From nobody Wed Apr 1 07:26:10 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD6A83A1029 for ; Wed, 1 Apr 2020 07:26:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CRi8HiMQtjnz for ; Wed, 1 Apr 2020 07:26:05 -0700 (PDT) Received: from mail-edgeS23.fraunhofer.de (mail-edges23.fraunhofer.de [153.97.7.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B02E3A1041 for ; Wed, 1 Apr 2020 07:26:03 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2HfEACJo4Re/xoHYZlmhD4sbANVLyo?= =?us-ascii?q?KkxWBZAglmV+BXwgKAQEBAQEBAQEBBgEBGAsKAgQBAQKEQgKCOSQ4EwIQAQE?= =?us-ascii?q?GAQEBAQEFBAICaYVWDINTfgEBAQEBAQEBAQEBAQEBAQEBAQEWAkNVEgEfAQE?= =?us-ascii?q?BAwEBMAEFNhsLEgYuJyIOBg0GAgEBgldLAYJ7BQuwCoVLg02BOAaBOIwiDw+?= =?us-ascii?q?BTD+BEScMA4JePoJnAQGBMAESAYYRBI4CBC+iSweBSXd8BJYaI4JMjGAFjEG?= =?us-ascii?q?DaIs7BIFSmjwCBAIJAhWBaSNncU0kT4JsUBgNlySFQ3KBKYx8AYEPAQE?= X-IPAS-Result: =?us-ascii?q?A2HfEACJo4Re/xoHYZlmhD4sbANVLyoKkxWBZAglmV+BX?= =?us-ascii?q?wgKAQEBAQEBAQEBBgEBGAsKAgQBAQKEQgKCOSQ4EwIQAQEGAQEBAQEFBAICa?= =?us-ascii?q?YVWDINTfgEBAQEBAQEBAQEBAQEBAQEBAQEWAkNVEgEfAQEBAwEBMAEFNhsLE?= =?us-ascii?q?gYuJyIOBg0GAgEBgldLAYJ7BQuwCoVLg02BOAaBOIwiDw+BTD+BEScMA4JeP?= =?us-ascii?q?oJnAQGBMAESAYYRBI4CBC+iSweBSXd8BJYaI4JMjGAFjEGDaIs7BIFSmjwCB?= =?us-ascii?q?AIJAhWBaSNncU0kT4JsUBgNlySFQ3KBKYx8AYEPAQE?= X-IronPort-AV: E=Sophos;i="5.72,332,1580770800"; d="scan'208";a="16989299" Received: from mail-mtas26.fraunhofer.de ([153.97.7.26]) by mail-edgeS23.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 01 Apr 2020 16:26:01 +0200 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CUEQCJo4Re/1lIDI1mHgELHIN4LGw?= =?us-ascii?q?DVDAqCpMVgWQIJZlfgWcKAQMBAQEBAQYBARgLCgIEAQGERAKCOCQ4EwIQAQE?= =?us-ascii?q?FAQEBAgEFBG2FVgyFcQEBAQMBATABBTYbCxIGLiciDgYNBgIBAYJXSwGDAAu?= =?us-ascii?q?wCoVLg02BOAaBOIwiDw+BTD+BEScMA4JePoJnAQGBMAESAYYRBI4CBC+iSwe?= =?us-ascii?q?BSXd8BJYaI4JMjGAFjEGDaIs7BIFSmjwCBAIJAhWBaSJncU0kT4JsUBgNlyS?= =?us-ascii?q?FQ0ExgSmMfAGBDwEB?= X-IronPort-AV: E=Sophos;i="5.72,332,1580770800"; d="scan'208";a="110738984" Received: from mailext.sit.fraunhofer.de ([141.12.72.89]) by mail-mtaS26.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 01 Apr 2020 16:25:58 +0200 Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 031EPvsU020523 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT) for ; Wed, 1 Apr 2020 16:25:58 +0200 Received: from [192.168.16.50] (79.234.123.239) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Wed, 1 Apr 2020 16:25:53 +0200 To: , "Fuchs, Andreas" References: From: Henk Birkholz Message-ID: Date: Wed, 1 Apr 2020 16:25:51 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [79.234.123.239] Archived-At: Subject: Re: [Rats] Nine Event Definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2020 14:26:09 -0000 Hi Eric, hi group, now that the architecture is starting to become stable, we will update the current RATS TUDA I-D and pull new terms and concept references in. This will include a mapping to the "remote attestation event types" that are proposed below. As TUDA is all about timestamps that makes a lot of sense. There were a few "purple" boxes that represent additional candidates to the list below in an older email from Eric. E.g., the "handle distribution" time. There is a counterpart to that (quite valid) candidate, that is the "loss of centrally time-bound freshness proof" due to clock drifts or restarts of "local relative tick counters" (these were addressed to some extend by the age Claim, too, I think) that are common in less secure environments. So there can be dedicated points in time, at which a proof of trustworthy time synchronization looses its validity - and a new "centrally time-bound freshness proof" is required and MUST be created and distributed, otherwise new streamed evidence would be rendered invalid. There are probably a few other points of time that are of interest from the PoV that is TUDA and we will provide updates on that in the following days. As an additional general comment: I find a clear differentiation of value generation, claim collection, and evidence creation is missing in the set of the very first two timestamp types. A lot of things can happen in these two durations and that could also render evidence invalid. In summary, the TUDA authors find the work on "remote attestation event types" relevant and useful as a frame of reference in the RATS architecture and support the inclusion into the architecture. Viele Grüße, Henk On 31.03.20 17:13, Eric Voit (evoit) wrote: > In today's RATS WG call, there was a discussion on RATS timing definitions > across use cases. Below are nine Event definitions which span multiple RATS > use cases. Each of these nine Event definitions currently appear in a pull > request to the Architecture document. (For those of you following the > alias, you will have seen early versions of these definitions.) It is > hoped that by including a common set of event type definitions in the > Architecture document, we will have a language which can help us more > formally frame similar characteristics between the use cases. And then we > can build call flow / timing diagrams which hopefully expose these > similarities. > > There are two asks from this email: > (1) Do you want to propose one or more *additional* event types which you > believe are common enough to be placed into the architecture document? > (Note: that *not* having an Event type in the architecture document does not > preclude you developing your own Event types. It just makes it harder for > others to adopt your event definitions within their documents.) > > (2) Are there any issues with the names and definitions described below? > > > ------------------------------ > Nine Event Definitions > ------------------------------ > > vg - Value Generation > A value to appear in a claim was created > > ns - Nonce Sent > A random number is generated and sent > > nr - Nonce Relayed > A random number is passed through another entity > > eg - Evidence Generation > An Attester collects claims and generates Evidence > > er - Evidence Relayed > A Relying Party relays Evidence to a Verifier > > rg - Result Generation > A Verifier appraises Evidence and generates an Attestation Result > > ra - Result Appraised > The Relying Party appraises Attestation Results > > op - Operation Performed > The Relying Party performs some operation in part driven by the current > trustworthiness of the Attester > > rx - Result eXpiry > An Attestation Result should no longer be accepted, according to the > Verifier that generated them. > > > > Thanks! > Eric > > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > From nobody Wed Apr 1 11:51:00 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93E203A1686 for ; Wed, 1 Apr 2020 11:50:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.894 X-Spam-Level: X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fzJOZkMtp3Uf for ; Wed, 1 Apr 2020 11:50:55 -0700 (PDT) Received: from p3plsmtpa07-07.prod.phx3.secureserver.net (p3plsmtpa07-07.prod.phx3.secureserver.net [173.201.192.236]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A28803A1688 for ; Wed, 1 Apr 2020 11:50:55 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id JiRyjHdFCS7eZJiRyjwahZ; Wed, 01 Apr 2020 11:50:54 -0700 X-CMAE-Analysis: v=2.3 cv=ddr+Ikfe c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=48vgC7mUAAAA:8 a=zOLhTfynNYFY5PjvBjUA:9 a=nwmVQDgInM9ueXmc:21 a=rPHSyVhh7JikVN4H:21 a=QEXdDO2ut3YA:10 a=d7t-KD0D6-2d_LFlxx8A:9 a=Bah-0pS1WeWejEtG:21 a=dF2ahKKp-_HYeXYo:21 a=hXr-nTB63YX3HBLk:21 a=_W_S_7VecoQA:10 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: <97CA2A0C-6C67-4FF2-BC96-A56EEA4AB2CC@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F9999741-143B-4AAC-8C42-6333E553FB77" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 1 Apr 2020 11:50:53 -0700 In-Reply-To: Cc: "rats@ietf.org" To: "Eric Voit (evoit)" References: X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfB8i841L/YzMDONdot/dRdGOhtd/ALcnjErp+l4QvDrVoAQ6eqxQjtRiX9Ay1V0ql1vmvGvBp1Dar0hrTeJgurB4le+gI3xxrfigBLjr4yRRj50B753w TsNnlSoVRHNaDMVUpmYlKtitLtPrhr6I6C82qtgicN6KTNxnLsVcaKn5t0+yYB/kl0j6dT8QRwSsQshTPSOEpajXNBQFN+n7o5I= Archived-At: Subject: Re: [Rats] Nine Event Definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2020 18:50:58 -0000 --Apple-Mail=_F9999741-143B-4AAC-8C42-6333E553FB77 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Mar 31, 2020, at 8:13 AM, Eric Voit (evoit) = wrote: >=20 > =E2=80=A6 > (2) Are there any issues with the names and definitions described = below? >=20 Nonces don=E2=80=99t have to be random numbers, so suggest the changes = below.=20 >=20 > ------------------------------ > Nine Event Definitions > ------------------------------ >=20 > vg - Value Generation > A value to appear in a claim was created >=20 > ns - Nonce Sent > A random number is generated and sent The nonce was generated and sent. >=20 > nr - Nonce Relayed > A random number is passed through another entity The nonce was relayed. LL= --Apple-Mail=_F9999741-143B-4AAC-8C42-6333E553FB77 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Mar 31, 2020, at 8:13 AM, Eric Voit (evoit) <evoit=3D40cisco.com@dmarc.ietf.org> wrote:

=E2=80=A6
(2) Are there any issues with = the names and definitions described below?


Nonces = don=E2=80=99t have to be random numbers, so suggest the changes = below. 


------------------------------
Nine Event = Definitions
------------------------------
vg - Value Generation
A value to appear in a = claim was created

ns - Nonce Sent
A random number is generated and = sent
The nonce was generated and = sent.


nr - Nonce Relayed
A random number is passed through another = entity
The nonce = was relayed.

LL= --Apple-Mail=_F9999741-143B-4AAC-8C42-6333E553FB77-- From nobody Thu Apr 2 12:05:01 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AA333A0C80 for ; Thu, 2 Apr 2020 12:04:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VFjtzl_5-yeR for ; Thu, 2 Apr 2020 12:04:58 -0700 (PDT) Received: from p3plsmtpa07-10.prod.phx3.secureserver.net (p3plsmtpa07-10.prod.phx3.secureserver.net [173.201.192.239]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC7603A0C7E for ; Thu, 2 Apr 2020 12:04:57 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id K596jHFnXurCkK597jm9Cu; Thu, 02 Apr 2020 12:04:57 -0700 X-CMAE-Analysis: v=2.3 cv=GPl27dFK c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=48vgC7mUAAAA:8 a=G8nwLPEkLw50c-uRuYEA:9 a=QEXdDO2ut3YA:10 a=ejdO0Ek8t5KIW6-wdXsA:9 a=37E51yhezimfzhS1:21 a=_W_S_7VecoQA:10 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_FB19C01D-AA4D-459E-B54C-2E7B20E7C13F" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: Date: Thu, 2 Apr 2020 12:04:56 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfPUuXMf7RjuhoCJRdflHMI85cqk0wvnUWu7fsVhb9OUqwSyockxSkkBB93CkumyxoxtiyMqFMP6LCwhKr8pp0fia4Mbyw9uKJxpaKEvDoyte5CIJ84DY PyUpyvHbPph27ZtV5uaKeDa8jplm1/Fu2D+oqQZuI1jOJBmdAxEpRSEi Archived-At: Subject: [Rats] Where are known-good references values in architecture? X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2020 19:04:59 -0000 --Apple-Mail=_FB19C01D-AA4D-459E-B54C-2E7B20E7C13F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 In the architecture diagram below, where do the known-good reference = values go into the verifier? = https://tools.ietf.org/html/draft-ietf-rats-architecture-02 only = mentions known-good references values as something the verifier = processes. The definitions of Endorsements and Appraisal Policy don=E2=80=99= t seem to include reference values. Or is it just something the verifier =E2=80=9Cknows=E2=80=9D? Seems like reference values could be things like the expected hashes of = some files, but could also be things like which versions of SW have a = vulnerability, or which versions of HW are certified. Seems an important to say where they come from as they are of critical = importance. LL ************ ************ ***************** * Endorser * * Verifier * * Relying Party * ************ * Owner * * Owner * | ************ ***************** | | | Endorsements| | | | |Appraisal | | |Policy for | | |Evidence | Appraisal | | | Policy for | | | Attestation | | | Result v v | .-----------------. | .----->| Verifier |------. | | '-----------------' | | | | | | Attestation| | | Results | | | Evidence | | | | | | v v .----------. .-----------------. | Attester | | Relying Party | '----------' '-----------------' Figure 1: Conceptual Data Flow --Apple-Mail=_FB19C01D-AA4D-459E-B54C-2E7B20E7C13F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 
In the architecture diagram =
below, where do the known-good reference values go into the verifier? =
 https://tools.ietf.org/html/draft-ietf-rats-architecture-02=
 only mentions known-good references values as something the verifier =
processes. The definitions of Endorsements and Appraisal Policy =
don=E2=80=99t seem to include reference values.

Or is it just =
something the verifier =E2=80=9Cknows=E2=80=9D?

Seems like =
reference values could be things like the expected hashes of some files, =
but could also be things like which versions of SW have a =
vulnerability, or which versions of HW are =
certified.

Seems an important to say =
where they come from as they are of critical =
importance.

LL



                 ************   ************    *****************
                 * Endorser *   * Verifier *    * Relying Party *
                 ************   *  Owner   *    *  Owner        *
                       |        ************    *****************
                       |              |                 |
           Endorsements|              |                 |
                       |              |Appraisal        |
                       |              |Policy for       |
                       |              |Evidence         | Appraisal
                       |              |                 | Policy for
                       |              |                 | Attestation
                       |              |                 |  Result
                       v              v                 |
                     .-----------------.                |
              .----->|     Verifier    |------.         |
              |      '-----------------'      |         |
              |                               |         |
              |                    Attestation|         |
              |                    Results    |         |
              | Evidence                      |         |
              |                               |         |
              |                               v         v
        .----------.                      .-----------------.
        | Attester |                      | Relying Party   |
        '----------'                      '-----------------'

                       Figure 1: Conceptual Data Flow

= --Apple-Mail=_FB19C01D-AA4D-459E-B54C-2E7B20E7C13F-- From nobody Thu Apr 2 12:08:40 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AB733A0C89 for ; Thu, 2 Apr 2020 12:08:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=OcKsOFHD; dkim=pass (1024-bit key) header.d=juniper.net header.b=dlDaCuMY Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x4KLmNIrpwRv for ; Thu, 2 Apr 2020 12:08:36 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E9D63A0C86 for ; Thu, 2 Apr 2020 12:08:36 -0700 (PDT) Received: from pps.filterd (m0108162.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 032IvRTw022450; Thu, 2 Apr 2020 12:08:35 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=yiz4/xf5o9UInSdtN3wDJ4ZQV9R25YeB4xXe7PVu0Gs=; b=OcKsOFHDBNV51N/bWhrnIl7jpQhXtgpyaKA/ILL6KJJ2BC5KhhrPQJD4j3tfsiErSjZS 17MoOgWWqvp//QHo3Jfa7SMBYZN+6sDtz4Rcu3P5AfCW8qnz+Azw128qzOFQRvwXbMzx LvAO2PqE9ct6flNFQsq3YEhx9ke9AFTOScTfzqIMMAhd2TTzXUdAWIscQRguPIZrc7aC 4xv21fmaQiPbd4jjxP6AjtGYNtp/Y8wngX3FgvzysM181N43PjvTY3rXQKBVGnDLEaXv YWiCjEJvpuoGorKXCF/C4Wfe/NEeCp2+YudoYMEcemGpzd/VBw7yUbJjl0Ii8+snYxWi lg== Received: from nam10-mw2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2104.outbound.protection.outlook.com [104.47.55.104]) by mx0b-00273201.pphosted.com with ESMTP id 3056aask3q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 02 Apr 2020 12:08:35 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=XEg3hIpRU+2xBSa9jqxnxKAllEsmE3HR2Z1rjGdagd7iDQHghJiDKDhXqsNe6xQOLb08/hfHj742y1+70SYdrAN8lIJMypRQYkpdvMJ5hPDm4ni7VcRlx7ApleO19Q4YR1IcKaqewfrqJRCMfgNOGH3Ak4Dak/uEcmNbDvQDC/JEYUr3pVOcR4Y2Z8uCqq1ybkJVOgni7oYaPAcWOcIcCTHYZz5+nRaM1Sb8jLi8fCeINCVvw68zvVml9dxJl532g6Kxg7JDiDsYZLofUC91RZCQbC+OBNLy9HvoY7tDCitwNKUae0/CwxsQE31cKaYlhjQGTDkleeW4UHAlhrwh8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yiz4/xf5o9UInSdtN3wDJ4ZQV9R25YeB4xXe7PVu0Gs=; b=Jbe/rVrM9644uwChmvqDlLGIlpQwReMevawBf91Zc6m5kDVpz8q6OGFaIYbEfMv0W6cPZmFlyi/hsXEbpCl0F3LfddT/Oj/qgiWVqkxJ/ZXoQ80bHdkSy3l8OvHQWvGdSapk0pG+bCPJ9PQflL3ZNnvIyjXiqMbMHuFi6c4jMwIO7jUankGnyL51ZqBICAMEDxJHCR3VI3TbIYCeF5VWHDjBqiLsRuIgeIzBS9ku9CFFYJiBgiahhlBjbxb5l7fF1FXIuSZl5VjhoqfASNxJN50MA2p29hmExJI+5s/mZG9YaC7LAxF3IKpWI25TQVqN56XonMqIj7dyD7Yj7TRD5Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yiz4/xf5o9UInSdtN3wDJ4ZQV9R25YeB4xXe7PVu0Gs=; b=dlDaCuMYKCoPkfwtBCiTUeWzYv+JoA9u0zZJ/6N0sTWx0Itr1DWK10y+7OygOxK4CGw+h4RWQX8RrcMqOsFszCxz49hgLODyrnHXFMnB9rQFsZkLoW2rZWeRwBYBONUxE0dOS2Jznzn7VAhxszf/LcDsrN6puNsF46NLn8zUP8Q= Received: from DM6PR05MB6889.namprd05.prod.outlook.com (2603:10b6:5:204::22) by DM6PR05MB4697.namprd05.prod.outlook.com (2603:10b6:5:18::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.12; Thu, 2 Apr 2020 19:08:32 +0000 Received: from DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::596:606f:449b:38b4]) by DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::596:606f:449b:38b4%4]) with mapi id 15.20.2878.010; Thu, 2 Apr 2020 19:08:32 +0000 From: Guy Fedorkow To: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Where are known-good references values in architecture? Thread-Index: AQHWCSGffxHP7IYwNU6aTIAiusd53ahmMZNQ Date: Thu, 2 Apr 2020 19:08:31 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-02T19:08:30.3200781Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=ebb91450-d821-4645-a245-935c7cb9d3b6; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic dlp-product: dlpe-windows dlp-version: 11.3.2.8 dlp-reaction: no-action x-originating-ip: [66.129.241.10] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: ec57966f-cfa4-4dc1-475d-08d7d7393c4a x-ms-traffictypediagnostic: DM6PR05MB4697: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0361212EA8 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR05MB6889.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(39860400002)(396003)(136003)(346002)(376002)(366004)(186003)(66556008)(52536014)(316002)(5660300002)(2906002)(110136005)(478600001)(966005)(53546011)(64756008)(66446008)(66946007)(8936002)(66476007)(7696005)(76116006)(26005)(9326002)(6506007)(81156014)(55016002)(86362001)(71200400001)(9686003)(81166006)(33656002)(8676002); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: jmP7lAyCdlaOCucczB23svQ5pObsEDn7+NoGlSRDkref9TXc/Qs56pqJWAk8egW9JuW4AtN9EbXFBSWjoTIuMzqpqv4syaix1Q6oqTeHTCsERxVtGoV3VAnb83wsxKwrdpdYzFLeGsFibp3weKNKTX+7vFumIyHN14k4H7pHoX/aN3OHd37/cX9cSU69PkrMt+FI4OQuHdBYS1ycrOs4AToYWVy8WT7m64PtMQ98ZPI4gdKC58yQsR4bt30SdHPnMKKc9RQGMmjUrDFgY7RHu5BFJ4K2OZ14lb10NVnFs+s00xL7XF+McHlLggghKwRXVAt+Gl81Wn2TuTzfbx01LJ62lwo4q3xKsPK0I1bebbyjwQa+HKt36/szpdda3PE93xuY9jBSuNSx7LdC2FkotfmaDwyynJ5auaGn0Sxb4Rtef01NZ/2ZyMiTNh90Ka6o5D9UzCl0vxb4KdWJ2ufDIBeM6mIGU3slz7y7FQya18shdFoWC9ljsKrk8z+B1vSwSwnv6I+afMAmHD/OTV7yog== x-ms-exchange-antispam-messagedata: XeVH+y97dsAg0jQs4gCFRNIlwiINVWT8aQ2khPMRBmxHZmOUuGXiq6UxcUkbLCWXQIzqumiVl1W448qXY3hMGNBwIkDoUB8zKRmv/3vKrv/38mcGd57GeNzatPyV95mNPGmvvo0KNWVftUmJMGkM5g== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR05MB68892300D820CBC601F56522BAC60DM6PR05MB6889namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: ec57966f-cfa4-4dc1-475d-08d7d7393c4a X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Apr 2020 19:08:31.9244 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: j068gdHFB5Rb560av1V1uEZVrb+odT8152lLLPZtoT2tv7Bazv81HyVS6oFvyIBpjI31Jdc5QeJp3AI7UH11pA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR05MB4697 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-02_09:2020-04-02, 2020-04-02 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 suspectscore=0 phishscore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 adultscore=0 malwarescore=0 mlxlogscore=999 clxscore=1011 impostorscore=0 mlxscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004020142 Archived-At: Subject: Re: [Rats] Where are known-good references values in architecture? X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2020 19:08:39 -0000 --_000_DM6PR05MB68892300D820CBC601F56522BAC60DM6PR05MB6889namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Laurence, There's material on known-good values in the RIV draft, under the name Re= ference Integrity Measurements /guy Juniper Business Use Only From: RATS On Behalf Of Laurence Lundblade Sent: Thursday, April 2, 2020 3:05 PM To: rats@ietf.org Subject: [Rats] Where are known-good references values in architecture? [External Email. Be cautious of content] In the architecture diagram below, where do the known-good reference values= go into the verifier? https://tools.ietf.org/html/draft-ietf-rats-archite= cture-02 only mentions known-good references values = as something the verifier processes. The definitions of Endorsements and Ap= praisal Policy don't seem to include reference values. Or is it just something the verifier "knows"? Seems like reference values could be things like the expected hashes of som= e files, but could also be things like which versions of SW have a vulnerab= ility, or which versions of HW are certified. Seems an important to say where they come from as they are of critical impo= rtance. LL ************ ************ ***************** * Endorser * * Verifier * * Relying Party * ************ * Owner * * Owner * | ************ ***************** | | | Endorsements| | | | |Appraisal | | |Policy for | | |Evidence | Appraisal | | | Policy for | | | Attestation | | | Result v v | .-----------------. | .----->| Verifier |------. | | '-----------------' | | | | | | Attestation| | | Results | | | Evidence | | | | | | v v .----------. .-----------------. | Attester | | Relying Party | '----------' '-----------------' Figure 1: Conceptual Data Flow --_000_DM6PR05MB68892300D820CBC601F56522BAC60DM6PR05MB6889namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Laurence,

  There’s material on known-good values i= n the RIV draft, under the name Reference Integrity Measurements=

/guy

 

 

 

Juniper Business Use Only

From: RATS <rats-bounces@ietf.org> O= n Behalf Of Laurence Lundblade
Sent: Thursday, April 2, 2020 3:05 PM
To: rats@ietf.org
Subject: [Rats] Where are known-good references values in architectu= re?

 

<= span style=3D"font-size:10.5pt;font-family:"Lato",sans-serif;colo= r:black">[External Email. Be cautious of content]

 

In the architecture diagram below, where do the known-g=
ood reference values go into the verifier?  https://tools.ietf.org/html/draft-ietf-rats-architecture-02 onl=
y mentions known-good references values as something the verifier processes=
. The definitions of Endorsements and Appraisal Policy don’t see=
m to include reference values.
 
Or is it just something the verifier “knows&=
#8221;?
 
Seems like reference values could be things like the ex=
pected hashes of some files, but could also be things like which versi=
ons of SW have a vulnerability, or which versions of HW are certified.
 
Seems an important to say where they come from as they =
are of critical importance.
 
LL
 
 
 
       =
;          ************ &=
nbsp; ************    *****************
           &nbs=
p;     * Endorser *   * Verifier *  =
;  * Relying Party *
           &nbs=
p;     ************   *  Owner &nbs=
p; *    *  Owner      &nb=
sp; *
           &nbs=
p;           |  =
;      ************    ************=
*****
           &nbs=
p;           |  =
;            | =
            &nb=
sp;   |
           Endorseme=
nts|            =
;  |           =
      |
           &nbs=
p;           |  =
;            |Apprai=
sal        |
           &nbs=
p;           |  =
;            |Policy=
 for       |
           &nbs=
p;           |  =
;            |Eviden=
ce         | Appraisal

           &nbs=
p;           |  =
;            | =
            &nb=
sp;   | Policy for


           &nbs=
p;           |  =
;            | =
            &nb=
sp;   | Attestation


           &nbs=
p;           |  =
;            | =
            &nb=
sp;   |  Result


           &nbs=
p;           v  =
;            v =
            &nb=
sp;   |


           &nbs=
p;         .-----------------. =
;            &n=
bsp;  |


           &nbs=
p;  .----->|     Verifier    |--=
----.         |


           &nbs=
p;  |      '-----------------'  &nb=
sp;   |         |


           &nbs=
p;  |           =
;            &n=
bsp;       |     &nb=
sp;   |


           &nbs=
p;  |           =
;         Attestation|  &=
nbsp;      |


           &nbs=
p;  |           =
;         Results   =
 |         |


           &nbs=
p;  | Evidence         &n=
bsp;            |&nb=
sp;        |


            &nb=
sp; |           =
;            &n=
bsp;       |     &nb=
sp;   |


           &nbs=
p;  |           =
;            &n=
bsp;       v     &nb=
sp;   v


        .----------.  &nb=
sp;            =
       .-----------------.


        | Attester |  &nb=
sp;            =
       | Relying Party   |


        '----------'  &nb=
sp;             =
;      '-----------------'


 


           &nbs=
p;           Figure 1: Co=
nceptual Data Flow




 
--_000_DM6PR05MB68892300D820CBC601F56522BAC60DM6PR05MB6889namp_-- From nobody Thu Apr 2 12:10:36 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C3423A0C8F for ; Thu, 2 Apr 2020 12:10:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6okaZ0jF9T8U for ; Thu, 2 Apr 2020 12:10:33 -0700 (PDT) Received: from NAM04-BN3-obe.outbound.protection.outlook.com (mail-eopbgr680132.outbound.protection.outlook.com [40.107.68.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C4493A0C8E for ; Thu, 2 Apr 2020 12:10:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NuaKq6U6B3bwDytlcpMjsdmurSeDyG2HFrjZCYIoR9wyZLUBZZNLNqqfyUmpMTO/Nwr/inQ6Dxac0OyMYqlFSs0kAqMyGnKn+GdlUoRAZN8AbG1U94ZCH00Tc9+8MiCP6vs2KHLN4UtW4FUqXTFOGhVSfiyZ9mab6PVq1hqyA20oqmdpkKi5MDc5MISELLR8xYRAglFszF+jeWO31mDDYfmrfG4oM/M95f7iRL52H60YG2Nwq05LgSA/xIaCcVlgMZ1fD67xxInQWhASQRkGCks78mkeZn6EcjFpTUzSNFNMAbiAuTbm6J1rCAPJL7O3/Y/59D73scAIKIQFSo1aSQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=S1Nq8mcNhSYWb7Hi1+eigd5xkjrfIkPm/RFf2ZStots=; b=LZLfmuqx2XIVyOTjDWODva6C5KJTFdw8y3rOx/nNKfEoUgcFCXdjBnq3IZP2lR4ygPWAAZoljuc1iWvfm0zJG2UzXkuvmRbvL5Gz2MTTg0tE+bVGn4Lpoeeg6dMpaAw4jE18RVuvrg3VJEWu+KrdJNut0OGr5AHQekG5g6T/13vSBdExqTs6ayOEg6m1aJ3L6j0I+6qyzE6dCt2olJguesvXkcGugWN0GzRzfClx1/Tg3rHGzLgn8ipm5skRTFyE5zWG+lspXYHhX9SG/Uq3/ZaQjtwO7g3etvfMf6bd6mhXe0wIohaBgKfrz284jEPf3O0QLbQPQ1vFMDm/dkEXbw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=S1Nq8mcNhSYWb7Hi1+eigd5xkjrfIkPm/RFf2ZStots=; b=jqWvH3NFXhjElRolfFZU4QSLyRYtWPs5cRUBbfkJmkNILcCPv+Wfl+WPfVNC2KcF40ly2nlw2MXkswtmgSKQYs6WgX0V1nsixM0zBY2KQWm3e74vIMYwmcXfNldov0G5HDcxC/iMN3hRiX5KoQS932gSLB4kVcdKLd1/1//Vu80= Received: from BL0PR2101MB1027.namprd21.prod.outlook.com (2603:10b6:207:30::33) by BL0PR2101MB1329.namprd21.prod.outlook.com (2603:10b6:208:92::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.2; Thu, 2 Apr 2020 19:10:31 +0000 Received: from BL0PR2101MB1027.namprd21.prod.outlook.com ([fe80::e5f4:bd2b:d304:bfc9]) by BL0PR2101MB1027.namprd21.prod.outlook.com ([fe80::e5f4:bd2b:d304:bfc9%4]) with mapi id 15.20.2878.010; Thu, 2 Apr 2020 19:10:31 +0000 From: Dave Thaler To: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Where are known-good references values in architecture? Thread-Index: AQHWCSGf1LcN/0jRUkWX1BU64ecPVahmMb6Q Date: Thu, 2 Apr 2020 19:10:31 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-originating-ip: [2601:600:9780:16f0:6893:5b01:eac2:20f6] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 7e86414b-f395-4c37-ba37-08d7d739837a x-ms-traffictypediagnostic: BL0PR2101MB1329: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0361212EA8 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR2101MB1027.namprd21.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(376002)(136003)(396003)(366004)(346002)(39860400002)(186003)(66946007)(71200400001)(316002)(76116006)(66476007)(66446008)(64756008)(66556008)(8936002)(55016002)(966005)(7696005)(9686003)(8676002)(82960400001)(8990500004)(86362001)(53546011)(81156014)(6506007)(82950400001)(10290500003)(478600001)(52536014)(110136005)(5660300002)(33656002)(2906002)(81166006); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: I7DQQ4zpE32BPSOyN7EFzpCvuq/D4KzYh6+bdxghNhry/wU4+111fiCgdryZcw/CIFbGyTzHn8heLlQNjPOGNMPDE5eUW2XOitbtdatrx0wPJRnMiAN0n/RTWnMNKQAmwQlmx+syi0gqFVv4rs6I1t1VO+8hIbU8gQCkvy/whNtF+xga3jbCedyxuQbeuw26jHWmjZDcKSw/736n6d7C0tslpw2iJnyM13lJEv4GadR9bUQ/PBro6LIy6t5EwiatL/tKNyqay4Y4AyInLSc5cXYuEN7hRDliAOI/ndvHn1hYrePxdGTMfYks4d6Hi0znp53bwp1QBcDs5V3ns3IIpWBitQlpYmH4DWr5hS+xCyQLxHXS0hOkS9KqyXxPw5/tcEKm+cSHOD/PhKSSNACO5OKOYY4/LFGORopOrJY6wskW381WJMWDwEWNw/2LIrJ8FRlThA8fbdBPTzGLe2x2J6UMnCQdu4uG3ozyrRymqUeHqmeo2dDOkx26bkzYleK5l8eXGxFcMW/vUWFs/ASaeQ== x-ms-exchange-antispam-messagedata: 9/r7fwwZlwhU8lSzRns/GceTe8cznl7XKfHzOtnpHhuq2zFPWyV6fo7mB2iHvkU1zXJCgrKrKcRHK28wTg4EoZ/6wudlPQWimhsUYuyyyXS3rCMAOp5/GT9SthWCqKhODGfiA1O2zggOKyub3I30Kil84H2lyrI8wwFd9e3gz8LOwY/Ah011GkvsEbj2wXiYIqd0wEVjxagbWt0o+WOIGQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BL0PR2101MB102719DBCDBC7312D6844121A3C60BL0PR2101MB1027_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7e86414b-f395-4c37-ba37-08d7d739837a X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Apr 2020 19:10:31.3941 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: eykRFxGNhZeeWgTP9EI8a8dKAi1kmTv1z66wMLislxGzSMiTwCzspj80uzTMR/08HxxgVEJATQJHX8t1rn63CASzAVwRxWqOnUdDwFKJMyY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR2101MB1329 Archived-At: Subject: Re: [Rats] Where are known-good references values in architecture? X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2020 19:10:35 -0000 --_000_BL0PR2101MB102719DBCDBC7312D6844121A3C60BL0PR2101MB1027_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhleSBjYW4gYmUgaW5jbHVkZWQgaW4gYW4gZW5kb3JzZW1lbnQsIG9yIHRoZXkgY2FuIGJlIHBh cnQgb2YgdGhlIGFwcHJhaXNhbCBwb2xpY3kgZm9yIGV2aWRlbmNlLg0KSSBrbm93IG9mIGJvdGgg Y2FzZXMgaW4gcmVhbCBkZXBsb3ltZW50cy4NCg0KRnJvbTogUkFUUyA8cmF0cy1ib3VuY2VzQGll dGYub3JnPiBPbiBCZWhhbGYgT2YgTGF1cmVuY2UgTHVuZGJsYWRlDQpTZW50OiBUaHVyc2RheSwg QXByaWwgMiwgMjAyMCAxMjowNSBQTQ0KVG86IHJhdHNAaWV0Zi5vcmcNClN1YmplY3Q6IFtSYXRz XSBXaGVyZSBhcmUga25vd24tZ29vZCByZWZlcmVuY2VzIHZhbHVlcyBpbiBhcmNoaXRlY3R1cmU/ DQoNCg0KSW4gdGhlIGFyY2hpdGVjdHVyZSBkaWFncmFtIGJlbG93LCB3aGVyZSBkbyB0aGUga25v d24tZ29vZCByZWZlcmVuY2UgdmFsdWVzIGdvIGludG8gdGhlIHZlcmlmaWVyPyAgaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtcmF0cy1hcmNoaXRlY3R1cmUtMDI8aHR0cHM6 Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJG JTJGdG9vbHMuaWV0Zi5vcmclMkZodG1sJTJGZHJhZnQtaWV0Zi1yYXRzLWFyY2hpdGVjdHVyZS0w MiZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3QzE0ZTJjNjMyZGRhZTQx OGFiZmMxMDhkN2Q3MzhjMGFjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0Mx JTdDMCU3QzYzNzIxNDUxMTA2MjU5MDYwMSZzZGF0YT1yQ3lNdjFvajdHb3c4b1ZWSSUyRm9rdDVJ QnJnckdKRlVsaDdaT003eE1VOUUlM0QmcmVzZXJ2ZWQ9MD4gb25seSBtZW50aW9ucyBrbm93bi1n b29kIHJlZmVyZW5jZXMgdmFsdWVzIGFzIHNvbWV0aGluZyB0aGUgdmVyaWZpZXIgcHJvY2Vzc2Vz LiBUaGUgZGVmaW5pdGlvbnMgb2YgRW5kb3JzZW1lbnRzIGFuZCBBcHByYWlzYWwgUG9saWN5IGRv buKAmXQgc2VlbSB0byBpbmNsdWRlIHJlZmVyZW5jZSB2YWx1ZXMuDQoNCg0KDQpPciBpcyBpdCBq dXN0IHNvbWV0aGluZyB0aGUgdmVyaWZpZXIg4oCca25vd3PigJ0/DQoNCg0KDQpTZWVtcyBsaWtl IHJlZmVyZW5jZSB2YWx1ZXMgY291bGQgYmUgdGhpbmdzIGxpa2UgdGhlIGV4cGVjdGVkIGhhc2hl cyBvZiBzb21lIGZpbGVzLCBidXQgY291bGQgYWxzbyBiZSB0aGluZ3MgbGlrZSB3aGljaCB2ZXJz aW9ucyBvZiBTVyBoYXZlIGEgdnVsbmVyYWJpbGl0eSwgb3Igd2hpY2ggdmVyc2lvbnMgb2YgSFcg YXJlIGNlcnRpZmllZC4NCg0KDQoNClNlZW1zIGFuIGltcG9ydGFudCB0byBzYXkgd2hlcmUgdGhl eSBjb21lIGZyb20gYXMgdGhleSBhcmUgb2YgY3JpdGljYWwgaW1wb3J0YW5jZS4NCg0KDQoNCkxM DQoNCg0KDQoNCg0KDQoNCiAgICAgICAgICAgICAgICAgKioqKioqKioqKioqICAgKioqKioqKioq KioqICAgICoqKioqKioqKioqKioqKioqDQoNCiAgICAgICAgICAgICAgICAgKiBFbmRvcnNlciAq ICAgKiBWZXJpZmllciAqICAgICogUmVseWluZyBQYXJ0eSAqDQoNCiAgICAgICAgICAgICAgICAg KioqKioqKioqKioqICAgKiAgT3duZXIgICAqICAgICogIE93bmVyICAgICAgICAqDQoNCiAgICAg ICAgICAgICAgICAgICAgICAgfCAgICAgICAgKioqKioqKioqKioqICAgICoqKioqKioqKioqKioq KioqDQoNCiAgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgfCAgICAgICAgICAg ICAgICAgfA0KDQogICAgICAgICAgIEVuZG9yc2VtZW50c3wgICAgICAgICAgICAgIHwgICAgICAg ICAgICAgICAgIHwNCg0KICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAgICB8QXBw cmFpc2FsICAgICAgICB8DQoNCiAgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAg fFBvbGljeSBmb3IgICAgICAgfA0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAg ICAgIHxFdmlkZW5jZSAgICAgICAgIHwgQXBwcmFpc2FsDQoNCiAgICAgICAgICAgICAgICAgICAg ICAgfCAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgfCBQb2xpY3kgZm9yDQoNCiAgICAg ICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgfCBBdHRl c3RhdGlvbg0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgIHwgICAgICAg ICAgICAgICAgIHwgIFJlc3VsdA0KDQogICAgICAgICAgICAgICAgICAgICAgIHYgICAgICAgICAg ICAgIHYgICAgICAgICAgICAgICAgIHwNCg0KICAgICAgICAgICAgICAgICAgICAgLi0tLS0tLS0t LS0tLS0tLS0tLiAgICAgICAgICAgICAgICB8DQoNCiAgICAgICAgICAgICAgLi0tLS0tPnwgICAg IFZlcmlmaWVyICAgIHwtLS0tLS0uICAgICAgICAgfA0KDQogICAgICAgICAgICAgIHwgICAgICAn LS0tLS0tLS0tLS0tLS0tLS0nICAgICAgfCAgICAgICAgIHwNCg0KICAgICAgICAgICAgICB8ICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICB8DQoNCiAgICAgICAgICAgICAg fCAgICAgICAgICAgICAgICAgICAgQXR0ZXN0YXRpb258ICAgICAgICAgfA0KDQogICAgICAgICAg ICAgIHwgICAgICAgICAgICAgICAgICAgIFJlc3VsdHMgICAgfCAgICAgICAgIHwNCg0KICAgICAg ICAgICAgICB8IEV2aWRlbmNlICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICB8DQoNCiAg ICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgfA0K DQogICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdiAgICAgICAg IHYNCg0KICAgICAgICAuLS0tLS0tLS0tLS4gICAgICAgICAgICAgICAgICAgICAgLi0tLS0tLS0t LS0tLS0tLS0tLg0KDQogICAgICAgIHwgQXR0ZXN0ZXIgfCAgICAgICAgICAgICAgICAgICAgICB8 IFJlbHlpbmcgUGFydHkgICB8DQoNCiAgICAgICAgJy0tLS0tLS0tLS0nICAgICAgICAgICAgICAg ICAgICAgICctLS0tLS0tLS0tLS0tLS0tLScNCg0KDQoNCiAgICAgICAgICAgICAgICAgICAgICAg RmlndXJlIDE6IENvbmNlcHR1YWwgRGF0YSBGbG93DQoNCg== --_000_BL0PR2101MB102719DBCDBC7312D6844121A3C60BL0PR2101MB1027_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6 IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTou MDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsN Cglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlm O30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJl Zm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGlu azoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uRW1h aWxTdHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQN Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFn ZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGlu IDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0K LS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpl eHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6 ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0t Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5UaGV5IGNhbiBiZSBpbmNsdWRlZCBpbiBhbiBlbmRv cnNlbWVudCwgb3IgdGhleSBjYW4gYmUgcGFydCBvZiB0aGUgYXBwcmFpc2FsIHBvbGljeSBmb3Ig ZXZpZGVuY2UuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkga25vdyBvZiBib3RoIGNhc2VzIGluIHJlYWwg ZGVwbG95bWVudHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUx RTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBS QVRTICZsdDtyYXRzLWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7DQo8Yj5PbiBCZWhhbGYgT2YgPC9iPkxh dXJlbmNlIEx1bmRibGFkZTxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwgQXByaWwgMiwgMjAy MCAxMjowNSBQTTxicj4NCjxiPlRvOjwvYj4gcmF0c0BpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6 PC9iPiBbUmF0c10gV2hlcmUgYXJlIGtub3duLWdvb2QgcmVmZXJlbmNlcyB2YWx1ZXMgaW4gYXJj aGl0ZWN0dXJlPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwcmU+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JbiB0aGUgYXJjaGl0 ZWN0dXJlIGRpYWdyYW0gYmVsb3csIHdoZXJlIGRvIHRoZSBrbm93bi1nb29kIHJlZmVyZW5jZSB2 YWx1ZXMgZ28gaW50byB0aGUgdmVyaWZpZXI/ICZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vbmFtMDYu c2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnRvb2xz LmlldGYub3JnJTJGaHRtbCUyRmRyYWZ0LWlldGYtcmF0cy1hcmNoaXRlY3R1cmUtMDImYW1wO2Rh dGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDMTRlMmM2MzJkZGFlNDE4YWJm YzEwOGQ3ZDczOGMwYWMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0Mw JTdDNjM3MjE0NTExMDYyNTkwNjAxJmFtcDtzZGF0YT1yQ3lNdjFvajdHb3c4b1ZWSSUyRm9rdDVJ QnJnckdKRlVsaDdaT003eE1VOUUlM0QmYW1wO3Jlc2VydmVkPTAiPmh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXJhdHMtYXJjaGl0ZWN0dXJlLTAyPC9hPiBvbmx5IG1lbnRp b25zIGtub3duLWdvb2QgcmVmZXJlbmNlcyB2YWx1ZXMgYXMgc29tZXRoaW5nIHRoZSB2ZXJpZmll ciBwcm9jZXNzZXMuIFRoZSBkZWZpbml0aW9ucyBvZiBFbmRvcnNlbWVudHMgYW5kJm5ic3A7QXBw cmFpc2FsIFBvbGljeSBkb27igJl0IHNlZW0gdG8gaW5jbHVkZSByZWZlcmVuY2UgdmFsdWVzLjwv c3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48 bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi Pk9yIGlzIGl0IGp1c3Qgc29tZXRoaW5nIHRoZSB2ZXJpZmllciZuYnNwO+KAnGtub3dz4oCdPzwv c3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48 bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PlNlZW1zIGxpa2UgcmVmZXJlbmNlIHZhbHVlcyBjb3VsZCBiZSB0aGluZ3MgbGlrZSB0aGUgZXhw ZWN0ZWQgaGFzaGVzIG9mIHNvbWUgZmlsZXMsIGJ1dCBjb3VsZCBhbHNvIGJlIHRoaW5ncyBsaWtl Jm5ic3A7d2hpY2ggdmVyc2lvbnMgb2YgU1cgaGF2ZSBhIHZ1bG5lcmFiaWxpdHksIG9yIHdoaWNo IHZlcnNpb25zIG9mIEhXIGFyZSBjZXJ0aWZpZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8 cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+U2VlbXMgYW4gaW1wb3J0YW50IHRvIHNh eSB3aGVyZSB0aGV5IGNvbWUgZnJvbSBhcyB0aGV5IGFyZSBvZiBjcml0aWNhbCBpbXBvcnRhbmNl Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdl Ij48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdl Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPkxMPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6 IHBhZ2UiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6 IHBhZ2UiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6 IHBhZ2UiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6 IHBhZ2UiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAqKioqKioqKioq KiombmJzcDsmbmJzcDsgKioqKioqKioqKioqJm5ic3A7Jm5ic3A7Jm5ic3A7ICoqKioqKioqKioq KioqKioqPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7ICogRW5kb3JzZXIgKiZuYnNwOyZuYnNwOyAqIFZlcmlmaWVyICombmJzcDsm bmJzcDsgJm5ic3A7KiBSZWx5aW5nIFBhcnR5ICo8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgKioqKioqKioqKioqJm5ic3A7Jm5i c3A7ICombmJzcDsgT3duZXImbmJzcDsmbmJzcDsgKiZuYnNwOyZuYnNwOyZuYnNwOyAqJm5ic3A7 IE93bmVyJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICo8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAqKioqKioqKioqKiombmJzcDsmbmJzcDsmbmJzcDsgKioq KioqKioqKioqKioqKio8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg fCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgRW5kb3JzZW1lbnRzfCZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3w8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyB8QXBwcmFpc2FsJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB8UG9saWN5IGZvciZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgfEV2aWRlbmNlJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IHwgQXBwcmFpc2FsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyB8IFBvbGljeSBmb3I8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwgQXR0ZXN0YXRpb248bzpwPjwvbzpwPjwvcHJlPg0K PHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsgUmVzdWx0PG86cD48L286cD48 L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHYmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IC4tLS0tLS0tLS0tLS0tLS0tLS4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJm5i c3A7Jm5ic3A7fDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAu LS0tLS0mZ3Q7fCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBWZXJpZmllciZuYnNwOyZuYnNwOyZu YnNwOyB8LS0tLS0tLiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJy0tLS0tLS0tLS0tLS0tLS0tJyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBB dHRlc3RhdGlvbnwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO1Jlc3Vs dHMmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IHwgRXZpZGVuY2UmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgdiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyB2PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IC4tLS0tLS0tLS0tLiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAuLS0tLS0tLS0tLS0t LS0tLS0uPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IHwgQXR0ZXN0ZXIgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8IFJlbHlpbmcgUGFydHkm bmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAnLS0tLS0tLS0tLScmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJy0tLS0tLS0t LS0tLS0tLS0tJzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBGaWd1cmUgMTogQ29uY2VwdHVhbCBEYXRhIEZsb3c8 bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_BL0PR2101MB102719DBCDBC7312D6844121A3C60BL0PR2101MB1027_-- From nobody Thu Apr 2 12:11:42 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F3963A0C9A for ; Thu, 2 Apr 2020 12:11:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qKmJzzqEke_a for ; Thu, 2 Apr 2020 12:11:39 -0700 (PDT) Received: from NAM12-DM6-obe.outbound.protection.outlook.com (mail-dm6nam12on20726.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe59::726]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DAF03A0C94 for ; Thu, 2 Apr 2020 12:11:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZGok+EzVIFfsCLYOAmcecB+GMHjMIMyFNpxcU5PJeyHrLJnFyzGgqSyDh0HAlyqNDpuTP2CWCtf4Lx0BElFHoYAbH97j0Jv4ngt0j3y6orFjqgm3rL8o+qISfIlpmSeyLfegEutEE4iodP48MVHMjneFPrlMKVrQZdLobkMzMPMvFmwJpX6GUbsUtsIzXJJIgSbjzsy1Y7tICHqtOdOZuNjARYtQYmk2ZksX1ayAI+m1R2Oui1JfV1Bn57tW2IdjwzJhPD/mycXXAfh7EAlXPO4qYgxvmXZSqk8hOU1E0qB49X6IA7XgdVU5x+lwLvOepuymjYRgoLLayTW1sUgUjw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lkivbws8f+Ud/75I8tmOleGFTpOH3bKLy4Kn4b9QtX4=; b=d2nQpu+uVf4KwuIOjlwOpwWVYkRkLUlBQGXpT1tj1UzViSoq6mPUDLSBBzxLPoyaeJydOU4WiAVSjMIKZA+5Up7lb+Bi3vqM5bfLMbs96qzUJ0D2vv9KABPG+NFHiWHj4tKn1iqpMkAofBY25bSJeiEnTsIx2soe6GU8crZaxpox+OLqNArTWpGWiHDUGzxGcorHzelLwpuBiGLwh2xm3Elx3Bn7cNegERjtNkUnG4HC+RKX0Du2msAOmvWzNtpFRC5Vqa0laQCMYRAb2cZI1rSiJb1Cny57HjWV40gSKZjJlCJeT2aUtrMRZO5H6UD5zB7Sr7ydKzSyMvfNTY8z0w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lkivbws8f+Ud/75I8tmOleGFTpOH3bKLy4Kn4b9QtX4=; b=PEbPrE0DA6ZMjIi7zT8slw12u0eHDCIP78q6utcNtja2GCYH+N4w8SKT90eenmff8qI/LhQjAv6cpoaYJZOXFyt0jOA4FHNp0AM5LyJ+6UbFHhn94j+R7JQAX1Y1f1wUKDPOEyupYrrz0DDrNq+sNht4+ZtnJOBXCLFVW08poSk= Received: from BL0PR2101MB1027.namprd21.prod.outlook.com (2603:10b6:207:30::33) by BL0PR2101MB1331.namprd21.prod.outlook.com (2603:10b6:208:92::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.2; Thu, 2 Apr 2020 19:11:37 +0000 Received: from BL0PR2101MB1027.namprd21.prod.outlook.com ([fe80::e5f4:bd2b:d304:bfc9]) by BL0PR2101MB1027.namprd21.prod.outlook.com ([fe80::e5f4:bd2b:d304:bfc9%4]) with mapi id 15.20.2878.010; Thu, 2 Apr 2020 19:11:37 +0000 From: Dave Thaler To: Guy Fedorkow , Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Where are known-good references values in architecture? Thread-Index: AQHWCSGf1LcN/0jRUkWX1BU64ecPVahmMe+AgAAAmdA= Date: Thu, 2 Apr 2020 19:11:36 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-originating-ip: [2601:600:9780:16f0:6893:5b01:eac2:20f6] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 5566459f-62f0-475a-0fc3-08d7d739aaaf x-ms-traffictypediagnostic: BL0PR2101MB1331: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0361212EA8 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR2101MB1027.namprd21.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(376002)(346002)(39860400002)(396003)(136003)(366004)(82960400001)(82950400001)(52536014)(6506007)(2906002)(316002)(7696005)(81156014)(186003)(71200400001)(110136005)(5660300002)(53546011)(478600001)(81166006)(10290500003)(8676002)(8936002)(966005)(33656002)(9686003)(86362001)(8990500004)(66556008)(66946007)(66476007)(66446008)(76116006)(55016002)(64756008); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: MQ5n8z6xPk9apDNY4PjRdRhquDYjhJ/YTzb5DglDiWdHd4HV0JUif8ZkMfG2CmoX7nG4I7ECf731K6bdvoh9fLKm2Lp/yAsFkg3HQGr36vP3OcpPj8/HMz8VGTgEyj9V9W5E4kTfiQYtC5d+6ZCqKoF8CcjPZHYuMo5Xz6Ks9R+Yd3zPNRlr6N+cA5dc5qOS8jIDru+nApHC0kzTVXxgKvXfNzlsdo2+GnXlWANIcu96pirIKfIBdbDFa98+IePg62kuw/6z5m1cBl9iKQq78toVfFviSk7YKFw2aQK+p+EFl0e7SFFFbfYbXPU5tY3Noz9c8v2JfGY881bv3QfXj/dvSfuOmq7o6y0M7NVw94jjrObp31RGjMtsrFVYq61/eHg+i8J88WnTkIN7RJRDV0/0OLXEeBHUy2Z7eeXAE2vi3VvgS+iiuSye+tbNXAEuKhcxTIGsyPSmoMlCWVtkdWbew4/k/VrfbVxn01474ugKyQ5sz4ZFDqtgjrm5NqYU9X/WgeR1+DN6npjPO9+D5Q== x-ms-exchange-antispam-messagedata: nu6eOpzr5twD+d9uI8fuFjnTzhs1KdNC3Gs3i0mvK4vTxrdXNNyJ9Twln/H7miPdZMD+/ZS3jIPNrITXkw3nU749hOSbmg60zzH53QovT9iU1w1/x+RsAi6q5h3jXd0ANQyDn+x1EtR/hRxVXZ21yvgmCEqbzlDQyc70ExPHtfhzZ0fTA4G26akLqgljJDae9hSJwLtMRJHpVp9WebmwhQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BL0PR2101MB102735358A0C14E83EC1F263A3C60BL0PR2101MB1027_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5566459f-62f0-475a-0fc3-08d7d739aaaf X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Apr 2020 19:11:37.1582 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: AxLmWCEtNiZGRUmmr2SmNAk2UaVA3F0Cov4NwWVaQw6arVoG5n2HWeDmbc69BeJbP4NFXKMRbnTGyNz5XNop+mW4wfodvMs6Eqp+P4D2XjE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR2101MB1331 Archived-At: Subject: Re: [Rats] Where are known-good references values in architecture? X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2020 19:11:41 -0000 --_000_BL0PR2101MB102735358A0C14E83EC1F263A3C60BL0PR2101MB1027_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable FYI, "known-good reference values" are just an example, or part of what mig= ht be used in appraisal. I've pointed out in earlier threads on this list why "known good values" is= pretty primitive and not flexible enough for many real world scenarios. From: RATS On Behalf Of Guy Fedorkow Sent: Thursday, April 2, 2020 12:09 PM To: Laurence Lundblade ; rats@ietf.org Subject: Re: [Rats] Where are known-good references values in architecture? Hi Laurence, There's material on known-good values in the RIV draft, under the name Re= ference Integrity Measurements /guy Juniper Business Use Only From: RATS > On Behalf = Of Laurence Lundblade Sent: Thursday, April 2, 2020 3:05 PM To: rats@ietf.org Subject: [Rats] Where are known-good references values in architecture? [External Email. Be cautious of content] In the architecture diagram below, where do the known-good reference values= go into the verifier? https://tools.ietf.org/html/draft-ietf-rats-archite= cture-02 only mentions known-good references values as something= the verifier processes.. The definitions of Endorsements and Appraisal Pol= icy don't seem to include reference values. Or is it just something the verifier "knows"? Seems like reference values could be things like the expected hashes of som= e files, but could also be things like which versions of SW have a vulnerab= ility, or which versions of HW are certified. Seems an important to say where they come from as they are of critical impo= rtance. LL ************ ************ ***************** * Endorser * * Verifier * * Relying Party * ************ * Owner * * Owner * | ************ ***************** | | | Endorsements| | | | |Appraisal | | |Policy for | | |Evidence | Appraisal | | | Policy for | | | Attestation | | | Result v v | .-----------------. | .----->| Verifier |------. | | '-----------------' | | | | | | Attestation| | | Results | | | Evidence | | | | | | v v .----------. .-----------------. | Attester | | Relying Party | '----------' '-----------------' Figure 1: Conceptual Data Flow --_000_BL0PR2101MB102735358A0C14E83EC1F263A3C60BL0PR2101MB1027_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

FYI, “known-good= reference values” are just an example, or part of what might be used in appraisal.

I’ve pointed out= in earlier threads on this list why “known good values” is pre= tty primitive and not

flexible enough for ma= ny real world scenarios.

 

From: RATS <rats-bounces@ietf.org> O= n Behalf Of Guy Fedorkow
Sent: Thursday, April 2, 2020 12:09 PM
To: Laurence Lundblade <lgl@island-resort.com>; rats@ietf.org<= br> Subject: Re: [Rats] Where are known-good references values in archit= ecture?

 

Hi Laurence,

  There’s material on known-good values i= n the RIV draft, under the name Reference Integrity Measurements=

/guy

 

 

 

Juniper Business Use Only

From: RATS <rats-bounces@ietf.org> On Behalf Of Laurence Lundblade
Sent: Thursday, April 2, 2020 3:05 PM
To: rats@ietf.org
Subject: [Rats] Where are known-good references values in architectu= re?

 

<= span style=3D"font-size:10.5pt;font-family:Lato;color:black">[External Emai= l. Be cautious of content]

 

In the architecture diagram below, where do the known-g=
ood reference values go into the verifier?  https://tools.ietf.org/html/draft-ietf-rats-architecture-02 onl=
y mentions known-good references values as something the verifier processes=
.. The definitions of Endorsements and Appraisal Policy don’t se=
em to include reference values.
 
Or is it just something the verifier “knows&=
#8221;?
 
Seems like reference values could be things like the ex=
pected hashes of some files, but could also be things like which versi=
ons of SW have a vulnerability, or which versions of HW are certified.
 
Seems an important to say where they come from as they =
are of critical importance.
 
LL
 
 
 
       =
;          ************ &=
nbsp; ************    *****************
           &nbs=
p;     * Endorser *   * Verifier *  =
;  * Relying Party *
           &nbs=
p;     ************   *  Owner &nbs=
p; *    *  Owner      &nb=
sp; *
           &nbs=
p;           |  =
;      ************    ************=
*****
           &nbs=
p;           |  =
;            | =
            &nb=
sp;   |
           Endorseme=
nts|            =
;  |           =
      |
           &nbs=
p;           |  =
;            |Apprai=
sal        |
           &nbs=
p;           |  =
;            |Policy=
 for       |
           &nbs=
p;           |  =
;            |Eviden=
ce         | Appraisal

           &nbs=
p;           |  =
;            | =
            &nb=
sp;   | Policy for


           &nbs=
p;           |  =
;            | =
            &nb=
sp;   | Attestation


           &nbs=
p;           |  =
;            | =
            &nb=
sp;   |  Result


           &nbs=
p;           v  =
;            v =
            &nb=
sp;   |


           &nbs=
p;         .-----------------. =
;            &n=
bsp;  |


           &nbs=
p;  .----->|     Verifier    |--=
----.         |


           &nbs=
p;  |      '-----------------'  &nb=
sp;   |         |


           &nbs=
p;  |           =
;            &n=
bsp;       |     &nb=
sp;   |


           &nbs=
p;  |           =
;         Attestation|  &=
nbsp;      |


           &nbs=
p;  |           =
;         Results   =
 |         |


           &nbs=
p;  | Evidence         &n=
bsp;            |&nb=
sp;        |


            &nb=
sp; |           =
;            &n=
bsp;       |     &nb=
sp;   |


           &nbs=
p;  |           =
;            &n=
bsp;       v     &nb=
sp;   v


        .----------.  &nb=
sp;            =
       .-----------------.


        | Attester |  &nb=
sp;            =
       | Relying Party   |


        '----------'  &nb=
sp;             =
;      '-----------------'


 


           &nbs=
p;           Figure 1: Co=
nceptual Data Flow




 
--_000_BL0PR2101MB102735358A0C14E83EC1F263A3C60BL0PR2101MB1027_-- From nobody Thu Apr 2 12:22:12 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3440F3A0FDE for ; Thu, 2 Apr 2020 12:22:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.499 X-Spam-Level: X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URI_NOVOWEL=0.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=iYat/yaJ; dkim=pass (1024-bit key) header.d=juniper.net header.b=aIhjRlnM Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2D9BLgDNs9YH for ; Thu, 2 Apr 2020 12:22:07 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46B163A0FDB for ; Thu, 2 Apr 2020 12:22:07 -0700 (PDT) Received: from pps.filterd (m0108163.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 032JHrTs006247; Thu, 2 Apr 2020 12:22:05 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=hYKUweQLyfBQ/UluyJkIRcbNEJsuj6e0ri5qLaTHDqg=; b=iYat/yaJ1JlrFOFkRdLR8C3UGim/IqWIuCVaSh2+Qt3MlFaB8lT48m3tFXYeDoa6H+Br CT7yMPgvJopIh28CSmLRxwfWmcSIzHJu4gtc7cNIlnR46vpXtgpxr1F7WGo50Gvmi8BU EuxAslwubepx4ibZhKuTXBSEjCJB4jPiZaWW71FRrDGXQkxl3g22k47+F3vmoHlF0Zbw XyuJ627PMEhRn//zAcH7iki8zQDJjGEHTkg0FgnQwtzZ1Qxlepg0+8maFoWyDDpath0X 7C5CCAR4cPL7/7lzBWpgnFhzlntukEZvR+7esF3FzUPMB2IgluiGFffGsy7EKG63/Mwm MA== Received: from nam02-sn1-obe.outbound.protection.outlook.com (mail-sn1nam02lp2052.outbound.protection.outlook.com [104.47.36.52]) by mx0b-00273201.pphosted.com with ESMTP id 304ya2j91a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 02 Apr 2020 12:22:05 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Qyrwz1zoyhHs0mKFzoOMqEw+HsFIuCMVarTN8xVIAFY2A6UnqLDHn7+XB0lPckWtBST9GvgK4h/wJJiJ4z7NmqcAEOFHyk3WZAFJSw4P4ek9JL6R94y4l961t57huzM2PT+25sWmTzKQ+C1TkrUrSU7wFRUytZXa4V+fYyNN4tsVqc0vXAKcJFIpT1WKzfmW4P3f0lIxggybF6/0hufSXal/5mpUDhXPZNC2kyLSu+VJqy6nFTtJIsxwcWJXaAcuRtZmAwPVjMl7QtJ60uPWzoBNzGrTrKu7W6HUJ5S/Dmy//jSi1fRTcZY7B4kT3UAdIYtxwhd9x+xoUqDwWNRwlg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hYKUweQLyfBQ/UluyJkIRcbNEJsuj6e0ri5qLaTHDqg=; b=hfqrZLoDVgvg9tu+BiatQ/+FcduG87cOlNYjcPiqAng5yCFl79oCE9eSQ8P6MQXW6mxAPFgkKq928ih3ejskD/WaY6NaZC6iN07yBSDw2MdSBt1aJ+UgUQKfh/+pz8fTJVrIsZkyItsrgIlqsjXEaJPE9755Ij7rJlAa01hYydxZstT4wN4lnsxw77X4LPwGkld6hYUOzh6E6ooNs09wn1RqryniSWKmmKSJ6SZRiRhINPo3FFt7l1uxSFgSJZJfwtMQhGUO2zm/CvotvGNlxQ9puRO0120Eoa335pTxRk+VkrDbihVwWhrB+y792wxLD64tK5+qrWarsBpy2qs2mw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hYKUweQLyfBQ/UluyJkIRcbNEJsuj6e0ri5qLaTHDqg=; b=aIhjRlnMjch9dUQrBcBhu0D7p8ZpZogCifG2c8lMBEr4KwSsaUvIqBer0gAYZG7KfFH76DCefYn6XCTmOZ/4K/JZl8TkpYaoCjxObWceWX79lqCnwWKUNzql8PYEwgGdYah7HPDHRnFPT6+9DY0FReb5iqICR5eWh7CQxBZg/4Q= Received: from DM6PR05MB6889.namprd05.prod.outlook.com (2603:10b6:5:204::22) by DM6PR05MB5994.namprd05.prod.outlook.com (2603:10b6:5:3a::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.11; Thu, 2 Apr 2020 19:22:03 +0000 Received: from DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::596:606f:449b:38b4]) by DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::596:606f:449b:38b4%4]) with mapi id 15.20.2878.010; Thu, 2 Apr 2020 19:22:03 +0000 From: Guy Fedorkow To: Dave Thaler CC: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Where are known-good references values in architecture? Thread-Index: AQHWCSGffxHP7IYwNU6aTIAiusd53ahmMZNQgAABOACAAAIEEA== Date: Thu, 2 Apr 2020 19:22:03 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-02T19:22:01.8454894Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=e44e8d52-2a7f-4fee-9f13-1bf96df41631; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic dlp-product: dlpe-windows dlp-version: 11.3.2.8 dlp-reaction: no-action x-originating-ip: [66.129.241.10] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 24ae7d49-4ee8-41b9-1a95-08d7d73b2002 x-ms-traffictypediagnostic: DM6PR05MB5994: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0361212EA8 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR05MB6889.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(136003)(39860400002)(366004)(396003)(346002)(376002)(71200400001)(9686003)(316002)(4326008)(81156014)(478600001)(81166006)(86362001)(55016002)(66476007)(5660300002)(8936002)(33656002)(26005)(6506007)(8676002)(64756008)(66556008)(54906003)(52536014)(53546011)(66946007)(186003)(7696005)(966005)(76116006)(2906002)(66446008); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: JcUk9adshHuxq3/+ZxFOjMvrh1ZVbB5Pp646UCM57aK5Csvy6R99ZEPCTwx3bN/NAQy+yry9EWySYxw6KJZ1vWXBTPfmN+drDld1Lg8jaNuxwQ5Tj/39aZ0vCzdZqAhqArdgP+2xHKYnEfT/N8hV60bs70esaI0zOQy8d4+P/wOAdIUotXdNGfpKY9I1d+mIup2cwriHTyhHKoyY142mOQ3q2NdIU6WKeP6QZamNe1MmEMsABU9dNOSW8BcJXDIXoEoD8XUO4gZqHsPVMqHsCcIb2/BjRk7fOe5PHFE9q9FjA72vLrTwfn43lg/AcnD0QO8fmhOWy/e+jEIWswUFguoqGs7DfcykZxiS0iR01HmPVICtGZDl9NwQVqwknjLr8m3MmcLqlHJmDqpMrC76RdyJOi3Cn0vPGWQd84i+fnTTQu8j/pgq/qtU1nywkZbTrxgBMS2HjNjwYNHGNUU+C8lu05Xo0JqBnNoI4ovOQY5obocMVQttmLMpvdmO95+O0WRCFrcZilNC2g97e49DhA== x-ms-exchange-antispam-messagedata: aIE9lr5u2ndUY/oFpawvaEpw05TjH5tbc0Ow3vY54olGv16449RnmqONzRU2BXba5mh953SmGXWA4XqoDrqhWkWd81bWREv4expJd5q5eAwYkAEh6w51MtF55cTurDTGlPPOXcF62Q2NCdSAi9nzDQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR05MB6889FE7E900737A234E222B0BAC60DM6PR05MB6889namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: 24ae7d49-4ee8-41b9-1a95-08d7d73b2002 X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Apr 2020 19:22:03.5016 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: eW3sQq7P3SqZXziaW+VmQlilgKNNXvdoJCyQfKYv1m3RN6UieKng9QGh7IlhWXxvwNeYrRziZdYhweTH3g0J+g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR05MB5994 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-02_09:2020-04-02, 2020-04-02 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 spamscore=0 mlxscore=0 malwarescore=0 priorityscore=1501 lowpriorityscore=0 adultscore=0 clxscore=1011 impostorscore=0 suspectscore=0 bulkscore=0 mlxlogscore=999 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004020143 Archived-At: Subject: Re: [Rats] Where are known-good references values in architecture? X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2020 19:22:09 -0000 --_000_DM6PR05MB6889FE7E900737A234E222B0BAC60DM6PR05MB6889namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Dave, You're right, the simple term "known good values" hides a very complex tr= ip through policies and software release strategies, even in what looks lik= e a constrained environment like TPM attestation. I think NIST has proposed helpful extensions to the ISO SWID standard tha= t takes a start at the problem. /guy Juniper Business Use Only From: Dave Thaler Sent: Thursday, April 2, 2020 3:12 PM To: Guy Fedorkow ; Laurence Lundblade ; rats@ietf.org Subject: RE: [Rats] Where are known-good references values in architecture? [External Email. Be cautious of content] FYI, "known-good reference values" are just an example, or part of what mig= ht be used in appraisal. I've pointed out in earlier threads on this list why "known good values" is= pretty primitive and not flexible enough for many real world scenarios. From: RATS > On Behalf = Of Guy Fedorkow Sent: Thursday, April 2, 2020 12:09 PM To: Laurence Lundblade = >; rats@ietf.org Subject: Re: [Rats] Where are known-good references values in architecture? Hi Laurence, There's material on known-good values in the RIV draft, under the name Re= ference Integrity Measurements /guy Juniper Business Use Only From: RATS > On Behalf = Of Laurence Lundblade Sent: Thursday, April 2, 2020 3:05 PM To: rats@ietf.org Subject: [Rats] Where are known-good references values in architecture? [External Email. Be cautious of content] In the architecture diagram below, where do the known-good reference values= go into the verifier? https://tools.ietf.org/html/draft-ietf-rats-archite= cture-02 only mentions known-good references values as something the ver= ifier processes... The definitions of Endorsements and Appraisal Policy don= 't seem to include reference values. Or is it just something the verifier "knows"? Seems like reference values could be things like the expected hashes of som= e files, but could also be things like which versions of SW have a vulnerab= ility, or which versions of HW are certified. Seems an important to say where they come from as they are of critical impo= rtance. LL ************ ************ ***************** * Endorser * * Verifier * * Relying Party * ************ * Owner * * Owner * | ************ ***************** | | | Endorsements| | | | |Appraisal | | |Policy for | | |Evidence | Appraisal | | | Policy for | | | Attestation | | | Result v v | .-----------------. | .----->| Verifier |------. | | '-----------------' | | | | | | Attestation| | | Results | | | Evidence | | | | | | v v .----------. .-----------------. | Attester | | Relying Party | '----------' '-----------------' Figure 1: Conceptual Data Flow --_000_DM6PR05MB6889FE7E900737A234E222B0BAC60DM6PR05MB6889namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Dave,

  You’re right, the simple term “kn= own good values” hides a very complex trip through policies and softw= are release strategies, even in what looks like a constrained environment l= ike TPM attestation.

  I think NIST has proposed helpful extensions = to the ISO SWID standard that takes a start at the problem.

/guy

 

 

 

Juniper Business Use Only

From: Dave Thaler <dthaler=3D40microsoft.c= om@dmarc.ietf.org>
Sent: Thursday, April 2, 2020 3:12 PM
To: Guy Fedorkow <gfedorkow@juniper.net>; Laurence Lundblade &= lt;lgl@island-resort.com>; rats@ietf.org
Subject: RE: [Rats] Where are known-good references values in archit= ecture?

 

<= span style=3D"font-size:10.5pt;font-family:"Lato",sans-serif;colo= r:black">[External Email. Be cautious of content]

 

FYI, “known-good= reference values” are just an example, or part of what might be used in appraisal.

I’ve pointed out= in earlier threads on this list why “known good values” is pre= tty primitive and not

flexible enough for ma= ny real world scenarios.

 

From: RATS <rats-bounces@ietf.org> On Behalf Of Guy Fedorkow
Sent: Thursday, April 2, 2020 12:09 PM
To: Laurence Lundblade <= lgl@island-resort.com>; rats@ietf.org
Subject: Re: [Rats] Where are known-good references values in archit= ecture?

 

Hi Laurence,

  There’s material on known-good values i= n the RIV draft, under the name Reference Integrity Measurements=

/guy

 

 

 

Juniper Business Use Only

From: RATS <rats-bounces@ietf.org> On Behalf Of Laurence Lundblade
Sent: Thursday, April 2, 2020 3:05 PM
To: rats@ietf.org
Subject: [Rats] Where are known-good references values in architectu= re?

 

<= span style=3D"font-size:10.5pt;font-family:"Lato",sans-serif;colo= r:black">[External Email. Be cautious of content]

 

In the architecture diagram below, where do the known-g=
ood reference values go into the verifier?  =
https://tools.ietf.org/html/draft-ietf-rats-architecture-02 only mentio=
ns known-good references values as something the verifier processes... The =
definitions of Endorsements and Appraisal Policy don’t seem to i=
nclude reference values.
 
Or is it just something the verifier “knows&=
#8221;?
 
Seems like reference values could be things like the ex=
pected hashes of some files, but could also be things like which versi=
ons of SW have a vulnerability, or which versions of HW are certified.
 
Seems an important to say where they come from as they =
are of critical importance.
 
LL
 
 
 
       =
;          ************ &=
nbsp; ************    *****************
           &nbs=
p;     * Endorser *   * Verifier *  =
;  * Relying Party *
           &nbs=
p;     ************   *  Owner &nbs=
p; *    *  Owner      &nb=
sp; *
           &nbs=
p;           |  =
;      ************    ************=
*****
           &nbs=
p;           |  =
;            | =
            &nb=
sp;   |
           Endorseme=
nts|            =
;  |           =
      |
           &nbs=
p;           |  =
;            |Apprai=
sal        |
           &nbs=
p;           |  =
;            |Policy=
 for       |
           &nbs=
p;           |  =
;            |Eviden=
ce         | Appraisal

           &nbs=
p;           |  =
;            | =
            &nb=
sp;   | Policy for


           &nbs=
p;           |  =
;            | =
            &nb=
sp;   | Attestation


           &nbs=
p;           |  =
;            | =
            &nb=
sp;   |  Result


           &nbs=
p;           v  =
;            v =
            &nb=
sp;   |


           &nbs=
p;         .-----------------. =
;            &n=
bsp;  |


           &nbs=
p;  .----->|     Verifier    |--=
----.         |


           &nbs=
p;  |      '-----------------'  &nb=
sp;   |         |


           &nbs=
p;  |           =
;            &n=
bsp;       |     &nb=
sp;   |


           &nbs=
p;  |           =
;         Attestation|  &=
nbsp;      |


           &nbs=
p;  |           =
;         Results   =
 |         |


           &nbs=
p;  | Evidence         &n=
bsp;            |&nb=
sp;        |


            &nb=
sp; |           =
;            &n=
bsp;       |     &nb=
sp;   |


           &nbs=
p;  |           =
;            &n=
bsp;       v     &nb=
sp;   v


        .----------.  &nb=
sp;            =
       .-----------------.


        | Attester |  &nb=
sp;            =
       | Relying Party   |


        '----------'  &nb=
sp;             =
;      '-----------------'


 


           &nbs=
p;           Figure 1: Co=
nceptual Data Flow




 
--_000_DM6PR05MB6889FE7E900737A234E222B0BAC60DM6PR05MB6889namp_-- From nobody Thu Apr 2 12:36:27 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 795273A104A for ; Thu, 2 Apr 2020 12:36:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.894 X-Spam-Level: X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z2HGZHghejeP for ; Thu, 2 Apr 2020 12:36:24 -0700 (PDT) Received: from p3plsmtpa07-01.prod.phx3.secureserver.net (p3plsmtpa07-01.prod.phx3.secureserver.net [173.201.192.230]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C127C3A1043 for ; Thu, 2 Apr 2020 12:36:24 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id K5dXjMz2uY86BK5dXjd9SJ; Thu, 02 Apr 2020 12:36:23 -0700 X-CMAE-Analysis: v=2.3 cv=DLLxHBFb c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=48vgC7mUAAAA:8 a=0XtbOteLAAAA:20 a=814oOQXXGY5T01c6-4oA:9 a=Ik1xDt5H50kLoAny:21 a=6-14p7fDkUldTRAg:21 a=QEXdDO2ut3YA:10 a=fwYrEeMZckM2ySW9rCYA:9 a=txK3SGMZoE1pDT_9:21 a=YQjVzUYSSWhEfv7a:21 a=M3t8hBc72cuuL24Q:21 a=_W_S_7VecoQA:10 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_F68FEEEC-C5D7-46ED-89A1-D9B23D1AC475" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: Date: Thu, 2 Apr 2020 12:36:22 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfNuPKu5T+IlRXvxGwtBlpAmsHbTn4525C1CyV5Ff6Mu0pglYk8q5OHNOoicR3mnTO72IH6YhjuJt+pYq/7pimDNCqaTgNqJlyB6clSE0x9k113lopkxw 193TxnsGFhU1nxOFzsFQeMPyRLF6PpXzz1xsPSvNwsvISH0L2irDO61Y Archived-At: Subject: [Rats] Processing Endorsements and Evidence into Results X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2020 19:36:27 -0000 --Apple-Mail=_F68FEEEC-C5D7-46ED-89A1-D9B23D1AC475 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Now that we have a first draft describing endorsements = , = and they look like Evidence and Results, it seems interesting to = consider some of how the verifier uses Endorsements (reference the = architecture diagram below). Let=E2=80=99s say there are three things in the endorsement, E1, E2 and = E3, three things in the evidence, C1, C2 and C3 and three in the = results, R1, R2 and R3. Then three simpleton top-level cases: 1) An Endorsement is passed through and becomes a result: E1 =E2=80=94 > = R1 2) A Claim is passed through and becomes a results: C1 =E2=80=94> R2 3) Some endorsements combine with some claims to become a result: {E2, = E3, C2, C3} =E2=80=94> R3 However that seems to be too simple and I think there has to be some = sort of a primitive endorsement, call it E0, whose semantics are that = some or all of the claims can always be believed. I think that means 2) = doesn=E2=80=99t really exist, but has to be this: 2) Some claims can pass through with the use of the primitive E0 = endorsement: {E0, C1} =E2=80=94> R2 One way E0 could be defined in the draft describing endorsements = is = that it is a list of the labels of claims that are trusted to be passed = through. For numeric labels a range INT64_MAX to INT64_MIN (or = -infinity to +infinity) indicates all claims are trusted. It could also = list specific ones that are trusted. =46rom the TEE, FIDO and Android Attestation views of the world where = measurements aren=E2=80=99t a primary thing and secure/trusted boot is = required and always on, a common model will be to pass everything = through to create an aggregate result. It could be represented this way: E1->R1 E2->R2 E3->R3 {E0,C1}->R4 {E0,C2}->R5 {E0,C3}->R6 I think this goes on to submodules too and has some relation to the = attempted to propose a connection type. Endorsements may be able to say = how submodules are trusted. There might even be an E00 primitive that = says the lead attester is allowed to say how submodules are trusted. = This whole line of thinking was partly prompted by this issue = against EAT and comments = from Giri and Dave. LL ************ ************ ***************** * Endorser * * Verifier * * Relying Party * ************ * Owner * * Owner * | ************ ***************** | | | Endorsements| | | | |Appraisal | | |Policy for | | |Evidence | Appraisal | | | Policy for | | | Attestation | | | Result v v | .-----------------. | .----->| Verifier |------. | | '-----------------' | | | | | | Attestation| | | Results | | | Evidence | | | | | | v v .----------. .-----------------. | Attester | | Relying Party | '----------' '-----------------' --Apple-Mail=_F68FEEEC-C5D7-46ED-89A1-D9B23D1AC475 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Now that we have a first draft describing endorsements, and they look like = Evidence and Results, it seems interesting to consider some of how the = verifier uses Endorsements (reference the architecture diagram = below).

Let=E2=80= =99s say there are three things in the endorsement, E1, E2 and E3, three = things in the evidence, C1, C2 and C3 and three in the results, R1, R2 = and R3.

Then = three simpleton top-level cases:

1) An Endorsement is passed = through and becomes a result: E1 =E2=80=94 > R1
2)= A Claim is passed through and becomes a results: C1 =E2=80=94> = R2
3) Some endorsements combine with some claims to = become a result: {E2, E3, C2, C3} =E2=80=94> = R3

However that seems to be too simple and I think there has to = be some sort of a primitive endorsement, call it E0, whose semantics are = that some or all of the claims can always be believed. I think that = means 2) doesn=E2=80=99t really exist, but has to be this:

2)= Some claims can pass through with the use of the primitive E0 = endorsement: {E0, C1} =E2=80=94> R2

One way E0 could be = defined in the draft describing endorsements is that it is a list = of the labels of claims that are trusted to be passed through. For = numeric labels  a range INT64_MAX to INT64_MIN (or -infinity to = +infinity)  indicates all claims are trusted. It could also list = specific ones that are trusted.

=46rom the TEE, FIDO and Android = Attestation views of the world where measurements aren=E2=80=99t a = primary thing and secure/trusted boot is required and always on, a = common model will be to pass everything through to create an aggregate = result. It could be represented this way:

E1->R1
E2->R2
E3->R3
{E0,C1}->R4
{E0,C2}->R5
{E0,C3}->R6

I think this goes on to submodules too = and has some relation to the attempted to propose a connection type. =  Endorsements may be able to say how submodules are trusted. There = might even be an E00 primitive that says the lead attester is allowed to = say how submodules are trusted. This whole line of thinking was partly = prompted by this issue against EAT and comments from Giri and = Dave.

LL


                 ************   ************    *****************
                 * Endorser *   * Verifier *    * Relying Party *
                 ************   *  Owner   *    *  Owner        *
                       |        ************    *****************
                       |              |                 |
           Endorsements|              |                 |
                       |              |Appraisal        |
                       |              |Policy for       |
                       |              |Evidence         | Appraisal
                       |              |                 | Policy for
                       |              |                 | Attestation
                       |              |                 |  Result
                       v              v                 |
                     .-----------------.                |
              .----->|     Verifier    |------.         |
              |      '-----------------'      |         |
              |                               |         |
              |                    Attestation|         |
              |                    Results    |         |
              | Evidence                      |         |
              |                               |         |
              |                               v         v
        .----------.                      .-----------------.
        | Attester |                      | Relying Party   |
        '----------'                      '-----------------'







= --Apple-Mail=_F68FEEEC-C5D7-46ED-89A1-D9B23D1AC475-- From nobody Thu Apr 2 12:43:41 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49A953A10DB for ; Thu, 2 Apr 2020 12:43:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.296 X-Spam-Level: X-Spam-Status: No, score=-1.296 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001, URI_NOVOWEL=0.5] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5iKadok824iz for ; Thu, 2 Apr 2020 12:43:37 -0700 (PDT) Received: from p3plsmtpa11-04.prod.phx3.secureserver.net (p3plsmtpa11-04.prod.phx3.secureserver.net [68.178.252.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B844B3A10D8 for ; Thu, 2 Apr 2020 12:43:37 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id K5kWjzf7bKG6HK5kXjpuSZ; Thu, 02 Apr 2020 12:43:37 -0700 X-CMAE-Analysis: v=2.3 cv=XN1OtjpE c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=0XtbOteLAAAA:20 a=OUXY8nFuAAAA:8 a=48vgC7mUAAAA:8 a=K6EGIJCdAAAA:8 a=uherdBYGAAAA:8 a=UqCG9HQmAAAA:8 a=EPsORfM6AAAA:8 a=xtG_lES6AAAA:8 a=NfaT3gVWVA2uVvJPRTMA:9 a=IQnpte2tBXcE5wJw:21 a=bCxeL-kIlBtq0wVU:21 a=QEXdDO2ut3YA:10 a=o7uwrXnoshEQrzeHSZoA:9 a=4mvJ7iNDj6-uXV9K:21 a=1tc9M8THGxpSI059:21 a=soZCM6XiGvQiVjgk:21 a=_W_S_7VecoQA:10 a=cAcMbU7R10T-QSRYIcO_:22 a=w1C3t2QeGrPiZgrLijVG:22 a=L6pVIi0Kn1GYQfi8-iRI:22 a=Ef4yma5cpRUEJWN9UqBm:22 a=o5NQm3BLIUAYAXoxEw0U:22 a=fSkwcdB3n3FesMQGoH22:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_B5D567DC-D4C9-472F-88C7-5561203490BB" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 2 Apr 2020 12:43:36 -0700 In-Reply-To: Cc: Dave Thaler , "rats@ietf.org" To: Guy Fedorkow References: X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfMUjQHNwpIMedahBPl/G0M35H67EhHJBjivRX1JBb8TytwAzjdW1giFCO6E+4asbkOfbgNgBVLACkal3zjmMLHu5aHD6pzJFqcMuk2YmsESAS+8eSazk PM+0fsGH8FKpsJA6iCPkoFCcldoDlBeoAPflVGDypUn51mB+Nkrtm3o+FwnRRYzJyqLEwx8sUFFRfALKWi2Z7QQ/SSDAh7vAWtusHkgGUwAqsXNLglh7bXGn UJL2NKZDbB2eNRymJosc+Q== Archived-At: Subject: Re: [Rats] Where are known-good references values in architecture? X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2020 19:43:39 -0000 --Apple-Mail=_B5D567DC-D4C9-472F-88C7-5561203490BB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 OK. That works (and was settled very quickly). Thx. :-) I filed an issue = requesting the = architecture document describe this. LL > On Apr 2, 2020, at 12:22 PM, Guy Fedorkow = wrote: >=20 > Dave, > You=E2=80=99re right, the simple term =E2=80=9Cknown good values=E2=80= =9D hides a very complex trip through policies and software release = strategies, even in what looks like a constrained environment like TPM = attestation. > I think NIST has proposed helpful extensions to the ISO SWID = standard that takes a start at the problem. > /guy > =20 > =20 > =20 > Juniper Business Use Only > From: Dave Thaler >=20 > Sent: Thursday, April 2, 2020 3:12 PM > To: Guy Fedorkow >; Laurence Lundblade = >; rats@ietf.org = > Subject: RE: [Rats] Where are known-good references values in = architecture? > =20 > [External Email. Be cautious of content] > =20 > FYI, =E2=80=9Cknown-good reference values=E2=80=9D are just an = example, or part of what might be used in appraisal. > I=E2=80=99ve pointed out in earlier threads on this list why =E2=80=9Ckn= own good values=E2=80=9D is pretty primitive and not > flexible enough for many real world scenarios. > =20 > From: RATS > On = Behalf Of Guy Fedorkow > Sent: Thursday, April 2, 2020 12:09 PM > To: Laurence Lundblade >; rats@ietf.org > Subject: Re: [Rats] Where are known-good references values in = architecture? > =20 > Hi Laurence, > There=E2=80=99s material on known-good values in the RIV draft, = under the name Reference Integrity Measurements > /guy > =20 > =20 > =20 > Juniper Business Use Only > From: RATS > On = Behalf Of Laurence Lundblade > Sent: Thursday, April 2, 2020 3:05 PM > To: rats@ietf.org > Subject: [Rats] Where are known-good references values in = architecture? > =20 > [External Email. Be cautious of content] > =20 > In the architecture diagram below, where do the known-good reference = values go into the verifier? = https://tools.ietf.org/html/draft-ietf-rats-architecture-02 = only mentions known-good references values as something the = verifier processes... The definitions of Endorsements and Appraisal = Policy don=E2=80=99t seem to include reference values. > =20 > Or is it just something the verifier =E2=80=9Cknows=E2=80=9D? > =20 > Seems like reference values could be things like the expected hashes = of some files, but could also be things like which versions of SW have a = vulnerability, or which versions of HW are certified. > =20 > Seems an important to say where they come from as they are of critical = importance. > =20 > LL > =20 > =20 > =20 > ************ ************ ***************** > * Endorser * * Verifier * * Relying Party * > ************ * Owner * * Owner * > | ************ ***************** > | | | > Endorsements| | | > | |Appraisal | > | |Policy for | > | |Evidence | Appraisal > | | | Policy for > | | | Attestation > | | | Result > v v | > .-----------------. | > .----->| Verifier |------. | > | '-----------------' | | > | | | > | Attestation| | > | Results | | > | Evidence | | > | | | > | v v > .----------. .-----------------. > | Attester | | Relying Party | > '----------' '-----------------' > =20 > Figure 1: Conceptual Data Flow --Apple-Mail=_B5D567DC-D4C9-472F-88C7-5561203490BB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 OK. = That works (and was settled very quickly). Thx. :-)

I filed an issue requesting the architecture document describe = this.

LL

On Apr 2, 2020, at 12:22 PM, Guy Fedorkow <gfedorkow@juniper.net> wrote:

Dave,
  = You=E2=80=99re right, the simple term =E2=80=9Cknown good values=E2=80=9D = hides a very complex trip through policies and software release = strategies, even in what looks like a constrained environment like TPM = attestation.
  I think NIST has proposed helpful extensions to the = ISO SWID standard that takes a start at the problem.
/guy
 
 
 
Juniper Business = Use Only
From: Dave Thaler <dthaler=3D40microsoft.com@dmarc.ietf.org> 
Sent: Thursday, April 2, 2020 = 3:12 PM
To: Guy Fedorkow <gfedorkow@juniper.net>; = Laurence Lundblade <lgl@island-resort.com>; rats@ietf.org
Subject: RE: [Rats] Where are = known-good references values in architecture?
 
[External Email. Be cautious of content]
 
FYI, =E2=80=9Cknown-good reference values=E2=80=9D are = just an example, or part of = what might be used in appraisal.
I=E2=80=99ve pointed out in earlier threads on this = list why =E2=80=9Cknown good values=E2=80=9D is pretty primitive and = not
flexible = enough for many real world scenarios.
 
From: RATS <rats-bounces@ietf.org> On Behalf = Of Guy Fedorkow
Sent: Thursday, April 2, 2020 = 12:09 PM
To: Laurence Lundblade <lgl@island-resort.com>; rats@ietf.org
Subject: Re: [Rats] Where are = known-good references values in architecture?
 
Hi Laurence,
  There=E2=80=99s material on known-good values in the = RIV draft, under the name Reference Integrity Measurements
/guy
 
 
 
Juniper Business = Use Only
From: RATS <rats-bounces@ietf.org> On Behalf = Of Laurence = Lundblade
Sent: Thursday, April 2, 2020 = 3:05 PM
To: rats@ietf.org
Subject: [Rats] Where are known-good = references values in architecture?
 
[External Email. Be cautious of content]
 
In the =
architecture diagram below, where do the known-good reference values go =
into the verifier?  https://tools.ietf.org/html/draft-ietf-rats-architecture-02=
 only mentions known-good references values as something the verifier =
processes... The definitions of Endorsements and Appraisal Policy =
don=E2=80=99t seem to include reference values.
 
Or is it just something the =
verifier =E2=80=9Cknows=E2=80=9D?
 
Seems like reference values could be things like =
the expected hashes of some files, but could also be things =
like which versions of SW have a vulnerability, or which versions =
of HW are certified.
 
Seems an important to say where they come from as they are of =
critical importance.
 
LL
 
 
 
          &nb=
sp;      ************   =
************    *****************
          &nb=
sp;      * Endorser *   * Verifier =
*    * Relying Party *
          &nb=
sp;      ************   *  =
Owner   *    *  =
Owner        *
          &nb=
sp;          =
  |        =
************    *****************
          &nb=
sp;            =
|            &=
nbsp; =
|            &=
nbsp;    |
           =
Endorsements|          &=
nbsp;   =
|            &=
nbsp;    |
          &nb=
sp;            =
|            &=
nbsp; |Appraisal        |
          &nb=
sp;            =
|             =
 |Policy for       |
          &nb=
sp;            =
|            &=
nbsp; |Evidence         | =
Appraisal
          &nb=
sp;            =
|            &=
nbsp; =
|            &=
nbsp;    | Policy for
          &nb=
sp;            =
|            &=
nbsp; =
|            &=
nbsp;    | Attestation
          &nb=
sp;            =
|    =
          |  &=
nbsp;           &nb=
sp;  |  Result
          &nb=
sp;            =
v            &=
nbsp; =
v            &=
nbsp;    |
          &nb=
sp;          =
.-----------------.         &=
nbsp;      |
          &nb=
sp;   .----->|     =
Verifier    =
|------.         |
          &nb=
sp;   |      =
'-----------------'    =
  |         |
          &nb=
sp;   =
|            &=
nbsp;           &nb=
sp;      =
|         |
          &nb=
sp;   =
|            &=
nbsp;       =
Attestation|         |
          &nb=
sp;   =
|            &=
nbsp;       Results    =
|         |
          &nb=
sp;   | =
Evidence           =
           =
|         |
          =
    |        &=
nbsp;           &nb=
sp;          =
|         |
          &nb=
sp;   =
|            &=
nbsp;           &nb=
sp;      =
v         v
        =
.----------.          &n=
bsp;           =
.-----------------.
        | Attester =
|            &=
nbsp;         | Relying =
Party   |
        =
'----------'      =
            &n=
bsp;   '-----------------'
 
          &nb=
sp;            =
Figure 1: Conceptual Data =
Flow

= --Apple-Mail=_B5D567DC-D4C9-472F-88C7-5561203490BB-- From nobody Thu Apr 2 16:16:44 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55CB63A1BEB for ; Thu, 2 Apr 2020 16:16:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.894 X-Spam-Level: X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jNa5PQdcf6WZ for ; Thu, 2 Apr 2020 16:16:37 -0700 (PDT) Received: from p3plsmtpa08-08.prod.phx3.secureserver.net (p3plsmtpa08-08.prod.phx3.secureserver.net [173.201.193.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB63A3A1BE8 for ; Thu, 2 Apr 2020 16:16:37 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id K94djw0q0TNSkK94ejhxhW; Thu, 02 Apr 2020 16:16:36 -0700 X-CMAE-Analysis: v=2.3 cv=eK1tc0h1 c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=03-ksFfLAAAA:8 a=K6EGIJCdAAAA:8 a=48vgC7mUAAAA:8 a=0XtbOteLAAAA:20 a=i_8hBTfFLagU8Q0TGiIA:9 a=c6GuGxQ_Xn8yV_wa:21 a=z0KEw3SM1kpy0gVc:21 a=QEXdDO2ut3YA:10 a=lU-0xsz7CH3h1eLVqfkA:9 a=LnTrinoH8vITzVH8:21 a=CvZZ8uSvMHfhXvZv:21 a=5hKFfqA6wIeRMB7y:21 a=_W_S_7VecoQA:10 a=xzjcLgdzzKJd7D42GW5i:22 a=L6pVIi0Kn1GYQfi8-iRI:22 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_2A36B59F-3E37-4974-88EA-25B8B8DF57E6" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 2 Apr 2020 16:16:35 -0700 References: To: rats@ietf.org In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfMtgu9MUGY0Fi/UWR96bhFFV9zLFiR/7MzIKKGk+vWDDRUmhirlsw86qy3HP43ulQqW5ndsKc8fpVw7eMWYHhMa5TC9Ahs1SLUi7hNltaB0AgDKw8Mxy +lnW4dNwA7M+++oPUvWsWK2muTj4TAUsg04rqwilYgh9asRgFZHOATdb Archived-At: Subject: Re: [Rats] Processing Endorsements and Evidence into Results X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2020 23:16:43 -0000 --Apple-Mail=_2A36B59F-3E37-4974-88EA-25B8B8DF57E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Let me make this much more concrete with an example. I=E2=80=99m using = JSON representation of CWT/EAT/Endorsements with C-style comments for = reading ease. Endorsement { =E2=80=9Ctrust-evidence=E2=80=9D: =E2=80=9Call=E2=80=9D, = // E0, I just made this up =E2=80=9Cfield-upgradable=E2=80=9D: true, // E1, from = draft-birkholz-rats-endorsement-eat-00 =E2=80=9Cshielded-secret=E2=80=9D: internal, // E2, from = draft-birkholz-rats-endorsement-eat-00 =E2=80=9Ccommon-criteria=E2=80=9D: = https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.pdf=E2=80=9D= , // E3, from draft-birkholz-rats-endorsement-eat-00 } Evidence { =E2=80=9Ciat": 5734873409823, // C1 time stamp for = evidence creation time(eg) from EAT draft =E2=80=9Csecurity-level=E2=80=9D: 4 // C2 the = security level is =E2=80=9Chardware=E2=80=9D from EAT draft =E2=80=9Cdebug-disable=E2=80=9D: =E2=80=9Cpermanent=E2=80=9D = // C3 debug is permanently disabled for all but the OEM from EAT draft } Results { =E2=80=9Cfield-upgradable=E2=80=9D: true, // R1, from = draft-birkholz-rats-endorsement-eat-00 =E2=80=9Cshielded-secret=E2=80=9D: internal, // R2, from = draft-birkholz-rats-endorsement-eat-00 =E2=80=9Ccommon-criteria=E2=80=9D: = https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.pdf=E2=80=9D= , // R3, from draft-birkholz-rats-endorsement-eat-00 =E2=80=9Ciat": 5734873409823, // R4 time stamp for = evidence creation time(eg) =E2=80=9Csecurity-level=E2=80=9D: 4 // R5 the = security level is =E2=80=9Chardware=E2=80=9D =E2=80=9Cdebug-disable=E2=80=9D: =E2=80=9Cpermanent=E2=80=9D = // R6 debug is permanently disabled for all but the OEM } In this example, the RP is probably feeding this into a risk engine so = they want all the details. Here=E2=80=99s another very abbreviated example with made up claim = names: Endorsement (not showing any signing) { =E2=80=9Cexpected-hash=E2=80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW=E2=80=9D } Evidence { =E2=80=9Cactual-hash=E2=80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW" } Results { =E2=80=9Cverified=E2=80=9D: true, =20 } This all seems like the eventual logical result of the EAT, endorsements = and architecture drafts to me. LL =20 > On Apr 2, 2020, at 12:36 PM, Laurence Lundblade = wrote: >=20 > Now that we have a first draft describing endorsements = , = and they look like Evidence and Results, it seems interesting to = consider some of how the verifier uses Endorsements (reference the = architecture diagram below). >=20 > Let=E2=80=99s say there are three things in the endorsement, E1, E2 = and E3, three things in the evidence, C1, C2 and C3 and three in the = results, R1, R2 and R3. >=20 > Then three simpleton top-level cases: >=20 > 1) An Endorsement is passed through and becomes a result: E1 =E2=80=94 = > R1 > 2) A Claim is passed through and becomes a results: C1 =E2=80=94> R2 > 3) Some endorsements combine with some claims to become a result: {E2, = E3, C2, C3} =E2=80=94> R3 >=20 > However that seems to be too simple and I think there has to be some = sort of a primitive endorsement, call it E0, whose semantics are that = some or all of the claims can always be believed. I think that means 2) = doesn=E2=80=99t really exist, but has to be this: >=20 > 2) Some claims can pass through with the use of the primitive E0 = endorsement: {E0, C1} =E2=80=94> R2 >=20 > One way E0 could be defined in the draft describing endorsements = is = that it is a list of the labels of claims that are trusted to be passed = through. For numeric labels a range INT64_MAX to INT64_MIN (or = -infinity to +infinity) indicates all claims are trusted. It could also = list specific ones that are trusted. >=20 > =46rom the TEE, FIDO and Android Attestation views of the world where = measurements aren=E2=80=99t a primary thing and secure/trusted boot is = required and always on, a common model will be to pass everything = through to create an aggregate result. It could be represented this way: >=20 > E1->R1 > E2->R2 > E3->R3 > {E0,C1}->R4 > {E0,C2}->R5 > {E0,C3}->R6 >=20 > I think this goes on to submodules too and has some relation to the = attempted to propose a connection type. Endorsements may be able to say = how submodules are trusted. There might even be an E00 primitive that = says the lead attester is allowed to say how submodules are trusted. = This whole line of thinking was partly prompted by this issue = against EAT and comments = from Giri and Dave. >=20 > LL >=20 >=20 > ************ ************ ***************** > * Endorser * * Verifier * * Relying Party * > ************ * Owner * * Owner * > | ************ ***************** > | | | > Endorsements| | | > | |Appraisal | > | |Policy for | > | |Evidence | Appraisal > | | | Policy for > | | | Attestation > | | | Result > v v | > .-----------------. | > .----->| Verifier |------. | > | '-----------------' | | > | | | > | Attestation| | > | Results | | > | Evidence | | > | | | > | v v > .----------. .-----------------. > | Attester | | Relying Party | > '----------' '-----------------' >=20 >=20 >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats --Apple-Mail=_2A36B59F-3E37-4974-88EA-25B8B8DF57E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Let = me make this much more concrete with an example. I=E2=80=99m using JSON = representation of CWT/EAT/Endorsements with C-style comments for reading = ease.

Endorsement
{
    =E2=80=9Ctrust-evidence=E2=80=9D: =E2=80=9Call=E2= =80=9D,           // E0, I just made this = up
    =E2=80=9Cfield-upgradable=E2=80=9D: true, =          // E1, = from draft-birkholz-rats-endorsement-eat-00
    = =E2=80=9Cshielded-secret=E2=80=9D: internal,       // E2, = from draft-birkholz-rats-endorsement-eat-00
    = =E2=80=9Ccommon-criteria=E2=80=9D: https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.= pdf=E2=80=9D,      // E3, = from draft-birkholz-rats-endorsement-eat-00
}

Evidence
{
    =E2=80=9Ciat": 5734873409823,     =          // C1 time stamp for evidence creation = time(eg) from EAT draft
    =E2=80=9Csecurity-level=E2=80=9D: 4   =              // C2 the security level = is =E2=80=9Chardware=E2=80=9D from EAT draft
    = =E2=80=9Cdebug-disable=E2=80=9D: =E2=80=9Cpermanent=E2=80=9D   =     // C3 debug is permanently disabled for all but the = OEM from EAT draft
}

Results
{
  =   =E2=80=9Cfield-upgradable=E2=80=9D: true,       =    // R1, = from draft-birkholz-rats-endorsement-eat-00
    = =E2=80=9Cshielded-secret=E2=80=9D: internal,       // R2, = from draft-birkholz-rats-endorsement-eat-00
    = =E2=80=9Ccommon-criteria=E2=80=9D: https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.= pdf=E2=80=9D,      // R3, = from draft-birkholz-rats-endorsement-eat-00
  =   =E2=80=9Ciat": 5734873409823,           =    // R4 time stamp for evidence creation = time(eg)
    =E2=80=9Csecurity-level=E2=80=9D: 4   =              // R5 the security level = is =E2=80=9Chardware=E2=80=9D
    =E2=80=9Cdebug-disable=E2=80= =9D: =E2=80=9Cpermanent=E2=80=9D       // R6 debug is = permanently disabled for all but the OEM
}

In this example, the RP = is probably feeding this into a risk engine so they want all the = details.


Here=E2=80=99s another very abbreviated = example with made up claim names:

Endorsement= (not showing any signing)
{
    =E2=80=9Cexpected-hash=E2=80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW=E2=80=9D
}

Evidence
{
    =E2=80=9Cactual-hash=E2=80=9D= : = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW"
}

Results
{
    = =E2=80=9Cverified=E2=80=9D: true,  
}

This all seems like the = eventual logical result of the EAT, endorsements and architecture drafts = to me.

LL
    



On Apr = 2, 2020, at 12:36 PM, Laurence Lundblade <lgl@island-resort.com> wrote:

Now that we have a first draft describing endorsements, and they look like = Evidence and Results, it seems interesting to consider some of how the = verifier uses Endorsements (reference the architecture diagram = below).

Let=E2=80= =99s say there are three things in the endorsement, E1, E2 and E3, three = things in the evidence, C1, C2 and C3 and three in the results, R1, R2 = and R3.

Then = three simpleton top-level cases:

1) An Endorsement is passed = through and becomes a result: E1 =E2=80=94 > R1
2)= A Claim is passed through and becomes a results: C1 =E2=80=94> = R2
3) Some endorsements combine with some claims to = become a result: {E2, E3, C2, C3} =E2=80=94> = R3

However that seems to be too simple and I think there has to = be some sort of a primitive endorsement, call it E0, whose semantics are = that some or all of the claims can always be believed. I think that = means 2) doesn=E2=80=99t really exist, but has to be this:

2)= Some claims can pass through with the use of the primitive E0 = endorsement: {E0, C1} =E2=80=94> R2

One way E0 could be = defined in the draft describing endorsements is that it is a list = of the labels of claims that are trusted to be passed through. For = numeric labels  a range INT64_MAX to INT64_MIN (or -infinity to = +infinity)  indicates all claims are trusted. It could also list = specific ones that are trusted.

=46rom the TEE, FIDO and Android = Attestation views of the world where measurements aren=E2=80=99t a = primary thing and secure/trusted boot is required and always on, a = common model will be to pass everything through to create an aggregate = result. It could be represented this way:

E1->R1
E2->R2
E3->R3
{E0,C1}->R4
{E0,C2}->R5
{E0,C3}->R6

I think this goes on to submodules too = and has some relation to the attempted to propose a connection type. =  Endorsements may be able to say how submodules are trusted. There = might even be an E00 primitive that says the lead attester is allowed to = say how submodules are trusted. This whole line of thinking was partly = prompted by this issue against EAT and comments from Giri and = Dave.

LL


                 ************   =
************    *****************
                 * Endorser *   * Verifier *    * Relying Party *
                 ************   *  Owner   *    *  Owner        *
                       |        ************    *****************
                       |              |                 |
           Endorsements|              |                 |
                       |              |Appraisal        |
                       |              |Policy for       |
                       |              |Evidence         | Appraisal
                       |              |                 | Policy for
                       |              |                 | Attestation
                       |              |                 |  Result
                       v              v                 |
                     .-----------------.                |
              .----->|     Verifier    |------.         |
              |      '-----------------'      |         |
              |                               |         |
              |                    Attestation|         |
              |                    Results    |         |
              | Evidence                      |         |
              |                               |         |
              |                               v         v
        .----------.                      .-----------------.
        | Attester |                      | Relying Party   |
        '----------'                      '-----------------'







_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_2A36B59F-3E37-4974-88EA-25B8B8DF57E6-- From nobody Thu Apr 2 21:20:16 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 313053A0E1C for ; Thu, 2 Apr 2020 21:20:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wDABPUByQzeU for ; Thu, 2 Apr 2020 21:20:11 -0700 (PDT) Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C59F3A0E19 for ; Thu, 2 Apr 2020 21:20:10 -0700 (PDT) IronPort-SDR: 3FzIh4ETNoB7g55w3UcPNtYjzecvfR8NW3wqYeWreL6OtSGOlx6TqzW0x0HyP4l4vc3Ovs562U DBEKzMei0tXQ== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Apr 2020 21:20:08 -0700 IronPort-SDR: ZyDCHiU66z9Wu0Wb44CExUg5qXAWcryrNkCZ5vmMSWt0df9/aenQNBs48gvxyTvTNfTF0lNHrO HUMr33bajfIg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,338,1580803200"; d="scan'208,217";a="238760845" Received: from orsmsx105.amr.corp.intel.com ([10.22.225.132]) by orsmga007.jf.intel.com with ESMTP; 02 Apr 2020 21:20:08 -0700 Received: from orsmsx122.amr.corp.intel.com (10.22.225.227) by ORSMSX105.amr.corp.intel.com (10.22.225.132) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 2 Apr 2020 21:20:07 -0700 Received: from orsmsx108.amr.corp.intel.com ([169.254.2.172]) by ORSMSX122.amr.corp.intel.com ([169.254.11.66]) with mapi id 14.03.0439.000; Thu, 2 Apr 2020 21:20:07 -0700 From: "Smith, Ned" To: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Processing Endorsements and Evidence into Results Thread-Index: AQHWCSYFjr6P8H2RO0Gpgb6vU8jglKhm7I6A///fdYA= Date: Fri, 3 Apr 2020 04:20:07 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.35.20030802 x-originating-ip: [10.254.67.174] Content-Type: multipart/alternative; boundary="_000_B8790B3C35FF4709837D0BE609678104intelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Processing Endorsements and Evidence into Results X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2020 04:20:13 -0000 --_000_B8790B3C35FF4709837D0BE609678104intelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QlRXOiBTaW5jZSDigJhkZWJ1Zy1kaXNhYmxl4oCZIGlzIHBlcm1hbmVudCBpdCBjb3VsZCBwcm9i YWJseSBlcXVhbGx5IGJlIGluY2x1ZGVkIGluIEVuZG9yc2VtZW50Lg0KSXQgaXMgYWxzbyByZWFz b25hYmxlIHRoYXQgVmVyaWZpZXIgY291bGQgZG93bmdyYWRlIOKAmHNlY3VyaXR5IGxldmVs4oCZ IGJhc2VkIG9uIG90aGVyIGNsYWltcyBhbmQgaG93IHRoZXkgcmVsYXRlIHRvIHBvbGljaWVzLiBT ZWN1cml0eSBsZXZlbCBpbiBFdmlkZW5jZSBpcyBhbiBhc3NlcnRpb24gdGhlIGF0dGVzdGVyIG1h a2VzIHRoYXQgaGFzIHRvIGJlIHN1YnN0YW50aWF0ZWQgaW4gc29tZSB3YXkuIEl0IGNvdWxkIGFs c28gYmUgdXNlZCBleGNsdXNpdmVseSBhcyBhIGNvbmNsdXNpb24gaW4gUmVzdWx0cyBiYXNlZCBv biByZXZpZXcgb2YgYSBidW5jaCBvZiBvdGhlciBjbGFpbXMgKGluIG90aGVyIHdvcmRzIEF0dGVz dGF0aW9uIFJlc3VsdHMgY29sZCBhY3F1aXJlIGFkZGl0aW9uYWwgY2xhaW1zIGJleW9uZCB3aGF0 IG9yaWdpbmFsbHkgZXhpc3RlZCBpbiB0aGUgaW50ZXJzZWN0aW9uIG9mIEV2aWRlbmNlIGFuZCBF bmRvcnNlbWVudC4NCg0KUG9saWNpZXMgYW5kIG9yIHN0YW5kYXJkaXplZCBwcm9maWxlcyBkZWNp ZGUgYWxsIHRoZXNlIHZhcmlhYmxlcyBJTUhPLg0KDQpCdXQgdGhlIGV4YW1wbGUgc2VlbXMgdG8g YmUgaWxsdXN0cmF0aXZlIChpZiB0aGF0IHdhcyB0aGUgaW50ZW50KS4NCg0KLU5lZA0KDQpGcm9t OiBSQVRTIDxyYXRzLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBMYXVyZW5jZSBMdW5k YmxhZGUgPGxnbEBpc2xhbmQtcmVzb3J0LmNvbT4NCkRhdGU6IFRodXJzZGF5LCBBcHJpbCAyLCAy MDIwIGF0IDQ6MTYgUE0NClRvOiAicmF0c0BpZXRmLm9yZyIgPHJhdHNAaWV0Zi5vcmc+DQpTdWJq ZWN0OiBSZTogW1JhdHNdIFByb2Nlc3NpbmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRv IFJlc3VsdHMNCg0KTGV0IG1lIG1ha2UgdGhpcyBtdWNoIG1vcmUgY29uY3JldGUgd2l0aCBhbiBl eGFtcGxlLiBJ4oCZbSB1c2luZyBKU09OIHJlcHJlc2VudGF0aW9uIG9mIENXVC9FQVQvRW5kb3Jz ZW1lbnRzIHdpdGggQy1zdHlsZSBjb21tZW50cyBmb3IgcmVhZGluZyBlYXNlLg0KDQpFbmRvcnNl bWVudA0Kew0KICAgIOKAnHRydXN0LWV2aWRlbmNl4oCdOiDigJxhbGzigJ0sICAgICAgICAgICAv LyBFMCwgSSBqdXN0IG1hZGUgdGhpcyB1cA0KICAgIOKAnGZpZWxkLXVwZ3JhZGFibGXigJ06IHRy dWUsICAgICAgICAgIC8vIEUxLCBmcm9tIGRyYWZ0LWJpcmtob2x6LXJhdHMtZW5kb3JzZW1lbnQt ZWF0LTAwDQogICAg4oCcc2hpZWxkZWQtc2VjcmV04oCdOiBpbnRlcm5hbCwgICAgICAgLy8gRTIs IGZyb20gZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDANCiAgICDigJxjb21t b24tY3JpdGVyaWHigJ06IGh0dHBzOi8vd3d3LmNvbW1vbmNyaXRlcmlhcG9ydGFsLm9yZy9maWxl cy9lcGZpbGVzLzA4NzlWM2FfcGRmLnBkZuKAnSwgICAgICAvLyBFMywgZnJvbSBkcmFmdC1iaXJr aG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KfQ0KDQpFdmlkZW5jZQ0Kew0KICAgIOKAnGlh dCI6IDU3MzQ4NzM0MDk4MjMsICAgICAgICAgICAgICAvLyBDMSB0aW1lIHN0YW1wIGZvciBldmlk ZW5jZSBjcmVhdGlvbiB0aW1lKGVnKSBmcm9tIEVBVCBkcmFmdA0KICAgIOKAnHNlY3VyaXR5LWxl dmVs4oCdOiA0ICAgICAgICAgICAgICAgIC8vIEMyIHRoZSBzZWN1cml0eSBsZXZlbCBpcyDigJxo YXJkd2FyZeKAnSBmcm9tIEVBVCBkcmFmdA0KICAgIOKAnGRlYnVnLWRpc2FibGXigJ06IOKAnHBl cm1hbmVudOKAnSAgICAgICAvLyBDMyBkZWJ1ZyBpcyBwZXJtYW5lbnRseSBkaXNhYmxlZCBmb3Ig YWxsIGJ1dCB0aGUgT0VNIGZyb20gRUFUIGRyYWZ0DQp9DQoNClJlc3VsdHMNCnsNCiAgICDigJxm aWVsZC11cGdyYWRhYmxl4oCdOiB0cnVlLCAgICAgICAgICAvLyBSMSwgZnJvbSBkcmFmdC1iaXJr aG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KICAgIOKAnHNoaWVsZGVkLXNlY3JldOKAnTog aW50ZXJuYWwsICAgICAgIC8vIFIyLCBmcm9tIGRyYWZ0LWJpcmtob2x6LXJhdHMtZW5kb3JzZW1l bnQtZWF0LTAwDQogICAg4oCcY29tbW9uLWNyaXRlcmlh4oCdOiBodHRwczovL3d3dy5jb21tb25j cml0ZXJpYXBvcnRhbC5vcmcvZmlsZXMvZXBmaWxlcy8wODc5VjNhX3BkZi5wZGbigJ0sICAgICAg Ly8gUjMsIGZyb20gZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDANCiAgICDi gJxpYXQiOiA1NzM0ODczNDA5ODIzLCAgICAgICAgICAgICAgLy8gUjQgdGltZSBzdGFtcCBmb3Ig ZXZpZGVuY2UgY3JlYXRpb24gdGltZShlZykNCiAgICDigJxzZWN1cml0eS1sZXZlbOKAnTogNCAg ICAgICAgICAgICAgICAvLyBSNSB0aGUgc2VjdXJpdHkgbGV2ZWwgaXMg4oCcaGFyZHdhcmXigJ0N CiAgICDigJxkZWJ1Zy1kaXNhYmxl4oCdOiDigJxwZXJtYW5lbnTigJ0gICAgICAgLy8gUjYgZGVi dWcgaXMgcGVybWFuZW50bHkgZGlzYWJsZWQgZm9yIGFsbCBidXQgdGhlIE9FTQ0KfQ0KDQpJbiB0 aGlzIGV4YW1wbGUsIHRoZSBSUCBpcyBwcm9iYWJseSBmZWVkaW5nIHRoaXMgaW50byBhIHJpc2sg ZW5naW5lIHNvIHRoZXkgd2FudCBhbGwgdGhlIGRldGFpbHMuDQoNCg0KSGVyZeKAmXMgYW5vdGhl ciB2ZXJ5IGFiYnJldmlhdGVkIGV4YW1wbGUgd2l0aCBtYWRlIHVwIGNsYWltIG5hbWVzOg0KDQpF bmRvcnNlbWVudCAobm90IHNob3dpbmcgYW55IHNpZ25pbmcpDQp7DQogICAg4oCcZXhwZWN0ZWQt aGFzaOKAnTog4oCcVFdGdUlHbHpJR1JwYzNScGJtZDFhWE5vWldRc0lHNXZkQ0J2Ym14NUlHSjVJ R2hwY3lCeVpX4oCdDQp9DQoNCkV2aWRlbmNlDQp7DQogICAg4oCcYWN0dWFsLWhhc2jigJ06IOKA nFRXRnVJR2x6SUdScGMzUnBibWQxYVhOb1pXUXNJRzV2ZENCdmJteDVJR0o1SUdocGN5QnlaVyIN Cn0NCg0KUmVzdWx0cw0Kew0KICAgIOKAnHZlcmlmaWVk4oCdOiB0cnVlLA0KfQ0KDQpUaGlzIGFs bCBzZWVtcyBsaWtlIHRoZSBldmVudHVhbCBsb2dpY2FsIHJlc3VsdCBvZiB0aGUgRUFULCBlbmRv cnNlbWVudHMgYW5kIGFyY2hpdGVjdHVyZSBkcmFmdHMgdG8gbWUuDQoNCkxMDQoNCg0KDQoNCg0K T24gQXByIDIsIDIwMjAsIGF0IDEyOjM2IFBNLCBMYXVyZW5jZSBMdW5kYmxhZGUgPGxnbEBpc2xh bmQtcmVzb3J0LmNvbTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tPj4gd3JvdGU6DQoNCk5v dyB0aGF0IHdlIGhhdmUgYSBmaXJzdCBkcmFmdCBkZXNjcmliaW5nIGVuZG9yc2VtZW50czxodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1l YXQtMDA+LCBhbmQgdGhleSBsb29rIGxpa2UgRXZpZGVuY2UgYW5kIFJlc3VsdHMsIGl0IHNlZW1z IGludGVyZXN0aW5nIHRvIGNvbnNpZGVyIHNvbWUgb2YgaG93IHRoZSB2ZXJpZmllciB1c2VzIEVu ZG9yc2VtZW50cyAocmVmZXJlbmNlIHRoZSBhcmNoaXRlY3R1cmUgZGlhZ3JhbSBiZWxvdykuDQoN CkxldOKAmXMgc2F5IHRoZXJlIGFyZSB0aHJlZSB0aGluZ3MgaW4gdGhlIGVuZG9yc2VtZW50LCBF MSwgRTIgYW5kIEUzLCB0aHJlZSB0aGluZ3MgaW4gdGhlIGV2aWRlbmNlLCBDMSwgQzIgYW5kIEMz IGFuZCB0aHJlZSBpbiB0aGUgcmVzdWx0cywgUjEsIFIyIGFuZCBSMy4NCg0KVGhlbiB0aHJlZSBz aW1wbGV0b24gdG9wLWxldmVsIGNhc2VzOg0KDQoxKSBBbiBFbmRvcnNlbWVudCBpcyBwYXNzZWQg dGhyb3VnaCBhbmQgYmVjb21lcyBhIHJlc3VsdDogRTEg4oCUID4gUjENCjIpIEEgQ2xhaW0gaXMg cGFzc2VkIHRocm91Z2ggYW5kIGJlY29tZXMgYSByZXN1bHRzOiBDMSDigJQ+IFIyDQozKSBTb21l IGVuZG9yc2VtZW50cyBjb21iaW5lIHdpdGggc29tZSBjbGFpbXMgdG8gYmVjb21lIGEgcmVzdWx0 OiB7RTIsIEUzLCBDMiwgQzN9IOKAlD4gUjMNCg0KSG93ZXZlciB0aGF0IHNlZW1zIHRvIGJlIHRv byBzaW1wbGUgYW5kIEkgdGhpbmsgdGhlcmUgaGFzIHRvIGJlIHNvbWUgc29ydCBvZiBhIHByaW1p dGl2ZSBlbmRvcnNlbWVudCwgY2FsbCBpdCBFMCwgd2hvc2Ugc2VtYW50aWNzIGFyZSB0aGF0IHNv bWUgb3IgYWxsIG9mIHRoZSBjbGFpbXMgY2FuIGFsd2F5cyBiZSBiZWxpZXZlZC4gSSB0aGluayB0 aGF0IG1lYW5zIDIpIGRvZXNu4oCZdCByZWFsbHkgZXhpc3QsIGJ1dCBoYXMgdG8gYmUgdGhpczoN Cg0KMikgU29tZSBjbGFpbXMgY2FuIHBhc3MgdGhyb3VnaCB3aXRoIHRoZSB1c2Ugb2YgdGhlIHBy aW1pdGl2ZSBFMCBlbmRvcnNlbWVudDoge0UwLCBDMX0g4oCUPiBSMg0KDQpPbmUgd2F5IEUwIGNv dWxkIGJlIGRlZmluZWQgaW4gdGhlIGRyYWZ0IGRlc2NyaWJpbmcgZW5kb3JzZW1lbnRzPGh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVh dC0wMD4gaXMgdGhhdCBpdCBpcyBhIGxpc3Qgb2YgdGhlIGxhYmVscyBvZiBjbGFpbXMgdGhhdCBh cmUgdHJ1c3RlZCB0byBiZSBwYXNzZWQgdGhyb3VnaC4gRm9yIG51bWVyaWMgbGFiZWxzICBhIHJh bmdlIElOVDY0X01BWCB0byBJTlQ2NF9NSU4gKG9yIC1pbmZpbml0eSB0byAraW5maW5pdHkpICBp bmRpY2F0ZXMgYWxsIGNsYWltcyBhcmUgdHJ1c3RlZC4gSXQgY291bGQgYWxzbyBsaXN0IHNwZWNp ZmljIG9uZXMgdGhhdCBhcmUgdHJ1c3RlZC4NCg0KRnJvbSB0aGUgVEVFLCBGSURPIGFuZCBBbmRy b2lkIEF0dGVzdGF0aW9uIHZpZXdzIG9mIHRoZSB3b3JsZCB3aGVyZSBtZWFzdXJlbWVudHMgYXJl buKAmXQgYSBwcmltYXJ5IHRoaW5nIGFuZCBzZWN1cmUvdHJ1c3RlZCBib290IGlzIHJlcXVpcmVk IGFuZCBhbHdheXMgb24sIGEgY29tbW9uIG1vZGVsIHdpbGwgYmUgdG8gcGFzcyBldmVyeXRoaW5n IHRocm91Z2ggdG8gY3JlYXRlIGFuIGFnZ3JlZ2F0ZSByZXN1bHQuIEl0IGNvdWxkIGJlIHJlcHJl c2VudGVkIHRoaXMgd2F5Og0KDQpFMS0+UjENCkUyLT5SMg0KRTMtPlIzDQp7RTAsQzF9LT5SNA0K e0UwLEMyfS0+UjUNCntFMCxDM30tPlI2DQoNCkkgdGhpbmsgdGhpcyBnb2VzIG9uIHRvIHN1Ym1v ZHVsZXMgdG9vIGFuZCBoYXMgc29tZSByZWxhdGlvbiB0byB0aGUgYXR0ZW1wdGVkIHRvIHByb3Bv c2UgYSBjb25uZWN0aW9uIHR5cGUuICBFbmRvcnNlbWVudHMgbWF5IGJlIGFibGUgdG8gc2F5IGhv dyBzdWJtb2R1bGVzIGFyZSB0cnVzdGVkLiBUaGVyZSBtaWdodCBldmVuIGJlIGFuIEUwMCBwcmlt aXRpdmUgdGhhdCBzYXlzIHRoZSBsZWFkIGF0dGVzdGVyIGlzIGFsbG93ZWQgdG8gc2F5IGhvdyBz dWJtb2R1bGVzIGFyZSB0cnVzdGVkLiBUaGlzIHdob2xlIGxpbmUgb2YgdGhpbmtpbmcgd2FzIHBh cnRseSBwcm9tcHRlZCBieSB0aGlzIGlzc3VlPGh0dHBzOi8vZ2l0aHViLmNvbS9pZXRmLXJhdHMt d2cvZWF0L2lzc3Vlcy81OD4gYWdhaW5zdCBFQVQgYW5kIGNvbW1lbnRzIGZyb20gR2lyaSBhbmQg RGF2ZS4NCg0KTEwNCg0KDQoNCiAgICAgICAgICAgICAgICAgKioqKioqKioqKioqICAgKioqKioq KioqKioqICAgICoqKioqKioqKioqKioqKioqDQoNCiAgICAgICAgICAgICAgICAgKiBFbmRvcnNl ciAqICAgKiBWZXJpZmllciAqICAgICogUmVseWluZyBQYXJ0eSAqDQoNCiAgICAgICAgICAgICAg ICAgKioqKioqKioqKioqICAgKiAgT3duZXIgICAqICAgICogIE93bmVyICAgICAgICAqDQoNCiAg ICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgKioqKioqKioqKioqICAgICoqKioqKioqKioq KioqKioqDQoNCiAgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgfCAgICAgICAg ICAgICAgICAgfA0KDQogICAgICAgICAgIEVuZG9yc2VtZW50c3wgICAgICAgICAgICAgIHwgICAg ICAgICAgICAgICAgIHwNCg0KICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAgICB8 QXBwcmFpc2FsICAgICAgICB8DQoNCiAgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAg ICAgfFBvbGljeSBmb3IgICAgICAgfA0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAg ICAgICAgIHxFdmlkZW5jZSAgICAgICAgIHwgQXBwcmFpc2FsDQoNCiAgICAgICAgICAgICAgICAg ICAgICAgfCAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgfCBQb2xpY3kgZm9yDQoNCiAg ICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgfCBB dHRlc3RhdGlvbg0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgIHwgICAg ICAgICAgICAgICAgIHwgIFJlc3VsdA0KDQogICAgICAgICAgICAgICAgICAgICAgIHYgICAgICAg ICAgICAgIHYgICAgICAgICAgICAgICAgIHwNCg0KICAgICAgICAgICAgICAgICAgICAgLi0tLS0t LS0tLS0tLS0tLS0tLiAgICAgICAgICAgICAgICB8DQoNCiAgICAgICAgICAgICAgLi0tLS0tPnwg ICAgIFZlcmlmaWVyICAgIHwtLS0tLS0uICAgICAgICAgfA0KDQogICAgICAgICAgICAgIHwgICAg ICAnLS0tLS0tLS0tLS0tLS0tLS0nICAgICAgfCAgICAgICAgIHwNCg0KICAgICAgICAgICAgICB8 ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICB8DQoNCiAgICAgICAgICAg ICAgfCAgICAgICAgICAgICAgICAgICAgQXR0ZXN0YXRpb258ICAgICAgICAgfA0KDQogICAgICAg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgIFJlc3VsdHMgICAgfCAgICAgICAgIHwNCg0KICAg ICAgICAgICAgICB8IEV2aWRlbmNlICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICB8DQoN CiAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAg fA0KDQogICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdiAgICAg ICAgIHYNCg0KICAgICAgICAuLS0tLS0tLS0tLS4gICAgICAgICAgICAgICAgICAgICAgLi0tLS0t LS0tLS0tLS0tLS0tLg0KDQogICAgICAgIHwgQXR0ZXN0ZXIgfCAgICAgICAgICAgICAgICAgICAg ICB8IFJlbHlpbmcgUGFydHkgICB8DQoNCiAgICAgICAgJy0tLS0tLS0tLS0nICAgICAgICAgICAg ICAgICAgICAgICctLS0tLS0tLS0tLS0tLS0tLScNCg0KDQoNCg0KDQoNCg0KX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClJBVFMgbWFpbGluZyBsaXN0DQpS QVRTQGlldGYub3JnPG1haWx0bzpSQVRTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9yYXRzDQoNCg== --_000_B8790B3C35FF4709837D0BE609678104intelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <02810F0A7A6B134B9625B48CE986193F@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkg MiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpNZW5sbzsNCglwYW5vc2Ut MToyIDExIDYgOSAzIDggNCAyIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29O b3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdp bi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpwcmUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFBy ZWZvcm1hdHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN Cglmb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bhbi5I VE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQg Q2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFBy ZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29sYXM7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjAN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIg TmV3IjsNCgljb2xvcjp3aW5kb3d0ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0 eWxlOm5vcm1hbDsNCgl0ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCi5Nc29DaHBEZWZhdWx0 DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30N Ci0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxp bms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5C VFc6IFNpbmNlIOKAmGRlYnVnLWRpc2FibGXigJkgaXMgcGVybWFuZW50IGl0IGNvdWxkIHByb2Jh Ymx5IGVxdWFsbHkgYmUgaW5jbHVkZWQgaW4gRW5kb3JzZW1lbnQuDQo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPkl0IGlzIGFsc28gcmVhc29uYWJsZSB0aGF0IFZlcmlmaWVy IGNvdWxkIGRvd25ncmFkZSDigJhzZWN1cml0eSBsZXZlbOKAmSBiYXNlZCBvbiBvdGhlciBjbGFp bXMgYW5kIGhvdyB0aGV5IHJlbGF0ZSB0byBwb2xpY2llcy4gU2VjdXJpdHkgbGV2ZWwgaW4gRXZp ZGVuY2UgaXMgYW4gYXNzZXJ0aW9uIHRoZSBhdHRlc3RlciBtYWtlcyB0aGF0IGhhcyB0bw0KIGJl IHN1YnN0YW50aWF0ZWQgaW4gc29tZSB3YXkuIEl0IGNvdWxkIGFsc28gYmUgdXNlZCBleGNsdXNp dmVseSBhcyBhIGNvbmNsdXNpb24gaW4gUmVzdWx0cyBiYXNlZCBvbiByZXZpZXcgb2YgYSBidW5j aCBvZiBvdGhlciBjbGFpbXMgKGluIG90aGVyIHdvcmRzIEF0dGVzdGF0aW9uIFJlc3VsdHMgY29s ZCBhY3F1aXJlIGFkZGl0aW9uYWwgY2xhaW1zIGJleW9uZCB3aGF0IG9yaWdpbmFsbHkgZXhpc3Rl ZCBpbiB0aGUgaW50ZXJzZWN0aW9uIG9mIEV2aWRlbmNlDQogYW5kIEVuZG9yc2VtZW50LjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij5Qb2xpY2llcyBhbmQgb3Igc3RhbmRhcmRpemVkIHByb2ZpbGVz IGRlY2lkZSBhbGwgdGhlc2UgdmFyaWFibGVzIElNSE8uPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PkJ1dCB0aGUgZXhhbXBsZSBzZWVtcyB0byBiZSBpbGx1c3RyYXRpdmUgKGlmIHRoYXQgd2FzIHRo ZSBpbnRlbnQpLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4tTmVkPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzoz LjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+UkFUUyAmbHQ7cmF0cy1ib3VuY2VzQGll dGYub3JnJmd0OyBvbiBiZWhhbGYgb2YgTGF1cmVuY2UgTHVuZGJsYWRlICZsdDtsZ2xAaXNsYW5k LXJlc29ydC5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlRodXJzZGF5LCBBcHJpbCAyLCAyMDIw IGF0IDQ6MTYgUE08YnI+DQo8Yj5UbzogPC9iPiZxdW90O3JhdHNAaWV0Zi5vcmcmcXVvdDsgJmx0 O3JhdHNAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbUmF0c10gUHJvY2Vz c2luZyBFbmRvcnNlbWVudHMgYW5kIEV2aWRlbmNlIGludG8gUmVzdWx0czxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MZXQgbWUgbWFrZSB0aGlz IG11Y2ggbW9yZSBjb25jcmV0ZSB3aXRoIGFuIGV4YW1wbGUuIEnigJltIHVzaW5nIEpTT04gcmVw cmVzZW50YXRpb24gb2YgQ1dUL0VBVC9FbmRvcnNlbWVudHMgd2l0aCBDLXN0eWxlIGNvbW1lbnRz IGZvciByZWFkaW5nIGVhc2UuDQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjx1PkVuZG9yc2VtZW50PC91PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij57PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnHRydXN0LWV2aWRlbmNl4oCdOiDigJxhbGzi gJ0sICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgLy8gRTAsIEkganVzdCBtYWRl IHRoaXMgdXA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDsiPiZuYnNwOyAmbmJzcDsg4oCcZmllbGQtdXBncmFkYWJsZeKAnTogdHJ1ZSwgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOy8vIEUxLCBmcm9tJm5ic3A7ZHJhZnQtYmlya2hvbHot cmF0cy1lbmRvcnNlbWVudC1lYXQtMDA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg4oCcc2hpZWxkZWQtc2VjcmV04oCdOiBp bnRlcm5hbCwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgLy8gRTIsIGZyb20mbmJzcDtkcmFmdC1iaXJr aG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxjb21tb24tY3JpdGVyaWHi gJ06DQo8YSBocmVmPSJodHRwczovL3d3dy5jb21tb25jcml0ZXJpYXBvcnRhbC5vcmcvZmlsZXMv ZXBmaWxlcy8wODc5VjNhX3BkZi5wZGYiPmh0dHBzOi8vd3d3LmNvbW1vbmNyaXRlcmlhcG9ydGFs Lm9yZy9maWxlcy9lcGZpbGVzLzA4NzlWM2FfcGRmLnBkZjwvYT7igJ0sICZuYnNwOyAmbmJzcDsg Jm5ic3A7Ly8gRTMsIGZyb20mbmJzcDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVh dC0wMDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ fTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHU+RXZpZGVuY2U8L3U+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPns8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDsiPiZuYnNwOyAmbmJzcDsg4oCcaWF0JnF1b3Q7OiA1NzM0ODczNDA5ODIzLCAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsvLyBDMSB0aW1lIHN0YW1w IGZvciBldmlkZW5jZSBjcmVhdGlvbiB0aW1lKGVnKSBmcm9tIEVBVCBkcmFmdDwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDi gJxzZWN1cml0eS1sZXZlbOKAnTogNCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gQzIgdGhlIHNlY3VyaXR5IGxldmVsIGlzIOKAnGhhcmR3 YXJl4oCdJm5ic3A7ZnJvbSBFQVQgZHJhZnQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg4oCcZGVidWctZGlzYWJsZeKAnTog 4oCccGVybWFuZW504oCdICZuYnNwOyAmbmJzcDsgJm5ic3A7IC8vIEMzIGRlYnVnIGlzIHBlcm1h bmVudGx5IGRpc2FibGVkIGZvciBhbGwgYnV0IHRoZSBPRU0mbmJzcDtmcm9tIEVBVCBkcmFmdDwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHU+UmVzdWx0czwvdT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+ezwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDsiPiZuYnNwOyAmbmJzcDsg4oCcZmllbGQtdXBncmFkYWJsZeKAnTogdHJ1ZSwgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOy8vIFIxLCBmcm9tJm5ic3A7ZHJhZnQtYmlya2hv bHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg4oCcc2hpZWxkZWQtc2VjcmV04oCd OiBpbnRlcm5hbCwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgLy8gUjIsIGZyb20mbmJzcDtkcmFmdC1i aXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxjb21tb24tY3JpdGVy aWHigJ06DQo8YSBocmVmPSJodHRwczovL3d3dy5jb21tb25jcml0ZXJpYXBvcnRhbC5vcmcvZmls ZXMvZXBmaWxlcy8wODc5VjNhX3BkZi5wZGYiPmh0dHBzOi8vd3d3LmNvbW1vbmNyaXRlcmlhcG9y dGFsLm9yZy9maWxlcy9lcGZpbGVzLzA4NzlWM2FfcGRmLnBkZjwvYT7igJ0sICZuYnNwOyAmbmJz cDsgJm5ic3A7Ly8gUjMsIGZyb20mbmJzcDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50 LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg4oCcaWF0JnF1b3Q7OiA1NzM0ODczNDA5ODIzLCAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsvLyBSNCB0aW1lIHN0 YW1wIGZvciBldmlkZW5jZSBjcmVhdGlvbiB0aW1lKGVnKTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxzZWN1cml0eS1s ZXZlbOKAnTogNCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7Ly8gUjUgdGhlIHNlY3VyaXR5IGxldmVsIGlzIOKAnGhhcmR3YXJl4oCdPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5i c3A7IOKAnGRlYnVnLWRpc2FibGXigJ06IOKAnHBlcm1hbmVudOKAnSAmbmJzcDsgJm5ic3A7ICZu YnNwOyAvLyBSNiBkZWJ1ZyBpcyBwZXJtYW5lbnRseSBkaXNhYmxlZCBmb3IgYWxsIGJ1dCB0aGUg T0VNPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDsiPn08L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gdGhpcyBleGFtcGxlLCB0aGUgUlAgaXMgcHJvYmFibHkg ZmVlZGluZyB0aGlzIGludG8gYSByaXNrIGVuZ2luZSBzbyB0aGV5IHdhbnQgYWxsIHRoZSBkZXRh aWxzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkhlcmXigJlzIGFub3RoZXIgdmVyeSBhYmJyZXZpYXRlZCBleGFtcGxlIHdpdGggbWFkZSB1 cCBjbGFpbSBuYW1lczo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjx1PkVuZG9yc2VtZW50IChub3Qgc2hvd2luZyBhbnkgc2lnbmlu Zyk8L3U+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPns8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAm bmJzcDsg4oCcZXhwZWN0ZWQtaGFzaOKAnTog4oCcVFdGdUlHbHpJR1JwYzNScGJtZDFhWE5vWldR c0lHNXZkQ0J2Ym14NUlHSjVJR2hwY3lCeVpX4oCdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij59PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dT5FdmlkZW5jZTwvdT48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ezwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxhY3R1YWwt aGFzaOKAnTog4oCcVFdGdUlHbHpJR1JwYzNScGJtZDFhWE5vWldRc0lHNXZkQ0J2Ym14NUlHSjVJ R2hwY3lCeVpXJnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij59PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48dT5SZXN1bHRzPC91PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij57PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJx2ZXJpZmllZOKAnTogdHJ1 ZSwgJm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij59PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhpcyBhbGwgc2VlbXMgbGlrZSB0aGUgZXZlbnR1 YWwgbG9naWNhbCByZXN1bHQgb2YgdGhlIEVBVCwgZW5kb3JzZW1lbnRzIGFuZCBhcmNoaXRlY3R1 cmUgZHJhZnRzIHRvIG1lLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5MTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9j a3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEFwciAyLCAyMDIwLCBhdCAxMjozNiBQTSwgTGF1 cmVuY2UgTHVuZGJsYWRlICZsdDs8YSBocmVmPSJtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29t Ij5sZ2xAaXNsYW5kLXJlc29ydC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ob3cmbmJzcDt0aGF0IHdlIGhhdmUg YSBmaXJzdCZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1i aXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMCI+ZHJhZnQgZGVzY3JpYmluZyBlbmRvcnNl bWVudHM8L2E+LCBhbmQgdGhleSBsb29rIGxpa2UgRXZpZGVuY2UgYW5kIFJlc3VsdHMsIGl0IHNl ZW1zIGludGVyZXN0aW5nIHRvIGNvbnNpZGVyIHNvbWUgb2YgaG93IHRoZSB2ZXJpZmllcg0KIHVz ZXMgRW5kb3JzZW1lbnRzIChyZWZlcmVuY2UgdGhlIGFyY2hpdGVjdHVyZSBkaWFncmFtIGJlbG93 KS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ TGV04oCZcyBzYXkgdGhlcmUgYXJlIHRocmVlIHRoaW5ncyBpbiB0aGUgZW5kb3JzZW1lbnQsIEUx LCBFMiBhbmQgRTMsIHRocmVlIHRoaW5ncyBpbiB0aGUgZXZpZGVuY2UsIEMxLCBDMiBhbmQgQzMg YW5kIHRocmVlIGluIHRoZSByZXN1bHRzLCBSMSwgUjIgYW5kIFIzLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGVuIHRocmVlIHNpbXBsZXRv biB0b3AtbGV2ZWwgY2FzZXM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4xKSBBbiBFbmRvcnNlbWVudCBpcyBwYXNzZWQgdGhyb3VnaCBhbmQg YmVjb21lcyBhIHJlc3VsdDogRTEg4oCUICZndDsgUjE8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjIpIEEgQ2xhaW0gaXMgcGFzc2VkIHRocm91Z2gg YW5kIGJlY29tZXMgYSByZXN1bHRzOiBDMSDigJQmZ3Q7IFIyPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4zKSBTb21lIGVuZG9yc2VtZW50cyBjb21i aW5lIHdpdGggc29tZSBjbGFpbXMgdG8gYmVjb21lIGEgcmVzdWx0OiB7RTIsIEUzLCBDMiwgQzN9 IOKAlCZndDsgUjM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SG93ZXZlciB0aGF0IHNlZW1zIHRvIGJlIHRvbyBzaW1w bGUgYW5kIEkgdGhpbmsgdGhlcmUgaGFzIHRvIGJlIHNvbWUgc29ydCBvZiBhIHByaW1pdGl2ZSBl bmRvcnNlbWVudCwgY2FsbCBpdCBFMCwgd2hvc2Ugc2VtYW50aWNzIGFyZSB0aGF0IHNvbWUgb3Ig YWxsIG9mIHRoZSBjbGFpbXMgY2FuIGFsd2F5cyBiZSBiZWxpZXZlZC4gSSB0aGluayB0aGF0IG1l YW5zIDIpIGRvZXNu4oCZdCByZWFsbHkgZXhpc3QsIGJ1dA0KIGhhcyB0byBiZSB0aGlzOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4w cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjIpIFNvbWUgY2xhaW1zIGNhbiBwYXNzIHRocm91Z2ggd2l0aCB0aGUgdXNlIG9mIHRoZSBwcmlt aXRpdmUgRTAgZW5kb3JzZW1lbnQ6IHtFMCwgQzF9IOKAlCZndDsgUjI8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5PbmUgd2F5IEUwIGNvdWxkIGJlIGRlZmluZWQgaW4gdGhlJm5ic3A7PGEgaHJlZj0iaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWJpcmtob2x6LXJhdHMtZW5kb3JzZW1lbnQt ZWF0LTAwIj5kcmFmdCBkZXNjcmliaW5nIGVuZG9yc2VtZW50czwvYT4mbmJzcDtpcyB0aGF0IGl0 IGlzIGEgbGlzdCBvZiB0aGUgbGFiZWxzIG9mIGNsYWltcyB0aGF0IGFyZSB0cnVzdGVkIHRvIGJl IHBhc3NlZCB0aHJvdWdoLiBGb3IgbnVtZXJpYw0KIGxhYmVscyAmbmJzcDthIHJhbmdlJm5ic3A7 PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZhbWlseTpNZW5sbztjb2xvcjojMDA3 NDAwO2JhY2tncm91bmQ6d2hpdGUiPklOVDY0X01BWDwvc3Bhbj4mbmJzcDt0byZuYnNwOzxzcGFu IHN0eWxlPSJmb250LXNpemU6OC41cHQ7Zm9udC1mYW1pbHk6TWVubG87Y29sb3I6IzAwNzQwMDti YWNrZ3JvdW5kOndoaXRlIj5JTlQ2NF9NSU4mbmJzcDs8L3NwYW4+KG9yIC1pbmZpbml0eSB0byAm IzQzO2luZmluaXR5KSAmbmJzcDtpbmRpY2F0ZXMgYWxsIGNsYWltcw0KIGFyZSB0cnVzdGVkLiBJ dCBjb3VsZCBhbHNvIGxpc3Qgc3BlY2lmaWMgb25lcyB0aGF0IGFyZSB0cnVzdGVkLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Gcm9tIHRoZSBU RUUsIEZJRE8gYW5kIEFuZHJvaWQgQXR0ZXN0YXRpb24gdmlld3Mgb2YgdGhlIHdvcmxkIHdoZXJl IG1lYXN1cmVtZW50cyBhcmVu4oCZdCBhIHByaW1hcnkgdGhpbmcgYW5kIHNlY3VyZS90cnVzdGVk IGJvb3QgaXMgcmVxdWlyZWQgYW5kIGFsd2F5cyBvbiwgYSBjb21tb24gbW9kZWwgd2lsbCBiZSB0 byBwYXNzIGV2ZXJ5dGhpbmcgdGhyb3VnaCB0byBjcmVhdGUgYW4gYWdncmVnYXRlIHJlc3VsdC4N CiBJdCBjb3VsZCBiZSByZXByZXNlbnRlZCB0aGlzIHdheTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi1yaWdodDow aW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+RTEtJmd0O1IxPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5FMi0mZ3Q7UjI8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPkUzLSZndDtSMzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+e0UwLEMxfS0mZ3Q7UjQ8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPntFMCxD Mn0tJmd0O1I1PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij57RTAsQzN9LSZndDtSNjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB0aGluayB0aGlzIGdvZXMg b24gdG8gc3VibW9kdWxlcyB0b28gYW5kIGhhcyBzb21lIHJlbGF0aW9uIHRvIHRoZSBhdHRlbXB0 ZWQgdG8gcHJvcG9zZSBhIGNvbm5lY3Rpb24gdHlwZS4gJm5ic3A7RW5kb3JzZW1lbnRzIG1heSBi ZSBhYmxlIHRvIHNheSBob3cgc3VibW9kdWxlcyBhcmUgdHJ1c3RlZC4gVGhlcmUgbWlnaHQgZXZl biBiZSBhbiBFMDAgcHJpbWl0aXZlIHRoYXQgc2F5cyB0aGUgbGVhZCBhdHRlc3RlciBpcw0KIGFs bG93ZWQgdG8gc2F5IGhvdyBzdWJtb2R1bGVzIGFyZSB0cnVzdGVkLiBUaGlzIHdob2xlIGxpbmUg b2YgdGhpbmtpbmcgd2FzIHBhcnRseSBwcm9tcHRlZCBieSB0aGlzJm5ic3A7PGEgaHJlZj0iaHR0 cHM6Ly9naXRodWIuY29tL2lldGYtcmF0cy13Zy9lYXQvaXNzdWVzLzU4Ij5pc3N1ZTwvYT4mbmJz cDthZ2FpbnN0IEVBVCBhbmQgY29tbWVudHMgZnJvbSBHaXJpIGFuZCBEYXZlLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MTDxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTogcGFnZSI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICoqKioqKioqKioqKiZuYnNw OyZuYnNwOyAqKioqKioqKioqKiombmJzcDsmbmJzcDsmbmJzcDsgKioqKioqKioqKioqKioqKio8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgKiBFbmRvcnNlciAqJm5ic3A7Jm5ic3A7ICogVmVyaWZpZXIgKiZuYnNwOyZuYnNwOyZu YnNwOyAqIFJlbHlpbmcgUGFydHkgKjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAqKioqKioqKioqKiombmJzcDsmbmJzcDsgKiZu YnNwOyBPd25lciZuYnNwOyZuYnNwOyAqJm5ic3A7Jm5ic3A7Jm5ic3A7ICombmJzcDsgT3duZXIm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgKjxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICoqKioqKioqKioqKiZuYnNwOyZuYnNwOyZuYnNwOyAqKioqKioqKioq KioqKioqKjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg fDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBFbmRvcnNlbWVudHN8Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfDxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IHxBcHByYWlzYWwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfDxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IHxQb2xpY3kgZm9yJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyB8RXZpZGVuY2UgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7fCBBcHByYWlzYWw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHwgUG9saWN5IGZvcjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgfCBBdHRlc3RhdGlvbjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyBSZXN1bHQ8bzpwPjwvbzpwPjwvcHJlPg0K PHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt2Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgLi0tLS0tLS0tLS0tLS0tLS0tLiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC4tLS0tLSZn dDt8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFZlcmlmaWVyJm5ic3A7Jm5ic3A7Jm5ic3A7IHwt LS0tLS0uJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyAnLS0tLS0tLS0tLS0tLS0tLS0nJm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7 fDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEF0dGVzdGF0 aW9ufCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8PG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgUmVzdWx0cyZuYnNw OyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCBF dmlkZW5jZSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDt2Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IHY8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgLi0tLS0tLS0tLS0uJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC4tLS0tLS0tLS0tLS0tLS0tLS48 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgfCBBdHRlc3RlciB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwgUmVseWluZyBQYXJ0eSZuYnNwOyZu YnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICctLS0tLS0tLS0tJyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAnLS0tLS0tLS0tLS0tLS0t LS0nPG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fPGJyPg0KUkFUUyBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86UkFUU0Bp ZXRmLm9yZyI+UkFUU0BpZXRmLm9yZzwvYT48YnI+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3JhdHM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_B8790B3C35FF4709837D0BE609678104intelcom_-- From nobody Thu Apr 2 21:27:09 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 333E03A0E4A for ; Thu, 2 Apr 2020 21:27:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l8rPTyPsuUBh for ; Thu, 2 Apr 2020 21:27:04 -0700 (PDT) Received: from NAM10-MW2-obe.outbound.protection.outlook.com (mail-mw2nam10on2122.outbound.protection.outlook.com [40.107.94.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D41E3A0E48 for ; Thu, 2 Apr 2020 21:27:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Zo9Cz7kBL0a+iX6ZVIUCmeBPyhFbfJhPNJeJdYnKo7ptcPdEDapVpUVa2CsRbfoY8BMOWcHiCBRxwoMyPMK6pOx8yQ9lUCTugMKnvTp3OWHZQvNX/GOH5VXH0ENkVxSc71fOUahFb7O+hN2LAgl5gWcK8aSl3IIbp9/VOnA5UwDQZhLBHK9D1DVbEkOLGsfKwcMPb854j9qbMbYqFpZuXCEqk3RZLDYjkWfQUqtUTKSrTary2H9Xh7M3uZRpRM1+crjs9L5xXOL8k3RV74yE2fF4wrmQql7Vl7PLGPx2Vm7s4G4sX4keCgh168m2zjNdWl53ZrgdbgMnAFpArm9erg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=siCCoYZgrfoQOANJfxmTENqy+4HVSmWYphPntyF8QKM=; b=X5NczVc1Jl4ZKaQQFk62DRS7NSWQvAYBdcofIQZliJEyf+mcoH2rl9Iz/q/bsw3O/uu5xkDxHLrTzGojB6N+4F0/axvqYzHjv9pYh7aen/XB4QYej3Ch9LhuB6DqERbebiDVyH6ahMy1VZvvUBaDPrRScTcZUEaXlqqtOQSw6MVy7OLk+2W5g65fBVZpBmTkWMmF1h8yeMNcU1cUK1Jjl3Z8eRrdPzz2FGwXiAuHPhyxKSCV0PP4gCMhICC1LOeQxCLXZaTNZpYSQKbvkN7PRR7OeYZ+EeDqDEAlEyJmt+gRvmjuadmToIbmo4vsK6jXNlC54WSJsvTU2YrXH0JEsg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=siCCoYZgrfoQOANJfxmTENqy+4HVSmWYphPntyF8QKM=; b=Y6pDHzTwaqbUJnOnMMueUknKBfpDxycMisG++ykP7fgZEGw1aEalkawRRxwM/HW7msYtCpa8iAKV+aIVGd5rOhja495JJstXEYtyIaphT6PJkpCjP+XfdcT6qcKP2tJH0A7DbNKfaLy0JR8nRLlczJURufu6+dNN7W88IsEbkBA= Received: from BL0PR2101MB1027.namprd21.prod.outlook.com (2603:10b6:207:30::33) by BL0PR2101MB0913.namprd21.prod.outlook.com (2603:10b6:207:36::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.2; Fri, 3 Apr 2020 04:27:02 +0000 Received: from BL0PR2101MB1027.namprd21.prod.outlook.com ([fe80::e5f4:bd2b:d304:bfc9]) by BL0PR2101MB1027.namprd21.prod.outlook.com ([fe80::e5f4:bd2b:d304:bfc9%4]) with mapi id 15.20.2878.010; Fri, 3 Apr 2020 04:27:02 +0000 From: Dave Thaler To: Ned Smith , Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Processing Endorsements and Evidence into Results Thread-Index: AQHWCSYEgK54VMXeGk+rWVOBKXCKo6hmdzWAgABUzoCAAADSsA== Date: Fri, 3 Apr 2020 04:27:02 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-originating-ip: [2601:600:9780:16f0:6893:5b01:eac2:20f6] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 06efce0b-eb1c-4af7-0642-08d7d7874249 x-ms-traffictypediagnostic: BL0PR2101MB0913:|BL0PR2101MB0913: x-ld-processed: 72f988bf-86f1-41af-91ab-2d7cd011db47,ExtAddr x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:3968; x-forefront-prvs: 0362BF9FDB x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR2101MB1027.namprd21.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(39860400002)(136003)(396003)(366004)(376002)(346002)(52536014)(33656002)(10290500003)(478600001)(86362001)(8676002)(8936002)(71200400001)(186003)(81156014)(53546011)(6506007)(316002)(7696005)(2906002)(81166006)(8990500004)(82960400001)(110136005)(76116006)(64756008)(966005)(66446008)(66946007)(66556008)(55016002)(9686003)(5660300002)(66476007)(82950400001); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ZsKPTgyedmRorwU2UgxQWJHNprT7V3k/4WemFQDmYNeOS6wEMvPbF6DR8pueCR9Qq0S3G/fbtJUroVslbeR3bJ7zLxcjKawTXb0ZegeO7XG4GUM2BE1Js17cABIdI8v4KjEpSzV0n4g0zGqG3uW+Ls8NyQ3swpU4pJ8sAcmhSathnAsVCpf/wxxIUWMg53PPh/6nLIK91YE4DBnFfy0nR48qbzP3YkRJNQKOMHoxOje3Qji36xh8fuej9EBRtRN81ee0pwzfeFx3aNIPln/pSMO5qljMrc7oVmooQegMBzJvN0lHxJ8Ej/ORXQTIKVhXJ3v4f7SmL1ZIJTBVg6dxUg1Sr9n7CRH1P5nyTDg5O/p2qWdFh07e6udeEYx/RBPPi/CB/hb6XSRykGmPQeRmm+6QsMkOzgfb1FWjG1wXYjVaMRelXHahfSuYyITAcS48PXyQxENZTd7jhtRTTvEFK4RdAmkAIs5+CWZ4a6nJEE3dB+FulBUGEp3TilSQdR15Cfz7wtiaRaiLcNn1J7pg3A== x-ms-exchange-antispam-messagedata: vffYA+KBj6R/xM+urVeRzVoga/YBb1MWBy1G9LWMkohlFM9GujLtqojJHnB0NSXPNKeJ+UfgfCnjeHg681CPdLyIGckC5rsOa64pSL0iDCNVae7Rzbk3M8j6b53neyeuAGmokRT0MIrMIIgwjdW24ngPxQZzlbSDvu+gyVak2iRgeZwj3S3x9Z9eKZPhTQISFxVtc3MM7kEeCLmF6ggYUg== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BL0PR2101MB1027DAD1C277DF2255F4795AA3C70BL0PR2101MB1027_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 06efce0b-eb1c-4af7-0642-08d7d7874249 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Apr 2020 04:27:02.7064 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: bkqmOiCJG6lQVnMzomyFZy3AcBE1hMecH9RU/oxvFJOXWw62Us8aqDSaOn/T80DT8zB3LbfOeRnyN6G/WiSelToo6FEPmjUHCIBbQDLFu2Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR2101MB0913 Archived-At: Subject: Re: [Rats] Processing Endorsements and Evidence into Results X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2020 04:27:07 -0000 --_000_BL0PR2101MB1027DAD1C277DF2255F4795AA3C70BL0PR2101MB1027_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RGVidWctZGlzYWJsZSBpcyBub3QgKGluIGdlbmVyYWwsIGJ1dCBjYW4gYmUgaW4gc3BlY2lmaWMg Y2FzZXMpIHBlcm1hbmVudCBmb3IgYSBkZXZpY2UsIGl0IGNhbiB2YXJ5IGJ5IGFwcGxpY2F0aW9u IG9uIHRoZSBzYW1lIGRldmljZSwNCmFuZCBjYW4gdmFyeSBvdmVyIHRpbWUgYXMgc2F5IHNvZnR3 YXJlL2Zpcm13YXJlIGlzIHBhdGNoZWQgb3IgY29uZmlndXJlZCwgc28gY2Fubm90IGluIHRoYXQg Y2FzZSBiZSBpbiBhbiBlbmRvcnNlbWVudC4NCg0KQWxzbyBJIHdvdWxkIGV4cGVjdCB0aGF0IGVu ZG9yc2VtZW50cyBnZW5lcmFsbHkgYWxzbyBjYXJyeSBzb21lIHNvcnQgb2YgZXhwaXJhdGlvbiBv ciB2YWxpZGl0eSBwZXJpb2QgYXMgd2VsbCwgd2hpY2ggaXNu4oCZdCBpbiBMYXVyZW5jZeKAmXMg ZXhhbXBsZS4NCihBbmQgZXhwaXJhdGlvbiB0aW1lIGlzIGFuIGV4YW1wbGUgb2Ygc29tZXRoaW5n IHRoYXQgZXF1YWxpdHkgY29tcGFyaXNvbiBhZ2FpbnN0IGEg4oCca25vd24gZ29vZCB2YWx1ZeKA nSBkb2VzbuKAmXQgd29yayBmb3IuKQ0KDQpEYXZlDQoNCkZyb206IFJBVFMgPHJhdHMtYm91bmNl c0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIFNtaXRoLCBOZWQNClNlbnQ6IFRodXJzZGF5LCBBcHJp bCAyLCAyMDIwIDk6MjAgUE0NClRvOiBMYXVyZW5jZSBMdW5kYmxhZGUgPGxnbEBpc2xhbmQtcmVz b3J0LmNvbT47IHJhdHNAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbUmF0c10gUHJvY2Vzc2luZyBF bmRvcnNlbWVudHMgYW5kIEV2aWRlbmNlIGludG8gUmVzdWx0cw0KDQpCVFc6IFNpbmNlIOKAmGRl YnVnLWRpc2FibGXigJkgaXMgcGVybWFuZW50IGl0IGNvdWxkIHByb2JhYmx5IGVxdWFsbHkgYmUg aW5jbHVkZWQgaW4gRW5kb3JzZW1lbnQuDQpJdCBpcyBhbHNvIHJlYXNvbmFibGUgdGhhdCBWZXJp ZmllciBjb3VsZCBkb3duZ3JhZGUg4oCYc2VjdXJpdHkgbGV2ZWzigJkgYmFzZWQgb24gb3RoZXIg Y2xhaW1zIGFuZCBob3cgdGhleSByZWxhdGUgdG8gcG9saWNpZXMuIFNlY3VyaXR5IGxldmVsIGlu IEV2aWRlbmNlIGlzIGFuIGFzc2VydGlvbiB0aGUgYXR0ZXN0ZXIgbWFrZXMgdGhhdCBoYXMgdG8g YmUgc3Vic3RhbnRpYXRlZCBpbiBzb21lIHdheS4gSXQgY291bGQgYWxzbyBiZSB1c2VkIGV4Y2x1 c2l2ZWx5IGFzIGEgY29uY2x1c2lvbiBpbiBSZXN1bHRzIGJhc2VkIG9uIHJldmlldyBvZiBhIGJ1 bmNoIG9mIG90aGVyIGNsYWltcyAoaW4gb3RoZXIgd29yZHMgQXR0ZXN0YXRpb24gUmVzdWx0cyBj b2xkIGFjcXVpcmUgYWRkaXRpb25hbCBjbGFpbXMgYmV5b25kIHdoYXQgb3JpZ2luYWxseSBleGlz dGVkIGluIHRoZSBpbnRlcnNlY3Rpb24gb2YgRXZpZGVuY2UgYW5kIEVuZG9yc2VtZW50Lg0KDQpQ b2xpY2llcyBhbmQgb3Igc3RhbmRhcmRpemVkIHByb2ZpbGVzIGRlY2lkZSBhbGwgdGhlc2UgdmFy aWFibGVzIElNSE8uDQoNCkJ1dCB0aGUgZXhhbXBsZSBzZWVtcyB0byBiZSBpbGx1c3RyYXRpdmUg KGlmIHRoYXQgd2FzIHRoZSBpbnRlbnQpLg0KDQotTmVkDQoNCkZyb206IFJBVFMgPHJhdHMtYm91 bmNlc0BpZXRmLm9yZzxtYWlsdG86cmF0cy1ib3VuY2VzQGlldGYub3JnPj4gb24gYmVoYWxmIG9m IExhdXJlbmNlIEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNs YW5kLXJlc29ydC5jb20+Pg0KRGF0ZTogVGh1cnNkYXksIEFwcmlsIDIsIDIwMjAgYXQgNDoxNiBQ TQ0KVG86ICJyYXRzQGlldGYub3JnPG1haWx0bzpyYXRzQGlldGYub3JnPiIgPHJhdHNAaWV0Zi5v cmc8bWFpbHRvOnJhdHNAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtSYXRzXSBQcm9jZXNzaW5n IEVuZG9yc2VtZW50cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzDQoNCkxldCBtZSBtYWtlIHRo aXMgbXVjaCBtb3JlIGNvbmNyZXRlIHdpdGggYW4gZXhhbXBsZS4gSeKAmW0gdXNpbmcgSlNPTiBy ZXByZXNlbnRhdGlvbiBvZiBDV1QvRUFUL0VuZG9yc2VtZW50cyB3aXRoIEMtc3R5bGUgY29tbWVu dHMgZm9yIHJlYWRpbmcgZWFzZS4NCg0KRW5kb3JzZW1lbnQNCnsNCiAgICDigJx0cnVzdC1ldmlk ZW5jZeKAnTog4oCcYWxs4oCdLCAgICAgICAgICAgLy8gRTAsIEkganVzdCBtYWRlIHRoaXMgdXAN CiAgICDigJxmaWVsZC11cGdyYWRhYmxl4oCdOiB0cnVlLCAgICAgICAgICAvLyBFMSwgZnJvbSBk cmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KICAgIOKAnHNoaWVsZGVkLXNl Y3JldOKAnTogaW50ZXJuYWwsICAgICAgIC8vIEUyLCBmcm9tIGRyYWZ0LWJpcmtob2x6LXJhdHMt ZW5kb3JzZW1lbnQtZWF0LTAwDQogICAg4oCcY29tbW9uLWNyaXRlcmlh4oCdOiBodHRwczovL3d3 dy5jb21tb25jcml0ZXJpYXBvcnRhbC5vcmcvZmlsZXMvZXBmaWxlcy8wODc5VjNhX3BkZi5wZGY8 aHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBz JTNBJTJGJTJGd3d3LmNvbW1vbmNyaXRlcmlhcG9ydGFsLm9yZyUyRmZpbGVzJTJGZXBmaWxlcyUy RjA4NzlWM2FfcGRmLnBkZiZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3 QzQ4MDliNmFiZjE3MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIwMTQyMSZzZGF0YT1FNjl0QUNxTVht bEhkbmplQlU5WThjRFQ1REpBd0hvMCUyQjdmQUlndnRVNHMlM0QmcmVzZXJ2ZWQ9MD7igJ0sICAg ICAgLy8gRTMsIGZyb20gZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDANCn0N Cg0KRXZpZGVuY2UNCnsNCiAgICDigJxpYXQiOiA1NzM0ODczNDA5ODIzLCAgICAgICAgICAgICAg Ly8gQzEgdGltZSBzdGFtcCBmb3IgZXZpZGVuY2UgY3JlYXRpb24gdGltZShlZykgZnJvbSBFQVQg ZHJhZnQNCiAgICDigJxzZWN1cml0eS1sZXZlbOKAnTogNCAgICAgICAgICAgICAgICAvLyBDMiB0 aGUgc2VjdXJpdHkgbGV2ZWwgaXMg4oCcaGFyZHdhcmXigJ0gZnJvbSBFQVQgZHJhZnQNCiAgICDi gJxkZWJ1Zy1kaXNhYmxl4oCdOiDigJxwZXJtYW5lbnTigJ0gICAgICAgLy8gQzMgZGVidWcgaXMg cGVybWFuZW50bHkgZGlzYWJsZWQgZm9yIGFsbCBidXQgdGhlIE9FTSBmcm9tIEVBVCBkcmFmdA0K fQ0KDQpSZXN1bHRzDQp7DQogICAg4oCcZmllbGQtdXBncmFkYWJsZeKAnTogdHJ1ZSwgICAgICAg ICAgLy8gUjEsIGZyb20gZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDANCiAg ICDigJxzaGllbGRlZC1zZWNyZXTigJ06IGludGVybmFsLCAgICAgICAvLyBSMiwgZnJvbSBkcmFm dC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KICAgIOKAnGNvbW1vbi1jcml0ZXJp YeKAnTogaHR0cHM6Ly93d3cuY29tbW9uY3JpdGVyaWFwb3J0YWwub3JnL2ZpbGVzL2VwZmlsZXMv MDg3OVYzYV9wZGYucGRmPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9v ay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5jb21tb25jcml0ZXJpYXBvcnRhbC5vcmclMkZm aWxlcyUyRmVwZmlsZXMlMkYwODc5VjNhX3BkZi5wZGYmZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0 MG1pY3Jvc29mdC5jb20lN0M0ODA5YjZhYmYxNzI0NTIzNGU3YTA4ZDdkNzg2NTFiMyU3QzcyZjk4 OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcyMTQ4NDQ3OTMyMDE0MjEm c2RhdGE9RTY5dEFDcU1YbWxIZG5qZUJVOVk4Y0RUNURKQXdIbzAlMkI3ZkFJZ3Z0VTRzJTNEJnJl c2VydmVkPTA+4oCdLCAgICAgIC8vIFIzLCBmcm9tIGRyYWZ0LWJpcmtob2x6LXJhdHMtZW5kb3Jz ZW1lbnQtZWF0LTAwDQogICAg4oCcaWF0IjogNTczNDg3MzQwOTgyMywgICAgICAgICAgICAgIC8v IFI0IHRpbWUgc3RhbXAgZm9yIGV2aWRlbmNlIGNyZWF0aW9uIHRpbWUoZWcpDQogICAg4oCcc2Vj dXJpdHktbGV2ZWzigJ06IDQgICAgICAgICAgICAgICAgLy8gUjUgdGhlIHNlY3VyaXR5IGxldmVs IGlzIOKAnGhhcmR3YXJl4oCdDQogICAg4oCcZGVidWctZGlzYWJsZeKAnTog4oCccGVybWFuZW50 4oCdICAgICAgIC8vIFI2IGRlYnVnIGlzIHBlcm1hbmVudGx5IGRpc2FibGVkIGZvciBhbGwgYnV0 IHRoZSBPRU0NCn0NCg0KSW4gdGhpcyBleGFtcGxlLCB0aGUgUlAgaXMgcHJvYmFibHkgZmVlZGlu ZyB0aGlzIGludG8gYSByaXNrIGVuZ2luZSBzbyB0aGV5IHdhbnQgYWxsIHRoZSBkZXRhaWxzLg0K DQoNCkhlcmXigJlzIGFub3RoZXIgdmVyeSBhYmJyZXZpYXRlZCBleGFtcGxlIHdpdGggbWFkZSB1 cCBjbGFpbSBuYW1lczoNCg0KRW5kb3JzZW1lbnQgKG5vdCBzaG93aW5nIGFueSBzaWduaW5nKQ0K ew0KICAgIOKAnGV4cGVjdGVkLWhhc2jigJ06IOKAnFRXRnVJR2x6SUdScGMzUnBibWQxYVhOb1pX UXNJRzV2ZENCdmJteDVJR0o1SUdocGN5QnlaV+KAnQ0KfQ0KDQpFdmlkZW5jZQ0Kew0KICAgIOKA nGFjdHVhbC1oYXNo4oCdOiDigJxUV0Z1SUdseklHUnBjM1JwYm1kMWFYTm9aV1FzSUc1dmRDQnZi bXg1SUdKNUlHaHBjeUJ5WlciDQp9DQoNClJlc3VsdHMNCnsNCiAgICDigJx2ZXJpZmllZOKAnTog dHJ1ZSwNCn0NCg0KVGhpcyBhbGwgc2VlbXMgbGlrZSB0aGUgZXZlbnR1YWwgbG9naWNhbCByZXN1 bHQgb2YgdGhlIEVBVCwgZW5kb3JzZW1lbnRzIGFuZCBhcmNoaXRlY3R1cmUgZHJhZnRzIHRvIG1l Lg0KDQpMTA0KDQoNCg0KDQpPbiBBcHIgMiwgMjAyMCwgYXQgMTI6MzYgUE0sIExhdXJlbmNlIEx1 bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5j b20+PiB3cm90ZToNCg0KTm93IHRoYXQgd2UgaGF2ZSBhIGZpcnN0IGRyYWZ0IGRlc2NyaWJpbmcg ZW5kb3JzZW1lbnRzPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5j b20vP3VybD1odHRwcyUzQSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRtbCUyRmRyYWZ0LWJpcmto b2x6LXJhdHMtZW5kb3JzZW1lbnQtZWF0LTAwJmRhdGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNy b3NvZnQuY29tJTdDNDgwOWI2YWJmMTcyNDUyMzRlN2EwOGQ3ZDc4NjUxYjMlN0M3MmY5ODhiZjg2 ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE0ODQ0NzkzMjExNDIzJnNkYXRh PThaUHkzbnkwN0EzRk8lMkJIbjNmQ3JXbkNvVUtCYklrS2h4YkNNdkY1SmJsOCUzRCZyZXNlcnZl ZD0wPiwgYW5kIHRoZXkgbG9vayBsaWtlIEV2aWRlbmNlIGFuZCBSZXN1bHRzLCBpdCBzZWVtcyBp bnRlcmVzdGluZyB0byBjb25zaWRlciBzb21lIG9mIGhvdyB0aGUgdmVyaWZpZXIgdXNlcyBFbmRv cnNlbWVudHMgKHJlZmVyZW5jZSB0aGUgYXJjaGl0ZWN0dXJlIGRpYWdyYW0gYmVsb3cpLg0KDQpM ZXTigJlzIHNheSB0aGVyZSBhcmUgdGhyZWUgdGhpbmdzIGluIHRoZSBlbmRvcnNlbWVudCwgRTEs IEUyIGFuZCBFMywgdGhyZWUgdGhpbmdzIGluIHRoZSBldmlkZW5jZSwgQzEsIEMyIGFuZCBDMyBh bmQgdGhyZWUgaW4gdGhlIHJlc3VsdHMsIFIxLCBSMiBhbmQgUjMuDQoNClRoZW4gdGhyZWUgc2lt cGxldG9uIHRvcC1sZXZlbCBjYXNlczoNCg0KMSkgQW4gRW5kb3JzZW1lbnQgaXMgcGFzc2VkIHRo cm91Z2ggYW5kIGJlY29tZXMgYSByZXN1bHQ6IEUxIOKAlCA+IFIxDQoyKSBBIENsYWltIGlzIHBh c3NlZCB0aHJvdWdoIGFuZCBiZWNvbWVzIGEgcmVzdWx0czogQzEg4oCUPiBSMg0KMykgU29tZSBl bmRvcnNlbWVudHMgY29tYmluZSB3aXRoIHNvbWUgY2xhaW1zIHRvIGJlY29tZSBhIHJlc3VsdDog e0UyLCBFMywgQzIsIEMzfSDigJQ+IFIzDQoNCkhvd2V2ZXIgdGhhdCBzZWVtcyB0byBiZSB0b28g c2ltcGxlIGFuZCBJIHRoaW5rIHRoZXJlIGhhcyB0byBiZSBzb21lIHNvcnQgb2YgYSBwcmltaXRp dmUgZW5kb3JzZW1lbnQsIGNhbGwgaXQgRTAsIHdob3NlIHNlbWFudGljcyBhcmUgdGhhdCBzb21l IG9yIGFsbCBvZiB0aGUgY2xhaW1zIGNhbiBhbHdheXMgYmUgYmVsaWV2ZWQuIEkgdGhpbmsgdGhh dCBtZWFucyAyKSBkb2VzbuKAmXQgcmVhbGx5IGV4aXN0LCBidXQgaGFzIHRvIGJlIHRoaXM6DQoN CjIpIFNvbWUgY2xhaW1zIGNhbiBwYXNzIHRocm91Z2ggd2l0aCB0aGUgdXNlIG9mIHRoZSBwcmlt aXRpdmUgRTAgZW5kb3JzZW1lbnQ6IHtFMCwgQzF9IOKAlD4gUjINCg0KT25lIHdheSBFMCBjb3Vs ZCBiZSBkZWZpbmVkIGluIHRoZSBkcmFmdCBkZXNjcmliaW5nIGVuZG9yc2VtZW50czxodHRwczov L25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYl MkZ0b29scy5pZXRmLm9yZyUyRmh0bWwlMkZkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50 LWVhdC0wMCZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3QzQ4MDliNmFi ZjE3MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRi NDclN0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIxMTQyMyZzZGF0YT04WlB5M255MDdBM0ZPJTJCSG4z ZkNyV25Db1VLQmJJa0toeGJDTXZGNUpibDglM0QmcmVzZXJ2ZWQ9MD4gaXMgdGhhdCBpdCBpcyBh IGxpc3Qgb2YgdGhlIGxhYmVscyBvZiBjbGFpbXMgdGhhdCBhcmUgdHJ1c3RlZCB0byBiZSBwYXNz ZWQgdGhyb3VnaC4gRm9yIG51bWVyaWMgbGFiZWxzICBhIHJhbmdlIElOVDY0X01BWCB0byBJTlQ2 NF9NSU4gKG9yIC1pbmZpbml0eSB0byAraW5maW5pdHkpICBpbmRpY2F0ZXMgYWxsIGNsYWltcyBh cmUgdHJ1c3RlZC4gSXQgY291bGQgYWxzbyBsaXN0IHNwZWNpZmljIG9uZXMgdGhhdCBhcmUgdHJ1 c3RlZC4NCg0KRnJvbSB0aGUgVEVFLCBGSURPIGFuZCBBbmRyb2lkIEF0dGVzdGF0aW9uIHZpZXdz IG9mIHRoZSB3b3JsZCB3aGVyZSBtZWFzdXJlbWVudHMgYXJlbuKAmXQgYSBwcmltYXJ5IHRoaW5n IGFuZCBzZWN1cmUvdHJ1c3RlZCBib290IGlzIHJlcXVpcmVkIGFuZCBhbHdheXMgb24sIGEgY29t bW9uIG1vZGVsIHdpbGwgYmUgdG8gcGFzcyBldmVyeXRoaW5nIHRocm91Z2ggdG8gY3JlYXRlIGFu IGFnZ3JlZ2F0ZSByZXN1bHQuIEl0IGNvdWxkIGJlIHJlcHJlc2VudGVkIHRoaXMgd2F5Og0KDQpF MS0+UjENCkUyLT5SMg0KRTMtPlIzDQp7RTAsQzF9LT5SNA0Ke0UwLEMyfS0+UjUNCntFMCxDM30t PlI2DQoNCkkgdGhpbmsgdGhpcyBnb2VzIG9uIHRvIHN1Ym1vZHVsZXMgdG9vIGFuZCBoYXMgc29t ZSByZWxhdGlvbiB0byB0aGUgYXR0ZW1wdGVkIHRvIHByb3Bvc2UgYSBjb25uZWN0aW9uIHR5cGUu ICBFbmRvcnNlbWVudHMgbWF5IGJlIGFibGUgdG8gc2F5IGhvdyBzdWJtb2R1bGVzIGFyZSB0cnVz dGVkLiBUaGVyZSBtaWdodCBldmVuIGJlIGFuIEUwMCBwcmltaXRpdmUgdGhhdCBzYXlzIHRoZSBs ZWFkIGF0dGVzdGVyIGlzIGFsbG93ZWQgdG8gc2F5IGhvdyBzdWJtb2R1bGVzIGFyZSB0cnVzdGVk LiBUaGlzIHdob2xlIGxpbmUgb2YgdGhpbmtpbmcgd2FzIHBhcnRseSBwcm9tcHRlZCBieSB0aGlz IGlzc3VlPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3Vy bD1odHRwcyUzQSUyRiUyRmdpdGh1Yi5jb20lMkZpZXRmLXJhdHMtd2clMkZlYXQlMkZpc3N1ZXMl MkY1OCZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3QzQ4MDliNmFiZjE3 MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIyMTQxNCZzZGF0YT11WFgzdGpaQ29jUFVxRUk0N0JvRFBI VmFTT1dhQXNzRGpsU1daZ1kwZlp3JTNEJnJlc2VydmVkPTA+IGFnYWluc3QgRUFUIGFuZCBjb21t ZW50cyBmcm9tIEdpcmkgYW5kIERhdmUuDQoNCkxMDQoNCg0KDQogICAgICAgICAgICAgICAgICoq KioqKioqKioqKiAgICoqKioqKioqKioqKiAgICAqKioqKioqKioqKioqKioqKg0KDQogICAgICAg ICAgICAgICAgICogRW5kb3JzZXIgKiAgICogVmVyaWZpZXIgKiAgICAqIFJlbHlpbmcgUGFydHkg Kg0KDQogICAgICAgICAgICAgICAgICoqKioqKioqKioqKiAgICogIE93bmVyICAgKiAgICAqICBP d25lciAgICAgICAgKg0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICoqKioqKioq KioqKiAgICAqKioqKioqKioqKioqKioqKg0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAg ICAgICAgICAgIHwgICAgICAgICAgICAgICAgIHwNCg0KICAgICAgICAgICBFbmRvcnNlbWVudHN8 ICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICB8DQoNCiAgICAgICAgICAgICAgICAgICAg ICAgfCAgICAgICAgICAgICAgfEFwcHJhaXNhbCAgICAgICAgfA0KDQogICAgICAgICAgICAgICAg ICAgICAgIHwgICAgICAgICAgICAgIHxQb2xpY3kgZm9yICAgICAgIHwNCg0KICAgICAgICAgICAg ICAgICAgICAgICB8ICAgICAgICAgICAgICB8RXZpZGVuY2UgICAgICAgICB8IEFwcHJhaXNhbA0K DQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAg IHwgUG9saWN5IGZvcg0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgIHwg ICAgICAgICAgICAgICAgIHwgQXR0ZXN0YXRpb24NCg0KICAgICAgICAgICAgICAgICAgICAgICB8 ICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICB8ICBSZXN1bHQNCg0KICAgICAgICAgICAg ICAgICAgICAgICB2ICAgICAgICAgICAgICB2ICAgICAgICAgICAgICAgICB8DQoNCiAgICAgICAg ICAgICAgICAgICAgIC4tLS0tLS0tLS0tLS0tLS0tLS4gICAgICAgICAgICAgICAgfA0KDQogICAg ICAgICAgICAgIC4tLS0tLT58ICAgICBWZXJpZmllciAgICB8LS0tLS0tLiAgICAgICAgIHwNCg0K ICAgICAgICAgICAgICB8ICAgICAgJy0tLS0tLS0tLS0tLS0tLS0tJyAgICAgIHwgICAgICAgICB8 DQoNCiAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAg ICAgfA0KDQogICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgIEF0dGVzdGF0aW9ufCAg ICAgICAgIHwNCg0KICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICBSZXN1bHRzICAg IHwgICAgICAgICB8DQoNCiAgICAgICAgICAgICAgfCBFdmlkZW5jZSAgICAgICAgICAgICAgICAg ICAgICB8ICAgICAgICAgfA0KDQogICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAgICAgIHwNCg0KICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHYgICAgICAgICB2DQoNCiAgICAgICAgLi0tLS0tLS0tLS0uICAgICAgICAg ICAgICAgICAgICAgIC4tLS0tLS0tLS0tLS0tLS0tLS4NCg0KICAgICAgICB8IEF0dGVzdGVyIHwg ICAgICAgICAgICAgICAgICAgICAgfCBSZWx5aW5nIFBhcnR5ICAgfA0KDQogICAgICAgICctLS0t LS0tLS0tJyAgICAgICAgICAgICAgICAgICAgICAnLS0tLS0tLS0tLS0tLS0tLS0nDQoNCg0KDQoN Cg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpS QVRTIG1haWxpbmcgbGlzdA0KUkFUU0BpZXRmLm9yZzxtYWlsdG86UkFUU0BpZXRmLm9yZz4NCmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0cw0KDQo= --_000_BL0PR2101MB1027DAD1C277DF2255F4795AA3C70BL0PR2101MB1027_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5Ok1lbmxvOw0KCXBh bm9zZS0xOjAgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAu TXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCglt YXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpwcmUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFBy ZWZvcm1hdHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN Cglmb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bhbi5I VE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQg Q2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFBy ZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29sYXM7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsN Cglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUy MA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ291cmllciBOZXci Ow0KCWNvbG9yOndpbmRvd3RleHQ7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6 bm9ybWFsOw0KCXRleHQtZGVjb3JhdGlvbjpub25lIG5vbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjEN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxl PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIg c3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48 eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQi IGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+ DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNs YXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMxRjQ5N0QiPkRlYnVnLWRpc2FibGUgaXMgbm90IChpbiBnZW5lcmFsLCBidXQgY2FuIGJl IGluIHNwZWNpZmljIGNhc2VzKSBwZXJtYW5lbnQgZm9yIGEgZGV2aWNlLCBpdCBjYW4gdmFyeSBi eSBhcHBsaWNhdGlvbiBvbiB0aGUgc2FtZSBkZXZpY2UsPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPmFuZCBjYW4g dmFyeSBvdmVyIHRpbWUgYXMgc2F5IHNvZnR3YXJlL2Zpcm13YXJlIGlzIHBhdGNoZWQgb3IgY29u ZmlndXJlZCwgc28gY2Fubm90IGluIHRoYXQgY2FzZSBiZSBpbiBhbiBlbmRvcnNlbWVudC48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkFsc28gSSB3b3VsZCBleHBlY3QgdGhh dCBlbmRvcnNlbWVudHMgZ2VuZXJhbGx5IGFsc28gY2Fycnkgc29tZSBzb3J0IG9mIGV4cGlyYXRp b24gb3IgdmFsaWRpdHkgcGVyaW9kIGFzIHdlbGwsIHdoaWNoIGlzbuKAmXQgaW4gTGF1cmVuY2Xi gJlzIGV4YW1wbGUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPihBbmQgZXhwaXJhdGlvbiB0aW1lIGlzIGFuIGV4 YW1wbGUgb2Ygc29tZXRoaW5nIHRoYXQgZXF1YWxpdHkgY29tcGFyaXNvbiBhZ2FpbnN0IGEg4oCc a25vd24gZ29vZCB2YWx1ZeKAnSBkb2VzbuKAmXQgd29yayBmb3IuKTxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+RGF2ZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpz b2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IFJBVFMgJmx0O3JhdHMtYm91bmNlc0BpZXRmLm9yZyZn dDsgPGI+T24gQmVoYWxmIE9mIDwvYj4NClNtaXRoLCBOZWQ8YnI+DQo8Yj5TZW50OjwvYj4gVGh1 cnNkYXksIEFwcmlsIDIsIDIwMjAgOToyMCBQTTxicj4NCjxiPlRvOjwvYj4gTGF1cmVuY2UgTHVu ZGJsYWRlICZsdDtsZ2xAaXNsYW5kLXJlc29ydC5jb20mZ3Q7OyByYXRzQGlldGYub3JnPGJyPg0K PGI+U3ViamVjdDo8L2I+IFJlOiBbUmF0c10gUHJvY2Vzc2luZyBFbmRvcnNlbWVudHMgYW5kIEV2 aWRlbmNlIGludG8gUmVzdWx0czxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5CVFc6 IFNpbmNlIOKAmGRlYnVnLWRpc2FibGXigJkgaXMgcGVybWFuZW50IGl0IGNvdWxkIHByb2JhYmx5 IGVxdWFsbHkgYmUgaW5jbHVkZWQgaW4gRW5kb3JzZW1lbnQuDQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPkl0IGlzIGFsc28gcmVhc29uYWJsZSB0aGF0IFZlcmlmaWVyIGNv dWxkIGRvd25ncmFkZSDigJhzZWN1cml0eSBsZXZlbOKAmSBiYXNlZCBvbiBvdGhlciBjbGFpbXMg YW5kIGhvdyB0aGV5IHJlbGF0ZSB0byBwb2xpY2llcy4gU2VjdXJpdHkgbGV2ZWwgaW4gRXZpZGVu Y2UgaXMgYW4gYXNzZXJ0aW9uIHRoZSBhdHRlc3RlciBtYWtlcyB0aGF0IGhhcyB0bw0KIGJlIHN1 YnN0YW50aWF0ZWQgaW4gc29tZSB3YXkuIEl0IGNvdWxkIGFsc28gYmUgdXNlZCBleGNsdXNpdmVs eSBhcyBhIGNvbmNsdXNpb24gaW4gUmVzdWx0cyBiYXNlZCBvbiByZXZpZXcgb2YgYSBidW5jaCBv ZiBvdGhlciBjbGFpbXMgKGluIG90aGVyIHdvcmRzIEF0dGVzdGF0aW9uIFJlc3VsdHMgY29sZCBh Y3F1aXJlIGFkZGl0aW9uYWwgY2xhaW1zIGJleW9uZCB3aGF0IG9yaWdpbmFsbHkgZXhpc3RlZCBp biB0aGUgaW50ZXJzZWN0aW9uIG9mIEV2aWRlbmNlDQogYW5kIEVuZG9yc2VtZW50LjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij5Qb2xpY2llcyBhbmQgb3Igc3RhbmRhcmRpemVkIHByb2ZpbGVzIGRl Y2lkZSBhbGwgdGhlc2UgdmFyaWFibGVzIElNSE8uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPkJ1 dCB0aGUgZXhhbXBsZSBzZWVtcyB0byBiZSBpbGx1c3RyYXRpdmUgKGlmIHRoYXQgd2FzIHRoZSBp bnRlbnQpLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4tTmVkPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBw dCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+UkFUUyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJh dHMtYm91bmNlc0BpZXRmLm9yZyI+cmF0cy1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgb24gYmVo YWxmIG9mIExhdXJlbmNlIEx1bmRibGFkZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxnbEBpc2xhbmQt cmVzb3J0LmNvbSI+bGdsQGlzbGFuZC1yZXNvcnQuY29tPC9hPiZndDs8YnI+DQo8Yj5EYXRlOiA8 L2I+VGh1cnNkYXksIEFwcmlsIDIsIDIwMjAgYXQgNDoxNiBQTTxicj4NCjxiPlRvOiA8L2I+JnF1 b3Q7PGEgaHJlZj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPnJhdHNAaWV0Zi5vcmc8L2E+JnF1b3Q7 ICZsdDs8YSBocmVmPSJtYWlsdG86cmF0c0BpZXRmLm9yZyI+cmF0c0BpZXRmLm9yZzwvYT4mZ3Q7 PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbUmF0c10gUHJvY2Vzc2luZyBFbmRvcnNlbWVudHMg YW5kIEV2aWRlbmNlIGludG8gUmVzdWx0czxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MZXQgbWUgbWFrZSB0aGlzIG11Y2ggbW9yZSBjb25jcmV0 ZSB3aXRoIGFuIGV4YW1wbGUuIEnigJltIHVzaW5nIEpTT04gcmVwcmVzZW50YXRpb24gb2YgQ1dU L0VBVC9FbmRvcnNlbWVudHMgd2l0aCBDLXN0eWxlIGNvbW1lbnRzIGZvciByZWFkaW5nIGVhc2Uu DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx1PkVuZG9y c2VtZW50PC91PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij57 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDsgJm5ic3A7IOKAnHRydXN0LWV2aWRlbmNl4oCdOiDigJxhbGzigJ0sICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgLy8gRTAsIEkganVzdCBtYWRlIHRoaXMgdXA8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg 4oCcZmllbGQtdXBncmFkYWJsZeKAnTogdHJ1ZSwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOy8vIEUxLCBmcm9tJm5ic3A7ZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1l YXQtMDA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDsg4oCcc2hpZWxkZWQtc2VjcmV04oCdOiBpbnRlcm5hbCwgJm5ic3A7ICZu YnNwOyAmbmJzcDsgLy8gRTIsIGZyb20mbmJzcDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2Vt ZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+Jm5ic3A7ICZuYnNwOyDigJxjb21tb24tY3JpdGVyaWHigJ06DQo8YSBocmVmPSJodHRw czovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0El MkYlMkZ3d3cuY29tbW9uY3JpdGVyaWFwb3J0YWwub3JnJTJGZmlsZXMlMkZlcGZpbGVzJTJGMDg3 OVYzYV9wZGYucGRmJmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3 QzQ4MDliNmFiZjE3MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIwMTQyMSZhbXA7c2RhdGE9RTY5dEFD cU1YbWxIZG5qZUJVOVk4Y0RUNURKQXdIbzAlMkI3ZkFJZ3Z0VTRzJTNEJmFtcDtyZXNlcnZlZD0w Ij4NCmh0dHBzOi8vd3d3LmNvbW1vbmNyaXRlcmlhcG9ydGFsLm9yZy9maWxlcy9lcGZpbGVzLzA4 NzlWM2FfcGRmLnBkZjwvYT7igJ0sICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gRTMsIGZyb20mbmJz cDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHU+RXZpZGVuY2U8L3U+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPns8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg 4oCcaWF0JnF1b3Q7OiA1NzM0ODczNDA5ODIzLCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsvLyBDMSB0aW1lIHN0YW1wIGZvciBldmlkZW5jZSBjcmVhdGlv biB0aW1lKGVnKSBmcm9tIEVBVCBkcmFmdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxzZWN1cml0eS1sZXZlbOKAnTog NCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 Ly8gQzIgdGhlIHNlY3VyaXR5IGxldmVsIGlzIOKAnGhhcmR3YXJl4oCdJm5ic3A7ZnJvbSBFQVQg ZHJhZnQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDsg4oCcZGVidWctZGlzYWJsZeKAnTog4oCccGVybWFuZW504oCdICZuYnNw OyAmbmJzcDsgJm5ic3A7IC8vIEMzIGRlYnVnIGlzIHBlcm1hbmVudGx5IGRpc2FibGVkIGZvciBh bGwgYnV0IHRoZSBPRU0mbmJzcDtmcm9tIEVBVCBkcmFmdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHU+UmVzdWx0czwvdT48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ezwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg 4oCcZmllbGQtdXBncmFkYWJsZeKAnTogdHJ1ZSwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOy8vIFIxLCBmcm9tJm5ic3A7ZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1l YXQtMDA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDsg4oCcc2hpZWxkZWQtc2VjcmV04oCdOiBpbnRlcm5hbCwgJm5ic3A7ICZu YnNwOyAmbmJzcDsgLy8gUjIsIGZyb20mbmJzcDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2Vt ZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+Jm5ic3A7ICZuYnNwOyDigJxjb21tb24tY3JpdGVyaWHigJ06DQo8YSBocmVmPSJodHRw czovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0El MkYlMkZ3d3cuY29tbW9uY3JpdGVyaWFwb3J0YWwub3JnJTJGZmlsZXMlMkZlcGZpbGVzJTJGMDg3 OVYzYV9wZGYucGRmJmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3 QzQ4MDliNmFiZjE3MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIwMTQyMSZhbXA7c2RhdGE9RTY5dEFD cU1YbWxIZG5qZUJVOVk4Y0RUNURKQXdIbzAlMkI3ZkFJZ3Z0VTRzJTNEJmFtcDtyZXNlcnZlZD0w Ij4NCmh0dHBzOi8vd3d3LmNvbW1vbmNyaXRlcmlhcG9ydGFsLm9yZy9maWxlcy9lcGZpbGVzLzA4 NzlWM2FfcGRmLnBkZjwvYT7igJ0sICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gUjMsIGZyb20mbmJz cDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg 4oCcaWF0JnF1b3Q7OiA1NzM0ODczNDA5ODIzLCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsvLyBSNCB0aW1lIHN0YW1wIGZvciBldmlkZW5jZSBjcmVhdGlv biB0aW1lKGVnKTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+Jm5ic3A7ICZuYnNwOyDigJxzZWN1cml0eS1sZXZlbOKAnTogNCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gUjUgdGhlIHNlY3Vy aXR5IGxldmVsIGlzIOKAnGhhcmR3YXJl4oCdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnGRlYnVnLWRpc2FibGXigJ06 IOKAnHBlcm1hbmVudOKAnSAmbmJzcDsgJm5ic3A7ICZuYnNwOyAvLyBSNiBkZWJ1ZyBpcyBwZXJt YW5lbnRseSBkaXNhYmxlZCBmb3IgYWxsIGJ1dCB0aGUgT0VNPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPn08L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4g dGhpcyBleGFtcGxlLCB0aGUgUlAgaXMgcHJvYmFibHkgZmVlZGluZyB0aGlzIGludG8gYSByaXNr IGVuZ2luZSBzbyB0aGV5IHdhbnQgYWxsIHRoZSBkZXRhaWxzLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhlcmXigJlzIGFub3RoZXIgdmVy eSBhYmJyZXZpYXRlZCBleGFtcGxlIHdpdGggbWFkZSB1cCBjbGFpbSBuYW1lczo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx1PkVu ZG9yc2VtZW50IChub3Qgc2hvd2luZyBhbnkgc2lnbmluZyk8L3U+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPns8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg4oCcZXhwZWN0ZWQtaGFzaOKA nTog4oCcVFdGdUlHbHpJR1JwYzNScGJtZDFhWE5vWldRc0lHNXZkQ0J2Ym14NUlHSjVJR2hwY3lC eVpX4oCdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ij59PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48dT5FdmlkZW5jZTwvdT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+ezwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxhY3R1YWwtaGFzaOKAnTog4oCcVFdGdUlHbHpJR1Jw YzNScGJtZDFhWE5vWldRc0lHNXZkQ0J2Ym14NUlHSjVJR2hwY3lCeVpXJnF1b3Q7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij59PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dT5SZXN1 bHRzPC91PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij57PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ Jm5ic3A7ICZuYnNwOyDigJx2ZXJpZmllZOKAnTogdHJ1ZSwgJm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij59PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+VGhpcyBhbGwgc2VlbXMgbGlrZSB0aGUgZXZlbnR1YWwgbG9naWNhbCByZXN1bHQgb2YgdGhl IEVBVCwgZW5kb3JzZW1lbnRzIGFuZCBhcmNoaXRlY3R1cmUgZHJhZnRzIHRvIG1lLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MTDxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gQXByIDIsIDIwMjAsIGF0IDEyOjM2IFBNLCBMYXVy ZW5jZSBMdW5kYmxhZGUgJmx0OzxhIGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20i PmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5vdyZuYnNwO3RoYXQgd2UgaGF2ZSBh IGZpcnN0Jm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5v dXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdG9vbHMuaWV0Zi5vcmclMkZodG1sJTJGZHJh ZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDAmYW1wO2RhdGE9MDIlN0MwMSU3Q2R0 aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDNDgwOWI2YWJmMTcyNDUyMzRlN2EwOGQ3ZDc4NjUxYjMl N0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE0ODQ0Nzkz MjExNDIzJmFtcDtzZGF0YT04WlB5M255MDdBM0ZPJTJCSG4zZkNyV25Db1VLQmJJa0toeGJDTXZG NUpibDglM0QmYW1wO3Jlc2VydmVkPTAiPmRyYWZ0DQogZGVzY3JpYmluZyBlbmRvcnNlbWVudHM8 L2E+LCBhbmQgdGhleSBsb29rIGxpa2UgRXZpZGVuY2UgYW5kIFJlc3VsdHMsIGl0IHNlZW1zIGlu dGVyZXN0aW5nIHRvIGNvbnNpZGVyIHNvbWUgb2YgaG93IHRoZSB2ZXJpZmllciB1c2VzIEVuZG9y c2VtZW50cyAocmVmZXJlbmNlIHRoZSBhcmNoaXRlY3R1cmUgZGlhZ3JhbSBiZWxvdykuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkxldOKAmXMg c2F5IHRoZXJlIGFyZSB0aHJlZSB0aGluZ3MgaW4gdGhlIGVuZG9yc2VtZW50LCBFMSwgRTIgYW5k IEUzLCB0aHJlZSB0aGluZ3MgaW4gdGhlIGV2aWRlbmNlLCBDMSwgQzIgYW5kIEMzIGFuZCB0aHJl ZSBpbiB0aGUgcmVzdWx0cywgUjEsIFIyIGFuZCBSMy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlbiB0aHJlZSBzaW1wbGV0b24gdG9wLWxl dmVsIGNhc2VzOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdp bi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjEpIEFuIEVuZG9y c2VtZW50IGlzIHBhc3NlZCB0aHJvdWdoIGFuZCBiZWNvbWVzIGEgcmVzdWx0OiBFMSDigJQgJmd0 OyBSMTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ MikgQSBDbGFpbSBpcyBwYXNzZWQgdGhyb3VnaCBhbmQgYmVjb21lcyBhIHJlc3VsdHM6IEMxIOKA lCZndDsgUjI8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjMpIFNvbWUgZW5kb3JzZW1lbnRzIGNvbWJpbmUgd2l0aCBzb21lIGNsYWltcyB0byBiZWNv bWUgYSByZXN1bHQ6IHtFMiwgRTMsIEMyLCBDM30g4oCUJmd0OyBSMzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ib3dl dmVyIHRoYXQgc2VlbXMgdG8gYmUgdG9vIHNpbXBsZSBhbmQgSSB0aGluayB0aGVyZSBoYXMgdG8g YmUgc29tZSBzb3J0IG9mIGEgcHJpbWl0aXZlIGVuZG9yc2VtZW50LCBjYWxsIGl0IEUwLCB3aG9z ZSBzZW1hbnRpY3MgYXJlIHRoYXQgc29tZSBvciBhbGwgb2YgdGhlIGNsYWltcyBjYW4gYWx3YXlz IGJlIGJlbGlldmVkLiBJIHRoaW5rIHRoYXQgbWVhbnMgMikgZG9lc27igJl0IHJlYWxseSBleGlz dCwgYnV0DQogaGFzIHRvIGJlIHRoaXM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1y aWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjIpIFNvbWUgY2xhaW1zIGNhbiBwYXNzIHRocm91Z2ggd2l0aCB0aGUgdXNlIG9m IHRoZSBwcmltaXRpdmUgRTAgZW5kb3JzZW1lbnQ6IHtFMCwgQzF9IOKAlCZndDsgUjI8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5PbmUgd2F5IEUwIGNvdWxkIGJlIGRlZmluZWQgaW4gdGhlJm5ic3A7PGEg aHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJs PWh0dHBzJTNBJTJGJTJGdG9vbHMuaWV0Zi5vcmclMkZodG1sJTJGZHJhZnQtYmlya2hvbHotcmF0 cy1lbmRvcnNlbWVudC1lYXQtMDAmYW1wO2RhdGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3Nv ZnQuY29tJTdDNDgwOWI2YWJmMTcyNDUyMzRlN2EwOGQ3ZDc4NjUxYjMlN0M3MmY5ODhiZjg2ZjE0 MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE0ODQ0NzkzMjExNDIzJmFtcDtzZGF0 YT04WlB5M255MDdBM0ZPJTJCSG4zZkNyV25Db1VLQmJJa0toeGJDTXZGNUpibDglM0QmYW1wO3Jl c2VydmVkPTAiPmRyYWZ0DQogZGVzY3JpYmluZyBlbmRvcnNlbWVudHM8L2E+Jm5ic3A7aXMgdGhh dCBpdCBpcyBhIGxpc3Qgb2YgdGhlIGxhYmVscyBvZiBjbGFpbXMgdGhhdCBhcmUgdHJ1c3RlZCB0 byBiZSBwYXNzZWQgdGhyb3VnaC4gRm9yIG51bWVyaWMgbGFiZWxzICZuYnNwO2EgcmFuZ2UmbmJz cDs8c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5OiZxdW90O01lbmxvJnF1 b3Q7LHNlcmlmO2NvbG9yOiMwMDc0MDA7YmFja2dyb3VuZDp3aGl0ZSI+SU5UNjRfTUFYPC9zcGFu PiZuYnNwO3RvJm5ic3A7PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZhbWlseTom cXVvdDtNZW5sbyZxdW90OyxzZXJpZjtjb2xvcjojMDA3NDAwO2JhY2tncm91bmQ6d2hpdGUiPklO VDY0X01JTiZuYnNwOzwvc3Bhbj4ob3INCiAtaW5maW5pdHkgdG8gJiM0MztpbmZpbml0eSkgJm5i c3A7aW5kaWNhdGVzIGFsbCBjbGFpbXMgYXJlIHRydXN0ZWQuIEl0IGNvdWxkIGFsc28gbGlzdCBz cGVjaWZpYyBvbmVzIHRoYXQgYXJlIHRydXN0ZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZyb20gdGhlIFRFRSwgRklETyBhbmQgQW5kcm9p ZCBBdHRlc3RhdGlvbiB2aWV3cyBvZiB0aGUgd29ybGQgd2hlcmUgbWVhc3VyZW1lbnRzIGFyZW7i gJl0IGEgcHJpbWFyeSB0aGluZyBhbmQgc2VjdXJlL3RydXN0ZWQgYm9vdCBpcyByZXF1aXJlZCBh bmQgYWx3YXlzIG9uLCBhIGNvbW1vbiBtb2RlbCB3aWxsIGJlIHRvIHBhc3MgZXZlcnl0aGluZyB0 aHJvdWdoIHRvIGNyZWF0ZSBhbiBhZ2dyZWdhdGUgcmVzdWx0Lg0KIEl0IGNvdWxkIGJlIHJlcHJl c2VudGVkIHRoaXMgd2F5OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGlu O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+RTEtJmd0O1IxPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5FMi0mZ3Q7 UjI8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPkUz LSZndDtSMzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+e0UwLEMxfS0mZ3Q7UjQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDsiPntFMCxDMn0tJmd0O1I1PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij57RTAsQzN9LSZndDtSNjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SSB0aGluayB0aGlzIGdvZXMgb24gdG8gc3VibW9kdWxlcyB0b28gYW5kIGhhcyBzb21lIHJlbGF0 aW9uIHRvIHRoZSBhdHRlbXB0ZWQgdG8gcHJvcG9zZSBhIGNvbm5lY3Rpb24gdHlwZS4gJm5ic3A7 RW5kb3JzZW1lbnRzIG1heSBiZSBhYmxlIHRvIHNheSBob3cgc3VibW9kdWxlcyBhcmUgdHJ1c3Rl ZC4gVGhlcmUgbWlnaHQgZXZlbiBiZSBhbiBFMDAgcHJpbWl0aXZlIHRoYXQgc2F5cyB0aGUgbGVh ZCBhdHRlc3RlciBpcw0KIGFsbG93ZWQgdG8gc2F5IGhvdyBzdWJtb2R1bGVzIGFyZSB0cnVzdGVk LiBUaGlzIHdob2xlIGxpbmUgb2YgdGhpbmtpbmcgd2FzIHBhcnRseSBwcm9tcHRlZCBieSB0aGlz Jm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29r LmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmlldGYtcmF0cy13ZyUyRmVhdCUy Rmlzc3VlcyUyRjU4JmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3 QzQ4MDliNmFiZjE3MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIyMTQxNCZhbXA7c2RhdGE9dVhYM3Rq WkNvY1BVcUVJNDdCb0RQSFZhU09XYUFzc0RqbFNXWmdZMGZadyUzRCZhbXA7cmVzZXJ2ZWQ9MCI+ aXNzdWU8L2E+Jm5ic3A7YWdhaW5zdA0KIEVBVCBhbmQgY29tbWVudHMgZnJvbSBHaXJpIGFuZCBE YXZlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5MTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9ImJyZWFr LWJlZm9yZTogcGFnZSI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICoq KioqKioqKioqKiZuYnNwOyZuYnNwOyAqKioqKioqKioqKiombmJzcDsmbmJzcDsmbmJzcDsgKioq KioqKioqKioqKioqKio8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgKiBFbmRvcnNlciAqJm5ic3A7Jm5ic3A7ICogVmVyaWZpZXIg KiZuYnNwOyZuYnNwOyZuYnNwOyAqIFJlbHlpbmcgUGFydHkgKjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAqKioqKioqKioqKiom bmJzcDsmbmJzcDsgKiZuYnNwOyBPd25lciZuYnNwOyZuYnNwOyAqJm5ic3A7Jm5ic3A7Jm5ic3A7 ICombmJzcDsgT3duZXImbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg KjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICoqKioqKioqKioqKiZuYnNwOyZuYnNwOyZu YnNwOyAqKioqKioqKioqKioqKioqKjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBFbmRvcnNlbWVudHN8 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IHxBcHByYWlzYWwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHxQb2xpY3kgZm9yJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg fCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8RXZpZGVuY2UgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7fCBBcHByYWlzYWw8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwgUG9saWN5IGZvcjxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCBBdHRlc3RhdGlvbjxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyBSZXN1bHQ8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDt2Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpw PjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgLi0tLS0tLS0tLS0tLS0tLS0tLiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IC4tLS0tLSZndDt8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFZlcmlmaWVyJm5ic3A7 Jm5ic3A7Jm5ic3A7IHwtLS0tLS0uJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAnLS0tLS0tLS0tLS0tLS0tLS0nJm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgJm5ic3A7fDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IEF0dGVzdGF0aW9ufCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgUmVzdWx0cyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgfCBFdmlkZW5jZSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt2Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IHY8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLi0tLS0tLS0tLS0uJm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC4tLS0t LS0tLS0tLS0tLS0tLS48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCBBdHRlc3RlciB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwgUmVseWlu ZyBQYXJ0eSZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICctLS0tLS0tLS0tJyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAn LS0tLS0tLS0tLS0tLS0tLS0nPG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fPGJyPg0KUkFUUyBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVm PSJtYWlsdG86UkFUU0BpZXRmLm9yZyI+UkFUU0BpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3JhdHMiPmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0czwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_BL0PR2101MB1027DAD1C277DF2255F4795AA3C70BL0PR2101MB1027_-- From nobody Fri Apr 3 11:00:11 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0B0C3A09AF for ; Fri, 3 Apr 2020 11:00:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.797 X-Spam-Level: X-Spam-Status: No, score=-1.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9pyhLZbr-EeV for ; Fri, 3 Apr 2020 11:00:06 -0700 (PDT) Received: from p3plsmtpa09-02.prod.phx3.secureserver.net (p3plsmtpa09-02.prod.phx3.secureserver.net [173.201.193.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 750793A09B4 for ; Fri, 3 Apr 2020 11:00:06 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id KQbtjws0BQG23KQbtjctUk; Fri, 03 Apr 2020 11:00:05 -0700 X-CMAE-Analysis: v=2.3 cv=Z+CS40ZA c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=0XtbOteLAAAA:20 a=7CQSdrXTAAAA:8 a=48vgC7mUAAAA:8 a=K6EGIJCdAAAA:8 a=03-ksFfLAAAA:8 a=UqCG9HQmAAAA:8 a=yMhMjlubAAAA:8 a=u4ooS7Ln3TBKnMoUDKkA:9 a=5EQvnLYBJ7oI5zDb:21 a=lUdfWMBVHWRQBj5x:21 a=QEXdDO2ut3YA:10 a=y9xj3q3fsdtBesVT9jcA:9 a=Dls7fpq71dqwZQc5:21 a=KChdqQdhosJ53ZFt:21 a=UpUzhoANeXLIUn2-:21 a=_W_S_7VecoQA:10 a=a-qgeE7W1pNrGK8U0ZQC:22 a=w1C3t2QeGrPiZgrLijVG:22 a=L6pVIi0Kn1GYQfi8-iRI:22 a=xzjcLgdzzKJd7D42GW5i:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_9511321B-B3D3-4106-BF4F-75BD681E62D5" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 3 Apr 2020 11:00:04 -0700 In-Reply-To: Cc: Ned Smith , "rats@ietf.org" To: Dave Thaler References: X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfLPHr8y81/cJCjBQYead463rvlWl4JB7uOa2zIVQvd6hjs6uIsLvnQsSF+8t2MZQ07dKSVuoorrhEbE3FFQ8NaIHueE6sTEs3MRL9iAZ7+eIs2lOzoK0 PzlRPbpPvSCnOzRlGQ80JR+/fWR6pt2723NLJa25mK4AZhNvV4IfweZYPnto5VHoVzR08C0uCF5j5DcqeW61LLxxK+mUhpXH3jrVsWEdqXPSWJI2bxX1bZeH ZrJd0udkKuyT3Auj7pwl5Q== Archived-At: Subject: [Rats] debug disable (was Re: Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2020 18:00:09 -0000 --Apple-Mail=_9511321B-B3D3-4106-BF4F-75BD681E62D5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 The latest debug disable text is here = = in GitHub but not yet in a released draft. The =E2=80=9Cpermanent disable=E2=80=9D state still allows for the OEM = (and only the OEM) to enable for things like RMA so it couldn't go in an = endorsement. =E2=80=9Cfull permanent disable=E2=80=9D could, but only if = the manufacturer really did it for every chip they shipped. The debug facilities the claim is aimed at are HW and system facilities = like JTAG, scan chain, Arm Coresight = and such.=20 Maybe for some app download systems it might make sense to make the app = an Attestation Target and make claims about that app=E2=80=99s debug = state, but that=E2=80=99s not how debug for SW / apps usually works. = There=E2=80=99s not usually config to turn debug on or off for = individual apps. LL > On Apr 2, 2020, at 9:27 PM, Dave Thaler = wrote: >=20 > Debug-disable is not (in general, but can be in specific cases) = permanent for a device, it can vary by application on the same device, > and can vary over time as say software/firmware is patched or = configured, so cannot in that case be in an endorsement. > =20 > Also I would expect that endorsements generally also carry some sort = of expiration or validity period as well, which isn=E2=80=99t in = Laurence=E2=80=99s example. > (And expiration time is an example of something that equality = comparison against a =E2=80=9Cknown good value=E2=80=9D doesn=E2=80=99t = work for.) > =20 > Dave > =20 > From: RATS On Behalf Of Smith, Ned > Sent: Thursday, April 2, 2020 9:20 PM > To: Laurence Lundblade ; rats@ietf.org > Subject: Re: [Rats] Processing Endorsements and Evidence into Results > =20 > BTW: Since =E2=80=98debug-disable=E2=80=99 is permanent it could = probably equally be included in Endorsement. > It is also reasonable that Verifier could downgrade =E2=80=98security = level=E2=80=99 based on other claims and how they relate to policies. = Security level in Evidence is an assertion the attester makes that has = to be substantiated in some way. It could also be used exclusively as a = conclusion in Results based on review of a bunch of other claims (in = other words Attestation Results cold acquire additional claims beyond = what originally existed in the intersection of Evidence and Endorsement. > =20 > Policies and or standardized profiles decide all these variables IMHO. > =20 > But the example seems to be illustrative (if that was the intent). > =20 > -Ned > =20 > From: RATS > on = behalf of Laurence Lundblade > > Date: Thursday, April 2, 2020 at 4:16 PM > To: "rats@ietf.org " > > Subject: Re: [Rats] Processing Endorsements and Evidence into Results > =20 > Let me make this much more concrete with an example. I=E2=80=99m using = JSON representation of CWT/EAT/Endorsements with C-style comments for = reading ease. > =20 > Endorsement > { > =E2=80=9Ctrust-evidence=E2=80=9D: =E2=80=9Call=E2=80=9D, = // E0, I just made this up > =E2=80=9Cfield-upgradable=E2=80=9D: true, // E1, from = draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Cshielded-secret=E2=80=9D: internal, // E2, from = draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Ccommon-criteria=E2=80=9D: = https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.pdf = =E2=80=9D, // E3, = from draft-birkholz-rats-endorsement-eat-00 > } > =20 > Evidence > { > =E2=80=9Ciat": 5734873409823, // C1 time stamp for = evidence creation time(eg) from EAT draft > =E2=80=9Csecurity-level=E2=80=9D: 4 // C2 the = security level is =E2=80=9Chardware=E2=80=9D from EAT draft > =E2=80=9Cdebug-disable=E2=80=9D: =E2=80=9Cpermanent=E2=80=9D = // C3 debug is permanently disabled for all but the OEM from EAT draft > } > =20 > Results > { > =E2=80=9Cfield-upgradable=E2=80=9D: true, // R1, from = draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Cshielded-secret=E2=80=9D: internal, // R2, from = draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Ccommon-criteria=E2=80=9D: = https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.pdf = =E2=80=9D, // R3, = from draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Ciat": 5734873409823, // R4 time stamp for = evidence creation time(eg) > =E2=80=9Csecurity-level=E2=80=9D: 4 // R5 the = security level is =E2=80=9Chardware=E2=80=9D > =E2=80=9Cdebug-disable=E2=80=9D: =E2=80=9Cpermanent=E2=80=9D = // R6 debug is permanently disabled for all but the OEM > } > =20 > In this example, the RP is probably feeding this into a risk engine so = they want all the details. > =20 > =20 > Here=E2=80=99s another very abbreviated example with made up claim = names: > =20 > Endorsement (not showing any signing) > { > =E2=80=9Cexpected-hash=E2=80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW=E2=80=9D > } > =20 > Evidence > { > =E2=80=9Cactual-hash=E2=80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW" > } > =20 > Results > { > =E2=80=9Cverified=E2=80=9D: true, =20 > } > =20 > This all seems like the eventual logical result of the EAT, = endorsements and architecture drafts to me. > =20 > LL > =20 > =20 > =20 > =20 >=20 > On Apr 2, 2020, at 12:36 PM, Laurence Lundblade > wrote: > =20 > Now that we have a first draft describing endorsements = , and they look like = Evidence and Results, it seems interesting to consider some of how the = verifier uses Endorsements (reference the architecture diagram below). > =20 > Let=E2=80=99s say there are three things in the endorsement, E1, E2 = and E3, three things in the evidence, C1, C2 and C3 and three in the = results, R1, R2 and R3. > =20 > Then three simpleton top-level cases: > =20 > 1) An Endorsement is passed through and becomes a result: E1 =E2=80=94 = > R1 > 2) A Claim is passed through and becomes a results: C1 =E2=80=94> R2 > 3) Some endorsements combine with some claims to become a result: {E2, = E3, C2, C3} =E2=80=94> R3 > =20 > However that seems to be too simple and I think there has to be some = sort of a primitive endorsement, call it E0, whose semantics are that = some or all of the claims can always be believed. I think that means 2) = doesn=E2=80=99t really exist, but has to be this: > =20 > 2) Some claims can pass through with the use of the primitive E0 = endorsement: {E0, C1} =E2=80=94> R2 > =20 > One way E0 could be defined in the draft describing endorsements = is that it is a list of = the labels of claims that are trusted to be passed through. For numeric = labels a range INT64_MAX to INT64_MIN (or -infinity to +infinity) = indicates all claims are trusted. It could also list specific ones that = are trusted. > =20 > =46rom the TEE, FIDO and Android Attestation views of the world where = measurements aren=E2=80=99t a primary thing and secure/trusted boot is = required and always on, a common model will be to pass everything = through to create an aggregate result. It could be represented this way: > =20 > E1->R1 > E2->R2 > E3->R3 > {E0,C1}->R4 > {E0,C2}->R5 > {E0,C3}->R6 > =20 > I think this goes on to submodules too and has some relation to the = attempted to propose a connection type. Endorsements may be able to say = how submodules are trusted. There might even be an E00 primitive that = says the lead attester is allowed to say how submodules are trusted. = This whole line of thinking was partly prompted by this issue = against EAT and comments from Giri and Dave. > =20 > LL > =20 > =20 > ************ ************ ***************** > * Endorser * * Verifier * * Relying Party * > ************ * Owner * * Owner * > | ************ ***************** > | | | > Endorsements| | | > | |Appraisal | > | |Policy for | > | |Evidence | Appraisal > | | | Policy for > | | | Attestation > | | | Result > v v | > .-----------------. | > .----->| Verifier |------. | > | '-----------------' | | > | | | > | Attestation| | > | Results | | > | Evidence | | > | | | > | v v > .----------. .-----------------. > | Attester | | Relying Party | > '----------' '-----------------' > =20 > =20 > =20 > =20 > =20 > =20 > =20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = > =20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_9511321B-B3D3-4106-BF4F-75BD681E62D5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
The latest debug disable text is here in GitHub but not yet in a released = draft.

