From nobody Tue Mar 3 18:18:14 2020 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BB1D3A0BBD for ; Tue, 3 Mar 2020 18:18:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.599 X-Spam-Level: X-Spam-Status: No, score=-9.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=KhmxsR6X; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=mNtRBSn4 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ERUvT_YkQ3t for ; Tue, 3 Mar 2020 18:18:11 -0800 (PST) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B59A73A0BBA for ; Tue, 3 Mar 2020 18:18:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4253; q=dns/txt; s=iport; t=1583288291; x=1584497891; h=from:to:subject:date:message-id:mime-version; bh=iVFgQ0SzqijnuXncceFVP2wO9wpwCCCjnbW6RK1IUPE=; b=KhmxsR6XF7k5H0oISUr8EXmCxOWRxil5RnDLN9jZWGcGWRpL6Mn53J4B DiYsKlYrdurtPz5n7HIq7nn3EoM15CYECwqzA1j8EcxV9WmJg7ixXZSmN +PqF2iYcgjdT71vN7oWcDxeO487CX5ZXwG2LXpGtTxtYz0nkS9fQv7pjx k=; IronPort-PHdr: =?us-ascii?q?9a23=3AH+5K0RFCDB99Bx3y9GADj51GYnJ96bzpIg4Y7I?= =?us-ascii?q?YmgLtSc6Oluo7vJ1Hb+e4z1Q3SRYuO7fVChqKWqK3mVWEaqbe5+HEZON0pNV?= =?us-ascii?q?cejNkO2QkpAcqLE0r+efjhZiklHcJNfFRk5Hq8d0NSHZW2ag=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BMGQC+Dl9e/5pdJa1mH4NHL1AFbFg?= =?us-ascii?q?gBAsqhBSDRgOKaE6VRIRiglIDVAkBAQEMAQEjCgIEAQGEQBmBZSQ4EwIDDQE?= =?us-ascii?q?BBQEBAQIBBQRthVYBC4V8ER0BATgRAQwxDQIEMCcELgeDBAGBfU0DLgEOogU?= =?us-ascii?q?CgTmIYnWBMoJ/AQEFgUNBQIJGGIIMAwaBOIUghwUaggCBOCCCTYEpGQGBXwI?= =?us-ascii?q?DAYIOgmSCXpBmhXCZSgqCPASHTo8UHJsxRI4uiHySTwIEAgQFAg4BAQWBaSK?= =?us-ascii?q?BWHAVZQGCQVAYDY41g1uFFIVBdIEpjz8BAQ?= X-IronPort-AV: E=Sophos;i="5.70,511,1574121600"; d="scan'208,217";a="455768725" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 04 Mar 2020 02:18:10 +0000 Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by rcdn-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id 0242I2a0008130 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Wed, 4 Mar 2020 02:18:09 GMT Received: from xhs-rtp-003.cisco.com (64.101.210.230) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 3 Mar 2020 20:18:07 -0600 Received: from xhs-rcd-001.cisco.com (173.37.227.246) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 3 Mar 2020 21:18:07 -0500 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 3 Mar 2020 20:18:07 -0600 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mMOyUFZQLmCUx1GzEDHRZT4mYEXu4397Yb1BpigC1LDm/jeA7VF1OFD5nxhbHj9qjv36cFHlxWTlyYvFgstlW4jyNhMMfbTquN5T6Nv2eBg9ffU82I5oWv3sYasZMeaxUplRFOGMh63M8NBO+WlUnDIwuWr7QCUnrBl1lJnzcZq2sri2m7+ApOWMd+mL9GzEBKYtRbpr0Xcquam5uj78sycVa777ZLPRRiieYMiEUzhfT8CwyLGno2Tjg3QzOe4XT8ovAlSwaR9dREmEPjg7yFcmPqTQFYVJBEf9ESBd2iHUJYlqsBcNR+rCepN7jrL43D6IFiw3+dZHK6IXBNvOTQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iVFgQ0SzqijnuXncceFVP2wO9wpwCCCjnbW6RK1IUPE=; b=SZ2QXk8ZTlNpI3owA92wBqK/sesqXGjSV+BBQTbUovbCQYIa0I4nijLr0nY7ibS1Y3l0EieaF4/ECMsQhdOthM6xbCpRKygIYYKWkFM2HO7NW3PjoOQlLwB9wqH05zYCa2fozr8c2GIWsr7PSeyPigMByYRDuK6Un/2/Ga+/J9dkverFeQUr3CuAyYrcj2YOLiw5U/CUZGndd9PgYX0CVUqdz79ZsMQ/I5JUaoX1sAkEDQ1uEqvMOPI862JMpR+xtsuV9apA6mgrBLZ7V94rGF1CYahYzfgaSH89QyVbd8Ll+R5bBtrsyLHqRq+6oTPoBPoDh0ptAFSWN7osGKJsUw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iVFgQ0SzqijnuXncceFVP2wO9wpwCCCjnbW6RK1IUPE=; b=mNtRBSn4jv+ZfnAcL3d3NblOeddWaH2HDqO4t541wHyCFPeINKogrYVF+b9HHWwA1Dh+pWk/iCTNqBKXnHOabW5sUFzAagg6HrUL3NMfMK/lHq4CVK8Q6a4t7bIdBYU3kHzzCFf+csi9mR85Rm9Vn/1dMw53dxit8rUcHRXereM= Received: from BY5PR11MB4070.namprd11.prod.outlook.com (2603:10b6:a03:181::16) by BY5PR11MB4183.namprd11.prod.outlook.com (2603:10b6:a03:18e::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2772.14; Wed, 4 Mar 2020 02:18:06 +0000 Received: from BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::30a9:3a20:96f7:a1e7]) by BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::30a9:3a20:96f7:a1e7%7]) with mapi id 15.20.2772.019; Wed, 4 Mar 2020 02:18:06 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "opsec@ietf.org" Thread-Topic: Request comments and discussion for draft-camwinget-tls-ns-impact Thread-Index: AQHV8csjPCc2ri87eUiwsjydupKeww== Date: Wed, 4 Mar 2020 02:18:05 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.13.200210 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [2001:420:c0c8:1003::60d] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 231dff58-7d23-4833-25de-08d7bfe24670 x-ms-traffictypediagnostic: BY5PR11MB4183: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4941; x-forefront-prvs: 0332AACBC3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(396003)(366004)(39860400002)(346002)(136003)(189003)(199004)(6486002)(71200400001)(81166006)(8676002)(81156014)(6512007)(66446008)(64756008)(4744005)(86362001)(76116006)(5660300002)(66556008)(66946007)(6506007)(66476007)(966005)(8936002)(316002)(33656002)(186003)(2616005)(36756003)(6916009)(2906002)(478600001); DIR:OUT; SFP:1101; SCL:1; SRVR:BY5PR11MB4183; H:BY5PR11MB4070.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: LdUPgiajE2VRDG4Yz14mo0jLYJg25/wyN6uuO05FVw3CMB0pKtHAbEIcOELg2XFSCKYlo8ZuKV4w1U51tTTEz2AIiV8t4i61yzhrS+yUs5CrEHzxTwI34oReu78Xp0PcTg6C0ogpfQsI8FEGzGeWmpnsL0e9fQc8+V8YERjYzVmdFBYIs1/vKPca9M0BP25EaezqCIKFhyQbNHHWPHpkVtXdwX16TntFfpwgT71DPTb6rf892+ws3HH56VKNzTZhVv3hEXE9Mk0SBBCo1AR82KDrLTME2KXrupj4Tn90qSgJkhe+QsF4ZCgcAaB5DRCM2d/OHssfMVTYiNYH0VvKawzO+gF95FpQEZkBiYXPFnHJQvq1z2zJCu1ZsrMHCauU7M7xbhKf9oKN9sW/UuhmFjVQ+RWYZV9SjfoxaKknBu44OBlkQTZHZGZkaa8CsdWeQ+wA4Z81/7y7/SujwKKm4cuc6n20XCOPl3GpXvKQAQhHAGIPIgkwFftMa+zbmuZv8jHNYqYkcoJuOEGHLCwunw== x-ms-exchange-antispam-messagedata: fO30g3J5b2hPAhURubEIuqUvpUpg/s0g3J41QuOJ6I8r2U0uqPtj9PIdMjIsds4JfouBa89lOIC5Zj2ihmE1H/GZG+QNQHsm3PW0ik9gg+FtlQhq95n4EDQPfE6PsRXC/KZ+b/lZkXWkCOL1IShLnwAuMEuXIzEtN2JyczaOJBs= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DC776DEED5DC46CDBDBE114990494486ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 231dff58-7d23-4833-25de-08d7bfe24670 X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Mar 2020 02:18:05.9314 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: JbJNHsH/lAZBM/aRdPl1L3bom8vNpcoq+1ZPP4Sj99VYKBXe2aYYSARgKY0xoncy1i4c4yrUU0buMJ2s4l8oNg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4183 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com X-Outbound-Node: rcdn-core-3.cisco.com Archived-At: Subject: [OPSEC] Request comments and discussion for draft-camwinget-tls-ns-impact X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 02:18:13 -0000 --_000_DC776DEED5DC46CDBDBE114990494486ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGVsbG8gT1BTRUMgcGFydGljaXBhbnRzLA0KDQpHaXZlbiB0aGUgdHJlbmRzIHRvIGltcHJvdmUg b24gc2VjdXJpdHkgYW5kIHByaXZhY3ksIHdlIHRob3VnaHQgaXQgaW1wb3J0YW50IHRvIGFsc28N CmRvY3VtZW50IGhvdyBuZXR3b3JrIHNlY3VyaXR5IHNvbHV0aW9ucyBhcmUgdXNlZCBhbmQgaG93 IHRoZXkgaW50ZXJhY3Qgd2l0aCBUTFMuDQpXZSBoYXZlIHN1Ym1pdHRlZCBodHRwczovL2RhdGF0 cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1jYW13aW5nZXQtdGxzLW5zLWltcGFjdC8NCmFuZCBi ZWxpZXZlIGl0IGlzIGFwcHJvcHJpYXRlIHRvIGRpc2N1c3MgaW4gdGhpcyB3b3JraW5nIGdyb3Vw Lg0KDQpXYXJtIHJlZ2FyZHMsICBOYW5jeSAoYW5kIG15IGNvLWF1dGhvcnMpDQo= --_000_DC776DEED5DC46CDBDBE114990494486ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <0D6D6AFB30B2F845901FD0B7FD11FB9F@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij5IZWxsbyBPUFNFQyBwYXJ0aWNpcGFudHMsPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5HaXZlbiB0aGUgdHJlbmRzIHRvIGltcHJvdmUgb24gc2Vj dXJpdHkgYW5kIHByaXZhY3ksIHdlIHRob3VnaHQgaXQgaW1wb3J0YW50IHRvIGFsc28NCjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij5kb2N1bWVudCBob3cgbmV0d29yayBzZWN1cml0eSBzb2x1dGlvbnMgYXJl IHVzZWQgYW5kIGhvdyB0aGV5IGludGVyYWN0IHdpdGggVExTLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5X ZSBoYXZlIHN1Ym1pdHRlZCA8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvZHJhZnQtY2Ftd2luZ2V0LXRscy1ucy1pbXBhY3QvIj5odHRwczovL2RhdGF0cmFj a2VyLmlldGYub3JnL2RvYy9kcmFmdC1jYW13aW5nZXQtdGxzLW5zLWltcGFjdC88L2E+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdCI+YW5kIGJlbGlldmUgaXQgaXMgYXBwcm9wcmlhdGUgdG8gZGlzY3VzcyBpbiB0aGlzIHdv cmtpbmcgZ3JvdXAuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5X YXJtIHJlZ2FyZHMsJm5ic3A7IE5hbmN5IChhbmQgbXkgY28tYXV0aG9ycyk8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DC776DEED5DC46CDBDBE114990494486ciscocom_-- From nobody Tue Mar 3 23:42:24 2020 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1793D3A0414 for ; Tue, 3 Mar 2020 23:42:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=jacobsuniversity.