From owner-ietf-ltans@mail.imc.org Mon Dec 8 08:24:46 2008 Return-Path: X-Original-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Delivered-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4AC9A3A6888 for ; Mon, 8 Dec 2008 08:24:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.445 X-Spam-Level: * X-Spam-Status: No, score=1.445 tagged_above=-999 required=5 tests=[AWL=-1.207, BAYES_40=-0.185, RCVD_BAD_ID=2.837] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K9XJd9h3R-CI for ; Mon, 8 Dec 2008 08:24:45 -0800 (PST) Received: from balder-227.proper.com (properopus-pt.tunnel.tserv3.fmt2.ipv6.he.net [IPv6:2001:470:1f04:392::2]) by core3.amsl.com (Postfix) with ESMTP id ECFF53A68E3 for ; Mon, 8 Dec 2008 08:24:44 -0800 (PST) Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB8GFxfm077856 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 8 Dec 2008 09:15:59 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB8GFxaY077855; Mon, 8 Dec 2008 09:15:59 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from ganymede.on-x.com (ganymede.on-x.com [194.51.68.3]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB8GFl1w077826 for ; Mon, 8 Dec 2008 09:15:58 -0700 (MST) (envelope-from Peter.Sylvester@edelweb.fr) Received: from vinea.on-x.com (sedna.puteaux.on-x [192.168.10.9]) by ganymede.on-x.com (Postfix) with ESMTP id 5EDDB13 for ; Mon, 8 Dec 2008 17:15:42 +0100 (CET) Received: from [193.51.14.5] ([212.234.46.65]) by vinea.on-x.com (Lotus Domino Release 5.0.11) with ESMTP id 2008120817154094:253608 ; Mon, 8 Dec 2008 17:15:40 +0100 Message-ID: <493D467E.4060902@edelweb.fr> Date: Mon, 08 Dec 2008 17:08:30 +0100 From: Peter Sylvester User-Agent: Thunderbird 1.5.0.9 (X11/20061206) MIME-Version: 1.0 To: "ietf-ltans@imc.org" Subject: ERS RFC 4998 question X-MIMETrack: Itemize by SMTP Server on vinea/ON-X(Release 5.0.11 |July 24, 2002) at 12/08/2008 05:15:41 PM, Serialize by Router on vinea/ON-X(Release 5.0.11 |July 24, 2002) at 12/08/2008 05:15:42 PM, Serialize complete at 12/08/2008 05:15:42 PM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms070005040408020100030108" Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: This is a cryptographically signed message in MIME format. --------------ms070005040408020100030108 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Hi, In a recent discussion I was asked to explain how the timestamp in an ERS ArchiveTimeStamp is created.=20 The text does not seem to be clear, point 5 on page 11: 5 Obtain a timestamp for this root hash value.=20 Does it mean that the hash value will be presented directly or a hash of that value. If it is presented directly, what has to be done for the root when the algorithm supported by a TSA and the digestAlgorithm indicated in the ArchiveTimeStamp are not the same? TIA for any info /P --=20 *Edel/W/eb* Peter SYLVESTER Consultant S=E9curit=E9 des Syst=E8mes d'Information ----------------------------------------------------------- EdelWeb - Groupe ON-X 15, quai de Dion-Bouton F-92816 Puteaux Cedex Tel : +33.1.40.99.14.14 / Fax : +33.1.40.99.99.58 www.edelweb.fr / www.on-x.com ----------------------------------------------------------- To verify the message signature, see edelpki.edelweb.fr=20 Cela vous permet de charger le certificat de l'autorit=E9 de racine=20 ; die Liste mit zur=FCckgerufenen Zertifikaten finden Sie da auch. --------------ms070005040408020100030108 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIOhTCC BHIwggLfoAMCAQICBgqvijKA3jANBgkqhkiG9w0BAQUFADBbMQswCQYDVQQGEwJGUjEQMA4G A1UEChMHRWRlbFdlYjEYMBYGA1UECxMPU2VydmljZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVs UEtJIEVkZWxXZWIgUGVyc0dFTjAeFw0wNzAzMjYxMDM3MDNaFw0wOTA2MDMxMDM3MDNaMHAx CzAJBgNVBAYTAkZSMRAwDgYDVQQKDAdFZGVsV2ViMRgwFgYDVQQLDA9TZXJ2aWNlIEVkZWxQ S0kxNTAzBgNVBAMMLFBldGVyIFNZTFZFU1RFUiA8UGV0ZXIuU3lsdmVzdGVyQGVkZWx3ZWIu ZnI+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPB7ZSfmYsUuVIV0W2izxb1Zyvr6ZJ IjPiqRMs77dbEQhQ6FZhhUSuABxxc8NjZvyPMRo0uuT0iVpRDktb0fWPTx3m9qTfdqrhWg2c IOBKNbNQr8NogDJvG1AxRx4q9SXKZCVpZCoHu3fz2Rfji1kL7l597+7qBEsFd9IyvRaexQID AQABo4IBLjCCASowYgYDVR0RBFswWYEaUGV0ZXIuU3lsdmVzdGVyQGVkZWx3ZWIuZnKkOzA5 MQswCQYDVQQGEwJGUjEQMA4GA1UECgwHRWRlbFdlYjEYMBYGA1UEAwwPUGV0ZXIgU1lMVkVT VEVSMA4GA1UdDwEB/wQEAwIF4DAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwSgYD VR0fBEMwQTA/oD2gO4Y5aHR0cDovL2VkZWxwa2kuZWRlbHdlYi5mci9jcmwvRWRlbFBLSS1F ZGVsV2ViLVBlcnNHRU4uY3JsMB0GA1UdDgQWBBSZjq81LuJmsiiu1Yt/ezwCiUQSQTAfBgNV HSMEGDAWgBSe5Q/BFJVJHN1aXV6crs0Bby+UeTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBBQUA A4IBfAAUq5MJ3gXhdKDpOm0ascDE9e1iMo0RQ24ujkc9IrFXhAJNS+3eNwcJEieU2vgZTsGb zKeBZom1zVOFoh73VIRP6T08j4dDlndpDYZbxD20KzFt9zX6gV8IgR2zkkZXLQRbLyW16kw8 oFe3s//p1csCkCPAlZv1rZQYR5Psm0A1aiOiuSHhWUmgfAJxmIgfbmKtS3WpsUZVBuLQpThN rWjLRAqJKYA++++qqo3ujqAAzJLe+MHrX5dai7+n6WBfV4qo1uDArR7XbmgVpV/EdPA75XRi XEedLgbFDawJ9nAMN6WfL/NG6GZkEa7mZ7sH/gG34y21nq4w4mAAxn9wz7mDKMsEbJMZ5VlJ TOp0g6TdYqGjNoc/rQg7pqjcRChVitwd1Rl8O31+bIdNSpv4UReNMDcffRQrt+pF1FxR4q6q M9YLJU8NThx/89Mf/WF7fzrgVlsNJ78D9nJu0EhKes/9EX2qpIcHUfk/izOj8lCc1ksFgXpd UEchE0DcMIIEcjCCAt+gAwIBAgIGCq+KMoDeMA0GCSqGSIb3DQEBBQUAMFsxCzAJBgNVBAYT AkZSMRAwDgYDVQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVkZWxQS0kxIDAeBgNV BAMTF0VkZWxQS0kgRWRlbFdlYiBQZXJzR0VOMB4XDTA3MDMyNjEwMzcwM1oXDTA5MDYwMzEw MzcwM1owcDELMAkGA1UEBhMCRlIxEDAOBgNVBAoMB0VkZWxXZWIxGDAWBgNVBAsMD1NlcnZp Y2UgRWRlbFBLSTE1MDMGA1UEAwwsUGV0ZXIgU1lMVkVTVEVSIDxQZXRlci5TeWx2ZXN0ZXJA ZWRlbHdlYi5mcj4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM8HtlJ+ZixS5UhXRbaL PFvVnK+vpkkiM+KpEyzvt1sRCFDoVmGFRK4AHHFzw2Nm/I8xGjS65PSJWlEOS1vR9Y9PHeb2 pN92quFaDZwg4Eo1s1Cvw2iAMm8bUDFHHir1JcpkJWlkKge7d/PZF+OLWQvuXn3v7uoESwV3 0jK9Fp7FAgMBAAGjggEuMIIBKjBiBgNVHREEWzBZgRpQZXRlci5TeWx2ZXN0ZXJAZWRlbHdl Yi5mcqQ7MDkxCzAJBgNVBAYTAkZSMRAwDgYDVQQKDAdFZGVsV2ViMRgwFgYDVQQDDA9QZXRl ciBTWUxWRVNURVIwDgYDVR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEF BQcDAjBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vZWRlbHBraS5lZGVsd2ViLmZyL2NybC9F ZGVsUEtJLUVkZWxXZWItUGVyc0dFTi5jcmwwHQYDVR0OBBYEFJmOrzUu4mayKK7Vi397PAKJ RBJBMB8GA1UdIwQYMBaAFJ7lD8EUlUkc3VpdXpyuzQFvL5R5MAkGA1UdEwQCMAAwDQYJKoZI hvcNAQEFBQADggF8ABSrkwneBeF0oOk6bRqxwMT17WIyjRFDbi6ORz0isVeEAk1L7d43BwkS J5Ta+BlOwZvMp4FmibXNU4WiHvdUhE/pPTyPh0OWd2kNhlvEPbQrMW33NfqBXwiBHbOSRlct BFsvJbXqTDygV7ez/+nVywKQI8CVm/WtlBhHk+ybQDVqI6K5IeFZSaB8AnGYiB9uYq1Ldamx RlUG4tClOE2taMtECokpgD7776qqje6OoADMkt74wetfl1qLv6fpYF9XiqjW4MCtHtduaBWl X8R08DvldGJcR50uBsUNrAn2cAw3pZ8v80boZmQRruZnuwf+AbfjLbWerjDiYADGf3DPuYMo ywRskxnlWUlM6nSDpN1ioaM2hz+tCDumqNxEKFWK3B3VGXw7fX5sh01Km/hRF40wNx99FCu3 6kXUXFHirqoz1gslTw1OHH/z0x/9YXt/OuBWWw0nvwP2cm7QSEp6z/0RfaqkhwdR+T+LM6Py UJzWSwWBel1QRyETQNwwggWVMIIDMKADAgECAgYKwoI0lJgwDQYJKoZIhvcNAQEFBQAwUjEL MAkGA1UEBhMCRlIxEDAOBgNVBAoTB0VkZWxXZWIxGDAWBgNVBAsTD1NlcnZpY2UgRWRlbFBL STEXMBUGA1UEAxMOUmFjaW5lIEVkZWxQS0kwHhcNMDcwNjI4MTc0MDU0WhcNMTQwNTAyMTc0 