The = =E2=80=9Cpermanent disable=E2=80=9D state still allows for the OEM (and = only the OEM) to enable for things like RMA so it couldn't go in an = endorsement. =E2=80=9Cfull permanent disable=E2=80=9D could, but only if = the manufacturer really did it for every chip they shipped.

The debug facilities the = claim is aimed at are HW and system facilities like JTAG, scan = chain, Arm Coresight and such. 

Maybe for some app = download systems it might make sense to make the app an Attestation = Target and make claims about that app=E2=80=99s debug state, but = that=E2=80=99s not how debug for SW / apps usually works. There=E2=80=99s = not usually config to turn debug on or off for individual = apps.

LL


On Apr = 2, 2020, at 9:27 PM, Dave Thaler <dthaler=3D40microsoft.com@dmarc.ietf.org> = wrote:

Debug-disable is not (in = general, but can be in specific cases) permanent for a device, it can = vary by application on the same device,
and can vary over time as = say software/firmware is patched or configured, so cannot in that case = be in an endorsement.
 
Also I would expect that endorsements generally also = carry some sort of expiration or validity period as well, which isn=E2=80=99= t in Laurence=E2=80=99s example.
(And expiration time is an example of something that = equality comparison against a =E2=80=9Cknown good value=E2=80=9D = doesn=E2=80=99t work for.)
 
Dave
 
From: RATS <rats-bounces@ietf.org> On Behalf = Of Smith, Ned
Sent: Thursday, April 2, 2020 = 9:20 PM
To: Laurence Lundblade <lgl@island-resort.com>; rats@ietf.org
Subject: Re: [Rats] Processing = Endorsements and Evidence into Results
 
BTW: Since =E2=80=98debug-disable=E2=80=99 is permanent it = could probably equally be included in Endorsement.
It is also = reasonable that Verifier could downgrade =E2=80=98security level=E2=80=99 = based on other claims and how they relate to policies. Security level in = Evidence is an assertion the attester makes that has to be substantiated = in some way. It could also be used exclusively as a conclusion in = Results based on review of a bunch of other claims (in other words = Attestation Results cold acquire additional claims beyond what = originally existed in the intersection of Evidence and Endorsement.
 
Policies and or standardized profiles decide all these = variables IMHO.
 
But the example seems to be illustrative (if that was the = intent).
 
-Ned
 
From: RATS <rats-bounces@ietf.org> on = behalf of Laurence Lundblade <lgl@island-resort.com>
Date: Thursday, April 2, 2020 = at 4:16 PM
To: "rats@ietf.org" <rats@ietf.org>
Subject: Re: [Rats] Processing = Endorsements and Evidence into Results
 
Let me make this much more concrete with an example. I=E2=80=99= m using JSON representation of CWT/EAT/Endorsements with C-style = comments for reading ease.
 
Endorsement
{
    =E2=80=9Ctrust-evidence= =E2=80=9D: =E2=80=9Call=E2=80=9D,           // = E0, I just made this up
    = =E2=80=9Cfield-upgradable=E2=80=9D: true,         =  // E1, from draft-birkholz-rats-endorsement-eat-00
    =E2=80=9Cshielded-secret=E2=80=9D: internal, =       // E2, = from draft-birkholz-rats-endorsement-eat-00
    =E2=80=9Ccommon-criteria=E2=80=9D: https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.= pdf=E2=80=9D,      // E3, = from draft-birkholz-rats-endorsement-eat-00
}
 
Evidence
{
    =E2=80=9Ciat": = 5734873409823,              // C1 = time stamp for evidence creation time(eg) from EAT draft
    =E2=80=9Csecurity-level=E2=80=9D: 4   =              // C2 the security level = is =E2=80=9Chardware=E2=80=9D from EAT draft
    =E2=80=9Cdebug-disable=E2=80=9D: = =E2=80=9Cpermanent=E2=80=9D       // C3 debug is = permanently disabled for all but the OEM from EAT draft
}
 
Results
{
    = =E2=80=9Cfield-upgradable=E2=80=9D: true,         =  // R1, from draft-birkholz-rats-endorsement-eat-00
    =E2=80=9Cshielded-secret=E2=80=9D: internal, =       // R2, = from draft-birkholz-rats-endorsement-eat-00
    =E2=80=9Ccommon-criteria=E2=80=9D: https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.= pdf=E2=80=9D,      // R3, = from draft-birkholz-rats-endorsement-eat-00
    =E2=80=9Ciat": = 5734873409823,              // R4 = time stamp for evidence creation time(eg)
    =E2=80=9Csecurity-level=E2=80=9D: 4   =              // R5 the security level = is =E2=80=9Chardware=E2=80=9D
    =E2=80=9Cdebug-disable=E2= =80=9D: =E2=80=9Cpermanent=E2=80=9D       // R6 debug is = permanently disabled for all but the OEM
}
 
In this example, the RP is probably feeding this into a risk = engine so they want all the details.
 
 
Here=E2=80=99s another very abbreviated = example with made up claim names:
 
Endorsement (not showing = any signing)
{
    =E2=80=9Cexpected-hash=E2=80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW=E2=80=9D
}
 
Evidence
{
    =E2=80=9Cactual-hash=E2= =80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW"
}
 
Results
{
    =E2=80=9Cverified=E2=80= =9D: true,  
}
 
This all seems like the eventual logical result of the EAT, = endorsements and architecture drafts to me.
 
LL
    
 
 

 

On Apr 2, 2020, at 12:36 PM, Laurence Lundblade <lgl@island-resort.com> = wrote:
 
Now that we have a first draft = describing endorsements, and they look like Evidence and Results, it = seems interesting to consider some of how the verifier uses Endorsements = (reference the architecture diagram below).
 
Let=E2=80=99s say there are three = things in the endorsement, E1, E2 and E3, three things in the evidence, = C1, C2 and C3 and three in the results, R1, R2 and R3.
 
Then three simpleton top-level = cases:
 
1) An Endorsement is passed through and becomes a result: E1 = =E2=80=94 > R1
2) A Claim is passed through and = becomes a results: C1 =E2=80=94> R2
3) Some endorsements combine with some claims to become a = result: {E2, E3, C2, C3} =E2=80=94> R3
 
However that seems to be too simple and I think there has to = be some sort of a primitive endorsement, call it E0, whose semantics are = that some or all of the claims can always be believed. I think that = means 2) doesn=E2=80=99t really exist, but has to be this:
 
2) Some claims can pass = through with the use of the primitive E0 endorsement: {E0, C1} =E2=80=94&g= t; R2
 
One way E0 could be defined in the draft = describing endorsements is that it is a list of the labels of = claims that are trusted to be passed through. For numeric labels  a = range INT64_MAX to INT64_MIN (or = -infinity to +infinity)  indicates all claims are trusted. It could = also list specific ones that are trusted.
 
=46rom the TEE, FIDO and Android = Attestation views of the world where measurements aren=E2=80=99t a = primary thing and secure/trusted boot is required and always on, a = common model will be to pass everything through to create an aggregate = result. It could be represented this way:
 
E1->R1
E2->R2
E3->R3
{E0,C1}->R4
{E0,C2}->R5
{E0,C3}->R6
 
I think this goes on to submodules too and has some relation = to the attempted to propose a connection type.  Endorsements may be = able to say how submodules are trusted. There might even be an E00 = primitive that says the lead attester is allowed to say how submodules = are trusted. This whole line of thinking was partly prompted by = this issue against EAT and = comments from Giri and Dave.
 
LL
 
 
          &nb=
sp;      ************   =
************    *****************
          &nb=
sp;      * Endorser *   * Verifier =
*    * Relying Party *
          &nb=
sp;      ************   *  =
Owner   *    *  =
Owner        *
          &nb=
sp;            =
|        =
************    *****************
          &nb=
sp;            =
|            &=
nbsp; =
|            &=
nbsp;    |
           =
Endorsements|          &=
nbsp;   =
|            &=
nbsp;    |
          &nb=
sp;            =
|            &=
nbsp; |Appraisal        |
          &nb=
sp;            =
|            &=
nbsp; |Policy for       |
          &nb=
sp;            =
|            &=
nbsp; |Evidence         | =
Appraisal
          &nb=
sp;            =
|            &=
nbsp; =
|            &=
nbsp;    | Policy for
          &nb=
sp;            =
|            &=
nbsp; =
|            &=
nbsp;    | Attestation
          &nb=
sp;            =
|            &=
nbsp; =
|            &=
nbsp;    |  Result
          &nb=
sp;            =
v       =
       v     &=
nbsp;           |
          &nb=
sp;          =
.-----------------.         &=
nbsp;      |
          &nb=
sp;   .----->|     =
Verifier    =
|------.         |
          &nb=
sp;   |      =
'-----------------'      =
|         |
          &nb=
sp;   =
|            &=
nbsp;           &nb=
sp;      =
|         |
          &nb=
sp;   =
|            &=
nbsp;       =
Attestation|         |
          &nb=
sp;   =
|            &=
nbsp;       Results    =
|         |
          &nb=
sp;   | =
Evidence           =
           =
|         |
          &nb=
sp;   =
|            &=
nbsp;           &nb=
sp;      =
|         |
          &nb=
sp;   |      =
            &n=
bsp;           &nbs=
p;v         v
        =
.----------.          &n=
bsp;           =
.-----------------.
        | Attester =
|            &=
nbsp;         | Relying =
Party   |
        =
'----------'          &n=
bsp;           =
'-----------------'
 
 
 
 
 
 
 
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats
 
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats
= --Apple-Mail=_9511321B-B3D3-4106-BF4F-75BD681E62D5-- From nobody Fri Apr 3 12:15:03 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98AF83A0755 for ; Fri, 3 Apr 2020 12:15:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eIN5phqfbCmI for ; Fri, 3 Apr 2020 12:14:55 -0700 (PDT) Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2121.outbound.protection.outlook.com [40.107.93.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 847603A0736 for ; Fri, 3 Apr 2020 12:14:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ResSedGCOEwCB6uEWBVkwd7J2jHmmXBQiT3Qx8QgSkGW5FfRxU9ow5eKiBQY9LUbXTQxqlY2ZcssV2RfeU2mpN7EcuRdMzPBD0MCOMRtXbdgIRjZqfwFqkEOyLb0kd09i1ntEFUskYvmvKAxeFUl6ZYTddLAmlZBvXRfUmlcIfOdQHKWp2pULvkOaZmsUfdp2/5F8Z4zPC//UMpREe2w3EIFTaFf4D1BgHGYdUVYjr+LVG6sXtDdG9T0J3suVnghpdIM2lCLuiFs1ITK7MCBQG4XiEBXVUcfXDnWVfJsrxJN6ijXS13Oxabjhs44H39vJtgdGPvLi2BmKzGrabEQDw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HaST79Dj7J9FfugTHdjc6I1fdnAQQGwYSsyS5mOdnoI=; b=kEZfT2EaWrL0CJxq+/16AsivBFzxGPo2d5nK+g+EmyrpjF7h0cUNYItL3A50sEFXGvV1dWCF4cIK9sKRjtIVy8q2EgJzBvEOPN+1BTn7V2DPchZbwqcp5t0l1I2VfGYgbfGODFnnNAgOxpY3eLbeDGoWsgM/uOSjpOuvoHEpYfCk/RvirAo2Y5bRAnwZmLEw4Pf0z0wXjgVWOpwj7xsRq5hWmAJSdYyMlZvnMOcnL0l/FoBnepC4U8cu0hlmOzWuA/gAK4MoIW08CTT0vhDhyI5mmWp9b4Y854WcXLDxWLplatAcf8YTyjM+lkToznPtDR8qabno4UWvcGl9/OzA6w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HaST79Dj7J9FfugTHdjc6I1fdnAQQGwYSsyS5mOdnoI=; b=fERjvhMjaPXVcwsaeS20eeTbUhnJCOEDdQKFacTR0UgPdz27ITGTD3bMUgH47jBGXrUYjQ4JJvNhy4Zn/Kyn7Wj7GjfhTpEafZYIVLtAZ7ezbnabvE0Ed2zk2mjO25ZT4EpPdstlFYOFtMMT38Jw3VNwOCEhpFzBl/RhdAcF1Qs= Received: from MW2PR2101MB1034.namprd21.prod.outlook.com (2603:10b6:302:a::10) by MW2PR2101MB1068.namprd21.prod.outlook.com (2603:10b6:302:a::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.2; Fri, 3 Apr 2020 19:14:46 +0000 Received: from MW2PR2101MB1034.namprd21.prod.outlook.com ([fe80::25fd:d901:ef7d:96e8]) by MW2PR2101MB1034.namprd21.prod.outlook.com ([fe80::25fd:d901:ef7d:96e8%5]) with mapi id 15.20.2900.002; Fri, 3 Apr 2020 19:14:46 +0000 From: Dave Thaler To: Laurence Lundblade CC: Ned Smith , "rats@ietf.org" Thread-Topic: debug disable (was Re: [Rats] Processing Endorsements and Evidence into Results) Thread-Index: AQHWCeIXkEkddm2qr0SPuskB8cHwiKhnxAyA Date: Fri, 3 Apr 2020 19:14:45 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-originating-ip: [2601:600:9780:16f0:9e4:140:d378:ab70] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 8e7c4d7d-d7c6-4c0a-da45-08d7d80345e6 x-ms-traffictypediagnostic: MW2PR2101MB1068:|MW2PR2101MB1068: x-ld-processed: 72f988bf-86f1-41af-91ab-2d7cd011db47,ExtAddr x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:3631; x-forefront-prvs: 0362BF9FDB x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MW2PR2101MB1034.namprd21.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(136003)(376002)(346002)(39860400002)(366004)(396003)(86362001)(54906003)(7696005)(4326008)(8676002)(5660300002)(66476007)(53546011)(52536014)(64756008)(186003)(316002)(55016002)(66556008)(81166006)(9686003)(6506007)(966005)(66446008)(2906002)(81156014)(8936002)(66946007)(10290500003)(71200400001)(76116006)(8990500004)(33656002)(82950400001)(478600001)(82960400001)(6916009)(579004); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ekL4NYu/2EESopCxVshIDBJsnZU9NiJsosKXjAXzQga/Lox4ls9Opc9aovp3FfgH6AI2rOLKlmTgZ6U9K3lE9yoe88HZfsvb57mLsJR27cHTENxHn1/UkiVL5xYV9Ht+7bhh3T4NB63y84SBFsExPl+A1ZCeAwWcHBXQx8E6VxcuTGCZF4fvDqgXroNWEsy0TzAFritqsxFCiIiLljdPVrik1hL+2HPvdoq6iTpYo4PaDHLNqunr88x3uLjnOjHRTqUZifcJUUsBWqSLwgJwBf00xUV7uiRX0knxkO26dbQ8U5iZpm7d1Ip1vhfU2j2OKPrB/1qSKWIkyS+CM+d6TphfG3BmKpVX/3JFxYB0/ARwcoxwqR5aaMq8PnQxjJsGMXD6ryGNcLbhRLtbet2XhihNHvrwZPxzED9ew96oHV8QFJkazda0xbmbnGNi3mL8Gr280yFzZf0H0/f+Z1dSQwnaC6P+xi945ZagtdTj3MMr9aHuclddp0kqb1R5m8stDcQDvIMYVbLRkR5xcsHD8Q== x-ms-exchange-antispam-messagedata: O/MnlzHZalrx9vnsQjt5lJMFfww73a+T60zhWxruvlChCjcnspKIJdxdhdlvFtKuqHgCYeLgkE4wmNrpQkGRymkvTAVcinpz2Ojvj4AFWKMxE4owiVM0oRXi9pstFuS0DyTutKxG6Db/SkiEx6qS7xeQfW8EvtD0MUnTfAKuPh5CC1h69ak6fs98lHggfQOfkFfYseJBq6w+RVbVTicLlg== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MW2PR2101MB1034C4B83AB2A0349B4DE44CA3C70MW2PR2101MB1034_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8e7c4d7d-d7c6-4c0a-da45-08d7d80345e6 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Apr 2020 19:14:46.4203 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: EYd9e3cbKyauvhPuT/bezyTpmMGBqoX4uRzN9Uc6uqCW/SGSxYxmg+v3XsGmmeoOUuPbJK9Tzto3q9DK9nUbvIIIAxLoBgOFn4iFij0x7kc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR2101MB1068 Archived-At: Subject: Re: [Rats] debug disable (was Re: Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2020 19:15:01 -0000 --_000_MW2PR2101MB1034C4B83AB2A0349B4DE44CA3C70MW2PR2101MB1034_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 4oCcdGhhdOKAmXMgbm90IGhvdyBkZWJ1ZyBmb3IgU1cgLyBhcHBzIHVzdWFsbHkgd29ya3MuIFRo ZXJl4oCZcyBub3QgdXN1YWxseSBjb25maWcgdG8gdHVybiBkZWJ1ZyBvbiBvciBvZmYgZm9yIGlu ZGl2aWR1YWwgYXBwcy7igJ0NCg0KSSBjYW4gdGVsbCB5b3UgdGhhdCBJUyBob3cgaXQgd29ya3Mg Zm9yIEludGVsIHByb2Nlc3NvcnMsIGluY2x1ZGluZyBhcHBzIHRoYXQgcnVuIGluIFNHWCBlbmNs YXZlcy4NClNvIOKAnHVzdWFsbHnigJ0gaXMgcGVyaGFwcyBhIG1hdHRlciBvZiBwZXJzcGVjdGl2 ZSwgb3IgYSBtYXR0ZXIgdGhhdCB2YXJpZXMgYnkgY2hpcCB2ZW5kb3IuDQoNCkZyb206IExhdXJl bmNlIEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPg0KU2VudDogRnJpZGF5LCBBcHJp bCAzLCAyMDIwIDExOjAwIEFNDQpUbzogRGF2ZSBUaGFsZXIgPGR0aGFsZXJAbWljcm9zb2Z0LmNv bT4NCkNjOiBOZWQgU21pdGggPG5lZC5zbWl0aEBpbnRlbC5jb20+OyByYXRzQGlldGYub3JnDQpT dWJqZWN0OiBkZWJ1ZyBkaXNhYmxlICh3YXMgUmU6IFtSYXRzXSBQcm9jZXNzaW5nIEVuZG9yc2Vt ZW50cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzKQ0KDQpUaGUgbGF0ZXN0IGRlYnVnIGRpc2Fi bGUgdGV4dCBpcyBoZXJlPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9v ay5jb20vP3VybD1odHRwcyUzQSUyRiUyRmdpdGh1Yi5jb20lMkZpZXRmLXJhdHMtd2clMkZlYXQl MkZibG9iJTJGbWFzdGVyJTJGZHJhZnQtaWV0Zi1yYXRzLWVhdC5tZCZkYXRhPTAyJTdDMDElN0Nk dGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Q2NjMTI1Y2ExYzkwNDQ1ZjE0MzMzMDhkN2Q3ZjhkYTQ1 JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzIxNTMzNjgy MjUyNDY2NyZzZGF0YT1UcTB0eTVaZFVnMkNFUWJycWh4UnMybFN5MkZYUGtTNWt0cGRYZG1Ldmtz JTNEJnJlc2VydmVkPTA+IGluIEdpdEh1YiBidXQgbm90IHlldCBpbiBhIHJlbGVhc2VkIGRyYWZ0 Lg0KDQpUaGUg4oCccGVybWFuZW50IGRpc2FibGXigJ0gc3RhdGUgc3RpbGwgYWxsb3dzIGZvciB0 aGUgT0VNIChhbmQgb25seSB0aGUgT0VNKSB0byBlbmFibGUgZm9yIHRoaW5ncyBsaWtlIFJNQSBz byBpdCBjb3VsZG4ndCBnbyBpbiBhbiBlbmRvcnNlbWVudC4g4oCcZnVsbCBwZXJtYW5lbnQgZGlz YWJsZeKAnSBjb3VsZCwgYnV0IG9ubHkgaWYgdGhlIG1hbnVmYWN0dXJlciByZWFsbHkgZGlkIGl0 IGZvciBldmVyeSBjaGlwIHRoZXkgc2hpcHBlZC4NCg0KVGhlIGRlYnVnIGZhY2lsaXRpZXMgdGhl IGNsYWltIGlzIGFpbWVkIGF0IGFyZSBIVyBhbmQgc3lzdGVtIGZhY2lsaXRpZXMgbGlrZSBKVEFH LCBzY2FuIGNoYWluLCBBcm0gQ29yZXNpZ2h0PGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3Rl Y3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRmRldmVsb3Blci5hcm0uY29tJTJG aXAtcHJvZHVjdHMlMkZzeXN0ZW0taXAlMkZjb3Jlc2lnaHQtZGVidWctYW5kLXRyYWNlJmRhdGE9 MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDY2MxMjVjYTFjOTA0NDVmMTQzMzMw OGQ3ZDdmOGRhNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdD NjM3MjE1MzM2ODIyNTM0NjYyJnNkYXRhPVZXdHBEJTJCVDJCeEl4ZGFtQ3BJS2VzdkdjZXp1aVo5 WG41TnBadW03NklzOCUzRCZyZXNlcnZlZD0wPiBhbmQgc3VjaC4NCg0KTWF5YmUgZm9yIHNvbWUg YXBwIGRvd25sb2FkIHN5c3RlbXMgaXQgbWlnaHQgbWFrZSBzZW5zZSB0byBtYWtlIHRoZSBhcHAg YW4gQXR0ZXN0YXRpb24gVGFyZ2V0IGFuZCBtYWtlIGNsYWltcyBhYm91dCB0aGF0IGFwcOKAmXMg ZGVidWcgc3RhdGUsIGJ1dCB0aGF04oCZcyBub3QgaG93IGRlYnVnIGZvciBTVyAvIGFwcHMgdXN1 YWxseSB3b3Jrcy4gVGhlcmXigJlzIG5vdCB1c3VhbGx5IGNvbmZpZyB0byB0dXJuIGRlYnVnIG9u IG9yIG9mZiBmb3IgaW5kaXZpZHVhbCBhcHBzLg0KDQpMTA0KDQoNCg0KT24gQXByIDIsIDIwMjAs IGF0IDk6MjcgUE0sIERhdmUgVGhhbGVyIDxkdGhhbGVyPTQwbWljcm9zb2Z0LmNvbUBkbWFyYy5p ZXRmLm9yZzxtYWlsdG86ZHRoYWxlcj00MG1pY3Jvc29mdC5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3 cm90ZToNCg0KRGVidWctZGlzYWJsZSBpcyBub3QgKGluIGdlbmVyYWwsIGJ1dCBjYW4gYmUgaW4g c3BlY2lmaWMgY2FzZXMpIHBlcm1hbmVudCBmb3IgYSBkZXZpY2UsIGl0IGNhbiB2YXJ5IGJ5IGFw cGxpY2F0aW9uIG9uIHRoZSBzYW1lIGRldmljZSwNCmFuZCBjYW4gdmFyeSBvdmVyIHRpbWUgYXMg c2F5IHNvZnR3YXJlL2Zpcm13YXJlIGlzIHBhdGNoZWQgb3IgY29uZmlndXJlZCwgc28gY2Fubm90 IGluIHRoYXQgY2FzZSBiZSBpbiBhbiBlbmRvcnNlbWVudC4NCg0KQWxzbyBJIHdvdWxkIGV4cGVj dCB0aGF0IGVuZG9yc2VtZW50cyBnZW5lcmFsbHkgYWxzbyBjYXJyeSBzb21lIHNvcnQgb2YgZXhw aXJhdGlvbiBvciB2YWxpZGl0eSBwZXJpb2QgYXMgd2VsbCwgd2hpY2ggaXNu4oCZdCBpbiBMYXVy ZW5jZeKAmXMgZXhhbXBsZS4NCihBbmQgZXhwaXJhdGlvbiB0aW1lIGlzIGFuIGV4YW1wbGUgb2Yg c29tZXRoaW5nIHRoYXQgZXF1YWxpdHkgY29tcGFyaXNvbiBhZ2FpbnN0IGEg4oCca25vd24gZ29v ZCB2YWx1ZeKAnSBkb2VzbuKAmXQgd29yayBmb3IuKQ0KDQpEYXZlDQoNCkZyb206IFJBVFMgPHJh dHMtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86cmF0cy1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVo YWxmIE9mIFNtaXRoLCBOZWQNClNlbnQ6IFRodXJzZGF5LCBBcHJpbCAyLCAyMDIwIDk6MjAgUE0N ClRvOiBMYXVyZW5jZSBMdW5kYmxhZGUgPGxnbEBpc2xhbmQtcmVzb3J0LmNvbTxtYWlsdG86bGds QGlzbGFuZC1yZXNvcnQuY29tPj47IHJhdHNAaWV0Zi5vcmc8bWFpbHRvOnJhdHNAaWV0Zi5vcmc+ DQpTdWJqZWN0OiBSZTogW1JhdHNdIFByb2Nlc3NpbmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5j ZSBpbnRvIFJlc3VsdHMNCg0KQlRXOiBTaW5jZSDigJhkZWJ1Zy1kaXNhYmxl4oCZIGlzIHBlcm1h bmVudCBpdCBjb3VsZCBwcm9iYWJseSBlcXVhbGx5IGJlIGluY2x1ZGVkIGluIEVuZG9yc2VtZW50 Lg0KSXQgaXMgYWxzbyByZWFzb25hYmxlIHRoYXQgVmVyaWZpZXIgY291bGQgZG93bmdyYWRlIOKA mHNlY3VyaXR5IGxldmVs4oCZIGJhc2VkIG9uIG90aGVyIGNsYWltcyBhbmQgaG93IHRoZXkgcmVs YXRlIHRvIHBvbGljaWVzLiBTZWN1cml0eSBsZXZlbCBpbiBFdmlkZW5jZSBpcyBhbiBhc3NlcnRp b24gdGhlIGF0dGVzdGVyIG1ha2VzIHRoYXQgaGFzIHRvIGJlIHN1YnN0YW50aWF0ZWQgaW4gc29t ZSB3YXkuIEl0IGNvdWxkIGFsc28gYmUgdXNlZCBleGNsdXNpdmVseSBhcyBhIGNvbmNsdXNpb24g aW4gUmVzdWx0cyBiYXNlZCBvbiByZXZpZXcgb2YgYSBidW5jaCBvZiBvdGhlciBjbGFpbXMgKGlu IG90aGVyIHdvcmRzIEF0dGVzdGF0aW9uIFJlc3VsdHMgY29sZCBhY3F1aXJlIGFkZGl0aW9uYWwg Y2xhaW1zIGJleW9uZCB3aGF0IG9yaWdpbmFsbHkgZXhpc3RlZCBpbiB0aGUgaW50ZXJzZWN0aW9u IG9mIEV2aWRlbmNlIGFuZCBFbmRvcnNlbWVudC4NCg0KUG9saWNpZXMgYW5kIG9yIHN0YW5kYXJk aXplZCBwcm9maWxlcyBkZWNpZGUgYWxsIHRoZXNlIHZhcmlhYmxlcyBJTUhPLg0KDQpCdXQgdGhl IGV4YW1wbGUgc2VlbXMgdG8gYmUgaWxsdXN0cmF0aXZlIChpZiB0aGF0IHdhcyB0aGUgaW50ZW50 KS4NCg0KLU5lZA0KDQpGcm9tOiBSQVRTIDxyYXRzLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnJh dHMtYm91bmNlc0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiBMYXVyZW5jZSBMdW5kYmxhZGUgPGxn bEBpc2xhbmQtcmVzb3J0LmNvbTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tPj4NCkRhdGU6 IFRodXJzZGF5LCBBcHJpbCAyLCAyMDIwIGF0IDQ6MTYgUE0NClRvOiAicmF0c0BpZXRmLm9yZzxt YWlsdG86cmF0c0BpZXRmLm9yZz4iIDxyYXRzQGlldGYub3JnPG1haWx0bzpyYXRzQGlldGYub3Jn Pj4NClN1YmplY3Q6IFJlOiBbUmF0c10gUHJvY2Vzc2luZyBFbmRvcnNlbWVudHMgYW5kIEV2aWRl bmNlIGludG8gUmVzdWx0cw0KDQpMZXQgbWUgbWFrZSB0aGlzIG11Y2ggbW9yZSBjb25jcmV0ZSB3 aXRoIGFuIGV4YW1wbGUuIEnigJltIHVzaW5nIEpTT04gcmVwcmVzZW50YXRpb24gb2YgQ1dUL0VB VC9FbmRvcnNlbWVudHMgd2l0aCBDLXN0eWxlIGNvbW1lbnRzIGZvciByZWFkaW5nIGVhc2UuDQoN CkVuZG9yc2VtZW50DQp7DQogICAg4oCcdHJ1c3QtZXZpZGVuY2XigJ06IOKAnGFsbOKAnSwgICAg ICAgICAgIC8vIEUwLCBJIGp1c3QgbWFkZSB0aGlzIHVwDQogICAg4oCcZmllbGQtdXBncmFkYWJs ZeKAnTogdHJ1ZSwgICAgICAgICAgLy8gRTEsIGZyb20gZHJhZnQtYmlya2hvbHotcmF0cy1lbmRv cnNlbWVudC1lYXQtMDANCiAgICDigJxzaGllbGRlZC1zZWNyZXTigJ06IGludGVybmFsLCAgICAg ICAvLyBFMiwgZnJvbSBkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KICAg IOKAnGNvbW1vbi1jcml0ZXJpYeKAnTogaHR0cHM6Ly93d3cuY29tbW9uY3JpdGVyaWFwb3J0YWwu b3JnL2ZpbGVzL2VwZmlsZXMvMDg3OVYzYV9wZGYucGRmPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtz LnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5jb21tb25jcml0 ZXJpYXBvcnRhbC5vcmclMkZmaWxlcyUyRmVwZmlsZXMlMkYwODc5VjNhX3BkZi5wZGYmZGF0YT0w MiU3QzAxJTdDZHRoYWxlciU0MG1pY3Jvc29mdC5jb20lN0NjYzEyNWNhMWM5MDQ0NWYxNDMzMzA4 ZDdkN2Y4ZGE0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2 MzcyMTUzMzY4MjI1MzQ2NjImc2RhdGE9bnNaQzZtdllWOXpsUDd1Uk5NSFFmbUp6MGRRUVY2ckZJ UzRCNkN6SjFEWSUzRCZyZXNlcnZlZD0wPuKAnSwgICAgICAvLyBFMywgZnJvbSBkcmFmdC1iaXJr aG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KfQ0KDQpFdmlkZW5jZQ0Kew0KICAgIOKAnGlh dCI6IDU3MzQ4NzM0MDk4MjMsICAgICAgICAgICAgICAvLyBDMSB0aW1lIHN0YW1wIGZvciBldmlk ZW5jZSBjcmVhdGlvbiB0aW1lKGVnKSBmcm9tIEVBVCBkcmFmdA0KICAgIOKAnHNlY3VyaXR5LWxl dmVs4oCdOiA0ICAgICAgICAgICAgICAgIC8vIEMyIHRoZSBzZWN1cml0eSBsZXZlbCBpcyDigJxo YXJkd2FyZeKAnSBmcm9tIEVBVCBkcmFmdA0KICAgIOKAnGRlYnVnLWRpc2FibGXigJ06IOKAnHBl cm1hbmVudOKAnSAgICAgICAvLyBDMyBkZWJ1ZyBpcyBwZXJtYW5lbnRseSBkaXNhYmxlZCBmb3Ig YWxsIGJ1dCB0aGUgT0VNIGZyb20gRUFUIGRyYWZ0DQp9DQoNClJlc3VsdHMNCnsNCiAgICDigJxm aWVsZC11cGdyYWRhYmxl4oCdOiB0cnVlLCAgICAgICAgICAvLyBSMSwgZnJvbSBkcmFmdC1iaXJr aG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KICAgIOKAnHNoaWVsZGVkLXNlY3JldOKAnTog aW50ZXJuYWwsICAgICAgIC8vIFIyLCBmcm9tIGRyYWZ0LWJpcmtob2x6LXJhdHMtZW5kb3JzZW1l bnQtZWF0LTAwDQogICAg4oCcY29tbW9uLWNyaXRlcmlh4oCdOiBodHRwczovL3d3dy5jb21tb25j cml0ZXJpYXBvcnRhbC5vcmcvZmlsZXMvZXBmaWxlcy8wODc5VjNhX3BkZi5wZGY8aHR0cHM6Ly9u YW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJG d3d3LmNvbW1vbmNyaXRlcmlhcG9ydGFsLm9yZyUyRmZpbGVzJTJGZXBmaWxlcyUyRjA4NzlWM2Ff cGRmLnBkZiZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Q2NjMTI1Y2Ex YzkwNDQ1ZjE0MzMzMDhkN2Q3ZjhkYTQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRi NDclN0MxJTdDMCU3QzYzNzIxNTMzNjgyMjU0NDY1NiZzZGF0YT1sc01Qbkw1bXNFTjF1WDJvdTIl MkZRdHZmczlyTyUyQmpnQWtFU2doZDdmSkRrOCUzRCZyZXNlcnZlZD0wPuKAnSwgICAgICAvLyBS MywgZnJvbSBkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KICAgIOKAnGlh dCI6IDU3MzQ4NzM0MDk4MjMsICAgICAgICAgICAgICAvLyBSNCB0aW1lIHN0YW1wIGZvciBldmlk ZW5jZSBjcmVhdGlvbiB0aW1lKGVnKQ0KICAgIOKAnHNlY3VyaXR5LWxldmVs4oCdOiA0ICAgICAg ICAgICAgICAgIC8vIFI1IHRoZSBzZWN1cml0eSBsZXZlbCBpcyDigJxoYXJkd2FyZeKAnQ0KICAg IOKAnGRlYnVnLWRpc2FibGXigJ06IOKAnHBlcm1hbmVudOKAnSAgICAgICAvLyBSNiBkZWJ1ZyBp cyBwZXJtYW5lbnRseSBkaXNhYmxlZCBmb3IgYWxsIGJ1dCB0aGUgT0VNDQp9DQoNCkluIHRoaXMg ZXhhbXBsZSwgdGhlIFJQIGlzIHByb2JhYmx5IGZlZWRpbmcgdGhpcyBpbnRvIGEgcmlzayBlbmdp bmUgc28gdGhleSB3YW50IGFsbCB0aGUgZGV0YWlscy4NCg0KDQpIZXJl4oCZcyBhbm90aGVyIHZl cnkgYWJicmV2aWF0ZWQgZXhhbXBsZSB3aXRoIG1hZGUgdXAgY2xhaW0gbmFtZXM6DQoNCkVuZG9y c2VtZW50IChub3Qgc2hvd2luZyBhbnkgc2lnbmluZykNCnsNCiAgICDigJxleHBlY3RlZC1oYXNo 4oCdOiDigJxUV0Z1SUdseklHUnBjM1JwYm1kMWFYTm9aV1FzSUc1dmRDQnZibXg1SUdKNUlHaHBj eUJ5WlfigJ0NCn0NCg0KRXZpZGVuY2UNCnsNCiAgICDigJxhY3R1YWwtaGFzaOKAnTog4oCcVFdG dUlHbHpJR1JwYzNScGJtZDFhWE5vWldRc0lHNXZkQ0J2Ym14NUlHSjVJR2hwY3lCeVpXIg0KfQ0K DQpSZXN1bHRzDQp7DQogICAg4oCcdmVyaWZpZWTigJ06IHRydWUsDQp9DQoNClRoaXMgYWxsIHNl ZW1zIGxpa2UgdGhlIGV2ZW50dWFsIGxvZ2ljYWwgcmVzdWx0IG9mIHRoZSBFQVQsIGVuZG9yc2Vt ZW50cyBhbmQgYXJjaGl0ZWN0dXJlIGRyYWZ0cyB0byBtZS4NCg0KTEwNCg0KDQoNCg0KT24gQXBy IDIsIDIwMjAsIGF0IDEyOjM2IFBNLCBMYXVyZW5jZSBMdW5kYmxhZGUgPGxnbEBpc2xhbmQtcmVz b3J0LmNvbTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tPj4gd3JvdGU6DQoNCk5vdyB0aGF0 IHdlIGhhdmUgYSBmaXJzdCBkcmFmdCBkZXNjcmliaW5nIGVuZG9yc2VtZW50czxodHRwczovL25h bTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0 b29scy5pZXRmLm9yZyUyRmh0bWwlMkZkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVh dC0wMCZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Q2NjMTI1Y2ExYzkw NDQ1ZjE0MzMzMDhkN2Q3ZjhkYTQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzNzIxNTMzNjgyMjU0NDY1NiZzZGF0YT1TVzh4SU9PQUVyaE1kakt1TnNOZ0JB UkFaUW1IZk9BUTdIdW9sTzJla1Y0JTNEJnJlc2VydmVkPTA+LCBhbmQgdGhleSBsb29rIGxpa2Ug RXZpZGVuY2UgYW5kIFJlc3VsdHMsIGl0IHNlZW1zIGludGVyZXN0aW5nIHRvIGNvbnNpZGVyIHNv bWUgb2YgaG93IHRoZSB2ZXJpZmllciB1c2VzIEVuZG9yc2VtZW50cyAocmVmZXJlbmNlIHRoZSBh cmNoaXRlY3R1cmUgZGlhZ3JhbSBiZWxvdykuDQoNCkxldOKAmXMgc2F5IHRoZXJlIGFyZSB0aHJl ZSB0aGluZ3MgaW4gdGhlIGVuZG9yc2VtZW50LCBFMSwgRTIgYW5kIEUzLCB0aHJlZSB0aGluZ3Mg aW4gdGhlIGV2aWRlbmNlLCBDMSwgQzIgYW5kIEMzIGFuZCB0aHJlZSBpbiB0aGUgcmVzdWx0cywg UjEsIFIyIGFuZCBSMy4NCg0KVGhlbiB0aHJlZSBzaW1wbGV0b24gdG9wLWxldmVsIGNhc2VzOg0K DQoxKSBBbiBFbmRvcnNlbWVudCBpcyBwYXNzZWQgdGhyb3VnaCBhbmQgYmVjb21lcyBhIHJlc3Vs dDogRTEg4oCUID4gUjENCjIpIEEgQ2xhaW0gaXMgcGFzc2VkIHRocm91Z2ggYW5kIGJlY29tZXMg YSByZXN1bHRzOiBDMSDigJQ+IFIyDQozKSBTb21lIGVuZG9yc2VtZW50cyBjb21iaW5lIHdpdGgg c29tZSBjbGFpbXMgdG8gYmVjb21lIGEgcmVzdWx0OiB7RTIsIEUzLCBDMiwgQzN9IOKAlD4gUjMN Cg0KSG93ZXZlciB0aGF0IHNlZW1zIHRvIGJlIHRvbyBzaW1wbGUgYW5kIEkgdGhpbmsgdGhlcmUg aGFzIHRvIGJlIHNvbWUgc29ydCBvZiBhIHByaW1pdGl2ZSBlbmRvcnNlbWVudCwgY2FsbCBpdCBF MCwgd2hvc2Ugc2VtYW50aWNzIGFyZSB0aGF0IHNvbWUgb3IgYWxsIG9mIHRoZSBjbGFpbXMgY2Fu IGFsd2F5cyBiZSBiZWxpZXZlZC4gSSB0aGluayB0aGF0IG1lYW5zIDIpIGRvZXNu4oCZdCByZWFs bHkgZXhpc3QsIGJ1dCBoYXMgdG8gYmUgdGhpczoNCg0KMikgU29tZSBjbGFpbXMgY2FuIHBhc3Mg dGhyb3VnaCB3aXRoIHRoZSB1c2Ugb2YgdGhlIHByaW1pdGl2ZSBFMCBlbmRvcnNlbWVudDoge0Uw LCBDMX0g4oCUPiBSMg0KDQpPbmUgd2F5IEUwIGNvdWxkIGJlIGRlZmluZWQgaW4gdGhlIGRyYWZ0 IGRlc2NyaWJpbmcgZW5kb3JzZW1lbnRzPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rp b24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRtbCUy RmRyYWZ0LWJpcmtob2x6LXJhdHMtZW5kb3JzZW1lbnQtZWF0LTAwJmRhdGE9MDIlN0MwMSU3Q2R0 aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDY2MxMjVjYTFjOTA0NDVmMTQzMzMwOGQ3ZDdmOGRhNDUl N0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE1MzM2ODIy NTU0NjUzJnNkYXRhPWtpZGpMbmRJbG9uQ3luQWl3ZEtYR2dNZzViSEFVS1BZa1hMJTJCQjJmcHpF MCUzRCZyZXNlcnZlZD0wPiBpcyB0aGF0IGl0IGlzIGEgbGlzdCBvZiB0aGUgbGFiZWxzIG9mIGNs YWltcyB0aGF0IGFyZSB0cnVzdGVkIHRvIGJlIHBhc3NlZCB0aHJvdWdoLiBGb3IgbnVtZXJpYyBs YWJlbHMgIGEgcmFuZ2UgSU5UNjRfTUFYIHRvIElOVDY0X01JTiAob3IgLWluZmluaXR5IHRvICtp bmZpbml0eSkgIGluZGljYXRlcyBhbGwgY2xhaW1zIGFyZSB0cnVzdGVkLiBJdCBjb3VsZCBhbHNv IGxpc3Qgc3BlY2lmaWMgb25lcyB0aGF0IGFyZSB0cnVzdGVkLg0KDQpGcm9tIHRoZSBURUUsIEZJ RE8gYW5kIEFuZHJvaWQgQXR0ZXN0YXRpb24gdmlld3Mgb2YgdGhlIHdvcmxkIHdoZXJlIG1lYXN1 cmVtZW50cyBhcmVu4oCZdCBhIHByaW1hcnkgdGhpbmcgYW5kIHNlY3VyZS90cnVzdGVkIGJvb3Qg aXMgcmVxdWlyZWQgYW5kIGFsd2F5cyBvbiwgYSBjb21tb24gbW9kZWwgd2lsbCBiZSB0byBwYXNz IGV2ZXJ5dGhpbmcgdGhyb3VnaCB0byBjcmVhdGUgYW4gYWdncmVnYXRlIHJlc3VsdC4gSXQgY291 bGQgYmUgcmVwcmVzZW50ZWQgdGhpcyB3YXk6DQoNCkUxLT5SMQ0KRTItPlIyDQpFMy0+UjMNCntF MCxDMX0tPlI0DQp7RTAsQzJ9LT5SNQ0Ke0UwLEMzfS0+UjYNCg0KSSB0aGluayB0aGlzIGdvZXMg b24gdG8gc3VibW9kdWxlcyB0b28gYW5kIGhhcyBzb21lIHJlbGF0aW9uIHRvIHRoZSBhdHRlbXB0 ZWQgdG8gcHJvcG9zZSBhIGNvbm5lY3Rpb24gdHlwZS4gIEVuZG9yc2VtZW50cyBtYXkgYmUgYWJs ZSB0byBzYXkgaG93IHN1Ym1vZHVsZXMgYXJlIHRydXN0ZWQuIFRoZXJlIG1pZ2h0IGV2ZW4gYmUg YW4gRTAwIHByaW1pdGl2ZSB0aGF0IHNheXMgdGhlIGxlYWQgYXR0ZXN0ZXIgaXMgYWxsb3dlZCB0 byBzYXkgaG93IHN1Ym1vZHVsZXMgYXJlIHRydXN0ZWQuIFRoaXMgd2hvbGUgbGluZSBvZiB0aGlu a2luZyB3YXMgcGFydGx5IHByb21wdGVkIGJ5IHRoaXMgaXNzdWU8aHR0cHM6Ly9uYW0wNi5zYWZl bGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNv bSUyRmlldGYtcmF0cy13ZyUyRmVhdCUyRmlzc3VlcyUyRjU4JmRhdGE9MDIlN0MwMSU3Q2R0aGFs ZXIlNDBtaWNyb3NvZnQuY29tJTdDY2MxMjVjYTFjOTA0NDVmMTQzMzMwOGQ3ZDdmOGRhNDUlN0M3 MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE1MzM2ODIyNTU0 NjUzJnNkYXRhPW5hbTFHS0ElMkJOR2MzMUx1Ym5iJTJCc1QyeHFlOUZ0OXZEdHc0djRKTCUyQnJX S2clM0QmcmVzZXJ2ZWQ9MD4gYWdhaW5zdCBFQVQgYW5kIGNvbW1lbnRzIGZyb20gR2lyaSBhbmQg RGF2ZS4NCg0KTEwNCg0KDQoNCiAgICAgICAgICAgICAgICAgKioqKioqKioqKioqICAgKioqKioq KioqKioqICAgICoqKioqKioqKioqKioqKioqDQoNCiAgICAgICAgICAgICAgICAgKiBFbmRvcnNl ciAqICAgKiBWZXJpZmllciAqICAgICogUmVseWluZyBQYXJ0eSAqDQoNCiAgICAgICAgICAgICAg ICAgKioqKioqKioqKioqICAgKiAgT3duZXIgICAqICAgICogIE93bmVyICAgICAgICAqDQoNCiAg ICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgKioqKioqKioqKioqICAgICoqKioqKioqKioq KioqKioqDQoNCiAgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgfCAgICAgICAg ICAgICAgICAgfA0KDQogICAgICAgICAgIEVuZG9yc2VtZW50c3wgICAgICAgICAgICAgIHwgICAg ICAgICAgICAgICAgIHwNCg0KICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAgICB8 QXBwcmFpc2FsICAgICAgICB8DQoNCiAgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAg ICAgfFBvbGljeSBmb3IgICAgICAgfA0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAg ICAgICAgIHxFdmlkZW5jZSAgICAgICAgIHwgQXBwcmFpc2FsDQoNCiAgICAgICAgICAgICAgICAg ICAgICAgfCAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgfCBQb2xpY3kgZm9yDQoNCiAg ICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgfCBB dHRlc3RhdGlvbg0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgIHwgICAg ICAgICAgICAgICAgIHwgIFJlc3VsdA0KDQogICAgICAgICAgICAgICAgICAgICAgIHYgICAgICAg ICAgICAgIHYgICAgICAgICAgICAgICAgIHwNCg0KICAgICAgICAgICAgICAgICAgICAgLi4tLS0t LS0tLS0tLS0tLS0tLS4gICAgICAgICAgICAgICAgfA0KDQogICAgICAgICAgICAgIC4tLS0tLT58 ICAgICBWZXJpZmllciAgICB8LS0tLS0tLiAgICAgICAgIHwNCg0KICAgICAgICAgICAgICB8ICAg ICAgJy0tLS0tLS0tLS0tLS0tLS0tJyAgICAgIHwgICAgICAgICB8DQoNCiAgICAgICAgICAgICAg fCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgfA0KDQogICAgICAgICAg ICAgIHwgICAgICAgICAgICAgICAgICAgIEF0dGVzdGF0aW9ufCAgICAgICAgIHwNCg0KICAgICAg ICAgICAgICB8ICAgICAgICAgICAgICAgICAgICBSZXN1bHRzICAgIHwgICAgICAgICB8DQoNCiAg ICAgICAgICAgICAgfCBFdmlkZW5jZSAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgfA0K DQogICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAg IHwNCg0KICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHYgICAg ICAgICB2DQoNCiAgICAgICAgLi4tLS0tLS0tLS0tLiAgICAgICAgICAgICAgICAgICAgICAuLi0t LS0tLS0tLS0tLS0tLS0tLg0KDQogICAgICAgIHwgQXR0ZXN0ZXIgfCAgICAgICAgICAgICAgICAg ICAgICB8IFJlbHlpbmcgUGFydHkgICB8DQoNCiAgICAgICAgJy0tLS0tLS0tLS0nICAgICAgICAg ICAgICAgICAgICAgICctLS0tLS0tLS0tLS0tLS0tLScNCg0KDQoNCg0KDQoNCg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClJBVFMgbWFpbGluZyBsaXN0 DQpSQVRTQGlldGYub3JnPG1haWx0bzpSQVRTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9yYXRzPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rp b24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4l MkZsaXN0aW5mbyUyRnJhdHMmZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1pY3Jvc29mdC5jb20l N0NjYzEyNWNhMWM5MDQ0NWYxNDMzMzA4ZDdkN2Y4ZGE0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFi MmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcyMTUzMzY4MjI1NjQ2NDcmc2RhdGE9UlI3dFBRb1kx Sm1RZDVNRU9DUXl4eFJzJTJCcENrRXhBaTBCJTJCQjUzYVNKaGclM0QmcmVzZXJ2ZWQ9MD4NCg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClJBVFMgbWFp bGluZyBsaXN0DQpSQVRTQGlldGYub3JnPG1haWx0bzpSQVRTQGlldGYub3JnPg0KaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRzPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtz LnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUy Rm1haWxtYW4lMkZsaXN0aW5mbyUyRnJhdHMmZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1pY3Jv c29mdC5jb20lN0NjYzEyNWNhMWM5MDQ0NWYxNDMzMzA4ZDdkN2Y4ZGE0NSU3QzcyZjk4OGJmODZm MTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcyMTUzMzY4MjI1NjQ2NDcmc2RhdGE9 UlI3dFBRb1kxSm1RZDVNRU9DUXl4eFJzJTJCcENrRXhBaTBCJTJCQjUzYVNKaGclM0QmcmVzZXJ2 ZWQ9MD4NCg0K --_000_MW2PR2101MB1034C4B83AB2A0349B4DE44CA3C70MW2PR2101MB1034_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5Ok1lbmxvOw0KCXBhbm9zZS0xOjAgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KLyogU3R5bGUgRGVm aW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7 bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsN Cglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNv SHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQt ZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxv d2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQpwcmUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1z dHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdp bi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3Vy aWVyIE5ldyI7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0K CXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJ bWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4t bGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIixzZXJpZjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFt ZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXtt c28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1p bHk6Q29uc29sYXM7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFG NDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglm b250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBp bjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0K CXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1s Pg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1s PjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpl eHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVs YXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGlu az0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRleHQtaW5kZW50Oi41aW4iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj7igJw8L3NwYW4+dGhhdOKAmXMgbm90IGhvdyBkZWJ1ZyBmb3IgU1cg LyBhcHBzIHVzdWFsbHkgd29ya3MuIFRoZXJl4oCZcyBub3QgdXN1YWxseSBjb25maWcgdG8gdHVy biBkZWJ1ZyBvbiBvciBvZmYgZm9yIGluZGl2aWR1YWwgYXBwcy7igJ08bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SSBjYW4gdGVsbCB5b3UgdGhhdCBJUyBob3cgaXQgd29ya3MgZm9yIEludGVsIHBy b2Nlc3NvcnMsIGluY2x1ZGluZyBhcHBzIHRoYXQgcnVuIGluIFNHWCBlbmNsYXZlcy48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNvIOKAnHVzdWFsbHnigJ0gaXMgcGVyaGFw cyBhIG1hdHRlciBvZiBwZXJzcGVjdGl2ZSwgb3IgYSBtYXR0ZXIgdGhhdCB2YXJpZXMgYnkgY2hp cCB2ZW5kb3IuPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBp biAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gTGF1cmVuY2UgTHVuZGJsYWRlICZsdDtsZ2xAaXNs YW5kLXJlc29ydC5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBBcHJpbCAzLCAy MDIwIDExOjAwIEFNPGJyPg0KPGI+VG86PC9iPiBEYXZlIFRoYWxlciAmbHQ7ZHRoYWxlckBtaWNy b3NvZnQuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gTmVkIFNtaXRoICZsdDtuZWQuc21pdGhAaW50 ZWwuY29tJmd0OzsgcmF0c0BpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBkZWJ1ZyBkaXNh YmxlICh3YXMgUmU6IFtSYXRzXSBQcm9jZXNzaW5nIEVuZG9yc2VtZW50cyBhbmQgRXZpZGVuY2Ug aW50byBSZXN1bHRzKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5UaGUgbGF0ZXN0IGRlYnVnIGRpc2FibGUgdGV4dCBpcyZuYnNwOzxhIGhyZWY9 Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRw cyUzQSUyRiUyRmdpdGh1Yi5jb20lMkZpZXRmLXJhdHMtd2clMkZlYXQlMkZibG9iJTJGbWFzdGVy JTJGZHJhZnQtaWV0Zi1yYXRzLWVhdC5tZCZhbXA7ZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1p Y3Jvc29mdC5jb20lN0NjYzEyNWNhMWM5MDQ0NWYxNDMzMzA4ZDdkN2Y4ZGE0NSU3QzcyZjk4OGJm ODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcyMTUzMzY4MjI1MjQ2NjcmYW1w O3NkYXRhPVRxMHR5NVpkVWcyQ0VRYnJxaHhSczJsU3kyRlhQa1M1a3RwZFhkbUt2a3MlM0QmYW1w O3Jlc2VydmVkPTAiPmhlcmU8L2E+Jm5ic3A7aW4NCiBHaXRIdWIgYnV0IG5vdCB5ZXQgaW4gYSBy ZWxlYXNlZCBkcmFmdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+VGhlIOKAnHBlcm1hbmVudCBkaXNhYmxl4oCdIHN0YXRlIHN0aWxsIGFsbG93 cyBmb3IgdGhlIE9FTSAoYW5kIG9ubHkgdGhlIE9FTSkgdG8gZW5hYmxlIGZvciB0aGluZ3MgbGlr ZSBSTUEgc28gaXQgY291bGRuJ3QgZ28gaW4gYW4gZW5kb3JzZW1lbnQuIOKAnGZ1bGwgcGVybWFu ZW50IGRpc2FibGXigJ0gY291bGQsIGJ1dCBvbmx5IGlmIHRoZSBtYW51ZmFjdHVyZXIgcmVhbGx5 IGRpZCBpdCBmb3IgZXZlcnkgY2hpcCB0aGV5DQogc2hpcHBlZC48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGRlYnVnIGZhY2lsaXRpZXMg dGhlIGNsYWltIGlzIGFpbWVkIGF0IGFyZSBIVyBhbmQgc3lzdGVtIGZhY2lsaXRpZXMgbGlrZSBK VEFHLCBzY2FuIGNoYWluLCZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnBy b3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRmRldmVsb3Blci5hcm0uY29t JTJGaXAtcHJvZHVjdHMlMkZzeXN0ZW0taXAlMkZjb3Jlc2lnaHQtZGVidWctYW5kLXRyYWNlJmFt cDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Q2NjMTI1Y2ExYzkwNDQ1 ZjE0MzMzMDhkN2Q3ZjhkYTQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0Mx JTdDMCU3QzYzNzIxNTMzNjgyMjUzNDY2MiZhbXA7c2RhdGE9Vld0cEQlMkJUMkJ4SXhkYW1DcElL ZXN2R2NlenVpWjlYbjVOcFp1bTc2SXM4JTNEJmFtcDtyZXNlcnZlZD0wIj5Bcm0NCiBDb3Jlc2ln aHQ8L2E+Jm5ic3A7YW5kIHN1Y2guJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1heWJlIGZvciBzb21lIGFwcCBkb3dubG9hZCBzeXN0 ZW1zIGl0IG1pZ2h0IG1ha2Ugc2Vuc2UgdG8gbWFrZSB0aGUgYXBwIGFuIEF0dGVzdGF0aW9uIFRh cmdldCBhbmQgbWFrZSBjbGFpbXMgYWJvdXQgdGhhdCBhcHDigJlzIGRlYnVnIHN0YXRlLCBidXQg dGhhdOKAmXMgbm90IGhvdyBkZWJ1ZyBmb3IgU1cgLyBhcHBzIHVzdWFsbHkgd29ya3MuIFRoZXJl 4oCZcyBub3QgdXN1YWxseSBjb25maWcgdG8gdHVybiBkZWJ1ZyBvbg0KIG9yIG9mZiBmb3IgaW5k aXZpZHVhbCBhcHBzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5MTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxl PSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk9uIEFwciAyLCAyMDIwLCBhdCA5OjI3IFBNLCBEYXZlIFRoYWxlciAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmR0aGFsZXI9NDBtaWNyb3NvZnQuY29tQGRtYXJjLmlldGYub3JnIj5k dGhhbGVyPTQwbWljcm9zb2Z0LmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPkRlYnVnLWRpc2FibGUgaXMgbm90IChpbiBnZW5lcmFsLCBidXQgY2Fu IGJlIGluIHNwZWNpZmljIGNhc2VzKSBwZXJtYW5lbnQgZm9yIGEgZGV2aWNlLCBpdCBjYW4gdmFy eSBieSBhcHBsaWNhdGlvbiBvbiB0aGUgc2FtZSBkZXZpY2UsPC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPmFuZCBjYW4gdmFyeSBvdmVyIHRp bWUgYXMgc2F5IHNvZnR3YXJlL2Zpcm13YXJlIGlzIHBhdGNoZWQgb3IgY29uZmlndXJlZCwgc28g Y2Fubm90IGluIHRoYXQgY2FzZSBiZSBpbiBhbiBlbmRvcnNlbWVudC48L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkFsc28gSSB3 b3VsZCBleHBlY3QgdGhhdCBlbmRvcnNlbWVudHMgZ2VuZXJhbGx5IGFsc28gY2Fycnkgc29tZSBz b3J0IG9mIGV4cGlyYXRpb24gb3IgdmFsaWRpdHkgcGVyaW9kIGFzIHdlbGwsIHdoaWNoIGlzbuKA mXQgaW4gTGF1cmVuY2XigJlzIGV4YW1wbGUuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPihBbmQgZXhwaXJhdGlvbiB0aW1lIGlzIGFuIGV4 YW1wbGUgb2Ygc29tZXRoaW5nIHRoYXQgZXF1YWxpdHkgY29tcGFyaXNvbiBhZ2FpbnN0IGEg4oCc a25vd24gZ29vZCB2YWx1ZeKAnSBkb2VzbuKAmXQgd29yayBmb3IuKTwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+RGF2ZTwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJz cDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEg MS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+UkFUUw0KICZsdDs8YSBocmVmPSJtYWlsdG86cmF0cy1ib3VuY2Vz QGlldGYub3JnIj5yYXRzLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OzxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlNtaXRoLCBOZWQ8YnI+ DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+VGh1cnNkYXksIEFwcmlsIDIsIDIwMjAgOToyMCBQTTxicj4NCjxiPlRvOjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+TGF1cmVuY2UgTHVu ZGJsYWRlICZsdDs8YSBocmVmPSJtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tIj5sZ2xAaXNs YW5kLXJlc29ydC5jb208L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpyYXRzQGlldGYub3JnIj5y YXRzQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW1JhdHNdIFByb2Nlc3NpbmcgRW5kb3Jz ZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRvIFJlc3VsdHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+QlRXOiBTaW5jZSDigJhkZWJ1Zy1kaXNhYmxl 4oCZIGlzIHBlcm1hbmVudCBpdCBjb3VsZCBwcm9iYWJseSBlcXVhbGx5IGJlIGluY2x1ZGVkIGlu IEVuZG9yc2VtZW50Ljwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5JdCBpcyBh bHNvIHJlYXNvbmFibGUgdGhhdCBWZXJpZmllciBjb3VsZCBkb3duZ3JhZGUg4oCYc2VjdXJpdHkg bGV2ZWzigJkgYmFzZWQgb24gb3RoZXIgY2xhaW1zIGFuZCBob3cgdGhleSByZWxhdGUgdG8gcG9s aWNpZXMuIFNlY3VyaXR5IGxldmVsIGluIEV2aWRlbmNlIGlzIGFuIGFzc2VydGlvbiB0aGUgYXR0 ZXN0ZXINCiBtYWtlcyB0aGF0IGhhcyB0byBiZSBzdWJzdGFudGlhdGVkIGluIHNvbWUgd2F5LiBJ dCBjb3VsZCBhbHNvIGJlIHVzZWQgZXhjbHVzaXZlbHkgYXMgYSBjb25jbHVzaW9uIGluIFJlc3Vs dHMgYmFzZWQgb24gcmV2aWV3IG9mIGEgYnVuY2ggb2Ygb3RoZXIgY2xhaW1zIChpbiBvdGhlciB3 b3JkcyBBdHRlc3RhdGlvbiBSZXN1bHRzIGNvbGQgYWNxdWlyZSBhZGRpdGlvbmFsIGNsYWltcyBi ZXlvbmQgd2hhdCBvcmlnaW5hbGx5IGV4aXN0ZWQgaW4gdGhlDQogaW50ZXJzZWN0aW9uIG9mIEV2 aWRlbmNlIGFuZCBFbmRvcnNlbWVudC48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPlBvbGljaWVzIGFu ZCBvciBzdGFuZGFyZGl6ZWQgcHJvZmlsZXMgZGVjaWRlIGFsbCB0aGVzZSB2YXJpYWJsZXMgSU1I Ty48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPkJ1dCB0aGUgZXhhbXBsZSBzZWVtcyB0byBiZSBpbGx1 c3RyYXRpdmUgKGlmIHRoYXQgd2FzIHRoZSBpbnRlbnQpLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ LU5lZDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0 IDBpbiAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PC9iPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlJB VFMgJmx0OzxhIGhyZWY9Im1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxl PSJjb2xvcjpwdXJwbGUiPnJhdHMtYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+Jmd0Ow0KIG9u IGJlaGFsZiBvZiBMYXVyZW5jZSBMdW5kYmxhZGUgJmx0OzxhIGhyZWY9Im1haWx0bzpsZ2xAaXNs YW5kLXJlc29ydC5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmxnbEBpc2xhbmQtcmVz b3J0LmNvbTwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxiPkRhdGU6PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5UaHVyc2RheSwgQXByaWwgMiwgMjAyMCBh dCA0OjE2IFBNPGJyPg0KPGI+VG86PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPjwvYj4mcXVvdDs8YSBocmVmPSJtYWlsdG86cmF0c0BpZXRmLm9yZyI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cmF0c0BpZXRmLm9yZzwvc3Bhbj48L2E+JnF1b3Q7ICZs dDs8YSBocmVmPSJtYWlsdG86cmF0c0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+cmF0c0BpZXRmLm9yZzwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5SZTogW1JhdHNdIFBy b2Nlc3NpbmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRvIFJlc3VsdHM8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5MZXQgbWUgbWFrZSB0aGlzIG11Y2ggbW9yZSBjb25j cmV0ZSB3aXRoIGFuIGV4YW1wbGUuIEnigJltIHVzaW5nIEpTT04gcmVwcmVzZW50YXRpb24gb2Yg Q1dUL0VBVC9FbmRvcnNlbWVudHMgd2l0aCBDLXN0eWxlIGNvbW1lbnRzIGZvciByZWFkaW5nIGVh c2UuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHU+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5FbmRvcnNlbWVudDwvc3Bhbj48L3U+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ezwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnHRydXN0LWV2aWRlbmNl4oCd OiDigJxhbGzigJ0sICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgLy8gRTAsIEkg anVzdCBtYWRlIHRoaXMgdXA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxmaWVsZC11cGdyYWRhYmxl4oCdOiB0cnVlLCAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gRTEsIGZyb20mbmJzcDtkcmFmdC1i aXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnHNoaWVsZGVkLXNlY3Jl dOKAnTogaW50ZXJuYWwsICZuYnNwOyAmbmJzcDsgJm5ic3A7IC8vIEUyLCBmcm9tJm5ic3A7ZHJh ZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDA8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxjb21tb24tY3Jp dGVyaWHigJ06PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PjxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20v P3VybD1odHRwcyUzQSUyRiUyRnd3dy5jb21tb25jcml0ZXJpYXBvcnRhbC5vcmclMkZmaWxlcyUy RmVwZmlsZXMlMkYwODc5VjNhX3BkZi5wZGYmYW1wO2RhdGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBt aWNyb3NvZnQuY29tJTdDY2MxMjVjYTFjOTA0NDVmMTQzMzMwOGQ3ZDdmOGRhNDUlN0M3MmY5ODhi Zjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE1MzM2ODIyNTM0NjYyJmFt cDtzZGF0YT1uc1pDNm12WVY5emxQN3VSTk1IUWZtSnowZFFRVjZyRklTNEI2Q3pKMURZJTNEJmFt cDtyZXNlcnZlZD0wIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3dy5jb21t b25jcml0ZXJpYXBvcnRhbC5vcmcvZmlsZXMvZXBmaWxlcy8wODc5VjNhX3BkZi5wZGY8L3NwYW4+ PC9hPuKAnSwNCiAmbmJzcDsgJm5ic3A7ICZuYnNwOy8vIEUzLCBmcm9tJm5ic3A7ZHJhZnQtYmly a2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHU+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5FdmlkZW5jZTwvc3Bhbj48L3U+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+ezwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnGlhdCZxdW90OzogNTczNDg3MzQwOTgy MywgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gQzEg dGltZSBzdGFtcCBmb3IgZXZpZGVuY2UgY3JlYXRpb24gdGltZShlZykgZnJvbSBFQVQgZHJhZnQ8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7 ICZuYnNwOyDigJxzZWN1cml0eS1sZXZlbOKAnTogNCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gQzIgdGhlIHNlY3VyaXR5IGxldmVsIGlz IOKAnGhhcmR3YXJl4oCdJm5ic3A7ZnJvbSBFQVQgZHJhZnQ8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxkZWJ1Zy1kaXNh Ymxl4oCdOiDigJxwZXJtYW5lbnTigJ0gJm5ic3A7ICZuYnNwOyAmbmJzcDsgLy8gQzMgZGVidWcg aXMgcGVybWFuZW50bHkgZGlzYWJsZWQgZm9yIGFsbCBidXQgdGhlIE9FTSZuYnNwO2Zyb20gRUFU IGRyYWZ0PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi Pn08L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx1PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+UmVzdWx0czwv c3Bhbj48L3U+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ezwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ Jm5ic3A7ICZuYnNwOyDigJxmaWVsZC11cGdyYWRhYmxl4oCdOiB0cnVlLCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gUjEsIGZyb20mbmJzcDtkcmFmdC1iaXJraG9sei1yYXRz LWVuZG9yc2VtZW50LWVhdC0wMDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnHNoaWVsZGVkLXNlY3JldOKAnTogaW50ZXJu YWwsICZuYnNwOyAmbmJzcDsgJm5ic3A7IC8vIFIyLCBmcm9tJm5ic3A7ZHJhZnQtYmlya2hvbHot cmF0cy1lbmRvcnNlbWVudC1lYXQtMDA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxjb21tb24tY3JpdGVyaWHigJ06PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0 dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnd3dy5jb21tb25jcml0ZXJpYXBvcnRhbC5vcmclMkZmaWxlcyUyRmVwZmlsZXMlMkYw ODc5VjNhX3BkZi5wZGYmYW1wO2RhdGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29t JTdDY2MxMjVjYTFjOTA0NDVmMTQzMzMwOGQ3ZDdmOGRhNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFh YjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE1MzM2ODIyNTQ0NjU2JmFtcDtzZGF0YT1sc01Q bkw1bXNFTjF1WDJvdTIlMkZRdHZmczlyTyUyQmpnQWtFU2doZDdmSkRrOCUzRCZhbXA7cmVzZXJ2 ZWQ9MCI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuY29tbW9uY3JpdGVy aWFwb3J0YWwub3JnL2ZpbGVzL2VwZmlsZXMvMDg3OVYzYV9wZGYucGRmPC9zcGFuPjwvYT7igJ0s DQogJm5ic3A7ICZuYnNwOyAmbmJzcDsvLyBSMywgZnJvbSZuYnNwO2RyYWZ0LWJpcmtob2x6LXJh dHMtZW5kb3JzZW1lbnQtZWF0LTAwPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnGlhdCZxdW90OzogNTczNDg3 MzQwOTgyMywgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 Ly8gUjQgdGltZSBzdGFtcCBmb3IgZXZpZGVuY2UgY3JlYXRpb24gdGltZShlZyk8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDi gJxzZWN1cml0eS1sZXZlbOKAnTogNCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gUjUgdGhlIHNlY3VyaXR5IGxldmVsIGlzIOKAnGhhcmR3 YXJl4oCdPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDsg4oCcZGVidWctZGlzYWJsZeKAnTog4oCccGVybWFuZW504oCdICZuYnNw OyAmbmJzcDsgJm5ic3A7IC8vIFI2IGRlYnVnIGlzIHBlcm1hbmVudGx5IGRpc2FibGVkIGZvciBh bGwgYnV0IHRoZSBPRU08L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij59PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+SW4gdGhpcyBleGFtcGxlLCB0aGUgUlAgaXMgcHJvYmFibHkgZmVlZGluZyB0 aGlzIGludG8gYSByaXNrIGVuZ2luZSBzbyB0aGV5IHdhbnQgYWxsIHRoZSBkZXRhaWxzLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkhl cmXigJlzIGFub3RoZXIgdmVyeSBhYmJyZXZpYXRlZCBleGFtcGxlIHdpdGggbWFkZSB1cCBjbGFp bSBuYW1lczo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48dT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkVuZG9yc2VtZW50IChub3Qgc2hv d2luZyBhbnkgc2lnbmluZyk8L3NwYW4+PC91PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDsiPns8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxleHBlY3RlZC1oYXNo4oCdOiDigJxUV0Z1SUds eklHUnBjM1JwYm1kMWFYTm9aV1FzSUc1dmRDQnZibXg1SUdKNUlHaHBjeUJ5WlfigJ08L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5FdmlkZW5jZTwvc3Bhbj48L3U+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ezwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnGFj dHVhbC1oYXNo4oCdOiDigJxUV0Z1SUdseklHUnBjM1JwYm1kMWFYTm9aV1FzSUc1dmRDQnZibXg1 SUdKNUlHaHBjeUJ5WlcmcXVvdDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHU+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5SZXN1bHRzPC9zcGFuPjwvdT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij57PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnHZlcmlmaWVk4oCdOiB0cnVlLCAmbmJzcDs8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VGhp cyBhbGwgc2VlbXMgbGlrZSB0aGUgZXZlbnR1YWwgbG9naWNhbCByZXN1bHQgb2YgdGhlIEVBVCwg ZW5kb3JzZW1lbnRzIGFuZCBhcmNoaXRlY3R1cmUgZHJhZnRzIHRvIG1lLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5MTDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7ICZuYnNwOyZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4w cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+T24gQXByIDIs IDIwMjAsIGF0IDEyOjM2IFBNLCBMYXVyZW5jZSBMdW5kYmxhZGUgJmx0OzxhIGhyZWY9Im1haWx0 bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmxnbEBp c2xhbmQtcmVzb3J0LmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5O b3cmbmJzcDt0aGF0IHdlIGhhdmUgYSBmaXJzdCZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vbmFtMDYu c2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnRvb2xz LmlldGYub3JnJTJGaHRtbCUyRmRyYWZ0LWJpcmtob2x6LXJhdHMtZW5kb3JzZW1lbnQtZWF0LTAw JmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Q2NjMTI1Y2ExYzkw NDQ1ZjE0MzMzMDhkN2Q3ZjhkYTQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzNzIxNTMzNjgyMjU0NDY1NiZhbXA7c2RhdGE9U1c4eElPT0FFcmhNZGpLdU5z TmdCQVJBWlFtSGZPQVE3SHVvbE8yZWtWNCUzRCZhbXA7cmVzZXJ2ZWQ9MCI+PHNwYW4gc3R5bGU9 ImNvbG9yOnB1cnBsZSI+ZHJhZnQNCiBkZXNjcmliaW5nIGVuZG9yc2VtZW50czwvc3Bhbj48L2E+ LCBhbmQgdGhleSBsb29rIGxpa2UgRXZpZGVuY2UgYW5kIFJlc3VsdHMsIGl0IHNlZW1zIGludGVy ZXN0aW5nIHRvIGNvbnNpZGVyIHNvbWUgb2YgaG93IHRoZSB2ZXJpZmllciB1c2VzIEVuZG9yc2Vt ZW50cyAocmVmZXJlbmNlIHRoZSBhcmNoaXRlY3R1cmUgZGlhZ3JhbSBiZWxvdykuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPkxldOKAmXMgc2F5IHRoZXJlIGFyZSB0aHJlZSB0aGluZ3MgaW4gdGhlIGVuZG9y c2VtZW50LCBFMSwgRTIgYW5kIEUzLCB0aHJlZSB0aGluZ3MgaW4gdGhlIGV2aWRlbmNlLCBDMSwg QzIgYW5kIEMzIGFuZCB0aHJlZSBpbiB0aGUgcmVzdWx0cywgUjEsIFIyIGFuZCBSMy48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+VGhlbiB0aHJlZSBzaW1wbGV0b24gdG9wLWxldmVsIGNhc2VzOjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7bWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjEpIEFuIEVu ZG9yc2VtZW50IGlzIHBhc3NlZCB0aHJvdWdoIGFuZCBiZWNvbWVzIGEgcmVzdWx0OiBFMSDigJQg Jmd0OyBSMTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+MikgQSBDbGFpbSBpcyBw YXNzZWQgdGhyb3VnaCBhbmQgYmVjb21lcyBhIHJlc3VsdHM6IEMxIOKAlCZndDsgUjI8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjMpIFNvbWUgZW5kb3JzZW1lbnRzIGNvbWJpbmUg d2l0aCBzb21lIGNsYWltcyB0byBiZWNvbWUgYSByZXN1bHQ6IHtFMiwgRTMsIEMyLCBDM30g4oCU Jmd0OyBSMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Ib3dldmVyIHRoYXQgc2Vl bXMgdG8gYmUgdG9vIHNpbXBsZSBhbmQgSSB0aGluayB0aGVyZSBoYXMgdG8gYmUgc29tZSBzb3J0 IG9mIGEgcHJpbWl0aXZlIGVuZG9yc2VtZW50LCBjYWxsIGl0IEUwLCB3aG9zZSBzZW1hbnRpY3Mg YXJlIHRoYXQgc29tZSBvciBhbGwgb2YgdGhlIGNsYWltcyBjYW4gYWx3YXlzDQogYmUgYmVsaWV2 ZWQuIEkgdGhpbmsgdGhhdCBtZWFucyAyKSBkb2VzbuKAmXQgcmVhbGx5IGV4aXN0LCBidXQgaGFz IHRvIGJlIHRoaXM6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2lu LWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPjIpIFNvbWUgY2xhaW1zIGNhbiBwYXNzIHRocm91Z2ggd2l0aCB0 aGUgdXNlIG9mIHRoZSBwcmltaXRpdmUgRTAgZW5kb3JzZW1lbnQ6IHtFMCwgQzF9IOKAlCZndDsg UjI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5PbmUgd2F5IEUwIGNv dWxkIGJlIGRlZmluZWQgaW4gdGhlJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlu a3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdG9vbHMuaWV0Zi5v cmclMkZodG1sJTJGZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDAmYW1wO2Rh dGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDY2MxMjVjYTFjOTA0NDVmMTQz MzMwOGQ3ZDdmOGRhNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0Mw JTdDNjM3MjE1MzM2ODIyNTU0NjUzJmFtcDtzZGF0YT1raWRqTG5kSWxvbkN5bkFpd2RLWEdnTWc1 YkhBVUtQWWtYTCUyQkIyZnB6RTAlM0QmYW1wO3Jlc2VydmVkPTAiPjxzcGFuIHN0eWxlPSJjb2xv cjpwdXJwbGUiPmRyYWZ0DQogZGVzY3JpYmluZyBlbmRvcnNlbWVudHM8L3NwYW4+PC9hPiZuYnNw O2lzIHRoYXQgaXQgaXMgYSBsaXN0IG9mIHRoZSBsYWJlbHMgb2YgY2xhaW1zIHRoYXQgYXJlIHRy dXN0ZWQgdG8gYmUgcGFzc2VkIHRocm91Z2guIEZvciBudW1lcmljIGxhYmVscyAmbmJzcDthIHJh bmdlJm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC41cHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7TWVubG8mcXVvdDssc2VyaWY7Y29sb3I6IzAwNzQwMDtiYWNrZ3JvdW5kOndoaXRlIj5J TlQ2NF9NQVg8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDt0byZuYnNwOzwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5OiZxdW90O01lbmxvJnF1b3Q7LHNl cmlmO2NvbG9yOiMwMDc0MDA7YmFja2dyb3VuZDp3aGl0ZSI+SU5UNjRfTUlOJm5ic3A7PC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+KG9yDQogLWluZmluaXR5IHRvICYjNDM7aW5maW5pdHkpICZuYnNw O2luZGljYXRlcyBhbGwgY2xhaW1zIGFyZSB0cnVzdGVkLiBJdCBjb3VsZCBhbHNvIGxpc3Qgc3Bl Y2lmaWMgb25lcyB0aGF0IGFyZSB0cnVzdGVkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tIHRoZSBU RUUsIEZJRE8gYW5kIEFuZHJvaWQgQXR0ZXN0YXRpb24gdmlld3Mgb2YgdGhlIHdvcmxkIHdoZXJl IG1lYXN1cmVtZW50cyBhcmVu4oCZdCBhIHByaW1hcnkgdGhpbmcgYW5kIHNlY3VyZS90cnVzdGVk IGJvb3QgaXMgcmVxdWlyZWQgYW5kIGFsd2F5cyBvbiwgYSBjb21tb24gbW9kZWwgd2lsbA0KIGJl IHRvIHBhc3MgZXZlcnl0aGluZyB0aHJvdWdoIHRvIGNyZWF0ZSBhbiBhZ2dyZWdhdGUgcmVzdWx0 LiBJdCBjb3VsZCBiZSByZXByZXNlbnRlZCB0aGlzIHdheTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPkUxLSZndDtSMTwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5FMi0mZ3Q7UjI8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+RTMtJmd0O1IzPC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPntFMCxDMX0tJmd0O1I0PC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPntFMCxDMn0t Jmd0O1I1PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PntFMCxDM30tJmd0O1I2PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPkkgdGhpbmsgdGhpcyBnb2VzIG9uIHRvIHN1Ym1vZHVsZXMgdG9vIGFu ZCBoYXMgc29tZSByZWxhdGlvbiB0byB0aGUgYXR0ZW1wdGVkIHRvIHByb3Bvc2UgYSBjb25uZWN0 aW9uIHR5cGUuICZuYnNwO0VuZG9yc2VtZW50cyBtYXkgYmUgYWJsZSB0byBzYXkgaG93IHN1Ym1v ZHVsZXMgYXJlIHRydXN0ZWQuIFRoZXJlDQogbWlnaHQgZXZlbiBiZSBhbiBFMDAgcHJpbWl0aXZl IHRoYXQgc2F5cyB0aGUgbGVhZCBhdHRlc3RlciBpcyBhbGxvd2VkIHRvIHNheSBob3cgc3VibW9k dWxlcyBhcmUgdHJ1c3RlZC4gVGhpcyB3aG9sZSBsaW5lIG9mIHRoaW5raW5nIHdhcyBwYXJ0bHkg cHJvbXB0ZWQgYnkgdGhpcyZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnBy b3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRmdpdGh1Yi5jb20lMkZpZXRm LXJhdHMtd2clMkZlYXQlMkZpc3N1ZXMlMkY1OCZhbXA7ZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0 MG1pY3Jvc29mdC5jb20lN0NjYzEyNWNhMWM5MDQ0NWYxNDMzMzA4ZDdkN2Y4ZGE0NSU3QzcyZjk4 OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcyMTUzMzY4MjI1NTQ2NTMm YW1wO3NkYXRhPW5hbTFHS0ElMkJOR2MzMUx1Ym5iJTJCc1QyeHFlOUZ0OXZEdHc0djRKTCUyQnJX S2clM0QmYW1wO3Jlc2VydmVkPTAiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmlzc3VlPC9z cGFuPjwvYT4mbmJzcDthZ2FpbnN0DQogRUFUIGFuZCBjb21tZW50cyBmcm9tIEdpcmkgYW5kIERh dmUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkxMPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHByZSBzdHlsZT0iYnJlYWst YmVmb3JlOiBwYWdlIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgKioq KioqKioqKioqJm5ic3A7Jm5ic3A7ICoqKioqKioqKioqKiZuYnNwOyZuYnNwOyZuYnNwOyAqKioq KioqKioqKioqKioqKjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyAqIEVuZG9yc2VyICombmJzcDsmbmJzcDsgKiBWZXJpZmllciAq Jm5ic3A7Jm5ic3A7Jm5ic3A7ICogUmVseWluZyBQYXJ0eSAqPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICoqKioqKioqKioqKiZu YnNwOyZuYnNwOyAqJm5ic3A7IE93bmVyJm5ic3A7Jm5ic3A7ICombmJzcDsmbmJzcDsmbmJzcDsg KiZuYnNwOyBPd25lciZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAq PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgKioqKioqKioqKioqJm5ic3A7Jm5ic3A7Jm5i c3A7ICoqKioqKioqKioqKioqKioqPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEVuZG9yc2VtZW50c3wm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgfEFwcHJhaXNhbCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgfFBvbGljeSBmb3ImbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHxFdmlkZW5jZSAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt8IEFwcHJhaXNhbDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCBQb2xpY3kgZm9yPG86cD48L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8IEF0dGVzdGF0aW9uPG86cD48L286cD48 L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7IFJlc3VsdDxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB2Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwO3YmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyAuLi0tLS0tLS0tLS0tLS0tLS0tLiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IC4tLS0tLSZndDt8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFZlcmlmaWVyJm5ic3A7 Jm5ic3A7Jm5ic3A7IHwtLS0tLS0uJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAnLS0tLS0tLS0tLS0tLS0tLS0nJm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgJm5ic3A7fDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IEF0dGVzdGF0aW9ufCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgUmVzdWx0cyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgfCBFdmlkZW5jZSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt2Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IHY8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLi4tLS0tLS0tLS0tLiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAuLi0t LS0tLS0tLS0tLS0tLS0tLjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8IEF0dGVzdGVyIHwmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCBSZWx5 aW5nIFBhcnR5Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJy0tLS0tLS0tLS0nJm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICctLS0tLS0tLS0tLS0tLS0tLSc8bzpwPjwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpSQVRTIG1haWxpbmcgbGlz dDxicj4NCjxhIGhyZWY9Im1haWx0bzpSQVRTQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5SQVRTQGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL25h bTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3 d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZyYXRzJmFtcDtkYXRhPTAyJTdDMDEl N0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Q2NjMTI1Y2ExYzkwNDQ1ZjE0MzMzMDhkN2Q3Zjhk YTQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzIxNTMz NjgyMjU2NDY0NyZhbXA7c2RhdGE9UlI3dFBRb1kxSm1RZDVNRU9DUXl4eFJzJTJCcENrRXhBaTBC JTJCQjUzYVNKaGclM0QmYW1wO3Jlc2VydmVkPTAiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi Pmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0czwvc3Bhbj48L2E+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fPGJyPg0KUkFUUyBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFp bHRvOlJBVFNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5SQVRTQGll dGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8L3NwYW4+PGEgaHJlZj0i aHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBz JTNBJTJGJTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGcmF0cyZhbXA7ZGF0 YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1pY3Jvc29mdC5jb20lN0NjYzEyNWNhMWM5MDQ0NWYxNDMz MzA4ZDdkN2Y4ZGE0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAl N0M2MzcyMTUzMzY4MjI1NjQ2NDcmYW1wO3NkYXRhPVJSN3RQUW9ZMUptUWQ1TUVPQ1F5eHhScyUy QnBDa0V4QWkwQiUyQkI1M2FTSmhnJTNEJmFtcDtyZXNlcnZlZD0wIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRz PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_MW2PR2101MB1034C4B83AB2A0349B4DE44CA3C70MW2PR2101MB1034_-- From nobody Fri Apr 3 12:37:42 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9573F3A07A9 for ; Fri, 3 Apr 2020 12:37:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.894 X-Spam-Level: X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DN62onq3vztn for ; Fri, 3 Apr 2020 12:37:38 -0700 (PDT) Received: from p3plsmtpa07-09.prod.phx3.secureserver.net (p3plsmtpa07-09.prod.phx3.secureserver.net [173.201.192.238]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 025A63A07A5 for ; Fri, 3 Apr 2020 12:37:37 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id KS8Hj6mKSdWuIKS8HjddCK; Fri, 03 Apr 2020 12:37:37 -0700 X-CMAE-Analysis: v=2.3 cv=WPABoUkR c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=K6EGIJCdAAAA:8 a=03-ksFfLAAAA:8 a=48vgC7mUAAAA:8 a=0XtbOteLAAAA:20 a=PUMEy0Ev_r2yloeUkLsA:9 a=tA8-cUsbr176_P3y:21 a=Ma-WCi5UoTSfP32h:21 a=QEXdDO2ut3YA:10 a=-oDLdplK7dZJOUJuMCEA:9 a=zb4TQFx-aCVuixNg:21 a=2zyKuJnLjukWgHDZ:21 a=NuWD3iGb9ktEsBsT:21 a=_W_S_7VecoQA:10 a=L6pVIi0Kn1GYQfi8-iRI:22 a=xzjcLgdzzKJd7D42GW5i:22 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_635F8B4C-230C-40E7-8C86-51C91172FAEC" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 3 Apr 2020 12:37:36 -0700 References: To: rats@ietf.org In-Reply-To: Message-Id: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfBVRXmXDXXy1ImE99DPoyli5XP0+7yAEy1URhGsZLlMX29DHYqAIBIAjobkxG+qNvthinFsEn1jnb55/7DF/G2yMkvOAps2ROcuOqffLKliSa1U7AwYy Utw+oGW6Bqnwt7xh9ozI2ray9KdFSvi4JZyqbVsmBSkJP3lgSOEQYq4v Archived-At: Subject: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2020 19:37:41 -0000 --Apple-Mail=_635F8B4C-230C-40E7-8C86-51C91172FAEC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 So how does a Verifier find the applicable endorsement for Evidence it = wishes to verify and know that is really the right endorsement? Seems like the Evidence needs some sort of an endorsement locator ID. = This could be a URL or a GUID. EAT currently has the origination claim = to try to solve this, but it is half-baked. It needs to get fixed. I=E2=80= =99m fishing for comments here on what it should be like. Pretty sure the Endorsement needs to include or reference the public key = that is used to verify the signature. Without that, the Attester could = lie and pick any old Endorsement that it wishes. There needs to be some = binding between items in the endorsement (E0, E1,=E2=80=A6) and the = verification key. That could be in the form of a signed token or = certificate, but doesn=E2=80=99t have to be. Pretty sure this needs to = be discussed in the architecture doc. There=E2=80=99s a few scenarios: - One endorsement applies to lots of devices in the same class, but each = has their own attestation key. - - Probably ECDAA fits in here - - One option here is an X509 hierarchy - Group keys are used (for privacy reasons or other) so there is a = one-one correlation with the Endorsements (the GEID discussion) - Group keys are used, but across devices that have different = endorsements so there=E2=80=99s no one-one correlation While the last one seems odd and unlikely, I think it could occur, = because from a lot of real experience the set up of attestation keys is = very idiosyncratic. It is wildly affected by manufacturing costs and = issues on assembly lines, sub contractor structure, location of secure = facilities and approaches to making money on it. They are like = snowflakes, each one is different. So maybe endorsement locator ID and = key ID are not the same, but they can be in some use cases? I am also tempted to encourage the placement of the endorsement locator = ID in the COSE or JOSE header parameters so you don=E2=80=99t have to = parse the unverified body of claims to be able to find the key material = to verify it. Thoughts? LL > On Apr 2, 2020, at 4:16 PM, Laurence Lundblade = wrote: >=20 > Let me make this much more concrete with an example. I=E2=80=99m using = JSON representation of CWT/EAT/Endorsements with C-style comments for = reading ease. >=20 > Endorsement > { > =E2=80=9Ctrust-evidence=E2=80=9D: =E2=80=9Call=E2=80=9D, = // E0, I just made this up > =E2=80=9Cfield-upgradable=E2=80=9D: true, // E1, from = draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Cshielded-secret=E2=80=9D: internal, // E2, from = draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Ccommon-criteria=E2=80=9D: = https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.pdf = =E2=80= =9D, // E3, from draft-birkholz-rats-endorsement-eat-00 > } >=20 > Evidence > { > =E2=80=9Ciat": 5734873409823, // C1 time stamp for = evidence creation time(eg) from EAT draft > =E2=80=9Csecurity-level=E2=80=9D: 4 // C2 the = security level is =E2=80=9Chardware=E2=80=9D from EAT draft > =E2=80=9Cdebug-disable=E2=80=9D: =E2=80=9Cpermanent=E2=80=9D = // C3 debug is permanently disabled for all but the OEM from EAT draft > } >=20 > Results > { > =E2=80=9Cfield-upgradable=E2=80=9D: true, // R1, from = draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Cshielded-secret=E2=80=9D: internal, // R2, from = draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Ccommon-criteria=E2=80=9D: = https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.pdf = =E2=80= =9D, // R3, from draft-birkholz-rats-endorsement-eat-00 > =E2=80=9Ciat": 5734873409823, // R4 time stamp for = evidence creation time(eg) > =E2=80=9Csecurity-level=E2=80=9D: 4 // R5 the = security level is =E2=80=9Chardware=E2=80=9D > =E2=80=9Cdebug-disable=E2=80=9D: =E2=80=9Cpermanent=E2=80=9D = // R6 debug is permanently disabled for all but the OEM > } >=20 > In this example, the RP is probably feeding this into a risk engine so = they want all the details. >=20 >=20 > Here=E2=80=99s another very abbreviated example with made up claim = names: >=20 > Endorsement (not showing any signing) > { > =E2=80=9Cexpected-hash=E2=80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW=E2=80=9D > } >=20 > Evidence > { > =E2=80=9Cactual-hash=E2=80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW" > } >=20 > Results > { > =E2=80=9Cverified=E2=80=9D: true, =20 > } >=20 > This all seems like the eventual logical result of the EAT, = endorsements and architecture drafts to me. >=20 > LL > =20 >=20 >=20 >=20 >> On Apr 2, 2020, at 12:36 PM, Laurence Lundblade = > wrote: >>=20 >> Now that we have a first draft describing endorsements = , = and they look like Evidence and Results, it seems interesting to = consider some of how the verifier uses Endorsements (reference the = architecture diagram below). >>=20 >> Let=E2=80=99s say there are three things in the endorsement, E1, E2 = and E3, three things in the evidence, C1, C2 and C3 and three in the = results, R1, R2 and R3. >>=20 >> Then three simpleton top-level cases: >>=20 >> 1) An Endorsement is passed through and becomes a result: E1 =E2=80=94 = > R1 >> 2) A Claim is passed through and becomes a results: C1 =E2=80=94> R2 >> 3) Some endorsements combine with some claims to become a result: = {E2, E3, C2, C3} =E2=80=94> R3 >>=20 >> However that seems to be too simple and I think there has to be some = sort of a primitive endorsement, call it E0, whose semantics are that = some or all of the claims can always be believed. I think that means 2) = doesn=E2=80=99t really exist, but has to be this: >>=20 >> 2) Some claims can pass through with the use of the primitive E0 = endorsement: {E0, C1} =E2=80=94> R2 >>=20 >> One way E0 could be defined in the draft describing endorsements = is = that it is a list of the labels of claims that are trusted to be passed = through. For numeric labels a range INT64_MAX to INT64_MIN (or = -infinity to +infinity) indicates all claims are trusted. It could also = list specific ones that are trusted. >>=20 >> =46rom the TEE, FIDO and Android Attestation views of the world where = measurements aren=E2=80=99t a primary thing and secure/trusted boot is = required and always on, a common model will be to pass everything = through to create an aggregate result. It could be represented this way: >>=20 >> E1->R1 >> E2->R2 >> E3->R3 >> {E0,C1}->R4 >> {E0,C2}->R5 >> {E0,C3}->R6 >>=20 >> I think this goes on to submodules too and has some relation to the = attempted to propose a connection type. Endorsements may be able to say = how submodules are trusted. There might even be an E00 primitive that = says the lead attester is allowed to say how submodules are trusted. = This whole line of thinking was partly prompted by this issue = against EAT and comments = from Giri and Dave. >>=20 >> LL >>=20 >>=20 >> ************ ************ ***************** >> * Endorser * * Verifier * * Relying Party * >> ************ * Owner * * Owner * >> | ************ ***************** >> | | | >> Endorsements| | | >> | |Appraisal | >> | |Policy for | >> | |Evidence | Appraisal >> | | | Policy for >> | | | Attestation >> | | | Result >> v v | >> .-----------------. | >> .----->| Verifier |------. | >> | '-----------------' | | >> | | | >> | Attestation| | >> | Results | | >> | Evidence | | >> | | | >> | v v >> .----------. .-----------------. >> | Attester | | Relying Party | >> '----------' '-----------------' >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> _______________________________________________ >> RATS mailing list >> RATS@ietf.org >> https://www.ietf.org/mailman/listinfo/rats >=20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats --Apple-Mail=_635F8B4C-230C-40E7-8C86-51C91172FAEC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
So how does a Verifier find the applicable endorsement for = Evidence it wishes to verify and know that is really the right = endorsement?

Seems like the Evidence needs some sort of an endorsement = locator ID. This could be a URL or a GUID. EAT currently has the = origination claim to try to solve this, but it is half-baked. It needs = to get fixed. I=E2=80=99m fishing for comments here on what it should be = like.

Pretty = sure the Endorsement needs to include or reference the public key that = is used to verify the signature. Without that, the Attester could lie = and pick any old Endorsement that it wishes. There needs to be some = binding between items in the endorsement (E0, E1,=E2=80=A6) and the = verification key. That could be in the form of a signed token or = certificate, but doesn=E2=80=99t have to be. Pretty sure this needs to = be discussed in the architecture doc.

There=E2=80=99s a few = scenarios:
- One endorsement applies to lots of = devices in the same class, but each has their own attestation = key.
- - Probably ECDAA fits in here
- - One option here is an X509 hierarchy
-= Group keys are used (for privacy reasons or other) so there is a = one-one correlation with the Endorsements (the GEID = discussion)
- Group keys are used, but across = devices that have different endorsements so there=E2=80=99s no one-one = correlation

While the last one seems odd and unlikely, I think it could = occur, because from a lot of real experience the set up of attestation = keys is very idiosyncratic. It is wildly affected by manufacturing costs = and issues on assembly lines, sub contractor structure, location of = secure facilities and approaches to making money on it. They are like = snowflakes, each one is different.  So maybe endorsement locator ID = and key ID are not the same, but they can be in some use = cases?

 I = am also tempted to encourage the placement of the endorsement locator ID = in the COSE or JOSE header parameters so you don=E2=80=99t have to parse = the unverified body of claims to be able to find the key material to = verify it.

Thoughts?

LL



On Apr 2, 2020, at 4:16 PM, Laurence Lundblade <lgl@island-resort.com> wrote:

Let me make this much = more concrete with an example. I=E2=80=99m using JSON representation of = CWT/EAT/Endorsements with C-style comments for reading ease.

Endorsement
{
    =E2=80=9Ctrust-evidence=E2=80=9D: =E2=80=9Call=E2= =80=9D,           // E0, I just made this = up
    =E2=80=9Cfield-upgradable=E2=80=9D: true, =          // E1, = from draft-birkholz-rats-endorsement-eat-00
    = =E2=80=9Cshielded-secret=E2=80=9D: internal,       // E2, = from draft-birkholz-rats-endorsement-eat-00
    = =E2=80=9Ccommon-criteria=E2=80=9D: https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.= pdf=E2=80=9D,      // E3, = from draft-birkholz-rats-endorsement-eat-00
}

Evidence
{
    =E2=80=9Ciat": 5734873409823,     =          // C1 time stamp for evidence creation = time(eg) from EAT draft
    =E2=80=9Csecurity-level=E2=80=9D: 4   =              // C2 the security level = is =E2=80=9Chardware=E2=80=9D from EAT draft
    = =E2=80=9Cdebug-disable=E2=80=9D: =E2=80=9Cpermanent=E2=80=9D   =     // C3 debug is permanently disabled for all but the = OEM from EAT draft
}

Results
{
  =   =E2=80=9Cfield-upgradable=E2=80=9D: true,       =    // R1, = from draft-birkholz-rats-endorsement-eat-00
    = =E2=80=9Cshielded-secret=E2=80=9D: internal,       // R2, = from draft-birkholz-rats-endorsement-eat-00
    = =E2=80=9Ccommon-criteria=E2=80=9D: https://www.commoncriteriaportal.org/files/epfiles/0879V3a_pdf.= pdf=E2=80=9D,      // R3, = from draft-birkholz-rats-endorsement-eat-00
  =   =E2=80=9Ciat": 5734873409823,           =    // R4 time stamp for evidence creation = time(eg)
    =E2=80=9Csecurity-level=E2=80=9D: 4   =              // R5 the security level = is =E2=80=9Chardware=E2=80=9D
    =E2=80=9Cdebug-disable=E2=80= =9D: =E2=80=9Cpermanent=E2=80=9D       // R6 debug is = permanently disabled for all but the OEM
}

In this example, the RP = is probably feeding this into a risk engine so they want all the = details.


Here=E2=80=99s another very abbreviated = example with made up claim names:

Endorsement= (not showing any signing)
{
    =E2=80=9Cexpected-hash=E2=80=9D: = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW=E2=80=9D
}

Evidence
{
    =E2=80=9Cactual-hash=E2=80=9D= : = =E2=80=9CTWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZW"
}

Results
{
    = =E2=80=9Cverified=E2=80=9D: true,  
}

This all seems like the = eventual logical result of the EAT, endorsements and architecture drafts = to me.

LL
    



On Apr 2, 2020, at 12:36 PM, Laurence Lundblade <lgl@island-resort.com> wrote:

Now that we have a first draft describing endorsements, and they look like = Evidence and Results, it seems interesting to consider some of how the = verifier uses Endorsements (reference the architecture diagram = below).

Let=E2=80= =99s say there are three things in the endorsement, E1, E2 and E3, three = things in the evidence, C1, C2 and C3 and three in the results, R1, R2 = and R3.

Then = three simpleton top-level cases:

1) An Endorsement is passed = through and becomes a result: E1 =E2=80=94 > R1
2)= A Claim is passed through and becomes a results: C1 =E2=80=94> = R2
3) Some endorsements combine with some claims to = become a result: {E2, E3, C2, C3} =E2=80=94> = R3

However that seems to be too simple and I think there has to = be some sort of a primitive endorsement, call it E0, whose semantics are = that some or all of the claims can always be believed. I think that = means 2) doesn=E2=80=99t really exist, but has to be this:

2)= Some claims can pass through with the use of the primitive E0 = endorsement: {E0, C1} =E2=80=94> R2

One way E0 could be = defined in the draft describing endorsements is that it is a list = of the labels of claims that are trusted to be passed through. For = numeric labels  a range INT64_MAX to INT64_MIN (or -infinity to = +infinity)  indicates all claims are trusted. It could also list = specific ones that are trusted.

=46rom the TEE, FIDO and Android = Attestation views of the world where measurements aren=E2=80=99t a = primary thing and secure/trusted boot is required and always on, a = common model will be to pass everything through to create an aggregate = result. It could be represented this way:

E1->R1
E2->R2
E3->R3
{E0,C1}->R4
{E0,C2}->R5
{E0,C3}->R6

I think this goes on to submodules too = and has some relation to the attempted to propose a connection type. =  Endorsements may be able to say how submodules are trusted. There = might even be an E00 primitive that says the lead attester is allowed to = say how submodules are trusted. This whole line of thinking was partly = prompted by this issue against EAT and comments from Giri and = Dave.

LL


                 ************   =
************    *****************
                 * Endorser *   * Verifier *    * Relying Party *
                 ************   *  Owner   *    *  Owner        *
                       |        ************    *****************
                       |              |                 |
           Endorsements|              |                 |
                       |              |Appraisal        |
                       |              |Policy for       |
                       |              |Evidence         | Appraisal
                       |              |                 | Policy for
                       |              |                 | Attestation
                       |              |                 |  Result
                       v              v                 |
                     .-----------------.                |
              .----->|     Verifier    |------.         |
              |      '-----------------'      |         |
              |                               |         |
              |                    Attestation|         |
              |                    Results    |         |
              | Evidence                      |         |
              |                               |         |
              |                               v         v
        .----------.                      .-----------------.
        | Attester |                      | Relying Party   |
        '----------'                      '-----------------'







_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_635F8B4C-230C-40E7-8C86-51C91172FAEC-- From nobody Fri Apr 3 12:45:45 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0A4B3A0895 for ; Fri, 3 Apr 2020 12:45:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y1OXbehM6-7o for ; Fri, 3 Apr 2020 12:45:42 -0700 (PDT) Received: from p3plsmtpa11-06.prod.phx3.secureserver.net (p3plsmtpa11-06.prod.phx3.secureserver.net [68.178.252.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF72E3A0893 for ; Fri, 3 Apr 2020 12:45:42 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id KSG5jhphPICrnKSG6jKHai; Fri, 03 Apr 2020 12:45:42 -0700 X-CMAE-Analysis: v=2.3 cv=PfOBeRpd c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=yMhMjlubAAAA:8 a=WjgZ1Hia5h-zAtdwrhUA:9 a=QEXdDO2ut3YA:10 a=ZRzikgDkCVBJjew6um0A:9 a=eT_Vlq9VJQ8E3VDf:21 a=_W_S_7VecoQA:10 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: <4CA2FCE1-A4A0-4520-82F9-746222340836@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_C8D8CB71-51F2-44E7-AC4D-A82C8C5631DC" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 3 Apr 2020 12:45:41 -0700 In-Reply-To: Cc: Ned Smith , "rats@ietf.org" To: Dave Thaler References: X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfCdzy1MKU4TiPjfzUcmMKcq9L1D8KwGeAyk4paA9iTyNDqhwV5R+t7BaBnS3Vi0fBAlA1FW9gL0DizfBWIyh9OO4Cyx1nPuotSp+CGdEX0PjG8NNkvIt 30smSBPAE/caf5kvlnOuKJN8oRTYKlpVEUTO5TFqsrmx7IRPhVjgHbyi6BhEWCJ2xJiTwCX+zuRC0iC46MuwKzOioHOgvBBQ5kzGc8Hm4PZv8qsuM4aZl6u9 Archived-At: Subject: Re: [Rats] debug disable (was Re: Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2020 19:45:44 -0000 --Apple-Mail=_C8D8CB71-51F2-44E7-AC4D-A82C8C5631DC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Apr 3, 2020, at 12:14 PM, Dave Thaler = wrote: >=20 > =E2=80=9Cthat=E2=80=99s not how debug for SW / apps usually works. = There=E2=80=99s not usually config to turn debug on or off for = individual apps.=E2=80=9D > =20 > I can tell you that IS how it works for Intel processors, including = apps that run in SGX enclaves. > So =E2=80=9Cusually=E2=80=9D is perhaps a matter of perspective, or a = matter that varies by chip vendor. Hopefully the debug disable claim in EAT can still handle this along = with the user of submods.=20 I=E2=80=99d like to understand a bit more here. Which debuggers are you = thinking of? Something you use from an IDE like MSVC? Something you use = from a JTAG port? Debug per SGX enclave makes sense. Presumably that could be handled in = EAT with submods. Any pointers to SGX debug documentation? LL= --Apple-Mail=_C8D8CB71-51F2-44E7-AC4D-A82C8C5631DC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Apr 3, 2020, at 12:14 PM, Dave Thaler <dthaler@microsoft.com> wrote:

=E2=80=9Cthat=E2=80=99s not how debug for SW / apps = usually works. There=E2=80=99s not usually config to turn debug on or = off for individual apps.=E2=80=9D
 
I can tell you that IS how it works for Intel = processors, including apps that run in SGX enclaves.
So =E2=80=9Cusually=E2=80=9D is perhaps a matter of = perspective, or a matter that varies by chip = vendor.

Hopefully the debug disable claim in = EAT can still handle this along with the user of = submods. 

I=E2=80=99d like to understand a bit more here. Which = debuggers are you thinking of? Something you use from an IDE like MSVC? = Something you use from a JTAG port?

Debug per SGX enclave makes sense. = Presumably that could be handled in EAT with submods. Any pointers to = SGX debug documentation?

LL
= --Apple-Mail=_C8D8CB71-51F2-44E7-AC4D-A82C8C5631DC-- From nobody Mon Apr 6 16:43:25 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C6E13A0D72 for ; Mon, 6 Apr 2020 16:43:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.818 X-Spam-Level: X-Spam-Status: No, score=-1.818 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xtO-4TEVnFeK for ; Mon, 6 Apr 2020 16:43:21 -0700 (PDT) Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87D373A0C17 for ; Mon, 6 Apr 2020 16:43:21 -0700 (PDT) IronPort-SDR: hqLHKjyikVwQXJ8raLKK1sgO7Ap/esocAffk3VLN0KVzmgIzXH7yAauCBbmkkmBb5xlUhuwJD/ Ze9ORrAZmI1g== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Apr 2020 16:43:20 -0700 IronPort-SDR: 6ZmZPs5t+ndn8wAFonadl6ITCSN2K2ADYZ2L0E1CMXaiyP7FxaYwaAfeQ8MK5znDpy9+XEOLGh lHCAIMUUTkHA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,352,1580803200"; d="scan'208,217";a="254275500" Received: from orsmsx109.amr.corp.intel.com ([10.22.240.7]) by orsmga006.jf.intel.com with ESMTP; 06 Apr 2020 16:43:20 -0700 Received: from orsmsx108.amr.corp.intel.com ([169.254.2.172]) by ORSMSX109.amr.corp.intel.com ([169.254.11.20]) with mapi id 14.03.0439.000; Mon, 6 Apr 2020 16:43:20 -0700 From: "Smith, Ned" To: Dave Thaler , Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Processing Endorsements and Evidence into Results Thread-Index: AQHWCSYFjr6P8H2RO0Gpgb6vU8jglKhm7I6A///fdYCAAHdIAIAFhLWA Date: Mon, 6 Apr 2020 23:43:19 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.35.20030802 x-originating-ip: [10.254.71.220] Content-Type: multipart/alternative; boundary="_000_B5C5BA4AD11B4C4A95B000AD41ACAECCintelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Processing Endorsements and Evidence into Results X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Apr 2020 23:43:24 -0000 --_000_B5C5BA4AD11B4C4A95B000AD41ACAECCintelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QW5vdGhlciB3YXkgdG8gdW5kZXJzdGFuZCBpdCBpcyBpZiB0aGUgc3RhdGUgaXMgdXBkYXRlZCBi eSBsaWZlY3ljbGUgZXZlbnRzLCBzdWNoIGFzIFNXIHVwZGF0ZSwgdGhlbiB0aGUgRW5kb3JzZW1l bnQgdGhhdCBpcyByZW5kZXJlZCB1bnRydWUgYXMgYSByZXN1bHQgbmVlZHMgdG8gYmUgdXBkYXRl ZCB0b28uDQoNClRoZXNlIGFyZSB0aGUgc2VtYW50aWNzIGZvciBTVyB1cGRhdGUgaW1hZ2UgaW50 ZWdyaXR5LiBUaGV5IGNvdWxkIGFwcGx5IHRvIGRlYnVnIHN0YXRlIHRvby4NCg0KRXhwaXJhdGlv biBvZiBhIOKAmHN0YXRpY+KAmSBFbmRvcnNlbWVudCBjbGFpbSBkb2VzbuKAmXQgbWFrZSB0aGUg aW50cmluc2ljIG5hdHVyZSBvZiB0aGUgY2xhaW0gZ28gYXdheSwganVzdCB0aGUgYXNzZXJ0aW9u IG9mIHRoZSBjbGFpbSBnb2VzIGF3YXkuDQoNClRoZSBhbHRlcm5hdGl2ZSwgdGhhdCBhbiBhdHRl c3RhdGlvbiBvZiB0aGUgY2xhaW0gZG9lc27igJl0IHJlcGxhY2UgdGhlIHJvbGUgb2YgRW5kb3Jz ZW1lbnQgY2FuIGFsc28gYmUgdHJ1ZS4gSXQganVzdCBtZWFucyB0aGUgRXZpZGVuY2UgaXMgcHJl c2VudGVkIHdpdGhvdXQgY29ycmVzcG9uZGluZyBFbmRvcnNlbWVudC4gVGhlIHZlcmlmaWVyIG1p Z2h0IHN0aWxsIGFjY2VwdCB0aGUgRXZpZGVuY2UgYmVjYXVzZSBvZiB0aGUgdHJ1c3QgaXQgcGxh Y2VzIGluIHRoZSBBdHRlc3RpbmcgRW52aXJvbm1lbnQgdG8ga25vdyB0aGF0IHRoZSBjbGFpbSBp cyBleHRhbnQuDQoNClRoZXNlIGFyZSBhbGwgZXhhbXBsZXMgb2YgY29ybmVyIGNvbmRpdGlvbnMg dGhhdCBBcHByYWlzYWwgcG9saWN5IG5lZWRzIHRvIGNvbXByZWhlbmQgSU1PLg0KDQotTmVkDQoN CkZyb206IERhdmUgVGhhbGVyIDxkdGhhbGVyQG1pY3Jvc29mdC5jb20+DQpEYXRlOiBUaHVyc2Rh eSwgQXByaWwgMiwgMjAyMCBhdCA5OjI3IFBNDQpUbzogIlNtaXRoLCBOZWQiIDxuZWQuc21pdGhA aW50ZWwuY29tPiwgTGF1cmVuY2UgTHVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb20+LCAi cmF0c0BpZXRmLm9yZyIgPHJhdHNAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSRTogW1JhdHNdIFByb2Nl c3NpbmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRvIFJlc3VsdHMNCg0KRGVidWctZGlz YWJsZSBpcyBub3QgKGluIGdlbmVyYWwsIGJ1dCBjYW4gYmUgaW4gc3BlY2lmaWMgY2FzZXMpIHBl cm1hbmVudCBmb3IgYSBkZXZpY2UsIGl0IGNhbiB2YXJ5IGJ5IGFwcGxpY2F0aW9uIG9uIHRoZSBz YW1lIGRldmljZSwNCmFuZCBjYW4gdmFyeSBvdmVyIHRpbWUgYXMgc2F5IHNvZnR3YXJlL2Zpcm13 YXJlIGlzIHBhdGNoZWQgb3IgY29uZmlndXJlZCwgc28gY2Fubm90IGluIHRoYXQgY2FzZSBiZSBp biBhbiBlbmRvcnNlbWVudC4NCg0KQWxzbyBJIHdvdWxkIGV4cGVjdCB0aGF0IGVuZG9yc2VtZW50 cyBnZW5lcmFsbHkgYWxzbyBjYXJyeSBzb21lIHNvcnQgb2YgZXhwaXJhdGlvbiBvciB2YWxpZGl0 eSBwZXJpb2QgYXMgd2VsbCwgd2hpY2ggaXNu4oCZdCBpbiBMYXVyZW5jZeKAmXMgZXhhbXBsZS4N CihBbmQgZXhwaXJhdGlvbiB0aW1lIGlzIGFuIGV4YW1wbGUgb2Ygc29tZXRoaW5nIHRoYXQgZXF1 YWxpdHkgY29tcGFyaXNvbiBhZ2FpbnN0IGEg4oCca25vd24gZ29vZCB2YWx1ZeKAnSBkb2VzbuKA mXQgd29yayBmb3IuKQ0KDQpEYXZlDQoNCkZyb206IFJBVFMgPHJhdHMtYm91bmNlc0BpZXRmLm9y Zz4gT24gQmVoYWxmIE9mIFNtaXRoLCBOZWQNClNlbnQ6IFRodXJzZGF5LCBBcHJpbCAyLCAyMDIw IDk6MjAgUE0NClRvOiBMYXVyZW5jZSBMdW5kYmxhZGUgPGxnbEBpc2xhbmQtcmVzb3J0LmNvbT47 IHJhdHNAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbUmF0c10gUHJvY2Vzc2luZyBFbmRvcnNlbWVu dHMgYW5kIEV2aWRlbmNlIGludG8gUmVzdWx0cw0KDQpCVFc6IFNpbmNlIOKAmGRlYnVnLWRpc2Fi bGXigJkgaXMgcGVybWFuZW50IGl0IGNvdWxkIHByb2JhYmx5IGVxdWFsbHkgYmUgaW5jbHVkZWQg aW4gRW5kb3JzZW1lbnQuDQpJdCBpcyBhbHNvIHJlYXNvbmFibGUgdGhhdCBWZXJpZmllciBjb3Vs ZCBkb3duZ3JhZGUg4oCYc2VjdXJpdHkgbGV2ZWzigJkgYmFzZWQgb24gb3RoZXIgY2xhaW1zIGFu ZCBob3cgdGhleSByZWxhdGUgdG8gcG9saWNpZXMuIFNlY3VyaXR5IGxldmVsIGluIEV2aWRlbmNl IGlzIGFuIGFzc2VydGlvbiB0aGUgYXR0ZXN0ZXIgbWFrZXMgdGhhdCBoYXMgdG8gYmUgc3Vic3Rh bnRpYXRlZCBpbiBzb21lIHdheS4gSXQgY291bGQgYWxzbyBiZSB1c2VkIGV4Y2x1c2l2ZWx5IGFz IGEgY29uY2x1c2lvbiBpbiBSZXN1bHRzIGJhc2VkIG9uIHJldmlldyBvZiBhIGJ1bmNoIG9mIG90 aGVyIGNsYWltcyAoaW4gb3RoZXIgd29yZHMgQXR0ZXN0YXRpb24gUmVzdWx0cyBjb2xkIGFjcXVp cmUgYWRkaXRpb25hbCBjbGFpbXMgYmV5b25kIHdoYXQgb3JpZ2luYWxseSBleGlzdGVkIGluIHRo ZSBpbnRlcnNlY3Rpb24gb2YgRXZpZGVuY2UgYW5kIEVuZG9yc2VtZW50Lg0KDQpQb2xpY2llcyBh bmQgb3Igc3RhbmRhcmRpemVkIHByb2ZpbGVzIGRlY2lkZSBhbGwgdGhlc2UgdmFyaWFibGVzIElN SE8uDQoNCkJ1dCB0aGUgZXhhbXBsZSBzZWVtcyB0byBiZSBpbGx1c3RyYXRpdmUgKGlmIHRoYXQg d2FzIHRoZSBpbnRlbnQpLg0KDQotTmVkDQoNCkZyb206IFJBVFMgPHJhdHMtYm91bmNlc0BpZXRm Lm9yZzxtYWlsdG86cmF0cy1ib3VuY2VzQGlldGYub3JnPj4gb24gYmVoYWxmIG9mIExhdXJlbmNl IEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29y dC5jb20+Pg0KRGF0ZTogVGh1cnNkYXksIEFwcmlsIDIsIDIwMjAgYXQgNDoxNiBQTQ0KVG86ICJy YXRzQGlldGYub3JnPG1haWx0bzpyYXRzQGlldGYub3JnPiIgPHJhdHNAaWV0Zi5vcmc8bWFpbHRv OnJhdHNAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtSYXRzXSBQcm9jZXNzaW5nIEVuZG9yc2Vt ZW50cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzDQoNCkxldCBtZSBtYWtlIHRoaXMgbXVjaCBt b3JlIGNvbmNyZXRlIHdpdGggYW4gZXhhbXBsZS4gSeKAmW0gdXNpbmcgSlNPTiByZXByZXNlbnRh dGlvbiBvZiBDV1QvRUFUL0VuZG9yc2VtZW50cyB3aXRoIEMtc3R5bGUgY29tbWVudHMgZm9yIHJl YWRpbmcgZWFzZS4NCg0KRW5kb3JzZW1lbnQNCnsNCiAgICDigJx0cnVzdC1ldmlkZW5jZeKAnTog 4oCcYWxs4oCdLCAgICAgICAgICAgLy8gRTAsIEkganVzdCBtYWRlIHRoaXMgdXANCiAgICDigJxm aWVsZC11cGdyYWRhYmxl4oCdOiB0cnVlLCAgICAgICAgICAvLyBFMSwgZnJvbSBkcmFmdC1iaXJr aG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KICAgIOKAnHNoaWVsZGVkLXNlY3JldOKAnTog aW50ZXJuYWwsICAgICAgIC8vIEUyLCBmcm9tIGRyYWZ0LWJpcmtob2x6LXJhdHMtZW5kb3JzZW1l bnQtZWF0LTAwDQogICAg4oCcY29tbW9uLWNyaXRlcmlh4oCdOiBodHRwczovL3d3dy5jb21tb25j cml0ZXJpYXBvcnRhbC5vcmcvZmlsZXMvZXBmaWxlcy8wODc5VjNhX3BkZi5wZGY8aHR0cHM6Ly9u YW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJG d3d3LmNvbW1vbmNyaXRlcmlhcG9ydGFsLm9yZyUyRmZpbGVzJTJGZXBmaWxlcyUyRjA4NzlWM2Ff cGRmLnBkZiZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3QzQ4MDliNmFi ZjE3MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRi NDclN0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIwMTQyMSZzZGF0YT1FNjl0QUNxTVhtbEhkbmplQlU5 WThjRFQ1REpBd0hvMCUyQjdmQUlndnRVNHMlM0QmcmVzZXJ2ZWQ9MD7igJ0sICAgICAgLy8gRTMs IGZyb20gZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDANCn0NCg0KRXZpZGVu Y2UNCnsNCiAgICDigJxpYXQiOiA1NzM0ODczNDA5ODIzLCAgICAgICAgICAgICAgLy8gQzEgdGlt ZSBzdGFtcCBmb3IgZXZpZGVuY2UgY3JlYXRpb24gdGltZShlZykgZnJvbSBFQVQgZHJhZnQNCiAg ICDigJxzZWN1cml0eS1sZXZlbOKAnTogNCAgICAgICAgICAgICAgICAvLyBDMiB0aGUgc2VjdXJp dHkgbGV2ZWwgaXMg4oCcaGFyZHdhcmXigJ0gZnJvbSBFQVQgZHJhZnQNCiAgICDigJxkZWJ1Zy1k aXNhYmxl4oCdOiDigJxwZXJtYW5lbnTigJ0gICAgICAgLy8gQzMgZGVidWcgaXMgcGVybWFuZW50 bHkgZGlzYWJsZWQgZm9yIGFsbCBidXQgdGhlIE9FTSBmcm9tIEVBVCBkcmFmdA0KfQ0KDQpSZXN1 bHRzDQp7DQogICAg4oCcZmllbGQtdXBncmFkYWJsZeKAnTogdHJ1ZSwgICAgICAgICAgLy8gUjEs IGZyb20gZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDANCiAgICDigJxzaGll bGRlZC1zZWNyZXTigJ06IGludGVybmFsLCAgICAgICAvLyBSMiwgZnJvbSBkcmFmdC1iaXJraG9s ei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMA0KICAgIOKAnGNvbW1vbi1jcml0ZXJpYeKAnTogaHR0 cHM6Ly93d3cuY29tbW9uY3JpdGVyaWFwb3J0YWwub3JnL2ZpbGVzL2VwZmlsZXMvMDg3OVYzYV9w ZGYucGRmPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3Vy bD1odHRwcyUzQSUyRiUyRnd3dy5jb21tb25jcml0ZXJpYXBvcnRhbC5vcmclMkZmaWxlcyUyRmVw ZmlsZXMlMkYwODc5VjNhX3BkZi5wZGYmZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1pY3Jvc29m dC5jb20lN0M0ODA5YjZhYmYxNzI0NTIzNGU3YTA4ZDdkNzg2NTFiMyU3QzcyZjk4OGJmODZmMTQx YWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcyMTQ4NDQ3OTMyMDE0MjEmc2RhdGE9RTY5 dEFDcU1YbWxIZG5qZUJVOVk4Y0RUNURKQXdIbzAlMkI3ZkFJZ3Z0VTRzJTNEJnJlc2VydmVkPTA+ 4oCdLCAgICAgIC8vIFIzLCBmcm9tIGRyYWZ0LWJpcmtob2x6LXJhdHMtZW5kb3JzZW1lbnQtZWF0 LTAwDQogICAg4oCcaWF0IjogNTczNDg3MzQwOTgyMywgICAgICAgICAgICAgIC8vIFI0IHRpbWUg c3RhbXAgZm9yIGV2aWRlbmNlIGNyZWF0aW9uIHRpbWUoZWcpDQogICAg4oCcc2VjdXJpdHktbGV2 ZWzigJ06IDQgICAgICAgICAgICAgICAgLy8gUjUgdGhlIHNlY3VyaXR5IGxldmVsIGlzIOKAnGhh cmR3YXJl4oCdDQogICAg4oCcZGVidWctZGlzYWJsZeKAnTog4oCccGVybWFuZW504oCdICAgICAg IC8vIFI2IGRlYnVnIGlzIHBlcm1hbmVudGx5IGRpc2FibGVkIGZvciBhbGwgYnV0IHRoZSBPRU0N Cn0NCg0KSW4gdGhpcyBleGFtcGxlLCB0aGUgUlAgaXMgcHJvYmFibHkgZmVlZGluZyB0aGlzIGlu dG8gYSByaXNrIGVuZ2luZSBzbyB0aGV5IHdhbnQgYWxsIHRoZSBkZXRhaWxzLg0KDQoNCkhlcmXi gJlzIGFub3RoZXIgdmVyeSBhYmJyZXZpYXRlZCBleGFtcGxlIHdpdGggbWFkZSB1cCBjbGFpbSBu YW1lczoNCg0KRW5kb3JzZW1lbnQgKG5vdCBzaG93aW5nIGFueSBzaWduaW5nKQ0Kew0KICAgIOKA nGV4cGVjdGVkLWhhc2jigJ06IOKAnFRXRnVJR2x6SUdScGMzUnBibWQxYVhOb1pXUXNJRzV2ZENC dmJteDVJR0o1SUdocGN5QnlaV+KAnQ0KfQ0KDQpFdmlkZW5jZQ0Kew0KICAgIOKAnGFjdHVhbC1o YXNo4oCdOiDigJxUV0Z1SUdseklHUnBjM1JwYm1kMWFYTm9aV1FzSUc1dmRDQnZibXg1SUdKNUlH aHBjeUJ5WlciDQp9DQoNClJlc3VsdHMNCnsNCiAgICDigJx2ZXJpZmllZOKAnTogdHJ1ZSwNCn0N Cg0KVGhpcyBhbGwgc2VlbXMgbGlrZSB0aGUgZXZlbnR1YWwgbG9naWNhbCByZXN1bHQgb2YgdGhl IEVBVCwgZW5kb3JzZW1lbnRzIGFuZCBhcmNoaXRlY3R1cmUgZHJhZnRzIHRvIG1lLg0KDQpMTA0K DQoNCg0KDQpPbiBBcHIgMiwgMjAyMCwgYXQgMTI6MzYgUE0sIExhdXJlbmNlIEx1bmRibGFkZSA8 bGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20+PiB3cm90 ZToNCg0KTm93IHRoYXQgd2UgaGF2ZSBhIGZpcnN0IGRyYWZ0IGRlc2NyaWJpbmcgZW5kb3JzZW1l bnRzPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1o dHRwcyUzQSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRtbCUyRmRyYWZ0LWJpcmtob2x6LXJhdHMt ZW5kb3JzZW1lbnQtZWF0LTAwJmRhdGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29t JTdDNDgwOWI2YWJmMTcyNDUyMzRlN2EwOGQ3ZDc4NjUxYjMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFh YjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE0ODQ0NzkzMjExNDIzJnNkYXRhPThaUHkzbnkw N0EzRk8lMkJIbjNmQ3JXbkNvVUtCYklrS2h4YkNNdkY1SmJsOCUzRCZyZXNlcnZlZD0wPiwgYW5k IHRoZXkgbG9vayBsaWtlIEV2aWRlbmNlIGFuZCBSZXN1bHRzLCBpdCBzZWVtcyBpbnRlcmVzdGlu ZyB0byBjb25zaWRlciBzb21lIG9mIGhvdyB0aGUgdmVyaWZpZXIgdXNlcyBFbmRvcnNlbWVudHMg KHJlZmVyZW5jZSB0aGUgYXJjaGl0ZWN0dXJlIGRpYWdyYW0gYmVsb3cpLg0KDQpMZXTigJlzIHNh eSB0aGVyZSBhcmUgdGhyZWUgdGhpbmdzIGluIHRoZSBlbmRvcnNlbWVudCwgRTEsIEUyIGFuZCBF MywgdGhyZWUgdGhpbmdzIGluIHRoZSBldmlkZW5jZSwgQzEsIEMyIGFuZCBDMyBhbmQgdGhyZWUg aW4gdGhlIHJlc3VsdHMsIFIxLCBSMiBhbmQgUjMuDQoNClRoZW4gdGhyZWUgc2ltcGxldG9uIHRv cC1sZXZlbCBjYXNlczoNCg0KMSkgQW4gRW5kb3JzZW1lbnQgaXMgcGFzc2VkIHRocm91Z2ggYW5k IGJlY29tZXMgYSByZXN1bHQ6IEUxIOKAlCA+IFIxDQoyKSBBIENsYWltIGlzIHBhc3NlZCB0aHJv dWdoIGFuZCBiZWNvbWVzIGEgcmVzdWx0czogQzEg4oCUPiBSMg0KMykgU29tZSBlbmRvcnNlbWVu dHMgY29tYmluZSB3aXRoIHNvbWUgY2xhaW1zIHRvIGJlY29tZSBhIHJlc3VsdDoge0UyLCBFMywg QzIsIEMzfSDigJQ+IFIzDQoNCkhvd2V2ZXIgdGhhdCBzZWVtcyB0byBiZSB0b28gc2ltcGxlIGFu ZCBJIHRoaW5rIHRoZXJlIGhhcyB0byBiZSBzb21lIHNvcnQgb2YgYSBwcmltaXRpdmUgZW5kb3Jz ZW1lbnQsIGNhbGwgaXQgRTAsIHdob3NlIHNlbWFudGljcyBhcmUgdGhhdCBzb21lIG9yIGFsbCBv ZiB0aGUgY2xhaW1zIGNhbiBhbHdheXMgYmUgYmVsaWV2ZWQuIEkgdGhpbmsgdGhhdCBtZWFucyAy KSBkb2VzbuKAmXQgcmVhbGx5IGV4aXN0LCBidXQgaGFzIHRvIGJlIHRoaXM6DQoNCjIpIFNvbWUg Y2xhaW1zIGNhbiBwYXNzIHRocm91Z2ggd2l0aCB0aGUgdXNlIG9mIHRoZSBwcmltaXRpdmUgRTAg ZW5kb3JzZW1lbnQ6IHtFMCwgQzF9IOKAlD4gUjINCg0KT25lIHdheSBFMCBjb3VsZCBiZSBkZWZp bmVkIGluIHRoZSBkcmFmdCBkZXNjcmliaW5nIGVuZG9yc2VtZW50czxodHRwczovL25hbTA2LnNh ZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0b29scy5p ZXRmLm9yZyUyRmh0bWwlMkZkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMCZk YXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3QzQ4MDliNmFiZjE3MjQ1MjM0 ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdD MCU3QzYzNzIxNDg0NDc5MzIxMTQyMyZzZGF0YT04WlB5M255MDdBM0ZPJTJCSG4zZkNyV25Db1VL QmJJa0toeGJDTXZGNUpibDglM0QmcmVzZXJ2ZWQ9MD4gaXMgdGhhdCBpdCBpcyBhIGxpc3Qgb2Yg dGhlIGxhYmVscyBvZiBjbGFpbXMgdGhhdCBhcmUgdHJ1c3RlZCB0byBiZSBwYXNzZWQgdGhyb3Vn aC4gRm9yIG51bWVyaWMgbGFiZWxzICBhIHJhbmdlIElOVDY0X01BWCB0byBJTlQ2NF9NSU4gKG9y IC1pbmZpbml0eSB0byAraW5maW5pdHkpICBpbmRpY2F0ZXMgYWxsIGNsYWltcyBhcmUgdHJ1c3Rl ZC4gSXQgY291bGQgYWxzbyBsaXN0IHNwZWNpZmljIG9uZXMgdGhhdCBhcmUgdHJ1c3RlZC4NCg0K RnJvbSB0aGUgVEVFLCBGSURPIGFuZCBBbmRyb2lkIEF0dGVzdGF0aW9uIHZpZXdzIG9mIHRoZSB3 b3JsZCB3aGVyZSBtZWFzdXJlbWVudHMgYXJlbuKAmXQgYSBwcmltYXJ5IHRoaW5nIGFuZCBzZWN1 cmUvdHJ1c3RlZCBib290IGlzIHJlcXVpcmVkIGFuZCBhbHdheXMgb24sIGEgY29tbW9uIG1vZGVs IHdpbGwgYmUgdG8gcGFzcyBldmVyeXRoaW5nIHRocm91Z2ggdG8gY3JlYXRlIGFuIGFnZ3JlZ2F0 ZSByZXN1bHQuIEl0IGNvdWxkIGJlIHJlcHJlc2VudGVkIHRoaXMgd2F5Og0KDQpFMS0+UjENCkUy LT5SMg0KRTMtPlIzDQp7RTAsQzF9LT5SNA0Ke0UwLEMyfS0+UjUNCntFMCxDM30tPlI2DQoNCkkg dGhpbmsgdGhpcyBnb2VzIG9uIHRvIHN1Ym1vZHVsZXMgdG9vIGFuZCBoYXMgc29tZSByZWxhdGlv biB0byB0aGUgYXR0ZW1wdGVkIHRvIHByb3Bvc2UgYSBjb25uZWN0aW9uIHR5cGUuICBFbmRvcnNl bWVudHMgbWF5IGJlIGFibGUgdG8gc2F5IGhvdyBzdWJtb2R1bGVzIGFyZSB0cnVzdGVkLiBUaGVy ZSBtaWdodCBldmVuIGJlIGFuIEUwMCBwcmltaXRpdmUgdGhhdCBzYXlzIHRoZSBsZWFkIGF0dGVz dGVyIGlzIGFsbG93ZWQgdG8gc2F5IGhvdyBzdWJtb2R1bGVzIGFyZSB0cnVzdGVkLiBUaGlzIHdo b2xlIGxpbmUgb2YgdGhpbmtpbmcgd2FzIHBhcnRseSBwcm9tcHRlZCBieSB0aGlzIGlzc3VlPGh0 dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRmdpdGh1Yi5jb20lMkZpZXRmLXJhdHMtd2clMkZlYXQlMkZpc3N1ZXMlMkY1OCZkYXRh PTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3QzQ4MDliNmFiZjE3MjQ1MjM0ZTdh MDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3 QzYzNzIxNDg0NDc5MzIyMTQxNCZzZGF0YT11WFgzdGpaQ29jUFVxRUk0N0JvRFBIVmFTT1dhQXNz RGpsU1daZ1kwZlp3JTNEJnJlc2VydmVkPTA+IGFnYWluc3QgRUFUIGFuZCBjb21tZW50cyBmcm9t IEdpcmkgYW5kIERhdmUuDQoNCkxMDQoNCg0KDQogICAgICAgICAgICAgICAgICoqKioqKioqKioq KiAgICoqKioqKioqKioqKiAgICAqKioqKioqKioqKioqKioqKg0KDQogICAgICAgICAgICAgICAg ICogRW5kb3JzZXIgKiAgICogVmVyaWZpZXIgKiAgICAqIFJlbHlpbmcgUGFydHkgKg0KDQogICAg ICAgICAgICAgICAgICoqKioqKioqKioqKiAgICogIE93bmVyICAgKiAgICAqICBPd25lciAgICAg ICAgKg0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICoqKioqKioqKioqKiAgICAq KioqKioqKioqKioqKioqKg0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAg IHwgICAgICAgICAgICAgICAgIHwNCg0KICAgICAgICAgICBFbmRvcnNlbWVudHN8ICAgICAgICAg ICAgICB8ICAgICAgICAgICAgICAgICB8DQoNCiAgICAgICAgICAgICAgICAgICAgICAgfCAgICAg ICAgICAgICAgfEFwcHJhaXNhbCAgICAgICAgfA0KDQogICAgICAgICAgICAgICAgICAgICAgIHwg ICAgICAgICAgICAgIHxQb2xpY3kgZm9yICAgICAgIHwNCg0KICAgICAgICAgICAgICAgICAgICAg ICB8ICAgICAgICAgICAgICB8RXZpZGVuY2UgICAgICAgICB8IEFwcHJhaXNhbA0KDQogICAgICAg ICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgIHwgUG9saWN5 IGZvcg0KDQogICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgIHwgICAgICAgICAg ICAgICAgIHwgQXR0ZXN0YXRpb24NCg0KICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAg ICAgICB8ICAgICAgICAgICAgICAgICB8ICBSZXN1bHQNCg0KICAgICAgICAgICAgICAgICAgICAg ICB2ICAgICAgICAgICAgICB2ICAgICAgICAgICAgICAgICB8DQoNCiAgICAgICAgICAgICAgICAg ICAgIC4tLS0tLS0tLS0tLS0tLS0tLS4gICAgICAgICAgICAgICAgfA0KDQogICAgICAgICAgICAg IC4tLS0tLT58ICAgICBWZXJpZmllciAgICB8LS0tLS0tLiAgICAgICAgIHwNCg0KICAgICAgICAg ICAgICB8ICAgICAgJy0tLS0tLS0tLS0tLS0tLS0tJyAgICAgIHwgICAgICAgICB8DQoNCiAgICAg ICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgfA0KDQog ICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgIEF0dGVzdGF0aW9ufCAgICAgICAgIHwN Cg0KICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICBSZXN1bHRzICAgIHwgICAgICAg ICB8DQoNCiAgICAgICAgICAgICAgfCBFdmlkZW5jZSAgICAgICAgICAgICAgICAgICAgICB8ICAg ICAgICAgfA0KDQogICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgICAgICAgIHwNCg0KICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHYgICAgICAgICB2DQoNCiAgICAgICAgLi0tLS0tLS0tLS0uICAgICAgICAgICAgICAgICAg ICAgIC4tLS0tLS0tLS0tLS0tLS0tLS4NCg0KICAgICAgICB8IEF0dGVzdGVyIHwgICAgICAgICAg ICAgICAgICAgICAgfCBSZWx5aW5nIFBhcnR5ICAgfA0KDQogICAgICAgICctLS0tLS0tLS0tJyAg ICAgICAgICAgICAgICAgICAgICAnLS0tLS0tLS0tLS0tLS0tLS0nDQoNCg0KDQoNCg0KDQoNCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpSQVRTIG1haWxp bmcgbGlzdA0KUkFUU0BpZXRmLm9yZzxtYWlsdG86UkFUU0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0cw0KDQo= --_000_B5C5BA4AD11B4C4A95B000AD41ACAECCintelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <50ED8CE91461E34AAB405111846DC317@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkg MiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpNZW5sbzsNCglwYW5vc2Ut MToyIDExIDYgOSAzIDggNCAyIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29O b3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdp bi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpwcmUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFBy ZWZvcm1hdHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN Cglmb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bhbi5I VE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQg Q2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFBy ZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29sYXM7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjIN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIg TmV3IjsNCgljb2xvcjp3aW5kb3d0ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0 eWxlOm5vcm1hbDsNCgl0ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCi5Nc29DaHBEZWZhdWx0 DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30N Ci0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxp bms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5B bm90aGVyIHdheSB0byB1bmRlcnN0YW5kIGl0IGlzIGlmIHRoZSBzdGF0ZSBpcyB1cGRhdGVkIGJ5 IGxpZmVjeWNsZSBldmVudHMsIHN1Y2ggYXMgU1cgdXBkYXRlLCB0aGVuIHRoZSBFbmRvcnNlbWVu dCB0aGF0IGlzIHJlbmRlcmVkIHVudHJ1ZSBhcyBhIHJlc3VsdCBuZWVkcyB0byBiZSB1cGRhdGVk IHRvby48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+VGhlc2UgYXJlIHRoZSBzZW1hbnRpY3MgZm9y IFNXIHVwZGF0ZSBpbWFnZSBpbnRlZ3JpdHkuIFRoZXkgY291bGQgYXBwbHkgdG8gZGVidWcgc3Rh dGUgdG9vLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5FeHBpcmF0aW9uIG9mIGEg4oCYc3RhdGlj 4oCZIEVuZG9yc2VtZW50IGNsYWltIGRvZXNu4oCZdCBtYWtlIHRoZSBpbnRyaW5zaWMgbmF0dXJl IG9mIHRoZSBjbGFpbSBnbyBhd2F5LCBqdXN0IHRoZSBhc3NlcnRpb24gb2YgdGhlIGNsYWltIGdv ZXMgYXdheS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5UaGUgYWx0ZXJuYXRpdmUsIHRoYXQg YW4gYXR0ZXN0YXRpb24gb2YgdGhlIGNsYWltIGRvZXNu4oCZdCByZXBsYWNlIHRoZSByb2xlIG9m IEVuZG9yc2VtZW50IGNhbiBhbHNvIGJlIHRydWUuIEl0IGp1c3QgbWVhbnMgdGhlIEV2aWRlbmNl IGlzIHByZXNlbnRlZCB3aXRob3V0IGNvcnJlc3BvbmRpbmcgRW5kb3JzZW1lbnQuIFRoZSB2ZXJp Zmllcg0KIG1pZ2h0IHN0aWxsIGFjY2VwdCB0aGUgRXZpZGVuY2UgYmVjYXVzZSBvZiB0aGUgdHJ1 c3QgaXQgcGxhY2VzIGluIHRoZSBBdHRlc3RpbmcgRW52aXJvbm1lbnQgdG8ga25vdyB0aGF0IHRo ZSBjbGFpbSBpcyBleHRhbnQuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+VGhlc2UgYXJlIGFs bCBleGFtcGxlcyBvZiBjb3JuZXIgY29uZGl0aW9ucyB0aGF0IEFwcHJhaXNhbCBwb2xpY3kgbmVl ZHMgdG8gY29tcHJlaGVuZCBJTU8uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPi1OZWQ8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5EYXZlIFRoYWxlciAm bHQ7ZHRoYWxlckBtaWNyb3NvZnQuY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UaHVyc2RheSwg QXByaWwgMiwgMjAyMCBhdCA5OjI3IFBNPGJyPg0KPGI+VG86IDwvYj4mcXVvdDtTbWl0aCwgTmVk JnF1b3Q7ICZsdDtuZWQuc21pdGhAaW50ZWwuY29tJmd0OywgTGF1cmVuY2UgTHVuZGJsYWRlICZs dDtsZ2xAaXNsYW5kLXJlc29ydC5jb20mZ3Q7LCAmcXVvdDtyYXRzQGlldGYub3JnJnF1b3Q7ICZs dDtyYXRzQGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SRTogW1JhdHNdIFByb2Nl c3NpbmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRvIFJlc3VsdHM8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMxRjQ5N0QiPkRlYnVnLWRpc2FibGUgaXMgbm90IChpbiBnZW5lcmFsLCBidXQgY2FuIGJl IGluIHNwZWNpZmljIGNhc2VzKSBwZXJtYW5lbnQgZm9yIGEgZGV2aWNlLCBpdCBjYW4gdmFyeSBi eSBhcHBsaWNhdGlvbiBvbiB0aGUgc2FtZSBkZXZpY2UsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPmFuZCBjYW4g dmFyeSBvdmVyIHRpbWUgYXMgc2F5IHNvZnR3YXJlL2Zpcm13YXJlIGlzIHBhdGNoZWQgb3IgY29u ZmlndXJlZCwgc28gY2Fubm90IGluIHRoYXQgY2FzZSBiZSBpbiBhbiBlbmRvcnNlbWVudC48L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkFsc28gSSB3b3VsZCBleHBlY3QgdGhh dCBlbmRvcnNlbWVudHMgZ2VuZXJhbGx5IGFsc28gY2Fycnkgc29tZSBzb3J0IG9mIGV4cGlyYXRp b24gb3IgdmFsaWRpdHkgcGVyaW9kIGFzIHdlbGwsIHdoaWNoIGlzbuKAmXQgaW4gTGF1cmVuY2Xi gJlzIGV4YW1wbGUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPihBbmQgZXhwaXJhdGlvbiB0aW1lIGlzIGFuIGV4 YW1wbGUgb2Ygc29tZXRoaW5nIHRoYXQgZXF1YWxpdHkgY29tcGFyaXNvbiBhZ2FpbnN0IGEg4oCc a25vd24gZ29vZCB2YWx1ZeKAnSBkb2VzbuKAmXQgd29yayBmb3IuKTwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+RGF2ZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpz b2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IFJBVFMgJmx0O3JhdHMtYm91bmNlc0BpZXRmLm9yZyZn dDsgPGI+T24gQmVoYWxmIE9mIDwvYj4NClNtaXRoLCBOZWQ8YnI+DQo8Yj5TZW50OjwvYj4gVGh1 cnNkYXksIEFwcmlsIDIsIDIwMjAgOToyMCBQTTxicj4NCjxiPlRvOjwvYj4gTGF1cmVuY2UgTHVu ZGJsYWRlICZsdDtsZ2xAaXNsYW5kLXJlc29ydC5jb20mZ3Q7OyByYXRzQGlldGYub3JnPGJyPg0K PGI+U3ViamVjdDo8L2I+IFJlOiBbUmF0c10gUHJvY2Vzc2luZyBFbmRvcnNlbWVudHMgYW5kIEV2 aWRlbmNlIGludG8gUmVzdWx0czxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5CVFc6 IFNpbmNlIOKAmGRlYnVnLWRpc2FibGXigJkgaXMgcGVybWFuZW50IGl0IGNvdWxkIHByb2JhYmx5 IGVxdWFsbHkgYmUgaW5jbHVkZWQgaW4gRW5kb3JzZW1lbnQuDQo8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPkl0IGlzIGFsc28gcmVhc29uYWJsZSB0aGF0IFZlcmlmaWVyIGNv dWxkIGRvd25ncmFkZSDigJhzZWN1cml0eSBsZXZlbOKAmSBiYXNlZCBvbiBvdGhlciBjbGFpbXMg YW5kIGhvdyB0aGV5IHJlbGF0ZSB0byBwb2xpY2llcy4gU2VjdXJpdHkgbGV2ZWwgaW4gRXZpZGVu Y2UgaXMgYW4gYXNzZXJ0aW9uIHRoZSBhdHRlc3RlciBtYWtlcyB0aGF0IGhhcyB0bw0KIGJlIHN1 YnN0YW50aWF0ZWQgaW4gc29tZSB3YXkuIEl0IGNvdWxkIGFsc28gYmUgdXNlZCBleGNsdXNpdmVs eSBhcyBhIGNvbmNsdXNpb24gaW4gUmVzdWx0cyBiYXNlZCBvbiByZXZpZXcgb2YgYSBidW5jaCBv ZiBvdGhlciBjbGFpbXMgKGluIG90aGVyIHdvcmRzIEF0dGVzdGF0aW9uIFJlc3VsdHMgY29sZCBh Y3F1aXJlIGFkZGl0aW9uYWwgY2xhaW1zIGJleW9uZCB3aGF0IG9yaWdpbmFsbHkgZXhpc3RlZCBp biB0aGUgaW50ZXJzZWN0aW9uIG9mIEV2aWRlbmNlDQogYW5kIEVuZG9yc2VtZW50Ljwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij5Qb2xpY2llcyBhbmQgb3Igc3RhbmRhcmRpemVkIHByb2ZpbGVzIGRl Y2lkZSBhbGwgdGhlc2UgdmFyaWFibGVzIElNSE8uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPkJ1 dCB0aGUgZXhhbXBsZSBzZWVtcyB0byBiZSBpbGx1c3RyYXRpdmUgKGlmIHRoYXQgd2FzIHRoZSBp bnRlbnQpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4tTmVkPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2IHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBw dCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+UkFUUyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJh dHMtYm91bmNlc0BpZXRmLm9yZyI+cmF0cy1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgb24gYmVo YWxmIG9mIExhdXJlbmNlIEx1bmRibGFkZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxnbEBpc2xhbmQt cmVzb3J0LmNvbSI+bGdsQGlzbGFuZC1yZXNvcnQuY29tPC9hPiZndDs8YnI+DQo8Yj5EYXRlOiA8 L2I+VGh1cnNkYXksIEFwcmlsIDIsIDIwMjAgYXQgNDoxNiBQTTxicj4NCjxiPlRvOiA8L2I+JnF1 b3Q7PGEgaHJlZj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPnJhdHNAaWV0Zi5vcmc8L2E+JnF1b3Q7 ICZsdDs8YSBocmVmPSJtYWlsdG86cmF0c0BpZXRmLm9yZyI+cmF0c0BpZXRmLm9yZzwvYT4mZ3Q7 PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbUmF0c10gUHJvY2Vzc2luZyBFbmRvcnNlbWVudHMg YW5kIEV2aWRlbmNlIGludG8gUmVzdWx0czwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MZXQgbWUgbWFrZSB0aGlzIG11Y2ggbW9yZSBjb25jcmV0 ZSB3aXRoIGFuIGV4YW1wbGUuIEnigJltIHVzaW5nIEpTT04gcmVwcmVzZW50YXRpb24gb2YgQ1dU L0VBVC9FbmRvcnNlbWVudHMgd2l0aCBDLXN0eWxlIGNvbW1lbnRzIGZvciByZWFkaW5nIGVhc2Uu DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx1PkVuZG9y c2VtZW50PC91PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij57 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDsgJm5ic3A7IOKAnHRydXN0LWV2aWRlbmNl4oCdOiDigJxhbGzigJ0sICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgLy8gRTAsIEkganVzdCBtYWRlIHRoaXMgdXA8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg 4oCcZmllbGQtdXBncmFkYWJsZeKAnTogdHJ1ZSwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOy8vIEUxLCBmcm9tJm5ic3A7ZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1l YXQtMDA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDsg4oCcc2hpZWxkZWQtc2VjcmV04oCdOiBpbnRlcm5hbCwgJm5ic3A7ICZu YnNwOyAmbmJzcDsgLy8gRTIsIGZyb20mbmJzcDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2Vt ZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+Jm5ic3A7ICZuYnNwOyDigJxjb21tb24tY3JpdGVyaWHigJ06DQo8YSBocmVmPSJodHRw czovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0El MkYlMkZ3d3cuY29tbW9uY3JpdGVyaWFwb3J0YWwub3JnJTJGZmlsZXMlMkZlcGZpbGVzJTJGMDg3 OVYzYV9wZGYucGRmJmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3 QzQ4MDliNmFiZjE3MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIwMTQyMSZhbXA7c2RhdGE9RTY5dEFD cU1YbWxIZG5qZUJVOVk4Y0RUNURKQXdIbzAlMkI3ZkFJZ3Z0VTRzJTNEJmFtcDtyZXNlcnZlZD0w Ij4NCmh0dHBzOi8vd3d3LmNvbW1vbmNyaXRlcmlhcG9ydGFsLm9yZy9maWxlcy9lcGZpbGVzLzA4 NzlWM2FfcGRmLnBkZjwvYT7igJ0sICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gRTMsIGZyb20mbmJz cDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHU+RXZpZGVuY2U8L3U+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPns8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg 4oCcaWF0JnF1b3Q7OiA1NzM0ODczNDA5ODIzLCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsvLyBDMSB0aW1lIHN0YW1wIGZvciBldmlkZW5jZSBjcmVhdGlv biB0aW1lKGVnKSBmcm9tIEVBVCBkcmFmdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxzZWN1cml0eS1sZXZlbOKAnTog NCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 Ly8gQzIgdGhlIHNlY3VyaXR5IGxldmVsIGlzIOKAnGhhcmR3YXJl4oCdJm5ic3A7ZnJvbSBFQVQg ZHJhZnQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDsg4oCcZGVidWctZGlzYWJsZeKAnTog4oCccGVybWFuZW504oCdICZuYnNw OyAmbmJzcDsgJm5ic3A7IC8vIEMzIGRlYnVnIGlzIHBlcm1hbmVudGx5IGRpc2FibGVkIGZvciBh bGwgYnV0IHRoZSBPRU0mbmJzcDtmcm9tIEVBVCBkcmFmdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHU+UmVzdWx0czwvdT48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ezwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg 4oCcZmllbGQtdXBncmFkYWJsZeKAnTogdHJ1ZSwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOy8vIFIxLCBmcm9tJm5ic3A7ZHJhZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1l YXQtMDA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDsg4oCcc2hpZWxkZWQtc2VjcmV04oCdOiBpbnRlcm5hbCwgJm5ic3A7ICZu YnNwOyAmbmJzcDsgLy8gUjIsIGZyb20mbmJzcDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2Vt ZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+Jm5ic3A7ICZuYnNwOyDigJxjb21tb24tY3JpdGVyaWHigJ06DQo8YSBocmVmPSJodHRw czovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0El MkYlMkZ3d3cuY29tbW9uY3JpdGVyaWFwb3J0YWwub3JnJTJGZmlsZXMlMkZlcGZpbGVzJTJGMDg3 OVYzYV9wZGYucGRmJmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3 QzQ4MDliNmFiZjE3MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIwMTQyMSZhbXA7c2RhdGE9RTY5dEFD cU1YbWxIZG5qZUJVOVk4Y0RUNURKQXdIbzAlMkI3ZkFJZ3Z0VTRzJTNEJmFtcDtyZXNlcnZlZD0w Ij4NCmh0dHBzOi8vd3d3LmNvbW1vbmNyaXRlcmlhcG9ydGFsLm9yZy9maWxlcy9lcGZpbGVzLzA4 NzlWM2FfcGRmLnBkZjwvYT7igJ0sICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gUjMsIGZyb20mbmJz cDtkcmFmdC1iaXJraG9sei1yYXRzLWVuZG9yc2VtZW50LWVhdC0wMDwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg 4oCcaWF0JnF1b3Q7OiA1NzM0ODczNDA5ODIzLCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsvLyBSNCB0aW1lIHN0YW1wIGZvciBldmlkZW5jZSBjcmVhdGlv biB0aW1lKGVnKTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+Jm5ic3A7ICZuYnNwOyDigJxzZWN1cml0eS1sZXZlbOKAnTogNCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7Ly8gUjUgdGhlIHNlY3Vy aXR5IGxldmVsIGlzIOKAnGhhcmR3YXJl4oCdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7IOKAnGRlYnVnLWRpc2FibGXigJ06 IOKAnHBlcm1hbmVudOKAnSAmbmJzcDsgJm5ic3A7ICZuYnNwOyAvLyBSNiBkZWJ1ZyBpcyBwZXJt YW5lbnRseSBkaXNhYmxlZCBmb3IgYWxsIGJ1dCB0aGUgT0VNPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPn08L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4g dGhpcyBleGFtcGxlLCB0aGUgUlAgaXMgcHJvYmFibHkgZmVlZGluZyB0aGlzIGludG8gYSByaXNr IGVuZ2luZSBzbyB0aGV5IHdhbnQgYWxsIHRoZSBkZXRhaWxzLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhlcmXigJlzIGFub3RoZXIgdmVy eSBhYmJyZXZpYXRlZCBleGFtcGxlIHdpdGggbWFkZSB1cCBjbGFpbSBuYW1lczo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx1PkVu ZG9yc2VtZW50IChub3Qgc2hvd2luZyBhbnkgc2lnbmluZyk8L3U+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPns8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg4oCcZXhwZWN0ZWQtaGFzaOKA nTog4oCcVFdGdUlHbHpJR1JwYzNScGJtZDFhWE5vWldRc0lHNXZkQ0J2Ym14NUlHSjVJR2hwY3lC eVpX4oCdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ij59PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48dT5FdmlkZW5jZTwvdT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+ezwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OyI+Jm5ic3A7ICZuYnNwOyDigJxhY3R1YWwtaGFzaOKAnTog4oCcVFdGdUlHbHpJR1Jw YzNScGJtZDFhWE5vWldRc0lHNXZkQ0J2Ym14NUlHSjVJR2hwY3lCeVpXJnF1b3Q7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij59PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dT5SZXN1 bHRzPC91PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij57PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ Jm5ic3A7ICZuYnNwOyDigJx2ZXJpZmllZOKAnTogdHJ1ZSwgJm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij59PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+VGhpcyBhbGwgc2VlbXMgbGlrZSB0aGUgZXZlbnR1YWwgbG9naWNhbCByZXN1bHQgb2YgdGhl IEVBVCwgZW5kb3JzZW1lbnRzIGFuZCBhcmNoaXRlY3R1cmUgZHJhZnRzIHRvIG1lLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MTDxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gQXByIDIsIDIwMjAsIGF0IDEyOjM2IFBNLCBMYXVy ZW5jZSBMdW5kYmxhZGUgJmx0OzxhIGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20i PmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5vdyZuYnNwO3RoYXQgd2UgaGF2ZSBh IGZpcnN0Jm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5v dXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdG9vbHMuaWV0Zi5vcmclMkZodG1sJTJGZHJh ZnQtYmlya2hvbHotcmF0cy1lbmRvcnNlbWVudC1lYXQtMDAmYW1wO2RhdGE9MDIlN0MwMSU3Q2R0 aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDNDgwOWI2YWJmMTcyNDUyMzRlN2EwOGQ3ZDc4NjUxYjMl N0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE0ODQ0Nzkz MjExNDIzJmFtcDtzZGF0YT04WlB5M255MDdBM0ZPJTJCSG4zZkNyV25Db1VLQmJJa0toeGJDTXZG NUpibDglM0QmYW1wO3Jlc2VydmVkPTAiPmRyYWZ0DQogZGVzY3JpYmluZyBlbmRvcnNlbWVudHM8 L2E+LCBhbmQgdGhleSBsb29rIGxpa2UgRXZpZGVuY2UgYW5kIFJlc3VsdHMsIGl0IHNlZW1zIGlu dGVyZXN0aW5nIHRvIGNvbnNpZGVyIHNvbWUgb2YgaG93IHRoZSB2ZXJpZmllciB1c2VzIEVuZG9y c2VtZW50cyAocmVmZXJlbmNlIHRoZSBhcmNoaXRlY3R1cmUgZGlhZ3JhbSBiZWxvdykuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkxldOKAmXMg c2F5IHRoZXJlIGFyZSB0aHJlZSB0aGluZ3MgaW4gdGhlIGVuZG9yc2VtZW50LCBFMSwgRTIgYW5k IEUzLCB0aHJlZSB0aGluZ3MgaW4gdGhlIGV2aWRlbmNlLCBDMSwgQzIgYW5kIEMzIGFuZCB0aHJl ZSBpbiB0aGUgcmVzdWx0cywgUjEsIFIyIGFuZCBSMy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlbiB0aHJlZSBzaW1wbGV0b24gdG9wLWxl dmVsIGNhc2VzOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdp bi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjEpIEFuIEVuZG9y c2VtZW50IGlzIHBhc3NlZCB0aHJvdWdoIGFuZCBiZWNvbWVzIGEgcmVzdWx0OiBFMSDigJQgJmd0 OyBSMTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ MikgQSBDbGFpbSBpcyBwYXNzZWQgdGhyb3VnaCBhbmQgYmVjb21lcyBhIHJlc3VsdHM6IEMxIOKA lCZndDsgUjI8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjMpIFNvbWUgZW5kb3JzZW1lbnRzIGNvbWJpbmUgd2l0aCBzb21lIGNsYWltcyB0byBiZWNv bWUgYSByZXN1bHQ6IHtFMiwgRTMsIEMyLCBDM30g4oCUJmd0OyBSMzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ib3dl dmVyIHRoYXQgc2VlbXMgdG8gYmUgdG9vIHNpbXBsZSBhbmQgSSB0aGluayB0aGVyZSBoYXMgdG8g YmUgc29tZSBzb3J0IG9mIGEgcHJpbWl0aXZlIGVuZG9yc2VtZW50LCBjYWxsIGl0IEUwLCB3aG9z ZSBzZW1hbnRpY3MgYXJlIHRoYXQgc29tZSBvciBhbGwgb2YgdGhlIGNsYWltcyBjYW4gYWx3YXlz IGJlIGJlbGlldmVkLiBJIHRoaW5rIHRoYXQgbWVhbnMgMikgZG9lc27igJl0IHJlYWxseSBleGlz dCwgYnV0DQogaGFzIHRvIGJlIHRoaXM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1y aWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjIpIFNvbWUgY2xhaW1zIGNhbiBwYXNzIHRocm91Z2ggd2l0aCB0aGUgdXNlIG9m IHRoZSBwcmltaXRpdmUgRTAgZW5kb3JzZW1lbnQ6IHtFMCwgQzF9IOKAlCZndDsgUjI8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5PbmUgd2F5IEUwIGNvdWxkIGJlIGRlZmluZWQgaW4gdGhlJm5ic3A7PGEg aHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJs PWh0dHBzJTNBJTJGJTJGdG9vbHMuaWV0Zi5vcmclMkZodG1sJTJGZHJhZnQtYmlya2hvbHotcmF0 cy1lbmRvcnNlbWVudC1lYXQtMDAmYW1wO2RhdGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3Nv ZnQuY29tJTdDNDgwOWI2YWJmMTcyNDUyMzRlN2EwOGQ3ZDc4NjUxYjMlN0M3MmY5ODhiZjg2ZjE0 MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjE0ODQ0NzkzMjExNDIzJmFtcDtzZGF0 YT04WlB5M255MDdBM0ZPJTJCSG4zZkNyV25Db1VLQmJJa0toeGJDTXZGNUpibDglM0QmYW1wO3Jl c2VydmVkPTAiPmRyYWZ0DQogZGVzY3JpYmluZyBlbmRvcnNlbWVudHM8L2E+Jm5ic3A7aXMgdGhh dCBpdCBpcyBhIGxpc3Qgb2YgdGhlIGxhYmVscyBvZiBjbGFpbXMgdGhhdCBhcmUgdHJ1c3RlZCB0 byBiZSBwYXNzZWQgdGhyb3VnaC4gRm9yIG51bWVyaWMgbGFiZWxzICZuYnNwO2EgcmFuZ2UmbmJz cDs8c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5Ok1lbmxvO2NvbG9yOiMw MDc0MDA7YmFja2dyb3VuZDp3aGl0ZSI+SU5UNjRfTUFYPC9zcGFuPiZuYnNwO3RvJm5ic3A7PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZhbWlseTpNZW5sbztjb2xvcjojMDA3NDAw O2JhY2tncm91bmQ6d2hpdGUiPklOVDY0X01JTiZuYnNwOzwvc3Bhbj4ob3INCiAtaW5maW5pdHkg dG8gJiM0MztpbmZpbml0eSkgJm5ic3A7aW5kaWNhdGVzIGFsbCBjbGFpbXMgYXJlIHRydXN0ZWQu IEl0IGNvdWxkIGFsc28gbGlzdCBzcGVjaWZpYyBvbmVzIHRoYXQgYXJlIHRydXN0ZWQuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZyb20gdGhl IFRFRSwgRklETyBhbmQgQW5kcm9pZCBBdHRlc3RhdGlvbiB2aWV3cyBvZiB0aGUgd29ybGQgd2hl cmUgbWVhc3VyZW1lbnRzIGFyZW7igJl0IGEgcHJpbWFyeSB0aGluZyBhbmQgc2VjdXJlL3RydXN0 ZWQgYm9vdCBpcyByZXF1aXJlZCBhbmQgYWx3YXlzIG9uLCBhIGNvbW1vbiBtb2RlbCB3aWxsIGJl IHRvIHBhc3MgZXZlcnl0aGluZyB0aHJvdWdoIHRvIGNyZWF0ZSBhbiBhZ2dyZWdhdGUgcmVzdWx0 Lg0KIEl0IGNvdWxkIGJlIHJlcHJlc2VudGVkIHRoaXMgd2F5OjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OyI+RTEtJmd0O1IxPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij5FMi0mZ3Q7UjI8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPkUzLSZndDtSMzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+e0UwLEMxfS0mZ3Q7UjQ8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPntFMCxDMn0tJmd0O1I1PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij57RTAsQzN9LSZndDtS Njwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB0aGluayB0aGlzIGdvZXMgb24gdG8gc3VibW9kdWxlcyB0 b28gYW5kIGhhcyBzb21lIHJlbGF0aW9uIHRvIHRoZSBhdHRlbXB0ZWQgdG8gcHJvcG9zZSBhIGNv bm5lY3Rpb24gdHlwZS4gJm5ic3A7RW5kb3JzZW1lbnRzIG1heSBiZSBhYmxlIHRvIHNheSBob3cg c3VibW9kdWxlcyBhcmUgdHJ1c3RlZC4gVGhlcmUgbWlnaHQgZXZlbiBiZSBhbiBFMDAgcHJpbWl0 aXZlIHRoYXQgc2F5cyB0aGUgbGVhZCBhdHRlc3RlciBpcw0KIGFsbG93ZWQgdG8gc2F5IGhvdyBz dWJtb2R1bGVzIGFyZSB0cnVzdGVkLiBUaGlzIHdob2xlIGxpbmUgb2YgdGhpbmtpbmcgd2FzIHBh cnRseSBwcm9tcHRlZCBieSB0aGlzJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlu a3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUy RmlldGYtcmF0cy13ZyUyRmVhdCUyRmlzc3VlcyUyRjU4JmFtcDtkYXRhPTAyJTdDMDElN0NkdGhh bGVyJTQwbWljcm9zb2Z0LmNvbSU3QzQ4MDliNmFiZjE3MjQ1MjM0ZTdhMDhkN2Q3ODY1MWIzJTdD NzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzIxNDg0NDc5MzIy MTQxNCZhbXA7c2RhdGE9dVhYM3RqWkNvY1BVcUVJNDdCb0RQSFZhU09XYUFzc0RqbFNXWmdZMGZa dyUzRCZhbXA7cmVzZXJ2ZWQ9MCI+aXNzdWU8L2E+Jm5ic3A7YWdhaW5zdA0KIEVBVCBhbmQgY29t bWVudHMgZnJvbSBHaXJpIGFuZCBEYXZlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTogcGFnZSI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7ICoqKioqKioqKioqKiZuYnNwOyZuYnNwOyAqKioqKioqKioqKiom bmJzcDsmbmJzcDsmbmJzcDsgKioqKioqKioqKioqKioqKio8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgKiBFbmRvcnNlciAqJm5i c3A7Jm5ic3A7ICogVmVyaWZpZXIgKiZuYnNwOyZuYnNwOyZuYnNwOyAqIFJlbHlpbmcgUGFydHkg KjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyAqKioqKioqKioqKiombmJzcDsmbmJzcDsgKiZuYnNwOyBPd25lciZuYnNwOyZuYnNw OyAqJm5ic3A7Jm5ic3A7Jm5ic3A7ICombmJzcDsgT3duZXImbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgKjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICoqKioq KioqKioqKiZuYnNwOyZuYnNwOyZuYnNwOyAqKioqKioqKioqKioqKioqKjxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyBFbmRvcnNlbWVudHN8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHxBcHByYWlzYWwmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHxQb2xpY3kgZm9yJm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8RXZpZGVuY2UgJm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7fCBBcHByYWlzYWw8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwgUG9saWN5 IGZvcjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCBB dHRlc3RhdGlvbjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgfCZuYnNwOyBSZXN1bHQ8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgdiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt2Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLi0tLS0tLS0tLS0tLS0t LS0tLiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC4tLS0tLSZndDt8Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IFZlcmlmaWVyJm5ic3A7Jm5ic3A7Jm5ic3A7IHwtLS0tLS0uJm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAn LS0tLS0tLS0tLS0tLS0tLS0nJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfDxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7fDxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEF0dGVzdGF0aW9ufCZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHwmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgUmVzdWx0cyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCBFdmlkZW5jZSZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB8Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHw8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt2Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHY8bzpwPjwvbzpwPjwvcHJlPg0K PHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLi0tLS0tLS0t LS0uJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IC4tLS0tLS0tLS0tLS0tLS0tLS48bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfCBBdHRlc3RlciB8 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHwgUmVseWluZyBQYXJ0eSZuYnNwOyZuYnNwOyB8PG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICctLS0t LS0tLS0tJyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyAnLS0tLS0tLS0tLS0tLS0tLS0nPG86cD48L286cD48L3ByZT4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KUkFUUyBtYWls aW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86UkFUU0BpZXRmLm9yZyI+UkFUU0BpZXRmLm9y ZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3JhdHMiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0czwvYT48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8 L2h0bWw+DQo= --_000_B5C5BA4AD11B4C4A95B000AD41ACAECCintelcom_-- From nobody Tue Apr 7 04:41:15 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE3A63A003D for ; Tue, 7 Apr 2020 04:41:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, T_SPF_TEMPERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hqx1-eFOma2D for ; Tue, 7 Apr 2020 04:41:08 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A5043A0030 for ; Tue, 7 Apr 2020 04:41:08 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id B3AFF3897B for ; Tue, 7 Apr 2020 07:39:27 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id A4EB34CC for ; Tue, 7 Apr 2020 07:41:02 -0400 (EDT) From: Michael Richardson To: rats@ietf.org X-Attribution: mcr X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 25.1.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Rats] architecture design team meeting 2020-04-07 - cancelled X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2020 11:41:14 -0000 --=-=-= Content-Type: text/plain To be clear, there is no architecture design team meeting today. It conflicted with TEEP virtual interim, so it was cancelled. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl6MZs4ACgkQgItw+93Q 3WW8jggAkuv7MSOnsXYDtVQsjv2GwhJ5L8P+miHfrCBR7mofy1o896dZLjQ1uk6v GejxtMD3dK/P9dXa6a/PD0VSE08eWcvwxkyHuCHctzIwGcpB3elfndoUIbqfnB94 yoMdrjsyH9NmDsqKRuoFkJlPjCBwne6AL6suksvRbf12bw1O5QyxVe0FYhWZBeQq fSSxE94FGFM9+PsFsphCzDaluKp60ZNXLplvt9lFVYLw4VZ82vITWX6k4BjUkZXB mOpbjQjE29IdyUr388kgfYSsSromexu5JK7UC/wBxM8IN+p6Ucg4x2sBDsMomofH bNPYDmhirHnsGfdMqKr6ZCM5Jjy7YQ== =VXBC -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Apr 7 07:36:17 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A1663A0B0B for ; Tue, 7 Apr 2020 07:36:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=wx8FGBaE; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=wx8FGBaE Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sqW-CjHAoV2S for ; Tue, 7 Apr 2020 07:36:12 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40049.outbound.protection.outlook.com [40.107.4.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1BB623A0B07 for ; Tue, 7 Apr 2020 07:36:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G3c0DgptuDekqhpsfrC0IoqMEV3tbBrCKLRrXfJNOpE=; b=wx8FGBaEsgsWERe80b52CFhtGb7ph4ej3pSYFtQEEak+rnz5RpZ8Bb9iq6AQMSCRIBXg+4MOuKkdlbHdFdNDRNUIzkyUhkGpc1V5yHsnwd4Kc8lMBUogCvRMGzItMpU9E9WXD6jZ63mTi+ZnUFhgSLh+0vwe4TRokIyrFM3uUnY= Received: from AM6P195CA0015.EURP195.PROD.OUTLOOK.COM (2603:10a6:209:81::28) by VI1PR0801MB1661.eurprd08.prod.outlook.com (2603:10a6:800:56::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.15; Tue, 7 Apr 2020 14:36:09 +0000 Received: from VE1EUR03FT061.eop-EUR03.prod.protection.outlook.com (2603:10a6:209:81:cafe::82) by AM6P195CA0015.outlook.office365.com (2603:10a6:209:81::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.15 via Frontend Transport; Tue, 7 Apr 2020 14:36:09 +0000 Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT061.mail.protection.outlook.com (10.152.19.220) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2856.17 via Frontend Transport; Tue, 7 Apr 2020 14:36:08 +0000 Received: ("Tessian outbound 5345ff401cf8:v50"); Tue, 07 Apr 2020 14:36:08 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 743d8debb8ec2888 X-CR-MTA-TID: 64aa7808 Received: from 0f63a63e68e1.2 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 6B8DDEDB-2113-456E-92E3-C9CED80F02D0.1; Tue, 07 Apr 2020 14:36:03 +0000 Received: from EUR02-VE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 0f63a63e68e1.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Tue, 07 Apr 2020 14:36:03 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Jm60evDtdD0M7ggq84QsEVUBOcgqxQUnhf7ktMy6NCvnNksXFEhb2Vrx0GYPU/P3x+9ohhhlSuK2wmBT8Aq2e50G9kOQUTuNisQ0sXeHPIhEjSnwybPKTanWrNMU1ZFTNsPmTgRw3vr3KtCZdiw0DEslisM5uNcJZ3OR1ttP9/GIUom1JG8neDE6WOdg0t7GVH9fdYfYuy4tG4tdRX8IbIz4ba3tHtaTxsaiJ7ra1kpfoQNhBANA3/HIP8qwV1yDNFKYF7rlIWX0leXzhmwnB1B5yX7/4ILq3DiJRJqR6j7uvME85mQlH2qDUiADaFbaO2pP5Eg0Q85hjHEcPCKT2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G3c0DgptuDekqhpsfrC0IoqMEV3tbBrCKLRrXfJNOpE=; b=W3fFDpPJ/Cgooi9xsnpaRK9scCbdzvTxqId1fxYUO05WQU+1gIlBwCpPWjBMdoViHhCgmJWNdgz3g/F9GRRcDcoMEGdFhEEnApYSETQVKa4XaI7PxPerJZxXEZioZGU6eKk1VmpYXBq846NUJ+e34NyrTlNYBuQX4PRHI6vJRWej8Cc4sxpRTrKqUz7pqGOxebTjcyKaT2K44xeYMf0eisxdt2+uCKWeIr8dlAkhR7+X48lO+M8PoUVxldtpynI3iVCdPrHYvHWTC5P8GgNfnEjWBXrcGA8ZqiQnRa8m+WKozmDALt9FxH6V7baJ6cd8Z5wQza+yWLzdSb574KhafA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G3c0DgptuDekqhpsfrC0IoqMEV3tbBrCKLRrXfJNOpE=; b=wx8FGBaEsgsWERe80b52CFhtGb7ph4ej3pSYFtQEEak+rnz5RpZ8Bb9iq6AQMSCRIBXg+4MOuKkdlbHdFdNDRNUIzkyUhkGpc1V5yHsnwd4Kc8lMBUogCvRMGzItMpU9E9WXD6jZ63mTi+ZnUFhgSLh+0vwe4TRokIyrFM3uUnY= Received: from AM6PR08MB4231.eurprd08.prod.outlook.com (20.179.18.151) by AM6PR08MB5256.eurprd08.prod.outlook.com (10.255.121.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.17; Tue, 7 Apr 2020 14:36:01 +0000 Received: from AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::9807:78f0:434f:2b9f]) by AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::9807:78f0:434f:2b9f%7]) with mapi id 15.20.2878.018; Tue, 7 Apr 2020 14:36:01 +0000 From: Thomas Fossati To: Laurence Lundblade , "rats@ietf.org" CC: Thomas Fossati Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9bvbcLEp+Zjk2vMtbuW9TMtqht0JyA Date: Tue, 7 Apr 2020 14:36:01 +0000 Message-ID: <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> In-Reply-To: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.35.20030802 Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; x-originating-ip: [82.11.185.80] x-ms-publictraffictype: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 5eef7bd4-1a71-43b9-0790-08d7db0102f7 x-ms-traffictypediagnostic: AM6PR08MB5256:|AM6PR08MB5256:|VI1PR0801MB1661: x-ms-exchange-transport-forked: True X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:8882;OLM:9508; x-forefront-prvs: 036614DD9C X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM6PR08MB4231.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(346002)(39860400002)(376002)(366004)(136003)(396003)(2906002)(71200400001)(64756008)(66556008)(8676002)(81166006)(81156014)(66476007)(5660300002)(66946007)(4326008)(6506007)(66446008)(8936002)(15650500001)(91956017)(76116006)(186003)(36756003)(966005)(53546011)(86362001)(6512007)(110136005)(478600001)(33656002)(26005)(316002)(2616005)(6486002); DIR:OUT; SFP:1101; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: Ojv0+TXurxs4DVq+fgHZcebrTznPsSWSMsTE0pfIruZ1J6Ah3+qD7wicjMA5dXEiYRXMs5wmwzMYnuzjLzy11vUiNexYmMRfrvlUGUzu7RDZ4JhMfRhWN4jije1gvCzCCnPpW9a89fEEr+FNXvdrZGSkPd0okz2VQ65KsbMiBCRVJLAX+UXthH1E+KfcpA0kSv1LGPkilLatXyjc0oLJsEoZMNcJtplmVtoUwxhQn3HC/us8DjXLlwRQHBPo6xqgmtu9UEFfDbSk6tlCkZX/57QMILPZj+CtMDfdOgBkjxfQUIr9ZZ0AqLSoqsaXBNea5F3nUp2Wg42FXukhklHWbP3IHY8esVTVImLVDQdhL9d6JCCwDTHpd6PGenkZMDiLJtX62oS5IsZbKTIqb71NcrEHL02WqHJiD0iswV8wcFoE3Gl52srHx4RmxeweIOxSz65iEUT3J6THDGCycybzxIHFUcP1XFSMEZYLhXlMnqAgRx1piEChzmE5aYR7dK5LkAB51mes+BXHwCJ7VJuLIw== x-ms-exchange-antispam-messagedata: P8FG9TbqcB7Al1JUrMvT3f5FfZ/SHtjr2HU9MbBrEU0QKt6c1z9lZ5NpG6hsroeOMQLh2OsERv0FxTZ/f8d6vXbtB4TzQX8kLe2ZiQXzkCqCh1S8jzlPT76O2hGeskEIsHA3bDGy0Pgoa8ig3msA/g== Content-Type: text/plain; charset="utf-8" Content-ID: <504E4C540229E6498C6FC42FC5589AA1@eurprd08.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB5256 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT061.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(136003)(376002)(39860400002)(346002)(396003)(46966005)(110136005)(6506007)(82740400003)(2616005)(186003)(47076004)(478600001)(316002)(86362001)(70206006)(6512007)(70586007)(15650500001)(33656002)(36906005)(4326008)(6486002)(356004)(336012)(26005)(2906002)(5660300002)(81156014)(966005)(8936002)(8676002)(26826003)(36756003)(81166006); DIR:OUT; SFP:1101; X-MS-Office365-Filtering-Correlation-Id-Prvs: cf5b87cb-f0d0-432c-b104-08d7db00feb0 X-Forefront-PRVS: 036614DD9C X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 8IY7Jbby3HiFOKYbs+rbVyPHLas8iML+EwIy2jHsns7ObXO/Okeco2u//+WJm1fp8Ik2vt0FU9of643yDG2UVcitePcBkxlaprsHcQGxdoKUhNEC8r6+DR/4GaDansYylgI5SjvQF6Cexq1cKtc5rdEUWb7BUnhxJOyHB4kOLETfcB9t/j0JzJVbA2heWN8mxuEGK/vKZy4K89fvGbJLb0LiIn5WW3JpxcFJ1qSB3DslIj23q2gDazBWa89RcbDEjXZQlq55X75u/whFcZWbbY091qovN5eZQUbPRNXSRQ0LxvB+3f3d/snJ51fjZkQBg+Otei+nmsGgf9yISNX5rFq4rEVKZR/WXG+MS0Sr6xiJ7LJVP3CFr6RiEfmAuAhKrqWmN1zVSVXuonYQchvKHpG+ZHSJFUDC4DjxPd3pBwPtKJlDsirK5P43JdFqOj7SDnLUSxNGj1ap4/Mx9pb0mh/EdhwdVct3pmrtiU5rQERaVEnCsrhHbFNEyxnxN92VdPErrmZxBViAudFzr08whiGyvq3RvD81SmOeKTrn4ja26SVqf+elI8fgE0l0V8918xxWOh+AomMryIZzcxIYcA== X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Apr 2020 14:36:08.6047 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5eef7bd4-1a71-43b9-0790-08d7db0102f7 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1661 Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2020 14:36:15 -0000 SGkgTGF1cmVuY2UsDQoNClRoYW5rcyBmb3IgYnJpbmdpbmcgdGhpcyB1cC4gIEEgZmV3IHRob3Vn aHRzIGJlbG93Lg0KDQpPbiAwMy8wNC8yMDIwLCAyMDozNywgIlJBVFMgb24gYmVoYWxmIG9mIExh dXJlbmNlIEx1bmRibGFkZSINCjxyYXRzLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIGxn bEBpc2xhbmQtcmVzb3J0LmNvbT4gd3JvdGU6DQo+IFNvIGhvdyBkb2VzIGEgVmVyaWZpZXIgZmlu ZCB0aGUgYXBwbGljYWJsZSBlbmRvcnNlbWVudCBmb3IgRXZpZGVuY2UgaXQNCj4gd2lzaGVzIHRv IHZlcmlmeSBhbmQga25vdyB0aGF0IGlzIHJlYWxseSB0aGUgcmlnaHQgZW5kb3JzZW1lbnQ/DQo+ DQo+IFNlZW1zIGxpa2UgdGhlIEV2aWRlbmNlIG5lZWRzIHNvbWUgc29ydCBvZiBhbiBlbmRvcnNl bWVudCBsb2NhdG9yIElELg0KPiBUaGlzIGNvdWxkIGJlIGEgVVJMIG9yIGEgR1VJRC4gRUFUIGN1 cnJlbnRseSBoYXMgdGhlIG9yaWdpbmF0aW9uIGNsYWltDQo+IHRvIHRyeSB0byBzb2x2ZSB0aGlz LCBidXQgaXQgaXMgaGFsZi1iYWtlZC4gSXQgbmVlZHMgdG8gZ2V0IGZpeGVkLiBJ4oCZbQ0KPiBm aXNoaW5nIGZvciBjb21tZW50cyBoZXJlIG9uIHdoYXQgaXQgc2hvdWxkIGJlIGxpa2UuDQo+DQo+ IFByZXR0eSBzdXJlIHRoZSBFbmRvcnNlbWVudCBuZWVkcyB0byBpbmNsdWRlIG9yIHJlZmVyZW5j ZSB0aGUgcHVibGljDQo+IGtleSB0aGF0IGlzIHVzZWQgdG8gdmVyaWZ5IHRoZSBzaWduYXR1cmUu IFdpdGhvdXQgdGhhdCwgdGhlIEF0dGVzdGVyDQo+IGNvdWxkIGxpZSBhbmQgcGljayBhbnkgb2xk IEVuZG9yc2VtZW50IHRoYXQgaXQgd2lzaGVzLiBUaGVyZSBuZWVkcyB0bw0KPiBiZSBzb21lIGJp bmRpbmcgYmV0d2VlbiBpdGVtcyBpbiB0aGUgZW5kb3JzZW1lbnQgKEUwLCBFMSzigKYpIGFuZCB0 aGUNCj4gdmVyaWZpY2F0aW9uIGtleS4gVGhhdCBjb3VsZCBiZSBpbiB0aGUgZm9ybSBvZiBhIHNp Z25lZCB0b2tlbiBvcg0KPiBjZXJ0aWZpY2F0ZSwgYnV0IGRvZXNu4oCZdCBoYXZlIHRvIGJlLiBQ cmV0dHkgc3VyZSB0aGlzIG5lZWRzIHRvIGJlDQo+IGRpc2N1c3NlZCBpbiB0aGUgYXJjaGl0ZWN0 dXJlIGRvYy4NCj4NCj4gVGhlcmUncyBhIGZldyBzY2VuYXJpb3M6DQo+IC0gT25lIGVuZG9yc2Vt ZW50IGFwcGxpZXMgdG8gbG90cyBvZiBkZXZpY2VzIGluIHRoZSBzYW1lIGNsYXNzLCBidXQNCj4g ICBlYWNoIGhhcyB0aGVpciBvd24gYXR0ZXN0YXRpb24ga2V5Lg0KPiAtIC0gUHJvYmFibHkgRUNE QUEgZml0cyBpbiBoZXJlDQo+IC0gLSBPbmUgb3B0aW9uIGhlcmUgaXMgYW4gWDUwOSBoaWVyYXJj aHkNCj4gLSBHcm91cCBrZXlzIGFyZSB1c2VkIChmb3IgcHJpdmFjeSByZWFzb25zIG9yIG90aGVy KSBzbyB0aGVyZSBpcyBhDQo+ICAgb25lLW9uZSBjb3JyZWxhdGlvbiB3aXRoIHRoZSBFbmRvcnNl bWVudHMgKHRoZSBHRUlEIGRpc2N1c3Npb24pDQo+IC0gR3JvdXAga2V5cyBhcmUgdXNlZCwgYnV0 IGFjcm9zcyBkZXZpY2VzIHRoYXQgaGF2ZSBkaWZmZXJlbnQNCj4gICBlbmRvcnNlbWVudHMgc28g dGhlcmXigJlzIG5vIG9uZS1vbmUgY29ycmVsYXRpb24NCj4NCj4gV2hpbGUgdGhlIGxhc3Qgb25l IHNlZW1zIG9kZCBhbmQgdW5saWtlbHksIEkgdGhpbmsgaXQgY291bGQgb2NjdXIsDQo+IGJlY2F1 c2UgZnJvbSBhIGxvdCBvZiByZWFsIGV4cGVyaWVuY2UgdGhlIHNldCB1cCBvZiBhdHRlc3RhdGlv biBrZXlzDQo+IGlzIHZlcnkgaWRpb3N5bmNyYXRpYy4gSXQgaXMgd2lsZGx5IGFmZmVjdGVkIGJ5 IG1hbnVmYWN0dXJpbmcgY29zdHMNCj4gYW5kIGlzc3VlcyBvbiBhc3NlbWJseSBsaW5lcywgc3Vi IGNvbnRyYWN0b3Igc3RydWN0dXJlLCBsb2NhdGlvbiBvZg0KPiBzZWN1cmUgZmFjaWxpdGllcyBh bmQgYXBwcm9hY2hlcyB0byBtYWtpbmcgbW9uZXkgb24gaXQuIFRoZXkgYXJlIGxpa2UNCj4gc25v d2ZsYWtlcywgZWFjaCBvbmUgaXMgZGlmZmVyZW50LiAgU28gbWF5YmUgZW5kb3JzZW1lbnQgbG9j YXRvciBJRA0KPiBhbmQga2V5IElEIGFyZSBub3QgdGhlIHNhbWUsIGJ1dCB0aGV5IGNhbiBiZSBp biBzb21lIHVzZSBjYXNlcz8NCj4NCj4gSSBhbSBhbHNvIHRlbXB0ZWQgdG8gZW5jb3VyYWdlIHRo ZSBwbGFjZW1lbnQgb2YgdGhlIGVuZG9yc2VtZW50DQo+IGxvY2F0b3IgSUQgaW4gdGhlIENPU0Ug b3IgSk9TRSBoZWFkZXIgcGFyYW1ldGVycyBzbyB5b3UgZG9u4oCZdCBoYXZlIHRvDQo+IHBhcnNl IHRoZSB1bnZlcmlmaWVkIGJvZHkgb2YgY2xhaW1zIHRvIGJlIGFibGUgdG8gZmluZCB0aGUga2V5 DQo+IG1hdGVyaWFsIHRvIHZlcmlmeSBpdC4NCj4NCj4gVGhvdWdodHM/DQoNCkEgdHdvIGxldmVs IGxvb2t1cCBrZXksIG1vZGVsK2luc3RhbmNlLCBzZWVtcyB0byBiZSBxdWl0ZSBnZW5lcmFsbHkN CmFwcGxpY2FibGUgYXMgYW4gZW5kb3JzZW1lbnQgbG9jYXRvci4gIFRoZSBtb2RlbCBwYXJ0IHdv dWxkIGdldCB5b3UgdG8NCnRoZSBzaGFyZWQgZGF0YSAoZS5nLiwgY2VydGlmaWNhdGlvbiwgbWVh c3VyZWQgYm9vdCBLR1ZzLCBldGMuKSwgd2hpbGUNCnRoZSBpbnN0YW5jZSBwYXJ0IGNhbiBiZSB1 c2VkIHRvIHJldHJpZXZlIGRldmljZS1zcGVjaWZpYyBzdGF0ZToNCnZlcmlmaWNhdGlvbiBrZXko cykgYXMgd2VsbCBhcyBvdGhlciBtZXRhZGF0YSwgZS5nLiwgaWYgc29tZSBnZWFyIGlzDQpibGFj a2xpc3RlZC4gIEluIFBTQSB3ZSBoYXZlIHNvbWV0aGluZyBxdWl0ZSAodGhvdWdoIG5vdCBlbnRp cmVseSkNCnNpbWlsYXIgd2l0aCBpbXBsZW1lbnRhdGlvbiBhbmQgaW5zdGFuY2UgSURzIFsxXSBb Ml0uDQoNCihDb250ZXh0LXN3aXRjaGluZyBmb3IgYSBzZWNvbmQgb24gb3VyIHByZXZpb3VzIFVF SUQvR0VJRCBkaXNjdXNzaW9uOiBJDQpndWVzcyB3ZSBtaWdodCBtb2RlbCBhbiBpbnN0YW5jZSBh cyBhbiBhbm9ueW1pdHkgc2V0LCBhbmQgdGhlcmVmb3JlDQp0cmVhdCBFVUlEcyBhcyB0aGUgc3Bl Y2lhbCBjYXNlIEdFSURzIHdpdGggY2FyZGluYWxpdHkgPT0gMT8pDQoNCkZvciB0aGUgc2FrZSBv ZiBidWlsZGluZyBhIHNoYXJlZCBhbmQgcmV1c2FibGUgdm9jYWJ1bGFyeSwgSSdkIHByZWZlcg0K a2VlcGluZyBtb2RlbCBhbmQgaW5zdGFuY2UgaWRlbnRpZmllcnMgYXMgc2VwYXJhdGUgY2xhaW1z IHJhdGhlciB0aGFuDQpoYXZpbmcgYW4gb3BhcXVlIGVuZG9yc2VtZW50IElEIGNsYWltIHRoYXQg Y2x1bXBzIHRvZ2V0aGVyIHRob3NlIGFuZA0KcG9zc2libHkgb3RoZXIgc3R1ZmYgaW4gYSB1c2Ut Y2FzZSBzcGVjaWZpYyBmYXNoaW9uLiAgRm9yIHRoZSBzYW1lDQpyZWFzb24gSSB3b3VsZCBub3Qg b3ZlcnJpZGUga2V5IElEIHdpdGggaW5zdGFuY2UgSUQgc2VtYW50aWNzLg0KDQpjaGVlcnMsIHRo YW5rcyENCg0KWzFdIGh0dHBzOi8vd3d3LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0 cy1wc2EtdG9rZW4tMDUuaHRtbCNuYW1lLWltcGxlbWVudGF0aW9uLWlkDQpbMl0gaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvaWQvZHJhZnQtdHNjaG9mZW5pZy1yYXRzLXBzYS10b2tlbi0wNS5odG1sI25h bWUtaW5zdGFuY2UtaWQNCg0KDQoNCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0 aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFs c28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwg cGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2Ug dGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2Us IG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlv dS4NCg== From nobody Tue Apr 7 11:29:03 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FFB03A0CDA for ; Tue, 7 Apr 2020 11:28:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.619 X-Spam-Level: X-Spam-Status: No, score=-9.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=hpbFG/sL; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=Tso5N8qK Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4LWwOb6EzN2N for ; Tue, 7 Apr 2020 11:28:54 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CB1D3A0CA2 for ; Tue, 7 Apr 2020 11:28:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3617; q=dns/txt; s=iport; t=1586284134; x=1587493734; h=from:to:subject:date:message-id:mime-version; bh=dKGrxLDp+DMYrBgOT72XKoMVOfDm7y+jgjvYTJ27qbQ=; b=hpbFG/sLe1KfgUz81qEvwX7izkyboI4rUnUysbLGBvJcSfrjfVgq3CYt nXDZph+/lukZ9Bl1zAyKkMz0f+wbYbNyUwy7FG3e5Wop6z4trIK/H4qtW 42tpGZ/gKFNu2VWqlT2YMsEaNDYyyZwu1AXj+7rTLvgvA4sC5epBvKrlA w=; IronPort-PHdr: =?us-ascii?q?9a23=3Au7WlzRObn9Pby11hLY8l6mtXPHoupqn0MwgJ65?= =?us-ascii?q?Eul7NJdOG58o//OFDEu6w/l0fHCIPc7f8My/HbtaztQyQh2d6AqzhDFf4ETB?= =?us-ascii?q?oZkYMTlg0kDtSCDBj9J/fvcC08E+xJVURu+DewNk0GUMs=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CkDwAMxoxe/4kNJK1mgkGBJS9QBWx?= =?us-ascii?q?YIAQLKgqEEoNFA4ppTpVRhGGBLoEkA1QKAQEBDAEBIwoCBAEBhEQZgW4kNQg?= =?us-ascii?q?OAgMBAQsBAQUBAQECAQUEbYVWAQuGCREdAQE4EQEMPgIEMCcENYMEAYF+TQM?= =?us-ascii?q?uAQ6lYgKBOYhidYEygn8BAQWCRYMAGIINAwaBOIUjhxAaggCBESccgThngXC?= =?us-ascii?q?BYwICGoF2gmUygiyRC4YFmiAKgj2XMB2cB487nCgCBAIEBQIOAQEFgVMBN4F?= =?us-ascii?q?XcBVlAYI+UBgNkTqDW4pVdAKBJ40bAYEPAQE?= X-IronPort-AV: E=Sophos;i="5.72,356,1580774400"; d="scan'208,217";a="742694135" Received: from alln-core-4.cisco.com ([173.36.13.137]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 07 Apr 2020 18:28:52 +0000 Received: from XCH-ALN-004.cisco.com (xch-aln-004.cisco.com [173.36.7.14]) by alln-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id 037ISqfo018358 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 7 Apr 2020 18:28:52 GMT Received: from xhs-rtp-003.cisco.com (64.101.210.230) by XCH-ALN-004.cisco.com (173.36.7.14) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 7 Apr 2020 13:28:52 -0500 Received: from xhs-rcd-001.cisco.com (173.37.227.246) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 7 Apr 2020 14:28:51 -0400 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Tue, 7 Apr 2020 13:28:51 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Gl+rXBcGnuiT/ZUScBZEd5ePfx1D8TzC/V/NGewqKeLn56HK84IEWA82MgYMtnNi2A9RLku60jLaW2o7FgOYQHAz1Ni/C7QuFRoTbODNOuoVYH71mH99GtF341yukMxp9pQ6OwyrLX1aQ1Zg4OqAlN4k09NuXZp0RQcnGlCqYYgK7wHFNAYTHLgl2HC+o/P9TegOLn/NAz3mcHBTaSwtc2W1ChjIMF/PZsE8L3aCAsc7DOa96M+mTIri3ht9GN0K8d2vkON92ieycfPnQXS9vyQMA9UpN38jdzJ/8xZlc3z7wIQSPszsNUvhEREfTITKMXKraN9yAMglEd5ly9HM9A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dKGrxLDp+DMYrBgOT72XKoMVOfDm7y+jgjvYTJ27qbQ=; b=d/qGvjY3jHxQKHbgTBhkPzUGjkG5QsF+9e6nqkI2O0g4pzxSHzYS6taqqq90hy2DX8sXXXTKBWHaBSjT0DCOhlw8SjNoIUMfit5a0m1XgWWxP1+v/h7X9xDDn3By4JupZqrQXJEMaXgItrvjrXPSnHmVo0pF4dLWUY49EY7irhDkSUo64LBEQpCK3zCIiWkNuzc5VZAB1NJqidQndikXV1y7+WncTEOIttUtzCK1+am+sqYadvQG4GJEo7xpRVVa3jpRVPfLSLGlKMBns2QLCsjhJTGqYVzN0jR5ZAXDfbmRwfYxUKr3CMP8sVL2aK2G1vxHDTRAwjnjzlVPRaHsZQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dKGrxLDp+DMYrBgOT72XKoMVOfDm7y+jgjvYTJ27qbQ=; b=Tso5N8qKYtW/z+0xD4uuWAWOHSW7JX32BWVWe771U1JC1w93TODWARYvxvu2htru3g26GCqaRZiH41qriiyEPtXeiYFDoi63FmIF/oMx+QW3VaSokL/s5Z+bsQjkzNJTeAbz8IdJKEIlDGjJ+RzJVWFd2/RxSjqUzaMypnUW3yc= Received: from BY5PR11MB4070.namprd11.prod.outlook.com (2603:10b6:a03:181::16) by BY5PR11MB4258.namprd11.prod.outlook.com (2603:10b6:a03:1c2::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.16; Tue, 7 Apr 2020 18:28:50 +0000 Received: from BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::852d:fab4:18c1:72d2]) by BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::852d:fab4:18c1:72d2%7]) with mapi id 15.20.2878.018; Tue, 7 Apr 2020 18:28:50 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "rats@ietf.org" Thread-Topic: RATS Mar 31st Virtual Interim recording posted Thread-Index: AQHWDQpinT2dxtnlqEG0A1lWw+NdBQ== Date: Tue, 7 Apr 2020 18:28:50 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.14.200307 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [73.162.233.180] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6eb2884e-705c-4e2c-c58d-08d7db2184b7 x-ms-traffictypediagnostic: BY5PR11MB4258: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:3826; x-forefront-prvs: 036614DD9C x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR11MB4070.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(346002)(136003)(39860400002)(376002)(396003)(366004)(71200400001)(8936002)(26005)(8676002)(6506007)(558084003)(186003)(86362001)(2616005)(81156014)(5660300002)(966005)(6916009)(478600001)(76116006)(66556008)(2906002)(316002)(66476007)(6512007)(66946007)(6486002)(33656002)(36756003)(81166006)(64756008)(66446008); DIR:OUT; SFP:1101; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: nG5dh9A1JPQoJdWBHub2RQKQBlLdLTy7+ZJjn/cBa4AAI78ajk2fq4WZ3UA6F096I39mNpJQQMlrMDN0/Y4tDnBP+zXwsbPZA30Z9aUSrZ4PXkgk82cjhF6fyO56klOFBl7n+GHeRr2vhQ446rIfzB8u1FgFANdhoI85Ok7jfU4sf6Qmi1EvqmVR4LMyJlWyQ+jhsdW7+SRnCWQpqHnGoyz+9I+t0fd6lXYcXau4RyWLtJDPIgco3Rzf0wecw6S3a/it2aAJgyq2pRSbrhztmGsLFX85f8hJjFSIZ3n+CAN0+O/ty6hkWHUjB2j/EZyEgImGM5aDLUrs3L2yMwwevM2ROwkXgQvr2mMonnxMChLtmqP/1Tze8msO4qo6l1eNRd8Mru4QnLUROyq3RyDj4HT6UwFpawpQlzj3rKpInJ/fRX1lf134LrmOADaZaYZqevJhZJLTfI16D0h3WvruhZhCmmCycgFWORnTjY+HDGcLFGPgsSwxyBT5aMpQaLZUawsmS+obMrbFRsFiUx7aow== x-ms-exchange-antispam-messagedata: yvj55hG7nE3ASh6d99vMCB0VvnwEvZFr9VDGWqEsenabimA9ii/EjUVsQ8kQJro33d2SB5YzfVEXr5phZJSjXRTSQ0+nVMyoQ9Zz9EQNZkby8FQFgKC+jOEVL74mrOsMjprEvfmxXdXtYzoKeJsFWw== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_C56862FDEF0C4F92AADF7E09C00D8885ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 6eb2884e-705c-4e2c-c58d-08d7db2184b7 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Apr 2020 18:28:50.2165 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: HfWBVF0a9EstC1LMpB5/GYFIPBLKcFh7Jb10jTdJoBl16I6q+l90rTL0ggenCFRWW4xA8Oe6vuMXhPeCc7YsFg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4258 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.14, xch-aln-004.cisco.com X-Outbound-Node: alln-core-4.cisco.com Archived-At: Subject: [Rats] RATS Mar 31st Virtual Interim recording posted X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2020 18:29:02 -0000 --_000_C56862FDEF0C4F92AADF7E09C00D8885ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGVsbG8gUkFUcyBwYXJ0aWNpcGFudHMsDQoNClRoZSB3ZWJleCByZWNvcmRpbmcgb2Ygb3VyIE1h ciAzMXN0LCAyMDIwIFZpcnR1YWwgSW50ZXJpbSBtZWV0aW5nIGhhcyBiZWVuIHBvc3RlZCwgeW91 IGNhbiBmaW5kIGl0IGluOg0KaHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g/dj1NVS1RU0RU eTZrTSZmZWF0dXJlPXlvdXR1LmJlDQoNCkJlc3QsIE5hbmN5DQoNCg== --_000_C56862FDEF0C4F92AADF7E09C00D8885ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <089127B93F9DAB48BEE1922F5E904D63@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij5IZWxsbyBSQVRzIHBhcnRpY2lwYW50cyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlRoZSB3ZWJleCByZWNvcmRpbmcgb2Ygb3VyIE1hciAzMXN0 LCAyMDIwIFZpcnR1YWwgSW50ZXJpbSBtZWV0aW5nIGhhcyBiZWVuIHBvc3RlZCwgeW91IGNhbiBm aW5kIGl0IGluOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxh IGhyZWY9Imh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL3dhdGNoP3Y9TVUtUVNEVHk2a00mYW1wO2Zl YXR1cmU9eW91dHUuYmUiPmh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL3dhdGNoP3Y9TVUtUVNEVHk2 a00mYW1wO2ZlYXR1cmU9eW91dHUuYmU8L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPkJlc3QsIE5hbmN5PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_C56862FDEF0C4F92AADF7E09C00D8885ciscocom_-- From nobody Tue Apr 7 12:12:44 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9F893A0F8F for ; Tue, 7 Apr 2020 12:12:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PbkcGfUgqoaG for ; Tue, 7 Apr 2020 12:12:40 -0700 (PDT) Received: from p3plsmtpa12-09.prod.phx3.secureserver.net (p3plsmtpa12-09.prod.phx3.secureserver.net [68.178.252.238]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5CE0C3A0F8D for ; Tue, 7 Apr 2020 12:12:40 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id LteJjuFmOd1iaLteJjuOM7; Tue, 07 Apr 2020 12:12:39 -0700 X-CMAE-Analysis: v=2.3 cv=R/R95uZX c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=7CQSdrXTAAAA:8 a=48vgC7mUAAAA:8 a=K6EGIJCdAAAA:8 a=rFuCLhaAnJiknnuOtzsA:9 a=gQhOUAfXAq2EQTtT:21 a=HOHODLyAFHnoP6LV:21 a=QEXdDO2ut3YA:10 a=y9OUIGaxdF8A:10 a=kj6DBQF8G6IA:10 a=KpR83WuFaQhDCtkxc_EA:9 a=oDf2WKooyRQWCSOY:21 a=hMXZAowRoZh-Ab_7:21 a=GcTuRAwDXrlrT5v2:21 a=_W_S_7VecoQA:10 a=a-qgeE7W1pNrGK8U0ZQC:22 a=w1C3t2QeGrPiZgrLijVG:22 a=L6pVIi0Kn1GYQfi8-iRI:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_43D1C8EA-4022-4A2E-92E8-00E463EA7747" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 7 Apr 2020 12:12:38 -0700 In-Reply-To: <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> Cc: "rats@ietf.org" , Ned Smith To: Thomas Fossati References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfFTaZ9Wg5SAAn/BPXSfo0xV0vMeSHddNzJ5FNGaSIStDs6XmZv2BxgizKBTDvfrrmFp33z4WzuOpxZ2hsFibYzZGxI21sBx1iKzltTrf/gmbhnpTvv0h 95/M1C9lATrvxekaZCDKnazRQIRUQp1D0U9OwihTjv620xpjTKiad4FgB8wzzHhcsQSfjooaFVJYVhUWkbcbK5ExqEdFSm9tLyRhCqStaysAgRVo4rFKNVGG Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2020 19:12:43 -0000 --Apple-Mail=_43D1C8EA-4022-4A2E-92E8-00E463EA7747 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 This is a reply to both Thomas and Ned=E2=80=99s message on debug in the = related threat. My inclination is to associate endorsements with time-invariant = characteristics of the device. At the moment this doesn=E2=80=99t seem = like the only way to do it, but it seems like a good way. Things that = are not time invariant are policy, k-g-v or such. Endorsement System architecture =E2=80=94 Does the Attester use a TEE or a TPM or = maybe it is simple system with just a simple CPU, but it is encased in = titanium. Is defense against chip invasive attacks considered? Do keys = become inaccessible when debug is enabled. Development process =E2=80=94 Is there a special security-oriented team? = Does the team have a code review policy? Is there a bug bounty? Are the = desktops and IT systems used for HW and SW development isolated? Manufacturing =E2=80=94 Are the factories secured in a special way? Is = the attestation key provisioning system hardened in some way (e.g., uses = HSMs). Certifications =E2=80=94 These take a long time to achieve and will = usually require some of the above. My thinking for EAT was that you only put attestation keys into devices = that meet some criteria like some of the above. Since there is often no = way to recover from a compromised attestation key because no key more = secure than it, you kind of have to have all that.=20 Since these don=E2=80=99t change much over time, the endorsement = wouldn=E2=80=99t change. They could even span several models and = varying HW. Policy, K-G-V, other SW Versions =E2=80=94 As long as the SW follows a development process = like that above, it doesn=E2=80=99t have to be included in the = endorsement. Of course the smaller the SW and the better the process, = the more it is true (and vice versa). Blacklists =E2=80=94 These might be specific to UEIDs, versions of SW, = deployments a particular OEM or such Debug status =E2=80=94 Most of the debug status values can vary on a = day-day basis OEM model =E2=80=94 If the attestation is implemented by a chip vendor = and the endorsement is for the chip, then the OEM model will vary = widely. None of these can be criteria as to whether an attestation key is put = into a device or not as they are not known at manufacturing time and/or = must be allowed to vary widely after manufacturing. I think what I=E2=80=99ve described above lines up pretty well for a = TPM. The system architecture is mostly set by the TCG. HW TPMs are = almost always certified. They are independent of OEM model. It also = lines up reasonably well with secure elements and can line up with = TEE=E2=80=99s. =20 The crux of endorsement to me is the security characteristics of the = attester that protect the attestation key because there is generally no = recovery from a compromised attestation key. It sets the baseline risk = of the HW and SW of the device. On one extreme is a separate endorsement for every device (=E2=80=9Cmicro = endorsement"?), which is what I think Thomas and ARM PSA are tending = towards. The other extreme is one endorsement for a product line = (=E2=80=9Cmacro endorsement"?),, say a product line of TPMs. Then it=E2=80= =99s more like the data sheet for the product.=20 Then there=E2=80=99s different ways to fan this out to the different key = / signing schemes (per-device key, group key, ECDAA, X.509). For example = a macro-endorsement could include the root of an X.509 hierarchy and the = individual devices (or groups of devices) would have individual keys = that chain up. With a micro-endorsement the per-device public key could = be per endorsement. The most important thing about the endorsement seems to me is the = characterization of how the attestation key is protected. LL > On Apr 7, 2020, at 7:36 AM, Thomas Fossati = wrote: >=20 > Hi Laurence, >=20 > Thanks for bringing this up. A few thoughts below. >=20 > On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" > on behalf of = lgl@island-resort.com > wrote: >> So how does a Verifier find the applicable endorsement for Evidence = it >> wishes to verify and know that is really the right endorsement? >>=20 >> Seems like the Evidence needs some sort of an endorsement locator ID. >> This could be a URL or a GUID. EAT currently has the origination = claim >> to try to solve this, but it is half-baked. It needs to get fixed. = I=E2=80=99m >> fishing for comments here on what it should be like. >>=20 >> Pretty sure the Endorsement needs to include or reference the public >> key that is used to verify the signature. Without that, the Attester >> could lie and pick any old Endorsement that it wishes. There needs to >> be some binding between items in the endorsement (E0, E1,=E2=80=A6) = and the >> verification key. That could be in the form of a signed token or >> certificate, but doesn=E2=80=99t have to be. Pretty sure this needs = to be >> discussed in the architecture doc. >>=20 >> There's a few scenarios: >> - One endorsement applies to lots of devices in the same class, but >> each has their own attestation key. >> - - Probably ECDAA fits in here >> - - One option here is an X509 hierarchy >> - Group keys are used (for privacy reasons or other) so there is a >> one-one correlation with the Endorsements (the GEID discussion) >> - Group keys are used, but across devices that have different >> endorsements so there=E2=80=99s no one-one correlation >>=20 >> While the last one seems odd and unlikely, I think it could occur, >> because from a lot of real experience the set up of attestation keys >> is very idiosyncratic. It is wildly affected by manufacturing costs >> and issues on assembly lines, sub contractor structure, location of >> secure facilities and approaches to making money on it. They are like >> snowflakes, each one is different. So maybe endorsement locator ID >> and key ID are not the same, but they can be in some use cases? >>=20 >> I am also tempted to encourage the placement of the endorsement >> locator ID in the COSE or JOSE header parameters so you don=E2=80=99t = have to >> parse the unverified body of claims to be able to find the key >> material to verify it. >>=20 >> Thoughts? >=20 > A two level lookup key, model+instance, seems to be quite generally > applicable as an endorsement locator. The model part would get you to > the shared data (e.g., certification, measured boot KGVs, etc.), while > the instance part can be used to retrieve device-specific state: > verification key(s) as well as other metadata, e.g., if some gear is > blacklisted. In PSA we have something quite (though not entirely) > similar with implementation and instance IDs [1] [2]. >=20 > (Context-switching for a second on our previous UEID/GEID discussion: = I > guess we might model an instance as an anonymity set, and therefore > treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?) >=20 > For the sake of building a shared and reusable vocabulary, I'd prefer > keeping model and instance identifiers as separate claims rather than > having an opaque endorsement ID claim that clumps together those and > possibly other stuff in a use-case specific fashion. For the same > reason I would not override key ID with instance ID semantics. >=20 > cheers, thanks! >=20 > [1] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-imple= mentation-id = > [2] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-insta= nce-id = >=20 >=20 >=20 > IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_43D1C8EA-4022-4A2E-92E8-00E463EA7747 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
This is a reply to both Thomas and Ned=E2=80=99s message on = debug in the related threat.