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9NdCx9dkpCYX for ; Tue, 3 Mar 2020 23:42:21 -0800 (PST) Received: from EUR05-DB8-obe.outbound.protection.outlook.com (mail-db8eur05on2079.outbound.protection.outlook.com [40.107.20.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 49D943A040E for ; Tue, 3 Mar 2020 23:42:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kPOWoghXczlJCZtHto4a+xI1bBxAVzUry59yzosGgreqpOtCsmJMxoehNw/HFvXPEQLr0uyN3pjNAUWBf7pow1FtBBpf+0Hf9OBWXpAsWsx8QWJnKyQupkLsTblSpMEKDk4a7rCPWA1FVynekFD/u7tXOxQudK8WWJgQB9ae/yvDZFP1md4Nsjv9Cvnh0qYgbz7XejnkqxqWeWDMzB8xkWVwmkxy7jNSvmnI94fQqamv0bLIiy9xy1UOTdtEr3Vb97eeSJ+E1rHnS5NGRA94a9u89IXIaKPRlZ1WsCISownWVkXY7gvCsTuOhcLfhFu2VdsiosCvCyCmYFdTGqkljg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9Ug/SkIrGMsHEIWaN4WKCLfprLE10tmx6BQI5tQXBAI=; b=F/JbD4R+DPSVDEXglzAV7S3LjVdR/NcPqLhebp9yauufAe9AcOMGau+lN+Tv0wzEArd4m4k+2oscnyxh/ktM6ZYUg0owu1t3G0naFbWAeAf+O8M0IvCE53DrGpX6JFnz5pT5mlK5LmyMySHyo2Gviu1p2OHlmxUC5vMWx20E1L+YV2JSBSqcr8GJ1BaGaZ5WptVnmPkhtIaIIaBHcp2XsoNPzasd0HVv5fF1Ysv18p6i2MG9cEcYxRvTp7hqqPnoHq5drEHhvsumtbp+J2BmMBRN5g5OFL6353SquwAf+D5XDTSMLywBSwGN0Msh+6W77jF0IQ412dwXeqdlqY4gAA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=jacobs-university.de; dmarc=pass action=none header.from=jacobs-university.de; dkim=pass header.d=jacobs-university.de; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jacobsuniversity.onmicrosoft.com; s=selector2-jacobsuniversity-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9Ug/SkIrGMsHEIWaN4WKCLfprLE10tmx6BQI5tQXBAI=; b=TP7AS0OJ1ZGUIDAFe53FeHDo497OsWo6aev1Wv8kfiA2cAH6x5OzECoGhSiLz6R5j1aBhtJepNcazzJosud3J+dri6vaEdUFSLmTgbtj4ae8ILPZA3KBUuqaYkb9wy4Q+aVTrKMD7CtCBz2YMT+O3PHCsVe2nZYh3F2ds94n+ME= Received: from AM4P190MB0004.EURP190.PROD.OUTLOOK.COM (10.172.221.19) by AM4P190MB0148.EURP190.PROD.OUTLOOK.COM (10.172.220.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2772.18; Wed, 4 Mar 2020 07:42:18 +0000 Received: from AM4P190MB0004.EURP190.PROD.OUTLOOK.COM ([fe80::b931:fce:e8b5:ec62]) by AM4P190MB0004.EURP190.PROD.OUTLOOK.COM ([fe80::b931:fce:e8b5:ec62%10]) with mapi id 15.20.2772.019; Wed, 4 Mar 2020 07:42:18 +0000 Received: from localhost (212.201.44.247) by AM3PR05CA0088.eurprd05.prod.outlook.com (2603:10a6:207:1::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2772.15 via Frontend Transport; Wed, 4 Mar 2020 07:42:17 +0000 From: =?iso-8859-1?Q?Sch=F6nw=E4lder=2C_J=FCrgen?= To: "Nancy Cam-Winget (ncamwing)" CC: "opsec@ietf.org" Thread-Topic: [OPSEC] Request comments and discussion for draft-camwinget-tls-ns-impact Thread-Index: AQHV8csjPCc2ri87eUiwsjydupKew6g4DUSA Date: Wed, 4 Mar 2020 07:42:18 +0000 Message-ID: <20200304074217.mn7mboum3e7ynj5l@anna.jacobs.jacobs-university.de> References: In-Reply-To: Reply-To: =?iso-8859-1?Q?Sch=F6nw=E4lder=2C_J=FCrgen?= Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: AM3PR05CA0088.eurprd05.prod.outlook.com (2603:10a6:207:1::14) To AM4P190MB0004.EURP190.PROD.OUTLOOK.COM (2603:10a6:200:65::19) x-originating-ip: [212.201.44.247] authentication-results: spf=none (sender IP is ) smtp.mailfrom=J.Schoenwaelder@jacobs-university.de; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f07e9b2b-34e4-4b3a-cd8a-08d7c00f90a7 x-ms-traffictypediagnostic: AM4P190MB0148: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6430; x-forefront-prvs: 0332AACBC3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(136003)(366004)(346002)(39850400004)(396003)(199004)(189003)(3450700001)(1076003)(2906002)(26005)(66556008)(966005)(64756008)(66946007)(66446008)(66476007)(6916009)(86362001)(186003)(81156014)(52116002)(786003)(6496006)(71200400001)(8936002)(81166006)(8676002)(6486002)(478600001)(16526019)(956004)(4744005)(4326008)(316002)(5660300002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4P190MB0148; H:AM4P190MB0004.EURP190.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: jacobs-university.de does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 4wo++5lOjU7U2xTxnA62WTpD1liYbXsZKWBMYc9HtwrCyMkBQwnnT34QHZNlSMCv4FbtUUKGzFkAzL70vq9lpNUWCIiwTgJZS4YzuqMkUeP5KHdhCZidzttnE+tIoQ92IwAgPg9llhaV8SCKzjBxCTm55g8iRsUijXT35W68NhBBC4ZZ3Ibo5/K+iR9zldSZXv0u+LZ730CaKJ+kwFYakArZBzmX7x0QgyEtYpkjfv5lRLoB+6wmFALzcenmv56bzcs2yPzePXWfLNl1h2wDH5qxsMXtU/6oseyQC45GVFiREwDyaimGGTLDyYc1JUaVvWWx5hP37etXvBNR+GwWW+7AgbPKlc0StiCVMQI3FKcC4dHKTRypeDY+ZtG2X494AqqjgujiOFfXTWIu83rAe4edlzZnwCmlaP7tYo54GvAUDpKyLAcXaLgrqCPsgo9+7I044behgV9Ch6inw8zbfoMfd+F+Cdz4gPAbMreo9v/f0auaL6WqDyEAoLxfHVOEjjEUvrKp5gLo2WNpRbMyJw== x-ms-exchange-antispam-messagedata: HDdKi4N7/pJuCWmBNAQs4S6KL1ZZizM0wyzPONZevCsj0dx24XvliF5SRd1YqznYm0Wfsnu4KQpOFGhPxDILUs17QMNiRk5HUyi7P11BKPKLxbPG5pllUAR19IYKeANhCwA37oo5V/iq6qyJMsux8Q== Content-Type: text/plain; charset="iso-8859-1" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: jacobs-university.de X-MS-Exchange-CrossTenant-Network-Message-Id: f07e9b2b-34e4-4b3a-cd8a-08d7c00f90a7 X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Mar 2020 07:42:18.2372 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f78e973e-5c0b-4ab8-bbd7-9887c95a8ebd X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 2ezz1clJVhS7TLZxgpGrEhzuh01iXZe18AT2ID3OuxHNyqoE0MPfanDz+89P33J3xJ3fSHc6dsVBwUOM8KqHvaKnwEjLqNKs8bgi5mjNL4I= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4P190MB0148 Archived-At: Subject: Re: [OPSEC] Request comments and discussion for draft-camwinget-tls-ns-impact X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 07:42:23 -0000 Dear Nancy, I have read the document and I like it, a very well written and useful catalog of TLS-specific security functions and how they are affected by TLS 1.3. Thanks for putting this together. /js On Wed, Mar 04, 2020 at 02:18:05AM +0000, Nancy Cam-Winget (ncamwing) wrote= : > Hello OPSEC participants, >=20 > Given the trends to improve on security and privacy, we thought it import= ant to also > document how network security solutions are used and how they interact wi= th TLS. > We have submitted https://datatracker.ietf.org/doc/draft-camwinget-tls-ns= -impact/ > and believe it is appropriate to discuss in this working group. >=20 > Warm regards, Nancy (and my co-authors) > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec --=20 Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1 | 28759 Bremen | Germany Fax: +49 421 200 3103 From nobody Wed Mar 4 07:35:34 2020 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B1523A1184 for ; Wed, 4 Mar 2020 07:35:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zamJsNf7P85q for ; Wed, 4 Mar 2020 07:35:28 -0800 (PST) Received: from mail-qv1-xf31.google.com (mail-qv1-xf31.google.com [IPv6:2607:f8b0:4864:20::f31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB1573A1189 for ; Wed, 4 Mar 2020 07:35:26 -0800 (PST) Received: by mail-qv1-xf31.google.com with SMTP id o18so965871qvf.1 for ; Wed, 04 Mar 2020 07:35:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=KEWGZPTylDX71qnC+g1QMNPfv+Jn18LrBb7cCKwakS4=; b=UKLheEMESNlqsBpwlyv7gDm5g7k47FRybjTxPnnXwU+saVQD0TJy+FoT9cEldZhnQa bL+zR7/FVYeeqWUFJUv1jgoNvIBRteYITTEC9SRfBTH2ZVuiCpTBIjomsJIli/N8HfVX 5p+/rgQ/6G/pc4qisGhe9/gV3NccgvHOEOVzrrmq+zxSdZ6q/UGqAWC48OpXBYtaa2tW 1fDetKRdvzL3qRGUyGdLOPSxjWv/tUd1FT+o012yDVLIO+3N3BuFp6zKpuuFltaKpalO N5XMlttmpJt7EUqywX7yG/xtMAnWckmtWuohAVSJi08nesuHfuYiaoe8dNe9gUhxSgX/ ELsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=KEWGZPTylDX71qnC+g1QMNPfv+Jn18LrBb7cCKwakS4=; b=qL4eNwKhVyNePmKtZpe+jtxHAM96bLHjJFErRuPL1oPJeJjkDElLI+i7bTxHI4rWMU 1GcQ2T9peUhpTOpbuf0nOD2RE90siF6Hhvi4x7aLIwVtjS/5JCgTCi+Q0mDdV5wHXCkH QAbEthvvG6wOEJPsOEw2977R5iXndotxtkxO7BFjg5BJUmx1D0En1MxizmbqYY853sbl kC+y8II/4XWYuqwuWz1mHEYNC03PvxziAv1mUYNxMIZ8LtP0z28XBlxXuxyGCE6DhzI5 v7pU9vpIQ3LKvZbgOYvx0RHpXAd1y62yKum8aZ1jkGsjN8/CBnZxKZnQHLPIt6SKYk5R fKqg== X-Gm-Message-State: ANhLgQ0GQV0vcQ+p5XFZJEWAHBz65BoCTHBfpdWp/ICREypJgfrRfRjq o7X8dLO7r6o8qRy/0XIoq43w3RCpYMzhkxkDl5Z6gw== X-Google-Smtp-Source: ADFU+vuLogtZanp06PYGFtVzUYIETXTIwdulZxKxNHaB7Ck86RQHIyohUyqIPAdacc43JfoL71RIKq9NA72AS9pXGY0= X-Received: by 2002:ad4:59d1:: with SMTP id el17mr2564047qvb.29.1583336120265; Wed, 04 Mar 2020 07:35:20 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Warren Kumari Date: Wed, 4 Mar 2020 10:34:43 -0500 Message-ID: To: "Nancy Cam-Winget (ncamwing)" Cc: "opsec@ietf.org" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [OPSEC] Request comments and discussion for draft-camwinget-tls-ns-impact X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 15:35:32 -0000 On Tue, Mar 3, 2020 at 9:18 PM Nancy Cam-Winget (ncamwing) wrote: > > Hello OPSEC participants, > > > > Given the trends to improve on security and privacy, we thought it important to also > document how network security solutions are used and how they interact with TLS. > > We have submitted https://datatracker.ietf.org/doc/draft-camwinget-tls-ns-impact/ > and believe it is appropriate to discuss in this working group. Thank you for this document -- I found it to be nicely readable and understandable -- other than one major questions / point. I'm sure I'm going to mess up the terminology horribly here - apologies in advance... Section 3: " To achieve this, a TLS Proxy must be able to present a valid X.509 certificate to the TLS client to appear as a valid TLS Server; similarly, the client must be able to validate the X.509 certificate using the appropriate trust anchor for that TLS connection." I'm seen at least 2 deployment types for this sort of inspection - the first is where a client is informed that there is a proxy server that they need to send their traffic through -- i.e the system or browser is configured with a proxy server (OS X called this "Secure Web Proxy"), and is configured with something like https://proxy.example.com:8080. The second is a security appliance which does MiTM type stuff, and the client installs a corporate CA certificate. These are two very very different deployment scenarios, and the "valid" part in "valid X.509 certificate" have very different meanings[0]. I think that it would be useful to clearly outline these two methods of watching "encrypted" user traffic, and clarify which one(s) you are talking about. The sentence: "This TLS Proxy is a transparent hop on the packet path; and where necessary, preserves the client's and server's original IP address and the intended source and destination TCP ports." implies only the second, but I think it would be useful to be much clearer in the introduction... W [0]: Yup, technically they are both valid, but (at least in my opinion) the second is much less so :-P > > > > Warm regards, Nancy (and my co-authors) > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec -- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf From nobody Wed Mar 4 15:33:22 2020 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F3D63A0C44 for ; Wed, 4 Mar 2020 15:33:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.598 X-Spam-Level: X-Spam-Status: No, score=-9.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=SVzpA4bA; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=QcUYvsTS Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yEbu5jxNUnwF for ; Wed, 4 Mar 2020 15:33:10 -0800 (PST) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FC0A3A0C37 for ; Wed, 4 Mar 2020 15:33:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2038; q=dns/txt; s=iport; t=1583364790; x=1584574390; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=I65uVipHkxjCi8W403wYyyG/MA72Gnnoo+OIcd1z1I0=; b=SVzpA4bAaQJQ74fl4ASYGM5hsbdRkiZ1PKglZLlV//iIWqUAVfAqWae9 CXisDTQom4a+cqKoGJGO+LylQKSr38nO4WKvDMq13qt9muofowntDEyeE 63wOVUKoxlA7avH6RRulgeC1l0WakoKYzvIu1A8dvlteffm06jJIJmDrA A=; IronPort-PHdr: =?us-ascii?q?9a23=3AuEpjVBUoQ4RWskuNnzr5isM7JwnV8LGuZFwc94?= =?us-ascii?q?YnhrRSc6+q45XlOgnF6O5wiEPSA9yJ8OpK3uzRta2oGXcN55qMqjgjSNRNTF?= =?us-ascii?q?dE7KdehAk8GIiAAEz/IuTtank8F81HS15j8FmwMFNeH4D1YFiB6nA=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DgAQBhOWBe/4gNJK1jAxsBAQEBAQE?= =?us-ascii?q?BBQEBAREBAQMDAQEBgXuBVCknBWxYIAQLKoQVg0YDimqCX5gVgUKBEANUCQE?= =?us-ascii?q?BAQwBARgLCgIEAQGEQwIXgWokOBMCAwEBCwEBBQEBAQIBBQRthVYMhWQBAQE?= =?us-ascii?q?DAQEQEREMAQEsCwENAgIBCBAIAgImAgICGQwLFRACBA4FGweDBAGCSgMuAQ6?= =?us-ascii?q?iYwKBOYhidYEygn8BAQWBQ0FAglUYggwDBgWBCSqFIYcGGoIAgTgggk0+axk?= =?us-ascii?q?BgV8BAQMBgSc6FwoZDYJKMoIskCZAnzoKgjyHUo8UHIJJjGyLfESXKpJPAgQ?= =?us-ascii?q?CBAUCDgEBBYFpIoFYcBU7KgGCQVAYDY4dGIEPAQiCQzOEYYVBdIEpjR8BAQ?= X-IronPort-AV: E=Sophos;i="5.70,515,1574121600"; d="scan'208";a="739132225" Received: from alln-core-3.cisco.com ([173.36.13.136]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 04 Mar 2020 23:33:07 +0000 Received: from XCH-ALN-002.cisco.com (xch-aln-002.cisco.com [173.36.7.12]) by alln-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id 024NX7NG017462 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 4 Mar 2020 23:33:07 GMT Received: from xhs-rtp-002.cisco.com (64.101.210.229) by XCH-ALN-002.cisco.com (173.36.7.12) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 4 Mar 2020 17:33:07 -0600 Received: from xhs-rtp-003.cisco.com (64.101.210.230) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 4 Mar 2020 18:33:06 -0500 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 4 Mar 2020 18:33:06 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DT1hSt0oRyWbydRSudXdUQJPyT3MDpJnIM+G6mf0q5LMbsgFmsDVsOVAjCWa9IWvt/z6iMbFjH7ucZrIF1MvwTTJfwMMsmrvJaXYaX/TJEAMkErrQm8D8jfoEmd0Zw2njkKJpOc7OjPhbbJQr3XvriTfcgrK9sMMt0jexHp8pbmrWyrN8jb0Vxh9x8+2q7DLDlzn1nQ0nyWPxB3NXNPGJH+oS8nRDqInmka+2gUDGBV5982XoQnvWvoluEQrG4+bBvpwVQr60pxwMFq1KbhywrX0KMGWedldQTERJtVADJbEcbCPvNREhgwVREkQv8iv/CspFzEih7MteCijlft/cg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=I65uVipHkxjCi8W403wYyyG/MA72Gnnoo+OIcd1z1I0=; b=HLvtIrv7u7JoMaVB0fZ5vdB0FUvwxUrBoHJBl+LLRcOuWHOOvgtlj3hLY50sOXZnl4q9MsA88qnmYk7bMzw2Pl4FYapzWkgtRknWRQJmaBCw7ylz976AGrNAJp0PitiMBUw2sy1CQbIsjtmTq+7X+s7yS7gTlWAP7Zy8XOPVQ7G0sEuhE5ZS9TXiEXT4u/X/xouyM7CfdO/GONgUlXj04gNLbPHkMRNE1ji2FbgC5npBFpDgsX8fluZf/7YFq4vYHGA8TxniEFmHOBCVzj9Hc1QjFcyeNwEqtvvvrH9XjPAOuVMDk7gd4IUiJTsvkaFePMOEnEI8whwgJZ+2dV7uvA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=I65uVipHkxjCi8W403wYyyG/MA72Gnnoo+OIcd1z1I0=; b=QcUYvsTSZeIQdZafEmlIOnA518cGoBkQ4r428zx88YezEXA9E5YvGZWFpEBW+amSTkRn/aNuB2MiHYPNdgsvTjGO4oXoGktfel1CRuaz3NoSa/BmXrUrBc2Z5QB/2uhBAbXkXDH623bQ7tur2HmRO4W1Y13rQE6pi4Kv47yCFds= Received: from BY5PR11MB4070.namprd11.prod.outlook.com (2603:10b6:a03:181::16) by BY5PR11MB4449.namprd11.prod.outlook.com (2603:10b6:a03:1cc::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2772.16; Wed, 4 Mar 2020 23:33:04 +0000 Received: from BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::852d:fab4:18c1:72d2]) by BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::852d:fab4:18c1:72d2%7]) with mapi id 15.20.2793.013; Wed, 4 Mar 2020 23:33:04 +0000 From: "Nancy Cam-Winget (ncamwing)" To: =?utf-8?B?U2Now7Zud8OkbGRlciwgSsO8cmdlbg==?= CC: "opsec@ietf.org" Thread-Topic: [OPSEC] Request comments and discussion for draft-camwinget-tls-ns-impact Thread-Index: AQHV8csjPCc2ri87eUiwsjydupKew6g4DUSAgACDiIA= Date: Wed, 4 Mar 2020 23:33:04 +0000 Message-ID: <9F8D0BFA-A66F-4DDD-94AA-66136F0C72C7@cisco.com> References: <20200304074217.mn7mboum3e7ynj5l@anna.jacobs.jacobs-university.de> In-Reply-To: <20200304074217.mn7mboum3e7ynj5l@anna.jacobs.jacobs-university.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.13.200210 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [2001:420:283:1005:183:ec60:cf8a:19] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f2fef074-4c1f-40e6-9db9-08d7c09462cd x-ms-traffictypediagnostic: BY5PR11MB4449: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0332AACBC3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(346002)(376002)(136003)(396003)(39860400002)(189003)(199004)(6506007)(33656002)(478600001)(66446008)(966005)(64756008)(6486002)(66476007)(66946007)(66556008)(36756003)(316002)(66574012)(2906002)(2616005)(8676002)(71200400001)(6512007)(76116006)(81166006)(186003)(6916009)(8936002)(4326008)(5660300002)(81156014)(86362001); DIR:OUT; SFP:1101; SCL:1; SRVR:BY5PR11MB4449; H:BY5PR11MB4070.