MDU0WjBbMQswCQYDVQQGEwJGUjEQMA4GA1UEChMHRWRlbFdlYjEYMBYGA1UECxMPU2Vydmlj ZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVsUEtJIEVkZWxXZWIgUGVyc0dFTjCCAZwwDQYJKoZI hvcNAQEBBQADggGJADCCAYQCggF7FyeP4kRrFG9y51CeWmJIxBSMD2bcrJKIlnAPn6eH8V1M ORWTPivMNQYq32XcEi9xrxjyREvvnhABrVcW+1VLyLH8WgRY6n5A5JfuDjU6Aq0RzmjqTWDe 1+ecbgAtN8FYjVk35vdQbgfYzpGHPT0NuxiHi8NB8lNFi8rG0t2hP7WLwHLA+sIKFzA/CCRt qeGPvQkB1pRamU2IAActykfzJb6Qc50uRobWUBJtVjEBy/lgIXU0rMnQNHeCgbUvebvAT9Hd UGIPbEiX7dKHxL5/AxzHK/rA5siMzNPk8nSckDeLvpf8c/gqQRpPqufy4DazzXfZosKeJATH pyONnairmwfzMTi63PvNovrbTgzUiyH+g5zvcNoci9cke0RiLQc1pI38psgnVLtPPITgOZrS cV9zs4+sD7x7vjRco7a9H2ErfAU+8/Ui2OkR1X0z8DpyBHD/fcaDXTD+EiISL7aJHQcJRoNB CdCFgZeomsXULIYoFTa1hH//TN0z9wIDAQABo4GgMIGdMDoGA1UdHwQzMDEwL6AtoCuGKWh0 dHA6Ly9lZGVscGtpLmVkZWx3ZWIuZnIvY3JsL0VkZWxQS0kuY3JsMA8GA1UdEwQIMAYBAf8C AQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSe5Q/BFJVJHN1aXV6crs0Bby+UeTAfBgNV HSMEGDAWgBSo2SuP1LBnur1JXLwz/HdSEblnnTANBgkqhkiG9w0BAQUFAAOCAk4AUgtIR4Jh Ynyk939SM6X4YZPNYIgDio8Gp064P1MBILDgI/hzSwyxT5bb1qUQub+icXO9/5ufsDufr/ff 2gCzKMuo3hC26iey630PzHTvJgrTcEp9c92IZPt3UKeouqy+95Lz2r58dbfouKLZVwiKQ0jP 2c2U5tPWmzW4CAjFWUKRYlrhbt+tjzW8CAA0DHO1xrrzAuTyuGNKcH4LlLuVo7MbDPn/uLma 1fAVYvH2c6OTwGHJyKTQVveYw4UqgAhErJMFWJDKm+Q9h91mCzkjrA1Eu0nVDUTV1+dW6mNT DPLIq0qSdqP7iT2WcNzQVy/0PiXT2aaEH9lE2W1SSD6PnT8y+aqJTGjRMK1cl7VSJHxbq8U9 lIS+6eiV5VrogAa8X52pKF0u91i+/CBZ3e5Mi2/BwMrMN/mXA/ZwL3p+jZpnijpqnqdz8iCn qR9ExhR+BpN/b56RqEu7llLrcwOS44kjbubALjxe0+XutidWjt/6/tLYuM7rJ6Hk1EweFGVd kRejKogD3GzZ3gOAIF/D28VBJcTRcyF7OI/k/3jPD0gHUGN1uxk2Krz8SE9GEPvP/JehCBl/ FrQOCsEUmszi7Se0Vxr2k1P7icxT7L/AcWt/djIgp/vsQNurbi0+5+q7YS2b2bc1HchjsmaI cXy8ha5IGk4+F1qrHZsGqTm5M7TzZN6k0X2llMaozrtPzxNMC6uvf1uRvHYHf1x0Q0pdxTzZ PuuFw1PUlu6o5xPHbf3ZgC7ZNSDry13ZEXmlG2Re0u9WwEJJ1nYqlcDvNzGCAq4wggKqAgEB MGUwWzELMAkGA1UEBhMCRlIxEDAOBgNVBAoTB0VkZWxXZWIxGDAWBgNVBAsTD1NlcnZpY2Ug RWRlbFBLSTEgMB4GA1UEAxMXRWRlbFBLSSBFZGVsV2ViIFBlcnNHRU4CBgqvijKA3jAJBgUr DgMCGgUAoIIBnzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0w ODEyMDgxNjA4MzBaMCMGCSqGSIb3DQEJBDEWBBR6bOxxjN4GCbOddNuhFqUNH6TdCTBSBgkq hkiG9w0BCQ8xRTBDMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIB QDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDB0BgkrBgEEAYI3EAQxZzBlMFsxCzAJBgNVBAYT AkZSMRAwDgYDVQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVkZWxQS0kxIDAeBgNV BAMTF0VkZWxQS0kgRWRlbFdlYiBQZXJzR0VOAgYKr4oygN4wdgYLKoZIhvcNAQkQAgsxZ6Bl MFsxCzAJBgNVBAYTAkZSMRAwDgYDVQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVk ZWxQS0kxIDAeBgNVBAMTF0VkZWxQS0kgRWRlbFdlYiBQZXJzR0VOAgYKr4oygN4wDQYJKoZI hvcNAQEBBQAEgYDNe20aXr+QubQejA0zd/fOspReSadEEEzZsUHdDlo4FJWmVSWiPll+SFdx OCM8EfuF+48Vf1BVb5/+2TxhxyAGqV+0shzTHV5JDGhlXGYEb03XS3kWbaeW5yxhwVWdZn+7 /cCP3SkTeSDqg+2bodl1se9wib26gMCvJnu1XB828wAAAAAAAA== --------------ms070005040408020100030108-- From owner-ietf-ltans@mail.imc.org Tue Dec 9 01:52:52 2008 Return-Path: X-Original-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Delivered-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E19AD3A6802 for ; Tue, 9 Dec 2008 01:52:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.249 X-Spam-Level: X-Spam-Status: No, score=-6.249 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g8Txq3pZiOdh for ; Tue, 9 Dec 2008 01:52:52 -0800 (PST) Received: from balder-227.proper.com (properopus-pt.tunnel.tserv3.fmt2.ipv6.he.net [IPv6:2001:470:1f04:392::2]) by core3.amsl.com (Postfix) with ESMTP id C62A03A6864 for ; Tue, 9 Dec 2008 01:52:51 -0800 (PST) Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB99j4Or043090 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 9 Dec 2008 02:45:04 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB99j4hj043089; Tue, 9 Dec 2008 02:45:04 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB99ipAD043073 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 9 Dec 2008 02:45:03 -0700 (MST) (envelope-from thomas.kunz@sit.fraunhofer.de) Received: from [141.12.88.87] (sitp1_131.sit.fraunhofer.de [141.12.68.131]) (authenticated bits=0) by mailext.sit.fraunhofer.de (8.13.6/8.13.6/9.9.9) with ESMTP id mB99iqja009125 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 9 Dec 2008 10:44:52 +0100 Message-ID: <493E3DFE.4080405@sit.fraunhofer.de> Date: Tue, 09 Dec 2008 10:44:30 +0100 From: Thomas Kunz User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: "ietf-ltans@imc.org" Subject: Re: ERS RFC 4998 question References: <493D467E.4060902@edelweb.fr> In-Reply-To: <493D467E.4060902@edelweb.fr> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: The root hash value is presented directly to the TSA. I would say, before building the hash tree, you have to ensure that the hash algorithm you use is supported by the TSA. Otherwise, if the hash algorithm is not supported, you will have to re-compute the complete hash tree. - Thomas Peter Sylvester schrieb: > Hi, > > In a recent discussion I was asked to explain how the timestamp > in an ERS ArchiveTimeStamp is created. > The text does not seem to be clear, point 5 on page 11: > > 5 Obtain a timestamp for this root hash value. > Does it mean that the hash value will be presented directly > or a hash of that value. > > If it is presented directly, what has to be done for the root > when the algorithm supported by a TSA and the digestAlgorithm > indicated in the ArchiveTimeStamp are not the same? > > TIA for any info > /P > > From owner-ietf-ltans@mail.imc.org Tue Dec 9 02:45:07 2008 Return-Path: X-Original-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Delivered-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 10B9D3A68A5 for ; Tue, 9 Dec 2008 02:45:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.249 X-Spam-Level: X-Spam-Status: No, score=-2.249 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vhGJyhR9eqCz for ; Tue, 9 Dec 2008 02:45:06 -0800 (PST) Received: from balder-227.proper.com (properopus-pt.tunnel.tserv3.fmt2.ipv6.he.net [IPv6:2001:470:1f04:392::2]) by core3.amsl.com (Postfix) with ESMTP id E37723A679C for ; Tue, 9 Dec 2008 02:45:05 -0800 (PST) Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9AcBLw046975 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 9 Dec 2008 03:38:11 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB9AcB1t046974; Tue, 9 Dec 2008 03:38:11 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from mail.seccommerce.de (mail.seccommerce.de [80.152.147.206]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9Abw4L046965 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 9 Dec 2008 03:38:10 -0700 (MST) (envelope-from tk-tlslist@seccommerce.de) Received: (qmail 11708 invoked from network); 9 Dec 2008 11:37:56 +0100 Received: from trebel.sec.intern (HELO ?10.3.0.1?) (10.3.0.1) by mail.seccommerce.de with AES256-SHA encrypted SMTP; 9 Dec 2008 11:37:55 +0100 Message-ID: <493E4A79.104@seccommerce.de> Date: Tue, 09 Dec 2008 11:37:45 +0100 From: Tilo Kienitz User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: Peter Sylvester CC: "ietf-ltans@imc.org" Subject: Re: ERS RFC 4998 question References: <493D467E.4060902@edelweb.fr> In-Reply-To: <493D467E.4060902@edelweb.fr> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Peter Sylvester wrote: > In a recent discussion I was asked to explain how the timestamp > in an ERS ArchiveTimeStamp is created. > The text does not seem to be clear, point 5 on page 11: > > 5 Obtain a timestamp for this root hash value. > Does it mean that the hash value will be presented directly > or a hash of that value. > > If it is presented directly, what has to be done for the root > when the algorithm supported by a TSA and the digestAlgorithm > indicated in the ArchiveTimeStamp are not the same? We had the same problem and implemented the following: The hash tree uses SHA-256. a) If the TSA supports SHA-256, then the root hash value is presented directly to the TSA. b) If the TSA only supports SHA-1, then an SHA-1 hash over the root hash is computed and sent to the TSA. As Thomas Kunz writes, b is not exactly what the RFC wants. However, we had no other choice, because we need qualified time stamps according to the german signature law. Such timestamps were not available with SHA-256 until about a year ago. So we had to use SHA-1 timestamps for a while. Kind regards Tilo From owner-ietf-ltans@mail.imc.org Tue Dec 9 08:42:34 2008 Return-Path: X-Original-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Delivered-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8550C3A686C for ; Tue, 9 Dec 2008 08:42:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OdJhEfD0KjRU for ; Tue, 9 Dec 2008 08:42:33 -0800 (PST) Received: from balder-227.proper.com (properopus-pt.tunnel.tserv3.fmt2.ipv6.he.net [IPv6:2001:470:1f04:392::2]) by core3.amsl.com (Postfix) with ESMTP id 29CE73A6823 for ; Tue, 9 Dec 2008 08:42:32 -0800 (PST) Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9GXriZ068131 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 9 Dec 2008 09:33:53 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB9GXrww068130; Tue, 9 Dec 2008 09:33:53 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from elasmtp-mealy.atl.sa.earthlink.net (elasmtp-mealy.atl.sa.earthlink.net [209.86.89.69]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9GXf2a068121 for ; Tue, 9 Dec 2008 09:33:51 -0700 (MST) (envelope-from tglassey@earthlink.net) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=lRp6kPIxq7fV6VCy5l8HG4TS8ByUZvXrRmukoEc9DxEu/mAo7vua7s1XaKk07qOW; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:CC:Subject:References:In-Reply-To:Content-Type:Content-Transfer-Encoding:X-ELNK-Trace:X-Originating-IP; Received: from [64.125.79.23] (helo=[192.168.0.32]) by elasmtp-mealy.atl.sa.earthlink.net with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.67) (envelope-from ) id 1LA5Wm-0007if-Ty; Tue, 09 Dec 2008 11:33:41 -0500 Message-ID: <493E9DE9.2030900@earthlink.net> Date: Tue, 09 Dec 2008 08:33:45 -0800 From: TSG User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: Thomas Kunz CC: "ietf-ltans@imc.org" Subject: Re: ERS RFC 4998 question References: <493D467E.4060902@edelweb.fr> <493E3DFE.4080405@sit.fraunhofer.de> In-Reply-To: <493E3DFE.4080405@sit.fraunhofer.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-ELNK-Trace: 01b7a7e171bdf5911aa676d7e74259b7b3291a7d08dfec7944631f5df0c72b38b3bbc7b620dd42fe350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 64.125.79.23 Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Thomas Kunz wrote: > > The root hash value is presented directly to the TSA. > I would say, before building the hash tree, you have to ensure that > the hash algorithm you use is supported by the TSA. Otherwise, if the > hash algorithm is not supported, you will have to re-compute the > complete hash tree. Or you have to have a way of specifying any number of Hash Values which could be supported by the TSA in its operations. Todd > > - Thomas > > > Peter Sylvester schrieb: >> Hi, >> >> In a recent discussion I was asked to explain how the timestamp >> in an ERS ArchiveTimeStamp is created. >> The text does not seem to be clear, point 5 on page 11: >> >> 5 Obtain a timestamp for this root hash value. >> Does it mean that the hash value will be presented directly >> or a hash of that value. >> >> If it is presented directly, what has to be done for the root >> when the algorithm supported by a TSA and the digestAlgorithm >> indicated in the ArchiveTimeStamp are not the same? >> >> TIA for any info >> /P >> >> > ------------------------------------------------------------------------ > > > Internal Virus Database is out of date. > Checked by AVG - http://www.avg.com > Version: 8.0.176 / Virus Database: 270.9.11/1818 - Release Date: 11/28/2008 7:31 PM > > From owner-ietf-ltans@mail.imc.org Tue Dec 9 10:28:01 2008 Return-Path: X-Original-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Delivered-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 147443A6810 for ; Tue, 9 Dec 2008 10:28:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZSynynDl2jXe for ; Tue, 9 Dec 2008 10:28:00 -0800 (PST) Received: from balder-227.proper.com (properopus-pt.tunnel.tserv3.fmt2.ipv6.he.net [IPv6:2001:470:1f04:392::2]) by core3.amsl.com (Postfix) with ESMTP id CAB3C3A6917 for ; Tue, 9 Dec 2008 10:27:59 -0800 (PST) Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9ILla5075144 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 9 Dec 2008 11:21:47 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB9ILl9V075143; Tue, 9 Dec 2008 11:21:47 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from maiev.nerim.net (smtp-116-tuesday.nerim.net [62.4.16.116]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9ILZSm075127 for ; Tue, 9 Dec 2008 11:21:46 -0700 (MST) (envelope-from julien.stern@cryptolog.com) Received: from uranus.cry.pto (cryptolog2.pck.nerim.net [213.41.184.9]) by maiev.nerim.net (Postfix) with ESMTP id 5B3A7B8151 for ; Tue, 9 Dec 2008 19:21:32 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by uranus.cry.pto (Postfix) with ESMTP id 5B1F5440AF for ; Tue, 9 Dec 2008 19:21:32 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at cryptolog.com Received: from uranus.cry.pto ([127.0.0.1]) by localhost (uranus.cry.pto [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQ1ZERLCupJb for ; Tue, 9 Dec 2008 19:21:29 +0100 (CET) Received: from mars.cry.pto (leda.cry.pto [10.0.1.30]) by uranus.cry.pto (Postfix) with SMTP id ECE604401B for ; Tue, 9 Dec 2008 19:21:27 +0100 (CET) Received: by mars.cry.pto (sSMTP sendmail emulation); Tue, 09 Dec 2008 19:21:27 +0100 Date: Tue, 9 Dec 2008 19:21:27 +0100 From: Julien Stern To: "ietf-ltans@imc.org" Subject: Re: ERS RFC 4998 question Message-ID: <20081209182119.GA15904@mars.cry.pto> Mail-Followup-To: Julien Stern , "ietf-ltans@imc.org" References: <493D467E.4060902@edelweb.fr> <493E4A79.104@seccommerce.