My inclination is to associate = endorsements with time-invariant characteristics of the device. At the = moment this doesn=E2=80=99t seem like the only way to do it, but it = seems like a good way. Things that are not time invariant are policy, = k-g-v or such.

Endorsement
System = architecture =E2=80=94 Does the Attester use a TEE or a TPM or maybe it = is simple system with just a simple CPU, but it is encased in titanium. = Is defense against chip invasive attacks considered? Do keys become = inaccessible when debug is enabled.

Development process =E2=80=94 Is there = a special security-oriented team? Does the team have a code review = policy? Is there a bug bounty? Are the desktops and IT systems used for = HW and SW development isolated?

Manufacturing =E2=80=94 Are the = factories secured in a special way? Is the attestation key provisioning = system hardened in some way (e.g., uses HSMs).

Certifications =E2=80=94 These take a = long time to achieve and will usually require some of the = above.

My thinking for EAT was that you only put attestation keys = into devices that meet some criteria like some of the above. Since there = is often no way to recover from a compromised attestation key because no = key more secure than it, you kind of have to have all = that. 

Since these don=E2=80=99t change much over time, the = endorsement wouldn=E2=80=99t change.  They could even span several = models and varying HW.

Policy, K-G-V, = other
SW Versions =E2=80=94 As = long as the SW follows a development process like that above, it = doesn=E2=80=99t have to be included in the endorsement. Of course the = smaller the SW and the better the process, the more it is true (and vice = versa).

Blacklists =E2=80=94 These might be specific to UEIDs, = versions of SW, deployments a particular OEM or such

Debug status =E2=80=94 = Most of the debug status values can vary on a day-day basis

OEM model =E2=80=94 If = the attestation is implemented by a chip vendor and the endorsement is = for the chip, then the OEM model will vary = widely.

None of these can be criteria as to whether an attestation = key is put into a device or not as they are not known at manufacturing = time and/or must be allowed to vary widely after = manufacturing.


I think what I=E2=80=99ve = described above lines up pretty well for a TPM. The system architecture = is mostly set by the TCG. HW TPMs are almost always certified. They are = independent of OEM model. It also lines up reasonably well with secure = elements and can line up with TEE=E2=80=99s.  

The crux of endorsement = to me is the security characteristics of the attester that protect the = attestation key because there is generally no recovery from a = compromised attestation key. It sets the baseline risk of the HW and SW = of the device.


On one extreme is a separate endorsement = for every device (=E2=80=9Cmicro endorsement"?), which is what I think = Thomas and ARM PSA are tending towards. The other extreme is one = endorsement for a product line (=E2=80=9Cmacro endorsement"?),, say = a product line of TPMs. Then it=E2=80=99s more like the data sheet for = the product. 

Then there=E2=80=99s different ways to fan this out to the = different key / signing schemes (per-device key, group key, ECDAA, = X.509). For example a macro-endorsement could include the root of an = X.509 hierarchy and the individual devices (or groups of devices) would = have individual keys that chain up. With a micro-endorsement the = per-device public key could be per endorsement.


The = most important thing about the endorsement seems to me is the = characterization of how the attestation key is protected.

LL



On Apr 7, 2020, at 7:36 AM, = Thomas Fossati <Thomas.Fossati@arm.com> wrote:

Hi Laurence,

Thanks for bringing this up. =  A few thoughts below.

On 03/04/2020, 20:37, "RATS on behalf of Laurence = Lundblade"
<rats-bounces@ietf.org on behalf of lgl@island-resort.com> wrote:
So = how does a Verifier find the applicable endorsement for Evidence it
wishes to verify and know that is really the right = endorsement?

Seems like the Evidence needs = some sort of an endorsement locator ID.
This could be a = URL or a GUID. EAT currently has the origination claim
to = try to solve this, but it is half-baked. It needs to get fixed. I=E2=80=99= m
fishing for comments here on what it should be like.

Pretty sure the Endorsement needs to include = or reference the public
key that is used to verify the = signature. Without that, the Attester
could lie and pick = any old Endorsement that it wishes. There needs to
be some = binding between items in the endorsement (E0, E1,=E2=80=A6) and the
verification key. That could be in the form of a signed token = or
certificate, but doesn=E2=80=99t have to be. Pretty = sure this needs to be
discussed in the architecture = doc.

There's a few scenarios:
-= One endorsement applies to lots of devices in the same class, but
 each has their own attestation key.
- - = Probably ECDAA fits in here
- - One option here is an X509 = hierarchy
- Group keys are used (for privacy reasons or = other) so there is a
 one-one correlation with the = Endorsements (the GEID discussion)
- Group keys are used, = but across devices that have different
 endorsements = so there=E2=80=99s no one-one correlation

While the last one seems odd and unlikely, I think it could = occur,
because from a lot of real experience the set up of = attestation keys
is very idiosyncratic. It is wildly = affected by manufacturing costs
and issues on assembly = lines, sub contractor structure, location of
secure = facilities and approaches to making money on it. They are like
snowflakes, each one is different.  So maybe endorsement = locator ID
and key ID are not the same, but they can be in = some use cases?

I am also tempted to = encourage the placement of the endorsement
locator ID in = the COSE or JOSE header parameters so you don=E2=80=99t have to
parse the unverified body of claims to be able to find the = key
material to verify it.

Thoughts?

A two level lookup key, model+instance, seems to be quite = generally
applicable as = an endorsement locator.  The model part would get you to
the shared data (e.g., = certification, measured boot KGVs, etc.), while
the instance part can be used to = retrieve device-specific state:
verification key(s) as well as other metadata, e.g., if some = gear is
blacklisted. =  In PSA we have something quite (though not entirely)
similar with implementation and = instance IDs [1] [2].

(Context-switching for a second on our previous UEID/GEID = discussion: I
guess we = might model an instance as an anonymity set, and therefore
treat EUIDs as the special case = GEIDs with cardinality =3D=3D 1?)

For the sake of building a shared and reusable vocabulary, = I'd prefer
keeping model = and instance identifiers as separate claims rather than
having an opaque endorsement ID = claim that clumps together those and
possibly other stuff in a use-case specific fashion. =  For the same
reason I would not override key ID with instance ID = semantics.

cheers, = thanks!

[1] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-implementation-id
[2] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-instance-id



IMPORTANT NOTICE: The contents of this email and any = attachments are confidential and may also be privileged. If you are not = the intended recipient, please notify the sender immediately and do not = disclose the contents to any other person, use it for any purpose, or = store or copy the information in any medium. Thank you.
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_43D1C8EA-4022-4A2E-92E8-00E463EA7747-- From nobody Tue Apr 7 16:11:39 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0FF03A0798 for ; Tue, 7 Apr 2020 16:11:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xo7DH5NeqZL6 for ; Tue, 7 Apr 2020 16:11:34 -0700 (PDT) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 907D73A0794 for ; Tue, 7 Apr 2020 16:11:32 -0700 (PDT) IronPort-SDR: 3IH2vZltk17R6S5PC10KRCGzh3LvNbOJ3kSelNY7DHrdKsKqfGis1FMW+Mdm7riGjbIkBAlmZM AAw9Ld6/gaxw== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Apr 2020 16:11:31 -0700 IronPort-SDR: 5fTZaqs47K7oFvgiGDiiqEHsHbF8RO4OGy5UAIUBthdUqc+IVWS6COZpqE5o84JjDNe4Mb6GxM 91sUBrrFRr7Q== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,356,1580803200"; d="scan'208,217";a="286371252" Received: from orsmsx107.amr.corp.intel.com ([10.22.240.5]) by fmsmga002.fm.intel.com with ESMTP; 07 Apr 2020 16:11:30 -0700 Received: from orsmsx115.amr.corp.intel.com (10.22.240.11) by ORSMSX107.amr.corp.intel.com (10.22.240.5) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 7 Apr 2020 16:11:30 -0700 Received: from orsmsx108.amr.corp.intel.com ([169.254.2.172]) by ORSMSX115.amr.corp.intel.com ([169.254.4.102]) with mapi id 14.03.0439.000; Tue, 7 Apr 2020 16:11:30 -0700 From: "Smith, Ned" To: Laurence Lundblade , Thomas Fossati CC: "rats@ietf.org" Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9aqBxq4ObY/kGk1JKQQWkxNahuNTGAgABNSQD//81kgA== Date: Tue, 7 Apr 2020 23:11:29 +0000 Message-ID: References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.35.20030802 x-originating-ip: [10.254.70.128] Content-Type: multipart/alternative; boundary="_000_C14BDF6F520F4DB2BDC37721DB16A97Eintelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2020 23:11:38 -0000 --_000_C14BDF6F520F4DB2BDC37721DB16A97Eintelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U2VlIGlubGluZSBubXM+DQoNCkZyb206IFJBVFMgPHJhdHMtYm91bmNlc0BpZXRmLm9yZz4gb24g YmVoYWxmIG9mIExhdXJlbmNlIEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPg0KRGF0 ZTogVHVlc2RheSwgQXByaWwgNywgMjAyMCBhdCAxMjoxMiBQTQ0KVG86IFRob21hcyBGb3NzYXRp IDxUaG9tYXMuRm9zc2F0aUBhcm0uY29tPg0KQ2M6ICJyYXRzQGlldGYub3JnIiA8cmF0c0BpZXRm Lm9yZz4sICJTbWl0aCwgTmVkIiA8bmVkLnNtaXRoQGludGVsLmNvbT4NClN1YmplY3Q6IFJlOiBb UmF0c10gRW5kb3JzZW1lbnQgSUQgYW5kIHZlcmlmaWNhdGlvbiBrZXkgKHdhcyBQcm9jZXNzaW5n IEVuZG9yc2VtZW50cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzKQ0KDQpUaGlzIGlzIGEgcmVw bHkgdG8gYm90aCBUaG9tYXMgYW5kIE5lZOKAmXMgbWVzc2FnZSBvbiBkZWJ1ZyBpbiB0aGUgcmVs YXRlZCB0aHJlYXQuDQoNCk15IGluY2xpbmF0aW9uIGlzIHRvIGFzc29jaWF0ZSBlbmRvcnNlbWVu dHMgd2l0aCB0aW1lLWludmFyaWFudCBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGRldmljZS4gQXQg dGhlIG1vbWVudCB0aGlzIGRvZXNu4oCZdCBzZWVtIGxpa2UgdGhlIG9ubHkgd2F5IHRvIGRvIGl0 LCBidXQgaXQgc2VlbXMgbGlrZSBhIGdvb2Qgd2F5LiBUaGluZ3MgdGhhdCBhcmUgbm90IHRpbWUg aW52YXJpYW50IGFyZSBwb2xpY3ksIGstZy12IG9yIHN1Y2guDQpObXM+IENlcnRhaW5seSBhbnkg cHJvcGVydHkgdGhhdCBpcyB0aW1lIGludmFyaWFudCAoYWJvdXQgdGhlIGRldmljZSkgY2FuIGJl IGV4cGxpY2l0bHkgY2FwdHVyZWQgaW4gRW5kb3JzZW1lbnRzLiBTaW5jZSB0aGV5IGFyZSB0aW1l LWludmFyaWFudCBpdCBkb2VzbuKAmXQgbWFrZSBzZW5zZSB0byBBdHRlc3QgdG8gdGhlbSBpbiBF dmlkZW5jZSAodGhleSB3aWxsIGFsd2F5cyBiZSB0aGUgc2FtZSByZXN1bHQpLiBJIGRpc2FncmVl IHRoYXQgRW5kb3JzZW1lbnQgTVVTVCBPTkxZIGJlIHRpbWUgaW52YXJpYW50IGNsYWltcyBob3dl dmVyLg0KTm1zPiBOb3Qgc3VyZSBpZiB0aGUgcXVlc3Rpb25zIGJlbG93IGFyZSByaGV0b3JpY2Fs Lg0KDQpFbmRvcnNlbWVudA0KU3lzdGVtIGFyY2hpdGVjdHVyZSDigJQgRG9lcyB0aGUgQXR0ZXN0 ZXIgdXNlIGEgVEVFIG9yIGEgVFBNIG9yIG1heWJlIGl0IGlzIHNpbXBsZSBzeXN0ZW0gd2l0aCBq dXN0IGEgc2ltcGxlIENQVSwgYnV0IGl0IGlzIGVuY2FzZWQgaW4gdGl0YW5pdW0uIElzIGRlZmVu c2UgYWdhaW5zdCBjaGlwIGludmFzaXZlIGF0dGFja3MgY29uc2lkZXJlZD8gRG8ga2V5cyBiZWNv bWUgaW5hY2Nlc3NpYmxlIHdoZW4gZGVidWcgaXMgZW5hYmxlZC4NCg0KRGV2ZWxvcG1lbnQgcHJv Y2VzcyDigJQgSXMgdGhlcmUgYSBzcGVjaWFsIHNlY3VyaXR5LW9yaWVudGVkIHRlYW0/IERvZXMg dGhlIHRlYW0gaGF2ZSBhIGNvZGUgcmV2aWV3IHBvbGljeT8gSXMgdGhlcmUgYSBidWcgYm91bnR5 PyBBcmUgdGhlIGRlc2t0b3BzIGFuZCBJVCBzeXN0ZW1zIHVzZWQgZm9yIEhXIGFuZCBTVyBkZXZl bG9wbWVudCBpc29sYXRlZD8NCg0KTWFudWZhY3R1cmluZyDigJQgQXJlIHRoZSBmYWN0b3JpZXMg c2VjdXJlZCBpbiBhIHNwZWNpYWwgd2F5PyBJcyB0aGUgYXR0ZXN0YXRpb24ga2V5IHByb3Zpc2lv bmluZyBzeXN0ZW0gaGFyZGVuZWQgaW4gc29tZSB3YXkgKGUuZy4sIHVzZXMgSFNNcykuDQoNCkNl cnRpZmljYXRpb25zIOKAlCBUaGVzZSB0YWtlIGEgbG9uZyB0aW1lIHRvIGFjaGlldmUgYW5kIHdp bGwgdXN1YWxseSByZXF1aXJlIHNvbWUgb2YgdGhlIGFib3ZlLg0KDQpNeSB0aGlua2luZyBmb3Ig RUFUIHdhcyB0aGF0IHlvdSBvbmx5IHB1dCBhdHRlc3RhdGlvbiBrZXlzIGludG8gZGV2aWNlcyB0 aGF0IG1lZXQgc29tZSBjcml0ZXJpYSBsaWtlIHNvbWUgb2YgdGhlIGFib3ZlLiBTaW5jZSB0aGVy ZSBpcyBvZnRlbiBubyB3YXkgdG8gcmVjb3ZlciBmcm9tIGEgY29tcHJvbWlzZWQgYXR0ZXN0YXRp b24ga2V5IGJlY2F1c2Ugbm8ga2V5IG1vcmUgc2VjdXJlIHRoYW4gaXQsIHlvdSBraW5kIG9mIGhh dmUgdG8gaGF2ZSBhbGwgdGhhdC4NCk5tcz4gVGhlIGlkZWEgdGhhdCBhIGRldmljZSBoYXMgYW4g QXR0ZXN0aW5nIEVudmlyb25tZW50KHMpIGFuZCBUYXJnZXQgRW52aXJvbm1lbnQocykgaW1wbGll cyB0aGUgQXR0ZXN0aW5nIEVudmlyb25tZW50IGlzL3Nob3VsZCBiZSBtb3JlIGhhcmRlbmVkIGlz IHdoYXQgc29tZSByZWZlciB0byBhcyBSb290LW9mLVRydXN0LiBUaGUgdGVjaG5pcXVlcyBmb3Ig cHJvdGVjdGluZyB0aGUgQXR0ZXN0aW5nIEVudmlyb25tZW50IHNob3VsZCBiZSBpbW11dGFibGUv aW52YXJpYW50IHdoaWNoIGlzIHdoeSBzb21lIHVzZSB0aGUgdGVybSDigJxIYXJkd2FyZSBSb290 IG9mIFRydXN04oCdIHdoZW4gZGVzY3JpYmluZyBhbiBpZGVhbCBBdHRlc3RpbmcgRW52aXJvbm1l bnQuDQoNClNpbmNlIHRoZXNlIGRvbuKAmXQgY2hhbmdlIG11Y2ggb3ZlciB0aW1lLCB0aGUgZW5k b3JzZW1lbnQgd291bGRu4oCZdCBjaGFuZ2UuDQpObXM+IFRoZSBFbmRvcnNlbWVudCBjb252ZXlz IHRoZSBpbW11dGFiaWxpdHkgLyBwcm9wZXJ0eSBvZiB0aW1lIGludmFyaWFuY2UgdG8gdGhlIFZl cmlmaWVyLiBJdCBkZXNjcmliZXMgdGhlIFJvb3Qgb2YgVHJ1c3QgLyBBdHRlc3RpbmcgRW52LiAg V2hlcmUgdGhlIGF0dGVzdGF0aW9uIGtleSBpcyBoZWxkIGJlY2F1c2UgaWYgdGhlIHJvb3QgYXR0 ZXN0YXRpb24gc3ViLXN5c3RlbSBpcyBicm9rZW4gdGhlcmUgaXMgbm8gb3RoZXIgcHJvdGVjdGlv biBtZWNoYW5pc20gdG8gZmFsbCBiYWNrIG9uIGZvciByZWNvdmVyeSB0aGF0IGRvZXNu4oCZdCBp bnZvbHZlIHBoeXNpY2FsIHJlbWVkaWF0aW9uLg0KDQogVGhleSBjb3VsZCBldmVuIHNwYW4gc2V2 ZXJhbCBtb2RlbHMgYW5kIHZhcnlpbmcgSFcuDQpObXM+IE9yIG5vdC4gSXQgZGVwZW5kcyBvbiB0 aGUgc3lzdGVtIGFyY2hpdGVjdHVyZS4NCg0KUG9saWN5LCBLLUctViwgb3RoZXINCk5tcz4gUG9s aWN5IChha2EgQXBwcmFpc2FsIFBvbGljeSBmb3IgRXZpZGVuY2UsIEFwcHJhaXNhbCBQb2xpY3kg Zm9yIEF0dGVzdGF0aW9uIFJlc3VsdHMpIGlzIGRpZmZlcmVudCBmcm9tIEVuZG9yc2VtZW50LiBL bm93biBHb29kIFZhbHVlcyBhcmUgc3lub255bW91cyB3aXRoIEVuZG9yc2VtZW50LiBUaGUgYXJj aGl0ZWN0dXJlIHVzZXMgb25lIHdvcmQgdG8gY2FwdHVyZSBhIHZhcmlldHkgb2YgcG9zc2libGUg Y2xhaW1zIHRoYXQgc3VwcGx5IGNoYWluIGVudGl0aWVzIGNhbiBjb252ZXkgdG8gVmVyaWZpZXJz LiBJIGRvbuKAmXQgdGhpbmsgaXQgbWFrZXMgc2Vuc2UgdG8gY29uZmxhdGUgUG9saWN5IHdpdGgg RW5kb3JzZW1lbnRzLiBJdCBtaWdodCBtYWtlIHNlbnNlIGZvciBQb2xpY3kgdG8gaGF2ZSBhbiBv cGluaW9uIGFzIHRvIHdoYXQgaXMg4oCYZ29vZOKAmS4gQnV0IGl0IGlzIGEgY2FzZSBvZiBhbiBP d25lciBkZWNpZGluZyB2cy4gdGhlIG1hbnVmYWN0dXJlci4gSXQgaXMgYXBwcm9wcmlhdGUgZm9y IGJvdGggdG8gaGF2ZSBzb21ldGhpbmcgdG8gc2F5IGFib3V0IHRoZSBjbGFpbS4NClNXIFZlcnNp b25zIOKAlCBBcyBsb25nIGFzIHRoZSBTVyBmb2xsb3dzIGEgZGV2ZWxvcG1lbnQgcHJvY2VzcyBs aWtlIHRoYXQgYWJvdmUsDQoNCml0IGRvZXNu4oCZdCBoYXZlIHRvIGJlIGluY2x1ZGVkIGluIHRo ZSBlbmRvcnNlbWVudC4NCk5tcz4gSSBkaXNhZ3JlZSB3aXRoIHRoaXMgY29uY2x1c2lvbi4gVGhl IHZlbmRvciBkZXRlcm1pbmVzIHdoaWNoIHZlcnNpb24gc3RyaW5nIGlzIGFwcGxpZWQgdG8gU1cg aXQgcHJvZHVjZXMuIFRoYXQgdmFsdWUgaXMgYW4gYXNzZXJ0aW9uIG9ubHkgdGhlIFNXIHZlbmRv ciBjYW4gbWFrZS4gT3duZXIgUG9saWN5IGNhbiBzYXkgdGhhdCB0aGUgdmVyc2lvbiBpcyDigJhn b29k4oCZIG9yIOKAmGJhZOKAmSBvciDigJh1bmtub3du4oCZIGJ1dCBjYW7igJl0IHNheSB0aGF0 IHRoZSB2ZXJzaW9uIGlzIFguDQoNCk9mIGNvdXJzZSB0aGUgc21hbGxlciB0aGUgU1cgYW5kIHRo ZSBiZXR0ZXIgdGhlIHByb2Nlc3MsIHRoZSBtb3JlIGl0IGlzIHRydWUgKGFuZCB2aWNlIHZlcnNh KS4NCg0KQmxhY2tsaXN0cyDigJQgVGhlc2UgbWlnaHQgYmUgc3BlY2lmaWMgdG8gVUVJRHMsIHZl cnNpb25zIG9mIFNXLCBkZXBsb3ltZW50cyBhIHBhcnRpY3VsYXIgT0VNIG9yIHN1Y2gNCk5tcz4g TWFueSBlbnRpdGllcyBjYW4gcHJvZHVjZSBibGFjay93aGl0ZSBsaXN0cyBsZWdpdGltYXRlbHku IElmIHRoZSBlbnRpdHkgaXMgaW4gdGhlIHN1cHBseSBjaGFpbiB0aGUgYXNzZXJ0aW9uIGlzIGFu IEVuZG9yc2VtZW50LiBJZiB0aGUgZW50aXR5IGlzIGFuIE93bmVyIHRoZW4gdGhlIGFzc2VydGlv biBpcyBhIFBvbGljeS4gVGhlIGRpZmZlcmVuY2UgaXMgaW4gaG93IHRoZSBWZXJpZmllciB0cmVh dHMgRW5kb3JzZW1lbnRzIHZzLiBQb2xpY2llcy4NCkV4YW1wbGU6DQogICAgICBTMCkgRW5kb3Jz ZXIgRTAgc2F5cyBLZXkgS0Qgc3BlYWtzIGZvciBEZXZpY2UgRA0KUzEpIEF0dGVzdGVyIEtEIHNh eXMgU1cgUyBpcyBleHRhbnQgb24gRA0KICAgICAgUzIpIEVuZG9yc2VyIEUxIHNheXMgU1cgUyBp cyB2ZXJzaW9uIDEuMA0KICAgICAgUzMpIEVuZG9yc2VyIEUyIHNheXMgdmVyc2lvbiAxLjAgKG9m IFMpIGlzIGJhZA0KICAgICAgUzQpIE93bmVyIHBvbGljeSBzYXlzIHZlcnNpb24gMS4wIChvZiBT KSBpcyBnb29kLg0KICAgICAgUzUpIE93bmVyIHBvbGljeSBzYXlzIEUxIGlzIHRydXN0ZWQgdG8g c2F5IFMgaXMgdmVyc2lvbiAxLjANCiAgICAgIFM2KSBPd25lciBwb2xpY3kgc2F5cyBFMiBpcyB0 cnVzdGVkIHRvIHNheSBTIGlzIGdvb2QvYmFkDQogICAgICBTNykgT3duZXIgUG9saWN5IHNheXMg RTAgaXMgdHJ1c3RlZCB0byBwcm92aXNpb24gS0Qgb24gRA0KICAgICAgQXBwcmFpc2FsIGV2YWx1 YXRlcyB0aGUgc3RhdGVtZW50czoNClByb3ZlOiBYID0gU1cgaXMgZXh0YW50IG9uIGRldmljZSBE IGFuZCBpdCBpcyBnb29kLg0KUHJvb2Y6DQogICAgICAgUzMgc2F5cyBFMiBzYXlzIHZlcnNpb24g MS4wIGlzIGJhZCA8YW5kPiBTNiBzYXlzIEUyIGNhbiBzYXkgdGhpcyB8IHZhbGlkDQpTMiBzYXlz IEUxIHNheXMgUyBpcyB2ZXJzaW9uIDEuMCA8YW5kPiBTNSBzYXlzIEUxIGNhbiBzYXkgdGhpcyB8 IHZhbGlkDQogICAgICAgUzEgc2F5cyBLRCBzYXlzIFMgaXMgZXh0YW50IG9uIEQgPGFuZD4gUzcg c2F5cyBLRCBjYW4gc2F5IHRoaXMgfCB2YWxpZA0KICAgICAgIFMwIHNheXMgS0Qgc3BlYWtzIGZv ciBEIDxhbmQ+IFM3IHNheXMgRTAgY2FuIHNheSB0aGlzIHwgdmFsaWQNCiAgVGhlcmVmb3JlIFgg aXMgRkFMU0UgYXQgdGhpcyBwb2ludDsgYnV0DQogICAgICAgUzQgc2F5cyB2ZXJzaW9uIDEuMCBp cyBnb29kIDxhbmQ+IE93bmVyIGNhbiBzYXkgYW55dGhpbmcgfCB2YWxpZA0KICBUaGVyZWZvcmUg WCBpcyBUUlVFDQoNCkRlYnVnIHN0YXR1cyDigJQgTW9zdCBvZiB0aGUgZGVidWcgc3RhdHVzIHZh bHVlcyBjYW4gdmFyeSBvbiBhIGRheS1kYXkgYmFzaXMNCk5tcz4gSXQgZGVwZW5kcyBvbiB0aGUg ZGVidWcgbWVjaGFuaXNtLg0KDQpPRU0gbW9kZWwg4oCUIElmIHRoZSBhdHRlc3RhdGlvbiBpcyBp bXBsZW1lbnRlZCBieSBhIGNoaXAgdmVuZG9yIGFuZCB0aGUgZW5kb3JzZW1lbnQgaXMgZm9yIHRo ZSBjaGlwLCB0aGVuIHRoZSBPRU0gbW9kZWwgd2lsbCB2YXJ5IHdpZGVseS4NCk5tcz4gTm90IHN1 cmUgaG93IHRoaXMgaXMgcmVsZXZhbnQNCg0KTm9uZSBvZiB0aGVzZSBjYW4gYmUgY3JpdGVyaWEg YXMgdG8gd2hldGhlciBhbiBhdHRlc3RhdGlvbiBrZXkgaXMgcHV0IGludG8gYSBkZXZpY2Ugb3Ig bm90IGFzIHRoZXkgYXJlIG5vdCBrbm93biBhdCBtYW51ZmFjdHVyaW5nIHRpbWUgYW5kL29yIG11 c3QgYmUgYWxsb3dlZCB0byB2YXJ5IHdpZGVseSBhZnRlciBtYW51ZmFjdHVyaW5nLg0KTm1zPiBE ZXZpY2VzIGNhbiBiZSBhIG1peCBvZiBoYXJkd2FyZSBhbmQgZmlybXdhcmUuIEV2ZW4gaGFyZHdh cmUgY2FuIGJlIG11dGFibGUuIEVuZG9yc2VtZW50cyBkZXNjcmliZSB0aGUgbXV0YWJpbGl0eSBw cm9wZXJ0aWVzIG9mIHRoZSBkZXZpY2UuIEVuZG9yc2VtZW50IGFsc28gZGVzY3JpYmUgdGhlIHJh bmdlIG9mIHBvc3NpYmxlIChhbmQgYWNjZXB0YWJsZSkgdmFsdWVzIHRoZSBtdXRhYmxlIHByb3Bl cnRpZXMgY2FuIGFjY2VwdC4NCg0KDQpJIHRoaW5rIHdoYXQgSeKAmXZlIGRlc2NyaWJlZCBhYm92 ZSBsaW5lcyB1cCBwcmV0dHkgd2VsbCBmb3IgYSBUUE0uDQpObXM+IEkgZGlzYWdyZWUuDQpUaGUg c3lzdGVtIGFyY2hpdGVjdHVyZSBpcyBtb3N0bHkgc2V0IGJ5IHRoZSBUQ0cuDQpObXM+IE5vLCB0 aGUgVENHIHNwZWNpZmllcyBpbnRlcmZhY2VzIG5vdCBpbXBsZW1lbnRhdGlvbi4NCkhXIFRQTXMg YXJlIGFsbW9zdCBhbHdheXMgY2VydGlmaWVkLg0KTm1zPiBBbiBpbmRlcGVuZGVudCBldmFsdWF0 aW9uIGVudGl0eSBzcGVjaWZpZXMgaG93IGFuIGltcGxlbWVudGF0aW9uIHNjb3JlZCBhY2NvcmRp bmcgdG8gdGhlIGNyaXRlcmlhLiBUaGVyZSBhcmUgbG90cyBvZiBUUE1zIHRoYXQgYXJlIG5vdCBj ZXJ0aWZpZWQgb3IgYXJlIGNlcnRpZmllZCB0byBkaWZmZXJlbnQgbGV2ZWxzLiBUaGUgaW1wb3J0 YW50IHBvaW50IHNob3VsZCBiZSB0aGF0IHRoZSBWZXJpZmllciBkb2VzbuKAmXQga25vdyB1bmxl c3MgaXQgYXNrcyBmb3IgRXZpZGVuY2UgYW5kIEVuZG9yc2VtZW50cy4NClRoZXkgYXJlIGluZGVw ZW5kZW50IG9mIE9FTSBtb2RlbC4NCk5tcz4gVGhpcyBpc27igJl0IHRydWUuIEV2ZXJ5IFRQTSBo YXMgYSB2ZW5kb3IsIG1vZGVsL3Byb2R1Y3QgbmFtZSBldGPigKYgdGhhdCBpcyBub3QgY2hvc2Vu IGJ5IFRDRy4NCkl0IGFsc28gbGluZXMgdXAgcmVhc29uYWJseSB3ZWxsIHdpdGggc2VjdXJlIGVs ZW1lbnRzIGFuZCBjYW4gbGluZSB1cCB3aXRoIFRFReKAmXMuDQoNClRoZSBjcnV4IG9mIGVuZG9y c2VtZW50IHRvIG1lIGlzIHRoZSBzZWN1cml0eSBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGF0dGVz dGVyIHRoYXQgcHJvdGVjdCB0aGUgYXR0ZXN0YXRpb24ga2V5IGJlY2F1c2UgdGhlcmUgaXMgZ2Vu ZXJhbGx5IG5vIHJlY292ZXJ5IGZyb20gYSBjb21wcm9taXNlZCBhdHRlc3RhdGlvbiBrZXkuIEl0 IHNldHMgdGhlIGJhc2VsaW5lIHJpc2sgb2YgdGhlIEhXIGFuZCBTVyBvZiB0aGUgZGV2aWNlLg0K Tm1zPiBJIGFncmVlIHRoYXQgdGhlIEF0dGVzdGluZyBFbnZpcm9ubWVudCBpcyB0cnVzdGVkIGJ5 IHRoZSBUYXJnZXQgRW52aXJvbm1lbnQuIElmIHRoZSBBdHRlc3RpbmcgRW52aXJvbm1lbnQgaXMg Y29tcHJvbWlzZWQsIHRoZXJlIGlzIG5vIHdheSBmb3IgdGhlIFRhcmdldCBFbnZpcm9ubWVudCB0 cnVzdHdvcnRoaW5lc3MgdG8gYmUgYXNzZXNzZWQuDQoNCg0KT24gb25lIGV4dHJlbWUgaXMgYSBz ZXBhcmF0ZSBlbmRvcnNlbWVudCBmb3IgZXZlcnkgZGV2aWNlICjigJxtaWNybyBlbmRvcnNlbWVu dCI/KSwgd2hpY2ggaXMgd2hhdCBJIHRoaW5rIFRob21hcyBhbmQgQVJNIFBTQSBhcmUgdGVuZGlu ZyB0b3dhcmRzLiBUaGUgb3RoZXIgZXh0cmVtZSBpcyBvbmUgZW5kb3JzZW1lbnQgZm9yIGEgcHJv ZHVjdCBsaW5lICjigJxtYWNybyBlbmRvcnNlbWVudCI/KSwsIHNheSBhIHByb2R1Y3QgbGluZSBv ZiBUUE1zLg0KTm1zPiBJIGRpc2FncmVlIHdpdGggdGhpcyBjaGFyYWN0ZXJpemF0aW9uIG9mIFRQ TXMuIEVhY2ggdmVuZG9y4oCZcyBUUE0gcHJvZHVjdCBpcyBkaWZmZXJlbnQgYW5kIGhhcyBkaWZm ZXJlbnQgaW50cmluc2ljIHRydXN0d29ydGhpbmVzcyBwcm9wZXJ0aWVzLiBNYW55IGFyZSBDQyBl dmFsdWF0ZWQgYW5kIHNvbWUgYWNoaWV2ZSBhIHNpbWlsYXIgc2NvcmUuIFRoYXQgZG9lc27igJl0 IG1lYW4gdGhleSBhcmUgdGhlIHNhbWUgcHJvZHVjdC4NClRoZW4gaXTigJlzIG1vcmUgbGlrZSB0 aGUgZGF0YSBzaGVldCBmb3IgdGhlIHByb2R1Y3QuDQoNClRoZW4gdGhlcmXigJlzIGRpZmZlcmVu dCB3YXlzIHRvIGZhbiB0aGlzIG91dCB0byB0aGUgZGlmZmVyZW50IGtleSAvIHNpZ25pbmcgc2No ZW1lcyAocGVyLWRldmljZSBrZXksIGdyb3VwIGtleSwgRUNEQUEsIFguNTA5KS4gRm9yIGV4YW1w bGUgYSBtYWNyby1lbmRvcnNlbWVudCBjb3VsZCBpbmNsdWRlIHRoZSByb290IG9mIGFuIFguNTA5 IGhpZXJhcmNoeSBhbmQgdGhlIGluZGl2aWR1YWwgZGV2aWNlcyAob3IgZ3JvdXBzIG9mIGRldmlj ZXMpIHdvdWxkIGhhdmUgaW5kaXZpZHVhbCBrZXlzIHRoYXQgY2hhaW4gdXAuDQpObXM+IFRoZSBy b290IG9mIGEgWC41MDkgaGllcmFyY2h5IGlzIGNhbGxlZCBhIOKAnFJvb3QgQ0HigJ0uIEEgcG9s aWN5IHRoYXQgYWNjZXB0cyBhIFJvb3QgQ0EgcHVibGljIGtleS9jZXJ0IGlzIGNhbGxlZCBhIOKA nFRydXN0IEFuY2hvcuKAnS4gQSB0cnVzdCBhbmNob3IgbWFuYWdlbWVudCBwcm90b2NvbCB0aGF0 IGNvbnZleXMgYSB0cnVzdCBhbmNob3IgdG8gYSBWZXJpZmllciBpcyBhbiBFbmRvcnNlbWVudCBv ZiBhIFJvb3QgQ0EgdGhhdCBjaGFpbnMgdG8gYW4gYXR0ZXN0YXRpb24ga2V5LiBUaGUgRW5kb3Jz ZW1lbnQgbWlnaHQgYmUgdXNlZnVsIGZvciBjb25zdHJ1Y3RpbmcgYSBwb2xpY3kgc2ltaWxhciB0 byDigJxTMOKAnSBhYm92ZS4gKEl0IGlzbuKAmXQgc2F5aW5nIG1vcmUgdGhhbiB0aGF0IElNTykN Cg0KV2l0aCBhIG1pY3JvLWVuZG9yc2VtZW50IHRoZSBwZXItZGV2aWNlIHB1YmxpYyBrZXkgY291 bGQgYmUgcGVyIGVuZG9yc2VtZW50Lg0KTm1zPiBJIGRvbuKAmXQgdGhpbmsgdGhlIGFyY2hpdGVj dHVyZSBzaG91bGQgdHJ5IHRvIGRlZmluZSDigJhtaWNybyBlbmRvcnNlbWVudOKAmSBvciDigJht YWNybyBlbmRvcnNlbWVudOKAmS4NCg0KDQpUaGUgbW9zdCBpbXBvcnRhbnQgdGhpbmcgYWJvdXQg dGhlIGVuZG9yc2VtZW50IHNlZW1zIHRvIG1lIGlzIHRoZSBjaGFyYWN0ZXJpemF0aW9uIG9mIGhv dyB0aGUgYXR0ZXN0YXRpb24ga2V5IGlzIHByb3RlY3RlZC4NCk5tcz4gVGhlIGZpcnN0IGxpbmUg aW4gdGhlIEVuZG9yc2VtZW50IHNlY3Rpb24gb2YgdGhlIGFyY2hpdGVjdHVyZSBkb2N1bWVudCBz YXlzIHRoaXMgYWxtb3N0IHZlcmJhdGltLg0KDQpMTA0KDQoNCg0KDQpPbiBBcHIgNywgMjAyMCwg YXQgNzozNiBBTSwgVGhvbWFzIEZvc3NhdGkgPFRob21hcy5Gb3NzYXRpQGFybS5jb208bWFpbHRv OlRob21hcy5Gb3NzYXRpQGFybS5jb20+PiB3cm90ZToNCg0KSGkgTGF1cmVuY2UsDQoNClRoYW5r cyBmb3IgYnJpbmdpbmcgdGhpcyB1cC4gIEEgZmV3IHRob3VnaHRzIGJlbG93Lg0KDQpPbiAwMy8w NC8yMDIwLCAyMDozNywgIlJBVFMgb24gYmVoYWxmIG9mIExhdXJlbmNlIEx1bmRibGFkZSINCjxy YXRzLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnJhdHMtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVo YWxmIG9mIGxnbEBpc2xhbmQtcmVzb3J0LmNvbTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29t Pj4gd3JvdGU6DQoNClNvIGhvdyBkb2VzIGEgVmVyaWZpZXIgZmluZCB0aGUgYXBwbGljYWJsZSBl bmRvcnNlbWVudCBmb3IgRXZpZGVuY2UgaXQNCndpc2hlcyB0byB2ZXJpZnkgYW5kIGtub3cgdGhh dCBpcyByZWFsbHkgdGhlIHJpZ2h0IGVuZG9yc2VtZW50Pw0KDQpTZWVtcyBsaWtlIHRoZSBFdmlk ZW5jZSBuZWVkcyBzb21lIHNvcnQgb2YgYW4gZW5kb3JzZW1lbnQgbG9jYXRvciBJRC4NClRoaXMg Y291bGQgYmUgYSBVUkwgb3IgYSBHVUlELiBFQVQgY3VycmVudGx5IGhhcyB0aGUgb3JpZ2luYXRp b24gY2xhaW0NCnRvIHRyeSB0byBzb2x2ZSB0aGlzLCBidXQgaXQgaXMgaGFsZi1iYWtlZC4gSXQg bmVlZHMgdG8gZ2V0IGZpeGVkLiBJ4oCZbQ0KZmlzaGluZyBmb3IgY29tbWVudHMgaGVyZSBvbiB3 aGF0IGl0IHNob3VsZCBiZSBsaWtlLg0KDQpQcmV0dHkgc3VyZSB0aGUgRW5kb3JzZW1lbnQgbmVl ZHMgdG8gaW5jbHVkZSBvciByZWZlcmVuY2UgdGhlIHB1YmxpYw0Ka2V5IHRoYXQgaXMgdXNlZCB0 byB2ZXJpZnkgdGhlIHNpZ25hdHVyZS4gV2l0aG91dCB0aGF0LCB0aGUgQXR0ZXN0ZXINCmNvdWxk IGxpZSBhbmQgcGljayBhbnkgb2xkIEVuZG9yc2VtZW50IHRoYXQgaXQgd2lzaGVzLiBUaGVyZSBu ZWVkcyB0bw0KYmUgc29tZSBiaW5kaW5nIGJldHdlZW4gaXRlbXMgaW4gdGhlIGVuZG9yc2VtZW50 IChFMCwgRTEs4oCmKSBhbmQgdGhlDQp2ZXJpZmljYXRpb24ga2V5LiBUaGF0IGNvdWxkIGJlIGlu IHRoZSBmb3JtIG9mIGEgc2lnbmVkIHRva2VuIG9yDQpjZXJ0aWZpY2F0ZSwgYnV0IGRvZXNu4oCZ dCBoYXZlIHRvIGJlLiBQcmV0dHkgc3VyZSB0aGlzIG5lZWRzIHRvIGJlDQpkaXNjdXNzZWQgaW4g dGhlIGFyY2hpdGVjdHVyZSBkb2MuDQoNClRoZXJlJ3MgYSBmZXcgc2NlbmFyaW9zOg0KLSBPbmUg ZW5kb3JzZW1lbnQgYXBwbGllcyB0byBsb3RzIG9mIGRldmljZXMgaW4gdGhlIHNhbWUgY2xhc3Ms IGJ1dA0KIGVhY2ggaGFzIHRoZWlyIG93biBhdHRlc3RhdGlvbiBrZXkuDQotIC0gUHJvYmFibHkg RUNEQUEgZml0cyBpbiBoZXJlDQotIC0gT25lIG9wdGlvbiBoZXJlIGlzIGFuIFg1MDkgaGllcmFy Y2h5DQotIEdyb3VwIGtleXMgYXJlIHVzZWQgKGZvciBwcml2YWN5IHJlYXNvbnMgb3Igb3RoZXIp IHNvIHRoZXJlIGlzIGENCiBvbmUtb25lIGNvcnJlbGF0aW9uIHdpdGggdGhlIEVuZG9yc2VtZW50 cyAodGhlIEdFSUQgZGlzY3Vzc2lvbikNCi0gR3JvdXAga2V5cyBhcmUgdXNlZCwgYnV0IGFjcm9z cyBkZXZpY2VzIHRoYXQgaGF2ZSBkaWZmZXJlbnQNCiBlbmRvcnNlbWVudHMgc28gdGhlcmXigJlz IG5vIG9uZS1vbmUgY29ycmVsYXRpb24NCg0KV2hpbGUgdGhlIGxhc3Qgb25lIHNlZW1zIG9kZCBh bmQgdW5saWtlbHksIEkgdGhpbmsgaXQgY291bGQgb2NjdXIsDQpiZWNhdXNlIGZyb20gYSBsb3Qg b2YgcmVhbCBleHBlcmllbmNlIHRoZSBzZXQgdXAgb2YgYXR0ZXN0YXRpb24ga2V5cw0KaXMgdmVy eSBpZGlvc3luY3JhdGljLiBJdCBpcyB3aWxkbHkgYWZmZWN0ZWQgYnkgbWFudWZhY3R1cmluZyBj b3N0cw0KYW5kIGlzc3VlcyBvbiBhc3NlbWJseSBsaW5lcywgc3ViIGNvbnRyYWN0b3Igc3RydWN0 dXJlLCBsb2NhdGlvbiBvZg0Kc2VjdXJlIGZhY2lsaXRpZXMgYW5kIGFwcHJvYWNoZXMgdG8gbWFr aW5nIG1vbmV5IG9uIGl0LiBUaGV5IGFyZSBsaWtlDQpzbm93Zmxha2VzLCBlYWNoIG9uZSBpcyBk aWZmZXJlbnQuICBTbyBtYXliZSBlbmRvcnNlbWVudCBsb2NhdG9yIElEDQphbmQga2V5IElEIGFy ZSBub3QgdGhlIHNhbWUsIGJ1dCB0aGV5IGNhbiBiZSBpbiBzb21lIHVzZSBjYXNlcz8NCg0KSSBh bSBhbHNvIHRlbXB0ZWQgdG8gZW5jb3VyYWdlIHRoZSBwbGFjZW1lbnQgb2YgdGhlIGVuZG9yc2Vt ZW50DQpsb2NhdG9yIElEIGluIHRoZSBDT1NFIG9yIEpPU0UgaGVhZGVyIHBhcmFtZXRlcnMgc28g eW91IGRvbuKAmXQgaGF2ZSB0bw0KcGFyc2UgdGhlIHVudmVyaWZpZWQgYm9keSBvZiBjbGFpbXMg dG8gYmUgYWJsZSB0byBmaW5kIHRoZSBrZXkNCm1hdGVyaWFsIHRvIHZlcmlmeSBpdC4NCg0KVGhv dWdodHM/DQoNCkEgdHdvIGxldmVsIGxvb2t1cCBrZXksIG1vZGVsK2luc3RhbmNlLCBzZWVtcyB0 byBiZSBxdWl0ZSBnZW5lcmFsbHkNCmFwcGxpY2FibGUgYXMgYW4gZW5kb3JzZW1lbnQgbG9jYXRv ci4gIFRoZSBtb2RlbCBwYXJ0IHdvdWxkIGdldCB5b3UgdG8NCnRoZSBzaGFyZWQgZGF0YSAoZS5n LiwgY2VydGlmaWNhdGlvbiwgbWVhc3VyZWQgYm9vdCBLR1ZzLCBldGMuKSwgd2hpbGUNCnRoZSBp bnN0YW5jZSBwYXJ0IGNhbiBiZSB1c2VkIHRvIHJldHJpZXZlIGRldmljZS1zcGVjaWZpYyBzdGF0 ZToNCnZlcmlmaWNhdGlvbiBrZXkocykgYXMgd2VsbCBhcyBvdGhlciBtZXRhZGF0YSwgZS5nLiwg aWYgc29tZSBnZWFyIGlzDQpibGFja2xpc3RlZC4gIEluIFBTQSB3ZSBoYXZlIHNvbWV0aGluZyBx dWl0ZSAodGhvdWdoIG5vdCBlbnRpcmVseSkNCnNpbWlsYXIgd2l0aCBpbXBsZW1lbnRhdGlvbiBh bmQgaW5zdGFuY2UgSURzIFsxXSBbMl0uDQoNCihDb250ZXh0LXN3aXRjaGluZyBmb3IgYSBzZWNv bmQgb24gb3VyIHByZXZpb3VzIFVFSUQvR0VJRCBkaXNjdXNzaW9uOiBJDQpndWVzcyB3ZSBtaWdo dCBtb2RlbCBhbiBpbnN0YW5jZSBhcyBhbiBhbm9ueW1pdHkgc2V0LCBhbmQgdGhlcmVmb3JlDQp0 cmVhdCBFVUlEcyBhcyB0aGUgc3BlY2lhbCBjYXNlIEdFSURzIHdpdGggY2FyZGluYWxpdHkgPT0g MT8pDQoNCkZvciB0aGUgc2FrZSBvZiBidWlsZGluZyBhIHNoYXJlZCBhbmQgcmV1c2FibGUgdm9j YWJ1bGFyeSwgSSdkIHByZWZlcg0Ka2VlcGluZyBtb2RlbCBhbmQgaW5zdGFuY2UgaWRlbnRpZmll cnMgYXMgc2VwYXJhdGUgY2xhaW1zIHJhdGhlciB0aGFuDQpoYXZpbmcgYW4gb3BhcXVlIGVuZG9y c2VtZW50IElEIGNsYWltIHRoYXQgY2x1bXBzIHRvZ2V0aGVyIHRob3NlIGFuZA0KcG9zc2libHkg b3RoZXIgc3R1ZmYgaW4gYSB1c2UtY2FzZSBzcGVjaWZpYyBmYXNoaW9uLiAgRm9yIHRoZSBzYW1l DQpyZWFzb24gSSB3b3VsZCBub3Qgb3ZlcnJpZGUga2V5IElEIHdpdGggaW5zdGFuY2UgSUQgc2Vt YW50aWNzLg0KDQpjaGVlcnMsIHRoYW5rcyENCg0KWzFdIGh0dHBzOi8vd3d3LmlldGYub3JnL2lk L2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1wc2EtdG9rZW4tMDUuaHRtbCNuYW1lLWltcGxlbWVudGF0 aW9uLWlkDQpbMl0gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtdHNjaG9mZW5pZy1yYXRz LXBzYS10b2tlbi0wNS5odG1sI25hbWUtaW5zdGFuY2UtaWQNCg0KDQoNCklNUE9SVEFOVCBOT1RJ Q0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNv bmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhl IGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5 IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVz ZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGlu IGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQpSQVRTIG1haWxpbmcgbGlzdA0KUkFUU0BpZXRmLm9yZzxtYWlsdG86 UkFUU0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0 cw0KDQo= --_000_C14BDF6F520F4DB2BDC37721DB16A97Eintelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <7BCA9799BBBF74489CD9CD7405E3A574@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjAgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAgMDt9 DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIg NCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0K CXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1p bHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAy IDIgMiAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29O b3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAx cHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsN Cgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5hcHBsZS1j b252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30N CnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJY29sb3I6d2luZG93dGV4dDsNCglmb250LXdlaWdo dDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9u ZTt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250 LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsN CgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtw YWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXtt c28tbGlzdC1pZDoxNzc4MTMyMDczOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0 LXRlbXBsYXRlLWlkczoyMTEyMDE0Mzc0IC0xNDE3MjMyNzY0IDY3Njk4NjkxIDY3Njk4NjkzIDY3 Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBs aXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MzsNCgltc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6LTsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6OTYu MHB0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0K CW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxl dmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJbWFyZ2luLWxlZnQ6MTMyLjBwdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxl ZnQ6MTY4LjBwdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJbWFyZ2luLWxlZnQ6MjA0LjBwdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6U3ltYm9sOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZl bDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCW1hcmdpbi1sZWZ0OjI0MC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0 OjI3Ni4wcHQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczsN Cgltc28tYmlkaS1mb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CW1hcmdpbi1sZWZ0OjMxMi4wcHQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OlN5bWJvbDsNCgltc28tYmlkaS1mb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgltYXJnaW4tbGVmdDozNDguMHB0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZh bWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoz ODQuMHB0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJ bXNvLWJpZGktZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGlu O30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5TZWUgaW5saW5lIG5tcyZndDs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5SQVRTICZsdDtyYXRzLWJv dW5jZXNAaWV0Zi5vcmcmZ3Q7IG9uIGJlaGFsZiBvZiBMYXVyZW5jZSBMdW5kYmxhZGUgJmx0O2xn bEBpc2xhbmQtcmVzb3J0LmNvbSZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+VHVlc2RheSwgQXByaWwg NywgMjAyMCBhdCAxMjoxMiBQTTxicj4NCjxiPlRvOiA8L2I+VGhvbWFzIEZvc3NhdGkgJmx0O1Ro b21hcy5Gb3NzYXRpQGFybS5jb20mZ3Q7PGJyPg0KPGI+Q2M6IDwvYj4mcXVvdDtyYXRzQGlldGYu b3JnJnF1b3Q7ICZsdDtyYXRzQGlldGYub3JnJmd0OywgJnF1b3Q7U21pdGgsIE5lZCZxdW90OyAm bHQ7bmVkLnNtaXRoQGludGVsLmNvbSZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UmU6IFtSYXRz XSBFbmRvcnNlbWVudCBJRCBhbmQgdmVyaWZpY2F0aW9uIGtleSAod2FzIFByb2Nlc3NpbmcgRW5k b3JzZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRvIFJlc3VsdHMpPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlzIGlzIGEgcmVwbHkg dG8gYm90aCBUaG9tYXMgYW5kIE5lZOKAmXMgbWVzc2FnZSBvbiBkZWJ1ZyBpbiB0aGUgcmVsYXRl ZCB0aHJlYXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk15IGluY2xpbmF0aW9uIGlzIHRvIGFzc29jaWF0ZSBlbmRvcnNlbWVudHMgd2l0aCB0 aW1lLWludmFyaWFudCBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGRldmljZS4gQXQgdGhlIG1vbWVu dCB0aGlzIGRvZXNu4oCZdCBzZWVtIGxpa2UgdGhlIG9ubHkgd2F5IHRvIGRvIGl0LCBidXQgaXQg c2VlbXMgbGlrZSBhIGdvb2Qgd2F5LiBUaGluZ3MgdGhhdCBhcmUgbm90IHRpbWUgaW52YXJpYW50 IGFyZSBwb2xpY3ksIGstZy12DQogb3Igc3VjaC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+Tm1zJmd0OyBDZXJ0YWlubHkgYW55IHByb3BlcnR5IHRoYXQgaXMgdGltZSBpbnZhcmlhbnQg KGFib3V0IHRoZSBkZXZpY2UpIGNhbiBiZSBleHBsaWNpdGx5IGNhcHR1cmVkIGluIEVuZG9yc2Vt ZW50cy4gU2luY2UgdGhleSBhcmUgdGltZS1pbnZhcmlhbnQgaXQgZG9lc27igJl0IG1ha2Ugc2Vu c2UgdG8gQXR0ZXN0IHRvIHRoZW0gaW4gRXZpZGVuY2UNCiAodGhleSB3aWxsIGFsd2F5cyBiZSB0 aGUgc2FtZSByZXN1bHQpLiBJIGRpc2FncmVlIHRoYXQgRW5kb3JzZW1lbnQgTVVTVCBPTkxZIGJl IHRpbWUgaW52YXJpYW50IGNsYWltcyBob3dldmVyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+Tm1zJmd0OyBOb3Qgc3VyZSBpZiB0aGUgcXVlc3Rpb25zIGJlbG93IGFyZSBy aGV0b3JpY2FsLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+PHU+RW5kb3JzZW1lbnQ8L3U+PC9iPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi1yaWdo dDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN5c3RlbSBhcmNoaXRlY3R1cmUg 4oCUIERvZXMgdGhlIEF0dGVzdGVyIHVzZSBhIFRFRSBvciBhIFRQTSBvciBtYXliZSBpdCBpcyBz aW1wbGUgc3lzdGVtIHdpdGgganVzdCBhIHNpbXBsZSBDUFUsIGJ1dCBpdCBpcyBlbmNhc2VkIGlu IHRpdGFuaXVtLiBJcyBkZWZlbnNlIGFnYWluc3QgY2hpcCBpbnZhc2l2ZSBhdHRhY2tzIGNvbnNp ZGVyZWQ/IERvIGtleXMgYmVjb21lIGluYWNjZXNzaWJsZSB3aGVuIGRlYnVnIGlzDQogZW5hYmxl ZC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ RGV2ZWxvcG1lbnQgcHJvY2VzcyDigJQgSXMgdGhlcmUgYSBzcGVjaWFsIHNlY3VyaXR5LW9yaWVu dGVkIHRlYW0/IERvZXMgdGhlIHRlYW0gaGF2ZSBhIGNvZGUgcmV2aWV3IHBvbGljeT8gSXMgdGhl cmUgYSBidWcgYm91bnR5PyBBcmUgdGhlIGRlc2t0b3BzIGFuZCBJVCBzeXN0ZW1zIHVzZWQgZm9y IEhXIGFuZCBTVyBkZXZlbG9wbWVudCBpc29sYXRlZD88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TWFudWZhY3R1cmluZyDigJQgQXJlIHRoZSBm YWN0b3JpZXMgc2VjdXJlZCBpbiBhIHNwZWNpYWwgd2F5PyBJcyB0aGUgYXR0ZXN0YXRpb24ga2V5 IHByb3Zpc2lvbmluZyBzeXN0ZW0gaGFyZGVuZWQgaW4gc29tZSB3YXkgKGUuZy4sIHVzZXMgSFNN cykuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PkNlcnRpZmljYXRpb25zIOKAlCBUaGVzZSB0YWtlIGEgbG9uZyB0aW1lIHRvIGFjaGlldmUgYW5k IHdpbGwgdXN1YWxseSByZXF1aXJlIHNvbWUgb2YgdGhlIGFib3ZlLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NeSB0 aGlua2luZyBmb3IgRUFUIHdhcyB0aGF0IHlvdSBvbmx5IHB1dCBhdHRlc3RhdGlvbiBrZXlzIGlu dG8gZGV2aWNlcyB0aGF0IG1lZXQgc29tZSBjcml0ZXJpYSBsaWtlIHNvbWUgb2YgdGhlIGFib3Zl LiBTaW5jZSB0aGVyZSBpcyBvZnRlbiBubyB3YXkgdG8gcmVjb3ZlciBmcm9tIGEgY29tcHJvbWlz ZWQgYXR0ZXN0YXRpb24ga2V5IGJlY2F1c2Ugbm8ga2V5IG1vcmUgc2VjdXJlIHRoYW4gaXQsIHlv dSBraW5kDQogb2YgaGF2ZSB0byBoYXZlIGFsbCB0aGF0LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IFRoZSBpZGVhIHRoYXQgYSBkZXZpY2UgaGFzIGFuIEF0dGVz dGluZyBFbnZpcm9ubWVudChzKSBhbmQgVGFyZ2V0IEVudmlyb25tZW50KHMpIGltcGxpZXMgdGhl IEF0dGVzdGluZyBFbnZpcm9ubWVudCBpcy9zaG91bGQgYmUgbW9yZSBoYXJkZW5lZCBpcyB3aGF0 IHNvbWUgcmVmZXIgdG8gYXMgUm9vdC1vZi1UcnVzdC4gVGhlIHRlY2huaXF1ZXMNCiBmb3IgcHJv dGVjdGluZyB0aGUgQXR0ZXN0aW5nIEVudmlyb25tZW50IHNob3VsZCBiZSBpbW11dGFibGUvaW52 YXJpYW50IHdoaWNoIGlzIHdoeSBzb21lIHVzZSB0aGUgdGVybSDigJxIYXJkd2FyZSBSb290IG9m IFRydXN04oCdIHdoZW4gZGVzY3JpYmluZyBhbiBpZGVhbCBBdHRlc3RpbmcgRW52aXJvbm1lbnQu DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPlNpbmNlIHRoZXNlIGRvbuKAmXQgY2hhbmdlIG11Y2ggb3ZlciB0aW1lLCB0aGUgZW5k b3JzZW1lbnQgd291bGRu4oCZdCBjaGFuZ2UuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi Pk5tcyZndDsgVGhlIEVuZG9yc2VtZW50IGNvbnZleXMgdGhlIGltbXV0YWJpbGl0eSAvIHByb3Bl cnR5IG9mIHRpbWUgaW52YXJpYW5jZSB0byB0aGUgVmVyaWZpZXIuIEl0IGRlc2NyaWJlcyB0aGUg Um9vdCBvZiBUcnVzdCAvIEF0dGVzdGluZyBFbnYuICZuYnNwO1doZXJlIHRoZSBhdHRlc3RhdGlv biBrZXkgaXMgaGVsZCBiZWNhdXNlIGlmIHRoZSByb290DQogYXR0ZXN0YXRpb24gc3ViLXN5c3Rl bSBpcyBicm9rZW4gdGhlcmUgaXMgbm8gb3RoZXIgcHJvdGVjdGlvbiBtZWNoYW5pc20gdG8gZmFs bCBiYWNrIG9uIGZvciByZWNvdmVyeSB0aGF0IGRvZXNu4oCZdCBpbnZvbHZlIHBoeXNpY2FsIHJl bWVkaWF0aW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7VGhleSBjb3Vs ZCBldmVuIHNwYW4gc2V2ZXJhbCBtb2RlbHMgYW5kIHZhcnlpbmcgSFcuPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDsiPk5tcyZndDsgT3Igbm90LiBJdCBkZXBlbmRzIG9uIHRoZSBzeXN0ZW0g YXJjaGl0ZWN0dXJlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHU+UG9saWN5LCBLLUctViwgb3RoZXI8bzpwPjwvbzpwPjwv dT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IFBvbGljeSAoYWthIEFwcHJhaXNhbCBQ b2xpY3kgZm9yIEV2aWRlbmNlLCBBcHByYWlzYWwgUG9saWN5IGZvciBBdHRlc3RhdGlvbiBSZXN1 bHRzKSBpcyBkaWZmZXJlbnQgZnJvbSBFbmRvcnNlbWVudC4gS25vd24gR29vZCBWYWx1ZXMgYXJl IHN5bm9ueW1vdXMgd2l0aCBFbmRvcnNlbWVudC4gVGhlIGFyY2hpdGVjdHVyZSB1c2VzIG9uZQ0K IHdvcmQgdG8gY2FwdHVyZSBhIHZhcmlldHkgb2YgcG9zc2libGUgY2xhaW1zIHRoYXQgc3VwcGx5 IGNoYWluIGVudGl0aWVzIGNhbiBjb252ZXkgdG8gVmVyaWZpZXJzLiBJIGRvbuKAmXQgdGhpbmsg aXQgbWFrZXMgc2Vuc2UgdG8gY29uZmxhdGUgUG9saWN5IHdpdGggRW5kb3JzZW1lbnRzLiBJdCBt aWdodCBtYWtlIHNlbnNlIGZvciBQb2xpY3kgdG8gaGF2ZSBhbiBvcGluaW9uIGFzIHRvIHdoYXQg aXMg4oCYZ29vZOKAmS4gQnV0IGl0IGlzIGEgY2FzZSBvZg0KIGFuIE93bmVyIGRlY2lkaW5nIHZz LiB0aGUgbWFudWZhY3R1cmVyLiBJdCBpcyBhcHByb3ByaWF0ZSBmb3IgYm90aCB0byBoYXZlIHNv bWV0aGluZyB0byBzYXkgYWJvdXQgdGhlIGNsYWltLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi1yaWdo dDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNXIFZlcnNpb25zIOKAlCBBcyBs b25nIGFzIHRoZSBTVyBmb2xsb3dzIGEgZGV2ZWxvcG1lbnQgcHJvY2VzcyBsaWtlIHRoYXQgYWJv dmUsDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+aXQgZG9lc27igJl0IGhhdmUgdG8gYmUgaW5j bHVkZWQgaW4gdGhlIGVuZG9yc2VtZW50LiA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ Tm1zJmd0OyBJIGRpc2FncmVlIHdpdGggdGhpcyBjb25jbHVzaW9uLiBUaGUgdmVuZG9yIGRldGVy bWluZXMgd2hpY2ggdmVyc2lvbiBzdHJpbmcgaXMgYXBwbGllZCB0byBTVyBpdCBwcm9kdWNlcy4g VGhhdCB2YWx1ZSBpcyBhbiBhc3NlcnRpb24gb25seSB0aGUgU1cgdmVuZG9yIGNhbiBtYWtlLiBP d25lciBQb2xpY3kgY2FuIHNheSB0aGF0IHRoZQ0KIHZlcnNpb24gaXMg4oCYZ29vZOKAmSBvciDi gJhiYWTigJkgb3Ig4oCYdW5rbm93buKAmSBidXQgY2Fu4oCZdCBzYXkgdGhhdCB0aGUgdmVyc2lv biBpcyBYLiA8bzpwPg0KPC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T2YgY291cnNlIHRoZSBz bWFsbGVyIHRoZSBTVyBhbmQgdGhlIGJldHRlciB0aGUgcHJvY2VzcywgdGhlIG1vcmUgaXQgaXMg dHJ1ZSAoYW5kIHZpY2UgdmVyc2EpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5CbGFja2xpc3RzIOKAlCBUaGVzZSBtaWdodCBiZSBzcGVjaWZp YyB0byBVRUlEcywgdmVyc2lvbnMgb2YgU1csIGRlcGxveW1lbnRzIGEgcGFydGljdWxhciBPRU0g b3Igc3VjaDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IE1hbnkgZW50aXRp ZXMgY2FuIHByb2R1Y2UgYmxhY2svd2hpdGUgbGlzdHMgbGVnaXRpbWF0ZWx5LiBJZiB0aGUgZW50 aXR5IGlzIGluIHRoZSBzdXBwbHkgY2hhaW4gdGhlIGFzc2VydGlvbiBpcyBhbiBFbmRvcnNlbWVu dC4gSWYgdGhlIGVudGl0eSBpcyBhbiBPd25lciB0aGVuIHRoZSBhc3NlcnRpb24gaXMgYSBQb2xp Y3kuIFRoZSBkaWZmZXJlbmNlDQogaXMgaW4gaG93IHRoZSBWZXJpZmllciB0cmVhdHMgRW5kb3Jz ZW1lbnRzIHZzLiBQb2xpY2llcy4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ij5FeGFtcGxlOiA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBTMCkgRW5kb3JzZXIgRTAgc2F5cyBLZXkgS0Qgc3BlYWtz IGZvciBEZXZpY2UgRDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7dGV4dC1pbmRlbnQ6Ni4wcHQiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+UzEpIEF0dGVzdGVyIEtEIHNh eXMgU1cgUyBpcyBleHRhbnQgb24gRDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFMyKSBFbmRvcnNlciBFMSBzYXlzIFNX IFMgaXMgdmVyc2lvbiAxLjA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBTMykgRW5kb3JzZXIgRTIgc2F5cyB2ZXJzaW9u IDEuMCAob2YgUykgaXMgYmFkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgUzQpIE93bmVyIHBvbGljeSBzYXlzIHZlcnNp b24gMS4wIChvZiBTKSBpcyBnb29kLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgUzUpIE93bmVyIHBvbGljeSBzYXlz IEUxIGlzIHRydXN0ZWQgdG8gc2F5IFMgaXMgdmVyc2lvbiAxLjA8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBTNikgT3du ZXIgcG9saWN5IHNheXMgRTIgaXMgdHJ1c3RlZCB0byBzYXkgUyBpcyBnb29kL2JhZDxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IFM3KSBPd25lciBQb2xpY3kgc2F5cyBFMCBpcyB0cnVzdGVkIHRvIHByb3Zpc2lvbiBLRCBv biBEPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgQXBwcmFpc2FsIGV2YWx1YXRlcyB0aGUgc3RhdGVtZW50czo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 NjYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PlByb3ZlOiBYID0gU1cgaXMgZXh0YW50IG9uIGRldmljZSBEIGFuZCBpdCBpcyBnb29kLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDo2Ni4wcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+UHJvb2Y6DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6NjYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgUzMgc2F5 cyBFMiBzYXlzIHZlcnNpb24gMS4wIGlzIGJhZCAmbHQ7YW5kJmd0OyBTNiBzYXlzIEUyIGNhbiBz YXkgdGhpcyB8IHZhbGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMjVpbjt0ZXh0LWluZGVudDouMjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5TMiBzYXlzIEUxIHNheXMg UyBpcyB2ZXJzaW9uIDEuMCAmbHQ7YW5kJmd0OyBTNSBzYXlzIEUxIGNhbiBzYXkgdGhpcyB8IHZh bGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjY2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFMxIHNheXMgS0Qgc2F5 cyBTIGlzIGV4dGFudCBvbiBEICZsdDthbmQmZ3Q7IFM3IHNheXMgS0QgY2FuIHNheSB0aGlzIHwg dmFsaWQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6NjYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBTMCBzYXlz IEtEIHNwZWFrcyBmb3IgRCAmbHQ7YW5kJmd0OyBTNyBzYXlzIEUwIGNhbiBzYXkgdGhpcyB8IHZh bGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjY2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij4mbmJzcDsgVGhlcmVmb3JlIFggaXMgRkFMU0UgYXQgdGhpcyBwb2ludDsgYnV0 PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjY2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgUzQgc2F5cyB2ZXJz aW9uIDEuMCBpcyBnb29kICZsdDthbmQmZ3Q7IE93bmVyIGNhbiBzYXkgYW55dGhpbmcgfCB2YWxp ZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDo2Ni4wcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OyI+Jm5ic3A7IFRoZXJlZm9yZSBYIGlzIFRSVUU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRlYnVnIHN0YXR1cyDigJQg TW9zdCBvZiB0aGUgZGVidWcgc3RhdHVzIHZhbHVlcyBjYW4gdmFyeSBvbiBhIGRheS1kYXkgYmFz aXM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBJdCBkZXBlbmRzIG9uIHRo ZSBkZWJ1ZyBtZWNoYW5pc20uPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PRU0gbW9kZWwg4oCUIElmIHRoZSBhdHRlc3RhdGlvbiBp cyBpbXBsZW1lbnRlZCBieSBhIGNoaXAgdmVuZG9yIGFuZCB0aGUgZW5kb3JzZW1lbnQgaXMgZm9y IHRoZSBjaGlwLCB0aGVuIHRoZSBPRU0gbW9kZWwgd2lsbCB2YXJ5IHdpZGVseS48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBOb3Qgc3VyZSBob3cgdGhpcyBpcyByZWxldmFu dDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Tm9uZSBvZiB0aGVzZSBjYW4gYmUgY3JpdGVyaWEgYXMgdG8g d2hldGhlciBhbiBhdHRlc3RhdGlvbiBrZXkgaXMgcHV0IGludG8gYSBkZXZpY2Ugb3Igbm90IGFz IHRoZXkgYXJlIG5vdCBrbm93biBhdCBtYW51ZmFjdHVyaW5nIHRpbWUgYW5kL29yIG11c3QgYmUg YWxsb3dlZCB0byB2YXJ5IHdpZGVseSBhZnRlciBtYW51ZmFjdHVyaW5nLjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IERldmljZXMgY2FuIGJlIGEgbWl4IG9mIGhhcmR3YXJl IGFuZCBmaXJtd2FyZS4gRXZlbiBoYXJkd2FyZSBjYW4gYmUgbXV0YWJsZS4gRW5kb3JzZW1lbnRz IGRlc2NyaWJlIHRoZSBtdXRhYmlsaXR5IHByb3BlcnRpZXMgb2YgdGhlIGRldmljZS4gRW5kb3Jz ZW1lbnQgYWxzbyBkZXNjcmliZSB0aGUgcmFuZ2Ugb2YgcG9zc2libGUgKGFuZA0KIGFjY2VwdGFi bGUpIHZhbHVlcyB0aGUgbXV0YWJsZSBwcm9wZXJ0aWVzIGNhbiBhY2NlcHQuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgdGhp bmsgd2hhdCBJ4oCZdmUgZGVzY3JpYmVkIGFib3ZlIGxpbmVzIHVwIHByZXR0eSB3ZWxsIGZvciBh IFRQTS4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IEkgZGlzYWdyZWUu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIHN5c3RlbSBh cmNoaXRlY3R1cmUgaXMgbW9zdGx5IHNldCBieSB0aGUgVENHLiA8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+Tm1zJmd0OyBObywgdGhlIFRDRyBzcGVjaWZpZXMgaW50ZXJmYWNlcyBub3Qg aW1wbGVtZW50YXRpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SFcgVFBNcyBhcmUgYWxtb3N0IGFsd2F5cyBjZXJ0aWZpZWQuIDxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IEFuIGluZGVwZW5kZW50IGV2YWx1YXRpb24gZW50aXR5IHNw ZWNpZmllcyBob3cgYW4gaW1wbGVtZW50YXRpb24gc2NvcmVkIGFjY29yZGluZyB0byB0aGUgY3Jp dGVyaWEuIFRoZXJlIGFyZSBsb3RzIG9mIFRQTXMgdGhhdCBhcmUgbm90IGNlcnRpZmllZCBvciBh cmUgY2VydGlmaWVkIHRvIGRpZmZlcmVudCBsZXZlbHMuIFRoZSBpbXBvcnRhbnQNCiBwb2ludCBz aG91bGQgYmUgdGhhdCB0aGUgVmVyaWZpZXIgZG9lc27igJl0IGtub3cgdW5sZXNzIGl0IGFza3Mg Zm9yIEV2aWRlbmNlIGFuZCBFbmRvcnNlbWVudHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+VGhleSBhcmUgaW5kZXBlbmRlbnQgb2YgT0VNIG1vZGVsLiA8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBUaGlzIGlzbuKAmXQgdHJ1ZS4gRXZl cnkgVFBNIGhhcyBhIHZlbmRvciwgbW9kZWwvcHJvZHVjdCBuYW1lIGV0Y+KApiB0aGF0IGlzIG5v dCBjaG9zZW4gYnkgVENHLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkl0IGFsc28gbGluZXMgdXAgcmVhc29uYWJseSB3ZWxsIHdpdGggc2VjdXJlIGVsZW1lbnRz IGFuZCBjYW4gbGluZSB1cCB3aXRoIFRFReKAmXMuICZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgY3J1eCBvZiBlbmRvcnNlbWVu dCB0byBtZSBpcyB0aGUgc2VjdXJpdHkgY2hhcmFjdGVyaXN0aWNzIG9mIHRoZSBhdHRlc3RlciB0 aGF0IHByb3RlY3QgdGhlIGF0dGVzdGF0aW9uIGtleSBiZWNhdXNlIHRoZXJlIGlzIGdlbmVyYWxs eSBubyByZWNvdmVyeSBmcm9tIGEgY29tcHJvbWlzZWQgYXR0ZXN0YXRpb24ga2V5LiBJdCBzZXRz IHRoZSBiYXNlbGluZSByaXNrIG9mIHRoZSBIVyBhbmQgU1cgb2YgdGhlDQogZGV2aWNlLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IEkgYWdyZWUgdGhhdCB0aGUgQXR0ZXN0 aW5nIEVudmlyb25tZW50IGlzIHRydXN0ZWQgYnkgdGhlIFRhcmdldCBFbnZpcm9ubWVudC4gSWYg dGhlIEF0dGVzdGluZyBFbnZpcm9ubWVudCBpcyBjb21wcm9taXNlZCwgdGhlcmUgaXMgbm8gd2F5 IGZvciB0aGUgVGFyZ2V0IEVudmlyb25tZW50IHRydXN0d29ydGhpbmVzcyB0byBiZSBhc3Nlc3Nl ZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5PbiBvbmUgZXh0cmVtZSBpcyBhIHNlcGFyYXRlIGVuZG9yc2VtZW50IGZvciBldmVyeSBkZXZp Y2UgKOKAnG1pY3JvIGVuZG9yc2VtZW50JnF1b3Q7PyksIHdoaWNoIGlzIHdoYXQgSSB0aGluayBU aG9tYXMgYW5kIEFSTSBQU0EgYXJlIHRlbmRpbmcgdG93YXJkcy4gVGhlIG90aGVyIGV4dHJlbWUg aXMgb25lIGVuZG9yc2VtZW50IGZvciBhIHByb2R1Y3QgbGluZSZuYnNwOyjigJxtYWNybyBlbmRv cnNlbWVudCZxdW90Oz8pLCwgc2F5IGEgcHJvZHVjdA0KIGxpbmUgb2YgVFBNcy4gPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsgSSBkaXNhZ3JlZSB3aXRoIHRoaXMgY2hhcmFj dGVyaXphdGlvbiBvZiBUUE1zLiBFYWNoIHZlbmRvcuKAmXMgVFBNIHByb2R1Y3QgaXMgZGlmZmVy ZW50IGFuZCBoYXMgZGlmZmVyZW50IGludHJpbnNpYyB0cnVzdHdvcnRoaW5lc3MgcHJvcGVydGll cy4gTWFueSBhcmUgQ0MgZXZhbHVhdGVkIGFuZCBzb21lIGFjaGlldmUgYSBzaW1pbGFyDQogc2Nv cmUuIFRoYXQgZG9lc27igJl0IG1lYW4gdGhleSBhcmUgdGhlIHNhbWUgcHJvZHVjdC48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGVuIGl04oCZcyBtb3JlIGxp a2UgdGhlIGRhdGEgc2hlZXQgZm9yIHRoZSBwcm9kdWN0LiZuYnNwOyA8bzpwPjwvbzpwPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZW4gdGhlcmXigJlzIGRpZmZlcmVudCB3 YXlzIHRvIGZhbiB0aGlzIG91dCB0byB0aGUgZGlmZmVyZW50IGtleSAvIHNpZ25pbmcgc2NoZW1l cyAocGVyLWRldmljZSBrZXksIGdyb3VwIGtleSwgRUNEQUEsIFguNTA5KS4gRm9yIGV4YW1wbGUg YSBtYWNyby1lbmRvcnNlbWVudCBjb3VsZCBpbmNsdWRlIHRoZSByb290IG9mIGFuIFguNTA5IGhp ZXJhcmNoeSBhbmQgdGhlIGluZGl2aWR1YWwgZGV2aWNlcyAob3IgZ3JvdXBzDQogb2YgZGV2aWNl cykgd291bGQgaGF2ZSBpbmRpdmlkdWFsIGtleXMgdGhhdCBjaGFpbiB1cC4gPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsgVGhlIHJvb3Qgb2YgYSBYLjUwOSBoaWVyYXJjaHkg aXMgY2FsbGVkIGEg4oCcUm9vdCBDQeKAnS4gQSBwb2xpY3kgdGhhdCBhY2NlcHRzIGEgUm9vdCBD QSBwdWJsaWMga2V5L2NlcnQgaXMgY2FsbGVkIGEg4oCcVHJ1c3QgQW5jaG9y4oCdLiBBIHRydXN0 IGFuY2hvciBtYW5hZ2VtZW50IHByb3RvY29sIHRoYXQgY29udmV5cyBhIHRydXN0IGFuY2hvcg0K IHRvIGEgVmVyaWZpZXIgaXMgYW4gRW5kb3JzZW1lbnQgb2YgYSBSb290IENBIHRoYXQgY2hhaW5z IHRvIGFuIGF0dGVzdGF0aW9uIGtleS4gVGhlIEVuZG9yc2VtZW50IG1pZ2h0IGJlIHVzZWZ1bCBm b3IgY29uc3RydWN0aW5nIGEgcG9saWN5IHNpbWlsYXIgdG8g4oCcUzDigJ0gYWJvdmUuIChJdCBp c27igJl0IHNheWluZyBtb3JlIHRoYW4gdGhhdCBJTU8pPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5XaXRoIGEgbWljcm8tZW5kb3JzZW1lbnQgdGhlIHBlci1kZXZpY2UgcHVibGljIGtl eSBjb3VsZCBiZSBwZXIgZW5kb3JzZW1lbnQuDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+Tm1zJmd0OyBJIGRvbuKAmXQgdGhpbmsgdGhlIGFyY2hpdGVjdHVyZSBzaG91bGQgdHJ5IHRv IGRlZmluZSDigJhtaWNybyBlbmRvcnNlbWVudOKAmSBvciDigJhtYWNybyBlbmRvcnNlbWVudOKA mS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+VGhlIG1vc3QgaW1wb3J0YW50IHRoaW5nIGFib3V0IHRoZSBlbmRvcnNlbWVudCBzZWVtcyB0 byBtZSBpcyB0aGUgY2hhcmFjdGVyaXphdGlvbiBvZiBob3cgdGhlIGF0dGVzdGF0aW9uIGtleSBp cyBwcm90ZWN0ZWQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsgVGhlIGZp cnN0IGxpbmUgaW4gdGhlIEVuZG9yc2VtZW50IHNlY3Rpb24gb2YgdGhlIGFyY2hpdGVjdHVyZSBk b2N1bWVudCBzYXlzIHRoaXMgYWxtb3N0IHZlcmJhdGltLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TEw8bzpwPjwvbzpwPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KPG86cD48L286cD48 L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUu MHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBBcHIgNywgMjAyMCwgYXQgNzoz NiBBTSwgVGhvbWFzIEZvc3NhdGkgJmx0OzxhIGhyZWY9Im1haWx0bzpUaG9tYXMuRm9zc2F0aUBh cm0uY29tIj5UaG9tYXMuRm9zc2F0aUBhcm0uY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5IaSBMYXVyZW5jZSw8YnI+DQo8YnI+DQpUaGFua3MgZm9y IGJyaW5naW5nIHRoaXMgdXAuICZuYnNwO0EgZmV3IHRob3VnaHRzIGJlbG93Ljxicj4NCjxicj4N Ck9uIDAzLzA0LzIwMjAsIDIwOjM3LCAmcXVvdDtSQVRTIG9uIGJlaGFsZiBvZiBMYXVyZW5jZSBM dW5kYmxhZGUmcXVvdDs8YnI+DQombHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpyYXRzLWJvdW5j ZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVs dmV0aWNhIj5yYXRzLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6SGVsdmV0aWNhIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5vbg0KIGJlaGFsZiBvZjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFpbHRv OmxnbEBpc2xhbmQtcmVzb3J0LmNvbSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTpIZWx2ZXRpY2EiPmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvc3Bhbj48L2E+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPiZndDsgd3JvdGU6 PGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDApO2ZvbnQtdmFyaWFudC1jYXBzOiBu b3JtYWw7dGV4dC1hbGlnbjpzdGFydDstd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7d29y ZC1zcGFjaW5nOjBweCI+DQo8YnI+DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVs dmV0aWNhIj5TbyBob3cgZG9lcyBhIFZlcmlmaWVyIGZpbmQgdGhlIGFwcGxpY2FibGUgZW5kb3Jz ZW1lbnQgZm9yIEV2aWRlbmNlIGl0PGJyPg0Kd2lzaGVzIHRvIHZlcmlmeSBhbmQga25vdyB0aGF0 IGlzIHJlYWxseSB0aGUgcmlnaHQgZW5kb3JzZW1lbnQ/PGJyPg0KPGJyPg0KU2VlbXMgbGlrZSB0 aGUgRXZpZGVuY2UgbmVlZHMgc29tZSBzb3J0IG9mIGFuIGVuZG9yc2VtZW50IGxvY2F0b3IgSUQu PGJyPg0KVGhpcyBjb3VsZCBiZSBhIFVSTCBvciBhIEdVSUQuIEVBVCBjdXJyZW50bHkgaGFzIHRo ZSBvcmlnaW5hdGlvbiBjbGFpbTxicj4NCnRvIHRyeSB0byBzb2x2ZSB0aGlzLCBidXQgaXQgaXMg aGFsZi1iYWtlZC4gSXQgbmVlZHMgdG8gZ2V0IGZpeGVkLiBJ4oCZbTxicj4NCmZpc2hpbmcgZm9y IGNvbW1lbnRzIGhlcmUgb24gd2hhdCBpdCBzaG91bGQgYmUgbGlrZS48YnI+DQo8YnI+DQpQcmV0 dHkgc3VyZSB0aGUgRW5kb3JzZW1lbnQgbmVlZHMgdG8gaW5jbHVkZSBvciByZWZlcmVuY2UgdGhl IHB1YmxpYzxicj4NCmtleSB0aGF0IGlzIHVzZWQgdG8gdmVyaWZ5IHRoZSBzaWduYXR1cmUuIFdp dGhvdXQgdGhhdCwgdGhlIEF0dGVzdGVyPGJyPg0KY291bGQgbGllIGFuZCBwaWNrIGFueSBvbGQg RW5kb3JzZW1lbnQgdGhhdCBpdCB3aXNoZXMuIFRoZXJlIG5lZWRzIHRvPGJyPg0KYmUgc29tZSBi aW5kaW5nIGJldHdlZW4gaXRlbXMgaW4gdGhlIGVuZG9yc2VtZW50IChFMCwgRTEs4oCmKSBhbmQg dGhlPGJyPg0KdmVyaWZpY2F0aW9uIGtleS4gVGhhdCBjb3VsZCBiZSBpbiB0aGUgZm9ybSBvZiBh IHNpZ25lZCB0b2tlbiBvcjxicj4NCmNlcnRpZmljYXRlLCBidXQgZG9lc27igJl0IGhhdmUgdG8g YmUuIFByZXR0eSBzdXJlIHRoaXMgbmVlZHMgdG8gYmU8YnI+DQpkaXNjdXNzZWQgaW4gdGhlIGFy Y2hpdGVjdHVyZSBkb2MuPGJyPg0KPGJyPg0KVGhlcmUncyBhIGZldyBzY2VuYXJpb3M6PGJyPg0K LSBPbmUgZW5kb3JzZW1lbnQgYXBwbGllcyB0byBsb3RzIG9mIGRldmljZXMgaW4gdGhlIHNhbWUg Y2xhc3MsIGJ1dDxicj4NCiZuYnNwO2VhY2ggaGFzIHRoZWlyIG93biBhdHRlc3RhdGlvbiBrZXku PGJyPg0KLSAtIFByb2JhYmx5IEVDREFBIGZpdHMgaW4gaGVyZTxicj4NCi0gLSBPbmUgb3B0aW9u IGhlcmUgaXMgYW4gWDUwOSBoaWVyYXJjaHk8YnI+DQotIEdyb3VwIGtleXMgYXJlIHVzZWQgKGZv ciBwcml2YWN5IHJlYXNvbnMgb3Igb3RoZXIpIHNvIHRoZXJlIGlzIGE8YnI+DQombmJzcDtvbmUt b25lIGNvcnJlbGF0aW9uIHdpdGggdGhlIEVuZG9yc2VtZW50cyAodGhlIEdFSUQgZGlzY3Vzc2lv bik8YnI+DQotIEdyb3VwIGtleXMgYXJlIHVzZWQsIGJ1dCBhY3Jvc3MgZGV2aWNlcyB0aGF0IGhh dmUgZGlmZmVyZW50PGJyPg0KJm5ic3A7ZW5kb3JzZW1lbnRzIHNvIHRoZXJl4oCZcyBubyBvbmUt b25lIGNvcnJlbGF0aW9uPGJyPg0KPGJyPg0KV2hpbGUgdGhlIGxhc3Qgb25lIHNlZW1zIG9kZCBh bmQgdW5saWtlbHksIEkgdGhpbmsgaXQgY291bGQgb2NjdXIsPGJyPg0KYmVjYXVzZSBmcm9tIGEg bG90IG9mIHJlYWwgZXhwZXJpZW5jZSB0aGUgc2V0IHVwIG9mIGF0dGVzdGF0aW9uIGtleXM8YnI+ DQppcyB2ZXJ5IGlkaW9zeW5jcmF0aWMuIEl0IGlzIHdpbGRseSBhZmZlY3RlZCBieSBtYW51ZmFj dHVyaW5nIGNvc3RzPGJyPg0KYW5kIGlzc3VlcyBvbiBhc3NlbWJseSBsaW5lcywgc3ViIGNvbnRy YWN0b3Igc3RydWN0dXJlLCBsb2NhdGlvbiBvZjxicj4NCnNlY3VyZSBmYWNpbGl0aWVzIGFuZCBh cHByb2FjaGVzIHRvIG1ha2luZyBtb25leSBvbiBpdC4gVGhleSBhcmUgbGlrZTxicj4NCnNub3dm bGFrZXMsIGVhY2ggb25lIGlzIGRpZmZlcmVudC4gJm5ic3A7U28gbWF5YmUgZW5kb3JzZW1lbnQg bG9jYXRvciBJRDxicj4NCmFuZCBrZXkgSUQgYXJlIG5vdCB0aGUgc2FtZSwgYnV0IHRoZXkgY2Fu IGJlIGluIHNvbWUgdXNlIGNhc2VzPzxicj4NCjxicj4NCkkgYW0gYWxzbyB0ZW1wdGVkIHRvIGVu Y291cmFnZSB0aGUgcGxhY2VtZW50IG9mIHRoZSBlbmRvcnNlbWVudDxicj4NCmxvY2F0b3IgSUQg aW4gdGhlIENPU0Ugb3IgSk9TRSBoZWFkZXIgcGFyYW1ldGVycyBzbyB5b3UgZG9u4oCZdCBoYXZl IHRvPGJyPg0KcGFyc2UgdGhlIHVudmVyaWZpZWQgYm9keSBvZiBjbGFpbXMgdG8gYmUgYWJsZSB0 byBmaW5kIHRoZSBrZXk8YnI+DQptYXRlcmlhbCB0byB2ZXJpZnkgaXQuPGJyPg0KPGJyPg0KVGhv dWdodHM/PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRp Y2EiPjxicj4NCkEgdHdvIGxldmVsIGxvb2t1cCBrZXksIG1vZGVsJiM0MztpbnN0YW5jZSwgc2Vl bXMgdG8gYmUgcXVpdGUgZ2VuZXJhbGx5PGJyPg0KYXBwbGljYWJsZSBhcyBhbiBlbmRvcnNlbWVu dCBsb2NhdG9yLiAmbmJzcDtUaGUgbW9kZWwgcGFydCB3b3VsZCBnZXQgeW91IHRvPGJyPg0KdGhl IHNoYXJlZCBkYXRhIChlLmcuLCBjZXJ0aWZpY2F0aW9uLCBtZWFzdXJlZCBib290IEtHVnMsIGV0 Yy4pLCB3aGlsZTxicj4NCnRoZSBpbnN0YW5jZSBwYXJ0IGNhbiBiZSB1c2VkIHRvIHJldHJpZXZl IGRldmljZS1zcGVjaWZpYyBzdGF0ZTo8YnI+DQp2ZXJpZmljYXRpb24ga2V5KHMpIGFzIHdlbGwg YXMgb3RoZXIgbWV0YWRhdGEsIGUuZy4sIGlmIHNvbWUgZ2VhciBpczxicj4NCmJsYWNrbGlzdGVk LiAmbmJzcDtJbiBQU0Egd2UgaGF2ZSBzb21ldGhpbmcgcXVpdGUgKHRob3VnaCBub3QgZW50aXJl bHkpPGJyPg0Kc2ltaWxhciB3aXRoIGltcGxlbWVudGF0aW9uIGFuZCBpbnN0YW5jZSBJRHMgWzFd IFsyXS48YnI+DQo8YnI+DQooQ29udGV4dC1zd2l0Y2hpbmcgZm9yIGEgc2Vjb25kIG9uIG91ciBw cmV2aW91cyBVRUlEL0dFSUQgZGlzY3Vzc2lvbjogSTxicj4NCmd1ZXNzIHdlIG1pZ2h0IG1vZGVs IGFuIGluc3RhbmNlIGFzIGFuIGFub255bWl0eSBzZXQsIGFuZCB0aGVyZWZvcmU8YnI+DQp0cmVh dCBFVUlEcyBhcyB0aGUgc3BlY2lhbCBjYXNlIEdFSURzIHdpdGggY2FyZGluYWxpdHkgPT0gMT8p PGJyPg0KPGJyPg0KRm9yIHRoZSBzYWtlIG9mIGJ1aWxkaW5nIGEgc2hhcmVkIGFuZCByZXVzYWJs ZSB2b2NhYnVsYXJ5LCBJJ2QgcHJlZmVyPGJyPg0Ka2VlcGluZyBtb2RlbCBhbmQgaW5zdGFuY2Ug aWRlbnRpZmllcnMgYXMgc2VwYXJhdGUgY2xhaW1zIHJhdGhlciB0aGFuPGJyPg0KaGF2aW5nIGFu IG9wYXF1ZSBlbmRvcnNlbWVudCBJRCBjbGFpbSB0aGF0IGNsdW1wcyB0b2dldGhlciB0aG9zZSBh bmQ8YnI+DQpwb3NzaWJseSBvdGhlciBzdHVmZiBpbiBhIHVzZS1jYXNlIHNwZWNpZmljIGZhc2hp b24uICZuYnNwO0ZvciB0aGUgc2FtZTxicj4NCnJlYXNvbiBJIHdvdWxkIG5vdCBvdmVycmlkZSBr ZXkgSUQgd2l0aCBpbnN0YW5jZSBJRCBzZW1hbnRpY3MuPGJyPg0KPGJyPg0KY2hlZXJzLCB0aGFu a3MhPGJyPg0KPGJyPg0KWzFdPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9pZC9kcmFmdC10 c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFtZS1pbXBsZW1lbnRhdGlvbi1pZCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPmh0dHBz Oi8vd3d3LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1wc2EtdG9rZW4tMDUuaHRt bCNuYW1lLWltcGxlbWVudGF0aW9uLWlkPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJyPg0KWzJdPHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJodHRwczovL3d3 dy5pZXRmLm9yZy9pZC9kcmFmdC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFt ZS1pbnN0YW5jZS1pZCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpI ZWx2ZXRpY2EiPmh0dHBzOi8vd3d3LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1w c2EtdG9rZW4tMDUuaHRtbCNuYW1lLWluc3RhbmNlLWlkPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJyPg0KPGJyPg0KPGJyPg0K PGJyPg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFu eSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2Vk LiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRo ZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8g YW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwNCiBvciBzdG9yZSBvciBj b3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuPGJyPg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpSQVRTIG1haWxp bmcgbGlzdDxicj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86UkFUU0BpZXRmLm9yZyI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPlJBVFNAaWV0Zi5v cmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVs dmV0aWNhIj48YnI+DQo8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9yYXRzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OkhlbHZldGljYSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRzPC9z cGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_C14BDF6F520F4DB2BDC37721DB16A97Eintelcom_-- From nobody Wed Apr 8 13:06:15 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B3A03A1051 for ; Wed, 8 Apr 2020 13:06:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.916 X-Spam-Level: X-Spam-Status: No, score=-1.916 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JTWRYyhe08lU for ; Wed, 8 Apr 2020 13:06:10 -0700 (PDT) Received: from p3plsmtpa08-04.prod.phx3.secureserver.net (p3plsmtpa08-04.prod.phx3.secureserver.net [173.201.193.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EFEC3A106D for ; Wed, 8 Apr 2020 13:06:10 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id MGxdjz82iMbfPMGxdjxUPT; Wed, 08 Apr 2020 13:06:09 -0700 X-CMAE-Analysis: v=2.3 cv=ZcJjyfdA c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=QyXUC8HyAAAA:8 a=48vgC7mUAAAA:8 a=K6EGIJCdAAAA:8 a=7CQSdrXTAAAA:8 a=Z96LoGclYW6m_vtN6poA:9 a=RkZRNRull275TBc6:21 a=sXIOq_xlHKHanXTU:21 a=QEXdDO2ut3YA:10 a=y9OUIGaxdF8A:10 a=kj6DBQF8G6IA:10 a=-ePzxIPG0CYLguv9MqEA:9 a=m3ls6Gdlv0GUOTUX:21 a=I1KHfuvQbEG6ggq-:21 a=0lgNssvugJLUXZCq:21 a=_W_S_7VecoQA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=L6pVIi0Kn1GYQfi8-iRI:22 a=a-qgeE7W1pNrGK8U0ZQC:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: <0CE0C60B-79FA-43CF-A445-2EC3B5C767DE@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_FBEA95B0-381D-437F-ACF9-1DDF406E2CE5" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 8 Apr 2020 13:06:09 -0700 In-Reply-To: Cc: Thomas Fossati , "rats@ietf.org" To: "Smith, Ned" References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfPKMahmXhAjgFxFGv9iVm2OQCLVaw+mXLtZQOd6JUib7tfQklkfsSXznVYt9NEeEvvAxL3vsg0Vffn55394my696aX9E2E0O5pZeVpVzK/bd2B7bZjhg StwXbHj1Jhuj5wxZap8NpxgYqNZ1W/uHwvAMMJq+Nwi4TjueDIqZL/kwtkuwsYbyKDCQl8pclYQL5Xrld+tNB4Y8szxhzUEnmdjGKNBMwKgf7578+31eNb3H Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Apr 2020 20:06:14 -0000 --Apple-Mail=_FBEA95B0-381D-437F-ACF9-1DDF406E2CE5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Ned, Seems like there is general agreement on the core purpose of the = endorsement =E2=80=94 describing the security characteristics of the = Endorser. I=E2=80=99m not advocating any definitions in the architecture document = here. I was after some general characteristics and common understanding. = I know implementations are going to vary wildly.=20 To be more clear on =E2=80=9COEM model=E2=80=9D. I was using that to = refer to the end device like a router, a phone or a washing machine, not = the manufacturer of a chip, a TPM or a TEE. The TEE might be the = Attester and might be the same Attester with the same endorsement that = is in both a Motorola phone and a Sony phone, each with a different OEM = Model claim. When I was referring to a =E2=80=9Cproduct line of TPMs=E2=80=9D, I was = thinking of several very similar models from the same TPM vendor. Seems = like this would share the more invariant characteristics of a = Endorsement and maybe could share an Endorsement. However, I have no = strong sense that it has to be one way or the other. One of the main reasons I=E2=80=99ve dug into all this is to try to = understand how Endorsements and Verification Keys are identified in the = Evidence so we can define what is needed in EAT. That was the main = reason for distinguishing micro and macro endorsements. It is not to = have them formally defined.=20 Thomas=E2=80=99 comments where really enlightening as to how ARM PSA is = thinking of this (and how it was quite different from mine). I haven=E2=80=99t come to any conclusions yet. Would be interested to = understand how identification of a particular Key come from a particular = Endorsement which comes from fields COSE / JOSE headers and / or = contained claims for lots of different instantiations and implements of = of RATS protocols. LL > On Apr 7, 2020, at 4:11 PM, Smith, Ned wrote: >=20 > See inline nms> > =20 > From: RATS > on = behalf of Laurence Lundblade > > Date: Tuesday, April 7, 2020 at 12:12 PM > To: Thomas Fossati > > Cc: "rats@ietf.org " >, "Smith, Ned" > > Subject: Re: [Rats] Endorsement ID and verification key (was = Processing Endorsements and Evidence into Results) > =20 > This is a reply to both Thomas and Ned=E2=80=99s message on debug in = the related threat. > =20 > My inclination is to associate endorsements with time-invariant = characteristics of the device. At the moment this doesn=E2=80=99t seem = like the only way to do it, but it seems like a good way. Things that = are not time invariant are policy, k-g-v or such. > Nms> Certainly any property that is time invariant (about the device) = can be explicitly captured in Endorsements. Since they are = time-invariant it doesn=E2=80=99t make sense to Attest to them in = Evidence (they will always be the same result). I disagree that = Endorsement MUST ONLY be time invariant claims however. > Nms> Not sure if the questions below are rhetorical. > =20 > Endorsement >> System architecture =E2=80=94 Does the Attester use a TEE or a TPM or = maybe it is simple system with just a simple CPU, but it is encased in = titanium. Is defense against chip invasive attacks considered? Do keys = become inaccessible when debug is enabled. >> =20 >> Development process =E2=80=94 Is there a special security-oriented = team? Does the team have a code review policy? Is there a bug bounty? = Are the desktops and IT systems used for HW and SW development isolated? >> =20 >> Manufacturing =E2=80=94 Are the factories secured in a special way? = Is the attestation key provisioning system hardened in some way (e.g., = uses HSMs). >> =20 >> Certifications =E2=80=94 These take a long time to achieve and will = usually require some of the above. >> =20 > My thinking for EAT was that you only put attestation keys into = devices that meet some criteria like some of the above. Since there is = often no way to recover from a compromised attestation key because no = key more secure than it, you kind of have to have all that.=20 > Nms> The idea that a device has an Attesting Environment(s) and Target = Environment(s) implies the Attesting Environment is/should be more = hardened is what some refer to as Root-of-Trust. The techniques for = protecting the Attesting Environment should be immutable/invariant which = is why some use the term =E2=80=9CHardware Root of Trust=E2=80=9D when = describing an ideal Attesting Environment. > =20 > Since these don=E2=80=99t change much over time, the endorsement = wouldn=E2=80=99t change. > Nms> The Endorsement conveys the immutability / property of time = invariance to the Verifier. It describes the Root of Trust / Attesting = Env. Where the attestation key is held because if the root attestation = sub-system is broken there is no other protection mechanism to fall back = on for recovery that doesn=E2=80=99t involve physical remediation. > =20 > They could even span several models and varying HW. > Nms> Or not. It depends on the system architecture. > =20 > Policy, K-G-V, other > Nms> Policy (aka Appraisal Policy for Evidence, Appraisal Policy for = Attestation Results) is different from Endorsement. Known Good Values = are synonymous with Endorsement. The architecture uses one word to = capture a variety of possible claims that supply chain entities can = convey to Verifiers. I don=E2=80=99t think it makes sense to conflate = Policy with Endorsements. It might make sense for Policy to have an = opinion as to what is =E2=80=98good=E2=80=99. But it is a case of an = Owner deciding vs. the manufacturer. It is appropriate for both to have = something to say about the claim. >> SW Versions =E2=80=94 As long as the SW follows a development process = like that above, >> =20 >> it doesn=E2=80=99t have to be included in the endorsement.=20 >> Nms> I disagree with this conclusion. The vendor determines which = version string is applied to SW it produces. That value is an assertion = only the SW vendor can make. Owner Policy can say that the version is = =E2=80=98good=E2=80=99 or =E2=80=98bad=E2=80=99 or =E2=80=98unknown=E2=80=99= but can=E2=80=99t say that the version is X.=20 >> =20 >> Of course the smaller the SW and the better the process, the more it = is true (and vice versa). >> =20 >> Blacklists =E2=80=94 These might be specific to UEIDs, versions of = SW, deployments a particular OEM or such >> Nms> Many entities can produce black/white lists legitimately. If the = entity is in the supply chain the assertion is an Endorsement. If the = entity is an Owner then the assertion is a Policy. The difference is in = how the Verifier treats Endorsements vs. Policies.=20 >> Example:=20 >> S0) Endorser E0 says Key KD speaks for Device D >> S1) Attester KD says SW S is extant on D >> S2) Endorser E1 says SW S is version 1.0 >> S3) Endorser E2 says version 1.0 (of S) is bad >> S4) Owner policy says version 1.0 (of S) is good. >> S5) Owner policy says E1 is trusted to say S is version 1.0 >> S6) Owner policy says E2 is trusted to say S is good/bad >> S7) Owner Policy says E0 is trusted to provision KD on D >> Appraisal evaluates the statements: >> Prove: X =3D SW is extant on device D and it is good. >> Proof: >> S3 says E2 says version 1.0 is bad S6 says E2 can say = this | valid >> S2 says E1 says S is version 1.0 S5 says E1 can say this | = valid >> S1 says KD says S is extant on D S7 says KD can say this = | valid >> S0 says KD speaks for D S7 says E0 can say this | valid >> Therefore X is FALSE at this point; but >> S4 says version 1.0 is good Owner can say anything | = valid >> Therefore X is TRUE >> =20 >> Debug status =E2=80=94 Most of the debug status values can vary on a = day-day basis >> Nms> It depends on the debug mechanism. >> =20 >> OEM model =E2=80=94 If the attestation is implemented by a chip = vendor and the endorsement is for the chip, then the OEM model will vary = widely. >> Nms> Not sure how this is relevant > =20 > None of these can be criteria as to whether an attestation key is put = into a device or not as they are not known at manufacturing time and/or = must be allowed to vary widely after manufacturing. > Nms> Devices can be a mix of hardware and firmware. Even hardware can = be mutable. Endorsements describe the mutability properties of the = device. Endorsement also describe the range of possible (and acceptable) = values the mutable properties can accept. > =20 > =20 > I think what I=E2=80=99ve described above lines up pretty well for a = TPM. > Nms> I disagree. > The system architecture is mostly set by the TCG.=20 > Nms> No, the TCG specifies interfaces not implementation. > HW TPMs are almost always certified.=20 > Nms> An independent evaluation entity specifies how an implementation = scored according to the criteria. There are lots of TPMs that are not = certified or are certified to different levels. The important point = should be that the Verifier doesn=E2=80=99t know unless it asks for = Evidence and Endorsements. > They are independent of OEM model.=20 > Nms> This isn=E2=80=99t true. Every TPM has a vendor, model/product = name etc=E2=80=A6 that is not chosen by TCG. > It also lines up reasonably well with secure elements and can line up = with TEE=E2=80=99s. =20 > =20 > The crux of endorsement to me is the security characteristics of the = attester that protect the attestation key because there is generally no = recovery from a compromised attestation key. It sets the baseline risk = of the HW and SW of the device. > Nms> I agree that the Attesting Environment is trusted by the Target = Environment. If the Attesting Environment is compromised, there is no = way for the Target Environment trustworthiness to be assessed. > =20 > =20 > On one extreme is a separate endorsement for every device (=E2=80=9Cmicr= o endorsement"?), which is what I think Thomas and ARM PSA are tending = towards. The other extreme is one endorsement for a product line = (=E2=80=9Cmacro endorsement"?),, say a product line of TPMs.=20 > Nms> I disagree with this characterization of TPMs. Each vendor=E2=80=99= s TPM product is different and has different intrinsic trustworthiness = properties. Many are CC evaluated and some achieve a similar score. That = doesn=E2=80=99t mean they are the same product. > Then it=E2=80=99s more like the data sheet for the product. =20 > =20 > Then there=E2=80=99s different ways to fan this out to the different = key / signing schemes (per-device key, group key, ECDAA, X.509). For = example a macro-endorsement could include the root of an X.509 hierarchy = and the individual devices (or groups of devices) would have individual = keys that chain up.=20 > Nms> The root of a X.509 hierarchy is called a =E2=80=9CRoot CA=E2=80=9D= . A policy that accepts a Root CA public key/cert is called a =E2=80=9CTru= st Anchor=E2=80=9D. A trust anchor management protocol that conveys a = trust anchor to a Verifier is an Endorsement of a Root CA that chains to = an attestation key. The Endorsement might be useful for constructing a = policy similar to =E2=80=9CS0=E2=80=9D above. (It isn=E2=80=99t saying = more than that IMO) > =20 > With a micro-endorsement the per-device public key could be per = endorsement. > Nms> I don=E2=80=99t think the architecture should try to define = =E2=80=98micro endorsement=E2=80=99 or =E2=80=98macro endorsement=E2=80=99= . > =20 > =20 > The most important thing about the endorsement seems to me is the = characterization of how the attestation key is protected. > Nms> The first line in the Endorsement section of the architecture = document says this almost verbatim. > =20 > LL > =20 > =20 >=20 >=20 >> On Apr 7, 2020, at 7:36 AM, Thomas Fossati > wrote: >> =20 >> Hi Laurence, >>=20 >> Thanks for bringing this up. A few thoughts below. >>=20 >> On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" >> on behalf of = lgl@island-resort.com > wrote: >>=20 >>> So how does a Verifier find the applicable endorsement for Evidence = it >>> wishes to verify and know that is really the right endorsement? >>>=20 >>> Seems like the Evidence needs some sort of an endorsement locator = ID. >>> This could be a URL or a GUID. EAT currently has the origination = claim >>> to try to solve this, but it is half-baked. It needs to get fixed. = I=E2=80=99m >>> fishing for comments here on what it should be like. >>>=20 >>> Pretty sure the Endorsement needs to include or reference the public >>> key that is used to verify the signature. Without that, the Attester >>> could lie and pick any old Endorsement that it wishes. There needs = to >>> be some binding between items in the endorsement (E0, E1,=E2=80=A6) = and the >>> verification key. That could be in the form of a signed token or >>> certificate, but doesn=E2=80=99t have to be. Pretty sure this needs = to be >>> discussed in the architecture doc. >>>=20 >>> There's a few scenarios: >>> - One endorsement applies to lots of devices in the same class, but >>> each has their own attestation key. >>> - - Probably ECDAA fits in here >>> - - One option here is an X509 hierarchy >>> - Group keys are used (for privacy reasons or other) so there is a >>> one-one correlation with the Endorsements (the GEID discussion) >>> - Group keys are used, but across devices that have different >>> endorsements so there=E2=80=99s no one-one correlation >>>=20 >>> While the last one seems odd and unlikely, I think it could occur, >>> because from a lot of real experience the set up of attestation keys >>> is very idiosyncratic. It is wildly affected by manufacturing costs >>> and issues on assembly lines, sub contractor structure, location of >>> secure facilities and approaches to making money on it. They are = like >>> snowflakes, each one is different. So maybe endorsement locator ID >>> and key ID are not the same, but they can be in some use cases? >>>=20 >>> I am also tempted to encourage the placement of the endorsement >>> locator ID in the COSE or JOSE header parameters so you don=E2=80=99t = have to >>> parse the unverified body of claims to be able to find the key >>> material to verify it. >>>=20 >>> Thoughts? >>=20 >> A two level lookup key, model+instance, seems to be quite generally >> applicable as an endorsement locator. The model part would get you = to >> the shared data (e.g., certification, measured boot KGVs, etc.), = while >> the instance part can be used to retrieve device-specific state: >> verification key(s) as well as other metadata, e.g., if some gear is >> blacklisted. In PSA we have something quite (though not entirely) >> similar with implementation and instance IDs [1] [2]. >>=20 >> (Context-switching for a second on our previous UEID/GEID discussion: = I >> guess we might model an instance as an anonymity set, and therefore >> treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?) >>=20 >> For the sake of building a shared and reusable vocabulary, I'd prefer >> keeping model and instance identifiers as separate claims rather than >> having an opaque endorsement ID claim that clumps together those and >> possibly other stuff in a use-case specific fashion. For the same >> reason I would not override key ID with instance ID semantics. >>=20 >> cheers, thanks! >>=20 >> [1] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-imple= mentation-id = >> [2] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-insta= nce-id = >>=20 >>=20 >>=20 >> IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. >> _______________________________________________ >> RATS mailing list >> RATS@ietf.org >> https://www.ietf.org/mailman/listinfo/rats = > =20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_FBEA95B0-381D-437F-ACF9-1DDF406E2CE5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Ned,

Seems like = there is general agreement on the core purpose of the endorsement =E2=80=94= describing the security characteristics of the Endorser.

I=E2=80=99m not = advocating any definitions in the architecture document here. I was = after some general characteristics and common understanding. I know = implementations are going to vary wildly. 

To be more clear on =E2=80=9COEM = model=E2=80=9D. I was using that to refer to the end device like a = router, a phone or a washing machine, not the manufacturer of a chip, a = TPM or a TEE.  The TEE might be the Attester and might be the same = Attester with the same endorsement that is in both a Motorola phone and = a Sony phone, each with a different OEM Model claim.

When I was referring to = a =E2=80=9Cproduct line of TPMs=E2=80=9D, I was thinking of several very = similar models from the same TPM vendor. Seems like this would share the = more invariant characteristics of a Endorsement and maybe could share an = Endorsement. However, I have no strong sense that it has to be one way = or the other.


One of the main reasons = I=E2=80=99ve dug into all this is to try to understand how Endorsements = and Verification Keys are identified in the Evidence so we can define = what is needed in EAT. That was the main reason for distinguishing micro = and macro endorsements. It is not to have them formally = defined. 

Thomas=E2=80=99 comments where really enlightening as to how = ARM PSA is thinking of this (and how it was quite different from = mine).

I = haven=E2=80=99t come to any conclusions yet. Would be interested to = understand how identification of a particular Key come from a particular = Endorsement which comes from fields COSE / JOSE headers and / or = contained claims for lots of different instantiations and implements of = of RATS protocols.

LL



On Apr 7, 2020, at 4:11 PM, Smith, Ned <ned.smith@intel.com>= wrote:

See inline = nms>
 
From: RATS <rats-bounces@ietf.org> on = behalf of Laurence Lundblade <lgl@island-resort.com>
Date: Tuesday, April 7, 2020 = at 12:12 PM
To: Thomas Fossati <Thomas.Fossati@arm.com>
Cc: "rats@ietf.org" <rats@ietf.org>, "Smith, Ned" <ned.smith@intel.com>
Subject: Re: [Rats] Endorsement = ID and verification key (was Processing Endorsements and Evidence into = Results)
 
This is a reply to both Thomas and Ned=E2=80=99s message on = debug in the related threat.
 
My inclination is to associate endorsements with = time-invariant characteristics of the device. At the moment this = doesn=E2=80=99t seem like the only way to do it, but it seems like a = good way. Things that are not time invariant are policy, k-g-v or = such.
Nms> = Certainly any property that is time invariant (about the device) can be = explicitly captured in Endorsements. Since they are time-invariant it = doesn=E2=80=99t make sense to Attest to them in Evidence (they will = always be the same result). I disagree that Endorsement MUST ONLY be = time invariant claims however.
Nms> Not sure if the questions = below are rhetorical.
 
Endorsement
System architecture =E2=80=94 Does the = Attester use a TEE or a TPM or maybe it is simple system with just a = simple CPU, but it is encased in titanium. Is defense against chip = invasive attacks considered? Do keys become inaccessible when debug is = enabled.
 
Development process =E2=80=94 Is there a special = security-oriented team? Does the team have a code review policy? Is = there a bug bounty? Are the desktops and IT systems used for HW and SW = development isolated?
 
Manufacturing =E2=80=94 Are the factories secured in a = special way? Is the attestation key provisioning system hardened in some = way (e.g., uses HSMs).
 
Certifications =E2=80=94 These take a long time to achieve = and will usually require some of the above.
 
My thinking for EAT was = that you only put attestation keys into devices that meet some criteria = like some of the above. Since there is often no way to recover from a = compromised attestation key because no key more secure than it, you kind = of have to have all that. 
Nms> The idea that a device has = an Attesting Environment(s) and Target Environment(s) implies the = Attesting Environment is/should be more hardened is what some refer to = as Root-of-Trust. The techniques for protecting the Attesting = Environment should be immutable/invariant which is why some use the term = =E2=80=9CHardware Root of Trust=E2=80=9D when describing an ideal = Attesting Environment.
 
Since these don=E2=80=99t change much over time, the = endorsement wouldn=E2=80=99t change.
Nms> The Endorsement conveys the = immutability / property of time invariance to the Verifier. It describes = the Root of Trust / Attesting Env.  Where the attestation key is = held because if the root attestation sub-system is broken there is no = other protection mechanism to fall back on for recovery that doesn=E2=80=99= t involve physical remediation.
 
 They could even span several models and varying HW.
Nms> Or = not. It depends on the system architecture.
 
Policy, = K-G-V, other
Nms> Policy (aka Appraisal Policy for Evidence, Appraisal = Policy for Attestation Results) is different from Endorsement. Known = Good Values are synonymous with Endorsement. The architecture uses one = word to capture a variety of possible claims that supply chain entities = can convey to Verifiers. I don=E2=80=99t think it makes sense to = conflate Policy with Endorsements. It might make sense for Policy to = have an opinion as to what is =E2=80=98good=E2=80=99. But it is a case = of an Owner deciding vs. the manufacturer. It is appropriate for both to = have something to say about the claim.
SW Versions =E2=80=94 As long as the SW = follows a development process like that above,
 
it doesn=E2=80=99t have to be included in the = endorsement. 
Nms> I = disagree with this conclusion. The vendor determines which version = string is applied to SW it produces. That value is an assertion only the = SW vendor can make. Owner Policy can say that the version is =E2=80=98good= =E2=80=99 or =E2=80=98bad=E2=80=99 or =E2=80=98unknown=E2=80=99 but = can=E2=80=99t say that the version is X. 
 
Of course the smaller the SW and the better the process, the = more it is true (and vice versa).
 
Blacklists =E2=80=94 These might be specific to UEIDs, = versions of SW, deployments a particular OEM or such
Nms> Many = entities can produce black/white lists legitimately. If the entity is in = the supply chain the assertion is an Endorsement. If the entity is an = Owner then the assertion is a Policy. The difference is in how the = Verifier treats Endorsements vs. Policies. 
Example: 
      S0) Endorser E0 says Key KD = speaks for Device D
S1) Attester = KD says SW S is extant on D
      S2) = Endorser E1 says SW S is version 1.0
      S3) Endorser E2 says version = 1.0 (of S) is bad
      S4) Owner policy says version = 1.0 (of S) is good.
      S5) = Owner policy says E1 is trusted to say S is version 1.0
      S6) Owner policy says E2 is = trusted to say S is good/bad
      S7) = Owner Policy says E0 is trusted to provision KD on D
      Appraisal evaluates the = statements:
Prove: X =3D SW is extant on device D and it is good.
Proof:
  =      S3 says E2 says version 1.0 is bad <and> = S6 says E2 can say this | valid
S2 says E1 = says S is version 1.0 <and> S5 says E1 can say this | valid
  =      S1 says KD says S is extant on D <and> S7 = says KD can say this | valid
       = S0 says KD speaks for D <and> S7 says E0 can say this | valid
  = Therefore X is FALSE at this point; but
       S4 says version 1.0 is = good <and> Owner can say anything | valid
  = Therefore X is TRUE
 
Debug status =E2=80=94 Most of the debug status values can = vary on a day-day basis
Nms> It depends on the debug mechanism.
 
OEM model =E2=80=94 If the attestation = is implemented by a chip vendor and the endorsement is for the chip, = then the OEM model will vary widely.
Nms> Not sure how this is = relevant
 
None of these can be criteria as to whether an attestation = key is put into a device or not as they are not known at manufacturing = time and/or must be allowed to vary widely after manufacturing.
Nms> = Devices can be a mix of hardware and firmware. Even hardware can be = mutable. Endorsements describe the mutability properties of the device. = Endorsement also describe the range of possible (and acceptable) values = the mutable properties can accept.
 
 
I think what I=E2=80=99ve described above lines up pretty = well for a TPM.
Nms> I disagree.
The system architecture is mostly set = by the TCG. 
Nms> No, = the TCG specifies interfaces not implementation.
HW TPMs = are almost always certified. 
Nms> An = independent evaluation entity specifies how an implementation scored = according to the criteria. There are lots of TPMs that are not certified = or are certified to different levels. The important point should be that = the Verifier doesn=E2=80=99t know unless it asks for Evidence and = Endorsements.
They are independent of OEM model. 
Nms> This = isn=E2=80=99t true. Every TPM has a vendor, model/product name etc=E2=80=A6= that is not chosen by TCG.
It also lines up reasonably well with = secure elements and can line up with TEE=E2=80=99s.  
 
The crux of endorsement to me is the = security characteristics of the attester that protect the attestation = key because there is generally no recovery from a compromised = attestation key. It sets the baseline risk of the HW and SW of the = device.
Nms> I agree that the Attesting Environment is trusted by = the Target Environment. If the Attesting Environment is compromised, = there is no way for the Target Environment trustworthiness to be = assessed.
 
 
On one extreme is a separate endorsement for every device = (=E2=80=9Cmicro endorsement"?), which is what I think Thomas and ARM PSA = are tending towards. The other extreme is one endorsement for a product = line (=E2=80=9Cmacro endorsement"?),, say a product line of = TPMs. 
Nms> I = disagree with this characterization of TPMs. Each vendor=E2=80=99s TPM = product is different and has different intrinsic trustworthiness = properties. Many are CC evaluated and some achieve a similar score. That = doesn=E2=80=99t mean they are the same product.
Then = it=E2=80=99s more like the data sheet for the product.  
 
Then there=E2=80=99s different ways to = fan this out to the different key / signing schemes (per-device key, = group key, ECDAA, X.509). For example a macro-endorsement could include = the root of an X.509 hierarchy and the individual devices (or groups of = devices) would have individual keys that chain up. 
Nms> The = root of a X.509 hierarchy is called a =E2=80=9CRoot CA=E2=80=9D. A = policy that accepts a Root CA public key/cert is called a =E2=80=9CTrust = Anchor=E2=80=9D. A trust anchor management protocol that conveys a trust = anchor to a Verifier is an Endorsement of a Root CA that chains to an = attestation key. The Endorsement might be useful for constructing a = policy similar to =E2=80=9CS0=E2=80=9D above. (It isn=E2=80=99t saying = more than that IMO)
 
With a micro-endorsement the per-device public key could be = per endorsement.
Nms> I don=E2=80=99t think the architecture should try to = define =E2=80=98micro endorsement=E2=80=99 or =E2=80=98macro = endorsement=E2=80=99.
 
 
The most important thing about the = endorsement seems to me is the characterization of how the attestation = key is protected.
Nms> The first line in the Endorsement section of the = architecture document says this almost verbatim.
 
LL
 
 


On Apr 7, 2020, at 7:36 AM, Thomas = Fossati <Thomas.Fossati@arm.com> wrote:
 
Hi Laurence,

Thanks for bringing = this up.  A few thoughts below.

On = 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade"
<rats-bounces@ietf.org on behalf = of lgl@island-resort.com> = wrote:

So how does a Verifier find the = applicable endorsement for Evidence it
wishes to verify = and know that is really the right endorsement?

Seems like the Evidence needs some sort of an endorsement = locator ID.
This could be a URL or a GUID. EAT currently = has the origination claim
to try to solve this, but it is = half-baked. It needs to get fixed. I=E2=80=99m
fishing for = comments here on what it should be like.

Pretty sure the Endorsement needs to include or reference the = public
key that is used to verify the signature. Without = that, the Attester
could lie and pick any old Endorsement = that it wishes. There needs to
be some binding between = items in the endorsement (E0, E1,=E2=80=A6) and the
verification key. That could be in the form of a signed token = or
certificate, but doesn=E2=80=99t have to be. Pretty = sure this needs to be
discussed in the architecture = doc.

There's a few scenarios:
-= One endorsement applies to lots of devices in the same class, but
 each has their own attestation key.
- - = Probably ECDAA fits in here
- - One option here is an X509 = hierarchy
- Group keys are used (for privacy reasons or = other) so there is a
 one-one correlation with the = Endorsements (the GEID discussion)
- Group keys are used, = but across devices that have different
 endorsements = so there=E2=80=99s no one-one correlation

While the last one seems odd and unlikely, I think it could = occur,
because from a lot of real experience the set up of = attestation keys
is very idiosyncratic. It is wildly = affected by manufacturing costs
and issues on assembly = lines, sub contractor structure, location of
secure = facilities and approaches to making money on it. They are like
snowflakes, each one is different.  So maybe endorsement = locator ID
and key ID are not the same, but they can be in = some use cases?

I am also tempted to = encourage the placement of the endorsement
locator ID in = the COSE or JOSE header parameters so you don=E2=80=99t have to
parse the unverified body of claims to be able to find the = key
material to verify it.

Thoughts?

A two level lookup = key, model+instance, seems to be quite generally
applicable = as an endorsement locator.  The model part would get you to
the shared data (e.g., certification, measured boot KGVs, = etc.), while
the instance part can be used to retrieve = device-specific state:
verification key(s) as well as = other metadata, e.g., if some gear is
blacklisted. =  In PSA we have something quite (though not entirely)
similar with implementation and instance IDs [1] [2].

(Context-switching for a second on our = previous UEID/GEID discussion: I
guess we might model an = instance as an anonymity set, and therefore
treat EUIDs as = the special case GEIDs with cardinality =3D=3D 1?)

For the sake of building a shared and reusable vocabulary, = I'd prefer
keeping model and instance identifiers as = separate claims rather than
having an opaque endorsement = ID claim that clumps together those and
possibly other = stuff in a use-case specific fashion.  For the same
reason I would not override key ID with instance ID = semantics.

cheers, thanks!

[1] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-implementation-id
[2] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-instance-id



IMPORTANT NOTICE: The contents of this email and any = attachments are confidential and may also be privileged. If you are not = the intended recipient, please notify the sender immediately and do not = disclose the contents to any other person, use it for any purpose, or = store or copy the information in any medium. Thank you.
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats
 
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_FBEA95B0-381D-437F-ACF9-1DDF406E2CE5-- From nobody Thu Apr 9 02:46:33 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B21D3A102C for ; Thu, 9 Apr 2020 02:46:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zkTn9yWFu_DJ for ; Thu, 9 Apr 2020 02:46:27 -0700 (PDT) Received: from mail-edgeS23.fraunhofer.de (mail-edges23.fraunhofer.de [153.97.7.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A059C3A1026 for ; Thu, 9 Apr 2020 02:46:24 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2ERBgDn7Y5e/xoBYJlmGwEBAQEBAQE?= =?us-ascii?q?FAQEBEQEBAwMBAQGBe4F9LGwDVS8qCoQSjwKBZAglgQGYYYFbDAoBAQEBAQE?= =?us-ascii?q?BAQEGAQEYDQgCBAEBAoRCAoIMJDgTAhABAQYBAQEBAQUEAgJphVYMg1N+AQE?= =?us-ascii?q?BAQEBAQEBAQEBAQEBAQEBARYCQ1USAQEdAQEBAQIBAQEhDwEFNgIJEAkCDgM?= =?us-ascii?q?BAgECAQICHwQDAgInHwECBggGDQEFAgEBgyIBglwfBQuUI5sEdYEyhU6Da4E?= =?us-ascii?q?6BoEOKopfgUUPD4FMP4ERJwwDgiUHLj6CZwEBAoEuARIBTYJmgl4EjXIyFwW?= =?us-ascii?q?CS4YrmQ17B4FKeH0EkRqFGyOCUDOIDoQ1BYxLjAOBPIIHnDcCBAIJAhWBaSN?= =?us-ascii?q?ncE0kT4JpUBgNkS4XFW8BAoddhUNyAoEnjQ8BgQ8BAQ?= X-IPAS-Result: =?us-ascii?q?A2ERBgDn7Y5e/xoBYJlmGwEBAQEBAQEFAQEBEQEBAwMBA?= =?us-ascii?q?QGBe4F9LGwDVS8qCoQSjwKBZAglgQGYYYFbDAoBAQEBAQEBAQEGAQEYDQgCB?= =?us-ascii?q?AEBAoRCAoIMJDgTAhABAQYBAQEBAQUEAgJphVYMg1N+AQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBARYCQ1USAQEdAQEBAQIBAQEhDwEFNgIJEAkCDgMBAgECAQICHwQDA?= =?us-ascii?q?gInHwECBggGDQEFAgEBgyIBglwfBQuUI5sEdYEyhU6Da4E6BoEOKopfgUUPD?= =?us-ascii?q?4FMP4ERJwwDgiUHLj6CZwEBAoEuARIBTYJmgl4EjXIyFwWCS4YrmQ17B4FKe?= =?us-ascii?q?H0EkRqFGyOCUDOIDoQ1BYxLjAOBPIIHnDcCBAIJAhWBaSNncE0kT4JpUBgNk?= =?us-ascii?q?S4XFW8BAoddhUNyAoEnjQ8BgQ8BAQ?= X-IronPort-AV: E=Sophos;i="5.72,362,1580770800"; d="scan'208";a="17156522" Received: from mail-mtaka26.fraunhofer.de ([153.96.1.26]) by mail-edgeS23.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Apr 2020 11:46:21 +0200 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AqAQBt7o5e/1lIDI1mGgEBAQEBAQE?= =?us-ascii?q?BAQMBAQEBEQEBAQICAQEBAYF7gX0sbANUMCoKhBKPAoFkCCWBAZhhgWcKAQM?= =?us-ascii?q?BAQEBAQYBARgNCAIEAQGERAKCCyQ4EwIQAQEFAQEBAgEFBG2FVgyFcAEBAQE?= =?us-ascii?q?CAQEBIQ8BBTYCCRAJAg4DAQIBAgECAh8EAwICJx8BAgYIBg0BBQIBAYMiAYJ?= =?us-ascii?q?cJAuUJJsEdYEyhU6DbYE6BoEOKopfgUUPD4FMP4ERJwwDgiUHLj6CZwEBAoE?= =?us-ascii?q?uARIBTYJmgl4EjXIyFwWCS4YrmQ17B4FKeH0EkRqFGyOCUDOIDoQ1BYxLjAO?= =?us-ascii?q?BPIIHnDcCBAIJAhWBaSJncE0kT4JpUBgNkS4XFW8BAoddhUNBMQKBJ40PAYE?= =?us-ascii?q?PAQE?= X-IronPort-AV: E=Sophos;i="5.72,362,1580770800"; d="scan'208";a="79959436" Received: from mailext.sit.fraunhofer.de ([141.12.72.89]) by mail-mtaKA26.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Apr 2020 11:46:14 +0200 Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 0399kD4h004937 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Thu, 9 Apr 2020 11:46:13 +0200 Received: from [192.168.16.50] (79.234.123.239) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Thu, 9 Apr 2020 11:46:08 +0200 To: Laurence Lundblade , "Smith, Ned" CC: "rats@ietf.org" , Thomas Fossati References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> <0CE0C60B-79FA-43CF-A445-2EC3B5C767DE@island-resort.com> From: Henk Birkholz Message-ID: <124577c9-4398-788d-1ab3-f1864fd708a8@sit.fraunhofer.de> Date: Thu, 9 Apr 2020 11:46:06 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: <0CE0C60B-79FA-43CF-A445-2EC3B5C767DE@island-resort.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [79.234.123.239] Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Apr 2020 09:46:32 -0000 Hi Laurence, did you really mean "describing the security characteristics of the Endorser" or instead "describing the security characteristics of the Attester by an Endorser"? Viele Grüße, Henk On 08.04.20 22:06, Laurence Lundblade wrote: > Hi Ned, > > Seems like there is general agreement on the core purpose of the > endorsement — describing the security characteristics of the Endorser. > > I’m not advocating any definitions in the architecture document here. I > was after some general characteristics and common understanding. I know > implementations are going to vary wildly. > > To be more clear on “OEM modelâ€. I was using that to refer to the end > device like a router, a phone or a washing machine, not the manufacturer > of a chip, a TPM or a TEE.  The TEE might be the Attester and might be > the same Attester with the same endorsement that is in both a Motorola > phone and a Sony phone, each with a different OEM Model claim. > > When I was referring to a “product line of TPMsâ€, I was thinking of > several very similar models from the same TPM vendor. Seems like this > would share the more invariant characteristics of a Endorsement and > maybe could share an Endorsement. However, I have no strong sense that > it has to be one way or the other. > > > One of the main reasons I’ve dug into all this is to try to understand > how Endorsements and Verification Keys are identified in the Evidence so > we can define what is needed in EAT. That was the main reason for > distinguishing micro and macro endorsements. It is not to have them > formally defined. > > Thomas’ comments where really enlightening as to how ARM PSA is thinking > of this (and how it was quite different from mine). > > I haven’t come to any conclusions yet. Would be interested to understand > how identification of a particular Key come from a particular > Endorsement which comes from fields COSE / JOSE headers and / or > contained claims for lots of different instantiations and implements of > of RATS protocols. > > LL > > > >> On Apr 7, 2020, at 4:11 PM, Smith, Ned > > wrote: >> >> See inline nms> >> *From:*RATS > on >> behalf of Laurence Lundblade > > >> *Date:*Tuesday, April 7, 2020 at 12:12 PM >> *To:*Thomas Fossati > > >> *Cc:*"rats@ietf.org " > >, "Smith, Ned" > > >> *Subject:*Re: [Rats] Endorsement ID and verification key (was >> Processing Endorsements and Evidence into Results) >> This is a reply to both Thomas and Ned’s message on debug in the >> related threat. >> My inclination is to associate endorsements with time-invariant >> characteristics of the device. At the moment this doesn’t seem like >> the only way to do it, but it seems like a good way. Things that are >> not time invariant are policy, k-g-v or such. >> Nms> Certainly any property that is time invariant (about the device) >> can be explicitly captured in Endorsements. Since they are >> time-invariant it doesn’t make sense to Attest to them in Evidence >> (they will always be the same result). I disagree that Endorsement >> MUST ONLY be time invariant claims however. >> Nms> Not sure if the questions below are rhetorical. >> *_Endorsement_* >>> System architecture — Does the Attester use a TEE or a TPM or maybe >>> it is simple system with just a simple CPU, but it is encased in >>> titanium. Is defense against chip invasive attacks considered? Do >>> keys become inaccessible when debug is enabled. >>> Development process — Is there a special security-oriented team? Does >>> the team have a code review policy? Is there a bug bounty? Are the >>> desktops and IT systems used for HW and SW development isolated? >>> Manufacturing — Are the factories secured in a special way? Is the >>> attestation key provisioning system hardened in some way (e.g., uses >>> HSMs). >>> Certifications — These take a long time to achieve and will usually >>> require some of the above. >> My thinking for EAT was that you only put attestation keys into >> devices that meet some criteria like some of the above. Since there is >> often no way to recover from a compromised attestation key because no >> key more secure than it, you kind of have to have all that. >> Nms> The idea that a device has an Attesting Environment(s) and Target >> Environment(s) implies the Attesting Environment is/should be more >> hardened is what some refer to as Root-of-Trust. The techniques for >> protecting the Attesting Environment should be immutable/invariant >> which is why some use the term “Hardware Root of Trust†when >> describing an ideal Attesting Environment. >> Since these don’t change much over time, the endorsement wouldn’t change. >> Nms> The Endorsement conveys the immutability / property of time >> invariance to the Verifier. It describes the Root of Trust / Attesting >> Env.  Where the attestation key is held because if the root >> attestation sub-system is broken there is no other protection >> mechanism to fall back on for recovery that doesn’t involve physical >> remediation. >>  They could even span several models and varying HW. >> Nms> Or not. It depends on the system architecture. >> *_Policy, K-G-V, other_* >> Nms> Policy (aka Appraisal Policy for Evidence, Appraisal Policy for >> Attestation Results) is different from Endorsement. Known Good Values >> are synonymous with Endorsement. The architecture uses one word to >> capture a variety of possible claims that supply chain entities can >> convey to Verifiers. I don’t think it makes sense to conflate Policy >> with Endorsements. It might make sense for Policy to have an opinion >> as to what is ‘good’. But it is a case of an Owner deciding vs. the >> manufacturer. It is appropriate for both to have something to say >> about the claim. >>> SW Versions — As long as the SW follows a development process like >>> that above, >>> it doesn’t have to be included in the endorsement. >>> Nms> I disagree with this conclusion. The vendor determines which >>> version string is applied to SW it produces. That value is an >>> assertion only the SW vendor can make. Owner Policy can say that the >>> version is ‘good’ or ‘bad’ or ‘unknown’ but can’t say that the >>> version is X. >>> Of course the smaller the SW and the better the process, the more it >>> is true (and vice versa). >>> Blacklists — These might be specific to UEIDs, versions of SW, >>> deployments a particular OEM or such >>> Nms> Many entities can produce black/white lists legitimately. If the >>> entity is in the supply chain the assertion is an Endorsement. If the >>> entity is an Owner then the assertion is a Policy. The difference is >>> in how the Verifier treats Endorsements vs. Policies. >>> Example: >>>       S0) Endorser E0 says Key KD speaks for Device D >>> S1) Attester KD says SW S is extant on D >>>       S2) Endorser E1 says SW S is version 1.0 >>>       S3) Endorser E2 says version 1.0 (of S) is bad >>>       S4) Owner policy says version 1.0 (of S) is good. >>>       S5) Owner policy says E1 is trusted to say S is version 1.0 >>>       S6) Owner policy says E2 is trusted to say S is good/bad >>>       S7) Owner Policy says E0 is trusted to provision KD on D >>>       Appraisal evaluates the statements: >>> Prove: X = SW is extant on device D and it is good. >>> Proof: >>>        S3 says E2 says version 1.0 is bad S6 says E2 can say >>> this | valid >>> S2 says E1 says S is version 1.0 S5 says E1 can say this | valid >>>        S1 says KD says S is extant on D S7 says KD can say this >>> | valid >>>        S0 says KD speaks for D S7 says E0 can say this | valid >>>   Therefore X is FALSE at this point; but >>>        S4 says version 1.0 is good Owner can say anything | valid >>>   Therefore X is TRUE >>> Debug status — Most of the debug status values can vary on a day-day >>> basis >>> Nms> It depends on the debug mechanism. >>> OEM model — If the attestation is implemented by a chip vendor and >>> the endorsement is for the chip, then the OEM model will vary widely. >>> Nms> Not sure how this is relevant >> None of these can be criteria as to whether an attestation key is put >> into a device or not as they are not known at manufacturing time >> and/or must be allowed to vary widely after manufacturing. >> Nms> Devices can be a mix of hardware and firmware. Even hardware can >> be mutable. Endorsements describe the mutability properties of the >> device. Endorsement also describe the range of possible (and >> acceptable) values the mutable properties can accept. >> I think what I’ve described above lines up pretty well for a TPM. >> Nms> I disagree. >> The system architecture is mostly set by the TCG. >> Nms> No, the TCG specifies interfaces not implementation. >> HW TPMs are almost always certified. >> Nms> An independent evaluation entity specifies how an implementation >> scored according to the criteria. There are lots of TPMs that are not >> certified or are certified to different levels. The important point >> should be that the Verifier doesn’t know unless it asks for Evidence >> and Endorsements. >> They are independent of OEM model. >> Nms> This isn’t true. Every TPM has a vendor, model/product name etc… >> that is not chosen by TCG. >> It also lines up reasonably well with secure elements and can line up >> with TEE’s. >> The crux of endorsement to me is the security characteristics of the >> attester that protect the attestation key because there is generally >> no recovery from a compromised attestation key. It sets the baseline >> risk of the HW and SW of the device. >> Nms> I agree that the Attesting Environment is trusted by the Target >> Environment. If the Attesting Environment is compromised, there is no >> way for the Target Environment trustworthiness to be assessed. >> On one extreme is a separate endorsement for every device (“micro >> endorsement"?), which is what I think Thomas and ARM PSA are tending >> towards. The other extreme is one endorsement for a product >> line (“macro endorsement"?),, say a product line of TPMs. >> Nms> I disagree with this characterization of TPMs. Each vendor’s TPM >> product is different and has different intrinsic trustworthiness >> properties. Many are CC evaluated and some achieve a similar score. >> That doesn’t mean they are the same product. >> Then it’s more like the data sheet for the product. >> Then there’s different ways to fan this out to the different key / >> signing schemes (per-device key, group key, ECDAA, X.509). For example >> a macro-endorsement could include the root of an X.509 hierarchy and >> the individual devices (or groups of devices) would have individual >> keys that chain up. >> Nms> The root of a X.509 hierarchy is called a “Root CAâ€. A policy >> that accepts a Root CA public key/cert is called a “Trust Anchorâ€. A >> trust anchor management protocol that conveys a trust anchor to a >> Verifier is an Endorsement of a Root CA that chains to an attestation >> key. The Endorsement might be useful for constructing a policy similar >> to “S0†above. (It isn’t saying more than that IMO) >> With a micro-endorsement the per-device public key could be per >> endorsement. >> Nms> I don’t think the architecture should try to define ‘micro >> endorsement’ or ‘macro endorsement’. >> The most important thing about the endorsement seems to me is the >> characterization of how the attestation key is protected. >> Nms> The first line in the Endorsement section of the architecture >> document says this almost verbatim. >> LL >> >> >>> On Apr 7, 2020, at 7:36 AM, Thomas Fossati >> > wrote: >>> Hi Laurence, >>> >>> Thanks for bringing this up.  A few thoughts below. >>> >>> On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" >>> on behalf >>> oflgl@island-resort.com > wrote: >>> >>>> So how does a Verifier find the applicable endorsement for Evidence it >>>> wishes to verify and know that is really the right endorsement? >>>> >>>> Seems like the Evidence needs some sort of an endorsement locator ID. >>>> This could be a URL or a GUID. EAT currently has the origination claim >>>> to try to solve this, but it is half-baked. It needs to get fixed. I’m >>>> fishing for comments here on what it should be like. >>>> >>>> Pretty sure the Endorsement needs to include or reference the public >>>> key that is used to verify the signature. Without that, the Attester >>>> could lie and pick any old Endorsement that it wishes. There needs to >>>> be some binding between items in the endorsement (E0, E1,…) and the >>>> verification key. That could be in the form of a signed token or >>>> certificate, but doesn’t have to be. Pretty sure this needs to be >>>> discussed in the architecture doc. >>>> >>>> There's a few scenarios: >>>> - One endorsement applies to lots of devices in the same class, but >>>>  each has their own attestation key. >>>> - - Probably ECDAA fits in here >>>> - - One option here is an X509 hierarchy >>>> - Group keys are used (for privacy reasons or other) so there is a >>>>  one-one correlation with the Endorsements (the GEID discussion) >>>> - Group keys are used, but across devices that have different >>>>  endorsements so there’s no one-one correlation >>>> >>>> While the last one seems odd and unlikely, I think it could occur, >>>> because from a lot of real experience the set up of attestation keys >>>> is very idiosyncratic. It is wildly affected by manufacturing costs >>>> and issues on assembly lines, sub contractor structure, location of >>>> secure facilities and approaches to making money on it. They are like >>>> snowflakes, each one is different.  So maybe endorsement locator ID >>>> and key ID are not the same, but they can be in some use cases? >>>> >>>> I am also tempted to encourage the placement of the endorsement >>>> locator ID in the COSE or JOSE header parameters so you don’t have to >>>> parse the unverified body of claims to be able to find the key >>>> material to verify it. >>>> >>>> Thoughts? >>> >>> A two level lookup key, model+instance, seems to be quite generally >>> applicable as an endorsement locator.  The model part would get you to >>> the shared data (e.g., certification, measured boot KGVs, etc.), while >>> the instance part can be used to retrieve device-specific state: >>> verification key(s) as well as other metadata, e.g., if some gear is >>> blacklisted.  In PSA we have something quite (though not entirely) >>> similar with implementation and instance IDs [1] [2]. >>> >>> (Context-switching for a second on our previous UEID/GEID discussion: I >>> guess we might model an instance as an anonymity set, and therefore >>> treat EUIDs as the special case GEIDs with cardinality == 1?) >>> >>> For the sake of building a shared and reusable vocabulary, I'd prefer >>> keeping model and instance identifiers as separate claims rather than >>> having an opaque endorsement ID claim that clumps together those and >>> possibly other stuff in a use-case specific fashion.  For the same >>> reason I would not override key ID with instance ID semantics. >>> >>> cheers, thanks! >>> >>> [1]https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-implementation-id >>> [2]https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-instance-id >>> >>> >>> >>> IMPORTANT NOTICE: The contents of this email and any attachments are >>> confidential and may also be privileged. If you are not the intended >>> recipient, please notify the sender immediately and do not disclose >>> the contents to any other person, use it for any purpose, or store or >>> copy the information in any medium. Thank you. >>> _______________________________________________ >>> RATS mailing list >>> RATS@ietf.org >>> https://www.ietf.org/mailman/listinfo/rats >> _______________________________________________ >> RATS mailing list >> RATS@ietf.org >> https://www.ietf.org/mailman/listinfo/rats > > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > From nobody Thu Apr 9 04:54:27 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E28F13A0943 for ; Thu, 9 Apr 2020 04:54:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=0abEIzQL; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=0abEIzQL Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QEu8dUUASXm4 for ; Thu, 9 Apr 2020 04:54:24 -0700 (PDT) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-ve1eur02on062b.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe06::62b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C35DF3A0940 for ; Thu, 9 Apr 2020 04:54:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8kt6nnc2epl+NaY7kRULLKPEs4B8yJQr3NMeK5cf/BU=; b=0abEIzQLVGX4D0lazT5QurIH39Fd/AyQXxUFpLWdNRE9NZ/Pn5bHls6u6xhkF48+L7GGwdKElwkCPjDXAdXfeZTpl2qM21JcJ/qjWJ3mvmeBC/qcRCqMS/qsPnqSOIDUlbcGxw6ED7WAkYtp191Vw3dv3zRG5EoG43VlGS0ymZ0= Received: from AM5PR0202CA0003.eurprd02.prod.outlook.com (2603:10a6:203:69::13) by DB8PR08MB5129.eurprd08.prod.outlook.com (2603:10a6:10:ec::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.19; Thu, 9 Apr 2020 11:54:17 +0000 Received: from AM5EUR03FT032.eop-EUR03.prod.protection.outlook.com (2603:10a6:203:69:cafe::77) by AM5PR0202CA0003.outlook.office365.com (2603:10a6:203:69::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.17 via Frontend Transport; Thu, 9 Apr 2020 11:54:17 +0000 Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT032.mail.protection.outlook.com (10.152.16.84) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.18 via Frontend Transport; Thu, 9 Apr 2020 11:54:17 +0000 Received: ("Tessian outbound e2c88df8bbbe:v50"); Thu, 09 Apr 2020 11:54:16 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 133e6a776694a2a7 X-CR-MTA-TID: 64aa7808 Received: from 1436b12724f7.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 8DED1BC5-6834-4C24-B874-0888C7CAD900.1; Thu, 09 Apr 2020 11:54:11 +0000 Received: from EUR04-HE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 1436b12724f7.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 09 Apr 2020 11:54:11 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ndX8oCoFWms1TTPsc73R0D5Oh72pty+xSWM7kyVHiQwVEPttq5B4DTn8DOcCe8yAswi2BsEZbbSp0Qs/UD5gaXsfuc8njD1FUwYFFegOBSiHj3kwOUEMwak+xk7cDWNZ07frhrUE4fSWdFatU9/ywiMu2nyU20pA/0d3JNOUiKeJhtHt+3P3sOU2nzTBcDzqk0DI+yRvYidvMKSeBLvuWrOSorRI0Ao6Bdzeirhnl+bdPnuqG6d45VxE7yd/l6feiSjUk+YdjySJZj+/eRsLVZheE46qWOlFLkbG2jSVE1OvWb0K6uJdbP86QcSLV6ZUASxpxZio28ggFjquNAJZPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8kt6nnc2epl+NaY7kRULLKPEs4B8yJQr3NMeK5cf/BU=; b=E/JNepg7Gn9nQSeTJ+ZpKKug6sm1RXf3zm8uuoekTKk54Y85HaaSgXrrBif2/jSzDv9tl4TRHSxM9FtQ44CEvfWD+iR6FVnK5nnCd6e2EFkgm7TuYKYq347Bp+RocrKztqMNM9I+FXF2hoxkCDgQkRv6iaMw+P+fNDibnREDGNqn61oJr9+hIuDmRM4Hamm6MJ7sR1q8oRUgTVb8VqGaoh4rW3EcwkU6+BwPYN3EDLccuzuaVsBw232uUcACOoKnH+7cy3OKaeYqC29acPFIRje9MiwptME8YBEY/wBRHyMqNdGsfrglTwkIrzloeJSLTXxyDOUTwRHvr9+kbMgG2Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8kt6nnc2epl+NaY7kRULLKPEs4B8yJQr3NMeK5cf/BU=; b=0abEIzQLVGX4D0lazT5QurIH39Fd/AyQXxUFpLWdNRE9NZ/Pn5bHls6u6xhkF48+L7GGwdKElwkCPjDXAdXfeZTpl2qM21JcJ/qjWJ3mvmeBC/qcRCqMS/qsPnqSOIDUlbcGxw6ED7WAkYtp191Vw3dv3zRG5EoG43VlGS0ymZ0= Received: from AM6PR08MB4231.eurprd08.prod.outlook.com (2603:10a6:20b:73::23) by AM6PR08MB5079.eurprd08.prod.outlook.com (2603:10a6:20b:e8::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.17; Thu, 9 Apr 2020 11:54:09 +0000 Received: from AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::b08c:a849:e63d:6150]) by AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::b08c:a849:e63d:6150%7]) with mapi id 15.20.2900.015; Thu, 9 Apr 2020 11:54:09 +0000 From: Thomas Fossati To: Laurence Lundblade CC: "rats@ietf.org" , Ned Smith , Thomas Fossati Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9bvbcLEp+Zjk2vMtbuW9TMtqht0JyAgAA8hgCAArrqgA== Date: Thu, 9 Apr 2020 11:54:09 +0000 Message-ID: <327A2536-0657-45B2-AD34-9DC97A83A429@arm.com> References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.35.20030802 Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; x-originating-ip: [82.11.185.80] x-ms-publictraffictype: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: f616f19e-524a-4437-3a67-08d7dc7cbb37 x-ms-traffictypediagnostic: AM6PR08MB5079:|AM6PR08MB5079:|DB8PR08MB5129: x-ms-exchange-transport-forked: True X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:6430;OLM:8273; x-forefront-prvs: 0368E78B5B X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM6PR08MB4231.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(376002)(346002)(396003)(136003)(366004)(39860400002)(6512007)(8936002)(5660300002)(81156014)(8676002)(6486002)(6506007)(71200400001)(186003)(2616005)(53546011)(2906002)(478600001)(26005)(36756003)(66476007)(33656002)(76116006)(6916009)(54906003)(15650500001)(66446008)(81166007)(316002)(64756008)(91956017)(66556008)(86362001)(66946007)(4326008); DIR:OUT; SFP:1101; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: 434zvcRFk26AcdQlBccLsQ9E7e0sJuzbDc+85NYsPSaPJLT+c2iJhEuDNScYj9OrQ3KoBPa9QknRparI60lMT8Fr7MBwrqvuzj4SrZIzD35mJdxqhDf2cGVYKVr5I/diD9pe7tGIXxhopo4OzfgjaMsJb0k0BC87JWXrycEETIfPP8BTk5Zi1K3MEDhKKiRpgY/plYAL9GPzxBAJ+Ompb4knSegcdIhno4c42oB/k922Quhj//WxjY9d2wWJQNJviHj578lsnA+ZBxQ1PBIh6LBRQmS0K2+leBhVBQSFFxD4g3ichYe1WTRHmhdU9dZnQ+JUSfesy8VbS88WoI6uUaxlaZLYZZ8VO1y+vwUi3Esdc1VQGeZbioaTiRuu5oHHXjQciNCc2c0u19vn1Ab6HurcaIAf04vMt8vt0ngjFq5GM4ZPhmmhqFSVOIU7BRK4 x-ms-exchange-antispam-messagedata: krWON6OKJiu86Ol75NCSgD+dnelopx26DzlZXVMWkXDV9FgEmWBjynypv9pyQs4cbsk+PSMcDUVi6OQkm+S7EBdcar8Pqqp7ywViZ6wAzi8JZEW3ha4IGDWakWiAGDJc+yBOMUMm4GlvUT5HROG/sg== Content-Type: text/plain; charset="utf-8" Content-ID: <9086B952C948A840ACF878BCD68B65F5@eurprd08.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB5079 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT032.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(376002)(346002)(136003)(396003)(39860400002)(46966005)(26826003)(8936002)(186003)(53546011)(478600001)(2906002)(336012)(4326008)(86362001)(33656002)(36756003)(5660300002)(8676002)(81156014)(6506007)(6486002)(15650500001)(6512007)(70206006)(36906005)(82740400003)(6862004)(47076004)(2616005)(70586007)(316002)(81166007)(356004)(26005)(54906003); DIR:OUT; SFP:1101; X-MS-Office365-Filtering-Correlation-Id-Prvs: 5420016c-85a5-4a07-d7a5-08d7dc7cb6ae X-Forefront-PRVS: 0368E78B5B X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: r4yST5lyR+hvClltaxsFBCCyrTsanOr1aUrjzrDwKS/LHLyZHf7XnaLRVJ/OCDlZygvJWPX35IDEtKEW1PD7zvbl3TcVCSeVuWjeeVnYXz2SqdYxOvE+oOHSmpCHJOOttDd+EtEuIwvAXr7vPHJsMCzM1UG1mhn9MLBk9OAm8UnYk5jvGZArl7eZDSM6l95e3aCn8B4F+CBDfEXqVzM6AFAiOJM3WDMu3JTVs/MQxXTpKZujJx2cQ4/zDleMmJK0UQKaqvZa570MIC/GjSZREDo+j31g2/bnWuIF68pmGqqXPSyNxg6aJEFbQw2fY307fCxVRKLJJ14sUTfRO2a+LpYgemRp+5jWO3zOm2DNM/ItG8NLWRURJ6FqhFjBj0qIUfAliqQaPpYmbgmkLgDnPlCBUCwI6MpMwOMOfg+WVeKPA96B4OSGWfCeEBLuKhkPHEglk2N80RXmxn49G/mUco5g4L/yQlHaITwsBZBs1sTJLjB/65zmQhE1sCSmqdYM8WcS7Cjgs8AC9YoyLaHJLw== X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Apr 2020 11:54:17.0628 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f616f19e-524a-4437-3a67-08d7dc7cbb37 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR08MB5129 Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Apr 2020 11:54:26 -0000 SGkgTGF1cmVuY2UsDQoNCk9uIDA3LzA0LzIwMjAsIDIwOjEyLCAiTGF1cmVuY2UgTHVuZGJsYWRl IiA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPiB3cm90ZToNCj4gT24gb25lIGV4dHJlbWUgaXMgYSBz ZXBhcmF0ZSBlbmRvcnNlbWVudCBmb3IgZXZlcnkgZGV2aWNlICgibWljcm8NCj4gZW5kb3JzZW1l bnQiPyksIHdoaWNoIGlzIHdoYXQgSSB0aGluayBUaG9tYXMgYW5kIEFSTSBQU0EgYXJlIHRlbmRp bmcNCj4gdG93YXJkcy4gVGhlIG90aGVyIGV4dHJlbWUgaXMgb25lIGVuZG9yc2VtZW50IGZvciBh IHByb2R1Y3QgbGluZQ0KPiAobWFjcm8gZW5kb3JzZW1lbnQiPyksIHNheSBhIHByb2R1Y3QgbGlu ZSBvZiBUUE1zLiBUaGVuIGl0J3MgbW9yZQ0KPiBsaWtlIHRoZSBkYXRhIHNoZWV0IGZvciB0aGUg cHJvZHVjdC4NCj4NCj4gVGhlbiB0aGVyZSdzIGRpZmZlcmVudCB3YXlzIHRvIGZhbiB0aGlzIG91 dCB0byB0aGUgZGlmZmVyZW50IGtleSAvDQo+IHNpZ25pbmcgc2NoZW1lcyAocGVyLWRldmljZSBr ZXksIGdyb3VwIGtleSwgRUNEQUEsIFguNTA5KS4gRm9yIGV4YW1wbGUNCj4gYSBtYWNyby1lbmRv cnNlbWVudCBjb3VsZCBpbmNsdWRlIHRoZSByb290IG9mIGFuIFguNTA5IGhpZXJhcmNoeSBhbmQN Cj4gdGhlIGluZGl2aWR1YWwgZGV2aWNlcyAob3IgZ3JvdXBzIG9mIGRldmljZXMpIHdvdWxkIGhh dmUgaW5kaXZpZHVhbA0KPiBrZXlzIHRoYXQgY2hhaW4gdXAuICBXaXRoIGEgbWljcm8tZW5kb3Jz ZW1lbnQgdGhlIHBlci1kZXZpY2UgcHVibGljDQo+IGtleSBjb3VsZCBiZSBwZXIgZW5kb3JzZW1l bnQuDQoNCk9uZSB0aW55IGNsYXJpZmljYXRpb24uICBXaGlsZSBpdCdzIHRydWUgdGhhdCB0aGUg Y3VycmVudCBQU0ENCmF0dGVzdGF0aW9uIGZvcm1hdCBncmF2aXRhdGVzIHRvd2FyZHMgbWljcm8t ZW5kb3JzZW1lbnRzLCB0aGF0IGlzIG5vdCBhDQpuZWNlc3Nhcnkgb3V0Y29tZSBvZiB0aGUgdW5k ZXJseWluZyBzZWN1cml0eSBhcmNoaXRlY3R1cmUuICBUaGUgYmFzZWxpbmUNCnJlcXVpcmVtZW50 IGlzIGZvciBhIHJhdyBwdWJsaWMga2V5LCBidXQgbm90aGluZyBwcmV2ZW50cyBpdCBiZWluZyBh DQpjZXJ0aWZpZWQga2V5IGluc3RlYWQuDQoNClRoZXJlIGlzIGJvdGggYWxyZWFkeSBzaGlwcGVk IGFuZCBpbi1wcm9ncmVzcyB3b3JrIHRoYXQgd291bGQgaGVscA0KbW92aW5nIGluIHRoZSBkaXJl Y3Rpb24sIHNwZWNpZmljYWxseToNCi0gaGF2ZSB0aGUgYXR0ZXN0YXRpb24ga2V5IGFzc29jaWF0 ZWQgd2l0aCBhIHByb2ZpbGVkIFsxXSBhbmQgY29tcHJlc3NlZA0KICBbMl0gY2VydDsNCi0gaGF2 ZSBFQVQgLyBQU0EgdG9rZW5zIGNhcnJ5IGNlcnQgbWF0ZXJpYWwgaW5zdGVhZCBvZiBqdXN0IGtl eQ0KICBpZGVudGlmaWVycyBbM10uDQoNCmNoZWVycyENCg0KWzFdIFJGQzc5MjUNClsyXSBkcmFm dC1tYXR0c3Nvbi10bHMtY2Jvci1jZXJ0LWNvbXByZXNzDQpbM10gZHJhZnQtaWV0Zi1jb3NlLXg1 MDkNCg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFu eSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2Vk LiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRo ZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8g YW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29w eSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0K From nobody Thu Apr 9 07:31:48 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB0FB3A076E for ; Thu, 9 Apr 2020 07:31:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.166 X-Spam-Level: X-Spam-Status: No, score=-2.166 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=TaVFcMrE; dkim=pass (1024-bit key) header.d=juniper.net header.b=KKOa6IFH Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b1oxnP3L9TOA for ; Thu, 9 Apr 2020 07:31:37 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB6DD3A077C for ; Thu, 9 Apr 2020 07:31:37 -0700 (PDT) Received: from pps.filterd (m0108161.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 039EVa6G026232; Thu, 9 Apr 2020 07:31:36 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=5ZSxeC6pg6RfoQIpl3mvQT22b6zc6gxWtv6FwXTwd4c=; b=TaVFcMrED55b3/FBSytA1/roS5dQVhTsXFedIjQjn/Pyy4l12c9NSfw55Q0M8rwVlonj piZmHX/UwMPm6xoX0g6gVI2t1R1b+t9dqfXMB2xdMHT8nTYBdiTkuIkql9o5PXXKZU1g MOGJ6oU2CT13DC1L6VG1VLtoB8UzIB3Xpudmc8S3nymXJzY7gX5kZXB5tFa4QYT476SF 1gNu0QGxlx8bWIX7dOcZlw49hcQN8+oNUVcfO26HB1sCEq4CYTEQO/XSYxh2Pct1j92K 2mu1nEFgLtcH/7O5etLAiKdQdn5xXZTxvOfodcbR7FEXV8HAEVSnUSRLXtTyIDLBLaOw kw== Received: from nam04-bn3-obe.outbound.protection.outlook.com (mail-bn3nam04lp2051.outbound.protection.outlook.com [104.47.46.51]) by mx0b-00273201.pphosted.com with ESMTP id 3091rnbhwv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 09 Apr 2020 07:31:36 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nv2aLUop1834ZQfpwmJkEG2Ng1R4epPnFZsIr7dFcFAILi0fy8dQtuuWXLAS/lJABQD5nCVV2wl92vmA2juK98QNclOr2EzzXY3gkeAuHiBcZTyxp1bEpBIZQk4ZlD5Itg91HiZWjZz/QKd6+Yntob2HNgVUXXLildUJGihbDhMMeDlPuuGcLtGsH/qOfg6NstpOUKccTTEgdKObAK0LBKkXLStB9FaEW6XWjbwa4srZUUhoNRvJXMRbz0NLmCGqaCqNEU6ATCKSNDNdpOwVfwTbIDU1oF+E12WNR0Ta6Pp2bUjjZOHlSC0+Hm82dEhgVnonXXZZ4hNGJXrekQfeMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5ZSxeC6pg6RfoQIpl3mvQT22b6zc6gxWtv6FwXTwd4c=; b=iCar38cxSTRgcpzH+Gq8kzEST+3Ud9UEo1oRzyjX2ISaGfiX/3whX1W9+C0oYBffHAG1ZdK9BHQz9z+eNoX1KO9zxb6bGlXwu+5kwV/XGO1d83X3mRKr4f7g3hi4WunZfaDVEpn7f/ESbEb420HUvb2ZCq3ttYTwEdkphDc81KlTdd+boVWBMSInKKXxxEFWYtDXnHZ04x7uDlFVaCBsC2CDF0wF8PTyBb26dhu5pfRGnqCjBXy99q3fNwu1Wds9O5gaIUHuQrTfo9shv+gBDQK3NACTNjkbR6Z84itF0AmEv8/Kw6G2SzoawSX7rq0TGTSetPGme9daKo5cZLfLTQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5ZSxeC6pg6RfoQIpl3mvQT22b6zc6gxWtv6FwXTwd4c=; b=KKOa6IFHbggcW8zsAjRhlmzwJ0O4RnqUMlEJePIoQ9dMOK2YmfjNFCwPlpZDs5UKqhq8sVjWePYK2vKpU0QElouph5cMr7o1ccpmDIzinnjhbLZUvwjgS00XeknjAr0JfCnLoAerK7oX1BjZ9WIuKKD5kBZA5LuVzNKOVewp2P4= Received: from DM6PR05MB6889.namprd05.prod.outlook.com (2603:10b6:5:204::22) by DM6PR05MB5337.namprd05.prod.outlook.com (2603:10b6:5:57::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.13; Thu, 9 Apr 2020 14:31:30 +0000 Received: from DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1]) by DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1%7]) with mapi id 15.20.2921.009; Thu, 9 Apr 2020 14:31:30 +0000 From: Guy Fedorkow To: Laurence Lundblade CC: "rats@ietf.org" , Ned Smith Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9b/q6maJEL0kaGXfcqT+zj8qhtv9mAgABNSQCAAtK/EA== Date: Thu, 9 Apr 2020 14:31:29 +0000 Message-ID: References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-09T14:31:28.3858892Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=5b6998b2-1f9b-4eb2-bba3-128e23ee313c; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic dlp-product: dlpe-windows dlp-version: 11.3.2.8 dlp-reaction: no-action x-originating-ip: [66.129.241.11] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 32f845d6-2711-45a6-cbc3-08d7dc92b1b9 x-ms-traffictypediagnostic: DM6PR05MB5337: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0368E78B5B x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR05MB6889.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(136003)(366004)(346002)(39860400002)(376002)(396003)(9326002)(9686003)(53546011)(33656002)(316002)(64756008)(55016002)(15650500001)(81156014)(86362001)(5660300002)(6506007)(8936002)(7696005)(66446008)(4326008)(8676002)(6916009)(26005)(76116006)(66556008)(66476007)(186003)(52536014)(966005)(478600001)(2906002)(66946007)(81166007)(71200400001)(54906003); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 2v6RDX2z89jG2K97WmSdqc5JKc8xsRdwG1LtR7ra/pi4pDPfGxOiFXeRf4zqNB2wJc9bC3SROJ1fMk18ciwPEMEtqddo+NogKH2IVTrAdXaI5+kZSYBhqEep6HhpASFxlVJyXF7pBe9lZPRZHGxMEta7NlTEHuAq0eHX+pphQHmckoCpwP9QZb2PJ3mF4juMsCGKpUhO2uaMha1H+FnC0SSC+eOlUCznqhDV1bSfVfjWT4/A4olSDsE5afn3MaHWS7WVS6g/XfMl9376JcA6nNGBwnst0UFCz21YTuqZtoWuERYdAYvgqKaiXdddtO3Ha/z8SyCgVvkyGq64zwf7nf9xDhmsEAS7/uIKfVBPqlegcnFgMlLWEtW2au6trUoPByAMggSMJhhRvjd/CvsN8KLH9kC3/BbA7vnyFxwmYKeuB4quAG+KPq1uhVuuJw1N6kv1SJFGXvKYQRsUnjSo0ep01un0yq4m/eqdLiUJFEmomhKJAJNiHC4FzXisKyWlWZ90mHyPGm1h5WERYYHy2A== x-ms-exchange-antispam-messagedata: 3D1xXyfjdnxIY7qyL0sC5iAg21yetdCb+4o3CRCSyrkgYCOgjZEWlTS/p6gSMGvxpHAlTq5ynf3Cca1pBJMS4edwR/+ubd/mtXAJsQDsZ5sbUkFBELfEJfMM57Z5CpuEshkRhD/jTCljCSEcKIE24w== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR05MB6889D52B4759285A81C43FA4BAC10DM6PR05MB6889namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: 32f845d6-2711-45a6-cbc3-08d7dc92b1b9 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Apr 2020 14:31:29.9804 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: cLiZSPIOnyaEQ3tDjUxz9s1UMInlQn/rHaT5QS219qwFiDKN0Ic9lhjYdzmnnQfzgpLFvUOajh1aGCztcH+bUw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR05MB5337 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-09_04:2020-04-07, 2020-04-09 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 mlxscore=0 malwarescore=0 lowpriorityscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 clxscore=1015 bulkscore=0 adultscore=0 priorityscore=1501 spamscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004090114 Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Apr 2020 14:31:46 -0000 --_000_DM6PR05MB6889D52B4759285A81C43FA4BAC10DM6PR05MB6889namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Laurence, I understand that the discussion on the topic below mainly pertains to EA= T, but I'd like to make sure we're not missing something on the RIV side. For OS software image integrity using a TPM, it seems like finding the ri= ght manifest shouldn't be that hard... The Attester needs to have pre-provisioned identity and attestation keys = as outlined in the RIV draft. That provides the Verifier with the vendor i= dentity for the root of trust. The measurement logs contain the alleged pr= oduct name and version number for the software installed on the box. Use t= he vendor ID to narrow the scope to specific vendor's product and version s= pace, and find the RIM that matches. Then check if the hashes line up; if = so, you're good, if not, either the claim of what software is present was i= ncorrect, or something got hacked. Seems like a verifier could follow this same model through the entire cha= in of trust, even through multiple vendors, as long as there are no gaps in= the chain. I know EAT needs to work in a less-constrained environment, but let me kn= ow if you think we're oversimplifying this on RIV. Thanks /guy Juniper Business Use Only From: RATS On Behalf Of Laurence Lundblade Sent: Tuesday, April 7, 2020 3:13 PM To: Thomas Fossati Cc: rats@ietf.org; Ned Smith Subject: Re: [Rats] Endorsement ID and verification key (was Processing End= orsements and Evidence into Results) [External Email. Be cautious of content] This is a reply to both Thomas and Ned's message on debug in the related th= reat. My inclination is to associate endorsements with time-invariant characteris= tics of the device. At the moment this doesn't seem like the only way to do= it, but it seems like a good way. Things that are not time invariant are p= olicy, k-g-v or such. Endorsement System architecture - Does the Attester use a TEE or a TPM or maybe it is s= imple system with just a simple CPU, but it is encased in titanium. Is defe= nse against chip invasive attacks considered? Do keys become inaccessible w= hen debug is enabled. Development process - Is there a special security-oriented team? Does the t= eam have a code review policy? Is there a bug bounty? Are the desktops and = IT systems used for HW and SW development isolated? Manufacturing - Are the factories secured in a special way? Is the attestat= ion key provisioning system hardened in some way (e.g., uses HSMs). Certifications - These take a long time to achieve and will usually require= some of the above. My thinking for EAT was that you only put attestation keys into devices tha= t meet some criteria like some of the above. Since there is often no way to= recover from a compromised attestation key because no key more secure than= it, you kind of have to have all that. Since these don't change much over time, the endorsement wouldn't change. = They could even span several models and varying HW. Policy, K-G-V, other SW Versions - As long as the SW follows a development process like that abo= ve, it doesn't have to be included in the endorsement. Of course the smalle= r the SW and the better the process, the more it is true (and vice versa). Blacklists - These might be specific to UEIDs, versions of SW, deployments = a particular OEM or such Debug status - Most of the debug status values can vary on a day-day basis OEM model - If the attestation is implemented by a chip vendor and the endo= rsement is for the chip, then the OEM model will vary widely. None of these can be criteria as to whether an attestation key is put into = a device or not as they are not known at manufacturing time and/or must be = allowed to vary widely after manufacturing. I think what I've described above lines up pretty well for a TPM. The syste= m architecture is mostly set by the TCG. HW TPMs are almost always certifie= d. They are independent of OEM model. It also lines up reasonably well with= secure elements and can line up with TEE's. The crux of endorsement to me is the security characteristics of the attest= er that protect the attestation key because there is generally no recovery = from a compromised attestation key. It sets the baseline risk of the HW and= SW of the device. On one extreme is a separate endorsement for every device ("micro endorseme= nt"?), which is what I think Thomas and ARM PSA are tending towards. The ot= her extreme is one endorsement for a product line ("macro endorsement"?),, = say a product line of TPMs. Then it's more like the data sheet for the prod= uct. Then there's different ways to fan this out to the different key / signing = schemes (per-device key, group key, ECDAA, X.509). For example a macro-endo= rsement could include the root of an X.509 hierarchy and the individual dev= ices (or groups of devices) would have individual keys that chain up. With = a micro-endorsement the per-device public key could be per endorsement. The most important thing about the endorsement seems to me is the character= ization of how the attestation key is protected. LL On Apr 7, 2020, at 7:36 AM, Thomas Fossati > wrote: Hi Laurence, Thanks for bringing this up. A few thoughts below. On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" on behalf of lgl@islan= d-resort.com> wrote: So how does a Verifier find the applicable endorsement for Evidence it wishes to verify and know that is really the right endorsement? Seems like the Evidence needs some sort of an endorsement locator ID. This could be a URL or a GUID. EAT currently has the origination claim to try to solve this, but it is half-baked. It needs to get fixed. I'm fishing for comments here on what it should be like. Pretty sure the Endorsement needs to include or reference the public key that is used to verify the signature. Without that, the Attester could lie and pick any old Endorsement that it wishes. There needs to be some binding between items in the endorsement (E0, E1,...) and the verification key. That could be in the form of a signed token or certificate, but doesn't have to be. Pretty sure this needs to be discussed in the architecture doc. There's a few scenarios: - One endorsement applies to lots of devices in the same class, but each has their own attestation key. - - Probably ECDAA fits in here - - One option here is an X509 hierarchy - Group keys are used (for privacy reasons or other) so there is a one-one correlation with the Endorsements (the GEID discussion) - Group keys are used, but across devices that have different endorsements so there's no one-one correlation While the last one seems odd and unlikely, I think it could occur, because from a lot of real experience the set up of attestation keys is very idiosyncratic. It is wildly affected by manufacturing costs and issues on assembly lines, sub contractor structure, location of secure facilities and approaches to making money on it. They are like snowflakes, each one is different. So maybe endorsement locator ID and key ID are not the same, but they can be in some use cases? I am also tempted to encourage the placement of the endorsement locator ID in the COSE or JOSE header parameters so you don't have to parse the unverified body of claims to be able to find the key material to verify it. Thoughts? A two level lookup key, model+instance, seems to be quite generally applicable as an endorsement locator. The model part would get you to the shared data (e.g., certification, measured boot KGVs, etc.), while the instance part can be used to retrieve device-specific state: verification key(s) as well as other metadata, e.g., if some gear is blacklisted. In PSA we have something quite (though not entirely) similar with implementation and instance IDs [1] [2]. (Context-switching for a second on our previous UEID/GEID discussion: I guess we might model an instance as an anonymity set, and therefore treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?) For the sake of building a shared and reusable vocabulary, I'd prefer keeping model and instance identifiers as separate claims rather than having an opaque endorsement ID claim that clumps together those and possibly other stuff in a use-case specific fashion. For the same reason I would not override key ID with instance ID semantics. cheers, thanks! [1] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-im= plementation-id [2] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-in= stance-id IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ RATS mailing list RATS@ietf.org https://www.ietf.org/mailman/listinfo/rats --_000_DM6PR05MB6889D52B4759285A81C43FA4BAC10DM6PR05MB6889namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Laurence,

  I understand that the discussion on the topic= below mainly pertains to EAT, but I’d like to make sure we’re = not missing something on the RIV side.