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: se0gEU3jRNgU7Vn7Y7LloVeQwUQIYONNym9ANaTfYpOgCtWiNNuMN2jrshG+lBxQIxuNMij9DiU2F7tQ0utLhhTQx0JvIikchFFmiT/iK10ypt/0S/w7Ts1Cc7Q5Xj9TTq/ocYL86Abf2qZPQS6VOoiCUbDukVwxQnWlSlixNejN2vCly22qeTQlbjyF4GC/CxoAzrRwOeofQoA1DiRkYDwULvgVGL9ab2HPaPe46hOmRQWJsx0zVTxeCIT53Ta82OdySY0swrlWEiA6nC4YnNE+33vvUTfvJjSkc6i35E552iYC7ULuv99r1QNfaezfyf3J2L27GpsiRtqFisV+k6wsasZ+Lcr+VmR/md17B1aTaLdSjFDY6jwfn5ZMm9PSAJVX2Lbc9Be/tiR8YZFEAj+stBxkoOeIz3shXd2F2v180y4HoV0mfssuFLpSlLMHDg32/xHYPCXQDy7/+q62y7pgDb5zfxoSDdxsGarPKiOUdvnKQmCvvFVMjS1/XYSkcScBOnVGhtLlbnkLkodh7Q== x-ms-exchange-antispam-messagedata: nFVsbTGQ0V0IEz9Z7JivIPHqRqsG/R+hdxviU5DVyRcB49HDd5RH83jlNqtAGWKhSaag6Siuk24DTkA/oJk1ENcXEqR5PGIyQjT2clHAZ1t4A0R1fwooAujyNV7QNKIPnX8PdaQF319PpLuK9/qI0KK8jikNvH1s4mgE4KPp8BGu8bPuu6a1xeH38+bH2w/VGK3cmsVIiFfTdLIHclOXiw== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: f2fef074-4c1f-40e6-9db9-08d7c09462cd X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Mar 2020 23:33:04.0660 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: LEvZDpTgYS3KtWdOiw9JvnOTM8Hh2uDLspiVo6S8kJeMJVF4pNAySuiC6pShFDu7vDebW5PsBEZkAILL5hBAcg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4449 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.12, xch-aln-002.cisco.com X-Outbound-Node: alln-core-3.cisco.com Archived-At: Subject: Re: [OPSEC] Request comments and discussion for draft-camwinget-tls-ns-impact X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 23:33:20 -0000 TWFueSB0aGFua3MgZm9yIHRoZSBxdWljayByZXNwb25zZSBKw7xyZ2VuISAgQW5kIG9mIGNvdXJz ZSwgYXMgYXV0aG9ycywgd2Ugd291bGQgbGlrZSB0byBzZWUNCklmIHRoZXJlIGlzIGludGVyZXN0 IGluIHRoZSBXRyB0byBhZG9wdCB0aGUgZG9jdW1lbnQ7IGJhcnJpbmcgd2UgcmVhc29uYWJseSBh ZGRyZXNzIGFsbCBmZWVkYmFjay4NCg0KV2FybSByZWdhcmRzLCBOYW5jeQ0KDQrvu79PbiAzLzMv MjAsIDExOjQyIFBNLCAiU2Now7Zud8OkbGRlciwgSsO8cmdlbiIgPEouU2Nob2Vud2FlbGRlckBq YWNvYnMtdW5pdmVyc2l0eS5kZT4gd3JvdGU6DQoNCiAgICBEZWFyIE5hbmN5LA0KICAgIA0KICAg IEkgaGF2ZSByZWFkIHRoZSBkb2N1bWVudCBhbmQgSSBsaWtlIGl0LCBhIHZlcnkgd2VsbCB3cml0 dGVuIGFuZCB1c2VmdWwNCiAgICBjYXRhbG9nIG9mIFRMUy1zcGVjaWZpYyBzZWN1cml0eSBmdW5j dGlvbnMgYW5kIGhvdyB0aGV5IGFyZSBhZmZlY3RlZA0KICAgIGJ5IFRMUyAxLjMuIFRoYW5rcyBm b3IgcHV0dGluZyB0aGlzIHRvZ2V0aGVyLg0KICAgIA0KICAgIC9qcw0KICAgIA0KICAgIE9uIFdl ZCwgTWFyIDA0LCAyMDIwIGF0IDAyOjE4OjA1QU0gKzAwMDAsIE5hbmN5IENhbS1XaW5nZXQgKG5j YW13aW5nKSB3cm90ZToNCiAgICA+IEhlbGxvIE9QU0VDIHBhcnRpY2lwYW50cywNCiAgICA+IA0K ICAgID4gR2l2ZW4gdGhlIHRyZW5kcyB0byBpbXByb3ZlIG9uIHNlY3VyaXR5IGFuZCBwcml2YWN5 LCB3ZSB0aG91Z2h0IGl0IGltcG9ydGFudCB0byBhbHNvDQogICAgPiBkb2N1bWVudCBob3cgbmV0 d29yayBzZWN1cml0eSBzb2x1dGlvbnMgYXJlIHVzZWQgYW5kIGhvdyB0aGV5IGludGVyYWN0IHdp dGggVExTLg0KICAgID4gV2UgaGF2ZSBzdWJtaXR0ZWQgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvZHJhZnQtY2Ftd2luZ2V0LXRscy1ucy1pbXBhY3QvDQogICAgPiBhbmQgYmVsaWV2 ZSBpdCBpcyBhcHByb3ByaWF0ZSB0byBkaXNjdXNzIGluIHRoaXMgd29ya2luZyBncm91cC4NCiAg ICA+IA0KICAgID4gV2FybSByZWdhcmRzLCAgTmFuY3kgKGFuZCBteSBjby1hdXRob3JzKQ0KICAg IA0KICAgID4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18N CiAgICA+IE9QU0VDIG1haWxpbmcgbGlzdA0KICAgID4gT1BTRUNAaWV0Zi5vcmcNCiAgICA+IGh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vb3BzZWMNCiAgICANCiAgICANCiAg ICAtLSANCiAgICBKdWVyZ2VuIFNjaG9lbndhZWxkZXIgICAgICAgICAgIEphY29icyBVbml2ZXJz aXR5IEJyZW1lbiBnR21iSA0KICAgIFBob25lOiArNDkgNDIxIDIwMCAzNTg3ICAgICAgICAgQ2Ft cHVzIFJpbmcgMSB8IDI4NzU5IEJyZW1lbiB8IEdlcm1hbnkNCiAgICBGYXg6ICAgKzQ5IDQyMSAy MDAgMzEwMyAgICAgICAgIDxodHRwczovL3d3dy5qYWNvYnMtdW5pdmVyc2l0eS5kZS8+DQogICAg DQoNCg== From nobody Wed Mar 4 17:07:26 2020 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81A7F3A0524 for ; Wed, 4 Mar 2020 17:07:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.589 X-Spam-Level: X-Spam-Status: No, score=-9.589 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=W1p91Lm1; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=uT1zfJrQ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6xuNvH2U9Dwu for ; Wed, 4 Mar 2020 17:07:22 -0800 (PST) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EC263A048D for ; Wed, 4 Mar 2020 17:07:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=19847; q=dns/txt; s=iport; t=1583370442; x=1584580042; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=ThYIajbPQ/Q5fOOmLR9RzjuxHymqMA9+dfjlmyb29bw=; b=W1p91Lm1VOes22yNG36CnPAdlqlyFiruyQMGNR+jmauApSpomHhkhr7I lHzRMvlHgyxBF4uRlbjBRRolIoopfeNgCldSDWZibtLieQPV2XKpDEZjs PXZ4nA7pBf6BiK3iFHem6HucZp8kOuMzuPwp9rIdZXm2F9AAt5vetnqPL c=; IronPort-PHdr: =?us-ascii?q?9a23=3AKduS0R1j2XwGfE4usmDT+zVfbzU7u7jyIg8e44?= =?us-ascii?q?YmjLQLaKm44pD+JxGOt+51ggrPWoPWo7JfhuzavrqoeFRI4I3J8RVgOIdJSw?= =?us-ascii?q?dDjMwXmwI6B8vQBE/kJfjlRyc7B89FElRi+iLzPA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BAAACVUGBe/4gNJK1mGgEBAQEBAQE?= =?us-ascii?q?BAQMBAQEBEQEBAQICAQEBAYFqAgEBAQELAYEkLyknBWxYIAQLKgqEC4NGA4p?= =?us-ascii?q?pgl+TM4RiglIDVAkBAQEMAQEYAQwIAgQBAYNvVAIXgWokNwYOAgMBAQsBAQU?= =?us-ascii?q?BAQECAQUEbYVWDIVkAQEBAwEBEBEdAQEsCwEPAgEIGCcDAgICJQsUEQIEDgU?= =?us-ascii?q?bB4MEAYF9TQMuAQ6iVQKBOYhidYEygn8BAQWBLwETQUCCRBiCDAMGgTgBhSC?= =?us-ascii?q?GaR0aggCBOCCCTT5rGQGBXwEBAgEBgUkXLoJkMoIskGaFcJlKCoI8h1KPFBy?= =?us-ascii?q?CSYgfgzqND0SOKokAjx2DMgIEAgQFAg4BAQWBaCOBWHAVOyoBgg0BATI+Ehg?= =?us-ascii?q?Njh0YgQ8BCIJDhRSFQXQCgSeKXi2BBAGBDwEB?= X-IronPort-AV: E=Sophos;i="5.70,516,1574121600"; d="scan'208,217";a="734803618" Received: from alln-core-3.cisco.com ([173.36.13.136]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 05 Mar 2020 01:07:21 +0000 Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by alln-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id 02517K7E005570 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 5 Mar 2020 01:07:21 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 4 Mar 2020 19:07:20 -0600 Received: from xhs-aln-002.cisco.com (173.37.135.119) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 4 Mar 2020 19:07:19 -0600 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 4 Mar 2020 19:07:19 -0600 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dzJTeoejL+5ZGsep39HlrCOFzbHZJNi241o69jIryTp75jT6H6PA7mh2lleKM46PBCYXe+YYOOJLghKwq+BRs5ybDUuCfxc1eQeEnvWR9oz28PuJCbDjTbxZnZxjcQ6rzYRmftWixd1pOybx1zBiJTgjHpTCvXH2zlO8bwt/mWwa0AbT99ktPfbhpK2Fjent5lnhnIbFN0ZGx7mOPlNHOFev0Pb8nvSHwmndc5W6HHWpkPXe1O7Hevd1I/4T0pNr6ikvTgz+HNScZAPBUwTtFZpzBsEk6CSJsjs/iyKx05wp2oR+nB2oS9Iy9GloAr/RqCnpRD/WKTWFuN32TJHslg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ThYIajbPQ/Q5fOOmLR9RzjuxHymqMA9+dfjlmyb29bw=; b=lcbsgQexZLSo8XSZvoZFgSEOt1wTdQSdHa3nkPEtJRo3rOpgd9+UiRqhMSST1pV2nmkXlVjwuAGpVPeXMgP9dp6dCqkGRctKdoh3W7Zu8d5wNRF+nCrPEBV9XtDbpwSd9CcA/BuEEhkuBRuuuLudYGT+txKDd1LVQVUItwP9uQEL48DaI+gerSCzCrxpFyL69+TrtGzd3K/46UwxMiByq2K2p1KJ0MI1qxTSUFZRO7wv2Svp606tXYkanUanaWTCgAFbHgrSbsLPH/ZcD3hpCHnBRITMbh2o2iiEZJGjcCPBAc+k5N5CpvIMJp+E6voqMg3GIAaO9aFT8KUB/SHemA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ThYIajbPQ/Q5fOOmLR9RzjuxHymqMA9+dfjlmyb29bw=; b=uT1zfJrQk08LQm310JBb+NMRRPFK5oI08sriurZ+r7Di2TlhX5wfM8Dtt+g6hAqtbKBzzAve72RsqPTMHAVIlTxE6fw0FB2I9eG4Rjw7HOVUWVt24LgYTUlg7wCUDpC+n1z/kt7dDRy57sFxcEKqeWTjcfrWPcPgFOsBsuYSL/g= Received: from BYAPR11MB2789.namprd11.prod.outlook.com (2603:10b6:a02:cc::11) by BYAPR11MB2661.namprd11.prod.outlook.com (2603:10b6:a02:c5::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2772.18; Thu, 5 Mar 2020 01:07:18 +0000 Received: from BYAPR11MB2789.namprd11.prod.outlook.com ([fe80::c1a4:a744:c5af:ea5b]) by BYAPR11MB2789.namprd11.prod.outlook.com ([fe80::c1a4:a744:c5af:ea5b%5]) with mapi id 15.20.2772.019; Thu, 5 Mar 2020 01:07:18 +0000 From: "Eric Wang (ejwang)" To: Warren Kumari CC: "Nancy Cam-Winget (ncamwing)" , "opsec@ietf.org" Thread-Topic: [OPSEC] Request comments and discussion for draft-camwinget-tls-ns-impact Thread-Index: AQHV8nwcYsKhHxIehEywrwBbi+N8c6g5L9uA Date: Thu, 5 Mar 2020 01:07:18 +0000 Message-ID: References: <748DB099-D180-4B5D-9346-A745D226A091@cisco.com> In-Reply-To: <748DB099-D180-4B5D-9346-A745D226A091@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3445.104.11) authentication-results: spf=none (sender IP is ) smtp.mailfrom=ejwang@cisco.com; x-originating-ip: [50.196.137.195] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0ff4e40a-afe5-4d18-fbfc-08d7c0a18d0a x-ms-traffictypediagnostic: BYAPR11MB2661: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 03333C607F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(376002)(396003)(346002)(136003)(366004)(189003)(199004)(81166006)(81156014)(8676002)(186003)(76116006)(316002)(5660300002)(26005)(4326008)(6486002)(86362001)(66574012)(36756003)(6506007)(66476007)(54906003)(478600001)(66446008)(33656002)(64756008)(966005)(2906002)(66556008)(53546011)(6916009)(71200400001)(66946007)(6512007)(2616005)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR11MB2661; H:BYAPR11MB2789.