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <493E4A79.104@seccommerce.de> User-Agent: Mutt/1.5.17+20080114 (2008-01-14) Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Hi list, allow me to jump in. I think that section 4.3 makes in reasonnably clear that it is indeed the hash which is directly presented. "Check timestamp. In case of a timestamp according to [RFC3161], the root hash value must correspond to hashedMessage, and digestAlgorithm must correspond to hashAlgorithm field, both in messageImprint field of timeStampToken." and that this is consistent with paragraph 3.2: "Using this approach, it is possible to "convert" existing timestamps into ArchiveTimestamps for renewal." However, I must say that section 4.2 is not perfectly clear: "Obtain a timestamp for this root hash value. The hash algorithm in the timestamp request MUST be the same as the hash algorithm of the hash tree, or the digestAlgorithm field of the ArchiveTimeStamp MUST be present and specify the hash algorithm of the hash tree." The first sentence could mean both interpretations (directly present the hash or hash it). The second sentence is really unclear: I fail to see a place where the RFC defines the way the handle an ERS if the hash digestAlgorithm is different than the digest used by the timestamp. My current interpretation is the following: 1) If one uses RFC 3161 then, the hash algorithm used in the hash tree MUST be the same as the one used in the timestamp (and the root is directly presented). In that case, the digestAlgorithm MUST either be absent or equals to the timestamp hash. 2) If other kind of timestamps are used, guidance is not as clear and it could happen that the hash values are different (altough I would not exactly know how to interpret it). Does this make sense to you ? -- Julien On Tue, Dec 09, 2008 at 11:37:45AM +0100, Tilo Kienitz wrote: > > Peter Sylvester wrote: >> In a recent discussion I was asked to explain how the timestamp >> in an ERS ArchiveTimeStamp is created. >> The text does not seem to be clear, point 5 on page 11: >> >> 5 Obtain a timestamp for this root hash value. >> Does it mean that the hash value will be presented directly >> or a hash of that value. >> >> If it is presented directly, what has to be done for the root >> when the algorithm supported by a TSA and the digestAlgorithm >> indicated in the ArchiveTimeStamp are not the same? > > We had the same problem and implemented the following: > > The hash tree uses SHA-256. > > a) If the TSA supports SHA-256, then the root hash value is > presented directly to the TSA. > b) If the TSA only supports SHA-1, then an SHA-1 hash over the > root hash is computed and sent to the TSA. > > As Thomas Kunz writes, b is not exactly what the RFC wants. However, > we had no other choice, because we need qualified time stamps > according to the german signature law. Such timestamps were not > available with SHA-256 until about a year ago. So we had to use > SHA-1 timestamps for a while. > > Kind regards > Tilo > From owner-ietf-ltans@mail.imc.org Thu Dec 11 07:24:47 2008 Return-Path: X-Original-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Delivered-To: ietfarch-ltans-archive-ba2WohFa@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EF60E3A689F for ; Thu, 11 Dec 2008 07:24:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.751 X-Spam-Level: X-Spam-Status: No, score=-2.751 tagged_above=-999 required=5 tests=[AWL=-1.283, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Eni8m5RsTGyx for ; Thu, 11 Dec 2008 07:24:43 -0800 (PST) Received: from balder-227.proper.com (properopus-pt.tunnel.tserv3.fmt2.ipv6.he.net [IPv6:2001:470:1f04:392::2]) by core3.amsl.com (Postfix) with ESMTP id 2D8D73A68AA for ; Thu, 11 Dec 2008 07:24:42 -0800 (PST) Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mBBFGeHx017207 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 11 Dec 2008 08:16:40 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mBBFGegA017206; Thu, 11 Dec 2008 08:16:40 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from scygmxsecs1.cygnacom.com (scygmxsecs1.cygnacom.com [65.242.48.253]) by balder-227.proper.com (8.14.2/8.14.2) with SMTP id mBBFGTO0017195 for ; Thu, 11 Dec 2008 08:16:39 -0700 (MST) (envelope-from CWallace@cygnacom.com) Received: (qmail 25339 invoked from network); 11 Dec 2008 15:15:52 -0000 Received: from CWallace@cygnacom.com by scygmxsecs1.cygnacom.com with EntrustECS-Server-7.4;11 Dec 2008 15:15:52 -0000 Received: from unknown (HELO scygexch1.cygnacom.com) (10.60.50.8) by scygmxsecs1.cygnacom.com with SMTP; 11 Dec 2008 15:15:52 -0000 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C95BA3.707F9C84" X-MimeOLE: Produced By Microsoft Exchange V6.5 Subject: FW: NIST Special Publications - Public Comments Requested Date: Thu, 11 Dec 2008 10:16:27 -0500 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: NIST Special Publications - Public Comments Requested thread-index: AclboIKQdTpc6gpNTLuKbyWirx8SPgAAtXQg From: "Carl Wallace" To: Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: This is a multi-part message in MIME format. ------_=_NextPart_001_01C95BA3.707F9C84 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The third of the NIST special publications listed below may be of interest to folks on this list. ________________________________ From: Sara Caswell [mailto:sara@nist.gov]=20 Sent: Thursday, December 11, 2008 9:38 AM To: Sara Caswell Subject: NIST Special Publications - Public Comments Requested NIST requests comments on Draft SP 800-56B, Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography. This Recommendation provides the specifications of asymmetric-based key agreement and key transport schemes that are based on the Rivest Shamir Adleman (RSA) algorithm. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-56B/Draft_SP800-56B_Dec 2008.pdf. Please provide comments to ebarker@nist.gov by February 12, 2009, with "Comments on SP 800-56B" in the subject line. Please note that the public comments period for FIPS 186-3, the Digital Signature Standard, closes on Friday, December 12, 2008. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-57-part3/Draft_SP800-57 -Part3_Recommendationforkeymanagement.pdf. Send any comments by the due date, as we intend to finalize this Standard as soon as possible. Please submit comments to ebarker@nist.gov with "Comments on Draft 186-3" in the subject line. Also, the public comment period on SP 800-102, Recommendation for Digital Signature Timeliness, closes on Friday, December 19, 2008. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-102/Draft_SP800-102.pdf . Please provide comments to ebarker@nist.gov with "Comments on SP 800-102" in the subject line=20 ------_=_NextPart_001_01C95BA3.707F9C84 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
The third of the NIST special publications = listed below may=20 be of interest to folks on this list.