  For OS software image integrity using a TPM, = it seems like finding the right manifest shouldn’t be that hard…= ;

  The Attester needs to have pre-provisioned id= entity and attestation keys as outlined in the RIV draft.  That provid= es the Verifier with the vendor identity for the root of trust.  The m= easurement logs contain the alleged product name and version number for the software installed on the box.  Use the ve= ndor ID to narrow the scope to specific vendor’s product and version = space, and find the RIM that matches.  Then check if the hashes line u= p; if so, you’re good, if not, either the claim of what software is present was incorrect, or something got hacked.

  Seems like a verifier could follow this same = model through the entire chain of trust, even through multiple vendors, as = long as there are no gaps in the chain.

  I know EAT needs to work in a less-constraine= d environment, but let me know if you think we’re oversimplifying thi= s on RIV.

 

  Thanks

/guy

 

 

 

Juniper Business Use Only

From: RATS <rats-bounces@ietf.org> O= n Behalf Of Laurence Lundblade
Sent: Tuesday, April 7, 2020 3:13 PM
To: Thomas Fossati <Thomas.Fossati@arm.com>
Cc: rats@ietf.org; Ned Smith <ned.smith@intel.com>
Subject: Re: [Rats] Endorsement ID and verification key (was Process= ing Endorsements and Evidence into Results)

 

<= span style=3D"font-size:10.5pt;font-family:"Lato",sans-serif;colo= r:black">[External Email. Be cautious of content]

 

This is a reply to both Thomas and Ned’s messa= ge on debug in the related threat.

 

My inclination is to associate endorsements with tim= e-invariant characteristics of the device. At the moment this doesn’t= seem like the only way to do it, but it seems like a good way. Things that= are not time invariant are policy, k-g-v or such.

 

Endorsement

System architecture — Does the Attester use a = TEE or a TPM or maybe it is simple system with just a simple CPU, but it is= encased in titanium. Is defense against chip invasive attacks considered? = Do keys become inaccessible when debug is enabled.

 

Development process — Is there a special secur= ity-oriented team? Does the team have a code review policy? Is there a bug = bounty? Are the desktops and IT systems used for HW and SW development isol= ated?

 

Manufacturing — Are the factories secured in a= special way? Is the attestation key provisioning system hardened in some w= ay (e.g., uses HSMs).

 

Certifications — These take a long time to ach= ieve and will usually require some of the above.

 

My thinking for EAT was that you only put attestatio= n keys into devices that meet some criteria like some of the above. Since t= here is often no way to recover from a compromised attestation key because = no key more secure than it, you kind of have to have all that. 

 

Since these don’t change much over time, the e= ndorsement wouldn’t change.  They could even span several models= and varying HW.

 

Policy, K-G-V, other

SW Versions — As long as the SW follows a deve= lopment process like that above, it doesn’t have to be included in th= e endorsement. Of course the smaller the SW and the better the process, the= more it is true (and vice versa).

 

Blacklists — These might be specific to UEIDs,= versions of SW, deployments a particular OEM or such

 

Debug status — Most of the debug status values= can vary on a day-day basis

 

OEM model — If the attestation is implemented = by a chip vendor and the endorsement is for the chip, then the OEM model wi= ll vary widely.

 

None of these can be criteria as to whether an attes= tation key is put into a device or not as they are not known at manufacturi= ng time and/or must be allowed to vary widely after manufacturing.

 

 

I think what I’ve described above lines up pre= tty well for a TPM. The system architecture is mostly set by the TCG. HW TP= Ms are almost always certified. They are independent of OEM model. It also = lines up reasonably well with secure elements and can line up with TEE’s.  

 

The crux of endorsement to me is the security charac= teristics of the attester that protect the attestation key because there is= generally no recovery from a compromised attestation key. It sets the base= line risk of the HW and SW of the device.

 

 

On one extreme is a separate endorsement for every d= evice (“micro endorsement"?), which is what I think Thomas and A= RM PSA are tending towards. The other extreme is one endorsement for a prod= uct line (“macro endorsement"?),, say a product line of TPMs. Then it’s more like the data sheet for the product.&nb= sp;

 

Then there’s different ways to fan this out to= the different key / signing schemes (per-device key, group key, ECDAA, X.5= 09). For example a macro-endorsement could include the root of an X.509 hie= rarchy and the individual devices (or groups of devices) would have individual keys that chain up. With a micro-endorse= ment the per-device public key could be per endorsement.

 

 

The most important thing about the endorsement seems= to me is the characterization of how the attestation key is protected.

 

LL

 

 

 

On Apr 7, 2020, at 7:36 AM, Thomas Fossati <Thomas.Fossati@arm.com> wrote:<= o:p>

 

Hi Laurence,

Thanks for bringing this up.  A few thoughts below.

On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade"
<rats-bounces@ietf.org=  on behalf of lgl@island-resort.com> wrote:

So how does a Verifier find the applicable endorse= ment for Evidence it
wishes to verify and know that is really the right endorsement?

Seems like the Evidence needs some sort of an endorsement locator ID.
This could be a URL or a GUID. EAT currently has the origination claim
to try to solve this, but it is half-baked. It needs to get fixed. I’= m
fishing for comments here on what it should be like.

Pretty sure the Endorsement needs to include or reference the public
key that is used to verify the signature. Without that, the Attester
could lie and pick any old Endorsement that it wishes. There needs to
be some binding between items in the endorsement (E0, E1,…) and the verification key. That could be in the form of a signed token or
certificate, but doesn’t have to be. Pretty sure this needs to be
discussed in the architecture doc.

There's a few scenarios:
- One endorsement applies to lots of devices in the same class, but
 each has their own attestation key.
- - Probably ECDAA fits in here
- - One option here is an X509 hierarchy
- Group keys are used (for privacy reasons or other) so there is a
 one-one correlation with the Endorsements (the GEID discussion)
- Group keys are used, but across devices that have different
 endorsements so there’s no one-one correlation

While the last one seems odd and unlikely, I think it could occur,
because from a lot of real experience the set up of attestation keys
is very idiosyncratic. It is wildly affected by manufacturing costs
and issues on assembly lines, sub contractor structure, location of
secure facilities and approaches to making money on it. They are like
snowflakes, each one is different.  So maybe endorsement locator ID and key ID are not the same, but they can be in some use cases?

I am also tempted to encourage the placement of the endorsement
locator ID in the COSE or JOSE header parameters so you don’t have to=
parse the unverified body of claims to be able to find the key
material to verify it.

Thoughts?


A two level lookup key, model+instance, seems to be quite generally
applicable as an endorsement locator.  The model part would get you to=
the shared data (e.g., certification, measured boot KGVs, etc.), while
the instance part can be used to retrieve device-specific state:
verification key(s) as well as other metadata, e.g., if some gear is
blacklisted.  In PSA we have something quite (though not entirely)
similar with implementation and instance IDs [1] [2].

(Context-switching for a second on our previous UEID/GEID discussion: I
guess we might model an instance as an anonymity set, and therefore
treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?)

For the sake of building a shared and reusable vocabulary, I'd prefer
keeping model and instance identifiers as separate claims rather than
having an opaque endorsement ID claim that clumps together those and
possibly other stuff in a use-case specific fashion.  For the same
reason I would not override key ID with instance ID semantics.

cheers, thanks!

[1] https://www.ietf.org/id/= draft-tschofenig-rats-psa-token-05.html#name-implementation-id=
[2] https://www.ietf.org/id/draft-= tschofenig-rats-psa-token-05.html#name-instance-id



IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats=

 

--_000_DM6PR05MB6889D52B4759285A81C43FA4BAC10DM6PR05MB6889namp_-- From nobody Thu Apr 9 09:23:28 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AAB83A0AE3 for ; Thu, 9 Apr 2020 09:23:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.917 X-Spam-Level: X-Spam-Status: No, score=-1.917 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iBtW3qGd_XTo for ; Thu, 9 Apr 2020 09:23:22 -0700 (PDT) Received: from p3plsmtpa08-01.prod.phx3.secureserver.net (p3plsmtpa08-01.prod.phx3.secureserver.net [173.201.193.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B552C3A0B0F for ; Thu, 9 Apr 2020 09:23:22 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id MZxZjgErhnHFwMZxajehYc; Thu, 09 Apr 2020 09:23:22 -0700 X-CMAE-Analysis: v=2.3 cv=R8Z95uZX c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=IkcTkHD0fZMA:10 a=QyXUC8HyAAAA:8 a=48vgC7mUAAAA:8 a=K6EGIJCdAAAA:8 a=7CQSdrXTAAAA:8 a=CUM5igzbH0wk9tQngBgA:9 a=Q2WaoXZNI8IVdF-5:21 a=z1GSI2byF-9cB3v6:21 a=QEXdDO2ut3YA:10 a=y9OUIGaxdF8A:10 a=kj6DBQF8G6IA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=L6pVIi0Kn1GYQfi8-iRI:22 a=a-qgeE7W1pNrGK8U0ZQC:22 X-SECURESERVER-ACCT: lgl@island-resort.com Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Laurence Lundblade In-Reply-To: <124577c9-4398-788d-1ab3-f1864fd708a8@sit.fraunhofer.de> Date: Thu, 9 Apr 2020 09:23:21 -0700 Cc: "Smith, Ned" , "rats@ietf.org" , Thomas Fossati Content-Transfer-Encoding: quoted-printable Message-Id: References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> <0CE0C60B-79FA-43CF-A445-2EC3B5C767DE@island-resort.com> <124577c9-4398-788d-1ab3-f1864fd708a8@sit.fraunhofer.de> To: Henk Birkholz X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfLs5ly2xwPJbf2Y3EvD9IgznMrT5C+CLN++0pIoj5gvY0+Q9XsiFwq6SNmIbP+OaU2LaLGCXGwDCUIr5M9DXEesf2gNtB+HttfGjlFLOK7wWIz4MGith 2bQRdzS+fJ8GNv3brzQs2fyKMUvtnMwLkyQ9659Ffvqo1JuasMUPFB+RyxaOySe498k97ribQrHXEqQc2XnLMNPrDYAeJoRXgtXu9xRNuYQZX/CBC8qZFO1Y MUcDZn9VR7ZBGof+8E/aXzeTOt2igySSjjrH1oZW7jg= Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Apr 2020 16:23:25 -0000 Attester by Endorser. Thanks for the correction, Henk. LL > On Apr 9, 2020, at 2:46 AM, Henk Birkholz = wrote: >=20 > Hi Laurence, >=20 > did you really mean "describing the security characteristics of the = Endorser" or instead "describing the security characteristics of the = Attester by an Endorser"? >=20 > Viele Gr=C3=BC=C3=9Fe, >=20 > Henk >=20 > On 08.04.20 22:06, Laurence Lundblade wrote: >> Hi Ned, >> Seems like there is general agreement on the core purpose of the = endorsement =E2=80=94 describing the security characteristics of the = Endorser. >> I=E2=80=99m not advocating any definitions in the architecture = document here. I was after some general characteristics and common = understanding. I know implementations are going to vary wildly. >> To be more clear on =E2=80=9COEM model=E2=80=9D. I was using that to = refer to the end device like a router, a phone or a washing machine, not = the manufacturer of a chip, a TPM or a TEE. The TEE might be the = Attester and might be the same Attester with the same endorsement that = is in both a Motorola phone and a Sony phone, each with a different OEM = Model claim. >> When I was referring to a =E2=80=9Cproduct line of TPMs=E2=80=9D, I = was thinking of several very similar models from the same TPM vendor. = Seems like this would share the more invariant characteristics of a = Endorsement and maybe could share an Endorsement. However, I have no = strong sense that it has to be one way or the other. >> One of the main reasons I=E2=80=99ve dug into all this is to try to = understand how Endorsements and Verification Keys are identified in the = Evidence so we can define what is needed in EAT. That was the main = reason for distinguishing micro and macro endorsements. It is not to = have them formally defined. >> Thomas=E2=80=99 comments where really enlightening as to how ARM PSA = is thinking of this (and how it was quite different from mine). >> I haven=E2=80=99t come to any conclusions yet. Would be interested to = understand how identification of a particular Key come from a particular = Endorsement which comes from fields COSE / JOSE headers and / or = contained claims for lots of different instantiations and implements of = of RATS protocols. >> LL >>> On Apr 7, 2020, at 4:11 PM, Smith, Ned > wrote: >>>=20 >>> See inline nms> >>> *From:*RATS > = on behalf of Laurence Lundblade > >>> *Date:*Tuesday, April 7, 2020 at 12:12 PM >>> *To:*Thomas Fossati > >>> *Cc:*"rats@ietf.org " >, "Smith, Ned" > >>> *Subject:*Re: [Rats] Endorsement ID and verification key (was = Processing Endorsements and Evidence into Results) >>> This is a reply to both Thomas and Ned=E2=80=99s message on debug in = the related threat. >>> My inclination is to associate endorsements with time-invariant = characteristics of the device. At the moment this doesn=E2=80=99t seem = like the only way to do it, but it seems like a good way. Things that = are not time invariant are policy, k-g-v or such. >>> Nms> Certainly any property that is time invariant (about the = device) can be explicitly captured in Endorsements. Since they are = time-invariant it doesn=E2=80=99t make sense to Attest to them in = Evidence (they will always be the same result). I disagree that = Endorsement MUST ONLY be time invariant claims however. >>> Nms> Not sure if the questions below are rhetorical. >>> *_Endorsement_* >>>> System architecture =E2=80=94 Does the Attester use a TEE or a TPM = or maybe it is simple system with just a simple CPU, but it is encased = in titanium. Is defense against chip invasive attacks considered? Do = keys become inaccessible when debug is enabled. >>>> Development process =E2=80=94 Is there a special security-oriented = team? Does the team have a code review policy? Is there a bug bounty? = Are the desktops and IT systems used for HW and SW development isolated? >>>> Manufacturing =E2=80=94 Are the factories secured in a special way? = Is the attestation key provisioning system hardened in some way (e.g., = uses HSMs). >>>> Certifications =E2=80=94 These take a long time to achieve and will = usually require some of the above. >>> My thinking for EAT was that you only put attestation keys into = devices that meet some criteria like some of the above. Since there is = often no way to recover from a compromised attestation key because no = key more secure than it, you kind of have to have all that. >>> Nms> The idea that a device has an Attesting Environment(s) and = Target Environment(s) implies the Attesting Environment is/should be = more hardened is what some refer to as Root-of-Trust. The techniques for = protecting the Attesting Environment should be immutable/invariant which = is why some use the term =E2=80=9CHardware Root of Trust=E2=80=9D when = describing an ideal Attesting Environment. >>> Since these don=E2=80=99t change much over time, the endorsement = wouldn=E2=80=99t change. >>> Nms> The Endorsement conveys the immutability / property of time = invariance to the Verifier. It describes the Root of Trust / Attesting = Env. Where the attestation key is held because if the root attestation = sub-system is broken there is no other protection mechanism to fall back = on for recovery that doesn=E2=80=99t involve physical remediation. >>> They could even span several models and varying HW. >>> Nms> Or not. It depends on the system architecture. >>> *_Policy, K-G-V, other_* >>> Nms> Policy (aka Appraisal Policy for Evidence, Appraisal Policy for = Attestation Results) is different from Endorsement. Known Good Values = are synonymous with Endorsement. The architecture uses one word to = capture a variety of possible claims that supply chain entities can = convey to Verifiers. I don=E2=80=99t think it makes sense to conflate = Policy with Endorsements. It might make sense for Policy to have an = opinion as to what is =E2=80=98good=E2=80=99. But it is a case of an = Owner deciding vs. the manufacturer. It is appropriate for both to have = something to say about the claim. >>>> SW Versions =E2=80=94 As long as the SW follows a development = process like that above, >>>> it doesn=E2=80=99t have to be included in the endorsement. >>>> Nms> I disagree with this conclusion. The vendor determines which = version string is applied to SW it produces. That value is an assertion = only the SW vendor can make. Owner Policy can say that the version is = =E2=80=98good=E2=80=99 or =E2=80=98bad=E2=80=99 or =E2=80=98unknown=E2=80=99= but can=E2=80=99t say that the version is X. >>>> Of course the smaller the SW and the better the process, the more = it is true (and vice versa). >>>> Blacklists =E2=80=94 These might be specific to UEIDs, versions of = SW, deployments a particular OEM or such >>>> Nms> Many entities can produce black/white lists legitimately. If = the entity is in the supply chain the assertion is an Endorsement. If = the entity is an Owner then the assertion is a Policy. The difference is = in how the Verifier treats Endorsements vs. Policies. >>>> Example: >>>> S0) Endorser E0 says Key KD speaks for Device D >>>> S1) Attester KD says SW S is extant on D >>>> S2) Endorser E1 says SW S is version 1.0 >>>> S3) Endorser E2 says version 1.0 (of S) is bad >>>> S4) Owner policy says version 1.0 (of S) is good. >>>> S5) Owner policy says E1 is trusted to say S is version 1.0 >>>> S6) Owner policy says E2 is trusted to say S is good/bad >>>> S7) Owner Policy says E0 is trusted to provision KD on D >>>> Appraisal evaluates the statements: >>>> Prove: X =3D SW is extant on device D and it is good. >>>> Proof: >>>> S3 says E2 says version 1.0 is bad S6 says E2 can say = this | valid >>>> S2 says E1 says S is version 1.0 S5 says E1 can say this | = valid >>>> S1 says KD says S is extant on D S7 says KD can say = this | valid >>>> S0 says KD speaks for D S7 says E0 can say this | = valid >>>> Therefore X is FALSE at this point; but >>>> S4 says version 1.0 is good Owner can say anything | = valid >>>> Therefore X is TRUE >>>> Debug status =E2=80=94 Most of the debug status values can vary on = a day-day basis >>>> Nms> It depends on the debug mechanism. >>>> OEM model =E2=80=94 If the attestation is implemented by a chip = vendor and the endorsement is for the chip, then the OEM model will vary = widely. >>>> Nms> Not sure how this is relevant >>> None of these can be criteria as to whether an attestation key is = put into a device or not as they are not known at manufacturing time = and/or must be allowed to vary widely after manufacturing. >>> Nms> Devices can be a mix of hardware and firmware. Even hardware = can be mutable. Endorsements describe the mutability properties of the = device. Endorsement also describe the range of possible (and acceptable) = values the mutable properties can accept. >>> I think what I=E2=80=99ve described above lines up pretty well for a = TPM. >>> Nms> I disagree. >>> The system architecture is mostly set by the TCG. >>> Nms> No, the TCG specifies interfaces not implementation. >>> HW TPMs are almost always certified. >>> Nms> An independent evaluation entity specifies how an = implementation scored according to the criteria. There are lots of TPMs = that are not certified or are certified to different levels. The = important point should be that the Verifier doesn=E2=80=99t know unless = it asks for Evidence and Endorsements. >>> They are independent of OEM model. >>> Nms> This isn=E2=80=99t true. Every TPM has a vendor, model/product = name etc=E2=80=A6 that is not chosen by TCG. >>> It also lines up reasonably well with secure elements and can line = up with TEE=E2=80=99s. >>> The crux of endorsement to me is the security characteristics of the = attester that protect the attestation key because there is generally no = recovery from a compromised attestation key. It sets the baseline risk = of the HW and SW of the device. >>> Nms> I agree that the Attesting Environment is trusted by the Target = Environment. If the Attesting Environment is compromised, there is no = way for the Target Environment trustworthiness to be assessed. >>> On one extreme is a separate endorsement for every device (=E2=80=9Cmi= cro endorsement"?), which is what I think Thomas and ARM PSA are tending = towards. The other extreme is one endorsement for a product line = (=E2=80=9Cmacro endorsement"?),, say a product line of TPMs. >>> Nms> I disagree with this characterization of TPMs. Each vendor=E2=80=99= s TPM product is different and has different intrinsic trustworthiness = properties. Many are CC evaluated and some achieve a similar score. That = doesn=E2=80=99t mean they are the same product. >>> Then it=E2=80=99s more like the data sheet for the product. >>> Then there=E2=80=99s different ways to fan this out to the different = key / signing schemes (per-device key, group key, ECDAA, X.509). For = example a macro-endorsement could include the root of an X.509 hierarchy = and the individual devices (or groups of devices) would have individual = keys that chain up. >>> Nms> The root of a X.509 hierarchy is called a =E2=80=9CRoot CA=E2=80=9D= . A policy that accepts a Root CA public key/cert is called a =E2=80=9CTru= st Anchor=E2=80=9D. A trust anchor management protocol that conveys a = trust anchor to a Verifier is an Endorsement of a Root CA that chains to = an attestation key. The Endorsement might be useful for constructing a = policy similar to =E2=80=9CS0=E2=80=9D above. (It isn=E2=80=99t saying = more than that IMO) >>> With a micro-endorsement the per-device public key could be per = endorsement. >>> Nms> I don=E2=80=99t think the architecture should try to define = =E2=80=98micro endorsement=E2=80=99 or =E2=80=98macro endorsement=E2=80=99= . >>> The most important thing about the endorsement seems to me is the = characterization of how the attestation key is protected. >>> Nms> The first line in the Endorsement section of the architecture = document says this almost verbatim. >>> LL >>>=20 >>>=20 >>>> On Apr 7, 2020, at 7:36 AM, Thomas Fossati > wrote: >>>> Hi Laurence, >>>>=20 >>>> Thanks for bringing this up. A few thoughts below. >>>>=20 >>>> On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" >>>> on behalf = oflgl@island-resort.com > wrote: >>>>=20 >>>>> So how does a Verifier find the applicable endorsement for = Evidence it >>>>> wishes to verify and know that is really the right endorsement? >>>>>=20 >>>>> Seems like the Evidence needs some sort of an endorsement locator = ID. >>>>> This could be a URL or a GUID. EAT currently has the origination = claim >>>>> to try to solve this, but it is half-baked. It needs to get fixed. = I=E2=80=99m >>>>> fishing for comments here on what it should be like. >>>>>=20 >>>>> Pretty sure the Endorsement needs to include or reference the = public >>>>> key that is used to verify the signature. Without that, the = Attester >>>>> could lie and pick any old Endorsement that it wishes. There needs = to >>>>> be some binding between items in the endorsement (E0, E1,=E2=80=A6) = and the >>>>> verification key. That could be in the form of a signed token or >>>>> certificate, but doesn=E2=80=99t have to be. Pretty sure this = needs to be >>>>> discussed in the architecture doc. >>>>>=20 >>>>> There's a few scenarios: >>>>> - One endorsement applies to lots of devices in the same class, = but >>>>> each has their own attestation key. >>>>> - - Probably ECDAA fits in here >>>>> - - One option here is an X509 hierarchy >>>>> - Group keys are used (for privacy reasons or other) so there is a >>>>> one-one correlation with the Endorsements (the GEID discussion) >>>>> - Group keys are used, but across devices that have different >>>>> endorsements so there=E2=80=99s no one-one correlation >>>>>=20 >>>>> While the last one seems odd and unlikely, I think it could occur, >>>>> because from a lot of real experience the set up of attestation = keys >>>>> is very idiosyncratic. It is wildly affected by manufacturing = costs >>>>> and issues on assembly lines, sub contractor structure, location = of >>>>> secure facilities and approaches to making money on it. They are = like >>>>> snowflakes, each one is different. So maybe endorsement locator = ID >>>>> and key ID are not the same, but they can be in some use cases? >>>>>=20 >>>>> I am also tempted to encourage the placement of the endorsement >>>>> locator ID in the COSE or JOSE header parameters so you don=E2=80=99= t have to >>>>> parse the unverified body of claims to be able to find the key >>>>> material to verify it. >>>>>=20 >>>>> Thoughts? >>>>=20 >>>> A two level lookup key, model+instance, seems to be quite generally >>>> applicable as an endorsement locator. The model part would get you = to >>>> the shared data (e.g., certification, measured boot KGVs, etc.), = while >>>> the instance part can be used to retrieve device-specific state: >>>> verification key(s) as well as other metadata, e.g., if some gear = is >>>> blacklisted. In PSA we have something quite (though not entirely) >>>> similar with implementation and instance IDs [1] [2]. >>>>=20 >>>> (Context-switching for a second on our previous UEID/GEID = discussion: I >>>> guess we might model an instance as an anonymity set, and therefore >>>> treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?) >>>>=20 >>>> For the sake of building a shared and reusable vocabulary, I'd = prefer >>>> keeping model and instance identifiers as separate claims rather = than >>>> having an opaque endorsement ID claim that clumps together those = and >>>> possibly other stuff in a use-case specific fashion. For the same >>>> reason I would not override key ID with instance ID semantics. >>>>=20 >>>> cheers, thanks! >>>>=20 >>>> = [1]https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-im= plementation-id >>>> = [2]https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-in= stance-id >>>>=20 >>>>=20 >>>>=20 >>>> IMPORTANT NOTICE: The contents of this email and any attachments = are confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. >>>> _______________________________________________ >>>> RATS mailing list >>>> RATS@ietf.org >>>> https://www.ietf.org/mailman/listinfo/rats >>> _______________________________________________ >>> RATS mailing list >>> RATS@ietf.org >>> https://www.ietf.org/mailman/listinfo/rats >> _______________________________________________ >> RATS mailing list >> RATS@ietf.org >> https://www.ietf.org/mailman/listinfo/rats >=20 From nobody Thu Apr 9 13:54:41 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5825A3A0E58 for ; Thu, 9 Apr 2020 13:54:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.797 X-Spam-Level: X-Spam-Status: No, score=-1.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cx8iYdhDFIub for ; Thu, 9 Apr 2020 13:54:36 -0700 (PDT) Received: from p3plsmtpa11-06.prod.phx3.secureserver.net (p3plsmtpa11-06.prod.phx3.secureserver.net [68.178.252.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DD603A0E50 for ; Thu, 9 Apr 2020 13:54:36 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id MeC3j91i1ICrnMeC3jOQRB; Thu, 09 Apr 2020 13:54:36 -0700 X-CMAE-Analysis: v=2.3 cv=PfOBeRpd c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=OUXY8nFuAAAA:8 a=48vgC7mUAAAA:8 a=7CQSdrXTAAAA:8 a=QyXUC8HyAAAA:8 a=K6EGIJCdAAAA:8 a=uherdBYGAAAA:8 a=fmKBIXM_FjfeUhDKJX4A:9 a=Ph_ZfIYJWp0r9FRo:21 a=wj5mFLQXh9uf1LzP:21 a=QEXdDO2ut3YA:10 a=y9OUIGaxdF8A:10 a=kj6DBQF8G6IA:10 a=PAJjY86Ch3NzbNBvD-EA:9 a=xdIHGBkBep6jUAym:21 a=Wbh3PoEnUehGiAX3:21 a=2NEQCHPUeGyBIurI:21 a=_W_S_7VecoQA:10 a=cAcMbU7R10T-QSRYIcO_:22 a=w1C3t2QeGrPiZgrLijVG:22 a=a-qgeE7W1pNrGK8U0ZQC:22 a=L6pVIi0Kn1GYQfi8-iRI:22 a=Ef4yma5cpRUEJWN9UqBm:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: <408AB883-23FC-48AE-8563-426980FC7E81@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_97191D41-A11A-4F69-8465-FCDBDF558971" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 9 Apr 2020 13:54:35 -0700 In-Reply-To: Cc: "rats@ietf.org" , Ned Smith To: Guy Fedorkow References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfEABwAf5vFzq8stzaE+YUnK4I94u88vSrizLLoOEDjekKhJ7AdGYzPqVrjsd88lRMn9Vo6FxmsJqWpxNbGbQnn4ZMa+hx4AzsIy/tl8jT47pfNmXyhMv vpxWxjNmqPtg6eoJv8whAjxYM/3CifhjSjvwDkrqzoIp9e9J4WeFRKCzVzjgM4atKfKaOXzsd+vUmCvUm48UAf9an99jSLoTb/4vFsN8g+MrMYqBjEtUc5Dj Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Apr 2020 20:54:39 -0000 --Apple-Mail=_97191D41-A11A-4F69-8465-FCDBDF558971 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Guy, > On Apr 9, 2020, at 7:31 AM, Guy Fedorkow = wrote: >=20 > Hi Laurence, > I understand that the discussion on the topic below mainly pertains = to EAT, but I=E2=80=99d like to make sure we=E2=80=99re not missing = something on the RIV side. Was trying for a general description into which TPM-based stuff fits = too. > For OS software image integrity using a TPM, it seems like finding = the right manifest shouldn=E2=80=99t be that hard=E2=80=A6 > The Attester needs to have pre-provisioned identity and attestation = keys as outlined in the RIV draft. That provides the Verifier with the = vendor identity for the root of trust.=20 That is to say you have a functioning TPM-based attester. Identity is of = the Attester only, not the OS Software, right? > The measurement logs contain the alleged product name and version = number for the software installed on the box. Are you saying that the OS software will write its product name and = version into a TPM measurement log? > Use the vendor ID to narrow the scope to specific vendor=E2=80=99s = product and version space, and find the RIM that matches. Presumably the vendor of the device, (e.g., Samsung for a phone, Lenovo = for a laptop) since vendor=E2=80=99s customize OS SW. > Then check if the hashes line up; if so, you=E2=80=99re good, if = not, either the claim of what software is present was incorrect, or = something got hacked. Seems like there=E2=80=99s a step of measuring the OS Software missing. = That has to be built into the boot loading sequence to be properly = secure. Step 1 measures the code for Step 2, then Step 2 loads, then = Step 2 measures code for Step 3 all the while recording the measurements = in the TPM. Pretty sure there are lots of OS=E2=80=99s that don=E2=80=99t= know how to put measurements into a TPM. Some TEE-based architectures use the TEE to load and verify a subsystem. = For example a phone might consist of a TEE, a main OS running Android = and some subsystems (Audio, cellular modem=E2=80=A6). The TEE takes care = of the loading and verification of the subsystem SW by reading and = writing into the subsystems memory, then the TEE signals the subsystem = to go out of reset. It more or less booted without the subsystem=E2=80=99s= CPU doing a thing. (And the TEE can later to a run-time integrity check = on it, something you can=E2=80=99t do with a TPM). > Seems like a verifier could follow this same model through the = entire chain of trust, even through multiple vendors, as long as there = are no gaps in the chain. Seems like you need each participant in the chain know how to measure = and write into the TPM. That doesn=E2=80=99t seem likely to happen to me = unless the whole architecture was designed around a TPM. > I know EAT needs to work in a less-constrained environment, but let = me know if you think we=E2=80=99re oversimplifying this on RIV. EAT is intended to work in very constrained environments. If you just = have limited subset of claims, you can build HW to implement EAT. CBOR = is designed well enough that this is possible. > =20 > Thanks Appreciate these discussions as it helps illuminate the core principles = at work on the TPM side and the TEE side. Both are secure, AFAIK :-), = but made different choices and have different capabilities.=20 > /guy > =20 LL > =20 > =20 > Juniper Business Use Only > From: RATS > On = Behalf Of Laurence Lundblade > Sent: Tuesday, April 7, 2020 3:13 PM > To: Thomas Fossati > > Cc: rats@ietf.org ; Ned Smith = > > Subject: Re: [Rats] Endorsement ID and verification key (was = Processing Endorsements and Evidence into Results) > =20 > [External Email. Be cautious of content] > =20 > This is a reply to both Thomas and Ned=E2=80=99s message on debug in = the related threat. > =20 > My inclination is to associate endorsements with time-invariant = characteristics of the device. At the moment this doesn=E2=80=99t seem = like the only way to do it, but it seems like a good way. Things that = are not time invariant are policy, k-g-v or such. > =20 > Endorsement > System architecture =E2=80=94 Does the Attester use a TEE or a TPM or = maybe it is simple system with just a simple CPU, but it is encased in = titanium. Is defense against chip invasive attacks considered? Do keys = become inaccessible when debug is enabled. > =20 > Development process =E2=80=94 Is there a special security-oriented = team? Does the team have a code review policy? Is there a bug bounty? = Are the desktops and IT systems used for HW and SW development isolated? > =20 > Manufacturing =E2=80=94 Are the factories secured in a special way? Is = the attestation key provisioning system hardened in some way (e.g., uses = HSMs). > =20 > Certifications =E2=80=94 These take a long time to achieve and will = usually require some of the above. > =20 > My thinking for EAT was that you only put attestation keys into = devices that meet some criteria like some of the above. Since there is = often no way to recover from a compromised attestation key because no = key more secure than it, you kind of have to have all that.=20 > =20 > Since these don=E2=80=99t change much over time, the endorsement = wouldn=E2=80=99t change. They could even span several models and = varying HW. > =20 > Policy, K-G-V, other > SW Versions =E2=80=94 As long as the SW follows a development process = like that above, it doesn=E2=80=99t have to be included in the = endorsement. Of course the smaller the SW and the better the process, = the more it is true (and vice versa). > =20 > Blacklists =E2=80=94 These might be specific to UEIDs, versions of SW, = deployments a particular OEM or such > =20 > Debug status =E2=80=94 Most of the debug status values can vary on a = day-day basis > =20 > OEM model =E2=80=94 If the attestation is implemented by a chip vendor = and the endorsement is for the chip, then the OEM model will vary = widely. > =20 > None of these can be criteria as to whether an attestation key is put = into a device or not as they are not known at manufacturing time and/or = must be allowed to vary widely after manufacturing. > =20 > =20 > I think what I=E2=80=99ve described above lines up pretty well for a = TPM. The system architecture is mostly set by the TCG. HW TPMs are = almost always certified. They are independent of OEM model. It also = lines up reasonably well with secure elements and can line up with = TEE=E2=80=99s. =20 > =20 > The crux of endorsement to me is the security characteristics of the = attester that protect the attestation key because there is generally no = recovery from a compromised attestation key. It sets the baseline risk = of the HW and SW of the device. > =20 > =20 > On one extreme is a separate endorsement for every device (=E2=80=9Cmicr= o endorsement"?), which is what I think Thomas and ARM PSA are tending = towards. The other extreme is one endorsement for a product line = (=E2=80=9Cmacro endorsement"?),, say a product line of TPMs. Then it=E2=80= =99s more like the data sheet for the product. =20 > =20 > Then there=E2=80=99s different ways to fan this out to the different = key / signing schemes (per-device key, group key, ECDAA, X.509). For = example a macro-endorsement could include the root of an X.509 hierarchy = and the individual devices (or groups of devices) would have individual = keys that chain up. With a micro-endorsement the per-device public key = could be per endorsement. > =20 > =20 > The most important thing about the endorsement seems to me is the = characterization of how the attestation key is protected. > =20 > LL > =20 > =20 > =20 >=20 > On Apr 7, 2020, at 7:36 AM, Thomas Fossati > wrote: > =20 > Hi Laurence, >=20 > Thanks for bringing this up. A few thoughts below. >=20 > On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" > on behalf of = lgl@island-resort.com > wrote: >=20 > So how does a Verifier find the applicable endorsement for Evidence it > wishes to verify and know that is really the right endorsement? >=20 > Seems like the Evidence needs some sort of an endorsement locator ID. > This could be a URL or a GUID. EAT currently has the origination claim > to try to solve this, but it is half-baked. It needs to get fixed. = I=E2=80=99m > fishing for comments here on what it should be like. >=20 > Pretty sure the Endorsement needs to include or reference the public > key that is used to verify the signature. Without that, the Attester > could lie and pick any old Endorsement that it wishes. There needs to > be some binding between items in the endorsement (E0, E1,=E2=80=A6) = and the > verification key. That could be in the form of a signed token or > certificate, but doesn=E2=80=99t have to be. Pretty sure this needs to = be > discussed in the architecture doc. >=20 > There's a few scenarios: > - One endorsement applies to lots of devices in the same class, but > each has their own attestation key. > - - Probably ECDAA fits in here > - - One option here is an X509 hierarchy > - Group keys are used (for privacy reasons or other) so there is a > one-one correlation with the Endorsements (the GEID discussion) > - Group keys are used, but across devices that have different > endorsements so there=E2=80=99s no one-one correlation >=20 > While the last one seems odd and unlikely, I think it could occur, > because from a lot of real experience the set up of attestation keys > is very idiosyncratic. It is wildly affected by manufacturing costs > and issues on assembly lines, sub contractor structure, location of > secure facilities and approaches to making money on it. They are like > snowflakes, each one is different. So maybe endorsement locator ID > and key ID are not the same, but they can be in some use cases? >=20 > I am also tempted to encourage the placement of the endorsement > locator ID in the COSE or JOSE header parameters so you don=E2=80=99t = have to > parse the unverified body of claims to be able to find the key > material to verify it. >=20 > Thoughts? >=20 > A two level lookup key, model+instance, seems to be quite generally > applicable as an endorsement locator. The model part would get you to > the shared data (e.g., certification, measured boot KGVs, etc.), while > the instance part can be used to retrieve device-specific state: > verification key(s) as well as other metadata, e.g., if some gear is > blacklisted. In PSA we have something quite (though not entirely) > similar with implementation and instance IDs [1] [2]. >=20 > (Context-switching for a second on our previous UEID/GEID discussion: = I > guess we might model an instance as an anonymity set, and therefore > treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?) >=20 > For the sake of building a shared and reusable vocabulary, I'd prefer > keeping model and instance identifiers as separate claims rather than > having an opaque endorsement ID claim that clumps together those and > possibly other stuff in a use-case specific fashion. For the same > reason I would not override key ID with instance ID semantics. >=20 > cheers, thanks! >=20 > [1] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-imple= mentation-id = > [2] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-insta= nce-id = >=20 >=20 >=20 > IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_97191D41-A11A-4F69-8465-FCDBDF558971 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Hi Guy,


On Apr = 9, 2020, at 7:31 AM, Guy Fedorkow <gfedorkow@juniper.net> wrote:

Hi = Laurence,
  I understand that the discussion on the topic below = mainly pertains to EAT, but I=E2=80=99d like to make sure we=E2=80=99re = not missing something on the RIV = side.

Was = trying for a general description into which TPM-based stuff fits = too.

  For OS software image integrity = using a TPM, it seems like finding the right manifest shouldn=E2=80=99t = be that hard=E2=80=A6
  The Attester needs to have pre-provisioned identity = and attestation keys as outlined in the RIV draft.  That provides = the Verifier with the vendor identity for the root of = trust. 

That is to say you have a functioning TPM-based = attester. Identity is of the Attester only, not the OS Software, = right?

The measurement logs contain the = alleged product name and version number for the software installed on = the box.

Are = you saying that the OS software will write its product name and version = into a TPM measurement log?

Use the vendor ID to = narrow the scope to specific vendor=E2=80=99s product and version space, = and find the RIM that matches.

Presumably the vendor of the device, (e.g., = Samsung for a phone, Lenovo for a laptop) since vendor=E2=80=99s = customize OS SW.

  Then check if the = hashes line up; if so, you=E2=80=99re good, if not, either the claim of = what software is present was incorrect, or something got = hacked.

Seems= like there=E2=80=99s a step of measuring the OS Software missing. That = has to be built into the boot loading sequence to be properly secure. = Step 1 measures the code for Step 2, then Step 2 loads, then Step 2 = measures code for Step 3 all the while recording the measurements in the = TPM.  Pretty sure there are lots of OS=E2=80=99s that don=E2=80=99t = know how to put measurements into a TPM.

Some TEE-based architectures use the TEE to load = and verify a subsystem. For example a phone might consist of a TEE, a = main OS running Android and some subsystems (Audio, cellular modem=E2=80=A6= ). The TEE takes care of the loading and verification of the subsystem = SW by reading and writing into the subsystems memory, then the TEE = signals the subsystem to go out of reset. It more or less booted without = the subsystem=E2=80=99s CPU doing a thing. (And the TEE can later to a = run-time integrity check on it, something you can=E2=80=99t do with a = TPM).

  Seems like a verifier could = follow this same model through the entire chain of trust, even through = multiple vendors, as long as there are no gaps in the = chain.

Seems = like you need each participant in the chain know how to measure and = write into the TPM. That doesn=E2=80=99t seem likely to happen to me = unless the whole architecture was designed around a TPM.

  I = know EAT needs to work in a less-constrained environment, but let me = know if you think we=E2=80=99re oversimplifying this on = RIV.

EAT is = intended to work in very constrained environments. If you just have = limited subset of claims, you can build HW to implement EAT. CBOR is = designed well enough that this is possible.

 
  = Thanks

Appreciate these discussions as it helps = illuminate the core principles at work on the TPM side and the TEE side. = Both are secure, AFAIK :-), but made different choices and have = different capabilities. 

/guy
 

LL


 
 
Juniper Business = Use Only
From: RATS <rats-bounces@ietf.org> On Behalf = Of Laurence = Lundblade
Sent: Tuesday, April 7, 2020 3:13 = PM
To: Thomas Fossati <Thomas.Fossati@arm.com>
Cc: rats@ietf.org; Ned Smith <ned.smith@intel.com>
Subject: Re: [Rats] Endorsement ID = and verification key (was Processing Endorsements and Evidence into = Results)
 
[External Email. Be cautious of content]
 
This is a reply to both = Thomas and Ned=E2=80=99s message on debug in the related threat.
 
My inclination is to associate = endorsements with time-invariant characteristics of the device. At the = moment this doesn=E2=80=99t seem like the only way to do it, but it = seems like a good way. Things that are not time invariant are policy, = k-g-v or such.
 
Endorsement
System architecture =E2=80=94 Does the Attester use a TEE or = a TPM or maybe it is simple system with just a simple CPU, but it is = encased in titanium. Is defense against chip invasive attacks = considered? Do keys become inaccessible when debug is enabled.
 
Development process =E2=80=94 Is there = a special security-oriented team? Does the team have a code review = policy? Is there a bug bounty? Are the desktops and IT systems used for = HW and SW development isolated?
 
Manufacturing =E2=80=94 Are the factories secured in a = special way? Is the attestation key provisioning system hardened in some = way (e.g., uses HSMs).
 
Certifications =E2=80=94 These take a long time to achieve = and will usually require some of the above.
 
My thinking for EAT was = that you only put attestation keys into devices that meet some criteria = like some of the above. Since there is often no way to recover from a = compromised attestation key because no key more secure than it, you kind = of have to have all that. 
 
Since these don=E2=80=99t change much over time, the = endorsement wouldn=E2=80=99t change.  They could even span several = models and varying HW.
 
Policy, K-G-V, other
SW Versions =E2=80=94 As long as the SW follows a development = process like that above, it doesn=E2=80=99t have to be included in the = endorsement. Of course the smaller the SW and the better the process, = the more it is true (and vice versa).
 
Blacklists =E2=80=94 These might be = specific to UEIDs, versions of SW, deployments a particular OEM or = such
 
Debug status =E2=80=94 Most of the debug status values can = vary on a day-day basis
 
OEM model =E2=80=94 If the attestation is implemented by a = chip vendor and the endorsement is for the chip, then the OEM model will = vary widely.
 
None of these can be criteria as to whether an attestation = key is put into a device or not as they are not known at manufacturing = time and/or must be allowed to vary widely after manufacturing.
 
 
I think what I=E2=80=99ve described above lines up pretty = well for a TPM. The system architecture is mostly set by the TCG. HW = TPMs are almost always certified. They are independent of OEM model. It = also lines up reasonably well with secure elements and can line up with = TEE=E2=80=99s.  
 
The crux of endorsement to me is the security characteristics = of the attester that protect the attestation key because there is = generally no recovery from a compromised attestation key. It sets the = baseline risk of the HW and SW of the device.
 
 
On one extreme is a separate endorsement for every device = (=E2=80=9Cmicro endorsement"?), which is what I think Thomas and ARM PSA = are tending towards. The other extreme is one endorsement for a product = line (=E2=80=9Cmacro endorsement"?),, say a product line of TPMs. = Then it=E2=80=99s more like the data sheet for the product.  
 
Then there=E2=80=99s different ways to = fan this out to the different key / signing schemes (per-device key, = group key, ECDAA, X.509). For example a macro-endorsement could include = the root of an X.509 hierarchy and the individual devices (or groups of = devices) would have individual keys that chain up. With a = micro-endorsement the per-device public key could be per = endorsement.
 
 
The most important thing about the = endorsement seems to me is the characterization of how the attestation = key is protected.
 
LL
 
 

 

On Apr 7, 2020, at 7:36 AM, Thomas Fossati <Thomas.Fossati@arm.com> = wrote:
 

Hi Laurence,

Thanks for bringing this up.  A few = thoughts below.

On 03/04/2020, 20:37, "RATS = on behalf of Laurence Lundblade"
<rats-bounces@ietf.org on behalf of lgl@island-resort.com> = wrote:

So how does a Verifier find the applicable = endorsement for Evidence it
wishes to verify and know that = is really the right endorsement?

Seems like = the Evidence needs some sort of an endorsement locator ID.
This could be a URL or a GUID. EAT currently has the = origination claim
to try to solve this, but it is = half-baked. It needs to get fixed. I=E2=80=99m
fishing for = comments here on what it should be like.

Pretty sure the Endorsement needs to include or reference the = public
key that is used to verify the signature. Without = that, the Attester
could lie and pick any old Endorsement = that it wishes. There needs to
be some binding between = items in the endorsement (E0, E1,=E2=80=A6) and the
verification key. That could be in the form of a signed token = or
certificate, but doesn=E2=80=99t have to be. Pretty = sure this needs to be
discussed in the architecture = doc.

There's a few scenarios:
-= One endorsement applies to lots of devices in the same class, but
 each has their own attestation key.
- - = Probably ECDAA fits in here
- - One option here is an X509 = hierarchy
- Group keys are used (for privacy reasons or = other) so there is a
 one-one correlation with the = Endorsements (the GEID discussion)
- Group keys are used, = but across devices that have different
 endorsements = so there=E2=80=99s no one-one correlation

While the last one seems odd and unlikely, I think it could = occur,
because from a lot of real experience the set up of = attestation keys
is very idiosyncratic. It is wildly = affected by manufacturing costs
and issues on assembly = lines, sub contractor structure, location of
secure = facilities and approaches to making money on it. They are like
snowflakes, each one is different.  So maybe endorsement = locator ID
and key ID are not the same, but they can be in = some use cases?

I am also tempted to = encourage the placement of the endorsement
locator ID in = the COSE or JOSE header parameters so you don=E2=80=99t have to
parse the unverified body of claims to be able to find the = key
material to verify it.

Thoughts?

A two = level lookup key, model+instance, seems to be quite generally
applicable as an endorsement locator.  The model part = would get you to
the shared data (e.g., certification, = measured boot KGVs, etc.), while
the instance part can be = used to retrieve device-specific state:
verification = key(s) as well as other metadata, e.g., if some gear is
blacklisted.  In PSA we have something quite (though not = entirely)
similar with implementation and instance IDs [1] = [2].

(Context-switching for a second on our = previous UEID/GEID discussion: I
guess we might model an = instance as an anonymity set, and therefore
treat EUIDs as = the special case GEIDs with cardinality =3D=3D 1?)

For the sake of building a shared and reusable vocabulary, = I'd prefer
keeping model and instance identifiers as = separate claims rather than
having an opaque endorsement = ID claim that clumps together those and
possibly other = stuff in a use-case specific fashion.  For the same
reason I would not override key ID with instance ID = semantics.

cheers, thanks!

[1] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-implementation-id
[2] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-instance-id



IMPORTANT NOTICE: The contents of this email = and any attachments are confidential and may also be privileged. If you = are not the intended recipient, please notify the sender immediately and = do not disclose the contents to any other person, use it for any = purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_97191D41-A11A-4F69-8465-FCDBDF558971-- From nobody Thu Apr 9 17:01:44 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 218683A1537 for ; Thu, 9 Apr 2020 17:01:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J0KIzZpGTbA7 for ; Thu, 9 Apr 2020 17:01:33 -0700 (PDT) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E52023A153E for ; Thu, 9 Apr 2020 17:01:32 -0700 (PDT) IronPort-SDR: BjsnunqSUaL4axbl7e2iUxknpa2m+ly1pAEnGHiDUmMeMpgLDA7miaLidZba3PpeCCE3TSCOvo RBxgNj9uc/ig== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Apr 2020 17:01:31 -0700 IronPort-SDR: XYBKSRf6rNqXdocDiNv2vTl+knMPgHbYNVjCIOlWtrh6DOuJL8B32fvqlvFB7O6wGRrowosun2 5hhFDPk4KouA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,364,1580803200"; d="scan'208,217";a="287055643" Received: from orsmsx107.amr.corp.intel.com ([10.22.240.5]) by fmsmga002.fm.intel.com with ESMTP; 09 Apr 2020 17:01:30 -0700 Received: from orsmsx115.amr.corp.intel.com (10.22.240.11) by ORSMSX107.amr.corp.intel.com (10.22.240.5) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 9 Apr 2020 17:01:31 -0700 Received: from orsmsx108.amr.corp.intel.com ([169.254.2.172]) by ORSMSX115.amr.corp.intel.com ([169.254.4.102]) with mapi id 14.03.0439.000; Thu, 9 Apr 2020 17:01:31 -0700 From: "Smith, Ned" To: Laurence Lundblade , Henk Berkholz CC: "rats@ietf.org" , Thomas Fossati Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9aqBxq4ObY/kGk1JKQQWkxNahuNTGAgABNSQD//81kgIAB0+WAgAFevYA= Date: Fri, 10 Apr 2020 00:01:30 +0000 Message-ID: References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> <0CE0C60B-79FA-43CF-A445-2EC3B5C767DE@island-resort.com> In-Reply-To: <0CE0C60B-79FA-43CF-A445-2EC3B5C767DE@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.35.20030802 x-originating-ip: [10.255.231.100] Content-Type: multipart/alternative; boundary="_000_EF9AEDD959A8498895BFC1B4A7E7BB79intelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Apr 2020 00:01:43 -0000 --_000_EF9AEDD959A8498895BFC1B4A7E7BB79intelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SW5saW5lIG5tcz4NCg0KRnJvbTogUkFUUyA8cmF0cy1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhh bGYgb2YgTGF1cmVuY2UgTHVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb20+DQpEYXRlOiBX ZWRuZXNkYXksIEFwcmlsIDgsIDIwMjAgYXQgMTowNiBQTQ0KVG86ICJTbWl0aCwgTmVkIiA8bmVk LnNtaXRoQGludGVsLmNvbT4NCkNjOiAicmF0c0BpZXRmLm9yZyIgPHJhdHNAaWV0Zi5vcmc+LCBU aG9tYXMgRm9zc2F0aSA8VGhvbWFzLkZvc3NhdGlAYXJtLmNvbT4NClN1YmplY3Q6IFJlOiBbUmF0 c10gRW5kb3JzZW1lbnQgSUQgYW5kIHZlcmlmaWNhdGlvbiBrZXkgKHdhcyBQcm9jZXNzaW5nIEVu ZG9yc2VtZW50cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzKQ0KDQpIaSBOZWQsDQoNClNlZW1z IGxpa2UgdGhlcmUgaXMgZ2VuZXJhbCBhZ3JlZW1lbnQgb24gdGhlIGNvcmUgcHVycG9zZSBvZiB0 aGUgZW5kb3JzZW1lbnQg4oCUIGRlc2NyaWJpbmcgdGhlIHNlY3VyaXR5IGNoYXJhY3RlcmlzdGlj cyBvZiB0aGUgRW5kb3JzZXIuDQoNCknigJltIG5vdCBhZHZvY2F0aW5nIGFueSBkZWZpbml0aW9u cyBpbiB0aGUgYXJjaGl0ZWN0dXJlIGRvY3VtZW50IGhlcmUuIEkgd2FzIGFmdGVyIHNvbWUgZ2Vu ZXJhbCBjaGFyYWN0ZXJpc3RpY3MgYW5kIGNvbW1vbiB1bmRlcnN0YW5kaW5nLiBJIGtub3cgaW1w bGVtZW50YXRpb25zIGFyZSBnb2luZyB0byB2YXJ5IHdpbGRseS4NCg0KVG8gYmUgbW9yZSBjbGVh ciBvbiDigJxPRU0gbW9kZWzigJ0uIEkgd2FzIHVzaW5nIHRoYXQgdG8gcmVmZXIgdG8gdGhlIGVu ZCBkZXZpY2UgbGlrZSBhIHJvdXRlciwgYSBwaG9uZSBvciBhIHdhc2hpbmcgbWFjaGluZSwgbm90 IHRoZSBtYW51ZmFjdHVyZXIgb2YgYSBjaGlwLCBhIFRQTSBvciBhIFRFRS4gIFRoZSBURUUgbWln aHQgYmUgdGhlIEF0dGVzdGVyDQpObXM+IEkgdGhpbmsgeW91IG1lYW4g4oCYQXR0ZXN0aW5nIEVu dmlyb25tZW504oCZDQphbmQgbWlnaHQgYmUgdGhlIHNhbWUgQXR0ZXN0ZXIgd2l0aCB0aGUgc2Ft ZSBlbmRvcnNlbWVudCB0aGF0IGlzIGluIGJvdGggYSBNb3Rvcm9sYSBwaG9uZSBhbmQgYSBTb255 IHBob25lLCBlYWNoIHdpdGggYSBkaWZmZXJlbnQgT0VNIE1vZGVsIGNsYWltLg0KTm1zPiBSaWdo dC4gVGhhdCB3b3VsZCBiZSB0cnVlIGlmIHRoZSBpbmdyZWRpZW50cyBmb3IgdGhlIEF0dGVzdGlu ZyBFbnZpcm9ubWVudHMgZm9yIHRoZSB2YXJpb3VzIG1vZGVscyB3YXMgdGhlIHNhbWUgc3Vic2V0 LiBUaGUgRW5kb3JzZW1lbnQgY291bGQgYmUgYSBtYW5pZmVzdCBvZiBhIHZhcmlldHkgb2YgaW5n cmVkaWVudHMgdGhhdCBlYWNoIGNvdWxkIGJlIGlkZW50aWZpZWQgaW4gdGVybXMgb2Yge3ZlbmRv ciwgbW9kZWwsIHZlcnNpb259IGluIHNvbWUgc29ydCBvZiBuZXN0aW5nIHN0cnVjdHVyZS4gTWF5 YmUgdGhlcmUgYXJlIHByaXZhY3kgY29uY2VybnMgb3Igd2hhdGV2ZXIsIGJ1dCBtb3N0IHN5c3Rl bXMgaGF2ZSBhIHdheSBvZiByZXBvcnRpbmcgc29tZXRoaW5nIGFib3V0IHdoYXQgaXMgaW5zaWRl IHRoZSBjaGFzc2lzLiBFbmRvcnNlbWVudHMgY291bGQgZm9sbG93IHNvbWV0aGluZyBsaWtlIHRo YXQuIEEgVFBNLCBURUUsIE1DVSBvciBvdGhlciB0ZWNobm9sb2d5IGNvdWxkIGJlIHBhcnQgb2Yg dGhlIEF0dGVzdGluZyBFbnZpcm9ubWVudC4gVGhlIEVuZG9yc2VtZW50IGNvdWxkIGJlIGV4cGxp Y2l0IGFib3V0IHRoYXQuIFNpbmNlIHRoZXJlIGlzIGEg4oCYcm9vdOKAmSBBdHRlc3RpbmcgRW52 aXJvbm1lbnQgKG9uZSB0aGF0IGlzIHRoZSBib3R0b20gbGF5ZXIpLCB0aGUgRW5kb3JzZW1lbnQg aXMgdGhlIG9ubHkgbWVjaGFuaXNtIGZvciBjb21tdW5pY2F0aW5nIHRoZXNlIGRldGFpbHMgdG8g dGhlIFZlcmlmaWVyLiBBdHRlc3RhdGlvbiBkb2VzbuKAmXQgd29yayBleGNlcHQgYXMgYW4gaW50 cm9zcGVjdGlvbiAod2hpY2ggc29tZSBiZWxpZXZlIGhhcyBzZWN1cml0eSBjaGFsbGVuZ2VzKS4N Cg0KV2hlbiBJIHdhcyByZWZlcnJpbmcgdG8gYSDigJxwcm9kdWN0IGxpbmUgb2YgVFBNc+KAnSwg SSB3YXMgdGhpbmtpbmcgb2Ygc2V2ZXJhbCB2ZXJ5IHNpbWlsYXIgbW9kZWxzIGZyb20gdGhlIHNh bWUgVFBNIHZlbmRvci4gU2VlbXMgbGlrZSB0aGlzIHdvdWxkIHNoYXJlIHRoZSBtb3JlIGludmFy aWFudCBjaGFyYWN0ZXJpc3RpY3Mgb2YgYSBFbmRvcnNlbWVudCBhbmQgbWF5YmUgY291bGQgc2hh cmUgYW4gRW5kb3JzZW1lbnQuIEhvd2V2ZXIsIEkgaGF2ZSBubyBzdHJvbmcgc2Vuc2UgdGhhdCBp dCBoYXMgdG8gYmUgb25lIHdheSBvciB0aGUgb3RoZXIuDQpObXM+IEkgdGhpbmsgaXQgaXMgY29y cmVjdCBmb3IgRW5kb3JzZW1lbnRzIHRvIHByb3ZpZGUgdmVjdG9ycyBvZiBpbnRlcmNoYW5nZWFi bGUgcGFydHMgZm9yIGEgZ2l2ZW4gc3lzdGVtLiBGb3IgZXhhbXBsZSwgbWFueSBPRU1zIHNvdXJj ZSB0aGUg4oCYc2FtZeKAmSBwYXJ0IGZyb20gbXVsdGlwbGUgc3VwcGxpZXJzIHRvIGVuc3VyZSB0 aGVyZSBpcyByZWR1bmRhbmN5IGluIHRoZSBzdXBwbHkgY2hhaW4uIFRoZSBwYXJ0cyBoYXZlIGRp ZmZlcmVudCB2ZW5kb3IsIG1vZGVsLCB2ZXJzaW9uIGJ1dCBjb21wbHkgdG8gYSBzdGFuZGFyZCBz ZXQgb2YgaW50ZXJmYWNlIHNwZWNzIHNvIHRoYXQgcGFydHMgY2FuIGJlIGludGVyY2hhbmdlYWJs ZS4gQW4gRW5kb3JzZW1lbnQgbWlnaHQgbGlzdCBhbGwgb2YgdGhlIHBvc3NpYmxlIHN1cHBsaWVy cyBmb3IgdGhlIHNhbWUg4oCYc3BlY+KAmSBwYXJ0LiBJZiB0aGF0IGlzIHRoZSBjYXNlLCB0aGVu IGF0dGVzdGF0aW9uIEV2aWRlbmNlIGlkZW50aWZpZXMgd2hpY2ggb2YgdGhlIHZhcmlvdXMgcG9z c2liaWxpdGllcyB3YXMgY2hvc2VuLg0KDQpUaGVyZSBpcyBhIHBvc3NpYmlsaXR5IHdoZXJlIGFu IOKAnGludHJvc3BlY3Rpb27igJ0gY2FzZSBjb3VsZCBleGlzdCBmb3IgdGhlIOKAmHJvb3TigJkg QXR0ZXN0aW5nIEVudmlyb25tZW50IHdoZXJlIHRoZSBPRU0gc291cmNlcyBtdWx0aXBsZSBzdXBw bGllcnMgZm9yIHRoZSBzYW1lIOKAmHNwZWPigJkgcGFydHMgYW5kIHRoZSBBdHRlc3RpbmcgRW52 aXJvbm1lbnQgbWF5IGJlIHRoZSBvbmx5IGF2YWlsYWJsZSBlbnRpdHkgdG8gZGlzYW1iaWd1YXRl IHdoaWNoIHN1cHBsaWVy4oCZcyBwYXJ0IHdhcyBjaG9zZW4uIEl0IG1heSBhbHNvIGJlIHRoZSBj YXNlIHRoYXQgdGhlIHBhcnQgaXNu4oCZdCBzZWxmLWF3YXJlIGFuZCB0aGVyZWZvcmUgcmVtYWlu cyBzaWxlbnQuIFRoZSBWZXJpZmllciBtYXkgaGF2ZSB0byBjb25jbHVkZSB0aGF0IHRoZSByb290 IEF0dGVzdGluZyBFbnZpcm9ubWVudCBpcyBlaXRoZXIgdmVuZG9yLUEgb3IgdmVuZG9yLUIgKGJh c2VkIG9uIHRoZSBFbmRvcnNlbWVudCB2ZWN0b3IpLCBidXQgZG9lc27igJl0IGtub3cgd2hpY2gu IFZlcmlmaWVyIFBvbGljeSBoYXMgdG8gYWxsb3cgYm90aCB2ZW5kb3LigJlzIHNwZWMgcGFydCBz aW5jZSBpdCBjYW7igJl0IHRlbGwgdGhlIGRpZmZlcmVuY2UuIElmIGEgZmxhdyB3YXMgZm91bmQg aW4gb25lIHZlbmRvcuKAmXMgc3BlYyBwYXJ0IGJ1dCBub3QgdGhlIG90aGVyIHZlbmRvcuKAmXMg cGFydCBib3RoIHdvdWxkIGhhdmUgdG8gYmUgZGlzYWxsb3dlZCBzaW5jZSBpdCBjYW7igJl0IHRl bGwgd2hpY2ggdmVuZG9y4oCZcyBwYXJ0IHdhcyB1c2VkLg0KDQpJZGVhbGx5LCB0aGVzZSBjb3Ju ZXIgY2FzZXMgd291bGQgYmUgbWluaW1pemVkIGluIGltcGxlbWVudGF0aW9ucy4NCg0KRnJvbSBh IGRlZmluaXRpb25hbCBwZXJzcGVjdGl2ZSwgRW5kb3JzZW1lbnQgZGF0YSBkZWZpbml0aW9uIHNo b3VsZCBhbnRpY2lwYXRlIHRoZSBwb3NzaWJpbGl0eSBvZiBtdWx0aXBsZSBpbnN0YW5jZXMgKHN1 cHBsaWVycykgZm9yIHRoZSBzYW1lIOKAmHNwZWPigJkgcGFydC4gV2hlcmVhcyBmb3IgRXZpZGVu Y2UsIGl0IG1heSBiZSBhZGVxdWF0ZSBpZiBpdCBvbmx5IHN1cHBvcnRlZCAwIG9yIDEgb2NjdXJy ZW5jZXMgb2YgdGhlIOKAmHNwZWPigJkgcGFydC4NCg0KDQpPbmUgb2YgdGhlIG1haW4gcmVhc29u cyBJ4oCZdmUgZHVnIGludG8gYWxsIHRoaXMgaXMgdG8gdHJ5IHRvIHVuZGVyc3RhbmQgaG93IEVu ZG9yc2VtZW50cyBhbmQgVmVyaWZpY2F0aW9uIEtleXMgYXJlIGlkZW50aWZpZWQgaW4gdGhlIEV2 aWRlbmNlDQpObXM+IEkgdGhpbmsgb2YgRW5kb3JzZW1lbnRzIGFzIOKAmGNsYXNz4oCZIHN0cnVj dHVyZXMgd2hlcmUgYW4gRW5kb3JzZW1lbnQgcmVwcmVzZW50cyBhIGNsYXNzIG9mIHNvbWV0aGlu ZywgZm9yIGV4YW1wbGUgYW4gaVBob25lIDgrLiBFdmlkZW5jZSByZXByZXNlbnRzIGFuIOKAmGlu c3RhbmNl4oCZIG9mIHNvbWV0aGluZywgZm9yIGV4YW1wbGUgYW5kIGlQaG9uZSA4KyB3aXRoIHRo ZSBzZXJpYWwgbnVtYmVyIFhZWi4gVGhlIGtleSBpcyB1c2VkIHRvIGF1dGhlbnRpY2F0ZSB0aGUg aW5zdGFuY2UgKG5vdCBuZWNlc3NhcmlseSBpZGVudGlmeSBpdCkuIEZvciBleGFtcGxlLCBpZiB0 aGUga2V5IHdhcyBhIGdyb3VwIGtleSBsaWtlIERBQSAvIEVQSUQgdGhlbiBrbm93bGVkZ2Ugb2Yg dGhlIGtleSB3b3VsZCBub3QgYmUgc3VmZmljaWVudCB0byBuYXJyb3cgZG93biB0byBhbiBpbnN0 YW5jZS4gWW91IHN0aWxsIG5lZWQgc29tZXRoaW5nIGxpa2Ugc2VyaWFsIG51bWJlciBvciBVRUlE LiBFdmlkZW5jZSB0aGVyZWZvcmUgc2hvdWxkIGNvbnRhaW4g4oCYaW5zdGFuY2XigJkgaWRlbnRp ZmllcihzKSBhcyBjbGFpbXMuIFRoZSBrZXlzIGFyZSBleHRlcm5hbCB0byBFdmlkZW5jZS4gVGhl cmVmb3JlLCB0aGUgd29yZGluZyDigJxWZXJpZmljYXRpb24gS2V5cyBhcmUgaWRlbnRpZmllZCBp biB0aGUgRXZpZGVuY2XigJ0gc2VlbXMgaW5jb3JyZWN0IGJlY2F1c2UgdGhlIGluc3RhbmNlIGlk ZW50aWZpZXIgZG9lc27igJl0IG5lY2Vzc2FyaWx5IGhhdmUgdG8gYmUgYSBrZXkuIEl0IGlzIHBv c3NpYmxlIHRvIGdlbmVyYXRlIGFuIGluc3RhbmNlIGlkZW50aWZpZXIgZnJvbSBhIGtleSwgYnV0 IHRoYXQgaXMgZGlmZmVyZW50IGZyb20gYmVpbmcgdGhlIGtleS4NCg0Kc28gd2UgY2FuIGRlZmlu ZSB3aGF0IGlzIG5lZWRlZCBpbiBFQVQuIFRoYXQgd2FzIHRoZSBtYWluIHJlYXNvbiBmb3IgZGlz dGluZ3Vpc2hpbmcgbWljcm8gYW5kIG1hY3JvIGVuZG9yc2VtZW50cy4gSXQgaXMgbm90IHRvIGhh dmUgdGhlbSBmb3JtYWxseSBkZWZpbmVkLg0KDQpUaG9tYXPigJkgY29tbWVudHMgd2hlcmUgcmVh bGx5IGVubGlnaHRlbmluZyBhcyB0byBob3cgQVJNIFBTQSBpcyB0aGlua2luZyBvZiB0aGlzIChh bmQgaG93IGl0IHdhcyBxdWl0ZSBkaWZmZXJlbnQgZnJvbSBtaW5lKS4NCg0KSSBoYXZlbuKAmXQg Y29tZSB0byBhbnkgY29uY2x1c2lvbnMgeWV0LiBXb3VsZCBiZSBpbnRlcmVzdGVkIHRvIHVuZGVy c3RhbmQgaG93IGlkZW50aWZpY2F0aW9uIG9mIGEgcGFydGljdWxhciBLZXkgY29tZSBmcm9tIGEg cGFydGljdWxhciBFbmRvcnNlbWVudA0KTm1zPiBHaXZlbiB0aGUgYWJvdmUgZXhwbGFuYXRpb24g b2YgY2xhc3MgYW5kIGluc3RhbmNlIGlkZW50aWZpZXJzIGFuZCB0aGVpciByZWxhdGlvbnNoaXAg dG8gRW5kb3JzbWVudHMgYW5kIEV2aWRlbmNlLCBkb2VzIGl0IHN0aWxsIG1ha2Ugc2Vuc2UgdG8g cG9zZSB0aGUgcXVlc3Rpb24gYXMg4oCcaG93IGlkZW50aWZpY2F0aW9uIG9mIGEgcGFydGljdWxh ciBLZXkgY29tZSBmcm9tIGEgcGFydGljdWxhciBFbmRvcnNlbWVudOKAnT8NCg0Kd2hpY2ggY29t ZXMgZnJvbSBmaWVsZHMgQ09TRSAvIEpPU0UgaGVhZGVycyBhbmQgLyBvciBjb250YWluZWQgY2xh aW1zIGZvciBsb3RzIG9mIGRpZmZlcmVudCBpbnN0YW50aWF0aW9ucyBhbmQgaW1wbGVtZW50cyBv ZiBvZiBSQVRTIHByb3RvY29scy4NCk5tcz4gSSB0aGluayBvZiB0aGUgVmVyaWZpZXLigJlzIHRh c2sgYXMgcHJpbWFyaWx5IG5lZWRpbmcgdG87IGZvciBlYWNoIGNsYWltIGluIHRoZSBFdmlkZW5j ZSwgKGEpIHNlbGVjdCBmcm9tIGEgbGlzdCBvZiBwb3NzaWJsZSByZWZlcmVuY2Ugc3lub255bSBj bGFpbXMgYW5kIChiKSBtYXRjaCB0aGUgRXZpZGVuY2UgY2xhaW0gd2l0aCBvbmUgaW4gdGhlIGxp c3QuDQoNCk5tcz4gVGhlIFZlcmlmaWVyIG5lZWRzIGVub3VnaCBjb250ZXh0IGFib3V0IGhvdyB0 aGUgZGV2aWNlIGlzIGNvbnN0cnVjdGVkIChlLmcuIHN1Ym1vZD8gY29udGV4dCkgdG8ga25vdyB3 aGljaCBFbmRvcnNlbWVudHMgc2hvdWxkIGJlIHVzZWQgYXMgdGhlIHJlZmVyZW5jZSBjbGFpbXMg Zm9yIGEgZ2l2ZW4gRXZpZGVuY2UgY2xhaW0uIFRoZSBjb252ZXlhbmNlIHByb3RvY29sIGFuZCBh dHRlc3RhdGlvbiBrZXkgcGxheSBhIHJvbGUgaW4gZXN0YWJsaXNoaW5nIHRoaXMgY29udGV4dCwg YnV0IEkgZG9u4oCZdCB0aGluayB0aGUgYXJjaGl0ZWN0dXJlIGhhcyBiZWVuIGZsZXNoZWQgb3V0 IGVub3VnaCB5ZXQuIEZvciBleGFtcGxlLCBpdCBtaWdodCBiZSBuZWNlc3NhcnkgZm9yIEVuZG9y c2VtZW50cyB0byBiZSBzdHJ1Y3R1cmVkIGFjY29yZGluZyB0byBhIHN1Ym1vZHMtbGlrZSDigJxi aWxsLW9mLW1hdGVyaWFsc+KAnSBhbmQgZ2l2ZW4gYSBzb3J0IG9mIHJlY29yZCBpZGVudGlmaWVy IHRoYXQgY2FuIGJlIGluY2x1ZGVkIHdpdGggKGluPykgdGhlIEV2aWRlbmNlIHNvIHRoZSBWZXJp ZmllciBrbm93cyBob3cgdG8gYXNrIGZvciB0aGUgYXBwcm9wcmlhdGUgRW5kb3JzZW1lbnQgcmVj b3Jkcy4gSXQgaXMgYWxzbyBwb3NzaWJsZSB0aGF0IHRoZSBjb252ZXlhbmNlIHByb3RvY29sIGNv dWxkIGNvbnZleSB0aGUgRW5kb3JzZW1lbnQgcmVjb3JkcyBkaXJlY3RseSBpZiB0aGV5IGhhcHBl biB0byBiZSBhdmFpbGFibGUgb24gdGhlIEF0dGVzdGVyLiBCdXQgaXQgaXMgc3RpbGwgbmVjZXNz YXJ5IGZvciB0aGUgVmVyaWZpZXIgdG8gY29ycmVsYXRlIHdoaWNoIEVuZG9yc2VtZW50IHJlY29y ZCBjb3JyZXNwb25kcyB0byB3aGljaCBwaWVjZSBvZiBFdmlkZW5jZS4gQSDigJhwaWVjZSBvZiBF dmlkZW5jZeKAmSBjb3VsZCBiZSBuZXN0ZWQgKGUuZy4gc3VibW9kPykgY29uc2lzdGluZyBvZiBz dGlsbCBvdGhlciDigJhwaWVjZXMgb2YgZXZpZGVuY2XigJkgZXRj4oCmIFRoaXMgYWxzbyBpbXBs aWVzIHRoZSBFbmRvcnNlbWVudCByZWNvcmQgcmVmZXJlbmNlKHMpIGlzKGFyZSkga25vd24gYnkg dGhlIEF0dGVzdGluZyBFbnZpcm9ubWVudCBhdCB0aGUgdGltZSBFdmlkZW5jZSBpcyBjb252ZXll ZC4gKCpNYXliZSB0aGlzIHNob3VsZCBiZSBhZGRlZCBhcyBhbiBpc3N1ZSB0byB0aGUgYXJjaCBk cmFmdD8qKQ0KDQpASGVuayBCZXJraG9sejxtYWlsdG86aGVuay5iaXJraG9sekBzaXQuZnJhdW5o b2Zlci5kZT4g4oCTIERvZXMgQ29TV0lEIGhhdmUgdGhlIGVxdWl2YWxlbnQgb2YgYSByZWNvcmQg aWRlbnRpZmllciBmb3Igc29tZXRoaW5nIHRoYXQgaXMgbGlrZSBhIHN1Yi1jb21wb25lbnQgb2Yg c29tZXRoaW5nIGVsc2U/IC9SZXNvdXJjZS8gZG9lc27igJl0IGFsbG93IG5lc3RpbmcgYW5kIC9G aWxlLyBzZWVtcyB0byBiZSBvdmVybG9hZGluZyB3aGF0IHdhcyBvcmlnaW5hbGx5IGludGVuZGVk LiBPZiBjb3Vyc2UgL1Jlc291cmNlLyBjb3VsZCByZWZlciB0byBhIFVDQ1MgKGh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1iaXJraG9sei1yYXRzLXVjY3MtMDApIHdoaWNoIGFsbG93 cyBuZXN0aW5nLg0KDQpMTA0KDQoNCg0KDQpPbiBBcHIgNywgMjAyMCwgYXQgNDoxMSBQTSwgU21p dGgsIE5lZCA8bmVkLnNtaXRoQGludGVsLmNvbTxtYWlsdG86bmVkLnNtaXRoQGludGVsLmNvbT4+ IHdyb3RlOg0KDQpTZWUgaW5saW5lIG5tcz4NCg0KRnJvbTogUkFUUyA8cmF0cy1ib3VuY2VzQGll dGYub3JnPG1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBiZWhhbGYgb2YgTGF1cmVu Y2UgTHVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQtcmVz b3J0LmNvbT4+DQpEYXRlOiBUdWVzZGF5LCBBcHJpbCA3LCAyMDIwIGF0IDEyOjEyIFBNDQpUbzog VGhvbWFzIEZvc3NhdGkgPFRob21hcy5Gb3NzYXRpQGFybS5jb208bWFpbHRvOlRob21hcy5Gb3Nz YXRpQGFybS5jb20+Pg0KQ2M6ICJyYXRzQGlldGYub3JnPG1haWx0bzpyYXRzQGlldGYub3JnPiIg PHJhdHNAaWV0Zi5vcmc8bWFpbHRvOnJhdHNAaWV0Zi5vcmc+PiwgIlNtaXRoLCBOZWQiIDxuZWQu c21pdGhAaW50ZWwuY29tPG1haWx0bzpuZWQuc21pdGhAaW50ZWwuY29tPj4NClN1YmplY3Q6IFJl OiBbUmF0c10gRW5kb3JzZW1lbnQgSUQgYW5kIHZlcmlmaWNhdGlvbiBrZXkgKHdhcyBQcm9jZXNz aW5nIEVuZG9yc2VtZW50cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzKQ0KDQpUaGlzIGlzIGEg cmVwbHkgdG8gYm90aCBUaG9tYXMgYW5kIE5lZOKAmXMgbWVzc2FnZSBvbiBkZWJ1ZyBpbiB0aGUg cmVsYXRlZCB0aHJlYXQuDQoNCk15IGluY2xpbmF0aW9uIGlzIHRvIGFzc29jaWF0ZSBlbmRvcnNl bWVudHMgd2l0aCB0aW1lLWludmFyaWFudCBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGRldmljZS4g QXQgdGhlIG1vbWVudCB0aGlzIGRvZXNu4oCZdCBzZWVtIGxpa2UgdGhlIG9ubHkgd2F5IHRvIGRv IGl0LCBidXQgaXQgc2VlbXMgbGlrZSBhIGdvb2Qgd2F5LiBUaGluZ3MgdGhhdCBhcmUgbm90IHRp bWUgaW52YXJpYW50IGFyZSBwb2xpY3ksIGstZy12IG9yIHN1Y2guDQpObXM+IENlcnRhaW5seSBh bnkgcHJvcGVydHkgdGhhdCBpcyB0aW1lIGludmFyaWFudCAoYWJvdXQgdGhlIGRldmljZSkgY2Fu IGJlIGV4cGxpY2l0bHkgY2FwdHVyZWQgaW4gRW5kb3JzZW1lbnRzLiBTaW5jZSB0aGV5IGFyZSB0 aW1lLWludmFyaWFudCBpdCBkb2VzbuKAmXQgbWFrZSBzZW5zZSB0byBBdHRlc3QgdG8gdGhlbSBp biBFdmlkZW5jZSAodGhleSB3aWxsIGFsd2F5cyBiZSB0aGUgc2FtZSByZXN1bHQpLiBJIGRpc2Fn cmVlIHRoYXQgRW5kb3JzZW1lbnQgTVVTVCBPTkxZIGJlIHRpbWUgaW52YXJpYW50IGNsYWltcyBo b3dldmVyLg0KTm1zPiBOb3Qgc3VyZSBpZiB0aGUgcXVlc3Rpb25zIGJlbG93IGFyZSByaGV0b3Jp Y2FsLg0KDQpFbmRvcnNlbWVudA0KU3lzdGVtIGFyY2hpdGVjdHVyZSDigJQgRG9lcyB0aGUgQXR0 ZXN0ZXIgdXNlIGEgVEVFIG9yIGEgVFBNIG9yIG1heWJlIGl0IGlzIHNpbXBsZSBzeXN0ZW0gd2l0 aCBqdXN0IGEgc2ltcGxlIENQVSwgYnV0IGl0IGlzIGVuY2FzZWQgaW4gdGl0YW5pdW0uIElzIGRl ZmVuc2UgYWdhaW5zdCBjaGlwIGludmFzaXZlIGF0dGFja3MgY29uc2lkZXJlZD8gRG8ga2V5cyBi ZWNvbWUgaW5hY2Nlc3NpYmxlIHdoZW4gZGVidWcgaXMgZW5hYmxlZC4NCg0KRGV2ZWxvcG1lbnQg cHJvY2VzcyDigJQgSXMgdGhlcmUgYSBzcGVjaWFsIHNlY3VyaXR5LW9yaWVudGVkIHRlYW0/IERv ZXMgdGhlIHRlYW0gaGF2ZSBhIGNvZGUgcmV2aWV3IHBvbGljeT8gSXMgdGhlcmUgYSBidWcgYm91 bnR5PyBBcmUgdGhlIGRlc2t0b3BzIGFuZCBJVCBzeXN0ZW1zIHVzZWQgZm9yIEhXIGFuZCBTVyBk ZXZlbG9wbWVudCBpc29sYXRlZD8NCg0KTWFudWZhY3R1cmluZyDigJQgQXJlIHRoZSBmYWN0b3Jp ZXMgc2VjdXJlZCBpbiBhIHNwZWNpYWwgd2F5PyBJcyB0aGUgYXR0ZXN0YXRpb24ga2V5IHByb3Zp c2lvbmluZyBzeXN0ZW0gaGFyZGVuZWQgaW4gc29tZSB3YXkgKGUuZy4sIHVzZXMgSFNNcykuDQoN CkNlcnRpZmljYXRpb25zIOKAlCBUaGVzZSB0YWtlIGEgbG9uZyB0aW1lIHRvIGFjaGlldmUgYW5k IHdpbGwgdXN1YWxseSByZXF1aXJlIHNvbWUgb2YgdGhlIGFib3ZlLg0KDQpNeSB0aGlua2luZyBm b3IgRUFUIHdhcyB0aGF0IHlvdSBvbmx5IHB1dCBhdHRlc3RhdGlvbiBrZXlzIGludG8gZGV2aWNl cyB0aGF0IG1lZXQgc29tZSBjcml0ZXJpYSBsaWtlIHNvbWUgb2YgdGhlIGFib3ZlLiBTaW5jZSB0 aGVyZSBpcyBvZnRlbiBubyB3YXkgdG8gcmVjb3ZlciBmcm9tIGEgY29tcHJvbWlzZWQgYXR0ZXN0 YXRpb24ga2V5IGJlY2F1c2Ugbm8ga2V5IG1vcmUgc2VjdXJlIHRoYW4gaXQsIHlvdSBraW5kIG9m IGhhdmUgdG8gaGF2ZSBhbGwgdGhhdC4NCk5tcz4gVGhlIGlkZWEgdGhhdCBhIGRldmljZSBoYXMg YW4gQXR0ZXN0aW5nIEVudmlyb25tZW50KHMpIGFuZCBUYXJnZXQgRW52aXJvbm1lbnQocykgaW1w bGllcyB0aGUgQXR0ZXN0aW5nIEVudmlyb25tZW50IGlzL3Nob3VsZCBiZSBtb3JlIGhhcmRlbmVk IGlzIHdoYXQgc29tZSByZWZlciB0byBhcyBSb290LW9mLVRydXN0LiBUaGUgdGVjaG5pcXVlcyBm b3IgcHJvdGVjdGluZyB0aGUgQXR0ZXN0aW5nIEVudmlyb25tZW50IHNob3VsZCBiZSBpbW11dGFi bGUvaW52YXJpYW50IHdoaWNoIGlzIHdoeSBzb21lIHVzZSB0aGUgdGVybSDigJxIYXJkd2FyZSBS b290IG9mIFRydXN04oCdIHdoZW4gZGVzY3JpYmluZyBhbiBpZGVhbCBBdHRlc3RpbmcgRW52aXJv bm1lbnQuDQoNClNpbmNlIHRoZXNlIGRvbuKAmXQgY2hhbmdlIG11Y2ggb3ZlciB0aW1lLCB0aGUg ZW5kb3JzZW1lbnQgd291bGRu4oCZdCBjaGFuZ2UuDQpObXM+IFRoZSBFbmRvcnNlbWVudCBjb252 ZXlzIHRoZSBpbW11dGFiaWxpdHkgLyBwcm9wZXJ0eSBvZiB0aW1lIGludmFyaWFuY2UgdG8gdGhl IFZlcmlmaWVyLiBJdCBkZXNjcmliZXMgdGhlIFJvb3Qgb2YgVHJ1c3QgLyBBdHRlc3RpbmcgRW52 LiAgV2hlcmUgdGhlIGF0dGVzdGF0aW9uIGtleSBpcyBoZWxkIGJlY2F1c2UgaWYgdGhlIHJvb3Qg YXR0ZXN0YXRpb24gc3ViLXN5c3RlbSBpcyBicm9rZW4gdGhlcmUgaXMgbm8gb3RoZXIgcHJvdGVj dGlvbiBtZWNoYW5pc20gdG8gZmFsbCBiYWNrIG9uIGZvciByZWNvdmVyeSB0aGF0IGRvZXNu4oCZ dCBpbnZvbHZlIHBoeXNpY2FsIHJlbWVkaWF0aW9uLg0KDQogVGhleSBjb3VsZCBldmVuIHNwYW4g c2V2ZXJhbCBtb2RlbHMgYW5kIHZhcnlpbmcgSFcuDQpObXM+IE9yIG5vdC4gSXQgZGVwZW5kcyBv biB0aGUgc3lzdGVtIGFyY2hpdGVjdHVyZS4NCg0KUG9saWN5LCBLLUctViwgb3RoZXINCk5tcz4g UG9saWN5IChha2EgQXBwcmFpc2FsIFBvbGljeSBmb3IgRXZpZGVuY2UsIEFwcHJhaXNhbCBQb2xp Y3kgZm9yIEF0dGVzdGF0aW9uIFJlc3VsdHMpIGlzIGRpZmZlcmVudCBmcm9tIEVuZG9yc2VtZW50 LiBLbm93biBHb29kIFZhbHVlcyBhcmUgc3lub255bW91cyB3aXRoIEVuZG9yc2VtZW50LiBUaGUg YXJjaGl0ZWN0dXJlIHVzZXMgb25lIHdvcmQgdG8gY2FwdHVyZSBhIHZhcmlldHkgb2YgcG9zc2li bGUgY2xhaW1zIHRoYXQgc3VwcGx5IGNoYWluIGVudGl0aWVzIGNhbiBjb252ZXkgdG8gVmVyaWZp ZXJzLiBJIGRvbuKAmXQgdGhpbmsgaXQgbWFrZXMgc2Vuc2UgdG8gY29uZmxhdGUgUG9saWN5IHdp dGggRW5kb3JzZW1lbnRzLiBJdCBtaWdodCBtYWtlIHNlbnNlIGZvciBQb2xpY3kgdG8gaGF2ZSBh biBvcGluaW9uIGFzIHRvIHdoYXQgaXMg4oCYZ29vZOKAmS4gQnV0IGl0IGlzIGEgY2FzZSBvZiBh biBPd25lciBkZWNpZGluZyB2cy4gdGhlIG1hbnVmYWN0dXJlci4gSXQgaXMgYXBwcm9wcmlhdGUg Zm9yIGJvdGggdG8gaGF2ZSBzb21ldGhpbmcgdG8gc2F5IGFib3V0IHRoZSBjbGFpbS4NClNXIFZl cnNpb25zIOKAlCBBcyBsb25nIGFzIHRoZSBTVyBmb2xsb3dzIGEgZGV2ZWxvcG1lbnQgcHJvY2Vz cyBsaWtlIHRoYXQgYWJvdmUsDQoNCml0IGRvZXNu4oCZdCBoYXZlIHRvIGJlIGluY2x1ZGVkIGlu IHRoZSBlbmRvcnNlbWVudC4NCk5tcz4gSSBkaXNhZ3JlZSB3aXRoIHRoaXMgY29uY2x1c2lvbi4g VGhlIHZlbmRvciBkZXRlcm1pbmVzIHdoaWNoIHZlcnNpb24gc3RyaW5nIGlzIGFwcGxpZWQgdG8g U1cgaXQgcHJvZHVjZXMuIFRoYXQgdmFsdWUgaXMgYW4gYXNzZXJ0aW9uIG9ubHkgdGhlIFNXIHZl bmRvciBjYW4gbWFrZS4gT3duZXIgUG9saWN5IGNhbiBzYXkgdGhhdCB0aGUgdmVyc2lvbiBpcyDi gJhnb29k4oCZIG9yIOKAmGJhZOKAmSBvciDigJh1bmtub3du4oCZIGJ1dCBjYW7igJl0IHNheSB0 aGF0IHRoZSB2ZXJzaW9uIGlzIFguDQoNCk9mIGNvdXJzZSB0aGUgc21hbGxlciB0aGUgU1cgYW5k IHRoZSBiZXR0ZXIgdGhlIHByb2Nlc3MsIHRoZSBtb3JlIGl0IGlzIHRydWUgKGFuZCB2aWNlIHZl cnNhKS4NCg0KQmxhY2tsaXN0cyDigJQgVGhlc2UgbWlnaHQgYmUgc3BlY2lmaWMgdG8gVUVJRHMs IHZlcnNpb25zIG9mIFNXLCBkZXBsb3ltZW50cyBhIHBhcnRpY3VsYXIgT0VNIG9yIHN1Y2gNCk5t cz4gTWFueSBlbnRpdGllcyBjYW4gcHJvZHVjZSBibGFjay93aGl0ZSBsaXN0cyBsZWdpdGltYXRl bHkuIElmIHRoZSBlbnRpdHkgaXMgaW4gdGhlIHN1cHBseSBjaGFpbiB0aGUgYXNzZXJ0aW9uIGlz IGFuIEVuZG9yc2VtZW50LiBJZiB0aGUgZW50aXR5IGlzIGFuIE93bmVyIHRoZW4gdGhlIGFzc2Vy dGlvbiBpcyBhIFBvbGljeS4gVGhlIGRpZmZlcmVuY2UgaXMgaW4gaG93IHRoZSBWZXJpZmllciB0 cmVhdHMgRW5kb3JzZW1lbnRzIHZzLiBQb2xpY2llcy4NCkV4YW1wbGU6DQogICAgICBTMCkgRW5k b3JzZXIgRTAgc2F5cyBLZXkgS0Qgc3BlYWtzIGZvciBEZXZpY2UgRA0KUzEpIEF0dGVzdGVyIEtE IHNheXMgU1cgUyBpcyBleHRhbnQgb24gRA0KICAgICAgUzIpIEVuZG9yc2VyIEUxIHNheXMgU1cg UyBpcyB2ZXJzaW9uIDEuMA0KICAgICAgUzMpIEVuZG9yc2VyIEUyIHNheXMgdmVyc2lvbiAxLjAg KG9mIFMpIGlzIGJhZA0KICAgICAgUzQpIE93bmVyIHBvbGljeSBzYXlzIHZlcnNpb24gMS4wIChv ZiBTKSBpcyBnb29kLg0KICAgICAgUzUpIE93bmVyIHBvbGljeSBzYXlzIEUxIGlzIHRydXN0ZWQg dG8gc2F5IFMgaXMgdmVyc2lvbiAxLjANCiAgICAgIFM2KSBPd25lciBwb2xpY3kgc2F5cyBFMiBp cyB0cnVzdGVkIHRvIHNheSBTIGlzIGdvb2QvYmFkDQogICAgICBTNykgT3duZXIgUG9saWN5IHNh eXMgRTAgaXMgdHJ1c3RlZCB0byBwcm92aXNpb24gS0Qgb24gRA0KICAgICAgQXBwcmFpc2FsIGV2 YWx1YXRlcyB0aGUgc3RhdGVtZW50czoNClByb3ZlOiBYID0gU1cgaXMgZXh0YW50IG9uIGRldmlj ZSBEIGFuZCBpdCBpcyBnb29kLg0KUHJvb2Y6DQogICAgICAgUzMgc2F5cyBFMiBzYXlzIHZlcnNp b24gMS4wIGlzIGJhZCA8YW5kPiBTNiBzYXlzIEUyIGNhbiBzYXkgdGhpcyB8IHZhbGlkDQpTMiBz YXlzIEUxIHNheXMgUyBpcyB2ZXJzaW9uIDEuMCA8YW5kPiBTNSBzYXlzIEUxIGNhbiBzYXkgdGhp cyB8IHZhbGlkDQogICAgICAgUzEgc2F5cyBLRCBzYXlzIFMgaXMgZXh0YW50IG9uIEQgPGFuZD4g Uzcgc2F5cyBLRCBjYW4gc2F5IHRoaXMgfCB2YWxpZA0KICAgICAgIFMwIHNheXMgS0Qgc3BlYWtz IGZvciBEIDxhbmQ+IFM3IHNheXMgRTAgY2FuIHNheSB0aGlzIHwgdmFsaWQNCiAgVGhlcmVmb3Jl IFggaXMgRkFMU0UgYXQgdGhpcyBwb2ludDsgYnV0DQogICAgICAgUzQgc2F5cyB2ZXJzaW9uIDEu MCBpcyBnb29kIDxhbmQ+IE93bmVyIGNhbiBzYXkgYW55dGhpbmcgfCB2YWxpZA0KICBUaGVyZWZv cmUgWCBpcyBUUlVFDQoNCkRlYnVnIHN0YXR1cyDigJQgTW9zdCBvZiB0aGUgZGVidWcgc3RhdHVz IHZhbHVlcyBjYW4gdmFyeSBvbiBhIGRheS1kYXkgYmFzaXMNCk5tcz4gSXQgZGVwZW5kcyBvbiB0 aGUgZGVidWcgbWVjaGFuaXNtLg0KDQpPRU0gbW9kZWwg4oCUIElmIHRoZSBhdHRlc3RhdGlvbiBp cyBpbXBsZW1lbnRlZCBieSBhIGNoaXAgdmVuZG9yIGFuZCB0aGUgZW5kb3JzZW1lbnQgaXMgZm9y IHRoZSBjaGlwLCB0aGVuIHRoZSBPRU0gbW9kZWwgd2lsbCB2YXJ5IHdpZGVseS4NCk5tcz4gTm90 IHN1cmUgaG93IHRoaXMgaXMgcmVsZXZhbnQNCg0KTm9uZSBvZiB0aGVzZSBjYW4gYmUgY3JpdGVy aWEgYXMgdG8gd2hldGhlciBhbiBhdHRlc3RhdGlvbiBrZXkgaXMgcHV0IGludG8gYSBkZXZpY2Ug b3Igbm90IGFzIHRoZXkgYXJlIG5vdCBrbm93biBhdCBtYW51ZmFjdHVyaW5nIHRpbWUgYW5kL29y IG11c3QgYmUgYWxsb3dlZCB0byB2YXJ5IHdpZGVseSBhZnRlciBtYW51ZmFjdHVyaW5nLg0KTm1z PiBEZXZpY2VzIGNhbiBiZSBhIG1peCBvZiBoYXJkd2FyZSBhbmQgZmlybXdhcmUuIEV2ZW4gaGFy ZHdhcmUgY2FuIGJlIG11dGFibGUuIEVuZG9yc2VtZW50cyBkZXNjcmliZSB0aGUgbXV0YWJpbGl0 eSBwcm9wZXJ0aWVzIG9mIHRoZSBkZXZpY2UuIEVuZG9yc2VtZW50IGFsc28gZGVzY3JpYmUgdGhl IHJhbmdlIG9mIHBvc3NpYmxlIChhbmQgYWNjZXB0YWJsZSkgdmFsdWVzIHRoZSBtdXRhYmxlIHBy b3BlcnRpZXMgY2FuIGFjY2VwdC4NCg0KDQpJIHRoaW5rIHdoYXQgSeKAmXZlIGRlc2NyaWJlZCBh Ym92ZSBsaW5lcyB1cCBwcmV0dHkgd2VsbCBmb3IgYSBUUE0uDQpObXM+IEkgZGlzYWdyZWUuDQpU aGUgc3lzdGVtIGFyY2hpdGVjdHVyZSBpcyBtb3N0bHkgc2V0IGJ5IHRoZSBUQ0cuDQpObXM+IE5v LCB0aGUgVENHIHNwZWNpZmllcyBpbnRlcmZhY2VzIG5vdCBpbXBsZW1lbnRhdGlvbi4NCkhXIFRQ TXMgYXJlIGFsbW9zdCBhbHdheXMgY2VydGlmaWVkLg0KTm1zPiBBbiBpbmRlcGVuZGVudCBldmFs dWF0aW9uIGVudGl0eSBzcGVjaWZpZXMgaG93IGFuIGltcGxlbWVudGF0aW9uIHNjb3JlZCBhY2Nv cmRpbmcgdG8gdGhlIGNyaXRlcmlhLiBUaGVyZSBhcmUgbG90cyBvZiBUUE1zIHRoYXQgYXJlIG5v dCBjZXJ0aWZpZWQgb3IgYXJlIGNlcnRpZmllZCB0byBkaWZmZXJlbnQgbGV2ZWxzLiBUaGUgaW1w b3J0YW50IHBvaW50IHNob3VsZCBiZSB0aGF0IHRoZSBWZXJpZmllciBkb2VzbuKAmXQga25vdyB1 bmxlc3MgaXQgYXNrcyBmb3IgRXZpZGVuY2UgYW5kIEVuZG9yc2VtZW50cy4NClRoZXkgYXJlIGlu ZGVwZW5kZW50IG9mIE9FTSBtb2RlbC4NCk5tcz4gVGhpcyBpc27igJl0IHRydWUuIEV2ZXJ5IFRQ TSBoYXMgYSB2ZW5kb3IsIG1vZGVsL3Byb2R1Y3QgbmFtZSBldGPigKYgdGhhdCBpcyBub3QgY2hv c2VuIGJ5IFRDRy4NCkl0IGFsc28gbGluZXMgdXAgcmVhc29uYWJseSB3ZWxsIHdpdGggc2VjdXJl IGVsZW1lbnRzIGFuZCBjYW4gbGluZSB1cCB3aXRoIFRFReKAmXMuDQoNClRoZSBjcnV4IG9mIGVu ZG9yc2VtZW50IHRvIG1lIGlzIHRoZSBzZWN1cml0eSBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGF0 dGVzdGVyIHRoYXQgcHJvdGVjdCB0aGUgYXR0ZXN0YXRpb24ga2V5IGJlY2F1c2UgdGhlcmUgaXMg Z2VuZXJhbGx5IG5vIHJlY292ZXJ5IGZyb20gYSBjb21wcm9taXNlZCBhdHRlc3RhdGlvbiBrZXku IEl0IHNldHMgdGhlIGJhc2VsaW5lIHJpc2sgb2YgdGhlIEhXIGFuZCBTVyBvZiB0aGUgZGV2aWNl Lg0KTm1zPiBJIGFncmVlIHRoYXQgdGhlIEF0dGVzdGluZyBFbnZpcm9ubWVudCBpcyB0cnVzdGVk IGJ5IHRoZSBUYXJnZXQgRW52aXJvbm1lbnQuIElmIHRoZSBBdHRlc3RpbmcgRW52aXJvbm1lbnQg aXMgY29tcHJvbWlzZWQsIHRoZXJlIGlzIG5vIHdheSBmb3IgdGhlIFRhcmdldCBFbnZpcm9ubWVu dCB0cnVzdHdvcnRoaW5lc3MgdG8gYmUgYXNzZXNzZWQuDQoNCg0KT24gb25lIGV4dHJlbWUgaXMg YSBzZXBhcmF0ZSBlbmRvcnNlbWVudCBmb3IgZXZlcnkgZGV2aWNlICjigJxtaWNybyBlbmRvcnNl bWVudCI/KSwgd2hpY2ggaXMgd2hhdCBJIHRoaW5rIFRob21hcyBhbmQgQVJNIFBTQSBhcmUgdGVu ZGluZyB0b3dhcmRzLiBUaGUgb3RoZXIgZXh0cmVtZSBpcyBvbmUgZW5kb3JzZW1lbnQgZm9yIGEg cHJvZHVjdCBsaW5lICjigJxtYWNybyBlbmRvcnNlbWVudCI/KSwsIHNheSBhIHByb2R1Y3QgbGlu ZSBvZiBUUE1zLg0KTm1zPiBJIGRpc2FncmVlIHdpdGggdGhpcyBjaGFyYWN0ZXJpemF0aW9uIG9m IFRQTXMuIEVhY2ggdmVuZG9y4oCZcyBUUE0gcHJvZHVjdCBpcyBkaWZmZXJlbnQgYW5kIGhhcyBk aWZmZXJlbnQgaW50cmluc2ljIHRydXN0d29ydGhpbmVzcyBwcm9wZXJ0aWVzLiBNYW55IGFyZSBD QyBldmFsdWF0ZWQgYW5kIHNvbWUgYWNoaWV2ZSBhIHNpbWlsYXIgc2NvcmUuIFRoYXQgZG9lc27i gJl0IG1lYW4gdGhleSBhcmUgdGhlIHNhbWUgcHJvZHVjdC4NClRoZW4gaXTigJlzIG1vcmUgbGlr ZSB0aGUgZGF0YSBzaGVldCBmb3IgdGhlIHByb2R1Y3QuDQoNClRoZW4gdGhlcmXigJlzIGRpZmZl cmVudCB3YXlzIHRvIGZhbiB0aGlzIG91dCB0byB0aGUgZGlmZmVyZW50IGtleSAvIHNpZ25pbmcg c2NoZW1lcyAocGVyLWRldmljZSBrZXksIGdyb3VwIGtleSwgRUNEQUEsIFguNTA5KS4gRm9yIGV4 YW1wbGUgYSBtYWNyby1lbmRvcnNlbWVudCBjb3VsZCBpbmNsdWRlIHRoZSByb290IG9mIGFuIFgu NTA5IGhpZXJhcmNoeSBhbmQgdGhlIGluZGl2aWR1YWwgZGV2aWNlcyAob3IgZ3JvdXBzIG9mIGRl dmljZXMpIHdvdWxkIGhhdmUgaW5kaXZpZHVhbCBrZXlzIHRoYXQgY2hhaW4gdXAuDQpObXM+IFRo ZSByb290IG9mIGEgWC41MDkgaGllcmFyY2h5IGlzIGNhbGxlZCBhIOKAnFJvb3QgQ0HigJ0uIEEg cG9saWN5IHRoYXQgYWNjZXB0cyBhIFJvb3QgQ0EgcHVibGljIGtleS9jZXJ0IGlzIGNhbGxlZCBh IOKAnFRydXN0IEFuY2hvcuKAnS4gQSB0cnVzdCBhbmNob3IgbWFuYWdlbWVudCBwcm90b2NvbCB0 aGF0IGNvbnZleXMgYSB0cnVzdCBhbmNob3IgdG8gYSBWZXJpZmllciBpcyBhbiBFbmRvcnNlbWVu dCBvZiBhIFJvb3QgQ0EgdGhhdCBjaGFpbnMgdG8gYW4gYXR0ZXN0YXRpb24ga2V5LiBUaGUgRW5k b3JzZW1lbnQgbWlnaHQgYmUgdXNlZnVsIGZvciBjb25zdHJ1Y3RpbmcgYSBwb2xpY3kgc2ltaWxh ciB0byDigJxTMOKAnSBhYm92ZS4gKEl0IGlzbuKAmXQgc2F5aW5nIG1vcmUgdGhhbiB0aGF0IElN TykNCg0KV2l0aCBhIG1pY3JvLWVuZG9yc2VtZW50IHRoZSBwZXItZGV2aWNlIHB1YmxpYyBrZXkg Y291bGQgYmUgcGVyIGVuZG9yc2VtZW50Lg0KTm1zPiBJIGRvbuKAmXQgdGhpbmsgdGhlIGFyY2hp dGVjdHVyZSBzaG91bGQgdHJ5IHRvIGRlZmluZSDigJhtaWNybyBlbmRvcnNlbWVudOKAmSBvciDi gJhtYWNybyBlbmRvcnNlbWVudOKAmS4NCg0KDQpUaGUgbW9zdCBpbXBvcnRhbnQgdGhpbmcgYWJv dXQgdGhlIGVuZG9yc2VtZW50IHNlZW1zIHRvIG1lIGlzIHRoZSBjaGFyYWN0ZXJpemF0aW9uIG9m IGhvdyB0aGUgYXR0ZXN0YXRpb24ga2V5IGlzIHByb3RlY3RlZC4NCk5tcz4gVGhlIGZpcnN0IGxp bmUgaW4gdGhlIEVuZG9yc2VtZW50IHNlY3Rpb24gb2YgdGhlIGFyY2hpdGVjdHVyZSBkb2N1bWVu dCBzYXlzIHRoaXMgYWxtb3N0IHZlcmJhdGltLg0KDQpMTA0KDQoNCg0KDQoNCk9uIEFwciA3LCAy MDIwLCBhdCA3OjM2IEFNLCBUaG9tYXMgRm9zc2F0aSA8VGhvbWFzLkZvc3NhdGlAYXJtLmNvbTxt YWlsdG86VGhvbWFzLkZvc3NhdGlAYXJtLmNvbT4+IHdyb3RlOg0KDQpIaSBMYXVyZW5jZSwNCg0K VGhhbmtzIGZvciBicmluZ2luZyB0aGlzIHVwLiAgQSBmZXcgdGhvdWdodHMgYmVsb3cuDQoNCk9u IDAzLzA0LzIwMjAsIDIwOjM3LCAiUkFUUyBvbiBiZWhhbGYgb2YgTGF1cmVuY2UgTHVuZGJsYWRl Ig0KPHJhdHMtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86cmF0cy1ib3VuY2VzQGlldGYub3JnPiBv biBiZWhhbGYgb2YgbGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29y dC5jb20+PiB3cm90ZToNCg0KDQpTbyBob3cgZG9lcyBhIFZlcmlmaWVyIGZpbmQgdGhlIGFwcGxp Y2FibGUgZW5kb3JzZW1lbnQgZm9yIEV2aWRlbmNlIGl0DQp3aXNoZXMgdG8gdmVyaWZ5IGFuZCBr bm93IHRoYXQgaXMgcmVhbGx5IHRoZSByaWdodCBlbmRvcnNlbWVudD8NCg0KU2VlbXMgbGlrZSB0 aGUgRXZpZGVuY2UgbmVlZHMgc29tZSBzb3J0IG9mIGFuIGVuZG9yc2VtZW50IGxvY2F0b3IgSUQu DQpUaGlzIGNvdWxkIGJlIGEgVVJMIG9yIGEgR1VJRC4gRUFUIGN1cnJlbnRseSBoYXMgdGhlIG9y aWdpbmF0aW9uIGNsYWltDQp0byB0cnkgdG8gc29sdmUgdGhpcywgYnV0IGl0IGlzIGhhbGYtYmFr ZWQuIEl0IG5lZWRzIHRvIGdldCBmaXhlZC4gSeKAmW0NCmZpc2hpbmcgZm9yIGNvbW1lbnRzIGhl cmUgb24gd2hhdCBpdCBzaG91bGQgYmUgbGlrZS4NCg0KUHJldHR5IHN1cmUgdGhlIEVuZG9yc2Vt ZW50IG5lZWRzIHRvIGluY2x1ZGUgb3IgcmVmZXJlbmNlIHRoZSBwdWJsaWMNCmtleSB0aGF0IGlz IHVzZWQgdG8gdmVyaWZ5IHRoZSBzaWduYXR1cmUuIFdpdGhvdXQgdGhhdCwgdGhlIEF0dGVzdGVy DQpjb3VsZCBsaWUgYW5kIHBpY2sgYW55IG9sZCBFbmRvcnNlbWVudCB0aGF0IGl0IHdpc2hlcy4g VGhlcmUgbmVlZHMgdG8NCmJlIHNvbWUgYmluZGluZyBiZXR3ZWVuIGl0ZW1zIGluIHRoZSBlbmRv cnNlbWVudCAoRTAsIEUxLOKApikgYW5kIHRoZQ0KdmVyaWZpY2F0aW9uIGtleS4gVGhhdCBjb3Vs ZCBiZSBpbiB0aGUgZm9ybSBvZiBhIHNpZ25lZCB0b2tlbiBvcg0KY2VydGlmaWNhdGUsIGJ1dCBk b2VzbuKAmXQgaGF2ZSB0byBiZS4gUHJldHR5IHN1cmUgdGhpcyBuZWVkcyB0byBiZQ0KZGlzY3Vz c2VkIGluIHRoZSBhcmNoaXRlY3R1cmUgZG9jLg0KDQpUaGVyZSdzIGEgZmV3IHNjZW5hcmlvczoN Ci0gT25lIGVuZG9yc2VtZW50IGFwcGxpZXMgdG8gbG90cyBvZiBkZXZpY2VzIGluIHRoZSBzYW1l IGNsYXNzLCBidXQNCiBlYWNoIGhhcyB0aGVpciBvd24gYXR0ZXN0YXRpb24ga2V5Lg0KLSAtIFBy b2JhYmx5IEVDREFBIGZpdHMgaW4gaGVyZQ0KLSAtIE9uZSBvcHRpb24gaGVyZSBpcyBhbiBYNTA5 IGhpZXJhcmNoeQ0KLSBHcm91cCBrZXlzIGFyZSB1c2VkIChmb3IgcHJpdmFjeSByZWFzb25zIG9y IG90aGVyKSBzbyB0aGVyZSBpcyBhDQogb25lLW9uZSBjb3JyZWxhdGlvbiB3aXRoIHRoZSBFbmRv cnNlbWVudHMgKHRoZSBHRUlEIGRpc2N1c3Npb24pDQotIEdyb3VwIGtleXMgYXJlIHVzZWQsIGJ1 dCBhY3Jvc3MgZGV2aWNlcyB0aGF0IGhhdmUgZGlmZmVyZW50DQogZW5kb3JzZW1lbnRzIHNvIHRo ZXJl4oCZcyBubyBvbmUtb25lIGNvcnJlbGF0aW9uDQoNCldoaWxlIHRoZSBsYXN0IG9uZSBzZWVt cyBvZGQgYW5kIHVubGlrZWx5LCBJIHRoaW5rIGl0IGNvdWxkIG9jY3VyLA0KYmVjYXVzZSBmcm9t IGEgbG90IG9mIHJlYWwgZXhwZXJpZW5jZSB0aGUgc2V0IHVwIG9mIGF0dGVzdGF0aW9uIGtleXMN CmlzIHZlcnkgaWRpb3N5bmNyYXRpYy4gSXQgaXMgd2lsZGx5IGFmZmVjdGVkIGJ5IG1hbnVmYWN0 dXJpbmcgY29zdHMNCmFuZCBpc3N1ZXMgb24gYXNzZW1ibHkgbGluZXMsIHN1YiBjb250cmFjdG9y IHN0cnVjdHVyZSwgbG9jYXRpb24gb2YNCnNlY3VyZSBmYWNpbGl0aWVzIGFuZCBhcHByb2FjaGVz IHRvIG1ha2luZyBtb25leSBvbiBpdC4gVGhleSBhcmUgbGlrZQ0Kc25vd2ZsYWtlcywgZWFjaCBv bmUgaXMgZGlmZmVyZW50LiAgU28gbWF5YmUgZW5kb3JzZW1lbnQgbG9jYXRvciBJRA0KYW5kIGtl eSBJRCBhcmUgbm90IHRoZSBzYW1lLCBidXQgdGhleSBjYW4gYmUgaW4gc29tZSB1c2UgY2FzZXM/ DQoNCkkgYW0gYWxzbyB0ZW1wdGVkIHRvIGVuY291cmFnZSB0aGUgcGxhY2VtZW50IG9mIHRoZSBl bmRvcnNlbWVudA0KbG9jYXRvciBJRCBpbiB0aGUgQ09TRSBvciBKT1NFIGhlYWRlciBwYXJhbWV0 ZXJzIHNvIHlvdSBkb27igJl0IGhhdmUgdG8NCnBhcnNlIHRoZSB1bnZlcmlmaWVkIGJvZHkgb2Yg Y2xhaW1zIHRvIGJlIGFibGUgdG8gZmluZCB0aGUga2V5DQptYXRlcmlhbCB0byB2ZXJpZnkgaXQu DQoNClRob3VnaHRzPw0KDQpBIHR3byBsZXZlbCBsb29rdXAga2V5LCBtb2RlbCtpbnN0YW5jZSwg c2VlbXMgdG8gYmUgcXVpdGUgZ2VuZXJhbGx5DQphcHBsaWNhYmxlIGFzIGFuIGVuZG9yc2VtZW50 IGxvY2F0b3IuICBUaGUgbW9kZWwgcGFydCB3b3VsZCBnZXQgeW91IHRvDQp0aGUgc2hhcmVkIGRh dGEgKGUuZy4sIGNlcnRpZmljYXRpb24sIG1lYXN1cmVkIGJvb3QgS0dWcywgZXRjLiksIHdoaWxl DQp0aGUgaW5zdGFuY2UgcGFydCBjYW4gYmUgdXNlZCB0byByZXRyaWV2ZSBkZXZpY2Utc3BlY2lm aWMgc3RhdGU6DQp2ZXJpZmljYXRpb24ga2V5KHMpIGFzIHdlbGwgYXMgb3RoZXIgbWV0YWRhdGEs IGUuZy4sIGlmIHNvbWUgZ2VhciBpcw0KYmxhY2tsaXN0ZWQuICBJbiBQU0Egd2UgaGF2ZSBzb21l dGhpbmcgcXVpdGUgKHRob3VnaCBub3QgZW50aXJlbHkpDQpzaW1pbGFyIHdpdGggaW1wbGVtZW50 YXRpb24gYW5kIGluc3RhbmNlIElEcyBbMV0gWzJdLg0KDQooQ29udGV4dC1zd2l0Y2hpbmcgZm9y IGEgc2Vjb25kIG9uIG91ciBwcmV2aW91cyBVRUlEL0dFSUQgZGlzY3Vzc2lvbjogSQ0KZ3Vlc3Mg d2UgbWlnaHQgbW9kZWwgYW4gaW5zdGFuY2UgYXMgYW4gYW5vbnltaXR5IHNldCwgYW5kIHRoZXJl Zm9yZQ0KdHJlYXQgRVVJRHMgYXMgdGhlIHNwZWNpYWwgY2FzZSBHRUlEcyB3aXRoIGNhcmRpbmFs aXR5ID09IDE/KQ0KDQpGb3IgdGhlIHNha2Ugb2YgYnVpbGRpbmcgYSBzaGFyZWQgYW5kIHJldXNh YmxlIHZvY2FidWxhcnksIEknZCBwcmVmZXINCmtlZXBpbmcgbW9kZWwgYW5kIGluc3RhbmNlIGlk ZW50aWZpZXJzIGFzIHNlcGFyYXRlIGNsYWltcyByYXRoZXIgdGhhbg0KaGF2aW5nIGFuIG9wYXF1 ZSBlbmRvcnNlbWVudCBJRCBjbGFpbSB0aGF0IGNsdW1wcyB0b2dldGhlciB0aG9zZSBhbmQNCnBv c3NpYmx5IG90aGVyIHN0dWZmIGluIGEgdXNlLWNhc2Ugc3BlY2lmaWMgZmFzaGlvbi4gIEZvciB0 aGUgc2FtZQ0KcmVhc29uIEkgd291bGQgbm90IG92ZXJyaWRlIGtleSBJRCB3aXRoIGluc3RhbmNl IElEIHNlbWFudGljcy4NCg0KY2hlZXJzLCB0aGFua3MhDQoNClsxXSBodHRwczovL3d3dy5pZXRm Lm9yZy9pZC9kcmFmdC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFtZS1pbXBs ZW1lbnRhdGlvbi1pZA0KWzJdIGh0dHBzOi8vd3d3LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVu aWctcmF0cy1wc2EtdG9rZW4tMDUuaHRtbCNuYW1lLWluc3RhbmNlLWlkDQoNCg0KDQpJTVBPUlRB TlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRz IGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUg bm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1l ZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVy c29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1h dGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KUkFUUyBtYWlsaW5nIGxpc3QNClJBVFNAaWV0Zi5vcmc8 bWFpbHRvOlJBVFNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3JhdHMNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NClJBVFMgbWFpbGluZyBsaXN0DQpSQVRTQGlldGYub3JnPG1haWx0bzpSQVRTQGlldGYub3Jn Pg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRzDQoNCg== --_000_EF9AEDD959A8498895BFC1B4A7E7BB79intelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <3CB76AC851B8144DB0D6350805615024@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAxMSA2IDQg MiAyIDIgMiAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5N c29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4w MDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5hcHBs ZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNl O30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0K CWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJY29sb3I6d2luZG93dGV4dDsNCglmb250LXdl aWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUg bm9uZTt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglm b250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBp bjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0K CXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0i RU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rp b24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+SW5saW5lIG5tcyZndDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0 IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5SQVRTICZsdDtyYXRzLWJvdW5jZXNAaWV0Zi5v cmcmZ3Q7IG9uIGJlaGFsZiBvZiBMYXVyZW5jZSBMdW5kYmxhZGUgJmx0O2xnbEBpc2xhbmQtcmVz b3J0LmNvbSZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+V2VkbmVzZGF5LCBBcHJpbCA4LCAyMDIwIGF0 IDE6MDYgUE08YnI+DQo8Yj5UbzogPC9iPiZxdW90O1NtaXRoLCBOZWQmcXVvdDsgJmx0O25lZC5z bWl0aEBpbnRlbC5jb20mZ3Q7PGJyPg0KPGI+Q2M6IDwvYj4mcXVvdDtyYXRzQGlldGYub3JnJnF1 b3Q7ICZsdDtyYXRzQGlldGYub3JnJmd0OywgVGhvbWFzIEZvc3NhdGkgJmx0O1Rob21hcy5Gb3Nz YXRpQGFybS5jb20mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbUmF0c10gRW5kb3JzZW1l bnQgSUQgYW5kIHZlcmlmaWNhdGlvbiBrZXkgKHdhcyBQcm9jZXNzaW5nIEVuZG9yc2VtZW50cyBh bmQgRXZpZGVuY2UgaW50byBSZXN1bHRzKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBOZWQsIDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+U2VlbXMgbGlrZSB0aGVyZSBpcyBnZW5lcmFsIGFncmVlbWVu dCBvbiB0aGUgY29yZSBwdXJwb3NlIG9mIHRoZSBlbmRvcnNlbWVudCDigJQgZGVzY3JpYmluZyB0 aGUgc2VjdXJpdHkgY2hhcmFjdGVyaXN0aWNzIG9mIHRoZSBFbmRvcnNlci48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SeKAmW0gbm90IGFkdm9j YXRpbmcgYW55IGRlZmluaXRpb25zIGluIHRoZSBhcmNoaXRlY3R1cmUgZG9jdW1lbnQgaGVyZS4g SSB3YXMgYWZ0ZXIgc29tZSBnZW5lcmFsIGNoYXJhY3RlcmlzdGljcyBhbmQgY29tbW9uIHVuZGVy c3RhbmRpbmcuIEkga25vdyBpbXBsZW1lbnRhdGlvbnMgYXJlIGdvaW5nIHRvIHZhcnkgd2lsZGx5 LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5UbyBiZSBtb3JlIGNsZWFyIG9uIOKAnE9FTSBtb2RlbOKAnS4gSSB3YXMgdXNpbmcgdGhh dCB0byByZWZlciB0byB0aGUgZW5kIGRldmljZSBsaWtlIGEgcm91dGVyLCBhIHBob25lIG9yIGEg d2FzaGluZyBtYWNoaW5lLCBub3QgdGhlIG1hbnVmYWN0dXJlciBvZiBhIGNoaXAsIGEgVFBNIG9y IGEgVEVFLiAmbmJzcDtUaGUgVEVFIG1pZ2h0IGJlIHRoZSBBdHRlc3Rlcg0KPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5ObXMmZ3Q7IEkgdGhpbmsgeW91IG1lYW4g4oCYQXR0 ZXN0aW5nIEVudmlyb25tZW504oCZPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5hbmQgbWlnaHQgYmUgdGhlIHNhbWUgQXR0ZXN0ZXIgd2l0aCB0aGUgc2FtZSBlbmRvcnNlbWVu dCB0aGF0IGlzIGluIGJvdGggYSBNb3Rvcm9sYSBwaG9uZSBhbmQgYSBTb255IHBob25lLCBlYWNo IHdpdGggYSBkaWZmZXJlbnQgT0VNIE1vZGVsIGNsYWltLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij5ObXMmZ3Q7IFJpZ2h0LiBUaGF0IHdvdWxkIGJlIHRydWUgaWYgdGhlIGluZ3JlZGll bnRzIGZvciB0aGUgQXR0ZXN0aW5nIEVudmlyb25tZW50cyBmb3IgdGhlIHZhcmlvdXMgbW9kZWxz IHdhcyB0aGUgc2FtZSBzdWJzZXQuIFRoZSBFbmRvcnNlbWVudCBjb3VsZCBiZSBhIG1hbmlmZXN0 IG9mIGEgdmFyaWV0eSBvZiBpbmdyZWRpZW50cyB0aGF0IGVhY2gNCiBjb3VsZCBiZSBpZGVudGlm aWVkIGluIHRlcm1zIG9mIHt2ZW5kb3IsIG1vZGVsLCB2ZXJzaW9ufSBpbiBzb21lIHNvcnQgb2Yg bmVzdGluZyBzdHJ1Y3R1cmUuIE1heWJlIHRoZXJlIGFyZSBwcml2YWN5IGNvbmNlcm5zIG9yIHdo YXRldmVyLCBidXQgbW9zdCBzeXN0ZW1zIGhhdmUgYSB3YXkgb2YgcmVwb3J0aW5nIHNvbWV0aGlu ZyBhYm91dCB3aGF0IGlzIGluc2lkZSB0aGUgY2hhc3Npcy4gRW5kb3JzZW1lbnRzIGNvdWxkIGZv bGxvdyBzb21ldGhpbmcNCiBsaWtlIHRoYXQuIEEgVFBNLCBURUUsIE1DVSBvciBvdGhlciB0ZWNo bm9sb2d5IGNvdWxkIGJlIHBhcnQgb2YgdGhlIEF0dGVzdGluZyBFbnZpcm9ubWVudC4gVGhlIEVu ZG9yc2VtZW50IGNvdWxkIGJlIGV4cGxpY2l0IGFib3V0IHRoYXQuIFNpbmNlIHRoZXJlIGlzIGEg 4oCYcm9vdOKAmSBBdHRlc3RpbmcgRW52aXJvbm1lbnQgKG9uZSB0aGF0IGlzIHRoZSBib3R0b20g bGF5ZXIpLCB0aGUgRW5kb3JzZW1lbnQgaXMgdGhlIG9ubHkgbWVjaGFuaXNtIGZvcg0KIGNvbW11 bmljYXRpbmcgdGhlc2UgZGV0YWlscyB0byB0aGUgVmVyaWZpZXIuIEF0dGVzdGF0aW9uIGRvZXNu 4oCZdCB3b3JrIGV4Y2VwdCBhcyBhbiBpbnRyb3NwZWN0aW9uICh3aGljaCBzb21lIGJlbGlldmUg aGFzIHNlY3VyaXR5IGNoYWxsZW5nZXMpLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2hlbiBJIHdhcyByZWZlcnJpbmcgdG8gYSDi gJxwcm9kdWN0IGxpbmUgb2YgVFBNc+KAnSwgSSB3YXMgdGhpbmtpbmcgb2Ygc2V2ZXJhbCB2ZXJ5 IHNpbWlsYXIgbW9kZWxzIGZyb20gdGhlIHNhbWUgVFBNIHZlbmRvci4gU2VlbXMgbGlrZSB0aGlz IHdvdWxkIHNoYXJlIHRoZSBtb3JlIGludmFyaWFudCBjaGFyYWN0ZXJpc3RpY3Mgb2YgYSBFbmRv cnNlbWVudCBhbmQgbWF5YmUgY291bGQgc2hhcmUgYW4gRW5kb3JzZW1lbnQuDQogSG93ZXZlciwg SSBoYXZlIG5vIHN0cm9uZyBzZW5zZSB0aGF0IGl0IGhhcyB0byBiZSBvbmUgd2F5IG9yIHRoZSBv dGhlci48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBJIHRoaW5rIGl0IGlz IGNvcnJlY3QgZm9yIEVuZG9yc2VtZW50cyB0byBwcm92aWRlIHZlY3RvcnMgb2YgaW50ZXJjaGFu Z2VhYmxlIHBhcnRzIGZvciBhIGdpdmVuIHN5c3RlbS4gRm9yIGV4YW1wbGUsIG1hbnkgT0VNcyBz b3VyY2UgdGhlIOKAmHNhbWXigJkgcGFydCBmcm9tIG11bHRpcGxlIHN1cHBsaWVycyB0byBlbnN1 cmUgdGhlcmUgaXMNCiByZWR1bmRhbmN5IGluIHRoZSBzdXBwbHkgY2hhaW4uIFRoZSBwYXJ0cyBo YXZlIGRpZmZlcmVudCB2ZW5kb3IsIG1vZGVsLCB2ZXJzaW9uIGJ1dCBjb21wbHkgdG8gYSBzdGFu ZGFyZCBzZXQgb2YgaW50ZXJmYWNlIHNwZWNzIHNvIHRoYXQgcGFydHMgY2FuIGJlIGludGVyY2hh bmdlYWJsZS4gQW4gRW5kb3JzZW1lbnQgbWlnaHQgbGlzdCBhbGwgb2YgdGhlIHBvc3NpYmxlIHN1 cHBsaWVycyBmb3IgdGhlIHNhbWUg4oCYc3BlY+KAmSBwYXJ0LiBJZiB0aGF0DQogaXMgdGhlIGNh c2UsIHRoZW4gYXR0ZXN0YXRpb24gRXZpZGVuY2UgaWRlbnRpZmllcyB3aGljaCBvZiB0aGUgdmFy aW91cyBwb3NzaWJpbGl0aWVzIHdhcyBjaG9zZW4uDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ VGhlcmUgaXMgYSBwb3NzaWJpbGl0eSB3aGVyZSBhbiDigJxpbnRyb3NwZWN0aW9u4oCdIGNhc2Ug Y291bGQgZXhpc3QgZm9yIHRoZSDigJhyb2904oCZIEF0dGVzdGluZyBFbnZpcm9ubWVudCB3aGVy ZSB0aGUgT0VNIHNvdXJjZXMgbXVsdGlwbGUgc3VwcGxpZXJzIGZvciB0aGUgc2FtZSDigJhzcGVj 4oCZIHBhcnRzIGFuZCB0aGUgQXR0ZXN0aW5nIEVudmlyb25tZW50DQogbWF5IGJlIHRoZSBvbmx5 IGF2YWlsYWJsZSBlbnRpdHkgdG8gZGlzYW1iaWd1YXRlIHdoaWNoIHN1cHBsaWVy4oCZcyBwYXJ0 IHdhcyBjaG9zZW4uIEl0IG1heSBhbHNvIGJlIHRoZSBjYXNlIHRoYXQgdGhlIHBhcnQgaXNu4oCZ dCBzZWxmLWF3YXJlIGFuZCB0aGVyZWZvcmUgcmVtYWlucyBzaWxlbnQuIFRoZSBWZXJpZmllciBt YXkgaGF2ZSB0byBjb25jbHVkZSB0aGF0IHRoZSByb290IEF0dGVzdGluZyBFbnZpcm9ubWVudCBp cyBlaXRoZXIgdmVuZG9yLUENCiBvciB2ZW5kb3ItQiAoYmFzZWQgb24gdGhlIEVuZG9yc2VtZW50 IHZlY3RvciksIGJ1dCBkb2VzbuKAmXQga25vdyB3aGljaC4gVmVyaWZpZXIgUG9saWN5IGhhcyB0 byBhbGxvdyBib3RoIHZlbmRvcuKAmXMgc3BlYyBwYXJ0IHNpbmNlIGl0IGNhbuKAmXQgdGVsbCB0 aGUgZGlmZmVyZW5jZS4gSWYgYSBmbGF3IHdhcyBmb3VuZCBpbiBvbmUgdmVuZG9y4oCZcyBzcGVj IHBhcnQgYnV0IG5vdCB0aGUgb3RoZXIgdmVuZG9y4oCZcyBwYXJ0IGJvdGggd291bGQgaGF2ZSB0 bw0KIGJlIGRpc2FsbG93ZWQgc2luY2UgaXQgY2Fu4oCZdCB0ZWxsIHdoaWNoIHZlbmRvcuKAmXMg cGFydCB3YXMgdXNlZC4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPklkZWFsbHksIHRoZXNlIGNv cm5lciBjYXNlcyB3b3VsZCBiZSBtaW5pbWl6ZWQgaW4gaW1wbGVtZW50YXRpb25zLg0KPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPkZyb20gYSBkZWZpbml0aW9uYWwgcGVyc3BlY3RpdmUsIEVuZG9y c2VtZW50IGRhdGEgZGVmaW5pdGlvbiBzaG91bGQgYW50aWNpcGF0ZSB0aGUgcG9zc2liaWxpdHkg b2YgbXVsdGlwbGUgaW5zdGFuY2VzIChzdXBwbGllcnMpIGZvciB0aGUgc2FtZSDigJhzcGVj4oCZ IHBhcnQuIFdoZXJlYXMgZm9yIEV2aWRlbmNlLCBpdCBtYXkgYmUgYWRlcXVhdGUNCiBpZiBpdCBv bmx5IHN1cHBvcnRlZCAwIG9yIDEgb2NjdXJyZW5jZXMgb2YgdGhlIOKAmHNwZWPigJkgcGFydC48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+T25lIG9mIHRoZSBtYWluIHJlYXNvbnMgSeKAmXZlIGR1ZyBpbnRvIGFsbCB0aGlzIGlz IHRvIHRyeSB0byB1bmRlcnN0YW5kIGhvdyBFbmRvcnNlbWVudHMgYW5kIFZlcmlmaWNhdGlvbiBL ZXlzIGFyZSBpZGVudGlmaWVkIGluIHRoZSBFdmlkZW5jZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij5ObXMmZ3Q7IEkgdGhpbmsgb2YgRW5kb3JzZW1lbnRzIGFzIOKAmGNsYXNz4oCZIHN0 cnVjdHVyZXMgd2hlcmUgYW4gRW5kb3JzZW1lbnQgcmVwcmVzZW50cyBhIGNsYXNzIG9mIHNvbWV0 aGluZywgZm9yIGV4YW1wbGUgYW4gaVBob25lIDgmIzQzOy4gRXZpZGVuY2UgcmVwcmVzZW50cyBh biDigJhpbnN0YW5jZeKAmSBvZiBzb21ldGhpbmcsIGZvciBleGFtcGxlIGFuZCBpUGhvbmUNCiA4 JiM0Mzsgd2l0aCB0aGUgc2VyaWFsIG51bWJlciBYWVouIFRoZSBrZXkgaXMgdXNlZCB0byBhdXRo ZW50aWNhdGUgdGhlIGluc3RhbmNlIChub3QgbmVjZXNzYXJpbHkgaWRlbnRpZnkgaXQpLiBGb3Ig ZXhhbXBsZSwgaWYgdGhlIGtleSB3YXMgYSBncm91cCBrZXkgbGlrZSBEQUEgLyBFUElEIHRoZW4g a25vd2xlZGdlIG9mIHRoZSBrZXkgd291bGQgbm90IGJlIHN1ZmZpY2llbnQgdG8gbmFycm93IGRv d24gdG8gYW4gaW5zdGFuY2UuIFlvdSBzdGlsbCBuZWVkDQogc29tZXRoaW5nIGxpa2Ugc2VyaWFs IG51bWJlciBvciBVRUlELiBFdmlkZW5jZSB0aGVyZWZvcmUgc2hvdWxkIGNvbnRhaW4g4oCYaW5z dGFuY2XigJkgaWRlbnRpZmllcihzKSBhcyBjbGFpbXMuIFRoZSBrZXlzIGFyZSBleHRlcm5hbCB0 byBFdmlkZW5jZS4gVGhlcmVmb3JlLCB0aGUgd29yZGluZyDigJxWZXJpZmljYXRpb24gS2V5cyBh cmUgaWRlbnRpZmllZCBpbiB0aGUgRXZpZGVuY2XigJ0gc2VlbXMgaW5jb3JyZWN0IGJlY2F1c2Ug dGhlIGluc3RhbmNlIGlkZW50aWZpZXINCiBkb2VzbuKAmXQgbmVjZXNzYXJpbHkgaGF2ZSB0byBi ZSBhIGtleS4gSXQgaXMgcG9zc2libGUgdG8gZ2VuZXJhdGUgYW4gaW5zdGFuY2UgaWRlbnRpZmll ciBmcm9tIGEga2V5LCBidXQgdGhhdCBpcyBkaWZmZXJlbnQgZnJvbSBiZWluZyB0aGUga2V5Ljxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+c28gd2UgY2FuIGRlZmluZSB3aGF0IGlzIG5l ZWRlZCBpbiBFQVQuIFRoYXQgd2FzIHRoZSBtYWluIHJlYXNvbiBmb3IgZGlzdGluZ3Vpc2hpbmcg bWljcm8gYW5kIG1hY3JvIGVuZG9yc2VtZW50cy4gSXQgaXMgbm90IHRvIGhhdmUgdGhlbSBmb3Jt YWxseSBkZWZpbmVkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5UaG9tYXPigJkgY29tbWVudHMgd2hlcmUgcmVhbGx5IGVubGlnaHRl bmluZyBhcyB0byBob3cgQVJNIFBTQSBpcyB0aGlua2luZyBvZiB0aGlzIChhbmQgaG93IGl0IHdh cyBxdWl0ZSBkaWZmZXJlbnQgZnJvbSBtaW5lKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBoYXZlbuKAmXQgY29tZSB0byBhbnkgY29uY2x1 c2lvbnMgeWV0LiBXb3VsZCBiZSBpbnRlcmVzdGVkIHRvIHVuZGVyc3RhbmQgaG93IGlkZW50aWZp Y2F0aW9uIG9mIGEgcGFydGljdWxhciBLZXkgY29tZSBmcm9tIGEgcGFydGljdWxhciBFbmRvcnNl bWVudA0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsgR2l2ZW4gdGhlIGFi b3ZlIGV4cGxhbmF0aW9uIG9mIGNsYXNzIGFuZCBpbnN0YW5jZSBpZGVudGlmaWVycyBhbmQgdGhl aXIgcmVsYXRpb25zaGlwIHRvIEVuZG9yc21lbnRzIGFuZCBFdmlkZW5jZSwgZG9lcyBpdCBzdGls bCBtYWtlIHNlbnNlIHRvIHBvc2UgdGhlIHF1ZXN0aW9uIGFzIOKAnGhvdyBpZGVudGlmaWNhdGlv biBvZiBhIHBhcnRpY3VsYXINCiBLZXkgY29tZSBmcm9tIGEgcGFydGljdWxhciBFbmRvcnNlbWVu dOKAnT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPndoaWNoIGNvbWVzIGZyb20gZmll bGRzIENPU0UgLyBKT1NFIGhlYWRlcnMgYW5kIC8gb3IgY29udGFpbmVkIGNsYWltcyBmb3IgbG90 cyBvZiBkaWZmZXJlbnQgaW5zdGFudGlhdGlvbnMgYW5kIGltcGxlbWVudHMgb2Ygb2YgUkFUUyBw cm90b2NvbHMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsgSSB0aGluayBv ZiB0aGUgVmVyaWZpZXLigJlzIHRhc2sgYXMgcHJpbWFyaWx5IG5lZWRpbmcgdG87IGZvciBlYWNo IGNsYWltIGluIHRoZSBFdmlkZW5jZSwgKGEpIHNlbGVjdCBmcm9tIGEgbGlzdCBvZiBwb3NzaWJs ZSByZWZlcmVuY2Ugc3lub255bSBjbGFpbXMgYW5kIChiKSBtYXRjaCB0aGUgRXZpZGVuY2UgY2xh aW0gd2l0aCBvbmUgaW4NCiB0aGUgbGlzdC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0 OyBUaGUgVmVyaWZpZXIgbmVlZHMgZW5vdWdoIGNvbnRleHQgYWJvdXQgaG93IHRoZSBkZXZpY2Ug aXMgY29uc3RydWN0ZWQgKGUuZy4gc3VibW9kPyBjb250ZXh0KSB0byBrbm93IHdoaWNoIEVuZG9y c2VtZW50cyBzaG91bGQgYmUgdXNlZCBhcyB0aGUgcmVmZXJlbmNlIGNsYWltcyBmb3IgYSBnaXZl biBFdmlkZW5jZSBjbGFpbS4gVGhlDQogY29udmV5YW5jZSBwcm90b2NvbCBhbmQgYXR0ZXN0YXRp b24ga2V5IHBsYXkgYSByb2xlIGluIGVzdGFibGlzaGluZyB0aGlzIGNvbnRleHQsIGJ1dCBJIGRv buKAmXQgdGhpbmsgdGhlIGFyY2hpdGVjdHVyZSBoYXMgYmVlbiBmbGVzaGVkIG91dCBlbm91Z2gg eWV0LiBGb3IgZXhhbXBsZSwgaXQgbWlnaHQgYmUgbmVjZXNzYXJ5IGZvciBFbmRvcnNlbWVudHMg dG8gYmUgc3RydWN0dXJlZCBhY2NvcmRpbmcgdG8gYSBzdWJtb2RzLWxpa2Ug4oCcYmlsbC1vZi1t YXRlcmlhbHPigJ0NCiBhbmQgZ2l2ZW4gYSBzb3J0IG9mIHJlY29yZCBpZGVudGlmaWVyIHRoYXQg Y2FuIGJlIGluY2x1ZGVkIHdpdGggKGluPykgdGhlIEV2aWRlbmNlIHNvIHRoZSBWZXJpZmllciBr bm93cyBob3cgdG8gYXNrIGZvciB0aGUgYXBwcm9wcmlhdGUgRW5kb3JzZW1lbnQgcmVjb3Jkcy4g SXQgaXMgYWxzbyBwb3NzaWJsZSB0aGF0IHRoZSBjb252ZXlhbmNlIHByb3RvY29sIGNvdWxkIGNv bnZleSB0aGUgRW5kb3JzZW1lbnQgcmVjb3JkcyBkaXJlY3RseSBpZiB0aGV5DQogaGFwcGVuIHRv IGJlIGF2YWlsYWJsZSBvbiB0aGUgQXR0ZXN0ZXIuIEJ1dCBpdCBpcyBzdGlsbCBuZWNlc3Nhcnkg Zm9yIHRoZSBWZXJpZmllciB0byBjb3JyZWxhdGUgd2hpY2ggRW5kb3JzZW1lbnQgcmVjb3JkIGNv cnJlc3BvbmRzIHRvIHdoaWNoIHBpZWNlIG9mIEV2aWRlbmNlLiBBIOKAmHBpZWNlIG9mIEV2aWRl bmNl4oCZIGNvdWxkIGJlIG5lc3RlZCAoZS5nLiBzdWJtb2Q/KSBjb25zaXN0aW5nIG9mIHN0aWxs IG90aGVyIOKAmHBpZWNlcyBvZiBldmlkZW5jZeKAmQ0KIGV0Y+KApiBUaGlzIGFsc28gaW1wbGll cyB0aGUgRW5kb3JzZW1lbnQgcmVjb3JkIHJlZmVyZW5jZShzKSBpcyhhcmUpIGtub3duIGJ5IHRo ZSBBdHRlc3RpbmcgRW52aXJvbm1lbnQgYXQgdGhlIHRpbWUgRXZpZGVuY2UgaXMgY29udmV5ZWQu ICgqTWF5YmUgdGhpcyBzaG91bGQgYmUgYWRkZWQgYXMgYW4gaXNzdWUgdG8gdGhlIGFyY2ggZHJh ZnQ/Kik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGEgaWQ9Ik9XQUFNQjI3OTEwQUE3NUU3OUM0 NTgzNDRCNzJFRTRFM0ZDOTYiIGhyZWY9Im1haWx0bzpoZW5rLmJpcmtob2x6QHNpdC5mcmF1bmhv ZmVyLmRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7 dGV4dC1kZWNvcmF0aW9uOm5vbmUiPkBIZW5rIEJlcmtob2x6PC9zcGFuPjwvYT4g4oCTIERvZXMg Q29TV0lEIGhhdmUNCiB0aGUgZXF1aXZhbGVudCBvZiBhIHJlY29yZCBpZGVudGlmaWVyIGZvciBz b21ldGhpbmcgdGhhdCBpcyBsaWtlIGEgc3ViLWNvbXBvbmVudCBvZiBzb21ldGhpbmcgZWxzZT8g L1Jlc291cmNlLyBkb2VzbuKAmXQgYWxsb3cgbmVzdGluZyBhbmQgL0ZpbGUvIHNlZW1zIHRvIGJl IG92ZXJsb2FkaW5nIHdoYXQgd2FzIG9yaWdpbmFsbHkgaW50ZW5kZWQuIE9mIGNvdXJzZSAvUmVz b3VyY2UvIGNvdWxkIHJlZmVyIHRvIGEgVUNDUyAoaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L2RyYWZ0LWJpcmtob2x6LXJhdHMtdWNjcy0wMCkNCiB3aGljaCBhbGxvd3MgbmVzdGluZy48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PkxMPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4N Cjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24g QXByIDcsIDIwMjAsIGF0IDQ6MTEgUE0sIFNtaXRoLCBOZWQgJmx0OzxhIGhyZWY9Im1haWx0bzpu ZWQuc21pdGhAaW50ZWwuY29tIj5uZWQuc21pdGhAaW50ZWwuY29tPC9hPiZndDsgd3JvdGU6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPlNlZSBpbmxpbmUgbm1zJmd0Ozwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQiPkZyb206PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPlJBVFMgJmx0Ozxh IGhyZWY9Im1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmciPnJhdHMtYm91bmNlc0BpZXRmLm9y ZzwvYT4mZ3Q7IG9uIGJlaGFsZiBvZiBMYXVyZW5jZSBMdW5kYmxhZGUgJmx0OzxhIGhyZWY9Im1h aWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvYT4mZ3Q7 PGJyPg0KPGI+RGF0ZTo8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+PC9iPlR1ZXNkYXksIEFwcmlsIDcsIDIwMjAgYXQgMTI6MTIgUE08YnI+DQo8Yj5Ubzo8 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlRob21h cyBGb3NzYXRpICZsdDs8YSBocmVmPSJtYWlsdG86VGhvbWFzLkZvc3NhdGlAYXJtLmNvbSI+VGhv bWFzLkZvc3NhdGlAYXJtLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj4mcXVvdDs8YSBocmVmPSJtYWlsdG86 cmF0c0BpZXRmLm9yZyI+cmF0c0BpZXRmLm9yZzwvYT4mcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0 bzpyYXRzQGlldGYub3JnIj5yYXRzQGlldGYub3JnPC9hPiZndDssICZxdW90O1NtaXRoLCBOZWQm cXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpuZWQuc21pdGhAaW50ZWwuY29tIj5uZWQuc21pdGhA aW50ZWwuY29tPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+UmU6IFtSYXRzXSBFbmRvcnNlbWVudCBJRCBh bmQgdmVyaWZpY2F0aW9uIGtleSAod2FzIFByb2Nlc3NpbmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlk ZW5jZSBpbnRvIFJlc3VsdHMpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlz IGlzIGEgcmVwbHkgdG8gYm90aCBUaG9tYXMgYW5kIE5lZOKAmXMgbWVzc2FnZSBvbiBkZWJ1ZyBp biB0aGUgcmVsYXRlZCB0aHJlYXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk15IGluY2xp bmF0aW9uIGlzIHRvIGFzc29jaWF0ZSBlbmRvcnNlbWVudHMgd2l0aCB0aW1lLWludmFyaWFudCBj aGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGRldmljZS4gQXQgdGhlIG1vbWVudCB0aGlzIGRvZXNu4oCZ dCBzZWVtIGxpa2UgdGhlIG9ubHkgd2F5IHRvIGRvIGl0LCBidXQgaXQgc2VlbXMgbGlrZSBhIGdv b2Qgd2F5LiBUaGluZ3MgdGhhdCBhcmUgbm90IHRpbWUgaW52YXJpYW50IGFyZSBwb2xpY3ksIGst Zy12DQogb3Igc3VjaC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+Tm1zJmd0OyBDZXJ0YWlubHkgYW55IHByb3BlcnR5IHRoYXQgaXMgdGltZSBpbnZhcmlhbnQg KGFib3V0IHRoZSBkZXZpY2UpIGNhbiBiZSBleHBsaWNpdGx5IGNhcHR1cmVkIGluIEVuZG9yc2Vt ZW50cy4gU2luY2UgdGhleSBhcmUgdGltZS1pbnZhcmlhbnQgaXQgZG9lc27igJl0IG1ha2Ugc2Vu c2UgdG8gQXR0ZXN0IHRvIHRoZW0gaW4gRXZpZGVuY2UNCiAodGhleSB3aWxsIGFsd2F5cyBiZSB0 aGUgc2FtZSByZXN1bHQpLiBJIGRpc2FncmVlIHRoYXQgRW5kb3JzZW1lbnQgTVVTVCBPTkxZIGJl IHRpbWUgaW52YXJpYW50IGNsYWltcyBob3dldmVyLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBOb3Qgc3VyZSBpZiB0aGUgcXVlc3Rp b25zIGJlbG93IGFyZSByaGV0b3JpY2FsLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHU+RW5kb3JzZW1lbnQ8L3U+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5TeXN0ZW0gYXJjaGl0ZWN0dXJlIOKAlCBEb2VzIHRoZSBBdHRl c3RlciB1c2UgYSBURUUgb3IgYSBUUE0gb3IgbWF5YmUgaXQgaXMgc2ltcGxlIHN5c3RlbSB3aXRo IGp1c3QgYSBzaW1wbGUgQ1BVLCBidXQgaXQgaXMgZW5jYXNlZCBpbiB0aXRhbml1bS4gSXMgZGVm ZW5zZSBhZ2FpbnN0IGNoaXAgaW52YXNpdmUgYXR0YWNrcyBjb25zaWRlcmVkPyBEbyBrZXlzIGJl Y29tZSBpbmFjY2Vzc2libGUgd2hlbiBkZWJ1ZyBpcw0KIGVuYWJsZWQuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkRldmVsb3BtZW50IHByb2Nlc3Mg4oCUIElzIHRoZXJlIGEgc3BlY2lhbCBz ZWN1cml0eS1vcmllbnRlZCB0ZWFtPyBEb2VzIHRoZSB0ZWFtIGhhdmUgYSBjb2RlIHJldmlldyBw b2xpY3k/IElzIHRoZXJlIGEgYnVnIGJvdW50eT8gQXJlIHRoZSBkZXNrdG9wcyBhbmQgSVQgc3lz dGVtcyB1c2VkIGZvciBIVyBhbmQgU1cgZGV2ZWxvcG1lbnQgaXNvbGF0ZWQ/PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk1hbnVmYWN0dXJpbmcg4oCUIEFyZSB0aGUgZmFjdG9yaWVzIHNlY3Vy ZWQgaW4gYSBzcGVjaWFsIHdheT8gSXMgdGhlIGF0dGVzdGF0aW9uIGtleSBwcm92aXNpb25pbmcg c3lzdGVtIGhhcmRlbmVkIGluIHNvbWUgd2F5IChlLmcuLCB1c2VzIEhTTXMpLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5DZXJ0aWZpY2F0aW9ucyDigJQgVGhlc2UgdGFrZSBhIGxvbmcgdGlt ZSB0byBhY2hpZXZlIGFuZCB3aWxsIHVzdWFsbHkgcmVxdWlyZSBzb21lIG9mIHRoZSBhYm92ZS48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TXkgdGhpbmtpbmcgZm9y IEVBVCB3YXMgdGhhdCB5b3Ugb25seSBwdXQgYXR0ZXN0YXRpb24ga2V5cyBpbnRvIGRldmljZXMg dGhhdCBtZWV0IHNvbWUgY3JpdGVyaWEgbGlrZSBzb21lIG9mIHRoZSBhYm92ZS4gU2luY2UgdGhl cmUgaXMgb2Z0ZW4gbm8gd2F5IHRvIHJlY292ZXIgZnJvbSBhIGNvbXByb21pc2VkIGF0dGVzdGF0 aW9uIGtleSBiZWNhdXNlIG5vIGtleSBtb3JlIHNlY3VyZSB0aGFuIGl0LCB5b3Uga2luZA0KIG9m IGhhdmUgdG8gaGF2ZSBhbGwgdGhhdC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBUaGUgaWRlYSB0aGF0IGEgZGV2aWNlIGhhcyBhbiBB dHRlc3RpbmcgRW52aXJvbm1lbnQocykgYW5kIFRhcmdldCBFbnZpcm9ubWVudChzKSBpbXBsaWVz IHRoZSBBdHRlc3RpbmcgRW52aXJvbm1lbnQgaXMvc2hvdWxkIGJlIG1vcmUgaGFyZGVuZWQgaXMg d2hhdCBzb21lIHJlZmVyIHRvIGFzIFJvb3Qtb2YtVHJ1c3QuIFRoZSB0ZWNobmlxdWVzDQogZm9y IHByb3RlY3RpbmcgdGhlIEF0dGVzdGluZyBFbnZpcm9ubWVudCBzaG91bGQgYmUgaW1tdXRhYmxl L2ludmFyaWFudCB3aGljaCBpcyB3aHkgc29tZSB1c2UgdGhlIHRlcm0g4oCcSGFyZHdhcmUgUm9v dCBvZiBUcnVzdOKAnSB3aGVuIGRlc2NyaWJpbmcgYW4gaWRlYWwgQXR0ZXN0aW5nIEVudmlyb25t ZW50Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2luY2UgdGhlc2UgZG9u4oCZ dCBjaGFuZ2UgbXVjaCBvdmVyIHRpbWUsIHRoZSBlbmRvcnNlbWVudCB3b3VsZG7igJl0IGNoYW5n ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBU aGUgRW5kb3JzZW1lbnQgY29udmV5cyB0aGUgaW1tdXRhYmlsaXR5IC8gcHJvcGVydHkgb2YgdGlt ZSBpbnZhcmlhbmNlIHRvIHRoZSBWZXJpZmllci4gSXQgZGVzY3JpYmVzIHRoZSBSb290IG9mIFRy dXN0IC8gQXR0ZXN0aW5nIEVudi4gJm5ic3A7V2hlcmUgdGhlIGF0dGVzdGF0aW9uIGtleSBpcyBo ZWxkIGJlY2F1c2UgaWYgdGhlIHJvb3QNCiBhdHRlc3RhdGlvbiBzdWItc3lzdGVtIGlzIGJyb2tl biB0aGVyZSBpcyBubyBvdGhlciBwcm90ZWN0aW9uIG1lY2hhbmlzbSB0byBmYWxsIGJhY2sgb24g Zm9yIHJlY292ZXJ5IHRoYXQgZG9lc27igJl0IGludm9sdmUgcGh5c2ljYWwgcmVtZWRpYXRpb24u PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDtUaGV5IGNvdWxkIGV2ZW4gc3BhbiBzZXZlcmFsIG1vZGVscyBhbmQgdmFyeWlu ZyBIVy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0 OyBPciBub3QuIEl0IGRlcGVuZHMgb24gdGhlIHN5c3RlbSBhcmNoaXRlY3R1cmUuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48dT5Qb2xpY3ksIEstRy1WLCBvdGhlcjwvdT48 L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsg UG9saWN5IChha2EgQXBwcmFpc2FsIFBvbGljeSBmb3IgRXZpZGVuY2UsIEFwcHJhaXNhbCBQb2xp Y3kgZm9yIEF0dGVzdGF0aW9uIFJlc3VsdHMpIGlzIGRpZmZlcmVudCBmcm9tIEVuZG9yc2VtZW50 LiBLbm93biBHb29kIFZhbHVlcyBhcmUgc3lub255bW91cyB3aXRoIEVuZG9yc2VtZW50LiBUaGUg YXJjaGl0ZWN0dXJlIHVzZXMgb25lDQogd29yZCB0byBjYXB0dXJlIGEgdmFyaWV0eSBvZiBwb3Nz aWJsZSBjbGFpbXMgdGhhdCBzdXBwbHkgY2hhaW4gZW50aXRpZXMgY2FuIGNvbnZleSB0byBWZXJp ZmllcnMuIEkgZG9u4oCZdCB0aGluayBpdCBtYWtlcyBzZW5zZSB0byBjb25mbGF0ZSBQb2xpY3kg d2l0aCBFbmRvcnNlbWVudHMuIEl0IG1pZ2h0IG1ha2Ugc2Vuc2UgZm9yIFBvbGljeSB0byBoYXZl IGFuIG9waW5pb24gYXMgdG8gd2hhdCBpcyDigJhnb29k4oCZLiBCdXQgaXQgaXMgYSBjYXNlIG9m DQogYW4gT3duZXIgZGVjaWRpbmcgdnMuIHRoZSBtYW51ZmFjdHVyZXIuIEl0IGlzIGFwcHJvcHJp YXRlIGZvciBib3RoIHRvIGhhdmUgc29tZXRoaW5nIHRvIHNheSBhYm91dCB0aGUgY2xhaW0uPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdp bi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TVyBW ZXJzaW9ucyDigJQgQXMgbG9uZyBhcyB0aGUgU1cgZm9sbG93cyBhIGRldmVsb3BtZW50IHByb2Nl c3MgbGlrZSB0aGF0IGFib3ZlLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5pdCBkb2VzbuKAmXQgaGF2ZSB0byBiZSBpbmNsdWRlZCBpbiB0aGUg ZW5kb3JzZW1lbnQuPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7 IEkgZGlzYWdyZWUgd2l0aCB0aGlzIGNvbmNsdXNpb24uIFRoZSB2ZW5kb3IgZGV0ZXJtaW5lcyB3 aGljaCB2ZXJzaW9uIHN0cmluZyBpcyBhcHBsaWVkIHRvIFNXIGl0IHByb2R1Y2VzLiBUaGF0IHZh bHVlIGlzIGFuIGFzc2VydGlvbiBvbmx5IHRoZSBTVyB2ZW5kb3IgY2FuIG1ha2UuIE93bmVyIFBv bGljeSBjYW4gc2F5IHRoYXQgdGhlDQogdmVyc2lvbiBpcyDigJhnb29k4oCZIG9yIOKAmGJhZOKA mSBvciDigJh1bmtub3du4oCZIGJ1dCBjYW7igJl0IHNheSB0aGF0IHRoZSB2ZXJzaW9uIGlzIFgu PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T2Yg Y291cnNlIHRoZSBzbWFsbGVyIHRoZSBTVyBhbmQgdGhlIGJldHRlciB0aGUgcHJvY2VzcywgdGhl IG1vcmUgaXQgaXMgdHJ1ZSAoYW5kIHZpY2UgdmVyc2EpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5CbGFja2xpc3RzIOKAlCBUaGVzZSBtaWdodCBiZSBzcGVjaWZpYyB0byBVRUlEcywgdmVy c2lvbnMgb2YgU1csIGRlcGxveW1lbnRzIGEgcGFydGljdWxhciBPRU0gb3Igc3VjaDxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IE1hbnkgZW50aXRp ZXMgY2FuIHByb2R1Y2UgYmxhY2svd2hpdGUgbGlzdHMgbGVnaXRpbWF0ZWx5LiBJZiB0aGUgZW50 aXR5IGlzIGluIHRoZSBzdXBwbHkgY2hhaW4gdGhlIGFzc2VydGlvbiBpcyBhbiBFbmRvcnNlbWVu dC4gSWYgdGhlIGVudGl0eSBpcyBhbiBPd25lciB0aGVuIHRoZSBhc3NlcnRpb24gaXMgYSBQb2xp Y3kuIFRoZSBkaWZmZXJlbmNlDQogaXMgaW4gaG93IHRoZSBWZXJpZmllciB0cmVhdHMgRW5kb3Jz ZW1lbnRzIHZzLiBQb2xpY2llcy48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij5FeGFtcGxlOjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBTMCkgRW5kb3JzZXIgRTAgc2F5cyBL ZXkgS0Qgc3BlYWtzIGZvciBEZXZpY2UgRDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJ0ZXh0LWluZGVudDo2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij5TMSkgQXR0ZXN0ZXIgS0Qgc2F5cyBTVyBTIGlzIGV4dGFudCBvbiBE PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgUzIpIEVuZG9yc2VyIEUxIHNheXMgU1cgUyBpcyB2 ZXJzaW9uIDEuMDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFMzKSBFbmRvcnNlciBFMiBzYXlz IHZlcnNpb24gMS4wIChvZiBTKSBpcyBiYWQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBTNCkg T3duZXIgcG9saWN5IHNheXMgdmVyc2lvbiAxLjAgKG9mIFMpIGlzIGdvb2QuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgUzUpIE93bmVyIHBvbGljeSBzYXlzIEUxIGlzIHRydXN0ZWQgdG8gc2F5 IFMgaXMgdmVyc2lvbiAxLjA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBTNikgT3duZXIgcG9s aWN5IHNheXMgRTIgaXMgdHJ1c3RlZCB0byBzYXkgUyBpcyBnb29kL2JhZDwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IFM3KSBPd25lciBQb2xpY3kgc2F5cyBFMCBpcyB0cnVzdGVkIHRvIHByb3Zp c2lvbiBLRCBvbiBEPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgQXBwcmFpc2FsIGV2YWx1YXRl cyB0aGUgc3RhdGVtZW50czo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0OjY2LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPlByb3ZlOiBYID0gU1cgaXMg ZXh0YW50IG9uIGRldmljZSBEIGFuZCBpdCBpcyBnb29kLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6NjYuMHB0Ij4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ UHJvb2Y6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDo2Ni4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IFMzIHNheXMgRTIgc2F5cyB2ZXJzaW9uIDEuMCBpcyBiYWQgJmx0O2FuZCZndDsgUzYgc2F5 cyBFMiBjYW4gc2F5IHRoaXMgfCB2YWxpZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4yNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJ0ZXh0LWluZGVudDouMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij5TMiBzYXlzIEUxIHNheXMgUyBpcyB2ZXJzaW9uIDEuMCAmbHQ7YW5k Jmd0OyBTNSBzYXlzIEUxIGNhbiBzYXkgdGhpcyB8IHZhbGlkPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDo2Ni4wcHQiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ij4mbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFMxIHNheXMgS0Qgc2F5cyBTIGlzIGV4 dGFudCBvbiBEICZsdDthbmQmZ3Q7IFM3IHNheXMgS0QgY2FuIHNheSB0aGlzIHwgdmFsaWQ8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjY2LjBw dCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBT MCBzYXlzIEtEIHNwZWFrcyBmb3IgRCAmbHQ7YW5kJmd0OyBTNyBzYXlzIEUwIGNhbiBzYXkgdGhp cyB8IHZhbGlkPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDo2Ni4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgVGhlcmVmb3JlIFggaXMgRkFM U0UgYXQgdGhpcyBwb2ludDsgYnV0PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDo2Ni4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgUzQgc2F5cyB2ZXJzaW9uIDEuMCBpcyBnb29kICZsdDth bmQmZ3Q7IE93bmVyIGNhbiBzYXkgYW55dGhpbmcgfCB2YWxpZDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6NjYuMHB0Ij4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+Jm5ic3A7IFRoZXJlZm9yZSBYIGlzIFRSVUU8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkRlYnVnIHN0YXR1cyDigJQgTW9zdCBvZiB0aGUgZGVidWcgc3RhdHVzIHZhbHVlcyBj YW4gdmFyeSBvbiBhIGRheS1kYXkgYmFzaXM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBJdCBkZXBlbmRzIG9uIHRoZSBkZWJ1ZyBtZWNoYW5pc20u PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PRU0gbW9kZWwg4oCUIElmIHRoZSBh dHRlc3RhdGlvbiBpcyBpbXBsZW1lbnRlZCBieSBhIGNoaXAgdmVuZG9yIGFuZCB0aGUgZW5kb3Jz ZW1lbnQgaXMgZm9yIHRoZSBjaGlwLCB0aGVuIHRoZSBPRU0gbW9kZWwgd2lsbCB2YXJ5IHdpZGVs eS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBO b3Qgc3VyZSBob3cgdGhpcyBpcyByZWxldmFudDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Tm9uZSBvZiB0aGVzZSBjYW4gYmUgY3JpdGVyaWEgYXMgdG8g d2hldGhlciBhbiBhdHRlc3RhdGlvbiBrZXkgaXMgcHV0IGludG8gYSBkZXZpY2Ugb3Igbm90IGFz IHRoZXkgYXJlIG5vdCBrbm93biBhdCBtYW51ZmFjdHVyaW5nIHRpbWUgYW5kL29yIG11c3QgYmUg YWxsb3dlZCB0byB2YXJ5IHdpZGVseSBhZnRlciBtYW51ZmFjdHVyaW5nLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IERldmljZXMgY2FuIGJlIGEg bWl4IG9mIGhhcmR3YXJlIGFuZCBmaXJtd2FyZS4gRXZlbiBoYXJkd2FyZSBjYW4gYmUgbXV0YWJs ZS4gRW5kb3JzZW1lbnRzIGRlc2NyaWJlIHRoZSBtdXRhYmlsaXR5IHByb3BlcnRpZXMgb2YgdGhl IGRldmljZS4gRW5kb3JzZW1lbnQgYWxzbyBkZXNjcmliZSB0aGUgcmFuZ2Ugb2YgcG9zc2libGUg KGFuZA0KIGFjY2VwdGFibGUpIHZhbHVlcyB0aGUgbXV0YWJsZSBwcm9wZXJ0aWVzIGNhbiBhY2Nl cHQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkg dGhpbmsgd2hhdCBJ4oCZdmUgZGVzY3JpYmVkIGFib3ZlIGxpbmVzIHVwIHByZXR0eSB3ZWxsIGZv ciBhIFRQTS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1z Jmd0OyBJIGRpc2FncmVlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBzeXN0ZW0gYXJjaGl0ZWN0dXJlIGlzIG1vc3RseSBzZXQg YnkgdGhlIFRDRy48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsg Tm8sIHRoZSBUQ0cgc3BlY2lmaWVzIGludGVyZmFjZXMgbm90IGltcGxlbWVudGF0aW9uLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhX IFRQTXMgYXJlIGFsbW9zdCBhbHdheXMgY2VydGlmaWVkLjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+Tm1zJmd0OyBBbiBpbmRlcGVuZGVudCBldmFsdWF0aW9uIGVudGl0eSBz cGVjaWZpZXMgaG93IGFuIGltcGxlbWVudGF0aW9uIHNjb3JlZCBhY2NvcmRpbmcgdG8gdGhlIGNy aXRlcmlhLiBUaGVyZSBhcmUgbG90cyBvZiBUUE1zIHRoYXQgYXJlIG5vdCBjZXJ0aWZpZWQgb3Ig YXJlIGNlcnRpZmllZCB0byBkaWZmZXJlbnQgbGV2ZWxzLiBUaGUgaW1wb3J0YW50DQogcG9pbnQg c2hvdWxkIGJlIHRoYXQgdGhlIFZlcmlmaWVyIGRvZXNu4oCZdCBrbm93IHVubGVzcyBpdCBhc2tz IGZvciBFdmlkZW5jZSBhbmQgRW5kb3JzZW1lbnRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXkgYXJlIGluZGVwZW5kZW50IG9m IE9FTSBtb2RlbC48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsg VGhpcyBpc27igJl0IHRydWUuIEV2ZXJ5IFRQTSBoYXMgYSB2ZW5kb3IsIG1vZGVsL3Byb2R1Y3Qg bmFtZSBldGPigKYgdGhhdCBpcyBub3QgY2hvc2VuIGJ5IFRDRy48L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JdCBhbHNvIGxpbmVzIHVw IHJlYXNvbmFibHkgd2VsbCB3aXRoIHNlY3VyZSBlbGVtZW50cyBhbmQgY2FuIGxpbmUgdXAgd2l0 aCBURUXigJlzLiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGNydXggb2Yg ZW5kb3JzZW1lbnQgdG8gbWUgaXMgdGhlIHNlY3VyaXR5IGNoYXJhY3RlcmlzdGljcyBvZiB0aGUg YXR0ZXN0ZXIgdGhhdCBwcm90ZWN0IHRoZSBhdHRlc3RhdGlvbiBrZXkgYmVjYXVzZSB0aGVyZSBp cyBnZW5lcmFsbHkgbm8gcmVjb3ZlcnkgZnJvbSBhIGNvbXByb21pc2VkIGF0dGVzdGF0aW9uIGtl eS4gSXQgc2V0cyB0aGUgYmFzZWxpbmUgcmlzayBvZiB0aGUgSFcgYW5kIFNXIG9mIHRoZQ0KIGRl dmljZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Tm1zJmd0 OyBJIGFncmVlIHRoYXQgdGhlIEF0dGVzdGluZyBFbnZpcm9ubWVudCBpcyB0cnVzdGVkIGJ5IHRo ZSBUYXJnZXQgRW52aXJvbm1lbnQuIElmIHRoZSBBdHRlc3RpbmcgRW52aXJvbm1lbnQgaXMgY29t cHJvbWlzZWQsIHRoZXJlIGlzIG5vIHdheSBmb3IgdGhlIFRhcmdldCBFbnZpcm9ubWVudCB0cnVz dHdvcnRoaW5lc3MgdG8gYmUgYXNzZXNzZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+T24gb25lIGV4dHJlbWUgaXMgYSBzZXBhcmF0ZSBlbmRvcnNlbWVudCBm b3IgZXZlcnkgZGV2aWNlICjigJxtaWNybyBlbmRvcnNlbWVudCZxdW90Oz8pLCB3aGljaCBpcyB3 aGF0IEkgdGhpbmsgVGhvbWFzIGFuZCBBUk0gUFNBIGFyZSB0ZW5kaW5nIHRvd2FyZHMuIFRoZSBv dGhlciBleHRyZW1lIGlzIG9uZSBlbmRvcnNlbWVudCBmb3IgYSBwcm9kdWN0IGxpbmUmbmJzcDso 4oCcbWFjcm8gZW5kb3JzZW1lbnQmcXVvdDs/KSwsIHNheSBhIHByb2R1Y3QNCiBsaW5lIG9mIFRQ TXMuPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IEkgZGlzYWdy ZWUgd2l0aCB0aGlzIGNoYXJhY3Rlcml6YXRpb24gb2YgVFBNcy4gRWFjaCB2ZW5kb3LigJlzIFRQ TSBwcm9kdWN0IGlzIGRpZmZlcmVudCBhbmQgaGFzIGRpZmZlcmVudCBpbnRyaW5zaWMgdHJ1c3R3 b3J0aGluZXNzIHByb3BlcnRpZXMuIE1hbnkgYXJlIENDIGV2YWx1YXRlZCBhbmQgc29tZSBhY2hp ZXZlIGEgc2ltaWxhcg0KIHNjb3JlLiBUaGF0IGRvZXNu4oCZdCBtZWFuIHRoZXkgYXJlIHRoZSBz YW1lIHByb2R1Y3QuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+VGhlbiBpdOKAmXMgbW9yZSBsaWtlIHRoZSBkYXRhIHNoZWV0IGZvciB0 aGUgcHJvZHVjdC4mbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGVuIHRoZXJl4oCZcyBkaWZmZXJlbnQgd2F5 cyB0byBmYW4gdGhpcyBvdXQgdG8gdGhlIGRpZmZlcmVudCBrZXkgLyBzaWduaW5nIHNjaGVtZXMg KHBlci1kZXZpY2Uga2V5LCBncm91cCBrZXksIEVDREFBLCBYLjUwOSkuIEZvciBleGFtcGxlIGEg bWFjcm8tZW5kb3JzZW1lbnQgY291bGQgaW5jbHVkZSB0aGUgcm9vdCBvZiBhbiBYLjUwOSBoaWVy YXJjaHkgYW5kIHRoZSBpbmRpdmlkdWFsIGRldmljZXMgKG9yIGdyb3Vwcw0KIG9mIGRldmljZXMp IHdvdWxkIGhhdmUgaW5kaXZpZHVhbCBrZXlzIHRoYXQgY2hhaW4gdXAuPHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7IFRoZSByb290IG9mIGEgWC41MDkgaGllcmFy Y2h5IGlzIGNhbGxlZCBhIOKAnFJvb3QgQ0HigJ0uIEEgcG9saWN5IHRoYXQgYWNjZXB0cyBhIFJv b3QgQ0EgcHVibGljIGtleS9jZXJ0IGlzIGNhbGxlZCBhIOKAnFRydXN0IEFuY2hvcuKAnS4gQSB0 cnVzdCBhbmNob3IgbWFuYWdlbWVudCBwcm90b2NvbCB0aGF0IGNvbnZleXMgYSB0cnVzdCBhbmNo b3INCiB0byBhIFZlcmlmaWVyIGlzIGFuIEVuZG9yc2VtZW50IG9mIGEgUm9vdCBDQSB0aGF0IGNo YWlucyB0byBhbiBhdHRlc3RhdGlvbiBrZXkuIFRoZSBFbmRvcnNlbWVudCBtaWdodCBiZSB1c2Vm dWwgZm9yIGNvbnN0cnVjdGluZyBhIHBvbGljeSBzaW1pbGFyIHRvIOKAnFMw4oCdIGFib3ZlLiAo SXQgaXNu4oCZdCBzYXlpbmcgbW9yZSB0aGFuIHRoYXQgSU1PKTwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2l0aCBhIG1pY3JvLWVu ZG9yc2VtZW50IHRoZSBwZXItZGV2aWNlIHB1YmxpYyBrZXkgY291bGQgYmUgcGVyIGVuZG9yc2Vt ZW50LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5ObXMmZ3Q7 IEkgZG9u4oCZdCB0aGluayB0aGUgYXJjaGl0ZWN0dXJlIHNob3VsZCB0cnkgdG8gZGVmaW5lIOKA mG1pY3JvIGVuZG9yc2VtZW504oCZIG9yIOKAmG1hY3JvIGVuZG9yc2VtZW504oCZLjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIG1vc3QgaW1wb3J0YW50IHRo aW5nIGFib3V0IHRoZSBlbmRvcnNlbWVudCBzZWVtcyB0byBtZSBpcyB0aGUgY2hhcmFjdGVyaXph dGlvbiBvZiBob3cgdGhlIGF0dGVzdGF0aW9uIGtleSBpcyBwcm90ZWN0ZWQuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsgVGhlIGZpcnN0IGxpbmUg aW4gdGhlIEVuZG9yc2VtZW50IHNlY3Rpb24gb2YgdGhlIGFyY2hpdGVjdHVyZSBkb2N1bWVudCBz YXlzIHRoaXMgYWxtb3N0IHZlcmJhdGltLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KPGJy Pg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiBBcHIgNywgMjAyMCwgYXQgNzozNiBBTSwgVGhvbWFzIEZvc3NhdGkgJmx0Ozxh IGhyZWY9Im1haWx0bzpUaG9tYXMuRm9zc2F0aUBhcm0uY29tIj5UaG9tYXMuRm9zc2F0aUBhcm0u Y29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5IaSBMYXVyZW5jZSw8YnI+DQo8YnI+DQpUaGFua3Mg Zm9yIGJyaW5naW5nIHRoaXMgdXAuICZuYnNwO0EgZmV3IHRob3VnaHRzIGJlbG93Ljxicj4NCjxi cj4NCk9uIDAzLzA0LzIwMjAsIDIwOjM3LCAmcXVvdDtSQVRTIG9uIGJlaGFsZiBvZiBMYXVyZW5j ZSBMdW5kYmxhZGUmcXVvdDs8YnI+DQombHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpyYXRzLWJv dW5jZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhIj5yYXRzLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6SGVsdmV0aWNhIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5vbg0KIGJlaGFsZiBvZjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFp bHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTpIZWx2ZXRpY2EiPmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvc3Bhbj48L2E+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPiZndDsgd3Jv dGU6PGJyPg0KPGJyPg0KPGJyPg0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OkhlbHZldGljYSI+U28gaG93IGRvZXMgYSBWZXJpZmllciBmaW5kIHRoZSBhcHBs aWNhYmxlIGVuZG9yc2VtZW50IGZvciBFdmlkZW5jZSBpdDxicj4NCndpc2hlcyB0byB2ZXJpZnkg YW5kIGtub3cgdGhhdCBpcyByZWFsbHkgdGhlIHJpZ2h0IGVuZG9yc2VtZW50Pzxicj4NCjxicj4N ClNlZW1zIGxpa2UgdGhlIEV2aWRlbmNlIG5lZWRzIHNvbWUgc29ydCBvZiBhbiBlbmRvcnNlbWVu dCBsb2NhdG9yIElELjxicj4NClRoaXMgY291bGQgYmUgYSBVUkwgb3IgYSBHVUlELiBFQVQgY3Vy cmVudGx5IGhhcyB0aGUgb3JpZ2luYXRpb24gY2xhaW08YnI+DQp0byB0cnkgdG8gc29sdmUgdGhp cywgYnV0IGl0IGlzIGhhbGYtYmFrZWQuIEl0IG5lZWRzIHRvIGdldCBmaXhlZC4gSeKAmW08YnI+ DQpmaXNoaW5nIGZvciBjb21tZW50cyBoZXJlIG9uIHdoYXQgaXQgc2hvdWxkIGJlIGxpa2UuPGJy Pg0KPGJyPg0KUHJldHR5IHN1cmUgdGhlIEVuZG9yc2VtZW50IG5lZWRzIHRvIGluY2x1ZGUgb3Ig cmVmZXJlbmNlIHRoZSBwdWJsaWM8YnI+DQprZXkgdGhhdCBpcyB1c2VkIHRvIHZlcmlmeSB0aGUg c2lnbmF0dXJlLiBXaXRob3V0IHRoYXQsIHRoZSBBdHRlc3Rlcjxicj4NCmNvdWxkIGxpZSBhbmQg cGljayBhbnkgb2xkIEVuZG9yc2VtZW50IHRoYXQgaXQgd2lzaGVzLiBUaGVyZSBuZWVkcyB0bzxi cj4NCmJlIHNvbWUgYmluZGluZyBiZXR3ZWVuIGl0ZW1zIGluIHRoZSBlbmRvcnNlbWVudCAoRTAs IEUxLOKApikgYW5kIHRoZTxicj4NCnZlcmlmaWNhdGlvbiBrZXkuIFRoYXQgY291bGQgYmUgaW4g dGhlIGZvcm0gb2YgYSBzaWduZWQgdG9rZW4gb3I8YnI+DQpjZXJ0aWZpY2F0ZSwgYnV0IGRvZXNu 4oCZdCBoYXZlIHRvIGJlLiBQcmV0dHkgc3VyZSB0aGlzIG5lZWRzIHRvIGJlPGJyPg0KZGlzY3Vz c2VkIGluIHRoZSBhcmNoaXRlY3R1cmUgZG9jLjxicj4NCjxicj4NClRoZXJlJ3MgYSBmZXcgc2Nl bmFyaW9zOjxicj4NCi0gT25lIGVuZG9yc2VtZW50IGFwcGxpZXMgdG8gbG90cyBvZiBkZXZpY2Vz IGluIHRoZSBzYW1lIGNsYXNzLCBidXQ8YnI+DQombmJzcDtlYWNoIGhhcyB0aGVpciBvd24gYXR0 ZXN0YXRpb24ga2V5Ljxicj4NCi0gLSBQcm9iYWJseSBFQ0RBQSBmaXRzIGluIGhlcmU8YnI+DQot IC0gT25lIG9wdGlvbiBoZXJlIGlzIGFuIFg1MDkgaGllcmFyY2h5PGJyPg0KLSBHcm91cCBrZXlz IGFyZSB1c2VkIChmb3IgcHJpdmFjeSByZWFzb25zIG9yIG90aGVyKSBzbyB0aGVyZSBpcyBhPGJy Pg0KJm5ic3A7b25lLW9uZSBjb3JyZWxhdGlvbiB3aXRoIHRoZSBFbmRvcnNlbWVudHMgKHRoZSBH RUlEIGRpc2N1c3Npb24pPGJyPg0KLSBHcm91cCBrZXlzIGFyZSB1c2VkLCBidXQgYWNyb3NzIGRl dmljZXMgdGhhdCBoYXZlIGRpZmZlcmVudDxicj4NCiZuYnNwO2VuZG9yc2VtZW50cyBzbyB0aGVy ZeKAmXMgbm8gb25lLW9uZSBjb3JyZWxhdGlvbjxicj4NCjxicj4NCldoaWxlIHRoZSBsYXN0IG9u ZSBzZWVtcyBvZGQgYW5kIHVubGlrZWx5LCBJIHRoaW5rIGl0IGNvdWxkIG9jY3VyLDxicj4NCmJl Y2F1c2UgZnJvbSBhIGxvdCBvZiByZWFsIGV4cGVyaWVuY2UgdGhlIHNldCB1cCBvZiBhdHRlc3Rh dGlvbiBrZXlzPGJyPg0KaXMgdmVyeSBpZGlvc3luY3JhdGljLiBJdCBpcyB3aWxkbHkgYWZmZWN0 ZWQgYnkgbWFudWZhY3R1cmluZyBjb3N0czxicj4NCmFuZCBpc3N1ZXMgb24gYXNzZW1ibHkgbGlu ZXMsIHN1YiBjb250cmFjdG9yIHN0cnVjdHVyZSwgbG9jYXRpb24gb2Y8YnI+DQpzZWN1cmUgZmFj aWxpdGllcyBhbmQgYXBwcm9hY2hlcyB0byBtYWtpbmcgbW9uZXkgb24gaXQuIFRoZXkgYXJlIGxp a2U8YnI+DQpzbm93Zmxha2VzLCBlYWNoIG9uZSBpcyBkaWZmZXJlbnQuICZuYnNwO1NvIG1heWJl IGVuZG9yc2VtZW50IGxvY2F0b3IgSUQ8YnI+DQphbmQga2V5IElEIGFyZSBub3QgdGhlIHNhbWUs IGJ1dCB0aGV5IGNhbiBiZSBpbiBzb21lIHVzZSBjYXNlcz88YnI+DQo8YnI+DQpJIGFtIGFsc28g dGVtcHRlZCB0byBlbmNvdXJhZ2UgdGhlIHBsYWNlbWVudCBvZiB0aGUgZW5kb3JzZW1lbnQ8YnI+ DQpsb2NhdG9yIElEIGluIHRoZSBDT1NFIG9yIEpPU0UgaGVhZGVyIHBhcmFtZXRlcnMgc28geW91 IGRvbuKAmXQgaGF2ZSB0bzxicj4NCnBhcnNlIHRoZSB1bnZlcmlmaWVkIGJvZHkgb2YgY2xhaW1z IHRvIGJlIGFibGUgdG8gZmluZCB0aGUga2V5PGJyPg0KbWF0ZXJpYWwgdG8gdmVyaWZ5IGl0Ljxi cj4NCjxicj4NClRob3VnaHRzPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj48YnI+DQpBIHR3byBsZXZlbCBsb29rdXAg a2V5LCBtb2RlbCYjNDM7aW5zdGFuY2UsIHNlZW1zIHRvIGJlIHF1aXRlIGdlbmVyYWxseTxicj4N CmFwcGxpY2FibGUgYXMgYW4gZW5kb3JzZW1lbnQgbG9jYXRvci4gJm5ic3A7VGhlIG1vZGVsIHBh cnQgd291bGQgZ2V0IHlvdSB0bzxicj4NCnRoZSBzaGFyZWQgZGF0YSAoZS5nLiwgY2VydGlmaWNh dGlvbiwgbWVhc3VyZWQgYm9vdCBLR1ZzLCBldGMuKSwgd2hpbGU8YnI+DQp0aGUgaW5zdGFuY2Ug cGFydCBjYW4gYmUgdXNlZCB0byByZXRyaWV2ZSBkZXZpY2Utc3BlY2lmaWMgc3RhdGU6PGJyPg0K dmVyaWZpY2F0aW9uIGtleShzKSBhcyB3ZWxsIGFzIG90aGVyIG1ldGFkYXRhLCBlLmcuLCBpZiBz b21lIGdlYXIgaXM8YnI+DQpibGFja2xpc3RlZC4gJm5ic3A7SW4gUFNBIHdlIGhhdmUgc29tZXRo aW5nIHF1aXRlICh0aG91Z2ggbm90IGVudGlyZWx5KTxicj4NCnNpbWlsYXIgd2l0aCBpbXBsZW1l bnRhdGlvbiBhbmQgaW5zdGFuY2UgSURzIFsxXSBbMl0uPGJyPg0KPGJyPg0KKENvbnRleHQtc3dp dGNoaW5nIGZvciBhIHNlY29uZCBvbiBvdXIgcHJldmlvdXMgVUVJRC9HRUlEIGRpc2N1c3Npb246 IEk8YnI+DQpndWVzcyB3ZSBtaWdodCBtb2RlbCBhbiBpbnN0YW5jZSBhcyBhbiBhbm9ueW1pdHkg c2V0LCBhbmQgdGhlcmVmb3JlPGJyPg0KdHJlYXQgRVVJRHMgYXMgdGhlIHNwZWNpYWwgY2FzZSBH RUlEcyB3aXRoIGNhcmRpbmFsaXR5ID09IDE/KTxicj4NCjxicj4NCkZvciB0aGUgc2FrZSBvZiBi dWlsZGluZyBhIHNoYXJlZCBhbmQgcmV1c2FibGUgdm9jYWJ1bGFyeSwgSSdkIHByZWZlcjxicj4N CmtlZXBpbmcgbW9kZWwgYW5kIGluc3RhbmNlIGlkZW50aWZpZXJzIGFzIHNlcGFyYXRlIGNsYWlt cyByYXRoZXIgdGhhbjxicj4NCmhhdmluZyBhbiBvcGFxdWUgZW5kb3JzZW1lbnQgSUQgY2xhaW0g dGhhdCBjbHVtcHMgdG9nZXRoZXIgdGhvc2UgYW5kPGJyPg0KcG9zc2libHkgb3RoZXIgc3R1ZmYg aW4gYSB1c2UtY2FzZSBzcGVjaWZpYyBmYXNoaW9uLiAmbmJzcDtGb3IgdGhlIHNhbWU8YnI+DQpy ZWFzb24gSSB3b3VsZCBub3Qgb3ZlcnJpZGUga2V5IElEIHdpdGggaW5zdGFuY2UgSUQgc2VtYW50 aWNzLjxicj4NCjxicj4NCmNoZWVycywgdGhhbmtzITxicj4NCjxicj4NClsxXTxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0iaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtdHNjaG9mZW5pZy1yYXRzLXBzYS10b2tlbi0wNS5o dG1sI25hbWUtaW1wbGVtZW50YXRpb24taWQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5odHRwczovL3d3dy5pZXRmLm9yZy9pZC9kcmFmdC10c2No b2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFtZS1pbXBsZW1lbnRhdGlvbi1pZDwvc3Bh bj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2Ei Pjxicj4NClsyXTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtdHNjaG9mZW5p Zy1yYXRzLXBzYS10b2tlbi0wNS5odG1sI25hbWUtaW5zdGFuY2UtaWQiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5odHRwczovL3d3dy5pZXRmLm9y Zy9pZC9kcmFmdC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFtZS1pbnN0YW5j ZS1pZDwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpI ZWx2ZXRpY2EiPjxicj4NCjxicj4NCjxicj4NCjxicj4NCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBj b250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlh bCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVk IHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBu b3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3Ig YW55IHB1cnBvc2UsDQogb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1l ZGl1bS4gVGhhbmsgeW91Ljxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fPGJyPg0KUkFUUyBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0i bWFpbHRvOlJBVFNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6SGVsdmV0aWNhIj5SQVRTQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9 Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0cyI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPmh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vcmF0czwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OkhlbHZldGljYSI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X188YnI+DQpSQVRTIG1haWxpbmcgbGlzdDxicj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86UkFU U0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2 ZXRpY2EiPlJBVFNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj48YnI+DQo8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRzIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9yYXRzPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_EF9AEDD959A8498895BFC1B4A7E7BB79intelcom_-- From nobody Fri Apr 10 06:25:30 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 225313A09B9 for ; Fri, 10 Apr 2020 06:25:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.166 X-Spam-Level: X-Spam-Status: No, score=-2.166 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=SB/uaaDC; dkim=pass (1024-bit key) header.d=juniper.net header.b=BgcluaiY Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NTFRyPjAt6g0 for ; Fri, 10 Apr 2020 06:25:21 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0a-00273201.pphosted.com [208.84.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBCB23A09B4 for ; Fri, 10 Apr 2020 06:25:21 -0700 (PDT) Received: from pps.filterd (m0108157.ppops.net [127.0.0.1]) by mx0a-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 03ADOJ7g022357; Fri, 10 Apr 2020 06:25:21 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=6gRwwxiBypVokLohjjdvmC6dMyKxYuVN2g6VgjtYoLA=; b=SB/uaaDCbS2wiRDRgffM3ZWJM7rfYzqoZtHgFDv2t84MHog482CZ9RHqm7bGmwSl0OA8 0A3YI4aiDKzkXnydt2RCcCdHI4HvReIsS/uwj9oLffrCmvSF9In7usQ4cUt1VOcTiRAY Mdz0mfKX3VdeMj+d6wxP8qd60C3kFFzOmRbPSE1RDQCocg1CeRpvS3R6zgthro6KSVp6 yWzNtnyifC7RmKg5sA+noMhd35Bu2sPebTC7Jd5mZxHlUf72lVKi5t0NFfYHiSl9flNM MQ1TaLynJdFrso6wvk17NbhuvhCHLm5cGRXgWkgwwMe9s0vyK0yZHo0mcbmB/etXZche vw== Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2106.outbound.protection.outlook.com [104.47.70.106]) by mx0a-00273201.pphosted.com with ESMTP id 3091rhde3b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 10 Apr 2020 06:25:20 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=afdge+76VBgmkC51+G97+LyC9vKBUEga6lSryi9FtkPInAsHi72eNh3u5ot0u9UEV9hbbd2o9wPXpLacoLhmhx0Hk701yM9HN2Tk9XyAQgHp9/u2gNv8J9FTvuGPk1CqswhREUbFHfM6YxVNrL5ccQvogx+Yrxumzych1iUppIdF1SGolaR3COKTBaacTekGuWB3X92Ex/AeREzGtuveykCf0hyAA0OmGjDG00td1gEHQyEHz+t9Eb8uK2wsDAgJ8l65Iv6LWC7Z8YKP4Lx3B5KBVR5KrlGPB+czIdqhvy9vIL5SKiFcOucH7omVPvgVrc6+918ltjzGz4SNKcHJEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6gRwwxiBypVokLohjjdvmC6dMyKxYuVN2g6VgjtYoLA=; b=a3e/lb5+rRJTzGovICrynxzQPAbi8lRoSQeuKvUolrCI6TjsHGqeBfIpUB0Ns74mbkGUV/jvlXHX0iGWIt6Oqo/ejdO+iQOY/JtQu7+4IGy9P/cRpCz/KbUUV+oQJFJBW0poAekFk/GkgQf3jW+mDMY5vrXxD0A9KQt6o5Jmx4EU2GEvQKWil/PnJqIRnRBugRZmYZ3U1LAbkLmz7G9OBC7Ed7Lo2JBgm/7YnSUg2pIKFWayP06cnWFuU+RrAS+D2mMmq38RTo3+45/vpETFSsTTvHryLU98y1qFMdKpECgxUGS2WtOeb7F59yRaVe+uGe0UonjRmeDuouAiBHhs8Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6gRwwxiBypVokLohjjdvmC6dMyKxYuVN2g6VgjtYoLA=; b=BgcluaiYLOwcHTTwNJU9Hij/Vm6t4w0vNqBluBfbWUM6CPt+Bq3Mn3PAxhH/IKvIgJkjbHxY4u9VviVzvKdeK8wpvl351yOR6EfN0WCWycGwPYNEp/gNRh16Y+mLpEH0n+ooXB5TO4F1bnm+iLl+WMj5KxPnVB7DvOX/0sdfX1c= Received: from DM6PR05MB6889.namprd05.prod.outlook.com (2603:10b6:5:204::22) by DM6PR05MB6700.namprd05.prod.outlook.com (2603:10b6:5:121::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.14; Fri, 10 Apr 2020 13:25:17 +0000 Received: from DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1]) by DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1%7]) with mapi id 15.20.2921.009; Fri, 10 Apr 2020 13:25:06 +0000 From: Guy Fedorkow To: Laurence Lundblade CC: "rats@ietf.org" , Ned Smith Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9b/q6maJEL0kaGXfcqT+zj8qhtv9mAgABNSQCAAtK/EIAAbmaAgAEL1aA= Date: Fri, 10 Apr 2020 13:25:06 +0000 Message-ID: References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> <408AB883-23FC-48AE-8563-426980FC7E81@island-resort.com> In-Reply-To: <408AB883-23FC-48AE-8563-426980FC7E81@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-10T13:25:03.6032883Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=46bb0065-a8b5-4e87-8dca-5c29707b2215; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic dlp-product: dlpe-windows dlp-version: 11.3.2.8 dlp-reaction: no-action x-originating-ip: [66.129.241.11] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 0b557b2d-ed6f-44e9-3fa0-08d7dd529581 x-ms-traffictypediagnostic: DM6PR05MB6700: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0369E8196C x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR05MB6889.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(396003)(346002)(376002)(39860400002)(366004)(136003)(53546011)(66574012)(81156014)(7696005)(5660300002)(2906002)(8936002)(6916009)(30864003)(26005)(8676002)(186003)(6506007)(66446008)(4326008)(66946007)(64756008)(66476007)(33656002)(66556008)(478600001)(54906003)(76116006)(71200400001)(15650500001)(55016002)(966005)(9686003)(316002)(52536014)(86362001); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 5AbLOvoqAkxD/0qrzZ3IOPHjRMfrHiyAPRpsN14oepokgps8VjriLlJovnBm5HPb51BRdYvOgRFxxio8LZInjDC6H8froqWfaw+3hUHgcaW+WY/C3F34SsiV8KfhyuvJoD0CzQYIO3/dAJTLCWd9MdVU9Su5xIGqN2gssNBJrJrJ3PZmGQw5tAlQiO65o8nOUNjTsFpdDIHSfngm+hbkkAfeHaJINBG57voihjG22JD+hM0R5lyED8kkOQ4JmPYuNdOzHhbG3SThZQPvvJR463w35T+e2ZP4QyHuoVLJI0JWLYQFGPbtiEI4BdSQVVpSdH1W1fTMvls12PQT2y12uHHpu1UrpFqHGzZuhpBFvKczgHjbDLvx1EBfDu2RVbrWgx0FUswg3r1tgMmsKwcQuOutbcq7r0GkfBKZiQHGxKybk94qm7yTVfHbUgyogsePL9wqhoyaDH1Og61IGuEEv9M+ujfsjLdvu6d1NEQIafzsuXj5SI8oi6C65S8Um/KNKuiNOe8O3kZRk9BgDEcABw== x-ms-exchange-antispam-messagedata: sUJ0r23vu8nymoAB2FkCRkab5wesAEzLLe4UjPXhG7hKcxGDFNn82uo43sTRAS1VHb+yAyuD4ul5WN0+s8qp8b4ilVOUw/YW1oIcdXOazXQuQeInhbxSojUpvbOzlW+LSOrkgMWjCxdJRYasfbJmqQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR05MB6889949334B6385B2E1F475ABADE0DM6PR05MB6889namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: 0b557b2d-ed6f-44e9-3fa0-08d7dd529581 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Apr 2020 13:25:06.0517 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: JL+MW61ARxps7ptlJ/NwKhasjokBV9VPtWfHemoImW9+3Nri+1VdPmT5yUFxRB0nIBiwGpH9C8K6EZ3Kke29YQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR05MB6700 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-10_04:2020-04-09, 2020-04-10 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 suspectscore=0 lowpriorityscore=0 adultscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 spamscore=0 mlxscore=0 impostorscore=0 bulkscore=0 mlxlogscore=999 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004100111 Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Apr 2020 13:25:27 -0000 --_000_DM6PR05MB6889949334B6385B2E1F475ABADE0DM6PR05MB6889namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTGF3cmVuY2UNCg0KDQoNCkp1bmlwZXIgQnVzaW5lc3MgVXNlIE9ubHkNCkZyb206IExhdXJl bmNlIEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPg0KU2VudDogVGh1cnNkYXksIEFw cmlsIDksIDIwMjAgNDo1NSBQTQ0KVG86IEd1eSBGZWRvcmtvdyA8Z2ZlZG9ya293QGp1bmlwZXIu bmV0Pg0KQ2M6IHJhdHNAaWV0Zi5vcmc7IE5lZCBTbWl0aCA8bmVkLnNtaXRoQGludGVsLmNvbT4N ClN1YmplY3Q6IFJlOiBbUmF0c10gRW5kb3JzZW1lbnQgSUQgYW5kIHZlcmlmaWNhdGlvbiBrZXkg KHdhcyBQcm9jZXNzaW5nIEVuZG9yc2VtZW50cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzKQ0K DQpbRXh0ZXJuYWwgRW1haWwuIEJlIGNhdXRpb3VzIG9mIGNvbnRlbnRdDQoNCkhpIEd1eSwNCg0K DQpPbiBBcHIgOSwgMjAyMCwgYXQgNzozMSBBTSwgR3V5IEZlZG9ya293IDxnZmVkb3Jrb3dAanVu aXBlci5uZXQ8bWFpbHRvOmdmZWRvcmtvd0BqdW5pcGVyLm5ldD4+IHdyb3RlOg0KDQpIaSBMYXVy ZW5jZSwNCiAgSSB1bmRlcnN0YW5kIHRoYXQgdGhlIGRpc2N1c3Npb24gb24gdGhlIHRvcGljIGJl bG93IG1haW5seSBwZXJ0YWlucyB0byBFQVQsIGJ1dCBJ4oCZZCBsaWtlIHRvIG1ha2Ugc3VyZSB3 ZeKAmXJlIG5vdCBtaXNzaW5nIHNvbWV0aGluZyBvbiB0aGUgUklWIHNpZGUuDQoNCldhcyB0cnlp bmcgZm9yIGEgZ2VuZXJhbCBkZXNjcmlwdGlvbiBpbnRvIHdoaWNoIFRQTS1iYXNlZCBzdHVmZiBm aXRzIHRvby4NCltndXldIFllcywgSSBhcHByZWNpYXRlIHRoZSBuZWVkIGZvciBhIGdlbmVyYWwg c29sdXRpb24sIGJ1dCBhdCB0aGUgc2FtZSB0aW1lLCBJ4oCZZCBsaWtlIHRvIHRyeSB0byBub3Qg aW1wb3J0IGNvbXBsZXhpdHkgdG8gdGhlIGFwcGxpY2F0aW9ucyB0aGF0IGRvbuKAmXQgc2VlbSB0 byBuZWVkIGl0Lg0KDQogIEZvciBPUyBzb2Z0d2FyZSBpbWFnZSBpbnRlZ3JpdHkgdXNpbmcgYSBU UE0sIGl0IHNlZW1zIGxpa2UgZmluZGluZyB0aGUgcmlnaHQgbWFuaWZlc3Qgc2hvdWxkbuKAmXQg YmUgdGhhdCBoYXJk4oCmDQogIFRoZSBBdHRlc3RlciBuZWVkcyB0byBoYXZlIHByZS1wcm92aXNp b25lZCBpZGVudGl0eSBhbmQgYXR0ZXN0YXRpb24ga2V5cyBhcyBvdXRsaW5lZCBpbiB0aGUgUklW IGRyYWZ0LiAgVGhhdCBwcm92aWRlcyB0aGUgVmVyaWZpZXIgd2l0aCB0aGUgdmVuZG9yIGlkZW50 aXR5IGZvciB0aGUgcm9vdCBvZiB0cnVzdC4NCg0KVGhhdCBpcyB0byBzYXkgeW91IGhhdmUgYSBm dW5jdGlvbmluZyBUUE0tYmFzZWQgYXR0ZXN0ZXIuIElkZW50aXR5IGlzIG9mIHRoZSBBdHRlc3Rl ciBvbmx5LCBub3QgdGhlIE9TIFNvZnR3YXJlLCByaWdodD8NCltndXldIFllcywgdGhlIHByZS1w cm92aXNpb25lZCBrZXlzIGFzc3VtZWQgaW4gUklWIGFyZSBmb3IgdGhlIGlkZW50aXR5IG9mIHRo ZSBwbGF0Zm9ybSBpdHNlbGYgKERldklEKSBhbmQgdGhlIGF0dGVzdGF0aW9uIGtleSBpbiB0aGUg VFBNIChJQUspLiAgSW1wbGVtZW50YXRpb25zIHVzaW5nIFRQTSBvZiBjb3Vyc2UgYXNzdW1lIHRo YXQgdGhlIFRQTSBpdHNlbGYgaXMgc2VjdXJlLCBidXQgYWxzbyByZXF1aXJlIHNvbWUgaW1wbGlj aXRseS10cnVzdGVkIGNvZGUgdG8gdGFrZSB0aGUgZmlyc3QgbWVhc3VyZW1lbnQsIGxhdW5jaGlu ZyB0aGUgY2hhaW4gb2YgdHJ1c3QuDQoNClRoZSBtZWFzdXJlbWVudCBsb2dzIGNvbnRhaW4gdGhl IGFsbGVnZWQgcHJvZHVjdCBuYW1lIGFuZCB2ZXJzaW9uIG51bWJlciBmb3IgdGhlIHNvZnR3YXJl IGluc3RhbGxlZCBvbiB0aGUgYm94Lg0KDQpBcmUgeW91IHNheWluZyB0aGF0IHRoZSBPUyBzb2Z0 d2FyZSB3aWxsIHdyaXRlIGl0cyBwcm9kdWN0IG5hbWUgYW5kIHZlcnNpb24gaW50byBhIFRQTSBt ZWFzdXJlbWVudCBsb2c/DQpbZ3V5XSDigJMgSSBkb27igJl0IHRoaW5rIGl0IG1hdHRlcnPigKYg IHRoZSBPUyBjYW4gcmVwb3J0IGl04oCZcyB2ZXJzaW9uIGFuZCBuYW1lIGFueSB3YXkgaXQgd2Fu dHPigKYgIGl04oCZcyBvbmx5IGEgaGludCBhdCBzaG9ydGVuaW5nIGEgc2VhcmNoIGZvciBhbiBh cHBsaWNhYmxlIFJJTS4NCg0KVXNlIHRoZSB2ZW5kb3IgSUQgdG8gbmFycm93IHRoZSBzY29wZSB0 byBzcGVjaWZpYyB2ZW5kb3LigJlzIHByb2R1Y3QgYW5kIHZlcnNpb24gc3BhY2UsIGFuZCBmaW5k IHRoZSBSSU0gdGhhdCBtYXRjaGVzLg0KDQpQcmVzdW1hYmx5IHRoZSB2ZW5kb3Igb2YgdGhlIGRl dmljZSwgKGUuZy4sIFNhbXN1bmcgZm9yIGEgcGhvbmUsIExlbm92byBmb3IgYSBsYXB0b3ApIHNp bmNlIHZlbmRvcuKAmXMgY3VzdG9taXplIE9TIFNXLg0KW2d1eV0gWWVzLiAgVGhpcyBhZG1pdHRl ZGx5IGlzICptdWNoKiBlYXNpZXIgb24gYW4gZW1iZWRkZWQgZGV2aWNlIGxpa2UgYSByb3V0ZXIs IHdoZXJlIHRoZSB2ZW5kb3Igc3VwcGxpZXMgdGhlIGhhcmR3YXJlLCBpdOKAmXMgcm9vdCBvZiB0 cnVzdCwgYW5kIHRoZSBPUywgYnV0IEkgZG9u4oCZdCB0aGluayB0aGF04oCZcyBhbiBlc3NlbnRp YWwgcmVxdWlyZW1lbnQuDQoNCiAgVGhlbiBjaGVjayBpZiB0aGUgaGFzaGVzIGxpbmUgdXA7IGlm IHNvLCB5b3XigJlyZSBnb29kLCBpZiBub3QsIGVpdGhlciB0aGUgY2xhaW0gb2Ygd2hhdCBzb2Z0 d2FyZSBpcyBwcmVzZW50IHdhcyBpbmNvcnJlY3QsIG9yIHNvbWV0aGluZyBnb3QgaGFja2VkLg0K DQpTZWVtcyBsaWtlIHRoZXJl4oCZcyBhIHN0ZXAgb2YgbWVhc3VyaW5nIHRoZSBPUyBTb2Z0d2Fy ZSBtaXNzaW5nLiBUaGF0IGhhcyB0byBiZSBidWlsdCBpbnRvIHRoZSBib290IGxvYWRpbmcgc2Vx dWVuY2UgdG8gYmUgcHJvcGVybHkgc2VjdXJlLiBTdGVwIDEgbWVhc3VyZXMgdGhlIGNvZGUgZm9y IFN0ZXAgMiwgdGhlbiBTdGVwIDIgbG9hZHMsIHRoZW4gU3RlcCAyIG1lYXN1cmVzIGNvZGUgZm9y IFN0ZXAgMyBhbGwgdGhlIHdoaWxlIHJlY29yZGluZyB0aGUgbWVhc3VyZW1lbnRzIGluIHRoZSBU UE0uICBQcmV0dHkgc3VyZSB0aGVyZSBhcmUgbG90cyBvZiBPU+KAmXMgdGhhdCBkb27igJl0IGtu b3cgaG93IHRvIHB1dCBtZWFzdXJlbWVudHMgaW50byBhIFRQTS4NCg0KU29tZSBURUUtYmFzZWQg YXJjaGl0ZWN0dXJlcyB1c2UgdGhlIFRFRSB0byBsb2FkIGFuZCB2ZXJpZnkgYSBzdWJzeXN0ZW0u IEZvciBleGFtcGxlIGEgcGhvbmUgbWlnaHQgY29uc2lzdCBvZiBhIFRFRSwgYSBtYWluIE9TIHJ1 bm5pbmcgQW5kcm9pZCBhbmQgc29tZSBzdWJzeXN0ZW1zIChBdWRpbywgY2VsbHVsYXIgbW9kZW3i gKYpLiBUaGUgVEVFIHRha2VzIGNhcmUgb2YgdGhlIGxvYWRpbmcgYW5kIHZlcmlmaWNhdGlvbiBv ZiB0aGUgc3Vic3lzdGVtIFNXIGJ5IHJlYWRpbmcgYW5kIHdyaXRpbmcgaW50byB0aGUgc3Vic3lz dGVtcyBtZW1vcnksIHRoZW4gdGhlIFRFRSBzaWduYWxzIHRoZSBzdWJzeXN0ZW0gdG8gZ28gb3V0 IG9mIHJlc2V0LiBJdCBtb3JlIG9yIGxlc3MgYm9vdGVkIHdpdGhvdXQgdGhlIHN1YnN5c3RlbeKA mXMgQ1BVIGRvaW5nIGEgdGhpbmcuIChBbmQgdGhlIFRFRSBjYW4gbGF0ZXIgdG8gYSBydW4tdGlt ZSBpbnRlZ3JpdHkgY2hlY2sgb24gaXQsIHNvbWV0aGluZyB5b3UgY2Fu4oCZdCBkbyB3aXRoIGEg VFBNKS4NCg0KW2d1eV0gQWJzb2x1dGVseSwgSSB0aGluayBtb3N0IGludGVncml0eSBwbGFucyBh c3N1bWUgdGhlIGNoYWluIG9mIHRydXN0IG1vZGVsLiAgVGhlIFRQTSBhcHByb2FjaCBhc3N1bWVz IGFuIHVuYnJva2VuIGNoYWluIG9mIG1lYXN1cmVtZW50cyBmcm9tIHRoZSByb290IG9mIHRydXN0 LiBMb3RzIG9mIE9T4oCZcyBjYW7igJl0IGRvIHRoYXQsIGJ1dCBhbGwgYW4gZW1iZWRkZWQgdmVu ZG9yIG5lZWRzIGlzIG9uZSB0aGF0IGNhbiENCg0KICBTZWVtcyBsaWtlIGEgdmVyaWZpZXIgY291 bGQgZm9sbG93IHRoaXMgc2FtZSBtb2RlbCB0aHJvdWdoIHRoZSBlbnRpcmUgY2hhaW4gb2YgdHJ1 c3QsIGV2ZW4gdGhyb3VnaCBtdWx0aXBsZSB2ZW5kb3JzLCBhcyBsb25nIGFzIHRoZXJlIGFyZSBu byBnYXBzIGluIHRoZSBjaGFpbi4NCg0KU2VlbXMgbGlrZSB5b3UgbmVlZCBlYWNoIHBhcnRpY2lw YW50IGluIHRoZSBjaGFpbiBrbm93IGhvdyB0byBtZWFzdXJlIGFuZCB3cml0ZSBpbnRvIHRoZSBU UE0uIFRoYXQgZG9lc27igJl0IHNlZW0gbGlrZWx5IHRvIGhhcHBlbiB0byBtZSB1bmxlc3MgdGhl IHdob2xlIGFyY2hpdGVjdHVyZSB3YXMgZGVzaWduZWQgYXJvdW5kIGEgVFBNLg0KW2d1eV0gU2Vl IOKAnGVtYmVkZGVk4oCdIGFib3ZlIPCfmIoNCg0KICBJIGtub3cgRUFUIG5lZWRzIHRvIHdvcmsg aW4gYSBsZXNzLWNvbnN0cmFpbmVkIGVudmlyb25tZW50LCBidXQgbGV0IG1lIGtub3cgaWYgeW91 IHRoaW5rIHdl4oCZcmUgb3ZlcnNpbXBsaWZ5aW5nIHRoaXMgb24gUklWLg0KDQpFQVQgaXMgaW50 ZW5kZWQgdG8gd29yayBpbiB2ZXJ5IGNvbnN0cmFpbmVkIGVudmlyb25tZW50cy4gSWYgeW91IGp1 c3QgaGF2ZSBsaW1pdGVkIHN1YnNldCBvZiBjbGFpbXMsIHlvdSBjYW4gYnVpbGQgSFcgdG8gaW1w bGVtZW50IEVBVC4gQ0JPUiBpcyBkZXNpZ25lZCB3ZWxsIGVub3VnaCB0aGF0IHRoaXMgaXMgcG9z c2libGUuDQpbZ3V5XSBhaCwgZGlmZmVyZW5jZSBpbiB3aGF0IHdlIG1lYW4gYnkgQ29uc3RyYWlu ZWTigKYgIEkgdGhpbmsgeW914oCZcmUgdGhpbmtpbmcgb2YgY29uc3RyYWluZWQgaW4gdGVybXMg b2YgcG93ZXIgYW5kIHRyYW5zaXN0b3JzLiAgSSB3YXMgdGhpbmtpbmcgbW9yZSBvZiB0aGUgZWNv c3lzdGVt4oCmICBhcyB5b3Ugc2F5LCB5b3UgY2Fu4oCZdCBqdXN0IHRha2UgYW55IG9sZCByYW5k b20gY29sbGVjdGlvbiBvZiBwYXJ0cywgT1PigJlzIGFuZCBhcHBsaWNhdGlvbnMsIHN0aXIgaW4g c29tZSBUUE0gYW5kIGdldCBzZWN1cml0eS4gIChBcyBtdWNoIGFzIG91ciB2YXJpb3VzIFZQ4oCZ cyBhbmQgZXhlY+KAmXMgd291bGQgbGlrZSEpDQoNCg0KICBUaGFua3MNCg0KQXBwcmVjaWF0ZSB0 aGVzZSBkaXNjdXNzaW9ucyBhcyBpdCBoZWxwcyBpbGx1bWluYXRlIHRoZSBjb3JlIHByaW5jaXBs ZXMgYXQgd29yayBvbiB0aGUgVFBNIHNpZGUgYW5kIHRoZSBURUUgc2lkZS4gQm90aCBhcmUgc2Vj dXJlLCBBRkFJSyA6LSksIGJ1dCBtYWRlIGRpZmZlcmVudCBjaG9pY2VzIGFuZCBoYXZlIGRpZmZl cmVudCBjYXBhYmlsaXRpZXMuDQoNCltndXldIFllcywgZGlmZmVyZW50IG1lYW5zIHRvIGEgc2lt aWxhciBlbmQuICBJIHRoaW5rIHRoZSB2aWV3IHBhcnRseSBkZXBlbmRzIG9uIHdoZXRoZXIgdGhl IHZlbmRvciBpbiBxdWVzdGlvbiBwcmluY2lwYWxseSByZWxpZXMgY29tbW9kaXR5IHByb2Nlc3Nv cnMsIG9yIGlzIGluIGNoYXJnZSBvZiBkZXNpZ25pbmcgdGhlaXIgcHJvY2Vzc29ycyBmcm9tIHNp bGljb24gb24gdXAuDQogIFRoYW5rcyBMYXVyZW5jZSENCg0KDQovZ3V5DQoNCg0KTEwNCg0KDQoN Cg0KSnVuaXBlciBCdXNpbmVzcyBVc2UgT25seQ0KRnJvbTogUkFUUyA8cmF0cy1ib3VuY2VzQGll dGYub3JnPG1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgTGF1cmVu Y2UgTHVuZGJsYWRlDQpTZW50OiBUdWVzZGF5LCBBcHJpbCA3LCAyMDIwIDM6MTMgUE0NClRvOiBU aG9tYXMgRm9zc2F0aSA8VGhvbWFzLkZvc3NhdGlAYXJtLmNvbTxtYWlsdG86VGhvbWFzLkZvc3Nh dGlAYXJtLmNvbT4+DQpDYzogcmF0c0BpZXRmLm9yZzxtYWlsdG86cmF0c0BpZXRmLm9yZz47IE5l ZCBTbWl0aCA8bmVkLnNtaXRoQGludGVsLmNvbTxtYWlsdG86bmVkLnNtaXRoQGludGVsLmNvbT4+ DQpTdWJqZWN0OiBSZTogW1JhdHNdIEVuZG9yc2VtZW50IElEIGFuZCB2ZXJpZmljYXRpb24ga2V5 ICh3YXMgUHJvY2Vzc2luZyBFbmRvcnNlbWVudHMgYW5kIEV2aWRlbmNlIGludG8gUmVzdWx0cykN Cg0KW0V4dGVybmFsIEVtYWlsLiBCZSBjYXV0aW91cyBvZiBjb250ZW50XQ0KDQpUaGlzIGlzIGEg cmVwbHkgdG8gYm90aCBUaG9tYXMgYW5kIE5lZOKAmXMgbWVzc2FnZSBvbiBkZWJ1ZyBpbiB0aGUg cmVsYXRlZCB0aHJlYXQuDQoNCk15IGluY2xpbmF0aW9uIGlzIHRvIGFzc29jaWF0ZSBlbmRvcnNl bWVudHMgd2l0aCB0aW1lLWludmFyaWFudCBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGRldmljZS4g QXQgdGhlIG1vbWVudCB0aGlzIGRvZXNu4oCZdCBzZWVtIGxpa2UgdGhlIG9ubHkgd2F5IHRvIGRv IGl0LCBidXQgaXQgc2VlbXMgbGlrZSBhIGdvb2Qgd2F5LiBUaGluZ3MgdGhhdCBhcmUgbm90IHRp bWUgaW52YXJpYW50IGFyZSBwb2xpY3ksIGstZy12IG9yIHN1Y2guDQoNCkVuZG9yc2VtZW50DQpT eXN0ZW0gYXJjaGl0ZWN0dXJlIOKAlCBEb2VzIHRoZSBBdHRlc3RlciB1c2UgYSBURUUgb3IgYSBU UE0gb3IgbWF5YmUgaXQgaXMgc2ltcGxlIHN5c3RlbSB3aXRoIGp1c3QgYSBzaW1wbGUgQ1BVLCBi dXQgaXQgaXMgZW5jYXNlZCBpbiB0aXRhbml1bS4gSXMgZGVmZW5zZSBhZ2FpbnN0IGNoaXAgaW52 YXNpdmUgYXR0YWNrcyBjb25zaWRlcmVkPyBEbyBrZXlzIGJlY29tZSBpbmFjY2Vzc2libGUgd2hl biBkZWJ1ZyBpcyBlbmFibGVkLg0KDQpEZXZlbG9wbWVudCBwcm9jZXNzIOKAlCBJcyB0aGVyZSBh IHNwZWNpYWwgc2VjdXJpdHktb3JpZW50ZWQgdGVhbT8gRG9lcyB0aGUgdGVhbSBoYXZlIGEgY29k ZSByZXZpZXcgcG9saWN5PyBJcyB0aGVyZSBhIGJ1ZyBib3VudHk/IEFyZSB0aGUgZGVza3RvcHMg YW5kIElUIHN5c3RlbXMgdXNlZCBmb3IgSFcgYW5kIFNXIGRldmVsb3BtZW50IGlzb2xhdGVkPw0K DQpNYW51ZmFjdHVyaW5nIOKAlCBBcmUgdGhlIGZhY3RvcmllcyBzZWN1cmVkIGluIGEgc3BlY2lh bCB3YXk/IElzIHRoZSBhdHRlc3RhdGlvbiBrZXkgcHJvdmlzaW9uaW5nIHN5c3RlbSBoYXJkZW5l ZCBpbiBzb21lIHdheSAoZS5nLiwgdXNlcyBIU01zKS4NCg0KQ2VydGlmaWNhdGlvbnMg4oCUIFRo ZXNlIHRha2UgYSBsb25nIHRpbWUgdG8gYWNoaWV2ZSBhbmQgd2lsbCB1c3VhbGx5IHJlcXVpcmUg c29tZSBvZiB0aGUgYWJvdmUuDQoNCk15IHRoaW5raW5nIGZvciBFQVQgd2FzIHRoYXQgeW91IG9u bHkgcHV0IGF0dGVzdGF0aW9uIGtleXMgaW50byBkZXZpY2VzIHRoYXQgbWVldCBzb21lIGNyaXRl cmlhIGxpa2Ugc29tZSBvZiB0aGUgYWJvdmUuIFNpbmNlIHRoZXJlIGlzIG9mdGVuIG5vIHdheSB0 byByZWNvdmVyIGZyb20gYSBjb21wcm9taXNlZCBhdHRlc3RhdGlvbiBrZXkgYmVjYXVzZSBubyBr ZXkgbW9yZSBzZWN1cmUgdGhhbiBpdCwgeW91IGtpbmQgb2YgaGF2ZSB0byBoYXZlIGFsbCB0aGF0 Lg0KDQpTaW5jZSB0aGVzZSBkb27igJl0IGNoYW5nZSBtdWNoIG92ZXIgdGltZSwgdGhlIGVuZG9y c2VtZW50IHdvdWxkbuKAmXQgY2hhbmdlLiAgVGhleSBjb3VsZCBldmVuIHNwYW4gc2V2ZXJhbCBt b2RlbHMgYW5kIHZhcnlpbmcgSFcuDQoNClBvbGljeSwgSy1HLVYsIG90aGVyDQpTVyBWZXJzaW9u cyDigJQgQXMgbG9uZyBhcyB0aGUgU1cgZm9sbG93cyBhIGRldmVsb3BtZW50IHByb2Nlc3MgbGlr ZSB0aGF0IGFib3ZlLCBpdCBkb2VzbuKAmXQgaGF2ZSB0byBiZSBpbmNsdWRlZCBpbiB0aGUgZW5k b3JzZW1lbnQuIE9mIGNvdXJzZSB0aGUgc21hbGxlciB0aGUgU1cgYW5kIHRoZSBiZXR0ZXIgdGhl IHByb2Nlc3MsIHRoZSBtb3JlIGl0IGlzIHRydWUgKGFuZCB2aWNlIHZlcnNhKS4NCg0KQmxhY2ts aXN0cyDigJQgVGhlc2UgbWlnaHQgYmUgc3BlY2lmaWMgdG8gVUVJRHMsIHZlcnNpb25zIG9mIFNX LCBkZXBsb3ltZW50cyBhIHBhcnRpY3VsYXIgT0VNIG9yIHN1Y2gNCg0KRGVidWcgc3RhdHVzIOKA lCBNb3N0IG9mIHRoZSBkZWJ1ZyBzdGF0dXMgdmFsdWVzIGNhbiB2YXJ5IG9uIGEgZGF5LWRheSBi YXNpcw0KDQpPRU0gbW9kZWwg4oCUIElmIHRoZSBhdHRlc3RhdGlvbiBpcyBpbXBsZW1lbnRlZCBi eSBhIGNoaXAgdmVuZG9yIGFuZCB0aGUgZW5kb3JzZW1lbnQgaXMgZm9yIHRoZSBjaGlwLCB0aGVu IHRoZSBPRU0gbW9kZWwgd2lsbCB2YXJ5IHdpZGVseS4NCg0KTm9uZSBvZiB0aGVzZSBjYW4gYmUg Y3JpdGVyaWEgYXMgdG8gd2hldGhlciBhbiBhdHRlc3RhdGlvbiBrZXkgaXMgcHV0IGludG8gYSBk ZXZpY2Ugb3Igbm90IGFzIHRoZXkgYXJlIG5vdCBrbm93biBhdCBtYW51ZmFjdHVyaW5nIHRpbWUg YW5kL29yIG11c3QgYmUgYWxsb3dlZCB0byB2YXJ5IHdpZGVseSBhZnRlciBtYW51ZmFjdHVyaW5n Lg0KDQoNCkkgdGhpbmsgd2hhdCBJ4oCZdmUgZGVzY3JpYmVkIGFib3ZlIGxpbmVzIHVwIHByZXR0 eSB3ZWxsIGZvciBhIFRQTS4gVGhlIHN5c3RlbSBhcmNoaXRlY3R1cmUgaXMgbW9zdGx5IHNldCBi eSB0aGUgVENHLiBIVyBUUE1zIGFyZSBhbG1vc3QgYWx3YXlzIGNlcnRpZmllZC4gVGhleSBhcmUg aW5kZXBlbmRlbnQgb2YgT0VNIG1vZGVsLiBJdCBhbHNvIGxpbmVzIHVwIHJlYXNvbmFibHkgd2Vs bCB3aXRoIHNlY3VyZSBlbGVtZW50cyBhbmQgY2FuIGxpbmUgdXAgd2l0aCBURUXigJlzLg0KDQpU aGUgY3J1eCBvZiBlbmRvcnNlbWVudCB0byBtZSBpcyB0aGUgc2VjdXJpdHkgY2hhcmFjdGVyaXN0 aWNzIG9mIHRoZSBhdHRlc3RlciB0aGF0IHByb3RlY3QgdGhlIGF0dGVzdGF0aW9uIGtleSBiZWNh dXNlIHRoZXJlIGlzIGdlbmVyYWxseSBubyByZWNvdmVyeSBmcm9tIGEgY29tcHJvbWlzZWQgYXR0 ZXN0YXRpb24ga2V5LiBJdCBzZXRzIHRoZSBiYXNlbGluZSByaXNrIG9mIHRoZSBIVyBhbmQgU1cg b2YgdGhlIGRldmljZS4NCg0KDQpPbiBvbmUgZXh0cmVtZSBpcyBhIHNlcGFyYXRlIGVuZG9yc2Vt ZW50IGZvciBldmVyeSBkZXZpY2UgKOKAnG1pY3JvIGVuZG9yc2VtZW50Ij8pLCB3aGljaCBpcyB3 aGF0IEkgdGhpbmsgVGhvbWFzIGFuZCBBUk0gUFNBIGFyZSB0ZW5kaW5nIHRvd2FyZHMuIFRoZSBv dGhlciBleHRyZW1lIGlzIG9uZSBlbmRvcnNlbWVudCBmb3IgYSBwcm9kdWN0IGxpbmUgKOKAnG1h Y3JvIGVuZG9yc2VtZW50Ij8pLCwgc2F5IGEgcHJvZHVjdCBsaW5lIG9mIFRQTXMuIFRoZW4gaXTi gJlzIG1vcmUgbGlrZSB0aGUgZGF0YSBzaGVldCBmb3IgdGhlIHByb2R1Y3QuDQoNClRoZW4gdGhl cmXigJlzIGRpZmZlcmVudCB3YXlzIHRvIGZhbiB0aGlzIG91dCB0byB0aGUgZGlmZmVyZW50IGtl eSAvIHNpZ25pbmcgc2NoZW1lcyAocGVyLWRldmljZSBrZXksIGdyb3VwIGtleSwgRUNEQUEsIFgu NTA5KS4gRm9yIGV4YW1wbGUgYSBtYWNyby1lbmRvcnNlbWVudCBjb3VsZCBpbmNsdWRlIHRoZSBy b290IG9mIGFuIFguNTA5IGhpZXJhcmNoeSBhbmQgdGhlIGluZGl2aWR1YWwgZGV2aWNlcyAob3Ig Z3JvdXBzIG9mIGRldmljZXMpIHdvdWxkIGhhdmUgaW5kaXZpZHVhbCBrZXlzIHRoYXQgY2hhaW4g dXAuIFdpdGggYSBtaWNyby1lbmRvcnNlbWVudCB0aGUgcGVyLWRldmljZSBwdWJsaWMga2V5IGNv dWxkIGJlIHBlciBlbmRvcnNlbWVudC4NCg0KDQpUaGUgbW9zdCBpbXBvcnRhbnQgdGhpbmcgYWJv dXQgdGhlIGVuZG9yc2VtZW50IHNlZW1zIHRvIG1lIGlzIHRoZSBjaGFyYWN0ZXJpemF0aW9uIG9m IGhvdyB0aGUgYXR0ZXN0YXRpb24ga2V5IGlzIHByb3RlY3RlZC4NCg0KTEwNCg0KDQoNCk9uIEFw ciA3LCAyMDIwLCBhdCA3OjM2IEFNLCBUaG9tYXMgRm9zc2F0aSA8VGhvbWFzLkZvc3NhdGlAYXJt LmNvbTxtYWlsdG86VGhvbWFzLkZvc3NhdGlAYXJtLmNvbT4+IHdyb3RlOg0KDQpIaSBMYXVyZW5j ZSwNCg0KVGhhbmtzIGZvciBicmluZ2luZyB0aGlzIHVwLiAgQSBmZXcgdGhvdWdodHMgYmVsb3cu DQoNCk9uIDAzLzA0LzIwMjAsIDIwOjM3LCAiUkFUUyBvbiBiZWhhbGYgb2YgTGF1cmVuY2UgTHVu ZGJsYWRlIg0KPHJhdHMtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86cmF0cy1ib3VuY2VzQGlldGYu b3JnPiBvbiBiZWhhbGYgb2YgbGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5k LXJlc29ydC5jb20+PiB3cm90ZToNClNvIGhvdyBkb2VzIGEgVmVyaWZpZXIgZmluZCB0aGUgYXBw bGljYWJsZSBlbmRvcnNlbWVudCBmb3IgRXZpZGVuY2UgaXQNCndpc2hlcyB0byB2ZXJpZnkgYW5k IGtub3cgdGhhdCBpcyByZWFsbHkgdGhlIHJpZ2h0IGVuZG9yc2VtZW50Pw0KDQpTZWVtcyBsaWtl IHRoZSBFdmlkZW5jZSBuZWVkcyBzb21lIHNvcnQgb2YgYW4gZW5kb3JzZW1lbnQgbG9jYXRvciBJ RC4NClRoaXMgY291bGQgYmUgYSBVUkwgb3IgYSBHVUlELiBFQVQgY3VycmVudGx5IGhhcyB0aGUg b3JpZ2luYXRpb24gY2xhaW0NCnRvIHRyeSB0byBzb2x2ZSB0aGlzLCBidXQgaXQgaXMgaGFsZi1i YWtlZC4gSXQgbmVlZHMgdG8gZ2V0IGZpeGVkLiBJ4oCZbQ0KZmlzaGluZyBmb3IgY29tbWVudHMg aGVyZSBvbiB3aGF0IGl0IHNob3VsZCBiZSBsaWtlLg0KDQpQcmV0dHkgc3VyZSB0aGUgRW5kb3Jz ZW1lbnQgbmVlZHMgdG8gaW5jbHVkZSBvciByZWZlcmVuY2UgdGhlIHB1YmxpYw0Ka2V5IHRoYXQg aXMgdXNlZCB0byB2ZXJpZnkgdGhlIHNpZ25hdHVyZS4gV2l0aG91dCB0aGF0LCB0aGUgQXR0ZXN0 ZXINCmNvdWxkIGxpZSBhbmQgcGljayBhbnkgb2xkIEVuZG9yc2VtZW50IHRoYXQgaXQgd2lzaGVz LiBUaGVyZSBuZWVkcyB0bw0KYmUgc29tZSBiaW5kaW5nIGJldHdlZW4gaXRlbXMgaW4gdGhlIGVu ZG9yc2VtZW50IChFMCwgRTEs4oCmKSBhbmQgdGhlDQp2ZXJpZmljYXRpb24ga2V5LiBUaGF0IGNv dWxkIGJlIGluIHRoZSBmb3JtIG9mIGEgc2lnbmVkIHRva2VuIG9yDQpjZXJ0aWZpY2F0ZSwgYnV0 IGRvZXNu4oCZdCBoYXZlIHRvIGJlLiBQcmV0dHkgc3VyZSB0aGlzIG5lZWRzIHRvIGJlDQpkaXNj dXNzZWQgaW4gdGhlIGFyY2hpdGVjdHVyZSBkb2MuDQoNClRoZXJlJ3MgYSBmZXcgc2NlbmFyaW9z Og0KLSBPbmUgZW5kb3JzZW1lbnQgYXBwbGllcyB0byBsb3RzIG9mIGRldmljZXMgaW4gdGhlIHNh bWUgY2xhc3MsIGJ1dA0KIGVhY2ggaGFzIHRoZWlyIG93biBhdHRlc3RhdGlvbiBrZXkuDQotIC0g UHJvYmFibHkgRUNEQUEgZml0cyBpbiBoZXJlDQotIC0gT25lIG9wdGlvbiBoZXJlIGlzIGFuIFg1 MDkgaGllcmFyY2h5DQotIEdyb3VwIGtleXMgYXJlIHVzZWQgKGZvciBwcml2YWN5IHJlYXNvbnMg b3Igb3RoZXIpIHNvIHRoZXJlIGlzIGENCiBvbmUtb25lIGNvcnJlbGF0aW9uIHdpdGggdGhlIEVu ZG9yc2VtZW50cyAodGhlIEdFSUQgZGlzY3Vzc2lvbikNCi0gR3JvdXAga2V5cyBhcmUgdXNlZCwg YnV0IGFjcm9zcyBkZXZpY2VzIHRoYXQgaGF2ZSBkaWZmZXJlbnQNCiBlbmRvcnNlbWVudHMgc28g dGhlcmXigJlzIG5vIG9uZS1vbmUgY29ycmVsYXRpb24NCg0KV2hpbGUgdGhlIGxhc3Qgb25lIHNl ZW1zIG9kZCBhbmQgdW5saWtlbHksIEkgdGhpbmsgaXQgY291bGQgb2NjdXIsDQpiZWNhdXNlIGZy b20gYSBsb3Qgb2YgcmVhbCBleHBlcmllbmNlIHRoZSBzZXQgdXAgb2YgYXR0ZXN0YXRpb24ga2V5 cw0KaXMgdmVyeSBpZGlvc3luY3JhdGljLiBJdCBpcyB3aWxkbHkgYWZmZWN0ZWQgYnkgbWFudWZh Y3R1cmluZyBjb3N0cw0KYW5kIGlzc3VlcyBvbiBhc3NlbWJseSBsaW5lcywgc3ViIGNvbnRyYWN0 b3Igc3RydWN0dXJlLCBsb2NhdGlvbiBvZg0Kc2VjdXJlIGZhY2lsaXRpZXMgYW5kIGFwcHJvYWNo ZXMgdG8gbWFraW5nIG1vbmV5IG9uIGl0LiBUaGV5IGFyZSBsaWtlDQpzbm93Zmxha2VzLCBlYWNo IG9uZSBpcyBkaWZmZXJlbnQuICBTbyBtYXliZSBlbmRvcnNlbWVudCBsb2NhdG9yIElEDQphbmQg a2V5IElEIGFyZSBub3QgdGhlIHNhbWUsIGJ1dCB0aGV5IGNhbiBiZSBpbiBzb21lIHVzZSBjYXNl cz8NCg0KSSBhbSBhbHNvIHRlbXB0ZWQgdG8gZW5jb3VyYWdlIHRoZSBwbGFjZW1lbnQgb2YgdGhl IGVuZG9yc2VtZW50DQpsb2NhdG9yIElEIGluIHRoZSBDT1NFIG9yIEpPU0UgaGVhZGVyIHBhcmFt ZXRlcnMgc28geW91IGRvbuKAmXQgaGF2ZSB0bw0KcGFyc2UgdGhlIHVudmVyaWZpZWQgYm9keSBv ZiBjbGFpbXMgdG8gYmUgYWJsZSB0byBmaW5kIHRoZSBrZXkNCm1hdGVyaWFsIHRvIHZlcmlmeSBp dC4NCg0KVGhvdWdodHM/DQoNCkEgdHdvIGxldmVsIGxvb2t1cCBrZXksIG1vZGVsK2luc3RhbmNl LCBzZWVtcyB0byBiZSBxdWl0ZSBnZW5lcmFsbHkNCmFwcGxpY2FibGUgYXMgYW4gZW5kb3JzZW1l bnQgbG9jYXRvci4gIFRoZSBtb2RlbCBwYXJ0IHdvdWxkIGdldCB5b3UgdG8NCnRoZSBzaGFyZWQg ZGF0YSAoZS5nLiwgY2VydGlmaWNhdGlvbiwgbWVhc3VyZWQgYm9vdCBLR1ZzLCBldGMuKSwgd2hp bGUNCnRoZSBpbnN0YW5jZSBwYXJ0IGNhbiBiZSB1c2VkIHRvIHJldHJpZXZlIGRldmljZS1zcGVj aWZpYyBzdGF0ZToNCnZlcmlmaWNhdGlvbiBrZXkocykgYXMgd2VsbCBhcyBvdGhlciBtZXRhZGF0 YSwgZS5nLiwgaWYgc29tZSBnZWFyIGlzDQpibGFja2xpc3RlZC4gIEluIFBTQSB3ZSBoYXZlIHNv bWV0aGluZyBxdWl0ZSAodGhvdWdoIG5vdCBlbnRpcmVseSkNCnNpbWlsYXIgd2l0aCBpbXBsZW1l bnRhdGlvbiBhbmQgaW5zdGFuY2UgSURzIFsxXSBbMl0uDQoNCihDb250ZXh0LXN3aXRjaGluZyBm b3IgYSBzZWNvbmQgb24gb3VyIHByZXZpb3VzIFVFSUQvR0VJRCBkaXNjdXNzaW9uOiBJDQpndWVz cyB3ZSBtaWdodCBtb2RlbCBhbiBpbnN0YW5jZSBhcyBhbiBhbm9ueW1pdHkgc2V0LCBhbmQgdGhl cmVmb3JlDQp0cmVhdCBFVUlEcyBhcyB0aGUgc3BlY2lhbCBjYXNlIEdFSURzIHdpdGggY2FyZGlu YWxpdHkgPT0gMT8pDQoNCkZvciB0aGUgc2FrZSBvZiBidWlsZGluZyBhIHNoYXJlZCBhbmQgcmV1 c2FibGUgdm9jYWJ1bGFyeSwgSSdkIHByZWZlcg0Ka2VlcGluZyBtb2RlbCBhbmQgaW5zdGFuY2Ug aWRlbnRpZmllcnMgYXMgc2VwYXJhdGUgY2xhaW1zIHJhdGhlciB0aGFuDQpoYXZpbmcgYW4gb3Bh cXVlIGVuZG9yc2VtZW50IElEIGNsYWltIHRoYXQgY2x1bXBzIHRvZ2V0aGVyIHRob3NlIGFuZA0K cG9zc2libHkgb3RoZXIgc3R1ZmYgaW4gYSB1c2UtY2FzZSBzcGVjaWZpYyBmYXNoaW9uLiAgRm9y IHRoZSBzYW1lDQpyZWFzb24gSSB3b3VsZCBub3Qgb3ZlcnJpZGUga2V5IElEIHdpdGggaW5zdGFu Y2UgSUQgc2VtYW50aWNzLg0KDQpjaGVlcnMsIHRoYW5rcyENCg0KWzFdIGh0dHBzOi8vd3d3Lmll dGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1wc2EtdG9rZW4tMDUuaHRtbCNuYW1lLWlt cGxlbWVudGF0aW9uLWlkPGh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRwczovd3d3Lmll dGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1wc2EtdG9rZW4tMDUuaHRtbCpuYW1lLWlt cGxlbWVudGF0aW9uLWlkX187SXchIU5FdDZ5TWFPLWdrIVJROGd5TzNSb3ktZElFZDZTX2thNDVs RkVHbTFHSUgybHRfRDFOYWZtYVFXcGpqc094NjI5emh1LUxtVWkxTU1NV3MkPg0KWzJdIGh0dHBz Oi8vd3d3LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1wc2EtdG9rZW4tMDUuaHRt bCNuYW1lLWluc3RhbmNlLWlkPGh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRwczovd3d3 LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1wc2EtdG9rZW4tMDUuaHRtbCpuYW1l LWluc3RhbmNlLWlkX187SXchIU5FdDZ5TWFPLWdrIVJROGd5TzNSb3ktZElFZDZTX2thNDVsRkVH bTFHSUgybHRfRDFOYWZtYVFXcGpqc094NjI5emh1LUxtVVFoU3pnNEUkPg0KDQoNCg0KSU1QT1JU QU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50 cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJl IG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1t ZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBl cnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3Jt YXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0KX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NClJBVFMgbWFpbGluZyBsaXN0DQpSQVRTQGlldGYub3Jn PG1haWx0bzpSQVRTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9yYXRzPGh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRwczovd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vcmF0c19fOyEhTkV0NnlNYU8tZ2shUlE4Z3lPM1JveS1kSUVkNlNf a2E0NWxGRUdtMUdJSDJsdF9EMU5hZm1hUVdwampzT3g2Mjl6aHUtTG1VelFUUFVBWSQ+DQoNCg== --_000_DM6PR05MB6889949334B6385B2E1F475ABADE0DM6PR05MB6889namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiU2Vnb2UgVUkg RW1vamkiOw0KCXBhbm9zZS0xOjIgMTEgNSAyIDQgMiA0IDIgMiAzO30NCkBmb250LWZhY2UNCgl7 Zm9udC1mYW1pbHk6TGF0bzsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgMzt9DQovKiBT dHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05v cm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bh bi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJ dGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5r Rm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0 LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2 Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9w LWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNv LXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJ e21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KcC5tc2lwZm9vdGVyMzBiM2Q1MzgsIGxp Lm1zaXBmb290ZXIzMGIzZDUzOCwgZGl2Lm1zaXBmb290ZXIzMGIzZDUzOA0KCXttc28tc3R5bGUt bmFtZTptc2lwZm9vdGVyMzBiM2Q1Mzg7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFy Z2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVm dDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglm b250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBp bjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0K CXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1s Pg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1s PjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpl eHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVs YXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGlu az0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SGkgTGF3cmVuY2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0ibXNpcGZvb3RlcjMwYjNkNTM4IiBhbGlnbj0i Y2VudGVyIiBzdHlsZT0ibWFyZ2luOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7dGV4dC1hbGln bjpjZW50ZXIiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdDtjb2xvcjpibGFjayI+SnVu aXBlciBCdXNpbmVzcyBVc2UgT25seTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGlu ZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4g TGF1cmVuY2UgTHVuZGJsYWRlICZsdDtsZ2xAaXNsYW5kLXJlc29ydC5jb20mZ3Q7IDxicj4NCjxi PlNlbnQ6PC9iPiBUaHVyc2RheSwgQXByaWwgOSwgMjAyMCA0OjU1IFBNPGJyPg0KPGI+VG86PC9i PiBHdXkgRmVkb3Jrb3cgJmx0O2dmZWRvcmtvd0BqdW5pcGVyLm5ldCZndDs8YnI+DQo8Yj5DYzo8 L2I+IHJhdHNAaWV0Zi5vcmc7IE5lZCBTbWl0aCAmbHQ7bmVkLnNtaXRoQGludGVsLmNvbSZndDs8 YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtSYXRzXSBFbmRvcnNlbWVudCBJRCBhbmQgdmVyaWZp Y2F0aW9uIGtleSAod2FzIFByb2Nlc3NpbmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRv IFJlc3VsdHMpPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bGluZS1oZWlnaHQ6MTIuMHB0O2JhY2tncm91bmQ6I0ZGRUI5QyI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7TGF0byZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOmJsYWNrIj5bRXh0ZXJuYWwgRW1haWwuIEJlIGNhdXRpb3VzIG9mIGNvbnRlbnRdPG86cD48 L286cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBHdXksPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJv dHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+T24gQXByIDksIDIwMjAsIGF0IDc6MzEgQU0sIEd1eSBGZWRvcmtvdyAmbHQ7PGEg aHJlZj0ibWFpbHRvOmdmZWRvcmtvd0BqdW5pcGVyLm5ldCI+Z2ZlZG9ya293QGp1bmlwZXIubmV0 PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5IaSBMYXVyZW5jZSw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyBJIHVuZGVyc3RhbmQgdGhhdCB0aGUgZGlzY3Vzc2lvbiBvbiB0 aGUgdG9waWMgYmVsb3cgbWFpbmx5IHBlcnRhaW5zIHRvIEVBVCwgYnV0IEnigJlkIGxpa2UgdG8g bWFrZSBzdXJlIHdl4oCZcmUgbm90IG1pc3Npbmcgc29tZXRoaW5nIG9uIHRoZSBSSVYgc2lkZS48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5XYXMgdHJ5aW5nIGZvciBhIGdlbmVyYWwgZGVzY3JpcHRpb24g aW50byB3aGljaCBUUE0tYmFzZWQgc3R1ZmYgZml0cyB0b28uPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5bZ3V5XSBZZXMsIEkgYXBwcmVjaWF0ZSB0aGUgbmVlZCBmb3IgYSBn ZW5lcmFsIHNvbHV0aW9uLCBidXQgYXQgdGhlIHNhbWUgdGltZSwgSeKAmWQgbGlrZSB0byB0cnkg dG8gbm90IGltcG9ydCBjb21wbGV4aXR5IHRvIHRoZSBhcHBsaWNhdGlvbnMgdGhhdCBkb27igJl0 IHNlZW0gdG8gbmVlZCBpdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQi Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgRm9yIE9TIHNvZnR3 YXJlIGltYWdlIGludGVncml0eSB1c2luZyBhIFRQTSwgaXQgc2VlbXMgbGlrZSBmaW5kaW5nIHRo ZSByaWdodCBtYW5pZmVzdCBzaG91bGRu4oCZdCBiZSB0aGF0IGhhcmTigKY8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyBUaGUgQXR0ZXN0 ZXIgbmVlZHMgdG8gaGF2ZSBwcmUtcHJvdmlzaW9uZWQgaWRlbnRpdHkgYW5kIGF0dGVzdGF0aW9u IGtleXMgYXMgb3V0bGluZWQgaW4gdGhlIFJJViBkcmFmdC4mbmJzcDsgVGhhdCBwcm92aWRlcyB0 aGUgVmVyaWZpZXIgd2l0aCB0aGUgdmVuZG9yIGlkZW50aXR5IGZvciB0aGUgcm9vdCBvZiB0cnVz dC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGF0IGlzIHRvIHNheSB5b3UgaGF2ZSBhIGZ1 bmN0aW9uaW5nIFRQTS1iYXNlZCBhdHRlc3Rlci4gSWRlbnRpdHkgaXMgb2YgdGhlIEF0dGVzdGVy IG9ubHksIG5vdCB0aGUgT1MgU29mdHdhcmUsIHJpZ2h0PzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+W2d1eV0gWWVzLCB0aGUgcHJlLXByb3Zpc2lvbmVkIGtleXMgYXNzdW1l ZCBpbiBSSVYgYXJlIGZvciB0aGUgaWRlbnRpdHkgb2YgdGhlIHBsYXRmb3JtIGl0c2VsZiAoRGV2 SUQpIGFuZCB0aGUgYXR0ZXN0YXRpb24ga2V5IGluIHRoZSBUUE0gKElBSykuJm5ic3A7IEltcGxl bWVudGF0aW9ucyB1c2luZyBUUE0gb2YgY291cnNlIGFzc3VtZSB0aGF0IHRoZSBUUE0gaXRzZWxm IGlzIHNlY3VyZSwgYnV0IGFsc28gcmVxdWlyZQ0KIHNvbWUgaW1wbGljaXRseS10cnVzdGVkIGNv ZGUgdG8gdGFrZSB0aGUgZmlyc3QgbWVhc3VyZW1lbnQsIGxhdW5jaGluZyB0aGUgY2hhaW4gb2Yg dHJ1c3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRo ZSBtZWFzdXJlbWVudCBsb2dzIGNvbnRhaW4gdGhlIGFsbGVnZWQgcHJvZHVjdCBuYW1lIGFuZCB2 ZXJzaW9uIG51bWJlciBmb3IgdGhlIHNvZnR3YXJlIGluc3RhbGxlZCBvbiB0aGUgYm94LjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkFyZSB5b3Ugc2F5aW5nIHRoYXQgdGhlIE9TIHNvZnR3YXJlIHdpbGwg d3JpdGUgaXRzIHByb2R1Y3QgbmFtZSBhbmQgdmVyc2lvbiBpbnRvIGEgVFBNIG1lYXN1cmVtZW50 IGxvZz88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPltndXldIOKAkyBJIGRv buKAmXQgdGhpbmsgaXQgbWF0dGVyc+KApiZuYnNwOyB0aGUgT1MgY2FuIHJlcG9ydCBpdOKAmXMg dmVyc2lvbiBhbmQgbmFtZSBhbnkgd2F5IGl0IHdhbnRz4oCmJm5ic3A7IGl04oCZcyBvbmx5IGEg aGludCBhdCBzaG9ydGVuaW5nIGEgc2VhcmNoIGZvciBhbiBhcHBsaWNhYmxlIFJJTS48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0 b206MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Vc2UgdGhlIHZlbmRvciBJRCB0byBuYXJyb3cgdGhlIHNjb3BlIHRvIHNw ZWNpZmljIHZlbmRvcuKAmXMgcHJvZHVjdCBhbmQgdmVyc2lvbiBzcGFjZSwgYW5kIGZpbmQgdGhl IFJJTSB0aGF0IG1hdGNoZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UHJlc3VtYWJseSB0aGUgdmVu ZG9yIG9mIHRoZSBkZXZpY2UsIChlLmcuLCBTYW1zdW5nIGZvciBhIHBob25lLCBMZW5vdm8gZm9y IGEgbGFwdG9wKSBzaW5jZSB2ZW5kb3LigJlzIGN1c3RvbWl6ZSBPUyBTVy48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPltndXldIFllcy4mbmJzcDsgVGhpcyBhZG1pdHRlZGx5 IGlzICo8Yj5tdWNoPC9iPiogZWFzaWVyIG9uIGFuIGVtYmVkZGVkIGRldmljZSBsaWtlIGEgcm91 dGVyLCB3aGVyZSB0aGUgdmVuZG9yIHN1cHBsaWVzIHRoZSBoYXJkd2FyZSwgaXTigJlzIHJvb3Qg b2YgdHJ1c3QsIGFuZCB0aGUgT1MsIGJ1dCBJIGRvbuKAmXQgdGhpbmsgdGhhdOKAmXMgYW4gZXNz ZW50aWFsIHJlcXVpcmVtZW50LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyBUaGVuIGNoZWNr IGlmIHRoZSBoYXNoZXMgbGluZSB1cDsgaWYgc28sIHlvdeKAmXJlIGdvb2QsIGlmIG5vdCwgZWl0 aGVyIHRoZSBjbGFpbSBvZiB3aGF0IHNvZnR3YXJlIGlzIHByZXNlbnQgd2FzIGluY29ycmVjdCwg b3Igc29tZXRoaW5nIGdvdCBoYWNrZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2VlbXMgbGlrZSB0 aGVyZeKAmXMgYSBzdGVwIG9mIG1lYXN1cmluZyB0aGUgT1MgU29mdHdhcmUgbWlzc2luZy4gVGhh dCBoYXMgdG8gYmUgYnVpbHQgaW50byB0aGUgYm9vdCBsb2FkaW5nIHNlcXVlbmNlIHRvIGJlIHBy b3Blcmx5IHNlY3VyZS4gU3RlcCAxIG1lYXN1cmVzIHRoZSBjb2RlIGZvciBTdGVwIDIsIHRoZW4g U3RlcCAyIGxvYWRzLCB0aGVuIFN0ZXAgMiBtZWFzdXJlcyBjb2RlIGZvciBTdGVwIDMgYWxsDQog dGhlIHdoaWxlIHJlY29yZGluZyB0aGUgbWVhc3VyZW1lbnRzIGluIHRoZSBUUE0uICZuYnNwO1By ZXR0eSBzdXJlIHRoZXJlIGFyZSBsb3RzIG9mIE9T4oCZcyB0aGF0IGRvbuKAmXQga25vdyBob3cg dG8gcHV0IG1lYXN1cmVtZW50cyBpbnRvIGEgVFBNLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Tb21lIFRFRS1iYXNlZCBhcmNoaXRlY3R1cmVz IHVzZSB0aGUgVEVFIHRvIGxvYWQgYW5kIHZlcmlmeSBhIHN1YnN5c3RlbS4gRm9yIGV4YW1wbGUg YSBwaG9uZSBtaWdodCBjb25zaXN0IG9mIGEgVEVFLCBhIG1haW4gT1MgcnVubmluZyBBbmRyb2lk IGFuZCBzb21lIHN1YnN5c3RlbXMgKEF1ZGlvLCBjZWxsdWxhciBtb2RlbeKApikuIFRoZSBURUUg dGFrZXMgY2FyZSBvZiB0aGUgbG9hZGluZyBhbmQgdmVyaWZpY2F0aW9uDQogb2YgdGhlIHN1YnN5 c3RlbSBTVyBieSByZWFkaW5nIGFuZCB3cml0aW5nIGludG8gdGhlIHN1YnN5c3RlbXMgbWVtb3J5 LCB0aGVuIHRoZSBURUUgc2lnbmFscyB0aGUgc3Vic3lzdGVtIHRvIGdvIG91dCBvZiByZXNldC4g SXQgbW9yZSBvciBsZXNzIGJvb3RlZCB3aXRob3V0IHRoZSBzdWJzeXN0ZW3igJlzIENQVSBkb2lu ZyBhIHRoaW5nLiAoQW5kIHRoZSBURUUgY2FuIGxhdGVyIHRvIGEgcnVuLXRpbWUgaW50ZWdyaXR5 IGNoZWNrIG9uIGl0LCBzb21ldGhpbmcNCiB5b3UgY2Fu4oCZdCBkbyB3aXRoIGEgVFBNKS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bZ3V5XSBBYnNvbHV0ZWx5LCBJIHRoaW5rIG1v c3QgaW50ZWdyaXR5IHBsYW5zIGFzc3VtZSB0aGUgY2hhaW4gb2YgdHJ1c3QgbW9kZWwuJm5ic3A7 IFRoZSBUUE0gYXBwcm9hY2ggYXNzdW1lcyBhbiB1bmJyb2tlbiBjaGFpbiBvZiBtZWFzdXJlbWVu dHMgZnJvbSB0aGUgcm9vdCBvZiB0cnVzdC4gTG90cyBvZiBPU+KAmXMgY2Fu4oCZdCBkbyB0aGF0 LCBidXQgYWxsIGFuIGVtYmVkZGVkIHZlbmRvciBuZWVkcyBpcyBvbmUgdGhhdA0KIGNhbiE8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyBTZWVtcyBsaWtlIGEg dmVyaWZpZXIgY291bGQgZm9sbG93IHRoaXMgc2FtZSBtb2RlbCB0aHJvdWdoIHRoZSBlbnRpcmUg Y2hhaW4gb2YgdHJ1c3QsIGV2ZW4gdGhyb3VnaCBtdWx0aXBsZSB2ZW5kb3JzLCBhcyBsb25nIGFz IHRoZXJlIGFyZSBubyBnYXBzIGluIHRoZSBjaGFpbi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TZWVt cyBsaWtlIHlvdSBuZWVkIGVhY2ggcGFydGljaXBhbnQgaW4gdGhlIGNoYWluIGtub3cgaG93IHRv IG1lYXN1cmUgYW5kIHdyaXRlIGludG8gdGhlIFRQTS4gVGhhdCBkb2VzbuKAmXQgc2VlbSBsaWtl bHkgdG8gaGFwcGVuIHRvIG1lIHVubGVzcyB0aGUgd2hvbGUgYXJjaGl0ZWN0dXJlIHdhcyBkZXNp Z25lZCBhcm91bmQgYSBUUE0uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5b Z3V5XSBTZWUg4oCcZW1iZWRkZWTigJ0gYWJvdmUgPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O1NlZ29lIFVJIEVtb2ppJnF1b3Q7LHNhbnMtc2VyaWYiPg0KJiMxMjg1MjI7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyBJIGtub3cgRUFUIG5lZWRzIHRvIHdvcmsgaW4gYSBs ZXNzLWNvbnN0cmFpbmVkIGVudmlyb25tZW50LCBidXQgbGV0IG1lIGtub3cgaWYgeW91IHRoaW5r IHdl4oCZcmUgb3ZlcnNpbXBsaWZ5aW5nIHRoaXMgb24gUklWLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RUFUIGlz IGludGVuZGVkIHRvIHdvcmsgaW4gdmVyeSBjb25zdHJhaW5lZCBlbnZpcm9ubWVudHMuIElmIHlv dSBqdXN0IGhhdmUgbGltaXRlZCBzdWJzZXQgb2YgY2xhaW1zLCB5b3UgY2FuIGJ1aWxkIEhXIHRv IGltcGxlbWVudCBFQVQuIENCT1IgaXMgZGVzaWduZWQgd2VsbCBlbm91Z2ggdGhhdCB0aGlzIGlz IHBvc3NpYmxlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W2d1eV0gYWgs IGRpZmZlcmVuY2UgaW4gd2hhdCB3ZSBtZWFuIGJ5IENvbnN0cmFpbmVk4oCmJm5ic3A7IEkgdGhp bmsgeW914oCZcmUgdGhpbmtpbmcgb2YgY29uc3RyYWluZWQgaW4gdGVybXMgb2YgcG93ZXIgYW5k IHRyYW5zaXN0b3JzLiZuYnNwOyBJIHdhcyB0aGlua2luZyBtb3JlIG9mIHRoZSBlY29zeXN0ZW3i gKYmbmJzcDsgYXMgeW91IHNheSwgeW91IGNhbuKAmXQganVzdCB0YWtlIGFueSBvbGQgcmFuZG9t IGNvbGxlY3Rpb24gb2YgcGFydHMsDQogT1PigJlzIGFuZCBhcHBsaWNhdGlvbnMsIHN0aXIgaW4g c29tZSBUUE0gYW5kIGdldCBzZWN1cml0eS4mbmJzcDsgKEFzIG11Y2ggYXMgb3VyIHZhcmlvdXMg VlDigJlzIGFuZCBleGVj4oCZcyB3b3VsZCBsaWtlISk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDsgVGhhbmtzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXBwcmVjaWF0ZSB0aGVzZSBk aXNjdXNzaW9ucyBhcyBpdCBoZWxwcyBpbGx1bWluYXRlIHRoZSBjb3JlIHByaW5jaXBsZXMgYXQg d29yayBvbiB0aGUgVFBNIHNpZGUgYW5kIHRoZSBURUUgc2lkZS4gQm90aCBhcmUgc2VjdXJlLCBB RkFJSyA6LSksIGJ1dCBtYWRlIGRpZmZlcmVudCBjaG9pY2VzIGFuZCBoYXZlIGRpZmZlcmVudCBj YXBhYmlsaXRpZXMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W2d1eV0g WWVzLCBkaWZmZXJlbnQgbWVhbnMgdG8gYSBzaW1pbGFyIGVuZC4mbmJzcDsgSSB0aGluayB0aGUg dmlldyBwYXJ0bHkgZGVwZW5kcyBvbiB3aGV0aGVyIHRoZSB2ZW5kb3IgaW4gcXVlc3Rpb24gcHJp bmNpcGFsbHkgcmVsaWVzIGNvbW1vZGl0eSBwcm9jZXNzb3JzLCBvciBpcyBpbiBjaGFyZ2Ugb2Yg ZGVzaWduaW5nIHRoZWlyIHByb2Nlc3NvcnMgZnJvbSBzaWxpY29uIG9uIHVwLjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7IFRoYW5rcyBMYXVyZW5jZSE8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4vZ3V5PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5MTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgYWxpZ249ImNlbnRlciIg c3R5bGU9InRleHQtYWxpZ246Y2VudGVyIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0Ij5K dW5pcGVyIEJ1c2luZXNzIFVzZSBPbmx5PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5G cm9tOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ UkFUUyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJhdHMtYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+cmF0cy1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uIEJlaGFs ZiBPZjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+ TGF1cmVuY2UNCiBMdW5kYmxhZGU8YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+VHVlc2RheSwgQXByaWwgNywgMjAyMCAzOjEz IFBNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj5UaG9tYXMgRm9zc2F0aSAmbHQ7PGEgaHJlZj0ibWFpbHRvOlRob21hcy5Gb3Nz YXRpQGFybS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPlRob21hcy5Gb3NzYXRpQGFy bS5jb208L3NwYW4+PC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpyYXRzQGlldGYub3Jn Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5yYXRzQGlldGYub3JnPC9zcGFuPjwvYT47IE5l ZCBTbWl0aCAmbHQ7PGEgaHJlZj0ibWFpbHRvOm5lZC5zbWl0aEBpbnRlbC5jb20iPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPm5lZC5zbWl0aEBpbnRlbC5jb208L3NwYW4+PC9hPiZndDs8YnI+ DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+UmU6IFtSYXRzXSBFbmRvcnNlbWVudCBJRCBhbmQgdmVyaWZpY2F0aW9uIGtleSAo d2FzIFByb2Nlc3NpbmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRvIFJlc3VsdHMpPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibGluZS1oZWlnaHQ6MTIuMHB0O2JhY2tncm91bmQ6I0ZGRUI5QyI+ PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7TGF0byZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5bRXh0ZXJuYWwgRW1haWwuIEJlIGNhdXRpb3Vz IG9mIGNvbnRlbnRdPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlzIGlzIGEgcmVwbHkgdG8gYm90 aCBUaG9tYXMgYW5kIE5lZOKAmXMgbWVzc2FnZSBvbiBkZWJ1ZyBpbiB0aGUgcmVsYXRlZCB0aHJl YXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk15IGluY2xpbmF0aW9uIGlzIHRvIGFzc29j aWF0ZSBlbmRvcnNlbWVudHMgd2l0aCB0aW1lLWludmFyaWFudCBjaGFyYWN0ZXJpc3RpY3Mgb2Yg dGhlIGRldmljZS4gQXQgdGhlIG1vbWVudCB0aGlzIGRvZXNu4oCZdCBzZWVtIGxpa2UgdGhlIG9u bHkgd2F5IHRvIGRvIGl0LCBidXQgaXQgc2VlbXMgbGlrZSBhIGdvb2Qgd2F5LiBUaGluZ3MgdGhh dCBhcmUgbm90IHRpbWUgaW52YXJpYW50IGFyZSBwb2xpY3ksIGstZy12DQogb3Igc3VjaC48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHU+RW5kb3JzZW1lbnQ8L3U+PC9iPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDoz MC4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TeXN0ZW0gYXJjaGl0ZWN0 dXJlIOKAlCBEb2VzIHRoZSBBdHRlc3RlciB1c2UgYSBURUUgb3IgYSBUUE0gb3IgbWF5YmUgaXQg aXMgc2ltcGxlIHN5c3RlbSB3aXRoIGp1c3QgYSBzaW1wbGUgQ1BVLCBidXQgaXQgaXMgZW5jYXNl ZCBpbiB0aXRhbml1bS4gSXMgZGVmZW5zZSBhZ2FpbnN0IGNoaXAgaW52YXNpdmUgYXR0YWNrcyBj b25zaWRlcmVkPyBEbyBrZXlzIGJlY29tZSBpbmFjY2Vzc2libGUgd2hlbiBkZWJ1ZyBpcw0KIGVu YWJsZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRldmVsb3BtZW50IHByb2Nlc3Mg4oCU IElzIHRoZXJlIGEgc3BlY2lhbCBzZWN1cml0eS1vcmllbnRlZCB0ZWFtPyBEb2VzIHRoZSB0ZWFt IGhhdmUgYSBjb2RlIHJldmlldyBwb2xpY3k/IElzIHRoZXJlIGEgYnVnIGJvdW50eT8gQXJlIHRo ZSBkZXNrdG9wcyBhbmQgSVQgc3lzdGVtcyB1c2VkIGZvciBIVyBhbmQgU1cgZGV2ZWxvcG1lbnQg aXNvbGF0ZWQ/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1hbnVmYWN0dXJpbmcg4oCUIEFy ZSB0aGUgZmFjdG9yaWVzIHNlY3VyZWQgaW4gYSBzcGVjaWFsIHdheT8gSXMgdGhlIGF0dGVzdGF0 aW9uIGtleSBwcm92aXNpb25pbmcgc3lzdGVtIGhhcmRlbmVkIGluIHNvbWUgd2F5IChlLmcuLCB1 c2VzIEhTTXMpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DZXJ0aWZpY2F0aW9ucyDigJQg VGhlc2UgdGFrZSBhIGxvbmcgdGltZSB0byBhY2hpZXZlIGFuZCB3aWxsIHVzdWFsbHkgcmVxdWly ZSBzb21lIG9mIHRoZSBhYm92ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+TXkgdGhpbmtpbmcgZm9yIEVBVCB3YXMgdGhhdCB5b3Ugb25seSBwdXQgYXR0ZXN0YXRp b24ga2V5cyBpbnRvIGRldmljZXMgdGhhdCBtZWV0IHNvbWUgY3JpdGVyaWEgbGlrZSBzb21lIG9m IHRoZSBhYm92ZS4gU2luY2UgdGhlcmUgaXMgb2Z0ZW4gbm8gd2F5IHRvIHJlY292ZXIgZnJvbSBh IGNvbXByb21pc2VkIGF0dGVzdGF0aW9uIGtleSBiZWNhdXNlIG5vIGtleSBtb3JlIHNlY3VyZSB0 aGFuIGl0LCB5b3Uga2luZA0KIG9mIGhhdmUgdG8gaGF2ZSBhbGwgdGhhdC4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+U2luY2UgdGhlc2UgZG9u4oCZdCBjaGFuZ2UgbXVjaCBvdmVy IHRpbWUsIHRoZSBlbmRvcnNlbWVudCB3b3VsZG7igJl0IGNoYW5nZS4gJm5ic3A7VGhleSBjb3Vs ZCBldmVuIHNwYW4gc2V2ZXJhbCBtb2RlbHMgYW5kIHZhcnlpbmcgSFcuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjx1PlBvbGljeSwgSy1HLVYsIG90aGVyPC91PjwvYj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAu MHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0 Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U1cgVmVyc2lvbnMg4oCUIEFz IGxvbmcgYXMgdGhlIFNXIGZvbGxvd3MgYSBkZXZlbG9wbWVudCBwcm9jZXNzIGxpa2UgdGhhdCBh Ym92ZSwgaXQgZG9lc27igJl0IGhhdmUgdG8gYmUgaW5jbHVkZWQgaW4gdGhlIGVuZG9yc2VtZW50 LiBPZiBjb3Vyc2UgdGhlIHNtYWxsZXIgdGhlIFNXIGFuZCB0aGUgYmV0dGVyIHRoZSBwcm9jZXNz LCB0aGUgbW9yZSBpdCBpcyB0cnVlIChhbmQgdmljZSB2ZXJzYSkuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkJsYWNrbGlzdHMg4oCUIFRoZXNlIG1pZ2h0IGJlIHNwZWNpZmljIHRvIFVFSURz LCB2ZXJzaW9ucyBvZiBTVywgZGVwbG95bWVudHMgYSBwYXJ0aWN1bGFyIE9FTSBvciBzdWNoPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRlYnVnIHN0YXR1cyDigJQgTW9zdCBvZiB0aGUgZGVi dWcgc3RhdHVzIHZhbHVlcyBjYW4gdmFyeSBvbiBhIGRheS1kYXkgYmFzaXM8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+T0VNIG1vZGVsIOKAlCBJZiB0aGUgYXR0ZXN0YXRpb24gaXMgaW1wbGVt ZW50ZWQgYnkgYSBjaGlwIHZlbmRvciBhbmQgdGhlIGVuZG9yc2VtZW50IGlzIGZvciB0aGUgY2hp cCwgdGhlbiB0aGUgT0VNIG1vZGVsIHdpbGwgdmFyeSB3aWRlbHkuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5vbmUgb2YgdGhlc2UgY2FuIGJlIGNyaXRlcmlhIGFz IHRvIHdoZXRoZXIgYW4gYXR0ZXN0YXRpb24ga2V5IGlzIHB1dCBpbnRvIGEgZGV2aWNlIG9yIG5v dCBhcyB0aGV5IGFyZSBub3Qga25vd24gYXQgbWFudWZhY3R1cmluZyB0aW1lIGFuZC9vciBtdXN0 IGJlIGFsbG93ZWQgdG8gdmFyeSB3aWRlbHkgYWZ0ZXIgbWFudWZhY3R1cmluZy48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5rIHdoYXQgSeKAmXZlIGRl c2NyaWJlZCBhYm92ZSBsaW5lcyB1cCBwcmV0dHkgd2VsbCBmb3IgYSBUUE0uIFRoZSBzeXN0ZW0g YXJjaGl0ZWN0dXJlIGlzIG1vc3RseSBzZXQgYnkgdGhlIFRDRy4gSFcgVFBNcyBhcmUgYWxtb3N0 IGFsd2F5cyBjZXJ0aWZpZWQuIFRoZXkgYXJlIGluZGVwZW5kZW50IG9mIE9FTSBtb2RlbC4gSXQg YWxzbyBsaW5lcyB1cCByZWFzb25hYmx5IHdlbGwgd2l0aCBzZWN1cmUgZWxlbWVudHMNCiBhbmQg Y2FuIGxpbmUgdXAgd2l0aCBURUXigJlzLiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+VGhlIGNydXggb2YgZW5kb3JzZW1lbnQgdG8gbWUgaXMgdGhlIHNlY3VyaXR5IGNoYXJhY3Rl cmlzdGljcyBvZiB0aGUgYXR0ZXN0ZXIgdGhhdCBwcm90ZWN0IHRoZSBhdHRlc3RhdGlvbiBrZXkg YmVjYXVzZSB0aGVyZSBpcyBnZW5lcmFsbHkgbm8gcmVjb3ZlcnkgZnJvbSBhIGNvbXByb21pc2Vk IGF0dGVzdGF0aW9uIGtleS4gSXQgc2V0cyB0aGUgYmFzZWxpbmUgcmlzayBvZiB0aGUgSFcgYW5k IFNXIG9mIHRoZQ0KIGRldmljZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIG9uZSBleHRyZW1lIGlzIGEgc2VwYXJhdGUgZW5kb3JzZW1lbnQgZm9yIGV2ZXJ5IGRldmlj ZSAo4oCcbWljcm8gZW5kb3JzZW1lbnQmcXVvdDs/KSwgd2hpY2ggaXMgd2hhdCBJIHRoaW5rIFRo b21hcyBhbmQgQVJNIFBTQSBhcmUgdGVuZGluZyB0b3dhcmRzLiBUaGUgb3RoZXIgZXh0cmVtZSBp cyBvbmUgZW5kb3JzZW1lbnQgZm9yIGEgcHJvZHVjdCBsaW5lJm5ic3A7KOKAnG1hY3JvIGVuZG9y c2VtZW50JnF1b3Q7PyksLCBzYXkgYSBwcm9kdWN0DQogbGluZSBvZiBUUE1zLiBUaGVuIGl04oCZ cyBtb3JlIGxpa2UgdGhlIGRhdGEgc2hlZXQgZm9yIHRoZSBwcm9kdWN0LiZuYnNwOzxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlRoZW4gdGhlcmXigJlzIGRpZmZlcmVudCB3YXlzIHRvIGZhbiB0aGlzIG91dCB0byB0aGUg ZGlmZmVyZW50IGtleSAvIHNpZ25pbmcgc2NoZW1lcyAocGVyLWRldmljZSBrZXksIGdyb3VwIGtl eSwgRUNEQUEsIFguNTA5KS4gRm9yIGV4YW1wbGUgYSBtYWNyby1lbmRvcnNlbWVudCBjb3VsZCBp bmNsdWRlIHRoZSByb290IG9mIGFuIFguNTA5IGhpZXJhcmNoeSBhbmQgdGhlIGluZGl2aWR1YWwg ZGV2aWNlcyAob3IgZ3JvdXBzDQogb2YgZGV2aWNlcykgd291bGQgaGF2ZSBpbmRpdmlkdWFsIGtl eXMgdGhhdCBjaGFpbiB1cC4gV2l0aCBhIG1pY3JvLWVuZG9yc2VtZW50IHRoZSBwZXItZGV2aWNl IHB1YmxpYyBrZXkgY291bGQgYmUgcGVyIGVuZG9yc2VtZW50LjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5UaGUgbW9zdCBpbXBvcnRhbnQgdGhpbmcgYWJvdXQgdGhlIGVuZG9y c2VtZW50IHNlZW1zIHRvIG1lIGlzIHRoZSBjaGFyYWN0ZXJpemF0aW9uIG9mIGhvdyB0aGUgYXR0 ZXN0YXRpb24ga2V5IGlzIHByb3RlY3RlZC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TEw8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIEFwciA3LCAyMDIwLCBhdCA3OjM2IEFNLCBUaG9tYXMgRm9zc2F0aSAmbHQ7PGEgaHJl Zj0ibWFpbHRvOlRob21hcy5Gb3NzYXRpQGFybS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPlRob21hcy5Gb3NzYXRpQGFybS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5IaSBMYXVyZW5jZSw8 YnI+DQo8YnI+DQpUaGFua3MgZm9yIGJyaW5naW5nIHRoaXMgdXAuICZuYnNwO0EgZmV3IHRob3Vn aHRzIGJlbG93Ljxicj4NCjxicj4NCk9uIDAzLzA0LzIwMjAsIDIwOjM3LCAmcXVvdDtSQVRTIG9u IGJlaGFsZiBvZiBMYXVyZW5jZSBMdW5kYmxhZGUmcXVvdDs8YnI+DQombHQ7PC9zcGFuPjxhIGhy ZWY9Im1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 cHVycGxlIj5yYXRzLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+b24NCiBiZWhhbGYgb2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5k LXJlc29ydC5jb20iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5sZ2xAaXNsYW5kLXJl c29ydC5jb208L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsNCiB3cm90ZTo8L3NwYW4+ PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5TbyBob3cgZG9lcyBhIFZlcmlmaWVyIGZpbmQgdGhlIGFwcGxpY2FibGUgZW5kb3Jz ZW1lbnQgZm9yIEV2aWRlbmNlIGl0PGJyPg0Kd2lzaGVzIHRvIHZlcmlmeSBhbmQga25vdyB0aGF0 IGlzIHJlYWxseSB0aGUgcmlnaHQgZW5kb3JzZW1lbnQ/PGJyPg0KPGJyPg0KU2VlbXMgbGlrZSB0 aGUgRXZpZGVuY2UgbmVlZHMgc29tZSBzb3J0IG9mIGFuIGVuZG9yc2VtZW50IGxvY2F0b3IgSUQu PGJyPg0KVGhpcyBjb3VsZCBiZSBhIFVSTCBvciBhIEdVSUQuIEVBVCBjdXJyZW50bHkgaGFzIHRo ZSBvcmlnaW5hdGlvbiBjbGFpbTxicj4NCnRvIHRyeSB0byBzb2x2ZSB0aGlzLCBidXQgaXQgaXMg aGFsZi1iYWtlZC4gSXQgbmVlZHMgdG8gZ2V0IGZpeGVkLiBJ4oCZbTxicj4NCmZpc2hpbmcgZm9y IGNvbW1lbnRzIGhlcmUgb24gd2hhdCBpdCBzaG91bGQgYmUgbGlrZS48YnI+DQo8YnI+DQpQcmV0 dHkgc3VyZSB0aGUgRW5kb3JzZW1lbnQgbmVlZHMgdG8gaW5jbHVkZSBvciByZWZlcmVuY2UgdGhl IHB1YmxpYzxicj4NCmtleSB0aGF0IGlzIHVzZWQgdG8gdmVyaWZ5IHRoZSBzaWduYXR1cmUuIFdp dGhvdXQgdGhhdCwgdGhlIEF0dGVzdGVyPGJyPg0KY291bGQgbGllIGFuZCBwaWNrIGFueSBvbGQg RW5kb3JzZW1lbnQgdGhhdCBpdCB3aXNoZXMuIFRoZXJlIG5lZWRzIHRvPGJyPg0KYmUgc29tZSBi aW5kaW5nIGJldHdlZW4gaXRlbXMgaW4gdGhlIGVuZG9yc2VtZW50IChFMCwgRTEs4oCmKSBhbmQg dGhlPGJyPg0KdmVyaWZpY2F0aW9uIGtleS4gVGhhdCBjb3VsZCBiZSBpbiB0aGUgZm9ybSBvZiBh IHNpZ25lZCB0b2tlbiBvcjxicj4NCmNlcnRpZmljYXRlLCBidXQgZG9lc27igJl0IGhhdmUgdG8g YmUuIFByZXR0eSBzdXJlIHRoaXMgbmVlZHMgdG8gYmU8YnI+DQpkaXNjdXNzZWQgaW4gdGhlIGFy Y2hpdGVjdHVyZSBkb2MuPGJyPg0KPGJyPg0KVGhlcmUncyBhIGZldyBzY2VuYXJpb3M6PGJyPg0K LSBPbmUgZW5kb3JzZW1lbnQgYXBwbGllcyB0byBsb3RzIG9mIGRldmljZXMgaW4gdGhlIHNhbWUg Y2xhc3MsIGJ1dDxicj4NCiZuYnNwO2VhY2ggaGFzIHRoZWlyIG93biBhdHRlc3RhdGlvbiBrZXku PGJyPg0KLSAtIFByb2JhYmx5IEVDREFBIGZpdHMgaW4gaGVyZTxicj4NCi0gLSBPbmUgb3B0aW9u IGhlcmUgaXMgYW4gWDUwOSBoaWVyYXJjaHk8YnI+DQotIEdyb3VwIGtleXMgYXJlIHVzZWQgKGZv ciBwcml2YWN5IHJlYXNvbnMgb3Igb3RoZXIpIHNvIHRoZXJlIGlzIGE8YnI+DQombmJzcDtvbmUt b25lIGNvcnJlbGF0aW9uIHdpdGggdGhlIEVuZG9yc2VtZW50cyAodGhlIEdFSUQgZGlzY3Vzc2lv bik8YnI+DQotIEdyb3VwIGtleXMgYXJlIHVzZWQsIGJ1dCBhY3Jvc3MgZGV2aWNlcyB0aGF0IGhh dmUgZGlmZmVyZW50PGJyPg0KJm5ic3A7ZW5kb3JzZW1lbnRzIHNvIHRoZXJl4oCZcyBubyBvbmUt b25lIGNvcnJlbGF0aW9uPGJyPg0KPGJyPg0KV2hpbGUgdGhlIGxhc3Qgb25lIHNlZW1zIG9kZCBh bmQgdW5saWtlbHksIEkgdGhpbmsgaXQgY291bGQgb2NjdXIsPGJyPg0KYmVjYXVzZSBmcm9tIGEg bG90IG9mIHJlYWwgZXhwZXJpZW5jZSB0aGUgc2V0IHVwIG9mIGF0dGVzdGF0aW9uIGtleXM8YnI+ DQppcyB2ZXJ5IGlkaW9zeW5jcmF0aWMuIEl0IGlzIHdpbGRseSBhZmZlY3RlZCBieSBtYW51ZmFj dHVyaW5nIGNvc3RzPGJyPg0KYW5kIGlzc3VlcyBvbiBhc3NlbWJseSBsaW5lcywgc3ViIGNvbnRy YWN0b3Igc3RydWN0dXJlLCBsb2NhdGlvbiBvZjxicj4NCnNlY3VyZSBmYWNpbGl0aWVzIGFuZCBh cHByb2FjaGVzIHRvIG1ha2luZyBtb25leSBvbiBpdC4gVGhleSBhcmUgbGlrZTxicj4NCnNub3dm bGFrZXMsIGVhY2ggb25lIGlzIGRpZmZlcmVudC4gJm5ic3A7U28gbWF5YmUgZW5kb3JzZW1lbnQg bG9jYXRvciBJRDxicj4NCmFuZCBrZXkgSUQgYXJlIG5vdCB0aGUgc2FtZSwgYnV0IHRoZXkgY2Fu IGJlIGluIHNvbWUgdXNlIGNhc2VzPzxicj4NCjxicj4NCkkgYW0gYWxzbyB0ZW1wdGVkIHRvIGVu Y291cmFnZSB0aGUgcGxhY2VtZW50IG9mIHRoZSBlbmRvcnNlbWVudDxicj4NCmxvY2F0b3IgSUQg aW4gdGhlIENPU0Ugb3IgSk9TRSBoZWFkZXIgcGFyYW1ldGVycyBzbyB5b3UgZG9u4oCZdCBoYXZl IHRvPGJyPg0KcGFyc2UgdGhlIHVudmVyaWZpZWQgYm9keSBvZiBjbGFpbXMgdG8gYmUgYWJsZSB0 byBmaW5kIHRoZSBrZXk8YnI+DQptYXRlcmlhbCB0byB2ZXJpZnkgaXQuPGJyPg0KPGJyPg0KVGhv dWdodHM/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KQSB0d28gbGV2 ZWwgbG9va3VwIGtleSwgbW9kZWwmIzQzO2luc3RhbmNlLCBzZWVtcyB0byBiZSBxdWl0ZSBnZW5l cmFsbHk8YnI+DQphcHBsaWNhYmxlIGFzIGFuIGVuZG9yc2VtZW50IGxvY2F0b3IuICZuYnNwO1Ro ZSBtb2RlbCBwYXJ0IHdvdWxkIGdldCB5b3UgdG88YnI+DQp0aGUgc2hhcmVkIGRhdGEgKGUuZy4s IGNlcnRpZmljYXRpb24sIG1lYXN1cmVkIGJvb3QgS0dWcywgZXRjLiksIHdoaWxlPGJyPg0KdGhl IGluc3RhbmNlIHBhcnQgY2FuIGJlIHVzZWQgdG8gcmV0cmlldmUgZGV2aWNlLXNwZWNpZmljIHN0 YXRlOjxicj4NCnZlcmlmaWNhdGlvbiBrZXkocykgYXMgd2VsbCBhcyBvdGhlciBtZXRhZGF0YSwg ZS5nLiwgaWYgc29tZSBnZWFyIGlzPGJyPg0KYmxhY2tsaXN0ZWQuICZuYnNwO0luIFBTQSB3ZSBo YXZlIHNvbWV0aGluZyBxdWl0ZSAodGhvdWdoIG5vdCBlbnRpcmVseSk8YnI+DQpzaW1pbGFyIHdp dGggaW1wbGVtZW50YXRpb24gYW5kIGluc3RhbmNlIElEcyBbMV0gWzJdLjxicj4NCjxicj4NCihD b250ZXh0LXN3aXRjaGluZyBmb3IgYSBzZWNvbmQgb24gb3VyIHByZXZpb3VzIFVFSUQvR0VJRCBk aXNjdXNzaW9uOiBJPGJyPg0KZ3Vlc3Mgd2UgbWlnaHQgbW9kZWwgYW4gaW5zdGFuY2UgYXMgYW4g YW5vbnltaXR5IHNldCwgYW5kIHRoZXJlZm9yZTxicj4NCnRyZWF0IEVVSURzIGFzIHRoZSBzcGVj aWFsIGNhc2UgR0VJRHMgd2l0aCBjYXJkaW5hbGl0eSA9PSAxPyk8YnI+DQo8YnI+DQpGb3IgdGhl IHNha2Ugb2YgYnVpbGRpbmcgYSBzaGFyZWQgYW5kIHJldXNhYmxlIHZvY2FidWxhcnksIEknZCBw cmVmZXI8YnI+DQprZWVwaW5nIG1vZGVsIGFuZCBpbnN0YW5jZSBpZGVudGlmaWVycyBhcyBzZXBh cmF0ZSBjbGFpbXMgcmF0aGVyIHRoYW48YnI+DQpoYXZpbmcgYW4gb3BhcXVlIGVuZG9yc2VtZW50 IElEIGNsYWltIHRoYXQgY2x1bXBzIHRvZ2V0aGVyIHRob3NlIGFuZDxicj4NCnBvc3NpYmx5IG90 aGVyIHN0dWZmIGluIGEgdXNlLWNhc2Ugc3BlY2lmaWMgZmFzaGlvbi4gJm5ic3A7Rm9yIHRoZSBz YW1lPGJyPg0KcmVhc29uIEkgd291bGQgbm90IG92ZXJyaWRlIGtleSBJRCB3aXRoIGluc3RhbmNl IElEIHNlbWFudGljcy48YnI+DQo8YnI+DQpjaGVlcnMsIHRoYW5rcyE8YnI+DQo8YnI+DQpbMV08 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxh IGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRwczovd3d3LmlldGYub3JnL2lk L2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1wc2EtdG9rZW4tMDUuaHRtbCpuYW1lLWltcGxlbWVudGF0 aW9uLWlkX187SXchIU5FdDZ5TWFPLWdrIVJROGd5TzNSb3ktZElFZDZTX2thNDVsRkVHbTFHSUgy bHRfRDFOYWZtYVFXcGpqc094NjI5emh1LUxtVWkxTU1NV3MkIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtdHNjaG9mZW5pZy1yYXRz LXBzYS10b2tlbi0wNS5odG1sI25hbWUtaW1wbGVtZW50YXRpb24taWQ8L3NwYW4+PC9hPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxicj4NClsyXTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLmNvbS92My9f X2h0dHBzOi93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtdHNjaG9mZW5pZy1yYXRzLXBzYS10b2tlbi0w NS5odG1sKm5hbWUtaW5zdGFuY2UtaWRfXztJdyEhTkV0NnlNYU8tZ2shUlE4Z3lPM1JveS1kSUVk NlNfa2E0NWxGRUdtMUdJSDJsdF9EMU5hZm1hUVdwampzT3g2Mjl6aHUtTG1VUWhTemc0RSQiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9pZC9kcmFm dC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFtZS1pbnN0YW5jZS1pZDwvc3Bh bj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KSU1QT1JUQU5U IE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBh cmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5v dCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRp YXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNv biwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwNCiBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1h dGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuPGJyPg0KX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpSQVRTIG1haWxpbmcgbGlzdDxicj4NCjwv c3Bhbj48YSBocmVmPSJtYWlsdG86UkFUU0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpwdXJwbGUiPlJBVFNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4N Cjwvc3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3JhdHNfXzshIU5FdDZ5TWFPLWdrIVJROGd5TzNSb3kt ZElFZDZTX2thNDVsRkVHbTFHSUgybHRfRDFOYWZtYVFXcGpqc094NjI5emh1LUxtVXpRVFBVQVkk Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9yYXRzPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM6PR05MB6889949334B6385B2E1F475ABADE0DM6PR05MB6889namp_-- From nobody Sun Apr 12 11:56:23 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A14193A099C for ; Sun, 12 Apr 2020 11:56:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.816 X-Spam-Level: X-Spam-Status: No, score=-1.816 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Ri-dlryzuOb for ; Sun, 12 Apr 2020 11:56:18 -0700 (PDT) Received: from p3plsmtpa09-04.prod.phx3.secureserver.net (p3plsmtpa09-04.prod.phx3.secureserver.net [173.201.193.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63D2E3A0A9E for ; Sun, 12 Apr 2020 11:56:18 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id NhmDj6sMTpAqaNhmDj6ulC; Sun, 12 Apr 2020 11:56:17 -0700 X-CMAE-Analysis: v=2.3 cv=BLbNU2YG c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=OUXY8nFuAAAA:8 a=48vgC7mUAAAA:8 a=7CQSdrXTAAAA:8 a=QyXUC8HyAAAA:8 a=K6EGIJCdAAAA:8 a=uherdBYGAAAA:8 a=fmKBIXM_FjfeUhDKJX4A:9 a=ljsLX9As8MIIM24L:21 a=_zDNtSXeFbF0t2Og:21 a=QEXdDO2ut3YA:10 a=y9OUIGaxdF8A:10 a=kj6DBQF8G6IA:10 a=anJ7ayKOw3Mh3FM6AlgA:9 a=7qNACPLnCNWRxAmL:21 a=iV-qsNTaEh87p8dJ:21 a=CLcZe0BhOn-LnOdQ:21 a=_W_S_7VecoQA:10 a=cAcMbU7R10T-QSRYIcO_:22 a=w1C3t2QeGrPiZgrLijVG:22 a=a-qgeE7W1pNrGK8U0ZQC:22 a=L6pVIi0Kn1GYQfi8-iRI:22 a=Ef4yma5cpRUEJWN9UqBm:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_0CA07872-2FBD-49AF-A9E4-3C204261D238" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Sun, 12 Apr 2020 11:56:17 -0700 In-Reply-To: Cc: "rats@ietf.org" , Ned Smith To: Guy Fedorkow References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfOsrogC2AW+F+yoohiXkLa909KmLdxvJ9EIUdAYtQ+fnzbske7VesTflENFah2FoNTAI7pf3GaS2H8MMWJax9L7DLEysZP/l8EN9wM3peG9kcNFutAVY 848UBDDQ/xvpIjiJfg5ELBkn0acsSS766m7yQo3dBQ2UStUFqaCbHB7S9Z8u7+lHSUzQmnbYMJd1n9NsbQZrNoogzwjuqNDKuPT1NBIT8L4yXS+Mj2mpEATC Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Apr 2020 18:56:22 -0000 --Apple-Mail=_0CA07872-2FBD-49AF-A9E4-3C204261D238 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Trying again, after re reading your question a few times (and a few = not-sent replies). First you need the endorsement for the TPM that is serving as the = attester. This endorsement would come from the TPM vendor. I assume that = is fairly well understood and in practice today through TPM architecture = and conventions already in place with things like IDevID. (Maybe you all = know it, but I don=E2=80=99t know how this works. I would be interested = in references and/or a description of it). Next you need to identify the RIM. That might come from the OS Vendor or = from the device vendor or even a third party, none of which are the TPM = vendor. For example, with Android, Google produces the OS, but it is = open source and the phone (the device) vendor can modify it, so the RIM = would probably come from the phone/device vendor. It seems possible to = have split RIMs where part comes from the the OS vendor and part comes = from the device vendor. Seems like OS/device/3rd-party Vendor IDs, product names and product = versions are very non-uniform. You couldn=E2=80=99t write much generic = Verifier code to work with them as they are today. The best attempts at = making these generic I know of seem EAT=E2=80=99s IEEE-based OEMID, and = PSA=E2=80=99s EAN-13 based HW version, but I don=E2=80=99t think these = are enough. Maybe there is something else out there. SWID of some sort?=20= Agreed that the identifier of the RIM doesn=E2=80=99t have to be secured = / attested, just like key ID=E2=80=99s don=E2=80=99t have to be. If the = Verifier gets the wrong one, the verification just fails. This is certainly not a solved problem in the EAT space. Maybe there=E2=80= =99s a solution in common? My first though is some sort of URI, maybe = related to SWID, that is part of the measurements in the Evidence sent = to the Verifier. It doesn=E2=80=99t have to be mandatory or used by = everyone, but it seems likely to benefit at least some. To be clear, I=E2=80=99m thinking that the Endorsement of the TPM = Attester is quite separate from the Endorsement that is the RIM. They = come from completely different vendors. The TPM Endorsement is of little = use to identify the RIM. LL > On Apr 9, 2020, at 7:31 AM, Guy Fedorkow = wrote: >=20 > Hi Laurence, > I understand that the discussion on the topic below mainly pertains = to EAT, but I=E2=80=99d like to make sure we=E2=80=99re not missing = something on the RIV side. > For OS software image integrity using a TPM, it seems like finding = the right manifest shouldn=E2=80=99t be that hard=E2=80=A6 > The Attester needs to have pre-provisioned identity and attestation = keys as outlined in the RIV draft. That provides the Verifier with the = vendor identity for the root of trust. The measurement logs contain the = alleged product name and version number for the software installed on = the box. Use the vendor ID to narrow the scope to specific vendor=E2=80=99= s product and version space, and find the RIM that matches. Then check = if the hashes line up; if so, you=E2=80=99re good, if not, either the = claim of what software is present was incorrect, or something got = hacked. > Seems like a verifier could follow this same model through the = entire chain of trust, even through multiple vendors, as long as there = are no gaps in the chain. > I know EAT needs to work in a less-constrained environment, but let = me know if you think we=E2=80=99re oversimplifying this on RIV. > =20 > Thanks > /guy > =20 > =20 > =20 > Juniper Business Use Only > From: RATS > On = Behalf Of Laurence Lundblade > Sent: Tuesday, April 7, 2020 3:13 PM > To: Thomas Fossati > > Cc: rats@ietf.org ; Ned Smith = > > Subject: Re: [Rats] Endorsement ID and verification key (was = Processing Endorsements and Evidence into Results) > =20 > [External Email. Be cautious of content] > =20 > This is a reply to both Thomas and Ned=E2=80=99s message on debug in = the related threat. > =20 > My inclination is to associate endorsements with time-invariant = characteristics of the device. At the moment this doesn=E2=80=99t seem = like the only way to do it, but it seems like a good way. Things that = are not time invariant are policy, k-g-v or such. > =20 > Endorsement > System architecture =E2=80=94 Does the Attester use a TEE or a TPM or = maybe it is simple system with just a simple CPU, but it is encased in = titanium. Is defense against chip invasive attacks considered? Do keys = become inaccessible when debug is enabled. > =20 > Development process =E2=80=94 Is there a special security-oriented = team? Does the team have a code review policy? Is there a bug bounty? = Are the desktops and IT systems used for HW and SW development isolated? > =20 > Manufacturing =E2=80=94 Are the factories secured in a special way? Is = the attestation key provisioning system hardened in some way (e.g., uses = HSMs). > =20 > Certifications =E2=80=94 These take a long time to achieve and will = usually require some of the above. > =20 > My thinking for EAT was that you only put attestation keys into = devices that meet some criteria like some of the above. Since there is = often no way to recover from a compromised attestation key because no = key more secure than it, you kind of have to have all that.=20 > =20 > Since these don=E2=80=99t change much over time, the endorsement = wouldn=E2=80=99t change. They could even span several models and = varying HW. > =20 > Policy, K-G-V, other > SW Versions =E2=80=94 As long as the SW follows a development process = like that above, it doesn=E2=80=99t have to be included in the = endorsement. Of course the smaller the SW and the better the process, = the more it is true (and vice versa). > =20 > Blacklists =E2=80=94 These might be specific to UEIDs, versions of SW, = deployments a particular OEM or such > =20 > Debug status =E2=80=94 Most of the debug status values can vary on a = day-day basis > =20 > OEM model =E2=80=94 If the attestation is implemented by a chip vendor = and the endorsement is for the chip, then the OEM model will vary = widely. > =20 > None of these can be criteria as to whether an attestation key is put = into a device or not as they are not known at manufacturing time and/or = must be allowed to vary widely after manufacturing. > =20 > =20 > I think what I=E2=80=99ve described above lines up pretty well for a = TPM. The system architecture is mostly set by the TCG. HW TPMs are = almost always certified. They are independent of OEM model. It also = lines up reasonably well with secure elements and can line up with = TEE=E2=80=99s. =20 > =20 > The crux of endorsement to me is the security characteristics of the = attester that protect the attestation key because there is generally no = recovery from a compromised attestation key. It sets the baseline risk = of the HW and SW of the device. > =20 > =20 > On one extreme is a separate endorsement for every device (=E2=80=9Cmicr= o endorsement"?), which is what I think Thomas and ARM PSA are tending = towards. The other extreme is one endorsement for a product line = (=E2=80=9Cmacro endorsement"?),, say a product line of TPMs. Then it=E2=80= =99s more like the data sheet for the product. =20 > =20 > Then there=E2=80=99s different ways to fan this out to the different = key / signing schemes (per-device key, group key, ECDAA, X.509). For = example a macro-endorsement could include the root of an X.509 hierarchy = and the individual devices (or groups of devices) would have individual = keys that chain up. With a micro-endorsement the per-device public key = could be per endorsement. > =20 > =20 > The most important thing about the endorsement seems to me is the = characterization of how the attestation key is protected. > =20 > LL > =20 > =20 > =20 >=20 > On Apr 7, 2020, at 7:36 AM, Thomas Fossati > wrote: > =20 > Hi Laurence, >=20 > Thanks for bringing this up. A few thoughts below. >=20 > On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" > on behalf of = lgl@island-resort.com > wrote: >=20 > So how does a Verifier find the applicable endorsement for Evidence it > wishes to verify and know that is really the right endorsement? >=20 > Seems like the Evidence needs some sort of an endorsement locator ID. > This could be a URL or a GUID. EAT currently has the origination claim > to try to solve this, but it is half-baked. It needs to get fixed. = I=E2=80=99m > fishing for comments here on what it should be like. >=20 > Pretty sure the Endorsement needs to include or reference the public > key that is used to verify the signature. Without that, the Attester > could lie and pick any old Endorsement that it wishes. There needs to > be some binding between items in the endorsement (E0, E1,=E2=80=A6) = and the > verification key. That could be in the form of a signed token or > certificate, but doesn=E2=80=99t have to be. Pretty sure this needs to = be > discussed in the architecture doc. >=20 > There's a few scenarios: > - One endorsement applies to lots of devices in the same class, but > each has their own attestation key. > - - Probably ECDAA fits in here > - - One option here is an X509 hierarchy > - Group keys are used (for privacy reasons or other) so there is a > one-one correlation with the Endorsements (the GEID discussion) > - Group keys are used, but across devices that have different > endorsements so there=E2=80=99s no one-one correlation >=20 > While the last one seems odd and unlikely, I think it could occur, > because from a lot of real experience the set up of attestation keys > is very idiosyncratic. It is wildly affected by manufacturing costs > and issues on assembly lines, sub contractor structure, location of > secure facilities and approaches to making money on it. They are like > snowflakes, each one is different. So maybe endorsement locator ID > and key ID are not the same, but they can be in some use cases? >=20 > I am also tempted to encourage the placement of the endorsement > locator ID in the COSE or JOSE header parameters so you don=E2=80=99t = have to > parse the unverified body of claims to be able to find the key > material to verify it. >=20 > Thoughts? >=20 > A two level lookup key, model+instance, seems to be quite generally > applicable as an endorsement locator. The model part would get you to > the shared data (e.g., certification, measured boot KGVs, etc.), while > the instance part can be used to retrieve device-specific state: > verification key(s) as well as other metadata, e.g., if some gear is > blacklisted. In PSA we have something quite (though not entirely) > similar with implementation and instance IDs [1] [2]. >=20 > (Context-switching for a second on our previous UEID/GEID discussion: = I > guess we might model an instance as an anonymity set, and therefore > treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?) >=20 > For the sake of building a shared and reusable vocabulary, I'd prefer > keeping model and instance identifiers as separate claims rather than > having an opaque endorsement ID claim that clumps together those and > possibly other stuff in a use-case specific fashion. For the same > reason I would not override key ID with instance ID semantics. >=20 > cheers, thanks! >=20 > [1] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-imple= mentation-id = > [2] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-insta= nce-id = >=20 >=20 >=20 > IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_0CA07872-2FBD-49AF-A9E4-3C204261D238 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Trying again, after re reading your question a few times (and = a few not-sent replies).

