSU5URVJORVQNCiAgIEVOR0lORUVSSU5H IFRBU0sgRk9SQ0UgRElTQ0xBSU0gQUxMIFdBUlJBTlRJRVMsIEVYUFJFU1MgT1IgSU1QTElFRCwN CiAgIElOQ0xVRElORyBCVVQgTk9UIExJTUlURUQgVE8gQU5ZIFdBUlJBTlRZIFRIQVQgVEhFIFVT RSBPRiBUSEUNCiAgIElORk9STUFUSU9OIEhFUkVJTiBXSUxMIE5PVCBJTkZSSU5HRSBBTlkgUklH SFRTIE9SIEFOWSBJTVBMSUVEDQogICBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSBPUiBG SVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4NCg0KDQpDb3B5cmlnaHQgU3RhdGVtZW50 DQoNCiAgIENvcHlyaWdodCAoQykgVGhlIEludGVybmV0IFNvY2lldHkgKDIwMDQpLiAgVGhpcyBk b2N1bWVudCBpcyBzdWJqZWN0DQogICB0byB0aGUgcmlnaHRzLCBsaWNlbnNlcyBhbmQgcmVzdHJp Y3Rpb25zIGNvbnRhaW5lZCBpbiBCQ1AgNzgsIGFuZA0KICAgZXhjZXB0IGFzIHNldCBmb3J0aCB0 aGVyZWluLCB0aGUgYXV0aG9ycyByZXRhaW4gYWxsIHRoZWlyIHJpZ2h0cy4NCg0KDQpBY2tub3ds ZWRnbWVudA0KDQogICBGdW5kaW5nIGZvciB0aGUgUkZDIEVkaXRvciBmdW5jdGlvbiBpcyBjdXJy ZW50bHkgcHJvdmlkZWQgYnkgdGhlDQogICBJbnRlcm5ldCBTb2NpZXR5Lg0KDQoNCg0KDQpaaHUs IGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDEyLCAyMDA1ICAgICAgICAgICAgICAg ICBbUGFnZSAyOF0NCgwNCg0K ------_=_NextPart_001_01C4E0F2.3DEB01A3 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten ------_=_NextPart_001_01C4E0F2.3DEB01A3-- From kitten-bounces@ietf.org Mon Dec 13 05:05:54 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA17713; Mon, 13 Dec 2004 05:05:54 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdnDL-0000hQ-L7; Mon, 13 Dec 2004 05:13:59 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdmy5-0005FQ-S7; Mon, 13 Dec 2004 04:58:13 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdmst-0003Yy-4K for kitten@megatron.ietf.org; Mon, 13 Dec 2004 04:52:51 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA16988 for ; Mon, 13 Dec 2004 04:52:48 -0500 (EST) Received: from au.padl.com ([203.13.32.1]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdn0e-0000Pw-0g for kitten@ietf.org; Mon, 13 Dec 2004 05:00:53 -0500 Received: from au.padl.com (localhost.padl.com [127.0.0.1]) by au.padl.com (8.12.11/8.12.11) with ESMTP id iBD9q3vO079003; Mon, 13 Dec 2004 20:52:03 +1100 (EST) (envelope-from lukeh@au.padl.com) Received: (from lukeh@localhost) by au.padl.com (8.12.11/8.12.11/Submit) id iBD9q2mw079002; Mon, 13 Dec 2004 20:52:02 +1100 (EST) (envelope-from lukeh) From: Luke Howard Message-Id: <200412130952.iBD9q2mw079002@au.padl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Organization: PADL Software Pty Ltd To: lzhu@windows.microsoft.com Date: Mon, 13 Dec 2004 20:52:02 +1100 Versions: dmail (bsd44) 2.6d/makemail 2.10 X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on au.padl.com X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Cc: kitten@ietf.org, hartmans-ietf@mit.edu Subject: RE: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: lukeh@padl.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 >> A publication request for this document should be accompanied by a >true assertion that the ASN.1 module has been >> validated. Please include the name of the person doing the validation >and the tool used. > >Larry Zhu, Microsoft ASN.1 Compiler V1.0. > >I will also ask Luke to post which tool he used. We used the Heimdal ASN.1 compiler. Note that it doesn't support CHOICE so it is hand-marshalled. -- Luke -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 09:13:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11616; Mon, 13 Dec 2004 09:13:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdr5E-0006z9-RI; Mon, 13 Dec 2004 09:21:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdqlF-0004qY-Ov; Mon, 13 Dec 2004 09:01:13 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdqWE-0007RL-Lo for kitten@megatron.ietf.org; Mon, 13 Dec 2004 08:45:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA08357 for ; Mon, 13 Dec 2004 08:45:41 -0500 (EST) Received: from luminous.mit.edu ([18.101.1.61]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdqe3-00063O-8Q for kitten@ietf.org; Mon, 13 Dec 2004 08:53:47 -0500 Received: by luminous.mit.edu (Postfix, from userid 1000) id 3F98676704; Mon, 13 Dec 2004 08:45:27 -0500 (EST) To: "Liqiang(Larry) Zhu" References: From: Sam Hartman Date: Mon, 13 Dec 2004 08:45:27 -0500 In-Reply-To: (Liqiang Zhu's message of "Mon, 13 Dec 2004 01:00:49 -0800") Message-ID: <87y8g2e2h4.fsf@luminous.mit.edu> User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Cc: kitten@ietf.org Subject: Re: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 >>>>> "Larry" == Liqiang(Larry) Zhu writes: Larry> It was meant to emphasize that the list should not contains Larry> mechanisms that the initiator does not have credentials Larry> for. Larry> New text Larry> The first negotiation token sent by the initiator Larry> contains an ordered list of mechanisms (in decreasing Larry> preference order, favorite mechanism first), and optionally Larry> the initial mechanism token for the preferred mechanism of Larry> the initiator (i.e., the first in the list). (Note that Larry> the list MUST NOT contain mechanisms for which the client Larry> does not have appropriate credentials.) I believe this is more clear but I believe it is wrong. Let's say I get credentials for SPNEGO and then add credentials for Kerberos to my credentials. If I then try and initiate a context, and the set of mechanisms SPNEGO negotiates includes SPKM by default, it is reasonable for me to end up with a SPKM context. The actual SPKM credentials used come from inside the SPNEGO credentials. Larry> Is this a bit clearer? >> What happens if it is absent? Larry> Fixed. GSS_Init_sec_context() should indicate Larry> GSS_S_DEFECTIVE_TOKEN. I actually meant what value is assumed if it is absent in the second and following messages? >> Isn't the mechlistmic also required if a mechanism other than >> the >> initiator's first choice chosen? Larry> Yes, but the acceptor must send reqest_mic in that case too Sure, but my point is that an client must require the MIC even if it is talking to an incorrect implementation (read attacker) that does not send request_mic when required. Thanks much for the quick response. --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 13:21:33 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05437; Mon, 13 Dec 2004 13:21:33 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdux4-0005Se-LD; Mon, 13 Dec 2004 13:29:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdul0-0004K8-CF; Mon, 13 Dec 2004 13:17:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdubq-00012S-Ob for kitten@megatron.ietf.org; Mon, 13 Dec 2004 13:07:46 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04585 for ; Mon, 13 Dec 2004 13:07:44 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdujh-0005C1-OQ for kitten@ietf.org; Mon, 13 Dec 2004 13:15:54 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBDI7jdt011942 for ; Mon, 13 Dec 2004 11:07:45 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBDI7ijW006530 for ; Mon, 13 Dec 2004 11:07:45 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBDI6nfg561060; Mon, 13 Dec 2004 12:06:49 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBDI6iSx560999; Mon, 13 Dec 2004 12:06:44 -0600 (CST) Date: Mon, 13 Dec 2004 12:06:44 -0600 From: Nicolas Williams To: Sam Hartman Message-ID: <20041213180643.GE135800@binky.central.sun.com> Mail-Followup-To: Sam Hartman , kitten@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Cc: kitten@ietf.org Subject: Re: Comments on draft-ietf-kitten-gssapi-prf-00 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 On Fri, Dec 10, 2004 at 05:54:50AM -0500, Sam Hartman wrote: > > > > 1) The spec must require that gss_pseudo_random with the same input > will produce the same output within one context. I.E. if I call > the function multiple times with the same input I get the same result. I.e., there should be a "MUST" in the text, correct? Will do. > 2) The spec must require that the probability that I get the same > output given the same input with different contexts is exponentially small Or as best the mechanism designers can get to that. Will do. Out of curiosity, where does this leave the krb5 des-cbc-crc enctype? :) > 3) The requirement that the function be called at most once per > context needs to be dropped. It was a recommendation, not requirement. In that light, should it still be dropped? > 4) A reference to a definition of PRFs needs to be added. Recommendations? > 5) The section titled "normative" should either become a subsection of a section titled "References" or should be retitled "Normative References" Will do. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 13:40:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07445; Mon, 13 Dec 2004 13:40:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdvFf-0005wM-9c; Mon, 13 Dec 2004 13:48:55 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdv2O-00007o-BI; Mon, 13 Dec 2004 13:35:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CduuC-00079t-Ri for kitten@megatron.ietf.org; Mon, 13 Dec 2004 13:26:44 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA06301 for ; Mon, 13 Dec 2004 13:26:41 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdv22-0005dg-5b for kitten@ietf.org; Mon, 13 Dec 2004 13:34:51 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iBDIQeiI004716 for ; Mon, 13 Dec 2004 10:26:41 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBDIQejW019517 for ; Mon, 13 Dec 2004 11:26:40 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBDIPjP1594167; Mon, 13 Dec 2004 12:25:45 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBDIPjIb594166; Mon, 13 Dec 2004 12:25:45 -0600 (CST) Date: Mon, 13 Dec 2004 12:25:45 -0600 From: Nicolas Williams To: Sam Hartman Message-ID: <20041213182545.GF135800@binky.central.sun.com> Mail-Followup-To: Sam Hartman , kitten@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Cc: kitten@ietf.org Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 On Fri, Dec 10, 2004 at 06:17:40AM -0500, Sam Hartman wrote: > I think all the Kerberos enctypes support at least 2**32 blocks, > although admittedly that's getting dangerous for DES. > > I'd propose a four-byte length rather than a two-byte length. Ok. There should, though, be a minimum output length that implementations must support -- 2^16 octets seems like reasonable such minimum, though perhaps a bit long. > I think the call to random-to-key and k-truncate are misplaced. > random-to-key is just wrong in the context of a PRF; you want random > strings not keys out. > > You do need to truncate the output, but I don't think k-truncate is > all that well understood in this context. Woops, that is an editing mistake -- yes, that's no PRF+. An editing error, I think, from the earlier version that didn't have a PRF+. The new PRF+: k5-gss-prf+(K, S, L) = truncate(L, T1 || T2 || .. || Tn) where Tn = pseudo-random-function(K, n || S) and where pseudo-random-function() is the function defined in draft-ietf-krb-wg-crypto. > I'd recommend explicitly saying that we truncate to the output length. See above. > The text is not clear on which key is used. Keep in mind that CFX > involves subkeys and the keying for RFC 1964 is kind of complicated. > You need to cover both cases. This gets at an issue brought up by Love: should there be a GSS_C_PRF_READY? Should PROT_READY apply to the PRF? It's easier if we answer no, and no. > I think that the security considerations text should explicitly call > out concerns with DES. Will do. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 16:44:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00021; Mon, 13 Dec 2004 16:44:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdy7d-0003hl-AQ; Mon, 13 Dec 2004 16:52:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdxrJ-0006Cn-NU; Mon, 13 Dec 2004 16:35:57 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdxfn-00065o-KW for kitten@megatron.ietf.org; Mon, 13 Dec 2004 16:24:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25292 for ; Mon, 13 Dec 2004 16:24:01 -0500 (EST) Received: from minbar.fac.cs.cmu.edu ([128.2.185.161]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cdxnf-0002tp-Ln for kitten@ietf.org; Mon, 13 Dec 2004 16:32:12 -0500 Received: from minbar.fac.cs.cmu.edu ([127.0.0.1]) by minbar.fac.cs.cmu.edu id aa26936; 13 Dec 2004 16:23 EST Date: Mon, 13 Dec 2004 16:23:47 -0500 From: Jeffrey Hutzelman To: Nicolas Williams , Sam Hartman Message-ID: <3326650000.1102973027@minbar.fac.cs.cmu.edu> In-Reply-To: <20041213182545.GF135800@binky.central.sun.com> References: <20041213182545.GF135800@binky.central.sun.com> X-Mailer: Mulberry/3.0.3 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Content-Transfer-Encoding: 7bit On Monday, December 13, 2004 12:25:45 -0600 Nicolas Williams wrote: >> The text is not clear on which key is used. Keep in mind that CFX >> involves subkeys and the keying for RFC 1964 is kind of complicated. >> You need to cover both cases. > > This gets at an issue brought up by Love: should there be a > GSS_C_PRF_READY? Should PROT_READY apply to the PRF? > > It's easier if we answer no, and no. I think PROT_READY is something of a kludge, and will not be particularly sad if things stop supporting it. In that vein, I don't think we need a GSS_C_PRF_READY. As for the second question, I don't think it matters. I'm having trouble imagining a mech which could report PROT_READY and not also be ready to run the PRF. -- Jeff _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 16:51:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00529; Mon, 13 Dec 2004 16:51:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdyDq-0003s9-Uq; Mon, 13 Dec 2004 16:59:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdxsJ-0006u2-G3; Mon, 13 Dec 2004 16:36:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdxls-0002HA-Le for kitten@megatron.ietf.org; Mon, 13 Dec 2004 16:30:20 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26100 for ; Mon, 13 Dec 2004 16:30:18 -0500 (EST) Received: from mail1.microsoft.com ([131.107.3.125]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdxtk-000371-K3 for kitten@ietf.org; Mon, 13 Dec 2004 16:38:30 -0500 Received: from mailout1.microsoft.com ([157.54.1.117]) by mail1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 13:29:48 -0800 Received: from red-hub-02.redmond.corp.microsoft.com ([157.54.7.100]) by mailout1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 13:29:47 -0800 Received: from win-imc-01.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.39]) by red-hub-02.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 13 Dec 2004 13:29:47 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-01.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 13:29:44 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 13 Dec 2004 13:29:44 -0800 Message-ID: Thread-Topic: AD review: draft-ietf-kitten-2478bis-02 Thread-Index: AcThGh0tTYCwk1ehRwaZY13xibZOPAAQADbg From: "Liqiang\(Larry\) Zhu" To: "Sam Hartman" X-OriginalArrivalTime: 13 Dec 2004 21:29:44.0895 (UTC) FILETIME=[DD4724F0:01C4E15A] X-Spam-Score: 0.0 (/) X-Scan-Signature: 73734d43604d52d23b3eba644a169745 Content-Transfer-Encoding: quoted-printable Cc: kitten@ietf.org Subject: RE: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 386e0819b1192672467565a524848168 Content-Transfer-Encoding: quoted-printable I chatted with Sam over the phone and he agreed to withdraw two of objections below, and for the remaining one I added a note in 5 c). c) In the case that the chosen mechanism exchanges an odd number of mechanism tokens (i.e., the initiator sends the last mechanism token), the initiator does the following when emitting the negotiation message containing the last mechanism token: if the negState was request_mic in the first reply from the target, a mechlistMIC token MUST be included, otherwise the mechlistMIC token is OPTIONAL. (Note that the MIC token exchange is required if a mechanism other than the initiator's first choice is chosen.) In the case that the optimistic mechanism token is the only mechanism token for the initiator's preferred mechanism, the mechlistMIC token is OPTIONAL. Whether or not the mechlistMIC token is included, GSS_Init_sec_context() indicates GSS_S_CONTINUE_NEEDED. Initiators that wish to be compatible with legacy Windows SPNEGO implementations as described in Appendix B should not generate a mechlistMIC token when the MIC token exchange is not required. The acceptor then processes the last mechanism token and does one of the following: With this, I believe all known issues/objections are addressed now. Thanks, -- Larry -----Original Message----- From: Sam Hartman [mailto:hartmans-ietf@mit.edu]=20 Sent: Monday, December 13, 2004 5:45 AM To: Liqiang(Larry) Zhu Cc: kitten@ietf.org Subject: Re: AD review: draft-ietf-kitten-2478bis-02 >>>>> "Larry" =3D=3D Liqiang(Larry) Zhu = writes: Larry> It was meant to emphasize that the list should not contains Larry> mechanisms that the initiator does not have credentials Larry> for. Larry> New text Larry> The first negotiation token sent by the initiator Larry> contains an ordered list of mechanisms (in decreasing Larry> preference order, favorite mechanism first), and optionally Larry> the initial mechanism token for the preferred mechanism of Larry> the initiator (i.e., the first in the list). (Note that Larry> the list MUST NOT contain mechanisms for which the client Larry> does not have appropriate credentials.) I believe this is more clear but I believe it is wrong. Let's say I get credentials for SPNEGO and then add credentials for Kerberos to my credentials. If I then try and initiate a context, and the set of mechanisms SPNEGO negotiates includes SPKM by default, it is reasonable for me to end up with a SPKM context. The actual SPKM credentials used come from inside the SPNEGO credentials. Larry> Is this a bit clearer? >> What happens if it is absent? Larry> Fixed. GSS_Init_sec_context() should indicate Larry> GSS_S_DEFECTIVE_TOKEN. I actually meant what value is assumed if it is absent in the second and following messages? >> Isn't the mechlistmic also required if a mechanism other than >> the >> initiator's first choice chosen? Larry> Yes, but the acceptor must send reqest_mic in that case too Sure, but my point is that an client must require the MIC even if it is talking to an incorrect implementation (read attacker) that does not send request_mic when required. Thanks much for the quick response. --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 16:58:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01118; Mon, 13 Dec 2004 16:58:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdyKz-00045o-NH; Mon, 13 Dec 2004 17:06:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdy6d-0003Ha-TL; Mon, 13 Dec 2004 16:51:47 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdxww-0000Ty-52 for kitten@megatron.ietf.org; Mon, 13 Dec 2004 16:41:46 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28881 for ; Mon, 13 Dec 2004 16:41:44 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdy4k-0003Yu-BS for kitten@ietf.org; Mon, 13 Dec 2004 16:49:53 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBDLfddt000321 for ; Mon, 13 Dec 2004 14:41:39 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBDLfdjY027632 for ; Mon, 13 Dec 2004 14:41:39 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBDLeiEq112032; Mon, 13 Dec 2004 15:40:44 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBDLedMk111459; Mon, 13 Dec 2004 15:40:39 -0600 (CST) Date: Mon, 13 Dec 2004 15:40:39 -0600 From: Nicolas Williams To: Jeffrey Hutzelman Message-ID: <20041213214039.GO135800@binky.central.sun.com> Mail-Followup-To: Jeffrey Hutzelman , Sam Hartman , kitten@ietf.org References: <20041213182545.GF135800@binky.central.sun.com> <3326650000.1102973027@minbar.fac.cs.cmu.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3326650000.1102973027@minbar.fac.cs.cmu.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Cc: kitten@ietf.org, Sam Hartman Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 On Mon, Dec 13, 2004 at 04:23:47PM -0500, Jeffrey Hutzelman wrote: > On Monday, December 13, 2004 12:25:45 -0600 Nicolas Williams > wrote: > > >>The text is not clear on which key is used. Keep in mind that CFX > >>involves subkeys and the keying for RFC 1964 is kind of complicated. > >>You need to cover both cases. > > > >This gets at an issue brought up by Love: should there be a > >GSS_C_PRF_READY? Should PROT_READY apply to the PRF? > > > >It's easier if we answer no, and no. > > I think PROT_READY is something of a kludge, and will not be particularly > sad if things stop supporting it. In that vein, I don't think we need a > GSS_C_PRF_READY. > > As for the second question, I don't think it matters. I'm having trouble > imagining a mech which could report PROT_READY and not also be ready to run > the PRF. The Kerberos V GSS mech's PRF could not be ready when the context is PROT_READY *if* we specify the use of the acceptor's sub-session key as the key for the PRF. One way to define PROT_READY is thus: the key material for the context has been exchanged/agreed upon, though it may not be authenticated until the context is fully established. By such a definition the Kerberos V mechanism's contexts can't be PROT_READY and not also be fully established. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 16:58:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01163; Mon, 13 Dec 2004 16:58:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdyLJ-000461-3e; Mon, 13 Dec 2004 17:06:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdy6f-0003Hj-1U; Mon, 13 Dec 2004 16:51:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdxxK-0000fG-ED for kitten@megatron.ietf.org; Mon, 13 Dec 2004 16:42:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29203 for ; Mon, 13 Dec 2004 16:42:08 -0500 (EST) Received: from minbar.fac.cs.cmu.edu ([128.2.185.161]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cdy5B-0003bD-5b for kitten@ietf.org; Mon, 13 Dec 2004 16:50:18 -0500 Received: from minbar.fac.cs.cmu.edu ([127.0.0.1]) by minbar.fac.cs.cmu.edu id aa26987; 13 Dec 2004 16:42 EST Date: Mon, 13 Dec 2004 16:42:02 -0500 From: Jeffrey Hutzelman To: Sam Hartman , "Liqiang(Larry) Zhu" Message-ID: <3332510000.1102974122@minbar.fac.cs.cmu.edu> In-Reply-To: <87y8g2e2h4.fsf@luminous.mit.edu> References: <87y8g2e2h4.fsf@luminous.mit.edu> X-Mailer: Mulberry/3.0.3 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org Subject: Re: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: 7bit On Monday, December 13, 2004 08:45:27 -0500 Sam Hartman wrote: > I believe this is more clear but I believe it is wrong. Let's say I > get credentials for SPNEGO and then add credentials for Kerberos to my > credentials. If I then try and initiate a context, and the set of > mechanisms SPNEGO negotiates includes SPKM by default, it is > reasonable for me to end up with a SPKM context. The actual SPKM > credentials used come from inside the SPNEGO credentials. I'm not sure what you mean when you say "get credentials for SPNEGO". Yes, from the RFC2743 point of view there is such a concept as SPNEGO credentials, but it's an abstraction for some set of underlying "real" credentials. The requirement applies to that set of real credentials -- if your "SPNEGO credentials" don't include SPKM credentials, then it is not OK for SPNEGO to negotiate SPKM. -- Jeff _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 18:07:01 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06164; Mon, 13 Dec 2004 18:07:01 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdzPN-0005aw-QC; Mon, 13 Dec 2004 18:15:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzCZ-0002xn-0M; Mon, 13 Dec 2004 18:01:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzAr-0001kg-TN for kitten@megatron.ietf.org; Mon, 13 Dec 2004 18:00:14 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05225 for ; Mon, 13 Dec 2004 18:00:11 -0500 (EST) Received: from minbar.fac.cs.cmu.edu ([128.2.185.161]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CdzIk-0005QO-Qt for kitten@ietf.org; Mon, 13 Dec 2004 18:08:24 -0500 Received: from minbar.fac.cs.cmu.edu ([127.0.0.1]) by minbar.fac.cs.cmu.edu id aa27155; 13 Dec 2004 18:00 EST Date: Mon, 13 Dec 2004 18:00:11 -0500 From: Jeffrey Hutzelman To: Nicolas Williams Message-ID: <3366640000.1102978811@minbar.fac.cs.cmu.edu> In-Reply-To: <20041213214039.GO135800@binky.central.sun.com> References: <20041213182545.GF135800@binky.central.sun.com> <3326650000.1102973027@minbar.fac.cs.cmu.edu> <20041213214039.GO135800@binky.central.sun.com> X-Mailer: Mulberry/3.0.3 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org, Sam Hartman Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit On Monday, December 13, 2004 15:40:39 -0600 Nicolas Williams wrote: >> As for the second question, I don't think it matters. I'm having >> trouble imagining a mech which could report PROT_READY and not also be >> ready to run the PRF. > > The Kerberos V GSS mech's PRF could not be ready when the context is > PROT_READY *if* we specify the use of the acceptor's sub-session key as > the key for the PRF. Indeed, I stand corrected. In which case, it simplifies things quite a lot if we specify that the PRF cannot be used until the context is fully established. -- Jeff _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 18:11:55 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06851; Mon, 13 Dec 2004 18:11:55 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdzU7-0005iD-1I; Mon, 13 Dec 2004 18:20:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzIG-000652-9E; Mon, 13 Dec 2004 18:07:52 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzDq-000447-37 for kitten@megatron.ietf.org; Mon, 13 Dec 2004 18:03:18 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05559 for ; Mon, 13 Dec 2004 18:03:15 -0500 (EST) Received: from minbar.fac.cs.cmu.edu ([128.2.185.161]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CdzLj-0005Vq-3a for kitten@ietf.org; Mon, 13 Dec 2004 18:11:28 -0500 Received: from minbar.fac.cs.cmu.edu ([127.0.0.1]) by minbar.fac.cs.cmu.edu id aa27160; 13 Dec 2004 18:02 EST Date: Mon, 13 Dec 2004 18:02:58 -0500 From: Jeffrey Hutzelman To: "Liqiang(Larry) Zhu" , Sam Hartman Message-ID: <3369640000.1102978978@minbar.fac.cs.cmu.edu> In-Reply-To: References: X-Mailer: Mulberry/3.0.3 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Spam-Score: 0.0 (/) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org Subject: RE: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Content-Transfer-Encoding: 7bit On Monday, December 13, 2004 13:29:44 -0800 "Liqiang(Larry) Zhu" wrote: > I chatted with Sam over the phone and he agreed to withdraw two of > objections below, and for the remaining one I added a note in 5 c). Um. So what text did we end up with for not negotiating a mechanism you don't have credentials for? Do we have the original text, or the new text you proposed, or something else? -- Jeff _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 18:21:03 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07898; Mon, 13 Dec 2004 18:21:02 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdzcu-0005uR-4b; Mon, 13 Dec 2004 18:29:15 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzMZ-0008U6-P4; Mon, 13 Dec 2004 18:12:19 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzKc-00074l-7j for kitten@megatron.ietf.org; Mon, 13 Dec 2004 18:10:18 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06685 for ; Mon, 13 Dec 2004 18:10:15 -0500 (EST) Received: from mail1.microsoft.com ([131.107.3.125]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdzST-0005fZ-SK for kitten@ietf.org; Mon, 13 Dec 2004 18:18:28 -0500 Received: from mailout1.microsoft.com ([157.54.1.117]) by mail1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 15:09:44 -0800 Received: from red-hub-01.redmond.corp.microsoft.com ([157.54.7.71]) by mailout1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 15:09:43 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-01.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 15:09:43 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Mon, 13 Dec 2004 15:09:43 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 13 Dec 2004 15:09:40 -0800 Message-ID: Thread-Topic: AD review: draft-ietf-kitten-2478bis-02 Thread-Index: AcThZ/nDoVcHFIeHReKzCHUVb+JgmAAADl8Q From: "Liqiang\(Larry\) Zhu" To: "Jeffrey Hutzelman" , "Sam Hartman" X-OriginalArrivalTime: 13 Dec 2004 23:09:43.0607 (UTC) FILETIME=[D4C9F470:01C4E168] X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: quoted-printable Cc: kitten@ietf.org Subject: RE: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Content-Transfer-Encoding: quoted-printable Jeffrey Hutzelman wrote: > Do we have the original text, or the new text you proposed, or something else? We agreed to use the new text. The new text is better in that it is more explicit. The problem I had with the old text was that the term "based on" was too vague (although it does not contradict with the fact that the caller can reduce the set of negotiable mechanisms for which the initiator has credentials). I think the difference (between the old and the new text) is too subtle for us to have an issue here. -- Larry -----Original Message----- From: Jeffrey Hutzelman [mailto:jhutz@cmu.edu]=20 Sent: Monday, December 13, 2004 3:03 PM To: Liqiang(Larry) Zhu; Sam Hartman Cc: kitten@ietf.org Subject: RE: AD review: draft-ietf-kitten-2478bis-02 On Monday, December 13, 2004 13:29:44 -0800 "Liqiang(Larry) Zhu"=20 wrote: > I chatted with Sam over the phone and he agreed to withdraw two of=20 > objections below, and for the remaining one I added a note in 5 c). Um. So what text did we end up with for not negotiating a mechanism you don't have credentials for? Do we have the original text, or the new text you proposed, or something else? -- Jeff _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 13 18:26:59 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08305; Mon, 13 Dec 2004 18:26:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdzig-00061z-UD; Mon, 13 Dec 2004 18:35:12 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzV6-0004rD-Oe; Mon, 13 Dec 2004 18:21:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzPv-0001fm-3F for kitten@megatron.ietf.org; Mon, 13 Dec 2004 18:15:47 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07321 for ; Mon, 13 Dec 2004 18:15:44 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdzXo-0005n0-8s for kitten@ietf.org; Mon, 13 Dec 2004 18:23:56 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iBDNFfiI009680 for ; Mon, 13 Dec 2004 15:15:44 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBDNFejY020244 for ; Mon, 13 Dec 2004 16:15:40 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBDNEjLQ150219; Mon, 13 Dec 2004 17:14:45 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBDNEjjt150218; Mon, 13 Dec 2004 17:14:45 -0600 (CST) Date: Mon, 13 Dec 2004 17:14:45 -0600 From: Nicolas Williams To: Jeffrey Hutzelman Message-ID: <20041213231445.GS135800@binky.central.sun.com> Mail-Followup-To: Jeffrey Hutzelman , Sam Hartman , kitten@ietf.org References: <20041213182545.GF135800@binky.central.sun.com> <3326650000.1102973027@minbar.fac.cs.cmu.edu> <20041213214039.GO135800@binky.central.sun.com> <3366640000.1102978811@minbar.fac.cs.cmu.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3366640000.1102978811@minbar.fac.cs.cmu.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Cc: kitten@ietf.org, Sam Hartman Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 On Mon, Dec 13, 2004 at 06:00:11PM -0500, Jeffrey Hutzelman wrote: > > > On Monday, December 13, 2004 15:40:39 -0600 Nicolas Williams > wrote: > > >>As for the second question, I don't think it matters. I'm having > >>trouble imagining a mech which could report PROT_READY and not also be > >>ready to run the PRF. > > > >The Kerberos V GSS mech's PRF could not be ready when the context is > >PROT_READY *if* we specify the use of the acceptor's sub-session key as > >the key for the PRF. > > Indeed, I stand corrected. > > In which case, it simplifies things quite a lot if we specify that the PRF > cannot be used until the context is fully established. Yes, but for potential future mechanisms this could be a bad compromise. Looking at: a) how prot_ready was added to the GSS-API and, b) the text in RFC2744 about the flags output parameter of the GSS context establishment/inquiry functions I do believe we could add prf_ready/GSS_C_PRF_READY to the GSS-API. But we could also add prf_ready/GSS_C_PRF_READY later, when it's actually needed, the same way that prot_ready was added. Anyways, this is an interesting excercise is figuring out what PROT_READY really means. Knowing what I know now, a) PROT_READY should have meant and should mean, if we could figure out how to make it so, that the key material for the context has been fully exchanged/agreed to though not authenticated until the context is fully established. But that would mean taking out support for PROT_READY from CFX. Fun. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 14 14:53:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10304; Tue, 14 Dec 2004 14:53:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeIrb-0003yt-BK; Tue, 14 Dec 2004 15:01:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeIge-0005Xs-Bx; Tue, 14 Dec 2004 14:50:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeIfr-0005B4-4d for kitten@megatron.ietf.org; Tue, 14 Dec 2004 14:49:31 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10004 for ; Tue, 14 Dec 2004 14:49:21 -0500 (EST) Received: from smtpde03.sap-ag.de ([155.56.68.140]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeInm-0003pZ-Bc for kitten@ietf.org; Tue, 14 Dec 2004 14:57:43 -0500 Received: from sap-ag.de (smtpde03) by smtpde03.sap-ag.de (out) with ESMTP id UAA25162; Tue, 14 Dec 2004 20:48:28 +0100 (MEZ) From: Martin Rex Message-Id: <200412141948.UAA00386@uw1048.wdf.sap.corp> To: Nicolas.Williams@sun.com (Nicolas Williams) Date: Tue, 14 Dec 2004 20:48:28 +0100 (MET) In-Reply-To: <20041213214039.GO135800@binky.central.sun.com> from "Nicolas Williams" at Dec 13, 4 03:40:39 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org, hartmans-ietf@mit.edu Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 8bit Nicolas Williams wrote: > > The Kerberos V GSS mech's PRF could not be ready when the context is > PROT_READY *if* we specify the use of the acceptor's sub-session key as > the key for the PRF. > > One way to define PROT_READY is thus: the key material for the context > has been exchanged/agreed upon, though it may not be authenticated until > the context is fully established. By such a definition the Kerberos V > mechanism's contexts can't be PROT_READY and not also be fully > established. PROT_READY was meant to allow an authenticated communication (i.e. context establishment plus application request reply) with a single application-level message exchange. So the (application level) request carries the initial context token plus protected messages with the application request, and the (application level) reply carries an optional reply context token plus protected messages with the application reply. This feature was specifically requested for use with rfc1964 Kerberos and both, unidirectional and mutual authentication by IBM to protect communication with stateless servers without having to change the architecture (the statelessness). We discussed the acceptor-asserted subsession key before -- it is somewhat incompatible with generic PROT_READY facility, and it is entirely incompatible with the target-only context establishment exchange. -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 14 14:56:44 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10609; Tue, 14 Dec 2004 14:56:44 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeIuw-00044C-3Q; Tue, 14 Dec 2004 15:05:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeIlK-0006Gx-Nl; Tue, 14 Dec 2004 14:55:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeIkX-00067H-Ta for kitten@megatron.ietf.org; Tue, 14 Dec 2004 14:54:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10474 for ; Tue, 14 Dec 2004 14:54:20 -0500 (EST) Received: from carter-zimmerman.mit.edu ([18.18.3.197] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeIsb-00040i-C8 for kitten@ietf.org; Tue, 14 Dec 2004 15:02:42 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id C4CC6E0063; Tue, 14 Dec 2004 14:54:55 -0500 (EST) To: martin.rex@sap.com References: <200412141948.UAA00386@uw1048.wdf.sap.corp> From: Sam Hartman Date: Tue, 14 Dec 2004 14:54:55 -0500 In-Reply-To: <200412141948.UAA00386@uw1048.wdf.sap.corp> (Martin Rex's message of "Tue, 14 Dec 2004 20:48:28 +0100 (MET)") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 7bac9cb154eb5790ae3b2913587a40de Cc: kitten@ietf.org, Nicolas Williams Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c >>>>> "Martin" == Martin Rex writes: Martin> We discussed the acceptor-asserted subsession key before Martin> -- it is somewhat incompatible with generic PROT_READY Martin> facility, and it is entirely incompatible with the Martin> target-only context establishment exchange. What is this facility? I'm missing or at least misplacing the reference. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 14 16:43:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA24734; Tue, 14 Dec 2004 16:43:26 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeKaD-0008CW-3R; Tue, 14 Dec 2004 16:51:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeKKo-0005Vo-BW; Tue, 14 Dec 2004 16:35:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeJno-0003Bh-57 for kitten@megatron.ietf.org; Tue, 14 Dec 2004 16:01:49 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA17173 for ; Tue, 14 Dec 2004 16:01:46 -0500 (EST) Received: from smtpde02.sap-ag.de ([155.56.68.170]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeJvs-0005ef-9j for kitten@ietf.org; Tue, 14 Dec 2004 16:10:10 -0500 Received: from sap-ag.de (smtpde02) by smtpde02.sap-ag.de (out) with ESMTP id WAA13408; Tue, 14 Dec 2004 22:00:59 +0100 (MEZ) From: Martin Rex Message-Id: <200412142100.WAA00756@uw1048.wdf.sap.corp> To: jhutz@cmu.edu (Jeffrey Hutzelman) Date: Tue, 14 Dec 2004 22:00:58 +0100 (MET) In-Reply-To: <3332510000.1102974122@minbar.fac.cs.cmu.edu> from "Jeffrey Hutzelman" at Dec 13, 4 04:42:02 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org, lzhu@windows.microsoft.com, hartmans-ietf@mit.edu Subject: Re: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Content-Transfer-Encoding: 8bit Jeffrey Hutzelman wrote: > > On Monday, December 13, 2004 08:45:27 -0500 Sam Hartman > wrote: > > I believe this is more clear but I believe it is wrong. Let's say I > > get credentials for SPNEGO and then add credentials for Kerberos to my > > credentials. If I then try and initiate a context, and the set of > > mechanisms SPNEGO negotiates includes SPKM by default, it is > > reasonable for me to end up with a SPKM context. The actual SPKM > > credentials used come from inside the SPNEGO credentials. > > I'm not sure what you mean when you say "get credentials for SPNEGO". Yes, > from the RFC2743 point of view there is such a concept as SPNEGO > credentials, but it's an abstraction for some set of underlying "real" > credentials. The requirement applies to that set of real credentials -- if > your "SPNEGO credentials" don't include SPKM credentials, then it is not OK > for SPNEGO to negotiate SPKM. Application-level "credentials management" that includes the SPNEGO mechanism OID is un(der)specified, so you should *never* mix the SPNEGO mechanism OID with any other mechanism OIDs when your (portable) application calls gss_acquire_cred() or gss_add_cred(). Similarly, your SPNEGO should never return individual mechanism OIDs when a SPNEGO credentials handle is queried for the mechanisms through gss_inquire_cred() or as the result of gs rfc2478 defines a GSS-API extension in Appendix A with two additional function calls that should be used to manipulate the mechanism (OIDs) to which an SPNEGO credentials handle refers. -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 14 16:45:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA24917; Tue, 14 Dec 2004 16:45:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeKcA-0008Fl-O7; Tue, 14 Dec 2004 16:53:51 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeKLB-0005r0-J7; Tue, 14 Dec 2004 16:36:17 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeJxc-000831-9v for kitten@megatron.ietf.org; Tue, 14 Dec 2004 16:11:56 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA18230 for ; Tue, 14 Dec 2004 16:11:54 -0500 (EST) Received: from smtpde03.sap-ag.de ([155.56.68.140]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeK5g-00061L-Ig for kitten@ietf.org; Tue, 14 Dec 2004 16:20:18 -0500 Received: from sap-ag.de (smtpde03) by smtpde03.sap-ag.de (out) with ESMTP id WAA22845; Tue, 14 Dec 2004 22:11:14 +0100 (MEZ) From: Martin Rex Message-Id: <200412142111.WAA00826@uw1048.wdf.sap.corp> To: hartmans-ietf@mit.edu (Sam Hartman) Date: Tue, 14 Dec 2004 22:11:15 +0100 (MET) In-Reply-To: from "Sam Hartman" at Dec 14, 4 02:54:55 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: 8bit Sam Hartman wrote: > > >>>>> "Martin" == Martin Rex writes: > > Martin> We discussed the acceptor-asserted subsession key before > Martin> -- it is somewhat incompatible with generic PROT_READY > Martin> facility, and it is entirely incompatible with the > Martin> target-only context establishment exchange. > > What is this facility? I'm missing or at least misplacing the > reference. What I meant is the following: 1) with the single token security context establishment that rfc1964 uses for unidirectional authentication there is no place for the acceptor to assert a subsession key 2) With PROT_READY, it may be difficult (or impossible) for the acceptor to determine (at the gssapi level) at which point the initiator is in possesion of an acceptor-asserted subsession key, and should no longer be using the initiator-asserted subsession key for message protection. -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 14 17:04:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26718; Tue, 14 Dec 2004 17:04:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeKuO-0000MB-L5; Tue, 14 Dec 2004 17:12:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeKhw-00046p-IZ; Tue, 14 Dec 2004 16:59:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeKb1-0002Yb-7V for kitten@megatron.ietf.org; Tue, 14 Dec 2004 16:52:39 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25567 for ; Tue, 14 Dec 2004 16:52:37 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeKj5-0008S2-RB for kitten@ietf.org; Tue, 14 Dec 2004 17:01:01 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iBELqaVu014052 for ; Tue, 14 Dec 2004 14:52:36 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBELqZJf015597 for ; Tue, 14 Dec 2004 14:52:35 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBELpdge160056; Tue, 14 Dec 2004 15:51:39 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBELpceV160055; Tue, 14 Dec 2004 15:51:38 -0600 (CST) Date: Tue, 14 Dec 2004 15:51:37 -0600 From: Nicolas Williams To: Martin Rex Message-ID: <20041214215137.GB135800@binky.central.sun.com> Mail-Followup-To: Martin Rex , Sam Hartman , kitten@ietf.org References: <200412142111.WAA00826@uw1048.wdf.sap.corp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412142111.WAA00826@uw1048.wdf.sap.corp> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Cc: kitten@ietf.org, Sam Hartman Subject: Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 On Tue, Dec 14, 2004 at 10:11:15PM +0100, Martin Rex wrote: > Sam Hartman wrote: > > > > >>>>> "Martin" == Martin Rex writes: > > > > Martin> We discussed the acceptor-asserted subsession key before > > Martin> -- it is somewhat incompatible with generic PROT_READY > > Martin> facility, and it is entirely incompatible with the > > Martin> target-only context establishment exchange. > > > > What is this facility? I'm missing or at least misplacing the > > reference. > > What I meant is the following: > > 1) with the single token security context establishment that rfc1964 > uses for unidirectional authentication there is no place for > the acceptor to assert a subsession key > > 2) With PROT_READY, it may be difficult (or impossible) for the > acceptor to determine (at the gssapi level) at which point > the initiator is in possesion of an acceptor-asserted subsession key, > and should no longer be using the initiator-asserted subsession key > for message protection. Yes, in CFX we had that problem. This would all be fixed by settling for the semantic I mentioned yesterday, that PROT_READY indicates that all key material has been exchanged, while GSS_S_COMPLETE indicates that all key material has been exchanged and authenticated and authentication is complete. That would mean that Kerberos V contexts can never be PROT_READY and also NOT fully established. But we've already made the mistake of giving the new mechanism a PROT_READY feature (and for this I must take blame). Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 14 18:14:54 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA03996; Tue, 14 Dec 2004 18:14:54 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeM0l-0002Ct-EI; Tue, 14 Dec 2004 18:23:19 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeLsF-0005E2-57; Tue, 14 Dec 2004 18:14:31 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeLpK-0003EE-Je for kitten@megatron.ietf.org; Tue, 14 Dec 2004 18:11:30 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA03636 for ; Tue, 14 Dec 2004 18:11:28 -0500 (EST) Received: from serrano.cc.columbia.edu ([128.59.206.20] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeLxR-00028T-2v for kitten@ietf.org; Tue, 14 Dec 2004 18:19:53 -0500 Received: from [192.168.1.66] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by serrano.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iBENBS9w009785 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 14 Dec 2004 18:11:29 -0500 (EST) Message-ID: <41BF7381.4010801@columbia.edu> Date: Tue, 14 Dec 2004 18:13:05 -0500 From: Jeffrey Altman Organization: Not Affiliated with Columbia University in the City of New York User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org References: <41AF09BE.2030809@columbia.edu> In-Reply-To: <41AF09BE.2030809@columbia.edu> X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.20 X-Spam-Score: 0.0 (/) X-Scan-Signature: 68ba2b07ef271dba6ee42a93832cfa4c Subject: REMINDER: Working Group Last Call: The Simple and Protected GSS-API Negotiation Mechanism X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0828313627==" Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 03169bfe4792634a390035a01a6c6d2f This is a cryptographically signed message in MIME format. --===============0828313627== Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms060601050702040103010603" This is a cryptographically signed message in MIME format. --------------ms060601050702040103010603 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit This is a reminder that the two week working group last call on "The Simple and Protected GSS-API Negotiation Mechanism" will expire on Thursday 16-Dec-2004. Draft -03 was posted to this list this morning containing the editorial changes already agreed upon. Jeffrey Altman Jeffrey Altman wrote: > The authors of "The Simple and Protected GSS-API Negotiation Mechanism" > have informed me that they believe that draft -02 is ready for last > call. I have reviewed the document and agree. I believe the remaining > issues on the list are editorial in nature. > > A Working Group Last Call period will start today to determine whether > or not it is the consensus of this group to submit the document to the > IESG for consideration as a Proposed Standard. > > As the -02 draft has not been published by the Secretariat as yet, > a copy of the draft may be found in the Kitten mailing list archives > at: > > http://www1.ietf.org/mail-archive/web/kitten/current/msg00281.html > > This Working Group Last Call will expire on 16-Dec-2004. > > Please send comments on this document to "kitten@ietf.org". > > ----------------------------------------------------------------- > Title: The Simple and Protected GSS-API Negotiation Mechanism > Authors: Zhu, L., Leach, P.J., Jaganathan, K., Ingersoll, W. > Filename: draft-ietf-kitten-2478bis-02.txt > Abstract: > > This document specifies a negotiation mechanism for the Generic > Security Service Application Program Interface (GSS-API) which is > described in RFC 2743. > > GSS-API peers can use this negotiation mechanism to choose from a > common set of security mechanisms. > > Size: 25 pages > Expiry: June 1, 2005 > -------------------------------------------------------------- > > Jeffrey Altman > Chair, IETF Kitten Working Group > Secure Endpoints Inc. > > > > _______________________________________________ > Kitten mailing list > Kitten@lists.ietf.org > https://www1.ietf.org/mailman/listinfo/kitten --------------ms060601050702040103010603 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJPzCC AvowggJjoAMCAQICAwxk8TANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UE ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNv bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDQwNTI3MTc1ODU4WhcNMDUwNTI3MTc1ODU4 WjBrMQ8wDQYDVQQEEwZBbHRtYW4xFTATBgNVBCoTDEplZmZyZXkgRXJpYzEcMBoGA1UEAxMT SmVmZnJleSBFcmljIEFsdG1hbjEjMCEGCSqGSIb3DQEJARYUamFsdG1hbkBjb2x1bWJpYS5l ZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc3JqO5AsZrozd+mJ2mPuCTYo2 +nJ9Qq6jtUYtp7YTMW4d2Q6GLhNaHb1l9m74SxuY4f5vP6JtZjr6p9+LCCxD0w0NVLKRgUDp z+tKFitbkJe9BSCxCURRvY3vdWA71gSCUvZAN3346hHb4oGVqgdpmfFJXYAHWpC46wiL72N9 WxySzY17/0eU0c8+r9dNoLpPQeL43O66O80jCl1qnXMaXaakZPsfm+5W90MYXhpQ1WIQpv02 lBn3BH5YE8xwbsNrw5AF4v7pjMuW85GI6FrDmfbpJX473Rpl5rmv3TpXkJ+7UsIIO1puyS8r 1o7kjDZ5EUYJxxglTGR6XL/RNzqHAgMBAAGjMTAvMB8GA1UdEQQYMBaBFGphbHRtYW5AY29s dW1iaWEuZWR1MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAZYeVFCMP0iV+UVa0 eFoXkzMVl61CNAVY2YQ9/QQazO3G4qNiif35ArrnjPRDRj5M7WTeOCFqPVuvCttyJRiDKsEe L4Yah22mRA3mR7x52j2FquPYZ9qCr1IhrNGzsMk+gopX5G0fTHZb6+uDu5SeMPNNcIznGA7M CMpXAJ2PcKgwggL6MIICY6ADAgECAgMMZPEwDQYJKoZIhvcNAQEEBQAwYjELMAkGA1UEBhMC WkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1Ro YXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA0MDUyNzE3NTg1OFoXDTA1 MDUyNzE3NTg1OFowazEPMA0GA1UEBBMGQWx0bWFuMRUwEwYDVQQqEwxKZWZmcmV5IEVyaWMx HDAaBgNVBAMTE0plZmZyZXkgRXJpYyBBbHRtYW4xIzAhBgkqhkiG9w0BCQEWFGphbHRtYW5A Y29sdW1iaWEuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3NyajuQLGa6M 3fpidpj7gk2KNvpyfUKuo7VGLae2EzFuHdkOhi4TWh29ZfZu+EsbmOH+bz+ibWY6+qffiwgs Q9MNDVSykYFA6c/rShYrW5CXvQUgsQlEUb2N73VgO9YEglL2QDd9+OoR2+KBlaoHaZnxSV2A B1qQuOsIi+9jfVscks2Ne/9HlNHPPq/XTaC6T0Hi+NzuujvNIwpdap1zGl2mpGT7H5vuVvdD GF4aUNViEKb9NpQZ9wR+WBPMcG7Da8OQBeL+6YzLlvORiOhaw5n26SV+O90aZea5r906V5Cf u1LCCDtabskvK9aO5Iw2eRFGCccYJUxkely/0Tc6hwIDAQABozEwLzAfBgNVHREEGDAWgRRq YWx0bWFuQGNvbHVtYmlhLmVkdTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBAGWH lRQjD9IlflFWtHhaF5MzFZetQjQFWNmEPf0EGsztxuKjYon9+QK654z0Q0Y+TO1k3jghaj1b rwrbciUYgyrBHi+GGodtpkQN5ke8edo9harj2Gfagq9SIazRs7DJPoKKV+RtH0x2W+vrg7uU njDzTXCM5xgOzAjKVwCdj3CoMIIDPzCCAqigAwIBAgIBDTANBgkqhkiG9w0BAQUFADCB0TEL MAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3du MRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENB MSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTAzMDcx NzAwMDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0 ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVl bWFpbCBJc3N1aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEpjxVc1X7TrnK mVoeaMB1BHCd3+n/ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuFWqo/ cVbLrzwLB+fxH5E2JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8 YQRAHmQZcmC3+wIDAQABo4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4 oDagNIYyaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS5j cmwwCwYDVR0PBAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwy LTEzODANBgkqhkiG9w0BAQUFAAOBgQBIjNFQg+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4 Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZfoSxmRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowg T2Vfldr394fWxghOrvbqNOUQGls1TXfjViF4gtwhGTXeJLHTHUb/XV9lTzGCAzswggM3AgEB MGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0 ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMMZPEw CQYFKw4DAhoFAKCCAacwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUx DxcNMDQxMjE0MjMxMzA1WjAjBgkqhkiG9w0BCQQxFgQU704YKDyZssBwck8Q77s6S4v2jucw UgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcN AwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgweAYJKwYBBAGCNxAEMWswaTBiMQswCQYD VQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAwxk8TB6BgsqhkiG9w0B CRACCzFroGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB AgMMZPEwDQYJKoZIhvcNAQEBBQAEggEACS8aNKM8buiAdAPaxXMqdMERO7YuTcc2Vzc0RkOk zjg0lcDiaDhhMWCkQ2G6kfwSOB33uchDb7lEzCFjpEWfAPUdBwr5snboKB0+3+2+q4ytpiS/ cjAbc3ZENnHxjE2JL9isBgbeBtheLKlsJHByNg0BdCXSDlEGxIWUf4nUSrvjmVYRcxdSU/0J rbi2f+Z5evJ4puhdm0QMRnyfC14zuydb148SJqn/pSLDKXOkPubo3K47fa29t5txGDm1mLQv OfDPEuryRkmk3KOUyGJCuks4bxhN6G+vCZbYFD0YbmgyBnlLCiGuShFos7f44jsIL6qkDkBq c/pXHpYTch8VqgAAAAAAAA== --------------ms060601050702040103010603-- --===============0828313627== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --===============0828313627==-- From kitten-bounces@ietf.org Wed Dec 15 03:27:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA11201; Wed, 15 Dec 2004 03:27:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeUdw-0006ht-Vh; Wed, 15 Dec 2004 03:36:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeUUo-0001Wd-BD; Wed, 15 Dec 2004 03:26:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeURV-0000tm-K2 for kitten@megatron.ietf.org; Wed, 15 Dec 2004 03:23:29 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA10862 for ; Wed, 15 Dec 2004 03:23:27 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeUZd-0006Za-SN for kitten@ietf.org; Wed, 15 Dec 2004 03:31:57 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iBF8NOiI018562 for ; Wed, 15 Dec 2004 00:23:24 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBF8NNjY028150 for ; Wed, 15 Dec 2004 01:23:23 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBF8MRl5172178; Wed, 15 Dec 2004 02:22:27 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBF8MQkD172177; Wed, 15 Dec 2004 02:22:26 -0600 (CST) Date: Wed, 15 Dec 2004 02:22:25 -0600 From: Nicolas Williams To: Jeffrey Hutzelman Message-ID: <20041215082225.GG135800@binky.central.sun.com> Mail-Followup-To: Jeffrey Hutzelman , Sam Hartman , "Liqiang(Larry) Zhu" , kitten@ietf.org References: <87y8g2e2h4.fsf@luminous.mit.edu> <3332510000.1102974122@minbar.fac.cs.cmu.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3332510000.1102974122@minbar.fac.cs.cmu.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Cc: kitten@ietf.org, "Liqiang\(Larry\) Zhu" , Sam Hartman Subject: Re: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 On Mon, Dec 13, 2004 at 04:42:02PM -0500, Jeffrey Hutzelman wrote: > > > On Monday, December 13, 2004 08:45:27 -0500 Sam Hartman > wrote: > > >I believe this is more clear but I believe it is wrong. Let's say I > >get credentials for SPNEGO and then add credentials for Kerberos to my > >credentials. If I then try and initiate a context, and the set of > >mechanisms SPNEGO negotiates includes SPKM by default, it is > >reasonable for me to end up with a SPKM context. The actual SPKM > >credentials used come from inside the SPNEGO credentials. > > I'm not sure what you mean when you say "get credentials for SPNEGO". Yes, > from the RFC2743 point of view there is such a concept as SPNEGO > credentials, but it's an abstraction for some set of underlying "real" > credentials. The requirement applies to that set of real credentials -- if > your "SPNEGO credentials" don't include SPKM credentials, then it is not OK > for SPNEGO to negotiate SPKM. "Get credentials for SPNEGO" -> e.g., call GSS_Add_cred() w/ desired_mech == SPNEGO's OID, or call GSS_Init_sec_context() w/ GSS_C_NO_CREDENTIAL and SPNEGO's OID as the mech, etc... Note that it's possible to have a GSS credential with elements for multiple mechanisms including one for SPNEGO which, in turn, may have an internal reference to a GSS credential with elements for non-SPNEGO mechanisms. Think of a non-monolythic multi-mechanism mech glue layer. The GSS_Set_neg_mechs() and GSS_Get_neg_mechs() functions are there to provide applications with control over what mechanisms a SPNEGO credential may have elements for. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 03:39:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA11774; Wed, 15 Dec 2004 03:39:50 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeUpY-0006wZ-1e; Wed, 15 Dec 2004 03:48:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeUfW-0003ML-AW; Wed, 15 Dec 2004 03:37:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeUWG-0001qP-7F for kitten@megatron.ietf.org; Wed, 15 Dec 2004 03:28:24 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA11260 for ; Wed, 15 Dec 2004 03:28:22 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeUeQ-0006iP-TW for kitten@ietf.org; Wed, 15 Dec 2004 03:36:52 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iBF8SLVu013807 for ; Wed, 15 Dec 2004 01:28:21 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBF8SLjW000304 for ; Wed, 15 Dec 2004 01:28:21 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBF8RQsc172201; Wed, 15 Dec 2004 02:27:26 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBF8RPAP172200; Wed, 15 Dec 2004 02:27:25 -0600 (CST) Date: Wed, 15 Dec 2004 02:27:25 -0600 From: Nicolas Williams To: "Liqiang(Larry) Zhu" Message-ID: <20041215082725.GH135800@binky.central.sun.com> Mail-Followup-To: "Liqiang(Larry) Zhu" , Sam Hartman , kitten@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 6d62ab47271805379d7172ee693a45db Cc: kitten@ietf.org, Sam Hartman Subject: Re: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7bac9cb154eb5790ae3b2913587a40de Is it sufficiently clear that foreknowledge of how many tokens a given mechanism will need is not needed? Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 05:56:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA19866; Wed, 15 Dec 2004 05:56:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeWy6-0001pO-JN; Wed, 15 Dec 2004 06:05:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeWpg-00019u-Ph; Wed, 15 Dec 2004 05:56:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeWnZ-0000sN-DO for kitten@megatron.ietf.org; Wed, 15 Dec 2004 05:54:25 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA19756 for ; Wed, 15 Dec 2004 05:54:22 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeWvm-0001m2-BK for kitten@ietf.org; Wed, 15 Dec 2004 06:02:54 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBFAsNdt020043 for ; Wed, 15 Dec 2004 03:54:24 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBFAsNJf000149 for ; Wed, 15 Dec 2004 03:54:23 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBFArRXP172308; Wed, 15 Dec 2004 04:53:27 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBFArRTU172307; Wed, 15 Dec 2004 04:53:27 -0600 (CST) Date: Wed, 15 Dec 2004 04:53:27 -0600 From: Nicolas Williams To: Sam Hartman Message-ID: <20041215105327.GL135800@binky.central.sun.com> Mail-Followup-To: Sam Hartman , kitten@ietf.org References: <20041213013831.C94BAE0063@cz.mit.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041213013831.C94BAE0063@cz.mit.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Cc: kitten@ietf.org Subject: Re: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 On Sun, Dec 12, 2004 at 08:38:31PM -0500, Sam Hartman wrote: > Acceptors that wish to be compatible with legacy Windows SPNEGO > implementations as described in Appendix B shall not generate a > mechlistMIC token when the MIC token exchange is not required. > I'd rather not have a 2119 SHALL subordinate to a "wish to" clause > suggest s/SHALL/should/ This seems like a matter of wording, and I do think that RFC2119 verbiage is needed here as this does involve interop with a widely deployed implementation. BTW, what is "legacy" in this case? Should we care? Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 06:38:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA22061; Wed, 15 Dec 2004 06:38:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeXcj-0002in-M8; Wed, 15 Dec 2004 06:47:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeXMw-0000dt-Rx; Wed, 15 Dec 2004 06:30:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeXIk-0008Kc-4R for kitten@megatron.ietf.org; Wed, 15 Dec 2004 06:26:38 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA21347 for ; Wed, 15 Dec 2004 06:26:35 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeXQx-0002SA-4i for kitten@ietf.org; Wed, 15 Dec 2004 06:35:07 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBFBQadt008017 for ; Wed, 15 Dec 2004 04:26:36 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBFBQaJf013054 for ; Wed, 15 Dec 2004 04:26:36 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBFBPbIb172331 for ; Wed, 15 Dec 2004 05:25:37 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBFBPap0172330 for kitten@ietf.org; Wed, 15 Dec 2004 05:25:36 -0600 (CST) Date: Wed, 15 Dec 2004 05:25:36 -0600 From: Nicolas Williams To: kitten@ietf.org Message-ID: <20041215112536.GQ135801@binky.central.sun.com> Mail-Followup-To: kitten@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 5d7a7e767f20255fce80fa0b77fb2433 Subject: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b22590c27682ace61775ee7b453b40d3 [My comments take into account the changes agreed to in the thread started by Sam about his comments.] - section 3.1, third paragraph: the GSS_Set/Get_neg_mechs() functions deal in SET OF OBJECT IDENTIFIER, not SEQUENCE OF, therefore applications cannot specify preference order through GSS_Set_neg_mechs(). GSS_Set/Get_neg_mechs() could not be changed to use SEQUENCE OF OBJECT IDENTIFIER because of language bindings issues (unless there exist no implementations, I suppose) since SEQUENCE OF is not used anywhere in RFC2743 none of the language bindings have appropriate bindings for that type. I suggest either extensions for specifying policy or else that this paragraph be re-written to remove at least the reference to appendix A. - section 3.1, next to last paragraph: should that not read: "Lastly, MIC tokens MAY, and sometimes MUST be exchanged ...?" - section 3.2, first paragraph: if integrity protection is not available then what? Presumably the context can be established anyhow as neither the initiator would offer nor the acceptor accept such a mech if they really want a protected negotiation. - section 3.2, (c), (III): s/depending on if at least.*\./according to the status of the negotiated mechanism's context./ Similarly, for section 3.2, (c), (II), there may or may not be a mechanism token in the negotiation token when the state is request_mic -- if the mechanism outputs a token then it should be included in the negotiation token (except in the error token case, in which it should be optional). - section 3.2, (d): encapsulated with what? NegTokenResp? - section 3.2, first paragraph after (e): s/i.e.,.*\./i.e., these flag input parameters and state output parameters are passed by SPNEGO unmodified between the application and the mechanism./ - section 3.2, last paragraph: I think this should be re-written thusly: When a GSS-API credential is acquired for the SPNEGO mechanism the implementation SHOULD produce a credential element for the SPNEGO mechanism which internally contains GSS-API credential elements for all mechanisms for which the principal has credentials available, except for any mechanisms which are not to be negotiated, either as per implementation-, site- or application-specific policy. See Appendix A for interfaces for expressing application policy. - section 4.2, first paragraph: s/are not/MUST NOT be/ - section 4.2.1, if reqFlags has no impact on the negotiation, what's the point? Why not deprecate that field recommend that it be left out? Besides, what would an acceptor do with those flags? GSS_Accept_sec_context() doesn't have a flags input parameter... And the final output flags from the SPNEGO GSS_Accept_sec_context() should, one would think, correspond to those of the negotiated mechanism's (minus prot_ready prior to full context establishment). - section 4.2.2: ENUMERATED can have extensibility markers too. If the negResult enumeration gets such a marker then section 6 will have to explain what implementors are to do about unknown negResults; IMO the answer is: derive actual state from the negotiated context state or, if that's not possible, quit with an error. - section 4.2.2: Add: "When negResult is absent the actual state should be inferred from the state of the negotiated mechanism context." - section 5, what happens when a mechListMIC is sent when it is OPTIONAL? The receipient should have to process it, IMO, and that should be a MUST, no? - section 5, (b), (I), the initiator MUST output a negotiation token with a mechListMIC, no? I.e., RFC2119 key words are needed. - section 5, (b), (II): s/terminated. GSS.*\.//terminated; GSS_S_DEFECTIVE_TOKEN MUST be indicated as the major status./ I.e., this applies not just to GSS_Accept_sec_context() but also to GSS_Init_sec_context(). Similarly for section 5, (b), (IV). - section 5, (c): I'm with Sam on this; I've not seen a response from Larry about. The initiator has to send a mechListMIC if the acceptor selected a mechanism other than the initiator's preference even if the acceptor did not request a mecListMIC. - section 5, (c): GSS_Init_sec_context() should not, presumably, indicate GSS_S_CONTINUE_NEEDED if the intiator offers only one mechanism, an optimistic token is included and the mechanism is a one-token mechanism (i.e., it indicates GSS_S_COMPLETE immediately), right? - section 5, (c), (I), again, RFC2119 key words are needed: s/contains/MUST include/ (and the token MUST be output!) - section 5, (c), (I), when the acceptor's mechListMIC cannot be verified by the initiator GSS_Init_sec_context() should (MUST) indicate GSS_S_DEFECTIVE_TOKEN. - section 5, (c), (III): It may be useful to explain why. - section 5, (c), (III): s/contains/MUST contain/ (and the token MUST be output!). - section 6, second paragraph, third sentence: s/ but instead.*\.// - section 7, given the attack in the even-numbered mechanism token exchange case where the initiator can end up fully established while the acceptor fails to establish, isn't there an issue where an attacker could cause a downgrade to a mechanism for which it could impersonate the acceptor through other attacks? It's late, but I think I'm done. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 06:41:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA22284; Wed, 15 Dec 2004 06:41:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeXfh-0002o4-5E; Wed, 15 Dec 2004 06:50:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeXV0-0001ti-Dy; Wed, 15 Dec 2004 06:39:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeXPp-0000wE-UW for kitten@megatron.ietf.org; Wed, 15 Dec 2004 06:33:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA21695 for ; Wed, 15 Dec 2004 06:33:54 -0500 (EST) Received: from mail3.microsoft.com ([131.107.3.123]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeXY3-0002ab-19 for kitten@ietf.org; Wed, 15 Dec 2004 06:42:27 -0500 Received: from mailout2.microsoft.com ([157.54.1.120]) by mail3.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 15 Dec 2004 03:33:29 -0800 Received: from red-hub-04.redmond.corp.microsoft.com ([157.54.3.6]) by mailout2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 15 Dec 2004 03:33:22 -0800 Received: from win-imc-01.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.39]) by red-hub-04.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 15 Dec 2004 03:33:21 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-01.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Wed, 15 Dec 2004 03:33:21 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 15 Dec 2004 03:32:14 -0800 Message-ID: Thread-Topic: AD review: draft-ietf-kitten-2478bis-02 Thread-Index: AcTigA6Jha6mUx5nQyyOFvZjdVU9kAAGasJI From: "Liqiang\(Larry\) Zhu" To: "Nicolas Williams" X-OriginalArrivalTime: 15 Dec 2004 11:33:21.0214 (UTC) FILETIME=[E15E3DE0:01C4E299] X-Spam-Score: 0.8 (/) X-Scan-Signature: 92df29fa99cf13e554b84c8374345c17 Cc: kitten@ietf.org, Sam Hartman Subject: RE: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1387522594==" Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.5 (/) X-Scan-Signature: b5d20af10c334b36874c0264b10f59f1 This is a multi-part message in MIME format. --===============1387522594== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C4E299.DC4693C3" This is a multi-part message in MIME format. ------_=_NextPart_001_01C4E299.DC4693C3 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable this is correct based on the algorithms in the current draft and = implementations we have. did you find anything different from your = side? =20 -- larry ________________________________ From: Nicolas Williams [mailto:Nicolas.Williams@sun.com] Sent: Wed 12/15/2004 12:27 AM To: Liqiang(Larry) Zhu Cc: Sam Hartman; kitten@ietf.org Subject: Re: AD review: draft-ietf-kitten-2478bis-02 Is it sufficiently clear that foreknowledge of how many tokens a given mechanism will need is not needed? Nico -- ------_=_NextPart_001_01C4E299.DC4693C3 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =0A= =0A= =0A= =0A= =0A= =0A= Re: AD review: draft-ietf-kitten-2478bis-02=0A= =0A= =0A=
=0A=
this is = correct based on the =0A= algorithms in the current draft and implementations we have. did = you find =0A= anything different from  your side?
=0A=
 
=0A=
-- larry
=0A=

=0A=
=0A= From: Nicolas Williams =0A= [mailto:Nicolas.Williams@sun.com]
Sent: Wed 12/15/2004 12:27 =0A= AM
To: Liqiang(Larry) Zhu
Cc: Sam Hartman; =0A= kitten@ietf.org
Subject: Re: AD review: =0A= draft-ietf-kitten-2478bis-02

=0A=
=0A=

Is it sufficiently clear that foreknowledge of how = many tokens a =0A= given
mechanism will need is not =0A= needed?