From: Sara Caswell = [mailto:sara@nist.gov]=20
Sent: Thursday, December 11, 2008 9:38 AM
To: Sara=20 Caswell
Subject: NIST Special Publications - Public Comments=20 Requested

NIST requests comments on Draft SP 800-56B, Recommendation = for=20 Pair-Wise Key Establishment Using Integer Factorization = Cryptography. This=20 Recommendation provides the specifications of asymmetric-based key = agreement and=20 key transport schemes that are based on the Rivest Shamir Adleman (RSA)=20 algorithm. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-56B/Dra= ft_SP800-56B_Dec2008.pdf.=20 Please provide comments to ebarker@nist.gov by February 12, = 2009,=20 with “Comments on SP 800-56B” in the subject = line.


Please note that=20 the public comments period for FIPS 186-3, the Digital Signature=20 Standard, closes on Friday, December 12, 2008. The draft is = available at=20 http://www.csrc.nist.go= v/publications/drafts/800-57-part3/Draft_SP800-57-Part3_Recommendationfor= keymanagement.pdf.=20 Send any comments by the due date, as we intend to finalize this = Standard as=20 soon as possible. Please submit comments to ebarker@nist.gov with "Comments on = Draft=20 186-3" in the subject line.


Also, the public comment = period on=20 SP 800-102, Recommendation for Digital Signature Timeliness, = closes on=20 Friday, December 19, 2008. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-102/Draft_SP800= -102.pdf.=20 Please provide comments to ebarker@nist.gov with = “Comments on SP=20 800-102” in the subject line ------_=_NextPart_001_01C95BA3.707F9C84-- Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mBBFGeHx017207 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 11 Dec 2008 08:16:40 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mBBFGegA017206; Thu, 11 Dec 2008 08:16:40 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from scygmxsecs1.cygnacom.com (scygmxsecs1.cygnacom.com [65.242.48.253]) by balder-227.proper.com (8.14.2/8.14.2) with SMTP id mBBFGTO0017195 for ; Thu, 11 Dec 2008 08:16:39 -0700 (MST) (envelope-from CWallace@cygnacom.com) Received: (qmail 25339 invoked from network); 11 Dec 2008 15:15:52 -0000 Received: from CWallace@cygnacom.com by scygmxsecs1.cygnacom.com with EntrustECS-Server-7.4;11 Dec 2008 15:15:52 -0000 Received: from unknown (HELO scygexch1.cygnacom.com) (10.60.50.8) by scygmxsecs1.cygnacom.com with SMTP; 11 Dec 2008 15:15:52 -0000 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C95BA3.707F9C84" X-MimeOLE: Produced By Microsoft Exchange V6.5 Subject: FW: NIST Special Publications - Public Comments Requested Date: Thu, 11 Dec 2008 10:16:27 -0500 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: NIST Special Publications - Public Comments Requested thread-index: AclboIKQdTpc6gpNTLuKbyWirx8SPgAAtXQg From: "Carl Wallace" To: Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: This is a multi-part message in MIME format. ------_=_NextPart_001_01C95BA3.707F9C84 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The third of the NIST special publications listed below may be of interest to folks on this list. ________________________________ From: Sara Caswell [mailto:sara@nist.gov]=20 Sent: Thursday, December 11, 2008 9:38 AM To: Sara Caswell Subject: NIST Special Publications - Public Comments Requested NIST requests comments on Draft SP 800-56B, Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography. This Recommendation provides the specifications of asymmetric-based key agreement and key transport schemes that are based on the Rivest Shamir Adleman (RSA) algorithm. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-56B/Draft_SP800-56B_Dec 2008.pdf. Please provide comments to ebarker@nist.gov by February 12, 2009, with "Comments on SP 800-56B" in the subject line. Please note that the public comments period for FIPS 186-3, the Digital Signature Standard, closes on Friday, December 12, 2008. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-57-part3/Draft_SP800-57 -Part3_Recommendationforkeymanagement.pdf. Send any comments by the due date, as we intend to finalize this Standard as soon as possible. Please submit comments to ebarker@nist.gov with "Comments on Draft 186-3" in the subject line. Also, the public comment period on SP 800-102, Recommendation for Digital Signature Timeliness, closes on Friday, December 19, 2008. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-102/Draft_SP800-102.pdf . Please provide comments to ebarker@nist.gov with "Comments on SP 800-102" in the subject line=20 ------_=_NextPart_001_01C95BA3.707F9C84 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
The third of the NIST special publications = listed below may=20 be of interest to folks on this list.

From: Sara Caswell = [mailto:sara@nist.gov]=20
Sent: Thursday, December 11, 2008 9:38 AM
To: Sara=20 Caswell
Subject: NIST Special Publications - Public Comments=20 Requested

NIST requests comments on Draft SP 800-56B, Recommendation = for=20 Pair-Wise Key Establishment Using Integer Factorization = Cryptography. This=20 Recommendation provides the specifications of asymmetric-based key = agreement and=20 key transport schemes that are based on the Rivest Shamir Adleman (RSA)=20 algorithm. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-56B/Dra= ft_SP800-56B_Dec2008.pdf.=20 Please provide comments to ebarker@nist.gov by February 12, = 2009,=20 with “Comments on SP 800-56B” in the subject = line.


Please note that=20 the public comments period for FIPS 186-3, the Digital Signature=20 Standard, closes on Friday, December 12, 2008. The draft is = available at=20 http://www.csrc.nist.go= v/publications/drafts/800-57-part3/Draft_SP800-57-Part3_Recommendationfor= keymanagement.pdf.=20 Send any comments by the due date, as we intend to finalize this = Standard as=20 soon as possible. Please submit comments to ebarker@nist.gov with "Comments on = Draft=20 186-3" in the subject line.