First you need the endorsement for the TPM that is serving as = the attester. This endorsement would come from the TPM vendor. I assume = that is fairly well understood and in practice today through TPM = architecture and conventions already in place with things like IDevID. = (Maybe you all know it, but I don=E2=80=99t know how this works. I would = be interested in references and/or a description of it).

Next you need to = identify the RIM. That might come from the OS Vendor or from the device = vendor or even a third party, none of which are the TPM vendor. For = example, with Android, Google produces the OS, but it is open source and = the phone (the device) vendor can modify it, so the RIM would probably = come from the phone/device vendor. It seems possible to have split RIMs = where part comes from the the OS vendor and part comes from the device = vendor.

Seems = like OS/device/3rd-party Vendor IDs, product names and product versions = are very non-uniform. You couldn=E2=80=99t write much generic Verifier = code to work with them as they are today. The best attempts at making = these generic I know of seem EAT=E2=80=99s IEEE-based OEMID, and PSA=E2=80= =99s EAN-13 based HW version, but I don=E2=80=99t think these are = enough. Maybe there is something else out there. SWID of some = sort? 

Agreed that the identifier of the RIM doesn=E2=80=99t have = to be secured / attested, just like key ID=E2=80=99s don=E2=80=99t have = to be. If the Verifier gets the wrong one, the verification just = fails.

This is certainly not a solved problem in the EAT space. = Maybe there=E2=80=99s a solution in common? My first though is some sort = of URI, maybe related to SWID, that is part of the measurements in the = Evidence sent to the Verifier. It doesn=E2=80=99t have to be mandatory = or used by everyone, but it seems likely to benefit at least = some.

To be = clear, I=E2=80=99m thinking that the Endorsement of the TPM Attester is = quite separate from the Endorsement that is the RIM. They come from = completely different vendors. The TPM Endorsement is of little use to = identify the RIM.

LL




On Apr 9, 2020, at 7:31 AM, Guy Fedorkow <gfedorkow@juniper.net> wrote:

Hi = Laurence,
  I understand that the discussion on the topic below = mainly pertains to EAT, but I=E2=80=99d like to make sure we=E2=80=99re = not missing something on the RIV side.
  For OS software image integrity = using a TPM, it seems like finding the right manifest shouldn=E2=80=99t = be that hard=E2=80=A6
  The Attester needs to have pre-provisioned identity = and attestation keys as outlined in the RIV draft.  That provides = the Verifier with the vendor identity for the root of trust.  The = measurement logs contain the alleged product name and version number for = the software installed on the box.  Use the vendor ID to narrow the = scope to specific vendor=E2=80=99s product and version space, and find = the RIM that matches.  Then check if the hashes line up; if so, = you=E2=80=99re good, if not, either the claim of what software is = present was incorrect, or something got hacked.
  = Seems like a verifier could follow this same model through the entire = chain of trust, even through multiple vendors, as long as there are no = gaps in the chain.
  I know EAT needs to work in a less-constrained = environment, but let me know if you think we=E2=80=99re oversimplifying = this on RIV.
 
  Thanks
/guy
 
 
 
Juniper Business Use Only
From: RATS <rats-bounces@ietf.org> On Behalf = Of Laurence = Lundblade
Sent: Tuesday, April 7, 2020 3:13 = PM
To: Thomas Fossati <Thomas.Fossati@arm.com>
Cc: rats@ietf.org; Ned Smith <ned.smith@intel.com>
Subject: Re: [Rats] Endorsement ID = and verification key (was Processing Endorsements and Evidence into = Results)
 
[External Email. Be cautious of content]
 
This is a reply to both = Thomas and Ned=E2=80=99s message on debug in the related threat.
 
My inclination is to associate = endorsements with time-invariant characteristics of the device. At the = moment this doesn=E2=80=99t seem like the only way to do it, but it = seems like a good way. Things that are not time invariant are policy, = k-g-v or such.
 
Endorsement
System architecture =E2=80=94 Does the Attester use a TEE or = a TPM or maybe it is simple system with just a simple CPU, but it is = encased in titanium. Is defense against chip invasive attacks = considered? Do keys become inaccessible when debug is enabled.
 
Development process =E2=80=94 Is there = a special security-oriented team? Does the team have a code review = policy? Is there a bug bounty? Are the desktops and IT systems used for = HW and SW development isolated?
 
Manufacturing =E2=80=94 Are the factories secured in a = special way? Is the attestation key provisioning system hardened in some = way (e.g., uses HSMs).
 
Certifications =E2=80=94 These take a long time to achieve = and will usually require some of the above.
 
My thinking for EAT was = that you only put attestation keys into devices that meet some criteria = like some of the above. Since there is often no way to recover from a = compromised attestation key because no key more secure than it, you kind = of have to have all that. 
 
Since these don=E2=80=99t change much over time, the = endorsement wouldn=E2=80=99t change.  They could even span several = models and varying HW.
 
Policy, K-G-V, other
SW Versions =E2=80=94 As long as the SW follows a development = process like that above, it doesn=E2=80=99t have to be included in the = endorsement. Of course the smaller the SW and the better the process, = the more it is true (and vice versa).
 
Blacklists =E2=80=94 These might be = specific to UEIDs, versions of SW, deployments a particular OEM or = such
 
Debug status =E2=80=94 Most of the debug status values can = vary on a day-day basis
 
OEM model =E2=80=94 If the attestation is implemented by a = chip vendor and the endorsement is for the chip, then the OEM model will = vary widely.
 
None of these can be criteria as to whether an attestation = key is put into a device or not as they are not known at manufacturing = time and/or must be allowed to vary widely after manufacturing.
 
 
I think what I=E2=80=99ve described above lines up pretty = well for a TPM. The system architecture is mostly set by the TCG. HW = TPMs are almost always certified. They are independent of OEM model. It = also lines up reasonably well with secure elements and can line up with = TEE=E2=80=99s.  
 
The crux of endorsement to me is the security characteristics = of the attester that protect the attestation key because there is = generally no recovery from a compromised attestation key. It sets the = baseline risk of the HW and SW of the device.
 
 
On one extreme is a separate endorsement for every device = (=E2=80=9Cmicro endorsement"?), which is what I think Thomas and ARM PSA = are tending towards. The other extreme is one endorsement for a product = line (=E2=80=9Cmacro endorsement"?),, say a product line of TPMs. = Then it=E2=80=99s more like the data sheet for the product.  
 
Then there=E2=80=99s different ways to = fan this out to the different key / signing schemes (per-device key, = group key, ECDAA, X.509). For example a macro-endorsement could include = the root of an X.509 hierarchy and the individual devices (or groups of = devices) would have individual keys that chain up. With a = micro-endorsement the per-device public key could be per = endorsement.
 
 
The most important thing about the = endorsement seems to me is the characterization of how the attestation = key is protected.
 
LL
 
 

 

On Apr 7, 2020, at 7:36 AM, Thomas Fossati <Thomas.Fossati@arm.com> = wrote:
 

Hi Laurence,

Thanks for bringing this up.  A few = thoughts below.

On 03/04/2020, 20:37, "RATS = on behalf of Laurence Lundblade"
<rats-bounces@ietf.org on behalf of lgl@island-resort.com> = wrote:

So how does a Verifier find the applicable = endorsement for Evidence it
wishes to verify and know that = is really the right endorsement?

Seems like = the Evidence needs some sort of an endorsement locator ID.
This could be a URL or a GUID. EAT currently has the = origination claim
to try to solve this, but it is = half-baked. It needs to get fixed. I=E2=80=99m
fishing for = comments here on what it should be like.

Pretty sure the Endorsement needs to include or reference the = public
key that is used to verify the signature. Without = that, the Attester
could lie and pick any old Endorsement = that it wishes. There needs to
be some binding between = items in the endorsement (E0, E1,=E2=80=A6) and the
verification key. That could be in the form of a signed token = or
certificate, but doesn=E2=80=99t have to be. Pretty = sure this needs to be
discussed in the architecture = doc.

There's a few scenarios:
-= One endorsement applies to lots of devices in the same class, but
 each has their own attestation key.
- - = Probably ECDAA fits in here
- - One option here is an X509 = hierarchy
- Group keys are used (for privacy reasons or = other) so there is a
 one-one correlation with the = Endorsements (the GEID discussion)
- Group keys are used, = but across devices that have different
 endorsements = so there=E2=80=99s no one-one correlation

While the last one seems odd and unlikely, I think it could = occur,
because from a lot of real experience the set up of = attestation keys
is very idiosyncratic. It is wildly = affected by manufacturing costs
and issues on assembly = lines, sub contractor structure, location of
secure = facilities and approaches to making money on it. They are like
snowflakes, each one is different.  So maybe endorsement = locator ID
and key ID are not the same, but they can be in = some use cases?

I am also tempted to = encourage the placement of the endorsement
locator ID in = the COSE or JOSE header parameters so you don=E2=80=99t have to
parse the unverified body of claims to be able to find the = key
material to verify it.

Thoughts?

A two = level lookup key, model+instance, seems to be quite generally
applicable as an endorsement locator.  The model part = would get you to
the shared data (e.g., certification, = measured boot KGVs, etc.), while
the instance part can be = used to retrieve device-specific state:
verification = key(s) as well as other metadata, e.g., if some gear is
blacklisted.  In PSA we have something quite (though not = entirely)
similar with implementation and instance IDs [1] = [2].

(Context-switching for a second on our = previous UEID/GEID discussion: I
guess we might model an = instance as an anonymity set, and therefore
treat EUIDs as = the special case GEIDs with cardinality =3D=3D 1?)

For the sake of building a shared and reusable vocabulary, = I'd prefer
keeping model and instance identifiers as = separate claims rather than
having an opaque endorsement = ID claim that clumps together those and
possibly other = stuff in a use-case specific fashion.  For the same
reason I would not override key ID with instance ID = semantics.

cheers, thanks!

[1] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-implementation-id
[2] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-instance-id



IMPORTANT NOTICE: The contents of this email = and any attachments are confidential and may also be privileged. If you = are not the intended recipient, please notify the sender immediately and = do not disclose the contents to any other person, use it for any = purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_0CA07872-2FBD-49AF-A9E4-3C204261D238-- From nobody Sun Apr 12 18:44:35 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9E433A0868 for ; Sun, 12 Apr 2020 18:44:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=SGrRXIYg; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=RGTbjJ8+ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5L2JrygYp9lW for ; Sun, 12 Apr 2020 18:44:29 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6A463A0866 for ; Sun, 12 Apr 2020 18:44:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=54909; q=dns/txt; s=iport; t=1586742268; x=1587951868; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=Ew9XqR7b7EUwuEizGLDP8U5zdh48x09R2erEjvqf6Bg=; b=SGrRXIYgL2vR4BJ/Hy+T8xfAMPNfUVjMvgoUr9YjTdA/STiYyx4rsNvK 9JKiNR/uwos6RbNenp+Z5Dp7lYpeQwBpjeqjlhxGwVZ3udNYL0/vz01fg 6tOtrLYW/m+RswgaTRwpKpLfyHEApeo++V5OWcnMP/udjU2BIk0wxPPEb Y=; IronPort-PHdr: =?us-ascii?q?9a23=3AtlH95xLZ/udk5ueak9mcpTVXNCE6p7X5OBIU4Z?= =?us-ascii?q?M7irVIN76u5InmIFeBvKd2lFGcW4Ld5roEkOfQv636EU04qZea+DFnEtRXUg?= =?us-ascii?q?Mdz8AfngguGsmAXFb7M/P2byUwNM9DT1RiuXq8NBsdFQ=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AjAgCsw5Ne/4kNJK1cAQkbAQEBAQE?= =?us-ascii?q?BAQUBAQERAQEDAwEBAYF7gSUvJAUnBWxYIAQLKgqEEoNGA4pngl+VP4JkgUK?= =?us-ascii?q?BEANQBAoBAQEMAQEYAQcNAgQBAYFQgnQCF4F5JDgTAgMBAQsBAQUBAQECAQU?= =?us-ascii?q?EbYVWDIVwAQEBAQEBAQEBEAgJHQEBLAIJAQQLAgEIDgMBAgEBASEBAgQDAgI?= =?us-ascii?q?CJQsUAwYIAgQBDQUbB4MEATiBRk0DDh8BAQ6jTgKBOYhidYEygn8BAQWBM1E?= =?us-ascii?q?Dgn8Ygg4DBoE4gmKHfzWBEA8agUE/JmsnHIFPUC4+gXluAQEBAYEuAQcBCgE?= =?us-ascii?q?oEAkNCQKCWjKCLI18SQIDgk2GCiSZFHsKgkGHfoothSQdglMziBKRDowLg0a?= =?us-ascii?q?JMZMXAgQCBAUCDgEBBYFpIjcNI3BwFTsqAYI+UBgNVowpJAwXFW8BAoJJhRS?= =?us-ascii?q?FQXQCARGBFY0vAYEPAQE?= X-IronPort-AV: E=Sophos;i="5.72,375,1580774400"; d="scan'208,217";a="745241962" Received: from alln-core-4.cisco.com ([173.36.13.137]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 13 Apr 2020 01:44:24 +0000 Received: from XCH-ALN-002.cisco.com (xch-aln-002.cisco.com [173.36.7.12]) by alln-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id 03D1iNpO027295 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 13 Apr 2020 01:44:23 GMT Received: from xhs-rtp-003.cisco.com (64.101.210.230) by XCH-ALN-002.cisco.com (173.36.7.12) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Sun, 12 Apr 2020 20:44:23 -0500 Received: from xhs-aln-003.cisco.com (173.37.135.120) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Sun, 12 Apr 2020 21:44:22 -0400 Received: from NAM04-CO1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Sun, 12 Apr 2020 20:44:22 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Nm/bL/cyNRi8tdlWXuWoxhsnrHjWu+bsthiEZnCb0UM0j+zDDiZ9zDvcKoELuEeCORTTfr8zOP5CoUb7z/GmXpCuACR76TeZ1gXepGBRNeT7eMt06Ph78n71vYoJCgAEIemsLNyBoKJZYDCrVnqEapzTNKmTAH3KbraV6lMcCG60JB7KxvdnS8IeUvqyA6gUyjx+GWT6QGJrucAC8ZVxKgu31r26O1fnS354b32O/MAmhU2h0MCDBz82B5y2zLEWppRZfuoNSMgQtvfnACzJGsh7xganBIbNr0FDSkFBXFd/erL9b78BLWTbyDCl2/YwLNIZH7QaGl+wggGo5aayuQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ew9XqR7b7EUwuEizGLDP8U5zdh48x09R2erEjvqf6Bg=; b=jc+T5W1xQaAOX2WKnjGY3Xg1PvMPkzJykvqmcMRkfsXCaLaYRqeRf7+6qGIFRb1y6LVWaMCqUo3kU4BjahkcnaWV1VUpUJnC0qpj2tWnL5RIpw5PaJ3IKK9Bxw68xSpTqe6lkWzaTnLlBBDfWHOQC6QYi/PGiKDDzrKcz8IpduXHSN8/dg5ziBp6ZdoFxnzWq3kNYXufDbXNS63dxRpEdeFP2kzguvzvJcNDR71DmWtGIAQgpZ+EbM4vOpvFVTWAiIa9kt1jEa4jnNsf9/sIMDt2U9w9mSHS/zmXXX2y0YnClhFC7g/7wZWHU6s/6xtWwgjJac/CySjV+yoDRr0lTg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ew9XqR7b7EUwuEizGLDP8U5zdh48x09R2erEjvqf6Bg=; b=RGTbjJ8+Kf2Xh6B0LVcxr9yCXrr8E+737pGVuZbA1KB7wvYM0XpAJ1TFefXB0S3QqxjA75LDE+TpZwUBU6rVIABSTNnDqfqvtsRqgEIL4bmAv1svM8caPINjPkH9ZUuRmStr63jGLTn7+kaDyXYgwkSn6OVlcyiwGO3oI7TupU8= Received: from CY4PR11MB0054.namprd11.prod.outlook.com (10.171.254.155) by CY4PR11MB1525.namprd11.prod.outlook.com (10.172.68.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.26; Mon, 13 Apr 2020 01:44:20 +0000 Received: from CY4PR11MB0054.namprd11.prod.outlook.com ([fe80::28e9:601e:c59b:edbf]) by CY4PR11MB0054.namprd11.prod.outlook.com ([fe80::28e9:601e:c59b:edbf%3]) with mapi id 15.20.2900.028; Mon, 13 Apr 2020 01:44:20 +0000 From: "Shwetha Bhandari (shwethab)" To: Laurence Lundblade , Guy Fedorkow CC: "rats@ietf.org" , Ned Smith Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9fJjulv3BN1Eixg7s2QPw1hKhtv9mAgABNSQCAAtYcgIAFAPqAgADOMoA= Date: Mon, 13 Apr 2020 01:44:19 +0000 Message-ID: <0026A707-C601-4F74-932A-53F3B1F24426@cisco.com> References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.21.0.200113 authentication-results: spf=none (sender IP is ) smtp.mailfrom=shwethab@cisco.com; x-originating-ip: [223.226.52.170] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a9f40599-853f-4a5d-66e5-08d7df4c2f4c x-ms-traffictypediagnostic: CY4PR11MB1525: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 037291602B x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CY4PR11MB0054.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(396003)(366004)(39860400002)(136003)(346002)(376002)(15650500001)(8936002)(81156014)(186003)(2616005)(71200400001)(6486002)(5660300002)(4326008)(30864003)(21615005)(86362001)(8676002)(6506007)(76116006)(91956017)(66946007)(36756003)(2906002)(53546011)(478600001)(966005)(110136005)(54906003)(66476007)(6512007)(55236004)(66556008)(33656002)(66446008)(64756008)(316002)(26005)(15398625002); DIR:OUT; SFP:1101; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: dKzYdcslKvQdeEB2Q76pUtw8UKExUXPEWekC6hI6oSC7wBcdoz7MxmcwJnilI9VCKojGaLlIaTrn20Szn2fzvfzOdQa9IlkasrRIWe7R7tkV8skwOOwjIxyDhXzWbaqjJhtj8WyctlFVBfMv3rPcc/7Eo3WmA4jBIQQ5TPmR0Cj2BeQym5Z62ISrZKNU7BeVYZZJ4NQKRKA/VNeUTsAjrwvj4ECblXZpAe66MtGY7RdvlDWJahuRc5sj73XhMqJmVZ2D6dQonbvCNn8fltzAwGYlsYsL/n6si2sL/RHCWzrP15AAlWpw9lM8tiearZ40T1B9xTukAYnRNGXCL0Unk6I3VHaSz1cvzxtcydi24uzbHi1KzhB40DcrIkxWM9BSkcgMXv+DrLev9eFpR6mBRaWWMbPQjiz0DNLnLAPf1CTWiz2aE2NyweP3nXAjoCPsXP3UqOzCEsTlzeGBXrSOsJ8W3bQJnaZFruJ2opb3SqkKNv/npj65otmgjWdzIPE91nOLkEfbji3WMEoc/2zSNkbg3p3mXxoiGPIF13F/6y2+mYWFpbXOmpOtfjYAhlDM x-ms-exchange-antispam-messagedata: xqoHp24uGHQpxjEOWtSaTpJ5GR2k++HqMuDz4M9uqm+MSWV1kabVWatJN59MfVFjnLmGPL2zW40NPcPeiTDssQ/gftHv9Btjo9hQhYWch4ASBddaqbz6VfVzhJJCN7DCEWBpafTZmZsIwcLH3VIYrw== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_0026A707C6014F74932A53F3B1F24426ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: a9f40599-853f-4a5d-66e5-08d7df4c2f4c X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Apr 2020 01:44:19.8390 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: mE38QFraZnpomZ+J8qqNN/kNofhWpiddyt713JO8GHeeEyPggOMoeh1V2oy7QRilLZw9wo6sg5MjFG4mvohwKQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR11MB1525 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.12, xch-aln-002.cisco.com X-Outbound-Node: alln-core-4.cisco.com Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Apr 2020 01:44:33 -0000 --_000_0026A707C6014F74932A53F3B1F24426ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiBGaXJzdCB5b3UgbmVlZCB0aGUgZW5kb3JzZW1lbnQgZm9yIHRoZSBUUE0gdGhhdCBpcyBzZXJ2 aW5nIGFzIHRoZSBhdHRlc3Rlci4gVGhpcyBlbmRvcnNlbWVudCB3b3VsZCBjb21lIGZyb20gdGhl IFRQTSB2ZW5kb3IuIEkgYXNzdW1lIHRoYXQgaXMgZmFpcmx5IHdlbGwgdW5kZXJzdG9vZCBhbmQg aW4gcHJhY3RpY2UgdG9kYXkgdGhyb3VnaCBUUE0gYXJjaGl0ZWN0dXJlIGFuZCBjb252ZW50aW9u cyBhbHJlYWR5IGluIHBsYWNlIHdpdGggdGhpbmdzIGxpa2UgSURldklELiAoTWF5YmUgeW91IGFs bCBrbm93IGl0LCBidXQgSSBkb27igJl0IGtub3cgaG93IHRoaXMgd29ya3MuIEkgd291bGQgYmUg aW50ZXJlc3RlZCBpbiByZWZlcmVuY2VzIGFuZC9vciBhIGRlc2NyaXB0aW9uIG9mIGl0KS4NCkFs c28gZW5kb3JzZW1lbnQgb2Yga2V5IHVzZWQgZm9yIGF0dGVzdGF0aW9uIOKAkyB0aGUgQXR0ZXN0 YXRpb24gSWRlbnRpdHkga2V5PGh0dHBzOi8vdHJ1c3RlZGNvbXB1dGluZ2dyb3VwLm9yZy93cC1j b250ZW50L3VwbG9hZHMvSVdHLUFJSy1DTUMtZW5yb2xsbWVudC1GQVEucGRmPi4NCg0KDQo+IE15 IGZpcnN0IHRob3VnaCBpcyBzb21lIHNvcnQgb2YgVVJJLCBtYXliZSByZWxhdGVkIHRvIFNXSUQs IHRoYXQgaXMgcGFydCBvZiB0aGUgbWVhc3VyZW1lbnRzIGluIHRoZSBFdmlkZW5jZSBzZW50IHRv IHRoZSBWZXJpZmllci4gSXQgZG9lc27igJl0IGhhdmUgdG8gYmUgbWFuZGF0b3J5IG9yIHVzZWQg YnkgZXZlcnlvbmUsIGJ1dCBpdCBzZWVtcyBsaWtlbHkgdG8gYmVuZWZpdCBhdCBsZWFzdCBzb21l Lg0KDQorMSB0byB0aGUgVVJJLiBBIHByb2dyYW1tYXRpYyBhbmQgdW5pZm9ybSB3YXkgdG8gcXVl cnkgdGhlIHB1Ymxpc2hlZCBSSU0gZm9yIGFsbCB0aGUgYXJ0aWZhY3RzIHdvdWxkIGJlIHVzZWZ1 bCwgSSBhc3N1bWUgdGhpcyBjYW5ub3QgYmUgcmVwb3J0ZWQgYnkgdGhlIGRldmljZSBpdHNlbGYg YXMgaXQgY2Fubm90IGJlIHRydXN0ZWQuIEluIGFkZGl0aW9uIHRvIE9FTUlELCBIVyBJRC92ZXJz aW9uLCBTV0lEIOKAkyBBbiBlYXN5IHdheSB0byBsb29rIHVwIFJJTSAtIHZlbmRvciBzcGVjaWZp YyBkYXRhYmFzZSB0byBxdWVyeSAtIEROUyBSUiBob3N0ZWQgYnkgdGhlIHZlbmRvcnMgcGVyaGFw cz8NCg0KSGVyZeKAmXMgYW4gZXhhbXBsZSBvZiB0aGUgUklNIHByb2R1Y2VkIGJ5IGEgTmV0d29y ayBkZXZpY2UgYW5kIE9TIHZlbmRvcjoNCmh0dHBzOi8vd3d3LmNpc2NvLmNvbS9jL2VuL3VzL2Fi b3V0L3RydXN0LWNlbnRlci9kb3dubG9hZHMuaHRtbA0KDQoNClRoYW5rcywNClNod2V0aGENCg0K RnJvbTogUkFUUyA8cmF0cy1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgTGF1cmVuY2Ug THVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb20+DQpEYXRlOiBNb25kYXksIEFwcmlsIDEz LCAyMDIwIGF0IDEyOjI2IEFNDQpUbzogR3V5IEZlZG9ya293IDxnZmVkb3Jrb3dAanVuaXBlci5u ZXQ+DQpDYzogInJhdHNAaWV0Zi5vcmciIDxyYXRzQGlldGYub3JnPiwgTmVkIFNtaXRoIDxuZWQu c21pdGhAaW50ZWwuY29tPg0KU3ViamVjdDogUmU6IFtSYXRzXSBFbmRvcnNlbWVudCBJRCBhbmQg dmVyaWZpY2F0aW9uIGtleSAod2FzIFByb2Nlc3NpbmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5j ZSBpbnRvIFJlc3VsdHMpDQoNClRyeWluZyBhZ2FpbiwgYWZ0ZXIgcmUgcmVhZGluZyB5b3VyIHF1 ZXN0aW9uIGEgZmV3IHRpbWVzIChhbmQgYSBmZXcgbm90LXNlbnQgcmVwbGllcykuDQoNCkZpcnN0 IHlvdSBuZWVkIHRoZSBlbmRvcnNlbWVudCBmb3IgdGhlIFRQTSB0aGF0IGlzIHNlcnZpbmcgYXMg dGhlIGF0dGVzdGVyLiBUaGlzIGVuZG9yc2VtZW50IHdvdWxkIGNvbWUgZnJvbSB0aGUgVFBNIHZl bmRvci4gSSBhc3N1bWUgdGhhdCBpcyBmYWlybHkgd2VsbCB1bmRlcnN0b29kIGFuZCBpbiBwcmFj dGljZSB0b2RheSB0aHJvdWdoIFRQTSBhcmNoaXRlY3R1cmUgYW5kIGNvbnZlbnRpb25zIGFscmVh ZHkgaW4gcGxhY2Ugd2l0aCB0aGluZ3MgbGlrZSBJRGV2SUQuIChNYXliZSB5b3UgYWxsIGtub3cg aXQsIGJ1dCBJIGRvbuKAmXQga25vdyBob3cgdGhpcyB3b3Jrcy4gSSB3b3VsZCBiZSBpbnRlcmVz dGVkIGluIHJlZmVyZW5jZXMgYW5kL29yIGEgZGVzY3JpcHRpb24gb2YgaXQpLg0KDQpOZXh0IHlv dSBuZWVkIHRvIGlkZW50aWZ5IHRoZSBSSU0uIFRoYXQgbWlnaHQgY29tZSBmcm9tIHRoZSBPUyBW ZW5kb3Igb3IgZnJvbSB0aGUgZGV2aWNlIHZlbmRvciBvciBldmVuIGEgdGhpcmQgcGFydHksIG5v bmUgb2Ygd2hpY2ggYXJlIHRoZSBUUE0gdmVuZG9yLiBGb3IgZXhhbXBsZSwgd2l0aCBBbmRyb2lk LCBHb29nbGUgcHJvZHVjZXMgdGhlIE9TLCBidXQgaXQgaXMgb3BlbiBzb3VyY2UgYW5kIHRoZSBw aG9uZSAodGhlIGRldmljZSkgdmVuZG9yIGNhbiBtb2RpZnkgaXQsIHNvIHRoZSBSSU0gd291bGQg cHJvYmFibHkgY29tZSBmcm9tIHRoZSBwaG9uZS9kZXZpY2UgdmVuZG9yLiBJdCBzZWVtcyBwb3Nz aWJsZSB0byBoYXZlIHNwbGl0IFJJTXMgd2hlcmUgcGFydCBjb21lcyBmcm9tIHRoZSB0aGUgT1Mg dmVuZG9yIGFuZCBwYXJ0IGNvbWVzIGZyb20gdGhlIGRldmljZSB2ZW5kb3IuDQoNClNlZW1zIGxp a2UgT1MvZGV2aWNlLzNyZC1wYXJ0eSBWZW5kb3IgSURzLCBwcm9kdWN0IG5hbWVzIGFuZCBwcm9k dWN0IHZlcnNpb25zIGFyZSB2ZXJ5IG5vbi11bmlmb3JtLiBZb3UgY291bGRu4oCZdCB3cml0ZSBt dWNoIGdlbmVyaWMgVmVyaWZpZXIgY29kZSB0byB3b3JrIHdpdGggdGhlbSBhcyB0aGV5IGFyZSB0 b2RheS4gVGhlIGJlc3QgYXR0ZW1wdHMgYXQgbWFraW5nIHRoZXNlIGdlbmVyaWMgSSBrbm93IG9m IHNlZW0gRUFU4oCZcyBJRUVFLWJhc2VkIE9FTUlELCBhbmQgUFNB4oCZcyBFQU4tMTMgYmFzZWQg SFcgdmVyc2lvbiwgYnV0IEkgZG9u4oCZdCB0aGluayB0aGVzZSBhcmUgZW5vdWdoLiBNYXliZSB0 aGVyZSBpcyBzb21ldGhpbmcgZWxzZSBvdXQgdGhlcmUuIFNXSUQgb2Ygc29tZSBzb3J0Pw0KDQpB Z3JlZWQgdGhhdCB0aGUgaWRlbnRpZmllciBvZiB0aGUgUklNIGRvZXNu4oCZdCBoYXZlIHRvIGJl IHNlY3VyZWQgLyBhdHRlc3RlZCwganVzdCBsaWtlIGtleSBJROKAmXMgZG9u4oCZdCBoYXZlIHRv IGJlLiBJZiB0aGUgVmVyaWZpZXIgZ2V0cyB0aGUgd3Jvbmcgb25lLCB0aGUgdmVyaWZpY2F0aW9u IGp1c3QgZmFpbHMuDQoNClRoaXMgaXMgY2VydGFpbmx5IG5vdCBhIHNvbHZlZCBwcm9ibGVtIGlu IHRoZSBFQVQgc3BhY2UuIE1heWJlIHRoZXJl4oCZcyBhIHNvbHV0aW9uIGluIGNvbW1vbj8gTXkg Zmlyc3QgdGhvdWdoIGlzIHNvbWUgc29ydCBvZiBVUkksIG1heWJlIHJlbGF0ZWQgdG8gU1dJRCwg dGhhdCBpcyBwYXJ0IG9mIHRoZSBtZWFzdXJlbWVudHMgaW4gdGhlIEV2aWRlbmNlIHNlbnQgdG8g dGhlIFZlcmlmaWVyLiBJdCBkb2VzbuKAmXQgaGF2ZSB0byBiZSBtYW5kYXRvcnkgb3IgdXNlZCBi eSBldmVyeW9uZSwgYnV0IGl0IHNlZW1zIGxpa2VseSB0byBiZW5lZml0IGF0IGxlYXN0IHNvbWUu DQoNClRvIGJlIGNsZWFyLCBJ4oCZbSB0aGlua2luZyB0aGF0IHRoZSBFbmRvcnNlbWVudCBvZiB0 aGUgVFBNIEF0dGVzdGVyIGlzIHF1aXRlIHNlcGFyYXRlIGZyb20gdGhlIEVuZG9yc2VtZW50IHRo YXQgaXMgdGhlIFJJTS4gVGhleSBjb21lIGZyb20gY29tcGxldGVseSBkaWZmZXJlbnQgdmVuZG9y cy4gVGhlIFRQTSBFbmRvcnNlbWVudCBpcyBvZiBsaXR0bGUgdXNlIHRvIGlkZW50aWZ5IHRoZSBS SU0uDQoNCkxMDQoNCg0KDQoNCg0KT24gQXByIDksIDIwMjAsIGF0IDc6MzEgQU0sIEd1eSBGZWRv cmtvdyA8Z2ZlZG9ya293QGp1bmlwZXIubmV0PG1haWx0bzpnZmVkb3Jrb3dAanVuaXBlci5uZXQ+ PiB3cm90ZToNCg0KSGkgTGF1cmVuY2UsDQogIEkgdW5kZXJzdGFuZCB0aGF0IHRoZSBkaXNjdXNz aW9uIG9uIHRoZSB0b3BpYyBiZWxvdyBtYWlubHkgcGVydGFpbnMgdG8gRUFULCBidXQgSeKAmWQg bGlrZSB0byBtYWtlIHN1cmUgd2XigJlyZSBub3QgbWlzc2luZyBzb21ldGhpbmcgb24gdGhlIFJJ ViBzaWRlLg0KICBGb3IgT1Mgc29mdHdhcmUgaW1hZ2UgaW50ZWdyaXR5IHVzaW5nIGEgVFBNLCBp dCBzZWVtcyBsaWtlIGZpbmRpbmcgdGhlIHJpZ2h0IG1hbmlmZXN0IHNob3VsZG7igJl0IGJlIHRo YXQgaGFyZOKApg0KICBUaGUgQXR0ZXN0ZXIgbmVlZHMgdG8gaGF2ZSBwcmUtcHJvdmlzaW9uZWQg aWRlbnRpdHkgYW5kIGF0dGVzdGF0aW9uIGtleXMgYXMgb3V0bGluZWQgaW4gdGhlIFJJViBkcmFm dC4gIFRoYXQgcHJvdmlkZXMgdGhlIFZlcmlmaWVyIHdpdGggdGhlIHZlbmRvciBpZGVudGl0eSBm b3IgdGhlIHJvb3Qgb2YgdHJ1c3QuICBUaGUgbWVhc3VyZW1lbnQgbG9ncyBjb250YWluIHRoZSBh bGxlZ2VkIHByb2R1Y3QgbmFtZSBhbmQgdmVyc2lvbiBudW1iZXIgZm9yIHRoZSBzb2Z0d2FyZSBp bnN0YWxsZWQgb24gdGhlIGJveC4gIFVzZSB0aGUgdmVuZG9yIElEIHRvIG5hcnJvdyB0aGUgc2Nv cGUgdG8gc3BlY2lmaWMgdmVuZG9y4oCZcyBwcm9kdWN0IGFuZCB2ZXJzaW9uIHNwYWNlLCBhbmQg ZmluZCB0aGUgUklNIHRoYXQgbWF0Y2hlcy4gIFRoZW4gY2hlY2sgaWYgdGhlIGhhc2hlcyBsaW5l IHVwOyBpZiBzbywgeW914oCZcmUgZ29vZCwgaWYgbm90LCBlaXRoZXIgdGhlIGNsYWltIG9mIHdo YXQgc29mdHdhcmUgaXMgcHJlc2VudCB3YXMgaW5jb3JyZWN0LCBvciBzb21ldGhpbmcgZ290IGhh Y2tlZC4NCiAgU2VlbXMgbGlrZSBhIHZlcmlmaWVyIGNvdWxkIGZvbGxvdyB0aGlzIHNhbWUgbW9k ZWwgdGhyb3VnaCB0aGUgZW50aXJlIGNoYWluIG9mIHRydXN0LCBldmVuIHRocm91Z2ggbXVsdGlw bGUgdmVuZG9ycywgYXMgbG9uZyBhcyB0aGVyZSBhcmUgbm8gZ2FwcyBpbiB0aGUgY2hhaW4uDQog IEkga25vdyBFQVQgbmVlZHMgdG8gd29yayBpbiBhIGxlc3MtY29uc3RyYWluZWQgZW52aXJvbm1l bnQsIGJ1dCBsZXQgbWUga25vdyBpZiB5b3UgdGhpbmsgd2XigJlyZSBvdmVyc2ltcGxpZnlpbmcg dGhpcyBvbiBSSVYuDQoNCiAgVGhhbmtzDQovZ3V5DQoNCg0KDQpKdW5pcGVyIEJ1c2luZXNzIFVz ZSBPbmx5DQpGcm9tOiBSQVRTIDxyYXRzLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnJhdHMtYm91 bmNlc0BpZXRmLm9yZz4+IE9uIEJlaGFsZiBPZiBMYXVyZW5jZSBMdW5kYmxhZGUNClNlbnQ6IFR1 ZXNkYXksIEFwcmlsIDcsIDIwMjAgMzoxMyBQTQ0KVG86IFRob21hcyBGb3NzYXRpIDxUaG9tYXMu Rm9zc2F0aUBhcm0uY29tPG1haWx0bzpUaG9tYXMuRm9zc2F0aUBhcm0uY29tPj4NCkNjOiByYXRz QGlldGYub3JnPG1haWx0bzpyYXRzQGlldGYub3JnPjsgTmVkIFNtaXRoIDxuZWQuc21pdGhAaW50 ZWwuY29tPG1haWx0bzpuZWQuc21pdGhAaW50ZWwuY29tPj4NClN1YmplY3Q6IFJlOiBbUmF0c10g RW5kb3JzZW1lbnQgSUQgYW5kIHZlcmlmaWNhdGlvbiBrZXkgKHdhcyBQcm9jZXNzaW5nIEVuZG9y c2VtZW50cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzKQ0KDQpbRXh0ZXJuYWwgRW1haWwuIEJl IGNhdXRpb3VzIG9mIGNvbnRlbnRdDQoNClRoaXMgaXMgYSByZXBseSB0byBib3RoIFRob21hcyBh bmQgTmVk4oCZcyBtZXNzYWdlIG9uIGRlYnVnIGluIHRoZSByZWxhdGVkIHRocmVhdC4NCg0KTXkg aW5jbGluYXRpb24gaXMgdG8gYXNzb2NpYXRlIGVuZG9yc2VtZW50cyB3aXRoIHRpbWUtaW52YXJp YW50IGNoYXJhY3RlcmlzdGljcyBvZiB0aGUgZGV2aWNlLiBBdCB0aGUgbW9tZW50IHRoaXMgZG9l c27igJl0IHNlZW0gbGlrZSB0aGUgb25seSB3YXkgdG8gZG8gaXQsIGJ1dCBpdCBzZWVtcyBsaWtl IGEgZ29vZCB3YXkuIFRoaW5ncyB0aGF0IGFyZSBub3QgdGltZSBpbnZhcmlhbnQgYXJlIHBvbGlj eSwgay1nLXYgb3Igc3VjaC4NCg0KRW5kb3JzZW1lbnQNClN5c3RlbSBhcmNoaXRlY3R1cmUg4oCU IERvZXMgdGhlIEF0dGVzdGVyIHVzZSBhIFRFRSBvciBhIFRQTSBvciBtYXliZSBpdCBpcyBzaW1w bGUgc3lzdGVtIHdpdGgganVzdCBhIHNpbXBsZSBDUFUsIGJ1dCBpdCBpcyBlbmNhc2VkIGluIHRp dGFuaXVtLiBJcyBkZWZlbnNlIGFnYWluc3QgY2hpcCBpbnZhc2l2ZSBhdHRhY2tzIGNvbnNpZGVy ZWQ/IERvIGtleXMgYmVjb21lIGluYWNjZXNzaWJsZSB3aGVuIGRlYnVnIGlzIGVuYWJsZWQuDQoN CkRldmVsb3BtZW50IHByb2Nlc3Mg4oCUIElzIHRoZXJlIGEgc3BlY2lhbCBzZWN1cml0eS1vcmll bnRlZCB0ZWFtPyBEb2VzIHRoZSB0ZWFtIGhhdmUgYSBjb2RlIHJldmlldyBwb2xpY3k/IElzIHRo ZXJlIGEgYnVnIGJvdW50eT8gQXJlIHRoZSBkZXNrdG9wcyBhbmQgSVQgc3lzdGVtcyB1c2VkIGZv ciBIVyBhbmQgU1cgZGV2ZWxvcG1lbnQgaXNvbGF0ZWQ/DQoNCk1hbnVmYWN0dXJpbmcg4oCUIEFy ZSB0aGUgZmFjdG9yaWVzIHNlY3VyZWQgaW4gYSBzcGVjaWFsIHdheT8gSXMgdGhlIGF0dGVzdGF0 aW9uIGtleSBwcm92aXNpb25pbmcgc3lzdGVtIGhhcmRlbmVkIGluIHNvbWUgd2F5IChlLmcuLCB1 c2VzIEhTTXMpLg0KDQpDZXJ0aWZpY2F0aW9ucyDigJQgVGhlc2UgdGFrZSBhIGxvbmcgdGltZSB0 byBhY2hpZXZlIGFuZCB3aWxsIHVzdWFsbHkgcmVxdWlyZSBzb21lIG9mIHRoZSBhYm92ZS4NCg0K TXkgdGhpbmtpbmcgZm9yIEVBVCB3YXMgdGhhdCB5b3Ugb25seSBwdXQgYXR0ZXN0YXRpb24ga2V5 cyBpbnRvIGRldmljZXMgdGhhdCBtZWV0IHNvbWUgY3JpdGVyaWEgbGlrZSBzb21lIG9mIHRoZSBh Ym92ZS4gU2luY2UgdGhlcmUgaXMgb2Z0ZW4gbm8gd2F5IHRvIHJlY292ZXIgZnJvbSBhIGNvbXBy b21pc2VkIGF0dGVzdGF0aW9uIGtleSBiZWNhdXNlIG5vIGtleSBtb3JlIHNlY3VyZSB0aGFuIGl0 LCB5b3Uga2luZCBvZiBoYXZlIHRvIGhhdmUgYWxsIHRoYXQuDQoNClNpbmNlIHRoZXNlIGRvbuKA mXQgY2hhbmdlIG11Y2ggb3ZlciB0aW1lLCB0aGUgZW5kb3JzZW1lbnQgd291bGRu4oCZdCBjaGFu Z2UuICBUaGV5IGNvdWxkIGV2ZW4gc3BhbiBzZXZlcmFsIG1vZGVscyBhbmQgdmFyeWluZyBIVy4N Cg0KUG9saWN5LCBLLUctViwgb3RoZXINClNXIFZlcnNpb25zIOKAlCBBcyBsb25nIGFzIHRoZSBT VyBmb2xsb3dzIGEgZGV2ZWxvcG1lbnQgcHJvY2VzcyBsaWtlIHRoYXQgYWJvdmUsIGl0IGRvZXNu 4oCZdCBoYXZlIHRvIGJlIGluY2x1ZGVkIGluIHRoZSBlbmRvcnNlbWVudC4gT2YgY291cnNlIHRo ZSBzbWFsbGVyIHRoZSBTVyBhbmQgdGhlIGJldHRlciB0aGUgcHJvY2VzcywgdGhlIG1vcmUgaXQg aXMgdHJ1ZSAoYW5kIHZpY2UgdmVyc2EpLg0KDQpCbGFja2xpc3RzIOKAlCBUaGVzZSBtaWdodCBi ZSBzcGVjaWZpYyB0byBVRUlEcywgdmVyc2lvbnMgb2YgU1csIGRlcGxveW1lbnRzIGEgcGFydGlj dWxhciBPRU0gb3Igc3VjaA0KDQpEZWJ1ZyBzdGF0dXMg4oCUIE1vc3Qgb2YgdGhlIGRlYnVnIHN0 YXR1cyB2YWx1ZXMgY2FuIHZhcnkgb24gYSBkYXktZGF5IGJhc2lzDQoNCk9FTSBtb2RlbCDigJQg SWYgdGhlIGF0dGVzdGF0aW9uIGlzIGltcGxlbWVudGVkIGJ5IGEgY2hpcCB2ZW5kb3IgYW5kIHRo ZSBlbmRvcnNlbWVudCBpcyBmb3IgdGhlIGNoaXAsIHRoZW4gdGhlIE9FTSBtb2RlbCB3aWxsIHZh cnkgd2lkZWx5Lg0KDQpOb25lIG9mIHRoZXNlIGNhbiBiZSBjcml0ZXJpYSBhcyB0byB3aGV0aGVy IGFuIGF0dGVzdGF0aW9uIGtleSBpcyBwdXQgaW50byBhIGRldmljZSBvciBub3QgYXMgdGhleSBh cmUgbm90IGtub3duIGF0IG1hbnVmYWN0dXJpbmcgdGltZSBhbmQvb3IgbXVzdCBiZSBhbGxvd2Vk IHRvIHZhcnkgd2lkZWx5IGFmdGVyIG1hbnVmYWN0dXJpbmcuDQoNCg0KSSB0aGluayB3aGF0IEni gJl2ZSBkZXNjcmliZWQgYWJvdmUgbGluZXMgdXAgcHJldHR5IHdlbGwgZm9yIGEgVFBNLiBUaGUg c3lzdGVtIGFyY2hpdGVjdHVyZSBpcyBtb3N0bHkgc2V0IGJ5IHRoZSBUQ0cuIEhXIFRQTXMgYXJl IGFsbW9zdCBhbHdheXMgY2VydGlmaWVkLiBUaGV5IGFyZSBpbmRlcGVuZGVudCBvZiBPRU0gbW9k ZWwuIEl0IGFsc28gbGluZXMgdXAgcmVhc29uYWJseSB3ZWxsIHdpdGggc2VjdXJlIGVsZW1lbnRz IGFuZCBjYW4gbGluZSB1cCB3aXRoIFRFReKAmXMuDQoNClRoZSBjcnV4IG9mIGVuZG9yc2VtZW50 IHRvIG1lIGlzIHRoZSBzZWN1cml0eSBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGF0dGVzdGVyIHRo YXQgcHJvdGVjdCB0aGUgYXR0ZXN0YXRpb24ga2V5IGJlY2F1c2UgdGhlcmUgaXMgZ2VuZXJhbGx5 IG5vIHJlY292ZXJ5IGZyb20gYSBjb21wcm9taXNlZCBhdHRlc3RhdGlvbiBrZXkuIEl0IHNldHMg dGhlIGJhc2VsaW5lIHJpc2sgb2YgdGhlIEhXIGFuZCBTVyBvZiB0aGUgZGV2aWNlLg0KDQoNCk9u IG9uZSBleHRyZW1lIGlzIGEgc2VwYXJhdGUgZW5kb3JzZW1lbnQgZm9yIGV2ZXJ5IGRldmljZSAo 4oCcbWljcm8gZW5kb3JzZW1lbnQiPyksIHdoaWNoIGlzIHdoYXQgSSB0aGluayBUaG9tYXMgYW5k IEFSTSBQU0EgYXJlIHRlbmRpbmcgdG93YXJkcy4gVGhlIG90aGVyIGV4dHJlbWUgaXMgb25lIGVu ZG9yc2VtZW50IGZvciBhIHByb2R1Y3QgbGluZSAo4oCcbWFjcm8gZW5kb3JzZW1lbnQiPyksLCBz YXkgYSBwcm9kdWN0IGxpbmUgb2YgVFBNcy4gVGhlbiBpdOKAmXMgbW9yZSBsaWtlIHRoZSBkYXRh IHNoZWV0IGZvciB0aGUgcHJvZHVjdC4NCg0KVGhlbiB0aGVyZeKAmXMgZGlmZmVyZW50IHdheXMg dG8gZmFuIHRoaXMgb3V0IHRvIHRoZSBkaWZmZXJlbnQga2V5IC8gc2lnbmluZyBzY2hlbWVzIChw ZXItZGV2aWNlIGtleSwgZ3JvdXAga2V5LCBFQ0RBQSwgWC41MDkpLiBGb3IgZXhhbXBsZSBhIG1h Y3JvLWVuZG9yc2VtZW50IGNvdWxkIGluY2x1ZGUgdGhlIHJvb3Qgb2YgYW4gWC41MDkgaGllcmFy Y2h5IGFuZCB0aGUgaW5kaXZpZHVhbCBkZXZpY2VzIChvciBncm91cHMgb2YgZGV2aWNlcykgd291 bGQgaGF2ZSBpbmRpdmlkdWFsIGtleXMgdGhhdCBjaGFpbiB1cC4gV2l0aCBhIG1pY3JvLWVuZG9y c2VtZW50IHRoZSBwZXItZGV2aWNlIHB1YmxpYyBrZXkgY291bGQgYmUgcGVyIGVuZG9yc2VtZW50 Lg0KDQoNClRoZSBtb3N0IGltcG9ydGFudCB0aGluZyBhYm91dCB0aGUgZW5kb3JzZW1lbnQgc2Vl bXMgdG8gbWUgaXMgdGhlIGNoYXJhY3Rlcml6YXRpb24gb2YgaG93IHRoZSBhdHRlc3RhdGlvbiBr ZXkgaXMgcHJvdGVjdGVkLg0KDQpMTA0KDQoNCg0KT24gQXByIDcsIDIwMjAsIGF0IDc6MzYgQU0s IFRob21hcyBGb3NzYXRpIDxUaG9tYXMuRm9zc2F0aUBhcm0uY29tPG1haWx0bzpUaG9tYXMuRm9z c2F0aUBhcm0uY29tPj4gd3JvdGU6DQoNCkhpIExhdXJlbmNlLA0KDQpUaGFua3MgZm9yIGJyaW5n aW5nIHRoaXMgdXAuICBBIGZldyB0aG91Z2h0cyBiZWxvdy4NCg0KT24gMDMvMDQvMjAyMCwgMjA6 MzcsICJSQVRTIG9uIGJlaGFsZiBvZiBMYXVyZW5jZSBMdW5kYmxhZGUiDQo8cmF0cy1ib3VuY2Vz QGlldGYub3JnPG1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBsZ2xA aXNsYW5kLXJlc29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbT4+IHdyb3RlOg0K U28gaG93IGRvZXMgYSBWZXJpZmllciBmaW5kIHRoZSBhcHBsaWNhYmxlIGVuZG9yc2VtZW50IGZv ciBFdmlkZW5jZSBpdA0Kd2lzaGVzIHRvIHZlcmlmeSBhbmQga25vdyB0aGF0IGlzIHJlYWxseSB0 aGUgcmlnaHQgZW5kb3JzZW1lbnQ/DQoNClNlZW1zIGxpa2UgdGhlIEV2aWRlbmNlIG5lZWRzIHNv bWUgc29ydCBvZiBhbiBlbmRvcnNlbWVudCBsb2NhdG9yIElELg0KVGhpcyBjb3VsZCBiZSBhIFVS TCBvciBhIEdVSUQuIEVBVCBjdXJyZW50bHkgaGFzIHRoZSBvcmlnaW5hdGlvbiBjbGFpbQ0KdG8g dHJ5IHRvIHNvbHZlIHRoaXMsIGJ1dCBpdCBpcyBoYWxmLWJha2VkLiBJdCBuZWVkcyB0byBnZXQg Zml4ZWQuIEnigJltDQpmaXNoaW5nIGZvciBjb21tZW50cyBoZXJlIG9uIHdoYXQgaXQgc2hvdWxk IGJlIGxpa2UuDQoNClByZXR0eSBzdXJlIHRoZSBFbmRvcnNlbWVudCBuZWVkcyB0byBpbmNsdWRl IG9yIHJlZmVyZW5jZSB0aGUgcHVibGljDQprZXkgdGhhdCBpcyB1c2VkIHRvIHZlcmlmeSB0aGUg c2lnbmF0dXJlLiBXaXRob3V0IHRoYXQsIHRoZSBBdHRlc3Rlcg0KY291bGQgbGllIGFuZCBwaWNr IGFueSBvbGQgRW5kb3JzZW1lbnQgdGhhdCBpdCB3aXNoZXMuIFRoZXJlIG5lZWRzIHRvDQpiZSBz b21lIGJpbmRpbmcgYmV0d2VlbiBpdGVtcyBpbiB0aGUgZW5kb3JzZW1lbnQgKEUwLCBFMSzigKYp IGFuZCB0aGUNCnZlcmlmaWNhdGlvbiBrZXkuIFRoYXQgY291bGQgYmUgaW4gdGhlIGZvcm0gb2Yg YSBzaWduZWQgdG9rZW4gb3INCmNlcnRpZmljYXRlLCBidXQgZG9lc27igJl0IGhhdmUgdG8gYmUu IFByZXR0eSBzdXJlIHRoaXMgbmVlZHMgdG8gYmUNCmRpc2N1c3NlZCBpbiB0aGUgYXJjaGl0ZWN0 dXJlIGRvYy4NCg0KVGhlcmUncyBhIGZldyBzY2VuYXJpb3M6DQotIE9uZSBlbmRvcnNlbWVudCBh cHBsaWVzIHRvIGxvdHMgb2YgZGV2aWNlcyBpbiB0aGUgc2FtZSBjbGFzcywgYnV0DQogZWFjaCBo YXMgdGhlaXIgb3duIGF0dGVzdGF0aW9uIGtleS4NCi0gLSBQcm9iYWJseSBFQ0RBQSBmaXRzIGlu IGhlcmUNCi0gLSBPbmUgb3B0aW9uIGhlcmUgaXMgYW4gWDUwOSBoaWVyYXJjaHkNCi0gR3JvdXAg a2V5cyBhcmUgdXNlZCAoZm9yIHByaXZhY3kgcmVhc29ucyBvciBvdGhlcikgc28gdGhlcmUgaXMg YQ0KIG9uZS1vbmUgY29ycmVsYXRpb24gd2l0aCB0aGUgRW5kb3JzZW1lbnRzICh0aGUgR0VJRCBk aXNjdXNzaW9uKQ0KLSBHcm91cCBrZXlzIGFyZSB1c2VkLCBidXQgYWNyb3NzIGRldmljZXMgdGhh dCBoYXZlIGRpZmZlcmVudA0KIGVuZG9yc2VtZW50cyBzbyB0aGVyZeKAmXMgbm8gb25lLW9uZSBj b3JyZWxhdGlvbg0KDQpXaGlsZSB0aGUgbGFzdCBvbmUgc2VlbXMgb2RkIGFuZCB1bmxpa2VseSwg SSB0aGluayBpdCBjb3VsZCBvY2N1ciwNCmJlY2F1c2UgZnJvbSBhIGxvdCBvZiByZWFsIGV4cGVy aWVuY2UgdGhlIHNldCB1cCBvZiBhdHRlc3RhdGlvbiBrZXlzDQppcyB2ZXJ5IGlkaW9zeW5jcmF0 aWMuIEl0IGlzIHdpbGRseSBhZmZlY3RlZCBieSBtYW51ZmFjdHVyaW5nIGNvc3RzDQphbmQgaXNz dWVzIG9uIGFzc2VtYmx5IGxpbmVzLCBzdWIgY29udHJhY3RvciBzdHJ1Y3R1cmUsIGxvY2F0aW9u IG9mDQpzZWN1cmUgZmFjaWxpdGllcyBhbmQgYXBwcm9hY2hlcyB0byBtYWtpbmcgbW9uZXkgb24g aXQuIFRoZXkgYXJlIGxpa2UNCnNub3dmbGFrZXMsIGVhY2ggb25lIGlzIGRpZmZlcmVudC4gIFNv IG1heWJlIGVuZG9yc2VtZW50IGxvY2F0b3IgSUQNCmFuZCBrZXkgSUQgYXJlIG5vdCB0aGUgc2Ft ZSwgYnV0IHRoZXkgY2FuIGJlIGluIHNvbWUgdXNlIGNhc2VzPw0KDQpJIGFtIGFsc28gdGVtcHRl ZCB0byBlbmNvdXJhZ2UgdGhlIHBsYWNlbWVudCBvZiB0aGUgZW5kb3JzZW1lbnQNCmxvY2F0b3Ig SUQgaW4gdGhlIENPU0Ugb3IgSk9TRSBoZWFkZXIgcGFyYW1ldGVycyBzbyB5b3UgZG9u4oCZdCBo YXZlIHRvDQpwYXJzZSB0aGUgdW52ZXJpZmllZCBib2R5IG9mIGNsYWltcyB0byBiZSBhYmxlIHRv IGZpbmQgdGhlIGtleQ0KbWF0ZXJpYWwgdG8gdmVyaWZ5IGl0Lg0KDQpUaG91Z2h0cz8NCg0KQSB0 d28gbGV2ZWwgbG9va3VwIGtleSwgbW9kZWwraW5zdGFuY2UsIHNlZW1zIHRvIGJlIHF1aXRlIGdl bmVyYWxseQ0KYXBwbGljYWJsZSBhcyBhbiBlbmRvcnNlbWVudCBsb2NhdG9yLiAgVGhlIG1vZGVs IHBhcnQgd291bGQgZ2V0IHlvdSB0bw0KdGhlIHNoYXJlZCBkYXRhIChlLmcuLCBjZXJ0aWZpY2F0 aW9uLCBtZWFzdXJlZCBib290IEtHVnMsIGV0Yy4pLCB3aGlsZQ0KdGhlIGluc3RhbmNlIHBhcnQg Y2FuIGJlIHVzZWQgdG8gcmV0cmlldmUgZGV2aWNlLXNwZWNpZmljIHN0YXRlOg0KdmVyaWZpY2F0 aW9uIGtleShzKSBhcyB3ZWxsIGFzIG90aGVyIG1ldGFkYXRhLCBlLmcuLCBpZiBzb21lIGdlYXIg aXMNCmJsYWNrbGlzdGVkLiAgSW4gUFNBIHdlIGhhdmUgc29tZXRoaW5nIHF1aXRlICh0aG91Z2gg bm90IGVudGlyZWx5KQ0Kc2ltaWxhciB3aXRoIGltcGxlbWVudGF0aW9uIGFuZCBpbnN0YW5jZSBJ RHMgWzFdIFsyXS4NCg0KKENvbnRleHQtc3dpdGNoaW5nIGZvciBhIHNlY29uZCBvbiBvdXIgcHJl dmlvdXMgVUVJRC9HRUlEIGRpc2N1c3Npb246IEkNCmd1ZXNzIHdlIG1pZ2h0IG1vZGVsIGFuIGlu c3RhbmNlIGFzIGFuIGFub255bWl0eSBzZXQsIGFuZCB0aGVyZWZvcmUNCnRyZWF0IEVVSURzIGFz IHRoZSBzcGVjaWFsIGNhc2UgR0VJRHMgd2l0aCBjYXJkaW5hbGl0eSA9PSAxPykNCg0KRm9yIHRo ZSBzYWtlIG9mIGJ1aWxkaW5nIGEgc2hhcmVkIGFuZCByZXVzYWJsZSB2b2NhYnVsYXJ5LCBJJ2Qg cHJlZmVyDQprZWVwaW5nIG1vZGVsIGFuZCBpbnN0YW5jZSBpZGVudGlmaWVycyBhcyBzZXBhcmF0 ZSBjbGFpbXMgcmF0aGVyIHRoYW4NCmhhdmluZyBhbiBvcGFxdWUgZW5kb3JzZW1lbnQgSUQgY2xh aW0gdGhhdCBjbHVtcHMgdG9nZXRoZXIgdGhvc2UgYW5kDQpwb3NzaWJseSBvdGhlciBzdHVmZiBp biBhIHVzZS1jYXNlIHNwZWNpZmljIGZhc2hpb24uICBGb3IgdGhlIHNhbWUNCnJlYXNvbiBJIHdv dWxkIG5vdCBvdmVycmlkZSBrZXkgSUQgd2l0aCBpbnN0YW5jZSBJRCBzZW1hbnRpY3MuDQoNCmNo ZWVycywgdGhhbmtzIQ0KDQpbMV0gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtdHNjaG9m ZW5pZy1yYXRzLXBzYS10b2tlbi0wNS5odG1sI25hbWUtaW1wbGVtZW50YXRpb24taWQ8aHR0cHM6 Ly91cmxkZWZlbnNlLmNvbS92My9fX2h0dHBzOi93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtdHNjaG9m ZW5pZy1yYXRzLXBzYS10b2tlbi0wNS5odG1sKm5hbWUtaW1wbGVtZW50YXRpb24taWRfXztJdyEh TkV0NnlNYU8tZ2shUlE4Z3lPM1JveS1kSUVkNlNfa2E0NWxGRUdtMUdJSDJsdF9EMU5hZm1hUVdw ampzT3g2Mjl6aHUtTG1VaTFNTU1XcyQ+DQpbMl0gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaWQvZHJh ZnQtdHNjaG9mZW5pZy1yYXRzLXBzYS10b2tlbi0wNS5odG1sI25hbWUtaW5zdGFuY2UtaWQ8aHR0 cHM6Ly91cmxkZWZlbnNlLmNvbS92My9fX2h0dHBzOi93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtdHNj aG9mZW5pZy1yYXRzLXBzYS10b2tlbi0wNS5odG1sKm5hbWUtaW5zdGFuY2UtaWRfXztJdyEhTkV0 NnlNYU8tZ2shUlE4Z3lPM1JveS1kSUVkNlNfa2E0NWxGRUdtMUdJSDJsdF9EMU5hZm1hUVdwampz T3g2Mjl6aHUtTG1VUWhTemc0RSQ+DQoNCg0KDQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVu dHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5k IG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNp cGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRp c2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBw dXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBU aGFuayB5b3UuDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KUkFUUyBtYWlsaW5nIGxpc3QNClJBVFNAaWV0Zi5vcmc8bWFpbHRvOlJBVFNAaWV0Zi5vcmc+ DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3JhdHM8aHR0cHM6Ly91cmxk ZWZlbnNlLmNvbS92My9fX2h0dHBzOi93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRz X187ISFORXQ2eU1hTy1nayFSUThneU8zUm95LWRJRWQ2U19rYTQ1bEZFR20xR0lIMmx0X0QxTmFm bWFRV3BqanNPeDYyOXpodS1MbVV6UVRQVUFZJD4NCg0K --_000_0026A707C6014F74932A53F3B1F24426ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <474F3106538BB14D96745027FB364B99@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6eD0idXJuOnNjaGVtYXMtbWljcm9z b2Z0LWNvbTpvZmZpY2U6ZXhjZWwiIHhtbG5zOm09Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5j b20vb2ZmaWNlLzIwMDQvMTIvb21tbCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1o dG1sNDAiPg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9 InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRl bnQ9Ik1pY3Jvc29mdCBXb3JkIDE1IChmaWx0ZXJlZCBtZWRpdW0pIj4NCjxzdHlsZT48IS0tDQov KiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkhlbHZldGlj YTsNCglwYW5vc2UtMTowIDAgMCAwIDAgMCAwIDAgMCAwO30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Q291cmllcjsNCglwYW5vc2UtMToyIDAgNSAwIDAgMCAwIDAgMCAwO30NCkBmb250LWZh Y2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQg NiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkRlbmdYaWFuOw0KCXBhbm9zZS0x OjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAyIDYgMyA1 IDQgNSAyIDMgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQERlbmdYaWFuIjsNCglw YW5vc2UtMToyIDEgNiAwIDMgMSAxIDEgMSAxO30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpw Lk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJ bWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnNwYW4uYXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxl LWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseTpDb3VyaWVyOw0KCWNvbG9yOndpbmRvd3RleHQ7 DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIg dmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXIiPiZndDs8L3NwYW4+IEZp cnN0IHlvdSBuZWVkIHRoZSBlbmRvcnNlbWVudCBmb3IgdGhlIFRQTSB0aGF0IGlzIHNlcnZpbmcg YXMgdGhlIGF0dGVzdGVyLiBUaGlzIGVuZG9yc2VtZW50IHdvdWxkIGNvbWUgZnJvbSB0aGUgVFBN IHZlbmRvci4gSSBhc3N1bWUgdGhhdCBpcyBmYWlybHkgd2VsbCB1bmRlcnN0b29kIGFuZCBpbiBw cmFjdGljZSB0b2RheSB0aHJvdWdoDQogVFBNIGFyY2hpdGVjdHVyZSBhbmQgY29udmVudGlvbnMg YWxyZWFkeSBpbiBwbGFjZSB3aXRoIHRoaW5ncyBsaWtlIElEZXZJRC4gKE1heWJlIHlvdSBhbGwg a25vdyBpdCwgYnV0IEkgZG9u4oCZdCBrbm93IGhvdyB0aGlzIHdvcmtzLiBJIHdvdWxkIGJlIGlu dGVyZXN0ZWQgaW4gcmVmZXJlbmNlcyBhbmQvb3IgYSBkZXNjcmlwdGlvbiBvZiBpdCkuPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 Q291cmllciI+QWxzbyBlbmRvcnNlbWVudCBvZiBrZXkgdXNlZCBmb3IgYXR0ZXN0YXRpb24g4oCT IHRoZQ0KPGEgaHJlZj0iaHR0cHM6Ly90cnVzdGVkY29tcHV0aW5nZ3JvdXAub3JnL3dwLWNvbnRl bnQvdXBsb2Fkcy9JV0ctQUlLLUNNQy1lbnJvbGxtZW50LUZBUS5wZGYiPg0KQXR0ZXN0YXRpb24g SWRlbnRpdHkga2V5PC9hPi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q291cmllciI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OkNvdXJpZXIiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4mZ3Q7PC9zcGFuPiBNeSBmaXJz dCB0aG91Z2ggaXMgc29tZSBzb3J0IG9mIFVSSSwgbWF5YmUgcmVsYXRlZCB0byBTV0lELCB0aGF0 IGlzIHBhcnQgb2YgdGhlIG1lYXN1cmVtZW50cyBpbiB0aGUgRXZpZGVuY2Ugc2VudCB0byB0aGUg VmVyaWZpZXIuIEl0IGRvZXNu4oCZdCBoYXZlIHRvIGJlIG1hbmRhdG9yeSBvciB1c2VkIGJ5IGV2 ZXJ5b25lLCBidXQgaXQgc2VlbXMNCiBsaWtlbHkgdG8gYmVuZWZpdCBhdCBsZWFzdCBzb21lLjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OkNvdXJpZXIiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj4mIzQzOzEgdG8gdGhlIFVS SS4gQSBwcm9ncmFtbWF0aWMgYW5kIHVuaWZvcm0gd2F5IHRvIHF1ZXJ5IHRoZSBwdWJsaXNoZWQg UklNIGZvciBhbGwgdGhlIGFydGlmYWN0cyB3b3VsZCBiZSB1c2VmdWwsIEkgYXNzdW1lIHRoaXMg Y2Fubm90IGJlIHJlcG9ydGVkIGJ5IHRoZSBkZXZpY2UgaXRzZWxmIGFzIGl0IGNhbm5vdCBiZSB0 cnVzdGVkLiBJbiBhZGRpdGlvbg0KIHRvIE9FTUlELCBIVyBJRC92ZXJzaW9uLCBTV0lEIOKAkyBB biBlYXN5IHdheSB0byBsb29rIHVwIFJJTSAtIHZlbmRvciBzcGVjaWZpYyBkYXRhYmFzZSB0byBx dWVyeSAtIEROUyBSUiBob3N0ZWQgYnkgdGhlIHZlbmRvcnMgcGVyaGFwcz88bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 Q291cmllciI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXIiPkhlcmXigJlzIGFuIGV4YW1wbGUg b2YgdGhlIFJJTSBwcm9kdWNlZCBieSBhIE5ldHdvcmsgZGV2aWNlIGFuZCBPUyB2ZW5kb3I6PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6 Ly93d3cuY2lzY28uY29tL2MvZW4vdXMvYWJvdXQvdHJ1c3QtY2VudGVyL2Rvd25sb2Fkcy5odG1s Ij5odHRwczovL3d3dy5jaXNjby5jb20vYy9lbi91cy9hYm91dC90cnVzdC1jZW50ZXIvZG93bmxv YWRzLmh0bWw8L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6Q291cmllciI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXIiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpDb3VyaWVyIj5UaGFua3MsPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXIiPlNo d2V0aGE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6Q291cmllciI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3Bh ZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPlJBVFMgJmx0O3JhdHMtYm91 bmNlc0BpZXRmLm9yZyZndDsgb24gYmVoYWxmIG9mIExhdXJlbmNlIEx1bmRibGFkZSAmbHQ7bGds QGlzbGFuZC1yZXNvcnQuY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5Nb25kYXksIEFwcmlsIDEz LCAyMDIwIGF0IDEyOjI2IEFNPGJyPg0KPGI+VG86IDwvYj5HdXkgRmVkb3Jrb3cgJmx0O2dmZWRv cmtvd0BqdW5pcGVyLm5ldCZndDs8YnI+DQo8Yj5DYzogPC9iPiZxdW90O3JhdHNAaWV0Zi5vcmcm cXVvdDsgJmx0O3JhdHNAaWV0Zi5vcmcmZ3Q7LCBOZWQgU21pdGggJmx0O25lZC5zbWl0aEBpbnRl bC5jb20mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbUmF0c10gRW5kb3JzZW1lbnQgSUQg YW5kIHZlcmlmaWNhdGlvbiBrZXkgKHdhcyBQcm9jZXNzaW5nIEVuZG9yc2VtZW50cyBhbmQgRXZp ZGVuY2UgaW50byBSZXN1bHRzKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5UcnlpbmcgYWdhaW4sIGFmdGVyIHJlIHJlYWRpbmcgeW91ciBxdWVz dGlvbiBhIGZldyB0aW1lcyAoYW5kIGEgZmV3IG5vdC1zZW50IHJlcGxpZXMpLg0KPG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GaXJzdCB5b3UgbmVlZCB0aGUg ZW5kb3JzZW1lbnQgZm9yIHRoZSBUUE0gdGhhdCBpcyBzZXJ2aW5nIGFzIHRoZSBhdHRlc3Rlci4g VGhpcyBlbmRvcnNlbWVudCB3b3VsZCBjb21lIGZyb20gdGhlIFRQTSB2ZW5kb3IuIEkgYXNzdW1l IHRoYXQgaXMgZmFpcmx5IHdlbGwgdW5kZXJzdG9vZCBhbmQgaW4gcHJhY3RpY2UgdG9kYXkgdGhy b3VnaCBUUE0gYXJjaGl0ZWN0dXJlIGFuZCBjb252ZW50aW9ucyBhbHJlYWR5DQogaW4gcGxhY2Ug d2l0aCB0aGluZ3MgbGlrZSBJRGV2SUQuIChNYXliZSB5b3UgYWxsIGtub3cgaXQsIGJ1dCBJIGRv buKAmXQga25vdyBob3cgdGhpcyB3b3Jrcy4gSSB3b3VsZCBiZSBpbnRlcmVzdGVkIGluIHJlZmVy ZW5jZXMgYW5kL29yIGEgZGVzY3JpcHRpb24gb2YgaXQpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5OZXh0IHlvdSBuZWVkIHRvIGlkZW50aWZ5 IHRoZSBSSU0uIFRoYXQgbWlnaHQgY29tZSBmcm9tIHRoZSBPUyBWZW5kb3Igb3IgZnJvbSB0aGUg ZGV2aWNlIHZlbmRvciBvciBldmVuIGEgdGhpcmQgcGFydHksIG5vbmUgb2Ygd2hpY2ggYXJlIHRo ZSBUUE0gdmVuZG9yLiBGb3IgZXhhbXBsZSwgd2l0aCBBbmRyb2lkLCBHb29nbGUgcHJvZHVjZXMg dGhlIE9TLCBidXQgaXQgaXMgb3BlbiBzb3VyY2UgYW5kIHRoZSBwaG9uZQ0KICh0aGUgZGV2aWNl KSB2ZW5kb3IgY2FuIG1vZGlmeSBpdCwgc28gdGhlIFJJTSB3b3VsZCBwcm9iYWJseSBjb21lIGZy b20gdGhlIHBob25lL2RldmljZSB2ZW5kb3IuIEl0IHNlZW1zIHBvc3NpYmxlIHRvIGhhdmUgc3Bs aXQgUklNcyB3aGVyZSBwYXJ0IGNvbWVzIGZyb20gdGhlIHRoZSBPUyB2ZW5kb3IgYW5kIHBhcnQg Y29tZXMgZnJvbSB0aGUgZGV2aWNlIHZlbmRvci48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2VlbXMgbGlrZSBPUy9kZXZpY2UvM3JkLXBhcnR5 IFZlbmRvciBJRHMsIHByb2R1Y3QgbmFtZXMgYW5kIHByb2R1Y3QgdmVyc2lvbnMgYXJlIHZlcnkg bm9uLXVuaWZvcm0uIFlvdSBjb3VsZG7igJl0IHdyaXRlIG11Y2ggZ2VuZXJpYyBWZXJpZmllciBj b2RlIHRvIHdvcmsgd2l0aCB0aGVtIGFzIHRoZXkgYXJlIHRvZGF5LiBUaGUgYmVzdCBhdHRlbXB0 cyBhdCBtYWtpbmcgdGhlc2UgZ2VuZXJpYyBJIGtub3cgb2Ygc2VlbQ0KIEVBVOKAmXMgSUVFRS1i YXNlZCBPRU1JRCwgYW5kIFBTQeKAmXMgRUFOLTEzIGJhc2VkIEhXIHZlcnNpb24sIGJ1dCBJIGRv buKAmXQgdGhpbmsgdGhlc2UgYXJlIGVub3VnaC4gTWF5YmUgdGhlcmUgaXMgc29tZXRoaW5nIGVs c2Ugb3V0IHRoZXJlLiBTV0lEIG9mIHNvbWUgc29ydD8mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFncmVlZCB0aGF0IHRo ZSBpZGVudGlmaWVyIG9mIHRoZSBSSU0gZG9lc27igJl0IGhhdmUgdG8gYmUgc2VjdXJlZCAvIGF0 dGVzdGVkLCBqdXN0IGxpa2Uga2V5IElE4oCZcyBkb27igJl0IGhhdmUgdG8gYmUuIElmIHRoZSBW ZXJpZmllciBnZXRzIHRoZSB3cm9uZyBvbmUsIHRoZSB2ZXJpZmljYXRpb24ganVzdCBmYWlscy48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5UaGlzIGlzIGNlcnRhaW5seSBub3QgYSBzb2x2ZWQgcHJvYmxlbSBpbiB0aGUgRUFUIHNw YWNlLiBNYXliZSB0aGVyZeKAmXMgYSBzb2x1dGlvbiBpbiBjb21tb24/IE15IGZpcnN0IHRob3Vn aCBpcyBzb21lIHNvcnQgb2YgVVJJLCBtYXliZSByZWxhdGVkIHRvIFNXSUQsIHRoYXQgaXMgcGFy dCBvZiB0aGUgbWVhc3VyZW1lbnRzIGluIHRoZSBFdmlkZW5jZSBzZW50IHRvIHRoZSBWZXJpZmll ci4gSXQgZG9lc27igJl0IGhhdmUNCiB0byBiZSBtYW5kYXRvcnkgb3IgdXNlZCBieSBldmVyeW9u ZSwgYnV0IGl0IHNlZW1zIGxpa2VseSB0byBiZW5lZml0IGF0IGxlYXN0IHNvbWUuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRvIGJlIGNsZWFy LCBJ4oCZbSB0aGlua2luZyB0aGF0IHRoZSBFbmRvcnNlbWVudCBvZiB0aGUgVFBNIEF0dGVzdGVy IGlzIHF1aXRlIHNlcGFyYXRlIGZyb20gdGhlIEVuZG9yc2VtZW50IHRoYXQgaXMgdGhlIFJJTS4g VGhleSBjb21lIGZyb20gY29tcGxldGVseSBkaWZmZXJlbnQgdmVuZG9ycy4gVGhlIFRQTSBFbmRv cnNlbWVudCBpcyBvZiBsaXR0bGUgdXNlIHRvIGlkZW50aWZ5IHRoZSBSSU0uPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkxMPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJy Pg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5P biBBcHIgOSwgMjAyMCwgYXQgNzozMSBBTSwgR3V5IEZlZG9ya293ICZsdDs8YSBocmVmPSJtYWls dG86Z2ZlZG9ya293QGp1bmlwZXIubmV0Ij5nZmVkb3Jrb3dAanVuaXBlci5uZXQ8L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIExh dXJlbmNlLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7IEkgdW5kZXJzdGFuZCB0aGF0IHRoZSBkaXNjdXNzaW9uIG9uIHRoZSB0b3BpYyBi ZWxvdyBtYWlubHkgcGVydGFpbnMgdG8gRUFULCBidXQgSeKAmWQgbGlrZSB0byBtYWtlIHN1cmUg d2XigJlyZSBub3QgbWlzc2luZyBzb21ldGhpbmcgb24gdGhlIFJJViBzaWRlLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7IEZvciBPUyBz b2Z0d2FyZSBpbWFnZSBpbnRlZ3JpdHkgdXNpbmcgYSBUUE0sIGl0IHNlZW1zIGxpa2UgZmluZGlu ZyB0aGUgcmlnaHQgbWFuaWZlc3Qgc2hvdWxkbuKAmXQgYmUgdGhhdCBoYXJk4oCmPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgVGhlIEF0 dGVzdGVyIG5lZWRzIHRvIGhhdmUgcHJlLXByb3Zpc2lvbmVkIGlkZW50aXR5IGFuZCBhdHRlc3Rh dGlvbiBrZXlzIGFzIG91dGxpbmVkIGluIHRoZSBSSVYgZHJhZnQuJm5ic3A7IFRoYXQgcHJvdmlk ZXMgdGhlIFZlcmlmaWVyIHdpdGggdGhlIHZlbmRvciBpZGVudGl0eSBmb3IgdGhlIHJvb3Qgb2Yg dHJ1c3QuJm5ic3A7IFRoZSBtZWFzdXJlbWVudCBsb2dzIGNvbnRhaW4gdGhlIGFsbGVnZWQgcHJv ZHVjdCBuYW1lDQogYW5kIHZlcnNpb24gbnVtYmVyIGZvciB0aGUgc29mdHdhcmUgaW5zdGFsbGVk IG9uIHRoZSBib3guJm5ic3A7IFVzZSB0aGUgdmVuZG9yIElEIHRvIG5hcnJvdyB0aGUgc2NvcGUg dG8gc3BlY2lmaWMgdmVuZG9y4oCZcyBwcm9kdWN0IGFuZCB2ZXJzaW9uIHNwYWNlLCBhbmQgZmlu ZCB0aGUgUklNIHRoYXQgbWF0Y2hlcy4mbmJzcDsgVGhlbiBjaGVjayBpZiB0aGUgaGFzaGVzIGxp bmUgdXA7IGlmIHNvLCB5b3XigJlyZSBnb29kLCBpZiBub3QsIGVpdGhlciB0aGUgY2xhaW0NCiBv ZiB3aGF0IHNvZnR3YXJlIGlzIHByZXNlbnQgd2FzIGluY29ycmVjdCwgb3Igc29tZXRoaW5nIGdv dCBoYWNrZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDsgU2VlbXMgbGlrZSBhIHZlcmlmaWVyIGNvdWxkIGZvbGxvdyB0aGlzIHNhbWUg bW9kZWwgdGhyb3VnaCB0aGUgZW50aXJlIGNoYWluIG9mIHRydXN0LCBldmVuIHRocm91Z2ggbXVs dGlwbGUgdmVuZG9ycywgYXMgbG9uZyBhcyB0aGVyZSBhcmUgbm8gZ2FwcyBpbiB0aGUgY2hhaW4u PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsgSSBrbm93IEVBVCBuZWVkcyB0byB3b3JrIGluIGEgbGVzcy1jb25zdHJhaW5lZCBlbnZpcm9u bWVudCwgYnV0IGxldCBtZSBrbm93IGlmIHlvdSB0aGluayB3ZeKAmXJlIG92ZXJzaW1wbGlmeWlu ZyB0aGlzIG9uIFJJVi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7IFRoYW5rczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+L2d1eTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBhbGlnbj0iY2VudGVyIiBzdHlsZT0idGV4dC1hbGlnbjpjZW50 ZXIiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQiPkp1bmlwZXIgQnVzaW5lc3MgVXNlIE9u bHk8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SQVRTICZsdDs8YSBocmVmPSJtYWls dG86cmF0cy1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5yYXRz LWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24gQmVoYWxmIE9mPHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5MYXVyZW5jZQ0KIEx1bmRibGFkZTxi cj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj5UdWVzZGF5LCBBcHJpbCA3LCAyMDIwIDM6MTMgUE08YnI+DQo8Yj5Ubzo8L2I+PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlRob21hcyBGb3Nz YXRpICZsdDs8YSBocmVmPSJtYWlsdG86VGhvbWFzLkZvc3NhdGlAYXJtLmNvbSI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+VGhvbWFzLkZvc3NhdGlAYXJtLmNvbTwvc3Bhbj48L2E+Jmd0Ozxi cj4NCjxiPkNjOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPnJhdHNAaWV0Zi5vcmc8L3NwYW4+PC9hPjsgTmVkIFNtaXRoICZsdDs8YSBocmVmPSJt YWlsdG86bmVkLnNtaXRoQGludGVsLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+bmVk LnNtaXRoQGludGVsLmNvbTwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW1JhdHNdIEVu ZG9yc2VtZW50IElEIGFuZCB2ZXJpZmljYXRpb24ga2V5ICh3YXMgUHJvY2Vzc2luZyBFbmRvcnNl bWVudHMgYW5kIEV2aWRlbmNlIGludG8gUmVzdWx0cyk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJsaW5l LWhlaWdodDoxMi4wcHQ7YmFja2dyb3VuZDojRkZFQjlDIj48Yj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrIj5bRXh0ZXJuYWwgRW1haWwuIEJlIGNhdXRpb3VzIG9mIGNvbnRlbnRdPC9zcGFuPjwv Yj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5UaGlzIGlzIGEgcmVwbHkgdG8gYm90aCBUaG9tYXMgYW5kIE5lZOKAmXMg bWVzc2FnZSBvbiBkZWJ1ZyBpbiB0aGUgcmVsYXRlZCB0aHJlYXQuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPk15IGluY2xpbmF0aW9uIGlzIHRvIGFzc29jaWF0ZSBlbmRvcnNlbWVudHMgd2l0 aCB0aW1lLWludmFyaWFudCBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGRldmljZS4gQXQgdGhlIG1v bWVudCB0aGlzIGRvZXNu4oCZdCBzZWVtIGxpa2UgdGhlIG9ubHkgd2F5IHRvIGRvIGl0LCBidXQg aXQgc2VlbXMgbGlrZSBhIGdvb2Qgd2F5LiBUaGluZ3MgdGhhdCBhcmUgbm90IHRpbWUgaW52YXJp YW50IGFyZSBwb2xpY3ksIGstZy12DQogb3Igc3VjaC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHU+RW5kb3JzZW1lbnQ8L3U+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5TeXN0ZW0gYXJjaGl0ZWN0dXJlIOKAlCBEb2VzIHRoZSBBdHRl c3RlciB1c2UgYSBURUUgb3IgYSBUUE0gb3IgbWF5YmUgaXQgaXMgc2ltcGxlIHN5c3RlbSB3aXRo IGp1c3QgYSBzaW1wbGUgQ1BVLCBidXQgaXQgaXMgZW5jYXNlZCBpbiB0aXRhbml1bS4gSXMgZGVm ZW5zZSBhZ2FpbnN0IGNoaXAgaW52YXNpdmUgYXR0YWNrcyBjb25zaWRlcmVkPyBEbyBrZXlzIGJl Y29tZSBpbmFjY2Vzc2libGUgd2hlbiBkZWJ1ZyBpcw0KIGVuYWJsZWQuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkRldmVsb3BtZW50IHByb2Nlc3Mg4oCUIElzIHRoZXJlIGEgc3BlY2lhbCBz ZWN1cml0eS1vcmllbnRlZCB0ZWFtPyBEb2VzIHRoZSB0ZWFtIGhhdmUgYSBjb2RlIHJldmlldyBw b2xpY3k/IElzIHRoZXJlIGEgYnVnIGJvdW50eT8gQXJlIHRoZSBkZXNrdG9wcyBhbmQgSVQgc3lz dGVtcyB1c2VkIGZvciBIVyBhbmQgU1cgZGV2ZWxvcG1lbnQgaXNvbGF0ZWQ/PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk1hbnVmYWN0dXJpbmcg4oCUIEFyZSB0aGUgZmFjdG9yaWVzIHNlY3Vy ZWQgaW4gYSBzcGVjaWFsIHdheT8gSXMgdGhlIGF0dGVzdGF0aW9uIGtleSBwcm92aXNpb25pbmcg c3lzdGVtIGhhcmRlbmVkIGluIHNvbWUgd2F5IChlLmcuLCB1c2VzIEhTTXMpLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5DZXJ0aWZpY2F0aW9ucyDigJQgVGhlc2UgdGFrZSBhIGxvbmcgdGlt ZSB0byBhY2hpZXZlIGFuZCB3aWxsIHVzdWFsbHkgcmVxdWlyZSBzb21lIG9mIHRoZSBhYm92ZS48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TXkgdGhpbmtpbmcgZm9y IEVBVCB3YXMgdGhhdCB5b3Ugb25seSBwdXQgYXR0ZXN0YXRpb24ga2V5cyBpbnRvIGRldmljZXMg dGhhdCBtZWV0IHNvbWUgY3JpdGVyaWEgbGlrZSBzb21lIG9mIHRoZSBhYm92ZS4gU2luY2UgdGhl cmUgaXMgb2Z0ZW4gbm8gd2F5IHRvIHJlY292ZXIgZnJvbSBhIGNvbXByb21pc2VkIGF0dGVzdGF0 aW9uIGtleSBiZWNhdXNlIG5vIGtleSBtb3JlIHNlY3VyZSB0aGFuIGl0LCB5b3Uga2luZA0KIG9m IGhhdmUgdG8gaGF2ZSBhbGwgdGhhdC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ U2luY2UgdGhlc2UgZG9u4oCZdCBjaGFuZ2UgbXVjaCBvdmVyIHRpbWUsIHRoZSBlbmRvcnNlbWVu dCB3b3VsZG7igJl0IGNoYW5nZS4gJm5ic3A7VGhleSBjb3VsZCBldmVuIHNwYW4gc2V2ZXJhbCBt b2RlbHMgYW5kIHZhcnlpbmcgSFcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjx1PlBv bGljeSwgSy1HLVYsIG90aGVyPC91PjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+U1cgVmVyc2lvbnMg4oCUIEFzIGxvbmcgYXMgdGhlIFNXIGZvbGxv d3MgYSBkZXZlbG9wbWVudCBwcm9jZXNzIGxpa2UgdGhhdCBhYm92ZSwgaXQgZG9lc27igJl0IGhh dmUgdG8gYmUgaW5jbHVkZWQgaW4gdGhlIGVuZG9yc2VtZW50LiBPZiBjb3Vyc2UgdGhlIHNtYWxs ZXIgdGhlIFNXIGFuZCB0aGUgYmV0dGVyIHRoZSBwcm9jZXNzLCB0aGUgbW9yZSBpdCBpcyB0cnVl IChhbmQgdmljZSB2ZXJzYSkuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJsYWNrbGlzdHMg 4oCUIFRoZXNlIG1pZ2h0IGJlIHNwZWNpZmljIHRvIFVFSURzLCB2ZXJzaW9ucyBvZiBTVywgZGVw bG95bWVudHMgYSBwYXJ0aWN1bGFyIE9FTSBvciBzdWNoPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkRlYnVnIHN0YXR1cyDigJQgTW9zdCBvZiB0aGUgZGVidWcgc3RhdHVzIHZhbHVlcyBjYW4g dmFyeSBvbiBhIGRheS1kYXkgYmFzaXM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T0VNIG1v ZGVsIOKAlCBJZiB0aGUgYXR0ZXN0YXRpb24gaXMgaW1wbGVtZW50ZWQgYnkgYSBjaGlwIHZlbmRv ciBhbmQgdGhlIGVuZG9yc2VtZW50IGlzIGZvciB0aGUgY2hpcCwgdGhlbiB0aGUgT0VNIG1vZGVs IHdpbGwgdmFyeSB3aWRlbHkuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk5vbmUgb2YgdGhlc2UgY2FuIGJlIGNyaXRlcmlhIGFzIHRvIHdoZXRoZXIgYW4gYXR0ZXN0 YXRpb24ga2V5IGlzIHB1dCBpbnRvIGEgZGV2aWNlIG9yIG5vdCBhcyB0aGV5IGFyZSBub3Qga25v d24gYXQgbWFudWZhY3R1cmluZyB0aW1lIGFuZC9vciBtdXN0IGJlIGFsbG93ZWQgdG8gdmFyeSB3 aWRlbHkgYWZ0ZXIgbWFudWZhY3R1cmluZy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5JIHRoaW5rIHdoYXQgSeKAmXZlIGRlc2NyaWJlZCBhYm92ZSBsaW5lcyB1 cCBwcmV0dHkgd2VsbCBmb3IgYSBUUE0uIFRoZSBzeXN0ZW0gYXJjaGl0ZWN0dXJlIGlzIG1vc3Rs eSBzZXQgYnkgdGhlIFRDRy4gSFcgVFBNcyBhcmUgYWxtb3N0IGFsd2F5cyBjZXJ0aWZpZWQuIFRo ZXkgYXJlIGluZGVwZW5kZW50IG9mIE9FTSBtb2RlbC4gSXQgYWxzbyBsaW5lcyB1cCByZWFzb25h Ymx5IHdlbGwgd2l0aCBzZWN1cmUgZWxlbWVudHMNCiBhbmQgY2FuIGxpbmUgdXAgd2l0aCBURUXi gJlzLiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGNydXggb2YgZW5kb3Jz ZW1lbnQgdG8gbWUgaXMgdGhlIHNlY3VyaXR5IGNoYXJhY3RlcmlzdGljcyBvZiB0aGUgYXR0ZXN0 ZXIgdGhhdCBwcm90ZWN0IHRoZSBhdHRlc3RhdGlvbiBrZXkgYmVjYXVzZSB0aGVyZSBpcyBnZW5l cmFsbHkgbm8gcmVjb3ZlcnkgZnJvbSBhIGNvbXByb21pc2VkIGF0dGVzdGF0aW9uIGtleS4gSXQg c2V0cyB0aGUgYmFzZWxpbmUgcmlzayBvZiB0aGUgSFcgYW5kIFNXIG9mIHRoZQ0KIGRldmljZS48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIG9uZSBleHRyZW1lIGlzIGEg c2VwYXJhdGUgZW5kb3JzZW1lbnQgZm9yIGV2ZXJ5IGRldmljZSAo4oCcbWljcm8gZW5kb3JzZW1l bnQmcXVvdDs/KSwgd2hpY2ggaXMgd2hhdCBJIHRoaW5rIFRob21hcyBhbmQgQVJNIFBTQSBhcmUg dGVuZGluZyB0b3dhcmRzLiBUaGUgb3RoZXIgZXh0cmVtZSBpcyBvbmUgZW5kb3JzZW1lbnQgZm9y IGEgcHJvZHVjdCBsaW5lJm5ic3A7KOKAnG1hY3JvIGVuZG9yc2VtZW50JnF1b3Q7PyksLCBzYXkg YSBwcm9kdWN0DQogbGluZSBvZiBUUE1zLiBUaGVuIGl04oCZcyBtb3JlIGxpa2UgdGhlIGRhdGEg c2hlZXQgZm9yIHRoZSBwcm9kdWN0LiZuYnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZW4gdGhlcmXigJlzIGRp ZmZlcmVudCB3YXlzIHRvIGZhbiB0aGlzIG91dCB0byB0aGUgZGlmZmVyZW50IGtleSAvIHNpZ25p bmcgc2NoZW1lcyAocGVyLWRldmljZSBrZXksIGdyb3VwIGtleSwgRUNEQUEsIFguNTA5KS4gRm9y IGV4YW1wbGUgYSBtYWNyby1lbmRvcnNlbWVudCBjb3VsZCBpbmNsdWRlIHRoZSByb290IG9mIGFu IFguNTA5IGhpZXJhcmNoeSBhbmQgdGhlIGluZGl2aWR1YWwgZGV2aWNlcyAob3IgZ3JvdXBzDQog b2YgZGV2aWNlcykgd291bGQgaGF2ZSBpbmRpdmlkdWFsIGtleXMgdGhhdCBjaGFpbiB1cC4gV2l0 aCBhIG1pY3JvLWVuZG9yc2VtZW50IHRoZSBwZXItZGV2aWNlIHB1YmxpYyBrZXkgY291bGQgYmUg cGVyIGVuZG9yc2VtZW50LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUg bW9zdCBpbXBvcnRhbnQgdGhpbmcgYWJvdXQgdGhlIGVuZG9yc2VtZW50IHNlZW1zIHRvIG1lIGlz IHRoZSBjaGFyYWN0ZXJpemF0aW9uIG9mIGhvdyB0aGUgYXR0ZXN0YXRpb24ga2V5IGlzIHByb3Rl Y3RlZC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEFwciA3LCAyMDIwLCBh dCA3OjM2IEFNLCBUaG9tYXMgRm9zc2F0aSAmbHQ7PGEgaHJlZj0ibWFpbHRvOlRob21hcy5Gb3Nz YXRpQGFybS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPlRob21hcy5Gb3NzYXRpQGFy bS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIu MHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+ SGkgTGF1cmVuY2UsPGJyPg0KPGJyPg0KVGhhbmtzIGZvciBicmluZ2luZyB0aGlzIHVwLiAmbmJz cDtBIGZldyB0aG91Z2h0cyBiZWxvdy48YnI+DQo8YnI+DQpPbiAwMy8wNC8yMDIwLCAyMDozNywg JnF1b3Q7UkFUUyBvbiBiZWhhbGYgb2YgTGF1cmVuY2UgTHVuZGJsYWRlJnF1b3Q7PGJyPg0KJmx0 Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86cmF0cy1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpwdXJwbGUiPnJh dHMtYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRp Y2EiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTpIZWx2ZXRpY2EiPm9uDQogYmVoYWxmIG9mPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86bGdsQGlzbGFu ZC1yZXNvcnQuY29tIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5Okhl bHZldGljYTtjb2xvcjpwdXJwbGUiPmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvc3Bhbj48L2E+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPiZndDsgd3Jv dGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPlNvIGhv dyBkb2VzIGEgVmVyaWZpZXIgZmluZCB0aGUgYXBwbGljYWJsZSBlbmRvcnNlbWVudCBmb3IgRXZp ZGVuY2UgaXQ8YnI+DQp3aXNoZXMgdG8gdmVyaWZ5IGFuZCBrbm93IHRoYXQgaXMgcmVhbGx5IHRo ZSByaWdodCBlbmRvcnNlbWVudD88YnI+DQo8YnI+DQpTZWVtcyBsaWtlIHRoZSBFdmlkZW5jZSBu ZWVkcyBzb21lIHNvcnQgb2YgYW4gZW5kb3JzZW1lbnQgbG9jYXRvciBJRC48YnI+DQpUaGlzIGNv dWxkIGJlIGEgVVJMIG9yIGEgR1VJRC4gRUFUIGN1cnJlbnRseSBoYXMgdGhlIG9yaWdpbmF0aW9u IGNsYWltPGJyPg0KdG8gdHJ5IHRvIHNvbHZlIHRoaXMsIGJ1dCBpdCBpcyBoYWxmLWJha2VkLiBJ dCBuZWVkcyB0byBnZXQgZml4ZWQuIEnigJltPGJyPg0KZmlzaGluZyBmb3IgY29tbWVudHMgaGVy ZSBvbiB3aGF0IGl0IHNob3VsZCBiZSBsaWtlLjxicj4NCjxicj4NClByZXR0eSBzdXJlIHRoZSBF bmRvcnNlbWVudCBuZWVkcyB0byBpbmNsdWRlIG9yIHJlZmVyZW5jZSB0aGUgcHVibGljPGJyPg0K a2V5IHRoYXQgaXMgdXNlZCB0byB2ZXJpZnkgdGhlIHNpZ25hdHVyZS4gV2l0aG91dCB0aGF0LCB0 aGUgQXR0ZXN0ZXI8YnI+DQpjb3VsZCBsaWUgYW5kIHBpY2sgYW55IG9sZCBFbmRvcnNlbWVudCB0 aGF0IGl0IHdpc2hlcy4gVGhlcmUgbmVlZHMgdG88YnI+DQpiZSBzb21lIGJpbmRpbmcgYmV0d2Vl biBpdGVtcyBpbiB0aGUgZW5kb3JzZW1lbnQgKEUwLCBFMSzigKYpIGFuZCB0aGU8YnI+DQp2ZXJp ZmljYXRpb24ga2V5LiBUaGF0IGNvdWxkIGJlIGluIHRoZSBmb3JtIG9mIGEgc2lnbmVkIHRva2Vu IG9yPGJyPg0KY2VydGlmaWNhdGUsIGJ1dCBkb2VzbuKAmXQgaGF2ZSB0byBiZS4gUHJldHR5IHN1 cmUgdGhpcyBuZWVkcyB0byBiZTxicj4NCmRpc2N1c3NlZCBpbiB0aGUgYXJjaGl0ZWN0dXJlIGRv Yy48YnI+DQo8YnI+DQpUaGVyZSdzIGEgZmV3IHNjZW5hcmlvczo8YnI+DQotIE9uZSBlbmRvcnNl bWVudCBhcHBsaWVzIHRvIGxvdHMgb2YgZGV2aWNlcyBpbiB0aGUgc2FtZSBjbGFzcywgYnV0PGJy Pg0KJm5ic3A7ZWFjaCBoYXMgdGhlaXIgb3duIGF0dGVzdGF0aW9uIGtleS48YnI+DQotIC0gUHJv YmFibHkgRUNEQUEgZml0cyBpbiBoZXJlPGJyPg0KLSAtIE9uZSBvcHRpb24gaGVyZSBpcyBhbiBY NTA5IGhpZXJhcmNoeTxicj4NCi0gR3JvdXAga2V5cyBhcmUgdXNlZCAoZm9yIHByaXZhY3kgcmVh c29ucyBvciBvdGhlcikgc28gdGhlcmUgaXMgYTxicj4NCiZuYnNwO29uZS1vbmUgY29ycmVsYXRp b24gd2l0aCB0aGUgRW5kb3JzZW1lbnRzICh0aGUgR0VJRCBkaXNjdXNzaW9uKTxicj4NCi0gR3Jv dXAga2V5cyBhcmUgdXNlZCwgYnV0IGFjcm9zcyBkZXZpY2VzIHRoYXQgaGF2ZSBkaWZmZXJlbnQ8 YnI+DQombmJzcDtlbmRvcnNlbWVudHMgc28gdGhlcmXigJlzIG5vIG9uZS1vbmUgY29ycmVsYXRp b248YnI+DQo8YnI+DQpXaGlsZSB0aGUgbGFzdCBvbmUgc2VlbXMgb2RkIGFuZCB1bmxpa2VseSwg SSB0aGluayBpdCBjb3VsZCBvY2N1ciw8YnI+DQpiZWNhdXNlIGZyb20gYSBsb3Qgb2YgcmVhbCBl eHBlcmllbmNlIHRoZSBzZXQgdXAgb2YgYXR0ZXN0YXRpb24ga2V5czxicj4NCmlzIHZlcnkgaWRp b3N5bmNyYXRpYy4gSXQgaXMgd2lsZGx5IGFmZmVjdGVkIGJ5IG1hbnVmYWN0dXJpbmcgY29zdHM8 YnI+DQphbmQgaXNzdWVzIG9uIGFzc2VtYmx5IGxpbmVzLCBzdWIgY29udHJhY3RvciBzdHJ1Y3R1 cmUsIGxvY2F0aW9uIG9mPGJyPg0Kc2VjdXJlIGZhY2lsaXRpZXMgYW5kIGFwcHJvYWNoZXMgdG8g bWFraW5nIG1vbmV5IG9uIGl0LiBUaGV5IGFyZSBsaWtlPGJyPg0Kc25vd2ZsYWtlcywgZWFjaCBv bmUgaXMgZGlmZmVyZW50LiAmbmJzcDtTbyBtYXliZSBlbmRvcnNlbWVudCBsb2NhdG9yIElEPGJy Pg0KYW5kIGtleSBJRCBhcmUgbm90IHRoZSBzYW1lLCBidXQgdGhleSBjYW4gYmUgaW4gc29tZSB1 c2UgY2FzZXM/PGJyPg0KPGJyPg0KSSBhbSBhbHNvIHRlbXB0ZWQgdG8gZW5jb3VyYWdlIHRoZSBw bGFjZW1lbnQgb2YgdGhlIGVuZG9yc2VtZW50PGJyPg0KbG9jYXRvciBJRCBpbiB0aGUgQ09TRSBv ciBKT1NFIGhlYWRlciBwYXJhbWV0ZXJzIHNvIHlvdSBkb27igJl0IGhhdmUgdG88YnI+DQpwYXJz ZSB0aGUgdW52ZXJpZmllZCBib2R5IG9mIGNsYWltcyB0byBiZSBhYmxlIHRvIGZpbmQgdGhlIGtl eTxicj4NCm1hdGVyaWFsIHRvIHZlcmlmeSBpdC48YnI+DQo8YnI+DQpUaG91Z2h0cz88L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZl dGljYSI+PGJyPg0KQSB0d28gbGV2ZWwgbG9va3VwIGtleSwgbW9kZWwmIzQzO2luc3RhbmNlLCBz ZWVtcyB0byBiZSBxdWl0ZSBnZW5lcmFsbHk8YnI+DQphcHBsaWNhYmxlIGFzIGFuIGVuZG9yc2Vt ZW50IGxvY2F0b3IuICZuYnNwO1RoZSBtb2RlbCBwYXJ0IHdvdWxkIGdldCB5b3UgdG88YnI+DQp0 aGUgc2hhcmVkIGRhdGEgKGUuZy4sIGNlcnRpZmljYXRpb24sIG1lYXN1cmVkIGJvb3QgS0dWcywg ZXRjLiksIHdoaWxlPGJyPg0KdGhlIGluc3RhbmNlIHBhcnQgY2FuIGJlIHVzZWQgdG8gcmV0cmll dmUgZGV2aWNlLXNwZWNpZmljIHN0YXRlOjxicj4NCnZlcmlmaWNhdGlvbiBrZXkocykgYXMgd2Vs bCBhcyBvdGhlciBtZXRhZGF0YSwgZS5nLiwgaWYgc29tZSBnZWFyIGlzPGJyPg0KYmxhY2tsaXN0 ZWQuICZuYnNwO0luIFBTQSB3ZSBoYXZlIHNvbWV0aGluZyBxdWl0ZSAodGhvdWdoIG5vdCBlbnRp cmVseSk8YnI+DQpzaW1pbGFyIHdpdGggaW1wbGVtZW50YXRpb24gYW5kIGluc3RhbmNlIElEcyBb MV0gWzJdLjxicj4NCjxicj4NCihDb250ZXh0LXN3aXRjaGluZyBmb3IgYSBzZWNvbmQgb24gb3Vy IHByZXZpb3VzIFVFSUQvR0VJRCBkaXNjdXNzaW9uOiBJPGJyPg0KZ3Vlc3Mgd2UgbWlnaHQgbW9k ZWwgYW4gaW5zdGFuY2UgYXMgYW4gYW5vbnltaXR5IHNldCwgYW5kIHRoZXJlZm9yZTxicj4NCnRy ZWF0IEVVSURzIGFzIHRoZSBzcGVjaWFsIGNhc2UgR0VJRHMgd2l0aCBjYXJkaW5hbGl0eSA9PSAx Pyk8YnI+DQo8YnI+DQpGb3IgdGhlIHNha2Ugb2YgYnVpbGRpbmcgYSBzaGFyZWQgYW5kIHJldXNh YmxlIHZvY2FidWxhcnksIEknZCBwcmVmZXI8YnI+DQprZWVwaW5nIG1vZGVsIGFuZCBpbnN0YW5j ZSBpZGVudGlmaWVycyBhcyBzZXBhcmF0ZSBjbGFpbXMgcmF0aGVyIHRoYW48YnI+DQpoYXZpbmcg YW4gb3BhcXVlIGVuZG9yc2VtZW50IElEIGNsYWltIHRoYXQgY2x1bXBzIHRvZ2V0aGVyIHRob3Nl IGFuZDxicj4NCnBvc3NpYmx5IG90aGVyIHN0dWZmIGluIGEgdXNlLWNhc2Ugc3BlY2lmaWMgZmFz aGlvbi4gJm5ic3A7Rm9yIHRoZSBzYW1lPGJyPg0KcmVhc29uIEkgd291bGQgbm90IG92ZXJyaWRl IGtleSBJRCB3aXRoIGluc3RhbmNlIElEIHNlbWFudGljcy48YnI+DQo8YnI+DQpjaGVlcnMsIHRo YW5rcyE8YnI+DQo8YnI+DQpbMV08c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19o dHRwczovd3d3LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1wc2EtdG9rZW4tMDUu aHRtbCpuYW1lLWltcGxlbWVudGF0aW9uLWlkX187SXchIU5FdDZ5TWFPLWdrIVJROGd5TzNSb3kt ZElFZDZTX2thNDVsRkVHbTFHSUgybHRfRDFOYWZtYVFXcGpqc094NjI5emh1LUxtVWkxTU1NV3Mk Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xv cjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1w c2EtdG9rZW4tMDUuaHRtbCNuYW1lLWltcGxlbWVudGF0aW9uLWlkPC9zcGFuPjwvYT48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJyPg0KWzJdPHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBo cmVmPSJodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L3d3dy5pZXRmLm9yZy9pZC9k cmFmdC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwqbmFtZS1pbnN0YW5jZS1pZF9f O0l3ISFORXQ2eU1hTy1nayFSUThneU8zUm95LWRJRWQ2U19rYTQ1bEZFR20xR0lIMmx0X0QxTmFm bWFRV3BqanNPeDYyOXpodS1MbVVRaFN6ZzRFJCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9y Zy9pZC9kcmFmdC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFtZS1pbnN0YW5j ZS1pZDwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpI ZWx2ZXRpY2EiPjxicj4NCjxicj4NCjxicj4NCjxicj4NCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBj b250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlh bCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVk IHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBu b3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3Ig YW55IHB1cnBvc2UsDQogb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1l ZGl1bS4gVGhhbmsgeW91Ljxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fPGJyPg0KUkFUUyBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0i bWFpbHRvOlJBVFNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6SGVsdmV0aWNhO2NvbG9yOnB1cnBsZSI+UkFUU0BpZXRmLm9yZzwvc3Bhbj48L2E+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxicj4NCjwv c3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3JhdHNfXzshIU5FdDZ5TWFPLWdrIVJROGd5TzNSb3ktZElF ZDZTX2thNDVsRkVHbTFHSUgybHRfRDFOYWZtYVFXcGpqc094NjI5emh1LUxtVXpRVFBVQVkkIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpw dXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0czwvc3Bhbj48 L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_0026A707C6014F74932A53F3B1F24426ciscocom_-- From nobody Mon Apr 13 08:25:25 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 221F33A17D5 for ; Mon, 13 Apr 2020 08:25:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.155 X-Spam-Level: X-Spam-Status: No, score=-2.155 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, T_SPF_TEMPERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=SonaIK13; dkim=pass (1024-bit key) header.d=juniper.net header.b=bVCTIAAU Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vaAafNZ4ewm5 for ; Mon, 13 Apr 2020 08:25:10 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7A0D3A17E0 for ; Mon, 13 Apr 2020 08:24:11 -0700 (PDT) Received: from pps.filterd (m0108161.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 03DFC2wk029146; Mon, 13 Apr 2020 08:24:09 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=ATW+GccbnbAc+6EKlIkwqsc4TKyUjsHsF5rTPA1lfJk=; b=SonaIK13sfKeAXNpmao9/wKnlFMv6k3TvyS7l7vwfYVyuGr2GUFPebly01pZuigVX3jD KgtIqr4pRa0+x22G7XzzGZrDdThcd6YmHk0m7IdGmah1AzcJDohmt8XD7NvOi3/0NPVs 1kuPT3BDOcv8JFrO5aU9K4aG9bJiljjRtJS6gy8o7B7HranWQlZ9C63yRU4FemkdV1c9 bvTxrn6Tz4I6BnQjfok0SBIRq6K8Nim9+wMl2cvphd7a7BhjY8oH4OEKqJU8Vto98fK4 LW6fTspWhWCkeNYqEBlLeQd+VNdqFYYDaDLdmkhNF6JHUpKPdhlAbGBAzjm8QCHQlkXt KA== Received: from nam11-co1-obe.outbound.protection.outlook.com (mail-co1nam11lp2169.outbound.protection.outlook.com [104.47.56.169]) by mx0b-00273201.pphosted.com with ESMTP id 30bd0xtjg4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Apr 2020 08:24:09 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HLsdoqi4OWOgKKmtMM6x7HmBchV8fiEkoe0dpLpKcGZcF1SZ+047sioQiop8TxIY/EpLRCk4FfMf3vK25ako3+VlocOWUduRM6SNv9fDjw5X+8nrANJ8YBtXGWqEUKSj0jWyQhpfCeSBra0wffqqym2geYQ1lJpQZTFpn5K0HoTYZItl4HqP4LArQkpO4PyK8Mj+2IgxE3shrRodWLx24hbYnAjEbm+7ZdVSPrt/imOEPfpMNxfWM52MPf9is7EgogSI9tyyGllRRmG6faxHi/WATDThmbZfVb9xT5+mWU15rTtUXOQbWAJubC/G3dVTNniy07fgwTJRayZvGz2/iA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ATW+GccbnbAc+6EKlIkwqsc4TKyUjsHsF5rTPA1lfJk=; b=YwfMbiYu5m3+4wMMbS9AtAUPy4KRkLadHBToXCDeuB7EKr+WDsZjdJ7ftsti/EJrT2CaDNmC3IVCKuLx1abqq6tIU9CcS1NWgLhd4z8iKM4z072wJW8pIU4wdm5AQQFh1EqcAnJb0A0Y3NvCXg9UsqkPcewnDD/U18HzS6n9Y7qvsCm0o1QJATDB7s3KxkilPnqVDcq1G2WvUCceJEPwf92CkRqSWNxb1HFl42vidtIQ0rL7uSqmCgS/j/f0MpmVGuVvTCioCdd1e9i05LecdwEUnowROqRGgIOhgJV3QChp/MgiNKTxvF7CHuon7rrGEaCp0ijrpyFLtlJOeqvWRw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ATW+GccbnbAc+6EKlIkwqsc4TKyUjsHsF5rTPA1lfJk=; b=bVCTIAAUhYHDn6t12hRq7BHM9IiM35t5zk9Vt6MfcvtMzyrTFcWAxyx9DSBtpay1smjDAoai1NrolllWl4yQjZK0ViNAGiYzdbLn1YOqxKAz4htRRUFnEYy0cDTECdxTDbmgB0hpZk9hueiU1lgEe0KLSavd2W7mvsruJJPlBxo= Received: from DM6PR05MB6889.namprd05.prod.outlook.com (2603:10b6:5:204::22) by DM6PR05MB7197.namprd05.prod.outlook.com (2603:10b6:5:20b::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2921.20; Mon, 13 Apr 2020 15:24:07 +0000 Received: from DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1]) by DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1%7]) with mapi id 15.20.2921.024; Mon, 13 Apr 2020 15:24:07 +0000 From: Guy Fedorkow To: Laurence Lundblade CC: "rats@ietf.org" , Ned Smith , Jessica Fitzgerald-McKay Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9b/q6maJEL0kaGXfcqT+zj8qhtv9mAgABNSQCAAtK/EIAFBFeAgAFKleA= Date: Mon, 13 Apr 2020 15:24:06 +0000 Message-ID: References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-13T15:24:04.9683404Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=1218f90f-0a0d-4024-9898-3509fb1a88e9; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic dlp-product: dlpe-windows dlp-version: 11.3.2.8 dlp-reaction: no-action x-originating-ip: [66.129.241.13] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: f7cabdb1-cfce-4d4a-1825-08d7dfbeb509 x-ms-traffictypediagnostic: DM6PR05MB7197: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 037291602B x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR05MB6889.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(346002)(396003)(366004)(39860400002)(136003)(376002)(9686003)(4326008)(6916009)(53546011)(966005)(30864003)(5660300002)(186003)(6506007)(2906002)(71200400001)(478600001)(7696005)(26005)(52536014)(64756008)(316002)(55016002)(66946007)(76116006)(66476007)(8676002)(81156014)(15650500001)(54906003)(33656002)(66556008)(66446008)(8936002)(86362001)(9326002)(15398625002); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: AzglNPVLVaA2NneYZwJ9YaYxtvcsGYgCTjFFGaHccnIqfUvk31ZqQWJCKE/YjCjDMfiO5u6pPQMl/35spkC7xpNtyoey53b9rLwHp3Ls0qsEPyh52769tc8ic/EnYC3LMQHYzfo92EKAVSW5vnkTF+aXv3RfFCYodBnudOL4NBNLQ4XfqKndy1VkqQj16OWFiFZk0RYnJOhG9kJEvB6vHJGo4LOg6psuyLEIpCVr+otdXcWjbBywIzaFxdl0j9v/5PZt+LY8vtzFGz+QYU2ycGb8EeA/cSSOnfaYvXSDb3L9RIU6b09HPQmkrZd2nW72rx6hOxAJGR78p4vpz9NT4bffA1bQiKWGfhSH5TSjhGuX2YAEjWS3lSSRueK+Q7Kqm6WHXqgJ1sNeo0EzbH7xQQGs2CDgLfSaj8u5l7magYNFqyXeRg/qmIg0ttlaUNPSWwSyuBshrNsaBEqcKIphhuPoKaOaLg4CpV+PY29qUJ1nNPTkEvjYV5G+rc7E85+iyWPK3tTzAbXFu4nM+j5IeyPBattOtZGTRtE66olsv49KBpZLXalB8Uezc6tdt2rs x-ms-exchange-antispam-messagedata: vEJVFba7+NcSdelkXNEhicOWrkf5AmTHL6JHoARWYA8GUltywQqhHIIW3VHdiS8bdCmvcVckwP8f+AK4wSyUCIV8vL7CWd7ZwpSblqSB5qa13fUMU/S4pLAHu8QtkBglUKmbuNWFt4piBd/U8n6XoA== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR05MB6889D66678CDE3F79244276CBADD0DM6PR05MB6889namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: f7cabdb1-cfce-4d4a-1825-08d7dfbeb509 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Apr 2020 15:24:06.9757 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: lD1cc7jlijarGyvZiFHqATZs0jR2ZaBkDtdZ0JNFrjvGf2sUdTLMZr06x8GKpZ3ba73YucfXjq0sJt7yWJwBPA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR05MB7197 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-13_07:2020-04-13, 2020-04-13 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 bulkscore=0 malwarescore=0 lowpriorityscore=0 spamscore=0 priorityscore=1501 mlxscore=0 phishscore=0 adultscore=0 suspectscore=0 clxscore=1015 mlxlogscore=999 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004130117 Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Apr 2020 15:25:23 -0000 --_000_DM6PR05MB6889D66678CDE3F79244276CBADD0DM6PR05MB6889namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Laurence, Thanks for your response... I've added annotations, marked with [guy]... /guy Juniper Business Use Only From: Laurence Lundblade Sent: Sunday, April 12, 2020 2:56 PM To: Guy Fedorkow Cc: rats@ietf.org; Ned Smith Subject: Re: [Rats] Endorsement ID and verification key (was Processing End= orsements and Evidence into Results) Trying again, after re reading your question a few times (and a few not-sen= t replies). First you need the endorsement for the TPM that is serving as the attester.= This endorsement would come from the TPM vendor. I assume that is fairly w= ell understood and in practice today through TPM architecture and conventio= ns already in place with things like IDevID. (Maybe you all know it, but I = don't know how this works. I would be interested in references and/or a des= cription of it). [guy] Yes, I think most TPMs ship with a pre-provisioned Endorsement Key an= d a certificate signed by the TPM manufacturer. Use of that key is control= led to prevent unwanted privacy abuses, but it's there specifically to vali= date the source of the TPM. For RIV, I'm not sure that needs to be done by the end-user of the device= ... the OEM who makes the 'router' (yes, or switch or firewall or access p= oint) should pre-provision a DevID signed by the OEM, and a trustworthy OEM= wouldn't sign an IDevID in their facility without verifying that the TPM t= hey've just soldered down is authentic. Some OEMs actually customize their TPMs slightly to contain their own sig= nature on the EK, rather than the TPM vendor's, but I don't think that's co= mmon. In addition to the identity of the device itself, RIV depends on verifica= tion of the certificate that goes with the TPM Attestation key. We've made= that as easy as possible in RIV by pre-provisioning the IAK along with the= IDevID, so the two will contain the same identity information, signed by t= he same vendor. For more-generic TPM applications where a pre-provisioned DevID may be in= appropriate, there's a well-specified series of steps to validate the TPM b= efore remotely installing the ID or attestation keys. The TCG spec with th= e gory details is still in draft, but if you have TCG access, it's called "= TPM Keys for Platform DevID for TPM2". Next you need to identify the RIM. That might come from the OS Vendor or fr= om the device vendor or even a third party, none of which are the TPM vendo= r. For example, with Android, Google produces the OS, but it is open source= and the phone (the device) vendor can modify it, so the RIM would probably= come from the phone/device vendor. It seems possible to have split RIMs wh= ere part comes from the the OS vendor and part comes from the device vendor= . [guy] Agreed - the RIM will almost certainly not come from the TPM vendor= . This seems fundamentally like a task for the system administrator, to de= cide who they trust for RIMs. If the OEM or software vendor ships RIMs, th= at seems like an obvious choice, but administrators can decide any way they= want. Seems like OS/device/3rd-party Vendor IDs, product names and product versio= ns are very non-uniform. You couldn't write much generic Verifier code to w= ork with them as they are today. The best attempts at making these generic = I know of seem EAT's IEEE-based OEMID, and PSA's EAN-13 based HW version, b= ut I don't think these are enough. Maybe there is something else out there.= SWID of some sort? [guy] TCG has a draft spec out for public review covering RIM. 'DRAFT: TCG= Reference Integrity Manifest Information Model' https://trustedcomputinggroup.org/wp-content/uploads/TCG_RIM_Model_v1-r= 13_2feb20.pdf The doc is completely based on ISO SWID, with the NIST guidelines. There's= a CBOR variant called CoSWID at IETF (I think you can guess which Henk, ou= t of the universe of all Henks, you could ask for details!) If you have interest in commenting on the TCG RIM spec, I know the author= s would be glad to hear from you. But about identity of RIMs... The RIM is signed, so once you've done the policy task of deciding which = RIM supplier you like, verifying it is easy. I realize of course that ther= e's little commonality on how to name a product or version, but I'm not sur= e that matters. The RIM corresponds to a very specific product and release= . The vendor can call it whatever they want, as long as they don't issue t= wo release with the same name. After that, I think it's just a string comp= are. I suppose if third-party RIM suppliers exist, then the RIM has to explici= tly call out the software manufacturer by name, but that's already part of = the SWID & RIM specs. As far as we can tell, SWID embodies sufficient flexibility to describe a= ny software release that can be expressed as files and directories. I have= a small project on my todo list to prove that for a Juniper release, but s= o far, I don't see a problem. Again, if you're interested, now is the time= for review! Agreed that the identifier of the RIM doesn't have to be secured / attested= , just like key ID's don't have to be. If the Verifier gets the wrong one, = the verification just fails. This is certainly not a solved problem in the EAT space. Maybe there's a so= lution in common? My first though is some sort of URI, maybe related to SWI= D, that is part of the measurements in the Evidence sent to the Verifier. I= t doesn't have to be mandatory or used by everyone, but it seems likely to = benefit at least some. [guy] Henk might have suggestion for potential commonality with EAT. As no= ted, SWID is strongly oriented to software releases with packages, director= ies and files, but maybe there's something useful there. To be clear, I'm thinking that the Endorsement of the TPM Attester is quite= separate from the Endorsement that is the RIM. They come from completely d= ifferent vendors. The TPM Endorsement is of little use to identify the RIM. [guy] Yes, in fact I think there are at least three suppliers that could be= verified; the TPM vendor, the hardware platform OEM who made the Attester,= and the RIM supplier who certifies the software image. Given the way RIV = is scoped, I think verification of the TPM itself is up to the OEM, but ver= ification of the OEM's DevID and IAK is one thing, and verification of the = authenticity of the RIM is another independent operation, both of which be= long in a RATS-compatible Verifier. Let me know what we're missing! /guy LL On Apr 9, 2020, at 7:31 AM, Guy Fedorkow > wrote: Hi Laurence, I understand that the discussion on the topic below mainly pertains to EA= T, but I'd like to make sure we're not missing something on the RIV side. For OS software image integrity using a TPM, it seems like finding the ri= ght manifest shouldn't be that hard... The Attester needs to have pre-provisioned identity and attestation keys = as outlined in the RIV draft. That provides the Verifier with the vendor i= dentity for the root of trust. The measurement logs contain the alleged pr= oduct name and version number for the software installed on the box. Use t= he vendor ID to narrow the scope to specific vendor's product and version s= pace, and find the RIM that matches. Then check if the hashes line up; if = so, you're good, if not, either the claim of what software is present was i= ncorrect, or something got hacked. Seems like a verifier could follow this same model through the entire cha= in of trust, even through multiple vendors, as long as there are no gaps in= the chain. I know EAT needs to work in a less-constrained environment, but let me kn= ow if you think we're oversimplifying this on RIV. Thanks /guy Juniper Business Use Only From: RATS > On Behalf = Of Laurence Lundblade Sent: Tuesday, April 7, 2020 3:13 PM To: Thomas Fossati > Cc: rats@ietf.org; Ned Smith > Subject: Re: [Rats] Endorsement ID and verification key (was Processing End= orsements and Evidence into Results) [External Email. Be cautious of content] This is a reply to both Thomas and Ned's message on debug in the related th= reat. My inclination is to associate endorsements with time-invariant characteris= tics of the device. At the moment this doesn't seem like the only way to do= it, but it seems like a good way. Things that are not time invariant are p= olicy, k-g-v or such. Endorsement System architecture - Does the Attester use a TEE or a TPM or maybe it is s= imple system with just a simple CPU, but it is encased in titanium. Is defe= nse against chip invasive attacks considered? Do keys become inaccessible w= hen debug is enabled. Development process - Is there a special security-oriented team? Does the t= eam have a code review policy? Is there a bug bounty? Are the desktops and = IT systems used for HW and SW development isolated? Manufacturing - Are the factories secured in a special way? Is the attestat= ion key provisioning system hardened in some way (e.g., uses HSMs). Certifications - These take a long time to achieve and will usually require= some of the above. My thinking for EAT was that you only put attestation keys into devices tha= t meet some criteria like some of the above. Since there is often no way to= recover from a compromised attestation key because no key more secure than= it, you kind of have to have all that. Since these don't change much over time, the endorsement wouldn't change. = They could even span several models and varying HW. Policy, K-G-V, other SW Versions - As long as the SW follows a development process like that abo= ve, it doesn't have to be included in the endorsement. Of course the smalle= r the SW and the better the process, the more it is true (and vice versa). Blacklists - These might be specific to UEIDs, versions of SW, deployments = a particular OEM or such Debug status - Most of the debug status values can vary on a day-day basis OEM model - If the attestation is implemented by a chip vendor and the endo= rsement is for the chip, then the OEM model will vary widely. None of these can be criteria as to whether an attestation key is put into = a device or not as they are not known at manufacturing time and/or must be = allowed to vary widely after manufacturing. I think what I've described above lines up pretty well for a TPM. The syste= m architecture is mostly set by the TCG. HW TPMs are almost always certifie= d. They are independent of OEM model. It also lines up reasonably well with= secure elements and can line up with TEE's. The crux of endorsement to me is the security characteristics of the attest= er that protect the attestation key because there is generally no recovery = from a compromised attestation key. It sets the baseline risk of the HW and= SW of the device. On one extreme is a separate endorsement for every device ("micro endorseme= nt"?), which is what I think Thomas and ARM PSA are tending towards. The ot= her extreme is one endorsement for a product line ("macro endorsement"?),, = say a product line of TPMs. Then it's more like the data sheet for the prod= uct. Then there's different ways to fan this out to the different key / signing = schemes (per-device key, group key, ECDAA, X.509). For example a macro-endo= rsement could include the root of an X.509 hierarchy and the individual dev= ices (or groups of devices) would have individual keys that chain up. With = a micro-endorsement the per-device public key could be per endorsement. The most important thing about the endorsement seems to me is the character= ization of how the attestation key is protected. LL On Apr 7, 2020, at 7:36 AM, Thomas Fossati > wrote: Hi Laurence, Thanks for bringing this up. A few thoughts below. On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" on behalf of lgl@islan= d-resort.com> wrote: So how does a Verifier find the applicable endorsement for Evidence it wishes to verify and know that is really the right endorsement? Seems like the Evidence needs some sort of an endorsement locator ID. This could be a URL or a GUID. EAT currently has the origination claim to try to solve this, but it is half-baked. It needs to get fixed. I'm fishing for comments here on what it should be like. Pretty sure the Endorsement needs to include or reference the public key that is used to verify the signature. Without that, the Attester could lie and pick any old Endorsement that it wishes. There needs to be some binding between items in the endorsement (E0, E1,...) and the verification key. That could be in the form of a signed token or certificate, but doesn't have to be. Pretty sure this needs to be discussed in the architecture doc. There's a few scenarios: - One endorsement applies to lots of devices in the same class, but each has their own attestation key. - - Probably ECDAA fits in here - - One option here is an X509 hierarchy - Group keys are used (for privacy reasons or other) so there is a one-one correlation with the Endorsements (the GEID discussion) - Group keys are used, but across devices that have different endorsements so there's no one-one correlation While the last one seems odd and unlikely, I think it could occur, because from a lot of real experience the set up of attestation keys is very idiosyncratic. It is wildly affected by manufacturing costs and issues on assembly lines, sub contractor structure, location of secure facilities and approaches to making money on it. They are like snowflakes, each one is different. So maybe endorsement locator ID and key ID are not the same, but they can be in some use cases? I am also tempted to encourage the placement of the endorsement locator ID in the COSE or JOSE header parameters so you don't have to parse the unverified body of claims to be able to find the key material to verify it. Thoughts? A two level lookup key, model+instance, seems to be quite generally applicable as an endorsement locator. The model part would get you to the shared data (e.g., certification, measured boot KGVs, etc.), while the instance part can be used to retrieve device-specific state: verification key(s) as well as other metadata, e.g., if some gear is blacklisted. In PSA we have something quite (though not entirely) similar with implementation and instance IDs [1] [2]. (Context-switching for a second on our previous UEID/GEID discussion: I guess we might model an instance as an anonymity set, and therefore treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?) For the sake of building a shared and reusable vocabulary, I'd prefer keeping model and instance identifiers as separate claims rather than having an opaque endorsement ID claim that clumps together those and possibly other stuff in a use-case specific fashion. For the same reason I would not override key ID with instance ID semantics. cheers, thanks! [1] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-im= plementation-id [2] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-in= stance-id IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ RATS mailing list RATS@ietf.org https://www.ietf.org/mailman/listinfo/rats --_000_DM6PR05MB6889D66678CDE3F79244276CBADD0DM6PR05MB6889namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Laurence,

  Thanks for your response…  I’= ;ve added annotations, marked with [guy]…

/guy

 

 

 

Juniper Business Use Only

From: Laurence Lundblade <lgl@island-resor= t.com>
Sent: Sunday, April 12, 2020 2:56 PM
To: Guy Fedorkow <gfedorkow@juniper.net>
Cc: rats@ietf.org; Ned Smith <ned.smith@intel.com>
Subject: Re: [Rats] Endorsement ID and verification key (was Process= ing Endorsements and Evidence into Results)

 

 

Trying again, after re reading your question a few t= imes (and a few not-sent replies).