Nico
--

=0A= =0A= =0A= ------_=_NextPart_001_01C4E299.DC4693C3-- --===============1387522594== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --===============1387522594==-- From kitten-bounces@ietf.org Wed Dec 15 07:01:44 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA23961; Wed, 15 Dec 2004 07:01:44 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeXyy-0003MC-Oo; Wed, 15 Dec 2004 07:10:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeXoy-0006AU-Pm; Wed, 15 Dec 2004 06:59:56 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeXfA-00042P-Oz for kitten@megatron.ietf.org; Wed, 15 Dec 2004 06:49:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA22817 for ; Wed, 15 Dec 2004 06:49:45 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeXnN-0002yn-2F for kitten@ietf.org; Wed, 15 Dec 2004 06:58:18 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBFBnkdt021599 for ; Wed, 15 Dec 2004 04:49:46 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBFBnkJf027337 for ; Wed, 15 Dec 2004 04:49:46 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBFBmn1Y172345; Wed, 15 Dec 2004 05:48:49 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBFBmmaP172344; Wed, 15 Dec 2004 05:48:48 -0600 (CST) Date: Wed, 15 Dec 2004 05:48:48 -0600 From: Nicolas Williams To: "Liqiang(Larry) Zhu" Message-ID: <20041215114848.GM135800@binky.central.sun.com> Mail-Followup-To: "Liqiang(Larry) Zhu" , Sam Hartman , kitten@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Cc: kitten@ietf.org, Sam Hartman Subject: Re: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d On closer review I think yes, it is clear. On Wed, Dec 15, 2004 at 03:32:14AM -0800, Liqiang(Larry) Zhu wrote: > this is correct based on the algorithms in the current draft and implementations we have. did you find anything different from your side? > > -- larry > > ________________________________ > > From: Nicolas Williams [mailto:Nicolas.Williams@sun.com] > Sent: Wed 12/15/2004 12:27 AM > To: Liqiang(Larry) Zhu > Cc: Sam Hartman; kitten@ietf.org > Subject: Re: AD review: draft-ietf-kitten-2478bis-02 > > > > Is it sufficiently clear that foreknowledge of how many tokens a given > mechanism will need is not needed? > > Nico > -- > > _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 08:10:14 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA28743; Wed, 15 Dec 2004 08:10:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeZ3F-0005Cb-Uh; Wed, 15 Dec 2004 08:18:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeYsd-0004aK-Gi; Wed, 15 Dec 2004 08:07:47 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeYg4-0001Yu-4x for kitten@megatron.ietf.org; Wed, 15 Dec 2004 07:54:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA27566 for ; Wed, 15 Dec 2004 07:54:46 -0500 (EST) Received: from cathode-dark-space.mit.edu ([18.18.1.96]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeYoH-0004mJ-AE for kitten@ietf.org; Wed, 15 Dec 2004 08:03:18 -0500 Received: (from tlyu@localhost) by cathode-dark-space.mit.edu (8.12.9) id iBFCsjAY004215; Wed, 15 Dec 2004 07:54:45 -0500 (EST) To: Jeffrey Altman References: <41AF09BE.2030809@columbia.edu> <41BF7381.4010801@columbia.edu> From: Tom Yu Date: Wed, 15 Dec 2004 07:54:45 -0500 In-Reply-To: <41BF7381.4010801@columbia.edu> (Jeffrey Altman's message of "Tue, 14 Dec 2004 18:13:05 -0500") Message-ID: Lines: 10 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 7bac9cb154eb5790ae3b2913587a40de Cc: kitten@ietf.org Subject: Re: REMINDER: Working Group Last Call: The Simple and Protected GSS-API Negotiation Mechanism X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c >>>>> "jaltman" == Jeffrey Altman writes: jaltman> Draft -03 was posted to this list this morning containing the jaltman> editorial changes already agreed upon. I do not see the -03 draft anywhere. It's not on the internet-drafts site, and I didn't see a copy come over the mailing list. It's also not in the mailing list archives. Is there in fact a -03 draft? ---Tom _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 10:05:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06216; Wed, 15 Dec 2004 10:05:26 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ceaqm-0007zp-7z; Wed, 15 Dec 2004 10:14:00 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ceaf7-0007cX-Oz; Wed, 15 Dec 2004 10:01:57 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeaLc-00081P-Aa for kitten@megatron.ietf.org; Wed, 15 Dec 2004 09:41:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA04306 for ; Wed, 15 Dec 2004 09:41:46 -0500 (EST) Received: from luminous.mit.edu ([18.101.1.61]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeaTq-0007Go-F3 for kitten@ietf.org; Wed, 15 Dec 2004 09:50:19 -0500 Received: by luminous.mit.edu (Postfix, from userid 1000) id A134876730; Wed, 15 Dec 2004 09:41:23 -0500 (EST) To: kitten@ietf.org References: <20041213013831.C94BAE0063@cz.mit.edu> <20041215105327.GL135800@binky.central.sun.com> From: Sam Hartman Date: Wed, 15 Dec 2004 09:41:23 -0500 In-Reply-To: <20041215105327.GL135800@binky.central.sun.com> (Nicolas Williams's message of "Wed, 15 Dec 2004 04:53:27 -0600") Message-ID: <873by77hf0.fsf@luminous.mit.edu> User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Subject: Re: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 >>>>> "Nicolas" == Nicolas Williams writes: Nicolas> On Sun, Dec 12, 2004 at 08:38:31PM -0500, Sam Hartman Nicolas> wrote: >> Acceptors that wish to be compatible with legacy Windows SPNEGO >> implementations as described in Appendix B shall not generate a >> mechlistMIC token when the MIC token exchange is not required. >> I'd rather not have a 2119 SHALL subordinate to a "wish to" >> clause suggest s/SHALL/should/ Nicolas> This seems like a matter of wording, and I do think that Nicolas> RFC2119 verbiage is needed here as this does involve Nicolas> interop with a widely deployed implementation. BTW, what Nicolas> is "legacy" in this case? Should we care? Propose text. Based on the timing I'd rather assume that any change we agree to will be integrated after ietf last call (probably in an rfc editor note) rather than before ietf lc. --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 10:36:40 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA09362; Wed, 15 Dec 2004 10:36:40 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CebKz-0000Ob-Fw; Wed, 15 Dec 2004 10:45:14 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ceb2x-000782-FB; Wed, 15 Dec 2004 10:26:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ceawm-0005Ei-5u for kitten@megatron.ietf.org; Wed, 15 Dec 2004 10:20:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA07644 for ; Wed, 15 Dec 2004 10:20:09 -0500 (EST) Received: from luminous.mit.edu ([18.101.1.61]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ceb50-0008NT-57 for kitten@ietf.org; Wed, 15 Dec 2004 10:28:43 -0500 Received: by luminous.mit.edu (Postfix, from userid 1000) id 5F79576740; Wed, 15 Dec 2004 10:19:47 -0500 (EST) To: kitten@ietf.org References: <20041215112536.GQ135801@binky.central.sun.com> From: Sam Hartman Date: Wed, 15 Dec 2004 10:19:46 -0500 In-Reply-To: <20041215112536.GQ135801@binky.central.sun.com> (Nicolas Williams's message of "Wed, 15 Dec 2004 05:25:36 -0600") Message-ID: <87llbz612l.fsf@luminous.mit.edu> User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 I think Nico wants somewhat more RFC 2119 language than I think is strictly necessary. Note that things other than 2119 language can place normative requirements on an implementation. I don't object to his proposed changes in this regard, I simply think some of of them are not required. I take no position on whether they would improve the spec. >>>>> "Nicolas" == Nicolas Williams writes: Nicolas> [My comments take into account the changes agreed to in Nicolas> Similarly, for section 3.2, (c), (II), there may or Nicolas> may not be a mechanism token in the negotiation token Nicolas> when the state is request_mic -- if the mechanism outputs Nicolas> a token then it should be included in the negotiation Nicolas> token (except in the error token case, in which it should Nicolas> be optional). Why is an error token optional? _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 10:37:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA09460; Wed, 15 Dec 2004 10:37:26 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CebLj-0000S2-Nq; Wed, 15 Dec 2004 10:45:59 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ceb3y-0007VY-AH; Wed, 15 Dec 2004 10:27:38 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ceaze-00066I-Tp for kitten@megatron.ietf.org; Wed, 15 Dec 2004 10:23:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA08037 for ; Wed, 15 Dec 2004 10:23:08 -0500 (EST) Received: from luminous.mit.edu ([18.101.1.61]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ceb7s-0008Vj-DO for kitten@ietf.org; Wed, 15 Dec 2004 10:31:41 -0500 Received: by luminous.mit.edu (Postfix, from userid 1000) id A555276740; Wed, 15 Dec 2004 10:22:45 -0500 (EST) To: kitten@ietf.org References: <20041213013831.C94BAE0063@cz.mit.edu> <20041215105327.GL135800@binky.central.sun.com> <873by77hf0.fsf@luminous.mit.edu> From: Sam Hartman Date: Wed, 15 Dec 2004 10:22:45 -0500 In-Reply-To: <873by77hf0.fsf@luminous.mit.edu> (Sam Hartman's message of "Wed, 15 Dec 2004 09:41:23 -0500") Message-ID: <87hdmn60xm.fsf@luminous.mit.edu> User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Subject: Re: AD review: draft-ietf-kitten-2478bis-02 X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a >>>>> "Sam" == Sam Hartman writes: >>>>> "Nicolas" == Nicolas Williams writes: Nicolas> On Sun, Dec 12, 2004 at 08:38:31PM -0500, Sam Hartman Nicolas> wrote: >>> Acceptors that wish to be compatible with legacy Windows >>> SPNEGO implementations as described in Appendix B shall not >>> generate a mechlistMIC token when the MIC token exchange is >>> not required. I'd rather not have a 2119 SHALL subordinate to >>> a "wish to" clause suggest s/SHALL/should/ Nicolas> This seems like a matter of wording, and I do think that Nicolas> RFC2119 verbiage is needed here as this does involve Nicolas> interop with a widely deployed implementation. BTW, what Nicolas> is "legacy" in this case? Should we care? Sam> Propose text. Based on the timing I'd rather assume that any Sam> change we agree to will be integrated after ietf last call Sam> (probably in an rfc editor note) rather than before ietf lc. Actually, I think timing is less of an issue now given Nico's other comments. --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 13:34:55 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26183; Wed, 15 Dec 2004 13:34:54 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cee7V-0005uh-L9; Wed, 15 Dec 2004 13:43:29 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CedeT-0006w4-Jb; Wed, 15 Dec 2004 13:13:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CedUA-0003jm-VL for kitten@megatron.ietf.org; Wed, 15 Dec 2004 13:02:51 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA23279 for ; Wed, 15 Dec 2004 13:02:47 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CedcR-0004se-Cj for kitten@ietf.org; Wed, 15 Dec 2004 13:11:24 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iBFI2niI012022 for ; Wed, 15 Dec 2004 10:02:49 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBFI2mJf008616 for ; Wed, 15 Dec 2004 11:02:48 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBFI1qak172591; Wed, 15 Dec 2004 12:01:52 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBFI1pvx172590; Wed, 15 Dec 2004 12:01:51 -0600 (CST) Date: Wed, 15 Dec 2004 12:01:51 -0600 From: Nicolas Williams To: Sam Hartman Message-ID: <20041215180151.GQ135800@binky.central.sun.com> Mail-Followup-To: Sam Hartman , kitten@ietf.org References: <20041215112536.GQ135801@binky.central.sun.com> <87llbz612l.fsf@luminous.mit.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87llbz612l.fsf@luminous.mit.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d On Wed, Dec 15, 2004 at 10:19:46AM -0500, Sam Hartman wrote: > I think Nico wants somewhat more RFC 2119 language than I think is > strictly necessary. Note that things other than 2119 language can > place normative requirements on an implementation. > > I don't object to his proposed changes in this regard, I simply think > some of of them are not required. I take no position on whether they > would improve the spec. Hmmm, well, I don't have a strong position on that matter -- I understood what the text said and meant, so if that's enough for you then we can drop this. > > >>>>> "Nicolas" == Nicolas Williams writes: > > Nicolas> [My comments take into account the changes agreed to in > > Nicolas> Similarly, for section 3.2, (c), (II), there may or > Nicolas> may not be a mechanism token in the negotiation token > Nicolas> when the state is request_mic -- if the mechanism outputs > Nicolas> a token then it should be included in the negotiation > Nicolas> token (except in the error token case, in which it should > Nicolas> be optional). > > Why is an error token optional? IIRC you've wanted error tokens and/or useful information in them to be optional and, anyways, initiators already have to be prepared to never hear from acceptors again, even in the middle of a context token exchange. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 13:42:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26807; Wed, 15 Dec 2004 13:42:15 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeeEb-00067Y-Ug; Wed, 15 Dec 2004 13:50:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cee2N-0005C8-Jj; Wed, 15 Dec 2004 13:38:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cedhg-0008DH-0m for kitten@megatron.ietf.org; Wed, 15 Dec 2004 13:16:49 -0500 Received: from serrano.cc.columbia.edu (IDENT:cu41754@serrano.cc.columbia.edu [128.59.206.20]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA24502 for ; Wed, 15 Dec 2004 13:16:43 -0500 (EST) Received: from [192.168.1.66] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by serrano.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iBFIGg9A000596 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 15 Dec 2004 13:16:42 -0500 (EST) Message-ID: <41C07FD6.9000207@columbia.edu> Date: Wed, 15 Dec 2004 13:17:58 -0500 From: Jeffrey Altman Organization: Not Affiliated with Columbia University in the City of New York User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.20 Subject: [Fwd: ID-submission:draft-ietf-kitten-2478bis-03.txt] X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0388358783==" Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: a5a8a60129fe3976c020eb42cc5130e4 This is a cryptographically signed message in MIME format. --===============0388358783== Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms090806070303040302010308" This is a cryptographically signed message in MIME format. --------------ms090806070303040302010308 Content-Type: multipart/mixed; boundary="------------040901070804050505050603" This is a multi-part message in MIME format. --------------040901070804050505050603 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Here is a copy of the -03 draft which Larry submitted yesterday. --------------040901070804050505050603 Content-Type: message/rfc822; name="ID-submission:draft-ietf-kitten-2478bis-03.txt" Content-Disposition: inline; filename="ID-submission:draft-ietf-kitten-2478bis-03.txt" Return-Path: Received: from mail2.microsoft.com (mail2.microsoft.com [131.107.3.124]) by dewberry.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iBEG1f4v025125 for ; Tue, 14 Dec 2004 11:01:41 -0500 (EST) Received: from mailout2.microsoft.com ([157.54.1.120]) by mail2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 14 Dec 2004 08:01:41 -0800 Received: from red-hub-01.redmond.corp.microsoft.com ([157.54.7.71]) by mailout2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 14 Dec 2004 08:01:40 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-01.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Tue, 14 Dec 2004 08:01:39 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Tue, 14 Dec 2004 08:01:39 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C4E1F6.26BED9C3" Subject: ID-submission:draft-ietf-kitten-2478bis-03.txt Date: Tue, 14 Dec 2004 08:01:20 -0800 Message-ID: X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: ID-submission:draft-ietf-kitten-2478bis-03.txt Thread-Index: AcTQs3j/cb9xF6Q+Q+uPNk2+At7ebAAJrebAABUliSABLWSzcACEgV8QAn/fieA= From: "Liqiang\(Larry\) Zhu" To: Cc: "Jeffrey Altman" , "Wyllys Ingersoll" X-OriginalArrivalTime: 14 Dec 2004 16:01:39.0353 (UTC) FILETIME=[32319090:01C4E1F6] X-No-Spam-Score: Too long X-Scanned-By: MIMEDefang 2.48 on 128.59.59.68 This is a multi-part message in MIME format. ------_=_NextPart_001_01C4E1F6.26BED9C3 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable =20 =20 RFC editors, This is an update for our existing document. This is a workinggroup document for the KITTEN workinggroup. ----------------------------------------------------------------- Title: The Simple and Protected GSS-API Negotiation Mechanism Authors: Zhu, L., Leach, P.J., Jaganathan, K., Ingersoll, W. Filename: draft-ietf-kitten-2478bis-03.txt Abstract: This document specifies a negotiation mechanism for the Generic Security Service Application Program Interface (GSS-API) which is described in RFC 2743. GSS-API peers can use this negotiation mechanism to choose from a common set of security mechanisms. If per-message integrity services are available on the established mechanism context, then the negotiation is protected against an attacker forcing the selection of a mechanism not desired by the peers. This mechanism replaces RFC 2478 in order to fix defects in that specification and to describe how to interoperate with implementations of that specification commonly deployed on the Internet. Size: 28 pages Expiry: June 16, 2005 Thanks, -- Larry ------_=_NextPart_001_01C4E1F6.26BED9C3 Content-Type: text/plain; name="draft-ietf-kitten-2478bis-03.txt" Content-Description: draft-ietf-kitten-2478bis-03.txt Content-Disposition: attachment; filename="draft-ietf-kitten-2478bis-03.txt" Content-Transfer-Encoding: base64 DQoNCk5FVFdPUksgV09SS0lORyBHUk9VUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEwuIFpodQ0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFAuIExlYWNoDQpPYnNvbGV0ZXM6IDI0NzggKGlm IGFwcHJvdmVkKSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEsuIEphZ2FuYXRoYW4NCkV4 cGlyZXM6IEp1bmUgMTQsIDIwMDUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1pY3Jvc29m dCBDb3Jwb3JhdGlvbg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgVy4gSW5nZXJzb2xsDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFN1biBNaWNyb3N5c3RlbXMNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEZWNlbWJlciAx NCwgMjAwNA0KDQoNCiAgICAgICAgIFRoZSBTaW1wbGUgYW5kIFByb3RlY3RlZCBHU1MtQVBJIE5l Z290aWF0aW9uIE1lY2hhbmlzbQ0KICAgICAgICAgICAgICAgICAgICAgICBkcmFmdC1pZXRmLWtp dHRlbi0yNDc4YmlzDQoNClN0YXR1cyBvZiB0aGlzIE1lbW8NCg0KICAgVGhpcyBkb2N1bWVudCBp cyBhbiBJbnRlcm5ldC1EcmFmdCBhbmQgaXMgc3ViamVjdCB0byBhbGwgcHJvdmlzaW9ucw0KICAg b2Ygc2VjdGlvbiAzIG9mIFJGQyAzNjY3LiAgQnkgc3VibWl0dGluZyB0aGlzIEludGVybmV0LURy YWZ0LCBlYWNoDQogICBhdXRob3IgcmVwcmVzZW50cyB0aGF0IGFueSBhcHBsaWNhYmxlIHBhdGVu dCBvciBvdGhlciBJUFIgY2xhaW1zIG9mDQogICB3aGljaCBoZSBvciBzaGUgaXMgYXdhcmUgaGF2 ZSBiZWVuIG9yIHdpbGwgYmUgZGlzY2xvc2VkLCBhbmQgYW55IG9mDQogICB3aGljaCBoZSBvciBz aGUgYmVjb21lIGF3YXJlIHdpbGwgYmUgZGlzY2xvc2VkLCBpbiBhY2NvcmRhbmNlIHdpdGgNCiAg IFJGQyAzNjY4Lg0KDQogICBJbnRlcm5ldC1EcmFmdHMgYXJlIHdvcmtpbmcgZG9jdW1lbnRzIG9m IHRoZSBJbnRlcm5ldCBFbmdpbmVlcmluZw0KICAgVGFzayBGb3JjZSAoSUVURiksIGl0cyBhcmVh cywgYW5kIGl0cyB3b3JraW5nIGdyb3Vwcy4gIE5vdGUgdGhhdA0KICAgb3RoZXIgZ3JvdXBzIG1h eSBhbHNvIGRpc3RyaWJ1dGUgd29ya2luZyBkb2N1bWVudHMgYXMNCiAgIEludGVybmV0LURyYWZ0 cy4NCg0KICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBkcmFmdCBkb2N1bWVudHMgdmFsaWQgZm9yIGEg bWF4aW11bSBvZiBzaXggbW9udGhzDQogICBhbmQgbWF5IGJlIHVwZGF0ZWQsIHJlcGxhY2VkLCBv ciBvYnNvbGV0ZWQgYnkgb3RoZXIgZG9jdW1lbnRzIGF0IGFueQ0KICAgdGltZS4gIEl0IGlzIGlu YXBwcm9wcmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBhcyByZWZlcmVuY2UNCiAgIG1hdGVy aWFsIG9yIHRvIGNpdGUgdGhlbSBvdGhlciB0aGFuIGFzICJ3b3JrIGluIHByb2dyZXNzLiINCg0K ICAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC1EcmFmdHMgY2FuIGJlIGFjY2Vzc2VkIGF0 DQogICBodHRwOi8vd3d3LmlldGYub3JnL2lldGYvMWlkLWFic3RyYWN0cy50eHQuDQoNCiAgIFRo ZSBsaXN0IG9mIEludGVybmV0LURyYWZ0IFNoYWRvdyBEaXJlY3RvcmllcyBjYW4gYmUgYWNjZXNz ZWQgYXQNCiAgIGh0dHA6Ly93d3cuaWV0Zi5vcmcvc2hhZG93Lmh0bWwuDQoNCiAgIFRoaXMgSW50 ZXJuZXQtRHJhZnQgd2lsbCBleHBpcmUgb24gSnVuZSAxNCwgMjAwNS4NCg0KQ29weXJpZ2h0IE5v dGljZQ0KDQogICBDb3B5cmlnaHQgKEMpIFRoZSBJbnRlcm5ldCBTb2NpZXR5ICgyMDA0KS4NCg0K QWJzdHJhY3QNCg0KICAgVGhpcyBkb2N1bWVudCBzcGVjaWZpZXMgYSBuZWdvdGlhdGlvbiBtZWNo YW5pc20gZm9yIHRoZSBHZW5lcmljDQogICBTZWN1cml0eSBTZXJ2aWNlIEFwcGxpY2F0aW9uIFBy b2dyYW0gSW50ZXJmYWNlIChHU1MtQVBJKSB3aGljaCBpcw0KICAgZGVzY3JpYmVkIGluIFJGQyAy NzQzLg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDE0LCAy MDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgMV0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdT Uy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCiAg IEdTUy1BUEkgcGVlcnMgY2FuIHVzZSB0aGlzIG5lZ290aWF0aW9uIG1lY2hhbmlzbSB0byBjaG9v c2UgZnJvbSBhDQogICBjb21tb24gc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMuDQoNCiAgIElm IHBlci1tZXNzYWdlIGludGVncml0eSBzZXJ2aWNlcyBhcmUgYXZhaWxhYmxlIG9uIHRoZSBlc3Rh Ymxpc2hlZA0KICAgbWVjaGFuaXNtIGNvbnRleHQsIHRoZW4gdGhlIG5lZ290aWF0aW9uIGlzIHBy b3RlY3RlZCBhZ2FpbnN0IGFuDQogICBhdHRhY2tlciBmb3JjaW5nIHRoZSBzZWxlY3Rpb24gb2Yg YSBtZWNoYW5pc20gbm90IGRlc2lyZWQgYnkgdGhlDQogICBwZWVycy4NCg0KICAgVGhpcyBtZWNo YW5pc20gcmVwbGFjZXMgUkZDIDI0NzggaW4gb3JkZXIgdG8gZml4IGRlZmVjdHMgaW4gdGhhdA0K ICAgc3BlY2lmaWNhdGlvbiBhbmQgdG8gZGVzY3JpYmUgaG93IHRvIGludGVyb3BlcmF0ZSB3aXRo DQogICBpbXBsZW1lbnRhdGlvbnMgb2YgdGhhdCBzcGVjaWZpY2F0aW9uIGNvbW1vbmx5IGRlcGxv eWVkIG9uIHRoZQ0KICAgSW50ZXJuZXQuDQoNClRhYmxlIG9mIENvbnRlbnRzDQoNCiAgIDEuICBJ bnRyb2R1Y3Rpb24gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAgMw0KICAgMi4gIENvbnZlbnRpb25zIFVzZWQgaW4gVGhpcyBEb2N1bWVudCAgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuICA1DQogICAzLiAgTmVnb3RpYXRpb24gUHJvdG9jb2wgLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDYNCiAgICAgMy4xICAgTmVn b3RpYXRpb24gRGVzY3JpcHRpb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAg Ng0KICAgICAzLjIgICBOZWdvdGlhdGlvbiBQcm9jZWR1cmUgIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuICA3DQogICA0LiAgVG9rZW4gRGVmaW5pdGlvbnMgIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTANCiAgICAgNC4xICAgTWVjaGFuaXNt IFR5cGVzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxMA0KICAg ICA0LjIgICBOZWdvdGlhdGlvbiBUb2tlbnMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIDEwDQogICAgICAgNC4yLjEgICBuZWdUb2tlbkluaXQgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTENCiAgICAgICA0LjIuMiAgIG5lZ1Rva2VuUmVz cCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxMg0KICAgNS4gIFBy b2Nlc3Npbmcgb2YgbWVjaExpc3RNSUMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIDE0DQogICA2LiAgRXh0ZW5zaWJpbGl0eSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gMTcNCiAgIDcuICBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyAg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxOA0KICAgOC4gIElBTkEgQ29u c2lkZXJhdGlvbnMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDE5 DQogICA5LiAgQWNrbm93bGVkZ21lbnRzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gMjANCiAgIDEwLiAgIFJlZmVyZW5jZXMgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyMQ0KICAgMTAuMSAgTm9ybWF0aXZlIFJl ZmVyZW5jZXMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIxDQogICAx MC4yICBJbmZvcm1hdGl2ZSBSZWZlcmVuY2VzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gMjENCiAgICAgICBBdXRob3JzJyBBZGRyZXNzZXMgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAyMQ0KICAgQS4gIEdTUy1BUEkgTmVnb3RpYXRpb24g U3VwcG9ydCBBUEkgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIzDQogICAgIEEuMSAg IEdTU19TZXRfbmVnX21lY2hzIGNhbGwgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gMjMNCiAgICAgQS4yICAgR1NTX0dldF9uZWdfbWVjaHMgY2FsbCAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAyMw0KICAgQi4gIENoYW5nZXMgc2luY2UgUkZDMjQ3OCAgLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDI1DQogICBDLiAgbWVjaExpc3RN SUMgQ29tcHV0YXRpb24gRXhhbXBsZSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMjcN CiAgICAgICBJbnRlbGxlY3R1YWwgUHJvcGVydHkgYW5kIENvcHlyaWdodCBTdGF0ZW1lbnRzIC4g LiAuIC4gLiAuIC4gLiAyOA0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAg ICAgICAgICBFeHBpcmVzIEp1bmUgMTQsIDIwMDUgICAgICAgICAgICAgICAgICBbUGFnZSAyXQ0K DA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAg ICAgICBEZWNlbWJlciAyMDA0DQoNCg0KMS4gIEludHJvZHVjdGlvbg0KDQogICBUaGUgR1NTLUFQ SSBbUkZDMjc0M10gcHJvdmlkZXMgYSBnZW5lcmljIGludGVyZmFjZSB3aGljaCBjYW4gYmUNCiAg IGxheWVyZWQgYXRvcCBkaWZmZXJlbnQgc2VjdXJpdHkgbWVjaGFuaXNtcyBzdWNoIHRoYXQgaWYg Y29tbXVuaWNhdGluZw0KICAgcGVlcnMgYWNxdWlyZSBHU1MtQVBJIGNyZWRlbnRpYWxzIGZvciB0 aGUgc2FtZSBzZWN1cml0eSBtZWNoYW5pc20sDQogICB0aGVuIGEgc2VjdXJpdHkgY29udGV4dCBt YXkgYmUgZXN0YWJsaXNoZWQgYmV0d2VlbiB0aGVtIChzdWJqZWN0IHRvDQogICBwb2xpY3kpLiAg SG93ZXZlciwgR1NTLUFQSSBkb2VzIG5vdCBwcmVzY3JpYmUgdGhlIG1ldGhvZCBieSB3aGljaA0K ICAgR1NTLUFQSSBwZWVycyBjYW4gZXN0YWJsaXNoIHdoZXRoZXIgdGhleSBoYXZlIGEgY29tbW9u IHNlY3VyaXR5DQogICBtZWNoYW5pc20uDQoNCiAgIFRoZSBTaW1wbGUgYW5kIFByb3RlY3RlZCBH U1MtQVBJIE5lZ290aWF0aW9uIChTUE5FR08pIG1lY2hhbmlzbQ0KICAgZGVmaW5lZCBoZXJlIGlz IGEgcHNldWRvIHNlY3VyaXR5IG1lY2hhbmlzbSwgcmVwcmVzZW50ZWQgYnkgdGhlDQogICBPYmpl Y3QgSWRlbnRpZmllciBpc28ub3JnLmRvZC5pbnRlcm5ldC5zZWN1cml0eS5tZWNoYW5pc20uc25l Z28NCiAgICgxLjMuNi4xLjUuNS4yKSwgd2hpY2ggZW5hYmxlcyBHU1MtQVBJIHBlZXJzIHRvIGRl dGVybWluZSBpbi1iYW5kDQogICB3aGV0aGVyIHRoZWlyIGNyZWRlbnRpYWxzIHN1cHBvcnQgYSBj b21tb24gc2V0IG9mIG9uZSBvciBtb3JlIEdTUy1BUEkNCiAgIHNlY3VyaXR5IG1lY2hhbmlzbXMs IGFuZCBpZiBzbywgdG8gaW52b2tlIHRoZSBub3JtYWwgc2VjdXJpdHkgY29udGV4dA0KICAgZXN0 YWJsaXNobWVudCBmb3IgYSBzZWxlY3RlZCBjb21tb24gc2VjdXJpdHkgbWVjaGFuaXNtLiAgVGhp cyBpcyBtb3N0DQogICB1c2VmdWwgZm9yIGFwcGxpY2F0aW9ucyB3aGljaCBkZXBlbmQgb24gR1NT LUFQSSBpbXBsZW1lbnRhdGlvbnMgYW5kDQogICBzaGFyZSBtdWx0aXBsZSBtZWNoYW5pc21zIGJl dHdlZW4gdGhlIHBlZXJzLg0KDQogICBUaGUgU1BORUdPIG1lY2hhbmlzbSBuZWdvdGlhdGlvbiBp cyBiYXNlZCBvbiB0aGUgZm9sbG93aW5nIG1vZGVsOiB0aGUNCiAgIGluaXRpYXRvciBwcm9wb3Nl cyBhIGxpc3Qgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtKHMpLCBpbiBkZWNyZWFzaW5nDQogICBwcmVm ZXJlbmNlIG9yZGVyIChmYXZvcml0ZSBjaG9pY2UgZmlyc3QpLCB0aGUgYWNjZXB0b3IgKGFsc28g a25vd24gYXMNCiAgIHRoZSB0YXJnZXQpIGVpdGhlciBhY2NlcHRzIHRoZSBpbml0aWF0b3IncyBw cmVmZXJyZWQgc2VjdXJpdHkNCiAgIG1lY2hhbmlzbSAodGhlIGZpcnN0IGluIHRoZSBsaXN0KSwg b3IgY2hvb3NlcyBvbmUgdGhhdCBpcyBhdmFpbGFibGUNCiAgIGZyb20gdGhlIG9mZmVyZWQgbGlz dCwgb3IgcmVqZWN0cyB0aGUgcHJvcG9zZWQgdmFsdWUocykuICBUaGUgdGFyZ2V0DQogICB0aGVu IGluZm9ybXMgdGhlIGluaXRpYXRvciBvZiBpdHMgY2hvaWNlLg0KDQogICBPbmNlIGEgY29tbW9u IHNlY3VyaXR5IG1lY2hhbmlzbSBpcyBjaG9zZW4sIG1lY2hhbmlzbS1zcGVjaWZpYw0KICAgb3B0 aW9ucyBNQVkgYmUgbmVnb3RpYXRlZCBhcyBwYXJ0IG9mIHRoZSBzZWxlY3RlZCBtZWNoYW5pc20n cyBjb250ZXh0DQogICBlc3RhYmxpc2htZW50LiAgVGhlc2UgbmVnb3RpYXRpb25zIChpZiBhbnkp IGFyZSBpbnRlcm5hbCB0byB0aGUNCiAgIG1lY2hhbmlzbSBhbmQgb3BhcXVlIHRvIHRoZSBTUE5F R08gcHJvdG9jb2wuICBBcyBzdWNoIHRoZXkgYXJlDQogICBvdXRzaWRlIHRoZSBzY29wZSBvZiB0 aGlzIGRvY3VtZW50Lg0KDQogICBJZiBwZXItbWVzc2FnZSBpbnRlZ3JpdHkgc2VydmljZXMgYXJl IGF2YWlsYWJsZSBvbiB0aGUgZXN0YWJsaXNoZWQNCiAgIG1lY2hhbmlzbSBzZWN1cml0eSBjb250 ZXh0LCB0aGVuIHRoZSBuZWdvdGlhdGlvbiBpcyBwcm90ZWN0ZWQgdG8NCiAgIGVuc3VyZSB0aGF0 IHRoZSBtZWNoYW5pc20gbGlzdCBoYXMgbm90IGJlZW4gbW9kaWZpZWQuICBJbiBjYXNlcyB3aGVy ZQ0KICAgYW4gYXR0YWNrZXIgY291bGQgaGF2ZSBtYXRlcmlhbGx5IGluZmx1ZW5jZWQgdGhlIG5l Z290aWF0aW9uLCBwZWVycw0KICAgZXhjaGFuZ2UgbWVzc2FnZSBpbnRlZ3JpdHkgY29kZSAoTUlD KSB0b2tlbnMgdG8gY29uZmlybSB0aGUgbWVjaGFuaXNtDQogICBsaXN0IGhhcyBub3QgYmVlbiBt b2RpZmllZC4gIElmIG5vIGFjdGlvbiBvZiBhbiBhdHRhY2tlciBjb3VsZCBoYXZlDQogICBtYXRl cmlhbGx5IG1vZGlmaWVkIHRoZSBvdXRjb21lIG9mIHRoZSBuZWdvdGlhdGlvbiwgdGhlIGV4Y2hh bmdlIG9mDQogICBNSUMgdG9rZW5zIGlzIG9wdGlvbmFsIChzZWUgU2VjdGlvbiA1KS4gIEFsbG93 aW5nIE1JQyB0b2tlbnMgdG8gYmUNCiAgIG9wdGlvbmFsIGluIHRoaXMgY2FzZSBwcm92aWRlcyBp bnRlcm9wZXJhYmlsaXR5IHdpdGggZXhpc3RpbmcNCiAgIGltcGxlbWVudGF0aW9ucyB3aGlsZSBz dGlsbCBwcm90ZWN0aW5nIHRoZSBuZWdvdGlhdGlvbi4gIFRoaXMNCiAgIGludGVyb3BlcmFiaWxp dHkgY29tZXMgYXQgdGhlIGNvc3Qgb2YgaW5jcmVhc2VkIGNvbXBsZXhpdHkuDQoNCiAgIEluIG9y ZGVyIHRvIGF2b2lkIGFuIGV4dHJhIHJvdW5kIHRyaXAsIHRoZSBmaXJzdCBjb250ZXh0DQogICBl c3RhYmxpc2htZW50IHRva2VuIG9mIHRoZSBpbml0aWF0b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNt IFNIT1VMRCBiZQ0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAx NCwgMjAwNSAgICAgICAgICAgICAgICAgIFtQYWdlIDNdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAg ICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0K DQogICBlbWJlZGRlZCBpbiB0aGUgaW5pdGlhbCBuZWdvdGlhdGlvbiBtZXNzYWdlIChhcyBkZWZp bmVkIGluIFNlY3Rpb24NCiAgIDQuMikuICAoVGhpcyBtZWNoYW5pc20gdG9rZW4gaXMgcmVmZXJy ZWQgdG8gYXMgdGhlIG9wdGltaXN0aWMNCiAgIG1lY2hhbmlzbSB0b2tlbiBpbiB0aGlzIGRvY3Vt ZW50LikgSW4gYWRkaXRpb24sIHVzaW5nIHRoZSBvcHRpbWlzdGljDQogICBtZWNoYW5pc20gdG9r ZW4gYWxsb3dzIHRoZSBpbml0aWF0b3IgdG8gcmVjb3ZlciBmcm9tIG5vbi1mYXRhbCBlcnJvcnMN CiAgIGVuY291bnRlcmVkIHRyeWluZyB0byBwcm9kdWNlIHRoZSBmaXJzdCBtZWNoYW5pc20gdG9r ZW4gYmVmb3JlIGENCiAgIG1lY2hhbmlzbSBjYW4gYmUgc2VsZWN0ZWQuICBJbXBsZW1lbnRhdGlv bnMgTUFZIG9taXQgdGhlIG9wdGltaXN0aWMNCiAgIG1lY2hhbmlzbSB0b2tlbiBpbiBjYXNlcyB3 aGVyZSB0aGUgbGlrZWxpaG9vZCBvZiB0aGUgaW5pdGlhdG9yJ3MNCiAgIHByZWZlcnJlZCBtZWNo YW5pc20gbm90IGJlaW5nIHNlbGVjdGVkIGJ5IHRoZSBhY2NlcHRvciBpcyBzaWduaWZpY2FudA0K ICAgZ2l2ZW4gdGhlIGNvc3Qgb2YgZ2VuZXJhdGluZyBpdC4NCg0KICAgU1BORUdPIHJlbGllcyBv biB0aGUgY29uY2VwdHMgZGV2ZWxvcGVkIGluIHRoZSBHU1MtQVBJIHNwZWNpZmljYXRpb24NCiAg IFtSRkMyNzQzXS4gIFRoZSBuZWdvdGlhdGlvbiBkYXRhIGlzIGVuY2Fwc3VsYXRlZCBpbiBjb250 ZXh0LWxldmVsDQogICB0b2tlbnMuICBUaGVyZWZvcmUsIGNhbGxlcnMgb2YgdGhlIEdTUy1BUEkg ZG8gbm90IG5lZWQgdG8gYmUgYXdhcmUgb2YNCiAgIHRoZSBleGlzdGVuY2Ugb2YgdGhlIG5lZ290 aWF0aW9uIHRva2VucyBidXQgb25seSBvZiB0aGUgbmV3DQogICBwc2V1ZG8tc2VjdXJpdHkgbWVj aGFuaXNtLiAgQSBmYWlsdXJlIGluIHRoZSBuZWdvdGlhdGlvbiBwaGFzZSBjYXVzZXMNCiAgIGEg bWFqb3Igc3RhdHVzIGNvZGUgdG8gYmUgcmV0dXJuZWQ6IEdTU19TX0JBRF9NRUNILg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTQsIDIwMDUgICAg ICAgICAgICAgICAgICBbUGFnZSA0XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBO ZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KMi4gIENvbnZl bnRpb25zIFVzZWQgaW4gVGhpcyBEb2N1bWVudA0KDQogICBUaGUga2V5IHdvcmRzICJNVVNUIiwg Ik1VU1QgTk9UIiwgIlJFUVVJUkVEIiwgIlNIQUxMIiwgIlNIQUxMIE5PVCIsDQogICAiU0hPVUxE IiwgIlNIT1VMRCBOT1QiLCAiUkVDT01NRU5ERUQiLCAiTUFZIiwgYW5kICJPUFRJT05BTCIgaW4g dGhpcw0KICAgZG9jdW1lbnQgYXJlIHRvIGJlIGludGVycHJldGVkIGFzIGRlc2NyaWJlZCBpbiBb UkZDMjExOV0uDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwu ICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTQsIDIwMDUgICAgICAgICAgICAgICAgICBbUGFn ZSA1XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5p c20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KMy4gIE5lZ290aWF0aW9uIFByb3RvY29sDQoN CiAgIFdoZW4gdGhlIGVzdGFibGlzaGVkIG1lY2hhbmlzbSBjb250ZXh0IHByb3ZpZGVzIGludGVn cml0eSBwcm90ZWN0aW9uLA0KICAgdGhlIG1lY2hhbmlzbSBuZWdvdGlhdGlvbiBjYW4gYmUgcHJv dGVjdGVkLiAgV2hlbiBhY3F1aXJpbmcNCiAgIG5lZ290aWF0ZWQgc2VjdXJpdHkgbWVjaGFuaXNt IHRva2VucywgcGVyLW1lc3NhZ2UgaW50ZWdyaXR5IHNlcnZpY2VzDQogICBhcmUgYWx3YXlzIHJl cXVlc3RlZCBieSB0aGUgU1BORUdPIG1lY2hhbmlzbS4NCg0KICAgV2hlbiB0aGUgZXN0YWJsaXNo ZWQgbWVjaGFuaXNtIGNvbnRleHQgc3VwcG9ydHMgcGVyLW1lc3NhZ2UgaW50ZWdyaXR5DQogICBz ZXJ2aWNlcywgU1BORUdPIGd1YXJhbnRlZXMgdGhhdCB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtIGlz IG11dHVhbGx5DQogICBwcmVmZXJyZWQuDQoNCiAgIFRoaXMgc2VjdGlvbiBkZXNjcmliZXMgdGhl IG5lZ290aWF0aW9uIHByb2Nlc3Mgb2YgdGhpcyBwcm90b2NvbC4NCg0KMy4xICBOZWdvdGlhdGlv biBEZXNjcmlwdGlvbg0KDQogICBUaGUgZmlyc3QgbmVnb3RpYXRpb24gdG9rZW4gc2VudCBieSB0 aGUgaW5pdGlhdG9yIGNvbnRhaW5zIGFuIG9yZGVyZWQNCiAgIGxpc3Qgb2YgbWVjaGFuaXNtcyBp biBkZWNyZWFzaW5nIHByZWZlcmVuY2Ugb3JkZXIgKGZhdm9yaXRlIG1lY2hhbmlzbQ0KICAgZmly c3QpLCBhbmQgb3B0aW9uYWxseSB0aGUgaW5pdGlhbCBtZWNoYW5pc20gdG9rZW4gZm9yIHRoZSBw cmVmZXJyZWQNCiAgIG1lY2hhbmlzbSBvZiB0aGUgaW5pdGlhdG9yIChpLmUuLCB0aGUgZmlyc3Qg aW4gdGhlIGxpc3QpLiAgKE5vdGUgdGhhdA0KICAgdGhlIGxpc3QgTVVTVCBOT1QgY29udGFpbiBt ZWNoYW5pc21zIGZvciB3aGljaCB0aGUgY2xpZW50IGRvZXMgbm90DQogICBoYXZlIGFwcHJvcHJp YXRlIGNyZWRlbnRpYWxzLikNCg0KICAgVGhlIHRhcmdldCB0aGVuIHByb2Nlc3NlcyB0aGUgdG9r ZW4gZnJvbSB0aGUgaW5pdGlhdG9yLiAgVGhpcyB3aWxsDQogICByZXN1bHQgaW4gb25lIG9mIGZv dXIgcG9zc2libGUgc3RhdGVzIChhcyBkZWZpbmVkIGluIFNlY3Rpb24gNC4yLjIpDQogICBiZWlu ZyByZXR1cm5lZCBpbiB0aGUgcmVwbHkgbWVzc2FnZTogYWNjZXB0X2NvbXBsZXRlZCwNCiAgIGFj Y2VwdF9pbmNvbXBsZXRlLCByZWplY3QsIG9yIHJlcXVlc3RfbWljLiAgQSByZWplY3Qgc3RhdGUg d2lsbA0KICAgdGVybWluYXRlIHRoZSBuZWdvdGlhdGlvbjsgIGFuIGFjY2VwdF9jb21wbGV0ZWQg c3RhdGUgaW5kaWNhdGVzIHRoYXQNCiAgIG5vdCBvbmx5IHdhcyB0aGUgaW5pdGlhdG9yLXNlbGVj dGVkIG1lY2hhbmlzbSBhY2NlcHRhYmxlIHRvIHRoZQ0KICAgdGFyZ2V0LCBidXQgYWxzbyB0aGF0 IHRoZSBvcHRpbWlzdGljIG1lY2hhbmlzbSB0b2tlbiB3YXMgc3VmZmljaWVudA0KICAgdG8gY29t cGxldGUgdGhlIGF1dGhlbnRpY2F0aW9uOyAgYW4gYWNjZXB0X2luY29tcGxldGUgc3RhdGUgaW5k aWNhdGVzDQogICB0aGF0IGZ1cnRoZXIgbWVzc2FnZSBleGNoYW5nZSBpcyBuZWVkZWQgYnV0IHRo ZSBNSUMgdG9rZW4gZXhjaGFuZ2UgYXMNCiAgIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDUgaXMgT1BU SU9OQUw7ICBhIHJlcXVlc3RfbWljIHN0YXRlICh0aGlzIHN0YXRlDQogICBjYW4gb25seSBiZSBw cmVzZW50IGluIHRoZSBmaXJzdCByZXBseSBtZXNzYWdlIGZyb20gdGhlIHRhcmdldCkNCiAgIGlu ZGljYXRlcyB0aGUgTUlDIHRva2VuIGV4Y2hhbmdlIGlzIFJFUVVJUkVEIGlmIHBlci1tZXNzYWdl IGludGVncml0eQ0KICAgc2VydmljZXMgYXJlIGF2YWlsYWJsZS4NCg0KICAgVW5sZXNzIHRoZSBw cmVmZXJlbmNlIG9yZGVyIGlzIHNwZWNpZmllZCBieSB0aGUgYXBwbGljYXRpb24gKHNlZQ0KICAg QXBwZW5kaXggQSksIHRoZSBwb2xpY3kgYnkgd2hpY2ggdGhlIHRhcmdldCBjaG9vc2VzIGEgbWVj aGFuaXNtIGlzIGFuDQogICBpbXBsZW1lbnRhdGlvbi1zcGVjaWZpYyBsb2NhbCBtYXR0ZXIuICBJ biB0aGUgYWJzZW5jZSBvZiBhbg0KICAgYXBwbGljYXRpb24gc3BlY2lmaWVkIHByZWZlcmVuY2Ug b3JkZXIgb3Igb3RoZXIgcG9saWN5LCB0aGUgdGFyZ2V0DQogICBTSEFMTCBjaG9vc2UgdGhlIGZp cnN0IG1lY2hhbmlzbSBpbiB0aGUgaW5pdGlhdG9yIHByb3Bvc2VkIGxpc3QgZm9yDQogICB3aGlj aCBpdCBoYXMgdmFsaWQgY3JlZGVudGlhbHMuDQoNCiAgIEluIGNhc2Ugb2YgYSBzdWNjZXNzZnVs IG5lZ290aWF0aW9uLCB0aGUgc2VjdXJpdHkgbWVjaGFuaXNtIGluIHRoZQ0KICAgZmlyc3QgcmVw bHkgbWVzc2FnZSByZXByZXNlbnRzIHRoZSB2YWx1ZSBzdWl0YWJsZSBmb3IgdGhlIHRhcmdldCwN CiAgIGNob3NlbiBmcm9tIHRoZSBsaXN0IG9mZmVyZWQgYnkgdGhlIGluaXRpYXRvci4NCg0KICAg SW4gY2FzZSBvZiBhbiB1bnN1Y2Nlc3NmdWwgbmVnb3RpYXRpb24sIHRoZSByZWplY3Qgc3RhdGUg aXMgcmV0dXJuZWQNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUg MTQsIDIwMDUgICAgICAgICAgICAgICAgICBbUGFnZSA2XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAg ICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoN Cg0KICAgYW5kIGl0IGlzIE9QVElPTkFMIHRvIGVtaXQgYSBjb250ZXh0IGxldmVsIG5lZ290aWF0 aW9uIHRva2VuLg0KDQogICBPbmNlIGEgbWVjaGFuaXNtIGhhcyBiZWVuIHNlbGVjdGVkLCBjb250 ZXh0IGVzdGFibGlzaG1lbnQgdG9rZW5zDQogICBzcGVjaWZpYyB0byB0aGUgc2VsZWN0ZWQgbWVj aGFuaXNtIGFyZSBjYXJyaWVkIHdpdGhpbiB0aGUgbmVnb3RpYXRpb24NCiAgIHRva2Vucy4NCg0K ICAgTGFzdGx5LCBNSUMgdG9rZW5zIG1heSBiZSBleGNoYW5nZWQgdG8gZW5zdXJlIHRoZSBhdXRo ZW50aWNpdHkgb2YgdGhlDQogICBtZWNoYW5pc20gbGlzdCByZWNlaXZlZCBieSB0aGUgdGFyZ2V0 Lg0KDQogICBUbyBhdm9pZCBjb25mbGljdHMgd2l0aCB0aGUgdXNlIG9mIE1JQyB0b2tlbnMgYnkg U1BORUdPLA0KICAgcGFydGlhbGx5LWVzdGFibGlzaGVkIGNvbnRleHRzIE1VU1QgTk9UIGJlIHVz ZWQgZm9yIHBlci1tZXNzYWdlDQogICBjYWxscy4gIFRvIGd1YXJhbnRlZSB0aGlzLCB0aGUgcHJv dF9yZWFkeV9zdGF0ZSBbUkZDMjc0M10gTVVTVCBiZSBzZXQNCiAgIHRvIGZhbHNlIG9uIHJldHVy biBmcm9tIEdTU19Jbml0X3NlY19jb250ZXh0KCkgYW5kDQogICBHU1NfQWNjZXB0X3NlY19jb250 ZXh0KCkgZXZlbiBpZiB0aGUgdW5kZXJseWluZyBtZWNoYW5pc20gcmV0dXJuZWQNCiAgIHRydWUu DQoNCjMuMiAgTmVnb3RpYXRpb24gUHJvY2VkdXJlDQoNCiAgIFRoZSBiYXNpYyBmb3JtIG9mIHRo ZSBwcm9jZWR1cmUgYXNzdW1lcyB0aGF0IHBlci1tZXNzYWdlIGludGVncml0eQ0KICAgc2Vydmlj ZXMgYXJlIGF2YWlsYWJsZSBvbiB0aGUgZXN0YWJsaXNoZWQgbWVjaGFuaXNtIGNvbnRleHQsIGFu ZCBpdA0KICAgaXMgc3VtbWFyaXplZCBhcyBmb2xsb3dzOg0KDQogICAoYSkgVGhlIEdTUy1BUEkg aW5pdGlhdG9yIGludm9rZXMgR1NTX0luaXRfc2VjX2NvbnRleHQoKSBhcyBub3JtYWwsDQogICAg ICBidXQgcmVxdWVzdHMgdGhhdCBTUE5FR08gYmUgdXNlZC4gIFNQTkVHTyBjYW4gZWl0aGVyIGJl IGV4cGxpY2l0eQ0KICAgICAgcmVxdWVzdGVkIG9yIGFjY2VwdGVkIGFzIHRoZSBkZWZhdWx0IG1l Y2hhbmlzbS4NCg0KICAgKGIpIFRoZSBpbml0aWF0b3IgR1NTLUFQSSBpbXBsZW1lbnRhdGlvbiBl bWl0cyBhIG5lZ290aWF0aW9uIHRva2VuDQogICAgICBjb250YWluaW5nIGEgbGlzdCBvZiBvbmUg b3IgbW9yZSBzZWN1cml0eSBtZWNoYW5pc21zIHRoYXQgYXJlDQogICAgICBhdmFpbGFibGUgYmFz ZWQgb24gdGhlIGNyZWRlbnRpYWxzIHVzZWQgZm9yIHRoaXMgY29udGV4dA0KICAgICAgZXN0YWJs aXNobWVudCwgYW5kIG9wdGlvbmFsbHkgdGhlIGluaXRpYWwgbWVjaGFuaXNtIHRva2VuIGZvciB0 aGUNCiAgICAgIGZpcnN0IG1lY2hhbmlzbSBpbiB0aGUgbGlzdC4NCg0KICAgKGMpIFRoZSBHU1Mt QVBJIGluaXRpYXRvciBhcHBsaWNhdGlvbiBzZW5kcyB0aGUgdG9rZW4gdG8gdGhlIHRhcmdldA0K ICAgICAgYXBwbGljYXRpb24uICBUaGUgR1NTLUFQSSB0YXJnZXQgYXBwbGljYXRpb24gZGVwb3Np dHMgdGhlIHRva2VuIGJ5DQogICAgICBpbnZva2luZyBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCku ICBUaGUgYWNjZXB0b3Igd2lsbCBkbyBvbmUgb2YNCiAgICAgIHRoZSBmb2xsb3dpbmc6DQoNCg0K ICAgICAgICAgKEkpIElmIG5vbmUgb2YgdGhlIHByb3Bvc2VkIG1lY2hhbmlzbXMgYXJlIGFjY2Vw dGFibGUsIHRoZQ0KICAgICAgICAgICAgbmVnb3RpYXRpb24gU0hBTEwgYmUgdGVybWluYXRlZC4g IEdTU19BY2NlcHRfc2VjX2NvbnRleHQNCiAgICAgICAgICAgIGluZGljYXRlcyBHU1NfU19CQURf TUVDSC4gIFRoZSBhY2NlcHRvciBNQVkgb3V0cHV0IGENCiAgICAgICAgICAgIG5lZ290aWF0aW9u IHRva2VuIGNvbnRhaW5pbmcgYSByZWplY3Qgc3RhdGUuDQoNCiAgICAgICAgIChJSSkgSWYgZWl0 aGVyIHRoZSBpbml0aWF0b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNtIGlzIG5vdA0KICAgICAgICAg ICAgYWNjZXB0ZWQgYnkgdGhlIHRhcmdldCBvciB0aGlzIG1lY2hhbmlzbSBpcyBhY2NlcHRlZCBi dXQgaXQNCiAgICAgICAgICAgIGlzIG5vdCB0aGUgYWNjZXB0b3IncyBtb3N0IHByZWZlcnJlZCBt ZWNoYW5pc20gKGkuZS4sIHRoZQ0KICAgICAgICAgICAgTUlDIHRva2VuIGV4Y2hhbmdlIGFzIGRl c2NyaWJlZCBpbiBTZWN0aW9uIDUgaXMgcmVxdWlyZWQpLA0KICAgICAgICAgICAgR1NTX0FjY2Vw dF9zZWNfY29udGV4dCgpIGluZGljYXRlcyBHU1NfU19DT05USU5VRV9ORUVERUQuDQoNCg0KDQpa aHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDE0LCAyMDA1ICAgICAgICAgICAg ICAgICAgW1BhZ2UgN10NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRp b24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCiAgICAgICAgICAgIFRoZSBh Y2NlcHRvciBNVVNUIG91dHB1dCBhIG5lZ290aWF0aW9uIHRva2VuIGNvbnRhaW5pbmcgYQ0KICAg ICAgICAgICAgcmVxdWVzdF9taWMgc3RhdGUuDQoNCiAgICAgICAgIChJSUkpIE90aGVyd2lzZSBp ZiBhdCBsZWFzdCBvbmUgYWRkaXRpb25hbCBuZWdvdGlhdGlvbiB0b2tlbg0KICAgICAgICAgICAg ZnJvbSB0aGUgaW5pdGlhdG9yIGlzIG5lZWRlZCB0byBlc3RhYmxpc2ggdGhpcyBjb250ZXh0LA0K ICAgICAgICAgICAgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgpIGluZGljYXRlcyBHU1NfU19DT05U SU5VRV9ORUVERUQgYW5kDQogICAgICAgICAgICBvdXRwdXRzIGEgbmVnb3RpYXRpb24gdG9rZW4g Y29udGFpbmluZyBhbiBhY2NlcHRfaW5jb21wbGV0ZQ0KICAgICAgICAgICAgc3RhdGUuDQoNCiAg ICAgICAgIChJVikgT3RoZXJ3aXNlIG5vIGFkZGl0aW9uYWwgbmVnb3RpYXRpb24gdG9rZW4gZnJv bSB0aGUNCiAgICAgICAgICAgIGluaXRpYXRvciBpcyBuZWVkZWQgdG8gZXN0YWJsaXNoIHRoaXMg Y29udGV4dCwNCiAgICAgICAgICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMg R1NTX1NfQ09NUExFVEUgYW5kDQogICAgICAgICAgICBvdXRwdXRzIGEgbmVnb3RpYXRpb24gdG9r ZW4gY29udGFpbmluZyBhbiBhY2NlcHRfY29tcGxldGUNCiAgICAgICAgICAgIHN0YXRlLg0KDQog ICAgICBJZiB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSBpcyBhY2NlcHRlZCwg YW5kIGFuDQogICAgICBvcHRpbWlzdGljIG1lY2hhbmlzbSB0b2tlbiB3YXMgaW5jbHVkZWQsIHRo aXMgbWVjaGFuaXNtIHRva2VuIE1VU1QNCiAgICAgIGJlIGRlcG9zaXRlZCB0byB0aGUgc2VsZWN0 ZWQgbWVjaGFuaXNtIGJ5IGludm9raW5nDQogICAgICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkg YW5kIGlmIGEgcmVzcG9uc2UgbWVjaGFuaXNtIHRva2VuIGlzDQogICAgICBlbWl0dGVkLCBpdCBN VVNUIGJlIGluY2x1ZGVkIGluIHRoZSByZXNwb25zZSBuZWdvdGlhdGlvbiB0b2tlbi4NCiAgICAg IE90aGVyd2lzZSwgdGhlIHRhcmdldCB3aWxsIG5vdCBlbWl0IGEgcmVzcG9uc2UgbWVjaGFuaXNt IHRva2VuIGluDQogICAgICB0aGUgZmlyc3QgcmVwbHkuDQoNCiAgIChkKSBUaGUgR1NTLUFQSSB0 YXJnZXQgYXBwbGljYXRpb24gcmV0dXJucyB0aGUgbmVnb3RpYXRpb24gdG9rZW4gdG8NCiAgICAg IHRoZSBpbml0aWF0b3IgYXBwbGljYXRpb24uICBUaGUgR1NTLUFQSSBpbml0aWF0b3IgYXBwbGlj YXRpb24NCiAgICAgIGRlcG9zaXRzIHRoZSB0b2tlbiBieSBpbnZva2luZyBHU1NfSW5pdF9zZWNf Y29udGV4dCgpLiAgVGhlDQogICAgICBzZWN1cml0eSBjb250ZXh0IGluaXRpYWxpemF0aW9uIGlz IHRoZW4gY29udGludWVkIGFjY29yZGluZyB0byB0aGUNCiAgICAgIHN0YW5kYXJkIEdTUy1BUEkg Y29udmVudGlvbnMgZm9yIHRoZSBzZWxlY3RlZCBtZWNoYW5pc20sIHdoZXJlIHRoZQ0KICAgICAg dG9rZW5zIG9mIHRoZSBzZWxlY3RlZCBtZWNoYW5pc20gYXJlIGVuY2Fwc3VsYXRlZCB1bnRpbCB0 aGUNCiAgICAgIEdTU19TX0NPTVBMRVRFIGlzIHJldHVybmVkIGZvciBib3RoIHRoZSBpbml0aWF0 b3IgYW5kIHRoZSB0YXJnZXQNCiAgICAgIGJ5IHRoZSBzZWxlY3RlZCBzZWN1cml0eSBtZWNoYW5p c20uDQoNCiAgIChlKSBNSUMgdG9rZW5zIGFyZSB0aGVuIGVpdGhlciBza2lwcGVkIG9yIGV4Y2hh bmdlZCBhY2NvcmRpbmcgdG8NCiAgICAgIFNlY3Rpb24gNS4NCg0KICAgTm90ZSB0aGF0IHRoZSAq X3JlcV9mbGFnIGlucHV0IHBhcmFtZXRlcnMgZm9yIGNvbnRleHQgZXN0YWJsaXNobWVudA0KICAg YXJlIHJlbGF0aXZlIHRvIHRoZSBzZWxlY3RlZCBtZWNoYW5pc20sIGFzIGFyZSB0aGUgKl9zdGF0 ZSBvdXRwdXQNCiAgIHBhcmFtZXRlcnMuICBpLmUuLCB0aGVzZSBwYXJhbWV0ZXJzIGFyZSBub3Qg YXBwbGljYWJsZSB0byB0aGUNCiAgIG5lZ290aWF0aW9uIHByb2Nlc3MgcGVyIHNlLg0KDQogICBP biByZWNlaXB0IG9mIGEgbmVnb3RpYXRpb24gdG9rZW4gb24gdGhlIHRhcmdldCBzaWRlLCBhIEdT Uy1BUEkNCiAgIGltcGxlbWVudGF0aW9uIHRoYXQgZG9lcyBub3Qgc3VwcG9ydCBuZWdvdGlhdGlv biB3b3VsZCBpbmRpY2F0ZSB0aGUNCiAgIEdTU19TX0JBRF9NRUNIIHN0YXR1cyBhcyBpZiBhIHBh cnRpY3VsYXIgYmFzaWMgc2VjdXJpdHkgbWVjaGFuaXNtIGhhZA0KICAgYmVlbiByZXF1ZXN0ZWQg YW5kIHdhcyBub3Qgc3VwcG9ydGVkLg0KDQogICBXaGVuIEdTU19BY3F1aXJlX2NyZWQgaXMgaW52 b2tlZCB3aXRoIHRoaXMgbmVnb3RpYXRpb24gbWVjaGFuaXNtIGluDQogICB0aGUgZGVzaXJlZF9t ZWNocywgYW4gaW1wbGVtZW50YXRpb24tc3BlY2lmaWMgZGVmYXVsdCBjcmVkZW50aWFsIGlzDQog ICB1c2VkIHRvIGNhcnJ5IG9uIHRoZSBuZWdvdGlhdGlvbi4gIEEgc2V0IG9mIG1lY2hhbmlzbXMg YXMgc3BlY2lmaWVkDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5l IDE0LCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgOF0NCgwNCkludGVybmV0LURyYWZ0ICAg ICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0K DQoNCiAgIGxvY2FsbHkgYnkgdGhlIHN5c3RlbSBhZG1pbmlzdHJhdG9yIGlzIHRoZW4gYXZhaWxh YmxlIGZvcg0KICAgbmVnb3RpYXRpb24uICBJZiB0aGVyZSBpcyBhIGRlc2lyZSBmb3IgdGhlIGNh bGxlciB0byBtYWtlIGl0cyBvd24NCiAgIGNob2ljZSwgdGhlbiBhbiBhZGRpdGlvbmFsIEFQSSBo YXMgdG8gYmUgdXNlZCAoc2VlIEFwcGVuZGl4IEEpLg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNCwg MjAwNSAgICAgICAgICAgICAgICAgIFtQYWdlIDldDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBH U1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQo0 LiAgVG9rZW4gRGVmaW5pdGlvbnMNCg0KICAgVGhlIHR5cGUgZGVmaW5pdGlvbnMgaW4gdGhpcyBz ZWN0aW9uIGFzc3VtZSBhbiBBU04uMSBtb2R1bGUNCiAgIGRlZmluaXRpb24gb2YgdGhlIGZvbGxv d2luZyBmb3JtOg0KDQoNCiAgICAgIFNQTkVHT0FTTk9uZVNwZWMgew0KICAgICAgICAgIGlzbygx KSBpZGVudGlmaWVkLW9yZ2FuaXphdGlvbigzKSBkb2QoNikgaW50ZXJuZXQoMSkNCiAgICAgICAg ICBzZWN1cml0eSg1KSBtZWNoYW5pc20oNSkgc25lZ28gKDIpIG1vZHVsZXMoNCkgc3BlYzIoMikN CiAgICAgIH0gREVGSU5JVElPTlMgRVhQTElDSVQgVEFHUyA6Oj0gQkVHSU4NCg0KICAgICAgLS0g cmVzdCBvZiBkZWZpbml0aW9ucyBoZXJlDQoNCiAgICAgIEVORA0KDQoNCiAgIFRoaXMgc3BlY2lm aWVzIHRoYXQgdGhlIHRhZ2dpbmcgY29udGV4dCBmb3IgdGhlIG1vZHVsZSB3aWxsIGJlDQogICBl eHBsaWNpdCBhbmQgbm9uLWF1dG9tYXRpYy4NCg0KICAgVGhlIGVuY29kaW5nIG9mIFNQTkVHTyBw cm90b2NvbCBtZXNzYWdlcyBzaGFsbCBvYmV5IHRoZSBEaXN0aW5ndWlzaGVkDQogICBFbmNvZGlu ZyBSdWxlcyAoREVSKSBvZiBBU04uMSBhcyBkZXNjcmliZWQgaW4gW1g2OTBdLg0KDQo0LjEgIE1l Y2hhbmlzbSBUeXBlcw0KDQogICBJbiB0aGlzIG5lZ290aWF0aW9uIG1vZGVsLCBlYWNoIE9JRCBy ZXByZXNlbnRzIG9uZSBHU1MtQVBJIG1lY2hhbmlzbQ0KICAgb3Igb25lIHZhcmlhbnQgKHNlZSBT ZWN0aW9uIDYpIG9mIGl0IGFjY29yZGluZyB0byBbUkZDMjc0M10uDQoNCg0KICAgICAgIE1lY2hU eXBlIDo6PSBPQkpFQ1QgSURFTlRJRklFUg0KICAgICAgICAgICAtLSBPSUQgcmVwcmVzZW50cyBl YWNoIHNlY3VyaXR5IG1lY2hhbmlzbSBhcyBzdWdnZXN0ZWQgYnkNCiAgICAgICAgICAgLS0gW1JG QzI3NDNdDQoNCiAgICAgICBNZWNoVHlwZUxpc3QgOjo9IFNFUVVFTkNFIE9GIE1lY2hUeXBlDQoN Cg0KNC4yICBOZWdvdGlhdGlvbiBUb2tlbnMNCg0KICAgVGhlIHN5bnRheCBvZiB0aGUgaW5pdGlh bCBuZWdvdGlhdGlvbiB0b2tlbnMgZm9sbG93cyB0aGUNCiAgIGluaXRpYWxDb250ZXh0VG9rZW4g c3ludGF4IGRlZmluZWQgaW4gU2VjdGlvbiAzLjEgb2YgW1JGQzI3NDNdLiAgVGhlDQogICBTUE5F R08gcHNldWRvIG1lY2hhbmlzbSBpcyBpZGVudGlmaWVkIGJ5IHRoZSBPYmplY3QgSWRlbnRpZmll cg0KICAgc3BlY2lmaWVkIGluIFNlY3Rpb24gMS4gIFN1YnNlcXVlbnQgdG9rZW5zIGFyZSBub3Qg ZW5jYXBzdWxhdGVkIGluDQogICB0aGlzIEdTUy1BUEkgZ2VuZXJpYyB0b2tlbiBmcmFtaW5nLg0K DQogICBUaGlzIHNlY3Rpb24gc3BlY2lmaWVzIHRoZSBzeW50YXggb2YgdGhlIGlubmVyIHRva2Vu IGZvciB0aGUgaW5pdGlhbA0KICAgbWVzc2FnZSBhbmQgdGhlIHN5bnRheCBvZiBzdWJzZXF1ZW50 IGNvbnRleHQgZXN0YWJsaXNobWVudCB0b2tlbnMuDQoNCiAgICAgICBOZWdvdGlhdGlvblRva2Vu IDo6PSBDSE9JQ0Ugew0KICAgICAgICAgICBuZWdUb2tlbkluaXQgICAgWzBdIE5lZ1Rva2VuSW5p dCwNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTQsIDIwMDUg ICAgICAgICAgICAgICAgIFtQYWdlIDEwXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQ SSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAgICAg ICAgICBuZWdUb2tlblJlc3AgICAgWzFdIG5lZ1Rva2VuUmVzcA0KICAgICAgIH0NCg0KDQoNCjQu Mi4xICBuZWdUb2tlbkluaXQNCg0KICAgICAgIE5lZ1Rva2VuSW5pdCA6Oj0gU0VRVUVOQ0Ugew0K ICAgICAgICAgICBtZWNoVHlwZXMgICAgICAgWzBdIE1lY2hUeXBlTGlzdCwNCiAgICAgICAgICAg cmVxRmxhZ3MgICAgICAgIFsxXSBDb250ZXh0RmxhZ3MgIE9QVElPTkFMLA0KICAgICAgICAgICBt ZWNoVG9rZW4gICAgICAgWzJdIE9DVEVUIFNUUklORyAgT1BUSU9OQUwsDQogICAgICAgICAgIG1l Y2hMaXN0TUlDICAgICBbM10gT0NURVQgU1RSSU5HICBPUFRJT05BTCwNCiAgICAgICAgICAgLi4u DQogICAgICAgfQ0KICAgICAgIENvbnRleHRGbGFncyA6Oj0gQklUIFNUUklORyB7DQogICAgICAg ICAgIGRlbGVnRmxhZyAgICAgICAoMCksDQogICAgICAgICAgIG11dHVhbEZsYWcgICAgICAoMSks DQogICAgICAgICAgIHJlcGxheUZsYWcgICAgICAoMiksDQogICAgICAgICAgIHNlcXVlbmNlRmxh ZyAgICAoMyksDQogICAgICAgICAgIGFub25GbGFnICAgICAgICAoNCksDQogICAgICAgICAgIGNv bmZGbGFnICAgICAgICAoNSksDQogICAgICAgICAgIGludGVnRmxhZyAgICAgICAoNikNCiAgICAg ICB9DQoNCiAgIFRoaXMgaXMgdGhlIHN5bnRheCBmb3IgdGhlIGlubmVyIHRva2VuIG9mIHRoZSBp bml0aWFsIG5lZ290aWF0aW9uDQogICBtZXNzYWdlLg0KDQogICBtZWNoVHlwZXMNCg0KICAgICAg ICAgVGhpcyBmaWVsZCBjb250YWlucyBvbmUgb3IgbW9yZSBzZWN1cml0eSBtZWNoYW5pc21zIGF2 YWlsYWJsZQ0KICAgICAgICAgZm9yIHRoZSBpbml0aWF0b3IgaW4gZGVjcmVhc2luZyBwcmVmZXJl bmNlIG9yZGVyIChmYXZvcml0ZQ0KICAgICAgICAgY2hvaWNlIGZpcnN0KS4NCg0KICAgcmVxRmxh Z3MNCg0KICAgICAgICAgVGhpcyBmaWVsZCwgaWYgcHJlc2VudCwgY29udGFpbnMgdGhlIHNlcnZp Y2Ugb3B0aW9ucyB0aGF0IGFyZQ0KICAgICAgICAgcmVxdWVzdGVkIHRvIGVzdGFibGlzaCB0aGUg Y29udGV4dC4gIFRoZSBjb250ZXh0IGZsYWdzIFNIT1VMRA0KICAgICAgICAgYmUgZmlsbGVkIGlu IGZyb20gdGhlIHJlcV9mbGFncyBwYXJhbWV0ZXIgb2YNCiAgICAgICAgIEdTU19Jbml0X3NlY19j b250ZXh0KCkuICBUaGlzIGZpZWxkIFNIQUxMIE5PVCBoYXZlIGltcGFjdCBvbg0KICAgICAgICAg dGhlIG5lZ290aWF0aW9uLg0KDQogICBtZWNoVG9rZW4NCg0KICAgICAgICAgVGhpcyBmaWVsZCwg aWYgcHJlc2VudCwgY29udGFpbnMgdGhlIG9wdGltaXN0aWMgbWVjaGFuaXNtDQogICAgICAgICB0 b2tlbi4NCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUg MTQsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDExXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAg ICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoN Cg0KICAgbWVjaGxpc3RNSUMNCg0KICAgICAgICAgVGhpcyBmaWVsZCwgaWYgcHJlc2VudCwgY29u dGFpbnMgYSBNSUMgdG9rZW4gZm9yIHRoZSBtZWNoYW5pc20NCiAgICAgICAgIGxpc3QgaW4gdGhl IGluaXRpYWwgbmVnb3RpYXRpb24gbWVzc2FnZS4gIFRoaXMgTUlDIHRva2VuIGlzDQogICAgICAg ICBjb21wdXRlZCBhY2NvcmRpbmcgdG8gU2VjdGlvbiA1Lg0KDQoNCjQuMi4yICBuZWdUb2tlblJl c3ANCg0KICAgICAgIE5lZ1Rva2VuUmVzcCA6Oj0gU0VRVUVOQ0Ugew0KICAgICAgICAgICBuZWdT dGF0ZSAgICAgICBbMF0gRU5VTUVSQVRFRCB7DQogICAgICAgICAgICAgICBhY2NlcHRfY29tcGxl dGVkICAgICgwKSwNCiAgICAgICAgICAgICAgIGFjY2VwdF9pbmNvbXBsZXRlICAgKDEpLA0KICAg ICAgICAgICAgICAgcmVqZWN0ICAgICAgICAgICAgICAoMiksDQogICAgICAgICAgICAgICByZXF1 ZXN0X21pYyAgICAgICAgICgzKQ0KICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgT1BUSU9OQUwsDQogICAgICAgICAgICAgLS0gUkVRVUlSRUQgaW4gdGhlIGZpcnN0 IHJlcGx5IGZyb20gdGhlIHRhcmdldA0KICAgICAgICAgICBzdXBwb3J0ZWRNZWNoICAgWzFdIE1l Y2hUeXBlICAgICAgT1BUSU9OQUwsDQogICAgICAgICAgICAgLS0gcHJlc2VudCBvbmx5IGluIHRo ZSBmaXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQNCiAgICAgICAgICAgcmVzcG9uc2VUb2tlbiAg IFsyXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLA0KICAgICAgICAgICBtZWNoTGlzdE1JQyAgICAg WzNdIE9DVEVUIFNUUklORyAgT1BUSU9OQUwsDQogICAgICAgICAgIC4uLg0KICAgICAgIH0NCg0K ICAgVGhpcyBpcyB0aGUgc3ludGF4IGZvciBhbGwgc3Vic2VxdWVudCBuZWdvdGlhdGlvbiBtZXNz YWdlcy4NCg0KICAgbmVnU3RhdGUNCg0KICAgICAgICAgVGhpcyBmaWVsZCwgaWYgcHJlc2VudCwg Y29udGFpbnMgdGhlIHN0YXRlIG9mIHRoZSBuZWdvdGlhdGlvbi4NCiAgICAgICAgIFRoaXMgY2Fu IGJlOg0KDQogICAgICAgICBhY2NlcHRfY29tcGxldGVkDQoNCiAgICAgICAgICAgIE5vIGZ1cnRo ZXIgbmVnb3RpYXRpb24gbWVzc2FnZSBmcm9tIHRoZSBwZWVyIGlzIGV4cGVjdGVkLA0KICAgICAg ICAgICAgYW5kIHRoZSBzZWN1cml0eSBjb250ZXh0IGlzIGVzdGFibGlzaGVkIGZvciB0aGUgc2Vu ZGVyLg0KDQogICAgICAgICBhY2NlcHRfaW5jb21wbGV0ZQ0KDQogICAgICAgICAgICBBdCBsZWFz dCBvbmUgbW9yZSBuZWdvdGlhdGlvbiBtZXNzYWdlIGZyb20gdGhlIHBlZXIgaXMNCiAgICAgICAg ICAgIG5lZWRlZCB0byBlc3RhYmxpc2ggdGhlIHNlY3VyaXR5IGNvbnRleHQuDQoNCiAgICAgICAg IHJlamVjdA0KDQogICAgICAgICAgICBUaGUgc2VuZGVyIHRlcm1pbmF0ZXMgdGhlIG5lZ290aWF0 aW9uLg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5l IDE0LCAyMDA1ICAgICAgICAgICAgICAgICBbUGFnZSAxMl0NCgwNCkludGVybmV0LURyYWZ0ICAg ICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0K DQoNCiAgICAgICAgIHJlcXVlc3RfbWljDQoNCiAgICAgICAgICAgIFRoZSBzZW5kZXIgaW5kaWNh dGVzIHRoYXQgdGhlIGV4Y2hhbmdlIG9mIE1JQyB0b2tlbnMsIGFzDQogICAgICAgICAgICBkZXNj cmliZWQgaW4gU2VjdGlvbiA1LCB3aWxsIGJlIFJFUVVJUkVEIGlmIHBlci1tZXNzYWdlDQogICAg ICAgICAgICBpbnRlZ3JpdHkgc2VydmljZXMgYXJlIGF2YWlsYWJsZSBvbiB0aGUgbWVjaGFuaXNt IGNvbnRleHQgdG8NCiAgICAgICAgICAgIGJlIGVzdGFibGlzaGVkLiAgVGhpcyB2YWx1ZSBTSEFM TCBvbmx5IGJlIHByZXNlbnQgaW4gdGhlDQogICAgICAgICAgICBmaXJzdCByZXBseSBmcm9tIHRo ZSB0YXJnZXQuDQoNCiAgICAgICAgIFRoaXMgZmllbGQgaXMgUkVRVUlSRUQgaW4gdGhlIGZpcnN0 IHJlcGx5IGZyb20gdGhlIHRhcmdldCwgYW5kDQogICAgICAgICBpdCBpcyBPUFRJT05BTCB0aGVy ZWFmdGVyLg0KDQogICBzdXBwb3J0ZWRNZWNoDQoNCiAgICAgICAgIFRoaXMgZmllbGQgU0hBTEwg b25seSBiZSBwcmVzZW50IGluIHRoZSBmaXJzdCByZXBseSBmcm9tIHRoZQ0KICAgICAgICAgdGFy Z2V0LiAgSXQgTVVTVCBiZSBvbmUgb2YgdGhlIG1lY2hhbmlzbShzKSBvZmZlcmVkIGJ5IHRoZQ0K ICAgICAgICAgaW5pdGlhdG9yLg0KDQogICBSZXNwb25zZVRva2VuDQoNCiAgICAgICAgIFRoaXMg ZmllbGQsIGlmIHByZXNlbnQsIGNvbnRhaW5zIHRva2VucyBzcGVjaWZpYyB0byB0aGUNCiAgICAg ICAgIG1lY2hhbmlzbSBzZWxlY3RlZC4NCg0KICAgbWVjaGxpc3RNSUMNCg0KICAgICAgICAgVGhp cyBmaWVsZCwgaWYgcHJlc2VudCwgY29udGFpbnMgYSBNSUMgdG9rZW4gZm9yIHRoZSBtZWNoYW5p c20NCiAgICAgICAgIGxpc3QgaW4gdGhlIGluaXRpYWwgbmVnb3RpYXRpb24gbWVzc2FnZS4gIFRo aXMgTUlDIHRva2VuIGlzDQogICAgICAgICBjb21wdXRlZCBhY2NvcmRpbmcgdG8gU2VjdGlvbiA1 Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBl dCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNCwgMjAwNSAgICAgICAgICAgICAgICAg W1BhZ2UgMTNdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1l Y2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQo1LiAgUHJvY2Vzc2luZyBvZiBtZWNo TGlzdE1JQw0KDQogICBJZiB0aGUgbWVjaGFuaXNtIHNlbGVjdGVkIGJ5IHRoZSBuZWdvdGlhdGlv biBkb2VzIG5vdCBzdXBwb3J0DQogICBpbnRlZ3JpdHkgcHJvdGVjdGlvbiwgdGhlbiBubyBtZWNo bGlzdE1JQyB0b2tlbiBpcyB1c2VkLg0KDQogICBPdGhlcndpc2UsIGlmIHRoZSBhY2NlcHRlZCBt ZWNoYW5pc20gaXMgdGhlIG1vc3QgcHJlZmVycmVkIG1lY2hhbmlzbQ0KICAgb2YgYm90aCB0aGUg aW5pdGlhdG9yIGFuZCB0aGUgYWNjZXB0b3IsIHRoZW4gdGhlIE1JQyB0b2tlbiBleGNoYW5nZSwN CiAgIGFzIGRlc2NyaWJlZCBsYXRlciBpbiB0aGlzIHNlY3Rpb24sIGlzIE9QVElPTkFMLiAgQSBt ZWNoYW5pc20gaXMgdGhlDQogICBhY2NlcHRvcidzIG1vc3QgcHJlZmVycmVkIG1lY2hhbmlzbSBp ZiB0aGVyZSBpcyBubyBvdGhlciBtZWNoYW5pc20NCiAgIHdoaWNoLCBoYWQgaXQgYmVlbiBwcmVz ZW50IGluIHRoZSBtZWNoYW5pc20gbGlzdCwgdGhlIGFjY2VwdG9yIHdvdWxkDQogICBoYXZlIHBy ZWZlcnJlZCBvdmVyIHRoZSBhY2NlcHRlZCBtZWNoYW5pc20uDQoNCiAgIEluIGFsbCBvdGhlciBj YXNlcywgTUlDIHRva2VucyBNVVNUIGJlIGV4Y2hhbmdlZCBhZnRlciB0aGUgbWVjaGFuaXNtDQog ICBjb250ZXh0IGlzIGZ1bGx5IGVzdGFibGlzaGVkLg0KDQogICBhKSBUaGUgbWVjaGxpc3RNSUMg dG9rZW4gKG9yIHNpbXBseSB0aGUgTUlDIHRva2VuKSBpcyBjb21wdXRlZCBvdmVyDQogICAgICB0 aGUgbWVjaGFuaXNtIGxpc3QgaW4gdGhlIGluaXRpYWwgbmVnb3RpYXRpb24gbWVzc2FnZSBieSBp bnZva2luZw0KICAgICAgR1NTX0dldE1JQygpIGFzIGZvbGxvd3M6IHRoZSBpbnB1dCBjb250ZXh0 X2hhbmRsZSBpcyB0aGUNCiAgICAgIGVzdGFibGlzaGVkIG1lY2hhbmlzbSBjb250ZXh0LCB0aGUg aW5wdXQgcW9wX3JlcSBpcyAwLCBhbmQgdGhlDQogICAgICBpbnB1dCBtZXNzYWdlIGlzIHRoZSBE RVIgZW5jb2Rpbmcgb2YgdGhlIHZhbHVlIG9mIHR5cGUNCiAgICAgIE1lY2hUeXBlTGlzdCB3aGlj aCBpcyBjb250YWluZWQgaW4gdGhlICJtZWNoVHlwZXMiIGZpZWxkIG9mIHRoZQ0KICAgICAgTmVn VG9rZW5Jbml0LiAgVGhlIGlucHV0IG1lc3NhZ2UgaXMgTk9UIHRoZSBERVIgZW5jb2Rpbmcgb2Yg dGhlDQogICAgICB0eXBlICJbMF0gTWVjaFR5cGVMaXN0Ii4NCg0KICAgYikgSWYgdGhlIHNlbGVj dGVkIG1lY2hhbmlzbSBleGNoYW5nZXMgYW4gZXZlbiBudW1iZXIgb2YgbWVjaGFuaXNtDQogICAg ICB0b2tlbnMgKGkuZS4sIHRoZSBhY2NlcHRvciBzZW5kcyB0aGUgbGFzdCBtZWNoYW5pc20gdG9r ZW4pLCB0aGUNCiAgICAgIGFjY2VwdG9yIGRvZXMgdGhlIGZvbGxvd2luZyB3aGVuIGVtaXR0aW5n IHRoZSBuZWdvdGlhdGlvbiBtZXNzYWdlDQogICAgICBjb250YWluaW5nIHRoZSBsYXN0IG1lY2hh bmlzbSB0b2tlbjogaWYgdGhlIE1JQyB0b2tlbiBleGNoYW5nZSBpcw0KICAgICAgb3B0aW9uYWws IEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBlaXRoZXIgaW5kaWNhdGVzIEdTU19TX0NPTVBMRVRF DQogICAgICBhbmQgZG9lcyBub3QgaW5jbHVkZSBhIG1lY2hsaXN0TUlDIHRva2VuLCBvciBpbmRp Y2F0ZXMNCiAgICAgIEdTU19TX0NPTlRJTlVFX05FRURFRCBhbmQgaW5jbHVkZXMgYSBtZWNobGlz dE1JQyB0b2tlbiBhbmQgYW4NCiAgICAgIGFjY2VwdF9pbmNvbXBsZXRlIHN0YXRlOyBpZiB0aGUg TUlDIHRva2VuIGV4Y2hhbmdlIGlzIHJlcXVpcmVkLA0KICAgICAgR1NTX0FjY2VwdF9zZWNfY29u dGV4dCgpIGluZGljYXRlcyBHU1NfU19DT05USU5VRV9ORUVERUQsIGFuZA0KICAgICAgaW5jbHVk ZXMgYSBtZWNobGlzdE1JQyB0b2tlbi4gIEFjY2VwdG9ycyB0aGF0IHdpc2ggdG8gYmUNCiAgICAg IGNvbXBhdGlibGUgd2l0aCBsZWdhY3kgV2luZG93cyBTUE5FR08gaW1wbGVtZW50YXRpb25zIGFz IGRlc2NyaWJlZA0KICAgICAgaW4gQXBwZW5kaXggQiBzaG91bGQgbm90IGdlbmVyYXRlIGEgbWVj aGxpc3RNSUMgdG9rZW4gd2hlbiB0aGUgTUlDDQogICAgICB0b2tlbiBleGNoYW5nZSBpcyBub3Qg cmVxdWlyZWQuICBUaGUgaW5pdGlhdG9yIHRoZW4gcHJvY2Vzc2VzIHRoZQ0KICAgICAgbGFzdCBt ZWNoYW5pc20gdG9rZW4sIGFuZCBkb2VzIG9uZSBvZiB0aGUgZm9sbG93aW5nOg0KDQogICAgICAo SSkgSWYgYSBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQsIGFuZCBpcyBjb3JyZWN0bHkN CiAgICAgICAgIHZlcmlmaWVkLCBHU1NfSW5pdF9zZWNfY29udGV4dCgpIGluZGljYXRlcyBHU1Nf U19DT01QTEVURS4gIFRoZQ0KICAgICAgICAgb3V0cHV0IG5lZ290aWF0aW9uIG1lc3NhZ2UgY29u dGFpbnMgYSBtZWNobGlzdE1JQyB0b2tlbiwgYW5kIGFuDQogICAgICAgICBhY2NlcHRfY29tcGxl dGUgc3RhdGUuICBUaGUgYWNjZXB0b3IgTVVTVCB0aGVuIHZlcmlmeSB0aGlzDQogICAgICAgICBt ZWNobGlzdE1JQyB0b2tlbi4NCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAg IEV4cGlyZXMgSnVuZSAxNCwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMTRdDQoMDQpJbnRl cm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERl Y2VtYmVyIDIwMDQNCg0KDQogICAgICAoSUkpIElmIGEgbWVjaGxpc3RNSUMgdG9rZW4gd2FzIGlu Y2x1ZGVkIGJ1dCBpcyBpbmNvcnJlY3QsIHRoZQ0KICAgICAgICAgbmVnb3RpYXRpb24gU0hBTEwg YmUgdGVybWluYXRlZC4gIEdTU19Jbml0X3NlY19jb250ZXh0KCkNCiAgICAgICAgIGluZGljYXRl cyBHU1NfU19ERUZFQ1RJVkVfVE9LRU4uDQoNCiAgICAgIChJSUkpIElmIG5vIG1lY2hsaXN0TUlD IHRva2VuIHdhcyBpbmNsdWRlZCwgYW5kIHRoZSBNSUMgdG9rZW4NCiAgICAgICAgIGV4Y2hhbmdl IGlzIG5vdCByZXF1aXJlZCwgR1NTX0luaXRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMNCiAgICAg ICAgIEdTU19TX0NPTVBMRVRFIHdpdGggbm8gb3V0cHV0IHRva2VuLg0KDQogICAgICAoSVYpIElm IG5vIG1lY2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCwgYnV0IHRoZSBNSUMgdG9rZW4NCiAg ICAgICAgIGV4Y2hhbmdlIGlzIHJlcXVpcmVkLCB0aGUgbmVnb3RpYXRpb24gU0hBTEwgYmUgdGVy bWluYXRlZC4NCiAgICAgICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NT X1NfREVGRUNUSVZFX1RPS0VOLg0KDQogICBjKSBJbiB0aGUgY2FzZSB0aGF0IHRoZSBjaG9zZW4g bWVjaGFuaXNtIGV4Y2hhbmdlcyBhbiBvZGQgbnVtYmVyIG9mDQogICAgICBtZWNoYW5pc20gdG9r ZW5zIChpLmUuLCB0aGUgaW5pdGlhdG9yIHNlbmRzIHRoZSBsYXN0IG1lY2hhbmlzbQ0KICAgICAg dG9rZW4pLCB0aGUgaW5pdGlhdG9yIGRvZXMgdGhlIGZvbGxvd2luZyB3aGVuIGVtaXR0aW5nIHRo ZQ0KICAgICAgbmVnb3RpYXRpb24gbWVzc2FnZSBjb250YWluaW5nIHRoZSBsYXN0IG1lY2hhbmlz bSB0b2tlbjogaWYgdGhlDQogICAgICBuZWdTdGF0ZSB3YXMgcmVxdWVzdF9taWMgaW4gdGhlIGZp cnN0IHJlcGx5IGZyb20gdGhlIHRhcmdldCwgYQ0KICAgICAgbWVjaGxpc3RNSUMgdG9rZW4gTVVT VCBiZSBpbmNsdWRlZCwgb3RoZXJ3aXNlIHRoZSBtZWNobGlzdE1JQw0KICAgICAgdG9rZW4gaXMg T1BUSU9OQUwuICAoTm90ZSB0aGF0IHRoZSBNSUMgdG9rZW4gZXhjaGFuZ2UgaXMgcmVxdWlyZWQN CiAgICAgIGlmIGEgbWVjaGFuaXNtIG90aGVyIHRoYW4gdGhlIGluaXRpYXRvcidzIGZpcnN0IGNo b2ljZSBpcyBjaG9zZW4uKQ0KICAgICAgSW4gdGhlIGNhc2UgdGhhdCB0aGUgb3B0aW1pc3RpYyBt ZWNoYW5pc20gdG9rZW4gaXMgdGhlIG9ubHkNCiAgICAgIG1lY2hhbmlzbSB0b2tlbiBmb3IgdGhl IGluaXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5pc20sIHRoZQ0KICAgICAgbWVjaGxpc3RNSUMg dG9rZW4gaXMgT1BUSU9OQUwuICBXaGV0aGVyIG9yIG5vdCB0aGUgbWVjaGxpc3RNSUMNCiAgICAg IHRva2VuIGlzIGluY2x1ZGVkLCBHU1NfSW5pdF9zZWNfY29udGV4dCgpIGluZGljYXRlcw0KICAg ICAgR1NTX1NfQ09OVElOVUVfTkVFREVELiAgSW5pdGlhdG9ycyB0aGF0IHdpc2ggdG8gYmUgY29t cGF0aWJsZSB3aXRoDQogICAgICBsZWdhY3kgV2luZG93cyBTUE5FR08gaW1wbGVtZW50YXRpb25z IGFzIGRlc2NyaWJlZCBpbiBBcHBlbmRpeCBCDQogICAgICBzaG91bGQgbm90IGdlbmVyYXRlIGEg bWVjaGxpc3RNSUMgdG9rZW4gd2hlbiB0aGUgTUlDIHRva2VuDQogICAgICBleGNoYW5nZSBpcyBu b3QgcmVxdWlyZWQuICBUaGUgYWNjZXB0b3IgdGhlbiBwcm9jZXNzZXMgdGhlIGxhc3QNCiAgICAg IG1lY2hhbmlzbSB0b2tlbiBhbmQgZG9lcyBvbmUgb2YgdGhlIGZvbGxvd2luZzoNCg0KICAgICAg KEkpIElmIGEgbWVjaGxpc3RNSUMgdG9rZW4gd2FzIGluY2x1ZGVkIGFuZCBpcyBjb3JyZWN0bHkg dmVyaWZpZWQsDQogICAgICAgICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzIEdT U19TX0NPTVBMRVRFLiAgVGhlIG91dHB1dA0KICAgICAgICAgbmVnb3RpYXRpb24gbWVzc2FnZSBj b250YWlucyBhIG1lY2hsaXN0TUlDIHRva2VuIGFuZCBhbg0KICAgICAgICAgYWNjZXB0X2NvbXBs ZXRlIHN0YXRlLiAgVGhlIGluaXRpYXRvciBNVVNUIHRoZW4gdmVyaWZ5IHRoaXMNCiAgICAgICAg IG1lY2hsaXN0TUlDIHRva2VuLg0KDQogICAgICAoSUkpIElmIGEgbWVjaGxpc3RNSUMgdG9rZW4g d2FzIGluY2x1ZGVkIGJ1dCBpcyBpbmNvcnJlY3QsIHRoZQ0KICAgICAgICAgbmVnb3RpYXRpb24g U0hBTEwgYmUgdGVybWluYXRlZC4gIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKQ0KICAgICAgICAg aW5kaWNhdGVzIEdTU19TX0RFRkVDVElWRV9UT0tFTi4NCg0KICAgICAgKElJSSkgSWYgbm8gbWVj aGxpc3RNSUMgdG9rZW4gd2FzIGluY2x1ZGVkIGJ1dCB0aGUgbWVjaGxpc3RNSUMNCiAgICAgICAg IHRva2VuIGV4Y2hhbmdlIGlzIG5vdCByZXF1aXJlZCwgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgp DQogICAgICAgICBpbmRpY2F0ZXMgR1NTX1NfQ09NUExFVEUuICBUaGUgb3V0cHV0IG5lZ290aWF0 aW9uIG1lc3NhZ2UNCiAgICAgICAgIGNvbnRhaW5zIGFuIGFjY2VwdF9jb21wbGV0ZSBzdGF0ZS4N Cg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNCwg MjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMTVdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBH U1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQog ICAgICAoSVYpIEluIHRoZSBjYXNlIHRoYXQgdGhlIG9wdGltaXN0aWMgbWVjaGFuaXNtIHRva2Vu IGlzIGFsc28gdGhlDQogICAgICAgICBsYXN0IG1lY2hhbmlzbSB0b2tlbiAod2hlbiB0aGUgaW5p dGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbQ0KICAgICAgICAgaXMgYWNjZXB0ZWQgYnkgdGhl IHRhcmdldCkgYW5kIHRoZSB0YXJnZXQgc2VuZHMgYSByZXF1ZXN0X21pYw0KICAgICAgICAgc3Rh dGUgYnV0IHRoZSBpbml0aWF0b3IgZGlkIG5vdCBzZW5kIGEgbWVjaGxpc3RNSUMgdG9rZW4sIHRo ZQ0KICAgICAgICAgdGFyZ2V0IHRoZW4gTVVTVCBpbmNsdWRlIGEgbWVjaGxpc3RNSUMgdG9rZW4g aW4gdGhhdCBmaXJzdA0KICAgICAgICAgcmVwbHkuICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkg aW5kaWNhdGVzDQogICAgICAgICBHU1NfU19DT05USU5VRV9ORUVERUQuICBUaGUgaW5pdGlhdG9y IE1VU1QgdmVyaWZ5IHRoZSByZWNlaXZlZA0KICAgICAgICAgbWVjaGxpc3RNSUMgdG9rZW4gYW5k IGdlbmVyYXRlIGEgbWVjaGxpc3RNSUMgdG9rZW4gdG8gc2VuZCBiYWNrDQogICAgICAgICB0byB0 aGUgdGFyZ2V0LiAgVGhlIHRhcmdldCBTSEFMTCBpbiB0dXJuIHZlcmlmeSB0aGUgcmV0dXJuZWQN CiAgICAgICAgIG1lY2hsaXN0TUlDIHRva2VuIGFuZCBjb21wbGV0ZSB0aGUgbmVnb3RpYXRpb24u DQoNCiAgICAgIChWKSBJZiBubyBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQgYW5kIHRo ZSBhY2NlcHRvciBzZW50IGENCiAgICAgICAgIHJlcXVlc3RfbWljIHN0YXRlIGluIHRoZSBmaXJz dCByZXBseSBtZXNzYWdlICh0aGUgZXhjaGFuZ2Ugb2YNCiAgICAgICAgIE1JQyB0b2tlbnMgaXMg cmVxdWlyZWQpLCB0aGUgbmVnb3RpYXRpb24gU0hBTEwgYmUgdGVybWluYXRlZC4NCiAgICAgICAg IEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfREVGRUNUSVZFX1RPS0VO Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAx NCwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMTZdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAg ICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0K DQo2LiAgRXh0ZW5zaWJpbGl0eQ0KDQogICBUd28gbWVjaGFuaXNtcyBhcmUgcHJvdmlkZWQgZm9y IGV4dGVuc2liaWxpdHkuICBGaXJzdCwgdGhlIEFTTi4xDQogICBzdHJ1Y3R1cmVzIGluIHRoaXMg c3BlY2lmaWNhdGlvbiBNQVkgYmUgZXhwYW5kZWQgYnkgSUVURiBzdGFuZGFyZHMNCiAgIGFjdGlv bi4gIEltcGxlbWVudGF0aW9ucyByZWNlaXZpbmcgdW5rbm93biBmaWVsZHMgTVVTVCBpZ25vcmUg dGhlc2UNCiAgIGZpZWxkcy4NCg0KICAgU2Vjb25kbHksIE9JRHMgY29ycmVzcG9uZGluZyB0byBh IGRlc2lyZWQgbWVjaGFuaXNtIGF0dHJpYnV0ZSAoaS5lLiwNCiAgIG1lY2hhbmlzbSB2YXJpYW50 cykgbWF5IGJlIGluY2x1ZGVkIGluIHRoZSBzZXQgb2YgcHJlZmVycmVkDQogICBtZWNoYW5pc21z IGJ5IGFuIGluaXRpYXRvci4gIFRoZSBhY2NlcHRvciBjYW4gY2hvb3NlIHRvIGhvbm9yIHRoaXMN CiAgIHJlcXVlc3QgYnkgcHJlZmVycmluZyBtZWNoYW5pc21zIHRoYXQgaGF2ZSB0aGUgaW5jbHVk ZWQgYXR0cmlidXRlcy4NCiAgIEZ1dHVyZSB3b3JrIHdpdGhpbiB0aGUgS2l0dGVuIHdvcmtpbmcg Z3JvdXAgaXMgZXhwZWN0ZWQgdG8NCiAgIHN0YW5kYXJkaXplIGNvbW1vbiBhdHRyaWJ1dGVzIHRo YXQgU1BORUdPIG1lY2hhbmlzbXMgbWF5IHdpc2ggdG8NCiAgIHN1cHBvcnQuICBBdCB0aGlzIHRp bWUgaXQgaXMgc3VmZmljaWVudCB0byBzYXkgdGhhdCBpbml0aWF0b3JzIE1BWQ0KICAgaW5jbHVk ZSBPSURzIHRoYXQgZG8gbm90IGNvcnJlc3BvbmQgdG8gbWVjaGFuaXNtcyBidXQgaW5zdGVhZA0K ICAgY29ycmVzcG9uZCB0byBkZXNpcmVkIG1lY2hhbmlzbSBhdHRyaWJ1dGVzIGluIHRoZWlyIHJl cXVlc3RzLiAgU3VjaA0KICAgT0lEcyBNQVkgaW5mbHVlbmNlIHRoZSBhY2NlcHRvcidzIGNob2lj ZSBvZiBtZWNoYW5pc20uICBBcyBkaXNjdXNzZWQNCiAgIGluIFNlY3Rpb24gNSwgaWYgdGhlcmUg YXJlIG1lY2hhbmlzbXMgdGhhdCBpZiBwcmVzZW50IGluIHRoZQ0KICAgaW5pdGlhdG9yJ3MgbGlz dCBvZiBtZWNoYW5pc21zIG1pZ2h0IGJlIHByZWZlcnJlZCBieSB0aGUgYWNjZXB0b3IgdG8NCiAg IHRoZSBpbml0aWF0b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNtLCB0aGUgYWNjZXB0b3IgTVVTVCBk ZW1hbmQgdGhlIE1JQw0KICAgdG9rZW4gZXhjaGFuZ2UuICBBcyBhIGNvbnNlcXVlbmNlLCBhY2Nl cHRvcnMgTVVTVCBkZW1hbmQgdGhlIE1JQw0KICAgdG9rZW4gZXhjaGFuZ2UgaWYgdGhleSBzdXBw b3J0IG5lZ290aWF0aW9uIG9mIGF0dHJpYnV0ZXMgbm90DQogICBhdmFpbGFibGUgaW4gdGhlIGlu aXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5pc20gcmVnYXJkbGVzcyBvZg0KICAgd2hldGhlciB0 aGUgaW5pdGlhdG9yIGFjdHVhbGx5IHJlcXVlc3RlZCB0aGVzZSBhdHRyaWJ1dGVzLg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBh bC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNCwgMjAwNSAgICAgICAgICAgICAgICAgW1Bh Z2UgMTddDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hh bmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQo3LiAgU2VjdXJpdHkgQ29uc2lkZXJhdGlv bnMNCg0KICAgSW4gb3JkZXIgdG8gcHJvZHVjZSB0aGUgTUlDIHRva2VuIGZvciB0aGUgbWVjaGFu aXNtIGxpc3QsIHRoZQ0KICAgbWVjaGFuaXNtIG11c3QgcHJvdmlkZSBpbnRlZ3JpdHkgcHJvdGVj dGlvbi4gIFdoZW4gdGhlIHNlbGVjdGVkDQogICBtZWNoYW5pc20gZG9lcyBub3Qgc3VwcG9ydCBp bnRlZ3JpdHkgcHJvdGVjdGlvbiwgdGhlIG5lZ290aWF0aW9uIGlzDQogICB2dWxuZXJhYmxlOiBh biBhY3RpdmUgYXR0YWNrZXIgY2FuIGZvcmNlIGl0IHRvIHVzZSBhIHNlY3VyaXR5DQogICBtZWNo YW5pc20gdGhhdCBpcyBub3QgbXV0dWFsbHkgcHJlZmVycmVkIGJ1dCBpcyBhY2NlcHRhYmxlIHRv