Also, the public comment = period on=20 SP 800-102, Recommendation for Digital Signature Timeliness, = closes on=20 Friday, December 19, 2008. The draft is available at http://www.csrc.nist.gov/publications/drafts/800-102/Draft_SP800= -102.pdf.=20 Please provide comments to ebarker@nist.gov with = “Comments on SP=20 800-102” in the subject line ------_=_NextPart_001_01C95BA3.707F9C84-- Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9ILla5075144 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 9 Dec 2008 11:21:47 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB9ILl9V075143; Tue, 9 Dec 2008 11:21:47 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from maiev.nerim.net (smtp-116-tuesday.nerim.net [62.4.16.116]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9ILZSm075127 for ; Tue, 9 Dec 2008 11:21:46 -0700 (MST) (envelope-from julien.stern@cryptolog.com) Received: from uranus.cry.pto (cryptolog2.pck.nerim.net [213.41.184.9]) by maiev.nerim.net (Postfix) with ESMTP id 5B3A7B8151 for ; Tue, 9 Dec 2008 19:21:32 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by uranus.cry.pto (Postfix) with ESMTP id 5B1F5440AF for ; Tue, 9 Dec 2008 19:21:32 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at cryptolog.com Received: from uranus.cry.pto ([127.0.0.1]) by localhost (uranus.cry.pto [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQ1ZERLCupJb for ; Tue, 9 Dec 2008 19:21:29 +0100 (CET) Received: from mars.cry.pto (leda.cry.pto [10.0.1.30]) by uranus.cry.pto (Postfix) with SMTP id ECE604401B for ; Tue, 9 Dec 2008 19:21:27 +0100 (CET) Received: by mars.cry.pto (sSMTP sendmail emulation); Tue, 09 Dec 2008 19:21:27 +0100 Date: Tue, 9 Dec 2008 19:21:27 +0100 From: Julien Stern To: "ietf-ltans@imc.org" Subject: Re: ERS RFC 4998 question Message-ID: <20081209182119.GA15904@mars.cry.pto> Mail-Followup-To: Julien Stern , "ietf-ltans@imc.org" References: <493D467E.4060902@edelweb.fr> <493E4A79.104@seccommerce.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <493E4A79.104@seccommerce.de> User-Agent: Mutt/1.5.17+20080114 (2008-01-14) Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Hi list, allow me to jump in. I think that section 4.3 makes in reasonnably clear that it is indeed the hash which is directly presented. "Check timestamp. In case of a timestamp according to [RFC3161], the root hash value must correspond to hashedMessage, and digestAlgorithm must correspond to hashAlgorithm field, both in messageImprint field of timeStampToken." and that this is consistent with paragraph 3.2: "Using this approach, it is possible to "convert" existing timestamps into ArchiveTimestamps for renewal." However, I must say that section 4.2 is not perfectly clear: "Obtain a timestamp for this root hash value. The hash algorithm in the timestamp request MUST be the same as the hash algorithm of the hash tree, or the digestAlgorithm field of the ArchiveTimeStamp MUST be present and specify the hash algorithm of the hash tree." The first sentence could mean both interpretations (directly present the hash or hash it). The second sentence is really unclear: I fail to see a place where the RFC defines the way the handle an ERS if the hash digestAlgorithm is different than the digest used by the timestamp. My current interpretation is the following: 1) If one uses RFC 3161 then, the hash algorithm used in the hash tree MUST be the same as the one used in the timestamp (and the root is directly presented). In that case, the digestAlgorithm MUST either be absent or equals to the timestamp hash. 2) If other kind of timestamps are used, guidance is not as clear and it could happen that the hash values are different (altough I would not exactly know how to interpret it). Does this make sense to you ? -- Julien On Tue, Dec 09, 2008 at 11:37:45AM +0100, Tilo Kienitz wrote: > > Peter Sylvester wrote: >> In a recent discussion I was asked to explain how the timestamp >> in an ERS ArchiveTimeStamp is created. >> The text does not seem to be clear, point 5 on page 11: >> >> 5 Obtain a timestamp for this root hash value. >> Does it mean that the hash value will be presented directly >> or a hash of that value. >> >> If it is presented directly, what has to be done for the root >> when the algorithm supported by a TSA and the digestAlgorithm >> indicated in the ArchiveTimeStamp are not the same? > > We had the same problem and implemented the following: > > The hash tree uses SHA-256. > > a) If the TSA supports SHA-256, then the root hash value is > presented directly to the TSA. > b) If the TSA only supports SHA-1, then an SHA-1 hash over the > root hash is computed and sent to the TSA. > > As Thomas Kunz writes, b is not exactly what the RFC wants. However, > we had no other choice, because we need qualified time stamps > according to the german signature law. Such timestamps were not > available with SHA-256 until about a year ago. So we had to use > SHA-1 timestamps for a while. > > Kind regards > Tilo > Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9GXriZ068131 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 9 Dec 2008 09:33:53 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB9GXrww068130; Tue, 9 Dec 2008 09:33:53 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from elasmtp-mealy.atl.sa.earthlink.net (elasmtp-mealy.atl.sa.earthlink.net [209.86.89.69]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9GXf2a068121 for ; Tue, 9 Dec 2008 09:33:51 -0700 (MST) (envelope-from tglassey@earthlink.net) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=lRp6kPIxq7fV6VCy5l8HG4TS8ByUZvXrRmukoEc9DxEu/mAo7vua7s1XaKk07qOW; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:CC:Subject:References:In-Reply-To:Content-Type:Content-Transfer-Encoding:X-ELNK-Trace:X-Originating-IP; Received: from [64.125.79.23] (helo=[192.168.0.32]) by elasmtp-mealy.atl.sa.earthlink.net with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.67) (envelope-from ) id 1LA5Wm-0007if-Ty; Tue, 09 Dec 2008 11:33:41 -0500 Message-ID: <493E9DE9.2030900@earthlink.net> Date: Tue, 09 Dec 2008 08:33:45 -0800 From: TSG User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: Thomas Kunz CC: "ietf-ltans@imc.org" Subject: Re: ERS RFC 4998 question References: <493D467E.4060902@edelweb.fr> <493E3DFE.4080405@sit.fraunhofer.de> In-Reply-To: <493E3DFE.4080405@sit.fraunhofer.