 

First you need the endorsement for the TPM that is s= erving as the attester. This endorsement would come from the TPM vendor. I = assume that is fairly well understood and in practice today through TPM arc= hitecture and conventions already in place with things like IDevID. (Maybe you all know it, but I don’= t know how this works. I would be interested in references and/or a descrip= tion of it).

[guy] Yes, I think mos= t TPMs ship with a pre-provisioned Endorsement Key and a certificate signed= by the TPM manufacturer.  Use of that key is controlled to prevent un= wanted privacy abuses, but it’s there specifically to validate the source of the TPM.

  For RIV, I̵= 7;m not sure that needs to be done by the end-user of the device…&nbs= p; the OEM who makes the ‘router’ (yes, or switch or firewall o= r access point) should pre-provision a DevID signed by the OEM, and a trustworthy OEM wouldn’t sign an IDevID in their facility without ve= rifying that the TPM they’ve just soldered down is authentic.

  Some OEMs actua= lly customize their TPMs slightly to contain their own signature on the EK,= rather than the TPM vendor’s, but I don’t think that’s c= ommon.

  In addition to = the identity of the device itself, RIV depends on verification of the certi= ficate that goes with the TPM Attestation key.  We’ve made that = as easy as possible in RIV by pre-provisioning the IAK along with the IDevID, so the two will contain the same identity informati= on, signed by the same vendor.

  For more-generi= c TPM applications where a pre-provisioned DevID may be inappropriate, ther= e’s a well-specified series of steps to validate the TPM before remot= ely installing the ID or attestation keys.  The TCG spec with the gory details is still in draft, but if you have TCG acce= ss, it’s called “TPM Keys for Platform DevID for TPM2”.

 

Next you need to identify the RIM. That might come f= rom the OS Vendor or from the device vendor or even a third party, none of = which are the TPM vendor. For example, with Android, Google produces the OS= , but it is open source and the phone (the device) vendor can modify it, so the RIM would probably come from the= phone/device vendor. It seems possible to have split RIMs where part comes= from the the OS vendor and part comes from the device vendor.

  [guy] Agreed &#= 8211; the RIM will almost certainly not come from the TPM vendor.  Thi= s seems fundamentally like a task for the system administrator, to decide w= ho they trust for RIMs.  If the OEM or software vendor ships RIMs, that seems like an obvious choice, but administrators can deci= de any way they want.

 

Seems like OS/device/3rd-party Vendor IDs, product n= ames and product versions are very non-uniform. You couldn’t write mu= ch generic Verifier code to work with them as they are today. The best atte= mpts at making these generic I know of seem EAT’s IEEE-based OEMID, and PSA’s EAN-13 based HW version, but= I don’t think these are enough. Maybe there is something else out th= ere. SWID of some sort? 

[guy] TCG has a draft = spec out for public review covering RIM.  'DRAFT: TCG Reference Integr= ity Manifest Information Model'

    https://trustedcomputinggroup.org/wp-content/= uploads/TCG_RIM_Model_v1-r13_2feb20.pdf

The doc is completely = based on ISO SWID, with the NIST guidelines.  There’s a CBOR var= iant called CoSWID at IETF (I think you can guess which Henk, out of the un= iverse of all Henks, you could ask for details!)

  If you have int= erest in commenting on the TCG RIM spec, I know the authors would be glad t= o hear from you.

  But about ident= ity of RIMs…

  The RIM is sign= ed, so once you’ve done the policy task of deciding which RIM supplie= r you like, verifying it is easy.  I realize of course that there̵= 7;s little commonality on how to name a product or version, but I’m not sure that matters.  The RIM corresponds to a very s= pecific product and release.  The vendor can call it whatever they wan= t, as long as they don’t issue two release with the same name.  = After that, I think it’s just a string compare.

  I suppose if th= ird-party RIM suppliers exist, then the RIM has to explicitly call out the = software manufacturer by name, but that’s already part of the SWID &a= mp; RIM specs.

  As far as we ca= n tell, SWID embodies sufficient flexibility to describe any software relea= se that can be expressed as files and directories.  I have a small pro= ject on my todo list to prove that for a Juniper release, but so far, I don’t see a problem.  Again, if you̵= 7;re interested, now is the time for review!

 

 

Agreed that the identifier of the RIM doesn’t = have to be secured / attested, just like key ID’s don’t have to= be. If the Verifier gets the wrong one, the verification just fails.<= /o:p>

 

This is certainly not a solved problem in the EAT sp= ace. Maybe there’s a solution in common? My first though is some sort= of URI, maybe related to SWID, that is part of the measurements in the Evi= dence sent to the Verifier. It doesn’t have to be mandatory or used by everyone, but it seems likely to benefit at lea= st some.

[guy] Henk might have = suggestion for potential commonality with EAT.  As noted, SWID is stro= ngly oriented to software releases with packages, directories and files, bu= t maybe there’s something useful there.

 

To be clear, I’m thinking that the Endorsement= of the TPM Attester is quite separate from the Endorsement that is the RIM= . They come from completely different vendors. The TPM Endorsement is of li= ttle use to identify the RIM.

[guy] Yes, in fact I t= hink there are at least three suppliers that could be verified; the TPM ven= dor, the hardware platform OEM who made the Attester, and the RIM supplier = who certifies the software image.  Given the way RIV is scoped, I think verification of the TPM itself is up to the= OEM, but verification of the OEM’s DevID and IAK is one thing, and v= erification of the authenticity of the RIM is another independent operation= , both of which  belong in a RATS-compatible Verifier.

  Let me know wha= t we’re missing!

  /guy=

 

LL

 

 

 

 

On Apr 9, 2020, at 7:31 AM, Guy Fedorkow <gfedorkow@juniper.net> wrote:=

 

Hi Laurence,

  I understand that the discussion on the topic= below mainly pertains to EAT, but I’d like to make sure we’re = not missing something on the RIV side.

  For OS software image integrity using a TPM, = it seems like finding the right manifest shouldn’t be that hard…= ;

  The Attester needs to have pre-provisioned id= entity and attestation keys as outlined in the RIV draft.  That provid= es the Verifier with the vendor identity for the root of trust.  The m= easurement logs contain the alleged product name and version number for the software installed on the box.  Use the ve= ndor ID to narrow the scope to specific vendor’s product and version = space, and find the RIM that matches.  Then check if the hashes line u= p; if so, you’re good, if not, either the claim of what software is present was incorrect, or something got hacked.

  Seems like a verifier could follow this same = model through the entire chain of trust, even through multiple vendors, as = long as there are no gaps in the chain.

  I know EAT needs to work in a less-constraine= d environment, but let me know if you think we’re oversimplifying thi= s on RIV.

 

  Thanks

/guy

 

 

 

Juniper Business Use Only

From:&n= bsp;RATS <rats-bounces@ietf.org> On Behalf Of Laurence Lundblade
Sent: Tuesday, Apr= il 7, 2020 3:13 PM
To: Thomas Fossati= <Thomas.Fossati@arm.com>
Cc: rats@ietf.org; N= ed Smith <ned.smith@intel.com>
Subject: Re: [Rats= ] Endorsement ID and verification key (was Processing Endorsements and Evid= ence into Results)

 

<= span style=3D"font-size:10.5pt;font-family:"Lato",sans-serif;colo= r:black">[External Email. Be cautious of content]

 

This is a reply to both Thomas and Ned’s messa= ge on debug in the related threat.

 

My inclination is to associate endorsements with tim= e-invariant characteristics of the device. At the moment this doesn’t= seem like the only way to do it, but it seems like a good way. Things that= are not time invariant are policy, k-g-v or such.

 

Endorsement

System architecture — Does the Attester use a = TEE or a TPM or maybe it is simple system with just a simple CPU, but it is= encased in titanium. Is defense against chip invasive attacks considered? = Do keys become inaccessible when debug is enabled.

 

Development process — Is there a special secur= ity-oriented team? Does the team have a code review policy? Is there a bug = bounty? Are the desktops and IT systems used for HW and SW development isol= ated?

 

Manufacturing — Are the factories secured in a= special way? Is the attestation key provisioning system hardened in some w= ay (e.g., uses HSMs).

 

Certifications — These take a long time to ach= ieve and will usually require some of the above.

 

My thinking for EAT was that you only put attestatio= n keys into devices that meet some criteria like some of the above. Since t= here is often no way to recover from a compromised attestation key because = no key more secure than it, you kind of have to have all that. 

 

Since these don’t change much over time, the e= ndorsement wouldn’t change.  They could even span several models= and varying HW.

 

Policy, K-G-V, other

SW Versions — As long as the SW follows a deve= lopment process like that above, it doesn’t have to be included in th= e endorsement. Of course the smaller the SW and the better the process, the= more it is true (and vice versa).

 

Blacklists — These might be specific to UEIDs,= versions of SW, deployments a particular OEM or such

 

Debug status — Most of the debug status values= can vary on a day-day basis

 

OEM model — If the attestation is implemented = by a chip vendor and the endorsement is for the chip, then the OEM model wi= ll vary widely.

 

None of these can be criteria as to whether an attes= tation key is put into a device or not as they are not known at manufacturi= ng time and/or must be allowed to vary widely after manufacturing.

 

 

I think what I’ve described above lines up pre= tty well for a TPM. The system architecture is mostly set by the TCG. HW TP= Ms are almost always certified. They are independent of OEM model. It also = lines up reasonably well with secure elements and can line up with TEE’s.  

 

The crux of endorsement to me is the security charac= teristics of the attester that protect the attestation key because there is= generally no recovery from a compromised attestation key. It sets the base= line risk of the HW and SW of the device.

 

 

On one extreme is a separate endorsement for every d= evice (“micro endorsement"?), which is what I think Thomas and A= RM PSA are tending towards. The other extreme is one endorsement for a prod= uct line (“macro endorsement"?),, say a product line of TPMs. Then it’s more like the data sheet for the product.&nb= sp; 

 

Then there’s different ways to fan this out to= the different key / signing schemes (per-device key, group key, ECDAA, X.5= 09). For example a macro-endorsement could include the root of an X.509 hie= rarchy and the individual devices (or groups of devices) would have individual keys that chain up. With a micro-endorse= ment the per-device public key could be per endorsement.

 

 

The most important thing about the endorsement seems= to me is the characterization of how the attestation key is protected.

 

LL

 

 

 

On Apr 7, 2020, at 7:36 AM, Thomas Fossati <Thomas.Fo= ssati@arm.com> wrote:

 

Hi Laurence,

Thanks for bringing this up.  A few thoughts below.

On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade"
<rats-bou= nces@ietf.org on behalf of lgl@island-resort.com> wrote:

So how does a Verifier find the applicable endorse= ment for Evidence it
wishes to verify and know that is really the right endorsement?

Seems like the Evidence needs some sort of an endorsement locator ID.
This could be a URL or a GUID. EAT currently has the origination claim
to try to solve this, but it is half-baked. It needs to get fixed. I’= m
fishing for comments here on what it should be like.

Pretty sure the Endorsement needs to include or reference the public
key that is used to verify the signature. Without that, the Attester
could lie and pick any old Endorsement that it wishes. There needs to
be some binding between items in the endorsement (E0, E1,…) and the verification key. That could be in the form of a signed token or
certificate, but doesn’t have to be. Pretty sure this needs to be
discussed in the architecture doc.

There's a few scenarios:
- One endorsement applies to lots of devices in the same class, but
 each has their own attestation key.
- - Probably ECDAA fits in here
- - One option here is an X509 hierarchy
- Group keys are used (for privacy reasons or other) so there is a
 one-one correlation with the Endorsements (the GEID discussion)
- Group keys are used, but across devices that have different
 endorsements so there’s no one-one correlation

While the last one seems odd and unlikely, I think it could occur,
because from a lot of real experience the set up of attestation keys
is very idiosyncratic. It is wildly affected by manufacturing costs
and issues on assembly lines, sub contractor structure, location of
secure facilities and approaches to making money on it. They are like
snowflakes, each one is different.  So maybe endorsement locator ID and key ID are not the same, but they can be in some use cases?

I am also tempted to encourage the placement of the endorsement
locator ID in the COSE or JOSE header parameters so you don’t have to=
parse the unverified body of claims to be able to find the key
material to verify it.

Thoughts?


A two level lookup key, model+instance, seems to be quite generally
applicable as an endorsement locator.  The model part would get you to=
the shared data (e.g., certification, measured boot KGVs, etc.), while
the instance part can be used to retrieve device-specific state:
verification key(s) as well as other metadata, e.g., if some gear is
blacklisted.  In PSA we have something quite (though not entirely)
similar with implementation and instance IDs [1] [2].

(Context-switching for a second on our previous UEID/GEID discussion: I
guess we might model an instance as an anonymity set, and therefore
treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?)

For the sake of building a shared and reusable vocabulary, I'd prefer
keeping model and instance identifiers as separate claims rather than
having an opaque endorsement ID claim that clumps together those and
possibly other stuff in a use-case specific fashion.  For the same
reason I would not override key ID with instance ID semantics.

cheers, thanks!

[1] https://www= .ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-implementation-id=
[2] https://www.ietf.= org/id/draft-tschofenig-rats-psa-token-05.html#name-instance-id<= span style=3D"font-size:9.0pt;font-family:"Helvetica",sans-serif"= >



IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
RATS mailing list
RATS@ietf.org=
https://www.ietf.org/mailman/listinf= o/rats

 

--_000_DM6PR05MB6889D66678CDE3F79244276CBADD0DM6PR05MB6889namp_-- From nobody Mon Apr 13 11:44:23 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40AFA3A1BDA for ; Mon, 13 Apr 2020 11:44:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.816 X-Spam-Level: X-Spam-Status: No, score=-1.816 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GwgGU5hOLXI8 for ; Mon, 13 Apr 2020 11:44:16 -0700 (PDT) Received: from p3plsmtpa08-09.prod.phx3.secureserver.net (p3plsmtpa08-09.prod.phx3.secureserver.net [173.201.193.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B5043A1BD7 for ; Mon, 13 Apr 2020 11:44:15 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id O446juCnbrDHlO447jOQhX; Mon, 13 Apr 2020 11:44:15 -0700 X-CMAE-Analysis: v=2.3 cv=WsJVzuXv c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=xt6ew7UTAAAA:8 a=OUXY8nFuAAAA:8 a=K6EGIJCdAAAA:8 a=48vgC7mUAAAA:8 a=QyXUC8HyAAAA:8 a=7CQSdrXTAAAA:8 a=uherdBYGAAAA:8 a=QKqaLUnCnK7NCZp3I_8A:9 a=IpVLTdgX98rHinHA:21 a=GPoj8F1e_TmAhzO_:21 a=QEXdDO2ut3YA:10 a=y9OUIGaxdF8A:10 a=kj6DBQF8G6IA:10 a=yu7Zdj4oUzMpwexNNuUA:9 a=fn9Q7Qq8dYcQmQS-:21 a=FzlNumEC3x81579l:21 a=CIpD3njzLOA_Sze1:21 a=_W_S_7VecoQA:10 a=tn93DeGZTgJ6DdWMtdD4:22 a=cAcMbU7R10T-QSRYIcO_:22 a=L6pVIi0Kn1GYQfi8-iRI:22 a=w1C3t2QeGrPiZgrLijVG:22 a=a-qgeE7W1pNrGK8U0ZQC:22 a=Ef4yma5cpRUEJWN9UqBm:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_0C7318AF-9557-4CF2-8400-34AE56E173EE" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 13 Apr 2020 11:44:14 -0700 In-Reply-To: Cc: "rats@ietf.org" , Ned Smith , Jessica Fitzgerald-McKay To: Guy Fedorkow References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfD6wEgsMpVRddqB7uZXqpWCmgxEpaZxBVWAhbm8dzrFmLsZEYP5F4uVRVPHVUeWnMiaEvwaIOPhjv4c2Eq1/6sdYV8YnE0rZrORuigg2zbFR39pjMZO5 ji7v2aZe4jfRInbt38zyha9qWo0IE8iPMa3y5u4mntmFUA/mcnB+3qufOEJByWEMzVRkfu3HzwhfQJ+NToOJ8NDNW/eopSaMib6wlnyoiOMmwIIH6TPLCa89 BU0cWGgcUG0iZk4Iv0NkJg== Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Apr 2020 18:44:22 -0000 --Apple-Mail=_0C7318AF-9557-4CF2-8400-34AE56E173EE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 So I suspect the router world is really different from the IoT world in = a way that affects the finding of RIMs.=20 Seems like the router world is a small number of manufacturers, less = than ten. Seems like routers are purchased and managed by very = technically competent staff that already work with lots of technical = details. It=E2=80=99s not that hard for network admins to go to the = router manufacturers web site and download a few RIMs and configure them = into their verifiers. Seems like the IoT world involves a much larger number of manufacturers, = hundreds or even thousands. IoT management is scattered and works in = lots of different ways. Sometimes it is the device maker itself. = Sometimes it is an enterprise. Sometimes it is a third party, maybe with = a fourth and fifth party... Phones have their own challenge =E2=80=94 they have huge numbers of = relying parties =E2=80=94 each app is a relying party. It seems a URI-based scheme for finding RIMs is important for the IoT = world, and maybe the phone world, but not so much for the router world. = Seems like it has to be URI-based because that=E2=80=99s the way to = identify a resource on the broad internet. It looks like the TCG RIM document = already has something like this as mentioned in Appendix C. = Not sure it is fully developed as it is in an appendix. The TCG Platform Certificate Profile [10] also defines a = PlatformConfigurationURI attribute that contains =E2=80=9CURI where the = reference integrity measurements could be obtained by the verifier=E2=80=9D= . The Platform Certificates Platform Configuration URI MUST hold a = reference to the location of the Primary RIM Bundle. The URI MAY point = to a location on the Endpoint platform or it MAY reside in a publicly = accessible location. The Base RIM MUST contain a LINK element that = points to the same URI as the Platform Certificates = PlatformConfigurationURI.=20 Glad to see the use of CoSWID. Seems like that will line up for EAT as = well. LL > On Apr 13, 2020, at 8:24 AM, Guy Fedorkow = wrote: >=20 > Hi Laurence, > Thanks for your response=E2=80=A6 I=E2=80=99ve added annotations, = marked with [guy]=E2=80=A6 > /guy > =20 > =20 > =20 > Juniper Business Use Only > From: Laurence Lundblade >=20 > Sent: Sunday, April 12, 2020 2:56 PM > To: Guy Fedorkow > > Cc: rats@ietf.org ; Ned Smith = > > Subject: Re: [Rats] Endorsement ID and verification key (was = Processing Endorsements and Evidence into Results) > =20 > =20 > Trying again, after re reading your question a few times (and a few = not-sent replies). > =20 > First you need the endorsement for the TPM that is serving as the = attester. This endorsement would come from the TPM vendor. I assume that = is fairly well understood and in practice today through TPM architecture = and conventions already in place with things like IDevID. (Maybe you all = know it, but I don=E2=80=99t know how this works. I would be interested = in references and/or a description of it). > [guy] Yes, I think most TPMs ship with a pre-provisioned Endorsement = Key and a certificate signed by the TPM manufacturer. Use of that key = is controlled to prevent unwanted privacy abuses, but it=E2=80=99s there = specifically to validate the source of the TPM. > For RIV, I=E2=80=99m not sure that needs to be done by the end-user = of the device=E2=80=A6 the OEM who makes the =E2=80=98router=E2=80=99 = (yes, or switch or firewall or access point) should pre-provision a = DevID signed by the OEM, and a trustworthy OEM wouldn=E2=80=99t sign an = IDevID in their facility without verifying that the TPM they=E2=80=99ve = just soldered down is authentic. > Some OEMs actually customize their TPMs slightly to contain their = own signature on the EK, rather than the TPM vendor=E2=80=99s, but I = don=E2=80=99t think that=E2=80=99s common. > In addition to the identity of the device itself, RIV depends on = verification of the certificate that goes with the TPM Attestation key. = We=E2=80=99ve made that as easy as possible in RIV by pre-provisioning = the IAK along with the IDevID, so the two will contain the same identity = information, signed by the same vendor. > For more-generic TPM applications where a pre-provisioned DevID may = be inappropriate, there=E2=80=99s a well-specified series of steps to = validate the TPM before remotely installing the ID or attestation keys. = The TCG spec with the gory details is still in draft, but if you have = TCG access, it=E2=80=99s called =E2=80=9CTPM Keys for Platform DevID for = TPM2=E2=80=9D. > =20 > Next you need to identify the RIM. That might come from the OS Vendor = or from the device vendor or even a third party, none of which are the = TPM vendor. For example, with Android, Google produces the OS, but it is = open source and the phone (the device) vendor can modify it, so the RIM = would probably come from the phone/device vendor. It seems possible to = have split RIMs where part comes from the the OS vendor and part comes = from the device vendor. > [guy] Agreed =E2=80=93 the RIM will almost certainly not come from = the TPM vendor. This seems fundamentally like a task for the system = administrator, to decide who they trust for RIMs. If the OEM or = software vendor ships RIMs, that seems like an obvious choice, but = administrators can decide any way they want. > =20 > Seems like OS/device/3rd-party Vendor IDs, product names and product = versions are very non-uniform. You couldn=E2=80=99t write much generic = Verifier code to work with them as they are today. The best attempts at = making these generic I know of seem EAT=E2=80=99s IEEE-based OEMID, and = PSA=E2=80=99s EAN-13 based HW version, but I don=E2=80=99t think these = are enough. Maybe there is something else out there. SWID of some sort?=20= > [guy] TCG has a draft spec out for public review covering RIM. = 'DRAFT: TCG Reference Integrity Manifest Information Model' > = https://trustedcomputinggroup.org/wp-content/uploads/TCG_RIM_Model_v1-r13_= 2feb20.pdf = > The doc is completely based on ISO SWID, with the NIST guidelines. = There=E2=80=99s a CBOR variant called CoSWID at IETF (I think you can = guess which Henk, out of the universe of all Henks, you could ask for = details!) > If you have interest in commenting on the TCG RIM spec, I know the = authors would be glad to hear from you. > But about identity of RIMs=E2=80=A6 > The RIM is signed, so once you=E2=80=99ve done the policy task of = deciding which RIM supplier you like, verifying it is easy. I realize = of course that there=E2=80=99s little commonality on how to name a = product or version, but I=E2=80=99m not sure that matters. The RIM = corresponds to a very specific product and release. The vendor can call = it whatever they want, as long as they don=E2=80=99t issue two release = with the same name. After that, I think it=E2=80=99s just a string = compare. > I suppose if third-party RIM suppliers exist, then the RIM has to = explicitly call out the software manufacturer by name, but that=E2=80=99s = already part of the SWID & RIM specs. > As far as we can tell, SWID embodies sufficient flexibility to = describe any software release that can be expressed as files and = directories. I have a small project on my todo list to prove that for a = Juniper release, but so far, I don=E2=80=99t see a problem. Again, if = you=E2=80=99re interested, now is the time for review! > =20 > =20 > Agreed that the identifier of the RIM doesn=E2=80=99t have to be = secured / attested, just like key ID=E2=80=99s don=E2=80=99t have to be. = If the Verifier gets the wrong one, the verification just fails. > =20 > This is certainly not a solved problem in the EAT space. Maybe = there=E2=80=99s a solution in common? My first though is some sort of = URI, maybe related to SWID, that is part of the measurements in the = Evidence sent to the Verifier. It doesn=E2=80=99t have to be mandatory = or used by everyone, but it seems likely to benefit at least some. > [guy] Henk might have suggestion for potential commonality with EAT. = As noted, SWID is strongly oriented to software releases with packages, = directories and files, but maybe there=E2=80=99s something useful there. > =20 > To be clear, I=E2=80=99m thinking that the Endorsement of the TPM = Attester is quite separate from the Endorsement that is the RIM. They = come from completely different vendors. The TPM Endorsement is of little = use to identify the RIM. > [guy] Yes, in fact I think there are at least three suppliers that = could be verified; the TPM vendor, the hardware platform OEM who made = the Attester, and the RIM supplier who certifies the software image. = Given the way RIV is scoped, I think verification of the TPM itself is = up to the OEM, but verification of the OEM=E2=80=99s DevID and IAK is = one thing, and verification of the authenticity of the RIM is another = independent operation, both of which belong in a RATS-compatible = Verifier. > Let me know what we=E2=80=99re missing! > /guy > =20 > LL > =20 > =20 > =20 > =20 >=20 > On Apr 9, 2020, at 7:31 AM, Guy Fedorkow > wrote: > =20 > Hi Laurence, > I understand that the discussion on the topic below mainly pertains = to EAT, but I=E2=80=99d like to make sure we=E2=80=99re not missing = something on the RIV side. > For OS software image integrity using a TPM, it seems like finding = the right manifest shouldn=E2=80=99t be that hard=E2=80=A6 > The Attester needs to have pre-provisioned identity and attestation = keys as outlined in the RIV draft. That provides the Verifier with the = vendor identity for the root of trust. The measurement logs contain the = alleged product name and version number for the software installed on = the box. Use the vendor ID to narrow the scope to specific vendor=E2=80=99= s product and version space, and find the RIM that matches. Then check = if the hashes line up; if so, you=E2=80=99re good, if not, either the = claim of what software is present was incorrect, or something got = hacked. > Seems like a verifier could follow this same model through the = entire chain of trust, even through multiple vendors, as long as there = are no gaps in the chain. > I know EAT needs to work in a less-constrained environment, but let = me know if you think we=E2=80=99re oversimplifying this on RIV. > =20 > Thanks > /guy > =20 > =20 > =20 > Juniper Business Use Only > From: RATS > On = Behalf Of Laurence Lundblade > Sent: Tuesday, April 7, 2020 3:13 PM > To: Thomas Fossati > > Cc: rats@ietf.org ; Ned Smith = > > Subject: Re: [Rats] Endorsement ID and verification key (was = Processing Endorsements and Evidence into Results) > =20 > [External Email. Be cautious of content] > =20 > This is a reply to both Thomas and Ned=E2=80=99s message on debug in = the related threat. > =20 > My inclination is to associate endorsements with time-invariant = characteristics of the device. At the moment this doesn=E2=80=99t seem = like the only way to do it, but it seems like a good way. Things that = are not time invariant are policy, k-g-v or such. > =20 > Endorsement > System architecture =E2=80=94 Does the Attester use a TEE or a TPM or = maybe it is simple system with just a simple CPU, but it is encased in = titanium. Is defense against chip invasive attacks considered? Do keys = become inaccessible when debug is enabled. > =20 > Development process =E2=80=94 Is there a special security-oriented = team? Does the team have a code review policy? Is there a bug bounty? = Are the desktops and IT systems used for HW and SW development isolated? > =20 > Manufacturing =E2=80=94 Are the factories secured in a special way? Is = the attestation key provisioning system hardened in some way (e.g., uses = HSMs). > =20 > Certifications =E2=80=94 These take a long time to achieve and will = usually require some of the above. > =20 > My thinking for EAT was that you only put attestation keys into = devices that meet some criteria like some of the above. Since there is = often no way to recover from a compromised attestation key because no = key more secure than it, you kind of have to have all that.=20 > =20 > Since these don=E2=80=99t change much over time, the endorsement = wouldn=E2=80=99t change. They could even span several models and = varying HW. > =20 > Policy, K-G-V, other > SW Versions =E2=80=94 As long as the SW follows a development process = like that above, it doesn=E2=80=99t have to be included in the = endorsement. Of course the smaller the SW and the better the process, = the more it is true (and vice versa). > =20 > Blacklists =E2=80=94 These might be specific to UEIDs, versions of SW, = deployments a particular OEM or such > =20 > Debug status =E2=80=94 Most of the debug status values can vary on a = day-day basis > =20 > OEM model =E2=80=94 If the attestation is implemented by a chip vendor = and the endorsement is for the chip, then the OEM model will vary = widely. > =20 > None of these can be criteria as to whether an attestation key is put = into a device or not as they are not known at manufacturing time and/or = must be allowed to vary widely after manufacturing. > =20 > =20 > I think what I=E2=80=99ve described above lines up pretty well for a = TPM. The system architecture is mostly set by the TCG. HW TPMs are = almost always certified. They are independent of OEM model. It also = lines up reasonably well with secure elements and can line up with = TEE=E2=80=99s. =20 > =20 > The crux of endorsement to me is the security characteristics of the = attester that protect the attestation key because there is generally no = recovery from a compromised attestation key. It sets the baseline risk = of the HW and SW of the device. > =20 > =20 > On one extreme is a separate endorsement for every device (=E2=80=9Cmicr= o endorsement"?), which is what I think Thomas and ARM PSA are tending = towards. The other extreme is one endorsement for a product line = (=E2=80=9Cmacro endorsement"?),, say a product line of TPMs. Then it=E2=80= =99s more like the data sheet for the product. =20 > =20 > Then there=E2=80=99s different ways to fan this out to the different = key / signing schemes (per-device key, group key, ECDAA, X.509). For = example a macro-endorsement could include the root of an X.509 hierarchy = and the individual devices (or groups of devices) would have individual = keys that chain up. With a micro-endorsement the per-device public key = could be per endorsement. > =20 > =20 > The most important thing about the endorsement seems to me is the = characterization of how the attestation key is protected. > =20 > LL > =20 > =20 > =20 >=20 > On Apr 7, 2020, at 7:36 AM, Thomas Fossati > wrote: > =20 > Hi Laurence, >=20 > Thanks for bringing this up. A few thoughts below. >=20 > On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" > on behalf of = lgl@island-resort.com > wrote: >=20 > So how does a Verifier find the applicable endorsement for Evidence it > wishes to verify and know that is really the right endorsement? >=20 > Seems like the Evidence needs some sort of an endorsement locator ID. > This could be a URL or a GUID. EAT currently has the origination claim > to try to solve this, but it is half-baked. It needs to get fixed. = I=E2=80=99m > fishing for comments here on what it should be like. >=20 > Pretty sure the Endorsement needs to include or reference the public > key that is used to verify the signature. Without that, the Attester > could lie and pick any old Endorsement that it wishes. There needs to > be some binding between items in the endorsement (E0, E1,=E2=80=A6) = and the > verification key. That could be in the form of a signed token or > certificate, but doesn=E2=80=99t have to be. Pretty sure this needs to = be > discussed in the architecture doc. >=20 > There's a few scenarios: > - One endorsement applies to lots of devices in the same class, but > each has their own attestation key. > - - Probably ECDAA fits in here > - - One option here is an X509 hierarchy > - Group keys are used (for privacy reasons or other) so there is a > one-one correlation with the Endorsements (the GEID discussion) > - Group keys are used, but across devices that have different > endorsements so there=E2=80=99s no one-one correlation >=20 > While the last one seems odd and unlikely, I think it could occur, > because from a lot of real experience the set up of attestation keys > is very idiosyncratic. It is wildly affected by manufacturing costs > and issues on assembly lines, sub contractor structure, location of > secure facilities and approaches to making money on it. They are like > snowflakes, each one is different. So maybe endorsement locator ID > and key ID are not the same, but they can be in some use cases? >=20 > I am also tempted to encourage the placement of the endorsement > locator ID in the COSE or JOSE header parameters so you don=E2=80=99t = have to > parse the unverified body of claims to be able to find the key > material to verify it. >=20 > Thoughts? >=20 > A two level lookup key, model+instance, seems to be quite generally > applicable as an endorsement locator. The model part would get you to > the shared data (e.g., certification, measured boot KGVs, etc.), while > the instance part can be used to retrieve device-specific state: > verification key(s) as well as other metadata, e.g., if some gear is > blacklisted. In PSA we have something quite (though not entirely) > similar with implementation and instance IDs [1] [2]. >=20 > (Context-switching for a second on our previous UEID/GEID discussion: = I > guess we might model an instance as an anonymity set, and therefore > treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?) >=20 > For the sake of building a shared and reusable vocabulary, I'd prefer > keeping model and instance identifiers as separate claims rather than > having an opaque endorsement ID claim that clumps together those and > possibly other stuff in a use-case specific fashion. For the same > reason I would not override key ID with instance ID semantics. >=20 > cheers, thanks! >=20 > [1] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-imple= mentation-id = > [2] = https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-insta= nce-id = >=20 >=20 >=20 > IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = > =20 --Apple-Mail=_0C7318AF-9557-4CF2-8400-34AE56E173EE Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 So = I suspect the router world is really different from the IoT world in a = way that affects the finding of RIMs. 

Seems like the router world is a small = number of manufacturers, less than ten. Seems like routers are purchased = and managed by very technically competent staff that already work with = lots of technical details. It=E2=80=99s not that hard for network admins = to go to the router manufacturers web site and download a few RIMs and = configure them into their verifiers.

Seems like the IoT world involves a = much larger number of manufacturers, hundreds or even thousands. IoT = management is scattered and works in lots of different ways. Sometimes = it is the device maker itself. Sometimes it is an enterprise. Sometimes = it is a third party, maybe with a fourth and fifth party...

Phones have their own = challenge =E2=80=94 they have huge numbers of relying parties =E2=80=94 = each app is a relying party.

It seems a URI-based scheme for finding = RIMs is important for the IoT world, and maybe the phone world, but not = so much for the router world. Seems like it has to be URI-based because = that=E2=80=99s the way to identify a resource on the broad = internet.

It = looks like the TCG RIM document already has = something like this as mentioned in Appendix C. Not sure it is fully = developed as it is in an appendix.

The TCG Platform Certificate Profile = [10] also defines a PlatformConfigurationURI attribute that = contains =E2=80=9CURI where the reference integrity measurements could be obtained by the = verifier=E2=80=9D. The = Platform Certificates Platform Configuration URI MUST hold a reference to the location of the Primary = RIM Bundle. The URI MAY point to a location on the Endpoint platform or it MAY reside in a publicly = accessible location. The Base RIM MUST contain a LINK element that points to the same URI as the Platform Certificates = PlatformConfigurationURI. 


Glad to = see the use of CoSWID. Seems like that will line up for EAT as = well.

LL


On Apr 13, 2020, at 8:24 AM, Guy Fedorkow <gfedorkow@juniper.net> wrote:

Hi = Laurence,
  Thanks for your response=E2=80=A6  I=E2=80=99ve = added annotations, marked with [guy]=E2=80=A6
/guy
 
 
 
Juniper Business = Use Only
From: Laurence Lundblade <lgl@island-resort.com> 
Sent: Sunday, April 12, 2020 2:56 = PM
To: Guy Fedorkow <gfedorkow@juniper.net>
Cc: rats@ietf.org; Ned Smith <ned.smith@intel.com>
Subject: Re: [Rats] Endorsement ID = and verification key (was Processing Endorsements and Evidence into = Results)
 
 
Trying again, after re reading your = question a few times (and a few not-sent replies).
 
First you need the endorsement for the = TPM that is serving as the attester. This endorsement would come from = the TPM vendor. I assume that is fairly well understood and in practice = today through TPM architecture and conventions already in place with = things like IDevID. (Maybe you all know it, but I don=E2=80=99t know how = this works. I would be interested in references and/or a description of = it).
[guy] Yes, I think most = TPMs ship with a pre-provisioned Endorsement Key and a certificate = signed by the TPM manufacturer.  Use of that key is controlled to = prevent unwanted privacy abuses, but it=E2=80=99s there specifically to = validate the source of the TPM.
  For RIV, I=E2=80=99m not sure that needs to be = done by the end-user of the device=E2=80=A6  the OEM who makes the = =E2=80=98router=E2=80=99 (yes, or switch or firewall or access point) = should pre-provision a DevID signed by the OEM, and a trustworthy OEM = wouldn=E2=80=99t sign an IDevID in their facility without verifying that = the TPM they=E2=80=99ve just soldered down is authentic.
  Some OEMs actually = customize their TPMs slightly to contain their own signature on the EK, = rather than the TPM vendor=E2=80=99s, but I don=E2=80=99t think that=E2=80= =99s common.
  In = addition to the identity of the device itself, RIV depends on = verification of the certificate that goes with the TPM Attestation = key.  We=E2=80=99ve made that as easy as possible in RIV by = pre-provisioning the IAK along with the IDevID, so the two will contain = the same identity information, signed by the same vendor.
  = For more-generic TPM applications where a pre-provisioned DevID may be = inappropriate, there=E2=80=99s a well-specified series of steps to = validate the TPM before remotely installing the ID or attestation = keys.  The TCG spec with the gory details is still in draft, but if = you have TCG access, it=E2=80=99s called =E2=80=9CTPM Keys for Platform = DevID for TPM2=E2=80=9D.
 
Next you need to identify the RIM. That might come from the = OS Vendor or from the device vendor or even a third party, none of which = are the TPM vendor. For example, with Android, Google produces the OS, = but it is open source and the phone (the device) vendor can modify it, = so the RIM would probably come from the phone/device vendor. It seems = possible to have split RIMs where part comes from the the OS vendor and = part comes from the device vendor.
  [guy] Agreed =E2=80=93 the RIM will almost = certainly not come from the TPM vendor.  This seems fundamentally = like a task for the system administrator, to decide who they trust for = RIMs.  If the OEM or software vendor ships RIMs, that seems like an = obvious choice, but administrators can decide any way they want.
 
Seems like OS/device/3rd-party Vendor = IDs, product names and product versions are very non-uniform. You = couldn=E2=80=99t write much generic Verifier code to work with them as = they are today. The best attempts at making these generic I know of seem = EAT=E2=80=99s IEEE-based OEMID, and PSA=E2=80=99s EAN-13 based HW = version, but I don=E2=80=99t think these are enough. Maybe there is = something else out there. SWID of some sort? 
[guy] TCG has a draft spec = out for public review covering RIM.  'DRAFT: TCG Reference = Integrity Manifest Information Model'
    https://trustedcomputinggroup.org/wp-content/uploads/TCG_RIM_Mo= del_v1-r13_2feb20.pdf
The doc is completely based on ISO SWID, with the NIST = guidelines.  There=E2=80=99s a CBOR variant called CoSWID at IETF = (I think you can guess which Henk, out of the universe of all Henks, you = could ask for details!)
  If you have interest in commenting on the TCG = RIM spec, I know the authors would be glad to hear from you.
  But about identity = of RIMs=E2=80=A6
  = The RIM is signed, so once you=E2=80=99ve done the policy task of = deciding which RIM supplier you like, verifying it is easy.  I = realize of course that there=E2=80=99s little commonality on how to name = a product or version, but I=E2=80=99m not sure that matters.  The = RIM corresponds to a very specific product and release.  The vendor = can call it whatever they want, as long as they don=E2=80=99t issue two = release with the same name.  After that, I think it=E2=80=99s just = a string compare.
  I = suppose if third-party RIM suppliers exist, then the RIM has to = explicitly call out the software manufacturer by name, but that=E2=80=99s = already part of the SWID & RIM specs.
  As far as we can = tell, SWID embodies sufficient flexibility to describe any software = release that can be expressed as files and directories.  I have a = small project on my todo list to prove that for a Juniper release, but = so far, I don=E2=80=99t see a problem.  Again, if you=E2=80=99re = interested, now is the time for review!
 
 
Agreed that the identifier of the RIM = doesn=E2=80=99t have to be secured / attested, just like key ID=E2=80=99s = don=E2=80=99t have to be. If the Verifier gets the wrong one, the = verification just fails.
 
This is certainly not a solved problem in the EAT space. = Maybe there=E2=80=99s a solution in common? My first though is some sort = of URI, maybe related to SWID, that is part of the measurements in the = Evidence sent to the Verifier. It doesn=E2=80=99t have to be mandatory = or used by everyone, but it seems likely to benefit at least some.
[guy] Henk might have = suggestion for potential commonality with EAT.  As noted, SWID is = strongly oriented to software releases with packages, directories and = files, but maybe there=E2=80=99s something useful there.
 
To be clear, I=E2=80=99m thinking that = the Endorsement of the TPM Attester is quite separate from the = Endorsement that is the RIM. They come from completely different = vendors. The TPM Endorsement is of little use to identify the RIM.
[guy] Yes, in fact I think = there are at least three suppliers that could be verified; the TPM = vendor, the hardware platform OEM who made the Attester, and the RIM = supplier who certifies the software image.  Given the way RIV is = scoped, I think verification of the TPM itself is up to the OEM, but = verification of the OEM=E2=80=99s DevID and IAK is one thing, and = verification of the authenticity of the RIM is another independent = operation, both of which  belong in a RATS-compatible Verifier.
  Let me know what = we=E2=80=99re missing!
  /guy
 
LL
 
 
 

 

On Apr 9, 2020, at 7:31 AM, Guy Fedorkow <gfedorkow@juniper.net> = wrote:
 
Hi Laurence,
  I understand that the discussion on the topic below = mainly pertains to EAT, but I=E2=80=99d like to make sure we=E2=80=99re = not missing something on the RIV side.
  For OS software image integrity using a TPM, it seems = like finding the right manifest shouldn=E2=80=99t be that hard=E2=80=A6
  The Attester needs to have pre-provisioned identity = and attestation keys as outlined in the RIV draft.  That provides = the Verifier with the vendor identity for the root of trust.  The = measurement logs contain the alleged product name and version number for = the software installed on the box.  Use the vendor ID to narrow the = scope to specific vendor=E2=80=99s product and version space, and find = the RIM that matches.  Then check if the hashes line up; if so, = you=E2=80=99re good, if not, either the claim of what software is = present was incorrect, or something got hacked.
  Seems like a verifier could follow this same model = through the entire chain of trust, even through multiple vendors, as = long as there are no gaps in the chain.
  I know EAT needs to work in a less-constrained = environment, but let me know if you think we=E2=80=99re oversimplifying = this on RIV.
 
  Thanks
/guy
 
 
 
Juniper Business Use Only
From: RATS <rats-bounces@ietf.org> On Behalf = Of Laurence = Lundblade
Sent: Tuesday, April 7, 2020 3:13 = PM
To: Thomas Fossati <Thomas.Fossati@arm.com>
Cc: rats@ietf.org; Ned Smith <ned.smith@intel.com>
Subject: Re: [Rats] Endorsement ID = and verification key (was Processing Endorsements and Evidence into = Results)
 
[External Email. Be cautious of = content]
 
This is a reply to both = Thomas and Ned=E2=80=99s message on debug in the related threat.
 
My inclination is to associate = endorsements with time-invariant characteristics of the device. At the = moment this doesn=E2=80=99t seem like the only way to do it, but it = seems like a good way. Things that are not time invariant are policy, = k-g-v or such.
 
Endorsement
System architecture =E2=80=94 Does the = Attester use a TEE or a TPM or maybe it is simple system with just a = simple CPU, but it is encased in titanium. Is defense against chip = invasive attacks considered? Do keys become inaccessible when debug is = enabled.
 
Development process =E2=80=94 Is there = a special security-oriented team? Does the team have a code review = policy? Is there a bug bounty? Are the desktops and IT systems used for = HW and SW development isolated?
 
Manufacturing =E2=80=94 Are the = factories secured in a special way? Is the attestation key provisioning = system hardened in some way (e.g., uses HSMs).
 
Certifications =E2=80=94 These take a = long time to achieve and will usually require some of the above.
 
My thinking for EAT was = that you only put attestation keys into devices that meet some criteria = like some of the above. Since there is often no way to recover from a = compromised attestation key because no key more secure than it, you kind = of have to have all that. 
 
Since these don=E2=80=99t change much = over time, the endorsement wouldn=E2=80=99t change.  They could = even span several models and varying HW.
 
Policy, = K-G-V, other
SW Versions =E2=80=94 As = long as the SW follows a development process like that above, it = doesn=E2=80=99t have to be included in the endorsement. Of course the = smaller the SW and the better the process, the more it is true (and vice = versa).
 
Blacklists =E2=80=94 These might be = specific to UEIDs, versions of SW, deployments a particular OEM or = such
 
Debug status =E2=80=94 Most of the = debug status values can vary on a day-day basis
 
OEM model =E2=80=94 If the attestation = is implemented by a chip vendor and the endorsement is for the chip, = then the OEM model will vary widely.
 
None of these can be criteria as to = whether an attestation key is put into a device or not as they are not = known at manufacturing time and/or must be allowed to vary widely after = manufacturing.
 
 
I think what I=E2=80=99ve described = above lines up pretty well for a TPM. The system architecture is mostly = set by the TCG. HW TPMs are almost always certified. They are = independent of OEM model. It also lines up reasonably well with secure = elements and can line up with TEE=E2=80=99s.  
 
The crux of endorsement to me is the = security characteristics of the attester that protect the attestation = key because there is generally no recovery from a compromised = attestation key. It sets the baseline risk of the HW and SW of the = device.
 
 
On one extreme is a separate endorsement for every device = (=E2=80=9Cmicro endorsement"?), which is what I think Thomas and ARM PSA = are tending towards. The other extreme is one endorsement for a product = line (=E2=80=9Cmacro endorsement"?),, say a product line of TPMs. = Then it=E2=80=99s more like the data sheet for the product.  
 
Then there=E2=80=99s different ways to = fan this out to the different key / signing schemes (per-device key, = group key, ECDAA, X.509). For example a macro-endorsement could include = the root of an X.509 hierarchy and the individual devices (or groups of = devices) would have individual keys that chain up. With a = micro-endorsement the per-device public key could be per = endorsement.
 
 
The most important thing about the = endorsement seems to me is the characterization of how the attestation = key is protected.
 
LL
 
 

 

On Apr 7, = 2020, at 7:36 AM, Thomas Fossati <Thomas.Fossati@arm.com> wrote:
 

Hi Laurence,

Thanks for bringing this up.  A few = thoughts below.

On 03/04/2020, 20:37, "RATS = on behalf of Laurence Lundblade"
<rats-bounces@ietf.org on behalf of lgl@island-resort.com> = wrote:

So how does a Verifier find the applicable = endorsement for Evidence it
wishes to verify and know that = is really the right endorsement?

Seems like = the Evidence needs some sort of an endorsement locator ID.
This could be a URL or a GUID. EAT currently has the = origination claim
to try to solve this, but it is = half-baked. It needs to get fixed. I=E2=80=99m
fishing for = comments here on what it should be like.

Pretty sure the Endorsement needs to include or reference the = public
key that is used to verify the signature. Without = that, the Attester
could lie and pick any old Endorsement = that it wishes. There needs to
be some binding between = items in the endorsement (E0, E1,=E2=80=A6) and the
verification key. That could be in the form of a signed token = or
certificate, but doesn=E2=80=99t have to be. Pretty = sure this needs to be
discussed in the architecture = doc.

There's a few scenarios:
-= One endorsement applies to lots of devices in the same class, but
 each has their own attestation key.
- - = Probably ECDAA fits in here
- - One option here is an X509 = hierarchy
- Group keys are used (for privacy reasons or = other) so there is a
 one-one correlation with the = Endorsements (the GEID discussion)
- Group keys are used, = but across devices that have different
 endorsements = so there=E2=80=99s no one-one correlation

While the last one seems odd and unlikely, I think it could = occur,
because from a lot of real experience the set up of = attestation keys
is very idiosyncratic. It is wildly = affected by manufacturing costs
and issues on assembly = lines, sub contractor structure, location of
secure = facilities and approaches to making money on it. They are like
snowflakes, each one is different.  So maybe endorsement = locator ID
and key ID are not the same, but they can be in = some use cases?

I am also tempted to = encourage the placement of the endorsement
locator ID in = the COSE or JOSE header parameters so you don=E2=80=99t have to
parse the unverified body of claims to be able to find the = key
material to verify it.

Thoughts?

A two = level lookup key, model+instance, seems to be quite generally
applicable as an endorsement locator.  The model part = would get you to
the shared data (e.g., certification, = measured boot KGVs, etc.), while
the instance part can be = used to retrieve device-specific state:
verification = key(s) as well as other metadata, e.g., if some gear is
blacklisted.  In PSA we have something quite (though not = entirely)
similar with implementation and instance IDs [1] = [2].

(Context-switching for a second on our = previous UEID/GEID discussion: I
guess we might model an = instance as an anonymity set, and therefore
treat EUIDs as = the special case GEIDs with cardinality =3D=3D 1?)

For the sake of building a shared and reusable vocabulary, = I'd prefer
keeping model and instance identifiers as = separate claims rather than
having an opaque endorsement = ID claim that clumps together those and
possibly other = stuff in a use-case specific fashion.  For the same
reason I would not override key ID with instance ID = semantics.

cheers, thanks!

[1] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-implementation-id
[2] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html= #name-instance-id



IMPORTANT NOTICE: The contents of this email = and any attachments are confidential and may also be privileged. If you = are not the intended recipient, please notify the sender immediately and = do not disclose the contents to any other person, use it for any = purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats
 
= --Apple-Mail=_0C7318AF-9557-4CF2-8400-34AE56E173EE-- From nobody Mon Apr 13 12:18:59 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A2943A1C90 for ; Mon, 13 Apr 2020 12:18:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.166 X-Spam-Level: X-Spam-Status: No, score=-2.166 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=OlBc3BN6; dkim=pass (1024-bit key) header.d=juniper.net header.b=UnFj+jWZ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e_tRPVvLSBSc for ; Mon, 13 Apr 2020 12:18:53 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CA053A1C86 for ; Mon, 13 Apr 2020 12:18:53 -0700 (PDT) Received: from pps.filterd (m0108161.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 03DJI4uU022740; Mon, 13 Apr 2020 12:18:52 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=d3NCm//xyHJVtGNqrA7v8tKDXeoGmSaHlwK/T0YqwGQ=; b=OlBc3BN6vZFajDAKf+qOQC65f7bjkaAj066jIRpOS5CPWSnAS7nibMlEeqR5tXfiwA5Z tjiE57zQOkeBcFw8XnJx/B24E4apSg+AR/1EQQeg9+QAljzk/FUWtkxh2xFsmJJ/QV0N ZCtI2giadRIjpIKU/WOWIhlQiQy8Z5DosGxIygm6df2sYfZWZb/7NhaoDG1Eq8N6vmjs /9xZOu+1TZBXNlEPk1l70oB4l0UgmxgORLM8ZJpI1DBv0ERarHJkE/1ZlbHiYfC0l8/k QQdEuwqcwt4j8y1YMS9YQvbSSgfLftzxjQZSKJomfRByMBEFNeGiDUSCCrl0yY0mWUfg 0Q== Received: from nam11-dm6-obe.outbound.protection.outlook.com (mail-dm6nam11lp2170.outbound.protection.outlook.com [104.47.57.170]) by mx0b-00273201.pphosted.com with ESMTP id 30bd0xtwhv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Apr 2020 12:18:51 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HFBmMSVHLLOuaMh+P1TqSdnnqhseLcO0+xdHucVRuLLcJtDqqC8UaCdZLt0ZMNkbPTDOLkw2gkqSjVaaocIo4V1Sk9XBLTazNwRBQlFwktzvNG/w/DhpQhtaZB2G5UiFb3NEJIxXMZxjMriEqQk34Hkkg4S1+GcZVb3d6R2FbiTcWu4XukM5iSyZQgpCKdeO+N1joRrIncDVBghV80LyPFTp3bL1CTSqTE3YDw9e9gsT/RYztkokxqpslzeShs3/lxu6G9fRJc2zvcvT5/C2DwNI7hLaGEBmNHVFambdku3A8LTe/0OHbJxQT9T0d5AlrkavAUu+mcDaljJfOUUnGw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=d3NCm//xyHJVtGNqrA7v8tKDXeoGmSaHlwK/T0YqwGQ=; b=AYiXk6UU8VKwALtQGSHEMTJabsDnBOI/V2G7Ry2l8Kf3Kdpv1KEKVqGWb3RglFAjChgfbdRiFWwm5Ir3LxOkYB4e6HZDTcU2Y+bEzKxzzE47i2Pspc/+I63DE4fzW76dYxIbkhPh0AftWo8tObzr99zAKdTG89s2F/hCgJ1PgkH9v+egOnmcaLWHSV66sZpOT0c5QfN/Nve9UlmaolSW2DlTllyQ9EBfMDjT0Da150ev+hB1A3vfbMh/hyYwN/4KOno1JUyS3B8UYZ8ZVGXhyrZEy7xp7eFJ4g53Ek999YKSxSHlEmtbyHiBGr+krjXikdnMp2Ey5PYJ+sCOuMVSNw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=d3NCm//xyHJVtGNqrA7v8tKDXeoGmSaHlwK/T0YqwGQ=; b=UnFj+jWZnaMcqGRFts4ttziG/zscgwAOByR5mFEdBvnBJ7m10ZeaRITIFYSk7HN4C4yHHgHuyhWw83ZBYz8Tclr9QbAGajM/LcwJB63+415AXd5+rwrLfsrKr5KFHJA5B8BZUduz0rUcRZ7BpwPSyoTgBnIRMCk33HpTQ95l2Qw= Received: from DM6PR05MB6889.namprd05.prod.outlook.com (2603:10b6:5:204::22) by DM6PR05MB6297.namprd05.prod.outlook.com (2603:10b6:5:105::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2921.24; Mon, 13 Apr 2020 19:18:49 +0000 Received: from DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1]) by DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1%7]) with mapi id 15.20.2921.024; Mon, 13 Apr 2020 19:18:49 +0000 From: Guy Fedorkow To: Laurence Lundblade CC: "rats@ietf.org" , Ned Smith , Jessica Fitzgerald-McKay Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9b/q6maJEL0kaGXfcqT+zj8qhtv9mAgABNSQCAAtK/EIAFBFeAgAFKleCAAERiAIAACIQQ Date: Mon, 13 Apr 2020 19:18:49 +0000 Message-ID: References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-13T19:18:48.0122256Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=cf73fe7b-ae45-46de-bc91-3d3d7429a851; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic dlp-product: dlpe-windows dlp-version: 11.3.2.8 dlp-reaction: no-action x-originating-ip: [66.129.241.13] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: d25fb521-e1b1-4fa1-e0aa-08d7dfdf7f0a x-ms-traffictypediagnostic: DM6PR05MB6297: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 037291602B x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR05MB6889.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(396003)(39860400002)(346002)(136003)(366004)(376002)(66446008)(66946007)(2906002)(54906003)(9686003)(316002)(64756008)(76116006)(186003)(7696005)(26005)(6506007)(66556008)(66476007)(53546011)(55016002)(66574012)(52536014)(6916009)(30864003)(33656002)(4326008)(478600001)(5660300002)(8676002)(15650500001)(71200400001)(86362001)(9326002)(966005)(8936002)(81156014)(15398625002); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: dFvRedNV0DqiW4+tXoyiWF2sNKsXnMUMFFmPRGtN/62iLnS1BlyKAiHr3NCwgARfRybtHWaSu15t9REq5L4ieVN/aEaPdEpqsFIBoXHCg0T7llaBK396CWpCN9f7J7TPnyMiXvyJB6A744cEGDNmXRZxX2RalJC300VuA6f/QSBsTconj7cKEp9uXnT8TkBppR2WAaTImCQwqJZHxJkvu2MnQBQ86hhVgz/wc+4i8O/Z7i16GN6lHLzo5YuzN6qIJENzKWeTb8OYt1YhDg05d6G2HCanhcAlXFFBvXB7R/8Yl6JCbGoMjTN4uSbuBe2ivbaAtygSbpM6ZQz4NKpF2ESoO9i4QQ0MVsqkHpMPKqyd/hzNZ/lXjGFkOq24aGHY4SY1U4E9xl9SF0bxQFcaKrNcsnNjQqjYowAtC8ii4LlwTOOv1ikyjDi0WsjdWMgVCpxR4EYUnG/7oxjfMqRunZQKSuYmPFOPP1yyLZrxNsoJMzqaPhf30nuCK6SgQPbdifQzNKf67yNOU+KG3/KrwUB2sxw+ZF0ZmrE/bnGvUc/4E6cWxIL7kfxj5QbQV/tR x-ms-exchange-antispam-messagedata: hrsVzH34oUn33Lnwe/dISfT8lzJ7P3B+U0JSdlI7N1xxLS6vt6NTgN+Y5MhLa/dKfwPv0ErkGMxij5MOlhD1WjGP3xxNiit4AQ+jDiSziGMR4iQtUM7jR0zRqJadlw6dBviKeLaw+Z4zcJjdK4VHzQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR05MB6889FB41A216FDFB8953BE48BADD0DM6PR05MB6889namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: d25fb521-e1b1-4fa1-e0aa-08d7dfdf7f0a X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Apr 2020 19:18:49.7225 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: aQrUCm1/Imhq8Tv/C3QKdk70Pup5GiVpdr8NDE1TFHXkWfTtUQAGayHl7ESvp2tVbgYUOBKAP+JttUCPmshQEQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR05MB6297 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-13_09:2020-04-13, 2020-04-13 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 bulkscore=0 malwarescore=0 lowpriorityscore=0 spamscore=0 priorityscore=1501 mlxscore=0 phishscore=0 adultscore=0 suspectscore=0 clxscore=1015 mlxlogscore=999 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004130143 Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Apr 2020 19:18:58 -0000 --_000_DM6PR05MB6889FB41A216FDFB8953BE48BADD0DM6PR05MB6889namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Laurence, I don't disagree about the complexity of the market space outside the rou= ter world, although the TCG RIM and ISO SWID are meant to work in more chao= tic ecosystems, and I think that's reflected in the excerpt below. If you see something that you think would help bind the RIM and a product= more reliably, I'm sure the TCG editors would want to hear about it. Thanks /guy Juniper Business Use Only From: Laurence Lundblade Sent: Monday, April 13, 2020 2:44 PM To: Guy Fedorkow Cc: rats@ietf.org; Ned Smith ; Jessica Fitzgerald-McKa= y Subject: Re: [Rats] Endorsement ID and verification key (was Processing End= orsements and Evidence into Results) [External Email. Be cautious of content] So I suspect the router world is really different from the IoT world in a w= ay that affects the finding of RIMs. Seems like the router world is a small number of manufacturers, less than t= en. Seems like routers are purchased and managed by very technically compet= ent staff that already work with lots of technical details. It's not that h= ard for network admins to go to the router manufacturers web site and downl= oad a few RIMs and configure them into their verifiers. Seems like the IoT world involves a much larger number of manufacturers, hu= ndreds or even thousands. IoT management is scattered and works in lots of = different ways. Sometimes it is the device maker itself. Sometimes it is an= enterprise. Sometimes it is a third party, maybe with a fourth and fifth p= arty... Phones have their own challenge - they have huge numbers of relying parties= - each app is a relying party. It seems a URI-based scheme for finding RIMs is important for the IoT world= , and maybe the phone world, but not so much for the router world. Seems li= ke it has to be URI-based because that's the way to identify a resource on = the broad internet. It looks like the TCG RIM document already has something like this as mentioned in Appendix C. Not sur= e it is fully developed as it is in an appendix. The TCG Platform Certificate Profile [10] also defines a PlatformConfigurat= ionURI attribute that contains "URI where the reference integrity measureme= nts could be obtained by the verifier". The Platform Certificates Platform = Configuration URI MUST hold a reference to the location of the Primary RIM = Bundle. The URI MAY point to a location on the Endpoint platform or it MAY = reside in a publicly accessible location. The Base RIM MUST contain a LINK = element that points to the same URI as the Platform Certificates PlatformCo= nfigurationURI. Glad to see the use of CoSWID. Seems like that will line up for EAT as well= . LL On Apr 13, 2020, at 8:24 AM, Guy Fedorkow > wrote: Hi Laurence, Thanks for your response... I've added annotations, marked with [guy]... /guy Juniper Business Use Only From: Laurence Lundblade > Sent: Sunday, April 12, 2020 2:56 PM To: Guy Fedorkow > Cc: rats@ietf.org; Ned Smith > Subject: Re: [Rats] Endorsement ID and verification key (was Processing End= orsements and Evidence into Results) Trying again, after re reading your question a few times (and a few not-sen= t replies). First you need the endorsement for the TPM that is serving as the attester.= This endorsement would come from the TPM vendor. I assume that is fairly w= ell understood and in practice today through TPM architecture and conventio= ns already in place with things like IDevID. (Maybe you all know it, but I = don't know how this works. I would be interested in references and/or a des= cription of it). [guy] Yes, I think most TPMs ship with a pre-provisioned Endorsement Key an= d a certificate signed by the TPM manufacturer. Use of that key is control= led to prevent unwanted privacy abuses, but it's there specifically to vali= date the source of the TPM. For RIV, I'm not sure that needs to be done by the end-user of the device= ... the OEM who makes the 'router' (yes, or switch or firewall or access p= oint) should pre-provision a DevID signed by the OEM, and a trustworthy OEM= wouldn't sign an IDevID in their facility without verifying that the TPM t= hey've just soldered down is authentic. Some OEMs actually customize their TPMs slightly to contain their own sig= nature on the EK, rather than the TPM vendor's, but I don't think that's co= mmon. In addition to the identity of the device itself, RIV depends on verifica= tion of the certificate that goes with the TPM Attestation key. We've made= that as easy as possible in RIV by pre-provisioning the IAK along with the= IDevID, so the two will contain the same identity information, signed by t= he same vendor. For more-generic TPM applications where a pre-provisioned DevID may be in= appropriate, there's a well-specified series of steps to validate the TPM b= efore remotely installing the ID or attestation keys. The TCG spec with th= e gory details is still in draft, but if you have TCG access, it's called "= TPM Keys for Platform DevID for TPM2". Next you need to identify the RIM. That might come from the OS Vendor or fr= om the device vendor or even a third party, none of which are the TPM vendo= r. For example, with Android, Google produces the OS, but it is open source= and the phone (the device) vendor can modify it, so the RIM would probably= come from the phone/device vendor. It seems possible to have split RIMs wh= ere part comes from the the OS vendor and part comes from the device vendor= . [guy] Agreed - the RIM will almost certainly not come from the TPM vendor= . This seems fundamentally like a task for the system administrator, to de= cide who they trust for RIMs. If the OEM or software vendor ships RIMs, th= at seems like an obvious choice, but administrators can decide any way they= want. Seems like OS/device/3rd-party Vendor IDs, product names and product versio= ns are very non-uniform. You couldn't write much generic Verifier code to w= ork with them as they are today. The best attempts at making these generic = I know of seem EAT's IEEE-based OEMID, and PSA's EAN-13 based HW version, b= ut I don't think these are enough. Maybe there is something else out there.= SWID of some sort? [guy] TCG has a draft spec out for public review covering RIM. 'DRAFT: TCG= Reference Integrity Manifest Information Model' https://trustedcomputinggroup.org/wp-content/uploads/TCG_RIM_Model_v1-r= 13_2feb20.pdf The doc is completely based on ISO SWID, with the NIST guidelines. There's= a CBOR variant called CoSWID at IETF (I think you can guess which Henk, ou= t of the universe of all Henks, you could ask for details!) If you have interest in commenting on the TCG RIM spec, I know the author= s would be glad to hear from you. But about identity of RIMs... The RIM is signed, so once you've done the policy task of deciding which = RIM supplier you like, verifying it is easy. I realize of course that ther= e's little commonality on how to name a product or version, but I'm not sur= e that matters. The RIM corresponds to a very specific product and release= . The vendor can call it whatever they want, as long as they don't issue t= wo release with the same name. After that, I think it's just a string comp= are. I suppose if third-party RIM suppliers exist, then the RIM has to explici= tly call out the software manufacturer by name, but that's already part of = the SWID & RIM specs. As far as we can tell, SWID embodies sufficient flexibility to describe a= ny software release that can be expressed as files and directories. I have= a small project on my todo list to prove that for a Juniper release, but s= o far, I don't see a problem. Again, if you're interested, now is the time= for review! Agreed that the identifier of the RIM doesn't have to be secured / attested= , just like key ID's don't have to be. If the Verifier gets the wrong one, = the verification just fails. This is certainly not a solved problem in the EAT space. Maybe there's a so= lution in common? My first though is some sort of URI, maybe related to SWI= D, that is part of the measurements in the Evidence sent to the Verifier. I= t doesn't have to be mandatory or used by everyone, but it seems likely to = benefit at least some. [guy] Henk might have suggestion for potential commonality with EAT. As no= ted, SWID is strongly oriented to software releases with packages, director= ies and files, but maybe there's something useful there. To be clear, I'm thinking that the Endorsement of the TPM Attester is quite= separate from the Endorsement that is the RIM. They come from completely d= ifferent vendors. The TPM Endorsement is of little use to identify the RIM. [guy] Yes, in fact I think there are at least three suppliers that could be= verified; the TPM vendor, the hardware platform OEM who made the Attester,= and the RIM supplier who certifies the software image. Given the way RIV = is scoped, I think verification of the TPM itself is up to the OEM, but ver= ification of the OEM's DevID and IAK is one thing, and verification of the = authenticity of the RIM is another independent operation, both of which be= long in a RATS-compatible Verifier. Let me know what we're missing! /guy LL On Apr 9, 2020, at 7:31 AM, Guy Fedorkow > wrote: Hi Laurence, I understand that the discussion on the topic below mainly pertains to EA= T, but I'd like to make sure we're not missing something on the RIV side. For OS software image integrity using a TPM, it seems like finding the ri= ght manifest shouldn't be that hard... The Attester needs to have pre-provisioned identity and attestation keys = as outlined in the RIV draft. That provides the Verifier with the vendor i= dentity for the root of trust. The measurement logs contain the alleged pr= oduct name and version number for the software installed on the box. Use t= he vendor ID to narrow the scope to specific vendor's product and version s= pace, and find the RIM that matches. Then check if the hashes line up; if = so, you're good, if not, either the claim of what software is present was i= ncorrect, or something got hacked. Seems like a verifier could follow this same model through the entire cha= in of trust, even through multiple vendors, as long as there are no gaps in= the chain. I know EAT needs to work in a less-constrained environment, but let me kn= ow if you think we're oversimplifying this on RIV. Thanks /guy Juniper Business Use Only From: RATS > On Behalf = Of Laurence Lundblade Sent: Tuesday, April 7, 2020 3:13 PM To: Thomas Fossati > Cc: rats@ietf.org; Ned Smith > Subject: Re: [Rats] Endorsement ID and verification key (was Processing End= orsements and Evidence into Results) [External Email. Be cautious of content] This is a reply to both Thomas and Ned's message on debug in the related th= reat. My inclination is to associate endorsements with time-invariant characteris= tics of the device. At the moment this doesn't seem like the only way to do= it, but it seems like a good way. Things that are not time invariant are p= olicy, k-g-v or such. Endorsement System architecture - Does the Attester use a TEE or a TPM or maybe it is s= imple system with just a simple CPU, but it is encased in titanium. Is defe= nse against chip invasive attacks considered? Do keys become inaccessible w= hen debug is enabled. Development process - Is there a special security-oriented team? Does the t= eam have a code review policy? Is there a bug bounty? Are the desktops and = IT systems used for HW and SW development isolated? Manufacturing - Are the factories secured in a special way? Is the attestat= ion key provisioning system hardened in some way (e.g., uses HSMs). Certifications - These take a long time to achieve and will usually require= some of the above. My thinking for EAT was that you only put attestation keys into devices tha= t meet some criteria like some of the above. Since there is often no way to= recover from a compromised attestation key because no key more secure than= it, you kind of have to have all that. Since these don't change much over time, the endorsement wouldn't change. = They could even span several models and varying HW. Policy, K-G-V, other SW Versions - As long as the SW follows a development process like that abo= ve, it doesn't have to be included in the endorsement. Of course the smalle= r the SW and the better the process, the more it is true (and vice versa). Blacklists - These might be specific to UEIDs, versions of SW, deployments = a particular OEM or such Debug status - Most of the debug status values can vary on a day-day basis OEM model - If the attestation is implemented by a chip vendor and the endo= rsement is for the chip, then the OEM model will vary widely. None of these can be criteria as to whether an attestation key is put into = a device or not as they are not known at manufacturing time and/or must be = allowed to vary widely after manufacturing. I think what I've described above lines up pretty well for a TPM. The syste= m architecture is mostly set by the TCG. HW TPMs are almost always certifie= d. They are independent of OEM model. It also lines up reasonably well with= secure elements and can line up with TEE's. The crux of endorsement to me is the security characteristics of the attest= er that protect the attestation key because there is generally no recovery = from a compromised attestation key. It sets the baseline risk of the HW and= SW of the device. On one extreme is a separate endorsement for every device ("micro endorseme= nt"?), which is what I think Thomas and ARM PSA are tending towards. The ot= her extreme is one endorsement for a product line ("macro endorsement"?),, = say a product line of TPMs. Then it's more like the data sheet for the prod= uct. Then there's different ways to fan this out to the different key / signing = schemes (per-device key, group key, ECDAA, X.509). For example a macro-endo= rsement could include the root of an X.509 hierarchy and the individual dev= ices (or groups of devices) would have individual keys that chain up. With = a micro-endorsement the per-device public key could be per endorsement. The most important thing about the endorsement seems to me is the character= ization of how the attestation key is protected. LL On Apr 7, 2020, at 7:36 AM, Thomas Fossati > wrote: Hi Laurence, Thanks for bringing this up. A few thoughts below. On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade" on behalf of lgl@islan= d-resort.com> wrote: So how does a Verifier find the applicable endorsement for Evidence it wishes to verify and know that is really the right endorsement? Seems like the Evidence needs some sort of an endorsement locator ID. This could be a URL or a GUID. EAT currently has the origination claim to try to solve this, but it is half-baked. It needs to get fixed. I'm fishing for comments here on what it should be like. Pretty sure the Endorsement needs to include or reference the public key that is used to verify the signature. Without that, the Attester could lie and pick any old Endorsement that it wishes. There needs to be some binding between items in the endorsement (E0, E1,...) and the verification key. That could be in the form of a signed token or certificate, but doesn't have to be. Pretty sure this needs to be discussed in the architecture doc. There's a few scenarios: - One endorsement applies to lots of devices in the same class, but each has their own attestation key. - - Probably ECDAA fits in here - - One option here is an X509 hierarchy - Group keys are used (for privacy reasons or other) so there is a one-one correlation with the Endorsements (the GEID discussion) - Group keys are used, but across devices that have different endorsements so there's no one-one correlation While the last one seems odd and unlikely, I think it could occur, because from a lot of real experience the set up of attestation keys is very idiosyncratic. It is wildly affected by manufacturing costs and issues on assembly lines, sub contractor structure, location of secure facilities and approaches to making money on it. They are like snowflakes, each one is different. So maybe endorsement locator ID and key ID are not the same, but they can be in some use cases? I am also tempted to encourage the placement of the endorsement locator ID in the COSE or JOSE header parameters so you don't have to parse the unverified body of claims to be able to find the key material to verify it. Thoughts? A two level lookup key, model+instance, seems to be quite generally applicable as an endorsement locator. The model part would get you to the shared data (e.g., certification, measured boot KGVs, etc.), while the instance part can be used to retrieve device-specific state: verification key(s) as well as other metadata, e.g., if some gear is blacklisted. In PSA we have something quite (though not entirely) similar with implementation and instance IDs [1] [2]. (Context-switching for a second on our previous UEID/GEID discussion: I guess we might model an instance as an anonymity set, and therefore treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?) For the sake of building a shared and reusable vocabulary, I'd prefer keeping model and instance identifiers as separate claims rather than having an opaque endorsement ID claim that clumps together those and possibly other stuff in a use-case specific fashion. For the same reason I would not override key ID with instance ID semantics. cheers, thanks! [1] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-im= plementation-id [2] https://www.ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-in= stance-id IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ RATS mailing list RATS@ietf.org https://www.ietf.org/mailman/listinfo/rats --_000_DM6PR05MB6889FB41A216FDFB8953BE48BADD0DM6PR05MB6889namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Laurence,

  I don’t disagree about the complexity o= f the market space outside the router world, although the TCG RIM and ISO S= WID are meant to work in more chaotic ecosystems, and I think that’s = reflected in the excerpt below.

  If you see something that you think would hel= p bind the RIM and a product more reliably, I’m sure the TCG editors = would want to hear about it.

  Thanks

/guy

 

 

 

 

Juniper Business Use Only

From: Laurence Lundblade <lgl@island-resor= t.com>
Sent: Monday, April 13, 2020 2:44 PM
To: Guy Fedorkow <gfedorkow@juniper.net>
Cc: rats@ietf.org; Ned Smith <ned.smith@intel.com>; Jessica Fi= tzgerald-McKay <jmfmckay@gmail.com>
Subject: Re: [Rats] Endorsement ID and verification key (was Process= ing Endorsements and Evidence into Results)

 

<= span style=3D"font-size:10.5pt;font-family:"Lato",sans-serif;colo= r:black">[External Email. Be cautious of content]

 

So I suspect the router world is really different fr= om the IoT world in a way that affects the finding of RIMs. 

 

Seems like the router world is a small number of man= ufacturers, less than ten. Seems like routers are purchased and managed by = very technically competent staff that already work with lots of technical d= etails. It’s not that hard for network admins to go to the router manufacturers web site and download a few RIMs = and configure them into their verifiers.

 

Seems like the IoT world involves a much larger numb= er of manufacturers, hundreds or even thousands. IoT management is scattere= d and works in lots of different ways. Sometimes it is the device maker its= elf. Sometimes it is an enterprise. Sometimes it is a third party, maybe with a fourth and fifth party...=

 

Phones have their own challenge — they have hu= ge numbers of relying parties — each app is a relying party.

 

It seems a URI-based scheme for finding RIMs is impo= rtant for the IoT world, and maybe the phone world, but not so much for the= router world. Seems like it has to be URI-based because that’s the w= ay to identify a resource on the broad internet.

 

It looks like the TCG RIM document already has something like this as mentioned in Appendix C. Not sure it is fully d= eveloped as it is in an appendix.

 

The TCG Plat= form Certificate Profile [10] also defines a PlatformConfigurationURI attri= bute that contains “URI where the reference integrity measurements could be obtained by the verifier”. The Platform Ce= rtificates Platform Configuration URI MUST hold a reference to the location= of the Primary RIM Bundle. The URI MAY point to a location on the Endpoint= platform or it MAY reside in a publicly accessible location. The Base RIM MUST contain a LINK element that points = to the same URI as the Platform Certificates PlatformConfigurationURI. = ;

 

Glad to see the use of CoSWID. Seems like that will = line up for EAT as well.

 

LL

 

 

On Apr 13, 2020, at 8:24 AM, Guy Fedorkow <gfedorkow@juniper.net> wrote:

 

Hi Laurence,

  Thanks for your response…  I’= ;ve added annotations, marked with&nb= sp;[guy]…

/guy

 

 

 

Juniper Business Use Only

From:&n= bsp;Laurence Lundblade <= lgl@island-resort.com> 
Sent: Sunday, Apri= l 12, 2020 2:56 PM
To: Guy Fedorkow &= lt;gf= edorkow@juniper.net>
Cc: rats@ietf.org; N= ed Smith <ned.smith@intel.com>
Subject: Re: [Rats= ] Endorsement ID and verification key (was Processing Endorsements and Evid= ence into Results)

 

 

Trying again, after re reading your question a few t= imes (and a few not-sent replies).

 

First you need the endorsement for the TPM that is s= erving as the attester. This endorsement would come from the TPM vendor. I = assume that is fairly well understood and in practice today through TPM arc= hitecture and conventions already in place with things like IDevID. (Maybe you all know it, but I don’= t know how this works. I would be interested in references and/or a descrip= tion of it).

[guy] Yes, I think mos= t TPMs ship with a pre-provisioned Endorsement Key and a certificate signed= by the TPM manufacturer.  Use of that key is controlled to prevent un= wanted privacy abuses, but it’s there specifically to validate the source of the TPM.

  For RIV, I̵= 7;m not sure that needs to be done by the end-user of the device…&nbs= p; the OEM who makes the ‘router’ (yes, or switch or firewall o= r access point) should pre-provision a DevID signed by the OEM, and a trustworthy OEM wouldn’t sign an IDevID in their facility without ve= rifying that the TPM they’ve just soldered down is authentic.<= o:p>

  Some OEMs actua= lly customize their TPMs slightly to contain their own signature on the EK,= rather than the TPM vendor’s, but I don’t think that’s c= ommon.

  In addition to = the identity of the device itself, RIV depends on verification of the certi= ficate that goes with the TPM Attestation key.  We’ve made that = as easy as possible in RIV by pre-provisioning the IAK along with the IDevID, so the two will contain the same identity informati= on, signed by the same vendor.

  For more-generi= c TPM applications where a pre-provisioned DevID may be inappropriate, ther= e’s a well-specified series of steps to validate the TPM before remot= ely installing the ID or attestation keys.  The TCG spec with the gory details is still in draft, but if you have TCG acce= ss, it’s called “TPM Keys for Platform DevID for TPM2”.

 

Next you need to identify the RIM. That might come f= rom the OS Vendor or from the device vendor or even a third party, none of = which are the TPM vendor. For example, with Android, Google produces the OS= , but it is open source and the phone (the device) vendor can modify it, so the RIM would probably come from the= phone/device vendor. It seems possible to have split RIMs where part comes= from the the OS vendor and part comes from the device vendor.

  [guy] Agreed &#= 8211; the RIM will almost certainly not come from the TPM vendor.  Thi= s seems fundamentally like a task for the system administrator, to decide w= ho they trust for RIMs.  If the OEM or software vendor ships RIMs, that seems like an obvious choice, but administrators can deci= de any way they want.

 

Seems like OS/device/3rd-party Vendor IDs, product n= ames and product versions are very non-uniform. You couldn’t write mu= ch generic Verifier code to work with them as they are today. The best atte= mpts at making these generic I know of seem EAT’s IEEE-based OEMID, and PSA’s EAN-13 based HW version, but= I don’t think these are enough. Maybe there is something else out th= ere. SWID of some sort? 

[guy] TCG has a draft = spec out for public review covering RIM.  'DRAFT: TCG Reference Integr= ity Manifest Information Model'

The doc is completely = based on ISO SWID, with the NIST guidelines.  There’s a CBOR var= iant called CoSWID at IETF (I think you can guess which Henk, out of the un= iverse of all Henks, you could ask for details!)

  If you have int= erest in commenting on the TCG RIM spec, I know the authors would be glad t= o hear from you.

  But about ident= ity of RIMs…

  The RIM is sign= ed, so once you’ve done the policy task of deciding which RIM supplie= r you like, verifying it is easy.  I realize of course that there̵= 7;s little commonality on how to name a product or version, but I’m not sure that matters.  The RIM corresponds to a very s= pecific product and release.  The vendor can call it whatever they wan= t, as long as they don’t issue two release with the same name.  = After that, I think it’s just a string compare.

  I suppose if th= ird-party RIM suppliers exist, then the RIM has to explicitly call out the = software manufacturer by name, but that’s already part of the SWID &a= mp; RIM specs.

  As far as we ca= n tell, SWID embodies sufficient flexibility to describe any software relea= se that can be expressed as files and directories.  I have a small pro= ject on my todo list to prove that for a Juniper release, but so far, I don’t see a problem.  Again, if you̵= 7;re interested, now is the time for review!

 

 

Agreed that the identifier of the RIM doesn’t = have to be secured / attested, just like key ID’s don’t have to= be. If the Verifier gets the wrong one, the verification just fails.<= /o:p>

 

This is certainly not a solved problem in the EAT sp= ace. Maybe there’s a solution in common? My first though is some sort= of URI, maybe related to SWID, that is part of the measurements in the Evi= dence sent to the Verifier. It doesn’t have to be mandatory or used by everyone, but it seems likely to benefit at lea= st some.

[guy] Henk might have = suggestion for potential commonality with EAT.  As noted, SWID is stro= ngly oriented to software releases with packages, directories and files, bu= t maybe there’s something useful there.

 

To be clear, I’m thinking that the Endorsement= of the TPM Attester is quite separate from the Endorsement that is the RIM= . They come from completely different vendors. The TPM Endorsement is of li= ttle use to identify the RIM.

[guy] Yes, in fact I t= hink there are at least three suppliers that could be verified; the TPM ven= dor, the hardware platform OEM who made the Attester, and the RIM supplier = who certifies the software image.  Given the way RIV is scoped, I think verification of the TPM itself is up to the= OEM, but verification of the OEM’s DevID and IAK is one thing, and v= erification of the authenticity of the RIM is another independent operation= , both of which  belong in a RATS-compatible Verifier.

  Let me know wha= t we’re missing!

  /guy

 

LL

 

 

 

 

On Apr 9, 2020, at 7:31 AM, Guy Fedorkow <gfedorkow@ju= niper.net> wrote:

 

Hi Laurence,

  I understand that the discussion on the topic= below mainly pertains to EAT, but I’d like to make sure we’re = not missing something on the RIV side.

  For OS software image integrity using a TPM, = it seems like finding the right manifest shouldn’t be that hard…= ;

  The Attester needs to have pre-provisioned id= entity and attestation keys as outlined in the RIV draft.  That provid= es the Verifier with the vendor identity for the root of trust.  The m= easurement logs contain the alleged product name and version number for the software installed on the box.  Use the ve= ndor ID to narrow the scope to specific vendor’s product and version = space, and find the RIM that matches.  Then check if the hashes line u= p; if so, you’re good, if not, either the claim of what software is present was incorrect, or something got hacked.

  Seems like a verifier could follow this same = model through the entire chain of trust, even through multiple vendors, as = long as there are no gaps in the chain.

  I know EAT needs to work in a less-constraine= d environment, but let me know if you think we’re oversimplifying thi= s on RIV.

 

  Thanks

/guy

 

 

 

Juniper Business Use Only

From:&n= bsp;RATS <rats-bounces@ietf.org> On Behalf Of Laurence Lundblade
Sent: Tuesday, Apr= il 7, 2020 3:13 PM
To: Thomas Fossati= <Thomas.Fossati@arm.com>
Cc: rats@ietf.org; N= ed Smith <ned.smith@intel.com>
Subject: Re: [Rats= ] Endorsement ID and verification key (was Processing Endorsements and Evid= ence into Results)

 

<= span style=3D"font-size:10.5pt;font-family:"Lato",sans-serif;colo= r:black">[External Email. Be cautious of content]

 

This is a reply to both Thomas and Ned’s messa= ge on debug in the related threat.

 

My inclination is to associate endorsements with tim= e-invariant characteristics of the device. At the moment this doesn’t= seem like the only way to do it, but it seems like a good way. Things that= are not time invariant are policy, k-g-v or such.

 

Endorsement

System architecture — Does the Attester use a = TEE or a TPM or maybe it is simple system with just a simple CPU, but it is= encased in titanium. Is defense against chip invasive attacks considered? = Do keys become inaccessible when debug is enabled.

 

Development process — Is there a special secur= ity-oriented team? Does the team have a code review policy? Is there a bug = bounty? Are the desktops and IT systems used for HW and SW development isol= ated?

 

Manufacturing — Are the factories secured in a= special way? Is the attestation key provisioning system hardened in some w= ay (e.g., uses HSMs).

 

Certifications — These take a long time to ach= ieve and will usually require some of the above.

 

My thinking for EAT was that you only put attestatio= n keys into devices that meet some criteria like some of the above. Since t= here is often no way to recover from a compromised attestation key because = no key more secure than it, you kind of have to have all that. 

 

Since these don’t change much over time, the e= ndorsement wouldn’t change.  They could even span several models= and varying HW.

 

Policy, K-G-V, other

SW Versions — As long as the SW follows a deve= lopment process like that above, it doesn’t have to be included in th= e endorsement. Of course the smaller the SW and the better the process, the= more it is true (and vice versa).

 

Blacklists — These might be specific to UEIDs,= versions of SW, deployments a particular OEM or such

 

Debug status — Most of the debug status values= can vary on a day-day basis

 

OEM model — If the attestation is implemented = by a chip vendor and the endorsement is for the chip, then the OEM model wi= ll vary widely.

 

None of these can be criteria as to whether an attes= tation key is put into a device or not as they are not known at manufacturi= ng time and/or must be allowed to vary widely after manufacturing.

 

 

I think what I’ve described above lines up pre= tty well for a TPM. The system architecture is mostly set by the TCG. HW TP= Ms are almost always certified. They are independent of OEM model. It also = lines up reasonably well with secure elements and can line up with TEE’s.  

 

The crux of endorsement to me is the security charac= teristics of the attester that protect the attestation key because there is= generally no recovery from a compromised attestation key. It sets the base= line risk of the HW and SW of the device.

 

 

On one extreme is a separate endorsement for every d= evice (“micro endorsement"?), which is what I think Thomas and A= RM PSA are tending towards. The other extreme is one endorsement for a prod= uct line (“macro endorsement"?),, say a product line of TPMs. Then it’s more like the data sheet for the product.&nb= sp; 

 

Then there’s different ways to fan this out to= the different key / signing schemes (per-device key, group key, ECDAA, X.5= 09). For example a macro-endorsement could include the root of an X.509 hie= rarchy and the individual devices (or groups of devices) would have individual keys that chain up. With a micro-endorse= ment the per-device public key could be per endorsement.

 

 

The most important thing about the endorsement seems= to me is the characterization of how the attestation key is protected.

 

LL

 

 

 

On Apr 7, 2020, at 7:36 AM, Thomas Fossati <Thomas.Fo= ssati@arm.com> wrote:

 

Hi Laurence,

Thanks for bringing this up.  A few thoughts below.

On 03/04/2020, 20:37, "RATS on behalf of Laurence Lundblade"
<rats-bou= nces@ietf.org on behalf of lgl@island-resort.com> wrote:

So how does a Verifier find the applicable endorse= ment for Evidence it
wishes to verify and know that is really the right endorsement?

Seems like the Evidence needs some sort of an endorsement locator ID.
This could be a URL or a GUID. EAT currently has the origination claim
to try to solve this, but it is half-baked. It needs to get fixed. I’= m
fishing for comments here on what it should be like.

Pretty sure the Endorsement needs to include or reference the public
key that is used to verify the signature. Without that, the Attester
could lie and pick any old Endorsement that it wishes. There needs to
be some binding between items in the endorsement (E0, E1,…) and the verification key. That could be in the form of a signed token or
certificate, but doesn’t have to be. Pretty sure this needs to be
discussed in the architecture doc.

There's a few scenarios:
- One endorsement applies to lots of devices in the same class, but
 each has their own attestation key.
- - Probably ECDAA fits in here
- - One option here is an X509 hierarchy
- Group keys are used (for privacy reasons or other) so there is a
 one-one correlation with the Endorsements (the GEID discussion)
- Group keys are used, but across devices that have different
 endorsements so there’s no one-one correlation

While the last one seems odd and unlikely, I think it could occur,
because from a lot of real experience the set up of attestation keys
is very idiosyncratic. It is wildly affected by manufacturing costs
and issues on assembly lines, sub contractor structure, location of
secure facilities and approaches to making money on it. They are like
snowflakes, each one is different.  So maybe endorsement locator ID and key ID are not the same, but they can be in some use cases?

I am also tempted to encourage the placement of the endorsement
locator ID in the COSE or JOSE header parameters so you don’t have to=
parse the unverified body of claims to be able to find the key
material to verify it.

Thoughts?


A two level lookup key, model+instance, seems to be quite generally
applicable as an endorsement locator.  The model part would get you to=
the shared data (e.g., certification, measured boot KGVs, etc.), while
the instance part can be used to retrieve device-specific state:
verification key(s) as well as other metadata, e.g., if some gear is
blacklisted.  In PSA we have something quite (though not entirely)
similar with implementation and instance IDs [1] [2].

(Context-switching for a second on our previous UEID/GEID discussion: I
guess we might model an instance as an anonymity set, and therefore
treat EUIDs as the special case GEIDs with cardinality =3D=3D 1?)

For the sake of building a shared and reusable vocabulary, I'd prefer
keeping model and instance identifiers as separate claims rather than
having an opaque endorsement ID claim that clumps together those and
possibly other stuff in a use-case specific fashion.  For the same
reason I would not override key ID with instance ID semantics.

cheers, thanks!

[1] https://www= .ietf.org/id/draft-tschofenig-rats-psa-token-05.html#name-implementation-id=
[2] https://www.ietf.= org/id/draft-tschofenig-rats-psa-token-05.html#name-instance-id<= span style=3D"font-size:9.0pt;font-family:"Helvetica",sans-serif"= >



IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
RATS mailing list
RATS@ietf.org=
https://www.ietf.org/mailman/listinf= o/rats

 

 

--_000_DM6PR05MB6889FB41A216FDFB8953BE48BADD0DM6PR05MB6889namp_-- From nobody Mon Apr 13 13:12:19 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C031A3A1D69 for ; Mon, 13 Apr 2020 13:12:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.799 X-Spam-Level: X-Spam-Status: No, score=-1.799 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YmdvQvDmVSys for ; Mon, 13 Apr 2020 13:12:13 -0700 (PDT) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB68E3A1D58 for ; Mon, 13 Apr 2020 13:12:11 -0700 (PDT) IronPort-SDR: BSPX/LSfNOndNlyhsv39wGmfZmps0D/JNrJ7+nrwIEvBtv7KN6Foipewg0bUOxtEXXyZ/lfXsQ vjVa545sqwBg== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Apr 2020 13:12:00 -0700 IronPort-SDR: resol5OJq5//gZYBz5UOZ1h4As74PH9m6J/UMzWHh7Gchquvvt4cPAwpJo0IxdmKXXX5uI/Mub xVlb+OG/ZaUw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,380,1580803200"; d="scan'208,217";a="426808886" Received: from orsmsx102.amr.corp.intel.com ([10.22.225.129]) by orsmga005.jf.intel.com with ESMTP; 13 Apr 2020 13:12:00 -0700 Received: from orsmsx108.amr.corp.intel.com ([169.254.2.172]) by ORSMSX102.amr.corp.intel.com ([169.254.3.107]) with mapi id 14.03.0439.000; Mon, 13 Apr 2020 13:12:00 -0700 From: "Smith, Ned" To: Guy Fedorkow , Laurence Lundblade CC: "rats@ietf.org" , Jessica Fitzgerald-McKay Thread-Topic: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) Thread-Index: AQHWCe9aqBxq4ObY/kGk1JKQQWkxNahuNTGAgABNSQCAAtYdgIAFAPqAgAFXDACAADfrAIAACaqA//+ZgoA= Date: Mon, 13 Apr 2020 20:11:59 +0000 Message-ID: <8B8EFB04-7C33-4058-BC53-E33A86802D6E@intel.com> References: <7FF8F147-968E-40B4-8E46-A8E86094DD4D@island-resort.com> <71AEA046-BF2C-4ACD-AD1F-43E11648127E@arm.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.35.20030802 msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-13T19:18:48.0122256Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=cf73fe7b-ae45-46de-bc91-3d3d7429a851; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic x-originating-ip: [10.254.69.132] Content-Type: multipart/alternative; boundary="_000_8B8EFB047C334058BC53E33A86802D6Eintelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Endorsement ID and verification key (was Processing Endorsements and Evidence into Results) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Apr 2020 20:12:18 -0000 --_000_8B8EFB047C334058BC53E33A86802D6Eintelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SXQgd2FzIHN0YXRlZCBvciBpbXBsaWVkIGJ5IHNvbWVvbmUgZWFybGllciBpbiB0aGlzIHRocmVh ZCB0aGF0IG1hbmFnaW5nIEVuZG9yc2VtZW50cyBpbiBhbiBJb1QgZWNvc3lzdGVtIHdvdWxkIGJl IGNvbXBsaWNhdGVkLiBPbmUgcG90ZW50aWFsIHNpbXBsaWZ5aW5nIGFwcHJvYWNoIG9ic2VydmVz IHRoYXQsIGF0IGxlYXN0IGluIHRlcm1zIG9mIFNXL0ZXIGltYWdlIGludGVncml0eSBjbGFpbXMs IHRoZSBwYXJ0IHRoYXQgbWlnaHQgYmUgY2FsbGVkIGEg4oCYcmVmZXJlbmNlIG1hbmlmZXN04oCZ IGlzIGFscmVhZHkgYSBzdWJzZXQgb2YgdGhlIFNXIHVwZGF0ZSBtYW5pZmVzdCAoU1VJVCkuIFRo YXQgaXMsIHRoZSBpZGVudGlmaWNhdGlvbiBvZiB0aGUgaW1hZ2UsIGFuIGludGVncml0eSBkaWdl c3Qgb2YgdGhlIGltYWdlIGFuZCBhIHNpZ25hdHVyZSBvdmVyIHBvc3NpYmx5IG11bHRpcGxlIGRp Z2VzdHMgaXMgdmVyeSBjbG9zZSB0byB3aGF0IFJBVFMgYXJjaCBkZWZpbmVzIGFzIGEgcmVmZXJl bmNlIG1hbmlmZXN0LiBUaGUgbWFpbiBkaWZmZXJlbmNlIGlzIGEgU1VJVCBtYW5pZmVzdCBhbHNv IGNvbnRhaW5zIHRoZSB1cGRhdGUgaW1hZ2Uocyk7IHdoaWNoIGEgUkFUUyBWZXJpZmllciBkb2Vz buKAmXQgbmVlZC4NCg0KQSByZWFzb25hYmxlIFNXIHVwZGF0ZSB1c2UgY2FzZSB0aGF0IGluY2x1 ZGVzIGF0dGVzdGF0aW9uIG1pZ2h0IHBhc3MgdGhlIFNVSVQgbWFuaWZlc3QgbWludXMgdGhlIGlt YWdlcyBhcyBFbmRvcnNlbWVudHMgdG8gdGhlIFZlcmlmaWVyIHdobyBtaWdodCAodXBvbiBzdWNj ZXNzZnVsIGF0dGVzdGF0aW9uKSBnaXZlIEF0dGVzdGF0aW9uIFJlc3VsdHMgdG8gYSBSZWx5aW5n IFBhcnR5IGluIGNoYXJnZSBvZiBTVyB1cGRhdGUgd2hvIG1pZ2h0IHByb2NlZWQgdG8gaW5zdGFs bCBhbiB1cGRhdGUuIFRoZSBSZWx5aW5nIFBhcnR5IG1pZ2h0IGRlY2lkZSB0byBzaGFyZSBqdXN0 IHRoZSByZWZlcmVuY2UgbWVhc3VyZW1lbnRzIGZvciB0aGUgbmV3bHkgaW5zdGFsbGVkIFNXIHdp dGggdGhlIFZlcmlmaWVyIGZvciBzdWJzZXF1ZW50IGF0dGVzdGF0aW9uIHZlcmlmaWNhdGlvbnMu DQoNClRoaXMgYXBwcm9hY2ggYWxsb3dzIHRoZSBTVyB2ZW5kb3IgdGhlIGFiaWxpdHkgdG8gY3Jl YXRlIEVuZG9yc2VtZW50cyB1c2luZyB0aGUgc2FtZSB0b29sIGNoYWluIHVzZWQgdG8gZ2VuZXJh dGUgdGhlIFNVSVQgbWFuaWZlc3QuDQoNClNpbmNlIHRoZSBJb1QgdmVuZG9ycyBhcmUgKHByZXN1 bWFibHkpIGFscmVhZHkgbW90aXZhdGVkIHRvIGltcGxlbWVudCBTVUlULCB0aGV5IGNvbmNlaXZh Ymx5IGFyZSBub3Qgb3Zlcmx5IGJ1cmRlbmVkIGJ5IGNyZWF0aW5nIEVuZG9yc2VtZW50cyBmb3Ig UkFUUyB1c2UgY2FzZXMuDQoNClNVSVQgbWFuaWZlc3RzIGNhbiAoYXQgbGVhc3QgaW4gcGFydCkg YmUgQ29TV0lELiBJIGJlbGlldmUgaXQgaXMgcG9zc2libGUgZm9yIENvU1dJRCB0byBpbmNsdWRl IFVDQ1MgY2xhaW1zIHdoaWNoIGltcGxpZXMgaXQgaXMgcG9zc2libGUgdG8gZXh0ZW5kIGEgU1VJ VCBtYW5pZmVzdCB0byBpbmNsdWRlIG90aGVyIGNsYWltcyBiZXNpZGVzIGNvZGUgaW50ZWdyaXR5 IGNsYWltcy4gQW4gSW9UIGRldmljZSBPRU0gbWlnaHQgYmUgaW4gYSBwb3NpdGlvbiB0byBtYWtl IGJvdGggY29kZSBpbnRlZ3JpdHkgYW5kIG90aGVyIGNsYWltcy4gVGhhdCB3b3VsZCBiZSBhIG5h dHVyYWwgZXh0ZW5zaW9uIHRvIHRoZWlyIHJlbGVhc2UgcHJvY2VzcyB0aGF0IHByb2R1Y2VzIGEg U1VJVCBtYW5pZmVzdC4NCg0KUmVnYXJkcywNCi1OZWQNCg0KRnJvbTogR3V5IEZlZG9ya293IDxn ZmVkb3Jrb3dAanVuaXBlci5uZXQ+DQpEYXRlOiBNb25kYXksIEFwcmlsIDEzLCAyMDIwIGF0IDEy OjE4IFBNDQpUbzogTGF1cmVuY2UgTHVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb20+DQpD YzogInJhdHNAaWV0Zi5vcmciIDxyYXRzQGlldGYub3JnPiwgIlNtaXRoLCBOZWQiIDxuZWQuc21p dGhAaW50ZWwuY29tPiwgSmVzc2ljYSBGaXR6Z2VyYWxkLU1jS2F5IDxqbWZtY2theUBnbWFpbC5j b20+DQpTdWJqZWN0OiBSRTogW1JhdHNdIEVuZG9yc2VtZW50IElEIGFuZCB2ZXJpZmljYXRpb24g a2V5ICh3YXMgUHJvY2Vzc2luZyBFbmRvcnNlbWVudHMgYW5kIEV2aWRlbmNlIGludG8gUmVzdWx0 cykNCg0KSGkgTGF1cmVuY2UsDQogIEkgZG9u4oCZdCBkaXNhZ3JlZSBhYm91dCB0aGUgY29tcGxl eGl0eSBvZiB0aGUgbWFya2V0IHNwYWNlIG91dHNpZGUgdGhlIHJvdXRlciB3b3JsZCwgYWx0aG91 Z2ggdGhlIFRDRyBSSU0gYW5kIElTTyBTV0lEIGFyZSBtZWFudCB0byB3b3JrIGluIG1vcmUgY2hh b3RpYyBlY29zeXN0ZW1zLCBhbmQgSSB0aGluayB0aGF04oCZcyByZWZsZWN0ZWQgaW4gdGhlIGV4 Y2VycHQgYmVsb3cuDQogIElmIHlvdSBzZWUgc29tZXRoaW5nIHRoYXQgeW91IHRoaW5rIHdvdWxk IGhlbHAgYmluZCB0aGUgUklNIGFuZCBhIHByb2R1Y3QgbW9yZSByZWxpYWJseSwgSeKAmW0gc3Vy ZSB0aGUgVENHIGVkaXRvcnMgd291bGQgd2FudCB0byBoZWFyIGFib3V0IGl0Lg0KICBUaGFua3MN Ci9ndXkNCg0KDQoNCg0KDQpKdW5pcGVyIEJ1c2luZXNzIFVzZSBPbmx5DQpGcm9tOiBMYXVyZW5j ZSBMdW5kYmxhZGUgPGxnbEBpc2xhbmQtcmVzb3J0LmNvbT4NClNlbnQ6IE1vbmRheSwgQXByaWwg MTMsIDIwMjAgMjo0NCBQTQ0KVG86IEd1eSBGZWRvcmtvdyA8Z2ZlZG9ya293QGp1bmlwZXIubmV0 Pg0KQ2M6IHJhdHNAaWV0Zi5vcmc7IE5lZCBTbWl0aCA8bmVkLnNtaXRoQGludGVsLmNvbT47IEpl c3NpY2EgRml0emdlcmFsZC1NY0theSA8am1mbWNrYXlAZ21haWwuY29tPg0KU3ViamVjdDogUmU6 IFtSYXRzXSBFbmRvcnNlbWVudCBJRCBhbmQgdmVyaWZpY2F0aW9uIGtleSAod2FzIFByb2Nlc3Np bmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRvIFJlc3VsdHMpDQoNCltFeHRlcm5hbCBF bWFpbC4gQmUgY2F1dGlvdXMgb2YgY29udGVudF0NCg0KU28gSSBzdXNwZWN0IHRoZSByb3V0ZXIg d29ybGQgaXMgcmVhbGx5IGRpZmZlcmVudCBmcm9tIHRoZSBJb1Qgd29ybGQgaW4gYSB3YXkgdGhh dCBhZmZlY3RzIHRoZSBmaW5kaW5nIG9mIFJJTXMuDQoNClNlZW1zIGxpa2UgdGhlIHJvdXRlciB3 b3JsZCBpcyBhIHNtYWxsIG51bWJlciBvZiBtYW51ZmFjdHVyZXJzLCBsZXNzIHRoYW4gdGVuLiBT ZWVtcyBsaWtlIHJvdXRlcnMgYXJlIHB1cmNoYXNlZCBhbmQgbWFuYWdlZCBieSB2ZXJ5IHRlY2hu aWNhbGx5IGNvbXBldGVudCBzdGFmZiB0aGF0IGFscmVhZHkgd29yayB3aXRoIGxvdHMgb2YgdGVj aG5pY2FsIGRldGFpbHMuIEl04oCZcyBub3QgdGhhdCBoYXJkIGZvciBuZXR3b3JrIGFkbWlucyB0 byBnbyB0byB0aGUgcm91dGVyIG1hbnVmYWN0dXJlcnMgd2ViIHNpdGUgYW5kIGRvd25sb2FkIGEg ZmV3IFJJTXMgYW5kIGNvbmZpZ3VyZSB0aGVtIGludG8gdGhlaXIgdmVyaWZpZXJzLg0KDQpTZWVt cyBsaWtlIHRoZSBJb1Qgd29ybGQgaW52b2x2ZXMgYSBtdWNoIGxhcmdlciBudW1iZXIgb2YgbWFu dWZhY3R1cmVycywgaHVuZHJlZHMgb3IgZXZlbiB0aG91c2FuZHMuIElvVCBtYW5hZ2VtZW50IGlz IHNjYXR0ZXJlZCBhbmQgd29ya3MgaW4gbG90cyBvZiBkaWZmZXJlbnQgd2F5cy4gU29tZXRpbWVz IGl0IGlzIHRoZSBkZXZpY2UgbWFrZXIgaXRzZWxmLiBTb21ldGltZXMgaXQgaXMgYW4gZW50ZXJw cmlzZS4gU29tZXRpbWVzIGl0IGlzIGEgdGhpcmQgcGFydHksIG1heWJlIHdpdGggYSBmb3VydGgg YW5kIGZpZnRoIHBhcnR5Li4uDQoNClBob25lcyBoYXZlIHRoZWlyIG93biBjaGFsbGVuZ2Ug4oCU IHRoZXkgaGF2ZSBodWdlIG51bWJlcnMgb2YgcmVseWluZyBwYXJ0aWVzIOKAlCBlYWNoIGFwcCBp cyBhIHJlbHlpbmcgcGFydHkuDQoNCkl0IHNlZW1zIGEgVVJJLWJhc2VkIHNjaGVtZSBmb3IgZmlu ZGluZyBSSU1zIGlzIGltcG9ydGFudCBmb3IgdGhlIElvVCB3b3JsZCwgYW5kIG1heWJlIHRoZSBw aG9uZSB3b3JsZCwgYnV0IG5vdCBzbyBtdWNoIGZvciB0aGUgcm91dGVyIHdvcmxkLiBTZWVtcyBs aWtlIGl0IGhhcyB0byBiZSBVUkktYmFzZWQgYmVjYXVzZSB0aGF04oCZcyB0aGUgd2F5IHRvIGlk ZW50aWZ5IGEgcmVzb3VyY2Ugb24gdGhlIGJyb2FkIGludGVybmV0Lg0KDQpJdCBsb29rcyBsaWtl IHRoZSBUQ0cgUklNIGRvY3VtZW50PGh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRwczov dHJ1c3RlZGNvbXB1dGluZ2dyb3VwLm9yZy93cC1jb250ZW50L3VwbG9hZHMvVENHX1JJTV9Nb2Rl bF92MS1yMTNfMmZlYjIwLnBkZl9fOyEhTkV0NnlNYU8tZ2shU0FMWjZUYVNRNzhtTnl5OER5SVFv WndFNWt1S3dmYkVwc2xTbDNtZ0NzdXZSZDJjakFER2FXMi14WGd1M1hSSUdRNCQ+IGFscmVhZHkg aGFzIHNvbWV0aGluZyBsaWtlIHRoaXMgYXMgbWVudGlvbmVkIGluIEFwcGVuZGl4IEMuIE5vdCBz dXJlIGl0IGlzIGZ1bGx5IGRldmVsb3BlZCBhcyBpdCBpcyBpbiBhbiBhcHBlbmRpeC4NCg0KVGhl IFRDRyBQbGF0Zm9ybSBDZXJ0aWZpY2F0ZSBQcm9maWxlIFsxMF0gYWxzbyBkZWZpbmVzIGEgUGxh dGZvcm1Db25maWd1cmF0aW9uVVJJIGF0dHJpYnV0ZSB0aGF0IGNvbnRhaW5zIOKAnFVSSSB3aGVy ZSB0aGUgcmVmZXJlbmNlIGludGVncml0eSBtZWFzdXJlbWVudHMgY291bGQgYmUgb2J0YWluZWQg YnkgdGhlIHZlcmlmaWVy4oCdLiBUaGUgUGxhdGZvcm0gQ2VydGlmaWNhdGVzIFBsYXRmb3JtIENv bmZpZ3VyYXRpb24gVVJJIE1VU1QgaG9sZCBhIHJlZmVyZW5jZSB0byB0aGUgbG9jYXRpb24gb2Yg dGhlIFByaW1hcnkgUklNIEJ1bmRsZS4gVGhlIFVSSSBNQVkgcG9pbnQgdG8gYSBsb2NhdGlvbiBv biB0aGUgRW5kcG9pbnQgcGxhdGZvcm0gb3IgaXQgTUFZIHJlc2lkZSBpbiBhIHB1YmxpY2x5IGFj Y2Vzc2libGUgbG9jYXRpb24uIFRoZSBCYXNlIFJJTSBNVVNUIGNvbnRhaW4gYSBMSU5LIGVsZW1l bnQgdGhhdCBwb2ludHMgdG8gdGhlIHNhbWUgVVJJIGFzIHRoZSBQbGF0Zm9ybSBDZXJ0aWZpY2F0 ZXMgUGxhdGZvcm1Db25maWd1cmF0aW9uVVJJLg0KDQpHbGFkIHRvIHNlZSB0aGUgdXNlIG9mIENv U1dJRC4gU2VlbXMgbGlrZSB0aGF0IHdpbGwgbGluZSB1cCBmb3IgRUFUIGFzIHdlbGwuDQoNCkxM DQoNCg0KT24gQXByIDEzLCAyMDIwLCBhdCA4OjI0IEFNLCBHdXkgRmVkb3Jrb3cgPGdmZWRvcmtv d0BqdW5pcGVyLm5ldDxtYWlsdG86Z2ZlZG9ya293QGp1bmlwZXIubmV0Pj4gd3JvdGU6DQoNCkhp IExhdXJlbmNlLA0KICBUaGFua3MgZm9yIHlvdXIgcmVzcG9uc2XigKYgIEnigJl2ZSBhZGRlZCBh bm5vdGF0aW9ucywgbWFya2VkIHdpdGggW2d1eV3igKYNCi9ndXkNCg0KDQoNCkp1bmlwZXIgQnVz aW5lc3MgVXNlIE9ubHkNCkZyb206IExhdXJlbmNlIEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNv cnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20+Pg0KU2VudDogU3VuZGF5LCBBcHJp bCAxMiwgMjAyMCAyOjU2IFBNDQpUbzogR3V5IEZlZG9ya293IDxnZmVkb3Jrb3dAanVuaXBlci5u ZXQ8bWFpbHRvOmdmZWRvcmtvd0BqdW5pcGVyLm5ldD4+DQpDYzogcmF0c0BpZXRmLm9yZzxtYWls dG86cmF0c0BpZXRmLm9yZz47IE5lZCBTbWl0aCA8bmVkLnNtaXRoQGludGVsLmNvbTxtYWlsdG86 bmVkLnNtaXRoQGludGVsLmNvbT4+DQpTdWJqZWN0OiBSZTogW1JhdHNdIEVuZG9yc2VtZW50IElE IGFuZCB2ZXJpZmljYXRpb24ga2V5ICh3YXMgUHJvY2Vzc2luZyBFbmRvcnNlbWVudHMgYW5kIEV2 aWRlbmNlIGludG8gUmVzdWx0cykNCg0KDQpUcnlpbmcgYWdhaW4sIGFmdGVyIHJlIHJlYWRpbmcg eW91ciBxdWVzdGlvbiBhIGZldyB0aW1lcyAoYW5kIGEgZmV3IG5vdC1zZW50IHJlcGxpZXMpLg0K DQpGaXJzdCB5b3UgbmVlZCB0aGUgZW5kb3JzZW1lbnQgZm9yIHRoZSBUUE0gdGhhdCBpcyBzZXJ2 aW5nIGFzIHRoZSBhdHRlc3Rlci4gVGhpcyBlbmRvcnNlbWVudCB3b3VsZCBjb21lIGZyb20gdGhl IFRQTSB2ZW5kb3IuIEkgYXNzdW1lIHRoYXQgaXMgZmFpcmx5IHdlbGwgdW5kZXJzdG9vZCBhbmQg aW4gcHJhY3RpY2UgdG9kYXkgdGhyb3VnaCBUUE0gYXJjaGl0ZWN0dXJlIGFuZCBjb252ZW50aW9u cyBhbHJlYWR5IGluIHBsYWNlIHdpdGggdGhpbmdzIGxpa2UgSURldklELiAoTWF5YmUgeW91IGFs bCBrbm93IGl0LCBidXQgSSBkb27igJl0IGtub3cgaG93IHRoaXMgd29ya3MuIEkgd291bGQgYmUg aW50ZXJlc3RlZCBpbiByZWZlcmVuY2VzIGFuZC9vciBhIGRlc2NyaXB0aW9uIG9mIGl0KS4NCltn dXldIFllcywgSSB0aGluayBtb3N0IFRQTXMgc2hpcCB3aXRoIGEgcHJlLXByb3Zpc2lvbmVkIEVu ZG9yc2VtZW50IEtleSBhbmQgYSBjZXJ0aWZpY2F0ZSBzaWduZWQgYnkgdGhlIFRQTSBtYW51ZmFj dHVyZXIuICBVc2Ugb2YgdGhhdCBrZXkgaXMgY29udHJvbGxlZCB0byBwcmV2ZW50IHVud2FudGVk IHByaXZhY3kgYWJ1c2VzLCBidXQgaXTigJlzIHRoZXJlIHNwZWNpZmljYWxseSB0byB2YWxpZGF0 ZSB0aGUgc291cmNlIG9mIHRoZSBUUE0uDQogIEZvciBSSVYsIEnigJltIG5vdCBzdXJlIHRoYXQg bmVlZHMgdG8gYmUgZG9uZSBieSB0aGUgZW5kLXVzZXIgb2YgdGhlIGRldmljZeKApiAgdGhlIE9F TSB3aG8gbWFrZXMgdGhlIOKAmHJvdXRlcuKAmSAoeWVzLCBvciBzd2l0Y2ggb3IgZmlyZXdhbGwg b3IgYWNjZXNzIHBvaW50KSBzaG91bGQgcHJlLXByb3Zpc2lvbiBhIERldklEIHNpZ25lZCBieSB0 aGUgT0VNLCBhbmQgYSB0cnVzdHdvcnRoeSBPRU0gd291bGRu4oCZdCBzaWduIGFuIElEZXZJRCBp biB0aGVpciBmYWNpbGl0eSB3aXRob3V0IHZlcmlmeWluZyB0aGF0IHRoZSBUUE0gdGhleeKAmXZl IGp1c3Qgc29sZGVyZWQgZG93biBpcyBhdXRoZW50aWMuDQogIFNvbWUgT0VNcyBhY3R1YWxseSBj dXN0b21pemUgdGhlaXIgVFBNcyBzbGlnaHRseSB0byBjb250YWluIHRoZWlyIG93biBzaWduYXR1 cmUgb24gdGhlIEVLLCByYXRoZXIgdGhhbiB0aGUgVFBNIHZlbmRvcuKAmXMsIGJ1dCBJIGRvbuKA mXQgdGhpbmsgdGhhdOKAmXMgY29tbW9uLg0KICBJbiBhZGRpdGlvbiB0byB0aGUgaWRlbnRpdHkg b2YgdGhlIGRldmljZSBpdHNlbGYsIFJJViBkZXBlbmRzIG9uIHZlcmlmaWNhdGlvbiBvZiB0aGUg Y2VydGlmaWNhdGUgdGhhdCBnb2VzIHdpdGggdGhlIFRQTSBBdHRlc3RhdGlvbiBrZXkuICBXZeKA mXZlIG1hZGUgdGhhdCBhcyBlYXN5IGFzIHBvc3NpYmxlIGluIFJJViBieSBwcmUtcHJvdmlzaW9u aW5nIHRoZSBJQUsgYWxvbmcgd2l0aCB0aGUgSURldklELCBzbyB0aGUgdHdvIHdpbGwgY29udGFp biB0aGUgc2FtZSBpZGVudGl0eSBpbmZvcm1hdGlvbiwgc2lnbmVkIGJ5IHRoZSBzYW1lIHZlbmRv ci4NCiAgRm9yIG1vcmUtZ2VuZXJpYyBUUE0gYXBwbGljYXRpb25zIHdoZXJlIGEgcHJlLXByb3Zp c2lvbmVkIERldklEIG1heSBiZSBpbmFwcHJvcHJpYXRlLCB0aGVyZeKAmXMgYSB3ZWxsLXNwZWNp ZmllZCBzZXJpZXMgb2Ygc3RlcHMgdG8gdmFsaWRhdGUgdGhlIFRQTSBiZWZvcmUgcmVtb3RlbHkg aW5zdGFsbGluZyB0aGUgSUQgb3IgYXR0ZXN0YXRpb24ga2V5cy4gIFRoZSBUQ0cgc3BlYyB3aXRo IHRoZSBnb3J5IGRldGFpbHMgaXMgc3RpbGwgaW4gZHJhZnQsIGJ1dCBpZiB5b3UgaGF2ZSBUQ0cg YWNjZXNzLCBpdOKAmXMgY2FsbGVkIOKAnFRQTSBLZXlzIGZvciBQbGF0Zm9ybSBEZXZJRCBmb3Ig VFBNMuKAnS4NCg0KTmV4dCB5b3UgbmVlZCB0byBpZGVudGlmeSB0aGUgUklNLiBUaGF0IG1pZ2h0 IGNvbWUgZnJvbSB0aGUgT1MgVmVuZG9yIG9yIGZyb20gdGhlIGRldmljZSB2ZW5kb3Igb3IgZXZl biBhIHRoaXJkIHBhcnR5LCBub25lIG9mIHdoaWNoIGFyZSB0aGUgVFBNIHZlbmRvci4gRm9yIGV4 YW1wbGUsIHdpdGggQW5kcm9pZCwgR29vZ2xlIHByb2R1Y2VzIHRoZSBPUywgYnV0IGl0IGlzIG9w ZW4gc291cmNlIGFuZCB0aGUgcGhvbmUgKHRoZSBkZXZpY2UpIHZlbmRvciBjYW4gbW9kaWZ5IGl0 LCBzbyB0aGUgUklNIHdvdWxkIHByb2JhYmx5IGNvbWUgZnJvbSB0aGUgcGhvbmUvZGV2aWNlIHZl bmRvci4gSXQgc2VlbXMgcG9zc2libGUgdG8gaGF2ZSBzcGxpdCBSSU1zIHdoZXJlIHBhcnQgY29t ZXMgZnJvbSB0aGUgdGhlIE9TIHZlbmRvciBhbmQgcGFydCBjb21lcyBmcm9tIHRoZSBkZXZpY2Ug dmVuZG9yLg0KICBbZ3V5XSBBZ3JlZWQg4oCTIHRoZSBSSU0gd2lsbCBhbG1vc3QgY2VydGFpbmx5 IG5vdCBjb21lIGZyb20gdGhlIFRQTSB2ZW5kb3IuICBUaGlzIHNlZW1zIGZ1bmRhbWVudGFsbHkg bGlrZSBhIHRhc2sgZm9yIHRoZSBzeXN0ZW0gYWRtaW5pc3RyYXRvciwgdG8gZGVjaWRlIHdobyB0 aGV5IHRydXN0IGZvciBSSU1zLiAgSWYgdGhlIE9FTSBvciBzb2Z0d2FyZSB2ZW5kb3Igc2hpcHMg UklNcywgdGhhdCBzZWVtcyBsaWtlIGFuIG9idmlvdXMgY2hvaWNlLCBidXQgYWRtaW5pc3RyYXRv cnMgY2FuIGRlY2lkZSBhbnkgd2F5IHRoZXkgd2FudC4NCg0KU2VlbXMgbGlrZSBPUy9kZXZpY2Uv M3JkLXBhcnR5IFZlbmRvciBJRHMsIHByb2R1Y3QgbmFtZXMgYW5kIHByb2R1Y3QgdmVyc2lvbnMg YXJlIHZlcnkgbm9uLXVuaWZvcm0uIFlvdSBjb3VsZG7igJl0IHdyaXRlIG11Y2ggZ2VuZXJpYyBW ZXJpZmllciBjb2RlIHRvIHdvcmsgd2l0aCB0aGVtIGFzIHRoZXkgYXJlIHRvZGF5LiBUaGUgYmVz dCBhdHRlbXB0cyBhdCBtYWtpbmcgdGhlc2UgZ2VuZXJpYyBJIGtub3cgb2Ygc2VlbSBFQVTigJlz IElFRUUtYmFzZWQgT0VNSUQsIGFuZCBQU0HigJlzIEVBTi0xMyBiYXNlZCBIVyB2ZXJzaW9uLCBi dXQgSSBkb27igJl0IHRoaW5rIHRoZXNlIGFyZSBlbm91Z2guIE1heWJlIHRoZXJlIGlzIHNvbWV0 aGluZyBlbHNlIG91dCB0aGVyZS4gU1dJRCBvZiBzb21lIHNvcnQ/DQpbZ3V5XSBUQ0cgaGFzIGEg ZHJhZnQgc3BlYyBvdXQgZm9yIHB1YmxpYyByZXZpZXcgY292ZXJpbmcgUklNLiAgJ0RSQUZUOiBU Q0cgUmVmZXJlbmNlIEludGVncml0eSBNYW5pZmVzdCBJbmZvcm1hdGlvbiBNb2RlbCcNCiAgICBo dHRwczovL3RydXN0ZWRjb21wdXRpbmdncm91cC5vcmcvd3AtY29udGVudC91cGxvYWRzL1RDR19S SU1fTW9kZWxfdjEtcjEzXzJmZWIyMC5wZGY8aHR0cHM6Ly91cmxkZWZlbnNlLmNvbS92My9fX2h0 dHBzOi90cnVzdGVkY29tcHV0aW5nZ3JvdXAub3JnL3dwLWNvbnRlbnQvdXBsb2Fkcy9UQ0dfUklN X01vZGVsX3YxLXIxM18yZmViMjAucGRmX187ISFORXQ2eU1hTy1nayFTQUxaNlRhU1E3OG1OeXk4 RHlJUW9ad0U1a3VLd2ZiRXBzbFNsM21nQ3N1dlJkMmNqQURHYVcyLXhYZ3UzWFJJR1E0JD4NClRo ZSBkb2MgaXMgY29tcGxldGVseSBiYXNlZCBvbiBJU08gU1dJRCwgd2l0aCB0aGUgTklTVCBndWlk ZWxpbmVzLiAgVGhlcmXigJlzIGEgQ0JPUiB2YXJpYW50IGNhbGxlZCBDb1NXSUQgYXQgSUVURiAo SSB0aGluayB5b3UgY2FuIGd1ZXNzIHdoaWNoIEhlbmssIG91dCBvZiB0aGUgdW5pdmVyc2Ugb2Yg YWxsIEhlbmtzLCB5b3UgY291bGQgYXNrIGZvciBkZXRhaWxzISkNCiAgSWYgeW91IGhhdmUgaW50 ZXJlc3QgaW4gY29tbWVudGluZyBvbiB0aGUgVENHIFJJTSBzcGVjLCBJIGtub3cgdGhlIGF1dGhv cnMgd291bGQgYmUgZ2xhZCB0byBoZWFyIGZyb20geW91Lg0KICBCdXQgYWJvdXQgaWRlbnRpdHkg b2YgUklNc+KApg0KICBUaGUgUklNIGlzIHNpZ25lZCwgc28gb25jZSB5b3XigJl2ZSBkb25lIHRo ZSBwb2xpY3kgdGFzayBvZiBkZWNpZGluZyB3aGljaCBSSU0gc3VwcGxpZXIgeW91IGxpa2UsIHZl cmlmeWluZyBpdCBpcyBlYXN5LiAgSSByZWFsaXplIG9mIGNvdXJzZSB0aGF0IHRoZXJl4oCZcyBs aXR0bGUgY29tbW9uYWxpdHkgb24gaG93IHRvIG5hbWUgYSBwcm9kdWN0IG9yIHZlcnNpb24sIGJ1 dCBJ4oCZbSBub3Qgc3VyZSB0aGF0IG1hdHRlcnMuICBUaGUgUklNIGNvcnJlc3BvbmRzIHRvIGEg dmVyeSBzcGVjaWZpYyBwcm9kdWN0IGFuZCByZWxlYXNlLiAgVGhlIHZlbmRvciBjYW4gY2FsbCBp dCB3aGF0ZXZlciB0aGV5IHdhbnQsIGFzIGxvbmcgYXMgdGhleSBkb27igJl0IGlzc3VlIHR3byBy ZWxlYXNlIHdpdGggdGhlIHNhbWUgbmFtZS4gIEFmdGVyIHRoYXQsIEkgdGhpbmsgaXTigJlzIGp1 c3QgYSBzdHJpbmcgY29tcGFyZS4NCiAgSSBzdXBwb3NlIGlmIHRoaXJkLXBhcnR5IFJJTSBzdXBw bGllcnMgZXhpc3QsIHRoZW4gdGhlIFJJTSBoYXMgdG8gZXhwbGljaXRseSBjYWxsIG91dCB0aGUg c29mdHdhcmUgbWFudWZhY3R1cmVyIGJ5IG5hbWUsIGJ1dCB0aGF04oCZcyBhbHJlYWR5IHBhcnQg b2YgdGhlIFNXSUQgJiBSSU0gc3BlY3MuDQogIEFzIGZhciBhcyB3ZSBjYW4gdGVsbCwgU1dJRCBl bWJvZGllcyBzdWZmaWNpZW50IGZsZXhpYmlsaXR5IHRvIGRlc2NyaWJlIGFueSBzb2Z0d2FyZSBy ZWxlYXNlIHRoYXQgY2FuIGJlIGV4cHJlc3NlZCBhcyBmaWxlcyBhbmQgZGlyZWN0b3JpZXMuICBJ IGhhdmUgYSBzbWFsbCBwcm9qZWN0IG9uIG15IHRvZG8gbGlzdCB0byBwcm92ZSB0aGF0IGZvciBh IEp1bmlwZXIgcmVsZWFzZSwgYnV0IHNvIGZhciwgSSBkb27igJl0IHNlZSBhIHByb2JsZW0uICBB Z2FpbiwgaWYgeW914oCZcmUgaW50ZXJlc3RlZCwgbm93IGlzIHRoZSB0aW1lIGZvciByZXZpZXch DQoNCg0KQWdyZWVkIHRoYXQgdGhlIGlkZW50aWZpZXIgb2YgdGhlIFJJTSBkb2VzbuKAmXQgaGF2 ZSB0byBiZSBzZWN1cmVkIC8gYXR0ZXN0ZWQsIGp1c3QgbGlrZSBrZXkgSUTigJlzIGRvbuKAmXQg aGF2ZSB0byBiZS4gSWYgdGhlIFZlcmlmaWVyIGdldHMgdGhlIHdyb25nIG9uZSwgdGhlIHZlcmlm aWNhdGlvbiBqdXN0IGZhaWxzLg0KDQpUaGlzIGlzIGNlcnRhaW5seSBub3QgYSBzb2x2ZWQgcHJv YmxlbSBpbiB0aGUgRUFUIHNwYWNlLiBNYXliZSB0aGVyZeKAmXMgYSBzb2x1dGlvbiBpbiBjb21t b24/IE15IGZpcnN0IHRob3VnaCBpcyBzb21lIHNvcnQgb2YgVVJJLCBtYXliZSByZWxhdGVkIHRv IFNXSUQsIHRoYXQgaXMgcGFydCBvZiB0aGUgbWVhc3VyZW1lbnRzIGluIHRoZSBFdmlkZW5jZSBz ZW50IHRvIHRoZSBWZXJpZmllci4gSXQgZG9lc27igJl0IGhhdmUgdG8gYmUgbWFuZGF0b3J5IG9y IHVzZWQgYnkgZXZlcnlvbmUsIGJ1dCBpdCBzZWVtcyBsaWtlbHkgdG8gYmVuZWZpdCBhdCBsZWFz dCBzb21lLg0KW2d1eV0gSGVuayBtaWdodCBoYXZlIHN1Z2dlc3Rpb24gZm9yIHBvdGVudGlhbCBj b21tb25hbGl0eSB3aXRoIEVBVC4gIEFzIG5vdGVkLCBTV0lEIGlzIHN0cm9uZ2x5IG9yaWVudGVk IHRvIHNvZnR3YXJlIHJlbGVhc2VzIHdpdGggcGFja2FnZXMsIGRpcmVjdG9yaWVzIGFuZCBmaWxl cywgYnV0IG1heWJlIHRoZXJl4oCZcyBzb21ldGhpbmcgdXNlZnVsIHRoZXJlLg0KDQpUbyBiZSBj bGVhciwgSeKAmW0gdGhpbmtpbmcgdGhhdCB0aGUgRW5kb3JzZW1lbnQgb2YgdGhlIFRQTSBBdHRl c3RlciBpcyBxdWl0ZSBzZXBhcmF0ZSBmcm9tIHRoZSBFbmRvcnNlbWVudCB0aGF0IGlzIHRoZSBS SU0uIFRoZXkgY29tZSBmcm9tIGNvbXBsZXRlbHkgZGlmZmVyZW50IHZlbmRvcnMuIFRoZSBUUE0g RW5kb3JzZW1lbnQgaXMgb2YgbGl0dGxlIHVzZSB0byBpZGVudGlmeSB0aGUgUklNLg0KW2d1eV0g WWVzLCBpbiBmYWN0IEkgdGhpbmsgdGhlcmUgYXJlIGF0IGxlYXN0IHRocmVlIHN1cHBsaWVycyB0 aGF0IGNvdWxkIGJlIHZlcmlmaWVkOyB0aGUgVFBNIHZlbmRvciwgdGhlIGhhcmR3YXJlIHBsYXRm b3JtIE9FTSB3aG8gbWFkZSB0aGUgQXR0ZXN0ZXIsIGFuZCB0aGUgUklNIHN1cHBsaWVyIHdobyBj ZXJ0aWZpZXMgdGhlIHNvZnR3YXJlIGltYWdlLiAgR2l2ZW4gdGhlIHdheSBSSVYgaXMgc2NvcGVk LCBJIHRoaW5rIHZlcmlmaWNhdGlvbiBvZiB0aGUgVFBNIGl0c2VsZiBpcyB1cCB0byB0aGUgT0VN LCBidXQgdmVyaWZpY2F0aW9uIG9mIHRoZSBPRU3igJlzIERldklEIGFuZCBJQUsgaXMgb25lIHRo aW5nLCBhbmQgdmVyaWZpY2F0aW9uIG9mIHRoZSBhdXRoZW50aWNpdHkgb2YgdGhlIFJJTSBpcyBh bm90aGVyIGluZGVwZW5kZW50IG9wZXJhdGlvbiwgYm90aCBvZiB3aGljaCAgYmVsb25nIGluIGEg UkFUUy1jb21wYXRpYmxlIFZlcmlmaWVyLg0KICBMZXQgbWUga25vdyB3aGF0IHdl4oCZcmUgbWlz c2luZyENCiAgL2d1eQ0KDQpMTA0KDQoNCg0KDQpPbiBBcHIgOSwgMjAyMCwgYXQgNzozMSBBTSwg R3V5IEZlZG9ya293IDxnZmVkb3Jrb3dAanVuaXBlci5uZXQ8bWFpbHRvOmdmZWRvcmtvd0BqdW5p cGVyLm5ldD4+IHdyb3RlOg0KDQpIaSBMYXVyZW5jZSwNCiAgSSB1bmRlcnN0YW5kIHRoYXQgdGhl IGRpc2N1c3Npb24gb24gdGhlIHRvcGljIGJlbG93IG1haW5seSBwZXJ0YWlucyB0byBFQVQsIGJ1 dCBJ4oCZZCBsaWtlIHRvIG1ha2Ugc3VyZSB3ZeKAmXJlIG5vdCBtaXNzaW5nIHNvbWV0aGluZyBv biB0aGUgUklWIHNpZGUuDQogIEZvciBPUyBzb2Z0d2FyZSBpbWFnZSBpbnRlZ3JpdHkgdXNpbmcg YSBUUE0sIGl0IHNlZW1zIGxpa2UgZmluZGluZyB0aGUgcmlnaHQgbWFuaWZlc3Qgc2hvdWxkbuKA mXQgYmUgdGhhdCBoYXJk4oCmDQogIFRoZSBBdHRlc3RlciBuZWVkcyB0byBoYXZlIHByZS1wcm92 aXNpb25lZCBpZGVudGl0eSBhbmQgYXR0ZXN0YXRpb24ga2V5cyBhcyBvdXRsaW5lZCBpbiB0aGUg UklWIGRyYWZ0LiAgVGhhdCBwcm92aWRlcyB0aGUgVmVyaWZpZXIgd2l0aCB0aGUgdmVuZG9yIGlk ZW50aXR5IGZvciB0aGUgcm9vdCBvZiB0cnVzdC4gIFRoZSBtZWFzdXJlbWVudCBsb2dzIGNvbnRh aW4gdGhlIGFsbGVnZWQgcHJvZHVjdCBuYW1lIGFuZCB2ZXJzaW9uIG51bWJlciBmb3IgdGhlIHNv ZnR3YXJlIGluc3RhbGxlZCBvbiB0aGUgYm94LiAgVXNlIHRoZSB2ZW5kb3IgSUQgdG8gbmFycm93 IHRoZSBzY29wZSB0byBzcGVjaWZpYyB2ZW5kb3LigJlzIHByb2R1Y3QgYW5kIHZlcnNpb24gc3Bh Y2UsIGFuZCBmaW5kIHRoZSBSSU0gdGhhdCBtYXRjaGVzLiAgVGhlbiBjaGVjayBpZiB0aGUgaGFz aGVzIGxpbmUgdXA7IGlmIHNvLCB5b3XigJlyZSBnb29kLCBpZiBub3QsIGVpdGhlciB0aGUgY2xh aW0gb2Ygd2hhdCBzb2Z0d2FyZSBpcyBwcmVzZW50IHdhcyBpbmNvcnJlY3QsIG9yIHNvbWV0aGlu ZyBnb3QgaGFja2VkLg0KICBTZWVtcyBsaWtlIGEgdmVyaWZpZXIgY291bGQgZm9sbG93IHRoaXMg c2FtZSBtb2RlbCB0aHJvdWdoIHRoZSBlbnRpcmUgY2hhaW4gb2YgdHJ1c3QsIGV2ZW4gdGhyb3Vn aCBtdWx0aXBsZSB2ZW5kb3JzLCBhcyBsb25nIGFzIHRoZXJlIGFyZSBubyBnYXBzIGluIHRoZSBj aGFpbi4NCiAgSSBrbm93IEVBVCBuZWVkcyB0byB3b3JrIGluIGEgbGVzcy1jb25zdHJhaW5lZCBl bnZpcm9ubWVudCwgYnV0IGxldCBtZSBrbm93IGlmIHlvdSB0aGluayB3ZeKAmXJlIG92ZXJzaW1w bGlmeWluZyB0aGlzIG9uIFJJVi4NCg0KICBUaGFua3MNCi9ndXkNCg0KDQoNCkp1bmlwZXIgQnVz aW5lc3MgVXNlIE9ubHkNCkZyb206IFJBVFMgPHJhdHMtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86 cmF0cy1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIExhdXJlbmNlIEx1bmRibGFkZQ0K U2VudDogVHVlc2RheSwgQXByaWwgNywgMjAyMCAzOjEzIFBNDQpUbzogVGhvbWFzIEZvc3NhdGkg PFRob21hcy5Gb3NzYXRpQGFybS5jb208bWFpbHRvOlRob21hcy5Gb3NzYXRpQGFybS5jb20+Pg0K Q2M6IHJhdHNAaWV0Zi5vcmc8bWFpbHRvOnJhdHNAaWV0Zi5vcmc+OyBOZWQgU21pdGggPG5lZC5z bWl0aEBpbnRlbC5jb208bWFpbHRvOm5lZC5zbWl0aEBpbnRlbC5jb20+Pg0KU3ViamVjdDogUmU6 IFtSYXRzXSBFbmRvcnNlbWVudCBJRCBhbmQgdmVyaWZpY2F0aW9uIGtleSAod2FzIFByb2Nlc3Np bmcgRW5kb3JzZW1lbnRzIGFuZCBFdmlkZW5jZSBpbnRvIFJlc3VsdHMpDQoNCltFeHRlcm5hbCBF bWFpbC4gQmUgY2F1dGlvdXMgb2YgY29udGVudF0NCg0KVGhpcyBpcyBhIHJlcGx5IHRvIGJvdGgg VGhvbWFzIGFuZCBOZWTigJlzIG1lc3NhZ2Ugb24gZGVidWcgaW4gdGhlIHJlbGF0ZWQgdGhyZWF0 Lg0KDQpNeSBpbmNsaW5hdGlvbiBpcyB0byBhc3NvY2lhdGUgZW5kb3JzZW1lbnRzIHdpdGggdGlt ZS1pbnZhcmlhbnQgY2hhcmFjdGVyaXN0aWNzIG9mIHRoZSBkZXZpY2UuIEF0IHRoZSBtb21lbnQg dGhpcyBkb2VzbuKAmXQgc2VlbSBsaWtlIHRoZSBvbmx5IHdheSB0byBkbyBpdCwgYnV0IGl0IHNl ZW1zIGxpa2UgYSBnb29kIHdheS4gVGhpbmdzIHRoYXQgYXJlIG5vdCB0aW1lIGludmFyaWFudCBh cmUgcG9saWN5LCBrLWctdiBvciBzdWNoLg0KDQpFbmRvcnNlbWVudA0KU3lzdGVtIGFyY2hpdGVj dHVyZSDigJQgRG9lcyB0aGUgQXR0ZXN0ZXIgdXNlIGEgVEVFIG9yIGEgVFBNIG9yIG1heWJlIGl0 IGlzIHNpbXBsZSBzeXN0ZW0gd2l0aCBqdXN0IGEgc2ltcGxlIENQVSwgYnV0IGl0IGlzIGVuY2Fz ZWQgaW4gdGl0YW5pdW0uIElzIGRlZmVuc2UgYWdhaW5zdCBjaGlwIGludmFzaXZlIGF0dGFja3Mg Y29uc2lkZXJlZD8gRG8ga2V5cyBiZWNvbWUgaW5hY2Nlc3NpYmxlIHdoZW4gZGVidWcgaXMgZW5h YmxlZC4NCg0KRGV2ZWxvcG1lbnQgcHJvY2VzcyDigJQgSXMgdGhlcmUgYSBzcGVjaWFsIHNlY3Vy aXR5LW9yaWVudGVkIHRlYW0/IERvZXMgdGhlIHRlYW0gaGF2ZSBhIGNvZGUgcmV2aWV3IHBvbGlj eT8gSXMgdGhlcmUgYSBidWcgYm91bnR5PyBBcmUgdGhlIGRlc2t0b3BzIGFuZCBJVCBzeXN0ZW1z IHVzZWQgZm9yIEhXIGFuZCBTVyBkZXZlbG9wbWVudCBpc29sYXRlZD8NCg0KTWFudWZhY3R1cmlu ZyDigJQgQXJlIHRoZSBmYWN0b3JpZXMgc2VjdXJlZCBpbiBhIHNwZWNpYWwgd2F5PyBJcyB0aGUg YXR0ZXN0YXRpb24ga2V5IHByb3Zpc2lvbmluZyBzeXN0ZW0gaGFyZGVuZWQgaW4gc29tZSB3YXkg KGUuZy4sIHVzZXMgSFNNcykuDQoNCkNlcnRpZmljYXRpb25zIOKAlCBUaGVzZSB0YWtlIGEgbG9u ZyB0aW1lIHRvIGFjaGlldmUgYW5kIHdpbGwgdXN1YWxseSByZXF1aXJlIHNvbWUgb2YgdGhlIGFi b3ZlLg0KDQpNeSB0aGlua2luZyBmb3IgRUFUIHdhcyB0aGF0IHlvdSBvbmx5IHB1dCBhdHRlc3Rh dGlvbiBrZXlzIGludG8gZGV2aWNlcyB0aGF0IG1lZXQgc29tZSBjcml0ZXJpYSBsaWtlIHNvbWUg b2YgdGhlIGFib3ZlLiBTaW5jZSB0aGVyZSBpcyBvZnRlbiBubyB3YXkgdG8gcmVjb3ZlciBmcm9t IGEgY29tcHJvbWlzZWQgYXR0ZXN0YXRpb24ga2V5IGJlY2F1c2Ugbm8ga2V5IG1vcmUgc2VjdXJl IHRoYW4gaXQsIHlvdSBraW5kIG9mIGhhdmUgdG8gaGF2ZSBhbGwgdGhhdC4NCg0KU2luY2UgdGhl c2UgZG9u4oCZdCBjaGFuZ2UgbXVjaCBvdmVyIHRpbWUsIHRoZSBlbmRvcnNlbWVudCB3b3VsZG7i gJl0IGNoYW5nZS4gIFRoZXkgY291bGQgZXZlbiBzcGFuIHNldmVyYWwgbW9kZWxzIGFuZCB2YXJ5 aW5nIEhXLg0KDQpQb2xpY3ksIEstRy1WLCBvdGhlcg0KU1cgVmVyc2lvbnMg4oCUIEFzIGxvbmcg YXMgdGhlIFNXIGZvbGxvd3MgYSBkZXZlbG9wbWVudCBwcm9jZXNzIGxpa2UgdGhhdCBhYm92ZSwg aXQgZG9lc27igJl0IGhhdmUgdG8gYmUgaW5jbHVkZWQgaW4gdGhlIGVuZG9yc2VtZW50LiBPZiBj b3Vyc2UgdGhlIHNtYWxsZXIgdGhlIFNXIGFuZCB0aGUgYmV0dGVyIHRoZSBwcm9jZXNzLCB0aGUg bW9yZSBpdCBpcyB0cnVlIChhbmQgdmljZSB2ZXJzYSkuDQoNCkJsYWNrbGlzdHMg4oCUIFRoZXNl IG1pZ2h0IGJlIHNwZWNpZmljIHRvIFVFSURzLCB2ZXJzaW9ucyBvZiBTVywgZGVwbG95bWVudHMg YSBwYXJ0aWN1bGFyIE9FTSBvciBzdWNoDQoNCkRlYnVnIHN0YXR1cyDigJQgTW9zdCBvZiB0aGUg ZGVidWcgc3RhdHVzIHZhbHVlcyBjYW4gdmFyeSBvbiBhIGRheS1kYXkgYmFzaXMNCg0KT0VNIG1v ZGVsIOKAlCBJZiB0aGUgYXR0ZXN0YXRpb24gaXMgaW1wbGVtZW50ZWQgYnkgYSBjaGlwIHZlbmRv ciBhbmQgdGhlIGVuZG9yc2VtZW50IGlzIGZvciB0aGUgY2hpcCwgdGhlbiB0aGUgT0VNIG1vZGVs IHdpbGwgdmFyeSB3aWRlbHkuDQoNCk5vbmUgb2YgdGhlc2UgY2FuIGJlIGNyaXRlcmlhIGFzIHRv IHdoZXRoZXIgYW4gYXR0ZXN0YXRpb24ga2V5IGlzIHB1dCBpbnRvIGEgZGV2aWNlIG9yIG5vdCBh cyB0aGV5IGFyZSBub3Qga25vd24gYXQgbWFudWZhY3R1cmluZyB0aW1lIGFuZC9vciBtdXN0IGJl IGFsbG93ZWQgdG8gdmFyeSB3aWRlbHkgYWZ0ZXIgbWFudWZhY3R1cmluZy4NCg0KDQpJIHRoaW5r IHdoYXQgSeKAmXZlIGRlc2NyaWJlZCBhYm92ZSBsaW5lcyB1cCBwcmV0dHkgd2VsbCBmb3IgYSBU UE0uIFRoZSBzeXN0ZW0gYXJjaGl0ZWN0dXJlIGlzIG1vc3RseSBzZXQgYnkgdGhlIFRDRy4gSFcg VFBNcyBhcmUgYWxtb3N0IGFsd2F5cyBjZXJ0aWZpZWQuIFRoZXkgYXJlIGluZGVwZW5kZW50IG9m IE9FTSBtb2RlbC4gSXQgYWxzbyBsaW5lcyB1cCByZWFzb25hYmx5IHdlbGwgd2l0aCBzZWN1cmUg ZWxlbWVudHMgYW5kIGNhbiBsaW5lIHVwIHdpdGggVEVF4oCZcy4NCg0KVGhlIGNydXggb2YgZW5k b3JzZW1lbnQgdG8gbWUgaXMgdGhlIHNlY3VyaXR5IGNoYXJhY3RlcmlzdGljcyBvZiB0aGUgYXR0 ZXN0ZXIgdGhhdCBwcm90ZWN0IHRoZSBhdHRlc3RhdGlvbiBrZXkgYmVjYXVzZSB0aGVyZSBpcyBn ZW5lcmFsbHkgbm8gcmVjb3ZlcnkgZnJvbSBhIGNvbXByb21pc2VkIGF0dGVzdGF0aW9uIGtleS4g SXQgc2V0cyB0aGUgYmFzZWxpbmUgcmlzayBvZiB0aGUgSFcgYW5kIFNXIG9mIHRoZSBkZXZpY2Uu DQoNCg0KT24gb25lIGV4dHJlbWUgaXMgYSBzZXBhcmF0ZSBlbmRvcnNlbWVudCBmb3IgZXZlcnkg ZGV2aWNlICjigJxtaWNybyBlbmRvcnNlbWVudCI/KSwgd2hpY2ggaXMgd2hhdCBJIHRoaW5rIFRo b21hcyBhbmQgQVJNIFBTQSBhcmUgdGVuZGluZyB0b3dhcmRzLiBUaGUgb3RoZXIgZXh0cmVtZSBp cyBvbmUgZW5kb3JzZW1lbnQgZm9yIGEgcHJvZHVjdCBsaW5lICjigJxtYWNybyBlbmRvcnNlbWVu dCI/KSwsIHNheSBhIHByb2R1Y3QgbGluZSBvZiBUUE1zLiBUaGVuIGl04oCZcyBtb3JlIGxpa2Ug dGhlIGRhdGEgc2hlZXQgZm9yIHRoZSBwcm9kdWN0Lg0KDQpUaGVuIHRoZXJl4oCZcyBkaWZmZXJl bnQgd2F5cyB0byBmYW4gdGhpcyBvdXQgdG8gdGhlIGRpZmZlcmVudCBrZXkgLyBzaWduaW5nIHNj aGVtZXMgKHBlci1kZXZpY2Uga2V5LCBncm91cCBrZXksIEVDREFBLCBYLjUwOSkuIEZvciBleGFt cGxlIGEgbWFjcm8tZW5kb3JzZW1lbnQgY291bGQgaW5jbHVkZSB0aGUgcm9vdCBvZiBhbiBYLjUw OSBoaWVyYXJjaHkgYW5kIHRoZSBpbmRpdmlkdWFsIGRldmljZXMgKG9yIGdyb3VwcyBvZiBkZXZp Y2VzKSB3b3VsZCBoYXZlIGluZGl2aWR1YWwga2V5cyB0aGF0IGNoYWluIHVwLiBXaXRoIGEgbWlj cm8tZW5kb3JzZW1lbnQgdGhlIHBlci1kZXZpY2UgcHVibGljIGtleSBjb3VsZCBiZSBwZXIgZW5k b3JzZW1lbnQuDQoNCg0KVGhlIG1vc3QgaW1wb3J0YW50IHRoaW5nIGFib3V0IHRoZSBlbmRvcnNl bWVudCBzZWVtcyB0byBtZSBpcyB0aGUgY2hhcmFjdGVyaXphdGlvbiBvZiBob3cgdGhlIGF0dGVz dGF0aW9uIGtleSBpcyBwcm90ZWN0ZWQuDQoNCkxMDQoNCg0KDQpPbiBBcHIgNywgMjAyMCwgYXQg NzozNiBBTSwgVGhvbWFzIEZvc3NhdGkgPFRob21hcy5Gb3NzYXRpQGFybS5jb208bWFpbHRvOlRo b21hcy5Gb3NzYXRpQGFybS5jb20+PiB3cm90ZToNCg0KSGkgTGF1cmVuY2UsDQoNClRoYW5rcyBm b3IgYnJpbmdpbmcgdGhpcyB1cC4gIEEgZmV3IHRob3VnaHRzIGJlbG93Lg0KDQpPbiAwMy8wNC8y MDIwLCAyMDozNywgIlJBVFMgb24gYmVoYWxmIG9mIExhdXJlbmNlIEx1bmRibGFkZSINCjxyYXRz LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnJhdHMtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxm IG9mIGxnbEBpc2xhbmQtcmVzb3J0LmNvbTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tPj4g d3JvdGU6DQpTbyBob3cgZG9lcyBhIFZlcmlmaWVyIGZpbmQgdGhlIGFwcGxpY2FibGUgZW5kb3Jz ZW1lbnQgZm9yIEV2aWRlbmNlIGl0DQp3aXNoZXMgdG8gdmVyaWZ5IGFuZCBrbm93IHRoYXQgaXMg cmVhbGx5IHRoZSByaWdodCBlbmRvcnNlbWVudD8NCg0KU2VlbXMgbGlrZSB0aGUgRXZpZGVuY2Ug bmVlZHMgc29tZSBzb3J0IG9mIGFuIGVuZG9yc2VtZW50IGxvY2F0b3IgSUQuDQpUaGlzIGNvdWxk IGJlIGEgVVJMIG9yIGEgR1VJRC4gRUFUIGN1cnJlbnRseSBoYXMgdGhlIG9yaWdpbmF0aW9uIGNs YWltDQp0byB0cnkgdG8gc29sdmUgdGhpcywgYnV0IGl0IGlzIGhhbGYtYmFrZWQuIEl0IG5lZWRz IHRvIGdldCBmaXhlZC4gSeKAmW0NCmZpc2hpbmcgZm9yIGNvbW1lbnRzIGhlcmUgb24gd2hhdCBp dCBzaG91bGQgYmUgbGlrZS4NCg0KUHJldHR5IHN1cmUgdGhlIEVuZG9yc2VtZW50IG5lZWRzIHRv IGluY2x1ZGUgb3IgcmVmZXJlbmNlIHRoZSBwdWJsaWMNCmtleSB0aGF0IGlzIHVzZWQgdG8gdmVy aWZ5IHRoZSBzaWduYXR1cmUuIFdpdGhvdXQgdGhhdCwgdGhlIEF0dGVzdGVyDQpjb3VsZCBsaWUg YW5kIHBpY2sgYW55IG9sZCBFbmRvcnNlbWVudCB0aGF0IGl0IHdpc2hlcy4gVGhlcmUgbmVlZHMg dG8NCmJlIHNvbWUgYmluZGluZyBiZXR3ZWVuIGl0ZW1zIGluIHRoZSBlbmRvcnNlbWVudCAoRTAs IEUxLOKApikgYW5kIHRoZQ0KdmVyaWZpY2F0aW9uIGtleS4gVGhhdCBjb3VsZCBiZSBpbiB0aGUg Zm9ybSBvZiBhIHNpZ25lZCB0b2tlbiBvcg0KY2VydGlmaWNhdGUsIGJ1dCBkb2VzbuKAmXQgaGF2 ZSB0byBiZS4gUHJldHR5IHN1cmUgdGhpcyBuZWVkcyB0byBiZQ0KZGlzY3Vzc2VkIGluIHRoZSBh cmNoaXRlY3R1cmUgZG9jLg0KDQpUaGVyZSdzIGEgZmV3IHNjZW5hcmlvczoNCi0gT25lIGVuZG9y c2VtZW50IGFwcGxpZXMgdG8gbG90cyBvZiBkZXZpY2VzIGluIHRoZSBzYW1lIGNsYXNzLCBidXQN CiBlYWNoIGhhcyB0aGVpciBvd24gYXR0ZXN0YXRpb24ga2V5Lg0KLSAtIFByb2JhYmx5IEVDREFB IGZpdHMgaW4gaGVyZQ0KLSAtIE9uZSBvcHRpb24gaGVyZSBpcyBhbiBYNTA5IGhpZXJhcmNoeQ0K LSBHcm91cCBrZXlzIGFyZSB1c2VkIChmb3IgcHJpdmFjeSByZWFzb25zIG9yIG90aGVyKSBzbyB0 aGVyZSBpcyBhDQogb25lLW9uZSBjb3JyZWxhdGlvbiB3aXRoIHRoZSBFbmRvcnNlbWVudHMgKHRo ZSBHRUlEIGRpc2N1c3Npb24pDQotIEdyb3VwIGtleXMgYXJlIHVzZWQsIGJ1dCBhY3Jvc3MgZGV2 aWNlcyB0aGF0IGhhdmUgZGlmZmVyZW50DQogZW5kb3JzZW1lbnRzIHNvIHRoZXJl4oCZcyBubyBv bmUtb25lIGNvcnJlbGF0aW9uDQoNCldoaWxlIHRoZSBsYXN0IG9uZSBzZWVtcyBvZGQgYW5kIHVu bGlrZWx5LCBJIHRoaW5rIGl0IGNvdWxkIG9jY3VyLA0KYmVjYXVzZSBmcm9tIGEgbG90IG9mIHJl YWwgZXhwZXJpZW5jZSB0aGUgc2V0IHVwIG9mIGF0dGVzdGF0aW9uIGtleXMNCmlzIHZlcnkgaWRp b3N5bmNyYXRpYy4gSXQgaXMgd2lsZGx5IGFmZmVjdGVkIGJ5IG1hbnVmYWN0dXJpbmcgY29zdHMN CmFuZCBpc3N1ZXMgb24gYXNzZW1ibHkgbGluZXMsIHN1YiBjb250cmFjdG9yIHN0cnVjdHVyZSwg bG9jYXRpb24gb2YNCnNlY3VyZSBmYWNpbGl0aWVzIGFuZCBhcHByb2FjaGVzIHRvIG1ha2luZyBt b25leSBvbiBpdC4gVGhleSBhcmUgbGlrZQ0Kc25vd2ZsYWtlcywgZWFjaCBvbmUgaXMgZGlmZmVy ZW50LiAgU28gbWF5YmUgZW5kb3JzZW1lbnQgbG9jYXRvciBJRA0KYW5kIGtleSBJRCBhcmUgbm90 IHRoZSBzYW1lLCBidXQgdGhleSBjYW4gYmUgaW4gc29tZSB1c2UgY2FzZXM/DQoNCkkgYW0gYWxz byB0ZW1wdGVkIHRvIGVuY291cmFnZSB0aGUgcGxhY2VtZW50IG9mIHRoZSBlbmRvcnNlbWVudA0K bG9jYXRvciBJRCBpbiB0aGUgQ09TRSBvciBKT1NFIGhlYWRlciBwYXJhbWV0ZXJzIHNvIHlvdSBk b27igJl0IGhhdmUgdG8NCnBhcnNlIHRoZSB1bnZlcmlmaWVkIGJvZHkgb2YgY2xhaW1zIHRvIGJl IGFibGUgdG8gZmluZCB0aGUga2V5DQptYXRlcmlhbCB0byB2ZXJpZnkgaXQuDQoNClRob3VnaHRz Pw0KDQpBIHR3byBsZXZlbCBsb29rdXAga2V5LCBtb2RlbCtpbnN0YW5jZSwgc2VlbXMgdG8gYmUg cXVpdGUgZ2VuZXJhbGx5DQphcHBsaWNhYmxlIGFzIGFuIGVuZG9yc2VtZW50IGxvY2F0b3IuICBU aGUgbW9kZWwgcGFydCB3b3VsZCBnZXQgeW91IHRvDQp0aGUgc2hhcmVkIGRhdGEgKGUuZy4sIGNl cnRpZmljYXRpb24sIG1lYXN1cmVkIGJvb3QgS0dWcywgZXRjLiksIHdoaWxlDQp0aGUgaW5zdGFu Y2UgcGFydCBjYW4gYmUgdXNlZCB0byByZXRyaWV2ZSBkZXZpY2Utc3BlY2lmaWMgc3RhdGU6DQp2 ZXJpZmljYXRpb24ga2V5KHMpIGFzIHdlbGwgYXMgb3RoZXIgbWV0YWRhdGEsIGUuZy4sIGlmIHNv bWUgZ2VhciBpcw0KYmxhY2tsaXN0ZWQuICBJbiBQU0Egd2UgaGF2ZSBzb21ldGhpbmcgcXVpdGUg KHRob3VnaCBub3QgZW50aXJlbHkpDQpzaW1pbGFyIHdpdGggaW1wbGVtZW50YXRpb24gYW5kIGlu c3RhbmNlIElEcyBbMV0gWzJdLg0KDQooQ29udGV4dC1zd2l0Y2hpbmcgZm9yIGEgc2Vjb25kIG9u IG91ciBwcmV2aW91cyBVRUlEL0dFSUQgZGlzY3Vzc2lvbjogSQ0KZ3Vlc3Mgd2UgbWlnaHQgbW9k ZWwgYW4gaW5zdGFuY2UgYXMgYW4gYW5vbnltaXR5IHNldCwgYW5kIHRoZXJlZm9yZQ0KdHJlYXQg RVVJRHMgYXMgdGhlIHNwZWNpYWwgY2FzZSBHRUlEcyB3aXRoIGNhcmRpbmFsaXR5ID09IDE/KQ0K DQpGb3IgdGhlIHNha2Ugb2YgYnVpbGRpbmcgYSBzaGFyZWQgYW5kIHJldXNhYmxlIHZvY2FidWxh cnksIEknZCBwcmVmZXINCmtlZXBpbmcgbW9kZWwgYW5kIGluc3RhbmNlIGlkZW50aWZpZXJzIGFz IHNlcGFyYXRlIGNsYWltcyByYXRoZXIgdGhhbg0KaGF2aW5nIGFuIG9wYXF1ZSBlbmRvcnNlbWVu dCBJRCBjbGFpbSB0aGF0IGNsdW1wcyB0b2dldGhlciB0aG9zZSBhbmQNCnBvc3NpYmx5IG90aGVy IHN0dWZmIGluIGEgdXNlLWNhc2Ugc3BlY2lmaWMgZmFzaGlvbi4gIEZvciB0aGUgc2FtZQ0KcmVh c29uIEkgd291bGQgbm90IG92ZXJyaWRlIGtleSBJRCB3aXRoIGluc3RhbmNlIElEIHNlbWFudGlj cy4NCg0KY2hlZXJzLCB0aGFua3MhDQoNClsxXSBodHRwczovL3d3dy5pZXRmLm9yZy9pZC9kcmFm dC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFtZS1pbXBsZW1lbnRhdGlvbi1p ZDxodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L3d3dy5pZXRmLm9yZy9pZC9kcmFm dC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwqbmFtZS1pbXBsZW1lbnRhdGlvbi1p ZF9fO0l3ISFORXQ2eU1hTy1nayFSUThneU8zUm95LWRJRWQ2U19rYTQ1bEZFR20xR0lIMmx0X0Qx TmFmbWFRV3BqanNPeDYyOXpodS1MbVVpMU1NTVdzJD4NClsyXSBodHRwczovL3d3dy5pZXRmLm9y Zy9pZC9kcmFmdC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFtZS1pbnN0YW5j ZS1pZDxodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L3d3dy5pZXRmLm9yZy9pZC9k cmFmdC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwqbmFtZS1pbnN0YW5jZS1pZF9f O0l3ISFORXQ2eU1hTy1nayFSUThneU8zUm95LWRJRWQ2U19rYTQ1bEZFR20xR0lIMmx0X0QxTmFm bWFRV3BqanNPeDYyOXpodS1MbVVRaFN6ZzRFJD4NCg0KDQoNCklNUE9SVEFOVCBOT1RJQ0U6IFRo ZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVu dGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVu ZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBk byBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBm b3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBt ZWRpdW0uIFRoYW5rIHlvdS4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQpSQVRTIG1haWxpbmcgbGlzdA0KUkFUU0BpZXRmLm9yZzxtYWlsdG86UkFUU0Bp ZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0czxodHRw czovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3JhdHNfXzshIU5FdDZ5TWFPLWdrIVJROGd5TzNSb3ktZElFZDZTX2thNDVsRkVHbTFHSUgy bHRfRDFOYWZtYVFXcGpqc094NjI5emh1LUxtVXpRVFBVQVkkPg0KDQoNCg== --_000_8B8EFB047C334058BC53E33A86802D6Eintelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <0EBFB21FB137B843B2E4C4E0CE9F6906@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAxMSA2IDQg MiAyIDIgMiAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpMYXRvOw0KCXBhbm9zZS0x OjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6QXJpYWxN VDsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9u cyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46 MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQpwLm1zaXBmb290ZXIzMGIzZDUzOCwgbGkubXNpcGZvb3RlcjMwYjNkNTM4 LCBkaXYubXNpcGZvb3RlcjMwYjNkNTM4DQoJe21zby1zdHlsZS1uYW1lOm1zaXBmb290ZXIzMGIz ZDUzODsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uYXBwbGUt Y29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1zcGFjZTt9 DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglm b250LWZhbWlseToiQ291cmllciBOZXciOw0KCWNvbG9yOndpbmRvd3RleHQ7DQoJZm9udC13ZWln aHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsOw0KCXRleHQtZGVjb3JhdGlvbjpub25lIG5v bmU7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9u dC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47 DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7 cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVO LVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPkl0IHdhcyBzdGF0ZWQgb3IgaW1wbGllZCBieSBzb21lb25lIGVh cmxpZXIgaW4gdGhpcyB0aHJlYWQgdGhhdCBtYW5hZ2luZyBFbmRvcnNlbWVudHMgaW4gYW4gSW9U IGVjb3N5c3RlbSB3b3VsZCBiZSBjb21wbGljYXRlZC4gT25lIHBvdGVudGlhbCBzaW1wbGlmeWlu ZyBhcHByb2FjaCBvYnNlcnZlcyB0aGF0LCBhdCBsZWFzdCBpbiB0ZXJtcw0KIG9mIFNXL0ZXIGlt YWdlIGludGVncml0eSBjbGFpbXMsIHRoZSBwYXJ0IHRoYXQgbWlnaHQgYmUgY2FsbGVkIGEg4oCY cmVmZXJlbmNlIG1hbmlmZXN04oCZIGlzIGFscmVhZHkgYSBzdWJzZXQgb2YgdGhlIFNXIHVwZGF0 ZSBtYW5pZmVzdCAoU1VJVCkuIFRoYXQgaXMsIHRoZSBpZGVudGlmaWNhdGlvbiBvZiB0aGUgaW1h Z2UsIGFuIGludGVncml0eSBkaWdlc3Qgb2YgdGhlIGltYWdlIGFuZCBhIHNpZ25hdHVyZSBvdmVy IHBvc3NpYmx5IG11bHRpcGxlIGRpZ2VzdHMNCiBpcyB2ZXJ5IGNsb3NlIHRvIHdoYXQgUkFUUyBh cmNoIGRlZmluZXMgYXMgYSByZWZlcmVuY2UgbWFuaWZlc3QuIFRoZSBtYWluIGRpZmZlcmVuY2Ug aXMgYSBTVUlUIG1hbmlmZXN0IGFsc28gY29udGFpbnMgdGhlIHVwZGF0ZSBpbWFnZShzKTsgd2hp Y2ggYSBSQVRTIFZlcmlmaWVyIGRvZXNu4oCZdCBuZWVkLg0KPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDsiPkEgcmVhc29uYWJsZSBTVyB1cGRhdGUgdXNlIGNhc2UgdGhhdCBpbmNsdWRlcyBhdHRlc3Rh dGlvbiBtaWdodCBwYXNzIHRoZSBTVUlUIG1hbmlmZXN0IG1pbnVzIHRoZSBpbWFnZXMgYXMgRW5k b3JzZW1lbnRzIHRvIHRoZSBWZXJpZmllciB3aG8gbWlnaHQgKHVwb24gc3VjY2Vzc2Z1bCBhdHRl c3RhdGlvbikgZ2l2ZSBBdHRlc3RhdGlvbiBSZXN1bHRzDQogdG8gYSBSZWx5aW5nIFBhcnR5IGlu IGNoYXJnZSBvZiBTVyB1cGRhdGUgd2hvIG1pZ2h0IHByb2NlZWQgdG8gaW5zdGFsbCBhbiB1cGRh dGUuIFRoZSBSZWx5aW5nIFBhcnR5IG1pZ2h0IGRlY2lkZSB0byBzaGFyZSBqdXN0IHRoZSByZWZl cmVuY2UgbWVhc3VyZW1lbnRzIGZvciB0aGUgbmV3bHkgaW5zdGFsbGVkIFNXIHdpdGggdGhlIFZl cmlmaWVyIGZvciBzdWJzZXF1ZW50IGF0dGVzdGF0aW9uIHZlcmlmaWNhdGlvbnMuDQo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyI+VGhpcyBhcHByb2FjaCBhbGxvd3MgdGhlIFNXIHZlbmRvciB0aGUg YWJpbGl0eSB0byBjcmVhdGUgRW5kb3JzZW1lbnRzIHVzaW5nIHRoZSBzYW1lIHRvb2wgY2hhaW4g dXNlZCB0byBnZW5lcmF0ZSB0aGUgU1VJVCBtYW5pZmVzdC4NCjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij5TaW5jZSB0aGUgSW9UIHZlbmRvcnMgYXJlIChwcmVzdW1hYmx5KSBhbHJlYWR5IG1vdGl2 YXRlZCB0byBpbXBsZW1lbnQgU1VJVCwgdGhleSBjb25jZWl2YWJseSBhcmUgbm90IG92ZXJseSBi dXJkZW5lZCBieSBjcmVhdGluZyBFbmRvcnNlbWVudHMgZm9yIFJBVFMgdXNlIGNhc2VzLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij5TVUlUIG1hbmlmZXN0cyBjYW4gKGF0IGxlYXN0IGluIHBhcnQp IGJlIENvU1dJRC4gSSBiZWxpZXZlIGl0IGlzIHBvc3NpYmxlIGZvciBDb1NXSUQgdG8gaW5jbHVk ZSBVQ0NTIGNsYWltcyB3aGljaCBpbXBsaWVzIGl0IGlzIHBvc3NpYmxlIHRvIGV4dGVuZCBhIFNV SVQgbWFuaWZlc3QgdG8gaW5jbHVkZSBvdGhlciBjbGFpbXMgYmVzaWRlcyBjb2RlDQogaW50ZWdy aXR5IGNsYWltcy4gQW4gSW9UIGRldmljZSBPRU0gbWlnaHQgYmUgaW4gYSBwb3NpdGlvbiB0byBt YWtlIGJvdGggY29kZSBpbnRlZ3JpdHkgYW5kIG90aGVyIGNsYWltcy4gVGhhdCB3b3VsZCBiZSBh IG5hdHVyYWwgZXh0ZW5zaW9uIHRvIHRoZWlyIHJlbGVhc2UgcHJvY2VzcyB0aGF0IHByb2R1Y2Vz IGEgU1VJVCBtYW5pZmVzdC4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5SZWdhcmRzLDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+LU5lZDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4w cHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkd1eSBGZWRvcmtvdyAmbHQ7Z2ZlZG9ya293 QGp1bmlwZXIubmV0Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5Nb25kYXksIEFwcmlsIDEzLCAyMDIw IGF0IDEyOjE4IFBNPGJyPg0KPGI+VG86IDwvYj5MYXVyZW5jZSBMdW5kYmxhZGUgJmx0O2xnbEBp c2xhbmQtcmVzb3J0LmNvbSZndDs8YnI+DQo8Yj5DYzogPC9iPiZxdW90O3JhdHNAaWV0Zi5vcmcm cXVvdDsgJmx0O3JhdHNAaWV0Zi5vcmcmZ3Q7LCAmcXVvdDtTbWl0aCwgTmVkJnF1b3Q7ICZsdDtu ZWQuc21pdGhAaW50ZWwuY29tJmd0OywgSmVzc2ljYSBGaXR6Z2VyYWxkLU1jS2F5ICZsdDtqbWZt Y2theUBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJFOiBbUmF0c10gRW5kb3Jz ZW1lbnQgSUQgYW5kIHZlcmlmaWNhdGlvbiBrZXkgKHdhcyBQcm9jZXNzaW5nIEVuZG9yc2VtZW50 cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBMYXVyZW5jZSw8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyBJIGRvbuKAmXQgZGlzYWdyZWUgYWJvdXQgdGhlIGNv bXBsZXhpdHkgb2YgdGhlIG1hcmtldCBzcGFjZSBvdXRzaWRlIHRoZSByb3V0ZXIgd29ybGQsIGFs dGhvdWdoIHRoZSBUQ0cgUklNIGFuZCBJU08gU1dJRCBhcmUgbWVhbnQgdG8gd29yayBpbiBtb3Jl IGNoYW90aWMgZWNvc3lzdGVtcywgYW5kIEkgdGhpbmsgdGhhdOKAmXMgcmVmbGVjdGVkIGluIHRo ZSBleGNlcnB0IGJlbG93LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7IElmIHlvdSBzZWUgc29tZXRoaW5nIHRoYXQgeW91IHRoaW5rIHdvdWxkIGhlbHAgYmluZCB0 aGUgUklNIGFuZCBhIHByb2R1Y3QgbW9yZSByZWxpYWJseSwgSeKAmW0gc3VyZSB0aGUgVENHIGVk aXRvcnMgd291bGQgd2FudCB0byBoZWFyIGFib3V0IGl0LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7IFRoYW5rczxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+L2d1eTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Im1zaXBmb290ZXIz MGIzZDUzOCIgYWxpZ249ImNlbnRlciIgc3R5bGU9Im1hcmdpbjowaW47bWFyZ2luLWJvdHRvbTou MDAwMXB0O3RleHQtYWxpZ246Y2VudGVyIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQ7 Y29sb3I6YmxhY2siPkp1bmlwZXIgQnVzaW5lc3MgVXNlIE9ubHk8L3NwYW4+PG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFF MUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+RnJvbTo8L2I+IExhdXJlbmNlIEx1bmRibGFkZSAmbHQ7bGdsQGlzbGFuZC1yZXNvcnQu Y29tJmd0OyA8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBBcHJpbCAxMywgMjAyMCAyOjQ0IFBN PGJyPg0KPGI+VG86PC9iPiBHdXkgRmVkb3Jrb3cgJmx0O2dmZWRvcmtvd0BqdW5pcGVyLm5ldCZn dDs8YnI+DQo8Yj5DYzo8L2I+IHJhdHNAaWV0Zi5vcmc7IE5lZCBTbWl0aCAmbHQ7bmVkLnNtaXRo QGludGVsLmNvbSZndDs7IEplc3NpY2EgRml0emdlcmFsZC1NY0theSAmbHQ7am1mbWNrYXlAZ21h aWwuY29tJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1JhdHNdIEVuZG9yc2VtZW50IElE IGFuZCB2ZXJpZmljYXRpb24ga2V5ICh3YXMgUHJvY2Vzc2luZyBFbmRvcnNlbWVudHMgYW5kIEV2 aWRlbmNlIGludG8gUmVzdWx0cyk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJsaW5lLWhlaWdodDoxMi4wcHQ7YmFja2dyb3VuZDojRkZFQjlDIj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTpMYXRvO2NvbG9yOmJsYWNrIj5b RXh0ZXJuYWwgRW1haWwuIEJlIGNhdXRpb3VzIG9mIGNvbnRlbnRdPC9zcGFuPjwvYj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNvIEkgc3VzcGVjdCB0aGUgcm91dGVyIHdvcmxkIGlz IHJlYWxseSBkaWZmZXJlbnQgZnJvbSB0aGUgSW9UIHdvcmxkIGluIGEgd2F5IHRoYXQgYWZmZWN0 cyB0aGUgZmluZGluZyBvZiBSSU1zLiZuYnNwOw0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5TZWVtcyBsaWtlIHRoZSByb3V0ZXIgd29ybGQgaXMgYSBzbWFs bCBudW1iZXIgb2YgbWFudWZhY3R1cmVycywgbGVzcyB0aGFuIHRlbi4gU2VlbXMgbGlrZSByb3V0 ZXJzIGFyZSBwdXJjaGFzZWQgYW5kIG1hbmFnZWQgYnkgdmVyeSB0ZWNobmljYWxseSBjb21wZXRl bnQgc3RhZmYgdGhhdCBhbHJlYWR5IHdvcmsgd2l0aCBsb3RzIG9mIHRlY2huaWNhbCBkZXRhaWxz LiBJdOKAmXMgbm90IHRoYXQgaGFyZCBmb3IgbmV0d29yaw0KIGFkbWlucyB0byBnbyB0byB0aGUg cm91dGVyIG1hbnVmYWN0dXJlcnMgd2ViIHNpdGUgYW5kIGRvd25sb2FkIGEgZmV3IFJJTXMgYW5k IGNvbmZpZ3VyZSB0aGVtIGludG8gdGhlaXIgdmVyaWZpZXJzLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TZWVtcyBsaWtlIHRoZSBJb1Qgd29y bGQgaW52b2x2ZXMgYSBtdWNoIGxhcmdlciBudW1iZXIgb2YgbWFudWZhY3R1cmVycywgaHVuZHJl ZHMgb3IgZXZlbiB0aG91c2FuZHMuIElvVCBtYW5hZ2VtZW50IGlzIHNjYXR0ZXJlZCBhbmQgd29y a3MgaW4gbG90cyBvZiBkaWZmZXJlbnQgd2F5cy4gU29tZXRpbWVzIGl0IGlzIHRoZSBkZXZpY2Ug bWFrZXIgaXRzZWxmLiBTb21ldGltZXMgaXQgaXMgYW4gZW50ZXJwcmlzZS4NCiBTb21ldGltZXMg aXQgaXMgYSB0aGlyZCBwYXJ0eSwgbWF5YmUgd2l0aCBhIGZvdXJ0aCBhbmQgZmlmdGggcGFydHku Li48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ UGhvbmVzIGhhdmUgdGhlaXIgb3duIGNoYWxsZW5nZSDigJQgdGhleSBoYXZlIGh1Z2UgbnVtYmVy cyBvZiByZWx5aW5nIHBhcnRpZXMg4oCUIGVhY2ggYXBwIGlzIGEgcmVseWluZyBwYXJ0eS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SXQgc2Vl bXMgYSBVUkktYmFzZWQgc2NoZW1lIGZvciBmaW5kaW5nIFJJTXMgaXMgaW1wb3J0YW50IGZvciB0 aGUgSW9UIHdvcmxkLCBhbmQgbWF5YmUgdGhlIHBob25lIHdvcmxkLCBidXQgbm90IHNvIG11Y2gg Zm9yIHRoZSByb3V0ZXIgd29ybGQuIFNlZW1zIGxpa2UgaXQgaGFzIHRvIGJlIFVSSS1iYXNlZCBi ZWNhdXNlIHRoYXTigJlzIHRoZSB3YXkgdG8gaWRlbnRpZnkgYSByZXNvdXJjZSBvbiB0aGUgYnJv YWQgaW50ZXJuZXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkl0IGxvb2tzIGxpa2UgdGhlJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZl bnNlLmNvbS92My9fX2h0dHBzOi90cnVzdGVkY29tcHV0aW5nZ3JvdXAub3JnL3dwLWNvbnRlbnQv dXBsb2Fkcy9UQ0dfUklNX01vZGVsX3YxLXIxM18yZmViMjAucGRmX187ISFORXQ2eU1hTy1nayFT QUxaNlRhU1E3OG1OeXk4RHlJUW9ad0U1a3VLd2ZiRXBzbFNsM21nQ3N1dlJkMmNqQURHYVcyLXhY Z3UzWFJJR1E0JCI+VENHIFJJTSBkb2N1bWVudDwvYT4mbmJzcDthbHJlYWR5DQogaGFzIHNvbWV0 aGluZyBsaWtlIHRoaXMgYXMgbWVudGlvbmVkIGluIEFwcGVuZGl4IEMuIE5vdCBzdXJlIGl0IGlz IGZ1bGx5IGRldmVsb3BlZCBhcyBpdCBpcyBpbiBhbiBhcHBlbmRpeC48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6QXJpYWxNVCI+VGhlIFRDRyBQbGF0Zm9ybSBDZXJ0aWZpY2F0ZSBQ cm9maWxlIFsxMF0gYWxzbyBkZWZpbmVzIGEgUGxhdGZvcm1Db25maWd1cmF0aW9uVVJJIGF0dHJp YnV0ZSB0aGF0IGNvbnRhaW5zIOKAnDx1PlVSSSB3aGVyZSB0aGUgcmVmZXJlbmNlIGludGVncml0 eQ0KIG1lYXN1cmVtZW50cyBjb3VsZCBiZSBvYnRhaW5lZCBieSB0aGUgdmVyaWZpZXI8L3U+4oCd LiBUaGUgUGxhdGZvcm0gQ2VydGlmaWNhdGVzIFBsYXRmb3JtIENvbmZpZ3VyYXRpb24gVVJJIE1V U1QgaG9sZCBhIHJlZmVyZW5jZSB0byB0aGUgbG9jYXRpb24gb2YgdGhlIFByaW1hcnkgUklNIEJ1 bmRsZS4gVGhlIFVSSSBNQVkgcG9pbnQgdG8gYSBsb2NhdGlvbiBvbiB0aGUgRW5kcG9pbnQgcGxh dGZvcm0gb3IgaXQgTUFZIHJlc2lkZSBpbiBhIHB1YmxpY2x5DQogYWNjZXNzaWJsZSBsb2NhdGlv bi4gVGhlIEJhc2UgUklNIE1VU1QgY29udGFpbiBhIExJTksgZWxlbWVudCB0aGF0IHBvaW50cyB0 byB0aGUgc2FtZSBVUkkgYXMgdGhlIFBsYXRmb3JtIENlcnRpZmljYXRlcyBQbGF0Zm9ybUNvbmZp Z3VyYXRpb25VUkkuJm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkdsYWQgdG8gc2VlIHRoZSB1c2Ugb2YgQ29TV0lELiBTZWVtcyBsaWtlIHRo YXQgd2lsbCBsaW5lIHVwIGZvciBFQVQgYXMgd2VsbC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9t OjEyLjBwdCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5PbiBBcHIgMTMsIDIwMjAsIGF0IDg6MjQgQU0sIEd1eSBGZWRvcmtvdyAmbHQ7PGEgaHJl Zj0ibWFpbHRvOmdmZWRvcmtvd0BqdW5pcGVyLm5ldCI+Z2ZlZG9ya293QGp1bmlwZXIubmV0PC9h PiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5IaSBMYXVyZW5jZSw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOyBUaGFua3MgZm9yIHlvdXIgcmVzcG9uc2XigKYmbmJzcDsgSeKAmXZl IGFkZGVkIGFubm90YXRpb25zLCBtYXJrZWQgd2l0aDxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6IzJGNTU5NyI+W2d1eV08 L3NwYW4+4oCmPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4vZ3V5PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJ0ZXh0LWFsaWduOmNlbnRlciI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo3LjBwdCI+SnVuaXBlciBCdXNpbmVzcyBVc2UgT25seTwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPkxhdXJlbmNlIEx1bmRibGFkZSAmbHQ7PGEgaHJlZj0ibWFpbHRv OmxnbEBpc2xhbmQtcmVzb3J0LmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+bGdsQGlz bGFuZC1yZXNvcnQuY29tPC9zcGFuPjwvYT4mZ3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5TdW5kYXksIEFwcmlsIDEyLCAyMDIwIDI6 NTYgUE08YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPkd1eSBGZWRvcmtvdyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmdmZWRvcmtvd0Bq dW5pcGVyLm5ldCI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+Z2ZlZG9ya293QGp1bmlwZXIu bmV0PC9zcGFuPjwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86cmF0c0BpZXRmLm9yZyI+ PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cmF0c0BpZXRmLm9yZzwvc3Bhbj48L2E+OyBOZWQg U21pdGggJmx0OzxhIGhyZWY9Im1haWx0bzpuZWQuc21pdGhAaW50ZWwuY29tIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5uZWQuc21pdGhAaW50ZWwuY29tPC9zcGFuPjwvYT4mZ3Q7PGJyPg0K PGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPlJlOiBbUmF0c10gRW5kb3JzZW1lbnQgSUQgYW5kIHZlcmlmaWNhdGlvbiBrZXkgKHdh cyBQcm9jZXNzaW5nIEVuZG9yc2VtZW50cyBhbmQgRXZpZGVuY2UgaW50byBSZXN1bHRzKTxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+VHJ5aW5nIGFnYWluLCBhZnRlciByZSByZWFkaW5nIHlvdXIgcXVl c3Rpb24gYSBmZXcgdGltZXMgKGFuZCBhIGZldyBub3Qtc2VudCByZXBsaWVzKS48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkZpcnN0IHlvdSBuZWVkIHRoZSBlbmRvcnNlbWVudCBmb3IgdGhlIFRQTSB0aGF0 IGlzIHNlcnZpbmcgYXMgdGhlIGF0dGVzdGVyLiBUaGlzIGVuZG9yc2VtZW50IHdvdWxkIGNvbWUg ZnJvbSB0aGUgVFBNIHZlbmRvci4gSSBhc3N1bWUgdGhhdCBpcyBmYWlybHkgd2VsbCB1bmRlcnN0 b29kIGFuZCBpbiBwcmFjdGljZSB0b2RheSB0aHJvdWdoIFRQTSBhcmNoaXRlY3R1cmUgYW5kIGNv bnZlbnRpb25zIGFscmVhZHkNCiBpbiBwbGFjZSB3aXRoIHRoaW5ncyBsaWtlIElEZXZJRC4gKE1h eWJlIHlvdSBhbGwga25vdyBpdCwgYnV0IEkgZG9u4oCZdCBrbm93IGhvdyB0aGlzIHdvcmtzLiBJ IHdvdWxkIGJlIGludGVyZXN0ZWQgaW4gcmVmZXJlbmNlcyBhbmQvb3IgYSBkZXNjcmlwdGlvbiBv ZiBpdCkuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzJGNTU5NyI+W2d1eV0gWWVzLCBJIHRoaW5rIG1vc3QgVFBN cyBzaGlwIHdpdGggYSBwcmUtcHJvdmlzaW9uZWQgRW5kb3JzZW1lbnQgS2V5IGFuZCBhIGNlcnRp ZmljYXRlIHNpZ25lZCBieSB0aGUgVFBNIG1hbnVmYWN0dXJlci4mbmJzcDsgVXNlIG9mIHRoYXQg a2V5IGlzIGNvbnRyb2xsZWQgdG8gcHJldmVudCB1bndhbnRlZCBwcml2YWN5IGFidXNlcywgYnV0 IGl04oCZcyB0aGVyZSBzcGVjaWZpY2FsbHkNCiB0byB2YWxpZGF0ZSB0aGUgc291cmNlIG9mIHRo ZSBUUE0uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMyRjU1OTciPiZuYnNwOyBGb3IgUklWLCBJ4oCZ bSBub3Qgc3VyZSB0aGF0IG5lZWRzIHRvIGJlIGRvbmUgYnkgdGhlIGVuZC11c2VyIG9mIHRoZSBk ZXZpY2XigKYmbmJzcDsgdGhlIE9FTSB3aG8gbWFrZXMgdGhlIOKAmHJvdXRlcuKAmSAoeWVzLCBv ciBzd2l0Y2ggb3IgZmlyZXdhbGwgb3IgYWNjZXNzIHBvaW50KSBzaG91bGQgcHJlLXByb3Zpc2lv biBhIERldklEIHNpZ25lZCBieSB0aGUgT0VNLCBhbmQgYQ0KIHRydXN0d29ydGh5IE9FTSB3b3Vs ZG7igJl0IHNpZ24gYW4gSURldklEIGluIHRoZWlyIGZhY2lsaXR5IHdpdGhvdXQgdmVyaWZ5aW5n IHRoYXQgdGhlIFRQTSB0aGV54oCZdmUganVzdCBzb2xkZXJlZCBkb3duIGlzIGF1dGhlbnRpYy48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzJGNTU5NyI+Jm5ic3A7IFNvbWUgT0VNcyBhY3R1YWxseSBj dXN0b21pemUgdGhlaXIgVFBNcyBzbGlnaHRseSB0byBjb250YWluIHRoZWlyIG93biBzaWduYXR1 cmUgb24gdGhlIEVLLCByYXRoZXIgdGhhbiB0aGUgVFBNIHZlbmRvcuKAmXMsIGJ1dCBJIGRvbuKA mXQgdGhpbmsgdGhhdOKAmXMgY29tbW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMkY1NTk3Ij4m bmJzcDsgSW4gYWRkaXRpb24gdG8gdGhlIGlkZW50aXR5IG9mIHRoZSBkZXZpY2UgaXRzZWxmLCBS SVYgZGVwZW5kcyBvbiB2ZXJpZmljYXRpb24gb2YgdGhlIGNlcnRpZmljYXRlIHRoYXQgZ29lcyB3 aXRoIHRoZSBUUE0gQXR0ZXN0YXRpb24ga2V5LiZuYnNwOyBXZeKAmXZlIG1hZGUgdGhhdCBhcyBl YXN5IGFzIHBvc3NpYmxlIGluIFJJViBieSBwcmUtcHJvdmlzaW9uaW5nIHRoZSBJQUsNCiBhbG9u ZyB3aXRoIHRoZSBJRGV2SUQsIHNvIHRoZSB0d28gd2lsbCBjb250YWluIHRoZSBzYW1lIGlkZW50 aXR5IGluZm9ybWF0aW9uLCBzaWduZWQgYnkgdGhlIHNhbWUgdmVuZG9yLjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMkY1NTk3Ij4mbmJzcDsgRm9yIG1vcmUtZ2VuZXJpYyBU UE0gYXBwbGljYXRpb25zIHdoZXJlIGEgcHJlLXByb3Zpc2lvbmVkIERldklEIG1heSBiZSBpbmFw cHJvcHJpYXRlLCB0aGVyZeKAmXMgYSB3ZWxsLXNwZWNpZmllZCBzZXJpZXMgb2Ygc3RlcHMgdG8g dmFsaWRhdGUgdGhlIFRQTSBiZWZvcmUgcmVtb3RlbHkgaW5zdGFsbGluZyB0aGUgSUQgb3IgYXR0 ZXN0YXRpb24ga2V5cy4mbmJzcDsgVGhlDQogVENHIHNwZWMgd2l0aCB0aGUgZ29yeSBkZXRhaWxz IGlzIHN0aWxsIGluIGRyYWZ0LCBidXQgaWYgeW91IGhhdmUgVENHIGFjY2VzcywgaXTigJlzIGNh bGxlZCDigJxUUE0gS2V5cyBmb3IgUGxhdGZvcm0gRGV2SUQgZm9yIFRQTTLigJ0uPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5OZXh0IHlvdSBuZWVkIHRvIGlkZW50aWZ5IHRoZSBSSU0uIFRoYXQgbWlnaHQg Y29tZSBmcm9tIHRoZSBPUyBWZW5kb3Igb3IgZnJvbSB0aGUgZGV2aWNlIHZlbmRvciBvciBldmVu IGEgdGhpcmQgcGFydHksIG5vbmUgb2Ygd2hpY2ggYXJlIHRoZSBUUE0gdmVuZG9yLiBGb3IgZXhh bXBsZSwgd2l0aCBBbmRyb2lkLCBHb29nbGUgcHJvZHVjZXMgdGhlIE9TLCBidXQgaXQgaXMgb3Bl biBzb3VyY2UgYW5kIHRoZSBwaG9uZQ0KICh0aGUgZGV2aWNlKSB2ZW5kb3IgY2FuIG1vZGlmeSBp dCwgc28gdGhlIFJJTSB3b3VsZCBwcm9iYWJseSBjb21lIGZyb20gdGhlIHBob25lL2RldmljZSB2 ZW5kb3IuIEl0IHNlZW1zIHBvc3NpYmxlIHRvIGhhdmUgc3BsaXQgUklNcyB3aGVyZSBwYXJ0IGNv bWVzIGZyb20gdGhlIHRoZSBPUyB2ZW5kb3IgYW5kIHBhcnQgY29tZXMgZnJvbSB0aGUgZGV2aWNl IHZlbmRvci48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMkY1NTk3Ij4mbmJzcDsgW2d1eV0gQWdyZWVkIOKAkyB0 aGUgUklNIHdpbGwgYWxtb3N0IGNlcnRhaW5seSBub3QgY29tZSBmcm9tIHRoZSBUUE0gdmVuZG9y LiZuYnNwOyBUaGlzIHNlZW1zIGZ1bmRhbWVudGFsbHkgbGlrZSBhIHRhc2sgZm9yIHRoZSBzeXN0 ZW0gYWRtaW5pc3RyYXRvciwgdG8gZGVjaWRlIHdobyB0aGV5IHRydXN0IGZvciBSSU1zLiZuYnNw OyBJZiB0aGUgT0VNIG9yIHNvZnR3YXJlIHZlbmRvcg0KIHNoaXBzIFJJTXMsIHRoYXQgc2VlbXMg bGlrZSBhbiBvYnZpb3VzIGNob2ljZSwgYnV0IGFkbWluaXN0cmF0b3JzIGNhbiBkZWNpZGUgYW55 IHdheSB0aGV5IHdhbnQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TZWVtcyBs aWtlIE9TL2RldmljZS8zcmQtcGFydHkgVmVuZG9yIElEcywgcHJvZHVjdCBuYW1lcyBhbmQgcHJv ZHVjdCB2ZXJzaW9ucyBhcmUgdmVyeSBub24tdW5pZm9ybS4gWW91IGNvdWxkbuKAmXQgd3JpdGUg bXVjaCBnZW5lcmljIFZlcmlmaWVyIGNvZGUgdG8gd29yayB3aXRoIHRoZW0gYXMgdGhleSBhcmUg dG9kYXkuIFRoZSBiZXN0IGF0dGVtcHRzIGF0IG1ha2luZyB0aGVzZSBnZW5lcmljIEkga25vdyBv ZiBzZWVtDQogRUFU4oCZcyBJRUVFLWJhc2VkIE9FTUlELCBhbmQgUFNB4oCZcyBFQU4tMTMgYmFz ZWQgSFcgdmVyc2lvbiwgYnV0IEkgZG9u4oCZdCB0aGluayB0aGVzZSBhcmUgZW5vdWdoLiBNYXli ZSB0aGVyZSBpcyBzb21ldGhpbmcgZWxzZSBvdXQgdGhlcmUuIFNXSUQgb2Ygc29tZSBzb3J0PyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMyRjU1OTciPltndXldIFRDRyBoYXMgYSBkcmFmdCBzcGVjIG91 dCBmb3IgcHVibGljIHJldmlldyBjb3ZlcmluZyBSSU0uJm5ic3A7ICdEUkFGVDogVENHIFJlZmVy ZW5jZSBJbnRlZ3JpdHkgTWFuaWZlc3QgSW5mb3JtYXRpb24gTW9kZWwnPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMyRjU1OTciPiZuYnNwOyZuYnNwOyZuYnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UuY29t L3YzL19faHR0cHM6L3RydXN0ZWRjb21wdXRpbmdncm91cC5vcmcvd3AtY29udGVudC91cGxvYWRz L1RDR19SSU1fTW9kZWxfdjEtcjEzXzJmZWIyMC5wZGZfXzshIU5FdDZ5TWFPLWdrIVNBTFo2VGFT UTc4bU55eThEeUlRb1p3RTVrdUt3ZmJFcHNsU2wzbWdDc3V2UmQyY2pBREdhVzIteFhndTNYUklH UTQkIj48c3BhbiBzdHlsZT0iY29sb3I6IzJGNTU5NyI+aHR0cHM6Ly90cnVzdGVkY29tcHV0aW5n Z3JvdXAub3JnL3dwLWNvbnRlbnQvdXBsb2Fkcy9UQ0dfUklNX01vZGVsX3YxLXIxM18yZmViMjAu cGRmPC9zcGFuPjwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzJGNTU5NyI+VGhlIGRvYyBpcyBj b21wbGV0ZWx5IGJhc2VkIG9uIElTTyBTV0lELCB3aXRoIHRoZSBOSVNUIGd1aWRlbGluZXMuJm5i c3A7IFRoZXJl4oCZcyBhIENCT1IgdmFyaWFudCBjYWxsZWQgQ29TV0lEIGF0IElFVEYgKEkgdGhp bmsgeW91IGNhbiBndWVzcyB3aGljaCBIZW5rLCBvdXQgb2YgdGhlIHVuaXZlcnNlIG9mIGFsbCBI ZW5rcywgeW91IGNvdWxkIGFzayBmb3IgZGV0YWlscyEpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMy RjU1OTciPiZuYnNwOyBJZiB5b3UgaGF2ZSBpbnRlcmVzdCBpbiBjb21tZW50aW5nIG9uIHRoZSBU Q0cgUklNIHNwZWMsIEkga25vdyB0aGUgYXV0aG9ycyB3b3VsZCBiZSBnbGFkIHRvIGhlYXIgZnJv bSB5b3UuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMyRjU1OTciPiZuYnNwOyBCdXQgYWJvdXQgaWRl bnRpdHkgb2YgUklNc+KApjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMkY1NTk3Ij4mbmJzcDsgVGhl IFJJTSBpcyBzaWduZWQsIHNvIG9uY2UgeW914oCZdmUgZG9uZSB0aGUgcG9saWN5IHRhc2sgb2Yg ZGVjaWRpbmcgd2hpY2ggUklNIHN1cHBsaWVyIHlvdSBsaWtlLCB2ZXJpZnlpbmcgaXQgaXMgZWFz eS4mbmJzcDsgSSByZWFsaXplIG9mIGNvdXJzZSB0aGF0IHRoZXJl4oCZcyBsaXR0bGUgY29tbW9u YWxpdHkgb24gaG93IHRvIG5hbWUgYSBwcm9kdWN0IG9yIHZlcnNpb24sDQogYnV0IEnigJltIG5v dCBzdXJlIHRoYXQgbWF0dGVycy4mbmJzcDsgVGhlIFJJTSBjb3JyZXNwb25kcyB0byBhIHZlcnkg c3BlY2lmaWMgcHJvZHVjdCBhbmQgcmVsZWFzZS4gJm5ic3A7VGhlIHZlbmRvciBjYW4gY2FsbCBp dCB3aGF0ZXZlciB0aGV5IHdhbnQsIGFzIGxvbmcgYXMgdGhleSBkb27igJl0IGlzc3VlIHR3byBy ZWxlYXNlIHdpdGggdGhlIHNhbWUgbmFtZS4mbmJzcDsgQWZ0ZXIgdGhhdCwgSSB0aGluayBpdOKA mXMganVzdCBhIHN0cmluZyBjb21wYXJlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMkY1NTk3Ij4m bmJzcDsgSSBzdXBwb3NlIGlmIHRoaXJkLXBhcnR5IFJJTSBzdXBwbGllcnMgZXhpc3QsIHRoZW4g dGhlIFJJTSBoYXMgdG8gZXhwbGljaXRseSBjYWxsIG91dCB0aGUgc29mdHdhcmUgbWFudWZhY3R1 cmVyIGJ5IG5hbWUsIGJ1dCB0aGF04oCZcyBhbHJlYWR5IHBhcnQgb2YgdGhlIFNXSUQgJmFtcDsg UklNIHNwZWNzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMkY1NTk3Ij4mbmJzcDsgQXMgZmFyIGFz IHdlIGNhbiB0ZWxsLCBTV0lEIGVtYm9kaWVzIHN1ZmZpY2llbnQgZmxleGliaWxpdHkgdG8gZGVz Y3JpYmUgYW55IHNvZnR3YXJlIHJlbGVhc2UgdGhhdCBjYW4gYmUgZXhwcmVzc2VkIGFzIGZpbGVz IGFuZCBkaXJlY3Rvcmllcy4mbmJzcDsgSSBoYXZlIGEgc21hbGwgcHJvamVjdCBvbiBteSB0b2Rv IGxpc3QgdG8gcHJvdmUgdGhhdCBmb3IgYSBKdW5pcGVyDQogcmVsZWFzZSwgYnV0IHNvIGZhciwg SSBkb27igJl0IHNlZSBhIHByb2JsZW0uJm5ic3A7IEFnYWluLCBpZiB5b3XigJlyZSBpbnRlcmVz dGVkLCBub3cgaXMgdGhlIHRpbWUgZm9yIHJldmlldyE8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzJG NTU5NyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QWdy ZWVkIHRoYXQgdGhlIGlkZW50aWZpZXIgb2YgdGhlIFJJTSBkb2VzbuKAmXQgaGF2ZSB0byBiZSBz ZWN1cmVkIC8gYXR0ZXN0ZWQsIGp1c3QgbGlrZSBrZXkgSUTigJlzIGRvbuKAmXQgaGF2ZSB0byBi ZS4gSWYgdGhlIFZlcmlmaWVyIGdldHMgdGhlIHdyb25nIG9uZSwgdGhlIHZlcmlmaWNhdGlvbiBq dXN0IGZhaWxzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgaXMgY2Vy dGFpbmx5IG5vdCBhIHNvbHZlZCBwcm9ibGVtIGluIHRoZSBFQVQgc3BhY2UuIE1heWJlIHRoZXJl 4oCZcyBhIHNvbHV0aW9uIGluIGNvbW1vbj8gTXkgZmlyc3QgdGhvdWdoIGlzIHNvbWUgc29ydCBv ZiBVUkksIG1heWJlIHJlbGF0ZWQgdG8gU1dJRCwgdGhhdCBpcyBwYXJ0IG9mIHRoZSBtZWFzdXJl bWVudHMgaW4gdGhlIEV2aWRlbmNlIHNlbnQgdG8gdGhlIFZlcmlmaWVyLiBJdCBkb2VzbuKAmXQg aGF2ZQ0KIHRvIGJlIG1hbmRhdG9yeSBvciB1c2VkIGJ5IGV2ZXJ5b25lLCBidXQgaXQgc2VlbXMg bGlrZWx5IHRvIGJlbmVmaXQgYXQgbGVhc3Qgc29tZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMkY1NTk3Ij5b Z3V5XSBIZW5rIG1pZ2h0IGhhdmUgc3VnZ2VzdGlvbiBmb3IgcG90ZW50aWFsIGNvbW1vbmFsaXR5 IHdpdGggRUFULiZuYnNwOyBBcyBub3RlZCwgU1dJRCBpcyBzdHJvbmdseSBvcmllbnRlZCB0byBz b2Z0d2FyZSByZWxlYXNlcyB3aXRoIHBhY2thZ2VzLCBkaXJlY3RvcmllcyBhbmQgZmlsZXMsIGJ1 dCBtYXliZSB0aGVyZeKAmXMgc29tZXRoaW5nIHVzZWZ1bCB0aGVyZS48L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlRvIGJlIGNsZWFyLCBJ4oCZbSB0aGlua2luZyB0aGF0IHRoZSBF bmRvcnNlbWVudCBvZiB0aGUgVFBNIEF0dGVzdGVyIGlzIHF1aXRlIHNlcGFyYXRlIGZyb20gdGhl IEVuZG9yc2VtZW50IHRoYXQgaXMgdGhlIFJJTS4gVGhleSBjb21lIGZyb20gY29tcGxldGVseSBk aWZmZXJlbnQgdmVuZG9ycy4gVGhlIFRQTSBFbmRvcnNlbWVudCBpcyBvZiBsaXR0bGUgdXNlIHRv IGlkZW50aWZ5IHRoZSBSSU0uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzJGNTU5NyI+W2d1eV0gWWVzLCBpbiBm YWN0IEkgdGhpbmsgdGhlcmUgYXJlIGF0IGxlYXN0IHRocmVlIHN1cHBsaWVycyB0aGF0IGNvdWxk IGJlIHZlcmlmaWVkOyB0aGUgVFBNIHZlbmRvciwgdGhlIGhhcmR3YXJlIHBsYXRmb3JtIE9FTSB3 aG8gbWFkZSB0aGUgQXR0ZXN0ZXIsIGFuZCB0aGUgUklNIHN1cHBsaWVyIHdobyBjZXJ0aWZpZXMg dGhlIHNvZnR3YXJlIGltYWdlLiZuYnNwOyBHaXZlbg0KIHRoZSB3YXkgUklWIGlzIHNjb3BlZCwg SSB0aGluayB2ZXJpZmljYXRpb24gb2YgdGhlIFRQTSBpdHNlbGYgaXMgdXAgdG8gdGhlIE9FTSwg YnV0IHZlcmlmaWNhdGlvbiBvZiB0aGUgT0VN4oCZcyBEZXZJRCBhbmQgSUFLIGlzIG9uZSB0aGlu ZywgYW5kIHZlcmlmaWNhdGlvbiBvZiB0aGUgYXV0aGVudGljaXR5IG9mIHRoZSBSSU0gaXMgYW5v dGhlciBpbmRlcGVuZGVudCBvcGVyYXRpb24sIGJvdGggb2Ygd2hpY2ggJm5ic3A7YmVsb25nIGlu IGEgUkFUUy1jb21wYXRpYmxlDQogVmVyaWZpZXIuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMyRjU1 OTciPiZuYnNwOyBMZXQgbWUga25vdyB3aGF0IHdl4oCZcmUgbWlzc2luZyE8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzJGNTU5NyI+Jm5ic3A7IC9ndXk8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkxMPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEFwciA5LCAy MDIwLCBhdCA3OjMxIEFNLCBHdXkgRmVkb3Jrb3cgJmx0OzxhIGhyZWY9Im1haWx0bzpnZmVkb3Jr b3dAanVuaXBlci5uZXQiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmdmZWRvcmtvd0BqdW5p cGVyLm5ldDwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIExhdXJl bmNlLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7IEkgdW5kZXJzdGFuZCB0aGF0IHRoZSBkaXNjdXNzaW9uIG9u IHRoZSB0b3BpYyBiZWxvdyBtYWlubHkgcGVydGFpbnMgdG8gRUFULCBidXQgSeKAmWQgbGlrZSB0 byBtYWtlIHN1cmUgd2XigJlyZSBub3QgbWlzc2luZyBzb21ldGhpbmcgb24gdGhlIFJJViBzaWRl LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7IEZvciBPUyBzb2Z0d2FyZSBpbWFnZSBpbnRlZ3JpdHkgdXNpbmcg YSBUUE0sIGl0IHNlZW1zIGxpa2UgZmluZGluZyB0aGUgcmlnaHQgbWFuaWZlc3Qgc2hvdWxkbuKA mXQgYmUgdGhhdCBoYXJk4oCmPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgVGhlIEF0dGVzdGVyIG5lZWRzIHRv IGhhdmUgcHJlLXByb3Zpc2lvbmVkIGlkZW50aXR5IGFuZCBhdHRlc3RhdGlvbiBrZXlzIGFzIG91 dGxpbmVkIGluIHRoZSBSSVYgZHJhZnQuJm5ic3A7IFRoYXQgcHJvdmlkZXMgdGhlIFZlcmlmaWVy IHdpdGggdGhlIHZlbmRvciBpZGVudGl0eSBmb3IgdGhlIHJvb3Qgb2YgdHJ1c3QuJm5ic3A7IFRo ZSBtZWFzdXJlbWVudCBsb2dzIGNvbnRhaW4gdGhlIGFsbGVnZWQgcHJvZHVjdCBuYW1lDQogYW5k IHZlcnNpb24gbnVtYmVyIGZvciB0aGUgc29mdHdhcmUgaW5zdGFsbGVkIG9uIHRoZSBib3guJm5i c3A7IFVzZSB0aGUgdmVuZG9yIElEIHRvIG5hcnJvdyB0aGUgc2NvcGUgdG8gc3BlY2lmaWMgdmVu ZG9y4oCZcyBwcm9kdWN0IGFuZCB2ZXJzaW9uIHNwYWNlLCBhbmQgZmluZCB0aGUgUklNIHRoYXQg bWF0Y2hlcy4mbmJzcDsgVGhlbiBjaGVjayBpZiB0aGUgaGFzaGVzIGxpbmUgdXA7IGlmIHNvLCB5 b3XigJlyZSBnb29kLCBpZiBub3QsIGVpdGhlciB0aGUgY2xhaW0NCiBvZiB3aGF0IHNvZnR3YXJl IGlzIHByZXNlbnQgd2FzIGluY29ycmVjdCwgb3Igc29tZXRoaW5nIGdvdCBoYWNrZWQuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDsgU2VlbXMgbGlrZSBhIHZlcmlmaWVyIGNvdWxkIGZvbGxvdyB0aGlzIHNhbWUg bW9kZWwgdGhyb3VnaCB0aGUgZW50aXJlIGNoYWluIG9mIHRydXN0LCBldmVuIHRocm91Z2ggbXVs dGlwbGUgdmVuZG9ycywgYXMgbG9uZyBhcyB0aGVyZSBhcmUgbm8gZ2FwcyBpbiB0aGUgY2hhaW4u PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDsgSSBrbm93IEVBVCBuZWVkcyB0byB3b3JrIGluIGEgbGVzcy1jb25z dHJhaW5lZCBlbnZpcm9ubWVudCwgYnV0IGxldCBtZSBrbm93IGlmIHlvdSB0aGluayB3ZeKAmXJl IG92ZXJzaW1wbGlmeWluZyB0aGlzIG9uIFJJVi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7IFRoYW5rczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+L2d1eTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJ0ZXh0LWFsaWduOmNlbnRl ciI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdCI+SnVuaXBlciBCdXNpbmVzcyBVc2UgT25s eTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPjxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SQVRTICZsdDs8YSBocmVm PSJtYWlsdG86cmF0cy1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5yYXRzLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs8c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24gQmVoYWxmIE9mPHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5MYXVyZW5jZQ0KIEx1bmRi bGFkZTxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj5UdWVzZGF5LCBBcHJpbCA3LCAyMDIwIDM6MTMgUE08YnI+DQo8Yj5Ubzo8 L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlRob21h cyBGb3NzYXRpICZsdDs8YSBocmVmPSJtYWlsdG86VGhvbWFzLkZvc3NhdGlAYXJtLmNvbSI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+VGhvbWFzLkZvc3NhdGlAYXJtLmNvbTwvc3Bhbj48L2E+ Jmd0Ozxicj4NCjxiPkNjOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPnJhdHNAaWV0Zi5vcmc8L3NwYW4+PC9hPjsgTmVkIFNtaXRoICZsdDs8YSBo cmVmPSJtYWlsdG86bmVkLnNtaXRoQGludGVsLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+bmVkLnNtaXRoQGludGVsLmNvbTwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9i PjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW1Jh dHNdIEVuZG9yc2VtZW50IElEIGFuZCB2ZXJpZmljYXRpb24ga2V5ICh3YXMgUHJvY2Vzc2luZyBF bmRvcnNlbWVudHMgYW5kIEV2aWRlbmNlIGludG8gUmVzdWx0cyk8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJsaW5lLWhlaWdodDoxMi4wcHQ7YmFja2dy b3VuZDojRkZFQjlDIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWls eTpMYXRvO2NvbG9yOmJsYWNrIj5bRXh0ZXJuYWwgRW1haWwuIEJlIGNhdXRpb3VzIG9mIGNvbnRl bnRdPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGlzIGlzIGEgcmVwbHkgdG8gYm90aCBUaG9tYXMgYW5kIE5lZOKAmXMgbWVzc2FnZSBvbiBkZWJ1 ZyBpbiB0aGUgcmVsYXRlZCB0aHJlYXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk15IGluY2xpbmF0aW9uIGlzIHRvIGFzc29jaWF0ZSBl bmRvcnNlbWVudHMgd2l0aCB0aW1lLWludmFyaWFudCBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGRl dmljZS4gQXQgdGhlIG1vbWVudCB0aGlzIGRvZXNu4oCZdCBzZWVtIGxpa2UgdGhlIG9ubHkgd2F5 IHRvIGRvIGl0LCBidXQgaXQgc2VlbXMgbGlrZSBhIGdvb2Qgd2F5LiBUaGluZ3MgdGhhdCBhcmUg bm90IHRpbWUgaW52YXJpYW50IGFyZSBwb2xpY3ksIGstZy12DQogb3Igc3VjaC48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHU+RW5k b3JzZW1lbnQ8L3U+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TeXN0ZW0gYXJjaGl0ZWN0dXJlIOKAlCBEb2VzIHRoZSBB dHRlc3RlciB1c2UgYSBURUUgb3IgYSBUUE0gb3IgbWF5YmUgaXQgaXMgc2ltcGxlIHN5c3RlbSB3 aXRoIGp1c3QgYSBzaW1wbGUgQ1BVLCBidXQgaXQgaXMgZW5jYXNlZCBpbiB0aXRhbml1bS4gSXMg ZGVmZW5zZSBhZ2FpbnN0IGNoaXAgaW52YXNpdmUgYXR0YWNrcyBjb25zaWRlcmVkPyBEbyBrZXlz IGJlY29tZSBpbmFjY2Vzc2libGUgd2hlbiBkZWJ1ZyBpcw0KIGVuYWJsZWQuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRldmVsb3BtZW50 IHByb2Nlc3Mg4oCUIElzIHRoZXJlIGEgc3BlY2lhbCBzZWN1cml0eS1vcmllbnRlZCB0ZWFtPyBE b2VzIHRoZSB0ZWFtIGhhdmUgYSBjb2RlIHJldmlldyBwb2xpY3k/IElzIHRoZXJlIGEgYnVnIGJv dW50eT8gQXJlIHRoZSBkZXNrdG9wcyBhbmQgSVQgc3lzdGVtcyB1c2VkIGZvciBIVyBhbmQgU1cg ZGV2ZWxvcG1lbnQgaXNvbGF0ZWQ/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1hbnVmYWN0dXJpbmcg4oCUIEFyZSB0aGUgZmFjdG9yaWVz IHNlY3VyZWQgaW4gYSBzcGVjaWFsIHdheT8gSXMgdGhlIGF0dGVzdGF0aW9uIGtleSBwcm92aXNp b25pbmcgc3lzdGVtIGhhcmRlbmVkIGluIHNvbWUgd2F5IChlLmcuLCB1c2VzIEhTTXMpLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DZXJ0 aWZpY2F0aW9ucyDigJQgVGhlc2UgdGFrZSBhIGxvbmcgdGltZSB0byBhY2hpZXZlIGFuZCB3aWxs IHVzdWFsbHkgcmVxdWlyZSBzb21lIG9mIHRoZSBhYm92ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TXkgdGhp bmtpbmcgZm9yIEVBVCB3YXMgdGhhdCB5b3Ugb25seSBwdXQgYXR0ZXN0YXRpb24ga2V5cyBpbnRv IGRldmljZXMgdGhhdCBtZWV0IHNvbWUgY3JpdGVyaWEgbGlrZSBzb21lIG9mIHRoZSBhYm92ZS4g U2luY2UgdGhlcmUgaXMgb2Z0ZW4gbm8gd2F5IHRvIHJlY292ZXIgZnJvbSBhIGNvbXByb21pc2Vk IGF0dGVzdGF0aW9uIGtleSBiZWNhdXNlIG5vIGtleSBtb3JlIHNlY3VyZSB0aGFuIGl0LCB5b3Ug a2luZA0KIG9mIGhhdmUgdG8gaGF2ZSBhbGwgdGhhdC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2luY2UgdGhlc2UgZG9u4oCZ dCBjaGFuZ2UgbXVjaCBvdmVyIHRpbWUsIHRoZSBlbmRvcnNlbWVudCB3b3VsZG7igJl0IGNoYW5n ZS4gJm5ic3A7VGhleSBjb3VsZCBldmVuIHNwYW4gc2V2ZXJhbCBtb2RlbHMgYW5kIHZhcnlpbmcg SFcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjx1PlBvbGljeSwgSy1HLVYsIG90aGVyPC91PjwvYj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4w cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQi Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U1cgVmVyc2lvbnMg 4oCUIEFzIGxvbmcgYXMgdGhlIFNXIGZvbGxvd3MgYSBkZXZlbG9wbWVudCBwcm9jZXNzIGxpa2Ug dGhhdCBhYm92ZSwgaXQgZG9lc27igJl0IGhhdmUgdG8gYmUgaW5jbHVkZWQgaW4gdGhlIGVuZG9y c2VtZW50LiBPZiBjb3Vyc2UgdGhlIHNtYWxsZXIgdGhlIFNXIGFuZCB0aGUgYmV0dGVyIHRoZSBw cm9jZXNzLCB0aGUgbW9yZSBpdCBpcyB0cnVlIChhbmQgdmljZSB2ZXJzYSkuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJsYWNrbGlzdHMg 4oCUIFRoZXNlIG1pZ2h0IGJlIHNwZWNpZmljIHRvIFVFSURzLCB2ZXJzaW9ucyBvZiBTVywgZGVw bG95bWVudHMgYSBwYXJ0aWN1bGFyIE9FTSBvciBzdWNoPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRlYnVnIHN0YXR1cyDigJQgTW9zdCBv ZiB0aGUgZGVidWcgc3RhdHVzIHZhbHVlcyBjYW4gdmFyeSBvbiBhIGRheS1kYXkgYmFzaXM8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T0VN IG1vZGVsIOKAlCBJZiB0aGUgYXR0ZXN0YXRpb24gaXMgaW1wbGVtZW50ZWQgYnkgYSBjaGlwIHZl bmRvciBhbmQgdGhlIGVuZG9yc2VtZW50IGlzIGZvciB0aGUgY2hpcCwgdGhlbiB0aGUgT0VNIG1v ZGVsIHdpbGwgdmFyeSB3aWRlbHkuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5vbmUgb2YgdGhlc2UgY2FuIGJl IGNyaXRlcmlhIGFzIHRvIHdoZXRoZXIgYW4gYXR0ZXN0YXRpb24ga2V5IGlzIHB1dCBpbnRvIGEg ZGV2aWNlIG9yIG5vdCBhcyB0aGV5IGFyZSBub3Qga25vd24gYXQgbWFudWZhY3R1cmluZyB0aW1l IGFuZC9vciBtdXN0IGJlIGFsbG93ZWQgdG8gdmFyeSB3aWRlbHkgYWZ0ZXIgbWFudWZhY3R1cmlu Zy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5rIHdoYXQgSeKAmXZlIGRl c2NyaWJlZCBhYm92ZSBsaW5lcyB1cCBwcmV0dHkgd2VsbCBmb3IgYSBUUE0uIFRoZSBzeXN0ZW0g YXJjaGl0ZWN0dXJlIGlzIG1vc3RseSBzZXQgYnkgdGhlIFRDRy4gSFcgVFBNcyBhcmUgYWxtb3N0 IGFsd2F5cyBjZXJ0aWZpZWQuIFRoZXkgYXJlIGluZGVwZW5kZW50IG9mIE9FTSBtb2RlbC4gSXQg YWxzbyBsaW5lcyB1cCByZWFzb25hYmx5IHdlbGwgd2l0aCBzZWN1cmUgZWxlbWVudHMNCiBhbmQg Y2FuIGxpbmUgdXAgd2l0aCBURUXigJlzLiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGNydXggb2YgZW5kb3JzZW1lbnQg dG8gbWUgaXMgdGhlIHNlY3VyaXR5IGNoYXJhY3RlcmlzdGljcyBvZiB0aGUgYXR0ZXN0ZXIgdGhh dCBwcm90ZWN0IHRoZSBhdHRlc3RhdGlvbiBrZXkgYmVjYXVzZSB0aGVyZSBpcyBnZW5lcmFsbHkg bm8gcmVjb3ZlcnkgZnJvbSBhIGNvbXByb21pc2VkIGF0dGVzdGF0aW9uIGtleS4gSXQgc2V0cyB0 aGUgYmFzZWxpbmUgcmlzayBvZiB0aGUgSFcgYW5kIFNXIG9mIHRoZQ0KIGRldmljZS48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPk9uIG9uZSBleHRyZW1lIGlzIGEgc2VwYXJhdGUgZW5kb3JzZW1l bnQgZm9yIGV2ZXJ5IGRldmljZSAo4oCcbWljcm8gZW5kb3JzZW1lbnQmcXVvdDs/KSwgd2hpY2gg aXMgd2hhdCBJIHRoaW5rIFRob21hcyBhbmQgQVJNIFBTQSBhcmUgdGVuZGluZyB0b3dhcmRzLiBU aGUgb3RoZXIgZXh0cmVtZSBpcyBvbmUgZW5kb3JzZW1lbnQgZm9yIGEgcHJvZHVjdCBsaW5lJm5i c3A7KOKAnG1hY3JvIGVuZG9yc2VtZW50JnF1b3Q7PyksLCBzYXkgYSBwcm9kdWN0DQogbGluZSBv ZiBUUE1zLiBUaGVuIGl04oCZcyBtb3JlIGxpa2UgdGhlIGRhdGEgc2hlZXQgZm9yIHRoZSBwcm9k dWN0LiZuYnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZW4g dGhlcmXigJlzIGRpZmZlcmVudCB3YXlzIHRvIGZhbiB0aGlzIG91dCB0byB0aGUgZGlmZmVyZW50 IGtleSAvIHNpZ25pbmcgc2NoZW1lcyAocGVyLWRldmljZSBrZXksIGdyb3VwIGtleSwgRUNEQUEs IFguNTA5KS4gRm9yIGV4YW1wbGUgYSBtYWNyby1lbmRvcnNlbWVudCBjb3VsZCBpbmNsdWRlIHRo ZSByb290IG9mIGFuIFguNTA5IGhpZXJhcmNoeSBhbmQgdGhlIGluZGl2aWR1YWwgZGV2aWNlcyAo b3IgZ3JvdXBzDQogb2YgZGV2aWNlcykgd291bGQgaGF2ZSBpbmRpdmlkdWFsIGtleXMgdGhhdCBj aGFpbiB1cC4gV2l0aCBhIG1pY3JvLWVuZG9yc2VtZW50IHRoZSBwZXItZGV2aWNlIHB1YmxpYyBr ZXkgY291bGQgYmUgcGVyIGVuZG9yc2VtZW50LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUg bW9zdCBpbXBvcnRhbnQgdGhpbmcgYWJvdXQgdGhlIGVuZG9yc2VtZW50IHNlZW1zIHRvIG1lIGlz IHRoZSBjaGFyYWN0ZXJpemF0aW9uIG9mIGhvdyB0aGUgYXR0ZXN0YXRpb24ga2V5IGlzIHByb3Rl Y3RlZC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4t Ym90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIEFwciA3LCAyMDIwLCBhdCA3OjM2IEFNLCBUaG9tYXMgRm9zc2F0aSAmbHQ7PGEgaHJlZj0i bWFpbHRvOlRob21hcy5Gb3NzYXRpQGFybS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PlRob21hcy5Gb3NzYXRpQGFybS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5IaSBMYXVyZW5jZSw8YnI+ DQo8YnI+DQpUaGFua3MgZm9yIGJyaW5naW5nIHRoaXMgdXAuICZuYnNwO0EgZmV3IHRob3VnaHRz IGJlbG93Ljxicj4NCjxicj4NCk9uIDAzLzA0LzIwMjAsIDIwOjM3LCAmcXVvdDtSQVRTIG9uIGJl aGFsZiBvZiBMYXVyZW5jZSBMdW5kYmxhZGUmcXVvdDs8YnI+DQombHQ7PC9zcGFuPjxhIGhyZWY9 Im1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOnB1cnBsZSI+cmF0cy1ib3VuY2VzQGlldGYu b3JnPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGlj YSI+b24NCiBiZWhhbGYgb2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOnB1 cnBsZSI+bGdsQGlzbGFuZC1yZXNvcnQuY29tPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+Jmd0OyB3cm90ZTo8L3NwYW4+PG86cD48 L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPlNvIGhvdyBkb2VzIGEg VmVyaWZpZXIgZmluZCB0aGUgYXBwbGljYWJsZSBlbmRvcnNlbWVudCBmb3IgRXZpZGVuY2UgaXQ8 YnI+DQp3aXNoZXMgdG8gdmVyaWZ5IGFuZCBrbm93IHRoYXQgaXMgcmVhbGx5IHRoZSByaWdodCBl bmRvcnNlbWVudD88YnI+DQo8YnI+DQpTZWVtcyBsaWtlIHRoZSBFdmlkZW5jZSBuZWVkcyBzb21l IHNvcnQgb2YgYW4gZW5kb3JzZW1lbnQgbG9jYXRvciBJRC48YnI+DQpUaGlzIGNvdWxkIGJlIGEg VVJMIG9yIGEgR1VJRC4gRUFUIGN1cnJlbnRseSBoYXMgdGhlIG9yaWdpbmF0aW9uIGNsYWltPGJy Pg0KdG8gdHJ5IHRvIHNvbHZlIHRoaXMsIGJ1dCBpdCBpcyBoYWxmLWJha2VkLiBJdCBuZWVkcyB0 byBnZXQgZml4ZWQuIEnigJltPGJyPg0KZmlzaGluZyBmb3IgY29tbWVudHMgaGVyZSBvbiB3aGF0 IGl0IHNob3VsZCBiZSBsaWtlLjxicj4NCjxicj4NClByZXR0eSBzdXJlIHRoZSBFbmRvcnNlbWVu dCBuZWVkcyB0byBpbmNsdWRlIG9yIHJlZmVyZW5jZSB0aGUgcHVibGljPGJyPg0Ka2V5IHRoYXQg aXMgdXNlZCB0byB2ZXJpZnkgdGhlIHNpZ25hdHVyZS4gV2l0aG91dCB0aGF0LCB0aGUgQXR0ZXN0 ZXI8YnI+DQpjb3VsZCBsaWUgYW5kIHBpY2sgYW55IG9sZCBFbmRvcnNlbWVudCB0aGF0IGl0IHdp c2hlcy4gVGhlcmUgbmVlZHMgdG88YnI+DQpiZSBzb21lIGJpbmRpbmcgYmV0d2VlbiBpdGVtcyBp biB0aGUgZW5kb3JzZW1lbnQgKEUwLCBFMSzigKYpIGFuZCB0aGU8YnI+DQp2ZXJpZmljYXRpb24g a2V5LiBUaGF0IGNvdWxkIGJlIGluIHRoZSBmb3JtIG9mIGEgc2lnbmVkIHRva2VuIG9yPGJyPg0K Y2VydGlmaWNhdGUsIGJ1dCBkb2VzbuKAmXQgaGF2ZSB0byBiZS4gUHJldHR5IHN1cmUgdGhpcyBu ZWVkcyB0byBiZTxicj4NCmRpc2N1c3NlZCBpbiB0aGUgYXJjaGl0ZWN0dXJlIGRvYy48YnI+DQo8 YnI+DQpUaGVyZSdzIGEgZmV3IHNjZW5hcmlvczo8YnI+DQotIE9uZSBlbmRvcnNlbWVudCBhcHBs aWVzIHRvIGxvdHMgb2YgZGV2aWNlcyBpbiB0aGUgc2FtZSBjbGFzcywgYnV0PGJyPg0KJm5ic3A7 ZWFjaCBoYXMgdGhlaXIgb3duIGF0dGVzdGF0aW9uIGtleS48YnI+DQotIC0gUHJvYmFibHkgRUNE QUEgZml0cyBpbiBoZXJlPGJyPg0KLSAtIE9uZSBvcHRpb24gaGVyZSBpcyBhbiBYNTA5IGhpZXJh cmNoeTxicj4NCi0gR3JvdXAga2V5cyBhcmUgdXNlZCAoZm9yIHByaXZhY3kgcmVhc29ucyBvciBv dGhlcikgc28gdGhlcmUgaXMgYTxicj4NCiZuYnNwO29uZS1vbmUgY29ycmVsYXRpb24gd2l0aCB0 aGUgRW5kb3JzZW1lbnRzICh0aGUgR0VJRCBkaXNjdXNzaW9uKTxicj4NCi0gR3JvdXAga2V5cyBh cmUgdXNlZCwgYnV0IGFjcm9zcyBkZXZpY2VzIHRoYXQgaGF2ZSBkaWZmZXJlbnQ8YnI+DQombmJz cDtlbmRvcnNlbWVudHMgc28gdGhlcmXigJlzIG5vIG9uZS1vbmUgY29ycmVsYXRpb248YnI+DQo8 YnI+DQpXaGlsZSB0aGUgbGFzdCBvbmUgc2VlbXMgb2RkIGFuZCB1bmxpa2VseSwgSSB0aGluayBp dCBjb3VsZCBvY2N1ciw8YnI+DQpiZWNhdXNlIGZyb20gYSBsb3Qgb2YgcmVhbCBleHBlcmllbmNl IHRoZSBzZXQgdXAgb2YgYXR0ZXN0YXRpb24ga2V5czxicj4NCmlzIHZlcnkgaWRpb3N5bmNyYXRp Yy4gSXQgaXMgd2lsZGx5IGFmZmVjdGVkIGJ5IG1hbnVmYWN0dXJpbmcgY29zdHM8YnI+DQphbmQg aXNzdWVzIG9uIGFzc2VtYmx5IGxpbmVzLCBzdWIgY29udHJhY3RvciBzdHJ1Y3R1cmUsIGxvY2F0 aW9uIG9mPGJyPg0Kc2VjdXJlIGZhY2lsaXRpZXMgYW5kIGFwcHJvYWNoZXMgdG8gbWFraW5nIG1v bmV5IG9uIGl0LiBUaGV5IGFyZSBsaWtlPGJyPg0Kc25vd2ZsYWtlcywgZWFjaCBvbmUgaXMgZGlm ZmVyZW50LiAmbmJzcDtTbyBtYXliZSBlbmRvcnNlbWVudCBsb2NhdG9yIElEPGJyPg0KYW5kIGtl eSBJRCBhcmUgbm90IHRoZSBzYW1lLCBidXQgdGhleSBjYW4gYmUgaW4gc29tZSB1c2UgY2FzZXM/ PGJyPg0KPGJyPg0KSSBhbSBhbHNvIHRlbXB0ZWQgdG8gZW5jb3VyYWdlIHRoZSBwbGFjZW1lbnQg b2YgdGhlIGVuZG9yc2VtZW50PGJyPg0KbG9jYXRvciBJRCBpbiB0aGUgQ09TRSBvciBKT1NFIGhl YWRlciBwYXJhbWV0ZXJzIHNvIHlvdSBkb27igJl0IGhhdmUgdG88YnI+DQpwYXJzZSB0aGUgdW52 ZXJpZmllZCBib2R5IG9mIGNsYWltcyB0byBiZSBhYmxlIHRvIGZpbmQgdGhlIGtleTxicj4NCm1h dGVyaWFsIHRvIHZlcmlmeSBpdC48YnI+DQo8YnI+DQpUaG91Z2h0cz88L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OkhlbHZldGljYSI+PGJyPg0KQSB0d28gbGV2ZWwgbG9va3VwIGtleSwgbW9kZWwmIzQzO2luc3Rh bmNlLCBzZWVtcyB0byBiZSBxdWl0ZSBnZW5lcmFsbHk8YnI+DQphcHBsaWNhYmxlIGFzIGFuIGVu ZG9yc2VtZW50IGxvY2F0b3IuICZuYnNwO1RoZSBtb2RlbCBwYXJ0IHdvdWxkIGdldCB5b3UgdG88 YnI+DQp0aGUgc2hhcmVkIGRhdGEgKGUuZy4sIGNlcnRpZmljYXRpb24sIG1lYXN1cmVkIGJvb3Qg S0dWcywgZXRjLiksIHdoaWxlPGJyPg0KdGhlIGluc3RhbmNlIHBhcnQgY2FuIGJlIHVzZWQgdG8g cmV0cmlldmUgZGV2aWNlLXNwZWNpZmljIHN0YXRlOjxicj4NCnZlcmlmaWNhdGlvbiBrZXkocykg YXMgd2VsbCBhcyBvdGhlciBtZXRhZGF0YSwgZS5nLiwgaWYgc29tZSBnZWFyIGlzPGJyPg0KYmxh Y2tsaXN0ZWQuICZuYnNwO0luIFBTQSB3ZSBoYXZlIHNvbWV0aGluZyBxdWl0ZSAodGhvdWdoIG5v dCBlbnRpcmVseSk8YnI+DQpzaW1pbGFyIHdpdGggaW1wbGVtZW50YXRpb24gYW5kIGluc3RhbmNl IElEcyBbMV0gWzJdLjxicj4NCjxicj4NCihDb250ZXh0LXN3aXRjaGluZyBmb3IgYSBzZWNvbmQg b24gb3VyIHByZXZpb3VzIFVFSUQvR0VJRCBkaXNjdXNzaW9uOiBJPGJyPg0KZ3Vlc3Mgd2UgbWln aHQgbW9kZWwgYW4gaW5zdGFuY2UgYXMgYW4gYW5vbnltaXR5IHNldCwgYW5kIHRoZXJlZm9yZTxi cj4NCnRyZWF0IEVVSURzIGFzIHRoZSBzcGVjaWFsIGNhc2UgR0VJRHMgd2l0aCBjYXJkaW5hbGl0 eSA9PSAxPyk8YnI+DQo8YnI+DQpGb3IgdGhlIHNha2Ugb2YgYnVpbGRpbmcgYSBzaGFyZWQgYW5k IHJldXNhYmxlIHZvY2FidWxhcnksIEknZCBwcmVmZXI8YnI+DQprZWVwaW5nIG1vZGVsIGFuZCBp bnN0YW5jZSBpZGVudGlmaWVycyBhcyBzZXBhcmF0ZSBjbGFpbXMgcmF0aGVyIHRoYW48YnI+DQpo YXZpbmcgYW4gb3BhcXVlIGVuZG9yc2VtZW50IElEIGNsYWltIHRoYXQgY2x1bXBzIHRvZ2V0aGVy IHRob3NlIGFuZDxicj4NCnBvc3NpYmx5IG90aGVyIHN0dWZmIGluIGEgdXNlLWNhc2Ugc3BlY2lm aWMgZmFzaGlvbi4gJm5ic3A7Rm9yIHRoZSBzYW1lPGJyPg0KcmVhc29uIEkgd291bGQgbm90IG92 ZXJyaWRlIGtleSBJRCB3aXRoIGluc3RhbmNlIElEIHNlbWFudGljcy48YnI+DQo8YnI+DQpjaGVl cnMsIHRoYW5rcyE8YnI+DQo8YnI+DQpbMV08c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5jb20v djMvX19odHRwczovd3d3LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWctcmF0cy1wc2EtdG9r ZW4tMDUuaHRtbCpuYW1lLWltcGxlbWVudGF0aW9uLWlkX187SXchIU5FdDZ5TWFPLWdrIVJROGd5 TzNSb3ktZElFZDZTX2thNDVsRkVHbTFHSUgybHRfRDFOYWZtYVFXcGpqc094NjI5emh1LUxtVWkx TU1NV3MkIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGlj YTtjb2xvcjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL2lkL2RyYWZ0LXRzY2hvZmVuaWct cmF0cy1wc2EtdG9rZW4tMDUuaHRtbCNuYW1lLWltcGxlbWVudGF0aW9uLWlkPC9zcGFuPjwvYT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJyPg0K WzJdPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bh bj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L3d3dy5pZXRmLm9y Zy9pZC9kcmFmdC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwqbmFtZS1pbnN0YW5j ZS1pZF9fO0l3ISFORXQ2eU1hTy1nayFSUThneU8zUm95LWRJRWQ2U19rYTQ1bEZFR20xR0lIMmx0 X0QxTmFmbWFRV3BqanNPeDYyOXpodS1MbVVRaFN6ZzRFJCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6cHVycGxlIj5odHRwczovL3d3dy5p ZXRmLm9yZy9pZC9kcmFmdC10c2Nob2ZlbmlnLXJhdHMtcHNhLXRva2VuLTA1Lmh0bWwjbmFtZS1p bnN0YW5jZS1pZDwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTpIZWx2ZXRpY2EiPjxicj4NCjxicj4NCjxicj4NCjxicj4NCklNUE9SVEFOVCBOT1RJQ0U6 IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZp ZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGlu dGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFu ZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBp dCBmb3IgYW55IHB1cnBvc2UsDQogb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4g YW55IG1lZGl1bS4gVGhhbmsgeW91Ljxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fPGJyPg0KUkFUUyBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEg aHJlZj0ibWFpbHRvOlJBVFNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOnB1cnBsZSI+UkFUU0BpZXRmLm9yZzwvc3Bhbj48 L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxi cj4NCjwvc3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3JhdHNfXzshIU5FdDZ5TWFPLWdrIVJROGd5TzNS b3ktZElFZDZTX2thNDVsRkVHbTFHSUgybHRfRDFOYWZtYVFXcGpqc094NjI5emh1LUxtVXpRVFBV QVkkIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtj b2xvcjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0czwv c3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_8B8EFB047C334058BC53E33A86802D6Eintelcom_-- From nobody Mon Apr 13 13:24:01 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41E7A3A1D98 for ; Mon, 13 Apr 2020 13:24:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DdhhtLhp3aop for ; Mon, 13 Apr 2020 13:23:58 -0700 (PDT) Received: from p3plsmtpa11-04.prod.phx3.secureserver.net (p3plsmtpa11-04.prod.phx3.secureserver.net [68.178.252.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98B4A3A1D97 for ; Mon, 13 Apr 2020 13:23:58 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id O5cbjmFhUKG6HO5ccjwz0A; Mon, 13 Apr 2020 13:23:58 -0700 X-CMAE-Analysis: v=2.3 cv=XN1OtjpE c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=0XtbOteLAAAA:20 a=2gBKRKXqXzOLMck0KFsA:9 a=JfzFkA_hRip5A7kW:21 a=SSLyRsy_Ay-wSV1S:21 a=QEXdDO2ut3YA:10 a=biJNw8l7KEDE5ZrsMOcA:9 a=QkC_8dzxIZdnJrwb:21 a=P7MvoAmQDjF40tOb:21 a=M5slkjXU87XoU4Ka:21 a=_W_S_7VecoQA:10 a=WQnItmPV2fbdzLaCP6-h:22 a=pHzHmUro8NiASowvMSCR:22 a=Ew2E2A-JSTLzCXPT_086:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_21EA1A2A-B473-4E73-A018-B1FE8CECCF0F" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: Date: Mon, 13 Apr 2020 13:23:57 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfF3YWunCZ0ex6JKQa+3EgO3zZIjezyGm7bNfMZqGbJbYgBetMtHaFoP2L58nFa+L+DDBI+196SYHcoPj0416RmXCV/I5SUOzY9tnc/zE1ZdrwJYdaQfx xk2dBnF8mQw1rSKixk7ORuR3O26toBB7FbGoPMepxhEAUo2Zp/i/C6cr Archived-At: Subject: [Rats] Claims Characteristics in EAT or in CWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Apr 2020 20:24:00 -0000 --Apple-Mail=_21EA1A2A-B473-4E73-A018-B1FE8CECCF0F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Jim proposed that the EAT-defined claims would be put in their own EAT = sub-area of CWT - They would have a separate IANA registry that could have separate = rules, particularly adding the guidelines from this PR = (which are just = guidelines). - Would occur in CWT=E2=80=99s in a special map defined to hold them. - Separate label space The main advantages of this is that EAT could have separate IANA = registration rules. There=E2=80=99s also a slight size advantage in that = the one-byte labels could be re used. I don=E2=80=99t think this advantage is out weighed by these = disadvantages. Confusion =E2=80=94 Both EAT-oriented use cases and CWT-oriented use = cases would likely use claims from both the CWT and EAT registries. Many = many claims are going to be generically useful. More Confusion =E2=80=94 It is not particularly obvious to distant = implementors and users why these two levels exist and what the rules are = for using them. Confusion Propagates =E2=80=94 Future use cases, say endorsements, will = inherit this split level because they will want to use claims from both = registries. IANA cross checking required =E2=80=94 We would want experts to make = sure that a claim wasn=E2=80=99t defined in both places Replicate for JWT =E2=80=94 We=E2=80=99d have to do the same subsetting = in JWT with a new EAT JWT registry. More registries is not better =E2=80=94 Doesn=E2=80=99t seem = operationally efficient to add two more registries really similar to = ones we already have. Also, it is weird if very similar registries have = significantly different rules. Loophole =E2=80=94 If someone doesn=E2=80=99t like the EAT rules, = they=E2=80=99ll just register a claim under the CWT rules. There=E2=80=99s= no way to prevent that. Decode complexity =E2=80=94 It will make CWT and EAT decoder a little = more complex. It will also make encode more complex, but not of any = significance. The path of least resistance here is to just put the claims = characteristics into the EAT document as a suggestion / recommendation. = There would be no formal imposition of these guidelines. They were never = meant as more than guidelines anyway. Another option is to make EAT an update of CWT so it formally changes = and adjusts CWT. Another option is to publish a separate update of CWT. My plan is to proceed with the path of least resistance, putting them in = EAT as guidelines, unless there is support for more formal work on CWT. LL= --Apple-Mail=_21EA1A2A-B473-4E73-A018-B1FE8CECCF0F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Jim = proposed that the EAT-defined claims would be put in their own EAT = sub-area of CWT
- They would have a separate IANA = registry that could have separate rules, particularly adding the = guidelines from this PR  (which are just = guidelines).
- Would occur in CWT=E2=80=99s in a = special map defined to hold them.
- Separate label = space