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: V4EalWKkKqfv0GT2dUyjo/i6371EjDf0QvnwT1QaPms9JcLForv3/y9m5DOvD9t0TzHtx1URFlc5gkOXR89tNLh0Z5VAF80xlBKJbYiEjamRujqYV/KsKOvdDqnD7JjQWleIJohrEn0XB/K7lw/0D18iIHFT45u6MQx/9/VHWAkhMdFILxn1Lw7alE2pVy19CRIyPPGBT+xzocQ311rVKtdnYRtmj8Eol/Bmew4RZmy6uFNv7H6KyH6x+RlHsTdwHK0rKT6yp+DqW9UWAvofpcHjfQQJKo2hLgBjlXVCynPnJPqUp0YhKlNCxbQbRpJ/3UNZzNJJvOEOjxUi/40SBsEVAF0KzXa5ZEQpEiMlyf0drLVeshFULO4jxYY+ljuH8DXJFg2Cd87amlVI6GPKayN/gRplqaGhiF153Q0lUnjiOQ0UHcltgT9FOwn3rMVVVt1w+fJ8oLYhnnpfFsfDn2lJBT20VSOAa19luZ2eARjPGYLR31p2VcuxO8lRQ57B6CMbrjDEri0M3kT0nkrwvg== x-ms-exchange-antispam-messagedata: anHigsVbAjXfYTmkbPheV3HoAebOd2Vgur6Be9FAXBvqxEZGd09YIIpHJCSyCfCXbngBbjI4iB55xJHjXnFM0weWZ+jyvlUSpLY3TQs1PO/+UgIBkS2xjkyCT6jRXa0Gm2Je2vSSgNZV8q8z59W28A== Content-Type: multipart/alternative; boundary="_000_C31C56BAEF7F4CA8A8D03851A8565EEBciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 0ff4e40a-afe5-4d18-fbfc-08d7c0a18d0a X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Mar 2020 01:07:18.3070 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 9H2IHPcIVDLp2Tkt4heyD2vzLnb7zWkNDcQWKzp1xCtPdCXOMc2L8A2qwpp9CKh1JIoJDaOD8+E7JuWHgU5j7Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR11MB2661 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com X-Outbound-Node: alln-core-3.cisco.com Archived-At: Subject: Re: [OPSEC] Request comments and discussion for draft-camwinget-tls-ns-impact X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Mar 2020 01:07:25 -0000 --_000_C31C56BAEF7F4CA8A8D03851A8565EEBciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgV2FycmVuLA0KDQpUaGFua3MgYSBsb3QgZm9yIHlvdXIgcXVpY2sgcmV2aWV3IGFuZCBjb21t ZW50cy4NCg0KWW91IGFyZSByaWdodCwgZm9yIHRoZSBmaXJzdCB3ZWIgcHJveHkgc2NlbmFyaW8s IHRoZSBwcm94eSBjb3VsZCBiZSB0ZXJtaW5hdGluZyB0aGUgdHJhbnNwb3J0IGxheWVyIHNvIHRo ZSBjbGllbnQgYW5kIHNlcnZlcuKAmXMgSVAgYWRkcmVzc2VzIG1heSBub3QgYmUgcHJlc2VydmVk Lg0KDQpIb3dldmVyLCB0aGUgVExTIGxheWVyIHJlbWFpbnMgdGhlIHNhbWUgYmVjYXVzZSB0aGUg Y2xpZW50IGFsd2F5cyBhdHRlbXB0cyB0byBlc3RhYmxpc2ggYW4gZW5kLXRvLWVuZCBUTFMgc2Vz c2lvbiB3aXRoIHRoZSBhY3R1YWwgc2VydmVyLCBldmVuIGlmIGl0IGlzIGNvbmZpZ3VyZWQgd2l0 aCBhIHdlYiBwcm94eSAoYWZ0ZXIgYW4gSFRUUCBDT05ORUNUIHRvIHRoZSB3ZWIgcHJveHkpLiAg VGhlIHByb3h5IGhhcyB0byByZWx5IG9uIHRoZSBmYWN0IHRoYXQgdGhlIGNsaWVudCB3b3VsZCB0 cnVzdCB0aGUgcHJveHnigJlzIGNlcnRpZmljYXRlIHRvIHByb3h5IHRoZSBUTFMgc2Vzc2lvbi4g IFRoaXMgaXMgdGhlIHNhbWUgZm9yIGEgd2ViIHByb3h5IGFuZCBhIG5ldHdvcmsgbWlkZGxlYm94 IGxpa2UgYSBmaXJld2FsbC4NCg0KUGxlYXNlIGxldCBtZSBrbm93IGlmIEkgbWlzdW5kZXJzdG9v ZCB5b3VyIHBvaW50cy4gIFRoZXJlIGlzIGEgc2NlbmFyaW8gd2l0aCBDRE4gYW5kIFRMUyBvZmZs b2FkaW5nIChkZXBsb3llZCBpbiBmcm9udCBvZiB0aGUgc2VydmVyKSB3aGVyZSB0aGUgcHJveHkg aXMgdGhlIG90aGVyIOKAnGVuZOKAnSBvZiBUTFMgc2Vzc2lvbi4gIFRoaXMgd2FzIHJlZmVycmVk IGFzIOKAnGluYm91bmQgVExTIHByb3h5IiBpbiB0aGUgZHJhZnQpLCBidXQgaXQgc2VlbXMgbm90 IHRoZSBjYXNlIGhlcmUuDQoNCldlIHdpbGwgcmV2aXNlIHRoZSB0ZXh0IHJlbGF0ZWQgdG8g4oCc cHJlc2VydmluZyBJUCBhZGRyZXNzZXPigJ0sIGFuZCBkZXNjcmliZSB0aGUgdHdvIGRlcGxveW1l bnQgdHlwZXMgZXhwbGljaXRseS4NCg0KQmVzdCwNCi1FcmljDQoNCg0KT24gTWFyIDQsIDIwMjAs IGF0IDM6MjQgUE0sIEVyaWMgV2FuZyAoZWp3YW5nKSA8ZWp3YW5nQGNpc2NvLmNvbTxtYWlsdG86 ZWp3YW5nQGNpc2NvLmNvbT4+IHdyb3RlOg0KDQpSZTogW09QU0VDXSBSZXF1ZXN0IGNvbW1lbnRz IGFuZCBkaXNjdXNzaW9uIGZvciBkcmFmdC1jYW13aW5nZXQtdGxzLW5zLWltcGFjdA0KDQpXYXJy ZW4gS3VtYXJpIDx3YXJyZW5Aa3VtYXJpLm5ldDxtYWlsdG86d2FycmVuQGt1bWFyaS5uZXQ+PiBX ZWQsIDA0IE1hcmNoIDIwMjAgMTU6MzUgVVRDU2hvdyBoZWFkZXI8aHR0cHM6Ly9tYWlsYXJjaGl2 ZS5pZXRmLm9yZy9hcmNoL2Jyb3dzZS9vcHNlYy8jPg0KDQpPbiBUdWUsIE1hciAzLCAyMDIwIGF0 IDk6MTggUE0gTmFuY3kgQ2FtLVdpbmdldCAobmNhbXdpbmcpDQo8bmNhbXdpbmc9NDBjaXNjby5j b21AZG1hcmMuaWV0Zi5vcmc+PG1haWx0bzombHQ7bmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMu aWV0Zi5vcmcmZ3Q7PiB3cm90ZToNCj4NCj4gSGVsbG8gT1BTRUMgcGFydGljaXBhbnRzLA0KPg0K Pg0KPg0KPiBHaXZlbiB0aGUgdHJlbmRzIHRvIGltcHJvdmUgb24gc2VjdXJpdHkgYW5kIHByaXZh Y3ksIHdlIHRob3VnaHQgaXQgaW1wb3J0YW50IHRvIGFsc28NCj4gZG9jdW1lbnQgaG93IG5ldHdv cmsgc2VjdXJpdHkgc29sdXRpb25zIGFyZSB1c2VkIGFuZCBob3cgdGhleSBpbnRlcmFjdCB3aXRo IFRMUy4NCj4NCj4gV2UgaGF2ZSBzdWJtaXR0ZWQgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9y Zy9kb2MvZHJhZnQtY2Ftd2luZ2V0LXRscy1ucy1pbXBhY3QvDQo+IGFuZCBiZWxpZXZlIGl0IGlz IGFwcHJvcHJpYXRlIHRvIGRpc2N1c3MgaW4gdGhpcyB3b3JraW5nIGdyb3VwLg0KDQpUaGFuayB5 b3UgZm9yIHRoaXMgZG9jdW1lbnQgLS0gSSBmb3VuZCBpdCB0byBiZSBuaWNlbHkgcmVhZGFibGUg YW5kDQp1bmRlcnN0YW5kYWJsZSAtLSBvdGhlciB0aGFuIG9uZSBtYWpvciBxdWVzdGlvbnMgLyBw b2ludC4NCg0KSSdtIHN1cmUgSSdtIGdvaW5nIHRvIG1lc3MgdXAgdGhlIHRlcm1pbm9sb2d5IGhv cnJpYmx5IGhlcmUgLQ0KYXBvbG9naWVzIGluIGFkdmFuY2UuLi4NCg0KU2VjdGlvbiAzOg0KIiBU byBhY2hpZXZlIHRoaXMsIGEgVExTIFByb3h5IG11c3QgYmUgYWJsZSB0byBwcmVzZW50IGEgdmFs aWQgWC41MDkNCiAgIGNlcnRpZmljYXRlIHRvIHRoZSBUTFMgY2xpZW50IHRvIGFwcGVhciBhcyBh IHZhbGlkIFRMUyBTZXJ2ZXI7DQogICBzaW1pbGFybHksIHRoZSBjbGllbnQgbXVzdCBiZSBhYmxl IHRvIHZhbGlkYXRlIHRoZSBYLjUwOSBjZXJ0aWZpY2F0ZQ0KICAgdXNpbmcgdGhlIGFwcHJvcHJp YXRlIHRydXN0IGFuY2hvciBmb3IgdGhhdCBUTFMgY29ubmVjdGlvbi4iDQoNCkknbSBzZWVuIGF0 IGxlYXN0IDIgZGVwbG95bWVudCB0eXBlcyBmb3IgdGhpcyBzb3J0IG9mIGluc3BlY3Rpb24gLSB0 aGUNCmZpcnN0IGlzIHdoZXJlIGEgY2xpZW50IGlzIGluZm9ybWVkIHRoYXQgdGhlcmUgaXMgYSBw cm94eSBzZXJ2ZXIgdGhhdA0KdGhleSBuZWVkIHRvIHNlbmQgdGhlaXIgdHJhZmZpYyB0aHJvdWdo IC0tIGkuZSB0aGUgc3lzdGVtIG9yIGJyb3dzZXINCmlzIGNvbmZpZ3VyZWQgd2l0aCBhIHByb3h5 IHNlcnZlciAoT1MgWCBjYWxsZWQgdGhpcyAiU2VjdXJlIFdlYg0KUHJveHkiKSwgYW5kIGlzIGNv bmZpZ3VyZWQgd2l0aCBzb21ldGhpbmcgbGlrZQ0KaHR0cHM6Ly9wcm94eS5leGFtcGxlLmNvbTo4 MDgwPGh0dHBzOi8vcHJveHkuZXhhbXBsZS5jb206ODA4MC8+Lg0KDQpUaGUgc2Vjb25kIGlzIGEg c2VjdXJpdHkgYXBwbGlhbmNlIHdoaWNoIGRvZXMgTWlUTSB0eXBlIHN0dWZmLCBhbmQgdGhlDQpj bGllbnQgaW5zdGFsbHMgYSBjb3Jwb3JhdGUgQ0EgY2VydGlmaWNhdGUuDQpUaGVzZSBhcmUgdHdv IHZlcnkgdmVyeSBkaWZmZXJlbnQgZGVwbG95bWVudCBzY2VuYXJpb3MsIGFuZCB0aGUNCiJ2YWxp ZCIgcGFydCBpbiAidmFsaWQgWC41MDkgY2VydGlmaWNhdGUiIGhhdmUgdmVyeSBkaWZmZXJlbnQN Cm1lYW5pbmdzWzBdLiBJIHRoaW5rIHRoYXQgaXQgd291bGQgYmUgdXNlZnVsIHRvIGNsZWFybHkg b3V0bGluZSB0aGVzZQ0KdHdvIG1ldGhvZHMgb2Ygd2F0Y2hpbmcgImVuY3J5cHRlZCIgdXNlciB0 cmFmZmljLCBhbmQgY2xhcmlmeSB3aGljaA0Kb25lKHMpIHlvdSBhcmUgdGFsa2luZyBhYm91dC4N ClRoZSBzZW50ZW5jZTogIlRoaXMgVExTIFByb3h5IGlzIGEgdHJhbnNwYXJlbnQgaG9wIG9uIHRo ZSBwYWNrZXQgcGF0aDsNCmFuZCB3aGVyZSBuZWNlc3NhcnksIHByZXNlcnZlcyB0aGUgY2xpZW50 J3MgYW5kIHNlcnZlcidzIG9yaWdpbmFsIElQDQphZGRyZXNzIGFuZCB0aGUgaW50ZW5kZWQgc291 cmNlIGFuZCBkZXN0aW5hdGlvbiBUQ1AgcG9ydHMuIiBpbXBsaWVzDQpvbmx5IHRoZSBzZWNvbmQs IGJ1dCBJIHRoaW5rIGl0IHdvdWxkIGJlIHVzZWZ1bCB0byBiZSBtdWNoIGNsZWFyZXIgaW4NCnRo ZSBpbnRyb2R1Y3Rpb24uLi4NCg0KDQoNClcNClswXTogWXVwLCB0ZWNobmljYWxseSB0aGV5IGFy ZSBib3RoIHZhbGlkLCBidXQgKGF0IGxlYXN0IGluIG15DQpvcGluaW9uKSB0aGUgc2Vjb25kIGlz IG11Y2ggbGVzcyBzbyA6LVANCg0KDQo+DQo+DQo+DQo+IFdhcm0gcmVnYXJkcywgIE5hbmN5IChh bmQgbXkgY28tYXV0aG9ycykNCj4NCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCj4gT1BTRUMgbWFpbGluZyBsaXN0DQo+IE9QU0VDQGlldGYub3JnPG1h aWx0bzpPUFNFQ0BpZXRmLm9yZz4NCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9vcHNlYw0KDQoNCg0KLS0NCkkgZG9uJ3QgdGhpbmsgdGhlIGV4ZWN1dGlvbiBpcyByZWxl dmFudCB3aGVuIGl0IHdhcyBvYnZpb3VzbHkgYSBiYWQNCmlkZWEgaW4gdGhlIGZpcnN0IHBsYWNl Lg0KVGhpcyBpcyBsaWtlIHB1dHRpbmcgcmFiaWQgd2Vhc2VscyBpbiB5b3VyIHBhbnRzLCBhbmQg bGF0ZXIgZXhwcmVzc2luZw0KcmVncmV0IGF0IGhhdmluZyBjaG9zZW4gdGhvc2UgcGFydGljdWxh ciByYWJpZCB3ZWFzZWxzIGFuZCB0aGF0IHBhaXINCm9mIHBhbnRzLg0KICAgLS0tbWFmDQoNCg0K DQogICogICBbT1BTRUNdIFJlcXVlc3QgY29tbWVudHMgYW5kIGRpc2N1c3Npb24gZm9yIGRyYWZ0 4oCmPGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvb3BzZWMvR2tTZ2tIU3R2 TlJfNGx5RTFVZGs0Z1diM1VzLz4gIE5hbmN5IENhbS1XaW5nZXQgKG5jYW13aW5nKQ0KICAqICAg UmU6IFtPUFNFQ10gUmVxdWVzdCBjb21tZW50cyBhbmQgZGlzY3Vzc2lvbiBmb3IgZOKApjxodHRw czovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL29wc2VjL3NIai1xVUYxbGx1eFZURVpZ YkJaTDdMRlp4TS8+ICBTY2jDtm53w6RsZGVyLCBKw7xyZ2VuDQogICogICBSZTogW09QU0VDXSBS ZXF1ZXN0IGNvbW1lbnRzIGFuZCBkaXNjdXNzaW9uIGZvciBk4oCmPGh0dHBzOi8vbWFpbGFyY2hp dmUuaWV0Zi5vcmcvYXJjaC9tc2cvb3BzZWMvNk5pSW10cmNDb0Nma1pWYUdLZkp1UU41eVVnLz4g IFdhcnJlbiBLdW1hcmkNCg0KDQo= --_000_C31C56BAEF7F4CA8A8D03851A8565EEBciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <57F71CB17325E749BFC9F3E8F64EEE07@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJ3b3JkLXdy YXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgbGluZS1icmVhazogYWZ0 ZXItd2hpdGUtc3BhY2U7IiBjbGFzcz0iIj4NCkhpIFdhcnJlbiwNCjxkaXYgY2xhc3M9IiI+PGJy IGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSIiPlRoYW5rcyBhIGxvdCBmb3IgeW91ciBx dWljayByZXZpZXcgYW5kIGNvbW1lbnRzLjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9 IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+WW91IGFyZSByaWdodCwgZm9yIHRoZSBmaXJzdCB3 ZWIgcHJveHkgc2NlbmFyaW8sIHRoZSBwcm94eSBjb3VsZCBiZSB0ZXJtaW5hdGluZyB0aGUgdHJh bnNwb3J0IGxheWVyIHNvIHRoZSBjbGllbnQgYW5kIHNlcnZlcuKAmXMgSVAgYWRkcmVzc2VzIG1h eSBub3QgYmUgcHJlc2VydmVkLjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8 L2Rpdj4NCjxkaXYgY2xhc3M9IiI+SG93ZXZlciwgdGhlIFRMUyBsYXllciByZW1haW5zIHRoZSBz YW1lIGJlY2F1c2UgdGhlIGNsaWVudCBhbHdheXMgYXR0ZW1wdHMgdG8gZXN0YWJsaXNoIGFuIGVu ZC10by1lbmQgVExTIHNlc3Npb24gd2l0aCB0aGUgYWN0dWFsIHNlcnZlciwgZXZlbiBpZiBpdCBp cyBjb25maWd1cmVkIHdpdGggYSB3ZWIgcHJveHkgKGFmdGVyIGFuIEhUVFAgQ09OTkVDVCB0byB0 aGUgd2ViIHByb3h5KS4gJm5ic3A7VGhlIHByb3h5IGhhcyB0byByZWx5DQogb24gdGhlIGZhY3Qg dGhhdCB0aGUgY2xpZW50IHdvdWxkIHRydXN0IHRoZSBwcm94eeKAmXMgY2VydGlmaWNhdGUgdG8g cHJveHkgdGhlIFRMUyBzZXNzaW9uLiAmbmJzcDtUaGlzIGlzIHRoZSBzYW1lIGZvciBhIHdlYiBw cm94eSBhbmQgYSBuZXR3b3JrIG1pZGRsZWJveCBsaWtlIGEgZmlyZXdhbGwuPC9kaXY+DQo8ZGl2 IGNsYXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj5QbGVhc2UgbGV0 IG1lIGtub3cgaWYgSSBtaXN1bmRlcnN0b29kIHlvdXIgcG9pbnRzLiAmbmJzcDtUaGVyZSBpcyBh IHNjZW5hcmlvIHdpdGggQ0ROIGFuZCBUTFMgb2ZmbG9hZGluZyAoZGVwbG95ZWQgaW4gZnJvbnQg b2YgdGhlIHNlcnZlcikgd2hlcmUgdGhlIHByb3h5IGlzIHRoZSBvdGhlciDigJxlbmTigJ0gb2Yg VExTIHNlc3Npb24uICZuYnNwO1RoaXMgd2FzIHJlZmVycmVkIGFzIOKAnGluYm91bmQgVExTIHBy b3h5JnF1b3Q7IGluIHRoZSBkcmFmdCksIGJ1dA0KIGl0IHNlZW1zIG5vdCB0aGUgY2FzZSBoZXJl LjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9 IiI+V2Ugd2lsbCByZXZpc2UgdGhlIHRleHQgcmVsYXRlZCB0byDigJxwcmVzZXJ2aW5nIElQIGFk ZHJlc3Nlc+KAnSwgYW5kIGRlc2NyaWJlIHRoZSB0d28gZGVwbG95bWVudCB0eXBlcyBleHBsaWNp dGx5LjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xh c3M9IiI+QmVzdCw8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+LUVyaWM8L2Rpdj4NCjxkaXYgY2xhc3M9 IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSIiPjxiciBjbGFzcz0iIj4NCjwv ZGl2Pg0KPGRpdiBjbGFzcz0iIj4NCjxkaXY+DQo8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjbGFz cz0iIj4NCjxkaXYgY2xhc3M9IiI+T24gTWFyIDQsIDIwMjAsIGF0IDM6MjQgUE0sIEVyaWMgV2Fu ZyAoZWp3YW5nKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVqd2FuZ0BjaXNjby5jb20iIGNsYXNzPSIi PmVqd2FuZ0BjaXNjby5jb208L2E+Jmd0OyB3cm90ZTo8L2Rpdj4NCjxiciBjbGFzcz0iQXBwbGUt aW50ZXJjaGFuZ2UtbmV3bGluZSI+DQo8ZGl2IGNsYXNzPSIiPg0KPGRpdiBzdHlsZT0id29yZC13 cmFwOiBicmVhay13b3JkOyAtd2Via2l0LW5ic3AtbW9kZTogc3BhY2U7IGxpbmUtYnJlYWs6IGFm dGVyLXdoaXRlLXNwYWNlOyIgY2xhc3M9IiI+DQo8ZGl2IGlkPSJtc2ctYm9keSIgZGF0YS1tZXNz YWdlLXVybD0iaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9vcHNlYy82TmlJ bXRyY0NvQ2ZrWlZhR0tmSnVRTjV5VWcvIiBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsg Y2FyZXQtY29sb3I6IHJnYigzMywgMzcsIDQxKTsgY29sb3I6IHJnYigzMywgMzcsIDQxKTsgZm9u dC1mYW1pbHk6IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgJnF1b3Q7U2Vnb2Ug VUkmcXVvdDssIFJvYm90bywgJnF1b3Q7SGVsdmV0aWNhIE5ldWUmcXVvdDssIEFyaWFsLCBzYW5z LXNlcmlmLCAmcXVvdDtBcHBsZSBDb2xvciBFbW9qaSZxdW90OywgJnF1b3Q7U2Vnb2UgVUkgRW1v amkmcXVvdDssICZxdW90O1NlZ29lIFVJIFN5bWJvbCZxdW90OywgJnF1b3Q7Tm90byBDb2xvciBF bW9qaSZxdW90OzsgZm9udC1zaXplOiAxNHB4OyIgY2xhc3M9IiI+DQo8aDMgc3R5bGU9ImJveC1z aXppbmc6IGJvcmRlci1ib3g7IG1hcmdpbjogMnB4IDBweDsgZm9udC1mYW1pbHk6IGluaGVyaXQ7 IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxpbmUtaGVpZ2h0OiAxLjI7IGNvbG9yOiBpbmhlcml0OyBm b250LXNpemU6IDE4cHg7IiBjbGFzcz0iIj4NClJlOiBbT1BTRUNdIFJlcXVlc3QgY29tbWVudHMg YW5kIGRpc2N1c3Npb24gZm9yIGRyYWZ0LWNhbXdpbmdldC10bHMtbnMtaW1wYWN0PC9oMz4NCjxw IGlkPSJtc2ctaW5mbyIgY2xhc3M9Im1zZy1oZWFkZXIiIHN0eWxlPSJib3gtc2l6aW5nOiBib3Jk ZXItYm94OyBtYXJnaW46IDBweCAwcHggMjBweDsgY29sb3I6IHJnYigxMjgsIDEyOCwgMTI4KTsi Pg0KPHNwYW4gaWQ9Im1zZy1mcm9tIiBjbGFzcz0icGlwZSIgc3R5bGU9ImJveC1zaXppbmc6IGJv cmRlci1ib3g7Ij5XYXJyZW4gS3VtYXJpICZsdDs8YSBocmVmPSJtYWlsdG86d2FycmVuQGt1bWFy aS5uZXQiIGNsYXNzPSIiPndhcnJlbkBrdW1hcmkubmV0PC9hPiZndDs8L3NwYW4+Jm5ic3A7PHNw YW4gaWQ9Im1zZy1kYXRlIiBjbGFzcz0icGlwZSIgc3R5bGU9ImJveC1zaXppbmc6IGJvcmRlci1i b3g7Ij5XZWQsIDA0IE1hcmNoIDIwMjAgMTU6MzUgVVRDPC9zcGFuPjxhIGlkPSJ0b2dnbGUtbXNn LWhlYWRlciIgY2xhc3M9InRvZ2dsZSIgaHJlZj0iaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9y Zy9hcmNoL2Jyb3dzZS9vcHNlYy8jIiBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsgY29s b3I6IHJnYig1MSwgMTIyLCAxODMpOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IHRleHQtZGVjb3Jh dGlvbi1za2lwOiBvYmplY3RzOyI+U2hvdw0KIGhlYWRlcjwvYT48L3A+DQo8ZGl2IGNsYXNzPSJt c2ctcGF5bG9hZCIgc3R5bGU9ImJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij4NCjxwcmUgY2xhc3M9 IndvcmR3cmFwIiBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsgZm9udC1mYW1pbHk6IFNG TW9uby1SZWd1bGFyLCBNZW5sbywgTW9uYWNvLCBDb25zb2xhcywgJnF1b3Q7TGliZXJhdGlvbiBN b25vJnF1b3Q7LCAmcXVvdDtDb3VyaWVyIE5ldyZxdW90OywgbW9ub3NwYWNlOyBmb250LXNpemU6 IDEyLjI1cHg7IG1hcmdpbi10b3A6IDBweDsgbWFyZ2luLWJvdHRvbTogMXJlbTsgb3ZlcmZsb3c6 IGF1dG87IHdoaXRlLXNwYWNlOiBwcmUtd3JhcDsgd29yZC13cmFwOiBub3JtYWw7IHdvcmQtYnJl YWs6IG5vcm1hbDsgcGFkZGluZzogMHB4OyI+T24gVHVlLCBNYXIgMywgMjAyMCBhdCA5OjE4IFBN IE5hbmN5IENhbS1XaW5nZXQgKG5jYW13aW5nKQ0KPGEgaHJlZj0ibWFpbHRvOiZhbXA7bHQ7bmNh bXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmcmYW1wO2d0OyIgc3R5bGU9ImJveC1zaXpp bmc6IGJvcmRlci1ib3g7IGNvbG9yOiByZ2IoNTEsIDEyMiwgMTgzKTsgdGV4dC1kZWNvcmF0aW9u OiBub25lOyB0ZXh0LWRlY29yYXRpb24tc2tpcDogb2JqZWN0czsiIGNsYXNzPSIiPiZsdDtuY2Ft d2luZz00MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZyZndDs8L2E+IHdyb3RlOg0KJmd0Ow0KJmd0 OyBIZWxsbyBPUFNFQyBwYXJ0aWNpcGFudHMsDQomZ3Q7DQomZ3Q7DQomZ3Q7DQomZ3Q7IEdpdmVu IHRoZSB0cmVuZHMgdG8gaW1wcm92ZSBvbiBzZWN1cml0eSBhbmQgcHJpdmFjeSwgd2UgdGhvdWdo dCBpdCBpbXBvcnRhbnQgdG8gYWxzbw0KJmd0OyBkb2N1bWVudCBob3cgbmV0d29yayBzZWN1cml0 eSBzb2x1dGlvbnMgYXJlIHVzZWQgYW5kIGhvdyB0aGV5IGludGVyYWN0IHdpdGggVExTLg0KJmd0 Ow0KJmd0OyBXZSBoYXZlIHN1Ym1pdHRlZCA8YSBocmVmPSJodHRwczovL2RhdGF0cmFja2VyLmll dGYub3JnL2RvYy9kcmFmdC1jYW13aW5nZXQtdGxzLW5zLWltcGFjdC8iIHJlbD0ibm9mb2xsb3ci IHN0eWxlPSJib3gtc2l6aW5nOiBib3JkZXItYm94OyBjb2xvcjogcmdiKDUxLCAxMjIsIDE4Myk7 IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgdGV4dC1kZWNvcmF0aW9uLXNraXA6IG9iamVjdHM7IiBj bGFzcz0iIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1jYW13aW5nZXQt dGxzLW5zLWltcGFjdC88L2E+DQomZ3Q7IGFuZCBiZWxpZXZlIGl0IGlzIGFwcHJvcHJpYXRlIHRv IGRpc2N1c3MgaW4gdGhpcyB3b3JraW5nIGdyb3VwLg0KDQpUaGFuayB5b3UgZm9yIHRoaXMgZG9j dW1lbnQgLS0gSSBmb3VuZCBpdCB0byBiZSBuaWNlbHkgcmVhZGFibGUgYW5kDQp1bmRlcnN0YW5k YWJsZSAtLSBvdGhlciB0aGFuIG9uZSBtYWpvciBxdWVzdGlvbnMgLyBwb2ludC4NCg0KSSdtIHN1 cmUgSSdtIGdvaW5nIHRvIG1lc3MgdXAgdGhlIHRlcm1pbm9sb2d5IGhvcnJpYmx5IGhlcmUgLQ0K YXBvbG9naWVzIGluIGFkdmFuY2UuLi4NCg0KU2VjdGlvbiAzOg0KJnF1b3Q7IFRvIGFjaGlldmUg dGhpcywgYSBUTFMgUHJveHkgbXVzdCBiZSBhYmxlIHRvIHByZXNlbnQgYSB2YWxpZCBYLjUwOQ0K ICAgY2VydGlmaWNhdGUgdG8gdGhlIFRMUyBjbGllbnQgdG8gYXBwZWFyIGFzIGEgdmFsaWQgVExT IFNlcnZlcjsNCiAgIHNpbWlsYXJseSwgdGhlIGNsaWVudCBtdXN0IGJlIGFibGUgdG8gdmFsaWRh dGUgdGhlIFguNTA5IGNlcnRpZmljYXRlDQogICB1c2luZyB0aGUgYXBwcm9wcmlhdGUgdHJ1c3Qg YW5jaG9yIGZvciB0aGF0IFRMUyBjb25uZWN0aW9uLiZxdW90Ow0KDQpJJ20gc2VlbiBhdCBsZWFz dCAyIGRlcGxveW1lbnQgdHlwZXMgZm9yIHRoaXMgc29ydCBvZiBpbnNwZWN0aW9uIC0gdGhlDQpm aXJzdCBpcyB3aGVyZSBhIGNsaWVudCBpcyBpbmZvcm1lZCB0aGF0IHRoZXJlIGlzIGEgcHJveHkg c2VydmVyIHRoYXQNCnRoZXkgbmVlZCB0byBzZW5kIHRoZWlyIHRyYWZmaWMgdGhyb3VnaCAtLSBp LmUgdGhlIHN5c3RlbSBvciBicm93c2VyDQppcyBjb25maWd1cmVkIHdpdGggYSBwcm94eSBzZXJ2 ZXIgKE9TIFggY2FsbGVkIHRoaXMgJnF1b3Q7U2VjdXJlIFdlYg0KUHJveHkmcXVvdDspLCBhbmQg aXMgY29uZmlndXJlZCB3aXRoIHNvbWV0aGluZyBsaWtlDQo8YSBocmVmPSJodHRwczovL3Byb3h5 LmV4YW1wbGUuY29tOjgwODAvIiByZWw9Im5vZm9sbG93IiBzdHlsZT0iYm94LXNpemluZzogYm9y