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-ELNK-Trace: 01b7a7e171bdf5911aa676d7e74259b7b3291a7d08dfec7944631f5df0c72b38b3bbc7b620dd42fe350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 64.125.79.23 Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Thomas Kunz wrote: > > The root hash value is presented directly to the TSA. > I would say, before building the hash tree, you have to ensure that > the hash algorithm you use is supported by the TSA. Otherwise, if the > hash algorithm is not supported, you will have to re-compute the > complete hash tree. Or you have to have a way of specifying any number of Hash Values which could be supported by the TSA in its operations. Todd > > - Thomas > > > Peter Sylvester schrieb: >> Hi, >> >> In a recent discussion I was asked to explain how the timestamp >> in an ERS ArchiveTimeStamp is created. >> The text does not seem to be clear, point 5 on page 11: >> >> 5 Obtain a timestamp for this root hash value. >> Does it mean that the hash value will be presented directly >> or a hash of that value. >> >> If it is presented directly, what has to be done for the root >> when the algorithm supported by a TSA and the digestAlgorithm >> indicated in the ArchiveTimeStamp are not the same? >> >> TIA for any info >> /P >> >> > ------------------------------------------------------------------------ > > > Internal Virus Database is out of date. > Checked by AVG - http://www.avg.com > Version: 8.0.176 / Virus Database: 270.9.11/1818 - Release Date: 11/28/2008 7:31 PM > > Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9AcBLw046975 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 9 Dec 2008 03:38:11 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB9AcB1t046974; Tue, 9 Dec 2008 03:38:11 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from mail.seccommerce.de (mail.seccommerce.de [80.152.147.206]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB9Abw4L046965 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 9 Dec 2008 03:38:10 -0700 (MST) (envelope-from tk-tlslist@seccommerce.de) Received: (qmail 11708 invoked from network); 9 Dec 2008 11:37:56 +0100 X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on mail.seccommerce.de X-Spam-Level: X-Spam-Status: No, score=-4.0 required=1.0 tests=ALL_TRUSTED,BAYES_00 autolearn=ham version=3.2.4 Received: from trebel.sec.intern (HELO ?10.3.0.1?) (10.3.0.1) by mail.seccommerce.de with AES256-SHA encrypted SMTP; 9 Dec 2008 11:37:55 +0100 Message-ID: <493E4A79.104@seccommerce.de> Date: Tue, 09 Dec 2008 11:37:45 +0100 From: Tilo Kienitz User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: Peter Sylvester CC: "ietf-ltans@imc.org" Subject: Re: ERS RFC 4998 question References: <493D467E.4060902@edelweb.fr> In-Reply-To: <493D467E.4060902@edelweb.fr> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Peter Sylvester wrote: > In a recent discussion I was asked to explain how the timestamp > in an ERS ArchiveTimeStamp is created. > The text does not seem to be clear, point 5 on page 11: > > 5 Obtain a timestamp for this root hash value. > Does it mean that the hash value will be presented directly > or a hash of that value. > > If it is presented directly, what has to be done for the root > when the algorithm supported by a TSA and the digestAlgorithm > indicated in the ArchiveTimeStamp are not the same? We had the same problem and implemented the following: The hash tree uses SHA-256. a) If the TSA supports SHA-256, then the root hash value is presented directly to the TSA. b) If the TSA only supports SHA-1, then an SHA-1 hash over the root hash is computed and sent to the TSA. As Thomas Kunz writes, b is not exactly what the RFC wants. However, we had no other choice, because we need qualified time stamps according to the german signature law. Such timestamps were not available with SHA-256 until about a year ago. So we had to use SHA-1 timestamps for a while. Kind regards Tilo Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB99j4Or043090 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 9 Dec 2008 02:45:04 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB99j4hj043089; Tue, 9 Dec 2008 02:45:04 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB99ipAD043073 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 9 Dec 2008 02:45:03 -0700 (MST) (envelope-from thomas.kunz@sit.fraunhofer.de) Received: from [141.12.88.87] (sitp1_131.sit.fraunhofer.de [141.12.68.131]) (authenticated bits=0) by mailext.sit.fraunhofer.de (8.13.6/8.13.6/9.9.9) with ESMTP id mB99iqja009125 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 9 Dec 2008 10:44:52 +0100 Message-ID: <493E3DFE.4080405@sit.fraunhofer.de> Date: Tue, 09 Dec 2008 10:44:30 +0100 From: Thomas Kunz User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: "ietf-ltans@imc.org" Subject: Re: ERS RFC 4998 question References: <493D467E.4060902@edelweb.fr> In-Reply-To: <493D467E.4060902@edelweb.fr> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: The root hash value is presented directly to the TSA. I would say, before building the hash tree, you have to ensure that the hash algorithm you use is supported by the TSA. Otherwise, if the hash algorithm is not supported, you will have to re-compute the complete hash tree. - Thomas Peter Sylvester schrieb: > Hi, > > In a recent discussion I was asked to explain how the timestamp > in an ERS ArchiveTimeStamp is created. > The text does not seem to be clear, point 5 on page 11: > > 5 Obtain a timestamp for this root hash value. > Does it mean that the hash value will be presented directly > or a hash of that value. > > If it is presented directly, what has to be done for the root > when the algorithm supported by a TSA and the digestAlgorithm > indicated in the ArchiveTimeStamp are not the same? > > TIA for any info > /P > > Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB8GFxfm077856 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 8 Dec 2008 09:15:59 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id mB8GFxaY077855; Mon, 8 Dec 2008 09:15:59 -0700 (MST) (envelope-from owner-ietf-ltans@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-ltans@mail.imc.org using -f Received: from ganymede.on-x.com (ganymede.on-x.com [194.51.68.3]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB8GFl1w077826 for ; Mon, 8 Dec 2008 09:15:58 -0700 (MST) (envelope-from Peter.Sylvester@edelweb.fr) Received: from vinea.on-x.com (sedna.puteaux.on-x [192.168.10.9]) by ganymede.on-x.com (Postfix) with ESMTP id 5EDDB13 for ; Mon, 8 Dec 2008 17:15:42 +0100 (CET) Received: from [193.51.14.5] ([212.234.46.65]) by vinea.on-x.com (Lotus Domino Release 5.0.11) with ESMTP id 2008120817154094:253608 ; Mon, 8 Dec 2008 17:15:40 +0100 Message-ID: <493D467E.4060902@edelweb.fr> Date: Mon, 08 Dec 2008 17:08:30 +0100 From: Peter Sylvester User-Agent: Thunderbird 1.5.0.9 (X11/20061206) MIME-Version: 1.0 To: "ietf-ltans@imc.org" Subject: ERS RFC 4998 question X-MIMETrack: Itemize by SMTP Server on vinea/ON-X(Release 5.0.11 |July 24, 2002) at 12/08/2008 05:15:41 PM, Serialize by Router on vinea/ON-X(Release 5.0.11 |July 24, 2002) at 12/08/2008 05:15:42 PM, Serialize complete at 12/08/2008 05:15:42 PM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms070005040408020100030108" Sender: owner-ietf-ltans@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: This is a cryptographically signed message in MIME format. --------------ms070005040408020100030108 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Hi, In a recent discussion I was asked to explain how the timestamp in an ERS ArchiveTimeStamp is created.=20 The text does not seem to be clear, point 5 on page 11: 5 Obtain a timestamp for this root hash value.