The main advantages of this is that EAT could have separate = IANA registration rules. There=E2=80=99s also a slight size advantage in = that the one-byte labels could be re used.

I don=E2=80=99t think this advantage is = out weighed by these disadvantages.

Confusion =E2= =80=94 Both EAT-oriented use cases and CWT-oriented use cases would = likely use claims from both the CWT and EAT registries. Many many claims = are going to be generically useful.

More Confusion =E2=80=94= It is not particularly obvious to distant implementors and users why = these two levels exist and what the rules are for using them.

Confusion = Propagates =E2=80=94 Future use cases, say endorsements, will = inherit this split level because they will want to use claims from both = registries.

IANA cross checking required =E2=80=94 We would want = experts to make sure that a claim wasn=E2=80=99t defined in both = places

Replicate for JWT =E2=80=94 We=E2=80=99d have to do the = same subsetting in JWT with a new EAT JWT registry.

More = registries is not better =E2=80=94 Doesn=E2=80=99t seem = operationally efficient to add two more registries really similar to = ones we already have. Also, it is weird if very similar registries have = significantly different rules.

Loophole =E2=80=94 If someone doesn=E2=80=99t like = the EAT rules, they=E2=80=99ll just register a claim under the CWT = rules. There=E2=80=99s no way to prevent that.

Decode = complexity =E2=80=94 It will make CWT and EAT decoder a little more = complex. It will also make encode more complex, but not of any = significance.


The path of least = resistance here is to just put the claims characteristics into the EAT = document as a suggestion / recommendation. There would be no formal = imposition of these guidelines. They were never meant as more than = guidelines anyway.

Another option is to make EAT an update of CWT so it formally = changes and adjusts CWT.

Another option is to publish a separate update of = CWT.

My plan = is to proceed with the path of least resistance, putting them in EAT as = guidelines, unless there is support for more formal work on = CWT.

LL
= --Apple-Mail=_21EA1A2A-B473-4E73-A018-B1FE8CECCF0F-- From nobody Mon Apr 13 15:16:57 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E88DD3A1F4C for ; Mon, 13 Apr 2020 15:16:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UadPgkUxhOYZ for ; Mon, 13 Apr 2020 15:16:53 -0700 (PDT) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C125E3A1F4A for ; Mon, 13 Apr 2020 15:16:53 -0700 (PDT) IronPort-SDR: n66jQKIpoUMotkJYzu5Ur6g0ubdNyOCxtGac4FgWNhTuMYqEfEvqkSFqGkI/DD84GxHmaWKAma novlpxeXdZ+w== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Apr 2020 15:16:53 -0700 IronPort-SDR: r8bYCznwqhpnDs8Z3Hsdviim3yTAp83AKjAMr8VutCCvBRwjn4Dzs5IiCn5x29dR+XO1KjJkze mj8LbN43FdaQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,380,1580803200"; d="scan'208,217";a="243652477" Received: from orsmsx107.amr.corp.intel.com ([10.22.240.5]) by fmsmga007.fm.intel.com with ESMTP; 13 Apr 2020 15:16:52 -0700 Received: from orsmsx108.amr.corp.intel.com ([169.254.2.172]) by ORSMSX107.amr.corp.intel.com ([169.254.1.18]) with mapi id 14.03.0439.000; Mon, 13 Apr 2020 15:16:52 -0700 From: "Smith, Ned" To: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Claims Characteristics in EAT or in CWT Thread-Index: AQHWEdGN8pKfh5FXxEa00YzhheIPxKh3nsuA Date: Mon, 13 Apr 2020 22:16:52 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.35.20030802 x-originating-ip: [10.254.69.132] Content-Type: multipart/alternative; boundary="_000_D9ADEAB360E24451A23AAF346B82BD51intelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Claims Characteristics in EAT or in CWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Apr 2020 22:16:56 -0000 --_000_D9ADEAB360E24451A23AAF346B82BD51intelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCkZyb206IFJBVFMgPHJhdHMtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIExhdXJl bmNlIEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPg0KRGF0ZTogTW9uZGF5LCBBcHJp bCAxMywgMjAyMCBhdCAxOjI0IFBNDQpUbzogInJhdHNAaWV0Zi5vcmciIDxyYXRzQGlldGYub3Jn Pg0KU3ViamVjdDogW1JhdHNdIENsYWltcyBDaGFyYWN0ZXJpc3RpY3MgaW4gRUFUIG9yIGluIENX VA0KDQpKaW0gcHJvcG9zZWQgdGhhdCB0aGUgRUFULWRlZmluZWQgY2xhaW1zIHdvdWxkIGJlIHB1 dCBpbiB0aGVpciBvd24gRUFUIHN1Yi1hcmVhIG9mIENXVA0KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgXl5eXl5eXg0KTm1zPiBEb2VzbuKAmXQgc3ViLWFy ZWEgbWVhbiB0aGUgZXhpc3RpbmcgYXNzaWduZWQgdG9rZW5zIGFyZSBzdGlsbCBhY2Nlc3NpYmxl IGJ5IEVBVD8gSWYgRUFUIHdhbnRlZCB0byBhc3NpZ24gdGhlaXIgb3duLCB0aGV5IHdvdWxkIGhh dmUgYSBzZXBhcmF0ZSBuYW1lc3BhY2UgdG8gYWxsb2NhdGUgZnJvbS4gT3IgYW0gSSBub3QgdW5k ZXJzdGFuZGluZyB3aGF0IHN1Yi1hcmVhIG1lYW5zPw0KDQotIFRoZXkgd291bGQgaGF2ZSBhIHNl cGFyYXRlIElBTkEgcmVnaXN0cnkgdGhhdCBjb3VsZCBoYXZlIHNlcGFyYXRlIHJ1bGVzLCBwYXJ0 aWN1bGFybHkgYWRkaW5nIHRoZSBndWlkZWxpbmVzIGZyb20gdGhpcyBQUjxodHRwczovL2dpdGh1 Yi5jb20vaWV0Zi1yYXRzLXdnL2VhdC9wdWxsLzc+ICAod2hpY2ggYXJlIGp1c3QgZ3VpZGVsaW5l cykuDQotIFdvdWxkIG9jY3VyIGluIENXVOKAmXMgaW4gYSBzcGVjaWFsIG1hcCBkZWZpbmVkIHRv IGhvbGQgdGhlbS4NCi0gU2VwYXJhdGUgbGFiZWwgc3BhY2UNCg0KVGhlIG1haW4gYWR2YW50YWdl cyBvZiB0aGlzIGlzIHRoYXQgRUFUIGNvdWxkIGhhdmUgc2VwYXJhdGUgSUFOQSByZWdpc3RyYXRp b24gcnVsZXMuIFRoZXJl4oCZcyBhbHNvIGEgc2xpZ2h0IHNpemUgYWR2YW50YWdlIGluIHRoYXQg dGhlIG9uZS1ieXRlIGxhYmVscyBjb3VsZCBiZSByZSB1c2VkLg0KDQpJIGRvbuKAmXQgdGhpbmsg dGhpcyBhZHZhbnRhZ2UgaXMgb3V0IHdlaWdoZWQgYnkgdGhlc2UgZGlzYWR2YW50YWdlcy4NCg0K Q29uZnVzaW9uIOKAlCBCb3RoIEVBVC1vcmllbnRlZCB1c2UgY2FzZXMgYW5kIENXVC1vcmllbnRl ZCB1c2UgY2FzZXMgd291bGQgbGlrZWx5IHVzZSBjbGFpbXMgZnJvbSBib3RoIHRoZSBDV1QgYW5k IEVBVCByZWdpc3RyaWVzLiBNYW55IG1hbnkgY2xhaW1zIGFyZSBnb2luZyB0byBiZSBnZW5lcmlj YWxseSB1c2VmdWwuDQoNCk1vcmUgQ29uZnVzaW9uIOKAlCBJdCBpcyBub3QgcGFydGljdWxhcmx5 IG9idmlvdXMgdG8gZGlzdGFudCBpbXBsZW1lbnRvcnMgYW5kIHVzZXJzIHdoeSB0aGVzZSB0d28g bGV2ZWxzIGV4aXN0IGFuZCB3aGF0IHRoZSBydWxlcyBhcmUgZm9yIHVzaW5nIHRoZW0uDQoNCkNv bmZ1c2lvbiBQcm9wYWdhdGVzIOKAlCBGdXR1cmUgdXNlIGNhc2VzLCBzYXkgZW5kb3JzZW1lbnRz LCB3aWxsIGluaGVyaXQgdGhpcyBzcGxpdCBsZXZlbCBiZWNhdXNlIHRoZXkgd2lsbCB3YW50IHRv IHVzZSBjbGFpbXMgZnJvbSBib3RoIHJlZ2lzdHJpZXMuDQoNCklBTkEgY3Jvc3MgY2hlY2tpbmcg cmVxdWlyZWQg4oCUIFdlIHdvdWxkIHdhbnQgZXhwZXJ0cyB0byBtYWtlIHN1cmUgdGhhdCBhIGNs YWltIHdhc27igJl0IGRlZmluZWQgaW4gYm90aCBwbGFjZXMNCg0KUmVwbGljYXRlIGZvciBKV1Qg 4oCUIFdl4oCZZCBoYXZlIHRvIGRvIHRoZSBzYW1lIHN1YnNldHRpbmcgaW4gSldUIHdpdGggYSBu ZXcgRUFUIEpXVCByZWdpc3RyeS4NCg0KTW9yZSByZWdpc3RyaWVzIGlzIG5vdCBiZXR0ZXIg4oCU IERvZXNu4oCZdCBzZWVtIG9wZXJhdGlvbmFsbHkgZWZmaWNpZW50IHRvIGFkZCB0d28gbW9yZSBy ZWdpc3RyaWVzIHJlYWxseSBzaW1pbGFyIHRvIG9uZXMgd2UgYWxyZWFkeSBoYXZlLiBBbHNvLCBp dCBpcyB3ZWlyZCBpZiB2ZXJ5IHNpbWlsYXIgcmVnaXN0cmllcyBoYXZlIHNpZ25pZmljYW50bHkg ZGlmZmVyZW50IHJ1bGVzLg0KDQpMb29waG9sZSDigJQgSWYgc29tZW9uZSBkb2VzbuKAmXQgbGlr ZSB0aGUgRUFUIHJ1bGVzLCB0aGV54oCZbGwganVzdCByZWdpc3RlciBhIGNsYWltIHVuZGVyIHRo ZSBDV1QgcnVsZXMuIFRoZXJl4oCZcyBubyB3YXkgdG8gcHJldmVudCB0aGF0Lg0KDQpEZWNvZGUg Y29tcGxleGl0eSDigJQgSXQgd2lsbCBtYWtlIENXVCBhbmQgRUFUIGRlY29kZXIgYSBsaXR0bGUg bW9yZSBjb21wbGV4LiBJdCB3aWxsIGFsc28gbWFrZSBlbmNvZGUgbW9yZSBjb21wbGV4LCBidXQg bm90IG9mIGFueSBzaWduaWZpY2FuY2UuDQoNCg0KVGhlIHBhdGggb2YgbGVhc3QgcmVzaXN0YW5j ZSBoZXJlIGlzIHRvIGp1c3QgcHV0IHRoZSBjbGFpbXMgY2hhcmFjdGVyaXN0aWNzIGludG8gdGhl IEVBVCBkb2N1bWVudCBhcyBhIHN1Z2dlc3Rpb24gLyByZWNvbW1lbmRhdGlvbi4gVGhlcmUgd291 bGQgYmUgbm8gZm9ybWFsIGltcG9zaXRpb24gb2YgdGhlc2UgZ3VpZGVsaW5lcy4gVGhleSB3ZXJl IG5ldmVyIG1lYW50IGFzIG1vcmUgdGhhbiBndWlkZWxpbmVzIGFueXdheS4NCg0KQW5vdGhlciBv cHRpb24gaXMgdG8gbWFrZSBFQVQgYW4gdXBkYXRlIG9mIENXVCBzbyBpdCBmb3JtYWxseSBjaGFu Z2VzIGFuZCBhZGp1c3RzIENXVC4NCg0KQW5vdGhlciBvcHRpb24gaXMgdG8gcHVibGlzaCBhIHNl cGFyYXRlIHVwZGF0ZSBvZiBDV1QuDQoNCk15IHBsYW4gaXMgdG8gcHJvY2VlZCB3aXRoIHRoZSBw YXRoIG9mIGxlYXN0IHJlc2lzdGFuY2UsIHB1dHRpbmcgdGhlbSBpbiBFQVQgYXMgZ3VpZGVsaW5l cywgdW5sZXNzIHRoZXJlIGlzIHN1cHBvcnQgZm9yIG1vcmUgZm9ybWFsIHdvcmsgb24gQ1dULg0K DQpMTA0K --_000_D9ADEAB360E24451A23AAF346B82BD51intelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <3DBD96579274FB4A9EC45A7E5C3EEC39@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7 DQoJY29sb3I6d2luZG93dGV4dDsNCglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpu b3JtYWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9uZTt9DQouTXNvQ2hwRGVmYXVsdA0KCXtt c28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdv cmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4w aW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48 L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJw dXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0 REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9z cGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+UkFUUyAm bHQ7cmF0cy1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBiZWhhbGYgb2YgTGF1cmVuY2UgTHVuZGJs YWRlICZsdDtsZ2xAaXNsYW5kLXJlc29ydC5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPk1vbmRh eSwgQXByaWwgMTMsIDIwMjAgYXQgMToyNCBQTTxicj4NCjxiPlRvOiA8L2I+JnF1b3Q7cmF0c0Bp ZXRmLm9yZyZxdW90OyAmbHQ7cmF0c0BpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+ W1JhdHNdIENsYWltcyBDaGFyYWN0ZXJpc3RpY3MgaW4gRUFUIG9yIGluIENXVDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SmltIHBy b3Bvc2VkIHRoYXQgdGhlIEVBVC1kZWZpbmVkIGNsYWltcyB3b3VsZCBiZSBwdXQgaW4gdGhlaXIg b3duIEVBVCBzdWItYXJlYSBvZiBDV1Q8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF5eXl5e Xl48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPk5tcyZndDsgRG9lc27igJl0 IHN1Yi1hcmVhIG1lYW4gdGhlIGV4aXN0aW5nIGFzc2lnbmVkIHRva2VucyBhcmUgc3RpbGwgYWNj ZXNzaWJsZSBieSBFQVQ/IElmIEVBVCB3YW50ZWQgdG8gYXNzaWduIHRoZWlyIG93biwgdGhleSB3 b3VsZCBoYXZlIGEgc2VwYXJhdGUgbmFtZXNwYWNlIHRvIGFsbG9jYXRlIGZyb20uIE9yIGFtIEkg bm90IHVuZGVyc3RhbmRpbmcNCiB3aGF0IHN1Yi1hcmVhIG1lYW5zPzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LSBUaGV5IHdvdWxkIGhhdmUgYSBzZXBhcmF0 ZSBJQU5BIHJlZ2lzdHJ5IHRoYXQgY291bGQgaGF2ZSBzZXBhcmF0ZSBydWxlcywgcGFydGljdWxh cmx5IGFkZGluZyZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9pZXRmLXJhdHMtd2cv ZWF0L3B1bGwvNyI+dGhlIGd1aWRlbGluZXMgZnJvbSB0aGlzIFBSPC9hPiZuYnNwOyZuYnNwOyh3 aGljaCBhcmUganVzdCBndWlkZWxpbmVzKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0gV291bGQgb2NjdXIgaW4gQ1dU4oCZcyBpbiBhIHNwZWNp YWwgbWFwIGRlZmluZWQgdG8gaG9sZCB0aGVtLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LSBTZXBhcmF0ZSBsYWJlbCBzcGFjZTxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIG1h aW4gYWR2YW50YWdlcyBvZiB0aGlzIGlzIHRoYXQgRUFUIGNvdWxkIGhhdmUgc2VwYXJhdGUgSUFO QSByZWdpc3RyYXRpb24gcnVsZXMuIFRoZXJl4oCZcyBhbHNvIGEgc2xpZ2h0IHNpemUgYWR2YW50 YWdlIGluIHRoYXQgdGhlIG9uZS1ieXRlIGxhYmVscyBjb3VsZCBiZSByZSB1c2VkLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkg ZG9u4oCZdCB0aGluayB0aGlzIGFkdmFudGFnZSBpcyBvdXQgd2VpZ2hlZCBieSB0aGVzZSBkaXNh ZHZhbnRhZ2VzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+Q29uZnVzaW9uJm5ic3A74oCUIDwvYj5Cb3RoIEVBVC1vcmllbnRlZCB1c2Ug Y2FzZXMgYW5kIENXVC1vcmllbnRlZCB1c2UgY2FzZXMgd291bGQgbGlrZWx5IHVzZSBjbGFpbXMg ZnJvbSBib3RoIHRoZSBDV1QgYW5kIEVBVCByZWdpc3RyaWVzLiBNYW55IG1hbnkgY2xhaW1zIGFy ZSBnb2luZyB0byBiZSBnZW5lcmljYWxseSB1c2VmdWwuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPk1vcmUgQ29uZnVzaW9uPC9iPiDigJQg SXQgaXMgbm90IHBhcnRpY3VsYXJseSBvYnZpb3VzIHRvIGRpc3RhbnQgaW1wbGVtZW50b3JzIGFu ZCB1c2VycyB3aHkgdGhlc2UgdHdvIGxldmVscyBleGlzdCBhbmQgd2hhdCB0aGUgcnVsZXMgYXJl IGZvciB1c2luZyB0aGVtLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48Yj5Db25mdXNpb24gUHJvcGFnYXRlczwvYj4g4oCUIEZ1dHVyZSB1c2Ug Y2FzZXMsIHNheSBlbmRvcnNlbWVudHMsIHdpbGwgaW5oZXJpdCB0aGlzIHNwbGl0IGxldmVsIGJl Y2F1c2UgdGhleSB3aWxsIHdhbnQgdG8gdXNlIGNsYWltcyBmcm9tIGJvdGggcmVnaXN0cmllcy48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ SUFOQSBjcm9zcyBjaGVja2luZyByZXF1aXJlZDwvYj4g4oCUIFdlIHdvdWxkIHdhbnQgZXhwZXJ0 cyB0byBtYWtlIHN1cmUgdGhhdCBhIGNsYWltIHdhc27igJl0IGRlZmluZWQgaW4gYm90aCBwbGFj ZXM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+UmVwbGljYXRlIGZvciBKV1Q8L2I+IOKAlCBXZeKAmWQgaGF2ZSB0byBkbyB0aGUgc2FtZSBz dWJzZXR0aW5nIGluIEpXVCB3aXRoIGEgbmV3IEVBVCBKV1QgcmVnaXN0cnkuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPk1vcmUgcmVnaXN0 cmllcyBpcyBub3QgYmV0dGVyPC9iPiDigJQgRG9lc27igJl0IHNlZW0gb3BlcmF0aW9uYWxseSBl ZmZpY2llbnQgdG8gYWRkIHR3byBtb3JlIHJlZ2lzdHJpZXMgcmVhbGx5IHNpbWlsYXIgdG8gb25l cyB3ZSBhbHJlYWR5IGhhdmUuIEFsc28sIGl0IGlzIHdlaXJkIGlmIHZlcnkgc2ltaWxhciByZWdp c3RyaWVzIGhhdmUgc2lnbmlmaWNhbnRseSBkaWZmZXJlbnQgcnVsZXMuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Mb29waG9s ZSZuYnNwOzwvYj7igJQgSWYgc29tZW9uZSBkb2VzbuKAmXQgbGlrZSB0aGUgRUFUIHJ1bGVzLCB0 aGV54oCZbGwganVzdCByZWdpc3RlciBhIGNsYWltIHVuZGVyIHRoZSBDV1QgcnVsZXMuIFRoZXJl 4oCZcyBubyB3YXkgdG8gcHJldmVudCB0aGF0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkRlY29kZSBjb21wbGV4aXR5PC9i PiDigJQgSXQgd2lsbCBtYWtlIENXVCBhbmQgRUFUIGRlY29kZXIgYSBsaXR0bGUgbW9yZSBjb21w bGV4LiBJdCB3aWxsIGFsc28gbWFrZSBlbmNvZGUgbW9yZSBjb21wbGV4LCBidXQgbm90IG9mIGFu eSBzaWduaWZpY2FuY2UuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIHBhdGggb2YgbGVhc3QgcmVzaXN0YW5j ZSBoZXJlIGlzIHRvIGp1c3QgcHV0IHRoZSBjbGFpbXMgY2hhcmFjdGVyaXN0aWNzIGludG8gdGhl IEVBVCBkb2N1bWVudCBhcyBhIHN1Z2dlc3Rpb24gLyByZWNvbW1lbmRhdGlvbi4gVGhlcmUgd291 bGQgYmUgbm8gZm9ybWFsIGltcG9zaXRpb24gb2YgdGhlc2UgZ3VpZGVsaW5lcy4gVGhleSB3ZXJl IG5ldmVyIG1lYW50IGFzIG1vcmUgdGhhbiBndWlkZWxpbmVzIGFueXdheS48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW5vdGhlciBvcHRpb24g aXMgdG8gbWFrZSBFQVQgYW4gdXBkYXRlIG9mIENXVCBzbyBpdCBmb3JtYWxseSBjaGFuZ2VzIGFu ZCBhZGp1c3RzIENXVC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+QW5vdGhlciBvcHRpb24gaXMgdG8gcHVibGlzaCBhIHNlcGFyYXRlIHVwZGF0 ZSBvZiBDV1QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk15IHBsYW4gaXMgdG8gcHJvY2VlZCB3aXRoIHRoZSBwYXRoIG9mIGxlYXN0IHJlc2lz dGFuY2UsIHB1dHRpbmcgdGhlbSBpbiBFQVQgYXMgZ3VpZGVsaW5lcywgdW5sZXNzIHRoZXJlIGlz IHN1cHBvcnQgZm9yIG1vcmUgZm9ybWFsIHdvcmsgb24gQ1dULjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MTDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_D9ADEAB360E24451A23AAF346B82BD51intelcom_-- From nobody Mon Apr 13 15:20:23 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 733423A1F5D for ; Mon, 13 Apr 2020 15:20:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.268 X-Spam-Level: X-Spam-Status: No, score=-2.268 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AoKUSHea9QAf for ; Mon, 13 Apr 2020 15:20:20 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-eopbgr770132.outbound.protection.outlook.com [40.107.77.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB0183A1F5B for ; Mon, 13 Apr 2020 15:20:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jKHQ3nOdKtgqysJKEfVGUvf6TfQ6zFHB63st8Cl6eMxL50q4/koPX7YL9pQzA+KZkydW/ECKo1eiAvg2uMxqyknEqptHn0yVVYVlrRv3ZChgJdoxipZx+79XauYQqHhxXgX9Nf5//pRXM5PkZ6crAU0bi5UBAAt3O8A6/+8RgZkUcfwVu0a/9Lqgq3cmAhbR1C+B3FIwgfh8GVPAyCy/sIqY+AdT2XOcL8T31gkDwc0aWWqFipY0nvJmFdLZ2lxK/B9YfpVE5b8RxB76vOgE8ym7VJtmWPyPMJnU0vBbJYzELGa/0U8aE/+XYZ/3B5G29Z3BBOefm+2Ugk9bSwhgbw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hFrBYO5vR4W1gyjBvKFc/Y0pkepfQV9kJKpozofWads=; b=l2uuZiaNLfmFrL2u+IzOaSXIik7LuTeJNFop+noGCA0vCMBSnrBAjw+3PvaidfyrjchodrXHs7dZ3VJlRwgZTAw2uTU2u31Z/yKeF3B0jEBlDUah33IRA8krxOR06foCh8TrjSMCDFpYvdS6Vj9LbU1nnDElDds82jP0oDYdWuVFicx/Zp5n4MUQRExjd0RUdww8nEF7x5Be9qxRHv+q8OtfY8Bc5+PW5lOcJxL7ZbISJmZVqWnW5Aqw80eR4dSXFtRty4sYDsicFZBYtQiSQktTBs1wr/4MvIagVErpDUEhRC73+a2Pacs+0m2AZWUDFEtAiojO1z5K/3EERVMbPg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hFrBYO5vR4W1gyjBvKFc/Y0pkepfQV9kJKpozofWads=; b=V6asGXOO2+nlt0Z9g0RuqoygdXzc63u6tQt6SsJI9QSQnnKPJm9e0nIw+lqxEUVdgWtvJhiP1lQ94yIDPwTirZ+YWvotwtzSUaC0wx2y5/mL2sMQv0zbAJ829Rum1d+zTHtwrX2+kIY8nwISk+//Mwiuy6sNbF9+LLkik9tQ3G4= Received: from BL0PR2101MB1027.namprd21.prod.outlook.com (2603:10b6:207:30::33) by BL0PR2101MB1012.namprd21.prod.outlook.com (2603:10b6:207:37::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2921.9; Mon, 13 Apr 2020 22:20:18 +0000 Received: from BL0PR2101MB1027.namprd21.prod.outlook.com ([fe80::50fa:9656:cec9:3a2d]) by BL0PR2101MB1027.namprd21.prod.outlook.com ([fe80::50fa:9656:cec9:3a2d%7]) with mapi id 15.20.2937.000; Mon, 13 Apr 2020 22:20:18 +0000 From: Dave Thaler To: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Claims Characteristics in EAT or in CWT Thread-Index: AQHWEdF7GTUjr9fNQ0+aGfQ2DRAbn6h3nzpA Date: Mon, 13 Apr 2020 22:20:18 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-originating-ip: [2601:600:9780:16f0:80fe:53ba:c958:67a9] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 6bb94ad8-c0b0-4a7a-c39b-08d7dff8d907 x-ms-traffictypediagnostic: BL0PR2101MB1012: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 037291602B x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR2101MB1027.namprd21.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(4636009)(366004)(39860400002)(376002)(346002)(136003)(396003)(86362001)(7696005)(10290500003)(2906002)(33656002)(53546011)(81156014)(66476007)(64756008)(6506007)(52536014)(478600001)(66446008)(8936002)(66946007)(66556008)(5660300002)(55016002)(316002)(76116006)(82950400001)(110136005)(82960400001)(8990500004)(186003)(71200400001)(9686003)(8676002); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: xGumr7x//IEgcaXW6VENgcCtvC4w2JmOqP4ej4joDnL37Gb58LSqHU2IMNDQ9q0VUESmJ/meDd5cBOF6w77dRr3bQNi21PCFbdMXW/cpIfel01luDBNs3db5ZTVs4VTI2k0J8k+Z0v4MrxsfUFNuPpH2KS/TmMz2s1J1qdWH+u6Tu1tAEGwwJvjImXfl3dnT/ZIKMH6d/HOp0auDcSF8Aa5nt8TJtDjXIs/CjBEJ/E0Y/l053aSnQnaYq1kvdeyVMsQ8JoDtyK8OI5+/KA5xokE0CJ5la6SVckFBh2T5s0E2IUlKCOzUK/7/gnLuzCiIqXpzFBTtc8iB/sbyRi54cKDjSvLnLAk0IDOSRkLaLIDKgsXySbu/X106aSSciCowjDcVIC+kG8gqITygGjokusZbQ+0lxGXqoU4wmdUw5DqR/Gzq5J15U62kIw0l+tF5JhhVRowozuOgAulm8xwHXJRs16Ce0JB5ANzjQnaCNrKaOAHpof3JWQFkLbPFP4tB+B9KE7NlR2+Kxr6YNZSSvA== x-ms-exchange-antispam-messagedata: txRpO36onHerhAWO9B9XaVrFw7ZKyVCgSJKTfsSPhiYRQ6lb/vMN0p0h+oTb8DCdsmN7ta0bl7GwKJV5rN3cTh4rMoTbGvIo+lVDwiyY+DUNq3sbVBrm4qxiv2+R/Zl42/I6Qfz29e08xM0dZ6+hgXEbpUJlfEHuyswJnVRi3Rl5cT5CBof1OfZKJz/DBVat9+r/RoxULJI3dSYW8QWDfw== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BL0PR2101MB10272B390422ECE0D7FDDDC8A3DD0BL0PR2101MB1027_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6bb94ad8-c0b0-4a7a-c39b-08d7dff8d907 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Apr 2020 22:20:18.2022 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 2NFB35CdYdY5ctDf/nNlNYzMz1JYMAwL/WLZWFsA7vPg/YHzvL0fj7QNNKp7inGligW8VkbbTb/2ZHagGxrzGSwaBo4N0Vue/zXigKT7mXE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR2101MB1012 Archived-At: Subject: Re: [Rats] Claims Characteristics in EAT or in CWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Apr 2020 22:20:22 -0000 --_000_BL0PR2101MB10272B390422ECE0D7FDDDC8A3DD0BL0PR2101MB1027_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T25lIG1vcmUgcG9pbnQgaXMgdGhhdCBpZiBzb21lb25lIGFkZHMgYW4gRUFUIGNsYWltIG5vdywg YW5kIGxhdGVyIGl04oCZcyBmb3VuZCB0byBuZWVkIHRoZSBzYW1lIHRoaW5nIGZvciBhIG5vbi1h dHRlc3RhdGlvbiB1c2UgY2FzZSwNCnRoZW4geW914oCZZCBlbmQgdXAgd2l0aCBhbiBlbnRyeSBp biBib3RoIHJlZ2lzdHJpZXMsIG9yIGVsc2UgbWlzdXNpbmcgYSB2YWx1ZSBvdXQgb2YgYW4gRUFU IHJlZ2lzdHJ5IGZvciBhIG5vbi1FQVQgdXNlIGNhc2UuDQoNCkZyb206IFJBVFMgPHJhdHMtYm91 bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIExhdXJlbmNlIEx1bmRibGFkZQ0KU2VudDogTW9u ZGF5LCBBcHJpbCAxMywgMjAyMCAxOjI0IFBNDQpUbzogcmF0c0BpZXRmLm9yZw0KU3ViamVjdDog W1JhdHNdIENsYWltcyBDaGFyYWN0ZXJpc3RpY3MgaW4gRUFUIG9yIGluIENXVA0KDQpKaW0gcHJv cG9zZWQgdGhhdCB0aGUgRUFULWRlZmluZWQgY2xhaW1zIHdvdWxkIGJlIHB1dCBpbiB0aGVpciBv d24gRUFUIHN1Yi1hcmVhIG9mIENXVA0KLSBUaGV5IHdvdWxkIGhhdmUgYSBzZXBhcmF0ZSBJQU5B IHJlZ2lzdHJ5IHRoYXQgY291bGQgaGF2ZSBzZXBhcmF0ZSBydWxlcywgcGFydGljdWxhcmx5IGFk ZGluZyB0aGUgZ3VpZGVsaW5lcyBmcm9tIHRoaXMgUFI8aHR0cHM6Ly9uYW0wNi5zYWZlbGlua3Mu cHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmll dGYtcmF0cy13ZyUyRmVhdCUyRnB1bGwlMkY3JmRhdGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNy b3NvZnQuY29tJTdDMjI2ZWNlYjgyZDRhNDY3MGY2OTIwOGQ3ZGZlODljMmMlN0M3MmY5ODhiZjg2 ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MjI0MDYyNDU1MzE5ODA2JnNkYXRh PUZiazViTnhUZ0UwM0xxV0o5S3dJOXc4MjhVZkxWaHBPNWpPUllBTjdTd2slM0QmcmVzZXJ2ZWQ9 MD4gICh3aGljaCBhcmUganVzdCBndWlkZWxpbmVzKS4NCi0gV291bGQgb2NjdXIgaW4gQ1dU4oCZ cyBpbiBhIHNwZWNpYWwgbWFwIGRlZmluZWQgdG8gaG9sZCB0aGVtLg0KLSBTZXBhcmF0ZSBsYWJl bCBzcGFjZQ0KDQpUaGUgbWFpbiBhZHZhbnRhZ2VzIG9mIHRoaXMgaXMgdGhhdCBFQVQgY291bGQg aGF2ZSBzZXBhcmF0ZSBJQU5BIHJlZ2lzdHJhdGlvbiBydWxlcy4gVGhlcmXigJlzIGFsc28gYSBz bGlnaHQgc2l6ZSBhZHZhbnRhZ2UgaW4gdGhhdCB0aGUgb25lLWJ5dGUgbGFiZWxzIGNvdWxkIGJl IHJlIHVzZWQuDQoNCkkgZG9u4oCZdCB0aGluayB0aGlzIGFkdmFudGFnZSBpcyBvdXQgd2VpZ2hl ZCBieSB0aGVzZSBkaXNhZHZhbnRhZ2VzLg0KDQpDb25mdXNpb24g4oCUIEJvdGggRUFULW9yaWVu dGVkIHVzZSBjYXNlcyBhbmQgQ1dULW9yaWVudGVkIHVzZSBjYXNlcyB3b3VsZCBsaWtlbHkgdXNl IGNsYWltcyBmcm9tIGJvdGggdGhlIENXVCBhbmQgRUFUIHJlZ2lzdHJpZXMuIE1hbnkgbWFueSBj bGFpbXMgYXJlIGdvaW5nIHRvIGJlIGdlbmVyaWNhbGx5IHVzZWZ1bC4NCg0KTW9yZSBDb25mdXNp b24g4oCUIEl0IGlzIG5vdCBwYXJ0aWN1bGFybHkgb2J2aW91cyB0byBkaXN0YW50IGltcGxlbWVu dG9ycyBhbmQgdXNlcnMgd2h5IHRoZXNlIHR3byBsZXZlbHMgZXhpc3QgYW5kIHdoYXQgdGhlIHJ1 bGVzIGFyZSBmb3IgdXNpbmcgdGhlbS4NCg0KQ29uZnVzaW9uIFByb3BhZ2F0ZXMg4oCUIEZ1dHVy ZSB1c2UgY2FzZXMsIHNheSBlbmRvcnNlbWVudHMsIHdpbGwgaW5oZXJpdCB0aGlzIHNwbGl0IGxl dmVsIGJlY2F1c2UgdGhleSB3aWxsIHdhbnQgdG8gdXNlIGNsYWltcyBmcm9tIGJvdGggcmVnaXN0 cmllcy4NCg0KSUFOQSBjcm9zcyBjaGVja2luZyByZXF1aXJlZCDigJQgV2Ugd291bGQgd2FudCBl eHBlcnRzIHRvIG1ha2Ugc3VyZSB0aGF0IGEgY2xhaW0gd2FzbuKAmXQgZGVmaW5lZCBpbiBib3Ro IHBsYWNlcw0KDQpSZXBsaWNhdGUgZm9yIEpXVCDigJQgV2XigJlkIGhhdmUgdG8gZG8gdGhlIHNh bWUgc3Vic2V0dGluZyBpbiBKV1Qgd2l0aCBhIG5ldyBFQVQgSldUIHJlZ2lzdHJ5Lg0KDQpNb3Jl IHJlZ2lzdHJpZXMgaXMgbm90IGJldHRlciDigJQgRG9lc27igJl0IHNlZW0gb3BlcmF0aW9uYWxs eSBlZmZpY2llbnQgdG8gYWRkIHR3byBtb3JlIHJlZ2lzdHJpZXMgcmVhbGx5IHNpbWlsYXIgdG8g b25lcyB3ZSBhbHJlYWR5IGhhdmUuIEFsc28sIGl0IGlzIHdlaXJkIGlmIHZlcnkgc2ltaWxhciBy ZWdpc3RyaWVzIGhhdmUgc2lnbmlmaWNhbnRseSBkaWZmZXJlbnQgcnVsZXMuDQoNCkxvb3Bob2xl IOKAlCBJZiBzb21lb25lIGRvZXNu4oCZdCBsaWtlIHRoZSBFQVQgcnVsZXMsIHRoZXnigJlsbCBq dXN0IHJlZ2lzdGVyIGEgY2xhaW0gdW5kZXIgdGhlIENXVCBydWxlcy4gVGhlcmXigJlzIG5vIHdh eSB0byBwcmV2ZW50IHRoYXQuDQoNCkRlY29kZSBjb21wbGV4aXR5IOKAlCBJdCB3aWxsIG1ha2Ug Q1dUIGFuZCBFQVQgZGVjb2RlciBhIGxpdHRsZSBtb3JlIGNvbXBsZXguIEl0IHdpbGwgYWxzbyBt YWtlIGVuY29kZSBtb3JlIGNvbXBsZXgsIGJ1dCBub3Qgb2YgYW55IHNpZ25pZmljYW5jZS4NCg0K DQpUaGUgcGF0aCBvZiBsZWFzdCByZXNpc3RhbmNlIGhlcmUgaXMgdG8ganVzdCBwdXQgdGhlIGNs YWltcyBjaGFyYWN0ZXJpc3RpY3MgaW50byB0aGUgRUFUIGRvY3VtZW50IGFzIGEgc3VnZ2VzdGlv biAvIHJlY29tbWVuZGF0aW9uLiBUaGVyZSB3b3VsZCBiZSBubyBmb3JtYWwgaW1wb3NpdGlvbiBv ZiB0aGVzZSBndWlkZWxpbmVzLiBUaGV5IHdlcmUgbmV2ZXIgbWVhbnQgYXMgbW9yZSB0aGFuIGd1 aWRlbGluZXMgYW55d2F5Lg0KDQpBbm90aGVyIG9wdGlvbiBpcyB0byBtYWtlIEVBVCBhbiB1cGRh dGUgb2YgQ1dUIHNvIGl0IGZvcm1hbGx5IGNoYW5nZXMgYW5kIGFkanVzdHMgQ1dULg0KDQpBbm90 aGVyIG9wdGlvbiBpcyB0byBwdWJsaXNoIGEgc2VwYXJhdGUgdXBkYXRlIG9mIENXVC4NCg0KTXkg cGxhbiBpcyB0byBwcm9jZWVkIHdpdGggdGhlIHBhdGggb2YgbGVhc3QgcmVzaXN0YW5jZSwgcHV0 dGluZyB0aGVtIGluIEVBVCBhcyBndWlkZWxpbmVzLCB1bmxlc3MgdGhlcmUgaXMgc3VwcG9ydCBm b3IgbW9yZSBmb3JtYWwgd29yayBvbiBDV1QuDQoNCkxMDQo= --_000_BL0PR2101MB10272B390422ECE0D7FDDDC8A3DD0BL0PR2101MB1027_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2Vj dGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEu MGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHls ZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQi IHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0 IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFk Pg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBj bGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5PbmUgbW9yZSBwb2ludCBpcyB0aGF0IGlmIHNvbWVvbmUgYWRkcyBh biBFQVQgY2xhaW0gbm93LCBhbmQgbGF0ZXIgaXTigJlzIGZvdW5kIHRvIG5lZWQgdGhlIHNhbWUg dGhpbmcgZm9yIGEgbm9uLWF0dGVzdGF0aW9uIHVzZSBjYXNlLDxicj4NCnRoZW4geW914oCZZCBl bmQgdXAgd2l0aCBhbiBlbnRyeSBpbiBib3RoIHJlZ2lzdHJpZXMsIG9yIGVsc2UgbWlzdXNpbmcg YSB2YWx1ZSBvdXQgb2YgYW4gRUFUIHJlZ2lzdHJ5IGZvciBhIG5vbi1FQVQgdXNlIGNhc2UuDQo8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFJBVFMgJmx0O3JhdHMt Ym91bmNlc0BpZXRmLm9yZyZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+TGF1cmVuY2UgTHVuZGJs YWRlPGJyPg0KPGI+U2VudDo8L2I+IE1vbmRheSwgQXByaWwgMTMsIDIwMjAgMToyNCBQTTxicj4N CjxiPlRvOjwvYj4gcmF0c0BpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBbUmF0c10gQ2xh aW1zIENoYXJhY3RlcmlzdGljcyBpbiBFQVQgb3IgaW4gQ1dUPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkppbSBwcm9wb3NlZCB0aGF0IHRoZSBF QVQtZGVmaW5lZCBjbGFpbXMgd291bGQgYmUgcHV0IGluIHRoZWlyIG93biBFQVQgc3ViLWFyZWEg b2YgQ1dUPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4tIFRoZXkgd291bGQgaGF2ZSBhIHNlcGFyYXRlIElBTkEgcmVnaXN0cnkgdGhhdCBjb3VsZCBo YXZlIHNlcGFyYXRlIHJ1bGVzLCBwYXJ0aWN1bGFybHkgYWRkaW5nJm5ic3A7PGEgaHJlZj0iaHR0 cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNB JTJGJTJGZ2l0aHViLmNvbSUyRmlldGYtcmF0cy13ZyUyRmVhdCUyRnB1bGwlMkY3JmFtcDtkYXRh PTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3QzIyNmVjZWI4MmQ0YTQ2NzBmNjky MDhkN2RmZTg5YzJjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3 QzYzNzIyNDA2MjQ1NTMxOTgwNiZhbXA7c2RhdGE9RmJrNWJOeFRnRTAzTHFXSjlLd0k5dzgyOFVm TFZocE81ak9SWUFON1N3ayUzRCZhbXA7cmVzZXJ2ZWQ9MCI+dGhlDQogZ3VpZGVsaW5lcyBmcm9t IHRoaXMgUFI8L2E+Jm5ic3A7Jm5ic3A7KHdoaWNoIGFyZSBqdXN0IGd1aWRlbGluZXMpLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LSBXb3VsZCBv Y2N1ciBpbiBDV1TigJlzIGluIGEgc3BlY2lhbCBtYXAgZGVmaW5lZCB0byBob2xkIHRoZW0uPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tIFNlcGFy YXRlIGxhYmVsIHNwYWNlPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgbWFpbiBhZHZhbnRhZ2VzIG9mIHRoaXMgaXMgdGhhdCBF QVQgY291bGQgaGF2ZSBzZXBhcmF0ZSBJQU5BIHJlZ2lzdHJhdGlvbiBydWxlcy4gVGhlcmXigJlz IGFsc28gYSBzbGlnaHQgc2l6ZSBhZHZhbnRhZ2UgaW4gdGhhdCB0aGUgb25lLWJ5dGUgbGFiZWxz IGNvdWxkIGJlIHJlIHVzZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBkb27igJl0IHRoaW5rIHRoaXMgYWR2YW50YWdlIGlz IG91dCB3ZWlnaGVkIGJ5IHRoZXNlIGRpc2FkdmFudGFnZXMuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tcmlnaHQ6 MGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Db25mdXNpb24mbmJzcDvigJQg PC9iPkJvdGggRUFULW9yaWVudGVkIHVzZSBjYXNlcyBhbmQgQ1dULW9yaWVudGVkIHVzZSBjYXNl cyB3b3VsZCBsaWtlbHkgdXNlIGNsYWltcyBmcm9tIGJvdGggdGhlIENXVCBhbmQgRUFUIHJlZ2lz dHJpZXMuIE1hbnkgbWFueSBjbGFpbXMgYXJlIGdvaW5nIHRvIGJlIGdlbmVyaWNhbGx5IHVzZWZ1 bC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+TW9yZSBDb25mdXNpb248L2I+IOKAlCBJdCBpcyBub3QgcGFydGljdWxhcmx5IG9idmlvdXMg dG8gZGlzdGFudCBpbXBsZW1lbnRvcnMgYW5kIHVzZXJzIHdoeSB0aGVzZSB0d28gbGV2ZWxzIGV4 aXN0IGFuZCB3aGF0IHRoZSBydWxlcyBhcmUgZm9yIHVzaW5nIHRoZW0uPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkNvbmZ1c2lvbiBQcm9w YWdhdGVzPC9iPiDigJQgRnV0dXJlIHVzZSBjYXNlcywgc2F5IGVuZG9yc2VtZW50cywgd2lsbCBp bmhlcml0IHRoaXMgc3BsaXQgbGV2ZWwgYmVjYXVzZSB0aGV5IHdpbGwgd2FudCB0byB1c2UgY2xh aW1zIGZyb20gYm90aCByZWdpc3RyaWVzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5JQU5BIGNyb3NzIGNoZWNraW5nIHJlcXVpcmVkPC9i PiDigJQgV2Ugd291bGQgd2FudCBleHBlcnRzIHRvIG1ha2Ugc3VyZSB0aGF0IGEgY2xhaW0gd2Fz buKAmXQgZGVmaW5lZCBpbiBib3RoIHBsYWNlczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5SZXBsaWNhdGUgZm9yIEpXVDwvYj4g4oCUIFdl 4oCZZCBoYXZlIHRvIGRvIHRoZSBzYW1lIHN1YnNldHRpbmcgaW4gSldUIHdpdGggYSBuZXcgRUFU IEpXVCByZWdpc3RyeS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+TW9yZSByZWdpc3RyaWVzIGlzIG5vdCBiZXR0ZXI8L2I+IOKAlCBEb2Vz buKAmXQgc2VlbSBvcGVyYXRpb25hbGx5IGVmZmljaWVudCB0byBhZGQgdHdvIG1vcmUgcmVnaXN0 cmllcyByZWFsbHkgc2ltaWxhciB0byBvbmVzIHdlIGFscmVhZHkgaGF2ZS4gQWxzbywgaXQgaXMg d2VpcmQgaWYgdmVyeSBzaW1pbGFyIHJlZ2lzdHJpZXMgaGF2ZSBzaWduaWZpY2FudGx5IGRpZmZl cmVudCBydWxlcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxiPkxvb3Bob2xlJm5ic3A7PC9iPuKAlCBJZiBzb21lb25lIGRvZXNu 4oCZdCBsaWtlIHRoZSBFQVQgcnVsZXMsIHRoZXnigJlsbCBqdXN0IHJlZ2lzdGVyIGEgY2xhaW0g dW5kZXIgdGhlIENXVCBydWxlcy4gVGhlcmXigJlzIG5vIHdheSB0byBwcmV2ZW50IHRoYXQuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+RGVjb2RlIGNvbXBsZXhpdHk8L2I+IOKAlCBJdCB3aWxsIG1ha2UgQ1dUIGFuZCBFQVQg ZGVjb2RlciBhIGxpdHRsZSBtb3JlIGNvbXBsZXguIEl0IHdpbGwgYWxzbyBtYWtlIGVuY29kZSBt b3JlIGNvbXBsZXgsIGJ1dCBub3Qgb2YgYW55IHNpZ25pZmljYW5jZS48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGUgcGF0aCBvZiBsZWFzdCByZXNpc3RhbmNlIGhlcmUgaXMgdG8ganVzdCBwdXQgdGhlIGNsYWlt cyBjaGFyYWN0ZXJpc3RpY3MgaW50byB0aGUgRUFUIGRvY3VtZW50IGFzIGEgc3VnZ2VzdGlvbiAv IHJlY29tbWVuZGF0aW9uLiBUaGVyZSB3b3VsZCBiZSBubyBmb3JtYWwgaW1wb3NpdGlvbiBvZiB0 aGVzZSBndWlkZWxpbmVzLiBUaGV5IHdlcmUgbmV2ZXIgbWVhbnQgYXMgbW9yZSB0aGFuIGd1aWRl bGluZXMgYW55d2F5LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5Bbm90aGVyIG9wdGlvbiBpcyB0byBtYWtlIEVBVCBhbiB1cGRhdGUgb2YgQ1dU IHNvIGl0IGZvcm1hbGx5IGNoYW5nZXMgYW5kIGFkanVzdHMgQ1dULjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Bbm90aGVyIG9wdGlvbiBpcyB0 byBwdWJsaXNoIGEgc2VwYXJhdGUgdXBkYXRlIG9mIENXVC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TXkgcGxhbiBpcyB0byBwcm9jZWVkIHdp dGggdGhlIHBhdGggb2YgbGVhc3QgcmVzaXN0YW5jZSwgcHV0dGluZyB0aGVtIGluIEVBVCBhcyBn dWlkZWxpbmVzLCB1bmxlc3MgdGhlcmUgaXMgc3VwcG9ydCBmb3IgbW9yZSBmb3JtYWwgd29yayBv biBDV1QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkxMPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_BL0PR2101MB10272B390422ECE0D7FDDDC8A3DD0BL0PR2101MB1027_-- From nobody Tue Apr 14 12:45:18 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D9CE3A0DCD for ; Tue, 14 Apr 2020 12:45:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.267 X-Spam-Level: X-Spam-Status: No, score=-2.267 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bho1UiGdxil9 for ; Tue, 14 Apr 2020 12:45:16 -0700 (PDT) Received: from out-19.smtp.github.com (out-19.smtp.github.com [192.30.252.202]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC5AB3A0DCC for ; Tue, 14 Apr 2020 12:45:15 -0700 (PDT) Received: from github-lowworker-c53a806.ac4-iad.github.net (github-lowworker-c53a806.ac4-iad.github.net [10.52.23.45]) by smtp.github.com (Postfix) with ESMTP id CA860520B84 for ; Tue, 14 Apr 2020 12:45:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1586893514; bh=q9pMWZxsIAi+0E5JOw2qZuYSf6VIZ2Pc2K3KXlJaKfM=; h=Date:From:To:Subject:From; b=CBeb/u3vUH1biRkRCoksEMwXi5yREWPwvxotkfMcvNVASs808H12sktV+Xttx2mE9 GqqVzWQdxu8V5Wc9Hvh4HQunmnn4u0cz3la2nmpgqQn22cgLkpAZJzUrt5xpJLzGff aT8jJXcWra+xZGDPhs43zJ3UMvwlDD2GH4DTYMbE= Date: Tue, 14 Apr 2020 12:45:14 -0700 From: Laurence Lundblade To: rats@ietf.org Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-GitHub-Recipient-Address: rats@ietf.org X-Auto-Response-Suppress: All Archived-At: Subject: [Rats] [ietf-rats-wg/eat] 231261: Claims characteristics are now just guidance for d... X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Apr 2020 19:45:17 -0000 Branch: refs/heads/claim-characteristics Home: https://github.com/ietf-rats-wg/eat Commit: 231261edbcfd6497597077b3f8aecfd0731d0238 https://github.com/ietf-rats-wg/eat/commit/231261edbcfd6497597077b3f8aecfd0731d0238 Author: Laurence Lundblade Date: 2020-04-14 (Tue, 14 Apr 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Claims characteristics are now just guidance for designing EAT claims From nobody Tue Apr 14 12:47:03 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CEFC3A0DEA for ; Tue, 14 Apr 2020 12:46:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.267 X-Spam-Level: X-Spam-Status: No, score=-7.267 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qSgduWkdo5P0 for ; Tue, 14 Apr 2020 12:46:53 -0700 (PDT) Received: from out-27.smtp.github.com (out-27.smtp.github.com [192.30.252.210]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 009BA3A0DFC for ; Tue, 14 Apr 2020 12:46:52 -0700 (PDT) Received: from github-lowworker-f045d1f.ac4-iad.github.net (github-lowworker-f045d1f.ac4-iad.github.net [10.52.19.54]) by smtp.github.com (Postfix) with ESMTP id 247C3E05EE for ; Tue, 14 Apr 2020 12:46:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1586893612; bh=s+WhxMWcKOOUzHj5HAZGuT2wcjx2YlelwlSLEB8vGjM=; h=Date:From:To:Subject:From; b=SuYY/RWkg6/ukKOjxyTY6k8iF0MdPlmey9WCJtcGjHS9a6bDtG09WjNANDKjEJby9 rOURrrzs+Gb5HokLiABOeX2daODAGeO7D2mqqKaBDCtEA1iwI5sm9Ny3ykg9ssbZ5X uMs/qtxJKvkoXU18y3Nc4i7g+VpeKhoNUKBcoMLs= Date: Tue, 14 Apr 2020 12:46:52 -0700 From: Laurence Lundblade To: rats@ietf.org Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-GitHub-Recipient-Address: rats@ietf.org X-Auto-Response-Suppress: All Archived-At: Subject: [Rats] [ietf-rats-wg/eat] 88d98b: no longer an update to RFC 8329 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Apr 2020 19:47:01 -0000 Branch: refs/heads/claim-characteristics Home: https://github.com/ietf-rats-wg/eat Commit: 88d98b499d224acaf914e2ff0e1e1c5fc0f0f96d https://github.com/ietf-rats-wg/eat/commit/88d98b499d224acaf914e2ff0e1e1c5fc0f0f96d Author: Laurence Lundblade Date: 2020-04-14 (Tue, 14 Apr 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- no longer an update to RFC 8329 From nobody Tue Apr 14 12:48:58 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC0503A0DDA for ; Tue, 14 Apr 2020 12:48:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.267 X-Spam-Level: X-Spam-Status: No, score=-7.267 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zFDq9BB3WMNA for ; Tue, 14 Apr 2020 12:48:53 -0700 (PDT) Received: from out-27.smtp.github.com (out-27.smtp.github.com [192.30.252.210]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E7963A0DD8 for ; Tue, 14 Apr 2020 12:48:53 -0700 (PDT) Received: from github-lowworker-943b171.ac4-iad.github.net (github-lowworker-943b171.ac4-iad.github.net [10.52.22.59]) by smtp.github.com (Postfix) with ESMTP id 976F6E111B for ; Tue, 14 Apr 2020 12:48:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1586893732; bh=JOdKR87zaktzkCrbLh5fgoyIyPBJeTpsBIx2T7Ed+fA=; h=Date:From:To:Subject:From; b=m4ipxPIKyBBRJ3HIhfZcO+Z9+JZepB/Tnqg+Owj56vwhRACLPim2WHBg35iA6OFOu Sc6hhJKEBsSpGiMx+jvMxNjPseKlQz+u1Y1JCM1mgGxIxMMhxi2zu36cbWQBVbl73X qdhtTfeqg6ZiQwCs4LgtHpHg3fH5k+f96DCZUFj4= Date: Tue, 14 Apr 2020 12:48:52 -0700 From: Laurence Lundblade To: rats@ietf.org Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-GitHub-Recipient-Address: rats@ietf.org X-Auto-Response-Suppress: All Archived-At: Subject: [Rats] [ietf-rats-wg/eat] 154fc4: minor reword related to nonce X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Apr 2020 19:48:56 -0000 Branch: refs/heads/claim-characteristics Home: https://github.com/ietf-rats-wg/eat Commit: 154fc43061f483856483aec7e202a5d01e134f05 https://github.com/ietf-rats-wg/eat/commit/154fc43061f483856483aec7e202a5d01e134f05 Author: Laurence Lundblade Date: 2019-07-15 (Mon, 15 Jul 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- minor reword related to nonce Commit: 817d0352aec99452488fa7779d8dad48dd57c317 https://github.com/ietf-rats-wg/eat/commit/817d0352aec99452488fa7779d8dad48dd57c317 Author: Laurence Lundblade Date: 2019-07-16 (Tue, 16 Jul 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Minor formatting fixes Commit: bdbefa9f71e2d5664c16dbe37a36ceae4b65f140 https://github.com/ietf-rats-wg/eat/commit/bdbefa9f71e2d5664c16dbe37a36ceae4b65f140 Author: Laurence Lundblade Date: 2019-07-16 (Tue, 16 Jul 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- more minor formatting fixes Commit: 68e19a58470fb223313cf5a9910a8337514a114e https://github.com/ietf-rats-wg/eat/commit/68e19a58470fb223313cf5a9910a8337514a114e Author: Laurence Lundblade Date: 2019-07-22 (Mon, 22 Jul 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Minor typo fixes and clarifications Commit: d56804b8c62d2c04abf88d2e88d34ef57083460c https://github.com/ietf-rats-wg/eat/commit/d56804b8c62d2c04abf88d2e88d34ef57083460c Author: Laurence Lundblade Date: 2019-07-22 (Mon, 22 Jul 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- minor typo fix Commit: 86e559b35f518baa61cc4aecd04d0f86d46eb1c5 https://github.com/ietf-rats-wg/eat/commit/86e559b35f518baa61cc4aecd04d0f86d46eb1c5 Author: Henk Birkholz Date: 2019-07-23 (Tue, 23 Jul 2019) Changed paths: R Makefile R README.md R circle.yml M draft-ietf-rats-eat.md Log Message: ----------- preparation for CircleCI Commit: 3449f68b667050f7ce97bddbdc16159546da5ed0 https://github.com/ietf-rats-wg/eat/commit/3449f68b667050f7ce97bddbdc16159546da5ed0 Author: Henk Birkholz Date: 2019-07-23 (Tue, 23 Jul 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Cleanup for CircleCI Commit: a9441fe5336bd4dfaca27e5253ffbe3c9c3b8a0d https://github.com/ietf-rats-wg/eat/commit/a9441fe5336bd4dfaca27e5253ffbe3c9c3b8a0d Author: Henk Birkholz Date: 2019-07-23 (Tue, 23 Jul 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- changed -01 to latest Commit: 9e83fde1de68b7c16feb6a38834f80610806f862 https://github.com/ietf-rats-wg/eat/commit/9e83fde1de68b7c16feb6a38834f80610806f862 Author: Henk Birkholz Date: 2019-07-23 (Tue, 23 Jul 2019) Changed paths: Log Message: ----------- Merge branch 'master' of github.com:ietf-rats-wg/eat Commit: cdaecbcdae3a61dcc39aa9601ac72ad8a6203965 https://github.com/ietf-rats-wg/eat/commit/cdaecbcdae3a61dcc39aa9601ac72ad8a6203965 Author: Henk Birkholz Date: 2019-07-23 (Tue, 23 Jul 2019) Changed paths: A .circleci/config.yml A .gitignore A .travis.yml A CONTRIBUTING.md A LICENSE.md A Makefile A README.md Log Message: ----------- Setup repository for draft-ietf-rats-eat using https://github.com/martinthomson/i-d-template Commit: 8c9a3eaa2273979da0e247c58a04d093d2780016 https://github.com/ietf-rats-wg/eat/commit/8c9a3eaa2273979da0e247c58a04d093d2780016 Author: gmandyam Date: 2019-08-12 (Mon, 12 Aug 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Security Considerations First cut Commit: ac2550f0b67320e260df88287dac651ac94549d7 https://github.com/ietf-rats-wg/eat/commit/ac2550f0b67320e260df88287dac651ac94549d7 Author: Paul Crowley Date: 2019-09-09 (Mon, 09 Sep 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Fix capitalization typo Commit: faab2c4351ce31e3d3f7b6b94a0f06c9e5d1cfb9 https://github.com/ietf-rats-wg/eat/commit/faab2c4351ce31e3d3f7b6b94a0f06c9e5d1cfb9 Author: Laurence Lundblade Date: 2019-10-01 (Tue, 01 Oct 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Merge pull request #29 from ciphergoth/patch-1 Fix capitalization typo Commit: f47a8b49b49763f5cd6887e48bb22bc521175471 https://github.com/ietf-rats-wg/eat/commit/f47a8b49b49763f5cd6887e48bb22bc521175471 Author: gmandyam Date: 2019-10-16 (Wed, 16 Oct 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Update draft-ietf-rats-eat.md Commit: c237b91135dcd940339e0860d33036e90dd9d941 https://github.com/ietf-rats-wg/eat/commit/c237b91135dcd940339e0860d33036e90dd9d941 Author: Laurence Lundblade Date: 2019-10-31 (Thu, 31 Oct 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- revamp of submods and nested tokens Commit: 5bfb9df8c6c6043a71bc98c140a100e4a0c278c6 https://github.com/ietf-rats-wg/eat/commit/5bfb9df8c6c6043a71bc98c140a100e4a0c278c6 Author: Laurence Lundblade Date: 2019-10-31 (Thu, 31 Oct 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Revert "revamp of submods and nested tokens". It should be a PR, not a direct commit. This reverts commit c237b91135dcd940339e0860d33036e90dd9d941. Commit: 2a051f45f07398de86a5731ff124c20a52ce1e09 https://github.com/ietf-rats-wg/eat/commit/2a051f45f07398de86a5731ff124c20a52ce1e09 Author: gmandyam Date: 2019-11-14 (Thu, 14 Nov 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Update draft-ietf-rats-eat.md Co-Authored-By: Thomas Fossati Commit: b1be67930ffd4c74f75d7e72ee0508e09126753e https://github.com/ietf-rats-wg/eat/commit/b1be67930ffd4c74f75d7e72ee0508e09126753e Author: gmandyam Date: 2019-11-17 (Sun, 17 Nov 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Update draft-ietf-rats-eat.md Commit: bdb24b4b85f06781b66f92d6c458e489d39cd8ab https://github.com/ietf-rats-wg/eat/commit/bdb24b4b85f06781b66f92d6c458e489d39cd8ab Author: Henk Birkholz Date: 2019-11-27 (Wed, 27 Nov 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- first attempt at fixing the CirclCI issues (and apparently xml2rfc) that creates an Error: Expected attribute "year" to be an integer, but found "n.d." Commit: a69331d7248345bde8fad2de93e4ce39c753be85 https://github.com/ietf-rats-wg/eat/commit/a69331d7248345bde8fad2de93e4ce39c753be85 Author: Laurence Lundblade Date: 2019-12-05 (Thu, 05 Dec 2019) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- OEMID clarifications and references (#41) * OEMID clarifications and references * Typographic errors in OEM ID section * Fix dates in references that seem to be causing build failures Commit: efd3e2c1217936ca454d8b666e90e1a832a46152 https://github.com/ietf-rats-wg/eat/commit/efd3e2c1217936ca454d8b666e90e1a832a46152 Author: Laurence Lundblade Date: 2020-01-06 (Mon, 06 Jan 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Add nonce claim, update jti/cti text (#42) * Add nonce claim, update jti/cti text * Remove confusing comment about nonce transport security * Add size range for nonce and correct the CDDL Commit: e0132c0a3bf8abf876b8cfd88c1d92ca4d844ea1 https://github.com/ietf-rats-wg/eat/commit/e0132c0a3bf8abf876b8cfd88c1d92ca4d844ea1 Author: Laurence Lundblade Date: 2020-01-06 (Mon, 06 Jan 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Add changes since -01 section Commit: 7d9a8de9cf276d7a71b4eaa8bf254f3757966fcf https://github.com/ietf-rats-wg/eat/commit/7d9a8de9cf276d7a71b4eaa8bf254f3757966fcf Author: Laurence Lundblade Date: 2020-02-07 (Fri, 07 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- UEID update: add references; 128 bits now, up to 256 bits later * Up UEID to 256 bits and add design rationale appendix * More thorough justification for 256-bit UEID * Correct spelling of BlueTooth Co-Authored-By: Thomas Fossati * Grammar Co-Authored-By: Thomas Fossati * Grammar Co-Authored-By: Thomas Fossati * Spelling Co-Authored-By: setrofim * Grammar Co-Authored-By: Thomas Fossati * fixed date issues for registries in yaml header * 128 bit UEIDs allowed, 256 optional; improve analysis in appendix * Correctly refer to oemid claim rather than OUI * EUI-48... are rolled in to EUI; add reference for IMEI * add references for EUIs Co-authored-by: Thomas Fossati Co-authored-by: setrofim Co-authored-by: Henk Birkholz Commit: 2c14b48b2b43df2f23f1c6c0a0540f4ee1db8331 https://github.com/ietf-rats-wg/eat/commit/2c14b48b2b43df2f23f1c6c0a0540f4ee1db8331 Author: Laurence Lundblade Date: 2020-02-13 (Thu, 13 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- revamp of submods and nested tokens (#43) * the nested eat claims is folded in with submods * specifies no inheritance * fix date for birthday attack reference to address build error * correction to say submod security level is less than or equal to rather than less than Commit: 136d631593e21078c3d1010f1866ce837f7ed189 https://github.com/ietf-rats-wg/eat/commit/136d631593e21078c3d1010f1866ce837f7ed189 Author: Laurence Lundblade Date: 2020-02-13 (Thu, 13 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- add differences from -02 draft Commit: a648f41f4040e94847d2f6669bb0045e4331d53a https://github.com/ietf-rats-wg/eat/commit/a648f41f4040e94847d2f6669bb0045e4331d53a Author: Laurence Lundblade Date: 2020-02-19 (Wed, 19 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Lots of CDDL fixes (#52) * Lots of fixes to the CDDL * update changes since -02 draft * Correct labels so the are integers and other minor * fix tiny typo Thanks, Henk Commit: b899254440826cea379eb1a5115ad08d1ed69898 https://github.com/ietf-rats-wg/eat/commit/b899254440826cea379eb1a5115ad08d1ed69898 Author: Giri Mandyam Date: 2020-02-19 (Wed, 19 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Merge branch 'master' into br1 Commit: cf76bd58c185a98a8a9d1637b9030e17f1054a92 https://github.com/ietf-rats-wg/eat/commit/cf76bd58c185a98a8a9d1637b9030e17f1054a92 Author: Giri Mandyam Date: 2020-02-19 (Wed, 19 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Merge pull request #28 from gmandyam/br1 Security Considerations Commit: 402099d886100f0181b2c9cbf51de39d2cda3afb https://github.com/ietf-rats-wg/eat/commit/402099d886100f0181b2c9cbf51de39d2cda3afb Author: Giri Mandyam Date: 2020-02-19 (Wed, 19 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Update draft-ietf-rats-eat.md Commit: 181c5fc09e5e71dc80c1108828fe2cfc4dfaec60 https://github.com/ietf-rats-wg/eat/commit/181c5fc09e5e71dc80c1108828fe2cfc4dfaec60 Author: Giri Mandyam Date: 2020-02-19 (Wed, 19 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Update draft-ietf-rats-eat.md Commit: 82dc3b0b98ccf5ae46378d85ab7481e275440159 https://github.com/ietf-rats-wg/eat/commit/82dc3b0b98ccf5ae46378d85ab7481e275440159 Author: Laurence Lundblade Date: 2020-02-20 (Thu, 20 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Array of nonces; fix example; text reformatting Commit: 22462da89d970fbb3b5922402263381ea5052692 https://github.com/ietf-rats-wg/eat/commit/22462da89d970fbb3b5922402263381ea5052692 Author: Giri Mandyam Date: 2020-02-20 (Thu, 20 Feb 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Update draft-ietf-rats-eat.md Commit: 0bc0f9149f544855ba400989efdd9b4961257ef8 https://github.com/ietf-rats-wg/eat/commit/0bc0f9149f544855ba400989efdd9b4961257ef8 Author: Laurence Lundblade Date: 2020-03-19 (Thu, 19 Mar 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- boot_state split into secure-boot and debug-disable claims; debug is an enum, not Booleans * Revamp debug disable so it is levels, not Booleans * Clarify description of disabled state Co-Authored-By: Thomas Fossati * Fix CDDL for boot and debug state * Rework to clarify inheritance and relations between submodules and superior modules * Add the Not Reported debug level and indicate that is the default when the claim is absent * absence of any claim means not reported; remove Not Reported debug state * grammar fix * split boot-state claim into debug disable and secure boot claims Co-authored-by: Thomas Fossati Co-authored-by: Laurence Lundblade Commit: fd566501ef6d4de679b8feee7415eacc0e209bcb https://github.com/ietf-rats-wg/eat/commit/fd566501ef6d4de679b8feee7415eacc0e209bcb Author: Patrick Uiterwijk Date: 2020-03-19 (Thu, 19 Mar 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Fix sentences describing Major type 2 and other types (#56) Commit: aac5de214068993208b41066f1717222abde6114 https://github.com/ietf-rats-wg/eat/commit/aac5de214068993208b41066f1717222abde6114 Author: Laurence Lundblade Date: 2020-03-19 (Thu, 19 Mar 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Fix minor errors in claim naming and examples Commit: be9adcfd6389a409503729ea7d2c9e3e9a7a470b https://github.com/ietf-rats-wg/eat/commit/be9adcfd6389a409503729ea7d2c9e3e9a7a470b Author: Laurence Lundblade Date: 2020-04-14 (Tue, 14 Apr 2020) Changed paths: A .circleci/config.yml A .gitignore A .travis.yml A CONTRIBUTING.md A LICENSE.md M Makefile M README.md R circle.yml M draft-ietf-rats-eat.md Log Message: ----------- Merge branch 'master' into claim-characteristics Compare: https://github.com/ietf-rats-wg/eat/compare/88d98b499d22...be9adcfd6389 From nobody Tue Apr 14 12:49:24 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CD8F3A0DDB for ; Tue, 14 Apr 2020 12:49:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.268 X-Spam-Level: X-Spam-Status: No, score=-2.268 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xZM07Fq6yPqw for ; Tue, 14 Apr 2020 12:49:20 -0700 (PDT) Received: from out-28.smtp.github.com (out-28.smtp.github.com [192.30.252.211]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC9393A0DDA for ; Tue, 14 Apr 2020 12:49:19 -0700 (PDT) Received: from github-lowworker-52827f8.ash1-iad.github.net (github-lowworker-52827f8.ash1-iad.github.net [10.56.108.24]) by smtp.github.com (Postfix) with ESMTP id 448A68C0FEA for ; Tue, 14 Apr 2020 12:49:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1586893759; bh=+gFPZmhz/MrRfBNw1n2Z0VpEk1sYI6W6lCZiBqdo0qg=; h=Date:From:To:Subject:From; b=FMy9DaiLH4QPGfnyIhw8qE5OfJlOQQkEu5/784oCIRQe1HbyZdrQzu2oqZjXOKmdB nX9q/j65bkrGvQ2rxtpFvEmROWuenQmOgk5JydKgAMEHlNZ6rPF5bOqZlpDyRpeVti EpDkTAUSUV20F4YkRsJJGQGTGdHiWAuoy/kungJw= Date: Tue, 14 Apr 2020 12:49:19 -0700 From: Henk Birkholz To: rats@ietf.org Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-GitHub-Recipient-Address: rats@ietf.org X-Auto-Response-Suppress: All Archived-At: Subject: [Rats] [ietf-rats-wg/eat] 4f9f83: Script updating gh-pages from be9adcf. [ci skip] X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Apr 2020 19:49:22 -0000 Branch: refs/heads/gh-pages Home: https://github.com/ietf-rats-wg/eat Commit: 4f9f833528e11c8130d6fbb06329218c068e7355 https://github.com/ietf-rats-wg/eat/commit/4f9f833528e11c8130d6fbb06329218c068e7355 Author: ID Bot Date: 2020-04-14 (Tue, 14 Apr 2020) Changed paths: A claim-characteristics/draft-ietf-rats-eat.html A claim-characteristics/draft-ietf-rats-eat.txt A claim-characteristics/index.html M index.html Log Message: ----------- Script updating gh-pages from be9adcf. [ci skip] From nobody Tue Apr 14 12:49:29 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4F073A0DE1 for ; Tue, 14 Apr 2020 12:49:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.268 X-Spam-Level: X-Spam-Status: No, score=-2.268 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.168, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8YgsJbmNsQOf for ; Tue, 14 Apr 2020 12:49:24 -0700 (PDT) Received: from out-26.smtp.github.com (out-26.smtp.github.com [192.30.252.209]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D9993A0DDC for ; Tue, 14 Apr 2020 12:49:24 -0700 (PDT) Received: from github-lowworker-6349a71.ac4-iad.github.net (github-lowworker-6349a71.ac4-iad.github.net [10.52.18.20]) by smtp.github.com (Postfix) with ESMTP id BB01B282B2F for ; Tue, 14 Apr 2020 12:49:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1586893763; bh=8qdC0g09UgRb+FEaTxkSuSg06j5RIuAzUZL1U7JQkT0=; h=Date:From:To:Subject:From; b=nIsHKZvxR2F33Al6NmgERXALkbHY/tGQ9dStj9Rt6EHDduqjGCZ5SzV0PYX4ZH1No sJJDwLba0d1FzGbXP2g1cV11SlOjuq7fdhSY84BBo9TBBHbeM8GktZO0kmYRjSsrHy InvNH+i4QjYl395aHQNVhItt5v9DewhtxN+FHVws= Date: Tue, 14 Apr 2020 12:49:23 -0700 From: Henk Birkholz To: rats@ietf.org Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-GitHub-Recipient-Address: rats@ietf.org X-Auto-Response-Suppress: All Archived-At: Subject: [Rats] [ietf-rats-wg/eat] df681b: Script updating archive at 2020-04-14T19:49:05Z. [... X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Apr 2020 19:49:28 -0000 Branch: refs/heads/gh-pages Home: https://github.com/ietf-rats-wg/eat Commit: df681b9687b52c318b77a02250d1f25ee5321e47 https://github.com/ietf-rats-wg/eat/commit/df681b9687b52c318b77a02250d1f25ee5321e47 Author: ID Bot Date: 2020-04-14 (Tue, 14 Apr 2020) Changed paths: M archive.json R pulls.json Log Message: ----------- Script updating archive at 2020-04-14T19:49:05Z. [ci skip] From nobody Tue Apr 14 13:00:34 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7610A3A0D42 for ; Tue, 14 Apr 2020 13:00:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.916 X-Spam-Level: X-Spam-Status: No, score=-1.916 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B-Irw2nKQulA for ; Tue, 14 Apr 2020 13:00:29 -0700 (PDT) Received: from p3plsmtpa06-01.prod.phx3.secureserver.net (p3plsmtpa06-01.prod.phx3.secureserver.net [173.201.192.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C18253A0E09 for ; Tue, 14 Apr 2020 13:00:29 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id ORjQjI8qUQs3wORjRjguxq; Tue, 14 Apr 2020 13:00:29 -0700 X-CMAE-Analysis: v=2.3 cv=Ss3uF8G0 c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=0XtbOteLAAAA:20 a=yMhMjlubAAAA:8 a=48vgC7mUAAAA:8 a=UqCG9HQmAAAA:8 a=Tsf3jjX8LXQbJRTiNJMA:9 a=cuvxsL9hyN1iop0U:21 a=ukBiDgXp0bV2DTKt:21 a=QEXdDO2ut3YA:10 a=Ny_Rmo-MNXIDDh9VRQUA:9 a=gEgq2_fvOLj8uCZ2:21 a=slfu47RjoJmxXjC_:21 a=IufDJO_ncAJ0Mr19:21 a=_W_S_7VecoQA:10 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_4798EA5E-881D-41B5-89DE-BAD71EBA5967" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 14 Apr 2020 13:00:28 -0700 In-Reply-To: Cc: "rats@ietf.org" To: Dave Thaler References: X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfCLSZdBoy7dOYipRhJMFf6HF576xvoTA6MNfc429JZTwDhzLSkH4HM6GM3K0hgKUug8rXvJmQjWwTO/UCquElmPjRgySEuumuZLzoiDrKWuaVOQM7ajs 6qn9RefAxMMUjkDjQmOHhJDME4ipq9lDjx9gV0VWDjCs9qzEetloyyfqw6w+Ef3b2wg+0b0sCwFGpfsK6FeicubHnICq8KEJxok= Archived-At: Subject: Re: [Rats] Claims Characteristics in EAT or in CWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Apr 2020 20:00:33 -0000 --Apple-Mail=_4798EA5E-881D-41B5-89DE-BAD71EBA5967 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I=E2=80=99ve update this PR = so it is just guidance for creating EAT claims (with suggestion that CWT = can use them too) and that EAT is not an update to the CWT RFC. Also, = some improved word smithing. I would like to merge it. To answer Ned=E2=80=99s question, the example in the EAT doc would look = like this, if we followed Jim=E2=80=99s proposal { / nonce / 9:h'948f8860d13a463e8e', / time stamp (iat) / 6:1526542894, / EAT sub-area / 10: { / UEID / = 1:h'0198f50a4ff6c05861c8860d13a638ea4fe2f', / secure-boot / 2:true, / debug-disbale / 3:3, / permanent-disable / } } =20 Claim with key / label 10 would be registered in the CWT registry and it = would be defined as a map that contains all the EAT claims. Note that I = have re used claim key / label 1, 2 and 3 above because it is a new EAT = space separate from CWT. LL > On Apr 13, 2020, at 3:20 PM, Dave Thaler = wrote: >=20 > One more point is that if someone adds an EAT claim now, and later = it=E2=80=99s found to need the same thing for a non-attestation use = case, > then you=E2=80=99d end up with an entry in both registries, or else = misusing a value out of an EAT registry for a non-EAT use case. > =20 > From: RATS On Behalf Of Laurence Lundblade > Sent: Monday, April 13, 2020 1:24 PM > To: rats@ietf.org > Subject: [Rats] Claims Characteristics in EAT or in CWT > =20 > Jim proposed that the EAT-defined claims would be put in their own EAT = sub-area of CWT > - They would have a separate IANA registry that could have separate = rules, particularly adding the guidelines from this PR = (which are just guidelines). > - Would occur in CWT=E2=80=99s in a special map defined to hold them. > - Separate label space > =20 > The main advantages of this is that EAT could have separate IANA = registration rules. There=E2=80=99s also a slight size advantage in that = the one-byte labels could be re used. > =20 > I don=E2=80=99t think this advantage is out weighed by these = disadvantages. > =20 > Confusion =E2=80=94 Both EAT-oriented use cases and CWT-oriented use = cases would likely use claims from both the CWT and EAT registries. Many = many claims are going to be generically useful. > =20 > More Confusion =E2=80=94 It is not particularly obvious to distant = implementors and users why these two levels exist and what the rules are = for using them. > =20 > Confusion Propagates =E2=80=94 Future use cases, say endorsements, = will inherit this split level because they will want to use claims from = both registries. > =20 > IANA cross checking required =E2=80=94 We would want experts to make = sure that a claim wasn=E2=80=99t defined in both places > =20 > Replicate for JWT =E2=80=94 We=E2=80=99d have to do the same = subsetting in JWT with a new EAT JWT registry. > =20 > More registries is not better =E2=80=94 Doesn=E2=80=99t seem = operationally efficient to add two more registries really similar to = ones we already have. Also, it is weird if very similar registries have = significantly different rules. > =20 > Loophole =E2=80=94 If someone doesn=E2=80=99t like the EAT rules, = they=E2=80=99ll just register a claim under the CWT rules. There=E2=80=99s= no way to prevent that. > =20 > Decode complexity =E2=80=94 It will make CWT and EAT decoder a little = more complex. It will also make encode more complex, but not of any = significance. > =20 > =20 > The path of least resistance here is to just put the claims = characteristics into the EAT document as a suggestion / recommendation. = There would be no formal imposition of these guidelines. They were never = meant as more than guidelines anyway. > =20 > Another option is to make EAT an update of CWT so it formally changes = and adjusts CWT. > =20 > Another option is to publish a separate update of CWT. > =20 > My plan is to proceed with the path of least resistance, putting them = in EAT as guidelines, unless there is support for more formal work on = CWT. > =20 > LL --Apple-Mail=_4798EA5E-881D-41B5-89DE-BAD71EBA5967 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
I=E2=80=99ve update this = PR so it is just guidance for creating EAT claims (with = suggestion that CWT can use them too) and that EAT is not an update to = the CWT RFC. Also, some improved word smithing. I would like to merge = it.

To answer = Ned=E2=80=99s question, the example in the EAT doc would look like this, = if we followed Jim=E2=80=99s proposal

{
   / nonce /           =        9:h'948f8860d13a463e8e',
   / time stamp (iat) /     =   6:1526542894,
   / = EAT sub-area /          10:
   {
       / UEID /       =           =  1:h'0198f50a4ff6c05861c8860d13a638ea4fe2f',
       / secure-boot /     =       2:true,
    =    / debug-disbale /         3:3,  / = permanent-disable  /
    = }
}
  =  
Claim with key / label 10 would be = registered in the CWT registry and it would be defined as a map that = contains all the EAT claims. Note that I have re used claim key / label = 1, 2 and 3 above because it is a new EAT space separate from = CWT.

LL

On Apr 13, 2020, at 3:20 PM, Dave Thaler <dthaler@microsoft.com> wrote:

One more point is that = if someone adds an EAT claim now, and later it=E2=80=99s found to need = the same thing for a non-attestation use case,
then = you=E2=80=99d end up with an entry in both registries, or else misusing = a value out of an EAT registry for a non-EAT use case.
 
From: RATS <rats-bounces@ietf.org> On Behalf = Of Laurence = Lundblade
Sent: Monday, April 13, 2020 1:24 = PM
To: rats@ietf.org
Subject: [Rats] Claims = Characteristics in EAT or in CWT
 
Jim proposed that the = EAT-defined claims would be put in their own EAT sub-area of CWT
- They would have a separate IANA registry that could = have separate rules, particularly adding the guidelines from this = PR  (which are just guidelines).
- Would occur in CWT=E2=80=99s in a special map = defined to hold them.
- Separate = label space
 
The main advantages of = this is that EAT could have separate IANA registration rules. There=E2=80=99= s also a slight size advantage in that the one-byte labels could be re = used.
 
I don=E2=80=99t think this advantage is = out weighed by these disadvantages.
 
Confusion =E2=80=94 Both EAT-oriented use = cases and CWT-oriented use cases would likely use claims from both the = CWT and EAT registries. Many many claims are going to be generically = useful.
 
More Confusion =E2=80=94 It is not = particularly obvious to distant implementors and users why these two = levels exist and what the rules are for using them.
 
Confusion Propagates =E2=80=94 Future use cases, = say endorsements, will inherit this split level because they will want = to use claims from both registries.
 
IANA cross checking = required =E2=80=94 = We would want experts to make sure that a claim wasn=E2=80=99t defined = in both places
 
Replicate for JWT =E2=80=94 We=E2=80=99d have = to do the same subsetting in JWT with a new EAT JWT registry.
 
More registries is not better =E2=80=94 Doesn=E2=80=99t = seem operationally efficient to add two more registries really similar = to ones we already have. Also, it is weird if very similar registries = have significantly different rules.
 
Loophole =E2=80=94 If someone doesn=E2=80=99t like = the EAT rules, they=E2=80=99ll just register a claim under the CWT = rules. There=E2=80=99s no way to prevent that.
 
Decode complexity =E2=80=94 It will make CWT = and EAT decoder a little more complex. It will also make encode more = complex, but not of any significance.
 
 
The path of least resistance here is to = just put the claims characteristics into the EAT document as a = suggestion / recommendation. There would be no formal imposition of = these guidelines. They were never meant as more than guidelines = anyway.
 
Another option is to make EAT an update = of CWT so it formally changes and adjusts CWT.
 
Another = option is to publish a separate update of CWT.
 
My plan is = to proceed with the path of least resistance, putting them in EAT as = guidelines, unless there is support for more formal work on CWT.
 
LL

= --Apple-Mail=_4798EA5E-881D-41B5-89DE-BAD71EBA5967-- From nobody Wed Apr 15 13:44:35 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A6343A0A59 for ; Wed, 15 Apr 2020 13:44:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mH8JLHWbxvJY for ; Wed, 15 Apr 2020 13:44:31 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F245E3A0A5A for ; Wed, 15 Apr 2020 13:44:30 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 8DCE73897C; Wed, 15 Apr 2020 16:42:47 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 6F90A602; Wed, 15 Apr 2020 16:44:29 -0400 (EDT) From: Michael Richardson To: Laurence Lundblade cc: rats@ietf.org In-Reply-To: References: X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 25.1.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] Claims Characteristics in EAT or in CWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Apr 2020 20:44:34 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Laurence Lundblade wrote: > I don=E2=80=99t think this advantage is out weighed by these disadvan= tages. > Confusion =E2=80=94 Both EAT-oriented use cases and CWT-oriented use = cases > would likely use claims from both the CWT and EAT registries. Many ma= ny > claims are going to be generically useful. I don't quite see the problem. First, I don't think that they will, once security considerations are taken into account, that this will happen as often as you think. *IF* they are generically useful, and the CWT rules work, then register the claim there. > More Confusion =E2=80=94 It is not particularly obvious to distant im= plementors > and users why these two levels exist and what the rules are for using > them. I agree: if people are unable to read the RFC, then they won't know. This happens in all sorts of place. I don't agree that it's a problem. I think you are making this much bigger an issue than it is. > The path of least resistance here is to just put the claims > characteristics into the EAT document as a suggestion / > recommendation. There would be no formal imposition of these > guidelines. They were never meant as more than guidelines anyway. I don't really know what "guidelines" means. Does this mean that you aren't going to register any claims? > Another option is to make EAT an update of CWT so it formally changes= and adjusts CWT. > Another option is to publish a separate update of CWT. I think that we've heard from COSE WG about this, and the suggestion is rea= sonable. > My plan is to proceed with the path of least resistance, putting them > in EAT as guidelines, unless there is support for more formal work on > CWT. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl6Xci0ACgkQgItw+93Q 3WXUoAf/cqAmqwBioMRdPlXm44Hw+IWOZmxrjL9BfJfro+B8w/HyHvpBxRA92Rbj sfwFPzLVfBcvdd4WtSW55Wyb0QU+DEiaoFKOeIrl3QWNcQ5SfEix2xK08N6GBsUS eZEiNsmu8Tt4wxFUGmywrJSypvgE22RM5aobnDdtg4pZtN3V7QZ7Aajdi9VneX6u LqBDsGtKSgxrkxMWseVEy39cRNflpbuauxq6t0RZz/6PvYOpFf0Hk8aA1txuUGrw 4VpffhZ0CIRtcRazvAVg4tjTFxNadrEpt09Cerasqr4rLKWYQjJU/8FALsEpmcho N4/wqCcD6mLdF7AUtZZvcdzW4pan0Q== =hTU1 -----END PGP SIGNATURE----- --=-=-=-- From nobody Sat Apr 18 20:02:19 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD5853A1707 for ; Sat, 18 Apr 2020 20:02:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xap_1vlXzp-j for ; Sat, 18 Apr 2020 20:02:17 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6DFD3A1706 for ; Sat, 18 Apr 2020 20:02:16 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 03J32C5B027929 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 18 Apr 2020 23:02:14 -0400 Date: Sat, 18 Apr 2020 20:02:11 -0700 From: Benjamin Kaduk To: Michael Richardson Cc: Laurence Lundblade , rats@ietf.org Message-ID: <20200419030211.GO69353@kduck.mit.edu> References: <30415.1586983469@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <30415.1586983469@localhost> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [Rats] Claims Characteristics in EAT or in CWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Apr 2020 03:02:18 -0000 On Wed, Apr 15, 2020 at 04:44:29PM -0400, Michael Richardson wrote: > > Laurence Lundblade wrote: > > > The path of least resistance here is to just put the claims > > characteristics into the EAT document as a suggestion / > > recommendation. There would be no formal imposition of these > > guidelines. They were never meant as more than guidelines anyway. > > I don't really know what "guidelines" means. > Does this mean that you aren't going to register any claims? > > > Another option is to make EAT an update of CWT so it formally changes and adjusts CWT. > > Another option is to publish a separate update of CWT. > > I think that we've heard from COSE WG about this, and the suggestion is reasonable. Sorry for having (presumably) missed the previous discussion, but what is the proposal that would require EAT to update CWT (vs. just allocating codepoints)? -Ben From nobody Mon Apr 20 09:04:34 2020 Return-Path: X-Original-To: rats@ietf.org Delivered-To: rats@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 853B83A0A5C; Mon, 20 Apr 2020 09:04:29 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: Cc: rats@ietf.org, ipr-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.127.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <158739866953.17020.11584476986044490471@ietfa.amsl.com> Date: Mon, 20 Apr 2020 09:04:29 -0700 Archived-At: Subject: [Rats] IPR Disclosure Huawei Technologies Co., Ltd's Statement about IPR related to draft-ietf-rats-architecture X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2020 16:04:30 -0000 Dear Henk Birkholz, Dave Thaler, Michael Richardson, Ned Smith, Wei Pan: An IPR disclosure that pertains to your Internet-Draft entitled "Remote Attestation Procedures Architecture" (draft-ietf-rats-architecture) was submitted to the IETF Secretariat on 2020-04-20 and has been posted on the "IETF Page of Intellectual Property Rights Disclosures" (https://datatracker.ietf.org/ipr/4106/). The title of the IPR disclosure is "Huawei Technologies Co.,Ltd's Statement about IPR related to draft-ietf-rats-architecture" Thank you IETF Secretariat From nobody Mon Apr 20 11:40:31 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DE6C3A0C1D for ; Mon, 20 Apr 2020 11:40:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.004 X-Spam-Level: X-Spam-Status: No, score=0.004 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gwDW84JhwYmP for ; Mon, 20 Apr 2020 11:40:27 -0700 (PDT) Received: from p3plsmtpa08-10.prod.phx3.secureserver.net (p3plsmtpa08-10.prod.phx3.secureserver.net [173.201.193.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8F0B3A0C03 for ; Mon, 20 Apr 2020 11:40:17 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id QbL5juQs9dRcMQbL6joLX7; Mon, 20 Apr 2020 11:40:16 -0700 X-CMAE-Analysis: v=2.3 cv=D4M51cZj c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=K6EGIJCdAAAA:8 a=0XtbOteLAAAA:20 a=USDS4BIA36sC5W_SQtgA:9 a=746lq3evYfz2fRHe:21 a=j8Cgw5eQ7BUoUPrF:21 a=QEXdDO2ut3YA:10 a=z5Q0h0Zo2XtWe4a2:21 a=bTz32MJe8D1-Jl0g:21 a=NgFsoCJIeisv1bD3:21 a=_W_S_7VecoQA:10 a=L6pVIi0Kn1GYQfi8-iRI:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: <7FCB91B0-3132-43B2-ABD1-1A9F6D1F26BF@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_D4EFD8B1-3039-4988-B76C-D0C00300E184" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 20 Apr 2020 11:40:15 -0700 In-Reply-To: <20200419030211.GO69353@kduck.mit.edu> Cc: Michael Richardson , rats@ietf.org To: Benjamin Kaduk References: <30415.1586983469@localhost> <20200419030211.GO69353@kduck.mit.edu> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfHZKuikUBEapMQH9a+360jLJNQ78TURXIjobHb74oztjM9teYEBrIWRO2xAK//laF2JNh79CRJcl/4k3LQz0ohv9DJhSoORrsZ/MQDGRbX+6tMl3DLib 0/8QFrbQo0G05v9bH8D/ZcX0derdmHXMuNDgUAJpsi5jzN2CCZZqwqna7ZLxQ4KCC1ET8jcq/UtZcxyErv26LOpViSX2qes6eLlEgGqekQLkKXdHp5nMR4gA Archived-At: Subject: Re: [Rats] Claims Characteristics in EAT or in CWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2020 18:40:30 -0000 --Apple-Mail=_D4EFD8B1-3039-4988-B76C-D0C00300E184 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Apr 18, 2020, at 8:02 PM, Benjamin Kaduk wrote: >=20 > On Wed, Apr 15, 2020 at 04:44:29PM -0400, Michael Richardson wrote: >>=20 >> Laurence Lundblade wrote: >>=20 >>> The path of least resistance here is to just put the claims >>> characteristics into the EAT document as a suggestion / >>> recommendation. There would be no formal imposition of these >>> guidelines. They were never meant as more than guidelines anyway. >>=20 >> I don't really know what "guidelines" means. >> Does this mean that you aren't going to register any claims? >>=20 >>> Another option is to make EAT an update of CWT so it formally = changes and adjusts CWT. >>> Another option is to publish a separate update of CWT. >>=20 >> I think that we've heard from COSE WG about this, and the suggestion = is reasonable. >=20 > Sorry for having (presumably) missed the previous discussion, but what = is > the proposal that would require EAT to update CWT (vs. just allocating > codepoints)? The thought is these claims characteristics = are just as applicable to = claims registered for CWT as they are to EAT. The update would be to add = them as guidance (not requirements) for the CWT registry. Perhaps during = expert review, the expert, based on the claims characteristics, would = ask things like =E2=80=9Cdid you consider adapting the already-standard = XXX format to CWT?=E2=80=9D or =E2=80=9Ccan you generalize this claim so = it is not just for Linux systems?" It=E2=80=99s clear that many claims defined in the registry will be = useful both for EAT and CWT. So far the iat, exp and cti claims defined = in CWT are used in EAT. I expect cnf claim to also be common. Going the = other way, I expect the nonce and location claims defined in EAT to be = useful in CWT.=20 I think having hard separation between EAT-use-case claims and = CWT-use-case claims is not a good thing. It will lead to the confusion I = previously mentioned and I can=E2=80=99t see where there is that much = benefit. So, since the claims are in common and share a registry, the claims = characteristics should be in common. Since there seems to be little appetite among CWT folks for an update = that makes these part of CWT, I=E2=80=99m current proposing this as soft = guidance in the EAT draft, but I=E2=80=99m also OK just dropping them = entirely. LL= --Apple-Mail=_D4EFD8B1-3039-4988-B76C-D0C00300E184 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On = Apr 18, 2020, at 8:02 PM, Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Wed, Apr 15, 2020 at 04:44:29PM -0400, Michael Richardson = wrote:

Laurence Lundblade <lgl@island-resort.com> wrote:

The path of least = resistance here is to just put the claims
characteristics = into the EAT document as a suggestion /
recommendation. = There would be no formal imposition of these
guidelines. = They were never meant as more than guidelines anyway.

I don't really know what = "guidelines" means.
Does this mean that you aren't going = to register any claims?

Another option is to make EAT an update of CWT = so it formally changes and adjusts CWT.
Another option is = to publish a separate update of CWT.

I think that we've heard from COSE WG about this, and the = suggestion is reasonable.

Sorry = for having (presumably) missed the previous discussion, but what is
the proposal that would require EAT to update CWT (vs. just = allocating
codepoints)?

The = thought is these claims = characteristics are just as applicable to claims registered for = CWT as they are to EAT. The update would be to add them as guidance (not = requirements) for the CWT registry. Perhaps during expert review, the = expert, based on the claims characteristics, would ask things like = =E2=80=9Cdid you consider adapting the already-standard XXX format to = CWT?=E2=80=9D or =E2=80=9Ccan you generalize this claim so it is not = just for Linux systems?"

It=E2=80=99s = clear that many claims defined in the registry will be useful both for = EAT and CWT. So far the iat, exp and cti claims defined in CWT are used = in EAT. I expect cnf claim to also be common. Going the other way, I = expect the nonce and location claims defined in EAT to be useful in = CWT. 

I think having hard = separation between EAT-use-case claims and CWT-use-case claims is not a = good thing. It will lead to the confusion I previously mentioned and I = can=E2=80=99t see where there is that much benefit.

So, since the claims are in common and share a = registry, the claims characteristics should be in common.

Since there seems to be little appetite among CWT = folks for an update that makes these part of CWT, I=E2=80=99m current = proposing this as soft guidance in the EAT draft, but I=E2=80=99m also = OK just dropping them entirely.

LL
= --Apple-Mail=_D4EFD8B1-3039-4988-B76C-D0C00300E184-- From nobody Mon Apr 20 12:47:56 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 69B023A0E43 for ; Mon, 20 Apr 2020 12:47:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.2 X-Spam-Level: X-Spam-Status: No, score=-0.2 tagged_above=-999 required=5 tests=[DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JOMqTwx-sJDw for ; Mon, 20 Apr 2020 12:47:51 -0700 (PDT) Received: from out-21.smtp.github.com (out-21.smtp.github.com [192.30.252.204]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58E363A0E37 for ; Mon, 20 Apr 2020 12:47:51 -0700 (PDT) Received: from github-lowworker-5fb2734.va3-iad.github.net (github-lowworker-5fb2734.va3-iad.github.net [10.48.19.27]) by smtp.github.com (Postfix) with ESMTP id 726DFA0A8F for ; Mon, 20 Apr 2020 12:47:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1587412070; bh=BeWQixNbDFX6ah++OybXUsD1f439yj0XcMPH1Y4Rpjc=; h=Date:From:To:Subject:From; b=UVqrhSp5CNooL7HgBKtQ/J51F1wjP2O5NLIEpt0VGzLIMTQ10O/35X257bjjVPkcP uOfch5XH09HVFjxmdhmb69NDc3xlReZqTxOHSWx7L07JI5ZS029ipdPBpCCdV5O6YO tO6uJWnv4QboXJOyKtNTYbKIj2OuoiVzxQzyHZbc= Date: Mon, 20 Apr 2020 12:47:50 -0700 From: Laurence Lundblade To: rats@ietf.org Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-GitHub-Recipient-Address: rats@ietf.org X-Auto-Response-Suppress: All Archived-At: Subject: [Rats] [ietf-rats-wg/eat] b4e93a: Disallow floating-point dates X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2020 19:47:55 -0000 Branch: refs/heads/no-float Home: https://github.com/ietf-rats-wg/eat Commit: b4e93a6884d70775e676ec7e93de2b2167102b1b https://github.com/ietf-rats-wg/eat/commit/b4e93a6884d70775e676ec7e93de2b2167102b1b Author: Laurence Lundblade Date: 2020-04-20 (Mon, 20 Apr 2020) Changed paths: M draft-ietf-rats-eat.md Log Message: ----------- Disallow floating-point dates From nobody Mon Apr 20 12:48:25 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A5EB3A0DFF for ; Mon, 20 Apr 2020 12:48:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.201 X-Spam-Level: X-Spam-Status: No, score=-0.201 tagged_above=-999 required=5 tests=[DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DeZf81_0GCTt for ; Mon, 20 Apr 2020 12:48:21 -0700 (PDT) Received: from out-21.smtp.github.com (out-21.smtp.github.com [192.30.252.204]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44EB73A0DFB for ; Mon, 20 Apr 2020 12:48:21 -0700 (PDT) Received: from github-lowworker-ca5950c.va3-iad.github.net (github-lowworker-ca5950c.va3-iad.github.net [10.48.17.57]) by smtp.github.com (Postfix) with ESMTP id 97309A116E for ; Mon, 20 Apr 2020 12:48:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1587412100; bh=JwjzDCHP6idG/t79P3OTyQwZl6oIw52xrFOCes2x6Bc=; h=Date:From:To:Subject:From; b=TAPetMw2Ifjm4x1gkK2rOtSgHM7IslNoZzlycuCHr9sQYEhvYR1NXOQK1UhcTmRyj egptEfJd7hDwrBzxGXrW528HuGh1Yo5zvovhFVtQnbmUcfraZckaCf+jpy368JHLXB 1zI95FctKZsvkfhFR9h1afm90XXTxNsveEDZarOE= Date: Mon, 20 Apr 2020 12:48:20 -0700 From: Henk Birkholz To: rats@ietf.org Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-GitHub-Recipient-Address: rats@ietf.org X-Auto-Response-Suppress: All Archived-At: Subject: [Rats] [ietf-rats-wg/eat] cfa901: Script updating gh-pages from b4e93a6. [ci skip] X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2020 19:48:23 -0000 Branch: refs/heads/gh-pages Home: https://github.com/ietf-rats-wg/eat Commit: cfa901614ce3d293c75f9214ac9c3d68eab663df https://github.com/ietf-rats-wg/eat/commit/cfa901614ce3d293c75f9214ac9c3d68eab663df Author: ID Bot Date: 2020-04-20 (Mon, 20 Apr 2020) Changed paths: M index.html A no-float/draft-ietf-rats-eat.html A no-float/draft-ietf-rats-eat.txt A no-float/index.html R update_debug_claim/draft-ietf-rats-eat.html R update_debug_claim/draft-ietf-rats-eat.txt R update_debug_claim/index.html Log Message: ----------- Script updating gh-pages from b4e93a6. [ci skip] From nobody Mon Apr 20 12:53:19 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 844B23A0E4B for ; Mon, 20 Apr 2020 12:53:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.005 X-Spam-Level: X-Spam-Status: No, score=0.005 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4ARaJy7rkiiv for ; Mon, 20 Apr 2020 12:53:06 -0700 (PDT) Received: from p3plsmtpa08-07.prod.phx3.secureserver.net (p3plsmtpa08-07.prod.phx3.secureserver.net [173.201.193.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 638533A0E49 for ; Mon, 20 Apr 2020 12:53:06 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id QcTZjPLf9Xm0PQcTZjo04j; Mon, 20 Apr 2020 12:53:05 -0700 X-CMAE-Analysis: v=2.3 cv=bM9o382Z c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=0XtbOteLAAAA:20 a=NKLwhBbdih843Hg1d2wA:9 a=QEXdDO2ut3YA:10 a=WJoNILsGWAdo90LZ1FsA:9 a=F37CBUQAl_dYFTyd:21 a=_W_S_7VecoQA:10 a=WQnItmPV2fbdzLaCP6-h:22 a=ApmT8IYWVU_m-XHnEi-O:22 a=p-dnK0njbqwfn1k4-x12:22 a=jjky5lfK57Ii_Ajn6BuG:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_D031E27C-DD45-4D29-BD99-8C8AD109DA46" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: Date: Mon, 20 Apr 2020 12:53:05 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfLqRWj/O1/kxXZ3FKhuJPNK4CrI8dfws2S4AcVmxrlDpWcpgdfz89QeTrVQxwPpuQSdGCPeZBiekQQ4NXKJaPDpdGTosDHoLV5esR+Apd7GBGhd+xB6Y T1Oha1sVaXHYdubn8tqo0qjGQjwAZ0MxMcS6j8PPfv4V5vVvMJPt68Kd Archived-At: Subject: [Rats] Disallowing floating-point dates in EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2020 19:53:18 -0000 --Apple-Mail=_D031E27C-DD45-4D29-BD99-8C8AD109DA46 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here=E2=80=99s a PR that = disallows floating-point dates in EAT. 64-bit integer epoch dates give = you a range of +/- 500 billion years so there=E2=80=99s no need for = floating-point for range. Also, there=E2=80=99s no need for fractional = seconds in EAT. If floating-point dates are allowed, then technically speaking, = Verifiers must support floating-point for interoperability. CWT still allows floating-point. LL --Apple-Mail=_D031E27C-DD45-4D29-BD99-8C8AD109DA46 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Here=E2=80=99s a PR that disallows floating-point dates in EAT. =  64-bit integer epoch dates give you a range of +/- 500 billion = years so there=E2=80=99s no need for floating-point for range. Also, = there=E2=80=99s no need for fractional seconds in EAT.

If floating-point dates = are allowed, then technically speaking, Verifiers must support = floating-point for interoperability.

CWT still allows = floating-point.

LL

= --Apple-Mail=_D031E27C-DD45-4D29-BD99-8C8AD109DA46-- From nobody Mon Apr 20 13:01:14 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3D0F3A0EAC for ; Mon, 20 Apr 2020 13:01:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.197 X-Spam-Level: X-Spam-Status: No, score=-0.197 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 272zZt-yWdgU for ; Mon, 20 Apr 2020 13:01:06 -0700 (PDT) Received: from mail-vs1-xe2c.google.com (mail-vs1-xe2c.google.com [IPv6:2607:f8b0:4864:20::e2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 725E93A0EAA for ; Mon, 20 Apr 2020 13:01:06 -0700 (PDT) Received: by mail-vs1-xe2c.google.com with SMTP id 184so6908505vsu.3 for ; Mon, 20 Apr 2020 13:01:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Qzxx6dHxxbL3g1+/B7oE5Bnx0EakX53YD30qoc2td9k=; b=Atc/eZz4YwOV9IlmQzXQZQ8jpyJmG8BAMGSk8A6LWMVHm+KAJaDkLg731wsSEXNrpL c6xL90Os9HIdGZH1hXx3i7UEo1UVtCZZyqFjUdlcCOz1jQjGkMAsy99S8agQH+nrtqvk Ye/PIV0e4HkTOC3aC51M6hJTVpGT4rzP+frDzYl5VPDkeCGrXLae3/t+ND1ihl0g8dNI l1B3lXpsiJOlREnmShCoyKJ7Xb810OKZmaET8ZHBS1WnCR1eRcfuTyxb/sycwgqIfTBP nHq3vT8sg3FdoWqMf/LvuFWtVNFDx5rMK/zFZnpXAGIIJbGOq4ZMrbzTWT1txW3xtoyD voBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Qzxx6dHxxbL3g1+/B7oE5Bnx0EakX53YD30qoc2td9k=; b=n7vhJra6nDq5zl56O+1jNwhpYBPSsexnl/16afB0T4qNxtHvZWP+aA5NUfgA0hZWZS XjECTKDrkztZ5Dn5on1viCngvSEwdtcyN0b1gDGxenqQZh2wy0yNak+5+1f3vTKUagBG stKR2PFxRx80MlAF1Yfl7dj4oP2IshSsiMVXyCwBi4QlQr6X8tFayVoZtrek/5vJMABQ 4iI+MT9Wgy9eMDd4hH6VAYuky60EVJx66THId1d7EsxIQ/rwllhRkITemdf6BfmKvyxu dT6xUTxmy5LhHybhvgFRztzdN7r6m3iy/stkQ1vr6qlsqlB1Oc6oogLRp6s/EwuD+zTg gphw== X-Gm-Message-State: AGi0PuZS9K16YN4E0bRT42rCiZA/3zcQQDM9AOCRLZVZGWBhlrzSaiRa eGuw9Ibu+zz1qj5lmCGx7SvX4jL1Yb+vCGXeBPw= X-Google-Smtp-Source: APiQypLTIYWlthc/IDoeqCxV1libRQK7EhanOgr1BvIH9Gbog4zABfUl63GrFbjJ0EtuO+jqPJawlQYYvHHNw8YAuR4= X-Received: by 2002:a67:a20f:: with SMTP id l15mr13145268vse.40.1587412865344; Mon, 20 Apr 2020 13:01:05 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ira McDonald Date: Mon, 20 Apr 2020 16:00:52 -0400 Message-ID: To: Laurence Lundblade , Ira McDonald Cc: rats@ietf.org Content-Type: multipart/alternative; boundary="000000000000f3692905a3be5b8b" Archived-At: Subject: Re: [Rats] Disallowing floating-point dates in EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2020 20:01:12 -0000 --000000000000f3692905a3be5b8b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable +1 On Mon, Apr 20, 2020 at 3:53 PM Laurence Lundblade wrote: > Here=E2=80=99s a PR that di= sallows > floating-point dates in EAT. 64-bit integer epoch dates give you a range > of +/- 500 billion years so there=E2=80=99s no need for floating-point fo= r range. > Also, there=E2=80=99s no need for fractional seconds in EAT. > > If floating-point dates are allowed, then technically speaking, Verifiers > must support floating-point for interoperability. > > CWT still allows floating-point. > > LL > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > --000000000000f3692905a3be5b8b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
+1

On Mon, Apr 20, 2020 at 3:53 PM Laurence Lundblade &= lt;lgl@island-resort.com> w= rote:
Here=E2=80=99s a=C2=A0PR=C2=A0that disal= lows floating-point dates in EAT. =C2=A064-bit integer epoch dates give you= a range of +/- 500 billion years so there=E2=80=99s no need for floating-p= oint for range. Also, there=E2=80=99s no need for fractional seconds in EAT= .

If floating-point dates are allowed, then technic= ally speaking, Verifiers must support floating-point for interoperability.<= /div>

CWT still allows floating-point.

LL

________________________________= _______________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats
--000000000000f3692905a3be5b8b-- From nobody Tue Apr 21 01:10:01 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4AB1F3A0844 for ; Tue, 21 Apr 2020 01:09:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.098 X-Spam-Level: X-Spam-Status: No, score=-0.098 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=qti.qualcomm.com header.b=Vy/Ib69/; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=qualcomm.onmicrosoft.com header.b=WkyvjFKh Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VD7IUFO7GESC for ; Tue, 21 Apr 2020 01:09:57 -0700 (PDT) Received: from alexa-out-sd-01.qualcomm.com (alexa-out-sd-01.qualcomm.com [199.106.114.38]) (using TLSv1.2 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63CCB3A0842 for ; Tue, 21 Apr 2020 01:09:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qti.qualcomm.com; i=@qti.qualcomm.com; q=dns/txt; s=qcdkim; t=1587456597; x=1618992597; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=z/BKb1Ufjs1TSKTVDgqA2XgFIi2ojeUJ7AexibVx6zc=; b=Vy/Ib69/Pdh3oHDTQWPXcNw08KHcFXMBItWDDL1rLWlHfxf9YE7Hlwfg g4YoEa/09mXw2lVUZONRogGKx4DYafj1cWxXb9F4reWDD/PRJ/FJhZYvE 11zZFVXGuB3OIGwZAOKwRUSnCV/P0f2ZsI3IY5kyo/vnzJH6CiRVTrJcW Q=; Received: from unknown (HELO ironmsg03-sd.qualcomm.com) ([10.53.140.143]) by alexa-out-sd-01.qualcomm.com with ESMTP; 21 Apr 2020 01:09:56 -0700 Received: from nasanexm01b.na.qualcomm.com ([10.85.0.82]) by ironmsg03-sd.qualcomm.com with ESMTP/TLS/AES256-SHA; 21 Apr 2020 01:09:56 -0700 Received: from nasanexm03a.na.qualcomm.com (10.85.0.103) by NASANEXM01B.na.qualcomm.com (10.85.0.82) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 21 Apr 2020 01:09:56 -0700 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (199.106.107.6) by nasanexm03a.na.qualcomm.com (10.85.0.103) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Tue, 21 Apr 2020 01:09:56 -0700 Received: from CY4PR0201MB3588.namprd02.prod.outlook.com (2603:10b6:910:93::25) by CY4PR0201MB3571.namprd02.prod.outlook.com (2603:10b6:910:95::38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2921.29; Tue, 21 Apr 2020 08:09:55 +0000 Received: from CY4PR0201MB3588.namprd02.prod.outlook.com ([fe80::dcbe:227c:736f:ada2]) by CY4PR0201MB3588.namprd02.prod.outlook.com ([fe80::dcbe:227c:736f:ada2%4]) with mapi id 15.20.2921.030; Tue, 21 Apr 2020 08:09:55 +0000 From: Jeremy O'Donoghue To: Ira McDonald , Laurence Lundblade CC: "rats@ietf.org" Thread-Topic: [Rats] Disallowing floating-point dates in EAT Thread-Index: AQHWF01rNbHy/YCk+0qoofDREZ9G5KiCbi4AgADcdAA= Date: Tue, 21 Apr 2020 08:09:55 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: spf=none (sender IP is ) smtp.mailfrom=jodonogh@qti.qualcomm.com; x-originating-ip: [86.183.189.76] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e8cf0f1d-d8aa-40a1-5553-08d7e5cb606a x-ms-traffictypediagnostic: CY4PR0201MB3571: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:1079; x-forefront-prvs: 038002787A x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CY4PR0201MB3588.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(366004)(396003)(376002)(136003)(346002)(39860400002)(186003)(33656002)(66946007)(4744005)(64756008)(66556008)(8936002)(2616005)(6512007)(81156014)(26005)(91956017)(5660300002)(2906002)(6506007)(86362001)(53546011)(66476007)(66446008)(71200400001)(6486002)(110136005)(966005)(8676002)(316002)(4326008)(76116006)(478600001); DIR:OUT; SFP:1102; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Dzm/Pp3x898h88tdoHBbI1s7eXXnJ6WF3NsMD2Mc+E6vmWdQ5toMKq2g4OvvFtIDdVUgsX2xoTOoYT9j30Q4MHK+qi5x44PH9DXRNvv/gVXD6qQpO+qCG8QuvQhQUOBFY49izn1oY5QBZuJC3gMOlaG1r9JXxyLzgPnJ2HheEd5EMJX3E9R35nwCEfo7XVjuBY42cGCbXUMtFwQMmBI8nIo7JV98zDyHcj4s+i0D/0mq/GDLmSyCg2NKvh+v+FtpsR03vYYEnnL4BvWBUHmdAO4xvxsUlQh8xkTBTymag6wwIC5xNOLZii49lD7ID14xXGcmkF+FovWmYwwed+87SlXq5Cw+79/3RvvtKM4KSiYjY0nyB/FTSanTujtst8SAEruePQaJJB3B0jnDeu/zwq2H/xd9D6xl+LMF664nj4rPsFQjvzgbUQf/KuoTVGoXUKDfJF2KA4/6Aaeet3Tucc+eeVaX0FA1++wEeNQzHXJqJCB0khHsASH0AdidnhKEpDK0CSYmf5ubJgLaaLwxMw== x-ms-exchange-antispam-messagedata: mM0CkAB59EsOmypfDFOsNu3bxF6bfURpSagWlpfrIfYbGXCqBjDkXyCy9Nk/OKG8x/1nlOigZ4VFGFNyToGGhjV88M5cHGm9HTJU8a/d6gGtYu37f8hJZjfZFHVKAixsJhp7mxWs+4h+LYdHv6xTfQ== x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=E8Toy5G3+9+IXqzvpDD1OIhqEoKd6k5d0dwXjBCkzvCrANGndh6u1vY2IGRWCa7AaqzBxZNa0ELhhycgMrzSp1HgwU+40GkMzMJdMXR0XbiJWmeqN6YGlYQuB/BCmjxoVlki18EJvLTmFKnn8YmH/BZdLNRhN2Z45cj/cU9dwcNJaNkmyczq8vPD+ldxVDq2M+dFKG7oydmC28cXBjYEFKTzeRChyKCRsk7Mru/SrZIcLu8OU96Mwn5Ce9z0nyCItRyhB7OjjSmjRL6ZJptqtvOnIlQkfjLfD1IIk+dtn0L/IWVn3qMp8l5tW3f9c+aEOfGyq9ufOJFLMBslw5pYPw== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0lnor+81uxbWNxVrUUWuuuV/MoF/W8qc1fpsIpTEyFY=; b=ejBvOLWqpYTkUmYRZwkphueD9uiJ1Rbe72P3LSdfk5Q/B90yzGMxSraFQu3KUczl+PalICD+Sgw3/fdnzjOoJQR2ouxwKtpyqRhdxJNIcrB88m9fEXcvw/DEzAjbKqMJWPwn9iDwPhbLqU4+36XWoT3DEFUtEpHKbjgX9so3r494vsB206hWoTe6Xl+W9hyqOGqBxfMwQs2VuNtU/sux8tBgxMEBsddjcVisBC95vuTh8ITy+d7xPp/PmvSPj6T0fjSNc85K9+C1o3DWKdcRSWelT/j/SV3rUeBB0KexVRZ8+JzTOLW7qyqBCafC7HgFhhMzuS8VedBp4yzk/GlplA== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=qti.qualcomm.com; dmarc=pass action=none header.from=qti.qualcomm.com; dkim=pass header.d=qti.qualcomm.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.onmicrosoft.com; s=selector1-qualcomm-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0lnor+81uxbWNxVrUUWuuuV/MoF/W8qc1fpsIpTEyFY=; b=WkyvjFKhJMIZ08MD3db1NDx1qnu+brmEuLHpsU0aKx2mc/mEolE9LlrKMSkure7qG1PzeJCL4UnqF1T+E0PL4mj7kDozdC40ZG7zG17zAyctxpD9cR4odcvAqq81TUUV2oYOs3ySeWdQXL7Dop7xVVjhiZQXJoF4G2NEiU2Lb7Q= x-ms-exchange-crosstenant-network-message-id: e8cf0f1d-d8aa-40a1-5553-08d7e5cb606a x-ms-exchange-crosstenant-originalarrivaltime: 21 Apr 2020 08:09:55.4617 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 98e9ba89-e1a1-4e38-9007-8bdabc25de1d x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: frAs0h60pO7T90nvjJ+N4ZpQkKxF8QOIzSK1QqtA4QmKBpJKR1BVEn+ZGr8UPakBjjxruuibx2fjGRtF5XIzoW58v3MKZOE6z1b3o1o/yf0= x-ms-exchange-transport-crosstenantheadersstamped: CY4PR0201MB3571 x-originatororg: qti.qualcomm.com Content-Type: multipart/alternative; boundary="_000_B94D870D875649E78E48F4CCE28CF7AAqtiqualcommcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Disallowing floating-point dates in EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Apr 2020 08:10:00 -0000 --_000_B94D870D875649E78E48F4CCE28CF7AAqtiqualcommcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 KzEg4oCTIHNpZ25pZmljYW50IHJlZHVjdGlvbiBpbiBpbXBsZW1lbnRhdGlvbiBjb21wbGV4aXR5 IGZvciBubyBsb3NzIG9mIG1lYW5pbmdmdWwgZnVuY3Rpb25hbGl0eS4NCg0KSmVyZW15DQoNCk9u IDIwLzA0LzIwMjAsIDIxOjAxLCAiUkFUUyBvbiBiZWhhbGYgb2YgSXJhIE1jRG9uYWxkIiA8cmF0 cy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFs ZiBvZiBibHVlcm9vZm11c2ljQGdtYWlsLmNvbTxtYWlsdG86Ymx1ZXJvb2ZtdXNpY0BnbWFpbC5j b20+PiB3cm90ZToNCg0KDQpDQVVUSU9OOiBUaGlzIGVtYWlsIG9yaWdpbmF0ZWQgZnJvbSBvdXRz aWRlIG9mIHRoZSBvcmdhbml6YXRpb24uDQorMQ0KDQpPbiBNb24sIEFwciAyMCwgMjAyMCBhdCAz OjUzIFBNIExhdXJlbmNlIEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzps Z2xAaXNsYW5kLXJlc29ydC5jb20+PiB3cm90ZToNCkhlcmXigJlzIGEgUFI8aHR0cHM6Ly9naXRo dWIuY29tL2lldGYtcmF0cy13Zy9lYXQvcHVsbC82MT4gdGhhdCBkaXNhbGxvd3MgZmxvYXRpbmct cG9pbnQgZGF0ZXMgaW4gRUFULiAgNjQtYml0IGludGVnZXIgZXBvY2ggZGF0ZXMgZ2l2ZSB5b3Ug YSByYW5nZSBvZiArLy0gNTAwIGJpbGxpb24geWVhcnMgc28gdGhlcmXigJlzIG5vIG5lZWQgZm9y IGZsb2F0aW5nLXBvaW50IGZvciByYW5nZS4gQWxzbywgdGhlcmXigJlzIG5vIG5lZWQgZm9yIGZy YWN0aW9uYWwgc2Vjb25kcyBpbiBFQVQuLg0KDQpJZiBmbG9hdGluZy1wb2ludCBkYXRlcyBhcmUg YWxsb3dlZCwgdGhlbiB0ZWNobmljYWxseSBzcGVha2luZywgVmVyaWZpZXJzIG11c3Qgc3VwcG9y dCBmbG9hdGluZy1wb2ludCBmb3IgaW50ZXJvcGVyYWJpbGl0eS4NCg0KQ1dUIHN0aWxsIGFsbG93 cyBmbG9hdGluZy1wb2ludC4NCg0KTEwNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NClJBVFMgbWFpbGluZyBsaXN0DQpSQVRTQGlldGYub3JnPG1haWx0 bzpSQVRTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9y YXRzDQo= --_000_B94D870D875649E78E48F4CCE28CF7AAqtiqualcommcom_ Content-Type: text/html; charset="utf-8" Content-ID: <0CCF56DF905D0F4FBF585EF9C95FDF6C@namprd02.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29D aHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4w cHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdp bjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdl OldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0Ii IGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+JiM0MzsxIOKAkyBzaWduaWZpY2FudCByZWR1Y3Rpb24gaW4gaW1wbGVtZW50YXRpb24g Y29tcGxleGl0eSBmb3Igbm8gbG9zcyBvZiBtZWFuaW5nZnVsIGZ1bmN0aW9uYWxpdHkuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1m YXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PkplcmVteTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij5PbiAyMC8wNC8yMDIwLCAyMTowMSwgJnF1b3Q7UkFUUyBvbiBiZWhhbGYg b2YgSXJhIE1jRG9uYWxkJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86cmF0cy1ib3VuY2VzQGll dGYub3JnIj5yYXRzLWJvdW5jZXNAaWV0Zi5vcmc8L2E+IG9uIGJlaGFsZiBvZg0KPGEgaHJlZj0i bWFpbHRvOmJsdWVyb29mbXVzaWNAZ21haWwuY29tIj5ibHVlcm9vZm11c2ljQGdtYWlsLmNvbTwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHN0cm9uZz48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDojRkZFQjlDIj5DQVVUSU9OPC9zcGFu Pjwvc3Ryb25nPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjaztiYWNrZ3JvdW5kOiNGRkVCOUMiPjog VGhpcyBlbWFpbA0KIG9yaWdpbmF0ZWQgZnJvbSBvdXRzaWRlIG9mIHRoZSBvcmdhbml6YXRpb24u PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPiYjNDM7MTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+T24gTW9uLCBBcHIgMjAsIDIwMjAgYXQgMzo1MyBQTSBMYXVyZW5jZSBM dW5kYmxhZGUgJmx0OzxhIGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPmxnbEBp c2xhbmQtcmVzb3J0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAx LjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1y aWdodDowY20iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPkhlcmXigJlzIGEmbmJzcDs8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vaWV0 Zi1yYXRzLXdnL2VhdC9wdWxsLzYxIiB0YXJnZXQ9Il9ibGFuayI+UFI8L2E+Jm5ic3A7dGhhdCBk aXNhbGxvd3MgZmxvYXRpbmctcG9pbnQgZGF0ZXMgaW4gRUFULiAmbmJzcDs2NC1iaXQgaW50ZWdl ciBlcG9jaCBkYXRlcyBnaXZlIHlvdSBhIHJhbmdlIG9mICYjNDM7Ly0gNTAwIGJpbGxpb24geWVh cnMgc28gdGhlcmXigJlzDQogbm8gbmVlZCBmb3IgZmxvYXRpbmctcG9pbnQgZm9yIHJhbmdlLiBB bHNvLCB0aGVyZeKAmXMgbm8gbmVlZCBmb3IgZnJhY3Rpb25hbCBzZWNvbmRzIGluIEVBVC4uDQo8 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5JZiBmbG9h dGluZy1wb2ludCBkYXRlcyBhcmUgYWxsb3dlZCwgdGhlbiB0ZWNobmljYWxseSBzcGVha2luZywg VmVyaWZpZXJzIG11c3Qgc3VwcG9ydCBmbG9hdGluZy1wb2ludCBmb3IgaW50ZXJvcGVyYWJpbGl0 eS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Q1dU IHN0aWxsIGFsbG93cyBmbG9hdGluZy1wb2ludC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+X19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX188YnI+DQpSQVRTIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9 Im1haWx0bzpSQVRTQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+UkFUU0BpZXRmLm9yZzwvYT48 YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3JhdHMi IHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Jh dHM8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_B94D870D875649E78E48F4CCE28CF7AAqtiqualcommcom_-- From nobody Tue Apr 21 05:58:55 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 183A33A0BA1 for ; Tue, 21 Apr 2020 05:58:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uxu8ZtB8YQnv for ; Tue, 21 Apr 2020 05:58:50 -0700 (PDT) Received: from mail-wm1-x334.google.com (mail-wm1-x334.google.com [IPv6:2a00:1450:4864:20::334]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7A953A0BA0 for ; Tue, 21 Apr 2020 05:58:49 -0700 (PDT) Received: by mail-wm1-x334.google.com with SMTP id t63so3442974wmt.3 for ; Tue, 21 Apr 2020 05:58:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:from:to:references:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=bnYZ8E9RZHmFngcV3bpKnbpjGnVLEgYh43O8nQxyKhg=; b=kzrxR8TapJ0PmgCLwiJZd/Sp7CfLFS5xmqyXS7sf1qP3lbtgtc8cm9GM5ijDCSyxIt +b8JRwqjGQnZAEysWMv5rxUnyFmK7UHggFoInFLsGVG5vRiOW0061sHTkxZsuuXLlkoV gOlw2FQa4r4WouDj4I1Xj07VL1N/oJoBzzU+K15ZzNS7wSLDiHq8b9GaA2R3aRkevkTc jponTYhCKnly0zQM7XtAQJuRNNIKuKC5j56C6siDF7nJMSRSUNQc62Cj2qJK/S392VbI Z9NUtheSN65SWTPHIQ1SVsqGPERC6JnmpO7QUJ9vtnjeWN2Dy4+NRyq9QjEIWHhITEGD MDDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:references:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=bnYZ8E9RZHmFngcV3bpKnbpjGnVLEgYh43O8nQxyKhg=; b=AdjsyiWiYR8nDxlXV2S843WAkyzRuLfQyk3amDIoHgNZkMmmmpfgKwtiRRUXuvR7jh MY9kwngaoIxOika9KBubHugboPId1itEMRQcfQ+xPcPTRnGuUHl0yaPi3autkVePbK4p y1S8WWn/b0JEqHy0fAiqKn5r4RdunjmitMB7z/E+7FMxWLn5MVodWGQQqKgWx97Ko28y NSUD1fT1yK6dAq/z1hJM/2Az8qzZqkyPdVyd1hhF7Zk4/0wOmgCJqiJ+9YSobxiDmaQZ hZg/in9Lmbu5gZD8wcyIbwW2uvAfVWjuLEXId82CvXbOd4dvQKHxkQqMkzCzST+GDpQe NO0A== X-Gm-Message-State: AGi0PubrXYC9QfnK//bkXMtYx5U+y3oIi5J97olstX9yuIwEX4BrjEcO 1zmg1gFEWcGOKkGmMGOKmXAdK9NKiAc= X-Google-Smtp-Source: APiQypKdbPvqZ0CVp+7+0Yo8nA/rlPJMhT2xxy2oi7/C++gykaqYAaF6uq2MhQbDyj9INnWVStHi1w== X-Received: by 2002:a1c:4042:: with SMTP id n63mr4738460wma.27.1587473928048; Tue, 21 Apr 2020 05:58:48 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id l6sm3655651wrb.75.2020.04.21.05.58.47 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 21 Apr 2020 05:58:47 -0700 (PDT) From: Anders Rundgren To: "rats@ietf.org" References: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> Message-ID: Date: Tue, 21 Apr 2020 14:58:45 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 MIME-Version: 1.0 In-Reply-To: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Rats] Dealing with Attestation Roots X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Apr 2020 12:58:53 -0000 Any takers out there? I could consider writing an I-D. /Anders On 2020-02-27 18:51, Anders Rundgren wrote: > Hi List, > In the https://cyberphone.github.io/openbankingwallet project the idea was to use attestations.  The most recent version of the Android app indeed supports this as well. > > In an ideal world the root would be provided by Google.  However, since we don't live in an ideal world there are vendors out there who do not follow that "recipe". > > For W3C's PaymentRequest API a simpler solution is used which do not match attestations but is better than nothing.  This scheme builds on publishing a manifest associated with the app.  Here is my particular manifest:  https://mobilepki.org/w3cpay/method > > But I still would like to use attestations and also not being tied to browsers. > > What about making attestations optionally contain a URL to the root like https://huawei.com/teeroot ? > Since the number of vendors in finite and the Web-PKI is in a fairly good shape these days, this could serve as a workaround for those who don't have any number of cycles to spend on installing arbitrary tee root certificates.  That is, a verifier's "trust registry" would simply hold host names like "huawei.com", "sony.com", "samsung.com", etc. > > If there is a better method, I'm all ears! > > thanx, > Anders > From nobody Tue Apr 21 09:09:52 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB1D93A0D61 for ; Tue, 21 Apr 2020 09:09:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.894 X-Spam-Level: X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2eBRdN5UIp4p for ; Tue, 21 Apr 2020 09:09:44 -0700 (PDT) Received: from p3plsmtpa07-06.prod.phx3.secureserver.net (p3plsmtpa07-06.prod.phx3.secureserver.net [173.201.192.235]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C82F3A0D6A for ; Tue, 21 Apr 2020 09:09:37 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id QvQfjZ4Pn4NFGQvQgjCxdo; Tue, 21 Apr 2020 09:07:22 -0700 X-CMAE-Analysis: v=2.3 cv=EPx4LGRC c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=0XtbOteLAAAA:20 a=K6EGIJCdAAAA:8 a=gKmFwSsBAAAA:8 a=QyXUC8HyAAAA:8 a=48vgC7mUAAAA:8 a=WMtHHQaCRWcHGEDLbcIA:9 a=QEXdDO2ut3YA:10 a=UcTN6IUWVUINGMuQfjEA:9 a=4RQ5A1VLkLRPNQEQ:21 a=_W_S_7VecoQA:10 a=L6pVIi0Kn1GYQfi8-iRI:22 a=nnPW6aIcBuj1ljLj_o6Q:22 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_F9907CDF-6DAB-451F-93E9-2F24DC401FDA" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 21 Apr 2020 09:07:21 -0700 In-Reply-To: <3F7E9A70-18BE-454C-A5EB-F07A1EDFE7DC@island-resort.com> Cc: "Smith, Ned" , Henk Birkholz , "rats@ietf.org" , Jim Schaad , "cbor@ietf.org" , Ace Wg To: Carsten Bormann References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> <01ae01d5f3eb$4a670fb0$df352f10$@augustcellars.com> <3F7E9A70-18BE-454C-A5EB-F07A1EDFE7DC@island-resort.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfF4SID21nOVc+Hqcj19ynLHV7g/QQGgOBc80lxQWhb31uVS8bzgJSRGrKKs5kEBtve7L9ao0lrmNkaN48tHAnA5q2mNwC1+caCmrbjyHqHFeZiK3ki3y AsrRKKAJLFnqgBOGaz4Q+lYRnF3ZS1x6YAaqpVG12nt8gqEcUZWdL14DFJDzLzjDg/+07PQ9+U+GHtJG7cgWYprmER7jUMINTAjlS38PFS1M5p9pCOqbq3dV hHcqjtdS/d92ofjRftV5b++eMz48n6u+QrrwxO+MxqsKJM2+QAvk1d1ADxIA8R2BjNZvjFkIgP2v34OZGtz202KV96LVfH0jfjtJiUpaPsQ= Archived-At: Subject: Re: [Rats] [Cbor] [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Apr 2020 16:09:50 -0000 --Apple-Mail=_F9907CDF-6DAB-451F-93E9-2F24DC401FDA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I have created a PR = against the EAT draft for UCCS and UJCS. I=E2=80=99m not sure this = really belongs in the EAT draft, but I thought I=E2=80=99d start by = putting it there. LL P.S. If we were do an update to CWT to accommodate this, it would also = be good to add CDDL describing CWT. That is another thing I=E2=80=99ve = got in the EAT draft, that probably belongs elsewhere. > On Mar 6, 2020, at 6:27 PM, Laurence Lundblade = wrote: >=20 > Pretty sure UCCS as Carsten describes below works for me provided: >=20 > - All the rules and requirements from CWT explicilty apply except = signing/encryption > - It uses the same registry > - There is a tag defined for it > - You get an (untagged) UCCS when you remove all signing and = encryption layers >=20 > LL >=20 >=20 >> On Mar 6, 2020, at 12:04 PM, Carsten Bormann wrote: >>=20 >> Hi Ned, >>=20 >> What I was trying to say is that the Unprotected CWT Claims Set = (UCCS) is not a CWT, but an UCCS. So I wouldn=E2=80=99t call it a token = (which implies some form of protection to me). But it is still a useful = data structure to carry around. >>=20 >>> On 2020-03-06, at 20:59, Smith, Ned wrote: >>>=20 >>> The earlier thread suggested that a naked token could be given to a = parser that was programmed correctly and it would 'just work'. But if = the definition of a CWT/JWT is that it must have bounding signature, = mac, encryption enveloping, then the parser should reject naked tokens = (tagged as such or not).=20 >>=20 >> A CWT decoder would diagnose an UCCS as =E2=80=9Cnot a CWT=E2=80=9D. >> A CWT/UCCS decoder would diagnose it as =E2=80=9CUCCS=E2=80=9D. >>=20 >>> If the naked token is defined and the map has a tag that indicates = it was formed without secure enveloping then the parser should accept = it, but the code using the parser needs to find some other way to ensure = security.=20 >>=20 >> Right. An UCCS is only a useful assertion if received over a secure = channel with the right properties to make it a useful assertion. >>=20 >>> If a parser receives a map with both security enveloping and the = naked token tag, then it should return both the map and the security = envelope context and let the code using the parser decide if the = security context satisfies the security requirement. >>=20 >> Well, it should diagnose this as =E2=80=9Cnot a CWT=E2=80=9D (and not = an UCCS either). >>=20 >> Gr=C3=BC=C3=9Fe, Carsten >>=20 >> _______________________________________________ >> RATS mailing list >> RATS@ietf.org >> https://www.ietf.org/mailman/listinfo/rats >=20 > _______________________________________________ > CBOR mailing list > CBOR@ietf.org > https://www.ietf.org/mailman/listinfo/cbor --Apple-Mail=_F9907CDF-6DAB-451F-93E9-2F24DC401FDA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = have created a PR against the EAT draft for UCCS and UJCS. =  I=E2=80=99m not sure this really belongs in the EAT draft, but I = thought I=E2=80=99d start by putting it there.