IHRoZQ0KICAgdGFyZ2V0Lg0KDQogICBUaGlzIHByb3RvY29sIHByb3ZpZGVzIHRoZSBmb2xsb3dp bmcgZ3VhcmFudGVlcyB3aGVuIHBlci1tZXNzYWdlDQogICBpbnRlZ3JpdHkgc2VydmljZXMgYXJl IGF2YWlsYWJsZSBvbiB0aGUgZXN0YWJsaXNoZWQgbWVjaGFuaXNtIGNvbnRleHQNCiAgIGFuZCB0 aGUgbWVjaGFuaXNtIGxpc3Qgd2FzIGFsdGVyZWQgYnkgYW4gYWR2ZXJzYXJ5IHN1Y2ggdGhhdCBh DQogICBtZWNoYW5pc20gd2hpY2ggaXMgbm90IG11dHVhbGx5IHByZWZlcnJlZCBjb3VsZCBiZSBz ZWxlY3RlZDoNCg0KICAgYSkgSWYgdGhlIGxhc3QgbWVjaGFuaXNtIHRva2VuIGlzIHNlbnQgYnkg dGhlIGluaXRpYXRvciwgYm90aCBwZWVycw0KICAgICAgc2hhbGwgZmFpbDsNCiAgIGIpIElmIHRo ZSBsYXN0IG1lY2hhbmlzbSB0b2tlbiBpcyBzZW50IGJ5IHRoZSBhY2NlcHRvciwgdGhlIGFjY2Vw dG9yDQogICAgICBzaGFsbCBub3QgY29tcGxldGUgYW5kIHRoZSBpbml0aWF0b3IgYXQgd29yc3Qg c2hhbGwgY29tcGxldGUgd2l0aA0KICAgICAgaXRzIHByZWZlcnJlZCBtZWNoYW5pc20gYmVpbmcg c2VsZWN0ZWQuDQoNCiAgIFRoZSBuZWdvdGlhdGlvbiBtYXkgbm90IGJlIHRlcm1pbmF0ZWQgaWYg YW4gYWx0ZXJhdGlvbiB3YXMgbWFkZSBidXQNCiAgIGl0IGhhZCBubyBtYXRlcmlhbCBpbXBhY3Qu DQoNCiAgIFRoZSBwcm90ZWN0aW9uIG9mIHRoZSBuZWdvdGlhdGlvbiBkZXBlbmRzIG9uIHRoZSBz dHJlbmd0aCBvZiB0aGUNCiAgIGludGVncml0eSBwcm90ZWN0aW9uLiAgSW4gcGFydGljdWxhciwg dGhlIHN0cmVuZ3RoIG9mIFNQTkVHTyBpcyBubw0KICAgc3Ryb25nZXIgdGhhbiB0aGUgaW50ZWdy aXR5IHByb3RlY3Rpb24gb2YgdGhlIHdlYWtlc3QgbWVjaGFuaXNtDQogICBhY2NlcHRhYmxlIHRv IEdTUy1BUEkgcGVlcnMuDQoNCiAgIEluIGFsbCBjYXNlcywgdGhlIGNvbW11bmljYXRpbmcgcGVl cnMgYXJlIGV4cG9zZWQgdG8gdGhlIGRlbmlhbCBvZg0KICAgc2VydmljZSB0aHJlYXQuDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAg ICAgICAgRXhwaXJlcyBKdW5lIDE0LCAyMDA1ICAgICAgICAgICAgICAgICBbUGFnZSAxOF0NCgwN CkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAg ICAgRGVjZW1iZXIgMjAwNA0KDQoNCjguICBJQU5BIENvbnNpZGVyYXRpb25zDQoNCiAgIFRoaXMg ZG9jdW1lbnQgaGFzIG5vIGFjdGlvbnMgZm9yIElBTkEuDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDE0 LCAyMDA1ICAgICAgICAgICAgICAgICBbUGFnZSAxOV0NCgwNCkludGVybmV0LURyYWZ0ICAgICAg IEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoN CjkuICBBY2tub3dsZWRnbWVudHMNCg0KICAgVGhlIGF1dGhvcnMgd2lzaCB0byB0aGFuayBTYW0g SGFydG1hbiwgTmljb2xhcyBXaWxsaWFtcywgS2VuIFJhZWJ1cm4sDQogICBKZWZmIEFsdG1hbiwg VG9tIFl1LCBDcmlzdGlhbiBJbGFjIGFuZCBNYXJ0aW4gUmV4IGZvciB0aGVpciBjb21tZW50cw0K ICAgYW5kIHN1Z2dlc3Rpb25zIGR1cmluZyBkZXZlbG9wbWVudCBvZiB0aGlzIGRvY3VtZW50Lg0K DQogICBMdWtlIEhvd2FyZCBwcm92aWRlZCBhIHByb3RvdHlwZSBvZiB0aGlzIHByb3RvY29sIGlu IEhlaW1kYWwgYW5kDQogICByZXNvbHZlZCBzZXZlcmFsIGlzc3VlcyBpbiB0aGUgaW5pdGlhbCBk cmFmdC4NCg0KICAgRXJpYyBCYWl6ZSBhbmQgRGVuaXMgUGlua2FzIHdyb3RlIHRoZSBvcmlnaW5h bCBTUE5FR08gc3BlY2lmaWNhdGlvbg0KICAgW1JGQzI0NzhdIG9mIHdoaWNoIHNvbWUgb2YgdGhl IHRleHQgaGFzIGJlZW4gcmV0YWluZWQgaW4gdGhpcw0KICAgZG9jdW1lbnQuDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDE0LCAyMDA1 ICAgICAgICAgICAgICAgICBbUGFnZSAyMF0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1B UEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCjEwLiAg UmVmZXJlbmNlcw0KDQoxMC4xICBOb3JtYXRpdmUgUmVmZXJlbmNlcw0KDQogICBbUkZDMjExOV0g IEJyYWRuZXIsIFMuLCAiS2V5IHdvcmRzIGZvciB1c2UgaW4gUkZDcyB0byBJbmRpY2F0ZQ0KICAg ICAgICAgICAgICBSZXF1aXJlbWVudCBMZXZlbHMiLCBCQ1AgMTQsIFJGQyAyMTE5LCBNYXJjaCAx OTk3Lg0KDQogICBbUkZDMjc0M10gIExpbm4sIEouLCAiR2VuZXJpYyBTZWN1cml0eSBTZXJ2aWNl IEFwcGxpY2F0aW9uIFByb2dyYW0NCiAgICAgICAgICAgICAgSW50ZXJmYWNlIFZlcnNpb24gMiwg VXBkYXRlIDEiLCBSRkMgMjc0MywgSmFudWFyeSAyMDAwLg0KDQogICBbWDY5MF0gICAgIEFTTi4x IGVuY29kaW5nIHJ1bGVzOiBTcGVjaWZpY2F0aW9uIG9mIEJhc2ljIEVuY29kaW5nIA0KICAgICAg ICAgICAgICBSdWxlcyAoQkVSKSwgQ2Fub25pY2FsIEVuY29kaW5nIFJ1bGVzIChDRVIpIGFuZCAN CiAgICAgICAgICAgICAgRGlzdGluZ3Vpc2hlZCBFbmNvZGluZyBSdWxlcyAoREVSKSwgSVRVLVQg UmVjb21tZW5kYXRpb24gDQogICAgICAgICAgICAgIFguNjkwICgxOTk3KSB8IElTTy9JRUMgSW50 ZXJuYXRpb25hbCBTdGFuZGFyZCA4ODI1LTE6MTk5OC4NCg0KMTAuMiAgSW5mb3JtYXRpdmUgUmVm ZXJlbmNlcw0KDQogICBbUkZDMjQ3OF0gIEJhaXplLCBFLiBhbmQgRC4gUGlua2FzLCAiVGhlIFNp bXBsZSBhbmQgUHJvdGVjdGVkIEdTUy1BUEkNCiAgICAgICAgICAgICAgTmVnb3RpYXRpb24gTWVj aGFuaXNtIiwgUkZDIDI0NzgsIERlY2VtYmVyIDE5OTguDQoNCg0KQXV0aG9ycycgQWRkcmVzc2Vz DQoNCiAgIExhcnJ5IFpodQ0KICAgTWljcm9zb2Z0IENvcnBvcmF0aW9uDQogICBPbmUgTWljcm9z b2Z0IFdheQ0KICAgUmVkbW9uZCwgV0EgIDk4MDUyDQogICBVUw0KDQogICBFTWFpbDogbHpodUBt aWNyb3NvZnQuY29tDQoNCg0KICAgUGF1bCBMZWFjaA0KICAgTWljcm9zb2Z0IENvcnBvcmF0aW9u DQogICBPbmUgTWljcm9zb2Z0IFdheQ0KICAgUmVkbW9uZCwgV0EgIDk4MDUyDQogICBVUw0KDQog ICBFTWFpbDogcGF1bGxlQG1pY3Jvc29mdC5jb20NCg0KDQogICBLYXJ0aGlrIEphZ2FuYXRoYW4N CiAgIE1pY3Jvc29mdCBDb3Jwb3JhdGlvbg0KICAgT25lIE1pY3Jvc29mdCBXYXkNCiAgIFJlZG1v bmQsIFdBICA5ODA1Mg0KICAgVVMNCg0KICAgRU1haWw6IGthcnRoaWtqQG1pY3Jvc29mdC5jb20N Cg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTQsIDIwMDUgICAg ICAgICAgICAgICAgIFtQYWdlIDIxXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBO ZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAgV3lsbHlz IEluZ2Vyc29sbA0KICAgU3VuIE1pY3Jvc3lzdGVtcw0KICAgMTc3NSBXaWVobGUgQXZlbnVlLCAy bmQgRmxvb3INCiAgIFJlc3RvbiwgVkEgIDIwMTkwDQogICBVUw0KDQogICBFTWFpbDogd3lsbHlz LmluZ2Vyc29sbEBzdW4uY29tDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBl dCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNCwgMjAwNSAgICAgICAgICAgICAgICAg W1BhZ2UgMjJdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1l Y2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQpBcHBlbmRpeCBBLiAgR1NTLUFQSSBO ZWdvdGlhdGlvbiBTdXBwb3J0IEFQSQ0KDQogICBJbiBvcmRlciB0byBwcm92aWRlIHRvIGEgR1NT LUFQSSBjYWxsZXIgKGVpdGhlciB0aGUgaW5pdGlhdG9yIG9yIHRoZQ0KICAgdGFyZ2V0IG9yIGJv dGgpIHRoZSBhYmlsaXR5IHRvIGNob29zZSBhbW9uZyB0aGUgc2V0IG9mIHN1cHBvcnRlZA0KICAg bWVjaGFuaXNtcyBhIHJlZHVjZWQgc2V0IG9mIG1lY2hhbmlzbXMgZm9yIG5lZ290aWF0aW9uLCB0 d28NCiAgIGFkZGl0aW9uYWwgQVBJcyBhcmUgZGVmaW5lZDoNCg0KICAgbyAgR1NTX0dldF9uZWdf bWVjaHMoKSBpbmRpY2F0ZXMgdGhlIHNldCBvZiBzZWN1cml0eSBtZWNoYW5pc21zDQogICAgICBh dmFpbGFibGUgb24gdGhlIGxvY2FsIHN5c3RlbSB0byB0aGUgY2FsbGVyIGZvciBuZWdvdGlhdGlv biwgZm9yDQogICAgICB3aGljaCBhcHByb3ByaWF0ZSBjcmVkZW50aWFscyBhcmUgYXZhaWxhYmxl Lg0KICAgbyAgR1NTX1NldF9uZWdfbWVjaHMoKSBzcGVjaWZpZXMgdGhlIHNldCBvZiBzZWN1cml0 eSBtZWNoYW5pc21zIHRvIGJlDQogICAgICB1c2VkIG9uIHRoZSBsb2NhbCBzeXN0ZW0gYnkgdGhl IGNhbGxlciBmb3IgbmVnb3RpYXRpb24sIGZvciB0aGUNCiAgICAgIGdpdmVuIGNyZWRlbnRpYWxz Lg0KDQpBLjEgIEdTU19TZXRfbmVnX21lY2hzIGNhbGwNCg0KICAgSW5wdXRzOg0KDQogICBvICBj cmVkX2hhbmRsZSBDUkVERU5USUFMIEhBTkRMRSwgLS0gTlVMTCBzcGVjaWZpZXMgZGVmYXVsdA0K ICAgICAgLS0gY3JlZGVudGlhbHMNCiAgIG8gIG1lY2hfc2V0IFNFVCBPRiBPQkpFQ1QgSURFTlRJ RklFUg0KDQogICBPdXRwdXRzOg0KDQogICBvICBtYWpvcl9zdGF0dXMgSU5URUdFUiwNCiAgIG8g IG1pbm9yX3N0YXR1cyBJTlRFR0VSDQoNCiAgIFJldHVybiBtYWpvcl9zdGF0dXMgY29kZXM6DQoN CiAgIG8gIEdTU19TX0NPTVBMRVRFIGluZGljYXRlcyB0aGF0IHRoZSBzZXQgb2Ygc2VjdXJpdHkg bWVjaGFuaXNtcw0KICAgICAgYXZhaWxhYmxlIGZvciBuZWdvdGlhdGlvbiBoYXMgYmVlbiBzZXQg dG8gbWVjaF9zZXQuDQogICBvICBHU1NfU19GQUlMVVJFIGluZGljYXRlcyB0aGF0IHRoZSByZXF1 ZXN0ZWQgb3BlcmF0aW9uIGNvdWxkIG5vdCBiZQ0KICAgICAgcGVyZm9ybWVkIGZvciByZWFzb25z IHVuc3BlY2lmaWVkIGF0IHRoZSBHU1MtQVBJIGxldmVsLg0KDQogICBBbGxvd3MgY2FsbGVycyB0 byBzcGVjaWZ5IHRoZSBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcyB0aGF0IG1heSBiZQ0KICAg bmVnb3RpYXRlZCB3aXRoIHRoZSBjcmVkZW50aWFsIGlkZW50aWZpZWQgYnkgY3JlZF9oYW5kbGUu ICBUaGlzIGNhbGwNCiAgIGlzIGludGVuZGVkIGZvciBzdXBwb3J0IG9mIHNwZWNpYWxpemVkIGNh bGxlcnMgd2hvIG5lZWQgdG8gcmVzdHJpY3QNCiAgIHRoZSBzZXQgb2YgbmVnb3RpYWJsZSBzZWN1 cml0eSBtZWNoYW5pc21zIGZyb20gdGhlIHNldCBvZiBhbGwNCiAgIHNlY3VyaXR5IG1lY2hhbmlz bXMgYXZhaWxhYmxlIHRvIHRoZSBjYWxsZXIgKGJhc2VkIG9uIGF2YWlsYWJsZQ0KICAgY3JlZGVu dGlhbHMpLiAgTm90ZSB0aGF0IGlmIG1vcmUgdGhhbiBvbmUgbWVjaGFuaXNtIGlzIHNwZWNpZmll ZCBpbg0KICAgbWVjaF9zZXQsIHRoZSBvcmRlciBpbiB3aGljaCB0aG9zZSBtZWNoYW5pc21zIGFy ZSBzcGVjaWZpZWQgaW1wbGllcyBhDQogICByZWxhdGl2ZSBwcmVmZXJlbmNlLg0KDQpBLjIgIEdT U19HZXRfbmVnX21lY2hzIGNhbGwNCg0KICAgSW5wdXQ6DQoNCg0KDQoNCg0KWmh1LCBldCBhbC4g ICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNCwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2Ug MjNdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlz bSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICBvICBjcmVkX2hhbmRsZSBDUkVERU5USUFM IEhBTkRMRSAtLSBOVUxMIHNwZWNpZmllcyBkZWZhdWx0DQogICAgICAtLSBjcmVkZW50aWFscw0K DQogICBPdXRwdXRzOg0KDQogICBvICBtYWpvcl9zdGF0dXMgSU5URUdFUiwNCiAgIG8gIG1pbm9y X3N0YXR1cyBJTlRFR0VSLA0KICAgbyAgbWVjaF9zZXQgU0VUIE9GIE9CSkVDVCBJREVOVElGSUVS DQoNCiAgIFJldHVybiBtYWpvcl9zdGF0dXMgY29kZXM6DQoNCiAgIG8gIEdTU19TX0NPTVBMRVRF IGluZGljYXRlcyB0aGF0IHRoZSBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcw0KICAgICAgYXZh aWxhYmxlIGZvciBuZWdvdGlhdGlvbiBoYXMgYmVlbiByZXR1cm5lZCBpbiBtZWNoX3NldC4NCiAg IG8gIEdTU19TX0ZBSUxVUkUgaW5kaWNhdGVzIHRoYXQgdGhlIHJlcXVlc3RlZCBvcGVyYXRpb24g Y291bGQgbm90IGJlDQogICAgICBwZXJmb3JtZWQgZm9yIHJlYXNvbnMgdW5zcGVjaWZpZWQgYXQg dGhlIEdTUy1BUEkgbGV2ZWwuDQoNCiAgIEFsbG93cyBjYWxsZXJzIHRvIGRldGVybWluZSB0aGUg c2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMgYXZhaWxhYmxlDQogICBmb3IgbmVnb3RpYXRpb24g d2l0aCB0aGUgY3JlZGVudGlhbCBpZGVudGlmaWVkIGJ5IGNyZWRfaGFuZGxlLiAgVGhpcw0KICAg Y2FsbCBpcyBpbnRlbmRlZCBmb3Igc3VwcG9ydCBvZiBzcGVjaWFsaXplZCBjYWxsZXJzIHdobyBu ZWVkIHRvDQogICByZWR1Y2UgdGhlIHNldCBvZiBuZWdvdGlhYmxlIHNlY3VyaXR5IG1lY2hhbmlz bXMgZnJvbSB0aGUgc2V0IG9mDQogICBzdXBwb3J0ZWQgc2VjdXJpdHkgbWVjaGFuaXNtcyBhdmFp bGFibGUgdG8gdGhlIGNhbGxlciAoYmFzZWQgb24NCiAgIGF2YWlsYWJsZSBjcmVkZW50aWFscyku DQoNCiAgIE5vdGU6IFRoZSBHU1NfSW5kaWNhdGVfbWVjaHMoKSBmdW5jdGlvbiBpbmRpY2F0ZXMg dGhlIGZ1bGwgc2V0IG9mDQogICBtZWNoYW5pc20gdHlwZXMgYXZhaWxhYmxlIG9uIHRoZSBsb2Nh bCBzeXN0ZW0uICBTaW5jZSB0aGlzIGNhbGwgaGFzDQogICBubyBpbnB1dCBwYXJhbWV0ZXIsIHRo ZSByZXR1cm5lZCBzZXQgaXMgbm90IG5lY2Vzc2FyaWx5IGF2YWlsYWJsZSBmb3INCiAgIGFsbCBj cmVkZW50aWFscy4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTQsIDIwMDUgICAgICAg ICAgICAgICAgIFtQYWdlIDI0XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdv dGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KQXBwZW5kaXggQi4g IENoYW5nZXMgc2luY2UgUkZDMjQ3OA0KDQogICAgICBTUE5FR08gaW1wbGVtZW50YXRpb25zIGlu IFdpbmRvd3MgMjAwMC9XaW5kb3dzIFhQL1dpbmRvd3MgU2VydmVyDQogICAgICAyMDAzIGhhdmUg dGhlIGZvbGxvd2luZyBiZWhhdmlvcjogbm8gbWVjaGxpc3RNSUMgaXMgcHJvZHVjZWQgYW5kDQog ICAgICBtZWNobGlzdE1JQyBpcyBub3QgcHJvY2Vzc2VkIGlmIG9uZSBpcyBwcm92aWRlZDsgaWYg dGhlIGluaXRpYXRvcg0KICAgICAgc2VuZHMgdGhlIGxhc3QgbWVjaGFuaXNtIHRva2VuLCB0aGUg YWNjZXB0b3Igd2lsbCBzZW5kIGJhY2sgYQ0KICAgICAgbmVnb3RpYXRpb24gdG9rZW4gd2l0aCBh biBhY2NlcHRfY29tcGxldGUgc3RhdGUgYW5kIG5vIG1lY2hsaXN0TUlDDQogICAgICB0b2tlbi4g IEluIGFkZGl0aW9uLCBhbiBpbmNvcnJlY3QgT0lEICgxLjIuODQwLjQ4MDE4LjEuMi4yKSBjYW4g YmUNCiAgICAgIHVzZWQgdG8gaWRlbnRpZnkgdGhlIEdTUy1BUEkgS2VyYmVyb3MgVmVyc2lvbiA1 IG1lY2hhbmlzbS4NCg0KICAgICAgVGhlIGZvbGxvd2luZyBjaGFuZ2VzIGhhdmUgYmVlbiBtYWRl IHRvIGJlIGNvbXBhdGlibGUgd2l0aCB0aGVzZQ0KICAgICAgbGVnYWN5IGltcGxlbWVudGF0aW9u cy4NCg0KICAgICAgKiAgTmVnVG9rZW5UYXJnIGlzIGNoYW5nZWQgdG8gbmVnVG9rZW5SZXNwIGFu ZCBpdCBpcyB0aGUgbWVzc2FnZQ0KICAgICAgICAgZm9ybWF0IGZvciBhbGwgc3Vic2VxdWVudCBu ZWdvdGlhdGlvbiB0b2tlbnMuDQogICAgICAqICBOZWdUb2tlbkluaXQgaXMgdGhlIG1lc3NhZ2Ug Zm9yIHRoZSBpbml0aWFsIG5lZ290aWF0aW9uIG1lc3NhZ2UNCiAgICAgICAgIGFuZCB0aGF0IG1l c3NhZ2Ugb25seS4NCiAgICAgICogIG1lY2hUeXBlcyBpbiBuZWdUb2tlbkluaXQgaXMgbm90IG9w dGlvbmFsLg0KICAgICAgKiAgSWYgdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSBpcyBhbHNvIHRoZSBt b3N0IHByZWZlcnJlZCBtZWNoYW5pc20NCiAgICAgICAgIGZvciBib3RoIHBlZXJzLCBpdCBpcyBz YWZlIHRvIG9taXQgdGhlIE1JQyB0b2tlbnMuDQoNCiAgICAgIElmIGF0IGxlYXN0IG9uZSBvZiB0 aGUgdHdvIHBlZXJzIGltcGxlbWVudHMgdGhlIHVwZGF0ZWQgcHNldWRvDQogICAgICBtZWNoYW5p c20gaW4gdGhpcyBkb2N1bWVudCwgdGhlIG5lZ290aWF0aW9uIGlzIHByb3RlY3RlZC4NCg0KICAg ICAgVGhlIGZvbGxvd2luZyBjaGFuZ2VzIGFyZSB0byBhZGRyZXNzIHRoZSBwcm9ibGVtcyBpbiBS RkMgMjQ3OC4NCg0KICAgICAgKiAgcmVxRmxhZ3MgaXMgbm90IHByb3RlY3RlZCB0aGVyZWZvcmUg aXQgc2hvdWxkIG5vdCBpbXBhY3QgdGhlDQogICAgICAgICBuZWdvdGlhdGlvbi4NCiAgICAgICog IERFUiBlbmNvZGluZyBpcyByZXF1aXJlZC4NCiAgICAgICogIEdTU19HZXRNSUMoKSBpbnB1dCBp cyBjbGFyaWZpZWQuDQogICAgICAqICBQZXItbWVzc2FnZSBpbnRlZ3JpdHkgc2VydmljZXMgYXJl IHJlcXVlc3RlZCBmb3IgdGhlIG5lZ290aWF0ZWQNCiAgICAgICAgIG1lY2hhbmlzbS4NCiAgICAg ICogIFR3byBNSUMgdG9rZW5zIGFyZSBleGNoYW5nZWQsIG9uZSBpbiBlYWNoIGRpcmVjdGlvbi4N Cg0KICAgQW4gaW1wbGVtZW50YXRpb24gdGhhdCBjb25mb3JtcyB0byB0aGlzIHNwZWNpZmljYXRp b24gd2lsbCBub3QNCiAgIGludGVyb3BlcmF0ZSB3aXRoIGEgc3RyaWN0IDI3NDggaW1wbGVtZW50 YXRpb24uICBFdmVuIGlmIHRoZSBuZXcNCiAgIGltcGxlbWVudGF0aW9uIGFsd2F5cyBzZW5kcyBh IG1lY2hsaXN0TUlDIHRva2VuLCBpdCB3aWxsIHN0aWxsIGZhaWwNCiAgIHRvIGludGVyb3BlcmF0 ZS4gIElmIGl0IGlzIGEgc2VydmVyLCBpdCB3aWxsIGZhaWwgYmVjYXVzZSBpdCByZXF1ZXN0cw0K ICAgYSBtZWNobGlzdE1JQyB0b2tlbiB1c2luZyBhbiBvcHRpb24gdGhhdCBvbGRlciBpbXBsZW1l bnRhdGlvbnMgc2ltcGx5DQogICBkbyBub3Qgc3VwcG9ydC4gIENsaWVudHMgd2lsbCB0ZW5kIHRv IGZhaWwgYXMgd2VsbC4NCg0KICAgQXMgYW4gYWx0ZXJuYXRpdmUgdG8gdGhlIGFwcHJvYWNoIGNo b3NlbiBpbiB0aGlzIHNwZWNpZmljYXRpb24sIHdlDQogICBjb3VsZCBoYXZlIGRvY3VtZW50ZWQg YSBjb3JyZWN0IGJlaGF2aW9yIHRoYXQgaXMgZnVsbHkgYmFja3dhcmQNCiAgIGNvbXBhdGlibGUg d2l0aCBSRkMgMjQ3OCBhbmQgaW5jbHVkZWQgYW4gYXBwZW5kaXggb24gaG93IHRvDQogICBpbnRl cm9wZXJhdGUgd2l0aCBleGlzdGluZyBpbmNvcnJlY3QgaW1wbGVtZW50YXRpb25zIG9mIFJGQyAy NDc4Lg0KDQogICBBcyBhIHByYWN0aWNhbCBtYXR0ZXIsIHRoZSBTUE5FR08gaW1wbGVtZW50ZXJz IHdpdGhpbiB0aGUgSUVURiBoYXZlDQogICB2YWx1ZWQgaW50ZXJvcGVyYWJpbGl0eSB3aXRoIHRo ZSBNaWNyb3NvZnQgaW1wbGVtZW50YXRpb25zLiAgV2Ugd2VyZQ0KDQoNCg0KWmh1LCBldCBhbC4g ICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNCwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2Ug MjVdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlz bSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICB1bmFibGUgdG8gY2hvb3NlIHRvIG1haW50 YWluIHJlYXNvbmFibGUgc2VjdXJpdHkgZ3VhcmFudGVlcywgbWFpbnRhaW4NCiAgIGludGVyb3Bl cmFiaWxpdHkgd2l0aCB0aGUgTWljcm9zb2Z0IGltcGxlbWVudGF0aW9ucyBhbmQgbWFpbnRhaW4N CiAgIGludGVyb3BlcmFiaWxpdHkgd2l0aCBjb3JyZWN0IGltcGxlbWVudGF0aW9ucyBvZiBSRkMg MjQ3OC4gIFRoZQ0KICAgd29ya2luZyBncm91cCB3YXMgbm90IGF3YXJlIG9mIGFueSBSRkMgMjQ3 OCBpbXBsZW1lbnRhdGlvbnMgZGVwbG95ZWQNCiAgIG9uIHRoZSBJbnRlcm5ldC4gIEV2ZW4gaWYg dGhlcmUgYXJlIHN1Y2ggaW1wbGVtZW50YXRpb25zLCBpdCBpcw0KICAgdW5saWtlbHkgdGhhdCB0 aGV5IHdpbGwgaW50ZXJvcGVyYXRlIGJlY2F1c2Ugb2YgYSBjcml0aWNhbCBmbGF3IGluDQogICB0 aGUgZGVzY3JpcHRpb24gb2YgdGhlIGVuY29kaW5nIG9mIHRoZSBtZWNoYW5pc20gbGlzdCBpbiBS RkMgMjQ3OC4NCg0KICAgV2l0aCB0aGUgYXBwcm9hY2ggdGFrZW4gaW4gdGhpcyBzcGVjaWZpY2F0 aW9uLCBzZWN1cml0eSBpcyBlbnN1cmVkDQogICBiZXR3ZWVuIG5ldyBpbXBsZW1lbnRhdGlvbnMg YWxsIHRoZSB0aW1lIHdoaWxlIG1haW50YWluaW5nDQogICBpbnRlcm9wZXJhYmlsaXR5IHdpdGgg dGhlIGltcGxlbWVudGF0aW9ucyBkZXBsb3llZCB3aXRoaW4gdGhlIElFVEYNCiAgIGNvbW11bml0 eS4gIFRoZSB3b3JraW5nIGdyb3VwIGJlbGlldmVzIHRoYXQgdGhpcyBqdXN0aWZpZXMgYnJlYWtp bmcNCiAgIGNvbXBhdGliaWxpdHkgd2l0aCBhIGNvcnJlY3QgaW1wbGVtZW50YXRpb24gb2YgUkZD IDI0NzguDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGly ZXMgSnVuZSAxNCwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMjZdDQoMDQpJbnRlcm5ldC1E cmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVy IDIwMDQNCg0KDQpBcHBlbmRpeCBDLiAgbWVjaExpc3RNSUMgQ29tcHV0YXRpb24gRXhhbXBsZQ0K DQogICBUaGUgZm9sbG93aW5nIGlzIGFuIGV4YW1wbGUgdG8gaWxsdXN0cmF0ZSBob3cgdGhlIG1l Y2hMaXN0TUlDIGZpZWxkDQogICB3b3VsZCBiZSBjb21wdXRlZC4NCg0KICAgVGhlIGluaXRpYWwg cGFydCBvZiB0aGUgREVSIGVuY29kaW5nIG9mIE5lZ1Rva2VuSW5pdCBpcyBjb25zdHJ1Y3RlZA0K ICAgYXMgZm9sbG93cyAodGhlICJubiIgYXJlIGxlbmd0aCBlbmNvZGluZ3MsIHBvc3NpYmx5IGxv bmdlciB0aGFuIG9uZQ0KICAgb2N0ZXQpOg0KDQogICAgICAzMCAtLSBpZGVudGlmaWVyIG9jdGV0 IGZvciBjb25zdHJ1Y3RlZCBTRVFVRU5DRSAoTmVnVG9rZW5Jbml0KQ0KICAgICAgbm4gLS0gbGVu Z3RoDQoNCiAgICAgICAgIC0tIGNvbnRlbnRzIG9jdGV0cyBvZiB0aGUgU0VRVUVOQ0UgYmVnaW4g d2l0aA0KICAgICAgICAgLS0gREVSIGVuY29kaW5nIG9mICJbMF0gTWVjaFR5cGVMaXN0IjoNCiAg ICAgICAgIEEwIC0tIGlkZW50aWZpZXIgb2N0ZXQgZm9yIGNvbnN0cnVjdGVkIFswXQ0KICAgICAg ICAgbm4gLS0gbGVuZ3RoDQoNCiAgICAgICAgICAgICAtLSBjb250ZW50cyBvZiB0aGUgY29uc3Ry dWN0ZWQgWzBdIGFyZSBERVIgZW5jb2RpbmcNCiAgICAgICAgICAgICAtLSBvZiBNZWNoVHlwZUxp c3QgKHdoaWNoIGlzIGEgU0VRVUVOQ0UpOg0KICAgICAgICAgICAgIDMwIC0tIGlkZW50aWZpZXIg b2N0ZXQgZm9yIGNvbnN0cnVjdGVkIFNFUVVFTkNFDQogICAgICAgICAgICAgbm4gLS0gbGVuZ3Ro DQoNCiAgICAgICAgICAgICAgICAtLSBjb250ZW50cyBvY3RldHMgb2YgdGhlIFNFUVVFTkNFIGJl Z2luIHdpdGgNCiAgICAgICAgICAgICAgICAtLSBERVIgZW5jb2Rpbmcgb2YgT0JKRUNUIElERU5U SUZJRVI6DQogICAgICAgICAgICAgICAgMDYgLS0gaWRlbnRpZmllciBvY3RldCBmb3IgcHJpbWl0 aXZlIE9CSkVDVCBJREVOVElGSUVSDQogICAgICAgICAgICAgICAgMDkgLS0gbGVuZ3RoDQogICAg ICAgICAgICAgICAgMkEgODYgNDggODYgRjcgMTIgMDEgMDIgMDIgLS0gS2VyYmVyb3MgVjUNCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSB7MSAyIDg0MCAxMTM1 NTQgMSAyIDJ9DQoNCiAgIElmIGEgbWVjaGxpc3RNSUMgbmVlZHMgdG8gYmUgZ2VuZXJhdGVkIChh Y2NvcmRpbmcgdG8gdGhlIHJ1bGVzIGluDQogICBTZWN0aW9uIDUpLCBpdCBpcyBjb21wdXRlZCBi eSB1c2luZyB0aGUgREVSIGVuY29kaW5nIG9mIHRoZSB0eXBlDQogICBNZWNoVHlwZUxpc3QgZGF0 YSBmcm9tIHRoZSBpbml0aWF0b3IncyBOZWdUb2tlbkluaXQgdG9rZW4gYXMgaW5wdXQgdG8NCiAg IHRoZSBHU1NfR2V0TUlDKCkgZnVuY3Rpb24uICBJbiB0aGlzIGNhc2UsIHRoZSBNSUMgd291bGQg YmUgY29tcHV0ZWQNCiAgIG92ZXIgdGhlIGZvbGxvd2luZyBvY3RldHM6DQoNCiAgICAgIERFUiBl bmNvZGluZyBvZiBNZWNoVHlwZUxpc3Q6DQogICAgICAzMCBubiAwNiAwOSAyQSA4NiA0OCA4NiBG NyAxMiAwMSAwMiAwMiAuLi4NCg0KICAgTm90ZSB0aGF0IHRoZSBpZGVudGlmaWVyIG9jdGV0IGFu ZCBsZW5naCBvY3RldChzKSBmb3IgY29uc3RydWN0ZWQgWzBdDQogICAoQTAgbm4pIGFyZSBub3Qg aW5jbHVkZWQgaW4gdGhlIE1JQyBjb21wdXRhdGlvbi4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQpa aHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDE0LCAyMDA1ICAgICAgICAgICAg ICAgICBbUGFnZSAyN10NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRp b24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCkludGVsbGVjdHVhbCBQcm9w ZXJ0eSBTdGF0ZW1lbnQNCg0KICAgVGhlIElFVEYgdGFrZXMgbm8gcG9zaXRpb24gcmVnYXJkaW5n IHRoZSB2YWxpZGl0eSBvciBzY29wZSBvZiBhbnkNCiAgIEludGVsbGVjdHVhbCBQcm9wZXJ0eSBS aWdodHMgb3Igb3RoZXIgcmlnaHRzIHRoYXQgbWlnaHQgYmUgY2xhaW1lZCB0bw0KICAgcGVydGFp biB0byB0aGUgaW1wbGVtZW50YXRpb24gb3IgdXNlIG9mIHRoZSB0ZWNobm9sb2d5IGRlc2NyaWJl ZCBpbg0KICAgdGhpcyBkb2N1bWVudCBvciB0aGUgZXh0ZW50IHRvIHdoaWNoIGFueSBsaWNlbnNl IHVuZGVyIHN1Y2ggcmlnaHRzDQogICBtaWdodCBvciBtaWdodCBub3QgYmUgYXZhaWxhYmxlOyBu b3IgZG9lcyBpdCByZXByZXNlbnQgdGhhdCBpdCBoYXMNCiAgIG1hZGUgYW55IGluZGVwZW5kZW50 IGVmZm9ydCB0byBpZGVudGlmeSBhbnkgc3VjaCByaWdodHMuICBJbmZvcm1hdGlvbg0KICAgb24g dGhlIHByb2NlZHVyZXMgd2l0aCByZXNwZWN0IHRvIHJpZ2h0cyBpbiBSRkMgZG9jdW1lbnRzIGNh biBiZQ0KICAgZm91bmQgaW4gQkNQIDc4IGFuZCBCQ1AgNzkuDQoNCiAgIENvcGllcyBvZiBJUFIg ZGlzY2xvc3VyZXMgbWFkZSB0byB0aGUgSUVURiBTZWNyZXRhcmlhdCBhbmQgYW55DQogICBhc3N1 cmFuY2VzIG9mIGxpY2Vuc2VzIHRvIGJlIG1hZGUgYXZhaWxhYmxlLCBvciB0aGUgcmVzdWx0IG9m IGFuDQogICBhdHRlbXB0IG1hZGUgdG8gb2J0YWluIGEgZ2VuZXJhbCBsaWNlbnNlIG9yIHBlcm1p c3Npb24gZm9yIHRoZSB1c2Ugb2YNCiAgIHN1Y2ggcHJvcHJpZXRhcnkgcmlnaHRzIGJ5IGltcGxl bWVudGVycyBvciB1c2VycyBvZiB0aGlzDQogICBzcGVjaWZpY2F0aW9uIGNhbiBiZSBvYnRhaW5l ZCBmcm9tIHRoZSBJRVRGIG9uLWxpbmUgSVBSIHJlcG9zaXRvcnkgYXQNCiAgIGh0dHA6Ly93d3cu aWV0Zi5vcmcvaXByLg0KDQogICBUaGUgSUVURiBpbnZpdGVzIGFueSBpbnRlcmVzdGVkIHBhcnR5 IHRvIGJyaW5nIHRvIGl0cyBhdHRlbnRpb24gYW55DQogICBjb3B5cmlnaHRzLCBwYXRlbnRzIG9y IHBhdGVudCBhcHBsaWNhdGlvbnMsIG9yIG90aGVyIHByb3ByaWV0YXJ5DQogICByaWdodHMgdGhh dCBtYXkgY292ZXIgdGVjaG5vbG9neSB0aGF0IG1heSBiZSByZXF1aXJlZCB0byBpbXBsZW1lbnQN CiAgIHRoaXMgc3RhbmRhcmQuICBQbGVhc2UgYWRkcmVzcyB0aGUgaW5mb3JtYXRpb24gdG8gdGhl IElFVEYgYXQNCiAgIGlldGYtaXByQGlldGYub3JnLg0KDQoNCkRpc2NsYWltZXIgb2YgVmFsaWRp dHkNCg0KICAgVGhpcyBkb2N1bWVudCBhbmQgdGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBoZXJl aW4gYXJlIHByb3ZpZGVkIG9uIGFuDQogICAiQVMgSVMiIGJhc2lzIGFuZCBUSEUgQ09OVFJJQlVU T1IsIFRIRSBPUkdBTklaQVRJT04gSEUvU0hFIFJFUFJFU0VOVFMNCiAgIE9SIElTIFNQT05TT1JF RCBCWSAoSUYgQU5ZKSwgVEhFIElOVEVSTkVUIFNPQ0lFVFkgQU5EIFRIRSBJTlRFUk5FVA0KICAg RU5HSU5FRVJJTkcgVEFTSyBGT1JDRSBESVNDTEFJTSBBTEwgV0FSUkFOVElFUywgRVhQUkVTUyBP UiBJTVBMSUVELA0KICAgSU5DTFVESU5HIEJVVCBOT1QgTElNSVRFRCBUTyBBTlkgV0FSUkFOVFkg VEhBVCBUSEUgVVNFIE9GIFRIRQ0KICAgSU5GT1JNQVRJT04gSEVSRUlOIFdJTEwgTk9UIElORlJJ TkdFIEFOWSBSSUdIVFMgT1IgQU5ZIElNUExJRUQNCiAgIFdBUlJBTlRJRVMgT0YgTUVSQ0hBTlRB QklMSVRZIE9SIEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUiBQVVJQT1NFLg0KDQoNCkNvcHlyaWdo dCBTdGF0ZW1lbnQNCg0KICAgQ29weXJpZ2h0IChDKSBUaGUgSW50ZXJuZXQgU29jaWV0eSAoMjAw NCkuICBUaGlzIGRvY3VtZW50IGlzIHN1YmplY3QNCiAgIHRvIHRoZSByaWdodHMsIGxpY2Vuc2Vz IGFuZCByZXN0cmljdGlvbnMgY29udGFpbmVkIGluIEJDUCA3OCwgYW5kDQogICBleGNlcHQgYXMg c2V0IGZvcnRoIHRoZXJlaW4sIHRoZSBhdXRob3JzIHJldGFpbiBhbGwgdGhlaXIgcmlnaHRzLg0K DQoNCkFja25vd2xlZGdtZW50DQoNCiAgIEZ1bmRpbmcgZm9yIHRoZSBSRkMgRWRpdG9yIGZ1bmN0 aW9uIGlzIGN1cnJlbnRseSBwcm92aWRlZCBieSB0aGUNCiAgIEludGVybmV0IFNvY2lldHkuDQoN Cg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTQsIDIwMDUgICAg ICAgICAgICAgICAgIFtQYWdlIDI4XQ0KDA0KDQo= ------_=_NextPart_001_01C4E1F6.26BED9C3 Content-Type: text/xml; name="draft-ietf-kitten-2478bis.xml" Content-Description: draft-ietf-kitten-2478bis.xml Content-Disposition: attachment; filename="draft-ietf-kitten-2478bis.xml" Content-Transfer-Encoding: base64 PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCg0KPCFET0NUWVBFIHJmYyBT WVNURU0gInJmYzI2MjkuZHRkIiBbDQogICAgPCFFTlRJVFkgUkZDMjExOSBQVUJMSUMgJycgDQog ICAgICAnaHR0cDovL3htbC5yZXNvdXJjZS5vcmcvcHVibGljL3JmYy9iaWJ4bWwvcmVmZXJlbmNl LlJGQy4yMTE5LnhtbCc+DQoNCiAgICA8IS0tIFNQTkVHTyAtLT4NCiAgICA8IUVOVElUWSBSRkMy NDc4IFBVQkxJQyAnJyANCiAgICAgICdodHRwOi8veG1sLnJlc291cmNlLm9yZy9wdWJsaWMvcmZj L2JpYnhtbC9yZWZlcmVuY2UuUkZDLjI0NzgueG1sJz4NCg0KICAgIDwhLS0gIEdTU0FQSSB2MiAt LT4NCiAgICA8IUVOVElUWSBSRkMyNzQzIFBVQkxJQyAnJyANCiAgICAgICdodHRwOi8veG1sLnJl c291cmNlLm9yZy9wdWJsaWMvcmZjL2JpYnhtbC9yZWZlcmVuY2UuUkZDLjI3NDMueG1sJz4NCl0+ DQoNCjw/eG1sLXN0eWxlc2hlZXQgdHlwZT0ndGV4dC94c2wnIGhyZWY9J3JmYzI2MjkueHNsdCcg Pz4NCg0KPD9yZmMgdG9jPSJ5ZXMiID8+DQo8P3JmYyBzeW1yZWZzPSJ5ZXMiID8+DQo8P3JmYyBz b3J0cmVmcz0ieWVzIiA/Pg0KPD9yZmMgaXBybm90aWZpZWQ9Im5vIiA/Pg0KPD9yZmMgc3RyaWN0 PSJ5ZXMiID8+DQoNCjxyZmMgaXByPSJmdWxsMzY2NyIgb2Jzb2xldGVzPSIyNDc4IiBkb2NOYW1l PSJkcmFmdC1pZXRmLWtpdHRlbi0yNDc4YmlzIj4NCg0KPGZyb250Pjx0aXRsZSBhYmJyZXY9IkdT Uy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtIj5UaGUgU2ltcGxlIGFuZCBQcm90ZWN0ZWQgR1NT LUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc208L3RpdGxlPg0KDQo8YXV0aG9yIGluaXRpYWxzPSJM LiIgc3VybmFtZT0iWmh1IiBmdWxsbmFtZT0iTGFycnkgWmh1Ij4NCjxvcmdhbml6YXRpb24+TWlj cm9zb2Z0IENvcnBvcmF0aW9uPC9vcmdhbml6YXRpb24+DQo8YWRkcmVzcz48cG9zdGFsPg0KPHN0 cmVldD5PbmUgTWljcm9zb2Z0IFdheTwvc3RyZWV0Pg0KPGNpdHk+UmVkbW9uZDwvY2l0eT4NCjxy ZWdpb24+V0E8L3JlZ2lvbj4NCjxjb2RlPjk4MDUyPC9jb2RlPg0KPGNvdW50cnk+VVM8L2NvdW50 cnk+DQo8L3Bvc3RhbD4NCjxlbWFpbD5semh1QG1pY3Jvc29mdC5jb208L2VtYWlsPjwvYWRkcmVz cz4NCjwvYXV0aG9yPg0KDQo8YXV0aG9yIGluaXRpYWxzPSJQLkouIiBzdXJuYW1lPSJMZWFjaCIg ZnVsbG5hbWU9IlBhdWwgTGVhY2giPg0KPG9yZ2FuaXphdGlvbj5NaWNyb3NvZnQgQ29ycG9yYXRp b248L29yZ2FuaXphdGlvbj4NCjxhZGRyZXNzPg0KPHBvc3RhbD48c3RyZWV0Pk9uZSBNaWNyb3Nv ZnQgV2F5PC9zdHJlZXQ+PGNpdHk+UmVkbW9uZDwvY2l0eT48cmVnaW9uPldBPC9yZWdpb24+PGNv ZGU+OTgwNTI8L2NvZGU+DQo8Y291bnRyeT5VUzwvY291bnRyeT48L3Bvc3RhbD4NCjxlbWFpbD5w YXVsbGVAbWljcm9zb2Z0LmNvbTwvZW1haWw+PC9hZGRyZXNzPg0KPC9hdXRob3I+DQoNCjxhdXRo b3IgaW5pdGlhbHM9IksuIiBzdXJuYW1lPSJKYWdhbmF0aGFuIiBmdWxsbmFtZT0iS2FydGhpayBK YWdhbmF0aGFuIj4NCjxvcmdhbml6YXRpb24+TWljcm9zb2Z0IENvcnBvcmF0aW9uPC9vcmdhbml6 YXRpb24+DQo8YWRkcmVzcz48cG9zdGFsPjxzdHJlZXQ+T25lIE1pY3Jvc29mdCBXYXk8L3N0cmVl dD48Y2l0eT5SZWRtb25kPC9jaXR5PjxyZWdpb24+V0E8L3JlZ2lvbj4NCjxjb2RlPjk4MDUyPC9j b2RlPjxjb3VudHJ5PlVTPC9jb3VudHJ5PjwvcG9zdGFsPjxlbWFpbD5rYXJ0aGlrakBtaWNyb3Nv ZnQuY29tPC9lbWFpbD48L2FkZHJlc3M+PC9hdXRob3I+IA0KDQo8YXV0aG9yIGluaXRpYWxzPSJX LiIgc3VybmFtZT0iSW5nZXJzb2xsIiBmdWxsbmFtZT0iV3lsbHlzIEluZ2Vyc29sbCI+DQo8b3Jn YW5pemF0aW9uPlN1biBNaWNyb3N5c3RlbXM8L29yZ2FuaXphdGlvbj4NCjxhZGRyZXNzPjxwb3N0 YWw+PHN0cmVldD4xNzc1IFdpZWhsZSBBdmVudWUsIDJuZCBGbG9vcjwvc3RyZWV0Pg0KPGNpdHk+ UmVzdG9uPC9jaXR5PjxyZWdpb24+VkE8L3JlZ2lvbj48Y29kZT4yMDE5MDwvY29kZT48Y291bnRy eT5VUzwvY291bnRyeT48L3Bvc3RhbD4NCjxlbWFpbD53eWxseXMuaW5nZXJzb2xsQHN1bi5jb208 L2VtYWlsPjwvYWRkcmVzcz4NCjwvYXV0aG9yPg0KDQoNCjxkYXRlIG1vbnRoPSJEZWNlbWJlciIg eWVhcj0iMjAwNCI+PC9kYXRlPg0KDQo8YXJlYT5TZWN1cml0eTwvYXJlYT48d29ya2dyb3VwPk5F VFdPUksgV09SS0lORyBHUk9VUDwvd29ya2dyb3VwPg0KDQo8a2V5d29yZD5JbnRlcm5ldC1EcmFm dDwva2V5d29yZD4NCg0KPGFic3RyYWN0Pg0KDQo8dD5UaGlzIGRvY3VtZW50IHNwZWNpZmllcyBh IG5lZ290aWF0aW9uIG1lY2hhbmlzbSBmb3IgdGhlIEdlbmVyaWMgU2VjdXJpdHkgU2VydmljZSBB cHBsaWNhdGlvbg0KICAgIFByb2dyYW0gSW50ZXJmYWNlIChHU1MtQVBJKSB3aGljaCBpcyBkZXNj cmliZWQgaW4gUkZDIDI3NDMuPC90Pg0KDQo8dD4gR1NTLUFQSSBwZWVycyBjYW4gdXNlIHRoaXMg bmVnb3RpYXRpb24gbWVjaGFuaXNtIHRvIGNob29zZSBmcm9tIGEgY29tbW9uIHNldCBvZiBzZWN1 cml0eQ0KICAgIG1lY2hhbmlzbXMuPC90Pg0KDQo8dD4gSWYgcGVyLW1lc3NhZ2UgaW50ZWdyaXR5 IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhlIGVzdGFibGlzaGVkIG1lY2hhbmlzbSBjb250 ZXh0LCB0aGVuIHRoZSBuZWdvdGlhdGlvbiBpcyANCnByb3RlY3RlZCBhZ2FpbnN0IGFuIGF0dGFj a2VyIGZvcmNpbmcgdGhlIHNlbGVjdGlvbiBvZiBhIG1lY2hhbmlzbSBub3QgZGVzaXJlZCBieSB0 aGUgcGVlcnMuPC90Pg0KDQo8dD4gVGhpcyBtZWNoYW5pc20gcmVwbGFjZXMgUkZDIDI0NzggaW4g b3JkZXIgdG8gZml4IGRlZmVjdHMgaW4gdGhhdCBzcGVjaWZpY2F0aW9uIGFuZCB0byBkZXNjcmli ZSBob3cgdG8gDQppbnRlcm9wZXJhdGUgd2l0aCBpbXBsZW1lbnRhdGlvbnMgb2YgdGhhdCBzcGVj aWZpY2F0aW9uIGNvbW1vbmx5IGRlcGxveWVkIG9uIHRoZSBJbnRlcm5ldC48L3Q+DQoNCjwvYWJz dHJhY3Q+DQoNCjwvZnJvbnQ+PG1pZGRsZT48c2VjdGlvbiBhbmNob3I9ImludHJvZHVjdGlvbiIg dGl0bGU9IkludHJvZHVjdGlvbiIgdG9jPSJkZWZhdWx0Ij4NCg0KPHQ+VGhlIEdTUy1BUEkgPHhy ZWYgdGFyZ2V0PSJSRkMyNzQzIiBwYWdlbm89ImZhbHNlIiBmb3JtYXQ9ImRlZmF1bHQiPjwveHJl Zj4gcHJvdmlkZXMgYSBnZW5lcmljDQogICAgaW50ZXJmYWNlIHdoaWNoIGNhbiBiZSBsYXllcmVk IGF0b3AgZGlmZmVyZW50IHNlY3VyaXR5IG1lY2hhbmlzbXMgc3VjaCB0aGF0IGlmIGNvbW11bmlj YXRpbmcgcGVlcnMNCiAgICBhY3F1aXJlIEdTUy1BUEkgY3JlZGVudGlhbHMgZm9yIHRoZSBzYW1l IHNlY3VyaXR5IG1lY2hhbmlzbSwgdGhlbiBhIHNlY3VyaXR5IGNvbnRleHQgbWF5IGJlDQogICAg ZXN0YWJsaXNoZWQgYmV0d2VlbiB0aGVtIChzdWJqZWN0IHRvIHBvbGljeSkuICBIb3dldmVyLCBH U1MtQVBJIGRvZXMgbm90IHByZXNjcmliZSB0aGUgbWV0aG9kIGJ5DQogICAgd2hpY2ggR1NTLUFQ SSBwZWVycyBjYW4gZXN0YWJsaXNoIHdoZXRoZXIgdGhleSBoYXZlIGEgY29tbW9uIHNlY3VyaXR5 IG1lY2hhbmlzbS48L3Q+DQoNCjx0PlRoZSBTaW1wbGUgYW5kIFByb3RlY3RlZCBHU1MtQVBJIE5l Z290aWF0aW9uIChTUE5FR08pIG1lY2hhbmlzbSBkZWZpbmVkIGhlcmUgaXMgYSBwc2V1ZG8gc2Vj dXJpdHkNCiAgICBtZWNoYW5pc20sIHJlcHJlc2VudGVkIGJ5IHRoZSBPYmplY3QgSWRlbnRpZmll ciBpc28ub3JnLmRvZC5pbnRlcm5ldC5zZWN1cml0eS5tZWNoYW5pc20uc25lZ28NCiAgICAoMS4z LjYuMS41LjUuMiksIHdoaWNoIGVuYWJsZXMgR1NTLUFQSSBwZWVycyB0byBkZXRlcm1pbmUgaW4t YmFuZCAgICAgIA0KICAgIHdoZXRoZXIgdGhlaXIgY3JlZGVudGlhbHMgc3VwcG9ydCBhIGNvbW1v biBzZXQgb2Ygb25lIG9yIG1vcmUgR1NTLUFQSSBzZWN1cml0eSBtZWNoYW5pc21zLA0KICAgICBh bmQgaWYgc28sIHRvIGludm9rZSB0aGUgbm9ybWFsIHNlY3VyaXR5IGNvbnRleHQgZXN0YWJsaXNo bWVudCBmb3IgYQ0KICAgICBzZWxlY3RlZCBjb21tb24gc2VjdXJpdHkgbWVjaGFuaXNtLiAgVGhp cyBpcyBtb3N0IHVzZWZ1bCBmb3INCiAgICBhcHBsaWNhdGlvbnMgd2hpY2ggZGVwZW5kIG9uIEdT Uy1BUEkgaW1wbGVtZW50YXRpb25zIGFuZCBzaGFyZQ0KICAgIG11bHRpcGxlIG1lY2hhbmlzbXMg YmV0d2VlbiB0aGUgcGVlcnMuPC90Pg0KICANCiAgICA8dD5UaGUgU1BORUdPIG1lY2hhbmlzbSBu ZWdvdGlhdGlvbiBpcyBiYXNlZCBvbiB0aGUgZm9sbG93aW5nDQogICAgIG1vZGVsOiB0aGUgaW5p dGlhdG9yIHByb3Bvc2VzIGEgbGlzdCBvZiBzZWN1cml0eQ0KICAgICBtZWNoYW5pc20ocyksIGlu IGRlY3JlYXNpbmcgcHJlZmVyZW5jZSBvcmRlciAoZmF2b3JpdGUgY2hvaWNlIGZpcnN0KSwgdGhl DQogICAgIGFjY2VwdG9yIChhbHNvIGtub3duIGFzIHRoZSB0YXJnZXQpIGVpdGhlciBhY2NlcHRz IHRoZSBpbml0aWF0b3Incw0KICAgICBwcmVmZXJyZWQgc2VjdXJpdHkgbWVjaGFuaXNtICh0aGUg Zmlyc3QgaW4gdGhlIGxpc3QpLCBvciBjaG9vc2VzIG9uZQ0KICAgICB0aGF0IGlzIGF2YWlsYWJs ZSBmcm9tIHRoZSBvZmZlcmVkIGxpc3QsIG9yIHJlamVjdHMgdGhlIHByb3Bvc2VkDQogICAgIHZh bHVlKHMpLiAgVGhlIHRhcmdldCB0aGVuIGluZm9ybXMgdGhlIGluaXRpYXRvciBvZiBpdHMgY2hv aWNlLjwvdD4NCiAgDQogICAgIDx0PiBPbmNlIGEgY29tbW9uIHNlY3VyaXR5IG1lY2hhbmlzbSBp cyBjaG9zZW4sIG1lY2hhbmlzbS1zcGVjaWZpYyBvcHRpb25zDQogICAgIE1BWSBiZSBuZWdvdGlh dGVkIGFzIHBhcnQgb2YgdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSdzIGNvbnRleHQgDQogICAgIGVz dGFibGlzaG1lbnQuICBUaGVzZSBuZWdvdGlhdGlvbnMgKGlmIGFueSkgYXJlIGludGVybmFsIHRv IHRoZSBtZWNoYW5pc20NCiAgICAgYW5kIG9wYXF1ZSB0byB0aGUgU1BORUdPIHByb3RvY29sLiAg QXMgc3VjaCB0aGV5IGFyZSBvdXRzaWRlIHRoZSANCiAgICAgc2NvcGUgb2YgdGhpcyBkb2N1bWVu dC48L3Q+DQogIA0KICAgICA8dD5JZiBwZXItbWVzc2FnZSBpbnRlZ3JpdHkgc2VydmljZXMgYXJl IGF2YWlsYWJsZSBvbiB0aGUgZXN0YWJsaXNoZWQNCiAgIG1lY2hhbmlzbSBzZWN1cml0eSBjb250 ZXh0LCB0aGVuIHRoZSBuZWdvdGlhdGlvbiBpcyBwcm90ZWN0ZWQgdG8gZW5zdXJlIHRoYXQgDQog ICB0aGUgbWVjaGFuaXNtIGxpc3QgaGFzIG5vdCBiZWVuIG1vZGlmaWVkLiAgSW4gY2FzZXMgd2hl cmUgYW4gYXR0YWNrZXIgY291bGQgDQogICBoYXZlIG1hdGVyaWFsbHkgaW5mbHVlbmNlZCB0aGUg bmVnb3RpYXRpb24sIHBlZXJzIGV4Y2hhbmdlIG1lc3NhZ2UgaW50ZWdyaXR5IA0KICAgY29kZSAo TUlDKSB0b2tlbnMgdG8gY29uZmlybSB0aGUgbWVjaGFuaXNtIGxpc3QgaGFzIG5vdCBiZWVuIG1v ZGlmaWVkLiAgSWYgDQogICBubyBhY3Rpb24gb2YgYW4gYXR0YWNrZXIgY291bGQgaGF2ZSBtYXRl cmlhbGx5IG1vZGlmaWVkIHRoZSBvdXRjb21lIG9mIHRoZSANCiAgIG5lZ290aWF0aW9uLCB0aGUg ZXhjaGFuZ2Ugb2YgTUlDIHRva2VucyBpcyBvcHRpb25hbCAoc2VlIDx4cmVmIHRhcmdldD0ibWlj cHJvY2Vzc2luZyIvPikuICBBbGxvd2luZyBNSUMgdG9rZW5zIHRvIGJlIA0KICAgb3B0aW9uYWwg aW4gdGhpcyBjYXNlIHByb3ZpZGVzIGludGVyb3BlcmFiaWxpdHkgd2l0aCBleGlzdGluZyBpbXBs ZW1lbnRhdGlvbnMgd2hpbGUgDQogICBzdGlsbCBwcm90ZWN0aW5nIHRoZSBuZWdvdGlhdGlvbi4g IFRoaXMgaW50ZXJvcGVyYWJpbGl0eSBjb21lcyBhdCB0aGUgY29zdCBvZiBpbmNyZWFzZWQgDQog ICBjb21wbGV4aXR5LjwvdD4NCiAgDQogICAgIDx0PkluIG9yZGVyIHRvIGF2b2lkIGFuIGV4dHJh IHJvdW5kIHRyaXAsIHRoZSBmaXJzdCBjb250ZXh0IGVzdGFibGlzaG1lbnQgdG9rZW4gb2YNCiAg ICAgdGhlIGluaXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5pc20gU0hPVUxEIGJlIGVtYmVkZGVk IGluIHRoZSBpbml0aWFsIG5lZ290aWF0aW9uDQogICAgIG1lc3NhZ2UgKGFzIGRlZmluZWQgaW4g U2VjdGlvbiA0LjIpLiAgKFRoaXMgbWVjaGFuaXNtIHRva2VuIGlzDQogICAgIHJlZmVycmVkIHRv IGFzIHRoZSBvcHRpbWlzdGljIG1lY2hhbmlzbSB0b2tlbiBpbiB0aGlzIGRvY3VtZW50LikgICAg ICANCiAgICAgSW4gYWRkaXRpb24sIHVzaW5nIHRoZSBvcHRpbWlzdGljIG1lY2hhbmlzbSB0b2tl biBhbGxvd3MgdGhlIGluaXRpYXRvciB0byByZWNvdmVyDQogICAgIGZyb20gbm9uLWZhdGFsIGVy cm9ycyBlbmNvdW50ZXJlZCB0cnlpbmcgdG8gcHJvZHVjZSB0aGUgZmlyc3QgbWVjaGFuaXNtIHRv a2VuIGJlZm9yZSBhDQogICAgIG1lY2hhbmlzbSBjYW4gYmUgc2VsZWN0ZWQuIEltcGxlbWVudGF0 aW9ucyBNQVkgb21pdCB0aGUgb3B0aW1pc3RpYyBtZWNoYW5pc20gdG9rZW4gDQogICBpbiBjYXNl cyB3aGVyZSB0aGUgbGlrZWxpaG9vZCBvZiB0aGUgaW5pdGlhdG9yJ3MNCiAgIHByZWZlcnJlZCBt ZWNoYW5pc20gbm90IGJlaW5nIHNlbGVjdGVkIGJ5IHRoZSBhY2NlcHRvciBpcyBzaWduaWZpY2Fu dCBnaXZlbiB0aGUgY29zdCBvZiBnZW5lcmF0aW5nIGl0LjwvdD4NCg0KIDx0PlNQTkVHTyByZWxp ZXMgb24gdGhlIGNvbmNlcHRzIGRldmVsb3BlZCBpbiB0aGUgR1NTLUFQSSBzcGVjaWZpY2F0aW9u IDx4cmVmIHRhcmdldD0iUkZDMjc0MyINCiAgICAgICAgcGFnZW5vPSJmYWxzZSIgZm9ybWF0PSJk ZWZhdWx0Ij48L3hyZWY+LiAgVGhlIG5lZ290aWF0aW9uIGRhdGEgaXMgZW5jYXBzdWxhdGVkIGlu DQogICAgY29udGV4dC1sZXZlbCB0b2tlbnMuICBUaGVyZWZvcmUsIGNhbGxlcnMgb2YgdGhlIEdT Uy1BUEkgZG8gbm90IG5lZWQgdG8gYmUgYXdhcmUgb2YgdGhlIGV4aXN0ZW5jZQ0KICAgIG9mIHRo ZSBuZWdvdGlhdGlvbiB0b2tlbnMgYnV0IG9ubHkgb2YgdGhlIG5ldyBwc2V1ZG8tc2VjdXJpdHkg bWVjaGFuaXNtLiAgQSBmYWlsdXJlIGluIHRoZQ0KICAgIG5lZ290aWF0aW9uIHBoYXNlIGNhdXNl cyBhIG1ham9yIHN0YXR1cyBjb2RlIHRvIGJlIHJldHVybmVkOiBHU1NfU19CQURfTUVDSC48L3Q+ DQoNCjwvc2VjdGlvbj4NCg0KPHNlY3Rpb24gdGl0bGU9IkNvbnZlbnRpb25zIFVzZWQgaW4gVGhp cyBEb2N1bWVudCIgdG9jPSJkZWZhdWx0Ij4NCg0KPHQ+VGhlIGtleSB3b3JkcyAiTVVTVCIsICJN VVNUIE5PVCIsICJSRVFVSVJFRCIsICJTSEFMTCIsICJTSEFMTCBOT1QiLCAiU0hPVUxEIiwgIlNI T1VMRCBOT1QiLA0KICAgICJSRUNPTU1FTkRFRCIsICJNQVkiLCBhbmQgIk9QVElPTkFMIiBpbiB0 aGlzIGRvY3VtZW50IGFyZSB0byBiZSBpbnRlcnByZXRlZCBhcyBkZXNjcmliZWQgaW4gPHhyZWYN CiAgICAgICAgdGFyZ2V0PSJSRkMyMTE5IiBwYWdlbm89ImZhbHNlIiBmb3JtYXQ9ImRlZmF1bHQi PjwveHJlZj4uPC90Pg0KDQo8L3NlY3Rpb24+DQoNCjxzZWN0aW9uIHRpdGxlPSJOZWdvdGlhdGlv biBQcm90b2NvbCIgdG9jPSJkZWZhdWx0Ij4NCg0KPHQ+V2hlbiB0aGUgZXN0YWJsaXNoZWQgbWVj aGFuaXNtIGNvbnRleHQgcHJvdmlkZXMgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHRoZSBtZWNoYW5p c20gbmVnb3RpYXRpb24NCiAgICBjYW4gYmUgcHJvdGVjdGVkLiAgV2hlbiBhY3F1aXJpbmcgbmVn b3RpYXRlZCBzZWN1cml0eSBtZWNoYW5pc20gdG9rZW5zLCBwZXItbWVzc2FnZSBpbnRlZ3JpdHkg c2VydmljZXMgYXJlIA0KICAgIGFsd2F5cyByZXF1ZXN0ZWQgYnkgdGhlIFNQTkVHTyBtZWNoYW5p c20uPC90Pg0KDQo8dD5XaGVuIHRoZSBlc3RhYmxpc2hlZCBtZWNoYW5pc20gY29udGV4dCBzdXBw b3J0cyBwZXItbWVzc2FnZSBpbnRlZ3JpdHkgc2VydmljZXMsIFNQTkVHTyBndWFyYW50ZWVzIHRo YXQgDQogICB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtIGlzIG11dHVhbGx5IHByZWZlcnJlZC48L3Q+ DQoNCjx0PlRoaXMgc2VjdGlvbiBkZXNjcmliZXMgdGhlIG5lZ290aWF0aW9uIHByb2Nlc3Mgb2Yg dGhpcyBwcm90b2NvbC48L3Q+DQoNCjxzZWN0aW9uIGFuY2hvcj0icHJvdG9jb2wiIHRpdGxlPSJO ZWdvdGlhdGlvbiBEZXNjcmlwdGlvbiIgdG9jPSJkZWZhdWx0Ij4NCg0KPHQ+VGhlIGZpcnN0IG5l Z290aWF0aW9uIHRva2VuIHNlbnQgYnkgdGhlIGluaXRpYXRvciBjb250YWlucyBhbiBvcmRlcmVk IA0KbGlzdCBvZiBtZWNoYW5pc21zIGluIGRlY3JlYXNpbmcgcHJlZmVyZW5jZSBvcmRlciAoZmF2 b3JpdGUgbWVjaGFuaXNtIGZpcnN0KSwgYW5kIG9wdGlvbmFsbHkgdGhlIGluaXRpYWwgbWVjaGFu aXNtIHRva2VuIGZvciB0aGUNCiAgICBwcmVmZXJyZWQgbWVjaGFuaXNtIG9mIHRoZSBpbml0aWF0 b3IgKGkuZS4sIHRoZSBmaXJzdCBpbiB0aGUgbGlzdCkuICAgIA0KICAgIChOb3RlIHRoYXQgdGhl IGxpc3QgTVVTVCBOT1QgY29udGFpbiBtZWNoYW5pc21zIGZvciB3aGljaCB0aGUgY2xpZW50DQog ICBkb2VzIG5vdCBoYXZlIGFwcHJvcHJpYXRlIGNyZWRlbnRpYWxzLik8L3Q+DQoNCjx0PlRoZSB0 YXJnZXQgdGhlbiBwcm9jZXNzZXMgdGhlIHRva2VuIGZyb20gdGhlIGluaXRpYXRvci4gIFRoaXMg d2lsbCByZXN1bHQgaW4gb25lIG9mIGZvdXIgcG9zc2libGUNCiAgICBzdGF0ZXMgKGFzIGRlZmlu ZWQgaW4gPHhyZWYgdGFyZ2V0PSJyZXN1bHRzIi8+KSBiZWluZyByZXR1cm5lZCBpbiB0aGUgcmVw bHkgbWVzc2FnZToNCiAgICBhY2NlcHRfY29tcGxldGVkLCBhY2NlcHRfaW5jb21wbGV0ZSwgcmVq ZWN0LCBvciByZXF1ZXN0X21pYy4gIEEgcmVqZWN0IHN0YXRlIHdpbGwgdGVybWluYXRlIHRoZQ0K ICAgIG5lZ290aWF0aW9uOyAgYW4gYWNjZXB0X2NvbXBsZXRlZCBzdGF0ZSBpbmRpY2F0ZXMgdGhh dCBub3Qgb25seSB3YXMgdGhlIGluaXRpYXRvci1zZWxlY3RlZCBtZWNoYW5pc20gYWNjZXB0YWJs ZSB0bw0KICAgIHRoZSB0YXJnZXQsIGJ1dCBhbHNvIHRoYXQgdGhlIG9wdGltaXN0aWMgbWVjaGFu aXNtIHRva2VuIHdhcyBzdWZmaWNpZW50IHRvIGNvbXBsZXRlIHRoZSBhdXRoZW50aWNhdGlvbjsg IGFuDQogICAgYWNjZXB0X2luY29tcGxldGUgc3RhdGUgaW5kaWNhdGVzIHRoYXQgZnVydGhlciBt ZXNzYWdlIGV4Y2hhbmdlIGlzIG5lZWRlZCBidXQgdGhlIE1JQyB0b2tlbiBleGNoYW5nZSANCiAg ICBhcyBkZXNjcmliZWQgaW4gPHhyZWYgdGFyZ2V0PSJtaWNwcm9jZXNzaW5nIi8+DQogICAgaXMg T1BUSU9OQUw7ICBhIHJlcXVlc3RfbWljIHN0YXRlICh0aGlzIHN0YXRlIGNhbiBvbmx5IGJlIHBy ZXNlbnQgaW4gdGhlIGZpcnN0DQogICAgcmVwbHkgbWVzc2FnZSBmcm9tIHRoZSB0YXJnZXQpIGlu ZGljYXRlcyB0aGUgTUlDIHRva2VuIGV4Y2hhbmdlIGlzIFJFUVVJUkVEIGlmDQogICAgcGVyLW1l c3NhZ2UgaW50ZWdyaXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUuIDwvdD4NCg0KPHQ+IFVubGVz cyB0aGUgcHJlZmVyZW5jZSBvcmRlciBpcyBzcGVjaWZpZWQgYnkgdGhlIGFwcGxpY2F0aW9uIChz ZWUgPHhyZWYgdGFyZ2V0PSJzdXBwb3J0YXBpIi8+KSwgDQogICAgdGhlIHBvbGljeSBieSB3aGlj aCB0aGUgdGFyZ2V0IGNob29zZXMgYSBtZWNoYW5pc20gaXMgYW4gaW1wbGVtZW50YXRpb24tc3Bl Y2lmaWMgbG9jYWwgbWF0dGVyLiAgSW4NCiAgICB0aGUgYWJzZW5jZSBvZiBhbiBhcHBsaWNhdGlv biBzcGVjaWZpZWQgcHJlZmVyZW5jZSBvcmRlciBvciBvdGhlciBwb2xpY3ksIHRoZSB0YXJnZXQg U0hBTEwgY2hvb3NlIHRoZSANCiAgICBmaXJzdCBtZWNoYW5pc20gaW4gdGhlIGluaXRpYXRvciBw cm9wb3NlZCBsaXN0IGZvciB3aGljaCBpdCBoYXMgdmFsaWQgY3JlZGVudGlhbHMuPC90Pg0KDQo8 dD4gSW4gY2FzZSBvZiBhIHN1Y2Nlc3NmdWwgbmVnb3RpYXRpb24sIHRoZSBzZWN1cml0eSBtZWNo YW5pc20gaW4gdGhlIGZpcnN0IHJlcGx5IG1lc3NhZ2UNCiAgIHJlcHJlc2VudHMgdGhlIHZhbHVl IHN1aXRhYmxlIGZvciB0aGUgdGFyZ2V0LCBjaG9zZW4gZnJvbSB0aGUNCiAgIGxpc3Qgb2ZmZXJl ZCBieSB0aGUgaW5pdGlhdG9yLiA8L3Q+DQogDQo8dD5JbiBjYXNlIG9mIGFuIHVuc3VjY2Vzc2Z1 bCBuZWdvdGlhdGlvbiwgdGhlIHJlamVjdCBzdGF0ZSBpcyByZXR1cm5lZCBhbmQgaXQgaXMgT1BU SU9OQUwgDQp0byBlbWl0IGEgY29udGV4dCBsZXZlbCBuZWdvdGlhdGlvbiB0b2tlbi48L3Q+DQoN Cjx0PiBPbmNlIGEgbWVjaGFuaXNtIGhhcyBiZWVuIHNlbGVjdGVkLCBjb250ZXh0IGVzdGFibGlz aG1lbnQgdG9rZW5zIHNwZWNpZmljIHRvIHRoZQ0KICAgc2VsZWN0ZWQgbWVjaGFuaXNtIGFyZSBj YXJyaWVkIHdpdGhpbiB0aGUgbmVnb3RpYXRpb24gdG9rZW5zLjwvdD4NCg0KPHQ+IExhc3RseSwg TUlDIHRva2VucyBtYXkgYmUgZXhjaGFuZ2VkIHRvIGVuc3VyZSB0aGUgYXV0aGVudGljaXR5IG9m IHRoZSBtZWNoYW5pc20gbGlzdCANCiAgICByZWNlaXZlZCBieSB0aGUgdGFyZ2V0LjwvdD4NCg0K PHQ+IFRvIGF2b2lkIGNvbmZsaWN0cyB3aXRoIHRoZSB1c2Ugb2YgTUlDIHRva2VucyBieSBTUE5F R08sDQogICBwYXJ0aWFsbHktZXN0YWJsaXNoZWQgY29udGV4dHMgTVVTVCBOT1QgYmUgdXNlZCBm b3IgcGVyLW1lc3NhZ2UgY2FsbHMuICBUbyANCiAgIGd1YXJhbnRlZSB0aGlzLCB0aGUgcHJvdF9y ZWFkeV9zdGF0ZSA8eHJlZiB0YXJnZXQ9IlJGQzI3NDMiLz4gTVVTVCBiZSBzZXQgdG8gZmFsc2Ug b24gcmV0dXJuIA0KICAgZnJvbSBHU1NfSW5pdF9zZWNfY29udGV4dCgpIGFuZCBHU1NfQWNjZXB0 X3NlY19jb250ZXh0KCkgZXZlbiBpZiB0aGUgdW5kZXJseWluZw0KICAgbWVjaGFuaXNtIHJldHVy bmVkIHRydWUuPC90Pg0KDQo8L3NlY3Rpb24+DQoNCjxzZWN0aW9uIGFuY2hvcj0ibmVnb3Byb2Mi IHRpdGxlPSJOZWdvdGlhdGlvbiBQcm9jZWR1cmUiIA0KICAgIHRvYz0iZGVmYXVsdCI+DQogICAg DQo8dD5UaGUgYmFzaWMgZm9ybSBvZiB0aGUgcHJvY2VkdXJlIGFzc3VtZXMgdGhhdCBwZXItbWVz c2FnZSBpbnRlZ3JpdHkgc2VydmljZXMgYXJlDQogICAgYXZhaWxhYmxlIG9uIHRoZSBlc3RhYmxp c2hlZCBtZWNoYW5pc20gY29udGV4dCwgYW5kIGl0IGlzIHN1bW1hcml6ZWQgYXMgZm9sbG93czo8 L3Q+DQogICANCjx0PjxsaXN0IHN0eWxlPSJoYW5naW5nIj4NCiAgICAgICAgDQogICAgPHQgaGFu Z1RleHQ9IihhKSI+VGhlIEdTUy1BUEkgaW5pdGlhdG9yIGludm9rZXMgR1NTX0luaXRfc2VjX2Nv bnRleHQoKSBhcyBub3JtYWwsDQogICAgICAgYnV0IHJlcXVlc3RzIHRoYXQgU1BORUdPIGJlIHVz ZWQuICBTUE5FR08gY2FuIGVpdGhlciBiZSBleHBsaWNpdHkNCiAgICAgICByZXF1ZXN0ZWQgb3Ig YWNjZXB0ZWQgYXMgdGhlIGRlZmF1bHQgbWVjaGFuaXNtLjx2c3BhY2UgYmxhbmtMaW5lcz0iMSI+ PC92c3BhY2U+PC90Pg0KDQogICAgPHQgaGFuZ1RleHQ9IihiKSI+VGhlIGluaXRpYXRvciBHU1Mt QVBJIGltcGxlbWVudGF0aW9uIGVtaXRzIGEgbmVnb3RpYXRpb24gdG9rZW4NCiAgICAgICBjb250 YWluaW5nIGEgbGlzdCBvZiBvbmUgb3IgbW9yZSBzZWN1cml0eSBtZWNoYW5pc21zIHRoYXQgYXJl IGF2YWlsYWJsZQ0KICAgICAgIGJhc2VkIG9uIHRoZSBjcmVkZW50aWFscyB1c2VkIGZvciB0aGlz IGNvbnRleHQgZXN0YWJsaXNobWVudCwgYW5kIA0KICAgICAgIG9wdGlvbmFsbHkgdGhlIGluaXRp YWwgbWVjaGFuaXNtIHRva2VuIGZvciB0aGUgZmlyc3QgbWVjaGFuaXNtIGluIA0KICAgICAgIHRo ZSBsaXN0Ljx2c3BhY2UgYmxhbmtMaW5lcz0iMSI+PC92c3BhY2U+PC90Pg0KDQogICAgPHQgaGFu Z1RleHQ9IihjKSI+VGhlIEdTUy1BUEkgaW5pdGlhdG9yIGFwcGxpY2F0aW9uIHNlbmRzIHRoZSB0 b2tlbiB0byB0aGUgdGFyZ2V0IGFwcGxpY2F0aW9uLg0KICAgICAgICBUaGUgR1NTLUFQSSB0YXJn ZXQgYXBwbGljYXRpb24gZGVwb3NpdHMgdGhlIHRva2VuIGJ5IGludm9raW5nIEdTU19BY2NlcHRf c2VjX2NvbnRleHQoKS4NCiAgICAgICAgVGhlIGFjY2VwdG9yIHdpbGwgZG8gb25lIG9mIHRoZSBm b2xsb3dpbmc6PC90Pg0KDQogICAgPHQgaGFuZ1RleHQ9IiI+PGxpc3Qgc3R5bGU9Imhhbmdpbmci Pg0KICAgICAgICAgIA0KICAgICAgICAgICA8dCBoYW5nVGV4dD0iIj4NCg0KICAgICAgICA8bGlz dCBzdHlsZT0iaGFuZ2luZyI+DQoNCiAgICAgICAgICAgIDx0IGhhbmdUZXh0PSIoSSkiPklmIG5v bmUgb2YgdGhlIHByb3Bvc2VkIG1lY2hhbmlzbXMgYXJlIGFjY2VwdGFibGUsIA0KdGhlIG5lZ290 aWF0aW9uIFNIQUxMIGJlIHRlcm1pbmF0ZWQuDQpHU1NfQWNjZXB0X3NlY19jb250ZXh0IGluZGlj YXRlcyBHU1NfU19CQURfTUVDSC4gIFRoZSBhY2NlcHRvciBNQVkgb3V0cHV0IGEgbmVnb3RpYXRp b24gDQp0b2tlbiBjb250YWluaW5nIGEgcmVqZWN0IHN0YXRlLjx2c3BhY2UgYmxhbmtMaW5lcz0i MSIvPjwvdD4NCg0KICAgICAgICAgICAgPHQgaGFuZ1RleHQ9IihJSSkiPklmIGVpdGhlciB0aGUg aW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSBpcyBub3QgYWNjZXB0ZWQgYnkgDQp0aGUg dGFyZ2V0IG9yIHRoaXMgbWVjaGFuaXNtIGlzIGFjY2VwdGVkIGJ1dCBpdCBpcyBub3QgdGhlDQph Y2NlcHRvcidzIG1vc3QgcHJlZmVycmVkIG1lY2hhbmlzbSAoaS5lLiwgdGhlIE1JQyB0b2tlbiBl eGNoYW5nZQ0KYXMgZGVzY3JpYmVkIGluIDx4cmVmIHRhcmdldD0ibWljcHJvY2Vzc2luZyIvPiBp cyByZXF1aXJlZCksIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKQ0KaW5kaWNhdGVzIEdTU19TX0NP TlRJTlVFX05FRURFRC4gIFRoZSBhY2NlcHRvciBNVVNUIG91dHB1dCBhIG5lZ290aWF0aW9uIHRv a2VuIGNvbnRhaW5pbmcgDQphIHJlcXVlc3RfbWljIHN0YXRlLiA8dnNwYWNlIGJsYW5rTGluZXM9 IjEiLz48L3Q+DQoNCiAgICA8dCBoYW5nVGV4dD0iKElJSSkiPiBPdGhlcndpc2UgaWYgYXQgbGVh c3Qgb25lDQogYWRkaXRpb25hbCBuZWdvdGlhdGlvbiB0b2tlbiBmcm9tIHRoZSBpbml0aWF0b3Ig aXMgbmVlZGVkIHRvDQogZXN0YWJsaXNoIHRoaXMgY29udGV4dCwgR1NTX0FjY2VwdF9zZWNfY29u dGV4dCgpIGluZGljYXRlcyBHU1NfU19DT05USU5VRV9ORUVERUQgYW5kDQogb3V0cHV0cyBhIG5l Z290aWF0aW9uIHRva2VuIGNvbnRhaW5pbmcgYW4gYWNjZXB0X2luY29tcGxldGUgc3RhdGUuDQog PHZzcGFjZSBibGFua0xpbmVzPSIxIi8+PC90Pg0KDQogICAgPHQgaGFuZ1RleHQ9IihJVikiPiBP dGhlcndpc2Ugbm8gYWRkaXRpb25hbCBuZWdvdGlhdGlvbiB0b2tlbiBmcm9tIHRoZSBpbml0aWF0 b3IgaXMgbmVlZGVkIHRvDQplc3RhYmxpc2ggdGhpcyBjb250ZXh0LCAgR1NTX0FjY2VwdF9zZWNf Y29udGV4dCgpIGluZGljYXRlcyBHU1NfU19DT01QTEVURSBhbmQgb3V0cHV0cyANCmEgbmVnb3Rp YXRpb24gdG9rZW4gY29udGFpbmluZyBhbiBhY2NlcHRfY29tcGxldGUgc3RhdGUuPHZzcGFjZSBi bGFua0xpbmVzPSIxIi8+PC90Pg0KDQogICAgICAgICA8L2xpc3Q+DQoNCiAgICAgICAgICAgPC90 Pg0KICAgICAgICAgICA8L2xpc3Q+PC90Pg0KDQogICAgPHQgaGFuZ1RleHQ9IiI+SWYgdGhlIGlu aXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5pc20gaXMgYWNjZXB0ZWQsIGFuZCBhbiBvcHRpbWlz dGljIG1lY2hhbmlzbQ0KdG9rZW4gd2FzIGluY2x1ZGVkLCB0aGlzIG1lY2hhbmlzbSB0b2tlbiBN VVNUIGJlIGRlcG9zaXRlZCB0byB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtIGJ5IGludm9raW5nDQpH U1NfQWNjZXB0X3NlY19jb250ZXh0KCkgYW5kIGlmIGEgcmVzcG9uc2UgbWVjaGFuaXNtIHRva2Vu IGlzIGVtaXR0ZWQsIGl0IE1VU1QgYmUgaW5jbHVkZWQgaW4NCnRoZSByZXNwb25zZSBuZWdvdGlh dGlvbiB0b2tlbi4gT3RoZXJ3aXNlLCB0aGUgdGFyZ2V0IHdpbGwgbm90IGVtaXQgYSByZXNwb25z ZSBtZWNoYW5pc20gdG9rZW4gaW4gdGhlDQpmaXJzdCByZXBseS48dnNwYWNlIGJsYW5rTGluZXM9 IjEiPjwvdnNwYWNlPjwvdD4NCg0KICAgIDx0IGhhbmdUZXh0PSIoZCkiPlRoZSBHU1MtQVBJIHRh cmdldCBhcHBsaWNhdGlvbiByZXR1cm5zIHRoZSBuZWdvdGlhdGlvbiB0b2tlbiB0byB0aGUgaW5p dGlhdG9yDQphcHBsaWNhdGlvbi4gIFRoZSBHU1MtQVBJIGluaXRpYXRvciBhcHBsaWNhdGlvbiBk ZXBvc2l0cyB0aGUgdG9rZW4gYnkgaW52b2tpbmcNCkdTU19Jbml0X3NlY19jb250ZXh0KCkuICBU aGUgc2VjdXJpdHkgY29udGV4dCBpbml0aWFsaXphdGlvbiBpcyB0aGVuIGNvbnRpbnVlZCBhY2Nv cmRpbmcgdG8NCnRoZSBzdGFuZGFyZCBHU1MtQVBJIGNvbnZlbnRpb25zIGZvciB0aGUgc2VsZWN0 ZWQgbWVjaGFuaXNtLCB3aGVyZSB0aGUgdG9rZW5zIG9mIHRoZSBzZWxlY3RlZA0KbWVjaGFuaXNt IGFyZSBlbmNhcHN1bGF0ZWQgdW50aWwgdGhlIEdTU19TX0NPTVBMRVRFIGlzIHJldHVybmVkIGZv ciBib3RoIHRoZSBpbml0aWF0b3IgYW5kIHRoZQ0KdGFyZ2V0IGJ5IHRoZSBzZWxlY3RlZCBzZWN1 cml0eSBtZWNoYW5pc20uPHZzcGFjZSBibGFua0xpbmVzPSIxIj48L3ZzcGFjZT48L3Q+DQoNCiAg ICA8dCBoYW5nVGV4dD0iKGUpIj5NSUMgdG9rZW5zIGFyZSB0aGVuIGVpdGhlciBza2lwcGVkIG9y IGV4Y2hhbmdlZCBhY2NvcmRpbmcgdG8gPHhyZWYgdGFyZ2V0PSJtaWNwcm9jZXNzaW5nIi8+Ljwv dD4NCg0KPC9saXN0PjwvdD4NCg0KICAgIDx0Pk5vdGUgdGhhdCB0aGUgKl9yZXFfZmxhZyBpbnB1 dCBwYXJhbWV0ZXJzIGZvciBjb250ZXh0IGVzdGFibGlzaG1lbnQgYXJlIHJlbGF0aXZlIHRvIHRo ZQ0KICAgICAgICBzZWxlY3RlZCBtZWNoYW5pc20sIGFzIGFyZSB0aGUgKl9zdGF0ZSBvdXRwdXQg cGFyYW1ldGVycy4gaS5lLiwgdGhlc2UgcGFyYW1ldGVycyBhcmUgbm90DQogICAgICAgIGFwcGxp Y2FibGUgdG8gdGhlIG5lZ290aWF0aW9uIHByb2Nlc3MgcGVyIHNlLjwvdD4NCiAgICANCiAgICA8 dD5PbiByZWNlaXB0IG9mIGEgbmVnb3RpYXRpb24gdG9rZW4gb24gdGhlIHRhcmdldCBzaWRlLCBh IEdTUy1BUEkgaW1wbGVtZW50YXRpb24gdGhhdCBkb2VzIG5vdA0Kc3VwcG9ydCBuZWdvdGlhdGlv biB3b3VsZCBpbmRpY2F0ZSB0aGUgR1NTX1NfQkFEX01FQ0ggc3RhdHVzIGFzIGlmIGEgcGFydGlj dWxhciBiYXNpYyBzZWN1cml0eQ0KbWVjaGFuaXNtIGhhZCBiZWVuIHJlcXVlc3RlZCBhbmQgd2Fz IG5vdCBzdXBwb3J0ZWQuPC90Pg0KICAgIA0KICAgIDx0PldoZW4gR1NTX0FjcXVpcmVfY3JlZCBp cyBpbnZva2VkIHdpdGggdGhpcyBuZWdvdGlhdGlvbiBtZWNoYW5pc20gaW4gdGhlDQogICAgIGRl c2lyZWRfbWVjaHMsIGFuIGltcGxlbWVudGF0aW9uLXNwZWNpZmljIGRlZmF1bHQgY3JlZGVudGlh bCBpcyB1c2VkDQogICB0byBjYXJyeSBvbiB0aGUgbmVnb3RpYXRpb24uIEEgc2V0IG9mIG1lY2hh bmlzbXMgYXMgc3BlY2lmaWVkDQogICBsb2NhbGx5IGJ5IHRoZSBzeXN0ZW0gYWRtaW5pc3RyYXRv ciBpcyB0aGVuIGF2YWlsYWJsZSBmb3INCiAgIG5lZ290aWF0aW9uLg0KICAgIElmIHRoZXJlIGlz IGEgZGVzaXJlIGZvciB0aGUgY2FsbGVyIHRvIG1ha2UgaXRzIG93bg0KICAgICBjaG9pY2UsIHRo ZW4gYW4gYWRkaXRpb25hbCBBUEkgaGFzIHRvIGJlIHVzZWQgKHNlZSA8eHJlZiB0YXJnZXQ9InN1 cHBvcnRhcGkiIHBhZ2Vubz0iZmFsc2UiIGZvcm1hdD0iZGVmYXVsdCI+PC94cmVmPikuPC90Pg0K DQo8L3NlY3Rpb24+DQoNCjwvc2VjdGlvbj4NCg0KPHNlY3Rpb24gdGl0bGU9IlRva2VuIERlZmlu aXRpb25zIiB0b2M9ImRlZmF1bHQiPg0KDQo8dD5UaGUgdHlwZSBkZWZpbml0aW9ucyBpbiB0aGlz IHNlY3Rpb24gYXNzdW1lIGFuIEFTTi4xIG1vZHVsZSBkZWZpbml0aW9uIG9mIHRoZSBmb2xsb3dp bmcNCiAgICBmb3JtOjwvdD4NCg0KPGZpZ3VyZSB0aXRsZT0iIj48YXJ0d29yayBuYW1lPSIiIHR5 cGU9IiIgd2lkdGg9IiIgaGVpZ2h0PSIiPiAgICANCg0KICAgU1BORUdPQVNOT25lU3BlYyB7ICAg ICAgICAgIA0KICAgICAgIGlzbygxKSBpZGVudGlmaWVkLW9yZ2FuaXphdGlvbigzKSBkb2QoNikg aW50ZXJuZXQoMSkgICAgICAgICAgIA0KICAgICAgIHNlY3VyaXR5KDUpIG1lY2hhbmlzbSg1KSBz bmVnbyAoMikgbW9kdWxlcyg0KSBzcGVjMigyKQ0KICAgfSBERUZJTklUSU9OUyBFWFBMSUNJVCBU QUdTIDo6PSBCRUdJTiAgICAgDQogICANCiAgIC0tIHJlc3Qgb2YgZGVmaW5pdGlvbnMgaGVyZSAg ICAgDQoNCiAgIEVORCAgICAgICAgICAgICANCg0KPC9hcnR3b3JrPjwvZmlndXJlPg0KDQo8dD5U aGlzIHNwZWNpZmllcyB0aGF0IHRoZSB0YWdnaW5nIGNvbnRleHQgZm9yIHRoZSBtb2R1bGUgd2ls bCBiZSBleHBsaWNpdCBhbmQgbm9uLWF1dG9tYXRpYy48L3Q+DQoNCjx0PlRoZSBlbmNvZGluZyBv ZiBTUE5FR08gcHJvdG9jb2wgbWVzc2FnZXMgc2hhbGwgb2JleSB0aGUgRGlzdGluZ3Vpc2hlZCBF bmNvZGluZyBSdWxlcyAoREVSKSBvZg0KICAgIEFTTi4xIGFzIGRlc2NyaWJlZCBpbiBbWDY5MF0u PC90Pg0KDQoNCjxzZWN0aW9uIHRpdGxlPSJNZWNoYW5pc20gVHlwZXMiIHRvYz0iZGVmYXVsdCI+ DQoNCiAgICA8dD5JbiB0aGlzIG5lZ290aWF0aW9uIG1vZGVsLCBlYWNoIE9JRCByZXByZXNlbnRz IG9uZSBHU1MtQVBJIG1lY2hhbmlzbSBvciBvbmUgdmFyaWFudCAoc2VlIDx4cmVmIHRhcmdldD0i ZXh0Ii8+KSBvZiBpdCBhY2NvcmRpbmcNCiAgICB0byA8eHJlZiB0YXJnZXQ9IlJGQzI3NDMiIHBh Z2Vubz0iZmFsc2UiIGZvcm1hdD0iZGVmYXVsdCI+PC94cmVmPi48L3Q+DQoNCjxmaWd1cmUgdGl0 bGU9IiI+PGFydHdvcmsgbmFtZT0iIiB0eXBlPSIiIHdpZHRoPSIiIGhlaWdodD0iIj4gICAgICAg ICANCg0KICAgIE1lY2hUeXBlIDo6PSBPQkpFQ1QgSURFTlRJRklFUiAgICAgICAgICAgDQogICAg ICAgIC0tIE9JRCByZXByZXNlbnRzIGVhY2ggc2VjdXJpdHkgbWVjaGFuaXNtIGFzIHN1Z2dlc3Rl ZCBieSAgICAgICAgICAgIA0KICAgICAgICAtLSBbUkZDMjc0M10gICAgICAgICAgICAgICAgICAg ICANCg0KICAgIE1lY2hUeXBlTGlzdCA6Oj0gU0VRVUVOQ0UgT0YgTWVjaFR5cGUgICAgIA0KPC9h cnR3b3JrPjwvZmlndXJlPg0KDQo8L3NlY3Rpb24+DQoNCjxzZWN0aW9uIGFuY2hvcj0idG9rZW5k ZWZzIiB0aXRsZT0iTmVnb3RpYXRpb24gVG9rZW5zIiB0b2M9ImRlZmF1bHQiPg0KDQo8dD5UaGUg c3ludGF4IG9mIHRoZSBpbml0aWFsIG5lZ290aWF0aW9uIHRva2VucyBmb2xsb3dzIHRoZSBpbml0 aWFsQ29udGV4dFRva2VuIHN5bnRheCBkZWZpbmVkIGluDQogICAgU2VjdGlvbiAzLjEgb2YgPHhy ZWYgdGFyZ2V0PSJSRkMyNzQzIi8+LiAgVGhlIFNQTkVHTw0KICAgIHBzZXVkbyBtZWNoYW5pc20g aXMgaWRlbnRpZmllZCBieSB0aGUgT2JqZWN0IElkZW50aWZpZXIgc3BlY2lmaWVkIGluIA0KICAg IDx4cmVmIHRhcmdldD0iaW50cm9kdWN0aW9uIi8+LiAgU3Vic2VxdWVudCB0b2tlbnMgYXJlIG5v dA0KICAgIGVuY2Fwc3VsYXRlZCBpbiB0aGlzIEdTUy1BUEkgZ2VuZXJpYyB0b2tlbiBmcmFtaW5n LjwvdD4NCg0KPHQ+VGhpcyBzZWN0aW9uIHNwZWNpZmllcyB0aGUgc3ludGF4IG9mIHRoZSBpbm5l ciB0b2tlbiBmb3IgdGhlIGluaXRpYWwgbWVzc2FnZSBhbmQgdGhlIHN5bnRheA0KICAgIG9mIHN1 YnNlcXVlbnQgY29udGV4dCBlc3RhYmxpc2htZW50IHRva2Vucy48L3Q+DQoNCjxmaWd1cmUgdGl0 bGU9IiI+PGFydHdvcmsgbmFtZT0iIiB0eXBlPSIiIHdpZHRoPSIiIGhlaWdodD0iIj4gICAgICAg ICANCiAgICBOZWdvdGlhdGlvblRva2VuIDo6PSBDSE9JQ0UgeyAgICAgICAgICAgICANCiAgICAg ICAgbmVnVG9rZW5Jbml0ICAgIFswXSBOZWdUb2tlbkluaXQsICAgICAgICAgICAgIA0KICAgICAg ICBuZWdUb2tlblJlc3AgICAgWzFdIG5lZ1Rva2VuUmVzcCAgICAgICAgICANCiAgICB9ICAgICAg ICAgIA0KICAgICAgICAgICAgDQo8L2FydHdvcms+PC9maWd1cmU+DQoNCjxzZWN0aW9uIHRpdGxl PSJuZWdUb2tlbkluaXQiIHRvYz0iZGVmYXVsdCI+DQoNCjxmaWd1cmUgdGl0bGU9IiI+PGFydHdv cmsgbmFtZT0iIiB0eXBlPSIiIHdpZHRoPSIiIGhlaWdodD0iIj4gICAgICAgICANCiAgICBOZWdU b2tlbkluaXQgOjo9IFNFUVVFTkNFIHsgICAgICAgICAgICAgDQogICAgICAgIG1lY2hUeXBlcyAg ICAgICBbMF0gTWVjaFR5cGVMaXN0LCAgICAgICAgICAgICANCiAgICAgICAgcmVxRmxhZ3MgICAg ICAgIFsxXSBDb250ZXh0RmxhZ3MgIE9QVElPTkFMLCAgICAgICAgICAgICANCiAgICAgICAgbWVj aFRva2VuICAgICAgIFsyXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLCAgICAgICAgICAgICANCiAg ICAgICAgbWVjaExpc3RNSUMgICAgIFszXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLA0KICAgICAg ICAuLi4NCiAgICB9ICAgICAgICAgIA0KICAgIENvbnRleHRGbGFncyA6Oj0gQklUIFNUUklORyB7 ICAgICAgICAgICAgIA0KICAgICAgICBkZWxlZ0ZsYWcgICAgICAgKDApLCAgICAgICAgICAgICAN CiAgICAgICAgbXV0dWFsRmxhZyAgICAgICgxKSwgICAgICAgICAgICAgDQogICAgICAgIHJlcGxh eUZsYWcgICAgICAoMiksICAgICAgICAgICAgIA0KICAgICAgICBzZXF1ZW5jZUZsYWcgICAgKDMp LCAgICAgICAgICAgICANCiAgICAgICAgYW5vbkZsYWcgICAgICAgICg0KSwgICAgICAgICAgICAg DQogICAgICAgIGNvbmZGbGFnICAgICAgICAoNSksICAgICAgICAgICAgIA0KICAgICAgICBpbnRl Z0ZsYWcgICAgICAgKDYpICAgICAgICAgDQogICAgfSAgICAgICAgICAgICAgICAgICAgIA0KPC9h cnR3b3JrPjwvZmlndXJlPg0KDQo8dD5UaGlzIGlzIHRoZSBzeW50YXggZm9yIHRoZSBpbm5lciB0 b2tlbiBvZiB0aGUgaW5pdGlhbCBuZWdvdGlhdGlvbiBtZXNzYWdlLjwvdD4NCg0KPHQ+PGxpc3Qg c3R5bGU9ImhhbmdpbmciPg0KICAgICAgICANCjx0IGhhbmdUZXh0PSJtZWNoVHlwZXMiPjwvdD4N Cg0KICAgIDx0PjxsaXN0IHN0eWxlPSJlbXB0eSI+PHQ+VGhpcyBmaWVsZCBjb250YWlucyBvbmUg b3IgbW9yZSBzZWN1cml0eSBtZWNoYW5pc21zIGF2YWlsYWJsZSBmb3IgdGhlDQogICAgICAgICAg ICAgICAgaW5pdGlhdG9yIGluIGRlY3JlYXNpbmcgcHJlZmVyZW5jZSBvcmRlciAoZmF2b3JpdGUg Y2hvaWNlIGZpcnN0KS48dnNwYWNlDQogICAgICAgICAgICAgICAgICAgIGJsYW5rTGluZXM9IjEi PjwvdnNwYWNlPjwvdD48L2xpc3Q+PC90Pg0KDQo8dCBoYW5nVGV4dD0icmVxRmxhZ3MiPjwvdD4N Cg0KICAgIDx0PjxsaXN0IHN0eWxlPSJlbXB0eSI+PHQ+VGhpcyBmaWVsZCwgaWYgcHJlc2VudCwg Y29udGFpbnMgdGhlIHNlcnZpY2Ugb3B0aW9ucyB0aGF0IGFyZSByZXF1ZXN0ZWQNCiAgICAgICAg ICAgICAgICB0byBlc3RhYmxpc2ggdGhlIGNvbnRleHQuIFRoZSBjb250ZXh0IGZsYWdzIFNIT1VM RCBiZSBmaWxsZWQgaW4gZnJvbSB0aGUNCiAgICAgICAgICAgICAgICByZXFfZmxhZ3MgcGFyYW1l dGVyIG9mIEdTU19Jbml0X3NlY19jb250ZXh0KCkuICBUaGlzIGZpZWxkIFNIQUxMIE5PVCBoYXZl IGltcGFjdCANCiAgICAgICAgICAgICAgICBvbiB0aGUgbmVnb3RpYXRpb24uPHZzcGFjZSBibGFu a0xpbmVzPSIxIj48L3ZzcGFjZT4gPC90PjwvbGlzdD48L3Q+DQoNCjx0IGhhbmdUZXh0PSJtZWNo VG9rZW4iPjwvdD4NCg0KICAgIDx0PjxsaXN0IHN0eWxlPSJlbXB0eSI+IDx0PlRoaXMgZmllbGQs IGlmIHByZXNlbnQsIGNvbnRhaW5zIHRoZSBvcHRpbWlzdGljIG1lY2hhbmlzbQ0KICAgICAgICAg ICAgICAgIHRva2VuLjx2c3BhY2UgYmxhbmtMaW5lcz0iMSI+PC92c3BhY2U+PC90PiA8L2xpc3Q+ PC90Pg0KDQo8dCBoYW5nVGV4dD0ibWVjaGxpc3RNSUMiPjwvdD4NCg0KPHQ+PGxpc3Qgc3R5bGU9 ImVtcHR5Ij4gPHQ+VGhpcyBmaWVsZCwgaWYgcHJlc2VudCwgY29udGFpbnMgYSBNSUMgdG9rZW4g Zm9yIHRoZSBtZWNoYW5pc20gDQogICAgICAgICAgbGlzdCBpbiB0aGUgaW5pdGlhbCBuZWdvdGlh dGlvbiBtZXNzYWdlLiAgVGhpcyBNSUMgdG9rZW4gaXMgY29tcHV0ZWQNCiAgICAgICAgICBhY2Nv cmRpbmcgdG8gPHhyZWYgdGFyZ2V0PSJtaWNwcm9jZXNzaW5nIi8+LiA8dnNwYWNlIGJsYW5rTGlu ZXM9IjEiPjwvdnNwYWNlPjwvdD4gPC9saXN0PjwvdD4NCg0KPC9saXN0PjwvdD4NCg0KPC9zZWN0 aW9uPg0KDQo8c2VjdGlvbiBhbmNob3I9InJlc3VsdHMiIHRpdGxlPSJuZWdUb2tlblJlc3AiIHRv Yz0iZGVmYXVsdCI+PGZpZ3VyZSB0aXRsZT0iIj4NCg0KPGFydHdvcmsgbmFtZT0iIiB0eXBlPSIi IHdpZHRoPSIiIGhlaWdodD0iIj4gICAgICAgICAgICAgDQogICAgTmVnVG9rZW5SZXNwIDo6PSBT RVFVRU5DRSB7ICAgICAgICAgICAgICAgICANCiAgICAgICAgbmVnU3RhdGUgICAgICAgWzBdIEVO VU1FUkFURUQgeyAgICAgICAgICAgICAgICAgICAgIA0KICAgICAgICAgICAgYWNjZXB0X2NvbXBs ZXRlZCAgICAoMCksICAgICAgICAgICAgICAgICAgICAgDQogICAgICAgICAgICBhY2NlcHRfaW5j b21wbGV0ZSAgICgxKSwgICAgICAgICAgICAgICAgICAgICANCiAgICAgICAgICAgIHJlamVjdCAg ICAgICAgICAgICAgKDIpLCAgICAgICAgICAgICAgICAgICAgIA0KICAgICAgICAgICAgcmVxdWVz dF9taWMgICAgICAgICAoMykgICAgICAgICAgICAgICAgICAgICANCiAgICAgICAgfSAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIE9QVElPTkFMLA0KICAgICAgICAgIC0tIFJFUVVJUkVE IGluIHRoZSBmaXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQNCiAgICAgICAgc3VwcG9ydGVkTWVj aCAgIFsxXSBNZWNoVHlwZSAgICAgIE9QVElPTkFMLCAgICANCiAgICAgICAgICAtLSBwcmVzZW50 IG9ubHkgaW4gdGhlIGZpcnN0IHJlcGx5IGZyb20gdGhlIHRhcmdldA0KICAgICAgICByZXNwb25z ZVRva2VuICAgWzJdIE9DVEVUIFNUUklORyAgT1BUSU9OQUwsICAgICAgICAgICAgICAgICANCiAg ICAgICAgbWVjaExpc3RNSUMgICAgIFszXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLA0KICAgICAg ICAuLi4NCiAgICB9ICAgICAgICAgICAgICAgICAgICAgICAgIA0KPC9hcnR3b3JrPjwvZmlndXJl Pg0KDQo8dD5UaGlzIGlzIHRoZSBzeW50YXggZm9yIGFsbCBzdWJzZXF1ZW50IG5lZ290aWF0aW9u IG1lc3NhZ2VzLjwvdD4NCg0KPHQ+PGxpc3Qgc3R5bGU9ImhhbmdpbmciPg0KDQo8dCBoYW5nVGV4 dD0ibmVnU3RhdGUiPjwvdD4gDQoNCiAgICA8dD48bGlzdCBzdHlsZT0iZW1wdHkiPiA8dD5UaGlz IGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyB0aGUgc3RhdGUgb2YgdGhlIG5lZ290aWF0aW9u LiAgVGhpcyBjYW4gYmU6PC90Pg0KDQogICAgICAgIDx0PjxsaXN0IHN0eWxlPSJoYW5naW5nIj4N Cg0KICAgICAgICA8dCBoYW5nVGV4dD0iYWNjZXB0X2NvbXBsZXRlZCI+PHZzcGFjZSBibGFua0xp bmVzPSIxIj48L3ZzcGFjZT5ObyBmdXJ0aGVyIG5lZ290aWF0aW9uIG1lc3NhZ2UgZnJvbSB0aGUg cGVlciANCiAgICAgICAgaXMgZXhwZWN0ZWQsIGFuZCB0aGUgc2VjdXJpdHkgY29udGV4dCBpcyBl c3RhYmxpc2hlZCBmb3IgdGhlIHNlbmRlci48dnNwYWNlDQogICAgICAgICAgICAgICAgYmxhbmtM aW5lcz0iMSI+PC92c3BhY2U+PC90Pg0KDQogICAgICAgIDx0IGhhbmdUZXh0PSJhY2NlcHRfaW5j b21wbGV0ZSI+IDx2c3BhY2UgYmxhbmtMaW5lcz0iMSI+PC92c3BhY2U+IEF0IGxlYXN0IG9uZSBt b3JlIG5lZ290aWF0aW9uIG1lc3NhZ2UgZnJvbQ0KICAgICAgICAgICAgdGhlIHBlZXIgaXMgbmVl ZGVkIHRvIGVzdGFibGlzaCB0aGUgc2VjdXJpdHkgY29udGV4dC48dnNwYWNlIGJsYW5rTGluZXM9 IjEiPjwvdnNwYWNlPjwvdD4NCg0KICAgICAgICA8dCBoYW5nVGV4dD0icmVqZWN0Ij48dnNwYWNl IGJsYW5rTGluZXM9IjEiPjwvdnNwYWNlPlRoZSBzZW5kZXIgdGVybWluYXRlcyB0aGUNCiAgICAg ICAgICAgIG5lZ290aWF0aW9uLjx2c3BhY2UgYmxhbmtMaW5lcz0iMSI+PC92c3BhY2U+PC90Pg0K DQogICAgICAgIDx0IGhhbmdUZXh0PSJyZXF1ZXN0X21pYyI+PHZzcGFjZSBibGFua0xpbmVzPSIx Ij48L3ZzcGFjZT4NCiAgICAgICAgVGhlIHNlbmRlciBpbmRpY2F0ZXMgdGhhdCB0aGUgZXhjaGFu Z2Ugb2YgTUlDIHRva2VucywgYXMgZGVzY3JpYmVkIGluDQogICAgICAgICAgICA8eHJlZiB0YXJn ZXQ9Im1pY3Byb2Nlc3NpbmciLz4sIHdpbGwgYmUgUkVRVUlSRUQgaWYgcGVyLW1lc3NhZ2UgaW50 ZWdyaXR5DQogICAgICAgICAgICBzZXJ2aWNlcyBhcmUgYXZhaWxhYmxlIG9uIHRoZSBtZWNoYW5p c20gY29udGV4dCB0byBiZSBlc3RhYmxpc2hlZC4gIA0KICAgICAgICAgICAgVGhpcyB2YWx1ZSBT SEFMTCBvbmx5IGJlIHByZXNlbnQgaW4gdGhlIGZpcnN0IHJlcGx5IGZyb20gdGhlIHRhcmdldC4N CiAgICAgICAgICAgIDx2c3BhY2UgYmxhbmtMaW5lcz0iMSI+PC92c3BhY2U+DQogICAgICAgIDwv dD4NCg0KICAgICA8L2xpc3Q+IDwvdD4gDQogICAgICAgIA0KICAgICAgICA8dD5UaGlzIGZpZWxk IGlzIFJFUVVJUkVEIGluIHRoZSBmaXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQsIGFuZCBpdCBp cyBPUFRJT05BTCB0aGVyZWFmdGVyLg0KICAgICAgICA8dnNwYWNlIGJsYW5rTGluZXM9IjEiPjwv dnNwYWNlPjwvdD4NCg0KICAgICAgICA8L2xpc3Q+PC90Pg0KDQo8dCBoYW5nVGV4dD0ic3VwcG9y dGVkTWVjaCI+PC90Pg0KDQogICA8dD48bGlzdCBzdHlsZT0iZW1wdHkiPjx0PlRoaXMgZmllbGQg U0hBTEwgb25seSBiZSBwcmVzZW50IGluIHRoZSBmaXJzdCByZXBseSBmcm9tIHRoZQ0KICAgIHRh cmdldC4gIEl0IE1VU1QgYmUgb25lIG9mIHRoZSBtZWNoYW5pc20ocykgb2ZmZXJlZCBieSB0aGUN CiAgICAgICAgICAgaW5pdGlhdG9yLjx2c3BhY2UgYmxhbmtMaW5lcz0iMSI+PC92c3BhY2U+PC90 PjwvbGlzdD48L3Q+DQoNCjx0IGhhbmdUZXh0PSJSZXNwb25zZVRva2VuIj48L3Q+IA0KDQogICA8 dD48bGlzdCBzdHlsZT0iZW1wdHkiPiA8dD5UaGlzIGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlu cyB0b2tlbnMgc3BlY2lmaWMgdG8gdGhlIG1lY2hhbmlzbQ0KICAgICAgICAgICAgICAgc2VsZWN0 ZWQuPHZzcGFjZSBibGFua0xpbmVzPSIxIj48L3ZzcGFjZT48L3Q+PC9saXN0PjwvdD4NCiAgICAg ICANCjx0IGhhbmdUZXh0PSJtZWNobGlzdE1JQyI+PC90Pg0KDQogICA8dD48bGlzdCBzdHlsZT0i ZW1wdHkiPiA8dD5UaGlzIGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyBhIE1JQyB0b2tlbiBm b3IgdGhlIG1lY2hhbmlzbSANCiAgICAgICAgICBsaXN0IGluIHRoZSBpbml0aWFsIG5lZ290aWF0 aW9uIG1lc3NhZ2UuICBUaGlzIE1JQyB0b2tlbiBpcyBjb21wdXRlZA0KICAgICAgICAgIGFjY29y ZGluZyB0byA8eHJlZiB0YXJnZXQ9Im1pY3Byb2Nlc3NpbmciLz4uIDx2c3BhY2UgYmxhbmtMaW5l cz0iMSI+PC92c3BhY2U+PC90PiA8L2xpc3Q+PC90Pg0KICAgICAgIA0KPC9saXN0PiA8L3Q+DQoN Cjwvc2VjdGlvbj4NCg0KPC9zZWN0aW9uPg0KDQo8L3NlY3Rpb24+DQoNCjxzZWN0aW9uIGFuY2hv cj0ibWljcHJvY2Vzc2luZyIgdGl0bGU9IlByb2Nlc3Npbmcgb2YgbWVjaExpc3RNSUMiIHRvYz0i ZGVmYXVsdCI+DQoNCjx0PklmIHRoZSBtZWNoYW5pc20gc2VsZWN0ZWQgYnkgdGhlIG5lZ290aWF0 aW9uIGRvZXMgbm90IHN1cHBvcnQgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHRoZW4gbm8gbWVjaGxp c3RNSUMNCiAgICB0b2tlbiBpcyB1c2VkLjwvdD4gDQogICAgDQogICAgPHQ+T3RoZXJ3aXNlLCBp ZiB0aGUgYWNjZXB0ZWQgbWVjaGFuaXNtIGlzIHRoZSBtb3N0IHByZWZlcnJlZCBtZWNoYW5pc20g b2YgYm90aCB0aGUgDQogICAgaW5pdGlhdG9yIGFuZCB0aGUgYWNjZXB0b3IsIHRoZW4gdGhlIE1J QyB0b2tlbiBleGNoYW5nZSwgYXMgZGVzY3JpYmVkIA0KICAgICBsYXRlciBpbiB0aGlzIHNlY3Rp b24sIGlzIE9QVElPTkFMLiAgQSBtZWNoYW5pc20gaXMgdGhlDQogICBhY2NlcHRvcidzIG1vc3Qg cHJlZmVycmVkIG1lY2hhbmlzbSBpZiB0aGVyZSBpcyBubyBvdGhlcg0KICAgbWVjaGFuaXNtIHdo aWNoLCBoYWQgaXQgYmVlbiBwcmVzZW50IGluIHRoZSBtZWNoYW5pc20gbGlzdCwgdGhlDQogICBh Y2NlcHRvciB3b3VsZCBoYXZlIHByZWZlcnJlZCBvdmVyIHRoZSBhY2NlcHRlZCBtZWNoYW5pc20u PC90PiAgDQogICAgDQogICAgDQogICAgPHQ+SW4gYWxsIG90aGVyIGNhc2VzLCBNSUMgdG9rZW5z IE1VU1QgYmUgZXhjaGFuZ2VkIGFmdGVyIHRoZSBtZWNoYW5pc20gY29udGV4dCBpcyBmdWxseSBl c3RhYmxpc2hlZC48L3Q+DQoNCjx0PjxsaXN0IHN0eWxlPSJoYW5naW5nIj4NCg0KPHQgaGFuZ1Rl eHQ9ImEpIj5UaGUgbWVjaGxpc3RNSUMgdG9rZW4gKG9yIHNpbXBseSB0aGUgTUlDIHRva2VuKSBp cyBjb21wdXRlZCBvdmVyIHRoZSBtZWNoYW5pc20gbGlzdCANCiAgICAgICAgICBpbiB0aGUgaW5p dGlhbCBuZWdvdGlhdGlvbiBtZXNzYWdlIGJ5DQogICAgICAgICAgaW52b2tpbmcgR1NTX0dldE1J QygpIGFzIGZvbGxvd3M6IHRoZSBpbnB1dCBjb250ZXh0X2hhbmRsZSBpcyB0aGUgZXN0YWJsaXNo ZWQNCiAgICAgICAgICBtZWNoYW5pc20gY29udGV4dCwgdGhlIGlucHV0IHFvcF9yZXEgaXMgMCwg YW5kIHRoZSBpbnB1dCBtZXNzYWdlDQogICAgICAgICAgaXMgdGhlIERFUiBlbmNvZGluZyBvZiB0 aGUgdmFsdWUgb2YgdHlwZSBNZWNoVHlwZUxpc3Qgd2hpY2ggaXMNCiAgICAgICAgICBjb250YWlu ZWQgaW4gdGhlICJtZWNoVHlwZXMiIGZpZWxkIG9mIHRoZSBOZWdUb2tlbkluaXQuICBUaGUgaW5w dXQNCiAgICAgICAgICBtZXNzYWdlIGlzIE5PVCB0aGUgREVSIGVuY29kaW5nIG9mIHRoZSB0eXBl ICJbMF0gTWVjaFR5cGVMaXN0Ii4NCiAgICAgICAgICA8dnNwYWNlIGJsYW5rTGluZXM9IjEiPjwv dnNwYWNlPjwvdD4NCg0KPHQgaGFuZ1RleHQ9ImIpIj5JZiB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNt IGV4Y2hhbmdlcyBhbiBldmVuIG51bWJlciBvZiBtZWNoYW5pc20gdG9rZW5zIChpLmUuLCB0aGUg YWNjZXB0b3INCiAgICBzZW5kcyB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW4pLCB0aGUgYWNjZXB0 b3IgZG9lcyB0aGUgZm9sbG93aW5nIHdoZW4gZW1pdHRpbmcgdGhlIG5lZ290aWF0aW9uIA0KICAg IG1lc3NhZ2UgY29udGFpbmluZyB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW46IGlmIHRoZSANCiAg ICBNSUMgdG9rZW4gZXhjaGFuZ2UgaXMgb3B0aW9uYWwsIEdTU19BY2NlcHRfc2VjX2NvbnRleHQo KSBlaXRoZXIgaW5kaWNhdGVzDQogICAgR1NTX1NfQ09NUExFVEUgYW5kIGRvZXMgbm90IGluY2x1 ZGUgYSBtZWNobGlzdE1JQyB0b2tlbiwgb3IgaW5kaWNhdGVzIEdTU19TX0NPTlRJTlVFX05FRURF RCBhbmQgDQogICAgaW5jbHVkZXMgYSBtZWNobGlzdE1JQyB0b2tlbiBhbmQgYW4gYWNjZXB0X2lu Y29tcGxldGUgc3RhdGU7IGlmIHRoZSBNSUMgdG9rZW4gZXhjaGFuZ2UgaXMgcmVxdWlyZWQsDQog ICAgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgpIGluZGljYXRlcyBHU1NfU19DT05USU5VRV9ORUVE RUQsIGFuZCANCiAgICBpbmNsdWRlcyBhIG1lY2hsaXN0TUlDIHRva2VuLiAgQWNjZXB0b3JzIHRo YXQgd2lzaCB0byBiZSBjb21wYXRpYmxlIHdpdGggbGVnYWN5IFdpbmRvd3MgU1BORUdPDQogICAg aW1wbGVtZW50YXRpb25zIGFzIGRlc2NyaWJlZCBpbiA8eHJlZiB0YXJnZXQ9ImNvbXBhdCIvPiBz aG91bGQgbm90IGdlbmVyYXRlIGEgbWVjaGxpc3RNSUMgdG9rZW4gd2hlbiANCiAgICB0aGUgTUlD IHRva2VuIGV4Y2hhbmdlIGlzIG5vdCByZXF1aXJlZC4gIFRoZSBpbml0aWF0b3IgdGhlbiBwcm9j ZXNzZXMgdGhlIGxhc3QgbWVjaGFuaXNtIHRva2VuLCBhbmQgDQogICAgZG9lcyBvbmUgb2YgdGhl IGZvbGxvd2luZzo8L3Q+DQoNCjx0PjxsaXN0IHN0eWxlPSJoYW5naW5nIj4NCiAgICAgICANCjx0 IGhhbmdUZXh0PSIoSSkiPiBJZiBhIG1lY2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCwgYW5k IGlzIGNvcnJlY3RseSB2ZXJpZmllZCwNCiAgICAgICAgICAgIEdTU19Jbml0X3NlY19jb250ZXh0 KCkgaW5kaWNhdGVzIEdTU19TX0NPTVBMRVRFLiBUaGUgb3V0cHV0IG5lZ290aWF0aW9uIG1lc3Nh Z2UgY29udGFpbnMgYSBtZWNobGlzdE1JQw0KICAgICAgICAgICAgdG9rZW4sIGFuZCBhbiBhY2Nl cHRfY29tcGxldGUgc3RhdGUuICBUaGUgYWNjZXB0b3IgTVVTVCB0aGVuIHZlcmlmeSB0aGlzIG1l Y2hsaXN0TUlDIHRva2VuLjx2c3BhY2UgYmxhbmtMaW5lcz0iMSI+PC92c3BhY2U+PC90Pg0KDQo8 dCBoYW5nVGV4dD0iKElJKSI+SWYgYSBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQgYnV0 IGlzIGluY29ycmVjdCwgdGhlDQogICAgICAgICAgICBuZWdvdGlhdGlvbiBTSEFMTCBiZSB0ZXJt aW5hdGVkLiBHU1NfSW5pdF9zZWNfY29udGV4dCgpIGluZGljYXRlcyBHU1NfU19ERUZFQ1RJVkVf VE9LRU4uPHZzcGFjZSBibGFua0xpbmVzPSIxIj48L3ZzcGFjZT48L3Q+DQoNCjx0IGhhbmdUZXh0 PSIoSUlJKSI+SWYgbm8gbWVjaGxpc3RNSUMgdG9rZW4gd2FzIGluY2x1ZGVkLCBhbmQgdGhlIE1J QyB0b2tlbiBleGNoYW5nZSBpcyBub3QNCiAgICByZXF1aXJlZCwgR1NTX0luaXRfc2VjX2NvbnRl eHQoKSBpbmRpY2F0ZXMgR1NTX1NfQ09NUExFVEUgd2l0aCBubyBvdXRwdXQgdG9rZW4uPHZzcGFj ZQ0KICAgICAgICBibGFua0xpbmVzPSIxIj48L3ZzcGFjZT48L3Q+DQoNCjx0IGhhbmdUZXh0PSIo SVYpIj5JZiBubyBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQsIGJ1dCB0aGUgTUlDIHRv a2VuIGV4Y2hhbmdlIGlzIHJlcXVpcmVkLCB0aGUNCiAgICBuZWdvdGlhdGlvbiBTSEFMTCBiZSB0 ZXJtaW5hdGVkLiBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzIEdTU19TX0RFRkVD VElWRV9UT0tFTi48dnNwYWNlIGJsYW5rTGluZXM9IjEiPjwvdnNwYWNlPjwvdD48L2xpc3Q+PC90 Pg0KDQo8dCBoYW5nVGV4dD0iYykiPiBJbiB0aGUgY2FzZSB0aGF0IHRoZSBjaG9zZW4gbWVjaGFu aXNtIGV4Y2hhbmdlcyBhbiBvZGQgbnVtYmVyIG9mIG1lY2hhbmlzbSB0b2tlbnMgKGkuZS4sIA0K ICAgIHRoZSBpbml0aWF0b3Igc2VuZHMgdGhlIGxhc3QgbWVjaGFuaXNtIHRva2VuKSwgdGhlIGlu aXRpYXRvciBkb2VzIHRoZSBmb2xsb3dpbmcgd2hlbiBlbWl0dGluZyB0aGUgbmVnb3RpYXRpb24g DQogICAgbWVzc2FnZSBjb250YWluaW5nIHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tlbjogDQogICAg aWYgdGhlIG5lZ1N0YXRlIHdhcyByZXF1ZXN0X21pYyBpbiB0aGUgZmlyc3QgcmVwbHkgZnJvbSB0 aGUgdGFyZ2V0LCBhIG1lY2hsaXN0TUlDIHRva2VuIA0KICAgIE1VU1QgYmUgaW5jbHVkZWQsIG90 aGVyd2lzZSB0aGUgbWVjaGxpc3RNSUMgdG9rZW4gaXMgT1BUSU9OQUwuIChOb3RlIHRoYXQgdGhl IE1JQyB0b2tlbiBleGNoYW5nZSBpcyByZXF1aXJlZCANCiAgICBpZiBhIG1lY2hhbmlzbSBvdGhl ciB0aGFuIHRoZSBpbml0aWF0b3IncyBmaXJzdCBjaG9pY2UgaXMgY2hvc2VuLikgSW4gdGhlIGNh c2UgdGhhdCB0aGUgb3B0aW1pc3RpYyBtZWNoYW5pc20gdG9rZW4gaXMgDQogICAgdGhlIG9ubHkg bWVjaGFuaXNtIHRva2VuIGZvciB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSwg dGhlIG1lY2hsaXN0TUlDIHRva2VuIGlzIE9QVElPTkFMLiAgDQogICAgV2hldGhlciBvciBub3Qg dGhlIG1lY2hsaXN0TUlDIHRva2VuIGlzIGluY2x1ZGVkLCBHU1NfSW5pdF9zZWNfY29udGV4dCgp IGluZGljYXRlcyBHU1NfU19DT05USU5VRV9ORUVERUQuIA0KICAgIEluaXRpYXRvcnMgdGhhdCB3 aXNoIHRvIGJlIGNvbXBhdGlibGUgd2l0aCBsZWdhY3kgV2luZG93cyBTUE5FR08gaW1wbGVtZW50 YXRpb25zIGFzIGRlc2NyaWJlZCBpbiA8eHJlZiB0YXJnZXQ9ImNvbXBhdCIvPiANCiAgICBzaG91 bGQgbm90IGdlbmVyYXRlIGEgbWVjaGxpc3RNSUMgdG9rZW4gd2hlbiB0aGUgTUlDIHRva2VuIGV4 Y2hhbmdlIGlzIG5vdCByZXF1aXJlZC4gDQogICAgVGhlIGFjY2VwdG9yIHRoZW4gcHJvY2Vzc2Vz IHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tlbiBhbmQgZG9lcyBvbmUgb2YgdGhlDQogICAgZm9sbG93 aW5nOjwvdD4NCg0KPHQ+PGxpc3Qgc3R5bGU9ImhhbmdpbmciPg0KDQo8dCBoYW5nVGV4dD0iKEkp Ij4gSWYgYSBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQgYW5kIGlzIGNvcnJlY3RseSB2 ZXJpZmllZCwgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgpIGluZGljYXRlcw0KICAgIEdTU19TX0NP TVBMRVRFLiBUaGUgb3V0cHV0IG5lZ290aWF0aW9uIG1lc3NhZ2UgY29udGFpbnMgYSBtZWNobGlz dE1JQyB0b2tlbiBhbmQgYW4NCiAgICBhY2NlcHRfY29tcGxldGUgc3RhdGUuICBUaGUgaW5pdGlh dG9yIE1VU1QgdGhlbiB2ZXJpZnkgdGhpcyBtZWNobGlzdE1JQyB0b2tlbi48dnNwYWNlDQogICAg ICAgIGJsYW5rTGluZXM9IjEiPjwvdnNwYWNlPjwvdD4NCg0KPHQgaGFuZ1RleHQ9IihJSSkiPklm IGEgbWVjaGxpc3RNSUMgdG9rZW4gd2FzIGluY2x1ZGVkIGJ1dCBpcyBpbmNvcnJlY3QsIHRoZSBu ZWdvdGlhdGlvbiBTSEFMTCBiZQ0KICAgIHRlcm1pbmF0ZWQuIEdTU19BY2NlcHRfc2VjX2NvbnRl eHQoKSBpbmRpY2F0ZXMgR1NTX1NfREVGRUNUSVZFX1RPS0VOLiA8dnNwYWNlIGJsYW5rTGluZXM9 IjEiPjwvdnNwYWNlPjwvdD4NCg0KPHQgaGFuZ1RleHQ9IihJSUkpIj5JZiBubyBtZWNobGlzdE1J QyB0b2tlbiB3YXMgaW5jbHVkZWQgYnV0IHRoZSBtZWNobGlzdE1JQyB0b2tlbiBleGNoYW5nZSBp cyBub3QNCiAgICByZXF1aXJlZCwgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgpIGluZGljYXRlcyBH U1NfU19DT01QTEVURS4gVGhlIG91dHB1dCBuZWdvdGlhdGlvbiBtZXNzYWdlDQogICAgY29udGFp bnMgYW4gYWNjZXB0X2NvbXBsZXRlIHN0YXRlLjx2c3BhY2UgYmxhbmtMaW5lcz0iMSI+PC92c3Bh Y2U+PC90Pg0KDQoNCjx0IGhhbmdUZXh0PSIoSVYpIj5JbiB0aGUgY2FzZSB0aGF0IHRoZSBvcHRp bWlzdGljIG1lY2hhbmlzbSB0b2tlbiBpcyANCiAgICBhbHNvIHRoZSBsYXN0IG1lY2hhbmlzbSB0 b2tlbiAod2hlbiB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSBpcyBhY2NlcHRl ZCBieSB0aGUgdGFyZ2V0KSANCiAgICBhbmQgdGhlIHRhcmdldCBzZW5kcyBhIHJlcXVlc3RfbWlj IHN0YXRlIGJ1dCB0aGUgaW5pdGlhdG9yIGRpZCBub3Qgc2VuZCBhIG1lY2hsaXN0TUlDIHRva2Vu LA0KICAgIHRoZSB0YXJnZXQgdGhlbiBNVVNUIGluY2x1ZGUgYSBtZWNobGlzdE1JQyB0b2tlbiBp biB0aGF0IGZpcnN0IHJlcGx5LiBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgDQogICAgaW5kaWNh dGVzIEdTU19TX0NPTlRJTlVFX05FRURFRC4gDQogICAgVGhlIGluaXRpYXRvciBNVVNUIHZlcmlm eSB0aGUgcmVjZWl2ZWQgbWVjaGxpc3RNSUMgdG9rZW4gYW5kIGdlbmVyYXRlIGEgbWVjaGxpc3RN SUMgdG9rZW4gdG8gc2VuZCBiYWNrDQogICAgdG8gdGhlIHRhcmdldC4gIFRoZSB0YXJnZXQgU0hB TEwgaW4gdHVybiB2ZXJpZnkgdGhlIHJldHVybmVkIG1lY2hsaXN0TUlDIHRva2VuIGFuZCBjb21w bGV0ZSB0aGUgbmVnb3RpYXRpb24uDQogICAgPHZzcGFjZSBibGFua0xpbmVzPSIxIj48L3ZzcGFj ZT48L3Q+ICAgIA0KDQo8dCBoYW5nVGV4dD0iKFYpIj5JZiBubyBtZWNobGlzdE1JQyB0b2tlbiB3 YXMgaW5jbHVkZWQgYW5kIHRoZSBhY2NlcHRvciBzZW50IGEgcmVxdWVzdF9taWMgc3RhdGUgaW4g dGhlIGZpcnN0DQogICAgcmVwbHkgbWVzc2FnZSAodGhlIGV4Y2hhbmdlIG9mIE1JQyB0b2tlbnMg aXMgcmVxdWlyZWQpLCB0aGUgbmVnb3RpYXRpb24gU0hBTEwgYmUgdGVybWluYXRlZC4gDQogICAg R1NTX0FjY2VwdF9zZWNfY29udGV4dCgpIGluZGljYXRlcyBHU1NfU19ERUZFQ1RJVkVfVE9LRU4u PHZzcGFjZSBibGFua0xpbmVzPSIxIj48L3ZzcGFjZT48L3Q+DQoNCjwvbGlzdD48L3Q+DQoNCjwv bGlzdD48L3Q+DQoNCjwvc2VjdGlvbj4NCg0KPHNlY3Rpb24gYW5jaG9yPSJleHQiIHRpdGxlPSJF eHRlbnNpYmlsaXR5Ij4NCg0KPHQ+IFR3byBtZWNoYW5pc21zIGFyZSBwcm92aWRlZCBmb3IgZXh0 ZW5zaWJpbGl0eS4gIEZpcnN0LCB0aGUgQVNOLjEgc3RydWN0dXJlcyBpbiB0aGlzIA0Kc3BlY2lm aWNhdGlvbiBNQVkgYmUgZXhwYW5kZWQgYnkgSUVURiBzdGFuZGFyZHMgYWN0aW9uLiAgSW1wbGVt ZW50YXRpb25zIHJlY2VpdmluZyB1bmtub3duIA0KZmllbGRzIE1VU1QgaWdub3JlIHRoZXNlIGZp