=20 Does it mean that the hash value will be presented directly or a hash of that value. If it is presented directly, what has to be done for the root when the algorithm supported by a TSA and the digestAlgorithm indicated in the ArchiveTimeStamp are not the same? TIA for any info /P --=20 *Edel/W/eb* Peter SYLVESTER Consultant S=E9curit=E9 des Syst=E8mes d'Information ----------------------------------------------------------- EdelWeb - Groupe ON-X 15, quai de Dion-Bouton F-92816 Puteaux Cedex Tel : +33.1.40.99.14.14 / Fax : +33.1.40.99.99.58 www.edelweb.fr / www.on-x.com ----------------------------------------------------------- To verify the message signature, see edelpki.edelweb.fr=20 Cela vous permet de charger le certificat de l'autorit=E9 de racine=20 ; die Liste mit zur=FCckgerufenen Zertifikaten finden Sie da auch. --------------ms070005040408020100030108 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIOhTCC BHIwggLfoAMCAQICBgqvijKA3jANBgkqhkiG9w0BAQUFADBbMQswCQYDVQQGEwJGUjEQMA4G A1UEChMHRWRlbFdlYjEYMBYGA1UECxMPU2VydmljZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVs UEtJIEVkZWxXZWIgUGVyc0dFTjAeFw0wNzAzMjYxMDM3MDNaFw0wOTA2MDMxMDM3MDNaMHAx CzAJBgNVBAYTAkZSMRAwDgYDVQQKDAdFZGVsV2ViMRgwFgYDVQQLDA9TZXJ2aWNlIEVkZWxQ S0kxNTAzBgNVBAMMLFBldGVyIFNZTFZFU1RFUiA8UGV0ZXIuU3lsdmVzdGVyQGVkZWx3ZWIu ZnI+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPB7ZSfmYsUuVIV0W2izxb1Zyvr6ZJ IjPiqRMs77dbEQhQ6FZhhUSuABxxc8NjZvyPMRo0uuT0iVpRDktb0fWPTx3m9qTfdqrhWg2c IOBKNbNQr8NogDJvG1AxRx4q9SXKZCVpZCoHu3fz2Rfji1kL7l597+7qBEsFd9IyvRaexQID AQABo4IBLjCCASowYgYDVR0RBFswWYEaUGV0ZXIuU3lsdmVzdGVyQGVkZWx3ZWIuZnKkOzA5 MQswCQYDVQQGEwJGUjEQMA4GA1UECgwHRWRlbFdlYjEYMBYGA1UEAwwPUGV0ZXIgU1lMVkVT VEVSMA4GA1UdDwEB/wQEAwIF4DAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwSgYD VR0fBEMwQTA/oD2gO4Y5aHR0cDovL2VkZWxwa2kuZWRlbHdlYi5mci9jcmwvRWRlbFBLSS1F ZGVsV2ViLVBlcnNHRU4uY3JsMB0GA1UdDgQWBBSZjq81LuJmsiiu1Yt/ezwCiUQSQTAfBgNV HSMEGDAWgBSe5Q/BFJVJHN1aXV6crs0Bby+UeTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBBQUA A4IBfAAUq5MJ3gXhdKDpOm0ascDE9e1iMo0RQ24ujkc9IrFXhAJNS+3eNwcJEieU2vgZTsGb zKeBZom1zVOFoh73VIRP6T08j4dDlndpDYZbxD20KzFt9zX6gV8IgR2zkkZXLQRbLyW16kw8 oFe3s//p1csCkCPAlZv1rZQYR5Psm0A1aiOiuSHhWUmgfAJxmIgfbmKtS3WpsUZVBuLQpThN rWjLRAqJKYA++++qqo3ujqAAzJLe+MHrX5dai7+n6WBfV4qo1uDArR7XbmgVpV/EdPA75XRi XEedLgbFDawJ9nAMN6WfL/NG6GZkEa7mZ7sH/gG34y21nq4w4mAAxn9wz7mDKMsEbJMZ5VlJ TOp0g6TdYqGjNoc/rQg7pqjcRChVitwd1Rl8O31+bIdNSpv4UReNMDcffRQrt+pF1FxR4q6q M9YLJU8NThx/89Mf/WF7fzrgVlsNJ78D9nJu0EhKes/9EX2qpIcHUfk/izOj8lCc1ksFgXpd UEchE0DcMIIEcjCCAt+gAwIBAgIGCq+KMoDeMA0GCSqGSIb3DQEBBQUAMFsxCzAJBgNVBAYT AkZSMRAwDgYDVQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVkZWxQS0kxIDAeBgNV BAMTF0VkZWxQS0kgRWRlbFdlYiBQZXJzR0VOMB4XDTA3MDMyNjEwMzcwM1oXDTA5MDYwMzEw MzcwM1owcDELMAkGA1UEBhMCRlIxEDAOBgNVBAoMB0VkZWxXZWIxGDAWBgNVBAsMD1NlcnZp Y2UgRWRlbFBLSTE1MDMGA1UEAwwsUGV0ZXIgU1lMVkVTVEVSIDxQZXRlci5TeWx2ZXN0ZXJA ZWRlbHdlYi5mcj4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM8HtlJ+ZixS5UhXRbaL PFvVnK+vpkkiM+KpEyzvt1sRCFDoVmGFRK4AHHFzw2Nm/I8xGjS65PSJWlEOS1vR9Y9PHeb2 pN92quFaDZwg4Eo1s1Cvw2iAMm8bUDFHHir1JcpkJWlkKge7d/PZF+OLWQvuXn3v7uoESwV3 0jK9Fp7FAgMBAAGjggEuMIIBKjBiBgNVHREEWzBZgRpQZXRlci5TeWx2ZXN0ZXJAZWRlbHdl Yi5mcqQ7MDkxCzAJBgNVBAYTAkZSMRAwDgYDVQQKDAdFZGVsV2ViMRgwFgYDVQQDDA9QZXRl ciBTWUxWRVNURVIwDgYDVR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEF BQcDAjBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vZWRlbHBraS5lZGVsd2ViLmZyL2NybC9F ZGVsUEtJLUVkZWxXZWItUGVyc0dFTi5jcmwwHQYDVR0OBBYEFJmOrzUu4mayKK7Vi397PAKJ RBJBMB8GA1UdIwQYMBaAFJ7lD8EUlUkc3VpdXpyuzQFvL5R5MAkGA1UdEwQCMAAwDQYJKoZI hvcNAQEFBQADggF8ABSrkwneBeF0oOk6bRqxwMT17WIyjRFDbi6ORz0isVeEAk1L7d43BwkS J5Ta+BlOwZvMp4FmibXNU4WiHvdUhE/pPTyPh0OWd2kNhlvEPbQrMW33NfqBXwiBHbOSRlct BFsvJbXqTDygV7ez/+nVywKQI8CVm/WtlBhHk+ybQDVqI6K5IeFZSaB8AnGYiB9uYq1Ldamx RlUG4tClOE2taMtECokpgD7776qqje6OoADMkt74wetfl1qLv6fpYF9XiqjW4MCtHtduaBWl X8R08DvldGJcR50uBsUNrAn2cAw3pZ8v80boZmQRruZnuwf+AbfjLbWerjDiYADGf3DPuYMo ywRskxnlWUlM6nSDpN1ioaM2hz+tCDumqNxEKFWK3B3VGXw7fX5sh01Km/hRF40wNx99FCu3 6kXUXFHirqoz1gslTw1OHH/z0x/9YXt/OuBWWw0nvwP2cm7QSEp6z/0RfaqkhwdR+T+LM6Py UJzWSwWBel1QRyETQNwwggWVMIIDMKADAgECAgYKwoI0lJgwDQYJKoZIhvcNAQEFBQAwUjEL MAkGA1UEBhMCRlIxEDAOBgNVBAoTB0VkZWxXZWIxGDAWBgNVBAsTD1NlcnZpY2UgRWRlbFBL STEXMBUGA1UEAxMOUmFjaW5lIEVkZWxQS0kwHhcNMDcwNjI4MTc0MDU0WhcNMTQwNTAyMTc0 MDU0WjBbMQswCQYDVQQGEwJGUjEQMA4GA1UEChMHRWRlbFdlYjEYMBYGA1UECxMPU2Vydmlj ZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVsUEtJIEVkZWxXZWIgUGVyc0dFTjCCAZwwDQYJKoZI hvcNAQEBBQADggGJADCCAYQCggF7FyeP4kRrFG9y51CeWmJIxBSMD2bcrJKIlnAPn6eH8V1M ORWTPivMNQYq32XcEi9xrxjyREvvnhABrVcW+1VLyLH8WgRY6n5A5JfuDjU6Aq0RzmjqTWDe 1+ecbgAtN8FYjVk35vdQbgfYzpGHPT0NuxiHi8NB8lNFi8rG0t2hP7WLwHLA+sIKFzA/CCRt qeGPvQkB1pRamU2IAActykfzJb6Qc50uRobWUBJtVjEBy/lgIXU0rMnQNHeCgbUvebvAT9Hd UGIPbEiX7dKHxL5/AxzHK/rA5siMzNPk8nSckDeLvpf8c/gqQRpPqufy4DazzXfZosKeJATH pyONnairmwfzMTi63PvNovrbTgzUiyH+g5zvcNoci9cke0RiLQc1pI38psgnVLtPPITgOZrS cV9zs4+sD7x7vjRco7a9H2ErfAU+8/Ui2OkR1X0z8DpyBHD/fcaDXTD+EiISL7aJHQcJRoNB CdCFgZeomsXULIYoFTa1hH//TN0z9wIDAQABo4GgMIGdMDoGA1UdHwQzMDEwL6AtoCuGKWh0 dHA6Ly9lZGVscGtpLmVkZWx3ZWIuZnIvY3JsL0VkZWxQS0kuY3JsMA8GA1UdEwQIMAYBAf8C AQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSe5Q/BFJVJHN1aXV6crs0Bby+UeTAfBgNV HSMEGDAWgBSo2SuP1LBnur1JXLwz/HdSEblnnTANBgkqhkiG9w0BAQUFAAOCAk4AUgtIR4Jh Ynyk939SM6X4YZPNYIgDio8Gp064P1MBILDgI/hzSwyxT5bb1qUQub+icXO9/5ufsDufr/ff 2gCzKMuo3hC26iey630PzHTvJgrTcEp9c92IZPt3UKeouqy+95Lz2r58dbfouKLZVwiKQ0jP 2c2U5tPWmzW4CAjFWUKRYlrhbt+tjzW8CAA0DHO1xrrzAuTyuGNKcH4LlLuVo7MbDPn/uLma 1fAVYvH2c6OTwGHJyKTQVveYw4UqgAhErJMFWJDKm+Q9h91mCzkjrA1Eu0nVDUTV1+dW6mNT DPLIq0qSdqP7iT2WcNzQVy/0PiXT2aaEH9lE2W1SSD6PnT8y+aqJTGjRMK1cl7VSJHxbq8U9 lIS+6eiV5VrogAa8X52pKF0u91i+/CBZ3e5Mi2/BwMrMN/mXA/ZwL3p+jZpnijpqnqdz8iCn qR9ExhR+BpN/b56RqEu7llLrcwOS44kjbubALjxe0+XutidWjt/6/tLYuM7rJ6Hk1EweFGVd kRejKogD3GzZ3gOAIF/D28VBJcTRcyF7OI/k/3jPD0gHUGN1uxk2Krz8SE9GEPvP/JehCBl/ FrQOCsEUmszi7Se0Vxr2k1P7icxT7L/AcWt/djIgp/vsQNurbi0+5+q7YS2b2bc1HchjsmaI cXy8ha5IGk4+F1qrHZsGqTm5M7TzZN6k0X2llMaozrtPzxNMC6uvf1uRvHYHf1x0Q0pdxTzZ PuuFw1PUlu6o5xPHbf3ZgC7ZNSDry13ZEXmlG2Re0u9WwEJJ1nYqlcDvNzGCAq4wggKqAgEB MGUwWzELMAkGA1UEBhMCRlIxEDAOBgNVBAoTB0VkZWxXZWIxGDAWBgNVBAsTD1NlcnZpY2Ug RWRlbFBLSTEgMB4GA1UEAxMXRWRlbFBLSSBFZGVsV2ViIFBlcnNHRU4CBgqvijKA3jAJBgUr DgMCGgUAoIIBnzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0w ODEyMDgxNjA4MzBaMCMGCSqGSIb3DQEJBDEWBBR6bOxxjN4GCbOddNuhFqUNH6TdCTBSBgkq hkiG9w0BCQ8xRTBDMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIB QDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDB0BgkrBgEEAYI3EAQxZzBlMFsxCzAJBgNVBAYT AkZSMRAwDgYDVQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVkZWxQS0kxIDAeBgNV BAMTF0VkZWxQS0kgRWRlbFdlYiBQZXJzR0VOAgYKr4oygN4wdgYLKoZIhvcNAQkQAgsxZ6Bl MFsxCzAJBgNVBAYTAkZSMRAwDgYDVQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVk ZWxQS0kxIDAeBgNVBAMTF0VkZWxQS0kgRWRlbFdlYiBQZXJzR0VOAgYKr4oygN4wDQYJKoZI hvcNAQEBBQAEgYDNe20aXr+QubQejA0zd/fOspReSadEEEzZsUHdDlo4FJWmVSWiPll+SFdx OCM8EfuF+48Vf1BVb5/+2TxhxyAGqV+0shzTHV5JDGhlXGYEb03XS3kWbaeW5yxhwVWdZn+7 /cCP3SkTeSDqg+2bodl1se9wib26gMCvJnu1XB828wAAAAAAAA== --------------ms070005040408020100030108--