LL

P.S. If we were do an = update to CWT to accommodate this, it would also be good to add CDDL = describing CWT. That is another thing I=E2=80=99ve got in the EAT draft, = that probably belongs elsewhere.



On Mar = 6, 2020, at 6:27 PM, Laurence Lundblade <lgl@island-resort.com> wrote:

Pretty= sure UCCS as Carsten describes below works for me provided:

- All the rules and requirements from CWT = explicilty apply except signing/encryption
- It uses the = same registry
- There is a tag defined for it
- You get an (untagged) UCCS when you remove all signing and = encryption layers

LL


On Mar 6, = 2020, at 12:04 PM, Carsten Bormann <cabo@tzi.org> wrote:

Hi = Ned,

What I was trying to say is that the = Unprotected CWT Claims Set (UCCS) is not a CWT, but an UCCS.  So I = wouldn=E2=80=99t call it a token (which implies some form of protection = to me).  But it is still a useful data structure to carry = around.

On 2020-03-06, at 20:59, Smith, Ned <ned.smith@intel.com>= wrote:

The earlier thread suggested that a = naked token could be given to a parser that was programmed correctly and = it would 'just work'. But if the definition of a CWT/JWT is that it must = have bounding signature, mac, encryption enveloping, then the parser = should reject naked tokens (tagged as such or not).

A CWT decoder would diagnose an = UCCS as =E2=80=9Cnot a CWT=E2=80=9D.
A CWT/UCCS decoder = would diagnose it as =E2=80=9CUCCS=E2=80=9D.

If the naked token is = defined and the map has a tag that indicates it was formed without = secure enveloping then the parser should accept it, but the code using = the parser needs to find some other way to ensure security.

Right.  An UCCS is only a = useful assertion if received over a secure channel with the right = properties to make it a useful assertion.

If a parser receives a = map with both security enveloping and the naked token tag, then it = should return both the map and the security envelope context and let the = code using the parser decide if the security context satisfies the = security requirement.

Well, it = should diagnose this as =E2=80=9Cnot a CWT=E2=80=9D (and not an UCCS = either).

Gr=C3=BC=C3=9Fe, Carsten

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

_______________________________________________
CBOR mailing list
CBOR@ietf.org
https://www.ietf.org/mailman/listinfo/cbor

= --Apple-Mail=_F9907CDF-6DAB-451F-93E9-2F24DC401FDA-- From nobody Wed Apr 22 07:38:31 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B63F3A0D77 for ; Wed, 22 Apr 2020 07:38:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jzQ7gRFC_sYX for ; Wed, 22 Apr 2020 07:38:28 -0700 (PDT) Received: from p3plsmtpa11-08.prod.phx3.secureserver.net (p3plsmtpa11-08.prod.phx3.secureserver.net [68.178.252.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C8F33A0D43 for ; Wed, 22 Apr 2020 07:38:28 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id RGWAjZgkiCRmmRGWAjtK0f; Wed, 22 Apr 2020 07:38:27 -0700 X-CMAE-Analysis: v=2.3 cv=WKYBoUkR c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=IkcTkHD0fZMA:10 a=pGLkceISAAAA:8 a=FOECo9npAAAA:8 a=YR1WRx-QAAAA:8 a=i0EeH86SAAAA:8 a=z6gsHLkEAAAA:8 a=hD80L64hAAAA:8 a=48vgC7mUAAAA:8 a=r7TYC1OoSX58LEqLnS4A:9 a=DKqIX6kcpxdWtR1i:21 a=YeL7WE9HN8xOC2lt:21 a=QEXdDO2ut3YA:10 a=byWG51NV23l9F6lfGfes:22 a=iOyaEzCc-dPZPfZw1HLk:22 a=d-OLMTCWyvARjPbQ-enb:22 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Laurence Lundblade In-Reply-To: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> Date: Wed, 22 Apr 2020 07:38:26 -0700 Cc: "rats@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <7C65B977-FA56-4118-BA8B-121BD9697F7C@island-resort.com> References: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> To: Anders Rundgren X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfCMDtxgHyRtWOP2Bv2iFVfytLBusw8cYDYQMOBf5tUDgPrlhvnv8R90buI1nTlBQjT/NfrX+WEYbsxMiz6aPU5V6g/GNdJ3kt7oSwi3Vp4m+sblGwpC6 LZs5TpYDmSaT1pl4e11MMsO9hi5SbiUEL5ixrWPnXZQRyTdiWvmoxyEQs0ZuI17T7v5AMV1mUXHkrrTDDgvIqhmcbL01t1KFscY= Archived-At: Subject: Re: [Rats] Dealing with Attestation Roots X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Apr 2020 14:38:30 -0000 Hi Anders, > On Feb 27, 2020, at 9:51 AM, Anders Rundgren = wrote: >=20 > Hi List, > In the https://cyberphone.github.io/openbankingwallet project the idea = was to use attestations. The most recent version of the Android app = indeed supports this as well. >=20 > In an ideal world the root would be provided by Google. However, = since we don't live in an ideal world there are vendors out there who do = not follow that "recipe=E2=80=9D. Are you referring to Android N Key Attestation that is implemented in = the key store? >=20 > For W3C's PaymentRequest API a simpler solution is used which do not = match attestations but is better than nothing. This scheme builds on = publishing a manifest associated with the app. Here is my particular = manifest: https://mobilepki.org/w3cpay/method >=20 > But I still would like to use attestations and also not being tied to = browsers. >=20 > What about making attestations optionally contain a URL to the root = like https://huawei.com/teeroot ? I don=E2=80=99t know what https://huawei.com/teeroot is. I can=E2=80=99t = get anything from this URL. I=E2=80=99m guessing you are after an X.509 root certificate, one that = is used for Android-style attestation. Is that right? LL > Since the number of vendors in finite and the Web-PKI is in a fairly = good shape these days, this could serve as a workaround for those who = don't have any number of cycles to spend on installing arbitrary tee = root certificates. That is, a verifier's "trust registry" would simply = hold host names like "huawei.com", "sony.com", "samsung.com", etc. >=20 > If there is a better method, I'm all ears! >=20 > thanx, > Anders >=20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats From nobody Wed Apr 22 07:55:06 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 991A03A0E19 for ; Wed, 22 Apr 2020 07:55:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TPB6pfCV1dbW for ; Wed, 22 Apr 2020 07:55:02 -0700 (PDT) Received: from mail-wr1-x429.google.com (mail-wr1-x429.google.com [IPv6:2a00:1450:4864:20::429]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3ED0D3A0E1D for ; Wed, 22 Apr 2020 07:55:02 -0700 (PDT) Received: by mail-wr1-x429.google.com with SMTP id d17so2731897wrg.11 for ; Wed, 22 Apr 2020 07:55:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=Q03D1Hj3e6ykydwCrszf3c5TYQsNb3RdO9Ude+ZxlT4=; b=grqCFRAJrUbWYDt0R8PSoXX6MtkzpZIDvUupWAcEu96fbdMtFHpdG9cFulLz2iGYGi GMBKg34VrXC3Mqlbkh6FECk2ZXPDyzbQL4CKOcTDlhThsVg8RenVvnkBTCf4QQ8TDI4S 4sKUr3IPwmUxWsT1h2+AoyuD1AMMJqBe+WlyCod+CTgx+PdIrpLfkq3wtAK/w9Z/Nb9E iprIVvsLtXA7vRbRyeCqjoQ1FfS8pkGIDPF6V6i47TmWZj/EO6+CED82j75Mwi4+VrhZ k3I1Th4kHx0NRMP6ZU0nLD9xrl6hbpWZ0GX0wDjZjY2ALiQwMKe28XoAnrVs/kYCWHZa 2Ndw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=Q03D1Hj3e6ykydwCrszf3c5TYQsNb3RdO9Ude+ZxlT4=; b=Z9FCCph5SuP774YHB/EIXm/ooA30iTc+fmUCTiPh++w4kZeseEKDLEnr6y0B8twt60 nEHQqkDP5dYQ4OnQ13lji/+9McPVJMM+qMSOyTrLhlnixQXS2IStYAo/EIoLc/D+wMHx KccGProMh8sIFLMiYZuk+yXgUg/ZirVqRwhfpZ2Cn1yalX27buzXWxM6khUXPeFY4P+W nKE/8+VtPRUhK2RIP2msttn5LVX396NjxG1KtbwznHbLg/NaFpMz4NhYCmfdLsaM22Jb esuzbE20pSOcclF5mOU1Kv3c9hKdera1T6seSbme4a9AYnB7KiSGW7RZrIjhXSaEt9xv FOyw== X-Gm-Message-State: AGi0PuaqQgZwWjEoLEMoPmhMUaWBUMmzotGUMCsgPKXm7+WtUHAcot+V nmwVr0soN5wxNtR/zHO5liCd7ThocUc= X-Google-Smtp-Source: APiQypI5xXiRvEiiGziWBp70vv/CCY4DdIFm+PTJI+3hSsbSKTqY2Y/RnlWgORcCWhh2iKRWXm8kbg== X-Received: by 2002:adf:dd8a:: with SMTP id x10mr29574351wrl.308.1587567300174; Wed, 22 Apr 2020 07:55:00 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id x13sm8430134wmc.5.2020.04.22.07.54.59 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 22 Apr 2020 07:54:59 -0700 (PDT) To: Laurence Lundblade Cc: "rats@ietf.org" References: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> <7C65B977-FA56-4118-BA8B-121BD9697F7C@island-resort.com> From: Anders Rundgren Message-ID: Date: Wed, 22 Apr 2020 16:54:57 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 MIME-Version: 1.0 In-Reply-To: <7C65B977-FA56-4118-BA8B-121BD9697F7C@island-resort.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Rats] Dealing with Attestation Roots X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Apr 2020 14:55:05 -0000 On 2020-04-22 16:38, Laurence Lundblade wrote: > Hi Anders, Hi Laurence, Thank you for responding! > >> On Feb 27, 2020, at 9:51 AM, Anders Rundgren wrote: >> >> Hi List, >> In the https://cyberphone.github.io/openbankingwallet project the idea was to use attestations. The most recent version of the Android app indeed supports this as well. >> >> In an ideal world the root would be provided by Google. However, since we don't live in an ideal world there are vendors out there who do not follow that "recipeâ€. > > Are you referring to Android N Key Attestation that is implemented in the key store? This is indeed one possible usage. https://developer.android.com/training/articles/security-key-attestation > >> >> For W3C's PaymentRequest API a simpler solution is used which do not match attestations but is better than nothing. This scheme builds on publishing a manifest associated with the app. Here is my particular manifest: https://mobilepki.org/w3cpay/method >> >> But I still would like to use attestations and also not being tied to browsers. >> >> What about making attestations optionally contain a URL to the root like https://huawei.com/teeroot ? > > I don’t know what https://huawei.com/teeroot is. I can’t get anything from this URL. That's correct, I don't even know where to find Huawei's attestation root which is how I came to this idea :) > I’m guessing you are after an X.509 root certificate, one that is used for Android-style attestation. Is that right? Right. Is using an X.509 root certificate an unusual way of dealing with attestation verification? Anders > > LL > > >> Since the number of vendors in finite and the Web-PKI is in a fairly good shape these days, this could serve as a workaround for those who don't have any number of cycles to spend on installing arbitrary tee root certificates. That is, a verifier's "trust registry" would simply hold host names like "huawei.com", "sony.com", "samsung.com", etc. >> >> If there is a better method, I'm all ears! >> >> thanx, >> Anders >> >> _______________________________________________ >> RATS mailing list >> RATS@ietf.org >> https://www.ietf.org/mailman/listinfo/rats > From nobody Thu Apr 23 12:21:01 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BED03A125F for ; Thu, 23 Apr 2020 12:21:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.894 X-Spam-Level: X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gq4zE75slR1D for ; Thu, 23 Apr 2020 12:20:58 -0700 (PDT) Received: from p3plsmtpa06-04.prod.phx3.secureserver.net (p3plsmtpa06-04.prod.phx3.secureserver.net [173.201.192.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84FA23A1260 for ; Thu, 23 Apr 2020 12:20:58 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id RhP7j82VByxohRhP7jgTHM; Thu, 23 Apr 2020 12:20:58 -0700 X-CMAE-Analysis: v=2.3 cv=D4M51cZj c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=48vgC7mUAAAA:8 a=1MSDjx2PAAAA:20 a=pGLkceISAAAA:8 a=FOECo9npAAAA:8 a=n8i27M1mAAAA:8 a=YR1WRx-QAAAA:8 a=i0EeH86SAAAA:8 a=z6gsHLkEAAAA:8 a=hD80L64hAAAA:8 a=_fqXA1i7Q1V1SoLNugsA:9 a=c6cs0ZwzTkk7BqMS:21 a=_XqbarhqGqmHBqGP:21 a=QEXdDO2ut3YA:10 a=kWFhrK73oceN_EPdFvEA:9 a=sn_QKXJ2tMwYUIB8:21 a=hE-K0EdpAR8N2Jja:21 a=VaISDnJI_3VHSSVW:21 a=_W_S_7VecoQA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=byWG51NV23l9F6lfGfes:22 a=iOyaEzCc-dPZPfZw1HLk:22 a=d-OLMTCWyvARjPbQ-enb:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_E91E2AC4-758D-4BD0-A22C-C738E3C6F2BF" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 23 Apr 2020 12:20:57 -0700 In-Reply-To: Cc: "rats@ietf.org" To: Anders Rundgren References: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> <7C65B977-FA56-4118-BA8B-121BD9697F7C@island-resort.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfAzgkcXXKPhkxKbkf05QdqzE8LJ56AMwzWApsqcT6t+y7rB6dpZd6MX/GPsUFP5zOqSCrBacmSmxq178n2cCS5T2J+G3kDF5nUhLBxUQ7Fz+Oi/LLM9B THEbFZDGZ56+i/BE9ruv/g5EahoP8Jx4JW5cgZ79sVgYLx0RdEur8f2+bfgwpErENL1GGQ/lB3i5ole61Gm8A0ABGQeMJJRKDtM= Archived-At: Subject: Re: [Rats] Dealing with Attestation Roots X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Apr 2020 19:21:00 -0000 --Apple-Mail=_E91E2AC4-758D-4BD0-A22C-C738E3C6F2BF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Anders, I think using an X.509 hierarchy with EAT is a fine thing to do, but no = one=E2=80=99s done it yet. The two EAT implementations I know of, use = other means to find the verification key. One by key ID, another by a = combination of claims inside the attestation. Android=E2=80=99s solution is not standard, it is just used by Android = AFAIK. I think it would be fine to write a draft that says how to use X.509 = with EAT. It would involve = https://tools.ietf.org/html/draft-ietf-cose-x509-06 and maybe the URL = you=E2=80=99ve suggested for finding the root. Would even be interested = in adding this functionality to ctoken = .=20 Technically speaking, this is all about endorsements and relates to = recent email threads on that subject here. LL > On Apr 22, 2020, at 7:54 AM, Anders Rundgren = wrote: >=20 > On 2020-04-22 16:38, Laurence Lundblade wrote: >> Hi Anders, >=20 > Hi Laurence, > Thank you for responding! >=20 >>> On Feb 27, 2020, at 9:51 AM, Anders Rundgren = wrote: >>>=20 >>> Hi List, >>> In the https://cyberphone.github.io/openbankingwallet project the = idea was to use attestations. The most recent version of the Android = app indeed supports this as well. >>>=20 >>> In an ideal world the root would be provided by Google. However, = since we don't live in an ideal world there are vendors out there who do = not follow that "recipe=E2=80=9D. >> Are you referring to Android N Key Attestation that is implemented in = the key store? >=20 > This is indeed one possible usage. > = https://developer.android.com/training/articles/security-key-attestation >=20 >>>=20 >>> For W3C's PaymentRequest API a simpler solution is used which do not = match attestations but is better than nothing. This scheme builds on = publishing a manifest associated with the app. Here is my particular = manifest: https://mobilepki.org/w3cpay/method >>>=20 >>> But I still would like to use attestations and also not being tied = to browsers. >>>=20 >>> What about making attestations optionally contain a URL to the root = like https://huawei.com/teeroot ? >> I don=E2=80=99t know what https://huawei.com/teeroot is. I can=E2=80=99= t get anything from this URL. >=20 > That's correct, I don't even know where to find Huawei's attestation = root which is how I came to this idea :) >=20 >=20 >> I=E2=80=99m guessing you are after an X.509 root certificate, one = that is used for Android-style attestation. Is that right? >=20 > Right. Is using an X.509 root certificate an unusual way of dealing = with attestation verification? >=20 > Anders >=20 >> LL >>> Since the number of vendors in finite and the Web-PKI is in a fairly = good shape these days, this could serve as a workaround for those who = don't have any number of cycles to spend on installing arbitrary tee = root certificates. That is, a verifier's "trust registry" would simply = hold host names like "huawei.com", "sony.com", "samsung.com", etc. >>>=20 >>> If there is a better method, I'm all ears! >>>=20 >>> thanx, >>> Anders >>>=20 >>> _______________________________________________ >>> RATS mailing list >>> RATS@ietf.org >>> https://www.ietf.org/mailman/listinfo/rats >=20 >=20 --Apple-Mail=_E91E2AC4-758D-4BD0-A22C-C738E3C6F2BF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Anders,

I think = using an X.509 hierarchy with EAT is a fine thing to do, but no one=E2=80=99= s done it yet. The two EAT implementations I know of, use other means to = find the verification key. One by key ID, another by a combination of = claims inside the attestation.

Android=E2=80=99s solution is not = standard, it is just used by Android AFAIK.

I think it would be fine to write a = draft that says how to use X.509 with EAT. It would involve https://tools.ietf.org/html/draft-ietf-cose-x509-06 and = maybe the URL you=E2=80=99ve suggested for finding the root. Would even = be interested in adding this functionality to ctoken. 

Technically speaking, this is all about = endorsements and relates to recent email threads on that subject = here.

LL


On Apr 22, 2020, at 7:54 AM, Anders Rundgren <anders.rundgren.net@gmail.com> wrote:

On = 2020-04-22 16:38, Laurence Lundblade wrote:
Hi Anders,

Hi Laurence,
Thank you for responding!

On Feb 27, 2020, at 9:51 AM, Anders Rundgren = <anders.rundgren.net@gmail.com> wrote:

Hi List,
In the https://cyberphone.github.io/openbankingwallet project = the idea was to use attestations.  The most recent version of the = Android app indeed supports this as well.

In = an ideal world the root would be provided by Google.  However, = since we don't live in an ideal world there are vendors out there who do = not follow that "recipe=E2=80=9D.
Are you = referring to Android N Key Attestation that is implemented in the key = store?

This is indeed one = possible usage.
https://developer.android.com/training/articles/security-key-at= testation


For W3C's = PaymentRequest API a simpler solution is used which do not match = attestations but is better than nothing.  This scheme builds on = publishing a manifest associated with the app.  Here is my = particular manifest:  https://mobilepki.org/w3cpay/method

But I still would like to use attestations and = also not being tied to browsers.

What about = making attestations optionally contain a URL to the root like = https://huawei.com/teeroot ?
I don=E2=80=99t = know what https://huawei.com/teeroot  is. I can=E2=80=99t get = anything from this URL.

That's = correct, I don't even know where to find Huawei's attestation root which = is how I came to this idea :)


I=E2=80=99m guessing you = are after an X.509 root certificate, one that is used for Android-style = attestation. Is that right?

Right.  Is using an X.509 root certificate an unusual = way of dealing with attestation verification?

Anders

LL
Since = the number of vendors in finite and the Web-PKI is in a fairly good = shape these days, this could serve as a workaround for those who don't = have any number of cycles to spend on installing arbitrary tee root = certificates.  That is, a verifier's "trust registry" would simply = hold host names like "huawei.com", "sony.com", "samsung.com", etc.

If there is a better method, I'm all ears!

thanx,
Anders

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats



= --Apple-Mail=_E91E2AC4-758D-4BD0-A22C-C738E3C6F2BF-- From nobody Thu Apr 23 20:32:16 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D65BE3A0C51 for ; Thu, 23 Apr 2020 20:32:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dlaYfwtJGX50 for ; Thu, 23 Apr 2020 20:32:11 -0700 (PDT) Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 299163A0EF8 for ; Thu, 23 Apr 2020 20:32:03 -0700 (PDT) Received: by mail-wm1-x32b.google.com with SMTP id 188so8852574wmc.2 for ; Thu, 23 Apr 2020 20:32:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=nMCC8tRc6XQbPCPiB2dV1j65xRFZTjlEfS7jxtkMChE=; b=p8lidzFCzC+IjL2xFtYfU6q2fH5RKVEePpKdknlYrz25HVabb4A4mDyNife1y/5YDO FiGw6Z/xEVdFDLboY7pbnlfE041Nn7WbYLrXcCd8dtdigZouTIJo7VL4nbI+sMuRafqJ Vq3qJroy9wsu0szkOMMXuNXaJiduD+CMZPU7m506YxPcd88ChgrlWVTe3W2kTGBGBlzT +RGrEKLzbaFJ4tlRTLIGVqdHKOyZK0uB3WQU0UM6SetG67VdMu9mZFe+TjW77PDkxDd1 lgSyXqK6KDWDhFZQWNrH49NI8ELUtKvJGTupB5at+v0fOxEw6md6S7AZwxin8vSGKA44 wofg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=nMCC8tRc6XQbPCPiB2dV1j65xRFZTjlEfS7jxtkMChE=; b=oqn5N/zhZkPZwhzeJF6Geq3f4KddqNhpu9Rc6htR5FuQfJK77eSphd21CYzJj+o2m3 weGz2h+HK+97LCJAZqQqckIr/uS3SivNT34H7q611cUnkJlSJ98yaSuyjDnX9Iw/Uk8/ s+UppPnnQADUWnn/kP7GWcHtPLX2O40M0HDiiePKLxW+JCbUm0AQPZZrkF+tESpOVp6p g8bc2If56r/WhNPFQlz4Zhds+hbGlRbPWu/zWBaEFtHS+v4m4iu11M6/qm99aSwy4fVF soerfcOnLAPV6elNp8SFERP6WRJj0NM3OS+0GPDlgtTqysYVQpvn80MOj5mNbsv53W2X rAjg== X-Gm-Message-State: AGi0PuZvBz7wSi1zS88NTCopphT0TMruS1lceaLKwaMcbEUqhUYU72pC K+9dR7vXg+nTtUQtqf1PRuV2lV9Bzng= X-Google-Smtp-Source: APiQypKGjer/7PeRYxZyKv2GyKSdHc3DOISuszPSEOVpIYtiQiWtM7+0V+Tv1RIK5/R3L5hQEGFc5A== X-Received: by 2002:a1c:24d4:: with SMTP id k203mr7568913wmk.49.1587699121021; Thu, 23 Apr 2020 20:32:01 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id q143sm1019229wme.31.2020.04.23.20.31.59 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 23 Apr 2020 20:31:59 -0700 (PDT) To: Laurence Lundblade Cc: "rats@ietf.org" References: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> <7C65B977-FA56-4118-BA8B-121BD9697F7C@island-resort.com> From: Anders Rundgren Message-ID: <089577da-e46c-5f9c-ef08-30a325ea9cfc@gmail.com> Date: Fri, 24 Apr 2020 05:31:57 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Rats] Dealing with Attestation Roots X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 03:32:14 -0000 On 2020-04-23 21:20, Laurence Lundblade wrote: > Hi Anders, > Hi Laurence; > I think using an X.509 hierarchy with EAT is a fine thing to do, but no one’s done it yet. I see it more like a workaround in the absence of a standard. Using CWTs is a better solution. The two EAT implementations I know of, use other means to find the verification key. One by key ID, another by a combination of claims inside the attestation. Somewhere there must be a trust anchor or a trusted public key, right? How do you locate it expressed in practical terms? This is the only thing the "Web PKI + Vendor URL" proposal was meant to addresses. For those who have doubts about automated retrieval of trust anchors based on vendor-specific host names, the scheme can also aid manual installation of such. The proposal is neutral with respect to key hierarchy. A flat or multi-level (as in Android) scheme would be dealt with in the same way. Anders > > Android’s solution is not standard, it is just used by Android AFAIK. > > I think it would be fine to write a draft that says how to use X.509 with EAT. It would involve https://tools.ietf.org/html/draft-ietf-cose-x509-06 and maybe the URL you’ve suggested for finding the root. Would even be interested in adding this functionality to ctoken . > > Technically speaking, this is all about endorsements and relates to recent email threads on that subject here. > > LL > > >> On Apr 22, 2020, at 7:54 AM, Anders Rundgren > wrote: >> >> On 2020-04-22 16:38, Laurence Lundblade wrote: >>> Hi Anders, >> >> Hi Laurence, >> Thank you for responding! >> >>>> On Feb 27, 2020, at 9:51 AM, Anders Rundgren > wrote: >>>> >>>> Hi List, >>>> In the https://cyberphone.github.io/openbankingwallet project the idea was to use attestations.  The most recent version of the Android app indeed supports this as well. >>>> >>>> In an ideal world the root would be provided by Google.  However, since we don't live in an ideal world there are vendors out there who do not follow that "recipeâ€. >>> Are you referring to Android N Key Attestation that is implemented in the key store? >> >> This is indeed one possible usage. >> https://developer.android.com/training/articles/security-key-attestation >> >>>> >>>> For W3C's PaymentRequest API a simpler solution is used which do not match attestations but is better than nothing.  This scheme builds on publishing a manifest associated with the app.  Here is my particular manifest:  https://mobilepki.org/w3cpay/method >>>> >>>> But I still would like to use attestations and also not being tied to browsers. >>>> >>>> What about making attestations optionally contain a URL to the root like https://huawei.com/teeroot ? >>> I don’t know what https://huawei.com/teeroot  is. I can’t get anything from this URL. >> >> That's correct, I don't even know where to find Huawei's attestation root which is how I came to this idea :) >> >> >>> I’m guessing you are after an X.509 root certificate, one that is used for Android-style attestation. Is that right? >> >> Right.  Is using an X.509 root certificate an unusual way of dealing with attestation verification? >> >> Anders >> >>> LL >>>> Since the number of vendors in finite and the Web-PKI is in a fairly good shape these days, this could serve as a workaround for those who don't have any number of cycles to spend on installing arbitrary tee root certificates.  That is, a verifier's "trust registry" would simply hold host names like "huawei.com", "sony.com", "samsung.com", etc. >>>> >>>> If there is a better method, I'm all ears! >>>> >>>> thanx, >>>> Anders >>>> >>>> _______________________________________________ >>>> RATS mailing list >>>> RATS@ietf.org >>>> https://www.ietf.org/mailman/listinfo/rats >> >> > From nobody Fri Apr 24 00:16:19 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D759D3A0DEB for ; Fri, 24 Apr 2020 00:16:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.6 X-Spam-Level: X-Spam-Status: No, score=-9.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WTGz2NN8SNCt for ; Fri, 24 Apr 2020 00:16:16 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D1B13A0DE9 for ; Fri, 24 Apr 2020 00:16:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3519; q=dns/txt; s=iport; t=1587712576; x=1588922176; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=MapnhHf6UhJZC8RBlKi2aRRZRwGOQn7fXowgKVrOqvI=; b=HGSrjsKS+a4Regl9bcJf/sCTDgWRxEZJeByJqVE5CEvQsTweGLovqnSJ QZVXjAHBcehfONhmuJEz14q57uOYDjM4Ayo5wCSJblyVx0Aq3glVG1p2w wD4d4LGWojKswrGJn1NYSdRisFberQa9QHu+T99zWflAw/9sEfRIEv8de w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AEAQDVkaJe/xbLJq1mGwEBAQEBAQE?= =?us-ascii?q?FAQEBEQEBAwMBAQGBe4ElgQWBQSASKoQfiQKIF4l1iViIDAoBAQEMAQEvBAE?= =?us-ascii?q?BhEQCgko4EwIDAQELAQEFAQEBAgEFBG2FVgyFcQEBAQECASNWBQsLBBQqAgI?= =?us-ascii?q?hNgYTgyaCTAMOILBudYEyhU+CYA2CIoE4jFOCAIE4HIJNPoIehUIygi0EsVF?= =?us-ascii?q?Kgk+CapBHhEYdnGubeY0zg0ICBAYFAhWBaSKBVjMaCBsVZQGCPj4SGA2aAIV?= =?us-ascii?q?/PwMwAo9AAQE?= X-IronPort-AV: E=Sophos; i="5.73,310,1583193600"; d="scan'208,217"; a="25608750" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 24 Apr 2020 07:16:05 +0000 Received: from dhcp-10-61-109-59.cisco.com (dhcp-10-61-109-59.cisco.com [10.61.109.59]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id 03O7G4op019203 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 24 Apr 2020 07:16:04 GMT From: Eliot Lear Message-Id: <089B4CD9-64FD-491C-8E92-7235A11F9080@cisco.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_0CEB94BE-1E98-4165-8292-D50F8E348234" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Fri, 24 Apr 2020 09:16:04 +0200 In-Reply-To: <089577da-e46c-5f9c-ef08-30a325ea9cfc@gmail.com> Cc: Laurence Lundblade , "rats@ietf.org" To: Anders Rundgren References: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> <7C65B977-FA56-4118-BA8B-121BD9697F7C@island-resort.com> <089577da-e46c-5f9c-ef08-30a325ea9cfc@gmail.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) X-Outbound-SMTP-Client: 10.61.109.59, dhcp-10-61-109-59.cisco.com X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: Re: [Rats] Dealing with Attestation Roots X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 07:16:18 -0000 --Apple-Mail=_0CEB94BE-1E98-4165-8292-D50F8E348234 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hiya > On 24 Apr 2020, at 05:31, Anders Rundgren = wrote: >=20 >> The two EAT implementations I know of, use other means to find the = verification key. One by key ID, another by a combination of claims = inside the attestation. >=20 > Somewhere there must be a trust anchor or a trusted public key, right? = How do you locate it expressed in practical terms? =20 Yeah, =E2=80=9Ccombination of claims inside the attestation=E2=80=9D? = Isn=E2=80=99t that a self-assertion? Eliot --Apple-Mail=_0CEB94BE-1E98-4165-8292-D50F8E348234 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hiya

On 24 Apr 2020, at 05:31, = Anders Rundgren <anders.rundgren.net@gmail.com> wrote:

The two EAT implementations I know of, use other means to = find the verification key. One by key ID, another by a combination of = claims inside the attestation.

Somewhere there must be a trust anchor or a trusted public = key, right? How do you locate it expressed in practical terms? =  

Yeah, = =E2=80=9Ccombination of claims inside the attestation=E2=80=9D? =  Isn=E2=80=99t that a self-assertion?

Eliot

= --Apple-Mail=_0CEB94BE-1E98-4165-8292-D50F8E348234-- From nobody Fri Apr 24 15:26:33 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B16773A0E2E for ; Fri, 24 Apr 2020 15:26:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.599 X-Spam-Level: X-Spam-Status: No, score=-9.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, WEIRD_PORT=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=OPPeE76B; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=wEG7itCy Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UEc-reRNOgVx for ; Fri, 24 Apr 2020 15:26:29 -0700 (PDT) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF2C43A0E27 for ; Fri, 24 Apr 2020 15:26:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2878; q=dns/txt; s=iport; t=1587767189; x=1588976789; h=from:to:subject:date:message-id:content-id: content-transfer-encoding:mime-version; bh=tEsJ7SChCV+FUMMTC+iCx343hqKuCU01SI54UFB5t3Y=; b=OPPeE76BCNBwMc8cpa7dzywbHSVUPH2Dgd5LgYFvzyXveE9PTyidSsnT pIPWlFl3UlTXJqp4Niklc7glrIvR0IVL+Jj5rgUbeNgyuQDeGGdh20fQT ZTWOjiykVVRoeR40fOnOBMeUwIu/Z7mxV7hKx+f/jgvxkYCYNv9Y/C3Uc 4=; IronPort-PHdr: =?us-ascii?q?9a23=3AQ30zPRBVuRVlLz5h9ML9UyQJPHJ1sqjoPgMT9p?= =?us-ascii?q?ssgq5PdaLm5Zn5IUjD/qs03kTRU9Dd7PRJw6rNvqbsVHZIwK7JsWtKMfkuHw?= =?us-ascii?q?QAld1QmgUhBMCfDkiuKvXjajM7GstqX15+9Hb9Ok9QS47z?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B2DQANZ6Ne/5NdJa1MGh4BCxw8gTw?= =?us-ascii?q?LgVRRBWxYIAQLKgqEFYNGA4pwTppBgS6BJANUCwEBAQwBARgNCAIEAQGDK0V?= =?us-ascii?q?tgg8kNgcOAgMBAQsBAQUBAQECAQUEbYVWAQuFdAUBEBERDAEBLAwRASICFAw?= =?us-ascii?q?GAgQlCxUSBBMigwQBgksDLgEOPKZSAoE5iGF2gTKDAAEBBUVxAgGBD4JjGII?= =?us-ascii?q?OAwaBDiqCY4lWGoIAgREnHIJNPoEEgWMBAQIaghiCGCsyghIbkTegaAqCRYg?= =?us-ascii?q?Mj28dglqIVpFBj3iBVodvkzkCBAIEBQIOAQEFgVkIKoFWcBU7KgGCPlAYDZE?= =?us-ascii?q?0DAwLg0+FFIVCdAIzAgYBBwEBAwl8jA2BDwGBDwEB?= X-IronPort-AV: E=Sophos;i="5.73,313,1583193600"; d="scan'208";a="482106868" Received: from rcdn-core-11.cisco.com ([173.37.93.147]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 24 Apr 2020 22:26:28 +0000 Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by rcdn-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id 03OMQSXR021692 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Fri, 24 Apr 2020 22:26:28 GMT Received: from xhs-rcd-001.cisco.com (173.37.227.246) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 24 Apr 2020 17:26:20 -0500 Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 24 Apr 2020 17:26:19 -0500 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Fri, 24 Apr 2020 18:26:19 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hBHdP6mqujLNU5uJGS+syO3fwKqct4loNmEwktlqTfuEpeRlq+L5JSdlDXB2YIuQKRnlHuGnmdXfz3+brg8xlTw+Ym45r1VlT5HdKP0iNCWlvox62cyoiuiOws5tYqqLAR2mcZsETBwZIyWYxFSOkjy4rcPO4Z/nOnMysHiys8VU2rXir4fgHcJ7BqkGspsZ6kjNPC/Jjq5pCPjfr4NYI7+FlmeQ1TDCM/5IPZfRZn2bI8f8uwTgpY/caR2fwTFnfwytp55lmKqi1OOm74EXAzy9f0SCkfnZVunMrb5vpgooHyWUzUnYBqBslp0iLW3y8j+Kq4g5csziGu9vtpE5gQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tEsJ7SChCV+FUMMTC+iCx343hqKuCU01SI54UFB5t3Y=; b=KEINA3jAPFMSINsJezyF8JpnkH+dXo77JQCv3aWxdqGjQllu78kboRC4TgaFF97qUtTaNyx3dyKPhqpvVSjWXLJjB2tks4EW4SebDeX3msNEZ4HdAcRnoDA/l0myguOIedCQodig/dnlVP6yovBSDFcH4b3uiSUfB81yvhh8cdhDQmnxU+tab3pDng6S4UFv9P/7+2CUeVHpsRv2XK+UZOoXq895qwUicIKBXxQUvF/ASNEWE8+qepn5WVTcTNDMSSzBQpXc5OCstFnJgvqY43id1hKlJcvzzdaLMj9k4Ovvtoy3otPW7YZ6FnnfQvkjSMhgvH5ssC4k0KMJXQXtFg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tEsJ7SChCV+FUMMTC+iCx343hqKuCU01SI54UFB5t3Y=; b=wEG7itCynZImlugvoNbZFs6fAmP7AM+98hfz8wVhQtwQaaLw2by2bfvntUUssZR0pC3MFCfJkmtuyY1AP6tt7Kj6E8HA0tJVelSJyfV5g28JaKuxzbEhnYkOFIR+z+9py61sEE5gTGI+FzIVbikR3xGUUJ8ifhfzEOzh8VHWPWo= Received: from BY5PR11MB4070.namprd11.prod.outlook.com (2603:10b6:a03:181::16) by BY5PR11MB4055.namprd11.prod.outlook.com (2603:10b6:a03:18b::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2921.29; Fri, 24 Apr 2020 22:26:17 +0000 Received: from BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::101e:db5b:b661:949]) by BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::101e:db5b:b661:949%6]) with mapi id 15.20.2937.020; Fri, 24 Apr 2020 22:26:17 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "rats@ietf.org" Thread-Topic: Remote ATtestation ProcedureS (rats) WG Virtual Meeting: 2020-04-28 Thread-Index: AQHWGodfL38c/wv0yEKG+dAt4HGFnw== Date: Fri, 24 Apr 2020 22:26:17 +0000 Message-ID: <367BB01B-1E8C-45C2-9DA4-FFC44B657E9E@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.15.200413 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [73.162.233.180] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 368da041-7f80-4ab2-5d70-08d7e89e81a5 x-ms-traffictypediagnostic: BY5PR11MB4055: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:3826; x-forefront-prvs: 03838E948C x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR11MB4070.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(376002)(346002)(136003)(366004)(39860400002)(396003)(66556008)(8936002)(66476007)(76116006)(71200400001)(2906002)(64756008)(86362001)(16799955002)(186003)(33656002)(5660300002)(6916009)(2616005)(316002)(966005)(66446008)(8676002)(36756003)(6506007)(6512007)(81156014)(26005)(478600001)(6486002)(66946007)(53546011); DIR:OUT; SFP:1101; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: MGc7js4LZDD6qDm8BnFyzAn4NlMLsYPoRvUkB3aPPWKcMMmdlHlOjo41QZVCEDqhlshIu/rYV9RgZLwaYA04FQ2OEV5PmmZjU54lqUjf8lrnynvNdzUaoXzplSC+AZ9eQ+CKMTbCWcGW05k4svr/vAg72d6oxFvULqd/iVTvOFEjZRXczAVLW0wqzUydvqxl+Q1kZPan0X2PuH1Vx51hxjWEtYd/D+GDr6+MFM0MSKTipUQPPbzpl4nvLyOtomzeGzV0GWPOHhyo7F+vC5Txu/1D3L31TBhZBFEMa4u4+cHS3dEzMLAcWqcWXdjYXo+ZkgOb3iDA22EIkxoYFMKjkHCLnMgDxCOS3f/qal2p4OQizeQnIISQqf9UkrVGgOVMfCxIWvl8/zFCaY6q6n0mqekR187ykl1HPAtCLuZWFdbn3ocppXs8rpOHhUwpMnh1M2TEUJF+EJLLy5krePEeV8B9Nf7YXnZdM+CCK9/vmuVMwTtSpt2c74UCkvpGOSgH6mQYP8TinlN7kWRjEHipaQ== x-ms-exchange-antispam-messagedata: VjfDFznEZdhUi2naDGjZz7pyVKE7qRjCKPjg0bAax0h5qFihvMpINGQXiL+IL9+Fai04b41PlTdsacn8t9zkTEWZ2kkZhuU6K/u++1Q7DuxaFd+vE8voJlJRDwuoBkAnqkfwKqvwa2l3SbTC3up30w== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 368da041-7f80-4ab2-5d70-08d7e89e81a5 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Apr 2020 22:26:17.2490 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: dTk22W+4tRqQSSCxVc24Hb1kUYkWW30K4bt2toyGN8p56CkyPImPBg+PC96sYKA22N165lik83I+jAl+gUoeSA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4055 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.14, xch-rcd-004.cisco.com X-Outbound-Node: rcdn-core-11.cisco.com Archived-At: Subject: [Rats] Remote ATtestation ProcedureS (rats) WG Virtual Meeting: 2020-04-28 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 22:26:32 -0000 SnVzdCBhIHJlbWluZGVyIHRoYXQgd2UgaGF2ZSBhIHZpcnR1YWwgaW50ZXJpbSBjb21pbmcgdXAg bmV4dCBUdWVzZGF5OyBpbmZvcm1hdGlvbiBpcyBiZWxvdy4gIA0KDQpCZXN0LCBOYW5jeQ0KDQrv u79PbiAzLzI1LzIwLCA5OjU5IFBNLCAiUkFUUyBvbiBiZWhhbGYgb2YgTmFuY3kgQ2FtLVdpbmdl dCAobmNhbXdpbmcpIiA8cmF0cy1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBuY2Ftd2lu Zz00MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZz4gd3JvdGU6DQoNCiAgICBJbiBjYXNlIHlvdSBt aXNzZWQgdGhlIGdlbmVyYWwgYW5ub3VuY2VtZW50LCB0aGUgaW5mbyBpcyBiZWxvdy4NCiAgICAN CiAgICBUbyB0aGUgcHJlc2VudGVyczogcGxlYXNlIHByb3ZpZGUgdGhlIHNsaWRlcyBieSBFT0Qg b24gRnJpZGF5IEFwciAyNCBzbyB0aGF0IHdlIGNhbiBoYXZlIHRoZW0gc3RpdGNoZWQgdG9nZXRo ZXIgZm9yIHNtb290aGVyIHRyYW5zaXRpb25zIGJldHdlZW4gcHJlc2VudGVycy4NCiAgICANCiAg ICBUaGFua3MsIE5hbmN5DQogICAgDQogICAgT24gMy8yNS8yMCwgNzowMyBBTSwgIlJBVFMgb24g YmVoYWxmIG9mIElFU0cgU2VjcmV0YXJ5IiA8cmF0cy1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFs ZiBvZiBpZXNnLXNlY3JldGFyeUBpZXRmLm9yZz4gd3JvdGU6DQogICAgDQogICAgICAgIFRoZSBS ZW1vdGUgQVR0ZXN0YXRpb24gUHJvY2VkdXJlUyAocmF0cykgV29ya2luZyBHcm91cCB3aWxsIGhv bGQNCiAgICAgICAgYSB2aXJ0dWFsIGludGVyaW0gbWVldGluZyBvbiAyMDIwLTA0LTI4IGZyb20g MTE6MDAgdG8gMTM6MDAgQW1lcmljYS9Mb3NfQW5nZWxlcyAoMTg6MDAgdG8gMjA6MDAgVVRDKS4N CiAgICAgICAgDQogICAgICAgIEFnZW5kYToNCiAgICAgICAgQWdlbmRhOg0KICAgICAgICAtIEFn ZW5kYSBCYXNoICg1bWluKQ0KICAgICAgICAtIE5ldHdvcmsgRGV2aWNlIEF0dGVzdGF0aW9uIC0g R3V5ICgyMG1pbikNCiAgICAgICAgLSBSQVRzIHdpdGggTVVEIOKAkyBIZW5rICgxMG1pbikNCiAg ICAgICAgLSBDT1NXSUQgZm9yIFJBVHMg4oCTIEhlbmsgKDEwbWluKQ0KICAgICAgICAtIEVBVCBF bmRvcnNlbWVudCDigJMgSGVuayAoMTBtaW4pDQogICAgICAgIC0gUkFUcyBVbnByb3RlY3RlZCBD V1QgVG9rZW5zIOKAkyBIZW5rICgxMG1pbikNCiAgICAgICAgLSBJbnRlcmFjdGlvbiBNb2RlbCDi gJMgSGVuayAoMTBtaW4pDQogICAgICAgIC0gQ0hBUlJBIFVwZGF0ZSDigJMgSGVuayAoMTBtaW4p DQogICAgICAgIA0KICAgICAgICAgRXRoZXJwYWQ6IGh0dHBzOi8vZXRoZXJwYWQuaWV0Zi5vcmc6 OTAwOS9wL25vdGVzLWlldGYtcmF0cy12aS0yMDIwLTA0LTI4DQogICAgICAgIA0KICAgICAgICBK T0lOIFdFQkVYIE1FRVRJTkcNCiAgICAgICAgaHR0cHM6Ly9pZXRmLndlYmV4LmNvbS9pZXRmL2ou cGhwP01USUQ9bWQ3ODBmMWFhNTNiZmMwYmY1ZWJhNWMxZGU5YzljM2M3DQogICAgICAgIE1lZXRp bmcgbnVtYmVyIChhY2Nlc3MgY29kZSk6IDYxMSA1MDMgNDAwDQogICAgICAgIA0KICAgICAgICBI b3N0IGtleTogMjYwNzExDQogICAgICAgIA0KICAgICAgICBNZWV0aW5nIHBhc3N3b3JkOiBqZlg5 S2tQQ1E4Mw0KICAgICAgICANCiAgICAgICAgDQogICAgICAgIA0KICAgICAgICBJbmZvcm1hdGlv biBhYm91dCByZW1vdGUgcGFydGljaXBhdGlvbjoNCiAgICAgICAgaHR0cHM6Ly9pZXRmLndlYmV4 LmNvbS9pZXRmL2oucGhwP01USUQ9bWQ3ODBmMWFhNTNiZmMwYmY1ZWJhNWMxZGU5YzljM2M3DQog ICAgICAgIA0KICAgICAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KICAgICAgICBSQVRTIG1haWxpbmcgbGlzdA0KICAgICAgICBSQVRTQGlldGYub3Jn DQogICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0cw0KICAg ICAgICANCiAgICANCiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KICAgIFJBVFMgbWFpbGluZyBsaXN0DQogICAgUkFUU0BpZXRmLm9yZw0KICAgIGh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0cw0KICAgIA0KDQo= From nobody Sun Apr 26 12:26:04 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8264F3A0F13 for ; Sun, 26 Apr 2020 12:26:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.894 X-Spam-Level: X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fKgYXXc3DVxS for ; Sun, 26 Apr 2020 12:25:58 -0700 (PDT) Received: from p3plsmtpa06-08.prod.phx3.secureserver.net (p3plsmtpa06-08.prod.phx3.secureserver.net [173.201.192.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC9BA3A0F1D for ; Sun, 26 Apr 2020 12:25:57 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id Smuaj5ZvwYPrTSmuajI0ID; Sun, 26 Apr 2020 12:25:57 -0700 X-CMAE-Analysis: v=2.3 cv=EoCsUhUA c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=pGLkceISAAAA:8 a=48vgC7mUAAAA:8 a=1MSDjx2PAAAA:20 a=FOECo9npAAAA:8 a=n8i27M1mAAAA:8 a=YR1WRx-QAAAA:8 a=i0EeH86SAAAA:8 a=z6gsHLkEAAAA:8 a=hD80L64hAAAA:8 a=96kE7qOnKFvWYeHqX_IA:9 a=poDjYddjOVpP9xRX:21 a=YnSBK_LETCTrUOha:21 a=QEXdDO2ut3YA:10 a=hKI9eobjCLQokgsKDVMA:9 a=JGkeJO6Mp8GvHkrp:21 a=b2KhRQuRoTeZISfU:21 a=OeWRAXXtQf8Phl4b:21 a=_W_S_7VecoQA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=byWG51NV23l9F6lfGfes:22 a=iOyaEzCc-dPZPfZw1HLk:22 a=d-OLMTCWyvARjPbQ-enb:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_152CBEA5-6194-4702-99CE-555727D8FF42" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Sun, 26 Apr 2020 12:25:55 -0700 In-Reply-To: <089577da-e46c-5f9c-ef08-30a325ea9cfc@gmail.com> Cc: "rats@ietf.org" To: Anders Rundgren References: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> <7C65B977-FA56-4118-BA8B-121BD9697F7C@island-resort.com> <089577da-e46c-5f9c-ef08-30a325ea9cfc@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfE3hGvTSPl4URjHzUJzdIWGTVvOC181ILpCgzQU9jQsXm9C6RKdJawHtktX2qXZMDOm2DQyDzbGm93tqhow7Ksjji1LgsEkGHsPJ95UI5aaJM9Hxd0sb gI6Lk4fdEyid1cjohazQpWHZxObpx0kEX1re8bxEpvOJr3wsDiRwS0AWHHtk1Z5QPE7fm9JZXbK3sExJjAL4/QDgnzsDZY99/pg= Archived-At: Subject: Re: [Rats] Dealing with Attestation Roots X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Apr 2020 19:26:02 -0000 --Apple-Mail=_152CBEA5-6194-4702-99CE-555727D8FF42 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Apr 23, 2020, at 8:31 PM, Anders Rundgren = wrote: >=20 > On 2020-04-23 21:20, Laurence Lundblade wrote: >> Hi Anders, > Hi Laurence; >=20 >> I think using an X.509 hierarchy with EAT is a fine thing to do, but = no one=E2=80=99s done it yet.=20 >=20 > I see it more like a workaround in the absence of a standard. Using = CWTs is a better solution. Android uses X.509 both for the attestation token and to chain up from a = root to a verification key. Agreed that the X.509 for the attestation = token is not preferred as a standard. I wasn=E2=80=99t suggesting that. = I was suggesting that X.509 is used WITH CWT/EAT to chain up from a root = to a verification key per = https://tools.ietf.org/html/draft-ietf-cose-x509-06 = . I think I=E2=80=99m= agreeing with you. >=20 >=20 >> The two EAT implementations I know of, use other means to find the = verification key. One by key ID, another by a combination of claims = inside the attestation. >>=20 > Somewhere there must be a trust anchor or a trusted public key, right? = How do you locate it expressed in practical terms? This is the only = thing the "Web PKI + Vendor URL" proposal was meant to addresses. For = those who have doubts about automated retrieval of trust anchors based = on vendor-specific host names, the scheme can also aid manual = installation of such. >=20 > The proposal is neutral with respect to key hierarchy. A flat or = multi-level (as in Android) scheme would be dealt with in the same way. Yes, I generally I agree with you on all this. Though I think there are other ways than an X.509 root certificate and a = URL for it to find a verification key.=20 I think we should have an IETF RATS draft that says how to use X.509 = roots and hierarchies plus a URI with EAT/CWT. LL >=20 > Anders >=20 >> Android=E2=80=99s solution is not standard, it is just used by = Android AFAIK. >> I think it would be fine to write a draft that says how to use X.509 = with EAT. It would involve = https://tools.ietf.org/html/draft-ietf-cose-x509-06 = and maybe the URL = you=E2=80=99ve suggested for finding the root. Would even be interested = in adding this functionality to ctoken = >. >> Technically speaking, this is all about endorsements and relates to = recent email threads on that subject here. >> LL >>> On Apr 22, 2020, at 7:54 AM, Anders Rundgren = = >> wrote: >>>=20 >>> On 2020-04-22 16:38, Laurence Lundblade wrote: >>>> Hi Anders, >>>=20 >>> Hi Laurence, >>> Thank you for responding! >>>=20 >>>>> On Feb 27, 2020, at 9:51 AM, Anders Rundgren = = >> wrote: >>>>>=20 >>>>> Hi List, >>>>> In the https://cyberphone.github.io/openbankingwallet project the = idea was to use attestations. The most recent version of the Android = app indeed supports this as well. >>>>>=20 >>>>> In an ideal world the root would be provided by Google. However, = since we don't live in an ideal world there are vendors out there who do = not follow that "recipe=E2=80=9D. >>>> Are you referring to Android N Key Attestation that is implemented = in the key store? >>>=20 >>> This is indeed one possible usage. >>> = https://developer.android.com/training/articles/security-key-attestation >>>=20 >>>>>=20 >>>>> For W3C's PaymentRequest API a simpler solution is used which do = not match attestations but is better than nothing. This scheme builds = on publishing a manifest associated with the app. Here is my particular = manifest: https://mobilepki.org/w3cpay/method >>>>>=20 >>>>> But I still would like to use attestations and also not being tied = to browsers. >>>>>=20 >>>>> What about making attestations optionally contain a URL to the = root like https://huawei.com/teeroot ? >>>> I don=E2=80=99t know what https://huawei.com/teeroot is. I can=E2=80= =99t get anything from this URL. >>>=20 >>> That's correct, I don't even know where to find Huawei's attestation = root which is how I came to this idea :) >>>=20 >>>=20 >>>> I=E2=80=99m guessing you are after an X.509 root certificate, one = that is used for Android-style attestation. Is that right? >>>=20 >>> Right. Is using an X.509 root certificate an unusual way of dealing = with attestation verification? >>>=20 >>> Anders >>>=20 >>>> LL >>>>> Since the number of vendors in finite and the Web-PKI is in a = fairly good shape these days, this could serve as a workaround for those = who don't have any number of cycles to spend on installing arbitrary tee = root certificates. That is, a verifier's "trust registry" would simply = hold host names like "huawei.com", "sony.com", "samsung.com", etc. >>>>>=20 >>>>> If there is a better method, I'm all ears! >>>>>=20 >>>>> thanx, >>>>> Anders >>>>>=20 >>>>> _______________________________________________ >>>>> RATS mailing list >>>>> RATS@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/rats >>>=20 >>>=20 >=20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_152CBEA5-6194-4702-99CE-555727D8FF42 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Apr 23, 2020, at 8:31 PM, Anders Rundgren <anders.rundgren.net@gmail.com> wrote:

On 2020-04-23 21:20, Laurence = Lundblade wrote:
Hi Anders,
Hi Laurence;

I think using an X.509 hierarchy with = EAT is a fine thing to do, but no one=E2=80=99s done it yet. 

I see it more like a workaround in the absence of a standard. =  Using CWTs is a better solution.

Android uses X.509 both for the attestation token = and to chain up from a root to a verification key. Agreed that the X.509 = for the attestation token is not preferred as a standard. I wasn=E2=80=99t= suggesting that. I was suggesting that X.509 is used WITH CWT/EAT to = chain up from a root to a verification key per https://tools.ietf.org/html/draft-ietf-cose-x509-06. I = think I=E2=80=99m agreeing with you.



The two EAT implementations I = know of, use other means to find the verification key. One by key ID, = another by a combination of claims inside the attestation.

Somewhere there must be a trust anchor or a trusted public = key, right? How do you locate it expressed in practical terms? =  This is the only thing the "Web PKI + Vendor URL" proposal was = meant to addresses.  For those who have doubts about automated = retrieval of trust anchors based on vendor-specific host names, the = scheme can also aid manual installation of such.

The proposal is neutral with = respect to key hierarchy.  A flat or multi-level (as in Android) = scheme would be dealt with in the same way.

Yes, I = generally I agree with you on all this.

Though I think there are other ways than an X.509 = root certificate and a URL for it to find a verification = key. 

I think we should have an = IETF RATS draft that says how to use X.509 roots and hierarchies plus a = URI with EAT/CWT.

LL




Anders

Android=E2=80=99s solution is not = standard, it is just used by Android AFAIK.
I think it = would be fine to write a draft that says how to use X.509 with EAT. It = would involve https://tools.ietf.org/html/draft-ietf-cose-x509-06 and maybe the URL you=E2=80=99= ve suggested for finding the root. Would even be interested in adding = this functionality to ctoken <https://github.com/laurencelundblade/ctoken>.
Technically speaking, this is all about endorsements and = relates to recent email threads on that subject here.
LL
On Apr 22, 2020, at 7:54 = AM, Anders Rundgren <anders.rundgren.net@gmail.com <mailto:anders.rundgren.net@gmail.com>> wrote:

On 2020-04-22 16:38, Laurence Lundblade = wrote:
Hi Anders,

Hi Laurence,
Thank = you for responding!

On Feb 27, 2020, at = 9:51 AM, Anders Rundgren <anders.rundgren.net@gmail.com <mailto:anders.rundgren.net@gmail.com>> wrote:

Hi List,
In the https://cyberphone.github.io/openbankingwallet project = the idea was to use attestations.  The most recent version of the = Android app indeed supports this as well.

In = an ideal world the root would be provided by Google.  However, = since we don't live in an ideal world there are vendors out there who do = not follow that "recipe=E2=80=9D.
Are you = referring to Android N Key Attestation that is implemented in the key = store?

This is indeed one = possible usage.
https://developer.android.com/training/articles/security-key-at= testation


For W3C's = PaymentRequest API a simpler solution is used which do not match = attestations but is better than nothing.  This scheme builds on = publishing a manifest associated with the app.  Here is my = particular manifest:  https://mobilepki.org/w3cpay/method

But I still would like to use attestations and = also not being tied to browsers.

What about = making attestations optionally contain a URL to the root like = https://huawei.com/teeroot ?
I don=E2=80=99t = know what https://huawei.com/teeroot  is. I can=E2=80=99t get = anything from this URL.

That's = correct, I don't even know where to find Huawei's attestation root which = is how I came to this idea :)


I=E2=80=99m guessing you = are after an X.509 root certificate, one that is used for Android-style = attestation. Is that right?

Right.  Is using an X.509 root certificate an unusual = way of dealing with attestation verification?

Anders

LL
Since = the number of vendors in finite and the Web-PKI is in a fairly good = shape these days, this could serve as a workaround for those who don't = have any number of cycles to spend on installing arbitrary tee root = certificates.  That is, a verifier's "trust registry" would simply = hold host names like "huawei.com", "sony.com", "samsung.com", etc.

If there is a better method, I'm all ears!

thanx,
Anders

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats



_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_152CBEA5-6194-4702-99CE-555727D8FF42-- From nobody Sun Apr 26 12:35:33 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C89753A0F6B for ; Sun, 26 Apr 2020 12:35:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.716 X-Spam-Level: X-Spam-Status: No, score=-2.716 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.82, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5O3e0RMxw0E9 for ; Sun, 26 Apr 2020 12:35:30 -0700 (PDT) Received: from p3plsmtpa11-09.prod.phx3.secureserver.net (p3plsmtpa11-09.prod.phx3.secureserver.net [68.178.252.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8810E3A0F6C for ; Sun, 26 Apr 2020 12:35:30 -0700 (PDT) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id Sn3pjMe5YAH7jSn3pj2gXP; Sun, 26 Apr 2020 12:35:30 -0700 X-CMAE-Analysis: v=2.3 cv=YbzDGDZf c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=48vgC7mUAAAA:8 a=pGLkceISAAAA:8 a=LfMD5_FKE7ujrVmnwTkA:9 a=Z8SXLZCkHBhyYdnq:21 a=qnao9o7MuypvPuO3:21 a=QEXdDO2ut3YA:10 a=Sdg63LF2uTc0LgqzOYkA:9 a=krBrgrtZv85E3sP6:21 a=m6tv8Tqb58I8cgzQ:21 a=fQp-Z9kRC3JnKVG6:21 a=_W_S_7VecoQA:10 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: <22D8F1C3-63B1-4629-B0C0-A79884FB6DC1@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_E8D4D633-7901-4665-9BDD-25D533D3185C" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Sun, 26 Apr 2020 12:35:28 -0700 In-Reply-To: <089B4CD9-64FD-491C-8E92-7235A11F9080@cisco.com> Cc: Anders Rundgren , "rats@ietf.org" To: Eliot Lear References: <49d8907c-7637-3d21-0619-4999565fc50e@gmail.com> <7C65B977-FA56-4118-BA8B-121BD9697F7C@island-resort.com> <089577da-e46c-5f9c-ef08-30a325ea9cfc@gmail.com> <089B4CD9-64FD-491C-8E92-7235A11F9080@cisco.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfFyzKkZXbxBRe+qdjnvZVbhyPmR+Ek7pPXxpBhSybEyom5ltnQ/A6jSzdJh7Mvn/PK3yF56QvEecfp29pP+K7t1pKY9y23Z8g/mCtIg7f5mio+4UBwLJ 63FB3f7zdS1x0VxoDN9NJBWPWh/1npMD8utoyOHJQh48B0sboQw8GaDt6bi2pFYXmdQljQdWogx1EZaOV89EP1E0chWsQya6XrCwnAt4sDblAjxV04l7KDr6 PVFaUJm+ULNZEfQDg+jzJw== Archived-At: Subject: Re: [Rats] Dealing with Attestation Roots X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Apr 2020 19:35:32 -0000 --Apple-Mail=_E8D4D633-7901-4665-9BDD-25D533D3185C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Apr 24, 2020, at 12:16 AM, Eliot Lear = wrote: >=20 > Hiya >=20 >> On 24 Apr 2020, at 05:31, Anders Rundgren = > = wrote: >>=20 >>> The two EAT implementations I know of, use other means to find the = verification key. One by key ID, another by a combination of claims = inside the attestation. >>=20 >> Somewhere there must be a trust anchor or a trusted public key, = right? How do you locate it expressed in practical terms? =20 >=20 > Yeah, =E2=80=9Ccombination of claims inside the attestation=E2=80=9D? = Isn=E2=80=99t that a self-assertion? >=20 By =E2=80=9Cclaims inside the attestation=E2=80=9D I don=E2=80=99t mean = self-assertion. You use the claims inside the attestation to find the = key. For example you use OEM ID to find the OEM of the device, then you = use the UEID to find the specific key. Yes, you are using claims that = are unverified to find the key, but that is OK. If you get the wrong = key, nothing works anyway. COSE=E2=80=99s key id is unprotected. Personally, I prefer to use the COSE kid or = https://tools.ietf.org/html/draft-ietf-cose-x509-06 = because it keeps = the SW stack cleaner, but there=E2=80=99s nothing insecure about using = claims inside the attestation to look up the verification key.=20 LL --Apple-Mail=_E8D4D633-7901-4665-9BDD-25D533D3185C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Apr 24, 2020, at 12:16 AM, Eliot Lear <lear=3D40cisco.com@dmarc.ietf.org> wrote:

Hiya

On 24 Apr 2020, at 05:31, Anders Rundgren <anders.rundgren.net@gmail.com> wrote:

The two EAT implementations I know of, use other means to = find the verification key. One by key ID, another by a combination of = claims inside the attestation.

Somewhere there must be a trust anchor or a trusted public = key, right? How do you locate it expressed in practical terms? =  

Yeah,= =E2=80=9Ccombination of claims inside the attestation=E2=80=9D? =  Isn=E2=80=99t that a self-assertion?


By = =E2=80=9Cclaims inside the attestation=E2=80=9D I don=E2=80=99t mean = self-assertion. You use the claims inside the attestation to find the = key. For example you use OEM ID to find the OEM of the device, then you = use the UEID to find the specific key. Yes, you are using claims that = are unverified to find the key, but that is OK. If you get the wrong = key, nothing works anyway. COSE=E2=80=99s key id is = unprotected.

Personally, I prefer to = use the COSE kid or https://tools.ietf.org/html/draft-ietf-cose-x509-06 be= cause it keeps the SW stack cleaner, but there=E2=80=99s nothing = insecure about using claims inside the attestation to look up the = verification key. 

LL

= --Apple-Mail=_E8D4D633-7901-4665-9BDD-25D533D3185C-- From nobody Tue Apr 28 02:11:08 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0CBE3A115A for ; Tue, 28 Apr 2020 02:11:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RebB_M7oFF_p for ; Tue, 28 Apr 2020 02:11:04 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E85F73A1157 for ; Tue, 28 Apr 2020 02:11:03 -0700 (PDT) Received: from lhreml735-chm.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id 4CF03D51E5B2C581E7E6; Tue, 28 Apr 2020 10:11:01 +0100 (IST) Received: from nkgeml706-chm.china.huawei.com (10.98.57.153) by lhreml735-chm.china.huawei.com (10.201.108.86) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1913.5; Tue, 28 Apr 2020 10:11:00 +0100 Received: from nkgeml705-chm.china.huawei.com (10.98.57.154) by nkgeml706-chm.china.huawei.com (10.98.57.153) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1913.5; Tue, 28 Apr 2020 17:10:58 +0800 Received: from nkgeml705-chm.china.huawei.com ([10.98.57.154]) by nkgeml705-chm.china.huawei.com ([10.98.57.154]) with mapi id 15.01.1913.007; Tue, 28 Apr 2020 17:10:58 +0800 From: "Panwei (William)" To: Henk Birkholz CC: "rats@ietf.org" Thread-Topic: I-D Action: draft-birkholz-rats-mud-00.txt Thread-Index: AQHV9m7jLabrS5f4YkaEfm6R77OgnaiOeujw Date: Tue, 28 Apr 2020 09:10:57 +0000 Message-ID: <599e9b4b8111468c8b7e32fe18e89f14@huawei.com> References: <158379806385.5562.11653463849665825762@ietfa.amsl.com> In-Reply-To: <158379806385.5562.11653463849665825762@ietfa.amsl.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.138.33.152] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Rats] I-D Action: draft-birkholz-rats-mud-00.txt X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Apr 2020 09:11:06 -0000 Hi Henk, I've read your draft of using MUD in RATS, it's a very clever and practical= idea. MUD provides a mechanism for the manufacturer to describe the usage = or characteristics of the device, and the Appraisal Policy for Evidence and= Endorsement are also one kind of information that the manufacturer knows a= nd can describe in the MUD File. Below are some personal ideas: 1. For now, in the draft, you only define three URIs in the MUD File, and t= he Verifier needs to retrieve the CoSWID-styled RIMs and CWT-styled Endorse= ments based on these URIs. I agree that this is one way to do. Still, I als= o think there is an alternative way that is directly defining the YANG modu= le for the RATS-related information (reference values, endorsements, etc.).= The MUD File is already YANG-modeled, so defining YANG-styled RATS-related= information can save the implementation work for those Verifiers which don= 't support CoSWID or CWT. 2. Except embedding the MUD URL in DevID, RFC8520 also describes using DHCP= and LLDP to convey the MUD URL. Although the latter two ways can't provide= explicit protection for the authenticity and integrity of the MUD URL, RFC= 8520 doesn't forbid these two ways and leave the security to the industry t= o consider because the trust may come from other out-of-band methods. So I = suggest not to limit to only use DevID in this draft, but allow the DHCP an= d LLDP ways and let the industry to consider how to provide trust. 3. You use MUD URI in this draft while RFC8520 uses MUD URL, I think it's b= etter to be consistent with RFC8520. Regards & Thanks! Wei Pan > -----Original Message----- > From: I-D-Announce [mailto:i-d-announce-bounces@ietf.org] On Behalf > Of internet-drafts@ietf.org > Sent: Tuesday, March 10, 2020 7:54 AM > To: i-d-announce@ietf.org > Subject: I-D Action: draft-birkholz-rats-mud-00.txt >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts > directories. >=20 >=20 > Title : MUD-Based RATS Resources Discovery > Author : Henk Birkholz > Filename : draft-birkholz-rats-mud-00.txt > Pages : 9 > Date : 2020-03-09 >=20 > Abstract: > Manufacturer Usage Description (MUD) files and the MUD URI that > point > to them are defined in RFC 8520. This document introduces a new type > of MUD file to be delivered in conjunction with a MUD file signature > and/or to be referenced via a MUD URI embedded in an IEEE 802.1AR > Secure Device Identifier (DevID). A DevID is a device specific pub- > key identity document that can be presented to other entities, e.g. a > network management system. If this entity is also a verifier as > defined by the IETF Remote ATtestation procedureS (RATS) > architecture, this verifier can use the references found in the MUD > file specified in this document in order to discover appropriate > Reference Integrity Measurements (RIM), Endorsement Documents, or > even globally suitable Remote Attestation Services (RAS). All three > types of theses resources are required to conduct RATS. Hence, the > MUD file defined in this document enables remote attestation > procedures by supporting the discovery of these required resources or > services. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-birkholz-rats-mud/ >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-birkholz-rats-mud-00 > https://datatracker.ietf.org/doc/html/draft-birkholz-rats-mud-00 >=20 >=20 > Please note that it may take a couple of minutes from the time of > submission until the htmlized version and diff are available at tools.iet= f.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 >=20 > _______________________________________________ > I-D-Announce mailing list > I-D-Announce@ietf.org > https://www.ietf.org/mailman/listinfo/i-d-announce > Internet-Draft directories: http://www.ietf.org/shadow.html or > ftp://ftp.ietf.org/ietf/1shadow-sites.txt From nobody Tue Apr 28 07:04:49 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A334D3A159C for ; Tue, 28 Apr 2020 07:04:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.188 X-Spam-Level: X-Spam-Status: No, score=-4.188 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HLuLckjMWhCJ for ; Tue, 28 Apr 2020 07:04:45 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 009303A159A for ; Tue, 28 Apr 2020 07:04:44 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 2947038980 for ; Tue, 28 Apr 2020 10:02:46 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id A759698A for ; Tue, 28 Apr 2020 10:04:38 -0400 (EDT) From: Michael Richardson To: rats@ietf.org In-Reply-To: <148655695.5198561588082451834.JavaMail.nobody@rva2rmd102.webex.com> References: <148655695.5198561588082451834.JavaMail.nobody@rva2rmd102.webex.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 25.1.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Rats] new webex URL for Architecture Design Team meeting X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Apr 2020 14:04:48 -0000 --=-=-= Content-Type: text/plain sorry, I let the webex recurrence expire and it won't let me extend it. RATS architecture design team meeting Occurs every Tuesday effective Tuesday, April 28, 2020 from 10:05 AM to 11:20 AM, (UTC-04:00) Eastern Time (US & Canada) 10:05 am | (UTC-04:00) Eastern Time (US & Canada) | 1 hr 15 mins Meeting number (access code): 610 366 750 Meeting password: 4vY2aS6X8DF When it's time, start your meeting. https://ietf.webex.com/ietf/j.php?MTID=m4c3d7395a15dad1ed8c0f95452794c25 -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl6oN/YACgkQgItw+93Q 3WUdsAf/T9y1Z3xwcezz7+CFrZdEBXZpkCvwCjGPBXh1O5bYeuODZOOInZQy3BXC 8O3I2lwYgUfaNTDL5r0m9WzaivlV4jqM2sMZ/cL/AkqjSTQQvrELS7ltB5gaQo3o H210pfS8SiVE1Mg5FwZkWFO9M+Jv/FGelXP6WzfLEge1DvLi8PKai51GUoYKbZXW HTRx6GMoRRNUYEFBDgJSiZu8JdK0EbEQ6Boo+Kp6JQ7kZYpN4ez6oWf79aW4WK9f rjPUZflIPQAoZxnimQiENq2I5HxcGhsqJTdrdf5ckLaiVxVhgW/RdAQW9w8bqmQi BCTKBV6yIkxwAeNbLaNdgtcvNdW1Dw== =8eil -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Apr 29 01:26:05 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B00043A077A for ; Wed, 29 Apr 2020 01:26:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id txfprAgHJujj for ; Wed, 29 Apr 2020 01:26:00 -0700 (PDT) Received: from gabriel-vm-2.zfn.uni-bremen.de (gabriel-vm-2.zfn.uni-bremen.de [134.102.50.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DD1B3A0774 for ; Wed, 29 Apr 2020 01:26:00 -0700 (PDT) Received: from [172.16.42.112] (p548DCD70.dip0.t-ipconnect.de [84.141.205.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-vm-2.zfn.uni-bremen.de (Postfix) with ESMTPSA id 49Bs6G1cDMz10Nb; Wed, 29 Apr 2020 10:25:58 +0200 (CEST) From: Carsten Bormann Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Mao-Original-Outgoing-Id: 609841557.7441241-3b26a8172a3a55bc1662e0bfce275851 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Wed, 29 Apr 2020 10:25:57 +0200 Message-Id: To: rats@ietf.org X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: [Rats] Jim's Jabber questions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Apr 2020 08:26:03 -0000 Yesterday, in the jabber channel, Jim asked two questions that I didn't = see and thus didn't answer. (1) I think that maybe a better name might be unprotected rather than = unsigned=09 A: Indeed! That is such a great idea that the title of = draft-birkholz-rats-uccs-00 is: =C2=BBA CBOR Tag for Unprotected CWT Claims Sets=C2=AB. (2) I assume that a secure channel w/o authentication of both ends is = not secure in this context? Or do you only need to have authenticated = the entity at the end that is providing the claims? A: Also, the emitter of the claims may be interested in authenticating = the receiver, so it knows who it is disclosing the claims to, and the = receiver may not have a good way to authenticate the emitter before = looking at the claims that it receives confidentially (the Web TLS = scenario, in other words). Gr=C3=BC=C3=9Fe, Carsten From nobody Wed Apr 29 06:56:37 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 336CD3A109F for ; Wed, 29 Apr 2020 06:56:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=vGCZku+g; dkim=pass (1024-bit key) header.d=juniper.net header.b=Qyc3m8uK Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HqHS2YQQl7UO for ; Wed, 29 Apr 2020 06:56:33 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3812A3A10B4 for ; Wed, 29 Apr 2020 06:56:33 -0700 (PDT) Received: from pps.filterd (m0108163.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 03TDbgW8021770; Wed, 29 Apr 2020 06:56:31 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : content-type : mime-version; s=PPS1017; bh=jNFM6nYk+vGTVOZWeFu0BcZiH3B8YSFHnYir3LS/1sA=; b=vGCZku+gpj1vke7Avr52QM1p01ythtlxXkJzuFpRt6ppsdnjrqupojuz4wMG47cOFQU5 KB1Bi3dkOEbZjh11xV8Lft3sXhLHNgHvFB7LIj0RMft5Jcf+a17bZHxb002lO07UHzh4 I2bqlWI1kINsPWcRAUD1l8eweTnLTYmjCPkOcFzklroeNIZ6fSxjVBGeI/zfRluGZ7ig l+tLxbusl7JOBbjsTA5n0MdrK5a/xUN2u4htD8zWqYtBS6ZluRWUKqTGAsAEu1Rqfs59 dkWyCeKk0xLlBXLCvCbm/0Cos/y39suIAtJOkgjrTsw/cGKBC+DqW1ZrSNCMkLwajq+6 RQ== Received: from nam11-bn8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2177.outbound.protection.outlook.com [104.47.58.177]) by mx0b-00273201.pphosted.com with ESMTP id 30mhtuyp0g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 29 Apr 2020 06:56:31 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fcfD7l8tcqWuzScESvIAuslqa8ycVtFMZbtUxkxraHpHHb7JqTOfSn35M23+0Y6mjX4loKOKGUnYbyFNScEOvYYSv3Hdgjp9+Ffxv1NZZTBlvLbzTLlAg/ssgaxPcOt7pXmsFku+NA7iIfsetHSwsVEzs56u2B3tQ9xtyVYw5LkRXUtMzpTcc4YNeWvT8SttpEDGBBcsH7Wqpt+E3kxouKYn4A4mWon0hC6GTaszsrFLU1caCIXGqvsvSiITwKYjmlOxhdRioOVRRdck5RwMNPjidMWVwdErFxlBejUQMF2VyFg1DpK3u1pbprEP1adicJj32J5X+lb9FBN6wdaQYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jNFM6nYk+vGTVOZWeFu0BcZiH3B8YSFHnYir3LS/1sA=; b=ac3WvvnLRm/KCWL2d+QWU+oRLNkGV+I/RdXQpXVc2lue1TaBecOZ0IXWR7kq+18GANNyqHhzCdAQva2z+NN3ME/pXBZtOB9hY73QOfhrclqg2vhb3VdSyo2Efdvtd5RX6lS5Casq7BIQssGxmUQmdcB8SManGUxwCC8R15bTKpU2sSKvHUw14y5+BqlluMX78PT9cpXrUhP/EJeXMkM+pAQwDktxqxdxnI5BZcOkiUG+f6fr0yk63u8uLZlyYfbcxVqyXiYZWm4nluEUqfibVtYdqyPLSkW4ABIAbSemQwb/Wi1N9dnBJ/0q+xgU5NYy5eAxTXNFpemUcp4xtT4RpA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jNFM6nYk+vGTVOZWeFu0BcZiH3B8YSFHnYir3LS/1sA=; b=Qyc3m8uKv0JS8xoOsNXHl2JDw7cZcz2UjDCqy69vVDxKF9N2GinGItospjBxEKPOCJoeE7tzlFxS16lYbTpQpjPro00tUOT2tyfkG072OACwNu4vuQ5jH5oAAkNTocNLnlcY1FlO5zXktQ7cZYzltw9Ea36OM/iW8J3TQ2c5Ibc= Received: from DM6PR05MB6889.namprd05.prod.outlook.com (2603:10b6:5:204::22) by DM6PR05MB5100.namprd05.prod.outlook.com (2603:10b6:5:36::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2958.8; Wed, 29 Apr 2020 13:56:29 +0000 Received: from DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1]) by DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1%7]) with mapi id 15.20.2979.013; Wed, 29 Apr 2020 13:56:29 +0000 From: Guy Fedorkow To: Henk Berkholz CC: "rats@ietf.org" , Jessica Fitzgerald-McKay , William Bellingrath Thread-Topic: retrieving reference measurements Thread-Index: AdYeLLsj977MpbIWSBiRE1EIoB5bdg== Date: Wed, 29 Apr 2020 13:56:28 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-29T13:56:26.6866068Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=eea69583-02d4-4ccd-b201-763f49c0bf35; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic dlp-product: dlpe-windows dlp-version: 11.3.2.8 dlp-reaction: no-action authentication-results: sit.fraunhofer.de; dkim=none (message not signed) header.d=none;sit.fraunhofer.de; dmarc=none action=none header.from=juniper.net; x-originating-ip: [66.129.241.10] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 54349b2e-23b9-463c-f1fa-08d7ec451db1 x-ms-traffictypediagnostic: DM6PR05MB5100: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 03883BD916 x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: nzmZSK5gJr6IJhjpbauLXV7pk6YUFOnPsiyzs2a52i+wq1frDHBJEuHis4J6OAL3n/PWgXl2vjv0QHVY22S+G5pOHuQ7YNQL2ZMqWneS3DqmEpCFMdVXroL+VKPZbjgx4a+NNrXrhsjQK7ttgrx3BpCknQ3Di3cHWHieJg/Dv9wAZQxjo8L2sFK/lSW3O0lkxgcxBUpgEHJQy1A8ahRt/NoSbxtYbn5vDDaMbWQWSAWXXPRMhxOzRDaVq1UospPbeNWwOmGXNHBR6LaHZ6c0wIST6n4mhAn6bFi8vqVIEQ7pfnZEtxhpKArd3hCqxcs3hS1J9UmqabYqUVRLO8RjXeUT/anZ+u/YQ3q5N5Tg56yTJAe16zogdUI9CnzwYCmjAgtNK1o4IRYZvziqGD/Cwak0SvQRP0BVSrSO9YpAFxdyU/OAfRhsTd7xZPJH4OUaub4NfqFuAXYT3M64FdAZgNIUiETrnw4hTDntKFhJxddPn26hPruwa/w9DclN/NC5/25Hgl+eP9TKmLssfQ7NWH6l0lIphFI8XqeBvM2iCQtDkkpXs08fhWPGGygdJNzt x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR05MB6889.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(136003)(376002)(396003)(366004)(346002)(8676002)(71200400001)(7116003)(6916009)(966005)(478600001)(107886003)(66476007)(66446008)(9686003)(66616009)(64756008)(55016002)(66574012)(4326008)(4744005)(66556008)(5660300002)(76116006)(66946007)(3480700007)(52536014)(99936003)(26005)(8936002)(7696005)(9326002)(33656002)(186003)(6506007)(54906003)(316002)(2906002)(86362001)(133083001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: GnVW9y3IPCnuEUCWtrSQKl5qjcDR0fgxiqJ1fgo65FFTw//aQX7b0lg53I7Zz9Si1o5STHMCgTTXOf/FKXdw6NK+50i0TV+pyx62X6nmBJ0t79tECyun5uTXiWOoDEPNsrMlIA0gXQNv8ppo+8jJFE7fIa6va1BkKepaKjiaRGuLGTlgVR6VcqfP/nlLsUdVMKl7BsrMZHycAEzpItNFalL032kRcEOqe8d5CS9KJMRxdeTfRKl9K04D3c4Tw4/Y/ppPh/3/BNhpGSA63Ml9zoUXtUHEGVZdPj2VlMixHodOX06EYr8fs/jsmsWg5+nmXBaEIjUm7o09673cVBwTn9xKT7OauEQWzm13icKy93ReCgWgNbll6ZXGFKljdchR9Yq4oRNweiRoml1mBvZbx2Uqc8bxKf3vm4TEOcyOhtfaohMWkvYigArdpBFNHP/5wHRyEqZnbaelneHrbbqF78bEehJx+zu4WvMdTVUn/WRgcTIoQQMqtoDTsZ3oC5GjGq5uVkqcd5fRot2ISof/it7o3zpEnVoRt7N2cwCc12vkculrcyiFJfaWfKoSbiLj1eVh7gCs0D2yvxxooan4gNeICv0WIYJxMo2ZiUonIc7yGyI3Ab2oyxYRFKNKsUG8GfPc3dJD+VsLr+hh47fPegMsMJvzNI9qYOpsJgg/5RUAwdHBzq8Kv/+EnsZTRAxUue9OCQrgq4hUoY+D3pRzSzYy1if+F5xo1rAcJ1BAtCj+gc8/D3m6X1VPS0uBRBpdtE0pBozxh0jVx64eMx6fElSozuJkWc3QonjiWrGmJCc= Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_00F3_01D61E0C.72BE4000" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: 54349b2e-23b9-463c-f1fa-08d7ec451db1 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Apr 2020 13:56:29.0474 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: OB+xJRnlnh8Fn5DgDRiuN1PCEi9V7fapjkG4FEykC0kcef25GknK5KrgxcDkEJmsRXZrM4JBei/tqCtO5R8iVw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR05MB5100 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-29_05:2020-04-29, 2020-04-29 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 mlxlogscore=999 lowpriorityscore=0 suspectscore=0 adultscore=0 spamscore=0 impostorscore=0 clxscore=1015 mlxscore=0 malwarescore=0 priorityscore=1501 phishscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004290115 Archived-At: Subject: [Rats] retrieving reference measurements X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Apr 2020 13:56:35 -0000 ------=_NextPart_000_00F3_01D61E0C.72BE4000 Content-Type: multipart/alternative; boundary="----=_NextPart_001_00F4_01D61E0C.72BE4000" ------=_NextPart_001_00F4_01D61E0C.72BE4000 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi Henk, I see your proposal for identifying URIs for reference measurements in https://tools.ietf.org/html/draft-birkholz-rats-mud-00 I realize that some constrained devices may not want to do this, but do you think draft-charra could be extended to allow retrieval of the signed reference measurements directly from the device being attested, via the YANG / Netconf interface? Ironic as it may sound, I'm sure you know that many operators ensure that their internet routers cannot access the public internet. Thanks, /guy Juniper Business Use Only ------=_NextPart_001_00F4_01D61E0C.72BE4000 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Henk,

I see your = proposal for identifying URIs for reference measurements in https://t= ools.ietf.org/html/draft-birkholz-rats-mud-00

 

  I = realize that some constrained devices may not want to do this, but do = you think draft-charra could be extended to allow retrieval of the = signed reference measurements directly from the device being attested, = via the YANG / Netconf interface?

  Ironic as it may sound, I’m sure you know = that many operators ensure that their internet routers cannot access the = public internet.

 

  = Thanks,

/guy

 


Juniper = Business Use Only

------=_NextPart_001_00F4_01D61E0C.72BE4000-- ------=_NextPart_000_00F3_01D61E0C.72BE4000 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIISJTCCBd4w ggPGoAMCAQICEAH9bTD8o8pRqBu8ZA41Ay0wDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVT MRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhl IFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTEwMDIwMTAwMDAwMFoXDTM4MDExODIzNTk1OVowgYgxCzAJBgNVBAYTAlVT MRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhl IFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sIs9CsVw12 7c0n00ytUINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnGvDoZtF+mvX2do2NCtnby qTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQIjy8/hPwhxR79uQfjtTkUcYRZ0YIUcuG FFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfbIWax1Jt4A8BQOujM8Ny8nkz+rwWWNR9XWrf/zvk9tyy2 9lTdyOcSOk2uTIq3XJq0tyA9yn8iNK5+O2hmAUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnH a4xgk97Exwzf4TKuzJM7UXiVZ4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNVicQN wZNUMBkTrNN9N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5D9kCnusSTJV882sF qV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJWBp/kjbmUZIO8yZ9HE0XvMnsQybQ v0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ5lhCLkMaTLTwJUdZ+gQek9QmRkpQgbLevni3/GcV 4clXhB4PY9bpYrrWX1Uu6lzGKAgEJTm4Diup8kyXHAc/DVL17e8vgg8CAwEAAaNCMEAwHQYDVR0O BBYEFFN5v1qqK0rPVIDh2JvAnfKyA2bLMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/ MA0GCSqGSIb3DQEBDAUAA4ICAQBc1HwNz/cBfUGZZQxzxVKfy/jPmQZ/G9pDFZ+eAlVXlhTxUjwn h5Qo7R86ATeidvxTUMCEm8ZrTrqMIU+ijlVikfNpFdi8iOPEqgv976jpS1UqBiBtVXgpGe5fMFxL JBFV/ySabl4qK+4LTZ9/9wE4lBSVQwcJ+2Cp7hyrEoygml6nmGpZbYs/CPvI0UWvGBVkkBIPcygu xeIkTvxY7PD0Rf4is+svjtLZRWEFwZdvqHZyj4uMNq+/DQXOcY3mpm8fbKZxYsXY0INyDPFnEYkM nBNMcjTfvNVx36px3eG5bIw8El1l2r1XErZDa//l3k1mEVHPma7sF7bocZGM3kn+3TVxohUnlBzP YeMmu2+jZyUhXebdHQsuaBs7gq/sg2eF1JhRdLG5mYCJ/394GVx5SmAukkCuTDcqLMnHYsgOXfc2 W8rgJSUBtN0aB5x3AD/Q3NXsPdT6uz/MhdZvf6kt37kC9/WXmrU12sNnsIdKqSieI47/XCdr4bBP 8wfuAC7UWYfLUkGV6vRH1+5kQVV8jVkCld1incK57loodISlm7eQxwwH3/WJNnQy1ijBsLAL4JxM wxzW/ONptUdGgS+igqvTY0RwxI3/LTO6rY97tXCIrj4Zz0Ao2PzIkLtdmSL1UuZYxR+IMUPuiB3X xo48Q2odpxjefT0W8WL5ypCo/TCCBhAwggP4oAMCAQICEE2ULBDUO+CUCcWBLTorBk8wDQYJKoZI hvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VS VHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE4MTEwMjAwMDAwMFoXDTMwMTIz MTIzNTk1OVowgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO BgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE+MDwGA1UEAxM1U2VjdGln byBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKPO2UCkH/3vlGuejWO+bakr8rEE6qGryCvb4mHCkqKtLN nFCBP22ULvOXqGfV9eNKjkypdR8i0yW2sxpepwRIm4rx20rno0JKuriIMpoqr03E5cWapdfbM3wc caNDZvZe/S/Uvk2TUxA8oDX3F5ZBykYQYVRR3SQ36gejH4v1pXWuN82IKPdsmTqQlo49ps+LbnTe ef8hNfl7xZ8+cbDhW5nv0qGPVgGt/biTkR7WwtMewu2mIr06MbiJBEF2rpn9OVXH+EYB7PmHfpsE kzGp0cul3AhSROpPyx7d53Q97ANyH/yQc+jl9mXm7UHR5ymr+wM3/mwIbnYOz5BTk7kTAgMBAAGj ggFkMIIBYDAfBgNVHSMEGDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUCcDy/Ava lNtf/ivfqJlCz8ngrQAwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBEGA1UdIAQKMAgwBgYEVR0gADBQBgNVHR8ESTBHMEWg Q6BBhj9odHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQ2VydGlmaWNhdGlvbkF1 dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEEajBoMD8GCCsGAQUFBzAChjNodHRwOi8vY3J0LnVzZXJ0 cnVzdC5jb20vVVNFUlRydXN0UlNBQWRkVHJ1c3RDQS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9v Y3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBAEFEdQCrOcIV9d6OlW0ycWiMAN0X 13ocEDiQyOOxvRcxkfO244K0oX7GzCGHYaqRbklCszzNWVT4DZU/vYrLaeVEDUbCYg+Ci7vhNn9d NqscbzN0xKBoOuRVjPPWDechU70geT3pXCxpwi8EXwl+oiz7xpYfY99JSs3E/piztTSxljHitcPr 5yoWr9lbkFR8KU3+uGTZ11BfKfuSSaRrZFBv133SeY0d2AqvB9Dj2ZDaFZA0OQkkhfAqNgDpVRH9 9lQV4JSKx0N7/QAEtMj6OF5dRXV6hhXuU3A0Eql4d0247oBpxvnfcmV95QfG8HP059hZSJe7T2ww C+IzXVDQO4xnnvrQJ07ZWemxc/grFpgiG+o+pQxapF1bKftysi02Rl6uhdp5wbTeLeYzt2SI9oKS ChwGDQQFixtkNnxuwbdrTwvASwvViDPdIGzIQJrTBqriE5/9nzkXbDZmld8/7DyriJ/A73RIZllX 4dH8mHqsRpU8NEX8IQZWpHWGK5A5nVgvl7MxNfRlIvCvKZQTSnCL8oNqJgHXm6zCB4gBwDonM8V/ 2kuQAUVazVA3I376eIWGwzjuqh3H88v7mNHzubLHm5h0ERCSQNz6UoHVZy3q5xeqbYSaxpDQz3lC NObL6sNaOQNh3DcyzqZJYTcGfuLlmC3AIteAAh7lbybJszYnMIIGKzCCBROgAwIBAgIRAPuElTZ4 EhaY10ByhNJltnIwDQYJKoZIhvcNAQELBQAwgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVh dGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRl ZDE+MDwGA1UEAxM1U2VjdGlnbyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUg RW1haWwgQ0EwHhcNMTkwODI0MDAwMDAwWhcNMjIwODIzMjM1OTU5WjCCATcxCzAJBgNVBAYTAlVT MQ4wDAYDVQQREwU5NDA4OTELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVN1bm55dmFsZTEcMBoGA1UE CRMTMTEzMyBJbm5vdmF0aW9uIFdheTEeMBwGA1UEChMVSnVuaXBlciBOZXR3b3JrcywgSW5jMR4w HAYDVQQLExVTb2Z0d2FyZSBFbmdpbmVlciBMYWIxOzA5BgNVBAsTMklzc3VlZCB0aHJvdWdoIEp1 bmlwZXIgTmV0d29ya3MsIEluYyBFLVBLSSBNYW5hZ2VyMR8wHQYDVQQLExZDb3Jwb3JhdGUgU2Vj dXJlIEVtYWlsMRUwEwYDVQQDEwxHdXkgRmVkb3Jrb3cxJDAiBgkqhkiG9w0BCQEWFWdmZWRvcmtv d0BqdW5pcGVyLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL2Fewgz3OFG1Go3 cuoLYIbLNRTSEFgN+GLUaqB6g5VuCf0UTvgARSlxgDmsvE5qwTtb8JOtJ64OylVNvz28uslsfvg4 WCc0InZUo1B6JkgNamxa3HI31h63s5wVm/wZgglg5Dv7WH7gmAPrgeoWpBC2GN1sxWHfcJOi2fzg M5LWst0Iwz4M7vqFsZ77AOkUFDNm5p19Fu8HRjVlsE0fNGieZB5GEiL2CN2YoxyOKrJdqWHNMkK8 Q5owvlDnSR0tb8oJgHDX8EESSo5TDA5zqnva48zFfFWCrOdobNgf1To4uBskX6B+QEmrSNLuSdpK JOHw9IdrPofgpjZCmFwvtS8CAwEAAaOCAc4wggHKMB8GA1UdIwQYMBaAFAnA8vwL2pTbX/4r36iZ Qs/J4K0AMB0GA1UdDgQWBBQPfL+xFDoZAlQisKraMq/Y34eQGjAOBgNVHQ8BAf8EBAMCBaAwDAYD VR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwQAYDVR0gBDkwNzA1Bgwr BgEEAbIxAQIBAQEwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwWgYDVR0f BFMwUTBPoE2gS4ZJaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUlNBQ2xpZW50QXV0aGVu dGljYXRpb25hbmRTZWN1cmVFbWFpbENBLmNybDCBigYIKwYBBQUHAQEEfjB8MFUGCCsGAQUFBzAC hklodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFu ZFNlY3VyZUVtYWlsQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAg BgNVHREEGTAXgRVnZmVkb3Jrb3dAanVuaXBlci5uZXQwDQYJKoZIhvcNAQELBQADggEBALilLU71 sn7XVNFoUU4MqcHXXFiFiOjCQmq1nqijMa6L4fKm/VX9LZtrsQs3CZTUiHuW2pyLapLVIEXdubNX L877oIVJmeAoSWz1+AYelK6CIpuGUUcGSsXKd4Xl9yOTrmLb7PTjrRpXsWSHJi//jrXTrR/X6M+U TterfzhR5gYPFyvX65Zie9M7k7V2yB3YJJPzT8EtfrJc+eDzYAgiWK8X/ToMZOG7noa/Er8FEARn joL7pKHVOkHTOM9UNaublWlhiUEzzXx9kYPKjgqjAetRo4zh1KBFm9MBlXeigAVBx+BQpP0OdmHb 5vcX3pUR4lkRpnVeLKFR++q6z+bViYAxggRnMIIEYwIBATCBrDCBljELMAkGA1UEBhMCR0IxGzAZ BgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2Vj dGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGllbnQgQXV0aGVudGljYXRpb24g YW5kIFNlY3VyZSBFbWFpbCBDQQIRAPuElTZ4EhaY10ByhNJltnIwCQYFKw4DAhoFAKCCAo8wGAYJ KoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjAwNDI5MTM1NjI2WjAjBgkq hkiG9w0BCQQxFgQUkotIUyd1i6riienr7j1Hx/XbLj8wga0GCSqGSIb3DQEJDzGBnzCBnDALBgkq hkiG9w0BAQcwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQME AQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIaMAsGCSqGSIb3DQEBCjAL BglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAsGCWCGSAFlAwQCATCBvQYJKwYBBAGCNxAEMYGvMIGs MIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdT YWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENs aWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhEA+4SVNngSFpjXQHKE0mW2 cjCBvwYLKoZIhvcNAQkQAgsxga+ggawwgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVy IE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE+ MDwGA1UEAxM1U2VjdGlnbyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1h aWwgQ0ECEQD7hJU2eBIWmNdAcoTSZbZyMA0GCSqGSIb3DQEBAQUABIIBAJz9XvRFSEwKE4CjKt3p 51vTQxaS5gOfi+gO90eAdGOceyCfJOVlKXPc5AHmk5O6SRfKX3y9cBVXfyQTpHZHyC+dG5MjtsT1 Bioy0gF2EV2v8cLn4lHB33z7sqHUVAQtyl45u3sSt1praaIlUpvuoFcCkeSohUTs+X/hfniZg/Qm pM2bIuGWhbQ0mFGeVB2MRQClCkAgAfynrK7FBeZJyZg/zoSpaqMB1Mq0us52gqDpjhf+mJat6dq4 ayDmYtdwhz9Vgl7lK05Okx0yBp30EATf/fK9RigK/txrC8eShm8nhNMrlCGakBhFumG3l4OPWK5e li/PmJMnbcXqpkNRm6IAAAAAAAA= ------=_NextPart_000_00F3_01D61E0C.72BE4000-- From nobody Wed Apr 29 08:29:43 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC7EF3A12ED for ; Wed, 29 Apr 2020 08:29:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3q-jMWogxhA2 for ; Wed, 29 Apr 2020 08:29:39 -0700 (PDT) Received: from mail-edgeKA27.fraunhofer.de (mail-edgeka27.fraunhofer.de [153.96.1.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C5303A12F2 for ; Wed, 29 Apr 2020 08:29:37 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2HCCQAfnKle/xoHYZlmgQmDcW4DVS8?= =?us-ascii?q?0lHUtm1oLAQEBAQEBAQEBBgEBIwoCBAEBAoRCAoIuJDgTAhABAQYBAQEBAQU?= =?us-ascii?q?EAgJphVYMg1R+AQEBAQEBAQEBAQEBAQEBAQEBARYCQ1USAR8BBTIBBUEQCw4?= =?us-ascii?q?KLlcGDQEHAQEXgwsBgnsFC7MzgTSEPQKBEYNUgToGgTiMQQ+BTD+BOA+CWj6?= =?us-ascii?q?CZwEBA4FKhgoEsRGBJAeBS31/BIcQj24jkAIFjQCZUJNCAgQCCQIVgWkjgVZ?= =?us-ascii?q?NJIM5TxgNm0GFRIEoAgYBBwEBAwl8kF4BgQoFAQE?= X-IPAS-Result: =?us-ascii?q?A2HCCQAfnKle/xoHYZlmgQmDcW4DVS80lHUtm1oLAQEBA?= =?us-ascii?q?QEBAQEBBgEBIwoCBAEBAoRCAoIuJDgTAhABAQYBAQEBAQUEAgJphVYMg1R+A?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBARYCQ1USAR8BBTIBBUEQCw4KLlcGDQEHAQEXg?= =?us-ascii?q?wsBgnsFC7MzgTSEPQKBEYNUgToGgTiMQQ+BTD+BOA+CWj6CZwEBA4FKhgoEs?= =?us-ascii?q?RGBJAeBS31/BIcQj24jkAIFjQCZUJNCAgQCCQIVgWkjgVZNJIM5TxgNm0GFR?= =?us-ascii?q?IEoAgYBBwEBAwl8kF4BgQoFAQE?= X-IronPort-AV: E=Sophos;i="5.73,332,1583190000"; d="scan'208";a="21570812" Received: from mail-mtas26.fraunhofer.de ([153.97.7.26]) by mail-edgeKA27.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Apr 2020 17:29:32 +0200 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BHDQDUnKle/1lIDI1mgQmDcW4DVDA?= =?us-ascii?q?0lHUtm1oLAQMBAQEBAQYBASMKAgQBAYREAoItJDgTAhABAQUBAQECAQUEbYV?= =?us-ascii?q?WDIVyAQUyAQVBEAsOCi5XBg0BBwEBF4MLAYMAC7M5gTSEPQKBEYNZgToGgTi?= =?us-ascii?q?MQQ+BTD+BOA+CWj6CZwEBA4FKhgoEsRGBJAeBS31/BIcQj24jkAIFjQCZUJN?= =?us-ascii?q?CAgQCCQIVgWkigVZNJIM5TxgNm0GFREFnAgYBBwEBAwl8kF4BgQoFAQE?= X-IronPort-AV: E=Sophos;i="5.73,332,1583190000"; d="scan'208";a="112610206" Received: from mailext.sit.fraunhofer.de ([141.12.72.89]) by mail-mtaS26.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Apr 2020 17:29:28 +0200 Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 03TFTRg0010066 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Wed, 29 Apr 2020 17:29:28 +0200 Received: from [192.168.16.50] (79.234.123.239) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Wed, 29 Apr 2020 17:29:22 +0200 To: Guy Fedorkow CC: "rats@ietf.org" , Jessica Fitzgerald-McKay , William Bellingrath References: From: Henk Birkholz Message-ID: <96c6bf0f-024d-972e-333f-edd288f3920f@sit.fraunhofer.de> Date: Wed, 29 Apr 2020 17:29:21 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [79.234.123.239] Archived-At: Subject: Re: [Rats] retrieving reference measurements X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Apr 2020 15:29:42 -0000 Hi Guy, I think it would be strange for a network equipment device to expose a potentially vulnerable management to the open internet, too :) Luckily, there will probably be a "higher level" constituent in the network that an Attester's DevID can be presented to (typically this is or is close to a device that is also a Verifier). And these systems generally have a way to "reach out" to the internet. The typically already existing "path" to follow here is the way updates find their way to a "network equipment device". If you are air-gap'ed or completely isolated wrt every layer 2 topology, it may start to become a bit tricky, but your are running around with usb sticks in hand to do updates then, too. YANG is a big solution for big problems. But you can use a YANG server to retrieve RIM that are stored on the Attester itself, of course. These probably are outdated at some point and then leave you with the same illustrated above, again. Viele Grüße, Henk On 29.04.20 15:56, Guy Fedorkow wrote: > Hi Henk, > > I see your proposal for identifying URIs for reference measurements in > https://tools.ietf.org/html/draft-birkholz-rats-mud-00 > >   I realize that some constrained devices may not want to do this, but > do you think draft-charra could be extended to allow retrieval of the > signed reference measurements directly from the device being attested, > via the YANG / Netconf interface? > >   Ironic as it may sound, I’m sure you know that many operators ensure > that their internet routers cannot access the public internet. > >   Thanks, > > /guy > > > Juniper Business Use Only > From nobody Wed Apr 29 09:19:22 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CB8E3A139D for ; Wed, 29 Apr 2020 09:19:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=wUunEwNy; dkim=pass (1024-bit key) header.d=juniper.net header.b=LFPaWmjE Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2hBymvXWA__e for ; Wed, 29 Apr 2020 09:19:17 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 976B63A1399 for ; Wed, 29 Apr 2020 09:19:17 -0700 (PDT) Received: from pps.filterd (m0108160.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 03TG2Ep4007758; Wed, 29 Apr 2020 09:19:16 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=wByITQDSW+zVAlkRyHRTK/6CERqyCAqUHn0Z4xb4vrs=; b=wUunEwNyiSYJBOZ+oEJVVONLNk25Qkpl3PMcrn8lKP/pNWl7H9DxmKgMVGkLBsu0mEDw CrwapMpswgE/06xWUD1s7o40zbQXbTCuuJye3XvUuCMH37vG6HDAU9iILzQe2XpTCoje OAptQJ/RGvsGFDRx2HcvxbLlzKu9nBW6dDCTlbDcaoOJMVco5L7C2PJhrBbnkQhVNtwc wXHNVfgHgRQoUaswGNAlhYyAXysO7fvqfP5GihCJZamEjHY4pXrUDclxIEx0igg+GM/C R0vMRx5plz+7pfDNont7DovM/XTIibNhHnTAQjy9yScjGqHbdE8Pqfi+Ayy+RRDe73eM 1g== Received: from nam02-cy1-obe.outbound.protection.outlook.com (mail-cys01nam02lp2058.outbound.protection.outlook.com [104.47.37.58]) by mx0b-00273201.pphosted.com with ESMTP id 30mk4fyu25-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 29 Apr 2020 09:19:15 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Enu9+YU9+FpoFSb236KZ0Binr0r0tzzQDic4pcWlxPxE6KAGqN9p4hTbkdvgO5dzGXR4Bj0nLoRGBflUqHNCCfqrgGS3ItVR9D2uKnyVrBzk5Ur0wJ2wamvwlub69y/VbjDnzA2rBKtzTFWWB5tyvTx/66wwqGBmQF3hpa2NFsUgTEseEB4Q6kRF3XC1f/H0bSuW98oNEXAw2VmhCsZlg7zzshCTyg7E3dva16JzG3qIIXtNzMST29tI8RBJPEXPrO9sn7oWZOBSqkdx+F6TUkh7wb5SVh9TlIK3JEfRJn/sa+8JNJ6oltI4T7hHvJiuqrLMtDe2F6hLNRSr09u//w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wByITQDSW+zVAlkRyHRTK/6CERqyCAqUHn0Z4xb4vrs=; b=GMk/eMWZSCIrHm4PU85TfPc8gNmnz1H1rTR2KIQXb4PtB7N+n/Edrvn4a1Lo083tVpi26KBOfr0Cf8gwtLEmv2OrAl2MATc5V9dpoKnIdqrEWErl7P3EBNinb8SPvvaHENsxiB/7el1jt4eU4SkRjL8g7HAc+pDxCHndAS2BCUQdkX7eLJfXq55QnzGZTsrgNiOl7drDKj0KySSyiingUvQvIi5hjDu+I7NywJZpiNiCD0JQLfIXHwpLb4pqeF4rZIwbYPHwJZhDC1lnGQDQ6XX3CicUnt4hmA1PC+gbdPKgorz2/hBqxlZcViTl/hy6iXcRA6TiNp21a+9jOxZe6Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wByITQDSW+zVAlkRyHRTK/6CERqyCAqUHn0Z4xb4vrs=; b=LFPaWmjEbgptLp0zmwux6r3urDGHjjnNxuOpTXME3kN3N5GEoADqIV4g/xzXz8yjgdFDMOjh41EPfY70gj/BofVI26Fkp/xdxv6DC28ZrXSq7b/crzCQk9gCf7PXDA8t/FWWI/F8QppN+jYX26ZSmLaSuFG/NVrGyk6IHOQmOa8= Received: from DM6PR05MB6889.namprd05.prod.outlook.com (2603:10b6:5:204::22) by DM6SPR01MB0080.namprd05.prod.outlook.com (2603:10b6:5:1c1::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2979.11; Wed, 29 Apr 2020 16:19:13 +0000 Received: from DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1]) by DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1%7]) with mapi id 15.20.2979.013; Wed, 29 Apr 2020 16:19:13 +0000 From: Guy Fedorkow To: Henk Birkholz CC: "rats@ietf.org" , Jessica Fitzgerald-McKay , William Bellingrath Thread-Topic: retrieving reference measurements Thread-Index: AdYeLLsj977MpbIWSBiRE1EIoB5bdgADjkuAAAFrpgA= Date: Wed, 29 Apr 2020 16:19:13 +0000 Message-ID: References: <96c6bf0f-024d-972e-333f-edd288f3920f@sit.fraunhofer.de> In-Reply-To: <96c6bf0f-024d-972e-333f-edd288f3920f@sit.fraunhofer.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-29T16:19:10.2462358Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=58b322b0-9e0e-499f-aa89-36ec28860dca; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic dlp-product: dlpe-windows dlp-version: 11.3.2.8 dlp-reaction: no-action authentication-results: sit.fraunhofer.de; dkim=none (message not signed) header.d=none;sit.fraunhofer.de; dmarc=none action=none header.from=juniper.net; x-originating-ip: [66.129.241.10] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: bfdf4180-f2b4-4b19-6136-08d7ec590e5d x-ms-traffictypediagnostic: DM6SPR01MB0080: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 03883BD916 x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 2lxepaAL8Us4lILXguSWgxx3wXCgljtrEJFRrS6HCC1UUg3gBdSaM5emkXOd5lPev67kP8tKPMecd1ZEyLpgpF80/hVva56liDZYV3rKR1SgJBwVIX0bZAGYNHHhbPhmY2wB51cks50uZ3kFZPJKUG51ve1xutzPswtTpWTMTlAye29PAVjf8DEbgVhmBNbgDLy7Uq+64r7w2TEFW0VVSksRUCP3qvJR566M3sTb0KlrgHWSpZ/FT3yePgt72BIEi31YTP4SohCtOXxZak25Ii1PL3GX49NhGOU1lhcUqPr/g6QjBHsnpL7CoPbjAeJWp0JbfFolQlzb1RiaWGt3ZHfHE51H+2PYyS7pklaY9mBXJLeAqwJFtf2Xp6B+7XAyHJ5dLeLkix2kq+S2i7X0KlvI4JDeT6M0j7tdnNHF/hBlrc71PQEP9Iu0z/dnoKB4sfyWtpBcBM7dI3z27jqceLFQ4ikMN2NVDYkKgFC6IJGLJzfbSRFCeGCIEXg/I/8Xb6mzwWFKzMEeIFdefosaBg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR05MB6889.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(376002)(39860400002)(366004)(396003)(136003)(7696005)(6916009)(71200400001)(3480700007)(7116003)(316002)(26005)(5660300002)(2906002)(107886003)(55016002)(8936002)(66446008)(966005)(66616009)(66476007)(33656002)(66574012)(66556008)(64756008)(66946007)(54906003)(76116006)(4326008)(99936003)(478600001)(9686003)(6506007)(8676002)(186003)(53546011)(52536014)(86362001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: d+MrXMLR50aVqvmDJ4XtRUR6gthH4JE598SmftXhaWvuQ/k67XRCZ10rHpMeVKyo9emi6wP9aMwjJ61UAxHq71vfllZ42rjc8gpZGn41siFqpgnLrl6srOIlgPaWIHO3DICU+w5EHy1lp3N978A+fU6D8xPyCKlO1ptz93nwV0VKDcvK5bSB7zxc13bILVonj6r0z0x9KaEgN8Jd7mSl9vndNLxoROUBI7kjQ9xIRcdJ/CAUFb/4c8jXn76e+NhU3evHTYiWvKX43xVLUjkxKGTTviESWvZrrtOXgJURY5+u+dEdw7g2WcTlJ2GK03Mi4TORL/y5DJ8Gqpr6Hj6uCUjXrBXu7xJ85Vmc1d165BBSsEgtkFkDE0TEmOpic8oNjCWmHkkePTTXY54BtybEqSXHCNogmxxnfhg5GUg5hxoj7u3/NkfGyu3718upKtViZycjrTqOwXNhiL4xI7ZI2s5xLg/Vup8feHdb3wwITQk5Lt8dlFhDkWg5vPxmiX1fAynvyZXaqtLJJZtfOVOfnsdUHgRPDEKMIDHT9E6pCRfDQN9l40U9e5RCniqr95otKmX6qAYKvtWNLd6P7pjiEsWh88AWTjpyftJ/VCFxYKwR/u2854jK+AOjZn1gHslMlgBKAzx8C5TPp5QwJ3sBbIaA16ORzb0rMSgGAHUbJxq/kLAfrTPOqVDzurkF3JGHuOO7ig8Dx/Zh/yuHBMTBIuzNtc6rckkywhjAZXd4hNsS1UKP46UoOP5q0C9xE+HMcYDSY6jH/aEvMkOtgs/YcUqVBB1ck1XKXO3I0By/+nI= Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_01CD_01D61E20.63184510" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: bfdf4180-f2b4-4b19-6136-08d7ec590e5d X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Apr 2020 16:19:13.3099 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: obTOVXFPFuqj0y9jfHjBROQjJa8pdfV91+wrk4P+qJGowh5oFCGOmvuwqw1tVtok1aHdcOliarInykf10Y7a1w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6SPR01MB0080 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-29_08:2020-04-29, 2020-04-29 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 suspectscore=0 mlxlogscore=999 impostorscore=0 bulkscore=0 phishscore=0 lowpriorityscore=0 adultscore=0 spamscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004290130 Archived-At: Subject: Re: [Rats] retrieving reference measurements X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Apr 2020 16:19:20 -0000 ------=_NextPart_000_01CD_01D61E20.63184510 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Henk, I understand that third-party RIMs could be used, but for embedded equipment, it seems like the easiest path is to deliver the RIMs as part = of the vendor's software update package for the device. Operators have well-worn procedures for getting software updates to devices; if the RIM = is just part of the package, they don't have to think about a new procedure = at all... Maybe not for everyone, but it seems like it would be a common = use-case... Thanks /guy Juniper Business Use Only -----Original Message----- From: Henk Birkholz =20 Sent: Wednesday, April 29, 2020 11:29 AM To: Guy Fedorkow Cc: rats@ietf.org; Jessica Fitzgerald-McKay ; = William Bellingrath Subject: Re: retrieving reference measurements [External Email. Be cautious of content] Hi Guy, I think it would be strange for a network equipment device to expose a potentially vulnerable management to the open internet, too :) Luckily, there will probably be a "higher level" constituent in the = network that an Attester's DevID can be presented to (typically this is or is = close to a device that is also a Verifier). And these systems generally have a = way to "reach out" to the internet. The typically already existing "path" to follow here is the way updates = find their way to a "network equipment device". If you are air-gap'ed or completely isolated wrt every layer 2 topology, it may start to become a = bit tricky, but your are running around with usb sticks in hand to do = updates then, too. YANG is a big solution for big problems. But you can use a YANG server = to retrieve RIM that are stored on the Attester itself, of course. These probably are outdated at some point and then leave you with the same illustrated above, again. Viele Gr=FC=DFe, Henk On 29.04.20 15:56, Guy Fedorkow wrote: > Hi Henk, > > I see your proposal for identifying URIs for reference measurements in = > https://urldefense.com/v3/__https://tools.ietf.org/html/draft-birkholz > -rats-mud-00__;!!NEt6yMaO-gk!WdyQ3vQ51adw93UKoSwWvgPFs4395vPIWLjuzRBiF > gldobaQ_dLIeFbhOWan0kBLDLY$ > > I realize that some constrained devices may not want to do this,=20 > but do you think draft-charra could be extended to allow retrieval of=20 > the signed reference measurements directly from the device being=20 > attested, via the YANG / Netconf interface? > > Ironic as it may sound, I=92m sure you know that many operators=20 > ensure that their internet routers cannot access the public internet. > > Thanks, > > /guy > > > Juniper Business Use Only > ------=_NextPart_000_01CD_01D61E20.63184510 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIISJTCCBd4w ggPGoAMCAQICEAH9bTD8o8pRqBu8ZA41Ay0wDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVT MRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhl IFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTEwMDIwMTAwMDAwMFoXDTM4MDExODIzNTk1OVowgYgxCzAJBgNVBAYTAlVT MRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhl IFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sIs9CsVw12 7c0n00ytUINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnGvDoZtF+mvX2do2NCtnby qTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQIjy8/hPwhxR79uQfjtTkUcYRZ0YIUcuG FFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfbIWax1Jt4A8BQOujM8Ny8nkz+rwWWNR9XWrf/zvk9tyy2 9lTdyOcSOk2uTIq3XJq0tyA9yn8iNK5+O2hmAUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnH a4xgk97Exwzf4TKuzJM7UXiVZ4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNVicQN wZNUMBkTrNN9N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5D9kCnusSTJV882sF qV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJWBp/kjbmUZIO8yZ9HE0XvMnsQybQ v0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ5lhCLkMaTLTwJUdZ+gQek9QmRkpQgbLevni3/GcV 4clXhB4PY9bpYrrWX1Uu6lzGKAgEJTm4Diup8kyXHAc/DVL17e8vgg8CAwEAAaNCMEAwHQYDVR0O BBYEFFN5v1qqK0rPVIDh2JvAnfKyA2bLMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/ MA0GCSqGSIb3DQEBDAUAA4ICAQBc1HwNz/cBfUGZZQxzxVKfy/jPmQZ/G9pDFZ+eAlVXlhTxUjwn h5Qo7R86ATeidvxTUMCEm8ZrTrqMIU+ijlVikfNpFdi8iOPEqgv976jpS1UqBiBtVXgpGe5fMFxL JBFV/ySabl4qK+4LTZ9/9wE4lBSVQwcJ+2Cp7hyrEoygml6nmGpZbYs/CPvI0UWvGBVkkBIPcygu xeIkTvxY7PD0Rf4is+svjtLZRWEFwZdvqHZyj4uMNq+/DQXOcY3mpm8fbKZxYsXY0INyDPFnEYkM nBNMcjTfvNVx36px3eG5bIw8El1l2r1XErZDa//l3k1mEVHPma7sF7bocZGM3kn+3TVxohUnlBzP YeMmu2+jZyUhXebdHQsuaBs7gq/sg2eF1JhRdLG5mYCJ/394GVx5SmAukkCuTDcqLMnHYsgOXfc2 W8rgJSUBtN0aB5x3AD/Q3NXsPdT6uz/MhdZvf6kt37kC9/WXmrU12sNnsIdKqSieI47/XCdr4bBP 8wfuAC7UWYfLUkGV6vRH1+5kQVV8jVkCld1incK57loodISlm7eQxwwH3/WJNnQy1ijBsLAL4JxM wxzW/ONptUdGgS+igqvTY0RwxI3/LTO6rY97tXCIrj4Zz0Ao2PzIkLtdmSL1UuZYxR+IMUPuiB3X xo48Q2odpxjefT0W8WL5ypCo/TCCBhAwggP4oAMCAQICEE2ULBDUO+CUCcWBLTorBk8wDQYJKoZI hvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VS VHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE4MTEwMjAwMDAwMFoXDTMwMTIz MTIzNTk1OVowgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO BgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE+MDwGA1UEAxM1U2VjdGln byBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKPO2UCkH/3vlGuejWO+bakr8rEE6qGryCvb4mHCkqKtLN nFCBP22ULvOXqGfV9eNKjkypdR8i0yW2sxpepwRIm4rx20rno0JKuriIMpoqr03E5cWapdfbM3wc caNDZvZe/S/Uvk2TUxA8oDX3F5ZBykYQYVRR3SQ36gejH4v1pXWuN82IKPdsmTqQlo49ps+LbnTe ef8hNfl7xZ8+cbDhW5nv0qGPVgGt/biTkR7WwtMewu2mIr06MbiJBEF2rpn9OVXH+EYB7PmHfpsE kzGp0cul3AhSROpPyx7d53Q97ANyH/yQc+jl9mXm7UHR5ymr+wM3/mwIbnYOz5BTk7kTAgMBAAGj ggFkMIIBYDAfBgNVHSMEGDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUCcDy/Ava lNtf/ivfqJlCz8ngrQAwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBEGA1UdIAQKMAgwBgYEVR0gADBQBgNVHR8ESTBHMEWg Q6BBhj9odHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQ2VydGlmaWNhdGlvbkF1 dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEEajBoMD8GCCsGAQUFBzAChjNodHRwOi8vY3J0LnVzZXJ0 cnVzdC5jb20vVVNFUlRydXN0UlNBQWRkVHJ1c3RDQS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9v Y3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBAEFEdQCrOcIV9d6OlW0ycWiMAN0X 13ocEDiQyOOxvRcxkfO244K0oX7GzCGHYaqRbklCszzNWVT4DZU/vYrLaeVEDUbCYg+Ci7vhNn9d NqscbzN0xKBoOuRVjPPWDechU70geT3pXCxpwi8EXwl+oiz7xpYfY99JSs3E/piztTSxljHitcPr 5yoWr9lbkFR8KU3+uGTZ11BfKfuSSaRrZFBv133SeY0d2AqvB9Dj2ZDaFZA0OQkkhfAqNgDpVRH9 9lQV4JSKx0N7/QAEtMj6OF5dRXV6hhXuU3A0Eql4d0247oBpxvnfcmV95QfG8HP059hZSJe7T2ww C+IzXVDQO4xnnvrQJ07ZWemxc/grFpgiG+o+pQxapF1bKftysi02Rl6uhdp5wbTeLeYzt2SI9oKS ChwGDQQFixtkNnxuwbdrTwvASwvViDPdIGzIQJrTBqriE5/9nzkXbDZmld8/7DyriJ/A73RIZllX 4dH8mHqsRpU8NEX8IQZWpHWGK5A5nVgvl7MxNfRlIvCvKZQTSnCL8oNqJgHXm6zCB4gBwDonM8V/ 2kuQAUVazVA3I376eIWGwzjuqh3H88v7mNHzubLHm5h0ERCSQNz6UoHVZy3q5xeqbYSaxpDQz3lC NObL6sNaOQNh3DcyzqZJYTcGfuLlmC3AIteAAh7lbybJszYnMIIGKzCCBROgAwIBAgIRAPuElTZ4 EhaY10ByhNJltnIwDQYJKoZIhvcNAQELBQAwgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVh dGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRl ZDE+MDwGA1UEAxM1U2VjdGlnbyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUg RW1haWwgQ0EwHhcNMTkwODI0MDAwMDAwWhcNMjIwODIzMjM1OTU5WjCCATcxCzAJBgNVBAYTAlVT MQ4wDAYDVQQREwU5NDA4OTELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVN1bm55dmFsZTEcMBoGA1UE CRMTMTEzMyBJbm5vdmF0aW9uIFdheTEeMBwGA1UEChMVSnVuaXBlciBOZXR3b3JrcywgSW5jMR4w HAYDVQQLExVTb2Z0d2FyZSBFbmdpbmVlciBMYWIxOzA5BgNVBAsTMklzc3VlZCB0aHJvdWdoIEp1 bmlwZXIgTmV0d29ya3MsIEluYyBFLVBLSSBNYW5hZ2VyMR8wHQYDVQQLExZDb3Jwb3JhdGUgU2Vj dXJlIEVtYWlsMRUwEwYDVQQDEwxHdXkgRmVkb3Jrb3cxJDAiBgkqhkiG9w0BCQEWFWdmZWRvcmtv d0BqdW5pcGVyLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL2Fewgz3OFG1Go3 cuoLYIbLNRTSEFgN+GLUaqB6g5VuCf0UTvgARSlxgDmsvE5qwTtb8JOtJ64OylVNvz28uslsfvg4 WCc0InZUo1B6JkgNamxa3HI31h63s5wVm/wZgglg5Dv7WH7gmAPrgeoWpBC2GN1sxWHfcJOi2fzg M5LWst0Iwz4M7vqFsZ77AOkUFDNm5p19Fu8HRjVlsE0fNGieZB5GEiL2CN2YoxyOKrJdqWHNMkK8 Q5owvlDnSR0tb8oJgHDX8EESSo5TDA5zqnva48zFfFWCrOdobNgf1To4uBskX6B+QEmrSNLuSdpK JOHw9IdrPofgpjZCmFwvtS8CAwEAAaOCAc4wggHKMB8GA1UdIwQYMBaAFAnA8vwL2pTbX/4r36iZ Qs/J4K0AMB0GA1UdDgQWBBQPfL+xFDoZAlQisKraMq/Y34eQGjAOBgNVHQ8BAf8EBAMCBaAwDAYD VR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwQAYDVR0gBDkwNzA1Bgwr BgEEAbIxAQIBAQEwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwWgYDVR0f BFMwUTBPoE2gS4ZJaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUlNBQ2xpZW50QXV0aGVu dGljYXRpb25hbmRTZWN1cmVFbWFpbENBLmNybDCBigYIKwYBBQUHAQEEfjB8MFUGCCsGAQUFBzAC hklodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFu ZFNlY3VyZUVtYWlsQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAg BgNVHREEGTAXgRVnZmVkb3Jrb3dAanVuaXBlci5uZXQwDQYJKoZIhvcNAQELBQADggEBALilLU71 sn7XVNFoUU4MqcHXXFiFiOjCQmq1nqijMa6L4fKm/VX9LZtrsQs3CZTUiHuW2pyLapLVIEXdubNX L877oIVJmeAoSWz1+AYelK6CIpuGUUcGSsXKd4Xl9yOTrmLb7PTjrRpXsWSHJi//jrXTrR/X6M+U TterfzhR5gYPFyvX65Zie9M7k7V2yB3YJJPzT8EtfrJc+eDzYAgiWK8X/ToMZOG7noa/Er8FEARn joL7pKHVOkHTOM9UNaublWlhiUEzzXx9kYPKjgqjAetRo4zh1KBFm9MBlXeigAVBx+BQpP0OdmHb 5vcX3pUR4lkRpnVeLKFR++q6z+bViYAxggRnMIIEYwIBATCBrDCBljELMAkGA1UEBhMCR0IxGzAZ BgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2Vj dGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGllbnQgQXV0aGVudGljYXRpb24g YW5kIFNlY3VyZSBFbWFpbCBDQQIRAPuElTZ4EhaY10ByhNJltnIwCQYFKw4DAhoFAKCCAo8wGAYJ KoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjAwNDI5MTYxOTEwWjAjBgkq hkiG9w0BCQQxFgQUcASn7XZE2XW0ZiFN5AscRR3nk9Uwga0GCSqGSIb3DQEJDzGBnzCBnDALBgkq hkiG9w0BAQcwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQME AQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIaMAsGCSqGSIb3DQEBCjAL BglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAsGCWCGSAFlAwQCATCBvQYJKwYBBAGCNxAEMYGvMIGs MIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdT YWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENs aWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhEA+4SVNngSFpjXQHKE0mW2 cjCBvwYLKoZIhvcNAQkQAgsxga+ggawwgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVy IE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE+ MDwGA1UEAxM1U2VjdGlnbyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1h aWwgQ0ECEQD7hJU2eBIWmNdAcoTSZbZyMA0GCSqGSIb3DQEBAQUABIIBAJ24aGC6RH94gmL0HVlm 7T80Rk6MFYXAWyoHTP6sldatBj0Z5XSRkTt/zw1CwOOhBPfCYkdUML6tCBuU7VRFcwC18bOUI7Pt kFSmNh3X3o2YMlyR9Dl8Wdn+F9TRTcqy49jow0Ab97aN1OuFGkLL6WFqC9CK8RL1H4mdODaVXQwk FryYa21HlLYheGNPUUDMwrMgPHSbgzZhM9e7RozPxTGhYvoHraB36sH9XryMhRGNAd15mF4r5U9n bwf+Wz5ywCcgo1w/5CcVkVn/15DhsNHIW62CRhAR2B51O7/rj8D3/alUBfuTW9hLhK3EvQh/UvgN zk5Bhk+TkNH3rEAKLP8AAAAAAAA= ------=_NextPart_000_01CD_01D61E20.63184510-- From nobody Wed Apr 29 09:30:12 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E61D03A13F5 for ; Wed, 29 Apr 2020 09:29:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8zxzdegnzoXl for ; Wed, 29 Apr 2020 09:29:50 -0700 (PDT) Received: from mail-edgeKA27.fraunhofer.de (mail-edgeka27.fraunhofer.de [153.96.1.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D7723A13DA for ; Wed, 29 Apr 2020 09:29:48 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2HpCQBBqqle/xoBYJlmHgEBCxIMQIN?= =?us-ascii?q?xbgNVLyoKlHYtiXaPfYFnCwEBAQEBAQEBAQYBASMKAgQBAQKBToJ0AoIuJDg?= =?us-ascii?q?TAhABAQYBAQEBAQUEAgJphVYMg1R+AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE?= =?us-ascii?q?BAQEPAg02HjcSAR4BAQEBAzIBBUEMBAsOAwQBAQEuIS4IBg0BBQIBAReDCwG?= =?us-ascii?q?CSwMtBQuyWnSBNIVQgnENYoE6BoE4jEEPgUw/gREnD4JaPoIeSQEBA4EtARI?= =?us-ascii?q?BCYYKBI5poihaSgeBS31/BIcQiyyEQiOCW40nBY0AkVyHdIJFkH0CBAIJAhW?= =?us-ascii?q?BaSNmcE0kgzhQGA2PEIcdhRSFRHICNAIGAQcBAQMJfJBeAYEKBQEB?= X-IPAS-Result: =?us-ascii?q?A2HpCQBBqqle/xoBYJlmHgEBCxIMQINxbgNVLyoKlHYti?= =?us-ascii?q?XaPfYFnCwEBAQEBAQEBAQYBASMKAgQBAQKBToJ0AoIuJDgTAhABAQYBAQEBA?= =?us-ascii?q?QUEAgJphVYMg1R+AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEPAg02HjcSA?= =?us-ascii?q?R4BAQEBAzIBBUEMBAsOAwQBAQEuIS4IBg0BBQIBAReDCwGCSwMtBQuyWnSBN?= =?us-ascii?q?IVQgnENYoE6BoE4jEEPgUw/gREnD4JaPoIeSQEBA4EtARIBCYYKBI5poihaS?= =?us-ascii?q?geBS31/BIcQiyyEQiOCW40nBY0AkVyHdIJFkH0CBAIJAhWBaSNmcE0kgzhQG?= =?us-ascii?q?A2PEIcdhRSFRHICNAIGAQcBAQMJfJBeAYEKBQEB?= X-IronPort-AV: E=Sophos;i="5.73,332,1583190000"; d="scan'208";a="21571934" Received: from mail-mtaka26.fraunhofer.de ([153.96.1.26]) by mail-edgeKA27.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Apr 2020 18:29:46 +0200 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BGCwClqqle/1lIDI1mHQEBAQEJARI?= =?us-ascii?q?BBQUBQIFHgipuA1QwKgqUdi2Jdo99gWcLAQMBAQEBAQYBASMKAgQBAYFQgnQ?= =?us-ascii?q?Cgi0kOBMCEAEBBQEBAQIBBQRthVYMhXEBAQEBAzIBBUEMBAsOAwQBAQEuIS4?= =?us-ascii?q?IBg0BBQIBAReDCwGCSwMyC7JadIE0hVCCcQ1igToGgTiMQQ+BTD+BEScPglo?= =?us-ascii?q?+gh5JAQEDgS0BEgEJhgoEjmmiKFpKB4FLfX8EhxCLLIRCI4JbjScFjQCRXId?= =?us-ascii?q?0gkWQfQIEAgkCFYFpImZwTSSDOFAYDY8Qhx2FFIVEQTECNAIGAQcBAQMJfJB?= =?us-ascii?q?eAYEKBQEB?= X-IronPort-AV: E=Sophos;i="5.73,332,1583190000"; d="scan'208";a="81231348" Received: from mailext.sit.fraunhofer.de ([141.12.72.89]) by mail-mtaKA26.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Apr 2020 18:29:44 +0200 Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 03TGThvw012688 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Wed, 29 Apr 2020 18:29:43 +0200 Received: from [192.168.16.50] (79.234.123.239) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Wed, 29 Apr 2020 18:29:38 +0200 To: Guy Fedorkow CC: "rats@ietf.org" , Jessica Fitzgerald-McKay , William Bellingrath References: <96c6bf0f-024d-972e-333f-edd288f3920f@sit.fraunhofer.de> From: Henk Birkholz Message-ID: <7a3b2b24-3dca-202b-fb83-3af52be25ee5@sit.fraunhofer.de> Date: Wed, 29 Apr 2020 18:29:37 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [79.234.123.239] Archived-At: Subject: Re: [Rats] retrieving reference measurements X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Apr 2020 16:30:01 -0000 Hi Guy, I think I misunderstood the intend of your initial question. I thought it was a "network isolation" question, but it is a "conveyance method" question, I think. CoSWID RIM tags use (and extend, actually), the payload-entry and therefore can be bundled in corresponding software/firmware packages that are updates. This is the reason why they are used in SUIT Manifests, too. If they are not included in a software package, they can be referred to via a MUD ULL / MUD File. MUD is simply a straight forward option to... point at device specific things. It is certainly not meant to be constraining options, it adds a increasingly popular one. Viele Grüße, Henk On 29.04.20 18:19, Guy Fedorkow wrote: > Hi Henk, > I understand that third-party RIMs could be used, but for embedded > equipment, it seems like the easiest path is to deliver the RIMs as part of > the vendor's software update package for the device. Operators have > well-worn procedures for getting software updates to devices; if the RIM is > just part of the package, they don't have to think about a new procedure at > all... > Maybe not for everyone, but it seems like it would be a common use-case... > Thanks > /guy > > > > Juniper Business Use Only > > -----Original Message----- > From: Henk Birkholz > Sent: Wednesday, April 29, 2020 11:29 AM > To: Guy Fedorkow > Cc: rats@ietf.org; Jessica Fitzgerald-McKay ; William > Bellingrath > Subject: Re: retrieving reference measurements > > [External Email. Be cautious of content] > > > Hi Guy, > > I think it would be strange for a network equipment device to expose a > potentially vulnerable management to the open internet, too :) > > Luckily, there will probably be a "higher level" constituent in the network > that an Attester's DevID can be presented to (typically this is or is close > to a device that is also a Verifier). And these systems generally have a way > to "reach out" to the internet. > > The typically already existing "path" to follow here is the way updates find > their way to a "network equipment device". If you are air-gap'ed or > completely isolated wrt every layer 2 topology, it may start to become a bit > tricky, but your are running around with usb sticks in hand to do updates > then, too. > > YANG is a big solution for big problems. But you can use a YANG server to > retrieve RIM that are stored on the Attester itself, of course. These > probably are outdated at some point and then leave you with the same > illustrated above, again. > > Viele Grüße, > > Henk > > > On 29.04.20 15:56, Guy Fedorkow wrote: >> Hi Henk, >> >> I see your proposal for identifying URIs for reference measurements in >> https://urldefense.com/v3/__https://tools.ietf.org/html/draft-birkholz >> -rats-mud-00__;!!NEt6yMaO-gk!WdyQ3vQ51adw93UKoSwWvgPFs4395vPIWLjuzRBiF >> gldobaQ_dLIeFbhOWan0kBLDLY$ >> >> I realize that some constrained devices may not want to do this, >> but do you think draft-charra could be extended to allow retrieval of >> the signed reference measurements directly from the device being >> attested, via the YANG / Netconf interface? >> >> Ironic as it may sound, I’m sure you know that many operators >> ensure that their internet routers cannot access the public internet. >> >> Thanks, >> >> /guy >> >> >> Juniper Business Use Only >> From nobody Wed Apr 29 09:36:17 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78E7F3A1408 for ; Wed, 29 Apr 2020 09:36:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.6 X-Spam-Level: X-Spam-Status: No, score=-9.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 20bexqeIHXlj for ; Wed, 29 Apr 2020 09:36:10 -0700 (PDT) Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38A003A1404 for ; Wed, 29 Apr 2020 09:36:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=9783; q=dns/txt; s=iport; t=1588178170; x=1589387770; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=UCgPCALKFLf4HoEixfZ7z7T/e3FjkkVH/f4LdOTsov4=; b=VjhT08B3QCLO7PhKsKhp+wBGWfOVpLw0YwCdpmhUI3YDJb6B6MpAAooX yzKUN83KwaLGyMPv7X9v9Zfcs3BY+ByE4hyVUVHscLfGerDPhfjOb9L0n x016Kfm5PxKcF5Rv/7f8hOGHC5NwniKFokbIUqGTfrWVlKWXGcgzEoAur Q=; X-Files: signature.asc : 488 X-IPAS-Result: =?us-ascii?q?A0DqAQADrKle/xbLJq1mGwEBAQEBAQEBBQEBARIBAQEDA?= =?us-ascii?q?wEBAYIHAoEjgXMPRQEgEiqEIYkBiAqHTYwCiAsEBwEBAQkDAQEYAQoMBAEBh?= =?us-ascii?q?EQCglE4EwIDAQEBAwIDAQEBAQUBAQECAQUEbYVWDEIBEAGFHQEBAQECAQEBI?= =?us-ascii?q?UsLBQsLGCcDAgInHxEGE4MmAYJcIA+yXXaBMoQ9AoERhRAKBoE4AYFSiwiCA?= =?us-ascii?q?IERJxyCTT6CZwEBAgGEdDOCLQSYeZk8gk+CboEkhAGPdB2QB40AmVCPf4NDA?= =?us-ascii?q?gQGBQIVgWkigVYzGggbFTsqAYI+PhIYDZtBhUQ/AzACNAIGAQcBAQMJhy+LO?= =?us-ascii?q?wEB?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.73,332,1583193600"; d="asc'?scan'208,217";a="23444380" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 29 Apr 2020 16:36:06 +0000 Received: from [10.61.246.165] ([10.61.246.165]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id 03TGa57R020444 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 29 Apr 2020 16:36:05 GMT From: Eliot Lear Message-Id: <661E8973-C30A-4D98-BC00-43EA05A4B289@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_FE7C6894-1D02-4C32-B44D-5F3394179FEE"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Wed, 29 Apr 2020 18:36:04 +0200 In-Reply-To: Cc: Henk Berkholz , "rats@ietf.org" , William Bellingrath , Jessica Fitzgerald-McKay To: Guy Fedorkow References: X-Mailer: Apple Mail (2.3608.80.23.2.2) X-Outbound-SMTP-Client: 10.61.246.165, [10.61.246.165] X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: Re: [Rats] retrieving reference measurements X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Apr 2020 16:36:14 -0000 --Apple-Mail=_FE7C6894-1D02-4C32-B44D-5F3394179FEE Content-Type: multipart/alternative; boundary="Apple-Mail=_C2CB7866-E70E-4709-83D1-93CA44EA3DB6" --Apple-Mail=_C2CB7866-E70E-4709-83D1-93CA44EA3DB6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Guy, > On 29 Apr 2020, at 15:56, Guy Fedorkow = wrote: >=20 > Hi Henk, > I see your proposal for identifying URIs for reference measurements in = https://tools.ietf.org/html/draft-birkholz-rats-mud-00 = >=20 > I realize that some constrained devices may not want to do this, but = do you think draft-charra could be extended to allow retrieval of the = signed reference measurements directly from the device being attested, = via the YANG / Netconf interface? If you can get this information in, then my suggestion would be to drop = it into a MUD file a=E2=80=99la draft-moran-suit-mud-00.txt. Eliot > Ironic as it may sound, I=E2=80=99m sure you know that many = operators ensure that their internet routers cannot access the public = internet. >=20 > Thanks, > /guy >=20 >=20 > Juniper Business Use Only > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_C2CB7866-E70E-4709-83D1-93CA44EA3DB6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Guy,

On 29 Apr 2020, at 15:56, Guy Fedorkow <gfedorkow=3D40juniper.net@dmarc.ietf.org> = wrote:

Hi = Henk,
I see = your proposal for identifying URIs for reference measurements in https://tools.ietf.org/html/draft-birkholz-rats-mud-00
 
  I = realize that some constrained devices may not want to do this, but do = you think draft-charra could be extended to allow retrieval of the = signed reference measurements directly from the device being attested, = via the YANG / Netconf interface?

If you can get this information in, then my suggestion = would be to drop it into a MUD file a=E2=80=99la draft-moran-suit-mud-00.txt.

Eliot

  Ironic as it may sound, I=E2=80=99= m sure you know that many operators ensure that their internet routers = cannot access the public internet.
 
  Thanks,
/guy
 

Juniper Business Use Only
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_C2CB7866-E70E-4709-83D1-93CA44EA3DB6-- --Apple-Mail=_FE7C6894-1D02-4C32-B44D-5F3394179FEE Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAl6prPQACgkQh7ZrRtnS ejNAMggAlhCZjphE2EnUT0sPm+AMNHLzTEi++TIC4/GJR2UxJfkMFc1fgaojs2yn acHTzdJbCYkuheBUHPuQvilJn4g1352pm00j79ZuMgTnpG2DuttbXWkut4tFRm2Q 0o8Vd6fGmgQKL08x9WsGQvtxhNMaFGX2exe/GZWI6ooU7rkWhKIwSR3S658uuV9e QnoPO/khVTGTVDKCxpY++B9EnXo9cfaSenbjJXW8jZ3uYhXHabCMUOEer/4D3AFv G/Nko8XDju/5lKf5IXc8jewNM65plo6/OaLG7oJdUBsXmjbqpgCWzXfJN3FXpgOR 0ddyfBSNb7WDVD1kiYfzL3XmLjr+MA== =Mo8F -----END PGP SIGNATURE----- --Apple-Mail=_FE7C6894-1D02-4C32-B44D-5F3394179FEE-- From nobody Wed Apr 29 10:36:45 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 601CA3A14AC for ; Wed, 29 Apr 2020 10:36:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net header.b=h9AKSklJ; dkim=pass (1024-bit key) header.d=juniper.net header.b=Cu9GOlvi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qqW2t7qU7KZm for ; Wed, 29 Apr 2020 10:36:42 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB2843A14AB for ; Wed, 29 Apr 2020 10:36:41 -0700 (PDT) Received: from pps.filterd (m0108163.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 03THVre8008489; Wed, 29 Apr 2020 10:36:35 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : content-type : mime-version; s=PPS1017; bh=YzechHesGtcxMeux/le3WJ2cPx37gnctM+WhFr9v4jY=; b=h9AKSklJFJ76zv/ZoW4PcP6PdDSENQtIgdK1g76u99f/ogvBWzyYUGYE0VsMR5axeBsQ Qg5g7+kgkR9r+FAWmCrAuxYv4ZnZZEGqKZtA4jmaLRpUwGx4ece2BWo8p/E0g6v5CsEs D1goeTblVdmH6emu5a00JLzMjgP1DTFlNAHq7a7VS3joQq1/aVdf6XiacJBromPOgmcf nkcE84oRZ9gRq2G5qpRGq6D4/EbnrDgUCQexh5ffDvZMFbotKwXzdmTplt8LRZhJkYmc Mi+MFjFCwEu9m67zimaHUpI5I9/XONJe55qCQmS120Qi3fJ9eHiKDd63TAWmLl5m0O1t 5Q== Received: from nam02-cy1-obe.outbound.protection.outlook.com (mail-cys01nam02lp2054.outbound.protection.outlook.com [104.47.37.54]) by mx0b-00273201.pphosted.com with ESMTP id 30mhtv035r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 29 Apr 2020 10:36:35 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Q89C7DwZZzwQpmCDAEjZAK7VMA2jUDjGVfBhVcLuw15Cbnx3DfndvbChv9LAuBWrZDZFpG2p+3NkJnurSh1BihnEdtMFUIp7qq/2R+aPGwsohhmzoa0xxKHjPPchMP83ak89iy+eE9Q8k3zUCW92IJWaqkzjnt065z3H97+5Lvte1F37aaH5gcVJIrCCMBnRRXFdqSeHIbPVyRvMVA89w2pRwVdgpwfgLvW18z0fa70JZ5RoQ2Li+5Mg3YVN5EYyxCRG01dBvyRVL70WAfZxUUz4dDb9Xlzroht3Og+7Uy7x679mltLY0Uhfqxo3xHOX+2STp5DbTP4Bsw/xLGH+qQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YzechHesGtcxMeux/le3WJ2cPx37gnctM+WhFr9v4jY=; b=G9VsuSoyNWZEBPgTpIRwCNV5zzomFL5ENjCBGpRCQZSvzxmNJtacZTl5J/jCwKdoSPBhjg+ojjkKC6TRShR7WEyATKTWGaNCVLbfnQOkEcyLBvHanoBbFillxTz705adTbAjV69cf2k3aDliEDDDOGJ+XZeMKMxJZj/Ml3X+ajmCj8mJSe69/bxZNCVMZ5xRWKAIQTwOt5NipS/H67ItFyNPHNn0qkBM+0zrZRNtKcF11//qmpMtOk9GK3UodXZqM7l4AR1aJDDNFBA2SJtHsV7T/tSMsdTrjr9vskv9kR756w+VkwWPOc9u9yw9b48IT7v4lwJCrTPzxsShpKfcgg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YzechHesGtcxMeux/le3WJ2cPx37gnctM+WhFr9v4jY=; b=Cu9GOlviFSkS9AgT+ZU82YycaNGuP9QA5ZkAIZgwBR/uJtAOB85PMxJkz1WLiVp1zmo1HwioYrsHGToj8gG05bejQsOi3pmTyx4I8S1ewADizkjtfKIGDHD0jtwnitIXuQvaPYNdY67kGbpHbIu5+C4aU1O40lFyP5Au4EdrA2s= Received: from DM6PR05MB6889.namprd05.prod.outlook.com (2603:10b6:5:204::22) by DM6PR05MB5739.namprd05.prod.outlook.com (2603:10b6:5:103::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2979.11; Wed, 29 Apr 2020 17:36:33 +0000 Received: from DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1]) by DM6PR05MB6889.namprd05.prod.outlook.com ([fe80::99d5:e781:8291:de1%7]) with mapi id 15.20.2979.013; Wed, 29 Apr 2020 17:36:33 +0000 From: Guy Fedorkow To: "rats@ietf.org" CC: "Eric Voit (evoit)" , Jessica Fitzgerald-McKay Thread-Topic: EAP and RIV Thread-Index: AdYeTCobkYAYRM1VRf6xELAVi8jZkw== Date: Wed, 29 Apr 2020 17:36:32 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Enabled=True; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Owner=gfedorkow@juniper.net; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_SetDate=2020-04-29T17:36:31.2692252Z; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Name=Juniper Business Use Only; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Application=Microsoft Azure Information Protection; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_ActionId=c02af8ae-3ed5-4f79-92d0-32376b0e7160; MSIP_Label_0633b888-ae0d-4341-a75f-06e04137d755_Extended_MSFT_Method=Automatic dlp-product: dlpe-windows dlp-version: 11.3.2.8 dlp-reaction: no-action authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=juniper.net; x-originating-ip: [66.129.241.10] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: b25a710f-d411-443e-d813-08d7ec63dbd4 x-ms-traffictypediagnostic: DM6PR05MB5739: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 03883BD916 x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: JRIFRAV8taJq1a4AxIpSH+gdYjHm/X3H+zJTAv6fEWCdH+hVmSEEuSY88RD/5HialhuxZ8GO1l3RRW+GhJ2hEJn8MrrM384nz8lhOWz3XvJTax+uDE4cOcIynGk/SVckw95MnlSwJq6e6RpVhn50UTK1NQQeL/3Qn4m0BZh0/AwldrZWc97KA1Zv5D1G/Vt3Ye0FI3HfmEc748w0biQs9gTNpqcsPGJrTRtuHfe4kNqHbhLlEeKR2C0vsJp9n0gqsTa0pmh7rILgqP7iuG3HvOFD/3JQ//D5YR1DQlsAq11tBaMCOYU8bRDNoJvY1k4Jks9Pk0Y5RjaBWDjZRachWIHLrpBduqLv7KWWDD5fxs6zZggS8wcGo6cCf2dVvqvX8xlkMKdZkF/T/1V+Hm7/QKiEMZxFqemlp/gjSS/XJxasP2c3/2c6DSep8P6P3UeA x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR05MB6889.namprd05.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(376002)(39860400002)(366004)(396003)(136003)(7696005)(6916009)(71200400001)(3480700007)(7116003)(316002)(26005)(2906002)(5660300002)(55016002)(8936002)(66446008)(66616009)(33656002)(66476007)(64756008)(66556008)(54906003)(76116006)(66946007)(4326008)(99936003)(558084003)(8676002)(186003)(6506007)(478600001)(52536014)(9686003)(86362001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: BzFdE6NorfAQ4Kd04+Tb/w9k227ktzeahHpQ5yAXMyNcacU8BvlEbYHsrAj3H5SHXWQOafr66rmwXPalXwJfRMQvD4b1+Reu4wAt3go4HD4tjzxPbYRUhzOdIwiz8OR/UF1E7TLPPg603q64Yw1i85Lx7+6r/xmmIcoYumSqpztYCjRq9lH58I6OcIB9u3E6mSecXzsSgXXDjkirL+VSoKjBIMkvDZAwK44qOTDp5mz50l2sPjwCZkJLP5UilyEd0UVDfR1MW8ytuc8fdZUDlWLVnm8N9TU+sJ5hpKQs9DdtklmT6B01X9TS3OkflryAbGYE/xSEpxeM8MabTfIii65t5nx65wKnb82GYUp1EdXXs/GTlCR5Jxg6zoxLVblvwHgkgTNGW1nIGs3DLPicNmTR3m/94oLKvk2yVkjkFQcoOCzdRvPNEWvodyE2VfcdHamrsYKhXImtEXe0aTDyCefDhKlF7mMZirZwEDNTQHDk3aOI3XaxmDhpwAO8HouDq4V2k9+M2TLfUtutvSmjz/Ckv1+Tu5KDS4kuiYDdnIt6fu9UUFYeT4KZm68GBFxinMv8tqa900p3xvUFQATcwr4/ZK2OVZBIOStIHG9GYEHsOuQNl+79IWqwDh088nieDW05qU2Dik5C4IGYgI0qEsApxMHydTZ7ASXSGAOdx4KSkMd7j8gVNFrFspA4d3NLzWfvKmAXI6MupkGlYCI9vkrKEmlonrr5Tv5rU2QAsY6XnYmyIgGbhliIGHRqNafdbsSzN0/hN3ZjX1UgmdRnI/aHTLWP495tgixKf/BS+F0= x-ms-exchange-transport-forked: True Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_021B_01D61E2B.3149B770" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: b25a710f-d411-443e-d813-08d7ec63dbd4 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Apr 2020 17:36:32.9421 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: KO1EQillpnUlJZCzowl+seUVM2qpLjCJ3sNptNsMPtOt/sgzZ5vazqHXKIaUXmRWUnGMnceq8Jg55Aj84MSxwQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR05MB5739 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-29_09:2020-04-29, 2020-04-29 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 mlxlogscore=862 lowpriorityscore=0 suspectscore=0 adultscore=0 spamscore=0 impostorscore=0 clxscore=1015 mlxscore=0 malwarescore=0 priorityscore=1501 phishscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004290136 Archived-At: Subject: [Rats] EAP and RIV X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Apr 2020 17:36:45 -0000 ------=_NextPart_000_021B_01D61E2B.3149B770 Content-Type: multipart/alternative; boundary="----=_NextPart_001_021C_01D61E2B.3149B770" ------=_NextPart_001_021C_01D61E2B.3149B770 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Someone asked about adding a protocol support for EAP to the RIV TPM Attestation draft on the RATS call yesterday, but I wasn't quick enough to write down the name. Could anyone interested in this contact me? Thanks /guy Juniper Business Use Only ------=_NextPart_001_021C_01D61E2B.3149B770 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Someone asked about adding a protocol support for EAP = to the RIV TPM Attestation draft on the RATS call yesterday, but I = wasn’t quick enough to write down the name…  Could = anyone interested in this contact me?

  Thanks

/guy

 


Juniper = Business Use Only

------=_NextPart_001_021C_01D61E2B.3149B770-- ------=_NextPart_000_021B_01D61E2B.3149B770 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIISJTCCBd4w ggPGoAMCAQICEAH9bTD8o8pRqBu8ZA41Ay0wDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVT MRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhl IFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTEwMDIwMTAwMDAwMFoXDTM4MDExODIzNTk1OVowgYgxCzAJBgNVBAYTAlVT MRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhl IFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sIs9CsVw12 7c0n00ytUINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnGvDoZtF+mvX2do2NCtnby qTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQIjy8/hPwhxR79uQfjtTkUcYRZ0YIUcuG FFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfbIWax1Jt4A8BQOujM8Ny8nkz+rwWWNR9XWrf/zvk9tyy2 9lTdyOcSOk2uTIq3XJq0tyA9yn8iNK5+O2hmAUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnH a4xgk97Exwzf4TKuzJM7UXiVZ4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNVicQN wZNUMBkTrNN9N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5D9kCnusSTJV882sF qV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJWBp/kjbmUZIO8yZ9HE0XvMnsQybQ v0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ5lhCLkMaTLTwJUdZ+gQek9QmRkpQgbLevni3/GcV 4clXhB4PY9bpYrrWX1Uu6lzGKAgEJTm4Diup8kyXHAc/DVL17e8vgg8CAwEAAaNCMEAwHQYDVR0O BBYEFFN5v1qqK0rPVIDh2JvAnfKyA2bLMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/ MA0GCSqGSIb3DQEBDAUAA4ICAQBc1HwNz/cBfUGZZQxzxVKfy/jPmQZ/G9pDFZ+eAlVXlhTxUjwn h5Qo7R86ATeidvxTUMCEm8ZrTrqMIU+ijlVikfNpFdi8iOPEqgv976jpS1UqBiBtVXgpGe5fMFxL JBFV/ySabl4qK+4LTZ9/9wE4lBSVQwcJ+2Cp7hyrEoygml6nmGpZbYs/CPvI0UWvGBVkkBIPcygu xeIkTvxY7PD0Rf4is+svjtLZRWEFwZdvqHZyj4uMNq+/DQXOcY3mpm8fbKZxYsXY0INyDPFnEYkM nBNMcjTfvNVx36px3eG5bIw8El1l2r1XErZDa//l3k1mEVHPma7sF7bocZGM3kn+3TVxohUnlBzP YeMmu2+jZyUhXebdHQsuaBs7gq/sg2eF1JhRdLG5mYCJ/394GVx5SmAukkCuTDcqLMnHYsgOXfc2 W8rgJSUBtN0aB5x3AD/Q3NXsPdT6uz/MhdZvf6kt37kC9/WXmrU12sNnsIdKqSieI47/XCdr4bBP 8wfuAC7UWYfLUkGV6vRH1+5kQVV8jVkCld1incK57loodISlm7eQxwwH3/WJNnQy1ijBsLAL4JxM wxzW/ONptUdGgS+igqvTY0RwxI3/LTO6rY97tXCIrj4Zz0Ao2PzIkLtdmSL1UuZYxR+IMUPuiB3X xo48Q2odpxjefT0W8WL5ypCo/TCCBhAwggP4oAMCAQICEE2ULBDUO+CUCcWBLTorBk8wDQYJKoZI hvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VS VHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE4MTEwMjAwMDAwMFoXDTMwMTIz MTIzNTk1OVowgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO BgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE+MDwGA1UEAxM1U2VjdGln byBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKPO2UCkH/3vlGuejWO+bakr8rEE6qGryCvb4mHCkqKtLN nFCBP22ULvOXqGfV9eNKjkypdR8i0yW2sxpepwRIm4rx20rno0JKuriIMpoqr03E5cWapdfbM3wc caNDZvZe/S/Uvk2TUxA8oDX3F5ZBykYQYVRR3SQ36gejH4v1pXWuN82IKPdsmTqQlo49ps+LbnTe ef8hNfl7xZ8+cbDhW5nv0qGPVgGt/biTkR7WwtMewu2mIr06MbiJBEF2rpn9OVXH+EYB7PmHfpsE kzGp0cul3AhSROpPyx7d53Q97ANyH/yQc+jl9mXm7UHR5ymr+wM3/mwIbnYOz5BTk7kTAgMBAAGj ggFkMIIBYDAfBgNVHSMEGDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUCcDy/Ava lNtf/ivfqJlCz8ngrQAwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBEGA1UdIAQKMAgwBgYEVR0gADBQBgNVHR8ESTBHMEWg Q6BBhj9odHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQ2VydGlmaWNhdGlvbkF1 dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEEajBoMD8GCCsGAQUFBzAChjNodHRwOi8vY3J0LnVzZXJ0 cnVzdC5jb20vVVNFUlRydXN0UlNBQWRkVHJ1c3RDQS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9v Y3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBAEFEdQCrOcIV9d6OlW0ycWiMAN0X 13ocEDiQyOOxvRcxkfO244K0oX7GzCGHYaqRbklCszzNWVT4DZU/vYrLaeVEDUbCYg+Ci7vhNn9d NqscbzN0xKBoOuRVjPPWDechU70geT3pXCxpwi8EXwl+oiz7xpYfY99JSs3E/piztTSxljHitcPr 5yoWr9lbkFR8KU3+uGTZ11BfKfuSSaRrZFBv133SeY0d2AqvB9Dj2ZDaFZA0OQkkhfAqNgDpVRH9 9lQV4JSKx0N7/QAEtMj6OF5dRXV6hhXuU3A0Eql4d0247oBpxvnfcmV95QfG8HP059hZSJe7T2ww C+IzXVDQO4xnnvrQJ07ZWemxc/grFpgiG+o+pQxapF1bKftysi02Rl6uhdp5wbTeLeYzt2SI9oKS ChwGDQQFixtkNnxuwbdrTwvASwvViDPdIGzIQJrTBqriE5/9nzkXbDZmld8/7DyriJ/A73RIZllX 4dH8mHqsRpU8NEX8IQZWpHWGK5A5nVgvl7MxNfRlIvCvKZQTSnCL8oNqJgHXm6zCB4gBwDonM8V/ 2kuQAUVazVA3I376eIWGwzjuqh3H88v7mNHzubLHm5h0ERCSQNz6UoHVZy3q5xeqbYSaxpDQz3lC NObL6sNaOQNh3DcyzqZJYTcGfuLlmC3AIteAAh7lbybJszYnMIIGKzCCBROgAwIBAgIRAPuElTZ4 EhaY10ByhNJltnIwDQYJKoZIhvcNAQELBQAwgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVh dGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRl ZDE+MDwGA1UEAxM1U2VjdGlnbyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUg RW1haWwgQ0EwHhcNMTkwODI0MDAwMDAwWhcNMjIwODIzMjM1OTU5WjCCATcxCzAJBgNVBAYTAlVT MQ4wDAYDVQQREwU5NDA4OTELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVN1bm55dmFsZTEcMBoGA1UE CRMTMTEzMyBJbm5vdmF0aW9uIFdheTEeMBwGA1UEChMVSnVuaXBlciBOZXR3b3JrcywgSW5jMR4w HAYDVQQLExVTb2Z0d2FyZSBFbmdpbmVlciBMYWIxOzA5BgNVBAsTMklzc3VlZCB0aHJvdWdoIEp1 bmlwZXIgTmV0d29ya3MsIEluYyBFLVBLSSBNYW5hZ2VyMR8wHQYDVQQLExZDb3Jwb3JhdGUgU2Vj dXJlIEVtYWlsMRUwEwYDVQQDEwxHdXkgRmVkb3Jrb3cxJDAiBgkqhkiG9w0BCQEWFWdmZWRvcmtv d0BqdW5pcGVyLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL2Fewgz3OFG1Go3 cuoLYIbLNRTSEFgN+GLUaqB6g5VuCf0UTvgARSlxgDmsvE5qwTtb8JOtJ64OylVNvz28uslsfvg4 WCc0InZUo1B6JkgNamxa3HI31h63s5wVm/wZgglg5Dv7WH7gmAPrgeoWpBC2GN1sxWHfcJOi2fzg M5LWst0Iwz4M7vqFsZ77AOkUFDNm5p19Fu8HRjVlsE0fNGieZB5GEiL2CN2YoxyOKrJdqWHNMkK8 Q5owvlDnSR0tb8oJgHDX8EESSo5TDA5zqnva48zFfFWCrOdobNgf1To4uBskX6B+QEmrSNLuSdpK JOHw9IdrPofgpjZCmFwvtS8CAwEAAaOCAc4wggHKMB8GA1UdIwQYMBaAFAnA8vwL2pTbX/4r36iZ Qs/J4K0AMB0GA1UdDgQWBBQPfL+xFDoZAlQisKraMq/Y34eQGjAOBgNVHQ8BAf8EBAMCBaAwDAYD VR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwQAYDVR0gBDkwNzA1Bgwr BgEEAbIxAQIBAQEwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwWgYDVR0f BFMwUTBPoE2gS4ZJaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUlNBQ2xpZW50QXV0aGVu dGljYXRpb25hbmRTZWN1cmVFbWFpbENBLmNybDCBigYIKwYBBQUHAQEEfjB8MFUGCCsGAQUFBzAC hklodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFu ZFNlY3VyZUVtYWlsQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAg BgNVHREEGTAXgRVnZmVkb3Jrb3dAanVuaXBlci5uZXQwDQYJKoZIhvcNAQELBQADggEBALilLU71 sn7XVNFoUU4MqcHXXFiFiOjCQmq1nqijMa6L4fKm/VX9LZtrsQs3CZTUiHuW2pyLapLVIEXdubNX L877oIVJmeAoSWz1+AYelK6CIpuGUUcGSsXKd4Xl9yOTrmLb7PTjrRpXsWSHJi//jrXTrR/X6M+U TterfzhR5gYPFyvX65Zie9M7k7V2yB3YJJPzT8EtfrJc+eDzYAgiWK8X/ToMZOG7noa/Er8FEARn joL7pKHVOkHTOM9UNaublWlhiUEzzXx9kYPKjgqjAetRo4zh1KBFm9MBlXeigAVBx+BQpP0OdmHb 5vcX3pUR4lkRpnVeLKFR++q6z+bViYAxggRnMIIEYwIBATCBrDCBljELMAkGA1UEBhMCR0IxGzAZ BgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2Vj dGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGllbnQgQXV0aGVudGljYXRpb24g YW5kIFNlY3VyZSBFbWFpbCBDQQIRAPuElTZ4EhaY10ByhNJltnIwCQYFKw4DAhoFAKCCAo8wGAYJ KoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjAwNDI5MTczNjMxWjAjBgkq hkiG9w0BCQQxFgQUWn2xqsqrG/Twj59pUybdoBnKETAwga0GCSqGSIb3DQEJDzGBnzCBnDALBgkq hkiG9w0BAQcwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQME AQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIaMAsGCSqGSIb3DQEBCjAL BglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAsGCWCGSAFlAwQCATCBvQYJKwYBBAGCNxAEMYGvMIGs MIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdT YWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENs aWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhEA+4SVNngSFpjXQHKE0mW2 cjCBvwYLKoZIhvcNAQkQAgsxga+ggawwgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVy IE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE+ MDwGA1UEAxM1U2VjdGlnbyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1h aWwgQ0ECEQD7hJU2eBIWmNdAcoTSZbZyMA0GCSqGSIb3DQEBAQUABIIBAITaReVPSwEtkF6Y98JU tYgr+Swfp79jpkjTy5vv+BiYAMV9Ct9gu6qFB33Ku13mCwR2N+i0xyIerxVXxpJigT9c5b4uBJRL vW4Ss0tuJkjJOpd4J9BWoc+/z4l2YbkWkH2AO7y7etmbxi1ZjCO7YAYJAivay7vJNuj0+PrtLx5F gbcLUgxPQSMzrpyy+KvJXW50yoLIeGOsHCuCYZ+l8lPdM1GvWLzh5wXTGKJR0hcc0NDmd7dvcxrz eSRWB3sEfREOSFHD61oc4jl0zqs+FSALlyj/qiWVRK4mekGHD5tkbLWi7wBSSTAhWc02bpdh6rlu umwm+dpZyzU4jArhHiMAAAAAAAA= ------=_NextPart_000_021B_01D61E2B.3149B770-- From nobody Wed Apr 29 20:00:17 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 565113A0C9F for ; Wed, 29 Apr 2020 20:00:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.72 X-Spam-Level: X-Spam-Status: No, score=-2.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H2=-0.82, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3xU7U-o5jncd for ; Wed, 29 Apr 2020 20:00:12 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 179513A0E4C for ; Wed, 29 Apr 2020 19:59:58 -0700 (PDT) Received: from lhreml741-chm.china.huawei.com (unknown [172.18.7.106]) by Forcepoint Email with ESMTP id A3D42125A76D290DE5B4; Thu, 30 Apr 2020 03:59:56 +0100 (IST) Received: from nkgeml708-chm.china.huawei.com (10.98.57.160) by lhreml741-chm.china.huawei.com (10.201.108.191) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1913.5; Thu, 30 Apr 2020 03:59:56 +0100 Received: from nkgeml705-chm.china.huawei.com (10.98.57.154) by nkgeml708-chm.china.huawei.com (10.98.57.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1913.5; Thu, 30 Apr 2020 10:59:53 +0800 Received: from nkgeml705-chm.china.huawei.com ([10.98.57.154]) by nkgeml705-chm.china.huawei.com ([10.98.57.154]) with mapi id 15.01.1913.007; Thu, 30 Apr 2020 10:59:53 +0800 From: "Panwei (William)" To: Henk Birkholz , Guy Fedorkow CC: "rats@ietf.org" , William Bellingrath , Jessica Fitzgerald-McKay Thread-Topic: [Rats] retrieving reference measurements Thread-Index: AQHWHkH/XlsP4jf+5k6XXTgIwg1OY6iPxB6AgAEjQ4A= Date: Thu, 30 Apr 2020 02:59:53 +0000 Message-ID: References: <96c6bf0f-024d-972e-333f-edd288f3920f@sit.fraunhofer.de> <7a3b2b24-3dca-202b-fb83-3af52be25ee5@sit.fraunhofer.de> In-Reply-To: <7a3b2b24-3dca-202b-fb83-3af52be25ee5@sit.fraunhofer.de> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.138.33.152] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Rats] retrieving reference measurements X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Apr 2020 03:00:16 -0000 Hi Henk, Guy, I think the key point is that the YANG-modeled reference measurements or th= e YANG-modeled RIM should be defined. I also suggested this in my comments = on draft-birkholz-rats-mud. I think there are two main reasons: 1) draft-birkholz-rats-coswid-rim defined the CoSWID-styled reference measu= rements. Meanwhile, draft-birkholz-rats-mud defines a YANG-modeled URI poin= ting at the reference measurements. So, by combining the two ideas together= , the YANG-modeled reference measurements or YANG-modeled RIM can be define= d directly in the MUD File. This way has an advantage that the Verifiers th= at only support YANG don't need to support CoSWID and do more implementatio= n. 2) There is a use case that the reference measurements (signed by the vendo= r) can be stored at the network devices. In this case, the reference measur= ements can be retrieved by the Verifier via the YANG / NETCONF interface. H= enk's concern is how to update the reference measurements when the network = devices update, and Guy's suggestion is that the new reference measurements= (also signed by the vendor) can be part of the vendor's software update pa= ckage. I agree with Guy that this is a reasonable use case, and there is a doable = solution. (Besides, I also think this path for delivering reference measure= ments can be used by other devices as well.) Therefore, for the network dev= ices that use the YANG / NETCONF interface, the YANG-modeled reference meas= urements or YANG-modeled RIM should be defined. And Guy proposed to define = the YANG-modeled reference measurements in DraftC. So I think the YANG-modeled reference measurements are worthy to be defined= , in draft-rats-mud or draft-charra or an independent draft. Regards & Thanks! Wei Pan > -----Original Message----- > From: RATS [mailto:rats-bounces@ietf.org] On Behalf Of Henk Birkholz > Sent: Thursday, April 30, 2020 12:30 AM > To: Guy Fedorkow > Cc: rats@ietf.org; William Bellingrath ; Jessic= a > Fitzgerald-McKay > Subject: Re: [Rats] retrieving reference measurements >=20 > Hi Guy, >=20 > I think I misunderstood the intend of your initial question. I thought it= was a > "network isolation" question, but it is a "conveyance method" > question, I think. >=20 > CoSWID RIM tags use (and extend, actually), the payload-entry and > therefore can be bundled in corresponding software/firmware packages > that are updates. This is the reason why they are used in SUIT Manifests,= too. >=20 > If they are not included in a software package, they can be referred to v= ia a > MUD ULL / MUD File. MUD is simply a straight forward option to... > point at device specific things. It is certainly not meant to be constrai= ning > options, it adds a increasingly popular one. >=20 > Viele Gr=FC=DFe, >=20 > Henk >=20 >=20 >=20 > On 29.04.20 18:19, Guy Fedorkow wrote: > > Hi Henk, > > I understand that third-party RIMs could be used, but for embedded > > equipment, it seems like the easiest path is to deliver the RIMs as > > part of the vendor's software update package for the device. > > Operators have well-worn procedures for getting software updates to > > devices; if the RIM is just part of the package, they don't have to > > think about a new procedure at all... > > Maybe not for everyone, but it seems like it would be a common > use-case... > > Thanks > > /guy > > > > > > > > Juniper Business Use Only > > > > -----Original Message----- > > From: Henk Birkholz > > Sent: Wednesday, April 29, 2020 11:29 AM > > To: Guy Fedorkow > > Cc: rats@ietf.org; Jessica Fitzgerald-McKay ; > > William Bellingrath > > Subject: Re: retrieving reference measurements > > > > [External Email. Be cautious of content] > > > > > > Hi Guy, > > > > I think it would be strange for a network equipment device to expose a > > potentially vulnerable management to the open internet, too :) > > > > Luckily, there will probably be a "higher level" constituent in the > > network that an Attester's DevID can be presented to (typically this > > is or is close to a device that is also a Verifier). And these systems > > generally have a way to "reach out" to the internet. > > > > The typically already existing "path" to follow here is the way > > updates find their way to a "network equipment device". If you are > > air-gap'ed or completely isolated wrt every layer 2 topology, it may > > start to become a bit tricky, but your are running around with usb > > sticks in hand to do updates then, too. > > > > YANG is a big solution for big problems. But you can use a YANG server > > to retrieve RIM that are stored on the Attester itself, of course. > > These probably are outdated at some point and then leave you with the > > same illustrated above, again. > > > > Viele Gr=FC=DFe, > > > > Henk > > > > > > On 29.04.20 15:56, Guy Fedorkow wrote: > >> Hi Henk, > >> > >> I see your proposal for identifying URIs for reference measurements > >> in > >> https://urldefense.com/v3/__https://tools.ietf.org/html/draft-birkhol > >> z > >> > -rats-mud-00__;!!NEt6yMaO-gk!WdyQ3vQ51adw93UKoSwWvgPFs4395vPI > WLjuzRBi > >> F > >> gldobaQ_dLIeFbhOWan0kBLDLY$ > >> > >> I realize that some constrained devices may not want to do this, > >> but do you think draft-charra could be extended to allow retrieval of > >> the signed reference measurements directly from the device being > >> attested, via the YANG / Netconf interface? > >> > >> Ironic as it may sound, I'm sure you know that many operators > >> ensure that their internet routers cannot access the public internet. > >> > >> Thanks, > >> > >> /guy > >> > >> > >> Juniper Business Use Only > >> >=20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats From nobody Thu Apr 30 00:32:16 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB7E63A0A53 for ; Thu, 30 Apr 2020 00:32:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K8HI9fXfzbvn for ; Thu, 30 Apr 2020 00:32:06 -0700 (PDT) Received: from mail-edgeDD24.fraunhofer.de (mail-edgeDD24.fraunhofer.de [192.102.167.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D80EA3A0A8C for ; Thu, 30 Apr 2020 00:32:04 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2GJAQBkpYde/xmnZsBmGgEBAQEBAQE?= =?us-ascii?q?BAQMBAQEBEQEBAQICAQEBAYF7gilsA1UvKgqEEY55gWQtiW6PcoFfCAoBAQE?= =?us-ascii?q?BAQEBAQEGAQEYCwoCBAEBAoFOgnQCgkckOBMCEAEBBgEBAQEBBQQCAmmFVgy?= =?us-ascii?q?DU34BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ8CDTYeNxIBAR0BAQEBAwE?= =?us-ascii?q?BIQ8BBTYLDAQJAhEEAQEBAgIjAwICIQYfAQgIBgEMAQUCAQEXgwsBgksDLgQ?= =?us-ascii?q?Lkz+bBHWBMoRJQUGCeA1igTgGgQ4qjDEPgUw/gREnD4JaPoIeSQEBAwGBLAE?= =?us-ascii?q?SAQmDKoJeBI12RIJFhieYTldHB4FJd3wEhm+FXIUfhDUjgkyMaQWMRo8ygVK?= =?us-ascii?q?HUYI8kD4CBAIJAhWBaSNncE0kT4JpUBgNjikXg1CFFIVDcgKBJ40ZAYEKBQE?= =?us-ascii?q?B?= X-IPAS-Result: =?us-ascii?q?A2GJAQBkpYde/xmnZsBmGgEBAQEBAQEBAQMBAQEBEQEBA?= =?us-ascii?q?QICAQEBAYF7gilsA1UvKgqEEY55gWQtiW6PcoFfCAoBAQEBAQEBAQEGAQEYC?= =?us-ascii?q?woCBAEBAoFOgnQCgkckOBMCEAEBBgEBAQEBBQQCAmmFVgyDU34BAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBAQ8CDTYeNxIBAR0BAQEBAwEBIQ8BBTYLDAQJA?= =?us-ascii?q?hEEAQEBAgIjAwICIQYfAQgIBgEMAQUCAQEXgwsBgksDLgQLkz+bBHWBMoRJQ?= =?us-ascii?q?UGCeA1igTgGgQ4qjDEPgUw/gREnD4JaPoIeSQEBAwGBLAESAQmDKoJeBI12R?= =?us-ascii?q?IJFhieYTldHB4FJd3wEhm+FXIUfhDUjgkyMaQWMRo8ygVKHUYI8kD4CBAIJA?= =?us-ascii?q?hWBaSNncE0kT4JpUBgNjikXg1CFFIVDcgKBJ40ZAYEKBQEB?= X-IronPort-AV: E=Sophos;i="5.72,341,1580770800"; d="scan'208";a="31509795" Received: from mail-mtadd25.fraunhofer.de ([192.102.167.25]) by mail-edgeDD24.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 30 Apr 2020 09:32:01 +0200 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B7DQCxfqpe/1lIDI1mHAEBAQEBAQc?= =?us-ascii?q?BARIBAQQEAQFAgUeCKm4DVDAqCoQXjnqBZC2Jdo99gWcLAQMBAQEBAQYBARg?= =?us-ascii?q?LCgIEAQGBUIJ0AoItJDgTAhABAQUBAQECAQUEbYUqASsMhXEBAQEBAwEBIQ8?= =?us-ascii?q?BBTYLDAQJAhEEAQEBAgIjAwICIQYfAQgIBgEMAQUCAQEXgwsBgksDMguXIZs?= =?us-ascii?q?DdoEyhE1BQoJyDWKBOgaBDiqMQQ+BTD+BEScPglo+gh5JAQEDAYEsARIBCYM?= =?us-ascii?q?qgmAEjiVEglKGOZkdWkoHgUt9fwSHEIV2hTaEQiOCW40nBY0AkAWBV4d0gkW?= =?us-ascii?q?QfQIEAgkCFYFpImZwTSRPgmlQGA2PEB+DGBeDT4UUhURBMQI0AgYBBwEBAwl?= =?us-ascii?q?8kF4BgQoFAQE?= X-IronPort-AV: E=Sophos;i="5.73,334,1583190000"; d="scan'208";a="81353464" Received: from mailext.sit.fraunhofer.de ([141.12.72.89]) by mail-mtaDD25.fraunhofer.de with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 30 Apr 2020 09:31:34 +0200 Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 03U7VV3q013149 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Thu, 30 Apr 2020 09:31:31 +0200 Received: from [192.168.16.50] (79.234.123.239) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Thu, 30 Apr 2020 09:31:25 +0200 To: "Panwei (William)" , Guy Fedorkow CC: "rats@ietf.org" , William Bellingrath , Jessica Fitzgerald-McKay References: <96c6bf0f-024d-972e-333f-edd288f3920f@sit.fraunhofer.de> <7a3b2b24-3dca-202b-fb83-3af52be25ee5@sit.fraunhofer.de> From: Henk Birkholz Message-ID: <318fe49a-40f9-d822-6ce8-015f0728f84b@sit.fraunhofer.de> Date: Thu, 30 Apr 2020 09:31:24 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [79.234.123.239] Archived-At: Subject: Re: [Rats] retrieving reference measurements X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Apr 2020 07:32:11 -0000 Hi Wei, hi Guy, it is relatively easy to include RIM (or as Dave highlighted we should fall back to Reference Values (Manifests) RVM) in software updates. I think there is wild agreement there. I think that is not the question, the question is how to retrieve them from the Attester and one option discussed are YANG management interfaces: As a test, I tried to model (Co)SWID as YANG once (https://datatracker.ietf.org/doc/draft-birkholz-yang-swid/): RIM/RVM can become quite big. Every reference value wrt to file integrity requires a file identifier that is applicable to file integrity measurements conducted by the Attester. Typically, a path and a file name are used (which apparently implies the existence of a file-system). Due to the volume of measurements, absolute path names create high redundancy in a RIM/RVM. (Co)SIWD address this issue by recreating a directory tree structure in the representation itself and therefore eliminating redundant segments in path notations. But - this requires the named type "directory" to be nested in the named type "directory" in order to construct that tree. That is possible in XML and CBOR, but not in YANG modeled data. In YANG, a circular use of statements (via groupings) is not allowed. Hence, it is not possible to use this "optimization" applied in (Co)SWID. The alternative is to fall-back to absolute paths and create an even larger volume of YANG model data. This would also break simple interoperability between YANG-SWID and (Co)SWID. It is not impossible - but at the moment I have doubts that it is feasible, though (and I arrived at the conclusion by trying to create a corresponding YANG module). If the module in draft-birkholz-yang-swid is acceptable (in general, details might still to be fixed) including the absolute path notation it uses, then we can revive that I-D. It's not that I did not thought about your proposal here already, I just thought it was not viable enough. Viele Grüße, Henk On 30.04.20 04:59, Panwei (William) wrote: > Hi Henk, Guy, > > I think the key point is that the YANG-modeled reference measurements or the YANG-modeled RIM should be defined. I also suggested this in my comments on draft-birkholz-rats-mud. I think there are two main reasons: > > 1) draft-birkholz-rats-coswid-rim defined the CoSWID-styled reference measurements. Meanwhile, draft-birkholz-rats-mud defines a YANG-modeled URI pointing at the reference measurements. So, by combining the two ideas together, the YANG-modeled reference measurements or YANG-modeled RIM can be defined directly in the MUD File. This way has an advantage that the Verifiers that only support YANG don't need to support CoSWID and do more implementation. > > 2) There is a use case that the reference measurements (signed by the vendor) can be stored at the network devices. In this case, the reference measurements can be retrieved by the Verifier via the YANG / NETCONF interface. Henk's concern is how to update the reference measurements when the network devices update, and Guy's suggestion is that the new reference measurements (also signed by the vendor) can be part of the vendor's software update package. > I agree with Guy that this is a reasonable use case, and there is a doable solution. (Besides, I also think this path for delivering reference measurements can be used by other devices as well.) Therefore, for the network devices that use the YANG / NETCONF interface, the YANG-modeled reference measurements or YANG-modeled RIM should be defined. And Guy proposed to define the YANG-modeled reference measurements in DraftC. > > So I think the YANG-modeled reference measurements are worthy to be defined, in draft-rats-mud or draft-charra or an independent draft. > > Regards & Thanks! > Wei Pan > >> -----Original Message----- >> From: RATS [mailto:rats-bounces@ietf.org] On Behalf Of Henk Birkholz >> Sent: Thursday, April 30, 2020 12:30 AM >> To: Guy Fedorkow >> Cc: rats@ietf.org; William Bellingrath ; Jessica >> Fitzgerald-McKay >> Subject: Re: [Rats] retrieving reference measurements >> >> Hi Guy, >> >> I think I misunderstood the intend of your initial question. I thought it was a >> "network isolation" question, but it is a "conveyance method" >> question, I think. >> >> CoSWID RIM tags use (and extend, actually), the payload-entry and >> therefore can be bundled in corresponding software/firmware packages >> that are updates. This is the reason why they are used in SUIT Manifests, too. >> >> If they are not included in a software package, they can be referred to via a >> MUD ULL / MUD File. MUD is simply a straight forward option to... >> point at device specific things. It is certainly not meant to be constraining >> options, it adds a increasingly popular one. >> >> Viele Grüße, >> >> Henk >> >> >> >> On 29.04.20 18:19, Guy Fedorkow wrote: >>> Hi Henk, >>> I understand that third-party RIMs could be used, but for embedded >>> equipment, it seems like the easiest path is to deliver the RIMs as >>> part of the vendor's software update package for the device. >>> Operators have well-worn procedures for getting software updates to >>> devices; if the RIM is just part of the package, they don't have to >>> think about a new procedure at all... >>> Maybe not for everyone, but it seems like it would be a common >> use-case... >>> Thanks >>> /guy >>> >>> >>> >>> Juniper Business Use Only >>> >>> -----Original Message----- >>> From: Henk Birkholz >>> Sent: Wednesday, April 29, 2020 11:29 AM >>> To: Guy Fedorkow >>> Cc: rats@ietf.org; Jessica Fitzgerald-McKay ; >>> William Bellingrath >>> Subject: Re: retrieving reference measurements >>> >>> [External Email. Be cautious of content] >>> >>> >>> Hi Guy, >>> >>> I think it would be strange for a network equipment device to expose a >>> potentially vulnerable management to the open internet, too :) >>> >>> Luckily, there will probably be a "higher level" constituent in the >>> network that an Attester's DevID can be presented to (typically this >>> is or is close to a device that is also a Verifier). And these systems >>> generally have a way to "reach out" to the internet. >>> >>> The typically already existing "path" to follow here is the way >>> updates find their way to a "network equipment device". If you are >>> air-gap'ed or completely isolated wrt every layer 2 topology, it may >>> start to become a bit tricky, but your are running around with usb >>> sticks in hand to do updates then, too. >>> >>> YANG is a big solution for big problems. But you can use a YANG server >>> to retrieve RIM that are stored on the Attester itself, of course. >>> These probably are outdated at some point and then leave you with the >>> same illustrated above, again. >>> >>> Viele Grüße, >>> >>> Henk >>> >>> >>> On 29.04.20 15:56, Guy Fedorkow wrote: >>>> Hi Henk, >>>> >>>> I see your proposal for identifying URIs for reference measurements >>>> in >>>> https://urldefense.com/v3/__https://tools.ietf.org/html/draft-birkhol >>>> z >>>> >> -rats-mud-00__;!!NEt6yMaO-gk!WdyQ3vQ51adw93UKoSwWvgPFs4395vPI >> WLjuzRBi >>>> F >>>> gldobaQ_dLIeFbhOWan0kBLDLY$ >>>> >>>> I realize that some constrained devices may not want to do this, >>>> but do you think draft-charra could be extended to allow retrieval of >>>> the signed reference measurements directly from the device being >>>> attested, via the YANG / Netconf interface? >>>> >>>> Ironic as it may sound, I'm sure you know that many operators >>>> ensure that their internet routers cannot access the public internet. >>>> >>>> Thanks, >>>> >>>> /guy >>>> >>>> >>>> Juniper Business Use Only >>>> >> >> _______________________________________________ >> RATS mailing list >> RATS@ietf.org >> https://www.ietf.org/mailman/listinfo/rats From nobody Thu Apr 30 18:06:38 2020 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 724CF3A0404 for ; Thu, 30 Apr 2020 18:06:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.597 X-Spam-Level: X-Spam-Status: No, score=-9.597 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=mbBEyQmL; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=SLUjo70l Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uQZN27S39XhS for ; Thu, 30 Apr 2020 18:06:34 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 602E33A0405 for ; Thu, 30 Apr 2020 18:06:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3407; q=dns/txt; s=iport; t=1588295194; x=1589504794; h=from:to:subject:date:message-id:mime-version; bh=ECg0wChkBWOpyFWB8TJNpaUTuCl5DJWjGhpI4A+SGUY=; b=mbBEyQmLdMc+quNLVpqg9dGcZGZEsKkJ1Zil1d/uosdCbm7WaA3Uo+U1 QS8xAIhFtSF53an78HwZ7MRbE5OBBAYHUMuqEIXp63/p/CaC+s83e3L1E pGlDqVqTYjC8KeayPKV9vw10kacDVgZVyD2Z35f264tHmcIzBjZVNi0oE g=; IronPort-PHdr: =?us-ascii?q?9a23=3A8OEG7BCATtyKMrMgyNhhUyQJPHJ1sqjoPgMT9p?= =?us-ascii?q?ssgq5PdaLm5Zn5IUjD/qw01g3IUJnVrfVehLmev6PhXDkG5pCM+DAHfYdXXh?= =?us-ascii?q?AIwcMRg0Q7AcGDBEG6SZyibyEzEMlYElMw+Xa9PBtUFdrwIVrIrS764TsbAB?= =?us-ascii?q?6qMw1zK6z8EZLTiMLi0ee09tXTbgxEiSD7b6l1KUC9rB7asY8dho4xJw=3D?= =?us-ascii?q?=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ChCQAgdate/40NJK1mHgEBCxIMgXw?= =?us-ascii?q?LgSUvUQVuWC8qCoQYg0YDizSVYYRigS6BJANUCwEBAQwBASMKAgQBAYREGYI?= =?us-ascii?q?ZJDQJDgIDAQELAQEFAQEBAgEFBG2FVgELhgoRHQEBOBEBDD4CBDAnBDWDBAG?= =?us-ascii?q?Bfk0DLgEOqHACgTmIYXaBMoMAAQEFgkmCeBiCDgMGgTiCY4JHhxcaggCBOBy?= =?us-ascii?q?BOIJXgWMCAhqBdoJlM4ItkUWGF5psCoJGmAodnRSQD50WAgQCBAUCDgEBBYF?= =?us-ascii?q?SOYFWcBVlAYI+UBgNkEIMDAuDT4pWdAI0AgYBBwEBAwl8jS8BgQ8BAQ?= X-IronPort-AV: E=Sophos;i="5.73,337,1583193600"; d="scan'208,217";a="752252475" Received: from alln-core-8.cisco.com ([173.36.13.141]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 01 May 2020 01:06:33 +0000 Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by alln-core-8.cisco.com (8.15.2/8.15.2) with ESMTPS id 04116XIV028671 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Fri, 1 May 2020 01:06:33 GMT Received: from xhs-rtp-001.cisco.com (64.101.210.228) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 30 Apr 2020 20:06:33 -0500 Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 30 Apr 2020 21:06:31 -0400 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Thu, 30 Apr 2020 21:06:31 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kZVNQUmktHmlQ1IaQ7u3CoecWCzLWdmPXQK/80uT2SFWKRw97ahV/kQOryiX+hgcVYx7PBSuEm31y5uBqg16t8jIDhNBfhYaWxHAY0qzCllScnZHWNM/9hePK0U5ozfw8Dz0Xt9375hbXtN0J5kfHSOnXb1Y4YV3aizLfusNmi39RKcyM424q/G7cvTFwVicRAWUkcfkvDU9iO+9qBH5REQ70O35iJXBE1Eq+wzW5eo4PqEgkyTB7DWiDCdxJGB+DeOlKdAz+mmZYCc3HAubgKgpKIwTn//RnvZaFS0UoOiIF/tqKVaroPqiQavWSmZMutVK+aUUB3Oe+OVc/cUQow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ECg0wChkBWOpyFWB8TJNpaUTuCl5DJWjGhpI4A+SGUY=; b=Akd08ATGGz3UXQAIQvi5jcitp5rfGo68bdxFDwzQW6c/sYIghyogaaQWtrW/3CJm8xCkbN2V078P2TgUvf+MMjz1uU8mVJ/htLPtqv6J/RLG/+sfooGtDuWdaRwjQDNB8SeH6/AlyMuBIhgbNFlv7mSVu5RbKJdwl05mATqcuZPMXSGJpEOYakeAZL8Fc0GAeGqhh+Mk5MhMndSaKax5lMvRIAIR0Ui9FINjFKKcp8y2XDiwQdHoN4JCo7R0ZGHAPxJQeDd10JfUfgdW3iHh8OzJ+9XeDd2xSqcbj9ykkqomiH3phVqo0up4sQIfdk8umLRShypxOjY4xS58pXH78g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ECg0wChkBWOpyFWB8TJNpaUTuCl5DJWjGhpI4A+SGUY=; b=SLUjo70lk8G+5WvQev+7MSeNmW0+kaOM/2kEeDlpVu44ZbpJbITJ01iz65gbbXTYFtKpz824c8KO0WuOlCyw70gUKvCqX21k+JBQ/tNE/iDcZw05MEh4iU+G4yfkdeq/awxqCzfJm703cVdIWP13zQztxnEYyFmCeWY6ar1CeAA= Received: from BY5PR11MB4070.namprd11.prod.outlook.com (2603:10b6:a03:181::16) by BY5PR11MB4498.namprd11.prod.outlook.com (2603:10b6:a03:1c2::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2958.19; Fri, 1 May 2020 01:06:30 +0000 Received: from BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::101e:db5b:b661:949]) by BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::101e:db5b:b661:949%6]) with mapi id 15.20.2937.028; Fri, 1 May 2020 01:06:30 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "rats@ietf.org" Thread-Topic: April 28 Virtual Interim recording Thread-Index: AQHWH1S/5ie5m+PoWkCUOUGRcW2y8w== Date: Fri, 1 May 2020 01:06:30 +0000 Message-ID: <97CF9AFE-75A8-4DB6-95E1-490C5AFDDA86@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.15.200413 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=cisco.com; x-originating-ip: [73.162.233.180] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b0b0c097-8722-4fd6-7be3-08d7ed6be23e x-ms-traffictypediagnostic: BY5PR11MB4498: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-forefront-prvs: 0390DB4BDA x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 7A71/1oMojE2y7COSc6xVQTYmMz82ix/l6dNHjhqFKlV7QnipNN8OS6ZBjinuTm+yIAZpgWg0+rdhxYMvXGXkui/9eGhmBWkz4/Y2N3C3N559ITcNlO3cUhwo4guQllgCSaqfkJxPkLIYsovnHPbeksrGkuoyHAGlvggVlc1xkLksidrYYOPyR6Sh1/UD9n8CLOOzwdIwYZqaYpAsFeZ5KQoRuy++xsmvNntVdECpAW9GlHAQ2dBiqIJorCfRwKE+G8vmNHmgN2UnwL/kpIZozjLVDkRrPchIsAvJNRxqfuioNnCD0WkA5aubhfqM8lxbR6ze9mv/chjuElM5hghrcTvkw0CK2KIsCBUKd9ea1HzwF67NHDM0KBm83JE9hdIOl2shhCuSw6nfXYF6C7cezkBzz/wnsnrWniDjpGocUynVxAI699/tvBfIBt/VM1mglZC6dSCFNx4UilIgEoVP8WdNixnXAttabZ3DtIAWQKLrKmdNtlHi7wZBQhdSs5q9UP7P+aYa3Plo1svcw3vew== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR11MB4070.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(376002)(346002)(136003)(366004)(39860400002)(396003)(8936002)(8676002)(33656002)(316002)(6506007)(6512007)(66556008)(66476007)(66946007)(76116006)(64756008)(66446008)(558084003)(6486002)(6916009)(966005)(478600001)(36756003)(26005)(71200400001)(5660300002)(86362001)(186003)(2616005)(2906002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: jGB2vrbJWJRaFm83TNIUwAHni56AqQLlQoIFaGyo1lL1l3ZyWyt0kH/gjfQ1PIDFaTnYMGKyHgBytGwgDN/Na7DZYGO8jGprHlyNMPAEvQHLFa495DxRTeCuMpo9wtQTbhtsWl84KWRyvFSLYBIoaJt3B7gtUtSjn4MiTFN1wQWObZ+6ncN41WHpNVpzBogW33U3ewKhm4syNxw6zkZDZFgHCLbH+KEnHNAQQ+sMnbY20ki8mFSBxmB/D59zBDjdzsERDCFTMCZvr7Prsv+FrtGNPDQNOb6Z30VkHFdFANgj/cbPCEkHFbJztN0Nx4J6D3ElrXh1Us4kRnQx3XlTggNmmXnHkaEV4xwva2f4Tm1nr7SvcS0HR55iQyqPAZaDn+RKeQDR3w36wcTr9/BM748DoDECmsedcZl8vO3E+xMuSToweZmYYR1xaMYpTyGyCjBqnvL7krGOWGiS5BiewOI+4GKwFtk+v4kqzbkX0LhoRgs2h1xaCAl1weaXuouAmIHLY9TZ7kScxXwZVyQjijfIbBXMFOVp7WbIXaGM+Osl8UfqFR0oc0jfxaIEJhK/VNObBvRAKCrGuN2doGpTCB/9Sr2T2bEbonX7bJ562HqVujMmHQjm0+fBTibOGsywLlzy/Qc6X8PsjnByM+HJuPeai+cgTGJvezsi/frTifb/4IiCG9VdzdhcbfxdwoHjHa/SHXMnGrV99US/mVemU/nQ1fajFE2crzWWLaiJmBc1bHlN+I5m++BUSkCYn9Bk3GKvtXgNL7KC+Li8L6p7MtzNaiaBsxQTN5sm8zkkjDk= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_97CF9AFE75A84DB695E1490C5AFDDA86ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: b0b0c097-8722-4fd6-7be3-08d7ed6be23e X-MS-Exchange-CrossTenant-originalarrivaltime: 01 May 2020 01:06:30.7894 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Iq3slT0Uz6ukbjxVDPF/0FFk8SPwqjqWnff+dFRlLHRLEs7zNJPmQlHDDFanulQzjRQaWcEnLRbNHgOE8O44fw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4498 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.14, xch-rcd-004.cisco.com X-Outbound-Node: alln-core-8.cisco.com Archived-At: Subject: [Rats] April 28 Virtual Interim recording X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote ATtestation procedureS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 May 2020 01:06:37 -0000 --_000_97CF9AFE75A84DB695E1490C5AFDDA86ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGVsbG8gUkFUcyBwYXJ0aWNpcGFudHMsDQpJIGRpZG7igJl0IHF1aXRlIGdldCB0aGUgcmVjb3Jk aW5nIHN0YXJ0ZWQgb24gdGltZSwgYnV0IHdlIGRpZCBjYXB0dXJlIG1vc3Qgb2YgaXQgYW5kIGhh cyBub3cgYmVlbiBwb3N0ZWQgaW46DQpodHRwczovL3d3dy55b3V0dWJlLmNvbS93YXRjaD92PWFS T0R0SDlvTnBrJmZlYXR1cmU9eW91dHUuYmUNCg0KQmVzdCwgTmFuY3kNCg== --_000_97CF9AFE75A84DB695E1490C5AFDDA86ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij5IZWxsbyBSQVRzIHBhcnRpY2lwYW50cyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SSBk aWRu4oCZdCBxdWl0ZSBnZXQgdGhlIHJlY29yZGluZyBzdGFydGVkIG9uIHRpbWUsIGJ1dCB3ZSBk aWQgY2FwdHVyZSBtb3N0IG9mIGl0IGFuZCBoYXMgbm93IGJlZW4gcG9zdGVkIGluOjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vd3d3 LnlvdXR1YmUuY29tL3dhdGNoP3Y9YVJPRHRIOW9OcGsmYW1wO2ZlYXR1cmU9eW91dHUuYmUiPmh0 dHBzOi8vd3d3LnlvdXR1YmUuY29tL3dhdGNoP3Y9YVJPRHRIOW9OcGsmYW1wO2ZlYXR1cmU9eW91 dHUuYmU8L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkJlc3QsIE5hbmN5 PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_97CF9AFE75A84DB695E1490C5AFDDA86ciscocom_--