ZWxkcy48L3Q+DQoNCjx0PiBTZWNvbmRseSwgT0lEcyBjb3JyZXNwb25kaW5nIHRvIGEgZGVzaXJl ZCBtZWNoYW5pc20gYXR0cmlidXRlIChpLmUuLCBtZWNoYW5pc20gdmFyaWFudHMpIG1heSBiZSBp bmNsdWRlZCBpbiB0aGUgDQpzZXQgb2YgcHJlZmVycmVkIG1lY2hhbmlzbXMgYnkgYW4gaW5pdGlh dG9yLiAgVGhlIGFjY2VwdG9yIGNhbiBjaG9vc2UgdG8gaG9ub3IgdGhpcyByZXF1ZXN0IA0KYnkg cHJlZmVycmluZyBtZWNoYW5pc21zIHRoYXQgaGF2ZSB0aGUgaW5jbHVkZWQgYXR0cmlidXRlcy4g IEZ1dHVyZSB3b3JrIHdpdGhpbiB0aGUgS2l0dGVuIHdvcmtpbmcgDQpncm91cCBpcyBleHBlY3Rl ZCB0byBzdGFuZGFyZGl6ZSBjb21tb24gYXR0cmlidXRlcyB0aGF0IFNQTkVHTyBtZWNoYW5pc21z IG1heSB3aXNoIHRvIHN1cHBvcnQuICANCkF0IHRoaXMgdGltZSBpdCBpcyBzdWZmaWNpZW50IHRv IHNheSB0aGF0IGluaXRpYXRvcnMgTUFZIGluY2x1ZGUgT0lEcyB0aGF0IGRvIG5vdCBjb3JyZXNw b25kIA0KdG8gbWVjaGFuaXNtcyBidXQgaW5zdGVhZCBjb3JyZXNwb25kIHRvIGRlc2lyZWQgbWVj aGFuaXNtIGF0dHJpYnV0ZXMgaW4gdGhlaXIgcmVxdWVzdHMuICANClN1Y2ggT0lEcyBNQVkgaW5m bHVlbmNlIHRoZSBhY2NlcHRvcidzIGNob2ljZSBvZiBtZWNoYW5pc20uICBBcyBkaXNjdXNzZWQg aW4gPHhyZWYgdGFyZ2V0PSJtaWNwcm9jZXNzaW5nIi8+LCANCmlmIHRoZXJlIGFyZSBtZWNoYW5p c21zIHRoYXQgaWYgcHJlc2VudCBpbiB0aGUgaW5pdGlhdG9yJ3MgbGlzdCBvZiBtZWNoYW5pc21z IG1pZ2h0IGJlIA0KcHJlZmVycmVkIGJ5IHRoZSBhY2NlcHRvciB0byB0aGUgaW5pdGlhdG9yJ3Mg cHJlZmVycmVkIG1lY2hhbmlzbSwgdGhlIGFjY2VwdG9yIE1VU1QgZGVtYW5kIHRoZSANCk1JQyB0 b2tlbiBleGNoYW5nZS4gIEFzIGEgY29uc2VxdWVuY2UsIGFjY2VwdG9ycyBNVVNUIGRlbWFuZCB0 aGUgTUlDIHRva2VuIGV4Y2hhbmdlIGlmIHRoZXkgDQpzdXBwb3J0IG5lZ290aWF0aW9uIG9mIGF0 dHJpYnV0ZXMgbm90IGF2YWlsYWJsZSBpbiB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hh bmlzbSANCnJlZ2FyZGxlc3Mgb2Ygd2hldGhlciB0aGUgaW5pdGlhdG9yIGFjdHVhbGx5IHJlcXVl c3RlZCB0aGVzZSBhdHRyaWJ1dGVzLiA8L3Q+DQoNCjwvc2VjdGlvbj4NCg0KPHNlY3Rpb24gYW5j aG9yPSJzZWN1cml0eWNvbnNpZGVyYXRpb24iIHRpdGxlPSJTZWN1cml0eSBDb25zaWRlcmF0aW9u cyIgdG9jPSJkZWZhdWx0Ij4NCg0KPHQ+ICAgICBJbiBvcmRlciB0byBwcm9kdWNlIHRoZSBNSUMg dG9rZW4gZm9yIHRoZSBtZWNoYW5pc20gbGlzdCwgdGhlDQogICAgIG1lY2hhbmlzbSBtdXN0IHBy b3ZpZGUgaW50ZWdyaXR5IHByb3RlY3Rpb24uICBXaGVuIHRoZSBzZWxlY3RlZA0KICAgIG1lY2hh bmlzbSBkb2VzIG5vdCBzdXBwb3J0IGludGVncml0eSBwcm90ZWN0aW9uLCB0aGUgbmVnb3RpYXRp b24NCiAgICAgaXMgdnVsbmVyYWJsZTogYW4gYWN0aXZlIGF0dGFja2VyIGNhbiBmb3JjZSBpdCB0 byB1c2UgYSBzZWN1cml0eQ0KICAgIG1lY2hhbmlzbSB0aGF0IGlzIG5vdCBtdXR1YWxseSBwcmVm ZXJyZWQgYnV0IGlzIGFjY2VwdGFibGUgdG8NCiAgICAgdGhlIHRhcmdldC48L3Q+DQogIA0KPHQ+ ICAgIFRoaXMgcHJvdG9jb2wgcHJvdmlkZXMgdGhlIGZvbGxvd2luZyBndWFyYW50ZWVzIHdoZW4g cGVyLW1lc3NhZ2UgDQogICAgIGludGVncml0eSBzZXJ2aWNlcyBhcmUgYXZhaWxhYmxlIG9uIHRo ZSBlc3RhYmxpc2hlZCBtZWNoYW5pc20gY29udGV4dA0KICAgIGFuZCB0aGUgbWVjaGFuaXNtIGxp c3Qgd2FzIGFsdGVyZWQgYnkgYW4gYWR2ZXJzYXJ5IHN1Y2ggdGhhdCBhIA0KICAgIG1lY2hhbmlz bSB3aGljaCBpcyBub3QgbXV0dWFsbHkgcHJlZmVycmVkIGNvdWxkIGJlIHNlbGVjdGVkOiA8L3Q+ DQogICAgIA0KICAgICA8dD4gPGxpc3Qgc3R5bGU9ImhhbmdpbmciPiA8dCBoYW5nVGV4dD0iYSki PklmIHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tlbiBpcyBzZW50IGJ5IHRoZSBpbml0aWF0b3IsDQog ICAgICBib3RoIHBlZXJzIHNoYWxsIGZhaWw7IDwvdD4NCg0KPHQgIGhhbmdUZXh0PSJiKSI+IElm IHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tlbiBpcyBzZW50IGJ5IHRoZSBhY2NlcHRvciwgdGhlIGFj Y2VwdG9yIA0KICAgICAgc2hhbGwgbm90IGNvbXBsZXRlIGFuZCB0aGUgaW5pdGlhdG9yIGF0IHdv cnN0IHNoYWxsIGNvbXBsZXRlIHdpdGggDQogICAgICBpdHMgcHJlZmVycmVkIG1lY2hhbmlzbSBi ZWluZyBzZWxlY3RlZC4gIDwvdD4gDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICANCiAgICAgIDwvbGlzdD48L3Q+DQoNCiAgICAgPHQ+IFRoZSBuZWdv dGlhdGlvbiBtYXkgbm90IA0KICAgICAgYmUgdGVybWluYXRlZCBpZiBhbiBhbHRlcmF0aW9uIHdh cyBtYWRlIGJ1dCBpdCBoYWQgbm8gbWF0ZXJpYWwgaW1wYWN0LjwvdD4NCg0KICAgICA8dD4gVGhl IHByb3RlY3Rpb24gb2YgdGhlIG5lZ290aWF0aW9uIGRlcGVuZHMgb24gdGhlIHN0cmVuZ3RoIG9m IHRoZQ0KICAgICBpbnRlZ3JpdHkgcHJvdGVjdGlvbi4gIEluIHBhcnRpY3VsYXIsIHRoZSBzdHJl bmd0aCBvZiBTUE5FR08gaXMgbm8NCiAgICAgc3Ryb25nZXIgdGhhbiB0aGUgaW50ZWdyaXR5IHBy b3RlY3Rpb24gb2YgdGhlIHdlYWtlc3QgbWVjaGFuaXNtIGFjY2VwdGFibGUgdG8gR1NTLUFQSSBw ZWVycy48L3Q+DQoNCjx0PkluIGFsbCBjYXNlcywgdGhlIGNvbW11bmljYXRpbmcgcGVlcnMgYXJl IGV4cG9zZWQgdG8gdGhlIGRlbmlhbCBvZiBzZXJ2aWNlIHRocmVhdC48L3Q+DQoNCjwvc2VjdGlv bj4NCg0KPHNlY3Rpb24gdGl0bGU9IklBTkEgQ29uc2lkZXJhdGlvbnMiPg0KDQo8dD4gVGhpcyBk b2N1bWVudCBoYXMgbm8gYWN0aW9ucyBmb3IgSUFOQS48L3Q+DQoNCjwvc2VjdGlvbj4NCg0KPHNl Y3Rpb24gdGl0bGU9IkFja25vd2xlZGdtZW50cyIgdG9jPSJkZWZhdWx0Ij4NCg0KICAgIDx0PlRo ZSBhdXRob3JzIHdpc2ggdG8gdGhhbmsgU2FtIEhhcnRtYW4sIE5pY29sYXMgV2lsbGlhbXMsIEtl biBSYWVidXJuLCBKZWZmIEFsdG1hbiwgVG9tIFl1LCBDcmlzdGlhbg0KICAgICAgICBJbGFjIGFu ZCBNYXJ0aW4gUmV4IGZvciB0aGVpciBjb21tZW50cyBhbmQgc3VnZ2VzdGlvbnMgZHVyaW5nIGRl dmVsb3BtZW50IG9mIHRoaXMgZG9jdW1lbnQuPC90Pg0KDQogICAgPHQ+IEx1a2UgSG93YXJkIHBy b3ZpZGVkIGEgcHJvdG90eXBlIG9mIHRoaXMgcHJvdG9jb2wgaW4gSGVpbWRhbA0KICAgIGFuZCBy ZXNvbHZlZCBzZXZlcmFsIGlzc3VlcyBpbiB0aGUgaW5pdGlhbCBkcmFmdC48L3Q+DQoNCjx0PkVy aWMgQmFpemUgYW5kIERlbmlzIFBpbmthcyB3cm90ZSB0aGUgb3JpZ2luYWwgU1BORUdPIHNwZWNp ZmljYXRpb24gPHhyZWYgdGFyZ2V0PSJSRkMyNDc4Ig0KICAgICAgICBwYWdlbm89ImZhbHNlIiBm b3JtYXQ9ImRlZmF1bHQiPjwveHJlZj4gb2Ygd2hpY2ggc29tZSBvZiB0aGUgdGV4dCBoYXMgYmVl biByZXRhaW5lZCBpbiB0aGlzDQogICAgZG9jdW1lbnQuPC90Pg0KDQo8L3NlY3Rpb24+DQo8L21p ZGRsZT4NCg0KPGJhY2s+DQoNCjxyZWZlcmVuY2VzIHRpdGxlPSJOb3JtYXRpdmUgUmVmZXJlbmNl cyI+JlJGQzIxMTk7JlJGQzI3NDM7PC9yZWZlcmVuY2VzPg0KDQo8cmVmZXJlbmNlcyB0aXRsZT0i SW5mb3JtYXRpdmUgUmVmZXJlbmNlcyI+JlJGQzI0Nzg7PC9yZWZlcmVuY2VzPg0KDQo8c2VjdGlv biBhbmNob3I9InN1cHBvcnRhcGkiIHRpdGxlPSJHU1MtQVBJIE5lZ290aWF0aW9uIFN1cHBvcnQg QVBJIiB0b2M9ImRlZmF1bHQiPg0KDQo8dD5JbiBvcmRlciB0byBwcm92aWRlIHRvIGEgR1NTLUFQ SSBjYWxsZXIgKGVpdGhlciB0aGUgaW5pdGlhdG9yIG9yIHRoZSB0YXJnZXQgb3IgYm90aCkgdGhl DQogICAgYWJpbGl0eSB0byBjaG9vc2UgYW1vbmcgdGhlIHNldCBvZiBzdXBwb3J0ZWQgbWVjaGFu aXNtcyBhIHJlZHVjZWQgc2V0IG9mIG1lY2hhbmlzbXMgZm9yDQogICAgbmVnb3RpYXRpb24sIHR3 byBhZGRpdGlvbmFsIEFQSXMgYXJlIGRlZmluZWQ6PC90Pg0KDQo8dD48bGlzdCBzdHlsZT0ic3lt Ym9scyI+PHQ+R1NTX0dldF9uZWdfbWVjaHMoKSBpbmRpY2F0ZXMgdGhlIHNldCBvZiBzZWN1cml0 eSBtZWNoYW5pc21zIA0KICAgICAgYXZhaWxhYmxlIG9uIHRoZSBsb2NhbCBzeXN0ZW0gdG8gdGhl IGNhbGxlciBmb3IgbmVnb3RpYXRpb24sIGZvciB3aGljaA0KICAgICAgYXBwcm9wcmlhdGUgY3Jl ZGVudGlhbHMgYXJlIGF2YWlsYWJsZS48L3Q+DQoNCjx0PkdTU19TZXRfbmVnX21lY2hzKCkgc3Bl Y2lmaWVzIHRoZSBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcyB0byBiZSB1c2VkIG9uIHRoZSBs b2NhbCBzeXN0ZW0gYnkgdGhlDQogICAgY2FsbGVyIGZvciBuZWdvdGlhdGlvbiwgZm9yIHRoZSBn aXZlbiBjcmVkZW50aWFscy48L3Q+PC9saXN0PjwvdD4NCg0KPHNlY3Rpb24gdGl0bGU9IkdTU19T ZXRfbmVnX21lY2hzIGNhbGwiIHRvYz0iZGVmYXVsdCI+DQoNCjx0PklucHV0czo8L3Q+DQoNCjx0 PiA8bGlzdCBzdHlsZT0ic3ltYm9scyI+DQoNCjx0PiBjcmVkX2hhbmRsZSBDUkVERU5USUFMIEhB TkRMRSwgLS0gTlVMTCBzcGVjaWZpZXMgZGVmYXVsdCANCjx2c3BhY2UvPi0tIGNyZWRlbnRpYWxz PC90Pg0KDQo8dD4gbWVjaF9zZXQgU0VUIE9GIE9CSkVDVCBJREVOVElGSUVSPC90Pg0KDQo8L2xp c3Q+PC90Pg0KDQo8dD4gT3V0cHV0czo8L3Q+DQoNCjx0PiA8bGlzdCBzdHlsZT0ic3ltYm9scyI+ DQogICAgDQo8dD4gbWFqb3Jfc3RhdHVzIElOVEVHRVIsPC90Pg0KDQo8dD4gbWlub3Jfc3RhdHVz IElOVEVHRVI8L3Q+DQoNCjwvbGlzdD48L3Q+DQoNCjx0PiBSZXR1cm4gbWFqb3Jfc3RhdHVzIGNv ZGVzOiA8L3Q+DQoNCjx0PiA8bGlzdCBzdHlsZT0ic3ltYm9scyI+DQogICAgDQo8dD4gR1NTX1Nf Q09NUExFVEUgaW5kaWNhdGVzIHRoYXQgdGhlIHNldCBvZiBzZWN1cml0eSBtZWNoYW5pc21zDQph dmFpbGFibGUgZm9yIG5lZ290aWF0aW9uIGhhcyBiZWVuIHNldCB0byBtZWNoX3NldC48L3Q+DQoN Cjx0PiBHU1NfU19GQUlMVVJFIGluZGljYXRlcyB0aGF0IHRoZSByZXF1ZXN0ZWQgb3BlcmF0aW9u IGNvdWxkDQpub3QgYmUgcGVyZm9ybWVkIGZvciByZWFzb25zIHVuc3BlY2lmaWVkIGF0IHRoZSBH U1MtQVBJIGxldmVsLjwvdD4NCg0KPC9saXN0PiA8L3Q+DQoNCjx0PkFsbG93cyBjYWxsZXJzIHRv IHNwZWNpZnkgdGhlIHNldCBvZiBzZWN1cml0eSBtZWNoYW5pc21zIHRoYXQgbWF5IGJlIG5lZ290 aWF0ZWQgd2l0aCB0aGUNCiAgICBjcmVkZW50aWFsIGlkZW50aWZpZWQgYnkgY3JlZF9oYW5kbGUu IFRoaXMgY2FsbCBpcyBpbnRlbmRlZCBmb3Igc3VwcG9ydCBvZiBzcGVjaWFsaXplZA0KICAgIGNh bGxlcnMgd2hvIG5lZWQgdG8gcmVzdHJpY3QgdGhlIHNldCBvZiBuZWdvdGlhYmxlIHNlY3VyaXR5 IG1lY2hhbmlzbXMgZnJvbSB0aGUgc2V0IG9mIGFsbA0KICAgIHNlY3VyaXR5IG1lY2hhbmlzbXMg YXZhaWxhYmxlIHRvIHRoZSBjYWxsZXIgKGJhc2VkIG9uIGF2YWlsYWJsZSBjcmVkZW50aWFscyku IE5vdGUgdGhhdCBpZg0KICAgIG1vcmUgdGhhbiBvbmUgbWVjaGFuaXNtIGlzIHNwZWNpZmllZCBp biBtZWNoX3NldCwgdGhlIG9yZGVyIGluIHdoaWNoIHRob3NlIG1lY2hhbmlzbXMgYXJlDQogICAg c3BlY2lmaWVkIGltcGxpZXMgYSByZWxhdGl2ZSBwcmVmZXJlbmNlLjwvdD4NCg0KPC9zZWN0aW9u Pg0KDQo8c2VjdGlvbiB0aXRsZT0iR1NTX0dldF9uZWdfbWVjaHMgY2FsbCIgdG9jPSJkZWZhdWx0 Ij4NCg0KPHQ+SW5wdXQ6PC90Pg0KDQo8dD4gPGxpc3Qgc3R5bGU9InN5bWJvbHMiPg0KDQo8dD4g Y3JlZF9oYW5kbGUgQ1JFREVOVElBTCBIQU5ETEUgLS0gTlVMTCBzcGVjaWZpZXMgZGVmYXVsdCAN Cjx2c3BhY2UvPi0tIGNyZWRlbnRpYWxzIDwvdD4NCg0KICAgIDwvbGlzdD4gPC90Pg0KDQo8dD4g T3V0cHV0czogPC90Pg0KDQo8dD4gPGxpc3Qgc3R5bGU9InN5bWJvbHMiPg0KDQogICAgPHQ+IG1h am9yX3N0YXR1cyBJTlRFR0VSLDwvdD4NCiAgICA8dD4gbWlub3Jfc3RhdHVzIElOVEVHRVIsPC90 Pg0KICAgIDx0PiBtZWNoX3NldCBTRVQgT0YgT0JKRUNUIElERU5USUZJRVIgPC90Pg0KICAgIA0K ICAgIDwvbGlzdD4NCjwvdD4NCg0KPHQ+IFJldHVybiBtYWpvcl9zdGF0dXMgY29kZXM6PC90Pg0K DQo8dD4gPGxpc3Qgc3R5bGU9InN5bWJvbHMiPg0KDQo8dD4gR1NTX1NfQ09NUExFVEUgaW5kaWNh dGVzIHRoYXQgdGhlIHNldCBvZiBzZWN1cml0eSBtZWNoYW5pc21zIGF2YWlsYWJsZSBmb3IgDQpu ZWdvdGlhdGlvbiBoYXMgYmVlbiByZXR1cm5lZCBpbiBtZWNoX3NldC4gPC90Pg0KDQo8dD4gR1NT X1NfRkFJTFVSRSBpbmRpY2F0ZXMgdGhhdCB0aGUgcmVxdWVzdGVkIG9wZXJhdGlvbiBjb3VsZA0K bm90IGJlIHBlcmZvcm1lZCBmb3IgcmVhc29ucyB1bnNwZWNpZmllZCBhdCB0aGUgR1NTLUFQSSBs ZXZlbC48L3Q+DQoNCjwvbGlzdD48L3Q+DQoNCjx0PkFsbG93cyBjYWxsZXJzIHRvIGRldGVybWlu ZSB0aGUgc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMgYXZhaWxhYmxlIGZvciBuZWdvdGlhdGlv biB3aXRoIHRoZQ0KICAgIGNyZWRlbnRpYWwgaWRlbnRpZmllZCBieSBjcmVkX2hhbmRsZS4gVGhp cyBjYWxsIGlzIGludGVuZGVkIGZvciBzdXBwb3J0IG9mIHNwZWNpYWxpemVkIGNhbGxlcnMNCiAg ICB3aG8gbmVlZCB0byByZWR1Y2UgdGhlIHNldCBvZiBuZWdvdGlhYmxlIHNlY3VyaXR5IG1lY2hh bmlzbXMgZnJvbSB0aGUgc2V0IG9mIHN1cHBvcnRlZA0KICAgIHNlY3VyaXR5IG1lY2hhbmlzbXMg YXZhaWxhYmxlIHRvIHRoZSBjYWxsZXIgKGJhc2VkIG9uIGF2YWlsYWJsZSBjcmVkZW50aWFscyku PC90Pg0KDQo8dD5Ob3RlOiBUaGUgR1NTX0luZGljYXRlX21lY2hzKCkgZnVuY3Rpb24gaW5kaWNh dGVzIHRoZSBmdWxsIHNldCBvZiBtZWNoYW5pc20gdHlwZXMgYXZhaWxhYmxlIG9uIHRoZQ0KICAg IGxvY2FsIHN5c3RlbS4gU2luY2UgdGhpcyBjYWxsIGhhcyBubyBpbnB1dCBwYXJhbWV0ZXIsIHRo ZSByZXR1cm5lZCBzZXQgaXMgbm90IG5lY2Vzc2FyaWx5DQogICAgYXZhaWxhYmxlIGZvciBhbGwg Y3JlZGVudGlhbHMuPC90Pg0KDQo8L3NlY3Rpb24+IDwvc2VjdGlvbj4NCg0KPHNlY3Rpb24gYW5j aG9yPSJjb21wYXQiIHRpdGxlPSJDaGFuZ2VzIHNpbmNlIFJGQzI0NzgiIHRvYz0iZGVmYXVsdCI+ PHQ+PGxpc3Qgc3R5bGU9ImVtcHR5Ij4NCg0KPHQ+U1BORUdPIGltcGxlbWVudGF0aW9ucyBpbiBX aW5kb3dzIDIwMDAvV2luZG93cyBYUC9XaW5kb3dzIFNlcnZlciAyMDAzIGhhdmUgdGhlDQogICAg Zm9sbG93aW5nIGJlaGF2aW9yOiBubyBtZWNobGlzdE1JQyBpcyBwcm9kdWNlZCBhbmQgbWVjaGxp c3RNSUMgaXMgbm90DQogICAgcHJvY2Vzc2VkIGlmIG9uZSBpcyBwcm92aWRlZDsgaWYgdGhlIGlu aXRpYXRvciBzZW5kcyB0aGUgbGFzdCBtZWNoYW5pc20gdG9rZW4sIHRoZQ0KICAgIGFjY2VwdG9y IHdpbGwgc2VuZCBiYWNrIGEgbmVnb3RpYXRpb24gdG9rZW4gd2l0aCBhbiBhY2NlcHRfY29tcGxl dGUgc3RhdGUgYW5kIG5vIG1lY2hsaXN0TUlDIHRva2VuLiAgSW4NCiAgICBhZGRpdGlvbiwgYW4g aW5jb3JyZWN0IE9JRCAoMS4yLjg0MC40ODAxOC4xLjIuMikgY2FuIGJlIHVzZWQgdG8gaWRlbnRp ZnkgdGhlIEdTUy1BUEkNCiAgICBLZXJiZXJvcyBWZXJzaW9uIDUgbWVjaGFuaXNtLiA8dnNwYWNl IGJsYW5rTGluZXM9IjEiPjwvdnNwYWNlPjwvdD4NCg0KPHQ+VGhlIGZvbGxvd2luZyBjaGFuZ2Vz IGhhdmUgYmVlbiBtYWRlIHRvIGJlIGNvbXBhdGlibGUgd2l0aCB0aGVzZSBsZWdhY3kgaW1wbGVt ZW50YXRpb25zLjwvdD4NCg0KPHQ+PGxpc3Qgc3R5bGU9InN5bWJvbHMiPg0KDQo8dD5OZWdUb2tl blRhcmcgaXMgY2hhbmdlZCB0byBuZWdUb2tlblJlc3AgYW5kIGl0IGlzIHRoZSBtZXNzYWdlIGZv cm1hdCBmb3IgYWxsIHN1YnNlcXVlbnQgbmVnb3RpYXRpb24NCiAgICB0b2tlbnMuPC90Pg0KDQo8 dD5OZWdUb2tlbkluaXQgaXMgdGhlIG1lc3NhZ2UgZm9yIHRoZSBpbml0aWFsIG5lZ290aWF0aW9u IG1lc3NhZ2UgYW5kIHRoYXQgbWVzc2FnZSBvbmx5LjwvdD4NCg0KPHQ+IG1lY2hUeXBlcyBpbiBu ZWdUb2tlbkluaXQgaXMgbm90IG9wdGlvbmFsLjwvdD4gICAgICAgICANCg0KPHQ+SWYgdGhlIHNl bGVjdGVkIG1lY2hhbmlzbSBpcyBhbHNvIHRoZSBtb3N0IHByZWZlcnJlZCBtZWNoYW5pc20gZm9y IGJvdGggcGVlcnMsIGl0IGlzIHNhZmUgdG8gb21pdA0KICAgIHRoZSBNSUMgdG9rZW5zLjwvdD48 L2xpc3Q+PHZzcGFjZSBibGFua0xpbmVzPSIxIj48L3ZzcGFjZT48L3Q+DQoNCjx0PiBJZiBhdCBs ZWFzdCBvbmUgb2YgdGhlIHR3byBwZWVycyBpbXBsZW1lbnRzIHRoZSB1cGRhdGVkIHBzZXVkbyBt ZWNoYW5pc20gaW4gdGhpcyBkb2N1bWVudCwgdGhlIG5lZ290aWF0aW9uIGlzIHByb3RlY3RlZC48 dnNwYWNlIGJsYW5rTGluZXM9IjEiPjwvdnNwYWNlPjwvdD4NCg0KPHQ+VGhlIGZvbGxvd2luZyBj aGFuZ2VzIGFyZSB0byBhZGRyZXNzIHRoZSBwcm9ibGVtcyBpbiBSRkMgMjQ3OC48L3Q+DQoNCjx0 PjxsaXN0IHN0eWxlPSJzeW1ib2xzIj4NCg0KPHQ+cmVxRmxhZ3MgaXMgbm90IHByb3RlY3RlZCB0 aGVyZWZvcmUgaXQgc2hvdWxkIG5vdCBpbXBhY3QgdGhlIG5lZ290aWF0aW9uLjwvdD4NCg0KPHQ+ REVSIGVuY29kaW5nIGlzIHJlcXVpcmVkLjwvdD4NCg0KPHQ+R1NTX0dldE1JQygpIGlucHV0IGlz IGNsYXJpZmllZC48L3Q+IA0KDQo8dD5QZXItbWVzc2FnZSBpbnRlZ3JpdHkgc2VydmljZXMgYXJl IHJlcXVlc3RlZCBmb3IgdGhlIG5lZ290aWF0ZWQgbWVjaGFuaXNtLjwvdD4NCg0KPHQ+IFR3byBN SUMgdG9rZW5zIGFyZSBleGNoYW5nZWQsIG9uZSBpbiBlYWNoIGRpcmVjdGlvbi48L3Q+DQoNCg0K PC9saXN0PjwvdD4NCg0KPC9saXN0PjwvdD4NCg0KPHQ+QW4gaW1wbGVtZW50YXRpb24gdGhhdCBj b25mb3JtcyB0byB0aGlzIHNwZWNpZmljYXRpb24gd2lsbCBub3QgaW50ZXJvcGVyYXRlIA0Kd2l0 aCBhIHN0cmljdCAyNzQ4IGltcGxlbWVudGF0aW9uLiAgRXZlbiBpZiB0aGUgbmV3IGltcGxlbWVu dGF0aW9uIGFsd2F5cyBzZW5kcyBhIG1lY2hsaXN0TUlDIHRva2VuLCANCml0IHdpbGwgc3RpbGwg ZmFpbCB0byBpbnRlcm9wZXJhdGUuICBJZiBpdCBpcyBhIHNlcnZlciwgaXQgd2lsbCBmYWlsIGJl Y2F1c2UgDQppdCByZXF1ZXN0cyBhIG1lY2hsaXN0TUlDIHRva2VuIHVzaW5nIGFuIG9wdGlvbiB0 aGF0IG9sZGVyIGltcGxlbWVudGF0aW9ucyBzaW1wbHkgZG8gbm90IHN1cHBvcnQuICANCkNsaWVu dHMgd2lsbCB0ZW5kIHRvIGZhaWwgYXMgd2VsbC48L3Q+DQoNCjx0PkFzIGFuIGFsdGVybmF0aXZl IHRvIHRoZSBhcHByb2FjaCBjaG9zZW4gaW4gdGhpcyBzcGVjaWZpY2F0aW9uLCB3ZSBjb3VsZCBo YXZlIGRvY3VtZW50ZWQgYSANCmNvcnJlY3QgYmVoYXZpb3IgdGhhdCBpcyBmdWxseSBiYWNrd2Fy ZCBjb21wYXRpYmxlIHdpdGggUkZDIDI0NzggYW5kIGluY2x1ZGVkIGFuIGFwcGVuZGl4IG9uIA0K aG93IHRvIGludGVyb3BlcmF0ZSB3aXRoIGV4aXN0aW5nIGluY29ycmVjdCBpbXBsZW1lbnRhdGlv bnMgb2YgUkZDIDI0NzguPC90Pg0KDQo8dD5BcyBhIHByYWN0aWNhbCBtYXR0ZXIsIHRoZSBTUE5F R08gaW1wbGVtZW50ZXJzIHdpdGhpbiB0aGUgSUVURiBoYXZlIHZhbHVlZCBpbnRlcm9wZXJhYmls aXR5IA0Kd2l0aCB0aGUgTWljcm9zb2Z0IGltcGxlbWVudGF0aW9ucy4gIFdlIHdlcmUgdW5hYmxl IHRvIGNob29zZSB0byBtYWludGFpbiByZWFzb25hYmxlIHNlY3VyaXR5IA0KZ3VhcmFudGVlcywg bWFpbnRhaW4gaW50ZXJvcGVyYWJpbGl0eSB3aXRoIHRoZSBNaWNyb3NvZnQgaW1wbGVtZW50YXRp b25zIGFuZCBtYWludGFpbiANCmludGVyb3BlcmFiaWxpdHkgd2l0aCBjb3JyZWN0IGltcGxlbWVu dGF0aW9ucyBvZiBSRkMgMjQ3OC4gIFRoZSB3b3JraW5nIGdyb3VwIHdhcyBub3QgDQphd2FyZSBv ZiBhbnkgUkZDIDI0NzggaW1wbGVtZW50YXRpb25zIGRlcGxveWVkIG9uIHRoZSANCkludGVybmV0 LiAgRXZlbiBpZiB0aGVyZSBhcmUgc3VjaCBpbXBsZW1lbnRhdGlvbnMsIGl0IA0KaXMgdW5saWtl bHkgdGhhdCB0aGV5IHdpbGwgaW50ZXJvcGVyYXRlIGJlY2F1c2Ugb2YgYSBjcml0aWNhbCBmbGF3 IGluIHRoZSBkZXNjcmlwdGlvbiBvZiANCnRoZSBlbmNvZGluZyBvZiB0aGUgbWVjaGFuaXNtIGxp c3QgaW4gUkZDIDI0NzguPC90Pg0KDQo8dD5XaXRoIHRoZSBhcHByb2FjaCB0YWtlbiBpbiB0aGlz IHNwZWNpZmljYXRpb24sIHNlY3VyaXR5IGlzIGVuc3VyZWQNCiAgICAgIGJldHdlZW4gbmV3IGlt cGxlbWVudGF0aW9ucyBhbGwgdGhlIHRpbWUgd2hpbGUgbWFpbnRhaW5pbmcNCiAgICAgIGludGVy b3BlcmFiaWxpdHkgd2l0aCB0aGUgaW1wbGVtZW50YXRpb25zIGRlcGxveWVkIHdpdGhpbiB0aGUN CiAgICAgIElFVEYgY29tbXVuaXR5LiAgVGhlIHdvcmtpbmcgZ3JvdXAgYmVsaWV2ZXMgdGhhdCB0 aGlzIGp1c3RpZmllcw0KICAgICAgYnJlYWtpbmcgY29tcGF0aWJpbGl0eSB3aXRoIGEgY29ycmVj dCBpbXBsZW1lbnRhdGlvbiBvZiBSRkMNCiAgICAgIDI0NzguPC90Pg0KICAgICAgICAgDQo8L3Nl Y3Rpb24+DQoNCjxzZWN0aW9uIHRpdGxlPSJtZWNoTGlzdE1JQyBDb21wdXRhdGlvbiBFeGFtcGxl IiB0b2M9ImRlZmF1bHQiPg0KDQo8dD5UaGUgZm9sbG93aW5nIGlzIGFuIGV4YW1wbGUgdG8gaWxs dXN0cmF0ZSBob3cgdGhlIG1lY2hMaXN0TUlDIGZpZWxkIHdvdWxkIGJlIGNvbXB1dGVkLjwvdD4N Cg0KPHQ+VGhlIGluaXRpYWwgcGFydCBvZiB0aGUgREVSIGVuY29kaW5nIG9mIE5lZ1Rva2VuSW5p dCBpcw0KICAgY29uc3RydWN0ZWQgYXMgZm9sbG93cyAodGhlICJubiIgYXJlIGxlbmd0aCBlbmNv ZGluZ3MsDQogICBwb3NzaWJseSBsb25nZXIgdGhhbiBvbmUgb2N0ZXQpOjwvdD4NCg0KPGZpZ3Vy ZSB0aXRsZT0iIj48YXJ0d29yayBuYW1lPSIiIHR5cGU9IiIgd2lkdGg9IiIgaGVpZ2h0PSIiPiAg ICAgICAgIA0KICAgMzAgLS0gaWRlbnRpZmllciBvY3RldCBmb3IgY29uc3RydWN0ZWQgU0VRVUVO Q0UgKE5lZ1Rva2VuSW5pdCkNCiAgIG5uIC0tIGxlbmd0aA0KDQogICAgICAtLSBjb250ZW50cyBv Y3RldHMgb2YgdGhlIFNFUVVFTkNFIGJlZ2luIHdpdGgNCiAgICAgIC0tIERFUiBlbmNvZGluZyBv ZiAiWzBdIE1lY2hUeXBlTGlzdCI6DQogICAgICBBMCAtLSBpZGVudGlmaWVyIG9jdGV0IGZvciBj b25zdHJ1Y3RlZCBbMF0NCiAgICAgIG5uIC0tIGxlbmd0aA0KDQogICAgICAgICAgLS0gY29udGVu dHMgb2YgdGhlIGNvbnN0cnVjdGVkIFswXSBhcmUgREVSIGVuY29kaW5nDQogICAgICAgICAgLS0g b2YgTWVjaFR5cGVMaXN0ICh3aGljaCBpcyBhIFNFUVVFTkNFKToNCiAgICAgICAgICAzMCAtLSBp ZGVudGlmaWVyIG9jdGV0IGZvciBjb25zdHJ1Y3RlZCBTRVFVRU5DRQ0KICAgICAgICAgIG5uIC0t IGxlbmd0aA0KDQogICAgICAgICAgICAgLS0gY29udGVudHMgb2N0ZXRzIG9mIHRoZSBTRVFVRU5D RSBiZWdpbiB3aXRoDQogICAgICAgICAgICAgLS0gREVSIGVuY29kaW5nIG9mIE9CSkVDVCBJREVO VElGSUVSOg0KICAgICAgICAgICAgIDA2IC0tIGlkZW50aWZpZXIgb2N0ZXQgZm9yIHByaW1pdGl2 ZSBPQkpFQ1QgSURFTlRJRklFUg0KICAgICAgICAgICAgIDA5IC0tIGxlbmd0aA0KICAgICAgICAg ICAgIDJBIDg2IDQ4IDg2IEY3IDEyIDAxIDAyIDAyIC0tIEtlcmJlcm9zIFY1IA0KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIHsxIDIgODQwIDExMzU1NCAxIDIgMn0N CjwvYXJ0d29yaz48L2ZpZ3VyZT4NCg0KPHQ+SWYgYSBtZWNobGlzdE1JQyBuZWVkcyB0byBiZSBn ZW5lcmF0ZWQgKGFjY29yZGluZyB0byB0aGUgcnVsZXMgaW4gPHhyZWYgdGFyZ2V0PSJtaWNwcm9j ZXNzaW5nIi8+KSwgDQogICBpdCBpcyBjb21wdXRlZCBieSB1c2luZyB0aGUgREVSIGVuY29kaW5n IG9mIHRoZSB0eXBlIE1lY2hUeXBlTGlzdCBkYXRhIGZyb20NCiAgIHRoZSBpbml0aWF0b3IncyBO ZWdUb2tlbkluaXQgdG9rZW4gYXMgaW5wdXQgdG8gdGhlIEdTU19HZXRNSUMoKSBmdW5jdGlvbi4N CiAgIEluIHRoaXMgY2FzZSwgdGhlIE1JQyB3b3VsZCBiZSBjb21wdXRlZCBvdmVyIHRoZSBmb2xs b3dpbmcgb2N0ZXRzOiA8L3Q+DQoNCjxmaWd1cmUgdGl0bGU9IiI+PGFydHdvcmsgbmFtZT0iIiB0 eXBlPSIiIHdpZHRoPSIiIGhlaWdodD0iIj4NCiAgIERFUiBlbmNvZGluZyBvZiBNZWNoVHlwZUxp c3Q6DQogICAzMCBubiAwNiAwOSAyQSA4NiA0OCA4NiBGNyAxMiAwMSAwMiAwMiAuLi4NCjwvYXJ0 d29yaz48L2ZpZ3VyZT4NCg0KPHQ+Tm90ZSB0aGF0IHRoZSBpZGVudGlmaWVyIG9jdGV0IGFuZCBs ZW5naCBvY3RldChzKSBmb3INCiAgIGNvbnN0cnVjdGVkIFswXSAoQTAgbm4pIGFyZSBub3QgaW5j bHVkZWQgaW4gdGhlIE1JQw0KICAgY29tcHV0YXRpb24uPC90Pg0KPC9zZWN0aW9uPg0KDQo8L2Jh Y2s+DQo8L3JmYz4NCg== ------_=_NextPart_001_01C4E1F6.26BED9C3-- --------------040901070804050505050603-- --------------ms090806070303040302010308 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature Content-Transfer-Encoding: base64 Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJPzCC AvowggJjoAMCAQICAwxk8TANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UE ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNv bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDQwNTI3MTc1ODU4WhcNMDUwNTI3MTc1ODU4 WjBrMQ8wDQYDVQQEEwZBbHRtYW4xFTATBgNVBCoTDEplZmZyZXkgRXJpYzEcMBoGA1UEAxMT SmVmZnJleSBFcmljIEFsdG1hbjEjMCEGCSqGSIb3DQEJARYUamFsdG1hbkBjb2x1bWJpYS5l ZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc3JqO5AsZrozd+mJ2mPuCTYo2 +nJ9Qq6jtUYtp7YTMW4d2Q6GLhNaHb1l9m74SxuY4f5vP6JtZjr6p9+LCCxD0w0NVLKRgUDp z+tKFitbkJe9BSCxCURRvY3vdWA71gSCUvZAN3346hHb4oGVqgdpmfFJXYAHWpC46wiL72N9 WxySzY17/0eU0c8+r9dNoLpPQeL43O66O80jCl1qnXMaXaakZPsfm+5W90MYXhpQ1WIQpv02 lBn3BH5YE8xwbsNrw5AF4v7pjMuW85GI6FrDmfbpJX473Rpl5rmv3TpXkJ+7UsIIO1puyS8r 1o7kjDZ5EUYJxxglTGR6XL/RNzqHAgMBAAGjMTAvMB8GA1UdEQQYMBaBFGphbHRtYW5AY29s dW1iaWEuZWR1MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAZYeVFCMP0iV+UVa0 eFoXkzMVl61CNAVY2YQ9/QQazO3G4qNiif35ArrnjPRDRj5M7WTeOCFqPVuvCttyJRiDKsEe L4Yah22mRA3mR7x52j2FquPYZ9qCr1IhrNGzsMk+gopX5G0fTHZb6+uDu5SeMPNNcIznGA7M CMpXAJ2PcKgwggL6MIICY6ADAgECAgMMZPEwDQYJKoZIhvcNAQEEBQAwYjELMAkGA1UEBhMC WkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1Ro YXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA0MDUyNzE3NTg1OFoXDTA1 MDUyNzE3NTg1OFowazEPMA0GA1UEBBMGQWx0bWFuMRUwEwYDVQQqEwxKZWZmcmV5IEVyaWMx HDAaBgNVBAMTE0plZmZyZXkgRXJpYyBBbHRtYW4xIzAhBgkqhkiG9w0BCQEWFGphbHRtYW5A Y29sdW1iaWEuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3NyajuQLGa6M 3fpidpj7gk2KNvpyfUKuo7VGLae2EzFuHdkOhi4TWh29ZfZu+EsbmOH+bz+ibWY6+qffiwgs Q9MNDVSykYFA6c/rShYrW5CXvQUgsQlEUb2N73VgO9YEglL2QDd9+OoR2+KBlaoHaZnxSV2A B1qQuOsIi+9jfVscks2Ne/9HlNHPPq/XTaC6T0Hi+NzuujvNIwpdap1zGl2mpGT7H5vuVvdD GF4aUNViEKb9NpQZ9wR+WBPMcG7Da8OQBeL+6YzLlvORiOhaw5n26SV+O90aZea5r906V5Cf u1LCCDtabskvK9aO5Iw2eRFGCccYJUxkely/0Tc6hwIDAQABozEwLzAfBgNVHREEGDAWgRRq YWx0bWFuQGNvbHVtYmlhLmVkdTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBAGWH lRQjD9IlflFWtHhaF5MzFZetQjQFWNmEPf0EGsztxuKjYon9+QK654z0Q0Y+TO1k3jghaj1b rwrbciUYgyrBHi+GGodtpkQN5ke8edo9harj2Gfagq9SIazRs7DJPoKKV+RtH0x2W+vrg7uU njDzTXCM5xgOzAjKVwCdj3CoMIIDPzCCAqigAwIBAgIBDTANBgkqhkiG9w0BAQUFADCB0TEL MAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3du MRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENB MSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTAzMDcx NzAwMDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0 ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVl bWFpbCBJc3N1aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEpjxVc1X7TrnK mVoeaMB1BHCd3+n/ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuFWqo/ cVbLrzwLB+fxH5E2JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8 YQRAHmQZcmC3+wIDAQABo4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4 oDagNIYyaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS5j cmwwCwYDVR0PBAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwy LTEzODANBgkqhkiG9w0BAQUFAAOBgQBIjNFQg+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4 Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZfoSxmRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowg T2Vfldr394fWxghOrvbqNOUQGls1TXfjViF4gtwhGTXeJLHTHUb/XV9lTzGCAzswggM3AgEB MGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0 ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMMZPEw CQYFKw4DAhoFAKCCAacwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUx DxcNMDQxMjE1MTgxNzU4WjAjBgkqhkiG9w0BCQQxFgQUFZaXhMQveajqRMUz+GsdCBUc4qQw UgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcN AwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgweAYJKwYBBAGCNxAEMWswaTBiMQswCQYD VQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAwxk8TB6BgsqhkiG9w0B CRACCzFroGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB AgMMZPEwDQYJKoZIhvcNAQEBBQAEggEAa7MFdiFwgFUD8z8LJf18QMpUOnOtYpO7jU9e2xvH bg593VsLK2PeLJTBIaxqTATdeKsj5+Vy7xMV2uw+wElk+Lw4x+5nhgF9RLlBjBUD05UpVo2y zidrLg0LOQOYAE05RjXWxmPN8mraoc8dQbgFoeuVV5hZikTVY4BymEJHYihvl6DEFdzdheeg 96PJ037FXMLYwo9Iy8NgWus5umfE3mOSibP1h3q1wkoYLaox+R5EWgx+CEdUvMyTojey2ExJ PIFUz6N7epEYdPnVk0df4bKPIc/YGQX0vA02akiblf5MPC1Lj/pFzC5DxtZoGUa3DjE6kOUm 7BwtmMmNE6iHmgAAAAAAAA== --------------ms090806070303040302010308-- --===============0388358783== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --===============0388358783==-- From kitten-bounces@ietf.org Wed Dec 15 14:37:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA01709; Wed, 15 Dec 2004 14:37:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cef5t-0007h1-2F; Wed, 15 Dec 2004 14:45:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeewW-0002EU-Vn; Wed, 15 Dec 2004 14:36:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeejY-0007CX-4k for kitten@megatron.ietf.org; Wed, 15 Dec 2004 14:22:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00013 for ; Wed, 15 Dec 2004 14:22:46 -0500 (EST) Received: from carter-zimmerman.mit.edu ([18.18.3.197] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ceerm-0007FV-NV for kitten@ietf.org; Wed, 15 Dec 2004 14:31:21 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id BA297E0063; Wed, 15 Dec 2004 14:23:22 -0500 (EST) To: kitten@ietf.org References: <20041215112536.GQ135801@binky.central.sun.com> <87llbz612l.fsf@luminous.mit.edu> <20041215180151.GQ135800@binky.central.sun.com> From: Sam Hartman Date: Wed, 15 Dec 2004 14:23:22 -0500 In-Reply-To: <20041215180151.GQ135800@binky.central.sun.com> (Nicolas Williams's message of "Wed, 15 Dec 2004 12:01:51 -0600") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a >>>>> "Nicolas" == Nicolas Williams writes: >> >>>>> "Nicolas" == Nicolas Williams >> writes: >> Nicolas> [My comments take into account the changes agreed to in >> Nicolas> Similarly, for section 3.2, (c), (II), there may or may Nicolas> not be a mechanism token in the negotiation token when Nicolas> the state is request_mic -- if the mechanism outputs a Nicolas> token then it should be included in the negotiation token Nicolas> (except in the error token case, in which it should be Nicolas> optional). >> Why is an error token optional? Nicolas> IIRC you've wanted error tokens and/or useful information Nicolas> in them to be optional and, anyways, initiators already Nicolas> have to be prepared to never hear from acceptors again, Nicolas> even in the middle of a context token exchange. In application protocols yes. In this instance, if the acceptor sends anything it should send the final token from the mechanism though even if it is an error token. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 15:38:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08021; Wed, 15 Dec 2004 15:38:12 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ceg2q-0000kk-8d; Wed, 15 Dec 2004 15:46:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cefn1-0003NW-8e; Wed, 15 Dec 2004 15:30:27 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CefcR-00052T-Fb for kitten@megatron.ietf.org; Wed, 15 Dec 2004 15:19:32 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA06112 for ; Wed, 15 Dec 2004 15:19:29 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cefkh-0000Ji-36 for kitten@ietf.org; Wed, 15 Dec 2004 15:28:05 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iBFKJQiI026265 for ; Wed, 15 Dec 2004 12:19:26 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBFKJPJf000361 for ; Wed, 15 Dec 2004 13:19:25 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBFKITsZ172691 for ; Wed, 15 Dec 2004 14:18:29 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBFKITaR172690 for kitten@ietf.org; Wed, 15 Dec 2004 14:18:29 -0600 (CST) Date: Wed, 15 Dec 2004 14:18:29 -0600 From: Nicolas Williams To: kitten@ietf.org Message-ID: <20041215201828.GU135801@binky.central.sun.com> Mail-Followup-To: kitten@ietf.org References: <20041215112536.GQ135801@binky.central.sun.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041215112536.GQ135801@binky.central.sun.com> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: a92270ba83d7ead10c5001bb42ec3221 Subject: Text (was Re: comments on 2478bis (SPNEGO) I-D) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 31b28e25e9d13a22020d8b7aedc9832c On Wed, Dec 15, 2004 at 05:25:36AM -0600, Nicolas Williams wrote: > [My comments take into account the changes agreed to in the thread > started by Sam about his comments.] > > - section 3.1, third paragraph: the GSS_Set/Get_neg_mechs() functions > deal in SET OF OBJECT IDENTIFIER, not SEQUENCE OF, therefore > applications cannot specify preference order through > GSS_Set_neg_mechs(). > > GSS_Set/Get_neg_mechs() could not be changed to use SEQUENCE OF > OBJECT IDENTIFIER because of language bindings issues (unless there > exist no implementations, I suppose) since SEQUENCE OF is not used > anywhere in RFC2743 none of the language bindings have appropriate > bindings for that type. > > I suggest either extensions for specifying policy or else that this > paragraph be re-written to remove at least the reference to appendix > A. > - section 3.1, next to last paragraph: should that not read: "Lastly, > MIC tokens MAY, and sometimes MUST be exchanged ...?" Larry points out that this should not be normative text, so lower case the 'may'. > - section 3.2, first paragraph: if integrity protection is not > available then what? Presumably the context can be established > anyhow as neither the initiator would offer nor the acceptor accept > such a mech if they really want a protected negotiation. So, what I'm asking for here is for security considerations text that uses rfc2119 key words to say that peers should not offer/accept such mechanisms if they want negotiation protection. > - section 3.2, (c), (III): s/depending on if at least.*\./according to > the status of the negotiated mechanism's context./ > > Similarly, for section 3.2, (c), (II), there may or may not be a > mechanism token in the negotiation token when the state is > request_mic -- if the mechanism outputs a token then it should be > included in the negotiation token (except in the error token case, in > which it should be optional). Larry agrees to this and has made the change. > - section 3.2, (d): encapsulated with what? NegTokenResp? Larry agrees and has fixed. > - section 3.2, first paragraph after (e): s/i.e.,.*\./i.e., these flag > input parameters and state output parameters are passed by SPNEGO > unmodified between the application and the mechanism./ Larry points out that this is implicit and also that a SPNEGO implementation might want to modify *_req_flags, so, no change is needed here and I agree. > - section 3.2, last paragraph: I think this should be re-written > thusly: > > When a GSS-API credential is acquired for the SPNEGO mechanism the > implementation SHOULD produce a credential element for the SPNEGO > mechanism which internally contains GSS-API credential elements > for all mechanisms for which the principal has credentials > available, except for any mechanisms which are not to be > negotiated, either as per implementation-, site- or > application-specific policy. See Appendix A for interfaces for > expressing application policy. Larry agrees to this change. > - section 4.2, first paragraph: s/are not/MUST NOT be/ Larry agrees and has fixed this. > - section 4.2.1, if reqFlags has no impact on the negotiation, what's > the point? Why not deprecate that field recommend that it be left > out? Besides, what would an acceptor do with those flags? > GSS_Accept_sec_context() doesn't have a flags input parameter... And > the final output flags from the SPNEGO GSS_Accept_sec_context() > should, one would think, correspond to those of the negotiated > mechanism's (minus prot_ready prior to full context establishment). Larry agrees and added a comment in the structure explaining that this field is there for compatibility but SHOULD be left out. > - section 4.2.2: ENUMERATED can have extensibility markers too. If the > negResult enumeration gets such a marker then section 6 will have to > explain what implementors are to do about unknown negResults; IMO the > answer is: derive actual state from the negotiated context state or, > if that's not possible, quit with an error. For simplicity's sake I'm withdrawing this comment. This field suffers from being mostly redundant, except for the request_mic value. (BTW, are underscores allowed in ASN.1 value symbols?) > - section 4.2.2: Add: "When negResult is absent the actual state should > be inferred from the state of the negotiated mechanism context." Larry agrees, and has fixed this. > - section 5, what happens when a mechListMIC is sent when it is > OPTIONAL? The receipient should have to process it, IMO, and that > should be a MUST, no? Larry points out that this is covered in section 5, (b) (I) and (c) (I), but note that there's no normative rfc2119 key words about that. Larry rejects this. I don't mind. > - section 5, (b), (I), the initiator MUST output a negotiation token > with a mechListMIC, no? I.e., RFC2119 key words are needed. Larry rejects this. I don't mind. > - section 5, (b), (II): s/terminated. GSS.*\.//terminated; > GSS_S_DEFECTIVE_TOKEN MUST be indicated as the major status./ > > I.e., this applies not just to GSS_Accept_sec_context() but also to > GSS_Init_sec_context(). > > Similarly for section 5, (b), (IV). Larry agrees and has fixed this. > - section 5, (c): I'm with Sam on this; I've not seen a response from > Larry about. The initiator has to send a mechListMIC if the acceptor > selected a mechanism other than the initiator's preference even if > the acceptor did not request a mecListMIC. Larry says that this has been addressed already -- either I missed it or it was addressed off-list. > - section 5, (c): GSS_Init_sec_context() should not, presumably, > indicate GSS_S_CONTINUE_NEEDED if the intiator offers only one > mechanism, an optimistic token is included and the mechanism is a > one-token mechanism (i.e., it indicates GSS_S_COMPLETE immediately), > right? Larry disagrees and considers this an optimization for a case where apps should not use SPNEGO anyways (to negotiate from a list of one mechanism). I withdraw the comment. > - section 5, (c), (I), again, RFC2119 key words are needed: > s/contains/MUST include/ (and the token MUST be output!) Larry rejects this comment. I don't mind. > - section 5, (c), (I), when the acceptor's mechListMIC cannot be > verified by the initiator GSS_Init_sec_context() should (MUST) > indicate GSS_S_DEFECTIVE_TOKEN. Larry rejects this comment claiming that this is implied. I agree it's impled and don't mind if it isn't fixed. > - section 5, (c), (III): It may be useful to explain why. This isn't a big deal, but my point is that someone who is not familiar with SPNEGO may legitimately wonder why there's that final negotiation message when the mechListMIC was not needed. In other words this text may be confusing to others, though not to me. Larry does not want to make a change. I don't mind. > - section 5, (c), (III): s/contains/MUST contain/ (and the token MUST > be output!). Larry rejects this comment. I don't mind. > - section 6, second paragraph, third sentence: s/ but instead.*\.// Larry agrees and has fixed this. > - section 7, given the attack in the even-numbered mechanism token > exchange case where the initiator can end up fully established while > the acceptor fails to establish, isn't there an issue where an > attacker could cause a downgrade to a mechanism for which it could > impersonate the acceptor through other attacks? Larry points out that the next to last paragraph in section 7 covers this. I withdraw this comment. Done. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 15:39:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08230; Wed, 15 Dec 2004 15:39:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ceg3v-0000m3-Na; Wed, 15 Dec 2004 15:47:55 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CefnC-0003WD-Pe; Wed, 15 Dec 2004 15:30:38 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CefjT-0000cR-49 for kitten@megatron.ietf.org; Wed, 15 Dec 2004 15:26:47 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07069 for ; Wed, 15 Dec 2004 15:26:44 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cefrk-0000U3-0O for kitten@ietf.org; Wed, 15 Dec 2004 15:35:21 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iBFKQiiI000177 for ; Wed, 15 Dec 2004 12:26:44 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBFKQhJf003579 for ; Wed, 15 Dec 2004 13:26:43 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBFKPlbG172732; Wed, 15 Dec 2004 14:25:47 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBFKPlSq172731; Wed, 15 Dec 2004 14:25:47 -0600 (CST) Date: Wed, 15 Dec 2004 14:25:47 -0600 From: Nicolas Williams To: Sam Hartman Message-ID: <20041215202547.GU135800@binky.central.sun.com> Mail-Followup-To: Sam Hartman , kitten@ietf.org References: <20041215112536.GQ135801@binky.central.sun.com> <87llbz612l.fsf@luminous.mit.edu> <20041215180151.GQ135800@binky.central.sun.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 On Wed, Dec 15, 2004 at 02:23:22PM -0500, Sam Hartman wrote: > >>>>> "Nicolas" == Nicolas Williams writes: > > > >> >>>>> "Nicolas" == Nicolas Williams > >> writes: > >> > Nicolas> [My comments take into account the changes agreed to in > >> > Nicolas> Similarly, for section 3.2, (c), (II), there may or may > Nicolas> not be a mechanism token in the negotiation token when > Nicolas> the state is request_mic -- if the mechanism outputs a > Nicolas> token then it should be included in the negotiation token > Nicolas> (except in the error token case, in which it should be > Nicolas> optional). > >> Why is an error token optional? > > Nicolas> IIRC you've wanted error tokens and/or useful information > Nicolas> in them to be optional and, anyways, initiators already > Nicolas> have to be prepared to never hear from acceptors again, > Nicolas> even in the middle of a context token exchange. > > In application protocols yes. In this instance, if the acceptor sends > anything it should send the final token from the mechanism though even > if it is an error token. But that makes the negotiation token an error token also, and negotiation error tokens have to be as optional as error tokens are for any mechanism. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 15:55:40 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA09694; Wed, 15 Dec 2004 15:55:40 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CegJj-0001LY-Tu; Wed, 15 Dec 2004 16:04:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CefwO-0000DU-AZ; Wed, 15 Dec 2004 15:40:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CefrL-0005uH-DV for kitten@megatron.ietf.org; Wed, 15 Dec 2004 15:34:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07724 for ; Wed, 15 Dec 2004 15:34:52 -0500 (EST) Received: from mail2.microsoft.com ([131.107.3.124]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cefzc-0000g4-Ck for kitten@ietf.org; Wed, 15 Dec 2004 15:43:29 -0500 Received: from mailout1.microsoft.com ([157.54.1.117]) by mail2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 15 Dec 2004 12:34:23 -0800 Received: from red-hub-04.redmond.corp.microsoft.com ([157.54.3.6]) by mailout1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1264); Wed, 15 Dec 2004 12:34:22 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-04.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 15 Dec 2004 12:34:21 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1289); Wed, 15 Dec 2004 12:34:09 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Wed, 15 Dec 2004 12:33:53 -0800 Message-ID: Thread-Topic: comments on 2478bis (SPNEGO) I-D Thread-Index: AcTi3XjA7E8bZz5oTGmlfidUyvbXqQABgNxQ From: "Liqiang\(Larry\) Zhu" To: "Sam Hartman" , X-OriginalArrivalTime: 15 Dec 2004 20:34:09.0129 (UTC) FILETIME=[6DD52590:01C4E2E5] X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Content-Transfer-Encoding: quoted-printable Subject: RE: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Content-Transfer-Encoding: quoted-printable Sam Hartman wrote: > In application protocols yes. In this instance, if the acceptor sends anything it should send the final >=20 > token from the mechanism though even if it is an error token. The error token must be optional because SSPI can not support context level tokens that are produced when GSS_Init_sec_context() or GSS_Init_accept_context() fails. -- larry -----Original Message----- From: kitten-bounces@lists.ietf.org [mailto:kitten-bounces@lists.ietf.org] On Behalf Of Sam Hartman Sent: Wednesday, December 15, 2004 11:23 AM To: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D >>>>> "Nicolas" =3D=3D Nicolas Williams = writes: >> >>>>> "Nicolas" =3D=3D Nicolas Williams = >> writes: >>=20 Nicolas> [My comments take into account the changes agreed to in >> Nicolas> Similarly, for section 3.2, (c), (II), there may or may Nicolas> not be a mechanism token in the negotiation token when Nicolas> the state is request_mic -- if the mechanism outputs a Nicolas> token then it should be included in the negotiation token Nicolas> (except in the error token case, in which it should be Nicolas> optional). >> Why is an error token optional? Nicolas> IIRC you've wanted error tokens and/or useful information Nicolas> in them to be optional and, anyways, initiators already Nicolas> have to be prepared to never hear from acceptors again, Nicolas> even in the middle of a context token exchange. In application protocols yes. In this instance, if the acceptor sends anything it should send the final token from the mechanism though even if it is an error token. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 15:59:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA10194; Wed, 15 Dec 2004 15:59:13 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CegNB-0001T9-NI; Wed, 15 Dec 2004 16:07:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CegBa-0007F3-En; Wed, 15 Dec 2004 15:55:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cefy0-0001Dw-8e for kitten@megatron.ietf.org; Wed, 15 Dec 2004 15:41:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08421 for ; Wed, 15 Dec 2004 15:41:43 -0500 (EST) Received: from carter-zimmerman.mit.edu ([18.18.3.197] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ceg5r-0000p1-DQ for kitten@ietf.org; Wed, 15 Dec 2004 15:50:20 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id 246C3E0063; Wed, 15 Dec 2004 15:41:58 -0500 (EST) To: "Liqiang(Larry) Zhu" References: From: Sam Hartman Date: Wed, 15 Dec 2004 15:41:58 -0500 In-Reply-To: (Liqiang Zhu's message of "Wed, 15 Dec 2004 12:33:53 -0800") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a >>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu writes: Liqiang(Larry)> Sam Hartman wrote: >> In application protocols yes. In this instance, if the >> acceptor sends Liqiang(Larry)> anything it should send the final > >> token from the mechanism though even if it is an error token. Liqiang(Larry)> The error token must be optional because SSPI can Liqiang(Larry)> not support context level tokens that are produced Liqiang(Larry)> when GSS_Init_sec_context() or Liqiang(Larry)> GSS_Init_accept_context() fails. Don't let this discussion interrupt work on -04. So, there are a lot of levels of optional here. If the mechanism returns gss_something_bad and generates an output token (something that cannot happen on SSPI), I contend that SPNEGO must also output this token. I agree mechanisms may not have error tokens. But if they do, SPNEGO must not be the reason they are not delivered. The application can of course choose not to deliver the resulting SPNEGO token. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 15 16:26:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15699; Wed, 15 Dec 2004 16:26:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cegnm-00038q-Pg; Wed, 15 Dec 2004 16:35:19 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CegCj-0008Bj-JD; Wed, 15 Dec 2004 15:57:01 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ceg22-0002Q2-Ej; Wed, 15 Dec 2004 15:45:58 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08880; Wed, 15 Dec 2004 15:45:56 -0500 (EST) Message-Id: <200412152045.PAA08880@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Wed, 15 Dec 2004 15:45:55 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-2478bis-03.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: cf3becbbd6d1a45acbe2ffd4ab88bdc2 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : The Simple and Protected GSS-API Negotiation Mechanism Author(s) : L. Zhu, et al. Filename : draft-ietf-kitten-2478bis-03.txt Pages : 28 Date : 2004-12-15 This document specifies a negotiation mechanism for the Generic Security Service Application Program Interface (GSS-API) which is described in RFC 2743. GSS-API peers can use this negotiation mechanism to choose from a common set of security mechanisms. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-2478bis-03.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-2478bis-03.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-2478bis-03.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-15161411.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-2478bis-03.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-2478bis-03.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-15161411.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Wed Dec 15 16:36:21 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA18025; Wed, 15 Dec 2004 16:36:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cegx6-0003wy-HP; Wed, 15 Dec 2004 16:44:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CegCs-0008Gd-L0; Wed, 15 Dec 2004 15:57:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ceg8e-0005RH-Fi for kitten@megatron.ietf.org; Wed, 15 Dec 2004 15:52:50 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA09323 for ; Wed, 15 Dec 2004 15:52:45 -0500 (EST) Received: from mail2.microsoft.com ([131.107.3.124]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CegGv-00016d-NU for kitten@ietf.org; Wed, 15 Dec 2004 16:01:23 -0500 Received: from mailout2.microsoft.com ([157.54.1.120]) by mail2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 15 Dec 2004 12:52:16 -0800 Received: from red-hub-02.redmond.corp.microsoft.com ([157.54.7.100]) by mailout2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 15 Dec 2004 12:52:15 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-02.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 15 Dec 2004 12:52:17 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1289); Wed, 15 Dec 2004 12:52:02 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C4E2E7.E36ED879" Date: Wed, 15 Dec 2004 12:51:45 -0800 Message-ID: X-MS-Has-Attach: yes Thread-Topic: Text (was Re: comments on 2478bis (SPNEGO) I-D) Thread-Index: AcTi5f8I1xAbCLMQRRihOy4STHHS+QAAedFg From: "Liqiang\(Larry\) Zhu" To: "Nicolas Williams" , X-OriginalArrivalTime: 15 Dec 2004 20:52:02.0182 (UTC) FILETIME=[ED6C0A60:01C4E2E7] X-Spam-Score: 0.0 (/) X-Scan-Signature: e82cca8d2cc5933d6aecab299a89ccb4 Subject: RE: Text (was Re: comments on 2478bis (SPNEGO) I-D) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7418200ea0c73569681eb45a76a492d4 This is a multi-part message in MIME format. ------_=_NextPart_001_01C4E2E7.E36ED879 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable -04 is attached. -----Original Message----- From: kitten-bounces@lists.ietf.org [mailto:kitten-bounces@lists.ietf.org] On Behalf Of Nicolas Williams Sent: Wednesday, December 15, 2004 12:18 PM To: kitten@ietf.org Subject: Text (was Re: comments on 2478bis (SPNEGO) I-D) On Wed, Dec 15, 2004 at 05:25:36AM -0600, Nicolas Williams wrote: > [My comments take into account the changes agreed to in the thread=20 > started by Sam about his comments.] >=20 > - section 3.1, third paragraph: the GSS_Set/Get_neg_mechs() functions > deal in SET OF OBJECT IDENTIFIER, not SEQUENCE OF, therefore > applications cannot specify preference order through > GSS_Set_neg_mechs(). >=20 > GSS_Set/Get_neg_mechs() could not be changed to use SEQUENCE OF > OBJECT IDENTIFIER because of language bindings issues (unless there > exist no implementations, I suppose) since SEQUENCE OF is not used > anywhere in RFC2743 none of the language bindings have appropriate > bindings for that type. >=20 > I suggest either extensions for specifying policy or else that this > paragraph be re-written to remove at least the reference to appendix > A. > - section 3.1, next to last paragraph: should that not read: "Lastly, > MIC tokens MAY, and sometimes MUST be exchanged ...?" Larry points out that this should not be normative text, so lower case the 'may'. > - section 3.2, first paragraph: if integrity protection is not > available then what? Presumably the context can be established > anyhow as neither the initiator would offer nor the acceptor accept > such a mech if they really want a protected negotiation. So, what I'm asking for here is for security considerations text that uses rfc2119 key words to say that peers should not offer/accept such mechanisms if they want negotiation protection. > - section 3.2, (c), (III): s/depending on if at least.*\./according to > the status of the negotiated mechanism's context./ >=20 > Similarly, for section 3.2, (c), (II), there may or may not be a > mechanism token in the negotiation token when the state is > request_mic -- if the mechanism outputs a token then it should be > included in the negotiation token (except in the error token case, in > which it should be optional). Larry agrees to this and has made the change. > - section 3.2, (d): encapsulated with what? NegTokenResp? Larry agrees and has fixed. > - section 3.2, first paragraph after (e): s/i.e.,.*\./i.e., these flag > input parameters and state output parameters are passed by SPNEGO > unmodified between the application and the mechanism./ Larry points out that this is implicit and also that a SPNEGO implementation might want to modify *_req_flags, so, no change is needed here and I agree. > - section 3.2, last paragraph: I think this should be re-written > thusly: >=20 > When a GSS-API credential is acquired for the SPNEGO mechanism the > implementation SHOULD produce a credential element for the SPNEGO > mechanism which internally contains GSS-API credential elements > for all mechanisms for which the principal has credentials > available, except for any mechanisms which are not to be > negotiated, either as per implementation-, site- or > application-specific policy. See Appendix A for interfaces for > expressing application policy. Larry agrees to this change. > - section 4.2, first paragraph: s/are not/MUST NOT be/ Larry agrees and has fixed this. > - section 4.2.1, if reqFlags has no impact on the negotiation, what's > the point? Why not deprecate that field recommend that it be left > out? Besides, what would an acceptor do with those flags? > GSS_Accept_sec_context() doesn't have a flags input parameter... And > the final output flags from the SPNEGO GSS_Accept_sec_context() > should, one would think, correspond to those of the negotiated > mechanism's (minus prot_ready prior to full context establishment). Larry agrees and added a comment in the structure explaining that this field is there for compatibility but SHOULD be left out. > - section 4.2.2: ENUMERATED can have extensibility markers too. If the > negResult enumeration gets such a marker then section 6 will have to > explain what implementors are to do about unknown negResults; IMO the > answer is: derive actual state from the negotiated context state or, > if that's not possible, quit with an error. For simplicity's sake I'm withdrawing this comment. This field suffers from being mostly redundant, except for the request_mic value. (BTW, are underscores allowed in ASN.1 value symbols?) > - section 4.2.2: Add: "When negResult is absent the actual state should > be inferred from the state of the negotiated mechanism context." Larry agrees, and has fixed this. > - section 5, what happens when a mechListMIC is sent when it is > OPTIONAL? The receipient should have to process it, IMO, and that > should be a MUST, no? Larry points out that this is covered in section 5, (b) (I) and (c) (I), but note that there's no normative rfc2119 key words about that. Larry rejects this. I don't mind. > - section 5, (b), (I), the initiator MUST output a negotiation token > with a mechListMIC, no? I.e., RFC2119 key words are needed. Larry rejects this. I don't mind. > - section 5, (b), (II): s/terminated. GSS.*\.//terminated; > GSS_S_DEFECTIVE_TOKEN MUST be indicated as the major status./ >=20 > I.e., this applies not just to GSS_Accept_sec_context() but also to > GSS_Init_sec_context(). >=20 > Similarly for section 5, (b), (IV). Larry agrees and has fixed this. > - section 5, (c): I'm with Sam on this; I've not seen a response from > Larry about. The initiator has to send a mechListMIC if the acceptor > selected a mechanism other than the initiator's preference even if > the acceptor did not request a mecListMIC. Larry says that this has been addressed already -- either I missed it or it was addressed off-list. > - section 5, (c): GSS_Init_sec_context() should not, presumably, > indicate GSS_S_CONTINUE_NEEDED if the intiator offers only one > mechanism, an optimistic token is included and the mechanism is a > one-token mechanism (i.e., it indicates GSS_S_COMPLETE immediately), > right? Larry disagrees and considers this an optimization for a case where apps should not use SPNEGO anyways (to negotiate from a list of one mechanism). I withdraw the comment. > - section 5, (c), (I), again, RFC2119 key words are needed: > s/contains/MUST include/ (and the token MUST be output!) Larry rejects this comment. I don't mind. > - section 5, (c), (I), when the acceptor's mechListMIC cannot be > verified by the initiator GSS_Init_sec_context() should (MUST) > indicate GSS_S_DEFECTIVE_TOKEN. Larry rejects this comment claiming that this is implied. I agree it's impled and don't mind if it isn't fixed. > - section 5, (c), (III): It may be useful to explain why. This isn't a big deal, but my point is that someone who is not familiar with SPNEGO may legitimately wonder why there's that final negotiation message when the mechListMIC was not needed. In other words this text may be confusing to others, though not to me. Larry does not want to make a change. I don't mind. > - section 5, (c), (III): s/contains/MUST contain/ (and the token MUST > be output!). Larry rejects this comment. I don't mind. > - section 6, second paragraph, third sentence: s/ but instead.*\.// Larry agrees and has fixed this. > - section 7, given the attack in the even-numbered mechanism token > exchange case where the initiator can end up fully established while > the acceptor fails to establish, isn't there an issue where an > attacker could cause a downgrade to a mechanism for which it could > impersonate the acceptor through other attacks? Larry points out that the next to last paragraph in section 7 covers this. I withdraw this comment. Done. Nico --=20 _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten ------_=_NextPart_001_01C4E2E7.E36ED879 Content-Type: text/plain; name="draft-ietf-kitten-2478bis-04.txt" Content-Description: draft-ietf-kitten-2478bis-04.txt Content-Disposition: attachment; filename="draft-ietf-kitten-2478bis-04.txt" Content-Transfer-Encoding: base64 DQoNCk5FVFdPUksgV09SS0lORyBHUk9VUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEwuIFpodQ0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFAuIExlYWNoDQpPYnNvbGV0ZXM6IDI0NzggKGlm IGFwcHJvdmVkKSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEsuIEphZ2FuYXRoYW4NCkV4 cGlyZXM6IEp1bmUgMTUsIDIwMDUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1pY3Jvc29m dCBDb3Jwb3JhdGlvbg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgVy4gSW5nZXJzb2xsDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFN1biBNaWNyb3N5c3RlbXMNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEZWNlbWJlciAx NSwgMjAwNA0KDQoNCiAgICAgICAgIFRoZSBTaW1wbGUgYW5kIFByb3RlY3RlZCBHU1MtQVBJIE5l Z290aWF0aW9uIE1lY2hhbmlzbQ0KICAgICAgICAgICAgICAgICAgICAgIGRyYWZ0LWlldGYta2l0 dGVuLTI0NzhiaXMtMDQNCg0KU3RhdHVzIG9mIHRoaXMgTWVtbw0KDQogICBUaGlzIGRvY3VtZW50 IGlzIGFuIEludGVybmV0LURyYWZ0IGFuZCBpcyBzdWJqZWN0IHRvIGFsbCBwcm92aXNpb25zDQog ICBvZiBzZWN0aW9uIDMgb2YgUkZDIDM2NjcuICBCeSBzdWJtaXR0aW5nIHRoaXMgSW50ZXJuZXQt RHJhZnQsIGVhY2gNCiAgIGF1dGhvciByZXByZXNlbnRzIHRoYXQgYW55IGFwcGxpY2FibGUgcGF0 ZW50IG9yIG90aGVyIElQUiBjbGFpbXMgb2YNCiAgIHdoaWNoIGhlIG9yIHNoZSBpcyBhd2FyZSBo YXZlIGJlZW4gb3Igd2lsbCBiZSBkaXNjbG9zZWQsIGFuZCBhbnkgb2YNCiAgIHdoaWNoIGhlIG9y IHNoZSBiZWNvbWUgYXdhcmUgd2lsbCBiZSBkaXNjbG9zZWQsIGluIGFjY29yZGFuY2Ugd2l0aA0K ICAgUkZDIDM2NjguDQoNCiAgIEludGVybmV0LURyYWZ0cyBhcmUgd29ya2luZyBkb2N1bWVudHMg b2YgdGhlIEludGVybmV0IEVuZ2luZWVyaW5nDQogICBUYXNrIEZvcmNlIChJRVRGKSwgaXRzIGFy ZWFzLCBhbmQgaXRzIHdvcmtpbmcgZ3JvdXBzLiAgTm90ZSB0aGF0DQogICBvdGhlciBncm91cHMg bWF5IGFsc28gZGlzdHJpYnV0ZSB3b3JraW5nIGRvY3VtZW50cyBhcw0KICAgSW50ZXJuZXQtRHJh ZnRzLg0KDQogICBJbnRlcm5ldC1EcmFmdHMgYXJlIGRyYWZ0IGRvY3VtZW50cyB2YWxpZCBmb3Ig YSBtYXhpbXVtIG9mIHNpeCBtb250aHMNCiAgIGFuZCBtYXkgYmUgdXBkYXRlZCwgcmVwbGFjZWQs IG9yIG9ic29sZXRlZCBieSBvdGhlciBkb2N1bWVudHMgYXQgYW55DQogICB0aW1lLiAgSXQgaXMg aW5hcHByb3ByaWF0ZSB0byB1c2UgSW50ZXJuZXQtRHJhZnRzIGFzIHJlZmVyZW5jZQ0KICAgbWF0 ZXJpYWwgb3IgdG8gY2l0ZSB0aGVtIG90aGVyIHRoYW4gYXMgIndvcmsgaW4gcHJvZ3Jlc3MuIg0K DQogICBUaGUgbGlzdCBvZiBjdXJyZW50IEludGVybmV0LURyYWZ0cyBjYW4gYmUgYWNjZXNzZWQg YXQNCiAgIGh0dHA6Ly93d3cuaWV0Zi5vcmcvaWV0Zi8xaWQtYWJzdHJhY3RzLnR4dC4NCg0KICAg VGhlIGxpc3Qgb2YgSW50ZXJuZXQtRHJhZnQgU2hhZG93IERpcmVjdG9yaWVzIGNhbiBiZSBhY2Nl c3NlZCBhdA0KICAgaHR0cDovL3d3dy5pZXRmLm9yZy9zaGFkb3cuaHRtbC4NCg0KICAgVGhpcyBJ bnRlcm5ldC1EcmFmdCB3aWxsIGV4cGlyZSBvbiBKdW5lIDE1LCAyMDA1Lg0KDQpDb3B5cmlnaHQg Tm90aWNlDQoNCiAgIENvcHlyaWdodCAoQykgVGhlIEludGVybmV0IFNvY2lldHkgKDIwMDQpLg0K DQpBYnN0cmFjdA0KDQogICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBhIG5lZ290aWF0aW9uIG1l Y2hhbmlzbSBmb3IgdGhlIEdlbmVyaWMNCiAgIFNlY3VyaXR5IFNlcnZpY2UgQXBwbGljYXRpb24g UHJvZ3JhbSBJbnRlcmZhY2UgKEdTUy1BUEkpIHdoaWNoIGlzDQogICBkZXNjcmliZWQgaW4gUkZD IDI3NDMuDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTUs IDIwMDUgICAgICAgICAgICAgICAgICBbUGFnZSAxXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAg R1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0K ICAgR1NTLUFQSSBwZWVycyBjYW4gdXNlIHRoaXMgbmVnb3RpYXRpb24gbWVjaGFuaXNtIHRvIGNo b29zZSBmcm9tIGENCiAgIGNvbW1vbiBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcy4NCg0KICAg SWYgcGVyLW1lc3NhZ2UgaW50ZWdyaXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhlIGVz dGFibGlzaGVkDQogICBtZWNoYW5pc20gY29udGV4dCwgdGhlbiB0aGUgbmVnb3RpYXRpb24gaXMg cHJvdGVjdGVkIGFnYWluc3QgYW4NCiAgIGF0dGFja2VyIGZvcmNpbmcgdGhlIHNlbGVjdGlvbiBv ZiBhIG1lY2hhbmlzbSBub3QgZGVzaXJlZCBieSB0aGUNCiAgIHBlZXJzLg0KDQogICBUaGlzIG1l Y2hhbmlzbSByZXBsYWNlcyBSRkMgMjQ3OCBpbiBvcmRlciB0byBmaXggZGVmZWN0cyBpbiB0aGF0 DQogICBzcGVjaWZpY2F0aW9uIGFuZCB0byBkZXNjcmliZSBob3cgdG8gaW50ZXJvcGVyYXRlIHdp dGgNCiAgIGltcGxlbWVudGF0aW9ucyBvZiB0aGF0IHNwZWNpZmljYXRpb24gY29tbW9ubHkgZGVw bG95ZWQgb24gdGhlDQogICBJbnRlcm5ldC4NCg0KVGFibGUgb2YgQ29udGVudHMNCg0KICAgMS4g IEludHJvZHVjdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuICAzDQogICAyLiAgQ29udmVudGlvbnMgVXNlZCBpbiBUaGlzIERvY3VtZW50ICAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDUNCiAgIDMuICBOZWdvdGlhdGlvbiBQcm90b2NvbCAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgNg0KICAgICAzLjEgICBO ZWdvdGlhdGlvbiBEZXNjcmlwdGlvbiAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu ICA2DQogICAgIDMuMiAgIE5lZ290aWF0aW9uIFByb2NlZHVyZSAgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gIDcNCiAgIDQuICBUb2tlbiBEZWZpbml0aW9ucyAgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxMA0KICAgICA0LjEgICBNZWNoYW5p c20gVHlwZXMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDEwDQog ICAgIDQuMiAgIE5lZ290aWF0aW9uIFRva2VucyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gMTANCiAgICAgICA0LjIuMSAgIG5lZ1Rva2VuSW5pdCAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxMQ0KICAgICAgIDQuMi4yICAgbmVnVG9rZW5S ZXNwIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDEyDQogICA1LiAg UHJvY2Vzc2luZyBvZiBtZWNoTGlzdE1JQyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gMTQNCiAgIDYuICBFeHRlbnNpYmlsaXR5ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxNw0KICAgNy4gIFNlY3VyaXR5IENvbnNpZGVyYXRpb25z ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDE4DQogICA4LiAgSUFOQSBD b25zaWRlcmF0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g MTkNCiAgIDkuICBBY2tub3dsZWRnbWVudHMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAyMA0KICAgMTAuICAgUmVmZXJlbmNlcyAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIxDQogICAxMC4xICBOb3JtYXRpdmUg UmVmZXJlbmNlcyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMjENCiAg IDEwLjIgIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAyMQ0KICAgICAgIEF1dGhvcnMnIEFkZHJlc3NlcyAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIxDQogICBBLiAgR1NTLUFQSSBOZWdvdGlhdGlv biBTdXBwb3J0IEFQSSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMjMNCiAgICAgQS4x ICAgR1NTX1NldF9uZWdfbWVjaHMgY2FsbCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAyMw0KICAgICBBLjIgICBHU1NfR2V0X25lZ19tZWNocyBjYWxsIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIzDQogICBCLiAgQ2hhbmdlcyBzaW5jZSBSRkMyNDc4ICAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMjUNCiAgIEMuICBtZWNoTGlz dE1JQyBDb21wdXRhdGlvbiBFeGFtcGxlICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAy Nw0KICAgICAgIEludGVsbGVjdHVhbCBQcm9wZXJ0eSBhbmQgQ29weXJpZ2h0IFN0YXRlbWVudHMg LiAuIC4gLiAuIC4gLiAuIDI4DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAg ICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNSwgMjAwNSAgICAgICAgICAgICAgICAgIFtQYWdlIDJd DQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAg ICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQoxLiAgSW50cm9kdWN0aW9uDQoNCiAgIFRoZSBHU1Mt QVBJIFtSRkMyNzQzXSBwcm92aWRlcyBhIGdlbmVyaWMgaW50ZXJmYWNlIHdoaWNoIGNhbiBiZQ0K ICAgbGF5ZXJlZCBhdG9wIGRpZmZlcmVudCBzZWN1cml0eSBtZWNoYW5pc21zIHN1Y2ggdGhhdCBp ZiBjb21tdW5pY2F0aW5nDQogICBwZWVycyBhY3F1aXJlIEdTUy1BUEkgY3JlZGVudGlhbHMgZm9y IHRoZSBzYW1lIHNlY3VyaXR5IG1lY2hhbmlzbSwNCiAgIHRoZW4gYSBzZWN1cml0eSBjb250ZXh0 IG1heSBiZSBlc3RhYmxpc2hlZCBiZXR3ZWVuIHRoZW0gKHN1YmplY3QgdG8NCiAgIHBvbGljeSku ICBIb3dldmVyLCBHU1MtQVBJIGRvZXMgbm90IHByZXNjcmliZSB0aGUgbWV0aG9kIGJ5IHdoaWNo DQogICBHU1MtQVBJIHBlZXJzIGNhbiBlc3RhYmxpc2ggd2hldGhlciB0aGV5IGhhdmUgYSBjb21t b24gc2VjdXJpdHkNCiAgIG1lY2hhbmlzbS4NCg0KICAgVGhlIFNpbXBsZSBhbmQgUHJvdGVjdGVk IEdTUy1BUEkgTmVnb3RpYXRpb24gKFNQTkVHTykgbWVjaGFuaXNtDQogICBkZWZpbmVkIGhlcmUg aXMgYSBwc2V1ZG8gc2VjdXJpdHkgbWVjaGFuaXNtLCByZXByZXNlbnRlZCBieSB0aGUNCiAgIE9i amVjdCBJZGVudGlmaWVyIGlzby5vcmcuZG9kLmludGVybmV0LnNlY3VyaXR5Lm1lY2hhbmlzbS5z bmVnbw0KICAgKDEuMy42LjEuNS41LjIpLCB3aGljaCBlbmFibGVzIEdTUy1BUEkgcGVlcnMgdG8g ZGV0ZXJtaW5lIGluLWJhbmQNCiAgIHdoZXRoZXIgdGhlaXIgY3JlZGVudGlhbHMgc3VwcG9ydCBh IGNvbW1vbiBzZXQgb2Ygb25lIG9yIG1vcmUgR1NTLUFQSQ0KICAgc2VjdXJpdHkgbWVjaGFuaXNt cywgYW5kIGlmIHNvLCB0byBpbnZva2UgdGhlIG5vcm1hbCBzZWN1cml0eSBjb250ZXh0DQogICBl c3RhYmxpc2htZW50IGZvciBhIHNlbGVjdGVkIGNvbW1vbiBzZWN1cml0eSBtZWNoYW5pc20uICBU aGlzIGlzIG1vc3QNCiAgIHVzZWZ1bCBmb3IgYXBwbGljYXRpb25zIHdoaWNoIGRlcGVuZCBvbiBH U1MtQVBJIGltcGxlbWVudGF0aW9ucyBhbmQNCiAgIHNoYXJlIG11bHRpcGxlIG1lY2hhbmlzbXMg YmV0d2VlbiB0aGUgcGVlcnMuDQoNCiAgIFRoZSBTUE5FR08gbWVjaGFuaXNtIG5lZ290aWF0aW9u IGlzIGJhc2VkIG9uIHRoZSBmb2xsb3dpbmcgbW9kZWw6IHRoZQ0KICAgaW5pdGlhdG9yIHByb3Bv c2VzIGEgbGlzdCBvZiBzZWN1cml0eSBtZWNoYW5pc20ocyksIGluIGRlY3JlYXNpbmcNCiAgIHBy ZWZlcmVuY2Ugb3JkZXIgKGZhdm9yaXRlIGNob2ljZSBmaXJzdCksIHRoZSBhY2NlcHRvciAoYWxz byBrbm93biBhcw0KICAgdGhlIHRhcmdldCkgZWl0aGVyIGFjY2VwdHMgdGhlIGluaXRpYXRvcidz IHByZWZlcnJlZCBzZWN1cml0eQ0KICAgbWVjaGFuaXNtICh0aGUgZmlyc3QgaW4gdGhlIGxpc3Qp LCBvciBjaG9vc2VzIG9uZSB0aGF0IGlzIGF2YWlsYWJsZQ0KICAgZnJvbSB0aGUgb2ZmZXJlZCBs aXN0LCBvciByZWplY3RzIHRoZSBwcm9wb3NlZCB2YWx1ZShzKS4gIFRoZSB0YXJnZXQNCiAgIHRo ZW4gaW5mb3JtcyB0aGUgaW5pdGlhdG9yIG9mIGl0cyBjaG9pY2UuDQoNCiAgIE9uY2UgYSBjb21t b24gc2VjdXJpdHkgbWVjaGFuaXNtIGlzIGNob3NlbiwgbWVjaGFuaXNtLXNwZWNpZmljDQogICBv cHRpb25zIE1BWSBiZSBuZWdvdGlhdGVkIGFzIHBhcnQgb2YgdGhlIHNlbGVjdGVkIG1lY2hhbmlz bSdzIGNvbnRleHQNCiAgIGVzdGFibGlzaG1lbnQuICBUaGVzZSBuZWdvdGlhdGlvbnMgKGlmIGFu eSkgYXJlIGludGVybmFsIHRvIHRoZQ0KICAgbWVjaGFuaXNtIGFuZCBvcGFxdWUgdG8gdGhlIFNQ TkVHTyBwcm90b2NvbC4gIEFzIHN1Y2ggdGhleSBhcmUNCiAgIG91dHNpZGUgdGhlIHNjb3BlIG9m IHRoaXMgZG9jdW1lbnQuDQoNCiAgIElmIHBlci1tZXNzYWdlIGludGVncml0eSBzZXJ2aWNlcyBh