ZGVyLWJveDsgY29sb3I6IHJnYig1MSwgMTIyLCAxODMpOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7 IHRleHQtZGVjb3JhdGlvbi1za2lwOiBvYmplY3RzOyIgY2xhc3M9IiI+aHR0cHM6Ly9wcm94eS5l eGFtcGxlLmNvbTo4MDgwPC9hPi4NCg0KVGhlIHNlY29uZCBpcyBhIHNlY3VyaXR5IGFwcGxpYW5j ZSB3aGljaCBkb2VzIE1pVE0gdHlwZSBzdHVmZiwgYW5kIHRoZQ0KY2xpZW50IGluc3RhbGxzIGEg Y29ycG9yYXRlIENBIGNlcnRpZmljYXRlLg0KVGhlc2UgYXJlIHR3byB2ZXJ5IHZlcnkgZGlmZmVy ZW50IGRlcGxveW1lbnQgc2NlbmFyaW9zLCBhbmQgdGhlDQomcXVvdDt2YWxpZCZxdW90OyBwYXJ0 IGluICZxdW90O3ZhbGlkIFguNTA5IGNlcnRpZmljYXRlJnF1b3Q7IGhhdmUgdmVyeSBkaWZmZXJl bnQNCm1lYW5pbmdzWzBdLiBJIHRoaW5rIHRoYXQgaXQgd291bGQgYmUgdXNlZnVsIHRvIGNsZWFy bHkgb3V0bGluZSB0aGVzZQ0KdHdvIG1ldGhvZHMgb2Ygd2F0Y2hpbmcgJnF1b3Q7ZW5jcnlwdGVk JnF1b3Q7IHVzZXIgdHJhZmZpYywgYW5kIGNsYXJpZnkgd2hpY2gNCm9uZShzKSB5b3UgYXJlIHRh bGtpbmcgYWJvdXQuDQpUaGUgc2VudGVuY2U6ICZxdW90O1RoaXMgVExTIFByb3h5IGlzIGEgdHJh bnNwYXJlbnQgaG9wIG9uIHRoZSBwYWNrZXQgcGF0aDsNCmFuZCB3aGVyZSBuZWNlc3NhcnksIHBy ZXNlcnZlcyB0aGUgY2xpZW50J3MgYW5kIHNlcnZlcidzIG9yaWdpbmFsIElQDQphZGRyZXNzIGFu ZCB0aGUgaW50ZW5kZWQgc291cmNlIGFuZCBkZXN0aW5hdGlvbiBUQ1AgcG9ydHMuJnF1b3Q7IGlt cGxpZXMNCm9ubHkgdGhlIHNlY29uZCwgYnV0IEkgdGhpbmsgaXQgd291bGQgYmUgdXNlZnVsIHRv IGJlIG11Y2ggY2xlYXJlciBpbg0KdGhlIGludHJvZHVjdGlvbi4uLg0KDQoNCg0KVw0KWzBdOiBZ dXAsIHRlY2huaWNhbGx5IHRoZXkgYXJlIGJvdGggdmFsaWQsIGJ1dCAoYXQgbGVhc3QgaW4gbXkN Cm9waW5pb24pIHRoZSBzZWNvbmQgaXMgbXVjaCBsZXNzIHNvIDotUA0KDQoNCiZndDsNCiZndDsN CiZndDsNCiZndDsgV2FybSByZWdhcmRzLCAgTmFuY3kgKGFuZCBteSBjby1hdXRob3JzKQ0KJmd0 Ow0KJmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K Jmd0OyBPUFNFQyBtYWlsaW5nIGxpc3QNCiZndDsgPGEgaHJlZj0ibWFpbHRvOk9QU0VDQGlldGYu b3JnIiBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsgY29sb3I6IHJnYig1MSwgMTIyLCAx ODMpOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IHRleHQtZGVjb3JhdGlvbi1za2lwOiBvYmplY3Rz OyIgY2xhc3M9IiI+T1BTRUNAaWV0Zi5vcmc8L2E+DQomZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vb3BzZWMiIHJlbD0ibm9mb2xsb3ciIHN0eWxlPSJi b3gtc2l6aW5nOiBib3JkZXItYm94OyBjb2xvcjogcmdiKDUxLCAxMjIsIDE4Myk7IHRleHQtZGVj b3JhdGlvbjogbm9uZTsgdGV4dC1kZWNvcmF0aW9uLXNraXA6IG9iamVjdHM7IiBjbGFzcz0iIj5o dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL29wc2VjPC9hPg0KDQoNCg0KLS0g DQpJIGRvbid0IHRoaW5rIHRoZSBleGVjdXRpb24gaXMgcmVsZXZhbnQgd2hlbiBpdCB3YXMgb2J2 aW91c2x5IGEgYmFkDQppZGVhIGluIHRoZSBmaXJzdCBwbGFjZS4NClRoaXMgaXMgbGlrZSBwdXR0 aW5nIHJhYmlkIHdlYXNlbHMgaW4geW91ciBwYW50cywgYW5kIGxhdGVyIGV4cHJlc3NpbmcNCnJl Z3JldCBhdCBoYXZpbmcgY2hvc2VuIHRob3NlIHBhcnRpY3VsYXIgcmFiaWQgd2Vhc2VscyBhbmQg dGhhdCBwYWlyDQpvZiBwYW50cy4NCiAgIC0tLW1hZg0KDQo8L3ByZT4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsiIGNsYXNzPSIiPjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2IGlkPSJtZXNzYWdlLXRocmVhZCIgc3R5bGU9ImJveC1zaXppbmc6IGJvcmRlci1ib3g7IGNh cmV0LWNvbG9yOiByZ2IoMzMsIDM3LCA0MSk7IGNvbG9yOiByZ2IoMzMsIDM3LCA0MSk7IGZvbnQt ZmFtaWx5OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsICZxdW90O1NlZ29lIFVJ JnF1b3Q7LCBSb2JvdG8sICZxdW90O0hlbHZldGljYSBOZXVlJnF1b3Q7LCBBcmlhbCwgc2Fucy1z ZXJpZiwgJnF1b3Q7QXBwbGUgQ29sb3IgRW1vamkmcXVvdDssICZxdW90O1NlZ29lIFVJIEVtb2pp JnF1b3Q7LCAmcXVvdDtTZWdvZSBVSSBTeW1ib2wmcXVvdDssICZxdW90O05vdG8gQ29sb3IgRW1v amkmcXVvdDs7IGZvbnQtc2l6ZTogMTRweDsiIGNsYXNzPSIiPg0KPHVsIGNsYXNzPSJ0aHJlYWQt c25pcHBldCIgc3R5bGU9ImJveC1zaXppbmc6IGJvcmRlci1ib3g7IG1hcmdpbi10b3A6IDMwcHg7 IG1hcmdpbi1ib3R0b206IDFyZW07IGZvbnQtZmFtaWx5OiBNZW5sbywgTW9uYWNvLCBDb25zb2xh cywgJnF1b3Q7Q291cmllciBOZXcmcXVvdDssIG1vbm9zcGFjZTsgZm9udC1zaXplOiAxM3B4OyBs aXN0LXN0eWxlLXR5cGU6IG5vbmU7IHBhZGRpbmctbGVmdDogMHB4OyI+DQo8bGkgY2xhc3M9ImRl cHRoLTAiIHN0eWxlPSJib3gtc2l6aW5nOiBib3JkZXItYm94OyI+PGEgaHJlZj0iaHR0cHM6Ly9t YWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9vcHNlYy9Ha1Nna0hTdHZOUl80bHlFMVVkazRn V2IzVXMvIiBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsgY29sb3I6IHJnYig1MSwgMTIy LCAxODMpOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IHRleHQtZGVjb3JhdGlvbi1za2lwOiBvYmpl Y3RzOyIgY2xhc3M9IiI+W09QU0VDXQ0KIFJlcXVlc3QgY29tbWVudHMgYW5kIGRpc2N1c3Npb24g Zm9yIGRyYWZ04oCmPC9hPiZuYnNwOyZuYnNwO05hbmN5IENhbS1XaW5nZXQgKG5jYW13aW5nKTwv bGk+PGxpIGNsYXNzPSJkZXB0aC0xIiBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsgcGFk ZGluZy1sZWZ0OiAyZW07Ij48YSBocmVmPSJodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2Fy Y2gvbXNnL29wc2VjL3NIai1xVUYxbGx1eFZURVpZYkJaTDdMRlp4TS8iIHN0eWxlPSJib3gtc2l6 aW5nOiBib3JkZXItYm94OyBjb2xvcjogcmdiKDUxLCAxMjIsIDE4Myk7IHRleHQtZGVjb3JhdGlv bjogbm9uZTsgdGV4dC1kZWNvcmF0aW9uLXNraXA6IG9iamVjdHM7IiBjbGFzcz0iIj5SZToNCiBb T1BTRUNdIFJlcXVlc3QgY29tbWVudHMgYW5kIGRpc2N1c3Npb24gZm9yIGTigKY8L2E+Jm5ic3A7 Jm5ic3A7U2Now7Zud8OkbGRlciwgSsO8cmdlbjwvbGk+PGxpIGNsYXNzPSJkZXB0aC0xIGN1cnJl bnQtbXNnIiBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsgYmFja2dyb3VuZC1jb2xvcjog cmdiKDI0NCwgMjQ1LCAyNDUpOyBwYWRkaW5nLWxlZnQ6IDJlbTsgYmFja2dyb3VuZC1wb3NpdGlv bjogaW5pdGlhbCBpbml0aWFsOyBiYWNrZ3JvdW5kLXJlcGVhdDogaW5pdGlhbCBpbml0aWFsOyI+ DQo8YSBocmVmPSJodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL29wc2VjLzZO aUltdHJjQ29DZmtaVmFHS2ZKdVFONXlVZy8iIHN0eWxlPSJib3gtc2l6aW5nOiBib3JkZXItYm94 OyBjb2xvcjogcmdiKDUxLCAxMjIsIDE4Myk7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgYmFja2dy b3VuZC1jb2xvcjogdHJhbnNwYXJlbnQ7IHRleHQtZGVjb3JhdGlvbi1za2lwOiBvYmplY3RzOyIg Y2xhc3M9IiI+UmU6IFtPUFNFQ10gUmVxdWVzdCBjb21tZW50cw0KIGFuZCBkaXNjdXNzaW9uIGZv ciBk4oCmPC9hPiZuYnNwOyZuYnNwO1dhcnJlbiBLdW1hcmk8L2xpPjwvdWw+DQo8L2Rpdj4NCjxk aXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPC9kaXY+DQo8YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_C31C56BAEF7F4CA8A8D03851A8565EEBciscocom_-- From nobody Wed Mar 4 17:37:33 2020 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D3793A07E4 for ; Wed, 4 Mar 2020 17:37:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.599 X-Spam-Level: X-Spam-Status: No, score=-9.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=TnZXDvDe; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=brBy+mvG Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5kdp8EZNX7TB for ; Wed, 4 Mar 2020 17:37:31 -0800 (PST) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE5373A07E2 for ; Wed, 4 Mar 2020 17:37:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=9259; q=dns/txt; s=iport; t=1583372250; x=1584581850; h=from:to:cc:subject:date:message-id:references: mime-version; bh=kkZA5uei1yMU1DIuxFXJvWU248qG5rnvQEvRHXTVFG8=; b=TnZXDvDefp0weR/HEGXo/+9CZor4w2ShhHtw5CmQgYTVo3nk5wzfdv2d uoUpsLm243OqEar2M9UqIMUv0Z3fnTK8dyWTxarWzG8qIHPGEU8plXNn6 nDcmshGY+zvQxzfBHNsuIjnzcklGXsO3uv37TUzImbhoaEQva7v6M+6Jp c=; X-IPAS-Result: =?us-ascii?q?A0D/AQDnVmBe/4sNJK1mGwEBAQEBAQEFAQEBEQEBAwMBA?= =?us-ascii?q?QGBe4FUUAVsWCAECyoKh1EDimmCOiWTM4RiglIDVAkBAQEMAQElCAIEAQGDD?= =?us-ascii?q?YE2AoIBJDgTAgMBAQEDAgMBAQEBBQEBAQIBBQRthVYBC4VjAQIBAxIuAQE3A?= =?us-ascii?q?Q8CARkDAQIoBzIUCQgCBA4FIoMEAYF9TQMuAQ6iSgKBOYhigieCfwEBBYEzA?= =?us-ascii?q?g5BgxYYggwJgTiFIYcGGoIAgTgMFIJNgSkZAYFfAQECAQEYgWkNCQiDBYIsl?= =?us-ascii?q?lYkmSYKgjwEh06PFByCSX+HIJBJRI4uiHyPHYMyAgQCBAUCDgEBBYE/KiKBW?= =?us-ascii?q?HAVGksBgkEJNRIYDY4dGINbhRSFQXQCgSeMDwGBDwEB?= IronPort-PHdr: =?us-ascii?q?9a23=3AAnBv0xeMdUeHBPyA9SIjEcnqlGMj4e+mNxMJ6p?= =?us-ascii?q?chl7NFe7ii+JKnJkHE+PFxlwKYD57D5adCjOzb++D7VGoM7IzJkUhKcYcEFn?= =?us-ascii?q?pnwd4TgxRmBceEDUPhK/u/Yi4lFcJNfFRk5Hq8d0NSHZW2PgeAuHC54D8MFx?= =?us-ascii?q?m6LhJ7drinPInUgoz3z/q155DYfwRPgny6fK92KxK16w7Ws5teiop5IaF3wR?= =?us-ascii?q?zM6ndPdv8ew2R0bV6ehBfz4M6s8fsBuzxdofcg69JNXe3hcqI0QKYQDDM9L3?