cmUgYXZhaWxhYmxlIG9uIHRoZSBlc3RhYmxpc2hlZA0KICAgbWVjaGFuaXNtIHNlY3VyaXR5IGNv bnRleHQsIHRoZW4gdGhlIG5lZ290aWF0aW9uIGlzIHByb3RlY3RlZCB0bw0KICAgZW5zdXJlIHRo YXQgdGhlIG1lY2hhbmlzbSBsaXN0IGhhcyBub3QgYmVlbiBtb2RpZmllZC4gIEluIGNhc2VzIHdo ZXJlDQogICBhbiBhdHRhY2tlciBjb3VsZCBoYXZlIG1hdGVyaWFsbHkgaW5mbHVlbmNlZCB0aGUg bmVnb3RpYXRpb24sIHBlZXJzDQogICBleGNoYW5nZSBtZXNzYWdlIGludGVncml0eSBjb2RlIChN SUMpIHRva2VucyB0byBjb25maXJtIHRoZSBtZWNoYW5pc20NCiAgIGxpc3QgaGFzIG5vdCBiZWVu IG1vZGlmaWVkLiAgSWYgbm8gYWN0aW9uIG9mIGFuIGF0dGFja2VyIGNvdWxkIGhhdmUNCiAgIG1h dGVyaWFsbHkgbW9kaWZpZWQgdGhlIG91dGNvbWUgb2YgdGhlIG5lZ290aWF0aW9uLCB0aGUgZXhj aGFuZ2Ugb2YNCiAgIE1JQyB0b2tlbnMgaXMgb3B0aW9uYWwgKHNlZSBTZWN0aW9uIDUpLiAgQWxs b3dpbmcgTUlDIHRva2VucyB0byBiZQ0KICAgb3B0aW9uYWwgaW4gdGhpcyBjYXNlIHByb3ZpZGVz IGludGVyb3BlcmFiaWxpdHkgd2l0aCBleGlzdGluZw0KICAgaW1wbGVtZW50YXRpb25zIHdoaWxl IHN0aWxsIHByb3RlY3RpbmcgdGhlIG5lZ290aWF0aW9uLiAgVGhpcw0KICAgaW50ZXJvcGVyYWJp bGl0eSBjb21lcyBhdCB0aGUgY29zdCBvZiBpbmNyZWFzZWQgY29tcGxleGl0eS4NCg0KICAgSW4g b3JkZXIgdG8gYXZvaWQgYW4gZXh0cmEgcm91bmQgdHJpcCwgdGhlIGZpcnN0IGNvbnRleHQNCiAg IGVzdGFibGlzaG1lbnQgdG9rZW4gb2YgdGhlIGluaXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5p c20gU0hPVUxEIGJlDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5l IDE1LCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgM10NCgwNCkludGVybmV0LURyYWZ0ICAg ICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0K DQoNCiAgIGVtYmVkZGVkIGluIHRoZSBpbml0aWFsIG5lZ290aWF0aW9uIG1lc3NhZ2UgKGFzIGRl ZmluZWQgaW4gU2VjdGlvbg0KICAgNC4yKS4gIChUaGlzIG1lY2hhbmlzbSB0b2tlbiBpcyByZWZl cnJlZCB0byBhcyB0aGUgb3B0aW1pc3RpYw0KICAgbWVjaGFuaXNtIHRva2VuIGluIHRoaXMgZG9j dW1lbnQuKSBJbiBhZGRpdGlvbiwgdXNpbmcgdGhlIG9wdGltaXN0aWMNCiAgIG1lY2hhbmlzbSB0 b2tlbiBhbGxvd3MgdGhlIGluaXRpYXRvciB0byByZWNvdmVyIGZyb20gbm9uLWZhdGFsIGVycm9y cw0KICAgZW5jb3VudGVyZWQgdHJ5aW5nIHRvIHByb2R1Y2UgdGhlIGZpcnN0IG1lY2hhbmlzbSB0 b2tlbiBiZWZvcmUgYQ0KICAgbWVjaGFuaXNtIGNhbiBiZSBzZWxlY3RlZC4gIEltcGxlbWVudGF0 aW9ucyBNQVkgb21pdCB0aGUgb3B0aW1pc3RpYw0KICAgbWVjaGFuaXNtIHRva2VuIGluIGNhc2Vz IHdoZXJlIHRoZSBsaWtlbGlob29kIG9mIHRoZSBpbml0aWF0b3Incw0KICAgcHJlZmVycmVkIG1l Y2hhbmlzbSBub3QgYmVpbmcgc2VsZWN0ZWQgYnkgdGhlIGFjY2VwdG9yIGlzIHNpZ25pZmljYW50 DQogICBnaXZlbiB0aGUgY29zdCBvZiBnZW5lcmF0aW5nIGl0Lg0KDQogICBTUE5FR08gcmVsaWVz IG9uIHRoZSBjb25jZXB0cyBkZXZlbG9wZWQgaW4gdGhlIEdTUy1BUEkgc3BlY2lmaWNhdGlvbg0K ICAgW1JGQzI3NDNdLiAgVGhlIG5lZ290aWF0aW9uIGRhdGEgaXMgZW5jYXBzdWxhdGVkIGluIGNv bnRleHQtbGV2ZWwNCiAgIHRva2Vucy4gIFRoZXJlZm9yZSwgY2FsbGVycyBvZiB0aGUgR1NTLUFQ SSBkbyBub3QgbmVlZCB0byBiZSBhd2FyZSBvZg0KICAgdGhlIGV4aXN0ZW5jZSBvZiB0aGUgbmVn b3RpYXRpb24gdG9rZW5zIGJ1dCBvbmx5IG9mIHRoZSBuZXcNCiAgIHBzZXVkby1zZWN1cml0eSBt ZWNoYW5pc20uICBBIGZhaWx1cmUgaW4gdGhlIG5lZ290aWF0aW9uIHBoYXNlIGNhdXNlcw0KICAg YSBtYWpvciBzdGF0dXMgY29kZSB0byBiZSByZXR1cm5lZDogR1NTX1NfQkFEX01FQ0guDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNSwgMjAwNSAg ICAgICAgICAgICAgICAgIFtQYWdlIDRdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJ IE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQoyLiAgQ29u dmVudGlvbnMgVXNlZCBpbiBUaGlzIERvY3VtZW50DQoNCiAgIFRoZSBrZXkgd29yZHMgIk1VU1Qi LCAiTVVTVCBOT1QiLCAiUkVRVUlSRUQiLCAiU0hBTEwiLCAiU0hBTEwgTk9UIiwNCiAgICJTSE9V TEQiLCAiU0hPVUxEIE5PVCIsICJSRUNPTU1FTkRFRCIsICJNQVkiLCBhbmQgIk9QVElPTkFMIiBp biB0aGlzDQogICBkb2N1bWVudCBhcmUgdG8gYmUgaW50ZXJwcmV0ZWQgYXMgZGVzY3JpYmVkIGlu IFtSRkMyMTE5XS4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBh bC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNSwgMjAwNSAgICAgICAgICAgICAgICAgIFtQ YWdlIDVdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hh bmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQozLiAgTmVnb3RpYXRpb24gUHJvdG9jb2wN Cg0KICAgV2hlbiB0aGUgZXN0YWJsaXNoZWQgbWVjaGFuaXNtIGNvbnRleHQgcHJvdmlkZXMgaW50 ZWdyaXR5IHByb3RlY3Rpb24sDQogICB0aGUgbWVjaGFuaXNtIG5lZ290aWF0aW9uIGNhbiBiZSBw cm90ZWN0ZWQuICBXaGVuIGFjcXVpcmluZw0KICAgbmVnb3RpYXRlZCBzZWN1cml0eSBtZWNoYW5p c20gdG9rZW5zLCBwZXItbWVzc2FnZSBpbnRlZ3JpdHkgc2VydmljZXMNCiAgIGFyZSBhbHdheXMg cmVxdWVzdGVkIGJ5IHRoZSBTUE5FR08gbWVjaGFuaXNtLg0KDQogICBXaGVuIHRoZSBlc3RhYmxp c2hlZCBtZWNoYW5pc20gY29udGV4dCBzdXBwb3J0cyBwZXItbWVzc2FnZSBpbnRlZ3JpdHkNCiAg IHNlcnZpY2VzLCBTUE5FR08gZ3VhcmFudGVlcyB0aGF0IHRoZSBzZWxlY3RlZCBtZWNoYW5pc20g aXMgbXV0dWFsbHkNCiAgIHByZWZlcnJlZC4NCg0KICAgVGhpcyBzZWN0aW9uIGRlc2NyaWJlcyB0 aGUgbmVnb3RpYXRpb24gcHJvY2VzcyBvZiB0aGlzIHByb3RvY29sLg0KDQozLjEgIE5lZ290aWF0 aW9uIERlc2NyaXB0aW9uDQoNCiAgIFRoZSBmaXJzdCBuZWdvdGlhdGlvbiB0b2tlbiBzZW50IGJ5 IHRoZSBpbml0aWF0b3IgY29udGFpbnMgYW4gb3JkZXJlZA0KICAgbGlzdCBvZiBtZWNoYW5pc21z IGluIGRlY3JlYXNpbmcgcHJlZmVyZW5jZSBvcmRlciAoZmF2b3JpdGUgbWVjaGFuaXNtDQogICBm aXJzdCksIGFuZCBvcHRpb25hbGx5IHRoZSBpbml0aWFsIG1lY2hhbmlzbSB0b2tlbiBmb3IgdGhl IHByZWZlcnJlZA0KICAgbWVjaGFuaXNtIG9mIHRoZSBpbml0aWF0b3IgKGkuZS4sIHRoZSBmaXJz dCBpbiB0aGUgbGlzdCkuICAoTm90ZSB0aGF0DQogICB0aGUgbGlzdCBNVVNUIE5PVCBjb250YWlu IG1lY2hhbmlzbXMgZm9yIHdoaWNoIHRoZSBjbGllbnQgZG9lcyBub3QNCiAgIGhhdmUgYXBwcm9w cmlhdGUgY3JlZGVudGlhbHMuKQ0KDQogICBUaGUgdGFyZ2V0IHRoZW4gcHJvY2Vzc2VzIHRoZSB0 b2tlbiBmcm9tIHRoZSBpbml0aWF0b3IuICBUaGlzIHdpbGwNCiAgIHJlc3VsdCBpbiBvbmUgb2Yg Zm91ciBwb3NzaWJsZSBzdGF0ZXMgKGFzIGRlZmluZWQgaW4gU2VjdGlvbiA0LjIuMikNCiAgIGJl aW5nIHJldHVybmVkIGluIHRoZSByZXBseSBtZXNzYWdlOiBhY2NlcHRfY29tcGxldGVkLA0KICAg YWNjZXB0X2luY29tcGxldGUsIHJlamVjdCwgb3IgcmVxdWVzdF9taWMuICBBIHJlamVjdCBzdGF0 ZSB3aWxsDQogICB0ZXJtaW5hdGUgdGhlIG5lZ290aWF0aW9uOyAgYW4gYWNjZXB0X2NvbXBsZXRl ZCBzdGF0ZSBpbmRpY2F0ZXMgdGhhdA0KICAgbm90IG9ubHkgd2FzIHRoZSBpbml0aWF0b3Itc2Vs ZWN0ZWQgbWVjaGFuaXNtIGFjY2VwdGFibGUgdG8gdGhlDQogICB0YXJnZXQsIGJ1dCBhbHNvIHRo YXQgdGhlIG9wdGltaXN0aWMgbWVjaGFuaXNtIHRva2VuIHdhcyBzdWZmaWNpZW50DQogICB0byBj b21wbGV0ZSB0aGUgYXV0aGVudGljYXRpb247ICBhbiBhY2NlcHRfaW5jb21wbGV0ZSBzdGF0ZSBp bmRpY2F0ZXMNCiAgIHRoYXQgZnVydGhlciBtZXNzYWdlIGV4Y2hhbmdlIGlzIG5lZWRlZCBidXQg dGhlIE1JQyB0b2tlbiBleGNoYW5nZSBhcw0KICAgZGVzY3JpYmVkIGluIFNlY3Rpb24gNSBpcyBP UFRJT05BTDsgIGEgcmVxdWVzdF9taWMgc3RhdGUgKHRoaXMgc3RhdGUNCiAgIGNhbiBvbmx5IGJl IHByZXNlbnQgaW4gdGhlIGZpcnN0IHJlcGx5IG1lc3NhZ2UgZnJvbSB0aGUgdGFyZ2V0KQ0KICAg aW5kaWNhdGVzIHRoZSBNSUMgdG9rZW4gZXhjaGFuZ2UgaXMgUkVRVUlSRUQgaWYgcGVyLW1lc3Nh Z2UgaW50ZWdyaXR5DQogICBzZXJ2aWNlcyBhcmUgYXZhaWxhYmxlLg0KDQogICBVbmxlc3MgdGhl IHByZWZlcmVuY2Ugb3JkZXIgaXMgc3BlY2lmaWVkIGJ5IHRoZSBhcHBsaWNhdGlvbiwgdGhlDQog ICBwb2xpY3kgYnkgd2hpY2ggdGhlIHRhcmdldCBjaG9vc2VzIGEgbWVjaGFuaXNtIGlzIGFuDQog ICBpbXBsZW1lbnRhdGlvbi1zcGVjaWZpYyBsb2NhbCBtYXR0ZXIuICBJbiB0aGUgYWJzZW5jZSBv ZiBhbg0KICAgYXBwbGljYXRpb24gc3BlY2lmaWVkIHByZWZlcmVuY2Ugb3JkZXIgb3Igb3RoZXIg cG9saWN5LCB0aGUgdGFyZ2V0DQogICBTSEFMTCBjaG9vc2UgdGhlIGZpcnN0IG1lY2hhbmlzbSBp biB0aGUgaW5pdGlhdG9yIHByb3Bvc2VkIGxpc3QgZm9yDQogICB3aGljaCBpdCBoYXMgdmFsaWQg Y3JlZGVudGlhbHMuDQoNCiAgIEluIGNhc2Ugb2YgYSBzdWNjZXNzZnVsIG5lZ290aWF0aW9uLCB0 aGUgc2VjdXJpdHkgbWVjaGFuaXNtIGluIHRoZQ0KICAgZmlyc3QgcmVwbHkgbWVzc2FnZSByZXBy ZXNlbnRzIHRoZSB2YWx1ZSBzdWl0YWJsZSBmb3IgdGhlIHRhcmdldCwNCiAgIGNob3NlbiBmcm9t IHRoZSBsaXN0IG9mZmVyZWQgYnkgdGhlIGluaXRpYXRvci4NCg0KICAgSW4gY2FzZSBvZiBhbiB1 bnN1Y2Nlc3NmdWwgbmVnb3RpYXRpb24sIHRoZSByZWplY3Qgc3RhdGUgaXMgcmV0dXJuZWQNCg0K DQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTUsIDIwMDUgICAgICAg ICAgICAgICAgICBbUGFnZSA2XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdv dGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAgYW5kIGl0IGlz IE9QVElPTkFMIHRvIGVtaXQgYSBjb250ZXh0IGxldmVsIG5lZ290aWF0aW9uIHRva2VuLg0KDQog ICBPbmNlIGEgbWVjaGFuaXNtIGhhcyBiZWVuIHNlbGVjdGVkLCBjb250ZXh0IGVzdGFibGlzaG1l bnQgdG9rZW5zDQogICBzcGVjaWZpYyB0byB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtIGFyZSBjYXJy aWVkIHdpdGhpbiB0aGUgbmVnb3RpYXRpb24NCiAgIHRva2Vucy4NCg0KICAgTGFzdGx5LCBNSUMg dG9rZW5zIG1heSBiZSBleGNoYW5nZWQgdG8gZW5zdXJlIHRoZSBhdXRoZW50aWNpdHkgb2YgdGhl DQogICBtZWNoYW5pc20gbGlzdCByZWNlaXZlZCBieSB0aGUgdGFyZ2V0Lg0KDQogICBUbyBhdm9p ZCBjb25mbGljdHMgd2l0aCB0aGUgdXNlIG9mIE1JQyB0b2tlbnMgYnkgU1BORUdPLA0KICAgcGFy dGlhbGx5LWVzdGFibGlzaGVkIGNvbnRleHRzIE1VU1QgTk9UIGJlIHVzZWQgZm9yIHBlci1tZXNz YWdlDQogICBjYWxscy4gIFRvIGd1YXJhbnRlZSB0aGlzLCB0aGUgcHJvdF9yZWFkeV9zdGF0ZSBb UkZDMjc0M10gTVVTVCBiZSBzZXQNCiAgIHRvIGZhbHNlIG9uIHJldHVybiBmcm9tIEdTU19Jbml0 X3NlY19jb250ZXh0KCkgYW5kDQogICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgZXZlbiBpZiB0 aGUgdW5kZXJseWluZyBtZWNoYW5pc20gcmV0dXJuZWQNCiAgIHRydWUuDQoNCjMuMiAgTmVnb3Rp YXRpb24gUHJvY2VkdXJlDQoNCiAgIFRoZSBiYXNpYyBmb3JtIG9mIHRoZSBwcm9jZWR1cmUgYXNz dW1lcyB0aGF0IHBlci1tZXNzYWdlIGludGVncml0eQ0KICAgc2VydmljZXMgYXJlIGF2YWlsYWJs ZSBvbiB0aGUgZXN0YWJsaXNoZWQgbWVjaGFuaXNtIGNvbnRleHQsIGFuZCBpdA0KICAgaXMgc3Vt bWFyaXplZCBhcyBmb2xsb3dzOg0KDQogICAoYSkgVGhlIEdTUy1BUEkgaW5pdGlhdG9yIGludm9r ZXMgR1NTX0luaXRfc2VjX2NvbnRleHQoKSBhcyBub3JtYWwsDQogICAgICBidXQgcmVxdWVzdHMg dGhhdCBTUE5FR08gYmUgdXNlZC4gIFNQTkVHTyBjYW4gZWl0aGVyIGJlIGV4cGxpY2l0eQ0KICAg ICAgcmVxdWVzdGVkIG9yIGFjY2VwdGVkIGFzIHRoZSBkZWZhdWx0IG1lY2hhbmlzbS4NCg0KICAg KGIpIFRoZSBpbml0aWF0b3IgR1NTLUFQSSBpbXBsZW1lbnRhdGlvbiBlbWl0cyBhIG5lZ290aWF0 aW9uIHRva2VuDQogICAgICBjb250YWluaW5nIGEgbGlzdCBvZiBvbmUgb3IgbW9yZSBzZWN1cml0 eSBtZWNoYW5pc21zIHRoYXQgYXJlDQogICAgICBhdmFpbGFibGUgYmFzZWQgb24gdGhlIGNyZWRl bnRpYWxzIHVzZWQgZm9yIHRoaXMgY29udGV4dA0KICAgICAgZXN0YWJsaXNobWVudCwgYW5kIG9w dGlvbmFsbHkgdGhlIGluaXRpYWwgbWVjaGFuaXNtIHRva2VuIGZvciB0aGUNCiAgICAgIGZpcnN0 IG1lY2hhbmlzbSBpbiB0aGUgbGlzdC4NCg0KICAgKGMpIFRoZSBHU1MtQVBJIGluaXRpYXRvciBh cHBsaWNhdGlvbiBzZW5kcyB0aGUgdG9rZW4gdG8gdGhlIHRhcmdldA0KICAgICAgYXBwbGljYXRp b24uICBUaGUgR1NTLUFQSSB0YXJnZXQgYXBwbGljYXRpb24gZGVwb3NpdHMgdGhlIHRva2VuIGJ5 DQogICAgICBpbnZva2luZyBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkuICBUaGUgYWNjZXB0b3Ig d2lsbCBkbyBvbmUgb2YNCiAgICAgIHRoZSBmb2xsb3dpbmc6DQoNCg0KICAgICAgICAgKEkpIElm IG5vbmUgb2YgdGhlIHByb3Bvc2VkIG1lY2hhbmlzbXMgYXJlIGFjY2VwdGFibGUsIHRoZQ0KICAg ICAgICAgICAgbmVnb3RpYXRpb24gU0hBTEwgYmUgdGVybWluYXRlZC4gIEdTU19BY2NlcHRfc2Vj X2NvbnRleHQNCiAgICAgICAgICAgIGluZGljYXRlcyBHU1NfU19CQURfTUVDSC4gIFRoZSBhY2Nl cHRvciBNQVkgb3V0cHV0IGENCiAgICAgICAgICAgIG5lZ290aWF0aW9uIHRva2VuIGNvbnRhaW5p bmcgYSByZWplY3Qgc3RhdGUuDQoNCiAgICAgICAgIChJSSkgSWYgZWl0aGVyIHRoZSBpbml0aWF0 b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNtIGlzIG5vdA0KICAgICAgICAgICAgYWNjZXB0ZWQgYnkg dGhlIHRhcmdldCBvciB0aGlzIG1lY2hhbmlzbSBpcyBhY2NlcHRlZCBidXQgaXQNCiAgICAgICAg ICAgIGlzIG5vdCB0aGUgYWNjZXB0b3IncyBtb3N0IHByZWZlcnJlZCBtZWNoYW5pc20gKGkuZS4s IHRoZQ0KICAgICAgICAgICAgTUlDIHRva2VuIGV4Y2hhbmdlIGFzIGRlc2NyaWJlZCBpbiBTZWN0 aW9uIDUgaXMgcmVxdWlyZWQpLA0KICAgICAgICAgICAgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgp IGluZGljYXRlcyBHU1NfU19DT05USU5VRV9ORUVERUQuDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAg ICAgICAgICAgRXhwaXJlcyBKdW5lIDE1LCAyMDA1ICAgICAgICAgICAgICAgICAgW1BhZ2UgN10N CgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAg ICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCiAgICAgICAgICAgIFRoZSBhY2NlcHRvciBNVVNUIG91 dHB1dCBhIG5lZ290aWF0aW9uIHRva2VuIGNvbnRhaW5pbmcgYQ0KICAgICAgICAgICAgcmVxdWVz dF9taWMgc3RhdGUuDQoNCiAgICAgICAgIChJSUkpIE90aGVyd2lzZSBpZiBhdCBsZWFzdCBvbmUg YWRkaXRpb25hbCBuZWdvdGlhdGlvbiB0b2tlbg0KICAgICAgICAgICAgZnJvbSB0aGUgaW5pdGlh dG9yIGlzIG5lZWRlZCB0byBlc3RhYmxpc2ggdGhpcyBjb250ZXh0LA0KICAgICAgICAgICAgR1NT X0FjY2VwdF9zZWNfY29udGV4dCgpIGluZGljYXRlcyBHU1NfU19DT05USU5VRV9ORUVERUQgYW5k DQogICAgICAgICAgICBvdXRwdXRzIGEgbmVnb3RpYXRpb24gdG9rZW4gY29udGFpbmluZyBhbiBh Y2NlcHRfaW5jb21wbGV0ZQ0KICAgICAgICAgICAgc3RhdGUuDQoNCiAgICAgICAgIChJVikgT3Ro ZXJ3aXNlIG5vIGFkZGl0aW9uYWwgbmVnb3RpYXRpb24gdG9rZW4gZnJvbSB0aGUNCiAgICAgICAg ICAgIGluaXRpYXRvciBpcyBuZWVkZWQgdG8gZXN0YWJsaXNoIHRoaXMgY29udGV4dCwNCiAgICAg ICAgICAgIEdTU19BY2NlcHRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfQ09NUExFVEUg YW5kDQogICAgICAgICAgICBvdXRwdXRzIGEgbmVnb3RpYXRpb24gdG9rZW4gY29udGFpbmluZyBh biBhY2NlcHRfY29tcGxldGUNCiAgICAgICAgICAgIHN0YXRlLg0KDQogICAgICBJZiB0aGUgaW5p dGlhdG9yJ3MgcHJlZmVycmVkIG1lY2hhbmlzbSBpcyBhY2NlcHRlZCwgYW5kIGFuDQogICAgICBv cHRpbWlzdGljIG1lY2hhbmlzbSB0b2tlbiB3YXMgaW5jbHVkZWQsIHRoaXMgbWVjaGFuaXNtIHRv a2VuIE1VU1QNCiAgICAgIGJlIGRlcG9zaXRlZCB0byB0aGUgc2VsZWN0ZWQgbWVjaGFuaXNtIGJ5 IGludm9raW5nDQogICAgICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgYW5kIGlmIGEgcmVzcG9u c2UgbWVjaGFuaXNtIHRva2VuIGlzDQogICAgICBlbWl0dGVkLCBpdCBNVVNUIGJlIGluY2x1ZGVk IGluIHRoZSByZXNwb25zZSBuZWdvdGlhdGlvbiB0b2tlbi4NCiAgICAgIE90aGVyd2lzZSwgdGhl IHRhcmdldCB3aWxsIG5vdCBlbWl0IGEgcmVzcG9uc2UgbWVjaGFuaXNtIHRva2VuIGluDQogICAg ICB0aGUgZmlyc3QgcmVwbHkuDQoNCiAgIChkKSBUaGUgR1NTLUFQSSB0YXJnZXQgYXBwbGljYXRp b24gcmV0dXJucyB0aGUgbmVnb3RpYXRpb24gdG9rZW4gdG8NCiAgICAgIHRoZSBpbml0aWF0b3Ig YXBwbGljYXRpb24uICBUaGUgR1NTLUFQSSBpbml0aWF0b3IgYXBwbGljYXRpb24NCiAgICAgIGRl cG9zaXRzIHRoZSB0b2tlbiBieSBpbnZva2luZyBHU1NfSW5pdF9zZWNfY29udGV4dCgpLiAgVGhl DQogICAgICBzZWN1cml0eSBjb250ZXh0IGluaXRpYWxpemF0aW9uIGlzIHRoZW4gY29udGludWVk IGFjY29yZGluZyB0byB0aGUNCiAgICAgIHN0YW5kYXJkIEdTUy1BUEkgY29udmVudGlvbnMgZm9y IHRoZSBzZWxlY3RlZCBtZWNoYW5pc20sIHdoZXJlIHRoZQ0KICAgICAgdG9rZW5zIG9mIHRoZSBz ZWxlY3RlZCBtZWNoYW5pc20gYXJlIGVuY2Fwc3VsYXRlZCBpbiBuZWdvdGlhdGlvbg0KICAgICAg bWVzc2FnZXMgKHNlZSBTZWN0aW9uIDQpIHVudGlsIHRoZSBHU1NfU19DT01QTEVURSBpcyByZXR1 cm5lZCBmb3INCiAgICAgIGJvdGggdGhlIGluaXRpYXRvciBhbmQgdGhlIHRhcmdldCBieSB0aGUg c2VsZWN0ZWQgc2VjdXJpdHkNCiAgICAgIG1lY2hhbmlzbS4NCg0KICAgKGUpIE1JQyB0b2tlbnMg YXJlIHRoZW4gZWl0aGVyIHNraXBwZWQgb3IgZXhjaGFuZ2VkIGFjY29yZGluZyB0bw0KICAgICAg U2VjdGlvbiA1Lg0KDQogICBOb3RlIHRoYXQgdGhlICpfcmVxX2ZsYWcgaW5wdXQgcGFyYW1ldGVy cyBmb3IgY29udGV4dCBlc3RhYmxpc2htZW50DQogICBhcmUgcmVsYXRpdmUgdG8gdGhlIHNlbGVj dGVkIG1lY2hhbmlzbSwgYXMgYXJlIHRoZSAqX3N0YXRlIG91dHB1dA0KICAgcGFyYW1ldGVycy4g IGkuZS4sIHRoZXNlIHBhcmFtZXRlcnMgYXJlIG5vdCBhcHBsaWNhYmxlIHRvIHRoZQ0KICAgbmVn b3RpYXRpb24gcHJvY2VzcyBwZXIgc2UuDQoNCiAgIE9uIHJlY2VpcHQgb2YgYSBuZWdvdGlhdGlv biB0b2tlbiBvbiB0aGUgdGFyZ2V0IHNpZGUsIGEgR1NTLUFQSQ0KICAgaW1wbGVtZW50YXRpb24g dGhhdCBkb2VzIG5vdCBzdXBwb3J0IG5lZ290aWF0aW9uIHdvdWxkIGluZGljYXRlIHRoZQ0KICAg R1NTX1NfQkFEX01FQ0ggc3RhdHVzIGFzIGlmIGEgcGFydGljdWxhciBiYXNpYyBzZWN1cml0eSBt ZWNoYW5pc20gaGFkDQogICBiZWVuIHJlcXVlc3RlZCBhbmQgd2FzIG5vdCBzdXBwb3J0ZWQuDQoN CiAgIFdoZW4gYSBHU1MtQVBJIGNyZWRlbnRpYWwgaXMgYWNxdWlyZWQgZm9yIHRoZSBTUE5FR08g bWVjaGFuaXNtIHRoZQ0KICAgaW1wbGVtZW50YXRpb24gU0hPVUxEIHByb2R1Y2UgYSBjcmVkZW50 aWFsIGVsZW1lbnQgZm9yIHRoZSBTUE5FR08NCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAg ICBFeHBpcmVzIEp1bmUgMTUsIDIwMDUgICAgICAgICAgICAgICAgICBbUGFnZSA4XQ0KDA0KSW50 ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBE ZWNlbWJlciAyMDA0DQoNCg0KICAgbWVjaGFuaXNtIHdoaWNoIGludGVybmFsbHkgY29udGFpbnMg R1NTLUFQSSBjcmVkZW50aWFsIGVsZW1lbnRzIGZvcg0KICAgYWxsIG1lY2hhbmlzbXMgZm9yIHdo aWNoIHRoZSBwcmluY2lwYWwgaGFzIGNyZWRlbnRpYWxzIGF2YWlsYWJsZSwNCiAgIGV4Y2VwdCBm b3IgYW55IG1lY2hhbmlzbXMgd2hpY2ggYXJlIG5vdCB0byBiZSBuZWdvdGlhdGVkLCBlaXRoZXIg YXMNCiAgIHBlciBpbXBsZW1lbnRhdGlvbi0sIHNpdGUtIG9yIGFwcGxpY2F0aW9uLXNwZWNpZmlj IHBvbGljeS4gIFNlZQ0KICAgQXBwZW5kaXggQSBmb3IgaW50ZXJmYWNlcyBmb3IgZXhwcmVzc2lu ZyBhcHBsaWNhdGlvbiBwb2xpY3kuDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN ClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTUsIDIwMDUgICAgICAgICAg ICAgICAgICBbUGFnZSA5XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlh dGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KNC4gIFRva2VuIERlZmlu aXRpb25zDQoNCiAgIFRoZSB0eXBlIGRlZmluaXRpb25zIGluIHRoaXMgc2VjdGlvbiBhc3N1bWUg YW4gQVNOLjEgbW9kdWxlDQogICBkZWZpbml0aW9uIG9mIHRoZSBmb2xsb3dpbmcgZm9ybToNCg0K DQogICAgICBTUE5FR09BU05PbmVTcGVjIHsNCiAgICAgICAgICBpc28oMSkgaWRlbnRpZmllZC1v cmdhbml6YXRpb24oMykgZG9kKDYpIGludGVybmV0KDEpDQogICAgICAgICAgc2VjdXJpdHkoNSkg bWVjaGFuaXNtKDUpIHNuZWdvICgyKSBtb2R1bGVzKDQpIHNwZWMyKDIpDQogICAgICB9IERFRklO SVRJT05TIEVYUExJQ0lUIFRBR1MgOjo9IEJFR0lODQoNCiAgICAgIC0tIHJlc3Qgb2YgZGVmaW5p dGlvbnMgaGVyZQ0KDQogICAgICBFTkQNCg0KDQogICBUaGlzIHNwZWNpZmllcyB0aGF0IHRoZSB0 YWdnaW5nIGNvbnRleHQgZm9yIHRoZSBtb2R1bGUgd2lsbCBiZQ0KICAgZXhwbGljaXQgYW5kIG5v bi1hdXRvbWF0aWMuDQoNCiAgIFRoZSBlbmNvZGluZyBvZiBTUE5FR08gcHJvdG9jb2wgbWVzc2Fn ZXMgc2hhbGwgb2JleSB0aGUgRGlzdGluZ3Vpc2hlZA0KICAgRW5jb2RpbmcgUnVsZXMgKERFUikg b2YgQVNOLjEgYXMgZGVzY3JpYmVkIGluIFtYNjkwXS4NCg0KNC4xICBNZWNoYW5pc20gVHlwZXMN Cg0KICAgSW4gdGhpcyBuZWdvdGlhdGlvbiBtb2RlbCwgZWFjaCBPSUQgcmVwcmVzZW50cyBvbmUg R1NTLUFQSSBtZWNoYW5pc20NCiAgIG9yIG9uZSB2YXJpYW50IChzZWUgU2VjdGlvbiA2KSBvZiBp dCBhY2NvcmRpbmcgdG8gW1JGQzI3NDNdLg0KDQoNCiAgICAgICBNZWNoVHlwZSA6Oj0gT0JKRUNU IElERU5USUZJRVINCiAgICAgICAgICAgLS0gT0lEIHJlcHJlc2VudHMgZWFjaCBzZWN1cml0eSBt ZWNoYW5pc20gYXMgc3VnZ2VzdGVkIGJ5DQogICAgICAgICAgIC0tIFtSRkMyNzQzXQ0KDQogICAg ICAgTWVjaFR5cGVMaXN0IDo6PSBTRVFVRU5DRSBPRiBNZWNoVHlwZQ0KDQoNCjQuMiAgTmVnb3Rp YXRpb24gVG9rZW5zDQoNCiAgIFRoZSBzeW50YXggb2YgdGhlIGluaXRpYWwgbmVnb3RpYXRpb24g dG9rZW5zIGZvbGxvd3MgdGhlDQogICBpbml0aWFsQ29udGV4dFRva2VuIHN5bnRheCBkZWZpbmVk IGluIFNlY3Rpb24gMy4xIG9mIFtSRkMyNzQzXS4gIFRoZQ0KICAgU1BORUdPIHBzZXVkbyBtZWNo YW5pc20gaXMgaWRlbnRpZmllZCBieSB0aGUgT2JqZWN0IElkZW50aWZpZXINCiAgIHNwZWNpZmll ZCBpbiBTZWN0aW9uIDEuICBTdWJzZXF1ZW50IHRva2VucyBNVVNUIE5PVCBiZSBlbmNhcHN1bGF0 ZWQNCiAgIGluIHRoaXMgR1NTLUFQSSBnZW5lcmljIHRva2VuIGZyYW1pbmcuDQoNCiAgIFRoaXMg c2VjdGlvbiBzcGVjaWZpZXMgdGhlIHN5bnRheCBvZiB0aGUgaW5uZXIgdG9rZW4gZm9yIHRoZSBp bml0aWFsDQogICBtZXNzYWdlIGFuZCB0aGUgc3ludGF4IG9mIHN1YnNlcXVlbnQgY29udGV4dCBl c3RhYmxpc2htZW50IHRva2Vucy4NCg0KICAgICAgIE5lZ290aWF0aW9uVG9rZW4gOjo9IENIT0lD RSB7DQogICAgICAgICAgIG5lZ1Rva2VuSW5pdCAgICBbMF0gTmVnVG9rZW5Jbml0LA0KDQoNCg0K Wmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNSwgMjAwNSAgICAgICAgICAg ICAgICAgW1BhZ2UgMTBdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0 aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICAgICAgICAgIG5lZ1Rv a2VuUmVzcCAgICBbMV0gbmVnVG9rZW5SZXNwDQogICAgICAgfQ0KDQoNCg0KNC4yLjEgIG5lZ1Rv a2VuSW5pdA0KDQogICAgICAgTmVnVG9rZW5Jbml0IDo6PSBTRVFVRU5DRSB7DQogICAgICAgICAg IG1lY2hUeXBlcyAgICAgICBbMF0gTWVjaFR5cGVMaXN0LA0KICAgICAgICAgICByZXFGbGFncyAg ICAgICAgWzFdIENvbnRleHRGbGFncyAgT1BUSU9OQUwsDQogICAgICAgICAgICAgLS0gbWFpbnRh aW5lZCBmcm9tIFJGQyAyNDc4IGZvciBiYWNrd2FyZCBjb21wYXRpYmlsaXR5LA0KICAgICAgICAg ICAgIC0tIFJFQ09NTUVOREVEIHRvIGJlIGxlZnQgb3V0DQogICAgICAgICAgIG1lY2hUb2tlbiAg ICAgICBbMl0gT0NURVQgU1RSSU5HICBPUFRJT05BTCwNCiAgICAgICAgICAgbWVjaExpc3RNSUMg ICAgIFszXSBPQ1RFVCBTVFJJTkcgIE9QVElPTkFMLA0KICAgICAgICAgICAuLi4NCiAgICAgICB9 DQogICAgICAgQ29udGV4dEZsYWdzIDo6PSBCSVQgU1RSSU5HIHsNCiAgICAgICAgICAgZGVsZWdG bGFnICAgICAgICgwKSwNCiAgICAgICAgICAgbXV0dWFsRmxhZyAgICAgICgxKSwNCiAgICAgICAg ICAgcmVwbGF5RmxhZyAgICAgICgyKSwNCiAgICAgICAgICAgc2VxdWVuY2VGbGFnICAgICgzKSwN CiAgICAgICAgICAgYW5vbkZsYWcgICAgICAgICg0KSwNCiAgICAgICAgICAgY29uZkZsYWcgICAg ICAgICg1KSwNCiAgICAgICAgICAgaW50ZWdGbGFnICAgICAgICg2KQ0KICAgICAgIH0NCg0KICAg VGhpcyBpcyB0aGUgc3ludGF4IGZvciB0aGUgaW5uZXIgdG9rZW4gb2YgdGhlIGluaXRpYWwgbmVn b3RpYXRpb24NCiAgIG1lc3NhZ2UuDQoNCiAgIG1lY2hUeXBlcw0KDQogICAgICAgICBUaGlzIGZp ZWxkIGNvbnRhaW5zIG9uZSBvciBtb3JlIHNlY3VyaXR5IG1lY2hhbmlzbXMgYXZhaWxhYmxlDQog ICAgICAgICBmb3IgdGhlIGluaXRpYXRvciBpbiBkZWNyZWFzaW5nIHByZWZlcmVuY2Ugb3JkZXIg KGZhdm9yaXRlDQogICAgICAgICBjaG9pY2UgZmlyc3QpLg0KDQogICByZXFGbGFncw0KDQogICAg ICAgICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyB0aGUgc2VydmljZSBvcHRpb25z IHRoYXQgYXJlDQogICAgICAgICByZXF1ZXN0ZWQgdG8gZXN0YWJsaXNoIHRoZSBjb250ZXh0LiAg VGhlIGNvbnRleHQgZmxhZ3MgU0hPVUxEDQogICAgICAgICBiZSBmaWxsZWQgaW4gZnJvbSB0aGUg cmVxX2ZsYWdzIHBhcmFtZXRlciBvZg0KICAgICAgICAgR1NTX0luaXRfc2VjX2NvbnRleHQoKS4g IFRoaXMgZmllbGQgU0hBTEwgTk9UIGhhdmUgaW1wYWN0IG9uDQogICAgICAgICB0aGUgbmVnb3Rp YXRpb24uDQoNCiAgIG1lY2hUb2tlbg0KDQogICAgICAgICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50 LCBjb250YWlucyB0aGUgb3B0aW1pc3RpYyBtZWNoYW5pc20NCiAgICAgICAgIHRva2VuLg0KDQoN Cg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDE1LCAyMDA1ICAgICAg ICAgICAgICAgICBbUGFnZSAxMV0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVn b3RpYXRpb24gTWVjaGFuaXNtICAgICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCiAgIG1lY2hsaXN0 TUlDDQoNCiAgICAgICAgIFRoaXMgZmllbGQsIGlmIHByZXNlbnQsIGNvbnRhaW5zIGEgTUlDIHRv a2VuIGZvciB0aGUgbWVjaGFuaXNtDQogICAgICAgICBsaXN0IGluIHRoZSBpbml0aWFsIG5lZ290 aWF0aW9uIG1lc3NhZ2UuICBUaGlzIE1JQyB0b2tlbiBpcw0KICAgICAgICAgY29tcHV0ZWQgYWNj b3JkaW5nIHRvIFNlY3Rpb24gNS4NCg0KDQo0LjIuMiAgbmVnVG9rZW5SZXNwDQoNCiAgICAgICBO ZWdUb2tlblJlc3AgOjo9IFNFUVVFTkNFIHsNCiAgICAgICAgICAgbmVnU3RhdGUgICAgICAgWzBd IEVOVU1FUkFURUQgew0KICAgICAgICAgICAgICAgYWNjZXB0X2NvbXBsZXRlZCAgICAoMCksDQog ICAgICAgICAgICAgICBhY2NlcHRfaW5jb21wbGV0ZSAgICgxKSwNCiAgICAgICAgICAgICAgIHJl amVjdCAgICAgICAgICAgICAgKDIpLA0KICAgICAgICAgICAgICAgcmVxdWVzdF9taWMgICAgICAg ICAoMykNCiAgICAgICAgICAgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9QVElP TkFMLA0KICAgICAgICAgICAgIC0tIFJFUVVJUkVEIGluIHRoZSBmaXJzdCByZXBseSBmcm9tIHRo ZSB0YXJnZXQNCiAgICAgICAgICAgc3VwcG9ydGVkTWVjaCAgIFsxXSBNZWNoVHlwZSAgICAgIE9Q VElPTkFMLA0KICAgICAgICAgICAgIC0tIHByZXNlbnQgb25seSBpbiB0aGUgZmlyc3QgcmVwbHkg ZnJvbSB0aGUgdGFyZ2V0DQogICAgICAgICAgIHJlc3BvbnNlVG9rZW4gICBbMl0gT0NURVQgU1RS SU5HICBPUFRJT05BTCwNCiAgICAgICAgICAgbWVjaExpc3RNSUMgICAgIFszXSBPQ1RFVCBTVFJJ TkcgIE9QVElPTkFMLA0KICAgICAgICAgICAuLi4NCiAgICAgICB9DQoNCiAgIFRoaXMgaXMgdGhl IHN5bnRheCBmb3IgYWxsIHN1YnNlcXVlbnQgbmVnb3RpYXRpb24gbWVzc2FnZXMuDQoNCiAgIG5l Z1N0YXRlDQoNCiAgICAgICAgIFRoaXMgZmllbGQsIGlmIHByZXNlbnQsIGNvbnRhaW5zIHRoZSBz dGF0ZSBvZiB0aGUgbmVnb3RpYXRpb24uDQogICAgICAgICBUaGlzIGNhbiBiZToNCg0KICAgICAg ICAgYWNjZXB0X2NvbXBsZXRlZA0KDQogICAgICAgICAgICBObyBmdXJ0aGVyIG5lZ290aWF0aW9u IG1lc3NhZ2UgZnJvbSB0aGUgcGVlciBpcyBleHBlY3RlZCwNCiAgICAgICAgICAgIGFuZCB0aGUg c2VjdXJpdHkgY29udGV4dCBpcyBlc3RhYmxpc2hlZCBmb3IgdGhlIHNlbmRlci4NCg0KICAgICAg ICAgYWNjZXB0X2luY29tcGxldGUNCg0KICAgICAgICAgICAgQXQgbGVhc3Qgb25lIG1vcmUgbmVn b3RpYXRpb24gbWVzc2FnZSBmcm9tIHRoZSBwZWVyIGlzDQogICAgICAgICAgICBuZWVkZWQgdG8g ZXN0YWJsaXNoIHRoZSBzZWN1cml0eSBjb250ZXh0Lg0KDQogICAgICAgICByZWplY3QNCg0KICAg ICAgICAgICAgVGhlIHNlbmRlciB0ZXJtaW5hdGVzIHRoZSBuZWdvdGlhdGlvbi4NCg0KDQoNCg0K DQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNSwgMjAwNSAgICAg ICAgICAgICAgICAgW1BhZ2UgMTJdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5l Z290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQogICAgICAgICBy ZXF1ZXN0X21pYw0KDQogICAgICAgICAgICBUaGUgc2VuZGVyIGluZGljYXRlcyB0aGF0IHRoZSBl eGNoYW5nZSBvZiBNSUMgdG9rZW5zLCBhcw0KICAgICAgICAgICAgZGVzY3JpYmVkIGluIFNlY3Rp b24gNSwgd2lsbCBiZSBSRVFVSVJFRCBpZiBwZXItbWVzc2FnZQ0KICAgICAgICAgICAgaW50ZWdy aXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhlIG1lY2hhbmlzbSBjb250ZXh0IHRvDQog ICAgICAgICAgICBiZSBlc3RhYmxpc2hlZC4gIFRoaXMgdmFsdWUgU0hBTEwgb25seSBiZSBwcmVz ZW50IGluIHRoZQ0KICAgICAgICAgICAgZmlyc3QgcmVwbHkgZnJvbSB0aGUgdGFyZ2V0Lg0KDQog ICAgICAgICBUaGlzIGZpZWxkIGlzIFJFUVVJUkVEIGluIHRoZSBmaXJzdCByZXBseSBmcm9tIHRo ZSB0YXJnZXQsIGFuZA0KICAgICAgICAgaXQgaXMgT1BUSU9OQUwgdGhlcmVhZnRlci4gIFdoZW4g bmVnU3RhdGUgaXMgYWJzZW50IHRoZSBhY3R1YWwNCiAgICAgICAgIHN0YXRlIHNob3VsZCBiZSBp bmZlcnJlZCBmcm9tIHRoZSBzdGF0ZSBvZiB0aGUgbmVnb3RpYXRlZA0KICAgICAgICAgbWVjaGFu aXNtIGNvbnRleHQuDQoNCiAgIHN1cHBvcnRlZE1lY2gNCg0KICAgICAgICAgVGhpcyBmaWVsZCBT SEFMTCBvbmx5IGJlIHByZXNlbnQgaW4gdGhlIGZpcnN0IHJlcGx5IGZyb20gdGhlDQogICAgICAg ICB0YXJnZXQuICBJdCBNVVNUIGJlIG9uZSBvZiB0aGUgbWVjaGFuaXNtKHMpIG9mZmVyZWQgYnkg dGhlDQogICAgICAgICBpbml0aWF0b3IuDQoNCiAgIFJlc3BvbnNlVG9rZW4NCg0KICAgICAgICAg VGhpcyBmaWVsZCwgaWYgcHJlc2VudCwgY29udGFpbnMgdG9rZW5zIHNwZWNpZmljIHRvIHRoZQ0K ICAgICAgICAgbWVjaGFuaXNtIHNlbGVjdGVkLg0KDQogICBtZWNobGlzdE1JQw0KDQogICAgICAg ICBUaGlzIGZpZWxkLCBpZiBwcmVzZW50LCBjb250YWlucyBhIE1JQyB0b2tlbiBmb3IgdGhlIG1l Y2hhbmlzbQ0KICAgICAgICAgbGlzdCBpbiB0aGUgaW5pdGlhbCBuZWdvdGlhdGlvbiBtZXNzYWdl LiAgVGhpcyBNSUMgdG9rZW4gaXMNCiAgICAgICAgIGNvbXB1dGVkIGFjY29yZGluZyB0byBTZWN0 aW9uIDUuDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNClpodSwg ZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTUsIDIwMDUgICAgICAgICAgICAgICAg IFtQYWdlIDEzXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBN ZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KNS4gIFByb2Nlc3Npbmcgb2YgbWVj aExpc3RNSUMNCg0KICAgSWYgdGhlIG1lY2hhbmlzbSBzZWxlY3RlZCBieSB0aGUgbmVnb3RpYXRp b24gZG9lcyBub3Qgc3VwcG9ydA0KICAgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHRoZW4gbm8gbWVj aGxpc3RNSUMgdG9rZW4gaXMgdXNlZC4NCg0KICAgT3RoZXJ3aXNlLCBpZiB0aGUgYWNjZXB0ZWQg bWVjaGFuaXNtIGlzIHRoZSBtb3N0IHByZWZlcnJlZCBtZWNoYW5pc20NCiAgIG9mIGJvdGggdGhl IGluaXRpYXRvciBhbmQgdGhlIGFjY2VwdG9yLCB0aGVuIHRoZSBNSUMgdG9rZW4gZXhjaGFuZ2Us DQogICBhcyBkZXNjcmliZWQgbGF0ZXIgaW4gdGhpcyBzZWN0aW9uLCBpcyBPUFRJT05BTC4gIEEg bWVjaGFuaXNtIGlzIHRoZQ0KICAgYWNjZXB0b3IncyBtb3N0IHByZWZlcnJlZCBtZWNoYW5pc20g aWYgdGhlcmUgaXMgbm8gb3RoZXIgbWVjaGFuaXNtDQogICB3aGljaCwgaGFkIGl0IGJlZW4gcHJl c2VudCBpbiB0aGUgbWVjaGFuaXNtIGxpc3QsIHRoZSBhY2NlcHRvciB3b3VsZA0KICAgaGF2ZSBw cmVmZXJyZWQgb3ZlciB0aGUgYWNjZXB0ZWQgbWVjaGFuaXNtLg0KDQogICBJbiBhbGwgb3RoZXIg Y2FzZXMsIE1JQyB0b2tlbnMgTVVTVCBiZSBleGNoYW5nZWQgYWZ0ZXIgdGhlIG1lY2hhbmlzbQ0K ICAgY29udGV4dCBpcyBmdWxseSBlc3RhYmxpc2hlZC4NCg0KICAgYSkgVGhlIG1lY2hsaXN0TUlD IHRva2VuIChvciBzaW1wbHkgdGhlIE1JQyB0b2tlbikgaXMgY29tcHV0ZWQgb3Zlcg0KICAgICAg dGhlIG1lY2hhbmlzbSBsaXN0IGluIHRoZSBpbml0aWFsIG5lZ290aWF0aW9uIG1lc3NhZ2UgYnkg aW52b2tpbmcNCiAgICAgIEdTU19HZXRNSUMoKSBhcyBmb2xsb3dzOiB0aGUgaW5wdXQgY29udGV4 dF9oYW5kbGUgaXMgdGhlDQogICAgICBlc3RhYmxpc2hlZCBtZWNoYW5pc20gY29udGV4dCwgdGhl IGlucHV0IHFvcF9yZXEgaXMgMCwgYW5kIHRoZQ0KICAgICAgaW5wdXQgbWVzc2FnZSBpcyB0aGUg REVSIGVuY29kaW5nIG9mIHRoZSB2YWx1ZSBvZiB0eXBlDQogICAgICBNZWNoVHlwZUxpc3Qgd2hp Y2ggaXMgY29udGFpbmVkIGluIHRoZSAibWVjaFR5cGVzIiBmaWVsZCBvZiB0aGUNCiAgICAgIE5l Z1Rva2VuSW5pdC4gIFRoZSBpbnB1dCBtZXNzYWdlIGlzIE5PVCB0aGUgREVSIGVuY29kaW5nIG9m IHRoZQ0KICAgICAgdHlwZSAiWzBdIE1lY2hUeXBlTGlzdCIuDQoNCiAgIGIpIElmIHRoZSBzZWxl Y3RlZCBtZWNoYW5pc20gZXhjaGFuZ2VzIGFuIGV2ZW4gbnVtYmVyIG9mIG1lY2hhbmlzbQ0KICAg ICAgdG9rZW5zIChpLmUuLCB0aGUgYWNjZXB0b3Igc2VuZHMgdGhlIGxhc3QgbWVjaGFuaXNtIHRv a2VuKSwgdGhlDQogICAgICBhY2NlcHRvciBkb2VzIHRoZSBmb2xsb3dpbmcgd2hlbiBlbWl0dGlu ZyB0aGUgbmVnb3RpYXRpb24gbWVzc2FnZQ0KICAgICAgY29udGFpbmluZyB0aGUgbGFzdCBtZWNo YW5pc20gdG9rZW46IGlmIHRoZSBNSUMgdG9rZW4gZXhjaGFuZ2UgaXMNCiAgICAgIG9wdGlvbmFs LCBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgZWl0aGVyIGluZGljYXRlcyBHU1NfU19DT01QTEVU RQ0KICAgICAgYW5kIGRvZXMgbm90IGluY2x1ZGUgYSBtZWNobGlzdE1JQyB0b2tlbiwgb3IgaW5k aWNhdGVzDQogICAgICBHU1NfU19DT05USU5VRV9ORUVERUQgYW5kIGluY2x1ZGVzIGEgbWVjaGxp c3RNSUMgdG9rZW4gYW5kIGFuDQogICAgICBhY2NlcHRfaW5jb21wbGV0ZSBzdGF0ZTsgaWYgdGhl IE1JQyB0b2tlbiBleGNoYW5nZSBpcyByZXF1aXJlZCwNCiAgICAgIEdTU19BY2NlcHRfc2VjX2Nv bnRleHQoKSBpbmRpY2F0ZXMgR1NTX1NfQ09OVElOVUVfTkVFREVELCBhbmQNCiAgICAgIGluY2x1 ZGVzIGEgbWVjaGxpc3RNSUMgdG9rZW4uICBBY2NlcHRvcnMgdGhhdCB3aXNoIHRvIGJlDQogICAg ICBjb21wYXRpYmxlIHdpdGggbGVnYWN5IFdpbmRvd3MgU1BORUdPIGltcGxlbWVudGF0aW9ucyBh cyBkZXNjcmliZWQNCiAgICAgIGluIEFwcGVuZGl4IEIgc2hvdWxkIG5vdCBnZW5lcmF0ZSBhIG1l Y2hsaXN0TUlDIHRva2VuIHdoZW4gdGhlIE1JQw0KICAgICAgdG9rZW4gZXhjaGFuZ2UgaXMgbm90 IHJlcXVpcmVkLiAgVGhlIGluaXRpYXRvciB0aGVuIHByb2Nlc3NlcyB0aGUNCiAgICAgIGxhc3Qg bWVjaGFuaXNtIHRva2VuLCBhbmQgZG9lcyBvbmUgb2YgdGhlIGZvbGxvd2luZzoNCg0KICAgICAg KEkpIElmIGEgbWVjaGxpc3RNSUMgdG9rZW4gd2FzIGluY2x1ZGVkLCBhbmQgaXMgY29ycmVjdGx5 DQogICAgICAgICB2ZXJpZmllZCwgR1NTX0luaXRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMgR1NT X1NfQ09NUExFVEUuICBUaGUNCiAgICAgICAgIG91dHB1dCBuZWdvdGlhdGlvbiBtZXNzYWdlIGNv bnRhaW5zIGEgbWVjaGxpc3RNSUMgdG9rZW4sIGFuZCBhbg0KICAgICAgICAgYWNjZXB0X2NvbXBs ZXRlIHN0YXRlLiAgVGhlIGFjY2VwdG9yIE1VU1QgdGhlbiB2ZXJpZnkgdGhpcw0KICAgICAgICAg bWVjaGxpc3RNSUMgdG9rZW4uDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAg ICBFeHBpcmVzIEp1bmUgMTUsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDE0XQ0KDA0KSW50 ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBE ZWNlbWJlciAyMDA0DQoNCg0KICAgICAgKElJKSBJZiBhIG1lY2hsaXN0TUlDIHRva2VuIHdhcyBp bmNsdWRlZCBidXQgaXMgaW5jb3JyZWN0LCB0aGUNCiAgICAgICAgIG5lZ290aWF0aW9uIFNIQUxM IGJlIHRlcm1pbmF0ZWQuICBHU1NfSW5pdF9zZWNfY29udGV4dCgpDQogICAgICAgICBpbmRpY2F0 ZXMgR1NTX1NfREVGRUNUSVZFX1RPS0VOLg0KDQogICAgICAoSUlJKSBJZiBubyBtZWNobGlzdE1J QyB0b2tlbiB3YXMgaW5jbHVkZWQsIGFuZCB0aGUgTUlDIHRva2VuDQogICAgICAgICBleGNoYW5n ZSBpcyBub3QgcmVxdWlyZWQsIEdTU19Jbml0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzDQogICAg ICAgICBHU1NfU19DT01QTEVURSB3aXRoIG5vIG91dHB1dCB0b2tlbi4NCg0KICAgICAgKElWKSBJ ZiBubyBtZWNobGlzdE1JQyB0b2tlbiB3YXMgaW5jbHVkZWQsIGJ1dCB0aGUgTUlDIHRva2VuDQog ICAgICAgICBleGNoYW5nZSBpcyByZXF1aXJlZCwgdGhlIG5lZ290aWF0aW9uIFNIQUxMIGJlIHRl cm1pbmF0ZWQuDQogICAgICAgICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzIEdT U19TX0RFRkVDVElWRV9UT0tFTi4NCg0KICAgYykgSW4gdGhlIGNhc2UgdGhhdCB0aGUgY2hvc2Vu IG1lY2hhbmlzbSBleGNoYW5nZXMgYW4gb2RkIG51bWJlciBvZg0KICAgICAgbWVjaGFuaXNtIHRv a2VucyAoaS5lLiwgdGhlIGluaXRpYXRvciBzZW5kcyB0aGUgbGFzdCBtZWNoYW5pc20NCiAgICAg IHRva2VuKSwgdGhlIGluaXRpYXRvciBkb2VzIHRoZSBmb2xsb3dpbmcgd2hlbiBlbWl0dGluZyB0 aGUNCiAgICAgIG5lZ290aWF0aW9uIG1lc3NhZ2UgY29udGFpbmluZyB0aGUgbGFzdCBtZWNoYW5p c20gdG9rZW46IGlmIHRoZQ0KICAgICAgbmVnU3RhdGUgd2FzIHJlcXVlc3RfbWljIGluIHRoZSBm aXJzdCByZXBseSBmcm9tIHRoZSB0YXJnZXQsIGENCiAgICAgIG1lY2hsaXN0TUlDIHRva2VuIE1V U1QgYmUgaW5jbHVkZWQsIG90aGVyd2lzZSB0aGUgbWVjaGxpc3RNSUMNCiAgICAgIHRva2VuIGlz IE9QVElPTkFMLiAgKE5vdGUgdGhhdCB0aGUgTUlDIHRva2VuIGV4Y2hhbmdlIGlzIHJlcXVpcmVk DQogICAgICBpZiBhIG1lY2hhbmlzbSBvdGhlciB0aGFuIHRoZSBpbml0aWF0b3IncyBmaXJzdCBj aG9pY2UgaXMgY2hvc2VuLikNCiAgICAgIEluIHRoZSBjYXNlIHRoYXQgdGhlIG9wdGltaXN0aWMg bWVjaGFuaXNtIHRva2VuIGlzIHRoZSBvbmx5DQogICAgICBtZWNoYW5pc20gdG9rZW4gZm9yIHRo ZSBpbml0aWF0b3IncyBwcmVmZXJyZWQgbWVjaGFuaXNtLCB0aGUNCiAgICAgIG1lY2hsaXN0TUlD IHRva2VuIGlzIE9QVElPTkFMLiAgV2hldGhlciBvciBub3QgdGhlIG1lY2hsaXN0TUlDDQogICAg ICB0b2tlbiBpcyBpbmNsdWRlZCwgR1NTX0luaXRfc2VjX2NvbnRleHQoKSBpbmRpY2F0ZXMNCiAg ICAgIEdTU19TX0NPTlRJTlVFX05FRURFRC4gIEluaXRpYXRvcnMgdGhhdCB3aXNoIHRvIGJlIGNv bXBhdGlibGUgd2l0aA0KICAgICAgbGVnYWN5IFdpbmRvd3MgU1BORUdPIGltcGxlbWVudGF0aW9u cyBhcyBkZXNjcmliZWQgaW4gQXBwZW5kaXggQg0KICAgICAgc2hvdWxkIG5vdCBnZW5lcmF0ZSBh IG1lY2hsaXN0TUlDIHRva2VuIHdoZW4gdGhlIE1JQyB0b2tlbg0KICAgICAgZXhjaGFuZ2UgaXMg bm90IHJlcXVpcmVkLiAgVGhlIGFjY2VwdG9yIHRoZW4gcHJvY2Vzc2VzIHRoZSBsYXN0DQogICAg ICBtZWNoYW5pc20gdG9rZW4gYW5kIGRvZXMgb25lIG9mIHRoZSBmb2xsb3dpbmc6DQoNCiAgICAg IChJKSBJZiBhIG1lY2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCBhbmQgaXMgY29ycmVjdGx5 IHZlcmlmaWVkLA0KICAgICAgICAgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgpIGluZGljYXRlcyBH U1NfU19DT01QTEVURS4gIFRoZSBvdXRwdXQNCiAgICAgICAgIG5lZ290aWF0aW9uIG1lc3NhZ2Ug Y29udGFpbnMgYSBtZWNobGlzdE1JQyB0b2tlbiBhbmQgYW4NCiAgICAgICAgIGFjY2VwdF9jb21w bGV0ZSBzdGF0ZS4gIFRoZSBpbml0aWF0b3IgTVVTVCB0aGVuIHZlcmlmeSB0aGlzDQogICAgICAg ICBtZWNobGlzdE1JQyB0b2tlbi4NCg0KICAgICAgKElJKSBJZiBhIG1lY2hsaXN0TUlDIHRva2Vu IHdhcyBpbmNsdWRlZCBidXQgaXMgaW5jb3JyZWN0LCB0aGUNCiAgICAgICAgIG5lZ290aWF0aW9u IFNIQUxMIGJlIHRlcm1pbmF0ZWQuICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkNCiAgICAgICAg IGluZGljYXRlcyBHU1NfU19ERUZFQ1RJVkVfVE9LRU4uDQoNCiAgICAgIChJSUkpIElmIG5vIG1l Y2hsaXN0TUlDIHRva2VuIHdhcyBpbmNsdWRlZCBidXQgdGhlIG1lY2hsaXN0TUlDDQogICAgICAg ICB0b2tlbiBleGNoYW5nZSBpcyBub3QgcmVxdWlyZWQsIEdTU19BY2NlcHRfc2VjX2NvbnRleHQo KQ0KICAgICAgICAgaW5kaWNhdGVzIEdTU19TX0NPTVBMRVRFLiAgVGhlIG91dHB1dCBuZWdvdGlh dGlvbiBtZXNzYWdlDQogICAgICAgICBjb250YWlucyBhbiBhY2NlcHRfY29tcGxldGUgc3RhdGUu DQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTUs IDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDE1XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAg R1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0K ICAgICAgKElWKSBJbiB0aGUgY2FzZSB0aGF0IHRoZSBvcHRpbWlzdGljIG1lY2hhbmlzbSB0b2tl biBpcyBhbHNvIHRoZQ0KICAgICAgICAgbGFzdCBtZWNoYW5pc20gdG9rZW4gKHdoZW4gdGhlIGlu aXRpYXRvcidzIHByZWZlcnJlZCBtZWNoYW5pc20NCiAgICAgICAgIGlzIGFjY2VwdGVkIGJ5IHRo ZSB0YXJnZXQpIGFuZCB0aGUgdGFyZ2V0IHNlbmRzIGEgcmVxdWVzdF9taWMNCiAgICAgICAgIHN0 YXRlIGJ1dCB0aGUgaW5pdGlhdG9yIGRpZCBub3Qgc2VuZCBhIG1lY2hsaXN0TUlDIHRva2VuLCB0 aGUNCiAgICAgICAgIHRhcmdldCB0aGVuIE1VU1QgaW5jbHVkZSBhIG1lY2hsaXN0TUlDIHRva2Vu IGluIHRoYXQgZmlyc3QNCiAgICAgICAgIHJlcGx5LiAgR1NTX0FjY2VwdF9zZWNfY29udGV4dCgp IGluZGljYXRlcw0KICAgICAgICAgR1NTX1NfQ09OVElOVUVfTkVFREVELiAgVGhlIGluaXRpYXRv ciBNVVNUIHZlcmlmeSB0aGUgcmVjZWl2ZWQNCiAgICAgICAgIG1lY2hsaXN0TUlDIHRva2VuIGFu ZCBnZW5lcmF0ZSBhIG1lY2hsaXN0TUlDIHRva2VuIHRvIHNlbmQgYmFjaw0KICAgICAgICAgdG8g dGhlIHRhcmdldC4gIFRoZSB0YXJnZXQgU0hBTEwgaW4gdHVybiB2ZXJpZnkgdGhlIHJldHVybmVk DQogICAgICAgICBtZWNobGlzdE1JQyB0b2tlbiBhbmQgY29tcGxldGUgdGhlIG5lZ290aWF0aW9u Lg0KDQogICAgICAoVikgSWYgbm8gbWVjaGxpc3RNSUMgdG9rZW4gd2FzIGluY2x1ZGVkIGFuZCB0 aGUgYWNjZXB0b3Igc2VudCBhDQogICAgICAgICByZXF1ZXN0X21pYyBzdGF0ZSBpbiB0aGUgZmly c3QgcmVwbHkgbWVzc2FnZSAodGhlIGV4Y2hhbmdlIG9mDQogICAgICAgICBNSUMgdG9rZW5zIGlz IHJlcXVpcmVkKSwgdGhlIG5lZ290aWF0aW9uIFNIQUxMIGJlIHRlcm1pbmF0ZWQuDQogICAgICAg ICBHU1NfQWNjZXB0X3NlY19jb250ZXh0KCkgaW5kaWNhdGVzIEdTU19TX0RFRkVDVElWRV9UT0tF Ti4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUg MTUsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDE2XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAg ICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoN Cg0KNi4gIEV4dGVuc2liaWxpdHkNCg0KICAgVHdvIG1lY2hhbmlzbXMgYXJlIHByb3ZpZGVkIGZv ciBleHRlbnNpYmlsaXR5LiAgRmlyc3QsIHRoZSBBU04uMQ0KICAgc3RydWN0dXJlcyBpbiB0aGlz IHNwZWNpZmljYXRpb24gTUFZIGJlIGV4cGFuZGVkIGJ5IElFVEYgc3RhbmRhcmRzDQogICBhY3Rp b24uICBJbXBsZW1lbnRhdGlvbnMgcmVjZWl2aW5nIHVua25vd24gZmllbGRzIE1VU1QgaWdub3Jl IHRoZXNlDQogICBmaWVsZHMuDQoNCiAgIFNlY29uZGx5LCBPSURzIGNvcnJlc3BvbmRpbmcgdG8g YSBkZXNpcmVkIG1lY2hhbmlzbSBhdHRyaWJ1dGUgKGkuZS4sDQogICBtZWNoYW5pc20gdmFyaWFu dHMpIG1heSBiZSBpbmNsdWRlZCBpbiB0aGUgc2V0IG9mIHByZWZlcnJlZA0KICAgbWVjaGFuaXNt cyBieSBhbiBpbml0aWF0b3IuICBUaGUgYWNjZXB0b3IgY2FuIGNob29zZSB0byBob25vciB0aGlz DQogICByZXF1ZXN0IGJ5IHByZWZlcnJpbmcgbWVjaGFuaXNtcyB0aGF0IGhhdmUgdGhlIGluY2x1 ZGVkIGF0dHJpYnV0ZXMuDQogICBGdXR1cmUgd29yayB3aXRoaW4gdGhlIEtpdHRlbiB3b3JraW5n IGdyb3VwIGlzIGV4cGVjdGVkIHRvDQogICBzdGFuZGFyZGl6ZSBjb21tb24gYXR0cmlidXRlcyB0 aGF0IFNQTkVHTyBtZWNoYW5pc21zIG1heSB3aXNoIHRvDQogICBzdXBwb3J0LiAgQXQgdGhpcyB0 aW1lIGl0IGlzIHN1ZmZpY2llbnQgdG8gc2F5IHRoYXQgaW5pdGlhdG9ycyBNQVkNCiAgIGluY2x1 ZGUgT0lEcyB0aGF0IGRvIG5vdCBjb3JyZXNwb25kIHRvIG1lY2hhbmlzbXMuICBTdWNoIE9JRHMg TUFZDQogICBpbmZsdWVuY2UgdGhlIGFjY2VwdG9yJ3MgY2hvaWNlIG9mIG1lY2hhbmlzbS4gIEFz IGRpc2N1c3NlZCBpbg0KICAgU2VjdGlvbiA1LCBpZiB0aGVyZSBhcmUgbWVjaGFuaXNtcyB0aGF0 IGlmIHByZXNlbnQgaW4gdGhlIGluaXRpYXRvcidzDQogICBsaXN0IG9mIG1lY2hhbmlzbXMgbWln aHQgYmUgcHJlZmVycmVkIGJ5IHRoZSBhY2NlcHRvciB0byB0aGUNCiAgIGluaXRpYXRvcidzIHBy ZWZlcnJlZCBtZWNoYW5pc20sIHRoZSBhY2NlcHRvciBNVVNUIGRlbWFuZCB0aGUgTUlDDQogICB0 b2tlbiBleGNoYW5nZS4gIEFzIGEgY29uc2VxdWVuY2UsIGFjY2VwdG9ycyBNVVNUIGRlbWFuZCB0 aGUgTUlDDQogICB0b2tlbiBleGNoYW5nZSBpZiB0aGV5IHN1cHBvcnQgbmVnb3RpYXRpb24gb2Yg YXR0cmlidXRlcyBub3QNCiAgIGF2YWlsYWJsZSBpbiB0aGUgaW5pdGlhdG9yJ3MgcHJlZmVycmVk IG1lY2hhbmlzbSByZWdhcmRsZXNzIG9mDQogICB3aGV0aGVyIHRoZSBpbml0aWF0b3IgYWN0dWFs bHkgcmVxdWVzdGVkIHRoZXNlIGF0dHJpYnV0ZXMuDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAgICBF eHBpcmVzIEp1bmUgMTUsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdlIDE3XQ0KDA0KSW50ZXJu ZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5pc20gICAgICAgICBEZWNl bWJlciAyMDA0DQoNCg0KNy4gIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zDQoNCiAgIEluIG9yZGVy IHRvIHByb2R1Y2UgdGhlIE1JQyB0b2tlbiBmb3IgdGhlIG1lY2hhbmlzbSBsaXN0LCB0aGUNCiAg IG1lY2hhbmlzbSBtdXN0IHByb3ZpZGUgaW50ZWdyaXR5IHByb3RlY3Rpb24uICBXaGVuIHRoZSBz ZWxlY3RlZA0KICAgbWVjaGFuaXNtIGRvZXMgbm90IHN1cHBvcnQgaW50ZWdyaXR5IHByb3RlY3Rp b24sIHRoZSBuZWdvdGlhdGlvbiBpcw0KICAgdnVsbmVyYWJsZTogYW4gYWN0aXZlIGF0dGFja2Vy IGNhbiBmb3JjZSBpdCB0byB1c2UgYSBzZWN1cml0eQ0KICAgbWVjaGFuaXNtIHRoYXQgaXMgbm90 IG11dHVhbGx5IHByZWZlcnJlZCBidXQgaXMgYWNjZXB0YWJsZSB0byB0aGUNCiAgIHRhcmdldC4N Cg0KICAgVGhpcyBwcm90b2NvbCBwcm92aWRlcyB0aGUgZm9sbG93aW5nIGd1YXJhbnRlZXMgd2hl biBwZXItbWVzc2FnZQ0KICAgaW50ZWdyaXR5IHNlcnZpY2VzIGFyZSBhdmFpbGFibGUgb24gdGhl IGVzdGFibGlzaGVkIG1lY2hhbmlzbSBjb250ZXh0DQogICBhbmQgdGhlIG1lY2hhbmlzbSBsaXN0 IHdhcyBhbHRlcmVkIGJ5IGFuIGFkdmVyc2FyeSBzdWNoIHRoYXQgYQ0KICAgbWVjaGFuaXNtIHdo aWNoIGlzIG5vdCBtdXR1YWxseSBwcmVmZXJyZWQgY291bGQgYmUgc2VsZWN0ZWQ6DQoNCiAgIGEp IElmIHRoZSBsYXN0IG1lY2hhbmlzbSB0b2tlbiBpcyBzZW50IGJ5IHRoZSBpbml0aWF0b3IsIGJv dGggcGVlcnMNCiAgICAgIHNoYWxsIGZhaWw7DQogICBiKSBJZiB0aGUgbGFzdCBtZWNoYW5pc20g dG9rZW4gaXMgc2VudCBieSB0aGUgYWNjZXB0b3IsIHRoZSBhY2NlcHRvcg0KICAgICAgc2hhbGwg bm90IGNvbXBsZXRlIGFuZCB0aGUgaW5pdGlhdG9yIGF0IHdvcnN0IHNoYWxsIGNvbXBsZXRlIHdp dGgNCiAgICAgIGl0cyBwcmVmZXJyZWQgbWVjaGFuaXNtIGJlaW5nIHNlbGVjdGVkLg0KDQogICBU aGUgbmVnb3RpYXRpb24gbWF5IG5vdCBiZSB0ZXJtaW5hdGVkIGlmIGFuIGFsdGVyYXRpb24gd2Fz IG1hZGUgYnV0DQogICBpdCBoYWQgbm8gbWF0ZXJpYWwgaW1wYWN0Lg0KDQogICBUaGUgcHJvdGVj dGlvbiBvZiB0aGUgbmVnb3RpYXRpb24gZGVwZW5kcyBvbiB0aGUgc3RyZW5ndGggb2YgdGhlDQog ICBpbnRlZ3JpdHkgcHJvdGVjdGlvbi4gIEluIHBhcnRpY3VsYXIsIHRoZSBzdHJlbmd0aCBvZiBT UE5FR08gaXMgbm8NCiAgIHN0cm9uZ2VyIHRoYW4gdGhlIGludGVncml0eSBwcm90ZWN0aW9uIG9m IHRoZSB3ZWFrZXN0IG1lY2hhbmlzbQ0KICAgYWNjZXB0YWJsZSB0byBHU1MtQVBJIHBlZXJzLg0K DQogICBJbiBhbGwgY2FzZXMsIHRoZSBjb21tdW5pY2F0aW5nIHBlZXJzIGFyZSBleHBvc2VkIHRv IHRoZSBkZW5pYWwgb2YNCiAgIHNlcnZpY2UgdGhyZWF0Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVu ZSAxNSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMThdDQoMDQpJbnRlcm5ldC1EcmFmdCAg ICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQN Cg0KDQo4LiAgSUFOQSBDb25zaWRlcmF0aW9ucw0KDQogICBUaGlzIGRvY3VtZW50IGhhcyBubyBh Y3Rpb25zIGZvciBJQU5BLg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K Wmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNSwgMjAwNSAgICAgICAgICAg ICAgICAgW1BhZ2UgMTldDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0 aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQo5LiAgQWNrbm93bGVkZ21l bnRzDQoNCiAgIFRoZSBhdXRob3JzIHdpc2ggdG8gdGhhbmsgU2FtIEhhcnRtYW4sIE5pY29sYXMg V2lsbGlhbXMsIEtlbiBSYWVidXJuLA0KICAgSmVmZiBBbHRtYW4sIFRvbSBZdSwgQ3Jpc3RpYW4g SWxhYyBhbmQgTWFydGluIFJleCBmb3IgdGhlaXIgY29tbWVudHMNCiAgIGFuZCBzdWdnZXN0aW9u cyBkdXJpbmcgZGV2ZWxvcG1lbnQgb2YgdGhpcyBkb2N1bWVudC4NCg0KICAgTHVrZSBIb3dhcmQg cHJvdmlkZWQgYSBwcm90b3R5cGUgb2YgdGhpcyBwcm90b2NvbCBpbiBIZWltZGFsIGFuZA0KICAg cmVzb2x2ZWQgc2V2ZXJhbCBpc3N1ZXMgaW4gdGhlIGluaXRpYWwgZHJhZnQuDQoNCiAgIEVyaWMg QmFpemUgYW5kIERlbmlzIFBpbmthcyB3cm90ZSB0aGUgb3JpZ2luYWwgU1BORUdPIHNwZWNpZmlj YXRpb24NCiAgIFtSRkMyNDc4XSBvZiB3aGljaCBzb21lIG9mIHRoZSB0ZXh0IGhhcyBiZWVuIHJl dGFpbmVkIGluIHRoaXMNCiAgIGRvY3VtZW50Lg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBl dCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNSwgMjAwNSAgICAgICAgICAgICAgICAg W1BhZ2UgMjBdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1l Y2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQoxMC4gIFJlZmVyZW5jZXMNCg0KMTAu MSAgTm9ybWF0aXZlIFJlZmVyZW5jZXMNCg0KICAgW1JGQzIxMTldICBCcmFkbmVyLCBTLiwgIktl eSB3b3JkcyBmb3IgdXNlIGluIFJGQ3MgdG8gSW5kaWNhdGUNCiAgICAgICAgICAgICAgUmVxdWly ZW1lbnQgTGV2ZWxzIiwgQkNQIDE0LCBSRkMgMjExOSwgTWFyY2ggMTk5Ny4NCg0KICAgW1JGQzI3 NDNdICBMaW5uLCBKLiwgIkdlbmVyaWMgU2VjdXJpdHkgU2VydmljZSBBcHBsaWNhdGlvbiBQcm9n cmFtDQogICAgICAgICAgICAgIEludGVyZmFjZSBWZXJzaW9uIDIsIFVwZGF0ZSAxIiwgUkZDIDI3 NDMsIEphbnVhcnkgMjAwMC4NCg0KICAgW1g2OTBdICAgICBBU04uMSBlbmNvZGluZyBydWxlczog U3BlY2lmaWNhdGlvbiBvZiBCYXNpYyBFbmNvZGluZyANCiAgICAgICAgICAgICAgUnVsZXMgKEJF UiksIENhbm9uaWNhbCBFbmNvZGluZyBSdWxlcyAoQ0VSKSBhbmQgDQogICAgICAgICAgICAgIERp c3Rpbmd1aXNoZWQgRW5jb2RpbmcgUnVsZXMgKERFUiksIElUVS1UIFJlY29tbWVuZGF0aW9uIA0K ICAgICAgICAgICAgICBYLjY5MCAoMTk5NykgfCBJU08vSUVDIEludGVybmF0aW9uYWwgU3RhbmRh cmQgODgyNS0xOjE5OTguDQoNCjEwLjIgIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMNCg0KICAgW1JG QzI0NzhdICBCYWl6ZSwgRS4gYW5kIEQuIFBpbmthcywgIlRoZSBTaW1wbGUgYW5kIFByb3RlY3Rl ZCBHU1MtQVBJDQogICAgICAgICAgICAgIE5lZ290aWF0aW9uIE1lY2hhbmlzbSIsIFJGQyAyNDc4 LCBEZWNlbWJlciAxOTk4Lg0KDQoNCkF1dGhvcnMnIEFkZHJlc3Nlcw0KDQogICBMYXJyeSBaaHUN CiAgIE1pY3Jvc29mdCBDb3Jwb3JhdGlvbg0KICAgT25lIE1pY3Jvc29mdCBXYXkNCiAgIFJlZG1v bmQsIFdBICA5ODA1Mg0KICAgVVMNCg0KICAgRU1haWw6IGx6aHVAbWljcm9zb2Z0LmNvbQ0KDQoN CiAgIFBhdWwgTGVhY2gNCiAgIE1pY3Jvc29mdCBDb3Jwb3JhdGlvbg0KICAgT25lIE1pY3Jvc29m dCBXYXkNCiAgIFJlZG1vbmQsIFdBICA5ODA1Mg0KICAgVVMNCg0KICAgRU1haWw6IHBhdWxsZUBt aWNyb3NvZnQuY29tDQoNCg0KICAgS2FydGhpayBKYWdhbmF0aGFuDQogICBNaWNyb3NvZnQgQ29y cG9yYXRpb24NCiAgIE9uZSBNaWNyb3NvZnQgV2F5DQogICBSZWRtb25kLCBXQSAgOTgwNTINCiAg IFVTDQoNCiAgIEVNYWlsOiBrYXJ0aGlrakBtaWNyb3NvZnQuY29tDQoNCg0KDQoNClpodSwgZXQg YWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTUsIDIwMDUgICAgICAgICAgICAgICAgIFtQ YWdlIDIxXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNo YW5pc20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KICAgV3lsbHlzIEluZ2Vyc29sbA0KICAg U3VuIE1pY3Jvc3lzdGVtcw0KICAgMTc3NSBXaWVobGUgQXZlbnVlLCAybmQgRmxvb3INCiAgIFJl c3RvbiwgVkEgIDIwMTkwDQogICBVUw0KDQogICBFTWFpbDogd3lsbHlzLmluZ2Vyc29sbEBzdW4u Y29tDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAg ICAgIEV4cGlyZXMgSnVuZSAxNSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMjJdDQoMDQpJ bnRlcm5ldC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAg IERlY2VtYmVyIDIwMDQNCg0KDQpBcHBlbmRpeCBBLiAgR1NTLUFQSSBOZWdvdGlhdGlvbiBTdXBw b3J0IEFQSQ0KDQogICBJbiBvcmRlciB0byBwcm92aWRlIHRvIGEgR1NTLUFQSSBjYWxsZXIgKGVp dGhlciB0aGUgaW5pdGlhdG9yIG9yIHRoZQ0KICAgdGFyZ2V0IG9yIGJvdGgpIHRoZSBhYmlsaXR5 IHRvIGNob29zZSBhbW9uZyB0aGUgc2V0IG9mIHN1cHBvcnRlZA0KICAgbWVjaGFuaXNtcyBhIHJl ZHVjZWQgc2V0IG9mIG1lY2hhbmlzbXMgZm9yIG5lZ290aWF0aW9uLCB0d28NCiAgIGFkZGl0aW9u YWwgQVBJcyBhcmUgZGVmaW5lZDoNCg0KICAgbyAgR1NTX0dldF9uZWdfbWVjaHMoKSBpbmRpY2F0 ZXMgdGhlIHNldCBvZiBzZWN1cml0eSBtZWNoYW5pc21zDQogICAgICBhdmFpbGFibGUgb24gdGhl IGxvY2FsIHN5c3RlbSB0byB0aGUgY2FsbGVyIGZvciBuZWdvdGlhdGlvbiwgZm9yDQogICAgICB3 aGljaCBhcHByb3ByaWF0ZSBjcmVkZW50aWFscyBhcmUgYXZhaWxhYmxlLg0KICAgbyAgR1NTX1Nl dF9uZWdfbWVjaHMoKSBzcGVjaWZpZXMgdGhlIHNldCBvZiBzZWN1cml0eSBtZWNoYW5pc21zIHRv IGJlDQogICAgICB1c2VkIG9uIHRoZSBsb2NhbCBzeXN0ZW0gYnkgdGhlIGNhbGxlciBmb3IgbmVn b3RpYXRpb24sIGZvciB0aGUNCiAgICAgIGdpdmVuIGNyZWRlbnRpYWxzLg0KDQpBLjEgIEdTU19T ZXRfbmVnX21lY2hzIGNhbGwNCg0KICAgSW5wdXRzOg0KDQogICBvICBjcmVkX2hhbmRsZSBDUkVE RU5USUFMIEhBTkRMRSwgLS0gTlVMTCBzcGVjaWZpZXMgZGVmYXVsdA0KICAgICAgLS0gY3JlZGVu dGlhbHMNCiAgIG8gIG1lY2hfc2V0IFNFVCBPRiBPQkpFQ1QgSURFTlRJRklFUg0KDQogICBPdXRw dXRzOg0KDQogICBvICBtYWpvcl9zdGF0dXMgSU5URUdFUiwNCiAgIG8gIG1pbm9yX3N0YXR1cyBJ TlRFR0VSDQoNCiAgIFJldHVybiBtYWpvcl9zdGF0dXMgY29kZXM6DQoNCiAgIG8gIEdTU19TX0NP TVBMRVRFIGluZGljYXRlcyB0aGF0IHRoZSBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcw0KICAg ICAgYXZhaWxhYmxlIGZvciBuZWdvdGlhdGlvbiBoYXMgYmVlbiBzZXQgdG8gbWVjaF9zZXQuDQog ICBvICBHU1NfU19GQUlMVVJFIGluZGljYXRlcyB0aGF0IHRoZSByZXF1ZXN0ZWQgb3BlcmF0aW9u IGNvdWxkIG5vdCBiZQ0KICAgICAgcGVyZm9ybWVkIGZvciByZWFzb25zIHVuc3BlY2lmaWVkIGF0 IHRoZSBHU1MtQVBJIGxldmVsLg0KDQogICBBbGxvd3MgY2FsbGVycyB0byBzcGVjaWZ5IHRoZSBz ZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcyB0aGF0IG1heSBiZQ0KICAgbmVnb3RpYXRlZCB3aXRo IHRoZSBjcmVkZW50aWFsIGlkZW50aWZpZWQgYnkgY3JlZF9oYW5kbGUuICBUaGlzIGNhbGwNCiAg IGlzIGludGVuZGVkIGZvciBzdXBwb3J0IG9mIHNwZWNpYWxpemVkIGNhbGxlcnMgd2hvIG5lZWQg dG8gcmVzdHJpY3QNCiAgIHRoZSBzZXQgb2YgbmVnb3RpYWJsZSBzZWN1cml0eSBtZWNoYW5pc21z IGZyb20gdGhlIHNldCBvZiBhbGwNCiAgIHNlY3VyaXR5IG1lY2hhbmlzbXMgYXZhaWxhYmxlIHRv IHRoZSBjYWxsZXIgKGJhc2VkIG9uIGF2YWlsYWJsZQ0KICAgY3JlZGVudGlhbHMpLiAgTm90ZSB0 aGF0IGlmIG1vcmUgdGhhbiBvbmUgbWVjaGFuaXNtIGlzIHNwZWNpZmllZCBpbg0KICAgbWVjaF9z ZXQsIHRoZSBvcmRlciBpbiB3aGljaCB0aG9zZSBtZWNoYW5pc21zIGFyZSBzcGVjaWZpZWQgaW1w bGllcyBhDQogICByZWxhdGl2ZSBwcmVmZXJlbmNlLg0KDQpBLjIgIEdTU19HZXRfbmVnX21lY2hz IGNhbGwNCg0KICAgSW5wdXQ6DQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4 cGlyZXMgSnVuZSAxNSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMjNdDQoMDQpJbnRlcm5l dC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2Vt YmVyIDIwMDQNCg0KDQogICBvICBjcmVkX2hhbmRsZSBDUkVERU5USUFMIEhBTkRMRSAtLSBOVUxM IHNwZWNpZmllcyBkZWZhdWx0DQogICAgICAtLSBjcmVkZW50aWFscw0KDQogICBPdXRwdXRzOg0K DQogICBvICBtYWpvcl9zdGF0dXMgSU5URUdFUiwNCiAgIG8gIG1pbm9yX3N0YXR1cyBJTlRFR0VS LA0KICAgbyAgbWVjaF9zZXQgU0VUIE9GIE9CSkVDVCBJREVOVElGSUVSDQoNCiAgIFJldHVybiBt YWpvcl9zdGF0dXMgY29kZXM6DQoNCiAgIG8gIEdTU19TX0NPTVBMRVRFIGluZGljYXRlcyB0aGF0 IHRoZSBzZXQgb2Ygc2VjdXJpdHkgbWVjaGFuaXNtcw0KICAgICAgYXZhaWxhYmxlIGZvciBuZWdv dGlhdGlvbiBoYXMgYmVlbiByZXR1cm5lZCBpbiBtZWNoX3NldC4NCiAgIG8gIEdTU19TX0ZBSUxV UkUgaW5kaWNhdGVzIHRoYXQgdGhlIHJlcXVlc3RlZCBvcGVyYXRpb24gY291bGQgbm90IGJlDQog ICAgICBwZXJmb3JtZWQgZm9yIHJlYXNvbnMgdW5zcGVjaWZpZWQgYXQgdGhlIEdTUy1BUEkgbGV2 ZWwuDQoNCiAgIEFsbG93cyBjYWxsZXJzIHRvIGRldGVybWluZSB0aGUgc2V0IG9mIHNlY3VyaXR5 IG1lY2hhbmlzbXMgYXZhaWxhYmxlDQogICBmb3IgbmVnb3RpYXRpb24gd2l0aCB0aGUgY3JlZGVu dGlhbCBpZGVudGlmaWVkIGJ5IGNyZWRfaGFuZGxlLiAgVGhpcw0KICAgY2FsbCBpcyBpbnRlbmRl ZCBmb3Igc3VwcG9ydCBvZiBzcGVjaWFsaXplZCBjYWxsZXJzIHdobyBuZWVkIHRvDQogICByZWR1 Y2UgdGhlIHNldCBvZiBuZWdvdGlhYmxlIHNlY3VyaXR5IG1lY2hhbmlzbXMgZnJvbSB0aGUgc2V0 IG9mDQogICBzdXBwb3J0ZWQgc2VjdXJpdHkgbWVjaGFuaXNtcyBhdmFpbGFibGUgdG8gdGhlIGNh bGxlciAoYmFzZWQgb24NCiAgIGF2YWlsYWJsZSBjcmVkZW50aWFscykuDQoNCiAgIE5vdGU6IFRo ZSBHU1NfSW5kaWNhdGVfbWVjaHMoKSBmdW5jdGlvbiBpbmRpY2F0ZXMgdGhlIGZ1bGwgc2V0IG9m DQogICBtZWNoYW5pc20gdHlwZXMgYXZhaWxhYmxlIG9uIHRoZSBsb2NhbCBzeXN0ZW0uICBTaW5j ZSB0aGlzIGNhbGwgaGFzDQogICBubyBpbnB1dCBwYXJhbWV0ZXIsIHRoZSByZXR1cm5lZCBzZXQg aXMgbm90IG5lY2Vzc2FyaWx5IGF2YWlsYWJsZSBmb3INCiAgIGFsbCBjcmVkZW50aWFscy4NCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNClpodSwgZXQgYWwu ICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTUsIDIwMDUgICAgICAgICAgICAgICAgIFtQYWdl IDI0XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgR1NTLUFQSSBOZWdvdGlhdGlvbiBNZWNoYW5p c20gICAgICAgICBEZWNlbWJlciAyMDA0DQoNCg0KQXBwZW5kaXggQi4gIENoYW5nZXMgc2luY2Ug UkZDMjQ3OA0KDQogICAgICBTUE5FR08gaW1wbGVtZW50YXRpb25zIGluIFdpbmRvd3MgMjAwMC9X aW5kb3dzIFhQL1dpbmRvd3MgU2VydmVyDQogICAgICAyMDAzIGhhdmUgdGhlIGZvbGxvd2luZyBi ZWhhdmlvcjogbm8gbWVjaGxpc3RNSUMgaXMgcHJvZHVjZWQgYW5kDQogICAgICBtZWNobGlzdE1J QyBpcyBub3QgcHJvY2Vzc2VkIGlmIG9uZSBpcyBwcm92aWRlZDsgaWYgdGhlIGluaXRpYXRvcg0K ICAgICAgc2VuZHMgdGhlIGxhc3QgbWVjaGFuaXNtIHRva2VuLCB0aGUgYWNjZXB0b3Igd2lsbCBz ZW5kIGJhY2sgYQ0KICAgICAgbmVnb3RpYXRpb24gdG9rZW4gd2l0aCBhbiBhY2NlcHRfY29tcGxl dGUgc3RhdGUgYW5kIG5vIG1lY2hsaXN0TUlDDQogICAgICB0b2tlbi4gIEluIGFkZGl0aW9uLCBh biBpbmNvcnJlY3QgT0lEICgxLjIuODQwLjQ4MDE4LjEuMi4yKSBjYW4gYmUNCiAgICAgIHVzZWQg dG8gaWRlbnRpZnkgdGhlIEdTUy1BUEkgS2VyYmVyb3MgVmVyc2lvbiA1IG1lY2hhbmlzbS4NCg0K ICAgICAgVGhlIGZvbGxvd2luZyBjaGFuZ2VzIGhhdmUgYmVlbiBtYWRlIHRvIGJlIGNvbXBhdGli bGUgd2l0aCB0aGVzZQ0KICAgICAgbGVnYWN5IGltcGxlbWVudGF0aW9ucy4NCg0KICAgICAgKiAg TmVnVG9rZW5UYXJnIGlzIGNoYW5nZWQgdG8gbmVnVG9rZW5SZXNwIGFuZCBpdCBpcyB0aGUgbWVz c2FnZQ0KICAgICAgICAgZm9ybWF0IGZvciBhbGwgc3Vic2VxdWVudCBuZWdvdGlhdGlvbiB0b2tl bnMuDQogICAgICAqICBOZWdUb2tlbkluaXQgaXMgdGhlIG1lc3NhZ2UgZm9yIHRoZSBpbml0aWFs IG5lZ290aWF0aW9uIG1lc3NhZ2UNCiAgICAgICAgIGFuZCB0aGF0IG1lc3NhZ2Ugb25seS4NCiAg ICAgICogIG1lY2hUeXBlcyBpbiBuZWdUb2tlbkluaXQgaXMgbm90IG9wdGlvbmFsLg0KICAgICAg KiAgSWYgdGhlIHNlbGVjdGVkIG1lY2hhbmlzbSBpcyBhbHNvIHRoZSBtb3N0IHByZWZlcnJlZCBt ZWNoYW5pc20NCiAgICAgICAgIGZvciBib3RoIHBlZXJzLCBpdCBpcyBzYWZlIHRvIG9taXQgdGhl IE1JQyB0b2tlbnMuDQoNCiAgICAgIElmIGF0IGxlYXN0IG9uZSBvZiB0aGUgdHdvIHBlZXJzIGlt cGxlbWVudHMgdGhlIHVwZGF0ZWQgcHNldWRvDQogICAgICBtZWNoYW5pc20gaW4gdGhpcyBkb2N1 bWVudCwgdGhlIG5lZ290aWF0aW9uIGlzIHByb3RlY3RlZC4NCg0KICAgICAgVGhlIGZvbGxvd2lu ZyBjaGFuZ2VzIGFyZSB0byBhZGRyZXNzIHRoZSBwcm9ibGVtcyBpbiBSRkMgMjQ3OC4NCg0KICAg ICAgKiAgcmVxRmxhZ3MgaXMgbm90IHByb3RlY3RlZCB0aGVyZWZvcmUgaXQgc2hvdWxkIG5vdCBp bXBhY3QgdGhlDQogICAgICAgICBuZWdvdGlhdGlvbi4NCiAgICAgICogIERFUiBlbmNvZGluZyBp cyByZXF1aXJlZC4NCiAgICAgICogIEdTU19HZXRNSUMoKSBpbnB1dCBpcyBjbGFyaWZpZWQuDQog ICAgICAqICBQZXItbWVzc2FnZSBpbnRlZ3JpdHkgc2VydmljZXMgYXJlIHJlcXVlc3RlZCBmb3Ig dGhlIG5lZ290aWF0ZWQNCiAgICAgICAgIG1lY2hhbmlzbS4NCiAgICAgICogIFR3byBNSUMgdG9r ZW5zIGFyZSBleGNoYW5nZWQsIG9uZSBpbiBlYWNoIGRpcmVjdGlvbi4NCg0KICAgQW4gaW1wbGVt ZW50YXRpb24gdGhhdCBjb25mb3JtcyB0byB0aGlzIHNwZWNpZmljYXRpb24gd2lsbCBub3QNCiAg IGludGVyb3BlcmF0ZSB3aXRoIGEgc3RyaWN0IDI3NDggaW1wbGVtZW50YXRpb24uICBFdmVuIGlm IHRoZSBuZXcNCiAgIGltcGxlbWVudGF0aW9uIGFsd2F5cyBzZW5kcyBhIG1lY2hsaXN0TUlDIHRv a2VuLCBpdCB3aWxsIHN0aWxsIGZhaWwNCiAgIHRvIGludGVyb3BlcmF0ZS4gIElmIGl0IGlzIGEg c2VydmVyLCBpdCB3aWxsIGZhaWwgYmVjYXVzZSBpdCByZXF1ZXN0cw0KICAgYSBtZWNobGlzdE1J QyB0b2tlbiB1c2luZyBhbiBvcHRpb24gdGhhdCBvbGRlciBpbXBsZW1lbnRhdGlvbnMgc2ltcGx5 DQogICBkbyBub3Qgc3VwcG9ydC4gIENsaWVudHMgd2lsbCB0ZW5kIHRvIGZhaWwgYXMgd2VsbC4N Cg0KICAgQXMgYW4gYWx0ZXJuYXRpdmUgdG8gdGhlIGFwcHJvYWNoIGNob3NlbiBpbiB0aGlzIHNw ZWNpZmljYXRpb24sIHdlDQogICBjb3VsZCBoYXZlIGRvY3VtZW50ZWQgYSBjb3JyZWN0IGJlaGF2 aW9yIHRoYXQgaXMgZnVsbHkgYmFja3dhcmQNCiAgIGNvbXBhdGlibGUgd2l0aCBSRkMgMjQ3OCBh bmQgaW5jbHVkZWQgYW4gYXBwZW5kaXggb24gaG93IHRvDQogICBpbnRlcm9wZXJhdGUgd2l0aCBl eGlzdGluZyBpbmNvcnJlY3QgaW1wbGVtZW50YXRpb25zIG9mIFJGQyAyNDc4Lg0KDQogICBBcyBh IHByYWN0aWNhbCBtYXR0ZXIsIHRoZSBTUE5FR08gaW1wbGVtZW50ZXJzIHdpdGhpbiB0aGUgSUVU RiBoYXZlDQogICB2YWx1ZWQgaW50ZXJvcGVyYWJpbGl0eSB3aXRoIHRoZSBNaWNyb3NvZnQgaW1w bGVtZW50YXRpb25zLiAgV2Ugd2VyZQ0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4 cGlyZXMgSnVuZSAxNSwgMjAwNSAgICAgICAgICAgICAgICAgW1BhZ2UgMjVdDQoMDQpJbnRlcm5l dC1EcmFmdCAgICAgICBHU1MtQVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2Vt YmVyIDIwMDQNCg0KDQogICB1bmFibGUgdG8gY2hvb3NlIHRvIG1haW50YWluIHJlYXNvbmFibGUg c2VjdXJpdHkgZ3VhcmFudGVlcywgbWFpbnRhaW4NCiAgIGludGVyb3BlcmFiaWxpdHkgd2l0aCB0 aGUgTWljcm9zb2Z0IGltcGxlbWVudGF0aW9ucyBhbmQgbWFpbnRhaW4NCiAgIGludGVyb3BlcmFi aWxpdHkgd2l0aCBjb3JyZWN0IGltcGxlbWVudGF0aW9ucyBvZiBSRkMgMjQ3OC4gIFRoZQ0KICAg d29ya2luZyBncm91cCB3YXMgbm90IGF3YXJlIG9mIGFueSBSRkMgMjQ3OCBpbXBsZW1lbnRhdGlv bnMgZGVwbG95ZWQNCiAgIG9uIHRoZSBJbnRlcm5ldC4gIEV2ZW4gaWYgdGhlcmUgYXJlIHN1Y2gg aW1wbGVtZW50YXRpb25zLCBpdCBpcw0KICAgdW5saWtlbHkgdGhhdCB0aGV5IHdpbGwgaW50ZXJv cGVyYXRlIGJlY2F1c2Ugb2YgYSBjcml0aWNhbCBmbGF3IGluDQogICB0aGUgZGVzY3JpcHRpb24g b2YgdGhlIGVuY29kaW5nIG9mIHRoZSBtZWNoYW5pc20gbGlzdCBpbiBSRkMgMjQ3OC4NCg0KICAg V2l0aCB0aGUgYXBwcm9hY2ggdGFrZW4gaW4gdGhpcyBzcGVjaWZpY2F0aW9uLCBzZWN1cml0eSBp cyBlbnN1cmVkDQogICBiZXR3ZWVuIG5ldyBpbXBsZW1lbnRhdGlvbnMgYWxsIHRoZSB0aW1lIHdo aWxlIG1haW50YWluaW5nDQogICBpbnRlcm9wZXJhYmlsaXR5IHdpdGggdGhlIGltcGxlbWVudGF0 aW9ucyBkZXBsb3llZCB3aXRoaW4gdGhlIElFVEYNCiAgIGNvbW11bml0eS4gIFRoZSB3b3JraW5n IGdyb3VwIGJlbGlldmVzIHRoYXQgdGhpcyBqdXN0aWZpZXMgYnJlYWtpbmcNCiAgIGNvbXBhdGli aWxpdHkgd2l0aCBhIGNvcnJlY3QgaW1wbGVtZW50YXRpb24gb2YgUkZDIDI0NzguDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAxNSwgMjAw NSAgICAgICAgICAgICAgICAgW1BhZ2UgMjZdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICBHU1Mt QVBJIE5lZ290aWF0aW9uIE1lY2hhbmlzbSAgICAgICAgIERlY2VtYmVyIDIwMDQNCg0KDQpBcHBl bmRpeCBDLiAgbWVjaExpc3RNSUMgQ29tcHV0YXRpb24gRXhhbXBsZQ0KDQogICBUaGUgZm9sbG93 aW5nIGlzIGFuIGV4YW1wbGUgdG8gaWxsdXN0cmF0ZSBob3cgdGhlIG1lY2hMaXN0TUlDIGZpZWxk DQogICB3b3VsZCBiZSBjb21wdXRlZC4NCg0KICAgVGhlIGluaXRpYWwgcGFydCBvZiB0aGUgREVS IGVuY29kaW5nIG9mIE5lZ1Rva2VuSW5pdCBpcyBjb25zdHJ1Y3RlZA0KICAgYXMgZm9sbG93cyAo dGhlICJubiIgYXJlIGxlbmd0aCBlbmNvZGluZ3MsIHBvc3NpYmx5IGxvbmdlciB0aGFuIG9uZQ0K ICAgb2N0ZXQpOg0KDQogICAgICAzMCAtLSBpZGVudGlmaWVyIG9jdGV0IGZvciBjb25zdHJ1Y3Rl ZCBTRVFVRU5DRSAoTmVnVG9rZW5Jbml0KQ0KICAgICAgbm4gLS0gbGVuZ3RoDQoNCiAgICAgICAg IC0tIGNvbnRlbnRzIG9jdGV0cyBvZiB0aGUgU0VRVUVOQ0UgYmVnaW4gd2l0aA0KICAgICAgICAg LS0gREVSIGVuY29kaW5nIG9mICJbMF0gTWVjaFR5cGVMaXN0IjoNCiAgICAgICAgIEEwIC0tIGlk ZW50aWZpZXIgb2N0ZXQgZm9yIGNvbnN0cnVjdGVkIFswXQ0KICAgICAgICAgbm4gLS0gbGVuZ3Ro DQoNCiAgICAgICAgICAgICAtLSBjb250ZW50cyBvZiB0aGUgY29uc3RydWN0ZWQgWzBdIGFyZSBE RVIgZW5jb2RpbmcNCiAgICAgICAgICAgICAtLSBvZiBNZWNoVHlwZUxpc3QgKHdoaWNoIGlzIGEg U0VRVUVOQ0UpOg0KICAgICAgICAgICAgIDMwIC0tIGlkZW50aWZpZXIgb2N0ZXQgZm9yIGNvbnN0 cnVjdGVkIFNFUVVFTkNFDQogICAgICAgICAgICAgbm4gLS0gbGVuZ3RoDQoNCiAgICAgICAgICAg ICAgICAtLSBjb250ZW50cyBvY3RldHMgb2YgdGhlIFNFUVVFTkNFIGJlZ2luIHdpdGgNCiAgICAg ICAgICAgICAgICAtLSBERVIgZW5jb2Rpbmcgb2YgT0JKRUNUIElERU5USUZJRVI6DQogICAgICAg ICAgICAgICAgMDYgLS0gaWRlbnRpZmllciBvY3RldCBmb3IgcHJpbWl0aXZlIE9CSkVDVCBJREVO VElGSUVSDQogICAgICAgICAgICAgICAgMDkgLS0gbGVuZ3RoDQogICAgICAgICAgICAgICAgMkEg ODYgNDggODYgRjcgMTIgMDEgMDIgMDIgLS0gS2VyYmVyb3MgVjUNCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAtLSB7MSAyIDg0MCAxMTM1NTQgMSAyIDJ9DQoNCiAg IElmIGEgbWVjaGxpc3RNSUMgbmVlZHMgdG8gYmUgZ2VuZXJhdGVkIChhY2NvcmRpbmcgdG8gdGhl IHJ1bGVzIGluDQogICBTZWN0aW9uIDUpLCBpdCBpcyBjb21wdXRlZCBieSB1c2luZyB0aGUgREVS IGVuY29kaW5nIG9mIHRoZSB0eXBlDQogICBNZWNoVHlwZUxpc3QgZGF0YSBmcm9tIHRoZSBpbml0 aWF0b3IncyBOZWdUb2tlbkluaXQgdG9rZW4gYXMgaW5wdXQgdG8NCiAgIHRoZSBHU1NfR2V0TUlD KCkgZnVuY3Rpb24uICBJbiB0aGlzIGNhc2UsIHRoZSBNSUMgd291bGQgYmUgY29tcHV0ZWQNCiAg IG92ZXIgdGhlIGZvbGxvd2luZyBvY3RldHM6DQoNCiAgICAgIERFUiBlbmNvZGluZyBvZiBNZWNo VHlwZUxpc3Q6DQogICAgICAzMCBubiAwNiAwOSAyQSA4NiA0OCA4NiBGNyAxMiAwMSAwMiAwMiAu Li4NCg0KICAgTm90ZSB0aGF0IHRoZSBpZGVudGlmaWVyIG9jdGV0IGFuZCBsZW5naCBvY3RldChz KSBmb3IgY29uc3RydWN0ZWQgWzBdDQogICAoQTAgbm4pIGFyZSBub3QgaW5jbHVkZWQgaW4gdGhl IE1JQyBjb21wdXRhdGlvbi4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAg ICAgICAgICAgRXhwaXJlcyBKdW5lIDE1LCAyMDA1ICAgICAgICAgICAgICAgICBbUGFnZSAyN10N CgwNCkludGVybmV0LURyYWZ0ICAgICAgIEdTUy1BUEkgTmVnb3RpYXRpb24gTWVjaGFuaXNtICAg ICAgICAgRGVjZW1iZXIgMjAwNA0KDQoNCkludGVsbGVjdHVhbCBQcm9wZXJ0eSBTdGF0ZW1lbnQN Cg0KICAgVGhlIElFVEYgdGFrZXMgbm8gcG9zaXRpb24gcmVnYXJkaW5nIHRoZSB2YWxpZGl0eSBv ciBzY29wZSBvZiBhbnkNCiAgIEludGVsbGVjdHVhbCBQcm9wZXJ0eSBSaWdodHMgb3Igb3RoZXIg cmlnaHRzIHRoYXQgbWlnaHQgYmUgY2xhaW1lZCB0bw0KICAgcGVydGFpbiB0byB0aGUgaW1wbGVt ZW50YXRpb24gb3IgdXNlIG9mIHRoZSB0ZWNobm9sb2d5IGRlc2NyaWJlZCBpbg0KICAgdGhpcyBk b2N1bWVudCBvciB0aGUgZXh0ZW50IHRvIHdoaWNoIGFueSBsaWNlbnNlIHVuZGVyIHN1Y2ggcmln aHRzDQogICBtaWdodCBvciBtaWdodCBub3QgYmUgYXZhaWxhYmxlOyBub3IgZG9lcyBpdCByZXBy ZXNlbnQgdGhhdCBpdCBoYXMNCiAgIG1hZGUgYW55IGluZGVwZW5kZW50IGVmZm9ydCB0byBpZGVu dGlmeSBhbnkgc3VjaCByaWdodHMuICBJbmZvcm1hdGlvbg0KICAgb24gdGhlIHByb2NlZHVyZXMg d2l0aCByZXNwZWN0IHRvIHJpZ2h0cyBpbiBSRkMgZG9jdW1lbnRzIGNhbiBiZQ0KICAgZm91bmQg aW4gQkNQIDc4IGFuZCBCQ1AgNzkuDQoNCiAgIENvcGllcyBvZiBJUFIgZGlzY2xvc3VyZXMgbWFk ZSB0byB0aGUgSUVURiBTZWNyZXRhcmlhdCBhbmQgYW55DQogICBhc3N1cmFuY2VzIG9mIGxpY2Vu c2VzIHRvIGJlIG1hZGUgYXZhaWxhYmxlLCBvciB0aGUgcmVzdWx0IG9mIGFuDQogICBhdHRlbXB0 IG1hZGUgdG8gb2J0YWluIGEgZ2VuZXJhbCBsaWNlbnNlIG9yIHBlcm1pc3Npb24gZm9yIHRoZSB1 c2Ugb2YNCiAgIHN1Y2ggcHJvcHJpZXRhcnkgcmlnaHRzIGJ5IGltcGxlbWVudGVycyBvciB1c2Vy cyBvZiB0aGlzDQogICBzcGVjaWZpY2F0aW9uIGNhbiBiZSBvYnRhaW5lZCBmcm9tIHRoZSBJRVRG IG9uLWxpbmUgSVBSIHJlcG9zaXRvcnkgYXQNCiAgIGh0dHA6Ly93d3cuaWV0Zi5vcmcvaXByLg0K DQogICBUaGUgSUVURiBpbnZpdGVzIGFueSBpbnRlcmVzdGVkIHBhcnR5IHRvIGJyaW5nIHRvIGl0 cyBhdHRlbnRpb24gYW55DQogICBjb3B5cmlnaHRzLCBwYXRlbnRzIG9yIHBhdGVudCBhcHBsaWNh dGlvbnMsIG9yIG90aGVyIHByb3ByaWV0YXJ5DQogICByaWdodHMgdGhhdCBtYXkgY292ZXIgdGVj aG5vbG9neSB0aGF0IG1heSBiZSByZXF1aXJlZCB0byBpbXBsZW1lbnQNCiAgIHRoaXMgc3RhbmRh cmQuICBQbGVhc2UgYWRkcmVzcyB0aGUgaW5mb3JtYXRpb24gdG8gdGhlIElFVEYgYXQNCiAgIGll dGYtaXByQGlldGYub3JnLg0KDQoNCkRpc2NsYWltZXIgb2YgVmFsaWRpdHkNCg0KICAgVGhpcyBk b2N1bWVudCBhbmQgdGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBoZXJlaW4gYXJlIHByb3ZpZGVk IG9uIGFuDQogICAiQVMgSVMiIGJhc2lzIGFuZCBUSEUgQ09OVFJJQlVUT1IsIFRIRSBPUkdBTkla QVRJT04gSEUvU0hFIFJFUFJFU0VOVFMNCiAgIE9SIElTIFNQT05TT1JFRCBCWSAoSUYgQU5ZKSwg VEhFIElOVEVSTkVUIFNPQ0lFVFkgQU5EIFRIRSBJTlRFUk5FVA0KICAgRU5HSU5FRVJJTkcgVEFT SyBGT1JDRSBESVNDTEFJTSBBTEwgV0FSUkFOVElFUywgRVhQUkVTUyBPUiBJTVBMSUVELA0KICAg SU5DTFVESU5HIEJVVCBOT1QgTElNSVRFRCBUTyBBTlkgV0FSUkFOVFkgVEhBVCBUSEUgVVNFIE9G IFRIRQ0KICAgSU5GT1JNQVRJT04gSEVSRUlOIFdJTEwgTk9UIElORlJJTkdFIEFOWSBSSUdIVFMg T1IgQU5ZIElNUExJRUQNCiAgIFdBUlJBTlRJRVMgT0YgTUVSQ0hBTlRBQklMSVRZIE9SIEZJVE5F U1MgRk9SIEEgUEFSVElDVUxBUiBQVVJQT1NFLg0KDQoNCkNvcHlyaWdodCBTdGF0ZW1lbnQNCg0K ICAgQ29weXJpZ2h0IChDKSBUaGUgSW50ZXJuZXQgU29jaWV0eSAoMjAwNCkuICBUaGlzIGRvY3Vt ZW50IGlzIHN1YmplY3QNCiAgIHRvIHRoZSByaWdodHMsIGxpY2Vuc2VzIGFuZCByZXN0cmljdGlv bnMgY29udGFpbmVkIGluIEJDUCA3OCwgYW5kDQogICBleGNlcHQgYXMgc2V0IGZvcnRoIHRoZXJl aW4sIHRoZSBhdXRob3JzIHJldGFpbiBhbGwgdGhlaXIgcmlnaHRzLg0KDQoNCkFja25vd2xlZGdt ZW50DQoNCiAgIEZ1bmRpbmcgZm9yIHRoZSBSRkMgRWRpdG9yIGZ1bmN0aW9uIGlzIGN1cnJlbnRs eSBwcm92aWRlZCBieSB0aGUNCiAgIEludGVybmV0IFNvY2lldHkuDQoNCg0KDQoNClpodSwgZXQg YWwuICAgICAgICAgICAgICBFeHBpcmVzIEp1bmUgMTUsIDIwMDUgICAgICAgICAgICAgICAgIFtQ YWdlIDI4XQ0KDA0KDQo= ------_=_NextPart_001_01C4E2E7.E36ED879 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten ------_=_NextPart_001_01C4E2E7.E36ED879-- From kitten-bounces@ietf.org Thu Dec 16 14:27:59 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28615; Thu, 16 Dec 2004 14:27:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf1Qe-00050t-3W; Thu, 16 Dec 2004 14:36:48 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf1Aw-0000HV-R4; Thu, 16 Dec 2004 14:20:34 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf0yB-0005yS-9n for kitten@megatron.ietf.org; Thu, 16 Dec 2004 14:07:23 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26928 for ; Thu, 16 Dec 2004 14:07:21 -0500 (EST) Received: from smtpde02.sap-ag.de ([155.56.68.170]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf16V-0004Hx-As for kitten@ietf.org; Thu, 16 Dec 2004 14:16:09 -0500 Received: from sap-ag.de (smtpde02) by smtpde02.sap-ag.de (out) with ESMTP id UAA25863; Thu, 16 Dec 2004 20:06:31 +0100 (MEZ) From: Martin Rex Message-Id: <200412161906.UAA16765@uw1048.wdf.sap.corp> To: Nicolas.Williams@sun.com (Nicolas Williams) Date: Thu, 16 Dec 2004 20:06:31 +0100 (MET) In-Reply-To: <20041215201828.GU135801@binky.central.sun.com> from "Nicolas Williams" at Dec 15, 4 02:18:29 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: 25620135586de10c627e3628c432b04a Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org Subject: Re: Text (was Re: comments on 2478bis (SPNEGO) I-D) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cd26b070c2577ac175cd3a6d878c6248 Content-Transfer-Encoding: 8bit Nicolas Williams wrote: > > > - section 5, what happens when a mechListMIC is sent when it is > > OPTIONAL? The receipient should have to process it, IMO, and that > > should be a MUST, no? > > Larry points out that this is covered in section 5, (b) (I) and (c) (I), > but note that there's no normative rfc2119 key words about that. > > Larry rejects this. I don't mind. The decision whether a supplied mechListMIC must be processed is clear from the situation, the decision is *NOT* at the discretion of the receiver. If a mechListMIC is created and sent for a security context where the final lag results in a context establishment failure, then the mechListMIC can obviously *not* be processed, because gss_verify_mic() can not be called. If a mechListMIC is created and sent for a security context that is successfully established, then the receiver MUST process the mechListMIC and call gss_verify_mic() in order to keep the message protection sequencing facilities in sync with the peer. Otherwise the application will run into message sequencing errors. > > > - section 5, (c), (I), again, RFC2119 key words are needed: > > s/contains/MUST include/ (and the token MUST be output!) > > Larry rejects this comment. I don't mind. > > > - section 5, (c), (I), when the acceptor's mechListMIC cannot be > > verified by the initiator GSS_Init_sec_context() should (MUST) > > indicate GSS_S_DEFECTIVE_TOKEN. > > Larry rejects this comment claiming that this is implied. I agree it's > impled and don't mind if it isn't fixed. > > > - section 5, (c), (III): It may be useful to explain why. > > This isn't a big deal, but my point is that someone who is not familiar > with SPNEGO may legitimately wonder why there's that final negotiation > message when the mechListMIC was not needed. In other words this text > may be confusing to others, though not to me. > > Larry does not want to make a change. I don't mind. > > > - section 5, (c), (III): s/contains/MUST contain/ (and the token MUST > > be output!). > > Larry rejects this comment. I don't mind. There are already too many things implied in our specs. I would really appreciate if things were spelled out more often, and in particular when someone involved in the spec discussion thinks that an explanation would help! I'm not an SPNEGO implementor and I'm sufficiently *un*familiar with the protocol to *not* recognize those parts of the spec that might make implementors wonder. When SPNEGO was originally discussed in ietf-cat, then I complained that it did only contain ASN.1 descriptions and no bits-and-bytes description. If there had been bits&bytes in the spec, there would never have been confusion about which bytes go into the mechListMIC. Unfortunately those implementors that were involved in the discussion and review (Denis Pinkas/Bull and Mike Swift/Microsoft) weren't sufficiently experienced with ASN.1 to see the problem, and unfortunately they didn't seem to have realized the problem while implementing, because they didn't complain... -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 16 14:42:28 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00091; Thu, 16 Dec 2004 14:42:28 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf1ee-0005UC-2X; Thu, 16 Dec 2004 14:51:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf1N0-0002jP-VZ; Thu, 16 Dec 2004 14:33:02 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf1EQ-0000ul-AM for kitten@megatron.ietf.org; Thu, 16 Dec 2004 14:24:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28338 for ; Thu, 16 Dec 2004 14:24:08 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf1Mt-0004ta-IW for kitten@ietf.org; Thu, 16 Dec 2004 14:32:56 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBGJO7dt002181 for ; Thu, 16 Dec 2004 12:24:07 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBGJO7jW012056 for ; Thu, 16 Dec 2004 12:24:07 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBGJNAql173429; Thu, 16 Dec 2004 13:23:10 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBGJN9cG173428; Thu, 16 Dec 2004 13:23:09 -0600 (CST) Date: Thu, 16 Dec 2004 13:23:09 -0600 From: Nicolas Williams To: Martin Rex Message-ID: <20041216192308.GF135800@binky.central.sun.com> Mail-Followup-To: Martin Rex , kitten@ietf.org References: <20041215201828.GU135801@binky.central.sun.com> <200412161906.UAA16765@uw1048.wdf.sap.corp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412161906.UAA16765@uw1048.wdf.sap.corp> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Cc: kitten@ietf.org Subject: Re: Text (was Re: comments on 2478bis (SPNEGO) I-D) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab On Thu, Dec 16, 2004 at 08:06:31PM +0100, Martin Rex wrote: > When SPNEGO was originally discussed in ietf-cat, then I complained > that it did only contain ASN.1 descriptions and no bits-and-bytes > description. If there had been bits&bytes in the spec, there would > never have been confusion about which bytes go into the mechListMIC. > Unfortunately those implementors that were involved in the discussion > and review (Denis Pinkas/Bull and Mike Swift/Microsoft) weren't sufficiently > experienced with ASN.1 to see the problem, and unfortunately they didn't > seem to have realized the problem while implementing, because they > didn't complain... If only the bits that went into the MIC were all they'd gotten wrong... Then this work item would be much simpler. The other things they got wrong were not due to spec vagueness, I don't think. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 16 15:48:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07605; Thu, 16 Dec 2004 15:48:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf2gr-0007r8-3C; Thu, 16 Dec 2004 15:57:38 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf2Rv-0003yX-Ex; Thu, 16 Dec 2004 15:42:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf2KT-0008N6-II for kitten@megatron.ietf.org; Thu, 16 Dec 2004 15:34:29 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA06038 for ; Thu, 16 Dec 2004 15:34:27 -0500 (EST) Received: from smtpde03.sap-ag.de ([155.56.68.140]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf2Sx-0007KS-Ep for kitten@ietf.org; Thu, 16 Dec 2004 15:43:16 -0500 Received: from sap-ag.de (smtpde03) by smtpde03.sap-ag.de (out) with ESMTP id VAA24106; Thu, 16 Dec 2004 21:33:51 +0100 (MEZ) From: Martin Rex Message-Id: <200412162033.VAA18204@uw1048.wdf.sap.corp> To: Nicolas.Williams@sun.com (Nicolas Williams) Date: Thu, 16 Dec 2004 21:33:52 +0100 (MET) In-Reply-To: <20041215202547.GU135800@binky.central.sun.com> from "Nicolas Williams" at Dec 15, 4 02:25:47 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org, hartmans-ietf@mit.edu Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Content-Transfer-Encoding: 8bit Nicolas Williams wrote: > > > >> Why is an error token optional? > > > > Nicolas> IIRC you've wanted error tokens and/or useful information > > Nicolas> in them to be optional and, anyways, initiators already > > Nicolas> have to be prepared to never hear from acceptors again, > > Nicolas> even in the middle of a context token exchange. > > > > In application protocols yes. In this instance, if the acceptor sends > > anything it should send the final token from the mechanism though even > > if it is an error token. > > But that makes the negotiation token an error token also, and > negotiation error tokens have to be as optional as error tokens are for > any mechanism. Error tokens are dangerous, because the can cause quite some confusion and interoperability problems. I think they should be avoided entirely. In case that the security context establishment fails when the final security context token is processed, then the sender has already returned GSS_S_COMPLETE and is therefore not expecting another context level (error) token, and the application level protocol may not have sufficient provisions to tag the token correctly... If gss_init_sec_context() or gss_accept_sec_context() returns a fatal routine error, then the calling applicatoin is likely to terminate the communication with the peer (and entirely ignore any token returned by the call). If the gssapi mechanism camouflages the error token by returning (GSS_S_CONTINUE_NEEDED|GSS_S_COMPLETE) plus an error token, then this will result in an interoperability problems and possible confusion if (a) the handling of error tokens is insufficiently standardized in the mechanism spec or (b) the error happened when processing the final context token and the peer is not expecting another context level (error) token. Microsoft's Kerberos implementation creates camouflaged context level error tokens in several situations, and legacy MIT Kerberos chokes on them. -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 16 17:35:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA20871; Thu, 16 Dec 2004 17:35:10 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf4Ln-00041S-Er; Thu, 16 Dec 2004 17:44:00 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf40O-0008RL-Hs; Thu, 16 Dec 2004 17:21:52 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf3ww-0007Tp-Kj for kitten@megatron.ietf.org; Thu, 16 Dec 2004 17:18:18 -0500 Received: from serrano.cc.columbia.edu (IDENT:cu41754@serrano.cc.columbia.edu [128.59.206.20]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19129 for ; Thu, 16 Dec 2004 17:18:15 -0500 (EST) Received: from [192.168.1.66] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by serrano.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iBGMIHOX020760 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 16 Dec 2004 17:18:17 -0500 (EST) Message-ID: <41C20A17.1050301@columbia.edu> Date: Thu, 16 Dec 2004 17:20:07 -0500 From: Jeffrey Altman Organization: Not Affiliated with Columbia University in the City of New York User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.20 Content-Transfer-Encoding: 7bit Subject: WGLC closed: The Simple and Protected GSS-API Negotiation Mechanism X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit The working group last call on SPNEGO is ended this morning. The -04 draft which was sent to the list yesterday (and should be published to the Internet-Drafts repository tomorrow) contains only editorial changes from the -02 on which the last call was issued. I will let the working group know tomorrow whether I feel there is enough consensus on the document to allow it to be forwarded to the IESG for an IETF Last Call. Jeffrey Altman _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 16 17:39:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA21565; Thu, 16 Dec 2004 17:39:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf4QM-0004Fh-8i; Thu, 16 Dec 2004 17:48:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf4Ev-0002xr-MK; Thu, 16 Dec 2004 17:36:53 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf459-0000VZ-4m for kitten@megatron.ietf.org; Thu, 16 Dec 2004 17:26:47 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA20062 for ; Thu, 16 Dec 2004 17:26:44 -0500 (EST) Received: from brazilnut.cc.columbia.edu ([128.59.206.18] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf4De-0003k5-25 for kitten@ietf.org; Thu, 16 Dec 2004 17:35:35 -0500 Received: from [192.168.1.66] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by brazilnut.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iBGMQix2019799 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 16 Dec 2004 17:26:44 -0500 (EST) Message-ID: <41C20C12.9090301@columbia.edu> Date: Thu, 16 Dec 2004 17:28:34 -0500 From: Jeffrey Altman Organization: Not Affiliated with Columbia University in the City of New York User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org References: <200412161906.UAA16765@uw1048.wdf.sap.corp> In-Reply-To: <200412161906.UAA16765@uw1048.wdf.sap.corp> X-Enigmail-Version: 0.84.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.18 X-Spam-Score: 0.0 (/) X-Scan-Signature: 5ebbf074524e58e662bc8209a6235027 Subject: Re: Text (was Re: comments on 2478bis (SPNEGO) I-D) X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1982666028==" Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 68ba2b07ef271dba6ee42a93832cfa4c This is a cryptographically signed message in MIME format. --===============1982666028== Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms000503000801000306030106" This is a cryptographically signed message in MIME format. --------------ms000503000801000306030106 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Martin Rex wrote: > > There are already too many things implied in our specs. I would > really appreciate if things were spelled out more often, and in > particular when someone involved in the spec discussion thinks that > an explanation would help! > > I'm not an SPNEGO implementor and I'm sufficiently *un*familiar with > the protocol to *not* recognize those parts of the spec that might > make implementors wonder. > > When SPNEGO was originally discussed in ietf-cat, then I complained > that it did only contain ASN.1 descriptions and no bits-and-bytes > description. If there had been bits&bytes in the spec, there would > never have been confusion about which bytes go into the mechListMIC. > Unfortunately those implementors that were involved in the discussion > and review (Denis Pinkas/Bull and Mike Swift/Microsoft) weren't sufficiently > experienced with ASN.1 to see the problem, and unfortunately they didn't > seem to have realized the problem while implementing, because they > didn't complain... > > -Martin I agree that I would rather error on the side of too much explanatory text then not enough. Especially in a protocol specification which is attempting to correct for the flaws of the past. The WGLC is over on this document. I will issue my determination on whether to send it to the IESG tomorrow. In either case, if there are further editorial changes which would help prevent confusion for implementors they can be submitted as IETF Last Call comments or incorporated into a new draft before it is sent to the IESG. Thanks. Jeffrey Altman --------------ms000503000801000306030106 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJPzCC AvowggJjoAMCAQICAwxk8TANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UE ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNv bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDQwNTI3MTc1ODU4WhcNMDUwNTI3MTc1ODU4 WjBrMQ8wDQYDVQQEEwZBbHRtYW4xFTATBgNVBCoTDEplZmZyZXkgRXJpYzEcMBoGA1UEAxMT SmVmZnJleSBFcmljIEFsdG1hbjEjMCEGCSqGSIb3DQEJARYUamFsdG1hbkBjb2x1bWJpYS5l ZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc3JqO5AsZrozd+mJ2mPuCTYo2 +nJ9Qq6jtUYtp7YTMW4d2Q6GLhNaHb1l9m74SxuY4f5vP6JtZjr6p9+LCCxD0w0NVLKRgUDp z+tKFitbkJe9BSCxCURRvY3vdWA71gSCUvZAN3346hHb4oGVqgdpmfFJXYAHWpC46wiL72N9 WxySzY17/0eU0c8+r9dNoLpPQeL43O66O80jCl1qnXMaXaakZPsfm+5W90MYXhpQ1WIQpv02 lBn3BH5YE8xwbsNrw5AF4v7pjMuW85GI6FrDmfbpJX473Rpl5rmv3TpXkJ+7UsIIO1puyS8r 1o7kjDZ5EUYJxxglTGR6XL/RNzqHAgMBAAGjMTAvMB8GA1UdEQQYMBaBFGphbHRtYW5AY29s dW1iaWEuZWR1MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAZYeVFCMP0iV+UVa0 eFoXkzMVl61CNAVY2YQ9/QQazO3G4qNiif35ArrnjPRDRj5M7WTeOCFqPVuvCttyJRiDKsEe L4Yah22mRA3mR7x52j2FquPYZ9qCr1IhrNGzsMk+gopX5G0fTHZb6+uDu5SeMPNNcIznGA7M CMpXAJ2PcKgwggL6MIICY6ADAgECAgMMZPEwDQYJKoZIhvcNAQEEBQAwYjELMAkGA1UEBhMC WkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1Ro YXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA0MDUyNzE3NTg1OFoXDTA1 MDUyNzE3NTg1OFowazEPMA0GA1UEBBMGQWx0bWFuMRUwEwYDVQQqEwxKZWZmcmV5IEVyaWMx HDAaBgNVBAMTE0plZmZyZXkgRXJpYyBBbHRtYW4xIzAhBgkqhkiG9w0BCQEWFGphbHRtYW5A Y29sdW1iaWEuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3NyajuQLGa6M 3fpidpj7gk2KNvpyfUKuo7VGLae2EzFuHdkOhi4TWh29ZfZu+EsbmOH+bz+ibWY6+qffiwgs Q9MNDVSykYFA6c/rShYrW5CXvQUgsQlEUb2N73VgO9YEglL2QDd9+OoR2+KBlaoHaZnxSV2A B1qQuOsIi+9jfVscks2Ne/9HlNHPPq/XTaC6T0Hi+NzuujvNIwpdap1zGl2mpGT7H5vuVvdD GF4aUNViEKb9NpQZ9wR+WBPMcG7Da8OQBeL+6YzLlvORiOhaw5n26SV+O90aZea5r906V5Cf u1LCCDtabskvK9aO5Iw2eRFGCccYJUxkely/0Tc6hwIDAQABozEwLzAfBgNVHREEGDAWgRRq YWx0bWFuQGNvbHVtYmlhLmVkdTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBAGWH lRQjD9IlflFWtHhaF5MzFZetQjQFWNmEPf0EGsztxuKjYon9+QK654z0Q0Y+TO1k3jghaj1b rwrbciUYgyrBHi+GGodtpkQN5ke8edo9harj2Gfagq9SIazRs7DJPoKKV+RtH0x2W+vrg7uU njDzTXCM5xgOzAjKVwCdj3CoMIIDPzCCAqigAwIBAgIBDTANBgkqhkiG9w0BAQUFADCB0TEL MAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3du MRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENB MSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTAzMDcx NzAwMDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0 ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVl bWFpbCBJc3N1aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEpjxVc1X7TrnK mVoeaMB1BHCd3+n/ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuFWqo/ cVbLrzwLB+fxH5E2JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8 YQRAHmQZcmC3+wIDAQABo4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4 oDagNIYyaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS5j cmwwCwYDVR0PBAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwy LTEzODANBgkqhkiG9w0BAQUFAAOBgQBIjNFQg+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4 Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZfoSxmRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowg T2Vfldr394fWxghOrvbqNOUQGls1TXfjViF4gtwhGTXeJLHTHUb/XV9lTzGCAzswggM3AgEB MGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0 ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMMZPEw CQYFKw4DAhoFAKCCAacwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUx DxcNMDQxMjE2MjIyODM0WjAjBgkqhkiG9w0BCQQxFgQUCUVL9ifJ1Hu5+QEdu3rpKaLUF5sw UgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcN AwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgweAYJKwYBBAGCNxAEMWswaTBiMQswCQYD VQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAwxk8TB6BgsqhkiG9w0B CRACCzFroGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB AgMMZPEwDQYJKoZIhvcNAQEBBQAEggEACBObx13f0QZHSennQ+9xyLC5OlwgIqvOfPoYuyJ/ Ry+DUd9SWFKER4SmU0rwKoVUc87ScMLUIUOyPEkt0UzijxxlcCpTfaSiP7KX/hWJ/HBH/0DT VqW92GT8Xx82dpBXq9B+VcWjpZtGMh/yNybXnMlGfOBEtLcXxe3eeQjuf98NtPFFZn4Sxi4l kDpvJ8GNQQnQAtbATCc6XDxF9USJI5xcGqbenbIfPVlsYFbA/k9BL4Vq+2mKjTLM7u7UMiwP HJJzM0sAlzHDzcEOgLb0uI4xKnQpikd5N4xi5I0Dg4U6VD1XGHagL9B1ZL90f0pwl3FoIzcn +mbZRQ4RRYXz9wAAAAAAAA== --------------ms000503000801000306030106-- --===============1982666028== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --===============1982666028==-- From kitten-bounces@ietf.org Thu Dec 16 21:19:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12028; Thu, 16 Dec 2004 21:19:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf7rD-0002YG-HT; Thu, 16 Dec 2004 21:28:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf7gI-0008M4-VC; Thu, 16 Dec 2004 21:17:22 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf7dq-0007qF-TX for kitten@megatron.ietf.org; Thu, 16 Dec 2004 21:14:51 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11670 for ; Thu, 16 Dec 2004 21:14:48 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf7mO-0002Py-Km for kitten@ietf.org; Thu, 16 Dec 2004 21:23:41 -0500 Received: from eastmail1bur.East.Sun.COM ([129.148.9.49]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBH2Emdt015000; Thu, 16 Dec 2004 19:14:48 -0700 (MST) Received: from 192.9.61.12 (punchin-sommerfeld.SFBay.Sun.COM [192.9.61.12]) by eastmail1bur.East.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id iBH2Ek8p009937; Thu, 16 Dec 2004 21:14:47 -0500 (EST) From: Bill Sommerfeld To: kitten@ietf.org In-Reply-To: References: <1102115448.10024.3.camel@thunk> Content-Type: text/plain Message-Id: <1103226365.1434.192.camel@unknown.hamachi.org> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6.324 Date: Thu, 16 Dec 2004 21:14:09 -0500 Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 1a1bf7677bfe77d8af1ebe0e91045c5b Content-Transfer-Encoding: 7bit Cc: Sam Hartman , Russ Housley Subject: Review: of draft-ietf-kitten-2478bis-03.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 944ecb6e61f753561f559a497458fb4f Content-Transfer-Encoding: 7bit Sam Hartman asked me to look at the 2478bis-03 draft. I should first say that it's been a long time since i've looked at anything GSSAPI related at this level of detail. My review is largely confined to higher level details; I'll leave it to someone else to determine if the bits-on-the-wire encodings match reality. 1) safety of omitting mechlistMIC: The safety, or lack there of, of making the mechlistMIC optional appears to depend in part on all of the acceptable mechanisms sharing a property: they will never mistake a token for another mechanism as if it were intended for them. this property needs to be explicitly spelled out in the spec. The safety of omitting the mechlistMIC when the first choice is picked depends on mechanisms reliably rejecting tokens not intended for them; this property needs to be documented. A thought experiment: Consider a pair (or larger sized sets) of mechanisms with different semantics but identical syntax, which share a common underlying credential mechanism. here's a slightly twisted example: a server-authentication-only variant of kerberos where mutual authenticaton is done as usual but where the identity presented to the target application is anonymous/"nobody". assume the client is juggling multiple kerberos identities, and would present one with the server-auth-only mech and a different one to the regular kerberos mechanism. It seems like it would be possible in this case for a MITM to mess up the negotiation unless the mechanism OID is cryptographically linked to the exchange. 2) excessive optimistic negotiation flexibility. Excessive numbers of options and configuration knobs present a real cost to implementors and users. whether or not to send an optimistic token should perhaps be a property of the mechanism, either in the mechanism spec (for new mechanisms) or in a separate spec. 3) a potential race condition (page 6: client "MUST NOT" include mechs it doesn't't have creds for in the list of acceptable mechanisms). Credentials could be administratively deleted between the first message and the response. when the server responds accepting an option no longer open to the client, the client will essentially be forced to abort the negotiation (at application level?) and retry. It could also be the case that mechanisms requiring an interaction with an on-line service to produce or validate a token could encounter a soft failure due to connectivity problems. the net result of this is an exchange which looks to the server or an external third-party observer as if the client violated this MUST NOT... 4) This statement in appendix B needs more detail. "Even if there are such implementations, it is unlikely that they will interoperate because of a critical flaw in the description of the encoding of the mechanism list in RFC 2478." what was this flaw? if there are multiple possible interpretations, an implementation could well try multiple reformulations of the input to the hash function.. overall: allow implementations to cache state and/or policy about peer capabilities, as a better interoperability solution than failing to interop with the RFC? 5) vague material in sec-cons (page 18): The negotiation may not be terminated if an alteration was made but it had no material impact. This is very ambiguous as it's not clear whether it is forbidding termination in this case or merely allowing continuation. I think you mean: If the receiver detects an alteration, but the alteration had no material impact on the negotiation, the reciever MAY opt to continue the session. It's also the case that "material alteration" is not defined. 6) appendix C example: IMHO you should should also pick an example mechanism, key, etc., and include the computed MIC. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 17 16:15:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08791; Fri, 17 Dec 2004 16:15:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfPao-00056W-Ak; Fri, 17 Dec 2004 16:24:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfOqa-0008Po-BD; Fri, 17 Dec 2004 15:37:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfOky-000556-Jj; Fri, 17 Dec 2004 15:31:20 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00699; Fri, 17 Dec 2004 15:31:18 -0500 (EST) Message-Id: <200412172031.PAA00699@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Fri, 17 Dec 2004 15:31:18 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-2478bis-04.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: cf3becbbd6d1a45acbe2ffd4ab88bdc2 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : The Simple and Protected GSS-API Negotiation Mechanism Author(s) : L. Zhu, et al. Filename : draft-ietf-kitten-2478bis-04.txt Pages : 28 Date : 2004-12-17 This document specifies a negotiation mechanism for the Generic Security Service Application Program Interface (GSS-API) which is described in RFC 2743. GSS-API peers can use this negotiation mechanism to choose from a common set of security mechanisms. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-2478bis-04.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-2478bis-04.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-2478bis-04.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-17153808.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-2478bis-04.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-2478bis-04.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-17153808.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Fri Dec 17 16:46:39 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA14798; Fri, 17 Dec 2004 16:46:39 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfQ4a-00076K-4h; Fri, 17 Dec 2004 16:55:42 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfPc8-0005rm-Rk; Fri, 17 Dec 2004 16:26:16 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfOsd-00010U-J9 for kitten@megatron.ietf.org; Fri, 17 Dec 2004 15:39:15 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01533 for ; Fri, 17 Dec 2004 15:39:13 -0500 (EST) Received: from biscayne-one-station.mit.edu ([18.7.7.80]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfP1I-0002OK-EC for kitten@ietf.org; Fri, 17 Dec 2004 15:48:15 -0500 Received: from outgoing.mit.edu (OUTGOING-AUTH.MIT.EDU [18.7.22.103]) by biscayne-one-station.mit.edu (8.12.4/8.9.2) with ESMTP id iBHKdAXH011991 for ; Fri, 17 Dec 2004 15:39:10 -0500 (EST) Received: from [18.18.1.76] (KEN-WIRELESS.MIT.EDU [18.18.1.76]) (authenticated bits=0) (User authenticated as raeburn@ATHENA.MIT.EDU) by outgoing.mit.edu (8.12.4/8.12.4) with ESMTP id iBHKd7mM022979 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for ; Fri, 17 Dec 2004 15:39:07 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v619) Message-Id: Content-Type: text/plain; charset=US-ASCII; format=flowed To: kitten@ietf.org From: Ken Raeburn Date: Fri, 17 Dec 2004 15:39:06 -0500 X-Mailer: Apple Mail (2.619) X-Spam-Score: -0.904 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.42 Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 2ed806e2f53ff1a061ad4f97e00345ac Content-Transfer-Encoding: 7bit Subject: spnego-bis comments X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c54bc2f42d02429833c0ca4b8725abd7 Content-Transfer-Encoding: 7bit Sorry these are so late, I've been working on my 48-hours, important bug fixes, etc. I probably should've spent more time going over the WG email before reviewing this, but.... Section 1, the introduction ought not to have requirements indications, at least not to this degree. I could see maybe an introduction saying under circumstances X or Y an implementation MAY/SHOULD/MUST follow this RFC, but not for how parts of the protocol defined in the RFC are to be implemented. The OID shouldn't be defined here either; probably in section 4 or maybe 4.2. Minor: Page 7 first line, "...and it is OPTIONAL to emit a context level negotiation token", sounds awkward to me (maybe "OPTIONAL whether to emit" or "emitting...is OPTIONAL"?). Given the aggressive work by the RFC Editor these days, it will probably get reworded into active voice, along with a whole bunch of other stuff. Better to do it first, than give them more work. Minor: Page 8, item (c), "...this mechanism token MUST be deposited to the selected mechanism". The word "deposited" seems odd here, how about "passed"? Item (d) likewise. And maybe "emit"->"returned" for outputs of GSS-API functions. Minor: Item (d) "until the GSS_S_COMPLETE is returned", drop "the" or make it "the GSS_S_COMPLETE status" or something. Section 3.1: Might be obvious, but it may be worth noting that the SPNEGO OID itself SHOULD (MUST?) NOT be included in the list of mechanisms. Section 3.2 "The basic form of the procedure ... is summarized as follows". Okay, where's the non-basic, non-summary, fully-detailed description? If this is the fully detailed description, it should tell me what the target should do if the initial proposed mechanism is acceptable, but an error happens processing the included token. Near as I can tell, (c) says I should return GSS_S_COMPLETE and not send a reply. If the error happens later, then it's clearer what I should do. Section 3.2 (d) seems to ignore the possibility that the target didn't like the proposed mechanism and returned a list of different ones. And what it if returned only ones which weren't supported by the initiator? In fact, the word "error" occurs only once in the document, and that's in the introduction. ("Fail" occurs a bit more -- introduction, security considerations, and appendices. But the main body of the spec can't address just the success cases.) Q: Does GSSAPI allow for a state where authentication has essentially succeeded, but one has the option of sending one more mech token and the other can't independently determine whether the it will do so? (I'm wondering if that would affect the scheduling of the MIC token transmission, but haven't looked into it yet.) Section 4.2.1: reqFlags [1] ContextFlags OPTIONAL, -- maintained from RFC 2478 for backward compatibility, -- RECOMMENDED to be left out reqFlags This field, if present, contains the service options that are requested to establish the context. The context flags SHOULD be filled in from the req_flags parameter of Which is it? Included (and ignored), or omitted? Section 5, second paragraph: as described later in this section, is OPTIONAL. A mechanism is the acceptor's most preferred mechanism if there is no other mechanism which, had it been present in the mechanism list, the acceptor would have preferred over the accepted mechanism. "The most preferred mechanism" implies uniqueness. The rest of the description does not seem to support that. In fact, if my policy is "use the first mech listed", then isn't that first mech always going to qualify (assuming I support it at all)? Or is the intent that this other mech would always be used if it's in the list, regardless of position or other mechanisms? (In which case, "use the first mech listed" has no "most preferred mech" at all.) When is NegTokenInit.mechListMIC used? Section 3 seems to indicate that the MIC tokens aren't exchanged until *after* GSS_S_COMPLETE has been returned on both sides by the agreed-upon mechanism, and aren't we sure to be using NegTokenResp at that point? (In Section 5 it appears that it's possible to use mechListMIC in NegTokenInit.) Section 6: A final RFC should probably not talk too much about planned work in specific working groups. MIC requirements: influence the acceptor's choice of mechanism. As discussed in Section 5, if there are mechanisms that if present in the initiator's list of mechanisms might be preferred by the acceptor to the initiator's preferred mechanism, the acceptor MUST demand the MIC token exchange. As a consequence, acceptors MUST demand the MIC token exchange if they support negotiation of attributes not available in the initiator's preferred mechanism regardless of whether the initiator actually requested these attributes. ... (I'm not sure I follow "as a consequence", but I haven't thought about it enough, or caught up on the mail) but section 5 says: If the mechanism selected by the negotiation does not support integrity protection, then no mechlistMIC token is used. ... so what if the acceptor supports this attribute negotiation but they agree on a mechanism without integrity protection? Section 7: The security considerations do need work, as Bill noted. I'd like to see discussion of Bill's thought-experiment case, where the two parties see different OIDs, each thinking they're negotiating for their preferred mech, but in reality they're different mechs with similar-enough initial messages. Minor: I don't think Sections demand page breaks. A bunch of vertical space is wasted just to get sections 2, 6, 7, 8, 9, and 10 to start at the top of their pages. Section 8 (one-line header plus one line of content) is especially wasteful. Minor: Appendix B starts off indented too far by three columns. Appendix B "address the problems in RFC 2478": Since there's been no discussion of what "the problems" are, I'd drop the word "the". Should we say "Microsoft Windows 2000/..."? That's it for now. Ken _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 17 17:52:03 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA23591; Fri, 17 Dec 2004 17:52:03 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfR5u-0001ty-KS; Fri, 17 Dec 2004 18:01:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfQoe-0001cb-Fk; Fri, 17 Dec 2004 17:43:16 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfQVm-0000ap-LN; Fri, 17 Dec 2004 17:23:46 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19787; Fri, 17 Dec 2004 17:23:44 -0500 (EST) Received: from gw2.cox.com ([24.248.72.254] helo=hatl0ms23.corp.cox.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfQeU-0000WZ-GX; Fri, 17 Dec 2004 17:32:47 -0500 Received: from mail pickup service by hatl0ms23.corp.cox.com with Microsoft SMTPSVC; Fri, 17 Dec 2004 17:23:13 -0500 Received: from cox.com ([10.64.198.37]) by HATL0MS22.corp.cox.com with Microsoft SMTPSVC(5.0.2195.6713); Fri, 17 Dec 2004 16:18:03 -0500 Received: from ([132.151.6.71]) by post4.cox.com with SMTP id KP-VXH63.86059765; Fri, 17 Dec 2004 16:17:00 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfOqb-0008Q2-MY; Fri, 17 Dec 2004 15:37:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfOky-000556-Jj; Fri, 17 Dec 2004 15:31:20 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00699; Fri, 17 Dec 2004 15:31:18 -0500 (EST) Message-Id: <200412172031.PAA00699@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Fri, 17 Dec 2004 15:31:18 -0500 X-BeenThere: i-d-announce@ietf.org X-Mailman-Version: 2.1.5 Precedence: list X-OriginalArrivalTime: 17 Dec 2004 21:18:03.0507 (UTC) FILETIME=[E4DED430:01C4E47D] X-Spam-Score: 0.4 (/) X-Scan-Signature: cf3becbbd6d1a45acbe2ffd4ab88bdc2 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-2478bis-04.txt X-BeenThere: kitten@lists.ietf.org Reply-To: internet-drafts@ietf.org List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: 7fa173a723009a6ca8ce575a65a5d813 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : The Simple and Protected GSS-API Negotiation Mechanism Author(s) : L. Zhu, et al. Filename : draft-ietf-kitten-2478bis-04.txt Pages : 28 Date : 2004-12-17 This document specifies a negotiation mechanism for the Generic Security Service Application Program Interface (GSS-API) which is described in RFC 2743. GSS-API peers can use this negotiation mechanism to choose from a common set of security mechanisms. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-2478bis-04.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-2478bis-04.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-2478bis-04.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-17153808.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-2478bis-04.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-2478bis-04.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-17153808.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit _______________________________________________ I-D-Announce mailing list I-D-Announce@ietf.org https://www1.ietf.org/mailman/listinfo/i-d-announce --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Fri Dec 17 18:28:53 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04216; Fri, 17 Dec 2004 18:28:53 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfRfA-0005CL-Ud; Fri, 17 Dec 2004 18:37:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfRSM-0002E8-5l; Fri, 17 Dec 2004 18:24:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfROA-0006dz-0L for kitten@megatron.ietf.org; Fri, 17 Dec 2004 18:19:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01771 for ; Fri, 17 Dec 2004 18:19:54 -0500 (EST) Received: from cs2876-92.austin.rr.com ([24.28.76.92] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfRWr-0004Sz-Bp for kitten@ietf.org; Fri, 17 Dec 2004 18:28:57 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id 10EE8E0078; Fri, 17 Dec 2004 18:20:02 -0500 (EST) To: Ken Raeburn References: From: Sam Hartman Date: Fri, 17 Dec 2004 18:20:02 -0500 In-Reply-To: (Ken Raeburn's message of "Fri, 17 Dec 2004 15:39:06 -0500") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Cc: kitten@ietf.org Subject: Re: spnego-bis comments X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 >>>>> "Ken" == Ken Raeburn writes: Ken> Section 6: Ken> A final RFC should probably not talk too much about planned Ken> work in specific working groups. Disagree. I've seen it done in other places and I believe it is reasonable in this instance. Do you have a better idea for conveying the information? Ken> MIC requirements: Ken> influence the acceptor's choice of mechanism. As Ken> discussed in Section 5, if there are mechanisms that if Ken> present in the initiator's list of mechanisms might be Ken> preferred by the acceptor to the initiator's preferred Ken> mechanism, the acceptor MUST demand the MIC token exchange. Ken> As a consequence, acceptors MUST demand the MIC token Ken> exchange if they support negotiation of attributes not Ken> available in the initiator's preferred mechanism regardless Ken> of whether the initiator actually requested these attributes. Ken> ... (I'm not sure I follow "as a consequence", but I haven't Ken> thought about it enough, or caught up on the mail) but Ken> section 5 says: Ken> If the mechanism selected by the negotiation does not Ken> support integrity protection, then no mechlistMIC token is Ken> used. Ken> ... so what if the acceptor supports this attribute Ken> negotiation but they agree on a mechanism without integrity Ken> protection? Then no MIc is exchanged. This does need rewording to allow for that. What section 6 is trying to say is that if you support things that influence your negotiation, then you tend not to be able to make the MIC token safe to omit. Ken> Section 7: Ken> The security considerations do need work, as Bill noted. I'd Ken> like to see discussion of Bill's thought-experiment case, Ken> where the two parties see different OIDs, each thinking Ken> they're negotiating for their preferred mech, but in reality Ken> they're different mechs with similar-enough initial messages. That's not quite enough to make the thought experiment work out. You actually need them to be similar enough in enough messages that one side ends up returning complete. I.E. I agree we need to address Bill's thought experiment but believe the conditions under which it is a problem will be tricky to describe. --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 17 18:31:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04734; Fri, 17 Dec 2004 18:31:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfRhv-0005Lb-C1; Fri, 17 Dec 2004 18:40:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfRVN-0003kd-VJ; Fri, 17 Dec 2004 18:27:25 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfRRY-0001EG-0Z for kitten@megatron.ietf.org; Fri, 17 Dec 2004 18:23:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA03092 for ; Fri, 17 Dec 2004 18:23:25 -0500 (EST) Received: from biscayne-one-station.mit.edu ([18.7.7.80]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfRaG-0004xh-Cq for kitten@ietf.org; Fri, 17 Dec 2004 18:32:29 -0500 Received: from outgoing.mit.edu (OUTGOING-AUTH.MIT.EDU [18.7.22.103]) by biscayne-one-station.mit.edu (8.12.4/8.9.2) with ESMTP id iBHNNP6a004237; Fri, 17 Dec 2004 18:23:25 -0500 (EST) Received: from [18.18.1.76] (KEN-WIRELESS.MIT.EDU [18.18.1.76]) (authenticated bits=0) (User authenticated as raeburn@ATHENA.MIT.EDU) by outgoing.mit.edu (8.12.4/8.12.4) with ESMTP id iBHNNMmM023265 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT); Fri, 17 Dec 2004 18:23:22 -0500 (EST) In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v619) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: From: Ken Raeburn Date: Fri, 17 Dec 2004 18:23:21 -0500 To: Sam Hartman X-Mailer: Apple Mail (2.619) X-Spam-Score: -0.908 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.42 Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org Subject: Re: spnego-bis comments X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Content-Transfer-Encoding: 7bit On Dec 17, 2004, at 18:20, Sam Hartman wrote: > Ken> A final RFC should probably not talk too much about planned > Ken> work in specific working groups. > > Disagree. I've seen it done in other places and I believe it is > reasonable in this instance. Do you have a better idea for conveying > the information? Planned work seems reasonable, it's references to specific working groups that will probably go away long before the RFC is made obsolete (if we get it right this time) that bother me a little. Just dropping the WG references and describing it as planned IETF work may be okay. Or, if people disagree, just leave it as is... Ken _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Sat Dec 18 12:43:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA03459; Sat, 18 Dec 2004 12:43:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cfikz-0007xE-Ek; Sat, 18 Dec 2004 12:52:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cfib2-0003oi-R6; Sat, 18 Dec 2004 12:42:25 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfiZo-0003gF-90 for kitten@megatron.ietf.org; Sat, 18 Dec 2004 12:41:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA03341 for ; Sat, 18 Dec 2004 12:41:05 -0500 (EST) Received: from cs2876-92.austin.rr.com ([24.28.76.92] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cfiih-0007u8-Bp for kitten@ietf.org; Sat, 18 Dec 2004 12:50:19 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id BD251E0078; Sat, 18 Dec 2004 12:41:23 -0500 (EST) To: Ken Raeburn References: From: Sam Hartman Date: Sat, 18 Dec 2004 12:41:23 -0500 In-Reply-To: (Ken Raeburn's message of "Fri, 17 Dec 2004 18:23:21 -0500") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Cc: kitten@ietf.org Subject: Re: spnego-bis comments X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a >>>>> "Ken" == Ken Raeburn writes: Ken> On Dec 17, 2004, at 18:20, Sam Hartman wrote: A final RFC Ken> should probably not talk too much about planned work in Ken> specific working groups. >> Disagree. I've seen it done in other places and I believe it >> is reasonable in this instance. Do you have a better idea for >> conveying the information? Ken> Planned work seems reasonable, it's references to specific Ken> working groups that will probably go away long before the RFC Ken> is made obsolete (if we get it right this time) that bother Ken> me a little. Just dropping the WG references and describing Ken> it as planned IETF work may be okay. Or, if people disagree, Ken> just leave it as is... I agree the reference will become obselete. However I also believe it is important for people to be able to find the work, and I think that reference will help such a search. --Sam _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 20 13:33:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21529; Mon, 20 Dec 2004 13:33:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgSVI-000864-HC; Mon, 20 Dec 2004 13:43:32 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgSJZ-000345-D7; Mon, 20 Dec 2004 13:31:25 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgSIN-0002yB-54 for kitten@megatron.ietf.org; Mon, 20 Dec 2004 13:30:11 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21376 for ; Mon, 20 Dec 2004 13:30:05 -0500 (EST) Received: from smtpde02.sap-ag.de ([155.56.68.170]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgSRT-0007zu-7q for kitten@ietf.org; Mon, 20 Dec 2004 13:39:45 -0500 Received: from sap-ag.de (smtpde02) by smtpde02.sap-ag.de (out) with ESMTP id TAA14069; Mon, 20 Dec 2004 19:29:21 +0100 (MEZ) From: Martin Rex Message-Id: <200412201829.TAA25300@uw1048.wdf.sap.corp> To: Nicolas.Williams@sun.com (Nicolas Williams) Date: Mon, 20 Dec 2004 19:29:21 +0100 (MET) In-Reply-To: <20041215112536.GQ135801@binky.central.sun.com> from "Nicolas Williams" at Dec 15, 4 05:25:36 am MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: 8bit Nicolas Williams wrote: > > - section 3.1, third paragraph: the GSS_Set/Get_neg_mechs() functions > deal in SET OF OBJECT IDENTIFIER, not SEQUENCE OF, therefore > applications cannot specify preference order through > GSS_Set_neg_mechs(). > > GSS_Set/Get_neg_mechs() could not be changed to use SEQUENCE OF > OBJECT IDENTIFIER because of language bindings issues (unless there > exist no implementations, I suppose) since SEQUENCE OF is not used > anywhere in RFC2743 none of the language bindings have appropriate > bindings for that type. I have a different understanding of rfc2478 and rfc2743. rfc2478 uses the same terminology to describe GSS_Set_mechs/GSS_Get_mechs function parameters as rfc2743. However the "SET OF OBJECT IDENTIFIER" is **NOT** meant to imply all of the ASN.1 semantics of a SET. In the GSS-API C-Bindings, the gss_OID_set has always been an array of OIDs, and for those API calls where order makes sense, the oder of OIDs in the array indicates a preference, e.g. the gss_OID_set returned by gss_indicate_mechs(). Therefore, the definition of GSS_Set/Get_neg_mechs() is fine with rfc2743/44 and provides a means to indicate an order of preference. -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 20 13:44:03 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21982; Mon, 20 Dec 2004 13:44:03 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgSf7-0008Hn-R2; Mon, 20 Dec 2004 13:53:42 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgSTv-0005Ja-05; Mon, 20 Dec 2004 13:42:07 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgSP8-0004pY-Aj for kitten@megatron.ietf.org; Mon, 20 Dec 2004 13:37:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21667 for ; Mon, 20 Dec 2004 13:37:06 -0500 (EST) Received: from nwkea-mail-2.sun.com ([192.18.42.14]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgSYQ-00089t-2s for kitten@ietf.org; Mon, 20 Dec 2004 13:46:47 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by nwkea-mail-2.sun.com (8.12.10/8.12.9) with ESMTP id iBKIb6pv010137 for ; Mon, 20 Dec 2004 10:37:06 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBKIb6jW016750 for ; Mon, 20 Dec 2004 11:37:06 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBKIa7kB180186; Mon, 20 Dec 2004 12:36:07 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBKIa6gu180185; Mon, 20 Dec 2004 12:36:06 -0600 (CST) Date: Mon, 20 Dec 2004 12:36:06 -0600 From: Nicolas Williams To: Martin Rex Message-ID: <20041220183606.GA135800@binky.central.sun.com> Mail-Followup-To: Martin Rex , kitten@ietf.org References: <20041215112536.GQ135801@binky.central.sun.com> <200412201829.TAA25300@uw1048.wdf.sap.corp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412201829.TAA25300@uw1048.wdf.sap.corp> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c On Mon, Dec 20, 2004 at 07:29:21PM +0100, Martin Rex wrote: > Nicolas Williams wrote: > > > > - section 3.1, third paragraph: the GSS_Set/Get_neg_mechs() functions > > deal in SET OF OBJECT IDENTIFIER, not SEQUENCE OF, therefore > > applications cannot specify preference order through > > GSS_Set_neg_mechs(). > > > > GSS_Set/Get_neg_mechs() could not be changed to use SEQUENCE OF > > OBJECT IDENTIFIER because of language bindings issues (unless there > > exist no implementations, I suppose) since SEQUENCE OF is not used > > anywhere in RFC2743 none of the language bindings have appropriate > > bindings for that type. > > I have a different understanding of rfc2478 and rfc2743. > > rfc2478 uses the same terminology to describe GSS_Set_mechs/GSS_Get_mechs > function parameters as rfc2743. However the "SET OF OBJECT IDENTIFIER" > is **NOT** meant to imply all of the ASN.1 semantics of a SET. > > In the GSS-API C-Bindings, the gss_OID_set has always been an > array of OIDs, and for those API calls where order makes sense, > the oder of OIDs in the array indicates a preference, > e.g. the gss_OID_set returned by gss_indicate_mechs(). RFC2744 has this to say about the subject in the description of gss_add_oid_set_member(): The routine may add the new member OID anywhere within the elements array, and implementations should verify that the new member_oid is not already contained within the elements array; if the member_oid is already present, the oid_set should remain unchanged. > Therefore, the definition of GSS_Set/Get_neg_mechs() is fine with rfc2743/44 > and provides a means to indicate an order of preference. See above; OID sets are _sets_ not sequences, in the C bindings. And I note that rfc2743 does not use 'SEQUENCE OF' at all while rfc2744 does not specify any sort of array type. Together with the rfc2744 text on OID sets I think the evidence is resounding that the C-bindings simply do not provide for any mapping of a generic 'SEQUENCE OF' to C constructs. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 20 15:49:59 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03210; Mon, 20 Dec 2004 15:49:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgUd1-0002sw-Ke; Mon, 20 Dec 2004 15:59:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgUSa-000138-F6; Mon, 20 Dec 2004 15:48:52 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgUQA-0008Cu-3r for kitten@megatron.ietf.org; Mon, 20 Dec 2004 15:46:22 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03052 for ; Mon, 20 Dec 2004 15:46:20 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgUZT-0002oq-6w for kitten@ietf.org; Mon, 20 Dec 2004 15:56:00 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iBKKkJVu013239 for ; Mon, 20 Dec 2004 13:46:19 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBKKkJjW019554 for ; Mon, 20 Dec 2004 13:46:19 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBKKjKsx182539; Mon, 20 Dec 2004 14:45:20 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBKKjKW2182538; Mon, 20 Dec 2004 14:45:20 -0600 (CST) Date: Mon, 20 Dec 2004 14:45:20 -0600 From: Nicolas Williams To: Bill Sommerfeld Message-ID: <20041220204520.GD182500@binky.central.sun.com> Mail-Followup-To: Bill Sommerfeld , kitten@ietf.org, Sam Hartman , Russ Housley References: <1102115448.10024.3.camel@thunk> <1103226365.1434.192.camel@unknown.hamachi.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1103226365.1434.192.camel@unknown.hamachi.org> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 Cc: kitten@ietf.org, Russ Housley , Sam Hartman Subject: Re: Review: of draft-ietf-kitten-2478bis-03.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6e922792024732fb1bb6f346e63517e4 On Thu, Dec 16, 2004 at 09:14:09PM -0500, Bill Sommerfeld wrote: > Sam Hartman asked me to look at the 2478bis-03 draft. > > I should first say that it's been a long time since i've looked at > anything GSSAPI related at this level of detail. My review is largely > confined to higher level details; I'll leave it to someone else to > determine if the bits-on-the-wire encodings match reality. > > 1) safety of omitting mechlistMIC: > > The safety, or lack there of, of making the mechlistMIC optional > appears to depend in part on all of the acceptable mechanisms sharing a > property: they will never mistake a token for another mechanism as if > it were intended for them. this property needs to be explicitly > spelled out in the spec. > > The safety of omitting the mechlistMIC when the first choice is picked > depends on mechanisms reliably rejecting tokens not intended for them; > this property needs to be documented. Bill's right. Some of you may remember a similar issue when we considered how the new Kerberos V mechanism might be extended in the future. And Bill's thought experiment is not so far fetched. The OID in the initial token outer wrapper could be used to select different semantics for mechs with similar syntax and credentials, though that be inadvisable unless those mechanisms actually provide integrity protection for that OID (note that none of the mechs defined by IETF documents do). > 2) excessive optimistic negotiation flexibility. > > Excessive numbers of options and configuration knobs present a real > cost to implementors and users. > > whether or not to send an optimistic token should perhaps be a > property of the mechanism, either in the mechanism spec (for new > mechanisms) or in a separate spec. Unfortunately changing the SPNEGO's OID is out of the question -- how would one negotiate which version of SPNEGO to use? How would new implementations interop with currently deployed Windows implementations? > 3) a potential race condition (page 6: client "MUST NOT" include mechs > it doesn't't have creds for in the list of acceptable mechanisms). > > Credentials could be administratively deleted between the first > message and the response. when the server responds accepting an > option no longer open to the client, the client will essentially be > forced to abort the negotiation (at application level?) and retry. Credentials can expire in the middle of the context negotiation; when that happens the context negotiation may (should) fail. Tough luck. > It could also be the case that mechanisms requiring an interaction > with an on-line service to produce or validate a token could encounter > a soft failure due to connectivity problems. That's true with or without SPNEGO in the mix. That said, for some mechanisms it'd be a good optimization for SPNEGO to call GSS_Init_sec_context() to determine, prior to offering a mechList, whether the initiator actually would fail to setup a context with the given target acceptor in spite of having credentials. For other mechanisms this be not be an optimization at all, but worse. > the net result of this is an exchange which looks to the server or an > external third-party observer as if the client violated this MUST > NOT... But is that a problem? I don't think so. > 4) This statement in appendix B needs more detail. > > "Even if there are such implementations, it is > unlikely that they will interoperate because of a critical flaw in > the description of the encoding of the mechanism list in RFC 2478." > > what was this flaw? if there are multiple possible interpretations, > an implementation could well try multiple reformulations of the input > to the hash function.. > > overall: > allow implementations to cache state and/or policy about peer > capabilities, as a better interoperability solution than > failing to interop with the RFC? If interop with legacy implementations means reduced security then caching knowledge about legacyness of peers seems dangerous. Policy, OTOH, is different; OOB policy should be allowed, but if there's no standard mechanism for distributing such policy then it should probably not be encouraged. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 20 16:40:12 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12061; Mon, 20 Dec 2004 16:40:12 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgVPc-00065e-Aj; Mon, 20 Dec 2004 16:49:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgUyK-0002VQ-8O; Mon, 20 Dec 2004 16:21:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgUY8-0003Ui-M6 for kitten@megatron.ietf.org; Mon, 20 Dec 2004 15:54:36 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03554 for ; Mon, 20 Dec 2004 15:54:34 -0500 (EST) Received: from cs2876-92.austin.rr.com ([24.28.76.92] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgUhS-000386-0R for kitten@ietf.org; Mon, 20 Dec 2004 16:04:15 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id 9C5A7E0063; Mon, 20 Dec 2004 15:55:17 -0500 (EST) To: Martin Rex References: <20041215112536.GQ135801@binky.central.sun.com> <200412201829.TAA25300@uw1048.wdf.sap.corp> <20041220183606.GA135800@binky.central.sun.com> From: Sam Hartman Date: Mon, 20 Dec 2004 15:55:17 -0500 In-Reply-To: <20041220183606.GA135800@binky.central.sun.com> (Nicolas Williams's message of "Mon, 20 Dec 2004 12:36:06 -0600") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 2870a44b67ee17965ce5ad0177e150f4 Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014 I'd recommend rephrasing your argument without reference to ASN.1. It will I think avoid unnecessary confusion. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 20 16:40:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12382; Mon, 20 Dec 2004 16:40:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgVQL-0006BW-Jl; Mon, 20 Dec 2004 16:50:38 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgV3T-0006AR-Rh; Mon, 20 Dec 2004 16:26:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgUmn-00033f-HR for kitten@megatron.ietf.org; Mon, 20 Dec 2004 16:09:45 -0500 Received: from serrano.cc.columbia.edu (IDENT:cu41754@serrano.cc.columbia.edu [128.59.206.20]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05481 for ; Mon, 20 Dec 2004 16:09:42 -0500 (EST) Received: from [192.168.1.66] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by serrano.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iBKL9hAc017369 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Mon, 20 Dec 2004 16:09:44 -0500 (EST) Message-ID: <41C73FF5.5090709@columbia.edu> Date: Mon, 20 Dec 2004 16:11:17 -0500 From: Jeffrey Altman Organization: Not Affiliated with Columbia University in the City of New York User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041217 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org X-Enigmail-Version: 0.89.6.0 X-Enigmail-Supports: pgp-inline, pgp-mime X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.20 Subject: Status of SPNEGO WGLC X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1256953700==" Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7fa173a723009a6ca8ce575a65a5d813 This is a cryptographically signed message in MIME format. --===============1256953700== Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms080008010406090700030801" This is a cryptographically signed message in MIME format. --------------ms080008010406090700030801 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit The WGLC for SPNEGO ended on Thursday morning. Late Thursday night and Friday morning additional reviews of the document were submitted. These reviews had been requested by the A.D. As a result of these reviews on top of the compromised discussions which took place on Tuesday and Wednesday, I determined that the draft would not have passed an IETF Last Call at the current time. It is my hope that the document can be revised to address all outstanding issues over the next ten days. If there is consensus on the list at that time, I will recommend the document be sent to the IESG for an IETF Last Call. Jeffrey Altman --------------ms080008010406090700030801 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJPzCC AvowggJjoAMCAQICAwxk8TANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UE ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNv bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDQwNTI3MTc1ODU4WhcNMDUwNTI3MTc1ODU4 WjBrMQ8wDQYDVQQEEwZBbHRtYW4xFTATBgNVBCoTDEplZmZyZXkgRXJpYzEcMBoGA1UEAxMT SmVmZnJleSBFcmljIEFsdG1hbjEjMCEGCSqGSIb3DQEJARYUamFsdG1hbkBjb2x1bWJpYS5l ZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc3JqO5AsZrozd+mJ2mPuCTYo2 +nJ9Qq6jtUYtp7YTMW4d2Q6GLhNaHb1l9m74SxuY4f5vP6JtZjr6p9+LCCxD0w0NVLKRgUDp z+tKFitbkJe9BSCxCURRvY3vdWA71gSCUvZAN3346hHb4oGVqgdpmfFJXYAHWpC46wiL72N9 WxySzY17/0eU0c8+r9dNoLpPQeL43O66O80jCl1qnXMaXaakZPsfm+5W90MYXhpQ1WIQpv02 lBn3BH5YE8xwbsNrw5AF4v7pjMuW85GI6FrDmfbpJX473Rpl5rmv3TpXkJ+7UsIIO1puyS8r 1o7kjDZ5EUYJxxglTGR6XL/RNzqHAgMBAAGjMTAvMB8GA1UdEQQYMBaBFGphbHRtYW5AY29s dW1iaWEuZWR1MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAZYeVFCMP0iV+UVa0 eFoXkzMVl61CNAVY2YQ9/QQazO3G4qNiif35ArrnjPRDRj5M7WTeOCFqPVuvCttyJRiDKsEe L4Yah22mRA3mR7x52j2FquPYZ9qCr1IhrNGzsMk+gopX5G0fTHZb6+uDu5SeMPNNcIznGA7M CMpXAJ2PcKgwggL6MIICY6ADAgECAgMMZPEwDQYJKoZIhvcNAQEEBQAwYjELMAkGA1UEBhMC WkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1Ro YXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA0MDUyNzE3NTg1OFoXDTA1 MDUyNzE3NTg1OFowazEPMA0GA1UEBBMGQWx0bWFuMRUwEwYDVQQqEwxKZWZmcmV5IEVyaWMx HDAaBgNVBAMTE0plZmZyZXkgRXJpYyBBbHRtYW4xIzAhBgkqhkiG9w0BCQEWFGphbHRtYW5A Y29sdW1iaWEuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3NyajuQLGa6M 3fpidpj7gk2KNvpyfUKuo7VGLae2EzFuHdkOhi4TWh29ZfZu+EsbmOH+bz+ibWY6+qffiwgs Q9MNDVSykYFA6c/rShYrW5CXvQUgsQlEUb2N73VgO9YEglL2QDd9+OoR2+KBlaoHaZnxSV2A B1qQuOsIi+9jfVscks2Ne/9HlNHPPq/XTaC6T0Hi+NzuujvNIwpdap1zGl2mpGT7H5vuVvdD GF4aUNViEKb9NpQZ9wR+WBPMcG7Da8OQBeL+6YzLlvORiOhaw5n26SV+O90aZea5r906V5Cf u1LCCDtabskvK9aO5Iw2eRFGCccYJUxkely/0Tc6hwIDAQABozEwLzAfBgNVHREEGDAWgRRq YWx0bWFuQGNvbHVtYmlhLmVkdTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBAGWH lRQjD9IlflFWtHhaF5MzFZetQjQFWNmEPf0EGsztxuKjYon9+QK654z0Q0Y+TO1k3jghaj1b rwrbciUYgyrBHi+GGodtpkQN5ke8edo9harj2Gfagq9SIazRs7DJPoKKV+RtH0x2W+vrg7uU njDzTXCM5xgOzAjKVwCdj3CoMIIDPzCCAqigAwIBAgIBDTANBgkqhkiG9w0BAQUFADCB0TEL MAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3du MRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENB MSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTAzMDcx NzAwMDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0 ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVl bWFpbCBJc3N1aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEpjxVc1X7TrnK mVoeaMB1BHCd3+n/ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuFWqo/ cVbLrzwLB+fxH5E2JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8 YQRAHmQZcmC3+wIDAQABo4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4 oDagNIYyaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS5j cmwwCwYDVR0PBAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwy LTEzODANBgkqhkiG9w0BAQUFAAOBgQBIjNFQg+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4 Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZfoSxmRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowg T2Vfldr394fWxghOrvbqNOUQGls1TXfjViF4gtwhGTXeJLHTHUb/XV9lTzGCAzswggM3AgEB MGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0 ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMMZPEw CQYFKw4DAhoFAKCCAacwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUx DxcNMDQxMjIwMjExMTE3WjAjBgkqhkiG9w0BCQQxFgQU6UlSCBFuWfo2MSI6gJ+XYJZmUSQw UgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcN AwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgweAYJKwYBBAGCNxAEMWswaTBiMQswCQYD VQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAwxk8TB6BgsqhkiG9w0B CRACCzFroGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB AgMMZPEwDQYJKoZIhvcNAQEBBQAEggEABJrtNx/+xEtXsR6zs9gdwO4XiJZHzRPshpdd5cWd ze2sTV3607I5aS0TjOJwOzd8KJ063wz/z5WHbr98rGAI6Glb22BZd0/4vG+6+RrUhvYonVTo YOYVzzqz7p6i/nq8VglLy1B4GkFDglwifBZcbzI+lDmMrA3ORpVLaM5qWhdIyMzIkxd5BR0q x7PmPr3XI8Sl+JRGESoH4cNmXbzXWg5VHsnqMwh63zulojPQhTAPOrmeitx6VmOTNEhArp4V f2PQt41YfKSwNTl5xUEBSo/0IlFGBWeglWDZ9uyYQ6DMuJhluHyHIMlpir+i7whvEXRMxEWU NpWhKquWuKCS2gAAAAAAAA== --------------ms080008010406090700030801-- --===============1256953700== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --===============1256953700==-- From kitten-bounces@ietf.org Mon Dec 20 19:05:21 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA27359; Mon, 20 Dec 2004 19:05:21 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgXg8-00020d-8K; Mon, 20 Dec 2004 19:15:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgXVj-0006gu-HK; Mon, 20 Dec 2004 19:04:19 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgXNm-00061S-GA for kitten@megatron.ietf.org; Mon, 20 Dec 2004 18:56:06 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA26833 for ; Mon, 20 Dec 2004 18:56:03 -0500 (EST) Received: from smtpde03.sap-ag.de ([155.56.68.140]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgXWy-0001oa-Cm for kitten@ietf.org; Mon, 20 Dec 2004 19:05:46 -0500 Received: from sap-ag.de (smtpde03) by smtpde03.sap-ag.de (out) with ESMTP id AAA10604; Tue, 21 Dec 2004 00:55:21 +0100 (MEZ) From: Martin Rex Message-Id: <200412202355.AAA28037@uw1048.wdf.sap.corp> To: Nicolas.Williams@sun.com (Nicolas Williams) Date: Tue, 21 Dec 2004 00:55:20 +0100 (MET) In-Reply-To: <20041220183606.GA135800@binky.central.sun.com> from "Nicolas Williams" at Dec 20, 4 12:36:06 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: 8f374d0786b25a451ef87d82c076f593 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 200d029292fbb60d25b263122ced50fc Content-Transfer-Encoding: 8bit Nicolas Williams wrote: > > > rfc2478 uses the same terminology to describe GSS_Set_mechs/GSS_Get_mechs > > function parameters as rfc2743. However the "SET OF OBJECT IDENTIFIER" > > is **NOT** meant to imply all of the ASN.1 semantics of a SET. > > > > In the GSS-API C-Bindings, the gss_OID_set has always been an > > array of OIDs, and for those API calls where order makes sense, > > the oder of OIDs in the array indicates a preference, > > e.g. the gss_OID_set returned by gss_indicate_mechs(). > > RFC2744 has this to say about the subject in the description of > gss_add_oid_set_member(): > > The routine may add the new member OID anywhere within > the elements array, and implementations should verify that the new > member_oid is not already contained within the elements array; if the > member_oid is already present, the oid_set should remain unchanged. The GSS-API spec uses only a single data type to pass more than a single OID between gssapi mechanism and application, and that data type is called "SET OF OBJECT IDENTIFIER" by rfc2743. In most cases, this should be considered a SET, meaning that if you want to check for a particular OID, you'll have to check all members. However, this convention was never meant to preclude the (ab)use of this datatype to convey a list of OIDs ordered by preference. And, in fact, this has been done from the days of GSS-API v1 for the return parameter of gss_indicate_mechs() and the input parameter to gss_acquire_cred() by several gssapi mechanisms. That includes MIT Kerberos 5. The definition of GSS_Set_mechs/GSS_Get_mechs in rfc2478 may be the first place where a gss_OID_set is explicitly treated as an ordered list at the spec level, but it is certainly not the first such use. And there was no suprize or contention about that kind of use among the CAT participants when SPNEGO was discussed, simply because everyone was used to doing it. > > > Therefore, the definition of GSS_Set/Get_neg_mechs() is fine with rfc2743/44 > > and provides a means to indicate an order of preference. > > See above; OID sets are _sets_ not sequences, in the C bindings. Nope. The C-Bindings define the gss_OID_set type as a top-level data-structure pointing to an array of gss_OIDs. typedef struct gss_OID_set_desc_struct { size_t count; gss_OID elements; } gss_OID_set_desc, *gss_OID_set; Except for __implementations__ of gss_add_oid_set_member(), applications and gssapi mechanisms are neither required nor expected to "enforce" any kind of "SET" semantics on gss_OID_set data types passed through GSS-API calls. I.e. an application may pass along a gss_OID_set with duplicate OIDs or gss_OID_set ordered by preference. Do you think that CAT should have created a seperate data type and forked gss_indicate_mechs() and gss_acquire_cred() into two seperate API calls? I certainly don't! > > And I note that rfc2743 does not use 'SEQUENCE OF' at all while rfc2744 > does not specify any sort of array type. Together with the rfc2744 > text on OID sets I think the evidence is resounding that the C-bindings > simply do not provide for any mapping of a generic 'SEQUENCE OF' to C > constructs. Huh? Quoting rfc2744: 3.4. Object Identifier Sets Certain GSS-API procedures take parameters of the type gss_OID_set. This type represents one or more object identifiers (section 2.3). A gss_OID_set object has the following structure: typedef struct gss_OID_set_desc_struct { size_t count; gss_OID elements; } gss_OID_set_desc, *gss_OID_set; The count field contains the number of OIDs within the set. The elements field is a pointer to an array of gss_OID_desc objects, each of which describes a single OID. gss_OID_set values are used to name the available mechanisms supported by the GSS-API, to request the use of specific mechanisms, and to indicate which mechanisms a given credential supports. All OID sets returned to the application by GSS-API are dynamic objects (the gss_OID_set_desc, the "elements" array of the set, and the "elements" array of each member OID are all dynamically allocated), and this storage must be deallocated by the application using the gss_release_oid_set() routine. Above is the entire definition of gss_OID_set. Take note that it does *NOT* require a gss_OID_set not to contain duplicates! (the requirement to not create duplicate OIDs within a gss_OID_set is **ONLY** for implementations of gss_add_oid_set_member(), a new and hardly used call for GSS-API v2). GSS-API (v1) already defined the set of OIDs data type. There are several uses where the set is treated as an ordered set, and there never was and still isn't a restriction in GSS-API that precludes this. RFC-2478 makes explicit uses of the fact that the GSS-API data type "SET OF OIDS" may be treated as a an ordered list ("sequence"), and noone from the ietf-cat wg had a problem with that. Quoting a reply from Denis Pinkas (the rfc2478 document author): : From: pinkas@emsc.frcl.bull.fr (Denis Pinkas) : Date: Thu, 16 Mar 1995 17:56:00 +0100 (NFT) : To: rosenthl@mcc.com (Doug Rosenthal) : Cc: linn@cam.ov.com, E.Baize@frcl.bull.fr, cat-ietf@mit.edu : Subject: Re: Simple GSS-API Negotiation Mechanism [...] : : rosenthl@mcc.com wrote: : : - Also wrt the ordered list of mechanism type/option pairs, it appears : : that there is no way for the application to influence the ordering, : : i.e. that the ordering is defined by the GSSAPI implementation. : : This is wrong. The GSS_set_neg_mechs is just there to do what you want. Nobody from the ietf-cat wg objected to the use of gss_OID_set as an ordered list for GSS_set/get_neg_mechs, simply because most of the participants have been doing it themselves and were quite used to the concept. -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 20 19:08:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA27641; Mon, 20 Dec 2004 19:08:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgXih-00023T-Kl; Mon, 20 Dec 2004 19:17:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgXYR-0007aG-1J; Mon, 20 Dec 2004 19:07:07 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgXXx-0007Mu-2f for kitten@megatron.ietf.org; Mon, 20 Dec 2004 19:06:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA27469 for ; Mon, 20 Dec 2004 19:06:33 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgXhG-00021s-RD for kitten@ietf.org; Mon, 20 Dec 2004 19:16:17 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iBL06WVu016287 for ; Mon, 20 Dec 2004 17:06:33 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBL06WjW002451 for ; Mon, 20 Dec 2004 17:06:32 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBL05XDA182832; Mon, 20 Dec 2004 18:05:33 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBL05Wpa182831; Mon, 20 Dec 2004 18:05:32 -0600 (CST) Date: Mon, 20 Dec 2004 18:05:32 -0600 From: Nicolas Williams To: Martin Rex Message-ID: <20041221000532.GM182500@binky.central.sun.com> Mail-Followup-To: Martin Rex , kitten@ietf.org References: <20041220183606.GA135800@binky.central.sun.com> <200412202355.AAA28037@uw1048.wdf.sap.corp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412202355.AAA28037@uw1048.wdf.sap.corp> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 1449ead51a2ff026dcb23465f5379250 Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 848ed35f2a4fc0638fa89629cb640f48 On Tue, Dec 21, 2004 at 12:55:20AM +0100, Martin Rex wrote: > Nicolas Williams wrote: > > > > > rfc2478 uses the same terminology to describe GSS_Set_mechs/GSS_Get_mechs > > > function parameters as rfc2743. However the "SET OF OBJECT IDENTIFIER" > > > is **NOT** meant to imply all of the ASN.1 semantics of a SET. > > > > > > In the GSS-API C-Bindings, the gss_OID_set has always been an > > > array of OIDs, and for those API calls where order makes sense, > > > the oder of OIDs in the array indicates a preference, > > > e.g. the gss_OID_set returned by gss_indicate_mechs(). > > > > RFC2744 has this to say about the subject in the description of > > gss_add_oid_set_member(): > > > > The routine may add the new member OID anywhere within > > the elements array, and implementations should verify that the new > > member_oid is not already contained within the elements array; if the > > member_oid is already present, the oid_set should remain unchanged. > > The GSS-API spec uses only a single data type to pass more than > a single OID between gssapi mechanism and application, and that > data type is called "SET OF OBJECT IDENTIFIER" by rfc2743. > > In most cases, this should be considered a SET, meaning that if you > want to check for a particular OID, you'll have to check all members. > > However, this convention was never meant to preclude the (ab)use of > this datatype to convey a list of OIDs ordered by preference. Abuse indeed. To build a gss_OID_set without resorting to gss_add_oid_set_member() means not being able to use gss_release_oid_set() to release it, and re-ordering a set's elements array after building it with gss_add_oid_set_member() is icky. > And, in fact, this has been done from the days of GSS-API v1 for the > return parameter of gss_indicate_mechs() and the input parameter to > gss_acquire_cred() by several gssapi mechanisms. > That includes MIT Kerberos 5. Those don't care about order in gss OID sets though, do they? > > The definition of GSS_Set_mechs/GSS_Get_mechs in rfc2478 may be > the first place where a gss_OID_set is explicitly treated as > an ordered list at the spec level, but it is certainly not > the first such use. And there was no suprize or contention about > that kind of use among the CAT participants when SPNEGO was > discussed, simply because everyone was used to doing it. RFC2478 was wrong to do this. > > > > > > Therefore, the definition of GSS_Set/Get_neg_mechs() is fine with rfc2743/44 > > > and provides a means to indicate an order of preference. > > > > See above; OID sets are _sets_ not sequences, in the C bindings. > > Nope. > > The C-Bindings define the gss_OID_set type as a top-level data-structure > pointing to an array of gss_OIDs. > > typedef struct gss_OID_set_desc_struct { > size_t count; > gss_OID elements; > } gss_OID_set_desc, *gss_OID_set; > > Except for __implementations__ of gss_add_oid_set_member(), > applications and gssapi mechanisms are neither required nor expected > to "enforce" any kind of "SET" semantics on gss_OID_set data types > passed through GSS-API calls. I.e. an application may pass along > a gss_OID_set with duplicate OIDs or gss_OID_set ordered by preference. > > > Do you think that CAT should have created a seperate data type > and forked gss_indicate_mechs() and gss_acquire_cred() into two > seperate API calls? I certainly don't! GSS_Indicate_mechs() and GSS_Acquire_cred() do not care about order in OID sets. > > > > > And I note that rfc2743 does not use 'SEQUENCE OF' at all while rfc2744 > > does not specify any sort of array type. Together with the rfc2744 > > text on OID sets I think the evidence is resounding that the C-bindings > > simply do not provide for any mapping of a generic 'SEQUENCE OF' to C > > constructs. > > Huh? Quoting rfc2744: > > 3.4. Object Identifier Sets > > Certain GSS-API procedures take parameters of the type gss_OID_set. > This type represents one or more object identifiers (section 2.3). A > gss_OID_set object has the following structure: > > typedef struct gss_OID_set_desc_struct { > size_t count; > gss_OID elements; > } gss_OID_set_desc, *gss_OID_set; > > The count field contains the number of OIDs within the set. The > elements field is a pointer to an array of gss_OID_desc objects, each > of which describes a single OID. gss_OID_set values are used to name > the available mechanisms supported by the GSS-API, to request the use > of specific mechanisms, and to indicate which mechanisms a given > credential supports. > > All OID sets returned to the application by GSS-API are dynamic > objects (the gss_OID_set_desc, the "elements" array of the set, and > the "elements" array of each member OID are all dynamically > allocated), and this storage must be deallocated by the application > using the gss_release_oid_set() routine. > > > Above is the entire definition of gss_OID_set. Take note that it > does *NOT* require a gss_OID_set not to contain duplicates! But the presecribed method for creating OID sets is gss_add_oid_set_member() and we know what that has to say about order. > (the requirement to not create duplicate OIDs within a gss_OID_set > is **ONLY** for implementations of gss_add_oid_set_member(), > a new and hardly used call for GSS-API v2). "Hardly?" > GSS-API (v1) already defined the set of OIDs data type. There are > several uses where the set is treated as an ordered set, and there > never was and still isn't a restriction in GSS-API that precludes this. > > RFC-2478 makes explicit uses of the fact that the GSS-API data type > "SET OF OIDS" may be treated as a an ordered list ("sequence"), > and noone from the ietf-cat wg had a problem with that. > > Quoting a reply from Denis Pinkas (the rfc2478 document author): > > : From: pinkas@emsc.frcl.bull.fr (Denis Pinkas) > : Date: Thu, 16 Mar 1995 17:56:00 +0100 (NFT) > : To: rosenthl@mcc.com (Doug Rosenthal) > : Cc: linn@cam.ov.com, E.Baize@frcl.bull.fr, cat-ietf@mit.edu > : Subject: Re: Simple GSS-API Negotiation Mechanism > [...] > : > : rosenthl@mcc.com wrote: > : : - Also wrt the ordered list of mechanism type/option pairs, it appears > : : that there is no way for the application to influence the ordering, > : : i.e. that the ordering is defined by the GSSAPI implementation. > : > : This is wrong. The GSS_set_neg_mechs is just there to do what you want. > > Nobody from the ietf-cat wg objected to the use of gss_OID_set as an > ordered list for GSS_set/get_neg_mechs, simply because most of the > participants have been doing it themselves and were quite used to > the concept. I object now. Providing a C binding for SEQUENCE OF OBJECT IDENTIFIER seems like a perfectly worthwhile task for KITTEN. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 20 19:58:14 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA00192; Mon, 20 Dec 2004 19:58:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgYVJ-00034G-R5; Mon, 20 Dec 2004 20:07:59 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgYKv-0007Vm-Qa; Mon, 20 Dec 2004 19:57:13 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgYIR-000703-PM for kitten@megatron.ietf.org; Mon, 20 Dec 2004 19:54:39 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA00048 for ; Mon, 20 Dec 2004 19:54:36 -0500 (EST) Received: from smtpde03.sap-ag.de ([155.56.68.140]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgYRo-0002zU-7N for kitten@ietf.org; Mon, 20 Dec 2004 20:04:20 -0500 Received: from sap-ag.de (smtpde03) by smtpde03.sap-ag.de (out) with ESMTP id BAA09264; Tue, 21 Dec 2004 01:54:06 +0100 (MEZ) From: Martin Rex Message-Id: <200412210054.BAA28543@uw1048.wdf.sap.corp> To: Nicolas.Williams@sun.com (Nicolas Williams) Date: Tue, 21 Dec 2004 01:54:05 +0100 (MET) In-Reply-To: <20041221000532.GM182500@binky.central.sun.com> from "Nicolas Williams" at Dec 20, 4 06:05:32 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: b7b9551d71acde901886cc48bfc088a6 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 10ba05e7e8a9aa6adb025f426bef3a30 Content-Transfer-Encoding: 8bit Nicolas Williams wrote: > > > The GSS-API spec uses only a single data type to pass more than > > a single OID between gssapi mechanism and application, and that > > data type is called "SET OF OBJECT IDENTIFIER" by rfc2743. > > > > In most cases, this should be considered a SET, meaning that if you > > want to check for a particular OID, you'll have to check all members. > > > > However, this convention was never meant to preclude the (ab)use of > > this datatype to convey a list of OIDs ordered by preference. > > Abuse indeed. To build a gss_OID_set without resorting to > gss_add_oid_set_member() means not being able to use > gss_release_oid_set() to release it, and re-ordering a set's elements > array after building it with gss_add_oid_set_member() is icky. No-one in their right minds uses gss_add_oid_set_member(). I mean that. For most purposes an automatic or static gss_OID_set is perfectly sufficient. Just think about the complex error handling that gss_* API calls require. And if an application is truely portable, then it will be able to run on top of GSS-API v1 mechanisms as well -- and there it doesn't have gss_add_oid_set_member(). And once an application needs to supply it's own code to compose those gss_OID_set that it needs, it would be outright stupid to call gss_add_oid_set_member() on those few occasion where it was available. > > > And, in fact, this has been done from the days of GSS-API v1 for the > > return parameter of gss_indicate_mechs() and the input parameter to > > gss_acquire_cred() by several gssapi mechanisms. > > That includes MIT Kerberos 5. > > Those don't care about order in gss OID sets though, do they? THEY DO. > > > Do you think that CAT should have created a seperate data type > > and forked gss_indicate_mechs() and gss_acquire_cred() into two > > seperate API calls? I certainly don't! > > GSS_Indicate_mechs() and GSS_Acquire_cred() do not care about order in > OID sets. The spec for those calls doesn't care. But many gssapi mechanisms and some applications *DO* care, whether you like it or not. > > But the presecribed method for creating OID sets is > gss_add_oid_set_member() and we know what that has to say about order. NOPE. The definition of gss_add_oid_set_member() only defines how this particular new call modifies only those gss_OID_sets created by gss_create_empty_oid_set(), *NOTHING* else. > > > (the requirement to not create duplicate OIDs within a gss_OID_set > > is **ONLY** for implementations of gss_add_oid_set_member(), > > a new and hardly used call for GSS-API v2). > > "Hardly?" Yes, exactly. > > Providing a C binding for SEQUENCE OF OBJECT IDENTIFIER seems like a > perfectly worthwhile task for KITTEN. That's entirely silly. gss_OID_set covers both, sets and ordered lists in the existing specs and the installed base. -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 20 20:27:56 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA01656; Mon, 20 Dec 2004 20:27:56 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgYy3-0003dY-HC; Mon, 20 Dec 2004 20:37:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgYnq-0004UX-3Q; Mon, 20 Dec 2004 20:27:06 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgYfI-0003aj-O1 for kitten@megatron.ietf.org; Mon, 20 Dec 2004 20:18:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA01316 for ; Mon, 20 Dec 2004 20:18:15 -0500 (EST) Received: from smtpde02.sap-ag.de ([155.56.68.170]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgYoe-0003RS-Ed for kitten@ietf.org; Mon, 20 Dec 2004 20:27:57 -0500 Received: from sap-ag.de (smtpde02) by smtpde02.sap-ag.de (out) with ESMTP id CAA08996; Tue, 21 Dec 2004 02:17:42 +0100 (MEZ) From: Martin Rex Message-Id: <200412210117.CAA28717@uw1048.wdf.sap.corp> To: Nicolas.Williams@sun.com (Nicolas Williams) Date: Tue, 21 Dec 2004 02:17:40 +0100 (MET) In-Reply-To: <20041221000532.GM182500@binky.central.sun.com> from "Nicolas Williams" at Dec 20, 4 06:05:32 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 Content-Transfer-Encoding: 8bit Nicolas Williams wrote: > > > However, this convention was never meant to preclude the (ab)use of > > this datatype to convey a list of OIDs ordered by preference. > > Abuse indeed. To build a gss_OID_set without resorting to > gss_add_oid_set_member() means not being able to use > gss_release_oid_set() to release it, and re-ordering a set's elements > array after building it with gss_add_oid_set_member() is icky. As I've explained before, sane applications will roll those few (if any) gss_OID_set that they need without gss_add_oid_set_member() resulting in significantly less code, and portable gssapi based applications (performing dynamic runtime loading) are not going to use those calls anyway. > > RFC2478 was wrong to do this. RFC2478 received consensus from the cat-ietf working group for doing it the way it does. > > I object now. > > Providing a C binding for SEQUENCE OF OBJECT IDENTIFIER seems like a > perfectly worthwhile task for KITTEN. GSS-API also uses a gss_buffer_t to pass both, binary blobs (tokens) and printable strings between application and gssapi mechanism. It dependes on the context and situation whether the contents of the gss_buffer_t are interpreted as strings or as binary blobs. Same goes for gss_OID_set. A gss_OID_set is an array of OIDs. What the OIDs mean and whether the order of the OIDs in the array is relevant depends on the particular API call and the purpose of the OID array. -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 00:13:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA16426; Tue, 21 Dec 2004 00:13:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgcTu-0000K8-Lb; Tue, 21 Dec 2004 00:22:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgcK3-0004pF-NB; Tue, 21 Dec 2004 00:12:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgcIC-0003pW-1J for kitten@megatron.ietf.org; Tue, 21 Dec 2004 00:10:40 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA16295 for ; Tue, 21 Dec 2004 00:10:36 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgcRZ-0000Gg-OT for kitten@ietf.org; Tue, 21 Dec 2004 00:20:23 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBL5Abdt026855 for ; Mon, 20 Dec 2004 22:10:37 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBL5AbJf014105 for ; Mon, 20 Dec 2004 22:10:37 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBL59cCs183056; Mon, 20 Dec 2004 23:09:38 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBL59bhu183055; Mon, 20 Dec 2004 23:09:37 -0600 (CST) Date: Mon, 20 Dec 2004 23:09:37 -0600 From: Nicolas Williams To: Martin Rex Message-ID: <20041221050937.GP182500@binky.central.sun.com> Mail-Followup-To: Martin Rex , kitten@ietf.org References: <20041221000532.GM182500@binky.central.sun.com> <200412210054.BAA28543@uw1048.wdf.sap.corp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412210054.BAA28543@uw1048.wdf.sap.corp> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 On Tue, Dec 21, 2004 at 01:54:05AM +0100, Martin Rex wrote: > Nicolas Williams wrote: > > > And, in fact, this has been done from the days of GSS-API v1 for the > > > return parameter of gss_indicate_mechs() and the input parameter to > > > gss_acquire_cred() by several gssapi mechanisms. > > > That includes MIT Kerberos 5. > > > > Those don't care about order in gss OID sets though, do they? > > THEY DO. They don't. Nothing about the text of RFC2743 about GSS_Indicate_mechs(), GSS_Acquire_cred(), GSS_Add_cred() or GSS_Inquire*() says anything about order in the SET OF OBJECT IDENTIFIER input or output parameters, never mind its significance. As to the SPNEGO interfaces, if we want order to matter (we do) and if there aren't any implementations of the rfc2478 interfaces or none that apps developers are likely to encounter then we should either change those interfaces to use SEQUENCE OF or deprecate and replace them with interfaces that use SEQUENCE OF. And while we're at it we should provide C, and other language, bindings for those interfaces and/or rules for determining the language bindings of the generic interfaces for any of the relevant programming languages. Regardless of whether the C-bindings gss_OID_set_desc type was meant for dual use or was abused now that we know we need SEQUENCE OF for SPNEGO's interfaces we do need to clarify the use of SET OF vs. SEQUENCE OF in the C bindings. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 01:39:59 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA22456; Tue, 21 Dec 2004 01:39:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgdq4-0002OS-CN; Tue, 21 Dec 2004 01:49:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgdfl-0007h5-Qe; Tue, 21 Dec 2004 01:39:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgdfL-0007X0-4q for kitten@megatron.ietf.org; Tue, 21 Dec 2004 01:38:39 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA22402 for ; Tue, 21 Dec 2004 01:38:38 -0500 (EST) Received: from cs2876-92.austin.rr.com ([24.28.76.92] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgdok-0002NX-Pw for kitten@ietf.org; Tue, 21 Dec 2004 01:48:23 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id BFD32E0063; Tue, 21 Dec 2004 01:39:23 -0500 (EST) To: Martin Rex References: <20041221000532.GM182500@binky.central.sun.com> <200412210054.BAA28543@uw1048.wdf.sap.corp> <20041221050937.GP182500@binky.central.sun.com> From: Sam Hartman Date: Tue, 21 Dec 2004 01:39:23 -0500 In-Reply-To: <20041221050937.GP182500@binky.central.sun.com> (Nicolas Williams's message of "Mon, 20 Dec 2004 23:09:37 -0600") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 >>>>> "Nicolas" == Nicolas Williams writes: Nicolas> On Tue, Dec 21, 2004 at 01:54:05AM +0100, Martin Rex Nicolas> wrote: Nicolas> As to the SPNEGO interfaces, if we want order to matter Nicolas> (we do) and if there aren't any implementations of the Nicolas> rfc2478 interfaces or none that apps developers are Nicolas> likely to encounter then we should either change those Nicolas> interfaces to use SEQUENCE OF or deprecate and replace Nicolas> them with interfaces that use SEQUENCE OF. Since when did GSSAPI use ASN.1 as its data model? This claim seems missing from the text in the same way that any specific reference to order of oid set members is missing. >From my point of view, I can think of several implications of assuming that GSS-API does not use ASN.1 as its data model. First, allowing the set type to be ordered might be a reasonable thing to do. Second, it means we should be more explicit both in our descriptions both on the list and in our documents of what the properties of abstract data types we use are. I'm not proposing a specific solution for the document, but I am proposing that we be more explicit of what we mean by a certain data type in our on-list discussions. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 10:35:20 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20710; Tue, 21 Dec 2004 10:35:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgmCE-0006me-OS; Tue, 21 Dec 2004 10:45:10 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgm0T-0002z4-9K; Tue, 21 Dec 2004 10:33:01 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cglsg-00083v-9L for kitten@megatron.ietf.org; Tue, 21 Dec 2004 10:24:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19048 for ; Tue, 21 Dec 2004 10:24:56 -0500 (EST) Received: from smtpde03.sap-ag.de ([155.56.68.140]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgm2A-0006S0-A0 for kitten@ietf.org; Tue, 21 Dec 2004 10:34:46 -0500 Received: from sap-ag.de (smtpde03) by smtpde03.sap-ag.de (out) with ESMTP id QAA25381; Tue, 21 Dec 2004 16:24:21 +0100 (MEZ) From: Martin Rex Message-Id: <200412211524.QAA02297@uw1048.wdf.sap.corp> To: Nicolas.Williams@sun.com (Nicolas Williams) Date: Tue, 21 Dec 2004 16:24:21 +0100 (MET) In-Reply-To: <20041221050937.GP182500@binky.central.sun.com> from "Nicolas Williams" at Dec 20, 4 11:09:37 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8 Content-Transfer-Encoding: 8bit Nicolas Williams wrote: > > They don't. Nothing about the text of RFC2743 about > GSS_Indicate_mechs(), GSS_Acquire_cred(), GSS_Add_cred() or > GSS_Inquire*() says anything about order in the SET OF OBJECT IDENTIFIER > input or output parameters, never mind its significance. A lot of things in GSS-API are "a local matter", i.e. unspecified at the generic level and left up to individual gssapi implementations. When a gssapi mechanism implements more than a single mechanism or mechanism variant, i.e. when gss_indicate_mechs() returns more than a single mechanism OID, then all mechanisms that I know put "their" preferred mechanism OID as the first entry in the gss_OID_set. All gssapi mechanism that I've seen which offer more than a single gssapi mechanism OID do that, including MIT Kerberos 5. There has been an expectation that an application which picks a mechanism OID from the list returned by gss_indicate_mechs() might process the list of OIDs from the beginning, checking whether it recognizes/likes the OID. Portable applications that ask for the default mechanism will supply GSS_C_NO_OID_SET to gss_acquire_cred() or GSS_C_NO_OID to gss_init_sec_context() and leave the selection entirely up to the gssapi mechanism implementation. Similarily, a gssapi mechanism _may_ honor the order of mechanism OIDs in a gss_OID_set passed to gss_acquire_cred() as a local matter. There is no requirement for either behaviour in the spec, permitting both. And for gssapi multimechanisms that have no negotiation capabilities, using the first mechanism OID from the list of OIDs supplied by the application would be a sensible choice for a gssapi mechanism. > > As to the SPNEGO interfaces, if we want order to matter (we do) and if > there aren't any implementations of the rfc2478 interfaces or none that > apps developers are likely to encounter then we should either change > those interfaces to use SEQUENCE OF or deprecate and replace them with > interfaces that use SEQUENCE OF. The Sesame guys (which authored the SNEGO document) have an implementation, even if they don't speak up here. But I really don't understand your problem with the current definition. There's really no need to be formally anal about the language that rfc2743/44 used to describe an array of OIDs. You are artificially creating problems where there are none in reality. If there was a SEQUENCE OF data type, then logically one would expect misc functions similar to gss_add_oid_set_member() to go with it, and that would be excessive spec and code bloat. > > Regardless of whether the C-bindings gss_OID_set_desc type was meant for > dual use or was abused now that we know we need SEQUENCE OF for SPNEGO's > interfaces we do need to clarify the use of SET OF vs. SEQUENCE OF in > the C bindings. It's actually not abuse, but creative use. All of the flexibility in GSS-API that permitted to define v2 in a backward compatible fashion to v1 was from *NOT* being anal about elements already in the spec. The guideline behind GSS-API architecture is to define rules ONLY where absolutely necessary for interoperability, and to leave everything else to the creativity of the implementors ("local matter"). The use of gss_OID_set for both, mathematical unordered sets or for ordered lists depending on the context where they're used and whether it makes sense is in perfect harmony with GSS-API traditions. -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 12:35:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA02740; Tue, 21 Dec 2004 12:35:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgo4n-0001rM-Sm; Tue, 21 Dec 2004 12:45:38 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgni2-00065p-T4; Tue, 21 Dec 2004 12:22:06 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgnTv-0001Fu-Cb for kitten@megatron.ietf.org; Tue, 21 Dec 2004 12:07:32 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29357 for ; Tue, 21 Dec 2004 12:07:28 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgndP-0000Zj-BC for kitten@ietf.org; Tue, 21 Dec 2004 12:17:20 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iBLH7SVu005331 for ; Tue, 21 Dec 2004 10:07:28 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBLH7SjW015711 for ; Tue, 21 Dec 2004 10:07:28 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBLH6Toa183517; Tue, 21 Dec 2004 11:06:29 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBLH6SnF183516; Tue, 21 Dec 2004 11:06:28 -0600 (CST) Date: Tue, 21 Dec 2004 11:06:28 -0600 From: Nicolas Williams To: Sam Hartman Message-ID: <20041221170627.GV182500@binky.central.sun.com> Mail-Followup-To: Sam Hartman , Martin Rex , kitten@ietf.org References: <20041221000532.GM182500@binky.central.sun.com> <200412210054.BAA28543@uw1048.wdf.sap.corp> <20041221050937.GP182500@binky.central.sun.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 On Tue, Dec 21, 2004 at 01:39:23AM -0500, Sam Hartman wrote: > >>>>> "Nicolas" == Nicolas Williams writes: > > Nicolas> On Tue, Dec 21, 2004 at 01:54:05AM +0100, Martin Rex > Nicolas> wrote: > Nicolas> As to the SPNEGO interfaces, if we want order to matter > Nicolas> (we do) and if there aren't any implementations of the > Nicolas> rfc2478 interfaces or none that apps developers are > Nicolas> likely to encounter then we should either change those > Nicolas> interfaces to use SEQUENCE OF or deprecate and replace > Nicolas> them with interfaces that use SEQUENCE OF. > > Since when did GSSAPI use ASN.1 as its data model? This claim seems > missing from the text in the same way that any specific reference to > order of oid set members is missing. > > >From my point of view, I can think of several implications of assuming > that GSS-API does not use ASN.1 as its data model. First, allowing > the set type to be ordered might be a reasonable thing to do. Second, > it means we should be more explicit both in our descriptions both on > the list and in our documents of what the properties of abstract data > types we use are. RFC2743 treats SET OF as just that: a set. The constructor for SET OF specifically describes set semantics. Either the original API used the word "SET" to mean "list" or "SEQUENCE" or what have you and a mistake was made in later adding text that supported set semantics, or folks have been sloppy in allowing for list semantics where the spec called for set semantics. > > I'm not proposing a specific solution for the document, but I am > proposing that we be more explicit of what we mean by a certain data > type in our on-list discussions. We should, indeed, be more careful around set vs. list types and semantics. At minimum I'd like to see C bindings for the SPNEGO functions. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 12:56:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA04168; Tue, 21 Dec 2004 12:56:06 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgoOV-0002Rp-73; Tue, 21 Dec 2004 13:05:59 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgo8p-0005Fg-3E; Tue, 21 Dec 2004 12:49:47 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgntq-00024N-5E for kitten@megatron.ietf.org; Tue, 21 Dec 2004 12:34:18 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA02367 for ; Tue, 21 Dec 2004 12:34:15 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgo3K-0001jE-DO for kitten@ietf.org; Tue, 21 Dec 2004 12:44:07 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iBLHYEiI015419 for ; Tue, 21 Dec 2004 09:34:14 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBLHYDjW028784 for ; Tue, 21 Dec 2004 10:34:14 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBLHXF85183557; Tue, 21 Dec 2004 11:33:15 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBLHXFlr183556; Tue, 21 Dec 2004 11:33:15 -0600 (CST) Date: Tue, 21 Dec 2004 11:33:15 -0600 From: Nicolas Williams To: Martin Rex Message-ID: <20041221173314.GW182500@binky.central.sun.com> Mail-Followup-To: Martin Rex , kitten@ietf.org References: <20041221050937.GP182500@binky.central.sun.com> <200412211524.QAA02297@uw1048.wdf.sap.corp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412211524.QAA02297@uw1048.wdf.sap.corp> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 7fa173a723009a6ca8ce575a65a5d813 Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 37af5f8fbf6f013c5b771388e24b09e7 On Tue, Dec 21, 2004 at 04:24:21PM +0100, Martin Rex wrote: > Nicolas Williams wrote: > > > > They don't. Nothing about the text of RFC2743 about > > GSS_Indicate_mechs(), GSS_Acquire_cred(), GSS_Add_cred() or > > GSS_Inquire*() says anything about order in the SET OF OBJECT IDENTIFIER > > input or output parameters, never mind its significance. > > A lot of things in GSS-API are "a local matter", i.e. unspecified > at the generic level and left up to individual gssapi implementations. Sure, and order in gss_OID_set's output by the GSS framework in some GSS implementation is, indeed one of those, since there must be an order, but that applies only to the C binding of the generic SET OF. What about other languages, ones that provide native types suitable for use in modelling sets, ones which may not provide a canonical order of a set's elements or whose canonical order is not what you might expect? How might a designer translate SET OF from rfc2743 to some new programming language? > When a gssapi mechanism implements more than a single mechanism > or mechanism variant, i.e. when gss_indicate_mechs() returns more > than a single mechanism OID, then all mechanisms that I know put > "their" preferred mechanism OID as the first entry in the gss_OID_set. What if there is no preferred mechanism? > All gssapi mechanism that I've seen which offer more than a single > gssapi mechanism OID do that, including MIT Kerberos 5. MIT offers two OIDs for the same mechanism. And though one of those is obsolete, which makes the other preferred, it is still the same mechanism. There are better examples. Solaris' libgss' gss_indicate_mechs() outputs an OID set where order reflects the order of entries in the /etc/gss/mech configuration file -- talk about local policy! In this example the order is left not to the implementor but to the site. Moreover, on Solaris it is actually possible to have credentials for more than one mechanism be available for any one principal/user, in which case knowing which is preferred tells you nothing about which mechanism your peers might have credentials for. Order really is not relevant to the gss_indicate_mechs(). (MIT's krb5 gss mechanism should really stop indicating the old OID. And if you bring SPKM, with its three variants, into the picture, then I will argue that the application needs a priori knowledge of the difference between them to pick one or it can pick one blindly, with or without "local" help.) > There has been an expectation that an application which picks a > mechanism OID from the list returned by gss_indicate_mechs() might > process the list of OIDs from the beginning, checking whether > it recognizes/likes the OID. Portable applications that ask > for the default mechanism will supply GSS_C_NO_OID_SET to gss_acquire_cred() > or GSS_C_NO_OID to gss_init_sec_context() and leave the selection > entirely up to the gssapi mechanism implementation. The first part is true of C applications. In other languages set enumeration might non-deterministic, and the same can be simulated in C. I agree as to the second part, that rfc2743 is clear as to what GSS_C_NULL_OID means, that a local default may be used as a result, and it is clear that SET OF means 'set'. > Similarily, a gssapi mechanism _may_ honor the order of mechanism OIDs > in a gss_OID_set passed to gss_acquire_cred() as a local matter. > There is no requirement for either behaviour in the spec, permitting both. > And for gssapi multimechanisms that have no negotiation capabilities, > using the first mechanism OID from the list of OIDs supplied by the > application would be a sensible choice for a gssapi mechanism. Applications can negotiate too. Examples of Internet protocols that do include NFSv3 and v4 and Secure Shell version 2. > > > > > As to the SPNEGO interfaces, if we want order to matter (we do) and if > > there aren't any implementations of the rfc2478 interfaces or none that > > apps developers are likely to encounter then we should either change > > those interfaces to use SEQUENCE OF or deprecate and replace them with > > interfaces that use SEQUENCE OF. > > The Sesame guys (which authored the SNEGO document) have > an implementation, even if they don't speak up here. Thanks. > But I really don't understand your problem with the current definition. > There's really no need to be formally anal about the language that > rfc2743/44 used to describe an array of OIDs. You are artificially > creating problems where there are none in reality. There are more programming language bindings for the GSS-API than those standardized at the IETF (e.g., Perl5 bindings). Developers of such bindings may not understand that you want list semantics out of rfc2743's SET OF because none of the text in the spec indicates as much. That's a problem, and I think we should fix it. > If there was a SEQUENCE OF data type, then logically one would expect > misc functions similar to gss_add_oid_set_member() to go with it, > and that would be excessive spec and code bloat. I wouldn't mind a SET OF type that can be safely typecast to SEQUENCE OF, both in the generic API and in the C bindings. Or at least clarification of what rfc2743 means by SET OF. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 13:03:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04841; Tue, 21 Dec 2004 13:03:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgoW5-0002fa-A8; Tue, 21 Dec 2004 13:13:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgoEy-0006ia-OM; Tue, 21 Dec 2004 12:56:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgo7P-00053N-W8 for kitten@megatron.ietf.org; Tue, 21 Dec 2004 12:48:20 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA03653 for ; Tue, 21 Dec 2004 12:48:17 -0500 (EST) Received: from cs2876-92.austin.rr.com ([24.28.76.92] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgoGu-0002Cn-Dj for kitten@ietf.org; Tue, 21 Dec 2004 12:58:09 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id CDC08E0063; Tue, 21 Dec 2004 12:49:01 -0500 (EST) To: martin.rex@sap.com References: <200412210054.BAA28543@uw1048.wdf.sap.corp> From: Sam Hartman Date: Tue, 21 Dec 2004 12:49:01 -0500 In-Reply-To: <200412210054.BAA28543@uw1048.wdf.sap.corp> (Martin Rex's message of "Tue, 21 Dec 2004 01:54:05 +0100 (MET)") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Cc: kitten@ietf.org, Nicolas Williams Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f >>>>> "Martin" == Martin Rex writes: Martin> Nicolas Williams wrote: >> > The GSS-API spec uses only a single data type to pass more >> than > a single OID between gssapi mechanism and application, >> and that > data type is called "SET OF OBJECT IDENTIFIER" by >> rfc2743. >> > >> > In most cases, this should be considered a SET, meaning that >> if you > want to check for a particular OID, you'll have to >> check all members. >> > >> > However, this convention was never meant to preclude the >> (ab)use of > this datatype to convey a list of OIDs ordered by >> preference. >> >> Abuse indeed. To build a gss_OID_set without resorting to >> gss_add_oid_set_member() means not being able to use >> gss_release_oid_set() to release it, and re-ordering a set's >> elements array after building it with gss_add_oid_set_member() >> is icky. Martin> No-one in their right minds uses gss_add_oid_set_member(). Martin> I mean that. For most purposes an automatic or static Martin> gss_OID_set is perfectly sufficient. I think Nico and I have both worked on code bases that use gss_add_oid_set_member. In my case it was ssh. I believe that was clearly the right decision for that code base. I think I'm in my right mind, although I'll realize that sometimes you probably disagree.;) _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 13:28:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA06202; Tue, 21 Dec 2004 13:28:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgotN-0003DR-PE; Tue, 21 Dec 2004 13:37:53 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgoah-0003E5-5M; Tue, 21 Dec 2004 13:18:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgoPk-00012A-VB for kitten@megatron.ietf.org; Tue, 21 Dec 2004 13:07:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05307 for ; Tue, 21 Dec 2004 13:07:14 -0500 (EST) Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgoZF-0002lu-Ho for kitten@ietf.org; Tue, 21 Dec 2004 13:17:07 -0500 Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by nwkea-mail-1.sun.com (8.12.10/8.12.9) with ESMTP id iBLI7EiI004691 for ; Tue, 21 Dec 2004 10:07:14 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBLI7DjW013900 for ; Tue, 21 Dec 2004 11:07:13 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBLI6Fo3183602; Tue, 21 Dec 2004 12:06:15 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBLI6F4a183601; Tue, 21 Dec 2004 12:06:15 -0600 (CST) Date: Tue, 21 Dec 2004 12:06:15 -0600 From: Nicolas Williams To: Sam Hartman Message-ID: <20041221180615.GX182500@binky.central.sun.com> Mail-Followup-To: Sam Hartman , martin.rex@sap.com, kitten@ietf.org References: <200412210054.BAA28543@uw1048.wdf.sap.corp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Cc: kitten@ietf.org Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 On Tue, Dec 21, 2004 at 12:49:01PM -0500, Sam Hartman wrote: > I think Nico and I have both worked on code bases that use > gss_add_oid_set_member. In my case it was ssh. I believe that was > clearly the right decision for that code base. SSHv2, SPNEGO, SASL, internally libgss, mech_krb5; RPCSEC_GSS and NFS code bases could make use of it, and probably should. > I think I'm in my right mind, although I'll realize that sometimes you > probably disagree.;) :) Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 13:36:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA06765; Tue, 21 Dec 2004 13:36:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgp1T-0003Rn-K1; Tue, 21 Dec 2004 13:46:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgok6-0004hw-5d; Tue, 21 Dec 2004 13:28:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgofs-0003wj-KG for kitten@megatron.ietf.org; Tue, 21 Dec 2004 13:23:56 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05986 for ; Tue, 21 Dec 2004 13:23:53 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgopN-00038I-Aj for kitten@ietf.org; Tue, 21 Dec 2004 13:33:46 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iBLINsVu010942 for ; Tue, 21 Dec 2004 11:23:54 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBLINqJf025002 for ; Tue, 21 Dec 2004 11:23:52 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBLIMsDC183627; Tue, 21 Dec 2004 12:22:54 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBLIMsPA183626; Tue, 21 Dec 2004 12:22:54 -0600 (CST) Date: Tue, 21 Dec 2004 12:22:54 -0600 From: Nicolas Williams To: Martin Rex , kitten@ietf.org Message-ID: <20041221182253.GZ182500@binky.central.sun.com> Mail-Followup-To: Martin Rex , kitten@ietf.org References: <20041221050937.GP182500@binky.central.sun.com> <200412211524.QAA02297@uw1048.wdf.sap.corp> <20041221173314.GW182500@binky.central.sun.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041221173314.GW182500@binky.central.sun.com> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199 Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 On Tue, Dec 21, 2004 at 11:33:15AM -0600, Nicolas Williams wrote: > I wouldn't mind a SET OF type that can be safely typecast to SEQUENCE > OF, both in the generic API and in the C bindings. Or at least > clarification of what rfc2743 means by SET OF. I would also be happy to leave RFC2743 mostly as is and clarify that for some language bindings OID sets order may be significant and clarify that for the C bindings it is. This would resolve the SPNEGO issue for me. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 14:38:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10757; Tue, 21 Dec 2004 14:38:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgq01-00053n-Qu; Tue, 21 Dec 2004 14:48:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgppV-0000ci-8K; Tue, 21 Dec 2004 14:37:57 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgpoZ-0000QR-DN for kitten@megatron.ietf.org; Tue, 21 Dec 2004 14:36:59 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10636 for ; Tue, 21 Dec 2004 14:36:57 -0500 (EST) Received: from serrano.cc.columbia.edu ([128.59.206.20] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgpy5-00050f-K6 for kitten@ietf.org; Tue, 21 Dec 2004 14:46:50 -0500 Received: from [192.168.1.66] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by serrano.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iBLJauQh002414 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 21 Dec 2004 14:36:57 -0500 (EST) Message-ID: <41C87BC3.8040405@columbia.edu> Date: Tue, 21 Dec 2004 14:38:43 -0500 From: Jeffrey Altman Organization: Not Affiliated with Columbia University in the City of New York User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041217 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org References: <200412210054.BAA28543@uw1048.wdf.sap.corp> In-Reply-To: X-Enigmail-Version: 0.89.6.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.20 X-Spam-Score: 0.0 (/) X-Scan-Signature: 7fa173a723009a6ca8ce575a65a5d813 Content-Transfer-Encoding: 7bit Subject: Historical context matters was Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 37af5f8fbf6f013c5b771388e24b09e7 Content-Transfer-Encoding: 7bit To the participants of the Kitten Working Group: I would like to take some of the heat out of this discussion. I believe that there is too much talking at each other going on and not enough talking to each other. There is clearly a significant difference of viewpoint in this discussion. In my opinion, the differences of viewpoint are similar to what happens when Congress passes a law and then prosecutors attempt to apply it a century later. The context has changed and therefore the modern interpretation of the law clashes with the intentions of the original authors. When applying laws it is therefore crucial for judges to review the original discussions surrounding the passing of the law; the original context within which the law was applied; and the cases to which the law was applied. This is done to determine the actual intention of the law which is just as important as the words which make up the text of the law. In our world of protocol and api design we have documents which have revision history and implementation history. Only by examining the current documents within their historical context can we determine what the true meanings of the words are. The vast majority of our protocol documents have unwritten assumptions in them which can only be determined by looking at the implementations based upon the documents available at a specific point in time. One of our challenges in this space is that the vast majority of us working on these documents (1) do not have access to the old implementations in order to see what assumptions were made; and (2) do not have the benefit of being involved in the discussions surrounding their publication. For this we *must* defer to those participants who have greater historical knowledge to inform us when the assumptions we are making clash with the assumptions which were made when the documents were originally published. Martin is our connection to the past and I would appreciate it if people would respect that role he is providing for us. It really is an important one. I also ask Martin to respect that the viewpoints of the rest of us are colored by our lack of intimate knowledge with the implementation history of gss api v1 and the assumptions which were made at that time and throughout the update process to gss api v2. It is my opinion that conversations in this space devolve into long threads in talking at each other because the basis for the conversation from each party are unspoken assumptions which in many cases have no overlap. I believe that by reading between the lines of this thread it is possible to put the conversation back on track. Martin has highlighted the fact that in certain contexts within GSSAPIv1 and its successors, the order of OIDs did matter. At the time all "SET OF" constructions were static in nature. Martin has pointed out that gss_add_oid_set_member() was added in v2. Nico points out that gss_add_oid_set_member() does not provide for the creation of ordered "SET OF" constructions. Martin has stated that this oversight in the addition of gss_add_oid_set_member() is acceptable because it is not used in practice. Here is where things begin to breakdown badly and the discussion has taken a turn into the use or abuse of ASN.1 types and C data structures; whether new types are needed; whether the use of old types for multiple semantic contexts was right or wrong; etc. It sounds to me that we are suffering here from there being undocumented assumptions on various GSSAPI operations which can only be determined by historical review of the documents and the implementations which were based on them. Before we can have a rationale discussion we need to know from the historical context: 1) which GSS API functions consider the order of OIDs in a SET OF to be important? 2) for what explicit purpose as gss_add_oid_set_member() added. if it was never meant to be used it would not have been added, therefore the addition must have had some purpose in mind. what were the undocumented restrictions on the use of this function? 3) are the undocumented restrictions on gss_add_oid_set_member() in conflict with the gss api functions included in (1) above? 4) was the data model for GSS API meant to be that of ASN.1? if not, what was the data model? Next, the discussion has taken a turn to focus on types and whether or not the use of types in the past was poor judgment and whether or not we need new ones. It seems apparent to me that there was a decision (conscious or not) to reuse existing types to represent both ordered and unordered lists of OIDs. I wonder if the group should be discussing the need to add a new function gss_add_oid_set_member_at_pos() which would allow for the construction of dynamic ordered lists using the existing data structures instead of the currently produced unordered sets. Jeffrey Altman P.S. - I apologize for the length of this e-mail. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 15:21:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15995; Tue, 21 Dec 2004 15:21:13 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgqev-0006PC-QY; Tue, 21 Dec 2004 15:31:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgqTe-0002ns-SE; Tue, 21 Dec 2004 15:19:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgqM9-0006kF-Ok for kitten@megatron.ietf.org; Tue, 21 Dec 2004 15:11:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14757 for ; Tue, 21 Dec 2004 15:11:39 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgqVe-00069X-Br for kitten@ietf.org; Tue, 21 Dec 2004 15:21:32 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBLKBbdt015374 for ; Tue, 21 Dec 2004 13:11:37 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBLKBaJh019431 for ; Tue, 21 Dec 2004 13:11:37 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBLKAcHf183784; Tue, 21 Dec 2004 14:10:38 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBLKAbA6183783; Tue, 21 Dec 2004 14:10:37 -0600 (CST) Date: Tue, 21 Dec 2004 14:10:37 -0600 From: Nicolas Williams To: Jeffrey Altman Message-ID: <20041221201037.GC182500@binky.central.sun.com> Mail-Followup-To: Jeffrey Altman , kitten@ietf.org References: <200412210054.BAA28543@uw1048.wdf.sap.corp> <41C87BC3.8040405@columbia.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <41C87BC3.8040405@columbia.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Cc: kitten@ietf.org Subject: Re: Historical context matters was Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Indeed, the normative GSS-APIv2u1 spec (rfc2743) doesn't speak about the relevance of order in OID sets, but the historical context of the C bindings supports the notion that sometimes the order of elements in the C bindings type for OID sets does matter. I think we should consider clarifying when and where in the generic API the order of the elements of a set of OIDs matters, may matter or does not matter. I think we should provide guidance for those who want to develop new bindings of the generic API. SPNEGO's generic interfaces should require that order matter. I would like that to be emphasized by use of "SEQUENCE OF" or, if you prefer, and to emphasize that ASN.1 is not a normative model, "LIST OF," instead of "SET OF." Further, and to avoid confusion, I think the language bindings, for C and Java at least, of those generic SPNEGO interfaces should be included, either in Larry's I-D or in a separate I-D so that there is no confusion as to what "SEQUENCE OF" maps to in those languages. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 15:37:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA17389; Tue, 21 Dec 2004 15:37:16 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgquT-0006qx-4S; Tue, 21 Dec 2004 15:47:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgqjq-000491-Cr; Tue, 21 Dec 2004 15:36:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgqi0-0002yh-2F for kitten@megatron.ietf.org; Tue, 21 Dec 2004 15:34:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA17180 for ; Tue, 21 Dec 2004 15:34:14 -0500 (EST) Received: from serrano.cc.columbia.edu ([128.59.206.20] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgqrW-0006ln-74 for kitten@ietf.org; Tue, 21 Dec 2004 15:44:07 -0500 Received: from [192.168.1.66] (24-193-46-55.nyc.rr.com [24.193.46.55]) (user=jaltman mech=PLAIN bits=0) by serrano.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id iBLKYDs4018364 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 21 Dec 2004 15:34:13 -0500 (EST) Message-ID: <41C8892B.8010101@columbia.edu> Date: Tue, 21 Dec 2004 15:35:55 -0500 From: Jeffrey Altman Organization: Not Affiliated with Columbia University in the City of New York User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041217 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org References: <200412210054.BAA28543@uw1048.wdf.sap.corp> <41C87BC3.8040405@columbia.edu> <20041221201037.GC182500@binky.central.sun.com> In-Reply-To: <20041221201037.GC182500@binky.central.sun.com> X-Enigmail-Version: 0.89.6.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.206.20 X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit Subject: Re: Historical context matters was Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: 7bit Nicolas Williams wrote: > Indeed, the normative GSS-APIv2u1 spec (rfc2743) doesn't speak about the > relevance of order in OID sets, but the historical context of the C > bindings supports the notion that sometimes the order of elements in the > C bindings type for OID sets does matter. > > I think we should consider clarifying when and where in the generic API > the order of the elements of a set of OIDs matters, may matter or does > not matter. > > I think we should provide guidance for those who want to develop new > bindings of the generic API. I agree with both of these shoulds but they are not going to occur in time for SPNEGO. > SPNEGO's generic interfaces should require that order matter. I would > like that to be emphasized by use of "SEQUENCE OF" or, if you prefer, > and to emphasize that ASN.1 is not a normative model, "LIST OF," instead > of "SET OF." Further, and to avoid confusion, I think the language > bindings, for C and Java at least, of those generic SPNEGO interfaces > should be included, either in Larry's I-D or in a separate I-D so that > there is no confusion as to what "SEQUENCE OF" maps to in those > languages. I agree that we have made decisions which require that the order of the OIDs in the mechList matters. I can certainly imagine a SPNEGO in which the order does not matter. However, that is not an issue here as 2478 clearly states that the mechList is an ordered list. I agree that to avoid confusion that providing C and Java Bindings either as part of this document or as part of an associated document would be a good idea. Let's start with providing them as a secondary "SPNEGO C, Java, and C# Language Bindings" document and see how quickly we can come to consensus on it. Jeffrey Altman _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 16:46:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28458; Tue, 21 Dec 2004 16:46:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgrzR-0002PP-1q; Tue, 21 Dec 2004 16:56:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgrMm-0003nQ-69; Tue, 21 Dec 2004 16:16:24 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgrDp-0004bh-KY for kitten@megatron.ietf.org; Tue, 21 Dec 2004 16:07:09 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA22297 for ; Tue, 21 Dec 2004 16:07:07 -0500 (EST) Received: from nwkea-mail-2.sun.com ([192.18.42.14]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgrNM-0000C3-Pr for kitten@ietf.org; Tue, 21 Dec 2004 16:17:01 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by nwkea-mail-2.sun.com (8.12.10/8.12.9) with ESMTP id iBLL78pv023025 for ; Tue, 21 Dec 2004 13:07:08 -0800 (PST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBLL76Jh014506 for ; Tue, 21 Dec 2004 14:07:07 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBLL68rd184068; Tue, 21 Dec 2004 15:06:08 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBLL68XQ184067; Tue, 21 Dec 2004 15:06:08 -0600 (CST) Date: Tue, 21 Dec 2004 15:06:08 -0600 From: Nicolas Williams To: Jeffrey Altman Message-ID: <20041221210608.GE182500@binky.central.sun.com> Mail-Followup-To: Jeffrey Altman , kitten@ietf.org References: <200412210054.BAA28543@uw1048.wdf.sap.corp> <41C87BC3.8040405@columbia.edu> <20041221201037.GC182500@binky.central.sun.com> <41C8892B.8010101@columbia.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <41C8892B.8010101@columbia.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Cc: kitten@ietf.org Subject: Re: Historical context matters was Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab On Tue, Dec 21, 2004 at 03:35:55PM -0500, Jeffrey Altman wrote: > I agree with both of these shoulds but they are not going to occur in > time for SPNEGO. If we agree to pursue language bindings for the SPNEGO interfaces then we can avoid delaying SPNEGO for other generic clarifications. > I agree that to avoid confusion that providing C and Java Bindings > either as part of this document or as part of an associated document > would be a good idea. Let's start with providing them as a secondary > "SPNEGO C, Java, and C# Language Bindings" document and see how quickly > we can come to consensus on it. Thanks. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 19:26:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA25513; Tue, 21 Dec 2004 19:26:42 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CguUU-0000db-1w; Tue, 21 Dec 2004 19:36:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CguEZ-0007kN-DU; Tue, 21 Dec 2004 19:20:07 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgu4q-00028o-D6 for kitten@megatron.ietf.org; Tue, 21 Dec 2004 19:10:04 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA23645 for ; Tue, 21 Dec 2004 19:09:59 -0500 (EST) Received: from cs2876-92.austin.rr.com ([24.28.76.92] helo=cz.