= =?us-ascii?q?t06Q=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.70,516,1574121600"; d="scan'208,217";a="430254830" Received: from alln-core-6.cisco.com ([173.36.13.139]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 05 Mar 2020 01:37:29 +0000 Received: from XCH-RCD-005.cisco.com (xch-rcd-005.cisco.com [173.37.102.15]) by alln-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id 0251bTPs028910 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 5 Mar 2020 01:37:29 GMT Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-RCD-005.cisco.com (173.37.102.15) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 4 Mar 2020 19:37:29 -0600 Received: from xhs-rcd-003.cisco.com (173.37.227.248) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 4 Mar 2020 19:37:28 -0600 Received: from NAM10-DM6-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-003.cisco.com (173.37.227.248) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 4 Mar 2020 19:37:28 -0600 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fdp+oxO1DsMekHszNmGquWUZnpSiFfMj5mqnGqSmoB0MTzm02+kL0qGVhFLCtkUMjHPxtLEjX0y8El/i+noDVIkbQK5y8MI77DL4c4z4DkExhLbB+BfKLg6RcBhewHV+7QCdcenz6witIS3zuakAVgfmasoAv7O8pdvmnxtiG95zJ/E6pAe1TSLd0h/IRiZKYu9DYycZaY2Qp0H0J83RgVIA3FOqd17iHk9B0FvTEKLNVgjKPXp6VvUVQgXXTrEkP/nrqIWf/FDsOgktiFO6o+qFIUwVXfkyyOwOegf/HBWBLRkiCXtdtvFxddn+iNUs9cXImOykd3jeikklc2bVSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sGpDBL1AATR8huXgcHS3ATCSTbN9XF+k4xcdeAZqPIY=; b=Ld+f8m8DTM71fLi/d5JO4ABgKDr7c/LlXZtMahwvdmuCz9JwcED24zE17/cQroPXgcD/IyGyceHjNeW60nxoA6TF2r0Ar+netqAvUH7a4ntg3cAJsB6elQB6vsdDXPLrLwlAhYXJ9aKFrtNhbkA4A3qTy31sPn4Uv/RTUVzn2ZskrTxbkhtuDsSmvL0O6HTZoWu99hP0SInMWD62Qtk4BNIGgzvAo1jAA2gX3roJY38I4GJp90hJIp2QcLD27hOV7Cdd3gr497SSTsMnYCgNitXE7xL8w81Rfty6cGqlinFuvfpkdX0/ysnu/j7suB1o8oeCN78Izk/DsXp+oIzGDg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sGpDBL1AATR8huXgcHS3ATCSTbN9XF+k4xcdeAZqPIY=; b=brBy+mvGPjCBrJBVTN9qx1ec0RbT6HhSbVOPcvGOUWfiigznh5VcF5mw5znNDhOJy0GL18i39F6Dkma4Lnp/6nTAAAwZVHm56nFFV8iaCL9QTPdigPbTWBfxiSflj5sNzCxflbqLVF2ak+N1AwaaBaNQXr6uyn7pUiqmiExMzjc= Received: from BYAPR11MB2789.namprd11.prod.outlook.com (2603:10b6:a02:cc::11) by BYAPR11MB2568.namprd11.prod.outlook.com (2603:10b6:a02:c6::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2772.18; Thu, 5 Mar 2020 01:37:27 +0000 Received: from BYAPR11MB2789.namprd11.prod.outlook.com ([fe80::c1a4:a744:c5af:ea5b]) by BYAPR11MB2789.namprd11.prod.outlook.com ([fe80::c1a4:a744:c5af:ea5b%5]) with mapi id 15.20.2772.019; Thu, 5 Mar 2020 01:37:27 +0000 From: "Eric Wang (ejwang)" To: "opsec@ietf.org" CC: "Andrew Ossipov (aossipov)" , Roelof DuToit , "Nancy Cam-Winget (ncamwing)" Thread-Topic: Request comments & discussion for draft-wang-tls-proxy-best-practice Thread-Index: AQHV8o6gGXamB5iflkuh13nIRXfUOQ== Date: Thu, 5 Mar 2020 01:37:27 +0000 Message-ID: References: <158336398859.29242.5330683089303756006@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3445.104.11) authentication-results: spf=none (sender IP is ) smtp.mailfrom=ejwang@cisco.com; x-originating-ip: [50.196.137.195] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: bb169c3c-6479-4b95-0b15-08d7c0a5c393 x-ms-traffictypediagnostic: BYAPR11MB2568: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 03333C607F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(39860400002)(366004)(136003)(346002)(396003)(199004)(189003)(107886003)(66476007)(966005)(71200400001)(36756003)(2906002)(478600001)(33656002)(66574012)(186003)(6916009)(26005)(66446008)(64756008)(66556008)(66946007)(76116006)(316002)(81156014)(2616005)(6512007)(8676002)(54906003)(6506007)(86362001)(4326008)(8936002)(5660300002)(6486002)(81166006); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR11MB2568; H:BYAPR11MB2789.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: P1Uetuee5+CUSaYfNvlYKvt4aXqvAH/H/a0+kWhJ4fT0Q/TFB4+HQLwXjllZmEyv5Ns5DoCT7A71RYxrwk1T3k30qwwXD0Ty/AuyyaFBOnhBpVFurcGXGH276S6mdbWDgghxSsmpcsKP8c6759Kzxw1LLewgSI1POXW/dMkhUJwVMhwEpFXN+8bndu/Qzeq28LRrqb+TP2vMrJO7EgIGYidwGP45XnH/iIPEs2SCFwoGtAQ5wRCgxD4yTsGwM04sAtYuYNUMhM3TRK3zMVGMxFP3tJEFnm5Nu39LDpcWPee4T5ddJ0kAXUtLcWcEO4dBYvyiRjtTRhncifFSRl1g/KEHWDoNbwwqHzBzIeGyxMkjVDyB6VsUOcAwtnyimy5Yxh64UhkHqgcVFc8vgXlZfKIHMEvjBpfQKTXSBbXEpOcVjzBCoORL9suWOGQVv1vx8344mFUiq7IuKxILy0mH4i9hat2MskTZVnEmSeFGvN6o7KYj7aBmvIB1d3yYx00DU2ih42zPZF7xrSqsh/QVCA== x-ms-exchange-antispam-messagedata: 3yptwjjMBcX9dG2KhX30S0KEdGi3SbcZGj4XDGPTZQzyrr44M/hPzyjT9HxQEqGMHjwLqaDyT682Fk2/eJW0l7rB2IvbicLtr/R7thE1ec67dnMPGOaeiliZE9UMWolbdqgcny3AiLSRKsOu6irt+A== Content-Type: multipart/alternative; boundary="_000_D70D9FE4187241E38D03D8987F425698ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: bb169c3c-6479-4b95-0b15-08d7c0a5c393 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Mar 2020 01:37:27.7196 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 5MejMBpKV0nr/yYvwjxIBVXOvBrm6RAN99pqWTzJEfvabI1kUvekJbW1kERmt0zIOJC0oK0vNmbfWiisezvkRQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR11MB2568 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.15, xch-rcd-005.cisco.com X-Outbound-Node: alln-core-6.cisco.com Archived-At: Subject: [OPSEC] Request comments & discussion for draft-wang-tls-proxy-best-practice X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Mar 2020 01:37:33 -0000 --_000_D70D9FE4187241E38D03D8987F425698ciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello OPSEC participants, We just submitted the following draft related to security best practices fo= r implementing "TLS proxy", a common function leveraged by network operator= s. We thought it is relevant to this working group and would appreciate you= r review and comments. This document is also related to draft-camwinget-tls-ns-impact which Nancy sent out e= arlier. Best, -Eric (on behalf of the authors) Begin forwarded message: From: > Subject: New Version Notification for draft-wang-tls-proxy-best-practice-01= .txt Date: March 4, 2020 at 3:19:48 PM PST To: Andrew Ossipov >, Eric Wa= ng >, "Roelof DuToit" > A new version of I-D, draft-wang-tls-proxy-best-practice-01.txt has been successfully submitted by Eric Wang and posted to the IETF repository. Name: draft-wang-tls-proxy-best-practice Revision: 01 Title: TLS Proxy Best Practice Document date: 2020-03-04 Group: Individual Submission Pages: 16 URL: https://www.ietf.org/internet-drafts/draft-wang-tls-proxy-b= est-practice-01.txt Status: https://datatracker.ietf.org/doc/draft-wang-tls-proxy-best-= practice/ Htmlized: https://tools.ietf.org/html/draft-wang-tls-proxy-best-pract= ice-01 Htmlized: https://datatracker.ietf.org/doc/html/draft-wang-tls-proxy-= best-practice Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-wang-tls-proxy-be= st-practice-01 Abstract: TLS proxies are widely deployed by organizations to enable security features and apply enterprise policies. This document defines a TLS proxy and discusses a wide range of security requirements to guide TLS proxy implementations. Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --_000_D70D9FE4187241E38D03D8987F425698ciscocom_ Content-Type: text/html; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable Hello OPSEC participants,

We just submitted the following draft related to security b= est practices for implementing "TLS proxy", a common function lev= eraged by network operators. We thought it is relevant to this working grou= p and would appreciate your review and comments.

This document is also related to draft-cam= winget-tls-ns-impact which Nancy sent out earlier.

Best,

-Eric (on behalf of the authors)


Begin forwarded message:

From: <internet-drafts@ietf.org>
Subject: New Version Notification = for draft-wang-tls-proxy-best-practice-01.txt
Date: March 4, 2020 at 3:19:48 PM PST
To: Andrew Ossipov <aossipov@cisco.com>, Eric Wang <ejwang@cisco.com>, "Roelof DuToit" <roelof.dutoit@broadcom.com>


A new version of I-D, draft-wang-tls-proxy-best-practice-01.txt
has been successfully submitted by Eric Wang and posted to the
IETF repository.

Name: draft-wang-tls-p= roxy-best-practice
Revision: 0= 1
Title: TLS Proxy Best = Practice
Document date: 2020-03-04
Group: Individual Subm= ission
Pages: 16
URL:            https://www.ietf.org/internet-drafts/draft-wang-tls-= proxy-best-practice-01.txt
Status:         ht= tps://datatracker.ietf.org/doc/draft-wang-tls-proxy-best-practice/
Htmlized:       https://tools.i= etf.org/html/draft-wang-tls-proxy-best-practice-01
Htmlized:       https://= datatracker.ietf.org/doc/html/draft-wang-tls-proxy-best-practice
Diff:           https://www.ietf.org/rfcdiff?url2=3Ddraft-wang-tls-proxy-bes= t-practice-01

Abstract:
  TLS proxies are widely deployed by organizations to enable secu= rity
  features and apply enterprise policies.  This document def= ines a TLS
  proxy and discusses a wide range of security requirements to gu= ide
  TLS proxy implementations.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat



--_000_D70D9FE4187241E38D03D8987F425698ciscocom_--