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CguAV-0006BJ-Qo for kitten@ietf.org; Tue, 21 Dec 2004 19:15:56 -0500 Received: by cz.mit.edu (Postfix, from userid 8042) id 4CD4DE0063; Tue, 21 Dec 2004 19:06:38 -0500 (EST) To: martin.rex@sap.com References: <200412212353.AAA05711@uw1048.wdf.sap.corp> From: Sam Hartman Date: Tue, 21 Dec 2004 19:06:38 -0500 In-Reply-To: <200412212353.AAA05711@uw1048.wdf.sap.corp> (Martin Rex's message of "Wed, 22 Dec 2004 00:53:43 +0100 (MET)") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Cc: kitten@ietf.org, Nicolas.Williams@sun.com Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b >>>>> "Martin" == Martin Rex writes: Martin> Sam Hartman wrote: >> Martin> No-one in their right minds uses gss_add_oid_set_member(). Martin> I mean that. For most purposes an automatic or static Martin> gss_OID_set is perfectly sufficient. >> I think Nico and I have both worked on code bases that use >> gss_add_oid_set_member. In my case it was ssh. I believe that >> was clearly the right decision for that code base. >> >> I think I'm in my right mind, although I'll realize that >> sometimes you probably disagree.;) Martin> I'm sorry for my language. It was definitely Martin> inapproriate. I did not take offense and did not think any was intended. I was mostly trying to point out that there seem to be multiple different sets of people using GSS-API with different sets of assumptions. As we work through these specs we are going to run into cases where something that is obvious to some of us is not obvious to others. I think what we should do in these instances is: 1) Revise specs to document all the ways of doing things we are aware of. 2) If after considering the options it seems like we want to recommend one of them, do so. I find these discussions quite interesting because it helps us all understand how GSS-API is used. It also reminds us that we'll never know all the uses to which our technologies are put. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Tue Dec 21 19:43:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA27377; Tue, 21 Dec 2004 19:43:24 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CguWP-00018M-1S; Tue, 21 Dec 2004 19:38:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CguF8-0008AD-7n; Tue, 21 Dec 2004 19:20:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgu5t-0002gi-29 for kitten@megatron.ietf.org; Tue, 21 Dec 2004 19:11:09 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA24561 for ; Tue, 21 Dec 2004 19:11:05 -0500 (EST) Received: from smtpde03.sap-ag.de ([155.56.68.140]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgtzG-0004x1-H2 for kitten@ietf.org; Tue, 21 Dec 2004 19:04:29 -0500 Received: from sap-ag.de (smtpde03) by smtpde03.sap-ag.de (out) with ESMTP id AAA19211; Wed, 22 Dec 2004 00:53:43 +0100 (MEZ) From: Martin Rex Message-Id: <200412212353.AAA05711@uw1048.wdf.sap.corp> To: hartmans-ietf@mit.edu (Sam Hartman) Date: Wed, 22 Dec 2004 00:53:43 +0100 (MET) In-Reply-To: from "Sam Hartman" at Dec 21, 4 12:49:01 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org, Nicolas.Williams@sun.com Subject: Re: comments on 2478bis (SPNEGO) I-D X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: 8bit Sam Hartman wrote: > > Martin> No-one in their right minds uses gss_add_oid_set_member(). > Martin> I mean that. For most purposes an automatic or static > Martin> gss_OID_set is perfectly sufficient. > > I think Nico and I have both worked on code bases that use > gss_add_oid_set_member. In my case it was ssh. I believe that was > clearly the right decision for that code base. > > I think I'm in my right mind, although I'll realize that sometimes you > probably disagree.;) I'm sorry for my language. It was definitely inapproriate. What I actually meant to say is, that if gss_add_oid_set_member is not part of your own codebase which you always link directly, then you're much better off by rolling gss_OID_sets on your own -- and in most cases you will not need them to be dynamic anyways. As soon as you write code that may or will get used with arbitrary gssapi mechanisms (i.e. a portable application), then it would not be wise to reject a gssapi v1 mechanism only because it doesn't offer gss_create_empty_oid_set/gss_add_oid_set_member/gss_test_oid_set_member API calls, simply because those calls are entirely mechanism *in*dependent. I agree that they might be useful *IF* one fiddles around with gss_OID_set quite a lot, but quite often, a much smaller, less complex and always available (directly linked) approach makes more sense (for apps). A mechanism or a mechanism glue layer that implements and exposes those fuctions is likely going to use them itself. (Although I would discourage to call exposed API functions from inside of a module, at least for more complex functions than those OID_set support routines). -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Wed Dec 22 14:59:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27362; Wed, 22 Dec 2004 14:59:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChCnN-0001AG-5h; Wed, 22 Dec 2004 15:09:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChCXf-0006Yt-0y; Wed, 22 Dec 2004 14:53:03 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChCXN-0006LP-Vr; Wed, 22 Dec 2004 14:52:47 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26953; Wed, 22 Dec 2004 14:52:39 -0500 (EST) Received: from sinclair.provo.novell.com ([137.65.81.169]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChCh2-0000yh-Ju; Wed, 22 Dec 2004 15:02:45 -0500 Received: from INET-PRV-MTA by sinclair.provo.novell.com with Novell_GroupWise; Wed, 22 Dec 2004 12:52:08 -0700 Message-Id: X-Mailer: Novell GroupWise Internet Agent 6.5.3 Date: Wed, 22 Dec 2004 12:51:53 -0700 From: "Juan Carlos Luciani" To: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=__Part7959FC49.1__=" X-Spam-Score: 0.0 (/) X-Scan-Signature: 04b84659b2acb599bee006e63124a606 Cc: kitten@ietf.org Subject: draft-ietf-kitten-gssapi-rfc2853-update-for-csharp X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 3b3673afe71d94a7551c8fbc5adb8948 This is a MIME message. If you are reading this text, you may want to consider changing to a mail reader or gateway that understands how to properly handle MIME multipart messages. --=__Part7959FC49.1__= Content-Type: text/plain; charset=US-ASCII Content-Disposition: inline Content-Transfer-Encoding: 7bit Hi, I would like to submit the attached draft (draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt) for consideration. The draft covers suggested updates to RFC2853 to allow it to also describe proposed C# bindings for GSS-API. Thank you for your help, Juan Carlos Luciani (jluciani@novell.com) Novell, Inc. --=__Part7959FC49.1__= Content-Type: text/plain; name="draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt" Content-Disposition: attachment; filename="draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt" Content-Transfer-Encoding: 8bit NETWORK WORKING GROUP J. Luciani INTERNET-DRAFT Novell, Inc. Expires: June 24, 2005 December 22, 2004 GSS-API V2: Java & C# Bindings draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00 Status of this Memo This document is an Internet-Draft and is subject to all provisions of section 3 of RFC 3667. By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she become aware will be disclosed, in accordance with RFC 3668. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on May 26, 2005. Copyright Notice Copyright (C) The Internet Society (2004). Abstract The Generic Security Services Application Program Interface (GSS-API) offers application programmers uniform access to security services atop a variety of underlying cryptographic mechanisms. This document proposes an update to Generic Security Service API Version 2: Java Bindings [RFC2853], to include C# bindings. The proposed updates are documented as additions to be merged into section 4 of RFC 2853. Luciani Expires June 24 2005 [Page 1] Internet-Draft GSS-API V2: Java & C# Bindings December 2004 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Additions to Section 4 of RFC 2853 . . . . . . . . . . . . . . . 4 2.1 New Section 4.17 - Title: C# Modifications . . . . . . . . 4 2.2 New Section 4.17.1 - Title: C# Assembly Name . . . . . . . 4 2.3 New Section 4.17.2 - Title: C# Class Definitions . . . . . 4 2.4 New Section 4.17.3 - Title: C# Data Types. . . . . . . . . 4 2.5 New Section 4.17.4 - Title: C# Exception Handling. . . . . 4 2.6 New Section 4.17.5: Title: C# Example Code . . . . . . . . 5 3. IANA Considerations. . . . . . . . . . . . . . . . . . . . . . . 9 4. Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . . . 9 5. Normative References . . . . . . . . . . . . . . . . . . . . . . 9 6. Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 7. Intellectual Property Statement. . . . . . . . . . . . . . . . 10 8. Disclaimer of Validity . . . . . . . . . . . . . . . . . . . . 10 9. Copyright Statement . . . . . . . . . . . . . . . . . . . . . . 10 Luciani Expires June 24, 2005 [Page 2] Internet-Draft GSS-API V2: Java & C# Bindings December 2004 1. Introduction This document specifies modifications to RFC 2853, Generic Security Service API Version 2: Java Bindings, that will allow it to also document C# bindings for GSS-API V2. The C# language has recently gained much popularity with the advent of the .NET and the Mono frameworks. The C# GSS-API bindings aim to allow C# application developers to leverage the security services of the API from within those frameworks. The design goal of the C# GSS-API was to adhere to the definition of the Java GSS-API as much as possible to leverage the work that has been done on it and to ease the transition of Java application developers to the C# environment. The following section describes additions that when merged with the contents of RFC 2853 should result in a document that covers both the Java and C# bindings of GSS-API [RFC2743]. Luciani Expires June 24, 2005 [Page 3] Internet-Draft GSS-API V2: Java & C# Bindings December 2004 2.0 Additions to Section 4 of RFC 2853 2.1 New Section 4.17 - Title: C# Modifications This section describes the language dependent modifications necessary to implement the interface in C#. 2.2 New Section 4.17.1 - Title: C# Assembly Name The C# namespace is org.ietf.gss. See section 4.17.5 for an example. 2.3 New Section 4.17.2 - Title: C# Class Definitions All class definitions & methods remain the same as specified in the Java bindings. 2.4 New Section 4.17.3 - Title: C# Data Types All data types remain the same. 2.5 New Section 4.17.4 - Title: C# Exception Handling All exception codes remain the same as specified in the Java bindings. However, C# does not have a 'throws' statement. Therefore, method prototypes do not include the exception type. For example, Java method prototype : public abstract GSSName createName(String nameStr, Oid nameType) throws GSSException; Equivalent C# method prototype : public abstract GSSName createName(String nameStr, Oid nameType); C# does implement the throw and catch keywords, for example: public class GSSName createName(String nameStr, Oid nameType) { int majorCode = 0; ... majorCode = validateParms(nameStr, nameType); if (majorCode) throw new GSSException(majorCode); ... } Luciani Expires June 24, 2005 [Page 4] Internet-Draft GSS-API V2: Java & C# Bindings December 2004 2.6 New Section 4.17.5: Title: C# Example Code Client example : using ietf.org.gss; class GssapiClient { private static TcpClient client; private static NetworkStream stream; static void Main(string[] args) { Connect("127.0.0.1", "message from client"); try { GSSManager manager = GSSManager.getInstance(); Oid krb5Mechanism = new Oid("1.2.840.113554.1.2.2"); Oid krb5PrincipalNameType = new Oid("1.2.840.113554.1.2.2.1"); // Optionally Identify who the client wishes to be // GSSName name = manager.createName("test@gsserver", // GSSName.NT_USER_NAME); // Obtain default credential GSSCredential userCreds = manager.createCredential(GSSCredential.INITIATE_ONLY); GSSName name = userCreds.getName(krb5PrincipalNameType); Console.WriteLine( "Just acquired credentials for " + name.toString()); int acceptLife = userCreds.getRemainingAcceptLifetime(new Oid("2.3.4")); int initLife = userCreds.getRemainingInitLifetime(new Oid("1..3.")); int remLife = userCreds.getRemainingLifetime(); int usage = userCreds.getUsage(); GSSName namea = userCreds.getName(); Oid[] oa = userCreds.getMechs(); Luciani Expires June 24, 2005 [Page 5] Internet-Draft GSS-API V2: Java & C# Bindings December 2004 // Instantiate and initialize a security context that will be // established with the server GSSContext context = manager.createContext(name, krb5Mechanism, userCreds, GSSContext.DEFAULT_LIFETIME); userCreds.dispose(); // Optionally Set Context Options, must be done // before iniSecContext call. context.requestMutualAuth(true); context.requestConf(true); context.requestInteg(true); context.requestSequenceDet(true); context.requestCredDeleg(true); MemoryStream ins = new MemoryStream(); MemoryStream outs = new MemoryStream(); // loop until context is setup and no more tokens to receive while (!context.isEstablished()) { outs = new MemoryStream(); context.initSecContext(ins, outs); // send token if present if (outs.Length > 0) { Console.WriteLine("Sending token..."); sendToken(outs); } // check if we should expect more tokens if (context.isEstablished()) break; // another token expected from peer Console.WriteLine( "Still expecting another token from server..."); ins = recvToken(); } // // display context information // Luciani Expires June 24, 2005 [Page 6] Internet-Draft GSS-API V2: Java & C# Bindings December 2004 // Did the server authenticate back to client? Console.WriteLine("\n{0} Mutual Authentication", context.getMutualAuthState() ? "Using" : "Not using"); Console.WriteLine("Credentials were delegated = " + context.getCredDelegState()); Console.WriteLine("Remaining lifetime in seconds = " + context.getLifetime()); Console.WriteLine("Context mechanism = " + context.getMech()); Console.WriteLine("Initiator = " + context.getSrcName().toString()); Console.WriteLine("Acceptor = " + context.getTargName().toString()); Console.WriteLine("Confidentiality (i.e., privacy) is {0}available", context.getConfState() ? "" : "not "); Console.WriteLine("Integrity is {0}available", context.getIntegState() ? "" : "not "); Console.WriteLine("Is initiator = " + context.isInitiator()); Console.WriteLine("Is transferable = " + context.isTransferable()); Console.WriteLine("Is protReady = " + context.isProtReady()); Console.WriteLine("ReplayDetState = " + context.getReplayDetState()); Console.WriteLine("SequenceDetState = " + context.getSequenceDetState()); // perform wrap on an application supplied message // using QOP = 0, and requesting privacy service MessageProp msgProp = new MessageProp(0, true); byte [] message = System.Text.Encoding.ASCII.GetBytes("Hello GSS-API!"); byte [] token = System.Text.Encoding.ASCII.GetBytes("tok"); // Byte aray method is equivalent to stream method //byte []token = context.wrap(message, 0, appMsg.length, msgProp); //sendToken(token); ins = new MemoryStream(); outs = new MemoryStream(); ins.Write(token, 0, token.Length); context.getMIC(ins, outs, msgProp); sendToken(outs); Luciani Expires June 24, 2005 [Page 7] Internet-Draft GSS-API V2: Java & C# Bindings December 2004 outs = new MemoryStream(); outs.Write(message, 0, message.Length); sendToken(outs); ins = new MemoryStream(); outs = new MemoryStream(); ins.Write(message, 0, message.Length); context.wrap(ins, outs, msgProp); sendToken(outs); // Optionally export context to another thead GSSContext ctx = manager.createContext(context.export()); Console.WriteLine("New context isTransferable = " + ctx.isTransferable()); Console.WriteLine("New context isInitiator = " + ctx.isInitiator()); Console.WriteLine("New context protReady = " + ctx.isProtReady()); Console.WriteLine("New context srcName = " + ctx.getSrcName().toString()); Console.WriteLine("New context targName = " + ctx.getTargName().toString()); // release the local-end of the context ctx.dispose(); stream.Close(); Console.WriteLine("Leaving..."); } catch (GSSException e) { Console.WriteLine(e.getMessage()); Console.WriteLine(e.StackTrace); } } Luciani Expires June 24, 2005 [Page 8] Internet-Draft GSS-API V2: Java & C# Bindings December 2004 3. IANA Considerations This document has no actions for IANA. 4. Acknowledgments The author would like to thank the following: Corby Morris who wrote the original version of this document and is the creator of the C# GSS-API bindings. Jeff Altman for his support and suggestions. Kabat, J. and Upadhyay, M. for writing the Generic Security Service API Version 2 : Java Bindings specification [RFC2743] that constitutes the basis of this work. Funding for the RFC Editor function is currently provided by the Internet Society. 5. Normative References [RFC2743] Linn, J., "Generic Security Service Application Program Interface Version 2, Update 1", RFC 2743, January 2000. [RFC2853] Kabat, J. and Upadhyay, M., "Generic Security Service API Version 2 : Java Bindings", RFC 2853, June 2000. 6. Authors' Addresses Juan Carlos Luciani Novell, Inc. 1800 South Novell Place Provo, Utah 84606 US EMail: jluciani@novell.com Luciani Expires June 24, 2005 [Page 9] Internet-Draft GSS-API V2: Java & C# Bindings December 2004 7. Intellectual Property Statement The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. 8. Disclaimer of Validity This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 9. Copyright Statement Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. Luciani Expires June 24, 2005 [Page 10] --=__Part7959FC49.1__= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --=__Part7959FC49.1__=-- From kitten-bounces@ietf.org Wed Dec 22 23:21:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA17702; Wed, 22 Dec 2004 23:21:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChKdh-0006Bk-Sg; Wed, 22 Dec 2004 23:31:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChKRn-0002zJ-Di; Wed, 22 Dec 2004 23:19:31 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChKIA-0000jS-I3 for kitten@megatron.ietf.org; Wed, 22 Dec 2004 23:09:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA16790 for ; Wed, 22 Dec 2004 23:09:31 -0500 (EST) Received: from biscayne-one-station.mit.edu ([18.7.7.80]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChKRx-0005ps-BG for kitten@ietf.org; Wed, 22 Dec 2004 23:19:42 -0500 Received: from outgoing.mit.edu (OUTGOING-AUTH.MIT.EDU [18.7.22.103]) by biscayne-one-station.mit.edu (8.12.4/8.9.2) with ESMTP id iBN49U33017863; Wed, 22 Dec 2004 23:09:30 -0500 (EST) Received: from [18.18.1.76] (KEN-WIRELESS.MIT.EDU [18.18.1.76]) (authenticated bits=0) (User authenticated as raeburn@ATHENA.MIT.EDU) by outgoing.mit.edu (8.12.4/8.12.4) with ESMTP id iBN49S2d020218 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT); Wed, 22 Dec 2004 23:09:28 -0500 (EST) In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v619) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <6FB0E777-5498-11D9-91AC-000A95909EE2@mit.edu> From: Ken Raeburn Date: Wed, 22 Dec 2004 23:09:26 -0500 To: "Juan Carlos Luciani" X-Mailer: Apple Mail (2.619) X-Spam-Score: -4.9 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.42 Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org Subject: Re: draft-ietf-kitten-gssapi-rfc2853-update-for-csharp X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit Meant to point this out earlier: 2.2 New Section 4.17.1 - Title: C# Assembly Name The C# namespace is org.ietf.gss. See section 4.17.5 for an example. 2.6 New Section 4.17.5: Title: C# Example Code Client example : using ietf.org.gss; The names aren't consistent. In sections 2.5, 2.6, and 4, remove the space before the colon in text (e.g., after "example" above). Ken _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Mon Dec 27 16:26:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29560; Mon, 27 Dec 2004 16:26:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj2YA-0000vf-EX; Mon, 27 Dec 2004 16:37:10 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1hb-00048k-M8; Mon, 27 Dec 2004 15:42:51 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1cr-0001pj-19; Mon, 27 Dec 2004 15:37:57 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19927; Mon, 27 Dec 2004 15:37:55 -0500 (EST) Message-Id: <200412272037.PAA19927@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Mon, 27 Dec 2004 15:37:55 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-gssapi-prf-01.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: 5011df3e2a27abcc044eaa15befcaa87 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : A PRF API extension for the GSS-API Author(s) : N. Williams Filename : draft-ietf-kitten-gssapi-prf-01.txt Pages : 9 Date : 2004-12-27 This document defines a Pseudo-Random Function (PRF) extension to the Generic Security Service Applicatoin Programming Interface (GSS-API) for keying application protocols given an established GSS-API security context. The primary intended use of this function is to key secure session layers that don't or cannot use GSS-API per-message MIC (message integrity check) and wrap tokens for session protection. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-gssapi-prf-01.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-gssapi-prf-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-gssapi-prf-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-27154843.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-gssapi-prf-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-gssapi-prf-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-27154843.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Mon Dec 27 16:28:33 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00400; Mon, 27 Dec 2004 16:28:33 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj2ad-0001C4-UC; Mon, 27 Dec 2004 16:39:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1he-00049k-Sk; Mon, 27 Dec 2004 15:42:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1cv-0001x9-C0; Mon, 27 Dec 2004 15:38:01 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19935; Mon, 27 Dec 2004 15:37:59 -0500 (EST) Message-Id: <200412272037.PAA19935@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Mon, 27 Dec 2004 15:37:59 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-krb5-gssapi-prf-01.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: 8de5f93cb2b4e3bee75302e9eacc33db --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : A PRF for the Kerberos V GSS-API Mechanism Author(s) : N. Williams Filename : draft-ietf-kitten-krb5-gssapi-prf-01.txt Pages : 7 Date : 2004-12-27 This document defines the Pseudo-Random Function (PRF) for the Kerberos V GSS-API mechanism, based on the PRF defined for the Kerberos V cryptographic framework, for keying application protocols given an established Kerberos V GSS-API security context. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-krb5-gssapi-prf-01.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-krb5-gssapi-prf-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-krb5-gssapi-prf-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-27154848.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-krb5-gssapi-prf-01.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-krb5-gssapi-prf-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-27154848.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Mon Dec 27 16:30:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00942; Mon, 27 Dec 2004 16:30:06 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj2c9-0001Mu-0N; Mon, 27 Dec 2004 16:41:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1hi-0004CN-SS; Mon, 27 Dec 2004 15:42:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1dE-00023r-42; Mon, 27 Dec 2004 15:38:20 -0500 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19948; Mon, 27 Dec 2004 15:38:18 -0500 (EST) Message-Id: <200412272038.PAA19948@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Mon, 27 Dec 2004 15:38:18 -0500 Cc: kitten@ietf.org Subject: I-D ACTION:draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: 6e922792024732fb1bb6f346e63517e4 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : GSS-API V2: Java & C# Bindings Author(s) : J. Luciani Filename : draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt Pages : 10 Date : 2004-12-27 The Generic Security Services Application Program Interface (GSS-API) offers application programmers uniform access to security services atop a variety of underlying cryptographic mechanisms. This document proposes an update to Generic Security Service API Version 2: Java Bindings [RFC2853], to include C# bindings. The proposed updates are documented as additions to be merged into section 4 of RFC 2853. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-12-27154853.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-gssapi-rfc2853-update-for-csharp-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-12-27154853.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@ietf.org Wed Dec 29 22:03:24 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13942; Wed, 29 Dec 2004 22:03:24 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjqmE-0002gz-NW; Wed, 29 Dec 2004 22:15:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjqYo-0008GV-Ra; Wed, 29 Dec 2004 22:01:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjqY8-00084s-Pm for kitten@megatron.ietf.org; Wed, 29 Dec 2004 22:00:28 -0500 Received: from smtp.unc.edu (smtpsrv11.isis.unc.edu [152.2.1.242]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13743 for ; Wed, 29 Dec 2004 22:00:26 -0500 (EST) Received: from [152.2.246.1] (hillary.oit.unc.edu [152.2.246.1]) by smtp.unc.edu (8.12.9/8.12.9) with ESMTP id iBU2xv5V024743 for ; Wed, 29 Dec 2004 21:59:57 -0500 (EST) Message-ID: <41D36F28.8090709@unc.edu> Date: Wed, 29 Dec 2004 21:59:52 -0500 From: Simon Spero User-Agent: Mozilla Thunderbird 0.9 (Windows/20041103) X-Accept-Language: en-us, en MIME-Version: 1.0 To: kitten@ietf.org Content-Type: multipart/mixed; boundary="------------090701000504040406090105" Subject: SPNEGO-bis comments/questions X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: dbb8771284c7a36189745aa720dc20ab This is a multi-part message in MIME format. --------------090701000504040406090105 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi - I've got a few comments on the current draft; most of them are pretty minor. 1) [ Section 4.2.1 : negTokenInit ] 1.1) Extension marker. Is the extension marker in NegTokenInit really necessary? If future implementations need extra fields, wouldn't it be better to define a new type and use a different OID in the initialContextToken? 1.2) mechTypes. MAY mechTypes contain the OID for SPNEGO? (I'd say MUST NOT). 2) [Section 4.2.1 : ContextFlags ] Since context flags are now deprecated, it would be a good idea to add a SIZE constraint on the BIT STRING. ContextFlags ::= BIT STRING {} (SIZE(7)) 3) [Section 4.2.2 : negTokenResp ] Is the extension marker necessary? If it is, should there also be an extension marker in negState? 4) Add appendix D, with all the ASN.1 (and no page breaks/headers). [attached] 5) [Section 5 - mechListMIC ] 5.1) "Most Preferred Mechanism". How does the acceptor know what the most preferred mechanism of the initiator is? What happens if Mallet deletes all offered mechanisms that support integ from the intial token? By (5) (b)(III), this will COMPLETE without signalling any error. 5.2) How can a generic implementation know ahead of time whether a mechanism supports integrity? This is just a subset of the bigger problem of negotiating QOP/Strength, etc. Of course, since the only mechanism I care about is Kerberos, I can ignore the problem for now :) 6) SET OF is really annoying, especially if you're using DER or PER; in this case, it's not that bad since the SET's don't go over the wire, but I still hate them anyway (LDAP is fetid with the buggers). It's not like there aren't any other, er, creative uses of ASN.1 in GSSAPI already... 7) The target should be allowed to send a negTokenInit before exchange. When using HTTP Negotiate authentication the target is usually the one to suggest doing GSSAPI. If the server was allowed to supply a negTokenInit with its preferred mechanisms list, we can potentially save a round trip if the initiator would have guessed wrong. Would this break any existing implementations? 8) SPNEGO is an anagram of SPONGE. Simon --------------090701000504040406090105 Content-Type: text/plain; name="spnego-bis.asn" Content-Disposition: inline; filename="spnego-bis.asn" Content-Transfer-Encoding: 7bit SPNEGOASNOneSpec { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanism(5) snego (2) modules(4) spec2(2) } DEFINITIONS EXPLICIT TAGS ::= BEGIN MechType ::= OBJECT IDENTIFIER -- OID represents each security mechanism as suggested by -- [RFC2743] MechTypeList ::= SEQUENCE OF MechType NegotiationToken ::= CHOICE { negTokenInit [0] NegTokenInit, negTokenResp [1] negTokenResp } NegTokenInit ::= SEQUENCE { mechTypes [0] MechTypeList, reqFlags [1] ContextFlags OPTIONAL, -- maintained from RFC 2478 for backward compatibility, -- RECOMMENDED to be left out mechToken [2] OCTET STRING OPTIONAL, mechListMIC [3] OCTET STRING OPTIONAL, ... } ContextFlags ::= BIT STRING { delegFlag (0), mutualFlag (1), replayFlag (2), sequenceFlag (3), anonFlag (4), confFlag (5), integFlag (6) } NegTokenResp ::= SEQUENCE { negState [0] ENUMERATED { accept_completed (0), accept_incomplete (1), reject (2), request_mic (3) } OPTIONAL, -- REQUIRED in the first reply from the target supportedMech [1] MechType OPTIONAL, -- present only in the first reply from the target responseToken [2] OCTET STRING OPTIONAL, mechListMIC [3] OCTET STRING OPTIONAL, ... } END --------------090701000504040406090105 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --------------090701000504040406090105-- From kitten-bounces@ietf.org Wed Dec 29 23:42:02 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20467; Wed, 29 Dec 2004 23:42:01 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjsJf-0004ZM-Q1; Wed, 29 Dec 2004 23:53:40 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjs4w-0004F4-Vj; Wed, 29 Dec 2004 23:38:27 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjs3f-0003CE-F4 for kitten@megatron.ietf.org; Wed, 29 Dec 2004 23:37:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA19759 for ; Wed, 29 Dec 2004 23:37:04 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjsEs-0004PS-Ql for kitten@ietf.org; Wed, 29 Dec 2004 23:48:45 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iBU4b3Vu009466 for ; Wed, 29 Dec 2004 21:37:03 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBU4b2Jf019973 for ; Wed, 29 Dec 2004 21:37:03 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBU4Zwt2246341; Wed, 29 Dec 2004 22:35:58 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBU4ZvHI246340; Wed, 29 Dec 2004 22:35:57 -0600 (CST) Date: Wed, 29 Dec 2004 22:35:57 -0600 From: Nicolas Williams To: Simon Spero Message-ID: <20041230043556.GC184117@binky.central.sun.com> Mail-Followup-To: Simon Spero , kitten@ietf.org References: <41D36F28.8090709@unc.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <41D36F28.8090709@unc.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: c83ccb5cc10e751496398f1233ca9c3a Cc: kitten@ietf.org Subject: Re: SPNEGO-bis comments/questions X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 825e642946eda55cd9bc654a36dab8c2 On Wed, Dec 29, 2004 at 09:59:52PM -0500, Simon Spero wrote: > Hi - I've got a few comments on the current draft; most of them are > pretty minor. > > 1) [ Section 4.2.1 : negTokenInit ] > > 1.1) Extension marker. > Is the extension marker in NegTokenInit really necessary? If future > implementations need extra fields, wouldn't it be better to define a > new type and use a different OID in the initialContextToken? As there would be no way to negotiate a negotiation mechanism I'd answer yes to the first question and no to the second. > 1.2) mechTypes. > MAY mechTypes contain the OID for SPNEGO? (I'd say MUST NOT). Does it matter? As long as it isn't selected... (and if it is I'm sure implementors will quickly realize that that doesn't work!). But yes, a note about recursion avoidance would be nice. > 2) [Section 4.2.1 : ContextFlags ] > Since context flags are now deprecated, it would be a good idea to add > a SIZE constraint on the BIT STRING. > ContextFlags ::= BIT STRING {} (SIZE(7)) Perhaps. It would help reject malformed messages sooner, before allocating large buffers for large context flags bit strings, but since there can't really be a small constraint on the size of the mechanism token octet strings I don't think it would make much difference. Wyllys? Larry? > 3) [Section 4.2.2 : negTokenResp ] > Is the extension marker necessary? If it is, should there also be an > extension marker in negState? Yes to the first question (see above). As to the second question, I made the same point earlier to Larry as I recall. IIRC Larry responded that in practice extension markers on that enum wouldn't help as unknown values really must lead to failure. > 4) Add appendix D, with all the ASN.1 (and no page breaks/headers). > [attached] Good point. > 5) [Section 5 - mechListMIC ] > 5.1) "Most Preferred Mechanism". How does the acceptor know what the > most preferred mechanism of the initiator is? It's the first OID in the initiator's mechList. > What happens if Mallet deletes all offered mechanisms that support integ > from the intial token? By (5) (b)(III), this will COMPLETE without > signalling any error. There's a security consideration w.r.t. the initiator offering, and the acceptor being willing to accept, mechanisms that offer no integrity protection support. > 5.2) How can a generic implementation know ahead of time whether a > mechanism supports integrity? This is just a subset of the bigger > problem of negotiating QOP/Strength, etc. See draft-williams-gssapi-stackable-pseudo-mechs-00.txt which is probably expired -- I'll submit a new version soon, as a KITTEN work item. That I-D proposes interfaces for discovering mechanisms' attributes. Without such an extension applications have to hardcode such information. For example, SSHv2 has support for using the GSS-API for user and host authentication, and it has its own method for mechanism negotiation, so it forbids the use of SPNEGO, but since GSS_Indicate_mechs() is free to indicate support for SPNEGO what is an SSHv2 implementation to do but to hardcode the OID of SPNEGO and filter it out from the list of mechanisms for which it has credentials for the relevant principal? > Of course, since the only mechanism I care about is Kerberos, I can > ignore the problem for now :) If your application hardcodes mechanism OIDs, yes. > 6) SET OF is really annoying, especially if you're using DER or PER; in > this case, it's not that bad since the SET's don't go over the wire, > but I still hate them anyway (LDAP is fetid with the buggers). It's > not like there aren't any other, er, creative uses of ASN.1 in GSSAPI > already... No ASN.1 SET OF type is actually used in any SPNEGO messages or, therefore, on the wire. SET OF is only used in the generic description of the SPNEGO programming interfaces, about which there was a long thread recently. > 7) The target should be allowed to send a negTokenInit before exchange. > When using HTTP Negotiate authentication the target is usually the one > to suggest doing GSSAPI. If the server was allowed to supply a > negTokenInit with its preferred mechanisms list, we can potentially save > a round trip if the initiator would have guessed wrong. Would this > break any existing implementations? That would be a very different mechanism. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 30 00:10:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA25627; Thu, 30 Dec 2004 00:10:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjslC-0005bn-P1; Thu, 30 Dec 2004 00:22:07 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjsYl-0001xC-IA; Thu, 30 Dec 2004 00:09:15 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjsXr-0001ZJ-LE for kitten@megatron.ietf.org; Thu, 30 Dec 2004 00:08:19 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA25492 for ; Thu, 30 Dec 2004 00:08:16 -0500 (EST) Received: from luminous.mit.edu ([18.101.1.61]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjsj7-0005Yc-Pg for kitten@ietf.org; Thu, 30 Dec 2004 00:19:58 -0500 Received: by luminous.mit.edu (Postfix, from userid 1000) id DDE587683E; Thu, 30 Dec 2004 00:06:48 -0500 (EST) To: Simon Spero References: <41D36F28.8090709@unc.edu> From: Sam Hartman Date: Thu, 30 Dec 2004 00:06:48 -0500 In-Reply-To: <41D36F28.8090709@unc.edu> (Simon Spero's message of "Wed, 29 Dec 2004 21:59:52 -0500") Message-ID: <87d5ws4bo7.fsf@luminous.mit.edu> User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 8de5f93cb2b4e3bee75302e9eacc33db Cc: kitten@ietf.org Subject: Re: SPNEGO-bis comments/questions X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 1a1bf7677bfe77d8af1ebe0e91045c5b >>>>> "Simon" == Simon Spero writes: Simon> Hi - I've got a few comments on the current draft; most of Simon> them are pretty minor. Responding as an individual: Simon> 1) [ Section 4.2.1 : negTokenInit ] 1.1) Extension marker. Simon> Is the extension marker in NegTokenInit really necessary? Simon> If future implementations need extra fields, wouldn't it be Simon> better to define a new type and use a different OID in the Simon> initialContextToken? No, there's really no way to negotiate the negotiation mechanism you are using. You want a way to send new fields that the receiver must ignore. Simon> 1.2) mechTypes. MAY mechTypes contain the OID for SPNEGO? Simon> (I'd say MUST NOT). I agree, MUST NOT. Simon> 2) [Section 4.2.1 : ContextFlags ] Since context flags are Simon> now deprecated, it would be a good idea to add a SIZE Simon> constraint on the BIT STRING. ContextFlags ::= BIT STRING Simon> {} (SIZE(7)) Hmm. I wonder if anyone gets minimal length of bitstrings wrong for SPNEGO? Simon> 3) [Section 4.2.2 : negTokenResp ] Is the extension marker Simon> necessary? If it is, should there also be an extension Simon> marker in negState? I think the question you should ask is whether adding the extension marker is harmful. Having an extension marker in negstate is fine, provided that you implementations only to send extensions after learning that the recipient supports them. Simon> 4) Add appendix D, with all the ASN.1 (and no page Simon> breaks/headers). [attached] You cannot have text without page breaks/headers in an RFC and technically it is a violation of id-nits to do so in an internet-draft. Simon> 5) [Section 5 - mechListMIC ] 5.1) "Most Preferred Simon> Mechanism". How does the acceptor know what the most Simon> preferred mechanism of the initiator is? It doesn't. The procedure outlined insures that the initiator doesn't return complete if a MIC is required and the most preferred mechanism is not selected. Simon> What happens if Simon> Mallet deletes all offered mechanisms that support integ Simon> from the intial token? By (5) (b)(III), this will COMPLETE Simon> without signalling any error. Yep, offering a mechanism without integrity means you are willing to accept no integrity (and thus no protected negotiation) Simon> 5.2) How can a generic implementation know ahead of time Simon> whether a mechanism supports integrity? This is just a Simon> subset of the bigger problem of negotiating QOP/Strength, Simon> etc. Of course, since the only mechanism I care about is Simon> Kerberos, I can ignore the problem for now :) Out of scope for this document; strictly speaking a SPNEGO You can determine this after the context is established. If you want to know before say to decide what mechanisms to offer, current GSSAPI provides no mechanism so you'll have to know the OIDs of some mechanisms that support integrity. This working group is chartered to solve that problem too and Nico does have drafts in that space. Simon> 6) SET OF is really annoying, especially if you're using Simon> DER or PER; in this case, it's not that bad since the SET's Simon> don't go over the wire, but I still hate them anyway (LDAP Simon> is fetid with the buggers). It's not like there aren't any Simon> other, er, creative uses of ASN.1 in GSSAPI already... This is not an ASN.1 type; it is a GSSAPI type. Simon> 7) The target should be allowed to send a negTokenInit Simon> before exchange. When using HTTP Negotiate authentication Simon> the target is usually the one to suggest doing GSSAPI. If Simon> the server was allowed to supply a negTokenInit with its Simon> preferred mechanisms list, we can potentially save a round Simon> trip if the initiator would have guessed wrong. Would this Simon> break any existing implementations? GSSAPI always starts with an initiator (funny that). Simon> 8) SPNEGO is an anagram of SPONGE. Good to know. _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 30 11:25:24 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA25002; Thu, 30 Dec 2004 11:25:24 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck3IV-0004FT-0V; Thu, 30 Dec 2004 11:37:11 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck306-0001fd-TR; Thu, 30 Dec 2004 11:18:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck2wE-0000vl-LY for kitten@megatron.ietf.org; Thu, 30 Dec 2004 11:14:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24197 for ; Thu, 30 Dec 2004 11:14:08 -0500 (EST) Received: from listserv0.isis.unc.edu ([152.2.0.38] helo=smtp.unc.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck37Z-0003wc-J8 for kitten@ietf.org; Thu, 30 Dec 2004 11:25:55 -0500 Received: from [192.168.2.2] (rdu57-250-013.nc.rr.com [66.57.250.13]) (authenticated bits=0) by smtp.unc.edu (8.12.9/8.12.9) with ESMTP id iBUGDGlZ010592 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Thu, 30 Dec 2004 11:13:16 -0500 (EST) Message-ID: <41D42926.5010908@unc.edu> Date: Thu, 30 Dec 2004 11:13:26 -0500 From: Simon Spero User-Agent: Mozilla Thunderbird 1.0RC1 (Macintosh/20041201) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Sam Hartman References: <41D36F28.8090709@unc.edu> <87d5ws4bo7.fsf@luminous.mit.edu> In-Reply-To: <87d5ws4bo7.fsf@luminous.mit.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.1 (/) X-Scan-Signature: d185fa790257f526fedfd5d01ed9c976 Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org Subject: Re: SPNEGO-bis comments/questions X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: c3a18ef96977fc9bcc21a621cbf1174b Content-Transfer-Encoding: 7bit Sam Hartman wrote: > Simon> 1) [ Section 4.2.1 : negTokenInit ] 1.1) Extension marker. > Simon> Is the extension marker in NegTokenInit really necessary? > >No, there's really no way to negotiate the negotiation mechanism you >are using. You want a way to send new fields that the receiver must >ignore. > > The trouble with extension markers is that they can't be used for critical extensions, and those extensions are only labeled by tag. They're also not part of the MIC. It might be better to reuse Extension(s) from PKIX. >Hmm. I wonder if anyone gets minimal length of bitstrings wrong for >SPNEGO? > > Not so much getting the minimal length wrong as being able to use a different implementation strategy. If a bit string has a fixed maximum size that can fit in an int, and is being used to indicate flags you can avoid having to create an indefinite length bit string. BTW, evil thought: if one were to dynamically create an object identifier with a known prefix and whose last component was the integer value of the context flags, and added that to the end of the mechList, wouldn't that allow upgraded implementations to detect flag changes without breaking legacy apps? > Simon> 4) Add appendix D, with all the ASN.1 (and no page > Simon> breaks/headers). [attached] > >You cannot have text without page breaks/headers in an RFC and >technically it is a violation of id-nits to do so in an >internet-draft. > > I meant to say 'no page breaks/headers in the middle of the code' :) It's a peeve. [MICS] >It doesn't. The procedure outlined insures that the initiator doesn't >return complete if a MIC is required and the most preferred mechanism >is not selected. > > (a) "If the mechanism selected by the negotiation does not support integrity protection, then no mechlistMIC token is used. (b) "Otherwise, if the accepted mechanism is the most preferred mechanism of both the initiator and the acceptor, then the MIC token exchange, as described later in this section, is OPTIONAL." (c) "If no mechlistMIC token was included, and the MIC token exchange is not required, GSS_Init_sec_context() indicates GSS_S_COMPLETE with no output token 1: Alice initiates, offering two protocols, one w/MIC, one wo/MIC {MIC,NOMIC}. Alice prefers MIC 2: Mallet rewrites to {NOMIC} 3: Bob is indifferent between MIC and NOMIC, and activates NOMIC by (a) and (b), the acceptor will not generate a MIC token by (a) and (c) the initiator will indicate success I guess the best thing to do is for the initiator not to offer MICless mechanisms unless all of them are preferred. > Simon> 7) The target should be allowed to send a negTokenInit > Simon> before exchange. When using HTTP Negotiate authentication > >GSSAPI always starts with an initiator (funny that). > > Never mind - I see that any data passed in to the first call to initSecContext is always ignored. > Simon> 8) SPNEGO is an anagram of SPONGE. >Good to know. > > Things you notice when you're coding against the original specs :) _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 30 11:59:22 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA27451; Thu, 30 Dec 2004 11:59:22 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck3pN-00057c-Az; Thu, 30 Dec 2004 12:11:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck3b1-00020M-RQ; Thu, 30 Dec 2004 11:56:19 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck3YM-0000t9-Hm for kitten@megatron.ietf.org; Thu, 30 Dec 2004 11:53:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA26980 for ; Thu, 30 Dec 2004 11:53:32 -0500 (EST) Received: from smtpde02.sap-ag.de ([155.56.68.170]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck3ji-0004vS-TG for kitten@ietf.org; Thu, 30 Dec 2004 12:05:19 -0500 Received: from sap-ag.de (smtpde02) by smtpde02.sap-ag.de (out) with ESMTP id RAA23251; Thu, 30 Dec 2004 17:52:33 +0100 (MEZ) From: Martin Rex Message-Id: <200412301652.RAA21250@uw1048.wdf.sap.corp> To: ses@unc.edu (Simon Spero) Date: Thu, 30 Dec 2004 17:52:33 +0100 (MET) In-Reply-To: <41D42926.5010908@unc.edu> from "Simon Spero" at Dec 30, 4 11:13:26 am MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: f60d0f7806b0c40781eee6b9cd0b2135 Content-Transfer-Encoding: 8bit Cc: kitten@ietf.org, hartmans-ietf@mit.edu Subject: Re: SPNEGO-bis comments/questions X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: fb6060cb60c0cea16e3f7219e40a0a81 Content-Transfer-Encoding: 8bit Simon Spero wrote: > > > > >No, there's really no way to negotiate the negotiation mechanism you > >are using. You want a way to send new fields that the receiver must > >ignore. > > The trouble with extension markers is that they can't be used for > critical extensions, and those extensions are only labeled by tag. > They're also not part of the MIC. It might be better to reuse > Extension(s) from PKIX. God help us -- NO! GSS-API is about trying as hard as possible to establish a security context, even if it doesn't fulfil all of the desires of both peers. Something like a critical extension would be a showstopper for the handshake with a legacy SPNEGO installed base, which is entirely alien to the GSS-API philosophy. > > >Hmm. I wonder if anyone gets minimal length of bitstrings wrong for > >SPNEGO? > > > Not so much getting the minimal length wrong as being able to use a > different implementation strategy. If a bit string has a fixed maximum > size that can fit in an int, and is being used to indicate flags you can > avoid having to create an indefinite length bit string. In case that we have a requirement for DER-encoding in SPNEGO, then indefinite length encoding is not permitted. > > I guess the best thing to do is for the initiator not to offer MICless > mechanisms unless all of them are preferred. The security consideration section should sufficiently address the problem with MICless mechanisms participating the negotiation. > > > Simon> 7) The target should be allowed to send a negTokenInit > > Simon> before exchange. When using HTTP Negotiate authentication > > > >GSSAPI always starts with an initiator (funny that). > > > > > Never mind - I see that any data passed in to the first call to > initSecContext is always ignored. I really wouldn't count on such a token to be ignored. Expect mechanisms to abort with an error if the input_token to gss_init_sec_context() is not NULL or an empty buffer as described in the C-Bindings (rfc2744). The only (non-ietf) mechanism that I know which does this is Microsoft's NTLM SSP, and as this mechanism uses a 3-leg authentication scheme (challenge-response authentication), it needs that dirty hack badly for the HTTP-negotiate authentication. But the actual NTLM-hack in HTTP-Negotiate must be a magnitude worse, because either you have to go through an additional error page for each and every request, or ignore replayed authentication tokens on subsequent requests and only force new TCP-connections through an error-page which emits a new challenge (I haven't read that document...). -Martin _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 30 13:15:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA03095; Thu, 30 Dec 2004 13:15:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck50z-00079u-0v; Thu, 30 Dec 2004 13:27:14 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck4lr-0004q1-9c; Thu, 30 Dec 2004 13:11:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck4Zn-0001Sg-TQ for kitten@megatron.ietf.org; Thu, 30 Dec 2004 12:59:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA01254 for ; Thu, 30 Dec 2004 12:59:05 -0500 (EST) Received: from listserv0.isis.unc.edu ([152.2.0.38] helo=smtp.unc.edu) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck4lA-0006ZQ-5y for kitten@ietf.org; Thu, 30 Dec 2004 13:10:53 -0500 Received: from [192.168.2.2] (rdu57-250-013.nc.rr.com [66.57.250.13]) (authenticated bits=0) by smtp.unc.edu (8.12.9/8.12.9) with ESMTP id iBUHwrlZ009042 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Thu, 30 Dec 2004 12:58:55 -0500 (EST) Message-ID: <41D441E6.9000505@unc.edu> Date: Thu, 30 Dec 2004 12:59:02 -0500 From: Simon Spero User-Agent: Mozilla Thunderbird 1.0RC1 (Macintosh/20041201) X-Accept-Language: en-us, en MIME-Version: 1.0 To: martin.rex@sap.com References: <200412301652.RAA21250@uw1048.wdf.sap.corp> In-Reply-To: <200412301652.RAA21250@uw1048.wdf.sap.corp> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.1 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Content-Transfer-Encoding: 7bit Cc: kitten@ietf.org, hartmans-ietf@mit.edu Subject: Re: SPNEGO-bis comments/questions X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Content-Transfer-Encoding: 7bit Martin Rex wrote: >>>Not so much getting the minimal length wrong as being able to use a >>>different implementation strategy. If a bit string has a fixed maximum >>>size that can fit in an int, and is being used to indicate flags you can >>>avoid having to create an indefinite length bit string. >>> >>> > >In case that we have a requirement for DER-encoding in SPNEGO, then >indefinite length encoding is not permitted. > > I should have said unconstrained length. If you have a bit string whose length is constrained enough to fit entirely in a machine word, you can generate a simpler implementation; bignum vs int. Simon _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 30 14:02:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06567; Thu, 30 Dec 2004 14:02:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5km-0008Vg-Er; Thu, 30 Dec 2004 14:14:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck5S9-00079N-Hw; Thu, 30 Dec 2004 13:55:17 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck5Ih-00054C-RN for kitten@megatron.ietf.org; Thu, 30 Dec 2004 13:45:32 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05388 for ; Thu, 30 Dec 2004 13:45:30 -0500 (EST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5U4-000820-5a for kitten@ietf.org; Thu, 30 Dec 2004 13:57:17 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id iBUIjSdt012586 for ; Thu, 30 Dec 2004 11:45:28 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBUIjSJf004858 for ; Thu, 30 Dec 2004 11:45:28 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBUIiL38246634; Thu, 30 Dec 2004 12:44:21 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBUIiKI5246633; Thu, 30 Dec 2004 12:44:20 -0600 (CST) Date: Thu, 30 Dec 2004 12:44:20 -0600 From: Nicolas Williams To: Simon Spero Message-ID: <20041230184420.GE184117@binky.central.sun.com> Mail-Followup-To: Simon Spero , Sam Hartman , kitten@ietf.org References: <41D36F28.8090709@unc.edu> <87d5ws4bo7.fsf@luminous.mit.edu> <41D42926.5010908@unc.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <41D42926.5010908@unc.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 Cc: kitten@ietf.org, Sam Hartman Subject: Re: SPNEGO-bis comments/questions X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab On Thu, Dec 30, 2004 at 11:13:26AM -0500, Simon Spero wrote: > Sam Hartman wrote: > > > Simon> 1) [ Section 4.2.1 : negTokenInit ] 1.1) Extension marker. > > Simon> Is the extension marker in NegTokenInit really necessary? > > > >No, there's really no way to negotiate the negotiation mechanism you > >are using. You want a way to send new fields that the receiver must > >ignore. > > > > > The trouble with extension markers is that they can't be used for > critical extensions, and those extensions are only labeled by tag. I think there are things we can do with the existing mechList and mechListMIC to securely negotiate extensions, in which case lack of support by one peer for the other's critical extensions should simply lead to failure. Of course, designing SPNEGO for extensibility now would be better, but we're aiming for a modicum of introperability with some existing, deployed implementations under some common circumstances. This places some constraints on what we can do in terms of re-designing SPNEGO. > They're also not part of the MIC. It might be better to reuse > Extension(s) from PKIX. The MIC can be made to include whatever we want it to in a future extensions :) Even today it can include lots of things other than mechanism OIDs, basically, any OIDs that the initiator wants to advertise. > BTW, evil thought: if one were to dynamically create an object > identifier with a known prefix and whose last component was the integer > value of the context flags, and added that to the end of the mechList, > wouldn't that allow upgraded implementations to detect flag changes > without breaking legacy apps? Or an OID per-flag set, then include all those OIDs int he mechList. We've had this thought before. [...] > I guess the best thing to do is for the initiator not to offer MICless > mechanisms unless all of them are preferred. Yes, and Larry's I-D says so, doesn't it? It's been known since the days of the original SPNEGO that negotiation of mechanisms that do not provide for integrity protection means that the negotiation can't be protected. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Thu Dec 30 14:03:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06600; Thu, 30 Dec 2004 14:03:13 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5lD-00005k-Ls; Thu, 30 Dec 2004 14:15:00 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck5SC-0007CL-PD; Thu, 30 Dec 2004 13:55:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck5Kn-0005WS-K9 for kitten@megatron.ietf.org; Thu, 30 Dec 2004 13:47:41 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05501 for ; Thu, 30 Dec 2004 13:47:40 -0500 (EST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5WA-00084M-3A for kitten@ietf.org; Thu, 30 Dec 2004 13:59:27 -0500 Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by brmea-mail-3.sun.com (8.12.10/8.12.9) with ESMTP id iBUIlcVu003117 for ; Thu, 30 Dec 2004 11:47:38 -0700 (MST) Received: from binky.central.sun.com (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id iBUIlcJf005764 for ; Thu, 30 Dec 2004 11:47:38 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.central.sun.com (8.13.1+Sun/8.13.1) with ESMTP id iBUIkYR3246641; Thu, 30 Dec 2004 12:46:34 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.13.1+Sun/8.13.1/Submit) id iBUIkYW5246640; Thu, 30 Dec 2004 12:46:34 -0600 (CST) Date: Thu, 30 Dec 2004 12:46:34 -0600 From: Nicolas Williams To: Sam Hartman Message-ID: <20041230184633.GF184117@binky.central.sun.com> Mail-Followup-To: Sam Hartman , Simon Spero , kitten@ietf.org References: <41D36F28.8090709@unc.edu> <87d5ws4bo7.fsf@luminous.mit.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87d5ws4bo7.fsf@luminous.mit.edu> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Cc: kitten@ietf.org Subject: Re: SPNEGO-bis comments/questions X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a On Thu, Dec 30, 2004 at 12:06:48AM -0500, Sam Hartman wrote: > Simon> 5.2) How can a generic implementation know ahead of time > Simon> whether a mechanism supports integrity? This is just a > Simon> subset of the bigger problem of negotiating QOP/Strength, > Simon> etc. Of course, since the only mechanism I care about is > Simon> Kerberos, I can ignore the problem for now :) > > Out of scope for this document; strictly speaking a SPNEGO You can > determine this after the context is established. If you want to know > before say to decide what mechanisms to offer, current GSSAPI provides > no mechanism so you'll have to know the OIDs of some mechanisms that > support integrity. This working group is chartered to solve that > problem too and Nico does have drafts in that space. Also, even if a given mechanism is supposed to provide for integrity protection it's entirely possible that under some circumstances it might not be able to and yet still be able to establish a security context, but that would lead to failure where a mechListMIC is needed, or, if one wasn't, to subsequent failure of the application. Nico -- _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Dec 31 07:33:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA24302; Fri, 31 Dec 2004 07:33:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkM9T-00073f-FE; Fri, 31 Dec 2004 07:45:07 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkLwv-0001RA-9L; Fri, 31 Dec 2004 07:32:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkLri-0000OH-7U for kitten@megatron.ietf.org; Fri, 31 Dec 2004 07:26:46 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA24101 for ; Fri, 31 Dec 2004 07:26:44 -0500 (EST) Received: from mail3.microsoft.com ([131.107.3.123]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkM3E-0006vI-Ll for kitten@ietf.org; Fri, 31 Dec 2004 07:38:41 -0500 Received: from mailout2.microsoft.com ([157.54.1.120]) by mail3.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 31 Dec 2004 04:26:41 -0800 Received: from red-hub-04.redmond.corp.microsoft.com ([157.54.3.6]) by mailout2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 31 Dec 2004 04:26:06 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-hub-04.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 31 Dec 2004 04:26:10 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1289); Fri, 31 Dec 2004 04:26:13 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Fri, 31 Dec 2004 04:26:12 -0800 Message-ID: Thread-Topic: SPNEGO-bis comments/questions Thread-Index: AcTum5vTWnE7jMg4Tgy1cOgt8KxQogAl8sLg From: "Liqiang\(Larry\) Zhu" To: "Simon Spero" , X-OriginalArrivalTime: 31 Dec 2004 12:26:13.0023 (UTC) FILETIME=[EA85E2F0:01C4EF33] X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c Content-Transfer-Encoding: quoted-printable Cc: kitten@ietf.org, hartmans-ietf@mit.edu Subject: RE: SPNEGO-bis comments/questions X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Content-Transfer-Encoding: quoted-printable I do not mind adding the size limit here. Two changes will be made into the next version. 1) The ContextFlags will be decorated with the size constrain. ContextFlags ::=3D BIT STRING (SIZE (32)) { delegFlag (0), mutualFlag (1), replayFlag (2), sequenceFlag (3), anonFlag (4), confFlag (5), integFlag (6) } 2) A new appendix for the ASN module will be added. -- Larry -----Original Message----- From: kitten-bounces@lists.ietf.org [mailto:kitten-bounces@lists.ietf.org] On Behalf Of Simon Spero Sent: Thursday, December 30, 2004 9:59 AM To: martin.rex@sap.com Cc: kitten@ietf.org; hartmans-ietf@mit.edu Subject: Re: SPNEGO-bis comments/questions Martin Rex wrote: >>>Not so much getting the minimal length wrong as being able to use a=20 >>>different implementation strategy. If a bit string has a fixed=20 >>>maximum size that can fit in an int, and is being used to indicate=20 >>>flags you can avoid having to create an indefinite length bit string. >>> =20 >>> > >In case that we have a requirement for DER-encoding in SPNEGO, then=20 >indefinite length encoding is not permitted. > =20 > I should have said unconstrained length. If you have a bit string whose length is constrained enough to fit entirely in a machine word, you can generate a simpler implementation; bignum vs int. Simon _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten