From nobody Thu Dec 1 04:23:22 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0A47129647; Thu, 1 Dec 2016 04:23:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BCohWiOdsf7b; Thu, 1 Dec 2016 04:23:19 -0800 (PST) Received: from mail-qt0-x243.google.com (mail-qt0-x243.google.com [IPv6:2607:f8b0:400d:c0d::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ECD1212949B; Thu, 1 Dec 2016 04:23:18 -0800 (PST) Received: by mail-qt0-x243.google.com with SMTP id m48so23283109qta.2; Thu, 01 Dec 2016 04:23:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=zDz9kPzKdM9+uXsBeDzPkRp6PPjbi4zdZ9r5+JaR6n4=; b=kXn81mG1OD+kT5B6/lSzund9wDeH581sss++QuaJFO8Om5KzKKgmgYWYLMp4+BTUqP iDIt0XMOS8iE4WiYYy+BkeK0kKRmiF04HfJsb8n/XwqXn68AccS1mA5hIUfuviJQfRUb V2PA7GJ4w2+CsV+djLFQVTbbjdmrxVLBnkn+joitSlhFd2mFUd8ZbM4mLgIDV9AFfnDU JAGVejH2taRrQIc9whHOopFte8Y3SmZhqHrAnvR388rlkR2+GZA4p+rsz3fO/SnqkQxU +UVMEs+i8Jr0Pgif8tqrNqe78sbKy1jdpji1vigPF/KK2IRpr7WktdPeZtlU6L2Is6do Ravg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=zDz9kPzKdM9+uXsBeDzPkRp6PPjbi4zdZ9r5+JaR6n4=; b=Cluv2rwNjU5gioOi9b9dLT55WQoi36BjZFzBwb/z2OAZJadx3N9qzuwaewKSjisTL4 Lfb+6jL86g6BnpkOiv7KC7reDX5eHfRyD/1uPDOrnV7R79bHnQmV/7/N9fWbmJyCpS2y sORakGjw5ES95kGk7wtaMPPnNx2Dp7EqeIsHH+BFe/lHOl5aGcygPdWjpbHawY8MKnmZ oORmQE0GKHOUSf9xbX2jSTzE1QdsN7PAQGLXKzsgptZiDLMgJge9AOh/CSETVJtqmVAP Yclx4RKl9cr1du8EwMFZWP+o+Jes6asLzOPUta/LxRVBTS148Pwt8awevHH68FWnuzCN 5qtQ== X-Gm-Message-State: AKaTC001ffOXzUZFWj/O9kIlkf+xD1/leQd6klnYAHCEoFb2s71HAWU5soaeNqVLGSKqFzH3RCJvlBakl3OSNw== X-Received: by 10.200.34.56 with SMTP id o53mr37235706qto.272.1480594998133; Thu, 01 Dec 2016 04:23:18 -0800 (PST) MIME-Version: 1.0 Sender: christopher.morrow@gmail.com Received: by 10.140.27.179 with HTTP; Thu, 1 Dec 2016 04:23:17 -0800 (PST) In-Reply-To: <55A37339-61E6-4D44-A00C-8718A05584A1@zdns.cn> References: <55A37339-61E6-4D44-A00C-8718A05584A1@zdns.cn> From: Christopher Morrow Date: Thu, 1 Dec 2016 07:23:17 -0500 X-Google-Sender-Auth: nluiUCBlsTXHWSV2d9JxXe9qeX4 Message-ID: To: Declan Ma Content-Type: multipart/alternative; boundary=001a11406abaeba611054297e202 Archived-At: Cc: Chris Morrow , sidr-ads@ietf.org, "sidr-chairs@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] Current document status && directionz X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 12:23:21 -0000 --001a11406abaeba611054297e202 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Thu, Dec 1, 2016 at 1:51 AM, Declan Ma wrote: > Chris, > > I would like to take this thread to request for comments on how to move o= n > SLURM. > > During the Seoul meeting, Tim suggested moving it to SIDROPS since SIDR i= s > being closed. > > Yet I had the impression that the AD hopes keeping the list/structure > going until current work items are done. > > Considering the only issue facing SLURM is the file format that Tim and > Rudiger mentioned in the MIC, IMHO, if this WG won=E2=80=99t plan to move= SLURM to > SIDROPS, WGLC is desirable to bring about inputs and comments to conclude > this work. > > if we're just haggling on format... then let's try to finish here? How about we give it until ~monday for comments here, then start WGLC if no comments/movement? > > Di > > > > =E5=9C=A8 2016=E5=B9=B412=E6=9C=881=E6=97=A5=EF=BC=8C02:33=EF=BC=8CChri= stopher Morrow =E5=86=99=E9=81=93=EF=BC=9A > > > > And again, restarting... post meeting and post travel refocusing :) > > > > On Wed, Oct 26, 2016 at 11:35 AM, Christopher Morrow < > morrowc.lists@gmail.com> wrote: > > Restarting this thread, with some updates :) > > > > Preparing for Seoul in a few weeks time, with the intent that we do not > meet face-to-face in Chicago, have all current 'protocol' related docs to > the IESG/done and meet instead in sidr-ops if there are agenda items at > that time :) > > > > Currently we have the following in IESG/pub-request status (13 > documents): > > draft-ietf-sidr-adverse-actions > > draft-ietf-sidr-as-migration > > draft-ietf-sidr-bgpsec-algs > > draft-ietf-sidr-bgpsec-ops > > draft-ietf-sidr-bgpsec-overview > > draft-ietf-sidr-bgpsec-pki-profiles > > draft-ietf-sidr-bgpsec-protocol > > draft-ietf-sidr-delta-protocol (10/26 sent forward) > > > > draft-ietf-sidr-origin-validation-signaling > > draft-ietf-sidr-publication > > draft-ietf-sidr-rpki-oob-setup > > draft-ietf-sidr-rpki-rtr-rfc6810-bis > > > > > > I had thought I sent validation-reconsidered forward for processing, I'= m > doing that today: > > draft-ietf-sidr-rpki-validation-reconsidered > > > > Currently still active documents (6 documents): > > > > draft-ietf-sidr-bgpsec-rollover > > draft-ietf-sidr-lta-use-cases > > draft-ietf-sidr-route-server-rpki-light > > draft-ietf-sidr-rpki-tree-validation > > draft-ietf-sidr-rtr-keying > > draft-ietf-sidr-slurm > > > > (this reflects the changes since the last email, included below) > > > > I believe we're still planning to move (and have agreement from authors= ): > > draft-ietf-sidr-bgpsec-rollover > > draft-ietf-sidr-lta-use-cases > > draft-ietf-sidr-route-server-rpki-light > > draft-ietf-sidr-rtr-keying > > > > draft-ietf-sidr-rpki-tree-validation > > > > which leaves to be dealt with by Chicago 2 documents: > > draft-ietf-sidr-slurm > > > > I think this is good, I believe (and of course I should be corrected if > wrong) > > slurm - more work inbound and discussion planned in Seoul > > tree-validation - I thought moved to sidr-ops, but don't have docs to > back that up. > > > > > > I still think this is good, I will be sending a request to the OPS-AD > folk today to move: > > draft-ietf-sidr-bgpsec-rollover > > draft-ietf-sidr-lta-use-cases > > draft-ietf-sidr-route-server-rpki-light > > draft-ietf-sidr-rtr-keying > > draft-ietf-sidr-rpki-tree-validation > > > > to sidr-ops... If there are corrections/additions please send them alon= g > :) > > > > -chris > > > > -chris > > > > On Fri, Sep 2, 2016 at 4:56 PM, Chris Morrow > wrote: > > > > Howdy SIDR peeps, > > (+bonus ops ad) > > > > Following on the Berlin meeting we were trying to accomplish two > > things: > > > > 1) get all documents related to sidr protocols into wglc and then > > publication > > > > 2) get all documents which are more operationally focused moved > > along to an ops group (sidr-ops or something akin to that) > > > > With that in mind there are 8 documents in the publication queue: > > draft-ietf-sidr-as-migration > > draft-ietf-sidr-bgpsec-algs > > draft-ietf-sidr-bgpsec-ops > > draft-ietf-sidr-bgpsec-overview > > draft-ietf-sidr-bgpsec-pki-profiles > > draft-ietf-sidr-bgpsec-protocol > > draft-ietf-sidr-origin-validation-signaling > > draft-ietf-sidr-rpki-rtr-rfc6810-bis > > > > and 11 still in progress. Of the 11 left Sandy and I think they > > roughly break down like: > > > > Documents which should move to the ops group: > > draft-ietf-sidr-bgpsec-rollover > > draft-ietf-sidr-lta-use-cases > > draft-ietf-sidr-route-server-rpki-light - authors notified/queried > about this > > draft-ietf-sidr-rtr-keying > > > > documents which should finish out in sidr: > > draft-ietf-sidr-delta-protocol > > draft-ietf-sidr-publication > > draft-ietf-sidr-rpki-oob-setup - pub request in flight > > draft-ietf-sidr-rpki-tree-validation > > draft-ietf-sidr-rpki-validation-reconsidered > > draft-ietf-sidr-slurm - authors recently updated > > draft-ietf-sidr-adverse-actions - wglc imminent > > > > I think if there's no meaningful discussion on change for these > > between now and 9/16/2016 (Sept 16th) we will assume this list is > > correct. For documents in the 'move' list, if progress to publication > > happens 'good!'. For all documents in the 'stays' list: > > 1) we aim to have wglc by Seoul > > 2) publication requests started on as many as possible > > > > We plan to meet in Seoul, but not in Chicago (Mar 2017) where we > > expect the ops group to exist and meet. We can progress documents in > > SIDR after Seoul, but the WG should close out shortly after the new > > year. (or that's the goal). > > > > Thoughts? > > -chris > > > > _______________________________________________ > > sidr mailing list > > sidr@ietf.org > > https://www.ietf.org/mailman/listinfo/sidr > > > > > > _______________________________________________ > > sidr mailing list > > sidr@ietf.org > > https://www.ietf.org/mailman/listinfo/sidr > > --001a11406abaeba611054297e202 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Thu, Dec 1, 2016 at 1:51 AM, Declan Ma <madi@zdns.cn> wrot= e:
Chris,

I would like to take this thread to request for comments on how to move on = SLURM.

During the Seoul meeting, Tim suggested moving it to SIDROPS since SIDR is = being closed.

Yet I had the impression that the AD hopes keeping the list/structure going= until current work items are done.

Considering the only issue facing SLURM is the file format that Tim and Rud= iger mentioned in the MIC, IMHO, if this WG won=E2=80=99t plan to move SLUR= M to SIDROPS, WGLC is desirable to bring about inputs and comments to concl= ude this work.


if we're just haggling on format..= . then let's try to finish here?
How about we give it until ~= monday for comments here, then start WGLC if no comments/movement?
=C2=A0

Di


> =E5=9C=A8 2016=E5=B9=B412=E6=9C=881=E6=97=A5=EF=BC=8C02:33=EF=BC=8CChr= istopher Morrow <morrowc.list= s@gmail.com> =E5=86=99=E9=81=93=EF=BC=9A
>
> And again, restarting... post meeting and post travel refocusing :) >
> On Wed, Oct 26, 2016 at 11:35 AM, Christopher Morrow <morrowc.lists@gmail.com> wrote:
> Restarting this thread, with some updates :)
>
> Preparing for Seoul in a few weeks time, with the intent that we do no= t meet face-to-face in Chicago, have all current 'protocol' related= docs to the IESG/done and meet instead in sidr-ops if there are agenda ite= ms at that time :)
>
> Currently we have the following in IESG/pub-request status (13 documen= ts):
> draft-ietf-sidr-adverse-actions
> draft-ietf-sidr-as-migration
> draft-ietf-sidr-bgpsec-algs
> draft-ietf-sidr-bgpsec-ops
> draft-ietf-sidr-bgpsec-overview
> draft-ietf-sidr-bgpsec-pki-profiles
> draft-ietf-sidr-bgpsec-protocol
>=C2=A0 =C2=A0 =C2=A0draft-ietf-sidr-delta-protocol (10/26 sent forward)=
>
> draft-ietf-sidr-origin-validation-signaling
> draft-ietf-sidr-publication
> draft-ietf-sidr-rpki-oob-setup
> draft-ietf-sidr-rpki-rtr-rfc6810-bis
>
>
> I had thought I sent validation-reconsidered forward for processing, I= 'm doing that today:
> draft-ietf-sidr-rpki-validation-reconsidered
>
>=C2=A0 Currently still active documents (6 documents):
>
> draft-ietf-sidr-bgpsec-rollover
> draft-ietf-sidr-lta-use-cases
> draft-ietf-sidr-route-server-rpki-light
> draft-ietf-sidr-rpki-tree-validation
> draft-ietf-sidr-rtr-keying
> draft-ietf-sidr-slurm
>
> (this reflects the changes since the last email, included below)
>
> I believe we're still planning to move (and have agreement from au= thors):
>=C2=A0 draft-ietf-sidr-bgpsec-rollover
>=C2=A0 draft-ietf-sidr-lta-use-cases
>=C2=A0 draft-ietf-sidr-route-server-rpki-light
>=C2=A0 draft-ietf-sidr-rtr-keying
>
> draft-ietf-sidr-rpki-tree-validation
>
> which leaves to be dealt with by Chicago 2 documents:
> draft-ietf-sidr-slurm
>
> I think this is good, I believe (and of course I should be corrected i= f wrong)
>=C2=A0 =C2=A0slurm - more work inbound and discussion planned in Seoul<= br> >=C2=A0 =C2=A0tree-validation - I thought moved to sidr-ops, but don'= ;t have docs to back that up.
>
>
> I still think this is good, I will be sending a request to the OPS-AD = folk today to move:
>=C2=A0 draft-ietf-sidr-bgpsec-rollover
>=C2=A0 draft-ietf-sidr-lta-use-cases
>=C2=A0 draft-ietf-sidr-route-server-rpki-light
>=C2=A0 draft-ietf-sidr-rtr-keying
>=C2=A0 draft-ietf-sidr-rpki-tree-validation
>
> to sidr-ops... If there are corrections/additions please send them alo= ng :)
>
> -chris
>
> -chris
>
> On Fri, Sep 2, 2016 at 4:56 PM, Chris Morrow <morrowc@ops-netman.net> wrote:
>
> Howdy SIDR peeps,
> (+bonus ops ad)
>
> Following on the Berlin meeting we were trying to accomplish two
> things:
>
>=C2=A0 =C2=A01) get all documents related to sidr protocols into wglc a= nd then
>=C2=A0 =C2=A0publication
>
>=C2=A0 =C2=A02) get all documents which are more operationally focused = moved
>=C2=A0 =C2=A0along to an ops group (sidr-ops or something akin to that)=
>
> With that in mind there are 8 documents in the publication queue:
>=C2=A0 =C2=A0draft-ietf-sidr-as-migration
>=C2=A0 =C2=A0draft-ietf-sidr-bgpsec-algs
>=C2=A0 =C2=A0draft-ietf-sidr-bgpsec-ops
>=C2=A0 =C2=A0draft-ietf-sidr-bgpsec-overview
>=C2=A0 =C2=A0draft-ietf-sidr-bgpsec-pki-profiles
>=C2=A0 =C2=A0draft-ietf-sidr-bgpsec-protocol
>=C2=A0 =C2=A0draft-ietf-sidr-origin-validation-signaling
>=C2=A0 =C2=A0draft-ietf-sidr-rpki-rtr-rfc6810-bis
>
> and 11 still in progress. Of the 11 left Sandy and I think they
> roughly break down like:
>
> Documents which should move to the ops group:
>=C2=A0 =C2=A0draft-ietf-sidr-bgpsec-rollover
>=C2=A0 =C2=A0draft-ietf-sidr-lta-use-cases
>=C2=A0 =C2=A0draft-ietf-sidr-route-server-rpki-light - authors not= ified/queried about this
>=C2=A0 =C2=A0draft-ietf-sidr-rtr-keying
>
> documents which should finish out in sidr:
>=C2=A0 =C2=A0draft-ietf-sidr-delta-protocol
>=C2=A0 =C2=A0draft-ietf-sidr-publication
>=C2=A0 =C2=A0draft-ietf-sidr-rpki-oob-setup - pub request in flight
>=C2=A0 =C2=A0draft-ietf-sidr-rpki-tree-validation
>=C2=A0 =C2=A0draft-ietf-sidr-rpki-validation-reconsidered
>=C2=A0 =C2=A0draft-ietf-sidr-slurm - authors recently updated
>=C2=A0 =C2=A0draft-ietf-sidr-adverse-actions - wglc imminent
>
> I think if there's no meaningful discussion on change for these > between now and 9/16/2016 (Sept 16th) we will assume this list is
> correct. For documents in the 'move' list, if progress to publ= ication
> happens 'good!'. For all documents in the 'stays' list= :
>=C2=A0 =C2=A01) we aim to have wglc by Seoul
>=C2=A0 =C2=A02) publication requests started on as many as possible
>
> We plan to meet in Seoul, but not in Chicago (Mar 2017) where we
> expect the ops group to exist and meet. We can progress documents in > SIDR after Seoul, but the WG should close out shortly after the new > year. (or that's the goal).
>
> Thoughts?
> -chris
>
> _______________________________________________
> sidr mailing list
> sidr@ietf.org
> https://www.ietf.org/mailman/listinfo/sidr >
>
> _______________________________________________
> sidr mailing list
> sidr@ietf.org
> https://www.ietf.org/mailman/listinfo/sidr

--001a11406abaeba611054297e202-- From nobody Thu Dec 1 05:34:45 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 144901296E3; Thu, 1 Dec 2016 05:34:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q9VS0xKx-QGk; Thu, 1 Dec 2016 05:34:42 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E3881295F2; Thu, 1 Dec 2016 05:34:42 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cCRVW-0006q3-Pc; Thu, 01 Dec 2016 13:34:38 +0000 Date: Thu, 01 Dec 2016 05:34:37 -0800 Message-ID: From: Randy Bush To: Christopher Morrow In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: Chris Morrow , sidr-ads@ietf.org, "sidr-chairs@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] Current document status && directionz X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 13:34:44 -0000 >>>> draft-ietf-sidr-rtr-keying >> i thought this was done > this one maybe done, but has not hit WGLC. we can do that here, or > there... I'm agnostic at this point. this is protocol, not ops randy From nobody Thu Dec 1 18:11:04 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7495F1295B9; Thu, 1 Dec 2016 18:11:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9RQsUKTOwz14; Thu, 1 Dec 2016 18:10:58 -0800 (PST) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CD6E129A60; Thu, 1 Dec 2016 18:10:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=69852; q=dns/txt; s=iport; t=1480644658; x=1481854258; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=/B2tasCvXkJlR1lRP9Z89vZomqwOCXY3ogFUL08XR/M=; b=bKMIrq/g5GOd6YpiMCgTYaPs+16n2pPBJY1GP29f5T0X/tU+zV5uW9t/ 4Hmhui4PltZqoEXFhCW3NzNmNnSJvAIcQWcXhwvIytNPNJcvttuRU2IfR sl7vmnfu1xVxAMJ4nvQjWZ0t7yPIu2hCk+JyhsskwklqKQNc6Ubg8ZVUa I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AdAQCe10BY/4sNJK1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgnNFAQEBAQEfWIEGB40+lwuUeIIFhiICGoFzPxQBAgEBAQEBAQF?= =?us-ascii?q?iKIRpAQEDARoBCCQyBQsCAQYCOAEJAgICMCUCBAENBRuFY4JnCI5NnUWCKS+DE?= =?us-ascii?q?4d+AQEBAQEBAQEBAQEBAQEBAQEBAQEBHIY+gX2CXoRggm0tgjAFiFeHY4Q7hWk?= =?us-ascii?q?BkQ+BcoR7g0GGCIddiigBHjeBGSMOAQGDKRyBXXKHCCuBA4ENAQEB?= X-IronPort-AV: E=Sophos;i="5.33,284,1477958400"; d="scan'208,217";a="176166849" Received: from alln-core-6.cisco.com ([173.36.13.139]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 02 Dec 2016 02:10:56 +0000 Received: from XCH-ALN-001.cisco.com (xch-aln-001.cisco.com [173.36.7.11]) by alln-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id uB22Auc1024589 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 2 Dec 2016 02:10:56 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-001.cisco.com (173.36.7.11) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 1 Dec 2016 20:10:55 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Thu, 1 Dec 2016 20:10:55 -0600 From: "Alvaro Retana (aretana)" To: "Sriram, Kotikalapudi (Fed)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-protocol-18 Thread-Index: AQHSNR6CtOW/YAot7EOz/vffo+bn+w== Date: Fri, 2 Dec 2016 02:10:55 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_B364FC57DEE24A08B9EC5235CDCD0634ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-protocol-18 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 02:11:02 -0000 --_000_B364FC57DEE24A08B9EC5235CDCD0634ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gMTEvMjcvMTYsIDEyOjIxIFBNLCAiU3JpcmFtLCBLb3Rpa2FsYXB1ZGkgKEZlZCkiIDxrb3Rp a2FsYXB1ZGkuc3JpcmFtQG5pc3QuZ292PiB3cm90ZToNCg0KDQoNClNyaXJhbToNCg0KDQoNCkhp ISAgVGhhbmtzIGZvciBhZGRyZXNzaW5nIG15IGNvbW1lbnRzLiAgSSBoYXZlIHNvbWUgcmVtYWlu aW5nIGNvbW1lbnRzIGJlbG93LiAgSSBmbGFnZ2VkIGEgY291cGxlIG9mIGl0ZW1zIHRoYXQgSSB0 aGluayB0aGUgQ2hhaXJzIHNob3VsZCBjb25zdWx0IHRoZSBXRyBvbiwgYnV0IEnigJlsbCBsZWF2 ZSBpdCB1cCB0byB0aGVtIHRvIGRlY2lkZSB0aGF0IOKAkyBub3RlIHRoYXQgSSBkb27igJl0IHRo aW5rIHdlIG5lZWQgdG8gV0dMQyB0aGUgd2hvbGUgZG9jdW1lbnQgYWdhaW4sIGp1c3QgYSBjb3Vw bGUgb2YgZGVjaXNpb25zLg0KDQoNCg0KSSBhbHNvIGFkZGVkIGEgY291cGxlIG9mIG5ldyBjb21t ZW50cyBhdCB0aGUgZW5kLg0KDQoNCg0KSSB0aGluayB3ZSBhcmUgY2xvc2VyLCBidXQgdGhlcmUg YXJlIHN0aWxsIGEgY291cGxlIG9mIGl0ZW1zIHdoZXJlIHdl4oCZcmUgbm90IGFncmVlaW5nOiAg dHJlYXRtZW50IG9mIGR1cGxpY2F0ZXMgYW5kIGNvbmZlZGVyYXRpb25zLiAgV2UgY2FuIGNvbnRp bnVlIHRoZSBkaXNjdXNzaW9uIOKAkyBJIHdvdWxkIGxvdmUgdG8gaGVhciBvdGhlciBvcGluaW9u cyBhcyB3ZWxsIChmcm9tIHRoZSBXRykuDQoNCg0KDQpJbiB0aGUgbWVhbnRpbWUsIEkgd2lsbCBz dGFydCB0aGUgSUVURiBMYXN0IENhbGwgYW5kIHJlcXVlc3QgYSBSVEctRGlyIHJldmlldyBhcyB3 ZWxsLiAgQWRkcmVzc2luZyB3aGF0IHdlIHNlZW0gdG8gYWdyZWUgb24gKEkgcHJvcG9zZWQgc29t ZSBjaGFuZ2VzIGJlbG93IGZvciBjbGFyaXR5KSBpbiB0aGUgbmV4dCBmZXcgZGF5cyB3b3VsZCBk ZWZpbml0ZWx5IGhlbHAgdGhlIHByb2Nlc3MuDQoNCg0KDQpUaGFua3MhDQoNCg0KDQpBbHZhcm8u DQoNCg0KDQoNCg0K4oCmDQoNCj4gW1NyaXJhbV0gRm9sbG93aW5nIHRoZSBjbGFyaWZpY2F0aW9u cyBhbmQgYWRkaXRpb25hbCBndWlkYW5jZSB5b3UgcHJvdmlkZWQgaW4gU2VvdWwgKHdoZW4NCg0K PiB5b3UsIENocmlzLCBhbmQgSSBtZXQpLCBJIGhhdmUgYWRkZWQgYSBuZXcgU2VjdGlvbiA3IChP cGVyYXRpb25zIGFuZCBNYW5hZ2VtZW50DQoNCj4gQ29uc2lkZXJhdGlvbnMpLiBUaGUgdG9waWNz IHlvdSBtZW50aW9uIGFib3ZlIGFyZSBhbGwgY292ZXJlZCBpbiB0aGUgbmV3IFNlY3Rpb24gNy4N Cg0KDQoNClRoYW5rcyBmb3IgYWRkaW5nIHRoaXMgU2VjdGlvbi4gIEkgdGhpbmsgdGhlIGVzc2Vu Y2Ugb2Ygd2hhdCB3ZSB0YWxrZWQgYWJvdXQgaXMgdGhlcmUsIGJ1dCB0aGUgdGV4dCBuZWVkcyBz b21lIGVkaXRpbmcuICBJ4oCZbSBwdXR0aW5nIHNvbWUgc3VnZ2VzdGlvbnMgYmVsb3cg4oCTIGtl ZXAgaW4gbWluZCB0aGF0IHRoaXMgZG9jdW1lbnQgaXMgYSBzcGVjaWZpY2F0aW9uLCBzbyB5b3Ug Y2FuIGJlIHByZXNjcmlwdGl2ZSB3aXRoIHdoYXQgeW91IHdhbnQgdG8gaGFwcGVuLg0KDQoNCg0K T0xEPg0KDQpEZXRhaWxlZCByZWNvbW1lbmRhdGlvbnMgY29uY2VybmluZyBvcGVyYXRpb25zIGFu ZCBtYW5hZ2VtZW50DQoNCiAgIGlzc3VlcyB3aXRoIEJHUHNlYyBhcmUgcHJvdmlkZWQgaW4gW0kt RC5pZXRmLXNpZHItYmdwc2VjLW9wc10uDQoNCg0KDQpORVc+DQoNClRoZSBCZXN0IEN1cnJlbnQg UHJhY3RpY2UgY29uY2VybmluZyBvcGVyYXRpb25hbCBkZXBsb3ltZW50IG9mIEJHUFNlYyBpcyBw cm92aWRlZCBpbg0KDQpbSS1ELmlldGYtc2lkci1iZ3BzZWMtb3BzXS4NCg0KDQoNCg0KDQpPTEQ+ DQoNCiAgIFRoaXMgZG9jdW1lbnQgc3BlY2lmaWVzIEJHUHNlYyBWZXJzaW9uIDAgb25seS4gIFdo YXQgc2hvdWxkIHRoZQ0KDQogICBhY3Rpb24gYmUgaWYgdGhlIFZlcnNpb24gaXMgbm90IDAgaW4g dGhlIEJHUHNlYyBjYXBhYmlsaXR5DQoNCiAgIGFkdmVydGlzZW1lbnQgZnJvbSBhIHBlZXI/ICBJ ZiB0aGUgaW50ZXJzZWN0aW9uIG9mIEJHUHNlYyBjYXBhYmlsaXR5DQoNCiAgIGFkdmVydGlzZW1l bnRzIGZyb20gYm90aCBzaWRlcyBkb2VzIG5vdCBpbmNsdWRlIFZlcnNpb24gMCwgdGhlbg0KDQog ICBCR1BzZWMgVmVyc2lvbiAwIGhhcyBub3QgYmVlbiBzdWNjZXNzZnVsbHkgbmVnb3RpYXRlZC4g IEhvd2V2ZXIsIGENCg0KICAgQkdQIHNlc3Npb24gaXMgc3RpbGwgbmVnb3RpYXRlZCBhbmQgaGVu Y2UgdGhlIGFiaWxpdHkgdG8gZXhjaGFuZ2UNCg0KICAgcm91dGVzIGlzIHN0aWxsIHRoZXJlLiAg QkdQICh1bnNpZ25lZCkgbWVzc2FnZXMgYXJlIGV4Y2hhbmdlZC4gIFNvDQoNCiAgIHRoZSBjaGFp biBvZiBBU05zIGlzIG5vdCBicm9rZW4sIGkuZS4gdGhleSBtYXkgbm90IGJlIGNvbnRpZ3VvdXMN Cg0KICAgQkdQc2VjIHBlZXJzIGJ1dCBhcmUgc3RpbGwgY29udGlndW91cyBCR1AgcGVlcnMuDQoN Cg0KDQogICBMZXQgdXMgc2F5IHRoYXQgQkdQc2VjIGNhcGFiaWxpdHkgd2FzIG5lZ290aWF0ZWQg c3VjY2Vzc2Z1bGx5IGJldHdlZW4NCg0KICAgdHdvIHBlZXJzLCBhbmQgc3Vic2VxdWVudGx5IGl0 IHdhcyByZXNldC4gIEluIHRoZSBtZWFudGltZSwgYXNzdW1lDQoNCiAgIHRoYXQgdGhlIDQtYnl0 ZSBBU04gY2FwYWJpbGl0eSBvciB0aGUgbXVsdGktcHJvdG9jb2wgY2FwYWJpbGl0eSB3YXMNCg0K ICAgbG9zdCBiZXR3ZWVuIHRoZSB0d28gcGVlcnMuICBTbyBub3cgdGhlIEJHUHNlYyBzZXNzaW9u IHJlc2V0IHJlc3VsdHMNCg0KICAgaW4gZmFpbHVyZSBvZiBCR1BzZWMgY2FwYWJpbGl0eSBuZWdv dGlhdGlvbiBhbmQgb25seSBhIEJHUCBzZXNzaW9uIGlzDQoNCiAgIGVzdGFibGlzaGVkLiAgV291 bGQgdGhlIG5ldHdvcmsgb3BlcmF0b3IgYmUgbm90aWZpZWQgdGhhdCB0aGlzDQoNCiAgIGRvd25n cmFkZSBmcm9tIEJHUHNlYyB0byBCR1AgaGFzIGhhcHBlbmVkPyAgV2hhdCBpZiB0aGUgb3BlcmF0 b3INCg0KICAgYWx3YXlzIHdhbnRzIGEgc2VjdXJlIHNlc3Npb24gb25seT8gIENhbiB0aGV5IHJl cXVpcmUgdGhhdCBubyBCR1ANCg0KICAgc2Vzc2lvbiBiZSBlc3RhYmxpc2hlZCBpZiBCR1BzZWMg Y2FwYWJpbGl0eSBuZWdvdGlhdGlvbiBmYWlscz8NCg0KICAgT3BlcmF0b3JzIGFyZSBhZHZpc2Vk IHRvIHNwZWFrIHdpdGggdGhlaXIgdmVuZG9ycyB0byBzZXQgdXAga25vYnMgYW5kDQoNCiAgIGFs ZXJ0cyB0byBoYXZlIHN1Y2ggb3BlcmF0aW9ucyBhbmQgbWFuYWdlbWVudCBmZWF0dXJlcyBpbiB0 aGVpcg0KDQogICBCR1BzZWMgY2FwYWJsZSByb3V0ZXJzLg0KDQoNCg0KTkVXPg0KDQogICBTZWN0 aW9uIDIuMiBkZXNjcmliZXMgdGhlIG5lZ290aWF0aW9uIHJlcXVpcmVkIHRvIGVzdGFibGlzaCBh IEJHUHNlYy1jYXBhYmxlDQoNCiAgIHBlZXJpbmcgc2Vzc2lvbi4gIE5vdCBvbmx5IG11c3QgdGhl IEJHUHNlYyBjYXBhYmlsaXR5IGJlIGV4Y2hhbmdlZCAoYW5kIGFncmVlZA0KDQogICBvbiksIGJ1 dCB0aGUgQkdQIG11bHRpcHJvdG9jb2wgZXh0ZW5zaW9uIFtSRkM0NzYwXSBmb3IgdGhlIHNhbWUg QUZJIGFuZCB0aGUNCg0KICAgZm91ci1ieXRlIEFTIGNhcGFiaWxpdHkgW1JGQzY3OTNdIG11c3Qg YWxzbyBiZSBleGNoYW5nZWQuICBGYWlsdXJlIHRvIHByb3Blcmx5DQoNCiAgIG5lZ290aWF0ZSBh IEJHUHNlYyBzZXNzaW9uLCBkdWUgdG8gYSBtaXNzaW5nIGNhcGFiaWxpdHksIGZvciBleGFtcGxl LCBtYXkgc3RpbGwNCg0KICAgcmVzdWx0IGluIHRoZSBleGNoYW5nZSBvZiBCR1AgKHVuc2lnbmVk KSB1cGRhdGVzLiAgV2hpbGUgdGhlIEJHUCBjaGFpbiBvZiBBU05zDQoNCiAgIGlzIG5vdCBicm9r ZW4sIHRoZSBzZWN1cml0eSBjYW4gYmUgcmVkdWNlZCBhbmQgYSBjb250aWd1b3VzIHNldCBvZiBC R1BzZWMgcGVlcnMNCg0KICAgbWF5IG5vdCBleGlzdCBhbnltb3JlLiAgSXQgaXMgUkVDT01NRU5E RUQgdGhhbiBhbiBpbXBsZW1lbnRhdGlvbiBsb2cgdGhlDQoNCiAgIGZhaWx1cmUgdG8gcHJvcGVy bHkgbmVnb3RpYXRlIGEgQkdQc2VjIHNlc3Npb24gaWYgdGhlIGxvY2FsIEJHUCBzcGVha2VyIGlz IGNvbmZpZ3VyZWQNCg0KICAgZm9yIGl0LiAgQWxzbywgYW4gaW1wbGVtZW50YXRpb24gTVVTVCBo YXZlIGFiaWxpdHkgdG8gcHJldmVudCBhIEJHUCBzZXNzaW9uIGZyb20NCg0KICAgYmVpbmcgZXN0 YWJsaXNoZWQgaWYgY29uZmlndXJlZCBmb3IgQkdQc2VjIHVzZS4NCg0KDQoNCg0KDQrigKYNCg0K PiBNMS4xLiBTZWN0aW9uIDIuMS4gKFRoZSBCR1BzZWMgQ2FwYWJpbGl0eSkgaW5jbHVkZXMgYSBW ZXJzaW9uIGZpZWxkIGFuZCBzb21lIFJlc2VydmVkIGJpdHMsDQoNCj4gYnV0IHRoZXJlIGFyZSBu byBJQU5BIHJlZ2lzdHJpZXMgZGVmaW5lZCBmb3IgaG93IHRvIG1hbmFnZSB0aGVzZSBzcGFjZXMu ICBQbGVhc2UgZGVmaW5lDQoNCj4gdGhlIHJlZ2lzdHJpZXMgYW5kIHRoZSBjb3JyZXNwb25kaW5n IHJlZ2lzdHJhdGlvbiBwcm9jZWR1cmVzLg0KDQo+DQoNCj4gW1NyaXJhbV0gRG9uZS4gUGxlYXNl IHNlZSB0aGUgdXBkYXRlZCBJQU5BIENvbnNpZGVyYXRpb25zIHNlY3Rpb24uDQoNCg0KDQpzL1Jl c2VydmVkL1VuYXNzaWduZWQNCg0KDQoNCkdpdmVuIHRoYXQgdGhlcmUgYXJlIG9ubHkgMyB1bmFz c2lnbmVkIGJpdHMgYW5kIHRoYXQgY2hhbmdpbmcgdmVyc2lvbnMgc2hvdWxkIGJlIGEgYmlnIGRl YWwsIEkgdGhpbmsgdGhhdCDigJxJRVRGIFJldmlld+KAnSBpcyBub3QgYSBzdHJvbmcgZW5vdWdo IHJlZ2lzdHJhdGlvbiBwcm9jZWR1cmUuICBTdWdnZXN0aW9uOiB1c2UgU3RhbmRhcmRzIEFjdGlv biBpbnN0ZWFkLg0KDQoNCg0KWypdIENoYWlyczogd2UgZG9u4oCZdCBuZWVkIHRvIFdHTEMgdGhl IHdob2xlIGRvY3VtZW50LCBidXQgaXQgd291bGQgYmUgYSBnb29kIGlkZWEgdG8gcnVuIHRoZSBy ZWdpc3RyYXRpb24gcHJvY2VkdXJlcyBieSB0aGUgV0cgb25jZSB3ZSBzZXR0bGUgb24gdGhlbSDi gJMgdGhpcyBjb3VsZCBldmVuIGJlIGRvbmUgaW4gcGFyYWxsZWwgd2l0aCB0aGUgSUVURiBMYXN0 IENhbGwuDQoNCg0KDQoNCg0KPiBNMS4yLiBTZWN0aW9uIDMuMS4gKFNlY3VyZV9QYXRoKSBkZWZp bmVzIHRoZSBGbGFncyBmaWVsZCBhbmQgYXNzaWducyB0aGUgZmlyc3QgYml0IChCVFcsIGlzDQoN Cj4gdGhhdCB0aGUgTVNCIG9yIHRoZSBMU0IsIHBsZWFzZSBjbGFyaWZ5KSwgYnV0IGRvZXNuJ3Qg c2V0IHVwIHRoZSByZWdpc3RyeSBvciByZWdpc3RyYXRpb24NCg0KPiBwcm9jZWR1cmVzLg0KDQo+ DQoNCj4gW1NyaXJhbV0gSXQgaXMgdGhlIE1TQiAobGVmdCBtb3N0IGJpdCkgYW5kIHRoYXQgaXMg bm93IGNsYXJpZmllZCBpbiBTZWN0aW9uIDMuMS4gU2V0IHVwIG9mIHRoZQ0KDQo+IHJlZ2lzdHJ5 IGZvciB0aGUgRmxhZ3MgZmllbGQgaXMgbm93IGluY2x1ZGVkIGluIHRoZSB1cGRhdGVkIElBTkEg Q29uc2lkZXJhdGlvbnMgc2VjdGlvbi4NCg0KDQoNClNhbWUgY29tbWVudCBhcyBhYm92ZSBhYm91 dCDigJxJRVRGIFJldmlld+KAnSB2cyDigJxTdGFuZGFyZHMgQWN0aW9u4oCdLg0KDQoNCg0K4oCm DQoNCj4gTTIuMi4gVGhlIGRlZmluaXRpb24gb2YgdGhlIEJHUHNlY19QYXRoIEF0dHJpYnV0ZSAo YW5kIGl0cyBkZXRhaWxzKSBkb24ndCBoYXZlIGNsZWFyIGVycm9yDQoNCj4gaGFuZGxpbmcgcHJv Y2VkdXJlcyBkZWZpbmVkIChSRkM3NjA2KS4gIFNlY3Rpb24gNC4zLiAoUHJvY2Vzc2luZyBJbnN0 cnVjdGlvbnMgZm9yDQoNCj4gQ29uZmVkZXJhdGlvbiBNZW1iZXJzKSBkb2VzIHNheSB0aGlzOiAi KEFzIGRpc2N1c3NlZCBpbiBTZWN0aW9uIDUuMiwgYW55IGVycm9yIGluIHRoZQ0KDQo+IEJHUHNl Y19QYXRoIGF0dHJpYnV0ZSBNVVNUIGJlIGhhbmRsZWQgdXNpbmcgdGhlICJ0cmVhdC1hcy13aXRo ZHJhdyIsIGFwcHJvYWNoIGFzDQoNCj4gZGVmaW5lZCBpbiBSRkMgNzYwNiBbUkZDNzYwNl0uKSIg KGluY2x1ZGluZyB0aGUgcGFyZW50aGVzZXMpLiAgSG93ZXZlciwgNSwyIG9ubHkgc2F5czoNCg0K PiAiQkdQc2VjIHNwZWFrZXJzIE1VU1QgaGFuZGxlIHRoZXNlIGVycm9ycyB1c2luZyB0aGUgInRy ZWF0LWFzLXdpdGhkcmF3IiBhcHByb2FjaCBhcw0KDQo+IGRlZmluZWQgaW4gUkZDIDc2MDYgW1JG Qzc2MDZdLiIgICBOb3RlOiAidGhlc2UgZXJyb3JzIiBpcyBub3QgdGhlIHNhbWUgYXMgImFueQ0K DQo+IGVycm9yIi4gIFBsZWFzZSBkaXNjdXNzIGVycm9yIGhhbmRsaW5nIGluIGEgbW9yZSBwcm9t aW5lbnQgcGxhY2UuIChIaW50OiBpdCBtYXkgZml0IGluIGEgZmF1bHQNCg0KPiBtYW5hZ2VtZW50 IGRpc2N1c3Npb24gaW4gdGhlIE9wZXJhdGlvbnMgYW5kIE1hbmFnZW1lbnQgU2VjdGlvbi4pDQoN Cj4NCg0KPiBbU3JpcmFtXSAgcyAvQXMgZGlzY3Vzc2VkIGluIFNlY3Rpb24gNS4yLCBhbnkgZXJy b3IgaW4gdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSBNVVNUIGJlDQoNCj4gaGFuZGxlZCB1c2lu ZyB0aGUgInRyZWF0LWFzLXdpdGhkcmF3IiwgYXBwcm9hY2ggYXMgZGVmaW5lZCBpbiBSRkMgNzYw NiBbUkZDNzYwNl0uLyBBcw0KDQo+IGRpc2N1c3NlZCBpbiBTZWN0aW9uIDUuMiwgYW55IHN5bnRh Y3RpY2FsIG9yIHByb3RvY29sIHZpb2xhdGlvbiBlcnJvcnMgaW4gdGhlIEJHUHNlY19QYXRoDQoN Cj4gYXR0cmlidXRlIE1VU1QgYmUgaGFuZGxlZCB1c2luZyB0aGUgInRyZWF0LWFzLXdpdGhkcmF3 IiBhcHByb2FjaCBhcyBkZWZpbmVkIGluIFJGQyA3NjA2DQoNCj4gW1JGQzc2MDZdLi8NCg0KPg0K DQo+IFtTcmlyYW1dICBTZWN0aW9uIDQuMyBoYXMgYmVlbiB1cGRhdGVkIGFjY29yZGluZ2x5Lg0K DQoNCg0KDQoNCkkgZGlkbuKAmXQgZXhwbGFpbiBteXNlbGYgY29ycmVjdGx5LiAgU2VjdGlvbiA0 LjMuIChQcm9jZXNzaW5nIEluc3RydWN0aW9ucyBmb3IgQ29uZmVkZXJhdGlvbiBNZW1iZXJzKSBj b3ZlcnMgb25seSB0aGUgcHJvY2Vzc2luZyBmb3IgY29uZmVkZXJhdGlvbnMsIHNvIHB1dHRpbmcg dGV4dCBpbiB0aGVyZSBhYm91dCBhbnkgZXJyb3JzIGlzIGdvb2QsIGJ1dCBkb2VzbuKAmXQgY292 ZXIgdGhlIGdlbmVyYWwgY2FzZSAoZm9yIHByb2Nlc3NpbmcgYW55IHVwZGF0ZSkuDQoNCg0KDQpP VE9ILCBTZWN0aW9uIDUuMi4gKFZhbGlkYXRpb24gQWxnb3JpdGhtKSBkb2VzbuKAmXQgYWN0dWFs bHkgdGFsayBhYm91dCDigJxhbnkgZXJyb3LigJ0gKGFzIHJlZmVyZW5jZWQgbm93IGZyb20gNC4z KSDigJMgaXQgb25seSB0YWxrcyBhYm91dCDigJx0aGVzZSBlcnJvcnPigJ0sIHdoaWNoIGNvcnJl c3BvbmQgdG8gdGhlIGxpc3Qgb2YgY2hlY2tzIGluIHRoZSBzZWN0aW9uLiAgSU9XLCB0aGVyZSBp cyBubyBnbG9iYWwgc3BlY2lmaWNhdGlvbiB0aGF0IGFueSBlcnJvciBtdXN0IHJlc3VsdCBpbiB0 cmVhdC1hcy13aXRoZHJhdy4NCg0KDQoNClNvbHV0aW9uOiAgdGFrZSB0aGUgdGV4dCBvdXQgb2Yg NC4zIGFuZCB1cGRhdGUgdGhlIHRleHQgaW4gNS4yOyBzdWdnZXN0aW9uOg0KDQoNCg0KT0xEPg0K DQogICBJZiBhbnkgb2YgdGhlc2UgY2hlY2tzIGZhaWwsIGl0IGlzIGFuIGVycm9yIGluIHRoZSBC R1BzZWNfUGF0aA0KDQogICBhdHRyaWJ1dGUuICBBbnkgb2YgdGhlc2UgZXJyb3JzIGluIHRoZSBC R1BzZWNfUGF0aCBhdHRyaWJ1dGUgYXJlDQoNCiAgIGhhbmRsZWQgYXMgcGVyIFJGQyA3NjA2IFtS RkM3NjA2XS4gIEJHUHNlYyBzcGVha2VycyBNVVNUIGhhbmRsZSB0aGVzZQ0KDQogICBlcnJvcnMg dXNpbmcgdGhlICJ0cmVhdC1hcy13aXRoZHJhdyIgYXBwcm9hY2ggYXMgZGVmaW5lZCBpbiBSRkMg NzYwNg0KDQogICBbUkZDNzYwNl0uDQoNCg0KDQpORVc+DQoNCiAgIElmIGFueSBvZiB0aGVzZSBj aGVja3MgZmFpbCwgaXQgaXMgYW4gZXJyb3IgaW4gdGhlIEJHUHNlY19QYXRoDQoNCiAgIGF0dHJp YnV0ZS4gIEJHUHNlYyBzcGVha2VycyBNVVNUIGhhbmRsZSBhbnkgc3ludGFjdGljYWwgb3IgcHJv dG9jb2wgZXJyb3JzDQoNCiAgIGluIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgdXNpbmcgdGhl ICJ0cmVhdC1hcy13aXRoZHJhdyIgYXBwcm9hY2ggYXMgZGVmaW5lZA0KDQogICBpbiBSRkMgNzYw NiBbUkZDNzYwNl0uDQoNCg0KDQoNCg0KDQoNCuKApg0KDQo+IE03LjEuIOKAnFdpdGggcmVnYXJk cyB0byB0aGUgcHJvY2Vzc2luZyBvZiBkdXBsaWNhdGUgdXBkYXRlIG1lc3NhZ2VzLCBpZiB0aGUg Zmlyc3QgdXBkYXRlDQoNCj4gbWVzc2FnZSBpcyB2YWxpZCwgdGhlbiBhbiBpbXBsZW1lbnRhdGlv biBTSE9VTEQgTk9UIHJ1biB0aGUgdmFsaWRhdGlvbiBwcm9jZWR1cmUgb24gdGhlDQoNCj4gc2Vj b25kLCBkdXBsaWNhdGUgdXBkYXRlIG1lc3NhZ2UgKGV2ZW4gaWYgdGhlIGJpdHMgb2YgdGhlIHNp Z25hdHVyZSBmaWVsZCBhcmUNCg0KPiBkaWZmZXJlbnQpLuKAnSAgRXZlbiB0aG91Z2ggYSBkaXNj dXNzaW9uIGFib3V0IG5vbi1kZXRlcm1pbmlzdGljIHNpZ25hdHVyZSBhbGdvcml0aG1zDQoNCj4g cHJlY2VkZXMgdGhpcyB0ZXh0LCB0aGUgdmFsaWRhdGlvbiBpcyBzdGlsbCBub3QgcnVuLiAgSG93 IGNhbiB0aGUgdmFsaWRpdHkgb2YgdGhlIFBhdGggYmUNCg0KPiBndWFyYW50ZWVkIGluIHRoaXMg Y2FzZT8gIFNob3VsZCB0aGlzIGJlIHRoZSBhY3Rpb24gZm9yIGFsbCBhbGdvcml0aG1zIG9yIG9u bHkgb25lcyBrbm93biB0bw0KDQo+IGJlIG5vbi1kZXRlcm1pbmlzdGljPw0KDQo+DQoNCj4gW1Ny aXJhbV0gRGVmaW5pdGlvbiBvZiBkdXBsaWNhdGUgdXBkYXRlIGZvciBCR1BzZWM6IEEgQkdQc2Vj IHVwZGF0ZSBpcyBhIGR1cGxpY2F0ZSBpZiBpdCBpcw0KDQo+IGlkZW50aWNhbCB0byBhbm90aGVy IHVwZGF0ZSBpbiB0aGUgQWRqLVJJQi1pbiwgaW5jbHVkaW5nIFNLSXMgYW5kIEFsZ29yaXRobSBJ RCwgYnV0IG5vdA0KDQo+IGluY2x1ZGluZyB0aGUgc2lnbmF0dXJlcy4gSWYgdGhlIGZpcnN0IHVw ZGF0ZSBtZXNzYWdlIChoYXZpbmcgdGhlICpzYW1lIFNLSXMqIGFzIHRoZQ0KDQo+IGR1cGxpY2F0 ZSkgaXMgKlZhbGlkKiwgdGhlbiB0aGUgZHVwbGljYXRl4oCZcyB2YWxpZGl0eSBzdGF0ZSBuZWVk IG5vdCBiZSBjb21wdXRlZC4gIElmIHZhbGlkaXR5IG9mDQoNCj4gdGhlIGR1cGxpY2F0ZSB3ZXJl IGNvbXB1dGVkIGFuZCBmb3VuZCAnVmFsaWQnLCB0aGVuIGl0IGdpdmVzIHRoZSByb3V0ZXIgbm8g bmV3DQoNCj4gaW5mb3JtYXRpb24uIEFsdGVybmF0aXZlbHksIGlmIGl0IHdlcmUgZm91bmQgJ05v dCBWYWxpZCcsIHRoZW4gaXQgb25seSBpbXBsaWVzIHRoYXQgc29tZSBiaXQNCg0KPiBlcnJvcnMg b2NjdXJyZWQgaW4gdGhlIHNpZ25hdHVyZXMuIFRoZXJlZm9yZSwgdGhlIEJHUHNlYyBzcGVha2Vy IHNob3VsZCBrZWVwIHRoZSAnVmFsaWQnDQoNCj4gb3JpZ2luYWwgdXBkYXRlIGFuZCBpZ25vcmUg dGhlIGR1cGxpY2F0ZS4gSG93ZXZlciwgaWYgdGhlIG9yaWdpbmFsIHVwZGF0ZSB3ZXJlICdOb3Qg VmFsaWQnLA0KDQo+IHRoZW4gcGVyZm9ybWluZyB2YWxpZGF0aW9uIG9mIHRoZSBkdXBsaWNhdGUg aXMgcmVsZXZhbnQgYW5kIFNIT1VMRCBiZSBkb25lLg0KDQo+DQoNCj4gW1NyaXJhbV0gQWRkZWQg YSBwYXJhZ3JhcGggaW4gdGhlIG5ldyBTZWN0aW9uIDcgKE9wZXJhdGlvbnMgYW5kIE1hbmFnZW1l bnQNCg0KPiBDb25zaWRlcmF0aW9ucykgdG8gaW5jbHVkZSB0aGUgYWJvdmUgb2JzZXJ2YXRpb25z Lg0KDQoNCg0KSSBzYXcgdGhlIHRleHQsIGFuZCBoYXZlIDMgcXVlc3Rpb25zL2NvbW1lbnRzOg0K DQoNCg0KMS4g4oCc4oCmaXQgb25seSBpbXBsaWVzIHRoYXQgc29tZSBiaXQgZXJyb3JzIG9jY3Vy cmVkIGluIHRoZSBzaWduYXR1cmVzLuKAnSAgIFdoYXQgZG9lcyB0aGF0IG1lYW4/ICBBcmUgeW91 IGltcGx5aW5nIHRoYXQgdGhlIHNlbmRlciBnb3QgdGhlIHNpZ25hdHVyZSB3cm9uZz8gIE9yIG1h eWJlIHRoYXQgdGhlcmUgd2FzIHNvbWUgY29ycnVwdGlvbiBpbi10cmFuc2l0PyAgQm90aCBjYXNl cyBhcmUgKmJhZCosIGJ1dCB0aGUgY2FzZSB3aGVyZSB0aGUgc2VuZGVyIGNvdWxkIGdldCB0aGUg c2lnbmF0dXJlIHdyb25nIGlzIHNwZWNpYWxseSBzbyBiZWNhdXNlIGlmIGl0IHdhc27igJl0IGEg ZHVwbGljYXRlIHVwZGF0ZSwgdGhlbiBpdCB3b3VsZCByZXN1bHQg4oCcTm90IFZhbGlk4oCdIGFu ZCB0aGVyZSBzZWVtcyB0byBiZSBubyB3YXkgdG8gZGV0ZXJtaW5lIGlmIGluIGZhY3QgdGhlIHZh bGlkaXR5IGZhaWxlZCBvciBpZiBpdCBpcyB0aGUgY2FzZSBvZiBzb21lIGJpdCBlcnJvcnMuIOKY uQ0KDQoNCg0KMi4g4oCcVGhlcmVmb3JlLCB0aGUgQkdQc2VjIHNwZWFrZXIgc2hvdWxkIGtlZXAg dGhlICdWYWxpZCcgb3JpZ2luYWwgdXBkYXRlIGFuZCBpZ25vcmUgdGhlIGR1cGxpY2F0ZS7igJ0g Tm8hICBUaGlzIGlzIG5vdCBob3cgQkdQIHdvcmtz4oCmc2VlIGJlbG93Lg0KDQoNCg0KMy4g4oCc 4oCmaWYgdGhlIG9yaWdpbmFsIHVwZGF0ZSB3ZXJlICdOb3QgVmFsaWQnLCB0aGVuIHBlcmZvcm1p bmcgdmFsaWRhdGlvbiBvZiB0aGUgZHVwbGljYXRlIGlzIHJlbGV2YW50IGFuZCBTSE9VTEQgYmUg ZG9uZS7igJ0gIFdoeSBpcyB0aGlzIG5vdCBhIOKAnE1VU1TigJ0/ICBJT1csIGlmIHRoZSBvcmln aW5hbCB1cGRhdGUgd2FzIOKAnE5vdCBWYWxpZOKAnSB3aGVuIHdvdWxkIGl0IGJlIG9rIHRvIG5v dCBwZXJmb3JtIHZhbGlkYXRpb24gb24gYSBuZXcgdXBkYXRlPw0KDQoNCg0KDQoNCj4gW1NyaXJh bV0gTm90ZSB0aGF0IHRoZSBhYm92ZSBhcHBsaWVzIHRvIGJvdGggbm9uLWRldGVybWluaXN0aWMg YW5kIGRldGVybWluaXN0aWMgc2lnbmF0dXJlDQoNCj4gYWxnb3JpdGhtcy4NCg0KPg0KDQo+IE03 LjIuIHJmYzQyNzEgKGluIFNlY3Rpb24gOS4gKFVQREFURSBNZXNzYWdlIEhhbmRsaW5nKSB0YWxr cyBhYm91dCB0aGUgaW1wbGljaXQgd2l0aGRyYXcNCg0KPiBvZiBhIHJvdXRlIOKAnGlmIHRoZSBO TFJJIG9mIHRoZSBuZXcgcm91dGUgaXMgaWRlbnRpY2FsIHRvIHRoZSBvbmUgdGhlIHJvdXRlciBj dXJyZW50bHkgaGFzDQoNCj4gc3RvcmVk4oCm4oCdLiAgVGhlIHNhbWUgTkxSSSBjYXNlIHNlZW1z IHRvIGJlIGEgcGFydGljdWxhciBjb25kaXRpb24gb2YgdGhlIOKAnGR1cGxpY2F0ZQ0KDQo+IHVw ZGF0ZeKAnSBkZXNjcmliZWQgaGVyZS4gIEl0IG1pZ2h0IGJlIGEgZ29vZCBpZGVhIHRvIG1lbnRp b24gdGhhdCBhIOKAnGR1cGxpY2F0ZSB1cGRhdGXigJ0NCg0KPiByZXN1bHRzIGluIHRoZSBpbXBs aWNpdCB3aXRoZHJhdyBvZiB0aGUgb3JpZ2luYWwgdXBkYXRlLiAgV2hhdCBoYXBwZW5zIGlmIGEg dGhpcmQgZHVwbGljYXRlDQoNCj4gcm91dGUgaXMgcmVjZWl2ZWQgKHRoZSBmaXJzdCBvbmUgd2Fz IHZhbGlkLCB0aGUgc2Vjb25kIG9uZSB3YXMgbm90IHZhbGlkYXRlZCksIHNob3VsZCBpdCBiZQ0K DQo+IHZhbGlkYXRlZD8NCg0KPg0KDQo+IFtTcmlyYW1dIEluIFJGQyA0MjcxLCB3aGVuIHRoZXJl IGlzIGEgZHVwbGljYXRlIHVwZGF0ZSwgdGhlIE5STEkgYW5kIHBhdGggYW5kIGFsbCBvdGhlcg0K DQo+IGF0dHJpYnV0ZXMgYXJlIGlkZW50aWNhbC4gVGhlcmUgaXMgbm8gaW1wbGljaXQgd2l0aGRy YXcuIFRoZSByb3V0ZXIga2VlcHMgd2hhdCBpdCBhbHJlYWR5DQoNCj4gaGFzLiBJbiB0aGUgY2Fz ZSBvZiBCR1BzZWMsIGEgcm91dGVyIGtlZXBzIHRoZSBvcmlnaW5hbCBpZiBpdCB3YXMgdmFsaWQs IGFuZCBpZ25vcmVzIHRoZQ0KDQo+IGR1cGxpY2F0ZS4gSXQgY2hlY2tzIHRoZSB2YWxpZGl0eSBv ZiB0aGUgZHVwbGljYXRlIG9ubHkgaWYgdGhlIG9yaWdpbmFsIHdlcmUgaW52YWxpZC4NCg0KDQoN CkluIHBsYWluIEJHUCwgaWYgYSBkdXBsaWNhdGUgdXBkYXRlIChhcyBkZWZpbmVkIGFib3ZlIHdo ZXJlIGV2ZXJ5dGhpbmcgaXMgaWRlbnRpY2FsKSBpcyByZWNlaXZlZCwgdGhlbiB0aGUgb3JpZ2lu YWwgb25lIGlzIHJlcGxhY2VkIGJ5IHRoZSBuZXcgb25lIOKAkyBpbiB0aGlzIHNwZWNpZmljIGNh c2UgKHdoZXJlIGV2ZXJ5dGhpbmcgaXMgaWRlbnRpY2FsKSwgaXQgbWF5IGxvb2sgbGlrZSB0aGUg cm91dGVyIGtlZXBzIHdoYXQgaXQgYWxyZWFkeSBoYXPigKZidXQgdGhlIGdlbmVyYWwgcnVsZSBp cyB0byByZXBsYWNlIHRoZSBvbGQgdXBkYXRlIHdpdGggYSBuZXcgb25lIGZvciB0aGUgc2FtZSBw cmVmaXguDQoNCg0KDQpXaGF0IHlvdSBhcmUgcHJvcG9zaW5nIGFib3ZlICjigJxJbiB0aGUgY2Fz ZSBvZiBCR1BzZWMsIGEgcm91dGVyIGtlZXBzIHRoZSBvcmlnaW5hbCBpZiBpdCB3YXMgdmFsaWQs IGFuZCBpZ25vcmVzIHRoZSBkdXBsaWNhdGUu4oCdKSBpcyBhIHNpZ25pZmljYW50IGNoYW5nZSB3 aXRoIHJlc3BlY3QgdG8gQkdQIHRoYXQgaXMgbm90IGV4cGxpY2l0bHkgY2FsbGVkIG91dC4gIEkg aGF2ZW7igJl0IHNlZW4gdGhpcyBiZWhhdmlvciBtZW50aW9uZWQgYW55d2hlcmUgaW4gdGhlIGRy YWZ0IOKAkyBpdCBoYXMgb25seSBjb21lIHVwIG5vdy4NCg0KDQoNCklNSE8sIG5vdCBvbmx5IHNo b3VsZCB0aGUgaW1wbGljaXQgd2l0aGRyYXcgYmVoYXZpb3Igbm90IGNoYW5nZSwgYnV0IGJ5IGln bm9yaW5nIHRoZSBzZWNvbmQgdXBkYXRlIHlvdeKAmXJlIGlnbm9yaW5nIGEgcG90ZW50aWFsbHkg aW1wb3J0YW50IGNoYW5nZSBpbiB0aGUgdG9wb2xvZ3kvc3RydWN0dXJlIG9mIHRoZSBuZXR3b3Jr Lg0KDQoNCg0K4oCmDQoNCj4gTTEwLiAgSW4gU2VjdGlvbiA3LjIuIChPbiB0aGUgUmVtb3ZhbCBv ZiBCR1BzZWMgU2lnbmF0dXJlcyk6IOKAnOKApnRoZSBwcm90b2NvbCBzcGVjaWZpZXMgdGhhdA0K DQo+IGEgQkdQc2VjIHNwZWFrZXIgY2hvb3NpbmcgdG8gcHJvcGFnYXRlIHRoZSByb3V0ZSBhZHZl cnRpc2VtZW50IGluIHN1Y2ggYW4gdXBkYXRlDQoNCj4gbWVzc2FnZSBTSE9VTEQgYWRkIGl0cyBz aWduYXR1cmUgdG8gZWFjaCBvZiB0aGUgU2lnbmF0dXJlX0Jsb2Nrcy7igJ0gICBJIGJlbGlldmUg dGhlDQoNCj4gcmVmZXJlbmNlIGlzIFNlY3Rpb24gNC4yIChwbGVhc2UgYWRkIGl0KS4gIEhvd2V2 ZXIsIHRoYXQgU2VjdGlvbiBkb2VzbuKAmXQgdXNlIG5vcm1hdGl2ZQ0KDQo+IGxhbmd1YWdlICji gJxGb3IgZWFjaCBTaWduYXR1cmVfQmxvY2sgY29ycmVzcG9uZGluZyB0byBhbiBhbGdvcml0aG0g c3VpdGUgdGhhdCB0aGUgQkdQc2VjDQoNCj4gc3BlYWtlciBkb2VzIHN1cHBvcnQsIHRoZSBCR1Bz ZWMgc3BlYWtlciBhZGRzIGEgbmV3IFNpZ25hdHVyZSBTZWdtZW50IHRvIHRoZQ0KDQo+IFNpZ25h dHVyZV9CbG9jay7igJ0pICAgSW4gYW55IGNhc2UsIHRoZSDigJxTSE9VTETigJ0gaW4gNy4yIGlz IG91dCBvZiBwbGFjZSBiZWNhdXNlIGl0IGlzDQoNCj4gcmVmZXJlbmNpbmcgYSBmYWN0IChwb2lu dGluZyBhdCB0aGUgb3RoZXIgc2VjdGlvbikgYW5kIG5vdCBiZWluZyB1c2VkIG5vcm1hdGl2ZWx5 IOKAkyBpZiB5b3UNCg0KPiB3YW50IHRoZSDigJxTSE9VTETigJ0gdG8gYmUgbm9ybWF0aXZlLCB0 aGVuIGl0IHNob3VsZCBiZSBiYWNrIGluIDQuMi4NCg0KPg0KDQo+IFtTcmlyYW1dIFllcywgYWdy ZWUuIEZpeGVkIHRoZSB3b3JkaW5nIHBlciB5b3VyIHN1Z2dlc3Rpb24gaW4gYm90aCBwbGFjZXMg KFNlY3Rpb25zIDQuMiBhbmQNCg0KPiA3LjIpLiBBZGRlZCByZWZlcmVuY2UgdG8gU2VjdGlvbiA0 LjIgaW4gU2VjdGlvbiA3LjIuDQoNCg0KDQpOb3cgNC4yIHJlYWRzOiDigJxGb3IgZWFjaCBTaWdu YXR1cmVfQmxvY2sgY29ycmVzcG9uZGluZyB0byBhbiBhbGdvcml0aG0gc3VpdGUgdGhhdCB0aGUg QkdQc2VjIHNwZWFrZXIgZG9lcyBzdXBwb3J0LCB0aGUgQkdQc2VjIHNwZWFrZXIgU0hPVUxEIGFk ZCBhIG5ldyBTaWduYXR1cmUgU2VnbWVudCB0byB0aGUgU2lnbmF0dXJlX0Jsb2Nr4oCdICAgU2hv dWxkIHRoYXQg4oCcU0hPVUxE4oCdIGJlIGEg4oCcTVVTVOKAnT8NCg0KDQoNCg0KDQrigKYNCg0K PiBNMTIuIFRoZSBtYW5kYXRvcnkgYWRkaXRpb24gb2YgU2VjdXJlX1BhdGggYW5kIFNpZ25hdHVy ZSBzZWdtZW50cyBpbiBhIENvbmZlZGVyYXRpb24NCg0KPiByZXN1bHRzIGluIHRoZSBpbmNvbnNp c3RlbnQgYXV0aG9yaXphdGlvbiBjaGFpbiBtZW50aW9uZWQgaW4gU2VjdGlvbiA0LjMuIChQcm9j ZXNzaW5nDQoNCj4gSW5zdHJ1Y3Rpb25zIGZvciBDb25mZWRlcmF0aW9uIE1lbWJlcnMpOiDigJxG b3IgYSBzaWduYXR1cmUgcHJvZHVjZWQgYnkgYSBwZWVyIEJHUHNlYw0KDQo+IHNwZWFrZXIgb3V0 c2lkZSBvZiBhIGNvbmZlZGVyYXRpb24sIHRoZSBUYXJnZXQgQVMgd2lsbCBhbHdheXMgYmUgdGhl IEFTIENvbmZlZGVyYXRpb24NCg0KPiBJZGVudGlmaWVyICh0aGUgcHVibGljIEFTIG51bWJlciBv ZiB0aGUgY29uZmVkZXJhdGlvbikgYXMgb3Bwb3NlZCB0byB0aGUgTWVtYmVyLUFTDQoNCj4gTnVt YmVyLuKAnSAgSXQgc2VlbXMgdG8gbWUgdGhhdCB0aGlzIGRpc2NvbnRpbnVpdHkgaW4gdGhlIEFT TiBsaXN0IGJyZWFrcyB0aGUg4oCcY3J5cHRvZ3JhcGhpYw0KDQo+IGFzc3VyYW5jZSB0aGF04oCm RXZlcnkgQVMgb24gdGhlIHBhdGggb2YgQVNlcyBsaXN0ZWQgaW4gdGhlIHVwZGF0ZSBtZXNzYWdl IGhhcyBleHBsaWNpdGx5DQoNCj4gYXV0aG9yaXplZCB0aGUgYWR2ZXJ0aXNlbWVudCBvZiB0aGUg cm91dGUgdG8gdGhlIHN1YnNlcXVlbnQgQVMgaW4gdGhlIHBhdGjigJ0gYmVjYXVzZSB0aGVyZQ0K DQo+IGlzIG5vIHdheSB0byB2ZXJpZnkgdGhhdCB0aGUgTWVtYmVyLUFTIGluIHRoZSBmaXJzdCBT ZWN1cmVfUGF0aCBzZWdtZW50IGlzIGluIGZhY3QgdGhlIG9uZQ0KDQo+IHBlZXJpbmcgd2l0aCB0 aGUgZXh0ZXJuYWwgbmVpZ2hib3IuICBJIHJlYWxpemUgdGhhdCB0aGUgcmlzayBtYXkgYmUgbWlu aW1pemVkIGJ5IGFuDQoNCj4g4oCcaW50ZXJuYWwgdHJ1c3TigJ0gZmFjdG9yLCBidXQgSSB3b3Vs ZCBsaWtlIHRvIHNlZSBhIGRpc2N1c3Npb24gYWJvdXQgdGhpcyBpc3N1ZSBpbiB0aGUgU2VjdXJp dHkNCg0KPiBDb25zaWRlcmF0aW9ucy4NCg0KPg0KDQo+IFtTcmlyYW1dIFNlZSB0aGUgbmV3IHNl Y29uZCBwYXJhZ3JhcGggaW4gU2VjdGlvbiA3LjQuIFRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9u IHRoYXQgeW91DQoNCj4gbWVudGlvbiBoZXJlIGFib3V0IHdpdGggdGhlIHdheSBjb25mZWRlcmF0 aW9ucyBhcmUgaGFuZGxlZCBpcyBkZXNjcmliZWQgYW5kIGRpc2N1c3NlZA0KDQo+IHRoZXJlLg0K DQoNCg0KUGVyc29uYWxseSwgSSB3b3VsZCBoYXZlIHByZWZlcnJlZCBpZiB5b3UgYWN0dWFsbHkg c29sdmVkIHRoZSBwcm9ibGVtLg0KDQoNCg0KT25lIHNvbHV0aW9uIGlzIHRvIGJvcnJvdyBmcm9t IGRyYWZ0LWlldGYtc2lkci1hcy1taWdyYXRpb24gYW5kIGZvcndhcmQgc2lnbiBmcm9tIHRoZSBD b25mZWRlcmF0aW9uIEFTICh0aGUgcHVibGljIG51bWJlcikgdG8gdGhlIE1lbWJlci1BUyB3aXRo IHBDb3VudD0wLiAgTm90ZSB0aGF0IHRoaXMgb3BlcmF0aW9uIHdvdWxkIHRha2UgcGxhY2UgaW5z aWRlIHRoZSBib3JkZXIgQ29uZmVkZXJhdGlvbiByb3V0ZXIsIHNvIHRoZXJlIGFyZSBubyBpc3N1 ZXMgd2l0aCBwQ291bnQ9MCBhbmQgdGhlIGZ1bGwgcGF0aCBjb250aW51aXR5IGlzIHByZXNlcnZl ZC4NCg0KDQoNClsqXSBDaGFpcnM6IEkgdGhpbmsgdGhhdCB0aGlzIHBhcnQgKHdoZXRoZXIgaXQg aXMgc29sdmVkIG9yIG5vdCkgc2hvdWxkIGFsc28gYmUgYm91bmNlZCBieSB0aGUgV0cuDQoNCg0K DQoNCg0K4oCmDQoNCj4gbTguIFNlY3Rpb24gNS4xLiAoT3ZlcnZpZXcgb2YgQkdQc2VjIFZhbGlk YXRpb24pOiDigJxJdCBpcyBleHBlY3RlZCB0aGF0IEJHUCBwZWVycyB3aWxsDQoNCj4gZ2VuZXJh bGx5IHByZWZlciByb3V0ZXMgcmVjZWl2ZWQgdmlhICdWYWxpZCcgQkdQc2VjIHVwZGF0ZSBtZXNz YWdlcyBvdmVyIGJvdGggcm91dGVzDQoNCj4gcmVjZWl2ZWQgdmlhICdOb3QgVmFsaWQnIEJHUHNl YyB1cGRhdGUgbWVzc2FnZXMgYW5kIHJvdXRlcyByZWNlaXZlZCB2aWEgdXBkYXRlIG1lc3NhZ2Vz DQoNCj4gdGhhdCBkbyBub3QgY29udGFpbiB0aGUgQkdQc2VjX1BhdGggYXR0cmlidXRl4oCmKFNl ZSBbSS1ELmlldGYtc2lkci1iZ3BzZWMtb3BzXeKApuKAnSAgSSByZWFkDQoNCj4gdGhpcyBwaWVj ZSBvZiB0ZXh0IGFzIHNheWluZyB0aGF0IHJvdXRlcyBpbiBOb3QgVmFsaWQgdXBkYXRlcyBhcmUg ZXhwZWN0ZWQgdG8gYmUgdXNlZCAoZXZlbg0KDQo+IHRob3VnaCB0aGV5IGFyZSBub3QgdmFsaWQp LiAgQmVzaWRlcyB0aGUgZmFjdCB0aGF0IEktRC5pZXRmLXNpZHItYmdwc2VjLW9wcyBkb2VzIHJl Y29tbWVuZA0KDQo+IHVzaW5nIE5vdCBWYWxpZCBhbm5vdW5jZW1lbnRzIChpbiBTZWN0aW9uIDcp LCBhcmUgdGhlcmUgb3RoZXIgcmVhc29ucyBmb3IgdGhpcyBkb2N1bWVudCB0bw0KDQo+IGV4cGVj dCB0aGVpciB1c2U/DQoNCj4NCg0KPiBbU3JpcmFtXSBJZiBvbmx5IGEg4oCYTm90IFZhbGlk4oCZ IHVwZGF0ZSBpcyBhdmFpbGFibGUgZm9yIGEgcHJlZml4LCB0aGVuIHRoZSB1cGRhdGUgaXMgdXNl ZCBzaW5jZQ0KDQo+IG90aGVyd2lzZSB0aGUgcHJlZml4IHdvdWxkIGJlIHVucmVhY2hhYmxlLiBC b3RoIEJHUHNlYyBhbmQgUlBLSS9vcmlnaW4gdmFsaWRhdGlvbiBhcmUNCg0KPiBleHBlY3RlZCB0 byBkZXByZWYgaW52YWxpZCB1cGRhdGVzIHJhdGhlciB0aGFuIGlnbm9yZSB0aGVtLiBUaGlzIGlz IGRyaXZlbiBieSBvcGVyYXRvcg0KDQo+IHBvbGljeSBhbmQgY2FuIHZhcnkuIEhlbmNlLCB3ZSBh cmUgZGVsaWJlcmF0ZWx5IG5vdCB1c2luZyBhbnkgbm9ybWF0aXZlIGxhbmd1YWdlIGhlcmUuDQoN Cg0KDQpIb25lc3RseSwgdXNpbmcg4oCcTm90IFZhbGlk4oCdIHVwZGF0ZXMgbWFrZXMgbm8gc2Vu c2UgdG8gbWUuICBXZeKAmXJlIGJ1aWxkaW5nIGFsbCB0aGlzIG1hY2hpbmVyeSwgY2hhbmdpbmcg QkdQLCBldGMuLiBqdXN0IHRvIGVuZCB1cCB1c2luZyB1cGRhdGVzIHRoYXQgYXJlIG5vdCB2YWxp ZCBhbnl3YXkuICBXaHkgYXJlIHdlIGRvaW5nIGFsbCB0aGlzIHdvcmsgdGhlbj8hPyAg4pi5DQoN Cg0KDQpJIHVuZGVyc3RhbmQgdGhhdCwgc3BlY2lhbGx5IGF0IHRoZSBiZWdpbm5pbmcsIHBlb3Bs ZSBtYXkgd2FudCB0byB1c2Ug4oCcTm90IFZhbGlk4oCdIHVwZGF0ZXPigKZidXQgdGhhdCBpcyBh biBvcGVyYXRpb25hbCBjb25zaWRlcmF0aW9uIChhcyB5b3Ugc2FpZCBhYm92ZSkuICBQbGVhc2Ug dGFrZSB0aGUgdGV4dCBvdXQgZnJvbSB0aGlzIGRvY3VtZW50IHRoYXQgcmVjb21tZW5kcyB1c2lu ZyDigJxOb3QgVmFsaWTigJ3igKZhbmQgbGV0IEktRC5pZXRmLXNpZHItYmdwc2VjLW9wcyBkZWFs IHdpdGggdGhhdCByZWNvbW1lbmRhdGlvbi4NCg0KDQoNCuKApg0KDQoNCg0KTmV3IGNvbW1lbnQ6 DQoNCg0KDQpOMS4gU2VjdGlvbiAyLjIuIChOZWdvdGlhdGluZyBCR1BzZWMgU3VwcG9ydCkgc2F5 cyB0aGF0IGJlY2F1c2Ug4oCcQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcyBjYW4gYmUgcXVpdGUgbGFy Z2UsIHRoZXJlZm9yZSBhbnkgQkdQc2VjIHNwZWFrZXLigKZTSE9VTEQgYWxzbyBhbm5vdW5jZSBz dXBwb3J0IGZvciB0aGUgY2FwYWJpbGl0eSB0byByZWNlaXZlIEJHUCBleHRlbmRlZCBtZXNzYWdl cyBbSS1ELmlldGYtaWRyLWJncC1leHRlbmRlZC1tZXNzYWdlc10u4oCdICAgV2hhdCBkb2VzIHRo aXMgbWVhbiB3aXRoIHJlc3BlY3QgdG8gdGhlIHNlc3Npb24gZXN0YWJsaXNobWVudCByZXF1aXJl bWVudHM/ICBUaGlzIGNhcGFiaWxpdHkgaXMgbm90IG1hbmRhdG9yeSAoU0hPVUxEIGlzIHVzZWQg YW5kIG5vdCBNVVNUKSwgYnV0IGFzIEJHUHNlYyBpcyBkZXBsb3llZCBtb3JlIGFuZCBtb3JlLCB0 aGUgc3lzdGVtIG1heSBub3Qgd29yayBhbnltb3JlIHVubGVzcyBpdCBpcyBleGNoYW5nZWQuICAg V2h5IHdhc27igJl0IOKAnE1VU1TigJ0gdXNlZD8gIEnigJltIGd1ZXNzaW5nIHRoYXQgcGFydCBv ZiB0aGUgcmVhc29uIG1heSBiZSBhdmFpbGFiaWxpdHkgb2YgdGhlIGZlYXR1cmXigKYgIEkgdGhp bmsgdGhhdCB0aGUgcG90ZW50aWFsIG9mIGhhdmluZyBhIHByb3Blcmx5IG5lZ290aWF0ZWQgQkdQ c2VjIHNlc3Npb24gc3RpbGwgbm90IHdvcmsgKGJlY2F1c2UgdGhlIG1lc3NhZ2VzIGFyZSB0b28g YmlnKSBzaG91bGQgYXQgbGVhc3QgYmUgbWVudGlvbmVkIGluIHRoZSBuZXcgT3BlcmF0aW9ucyBh bmQgTWFuYWdlbWVudCBDb25zaWRlcmF0aW9ucyBTZWN0aW9uLg0KDQoNCg0KTjIuIFRoZSByZWZl cmVuY2VzIHRvIFJGQzUyMjYgYW5kIFJGQzY0ODcgc2hvdWxkIGJlIE5vcm1hdGl2ZS4NCg0KDQo= --_000_B364FC57DEE24A08B9EC5235CDCD0634ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAg MCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsN CglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1p bHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAz IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxp bmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpi bHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5 cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7 DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb1BsYWluVGV4dCwgbGkuTXNvUGxh aW5UZXh0LCBkaXYuTXNvUGxhaW5UZXh0DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28t c3R5bGUtbGluazoiUGxhaW4gVGV4dCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0K cA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIjt9DQpzcGFuLmFwcGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtc3R5 bGUtc3Bhbjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsN Cglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3RleHQ7DQoJZm9udC13ZWlnaHQ6 bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCnNwYW4uUGxhaW5UZXh0Q2hhcg0KCXttc28t c3R5bGUtbmFtZToiUGxhaW4gVGV4dCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJ bXNvLXN0eWxlLWxpbms6IlBsYWluIFRleHQiOw0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0Kc3Bh bi5tc29JbnMNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6 IiI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBE ZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7 fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBp biAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rp b24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjE4 MDQ1NDE1NzM7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRz OjE5MDc1MTM3NTQgMTU5NTk5Mjk0MiA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcx MyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMDpsZXZlbDEN Cgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCW1hcmdpbi1sZWZ0OjQxLjZwdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3Qg bDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCglt YXJnaW4tbGVmdDo3Ny42cHQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVs Mw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCW1hcmdpbi1s ZWZ0OjExMy42cHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwwOmxldmVsNA0KCXtt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJbWFyZ2luLWxlZnQ6MTQ5LjZwdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6 bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJn aW4tbGVmdDoxODUuNnB0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDYN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgltYXJnaW4tbGVm dDoyMjEuNnB0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CW1hcmdpbi1sZWZ0OjI1Ny42cHQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxl dmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2lu LWxlZnQ6MjkzLjZwdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJbWFyZ2luLWxlZnQ6 MzI5LjZwdDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47 fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5 IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+ DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+T24g MTEvMjcvMTYsIDEyOjIxIFBNLCAmcXVvdDtTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSZxdW90 OyAmbHQ7a290aWthbGFwdWRpLnNyaXJhbUBuaXN0LmdvdiZndDsgd3JvdGU6PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPlNyaXJhbTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ SGkhJm5ic3A7IFRoYW5rcyBmb3IgYWRkcmVzc2luZyBteSBjb21tZW50cy4mbmJzcDsgSSBoYXZl IHNvbWUgcmVtYWluaW5nIGNvbW1lbnRzIGJlbG93LiZuYnNwOyBJIGZsYWdnZWQgYSBjb3VwbGUg b2YgaXRlbXMgdGhhdCBJIHRoaW5rIHRoZSBDaGFpcnMgc2hvdWxkIGNvbnN1bHQgdGhlIFdHIG9u LCBidXQgSeKAmWxsIGxlYXZlIGl0IHVwIHRvIHRoZW0gdG8gZGVjaWRlIHRoYXQg4oCTIG5vdGUg dGhhdCBJIGRvbuKAmXQgdGhpbmsgd2UgbmVlZA0KIHRvIFdHTEMgdGhlIHdob2xlIGRvY3VtZW50 IGFnYWluLCBqdXN0IGEgY291cGxlIG9mIGRlY2lzaW9ucy48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPkkg YWxzbyBhZGRlZCBhIGNvdXBsZSBvZiBuZXcgY29tbWVudHMgYXQgdGhlIGVuZC48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPkkgdGhpbmsgd2UgYXJlIGNsb3NlciwgYnV0IHRoZXJlIGFyZSBzdGlsbCBhIGNv dXBsZSBvZiBpdGVtcyB3aGVyZSB3ZeKAmXJlIG5vdCBhZ3JlZWluZzombmJzcDsgdHJlYXRtZW50 IG9mIGR1cGxpY2F0ZXMgYW5kIGNvbmZlZGVyYXRpb25zLiZuYnNwOyBXZSBjYW4gY29udGludWUg dGhlIGRpc2N1c3Npb24g4oCTIEkgd291bGQgbG92ZSB0byBoZWFyIG90aGVyIG9waW5pb25zIGFz IHdlbGwgKGZyb20gdGhlIFdHKS48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPkluIHRoZSBtZWFudGltZSwg SSB3aWxsIHN0YXJ0IHRoZSBJRVRGIExhc3QgQ2FsbCBhbmQgcmVxdWVzdCBhIFJURy1EaXIgcmV2 aWV3IGFzIHdlbGwuJm5ic3A7IEFkZHJlc3Npbmcgd2hhdCB3ZSBzZWVtIHRvIGFncmVlIG9uIChJ IHByb3Bvc2VkIHNvbWUgY2hhbmdlcyBiZWxvdyBmb3IgY2xhcml0eSkgaW4gdGhlIG5leHQgZmV3 IGRheXMgd291bGQgZGVmaW5pdGVseSBoZWxwIHRoZSBwcm9jZXNzLjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+VGhhbmtzITxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5BbHZhcm8uPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+4oCmPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBbU3JpcmFt XSBGb2xsb3dpbmcgdGhlIGNsYXJpZmljYXRpb25zIGFuZCBhZGRpdGlvbmFsIGd1aWRhbmNlIHlv dSBwcm92aWRlZCBpbiBTZW91bCAod2hlbg0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ Jmd0OyB5b3UsIENocmlzLCBhbmQgSSBtZXQpLCBJIGhhdmUgYWRkZWQgYSBuZXcgU2VjdGlvbiA3 IChPcGVyYXRpb25zIGFuZCBNYW5hZ2VtZW50DQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij4mZ3Q7IENvbnNpZGVyYXRpb25zKS4gVGhlIHRvcGljcyB5b3UgbWVudGlvbiBhYm92ZSBhcmUg YWxsIGNvdmVyZWQgaW4gdGhlIG5ldyBTZWN0aW9uIDcuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPlRoYW5rcyBmb3IgYWRkaW5nIHRoaXMgU2VjdGlvbi4mbmJzcDsgSSB0aGluayB0aGUg ZXNzZW5jZSBvZiB3aGF0IHdlIHRhbGtlZCBhYm91dCBpcyB0aGVyZSwgYnV0IHRoZSB0ZXh0IG5l ZWRzIHNvbWUgZWRpdGluZy4mbmJzcDsgSeKAmW0gcHV0dGluZyBzb21lIHN1Z2dlc3Rpb25zIGJl bG93IOKAkyBrZWVwIGluIG1pbmQgdGhhdCB0aGlzIGRvY3VtZW50IGlzIGEgc3BlY2lmaWNhdGlv biwgc28geW91IGNhbiBiZSBwcmVzY3JpcHRpdmUNCiB3aXRoIHdoYXQgeW91IHdhbnQgdG8gaGFw cGVuLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5PTEQmZ3Q7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5EZXRhaWxlZCByZWNvbW1lbmRhdGlvbnMgY29uY2Vy bmluZyBvcGVyYXRpb25zIGFuZCBtYW5hZ2VtZW50PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgaXNzdWVzIHdpdGggQkdQc2VjIGFyZSBwcm92aWRl ZCBpbiBbSS1ELmlldGYtc2lkci1iZ3BzZWMtb3BzXS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+TkVXJmd0OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+VGhl IEJlc3QgQ3VycmVudCBQcmFjdGljZSBjb25jZXJuaW5nIG9wZXJhdGlvbmFsIGRlcGxveW1lbnQg b2YgQkdQU2VjIGlzIHByb3ZpZGVkIGluPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij5bSS1ELmlldGYtc2lkci1iZ3BzZWMtb3BzXS48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5P TEQmZ3Q7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJz cDsgVGhpcyBkb2N1bWVudCBzcGVjaWZpZXMgQkdQc2VjIFZlcnNpb24gMCBvbmx5LiZuYnNwOyBX aGF0IHNob3VsZCB0aGU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZu YnNwOyZuYnNwOyBhY3Rpb24gYmUgaWYgdGhlIFZlcnNpb24gaXMgbm90IDAgaW4gdGhlIEJHUHNl YyBjYXBhYmlsaXR5PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJz cDsmbmJzcDsgYWR2ZXJ0aXNlbWVudCBmcm9tIGEgcGVlcj8mbmJzcDsgSWYgdGhlIGludGVyc2Vj dGlvbiBvZiBCR1BzZWMgY2FwYWJpbGl0eTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jm5ic3A7Jm5ic3A7IGFkdmVydGlzZW1lbnRzIGZyb20gYm90aCBzaWRlcyBkb2Vz IG5vdCBpbmNsdWRlIFZlcnNpb24gMCwgdGhlbjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IEJHUHNlYyBWZXJzaW9uIDAgaGFzIG5vdCBiZWVuIHN1 Y2Nlc3NmdWxseSBuZWdvdGlhdGVkLiZuYnNwOyBIb3dldmVyLCBhPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgQkdQIHNlc3Npb24gaXMgc3RpbGwg bmVnb3RpYXRlZCBhbmQgaGVuY2UgdGhlIGFiaWxpdHkgdG8gZXhjaGFuZ2U8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyByb3V0ZXMgaXMgc3RpbGwg dGhlcmUuJm5ic3A7IEJHUCAodW5zaWduZWQpIG1lc3NhZ2VzIGFyZSBleGNoYW5nZWQuJm5ic3A7 IFNvPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsg dGhlIGNoYWluIG9mIEFTTnMgaXMgbm90IGJyb2tlbiwgaS5lLiB0aGV5IG1heSBub3QgYmUgY29u dGlndW91czxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5i c3A7IEJHUHNlYyBwZWVycyBidXQgYXJlIHN0aWxsIGNvbnRpZ3VvdXMgQkdQIHBlZXJzLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgTGV0IHVzIHNheSB0aGF0IEJH UHNlYyBjYXBhYmlsaXR5IHdhcyBuZWdvdGlhdGVkIHN1Y2Nlc3NmdWxseSBiZXR3ZWVuPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgdHdvIHBlZXJz LCBhbmQgc3Vic2VxdWVudGx5IGl0IHdhcyByZXNldC4mbmJzcDsgSW4gdGhlIG1lYW50aW1lLCBh c3N1bWU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNw OyB0aGF0IHRoZSA0LWJ5dGUgQVNOIGNhcGFiaWxpdHkgb3IgdGhlIG11bHRpLXByb3RvY29sIGNh cGFiaWxpdHkgd2FzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJz cDsmbmJzcDsgbG9zdCBiZXR3ZWVuIHRoZSB0d28gcGVlcnMuJm5ic3A7IFNvIG5vdyB0aGUgQkdQ c2VjIHNlc3Npb24gcmVzZXQgcmVzdWx0czxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jm5ic3A7Jm5ic3A7IGluIGZhaWx1cmUgb2YgQkdQc2VjIGNhcGFiaWxpdHkgbmVn b3RpYXRpb24gYW5kIG9ubHkgYSBCR1Agc2Vzc2lvbiBpczxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IGVzdGFibGlzaGVkLiZuYnNwOyBXb3VsZCB0 aGUgbmV0d29yayBvcGVyYXRvciBiZSBub3RpZmllZCB0aGF0IHRoaXM8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyBkb3duZ3JhZGUgZnJvbSBCR1Bz ZWMgdG8gQkdQIGhhcyBoYXBwZW5lZD8mbmJzcDsgV2hhdCBpZiB0aGUgb3BlcmF0b3I8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyBhbHdheXMgd2Fu dHMgYSBzZWN1cmUgc2Vzc2lvbiBvbmx5PyZuYnNwOyBDYW4gdGhleSByZXF1aXJlIHRoYXQgbm8g QkdQPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsg c2Vzc2lvbiBiZSBlc3RhYmxpc2hlZCBpZiBCR1BzZWMgY2FwYWJpbGl0eSBuZWdvdGlhdGlvbiBm YWlscz88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNw OyBPcGVyYXRvcnMgYXJlIGFkdmlzZWQgdG8gc3BlYWsgd2l0aCB0aGVpciB2ZW5kb3JzIHRvIHNl dCB1cCBrbm9icyBhbmQ8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZu YnNwOyZuYnNwOyBhbGVydHMgdG8gaGF2ZSBzdWNoIG9wZXJhdGlvbnMgYW5kIG1hbmFnZW1lbnQg ZmVhdHVyZXMgaW4gdGhlaXI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZuYnNwOyZuYnNwOyBCR1BzZWMgY2FwYWJsZSByb3V0ZXJzLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij5ORVcmZ3Q7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij4mbmJzcDsmbmJzcDsgU2VjdGlvbiAyLjIgZGVzY3JpYmVzIHRoZSBuZWdvdGlhdGlvbiByZXF1 aXJlZCB0byBlc3RhYmxpc2ggYSBCR1BzZWMtY2FwYWJsZQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7cGVlcmluZyBzZXNzaW9uLiZuYnNwOyBOb3Qgb25s eSBtdXN0IHRoZSBCR1BzZWMgY2FwYWJpbGl0eSBiZSBleGNoYW5nZWQgKGFuZCBhZ3JlZWQNCjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyZuYnNwO29uKSwgYnV0IHRo ZSBCR1AgbXVsdGlwcm90b2NvbCBleHRlbnNpb24gW1JGQzQ3NjBdIGZvciB0aGUgc2FtZSBBRkkg YW5kIHRoZQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Zm91ci1ieXRlIEFTIGNhcGFiaWxpdHkgW1JGQzY3OTNdIG11c3QgYWxzbyBiZSBleGNoYW5nZWQu Jm5ic3A7IEZhaWx1cmUgdG8gcHJvcGVybHkNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZuYnNwOyZuYnNwOyZuYnNwO25lZ290aWF0ZSBhIEJHUHNlYyBzZXNzaW9uLCBkdWUgdG8gYSBt aXNzaW5nIGNhcGFiaWxpdHksIGZvciBleGFtcGxlLCBtYXkgc3RpbGwNCjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyZuYnNwO3Jlc3VsdCBpbiB0aGUgZXhjaGFuZ2Ug b2YgQkdQICh1bnNpZ25lZCkgdXBkYXRlcy4mbmJzcDsgV2hpbGUgdGhlIEJHUCBjaGFpbiBvZiBB U05zDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsmbmJzcDtpcyBu b3QgYnJva2VuLCB0aGUgc2VjdXJpdHkgY2FuIGJlIHJlZHVjZWQgYW5kIGEgY29udGlndW91cyBz ZXQgb2YgQkdQc2VjIHBlZXJzDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsm bmJzcDsmbmJzcDttYXkgbm90IGV4aXN0IGFueW1vcmUuJm5ic3A7IEl0IGlzIFJFQ09NTUVOREVE IHRoYW4gYW4gaW1wbGVtZW50YXRpb24gbG9nIHRoZQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ZmFpbHVyZSB0byBwcm9wZXJseSBuZWdvdGlhdGUgYSBC R1BzZWMgc2Vzc2lvbiBpZiB0aGUgbG9jYWwgQkdQIHNwZWFrZXIgaXMgY29uZmlndXJlZA0KPC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Zm9yIGl0LiZuYnNw OyBBbHNvLCBhbiBpbXBsZW1lbnRhdGlvbiBNVVNUIGhhdmUgYWJpbGl0eSB0byBwcmV2ZW50IGEg QkdQIHNlc3Npb24gZnJvbQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5i c3A7Jm5ic3A7YmVpbmcgZXN0YWJsaXNoZWQgaWYgY29uZmlndXJlZCBmb3IgQkdQc2VjIHVzZS48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij7igKY8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPiZndDsgTTEuMS4gU2VjdGlvbiAyLjEuIChUaGUgQkdQc2VjIENhcGFiaWxpdHkpIGlu Y2x1ZGVzIGEgVmVyc2lvbiBmaWVsZCBhbmQgc29tZSBSZXNlcnZlZCBiaXRzLA0KPC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBidXQgdGhlcmUgYXJlIG5vIElBTkEgcmVnaXN0cmll cyBkZWZpbmVkIGZvciBob3cgdG8gbWFuYWdlIHRoZXNlIHNwYWNlcy4mbmJzcDsgUGxlYXNlIGRl ZmluZQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGUgcmVnaXN0cmllcyBh bmQgdGhlIGNvcnJlc3BvbmRpbmcgcmVnaXN0cmF0aW9uIHByb2NlZHVyZXMuPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IFtTcmlyYW1dIERvbmUuIFBsZWFzZSBzZWUgdGhl IHVwZGF0ZWQgSUFOQSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij5zL1Jlc2VydmVkL1VuYXNzaWduZWQ8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+R2l2ZW4gdGhhdCB0aGVyZSBhcmUgb25seSAzIHVuYXNzaWduZWQgYml0cyBhbmQgdGhh dCBjaGFuZ2luZyB2ZXJzaW9ucyBzaG91bGQgYmUgYSBiaWcgZGVhbCwgSSB0aGluayB0aGF0IOKA nElFVEYgUmV2aWV34oCdIGlzIG5vdCBhIHN0cm9uZyBlbm91Z2ggcmVnaXN0cmF0aW9uIHByb2Nl ZHVyZS4mbmJzcDsgU3VnZ2VzdGlvbjogdXNlIFN0YW5kYXJkcyBBY3Rpb24gaW5zdGVhZC48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+WypdIENoYWlyczogd2UgZG9u4oCZdCBuZWVkIHRv IFdHTEMgdGhlIHdob2xlIGRvY3VtZW50LCBidXQgaXQgd291bGQgYmUgYSBnb29kIGlkZWEgdG8g cnVuIHRoZSByZWdpc3RyYXRpb24gcHJvY2VkdXJlcyBieSB0aGUgV0cgb25jZSB3ZSBzZXR0bGUg b24gdGhlbSDigJMgdGhpcyBjb3VsZCBldmVuIGJlIGRvbmUgaW4gcGFyYWxsZWwgd2l0aCB0aGUg SUVURiBMYXN0IENhbGwuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBNMS4yLiBTZWN0aW9uIDMu MS4gKFNlY3VyZV9QYXRoKSBkZWZpbmVzIHRoZSBGbGFncyBmaWVsZCBhbmQgYXNzaWducyB0aGUg Zmlyc3QgYml0IChCVFcsIGlzDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHRo YXQgdGhlIE1TQiBvciB0aGUgTFNCLCBwbGVhc2UgY2xhcmlmeSksIGJ1dCBkb2Vzbid0IHNldCB1 cCB0aGUgcmVnaXN0cnkgb3IgcmVnaXN0cmF0aW9uDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7IHByb2NlZHVyZXMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4m Z3Q7IFtTcmlyYW1dIEl0IGlzIHRoZSBNU0IgKGxlZnQgbW9zdCBiaXQpIGFuZCB0aGF0IGlzIG5v dyBjbGFyaWZpZWQgaW4gU2VjdGlvbiAzLjEuIFNldCB1cCBvZiB0aGUNCjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPiZndDsgcmVnaXN0cnkgZm9yIHRoZSBGbGFncyBmaWVsZCBpcyBub3cg aW5jbHVkZWQgaW4gdGhlIHVwZGF0ZWQgSUFOQSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5TYW1lIGNvbW1lbnQgYXMgYWJvdmUgYWJvdXQg4oCc SUVURiBSZXZpZXfigJ0gdnMg4oCcU3RhbmRhcmRzIEFjdGlvbuKAnS48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+4oCmJm5ic3A7Jm5ic3A7IDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jmd0OyBNMi4yLiBUaGUgZGVmaW5pdGlvbiBvZiB0aGUgQkdQc2VjX1Bh dGggQXR0cmlidXRlIChhbmQgaXRzIGRldGFpbHMpIGRvbid0IGhhdmUgY2xlYXIgZXJyb3INCjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgaGFuZGxpbmcgcHJvY2VkdXJlcyBkZWZp bmVkIChSRkM3NjA2KS4mbmJzcDsgU2VjdGlvbiA0LjMuIChQcm9jZXNzaW5nIEluc3RydWN0aW9u cyBmb3INCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgQ29uZmVkZXJhdGlvbiBN ZW1iZXJzKSBkb2VzIHNheSB0aGlzOiAmcXVvdDsoQXMgZGlzY3Vzc2VkIGluIFNlY3Rpb24gNS4y LCBhbnkgZXJyb3IgaW4gdGhlDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IEJH UHNlY19QYXRoIGF0dHJpYnV0ZSBNVVNUIGJlIGhhbmRsZWQgdXNpbmcgdGhlICZxdW90O3RyZWF0 LWFzLXdpdGhkcmF3JnF1b3Q7LCBhcHByb2FjaCBhcw0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+Jmd0OyBkZWZpbmVkIGluIFJGQyA3NjA2IFtSRkM3NjA2XS4pJnF1b3Q7IChpbmNsdWRp bmcgdGhlIHBhcmVudGhlc2VzKS4mbmJzcDsgSG93ZXZlciwgNSwyIG9ubHkgc2F5czoNCjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgJnF1b3Q7QkdQc2VjIHNwZWFrZXJzIE1VU1Qg aGFuZGxlIHRoZXNlIGVycm9ycyB1c2luZyB0aGUgJnF1b3Q7dHJlYXQtYXMtd2l0aGRyYXcmcXVv dDsgYXBwcm9hY2ggYXMNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgZGVmaW5l ZCBpbiBSRkMgNzYwNiBbUkZDNzYwNl0uJnF1b3Q7Jm5ic3A7Jm5ic3A7IE5vdGU6ICZxdW90O3Ro ZXNlIGVycm9ycyZxdW90OyBpcyBub3QgdGhlIHNhbWUgYXMgJnF1b3Q7YW55DQo8L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGVycm9yJnF1b3Q7LiZuYnNwOyBQbGVhc2UgZGlzY3Vz cyBlcnJvciBoYW5kbGluZyBpbiBhIG1vcmUgcHJvbWluZW50IHBsYWNlLiAoSGludDogaXQgbWF5 IGZpdCBpbiBhIGZhdWx0DQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IG1hbmFn ZW1lbnQgZGlzY3Vzc2lvbiBpbiB0aGUgT3BlcmF0aW9ucyBhbmQgTWFuYWdlbWVudCBTZWN0aW9u Lik8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDs8bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0mbmJzcDsg cyAvQXMgZGlzY3Vzc2VkIGluIFNlY3Rpb24gNS4yLCBhbnkgZXJyb3IgaW4gdGhlIEJHUHNlY19Q YXRoIGF0dHJpYnV0ZSBNVVNUIGJlDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7 IGhhbmRsZWQgdXNpbmcgdGhlICZxdW90O3RyZWF0LWFzLXdpdGhkcmF3JnF1b3Q7LCBhcHByb2Fj aCBhcyBkZWZpbmVkIGluIFJGQyA3NjA2IFtSRkM3NjA2XS4vIEFzDQo8L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij4mZ3Q7IGRpc2N1c3NlZCBpbiBTZWN0aW9uIDUuMiwgYW55IHN5bnRhY3Rp Y2FsIG9yIHByb3RvY29sIHZpb2xhdGlvbiBlcnJvcnMgaW4gdGhlIEJHUHNlY19QYXRoDQo8L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGF0dHJpYnV0ZSBNVVNUIGJlIGhhbmRsZWQg dXNpbmcgdGhlICZxdW90O3RyZWF0LWFzLXdpdGhkcmF3JnF1b3Q7IGFwcHJvYWNoIGFzIGRlZmlu ZWQgaW4gUkZDIDc2MDYNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgW1JGQzc2 MDZdLi88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDs8bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0mbmJz cDsgU2VjdGlvbiA0LjMgaGFzIGJlZW4gdXBkYXRlZCBhY2NvcmRpbmdseS48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij5JIGRpZG7igJl0IGV4cGxhaW4gbXlzZWxmIGNvcnJlY3RseS4mbmJzcDsgU2VjdGlv biA0LjMuIChQcm9jZXNzaW5nIEluc3RydWN0aW9ucyBmb3IgQ29uZmVkZXJhdGlvbiBNZW1iZXJz KSBjb3ZlcnMgb25seSB0aGUgcHJvY2Vzc2luZyBmb3IgY29uZmVkZXJhdGlvbnMsIHNvIHB1dHRp bmcgdGV4dCBpbiB0aGVyZSBhYm91dCBhbnkgZXJyb3JzIGlzIGdvb2QsIGJ1dCBkb2VzbuKAmXQg Y292ZXIgdGhlIGdlbmVyYWwgY2FzZQ0KIChmb3IgcHJvY2Vzc2luZyBhbnkgdXBkYXRlKS4mbmJz cDsgPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk9UT0gsIFNlY3Rpb24gNS4yLiAoVmFs aWRhdGlvbiBBbGdvcml0aG0pIGRvZXNu4oCZdCBhY3R1YWxseSB0YWxrIGFib3V0IOKAnGFueSBl cnJvcuKAnSAoYXMgcmVmZXJlbmNlZCBub3cgZnJvbSA0LjMpIOKAkyBpdCBvbmx5IHRhbGtzIGFi b3V0IOKAnHRoZXNlIGVycm9yc+KAnSwgd2hpY2ggY29ycmVzcG9uZCB0byB0aGUgbGlzdCBvZiBj aGVja3MgaW4gdGhlIHNlY3Rpb24uJm5ic3A7IElPVywgdGhlcmUgaXMgbm8gZ2xvYmFsIHNwZWNp ZmljYXRpb24NCiB0aGF0IGFueSBlcnJvciBtdXN0IHJlc3VsdCBpbiB0cmVhdC1hcy13aXRoZHJh dy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+U29sdXRpb246Jm5ic3A7IHRha2UgdGhl IHRleHQgb3V0IG9mIDQuMyBhbmQgdXBkYXRlIHRoZSB0ZXh0IGluIDUuMjsgc3VnZ2VzdGlvbjo8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+T0xEJmd0OzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IElmIGFueSBvZiB0aGVzZSBjaGVja3Mg ZmFpbCwgaXQgaXMgYW4gZXJyb3IgaW4gdGhlIEJHUHNlY19QYXRoPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgYXR0cmlidXRlLiZuYnNwOyBBbnkg b2YgdGhlc2UgZXJyb3JzIGluIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgYXJlPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgaGFuZGxlZCBhcyBw ZXIgUkZDIDc2MDYgW1JGQzc2MDZdLiZuYnNwOyBCR1BzZWMgc3BlYWtlcnMgTVVTVCBoYW5kbGUg dGhlc2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNw OyBlcnJvcnMgdXNpbmcgdGhlICZxdW90O3RyZWF0LWFzLXdpdGhkcmF3JnF1b3Q7IGFwcHJvYWNo IGFzIGRlZmluZWQgaW4gUkZDIDc2MDY8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPiZuYnNwOyZuYnNwOyBbUkZDNzYwNl0uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPk5FVyZndDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNw OyZuYnNwOyBJZiBhbnkgb2YgdGhlc2UgY2hlY2tzIGZhaWwsIGl0IGlzIGFuIGVycm9yIGluIHRo ZSBCR1BzZWNfUGF0aDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5i c3A7Jm5ic3A7IGF0dHJpYnV0ZS4gJm5ic3A7QkdQc2VjIHNwZWFrZXJzIE1VU1QgaGFuZGxlIGFu eSBzeW50YWN0aWNhbCBvciBwcm90b2NvbCBlcnJvcnMNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPiZuYnNwOyZuYnNwOyZuYnNwO2luIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgdXNp bmcgdGhlICZxdW90O3RyZWF0LWFzLXdpdGhkcmF3JnF1b3Q7IGFwcHJvYWNoIGFzIGRlZmluZWQN CjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyZuYnNwO2luIFJGQyA3 NjA2IFtSRkM3NjA2XS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPuKApjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jmd0OyBNNy4xLiDigJxXaXRoIHJlZ2FyZHMgdG8gdGhlIHByb2Nlc3Npbmcg b2YgZHVwbGljYXRlIHVwZGF0ZSBtZXNzYWdlcywgaWYgdGhlIGZpcnN0IHVwZGF0ZQ0KPC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBtZXNzYWdlIGlzIHZhbGlkLCB0aGVuIGFuIGlt cGxlbWVudGF0aW9uIFNIT1VMRCBOT1QgcnVuIHRoZSB2YWxpZGF0aW9uIHByb2NlZHVyZSBvbiB0 aGUNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgc2Vjb25kLCBkdXBsaWNhdGUg dXBkYXRlIG1lc3NhZ2UgKGV2ZW4gaWYgdGhlIGJpdHMgb2YgdGhlIHNpZ25hdHVyZSBmaWVsZCBh cmUNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgZGlmZmVyZW50KS7igJ0mbmJz cDsgRXZlbiB0aG91Z2ggYSBkaXNjdXNzaW9uIGFib3V0IG5vbi1kZXRlcm1pbmlzdGljIHNpZ25h dHVyZSBhbGdvcml0aG1zDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHByZWNl ZGVzIHRoaXMgdGV4dCwgdGhlIHZhbGlkYXRpb24gaXMgc3RpbGwgbm90IHJ1bi4mbmJzcDsgSG93 IGNhbiB0aGUgdmFsaWRpdHkgb2YgdGhlIFBhdGggYmUNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPiZndDsgZ3VhcmFudGVlZCBpbiB0aGlzIGNhc2U/Jm5ic3A7IFNob3VsZCB0aGlzIGJl IHRoZSBhY3Rpb24gZm9yIGFsbCBhbGdvcml0aG1zIG9yIG9ubHkgb25lcyBrbm93biB0bw0KPC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBiZSBub24tZGV0ZXJtaW5pc3RpYz88bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDs8bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0gRGVmaW5pdGlvbiBv ZiBkdXBsaWNhdGUgdXBkYXRlIGZvciBCR1BzZWM6IEEgQkdQc2VjIHVwZGF0ZSBpcyBhIGR1cGxp Y2F0ZSBpZiBpdCBpcw0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBpZGVudGlj YWwgdG8gYW5vdGhlciB1cGRhdGUgaW4gdGhlIEFkai1SSUItaW4sIGluY2x1ZGluZyBTS0lzIGFu ZCBBbGdvcml0aG0gSUQsIGJ1dCBub3QNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZn dDsgaW5jbHVkaW5nIHRoZSBzaWduYXR1cmVzLiBJZiB0aGUgZmlyc3QgdXBkYXRlIG1lc3NhZ2Ug KGhhdmluZyB0aGUgKnNhbWUgU0tJcyogYXMgdGhlDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7IGR1cGxpY2F0ZSkgaXMgKlZhbGlkKiwgdGhlbiB0aGUgZHVwbGljYXRl4oCZcyB2 YWxpZGl0eSBzdGF0ZSBuZWVkIG5vdCBiZSBjb21wdXRlZC4mbmJzcDsgSWYgdmFsaWRpdHkgb2YN CjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgdGhlIGR1cGxpY2F0ZSB3ZXJlIGNv bXB1dGVkIGFuZCBmb3VuZCAnVmFsaWQnLCB0aGVuIGl0IGdpdmVzIHRoZSByb3V0ZXIgbm8gbmV3 DQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGluZm9ybWF0aW9uLiBBbHRlcm5h dGl2ZWx5LCBpZiBpdCB3ZXJlIGZvdW5kICdOb3QgVmFsaWQnLCB0aGVuIGl0IG9ubHkgaW1wbGll cyB0aGF0IHNvbWUgYml0DQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGVycm9y cyBvY2N1cnJlZCBpbiB0aGUgc2lnbmF0dXJlcy4gVGhlcmVmb3JlLCB0aGUgQkdQc2VjIHNwZWFr ZXIgc2hvdWxkIGtlZXAgdGhlICdWYWxpZCcNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZndDsgb3JpZ2luYWwgdXBkYXRlIGFuZCBpZ25vcmUgdGhlIGR1cGxpY2F0ZS4gSG93ZXZlciwg aWYgdGhlIG9yaWdpbmFsIHVwZGF0ZSB3ZXJlICdOb3QgVmFsaWQnLA0KPC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGVuIHBlcmZvcm1pbmcgdmFsaWRhdGlvbiBvZiB0aGUgZHVw bGljYXRlIGlzIHJlbGV2YW50IGFuZCBTSE9VTEQgYmUgZG9uZS48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPiZndDs8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0gQWRkZWQgYSBwYXJhZ3JhcGggaW4gdGhlIG5l dyBTZWN0aW9uIDcgKE9wZXJhdGlvbnMgYW5kIE1hbmFnZW1lbnQNCjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZndDsgQ29uc2lkZXJhdGlvbnMpIHRvIGluY2x1ZGUgdGhlIGFib3ZlIG9i c2VydmF0aW9ucy4mbmJzcDsgPG86cD4NCjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+SSBzYXcg dGhlIHRleHQsIGFuZCBoYXZlIDMgcXVlc3Rpb25zL2NvbW1lbnRzOjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij4xLiDigJzigKZpdCBvbmx5IGltcGxpZXMgdGhhdCBzb21lIGJpdCBlcnJv cnMgb2NjdXJyZWQgaW4gdGhlIHNpZ25hdHVyZXMu4oCdJm5ic3A7Jm5ic3A7IFdoYXQgZG9lcyB0 aGF0IG1lYW4/Jm5ic3A7IEFyZSB5b3UgaW1wbHlpbmcgdGhhdCB0aGUgc2VuZGVyIGdvdCB0aGUg c2lnbmF0dXJlIHdyb25nPyZuYnNwOyBPciBtYXliZSB0aGF0IHRoZXJlIHdhcyBzb21lIGNvcnJ1 cHRpb24gaW4tdHJhbnNpdD8mbmJzcDsgQm90aCBjYXNlcyBhcmUgKmJhZCosIGJ1dA0KIHRoZSBj YXNlIHdoZXJlIHRoZSBzZW5kZXIgY291bGQgZ2V0IHRoZSBzaWduYXR1cmUgd3JvbmcgaXMgc3Bl Y2lhbGx5IHNvIGJlY2F1c2UgaWYgaXQgd2FzbuKAmXQgYSBkdXBsaWNhdGUgdXBkYXRlLCB0aGVu IGl0IHdvdWxkIHJlc3VsdCDigJxOb3QgVmFsaWTigJ0gYW5kIHRoZXJlIHNlZW1zIHRvIGJlIG5v IHdheSB0byBkZXRlcm1pbmUgaWYgaW4gZmFjdCB0aGUgdmFsaWRpdHkgZmFpbGVkIG9yIGlmIGl0 IGlzIHRoZSBjYXNlIG9mIHNvbWUgYml0IGVycm9ycy4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTpXaW5nZGluZ3MiPkw8L3NwYW4+IDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4yLiDi gJxUaGVyZWZvcmUsIHRoZSBCR1BzZWMgc3BlYWtlciBzaG91bGQga2VlcCB0aGUgJ1ZhbGlkJyBv cmlnaW5hbCB1cGRhdGUgYW5kIGlnbm9yZSB0aGUgZHVwbGljYXRlLuKAnSBObyEmbmJzcDsgVGhp cyBpcyBub3QgaG93IEJHUCB3b3Jrc+KApnNlZSBiZWxvdy48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+My4g4oCc4oCmaWYgdGhlIG9yaWdpbmFsIHVwZGF0ZSB3ZXJlICdOb3QgVmFsaWQn LCB0aGVuIHBlcmZvcm1pbmcgdmFsaWRhdGlvbiBvZiB0aGUgZHVwbGljYXRlIGlzIHJlbGV2YW50 IGFuZCBTSE9VTEQgYmUgZG9uZS7igJ0mbmJzcDsgV2h5IGlzIHRoaXMgbm90IGEg4oCcTVVTVOKA nT8mbmJzcDsgSU9XLCBpZiB0aGUgb3JpZ2luYWwgdXBkYXRlIHdhcyDigJxOb3QgVmFsaWTigJ0g d2hlbiB3b3VsZCBpdCBiZSBvayB0byBub3QgcGVyZm9ybSB2YWxpZGF0aW9uDQogb24gYSBuZXcg dXBkYXRlPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0gTm90ZSB0aGF0IHRoZSBh Ym92ZSBhcHBsaWVzIHRvIGJvdGggbm9uLWRldGVybWluaXN0aWMgYW5kIGRldGVybWluaXN0aWMg c2lnbmF0dXJlDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGFsZ29yaXRobXMu Jm5ic3A7IDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OzxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBNNy4yLiByZmM0 MjcxIChpbiBTZWN0aW9uIDkuIChVUERBVEUgTWVzc2FnZSBIYW5kbGluZykgdGFsa3MgYWJvdXQg dGhlIGltcGxpY2l0IHdpdGhkcmF3DQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7 IG9mIGEgcm91dGUg4oCcaWYgdGhlIE5MUkkgb2YgdGhlIG5ldyByb3V0ZSBpcyBpZGVudGljYWwg dG8gdGhlIG9uZSB0aGUgcm91dGVyIGN1cnJlbnRseSBoYXMNCjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPiZndDsgc3RvcmVk4oCm4oCdLiZuYnNwOyBUaGUgc2FtZSBOTFJJIGNhc2Ugc2Vl bXMgdG8gYmUgYSBwYXJ0aWN1bGFyIGNvbmRpdGlvbiBvZiB0aGUg4oCcZHVwbGljYXRlDQo8L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHVwZGF0ZeKAnSBkZXNjcmliZWQgaGVyZS4m bmJzcDsgSXQgbWlnaHQgYmUgYSBnb29kIGlkZWEgdG8gbWVudGlvbiB0aGF0IGEg4oCcZHVwbGlj YXRlIHVwZGF0ZeKAnQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyByZXN1bHRz IGluIHRoZSBpbXBsaWNpdCB3aXRoZHJhdyBvZiB0aGUgb3JpZ2luYWwgdXBkYXRlLiZuYnNwOyBX aGF0IGhhcHBlbnMgaWYgYSB0aGlyZCBkdXBsaWNhdGUNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPiZndDsgcm91dGUgaXMgcmVjZWl2ZWQgKHRoZSBmaXJzdCBvbmUgd2FzIHZhbGlkLCB0 aGUgc2Vjb25kIG9uZSB3YXMgbm90IHZhbGlkYXRlZCksIHNob3VsZCBpdCBiZQ0KPC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB2YWxpZGF0ZWQ/PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij4mZ3Q7IFtTcmlyYW1dIEluIFJGQyA0MjcxLCB3aGVuIHRoZXJlIGlzIGEg ZHVwbGljYXRlIHVwZGF0ZSwgdGhlIE5STEkgYW5kIHBhdGggYW5kIGFsbCBvdGhlcg0KPC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBhdHRyaWJ1dGVzIGFyZSBpZGVudGljYWwuIFRo ZXJlIGlzIG5vIGltcGxpY2l0IHdpdGhkcmF3LiBUaGUgcm91dGVyIGtlZXBzIHdoYXQgaXQgYWxy ZWFkeQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBoYXMuIEluIHRoZSBjYXNl IG9mIEJHUHNlYywgYSByb3V0ZXIga2VlcHMgdGhlIG9yaWdpbmFsIGlmIGl0IHdhcyB2YWxpZCwg YW5kIGlnbm9yZXMgdGhlDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGR1cGxp Y2F0ZS4gSXQgY2hlY2tzIHRoZSB2YWxpZGl0eSBvZiB0aGUgZHVwbGljYXRlIG9ubHkgaWYgdGhl IG9yaWdpbmFsIHdlcmUgaW52YWxpZC4mbmJzcDsmbmJzcDsNCjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij5JbiBwbGFpbiBCR1AsIGlmIGEgZHVwbGljYXRlIHVwZGF0ZSAoYXMgZGVmaW5l ZCBhYm92ZSB3aGVyZSBldmVyeXRoaW5nIGlzIGlkZW50aWNhbCkgaXMgcmVjZWl2ZWQsIHRoZW4g dGhlIG9yaWdpbmFsIG9uZSBpcyByZXBsYWNlZCBieSB0aGUgbmV3IG9uZSDigJMgaW4gdGhpcyBz cGVjaWZpYyBjYXNlICh3aGVyZSBldmVyeXRoaW5nIGlzIGlkZW50aWNhbCksIGl0IG1heSBsb29r IGxpa2UgdGhlIHJvdXRlciBrZWVwcw0KIHdoYXQgaXQgYWxyZWFkeSBoYXPigKZidXQgdGhlIGdl bmVyYWwgcnVsZSBpcyB0byByZXBsYWNlIHRoZSBvbGQgdXBkYXRlIHdpdGggYSBuZXcgb25lIGZv ciB0aGUgc2FtZSBwcmVmaXguPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPldoYXQgeW91 IGFyZSBwcm9wb3NpbmcgYWJvdmUgKOKAnEluIHRoZSBjYXNlIG9mIEJHUHNlYywgYSByb3V0ZXIg a2VlcHMgdGhlIG9yaWdpbmFsIGlmIGl0IHdhcyB2YWxpZCwgYW5kIGlnbm9yZXMgdGhlIGR1cGxp Y2F0ZS7igJ0pIGlzIGEgc2lnbmlmaWNhbnQgY2hhbmdlIHdpdGggcmVzcGVjdCB0byBCR1AgdGhh dCBpcyBub3QgZXhwbGljaXRseSBjYWxsZWQgb3V0LiZuYnNwOyBJIGhhdmVu4oCZdCBzZWVuIHRo aXMgYmVoYXZpb3INCiBtZW50aW9uZWQgYW55d2hlcmUgaW4gdGhlIGRyYWZ0IOKAkyBpdCBoYXMg b25seSBjb21lIHVwIG5vdy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+SU1ITywgbm90 IG9ubHkgc2hvdWxkIHRoZSBpbXBsaWNpdCB3aXRoZHJhdyBiZWhhdmlvciBub3QgY2hhbmdlLCBi dXQgYnkgaWdub3JpbmcgdGhlIHNlY29uZCB1cGRhdGUgeW914oCZcmUgaWdub3JpbmcgYSBwb3Rl bnRpYWxseSBpbXBvcnRhbnQgY2hhbmdlIGluIHRoZSB0b3BvbG9neS9zdHJ1Y3R1cmUgb2YgdGhl IG5ldHdvcmsuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPuKApjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBNMTAuJm5ic3A7IEluIFNlY3Rpb24gNy4y LiAoT24gdGhlIFJlbW92YWwgb2YgQkdQc2VjIFNpZ25hdHVyZXMpOiDigJzigKZ0aGUgcHJvdG9j b2wgc3BlY2lmaWVzIHRoYXQNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgYSBC R1BzZWMgc3BlYWtlciBjaG9vc2luZyB0byBwcm9wYWdhdGUgdGhlIHJvdXRlIGFkdmVydGlzZW1l bnQgaW4gc3VjaCBhbiB1cGRhdGUNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsg bWVzc2FnZSBTSE9VTEQgYWRkIGl0cyBzaWduYXR1cmUgdG8gZWFjaCBvZiB0aGUgU2lnbmF0dXJl X0Jsb2Nrcy7igJ0mbmJzcDsmbmJzcDsgSSBiZWxpZXZlIHRoZQ0KPC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jmd0OyByZWZlcmVuY2UgaXMgU2VjdGlvbiA0LjIgKHBsZWFzZSBhZGQgaXQp LiZuYnNwOyBIb3dldmVyLCB0aGF0IFNlY3Rpb24gZG9lc27igJl0IHVzZSBub3JtYXRpdmUNCjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgbGFuZ3VhZ2UgKOKAnEZvciBlYWNoIFNp Z25hdHVyZV9CbG9jayBjb3JyZXNwb25kaW5nIHRvIGFuIGFsZ29yaXRobSBzdWl0ZSB0aGF0IHRo ZSBCR1BzZWMNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgc3BlYWtlciBkb2Vz IHN1cHBvcnQsIHRoZSBCR1BzZWMgc3BlYWtlciBhZGRzIGEgbmV3IFNpZ25hdHVyZSBTZWdtZW50 IHRvIHRoZQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBTaWduYXR1cmVfQmxv Y2su4oCdKSZuYnNwOyZuYnNwOyBJbiBhbnkgY2FzZSwgdGhlIOKAnFNIT1VMROKAnSBpbiA3LjIg aXMgb3V0IG9mIHBsYWNlIGJlY2F1c2UgaXQgaXMNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZndDsgcmVmZXJlbmNpbmcgYSBmYWN0IChwb2ludGluZyBhdCB0aGUgb3RoZXIgc2VjdGlv bikgYW5kIG5vdCBiZWluZyB1c2VkIG5vcm1hdGl2ZWx5IOKAkyBpZiB5b3UNCjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPiZndDsgd2FudCB0aGUg4oCcU0hPVUxE4oCdIHRvIGJlIG5vcm1h dGl2ZSwgdGhlbiBpdCBzaG91bGQgYmUgYmFjayBpbiA0LjIuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij4mZ3Q7IFtTcmlyYW1dIFllcywgYWdyZWUuIEZpeGVkIHRoZSB3b3JkaW5n IHBlciB5b3VyIHN1Z2dlc3Rpb24gaW4gYm90aCBwbGFjZXMgKFNlY3Rpb25zIDQuMiBhbmQNCjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgNy4yKS4gQWRkZWQgcmVmZXJlbmNlIHRv IFNlY3Rpb24gNC4yIGluIFNlY3Rpb24gNy4yLiZuYnNwOyZuYnNwOyA8bzpwPg0KPC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij5Ob3cgNC4yIHJlYWRzOiDigJxGb3IgZWFjaCBTaWduYXR1cmVfQmxv Y2sgY29ycmVzcG9uZGluZyB0byBhbiBhbGdvcml0aG0gc3VpdGUgdGhhdCB0aGUgQkdQc2VjIHNw ZWFrZXIgZG9lcyBzdXBwb3J0LCB0aGUgQkdQc2VjIHNwZWFrZXIgU0hPVUxEIGFkZCBhIG5ldyBT aWduYXR1cmUgU2VnbWVudCB0byB0aGUgU2lnbmF0dXJlX0Jsb2Nr4oCdJm5ic3A7Jm5ic3A7IFNo b3VsZCB0aGF0IOKAnFNIT1VMROKAnSBiZSBhIOKAnE1VU1TigJ0/PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+4oCmPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IE0xMi4g VGhlIG1hbmRhdG9yeSBhZGRpdGlvbiBvZiBTZWN1cmVfUGF0aCBhbmQgU2lnbmF0dXJlIHNlZ21l bnRzIGluIGEgQ29uZmVkZXJhdGlvbg0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0 OyByZXN1bHRzIGluIHRoZSBpbmNvbnNpc3RlbnQgYXV0aG9yaXphdGlvbiBjaGFpbiBtZW50aW9u ZWQgaW4gU2VjdGlvbiA0LjMuIChQcm9jZXNzaW5nDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7IEluc3RydWN0aW9ucyBmb3IgQ29uZmVkZXJhdGlvbiBNZW1iZXJzKTog4oCcRm9y IGEgc2lnbmF0dXJlIHByb2R1Y2VkIGJ5IGEgcGVlciBCR1BzZWMNCjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZndDsgc3BlYWtlciBvdXRzaWRlIG9mIGEgY29uZmVkZXJhdGlvbiwgdGhl IFRhcmdldCBBUyB3aWxsIGFsd2F5cyBiZSB0aGUgQVMgQ29uZmVkZXJhdGlvbg0KPC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBJZGVudGlmaWVyICh0aGUgcHVibGljIEFTIG51bWJl ciBvZiB0aGUgY29uZmVkZXJhdGlvbikgYXMgb3Bwb3NlZCB0byB0aGUgTWVtYmVyLUFTDQo8L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IE51bWJlci7igJ0mbmJzcDsgSXQgc2VlbXMg dG8gbWUgdGhhdCB0aGlzIGRpc2NvbnRpbnVpdHkgaW4gdGhlIEFTTiBsaXN0IGJyZWFrcyB0aGUg 4oCcY3J5cHRvZ3JhcGhpYw0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBhc3N1 cmFuY2UgdGhhdOKApkV2ZXJ5IEFTIG9uIHRoZSBwYXRoIG9mIEFTZXMgbGlzdGVkIGluIHRoZSB1 cGRhdGUgbWVzc2FnZSBoYXMgZXhwbGljaXRseQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jmd0OyBhdXRob3JpemVkIHRoZSBhZHZlcnRpc2VtZW50IG9mIHRoZSByb3V0ZSB0byB0aGUg c3Vic2VxdWVudCBBUyBpbiB0aGUgcGF0aOKAnSBiZWNhdXNlIHRoZXJlDQo8L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGlzIG5vIHdheSB0byB2ZXJpZnkgdGhhdCB0aGUgTWVtYmVy LUFTIGluIHRoZSBmaXJzdCBTZWN1cmVfUGF0aCBzZWdtZW50IGlzIGluIGZhY3QgdGhlIG9uZQ0K PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBwZWVyaW5nIHdpdGggdGhlIGV4dGVy bmFsIG5laWdoYm9yLiZuYnNwOyBJIHJlYWxpemUgdGhhdCB0aGUgcmlzayBtYXkgYmUgbWluaW1p emVkIGJ5IGFuDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IOKAnGludGVybmFs IHRydXN04oCdIGZhY3RvciwgYnV0IEkgd291bGQgbGlrZSB0byBzZWUgYSBkaXNjdXNzaW9uIGFi b3V0IHRoaXMgaXNzdWUgaW4gdGhlIFNlY3VyaXR5DQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7IENvbnNpZGVyYXRpb25zLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jmd0OyBbU3JpcmFtXSBTZWUgdGhlIG5ldyBzZWNvbmQgcGFyYWdyYXBoIGluIFNlY3Rpb24g Ny40LiBUaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbiB0aGF0IHlvdQ0KPC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jmd0OyBtZW50aW9uIGhlcmUgYWJvdXQgd2l0aCB0aGUgd2F5IGNvbmZl ZGVyYXRpb25zIGFyZSBoYW5kbGVkIGlzIGRlc2NyaWJlZCBhbmQgZGlzY3Vzc2VkDQo8L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHRoZXJlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij5QZXJzb25hbGx5LCBJIHdvdWxkIGhhdmUgcHJlZmVycmVkIGlmIHlvdSBhY3R1YWxs eSBzb2x2ZWQgdGhlIHByb2JsZW0uJm5ic3A7DQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk9uZSBzb2x1 dGlvbiBpcyB0byBib3Jyb3cgZnJvbSBkcmFmdC1pZXRmLXNpZHItYXMtbWlncmF0aW9uIGFuZCBm b3J3YXJkIHNpZ24gZnJvbSB0aGUgQ29uZmVkZXJhdGlvbiBBUyAodGhlIHB1YmxpYyBudW1iZXIp IHRvIHRoZSBNZW1iZXItQVMgd2l0aCBwQ291bnQ9MC4mbmJzcDsgTm90ZSB0aGF0IHRoaXMgb3Bl cmF0aW9uIHdvdWxkIHRha2UgcGxhY2UgaW5zaWRlIHRoZSBib3JkZXIgQ29uZmVkZXJhdGlvbiBy b3V0ZXIsDQogc28gdGhlcmUgYXJlIG5vIGlzc3VlcyB3aXRoIHBDb3VudD0wIGFuZCB0aGUgZnVs bCBwYXRoIGNvbnRpbnVpdHkgaXMgcHJlc2VydmVkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij5bKl0gQ2hhaXJzOiBJIHRoaW5rIHRoYXQgdGhpcyBwYXJ0ICh3aGV0aGVyIGl0IGlzIHNv bHZlZCBvciBub3QpIHNob3VsZCBhbHNvIGJlIGJvdW5jZWQgYnkgdGhlIFdHLg0KPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+4oCmPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBtOC4gU2Vj dGlvbiA1LjEuIChPdmVydmlldyBvZiBCR1BzZWMgVmFsaWRhdGlvbik6IOKAnEl0IGlzIGV4cGVj dGVkIHRoYXQgQkdQIHBlZXJzIHdpbGwNCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZn dDsgZ2VuZXJhbGx5IHByZWZlciByb3V0ZXMgcmVjZWl2ZWQgdmlhICdWYWxpZCcgQkdQc2VjIHVw ZGF0ZSBtZXNzYWdlcyBvdmVyIGJvdGggcm91dGVzDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7IHJlY2VpdmVkIHZpYSAnTm90IFZhbGlkJyBCR1BzZWMgdXBkYXRlIG1lc3NhZ2Vz IGFuZCByb3V0ZXMgcmVjZWl2ZWQgdmlhIHVwZGF0ZSBtZXNzYWdlcw0KPC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGF0IGRvIG5vdCBjb250YWluIHRoZSBCR1BzZWNfUGF0aCBh dHRyaWJ1dGXigKYoU2VlIFtJLUQuaWV0Zi1zaWRyLWJncHNlYy1vcHNd4oCm4oCdJm5ic3A7IEkg cmVhZA0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGlzIHBpZWNlIG9mIHRl eHQgYXMgc2F5aW5nIHRoYXQgcm91dGVzIGluIE5vdCBWYWxpZCB1cGRhdGVzIGFyZSBleHBlY3Rl ZCB0byBiZSB1c2VkIChldmVuDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHRo b3VnaCB0aGV5IGFyZSBub3QgdmFsaWQpLiZuYnNwOyBCZXNpZGVzIHRoZSBmYWN0IHRoYXQgSS1E LmlldGYtc2lkci1iZ3BzZWMtb3BzIGRvZXMgcmVjb21tZW5kDQo8L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij4mZ3Q7IHVzaW5nIE5vdCBWYWxpZCBhbm5vdW5jZW1lbnRzIChpbiBTZWN0aW9u IDcpLCBhcmUgdGhlcmUgb3RoZXIgcmVhc29ucyBmb3IgdGhpcyBkb2N1bWVudCB0bw0KPC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBleHBlY3QgdGhlaXIgdXNlPzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBbU3JpcmFtXSBJZiBvbmx5IGEg4oCYTm90IFZh bGlk4oCZIHVwZGF0ZSBpcyBhdmFpbGFibGUgZm9yIGEgcHJlZml4LCB0aGVuIHRoZSB1cGRhdGUg aXMgdXNlZCBzaW5jZQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBvdGhlcndp c2UgdGhlIHByZWZpeCB3b3VsZCBiZSB1bnJlYWNoYWJsZS4gQm90aCBCR1BzZWMgYW5kIFJQS0kv b3JpZ2luIHZhbGlkYXRpb24gYXJlDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7 IGV4cGVjdGVkIHRvIGRlcHJlZiBpbnZhbGlkIHVwZGF0ZXMgcmF0aGVyIHRoYW4gaWdub3JlIHRo ZW0uIFRoaXMgaXMgZHJpdmVuIGJ5IG9wZXJhdG9yDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7IHBvbGljeSBhbmQgY2FuIHZhcnkuIEhlbmNlLCB3ZSBhcmUgZGVsaWJlcmF0ZWx5 IG5vdCB1c2luZyBhbnkgbm9ybWF0aXZlIGxhbmd1YWdlIGhlcmUuJm5ic3A7DQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+SG9uZXN0bHksIHVzaW5nIOKAnE5vdCBWYWxpZOKAnSB1cGRh dGVzIG1ha2VzIG5vIHNlbnNlIHRvIG1lLiZuYnNwOyBXZeKAmXJlIGJ1aWxkaW5nIGFsbCB0aGlz IG1hY2hpbmVyeSwgY2hhbmdpbmcgQkdQLCBldGMuLiBqdXN0IHRvIGVuZCB1cCB1c2luZyB1cGRh dGVzIHRoYXQgYXJlIG5vdCB2YWxpZCBhbnl3YXkuJm5ic3A7IFdoeSBhcmUgd2UgZG9pbmcgYWxs IHRoaXMgd29yayB0aGVuPyE/Jm5ic3A7DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 TVMgTWluY2hvJnF1b3Q7Ij7imLk8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PkkgdW5kZXJzdGFuZCB0aGF0LCBzcGVjaWFsbHkgYXQgdGhlIGJlZ2lubmluZywgcGVvcGxlIG1h eSB3YW50IHRvIHVzZSDigJxOb3QgVmFsaWTigJ0gdXBkYXRlc+KApmJ1dCB0aGF0IGlzIGFuIG9w ZXJhdGlvbmFsIGNvbnNpZGVyYXRpb24gKGFzIHlvdSBzYWlkIGFib3ZlKS4mbmJzcDsgUGxlYXNl IHRha2UgdGhlIHRleHQgb3V0IGZyb20gdGhpcyBkb2N1bWVudCB0aGF0IHJlY29tbWVuZHMgdXNp bmcg4oCcTm90IFZhbGlk4oCd4oCmYW5kDQogbGV0IEktRC5pZXRmLXNpZHItYmdwc2VjLW9wcyBk ZWFsIHdpdGggdGhhdCByZWNvbW1lbmRhdGlvbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+4oCmPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk5ldyBjb21tZW50OjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5OMS4gU2VjdGlvbiAyLjIuIChOZWdvdGlhdGluZyBCR1Bz ZWMgU3VwcG9ydCkgc2F5cyB0aGF0IGJlY2F1c2Ug4oCcQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcyBj YW4gYmUgcXVpdGUgbGFyZ2UsIHRoZXJlZm9yZSBhbnkgQkdQc2VjIHNwZWFrZXLigKZTSE9VTEQg YWxzbyBhbm5vdW5jZSBzdXBwb3J0IGZvciB0aGUgY2FwYWJpbGl0eSB0byByZWNlaXZlIEJHUCBl eHRlbmRlZCBtZXNzYWdlcyBbSS1ELmlldGYtaWRyLWJncC1leHRlbmRlZC1tZXNzYWdlc10u4oCd Jm5ic3A7Jm5ic3A7DQogV2hhdCBkb2VzIHRoaXMgbWVhbiB3aXRoIHJlc3BlY3QgdG8gdGhlIHNl c3Npb24gZXN0YWJsaXNobWVudCByZXF1aXJlbWVudHM/Jm5ic3A7IFRoaXMgY2FwYWJpbGl0eSBp cyBub3QgbWFuZGF0b3J5IChTSE9VTEQgaXMgdXNlZCBhbmQgbm90IE1VU1QpLCBidXQgYXMgQkdQ c2VjIGlzIGRlcGxveWVkIG1vcmUgYW5kIG1vcmUsIHRoZSBzeXN0ZW0gbWF5IG5vdCB3b3JrIGFu eW1vcmUgdW5sZXNzIGl0IGlzIGV4Y2hhbmdlZC4mbmJzcDsmbmJzcDsgV2h5IHdhc27igJl0IOKA nE1VU1TigJ0NCiB1c2VkPyZuYnNwOyBJ4oCZbSBndWVzc2luZyB0aGF0IHBhcnQgb2YgdGhlIHJl YXNvbiBtYXkgYmUgYXZhaWxhYmlsaXR5IG9mIHRoZSBmZWF0dXJl4oCmJm5ic3A7IEkgdGhpbmsg dGhhdCB0aGUgcG90ZW50aWFsIG9mIGhhdmluZyBhIHByb3Blcmx5IG5lZ290aWF0ZWQgQkdQc2Vj IHNlc3Npb24gc3RpbGwgbm90IHdvcmsgKGJlY2F1c2UgdGhlIG1lc3NhZ2VzIGFyZSB0b28gYmln KSBzaG91bGQgYXQgbGVhc3QgYmUgbWVudGlvbmVkIGluIHRoZSBuZXcgT3BlcmF0aW9ucw0KIGFu ZCBNYW5hZ2VtZW50IENvbnNpZGVyYXRpb25zIFNlY3Rpb24uPC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5O Mi4gVGhlIHJlZmVyZW5jZXMgdG8gUkZDNTIyNiBhbmQgUkZDNjQ4NyBzaG91bGQgYmUgTm9ybWF0 aXZlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_B364FC57DEE24A08B9EC5235CDCD0634ciscocom_-- From nobody Thu Dec 1 18:15:17 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25BB3129A5A; Thu, 1 Dec 2016 18:15:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id swBG9apYnnPa; Thu, 1 Dec 2016 18:15:11 -0800 (PST) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7477129A53; Thu, 1 Dec 2016 18:15:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=71302; q=dns/txt; s=iport; t=1480644910; x=1481854510; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=LLQta/l4s1pDHgLK4ApOMtV8gRV1hpiWYsHomk/z0HI=; b=ASvUhQwC7RXD0Uu0GIJvsFFEVVgXhsCZVxeZcOpeAx67cAoWNVKr/Kjp AkVR7wfgEFiJYRr1vfGq9lBkGlIodGBNlIQxpchu1sKYrwCKG7332oZnf BPzid8FBhlLitfF/kk4EsIhpcQ0gJRjrTI1y6+kEWmo+oW8LqZrL2wCpA A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AdAQBJ2EBY/5hdJa1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgnNFAQEBAQEfWIEGB40+lwuUeIIFhiICGoFzPxQBAgEBAQEBAQF?= =?us-ascii?q?iKIRpAQEDARoBCCQyBQsCAQYCOAEGAwICAjAUEQIEAQ0FG4VjgmcIjlGdRYIpL?= =?us-ascii?q?4MTh34BAQEBAQEBAQEBAQEBAQEBAQEBAQEchj6BfQiCVoRggm0tgjAFiFeHY4Q?= =?us-ascii?q?7hWkBkQ8CgXCEe4NBhgiHXYooAR43gRkjDgEBgykcgV1yhwgrgQOBDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.33,284,1477958400"; d="scan'208,217";a="354871386" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 Dec 2016 02:15:09 +0000 Received: from XCH-ALN-005.cisco.com (xch-aln-005.cisco.com [173.36.7.15]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id uB22F8mx000485 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 2 Dec 2016 02:15:09 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 1 Dec 2016 20:15:08 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Thu, 1 Dec 2016 20:15:08 -0600 From: "Alvaro Retana (aretana)" To: "Sriram, Kotikalapudi (Fed)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-protocol-18 Thread-Index: AQHSNR6CtOW/YAot7EOz/vffo+bn+6D0KlOA Date: Fri, 2 Dec 2016 02:15:08 +0000 Message-ID: <02396733-6521-4F5D-B9CD-77B0E544BF57@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_0239673365214F5DB9CD77B0E544BF57ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-protocol-18 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 02:15:15 -0000 --_000_0239673365214F5DB9CD77B0E544BF57ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SnVzdCBub3RpY2VkIG9uZSBtb3JlIHRoaW5nOiAgdGhlIHJlZmVyZW5jZSB0byBJLUQuaWV0Zi1z aWRyLXJ0ci1rZXlpbmcgaXMgbm8gbG9uZ2VyIG5lZWRlZC4NCg0KVGhhbmtzIQ0KDQpBbHZhcm8u DQoNCk9uIDEyLzEvMTYsIDk6MTAgUE0sICJBbHZhcm8gUmV0YW5hIChhcmV0YW5hKSIgPGFyZXRh bmFAY2lzY28uY29tPG1haWx0bzphcmV0YW5hQGNpc2NvLmNvbT4+IHdyb3RlOg0KDQoNCk9uIDEx LzI3LzE2LCAxMjoyMSBQTSwgIlNyaXJhbSwgS290aWthbGFwdWRpIChGZWQpIiA8a290aWthbGFw dWRpLnNyaXJhbUBuaXN0Lmdvdj4gd3JvdGU6DQoNCg0KDQpTcmlyYW06DQoNCg0KDQpIaSEgIFRo YW5rcyBmb3IgYWRkcmVzc2luZyBteSBjb21tZW50cy4gIEkgaGF2ZSBzb21lIHJlbWFpbmluZyBj b21tZW50cyBiZWxvdy4gIEkgZmxhZ2dlZCBhIGNvdXBsZSBvZiBpdGVtcyB0aGF0IEkgdGhpbmsg dGhlIENoYWlycyBzaG91bGQgY29uc3VsdCB0aGUgV0cgb24sIGJ1dCBJ4oCZbGwgbGVhdmUgaXQg dXAgdG8gdGhlbSB0byBkZWNpZGUgdGhhdCDigJMgbm90ZSB0aGF0IEkgZG9u4oCZdCB0aGluayB3 ZSBuZWVkIHRvIFdHTEMgdGhlIHdob2xlIGRvY3VtZW50IGFnYWluLCBqdXN0IGEgY291cGxlIG9m IGRlY2lzaW9ucy4NCg0KDQoNCkkgYWxzbyBhZGRlZCBhIGNvdXBsZSBvZiBuZXcgY29tbWVudHMg YXQgdGhlIGVuZC4NCg0KDQoNCkkgdGhpbmsgd2UgYXJlIGNsb3NlciwgYnV0IHRoZXJlIGFyZSBz dGlsbCBhIGNvdXBsZSBvZiBpdGVtcyB3aGVyZSB3ZeKAmXJlIG5vdCBhZ3JlZWluZzogIHRyZWF0 bWVudCBvZiBkdXBsaWNhdGVzIGFuZCBjb25mZWRlcmF0aW9ucy4gIFdlIGNhbiBjb250aW51ZSB0 aGUgZGlzY3Vzc2lvbiDigJMgSSB3b3VsZCBsb3ZlIHRvIGhlYXIgb3RoZXIgb3BpbmlvbnMgYXMg d2VsbCAoZnJvbSB0aGUgV0cpLg0KDQoNCg0KSW4gdGhlIG1lYW50aW1lLCBJIHdpbGwgc3RhcnQg dGhlIElFVEYgTGFzdCBDYWxsIGFuZCByZXF1ZXN0IGEgUlRHLURpciByZXZpZXcgYXMgd2VsbC4g IEFkZHJlc3Npbmcgd2hhdCB3ZSBzZWVtIHRvIGFncmVlIG9uIChJIHByb3Bvc2VkIHNvbWUgY2hh bmdlcyBiZWxvdyBmb3IgY2xhcml0eSkgaW4gdGhlIG5leHQgZmV3IGRheXMgd291bGQgZGVmaW5p dGVseSBoZWxwIHRoZSBwcm9jZXNzLg0KDQoNCg0KVGhhbmtzIQ0KDQoNCg0KQWx2YXJvLg0KDQoN Cg0KDQoNCuKApg0KDQo+IFtTcmlyYW1dIEZvbGxvd2luZyB0aGUgY2xhcmlmaWNhdGlvbnMgYW5k IGFkZGl0aW9uYWwgZ3VpZGFuY2UgeW91IHByb3ZpZGVkIGluIFNlb3VsICh3aGVuDQoNCj4geW91 LCBDaHJpcywgYW5kIEkgbWV0KSwgSSBoYXZlIGFkZGVkIGEgbmV3IFNlY3Rpb24gNyAoT3BlcmF0 aW9ucyBhbmQgTWFuYWdlbWVudA0KDQo+IENvbnNpZGVyYXRpb25zKS4gVGhlIHRvcGljcyB5b3Ug bWVudGlvbiBhYm92ZSBhcmUgYWxsIGNvdmVyZWQgaW4gdGhlIG5ldyBTZWN0aW9uIDcuDQoNCg0K DQpUaGFua3MgZm9yIGFkZGluZyB0aGlzIFNlY3Rpb24uICBJIHRoaW5rIHRoZSBlc3NlbmNlIG9m IHdoYXQgd2UgdGFsa2VkIGFib3V0IGlzIHRoZXJlLCBidXQgdGhlIHRleHQgbmVlZHMgc29tZSBl ZGl0aW5nLiAgSeKAmW0gcHV0dGluZyBzb21lIHN1Z2dlc3Rpb25zIGJlbG93IOKAkyBrZWVwIGlu IG1pbmQgdGhhdCB0aGlzIGRvY3VtZW50IGlzIGEgc3BlY2lmaWNhdGlvbiwgc28geW91IGNhbiBi ZSBwcmVzY3JpcHRpdmUgd2l0aCB3aGF0IHlvdSB3YW50IHRvIGhhcHBlbi4NCg0KDQoNCk9MRD4N Cg0KRGV0YWlsZWQgcmVjb21tZW5kYXRpb25zIGNvbmNlcm5pbmcgb3BlcmF0aW9ucyBhbmQgbWFu YWdlbWVudA0KDQogICBpc3N1ZXMgd2l0aCBCR1BzZWMgYXJlIHByb3ZpZGVkIGluIFtJLUQuaWV0 Zi1zaWRyLWJncHNlYy1vcHNdLg0KDQoNCg0KTkVXPg0KDQpUaGUgQmVzdCBDdXJyZW50IFByYWN0 aWNlIGNvbmNlcm5pbmcgb3BlcmF0aW9uYWwgZGVwbG95bWVudCBvZiBCR1BTZWMgaXMgcHJvdmlk ZWQgaW4NCg0KW0ktRC5pZXRmLXNpZHItYmdwc2VjLW9wc10uDQoNCg0KDQoNCg0KT0xEPg0KDQog ICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBCR1BzZWMgVmVyc2lvbiAwIG9ubHkuICBXaGF0IHNo b3VsZCB0aGUNCg0KICAgYWN0aW9uIGJlIGlmIHRoZSBWZXJzaW9uIGlzIG5vdCAwIGluIHRoZSBC R1BzZWMgY2FwYWJpbGl0eQ0KDQogICBhZHZlcnRpc2VtZW50IGZyb20gYSBwZWVyPyAgSWYgdGhl IGludGVyc2VjdGlvbiBvZiBCR1BzZWMgY2FwYWJpbGl0eQ0KDQogICBhZHZlcnRpc2VtZW50cyBm cm9tIGJvdGggc2lkZXMgZG9lcyBub3QgaW5jbHVkZSBWZXJzaW9uIDAsIHRoZW4NCg0KICAgQkdQ c2VjIFZlcnNpb24gMCBoYXMgbm90IGJlZW4gc3VjY2Vzc2Z1bGx5IG5lZ290aWF0ZWQuICBIb3dl dmVyLCBhDQoNCiAgIEJHUCBzZXNzaW9uIGlzIHN0aWxsIG5lZ290aWF0ZWQgYW5kIGhlbmNlIHRo ZSBhYmlsaXR5IHRvIGV4Y2hhbmdlDQoNCiAgIHJvdXRlcyBpcyBzdGlsbCB0aGVyZS4gIEJHUCAo dW5zaWduZWQpIG1lc3NhZ2VzIGFyZSBleGNoYW5nZWQuICBTbw0KDQogICB0aGUgY2hhaW4gb2Yg QVNOcyBpcyBub3QgYnJva2VuLCBpLmUuIHRoZXkgbWF5IG5vdCBiZSBjb250aWd1b3VzDQoNCiAg IEJHUHNlYyBwZWVycyBidXQgYXJlIHN0aWxsIGNvbnRpZ3VvdXMgQkdQIHBlZXJzLg0KDQoNCg0K ICAgTGV0IHVzIHNheSB0aGF0IEJHUHNlYyBjYXBhYmlsaXR5IHdhcyBuZWdvdGlhdGVkIHN1Y2Nl c3NmdWxseSBiZXR3ZWVuDQoNCiAgIHR3byBwZWVycywgYW5kIHN1YnNlcXVlbnRseSBpdCB3YXMg cmVzZXQuICBJbiB0aGUgbWVhbnRpbWUsIGFzc3VtZQ0KDQogICB0aGF0IHRoZSA0LWJ5dGUgQVNO IGNhcGFiaWxpdHkgb3IgdGhlIG11bHRpLXByb3RvY29sIGNhcGFiaWxpdHkgd2FzDQoNCiAgIGxv c3QgYmV0d2VlbiB0aGUgdHdvIHBlZXJzLiAgU28gbm93IHRoZSBCR1BzZWMgc2Vzc2lvbiByZXNl dCByZXN1bHRzDQoNCiAgIGluIGZhaWx1cmUgb2YgQkdQc2VjIGNhcGFiaWxpdHkgbmVnb3RpYXRp b24gYW5kIG9ubHkgYSBCR1Agc2Vzc2lvbiBpcw0KDQogICBlc3RhYmxpc2hlZC4gIFdvdWxkIHRo ZSBuZXR3b3JrIG9wZXJhdG9yIGJlIG5vdGlmaWVkIHRoYXQgdGhpcw0KDQogICBkb3duZ3JhZGUg ZnJvbSBCR1BzZWMgdG8gQkdQIGhhcyBoYXBwZW5lZD8gIFdoYXQgaWYgdGhlIG9wZXJhdG9yDQoN CiAgIGFsd2F5cyB3YW50cyBhIHNlY3VyZSBzZXNzaW9uIG9ubHk/ICBDYW4gdGhleSByZXF1aXJl IHRoYXQgbm8gQkdQDQoNCiAgIHNlc3Npb24gYmUgZXN0YWJsaXNoZWQgaWYgQkdQc2VjIGNhcGFi aWxpdHkgbmVnb3RpYXRpb24gZmFpbHM/DQoNCiAgIE9wZXJhdG9ycyBhcmUgYWR2aXNlZCB0byBz cGVhayB3aXRoIHRoZWlyIHZlbmRvcnMgdG8gc2V0IHVwIGtub2JzIGFuZA0KDQogICBhbGVydHMg dG8gaGF2ZSBzdWNoIG9wZXJhdGlvbnMgYW5kIG1hbmFnZW1lbnQgZmVhdHVyZXMgaW4gdGhlaXIN Cg0KICAgQkdQc2VjIGNhcGFibGUgcm91dGVycy4NCg0KDQoNCk5FVz4NCg0KICAgU2VjdGlvbiAy LjIgZGVzY3JpYmVzIHRoZSBuZWdvdGlhdGlvbiByZXF1aXJlZCB0byBlc3RhYmxpc2ggYSBCR1Bz ZWMtY2FwYWJsZQ0KDQogICBwZWVyaW5nIHNlc3Npb24uICBOb3Qgb25seSBtdXN0IHRoZSBCR1Bz ZWMgY2FwYWJpbGl0eSBiZSBleGNoYW5nZWQgKGFuZCBhZ3JlZWQNCg0KICAgb24pLCBidXQgdGhl IEJHUCBtdWx0aXByb3RvY29sIGV4dGVuc2lvbiBbUkZDNDc2MF0gZm9yIHRoZSBzYW1lIEFGSSBh bmQgdGhlDQoNCiAgIGZvdXItYnl0ZSBBUyBjYXBhYmlsaXR5IFtSRkM2NzkzXSBtdXN0IGFsc28g YmUgZXhjaGFuZ2VkLiAgRmFpbHVyZSB0byBwcm9wZXJseQ0KDQogICBuZWdvdGlhdGUgYSBCR1Bz ZWMgc2Vzc2lvbiwgZHVlIHRvIGEgbWlzc2luZyBjYXBhYmlsaXR5LCBmb3IgZXhhbXBsZSwgbWF5 IHN0aWxsDQoNCiAgIHJlc3VsdCBpbiB0aGUgZXhjaGFuZ2Ugb2YgQkdQICh1bnNpZ25lZCkgdXBk YXRlcy4gIFdoaWxlIHRoZSBCR1AgY2hhaW4gb2YgQVNOcw0KDQogICBpcyBub3QgYnJva2VuLCB0 aGUgc2VjdXJpdHkgY2FuIGJlIHJlZHVjZWQgYW5kIGEgY29udGlndW91cyBzZXQgb2YgQkdQc2Vj IHBlZXJzDQoNCiAgIG1heSBub3QgZXhpc3QgYW55bW9yZS4gIEl0IGlzIFJFQ09NTUVOREVEIHRo YW4gYW4gaW1wbGVtZW50YXRpb24gbG9nIHRoZQ0KDQogICBmYWlsdXJlIHRvIHByb3Blcmx5IG5l Z290aWF0ZSBhIEJHUHNlYyBzZXNzaW9uIGlmIHRoZSBsb2NhbCBCR1Agc3BlYWtlciBpcyBjb25m aWd1cmVkDQoNCiAgIGZvciBpdC4gIEFsc28sIGFuIGltcGxlbWVudGF0aW9uIE1VU1QgaGF2ZSBh YmlsaXR5IHRvIHByZXZlbnQgYSBCR1Agc2Vzc2lvbiBmcm9tDQoNCiAgIGJlaW5nIGVzdGFibGlz aGVkIGlmIGNvbmZpZ3VyZWQgZm9yIEJHUHNlYyB1c2UuDQoNCg0KDQoNCg0K4oCmDQoNCj4gTTEu MS4gU2VjdGlvbiAyLjEuIChUaGUgQkdQc2VjIENhcGFiaWxpdHkpIGluY2x1ZGVzIGEgVmVyc2lv biBmaWVsZCBhbmQgc29tZSBSZXNlcnZlZCBiaXRzLA0KDQo+IGJ1dCB0aGVyZSBhcmUgbm8gSUFO QSByZWdpc3RyaWVzIGRlZmluZWQgZm9yIGhvdyB0byBtYW5hZ2UgdGhlc2Ugc3BhY2VzLiAgUGxl YXNlIGRlZmluZQ0KDQo+IHRoZSByZWdpc3RyaWVzIGFuZCB0aGUgY29ycmVzcG9uZGluZyByZWdp c3RyYXRpb24gcHJvY2VkdXJlcy4NCg0KPg0KDQo+IFtTcmlyYW1dIERvbmUuIFBsZWFzZSBzZWUg dGhlIHVwZGF0ZWQgSUFOQSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLg0KDQoNCg0Kcy9SZXNlcnZl ZC9VbmFzc2lnbmVkDQoNCg0KDQpHaXZlbiB0aGF0IHRoZXJlIGFyZSBvbmx5IDMgdW5hc3NpZ25l ZCBiaXRzIGFuZCB0aGF0IGNoYW5naW5nIHZlcnNpb25zIHNob3VsZCBiZSBhIGJpZyBkZWFsLCBJ IHRoaW5rIHRoYXQg4oCcSUVURiBSZXZpZXfigJ0gaXMgbm90IGEgc3Ryb25nIGVub3VnaCByZWdp c3RyYXRpb24gcHJvY2VkdXJlLiAgU3VnZ2VzdGlvbjogdXNlIFN0YW5kYXJkcyBBY3Rpb24gaW5z dGVhZC4NCg0KDQoNClsqXSBDaGFpcnM6IHdlIGRvbuKAmXQgbmVlZCB0byBXR0xDIHRoZSB3aG9s ZSBkb2N1bWVudCwgYnV0IGl0IHdvdWxkIGJlIGEgZ29vZCBpZGVhIHRvIHJ1biB0aGUgcmVnaXN0 cmF0aW9uIHByb2NlZHVyZXMgYnkgdGhlIFdHIG9uY2Ugd2Ugc2V0dGxlIG9uIHRoZW0g4oCTIHRo aXMgY291bGQgZXZlbiBiZSBkb25lIGluIHBhcmFsbGVsIHdpdGggdGhlIElFVEYgTGFzdCBDYWxs Lg0KDQoNCg0KDQoNCj4gTTEuMi4gU2VjdGlvbiAzLjEuIChTZWN1cmVfUGF0aCkgZGVmaW5lcyB0 aGUgRmxhZ3MgZmllbGQgYW5kIGFzc2lnbnMgdGhlIGZpcnN0IGJpdCAoQlRXLCBpcw0KDQo+IHRo YXQgdGhlIE1TQiBvciB0aGUgTFNCLCBwbGVhc2UgY2xhcmlmeSksIGJ1dCBkb2Vzbid0IHNldCB1 cCB0aGUgcmVnaXN0cnkgb3IgcmVnaXN0cmF0aW9uDQoNCj4gcHJvY2VkdXJlcy4NCg0KPg0KDQo+ IFtTcmlyYW1dIEl0IGlzIHRoZSBNU0IgKGxlZnQgbW9zdCBiaXQpIGFuZCB0aGF0IGlzIG5vdyBj bGFyaWZpZWQgaW4gU2VjdGlvbiAzLjEuIFNldCB1cCBvZiB0aGUNCg0KPiByZWdpc3RyeSBmb3Ig dGhlIEZsYWdzIGZpZWxkIGlzIG5vdyBpbmNsdWRlZCBpbiB0aGUgdXBkYXRlZCBJQU5BIENvbnNp ZGVyYXRpb25zIHNlY3Rpb24uDQoNCg0KDQpTYW1lIGNvbW1lbnQgYXMgYWJvdmUgYWJvdXQg4oCc SUVURiBSZXZpZXfigJ0gdnMg4oCcU3RhbmRhcmRzIEFjdGlvbuKAnS4NCg0KDQoNCuKApg0KDQo+ IE0yLjIuIFRoZSBkZWZpbml0aW9uIG9mIHRoZSBCR1BzZWNfUGF0aCBBdHRyaWJ1dGUgKGFuZCBp dHMgZGV0YWlscykgZG9uJ3QgaGF2ZSBjbGVhciBlcnJvcg0KDQo+IGhhbmRsaW5nIHByb2NlZHVy ZXMgZGVmaW5lZCAoUkZDNzYwNikuICBTZWN0aW9uIDQuMy4gKFByb2Nlc3NpbmcgSW5zdHJ1Y3Rp b25zIGZvcg0KDQo+IENvbmZlZGVyYXRpb24gTWVtYmVycykgZG9lcyBzYXkgdGhpczogIihBcyBk aXNjdXNzZWQgaW4gU2VjdGlvbiA1LjIsIGFueSBlcnJvciBpbiB0aGUNCg0KPiBCR1BzZWNfUGF0 aCBhdHRyaWJ1dGUgTVVTVCBiZSBoYW5kbGVkIHVzaW5nIHRoZSAidHJlYXQtYXMtd2l0aGRyYXci LCBhcHByb2FjaCBhcw0KDQo+IGRlZmluZWQgaW4gUkZDIDc2MDYgW1JGQzc2MDZdLikiIChpbmNs dWRpbmcgdGhlIHBhcmVudGhlc2VzKS4gIEhvd2V2ZXIsIDUsMiBvbmx5IHNheXM6DQoNCj4gIkJH UHNlYyBzcGVha2VycyBNVVNUIGhhbmRsZSB0aGVzZSBlcnJvcnMgdXNpbmcgdGhlICJ0cmVhdC1h cy13aXRoZHJhdyIgYXBwcm9hY2ggYXMNCg0KPiBkZWZpbmVkIGluIFJGQyA3NjA2IFtSRkM3NjA2 XS4iICAgTm90ZTogInRoZXNlIGVycm9ycyIgaXMgbm90IHRoZSBzYW1lIGFzICJhbnkNCg0KPiBl cnJvciIuICBQbGVhc2UgZGlzY3VzcyBlcnJvciBoYW5kbGluZyBpbiBhIG1vcmUgcHJvbWluZW50 IHBsYWNlLiAoSGludDogaXQgbWF5IGZpdCBpbiBhIGZhdWx0DQoNCj4gbWFuYWdlbWVudCBkaXNj dXNzaW9uIGluIHRoZSBPcGVyYXRpb25zIGFuZCBNYW5hZ2VtZW50IFNlY3Rpb24uKQ0KDQo+DQoN Cj4gW1NyaXJhbV0gIHMgL0FzIGRpc2N1c3NlZCBpbiBTZWN0aW9uIDUuMiwgYW55IGVycm9yIGlu IHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgTVVTVCBiZQ0KDQo+IGhhbmRsZWQgdXNpbmcgdGhl ICJ0cmVhdC1hcy13aXRoZHJhdyIsIGFwcHJvYWNoIGFzIGRlZmluZWQgaW4gUkZDIDc2MDYgW1JG Qzc2MDZdLi8gQXMNCg0KPiBkaXNjdXNzZWQgaW4gU2VjdGlvbiA1LjIsIGFueSBzeW50YWN0aWNh bCBvciBwcm90b2NvbCB2aW9sYXRpb24gZXJyb3JzIGluIHRoZSBCR1BzZWNfUGF0aA0KDQo+IGF0 dHJpYnV0ZSBNVVNUIGJlIGhhbmRsZWQgdXNpbmcgdGhlICJ0cmVhdC1hcy13aXRoZHJhdyIgYXBw cm9hY2ggYXMgZGVmaW5lZCBpbiBSRkMgNzYwNg0KDQo+IFtSRkM3NjA2XS4vDQoNCj4NCg0KPiBb U3JpcmFtXSAgU2VjdGlvbiA0LjMgaGFzIGJlZW4gdXBkYXRlZCBhY2NvcmRpbmdseS4NCg0KDQoN Cg0KDQpJIGRpZG7igJl0IGV4cGxhaW4gbXlzZWxmIGNvcnJlY3RseS4gIFNlY3Rpb24gNC4zLiAo UHJvY2Vzc2luZyBJbnN0cnVjdGlvbnMgZm9yIENvbmZlZGVyYXRpb24gTWVtYmVycykgY292ZXJz IG9ubHkgdGhlIHByb2Nlc3NpbmcgZm9yIGNvbmZlZGVyYXRpb25zLCBzbyBwdXR0aW5nIHRleHQg aW4gdGhlcmUgYWJvdXQgYW55IGVycm9ycyBpcyBnb29kLCBidXQgZG9lc27igJl0IGNvdmVyIHRo ZSBnZW5lcmFsIGNhc2UgKGZvciBwcm9jZXNzaW5nIGFueSB1cGRhdGUpLg0KDQoNCg0KT1RPSCwg U2VjdGlvbiA1LjIuIChWYWxpZGF0aW9uIEFsZ29yaXRobSkgZG9lc27igJl0IGFjdHVhbGx5IHRh bGsgYWJvdXQg4oCcYW55IGVycm9y4oCdIChhcyByZWZlcmVuY2VkIG5vdyBmcm9tIDQuMykg4oCT IGl0IG9ubHkgdGFsa3MgYWJvdXQg4oCcdGhlc2UgZXJyb3Jz4oCdLCB3aGljaCBjb3JyZXNwb25k IHRvIHRoZSBsaXN0IG9mIGNoZWNrcyBpbiB0aGUgc2VjdGlvbi4gIElPVywgdGhlcmUgaXMgbm8g Z2xvYmFsIHNwZWNpZmljYXRpb24gdGhhdCBhbnkgZXJyb3IgbXVzdCByZXN1bHQgaW4gdHJlYXQt YXMtd2l0aGRyYXcuDQoNCg0KDQpTb2x1dGlvbjogIHRha2UgdGhlIHRleHQgb3V0IG9mIDQuMyBh bmQgdXBkYXRlIHRoZSB0ZXh0IGluIDUuMjsgc3VnZ2VzdGlvbjoNCg0KDQoNCk9MRD4NCg0KICAg SWYgYW55IG9mIHRoZXNlIGNoZWNrcyBmYWlsLCBpdCBpcyBhbiBlcnJvciBpbiB0aGUgQkdQc2Vj X1BhdGgNCg0KICAgYXR0cmlidXRlLiAgQW55IG9mIHRoZXNlIGVycm9ycyBpbiB0aGUgQkdQc2Vj X1BhdGggYXR0cmlidXRlIGFyZQ0KDQogICBoYW5kbGVkIGFzIHBlciBSRkMgNzYwNiBbUkZDNzYw Nl0uICBCR1BzZWMgc3BlYWtlcnMgTVVTVCBoYW5kbGUgdGhlc2UNCg0KICAgZXJyb3JzIHVzaW5n IHRoZSAidHJlYXQtYXMtd2l0aGRyYXciIGFwcHJvYWNoIGFzIGRlZmluZWQgaW4gUkZDIDc2MDYN Cg0KICAgW1JGQzc2MDZdLg0KDQoNCg0KTkVXPg0KDQogICBJZiBhbnkgb2YgdGhlc2UgY2hlY2tz IGZhaWwsIGl0IGlzIGFuIGVycm9yIGluIHRoZSBCR1BzZWNfUGF0aA0KDQogICBhdHRyaWJ1dGUu ICBCR1BzZWMgc3BlYWtlcnMgTVVTVCBoYW5kbGUgYW55IHN5bnRhY3RpY2FsIG9yIHByb3RvY29s IGVycm9ycw0KDQogICBpbiB0aGUgQkdQc2VjX1BhdGggYXR0cmlidXRlIHVzaW5nIHRoZSAidHJl YXQtYXMtd2l0aGRyYXciIGFwcHJvYWNoIGFzIGRlZmluZWQNCg0KICAgaW4gUkZDIDc2MDYgW1JG Qzc2MDZdLg0KDQoNCg0KDQoNCg0KDQrigKYNCg0KPiBNNy4xLiDigJxXaXRoIHJlZ2FyZHMgdG8g dGhlIHByb2Nlc3Npbmcgb2YgZHVwbGljYXRlIHVwZGF0ZSBtZXNzYWdlcywgaWYgdGhlIGZpcnN0 IHVwZGF0ZQ0KDQo+IG1lc3NhZ2UgaXMgdmFsaWQsIHRoZW4gYW4gaW1wbGVtZW50YXRpb24gU0hP VUxEIE5PVCBydW4gdGhlIHZhbGlkYXRpb24gcHJvY2VkdXJlIG9uIHRoZQ0KDQo+IHNlY29uZCwg ZHVwbGljYXRlIHVwZGF0ZSBtZXNzYWdlIChldmVuIGlmIHRoZSBiaXRzIG9mIHRoZSBzaWduYXR1 cmUgZmllbGQgYXJlDQoNCj4gZGlmZmVyZW50KS7igJ0gIEV2ZW4gdGhvdWdoIGEgZGlzY3Vzc2lv biBhYm91dCBub24tZGV0ZXJtaW5pc3RpYyBzaWduYXR1cmUgYWxnb3JpdGhtcw0KDQo+IHByZWNl ZGVzIHRoaXMgdGV4dCwgdGhlIHZhbGlkYXRpb24gaXMgc3RpbGwgbm90IHJ1bi4gIEhvdyBjYW4g dGhlIHZhbGlkaXR5IG9mIHRoZSBQYXRoIGJlDQoNCj4gZ3VhcmFudGVlZCBpbiB0aGlzIGNhc2U/ ICBTaG91bGQgdGhpcyBiZSB0aGUgYWN0aW9uIGZvciBhbGwgYWxnb3JpdGhtcyBvciBvbmx5IG9u ZXMga25vd24gdG8NCg0KPiBiZSBub24tZGV0ZXJtaW5pc3RpYz8NCg0KPg0KDQo+IFtTcmlyYW1d IERlZmluaXRpb24gb2YgZHVwbGljYXRlIHVwZGF0ZSBmb3IgQkdQc2VjOiBBIEJHUHNlYyB1cGRh dGUgaXMgYSBkdXBsaWNhdGUgaWYgaXQgaXMNCg0KPiBpZGVudGljYWwgdG8gYW5vdGhlciB1cGRh dGUgaW4gdGhlIEFkai1SSUItaW4sIGluY2x1ZGluZyBTS0lzIGFuZCBBbGdvcml0aG0gSUQsIGJ1 dCBub3QNCg0KPiBpbmNsdWRpbmcgdGhlIHNpZ25hdHVyZXMuIElmIHRoZSBmaXJzdCB1cGRhdGUg bWVzc2FnZSAoaGF2aW5nIHRoZSAqc2FtZSBTS0lzKiBhcyB0aGUNCg0KPiBkdXBsaWNhdGUpIGlz ICpWYWxpZCosIHRoZW4gdGhlIGR1cGxpY2F0ZeKAmXMgdmFsaWRpdHkgc3RhdGUgbmVlZCBub3Qg YmUgY29tcHV0ZWQuICBJZiB2YWxpZGl0eSBvZg0KDQo+IHRoZSBkdXBsaWNhdGUgd2VyZSBjb21w dXRlZCBhbmQgZm91bmQgJ1ZhbGlkJywgdGhlbiBpdCBnaXZlcyB0aGUgcm91dGVyIG5vIG5ldw0K DQo+IGluZm9ybWF0aW9uLiBBbHRlcm5hdGl2ZWx5LCBpZiBpdCB3ZXJlIGZvdW5kICdOb3QgVmFs aWQnLCB0aGVuIGl0IG9ubHkgaW1wbGllcyB0aGF0IHNvbWUgYml0DQoNCj4gZXJyb3JzIG9jY3Vy cmVkIGluIHRoZSBzaWduYXR1cmVzLiBUaGVyZWZvcmUsIHRoZSBCR1BzZWMgc3BlYWtlciBzaG91 bGQga2VlcCB0aGUgJ1ZhbGlkJw0KDQo+IG9yaWdpbmFsIHVwZGF0ZSBhbmQgaWdub3JlIHRoZSBk dXBsaWNhdGUuIEhvd2V2ZXIsIGlmIHRoZSBvcmlnaW5hbCB1cGRhdGUgd2VyZSAnTm90IFZhbGlk JywNCg0KPiB0aGVuIHBlcmZvcm1pbmcgdmFsaWRhdGlvbiBvZiB0aGUgZHVwbGljYXRlIGlzIHJl bGV2YW50IGFuZCBTSE9VTEQgYmUgZG9uZS4NCg0KPg0KDQo+IFtTcmlyYW1dIEFkZGVkIGEgcGFy YWdyYXBoIGluIHRoZSBuZXcgU2VjdGlvbiA3IChPcGVyYXRpb25zIGFuZCBNYW5hZ2VtZW50DQoN Cj4gQ29uc2lkZXJhdGlvbnMpIHRvIGluY2x1ZGUgdGhlIGFib3ZlIG9ic2VydmF0aW9ucy4NCg0K DQoNCkkgc2F3IHRoZSB0ZXh0LCBhbmQgaGF2ZSAzIHF1ZXN0aW9ucy9jb21tZW50czoNCg0KDQoN CjEuIOKAnOKApml0IG9ubHkgaW1wbGllcyB0aGF0IHNvbWUgYml0IGVycm9ycyBvY2N1cnJlZCBp biB0aGUgc2lnbmF0dXJlcy7igJ0gICBXaGF0IGRvZXMgdGhhdCBtZWFuPyAgQXJlIHlvdSBpbXBs eWluZyB0aGF0IHRoZSBzZW5kZXIgZ290IHRoZSBzaWduYXR1cmUgd3Jvbmc/ICBPciBtYXliZSB0 aGF0IHRoZXJlIHdhcyBzb21lIGNvcnJ1cHRpb24gaW4tdHJhbnNpdD8gIEJvdGggY2FzZXMgYXJl ICpiYWQqLCBidXQgdGhlIGNhc2Ugd2hlcmUgdGhlIHNlbmRlciBjb3VsZCBnZXQgdGhlIHNpZ25h dHVyZSB3cm9uZyBpcyBzcGVjaWFsbHkgc28gYmVjYXVzZSBpZiBpdCB3YXNu4oCZdCBhIGR1cGxp Y2F0ZSB1cGRhdGUsIHRoZW4gaXQgd291bGQgcmVzdWx0IOKAnE5vdCBWYWxpZOKAnSBhbmQgdGhl cmUgc2VlbXMgdG8gYmUgbm8gd2F5IHRvIGRldGVybWluZSBpZiBpbiBmYWN0IHRoZSB2YWxpZGl0 eSBmYWlsZWQgb3IgaWYgaXQgaXMgdGhlIGNhc2Ugb2Ygc29tZSBiaXQgZXJyb3JzLiDimLkNCg0K DQoNCjIuIOKAnFRoZXJlZm9yZSwgdGhlIEJHUHNlYyBzcGVha2VyIHNob3VsZCBrZWVwIHRoZSAn VmFsaWQnIG9yaWdpbmFsIHVwZGF0ZSBhbmQgaWdub3JlIHRoZSBkdXBsaWNhdGUu4oCdIE5vISAg VGhpcyBpcyBub3QgaG93IEJHUCB3b3Jrc+KApnNlZSBiZWxvdy4NCg0KDQoNCjMuIOKAnOKApmlm IHRoZSBvcmlnaW5hbCB1cGRhdGUgd2VyZSAnTm90IFZhbGlkJywgdGhlbiBwZXJmb3JtaW5nIHZh bGlkYXRpb24gb2YgdGhlIGR1cGxpY2F0ZSBpcyByZWxldmFudCBhbmQgU0hPVUxEIGJlIGRvbmUu 4oCdICBXaHkgaXMgdGhpcyBub3QgYSDigJxNVVNU4oCdPyAgSU9XLCBpZiB0aGUgb3JpZ2luYWwg dXBkYXRlIHdhcyDigJxOb3QgVmFsaWTigJ0gd2hlbiB3b3VsZCBpdCBiZSBvayB0byBub3QgcGVy Zm9ybSB2YWxpZGF0aW9uIG9uIGEgbmV3IHVwZGF0ZT8NCg0KDQoNCg0KDQo+IFtTcmlyYW1dIE5v dGUgdGhhdCB0aGUgYWJvdmUgYXBwbGllcyB0byBib3RoIG5vbi1kZXRlcm1pbmlzdGljIGFuZCBk ZXRlcm1pbmlzdGljIHNpZ25hdHVyZQ0KDQo+IGFsZ29yaXRobXMuDQoNCj4NCg0KPiBNNy4yLiBy ZmM0MjcxIChpbiBTZWN0aW9uIDkuIChVUERBVEUgTWVzc2FnZSBIYW5kbGluZykgdGFsa3MgYWJv dXQgdGhlIGltcGxpY2l0IHdpdGhkcmF3DQoNCj4gb2YgYSByb3V0ZSDigJxpZiB0aGUgTkxSSSBv ZiB0aGUgbmV3IHJvdXRlIGlzIGlkZW50aWNhbCB0byB0aGUgb25lIHRoZSByb3V0ZXIgY3VycmVu dGx5IGhhcw0KDQo+IHN0b3JlZOKApuKAnS4gIFRoZSBzYW1lIE5MUkkgY2FzZSBzZWVtcyB0byBi ZSBhIHBhcnRpY3VsYXIgY29uZGl0aW9uIG9mIHRoZSDigJxkdXBsaWNhdGUNCg0KPiB1cGRhdGXi gJ0gZGVzY3JpYmVkIGhlcmUuICBJdCBtaWdodCBiZSBhIGdvb2QgaWRlYSB0byBtZW50aW9uIHRo YXQgYSDigJxkdXBsaWNhdGUgdXBkYXRl4oCdDQoNCj4gcmVzdWx0cyBpbiB0aGUgaW1wbGljaXQg d2l0aGRyYXcgb2YgdGhlIG9yaWdpbmFsIHVwZGF0ZS4gIFdoYXQgaGFwcGVucyBpZiBhIHRoaXJk IGR1cGxpY2F0ZQ0KDQo+IHJvdXRlIGlzIHJlY2VpdmVkICh0aGUgZmlyc3Qgb25lIHdhcyB2YWxp ZCwgdGhlIHNlY29uZCBvbmUgd2FzIG5vdCB2YWxpZGF0ZWQpLCBzaG91bGQgaXQgYmUNCg0KPiB2 YWxpZGF0ZWQ/DQoNCj4NCg0KPiBbU3JpcmFtXSBJbiBSRkMgNDI3MSwgd2hlbiB0aGVyZSBpcyBh IGR1cGxpY2F0ZSB1cGRhdGUsIHRoZSBOUkxJIGFuZCBwYXRoIGFuZCBhbGwgb3RoZXINCg0KPiBh dHRyaWJ1dGVzIGFyZSBpZGVudGljYWwuIFRoZXJlIGlzIG5vIGltcGxpY2l0IHdpdGhkcmF3LiBU aGUgcm91dGVyIGtlZXBzIHdoYXQgaXQgYWxyZWFkeQ0KDQo+IGhhcy4gSW4gdGhlIGNhc2Ugb2Yg QkdQc2VjLCBhIHJvdXRlciBrZWVwcyB0aGUgb3JpZ2luYWwgaWYgaXQgd2FzIHZhbGlkLCBhbmQg aWdub3JlcyB0aGUNCg0KPiBkdXBsaWNhdGUuIEl0IGNoZWNrcyB0aGUgdmFsaWRpdHkgb2YgdGhl IGR1cGxpY2F0ZSBvbmx5IGlmIHRoZSBvcmlnaW5hbCB3ZXJlIGludmFsaWQuDQoNCg0KDQpJbiBw bGFpbiBCR1AsIGlmIGEgZHVwbGljYXRlIHVwZGF0ZSAoYXMgZGVmaW5lZCBhYm92ZSB3aGVyZSBl dmVyeXRoaW5nIGlzIGlkZW50aWNhbCkgaXMgcmVjZWl2ZWQsIHRoZW4gdGhlIG9yaWdpbmFsIG9u ZSBpcyByZXBsYWNlZCBieSB0aGUgbmV3IG9uZSDigJMgaW4gdGhpcyBzcGVjaWZpYyBjYXNlICh3 aGVyZSBldmVyeXRoaW5nIGlzIGlkZW50aWNhbCksIGl0IG1heSBsb29rIGxpa2UgdGhlIHJvdXRl ciBrZWVwcyB3aGF0IGl0IGFscmVhZHkgaGFz4oCmYnV0IHRoZSBnZW5lcmFsIHJ1bGUgaXMgdG8g cmVwbGFjZSB0aGUgb2xkIHVwZGF0ZSB3aXRoIGEgbmV3IG9uZSBmb3IgdGhlIHNhbWUgcHJlZml4 Lg0KDQoNCg0KV2hhdCB5b3UgYXJlIHByb3Bvc2luZyBhYm92ZSAo4oCcSW4gdGhlIGNhc2Ugb2Yg QkdQc2VjLCBhIHJvdXRlciBrZWVwcyB0aGUgb3JpZ2luYWwgaWYgaXQgd2FzIHZhbGlkLCBhbmQg aWdub3JlcyB0aGUgZHVwbGljYXRlLuKAnSkgaXMgYSBzaWduaWZpY2FudCBjaGFuZ2Ugd2l0aCBy ZXNwZWN0IHRvIEJHUCB0aGF0IGlzIG5vdCBleHBsaWNpdGx5IGNhbGxlZCBvdXQuICBJIGhhdmVu 4oCZdCBzZWVuIHRoaXMgYmVoYXZpb3IgbWVudGlvbmVkIGFueXdoZXJlIGluIHRoZSBkcmFmdCDi gJMgaXQgaGFzIG9ubHkgY29tZSB1cCBub3cuDQoNCg0KDQpJTUhPLCBub3Qgb25seSBzaG91bGQg dGhlIGltcGxpY2l0IHdpdGhkcmF3IGJlaGF2aW9yIG5vdCBjaGFuZ2UsIGJ1dCBieSBpZ25vcmlu ZyB0aGUgc2Vjb25kIHVwZGF0ZSB5b3XigJlyZSBpZ25vcmluZyBhIHBvdGVudGlhbGx5IGltcG9y dGFudCBjaGFuZ2UgaW4gdGhlIHRvcG9sb2d5L3N0cnVjdHVyZSBvZiB0aGUgbmV0d29yay4NCg0K DQoNCuKApg0KDQo+IE0xMC4gIEluIFNlY3Rpb24gNy4yLiAoT24gdGhlIFJlbW92YWwgb2YgQkdQ c2VjIFNpZ25hdHVyZXMpOiDigJzigKZ0aGUgcHJvdG9jb2wgc3BlY2lmaWVzIHRoYXQNCg0KPiBh IEJHUHNlYyBzcGVha2VyIGNob29zaW5nIHRvIHByb3BhZ2F0ZSB0aGUgcm91dGUgYWR2ZXJ0aXNl bWVudCBpbiBzdWNoIGFuIHVwZGF0ZQ0KDQo+IG1lc3NhZ2UgU0hPVUxEIGFkZCBpdHMgc2lnbmF0 dXJlIHRvIGVhY2ggb2YgdGhlIFNpZ25hdHVyZV9CbG9ja3Mu4oCdICAgSSBiZWxpZXZlIHRoZQ0K DQo+IHJlZmVyZW5jZSBpcyBTZWN0aW9uIDQuMiAocGxlYXNlIGFkZCBpdCkuICBIb3dldmVyLCB0 aGF0IFNlY3Rpb24gZG9lc27igJl0IHVzZSBub3JtYXRpdmUNCg0KPiBsYW5ndWFnZSAo4oCcRm9y IGVhY2ggU2lnbmF0dXJlX0Jsb2NrIGNvcnJlc3BvbmRpbmcgdG8gYW4gYWxnb3JpdGhtIHN1aXRl IHRoYXQgdGhlIEJHUHNlYw0KDQo+IHNwZWFrZXIgZG9lcyBzdXBwb3J0LCB0aGUgQkdQc2VjIHNw ZWFrZXIgYWRkcyBhIG5ldyBTaWduYXR1cmUgU2VnbWVudCB0byB0aGUNCg0KPiBTaWduYXR1cmVf QmxvY2su4oCdKSAgIEluIGFueSBjYXNlLCB0aGUg4oCcU0hPVUxE4oCdIGluIDcuMiBpcyBvdXQg b2YgcGxhY2UgYmVjYXVzZSBpdCBpcw0KDQo+IHJlZmVyZW5jaW5nIGEgZmFjdCAocG9pbnRpbmcg YXQgdGhlIG90aGVyIHNlY3Rpb24pIGFuZCBub3QgYmVpbmcgdXNlZCBub3JtYXRpdmVseSDigJMg aWYgeW91DQoNCj4gd2FudCB0aGUg4oCcU0hPVUxE4oCdIHRvIGJlIG5vcm1hdGl2ZSwgdGhlbiBp dCBzaG91bGQgYmUgYmFjayBpbiA0LjIuDQoNCj4NCg0KPiBbU3JpcmFtXSBZZXMsIGFncmVlLiBG aXhlZCB0aGUgd29yZGluZyBwZXIgeW91ciBzdWdnZXN0aW9uIGluIGJvdGggcGxhY2VzIChTZWN0 aW9ucyA0LjIgYW5kDQoNCj4gNy4yKS4gQWRkZWQgcmVmZXJlbmNlIHRvIFNlY3Rpb24gNC4yIGlu IFNlY3Rpb24gNy4yLg0KDQoNCg0KTm93IDQuMiByZWFkczog4oCcRm9yIGVhY2ggU2lnbmF0dXJl X0Jsb2NrIGNvcnJlc3BvbmRpbmcgdG8gYW4gYWxnb3JpdGhtIHN1aXRlIHRoYXQgdGhlIEJHUHNl YyBzcGVha2VyIGRvZXMgc3VwcG9ydCwgdGhlIEJHUHNlYyBzcGVha2VyIFNIT1VMRCBhZGQgYSBu ZXcgU2lnbmF0dXJlIFNlZ21lbnQgdG8gdGhlIFNpZ25hdHVyZV9CbG9ja+KAnSAgIFNob3VsZCB0 aGF0IOKAnFNIT1VMROKAnSBiZSBhIOKAnE1VU1TigJ0/DQoNCg0KDQoNCg0K4oCmDQoNCj4gTTEy LiBUaGUgbWFuZGF0b3J5IGFkZGl0aW9uIG9mIFNlY3VyZV9QYXRoIGFuZCBTaWduYXR1cmUgc2Vn bWVudHMgaW4gYSBDb25mZWRlcmF0aW9uDQoNCj4gcmVzdWx0cyBpbiB0aGUgaW5jb25zaXN0ZW50 IGF1dGhvcml6YXRpb24gY2hhaW4gbWVudGlvbmVkIGluIFNlY3Rpb24gNC4zLiAoUHJvY2Vzc2lu Zw0KDQo+IEluc3RydWN0aW9ucyBmb3IgQ29uZmVkZXJhdGlvbiBNZW1iZXJzKTog4oCcRm9yIGEg c2lnbmF0dXJlIHByb2R1Y2VkIGJ5IGEgcGVlciBCR1BzZWMNCg0KPiBzcGVha2VyIG91dHNpZGUg b2YgYSBjb25mZWRlcmF0aW9uLCB0aGUgVGFyZ2V0IEFTIHdpbGwgYWx3YXlzIGJlIHRoZSBBUyBD b25mZWRlcmF0aW9uDQoNCj4gSWRlbnRpZmllciAodGhlIHB1YmxpYyBBUyBudW1iZXIgb2YgdGhl IGNvbmZlZGVyYXRpb24pIGFzIG9wcG9zZWQgdG8gdGhlIE1lbWJlci1BUw0KDQo+IE51bWJlci7i gJ0gIEl0IHNlZW1zIHRvIG1lIHRoYXQgdGhpcyBkaXNjb250aW51aXR5IGluIHRoZSBBU04gbGlz dCBicmVha3MgdGhlIOKAnGNyeXB0b2dyYXBoaWMNCg0KPiBhc3N1cmFuY2UgdGhhdOKApkV2ZXJ5 IEFTIG9uIHRoZSBwYXRoIG9mIEFTZXMgbGlzdGVkIGluIHRoZSB1cGRhdGUgbWVzc2FnZSBoYXMg ZXhwbGljaXRseQ0KDQo+IGF1dGhvcml6ZWQgdGhlIGFkdmVydGlzZW1lbnQgb2YgdGhlIHJvdXRl IHRvIHRoZSBzdWJzZXF1ZW50IEFTIGluIHRoZSBwYXRo4oCdIGJlY2F1c2UgdGhlcmUNCg0KPiBp cyBubyB3YXkgdG8gdmVyaWZ5IHRoYXQgdGhlIE1lbWJlci1BUyBpbiB0aGUgZmlyc3QgU2VjdXJl X1BhdGggc2VnbWVudCBpcyBpbiBmYWN0IHRoZSBvbmUNCg0KPiBwZWVyaW5nIHdpdGggdGhlIGV4 dGVybmFsIG5laWdoYm9yLiAgSSByZWFsaXplIHRoYXQgdGhlIHJpc2sgbWF5IGJlIG1pbmltaXpl ZCBieSBhbg0KDQo+IOKAnGludGVybmFsIHRydXN04oCdIGZhY3RvciwgYnV0IEkgd291bGQgbGlr ZSB0byBzZWUgYSBkaXNjdXNzaW9uIGFib3V0IHRoaXMgaXNzdWUgaW4gdGhlIFNlY3VyaXR5DQoN Cj4gQ29uc2lkZXJhdGlvbnMuDQoNCj4NCg0KPiBbU3JpcmFtXSBTZWUgdGhlIG5ldyBzZWNvbmQg cGFyYWdyYXBoIGluIFNlY3Rpb24gNy40LiBUaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbiB0aGF0 IHlvdQ0KDQo+IG1lbnRpb24gaGVyZSBhYm91dCB3aXRoIHRoZSB3YXkgY29uZmVkZXJhdGlvbnMg YXJlIGhhbmRsZWQgaXMgZGVzY3JpYmVkIGFuZCBkaXNjdXNzZWQNCg0KPiB0aGVyZS4NCg0KDQoN ClBlcnNvbmFsbHksIEkgd291bGQgaGF2ZSBwcmVmZXJyZWQgaWYgeW91IGFjdHVhbGx5IHNvbHZl ZCB0aGUgcHJvYmxlbS4NCg0KDQoNCk9uZSBzb2x1dGlvbiBpcyB0byBib3Jyb3cgZnJvbSBkcmFm dC1pZXRmLXNpZHItYXMtbWlncmF0aW9uIGFuZCBmb3J3YXJkIHNpZ24gZnJvbSB0aGUgQ29uZmVk ZXJhdGlvbiBBUyAodGhlIHB1YmxpYyBudW1iZXIpIHRvIHRoZSBNZW1iZXItQVMgd2l0aCBwQ291 bnQ9MC4gIE5vdGUgdGhhdCB0aGlzIG9wZXJhdGlvbiB3b3VsZCB0YWtlIHBsYWNlIGluc2lkZSB0 aGUgYm9yZGVyIENvbmZlZGVyYXRpb24gcm91dGVyLCBzbyB0aGVyZSBhcmUgbm8gaXNzdWVzIHdp dGggcENvdW50PTAgYW5kIHRoZSBmdWxsIHBhdGggY29udGludWl0eSBpcyBwcmVzZXJ2ZWQuDQoN Cg0KDQpbKl0gQ2hhaXJzOiBJIHRoaW5rIHRoYXQgdGhpcyBwYXJ0ICh3aGV0aGVyIGl0IGlzIHNv bHZlZCBvciBub3QpIHNob3VsZCBhbHNvIGJlIGJvdW5jZWQgYnkgdGhlIFdHLg0KDQoNCg0KDQoN CuKApg0KDQo+IG04LiBTZWN0aW9uIDUuMS4gKE92ZXJ2aWV3IG9mIEJHUHNlYyBWYWxpZGF0aW9u KTog4oCcSXQgaXMgZXhwZWN0ZWQgdGhhdCBCR1AgcGVlcnMgd2lsbA0KDQo+IGdlbmVyYWxseSBw cmVmZXIgcm91dGVzIHJlY2VpdmVkIHZpYSAnVmFsaWQnIEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMg b3ZlciBib3RoIHJvdXRlcw0KDQo+IHJlY2VpdmVkIHZpYSAnTm90IFZhbGlkJyBCR1BzZWMgdXBk YXRlIG1lc3NhZ2VzIGFuZCByb3V0ZXMgcmVjZWl2ZWQgdmlhIHVwZGF0ZSBtZXNzYWdlcw0KDQo+ IHRoYXQgZG8gbm90IGNvbnRhaW4gdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZeKApihTZWUgW0kt RC5pZXRmLXNpZHItYmdwc2VjLW9wc13igKbigJ0gIEkgcmVhZA0KDQo+IHRoaXMgcGllY2Ugb2Yg dGV4dCBhcyBzYXlpbmcgdGhhdCByb3V0ZXMgaW4gTm90IFZhbGlkIHVwZGF0ZXMgYXJlIGV4cGVj dGVkIHRvIGJlIHVzZWQgKGV2ZW4NCg0KPiB0aG91Z2ggdGhleSBhcmUgbm90IHZhbGlkKS4gIEJl c2lkZXMgdGhlIGZhY3QgdGhhdCBJLUQuaWV0Zi1zaWRyLWJncHNlYy1vcHMgZG9lcyByZWNvbW1l bmQNCg0KPiB1c2luZyBOb3QgVmFsaWQgYW5ub3VuY2VtZW50cyAoaW4gU2VjdGlvbiA3KSwgYXJl IHRoZXJlIG90aGVyIHJlYXNvbnMgZm9yIHRoaXMgZG9jdW1lbnQgdG8NCg0KPiBleHBlY3QgdGhl aXIgdXNlPw0KDQo+DQoNCj4gW1NyaXJhbV0gSWYgb25seSBhIOKAmE5vdCBWYWxpZOKAmSB1cGRh dGUgaXMgYXZhaWxhYmxlIGZvciBhIHByZWZpeCwgdGhlbiB0aGUgdXBkYXRlIGlzIHVzZWQgc2lu Y2UNCg0KPiBvdGhlcndpc2UgdGhlIHByZWZpeCB3b3VsZCBiZSB1bnJlYWNoYWJsZS4gQm90aCBC R1BzZWMgYW5kIFJQS0kvb3JpZ2luIHZhbGlkYXRpb24gYXJlDQoNCj4gZXhwZWN0ZWQgdG8gZGVw cmVmIGludmFsaWQgdXBkYXRlcyByYXRoZXIgdGhhbiBpZ25vcmUgdGhlbS4gVGhpcyBpcyBkcml2 ZW4gYnkgb3BlcmF0b3INCg0KPiBwb2xpY3kgYW5kIGNhbiB2YXJ5LiBIZW5jZSwgd2UgYXJlIGRl bGliZXJhdGVseSBub3QgdXNpbmcgYW55IG5vcm1hdGl2ZSBsYW5ndWFnZSBoZXJlLg0KDQoNCg0K SG9uZXN0bHksIHVzaW5nIOKAnE5vdCBWYWxpZOKAnSB1cGRhdGVzIG1ha2VzIG5vIHNlbnNlIHRv IG1lLiAgV2XigJlyZSBidWlsZGluZyBhbGwgdGhpcyBtYWNoaW5lcnksIGNoYW5naW5nIEJHUCwg ZXRjLi4ganVzdCB0byBlbmQgdXAgdXNpbmcgdXBkYXRlcyB0aGF0IGFyZSBub3QgdmFsaWQgYW55 d2F5LiAgV2h5IGFyZSB3ZSBkb2luZyBhbGwgdGhpcyB3b3JrIHRoZW4/IT8gIOKYuQ0KDQoNCg0K SSB1bmRlcnN0YW5kIHRoYXQsIHNwZWNpYWxseSBhdCB0aGUgYmVnaW5uaW5nLCBwZW9wbGUgbWF5 IHdhbnQgdG8gdXNlIOKAnE5vdCBWYWxpZOKAnSB1cGRhdGVz4oCmYnV0IHRoYXQgaXMgYW4gb3Bl cmF0aW9uYWwgY29uc2lkZXJhdGlvbiAoYXMgeW91IHNhaWQgYWJvdmUpLiAgUGxlYXNlIHRha2Ug dGhlIHRleHQgb3V0IGZyb20gdGhpcyBkb2N1bWVudCB0aGF0IHJlY29tbWVuZHMgdXNpbmcg4oCc Tm90IFZhbGlk4oCd4oCmYW5kIGxldCBJLUQuaWV0Zi1zaWRyLWJncHNlYy1vcHMgZGVhbCB3aXRo IHRoYXQgcmVjb21tZW5kYXRpb24uDQoNCg0KDQrigKYNCg0KDQoNCk5ldyBjb21tZW50Og0KDQoN Cg0KTjEuIFNlY3Rpb24gMi4yLiAoTmVnb3RpYXRpbmcgQkdQc2VjIFN1cHBvcnQpIHNheXMgdGhh dCBiZWNhdXNlIOKAnEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMgY2FuIGJlIHF1aXRlIGxhcmdlLCB0 aGVyZWZvcmUgYW55IEJHUHNlYyBzcGVha2Vy4oCmU0hPVUxEIGFsc28gYW5ub3VuY2Ugc3VwcG9y dCBmb3IgdGhlIGNhcGFiaWxpdHkgdG8gcmVjZWl2ZSBCR1AgZXh0ZW5kZWQgbWVzc2FnZXMgW0kt RC5pZXRmLWlkci1iZ3AtZXh0ZW5kZWQtbWVzc2FnZXNdLuKAnSAgIFdoYXQgZG9lcyB0aGlzIG1l YW4gd2l0aCByZXNwZWN0IHRvIHRoZSBzZXNzaW9uIGVzdGFibGlzaG1lbnQgcmVxdWlyZW1lbnRz PyAgVGhpcyBjYXBhYmlsaXR5IGlzIG5vdCBtYW5kYXRvcnkgKFNIT1VMRCBpcyB1c2VkIGFuZCBu b3QgTVVTVCksIGJ1dCBhcyBCR1BzZWMgaXMgZGVwbG95ZWQgbW9yZSBhbmQgbW9yZSwgdGhlIHN5 c3RlbSBtYXkgbm90IHdvcmsgYW55bW9yZSB1bmxlc3MgaXQgaXMgZXhjaGFuZ2VkLiAgIFdoeSB3 YXNu4oCZdCDigJxNVVNU4oCdIHVzZWQ/ICBJ4oCZbSBndWVzc2luZyB0aGF0IHBhcnQgb2YgdGhl IHJlYXNvbiBtYXkgYmUgYXZhaWxhYmlsaXR5IG9mIHRoZSBmZWF0dXJl4oCmICBJIHRoaW5rIHRo YXQgdGhlIHBvdGVudGlhbCBvZiBoYXZpbmcgYSBwcm9wZXJseSBuZWdvdGlhdGVkIEJHUHNlYyBz ZXNzaW9uIHN0aWxsIG5vdCB3b3JrIChiZWNhdXNlIHRoZSBtZXNzYWdlcyBhcmUgdG9vIGJpZykg c2hvdWxkIGF0IGxlYXN0IGJlIG1lbnRpb25lZCBpbiB0aGUgbmV3IE9wZXJhdGlvbnMgYW5kIE1h bmFnZW1lbnQgQ29uc2lkZXJhdGlvbnMgU2VjdGlvbi4NCg0KDQoNCk4yLiBUaGUgcmVmZXJlbmNl cyB0byBSRkM1MjI2IGFuZCBSRkM2NDg3IHNob3VsZCBiZSBOb3JtYXRpdmUuDQoNCg0K --_000_0239673365214F5DB9CD77B0E544BF57ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAg MCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsN CglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1p bHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Ik1TIE1pbmNobyI7DQoJcGFub3NlLTE6MiAy IDYgOSA0IDIgNSA4IDMgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0 ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0K CWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvUGxhaW5U ZXh0LCBsaS5Nc29QbGFpblRleHQsIGRpdi5Nc29QbGFpblRleHQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFpbiBUZXh0IENoYXIiOw0KCW1hcmdpbjowaW47 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6Q2FsaWJyaTt9DQpwDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltYXJnaW46MGluOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iO30NCnNwYW4uYXBwbGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUt bmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uUGxhaW5UZXh0Q2hhcg0KCXttc28tc3R5bGUt bmFtZToiUGxhaW4gVGV4dCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0 eWxlLWxpbms6IlBsYWluIFRleHQiOw0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5FbWFp bFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6Q2FsaWJy aTsNCgljb2xvcjp3aW5kb3d0ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxl Om5vcm1hbDt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1y ZXBseTsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3RleHQ7DQoJZm9udC13 ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCnNwYW4ubXNvSW5zDQoJe21zby1z dHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1zdHlsZS1uYW1lOiIiOw0KCXRleHQtZGVjb3Jh dGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxl Pg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVTIiBsaW5rPSJibHVl IiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj5KdXN0IG5vdGljZWQgb25lIG1vcmUgdGhpbmc6Jm5ic3A7IHRoZSByZWZlcmVuY2UgdG8g SS1ELmlldGYtc2lkci1ydHIta2V5aW5nIGlzIG5vIGxvbmdlciBuZWVkZWQuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaSI+VGhhbmtzITxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkFsdmFyby48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgI0I1QzRERiA0LjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0O21hcmdpbi1sZWZ0OjMu NzVwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNvbnNv bGFzO2NvbG9yOmJsYWNrIj5PbiAxMi8xLzE2LCA5OjEwIFBNLCAmcXVvdDtBbHZhcm8gUmV0YW5h IChhcmV0YW5hKSZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFyZXRhbmFAY2lzY28uY29tIj5h cmV0YW5hQGNpc2NvLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+T24gMTEvMjcv MTYsIDEyOjIxIFBNLCAmcXVvdDtTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSZxdW90OyAmbHQ7 a290aWthbGFwdWRpLnNyaXJhbUBuaXN0LmdvdiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPlNyaXJhbTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+SGkhJm5i c3A7IFRoYW5rcyBmb3IgYWRkcmVzc2luZyBteSBjb21tZW50cy4mbmJzcDsgSSBoYXZlIHNvbWUg cmVtYWluaW5nIGNvbW1lbnRzIGJlbG93LiZuYnNwOyBJIGZsYWdnZWQgYSBjb3VwbGUgb2YgaXRl bXMgdGhhdCBJIHRoaW5rIHRoZSBDaGFpcnMgc2hvdWxkIGNvbnN1bHQgdGhlIFdHIG9uLCBidXQg SeKAmWxsIGxlYXZlIGl0IHVwIHRvIHRoZW0gdG8gZGVjaWRlIHRoYXQg4oCTIG5vdGUgdGhhdCBJ IGRvbuKAmXQgdGhpbmsgd2UgbmVlZA0KIHRvIFdHTEMgdGhlIHdob2xlIGRvY3VtZW50IGFnYWlu LCBqdXN0IGEgY291cGxlIG9mIGRlY2lzaW9ucy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+SSBhbHNvIGFkZGVkIGEgY291cGxlIG9mIG5ldyBjb21tZW50cyBhdCB0aGUgZW5kLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5JIHRoaW5rIHdlIGFyZSBjbG9zZXIsIGJ1dCB0aGVy ZSBhcmUgc3RpbGwgYSBjb3VwbGUgb2YgaXRlbXMgd2hlcmUgd2XigJlyZSBub3QgYWdyZWVpbmc6 Jm5ic3A7IHRyZWF0bWVudCBvZiBkdXBsaWNhdGVzIGFuZCBjb25mZWRlcmF0aW9ucy4mbmJzcDsg V2UgY2FuIGNvbnRpbnVlIHRoZSBkaXNjdXNzaW9uIOKAkyBJIHdvdWxkIGxvdmUgdG8gaGVhciBv dGhlciBvcGluaW9ucyBhcyB3ZWxsIChmcm9tIHRoZSBXRykuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPkluIHRoZSBtZWFudGltZSwgSSB3aWxsIHN0YXJ0IHRoZSBJRVRGIExhc3QgQ2Fs bCBhbmQgcmVxdWVzdCBhIFJURy1EaXIgcmV2aWV3IGFzIHdlbGwuJm5ic3A7IEFkZHJlc3Npbmcg d2hhdCB3ZSBzZWVtIHRvIGFncmVlIG9uIChJIHByb3Bvc2VkIHNvbWUgY2hhbmdlcyBiZWxvdyBm b3IgY2xhcml0eSkgaW4gdGhlIG5leHQgZmV3IGRheXMgd291bGQgZGVmaW5pdGVseSBoZWxwIHRo ZSBwcm9jZXNzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5UaGFua3MhPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPkFsdmFyby48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij7igKY8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0gRm9sbG93 aW5nIHRoZSBjbGFyaWZpY2F0aW9ucyBhbmQgYWRkaXRpb25hbCBndWlkYW5jZSB5b3UgcHJvdmlk ZWQgaW4gU2VvdWwgKHdoZW4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jmd0OyB5b3UsIENocmlzLCBhbmQgSSBtZXQpLCBJIGhhdmUgYWRkZWQgYSBuZXcgU2VjdGlv biA3IChPcGVyYXRpb25zIGFuZCBNYW5hZ2VtZW50DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPiZndDsgQ29uc2lkZXJhdGlvbnMpLiBUaGUgdG9waWNzIHlvdSBtZW50 aW9uIGFib3ZlIGFyZSBhbGwgY292ZXJlZCBpbiB0aGUgbmV3IFNlY3Rpb24gNy48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+VGhhbmtzIGZvciBhZGRpbmcgdGhpcyBTZWN0aW9uLiZuYnNw OyBJIHRoaW5rIHRoZSBlc3NlbmNlIG9mIHdoYXQgd2UgdGFsa2VkIGFib3V0IGlzIHRoZXJlLCBi dXQgdGhlIHRleHQgbmVlZHMgc29tZSBlZGl0aW5nLiZuYnNwOyBJ4oCZbSBwdXR0aW5nIHNvbWUg c3VnZ2VzdGlvbnMgYmVsb3cg4oCTIGtlZXAgaW4gbWluZCB0aGF0IHRoaXMgZG9jdW1lbnQgaXMg YSBzcGVjaWZpY2F0aW9uLCBzbyB5b3UgY2FuIGJlIHByZXNjcmlwdGl2ZQ0KIHdpdGggd2hhdCB5 b3Ugd2FudCB0byBoYXBwZW4uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk9MRCZndDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPkRldGFpbGVkIHJlY29tbWVu ZGF0aW9ucyBjb25jZXJuaW5nIG9wZXJhdGlvbnMgYW5kIG1hbmFnZW1lbnQ8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyBpc3N1ZXMgd2l0aCBCR1Bz ZWMgYXJlIHByb3ZpZGVkIGluIFtJLUQuaWV0Zi1zaWRyLWJncHNlYy1vcHNdLjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij5ORVcmZ3Q7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij5UaGUgQmVzdCBDdXJyZW50IFByYWN0aWNlIGNvbmNlcm5pbmcgb3BlcmF0aW9u YWwgZGVwbG95bWVudCBvZiBCR1BTZWMgaXMgcHJvdmlkZWQgaW48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPltJLUQuaWV0Zi1zaWRyLWJncHNlYy1vcHNdLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPk9MRCZndDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZuYnNwOyZuYnNwOyBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBCR1BzZWMgVmVyc2lvbiAw IG9ubHkuJm5ic3A7IFdoYXQgc2hvdWxkIHRoZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IGFjdGlvbiBiZSBpZiB0aGUgVmVyc2lvbiBpcyBub3Qg MCBpbiB0aGUgQkdQc2VjIGNhcGFiaWxpdHk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPiZuYnNwOyZuYnNwOyBhZHZlcnRpc2VtZW50IGZyb20gYSBwZWVyPyZuYnNwOyBJ ZiB0aGUgaW50ZXJzZWN0aW9uIG9mIEJHUHNlYyBjYXBhYmlsaXR5PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgYWR2ZXJ0aXNlbWVudHMgZnJvbSBi b3RoIHNpZGVzIGRvZXMgbm90IGluY2x1ZGUgVmVyc2lvbiAwLCB0aGVuPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgQkdQc2VjIFZlcnNpb24gMCBo YXMgbm90IGJlZW4gc3VjY2Vzc2Z1bGx5IG5lZ290aWF0ZWQuJm5ic3A7IEhvd2V2ZXIsIGE8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyBCR1Agc2Vz c2lvbiBpcyBzdGlsbCBuZWdvdGlhdGVkIGFuZCBoZW5jZSB0aGUgYWJpbGl0eSB0byBleGNoYW5n ZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IHJv dXRlcyBpcyBzdGlsbCB0aGVyZS4mbmJzcDsgQkdQICh1bnNpZ25lZCkgbWVzc2FnZXMgYXJlIGV4 Y2hhbmdlZC4mbmJzcDsgU288bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZuYnNwOyZuYnNwOyB0aGUgY2hhaW4gb2YgQVNOcyBpcyBub3QgYnJva2VuLCBpLmUuIHRoZXkg bWF5IG5vdCBiZSBjb250aWd1b3VzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mbmJzcDsmbmJzcDsgQkdQc2VjIHBlZXJzIGJ1dCBhcmUgc3RpbGwgY29udGlndW91cyBC R1AgcGVlcnMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyBMZXQg dXMgc2F5IHRoYXQgQkdQc2VjIGNhcGFiaWxpdHkgd2FzIG5lZ290aWF0ZWQgc3VjY2Vzc2Z1bGx5 IGJldHdlZW48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZu YnNwOyB0d28gcGVlcnMsIGFuZCBzdWJzZXF1ZW50bHkgaXQgd2FzIHJlc2V0LiZuYnNwOyBJbiB0 aGUgbWVhbnRpbWUsIGFzc3VtZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jm5ic3A7Jm5ic3A7IHRoYXQgdGhlIDQtYnl0ZSBBU04gY2FwYWJpbGl0eSBvciB0aGUgbXVs dGktcHJvdG9jb2wgY2FwYWJpbGl0eSB3YXM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPiZuYnNwOyZuYnNwOyBsb3N0IGJldHdlZW4gdGhlIHR3byBwZWVycy4mbmJzcDsg U28gbm93IHRoZSBCR1BzZWMgc2Vzc2lvbiByZXNldCByZXN1bHRzPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgaW4gZmFpbHVyZSBvZiBCR1BzZWMg Y2FwYWJpbGl0eSBuZWdvdGlhdGlvbiBhbmQgb25seSBhIEJHUCBzZXNzaW9uIGlzPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgZXN0YWJsaXNoZWQu Jm5ic3A7IFdvdWxkIHRoZSBuZXR3b3JrIG9wZXJhdG9yIGJlIG5vdGlmaWVkIHRoYXQgdGhpczxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IGRvd25n cmFkZSBmcm9tIEJHUHNlYyB0byBCR1AgaGFzIGhhcHBlbmVkPyZuYnNwOyBXaGF0IGlmIHRoZSBv cGVyYXRvcjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5i c3A7IGFsd2F5cyB3YW50cyBhIHNlY3VyZSBzZXNzaW9uIG9ubHk/Jm5ic3A7IENhbiB0aGV5IHJl cXVpcmUgdGhhdCBubyBCR1A8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZuYnNwOyZuYnNwOyBzZXNzaW9uIGJlIGVzdGFibGlzaGVkIGlmIEJHUHNlYyBjYXBhYmlsaXR5 IG5lZ290aWF0aW9uIGZhaWxzPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jm5ic3A7Jm5ic3A7IE9wZXJhdG9ycyBhcmUgYWR2aXNlZCB0byBzcGVhayB3aXRoIHRoZWly IHZlbmRvcnMgdG8gc2V0IHVwIGtub2JzIGFuZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IGFsZXJ0cyB0byBoYXZlIHN1Y2ggb3BlcmF0aW9ucyBh bmQgbWFuYWdlbWVudCBmZWF0dXJlcyBpbiB0aGVpcjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IEJHUHNlYyBjYXBhYmxlIHJvdXRlcnMuPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk5FVyZndDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyBTZWN0aW9uIDIuMiBkZXNjcmliZXMgdGhlIG5l Z290aWF0aW9uIHJlcXVpcmVkIHRvIGVzdGFibGlzaCBhIEJHUHNlYy1jYXBhYmxlDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyZuYnNwO3BlZXJp bmcgc2Vzc2lvbi4mbmJzcDsgTm90IG9ubHkgbXVzdCB0aGUgQkdQc2VjIGNhcGFiaWxpdHkgYmUg ZXhjaGFuZ2VkIChhbmQgYWdyZWVkDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPiZuYnNwOyZuYnNwOyZuYnNwO29uKSwgYnV0IHRoZSBCR1AgbXVsdGlwcm90b2NvbCBl eHRlbnNpb24gW1JGQzQ3NjBdIGZvciB0aGUgc2FtZSBBRkkgYW5kIHRoZQ0KPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsmbmJzcDtmb3VyLWJ5dGUg QVMgY2FwYWJpbGl0eSBbUkZDNjc5M10gbXVzdCBhbHNvIGJlIGV4Y2hhbmdlZC4mbmJzcDsgRmFp bHVyZSB0byBwcm9wZXJseQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij4mbmJzcDsmbmJzcDsmbmJzcDtuZWdvdGlhdGUgYSBCR1BzZWMgc2Vzc2lvbiwgZHVlIHRvIGEg bWlzc2luZyBjYXBhYmlsaXR5LCBmb3IgZXhhbXBsZSwgbWF5IHN0aWxsDQo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyZuYnNwO3Jlc3VsdCBpbiB0 aGUgZXhjaGFuZ2Ugb2YgQkdQICh1bnNpZ25lZCkgdXBkYXRlcy4mbmJzcDsgV2hpbGUgdGhlIEJH UCBjaGFpbiBvZiBBU05zDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZuYnNwOyZuYnNwOyZuYnNwO2lzIG5vdCBicm9rZW4sIHRoZSBzZWN1cml0eSBjYW4gYmUgcmVk dWNlZCBhbmQgYSBjb250aWd1b3VzIHNldCBvZiBCR1BzZWMgcGVlcnMNCjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7bWF5IG5vdCBleGlz dCBhbnltb3JlLiZuYnNwOyBJdCBpcyBSRUNPTU1FTkRFRCB0aGFuIGFuIGltcGxlbWVudGF0aW9u IGxvZyB0aGUNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7ZmFpbHVyZSB0byBwcm9wZXJseSBuZWdvdGlhdGUgYSBCR1BzZWMgc2Vzc2lv biBpZiB0aGUgbG9jYWwgQkdQIHNwZWFrZXIgaXMgY29uZmlndXJlZA0KPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsmbmJzcDtmb3IgaXQuJm5ic3A7 IEFsc28sIGFuIGltcGxlbWVudGF0aW9uIE1VU1QgaGF2ZSBhYmlsaXR5IHRvIHByZXZlbnQgYSBC R1Agc2Vzc2lvbiBmcm9tDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZuYnNwOyZuYnNwOyZuYnNwO2JlaW5nIGVzdGFibGlzaGVkIGlmIGNvbmZpZ3VyZWQgZm9yIEJH UHNlYyB1c2UuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+4oCmPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IE0xLjEuIFNlY3Rpb24gMi4xLiAoVGhlIEJHUHNlYyBDYXBh YmlsaXR5KSBpbmNsdWRlcyBhIFZlcnNpb24gZmllbGQgYW5kIHNvbWUgUmVzZXJ2ZWQgYml0cywN CjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBidXQgdGhlcmUg YXJlIG5vIElBTkEgcmVnaXN0cmllcyBkZWZpbmVkIGZvciBob3cgdG8gbWFuYWdlIHRoZXNlIHNw YWNlcy4mbmJzcDsgUGxlYXNlIGRlZmluZQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij4mZ3Q7IHRoZSByZWdpc3RyaWVzIGFuZCB0aGUgY29ycmVzcG9uZGluZyByZWdp c3RyYXRpb24gcHJvY2VkdXJlcy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZn dDsgW1NyaXJhbV0gRG9uZS4gUGxlYXNlIHNlZSB0aGUgdXBkYXRlZCBJQU5BIENvbnNpZGVyYXRp b25zIHNlY3Rpb24uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnMvUmVzZXJ2ZWQvVW5h c3NpZ25lZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5HaXZlbiB0aGF0IHRoZXJlIGFy ZSBvbmx5IDMgdW5hc3NpZ25lZCBiaXRzIGFuZCB0aGF0IGNoYW5naW5nIHZlcnNpb25zIHNob3Vs ZCBiZSBhIGJpZyBkZWFsLCBJIHRoaW5rIHRoYXQg4oCcSUVURiBSZXZpZXfigJ0gaXMgbm90IGEg c3Ryb25nIGVub3VnaCByZWdpc3RyYXRpb24gcHJvY2VkdXJlLiZuYnNwOyBTdWdnZXN0aW9uOiB1 c2UgU3RhbmRhcmRzIEFjdGlvbiBpbnN0ZWFkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij5bKl0gQ2hhaXJzOiB3ZSBkb27igJl0IG5lZWQgdG8gV0dMQyB0aGUgd2hvbGUgZG9jdW1lbnQs IGJ1dCBpdCB3b3VsZCBiZSBhIGdvb2QgaWRlYSB0byBydW4gdGhlIHJlZ2lzdHJhdGlvbiBwcm9j ZWR1cmVzIGJ5IHRoZSBXRyBvbmNlIHdlIHNldHRsZSBvbiB0aGVtIOKAkyB0aGlzIGNvdWxkIGV2 ZW4gYmUgZG9uZSBpbiBwYXJhbGxlbCB3aXRoIHRoZSBJRVRGIExhc3QgQ2FsbC48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij4mZ3Q7IE0xLjIuIFNlY3Rpb24gMy4xLiAoU2VjdXJlX1BhdGgpIGRlZmluZXMg dGhlIEZsYWdzIGZpZWxkIGFuZCBhc3NpZ25zIHRoZSBmaXJzdCBiaXQgKEJUVywgaXMNCjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGF0IHRoZSBNU0Igb3Ig dGhlIExTQiwgcGxlYXNlIGNsYXJpZnkpLCBidXQgZG9lc24ndCBzZXQgdXAgdGhlIHJlZ2lzdHJ5 IG9yIHJlZ2lzdHJhdGlvbg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij4mZ3Q7IHByb2NlZHVyZXMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7 IFtTcmlyYW1dIEl0IGlzIHRoZSBNU0IgKGxlZnQgbW9zdCBiaXQpIGFuZCB0aGF0IGlzIG5vdyBj bGFyaWZpZWQgaW4gU2VjdGlvbiAzLjEuIFNldCB1cCBvZiB0aGUNCjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyByZWdpc3RyeSBmb3IgdGhlIEZsYWdzIGZpZWxk IGlzIG5vdyBpbmNsdWRlZCBpbiB0aGUgdXBkYXRlZCBJQU5BIENvbnNpZGVyYXRpb25zIHNlY3Rp b24uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPlNhbWUgY29tbWVudCBhcyBhYm92ZSBh Ym91dCDigJxJRVRGIFJldmlld+KAnSB2cyDigJxTdGFuZGFyZHMgQWN0aW9u4oCdLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij7igKYmbmJzcDsmbmJzcDsgPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IE0yLjIuIFRoZSBkZWZpbml0aW9uIG9mIHRoZSBC R1BzZWNfUGF0aCBBdHRyaWJ1dGUgKGFuZCBpdHMgZGV0YWlscykgZG9uJ3QgaGF2ZSBjbGVhciBl cnJvcg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGhhbmRs aW5nIHByb2NlZHVyZXMgZGVmaW5lZCAoUkZDNzYwNikuJm5ic3A7IFNlY3Rpb24gNC4zLiAoUHJv Y2Vzc2luZyBJbnN0cnVjdGlvbnMgZm9yDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPiZndDsgQ29uZmVkZXJhdGlvbiBNZW1iZXJzKSBkb2VzIHNheSB0aGlzOiAmcXVv dDsoQXMgZGlzY3Vzc2VkIGluIFNlY3Rpb24gNS4yLCBhbnkgZXJyb3IgaW4gdGhlDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgQkdQc2VjX1BhdGggYXR0cmli dXRlIE1VU1QgYmUgaGFuZGxlZCB1c2luZyB0aGUgJnF1b3Q7dHJlYXQtYXMtd2l0aGRyYXcmcXVv dDssIGFwcHJvYWNoIGFzDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZndDsgZGVmaW5lZCBpbiBSRkMgNzYwNiBbUkZDNzYwNl0uKSZxdW90OyAoaW5jbHVkaW5nIHRo ZSBwYXJlbnRoZXNlcykuJm5ic3A7IEhvd2V2ZXIsIDUsMiBvbmx5IHNheXM6DQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgJnF1b3Q7QkdQc2VjIHNwZWFrZXJz IE1VU1QgaGFuZGxlIHRoZXNlIGVycm9ycyB1c2luZyB0aGUgJnF1b3Q7dHJlYXQtYXMtd2l0aGRy YXcmcXVvdDsgYXBwcm9hY2ggYXMNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+Jmd0OyBkZWZpbmVkIGluIFJGQyA3NjA2IFtSRkM3NjA2XS4mcXVvdDsmbmJzcDsmbmJz cDsgTm90ZTogJnF1b3Q7dGhlc2UgZXJyb3JzJnF1b3Q7IGlzIG5vdCB0aGUgc2FtZSBhcyAmcXVv dDthbnkNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBlcnJv ciZxdW90Oy4mbmJzcDsgUGxlYXNlIGRpc2N1c3MgZXJyb3IgaGFuZGxpbmcgaW4gYSBtb3JlIHBy b21pbmVudCBwbGFjZS4gKEhpbnQ6IGl0IG1heSBmaXQgaW4gYSBmYXVsdA0KPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IG1hbmFnZW1lbnQgZGlzY3Vzc2lvbiBp biB0aGUgT3BlcmF0aW9ucyBhbmQgTWFuYWdlbWVudCBTZWN0aW9uLik8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0mbmJzcDsgcyAvQXMgZGlzY3Vzc2VkIGlu IFNlY3Rpb24gNS4yLCBhbnkgZXJyb3IgaW4gdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSBNVVNU IGJlDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgaGFuZGxl ZCB1c2luZyB0aGUgJnF1b3Q7dHJlYXQtYXMtd2l0aGRyYXcmcXVvdDssIGFwcHJvYWNoIGFzIGRl ZmluZWQgaW4gUkZDIDc2MDYgW1JGQzc2MDZdLi8gQXMNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBkaXNjdXNzZWQgaW4gU2VjdGlvbiA1LjIsIGFueSBzeW50 YWN0aWNhbCBvciBwcm90b2NvbCB2aW9sYXRpb24gZXJyb3JzIGluIHRoZSBCR1BzZWNfUGF0aA0K PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGF0dHJpYnV0ZSBN VVNUIGJlIGhhbmRsZWQgdXNpbmcgdGhlICZxdW90O3RyZWF0LWFzLXdpdGhkcmF3JnF1b3Q7IGFw cHJvYWNoIGFzIGRlZmluZWQgaW4gUkZDIDc2MDYNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jmd0OyBbUkZDNzYwNl0uLzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jmd0OyBbU3JpcmFtXSZuYnNwOyBTZWN0aW9uIDQuMyBoYXMgYmVlbiB1cGRhdGVk IGFjY29yZGluZ2x5LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPkkgZGlkbuKAmXQgZXhwbGFpbiBteXNl bGYgY29ycmVjdGx5LiZuYnNwOyBTZWN0aW9uIDQuMy4gKFByb2Nlc3NpbmcgSW5zdHJ1Y3Rpb25z IGZvciBDb25mZWRlcmF0aW9uIE1lbWJlcnMpIGNvdmVycyBvbmx5IHRoZSBwcm9jZXNzaW5nIGZv ciBjb25mZWRlcmF0aW9ucywgc28gcHV0dGluZyB0ZXh0IGluIHRoZXJlIGFib3V0IGFueSBlcnJv cnMgaXMgZ29vZCwgYnV0IGRvZXNu4oCZdCBjb3ZlciB0aGUgZ2VuZXJhbCBjYXNlDQogKGZvciBw cm9jZXNzaW5nIGFueSB1cGRhdGUpLiZuYnNwOyA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+T1RPSCwgU2VjdGlvbiA1LjIuIChWYWxpZGF0aW9uIEFsZ29yaXRobSkgZG9lc27igJl0IGFj dHVhbGx5IHRhbGsgYWJvdXQg4oCcYW55IGVycm9y4oCdIChhcyByZWZlcmVuY2VkIG5vdyBmcm9t IDQuMykg4oCTIGl0IG9ubHkgdGFsa3MgYWJvdXQg4oCcdGhlc2UgZXJyb3Jz4oCdLCB3aGljaCBj b3JyZXNwb25kIHRvIHRoZSBsaXN0IG9mIGNoZWNrcyBpbiB0aGUgc2VjdGlvbi4mbmJzcDsgSU9X LCB0aGVyZSBpcyBubyBnbG9iYWwgc3BlY2lmaWNhdGlvbg0KIHRoYXQgYW55IGVycm9yIG11c3Qg cmVzdWx0IGluIHRyZWF0LWFzLXdpdGhkcmF3LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij5Tb2x1dGlvbjombmJzcDsgdGFrZSB0aGUgdGV4dCBvdXQgb2YgNC4zIGFuZCB1cGRhdGUgdGhl IHRleHQgaW4gNS4yOyBzdWdnZXN0aW9uOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5P TEQmZ3Q7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJz cDsgSWYgYW55IG9mIHRoZXNlIGNoZWNrcyBmYWlsLCBpdCBpcyBhbiBlcnJvciBpbiB0aGUgQkdQ c2VjX1BhdGg8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZu YnNwOyBhdHRyaWJ1dGUuJm5ic3A7IEFueSBvZiB0aGVzZSBlcnJvcnMgaW4gdGhlIEJHUHNlY19Q YXRoIGF0dHJpYnV0ZSBhcmU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZuYnNwOyZuYnNwOyBoYW5kbGVkIGFzIHBlciBSRkMgNzYwNiBbUkZDNzYwNl0uJm5ic3A7IEJH UHNlYyBzcGVha2VycyBNVVNUIGhhbmRsZSB0aGVzZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IGVycm9ycyB1c2luZyB0aGUgJnF1b3Q7dHJlYXQt YXMtd2l0aGRyYXcmcXVvdDsgYXBwcm9hY2ggYXMgZGVmaW5lZCBpbiBSRkMgNzYwNjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IFtSRkM3NjA2XS48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+TkVXJmd0OzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IElmIGFueSBvZiB0aGVzZSBjaGVja3Mg ZmFpbCwgaXQgaXMgYW4gZXJyb3IgaW4gdGhlIEJHUHNlY19QYXRoPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsgYXR0cmlidXRlLiAmbmJzcDtCR1Bz ZWMgc3BlYWtlcnMgTVVTVCBoYW5kbGUgYW55IHN5bnRhY3RpY2FsIG9yIHByb3RvY29sIGVycm9y cw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsmbmJzcDsm bmJzcDtpbiB0aGUgQkdQc2VjX1BhdGggYXR0cmlidXRlIHVzaW5nIHRoZSAmcXVvdDt0cmVhdC1h cy13aXRoZHJhdyZxdW90OyBhcHByb2FjaCBhcyBkZWZpbmVkDQo8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyZuYnNwO2luIFJGQyA3NjA2IFtSRkM3 NjA2XS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPuKApjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jmd0OyBNNy4xLiDigJxXaXRoIHJlZ2FyZHMgdG8gdGhlIHByb2Nlc3Npbmcgb2YgZHVwbGlj YXRlIHVwZGF0ZSBtZXNzYWdlcywgaWYgdGhlIGZpcnN0IHVwZGF0ZQ0KPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IG1lc3NhZ2UgaXMgdmFsaWQsIHRoZW4gYW4g aW1wbGVtZW50YXRpb24gU0hPVUxEIE5PVCBydW4gdGhlIHZhbGlkYXRpb24gcHJvY2VkdXJlIG9u IHRoZQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHNlY29u ZCwgZHVwbGljYXRlIHVwZGF0ZSBtZXNzYWdlIChldmVuIGlmIHRoZSBiaXRzIG9mIHRoZSBzaWdu YXR1cmUgZmllbGQgYXJlDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZndDsgZGlmZmVyZW50KS7igJ0mbmJzcDsgRXZlbiB0aG91Z2ggYSBkaXNjdXNzaW9uIGFib3V0 IG5vbi1kZXRlcm1pbmlzdGljIHNpZ25hdHVyZSBhbGdvcml0aG1zDQo8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgcHJlY2VkZXMgdGhpcyB0ZXh0LCB0aGUgdmFs aWRhdGlvbiBpcyBzdGlsbCBub3QgcnVuLiZuYnNwOyBIb3cgY2FuIHRoZSB2YWxpZGl0eSBvZiB0 aGUgUGF0aCBiZQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7 IGd1YXJhbnRlZWQgaW4gdGhpcyBjYXNlPyZuYnNwOyBTaG91bGQgdGhpcyBiZSB0aGUgYWN0aW9u IGZvciBhbGwgYWxnb3JpdGhtcyBvciBvbmx5IG9uZXMga25vd24gdG8NCjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBiZSBub24tZGV0ZXJtaW5pc3RpYz88bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0gRGVmaW5pdGlvbiBv ZiBkdXBsaWNhdGUgdXBkYXRlIGZvciBCR1BzZWM6IEEgQkdQc2VjIHVwZGF0ZSBpcyBhIGR1cGxp Y2F0ZSBpZiBpdCBpcw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4m Z3Q7IGlkZW50aWNhbCB0byBhbm90aGVyIHVwZGF0ZSBpbiB0aGUgQWRqLVJJQi1pbiwgaW5jbHVk aW5nIFNLSXMgYW5kIEFsZ29yaXRobSBJRCwgYnV0IG5vdA0KPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGluY2x1ZGluZyB0aGUgc2lnbmF0dXJlcy4gSWYgdGhl IGZpcnN0IHVwZGF0ZSBtZXNzYWdlIChoYXZpbmcgdGhlICpzYW1lIFNLSXMqIGFzIHRoZQ0KPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGR1cGxpY2F0ZSkgaXMg KlZhbGlkKiwgdGhlbiB0aGUgZHVwbGljYXRl4oCZcyB2YWxpZGl0eSBzdGF0ZSBuZWVkIG5vdCBi ZSBjb21wdXRlZC4mbmJzcDsgSWYgdmFsaWRpdHkgb2YNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGUgZHVwbGljYXRlIHdlcmUgY29tcHV0ZWQgYW5kIGZv dW5kICdWYWxpZCcsIHRoZW4gaXQgZ2l2ZXMgdGhlIHJvdXRlciBubyBuZXcNCjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBpbmZvcm1hdGlvbi4gQWx0ZXJuYXRp dmVseSwgaWYgaXQgd2VyZSBmb3VuZCAnTm90IFZhbGlkJywgdGhlbiBpdCBvbmx5IGltcGxpZXMg dGhhdCBzb21lIGJpdA0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4m Z3Q7IGVycm9ycyBvY2N1cnJlZCBpbiB0aGUgc2lnbmF0dXJlcy4gVGhlcmVmb3JlLCB0aGUgQkdQ c2VjIHNwZWFrZXIgc2hvdWxkIGtlZXAgdGhlICdWYWxpZCcNCjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBvcmlnaW5hbCB1cGRhdGUgYW5kIGlnbm9yZSB0aGUg ZHVwbGljYXRlLiBIb3dldmVyLCBpZiB0aGUgb3JpZ2luYWwgdXBkYXRlIHdlcmUgJ05vdCBWYWxp ZCcsDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgdGhlbiBw ZXJmb3JtaW5nIHZhbGlkYXRpb24gb2YgdGhlIGR1cGxpY2F0ZSBpcyByZWxldmFudCBhbmQgU0hP VUxEIGJlIGRvbmUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7 Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IFtTcmly YW1dIEFkZGVkIGEgcGFyYWdyYXBoIGluIHRoZSBuZXcgU2VjdGlvbiA3IChPcGVyYXRpb25zIGFu ZCBNYW5hZ2VtZW50DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZn dDsgQ29uc2lkZXJhdGlvbnMpIHRvIGluY2x1ZGUgdGhlIGFib3ZlIG9ic2VydmF0aW9ucy4mbmJz cDsgPG86cD4NCjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+SSBzYXcgdGhlIHRleHQsIGFuZCBo YXZlIDMgcXVlc3Rpb25zL2NvbW1lbnRzOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4x LiDigJzigKZpdCBvbmx5IGltcGxpZXMgdGhhdCBzb21lIGJpdCBlcnJvcnMgb2NjdXJyZWQgaW4g dGhlIHNpZ25hdHVyZXMu4oCdJm5ic3A7Jm5ic3A7IFdoYXQgZG9lcyB0aGF0IG1lYW4/Jm5ic3A7 IEFyZSB5b3UgaW1wbHlpbmcgdGhhdCB0aGUgc2VuZGVyIGdvdCB0aGUgc2lnbmF0dXJlIHdyb25n PyZuYnNwOyBPciBtYXliZSB0aGF0IHRoZXJlIHdhcyBzb21lIGNvcnJ1cHRpb24gaW4tdHJhbnNp dD8mbmJzcDsgQm90aCBjYXNlcyBhcmUgKmJhZCosIGJ1dA0KIHRoZSBjYXNlIHdoZXJlIHRoZSBz ZW5kZXIgY291bGQgZ2V0IHRoZSBzaWduYXR1cmUgd3JvbmcgaXMgc3BlY2lhbGx5IHNvIGJlY2F1 c2UgaWYgaXQgd2FzbuKAmXQgYSBkdXBsaWNhdGUgdXBkYXRlLCB0aGVuIGl0IHdvdWxkIHJlc3Vs dCDigJxOb3QgVmFsaWTigJ0gYW5kIHRoZXJlIHNlZW1zIHRvIGJlIG5vIHdheSB0byBkZXRlcm1p bmUgaWYgaW4gZmFjdCB0aGUgdmFsaWRpdHkgZmFpbGVkIG9yIGlmIGl0IGlzIHRoZSBjYXNlIG9m IHNvbWUgYml0IGVycm9ycy4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPkw8 L3NwYW4+IDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4yLiDigJxUaGVyZWZvcmUsIHRo ZSBCR1BzZWMgc3BlYWtlciBzaG91bGQga2VlcCB0aGUgJ1ZhbGlkJyBvcmlnaW5hbCB1cGRhdGUg YW5kIGlnbm9yZSB0aGUgZHVwbGljYXRlLuKAnSBObyEmbmJzcDsgVGhpcyBpcyBub3QgaG93IEJH UCB3b3Jrc+KApnNlZSBiZWxvdy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+My4g4oCc 4oCmaWYgdGhlIG9yaWdpbmFsIHVwZGF0ZSB3ZXJlICdOb3QgVmFsaWQnLCB0aGVuIHBlcmZvcm1p bmcgdmFsaWRhdGlvbiBvZiB0aGUgZHVwbGljYXRlIGlzIHJlbGV2YW50IGFuZCBTSE9VTEQgYmUg ZG9uZS7igJ0mbmJzcDsgV2h5IGlzIHRoaXMgbm90IGEg4oCcTVVTVOKAnT8mbmJzcDsgSU9XLCBp ZiB0aGUgb3JpZ2luYWwgdXBkYXRlIHdhcyDigJxOb3QgVmFsaWTigJ0gd2hlbiB3b3VsZCBpdCBi ZSBvayB0byBub3QgcGVyZm9ybSB2YWxpZGF0aW9uDQogb24gYSBuZXcgdXBkYXRlPzxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0gTm90ZSB0aGF0IHRoZSBhYm92ZSBhcHBsaWVzIHRv IGJvdGggbm9uLWRldGVybWluaXN0aWMgYW5kIGRldGVybWluaXN0aWMgc2lnbmF0dXJlDQo8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgYWxnb3JpdGhtcy4mbmJz cDsgPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IE03LjIuIHJmYzQyNzEg KGluIFNlY3Rpb24gOS4gKFVQREFURSBNZXNzYWdlIEhhbmRsaW5nKSB0YWxrcyBhYm91dCB0aGUg aW1wbGljaXQgd2l0aGRyYXcNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jmd0OyBvZiBhIHJvdXRlIOKAnGlmIHRoZSBOTFJJIG9mIHRoZSBuZXcgcm91dGUgaXMgaWRl bnRpY2FsIHRvIHRoZSBvbmUgdGhlIHJvdXRlciBjdXJyZW50bHkgaGFzDQo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgc3RvcmVk4oCm4oCdLiZuYnNwOyBUaGUg c2FtZSBOTFJJIGNhc2Ugc2VlbXMgdG8gYmUgYSBwYXJ0aWN1bGFyIGNvbmRpdGlvbiBvZiB0aGUg 4oCcZHVwbGljYXRlDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZn dDsgdXBkYXRl4oCdIGRlc2NyaWJlZCBoZXJlLiZuYnNwOyBJdCBtaWdodCBiZSBhIGdvb2QgaWRl YSB0byBtZW50aW9uIHRoYXQgYSDigJxkdXBsaWNhdGUgdXBkYXRl4oCdDQo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgcmVzdWx0cyBpbiB0aGUgaW1wbGljaXQg d2l0aGRyYXcgb2YgdGhlIG9yaWdpbmFsIHVwZGF0ZS4mbmJzcDsgV2hhdCBoYXBwZW5zIGlmIGEg dGhpcmQgZHVwbGljYXRlDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZndDsgcm91dGUgaXMgcmVjZWl2ZWQgKHRoZSBmaXJzdCBvbmUgd2FzIHZhbGlkLCB0aGUgc2Vj b25kIG9uZSB3YXMgbm90IHZhbGlkYXRlZCksIHNob3VsZCBpdCBiZQ0KPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHZhbGlkYXRlZD88bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbV0gSW4gUkZDIDQyNzEsIHdoZW4gdGhlcmUg aXMgYSBkdXBsaWNhdGUgdXBkYXRlLCB0aGUgTlJMSSBhbmQgcGF0aCBhbmQgYWxsIG90aGVyDQo8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgYXR0cmlidXRlcyBh cmUgaWRlbnRpY2FsLiBUaGVyZSBpcyBubyBpbXBsaWNpdCB3aXRoZHJhdy4gVGhlIHJvdXRlciBr ZWVwcyB3aGF0IGl0IGFscmVhZHkNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+Jmd0OyBoYXMuIEluIHRoZSBjYXNlIG9mIEJHUHNlYywgYSByb3V0ZXIga2VlcHMgdGhl IG9yaWdpbmFsIGlmIGl0IHdhcyB2YWxpZCwgYW5kIGlnbm9yZXMgdGhlDQo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgZHVwbGljYXRlLiBJdCBjaGVja3MgdGhl IHZhbGlkaXR5IG9mIHRoZSBkdXBsaWNhdGUgb25seSBpZiB0aGUgb3JpZ2luYWwgd2VyZSBpbnZh bGlkLiZuYnNwOyZuYnNwOw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPkluIHBsYWlu IEJHUCwgaWYgYSBkdXBsaWNhdGUgdXBkYXRlIChhcyBkZWZpbmVkIGFib3ZlIHdoZXJlIGV2ZXJ5 dGhpbmcgaXMgaWRlbnRpY2FsKSBpcyByZWNlaXZlZCwgdGhlbiB0aGUgb3JpZ2luYWwgb25lIGlz IHJlcGxhY2VkIGJ5IHRoZSBuZXcgb25lIOKAkyBpbiB0aGlzIHNwZWNpZmljIGNhc2UgKHdoZXJl IGV2ZXJ5dGhpbmcgaXMgaWRlbnRpY2FsKSwgaXQgbWF5IGxvb2sgbGlrZSB0aGUgcm91dGVyIGtl ZXBzDQogd2hhdCBpdCBhbHJlYWR5IGhhc+KApmJ1dCB0aGUgZ2VuZXJhbCBydWxlIGlzIHRvIHJl cGxhY2UgdGhlIG9sZCB1cGRhdGUgd2l0aCBhIG5ldyBvbmUgZm9yIHRoZSBzYW1lIHByZWZpeC48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+V2hhdCB5b3UgYXJlIHByb3Bvc2luZyBhYm92 ZSAo4oCcSW4gdGhlIGNhc2Ugb2YgQkdQc2VjLCBhIHJvdXRlciBrZWVwcyB0aGUgb3JpZ2luYWwg aWYgaXQgd2FzIHZhbGlkLCBhbmQgaWdub3JlcyB0aGUgZHVwbGljYXRlLuKAnSkgaXMgYSBzaWdu aWZpY2FudCBjaGFuZ2Ugd2l0aCByZXNwZWN0IHRvIEJHUCB0aGF0IGlzIG5vdCBleHBsaWNpdGx5 IGNhbGxlZCBvdXQuJm5ic3A7IEkgaGF2ZW7igJl0IHNlZW4gdGhpcyBiZWhhdmlvcg0KIG1lbnRp b25lZCBhbnl3aGVyZSBpbiB0aGUgZHJhZnQg4oCTIGl0IGhhcyBvbmx5IGNvbWUgdXAgbm93Ljxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5JTUhPLCBub3Qgb25seSBzaG91bGQgdGhlIGlt cGxpY2l0IHdpdGhkcmF3IGJlaGF2aW9yIG5vdCBjaGFuZ2UsIGJ1dCBieSBpZ25vcmluZyB0aGUg c2Vjb25kIHVwZGF0ZSB5b3XigJlyZSBpZ25vcmluZyBhIHBvdGVudGlhbGx5IGltcG9ydGFudCBj aGFuZ2UgaW4gdGhlIHRvcG9sb2d5L3N0cnVjdHVyZSBvZiB0aGUgbmV0d29yay48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+4oCmPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij4mZ3Q7IE0xMC4mbmJzcDsgSW4gU2VjdGlvbiA3LjIuIChPbiB0aGUgUmVtb3ZhbCBv ZiBCR1BzZWMgU2lnbmF0dXJlcyk6IOKAnOKApnRoZSBwcm90b2NvbCBzcGVjaWZpZXMgdGhhdA0K PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGEgQkdQc2VjIHNw ZWFrZXIgY2hvb3NpbmcgdG8gcHJvcGFnYXRlIHRoZSByb3V0ZSBhZHZlcnRpc2VtZW50IGluIHN1 Y2ggYW4gdXBkYXRlDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZn dDsgbWVzc2FnZSBTSE9VTEQgYWRkIGl0cyBzaWduYXR1cmUgdG8gZWFjaCBvZiB0aGUgU2lnbmF0 dXJlX0Jsb2Nrcy7igJ0mbmJzcDsmbmJzcDsgSSBiZWxpZXZlIHRoZQ0KPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHJlZmVyZW5jZSBpcyBTZWN0aW9uIDQuMiAo cGxlYXNlIGFkZCBpdCkuJm5ic3A7IEhvd2V2ZXIsIHRoYXQgU2VjdGlvbiBkb2VzbuKAmXQgdXNl IG5vcm1hdGl2ZQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7 IGxhbmd1YWdlICjigJxGb3IgZWFjaCBTaWduYXR1cmVfQmxvY2sgY29ycmVzcG9uZGluZyB0byBh biBhbGdvcml0aG0gc3VpdGUgdGhhdCB0aGUgQkdQc2VjDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPiZndDsgc3BlYWtlciBkb2VzIHN1cHBvcnQsIHRoZSBCR1BzZWMg c3BlYWtlciBhZGRzIGEgbmV3IFNpZ25hdHVyZSBTZWdtZW50IHRvIHRoZQ0KPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IFNpZ25hdHVyZV9CbG9jay7igJ0pJm5i c3A7Jm5ic3A7IEluIGFueSBjYXNlLCB0aGUg4oCcU0hPVUxE4oCdIGluIDcuMiBpcyBvdXQgb2Yg cGxhY2UgYmVjYXVzZSBpdCBpcw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7IHJlZmVyZW5jaW5nIGEgZmFjdCAocG9pbnRpbmcgYXQgdGhlIG90aGVyIHNlY3Rp b24pIGFuZCBub3QgYmVpbmcgdXNlZCBub3JtYXRpdmVseSDigJMgaWYgeW91DQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgd2FudCB0aGUg4oCcU0hPVUxE4oCd IHRvIGJlIG5vcm1hdGl2ZSwgdGhlbiBpdCBzaG91bGQgYmUgYmFjayBpbiA0LjIuPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IFtTcmlyYW1dIFllcywgYWdyZWUuIEZpeGVk IHRoZSB3b3JkaW5nIHBlciB5b3VyIHN1Z2dlc3Rpb24gaW4gYm90aCBwbGFjZXMgKFNlY3Rpb25z IDQuMiBhbmQNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyA3 LjIpLiBBZGRlZCByZWZlcmVuY2UgdG8gU2VjdGlvbiA0LjIgaW4gU2VjdGlvbiA3LjIuJm5ic3A7 Jm5ic3A7IDxvOnA+DQo8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk5vdyA0LjIgcmVhZHM6IOKA nEZvciBlYWNoIFNpZ25hdHVyZV9CbG9jayBjb3JyZXNwb25kaW5nIHRvIGFuIGFsZ29yaXRobSBz dWl0ZSB0aGF0IHRoZSBCR1BzZWMgc3BlYWtlciBkb2VzIHN1cHBvcnQsIHRoZSBCR1BzZWMgc3Bl YWtlciBTSE9VTEQgYWRkIGEgbmV3IFNpZ25hdHVyZSBTZWdtZW50IHRvIHRoZSBTaWduYXR1cmVf QmxvY2vigJ0mbmJzcDsmbmJzcDsgU2hvdWxkIHRoYXQg4oCcU0hPVUxE4oCdIGJlIGEg4oCcTVVT VOKAnT88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij7igKY8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZndDsgTTEyLiBUaGUgbWFuZGF0b3J5IGFkZGl0aW9uIG9mIFNlY3VyZV9Q YXRoIGFuZCBTaWduYXR1cmUgc2VnbWVudHMgaW4gYSBDb25mZWRlcmF0aW9uDQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgcmVzdWx0cyBpbiB0aGUgaW5jb25z aXN0ZW50IGF1dGhvcml6YXRpb24gY2hhaW4gbWVudGlvbmVkIGluIFNlY3Rpb24gNC4zLiAoUHJv Y2Vzc2luZw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IElu c3RydWN0aW9ucyBmb3IgQ29uZmVkZXJhdGlvbiBNZW1iZXJzKTog4oCcRm9yIGEgc2lnbmF0dXJl IHByb2R1Y2VkIGJ5IGEgcGVlciBCR1BzZWMNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jmd0OyBzcGVha2VyIG91dHNpZGUgb2YgYSBjb25mZWRlcmF0aW9uLCB0aGUg VGFyZ2V0IEFTIHdpbGwgYWx3YXlzIGJlIHRoZSBBUyBDb25mZWRlcmF0aW9uDQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgSWRlbnRpZmllciAodGhlIHB1Ymxp YyBBUyBudW1iZXIgb2YgdGhlIGNvbmZlZGVyYXRpb24pIGFzIG9wcG9zZWQgdG8gdGhlIE1lbWJl ci1BUw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IE51bWJl ci7igJ0mbmJzcDsgSXQgc2VlbXMgdG8gbWUgdGhhdCB0aGlzIGRpc2NvbnRpbnVpdHkgaW4gdGhl IEFTTiBsaXN0IGJyZWFrcyB0aGUg4oCcY3J5cHRvZ3JhcGhpYw0KPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGFzc3VyYW5jZSB0aGF04oCmRXZlcnkgQVMgb24g dGhlIHBhdGggb2YgQVNlcyBsaXN0ZWQgaW4gdGhlIHVwZGF0ZSBtZXNzYWdlIGhhcyBleHBsaWNp dGx5DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgYXV0aG9y aXplZCB0aGUgYWR2ZXJ0aXNlbWVudCBvZiB0aGUgcm91dGUgdG8gdGhlIHN1YnNlcXVlbnQgQVMg aW4gdGhlIHBhdGjigJ0gYmVjYXVzZSB0aGVyZQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij4mZ3Q7IGlzIG5vIHdheSB0byB2ZXJpZnkgdGhhdCB0aGUgTWVtYmVyLUFT IGluIHRoZSBmaXJzdCBTZWN1cmVfUGF0aCBzZWdtZW50IGlzIGluIGZhY3QgdGhlIG9uZQ0KPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHBlZXJpbmcgd2l0aCB0 aGUgZXh0ZXJuYWwgbmVpZ2hib3IuJm5ic3A7IEkgcmVhbGl6ZSB0aGF0IHRoZSByaXNrIG1heSBi ZSBtaW5pbWl6ZWQgYnkgYW4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jmd0OyDigJxpbnRlcm5hbCB0cnVzdOKAnSBmYWN0b3IsIGJ1dCBJIHdvdWxkIGxpa2UgdG8g c2VlIGEgZGlzY3Vzc2lvbiBhYm91dCB0aGlzIGlzc3VlIGluIHRoZSBTZWN1cml0eQ0KPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IENvbnNpZGVyYXRpb25zLjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBbU3JpcmFtXSBTZWUgdGhlIG5l dyBzZWNvbmQgcGFyYWdyYXBoIGluIFNlY3Rpb24gNy40LiBUaGUgc2VjdXJpdHkgY29uc2lkZXJh dGlvbiB0aGF0IHlvdQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4m Z3Q7IG1lbnRpb24gaGVyZSBhYm91dCB3aXRoIHRoZSB3YXkgY29uZmVkZXJhdGlvbnMgYXJlIGhh bmRsZWQgaXMgZGVzY3JpYmVkIGFuZCBkaXNjdXNzZWQNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGVyZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+UGVyc29uYWxseSwgSSB3b3VsZCBoYXZlIHByZWZlcnJlZCBpZiB5b3UgYWN0dWFsbHkgc29s dmVkIHRoZSBwcm9ibGVtLiZuYnNwOw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk9u ZSBzb2x1dGlvbiBpcyB0byBib3Jyb3cgZnJvbSBkcmFmdC1pZXRmLXNpZHItYXMtbWlncmF0aW9u IGFuZCBmb3J3YXJkIHNpZ24gZnJvbSB0aGUgQ29uZmVkZXJhdGlvbiBBUyAodGhlIHB1YmxpYyBu dW1iZXIpIHRvIHRoZSBNZW1iZXItQVMgd2l0aCBwQ291bnQ9MC4mbmJzcDsgTm90ZSB0aGF0IHRo aXMgb3BlcmF0aW9uIHdvdWxkIHRha2UgcGxhY2UgaW5zaWRlIHRoZSBib3JkZXIgQ29uZmVkZXJh dGlvbiByb3V0ZXIsDQogc28gdGhlcmUgYXJlIG5vIGlzc3VlcyB3aXRoIHBDb3VudD0wIGFuZCB0 aGUgZnVsbCBwYXRoIGNvbnRpbnVpdHkgaXMgcHJlc2VydmVkLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij5bKl0gQ2hhaXJzOiBJIHRoaW5rIHRoYXQgdGhpcyBwYXJ0ICh3aGV0aGVyIGl0 IGlzIHNvbHZlZCBvciBub3QpIHNob3VsZCBhbHNvIGJlIGJvdW5jZWQgYnkgdGhlIFdHLg0KPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+4oCmPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7IG04LiBTZWN0aW9uIDUuMS4gKE92ZXJ2aWV3IG9mIEJHUHNlYyBWYWxpZGF0aW9u KTog4oCcSXQgaXMgZXhwZWN0ZWQgdGhhdCBCR1AgcGVlcnMgd2lsbA0KPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGdlbmVyYWxseSBwcmVmZXIgcm91dGVzIHJl Y2VpdmVkIHZpYSAnVmFsaWQnIEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMgb3ZlciBib3RoIHJvdXRl cw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHJlY2VpdmVk IHZpYSAnTm90IFZhbGlkJyBCR1BzZWMgdXBkYXRlIG1lc3NhZ2VzIGFuZCByb3V0ZXMgcmVjZWl2 ZWQgdmlhIHVwZGF0ZSBtZXNzYWdlcw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij4mZ3Q7IHRoYXQgZG8gbm90IGNvbnRhaW4gdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0 ZeKApihTZWUgW0ktRC5pZXRmLXNpZHItYmdwc2VjLW9wc13igKbigJ0mbmJzcDsgSSByZWFkDQo8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgdGhpcyBwaWVjZSBv ZiB0ZXh0IGFzIHNheWluZyB0aGF0IHJvdXRlcyBpbiBOb3QgVmFsaWQgdXBkYXRlcyBhcmUgZXhw ZWN0ZWQgdG8gYmUgdXNlZCAoZXZlbg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij4mZ3Q7IHRob3VnaCB0aGV5IGFyZSBub3QgdmFsaWQpLiZuYnNwOyBCZXNpZGVzIHRo ZSBmYWN0IHRoYXQgSS1ELmlldGYtc2lkci1iZ3BzZWMtb3BzIGRvZXMgcmVjb21tZW5kDQo8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgdXNpbmcgTm90IFZhbGlk IGFubm91bmNlbWVudHMgKGluIFNlY3Rpb24gNyksIGFyZSB0aGVyZSBvdGhlciByZWFzb25zIGZv ciB0aGlzIGRvY3VtZW50IHRvDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZndDsgZXhwZWN0IHRoZWlyIHVzZT88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZndDsgW1NyaXJhbV0gSWYgb25seSBhIOKAmE5vdCBWYWxpZOKAmSB1cGRhdGUgaXMgYXZh aWxhYmxlIGZvciBhIHByZWZpeCwgdGhlbiB0aGUgdXBkYXRlIGlzIHVzZWQgc2luY2UNCjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBvdGhlcndpc2UgdGhlIHBy ZWZpeCB3b3VsZCBiZSB1bnJlYWNoYWJsZS4gQm90aCBCR1BzZWMgYW5kIFJQS0kvb3JpZ2luIHZh bGlkYXRpb24gYXJlDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZn dDsgZXhwZWN0ZWQgdG8gZGVwcmVmIGludmFsaWQgdXBkYXRlcyByYXRoZXIgdGhhbiBpZ25vcmUg dGhlbS4gVGhpcyBpcyBkcml2ZW4gYnkgb3BlcmF0b3INCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBwb2xpY3kgYW5kIGNhbiB2YXJ5LiBIZW5jZSwgd2UgYXJl IGRlbGliZXJhdGVseSBub3QgdXNpbmcgYW55IG5vcm1hdGl2ZSBsYW5ndWFnZSBoZXJlLiZuYnNw Ow0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPkhvbmVzdGx5LCB1c2luZyDigJxOb3Qg VmFsaWTigJ0gdXBkYXRlcyBtYWtlcyBubyBzZW5zZSB0byBtZS4mbmJzcDsgV2XigJlyZSBidWls ZGluZyBhbGwgdGhpcyBtYWNoaW5lcnksIGNoYW5naW5nIEJHUCwgZXRjLi4ganVzdCB0byBlbmQg dXAgdXNpbmcgdXBkYXRlcyB0aGF0IGFyZSBub3QgdmFsaWQgYW55d2F5LiZuYnNwOyBXaHkgYXJl IHdlIGRvaW5nIGFsbCB0aGlzIHdvcmsgdGhlbj8hPyZuYnNwOw0KPHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O01TIE1pbmNobyZxdW90OyI+4pi5PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij5JIHVuZGVyc3RhbmQgdGhhdCwgc3BlY2lhbGx5IGF0IHRoZSBiZWdpbm5p bmcsIHBlb3BsZSBtYXkgd2FudCB0byB1c2Ug4oCcTm90IFZhbGlk4oCdIHVwZGF0ZXPigKZidXQg dGhhdCBpcyBhbiBvcGVyYXRpb25hbCBjb25zaWRlcmF0aW9uIChhcyB5b3Ugc2FpZCBhYm92ZSku Jm5ic3A7IFBsZWFzZSB0YWtlIHRoZSB0ZXh0IG91dCBmcm9tIHRoaXMgZG9jdW1lbnQgdGhhdCBy ZWNvbW1lbmRzIHVzaW5nIOKAnE5vdCBWYWxpZOKAneKApmFuZA0KIGxldCBJLUQuaWV0Zi1zaWRy LWJncHNlYy1vcHMgZGVhbCB3aXRoIHRoYXQgcmVjb21tZW5kYXRpb24uPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPuKApjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5OZXcgY29t bWVudDo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+TjEuIFNlY3Rpb24gMi4yLiAoTmVn b3RpYXRpbmcgQkdQc2VjIFN1cHBvcnQpIHNheXMgdGhhdCBiZWNhdXNlIOKAnEJHUHNlYyB1cGRh dGUgbWVzc2FnZXMgY2FuIGJlIHF1aXRlIGxhcmdlLCB0aGVyZWZvcmUgYW55IEJHUHNlYyBzcGVh a2Vy4oCmU0hPVUxEIGFsc28gYW5ub3VuY2Ugc3VwcG9ydCBmb3IgdGhlIGNhcGFiaWxpdHkgdG8g cmVjZWl2ZSBCR1AgZXh0ZW5kZWQgbWVzc2FnZXMgW0ktRC5pZXRmLWlkci1iZ3AtZXh0ZW5kZWQt bWVzc2FnZXNdLuKAnSZuYnNwOyZuYnNwOw0KIFdoYXQgZG9lcyB0aGlzIG1lYW4gd2l0aCByZXNw ZWN0IHRvIHRoZSBzZXNzaW9uIGVzdGFibGlzaG1lbnQgcmVxdWlyZW1lbnRzPyZuYnNwOyBUaGlz IGNhcGFiaWxpdHkgaXMgbm90IG1hbmRhdG9yeSAoU0hPVUxEIGlzIHVzZWQgYW5kIG5vdCBNVVNU KSwgYnV0IGFzIEJHUHNlYyBpcyBkZXBsb3llZCBtb3JlIGFuZCBtb3JlLCB0aGUgc3lzdGVtIG1h eSBub3Qgd29yayBhbnltb3JlIHVubGVzcyBpdCBpcyBleGNoYW5nZWQuJm5ic3A7Jm5ic3A7IFdo eSB3YXNu4oCZdCDigJxNVVNU4oCdDQogdXNlZD8mbmJzcDsgSeKAmW0gZ3Vlc3NpbmcgdGhhdCBw YXJ0IG9mIHRoZSByZWFzb24gbWF5IGJlIGF2YWlsYWJpbGl0eSBvZiB0aGUgZmVhdHVyZeKApiZu YnNwOyBJIHRoaW5rIHRoYXQgdGhlIHBvdGVudGlhbCBvZiBoYXZpbmcgYSBwcm9wZXJseSBuZWdv dGlhdGVkIEJHUHNlYyBzZXNzaW9uIHN0aWxsIG5vdCB3b3JrIChiZWNhdXNlIHRoZSBtZXNzYWdl cyBhcmUgdG9vIGJpZykgc2hvdWxkIGF0IGxlYXN0IGJlIG1lbnRpb25lZCBpbiB0aGUgbmV3IE9w ZXJhdGlvbnMNCiBhbmQgTWFuYWdlbWVudCBDb25zaWRlcmF0aW9ucyBTZWN0aW9uLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5OMi4gVGhlIHJlZmVyZW5jZXMgdG8gUkZDNTIyNiBhbmQg UkZDNjQ4NyBzaG91bGQgYmUgTm9ybWF0aXZlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_0239673365214F5DB9CD77B0E544BF57ciscocom_-- From nobody Thu Dec 1 18:20:54 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3236129A61 for ; Thu, 1 Dec 2016 18:20:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N5JLX6O8grzH for ; Thu, 1 Dec 2016 18:20:50 -0800 (PST) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E70D129A62 for ; Thu, 1 Dec 2016 18:20:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6800; q=dns/txt; s=iport; t=1480645250; x=1481854850; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=9+D11Y7lWDk31nT6ztaz/sGvqe5qzpizNVXH4QMdfz4=; b=X1o5Fq9saMDuamlQoEEMdjd5uE4a6WTor2kHMlIoGwqB6acXzXBXxW/p VUy04N3TA5ttxaT1+dlX8y7CApw4/KgPB5YW/4nfnWkzBsb+zauQaxvJ9 STKWH4ySxrZYbedVkUIiSfcKpekiVQ009B8jFuA1OED6fXLLjyX0Tku48 k=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B+AQDx2UBY/4gNJK1cGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgnNFAQEBAQEfWIEGB40+pmOFIIIFhiICGoFzPxQBAgEBAQEBAQFiKIR?= =?us-ascii?q?pAQEEI1YQAgEIPwMCAgIwFBECBA4FiG2sH4IpL4sSAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBHIY+gX2BVoEIh00tgjAFlHWFaQGRDwqBaI5Eh12KKAEeN4EZMQEBhSJ?= =?us-ascii?q?yiDaBDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.33,284,1477958400"; d="scan'208,217";a="355641961" Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 02 Dec 2016 02:20:49 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by alln-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id uB22Kn0l022674 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 2 Dec 2016 02:20:49 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 1 Dec 2016 20:20:48 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Thu, 1 Dec 2016 20:20:48 -0600 From: "Alvaro Retana (aretana)" To: Randy Bush Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-ops-10 Thread-Index: AQHSNR62bJsPySrh80ivtkDVsKGkYKDO/EcAgCUvogA= Date: Fri, 2 Dec 2016 02:20:48 +0000 Message-ID: References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_E9457A370B6443ACBC9D546D86528232ciscocom_" MIME-Version: 1.0 Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 02:20:52 -0000 --_000_E9457A370B6443ACBC9D546D86528232ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UmFuZHk6DQoNCkhpIQ0KDQpEbyB5b3UgdGhpbmsgd2UgY2FuIGdldCBhbiB1cGRhdGUgb3V0IGZv ciB0aGlzIGRvY3VtZW50IHNvb24/ICBJIGp1c3QgcHV0IHRoZSBCR1BzZWMgc3BlYyB1cCBmb3Ig dGhlIEphbi81IElFU0cgVGVsZWNoYXQsIGFuZCBpdCB3b3VsZCBiZSBncmVhdCBpZiB3ZSBjb3Vs ZCBnZXQgdGhpcyBkb2N1bWVudCBpbiBhcyB3ZWxsLg0KDQpUaGFua3MhDQoNCkFsdmFyby4NCg0K T24gMTEvOC8xNiwgMTI6MjggQU0sICJSYW5keSBCdXNoIiA8cmFuZHlAcHNnLmNvbTxtYWlsdG86 cmFuZHlAcHNnLmNvbT4+IHdyb3RlOg0KDQp0aGFua3MgZm9yIHRoZSBiZXN0IHJldmlldyB0aGlz IGhhcyBoYWQgaW4gYSB3aGlsZS4gIGkgYW0gbm90IGlnbm9yaW5nDQp5b3U7IGFuZCBtYXkgZXZl biBnZXQgYSB2ZXJzaW9uIG91dCBmb3IgbmV4dCB3ZWVrLiAgYnV0IG5vIHByb21pc2VzLCBhcw0K aSBzdXNwZWN0IHlvdSBmb2xrIHdpbGwgdGhpbmsgdGhhdCBoYXZpbmcgYSBzb2xpZCBpZXRmIG5l dHdvcmsgbmV4dCB3ZWVrDQppcyBtb3JlIGltcG9ydGFudCA6KQ0KDQo= --_000_E9457A370B6443ACBC9D546D86528232ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <3B454D69ADE9FD45B6CA95D5909113AA@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBE ZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0K CXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnNwYW4uYXBwbGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTph cHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDsN Cglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7fQ0Kc3Bhbi5tc29JbnMN Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJ e21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2Ug V29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAx LjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0t Pjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPlJhbmR5OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkhpITxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPkRvIHlvdSB0aGluayB3ZSBjYW4gZ2V0IGFuIHVwZGF0ZSBvdXQg Zm9yIHRoaXMgZG9jdW1lbnQgc29vbj8mbmJzcDsgSSBqdXN0IHB1dCB0aGUgQkdQc2VjIHNwZWMg dXAgZm9yIHRoZSBKYW4vNSBJRVNHIFRlbGVjaGF0LCBhbmQgaXQgd291bGQgYmUgZ3JlYXQgaWYg d2UgY291bGQgZ2V0IHRoaXMgZG9jdW1lbnQgaW4gYXMgd2VsbC48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj5UaGFua3MhPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+QWx2YXJvLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQjVD NERGIDQuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQ7bWFyZ2luLWxlZnQ6My43NXB0O21h cmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29s b3I6YmxhY2siPk9uIDExLzgvMTYsIDEyOjI4IEFNLCAmcXVvdDtSYW5keSBCdXNoJnF1b3Q7ICZs dDs8YSBocmVmPSJtYWlsdG86cmFuZHlAcHNnLmNvbSI+cmFuZHlAcHNnLmNvbTwvYT4mZ3Q7IHdy b3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuNXB0O2Zv bnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj50aGFua3MgZm9yIHRoZSBiZXN0IHJldmll dyB0aGlzIGhhcyBoYWQgaW4gYSB3aGlsZS4mbmJzcDsmbmJzcDtpIGFtIG5vdCBpZ25vcmluZzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuNXB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9y OmJsYWNrIj55b3U7IGFuZCBtYXkgZXZlbiBnZXQgYSB2ZXJzaW9uIG91dCBmb3IgbmV4dCB3ZWVr LiZuYnNwOyZuYnNwO2J1dCBubyBwcm9taXNlcywgYXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjVwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjayI+aSBzdXNwZWN0IHlvdSBm b2xrIHdpbGwgdGhpbmsgdGhhdCBoYXZpbmcgYSBzb2xpZCBpZXRmIG5ldHdvcmsgbmV4dCB3ZWVr PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29s b3I6YmxhY2siPmlzIG1vcmUgaW1wb3J0YW50IDopPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvYmxvY2tx dW90ZT4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_E9457A370B6443ACBC9D546D86528232ciscocom_-- From nobody Fri Dec 2 07:42:47 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D8E88129636; Fri, 2 Dec 2016 07:42:46 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <148069336684.29741.1161316902987411944.idtracker@ietfa.amsl.com> Date: Fri, 02 Dec 2016 07:42:46 -0800 Archived-At: Cc: draft-ietf-sidr-bgpsec-protocol@ietf.org, sidr-chairs@ietf.org, m.waehlisch@fu-berlin.de, sidr@ietf.org Subject: [sidr] Last Call: (BGPsec Protocol Specification) to Proposed Standard X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Reply-To: ietf@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 15:42:47 -0000 The IESG has received a request from the Secure Inter-Domain Routing WG (sidr) to consider the following document: - 'BGPsec Protocol Specification' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2016-12-16. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document describes BGPsec, an extension to the Border Gateway Protocol (BGP) that provides security for the path of autonomous systems through which a BGP update message passes. BGPsec is implemented via an optional non-transitive BGP path attribute that carries a digital signature produced by each autonomous system that propagates the update message. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-protocol/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-protocol/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Fri Dec 2 07:56:35 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 631D8129435 for ; Fri, 2 Dec 2016 07:56:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jKdpPNLVs3T6 for ; Fri, 2 Dec 2016 07:56:29 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CD4C129447 for ; Fri, 2 Dec 2016 07:56:29 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cCqCI-0007MH-RK; Fri, 02 Dec 2016 15:56:27 +0000 Date: Fri, 02 Dec 2016 07:56:25 -0800 Message-ID: From: Randy Bush To: Alvaro Retana In-Reply-To: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=BIG5 Content-Transfer-Encoding: base64 Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 15:56:34 -0000 Z3JlYXQgcmV2aWV3LiAgdGhhbmtzIQ0KDQo+IDEuIFdoeSBpcyB0aGlzIGRvY3VtZW50IGEgQkNQ PyAgQSBCQ1AgaXMgYSBkb2N1bWVudCB0aGF0IGRlc2NyaWJlcw0KPiChp3RoZSBjb21tdW5pdHkn cyBiZXN0IGN1cnJlbnQgdGhpbmtpbmehS29uIHdoYXQgaXMgYmVsaWV2ZWQgdG8gYmUgdGhlDQo+ IGJlc3Qgd2F5IHRvIHBlcmZvcm0gc29tZSBvcGVyYXRpb25zoaggW3JmYzIwMjZdLiAgVGhpcyBk b2N1bWVudCBtZWV0cw0KPiB0aGF0IGJhciBvZiB0aGUgZGVzY3JpcHRpb24sIGJ1dCB0aGVyZSBp cyBjbGVhcmx5IG5vdCBhIGxvdCBvZg0KPiBwcmFjdGljZSBiZWhpbmQgdGhlIGNvbnNpZGVyYXRp b25zIKFWIHdoaWNoIEkgdGhpbmsgaXMgcmVmbGVjdGVkIGluIHRoZQ0KPiBsYWNrIG9mIHNpZ25p ZmljYW50IGNvbW1lbnRzIGZyb20gdGhlIFdHLiAgSSB3b3VsZCBwcmVmZXIgaWYgdGhpcw0KPiBk b2N1bWVudCBhcyBJbmZvcm1hdGlvbmFsLCBwZW5kaW5nIHNvbWUgYWN0dWFsIGV4cGVyaWVuY2Uu ICBCdXQgSaGmbGwNCj4gc2V0dGxlIGZvciBhIGdvb2QgZXhwbGFuYXRpb24gKHRvIGJlIGFsc28g aW5jbHVkZWQgaW4gdGhlIFNoZXBoZXJkoaZzDQo+IHdyaXRlLXVwKSBvZiB3aHkgQkNQLg0KDQpi ZWNhdXNlIGl0IGlzLCBhcyB5b3UgcXVvdGUsIHRoZSBjb21tdW5pdHkncyBiZXN0IGN1cnJlbnQg dGhpbmtpbmehS29uDQp3aGF0IGlzIGJlbGlldmVkIHRvIGJlIHRoZSBiZXN0IHdheSB0byBwZXJm b3JtIHNvbWUgb3BlcmF0aW9ucw0KDQphcyB0byBzaWduaWZpY2FudCBjb21tZW50cyBmcm9tIHRo ZSB3Zywgd2VsY29tZSB0byBzaWRyOyBpdCdzIGVpdGhlciBhDQpwb29scGFoIG9yIHNpbGVudCBh c3NlbnQuDQoNCj4gMi4gVGhpcyBkb2N1bWVudCwgYXMgYSBjb21wYW5pb24gb2YgZHJhZnQtaWV0 Zi1zaWRyLWJncHNlYy1wcm90b2NvbCwNCj4gaXMgdGhlIG9ubHkgcGxhY2Ugd2hlcmUgT3BlcmF0 aW9uYWwgKG9yIE1hbmFnZW1lbnQpIENvbnNpZGVyYXRpb25zIGFyZQ0KPiBkaXNjdXNzZWQuICBI b3dldmVyLCBpbXBvcnRhbnQgaXRlbXMgcmVjb21tZW5kZWQgaW4gUkZDNTcwNg0KPiAoR3VpZGVs aW5lcyBmb3IgQ29uc2lkZXJpbmcgT3BlcmF0aW9ucyBhbmQgTWFuYWdlbWVudCBvZiBOZXcgUHJv dG9jb2xzDQo+IGFuZCBQcm90b2NvbCBFeHRlbnNpb25zKSwgc3VjaCBhcyBtaWdyYXRpb24gb3Ig ZmF1bHQgbWFuYWdlbWVudCBhcmUNCj4gbm90IGNvdmVyZWQgYW55d2hlcmUuICBHaXZlbiB0aGUg dG9uZSBhbmQgY3VycmVudCBjb250ZW50IG9mIHRoaXMNCj4gZG9jdW1lbnQsIEkgZG9uoaZ0IHRo aW5rIGV4dGVuZGluZyBpdCBpcyB0aGUgd2F5IGZvcndhcmQgLS0gc28sIGluIG15DQo+IHJldmll dyBvZiBkcmFmdC1pZXRmLXNpZHItYmdwc2VjLXByb3RvY29sIFsxXSwgSSBhc2tlZCB0aGUgYXV0 aG9ycyB0bw0KPiBpbmNsdWRlIGFuIE9wZXJhdGlvbnMgYW5kIE1hbmFnZW1lbnQgU2VjdGlvbiB0 aGVyZSBhbmQgdG8gY29uc2lkZXINCj4gdXNpbmcgdGhpcyBkb2N1bWVudCBhcyB0aGUgYmFzZS4g IE1lcmdpbmcgdGhpcyBkb2N1bWVudCBpbnRvDQo+IGRyYWZ0LWlldGYtc2lkci1iZ3BzZWMtcHJv dG9jb2wgaXMgYW4gYWN0aW9uIHRoYXQgdGhlDQo+IFdHL2F1dGhvcnMvQ2hhaXJzL1NoZXBoZXJk cyBzaG91bGQgY29uc2lkZXIuICBXaGlsZSB0aGF0IGlzIG15DQo+IHByZWZlcnJlZCBzb2x1dGlv biwgSSB3aWxsIG1vdmUgZm9yd2FyZCB3aXRoIHB1YmxpY2F0aW9uIG9mIHRoaXMNCj4gZG9jdW1l bnQgaWYgdGhhdCBpcyB0aGUgY29uc2Vuc3VzLg0KDQpzaWRyIGhhcyBiZWVuIHNlcGFyYXRpbmcg cHJvdG9jb2wgZnJvbSBvcHMgYWxsIHRoZSB3YXkgZG93biB0aGUgbGluZSwNCmUuZy4gaW4gb3Jp Z2luIHZhbGlkYXRpb24uICBoZWNrLCB5b3UgaGF2ZSBzZXBhcmF0ZWQgKHByb3RvY29sID09IHNp ZHIpDQpmcm9tIChvcHMgPT0gc2lkcm9wcykuDQoNCj4gTTEuIEluIFNlY3Rpb24gNSwgeW91IHdy b3RlOiChp0FzIHRoZXkgYXJlIG5vdCBmb3JtYWxseSB2ZXJpZmlhYmxlLCBhbg0KPiBlQkdQIGxp c3RlbmVyIFNIT1VMRCBOT1Qgc3Ryb25nbHkgdHJ1c3QgdW5zaWduZWQgc2VjdXJpdHkgbWFya2lu Z3MNCj4gc3VjaCBhcyBjb21tdW5pdGllcyByZWNlaXZlZCBhY3Jvc3MgYSB0cnVzdCBib3VuZGFy eS6hqCAgQWZ0ZXIgcmVhZGluZw0KPiB0aGlzIHBpZWNlIG9mIHRleHQgc2V2ZXJhbCB0aW1lcywg SSB0aGluayBJIHBpY2tlZCB1cCBvbiB0aGUgc3VidGxlDQo+IG1lc3NhZ2U6IGRvbqGmdCB0cnVz dCB1bnNpZ25lZCAqc2VjdXJpdHkgbWFya2luZ3MqIC0tIHZzIHdoYXQgSSBnb3QNCj4gZnJvbSB0 aGUgZmlyc3Qgbi0xIHJlYWRpbmdzOiBkb26hpnQgdHJ1c3QgY29tbXVuaXRpZXMuICBJIHRoaW5r IHRoYXQNCj4gdGhpcyBwYXJhZ3JhcGggd291bGQgZ3JlYXRseSBiZW5lZml0IGZyb20gbW9yZSBk ZXRhaWxzIG9yIGFuIGV4YW1wbGUNCj4gcmVsYXRlZCB0byBzZWN1cml0eSBtYXJraW5ncy4NCg0K ICAgQkdQc2VjIGRvZXMgbm90IHNpZ24gb3ZlciBjb21tdW5pdGllcywgc28gdGhleSBhcmUgbm90 IGZvcm1hbGx5DQogICB0cnVzdGFibGUuICBBZGRpdGlvbmFsbHksIG91dHNvdXJjaW5nIHZlcmlm aWNhdGlvbiBpcyBub3QgcHJ1ZGVudA0KICAgc2VjdXJpdHkgcHJhY3RpY2UuICBUaGVyZWZvcmUg YW4gZUJHUCBsaXN0ZW5lciBTSE9VTEQgTk9UIHN0cm9uZ2x5DQogICB0cnVzdCB1bnNpZ25lZCBz ZWN1cml0eSBzaWduYWxpbmcsIHN1Y2ggYXMgY29tbXVuaXRpZXMsIHJlY2VpdmVkDQogICBhY3Jv c3MgYSB0cnVzdCBib3VuZGFyeS4NCg0KPiBNMi4gSW4gU2VjdGlvbiA3LiAoUm91dGluZyBQb2xp Y3kpOiChp0FzIEJHUHNlYyB3aWxsIGJlIHJvbGxlZCBvdXQNCj4gb3ZlcqFLYSBsb25nIHRpbWUu ICBIZW5jZSBhIG5vcm1hbCBvcGVyYXRvcidzIHBvbGljeSBTSE9VTEQgTk9UIGJlDQo+IG92ZXJs eSBzdHJpY3QsIHBlcmhhcHMgcHJlZmVycmluZyBWYWxpZCBwYXRocyBhbmQgZ2l2aW5nIHZlcnkg bG93DQo+IHByZWZlcmVuY2UsIGJ1dCBzdGlsbCB1c2luZywgTm90IFZhbGlkIHBhdGhzLqGoICBU aGlzIHJlY29tbWVuZGF0aW9uDQo+IGNvbmNlcm5zIG1lIGJlY2F1c2UgoadOb3QgVmFsaWShqCB0 YWxrcyBkaXJlY3RseSB0byB0aGUgZmFjdCB0aGF0IHRoZQ0KPiBhbm5vdW5jZW1lbnQgaXMsIHdl bGwsIG5vdCB2YWxpZCChViB2cyBqdXN0IHVuYWJsZSB0byBiZSB2ZXJpZmllZA0KPiAoYmVjYXVz ZSB0aGVyZaGmcyBubyBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUsIGZvciBleGFtcGxlKS4gIFRoZSBu ZXh0DQo+IHNlbnRlbmNlIGlzIGEgcmVmbGVjdGlvbiBvZiBteSBjb25jZXJuOiChp09wZXJhdG9y cyBzaG91bGQgYmUgYXdhcmUNCj4gdGhhdCBhY2NlcHRpbmcgTm90IFZhbGlkIGFubm91bmNlbWVu dHOhS3dpbGwgb2Z0ZW4gYmUgdGhlIGVxdWl2YWxlbnQgb2YNCj4gdHJlYXRpbmcgdGhlbSBhcyBm dWxseSBWYWxpZC6hqCAgSS1ELnNpZHItYmdwc2VjLXByb3RvY29sIHN1Z2dlc3RzIHRoZQ0KPiBz YW1lIHRoaW5nIChpbiA1LjEsIHBvaW50aW5nIHRvIHRoaXMgZG9jdW1lbnQpLiAgSSBhbSBsZWZ0 IHdpdGggdGhlDQo+IHF1ZXN0aW9uOiB3aHkgdmFsaWRhdGUgYXQgYWxsIGlmIHRoZSBCQ1AgcmVj b21tZW5kYXRpb24gaXMgdG8gdXNlIGFsbA0KPiBhbm5vdW5jZW1lbnRzIG5vIG1hdHRlciB0aGUg c3RhdGU/ICBJIG9idmlvdXNseSByZWFsaXplIHRoYXQgaXQgaXMNCj4gc3RpbGwgZWFybHkgZGF5 cyChViBtYXliZSBpdCBpcyB0b28gZWFybHkgZm9yIGEgQkNQIGRvY3VtZW50IGlmIHRoZQ0KPiCh p3ByYWN0aWNloaggaXMgbm90IHRoZXJlIHlldKFLDQoNCnRoaXMgaXMgdGhlIHJlc3VsdCBvZiBh IHByaW1yb3NlIHBhdGggYW5kLCBhcyBpIGFtIGEgbmFnZ3VtaXRlLCBpIGFtDQpxdWl0ZSB3aWxs aW5nIHRvIGJlIHN0cmljdCBoZXJlLiAgYnV0IGhvdyB3ZSBnb3QgaGVyZSB3YXM7IHBhdGhzIGFy ZQ0KZWl0aGVyIHZhbGlkIG9yIG5vdDsgeW91IGRvIG5vdCBrbm93IGlmIGl0IGlzIG5vdCB2YWxp ZCBiZWNhdXNlIG9mIGxhY2sNCm9mIGN1cnJlbnQgcnBraSBkYXRhIG9yIGFuIGF0dGNrIChtdWNo IGJsb29kIHNwaWxsZWQgaGVyZSkuICBvbmNlIHlvdQ0KaGF2ZSBzd29sbG93ZWQgdGhpcyByZWR1 Y2VkIHNpZ25hbGluZyBrb29sYWlkLCB5b3UgY291bGQgaGF2ZSBhIG5vdA0KdmFsaWQgcGF0aCBi ZWNhdXNlIHlvdSBqdXN0IGRvbid0IGhhdmUgdGhlIGRhdGEsIGEgd2Vha2VyIHN0YXRlIHRoYW4N CmZhaWx1cmUuICB0aGlzIGxlZnQgdXMgd3Vzc2luZyBvdXQgb24gd2hhdCB0byBkbyB3aXRoIHRo ZW0gaW4gYmVzdCBwYXRoDQpjaG9pY2UuDQoNCmhvdyBhYm91dCBzL1NIT1VMRCBOT1QvTUlHSFQg Tk9ULz8NCg0Kb3IsIGFzIGkgYW0gYSBuYWdndW1pdGUsIGkgYW0gd2lsbGluZyB0byBzYXkganVz dCBkcm9wIHRoZSBzdWNrZXJzLCBhbmQNCmJsYW1lIGl0IG9uIHlvdSA6KQ0KDQo+IE0zLiBBbHNv IGluIFNlY3Rpb24gNzogoaehS3NpZ25lZCBwYXRocyB0aGF0IGFyZSBOb3QgVmFsaWQgYW5kIHll dA0KPiBwcm9wYWdhdGVkoUtTSE9VTEQgaGF2ZSB0aGVpciBzaWduYXR1cmVzIGtlcHQgaW50YWN0 oUuhqCBTZWN0aW9uDQo+IDQuMi4gKENvbnN0cnVjdGluZyB0aGUgQkdQc2VjX1BhdGggQXR0cmli dXRlKSBvZg0KPiBkcmFmdC1pZXRmLXNpZHItYmdwc2VjLXByb3RvY29sIHNheXM6IKGnYSBTaWdu YXR1cmVfQmxvY2sgd2hpY2ggaXMgbm90DQo+IGRlZW1lZCAnVmFsaWQnoUtzdWNoIFNpZ25hdHVy ZV9CbG9ja3MgTVVTVCBOT1QgYmUgcmVtb3ZlZC6hqCAgVGhlDQo+IKGnU0hPVUxEoaggaW4gdGhp cyBkb2N1bWVudCBpcyBhdCBvZGRzIHdpdGggdGhlIKGnTVVTVCBOT1ShqCBpbiB0aGUgQkdQU2Vj DQo+IHNwZWM7IHBsZWFzZSBzL1NIT1VMRC9NVVNULCBvciAoZXZlbiBiZXR0ZXIpIHMvU0hPVUxE L3Nob3VsZC4NCg0KICAgQmVjYXVzZSBvZiBwb3NzaWJsZSBSUEtJIHZlcnNpb24gc2tldywgYW4g QVMgUGF0aCB3aGljaCBkb2VzIG5vdA0KICAgdmFsaWRhdGUgYXQgcm91dGVyIFIwIG1pZ2h0IHZh bGlkYXRlIGF0IFIxLiAgVGhlcmVmb3JlLCBzaWduZWQgcGF0aHMNCiAgIHRoYXQgYXJlIE5vdCBW YWxpZCBhbmQgeWV0IHByb3BhZ2F0ZWQgKGJlY2F1c2UgdGhleSBhcmUgY2hvc2VuIGFzDQogICBi ZXN0IHBhdGgpIHNob3VsZCBoYXZlIHRoZWlyIHNpZ25hdHVyZXMgbGVmdCBpbnRhY3QgYW5kIE1V U1QgYmUNCiAgIHNpZ25lZCBpZiBzZW50IHRvIGV4dGVybmFsIEJHUHNlYyBzcGVha2Vycy4NCg0K PiBNNC4gU3RpbGwgaW4gU2VjdGlvbiA3OiChp1RvIHByZXZlbnQgZXhwb3N1cmUgb2YgdGhlIGlu dGVybmFscyBvZiBCR1ANCj4gQ29uZmVkZXJhdGlvbnMgW1JGQzUwNjVdLCBhIEJHUHNlYyBzcGVh a2VyIHdoaWNoIGlzIGEgTWVtYmVyLUFTIG9mIGENCj4gQ29uZmVkZXJhdGlvbiBNVVNUIE5PVCBz aWduIHVwZGF0ZXMgc2VudCB0byBhbm90aGVyIE1lbWJlci1BUyBvZiB0aGUNCj4gc2FtZSBDb25m ZWRlcmF0aW9uLqGoICBUaGlzIGlzIGFub3RoZXIgY2FzZSB3aGVyZSB0aGUgQkdQU2VjIHNwZWMg c2F5cw0KPiBzb21ldGhpbmcgZGlmZmVyZW50OiBTZWN0aW9uIDQuMy4gKFByb2Nlc3NpbmcgSW5z dHJ1Y3Rpb25zIGZvcg0KPiBDb25mZWRlcmF0aW9uIE1lbWJlcnMpIHByZXNlbnRzIGEgbWFuZGF0 b3J5IG1lY2hhbmlzbSB0aGF0IGluY2x1ZGVzDQo+IHNpZ25pbmcsIGJ1dCBub3QgbmVjZXNzYXJp bHkgdmFsaWRhdGluZy4gIEJUVywgaWYgdGhlIHVwZGF0ZXMgYXJlIG5vdA0KPiBzaWduZWQsIHRo ZW4gdGhlIHNpZ25lZCBwYXRoIHdvdWxkIGJlIGJyb2tlbiwgZXZlbiBpZiBhbGwgdGhlIHJvdXRl cnMNCj4gaW4gdGhlIHBhdGggc3VwcG9ydCBCR1BTZWMsIHJpZ2h0PyAgSXMgdGhhdCB0aGUgcmVj b21tZW5kYXRpb24/DQoNCml0IGlzIGNvbW1vbiBmb3IgYSBiZ3AgY29uZmVkZXJhdGlvbiB0byBp bmNsdWRlIHByaXZhdGUgQVNzIGZvciB3aGljaA0KdGhlcmUgY2FuIGJlIG5vIHVuaXF1ZSBhdXRo b3JhdGl2ZSByb3V0ZXIgY3JlZGVudGlhbHMgaW4gdGhlIHJwa2kuDQpoZW5jZSBpIGFtIHN1c3Bp Y2lvdXMgb2YgdGhlIHByb3RvY29sIHNwZWMuDQoNCj4gTTUuIEluIFNlY3Rpb24gODogoaehS3Jv dXRlcnMnIGNsb2NrcyBNVVNUIGJlIGNvcnJlY3ShS6GoIFdoYXQgZG9lcyB0aGlzDQo+IG1lYW4/ ICBDb3JyZWN0IHdpdGggcmVzcGVjdCB0byB3aGF0PyAgTGF0ZXIgKDIgcGFyYWdyYXBocykgeW91 IGRvDQo+IG1lbnRpb24gUkZDNTkwNSwgc2hvdWxkIHRoYXQgYmUgdGhlIHJlZmVyZW5jZSBoZXJl PyAgTWF5YmUgbWFrZSB0aGUNCj4gY2xvY2sgdG9waWMgb25lIHBhcmFncmFwaCB0byBhdm9pZCBj b25mdXNpb24uDQoNCiAgIEFzIGEgcm91dGVyIG11c3QgZXZhbHVhdGUgY2VydGlmaWNhdGVzIGFu ZCBST0FzIHdoaWNoIGFyZSB0aW1lDQogICBkZXBlbmRlbnQsIHJvdXRlcnMnIGNsb2NrcyBNVVNU IGJlIGNvcnJlY3QgdG8gYSB0b2xlcmFuY2Ugb2YNCiAgIGFwcHJveGltYXRlbHkgYW4gaG91ci4g IFRoZSBjb21tb24gYXBwcm9hY2ggaXMgZm9yIG9wZXJhdG9ycyB0bw0KICAgZGVwbG95IHNlcnZl cnMgdGhhdCBwcm92aWRlIHRpbWUgc2VydmljZSwgc3VjaCBhcyBbUkZDNTkwNV0sIHRvDQogICBj bGllbnQgcm91dGVycy4NCg0KPiBSMS4gVGhlIHJlZmVyZW5jZSB0byBCR1BzZWMgc2hvdWxkIGJl IGRyYWZ0LWlldGYtc2lkci1iZ3BzZWMtcHJvdG9jb2wNCj4gKGFuZCBub3QgSS1ELmlldGYtc2lk ci1iZ3BzZWMtb3ZlcnZpZXcpLiAgSSB0aGluayBpdCBpcyBvayB0bw0KPiByZWZlcmVuY2UgSS1E LmlldGYtc2lkci1iZ3BzZWMtb3ZlcnZpZXcgaW4gdGhlIFN1Z2dlc3RlZCBSZWFkaW5nIGFzIGFu DQo+IEluZm9ybWF0aXZlIHJlZmVyZW5jZS4gIFNpbWlsYXJseSwgcmZjNjQ4MCwgcmZjNjQ4MSBh bmQgcmZjNjQ4MiBzaG91bGQNCj4gYmUgbWFkZSBJbmZvcm1hdGl2ZSBhcyB3ZWxsLg0KDQphY2sN Cg0KPiBSMi4gU2VjdGlvbiA3OiChp1RoaXMgaW1wbGllcyB0aGF0IHRoZSByb3V0ZSBzZXJ2ZXIg Y3JlYXRlcyBzaWduYXR1cmVzDQo+IHBlciBjbGllbnQgaW5jbHVkaW5nIGl0cyBvd24gQVMgaW4g dGhlIEJHUHNlY19QYXRoIGFuZCB0aGUgdGFyZ2V0DQo+IEFTZXMsIHNlZSAyLjIuMiBvZiBbSS1E LmlldGYtaWRyLWl4LWJncC1yb3V0ZS1zZXJ2ZXJdLqGoICBJIHRoaW5rIHRoaXMNCj4gcmVmZXJl bmNlIGlzIG5vdCBjb3JyZWN0IGJlY2F1c2UgSS1ELmlldGYtaWRyLWl4LWJncC1yb3V0ZS1zZXJ2 ZXINCj4gZG9lc26hpnQgc2F5IGFueXRoaW5nIGFib3V0IEJHUFNlYy4gIFRoYXQgc2VjdGlvbiBk b2VzIHNheSB0aGUNCj4gb3Bwb3NpdGU6IKGndGhlIHJvdXRlIHNlcnZlciBTSE9VTEQgTk9UIHBy ZXBlbmQgaXRzIG93biBBUyBudW1iZXIgdG8NCj4gdGhlIEFTX1BBVEggc2VnbWVudCBub3IgbW9k aWZ5IHRoZSBBU19QQVRIIHNlZ21lbnQgaW4gYW55IG90aGVyIHdheaGoLg0KPiBNYXliZSBwb2lu dCBhdCA0LjIgb2YgZHJhZnQtaWV0Zi1zaWRyLWJncHNlYy1wcm90b2NvbCBpbnN0ZWFkLg0KDQog ICBBIHJvdXRlIHNlcnZlciBpcyB1c3VhbGx5ICd0cmFuc3BhcmVudCcsIGkuZS4gZG9lcyBub3Qg aW5zZXJ0IGFuIEFTDQogICBpbnRvIHRoZSBwYXRoIHNvIGFzIG5vdCB0byBpbmNyZWFzZSB0aGUg QVMgaG9wIGNvdW50IGFuZCB0aGVyZWJ5DQogICBhZmZlY3QgZG93bnN0cmVhbSBwYXRoIGNob2lj ZXMuICBCdXQsIHdpdGggQkdQc2VjLCBhIGNsaWVudCByb3V0ZXIgUg0KICAgbmVlZHMgdG8gYmUg YWJsZSB0byB2YWxpZGF0ZSBwYXRocyB3aGljaCBhcmUgZm9yd2FyZCBzaWduZWQgdG8gUi4NCiAg IEJ1dCB0aGUgc2VuZGluZyByb3V0ZXIgY2FuIG5vdCBnZW5lcmF0ZSBzaWduYXR1cmVzIHRvIGFs bCB0aGUNCiAgIHBvc3NpYmxlIGNsaWVudHMuICBUaGVyZWZvcmUgYSBCR1BzZWMtYXdhcmUgcm91 dGUgc2VydmVyIG5lZWRzIHRvDQogICB2YWxpZGF0ZSB0aGUgaW5jb21pbmcgQkdQc2VjX1BhdGgs IGFuZCB0byBmb3J3YXJkIHVwZGF0ZXMgd2hpY2ggY2FuDQogICBiZSB2YWxpZGF0ZWQgYnkgY2xp ZW50cyB3aGljaCBtdXN0IHRoZXJlZm9yZSBrbm93IHRoZSByb3V0ZSBzZXJ2ZXIncw0KICAgQVMu ICBUaGlzIGltcGxpZXMgdGhhdCB0aGUgcm91dGUgc2VydmVyIGNyZWF0ZXMgc2lnbmF0dXJlcyBw ZXIgY2xpZW50DQogICBpbmNsdWRpbmcgaXRzIG93biBBUyBpbiB0aGUgQkdQc2VjX1BhdGgsIGZv cndhcmQgc2lnbmluZyB0byBlYWNoDQogICBjbGllbnQgQVMsIHNlZSBbSS1ELmlldGYtc2lkci1i Z3BzZWMtcHJvdG9jb2xdLiAgVGhlIHJvdXRlIHNlcnZlcg0KICAgdXNlcyBwQ291bnQgb2YgemVy byB0byBub3QgaW5jcmVhc2UgdGhlIGVmZmVjdGl2ZSBBUyBob3AgY291bnQsDQogICB0aGVyZWJ5 IHJldGFpbmluZyB0aGUgaW50ZW50IG9mICd0cmFuc3BhcmVuY3knLg0KDQo+IFIzLiBSRkM2ODEx IHNob3VsZCBiZSBhIE5vcm1hdGl2ZSByZWZlcmVuY2UuDQoNCmFjaw0KDQo+IE1pbm9yOg0KPiBt MS4gVGhlIElQdjQgZXhhbXBsZXMgaW4gU2VjdGlvbiA3IHNob3VsZCB1c2UgYWRkcmVzc2VkIGZy b20gcmZjNjg5MC4NCg0KY2FuJ3QuICBuZWVkIG1vcmUgdGhhbiBhIC8yNC4gIHdlIHdlbnQgdGhy b3VnaCB0aGlzIGluIG9yaWdpbg0KdmFsaWRhdGlvbi4NCg0KPiBtMi4gSW4gU2VjdGlvbiA3OiCh p1RoZXJlZm9yZSwgdW5sZXNzIGxvY2FsIHBvbGljeSBlbnN1cmVzIG90aGVyd2lzZSwgYQ0KPiBz aWduZWQgcGF0aCBsZWFybmVkIHZpYSBpQkdQIE1BWSBiZSBOb3QgVmFsaWQuoaggIFRoYXQgoadN QVmhqCBpcyBub3QNCj4gbm9ybWF0aXZlIGluIHRoaXMgY29udGV4dCwgYnV0IGl0IGlzIHN0YXRp bmcgYSBmYWN0OiBzL01BWS9tYXkuDQoNCmFjaw0KDQo+IG0zLiBBbHNvIGluIFNlY3Rpb24gNzog oadJZiBpdCBpcyBrbm93biB0aGF0IGEgQkdQc2VjIG5laWdoYm9yIGlzIG5vdCBhDQo+IHRyYW5z cGFyZW50IHJvdXRlIHNlcnZlciwgYW5kIHRoZSByb3V0ZXIgcHJvdmlkZXMgYSBrbm9iIHRvIGRp c2FsbG93IGENCj4gcmVjZWl2ZWQgcENvdW50IChwcmVwZW5kIGNvdW50LCB6ZXJvIGZvciB0cmFu c3BhcmVudCByb3V0ZSBzZXJ2ZXJzKSBvZg0KPiB6ZXJvLCB0aGF0IGtub2IgU0hPVUxEIGJlIGFw cGxpZWQuoaggIFRoZXJlIGFyZSBvdGhlciBjYXNlcyB3aGVuIHBDb3VudA0KPiAwIGlzIG9rLCBk cmFmdC1pZXRmLXNpZHItYXMtbWlncmF0aW9uIGZvciBleGFtcGxlLiAgSSBrbm93IHRoYXQNCj4g oadTSE9VTEShqCBhbGxvd3Mgb3RoZXIgY2FzZXMsIGJ1dCBtYXliZSB3b3JraW5nIGluIHRoZSBy b3V0ZXIgc2VydmVyIGFzDQo+IGFuIGV4YW1wbGUgbWlnaHQgYmUgYW4gaW1wcm92ZW1lbnQuDQoN CiAgIElmIGl0IGlzIGtub3duIHRoYXQgYSBCR1BzZWMgbmVpZ2hib3IgaXMgbm90IGEgdHJhbnNw YXJlbnQgcm91dGUNCiAgIHNlcnZlciwgb3IgaXMgb3RoZXJ3aXNlIHZhbGlkbHkgdXNpbmcgcENv dW50PTAgKGUsZywgc2VlDQogICBbSS1ELmlldGYtc2lkci1hcy1taWdyYXRpb25dKSwgYW5kIHRo ZSByb3V0ZXIgcHJvdmlkZXMgYSBrbm9iIHRvDQogICBkaXNhbGxvdyBhIHJlY2VpdmVkIHBDb3Vu dCBvZiB6ZXJvLCB0aGF0IGtub2IgU0hPVUxEIGJlIGFwcGxpZWQuDQogICBSb3V0ZXJzIHNob3Vs ZCBkaXNhbGxvdyBwQ291bnQgMCBieSBkZWZhdWx0Lg0KDQo+IG00LiBTZWN0aW9uIDkuIChTZWN1 cml0eSBDb25zaWRlcmF0aW9ucyk6IKGnVGhlIG1ham9yIHNlY3VyaXR5DQo+IGNvbnNpZGVyYXRp b25zIGZvciB0aGUgQkdQc2VjIHByb3RvY29sIGFyZSBkZXNjcmliZWQgaW4NCj4gW0ktRC5pZXRm LXNpZHItYmdwc2VjLXByb3RvY29sXS6hqCAgQXJlIHRoZXJlIG90aGVyIHNlY3VyaXR5DQo+IGNv bnNpZGVyYXRpb25zIG5vdCBtZW50aW9uZWQgdGhlcmU/DQoNCnVoLCBub25lIGNvbWUgdG8gbWlu ZCB3aXRoIG9ubHkgb25lIGN1cHBhLg0KDQo+IE5pdHM6DQo+IG4xLiBJbnRyb2R1Y3Rpb246IKGn oUtvcmlnaW4gdmFsaWRhdGlvbqFLd2lsbCBvY2N1ciBvdmVyIHRoZSBuZXh0IHR3byB0bw0KPiB0 aHJlZSB5ZWFycyBhbmQgdGhhdCBCR1BzZWMgd2lsbCBzdGFydCB0byBkZXBsb3kgd2VsbCBhZnRl ciB0aGF0LqGoDQo+IFJlY29tbWVuZGF0aW9uOiBhdm9pZCBzcGVjaWZpYyB0aW1lZnJhbWVzLCBi ZSBhIGxpdHRsZSB2YWd1ZXINCj4gKHNob3J0L21lZGl1bS9sb25nIHRlcm0pLiAgSSBub3RpY2Vk IHRoYXQgdGhlIGZpcnN0IHZlcnNpb24gb2YNCj4gZHJhZnQteW1iay1iZ3BzZWMtb3BzIGFsc28g bWVudGlvbmVkIKGndHdvIHRvIGZpdmUgeWVhcnOhqCAoaW4gMjAxMSEpLg0KDQp3ZWxsLCB3ZSB3 ZXJlIHVzaW5nIHRoZSBpcHY2IHRpbWUgc2VydmljZSwgY2xlYXJseSBhIG1pc3Rha2UgOikNCg0K ICAgQkdQc2VjLCBbSS1ELmlldGYtc2lkci1iZ3BzZWMtcHJvdG9jb2xdLCBpcyBhIG5ldyBwcm90 b2NvbCB3aXRoIG1hbnkNCiAgIG9wZXJhdGlvbmFsIGNvbnNpZGVyYXRpb25zLiAgSXQgaXMgZXhw ZWN0ZWQgdG8gYmUgZGVwbG95ZWQNCiAgIGluY3JlbWVudGFsbHkgb3ZlciBhIG51bWJlciBvZiB5 ZWFycy4gIEFzIGNvcmUgQkdQc2VjLWNhcGFibGUgcm91dGVycw0KICAgbWF5IHJlcXVpcmUgbGFy Z2UgbWVtb3J5IGFuZC9vciBtb2Rlcm4gQ1BVcywgaXQgaXMgdGhvdWdodCB0aGF0DQogICBvcmln aW4gdmFsaWRhdGlvbiBiYXNlZCBvbiB0aGUgUlBLSSwgW1JGQzY4MTFdLCB3aWxsIG9jY3VyIG92 ZXIgc29tZQ0KICAgeWVhcnMgYW5kIHRoYXQgQkdQc2VjIHdpbGwgc3RhcnQgdG8gZGVwbG95IGFm dGVyIHRoYXQuDQoNCj4gbjIuIHMvIGNsaWVudCBjb25lLCBpLmUuIGFuIFJSIGNsaWVudCBvciB0 aGUgdHJhbnNpdGl2ZSBjbG9zdXJlIG9mDQo+IHRoZWlyIGN1c3RvbWVycycgY3VzdG9tZXJzJyBj dXN0b21lcnMnIGV0Yy4vIGNsaWVudCBjb25lLCBpLmUuIGFuIFJSDQo+IGNsaWVudCBvciByZWFj aGFibGUgdHJhbnNpdGl2ZWx5IHRocm91Z2ggb25lIG9mIHRoZW0uDQoNCiAgIEluIGEgZnVsbHkg QkdQc2VjIGVuYWJsZWQgQVMsIFJvdXRlIFJlZmxlY3RvcnMgTVVTVCBoYXZlIEJHUHNlYw0KICAg ZW5hYmxlZCBpZiBhbmQgb25seSBpZiB0aGVyZSBhcmUgZUJHUCBzcGVha2VycyBpbiB0aGVpciBj bGllbnQgY29uZSwNCiAgIGkuZS4gYW4gUlIgY2xpZW50IG9yIHRoZSB0cmFuc2l0aXZlIGNsb3N1 cmUgb2YgYSBjbGllbnQncyBjdXN0b21lcnMnDQogICBjdXN0b21lcnMnIGN1c3RvbWVycycgZXRj Lg0KDQo+IG4zLiChp0FzIHRoZSB2YXN0IG1ham9yaXR5ICg4NCUpIG9mIEFTcyBhcmUgc3R1YnMs IGFuZCB0aGV5IGFubm91bmNlDQo+IHRoZSBtYWpvcml0eSBvZiBwcmVmaXhlc6FLoaggQSByZWZl cmVuY2Ugd291bGQgYmUgbmljZS4NCg0KbG9zdCBpbiB0aW1lLiAgcmVtb3ZlZC4gIHNob3VsZCBy ZXJ1biBtZWFzdXJlbWVudCwgYnV0IG5vdCB0b2RheS4NCg0KPiBuNC4goadCZWNhdXNlIG9mIHBv c3NpYmxlIFJQS0kgdmVyc2lvbiBza2V3oUuhqCAgSSBndWVzcyB5b3UgbWVhbiBsYWNrIG9mDQo+ IHN5bmOhSw0KDQppIGRvbid0IHRoaW5rIHNvLiAgaSB0YWtlIGxhY2sgb2Ygc3luYyBtZWFuaW5n IGkgY2FuIG5vdCByZWFjaCBhIGNhY2hlDQpvciBwdWJsaXNoZXIuICB2ZXJzaW9uIHNrZXcgY291 bGQgb2NjdXIgd2hlbiB0aW1lcnMgaGF2ZSBub3QgeWV0IGZpcmVkLg0KYnV0IGl0J3MgZnV6enku DQoNCj4gbjUuIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zLiAgUGxlYXNlIHdyaXRlIHNvbWV0aGlu ZyBhbG9uZyB0aGUgbGluZXMNCj4gb2Y6IKGnVGhpcyBkb2N1bWVudCBkZXNjcmliZXMgb3BlcmF0 aW9uYWwgY29uc2lkZXJhdGlvbnMgZm9yIHRoZQ0KPiBkZXBsb3ltZW50IG9mIEJHUHNlYy4gIFRo ZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBmb3IgQkdQc2VjIGFyZaFLoagNCg0KOS4gIFNlY3Vy aXR5IENvbnNpZGVyYXRpb25zDQoNCiAgIFRoaXMgZG9jdW1lbnQgZGVzY3JpYmVzIG9wZXJhdGlv bmFsIGNvbnNpZGVyYXRpb25zIGZvciB0aGUgZGVwbG95bWVudA0KICAgb2YgQkdQc2VjLiAgVGhl IHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGZvciBCR1BzZWMgYXJlIGRlc2NyaWJlZCBpbg0KICAg W0ktRC5pZXRmLXNpZHItYmdwc2VjLXByb3RvY29sXS4NCg0KaSBkbyBub3QgcGxhbiB0byBwdXNo IHRoZSBidXR0b24gdW50aWwgeW91IGFuZCBjaGFpcnMgc2F5IHdlJ3JlDQpjb252ZXJnZWQuDQoN CnJhbmR5DQo= From nobody Fri Dec 2 09:20:02 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09F2E1297E8 for ; Fri, 2 Dec 2016 09:20:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2GcMzT_-JFgv for ; Fri, 2 Dec 2016 09:19:58 -0800 (PST) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F064E128B38 for ; Fri, 2 Dec 2016 09:19:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=17678; q=dns/txt; s=iport; t=1480699190; x=1481908790; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=9IrBZLV/F5hZJ+eMFejMlSP2PaHKZ7EA40pc5n5Nxvo=; b=d8jTpL1BezZjLbkXdDg6jlB39CG2+zHQDWvp0kZ4QBbGv0i0KWVS4KVp 92w50t535et2Q2Y2z/V5eaih5yTwozzIIzw2nvvXqIJdRXIwKQfFtru95 TNbJdpi2JoJGmGh3xfeDnpwp/AfadZrtaC3pcgyzfULkb8csqhiR+Wtkd A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B2AQB8rEFY/5tdJa1cGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgnNFAQEBAQEfWoEGB40/lwqPWoUiggaGIgIaggA/FAECAQEBAQEBAWI?= =?us-ascii?q?ohGkBBAEjVgULAgEGAkICAgIwJQIEDgWIZwiOf51HgikviwEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEchj6BfYJehDeDFi2CMAWUeoVpAZETkDmSDAEfN4EZMQEBhSJ?= =?us-ascii?q?yhkMrgQOBDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.33,287,1477958400"; d="scan'208,217";a="176783286" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 Dec 2016 17:19:49 +0000 Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id uB2HJoIR006158 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 2 Dec 2016 17:19:50 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 2 Dec 2016 11:19:49 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Fri, 2 Dec 2016 11:19:49 -0600 From: "Alvaro Retana (aretana)" To: Randy Bush Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-ops-10 Thread-Index: AQHSNR62bJsPySrh80ivtkDVsKGkYKD1Y5yA///DegA= Date: Fri, 2 Dec 2016 17:19:49 +0000 Message-ID: References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_B8E83589E2B84D93BEC1108F3BD1CF41ciscocom_" MIME-Version: 1.0 Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 17:20:01 -0000 --_000_B8E83589E2B84D93BEC1108F3BD1CF41ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gMTIvMi8xNiwgMTA6NTYgQU0sICJSYW5keSBCdXNoIiA8cmFuZHlAcHNnLmNvbT4gd3JvdGU6 DQoNCg0KDQpSYW5keToNCg0KDQoNCkhpIQ0KDQoNCg0KSeKAmW0gZmluZSB3aXRoIHlvdXIgY29t bWVudHMsIHByb3Bvc2VkIHRleHQuICBKdXN0IGEgY291cGxlIG9mIG1vcmUgcmVwbGllcyBiZWxv dy4NCg0KDQoNClRoYW5rcyENCg0KDQoNCkFsdmFyby4NCg0KDQoNCuKApg0KDQo+ID4gTTIuIElu IFNlY3Rpb24gNy4gKFJvdXRpbmcgUG9saWN5KTog4oCcQXMgQkdQc2VjIHdpbGwgYmUgcm9sbGVk IG91dA0KDQo+ID4gb3ZlcuKApmEgbG9uZyB0aW1lLiAgSGVuY2UgYSBub3JtYWwgb3BlcmF0b3In cyBwb2xpY3kgU0hPVUxEIE5PVCBiZQ0KDQo+ID4gb3Zlcmx5IHN0cmljdCwgcGVyaGFwcyBwcmVm ZXJyaW5nIFZhbGlkIHBhdGhzIGFuZCBnaXZpbmcgdmVyeSBsb3cNCg0KPiA+IHByZWZlcmVuY2Us IGJ1dCBzdGlsbCB1c2luZywgTm90IFZhbGlkIHBhdGhzLuKAnSAgVGhpcyByZWNvbW1lbmRhdGlv bg0KDQo+ID4gY29uY2VybnMgbWUgYmVjYXVzZSDigJxOb3QgVmFsaWTigJ0gdGFsa3MgZGlyZWN0 bHkgdG8gdGhlIGZhY3QgdGhhdCB0aGUNCg0KPiA+IGFubm91bmNlbWVudCBpcywgd2VsbCwgbm90 IHZhbGlkIOKAkyB2cyBqdXN0IHVuYWJsZSB0byBiZSB2ZXJpZmllZA0KDQo+ID4gKGJlY2F1c2Ug dGhlcmXigJlzIG5vIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSwgZm9yIGV4YW1wbGUpLiAgVGhlIG5l eHQNCg0KPiA+IHNlbnRlbmNlIGlzIGEgcmVmbGVjdGlvbiBvZiBteSBjb25jZXJuOiDigJxPcGVy YXRvcnMgc2hvdWxkIGJlIGF3YXJlDQoNCj4gPiB0aGF0IGFjY2VwdGluZyBOb3QgVmFsaWQgYW5u b3VuY2VtZW50c+KApndpbGwgb2Z0ZW4gYmUgdGhlIGVxdWl2YWxlbnQgb2YNCg0KPiA+IHRyZWF0 aW5nIHRoZW0gYXMgZnVsbHkgVmFsaWQu4oCdICBJLUQuc2lkci1iZ3BzZWMtcHJvdG9jb2wgc3Vn Z2VzdHMgdGhlDQoNCj4gPiBzYW1lIHRoaW5nIChpbiA1LjEsIHBvaW50aW5nIHRvIHRoaXMgZG9j dW1lbnQpLiAgSSBhbSBsZWZ0IHdpdGggdGhlDQoNCj4gPiBxdWVzdGlvbjogd2h5IHZhbGlkYXRl IGF0IGFsbCBpZiB0aGUgQkNQIHJlY29tbWVuZGF0aW9uIGlzIHRvIHVzZSBhbGwNCg0KPiA+IGFu bm91bmNlbWVudHMgbm8gbWF0dGVyIHRoZSBzdGF0ZT8gIEkgb2J2aW91c2x5IHJlYWxpemUgdGhh dCBpdCBpcw0KDQo+ID4gc3RpbGwgZWFybHkgZGF5cyDigJMgbWF5YmUgaXQgaXMgdG9vIGVhcmx5 IGZvciBhIEJDUCBkb2N1bWVudCBpZiB0aGUNCg0KPiA+IOKAnHByYWN0aWNl4oCdIGlzIG5vdCB0 aGVyZSB5ZXTigKYNCg0KPg0KDQo+IHRoaXMgaXMgdGhlIHJlc3VsdCBvZiBhIHByaW1yb3NlIHBh dGggYW5kLCBhcyBpIGFtIGEgbmFnZ3VtaXRlLCBpIGFtDQoNCj4gcXVpdGUgd2lsbGluZyB0byBi ZSBzdHJpY3QgaGVyZS4gIGJ1dCBob3cgd2UgZ290IGhlcmUgd2FzOyBwYXRocyBhcmUNCg0KPiBl aXRoZXIgdmFsaWQgb3Igbm90OyB5b3UgZG8gbm90IGtub3cgaWYgaXQgaXMgbm90IHZhbGlkIGJl Y2F1c2Ugb2YgbGFjaw0KDQo+IG9mIGN1cnJlbnQgcnBraSBkYXRhIG9yIGFuIGF0dGNrIChtdWNo IGJsb29kIHNwaWxsZWQgaGVyZSkuICBvbmNlIHlvdQ0KDQo+IGhhdmUgc3dvbGxvd2VkIHRoaXMg cmVkdWNlZCBzaWduYWxpbmcga29vbGFpZCwgeW91IGNvdWxkIGhhdmUgYSBub3QNCg0KPiB2YWxp ZCBwYXRoIGJlY2F1c2UgeW91IGp1c3QgZG9uJ3QgaGF2ZSB0aGUgZGF0YSwgYSB3ZWFrZXIgc3Rh dGUgdGhhbg0KDQo+IGZhaWx1cmUuICB0aGlzIGxlZnQgdXMgd3Vzc2luZyBvdXQgb24gd2hhdCB0 byBkbyB3aXRoIHRoZW0gaW4gYmVzdCBwYXRoDQoNCj4gY2hvaWNlLg0KDQo+DQoNCj4gaG93IGFi b3V0IHMvU0hPVUxEIE5PVC9NSUdIVCBOT1QvPw0KDQo+DQoNCj4gb3IsIGFzIGkgYW0gYSBuYWdn dW1pdGUsIGkgYW0gd2lsbGluZyB0byBzYXkganVzdCBkcm9wIHRoZSBzdWNrZXJzLCBhbmQNCg0K PiBibGFtZSBpdCBvbiB5b3UgOikNCg0KDQoNCg0KDQrigJxuYWdndW1pdGXigJ0g4oCTIGl0IHRv b2sgbWUgYSB3aGlsZSB0byBmaWd1cmUgdGhpcyBvdXTigKYgOy0pDQoNCg0KDQpNeSBiaWdnZXN0 IHByb2JsZW0gd2l0aCB0aGUgb3JpZ2luYWwgdGV4dCBpcyB0aGUgbm9ybWF0aXZlIOKAnFNIT1VM RCBOT1TigJ0sIHNvIGNoYW5naW5nIHRoYXQgdG8g4oCcbWlnaHQgbm904oCdIHdvcmtzIGZvciBt ZSBhcyB5b3XigJlyZSBkZXNjcmliaW5nIGEgZmFjdCBvZiB3aGF0IG1heSBoYXBwZW4gaW4gdGhl IGluaXRpYWwgZGVwbG95bWVudHPigKYNCg0KDQoNCkkgYW0gYWxzbyBoYXBweSB0byB0YWtlIHRo ZSBibGFtZSBmb3IgZHJvcHBpbmcgaW52YWxpZCBzdHVmZi4gOy0pDQoNCg0KDQoNCg0K4oCmDQoN Cj4gPiBNNC4gU3RpbGwgaW4gU2VjdGlvbiA3OiDigJxUbyBwcmV2ZW50IGV4cG9zdXJlIG9mIHRo ZSBpbnRlcm5hbHMgb2YgQkdQDQoNCj4gPiBDb25mZWRlcmF0aW9ucyBbUkZDNTA2NV0sIGEgQkdQ c2VjIHNwZWFrZXIgd2hpY2ggaXMgYSBNZW1iZXItQVMgb2YgYQ0KDQo+ID4gQ29uZmVkZXJhdGlv biBNVVNUIE5PVCBzaWduIHVwZGF0ZXMgc2VudCB0byBhbm90aGVyIE1lbWJlci1BUyBvZiB0aGUN Cg0KPiA+IHNhbWUgQ29uZmVkZXJhdGlvbi7igJ0gIFRoaXMgaXMgYW5vdGhlciBjYXNlIHdoZXJl IHRoZSBCR1BTZWMgc3BlYyBzYXlzDQoNCj4gPiBzb21ldGhpbmcgZGlmZmVyZW50OiBTZWN0aW9u IDQuMy4gKFByb2Nlc3NpbmcgSW5zdHJ1Y3Rpb25zIGZvcg0KDQo+ID4gQ29uZmVkZXJhdGlvbiBN ZW1iZXJzKSBwcmVzZW50cyBhIG1hbmRhdG9yeSBtZWNoYW5pc20gdGhhdCBpbmNsdWRlcw0KDQo+ ID4gc2lnbmluZywgYnV0IG5vdCBuZWNlc3NhcmlseSB2YWxpZGF0aW5nLiAgQlRXLCBpZiB0aGUg dXBkYXRlcyBhcmUgbm90DQoNCj4gPiBzaWduZWQsIHRoZW4gdGhlIHNpZ25lZCBwYXRoIHdvdWxk IGJlIGJyb2tlbiwgZXZlbiBpZiBhbGwgdGhlIHJvdXRlcnMNCg0KPiA+IGluIHRoZSBwYXRoIHN1 cHBvcnQgQkdQU2VjLCByaWdodD8gIElzIHRoYXQgdGhlIHJlY29tbWVuZGF0aW9uPw0KDQo+DQoN Cj4gaXQgaXMgY29tbW9uIGZvciBhIGJncCBjb25mZWRlcmF0aW9uIHRvIGluY2x1ZGUgcHJpdmF0 ZSBBU3MgZm9yIHdoaWNoDQoNCj4gdGhlcmUgY2FuIGJlIG5vIHVuaXF1ZSBhdXRob3JhdGl2ZSBy b3V0ZXIgY3JlZGVudGlhbHMgaW4gdGhlIHJwa2kuDQoNCj4gaGVuY2UgaSBhbSBzdXNwaWNpb3Vz IG9mIHRoZSBwcm90b2NvbCBzcGVjLg0KDQoNCg0KQXMgbHVjayB3b3VsZCBoYXZlIGl0LCB0aGUg cHJvdG9jb2wgc3BlYyBpcyBpbiBJRVRGIExhc3QgQ2FsbCByaWdodCBub3cuIDstKQ0KDQoNCg0K U2hvcnQgb2YgY2hhbmdpbmcgdGhlIHNwZWMsIHdlIGNhbuKAmXQgaGF2ZSBjb25mbGljdGluZyBi ZWhhdmlvciBiZWluZyBzcGVjaWZpZWQuDQoNCg0KDQoNCg0K4oCmDQoNCj4gaSBkbyBub3QgcGxh biB0byBwdXNoIHRoZSBidXR0b24gdW50aWwgeW91IGFuZCBjaGFpcnMgc2F5IHdlJ3JlDQoNCj4g Y29udmVyZ2VkLg0KDQoNCg0KRXhjZXB0IGZvciB0aGUgQ29uZmVkZXJhdGlvbnMgcG9pbnQgYWJv dmUsIEkgdGhpbmsgd2UgYXJlLg0KDQoNCg0KVGhhbmtzIQ0KDQoNCg0KQWx2YXJvLg0K --_000_B8E83589E2B84D93BEC1108F3BD1CF41ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpwLk1zb1BsYWluVGV4dCwgbGkuTXNvUGxhaW5UZXh0LCBkaXYuTXNvUGxhaW5UZXh0DQoJe21z by1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCBDaGFyIjsN CgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1z dHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0 eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0 ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5vcm1hbDt9DQpzcGFuLlBs YWluVGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IlBsYWluIFRleHQgQ2hhciI7DQoJbXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFpbiBUZXh0IjsNCglmb250LWZh bWlseTpDYWxpYnJpO30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5 Ow0KCW1zby1zdHlsZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29s b3I6dGVhbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsN Cglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDEx LjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9u MQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgYmdj b2xvcj0id2hpdGUiIGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5PbiAxMi8y LzE2LCAxMDo1NiBBTSwgJnF1b3Q7UmFuZHkgQnVzaCZxdW90OyAmbHQ7cmFuZHlAcHNnLmNvbSZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPlJhbmR5OjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij5IaSE8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+SeKA mW0gZmluZSB3aXRoIHlvdXIgY29tbWVudHMsIHByb3Bvc2VkIHRleHQuJm5ic3A7IEp1c3QgYSBj b3VwbGUgb2YgbW9yZSByZXBsaWVzIGJlbG93LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij5UaGFua3MhPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPkFsdmFyby48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+4oCmPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij4mZ3Q7ICZndDsgTTIuIEluIFNlY3Rpb24gNy4gKFJvdXRpbmcgUG9saWN5KTog4oCc QXMgQkdQc2VjIHdpbGwgYmUgcm9sbGVkIG91dDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jmd0OyAmZ3Q7IG92ZXLigKZhIGxvbmcgdGltZS4mbmJzcDsmbmJzcDtIZW5j ZSBhIG5vcm1hbCBvcGVyYXRvcidzIHBvbGljeSBTSE9VTEQgTk9UIGJlPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7ICZndDsgb3Zlcmx5IHN0cmljdCwgcGVyaGFw cyBwcmVmZXJyaW5nIFZhbGlkIHBhdGhzIGFuZCBnaXZpbmcgdmVyeSBsb3c8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgJmd0OyBwcmVmZXJlbmNlLCBidXQgc3Rp bGwgdXNpbmcsIE5vdCBWYWxpZCBwYXRocy7igJ0mbmJzcDsmbmJzcDtUaGlzIHJlY29tbWVuZGF0 aW9uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7ICZndDsgY29u Y2VybnMgbWUgYmVjYXVzZSDigJxOb3QgVmFsaWTigJ0gdGFsa3MgZGlyZWN0bHkgdG8gdGhlIGZh Y3QgdGhhdCB0aGU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsg Jmd0OyBhbm5vdW5jZW1lbnQgaXMsIHdlbGwsIG5vdCB2YWxpZCDigJMgdnMganVzdCB1bmFibGUg dG8gYmUgdmVyaWZpZWQ8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZn dDsgJmd0OyAoYmVjYXVzZSB0aGVyZeKAmXMgbm8gQkdQc2VjX1BhdGggYXR0cmlidXRlLCBmb3Ig ZXhhbXBsZSkuJm5ic3A7Jm5ic3A7VGhlIG5leHQ8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZndDsgJmd0OyBzZW50ZW5jZSBpcyBhIHJlZmxlY3Rpb24gb2YgbXkgY29u Y2Vybjog4oCcT3BlcmF0b3JzIHNob3VsZCBiZSBhd2FyZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyAmZ3Q7IHRoYXQgYWNjZXB0aW5nIE5vdCBWYWxpZCBhbm5v dW5jZW1lbnRz4oCmd2lsbCBvZnRlbiBiZSB0aGUgZXF1aXZhbGVudCBvZjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyAmZ3Q7IHRyZWF0aW5nIHRoZW0gYXMgZnVs bHkgVmFsaWQu4oCdJm5ic3A7Jm5ic3A7SS1ELnNpZHItYmdwc2VjLXByb3RvY29sIHN1Z2dlc3Rz IHRoZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyAmZ3Q7IHNh bWUgdGhpbmcgKGluIDUuMSwgcG9pbnRpbmcgdG8gdGhpcyBkb2N1bWVudCkuJm5ic3A7Jm5ic3A7 SSBhbSBsZWZ0IHdpdGggdGhlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij4mZ3Q7ICZndDsgcXVlc3Rpb246IHdoeSB2YWxpZGF0ZSBhdCBhbGwgaWYgdGhlIEJDUCByZWNv bW1lbmRhdGlvbiBpcyB0byB1c2UgYWxsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij4mZ3Q7ICZndDsgYW5ub3VuY2VtZW50cyBubyBtYXR0ZXIgdGhlIHN0YXRlPyZuYnNw OyZuYnNwO0kgb2J2aW91c2x5IHJlYWxpemUgdGhhdCBpdCBpczxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyAmZ3Q7IHN0aWxsIGVhcmx5IGRheXMg4oCTIG1heWJl IGl0IGlzIHRvbyBlYXJseSBmb3IgYSBCQ1AgZG9jdW1lbnQgaWYgdGhlPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7ICZndDsg4oCccHJhY3RpY2XigJ0gaXMgbm90 IHRoZXJlIHlldOKApjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0 OzxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGlz IGlzIHRoZSByZXN1bHQgb2YgYSBwcmltcm9zZSBwYXRoIGFuZCwgYXMgaSBhbSBhIG5hZ2d1bWl0 ZSwgaSBhbTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBxdWl0 ZSB3aWxsaW5nIHRvIGJlIHN0cmljdCBoZXJlLiZuYnNwOyZuYnNwO2J1dCBob3cgd2UgZ290IGhl cmUgd2FzOyBwYXRocyBhcmU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZndDsgZWl0aGVyIHZhbGlkIG9yIG5vdDsgeW91IGRvIG5vdCBrbm93IGlmIGl0IGlzIG5vdCB2 YWxpZCBiZWNhdXNlIG9mIGxhY2s8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZndDsgb2YgY3VycmVudCBycGtpIGRhdGEgb3IgYW4gYXR0Y2sgKG11Y2ggYmxvb2Qgc3Bp bGxlZCBoZXJlKS4mbmJzcDsmbmJzcDtvbmNlIHlvdTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jmd0OyBoYXZlIHN3b2xsb3dlZCB0aGlzIHJlZHVjZWQgc2lnbmFsaW5n IGtvb2xhaWQsIHlvdSBjb3VsZCBoYXZlIGEgbm90PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij4mZ3Q7IHZhbGlkIHBhdGggYmVjYXVzZSB5b3UganVzdCBkb24ndCBoYXZl IHRoZSBkYXRhLCBhIHdlYWtlciBzdGF0ZSB0aGFuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij4mZ3Q7IGZhaWx1cmUuJm5ic3A7Jm5ic3A7dGhpcyBsZWZ0IHVzIHd1c3Np bmcgb3V0IG9uIHdoYXQgdG8gZG8gd2l0aCB0aGVtIGluIGJlc3QgcGF0aDxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBjaG9pY2UuPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGhvdyBhYm91dCBzL1NIT1VMRCBOT1QvTUlHSFQgTk9ULz88 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDs8bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgb3IsIGFzIGkgYW0gYSBuYWdn dW1pdGUsIGkgYW0gd2lsbGluZyB0byBzYXkganVzdCBkcm9wIHRoZSBzdWNrZXJzLCBhbmQ8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgYmxhbWUgaXQgb24geW91 IDopPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+4oCcbmFnZ3VtaXRl4oCdIOKAkyBpdCB0b29rIG1lIGEg d2hpbGUgdG8gZmlndXJlIHRoaXMgb3V04oCmIDstKTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij5NeSBiaWdnZXN0IHByb2JsZW0gd2l0aCB0aGUgb3JpZ2luYWwgdGV4dCBpcyB0aGUgbm9y bWF0aXZlIOKAnFNIT1VMRCBOT1TigJ0sIHNvIGNoYW5naW5nIHRoYXQgdG8g4oCcbWlnaHQgbm90 4oCdIHdvcmtzIGZvciBtZSBhcyB5b3XigJlyZSBkZXNjcmliaW5nIGEgZmFjdCBvZiB3aGF0IG1h eSBoYXBwZW4gaW4gdGhlIGluaXRpYWwgZGVwbG95bWVudHPigKY8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+SSBhbSBhbHNvIGhhcHB5IHRvIHRha2UgdGhlIGJsYW1lIGZvciBkcm9wcGlu ZyBpbnZhbGlkIHN0dWZmLiA7LSk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij7igKY8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgJmd0OyBNNC4gU3RpbGwgaW4gU2VjdGlv biA3OiDigJxUbyBwcmV2ZW50IGV4cG9zdXJlIG9mIHRoZSBpbnRlcm5hbHMgb2YgQkdQPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7ICZndDsgQ29uZmVkZXJhdGlv bnMgW1JGQzUwNjVdLCBhIEJHUHNlYyBzcGVha2VyIHdoaWNoIGlzIGEgTWVtYmVyLUFTIG9mIGE8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgJmd0OyBDb25mZWRl cmF0aW9uIE1VU1QgTk9UIHNpZ24gdXBkYXRlcyBzZW50IHRvIGFub3RoZXIgTWVtYmVyLUFTIG9m IHRoZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyAmZ3Q7IHNh bWUgQ29uZmVkZXJhdGlvbi7igJ0mbmJzcDsmbmJzcDtUaGlzIGlzIGFub3RoZXIgY2FzZSB3aGVy ZSB0aGUgQkdQU2VjIHNwZWMgc2F5czxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+Jmd0OyAmZ3Q7IHNvbWV0aGluZyBkaWZmZXJlbnQ6IFNlY3Rpb24gNC4zLiAoUHJvY2Vz c2luZyBJbnN0cnVjdGlvbnMgZm9yPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mZ3Q7ICZndDsgQ29uZmVkZXJhdGlvbiBNZW1iZXJzKSBwcmVzZW50cyBhIG1hbmRhdG9y eSBtZWNoYW5pc20gdGhhdCBpbmNsdWRlczxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jmd0OyAmZ3Q7IHNpZ25pbmcsIGJ1dCBub3QgbmVjZXNzYXJpbHkgdmFsaWRhdGlu Zy4mbmJzcDsmbmJzcDtCVFcsIGlmIHRoZSB1cGRhdGVzIGFyZSBub3Q8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgJmd0OyBzaWduZWQsIHRoZW4gdGhlIHNpZ25l ZCBwYXRoIHdvdWxkIGJlIGJyb2tlbiwgZXZlbiBpZiBhbGwgdGhlIHJvdXRlcnM8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgJmd0OyBpbiB0aGUgcGF0aCBzdXBw b3J0IEJHUFNlYywgcmlnaHQ/Jm5ic3A7Jm5ic3A7SXMgdGhhdCB0aGUgcmVjb21tZW5kYXRpb24/ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGl0IGlzIGNvbW1vbiBmb3Ig YSBiZ3AgY29uZmVkZXJhdGlvbiB0byBpbmNsdWRlIHByaXZhdGUgQVNzIGZvciB3aGljaDxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGVyZSBjYW4gYmUgbm8g dW5pcXVlIGF1dGhvcmF0aXZlIHJvdXRlciBjcmVkZW50aWFscyBpbiB0aGUgcnBraS48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgaGVuY2UgaSBhbSBzdXNwaWNp b3VzIG9mIHRoZSBwcm90b2NvbCBzcGVjLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5B cyBsdWNrIHdvdWxkIGhhdmUgaXQsIHRoZSBwcm90b2NvbCBzcGVjIGlzIGluIElFVEYgTGFzdCBD YWxsIHJpZ2h0IG5vdy4gOy0pPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPlNob3J0IG9m IGNoYW5naW5nIHRoZSBzcGVjLCB3ZSBjYW7igJl0IGhhdmUgY29uZmxpY3RpbmcgYmVoYXZpb3Ig YmVpbmcgc3BlY2lmaWVkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPuKApjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBpIGRvIG5vdCBwbGFuIHRvIHB1c2ggdGhlIGJ1 dHRvbiB1bnRpbCB5b3UgYW5kIGNoYWlycyBzYXkgd2UncmU8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPiZndDsgY29udmVyZ2VkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij5FeGNlcHQgZm9yIHRoZSBDb25mZWRlcmF0aW9ucyBwb2ludCBhYm92ZSwgSSB0aGlu ayB3ZSBhcmUuPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5UaGFua3MhPC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5B bHZhcm8uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_B8E83589E2B84D93BEC1108F3BD1CF41ciscocom_-- From nobody Fri Dec 2 09:23:56 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78B0212952F for ; Fri, 2 Dec 2016 09:23:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4Qzyep1GSabO for ; Fri, 2 Dec 2016 09:23:54 -0800 (PST) Received: from mail.rg.net (mail.rg.net [198.180.150.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0482F1294F6 for ; Fri, 2 Dec 2016 09:23:54 -0800 (PST) Received: from [166.170.37.54] (helo=[10.53.134.44]) by mail.rg.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.86_2) (envelope-from ) id 1cCrYt-0005Ig-CO; Fri, 02 Dec 2016 17:23:51 +0000 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Randy Bush X-Mailer: iPhone Mail (14B150) In-Reply-To: Date: Fri, 2 Dec 2016 09:23:49 -0800 Content-Transfer-Encoding: 7bit Message-Id: <8A08D99E-966A-45E3-84ED-054A3C52FCF5@psg.com> References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> To: "Alvaro Retana (aretana)" Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 17:23:55 -0000 I'll wait to push when until have heard from the protocol editors. randy From nobody Fri Dec 2 11:26:26 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3435129528; Fri, 2 Dec 2016 11:26:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Uy63wJxttvg; Fri, 2 Dec 2016 11:26:23 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D60512943A; Fri, 2 Dec 2016 11:26:23 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cCtTO-0000NP-Bo; Fri, 02 Dec 2016 19:26:18 +0000 Date: Fri, 02 Dec 2016 11:26:17 -0800 Message-ID: From: Randy Bush To: "Alvaro Retana (aretana)" In-Reply-To: <88A45E79-880B-4F82-9FAA-80C05627A49F@cisco.com> References: <88A45E79-880B-4F82-9FAA-80C05627A49F@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: "Sandra L. Murphy" , "sidr-chairs@ietf.org" , "draft-ietf-sidr-origin-validation-signaling@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of sidr-origin-validation-signaling-09 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 19:26:25 -0000 i realized you wanna ietf last call it. will push a rev in a few hours. randy From nobody Fri Dec 2 11:26:56 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A98E6129561; Fri, 2 Dec 2016 11:26:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p2u325s0L3Wr; Fri, 2 Dec 2016 11:26:54 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22ED7129528; Fri, 2 Dec 2016 11:26:54 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cCtTw-0000Nz-8A; Fri, 02 Dec 2016 19:26:52 +0000 Date: Fri, 02 Dec 2016 11:26:51 -0800 Message-ID: From: Randy Bush To: "Alvaro Retana (aretana)" In-Reply-To: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "draft-ietf-sidr-bgpsec-ops@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 19:26:55 -0000 sig. wrong docco. will push this one. randy From nobody Fri Dec 2 11:31:48 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 527741295CB for ; Fri, 2 Dec 2016 11:31:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L1eJ8P0pFClX for ; Fri, 2 Dec 2016 11:31:45 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D157129604 for ; Fri, 2 Dec 2016 11:31:26 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cCtYK-0000Pu-OB; Fri, 02 Dec 2016 19:31:24 +0000 Date: Fri, 02 Dec 2016 11:31:24 -0800 Message-ID: From: Randy Bush To: Alvaro Retana In-Reply-To: References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=BIG5 Content-Transfer-Encoding: base64 Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 19:31:46 -0000 PiChp25hZ2d1bWl0ZaGoIKFWIGl0IHRvb2sgbWUgYSB3aGlsZSB0byBmaWd1cmUgdGhpcyBvdXSh SyA7LSkNCg0Kb25lIG9mIHRoZSB0aW1lcyBqb24gcG9zdGVsIGFuZCBpIGRpc2FncmVlZC4gIGlt aWhvIGJlaW5nIGxpYmVyYWwgaW4NCndoYXQgeW91IGV4Y2VwdCBpcyB0aGUgcm9hZCB0byBlbnRy b3BpYyBkZWF0aC4NCg0KPiBNeSBiaWdnZXN0IHByb2JsZW0gd2l0aCB0aGUgb3JpZ2luYWwgdGV4 dCBpcyB0aGUgbm9ybWF0aXZlIKGnU0hPVUxEDQo+IE5PVKGoLCBzbyBjaGFuZ2luZyB0aGF0IHRv IKGnbWlnaHQgbm90oaggd29ya3MgZm9yIG1lIGFzIHlvdaGmcmUNCj4gZGVzY3JpYmluZyBhIGZh Y3Qgb2Ygd2hhdCBtYXkgaGFwcGVuIGluIHRoZSBpbml0aWFsIGRlcGxveW1lbnRzoUsNCj4gDQo+ IEkgYW0gYWxzbyBoYXBweSB0byB0YWtlIHRoZSBibGFtZSBmb3IgZHJvcHBpbmcgaW52YWxpZCBz dHVmZi4gOy0pDQoNCnRoaXMgaXMgdGhlIGJpdCBpIHdhbm5hIHR3ZWFrIHdoZW4gaSBnZXQgb2Zm IHRoZSBwaG9uZSB3aXRoIHVudGllZA0KDQpyYW5keQ== From nobody Fri Dec 2 12:37:50 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9113128B44 for ; Fri, 2 Dec 2016 12:37:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B-ijW0ONY25u for ; Fri, 2 Dec 2016 12:37:47 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E95A124281 for ; Fri, 2 Dec 2016 12:37:47 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cCuaX-0000wk-6S; Fri, 02 Dec 2016 20:37:45 +0000 Date: Fri, 02 Dec 2016 12:37:44 -0800 Message-ID: From: Randy Bush To: "Alvaro Retana (aretana)" In-Reply-To: References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 20:37:49 -0000 unless someone screams As BGPsec will be rolled out over years and does not allow for intermediate non-signing edge routers, coverage will be spotty for a long time. This presents a dilemma; should a router evaluating an inbound BGPsec_Path as Not Valid be very strict and discard it? On the other hand, it might be the only path to that prefix, and a very low local-preference would cause it to be used and propagated only if there was no alternative. Either choice is reasonable, but we recommend dropping because of the next point. Operators should be aware that accepting Not Valid announcements, no matter the local preference, will often be the equivalent of treating them as fully Valid. Local preference affects only routes to the same set of destinations. Consider having a Valid announcement from neighbor V for prefix 10.0.0.0/16 and an Not Valid announcement for 10.0.666.0/24 from neighbor I. If local policy on the router is not configured to discard the Not Valid announcement from I, then longest match forwarding will send packets to neighbor I no matter the value of local preference. From nobody Fri Dec 2 12:54:41 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 87F15120725; Fri, 2 Dec 2016 12:54:39 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148071207955.31853.1208254367292336312.idtracker@ietfa.amsl.com> Date: Fri, 02 Dec 2016 12:54:39 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-ops-11.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 20:54:39 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing of the IETF. Title : BGPsec Operational Considerations Author : Randy Bush Filename : draft-ietf-sidr-bgpsec-ops-11.txt Pages : 9 Date : 2016-12-02 Abstract: Deployment of the BGPsec architecture and protocols has many operational considerations. This document attempts to collect and present the most critical and universal. It is expected to evolve as BGPsec is formalized and initially deployed. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-ops/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-ops-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-bgpsec-ops-11 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Dec 4 04:58:33 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 087AE1294E8; Sun, 4 Dec 2016 04:58:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZHAi8qLrYp8o; Sun, 4 Dec 2016 04:58:30 -0800 (PST) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9744212711D; Sun, 4 Dec 2016 04:58:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=13332; q=dns/txt; s=iport; t=1480856309; x=1482065909; h=from:to:cc:subject:date:message-id:mime-version; bh=TgFosTz42epVegHEq9J8GStOVJ0/0hNa74eBV3JVvoI=; b=BN0Ie5g5pFx4pXM65LHCi1cwEi/x9Glrivxqm5gtfJ3GesQN9yBuzo6x gzNM3Fu6V5L34dT3aph7JhGrkUv7zmGA26mo8ImT5cnpLwn0lWP+oxIRv eEGc6tWp8dJEf8DNtr//2gvYPoHY4GLy405UWMX5u0Y+6dOlC06YEA5l2 E=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AsBACxEkRY/4sNJK1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgnNFAQEBAQEfWoENjUCmZIUiggiGIhyCAz8UAQIBAQEBAQEBYh0LhG8?= =?us-ascii?q?jCkwSAQZEAgQwJwQOiHSPa51HgikvinwBAQEBAQEBAQEBAQEBAQEBAQEBAR2GP?= =?us-ascii?q?oF9iiotghIeBZR8hWoBkRaBcoR9iU6HYIouAR83gRkxAQGFIoceK4EDgQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.33,298,1477958400"; d="scan'208,217";a="182792306" Received: from alln-core-6.cisco.com ([173.36.13.139]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 04 Dec 2016 12:58:21 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by alln-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id uB4CwLUC006326 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sun, 4 Dec 2016 12:58:21 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sun, 4 Dec 2016 06:58:20 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Sun, 4 Dec 2016 06:58:20 -0600 From: "Alvaro Retana (aretana)" To: "draft-ietf-sidr-bgpsec-pki-profiles@ietf.org" Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18 Thread-Index: AQHSTi4WSu/tt18RUk64ZuozIah2bA== Date: Sun, 4 Dec 2016 12:58:20 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_C835CAC99CBB41B3B376D1E3A79F4638ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "sidr@ietf.org" Subject: [sidr] AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Dec 2016 12:58:32 -0000 --_000_C835CAC99CBB41B3B376D1E3A79F4638ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RGVhciBhdXRob3JzOg0KDQpIaSEgIEkganVzdCBmaW5pc2hlZCByZWFkaW5nIHRoaXMgZG9jdW1l bnQuDQoNCkkgaGF2ZSBzb21lIGNvbW1lbnRzIChwbGVhc2Ugc2VlIGJlbG93KSBJIHdvdWxkIGxp a2UgeW91IHRvIGFkZHJlc3MsIGJ1dCBJIHdvdWxkbuKAmXQgY2hhcmFjdGVyaXplIGFueSBvZiB0 aGVtIGFzIG1ham9yLCBzbyBJ4oCZbSBzdGFydGluZyB0aGUgSUVURiBMYXN0IENhbGwgYW5kIHBs YWNpbmcgdGhpcyBkb2N1bWVudCBpbiB0aGUgbmV4dCBhdmFpbGFibGUgSUVTRyBUZWxlY2hhdC4N Cg0KVGhhbmtzIQ0KDQpBbHZhcm8uDQoNCg0KQ29tbWVudHM6DQoNCkMxLiBGcm9tIHRoZSBJbnRy b2R1Y3Rpb246IOKAnEEgcm91dGVyIGhvbGRpbmcgdGhlIHByaXZhdGUga2V5IGlzIGF1dGhvcml6 ZWQgdG8gc2VuZCByb3V0ZSBhZHZlcnRpc2VtZW50cyAodG8gaXRzIHBlZXJzKSB0aGF0IGNvbnRh aW4gb25lIG9yIG1vcmUgb2YgdGhlIHNwZWNpZmllZCBBUyBudW1iZXIgYXMgdGhlIGxhc3QgaXRl bSBpbiB0aGUgQVMgUEFUSCBhdHRyaWJ1dGUu4oCdICBGaXJzdCBvZiBhbGwsIGlmIEJHUFNlYyBp cyB1c2VkLCB0aGVuIHRoZSBBU19QQVRIIGF0dHJpYnV0ZSBpcyBub3QuICBTZWNvbmQsIHdoYXQg ZG9lcyDigJxvbmUgb3IgbW9yZSBvZiB0aGUgc3BlY2lmaWVkIEFTIG51bWJlciBhcyB0aGUgbGFz dCBpdGVt4oCdIG1lYW4/ICBUaGVyZSBpcyBvbmx5IG9uZSDigJxsYXN0IGl0ZW3igJ3igKZidXQg SeKAmW0gZ3Vlc3NpbmcgeW91IG1pZ2h0IGJlIHJlZmVycmluZyB0byBwcmUtcGVuZGluZy4NCg0K QzIuIOKAnEJvcmRlciBHYXRld2F5IFByb3RvY29sIFNlY3VyaXR5IHByb3RvY29sIChCR1BzZWMp 4oCdICBJIGhhdmVu4oCZdCBzZWVuIEJHUHNlYyBleHBhbmRlZCBhbnl3aGVyZSBlbHNlIGxpa2Ug dGhhdC4gIEluIGZhY3QsIElELnNpZHItYmdwc2VjLXByb3RvY29sIGp1c3QgdXNlZCBCR1BzZWMg KG5vIGV4cGFuc2lvbikuDQoNCkMzLiBzL0lELnNpZHItcmZjNjQ4NWJpcy9yZmM3OTM1DQoNCkM0 LiBJbiBTZWN0aW9uIDMuMS4zLjIuIChFeHRlbmRlZCBLZXkgVXNhZ2UpOiDigJxBcyBzcGVjaWZp ZWQgaW4gW1JGQzY0ODddIHRoaXMgZXh0ZW5zaW9uIE1VU1QgYmUgbWFya2VkIGFzIG5vbi1jcml0 aWNhbC7igJ0gIEJlY2F1c2UgdGhlIGJlaGF2aW9yIHdhcyBzcGVjaWZpZWQgaW4gUkZDNjQ4Nywg dGhlbiB0aGUg4oCcTVVTVOKAnSBzaG91bGRu4oCZdCBiZSBOb3JtYXRpdmUgaGVyZTsgcy9NVVNU L211c3QNCg0KQzUuIFNlY3Rpb24gMy4zLiAoQkdQc2VjIFJvdXRlciBDZXJ0aWZpY2F0ZSBWYWxp ZGF0aW9uKSBzYXlzIHRoYXQgdGhlIOKAnHZhbGlkYXRpb24gcHJvY2VkdXJl4oCmaXMgaWRlbnRp Y2FsIHRvIHRoZSB2YWxpZGF0aW9uIHByb2NlZHVyZSBkZXNjcmliZWQgaW4gU2VjdGlvbiA3IG9m IFtSRkM2NDg3XSAoYW5kIGFueSBSRkMgdGhhdCB1cGRhdGVzIHRoaXMgcHJvY2VkdXJlKSwgYnV0 IHVzaW5nIHRoZSBjb25zdHJhaW50cyBhcHBsaWVkIGNvbWUgZnJvbSB0aGlzIHNwZWNpZmljYXRp b24u4oCdICBJdCBJcyBzdHJhbmdlIHRvIG1lIHRoYXQgdGhlIHBocmFzZSBpbnNpZGUgdGhlIHBh cmVudGhlc2lzIGlzIGluY2x1ZGVkIGhlcmUgc2luY2UgdGhlcmUgaXNu4oCZdCBhbiB1cGRhdGUg dG8gdGhlIHByb2NlZHVyZSDigJMgaXMgdGhlcmUgYSBzcGVjaWZpYyByZWFzb24gd2h5IHlvdSBu ZWVkIHRvIGNhbGwgZnV0dXJlICh1bmtub3duKSB1cGRhdGVzIG91dCBhdCB0aGlzIHBvaW50PyAg IEJUVywgcy91c2luZyB0aGUgY29uc3RyYWludHMgYXBwbGllZCBjb21lIGZyb20gdGhpcyBzcGVj aWZpY2F0aW9uL3VzaW5nIHRoZSBjb25zdHJhaW50cyBmcm9tIHRoaXMgc3BlY2lmaWNhdGlvbg0K DQpDNi4gUmVmZXJlbmNlcy4NCi0gUkZDNjgxOCBjYW4gYmUgbWFkZSBJbmZvcm1hdGl2ZS4NCi0g UkZDNjQ4NiBhbmQgSUQuc2lkci1iZ3BzZWMtcHJvdG9jb2wgc2hvdWxkIGJlIE5vcm1hdGl2ZS4N Cg0KQzcuIHMvdG8gYW4gSW50ZXJuZXQgU2VydmljZSBQcm92aWRlcnMgKElTUCkvIHRvIGFuIElu dGVybmV0IFNlcnZpY2UgUHJvdmlkZXIgKElTUCkNCg0KQzguIHMvVGhlIENBIGFsc28gZ2VuZXJh dGUuLyAgKG9ycGhhbiBwaHJhc2UpDQoNCkM5LiBzL1RoZSBbUkZDNjQ4MF0vW1JGQzY0ODBdDQoN CkMxMC4gcy8zLjEuMS4xLi8zLjEuMS4NCg0KQzExLiDigJzigKZ0aGUgZWZmb3J0cyBvZiBTdGV2 ZSBLZW504oCmd2VyZSBpbnN0cnVtZW50YWwgaW4gcHJlcGFyaW5nIHRoaXMgd29ya+KAnSAgU3Rl dmUgaXMgYW4gYXV0aG9yLg0K --_000_C835CAC99CBB41B3B376D1E3A79F4638ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxuczptdj0iaHR0cDovL21hY1ZtbFNj aGVtYVVyaSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1odG1sNDAiPg0KPGhlYWQ+ DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hh cnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJUaXRsZSIgY29udGVudD0iIj4NCjxtZXRhIG5hbWU9 IktleXdvcmRzIiBjb250ZW50PSIiPg0KPG1ldGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJN aWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQgbWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9u dCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRo IjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjNDMTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDsNCglmb250LXdlaWdo dDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNv bG9yOndpbmRvd3RleHQ7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFs O30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1zdHls ZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9DQou TXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3Np emU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYu V29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIx MDI3Ii8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNo YXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIi8+ DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBiZ2Nv bG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4N CjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+RGVhciBhdXRob3JzOjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+SGkhJm5ic3A7IEkganVzdCBmaW5pc2hlZCByZWFkaW5n IHRoaXMgZG9jdW1lbnQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij5JIGhhdmUgc29tZSBjb21tZW50cyAocGxlYXNlIHNlZSBiZWxvdykgSSB3b3VsZCBsaWtlIHlv dSB0byBhZGRyZXNzLCBidXQgSSB3b3VsZG7igJl0IGNoYXJhY3Rlcml6ZSBhbnkgb2YgdGhlbSBh cyBtYWpvciwgc28gSeKAmW0gc3RhcnRpbmcgdGhlIElFVEYgTGFzdCBDYWxsIGFuZCBwbGFjaW5n IHRoaXMgZG9jdW1lbnQgaW4gdGhlIG5leHQgYXZhaWxhYmxlIElFU0cNCiBUZWxlY2hhdC48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlRoYW5rcyE8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkFsdmFyby48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5Db21t ZW50czo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkMxLiBGcm9t IHRoZSBJbnRyb2R1Y3Rpb246IOKAnEEgcm91dGVyIGhvbGRpbmcgdGhlIHByaXZhdGUga2V5IGlz IGF1dGhvcml6ZWQgdG8gc2VuZCByb3V0ZSBhZHZlcnRpc2VtZW50cyAodG8gaXRzIHBlZXJzKSB0 aGF0IGNvbnRhaW4gb25lIG9yIG1vcmUgb2YgdGhlIHNwZWNpZmllZCBBUyBudW1iZXIgYXMgdGhl IGxhc3QgaXRlbSBpbiB0aGUgQVMgUEFUSCBhdHRyaWJ1dGUu4oCdJm5ic3A7DQogRmlyc3Qgb2Yg YWxsLCBpZiBCR1BTZWMgaXMgdXNlZCwgdGhlbiB0aGUgQVNfUEFUSCBhdHRyaWJ1dGUgaXMgbm90 LiZuYnNwOyBTZWNvbmQsIHdoYXQgZG9lcyDigJxvbmUgb3IgbW9yZSBvZiB0aGUgc3BlY2lmaWVk IEFTIG51bWJlciBhcyB0aGUgbGFzdCBpdGVt4oCdIG1lYW4/Jm5ic3A7IFRoZXJlIGlzIG9ubHkg b25lIOKAnGxhc3QgaXRlbeKAneKApmJ1dCBJ4oCZbSBndWVzc2luZyB5b3UgbWlnaHQgYmUgcmVm ZXJyaW5nIHRvIHByZS1wZW5kaW5nLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+QzIuIOKAnEJvcmRlciBHYXRld2F5IFByb3RvY29sIFNlY3VyaXR5IHByb3RvY29s IChCR1BzZWMp4oCdJm5ic3A7IEkgaGF2ZW7igJl0IHNlZW4gQkdQc2VjIGV4cGFuZGVkIGFueXdo ZXJlIGVsc2UgbGlrZSB0aGF0LiZuYnNwOyBJbiBmYWN0LCBJRC5zaWRyLWJncHNlYy1wcm90b2Nv bCBqdXN0IHVzZWQgQkdQc2VjIChubyBleHBhbnNpb24pLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+QzMuIHMvSUQuc2lkci1yZmM2NDg1YmlzL3JmYzc5MzU8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkM0LiBJbiBTZWN0aW9uIDMu MS4zLjIuIChFeHRlbmRlZCBLZXkgVXNhZ2UpOiDigJxBcyBzcGVjaWZpZWQgaW4gW1JGQzY0ODdd IHRoaXMgZXh0ZW5zaW9uIE1VU1QgYmUgbWFya2VkIGFzIG5vbi1jcml0aWNhbC7igJ0mbmJzcDsg QmVjYXVzZSB0aGUgYmVoYXZpb3Igd2FzIHNwZWNpZmllZCBpbiBSRkM2NDg3LCB0aGVuIHRoZSDi gJxNVVNU4oCdIHNob3VsZG7igJl0IGJlIE5vcm1hdGl2ZQ0KIGhlcmU7IHMvTVVTVC9tdXN0PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5DNS4gU2VjdGlvbiAzLjMu IChCR1BzZWMgUm91dGVyIENlcnRpZmljYXRlIFZhbGlkYXRpb24pIHNheXMgdGhhdCB0aGUg4oCc dmFsaWRhdGlvbiBwcm9jZWR1cmXigKZpcyBpZGVudGljYWwgdG8gdGhlIHZhbGlkYXRpb24gcHJv Y2VkdXJlIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDcgb2YgW1JGQzY0ODddIChhbmQgYW55IFJGQyB0 aGF0IHVwZGF0ZXMgdGhpcyBwcm9jZWR1cmUpLA0KIGJ1dCB1c2luZyB0aGUgY29uc3RyYWludHMg YXBwbGllZCBjb21lIGZyb20gdGhpcyBzcGVjaWZpY2F0aW9uLuKAnSZuYnNwOyBJdCBJcyBzdHJh bmdlIHRvIG1lIHRoYXQgdGhlIHBocmFzZSBpbnNpZGUgdGhlIHBhcmVudGhlc2lzIGlzIGluY2x1 ZGVkIGhlcmUgc2luY2UgdGhlcmUgaXNu4oCZdCBhbiB1cGRhdGUgdG8gdGhlIHByb2NlZHVyZSDi gJMgaXMgdGhlcmUgYSBzcGVjaWZpYyByZWFzb24gd2h5IHlvdSBuZWVkIHRvIGNhbGwgZnV0dXJl ICh1bmtub3duKSB1cGRhdGVzDQogb3V0IGF0IHRoaXMgcG9pbnQ/Jm5ic3A7Jm5ic3A7IEJUVywg cy91c2luZyB0aGUgY29uc3RyYWludHMgYXBwbGllZCBjb21lIGZyb20gdGhpcyBzcGVjaWZpY2F0 aW9uL3VzaW5nIHRoZSBjb25zdHJhaW50cyBmcm9tIHRoaXMgc3BlY2lmaWNhdGlvbjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QzYuIFJlZmVyZW5jZXMuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQiPi0gUkZDNjgxOCBjYW4gYmUgbWFkZSBJbmZvcm1hdGl2ZS48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+LSBSRkM2NDg2IGFuZCBJRC5zaWRyLWJncHNlYy1wcm90b2NvbCBzaG91bGQgYmUg Tm9ybWF0aXZlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Qzcu IHMvdG8gYW4gSW50ZXJuZXQgU2VydmljZSBQcm92aWRlcnMgKElTUCkvPC9zcGFuPg0KPHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPnRvIGFuIEludGVybmV0IFNlcnZpY2UgUHJvdmlkZXIg KElTUCk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkM4LiBzL1Ro ZSBDQSBhbHNvIGdlbmVyYXRlLi8mbmJzcDsgKG9ycGhhbiBwaHJhc2UpPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5DOS4gcy9UaGUgW1JGQzY0ODBdL1tSRkM2NDgw XTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QzEwLiBzLzMuMS4x LjEuLzMuMS4xLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QzEx LiDigJzigKZ0aGUgZWZmb3J0cyBvZiBTdGV2ZSBLZW504oCmd2VyZSBpbnN0cnVtZW50YWwgaW4g cHJlcGFyaW5nIHRoaXMgd29ya+KAnSZuYnNwOyBTdGV2ZSBpcyBhbiBhdXRob3IuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_C835CAC99CBB41B3B376D1E3A79F4638ciscocom_-- From nobody Mon Dec 5 07:15:08 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AB65D129A79; Mon, 5 Dec 2016 07:15:06 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148095090669.3249.13817539489864907230.idtracker@ietfa.amsl.com> Date: Mon, 05 Dec 2016 07:15:06 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-protocol-20.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 15:15:07 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing of the IETF. Title : BGPsec Protocol Specification Authors : Matthew Lepinski Kotikalapudi Sriram Filename : draft-ietf-sidr-bgpsec-protocol-20.txt Pages : 39 Date : 2016-12-05 Abstract: This document describes BGPsec, an extension to the Border Gateway Protocol (BGP) that provides security for the path of autonomous systems through which a BGP update message passes. BGPsec is implemented via an optional non-transitive BGP path attribute that carries a digital signature produced by each autonomous system that propagates the update message. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-protocol/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-protocol-20 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-bgpsec-protocol-20 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Dec 5 08:37:18 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F88312948E; Mon, 5 Dec 2016 08:37:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.896 X-Spam-Level: X-Spam-Status: No, score=0.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MANY_SPAN_IN_TEXT=2.797, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wKM9vsRLLInJ; Mon, 5 Dec 2016 08:37:12 -0800 (PST) Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0099.outbound.protection.outlook.com [23.103.201.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8EE1129B70; Mon, 5 Dec 2016 08:35:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=as0hohynZEZ6VxqFGPDcPwXMlg70WRPz9E63E4+pOdM=; b=C+crLvWLV9KaaMgScWbOqgw7qOLlZYM6KAXLLgl+3LHkSuZV9Yc+/iaclomwEUByHTrs2t2her0XBtgdwOtKnR+5s9OlvpiW5Rt08BCm0xfjdORCjIWGBG6VBxo1CrgekC0i533Y1CquLzITOopnpP9+poPpMGBpwx9JkltGhTo= Received: from DM2PR09MB0446.namprd09.prod.outlook.com (10.161.252.145) by DM2PR09MB0448.namprd09.prod.outlook.com (10.161.252.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.761.9; Mon, 5 Dec 2016 16:35:44 +0000 Received: from DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) by DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) with mapi id 15.01.0761.016; Mon, 5 Dec 2016 16:35:43 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "Alvaro Retana (aretana)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-protocol-18 Thread-Index: AQHSNR6CtOW/YAot7EOz/vffo+bn+6DtE+nUgAAdepOABucAgIAFm/Tv Date: Mon, 5 Dec 2016 16:35:43 +0000 Message-ID: References: , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=kotikalapudi.sriram@nist.gov; x-originating-ip: [129.6.223.199] x-ms-office365-filtering-correlation-id: d5d9b510-e97d-40a6-44cf-08d41d2cc217 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DM2PR09MB0448; x-microsoft-exchange-diagnostics: 1; DM2PR09MB0448; 7:JWS8fBXSQVpgzha8akVJ4KSmh/ur6pX2WezhK7+jh06x4mBh4gl+SULWFcovMZoh9Hc+506tq3cmdKBhV2vJYZbR8LTvg1lXccPieBKnoFbSBwPMgqM1MbyHP8hGB4v7sPpKue5meyp4AFEjoG7cY25hn/ycuiZl7NrTqvo9eOU12cvQgywLnSP78BCEmiLcYok4dNpUK1To8cUvtKPcxeUdIDTwaIbFhrzTHayFlxW8Zj7R7T/Kw4QbOKb+7fGYt9bavYM9rwZcOwsRcYrapcj80iwpBPmnneteZRIZZTtJvDXsg6EZYAcVrt+Kz1GbMBcVY6jS3DPNbOqywCPIGXhVWjAATdI/g4aVHWWKllwMkfhCkLCyRyI7om6R+9EAd3aTkq29XD7lA7HEvFnUyHov4c7U73DPapoxgKjNFwb9Bv+1G3kbKbHJa/7OEPc4deKpSpc7bzZ0e164Ytz13g== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(788757137089)(17755550239193); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(6041248)(20161123560025)(20161123562025)(20161123564025)(20161123555025)(6072148); SRVR:DM2PR09MB0448; BCL:0; PCL:0; RULEID:; SRVR:DM2PR09MB0448; x-forefront-prvs: 0147E151B5 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(199003)(189002)(51444003)(55674003)(2950100002)(74316002)(66066001)(8936002)(4326007)(8676002)(68736007)(7736002)(77096006)(7846002)(50986999)(106116001)(76176999)(102836003)(39840400001)(39860400001)(106356001)(6606003)(54356999)(81166006)(7696004)(5660300001)(9686002)(81156014)(2201001)(3846002)(86362001)(6116002)(3660700001)(2501003)(19627405001)(93886004)(105586002)(92566002)(101416001)(2906002)(230783001)(6506006)(229853002)(606004)(2900100001)(39450400002)(38730400001)(39410400001)(7906003)(39850400001)(99286002)(76576001)(97736004)(5001770100001)(122556002)(189998001)(3280700002)(33656002)(569005); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0448; H:DM2PR09MB0446.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR09MB04461678B8C50EEB716FC52A84830DM2PR09MB0446namp_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Dec 2016 16:35:43.5411 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR09MB0448 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-protocol-18 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 16:37:16 -0000 --_000_DM2PR09MB04461678B8C50EEB716FC52A84830DM2PR09MB0446namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWx2YXJvLA0KDQoNCg0KVGhhbmtzIGZvciB0aGlzIHNldCBvZiBmdXJ0aGVyIGNvbW1lbnRzL3F1 ZXN0aW9ucy9kaXNjdXNzaW9uLiBUaGV5IGFyZSB2ZXJ5IGluc2lnaHRmdWwgYW5kIGhlbHBmdWwu DQoNCg0KDQpJIGhhdmUgdXBsb2FkZWQgdmVyc2lvbi0yMCB3aGljaCBpbmNsdWRlcyBjaGFuZ2Vz IGJhc2VkIG9uIHlvdXIgbGF0ZXN0IGNvbW1lbnRzLg0KDQoNCg0KUmVnYXJkaW5nIHlvdXIgc2Vj dXJpdHkgY29uY2VybiB3aXRoIHRoZSBtZXRob2QgdXNlZCBmb3IgY29uZmVkZXJhdGlvbnM6DQoN Cg0KDQpUaGUgcHJvYmxlbSB5b3UgZGVzY3JpYmVkIGlzIGEgdmFyaWFudCBvZiB0aGUgcHJvYmxl bSBvZiBjb2xsdXNpb24gYmV0d2VlbiBub24tcGVlcmluZyBBU2VzIGJ5IHR1bm5lbGluZy4gVGhl IFdHIGhhZCBkaXNjdXNzZWQgdGhpcyBwcm9ibGVtIChhbHRob3VnaCBpbiBzbGlnaHRseSBkaWZm ZXJlbnQgY29udGV4dCkuIFNlZSB0aGUgdGhyZWFkIGF0Og0KDQoNCg0KaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbC1hcmNoaXZlL3dlYi9zaWRyL2N1cnJlbnQvbXNnMDcyNjAuaHRtbA0KDQoNCg0K QXQgdGhlIHRpbWUsIHRoZSBXRyBhZ3JlZWQgdGhhdCBpdCB3YXMgYmV5b25kIHRoZSBzY29wZSBv ZiBCR1BzZWMgdG8gc29sdmUgdGhlIHByb2JsZW0gb2YgY29sbHVzaW9uIGJldHdlZW4gbm9uLXBl ZXJpbmcgQVNlcyB1c2luZyBPT0IgY29tbXVuaWNhdGlvbi4gQkdQc2VjIGlzIGRlc2lnbmVkIHRv IHByb3RlY3QgbWVzc2FnZXMgc2VudCB3aXRoaW4gQkdQIChpLmUuIHdpdGhpbiB0aGUgY29udHJv bCBwbGFuZSkg4oCTIG5vdCB3aGVuIHRoZSBjb250cm9sIHBsYW5lIGluIGJ5cGFzc2VkLg0KDQoN Cg0KU28gSSBoYXZlIHRoZSBhZGRlZCB0aGUgZm9sbG93aW5nIG5ldyB3b3JkaW5nIGluIHZlcnNp b24tMjAgaW4gdGhlIG9wcyBhbmQgbWdtdC4gc2VjdGlvbjoNCg0KDQoNClRoZXJlIGlzIGEgcG9z c2liaWxpdHkgb2YgcGFzc2luZyBhIEJHUHNlYyB1cGRhdGUgdmlhIHR1bm5lbGluZw0KDQogICBi ZXR3ZWVuIGNvbGx1ZGluZyBBU2VzLiAgRm9yIGV4YW1wbGUsIHNheSwgQVMtWCBkb2VzIG5vdCBw ZWVyIHdpdGgNCg0KICAgQVMtWSwgYnV0IGNvbGx1ZGVzIHdpdGggQVMtWSwgc2lnbnMgYW5kIHNl bmRzIGEgQkdQc2VjIHVwZGF0ZSB0byBBUy1ZDQoNCiAgIGJ5IHR1bm5lbGluZy4gIEFTLVkgY2Fu IHRoZW4gZnVydGhlciBzaWduIGFuZCBwcm9wYWdhdGUgdGhlIEJHUHNlYw0KDQogICB1cGRhdGUg dG8gaXRzIHBlZXJzLiAgSXQgaXMgYmV5b25kIHRoZSBzY29wZSBvZiB0aGUgQkdQc2VjIHByb3Rv Y29sDQoNCiAgIHRvIGRldGVjdCB0aGlzIGZvcm0gb2YgbWFsaWNpb3VzIGJlaGF2aW9yLiAgQkdQ c2VjIGlzIGRlc2lnbmVkIHRvDQoNCiAgIHByb3RlY3QgbWVzc2FnZXMgc2VudCB3aXRoaW4gQkdQ IChpLmUuIHdpdGhpbiB0aGUgY29udHJvbCBwbGFuZSkgLQ0KDQogICBub3Qgd2hlbiB0aGUgY29u dHJvbCBwbGFuZSBpbiBieXBhc3NlZC4NCg0KDQoNCg0KDQogICBBIHZhcmlhbnQgb2YgdGhlIGNv bGx1c2lvbiBieSB0dW5uZWxpbmcgbWVudGlvbmVkIGFib3ZlIGNhbiBoYXBwZW4gaW4NCg0KICAg dGhlIGNvbnRleHQgb2YgQVMgY29uZmVkZXJhdGlvbnMuICBXaGVuIGEgQkdQc2VjIHJvdXRlciAo b3V0c2lkZSBvZiBhDQoNCiAgIGNvbmZlZGVyYXRpb24pIGlzIGZvcndhcmRpbmcgYW4gdXBkYXRl IHRvIGEgbWVtYmVyIG9mIHRoZQ0KDQogICBjb25mZWRlcmF0aW9uLCBpdCBzaWducyB0aGUgdXBk YXRlIHRvIHRoZSBwdWJsaWMgQVNOIG9mIHRoZQ0KDQogICBjb25mZWRlcmF0aW9uIGFuZCBub3Qg dG8gdGhlIG1lbWJlcidzIEFTTiAoc2VlIFNlY3Rpb24gNC4zKS4gIFNhaWQNCg0KICAgbWVtYmVy IGNhbiB0dW5uZWwgdGhlIHNpZ25lZCB1cGRhdGUgdG8gYW5vdGhlciBtZW1iZXIgYXMgaXMgKGku ZS4NCg0KICAgd2l0aG91dCBhZGRpbmcgYSBzaWduYXR1cmUpLiAgVGhlIHVwZGF0ZSBjYW4gdGhl biBiZSBwcm9wYWdhdGVkIHVzaW5nDQoNCiAgIEJHUHNlYyB0byBvdGhlciBjb25mZWRlcmF0aW9u IG1lbWJlcnMgb3IgdG8gQkdQc2VjIG5laWdoYm9ycyBvdXRzaWRlDQoNCiAgIG9mIHRoZSBjb25m ZWRlcmF0aW9uLiAgVGhpcyBraW5kIG9mIG9wZXJhdGlvbiBpcyBwb3NzaWJsZSwgYnV0IG5vDQoN CiAgIGdyYXZlIHNlY3VyaXR5IG9yIHJlYWNoYWJpbGl0eSBjb21wcm9taXNlIGlzIGZlYXJlZCBk dWUgdG8gdGhlDQoNCiAgIGZvbGxvd2luZyByZWFzb25zOiAoMSkgVGhlIGNvbmZlZGVyYXRpb24g bWVtYmVycyBiZWxvbmcgdG8gb25lDQoNCiAgIG9yZ2FuaXphdGlvbiBhbmQgc3Ryb25nIGludGVy bmFsIHRydXN0IGlzIGV4cGVjdGVkOyBhbmQgKDIpIFJlY2FsbA0KDQogICB0aGF0IHRoZSBzaWdu YXR1cmVzIHRoYXQgYXJlIGludGVybmFsIHRvIHRoZSBjb25mZWRlcmF0aW9uIG11c3QgYmUNCg0K ICAgcmVtb3ZlZCBwcmlvciB0byBmb3J3YXJkaW5nIHRoZSB1cGRhdGUgdG8gYW4gb3V0c2lkZSBC R1BzZWMgcm91dGVyDQoNCiAgIChzZWUgU2VjdGlvbiA0LjMpLg0KDQoNCg0KUmVnYXJkaW5nIHBy b2Nlc3Npbmcgb2YgZHVwbGljYXRlIHVwZGF0ZSBxdWVzdGlvbjoNCg0KDQoNCkkgZmVlbCBub3cg dGhhdCB0aGVyZSBpcyBubyByZWFsIHV0aWxpdHkgaW4gZGlzY3Vzc2luZyB0aGUgZGV0YWlscyBv ZiBvcHRpbWl6YXRpb24gb2YgdmFsaWRhdGlvbiBwcm9jZXNzaW5nIGZvciBkdXBsaWNhdGUgdXBk YXRlcyBpbiB0aGUgbWlkZGxlIG9mIHByb3RvY29sIHNwZWNpZmljYXRpb24gKGFzIHdlIGRpZCBi ZWZvcmUgaW4gU2VjdGlvbiA1KS4gV2UgbmVlZCBub3QgZXZlbiBnZXQgaW50byBkZWZpbmluZyBk dXBsaWNhdGUgdXBkYXRlcywgZXRjLiAgSSBoYXZlIG1vdmVkIHRoZSBub3RlIGFib3V0IG5vbi1k ZXRlcm1pbmlzdGljL2RldGVybWluaXN0aWMgc2lnbmF0dXJlIGFsZ29yaXRobXMgZnJvbSBTZWN0 aW9uIDUgaW50byB0aGUgb3BzIGFuZCBtZ210LiBzZWN0aW9uIChTZWN0aW9uIDcpLiBUaGUgcGFy YWdyYXBoIHRoZXJlIG5vdyByZWFkcyBhcyBmb2xsb3dzOg0KDQoNCg0KTWFueSBzaWduYXR1cmUg YWxnb3JpdGhtcyBhcmUgbm9uLWRldGVybWluaXN0aWMuICBUaGF0IGlzLCBtYW55DQoNCiAgIHNp Z25hdHVyZSBhbGdvcml0aG1zIHdpbGwgcHJvZHVjZSBkaWZmZXJlbnQgc2lnbmF0dXJlcyBlYWNo IHRpbWUgdGhleQ0KDQogICBhcmUgcnVuIChldmVuIHdoZW4gdGhleSBhcmUgc2lnbmluZyB0aGUg c2FtZSBkYXRhIHdpdGggdGhlIHNhbWUga2V5KS4NCg0KICAgVGhlcmVmb3JlLCBpZiBhIEJHUHNl YyByb3V0ZXIgcmVjZWl2ZXMgYSBCR1BzZWMgdXBkYXRlIGZyb20gYSBwZWVyDQoNCiAgIGFuZCBs YXRlciByZWNlaXZlcyBhIHNlY29uZCBCR1BzZWMgdXBkYXRlIG1lc3NhZ2UgZnJvbSB0aGUgc2Ft ZSBwZWVyDQoNCiAgIGZvciB0aGUgc2FtZSBwcmVmaXggd2l0aCB0aGUgc2FtZSBTZWN1cmVfUGF0 aCBhbmQgU0tJcywgdGhlIHNlY29uZA0KDQogICB1cGRhdGUgd2lsbCBkaWZmZXIgZnJvbSB0aGUg Zmlyc3QgdXBkYXRlIGluIHRoZSBzaWduYXR1cmUgZmllbGRzIChmb3INCg0KICAgYSBub24tZGV0 ZXJtaW5pc3RpYyBzaWduYXR1cmUgYWxnb3JpdGhtKS4gIEZvciBhIGRldGVybWluaXN0aWMNCg0K ICAgc2lnbmF0dXJlIGFsZ29yaXRobSwgdGhlIHNpZ25hdHVyZSBmaWVsZHMgd2lsbCBhbHNvIGJl IGlkZW50aWNhbA0KDQogICBiZXR3ZWVuIHRoZSB0d28gdXBkYXRlcy4gIE9uIHRoZSBiYXNpcyBv ZiB0aGVzZSBvYnNlcnZhdGlvbnMsIGFuDQoNCiAgIGltcGxlbWVudGF0aW9uIG1heSBpbmNvcnBv cmF0ZSBvcHRpbWl6YXRpb25zIGluIHVwZGF0ZSB2YWxpZGF0aW9uDQoNCiAgIHByb2Nlc3Npbmcu DQoNCg0KDQpZb3VyIG90aGVyIGNvbW1lbnRzL3N1Z2dlc3Rpb25zIHdlcmUgc3RyYWlnaHQgZm9y d2FyZCBhbmQgSSBoYXZlIGluY29ycG9yYXRlZCB0aGVtIGFzIHdlbGwgaW4gdmVyc2lvbi0yMC4N Cg0KDQoNClBsZWFzZSBzZWUgbXkgcmVzcG9uc2VzIHRvIHlvdXIgaW5kaXZpZHVhbCBjb21tZW50 cyBtYXJrZWQgd2l0aCBbU3JpcmFtLTJdIGJlbG93Lg0KDQoNCg0KU3JpcmFtDQoNCi0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoNCg0KDQpIaSEg IFRoYW5rcyBmb3IgYWRkcmVzc2luZyBteSBjb21tZW50cy4gIEkgaGF2ZSBzb21lIHJlbWFpbmlu ZyBjb21tZW50cyBiZWxvdy4gIEkgZmxhZ2dlZCBhIGNvdXBsZSBvZiBpdGVtcyB0aGF0IEkgdGhp bmsgdGhlIENoYWlycyBzaG91bGQgY29uc3VsdCB0aGUgV0cgb24sIGJ1dCBJ4oCZbGwgbGVhdmUg aXQgdXAgdG8gdGhlbSB0byBkZWNpZGUgdGhhdCDigJMgbm90ZSB0aGF0IEkgZG9u4oCZdCB0aGlu ayB3ZSBuZWVkIHRvIFdHTEMgdGhlIHdob2xlIGRvY3VtZW50IGFnYWluLCBqdXN0IGEgY291cGxl IG9mIGRlY2lzaW9ucy4NCg0KDQoNCkkgYWxzbyBhZGRlZCBhIGNvdXBsZSBvZiBuZXcgY29tbWVu dHMgYXQgdGhlIGVuZC4NCg0KDQoNCkkgdGhpbmsgd2UgYXJlIGNsb3NlciwgYnV0IHRoZXJlIGFy ZSBzdGlsbCBhIGNvdXBsZSBvZiBpdGVtcyB3aGVyZSB3ZeKAmXJlIG5vdCBhZ3JlZWluZzogIHRy ZWF0bWVudCBvZiBkdXBsaWNhdGVzIGFuZCBjb25mZWRlcmF0aW9ucy4gIFdlIGNhbiBjb250aW51 ZSB0aGUgZGlzY3Vzc2lvbiDigJMgSSB3b3VsZCBsb3ZlIHRvIGhlYXIgb3RoZXIgb3BpbmlvbnMg YXMgd2VsbCAoZnJvbSB0aGUgV0cpLg0KDQoNCg0KSW4gdGhlIG1lYW50aW1lLCBJIHdpbGwgc3Rh cnQgdGhlIElFVEYgTGFzdCBDYWxsIGFuZCByZXF1ZXN0IGEgUlRHLURpciByZXZpZXcgYXMgd2Vs bC4gIEFkZHJlc3Npbmcgd2hhdCB3ZSBzZWVtIHRvIGFncmVlIG9uIChJIHByb3Bvc2VkIHNvbWUg Y2hhbmdlcyBiZWxvdyBmb3IgY2xhcml0eSkgaW4gdGhlIG5leHQgZmV3IGRheXMgd291bGQgZGVm aW5pdGVseSBoZWxwIHRoZSBwcm9jZXNzLg0KDQoNCg0KVGhhbmtzIQ0KDQoNCg0KQWx2YXJvLg0K DQoNCg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoNCg0KDQpbU3JpcmFt LTJdICAgUGxlYXNlIHNlZSBteSByZXNwb25zZXMgdG8geW91ciBpbmRpdmlkdWFsIGNvbW1lbnRz IG1hcmtlZCB3aXRoIFtTcmlyYW0tMl0gYmVsb3cNCg0KDQoNCj4gW1NyaXJhbV0gRm9sbG93aW5n IHRoZSBjbGFyaWZpY2F0aW9ucyBhbmQgYWRkaXRpb25hbCBndWlkYW5jZSB5b3UgcHJvdmlkZWQg aW4gU2VvdWwgKHdoZW4NCg0KDQoNCj4geW91LCBDaHJpcywgYW5kIEkgbWV0KSwgSSBoYXZlIGFk ZGVkIGEgbmV3IFNlY3Rpb24gNyAoT3BlcmF0aW9ucyBhbmQgTWFuYWdlbWVudA0KDQoNCg0KPiBD b25zaWRlcmF0aW9ucykuIFRoZSB0b3BpY3MgeW91IG1lbnRpb24gYWJvdmUgYXJlIGFsbCBjb3Zl cmVkIGluIHRoZSBuZXcgU2VjdGlvbiA3Lg0KDQoNCg0KVGhhbmtzIGZvciBhZGRpbmcgdGhpcyBT ZWN0aW9uLiAgSSB0aGluayB0aGUgZXNzZW5jZSBvZiB3aGF0IHdlIHRhbGtlZCBhYm91dCBpcyB0 aGVyZSwgYnV0IHRoZSB0ZXh0IG5lZWRzIHNvbWUgZWRpdGluZy4gIEnigJltIHB1dHRpbmcgc29t ZSBzdWdnZXN0aW9ucyBiZWxvdyDigJMga2VlcCBpbiBtaW5kIHRoYXQgdGhpcyBkb2N1bWVudCBp cyBhIHNwZWNpZmljYXRpb24sIHNvIHlvdSBjYW4gYmUgcHJlc2NyaXB0aXZlIHdpdGggd2hhdCB5 b3Ugd2FudCB0byBoYXBwZW4uDQoNCg0KDQpPTEQ+DQoNCg0KDQpEZXRhaWxlZCByZWNvbW1lbmRh dGlvbnMgY29uY2VybmluZyBvcGVyYXRpb25zIGFuZCBtYW5hZ2VtZW50IGlzc3VlcyB3aXRoIEJH UHNlYyBhcmUgcHJvdmlkZWQgaW4gW0ktRC5pZXRmLXNpZHItYmdwc2VjLW9wc10uDQoNCg0KDQpO RVc+DQoNCg0KDQpUaGUgQmVzdCBDdXJyZW50IFByYWN0aWNlIGNvbmNlcm5pbmcgb3BlcmF0aW9u YWwgZGVwbG95bWVudCBvZiBCR1BTZWMgaXMgcHJvdmlkZWQgaW4gW0ktRC5pZXRmLXNpZHItYmdw c2VjLW9wc10uDQoNCg0KDQpbU3JpcmFtLTJdIEdvb2QgcmV3b3JkaW5nLiBNYWRlIHRoZSBzdWJz dGl0dXRpb24uDQoNCg0KDQpPTEQ+DQoNCg0KDQpUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBCR1Bz ZWMgVmVyc2lvbiAwIG9ubHkuICBXaGF0IHNob3VsZCB0aGUgICBhY3Rpb24gYmUgaWYgdGhlIFZl cnNpb24gaXMgbm90IDAgaW4gdGhlIEJHUHNlYyBjYXBhYmlsaXR5ICAgYWR2ZXJ0aXNlbWVudCBm cm9tIGEgcGVlcj8gIElmIHRoZSBpbnRlcnNlY3Rpb24gb2YgQkdQc2VjIGNhcGFiaWxpdHkgICBh ZHZlcnRpc2VtZW50cyBmcm9tIGJvdGggc2lkZXMgZG9lcyBub3QgaW5jbHVkZSBWZXJzaW9uIDAs IHRoZW4gICBCR1BzZWMgVmVyc2lvbiAwIGhhcyBub3QgYmVlbiBzdWNjZXNzZnVsbHkgbmVnb3Rp YXRlZC4gIEhvd2V2ZXIsIGEgICBCR1Agc2Vzc2lvbiBpcyBzdGlsbCBuZWdvdGlhdGVkIGFuZCBo ZW5jZSB0aGUgYWJpbGl0eSB0byBleGNoYW5nZSAgIHJvdXRlcyBpcyBzdGlsbCB0aGVyZS4gIEJH UCAodW5zaWduZWQpIG1lc3NhZ2VzIGFyZSBleGNoYW5nZWQuICBTbyAgIHRoZSBjaGFpbiBvZiBB U05zIGlzIG5vdCBicm9rZW4sIGkuZS4gdGhleSBtYXkgbm90IGJlIGNvbnRpZ3VvdXMgICBCR1Bz ZWMgcGVlcnMgYnV0IGFyZSBzdGlsbCBjb250aWd1b3VzIEJHUCBwZWVycy4NCg0KDQoNCkxldCB1 cyBzYXkgdGhhdCBCR1BzZWMgY2FwYWJpbGl0eSB3YXMgbmVnb3RpYXRlZCBzdWNjZXNzZnVsbHkg YmV0d2VlbiAgIHR3byBwZWVycywgYW5kIHN1YnNlcXVlbnRseSBpdCB3YXMgcmVzZXQuICBJbiB0 aGUgbWVhbnRpbWUsIGFzc3VtZSAgIHRoYXQgdGhlIDQtYnl0ZSBBU04gY2FwYWJpbGl0eSBvciB0 aGUgbXVsdGktcHJvdG9jb2wgY2FwYWJpbGl0eSB3YXMgICBsb3N0IGJldHdlZW4gdGhlIHR3byBw ZWVycy4gIFNvIG5vdyB0aGUgQkdQc2VjIHNlc3Npb24gcmVzZXQgcmVzdWx0cyAgIGluIGZhaWx1 cmUgb2YgQkdQc2VjIGNhcGFiaWxpdHkgbmVnb3RpYXRpb24gYW5kIG9ubHkgYSBCR1Agc2Vzc2lv biBpcyAgIGVzdGFibGlzaGVkLiAgV291bGQgdGhlIG5ldHdvcmsgb3BlcmF0b3IgYmUgbm90aWZp ZWQgdGhhdCB0aGlzICAgZG93bmdyYWRlIGZyb20gQkdQc2VjIHRvIEJHUCBoYXMgaGFwcGVuZWQ/ ICBXaGF0IGlmIHRoZSBvcGVyYXRvciAgIGFsd2F5cyB3YW50cyBhIHNlY3VyZSBzZXNzaW9uIG9u bHk/ICBDYW4gdGhleSByZXF1aXJlIHRoYXQgbm8gQkdQICAgc2Vzc2lvbiBiZSBlc3RhYmxpc2hl ZCBpZiBCR1BzZWMgY2FwYWJpbGl0eSBuZWdvdGlhdGlvbiBmYWlscz8gICBPcGVyYXRvcnMgYXJl IGFkdmlzZWQgdG8gc3BlYWsgd2l0aCB0aGVpciB2ZW5kb3JzIHRvIHNldCB1cCBrbm9icyBhbmQg ICBhbGVydHMgdG8gaGF2ZSBzdWNoIG9wZXJhdGlvbnMgYW5kIG1hbmFnZW1lbnQgZmVhdHVyZXMg aW4gdGhlaXIgICBCR1BzZWMgY2FwYWJsZSByb3V0ZXJzLg0KDQoNCg0KTkVXPg0KDQoNCg0KU2Vj dGlvbiAyLjIgZGVzY3JpYmVzIHRoZSBuZWdvdGlhdGlvbiByZXF1aXJlZCB0byBlc3RhYmxpc2gg YSBCR1BzZWMtY2FwYWJsZSBwZWVyaW5nIHNlc3Npb24uIE5vdCBvbmx5IG11c3QgdGhlIEJHUHNl YyBjYXBhYmlsaXR5IGJlIGV4Y2hhbmdlZCAoYW5kIGFncmVlZCBvbiksIGJ1dCB0aGUgQkdQIG11 bHRpcHJvdG9jb2wgZXh0ZW5zaW9uIFtSRkM0NzYwXSBmb3IgdGhlIHNhbWUgQUZJIGFuZCB0aGUg Zm91ci1ieXRlIEFTIGNhcGFiaWxpdHkgW1JGQzY3OTNdIG11c3QgYWxzbyBiZSBleGNoYW5nZWQu IEZhaWx1cmUgdG8gcHJvcGVybHkgbmVnb3RpYXRlIGEgQkdQc2VjIHNlc3Npb24sIGR1ZSB0byBh IG1pc3NpbmcgY2FwYWJpbGl0eSwgZm9yIGV4YW1wbGUsIG1heSBzdGlsbCByZXN1bHQgaW4gdGhl IGV4Y2hhbmdlIG9mIEJHUCAodW5zaWduZWQpIHVwZGF0ZXMuIFdoaWxlIHRoZSBCR1AgY2hhaW4g b2YgQVNOcyBpcyBub3QgYnJva2VuLCB0aGUgc2VjdXJpdHkgY2FuIGJlIHJlZHVjZWQgYW5kIGEg Y29udGlndW91cyBzZXQgb2YgQkdQc2VjIHBlZXJzIG1heSBub3QgZXhpc3QgYW55bW9yZS4gSXQg aXMgUkVDT01NRU5ERUQgdGhhdCBhbiBpbXBsZW1lbnRhdGlvbiBsb2cgdGhlIGZhaWx1cmUgdG8g cHJvcGVybHkgbmVnb3RpYXRlIGEgQkdQc2VjIHNlc3Npb24gaWYgdGhlIGxvY2FsIEJHUCBzcGVh a2VyIGlzIGNvbmZpZ3VyZWQgZm9yIGl0LiBBbHNvLCBhbiBpbXBsZW1lbnRhdGlvbiBNVVNUIGhh dmUgYWJpbGl0eSB0byBwcmV2ZW50IGEgQkdQIHNlc3Npb24gZnJvbSBiZWluZyBlc3RhYmxpc2hl ZCBpZiBjb25maWd1cmVkIGZvciBCR1BzZWMgdXNlLg0KDQoNCg0KW1NyaXJhbS0yXSBJIGFncmVl LiBOb3cgdGhlIGRvY3VtZW50IHVzZXMgcGFyYWdyYXBoIGFib3ZlIHRoYXQgeW914oCZdmUgb2Zm ZXJlZC4gVGhlIGxhc3Qgc2VudGVuY2Ugc2xpZ2h0bHkgbW9kaWZpZWQgdG8gcmVhZCDigJzigKZp ZiBjb25maWd1cmVkIGZvciBvbmx5IEJHUHNlYyB1c2Uu4oCdDQoNCg0KDQo+IE0xLjEuIFNlY3Rp b24gMi4xLiAoVGhlIEJHUHNlYyBDYXBhYmlsaXR5KSBpbmNsdWRlcyBhIFZlcnNpb24gZmllbGQg YW5kIHNvbWUgUmVzZXJ2ZWQgYml0cywgYnV0IHRoZXJlIGFyZSBubyBJQU5BIHJlZ2lzdHJpZXMg ZGVmaW5lZCBmb3IgaG93IHRvIG1hbmFnZSB0aGVzZSBzcGFjZXMuICBQbGVhc2UgZGVmaW5lIHRo ZSByZWdpc3RyaWVzIGFuZCB0aGUgY29ycmVzcG9uZGluZyByZWdpc3RyYXRpb24gcHJvY2VkdXJl cy4NCg0KDQoNCj4+IFtTcmlyYW1dIERvbmUuIFBsZWFzZSBzZWUgdGhlIHVwZGF0ZWQgSUFOQSBD b25zaWRlcmF0aW9ucyBzZWN0aW9uLg0KDQoNCg0Kcy9SZXNlcnZlZC9VbmFzc2lnbmVkLw0KDQoN Cg0KW1NyaXJhbS0yXSBEb25lLg0KDQoNCg0KR2l2ZW4gdGhhdCB0aGVyZSBhcmUgb25seSAzIHVu YXNzaWduZWQgYml0cyBhbmQgdGhhdCBjaGFuZ2luZyB2ZXJzaW9ucyBzaG91bGQgYmUgYSBiaWcg ZGVhbCwgSSB0aGluayB0aGF0IOKAnElFVEYgUmV2aWV34oCdIGlzIG5vdCBhIHN0cm9uZyBlbm91 Z2ggcmVnaXN0cmF0aW9uIHByb2NlZHVyZS4gIFN1Z2dlc3Rpb246IHVzZSBTdGFuZGFyZHMgQWN0 aW9uIGluc3RlYWQuDQoNCg0KDQpbU3JpcmFtLTJdIE9LLiBNYWRlIHRoYXQgY2hhbmdlIGluIHRo ZSBJQU5BIGNvbnNpZGVyYXRpb25zIHNlY3Rpb24uDQoNCg0KDQpbKl0gQ2hhaXJzOiB3ZSBkb27i gJl0IG5lZWQgdG8gV0dMQyB0aGUgd2hvbGUgZG9jdW1lbnQsIGJ1dCBpdCB3b3VsZCBiZSBhIGdv b2QgaWRlYSB0byBydW4gdGhlIHJlZ2lzdHJhdGlvbiBwcm9jZWR1cmVzIGJ5IHRoZSBXRyBvbmNl IHdlIHNldHRsZSBvbiB0aGVtIOKAkyB0aGlzIGNvdWxkIGV2ZW4gYmUgZG9uZSBpbiBwYXJhbGxl bCB3aXRoIHRoZSBJRVRGIExhc3QgQ2FsbC4NCg0KDQoNCj4gTTEuMi4gU2VjdGlvbiAzLjEuIChT ZWN1cmVfUGF0aCkgZGVmaW5lcyB0aGUgRmxhZ3MgZmllbGQgYW5kIGFzc2lnbnMgdGhlIGZpcnN0 IGJpdCAoQlRXLCBpcyB0aGF0IHRoZSBNU0Igb3IgdGhlIExTQiwgcGxlYXNlIGNsYXJpZnkpLCBi dXQgZG9lc24ndCBzZXQgdXAgdGhlIHJlZ2lzdHJ5IG9yIHJlZ2lzdHJhdGlvbj4gcHJvY2VkdXJl cy4NCg0KDQoNCj4+IFtTcmlyYW1dIEl0IGlzIHRoZSBNU0IgKGxlZnQgbW9zdCBiaXQpIGFuZCB0 aGF0IGlzIG5vdyBjbGFyaWZpZWQgaW4gU2VjdGlvbiAzLjEuIFNldCB1cCBvZiB0aGUgcmVnaXN0 cnkgZm9yIHRoZSBGbGFncyBmaWVsZCBpcyBub3cgaW5jbHVkZWQgaW4gdGhlIHVwZGF0ZWQgSUFO QSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLg0KDQoNCg0KU2FtZSBjb21tZW50IGFzIGFib3ZlIGFi b3V0IOKAnElFVEYgUmV2aWV34oCdIHZzIOKAnFN0YW5kYXJkcyBBY3Rpb27igJ0NCg0KDQoNCltT cmlyYW0tMl0gRG9uZS4gTWFkZSB0aGF0IGNoYW5nZSBpbiB0aGUgSUFOQSBjb25zaWRlcmF0aW9u cyBzZWN0aW9uLg0KDQoNCg0KPiBNMi4yLiBUaGUgZGVmaW5pdGlvbiBvZiB0aGUgQkdQc2VjX1Bh dGggQXR0cmlidXRlIChhbmQgaXRzIGRldGFpbHMpIGRvbid0IGhhdmUgY2xlYXIgZXJyb3IgaGFu ZGxpbmcgcHJvY2VkdXJlcyBkZWZpbmVkIChSRkM3NjA2KS4gIFNlY3Rpb24gNC4zLiAoUHJvY2Vz c2luZyBJbnN0cnVjdGlvbnMgZm9yIENvbmZlZGVyYXRpb24gTWVtYmVycykgZG9lcyBzYXkgdGhp czogIihBcyBkaXNjdXNzZWQgaW4gU2VjdGlvbiA1LjIsIGFueSBlcnJvciBpbiB0aGUgQkdQc2Vj X1BhdGggYXR0cmlidXRlIE1VU1QgYmUgaGFuZGxlZCB1c2luZyB0aGUgInRyZWF0LWFzLXdpdGhk cmF3IiwgYXBwcm9hY2ggYXMgZGVmaW5lZCBpbiBSRkMgNzYwNiBbUkZDNzYwNl0uKSIgKGluY2x1 ZGluZyB0aGUgcGFyZW50aGVzZXMpLiAgSG93ZXZlciwgNSwyIG9ubHkgc2F5czogIkJHUHNlYyBz cGVha2VycyBNVVNUIGhhbmRsZSB0aGVzZSBlcnJvcnMgdXNpbmcgdGhlICJ0cmVhdC1hcy13aXRo ZHJhdyIgYXBwcm9hY2ggYXMgZGVmaW5lZCBpbiBSRkMgNzYwNiBbUkZDNzYwNl0uIiAgIE5vdGU6 ICJ0aGVzZSBlcnJvcnMiIGlzIG5vdCB0aGUgc2FtZSBhcyAiYW55IGVycm9yIi4gIFBsZWFzZSBk aXNjdXNzIGVycm9yIGhhbmRsaW5nIGluIGEgbW9yZSBwcm9taW5lbnQgcGxhY2UuIChIaW50OiBp dCBtYXkgZml0IGluIGEgZmF1bHQgbWFuYWdlbWVudCBkaXNjdXNzaW9uIGluIHRoZSBPcGVyYXRp b25zIGFuZCBNYW5hZ2VtZW50IFNlY3Rpb24uKQ0KDQoNCg0KPj4gW1NyaXJhbV0gIHMgL0FzIGRp c2N1c3NlZCBpbiBTZWN0aW9uIDUuMiwgYW55IGVycm9yIGluIHRoZSBCR1BzZWNfUGF0aCBhdHRy aWJ1dGUgTVVTVCBiZSBoYW5kbGVkIHVzaW5nIHRoZSAidHJlYXQtYXMtd2l0aGRyYXciLCBhcHBy b2FjaCBhcyBkZWZpbmVkIGluIFJGQyA3NjA2IFtSRkM3NjA2XS4vIEFzIGRpc2N1c3NlZCBpbiBT ZWN0aW9uIDUuMiwgYW55IHN5bnRhY3RpY2FsIG9yIHByb3RvY29sIHZpb2xhdGlvbiBlcnJvcnMg aW4gdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSBNVVNUIGJlIGhhbmRsZWQgdXNpbmcgdGhlICJ0 cmVhdC1hcy13aXRoZHJhdyIgYXBwcm9hY2ggYXMgZGVmaW5lZCBpbiBSRkMgNzYwNiBbUkZDNzYw Nl0uLw0KDQoNCg0KPj4gW1NyaXJhbV0gIFNlY3Rpb24gNC4zIGhhcyBiZWVuIHVwZGF0ZWQgYWNj b3JkaW5nbHkuDQoNCg0KDQpJIGRpZG7igJl0IGV4cGxhaW4gbXlzZWxmIGNvcnJlY3RseS4gIFNl Y3Rpb24gNC4zLiAoUHJvY2Vzc2luZyBJbnN0cnVjdGlvbnMgZm9yIENvbmZlZGVyYXRpb24gTWVt YmVycykgY292ZXJzIG9ubHkgdGhlIHByb2Nlc3NpbmcgZm9yIGNvbmZlZGVyYXRpb25zLCBzbyBw dXR0aW5nIHRleHQgaW4gdGhlcmUgYWJvdXQgYW55IGVycm9ycyBpcyBnb29kLCBidXQgZG9lc27i gJl0IGNvdmVyIHRoZSBnZW5lcmFsIGNhc2UgKGZvciBwcm9jZXNzaW5nIGFueSB1cGRhdGUpLiBP VE9ILCBTZWN0aW9uIDUuMi4gKFZhbGlkYXRpb24gQWxnb3JpdGhtKSBkb2VzbuKAmXQgYWN0dWFs bHkgdGFsayBhYm91dCDigJxhbnkgZXJyb3LigJ0gKGFzIHJlZmVyZW5jZWQgbm93IGZyb20gNC4z KSDigJMgaXQgb25seSB0YWxrcyBhYm91dCDigJx0aGVzZSBlcnJvcnPigJ0sIHdoaWNoIGNvcnJl c3BvbmQgdG8gdGhlIGxpc3Qgb2YgY2hlY2tzIGluIHRoZSBzZWN0aW9uLiAgSU9XLCB0aGVyZSBp cyBubyBnbG9iYWwgc3BlY2lmaWNhdGlvbiB0aGF0IGFueSBlcnJvciBtdXN0IHJlc3VsdCBpbiB0 cmVhdC1hcy13aXRoZHJhdy4NCg0KDQoNClNvbHV0aW9uOiAgdGFrZSB0aGUgdGV4dCBvdXQgb2Yg NC4zIGFuZCB1cGRhdGUgdGhlIHRleHQgaW4gNS4yOyBzdWdnZXN0aW9uOg0KDQoNCg0KT0xEPg0K DQoNCg0KSWYgYW55IG9mIHRoZXNlIGNoZWNrcyBmYWlsLCBpdCBpcyBhbiBlcnJvciBpbiB0aGUg QkdQc2VjX1BhdGggICBhdHRyaWJ1dGUuICBBbnkgb2YgdGhlc2UgZXJyb3JzIGluIHRoZSBCR1Bz ZWNfUGF0aCBhdHRyaWJ1dGUgYXJlICAgaGFuZGxlZCBhcyBwZXIgUkZDIDc2MDYgW1JGQzc2MDZd LiAgQkdQc2VjIHNwZWFrZXJzIE1VU1QgaGFuZGxlIHRoZXNlICAgZXJyb3JzIHVzaW5nIHRoZSAi dHJlYXQtYXMtd2l0aGRyYXciIGFwcHJvYWNoIGFzIGRlZmluZWQgaW4gUkZDIDc2MDYgICBbUkZD NzYwNl0uDQoNCg0KDQpORVc+DQoNCg0KDQpJZiBhbnkgb2YgdGhlc2UgY2hlY2tzIGZhaWwsIGl0 IGlzIGFuIGVycm9yIGluIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUuIEJHUHNlYyBzcGVha2Vy cyBNVVNUIGhhbmRsZSBhbnkgc3ludGFjdGljYWwgb3IgcHJvdG9jb2wgZXJyb3JzIGluIHRoZSBC R1BzZWNfUGF0aCBhdHRyaWJ1dGUgdXNpbmcgdGhlICJ0cmVhdC1hcy13aXRoZHJhdyIgYXBwcm9h Y2ggYXMgZGVmaW5lZCBpbiBSRkMgNzYwNiBbUkZDNzYwNl0uDQoNCg0KDQpbU3JpcmFtLTJdIEFn cmVlIHdpdGggdGhhdC4gRG9uZSBhcyBzdWdnZXN0ZWQuDQoNCg0KDQo+IE03LjEuIOKAnFdpdGgg cmVnYXJkcyB0byB0aGUgcHJvY2Vzc2luZyBvZiBkdXBsaWNhdGUgdXBkYXRlIG1lc3NhZ2VzLCBp ZiB0aGUgZmlyc3QgdXBkYXRlIG1lc3NhZ2UgaXMgdmFsaWQsIHRoZW4gYW4gaW1wbGVtZW50YXRp b24gU0hPVUxEIE5PVCBydW4gdGhlIHZhbGlkYXRpb24gcHJvY2VkdXJlIG9uIHRoZSBzZWNvbmQs IGR1cGxpY2F0ZSB1cGRhdGUgbWVzc2FnZSAoZXZlbiBpZiB0aGUgYml0cyBvZiB0aGUgc2lnbmF0 dXJlIGZpZWxkIGFyZSBkaWZmZXJlbnQpLuKAnSAgRXZlbiB0aG91Z2ggYSBkaXNjdXNzaW9uIGFi b3V0IG5vbi1kZXRlcm1pbmlzdGljIHNpZ25hdHVyZSBhbGdvcml0aG1zIHByZWNlZGVzIHRoaXMg dGV4dCwgdGhlIHZhbGlkYXRpb24gaXMgc3RpbGwgbm90IHJ1bi4gIEhvdyBjYW4gdGhlIHZhbGlk aXR5IG9mIHRoZSBQYXRoIGJlIGd1YXJhbnRlZWQgaW4gdGhpcyBjYXNlPyAgU2hvdWxkIHRoaXMg YmUgdGhlIGFjdGlvbiBmb3IgYWxsIGFsZ29yaXRobXMgb3Igb25seSBvbmVzIGtub3duIHRvIGJl IG5vbi1kZXRlcm1pbmlzdGljPw0KDQoNCg0KPj4gW1NyaXJhbV0gRGVmaW5pdGlvbiBvZiBkdXBs aWNhdGUgdXBkYXRlIGZvciBCR1BzZWM6IEEgQkdQc2VjIHVwZGF0ZSBpcyBhIGR1cGxpY2F0ZSBp ZiBpdCBpcyBpZGVudGljYWwgdG8gYW5vdGhlciB1cGRhdGUgaW4gdGhlIEFkai1SSUItaW4sIGlu Y2x1ZGluZyBTS0lzIGFuZCBBbGdvcml0aG0gSUQsIGJ1dCBub3QgaW5jbHVkaW5nIHRoZSBzaWdu YXR1cmVzLiBJZiB0aGUgZmlyc3QgdXBkYXRlIG1lc3NhZ2UgKGhhdmluZyB0aGUgKnNhbWUgU0tJ cyogYXMgdGhlIGR1cGxpY2F0ZSkgaXMgKlZhbGlkKiwgdGhlbiB0aGUgZHVwbGljYXRl4oCZcyB2 YWxpZGl0eSBzdGF0ZSBuZWVkIG5vdCBiZSBjb21wdXRlZC4gIElmIHZhbGlkaXR5IG9mIHRoZSBk dXBsaWNhdGUgd2VyZSBjb21wdXRlZCBhbmQgZm91bmQgJ1ZhbGlkJywgdGhlbiBpdCBnaXZlcyB0 aGUgcm91dGVyIG5vIG5ldyBpbmZvcm1hdGlvbi4gQWx0ZXJuYXRpdmVseSwgaWYgaXQgd2VyZSBm b3VuZCAnTm90IFZhbGlkJywgdGhlbiBpdCBvbmx5IGltcGxpZXMgdGhhdCBzb21lIGJpdCBlcnJv cnMgb2NjdXJyZWQgaW4gdGhlIHNpZ25hdHVyZXMuIFRoZXJlZm9yZSwgdGhlIEJHUHNlYyBzcGVh a2VyIHNob3VsZCBrZWVwIHRoZSAnVmFsaWQnIG9yaWdpbmFsIHVwZGF0ZSBhbmQgaWdub3JlIHRo ZSBkdXBsaWNhdGUuIEhvd2V2ZXIsIGlmIHRoZSBvcmlnaW5hbCB1cGRhdGUgd2VyZSAnTm90IFZh bGlkJywgdGhlbiBwZXJmb3JtaW5nIHZhbGlkYXRpb24gb2YgdGhlIGR1cGxpY2F0ZSBpcyByZWxl dmFudCBhbmQgU0hPVUxEIGJlIGRvbmUuDQoNCg0KDQo+PiBbU3JpcmFtXSBBZGRlZCBhIHBhcmFn cmFwaCBpbiB0aGUgbmV3IFNlY3Rpb24gNyAoT3BlcmF0aW9ucyBhbmQgTWFuYWdlbWVudCBDb25z aWRlcmF0aW9ucykgdG8gaW5jbHVkZSB0aGUgYWJvdmUgb2JzZXJ2YXRpb25zLg0KDQoNCg0KSSBz YXcgdGhlIHRleHQsIGFuZCBoYXZlIDMgcXVlc3Rpb25zL2NvbW1lbnRzOg0KDQoNCg0KMS4g4oCc 4oCmaXQgb25seSBpbXBsaWVzIHRoYXQgc29tZSBiaXQgZXJyb3JzIG9jY3VycmVkIGluIHRoZSBz aWduYXR1cmVzLuKAnSAgIFdoYXQgZG9lcyB0aGF0IG1lYW4/ICBBcmUgeW91IGltcGx5aW5nIHRo YXQgdGhlIHNlbmRlciBnb3QgdGhlIHNpZ25hdHVyZSB3cm9uZz8gIE9yIG1heWJlIHRoYXQgdGhl cmUgd2FzIHNvbWUgY29ycnVwdGlvbiBpbi10cmFuc2l0PyAgQm90aCBjYXNlcyBhcmUgKmJhZCos IGJ1dCB0aGUgY2FzZSB3aGVyZSB0aGUgc2VuZGVyIGNvdWxkIGdldCB0aGUgc2lnbmF0dXJlIHdy b25nIGlzIHNwZWNpYWxseSBzbyBiZWNhdXNlIGlmIGl0IHdhc27igJl0IGEgZHVwbGljYXRlIHVw ZGF0ZSwgdGhlbiBpdCB3b3VsZCByZXN1bHQg4oCcTm90IFZhbGlk4oCdIGFuZCB0aGVyZSBzZWVt cyB0byBiZSBubyB3YXkgdG8gZGV0ZXJtaW5lIGlmIGluIGZhY3QgdGhlIHZhbGlkaXR5IGZhaWxl ZCBvciBpZiBpdCBpcyB0aGUgY2FzZSBvZiBzb21lIGJpdCBlcnJvcnMuIOKYuQ0KDQoNCg0KW1Ny aXJhbS0yXSBUaGlzIGlzIGlycmVsZXZhbnQgbm93IGluIGxpZ2h0IG9mIHRoZSBleHBsYW5hdGlv biBwcm92aWRlZCBhdCB0aGUgdG9wIG9mIHRoaXMgZW1haWwuIFdlIGRvIG5vdCBldmVuIG5lZWQg dG8gZGVmaW5lIGR1cGxpY2F0ZSBoZXJlLCBub3IgdGFsayBhYm91dCBkZXRhaWxzIG9mIG9wdGlt aXphdGlvbnMgaW4gdGhlIGRvY3VtZW50Lg0KDQoNCg0KMi4g4oCcVGhlcmVmb3JlLCB0aGUgQkdQ c2VjIHNwZWFrZXIgc2hvdWxkIGtlZXAgdGhlICdWYWxpZCcgb3JpZ2luYWwgdXBkYXRlIGFuZCBp Z25vcmUgdGhlIGR1cGxpY2F0ZS7igJ0gTm8hICBUaGlzIGlzIG5vdCBob3cgQkdQIHdvcmtz4oCm c2VlIGJlbG93Lg0KDQoNCg0KW1NyaXJhbS0yXSBUaGlzIGlzIGlycmVsZXZhbnQgbm93IGluIGxp Z2h0IG9mIHRoZSBleHBsYW5hdGlvbiBwcm92aWRlZCBhdCB0aGUgdG9wIG9mIHRoaXMgZW1haWwu IFdlIG5lZWQgbm90IGdldCBpbnRvIHRoZSBkZXRhaWxzIG9mIHZhbGlkYXRpb24gb3B0aW1pemF0 aW9ucyBpbiB0aGUgZG9jdW1lbnQuDQoNCg0KDQozLiDigJzigKZpZiB0aGUgb3JpZ2luYWwgdXBk YXRlIHdlcmUgJ05vdCBWYWxpZCcsIHRoZW4gcGVyZm9ybWluZyB2YWxpZGF0aW9uIG9mIHRoZSBk dXBsaWNhdGUgaXMgcmVsZXZhbnQgYW5kIFNIT1VMRCBiZSBkb25lLuKAnSAgV2h5IGlzIHRoaXMg bm90IGEg4oCcTVVTVOKAnT8gIElPVywgaWYgdGhlIG9yaWdpbmFsIHVwZGF0ZSB3YXMg4oCcTm90 IFZhbGlk4oCdIHdoZW4gd291bGQgaXQgYmUgb2sgdG8gbm90IHBlcmZvcm0gdmFsaWRhdGlvbiBv biBhIG5ldyB1cGRhdGU/DQoNCg0KDQpbU3JpcmFtLTJdICBUaGlzIGlzIGlycmVsZXZhbnQgbm93 IGluIGxpZ2h0IG9mIHRoZSBleHBsYW5hdGlvbiBwcm92aWRlZCBhdCB0aGUgdG9wIG9mIHRoaXMg ZW1haWwuICBUaGUgc2VudGVuY2UgeW91IGFyZSByZWZlcnJpbmcgdG8gaXMgbm8gbG9uZ2VyIHRo ZXJlOyBub3QgbmVlZGVkLg0KDQoNCg0KPj4gW1NyaXJhbV0gTm90ZSB0aGF0IHRoZSBhYm92ZSBh cHBsaWVzIHRvIGJvdGggbm9uLWRldGVybWluaXN0aWMgYW5kIGRldGVybWluaXN0aWMgc2lnbmF0 dXJlIGFsZ29yaXRobXMuDQoNCg0KDQo+PiBNNy4yLiByZmM0MjcxIChpbiBTZWN0aW9uIDkuIChV UERBVEUgTWVzc2FnZSBIYW5kbGluZykgdGFsa3MgYWJvdXQgdGhlIGltcGxpY2l0IHdpdGhkcmF3 IG9mIGEgcm91dGUg4oCcaWYgdGhlIE5MUkkgb2YgdGhlIG5ldyByb3V0ZSBpcyBpZGVudGljYWwg dG8gdGhlIG9uZSB0aGUgcm91dGVyIGN1cnJlbnRseSBoYXMgc3RvcmVk4oCm4oCdLiAgVGhlIHNh bWUgTkxSSSBjYXNlIHNlZW1zIHRvIGJlIGEgcGFydGljdWxhciBjb25kaXRpb24gb2YgdGhlIOKA nGR1cGxpY2F0ZSB1cGRhdGXigJ0gZGVzY3JpYmVkIGhlcmUuICBJdCBtaWdodCBiZSBhIGdvb2Qg aWRlYSB0byBtZW50aW9uIHRoYXQgYSDigJxkdXBsaWNhdGUgdXBkYXRl4oCdIHJlc3VsdHMgaW4g dGhlIGltcGxpY2l0IHdpdGhkcmF3IG9mIHRoZSBvcmlnaW5hbCB1cGRhdGUuICBXaGF0IGhhcHBl bnMgaWYgYSB0aGlyZCBkdXBsaWNhdGUgcm91dGUgaXMgcmVjZWl2ZWQgKHRoZSBmaXJzdCBvbmUg d2FzIHZhbGlkLCB0aGUgc2Vjb25kIG9uZSB3YXMgbm90IHZhbGlkYXRlZCksIHNob3VsZCBpdCBi ZSB2YWxpZGF0ZWQ/DQoNCg0KDQo+PiBbU3JpcmFtXSBJbiBSRkMgNDI3MSwgd2hlbiB0aGVyZSBp cyBhIGR1cGxpY2F0ZSB1cGRhdGUsIHRoZSBOUkxJIGFuZCBwYXRoIGFuZCBhbGwgb3RoZXIgYXR0 cmlidXRlcyBhcmUgaWRlbnRpY2FsLiBUaGVyZSBpcyBubyBpbXBsaWNpdCB3aXRoZHJhdy4gVGhl IHJvdXRlciBrZWVwcyB3aGF0IGl0IGFscmVhZHkgaGFzLiBJbiB0aGUgY2FzZSBvZiBCR1BzZWMs IGEgcm91dGVyIGtlZXBzIHRoZSBvcmlnaW5hbCBpZiBpdCB3YXMgdmFsaWQsIGFuZCBpZ25vcmVz IHRoZSBkdXBsaWNhdGUuIEl0IGNoZWNrcyB0aGUgdmFsaWRpdHkgb2YgdGhlIGR1cGxpY2F0ZSBv bmx5IGlmIHRoZSBvcmlnaW5hbCB3ZXJlIGludmFsaWQuDQoNCg0KDQpJbiBwbGFpbiBCR1AsIGlm IGEgZHVwbGljYXRlIHVwZGF0ZSAoYXMgZGVmaW5lZCBhYm92ZSB3aGVyZSBldmVyeXRoaW5nIGlz IGlkZW50aWNhbCkgaXMgcmVjZWl2ZWQsIHRoZW4gdGhlIG9yaWdpbmFsIG9uZSBpcyByZXBsYWNl ZCBieSB0aGUgbmV3IG9uZSDigJMgaW4gdGhpcyBzcGVjaWZpYyBjYXNlICh3aGVyZSBldmVyeXRo aW5nIGlzIGlkZW50aWNhbCksIGl0IG1heSBsb29rIGxpa2UgdGhlIHJvdXRlciBrZWVwcyB3aGF0 IGl0IGFscmVhZHkgaGFz4oCmYnV0IHRoZSBnZW5lcmFsIHJ1bGUgaXMgdG8gcmVwbGFjZSB0aGUg b2xkIHVwZGF0ZSB3aXRoIGEgbmV3IG9uZSBmb3IgdGhlIHNhbWUgcHJlZml4LiBXaGF0IHlvdSBh cmUgcHJvcG9zaW5nIGFib3ZlICjigJxJbiB0aGUgY2FzZSBvZiBCR1BzZWMsIGEgcm91dGVyIGtl ZXBzIHRoZSBvcmlnaW5hbCBpZiBpdCB3YXMgdmFsaWQsIGFuZCBpZ25vcmVzIHRoZSBkdXBsaWNh dGUu4oCdKSBpcyBhIHNpZ25pZmljYW50IGNoYW5nZSB3aXRoIHJlc3BlY3QgdG8gQkdQIHRoYXQg aXMgbm90IGV4cGxpY2l0bHkgY2FsbGVkIG91dC4gIEkgaGF2ZW7igJl0IHNlZW4gdGhpcyBiZWhh dmlvciBtZW50aW9uZWQgYW55d2hlcmUgaW4gdGhlIGRyYWZ0IOKAkyBpdCBoYXMgb25seSBjb21l IHVwIG5vdy4gSU1ITywgbm90IG9ubHkgc2hvdWxkIHRoZSBpbXBsaWNpdCB3aXRoZHJhdyBiZWhh dmlvciBub3QgY2hhbmdlLCBidXQgYnkgaWdub3JpbmcgdGhlIHNlY29uZCB1cGRhdGUgeW914oCZ cmUgaWdub3JpbmcgYSBwb3RlbnRpYWxseSBpbXBvcnRhbnQgY2hhbmdlIGluIHRoZSB0b3BvbG9n eS9zdHJ1Y3R1cmUgb2YgdGhlIG5ldHdvcmsu4oCmDQoNCg0KDQpbU3JpcmFtLTJdICBBZ2Fpbiwg dGhpcyBpcyBpcnJlbGV2YW50IG5vdyBpbiBsaWdodCBvZiB0aGUgZXhwbGFuYXRpb24gcHJvdmlk ZWQgYXQgdGhlIHRvcCBvZiB0aGlzIGVtYWlsIGFuZCB0aGUgY2hhbmdlcyBtYWRlIGluIHRoZSBk b2N1bWVudC4gTm90aGluZyBzYWlkIGluIHZlcnNpb24tMjAgdGhhdCBjb250cmFkaWN0cyB3aGF0 IGlzIGRvbmUgaW4gcGxhaW4gQkdQIHdpdGggZHVwbGljYXRlcy4NCg0KDQoNCj4+IE0xMC4gIElu IFNlY3Rpb24gNy4yLiAoT24gdGhlIFJlbW92YWwgb2YgQkdQc2VjIFNpZ25hdHVyZXMpOiDigJzi gKZ0aGUgcHJvdG9jb2wgc3BlY2lmaWVzIHRoYXQgYSBCR1BzZWMgc3BlYWtlciBjaG9vc2luZyB0 byBwcm9wYWdhdGUgdGhlIHJvdXRlIGFkdmVydGlzZW1lbnQgaW4gc3VjaCBhbiB1cGRhdGUgbWVz c2FnZSBTSE9VTEQgYWRkIGl0cyBzaWduYXR1cmUgdG8gZWFjaCBvZiB0aGUgU2lnbmF0dXJlX0Js b2Nrcy7igJ0gICBJIGJlbGlldmUgdGhlIHJlZmVyZW5jZSBpcyBTZWN0aW9uIDQuMiAocGxlYXNl IGFkZCBpdCkuICBIb3dldmVyLCB0aGF0IFNlY3Rpb24gZG9lc27igJl0IHVzZSBub3JtYXRpdmUg bGFuZ3VhZ2UgKOKAnEZvciBlYWNoIFNpZ25hdHVyZV9CbG9jayBjb3JyZXNwb25kaW5nIHRvIGFu IGFsZ29yaXRobSBzdWl0ZSB0aGF0IHRoZSBCR1BzZWMgc3BlYWtlciBkb2VzIHN1cHBvcnQsIHRo ZSBCR1BzZWMgc3BlYWtlciBhZGRzIGEgbmV3IFNpZ25hdHVyZSBTZWdtZW50IHRvIHRoZSBTaWdu YXR1cmVfQmxvY2su4oCdKSAgIEluIGFueSBjYXNlLCB0aGUg4oCcU0hPVUxE4oCdIGluIDcuMiBp cyBvdXQgb2YgcGxhY2UgYmVjYXVzZSBpdCBpcyByZWZlcmVuY2luZyBhIGZhY3QgKHBvaW50aW5n IGF0IHRoZSBvdGhlciBzZWN0aW9uKSBhbmQgbm90IGJlaW5nIHVzZWQgbm9ybWF0aXZlbHkg4oCT IGlmIHlvdSB3YW50IHRoZSDigJxTSE9VTETigJ0gdG8gYmUgbm9ybWF0aXZlLCB0aGVuIGl0IHNo b3VsZCBiZSBiYWNrIGluIDQuMi4NCg0KDQoNCj4+IFtTcmlyYW1dIFllcywgYWdyZWUuIEZpeGVk IHRoZSB3b3JkaW5nIHBlciB5b3VyIHN1Z2dlc3Rpb24gaW4gYm90aCBwbGFjZXMgKFNlY3Rpb25z IDQuMiBhbmQgNy4yKS4gQWRkZWQgcmVmZXJlbmNlIHRvIFNlY3Rpb24gNC4yIGluIFNlY3Rpb24g Ny4yLiBOb3cgNC4yIHJlYWRzOiDigJxGb3IgZWFjaCBTaWduYXR1cmVfQmxvY2sgY29ycmVzcG9u ZGluZyB0byBhbiBhbGdvcml0aG0gc3VpdGUgdGhhdCB0aGUgQkdQc2VjIHNwZWFrZXIgZG9lcyBz dXBwb3J0LCB0aGUgQkdQc2VjIHNwZWFrZXIgU0hPVUxEIGFkZCBhIG5ldyBTaWduYXR1cmUgU2Vn bWVudCB0byB0aGUgU2lnbmF0dXJlX0Jsb2Nr4oCdDQoNCg0KDQpTaG91bGQgdGhhdCDigJxTSE9V TETigJ0gYmUgYSDigJxNVVNU4oCdP+KApg0KDQoNCg0KW1NyaXJhbS0yXSBJIGFncmVlLiBNVVNU IGlzIGFwcHJvcHJpYXRlIGhlcmUuIERvbmUgdGhlIHN1YnN0aXR1dGlvbi4NCg0KDQoNCj4gTTEy LiBUaGUgbWFuZGF0b3J5IGFkZGl0aW9uIG9mIFNlY3VyZV9QYXRoIGFuZCBTaWduYXR1cmUgc2Vn bWVudHMgaW4gYSBDb25mZWRlcmF0aW9uIHJlc3VsdHMgaW4gdGhlIGluY29uc2lzdGVudCBhdXRo b3JpemF0aW9uIGNoYWluIG1lbnRpb25lZCBpbiBTZWN0aW9uIDQuMy4gKFByb2Nlc3NpbmcgSW5z dHJ1Y3Rpb25zIGZvciBDb25mZWRlcmF0aW9uIE1lbWJlcnMpOiDigJxGb3IgYSBzaWduYXR1cmUg cHJvZHVjZWQgYnkgYSBwZWVyIEJHUHNlYyBzcGVha2VyIG91dHNpZGUgb2YgYSBjb25mZWRlcmF0 aW9uLCB0aGUgVGFyZ2V0IEFTIHdpbGwgYWx3YXlzIGJlIHRoZSBBUyBDb25mZWRlcmF0aW9uIElk ZW50aWZpZXIgKHRoZSBwdWJsaWMgQVMgbnVtYmVyIG9mIHRoZSBjb25mZWRlcmF0aW9uKSBhcyBv cHBvc2VkIHRvIHRoZSBNZW1iZXItQVMgTnVtYmVyLuKAnSAgSXQgc2VlbXMgdG8gbWUgdGhhdCB0 aGlzIGRpc2NvbnRpbnVpdHkgaW4gdGhlIEFTTiBsaXN0IGJyZWFrcyB0aGUg4oCcY3J5cHRvZ3Jh cGhpYyBhc3N1cmFuY2UgdGhhdOKApkV2ZXJ5IEFTIG9uIHRoZSBwYXRoIG9mIEFTZXMgbGlzdGVk IGluIHRoZSB1cGRhdGUgbWVzc2FnZSBoYXMgZXhwbGljaXRseSBhdXRob3JpemVkIHRoZSBhZHZl cnRpc2VtZW50IG9mIHRoZSByb3V0ZSB0byB0aGUgc3Vic2VxdWVudCBBUyBpbiB0aGUgcGF0aOKA nSBiZWNhdXNlIHRoZXJlIGlzIG5vIHdheSB0byB2ZXJpZnkgdGhhdCB0aGUgTWVtYmVyLUFTIGlu IHRoZSBmaXJzdCBTZWN1cmVfUGF0aCBzZWdtZW50IGlzIGluIGZhY3QgdGhlIG9uZSBwZWVyaW5n IHdpdGggdGhlIGV4dGVybmFsIG5laWdoYm9yLiAgSSByZWFsaXplIHRoYXQgdGhlIHJpc2sgbWF5 IGJlIG1pbmltaXplZCBieSBhbiDigJxpbnRlcm5hbCB0cnVzdOKAnSBmYWN0b3IsIGJ1dCBJIHdv dWxkIGxpa2UgdG8gc2VlIGEgZGlzY3Vzc2lvbiBhYm91dCB0aGlzIGlzc3VlIGluIHRoZSBTZWN1 cml0eSBDb25zaWRlcmF0aW9ucy4NCg0KDQoNCj4+IFtTcmlyYW1dIFNlZSB0aGUgbmV3IHNlY29u ZCBwYXJhZ3JhcGggaW4gU2VjdGlvbiA3LjQuIFRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9uIHRo YXQgeW91IG1lbnRpb24gaGVyZSBhYm91dCB3aXRoIHRoZSB3YXkgY29uZmVkZXJhdGlvbnMgYXJl IGhhbmRsZWQgaXMgZGVzY3JpYmVkIGFuZCBkaXNjdXNzZWQgdGhlcmUuDQoNCg0KDQpQZXJzb25h bGx5LCBJIHdvdWxkIGhhdmUgcHJlZmVycmVkIGlmIHlvdSBhY3R1YWxseSBzb2x2ZWQgdGhlIHBy b2JsZW0uIE9uZSBzb2x1dGlvbiBpcyB0byBib3Jyb3cgZnJvbSBkcmFmdC1pZXRmLXNpZHItYXMt bWlncmF0aW9uIGFuZCBmb3J3YXJkIHNpZ24gZnJvbSB0aGUgQ29uZmVkZXJhdGlvbiBBUyAodGhl IHB1YmxpYyBudW1iZXIpIHRvIHRoZSBNZW1iZXItQVMgd2l0aCBwQ291bnQ9MC4gIE5vdGUgdGhh dCB0aGlzIG9wZXJhdGlvbiB3b3VsZCB0YWtlIHBsYWNlIGluc2lkZSB0aGUgYm9yZGVyIENvbmZl ZGVyYXRpb24gcm91dGVyLCBzbyB0aGVyZSBhcmUgbm8gaXNzdWVzIHdpdGggcENvdW50PTAgYW5k IHRoZSBmdWxsIHBhdGggY29udGludWl0eSBpcyBwcmVzZXJ2ZWQuWypdIENoYWlyczogSSB0aGlu ayB0aGF0IHRoaXMgcGFydCAod2hldGhlciBpdCBpcyBzb2x2ZWQgb3Igbm90KSBzaG91bGQgYWxz byBiZSBib3VuY2VkIGJ5IHRoZSBXRy7igKYNCg0KDQoNCltTcmlyYW0tMl0gUGxlYXNlIHNlZSBk aXNjdXNzaW9uIGF0IHRoZSB0b3Agb2YgdGhpcyBlbWFpbC4gSSBhbSBhZnJhaWQsIHRoZSBzb2x1 dGlvbiB5b3UgcHJvcG9zZSB3aWxsIG5vdCB3b3JrLiBUaGUgZmlyc3QgQVMgaW4gdGhlIENvbmZl ZGVyYXRpb24gY2FuIHN0aWxsIHR1bm5lbCB0aGUgdXBkYXRlIHRvIHRoZSBzZWNvbmQgQVMgaXQg aXMgY29sbHVkaW5nIHdpdGgsIGFuZCB0aGUgc2Vjb25kIEFTIOKAnGZvcndhcmQgc2lnbnMgZnJv bSB0aGUgQ29uZmVkZXJhdGlvbiBBUyAodGhlIHB1YmxpYyBudW1iZXIpIHRvIHRoZSBNZW1iZXIt QVMgd2l0aCBwQ291bnQ9MOKAnS4gU28gdGhlIHByb2JsZW0geW91IG9yaWdpbmFsbHkgaWRlbnRp ZmllZCBkb2VzbuKAmXQgZ28gYXdheS4NCg0KDQoNCj4gbTguIFNlY3Rpb24gNS4xLiAoT3ZlcnZp ZXcgb2YgQkdQc2VjIFZhbGlkYXRpb24pOiDigJxJdCBpcyBleHBlY3RlZCB0aGF0IEJHUCBwZWVy cyB3aWxsIGdlbmVyYWxseSBwcmVmZXIgcm91dGVzIHJlY2VpdmVkIHZpYSAnVmFsaWQnIEJHUHNl YyB1cGRhdGUgbWVzc2FnZXMgb3ZlciBib3RoIHJvdXRlcyByZWNlaXZlZCB2aWEgJ05vdCBWYWxp ZCcgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcyBhbmQgcm91dGVzIHJlY2VpdmVkIHZpYSB1cGRhdGUg bWVzc2FnZXMgdGhhdCBkbyBub3QgY29udGFpbiB0aGUgQkdQc2VjX1BhdGggYXR0cmlidXRl4oCm KFNlZSBbSS1ELmlldGYtc2lkci1iZ3BzZWMtb3BzXeKApuKAnSAgSSByZWFkIHRoaXMgcGllY2Ug b2YgdGV4dCBhcyBzYXlpbmcgdGhhdCByb3V0ZXMgaW4gTm90IFZhbGlkIHVwZGF0ZXMgYXJlIGV4 cGVjdGVkIHRvIGJlIHVzZWQgKGV2ZW4gdGhvdWdoIHRoZXkgYXJlIG5vdCB2YWxpZCkuICBCZXNp ZGVzIHRoZSBmYWN0IHRoYXQgSS1ELmlldGYtc2lkci1iZ3BzZWMtb3BzIGRvZXMgcmVjb21tZW5k IHVzaW5nIE5vdCBWYWxpZCBhbm5vdW5jZW1lbnRzIChpbiBTZWN0aW9uIDcpLCBhcmUgdGhlcmUg b3RoZXIgcmVhc29ucyBmb3IgdGhpcyBkb2N1bWVudCB0byBleHBlY3QgdGhlaXIgdXNlPw0KDQoN Cg0KPj4gW1NyaXJhbV0gSWYgb25seSBhIOKAmE5vdCBWYWxpZOKAmSB1cGRhdGUgaXMgYXZhaWxh YmxlIGZvciBhIHByZWZpeCwgdGhlbiB0aGUgdXBkYXRlIGlzIHVzZWQgc2luY2Ugb3RoZXJ3aXNl IHRoZSBwcmVmaXggd291bGQgYmUgdW5yZWFjaGFibGUuIEJvdGggQkdQc2VjIGFuZCBSUEtJL29y aWdpbiB2YWxpZGF0aW9uIGFyZSBleHBlY3RlZCB0byBkZXByZWYgaW52YWxpZCB1cGRhdGVzIHJh dGhlciB0aGFuIGlnbm9yZSB0aGVtLiBUaGlzIGlzIGRyaXZlbiBieSBvcGVyYXRvciBwb2xpY3kg YW5kIGNhbiB2YXJ5LiBIZW5jZSwgd2UgYXJlIGRlbGliZXJhdGVseSBub3QgdXNpbmcgYW55IG5v cm1hdGl2ZSBsYW5ndWFnZSBoZXJlLg0KDQoNCg0KSG9uZXN0bHksIHVzaW5nIOKAnE5vdCBWYWxp ZOKAnSB1cGRhdGVzIG1ha2VzIG5vIHNlbnNlIHRvIG1lLiAgV2XigJlyZSBidWlsZGluZyBhbGwg dGhpcyBtYWNoaW5lcnksIGNoYW5naW5nIEJHUCwgZXRjLi4ganVzdCB0byBlbmQgdXAgdXNpbmcg dXBkYXRlcyB0aGF0IGFyZSBub3QgdmFsaWQgYW55d2F5LiAgV2h5IGFyZSB3ZSBkb2luZyBhbGwg dGhpcyB3b3JrIHRoZW4/IT8gIOKYuUkgdW5kZXJzdGFuZCB0aGF0LCBzcGVjaWFsbHkgYXQgdGhl IGJlZ2lubmluZywgcGVvcGxlIG1heSB3YW50IHRvIHVzZSDigJxOb3QgVmFsaWTigJ0gdXBkYXRl c+KApmJ1dCB0aGF0IGlzIGFuIG9wZXJhdGlvbmFsIGNvbnNpZGVyYXRpb24gKGFzIHlvdSBzYWlk IGFib3ZlKS4gIFBsZWFzZSB0YWtlIHRoZSB0ZXh0IG91dCBmcm9tIHRoaXMgZG9jdW1lbnQgdGhh dCByZWNvbW1lbmRzIHVzaW5nIOKAnE5vdCBWYWxpZOKAneKApmFuZCBsZXQgSS1ELmlldGYtc2lk ci1iZ3BzZWMtb3BzIGRlYWwgd2l0aCB0aGF0IHJlY29tbWVuZGF0aW9uLuKApg0KDQoNCg0KW1Ny aXJhbS0yXSAgVGhlIHRleHQgaGFzIGJlZW4gZGVsZXRlZCBhcyBzdWdnZXN0ZWQuDQoNCg0KDQpO ZXcgY29tbWVudDoNCg0KDQoNCk4xLiBTZWN0aW9uIDIuMi4gKE5lZ290aWF0aW5nIEJHUHNlYyBT dXBwb3J0KSBzYXlzIHRoYXQgYmVjYXVzZSDigJxCR1BzZWMgdXBkYXRlIG1lc3NhZ2VzIGNhbiBi ZSBxdWl0ZSBsYXJnZSwgdGhlcmVmb3JlIGFueSBCR1BzZWMgc3BlYWtlcuKAplNIT1VMRCBhbHNv IGFubm91bmNlIHN1cHBvcnQgZm9yIHRoZSBjYXBhYmlsaXR5IHRvIHJlY2VpdmUgQkdQIGV4dGVu ZGVkIG1lc3NhZ2VzIFtJLUQuaWV0Zi1pZHItYmdwLWV4dGVuZGVkLW1lc3NhZ2VzXS7igJ0gICBX aGF0IGRvZXMgdGhpcyBtZWFuIHdpdGggcmVzcGVjdCB0byB0aGUgc2Vzc2lvbiBlc3RhYmxpc2ht ZW50IHJlcXVpcmVtZW50cz8gIFRoaXMgY2FwYWJpbGl0eSBpcyBub3QgbWFuZGF0b3J5IChTSE9V TEQgaXMgdXNlZCBhbmQgbm90IE1VU1QpLCBidXQgYXMgQkdQc2VjIGlzIGRlcGxveWVkIG1vcmUg YW5kIG1vcmUsIHRoZSBzeXN0ZW0gbWF5IG5vdCB3b3JrIGFueW1vcmUgdW5sZXNzIGl0IGlzIGV4 Y2hhbmdlZC4gICBXaHkgd2FzbuKAmXQg4oCcTVVTVOKAnSB1c2VkPyAgSeKAmW0gZ3Vlc3Npbmcg dGhhdCBwYXJ0IG9mIHRoZSByZWFzb24gbWF5IGJlIGF2YWlsYWJpbGl0eSBvZiB0aGUgZmVhdHVy ZeKApiAgSSB0aGluayB0aGF0IHRoZSBwb3RlbnRpYWwgb2YgaGF2aW5nIGEgcHJvcGVybHkgbmVn b3RpYXRlZCBCR1BzZWMgc2Vzc2lvbiBzdGlsbCBub3Qgd29yayAoYmVjYXVzZSB0aGUgbWVzc2Fn ZXMgYXJlIHRvbyBiaWcpIHNob3VsZCBhdCBsZWFzdCBiZSBtZW50aW9uZWQgaW4gdGhlIG5ldyBP cGVyYXRpb25zIGFuZCBNYW5hZ2VtZW50IENvbnNpZGVyYXRpb25zIFNlY3Rpb24uDQoNCg0KDQpb U3JpcmFtLTJdIFRoZSBmb2xsb3dpbmcgcGFyYSBhZGRlZCBpbiB0aGUgb3BzIGFuZCBtZ210LiBz ZWN0aW9uOg0KDQoNCg0KSW4gU2VjdGlvbiAyLjIsIGlzIHdhcyBzdGF0ZWQgdGhhdCBhIEJHUHNl YyBzcGVha2VyIFNIT1VMRCBhbm5vdW5jZQ0KDQogICBzdXBwb3J0IGZvciB0aGUgY2FwYWJpbGl0 eSB0byByZWNlaXZlIEJHUCBleHRlbmRlZCBtZXNzYWdlcy4gIExhY2sgb2YNCg0KICAgbmVnb3Rp YXRpb24gb2YgdGhpcyBjYXBhYmlsaXR5IGlzIG5vdCBleHBlY3RlZCB0byBwb3NlIGEgcHJvYmxl bSBpbg0KDQogICB0aGUgZWFybHkgeWVhcnMgb2YgQkdQc2VjIGRlcGxveW1lbnQuICBIb3dldmVy LCBhcyBCR1BzZWMgaXMgZGVwbG95ZWQNCg0KICAgbW9yZSBhbmQgbW9yZSwgdGhlIEJHUHNlYyB1 cGRhdGUgbWVzc2FnZXMgd291bGQgZ3JvdyBpbiBzaXplIGFuZCBzb21lDQoNCiAgIG1lc3NhZ2Vz IG1heSBiZSBkcm9wcGVkIGR1ZSB0byB0aGVpciBzaXplIGV4Y2VlZGluZyB0aGUgY3VycmVudCA0 Sw0KDQogICBieXRlcyBsaW1pdC4gIFRoZXJlZm9yZSwgaXQgaXMgc3Ryb25nbHkgUkVDT01NRU5E RUQgdGhhdCBhbGwgQkdQc2VjDQoNCiAgIHNwZWFrZXJzIG5lZ290aWF0ZSB0aGUgZXh0ZW5kZWQg bWVzc2FnZSBjYXBhYmlsaXR5IHdpdGhpbiBhDQoNCiAgIHJlYXNvbmFibGUgcGVyaW9kIG9mIHRp bWUgYWZ0ZXIgaW5pdGlhbCBkZXBsb3ltZW50IG9mIEJHUHNlYy4NCg0KDQoNCg0KDQpOMi4gVGhl IHJlZmVyZW5jZXMgdG8gUkZDNTIyNiBhbmQgUkZDNjQ4NyBzaG91bGQgYmUgTm9ybWF0aXZlLg0K DQoNCg0KW1NyaXJhbS0yXSBEb25lLg0KDQoNClNyaXJhbQ0K --_000_DM2PR09MB04461678B8C50EEB716FC52A84830DM2PR09MB0446namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyIgc3R5bGU9 ImRpc3BsYXk6bm9uZTsiPjwhLS0gUCB7bWFyZ2luLXRvcDowO21hcmdpbi1ib3R0b206MDt9IC0t Pjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBkaXI9Imx0ciI+DQo8ZGl2IGlkPSJkaXZ0YWdkZWZh dWx0d3JhcHBlciIgc3R5bGU9ImZvbnQtc2l6ZToxMnB0O2NvbG9yOiMwMDAwMDA7Zm9udC1mYW1p bHk6Q2FsaWJyaSxBcmlhbCxIZWx2ZXRpY2Esc2Fucy1zZXJpZjsiIGRpcj0ibHRyIj4NCjxwPjxm b250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46 IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmOyI+QWx2YXJvLDwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBO ZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZu YnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPlRoYW5rcyBmb3IgdGhpcyBzZXQg b2YgZnVydGhlciBjb21tZW50cy9xdWVzdGlvbnMvZGlzY3Vzc2lvbi4gVGhleSBhcmUgdmVyeSBp bnNpZ2h0ZnVsIGFuZCBoZWxwZnVsLjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBO ZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZu YnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPkkgaGF2ZSB1cGxvYWRlZCB2ZXJz aW9uLTIwIHdoaWNoIGluY2x1ZGVzIGNoYW5nZXMgYmFzZWQgb24geW91ciBsYXRlc3QgY29tbWVu dHMuDQo8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0K PHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Ij5SZWdhcmRpbmcgeW91ciBzZWN1cml0eSBjb25jZXJuIHdpdGgg dGhlIG1ldGhvZCB1c2VkIGZvciBjb25mZWRlcmF0aW9uczo8L3NwYW4+PC9wPg0KPHA+PGZvbnQg ZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGlu IDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJv bWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5UaGUgcHJv YmxlbSB5b3UgZGVzY3JpYmVkIGlzIGEgdmFyaWFudCBvZiB0aGUgcHJvYmxlbSBvZiBjb2xsdXNp b24gYmV0d2VlbiBub24tcGVlcmluZyBBU2VzIGJ5IHR1bm5lbGluZy4gVGhlIFdHIGhhZCBkaXNj dXNzZWQgdGhpcyBwcm9ibGVtIChhbHRob3VnaCBpbiBzbGlnaHRseSBkaWZmZXJlbnQgY29udGV4 dCkuDQogU2VlIHRoZSB0aHJlYWQgYXQ6PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVz IE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+ Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250 PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PGEgaWQ9IkxQbG5rNTI4MDYy IiBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL3NpZHIvY3VycmVu dC9tc2cwNzI2MC5odG1sIiBwcmV2aWV3cmVtb3ZlZD0idHJ1ZSI+PGZvbnQgY29sb3I9IiMwNTYz YzEiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWwtYXJjaGl2ZS93ZWIvc2lkci9jdXJyZW50L21z ZzA3MjYwLmh0bWw8L2ZvbnQ+PC9hPg0KPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVz IE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+ Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250 PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+QXQgdGhlIHRpbWUsIHRoZSBX RyBhZ3JlZWQgdGhhdCBpdCB3YXMgYmV5b25kIHRoZSBzY29wZSBvZiBCR1BzZWMgdG8gc29sdmUg dGhlIHByb2JsZW0gb2YgY29sbHVzaW9uIGJldHdlZW4gbm9uLXBlZXJpbmcgQVNlcyB1c2luZyBP T0IgY29tbXVuaWNhdGlvbi4gQkdQc2VjIGlzIGRlc2lnbmVkIHRvIHByb3RlY3QNCiBtZXNzYWdl cyBzZW50IHdpdGhpbiBCR1AgKGkuZS4gd2l0aGluIHRoZSBjb250cm9sIHBsYW5lKSDigJMgbm90 IHdoZW4gdGhlIGNvbnRyb2wgcGxhbmUgaW4gYnlwYXNzZWQuDQo8L3NwYW4+PC9wPg0KPHA+PGZv bnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjog MGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3 IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5TbyBJ IGhhdmUgdGhlIGFkZGVkIHRoZSBmb2xsb3dpbmcgbmV3IHdvcmRpbmcgaW4gdmVyc2lvbi0yMCBp biB0aGUgb3BzIGFuZCBtZ210LiBzZWN0aW9uOjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJU aW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhw dDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp ZjsiPiZuYnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwv Zm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5v cm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5UaGVyZSBpcyBhIHBvc3NpYmls aXR5IG9mIHBhc3NpbmcgYSBCR1BzZWMgdXBkYXRlIHZpYSB0dW5uZWxpbmc8L3NwYW4+PC9wPg0K PHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1h bGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5i c3A7DQo8L3NwYW4+YmV0d2VlbiBjb2xsdWRpbmcgQVNlcy48c3BhbiBzdHlsZT0ibXNvLXNwYWNl cnVuOiB5ZXM7Ij4mbmJzcDsgPC9zcGFuPkZvciBleGFtcGxlLCBzYXksIEFTLVggZG9lcyBub3Qg cGVlciB3aXRoPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9m b250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMHB0OyBsaW5lLWhlaWdodDogbm9y bWFsOyBtc28tbGF5b3V0LWdyaWQtYWxpZ246IG5vbmU7Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPjxzcGFuIHN0eWxlPSJtc28tc3Bh Y2VydW46IHllczsiPiZuYnNwOyZuYnNwOw0KPC9zcGFuPkFTLVksIGJ1dCBjb2xsdWRlcyB3aXRo IEFTLVksIHNpZ25zIGFuZCBzZW5kcyBhIEJHUHNlYyB1cGRhdGUgdG8gQVMtWTwvc3Bhbj48L3A+ DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0i bWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91dC1ncmlk LWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsm bmJzcDsNCjwvc3Bhbj5ieSB0dW5uZWxpbmcuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVz OyI+Jm5ic3A7IDwvc3Bhbj5BUy1ZIGNhbiB0aGVuIGZ1cnRoZXIgc2lnbiBhbmQgcHJvcGFnYXRl IHRoZSBCR1BzZWM8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48 L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBu b3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+dXBkYXRlIHRvIGl0cyBwZWVycy48 c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsgPC9zcGFuPkl0IGlzIGJleW9u ZCB0aGUgc2NvcGUgb2YgdGhlIEJHUHNlYyBwcm90b2NvbDwvc3Bhbj48L3A+DQo8cD48Zm9udCBm YWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4g MGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBub25l OyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bh bj50byBkZXRlY3QgdGhpcyBmb3JtIG9mIG1hbGljaW91cyBiZWhhdmlvci48c3BhbiBzdHlsZT0i bXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5CR1BzZWMgaXMgZGVzaWduZWQgdG88 L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1s YXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVz OyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+cHJvdGVjdCBtZXNzYWdlcyBzZW50IHdpdGhpbiBCR1Ag KGkuZS4gd2l0aGluIHRoZSBjb250cm9sIHBsYW5lKSAtPC9zcGFuPjwvcD4NCjxwPjxmb250IGZh Y2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAw aW4gMHB0OyBsaW5lLWhlaWdodDogbm9ybWFsOyBtc28tbGF5b3V0LWdyaWQtYWxpZ246IG5vbmU7 Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp ZjsiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOyZuYnNwOw0KPC9zcGFu Pm5vdCB3aGVuIHRoZSBjb250cm9sIHBsYW5lIGluIGJ5cGFzc2VkLjwvc3Bhbj48L3A+DQo8cD48 Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2lu OiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWdu OiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJv bWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVp Z2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFu PjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0 eWxlPSJtYXJnaW46IDBpbiAwaW4gMHB0OyBsaW5lLWhlaWdodDogbm9ybWFsOyBtc28tbGF5b3V0 LWdyaWQtYWxpZ246IG5vbmU7Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjsiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZu YnNwOyZuYnNwOw0KPC9zcGFuPkEgdmFyaWFudCBvZiB0aGUgY29sbHVzaW9uIGJ5IHR1bm5lbGlu ZyBtZW50aW9uZWQgYWJvdmUgY2FuIGhhcHBlbiBpbjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNl PSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGlu IDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBub25lOyI+ DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj50 aGUgY29udGV4dCBvZiBBUyBjb25mZWRlcmF0aW9ucy48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVu OiB5ZXM7Ij4mbmJzcDsgPC9zcGFuPg0KV2hlbiBhIEJHUHNlYyByb3V0ZXIgKG91dHNpZGUgb2Yg YTwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+ DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNv LWxheW91dC1ncmlkLWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5 ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5jb25mZWRlcmF0aW9uKSBpcyBmb3J3YXJkaW5nIGFu IHVwZGF0ZSB0byBhIG1lbWJlciBvZiB0aGU8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGlt ZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7 IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNw YW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+Y29uZmVk ZXJhdGlvbiwgaXQgc2lnbnMgdGhlIHVwZGF0ZSB0byB0aGUgcHVibGljIEFTTiBvZiB0aGU8L3Nw YW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1sYXlv dXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+ Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+Y29uZmVkZXJhdGlvbiBhbmQgbm90IHRvIHRoZSBtZW1iZXIn cyBBU04gKHNlZSBTZWN0aW9uIDQuMykuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+ Jm5ic3A7DQo8L3NwYW4+U2FpZDwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcg Um9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1o ZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij48c3BhbiBzdHls ZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5tZW1iZXIgY2FuIHR1 bm5lbCB0aGUgc2lnbmVkIHVwZGF0ZSB0byBhbm90aGVyIG1lbWJlciBhcyBpcyAoaS5lLjwvc3Bh bj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBz dHlsZT0ibWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91 dC1ncmlkLWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4m bmJzcDsmbmJzcDsNCjwvc3Bhbj53aXRob3V0IGFkZGluZyBhIHNpZ25hdHVyZSkuPHNwYW4gc3R5 bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7IDwvc3Bhbj5UaGUgdXBkYXRlIGNhbiB0aGVu IGJlIHByb3BhZ2F0ZWQgdXNpbmc8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3 IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUt aGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5 bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+QkdQc2VjIHRvIG90 aGVyIGNvbmZlZGVyYXRpb24gbWVtYmVycyBvciB0byBCR1BzZWMgbmVpZ2hib3JzIG91dHNpZGU8 L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1s YXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVz OyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+b2YgdGhlIGNvbmZlZGVyYXRpb24uPHNwYW4gc3R5bGU9 Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7IDwvc3Bhbj5UaGlzIGtpbmQgb2Ygb3BlcmF0aW9u IGlzIHBvc3NpYmxlLCBidXQgbm88L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3 IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUt aGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5 bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+Z3JhdmUgc2VjdXJp dHkgb3IgcmVhY2hhYmlsaXR5IGNvbXByb21pc2UgaXMgZmVhcmVkIGR1ZSB0byB0aGU8L3NwYW4+ PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5 bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQt Z3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5i c3A7Jm5ic3A7DQo8L3NwYW4+Zm9sbG93aW5nIHJlYXNvbnM6ICgxKSBUaGUgY29uZmVkZXJhdGlv biBtZW1iZXJzIGJlbG9uZyB0byBvbmU8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMg TmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxp bmUtaGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4g c3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+b3JnYW5pemF0 aW9uIGFuZCBzdHJvbmcgaW50ZXJuYWwgdHJ1c3QgaXMgZXhwZWN0ZWQ7IGFuZCAoMikgUmVjYWxs PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMHB0OyBsaW5lLWhlaWdodDogbm9ybWFsOyBtc28t bGF5b3V0LWdyaWQtYWxpZ246IG5vbmU7Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHll czsiPiZuYnNwOyZuYnNwOw0KPC9zcGFuPnRoYXQgdGhlIHNpZ25hdHVyZXMgdGhhdCBhcmUgaW50 ZXJuYWwgdG8gdGhlIGNvbmZlZGVyYXRpb24gbXVzdCBiZTwvc3Bhbj48L3A+DQo8cD48Zm9udCBm YWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4g MGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBub25l OyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bh bj5yZW1vdmVkIHByaW9yIHRvIGZvcndhcmRpbmcgdGhlIHVwZGF0ZSB0byBhbiBvdXRzaWRlIEJH UHNlYyByb3V0ZXI8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48 L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBu b3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+KHNlZSBTZWN0aW9uIDQuMykuPC9z cGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxw IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAm cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250 IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBp biAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmOyI+UmVnYXJkaW5nIHByb2Nlc3Npbmcgb2YgZHVwbGljYXRlIHVwZGF0ZSBxdWVz dGlvbjo8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0K PHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Ij5JIGZlZWwgbm93IHRoYXQgdGhlcmUgaXMgbm8gcmVhbCB1dGls aXR5IGluIGRpc2N1c3NpbmcgdGhlIGRldGFpbHMgb2Ygb3B0aW1pemF0aW9uIG9mIHZhbGlkYXRp b24gcHJvY2Vzc2luZyBmb3IgZHVwbGljYXRlIHVwZGF0ZXMgaW4gdGhlIG1pZGRsZSBvZiBwcm90 b2NvbCBzcGVjaWZpY2F0aW9uIChhcyB3ZSBkaWQNCiBiZWZvcmUgaW4gU2VjdGlvbiA1KS4gV2Ug bmVlZCBub3QgZXZlbiBnZXQgaW50byBkZWZpbmluZyBkdXBsaWNhdGUgdXBkYXRlcywgZXRjLg0K PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7PC9zcGFuPkkgaGF2ZSBtb3Zl ZCB0aGUgbm90ZSBhYm91dCBub24tZGV0ZXJtaW5pc3RpYy9kZXRlcm1pbmlzdGljIHNpZ25hdHVy ZSBhbGdvcml0aG1zIGZyb20gU2VjdGlvbiA1IGludG8gdGhlIG9wcyBhbmQgbWdtdC4gc2VjdGlv biAoU2VjdGlvbiA3KS4gVGhlIHBhcmFncmFwaCB0aGVyZSBub3cgcmVhZHMgYXMgZm9sbG93czo8 L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZv bnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjog MGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjog bm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmOyI+TWFueSBzaWduYXR1cmUgYWxnb3JpdGhtcyBhcmUgbm9uLWRldGVybWluaXN0aWMu PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+VGhhdCBpcywg bWFueTwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsg bXNvLWxheW91dC1ncmlkLWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVu OiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5zaWduYXR1cmUgYWxnb3JpdGhtcyB3aWxsIHBy b2R1Y2UgZGlmZmVyZW50IHNpZ25hdHVyZXMgZWFjaCB0aW1lIHRoZXk8L3NwYW4+PC9wPg0KPHA+ PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGln bjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7 DQo8L3NwYW4+YXJlIHJ1biAoZXZlbiB3aGVuIHRoZXkgYXJlIHNpZ25pbmcgdGhlIHNhbWUgZGF0 YSB3aXRoIHRoZSBzYW1lIGtleSkuPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5l dyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMHB0OyBsaW5l LWhlaWdodDogbm9ybWFsOyBtc28tbGF5b3V0LWdyaWQtYWxpZ246IG5vbmU7Ij4NCjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPjxzcGFuIHN0 eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOyZuYnNwOw0KPC9zcGFuPlRoZXJlZm9yZSwg aWYgYSBCR1BzZWMgcm91dGVyIHJlY2VpdmVzIGEgQkdQc2VjIHVwZGF0ZSBmcm9tIGEgcGVlcjwv c3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8 cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxh eW91dC1ncmlkLWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90 O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7 Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5hbmQgbGF0ZXIgcmVjZWl2ZXMgYSBzZWNvbmQgQkdQc2Vj IHVwZGF0ZSBtZXNzYWdlIGZyb20gdGhlIHNhbWUgcGVlcjwvc3Bhbj48L3A+DQo8cD48Zm9udCBm YWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4g MGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBub25l OyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bh bj5mb3IgdGhlIHNhbWUgcHJlZml4IHdpdGggdGhlIHNhbWUgU2VjdXJlX1BhdGggYW5kIFNLSXMs IHRoZSBzZWNvbmQ8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48 L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBu b3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+dXBkYXRlIHdpbGwgZGlmZmVyIGZy b20gdGhlIGZpcnN0IHVwZGF0ZSBpbiB0aGUgc2lnbmF0dXJlIGZpZWxkcyAoZm9yPC9zcGFuPjwv cD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxl PSJtYXJnaW46IDBpbiAwaW4gMHB0OyBsaW5lLWhlaWdodDogbm9ybWFsOyBtc28tbGF5b3V0LWdy aWQtYWxpZ246IG5vbmU7Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjsiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNw OyZuYnNwOw0KPC9zcGFuPmEgbm9uLWRldGVybWluaXN0aWMgc2lnbmF0dXJlIGFsZ29yaXRobSku PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+Rm9yIGEgZGV0 ZXJtaW5pc3RpYzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwv Zm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5v cm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNw YWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5zaWduYXR1cmUgYWxnb3JpdGhtLCB0 aGUgc2lnbmF0dXJlIGZpZWxkcyB3aWxsIGFsc28gYmUgaWRlbnRpY2FsPC9zcGFuPjwvcD4NCjxw Pjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJn aW46IDBpbiAwaW4gMHB0OyBsaW5lLWhlaWdodDogbm9ybWFsOyBtc28tbGF5b3V0LWdyaWQtYWxp Z246IG5vbmU7Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjsiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOyZuYnNw Ow0KPC9zcGFuPmJldHdlZW4gdGhlIHR3byB1cGRhdGVzLjxzcGFuIHN0eWxlPSJtc28tc3BhY2Vy dW46IHllczsiPiZuYnNwOyA8L3NwYW4+T24gdGhlIGJhc2lzIG9mIHRoZXNlIG9ic2VydmF0aW9u cywgYW48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBub3JtYWw7 IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1 bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+aW1wbGVtZW50YXRpb24gbWF5IGluY29ycG9y YXRlIG9wdGltaXphdGlvbnMgaW4gdXBkYXRlIHZhbGlkYXRpb248L3NwYW4+PC9wPg0KPHA+PGZv bnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjog MGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjog bm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8 L3NwYW4+cHJvY2Vzc2luZy48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJv bWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8 L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5Zb3VyIG90aGVyIGNvbW1lbnRzL3N1Z2dl c3Rpb25zIHdlcmUgc3RyYWlnaHQgZm9yd2FyZCBhbmQgSSBoYXZlIGluY29ycG9yYXRlZCB0aGVt IGFzIHdlbGwgaW4gdmVyc2lvbi0yMC48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMg TmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4m bmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5QbGVhc2Ugc2VlIG15IHJlc3Bv bnNlcyB0byB5b3VyIGluZGl2aWR1YWwgY29tbWVudHMgbWFya2VkIHdpdGggW1NyaXJhbS0yXSBi ZWxvdy48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0K PHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Ij5TcmlyYW0NCjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJU aW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhw dDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp ZjsiPi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxm b250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46 IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmOyI+SGkhPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7 DQo8L3NwYW4+VGhhbmtzIGZvciBhZGRyZXNzaW5nIG15IGNvbW1lbnRzLjxzcGFuIHN0eWxlPSJt c28tc3BhY2VydW46IHllczsiPiZuYnNwOyA8L3NwYW4+DQpJIGhhdmUgc29tZSByZW1haW5pbmcg Y29tbWVudHMgYmVsb3cuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7IDwv c3Bhbj5JIGZsYWdnZWQgYSBjb3VwbGUgb2YgaXRlbXMgdGhhdCBJIHRoaW5rIHRoZSBDaGFpcnMg c2hvdWxkIGNvbnN1bHQgdGhlIFdHIG9uLCBidXQgSeKAmWxsIGxlYXZlIGl0IHVwIHRvIHRoZW0g dG8gZGVjaWRlIHRoYXQg4oCTIG5vdGUgdGhhdCBJIGRvbuKAmXQgdGhpbmsgd2UgbmVlZCB0byBX R0xDIHRoZSB3aG9sZSBkb2N1bWVudA0KIGFnYWluLCBqdXN0IGEgY291cGxlIG9mIGRlY2lzaW9u cy48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9w Pg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+ PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Ij5JIGFsc28gYWRkZWQgYSBjb3VwbGUgb2YgbmV3IGNvbW1lbnRzIGF0 IHRoZSBlbmQuPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9m b250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwv cD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxl PSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+SSB0aGluayB3ZSBhcmUgY2xvc2VyLCBidXQgdGhlcmUg YXJlIHN0aWxsIGEgY291cGxlIG9mIGl0ZW1zIHdoZXJlIHdl4oCZcmUgbm90IGFncmVlaW5nOjxz cGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPnRyZWF0bWVudCBv ZiBkdXBsaWNhdGVzIGFuZCBjb25mZWRlcmF0aW9ucy48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVu OiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5XZSBjYW4gY29udGludWUgdGhlIGRpc2N1c3Npb24g4oCT IEkgd291bGQgbG92ZSB0byBoZWFyIG90aGVyIG9waW5pb25zIGFzIHdlbGwgKGZyb20gdGhlIFdH KS48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9w Pg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+ PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Ij5JbiB0aGUgbWVhbnRpbWUsIEkgd2lsbCBzdGFydCB0aGUgSUVURiBM YXN0IENhbGwgYW5kIHJlcXVlc3QgYSBSVEctRGlyIHJldmlldyBhcyB3ZWxsLjxzcGFuIHN0eWxl PSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPkFkZHJlc3Npbmcgd2hhdCB3ZSBz ZWVtIHRvIGFncmVlIG9uIChJIHByb3Bvc2VkIHNvbWUgY2hhbmdlcyBiZWxvdyBmb3IgY2xhcml0 eSkgaW4gdGhlIG5leHQgZmV3IGRheXMgd291bGQgZGVmaW5pdGVseSBoZWxwIHRoZSBwcm9jZXNz Ljwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+ DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bhbj48L3A+DQo8cD48 Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2lu OiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjsiPlRoYW5rcyE8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMg TmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4m bmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5BbHZhcm8uPC9zcGFuPjwvcD4N CjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJt YXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRp bWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0 OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm OyI+LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPC9zcGFuPjwvcD4NCjxwPjxm b250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46 IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAw aW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmOyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmOyI+Wzxmb250IGZhY2U9IkFyaWFsIj5TcmlyYW0tMl08L2ZvbnQ+Jm5ic3A7Jm5ic3A7 IFBsZWFzZSBzZWUgbXkgcmVzcG9uc2VzIHRvIHlvdXIgaW5kaXZpZHVhbCBjb21tZW50cyBtYXJr ZWQgd2l0aCBbU3JpcmFtLTJdIGJlbG93PC9zcGFuPjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNl PSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGlu IDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZjsiPiZuYnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4i PjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZndDsgW1NyaXJh bV0gRm9sbG93aW5nIHRoZSBjbGFyaWZpY2F0aW9ucyBhbmQgYWRkaXRpb25hbCBndWlkYW5jZSB5 b3UgcHJvdmlkZWQgaW4gU2VvdWwgKHdoZW48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGlt ZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2Zv bnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7IHlvdSwgQ2hyaXMs IGFuZCBJIG1ldCksIEkgaGF2ZSBhZGRlZCBhIG5ldyBTZWN0aW9uIDcgKE9wZXJhdGlvbnMgYW5k IE1hbmFnZW1lbnQ8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48 L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+ PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5 bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90 O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7IENvbnNpZGVyYXRpb25zKS4gVGhlIHRvcGlj cyB5b3UgbWVudGlvbiBhYm92ZSBhcmUgYWxsIGNvdmVyZWQgaW4gdGhlIG5ldyBTZWN0aW9uIDcu PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxm b250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46 IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmOyI+VGhhbmtzIGZvciBhZGRpbmcgdGhpcyBTZWN0aW9uLjxzcGFuIHN0eWxl PSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPkkgdGhpbmsgdGhlIGVzc2VuY2Ug b2Ygd2hhdCB3ZSB0YWxrZWQgYWJvdXQgaXMgdGhlcmUsIGJ1dCB0aGUgdGV4dCBuZWVkcyBzb21l IGVkaXRpbmcuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+ SeKAmW0gcHV0dGluZyBzb21lIHN1Z2dlc3Rpb25zIGJlbG93IOKAkyBrZWVwIGluIG1pbmQgdGhh dCB0aGlzIGRvY3VtZW50IGlzIGEgc3BlY2lmaWNhdGlvbiwgc28geW91IGNhbiBiZSBwcmVzY3Jp cHRpdmUgd2l0aCB3aGF0IHlvdSB3YW50IHRvIGhhcHBlbi48L3NwYW4+PC9wPg0KPHA+PGZvbnQg ZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGlu IDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJv bWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5PTEQmZ3Q7 PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxm b250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46 IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmOyI+RGV0YWlsZWQgcmVjb21tZW5kYXRpb25zIGNvbmNlcm5pbmcgb3BlcmF0 aW9ucyBhbmQgbWFuYWdlbWVudCBpc3N1ZXMgd2l0aCBCR1BzZWMgYXJlIHByb3ZpZGVkIGluIFtJ LUQuaWV0Zi1zaWRyLWJncHNlYy1vcHNdLjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1l cyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsi PiZuYnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9u dD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPk5FVyZndDs8L3NwYW4+PC9w Pg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9 Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0i VGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4 cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Ij5UaGUgQmVzdCBDdXJyZW50IFByYWN0aWNlIGNvbmNlcm5pbmcgb3BlcmF0aW9uYWwgZGVw bG95bWVudCBvZiBCR1BTZWMgaXMgcHJvdmlkZWQgaW4gW0ktRC5pZXRmLXNpZHItYmdwc2VjLW9w c10uPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250Pjwv cD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxw Pjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJn aW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZx dW90OyxzYW5zLXNlcmlmOyI+W1NyaXJhbS0yXSBHb29kIHJld29yZGluZy4gTWFkZSB0aGUgc3Vi c3RpdHV0aW9uLjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwv Zm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bhbj48 L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHls ZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPk9MRCZndDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFj ZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBp biA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFu Ij48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5UaGlzIGRvY3Vt ZW50IHNwZWNpZmllcyBCR1BzZWMgVmVyc2lvbiAwIG9ubHkuPHNwYW4gc3R5bGU9Im1zby1zcGFj ZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+V2hhdCBzaG91bGQgdGhlPHNwYW4gc3R5bGU9Im1z by1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7IDwvc3Bhbj5hY3Rpb24gYmUgaWYgdGhlIFZl cnNpb24gaXMgbm90IDAgaW4gdGhlIEJHUHNlYyBjYXBhYmlsaXR5PHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+YWR2ZXJ0aXNlbWVudCBmcm9tIGEg cGVlcj88c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsgPC9zcGFuPklmIHRo ZSBpbnRlcnNlY3Rpb24gb2YgQkdQc2VjIGNhcGFiaWxpdHk8c3BhbiBzdHlsZT0ibXNvLXNwYWNl cnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5hZHZlcnRpc2VtZW50cyBmcm9tIGJvdGgg c2lkZXMgZG9lcyBub3QgaW5jbHVkZSBWZXJzaW9uIDAsIHRoZW48c3BhbiBzdHlsZT0ibXNvLXNw YWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5CR1BzZWMgVmVyc2lvbiAwIGhhcyBu b3QgYmVlbiBzdWNjZXNzZnVsbHkgbmVnb3RpYXRlZC48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVu OiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5Ib3dldmVyLCBhPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1 bjogeWVzOyI+Jm5ic3A7Jm5ic3A7IDwvc3Bhbj5CR1Agc2Vzc2lvbiBpcyBzdGlsbCBuZWdvdGlh dGVkIGFuZCBoZW5jZSB0aGUgYWJpbGl0eSB0byBleGNoYW5nZTxzcGFuIHN0eWxlPSJtc28tc3Bh Y2VydW46IHllczsiPiZuYnNwOyZuYnNwOw0KPC9zcGFuPnJvdXRlcyBpcyBzdGlsbCB0aGVyZS48 c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsgPC9zcGFuPkJHUCAodW5zaWdu ZWQpIG1lc3NhZ2VzIGFyZSBleGNoYW5nZWQuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVz OyI+Jm5ic3A7DQo8L3NwYW4+U288c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJz cDsmbmJzcDsgPC9zcGFuPnRoZSBjaGFpbiBvZiBBU05zIGlzIG5vdCBicm9rZW4sIGkuZS4gdGhl eSBtYXkgbm90IGJlIGNvbnRpZ3VvdXM8c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4m bmJzcDsmbmJzcDsNCjwvc3Bhbj5CR1BzZWMgcGVlcnMgYnV0IGFyZSBzdGlsbCBjb250aWd1b3Vz IEJHUCBwZWVycy48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsN Cjwvc3Bhbj48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2Zv bnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9w Pg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9 Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5MZXQgdXMgc2F5IHRoYXQgQkdQc2VjIGNhcGFiaWxpdHkg d2FzIG5lZ290aWF0ZWQgc3VjY2Vzc2Z1bGx5IGJldHdlZW48c3BhbiBzdHlsZT0ibXNvLXNwYWNl cnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj50d28gcGVlcnMsIGFuZCBzdWJzZXF1ZW50 bHkgaXQgd2FzIHJlc2V0LjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0K PC9zcGFuPkluIHRoZSBtZWFudGltZSwgYXNzdW1lPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjog eWVzOyI+Jm5ic3A7Jm5ic3A7IDwvc3Bhbj50aGF0IHRoZSA0LWJ5dGUgQVNOIGNhcGFiaWxpdHkg b3IgdGhlIG11bHRpLXByb3RvY29sIGNhcGFiaWxpdHkgd2FzPHNwYW4gc3R5bGU9Im1zby1zcGFj ZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+bG9zdCBiZXR3ZWVuIHRoZSB0d28gcGVl cnMuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7IDwvc3Bhbj5TbyBub3cg dGhlIEJHUHNlYyBzZXNzaW9uIHJlc2V0IHJlc3VsdHM8c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVu OiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5pbiBmYWlsdXJlIG9mIEJHUHNlYyBjYXBhYmls aXR5IG5lZ290aWF0aW9uIGFuZCBvbmx5IGEgQkdQIHNlc3Npb24gaXM8c3BhbiBzdHlsZT0ibXNv LXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5lc3RhYmxpc2hlZC48c3BhbiBz dHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsgPC9zcGFuPldvdWxkIHRoZSBuZXR3b3Jr IG9wZXJhdG9yIGJlIG5vdGlmaWVkIHRoYXQgdGhpczxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46 IHllczsiPiZuYnNwOyZuYnNwOw0KPC9zcGFuPmRvd25ncmFkZSBmcm9tIEJHUHNlYyB0byBCR1Ag aGFzIGhhcHBlbmVkPzxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9z cGFuPldoYXQgaWYgdGhlIG9wZXJhdG9yPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+ Jm5ic3A7Jm5ic3A7IDwvc3Bhbj5hbHdheXMgd2FudHMgYSBzZWN1cmUgc2Vzc2lvbiBvbmx5Pzxz cGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPkNhbiB0aGV5IHJl cXVpcmUgdGhhdCBubyBCR1A8c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsm bmJzcDsgPC9zcGFuPnNlc3Npb24gYmUgZXN0YWJsaXNoZWQgaWYgQkdQc2VjIGNhcGFiaWxpdHkg bmVnb3RpYXRpb24gZmFpbHM/PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7 Jm5ic3A7DQo8L3NwYW4+T3BlcmF0b3JzIGFyZSBhZHZpc2VkIHRvIHNwZWFrIHdpdGggdGhlaXIg dmVuZG9ycyB0byBzZXQgdXAga25vYnMgYW5kPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVz OyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+YWxlcnRzIHRvIGhhdmUgc3VjaCBvcGVyYXRpb25zIGFu ZCBtYW5hZ2VtZW50IGZlYXR1cmVzIGluIHRoZWlyPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjog eWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+QkdQc2VjIGNhcGFibGUgcm91dGVycy48L3NwYW4+ PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5 bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90 O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFj ZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBp biA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Ij5ORVcmZ3Q7PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5i c3A7DQo8L3NwYW4+PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+ PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFu PjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0 eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+U2VjdGlvbiAyLjIgZGVzY3JpYmVzIHRoZSBuZWdv dGlhdGlvbiByZXF1aXJlZCB0byBlc3RhYmxpc2ggYSBCR1BzZWMtY2FwYWJsZSBwZWVyaW5nIHNl c3Npb24uIE5vdCBvbmx5IG11c3QgdGhlIEJHUHNlYyBjYXBhYmlsaXR5IGJlIGV4Y2hhbmdlZCAo YW5kIGFncmVlZCBvbiksIGJ1dCB0aGUgQkdQIG11bHRpcHJvdG9jb2wNCiBleHRlbnNpb24gW1JG QzQ3NjBdIGZvciB0aGUgc2FtZSBBRkkgYW5kIHRoZSBmb3VyLWJ5dGUgQVMgY2FwYWJpbGl0eSBb UkZDNjc5M10gbXVzdCBhbHNvIGJlIGV4Y2hhbmdlZC4gRmFpbHVyZSB0byBwcm9wZXJseSBuZWdv dGlhdGUgYSBCR1BzZWMgc2Vzc2lvbiwgZHVlIHRvIGEgbWlzc2luZyBjYXBhYmlsaXR5LCBmb3Ig ZXhhbXBsZSwgbWF5IHN0aWxsIHJlc3VsdCBpbiB0aGUgZXhjaGFuZ2Ugb2YgQkdQICh1bnNpZ25l ZCkgdXBkYXRlcy4gV2hpbGUNCiB0aGUgQkdQIGNoYWluIG9mIEFTTnMgaXMgbm90IGJyb2tlbiwg dGhlIHNlY3VyaXR5IGNhbiBiZSByZWR1Y2VkIGFuZCBhIGNvbnRpZ3VvdXMgc2V0IG9mIEJHUHNl YyBwZWVycyBtYXkgbm90IGV4aXN0IGFueW1vcmUuIEl0IGlzIFJFQ09NTUVOREVEIHRoYXQgYW4g aW1wbGVtZW50YXRpb24gbG9nIHRoZSBmYWlsdXJlIHRvIHByb3Blcmx5IG5lZ290aWF0ZSBhIEJH UHNlYyBzZXNzaW9uIGlmIHRoZSBsb2NhbCBCR1Agc3BlYWtlciBpcyBjb25maWd1cmVkDQogZm9y IGl0LiBBbHNvLCBhbiBpbXBsZW1lbnRhdGlvbiBNVVNUIGhhdmUgYWJpbGl0eSB0byBwcmV2ZW50 IGEgQkdQIHNlc3Npb24gZnJvbSBiZWluZyBlc3RhYmxpc2hlZCBpZiBjb25maWd1cmVkIGZvciBC R1BzZWMgdXNlLjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwv Zm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bhbj48 L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHls ZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPltTcmlyYW0tMl0gSSBhZ3JlZS4gTm93IHRoZSBkb2N1 bWVudCB1c2VzIHBhcmFncmFwaCBhYm92ZSB0aGF0IHlvdeKAmXZlIG9mZmVyZWQuIFRoZSBsYXN0 IHNlbnRlbmNlIHNsaWdodGx5IG1vZGlmaWVkIHRvIHJlYWQg4oCc4oCmaWYgY29uZmlndXJlZCBm b3Igb25seSBCR1BzZWMgdXNlLuKAnTwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBO ZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZu YnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZndDsgTTEuMS4gU2VjdGlvbiAy LjEuIChUaGUgQkdQc2VjIENhcGFiaWxpdHkpIGluY2x1ZGVzIGEgVmVyc2lvbiBmaWVsZCBhbmQg c29tZSBSZXNlcnZlZCBiaXRzLCBidXQgdGhlcmUgYXJlIG5vIElBTkEgcmVnaXN0cmllcyBkZWZp bmVkIGZvciBob3cgdG8gbWFuYWdlIHRoZXNlIHNwYWNlcy48c3BhbiBzdHlsZT0ibXNvLXNwYWNl cnVuOiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5QbGVhc2UgZGVmaW5lIHRoZSByZWdpc3RyaWVzIGFu ZCB0aGUgY29ycmVzcG9uZGluZyByZWdpc3RyYXRpb24gcHJvY2VkdXJlcy48L3NwYW4+PC9wPg0K PHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGlt ZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Ij4mZ3Q7Jmd0OyBbU3JpcmFtXSBEb25lLiBQbGVhc2Ugc2VlIHRoZSB1cGRhdGVkIElBTkEgQ29u c2lkZXJhdGlvbnMgc2VjdGlvbi48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3 IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJz cDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9w Pg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5zL1Jlc2VydmVkL1VuYXNzaWduZWQv PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxm b250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46 IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmOyI+W1NyaXJhbS0yXSBEb25lLjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNl PSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGlu IDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZjsiPiZuYnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4i PjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPkdpdmVuIHRoYXQg dGhlcmUgYXJlIG9ubHkgMyB1bmFzc2lnbmVkIGJpdHMgYW5kIHRoYXQgY2hhbmdpbmcgdmVyc2lv bnMgc2hvdWxkIGJlIGEgYmlnIGRlYWwsIEkgdGhpbmsgdGhhdCDigJxJRVRGIFJldmlld+KAnSBp cyBub3QgYSBzdHJvbmcgZW5vdWdoIHJlZ2lzdHJhdGlvbiBwcm9jZWR1cmUuPHNwYW4gc3R5bGU9 Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+U3VnZ2VzdGlvbjogdXNlIFN0YW5k YXJkcyBBY3Rpb24gaW5zdGVhZC48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3 IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJz cDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9w Pg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5bU3JpcmFtLTJdIE9LLiBNYWRlIHRo YXQgY2hhbmdlIGluIHRoZSBJQU5BIGNvbnNpZGVyYXRpb25zIHNlY3Rpb24uPC9zcGFuPjwvcD4N CjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJt YXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRp bWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0 OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm OyI+WypdIENoYWlyczogd2UgZG9u4oCZdCBuZWVkIHRvIFdHTEMgdGhlIHdob2xlIGRvY3VtZW50 LCBidXQgaXQgd291bGQgYmUgYSBnb29kIGlkZWEgdG8gcnVuIHRoZSByZWdpc3RyYXRpb24gcHJv Y2VkdXJlcyBieSB0aGUgV0cgb25jZSB3ZSBzZXR0bGUgb24gdGhlbSDigJMgdGhpcyBjb3VsZCBl dmVuIGJlIGRvbmUgaW4NCiBwYXJhbGxlbCB3aXRoIHRoZSBJRVRGIExhc3QgQ2FsbC48L3NwYW4+ PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5 bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90 O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFj ZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBp biA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Ij4mZ3Q7IE0xLjIuIFNlY3Rpb24gMy4xLiAoU2VjdXJlX1BhdGgpIGRlZmluZXMgdGhl IEZsYWdzIGZpZWxkIGFuZCBhc3NpZ25zIHRoZSBmaXJzdCBiaXQgKEJUVywgaXMgdGhhdCB0aGUg TVNCIG9yIHRoZSBMU0IsIHBsZWFzZSBjbGFyaWZ5KSwgYnV0IGRvZXNuJ3Qgc2V0IHVwIHRoZSBy ZWdpc3RyeSBvciByZWdpc3RyYXRpb24mZ3Q7DQogcHJvY2VkdXJlcy48L3NwYW4+PC9wPg0KPHA+ PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMg TmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4m Z3Q7Jmd0OyBbU3JpcmFtXSBJdCBpcyB0aGUgTVNCIChsZWZ0IG1vc3QgYml0KSBhbmQgdGhhdCBp cyBub3cgY2xhcmlmaWVkIGluIFNlY3Rpb24gMy4xLiBTZXQgdXAgb2YgdGhlIHJlZ2lzdHJ5IGZv ciB0aGUgRmxhZ3MgZmllbGQgaXMgbm93IGluY2x1ZGVkIGluIHRoZSB1cGRhdGVkIElBTkEgQ29u c2lkZXJhdGlvbnMNCiBzZWN0aW9uLjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBO ZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZu YnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPlNhbWUgY29tbWVudCBhcyBhYm92 ZSBhYm91dCDigJxJRVRGIFJldmlld+KAnSB2cyDigJxTdGFuZGFyZHMgQWN0aW9u4oCdPC9zcGFu PjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0 eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZh Y2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAw aW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmOyI+W1NyaXJhbS0yXSBEb25lLiBNYWRlIHRoYXQgY2hhbmdlIGluIHRoZSBJQU5BIGNv bnNpZGVyYXRpb25zIHNlY3Rpb24uPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5l dyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5i c3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250Pjwv cD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jmd0OyBNMi4yLiBUaGUgZGVmaW5p dGlvbiBvZiB0aGUgQkdQc2VjX1BhdGggQXR0cmlidXRlIChhbmQgaXRzIGRldGFpbHMpIGRvbid0 IGhhdmUgY2xlYXIgZXJyb3IgaGFuZGxpbmcgcHJvY2VkdXJlcyBkZWZpbmVkIChSRkM3NjA2KS48 c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5TZWN0aW9uIDQu My4gKFByb2Nlc3NpbmcgSW5zdHJ1Y3Rpb25zIGZvciBDb25mZWRlcmF0aW9uIE1lbWJlcnMpIGRv ZXMgc2F5IHRoaXM6ICZxdW90OyhBcyBkaXNjdXNzZWQgaW4gU2VjdGlvbiA1LjIsIGFueSBlcnJv ciBpbiB0aGUgQkdQc2VjX1BhdGggYXR0cmlidXRlIE1VU1QgYmUgaGFuZGxlZCB1c2luZyB0aGUg JnF1b3Q7dHJlYXQtYXMtd2l0aGRyYXcmcXVvdDssIGFwcHJvYWNoIGFzIGRlZmluZWQgaW4gUkZD IDc2MDYgW1JGQzc2MDZdLikmcXVvdDsgKGluY2x1ZGluZw0KIHRoZSBwYXJlbnRoZXNlcykuPHNw YW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7IDwvc3Bhbj5Ib3dldmVyLCA1LDIg b25seSBzYXlzOiAmcXVvdDtCR1BzZWMgc3BlYWtlcnMgTVVTVCBoYW5kbGUgdGhlc2UgZXJyb3Jz IHVzaW5nIHRoZSAmcXVvdDt0cmVhdC1hcy13aXRoZHJhdyZxdW90OyBhcHByb2FjaCBhcyBkZWZp bmVkIGluIFJGQyA3NjA2IFtSRkM3NjA2XS4mcXVvdDs8c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVu OiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5Ob3RlOiAmcXVvdDt0aGVzZSBlcnJvcnMmcXVv dDsgaXMgbm90IHRoZSBzYW1lIGFzICZxdW90O2FueSBlcnJvciZxdW90Oy48c3BhbiBzdHlsZT0i bXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5QbGVhc2UgZGlzY3VzcyBlcnJvciBo YW5kbGluZyBpbiBhIG1vcmUgcHJvbWluZW50IHBsYWNlLiAoSGludDogaXQgbWF5IGZpdCBpbiBh IGZhdWx0IG1hbmFnZW1lbnQgZGlzY3Vzc2lvbiBpbiB0aGUgT3BlcmF0aW9ucyBhbmQgTWFuYWdl bWVudCBTZWN0aW9uLik8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFu Ij48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3Nw YW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7Jmd0OyBbU3JpcmFtXTxzcGFuIHN0eWxl PSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPnMgL0FzIGRpc2N1c3NlZCBpbiBT ZWN0aW9uIDUuMiwgYW55IGVycm9yIGluIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgTVVTVCBi ZSBoYW5kbGVkIHVzaW5nIHRoZSAmcXVvdDt0cmVhdC1hcy13aXRoZHJhdyZxdW90OywgYXBwcm9h Y2ggYXMgZGVmaW5lZCBpbiBSRkMgNzYwNiBbUkZDNzYwNl0uLyBBcyBkaXNjdXNzZWQgaW4gU2Vj dGlvbiA1LjIsIGFueSBzeW50YWN0aWNhbCBvciBwcm90b2NvbCB2aW9sYXRpb24gZXJyb3JzIGlu IHRoZSBCR1BzZWNfUGF0aA0KIGF0dHJpYnV0ZSBNVVNUIGJlIGhhbmRsZWQgdXNpbmcgdGhlICZx dW90O3RyZWF0LWFzLXdpdGhkcmF3JnF1b3Q7IGFwcHJvYWNoIGFzIGRlZmluZWQgaW4gUkZDIDc2 MDYgW1JGQzc2MDZdLi88L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFu Ij48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3Nw YW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7Jmd0OyBbU3JpcmFtXTxzcGFuIHN0eWxl PSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPlNlY3Rpb24gNC4zIGhhcyBiZWVu IHVwZGF0ZWQgYWNjb3JkaW5nbHkuPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5l dyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5i c3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250Pjwv cD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+SSBkaWRu4oCZdCBleHBsYWluIG15 c2VsZiBjb3JyZWN0bHkuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8 L3NwYW4+U2VjdGlvbiA0LjMuIChQcm9jZXNzaW5nIEluc3RydWN0aW9ucyBmb3IgQ29uZmVkZXJh dGlvbiBNZW1iZXJzKSBjb3ZlcnMgb25seSB0aGUgcHJvY2Vzc2luZyBmb3IgY29uZmVkZXJhdGlv bnMsIHNvIHB1dHRpbmcgdGV4dCBpbiB0aGVyZSBhYm91dCBhbnkgZXJyb3JzIGlzIGdvb2QsIGJ1 dCBkb2VzbuKAmXQgY292ZXIgdGhlIGdlbmVyYWwgY2FzZSAoZm9yIHByb2Nlc3NpbmcgYW55IHVw ZGF0ZSkuIE9UT0gsIFNlY3Rpb24gNS4yLiAoVmFsaWRhdGlvbg0KIEFsZ29yaXRobSkgZG9lc27i gJl0IGFjdHVhbGx5IHRhbGsgYWJvdXQg4oCcYW55IGVycm9y4oCdIChhcyByZWZlcmVuY2VkIG5v dyBmcm9tIDQuMykg4oCTIGl0IG9ubHkgdGFsa3MgYWJvdXQg4oCcdGhlc2UgZXJyb3Jz4oCdLCB3 aGljaCBjb3JyZXNwb25kIHRvIHRoZSBsaXN0IG9mIGNoZWNrcyBpbiB0aGUgc2VjdGlvbi48c3Bh biBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5JT1csIHRoZXJlIGlz IG5vIGdsb2JhbCBzcGVjaWZpY2F0aW9uIHRoYXQgYW55IGVycm9yIG11c3QgcmVzdWx0IGluIHRy ZWF0LWFzLXdpdGhkcmF3Ljwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9t YW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZuYnNwOzwv c3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8 cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTog JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPlNvbHV0aW9uOjxzcGFuIHN0eWxlPSJtc28t c3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPnRha2UgdGhlIHRleHQgb3V0IG9mIDQuMyBh bmQgdXBkYXRlIHRoZSB0ZXh0IGluIDUuMjsgc3VnZ2VzdGlvbjo8L3NwYW4+PC9wPg0KPHA+PGZv bnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjog MGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3 IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5PTEQm Z3Q7PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+PC9zcGFu PjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0 eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZh Y2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAw aW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmOyI+SWYgYW55IG9mIHRoZXNlIGNoZWNrcyBmYWlsLCBpdCBpcyBhbiBlcnJvciBpbiB0 aGUgQkdQc2VjX1BhdGg8c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJz cDsNCjwvc3Bhbj5hdHRyaWJ1dGUuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5i c3A7IDwvc3Bhbj5Bbnkgb2YgdGhlc2UgZXJyb3JzIGluIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1 dGUgYXJlPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3Nw YW4+aGFuZGxlZCBhcyBwZXIgUkZDIDc2MDYgW1JGQzc2MDZdLjxzcGFuIHN0eWxlPSJtc28tc3Bh Y2VydW46IHllczsiPiZuYnNwOyA8L3NwYW4+DQpCR1BzZWMgc3BlYWtlcnMgTVVTVCBoYW5kbGUg dGhlc2U8c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsgPC9zcGFu PmVycm9ycyB1c2luZyB0aGUgJnF1b3Q7dHJlYXQtYXMtd2l0aGRyYXcmcXVvdDsgYXBwcm9hY2gg YXMgZGVmaW5lZCBpbiBSRkMgNzYwNjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZu YnNwOyZuYnNwOw0KPC9zcGFuPltSRkM3NjA2XS48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0i VGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4 cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48 L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5ORVcmZ3Q7PHNwYW4g c3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwv cD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxl PSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9 IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4g OHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNl cmlmOyI+SWYgYW55IG9mIHRoZXNlIGNoZWNrcyBmYWlsLCBpdCBpcyBhbiBlcnJvciBpbiB0aGUg QkdQc2VjX1BhdGggYXR0cmlidXRlLiBCR1BzZWMgc3BlYWtlcnMgTVVTVCBoYW5kbGUgYW55IHN5 bnRhY3RpY2FsIG9yIHByb3RvY29sIGVycm9ycyBpbiB0aGUgQkdQc2VjX1BhdGggYXR0cmlidXRl IHVzaW5nIHRoZSAmcXVvdDt0cmVhdC1hcy13aXRoZHJhdyZxdW90Ow0KIGFwcHJvYWNoIGFzIGRl ZmluZWQgaW4gUkZDIDc2MDYgW1JGQzc2MDZdLjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJU aW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhw dDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp ZjsiPiZuYnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwv Zm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPltTcmlyYW0tMl0gQWdy ZWUgd2l0aCB0aGF0LiBEb25lIGFzIHN1Z2dlc3RlZC48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFj ZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBp biA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFu Ij48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7IE03LjEu IOKAnFdpdGggcmVnYXJkcyB0byB0aGUgcHJvY2Vzc2luZyBvZiBkdXBsaWNhdGUgdXBkYXRlIG1l c3NhZ2VzLCBpZiB0aGUgZmlyc3QgdXBkYXRlIG1lc3NhZ2UgaXMgdmFsaWQsIHRoZW4gYW4gaW1w bGVtZW50YXRpb24gU0hPVUxEIE5PVCBydW4gdGhlIHZhbGlkYXRpb24gcHJvY2VkdXJlIG9uIHRo ZQ0KIHNlY29uZCwgZHVwbGljYXRlIHVwZGF0ZSBtZXNzYWdlIChldmVuIGlmIHRoZSBiaXRzIG9m IHRoZSBzaWduYXR1cmUgZmllbGQgYXJlIGRpZmZlcmVudCku4oCdPHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+RXZlbiB0aG91Z2ggYSBkaXNjdXNzaW9uIGFi b3V0IG5vbi1kZXRlcm1pbmlzdGljIHNpZ25hdHVyZSBhbGdvcml0aG1zIHByZWNlZGVzIHRoaXMg dGV4dCwgdGhlIHZhbGlkYXRpb24gaXMgc3RpbGwgbm90IHJ1bi48c3BhbiBzdHlsZT0ibXNvLXNw YWNlcnVuOiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5Ib3cgY2FuIHRoZSB2YWxpZGl0eSBvZiB0aGUg UGF0aCBiZSBndWFyYW50ZWVkIGluIHRoaXMgY2FzZT88c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVu OiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5TaG91bGQgdGhpcyBiZSB0aGUgYWN0aW9uIGZvciBhbGwg YWxnb3JpdGhtcyBvciBvbmx5IG9uZXMga25vd24gdG8gYmUgbm9uLWRldGVybWluaXN0aWM/PC9z cGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxw IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAm cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250 IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBp biAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmOyI+Jmd0OyZndDsgW1NyaXJhbV0gRGVmaW5pdGlvbiBvZiBkdXBsaWNhdGUgdXBk YXRlIGZvciBCR1BzZWM6IEEgQkdQc2VjIHVwZGF0ZSBpcyBhIGR1cGxpY2F0ZSBpZiBpdCBpcyBp ZGVudGljYWwgdG8gYW5vdGhlciB1cGRhdGUgaW4gdGhlIEFkai1SSUItaW4sIGluY2x1ZGluZyBT S0lzIGFuZCBBbGdvcml0aG0gSUQsIGJ1dA0KIG5vdCBpbmNsdWRpbmcgdGhlIHNpZ25hdHVyZXMu IElmIHRoZSBmaXJzdCB1cGRhdGUgbWVzc2FnZSAoaGF2aW5nIHRoZSAqc2FtZSBTS0lzKiBhcyB0 aGUgZHVwbGljYXRlKSBpcyAqVmFsaWQqLCB0aGVuIHRoZSBkdXBsaWNhdGXigJlzIHZhbGlkaXR5 IHN0YXRlIG5lZWQgbm90IGJlIGNvbXB1dGVkLjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHll czsiPiZuYnNwOw0KPC9zcGFuPklmIHZhbGlkaXR5IG9mIHRoZSBkdXBsaWNhdGUgd2VyZSBjb21w dXRlZCBhbmQgZm91bmQgJ1ZhbGlkJywgdGhlbiBpdCBnaXZlcyB0aGUgcm91dGVyIG5vIG5ldyBp bmZvcm1hdGlvbi4gQWx0ZXJuYXRpdmVseSwgaWYgaXQgd2VyZSBmb3VuZCAnTm90IFZhbGlkJywg dGhlbiBpdCBvbmx5IGltcGxpZXMgdGhhdCBzb21lIGJpdCBlcnJvcnMgb2NjdXJyZWQgaW4gdGhl IHNpZ25hdHVyZXMuIFRoZXJlZm9yZSwgdGhlIEJHUHNlYyBzcGVha2VyDQogc2hvdWxkIGtlZXAg dGhlICdWYWxpZCcgb3JpZ2luYWwgdXBkYXRlIGFuZCBpZ25vcmUgdGhlIGR1cGxpY2F0ZS4gSG93 ZXZlciwgaWYgdGhlIG9yaWdpbmFsIHVwZGF0ZSB3ZXJlICdOb3QgVmFsaWQnLCB0aGVuIHBlcmZv cm1pbmcgdmFsaWRhdGlvbiBvZiB0aGUgZHVwbGljYXRlIGlzIHJlbGV2YW50IGFuZCBTSE9VTEQg YmUgZG9uZS48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2Zv bnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9w Pg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9 Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7Jmd0OyBbU3JpcmFtXSBBZGRlZCBhIHBhcmFncmFw aCBpbiB0aGUgbmV3IFNlY3Rpb24gNyAoT3BlcmF0aW9ucyBhbmQgTWFuYWdlbWVudCBDb25zaWRl cmF0aW9ucykgdG8gaW5jbHVkZSB0aGUgYWJvdmUgb2JzZXJ2YXRpb25zLjwvc3Bhbj48L3A+DQo8 cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFy Z2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1l cyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsi Pkkgc2F3IHRoZSB0ZXh0LCBhbmQgaGF2ZSAzIHF1ZXN0aW9ucy9jb21tZW50czo8L3NwYW4+PC9w Pg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9 Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0i VGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4 cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Ij4xLiDigJzigKZpdCBvbmx5IGltcGxpZXMgdGhhdCBzb21lIGJpdCBlcnJvcnMgb2NjdXJy ZWQgaW4gdGhlIHNpZ25hdHVyZXMu4oCdPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+ Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+V2hhdCBkb2VzIHRoYXQgbWVhbj88c3BhbiBzdHlsZT0ibXNv LXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsgPC9zcGFuPkFyZSB5b3UgaW1wbHlpbmcgdGhhdCB0aGUg c2VuZGVyIGdvdCB0aGUgc2lnbmF0dXJlIHdyb25nPzxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46 IHllczsiPiZuYnNwOw0KPC9zcGFuPk9yIG1heWJlIHRoYXQgdGhlcmUgd2FzIHNvbWUgY29ycnVw dGlvbiBpbi10cmFuc2l0PzxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0K PC9zcGFuPkJvdGggY2FzZXMgYXJlICpiYWQqLCBidXQgdGhlIGNhc2Ugd2hlcmUgdGhlIHNlbmRl ciBjb3VsZCBnZXQgdGhlIHNpZ25hdHVyZSB3cm9uZyBpcyBzcGVjaWFsbHkgc28gYmVjYXVzZSBp ZiBpdCB3YXNu4oCZdCBhIGR1cGxpY2F0ZSB1cGRhdGUsIHRoZW4gaXQgd291bGQgcmVzdWx0IOKA nE5vdCBWYWxpZOKAnSBhbmQgdGhlcmUgc2VlbXMgdG8gYmUgbm8gd2F5IHRvIGRldGVybWluZSBp ZiBpbiBmYWN0IHRoZSB2YWxpZGl0eSBmYWlsZWQgb3IgaWYNCiBpdCBpcyB0aGUgY2FzZSBvZiBz b21lIGJpdCBlcnJvcnMuIDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O1Nl Z29lIFVJIFN5bWJvbCZxdW90OyxzYW5zLXNlcmlmOyBtc28tYmlkaS1mb250LWZhbWlseTogJnF1 b3Q7U2Vnb2UgVUkgU3ltYm9sJnF1b3Q7OyI+4pi5PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9 IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4g OHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNl cmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+ PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+W1NyaXJhbS0yXSBU aGlzIGlzIGlycmVsZXZhbnQgbm93IGluIGxpZ2h0IG9mIHRoZSBleHBsYW5hdGlvbiBwcm92aWRl ZCBhdCB0aGUgdG9wIG9mIHRoaXMgZW1haWwuIFdlIGRvIG5vdCBldmVuIG5lZWQgdG8gZGVmaW5l IGR1cGxpY2F0ZSBoZXJlLCBub3IgdGFsayBhYm91dCBkZXRhaWxzIG9mIG9wdGltaXphdGlvbnMN CiBpbiB0aGUgZG9jdW1lbnQuPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBS b21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7 PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Mi4g4oCcVGhlcmVmb3JlLCB0aGUgQkdQ c2VjIHNwZWFrZXIgc2hvdWxkIGtlZXAgdGhlICdWYWxpZCcgb3JpZ2luYWwgdXBkYXRlIGFuZCBp Z25vcmUgdGhlIGR1cGxpY2F0ZS7igJ0gTm8hPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVz OyI+Jm5ic3A7DQo8L3NwYW4+VGhpcyBpcyBub3QgaG93IEJHUCB3b3Jrc+KApnNlZSBiZWxvdy48 L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZv bnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjog MGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Ij5bU3JpcmFtLTJdIFRoaXMgaXMgaXJyZWxldmFudCBub3cgaW4gbGlnaHQg b2YgdGhlIGV4cGxhbmF0aW9uIHByb3ZpZGVkIGF0IHRoZSB0b3Agb2YgdGhpcyBlbWFpbC4gV2Ug bmVlZCBub3QgZ2V0IGludG8gdGhlIGRldGFpbHMgb2YgdmFsaWRhdGlvbiBvcHRpbWl6YXRpb25z IGluIHRoZSBkb2N1bWVudC4NCjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcg Um9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZuYnNw Ozwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+ DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPjMuIOKAnOKApmlmIHRoZSBvcmlnaW5h bCB1cGRhdGUgd2VyZSAnTm90IFZhbGlkJywgdGhlbiBwZXJmb3JtaW5nIHZhbGlkYXRpb24gb2Yg dGhlIGR1cGxpY2F0ZSBpcyByZWxldmFudCBhbmQgU0hPVUxEIGJlIGRvbmUu4oCdPHNwYW4gc3R5 bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+V2h5IGlzIHRoaXMgbm90IGEg 4oCcTVVTVOKAnT88c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsgPC9zcGFu PklPVywgaWYgdGhlIG9yaWdpbmFsIHVwZGF0ZSB3YXMg4oCcTm90IFZhbGlk4oCdIHdoZW4gd291 bGQgaXQgYmUgb2sgdG8gbm90IHBlcmZvcm0gdmFsaWRhdGlvbiBvbiBhIG5ldyB1cGRhdGU/PC9z cGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxw IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyB0YWItc3RvcHM6IDY1LjM1cHQ7Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8 L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7IHRhYi1zdG9wczogNjUuMzVwdDsiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPltTcmly YW0tMl08c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5UaGlz IGlzIGlycmVsZXZhbnQgbm93IGluIGxpZ2h0IG9mIHRoZSBleHBsYW5hdGlvbiBwcm92aWRlZCBh dCB0aGUgdG9wIG9mIHRoaXMgZW1haWwuPHNwYW4gc3R5bGU9Im1zby10YWItY291bnQ6IDE7Ij4m bmJzcDsgVGhlIHNlbnRlbmNlIHlvdSBhcmUgcmVmZXJyaW5nIHRvIGlzIG5vIGxvbmdlciB0aGVy ZTsgbm90IG5lZWRlZC4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3 IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJz cDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9w Pg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7Jmd0OyBbU3JpcmFtXSBOb3Rl IHRoYXQgdGhlIGFib3ZlIGFwcGxpZXMgdG8gYm90aCBub24tZGV0ZXJtaW5pc3RpYyBhbmQgZGV0 ZXJtaW5pc3RpYyBzaWduYXR1cmUgYWxnb3JpdGhtcy48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFj ZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBp biA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFu Ij48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7Jmd0OyBN Ny4yLiByZmM0MjcxIChpbiBTZWN0aW9uIDkuIChVUERBVEUgTWVzc2FnZSBIYW5kbGluZykgdGFs a3MgYWJvdXQgdGhlIGltcGxpY2l0IHdpdGhkcmF3IG9mIGEgcm91dGUg4oCcaWYgdGhlIE5MUkkg b2YgdGhlIG5ldyByb3V0ZSBpcyBpZGVudGljYWwgdG8gdGhlIG9uZSB0aGUgcm91dGVyIGN1cnJl bnRseQ0KIGhhcyBzdG9yZWTigKbigJ0uPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+ Jm5ic3A7IDwvc3Bhbj5UaGUgc2FtZSBOTFJJIGNhc2Ugc2VlbXMgdG8gYmUgYSBwYXJ0aWN1bGFy IGNvbmRpdGlvbiBvZiB0aGUg4oCcZHVwbGljYXRlIHVwZGF0ZeKAnSBkZXNjcmliZWQgaGVyZS48 c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5JdCBtaWdodCBi ZSBhIGdvb2QgaWRlYSB0byBtZW50aW9uIHRoYXQgYSDigJxkdXBsaWNhdGUgdXBkYXRl4oCdIHJl c3VsdHMgaW4gdGhlIGltcGxpY2l0IHdpdGhkcmF3IG9mIHRoZSBvcmlnaW5hbCB1cGRhdGUuPHNw YW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+V2hhdCBoYXBwZW5z IGlmIGEgdGhpcmQgZHVwbGljYXRlIHJvdXRlIGlzIHJlY2VpdmVkICh0aGUgZmlyc3Qgb25lIHdh cyB2YWxpZCwgdGhlIHNlY29uZCBvbmUgd2FzIG5vdCB2YWxpZGF0ZWQpLCBzaG91bGQgaXQgYmUg dmFsaWRhdGVkPzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwv Zm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bhbj48 L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHls ZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZndDsmZ3Q7IFtTcmlyYW1dIEluIFJGQyA0MjcxLCB3 aGVuIHRoZXJlIGlzIGEgZHVwbGljYXRlIHVwZGF0ZSwgdGhlIE5STEkgYW5kIHBhdGggYW5kIGFs bCBvdGhlciBhdHRyaWJ1dGVzIGFyZSBpZGVudGljYWwuIFRoZXJlIGlzIG5vIGltcGxpY2l0IHdp dGhkcmF3LiBUaGUgcm91dGVyIGtlZXBzIHdoYXQgaXQgYWxyZWFkeQ0KIGhhcy4gSW4gdGhlIGNh c2Ugb2YgQkdQc2VjLCBhIHJvdXRlciBrZWVwcyB0aGUgb3JpZ2luYWwgaWYgaXQgd2FzIHZhbGlk LCBhbmQgaWdub3JlcyB0aGUgZHVwbGljYXRlLiBJdCBjaGVja3MgdGhlIHZhbGlkaXR5IG9mIHRo ZSBkdXBsaWNhdGUgb25seSBpZiB0aGUgb3JpZ2luYWwgd2VyZSBpbnZhbGlkLg0KPC9zcGFuPjwv cD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxl PSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9 IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4g OHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNl cmlmOyI+SW4gcGxhaW4gQkdQLCBpZiBhIGR1cGxpY2F0ZSB1cGRhdGUgKGFzIGRlZmluZWQgYWJv dmUgd2hlcmUgZXZlcnl0aGluZyBpcyBpZGVudGljYWwpIGlzIHJlY2VpdmVkLCB0aGVuIHRoZSBv cmlnaW5hbCBvbmUgaXMgcmVwbGFjZWQgYnkgdGhlIG5ldyBvbmUg4oCTIGluIHRoaXMgc3BlY2lm aWMgY2FzZSAod2hlcmUNCiBldmVyeXRoaW5nIGlzIGlkZW50aWNhbCksIGl0IG1heSBsb29rIGxp a2UgdGhlIHJvdXRlciBrZWVwcyB3aGF0IGl0IGFscmVhZHkgaGFz4oCmYnV0IHRoZSBnZW5lcmFs IHJ1bGUgaXMgdG8gcmVwbGFjZSB0aGUgb2xkIHVwZGF0ZSB3aXRoIGEgbmV3IG9uZSBmb3IgdGhl IHNhbWUgcHJlZml4LiBXaGF0IHlvdSBhcmUgcHJvcG9zaW5nIGFib3ZlICjigJxJbiB0aGUgY2Fz ZSBvZiBCR1BzZWMsIGEgcm91dGVyIGtlZXBzIHRoZSBvcmlnaW5hbCBpZiBpdCB3YXMNCiB2YWxp ZCwgYW5kIGlnbm9yZXMgdGhlIGR1cGxpY2F0ZS7igJ0pIGlzIGEgc2lnbmlmaWNhbnQgY2hhbmdl IHdpdGggcmVzcGVjdCB0byBCR1AgdGhhdCBpcyBub3QgZXhwbGljaXRseSBjYWxsZWQgb3V0Ljxz cGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPkkgaGF2ZW7igJl0 IHNlZW4gdGhpcyBiZWhhdmlvciBtZW50aW9uZWQgYW55d2hlcmUgaW4gdGhlIGRyYWZ0IOKAkyBp dCBoYXMgb25seSBjb21lIHVwIG5vdy4gSU1ITywgbm90IG9ubHkgc2hvdWxkIHRoZSBpbXBsaWNp dCB3aXRoZHJhdyBiZWhhdmlvciBub3QgY2hhbmdlLCBidXQgYnkgaWdub3JpbmcgdGhlIHNlY29u ZCB1cGRhdGUgeW914oCZcmUgaWdub3JpbmcgYSBwb3RlbnRpYWxseSBpbXBvcnRhbnQgY2hhbmdl IGluIHRoZSB0b3BvbG9neS9zdHJ1Y3R1cmUNCiBvZiB0aGUgbmV0d29yay7igKY8L3NwYW4+PC9w Pg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9 Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0i VGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4 cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Ij5bU3JpcmFtLTJdPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8 L3NwYW4+QWdhaW4sIHRoaXMgaXMgaXJyZWxldmFudCBub3cgaW4gbGlnaHQgb2YgdGhlIGV4cGxh bmF0aW9uIHByb3ZpZGVkIGF0IHRoZSB0b3Agb2YgdGhpcyBlbWFpbCBhbmQgdGhlIGNoYW5nZXMg bWFkZSBpbiB0aGUgZG9jdW1lbnQuIE5vdGhpbmcgc2FpZCBpbiB2ZXJzaW9uLTIwIHRoYXQgY29u dHJhZGljdHMgd2hhdCBpcyBkb25lIGluIHBsYWluIEJHUCB3aXRoIGR1cGxpY2F0ZXMuDQo8L3Nw YW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQg ZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGlu IDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Ij4mZ3Q7Jmd0OyBNMTAuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+ Jm5ic3A7DQo8L3NwYW4+SW4gU2VjdGlvbiA3LjIuIChPbiB0aGUgUmVtb3ZhbCBvZiBCR1BzZWMg U2lnbmF0dXJlcyk6IOKAnOKApnRoZSBwcm90b2NvbCBzcGVjaWZpZXMgdGhhdCBhIEJHUHNlYyBz cGVha2VyIGNob29zaW5nIHRvIHByb3BhZ2F0ZSB0aGUgcm91dGUgYWR2ZXJ0aXNlbWVudCBpbiBz dWNoIGFuIHVwZGF0ZSBtZXNzYWdlIFNIT1VMRCBhZGQgaXRzIHNpZ25hdHVyZSB0byBlYWNoIG9m IHRoZSBTaWduYXR1cmVfQmxvY2tzLuKAnTxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsi PiZuYnNwOyZuYnNwOw0KPC9zcGFuPkkgYmVsaWV2ZSB0aGUgcmVmZXJlbmNlIGlzIFNlY3Rpb24g NC4yIChwbGVhc2UgYWRkIGl0KS48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJz cDsNCjwvc3Bhbj5Ib3dldmVyLCB0aGF0IFNlY3Rpb24gZG9lc27igJl0IHVzZSBub3JtYXRpdmUg bGFuZ3VhZ2UgKOKAnEZvciBlYWNoIFNpZ25hdHVyZV9CbG9jayBjb3JyZXNwb25kaW5nIHRvIGFu IGFsZ29yaXRobSBzdWl0ZSB0aGF0IHRoZSBCR1BzZWMgc3BlYWtlciBkb2VzIHN1cHBvcnQsIHRo ZSBCR1BzZWMgc3BlYWtlciBhZGRzIGEgbmV3IFNpZ25hdHVyZSBTZWdtZW50IHRvIHRoZSBTaWdu YXR1cmVfQmxvY2su4oCdKTxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOyZu YnNwOw0KPC9zcGFuPkluIGFueSBjYXNlLCB0aGUg4oCcU0hPVUxE4oCdIGluIDcuMiBpcyBvdXQg b2YgcGxhY2UgYmVjYXVzZSBpdCBpcyByZWZlcmVuY2luZyBhIGZhY3QgKHBvaW50aW5nIGF0IHRo ZSBvdGhlciBzZWN0aW9uKSBhbmQgbm90IGJlaW5nIHVzZWQgbm9ybWF0aXZlbHkg4oCTIGlmIHlv dSB3YW50IHRoZSDigJxTSE9VTETigJ0gdG8gYmUgbm9ybWF0aXZlLCB0aGVuIGl0IHNob3VsZCBi ZSBiYWNrIGluIDQuMi48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFu Ij48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3Nw YW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7Jmd0OyBbU3JpcmFtXSBZZXMsIGFncmVl LiBGaXhlZCB0aGUgd29yZGluZyBwZXIgeW91ciBzdWdnZXN0aW9uIGluIGJvdGggcGxhY2VzIChT ZWN0aW9ucyA0LjIgYW5kIDcuMikuIEFkZGVkIHJlZmVyZW5jZSB0byBTZWN0aW9uIDQuMiBpbiBT ZWN0aW9uIDcuMi4gTm93IDQuMiByZWFkczog4oCcRm9yIGVhY2ggU2lnbmF0dXJlX0Jsb2NrDQog Y29ycmVzcG9uZGluZyB0byBhbiBhbGdvcml0aG0gc3VpdGUgdGhhdCB0aGUgQkdQc2VjIHNwZWFr ZXIgZG9lcyBzdXBwb3J0LCB0aGUgQkdQc2VjIHNwZWFrZXIgU0hPVUxEIGFkZCBhIG5ldyBTaWdu YXR1cmUgU2VnbWVudCB0byB0aGUgU2lnbmF0dXJlX0Jsb2Nr4oCdPHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvcD4NCjxwPjxmb250 IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBp biAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBS b21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+U2hvdWxk IHRoYXQg4oCcU0hPVUxE4oCdIGJlIGEg4oCcTVVTVOKAnT/igKY8L3NwYW4+PC9wPg0KPHA+PGZv bnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjog MGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3 IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5bU3Jp cmFtLTJdIEkgYWdyZWUuIE1VU1QgaXMgYXBwcm9wcmlhdGUgaGVyZS4gRG9uZSB0aGUgc3Vic3Rp dHV0aW9uLjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOyZuYnNwOw0KPC9z cGFuPjwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bhbj48L3A+DQo8 cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFy Z2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjsiPiZndDsgTTEyLiBUaGUgbWFuZGF0b3J5IGFkZGl0aW9uIG9mIFNl Y3VyZV9QYXRoIGFuZCBTaWduYXR1cmUgc2VnbWVudHMgaW4gYSBDb25mZWRlcmF0aW9uIHJlc3Vs dHMgaW4gdGhlIGluY29uc2lzdGVudCBhdXRob3JpemF0aW9uIGNoYWluIG1lbnRpb25lZCBpbiBT ZWN0aW9uIDQuMy4gKFByb2Nlc3NpbmcgSW5zdHJ1Y3Rpb25zDQogZm9yIENvbmZlZGVyYXRpb24g TWVtYmVycyk6IOKAnEZvciBhIHNpZ25hdHVyZSBwcm9kdWNlZCBieSBhIHBlZXIgQkdQc2VjIHNw ZWFrZXIgb3V0c2lkZSBvZiBhIGNvbmZlZGVyYXRpb24sIHRoZSBUYXJnZXQgQVMgd2lsbCBhbHdh eXMgYmUgdGhlIEFTIENvbmZlZGVyYXRpb24gSWRlbnRpZmllciAodGhlIHB1YmxpYyBBUyBudW1i ZXIgb2YgdGhlIGNvbmZlZGVyYXRpb24pIGFzIG9wcG9zZWQgdG8gdGhlIE1lbWJlci1BUyBOdW1i ZXIu4oCdPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+SXQg c2VlbXMgdG8gbWUgdGhhdCB0aGlzIGRpc2NvbnRpbnVpdHkgaW4gdGhlIEFTTiBsaXN0IGJyZWFr cyB0aGUg4oCcY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2UgdGhhdOKApkV2ZXJ5IEFTIG9uIHRoZSBw YXRoIG9mIEFTZXMgbGlzdGVkIGluIHRoZSB1cGRhdGUgbWVzc2FnZSBoYXMgZXhwbGljaXRseSBh dXRob3JpemVkIHRoZSBhZHZlcnRpc2VtZW50IG9mIHRoZSByb3V0ZSB0byB0aGUgc3Vic2VxdWVu dCBBUyBpbiB0aGUgcGF0aOKAnSBiZWNhdXNlDQogdGhlcmUgaXMgbm8gd2F5IHRvIHZlcmlmeSB0 aGF0IHRoZSBNZW1iZXItQVMgaW4gdGhlIGZpcnN0IFNlY3VyZV9QYXRoIHNlZ21lbnQgaXMgaW4g ZmFjdCB0aGUgb25lIHBlZXJpbmcgd2l0aCB0aGUgZXh0ZXJuYWwgbmVpZ2hib3IuPHNwYW4gc3R5 bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+SSByZWFsaXplIHRoYXQgdGhl IHJpc2sgbWF5IGJlIG1pbmltaXplZCBieSBhbiDigJxpbnRlcm5hbCB0cnVzdOKAnSBmYWN0b3Is IGJ1dCBJIHdvdWxkIGxpa2UgdG8gc2VlIGEgZGlzY3Vzc2lvbiBhYm91dCB0aGlzIGlzc3VlIGlu IHRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucy48L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0i VGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4 cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48 L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7Jmd0OyBbU3Jp cmFtXSBTZWUgdGhlIG5ldyBzZWNvbmQgcGFyYWdyYXBoIGluIFNlY3Rpb24gNy40LiBUaGUgc2Vj dXJpdHkgY29uc2lkZXJhdGlvbiB0aGF0IHlvdSBtZW50aW9uIGhlcmUgYWJvdXQgd2l0aCB0aGUg d2F5IGNvbmZlZGVyYXRpb25zIGFyZSBoYW5kbGVkIGlzIGRlc2NyaWJlZCBhbmQgZGlzY3Vzc2Vk DQogdGhlcmUuIDwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwv Zm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bhbj48 L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHls ZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPlBlcnNvbmFsbHksIEkgd291bGQgaGF2ZSBwcmVmZXJy ZWQgaWYgeW91IGFjdHVhbGx5IHNvbHZlZCB0aGUgcHJvYmxlbS4gT25lIHNvbHV0aW9uIGlzIHRv IGJvcnJvdyBmcm9tIGRyYWZ0LWlldGYtc2lkci1hcy1taWdyYXRpb24gYW5kIGZvcndhcmQgc2ln biBmcm9tIHRoZSBDb25mZWRlcmF0aW9uIEFTICh0aGUNCiBwdWJsaWMgbnVtYmVyKSB0byB0aGUg TWVtYmVyLUFTIHdpdGggcENvdW50PTAuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+ Jm5ic3A7DQo8L3NwYW4+Tm90ZSB0aGF0IHRoaXMgb3BlcmF0aW9uIHdvdWxkIHRha2UgcGxhY2Ug aW5zaWRlIHRoZSBib3JkZXIgQ29uZmVkZXJhdGlvbiByb3V0ZXIsIHNvIHRoZXJlIGFyZSBubyBp c3N1ZXMgd2l0aCBwQ291bnQ9MCBhbmQgdGhlIGZ1bGwgcGF0aCBjb250aW51aXR5IGlzIHByZXNl cnZlZC5bKl0gQ2hhaXJzOiBJIHRoaW5rIHRoYXQgdGhpcyBwYXJ0ICh3aGV0aGVyIGl0IGlzIHNv bHZlZCBvciBub3QpIHNob3VsZCBhbHNvIGJlIGJvdW5jZWQgYnkNCiB0aGUgV0cu4oCmPC9zcGFu PjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0 eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZh Y2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAw aW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmOyI+W1NyaXJhbS0yXSBQbGVhc2Ugc2VlIGRpc2N1c3Npb24gYXQgdGhlIHRvcCBvZiB0 aGlzIGVtYWlsLiBJIGFtIGFmcmFpZCwgdGhlIHNvbHV0aW9uIHlvdSBwcm9wb3NlIHdpbGwgbm90 IHdvcmsuIFRoZSBmaXJzdCBBUyBpbiB0aGUgQ29uZmVkZXJhdGlvbiBjYW4gc3RpbGwgdHVubmVs IHRoZSB1cGRhdGUgdG8gdGhlDQogc2Vjb25kIEFTIGl0IGlzIGNvbGx1ZGluZyB3aXRoLCBhbmQg dGhlIHNlY29uZCBBUyDigJxmb3J3YXJkIHNpZ25zIGZyb20gdGhlIENvbmZlZGVyYXRpb24gQVMg KHRoZSBwdWJsaWMgbnVtYmVyKSB0byB0aGUgTWVtYmVyLUFTIHdpdGggcENvdW50PTDigJ0uIFNv IHRoZSBwcm9ibGVtIHlvdSBvcmlnaW5hbGx5IGlkZW50aWZpZWQgZG9lc27igJl0IGdvIGF3YXku DQo8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9w Pg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+ PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Ij4mZ3Q7IG04LiBTZWN0aW9uIDUuMS4gKE92ZXJ2aWV3IG9mIEJHUHNl YyBWYWxpZGF0aW9uKTog4oCcSXQgaXMgZXhwZWN0ZWQgdGhhdCBCR1AgcGVlcnMgd2lsbCBnZW5l cmFsbHkgcHJlZmVyIHJvdXRlcyByZWNlaXZlZCB2aWEgJ1ZhbGlkJyBCR1BzZWMgdXBkYXRlIG1l c3NhZ2VzIG92ZXIgYm90aCByb3V0ZXMgcmVjZWl2ZWQNCiB2aWEgJ05vdCBWYWxpZCcgQkdQc2Vj IHVwZGF0ZSBtZXNzYWdlcyBhbmQgcm91dGVzIHJlY2VpdmVkIHZpYSB1cGRhdGUgbWVzc2FnZXMg dGhhdCBkbyBub3QgY29udGFpbiB0aGUgQkdQc2VjX1BhdGggYXR0cmlidXRl4oCmKFNlZSBbSS1E LmlldGYtc2lkci1iZ3BzZWMtb3BzXeKApuKAnTxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHll czsiPiZuYnNwOw0KPC9zcGFuPkkgcmVhZCB0aGlzIHBpZWNlIG9mIHRleHQgYXMgc2F5aW5nIHRo YXQgcm91dGVzIGluIE5vdCBWYWxpZCB1cGRhdGVzIGFyZSBleHBlY3RlZCB0byBiZSB1c2VkIChl dmVuIHRob3VnaCB0aGV5IGFyZSBub3QgdmFsaWQpLjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46 IHllczsiPiZuYnNwOw0KPC9zcGFuPkJlc2lkZXMgdGhlIGZhY3QgdGhhdCBJLUQuaWV0Zi1zaWRy LWJncHNlYy1vcHMgZG9lcyByZWNvbW1lbmQgdXNpbmcgTm90IFZhbGlkIGFubm91bmNlbWVudHMg KGluIFNlY3Rpb24gNyksIGFyZSB0aGVyZSBvdGhlciByZWFzb25zIGZvciB0aGlzIGRvY3VtZW50 IHRvIGV4cGVjdCB0aGVpciB1c2U/PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5l dyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5i c3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250Pjwv cD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jmd0OyZndDsgW1NyaXJhbV0gSWYg b25seSBhIOKAmE5vdCBWYWxpZOKAmSB1cGRhdGUgaXMgYXZhaWxhYmxlIGZvciBhIHByZWZpeCwg dGhlbiB0aGUgdXBkYXRlIGlzIHVzZWQgc2luY2Ugb3RoZXJ3aXNlIHRoZSBwcmVmaXggd291bGQg YmUgdW5yZWFjaGFibGUuIEJvdGggQkdQc2VjIGFuZCBSUEtJL29yaWdpbiB2YWxpZGF0aW9uDQog YXJlIGV4cGVjdGVkIHRvIGRlcHJlZiBpbnZhbGlkIHVwZGF0ZXMgcmF0aGVyIHRoYW4gaWdub3Jl IHRoZW0uIFRoaXMgaXMgZHJpdmVuIGJ5IG9wZXJhdG9yIHBvbGljeSBhbmQgY2FuIHZhcnkuIEhl bmNlLCB3ZSBhcmUgZGVsaWJlcmF0ZWx5IG5vdCB1c2luZyBhbnkgbm9ybWF0aXZlIGxhbmd1YWdl IGhlcmUuPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250 PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4N CjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJt YXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmOyI+SG9uZXN0bHksIHVzaW5nIOKAnE5vdCBWYWxpZOKAnSB1cGRh dGVzIG1ha2VzIG5vIHNlbnNlIHRvIG1lLjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsi PiZuYnNwOw0KPC9zcGFuPldl4oCZcmUgYnVpbGRpbmcgYWxsIHRoaXMgbWFjaGluZXJ5LCBjaGFu Z2luZyBCR1AsIGV0Yy4uIGp1c3QgdG8gZW5kIHVwIHVzaW5nIHVwZGF0ZXMgdGhhdCBhcmUgbm90 IHZhbGlkIGFueXdheS48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsNCjwv c3Bhbj5XaHkgYXJlIHdlIGRvaW5nIGFsbCB0aGlzIHdvcmsgdGhlbj8hPzxzcGFuIHN0eWxlPSJt c28tc3BhY2VydW46IHllczsiPiZuYnNwOyA8L3NwYW4+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiAmcXVvdDtTZWdvZSBVSSBTeW1ib2wmcXVvdDssc2Fucy1zZXJpZjsgbXNvLWJp ZGktZm9udC1mYW1pbHk6ICZxdW90O1NlZ29lIFVJIFN5bWJvbCZxdW90OzsiPuKYuTwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5J IHVuZGVyc3RhbmQgdGhhdCwgc3BlY2lhbGx5IGF0IHRoZSBiZWdpbm5pbmcsIHBlb3BsZSBtYXkg d2FudCB0byB1c2Ug4oCcTm90IFZhbGlk4oCdIHVwZGF0ZXPigKZidXQgdGhhdA0KIGlzIGFuIG9w ZXJhdGlvbmFsIGNvbnNpZGVyYXRpb24gKGFzIHlvdSBzYWlkIGFib3ZlKS48c3BhbiBzdHlsZT0i bXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsNCjwvc3Bhbj5QbGVhc2UgdGFrZSB0aGUgdGV4dCBv dXQgZnJvbSB0aGlzIGRvY3VtZW50IHRoYXQgcmVjb21tZW5kcyB1c2luZyDigJxOb3QgVmFsaWTi gJ3igKZhbmQgbGV0IEktRC5pZXRmLXNpZHItYmdwc2VjLW9wcyBkZWFsIHdpdGggdGhhdCByZWNv bW1lbmRhdGlvbi7igKY8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFu Ij48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3Nw YW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5bU3JpcmFtLTJdPHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+VGhlIHRleHQgaGFzIGJlZW4gZGVsZXRlZCBh cyBzdWdnZXN0ZWQuIDwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4i PjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bh bj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBz dHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPk5ldyBjb21tZW50Ojwvc3Bhbj48L3A+DQo8cD48 Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2lu OiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBO ZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPk4x LiBTZWN0aW9uIDIuMi4gKE5lZ290aWF0aW5nIEJHUHNlYyBTdXBwb3J0KSBzYXlzIHRoYXQgYmVj YXVzZSDigJxCR1BzZWMgdXBkYXRlIG1lc3NhZ2VzIGNhbiBiZSBxdWl0ZSBsYXJnZSwgdGhlcmVm b3JlIGFueSBCR1BzZWMgc3BlYWtlcuKAplNIT1VMRCBhbHNvIGFubm91bmNlIHN1cHBvcnQgZm9y IHRoZSBjYXBhYmlsaXR5DQogdG8gcmVjZWl2ZSBCR1AgZXh0ZW5kZWQgbWVzc2FnZXMgW0ktRC5p ZXRmLWlkci1iZ3AtZXh0ZW5kZWQtbWVzc2FnZXNdLuKAnTxzcGFuIHN0eWxlPSJtc28tc3BhY2Vy dW46IHllczsiPiZuYnNwOyZuYnNwOw0KPC9zcGFuPldoYXQgZG9lcyB0aGlzIG1lYW4gd2l0aCBy ZXNwZWN0IHRvIHRoZSBzZXNzaW9uIGVzdGFibGlzaG1lbnQgcmVxdWlyZW1lbnRzPzxzcGFuIHN0 eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPlRoaXMgY2FwYWJpbGl0eSBp cyBub3QgbWFuZGF0b3J5IChTSE9VTEQgaXMgdXNlZCBhbmQgbm90IE1VU1QpLCBidXQgYXMgQkdQ c2VjIGlzIGRlcGxveWVkIG1vcmUgYW5kIG1vcmUsIHRoZSBzeXN0ZW0gbWF5IG5vdCB3b3JrIGFu eW1vcmUgdW5sZXNzIGl0IGlzIGV4Y2hhbmdlZC48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5 ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5XaHkgd2FzbuKAmXQg4oCcTVVTVOKAnSB1c2VkPzxz cGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOyA8L3NwYW4+SeKAmW0gZ3Vlc3Np bmcgdGhhdCBwYXJ0IG9mIHRoZSByZWFzb24gbWF5IGJlIGF2YWlsYWJpbGl0eSBvZiB0aGUgZmVh dHVyZeKApjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOw0KPC9zcGFuPkkg dGhpbmsgdGhhdCB0aGUgcG90ZW50aWFsIG9mIGhhdmluZyBhIHByb3Blcmx5IG5lZ290aWF0ZWQg QkdQc2VjIHNlc3Npb24gc3RpbGwgbm90IHdvcmsgKGJlY2F1c2UgdGhlIG1lc3NhZ2VzIGFyZSB0 b28gYmlnKSBzaG91bGQgYXQgbGVhc3QgYmUgbWVudGlvbmVkIGluIHRoZSBuZXcgT3BlcmF0aW9u cyBhbmQgTWFuYWdlbWVudCBDb25zaWRlcmF0aW9ucyBTZWN0aW9uLjwvc3Bhbj48L3A+DQo8cD48 Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2lu OiAwaW4gMGluIDhwdDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjsiPiZuYnNwOzwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBO ZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDhwdDsiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPltT cmlyYW0tMl0gVGhlIGZvbGxvd2luZyBwYXJhIGFkZGVkIGluIHRoZSBvcHMgYW5kIG1nbXQuIHNl Y3Rpb246PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250 PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4N CjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJt YXJnaW46IDBpbiAwaW4gMHB0OyBsaW5lLWhlaWdodDogbm9ybWFsOyBtc28tbGF5b3V0LWdyaWQt YWxpZ246IG5vbmU7Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjsiPkluIFNlY3Rpb24gMi4yLCBpcyB3YXMgc3RhdGVkIHRoYXQgYSBCR1Bz ZWMgc3BlYWtlciBTSE9VTEQgYW5ub3VuY2U8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGlt ZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7 IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNw YW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+c3VwcG9y dCBmb3IgdGhlIGNhcGFiaWxpdHkgdG8gcmVjZWl2ZSBCR1AgZXh0ZW5kZWQgbWVzc2FnZXMuPHNw YW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7DQo8L3NwYW4+TGFjayBvZjwvc3Bh bj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBz dHlsZT0ibWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91 dC1ncmlkLWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4m bmJzcDsmbmJzcDsNCjwvc3Bhbj5uZWdvdGlhdGlvbiBvZiB0aGlzIGNhcGFiaWxpdHkgaXMgbm90 IGV4cGVjdGVkIHRvIHBvc2UgYSBwcm9ibGVtIGluPC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9 IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4g MHB0OyBsaW5lLWhlaWdodDogbm9ybWFsOyBtc28tbGF5b3V0LWdyaWQtYWxpZ246IG5vbmU7Ij4N CjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsi PjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllczsiPiZuYnNwOyZuYnNwOw0KPC9zcGFuPnRo ZSBlYXJseSB5ZWFycyBvZiBCR1BzZWMgZGVwbG95bWVudC48c3BhbiBzdHlsZT0ibXNvLXNwYWNl cnVuOiB5ZXM7Ij4mbmJzcDsgPC9zcGFuPg0KSG93ZXZlciwgYXMgQkdQc2VjIGlzIGRlcGxveWVk PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMHB0OyBsaW5lLWhlaWdodDogbm9ybWFsOyBtc28t bGF5b3V0LWdyaWQtYWxpZ246IG5vbmU7Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogJnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjsiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHll czsiPiZuYnNwOyZuYnNwOw0KPC9zcGFuPm1vcmUgYW5kIG1vcmUsIHRoZSBCR1BzZWMgdXBkYXRl IG1lc3NhZ2VzIHdvdWxkIGdyb3cgaW4gc2l6ZSBhbmQgc29tZTwvc3Bhbj48L3A+DQo8cD48Zm9u dCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAw aW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBu b25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwv c3Bhbj5tZXNzYWdlcyBtYXkgYmUgZHJvcHBlZCBkdWUgdG8gdGhlaXIgc2l6ZSBleGNlZWRpbmcg dGhlIGN1cnJlbnQgNEs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFu Ij48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwcHQ7IGxpbmUtaGVpZ2h0 OiBub3JtYWw7IG1zby1sYXlvdXQtZ3JpZC1hbGlnbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+PHNwYW4gc3R5bGU9Im1z by1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+Ynl0ZXMgbGltaXQuPHNwYW4g c3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzOyI+Jm5ic3A7IDwvc3Bhbj5UaGVyZWZvcmUsIGl0IGlz IHN0cm9uZ2x5IFJFQ09NTUVOREVEIHRoYXQgYWxsIEJHUHNlYzwvc3Bhbj48L3A+DQo8cD48Zm9u dCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9udD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAw aW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBu b25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwv c3Bhbj5zcGVha2VycyBuZWdvdGlhdGUgdGhlIGV4dGVuZGVkIG1lc3NhZ2UgY2FwYWJpbGl0eSB3 aXRoaW4gYTwvc3Bhbj48L3A+DQo8cD48Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iPjwvZm9u dD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDBwdDsgbGluZS1oZWlnaHQ6IG5vcm1h bDsgbXNvLWxheW91dC1ncmlkLWFsaWduOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNl cnVuOiB5ZXM7Ij4mbmJzcDsmbmJzcDsNCjwvc3Bhbj5yZWFzb25hYmxlIHBlcmlvZCBvZiB0aW1l IGFmdGVyIGluaXRpYWwgZGVwbG95bWVudCBvZiBCR1BzZWMuPC9zcGFuPjwvcD4NCjxwPjxmb250 IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBp biAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmOyI+Jm5ic3A7PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBS b21hbiI+PC9mb250PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+Jm5ic3A7 PC9zcGFuPjwvcD4NCjxwPjxmb250IGZhY2U9IlRpbWVzIE5ldyBSb21hbiI+PC9mb250PjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gOHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiAmcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyI+TjIuIFRoZSByZWZlcmVuY2VzIHRvIFJG QzUyMjYgYW5kIFJGQzY0ODcgc2hvdWxkIGJlIE5vcm1hdGl2ZS48L3NwYW4+PC9wPg0KPHA+PGZv bnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjog MGluIDBpbiA4cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Ij4mbmJzcDs8L3NwYW4+PC9wPg0KPHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3 IFJvbWFuIj48L2ZvbnQ+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5bU3Jp cmFtLTJdIERvbmUuDQo8L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Ij48YnI+DQo8L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjogMGluIDBpbiA4cHQ7Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Ij5Tcmly YW08L3NwYW4+PGJyPg0KPC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM2PR09MB04461678B8C50EEB716FC52A84830DM2PR09MB0446namp_-- From nobody Mon Dec 5 08:49:17 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A5D99129B67; Mon, 5 Dec 2016 08:49:11 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <148095655167.3353.15327020681531595531.idtracker@ietfa.amsl.com> Date: Mon, 05 Dec 2016 08:49:11 -0800 Archived-At: Cc: Chris Morrow , sidr-chairs@ietf.org, draft-ietf-sidr-bgpsec-pki-profiles@ietf.org, sidr@ietf.org Subject: [sidr] Last Call: (A Profile for BGPsec Router Certificates, Certificate Revocation Lists, and Certification Requests) to Proposed Standard X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Reply-To: ietf@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 16:49:12 -0000 The IESG has received a request from the Secure Inter-Domain Routing WG (sidr) to consider the following document: - 'A Profile for BGPsec Router Certificates, Certificate Revocation Lists, and Certification Requests' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2016-12-19. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document defines a standard profile for X.509 certificates used to enable validation of Autonomous System (AS) paths in the Border Gateway Protocol (BGP), as part of an extension to that protocol known as BGPsec. BGP is the standard for inter-domain routing in the Internet; it is the "glue" that holds the Internet together. BGPsec is being developed as one component of a solution that addresses the requirement to provide security for BGP. The goal of BGPsec is to provide full AS path validation based on the use of strong cryptographic primitives. The end-entity (EE) certificates specified by this profile are issued (to routers within an Autonomous System). Each of these certificates is issued under a Resource Public Key Infrastructure (RPKI) Certification Authority (CA) certificate. These CA certificates and EE certificates both contain the AS Identifier Delegation extension. An EE certificate of this type asserts that the router(s) holding the corresponding private key are authorized to emit secure route advertisements on behalf of the AS(es) specified in the certificate. This document also profiles the format of certification requests, and specifies Relying Party (RP) certificate path validation procedures for these EE certificates. This document extends the RPKI; therefore, this documents updates the RPKI Resource Certificates Profile (RFC 6487). The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-pki-profiles/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-pki-profiles/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Mon Dec 5 09:05:18 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F229B129B1A; Mon, 5 Dec 2016 09:05:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.796 X-Spam-Level: X-Spam-Status: No, score=-9.796 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8kL14i6aAFFB; Mon, 5 Dec 2016 09:05:15 -0800 (PST) Received: from dfw-mailout2.raytheon.com (dfw-mailout2.raytheon.com [199.46.199.208]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F35E9129C32; Mon, 5 Dec 2016 09:01:55 -0800 (PST) Received: from ca-mailout10.rtnmail.ray.com (ca-mailout10.rtnmail.ray.com [147.25.146.12]) by dfw-mailout2.raytheon.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.1) with ESMTP id uB5Gbfnd021143 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 5 Dec 2016 16:37:42 GMT Received: from 008-smtp-out.ray.com ([23.103.8.214]) by ca-mailout10.rtnmail.ray.com (8.15.0.59/8.15.0.59) with ESMTPS id uB5GbfHW015911 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 5 Dec 2016 16:37:41 GMT Received: from CY1PR0601MB023.008f.mgd2.msft.net (23.103.8.215) by CY1PR0601MB022.008f.mgd2.msft.net (23.103.8.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.721.19; Mon, 5 Dec 2016 16:37:40 +0000 Received: from CY1PR0601MB023.008f.mgd2.msft.net ([23.103.8.215]) by CY1PR0601MB023.008f.mgd2.msft.net ([23.103.8.215]) with mapi id 15.01.0721.017; Mon, 5 Dec 2016 16:37:40 +0000 From: Steve KENT To: "Alvaro Retana (aretana)" , "draft-ietf-sidr-bgpsec-pki-profiles@ietf.org" Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18 Thread-Index: AQHSTi4WSu/tt18RUk64ZuozIah2bKD5i9mD Date: Mon, 5 Dec 2016 16:37:40 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [23.103.8.69] Content-Type: multipart/alternative; boundary="_000_c383b226d2d14e5bbc5cfae785a89a4cCY1PR0601MB023008fmgd2m_" MIME-Version: 1.0 X-CC: aretana@cisco.com, draft-ietf-sidr-bgpsec-pki-profiles@ietf.org, sidr-chairs@ietf.org, morrowc@ops-netman.net, sidr@ietf.org X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-12-05_12:, , signatures=0 Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 17:05:17 -0000 --_000_c383b226d2d14e5bbc5cfae785a89a4cCY1PR0601MB023008fmgd2m_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Alvaro, Thanks for the careful review. I agree with your suggested edits cited in C2, C3, C4, C6, C7, C8, C9, and = C10. C1: yep, this sentence is broken in a few ways. How about: "A router holding the private key is authorized to send route advertisements (to its peers) identifying the router's ASN as the = source of the advertisements. C5: The allusion to future updates is in anticipation of adopting the relax= ed validation procedure that SIDR is about to forward to you. Still, the wo= rding is poor" how about: "=85is identical to the validation procedure desc= ribed in Section 7 of [RFC6487] (and any RFC that updates this procedure), = as modified below." C11: yes, my name should be removed from the Acknowledgements section. I'll rely on Sean to make these changes, if he concurs. Steve ________________________________ From: Alvaro Retana (aretana) Sent: Sunday, December 4, 2016 7:58:20 AM To: draft-ietf-sidr-bgpsec-pki-profiles@ietf.org Cc: sidr-chairs@ietf.org; Chris Morrow; sidr@ietf.org Subject: AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18 Dear authors: Hi! I just finished reading this document. I have some comments (please see below) I would like you to address, but I = wouldn=92t characterize any of them as major, so I=92m starting the IETF La= st Call and placing this document in the next available IESG Telechat. Thanks! Alvaro. Comments: C1. From the Introduction: =93A router holding the private key is authorize= d to send route advertisements (to its peers) that contain one or more of t= he specified AS number as the last item in the AS PATH attribute.=94 First= of all, if BGPSec is used, then the AS_PATH attribute is not. Second, wha= t does =93one or more of the specified AS number as the last item=94 mean? = There is only one =93last item=94=85but I=92m guessing you might be referr= ing to pre-pending. C2. =93Border Gateway Protocol Security protocol (BGPsec)=94 I haven=92t s= een BGPsec expanded anywhere else like that. In fact, ID.sidr-bgpsec-proto= col just used BGPsec (no expansion). C3. s/ID.sidr-rfc6485bis/rfc7935 C4. In Section 3.1.3.2. (Extended Key Usage): =93As specified in [RFC6487] = this extension MUST be marked as non-critical.=94 Because the behavior was= specified in RFC6487, then the =93MUST=94 shouldn=92t be Normative here; s= /MUST/must C5. Section 3.3. (BGPsec Router Certificate Validation) says that the =93va= lidation procedure=85is identical to the validation procedure described in = Section 7 of [RFC6487] (and any RFC that updates this procedure), but using= the constraints applied come from this specification.=94 It Is strange to= me that the phrase inside the parenthesis is included here since there isn= =92t an update to the procedure =96 is there a specific reason why you need= to call future (unknown) updates out at this point? BTW, s/using the con= straints applied come from this specification/using the constraints from th= is specification C6. References. - RFC6818 can be made Informative. - RFC6486 and ID.sidr-bgpsec-protocol should be Normative. C7. s/to an Internet Service Providers (ISP)/ to an Internet Service Provid= er (ISP) C8. s/The CA also generate./ (orphan phrase) C9. s/The [RFC6480]/[RFC6480] C10. s/3.1.1.1./3.1.1. C11. =93=85the efforts of Steve Kent=85were instrumental in preparing this = work=94 Steve is an author. --_000_c383b226d2d14e5bbc5cfae785a89a4cCY1PR0601MB023008fmgd2m_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Alvaro,


Thanks for the careful review.


I agree with your suggested edits cited in C2, C3, C4, C6, C7, C8,= C9, and C10.


C1: yep, this sentence is broken in a few ways. How about:<= /p>

"A router holding the private key is authorized to sen= d

   route advertisements (to its peers) identifying the route= r's ASN as the source of the advertisements.


C5: The allusion to future updates is in anticipation of adopting the re= laxed validation procedure that SIDR is about to forward to you. Still, the= wording is poor" how about: "= =85is identical to the validation procedure described in Section 7 of [RFC6487] (and any RFC that updates this procedure), as mo= dified below."


C11: yes, my name should be removed fro= m the Acknowledgements section.


I'll rely on Sean to make these changes= , if he concurs.


Steve

From: Alvaro Retana (aretan= a) <aretana@cisco.com>
Sent: Sunday, December 4, 2016 7:58:20 AM
To: draft-ietf-sidr-bgpsec-pki-profiles@ietf.org
Cc: sidr-chairs@ietf.org; Chris Morrow; sidr@ietf.org
Subject: AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18
 

Dear authors:<= /o:p>

 

Hi!  I just fi= nished reading this document.

 

I have some comment= s (please see below) I would like you to address, but I wouldn=92t characte= rize any of them as major, so I=92m starting the IETF Last Call and placing= this document in the next available IESG Telechat.

 

Thanks!<= /span>

 

Alvaro.<= /span>

 

 

Comments:

 

C1. From the Introd= uction: =93A router holding the private key is authorized to send route adv= ertisements (to its peers) that contain one or more of the specified AS num= ber as the last item in the AS PATH attribute.=94  First of all, if BGPSec is used, then the AS_PATH attribute is not.  = Second, what does =93one or more of the specified AS number as the last ite= m=94 mean?  There is only one =93last item=94=85but I=92m guessing you= might be referring to pre-pending.

 

C2. =93Border Gatew= ay Protocol Security protocol (BGPsec)=94  I haven=92t seen BGPsec exp= anded anywhere else like that.  In fact, ID.sidr-bgpsec-protocol just = used BGPsec (no expansion).

 

C3. s/ID.sidr-rfc64= 85bis/rfc7935

 

C4. In Section 3.1.= 3.2. (Extended Key Usage): =93As specified in [RFC6487] this extension MUST= be marked as non-critical.=94  Because the behavior was specified in = RFC6487, then the =93MUST=94 shouldn=92t be Normative here; s/MUST/must

 

C5. Section 3.3. (B= GPsec Router Certificate Validation) says that the =93validation procedure= =85is identical to the validation procedure described in Section 7 of [RFC6= 487] (and any RFC that updates this procedure), but using the constraints applied come from this specification.=94  I= t Is strange to me that the phrase inside the parenthesis is included here = since there isn=92t an update to the procedure =96 is there a specific reas= on why you need to call future (unknown) updates out at this point?   BTW, s/using the constraints applied come f= rom this specification/using the constraints from this specification

 

C6. References.

- RFC6818 can be ma= de Informative.

- RFC6486 and ID.si= dr-bgpsec-protocol should be Normative.

 

C7. s/to an Interne= t Service Providers (ISP)/ to an Internet Service Provider (ISP)=

 

C8. s/The CA also g= enerate./  (orphan phrase)

 

C9. s/The [RFC6480]= /[RFC6480]

 

C10. s/3.1.1.1./3.1= .1.

 

C11. =93=85the effo= rts of Steve Kent=85were instrumental in preparing this work=94  Steve= is an author.

--_000_c383b226d2d14e5bbc5cfae785a89a4cCY1PR0601MB023008fmgd2m_-- From nobody Tue Dec 6 11:09:21 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C7F4129ABA for ; Tue, 6 Dec 2016 11:09:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j6Omxx34YzUJ for ; Tue, 6 Dec 2016 11:09:07 -0800 (PST) Received: from mail-qk0-x22c.google.com (mail-qk0-x22c.google.com [IPv6:2607:f8b0:400d:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EB7B129AF9 for ; Tue, 6 Dec 2016 11:08:37 -0800 (PST) Received: by mail-qk0-x22c.google.com with SMTP id n204so390124415qke.2 for ; Tue, 06 Dec 2016 11:08:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=+H9/RnNDlAjZZFCpWH/WyeCOUEapsaRlQx7efOWko1A=; b=MpitBq3qayJQTX9EcB/RcySvCmNH7OB8v8ItGhmi4kD1jut9KT0fz4LCjKHJr/N0qK TFv434qqie9H5HTXfgKSQ54QVS0gNGxdVgCdKilXc0zBECgGfIkb0H2gsbIGvRrez+Oz 1/3oAoxpK9fxea6F+7gk0CSKr1zbZKkF3xREg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=+H9/RnNDlAjZZFCpWH/WyeCOUEapsaRlQx7efOWko1A=; b=P1l7f3qwDnuRj9ORIGwAe/bOjY3/HtEnF6dD0+krli8H90xhWefeuyp25sm6yvL9xO X2Zqgpooo6+6FaU1lzG8Gief7TevLuDku3+BfsjuKjIHsdHyqni/heI1RYCgvO48v/8X h6aoM2noKdmp6li0YtVLC+/lM5uv1Dcf7PV6YHUc1ufne4thq0+kdZrJ3aUZRmgxRhRT N/LncegLSkzpIzTqrchAk73Qn73Z0OjmP5cb+R1G3wrT5TbaE678NF2pGLdgRZLlm8/U ZdSLqPw+nP+E0yvwjw916LUwKJ5GC4LfhxN+xQ2Xb0W7da3mAK64yYvbzfOOGKgfR9GG v8Sw== X-Gm-Message-State: AKaTC02m4Tn/7UkbwzUPEYTHWilnGE6pDBBM1MI1S14RqNMNGDyoLZRppijn2pc7YAv4Ww== X-Received: by 10.55.154.23 with SMTP id c23mr53940333qke.304.1481051316662; Tue, 06 Dec 2016 11:08:36 -0800 (PST) Received: from [172.16.0.92] (pool-173-73-120-80.washdc.east.verizon.net. [173.73.120.80]) by smtp.gmail.com with ESMTPSA id q3sm12731159qte.41.2016.12.06.11.08.35 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 06 Dec 2016 11:08:36 -0800 (PST) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: Date: Tue, 6 Dec 2016 14:08:34 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <2BF91614-3AE9-432F-8F19-4D663409C18A@sn3rd.com> References: To: Steve KENT , "Alvaro Retana (aretana)" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "draft-ietf-sidr-bgpsec-pki-profiles@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 19:09:10 -0000 I concur and I=92ve got an editor=92s copy with all the changes = incorporated. Unless I hear otherwise I=92ll hold off on posting until = we=92ve collected and addressed all of the other IETF LC comments. spt > On Dec 05, 2016, at 11:37, Steve KENT wrote: >=20 > Alvaro, >=20 > Thanks for the careful review. >=20 > I agree with your suggested edits cited in C2, C3, C4, C6, C7, C8, C9, = and C10. >=20 > C1: yep, this sentence is broken in a few ways. How about: > "A router holding the private key is authorized to send > route advertisements (to its peers) identifying the router's ASN as = the source of the advertisements. >=20 > C5: The allusion to future updates is in anticipation of adopting the = relaxed validation procedure that SIDR is about to forward to you. = Still, the wording is poor" how about: "=85is identical to the = validation procedure described in Section 7 of [RFC6487] (and any RFC = that updates this procedure), as modified below." >=20 > C11: yes, my name should be removed from the Acknowledgements section. >=20 > I'll rely on Sean to make these changes, if he concurs. >=20 > Steve > From: Alvaro Retana (aretana) > Sent: Sunday, December 4, 2016 7:58:20 AM > To: draft-ietf-sidr-bgpsec-pki-profiles@ietf.org > Cc: sidr-chairs@ietf.org; Chris Morrow; sidr@ietf.org > Subject: AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18 > =20 > Dear authors: > =20 > Hi! I just finished reading this document. > =20 > I have some comments (please see below) I would like you to address, = but I wouldn=92t characterize any of them as major, so I=92m starting = the IETF Last Call and placing this document in the next available IESG = Telechat. > =20 > Thanks! > =20 > Alvaro. > =20 > =20 > Comments: > =20 > C1. =46rom the Introduction: =93A router holding the private key is = authorized to send route advertisements (to its peers) that contain one = or more of the specified AS number as the last item in the AS PATH = attribute.=94 First of all, if BGPSec is used, then the AS_PATH = attribute is not. Second, what does =93one or more of the specified AS = number as the last item=94 mean? There is only one =93last item=94=85but = I=92m guessing you might be referring to pre-pending. > =20 > C2. =93Border Gateway Protocol Security protocol (BGPsec)=94 I = haven=92t seen BGPsec expanded anywhere else like that. In fact, = ID.sidr-bgpsec-protocol just used BGPsec (no expansion). > =20 > C3. s/ID.sidr-rfc6485bis/rfc7935 > =20 > C4. In Section 3.1.3.2. (Extended Key Usage): =93As specified in = [RFC6487] this extension MUST be marked as non-critical.=94 Because the = behavior was specified in RFC6487, then the =93MUST=94 shouldn=92t be = Normative here; s/MUST/must > =20 > C5. Section 3.3. (BGPsec Router Certificate Validation) says that the = =93validation procedure=85is identical to the validation procedure = described in Section 7 of [RFC6487] (and any RFC that updates this = procedure), but using the constraints applied come from this = specification.=94 It Is strange to me that the phrase inside the = parenthesis is included here since there isn=92t an update to the = procedure =96 is there a specific reason why you need to call future = (unknown) updates out at this point? BTW, s/using the constraints = applied come from this specification/using the constraints from this = specification > =20 > C6. References. > - RFC6818 can be made Informative. > - RFC6486 and ID.sidr-bgpsec-protocol should be Normative. > =20 > C7. s/to an Internet Service Providers (ISP)/ to an Internet Service = Provider (ISP) > =20 > C8. s/The CA also generate./ (orphan phrase) > =20 > C9. s/The [RFC6480]/[RFC6480] > =20 > C10. s/3.1.1.1./3.1.1. > =20 > C11. =93=85the efforts of Steve Kent=85were instrumental in preparing = this work=94 Steve is an author. From nobody Tue Dec 6 11:28:13 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5D3B129BA2; Tue, 6 Dec 2016 11:28:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JHol_o1NQQXq; Tue, 6 Dec 2016 11:28:10 -0800 (PST) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB42D129BBF; Tue, 6 Dec 2016 11:23:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5154; q=dns/txt; s=iport; t=1481052225; x=1482261825; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=er9ZFiqCABBTx9ElF3ODaMoGuVuLe0o2dVdKOm9dwGI=; b=kp6ZSyfIeBhWdOxxcesMiiUTiQUK+jC6BZl+kJa9yeD2CsQexZH1HgVo m9e/pT9xVAdw5npV8lSSOw2taHxHkzpTRdPq4xHGrTQsif3JhkCVqeW7+ rEM5wh0H31jh4MNitOFujSagxkRuWW12yYF5KRLXSi/bBH7tJQexoO/L9 c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AXAQDTDkdY/4oNJK1eGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgnNGAQEBAQEfWoEGB41ApmmFIoIHhiICGoIKPxQBAgEBAQEBAQF?= =?us-ascii?q?iKIRpBiNWEAIBCAQ7AwICAjAUEQIEAQ0FiG+pNYIpL4sUAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBHIY+gX0IglaHTC2CEh4FlHyFagGRF5A/khABHzeBGTEBAYUicog?= =?us-ascii?q?BgQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.33,310,1477958400"; d="scan'208,217";a="356559956" Received: from alln-core-5.cisco.com ([173.36.13.138]) by alln-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 06 Dec 2016 19:23:45 +0000 Received: from XCH-ALN-003.cisco.com (xch-aln-003.cisco.com [173.36.7.13]) by alln-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id uB6JNjo8010306 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 6 Dec 2016 19:23:45 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-003.cisco.com (173.36.7.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 6 Dec 2016 13:23:44 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Tue, 6 Dec 2016 13:23:44 -0600 From: "Alvaro Retana (aretana)" To: Sean Turner , Steve KENT Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18 Thread-Index: AQHSTi4WSu/tt18RUk64ZuozIah2bKD5i9mDgAIkpwD//9HwAA== Date: Tue, 6 Dec 2016 19:23:44 +0000 Message-ID: <04484EFF-58D7-48B5-8633-043436BCB9B7@cisco.com> References: <2BF91614-3AE9-432F-8F19-4D663409C18A@sn3rd.com> In-Reply-To: <2BF91614-3AE9-432F-8F19-4D663409C18A@sn3rd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.230.46] Content-Type: multipart/alternative; boundary="_000_04484EFF58D748B58633043436BCB9B7ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "draft-ietf-sidr-bgpsec-pki-profiles@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-pki-profiles-18 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 19:28:12 -0000 --_000_04484EFF58D748B58633043436BCB9B7ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhdCB3b3JrZCBmb3IgbWUuDQoNClRoYW5rcyENCg0KQWx2YXJvLg0KDQpPbiAxMi82LzE2LCA0 OjA4IFBNLCAiU2VhbiBUdXJuZXIiIDxzZWFuQHNuM3JkLmNvbTxtYWlsdG86c2VhbkBzbjNyZC5j b20+PiB3cm90ZToNCg0KSSBjb25jdXIgYW5kIEnigJl2ZSBnb3QgYW4gZWRpdG9y4oCZcyBjb3B5 IHdpdGggYWxsIHRoZSBjaGFuZ2VzIGluY29ycG9yYXRlZC4gIFVubGVzcyBJIGhlYXIgb3RoZXJ3 aXNlIEnigJlsbCBob2xkIG9mZiBvbiBwb3N0aW5nIHVudGlsIHdl4oCZdmUgY29sbGVjdGVkIGFu ZCBhZGRyZXNzZWQgYWxsIG9mIHRoZSBvdGhlciBJRVRGIExDIGNvbW1lbnRzLg0KDQo= --_000_04484EFF58D748B58633043436BCB9B7ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <0BE9784438D4914899ECACF9C786E4E5@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBE ZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0K CXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnNwYW4uYXBwbGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTph cHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDsN Cglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7fQ0Kc3Bhbi5tc29JbnMN Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJ e21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2Ug V29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAx LjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0t Pjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPlRoYXQgd29ya2QgZm9yIG1lLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PlRoYW5rcyE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5BbHZhcm8uPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGJs b2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNCNUM0REYgNC41 cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdDttYXJnaW4tbGVmdDozLjc1cHQ7bWFyZ2luLXJp Z2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFj ayI+T24gMTIvNi8xNiwgNDowOCBQTSwgJnF1b3Q7U2VhbiBUdXJuZXImcXVvdDsgJmx0OzxhIGhy ZWY9Im1haWx0bzpzZWFuQHNuM3JkLmNvbSI+c2VhbkBzbjNyZC5jb208L2E+Jmd0OyB3cm90ZTo8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjVwdDtmb250LWZh bWlseTpDb25zb2xhcztjb2xvcjpibGFjayI+SSBjb25jdXIgYW5kIEnigJl2ZSBnb3QgYW4gZWRp dG9y4oCZcyBjb3B5IHdpdGggYWxsIHRoZSBjaGFuZ2VzIGluY29ycG9yYXRlZC4mbmJzcDsmbmJz cDtVbmxlc3MgSSBoZWFyIG90aGVyd2lzZSBJ4oCZbGwgaG9sZCBvZmYgb24gcG9zdGluZyB1bnRp bCB3ZeKAmXZlIGNvbGxlY3RlZCBhbmQgYWRkcmVzc2VkIGFsbCBvZiB0aGUgb3RoZXINCiBJRVRG IExDIGNvbW1lbnRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_04484EFF58D748B58633043436BCB9B7ciscocom_-- From nobody Tue Dec 6 14:31:47 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EC891295A3; Tue, 6 Dec 2016 14:31:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uX2RmHxqVHng; Tue, 6 Dec 2016 14:31:43 -0800 (PST) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 926171295C7; Tue, 6 Dec 2016 14:31:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=10150; q=dns/txt; s=iport; t=1481063495; x=1482273095; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=lTgfoAUSYLA0BrWyyPC0GN5jkSRpjcZSsR3Om1uIE5Q=; b=dJYKgg55HCN+i/uISzAqnPRNtaBuKr0feo8krmLgWoPd8eZqn2wu0pjt M+RsFBcs4uIhv5VbCgZtJzt3XTa27R9UZcCgPFk92lYvv0Js/C0YPvrn3 0Y7fRciGN9nvSJF4BQDbP+cmJtVHiZSlXiWbKWsKASYaJr0vw1hs76L+8 o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BxAQAFO0dY/4gNJK1eGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgnNGAQEBAQEfWoEGB41ApmiFIoIHhiICGoIMPxQBAgEBAQEBAQFiKIR?= =?us-ascii?q?pBiNWEAIBCD8DAgICMBQRAgQOBYhvqTKCKS+LEwEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBARyGPoF9CIJWhDaDFi2CMAWUfIVqAZEXkD+SEAEfN4EZMQEBhSJyhlMrgQO?= =?us-ascii?q?BDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.33,310,1477958400"; d="scan'208,217";a="357539498" Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 06 Dec 2016 22:31:34 +0000 Received: from XCH-RCD-001.cisco.com (xch-rcd-001.cisco.com [173.37.102.11]) by alln-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id uB6MVYxk008871 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 6 Dec 2016 22:31:34 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-001.cisco.com (173.37.102.11) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 6 Dec 2016 16:31:34 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Tue, 6 Dec 2016 16:31:33 -0600 From: "Alvaro Retana (aretana)" To: Randy Bush Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-ops-10 Thread-Index: AQHSNR62bJsPySrh80ivtkDVsKGkYA== Date: Tue, 6 Dec 2016 22:31:33 +0000 Message-ID: References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.230.46] Content-Type: multipart/alternative; boundary="_000_C7A005B575504B748C80C32C60093CD9ciscocom_" MIME-Version: 1.0 Archived-At: Cc: "sidr-chairs@ietf.org" , sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 22:31:44 -0000 --_000_C7A005B575504B748C80C32C60093CD9ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UmFuZHk6DQoNCkhpIQ0KDQpJbiB0aGlua2luZyBhYm91dCB0aGlzIHBvaW50IHNvbWUgbW9yZeKA pndoYXQgYWJvdXQgZHJhZnQtaWV0Zi1zaWRyLXNsdXJtPyAgSXNu4oCZdCB0aGF0IHN1cHBvc2Vk IHRvIGFkZHJlc3MgdGhlIHByaXZhdGUgc3BhY2U/DQoNClRoYW5rcyENCg0KQWx2YXJvLg0KDQpP biAxMi8yLzE2LCAxMjo1NiBQTSwgIlJhbmR5IEJ1c2giIDxyYW5keUBwc2cuY29tPG1haWx0bzpy YW5keUBwc2cuY29tPj4gd3JvdGU6DQoNCg0KTTQuIFN0aWxsIGluIFNlY3Rpb24gNzog4oCcVG8g cHJldmVudCBleHBvc3VyZSBvZiB0aGUgaW50ZXJuYWxzIG9mIEJHUA0KQ29uZmVkZXJhdGlvbnMg W1JGQzUwNjVdLCBhIEJHUHNlYyBzcGVha2VyIHdoaWNoIGlzIGEgTWVtYmVyLUFTIG9mIGENCkNv bmZlZGVyYXRpb24gTVVTVCBOT1Qgc2lnbiB1cGRhdGVzIHNlbnQgdG8gYW5vdGhlciBNZW1iZXIt QVMgb2YgdGhlDQpzYW1lIENvbmZlZGVyYXRpb24u4oCdICBUaGlzIGlzIGFub3RoZXIgY2FzZSB3 aGVyZSB0aGUgQkdQU2VjIHNwZWMgc2F5cw0Kc29tZXRoaW5nIGRpZmZlcmVudDogU2VjdGlvbiA0 LjMuIChQcm9jZXNzaW5nIEluc3RydWN0aW9ucyBmb3INCkNvbmZlZGVyYXRpb24gTWVtYmVycykg cHJlc2VudHMgYSBtYW5kYXRvcnkgbWVjaGFuaXNtIHRoYXQgaW5jbHVkZXMNCnNpZ25pbmcsIGJ1 dCBub3QgbmVjZXNzYXJpbHkgdmFsaWRhdGluZy4gIEJUVywgaWYgdGhlIHVwZGF0ZXMgYXJlIG5v dA0Kc2lnbmVkLCB0aGVuIHRoZSBzaWduZWQgcGF0aCB3b3VsZCBiZSBicm9rZW4sIGV2ZW4gaWYg YWxsIHRoZSByb3V0ZXJzDQppbiB0aGUgcGF0aCBzdXBwb3J0IEJHUFNlYywgcmlnaHQ/ICBJcyB0 aGF0IHRoZSByZWNvbW1lbmRhdGlvbj8NCg0KaXQgaXMgY29tbW9uIGZvciBhIGJncCBjb25mZWRl cmF0aW9uIHRvIGluY2x1ZGUgcHJpdmF0ZSBBU3MgZm9yIHdoaWNoDQp0aGVyZSBjYW4gYmUgbm8g dW5pcXVlIGF1dGhvcmF0aXZlIHJvdXRlciBjcmVkZW50aWFscyBpbiB0aGUgcnBraS4NCmhlbmNl IGkgYW0gc3VzcGljaW91cyBvZiB0aGUgcHJvdG9jb2wgc3BlYy4NCg0K --_000_C7A005B575504B748C80C32C60093CD9ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <4DC7519D8D873940A4BE3F8965DB1719@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBE ZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0K CXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnNwYW4uYXBwbGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTph cHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDsN Cglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7fQ0Kc3Bhbi5tc29JbnMN Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJ e21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2Ug V29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAx LjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0t Pjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPlJhbmR5OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkhpITxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPkluIHRoaW5raW5nIGFib3V0IHRoaXMgcG9pbnQgc29tZSBtb3Jl 4oCmd2hhdCBhYm91dCBkcmFmdC1pZXRmLXNpZHItc2x1cm0/Jm5ic3A7IElzbuKAmXQgdGhhdCBz dXBwb3NlZCB0byBhZGRyZXNzIHRoZSBwcml2YXRlIHNwYWNlPzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPlRoYW5rcyE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5BbHZhcm8uPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNCNUM0 REYgNC41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdDttYXJnaW4tbGVmdDozLjc1cHQ7bWFy Z2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xv cjpibGFjayI+T24gMTIvMi8xNiwgMTI6NTYgUE0sICZxdW90O1JhbmR5IEJ1c2gmcXVvdDsgJmx0 OzxhIGhyZWY9Im1haWx0bzpyYW5keUBwc2cuY29tIj5yYW5keUBwc2cuY29tPC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0I1QzRERiA0LjVw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0O21hcmdpbi1sZWZ0OjMuNzVwdDttYXJnaW4tcmln aHQ6MGluO2ZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7b3JwaGFuczogYXV0bzt0ZXh0LWFsaWdu OnN0YXJ0O3dpZG93czogYXV0bzstd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7d29yZC1z cGFjaW5nOjBweCIgaWQ9Ik1BQ19PVVRMT09LX0FUVFJJQlVUSU9OX0JMT0NLUVVPVEUiPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuNXB0O2Zv bnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj48YnI+DQpNNC4gU3RpbGwgaW4gU2VjdGlv biA3OiDigJxUbyBwcmV2ZW50IGV4cG9zdXJlIG9mIHRoZSBpbnRlcm5hbHMgb2YgQkdQPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6Ymxh Y2siPkNvbmZlZGVyYXRpb25zIFtSRkM1MDY1XSwgYSBCR1BzZWMgc3BlYWtlciB3aGljaCBpcyBh IE1lbWJlci1BUyBvZiBhPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1p bHk6Q29uc29sYXM7Y29sb3I6YmxhY2siPkNvbmZlZGVyYXRpb24gTVVTVCBOT1Qgc2lnbiB1cGRh dGVzIHNlbnQgdG8gYW5vdGhlciBNZW1iZXItQVMgb2YgdGhlPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2siPnNhbWUgQ29uZmVk ZXJhdGlvbi7igJ0mbmJzcDsmbmJzcDtUaGlzIGlzIGFub3RoZXIgY2FzZSB3aGVyZSB0aGUgQkdQ U2VjIHNwZWMgc2F5czxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuNXB0O2ZvbnQtZmFtaWx5 OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj5zb21ldGhpbmcgZGlmZmVyZW50OiBTZWN0aW9uIDQuMy4g KFByb2Nlc3NpbmcgSW5zdHJ1Y3Rpb25zIGZvcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu NXB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj5Db25mZWRlcmF0aW9uIE1lbWJl cnMpIHByZXNlbnRzIGEgbWFuZGF0b3J5IG1lY2hhbmlzbSB0aGF0IGluY2x1ZGVzPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2si PnNpZ25pbmcsIGJ1dCBub3QgbmVjZXNzYXJpbHkgdmFsaWRhdGluZy4mbmJzcDsmbmJzcDtCVFcs IGlmIHRoZSB1cGRhdGVzIGFyZSBub3Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjVwdDtm b250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjayI+c2lnbmVkLCB0aGVuIHRoZSBzaWduZWQg cGF0aCB3b3VsZCBiZSBicm9rZW4sIGV2ZW4gaWYgYWxsIHRoZSByb3V0ZXJzPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2siPmlu IHRoZSBwYXRoIHN1cHBvcnQgQkdQU2VjLCByaWdodD8mbmJzcDsmbmJzcDtJcyB0aGF0IHRoZSBy ZWNvbW1lbmRhdGlvbj88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90 ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjVwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2siPml0 IGlzIGNvbW1vbiBmb3IgYSBiZ3AgY29uZmVkZXJhdGlvbiB0byBpbmNsdWRlIHByaXZhdGUgQVNz IGZvciB3aGljaDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuNXB0O2ZvbnQtZmFtaWx5OkNv bnNvbGFzO2NvbG9yOmJsYWNrIj50aGVyZSBjYW4gYmUgbm8gdW5pcXVlIGF1dGhvcmF0aXZlIHJv dXRlciBjcmVkZW50aWFscyBpbiB0aGUgcnBraS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjVwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjayI+aGVuY2UgaSBhbSBzdXNwaWNp b3VzIG9mIHRoZSBwcm90b2NvbCBzcGVjLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_C7A005B575504B748C80C32C60093CD9ciscocom_-- From nobody Tue Dec 6 16:40:30 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9181129610 for ; Tue, 6 Dec 2016 16:40:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hp9OEKXaHGoh for ; Tue, 6 Dec 2016 16:40:27 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E9EA129553 for ; Tue, 6 Dec 2016 16:40:27 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cEQHY-0006uH-NL; Wed, 07 Dec 2016 00:40:25 +0000 Date: Tue, 06 Dec 2016 16:40:23 -0800 Message-ID: From: Randy Bush To: Alvaro Retana In-Reply-To: References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-2022-JP Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 00:40:29 -0000 alvaro, > In thinking about this point some more$B!D(Bwhat about > draft-ietf-sidr-slurm? Isn$B!G(Bt that supposed to address the private > space? > > M4. Still in Section 7: $B!H(BTo prevent exposure of the internals of BGP > Confederations [RFC5065], a BGPsec speaker which is a Member-AS of a > Confederation MUST NOT sign updates sent to another Member-AS of the > same Confederation.$B!I(B This is another case where the BGPSec spec says > something different: Section 4.3. (Processing Instructions for > Confederation Members) presents a mandatory mechanism that includes > signing, but not necessarily validating. BTW, if the updates are not > signed, then the signed path would be broken, even if all the routers > in the path support BGPSec, right? Is that the recommendation? > > it is common for a bgp confederation to include private ASs for which > there can be no unique authorative router credentials in the rpki. > hence i am suspicious of the protocol spec. if a private-as router in confederation C signs from that as, others in the confed C may (or may not) have the slurmy data. but assuredly, when that route finally makes its way out to the global internet, there will be a signature in the path which no one can validate. randy From nobody Tue Dec 6 21:41:55 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 784061294C5 for ; Tue, 6 Dec 2016 21:41:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wwac2e21V2hr for ; Tue, 6 Dec 2016 21:41:51 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 81766129675 for ; Tue, 6 Dec 2016 21:41:51 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cEUzE-0000mj-ES; Wed, 07 Dec 2016 05:41:48 +0000 Date: Tue, 06 Dec 2016 21:41:47 -0800 Message-ID: From: Randy Bush To: "Alvaro Retana (aretana)" In-Reply-To: References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-2022-JP Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 05:41:53 -0000 > M4. Still in Section 7: $B!H(BTo prevent exposure of the internals of BGP > Confederations [RFC5065], a BGPsec speaker which is a Member-AS of a > Confederation MUST NOT sign updates sent to another Member-AS of the > same Confederation.$B!I(B This is another case where the BGPSec spec says > something different: Section 4.3. (Processing Instructions for > Confederation Members) presents a mandatory mechanism that includes > signing, but not necessarily validating. BTW, if the updates are not > signed, then the signed path would be broken, even if all the routers > in the path support BGPSec, right? Is that the recommendation? > > it is common for a bgp confederation to include private ASs for which > there can be no unique authorative router credentials in the rpki. > hence i am suspicious of the protocol spec. i recant. the protocol spec 4.3 says the intra-confed path elements are stripped before exporting outside the confed. To prevent exposure of the internals of BGP Confederations [RFC5065], a BGPsec speaker exporting to a non-member removes all intra- confederation Secure_Path segments. Therefore signing within the confederation will not cause external confusion even if non-unique private ASs are used. randy From nobody Tue Dec 6 21:44:47 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4ADFB1294C5; Tue, 6 Dec 2016 21:44:43 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148108948329.1742.8267776174436284988.idtracker@ietfa.amsl.com> Date: Tue, 06 Dec 2016 21:44:43 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-ops-12.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 05:44:43 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing of the IETF. Title : BGPsec Operational Considerations Author : Randy Bush Filename : draft-ietf-sidr-bgpsec-ops-12.txt Pages : 9 Date : 2016-12-06 Abstract: Deployment of the BGPsec architecture and protocols has many operational considerations. This document attempts to collect and present the most critical and universal. It is expected to evolve as BGPsec is formalized and initially deployed. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-ops/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-ops-12 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-bgpsec-ops-12 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Dec 7 07:27:30 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D744129505; Wed, 7 Dec 2016 07:27:28 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <148112444860.13678.830966785604568036.idtracker@ietfa.amsl.com> Date: Wed, 07 Dec 2016 07:27:28 -0800 Archived-At: Cc: Chris Morrow , sidr-chairs@ietf.org, draft-ietf-sidr-bgpsec-ops@ietf.org, sidr@ietf.org Subject: [sidr] Last Call: (BGPsec Operational Considerations) to Best Current Practice X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Reply-To: ietf@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 15:27:28 -0000 The IESG has received a request from the Secure Inter-Domain Routing WG (sidr) to consider the following document: - 'BGPsec Operational Considerations' as Best Current Practice The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2016-12-21. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract Deployment of the BGPsec architecture and protocols has many operational considerations. This document attempts to collect and present the most critical and universal. It is expected to evolve as BGPsec is formalized and initially deployed. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-ops/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-ops/ballot/ No IPR declarations have been submitted directly on this I-D. The document contains these normative downward references. See RFC 3967 for additional information: rfc6811: BGP Prefix Origin Validation (Proposed Standard - IETF stream) draft-ietf-sidr-bgpsec-protocol: BGPsec Protocol Specification (None - IETF stream) rfc6493: The Resource Public Key Infrastructure (RPKI) Ghostbusters Record (Proposed Standard - IETF stream) Note that some of these references may already be listed in the acceptable Downref Registry. From nobody Wed Dec 7 13:07:43 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 645521296EC for ; Wed, 7 Dec 2016 13:07:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pVgANBtHdTOJ for ; Wed, 7 Dec 2016 13:07:41 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BAB47129BA6 for ; Wed, 7 Dec 2016 13:07:39 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cEjRB-0004mj-IH; Wed, 07 Dec 2016 21:07:37 +0000 Date: Wed, 07 Dec 2016 13:07:35 -0800 Message-ID: From: Randy Bush To: Alvaro Retana In-Reply-To: References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 21:07:42 -0000 otoh, private AS numbers are used in non-confed topologies, e.g. the bgp stub customer who uses a private AS. they should not sign of course. but once i receive their announcement and strip the private AS, can/should i sign? i just looked at bgpsec-protocol and found no guidance. randy From nobody Wed Dec 7 13:48:26 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E49CC129C08; Wed, 7 Dec 2016 13:48:24 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148114730493.13638.10456251117647900306.idtracker@ietfa.amsl.com> Date: Wed, 07 Dec 2016 13:48:24 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-as-migration-06.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 21:48:25 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing of the IETF. Title : BGPSec Considerations for AS Migration Authors : Wesley George Sandy Murphy Filename : draft-ietf-sidr-as-migration-06.txt Pages : 16 Date : 2016-12-07 Abstract: This document discusses considerations and methods for supporting and securing a common method for AS-Migration within the BGPSec protocol. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-as-migration/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-as-migration-06 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-as-migration-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Dec 9 13:51:41 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79D1C12955B for ; Fri, 9 Dec 2016 13:51:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aoqVPk88VNqv for ; Fri, 9 Dec 2016 13:51:38 -0800 (PST) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B619D1294AB for ; Fri, 9 Dec 2016 13:51:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6660; q=dns/txt; s=iport; t=1481320298; x=1482529898; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=omfjjHDm2MFoNSY87ZZ8XmTvdfuOxkmd50uerp7eb14=; b=LSW5LJhlaSc65Ml8mWK24Ymai80Vxg6s1Xy23TvhbjStJDmcTrd4AFQB Z3nPV84R5ByVnP2vD0SV30Ywc9x+2XgxR142MYVPcu4hUDCaHHIX8ouZU BpVVh7B9hj0RC0YKiel36GWhGGtfRJGtyXEXPM8R1mbcdvkoCDqQ99v1/ o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BsAQBqJktY/51dJa1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgnNEAQEBAQEfWoEGB41CpnOFIoIKhiECGoFMPxQBAgEBAQEBAQFiKIR?= =?us-ascii?q?pBiNWEAIBCD8DAgICMBQRAgQOBYhrqxKCKS+KbwEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAR2GPoF9gl6HTC2CMAWVAIVrAZEgkEWSGAEfN4EhMgEBhSVyhhoFgSuBDQE?= =?us-ascii?q?BAQ?= X-IronPort-AV: E=Sophos;i="5.33,325,1477958400"; d="scan'208,217";a="357063184" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Dec 2016 21:51:37 +0000 Received: from XCH-ALN-004.cisco.com (xch-aln-004.cisco.com [173.36.7.14]) by rcdn-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id uB9LpbQq021353 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 9 Dec 2016 21:51:37 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-004.cisco.com (173.36.7.14) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 9 Dec 2016 15:51:37 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Fri, 9 Dec 2016 15:51:37 -0600 From: "Alvaro Retana (aretana)" To: Randy Bush Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-ops-10 Thread-Index: AQHSNR62bJsPySrh80ivtkDVsKGkYKD8P1SAgAFW4YCAAw9tgA== Date: Fri, 9 Dec 2016 21:51:37 +0000 Message-ID: <626EE1F7-878E-453A-A33B-DAAC21907261@cisco.com> References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.86.249.235] Content-Type: multipart/alternative; boundary="_000_626EE1F7878E453AA33BDAAC21907261ciscocom_" MIME-Version: 1.0 Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Dec 2016 21:51:40 -0000 --_000_626EE1F7878E453AA33BDAAC21907261ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkhDQoNClllcywgdGhlcmUgc2hvdWxkIGJlIHNvbWV0aGluZyBhYm91dCBwcml2YXRlIEFTTnMg aW4gdGhlIHByb3RvY29sIHNwZWMuDQoNCkl0IHdvdWxkIGJlIG5pY2UgdG8gYWxzbyBzZWUgc29t ZSBvcGVyYXRpb25hbCBndWlkYW5jZSBpbiB0aGlzIGRvY3VtZW50Lg0KDQpBbHZhcm8uDQoNCk9u IDEyLzcvMTYsIDc6MDcgUE0sICJSYW5keSBCdXNoIiA8cmFuZHlAcHNnLmNvbTxtYWlsdG86cmFu ZHlAcHNnLmNvbT4+IHdyb3RlOg0KDQpvdG9oLCBwcml2YXRlIEFTIG51bWJlcnMgYXJlIHVzZWQg aW4gbm9uLWNvbmZlZCB0b3BvbG9naWVzLCBlLmcuIHRoZSBiZ3ANCnN0dWIgY3VzdG9tZXIgd2hv IHVzZXMgYSBwcml2YXRlIEFTLiAgdGhleSBzaG91bGQgbm90IHNpZ24gb2YgY291cnNlLg0KYnV0 IG9uY2UgaSByZWNlaXZlIHRoZWlyIGFubm91bmNlbWVudCBhbmQgc3RyaXAgdGhlIHByaXZhdGUg QVMsDQpjYW4vc2hvdWxkIGkgc2lnbj8gIGkganVzdCBsb29rZWQgYXQgYmdwc2VjLXByb3RvY29s IGFuZCBmb3VuZCBubw0KZ3VpZGFuY2UuDQoNCg== --_000_626EE1F7878E453AA33BDAAC21907261ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <84D6AD494A5ABC42A8B0FB6775A13CF5@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBE ZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0K CXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnNwYW4uYXBwbGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTph cHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDsN Cglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7fQ0Kc3Bhbi5tc29JbnMN Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJ e21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2Ug V29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAx LjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0t Pjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPkhpITxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlllcywgdGhlcmUgc2hv dWxkIGJlIHNvbWV0aGluZyBhYm91dCBwcml2YXRlIEFTTnMgaW4gdGhlIHByb3RvY29sIHNwZWMu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SXQgd291bGQgYmUgbmljZSB0byBhbHNvIHNlZSBz b21lIG9wZXJhdGlvbmFsIGd1aWRhbmNlIGluIHRoaXMgZG9jdW1lbnQuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6Q2FsaWJyaSI+QWx2YXJvLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQjVDNERGIDQuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4g NC4wcHQ7bWFyZ2luLWxlZnQ6My43NXB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2siPk9uIDEyLzcvMTYsIDc6MDcgUE0s ICZxdW90O1JhbmR5IEJ1c2gmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpyYW5keUBwc2cuY29t Ij5yYW5keUBwc2cuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2si Pm90b2gsIHByaXZhdGUgQVMgbnVtYmVycyBhcmUgdXNlZCBpbiBub24tY29uZmVkIHRvcG9sb2dp ZXMsIGUuZy4gdGhlIGJncDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuNXB0O2ZvbnQtZmFt aWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj5zdHViIGN1c3RvbWVyIHdobyB1c2VzIGEgcHJpdmF0 ZSBBUy4mbmJzcDsmbmJzcDt0aGV5IHNob3VsZCBub3Qgc2lnbiBvZiBjb3Vyc2UuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2si PmJ1dCBvbmNlIGkgcmVjZWl2ZSB0aGVpciBhbm5vdW5jZW1lbnQgYW5kIHN0cmlwIHRoZSBwcml2 YXRlIEFTLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuNXB0O2ZvbnQtZmFtaWx5OkNvbnNv bGFzO2NvbG9yOmJsYWNrIj5jYW4vc2hvdWxkIGkgc2lnbj8mbmJzcDsmbmJzcDtpIGp1c3QgbG9v a2VkIGF0IGJncHNlYy1wcm90b2NvbCBhbmQgZm91bmQgbm88bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjVwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjayI+Z3VpZGFuY2UuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_626EE1F7878E453AA33BDAAC21907261ciscocom_-- From nobody Fri Dec 9 13:57:17 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DA391296A8 for ; Fri, 9 Dec 2016 13:57:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MIzeeKN-HEgc for ; Fri, 9 Dec 2016 13:57:14 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4268129593 for ; Fri, 9 Dec 2016 13:57:14 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cFTAF-0001uL-Vf; Fri, 09 Dec 2016 21:57:12 +0000 Date: Fri, 09 Dec 2016 13:57:11 -0800 Message-ID: From: Randy Bush To: "Alvaro Retana (aretana)" In-Reply-To: <626EE1F7-878E-453A-A33B-DAAC21907261@cisco.com> References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> <626EE1F7-878E-453A-A33B-DAAC21907261@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Dec 2016 21:57:16 -0000 > Yes, there should be something about private ASNs in the protocol spec. > > It would be nice to also see some operational guidance in this document. > > Alvaro. > > otoh, private AS numbers are used in non-confed topologies, e.g. the bgp > stub customer who uses a private AS. they should not sign of course. > but once i receive their announcement and strip the private AS, > can/should i sign? i just looked at bgpsec-protocol and found no > guidance. first the protocol spec needs to make clear if the real AS can proxy sign for a connected private AS. then i can hack the ops doc. seems to me that, as the real AS is required to strip the private AS from the path, the real AS should be able to proxy sign. but then who has the cert to create the roa, etc.? randy From nobody Fri Dec 9 14:00:36 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47A9D1296AE; Fri, 9 Dec 2016 14:00:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GyV8xw2qzjGL; Fri, 9 Dec 2016 14:00:31 -0800 (PST) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA8CA129584; Fri, 9 Dec 2016 14:00:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=25636; q=dns/txt; s=iport; t=1481320830; x=1482530430; h=from:to:cc:subject:date:message-id:mime-version; bh=k1VwhNONkcFlekGLpXdzvqzGflOQyHLr7eVJbedv8r4=; b=TjTSkoIxzPd1gpDeVaYCltwykAcIqeS9Wmx8uf+f/E3H0D6dP6nGFnn8 I0Bo9bCZ7SzgjZUZKrJCbqzg4OfAo3jWdZIQi0ZPfY7JGhS11hmBbPjC+ gz74IuRK0CVxiIjRCsiiWUGiYQPl7zxPDfutC3yZzBP2GDCccO0YCUMEG c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BrAQC8KEtY/4MNJK1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgnNEAQEBAQEfWoEGB41CrBWCCoYhHIFMPxQBAgEBAQEBAQFiKIRvIwQ?= =?us-ascii?q?GTBIBRwMCBDAUEwQBDQUbiFCrCoFsPS+KbwEBAQEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?R2GPoF9hngRAYMgLYIwBYY7jkWFawGMcoQugXOEf4lTh2aKMgEfN2I/JA4BAYN?= =?us-ascii?q?ggUVyhimBIYENAQEB?= X-IronPort-AV: E=Sophos;i="5.33,325,1477958400"; d="scan'208,217";a="357065898" Received: from alln-core-1.cisco.com ([173.36.13.131]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 09 Dec 2016 22:00:29 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by alln-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id uB9M0THF007759 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 9 Dec 2016 22:00:29 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 9 Dec 2016 16:00:28 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Fri, 9 Dec 2016 16:00:28 -0600 From: "Alvaro Retana (aretana)" To: "Sriram, Kotikalapudi (Fed)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" Thread-Topic: Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) Thread-Index: AQHSUmenE2EHhTbiU0q7IXrD4ZYx2Q== Date: Fri, 9 Dec 2016 22:00:28 +0000 Message-ID: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.86.249.235] Content-Type: multipart/alternative; boundary="_000_7055D2095BF74B5DA675356CD2CBFF4Dciscocom_" MIME-Version: 1.0 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Dec 2016 22:00:34 -0000 --_000_7055D2095BF74B5DA675356CD2CBFF4Dciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 W0NoYW5nZWQgdGhlIFN1YmplY3QgdG8gc3BlY2lmaWNhbGx5IGRpc2N1c3MgQ29uZmVkZXJhdGlv biBzdXBwb3J0LCBhbmQgaG9wZWZ1bGx5IGdldCBzb21lIGF0dGVudGlvbiBmcm9tIHRoZSBXRy5d DQoNClNyaXJhbToNCg0KSGkhICBJIHRoaW5rIHRoZSBvbmx5IGl0ZW0gbGVmdCBpcyB0aGUgQ29u ZmVkZXJhdGlvbnMgb25l4oCmYW5kIHdlIG1pZ2h0IGJlIHNwZWFraW5nIHBhc3QgZWFjaCBvdGhl ci4NCg0KDQpZZXMsIEkgYWdyZWUgdGhhdCB0aGUgY29sbHVzaW9uIHByb2JsZW0gaXMgb25lIHRo YXQgKGFzIHlvdSBtZW50aW9uZWQgYmVsb3cpIGlzIG91dCBvZiB0aGUgc2NvcGUgb2YgQkdQc2Vj LiAgWW91IGFyZSByaWdodCB0aGF0IHBDb3VudD0wIChhcyBwcm9wb3NlZCBiZWxvdykgZG9lc27i gJl0IHNvbHZlIHRoZSBjb2xsdXNpb24gcHJvYmxlbSDigJMgYnV0IGl0IGRvZXMgYWRkcmVzcyB0 aGUgZm9sbG93aW5nIHNlY3VyaXR5IGd1YXJhbnRlZSB0aGF0IGlzIGN1cnJlbnRseSBub3QgbWV0 IGluIHRoZSBDb25mZWRlcmF0aW9ucyBjYXNlIChmcm9tIDguMSk6DQoNCiAgIG8gIEZvciBlYWNo IEFTIGluIHRoZSBwYXRoLCBhIEJHUHNlYyBzcGVha2VyIGF1dGhvcml6ZWQgYnkgdGhlIGhvbGRl cg0KICAgICAgb2YgdGhlIEFTIG51bWJlciBpbnRlbnRpb25hbGx5IGNob3NlIChpbiBhY2NvcmRh bmNlIHdpdGggbG9jYWwNCiAgICAgIHBvbGljeSkgdG8gcHJvcGFnYXRlIHRoZSByb3V0ZSBhZHZl cnRpc2VtZW50IHRvIHRoZSBzdWJzZXF1ZW50IEFTDQogICAgICBpbiB0aGUgcGF0aC4NCg0KSW4g dGhlIGNhc2Ugb2YgQ29uZmVkZXJhdGlvbnMsIGl0IGNhbm5vdCBiZSAoY3VycmVudGx5KSB2ZXJp ZmllZCB0aGF0IGFsbCB0aGUgQVNOcyBpbiB0aGUgcGF0aCBpbnRlbnRpb25hbGx5IGNob3NlIHRv IHNlbmQgdGhlIHVwZGF0ZSB0byB0aGUgbmV4dCBBU04gYmVjYXVzZSB0aGVyZSBpcyBhIGRpc2Nv bnRpbnVpdHkgYXQgdGhlIGJvcmRlci4gIEZvciBhIHRvcG9sb2d5IGxpa2UgdGhpczogQVMxIC0+ IEFTMi9BUzY1MDAxIC0+IEFTNjUwMDIvQVMyIC0+IEFTMyAoQVMyIGlzIHRoZSBDb25mZWRlcmF0 aW9uIElEIGFuZCBBUzY1MDAxIGFuZCBBUzY1MDAyIGFyZSBNZW1iZXJzKSwgaXQgY2FuIGJlIHZl cmlmaWVkIHRoYXQgQVMxIGludGVudGlvbmFsbHkgc2VudCB0aGUgVXBkYXRlIHRvIEFTMiwgYnV0 IHRoZXJlIGlzIG5vIGV4cGxpY2l0IGluZGljYXRpb24gKGV2ZW4gaWYgc3ltYm9saWM6IHBDb3Vu dD0wKSBvZiB0aGUgaW50ZW50aW9uIGZvciBBUzY1MDAxIHRvIOKAnHJlY2VpdmXigJ0gdGhlIHVw ZGF0ZSwgYW5kIHRoZW4gYmUgYWJsZSB0byBzZW5kIGl0IHRvIEFTNjUwMDIuDQoNCkkgc3RpbGwg dGhpbmsgdGhhdCB0aGlzIGNvbnRpbnVpdHkgaXNzdWUgc2hvdWxkIGJlIGFkZHJlc3NlZDsgaXQg bm90aGluZyBtb3JlIGp1c3QgYmVjYXVzZSB0aGUgaW50ZW50aW9uYWxpdHkgaXMgbWVudGlvbmVk IGFzIGEgc2VjdXJpdHkgZ3VhcmFudGVlIG9mIEJHUHNlYy4NCg0KQ2hhaXJzOiBQbGVhc2UgcG9s bCB0aGUgV0cgb3IgbWFrZSBhIGRlY2lzaW9uIG9mIHdoZXRoZXIgdGhlcmUgaXMgY29uc2Vuc3Vz IChvciBub3QpIHRvIG5vdCBzb2x2ZSB0aGlzIGNvbnRpbnVpdHkgaXNzdWUgKG1heWJlIGZyb20g cHJpb3IgZGlzY3Vzc2lvbnMgb24gdGhlIGxpc3QpLiAgSWYgdGhlIFdHIGRlY2lkZXMgbm90IHRv IHNvbHZlIHRoaXMgaXNzdWUgKG9yIGlmIGl0IHdhcyBhbHJlYWR5IGRpc2N1c3NlZCksIEnigJlt IG9rIHdpdGggYmVpbmcgaW4gdGhlIHJvdWdoLg0KDQoNClJlbGF0ZWQgdG8gdGhlIGFib3ZlLCBp cyB0aGUgc3VwcG9ydCBmb3IgcHJpdmF0ZSBBU05zIC0tLSB0aGlzIHRvcGljIGFsc28gY2FtZSB1 cCBpbiB0aGUgcmV2aWV3IG9mIGRyYWZ0LWlldGYtc2lkci1iZ3BzZWMtb3BzLCBhbmQgdGhlIEdl bkFydC9TZWNEaXIgcmV2aWV3cy4gIFRoZXJlIGFyZSB0d28gcmVsYXRlZCBwb2ludHM6DQoNCg0K MS4gICAgICAgSXQgaXMgY29tbW9uIHRvIHVzZSBwcml2YXRlIEFTTnMgaW4gQ29uZmVkZXJhdGlv bnMsIGJ1dCB0aGUgZ2xvYmFsIFJQS0kgY2Fu4oCZdCBzdXBwb3J0IHRoYXQuICBkcmFmdC1pZXRm LXNpZHItc2x1cm0gc2VlbXMgdG8gYWRkcmVzcyB0aGUgaXNzdWUgb2YgbG9jYWwgbWFuYWdlbWVu dCBvZiBwcml2YXRlIHJlc291cmNlcyBpbiB0aGUgUlBLSS4gIEdpdmVuIHRoYXQgdGhlIHNpZ25p bmcgb2YgVXBkYXRlcyBpcyBtYW5kYXRlZCwgSSB0aGluayB0aGF0IHN1cHBvcnQgb2YgZHJhZnQt aWV0Zi1zaWRyLXNsdXJtIGlzIG5lY2Vzc2FyeTsgSU9XLCBJIHRoaW5rIHRoYXQgZHJhZnQtaWV0 Zi1zaWRyLXNsdXJtIHNob3VsZCBiZSBhIE5vcm1hdGl2ZSByZWZlcmVuY2UuDQoNCjIuICAgICAg IFByaXZhdGUgQVNOcyAoYXMgcG9pbnRlZCBvdXQgaW4gdGhlIFNlY0RpciByZXZpZXcpIGFyZSBj b21tb25seSB1c2VkIGZvciBzdHVicy4gIFRoaXMgZG9jdW1lbnQgc2hvdWxkIGluY2x1ZGUgc29t ZXRoaW5nIChJ4oCZbSB0aGlua2luZyBpbiB0aGUgT3BzIFNlY3Rpb24pIGFib3V0IHRoZSBwcm90 b2NvbCBjb25zaWRlcmF0aW9uczogdGhlcmUgbXVzdCBiZSBhIFJPQSBmcm9tIHRoZSByZXNvdXJj ZSBvd25lciBmb3IgdGhlIElTUCB0byBwcm9wZXJseSByZS1vcmlnaW5hdGUgdGhlIFVwZGF0ZSwg ZXRjLi4NCg0KDQpUaGFua3MhDQoNCkFsdmFyby4NCg0KDQpPbiAxMi81LzE2LCAxOjM1IFBNLCAi U3JpcmFtLCBLb3Rpa2FsYXB1ZGkgKEZlZCkiIDxrb3Rpa2FsYXB1ZGkuc3JpcmFtQG5pc3QuZ292 PG1haWx0bzprb3Rpa2FsYXB1ZGkuc3JpcmFtQG5pc3QuZ292Pj4gd3JvdGU6DQoNCg0KUGVyc29u YWxseSwgSSB3b3VsZCBoYXZlIHByZWZlcnJlZCBpZiB5b3UgYWN0dWFsbHkgc29sdmVkIHRoZSBw cm9ibGVtLiBPbmUgc29sdXRpb24gaXMgdG8gYm9ycm93IGZyb20gZHJhZnQtaWV0Zi1zaWRyLWFz LW1pZ3JhdGlvbiBhbmQgZm9yd2FyZCBzaWduIGZyb20gdGhlIENvbmZlZGVyYXRpb24gQVMgKHRo ZSBwdWJsaWMgbnVtYmVyKSB0byB0aGUgTWVtYmVyLUFTIHdpdGggcENvdW50PTAuICBOb3RlIHRo YXQgdGhpcyBvcGVyYXRpb24gd291bGQgdGFrZSBwbGFjZSBpbnNpZGUgdGhlIGJvcmRlciBDb25m ZWRlcmF0aW9uIHJvdXRlciwgc28gdGhlcmUgYXJlIG5vIGlzc3VlcyB3aXRoIHBDb3VudD0wIGFu ZCB0aGUgZnVsbCBwYXRoIGNvbnRpbnVpdHkgaXMgcHJlc2VydmVkLlsqXSBDaGFpcnM6IEkgdGhp bmsgdGhhdCB0aGlzIHBhcnQgKHdoZXRoZXIgaXQgaXMgc29sdmVkIG9yIG5vdCkgc2hvdWxkIGFs c28gYmUgYm91bmNlZCBieSB0aGUgV0cu4oCmDQoNCg0KDQpbU3JpcmFtLTJdIFBsZWFzZSBzZWUg ZGlzY3Vzc2lvbiBhdCB0aGUgdG9wIG9mIHRoaXMgZW1haWwuIEkgYW0gYWZyYWlkLCB0aGUgc29s dXRpb24geW91IHByb3Bvc2Ugd2lsbCBub3Qgd29yay4gVGhlIGZpcnN0IEFTIGluIHRoZSBDb25m ZWRlcmF0aW9uIGNhbiBzdGlsbCB0dW5uZWwgdGhlIHVwZGF0ZSB0byB0aGUgc2Vjb25kIEFTIGl0 IGlzIGNvbGx1ZGluZyB3aXRoLCBhbmQgdGhlIHNlY29uZCBBUyDigJxmb3J3YXJkIHNpZ25zIGZy b20gdGhlIENvbmZlZGVyYXRpb24gQVMgKHRoZSBwdWJsaWMgbnVtYmVyKSB0byB0aGUgTWVtYmVy LUFTIHdpdGggcENvdW50PTDigJ0uIFNvIHRoZSBwcm9ibGVtIHlvdSBvcmlnaW5hbGx5IGlkZW50 aWZpZWQgZG9lc27igJl0IGdvIGF3YXkuDQoNCg== --_000_7055D2095BF74B5DA675356CD2CBFF4Dciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxuczptdj0iaHR0cDovL21hY1ZtbFNj aGVtYVVyaSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1odG1sNDAiPg0KPGhlYWQ+ DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hh cnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJUaXRsZSIgY29udGVudD0iIj4NCjxtZXRhIG5hbWU9 IktleXdvcmRzIiBjb250ZW50PSIiPg0KPG1ldGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJN aWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQgbWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9u dCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpBcmlhbDsNCglwYW5v c2UtMToyIDExIDYgNCAyIDIgMiAyIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJD YW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2 IDkgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBs aS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVk LCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwDQoJe21zby1zdHls ZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglm b250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIjt9DQpzcGFuLmFwcGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBw bGUtc3R5bGUtc3Bhbjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUt bmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0 eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0 ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5vcm1hbDt9DQpzcGFuLkVt YWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFt aWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDsNCglmb250LXdlaWdodDpub3JtYWw7DQoJ Zm9udC1zdHlsZTpub3JtYWw7fQ0Kc3Bhbi5tc29JbnMNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTsN Cgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1v bmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41 aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBs aXN0IGwwDQoJe21zby1saXN0LWlkOjE3OTMxOTMyODsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsN Cgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE1MDc0MjA1MjIgNjc2OTg3MDMgNjc2OTg3MTMgNjc2 OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3 MTU7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3Qg bDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGww OmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1s b3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBs MDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0 ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6MTA1MzE5NTQ5NjsN Cgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTQ3NTc0NTIy MiA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2 NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZl bDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWlu ZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2Vy Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30N CkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxl dmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpvbA0KCXttYXJnaW4t Ym90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNyIvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8 bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0i MSIvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkg Ymdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4N CjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5bQ2hhbmdlZCB0aGUg U3ViamVjdCB0byBzcGVjaWZpY2FsbHkgZGlzY3VzcyBDb25mZWRlcmF0aW9uIHN1cHBvcnQsIGFu ZCBob3BlZnVsbHkgZ2V0IHNvbWUgYXR0ZW50aW9uIGZyb20gdGhlIFdHLl08bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpIj5TcmlyYW06PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SGkhJm5ic3A7 IEkgdGhpbmsgdGhlIG9ubHkgaXRlbSBsZWZ0IGlzIHRoZSBDb25mZWRlcmF0aW9ucyBvbmXigKZh bmQgd2UgbWlnaHQgYmUgc3BlYWtpbmcgcGFzdCBlYWNoIG90aGVyLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlll cywgSSBhZ3JlZSB0aGF0IHRoZSBjb2xsdXNpb24gcHJvYmxlbSBpcyBvbmUgdGhhdCAoYXMgeW91 IG1lbnRpb25lZCBiZWxvdykgaXMgb3V0IG9mIHRoZSBzY29wZSBvZiBCR1BzZWMuJm5ic3A7IFlv dSBhcmUgcmlnaHQgdGhhdCBwQ291bnQ9MCAoYXMgcHJvcG9zZWQgYmVsb3cpIGRvZXNu4oCZdCBz b2x2ZSB0aGUgY29sbHVzaW9uDQogcHJvYmxlbSDigJMgYnV0IGl0IGRvZXMgYWRkcmVzcyB0aGUg Zm9sbG93aW5nIHNlY3VyaXR5IGd1YXJhbnRlZSB0aGF0IGlzIGN1cnJlbnRseSBub3QgbWV0IGlu IHRoZSBDb25mZWRlcmF0aW9ucyBjYXNlIChmcm9tIDguMSk6PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+Jm5ic3A7Jm5ic3A7IG8mbmJzcDsgRm9yIGVhY2ggQVMgaW4gdGhlIHBhdGgsIGEgQkdQ c2VjIHNwZWFrZXIgYXV0aG9yaXplZCBieSB0aGUgaG9sZGVyPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IG9mIHRoZSBB UyBudW1iZXIgaW50ZW50aW9uYWxseSBjaG9zZSAoaW4gYWNjb3JkYW5jZSB3aXRoIGxvY2FsPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IHBvbGljeSkgdG8gcHJvcGFnYXRlIHRoZSByb3V0ZSBhZHZlcnRpc2VtZW50IHRv IHRoZSBzdWJzZXF1ZW50IEFTPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGluIHRoZSBwYXRoLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPkluIHRoZSBjYXNlIG9mIENvbmZlZGVyYXRpb25zLCBpdCBjYW5ub3QgYmUg KGN1cnJlbnRseSkgdmVyaWZpZWQgdGhhdCBhbGwgdGhlIEFTTnMgaW4gdGhlIHBhdGggaW50ZW50 aW9uYWxseSBjaG9zZSB0byBzZW5kIHRoZSB1cGRhdGUgdG8gdGhlIG5leHQgQVNOIGJlY2F1c2Ug dGhlcmUgaXMgYSBkaXNjb250aW51aXR5IGF0DQogdGhlIGJvcmRlci4mbmJzcDsgRm9yIGEgdG9w b2xvZ3kgbGlrZSB0aGlzOiBBUzEgLSZndDsgQVMyL0FTNjUwMDEgLSZndDsgQVM2NTAwMi9BUzIg LSZndDsgQVMzIChBUzIgaXMgdGhlIENvbmZlZGVyYXRpb24gSUQgYW5kIEFTNjUwMDEgYW5kIEFT NjUwMDIgYXJlIE1lbWJlcnMpLCBpdCBjYW4gYmUgdmVyaWZpZWQgdGhhdCBBUzEgaW50ZW50aW9u YWxseSBzZW50IHRoZSBVcGRhdGUgdG8gQVMyLCBidXQgdGhlcmUgaXMgbm8gZXhwbGljaXQgaW5k aWNhdGlvbiAoZXZlbiBpZg0KIHN5bWJvbGljOiBwQ291bnQ9MCkgb2YgdGhlIGludGVudGlvbiBm b3IgQVM2NTAwMSB0byDigJxyZWNlaXZl4oCdIHRoZSB1cGRhdGUsIGFuZCB0aGVuIGJlIGFibGUg dG8gc2VuZCBpdCB0byBBUzY1MDAyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkkgc3RpbGwg dGhpbmsgdGhhdCB0aGlzIGNvbnRpbnVpdHkgaXNzdWUgc2hvdWxkIGJlIGFkZHJlc3NlZDsgaXQg bm90aGluZyBtb3JlIGp1c3QgYmVjYXVzZSB0aGUgaW50ZW50aW9uYWxpdHkgaXMgbWVudGlvbmVk IGFzIGEgc2VjdXJpdHkgZ3VhcmFudGVlIG9mIEJHUHNlYy4mbmJzcDsNCjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPkNoYWlyczogUGxlYXNlIHBvbGwgdGhlIFdHIG9yIG1ha2UgYSBkZWNpc2lv biBvZiB3aGV0aGVyIHRoZXJlIGlzIGNvbnNlbnN1cyAob3Igbm90KSB0byBub3Qgc29sdmUgdGhp cyBjb250aW51aXR5IGlzc3VlIChtYXliZSBmcm9tIHByaW9yIGRpc2N1c3Npb25zIG9uIHRoZSBs aXN0KS4mbmJzcDsgSWYgdGhlIFdHIGRlY2lkZXMgbm90DQogdG8gc29sdmUgdGhpcyBpc3N1ZSAo b3IgaWYgaXQgd2FzIGFscmVhZHkgZGlzY3Vzc2VkKSwgSeKAmW0gb2sgd2l0aCBiZWluZyBpbiB0 aGUgcm91Z2guJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5SZWxhdGVkIHRvIHRoZSBhYm92ZSwgaXMg dGhlIHN1cHBvcnQgZm9yIHByaXZhdGUgQVNOcyAtLS0gdGhpcyB0b3BpYyBhbHNvIGNhbWUgdXAg aW4gdGhlIHJldmlldyBvZiBkcmFmdC1pZXRmLXNpZHItYmdwc2VjLW9wcywgYW5kIHRoZSBHZW5B cnQvU2VjRGlyIHJldmlld3MuJm5ic3A7IFRoZXJlIGFyZSB0d28gcmVsYXRlZCBwb2ludHM6PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDot LjI1aW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzIiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxzcGFuIHN0eWxl PSJtc28tbGlzdDpJZ25vcmUiPjEuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMg TmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj5JdCBpcyBjb21tb24gdG8gdXNlIHByaXZhdGUgQVNOcyBp biBDb25mZWRlcmF0aW9ucywgYnV0IHRoZSBnbG9iYWwgUlBLSSBjYW7igJl0IHN1cHBvcnQgdGhh dC4gJm5ic3A7ZHJhZnQtaWV0Zi1zaWRyLXNsdXJtIHNlZW1zIHRvIGFkZHJlc3MgdGhlIGlzc3Vl IG9mIGxvY2FsIG1hbmFnZW1lbnQgb2YgcHJpdmF0ZSByZXNvdXJjZXMNCiBpbiB0aGUgUlBLSS4m bmJzcDsgR2l2ZW4gdGhhdCB0aGUgc2lnbmluZyBvZiBVcGRhdGVzIGlzIG1hbmRhdGVkLCBJIHRo aW5rIHRoYXQgc3VwcG9ydCBvZiBkcmFmdC1pZXRmLXNpZHItc2x1cm0gaXMgbmVjZXNzYXJ5OyBJ T1csIEkgdGhpbmsgdGhhdCBkcmFmdC1pZXRmLXNpZHItc2x1cm0gc2hvdWxkIGJlIGEgTm9ybWF0 aXZlIHJlZmVyZW5jZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMSBsZXZlbDEgbGZv MiI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+Mi48c3BhbiBz dHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZd PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlByaXZh dGUgQVNOcyAoYXMgcG9pbnRlZCBvdXQgaW4gdGhlIFNlY0RpciByZXZpZXcpIGFyZSBjb21tb25s eSB1c2VkIGZvciBzdHVicy4mbmJzcDsgVGhpcyBkb2N1bWVudCBzaG91bGQgaW5jbHVkZSBzb21l dGhpbmcgKEnigJltIHRoaW5raW5nIGluIHRoZSBPcHMgU2VjdGlvbikgYWJvdXQgdGhlIHByb3Rv Y29sIGNvbnNpZGVyYXRpb25zOg0KIHRoZXJlIG11c3QgYmUgYSBST0EgZnJvbSB0aGUgcmVzb3Vy Y2Ugb3duZXIgZm9yIHRoZSBJU1AgdG8gcHJvcGVybHkgcmUtb3JpZ2luYXRlIHRoZSBVcGRhdGUs IGV0Yy4uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VGhhbmtzITxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkFs dmFyby48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0I1 QzRERiA0LjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0O21hcmdpbi1sZWZ0OjMuNzVwdDtt YXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjayI+T24gMTIvNS8x NiwgMTozNSBQTSwgJnF1b3Q7U3JpcmFtLCBLb3Rpa2FsYXB1ZGkgKEZlZCkmcXVvdDsgJmx0Ozwv c3Bhbj48YSBocmVmPSJtYWlsdG86a290aWthbGFwdWRpLnNyaXJhbUBuaXN0LmdvdiI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXMiPmtvdGlrYWxhcHVk aS5zcmlyYW1AbmlzdC5nb3Y8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj4mZ3Q7DQogd3JvdGU6PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OjBpbjttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206OC4wcHQ7bWFy Z2luLWxlZnQ6MGluO2ZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7b3JwaGFuczogYXV0bzt0ZXh0 LWFsaWduOnN0YXJ0O3dpZG93czogYXV0bzstd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7 d29yZC1zcGFjaW5nOjBweCI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6 YmxhY2siPlBlcnNvbmFsbHksIEkgd291bGQgaGF2ZSBwcmVmZXJyZWQgaWYgeW91IGFjdHVhbGx5 IHNvbHZlZCB0aGUgcHJvYmxlbS4gT25lIHNvbHV0aW9uIGlzIHRvIGJvcnJvdyBmcm9tIGRyYWZ0 LWlldGYtc2lkci1hcy1taWdyYXRpb24gYW5kIGZvcndhcmQgc2lnbiBmcm9tIHRoZSBDb25mZWRl cmF0aW9uIEFTICh0aGUgcHVibGljIG51bWJlcikgdG8gdGhlIE1lbWJlci1BUyB3aXRoDQogcENv dW50PTAuJm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPk5vdGUgdGhhdCB0aGlzIG9wZXJhdGlvbiB3b3VsZCB0YWtlIHBsYWNlIGluc2lkZSB0aGUg Ym9yZGVyIENvbmZlZGVyYXRpb24gcm91dGVyLCBzbyB0aGVyZSBhcmUgbm8gaXNzdWVzIHdpdGgg cENvdW50PTAgYW5kIHRoZSBmdWxsIHBhdGggY29udGludWl0eSBpcyBwcmVzZXJ2ZWQuWypdIENo YWlyczogSSB0aGluayB0aGF0IHRoaXMgcGFydCAod2hldGhlcg0KIGl0IGlzIHNvbHZlZCBvciBu b3QpIHNob3VsZCBhbHNvIGJlIGJvdW5jZWQgYnkgdGhlIFdHLuKApjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowaW47bWFyZ2luLXJpZ2h0OjBpbjttYXJn aW4tYm90dG9tOjguMHB0O21hcmdpbi1sZWZ0OjBpbjtmb250LXZhcmlhbnQtY2Fwczogbm9ybWFs O29ycGhhbnM6IGF1dG87dGV4dC1hbGlnbjpzdGFydDt3aWRvd3M6IGF1dG87LXdlYmtpdC10ZXh0 LXN0cm9rZS13aWR0aDogMHB4O3dvcmQtc3BhY2luZzowcHgiPg0KPHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGluO21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRv bTo4LjBwdDttYXJnaW4tbGVmdDowaW47Zm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDtvcnBoYW5z OiBhdXRvO3RleHQtYWxpZ246c3RhcnQ7d2lkb3dzOiBhdXRvOy13ZWJraXQtdGV4dC1zdHJva2Ut d2lkdGg6IDBweDt3b3JkLXNwYWNpbmc6MHB4Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpB cmlhbDtjb2xvcjpibGFjayI+W1NyaXJhbS0yXSBQbGVhc2Ugc2VlIGRpc2N1c3Npb24gYXQgdGhl IHRvcCBvZiB0aGlzIGVtYWlsLiBJIGFtIGFmcmFpZCwgdGhlIHNvbHV0aW9uIHlvdSBwcm9wb3Nl IHdpbGwgbm90IHdvcmsuIFRoZSBmaXJzdCBBUyBpbiB0aGUgQ29uZmVkZXJhdGlvbiBjYW4gc3Rp bGwgdHVubmVsIHRoZSB1cGRhdGUgdG8gdGhlIHNlY29uZCBBUyBpdCBpcyBjb2xsdWRpbmcgd2l0 aCwNCiBhbmQgdGhlIHNlY29uZCBBUyDigJxmb3J3YXJkIHNpZ25zIGZyb20gdGhlIENvbmZlZGVy YXRpb24gQVMgKHRoZSBwdWJsaWMgbnVtYmVyKSB0byB0aGUgTWVtYmVyLUFTIHdpdGggcENvdW50 PTDigJ0uIFNvIHRoZSBwcm9ibGVtIHlvdSBvcmlnaW5hbGx5IGlkZW50aWZpZWQgZG9lc27igJl0 IGdvIGF3YXkuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJs YWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i Zm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDtvcnBoYW5zOiBhdXRvO3RleHQtYWxpZ246c3RhcnQ7 d2lkb3dzOiBhdXRvOy13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDt3b3JkLXNwYWNpbmc6 MHB4Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jv ZHk+DQo8L2h0bWw+DQo= --_000_7055D2095BF74B5DA675356CD2CBFF4Dciscocom_-- From nobody Fri Dec 9 14:01:50 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DD61129531 for ; Fri, 9 Dec 2016 14:01:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bzAGu-qHuA-q for ; Fri, 9 Dec 2016 14:01:46 -0800 (PST) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8057212950C for ; Fri, 9 Dec 2016 14:01:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5976; q=dns/txt; s=iport; t=1481320906; x=1482530506; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=mj7Xa4bAdBleeG79GmyF32vUmGmgKjU3PPe+CtO5GRQ=; b=SDTm2ENEDR5lhtbtrEZ6wrCwFXEiTPMtPckrTTMI06U9SJwpCm2nnEU1 jHfhr0REl/qhypb8XoKIAWPXgMzDfTwpuRxLl/VFlGats5pg4Sisr3hJv s9j79H/pt3eJYr4h5klO7b9h09TGG/afNN83cmuuTLRgLaNO6105obmI+ 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BsAQCCKUtY/4oNJK1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgnNEAQEBAQEfWoEGB41CpnOFIoIKhiECGoFMPxQBAgEBAQEBAQFiKIR?= =?us-ascii?q?pBiNWEAIBCD8DAgICMBQRAgQOBYhrqwmCKS+KcAEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAR2GPoF9gl6HTC2CMAWaawGRIJBFkhgBHzeBITIBAYUlcodKgQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.33,325,1477958400"; d="scan'208,217";a="183770390" Received: from alln-core-5.cisco.com ([173.36.13.138]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 09 Dec 2016 22:01:39 +0000 Received: from XCH-ALN-005.cisco.com (xch-aln-005.cisco.com [173.36.7.15]) by alln-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id uB9M1d0k003357 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 9 Dec 2016 22:01:39 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 9 Dec 2016 16:01:38 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Fri, 9 Dec 2016 16:01:38 -0600 From: "Alvaro Retana (aretana)" To: Randy Bush Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-ops-10 Thread-Index: AQHSNR62bJsPySrh80ivtkDVsKGkYKD8P1SAgAFW4YCAAw9tgIAAIxiA///fuIA= Date: Fri, 9 Dec 2016 22:01:38 +0000 Message-ID: <801A1E8B-2E71-4EA8-B6DB-5E7B5CAD9861@cisco.com> References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> <626EE1F7-878E-453A-A33B-DAAC21907261@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.86.249.235] Content-Type: multipart/alternative; boundary="_000_801A1E8B2E714EA8B6DB5E7B5CAD9861ciscocom_" MIME-Version: 1.0 Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Dec 2016 22:01:48 -0000 --_000_801A1E8B2E714EA8B6DB5E7B5CAD9861ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WWVzLCBJIGFncmVlLiAgSSBqdXN0IHNlbnQgYSBtZXNzYWdlIHRvIHRoZSBhdXRob3JzIG9mIHRo ZSBwcm90b2NvbCBzcGVjIChjY+KAmWQgdGhlIFdHKSBhbG9uZyB0aGUgc2FtZSBsaW5lcy4NCg0K T24gMTIvOS8xNiwgNzo1NyBQTSwgIlJhbmR5IEJ1c2giIDxyYW5keUBwc2cuY29tPG1haWx0bzpy YW5keUBwc2cuY29tPj4gd3JvdGU6DQoNCmZpcnN0IHRoZSBwcm90b2NvbCBzcGVjIG5lZWRzIHRv IG1ha2UgY2xlYXIgaWYgdGhlIHJlYWwgQVMgY2FuIHByb3h5DQpzaWduIGZvciBhIGNvbm5lY3Rl ZCBwcml2YXRlIEFTLiAgdGhlbiBpIGNhbiBoYWNrIHRoZSBvcHMgZG9jLg0KDQpzZWVtcyB0byBt ZSB0aGF0LCBhcyB0aGUgcmVhbCBBUyBpcyByZXF1aXJlZCB0byBzdHJpcCB0aGUgcHJpdmF0ZSBB Uw0KZnJvbSB0aGUgcGF0aCwgdGhlIHJlYWwgQVMgc2hvdWxkIGJlIGFibGUgdG8gcHJveHkgc2ln bi4gIGJ1dCB0aGVuDQp3aG8gaGFzIHRoZSBjZXJ0IHRvIGNyZWF0ZSB0aGUgcm9hLCBldGMuPw0K DQo= --_000_801A1E8B2E714EA8B6DB5E7B5CAD9861ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <7A2A3AE12EE9624A9ACD0574545FE6C4@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBE ZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0K CXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnNwYW4uYXBwbGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTph cHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDsN Cglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7fQ0Kc3Bhbi5tc29JbnMN Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJ e21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2Ug V29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAx LjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0t Pjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPlllcywgSSBhZ3JlZS4mbmJzcDsgSSBqdXN0IHNlbnQgYSBtZXNzYWdlIHRv IHRoZSBhdXRob3JzIG9mIHRoZSBwcm90b2NvbCBzcGVjIChjY+KAmWQgdGhlIFdHKSBhbG9uZyB0 aGUgc2FtZSBsaW5lcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0I1QzRERiA0LjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0 O21hcmdpbi1sZWZ0OjMuNzVwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj5PbiAxMi85LzE2LCA3OjU3IFBNLCAmcXVv dDtSYW5keSBCdXNoJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86cmFuZHlAcHNnLmNvbSI+cmFu ZHlAcHNnLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuNXB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj5maXJz dCB0aGUgcHJvdG9jb2wgc3BlYyBuZWVkcyB0byBtYWtlIGNsZWFyIGlmIHRoZSByZWFsIEFTIGNh biBwcm94eTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuNXB0O2ZvbnQtZmFtaWx5OkNvbnNv bGFzO2NvbG9yOmJsYWNrIj5zaWduIGZvciBhIGNvbm5lY3RlZCBwcml2YXRlIEFTLiZuYnNwOyZu YnNwO3RoZW4gaSBjYW4gaGFjayB0aGUgb3BzIGRvYy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjVwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2si PnNlZW1zIHRvIG1lIHRoYXQsIGFzIHRoZSByZWFsIEFTIGlzIHJlcXVpcmVkIHRvIHN0cmlwIHRo ZSBwcml2YXRlIEFTPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6 Q29uc29sYXM7Y29sb3I6YmxhY2siPmZyb20gdGhlIHBhdGgsIHRoZSByZWFsIEFTIHNob3VsZCBi ZSBhYmxlIHRvIHByb3h5IHNpZ24uJm5ic3A7Jm5ic3A7YnV0IHRoZW48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjVwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjayI+d2hvIGhh cyB0aGUgY2VydCB0byBjcmVhdGUgdGhlIHJvYSwgZXRjLj88bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9i bG9ja3F1b3RlPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_801A1E8B2E714EA8B6DB5E7B5CAD9861ciscocom_-- From nobody Sat Dec 10 03:50:59 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9143C129557; Sat, 10 Dec 2016 03:50:58 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "Alexey Melnikov" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148137065859.3698.8955088480248952167.idtracker@ietfa.amsl.com> Date: Sat, 10 Dec 2016 03:50:58 -0800 Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, sidr-chairs@ietf.org, sidr@ietf.org, sandy@tislabs.com Subject: [sidr] Alexey Melnikov's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Dec 2016 11:50:58 -0000 Alexey Melnikov has entered the following ballot position for draft-ietf-sidr-bgpsec-algs-16: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Maybe I missed it, but I don't think the document is clear on why new algorithms are needed. Is this specified in one of referenced documents? From nobody Sat Dec 10 04:41:07 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55BBD1299DC for ; Sat, 10 Dec 2016 04:41:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C1o44KTZb5M1 for ; Sat, 10 Dec 2016 04:40:59 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F14C91299DE for ; Sat, 10 Dec 2016 04:40:56 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id q130so43073669qke.1 for ; Sat, 10 Dec 2016 04:40:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=sN6CiE3BWX/2OQmzZLcdwTFYaSCff/5WwrjjMZWYMtg=; b=XMLZNSlvnZMOFzM6QSDTPRFHMvW28zka1QYEPqX8rvZpPddukxM6VCJDxzITBxPEQ1 I9fdCJ/DwrgEk4mMb0ZZ4p0VW5gKwVZ57iVcqTpkIqoX5MlbGEBDtuyuiEdJgNkvZ/X0 gulVI6C5NB5VjcMAIbfmwXu2XQQuykeFuZ2+I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=sN6CiE3BWX/2OQmzZLcdwTFYaSCff/5WwrjjMZWYMtg=; b=mmxCnFasYOdi+aV3BgUQsF8Gs0z0oZ8Uavxw901olvs+t6sRfSGxnUVnb8O1hf5Ryt 8fbxiIUJgY31++9HcL5on7szYRQROQf014O279kGGfQstqah0c8UvpPxMfMsP2sfYwOG kLHU5ocLqL3zeB6mfN2apwgF+m2SV4JGosz3N3EiFrFWDuqQLVNLUfVvhsT1vgXJw9y1 YK5knZlXoetfn8ZJFzpxpC+R7/2y2tGLKruhMZ3xRtSstPvaWCsVfVIQ9MKZMZ+E8pL1 UXd6Tcl+VV3oeps/G0KuMRhwPWlFaWnjMcTjr6+3diQ5yzK8+XxXzDeOgiWC+90Iq/n3 JKWA== X-Gm-Message-State: AKaTC02yScSmqGZt4ApqmtxVOdSIDDTuwG1dnPzzvuwilHBYUqtWSe1Ve6f0vcFbGk4cXg== X-Received: by 10.55.189.199 with SMTP id n190mr82861241qkf.139.1481373656096; Sat, 10 Dec 2016 04:40:56 -0800 (PST) Received: from [172.16.0.92] (pool-173-73-120-80.washdc.east.verizon.net. [173.73.120.80]) by smtp.gmail.com with ESMTPSA id d78sm22036507qkg.49.2016.12.10.04.40.55 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 10 Dec 2016 04:40:55 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: <148137065859.3698.8955088480248952167.idtracker@ietfa.amsl.com> Date: Sat, 10 Dec 2016 07:40:53 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <0A3548C0-D59D-4232-A6DF-6371395FFFAA@sn3rd.com> References: <148137065859.3698.8955088480248952167.idtracker@ietfa.amsl.com> To: Alexey Melnikov X-Mailer: Apple Mail (2.3124) Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, Sandra Murphy , sidr-chairs@ietf.org, The IESG , sidr@ietf.org Subject: Re: [sidr] Alexey Melnikov's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Dec 2016 12:41:00 -0000 > On Dec 10, 2016, at 06:50, Alexey Melnikov = wrote: >=20 > Alexey Melnikov has entered the following ballot position for > draft-ietf-sidr-bgpsec-algs-16: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut = this > introductory paragraph, however.) >=20 >=20 > Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > Maybe I missed it, but I don't think the document is clear on why new > algorithms are needed. Is this specified in one of referenced = documents? I think you=E2=80=99re asking why different algorithms are needed to = those specified for the rest of the RPKI? If that=E2=80=99s the case, = it=E2=80=99s key/sig size to keep the protocol smaller than if we used = RSA/RSA-PSS and that=E2=80=99s covered in RFC 5480. If you=E2=80=99re = asking about why would somebody want to define different algorithms for = BGPsec then it's discovered weaknesses, vanity :), etc. spt= From nobody Sat Dec 10 05:42:36 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFA7312953E; Sat, 10 Dec 2016 05:42:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.72 X-Spam-Level: X-Spam-Status: No, score=-2.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fastmail.fm header.b=Ktmx6xZU; dkim=pass (1024-bit key) header.d=messagingengine.com header.b=Du4s6tp5 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PIvA16x6Mmjs; Sat, 10 Dec 2016 05:42:26 -0800 (PST) Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03760129411; Sat, 10 Dec 2016 05:40:19 -0800 (PST) Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id EAF162120D; Sat, 10 Dec 2016 08:40:15 -0500 (EST) Received: from frontend1 ([10.202.2.160]) by compute7.internal (MEProxy); Sat, 10 Dec 2016 08:40:15 -0500 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=fastmail.fm; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=mesmtp; bh=YdYSoe39HsuYVae jrwJ0NAciaX0=; b=Ktmx6xZU15EpvVH5xGkUs7GA3+KgMFMiBBd+YLYV9gfhLy5 pSKRe18sN3sX6DRBktvJLQYHAZjvjez719EHVPxQ66TEnb+q2hvVLFImyIhdLRNl KD48YUX4/e0j6QFFqyyrycajmcImQOIoiOYSPKCvDXlo5vXOTgxsJ8a/ByQo= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s= smtpout; bh=YdYSoe39HsuYVaejrwJ0NAciaX0=; b=Du4s6tp5kG3FpuqJfa42 sC1lg99c9kF7QRVWTj07xJQQlIzk7NYJuStq4mfUNAK0dCIJrgPUaIn34L0+DqG+ SN3bAXLdR6gnh3gQ4NpsMmh0lLNaxBEhGiy1n9j12wRGAycE2PrEuUwrKx+LnGVz 06XY7KgKtG9B+n1c5XrSZ24= X-ME-Sender: X-Sasl-enc: T3seFMIqIbCoSUaW1yAnx1ZI3PUIq4TnroC8Dvb5ZhKi 1481377214 Received: from [192.168.1.221] (host86-132-209-146.range86-132.btcentralplus.com [86.132.209.146]) by mail.messagingengine.com (Postfix) with ESMTPA id 8798D7EF1F; Sat, 10 Dec 2016 08:40:14 -0500 (EST) Content-Type: text/plain; charset=windows-1251 Mime-Version: 1.0 (1.0) From: Alexey Melnikov X-Mailer: iPad Mail (14A456) In-Reply-To: <0A3548C0-D59D-4232-A6DF-6371395FFFAA@sn3rd.com> Date: Sat, 10 Dec 2016 13:56:22 +0000 Content-Transfer-Encoding: quoted-printable Message-Id: References: <148137065859.3698.8955088480248952167.idtracker@ietfa.amsl.com> <0A3548C0-D59D-4232-A6DF-6371395FFFAA@sn3rd.com> To: Sean Turner Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, Sandra Murphy , sidr-chairs@ietf.org, The IESG , sidr@ietf.org Subject: Re: [sidr] Alexey Melnikov's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Dec 2016 13:42:28 -0000 > On 10 Dec 2016, at 12:40, Sean Turner wrote: >=20 >> On Dec 10, 2016, at 06:50, Alexey Melnikov wrote= : >>=20 >> Maybe I missed it, but I don't think the document is clear on why new >> algorithms are needed. Is this specified in one of referenced documents? >=20 > I think you=92re asking why different algorithms are needed to those speci= fied for the rest of the RPKI? If that=92s the case, it=92s key/sig size to= keep the protocol smaller than if we used RSA/RSA-PSS and that=92s covered i= n RFC 5480. =20 Thank you, Sean. Maybe the document should have a sentence on this. > If you=92re asking about why would somebody want to define different algor= ithms for BGPsec then it's discovered weaknesses, vanity :), etc. From nobody Sat Dec 10 06:43:01 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 688DF12951E for ; Sat, 10 Dec 2016 06:42:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gguIGzg-rAiS for ; Sat, 10 Dec 2016 06:42:53 -0800 (PST) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84EE812951F for ; Sat, 10 Dec 2016 06:42:53 -0800 (PST) Received: by mail-qk0-x234.google.com with SMTP id n204so44801427qke.2 for ; Sat, 10 Dec 2016 06:42:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=7XVaJ+pjRDf0+k+tE9fthXgs/TOnaxlWb2SiVBhBXN8=; b=g5W6jUUyDj+qR7MrJqCuYncGInQ1l9I9lF2PV5lC/wpdAbwHd5H/JKkUe90+ZirOVc aZPI0nt34+LRDzyi3ZORoZVTakyIQpjfdnNkPvfPsK9+WvXKfkvliV9WXcsgjcmYadGt C3r/G4zsprQjVR55u7fXOCY0Mm7mV2MRhR3lY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=7XVaJ+pjRDf0+k+tE9fthXgs/TOnaxlWb2SiVBhBXN8=; b=Eol2oLmAqKlLf2tuXDM5xbDOStgHvTwkaMKKNH5i8Sr/502sPiGZtSyJFcACJvUslp EIlr+/3dH9V0xBsu9suxBJSgNpf2lq4lO7kmPokGSr0RcZckr31n5ZwE9hiZb3aT5NgA B2Etedx35VQv1ycpp/sCcvGyoXJNEyBzphw/3z1UBdUi6zaeKHQeJctoiUSMAiBeXkiQ D2m3UyUuB2S3Z0el1sfrED4rUYkKl259M4+83YY3V+D9CKTeSr6CxpgaPlquOGWJP1z4 Ilz5qleUH4IXIDMPe/EofFsMoqRdn8a2p/vHaQMnLrcYqSqcmL/UI7ELFqme4lOH0n+Q tsnQ== X-Gm-Message-State: AKaTC0266E4Wb5coI4MLNDv74SoBtjGaCdkRKyl1SHFaKm+Xey1yRkS0zoYekgCbESmAEw== X-Received: by 10.55.16.10 with SMTP id a10mr71876909qkh.66.1481380972601; Sat, 10 Dec 2016 06:42:52 -0800 (PST) Received: from [172.16.0.92] (pool-173-73-120-80.washdc.east.verizon.net. [173.73.120.80]) by smtp.gmail.com with ESMTPSA id f2sm19472027qtg.22.2016.12.10.06.42.51 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 10 Dec 2016 06:42:52 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: Date: Sat, 10 Dec 2016 09:42:50 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <0D923C44-DD00-4C6B-90A0-ABB4AB2ADD4E@sn3rd.com> References: <148137065859.3698.8955088480248952167.idtracker@ietfa.amsl.com> <0A3548C0-D59D-4232-A6DF-6371395FFFAA@sn3rd.com> To: Alexey Melnikov X-Mailer: Apple Mail (2.3124) Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, Sandra Murphy , sidr-chairs@ietf.org, The IESG , sidr@ietf.org Subject: Re: [sidr] Alexey Melnikov's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Dec 2016 14:42:55 -0000 > On Dec 10, 2016, at 08:56, Alexey Melnikov = wrote: >=20 >=20 >> On 10 Dec 2016, at 12:40, Sean Turner wrote: >>=20 >>> On Dec 10, 2016, at 06:50, Alexey Melnikov = wrote: >>>=20 >>> Maybe I missed it, but I don't think the document is clear on why = new >>> algorithms are needed. Is this specified in one of referenced = documents? >>=20 >> I think you=E2=80=99re asking why different algorithms are needed to = those specified for the rest of the RPKI? If that=E2=80=99s the case, = it=E2=80=99s key/sig size to keep the protocol smaller than if we used = RSA/RSA-PSS and that=E2=80=99s covered in RFC 5480. =20 >=20 > Thank you, Sean. Maybe the document should have a sentence on this. Ack - maybe in the last para of s1 we put something like this: BGPsec uses a different algorithm as compared to the rest of the RPKI to = minimize the size of the protocol exchanged between routers [RFC5480]. I=E2=80=99m not wed to this wording though so wordsmithing from the WG = is welcome. spt From nobody Sat Dec 10 11:09:49 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2D0B1294DB; Sat, 10 Dec 2016 11:09:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v9vtvaHYVGmJ; Sat, 10 Dec 2016 11:09:40 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20CDF12947F; Sat, 10 Dec 2016 11:09:40 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cFn1d-00082D-IH; Sat, 10 Dec 2016 19:09:37 +0000 Date: Sat, 10 Dec 2016 11:09:36 -0800 Message-ID: From: Randy Bush To: Sean Turner In-Reply-To: <0D923C44-DD00-4C6B-90A0-ABB4AB2ADD4E@sn3rd.com> References: <148137065859.3698.8955088480248952167.idtracker@ietfa.amsl.com> <0A3548C0-D59D-4232-A6DF-6371395FFFAA@sn3rd.com> <0D923C44-DD00-4C6B-90A0-ABB4AB2ADD4E@sn3rd.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: The IESG , sidr wg list Subject: Re: [sidr] Alexey Melnikov's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Dec 2016 19:09:41 -0000 > BGPsec uses a different algorithm as compared to the rest of the RPKI > to minimize the size of the protocol exchanged between routers > [RFC5480]. to reduce the size of signed bgpsec updates on the wire. i still wonder why we are not doing 25519 considering it is the cfrg recco and all the kool kids have gone that path. randy From nobody Sat Dec 10 14:06:23 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 19953129521; Sat, 10 Dec 2016 14:06:16 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Ralph Droms To: X-Test-IDTracker: no X-IETF-IDTracker: 6.39.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148140757610.3742.18377844934799246064.idtracker@ietfa.amsl.com> Date: Sat, 10 Dec 2016 14:06:16 -0800 Archived-At: Cc: draft-ietf-sidr-origin-validation-signaling.all@ietf.org, ietf@ietf.org, sidr@ietf.org Subject: [sidr] Review of draft-ietf-sidr-origin-validation-signaling-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Dec 2016 22:06:16 -0000 Reviewer: Ralph Droms Review result: Ready Document: draft-ietf-sidr-origin-validation-signaling-10 Reviewer: Ralph Droms Review Date: 2016-12-10 IETF LC End Date: 2016-12-07 IESG Telechat date: 2016-12-15 Summary: This draft is ready for publication as a Proposed Standard RFC Note: My review of -09 is unchanged for -10 Major issues: None Minor issues: None Nits/editorial comments: None From nobody Sun Dec 11 14:16:11 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB3AD1294E5 for ; Sun, 11 Dec 2016 14:16:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.796 X-Spam-Level: X-Spam-Status: No, score=-9.796 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rDlCBZ-B7OLj for ; Sun, 11 Dec 2016 14:16:08 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 388811293EB for ; Sun, 11 Dec 2016 14:16:08 -0800 (PST) Received: from mb-3.local (c-73-202-177-209.hsd1.ca.comcast.net [73.202.177.209]) (authenticated bits=0) by nagasaki.bogus.com (8.15.2/8.15.2) with ESMTPSA id uBBMG2a2047249 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Sun, 11 Dec 2016 22:16:05 GMT (envelope-from joelja@bogus.com) X-Authentication-Warning: nagasaki.bogus.com: Host c-73-202-177-209.hsd1.ca.comcast.net [73.202.177.209] claimed to be mb-3.local To: Randy Bush , Alvaro Retana References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> From: joel jaeggli Message-ID: <167fc1b5-50b9-a240-afb7-080ab97f1805@bogus.com> Date: Sun, 11 Dec 2016 14:15:58 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:50.0) Gecko/20100101 Thunderbird/50.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="654232nt0hufwvaVXEqsM1qXmj0x1lRI6" Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 11 Dec 2016 22:16:10 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --654232nt0hufwvaVXEqsM1qXmj0x1lRI6 Content-Type: multipart/mixed; boundary="51D7oUia0qsXLm71s2fPhCA7BVfRMIesq"; protected-headers="v1" From: joel jaeggli To: Randy Bush , Alvaro Retana Cc: sidr wg list Message-ID: <167fc1b5-50b9-a240-afb7-080ab97f1805@bogus.com> Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> In-Reply-To: --51D7oUia0qsXLm71s2fPhCA7BVfRMIesq Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 12/7/16 1:07 PM, Randy Bush wrote: > otoh, private AS numbers are used in non-confed topologies, e.g. the bg= p > stub customer who uses a private AS. they should not sign of course. > but once i receive their announcement and strip the private AS, > can/should i sign? i just looked at bgpsec-protocol and found no > guidance. from that vantage point you are the origin. it's not clear to me that a customer relationship is substantively then if you do this internal to your org. operationally the'yre probably also registering route objects, issuing LOAS and operating on behalf of the private ASN. > randy >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr >=20 --51D7oUia0qsXLm71s2fPhCA7BVfRMIesq-- --654232nt0hufwvaVXEqsM1qXmj0x1lRI6 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlhN0B4ACgkQ8AA1q7Z/VrINCACfQ4CvghzMekUWYMVgoEcbd8mi wtAAnijS0VljOj/iN/fK6fcVXpKnlQSP =vgWY -----END PGP SIGNATURE----- --654232nt0hufwvaVXEqsM1qXmj0x1lRI6-- From nobody Mon Dec 12 05:34:28 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 09979129B14; Mon, 12 Dec 2016 05:34:27 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "Mirja Kuehlewind" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148154966702.22433.12175370874876571095.idtracker@ietfa.amsl.com> Date: Mon, 12 Dec 2016 05:34:27 -0800 Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, sidr-chairs@ietf.org, sidr@ietf.org, sandy@tislabs.com Subject: [sidr] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_draft-i?= =?utf-8?q?etf-sidr-bgpsec-algs-16=3A_=28with_COMMENT=29?= X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 13:34:27 -0000 Mirja Kühlewind has entered the following ballot position for draft-ietf-sidr-bgpsec-algs-16: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Just a thought: Would it be useful to add an IESG note saying something like in the sheperd write-up: "[...] there are published references that preceded the filing of the patent, especially those mentioned in RFC6090. RFC6090 notes that its descriptions "may be useful for implementing the fundamental algorithms without using any of the specialized methods that were developed in following years."" I know we usuall don't do things like this. But I'm wondering how someone who wants to implement this should figure this out otherwise....? From nobody Mon Dec 12 07:08:00 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B6C3129C4F; Mon, 12 Dec 2016 07:07:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.418 X-Spam-Level: X-Spam-Status: No, score=-17.418 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5GT5DItZAsT8; Mon, 12 Dec 2016 07:07:54 -0800 (PST) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87ADB129C4D; Mon, 12 Dec 2016 07:07:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1726; q=dns/txt; s=iport; t=1481555274; x=1482764874; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=1FpoEantdDYGWBLJqSbIFMXfbDjQ26zuA2lUmvSPNz0=; b=SUq5djmoQUPbrD/c5+ubIfptY+FRKCtTpIcqhF0g4bGrzlcenEUlqZ7K KxF242lyxqo7AEUEjAozYKfJqYYaZtqfOKHxkaiURZ2TgT+iGSkJfgYUH yxWd/bMYW0ZkmdJDTfGwGwKIVmX6GhrjF3a6+LoELPSBvTMHJmDtXVwxJ M=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DsAgDkvE5Y/49dJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgzcBAQEBAR+BYAe1B4JEgg+CCIYhAhqBWUATAQIBAQEBAQEBYii?= =?us-ascii?q?EaQYjEUUQAgEGAg4MAiYCAgIwFQULAgQBDQWIa44WnUqCKIsaAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBHYELhTOBfYJeh0wtgjABBIhjjB2FawGRJZBGkhkBIAE1gR8?= =?us-ascii?q?yAQGDY4FFcocOgQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.33,336,1477958400"; d="scan'208";a="359856425" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 12 Dec 2016 15:07:45 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by rcdn-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id uBCF7jQl009310 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 12 Dec 2016 15:07:45 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 12 Dec 2016 09:07:45 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Mon, 12 Dec 2016 09:07:45 -0600 From: "Alvaro Retana (aretana)" To: Mirja Kuehlewind , The IESG Thread-Topic: =?utf-8?B?TWlyamEgS8O8aGxld2luZCdzIE5vIE9iamVjdGlvbiBvbiBkcmFmdC1pZXRm?= =?utf-8?Q?-sidr-bgpsec-algs-16:_(with_COMMENT)?= Thread-Index: AQHSVHx2bYZERYyedkSxJ+s3GtgK96EEesUA Date: Mon, 12 Dec 2016 15:07:45 +0000 Message-ID: <7C970123-C954-44D8-B24B-BCA2BA294BBB@cisco.com> References: <148154966702.22433.12175370874876571095.idtracker@ietfa.amsl.com> In-Reply-To: <148154966702.22433.12175370874876571095.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: text/plain; charset="utf-8" Content-ID: <776F5DE758DFC04981D6E93681319CCD@emea.cisco.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-sidr-bgpsec-algs@ietf.org" , "sidr-chairs@ietf.org" , "sidr@ietf.org" , "Sandra L. Murphy" Subject: Re: [sidr] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_draft-i?= =?utf-8?q?etf-sidr-bgpsec-algs-16=3A_=28with_COMMENT=29?= X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 15:07:59 -0000 T24gMTIvMTIvMTYsIDg6MzQgQU0sICJNaXJqYSBLdWVobGV3aW5kIiA8aWV0ZkBrdWVobGV3aW5k Lm5ldD4gd3JvdGU6DQoNCk1pcmphOg0KDQpIaSENCg0KPiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+IENPTU1F TlQ6DQo+IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0NCj4NCj4gSnVzdCBhIHRob3VnaHQ6IFdvdWxkIGl0IGJlIHVz ZWZ1bCB0byBhZGQgYW4gSUVTRyBub3RlIHNheWluZyBzb21ldGhpbmcNCj4gbGlrZSBpbiB0aGUg c2hlcGVyZCB3cml0ZS11cDoNCj4gIlsuLi5dIHRoZXJlIGFyZSBwdWJsaXNoZWQgcmVmZXJlbmNl cw0KPsKgwqDCoMKgdGhhdCBwcmVjZWRlZCB0aGUgZmlsaW5nIG9mIHRoZSBwYXRlbnQsIGVzcGVj aWFsbHkgdGhvc2XCoA0KPsKgwqDCoMKgbWVudGlvbmVkIGluIFJGQzYwOTAuwqDCoFJGQzYwOTAg bm90ZXMgdGhhdCBpdHMgZGVzY3JpcHRpb25zDQo+wqDCoMKgwqAibWF5IGJlIHVzZWZ1bCBmb3Ig aW1wbGVtZW50aW5nIHRoZSBmdW5kYW1lbnRhbCBhbGdvcml0aG1zIHdpdGhvdXTCoA0KPsKgwqDC oMKgdXNpbmcgYW55IG9mIHRoZcKgwqBzcGVjaWFsaXplZCBtZXRob2RzIHRoYXQgd2VyZSBkZXZl bG9wZWQgaW7CoA0KPsKgwqDCoMKgZm9sbG93aW5nIHllYXJzLiIiDQo+IEkga25vdyB3ZSB1c3Vh bGwgZG9uJ3QgZG8gdGhpbmdzIGxpa2UgdGhpcy4gQnV0IEknbSB3b25kZXJpbmcgaG93IHNvbWVv bmUNCj4gd2hvIHdhbnRzIHRvIGltcGxlbWVudCB0aGlzIHNob3VsZCBmaWd1cmUgdGhpcyBvdXQg b3RoZXJ3aXNlLi4uLj8NCg0KSSB0aGluayB3ZSB3b3VsZCBiZSBnZXR0aW5nIHRvbyBjbG9zZSB0 byB0YWtpbmcgYSBzdGFuY2Ugb24gdGhlIHZhbGlkaXR5LCBlbmZvcmNlYWJpbGl0eSBvZiB0aGUg SVBSLiAgVGhlIFdHIGhhcyBhbHJlYWR5IGRpc2N1c3NlZCBhbmQgY2hvc2UgdG8gZ28gYWhlYWQu DQoNClJGQzYwOTAgaXMgYSBub3JtYXRpdmUgcmVmZXJlbmNlIGZvciB0aGlzIGRvY3VtZW50LCBw b2ludGluZyBhdCB0aGUgc2lnbmF0dXJlIGFsZ29yaXRobSB0byBiZSB1c2VkLiAgQW55IGltcGxl bWVudGVyIHdvdWxkIGhhdmUgdG8gYXQgbGVhc3QgY2hlY2sgb3V0IFJGQzYwOTAgYW5kIHdvdWxk IGZpbmQgdGhlIHRleHQgYWJvdmUgaW4gdGhlIEFic3RyYWN0Lg0KDQpUaGFua3MhDQoNCkFsdmFy by4NCg0K From nobody Mon Dec 12 08:15:55 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A70C81295B5 for ; Mon, 12 Dec 2016 08:15:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.796 X-Spam-Level: X-Spam-Status: No, score=-4.796 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-2.896] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lm_jfUIMLq9g for ; Mon, 12 Dec 2016 08:15:50 -0800 (PST) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 267D9129CC0 for ; Mon, 12 Dec 2016 08:15:37 -0800 (PST) Received: from [10.0.1.21] (cpe-66-25-7-22.tx.res.rr.com [66.25.7.22]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id uBCGFWRL024369 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 12 Dec 2016 10:15:33 -0600 (CST) (envelope-from ben@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host cpe-66-25-7-22.tx.res.rr.com [66.25.7.22] claimed to be [10.0.1.21] From: "Ben Campbell" To: "Alvaro Retana" Date: Mon, 12 Dec 2016 10:15:32 -0600 Message-ID: <94724E1D-5EA3-46A3-80F9-4E4636D1266F@nostrum.com> In-Reply-To: <7C970123-C954-44D8-B24B-BCA2BA294BBB@cisco.com> References: <148154966702.22433.12175370874876571095.idtracker@ietfa.amsl.com> <7C970123-C954-44D8-B24B-BCA2BA294BBB@cisco.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-Mailer: MailMate (1.9.6r5310) Archived-At: Cc: "draft-ietf-sidr-bgpsec-algs@ietf.org" , "sidr@ietf.org" , "sidr-chairs@ietf.org" , Mirja Kuehlewind , The IESG , "Sandra L. Murphy" Subject: Re: [sidr] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_draft-i?= =?utf-8?q?etf-sidr-bgpsec-algs-16=3A_=28with_COMMENT=29?= X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 16:15:51 -0000 On 12 Dec 2016, at 9:07, Alvaro Retana (aretana) wrote: > On 12/12/16, 8:34 AM, "Mirja Kuehlewind" wrote: > > Mirja: > > Hi! > >> ---------------------------------------------------------------------- >> COMMENT: >> ---------------------------------------------------------------------- >> >> Just a thought: Would it be useful to add an IESG note saying >> something >> like in the sheperd write-up: >> "[...] there are published references >>     that preceded the filing of the patent, especially those  >>     mentioned in RFC6090.  RFC6090 notes that its descriptions >>     "may be useful for implementing the fundamental algorithms >> without  >>     using any of the  specialized methods that were developed >> in  >>     following years."" >> I know we usuall don't do things like this. But I'm wondering how >> someone >> who wants to implement this should figure this out otherwise....? > > I think we would be getting too close to taking a stance on the > validity, enforceability of the IPR. The WG has already discussed and > chose to go ahead. > > RFC6090 is a normative reference for this document, pointing at the > signature algorithm to be used. Any implementer would have to at > least check out RFC6090 and would find the text above in the Abstract. I agree with Alvaro, with the caveat that it would be more than "too close"; it would be the same as taking a stance on validity. It's the implementors problem to consider IPR issues even without a disclosure. Thanks! Ben. From nobody Mon Dec 12 10:13:03 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CC4612941D; Mon, 12 Dec 2016 10:12:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5EvlfCUe1t7E; Mon, 12 Dec 2016 10:12:53 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C665B12940D; Mon, 12 Dec 2016 10:12:53 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cGV5j-0002hv-UQ; Mon, 12 Dec 2016 18:12:48 +0000 Date: Mon, 12 Dec 2016 10:12:44 -0800 Message-ID: From: Randy Bush To: "Ben Campbell" In-Reply-To: <94724E1D-5EA3-46A3-80F9-4E4636D1266F@nostrum.com> References: <148154966702.22433.12175370874876571095.idtracker@ietfa.amsl.com> <7C970123-C954-44D8-B24B-BCA2BA294BBB@cisco.com> <94724E1D-5EA3-46A3-80F9-4E4636D1266F@nostrum.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: "draft-ietf-sidr-bgpsec-algs@ietf.org" , "Sandra L. Murphy" , "sidr-chairs@ietf.org" , Mirja Kuehlewind , The IESG , "sidr@ietf.org" Subject: Re: [sidr] =?iso-8859-1?q?Mirja_K=FChlewind=27s_No_Objection_on_draft?= =?iso-8859-1?q?-ietf-sidr-bgpsec-algs-16=3A_=28with_COMMENT=29?= X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 18:12:55 -0000 > It's the implementors problem to consider IPR issues even without a > disclosure. and ours not to lead them into ipr with no warning. randy From nobody Mon Dec 12 10:32:56 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82A46129484 for ; Mon, 12 Dec 2016 10:32:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JhSviMIEw71R for ; Mon, 12 Dec 2016 10:32:54 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4451212941D for ; Mon, 12 Dec 2016 10:32:54 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cGVPA-0002ny-4N; Mon, 12 Dec 2016 18:32:52 +0000 Date: Mon, 12 Dec 2016 10:32:49 -0800 Message-ID: From: Randy Bush To: joel jaeggli In-Reply-To: <167fc1b5-50b9-a240-afb7-080ab97f1805@bogus.com> References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> <167fc1b5-50b9-a240-afb7-080ab97f1805@bogus.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: sidr wg list Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 18:32:55 -0000 >> otoh, private AS numbers are used in non-confed topologies, e.g. the bgp >> stub customer who uses a private AS. they should not sign of course. >> but once i receive their announcement and strip the private AS, >> can/should i sign? i just looked at bgpsec-protocol and found no >> guidance. > > from that vantage point you are the origin. it's not clear to me that > a customer relationship is substantively then if you do this internal ^ did you drop "different?" > to your org. operationally the'yre probably also registering route > objects, issuing LOAS and operating on behalf of the private ASN. almost. while they _may_ be registering route objects, it is unlikely they are signing contracts on behalf of the customer. different transit providers provision customers using private ASs in different ways (doh). but i think essentially we are in agreement. as far as bgpsec and roa-based origin validation go, it would probably be good to specify how the transit operator proxies for the private AS customer. but this is the ietf. i have faith that someone can come up with a corner case where this should not be done. :) randy From nobody Mon Dec 12 11:47:54 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F79D129442; Mon, 12 Dec 2016 11:47:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.797 X-Spam-Level: X-Spam-Status: No, score=-9.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MvVKUdvNC8Cb; Mon, 12 Dec 2016 11:47:45 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2864D12940F; Mon, 12 Dec 2016 11:47:45 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cGWZa-0003DL-9Z; Mon, 12 Dec 2016 19:47:42 +0000 Date: Tue, 13 Dec 2016 04:47:39 +0900 Message-ID: From: Randy Bush To: "Mirja Kuehlewind" In-Reply-To: <148154966702.22433.12175370874876571095.idtracker@ietfa.amsl.com> References: <148154966702.22433.12175370874876571095.idtracker@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, sidr-chairs@ietf.org, sandy@tislabs.com, The IESG , sidr@ietf.org Subject: Re: [sidr] =?iso-8859-1?q?Mirja_K=FChlewind=27s_No_Objection_on_draft?= =?iso-8859-1?q?-ietf-sidr-bgpsec-algs-16=3A_=28with_COMMENT=29?= X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 19:47:46 -0000 > Just a thought: Would it be useful to add an IESG note saying something > like in the sheperd write-up: > "[...] there are published references > that preceded the filing of the patent, especially those mentioned > in RFC6090. RFC6090 notes that its descriptions "may be useful > for implementing the fundamental algorithms without using any of > the specialized methods that were developed in following years."" perhaps the simple truth would raise less objection; if it does raise objection then i suspect something is broken. say that there is an ipr filing on this draft and the wg considered that and decided to go ahead anyway. also say that \cite{rfc6090} describes relevant algorithms and has no ipr filed against it. randy From nobody Mon Dec 12 13:45:18 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D8F5129CDD for ; Mon, 12 Dec 2016 13:45:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.798 X-Spam-Level: X-Spam-Status: No, score=-4.798 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MSp72CNlKfgp for ; Mon, 12 Dec 2016 13:45:16 -0800 (PST) Received: from kuehlewind.net (kuehlewind.net [83.169.45.111]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC5A21294AF for ; Mon, 12 Dec 2016 13:45:15 -0800 (PST) Received: (qmail 21556 invoked from network); 12 Dec 2016 22:38:32 +0100 Received: from p5dec2f57.dip0.t-ipconnect.de (HELO ?192.168.178.33?) (93.236.47.87) by kuehlewind.net with ESMTPSA (DHE-RSA-AES256-SHA encrypted, authenticated); 12 Dec 2016 22:38:32 +0100 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.1 \(3251\)) From: "Mirja Kuehlewind (IETF)" In-Reply-To: Date: Mon, 12 Dec 2016 22:38:30 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: <43042837-7603-4C8F-8EA5-2E37E0986B79@kuehlewind.net> References: <148154966702.22433.12175370874876571095.idtracker@ietfa.amsl.com> <7C970123-C954-44D8-B24B-BCA2BA294BBB@cisco.com> <94724E1D-5EA3-46A3-80F9-4E4636D1266F@nostrum.com> To: Randy Bush , Ben Campbell X-Mailer: Apple Mail (2.3251) Archived-At: Cc: "draft-ietf-sidr-bgpsec-algs@ietf.org" , "Sandra L. Murphy" , "sidr-chairs@ietf.org" , The IESG , "sidr@ietf.org" Subject: Re: [sidr] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_draft-i?= =?utf-8?q?etf-sidr-bgpsec-algs-16=3A_=28with_COMMENT=29?= X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 21:45:17 -0000 Yes, just wanted to make sure implementors have the information they = need to make a decision. The text cited from the shepherd write-up only says that RFC6090 = predates the patent filing; without a judgement or validity check. However, that was just a thought/question. If the answer is no that=E2=80=99= s fine. Mirja > Am 12.12.2016 um 19:12 schrieb Randy Bush : >=20 >> It's the implementors problem to consider IPR issues even without a >> disclosure. >=20 > and ours not to lead them into ipr with no warning. >=20 > randy >=20 From nobody Mon Dec 12 13:54:39 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AA14712945C; Mon, 12 Dec 2016 13:54:38 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "Benoit Claise" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148157967869.22355.15497424989049721976.idtracker@ietfa.amsl.com> Date: Mon, 12 Dec 2016 13:54:38 -0800 Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, jouni.nospam@gmail.com, sandy@tislabs.com, sidr-chairs@ietf.org, sidr@ietf.org Subject: [sidr] Benoit Claise's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 21:54:39 -0000 Benoit Claise has entered the following ballot position for draft-ietf-sidr-bgpsec-algs-16: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- As noted by Jouni in his OPS DIR review, and acknowledged by Sean Turner > o Section 7 IANA Considerations says on line 192: > "Infrastructure (RPKI) group. The one-octet BGPsec Algorithm Suite” > ^^^^^^^^^ > However, in the following table and text it says nothing about > values 0x10-0xff. Are these unassigned or reserved? This is a bit > confusing since the table lists values up to 0xF (one-nibble). Sigh - that should be: +------------+------------+-------------+---------------------+ | 0x2-0xEF | Unassigned | Unassigned | This draft | +------------+------------+-------------+---------------------+ | 0xFF | Reserved | Reserved | This draft | +------------+------------+-------------+---------------------+ From nobody Mon Dec 12 15:01:01 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE4AC129E6E for ; Mon, 12 Dec 2016 15:00:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5LyaQo-UzjSR for ; Mon, 12 Dec 2016 15:00:58 -0800 (PST) Received: from mail-qk0-x236.google.com (mail-qk0-x236.google.com [IPv6:2607:f8b0:400d:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A3C2129E82 for ; Mon, 12 Dec 2016 14:59:13 -0800 (PST) Received: by mail-qk0-x236.google.com with SMTP id q130so99318987qke.1 for ; Mon, 12 Dec 2016 14:59:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=jyjd//pHR9iBdNYp0T7RFZsB3rdSgbGI15TZeb0ZsBE=; b=YkaiDuGZmKLs7scx/5RtH3i+9oMpDtIuppz8R0hAXWVdo1LodybR4n715duMFTpwsH PM85fTKOoVJd8OteqDALB8aBPdc2NQtJ5F5TozqEF53iP/YgXU6wceVVnlifweel6lMR Hv52nzTRJ7UvylfQ/3jZZ4/oDX9VPfcnTiFFE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=jyjd//pHR9iBdNYp0T7RFZsB3rdSgbGI15TZeb0ZsBE=; b=YMtFYvckpD4H4OrcAjuiP0bV3CvHQ2DAAu+OqgAJfauZkF6H04UPdPRgDcGXAgioKD Uk7YTfR1qiLTkvLUyzDll5CjtCJvklMMFe8+buF4as4aCvOgm950chNfG25fpwY7CQSB CxNE2yGvLM+bdvfygNQ5lonMyUmk6aGY5ElP3OBQkGFoOYQwIM5s6M5NsvWiAkTyfvzK Y1B5gYeoD2AAAJ2G8Ttu8dsHF/Ri7h8he/9keYqJFj2nj7cxbAA9AnALKjNRJybjnlaS T24QeBrvCFjmM974r9cWA21hUZh2qjr1YxSsUllc30l0U+2ru7wcMKwgJFHkpWR1+YjH +L5Q== X-Gm-Message-State: AKaTC016csmlU28aa5zRebawoQc3raizNz6PeXEr4MkDgOkXYcAN9HizbRJ11e+RFW1LrA== X-Received: by 10.55.124.198 with SMTP id x189mr90041631qkc.95.1481583552407; Mon, 12 Dec 2016 14:59:12 -0800 (PST) Received: from [172.16.0.92] (pool-173-73-120-80.washdc.east.verizon.net. [173.73.120.80]) by smtp.gmail.com with ESMTPSA id d127sm27553622qkf.34.2016.12.12.14.59.10 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 12 Dec 2016 14:59:12 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: <148157967869.22355.15497424989049721976.idtracker@ietfa.amsl.com> Date: Mon, 12 Dec 2016 17:59:07 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: <148157967869.22355.15497424989049721976.idtracker@ietfa.amsl.com> To: Benoit Claise X-Mailer: Apple Mail (2.3124) Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, jouni.nospam@gmail.com, Sandra Murphy , sidr-chairs@ietf.org, The IESG , sidr@ietf.org Subject: Re: [sidr] Benoit Claise's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 23:01:00 -0000 On Dec 12, 2016, at 16:54, Benoit Claise wrote: >=20 > Benoit Claise has entered the following ballot position for > draft-ietf-sidr-bgpsec-algs-16: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut = this > introductory paragraph, however.) >=20 >=20 > Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > As noted by Jouni in his OPS DIR review, and acknowledged by Sean = Turner >> o Section 7 IANA Considerations says on line 192: >> "Infrastructure (RPKI) group. The one-octet BGPsec Algorithm = Suite=E2=80=9D >> ^^^^^^^^^ >> However, in the following table and text it says nothing about >> values 0x10-0xff. Are these unassigned or reserved? This is a bit >> confusing since the table lists values up to 0xF (one-nibble). >=20 > Sigh - that should be: >=20 > +------------+------------+-------------+---------------------+ > | 0x2-0xEF | Unassigned | Unassigned | This draft | > +------------+------------+-------------+---------------------+ > | 0xFF | Reserved | Reserved | This draft | > = +------------+------------+-------------+=E2=80=94=E2=80=94=E2=80=94=E2=80= =94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94+ Yep this is in my list of things to do. I also let IANA to double check = that I did it before they create the registry :) spt From nobody Tue Dec 13 03:35:09 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A80C9129A58; Tue, 13 Dec 2016 03:35:08 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "Stephen Farrell" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148162890868.29309.6612521336331258650.idtracker@ietfa.amsl.com> Date: Tue, 13 Dec 2016 03:35:08 -0800 Archived-At: Cc: sidr@ietf.org, sidr-chairs@ietf.org, draft-ietf-sidr-origin-validation-signaling@ietf.org, sandy@tislabs.com Subject: [sidr] Stephen Farrell's No Objection on draft-ietf-sidr-origin-validation-signaling-10: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 11:35:08 -0000 Stephen Farrell has entered the following ballot position for draft-ietf-sidr-origin-validation-signaling-10: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-sidr-origin-validation-signaling/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- - section 2, super-nit: when you say "the last octet ... encodes" that is a teeny bit ambiguous, as it could just about be read to mean that the last octet is a bit mask, leading someone's code to not correctly handle future values >2. So it might be good to be that little bit more explicit that the other 6 bits of that octet are also important, even if they're not defined now. IOW, if a device sees a value 4 in there then it MUST NOT treat that as valid by only seeing zeroes in the two low order bits. (And btw, I assume network byte order is generically understood here too, not sure if that also needs to be stated, probably not, as that ought be generic for encoding integers within extensions I guess.) - section 2: Is "By default, ... SHOULD drop..." correct? I think what you mean is "By default ... MUST drop" as the case for not dropping is not the default. Or, you could say "SHOULD drop except when... " and not have to mention any default. (Note: I'm only questioning the wording here, not the semantics, which seems fine.) - section 6: I didn't read all the references, but is there anything to be said about possible differences in the duration for which one is vulnerable to not yet seeing a revocation for a node that sees this extension, vs a node that does origin validation itself? If a node having seen this extension were to remember the origin for a lot longer than one that does validation itself, then that might be worth noting here, but I don't know how the relative timings might pan out, so not sure. (And apologies if this is covered in the references I didn't check out;-) From nobody Tue Dec 13 03:54:22 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 376F81295DF; Tue, 13 Dec 2016 03:54:21 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "Stephen Farrell" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148163006122.29374.7201338314702333753.idtracker@ietfa.amsl.com> Date: Tue, 13 Dec 2016 03:54:21 -0800 Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, sidr-chairs@ietf.org, sidr@ietf.org, sandy@tislabs.com Subject: [sidr] Stephen Farrell's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 11:54:21 -0000 Stephen Farrell has entered the following ballot position for draft-ietf-sidr-bgpsec-algs-16: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- - As Randy commented, if the goal is to smallerise the packets, it'd have been nice to use eddsa here but I assume that wasn't practical due to the timing and the number of RPKI elements that'd need to be defined for that? Is that right? Did the WG consider using 25519 instead of p256? If not, is it worth asking, just in case everyone loves the idea more than this? - Documents like this are better with test vectors included or referenced. Couldn't you add those or some pointers to those? - To answer Mirja's point: Anyone who knows RFC6090 knows that it more or less only exists because of IPR silliness. And sadly, even though 6090 only references documents that predate relevant IPR filings by >20 years, even 6090 still got an (IMO also silly) IPR declaration. [1] Sheesh, but whaddya gonna do? :-( Anyway, I don't think there's a need to, or benefit from, adding text here about the well-known situation with ECC IPR that I believe stymied deployment for at least a decade. [1] https://datatracker.ietf.org/ipr/search/?rfc=6090&submit=rfc From nobody Tue Dec 13 04:26:17 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38E2B12964B; Tue, 13 Dec 2016 04:26:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SPwb6IfLCUGo; Tue, 13 Dec 2016 04:26:08 -0800 (PST) Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0107.outbound.protection.outlook.com [23.103.201.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B1D5129648; Tue, 13 Dec 2016 04:26:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=tnoIeZAsvBjI9QZbTbo7OCCmdwOdQTovC2tbhKFgr0I=; b=2K0iIEwf6uJTbYL/geOGYtYDZwmggknVK4G3yJKj3VgG+Qfd0pQ7rfAaVypCY09UMdfEwApw7O6WN8EtY13Yk6c1bXpiI1ywJNaQRan96Rt87kI+SyH2yshc4VKhhq3n9EzqWT34NjKptOEOh1wDkd9mwWNec42/bvA5wv0YICw= Received: from DM2PR09MB0446.namprd09.prod.outlook.com (10.161.252.145) by DM2PR09MB0445.namprd09.prod.outlook.com (10.161.252.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Tue, 13 Dec 2016 12:26:05 +0000 Received: from DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) by DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) with mapi id 15.01.0771.014; Tue, 13 Dec 2016 12:26:05 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "Alvaro Retana (aretana)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" Thread-Topic: Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) Thread-Index: AQHSUmenE2EHhTbiU0q7IXrD4ZYx2aEF0Iz4 Date: Tue, 13 Dec 2016 12:26:05 +0000 Message-ID: References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> In-Reply-To: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=kotikalapudi.sriram@nist.gov; x-originating-ip: [129.6.218.229] x-ms-office365-filtering-correlation-id: 21fdd3ac-06ba-43a5-128c-08d4235335da x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DM2PR09MB0445; x-microsoft-exchange-diagnostics: 1; DM2PR09MB0445; 7:2yZZkF1Hz9Fl0OZ853I7Q3VFMNNIgR1zr7BwzTDrxfXPXN5t5FTbupEKZl5TrQpNpP+b/vfh+ZZHk1+gk7WHb87s53MrxTMirwJ2+ZSrCtb3pphngl3aJ4IZmXsVeE9PSxGeNtQIqqkhspvh2zJKBlP71HBHRaGL4+wt7KBPIlkBI7BFT3/ds3K1BmyOCmJ3daKRYCX7+HgyAbEW2xbcpZMM+NEXVZQsY8xPePozrQnrtadLKR9iht4eQVNVxfxsK2GGiFPlob1k5xAra2sbPM8KQKjtTNhmHHbTTGVSMhVlafo/JypFWOte4rKP1dqiD2ivT8hMZPugr8b17PNOH+lq8h1Vz7gdyTAQq7tEF9cw/mwuwoGLYkjMTDZS9BWcUR8glKj6+8hrrCWhRKBh5nzfbFNSvPKoe+waZxUzq1VawskpVZzQuKogOt8DKW8e2rH/fiiGS9W/VpXoFE0I7Q== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(100405760836317); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(6041248)(20161123560025)(20161123555025)(20161123562025)(20161123564025)(6072148); SRVR:DM2PR09MB0445; BCL:0; PCL:0; RULEID:; SRVR:DM2PR09MB0445; x-forefront-prvs: 01559F388D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39410400002)(39450400003)(39850400002)(39860400002)(39840400002)(189002)(199003)(51444003)(5660300001)(19627405001)(92566002)(4326007)(76176999)(2900100001)(54356999)(106356001)(106116001)(50986999)(99286002)(105586002)(101416001)(6606003)(2950100002)(189998001)(97736004)(5001770100001)(122556002)(7696004)(76576001)(7736002)(74316002)(33656002)(2906002)(102836003)(6116002)(3846002)(230783001)(66066001)(86362001)(68736007)(81166006)(3280700002)(2501003)(2201001)(9686002)(8936002)(38730400001)(3660700001)(229853002)(81156014)(6436002)(77096006)(8676002)(6506006); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0445; H:DM2PR09MB0446.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR09MB04460DC9A23E1F58AEE629BF849B0DM2PR09MB0446namp_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2016 12:26:05.5691 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR09MB0445 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 12:26:15 -0000 --_000_DM2PR09MB04460DC9A23E1F58AEE629BF849B0DM2PR09MB0446namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable >Hi! I think the only item left is the Confederations one=85and we might b= e speaking past each other. Thanks, Alvaro. My comments are marked with [Sriram-3]. [Sriram-3] I understand now your main comment about confederation. I think = there are two ways to address it (of course I hope other people chime in as= well): Choice A: The pCount =3D 0 solution that you have suggested. But I feel that this is somewhat a cosmetic solution. In your example, it c= an be perhaps questioned whether the signature with pCount =3D 0 from AS2 t= o AS65001 does actually fit the security guarantee from Section 8.1 that yo= u=92ve cited. Because AS2 (the AS with the public ASN) did not produce tha= t signature directly. Instead AS65001 played proxy for AS2 -- which is of c= ourse part of the original solution anyway. So we may consider choice B bel= ow. Choice B: Include a caveat to the statement in Section 8.1. For instance, w= e modify it as follows: For each AS in the path, a BGPsec speaker authorized by the holder of the AS number intentionally chose (in accordance with local policy) to propagate the route advertisement to the subsequent AS in the path (except for a minor caveat that applies in the case of BG= Psec speakers in a confederation). The caveat applies because a BGPsec speaker in a confederation-member AS can be a proxy receiver and signer for t= he public AS (identified by the public AS number of the confederation). Therefore,= a signature that appears to correspond to an AS with the public AS number may actually be proxy produced by a member AS that has an internal AS number not matching the public AS number. The confederation-member ASes are cognizant of this and hence it poses no security concern within the confederation, and it is transparent to ASes outside the confederation (see Section 4.3). [Sriram-3] Do you feel Choice B makes sense? [Sriram-3] Please see inline below for the rest of my comments (all marked = with [Sriram-3]). >Yes, I agree that the collusion problem is one that (as you mentioned belo= w) is out of the scope of BGPsec. You are right that pCount=3D0 (as propos= ed below) doesn=92t solve the collusion problem =96 but it does address the= following security guarantee that is currently not met in the Confederatio= ns case (from 8.1): > o For each AS in the path, a BGPsec speaker authorized by the holder of the AS number intentionally chose (in accordance with local policy) to propagate the route advertisement to the subsequent AS in the path. >In the case of Confederations, it cannot be (currently) verified that all = the ASNs in the path intentionally chose to send the update to the next ASN= because there is a discontinuity at the border. For a topology like this:= AS1 -> AS2/AS65001 -> AS65002/AS2 -> AS3 (AS2 is the Confederation ID and = AS65001 and AS65002 are Members), it can be verified that AS1 intentionally= sent the Update to AS2, but there is no explicit indication (even if symbo= lic: pCount=3D0) of the intention for AS65001 to =93receive=94 the update, = and then be able to send it to AS65002. >I still think that this continuity issue should be addressed; it nothing m= ore just because the intentionality is mentioned as a security guarantee of= BGPsec. [Sriram-3] Please see solution choices and A and B above and the related di= scussion. Chairs: Please poll the WG or make a decision of whether there is consensus= (or not) to not solve this continuity issue (maybe from prior discussions = on the list). If the WG decides not to solve this issue (or if it was alre= ady discussed), I=92m ok with being in the rough. Related to the above, is the support for private ASNs --- this topic also c= ame up in the review of draft-ietf-sidr-bgpsec-ops, and the GenArt/SecDir r= eviews. There are two related points: 1. It is common to use private ASNs in Confederations, but the global RPKI = can=92t support that. draft-ietf-sidr-slurm seems to address the issue of = local management of private resources in the RPKI. Given that the signing = of Updates is mandated, I think that support of draft-ietf-sidr-slurm is ne= cessary; IOW, I think that draft-ietf-sidr-slurm should be a Normative refe= rence. [Sriram-3] OK, will include draft-ietf-sidr-slurm as a normative reference= . 2. Private ASNs (as pointed out in the SecDir review) are commonly used for= stubs. This document should include something (I=92m thinking in the Ops = Section) about the protocol considerations: there must be a ROA from the re= source owner for the ISP to properly re-originate the Update, etc.. [Sriram-3] Agree. I=92ll factor in your inputs and those from Joel, Russ, = and Randy to include a paragraph on this topic in the ops and mgmt. section= . [Sriram-3] Perhaps I should wait for some more IESG LC reviews to roll in before I include this set of changes and those from Russ (Gen-ART) and Nevil (OPS-DIR)? Please advise. Thank you. Sriram --_000_DM2PR09MB04460DC9A23E1F58AEE629BF849B0DM2PR09MB0446namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

>Hi!  I t= hink the only item left is the Confederations one=85and we might be speaking past each other.

 

Thanks, Alvaro. M= y comments are marked with [Sriram-3].

 

[Sriram-3] I unde= rstand now your main comment about confederation. I think there are two ways to address it (of course I hope other people chime in a= s well):

 

Choice A: The pCo= unt =3D 0 solution that you have suggested.

 

But I feel that t= his is somewhat a cosmetic solution. In your example, it can be perhaps questioned whether the signature with pCount =3D 0 from AS2= to AS65001 does actually fit the security guarantee from Section 8.1 that = you=92ve cited.  Because AS2 (the AS with th= e public ASN) did not produce that signature directly. Instead AS65001 play= ed proxy for AS2 -- which is of course part of the original solution anyway= . So we may consider choice B below.&nbs= p;  

 

Choice B: Include= a caveat to the statement in Section 8.1. For instance, we modify it as follows:

 

For each AS in th= e path, a BGPsec speaker authorized by the holder

   = ;   of the AS number intentionally chose (in accordance with loca= l

   = ;   policy) to propagate the route advertisement to the subsequen= t AS

   = ;   in the path (except for a minor caveat that applies in the ca= se of BGPsec speakers

      in a  confederation).= The caveat applies because a BGPsec speaker

      in a confederation-member AS can be a proxy receiver and signer for = the public AS

      (identified by the public AS number of the confederation). Therefore= , a signature that appears to

     correspond to an AS = with the public AS number may actually

     be proxy produced by= a member AS that has an internal AS number

     not matching the public AS number. The confederation-member ASes

     are cognizant of this and hence it poses no security concern =

     within the confederation, and it is transparent to ASes outside

     the confederation (see Section 4.3).

 

[Sriram-3] Do you= feel Choice B makes sense?

 

[Sriram-3] Please= see inline below for the rest of my comments (all marked with [Sriram-3]).

 

 

>Yes, I agree = that the collusion problem is one that (as you mentioned below) is out of the scope of BGPsec.  You are right that pCount=3D0 (as pro= posed below) doesn=92t solve the collusion problem =96 but it does address = the following security guarantee that is currently not met in the Confedera= tions case (from 8.1):

 

>   = o  For each AS in the path, a BGPsec speaker authorized by the holder<= /font>

   = ;   of the AS number intentionally chose (in accordance with loca= l

   = ;   policy) to propagate the route advertisement to the subsequen= t AS

   = ;   in the path.

 

>In the case o= f Confederations, it cannot be (currently) verified that all the ASNs in the path intentionally chose to send the update to the next AS= N because there is a discontinuity at the border.  For a topology like= this: AS1 -> AS2/AS65001 -> AS65002/AS2 -> AS3 (AS2 is the Confed= eration ID and AS65001 and AS65002 are Members), it can be verified that AS1 intentionally sent the Update to AS2, but ther= e is no explicit indication (even if symbolic: pCount=3D0) of the intention= for AS65001 to =93receive=94 the update, and then be able to send it to AS= 65002.

  <= /span>

>I still think= that this continuity issue should be addressed; it nothing more just because the intentionality is mentioned as a security guarantee = of BGPsec. 

 

[Sriram-3] Please= see solution choices and A and B above and the related discussion.

 

Chairs: Please po= ll the WG or make a decision of whether there is consensus (or not) to not solve this continuity issue (maybe from prior discussions = on the list).  If the WG decides not to solve this issue (or if it was= already discussed), I=92m ok with being in the rough. 

 

Related to the ab= ove, is the support for private ASNs --- this topic also came up in the review of draft-ietf-sidr-bgpsec-ops, and the GenArt/SecDir= reviews.  There are two related points:

 

1. It is comm= on to use private ASNs in Confederations, but the global RPKI can=92t suppo= rt that.  draft-ietf-sidr-slurm seems to address the issue of local management of private resources in the RPKI.&nb= sp; Given that the signing of Updates is mandated, I think that support of = draft-ietf-sidr-slurm is necessary; IOW, I think that draft-ietf-sidr-slurm= should be a Normative reference.

 =

[Sriram-3]  OK, will include draft-ietf= -sidr-slurm as a normative reference.   

 

2. Private AS= Ns (as pointed out in the SecDir review) are commonly used for stubs. = This document should include something (I=92m thinking in the Ops Section) about the protocol considerations: there must= be a ROA from the resource owner for the ISP to properly re-originate the = Update, etc..

 =

[Sriram-3]&nb= sp; Agree. I=92ll factor in your inputs and those from Joel, Russ, and Rand= y to include a paragraph on this topic in the ops and mgmt. section.

 =

[Sriram-3]  Perhaps I should wait for some more IESG LC reviews to roll in

before I incl= ude this set of changes and those from Russ (Gen-ART)

and Nevil (OP= S-DIR)? Please advise.

 =

Thank you.

 =

Sriram  

--_000_DM2PR09MB04460DC9A23E1F58AEE629BF849B0DM2PR09MB0446namp_-- From nobody Tue Dec 13 06:27:56 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D66A51298C0 for ; Tue, 13 Dec 2016 06:27:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MJxd1teqHhjr for ; Tue, 13 Dec 2016 06:27:52 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B91E81298BC for ; Tue, 13 Dec 2016 06:27:25 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id n204so117573717qke.2 for ; Tue, 13 Dec 2016 06:27:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=MBeNOmDetJ1Q7hmGL2aOCXcicmAs9aHtzNm8HqZZrSo=; b=M+mJJM+6YcSEsvOPkaLWr0S2wK782C4yEp7NzJw2AShAqypUrFzMGWEfbQ4dySFzyc cxkVyiewnud89HIcFvIL2IomBeIhxaXR15EOC3JQDlI4S8s5UETQJMD2Pa5rTTodZTlL JLde2xsM7qvEPqGPPAxCBGkjh5tHoz5fj4uUc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=MBeNOmDetJ1Q7hmGL2aOCXcicmAs9aHtzNm8HqZZrSo=; b=LiF1oqKC4IZFMhSSHbdDX4QS41CfwT4IEC37+xKCG6/7xOwrmh1lImlUzEW8eDB5Hq r9oYYGl7M/tBXoQn/WuZafZfm7yCRbUO+iMdzN6QMWttNqyB/eQYGT4mzD/w6TSv9Kl4 zMeRXUjOOKRnPkhiQ+zlovAzgt2I+h1E1zQDYXQsROB4GCWKd2IVtxjAZ/L406PMc6j3 jChwXmMHyR2hYMyYGDH2dQCnb3FfR8NfXwfIhaQQ7EfmVTbWiCa1QjQfKRTHy+iYdO63 M6zC0Wt8mbOHyT+zV9Wps4XrDmFSokDClQhpYeunzMTeEd5QRvzAUwI5tKED5TWr7uTi Q7Jg== X-Gm-Message-State: AKaTC03e+lu3CAtPoTT9H1fyqQ6tM2J0K9C8Q096ICr/yIbsJnEpoZtUAKPhZTLpa8FH/g== X-Received: by 10.55.6.11 with SMTP id 11mr78936949qkg.29.1481639244829; Tue, 13 Dec 2016 06:27:24 -0800 (PST) Received: from [172.16.0.92] (pool-173-73-120-80.washdc.east.verizon.net. [173.73.120.80]) by smtp.gmail.com with ESMTPSA id 21sm29169347qkh.4.2016.12.13.06.27.23 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 13 Dec 2016 06:27:24 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: <148163006122.29374.7201338314702333753.idtracker@ietfa.amsl.com> Date: Tue, 13 Dec 2016 09:27:23 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: <148163006122.29374.7201338314702333753.idtracker@ietfa.amsl.com> To: Stephen Farrell X-Mailer: Apple Mail (2.3124) Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, Sandra Murphy , sidr chairs , The IESG , sidr wg list Subject: Re: [sidr] Stephen Farrell's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 14:27:55 -0000 On Dec 13, 2016, at 06:54, Stephen Farrell = wrote: >=20 > Stephen Farrell has entered the following ballot position for > draft-ietf-sidr-bgpsec-algs-16: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut = this > introductory paragraph, however.) >=20 >=20 > Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs/ >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > - As Randy commented, if the goal is to smallerise the > packets, it'd have been nice to use eddsa here but I assume > that wasn't practical due to the timing and the number of > RPKI elements that'd need to be defined for that? Is that > right? Did the WG consider using 25519 instead of p256? If > not, is it worth asking, just in case everyone loves the > idea more than this? We weren=E2=80=99t trying to optimize for the smallest possible packets = just smaller than RSA because at the time we were deciding on the = algorithm suite, which was circa =E2=80=9911, 25519 (or really any other = EC-based algorithm) wasn=E2=80=99t far enough along the standardization = path. And, you=E2=80=99re right there was a grunch of timing/elements = that needed to be come together to make any other EC-based algorithm = realistic. Since we=E2=80=99re now cc'ing the WG on IESG ballot positions it kind = of feels like it just got asked ;) Personally, I think it=E2=80=99s = fine the way it is and for what it=E2=80=99s worth there are now = interoperable implementations (see below). > - Documents like this are better with test vectors included > or referenced. Couldn't you add those or some pointers to > those? Would they be better in this draft or in the protocol draft (on the = 20170115 IESG telechat)? Either way I reached out to Oliver Borchers @ = NIST who did some interop testing between QuaggaSRx and BIRD [0]. = Hoping that doing some packet captures with a simple example (BGPsec = packets, private key+certs) wouldn=E2=80=99t be too hard to pull off; = it=E2=80=99ll double the size of this draft that=E2=80=99s for sure. Cheers, spt [0] https://tinyurl.com/hdsux2d= From nobody Tue Dec 13 06:42:02 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 704A9129A9A; Tue, 13 Dec 2016 06:42:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.197 X-Spam-Level: X-Spam-Status: No, score=-7.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DWB-RNcuDyeb; Tue, 13 Dec 2016 06:41:56 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03087129AB0; Tue, 13 Dec 2016 06:40:43 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 2A495BE38; Tue, 13 Dec 2016 14:40:41 +0000 (GMT) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OPSzFRWmQruB; Tue, 13 Dec 2016 14:40:41 +0000 (GMT) Received: from [134.226.63.183] (cswireless63-183.scss.tcd.ie [134.226.63.183]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 7BBF6BE2F; Tue, 13 Dec 2016 14:40:40 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1481640040; bh=I/DMx0ebfagvpNTpALv97Ki7AOyoKXwzKuPS/MX+zVs=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=EPbLoi4KYf9C7ImmJmAtTL0LKX8fr9W4oPw2FCObyiY7/WqyGowejsfrADK9uJ0UE ju20ewQh5PRkBoOK6/McQqIjZkmrNfpG1kLZxEd/9iOjXvlygYjv6yMLqHzdr4GbST icV9NKLRVGzuXcrHDWQXTv1mse2zrDTEitN0v6I4= To: Sean Turner References: <148163006122.29374.7201338314702333753.idtracker@ietfa.amsl.com> From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Tue, 13 Dec 2016 14:40:39 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms090302000001070902040002" Archived-At: Cc: draft-ietf-sidr-bgpsec-algs@ietf.org, Sandra Murphy , sidr chairs , The IESG , sidr wg list Subject: Re: [sidr] Stephen Farrell's No Objection on draft-ietf-sidr-bgpsec-algs-16: (with COMMENT) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 14:42:00 -0000 This is a cryptographically signed message in MIME format. --------------ms090302000001070902040002 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 13/12/16 14:27, Sean Turner wrote: > On Dec 13, 2016, at 06:54, Stephen Farrell > wrote: >>=20 >> Stephen Farrell has entered the following ballot position for=20 >> draft-ietf-sidr-bgpsec-algs-16: No Objection >>=20 >> When responding, please keep the subject line intact and reply to >> all email addresses included in the To and CC lines. (Feel free to >> cut this introductory paragraph, however.) >>=20 >>=20 >> Please refer to >> https://www.ietf.org/iesg/statement/discuss-criteria.html for more >> information about IESG DISCUSS and COMMENT positions. >>=20 >>=20 >> The document, along with other ballot positions, can be found >> here:=20 >> https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs/ >>=20 >> ----------------------------------------------------------------------= >> >>=20 COMMENT: >> ----------------------------------------------------------------------= >> >> >>=20 - As Randy commented, if the goal is to smallerise the >> packets, it'd have been nice to use eddsa here but I assume that >> wasn't practical due to the timing and the number of RPKI elements >> that'd need to be defined for that? Is that right? Did the WG >> consider using 25519 instead of p256? If not, is it worth asking, >> just in case everyone loves the idea more than this? >=20 > We weren=E2=80=99t trying to optimize for the smallest possible packets= just > smaller than RSA because at the time we were deciding on the > algorithm suite, which was circa =E2=80=9911, 25519 (or really any othe= r > EC-based algorithm) wasn=E2=80=99t far enough along the standardization= path. > And, you=E2=80=99re right there was a grunch of timing/elements that ne= eded > to be come together to make any other EC-based algorithm realistic. >=20 > Since we=E2=80=99re now cc'ing the WG on IESG ballot positions it kind = of > feels like it just got asked ;) =20 Yep. > Personally, I think it=E2=80=99s fine the > way it is and for what it=E2=80=99s worth there are now interoperable > implementations (see below). I'm also ok with p256 for this, given the set of things that'd all need a bit of updating for 25519. >=20 >> - Documents like this are better with test vectors included or >> referenced. Couldn't you add those or some pointers to those? >=20 > Would they be better in this draft or in the protocol draft (on the > 20170115 IESG telechat)? =20 A reference to that as a place to find test vectors would be just fine. Or inline in this one is also fine. Cheers, S. > Either way I reached out to Oliver Borchers > @ NIST who did some interop testing between QuaggaSRx and BIRD [0]. > Hoping that doing some packet captures with a simple example (BGPsec > packets, private key+certs) wouldn=E2=80=99t be too hard to pull off; i= t=E2=80=99ll > double the size of this draft that=E2=80=99s for sure. >=20 > Cheers, >=20 > spt >=20 > [0] https://tinyurl.com/hdsux2d >=20 --------------ms090302000001070902040002 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjEyMTMx NDQwMzlaMC8GCSqGSIb3DQEJBDEiBCCTCPVvrtij6HmB99IfSj+ckxyLiWq6ID5JpB/WPG3L HzBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQB2sicGNoKVCCvq6DfZztmFIbVUWJQz/lkJXQlJqrf4A2pfxRCck4iC tUkbYzHqp5O/3IGGNOn2ippD1jn/H79pIV1HfipB0Wq6IFBCgD7zVuzdMmLhFowXCLsXiTH/ fJuNxzBkKMWA/8tluXvFMATCmL+jJAIgMsAy31+6Iv/WF1yq7W+L5xSeHEg/xd3i1Liy7Lsl Q1ImhVXKAgWw9Cf2deKDqA4dKe1PiRo4fHCBK16UqPRGgEEvVbSgLLJr/qJZJBaYhkAOEUCA jMNd1CL54ggrv3bGkryhS8mist39I2Wd/Kt1l8QsPKYIY1a6Jr0gIb2HbWr1mB4z8BwdQLSP AAAAAAAA --------------ms090302000001070902040002-- From nobody Tue Dec 13 13:45:11 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 918F4129C0A; Tue, 13 Dec 2016 13:45:09 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Dale Worley To: X-Test-IDTracker: no X-IETF-IDTracker: 6.39.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148166550959.10904.12174161860330524758.idtracker@ietfa.amsl.com> Date: Tue, 13 Dec 2016 13:45:09 -0800 Archived-At: Cc: draft-ietf-sidr-bgpsec-pki-profiles.all@ietf.org, ietf@ietf.org, sidr@ietf.org Subject: [sidr] Review of draft-ietf-sidr-bgpsec-pki-profiles-18 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 21:45:09 -0000 Reviewer: Dale Worley Review result: Ready with Nits I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat these comments just like any other last call comments. Document: draft-ietf-sidr-bgpsec-pki-profiles-18 Reviewer: Dale R. Worley Review Date: 12 Dec 2016 IETF LC End Date: 19 Dec 2016 IESG Telechat date: unknown Summary: This draft is basically ready for publication, but has nits that should be fixed before publication. Some of these items appear to be technical, but I suspect that the intended meanings are clear to people well-versed in PKI and are known to work. However, they are unclear to a naive reader. 2. Describing Resources in Certificates The RIR, in turn, issues a CA certificate to an Internet Service Providers (ISP). s/Providers/Provider/ The CA also generate. The CA also generates Certificate Revocation Lists (CRLs). The first "The CA also generate." is extraneous. 3.1 BGPsec Router Certificate Fields A BGPsec Router Certificate is a valid X.509 public key certificate, consistent with the PKIX profile [RFC5280], containing the fields listed in this section. This profile is also based on [RFC6487] and only the differences between this profile and the profile in [RFC6487] are specified below. I suspect this paragraph is going to cause implementers some trouble. What, exactly, are the constraints on the BGPsec Router Certificate? It looks like the certificate must conform to: - X.509 - RFC 5280 - RFC 6487 as modified by "below" and I see that RFC 6487 requires that certificates conform to RFC 5280. So it seems that the first two items are directly required by this document and transitively required by RFC 6487. I suggest changing the first two items to be required only by transitivity, only mentioning X.509 and RFC 5280 as explanatory: A BGPsec Router Certificate is consistent with the profile in [RFC6487] as modified by the specifications in this section. As such, it must be a valid X.509 public key certificate and consistent with the PKIX profile [RFC5280]. Also, "below" is vague. I suspect you mean "The differences between this profile and the profile in [RFC6487] are specified in this section." 3.1.1.1. Subject However, each certificate issued by an individual CA MUST contain a Subject name that is unique within that context. What is "that context"? Do you mean: However, the certificates issued by an individual CA MUST contain unique Subject names. However that has difficulties when it comes time for the CA to issue new certificates with later validity times. Why there is a constraint based on "issued by an individual CA" is not clear, given that there is no constraint regarding which CA issues certificates to which routers. Merely aggregating the work of multiple CAs into one CA could require changing the subject names in the next revision of issued certificates, whereas splitting the work of one CA into multiple CAs would loosen this requirement. In addition, the definition of "an individual CA" is not clear. Is there really an operational requirement for this uniqueness constraint? More to the point, is the combination of common name (i.e. AS number) and serial number (router ID) required to be globally unique or not? That seems to be the only question that can be operationally significant. I suspect that someone well-versed in PKI knows these answers, but for the naive, what is required and why seems confusing. 3.2. BGPsec Router Certificate Request Profile o The SubjectPublicKeyInfo and PublicKey fields are specified in [ID.sidr-bgpsec-algs]. There is no "PublicKey field" discussed in ID.sidr-bgpsec-algs. Is "subjectPublicKey" intended? If so, "subjectPublicKey" seems to be a sub-field of SubjectPublicKeyInfo (per ID.sidr-bgpsec-algs section 3.1), which is also listed here, so it is not clear why it is mentioned individually here. 3.3. BGPsec Router Certificate Validation The validation procedure used for BGPsec Router Certificates is identical to the validation procedure described in Section 7 of [RFC6487] (and any RFC that updates this procedure), but using the constraints applied come from this specification. I assume you mean "and any RFC that updates the procedure of [RFC6487]". In that case, I think that "that procedure" would be required, but "the procedure of [RFC6487]" would eliminate any ambiguity. "but using the constraints applied come from this specification" is unclear. step 3: "the certificate contains all the field that must be present" This doesn't match the text in RFC 6487, despite claiming to be quoted: s/the certificate/The certificate/ s/all the field/all fields/ o BGPsec Router Certificate MUST include the "Subject Public Key Info" described in [ID.sidr-bgpsec-algs] as it updates [ID.sidr- rfc6485bis]. There is no "Subject Public Key Info" in ID.sidr-bgpsec-algs. Is "subjectPublicKeyInfo" intended? The construction "[ID.sidr-bgpsec-algs] as it updates [ID.sidr-rfc6485bis]" is awkward. Is "[ID.sidr-rfc6485bis] as updated by [ID.sidr-bgpsec-algs]" intended? If the latter construction is used, it is well-defined, though it means that the actual place to look for the description of "subjectPublicKeyInfo" is in [ID.sidr-bgpsec-algs]. Better, though, is to ask, What will this look like when the RFCs are published? Will [ID.sidr-bgpsec-algs] and [ID.sidr-rfc6485bis] be separate RFCs? If so, the desired format of "subjectPublicKeyInfo" will be described in one or the other of the RFCs, but (it seems) you could name just one of them. (It seems to me that if you have one draft modifying another draft, you should combine them into one draft, or move the modifying text into the draft it modifies.) NOTE: The cryptographic algorithms used by BGPsec routers are found in [ID.sidr-bgpsec-algs]. Currently, the algorithms specified in [ID.sidr-bgpsec-algs] and [ID.sidr-rfc6485bis] are different. BGPsec RPs will need to support algorithms that are used to validate BGPsec signatures as well as the algorithms that are needed to validate signatures on BGPsec certificates, RPKI CA certificates, and RPKI CRLs. I assume that there are two dichotomies: [ID.sidr-bgpsec-algs] vs. [ID.sidr-rfc6485bis] {the algorithms that are used to validate BGPsec signatures} vs. {the algorithms that are needed to validate signatures on BGPsec certificates, RPKI CA certificates, and RPKI CRLs} It would be easier on the reader if it was clear how these paired. E.g., NOTE: BGPsec RPs will need to support the algorithms in [ID.sidr-bgpsec-algs], which are used to validate BGPsec signatures, as well as the algorithms in [ID.sidr-rfc6485bis], which are needed to validate signatures on BGPsec certificates, RPKI CA certificates, and RPKI CRLs. or vice-versa. 4. Design Notes Note that this behavior is similar to the CA including the AS Resource Identifier Delegation extension in issued BGPsec Router Certificates despite the fact it is not present in the request. This text is indented as if it is a continuation of the immediately preceding bullet point. I can't tell for sure, but it seems to me that the text is actually a continuation of the paragraph containing the bulleted list, and so should be out-dented by two spaces from where it is now. 6. Security Considerations A BGPsec Router Certificate will fail RPKI validation, as defined in [RFC6487], because the algorithm suite is different. Different from what? Also, "algorithm suite" doesn't appear to be a defined datum in certificates; at least, it's not mentioned anywhere else in this document. Consequently, a RP needs to identify the EKU to determine the appropriate Validation constraint. I *think* this means that a RP needs to examine the EKU value to determine the algorithms that are used for [something]. (What does it mean to "identify" the EKU?) Also, this paragraph discusses "the certificate will fail validation as defined in 6487", and then talks about "the appropriate validation constraint", but it doesn't state that "the appropriate validation constraint" modifies the process in 6487. I suspect that the EKU value determines an algorithm suite (based on some unstated correspondence), which is then used to replace the algorithm suite demanded by some part of the 6487 process, and then after that, the certificate will pass the modified process. But the text doesn't assert that the certificate has to pass the modified process. I suspect that the intended meaning of this paragraph is obvious to anyone well-versed in PKI, but I don't think the words actually say that meaning. Hash functions [ID.sidr-bgpsec-algs] are used when generating the two key identifiers extension included in BGPsec certificates. I suspect s/key identifiers extension/key identifier extensions/. However as noted in [RFC6818], collision resistance is not a required property of one-way hash functions when used to generate key identifiers. Regardless, hash collisions are possible and if detected an operator should be alerted. The fact that "an operator should be alerted" suggests that if a hash collision happens it will cause an operational problem of some sort. What that problem is should be described and some bound stated for the amount of ensuing trouble. Conversely, if no operational problem can arise, then there is no reason to alert an operator. 7. IANA Considerations No IANA allocations are request of IANA, ... This should be "No IANA allocations are requested of IANA", or probably better "No allocations are requested of IANA". 9.2. Informative References Appendix A. ASN.1 Module id-kp OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) kp(3) } Is this correct? I believe this should be id-kp OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) } RFC 3029 has id-kp-dvcs OBJECT IDENTIFIER ::= {iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) 10} RFC 6494 has send-kp OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) } The IANA registry "smi-numbers" shows 1.3.6.1.5.5.7.3 as "Extended key purpose identifiers" with ...10 as "id-kp-dvcs". The IANA registry shows 1.3.6.1.5.5.3 as "PEM-Based IDUP Mechanism". Dale From nobody Thu Dec 15 05:05:38 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D69C5129DA8; Thu, 15 Dec 2016 05:05:36 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Roni Even To: X-Test-IDTracker: no X-IETF-IDTracker: 6.39.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148180713687.27658.2938123182879685300.idtracker@ietfa.amsl.com> Date: Thu, 15 Dec 2016 05:05:36 -0800 Archived-At: Cc: draft-ietf-sidr-bgpsec-ops.all@ietf.org, ietf@ietf.org, sidr@ietf.org Subject: [sidr] Review of draft-ietf-sidr-bgpsec-ops-12 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 13:05:37 -0000 Reviewer: Roni Even Review result: Almost Ready I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at . Please resolve these comments along with any other Last Call comments you may receive. Document: draft-ietf-sidr-bgpsec-ops-12 Reviewer: Roni Even Review Date:2016-12-15 IETF LC End Date: 2016–12-22 IESG Telechat date: Summary: This draft is almost ready for publication as a BCP RFC. Major issues: Minor issues: Nits/editorial comments: I think the document need an editorial review, a lot of text in passive language, for example third paragraph in section 1 "BGPsec needs to be spoken only by an AS's eBGP speaking, AKA border, routers, and is designed so that it can be used to protect announcements which are originated by resource constrained edge routers." is written in passive language and it is also a long sentence. From nobody Thu Dec 15 05:16:14 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49EF3129C9B; Thu, 15 Dec 2016 05:16:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.796 X-Spam-Level: X-Spam-Status: No, score=-4.796 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-2.896] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qLcJtX5LUXDe; Thu, 15 Dec 2016 05:15:59 -0800 (PST) Received: from p130.piuha.net (p130.piuha.net [193.234.218.130]) by ietfa.amsl.com (Postfix) with ESMTP id 2095C1295DF; Thu, 15 Dec 2016 05:15:59 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id 581152CCAE; Thu, 15 Dec 2016 15:15:58 +0200 (EET) (envelope-from jari.arkko@piuha.net) X-Virus-Scanned: amavisd-new at piuha.net Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MYmqSgAHZqvj; Thu, 15 Dec 2016 15:15:57 +0200 (EET) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2a00:1d50:2::130]) by p130.piuha.net (Postfix) with ESMTP id 72F042CC95; Thu, 15 Dec 2016 15:15:53 +0200 (EET) (envelope-from jari.arkko@piuha.net) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: multipart/signed; boundary="Apple-Mail=_D43B5FC2-1CCC-4E98-878A-9ED0FA912B82"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail From: Jari Arkko In-Reply-To: <148140757610.3742.18377844934799246064.idtracker@ietfa.amsl.com> Date: Thu, 15 Dec 2016 15:15:52 +0200 Message-Id: References: <148140757610.3742.18377844934799246064.idtracker@ietfa.amsl.com> To: Ralph Droms X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: draft-ietf-sidr-origin-validation-signaling.all@ietf.org, gen-art@ietf.org, ietf@ietf.org, sidr@ietf.org Subject: Re: [sidr] [Gen-art] Review of draft-ietf-sidr-origin-validation-signaling-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 13:16:02 -0000 --Apple-Mail=_D43B5FC2-1CCC-4E98-878A-9ED0FA912B82 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii Thank you for your review(s) of this doc, Ralph! Jari --Apple-Mail=_D43B5FC2-1CCC-4E98-878A-9ED0FA912B82 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYUpeIAAoJEM80gCTQU46qlc4QAKLVd/DZeyTEVBu73WSSJsOp yd8nR1Dp5cEFnaGr8sbHuZfw/wFp6h+dvdvXRk5Qbwg60Iz4rRgTkgmtfUVKBGbf N+PABo2wgkcOwr3vtrHZlcbRP/hbbFJ+64TOum/XtRcag/SXm/S6WM5CiUU563Cz iao88l45DdlfodGIVcMmkI0pIMP+u+LEH5A0OuHf48M45tCVaje55qURw7f/kIz8 6g+BAw7eS/DtAzhTi/qwNbPwqA4AEfUXKnF6se1TmwONPuMiuAgAu7Ou5zSfv/6k 5rzAj53qKy+HDG0bbp4yIkBhnvUI3WhQcAVnmKcg9D8PSPBy+jm/LjBKTX8pODT7 u7Cht/aOAcZS4LW3WRmolSyM9EMNRs16KdH/TMMLn/0MVb97bzoyIrt+dR/hKuln wi6DzmHkXpQGGE5kpqAPT3oK9UkSucrnr754cYwlN0hpdkt2/7z1OT9TGBJCGsRn uqs4Pk/i4bvlpXlXyydKWj3amArRKD9BrN/CRsJCYxPn5rqxYyM5g5AJ3qNgK7Wt yVKtTQeWQhf7GIcovZlhrxsx/cJrhi5SiBctOVdYwaGAOzkcilZ85xGhbk2pL1/4 CpdQT9g/8DtvOtvzyuNrwAm72EPsEgnelGsGiHkaYXC301QIWt+hLC1Tg7pGgnM8 ya5BxUb2/16IDQDYv+Ch =YvC4 -----END PGP SIGNATURE----- --Apple-Mail=_D43B5FC2-1CCC-4E98-878A-9ED0FA912B82-- From nobody Thu Dec 15 08:09:32 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6252129731; Thu, 15 Dec 2016 08:09:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.417 X-Spam-Level: X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZDlHBLgzS_Nz; Thu, 15 Dec 2016 08:09:25 -0800 (PST) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC50012A00C; Thu, 15 Dec 2016 08:09:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=13804; q=dns/txt; s=iport; t=1481818162; x=1483027762; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=clScRdO0JjapLMjU/nXxmQgMbbwGO0SgKKKBVVXsn/Y=; b=eOylZsqrUa8odXGxr2d/x9JvkfV24QmthMjsmSBKsVcCcK0S67KNzZLD lwIFAUG3o+Z/oT4swslWRcVZ8zBVPpJiZSk6ZynzHRmyAoEO2hxG5iT// 7tZTlwfBNVNUgUaBIQCTH3ICFd1FMK273sjrl6bZOuIhjK3V+mcGtxi9B s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AqAQAGv1JY/4gNJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgnNEAQEBAQEfWoEGB41HllePZoUkggmGIgIagWw/FAECAQEBAQE?= =?us-ascii?q?BAWIohGkBAQMBEhFWBQsCAQYCQgICAjAlAgQBDQUbB4hBCItOj1UBjXaCKC+KY?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBAQEBAR2GNoF9glyHRC2CMAWVAIVsAZEygXSFAYl?= =?us-ascii?q?WkiIBHzeBIjgBAYNDHBiBRXKHX4ENAQEB?= X-IronPort-AV: E=Sophos;i="5.33,352,1477958400"; d="scan'208,217";a="183693665" Received: from alln-core-3.cisco.com ([173.36.13.136]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 15 Dec 2016 16:09:21 +0000 Received: from XCH-ALN-004.cisco.com (xch-aln-004.cisco.com [173.36.7.14]) by alln-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id uBFG9LeG013645 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 15 Dec 2016 16:09:21 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-004.cisco.com (173.36.7.14) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 15 Dec 2016 10:09:21 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Thu, 15 Dec 2016 10:09:21 -0600 From: "Alvaro Retana (aretana)" To: "Sriram, Kotikalapudi (Fed)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" Thread-Topic: Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) Thread-Index: AQHSUmenE2EHhTbiU0q7IXrD4ZYx2aEF0Iz4gAN2lwA= Date: Thu, 15 Dec 2016 16:09:21 +0000 Message-ID: <98186E08-8CAC-4EB0-9E84-BBABACC43678@cisco.com> References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1c.0.161115 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_98186E088CAC4EB09E84BBABACC43678ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 16:09:31 -0000 --_000_98186E088CAC4EB09E84BBABACC43678ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gMTIvMTMvMTYsIDc6MjYgQU0sICJTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSIgPGtvdGlr YWxhcHVkaS5zcmlyYW1AbmlzdC5nb3Y+IHdyb3RlOg0KDQoNCg0KPiBbU3JpcmFtLTNdIEkgdW5k ZXJzdGFuZCBub3cgeW91ciBtYWluIGNvbW1lbnQgYWJvdXQgY29uZmVkZXJhdGlvbi4gSSB0aGlu ayB0aGVyZSBhcmUNCg0KPiB0d28gd2F5cyB0byBhZGRyZXNzIGl0IChvZiBjb3Vyc2UgSSBob3Bl IG90aGVyIHBlb3BsZSBjaGltZSBpbiBhcyB3ZWxsKToNCg0KPg0KDQo+IENob2ljZSBBOiBUaGUg cENvdW50ID0gMCBzb2x1dGlvbiB0aGF0IHlvdSBoYXZlIHN1Z2dlc3RlZC4NCg0KPg0KDQo+IEJ1 dCBJIGZlZWwgdGhhdCB0aGlzIGlzIHNvbWV3aGF0IGEgY29zbWV0aWMgc29sdXRpb24uIEluIHlv dXIgZXhhbXBsZSwgaXQgY2FuIGJlIHBlcmhhcHMNCg0KPiBxdWVzdGlvbmVkIHdoZXRoZXIgdGhl IHNpZ25hdHVyZSB3aXRoIHBDb3VudCA9IDAgZnJvbSBBUzIgdG8gQVM2NTAwMSBkb2VzIGFjdHVh bGx5IGZpdA0KDQo+IHRoZSBzZWN1cml0eSBndWFyYW50ZWUgZnJvbSBTZWN0aW9uIDguMSB0aGF0 IHlvdeKAmXZlIGNpdGVkLiAgQmVjYXVzZSBBUzIgKHRoZSBBUyB3aXRoIHRoZQ0KDQo+IHB1Ymxp YyBBU04pIGRpZCBub3QgcHJvZHVjZSB0aGF0IHNpZ25hdHVyZSBkaXJlY3RseS4gSW5zdGVhZCBB UzY1MDAxIHBsYXllZCBwcm94eSBmb3INCg0KPiBBUzIgLS0gd2hpY2ggaXMgb2YgY291cnNlIHBh cnQgb2YgdGhlIG9yaWdpbmFsIHNvbHV0aW9uIGFueXdheS4gU28gd2UgbWF5IGNvbnNpZGVyIGNo b2ljZQ0KDQo+IEIgYmVsb3cuDQoNCg0KDQpXZWxsLCB0aGUgUEUgd2l0aCBib3RoIEFTMiBhbmQg QVM2NTAwMSAqaXMqIGJvdGggQVMyICphbmQqIEFTNjUwMDHigKZzbyBJIGRvbuKAmXQgc2VlIGl0 IGFzIGEgcHJveHkuDQoNCg0KDQo+IENob2ljZSBCOiBJbmNsdWRlIGEgY2F2ZWF0IHRvIHRoZSBz dGF0ZW1lbnQgaW4gU2VjdGlvbiA4LjEuIEZvciBpbnN0YW5jZSwgd2UgbW9kaWZ5IGl0IGFzDQoN Cj4gZm9sbG93czoNCg0KPg0KDQo+IEZvciBlYWNoIEFTIGluIHRoZSBwYXRoLCBhIEJHUHNlYyBz cGVha2VyIGF1dGhvcml6ZWQgYnkgdGhlIGhvbGRlcg0KDQo+ICAgICAgb2YgdGhlIEFTIG51bWJl ciBpbnRlbnRpb25hbGx5IGNob3NlIChpbiBhY2NvcmRhbmNlIHdpdGggbG9jYWwNCg0KPiAgICAg IHBvbGljeSkgdG8gcHJvcGFnYXRlIHRoZSByb3V0ZSBhZHZlcnRpc2VtZW50IHRvIHRoZSBzdWJz ZXF1ZW50IEFTDQoNCj4gICAgICBpbiB0aGUgcGF0aCAoZXhjZXB0IGZvciBhIG1pbm9yIGNhdmVh dCB0aGF0IGFwcGxpZXMgaW4gdGhlIGNhc2Ugb2YgQkdQc2VjIHNwZWFrZXJzDQoNCj4gICAgICAg aW4gYSAgY29uZmVkZXJhdGlvbikuIFRoZSBjYXZlYXQgYXBwbGllcyBiZWNhdXNlIGEgQkdQc2Vj IHNwZWFrZXINCg0KPiAgICAgICBpbiBhIGNvbmZlZGVyYXRpb24tbWVtYmVyIEFTIGNhbiBiZSBh IHByb3h5IHJlY2VpdmVyIGFuZCBzaWduZXIgZm9yIHRoZSBwdWJsaWMgQVMNCg0KPiAgICAgICAo aWRlbnRpZmllZCBieSB0aGUgcHVibGljIEFTIG51bWJlciBvZiB0aGUgY29uZmVkZXJhdGlvbiku IFRoZXJlZm9yZSwgYSBzaWduYXR1cmUgdGhhdCA+IGFwcGVhcnMgdG8NCg0KPiAgICAgIGNvcnJl c3BvbmQgdG8gYW4gQVMgd2l0aCB0aGUgcHVibGljIEFTIG51bWJlciBtYXkgYWN0dWFsbHkNCg0K PiAgICAgIGJlIHByb3h5IHByb2R1Y2VkIGJ5IGEgbWVtYmVyIEFTIHRoYXQgaGFzIGFuIGludGVy bmFsIEFTIG51bWJlcg0KDQo+ICAgICAgbm90IG1hdGNoaW5nIHRoZSBwdWJsaWMgQVMgbnVtYmVy LiBUaGUgY29uZmVkZXJhdGlvbi1tZW1iZXIgQVNlcw0KDQo+ICAgICAgYXJlIGNvZ25pemFudCBv ZiB0aGlzIGFuZCBoZW5jZSBpdCBwb3NlcyBubyBzZWN1cml0eSBjb25jZXJuDQoNCj4gICAgICB3 aXRoaW4gdGhlIGNvbmZlZGVyYXRpb24sIGFuZCBpdCBpcyB0cmFuc3BhcmVudCB0byBBU2VzIG91 dHNpZGUNCg0KPiAgICAgIHRoZSBjb25mZWRlcmF0aW9uIChzZWUgU2VjdGlvbiA0LjMpLg0KDQo+ DQoNCj4gW1NyaXJhbS0zXSBEbyB5b3UgZmVlbCBDaG9pY2UgQiBtYWtlcyBzZW5zZT8NCg0KDQoN ClBlcnNvbmFsbHksIEkgZG9u4oCZdCBsaWtlIENob2ljZSBCIGJlY2F1c2UgaXQgcmVhZHM6IOKA nHdlIGd1YXJhbnRlZSBYLCBleGNlcHQgaW4gYSBzY2VuYXJpbyB3aGVyZSB0aGUgc2lnbmF0dXJl cyBhcmUgbm90IHdoYXQgdGhleSBzZWVt4oCd4oCmICAgSXQgZG9lc27igJl0IGdpdmUgbWUgYSB3 YXJtIGEgZnV6enkgZmVlbGluZywgZXNwZWNpYWxseSB3aGVuIHdl4oCZcmUgdGFsa2luZyBhYm91 dCBhIHNlY3VyaXR5LXJlbGF0ZWQgZG9jdW1lbnQuDQoNCg0KDQpUaGlzIGlzIHdoZXJlIEkgd291 bGQgbGlrZSB0aGUgQ2hhaXJzL3Jlc3Qgb2YgdGhlIFdHIHRvIHBpdGNoIGluLg0KDQoNCg0K4oCm DQoNCj4gW1NyaXJhbS0zXSAgUGVyaGFwcyBJIHNob3VsZCB3YWl0IGZvciBzb21lIG1vcmUgSUVT RyBMQyByZXZpZXdzIHRvIHJvbGwgaW4gYmVmb3JlIEkgaW5jbHVkZQ0KDQo+IHRoaXMgc2V0IG9m IGNoYW5nZXMgYW5kIHRob3NlIGZyb20gUnVzcyAoR2VuLUFSVCkgYW5kIE5ldmlsIChPUFMtRElS KT8gUGxlYXNlIGFkdmlzZS4NCg0KDQoNClRoZSBJRVRGIExDIGVuZHMgdG9tb3Jyb3cuICBJbmNs dWRlIHRoZSBjaGFuZ2VzIHdpdGggYW55dGhpbmcgeW91IHJlY2VpdmUgYnkgdG9tb3Jyb3cuDQoN Cg0KDQpUaGFua3MhDQoNCg0KDQpBbHZhcm8uDQo= --_000_98186E088CAC4EB09E84BBABACC43678ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <24D5149CC90A12469DD22308FE3B1741@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpwLk1zb1BsYWluVGV4dCwgbGkuTXNvUGxhaW5UZXh0LCBkaXYuTXNvUGxhaW5UZXh0DQoJe21z by1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCBDaGFyIjsN CgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KcA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJ bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsN Cglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndp bmRvd3RleHQ7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCnNw YW4uUGxhaW5UZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiUGxhaW4gVGV4dCBDaGFyIjsNCglt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IlBsYWluIFRleHQiOw0KCWZv bnQtZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5tc29JbnMNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTsN Cgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1v bmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41 aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9k eSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk9u IDEyLzEzLzE2LCA3OjI2IEFNLCAmcXVvdDtTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSZxdW90 OyAmbHQ7a290aWthbGFwdWRpLnNyaXJhbUBuaXN0LmdvdiZndDsgd3JvdGU6PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPiZndDsgW1NyaXJhbS0zXSBJIHVuZGVyc3RhbmQgbm93IHlvdXIg bWFpbiBjb21tZW50IGFib3V0IGNvbmZlZGVyYXRpb24uJm5ic3A7SSB0aGluayB0aGVyZSBhcmUN CjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgdHdvIHdheXMgdG8gYWRkcmVzcyBp dCAob2YgY291cnNlIEkgaG9wZSBvdGhlciBwZW9wbGUgY2hpbWUgaW4gYXMgd2VsbCk6PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IENob2ljZSBBOiBUaGUgcENvdW50ID0g MCBzb2x1dGlvbiB0aGF0IHlvdSBoYXZlIHN1Z2dlc3RlZC4NCjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+Jmd0OyBCdXQgSSBmZWVsIHRoYXQgdGhpcyBpcyBzb21ld2hhdCBhIGNv c21ldGljIHNvbHV0aW9uLiBJbiB5b3VyIGV4YW1wbGUsIGl0IGNhbiBiZSBwZXJoYXBzDQo8L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHF1ZXN0aW9uZWQgd2hldGhlciB0aGUgc2ln bmF0dXJlIHdpdGggcENvdW50ID0gMCBmcm9tIEFTMiB0byBBUzY1MDAxIGRvZXMgYWN0dWFsbHkg Zml0DQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHRoZSBzZWN1cml0eSBndWFy YW50ZWUgZnJvbSBTZWN0aW9uIDguMSB0aGF0IHlvdeKAmXZlIGNpdGVkLiZuYnNwOyBCZWNhdXNl IEFTMiAodGhlIEFTIHdpdGggdGhlDQo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7 IHB1YmxpYyBBU04pIGRpZCBub3QgcHJvZHVjZSB0aGF0IHNpZ25hdHVyZSBkaXJlY3RseS4gSW5z dGVhZCBBUzY1MDAxIHBsYXllZCBwcm94eSBmb3INCjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZndDsgQVMyIC0tIHdoaWNoIGlzIG9mIGNvdXJzZSBwYXJ0IG9mIHRoZSBvcmlnaW5hbCBz b2x1dGlvbiBhbnl3YXkuIFNvIHdlIG1heSBjb25zaWRlciBjaG9pY2UNCjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPiZndDsgQiBiZWxvdy4mbmJzcDsmbmJzcDsmbmJzcDsgPC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij5XZWxsLCB0aGUgUEUgd2l0aCBib3RoIEFTMiBhbmQgQVM2NTAwMSAqPGI+aXM8 L2I+KiBib3RoIEFTMiAqPGI+YW5kPC9iPiogQVM2NTAwMeKApnNvIEkgZG9u4oCZdCBzZWUgaXQg YXMgYSBwcm94eS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBDaG9pY2UgQjog SW5jbHVkZSBhIGNhdmVhdCB0byB0aGUgc3RhdGVtZW50IGluIFNlY3Rpb24gOC4xLiBGb3IgaW5z dGFuY2UsIHdlIG1vZGlmeSBpdCBhcw0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0 OyBmb2xsb3dzOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBGb3IgZWFj aCBBUyBpbiB0aGUgcGF0aCwgYSBCR1BzZWMgc3BlYWtlciBhdXRob3JpemVkIGJ5IHRoZSBob2xk ZXI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgb2YgdGhlIEFTIG51bWJlciBpbnRlbnRpb25hbGx5IGNob3Nl IChpbiBhY2NvcmRhbmNlIHdpdGggbG9jYWw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPiZndDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgcG9saWN5KSB0byBw cm9wYWdhdGUgdGhlIHJvdXRlIGFkdmVydGlzZW1lbnQgdG8gdGhlIHN1YnNlcXVlbnQgQVM8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgaW4gdGhlIHBhdGggKGV4Y2VwdCBmb3IgYSBtaW5vciBjYXZlYXQgdGhh dCBhcHBsaWVzIGluIHRoZSBjYXNlIG9mIEJHUHNlYyBzcGVha2Vycw0KPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwO2luIGEmbmJzcDsgY29uZmVkZXJhdGlvbikuIFRoZSBjYXZlYXQgYXBwbGllcyBi ZWNhdXNlIGEgQkdQc2VjIHNwZWFrZXINCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jmd0OyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtpbiBhIGNv bmZlZGVyYXRpb24tbWVtYmVyIEFTIGNhbiBiZSBhIHByb3h5IHJlY2VpdmVyIGFuZCBzaWduZXIg Zm9yIHRoZSBwdWJsaWMgQVMNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jmd0OyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsoaWRlbnRpZmllZCBi eSB0aGUgcHVibGljIEFTIG51bWJlciBvZiB0aGUgY29uZmVkZXJhdGlvbikuIFRoZXJlZm9yZSwg YSBzaWduYXR1cmUgdGhhdCAmZ3Q7IGFwcGVhcnMgdG88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPiZndDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Y29ycmVz cG9uZCB0byBhbiBBUyB3aXRoIHRoZSBwdWJsaWMgQVMgbnVtYmVyIG1heSBhY3R1YWxseTxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyAmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDtiZSBwcm94eSBwcm9kdWNlZCBieSBhIG1lbWJlciBBUyB0aGF0IGhhcyBh biBpbnRlcm5hbCBBUyBudW1iZXINCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+Jmd0OyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtub3QgbWF0Y2hpbmcgdGhl IHB1YmxpYyBBUyBudW1iZXIuIFRoZSBjb25mZWRlcmF0aW9uLW1lbWJlciBBU2VzDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgJm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7YXJlIGNvZ25pemFudCBvZiB0aGlzIGFuZCBoZW5jZSBpdCBwb3NlcyBubyBz ZWN1cml0eSBjb25jZXJuDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZndDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d2l0aGluIHRoZSBjb25mZWRlcmF0 aW9uLCBhbmQgaXQgaXMgdHJhbnNwYXJlbnQgdG8gQVNlcyBvdXRzaWRlDQo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7dGhlIGNvbmZlZGVyYXRpb24gKHNlZSBTZWN0aW9uIDQuMykuIDxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBbU3JpcmFtLTNdIERvIHlvdSBmZWVsIENob2ljZSBC IG1ha2VzIHNlbnNlPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5QZXJzb25hbGx5LCBJ IGRvbuKAmXQgbGlrZSBDaG9pY2UgQiBiZWNhdXNlIGl0IHJlYWRzOiDigJx3ZSBndWFyYW50ZWUg WCwgZXhjZXB0IGluIGEgc2NlbmFyaW8gd2hlcmUgdGhlIHNpZ25hdHVyZXMgYXJlIG5vdCB3aGF0 IHRoZXkgc2VlbeKAneKApiZuYnNwOyZuYnNwOyBJdCBkb2VzbuKAmXQgZ2l2ZSBtZSBhIHdhcm0g YSBmdXp6eSBmZWVsaW5nLCBlc3BlY2lhbGx5IHdoZW4gd2XigJlyZSB0YWxraW5nIGFib3V0IGEg c2VjdXJpdHktcmVsYXRlZA0KIGRvY3VtZW50LjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+VGhpcyBpcyB3 aGVyZSBJIHdvdWxkIGxpa2UgdGhlIENoYWlycy9yZXN0IG9mIHRoZSBXRyB0byBwaXRjaCBpbi48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+4oCmJm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IFtTcmlyYW0tM10mbmJzcDsgUGVyaGFwcyBJIHNo b3VsZCB3YWl0IGZvciBzb21lIG1vcmUgSUVTRyBMQyByZXZpZXdzIHRvIHJvbGwgaW4gYmVmb3Jl IEkgaW5jbHVkZQ0KPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGlzIHNldCBv ZiBjaGFuZ2VzIGFuZCB0aG9zZSBmcm9tIFJ1c3MgKEdlbi1BUlQpIGFuZCBOZXZpbCAoT1BTLURJ Uik/IFBsZWFzZSBhZHZpc2UuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPlRoZSBJRVRG IExDIGVuZHMgdG9tb3Jyb3cuJm5ic3A7IEluY2x1ZGUgdGhlIGNoYW5nZXMgd2l0aCBhbnl0aGlu ZyB5b3UgcmVjZWl2ZSBieSB0b21vcnJvdy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ VGhhbmtzITxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5BbHZhcm8uPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_98186E088CAC4EB09E84BBABACC43678ciscocom_-- From nobody Fri Dec 16 13:55:37 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AEE7D128BA2; Fri, 16 Dec 2016 13:55:35 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.40.1 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <148192533567.14796.9026681450369742744.idtracker@ietfa.amsl.com> Date: Fri, 16 Dec 2016 13:55:35 -0800 Archived-At: Cc: Chris Morrow , sidr-chairs@ietf.org, draft-ietf-sidr-publication@ietf.org, sidr@ietf.org Subject: [sidr] Last Call: (A Publication Protocol for the Resource Public Key Infrastructure (RPKI)) to Proposed Standard X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Reply-To: ietf@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Dec 2016 21:55:36 -0000 The IESG has received a request from the Secure Inter-Domain Routing WG (sidr) to consider the following document: - 'A Publication Protocol for the Resource Public Key Infrastructure (RPKI)' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2017-01-06. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document defines a protocol for publishing Resource Public Key Infrastructure (RPKI) objects. Even though the RPKI will have many participants issuing certificates and creating other objects, it is operationally useful to consolidate the publication of those objects. This document provides the protocol for doing so. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-sidr-publication/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-sidr-publication/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Sat Dec 17 10:26:27 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78F4C129A60 for ; Sat, 17 Dec 2016 10:26:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=instituut-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bYLefpjHYWJK for ; Sat, 17 Dec 2016 10:26:16 -0800 (PST) Received: from mail-wj0-x229.google.com (mail-wj0-x229.google.com [IPv6:2a00:1450:400c:c01::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 553F4129A5D for ; Sat, 17 Dec 2016 10:26:14 -0800 (PST) Received: by mail-wj0-x229.google.com with SMTP id tk12so117941812wjb.3 for ; Sat, 17 Dec 2016 10:26:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=instituut-net.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=bX6zBfD8iEqJ5BTfXYkKnl8L81443CaQcrUnHgzKrAY=; b=XuoriYQinS2g97v+Sa+JDi2kP2firFLukFU1Q/r/cOqqY9zCCjJ8dKCEZviaFv2S5S kaqMnLynrcqSx3zN5LJQy4hEl6UJ1l+aK7rATpevFBgt5+XqOtfGs2hzKqnhtzDjGfQw gAy7qPIeHapuuIf3x+wQIOvOfxvGNLFrMli3RV2GN3DX8OS9QXJL8hvpHr6eM8noQRDC Z5H+/HWTA6rMW6ilvbb56kQly0wSbap63xpTm3hxS24s/uf8zezLHFMrdaViNG7+otH+ f7Ezg/IG/osjbOJ3Aqyo2YDXou3fFJBXf5NlJbA2EnQVZcU9pLhfELUw0yczQJHGW04e 27Ww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=bX6zBfD8iEqJ5BTfXYkKnl8L81443CaQcrUnHgzKrAY=; b=C1XmhpiOL+SS9CjHEzwywvAtf9FKmKcsJOTZbEsv5OAPZXHncz8GX2ukJJeWyKCJvn Wo5NaBKYgm5YfSqsUl+Al0zn3KuoOvhtpaDrAIFoJpHKlm5rIW5yaEFT7svceQA+Ncak 3f20txU+EUnjapVLXdnwTpfIU7hCq6ZRYZnb2Aj30Kvu9oY/psXUa8JRxAyi0uTk6v1J dAJw/Vbzmq293cAj77/ys4CNbIiqpU5tgysVw6rAe1+lwlAkD4JEyoAMvKyLQzmMuf2E AZW9HIUB0F2zheEWVAljundOHII6zgXjpXfUsq0iPhhBZ6Pj6CogpQrcWY1iSyCMOE19 c6Ww== X-Gm-Message-State: AKaTC03eLFVl5+p27c8i5MIoV/l1yVf7i5F3fB0gyng9SZwwRzIb+zlGpCcB+ejSYhuVxw== X-Received: by 10.194.146.131 with SMTP id tc3mr7781372wjb.129.1481999172649; Sat, 17 Dec 2016 10:26:12 -0800 (PST) Received: from localhost ([2001:67c:208c:10:b591:3f29:3ca8:f0b9]) by smtp.gmail.com with ESMTPSA id jm6sm12471778wjb.27.2016.12.17.10.26.11 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 17 Dec 2016 10:26:12 -0800 (PST) Date: Sat, 17 Dec 2016 19:26:10 +0100 From: Job Snijders To: ietf@ietf.org Message-ID: <20161217182610.GE1554@Vurt.local> References: <148112444860.13678.830966785604568036.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <148112444860.13678.830966785604568036.idtracker@ietfa.amsl.com> X-Clacks-Overhead: GNU Terry Pratchett User-Agent: Mutt/1.7.1 (2016-10-04) Archived-At: Cc: Chris Morrow , sidr-chairs@ietf.org, draft-ietf-sidr-bgpsec-ops@ietf.org, IETF-Announce , sidr@ietf.org Subject: Re: [sidr] Last Call: (BGPsec Operational Considerations) to Best Current Practice X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Dec 2016 18:26:17 -0000 Hi all, This following paragraph looks somewhat awkward to me. TEXT: An edge site which does not provide transit and trusts its upstream(s) SHOULD only originate a signed prefix announcement and need not validate received announcements. COMMENT: If you are multihomed and receive full (or partial) tables, there is benefit in validating the received routes, if not: why not? One upstream might be poisoned while the other isn't? Mabye the text should be amended to make it clear that this might apply if the stub ASN only takes default-originates? Kind regards, Job On Wed, Dec 07, 2016 at 07:27:28AM -0800, The IESG wrote: > > The IESG has received a request from the Secure Inter-Domain Routing WG > (sidr) to consider the following document: > - 'BGPsec Operational Considerations' > as Best Current Practice > > The IESG plans to make a decision in the next few weeks, and solicits > final comments on this action. Please send substantive comments to the > ietf@ietf.org mailing lists by 2016-12-21. Exceptionally, comments may be > sent to iesg@ietf.org instead. In either case, please retain the > beginning of the Subject line to allow automated sorting. > > Abstract > > > Deployment of the BGPsec architecture and protocols has many > operational considerations. This document attempts to collect and > present the most critical and universal. It is expected to evolve as > BGPsec is formalized and initially deployed. > > > > > > The file can be obtained via > https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-ops/ > > IESG discussion can be tracked via > https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-ops/ballot/ > > > No IPR declarations have been submitted directly on this I-D. > > > The document contains these normative downward references. > See RFC 3967 for additional information: > rfc6811: BGP Prefix Origin Validation (Proposed Standard - IETF stream) > draft-ietf-sidr-bgpsec-protocol: BGPsec Protocol Specification (None - IETF stream) > rfc6493: The Resource Public Key Infrastructure (RPKI) Ghostbusters Record (Proposed Standard - IETF stream) > Note that some of these references may already be listed in the acceptable Downref Registry. > > From nobody Sat Dec 17 10:30:25 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 069EB129A5B for ; Sat, 17 Dec 2016 10:30:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.001 X-Spam-Level: X-Spam-Status: No, score=-5.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d83LUtQKMahr for ; Sat, 17 Dec 2016 10:30:22 -0800 (PST) Received: from relay.kvm02.ops-netman.net (relay.kvm02.ops-netman.net [IPv6:2606:700:e:550:5c82:28ff:fe25:4960]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13C61129A58 for ; Sat, 17 Dec 2016 10:30:22 -0800 (PST) Received: from mail.ops-netman.net (mailserver.ops-netman.net [199.168.90.119]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by relay.kvm02.ops-netman.net (Postfix) with ESMTPS id E9BF13FEDB for ; Sat, 17 Dec 2016 18:30:20 +0000 (UTC) Received: from morrowc-glaptop4.roam.corp.google.com.ops-netman.net (c-69-138-171-9.hsd1.va.comcast.net [69.138.171.9]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mail.ops-netman.net (Postfix) with ESMTPSA id D417B72BFC58 for ; Sat, 17 Dec 2016 18:30:20 +0000 (UTC) Date: Sat, 17 Dec 2016 13:30:20 -0500 Message-ID: From: Chris Morrow To: sidr@ietf.org User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.3 Mule/6.0 (HANACHIRUSATO) Organization: Operations Network Management, Ltd. MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: [sidr] Reminder that sidr is closing out, sidrops is the new thing! X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Dec 2016 18:30:24 -0000 I haven't checked the mailing list membership set for sidrops yet, but.. if you are planning to keep on discussing this problem space you may consider joining 'sidrops@ietf.org' so we can keep on keepin' on. Sidrops mailing list info: archive: https://mailarchive.ietf.org/arch/browse/sidrops/ subscribe: https://www.ietf.org/mailman/listinfo/sidrops -chris From nobody Sat Dec 17 15:31:56 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBDB912949A; Sat, 17 Dec 2016 15:31:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.001 X-Spam-Level: X-Spam-Status: No, score=-10.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3WfS4T7CaHvI; Sat, 17 Dec 2016 15:31:50 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2EFF12948D; Sat, 17 Dec 2016 15:31:49 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cIOSB-0005gV-1c; Sat, 17 Dec 2016 23:31:47 +0000 Date: Sun, 18 Dec 2016 08:31:44 +0900 Message-ID: From: Randy Bush To: Job Snijders In-Reply-To: <20161217182610.GE1554@Vurt.local> References: <148112444860.13678.830966785604568036.idtracker@ietfa.amsl.com> <20161217182610.GE1554@Vurt.local> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: ietf@ietf.org, draft-ietf-sidr-bgpsec-ops@ietf.org, Chris Morrow , sidr-chairs@ietf.org, sidr@ietf.org, IETF-Announce Subject: Re: [sidr] Last Call: (BGPsec Operational Considerations) to Best Current Practice X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Dec 2016 23:31:51 -0000 hi job, > TEXT: > An edge site which does not provide transit and trusts its > upstream(s) SHOULD only originate a signed prefix announcement and > need not validate received announcements. > > COMMENT: > If you are multihomed and receive full (or partial) tables, there is > benefit in validating the received routes, if not: why not? One > upstream might be poisoned while the other isn't? Mabye the text > should be amended to make it clear that this might apply if the stub > ASN only takes default-originates? that is why it is SHOULD. and note it does say "and trusts its upstream(s)." going down the rat-hole of trusting upstreams differently seems an exercise in adding words but not adding value. note that doing path validation would pretty much mean the end site buys new hardware. pointing out that one could avoid that was the purpose of the paragraph. if i made any change, it would be a rant about out-sourcing security. e.g. "Note that this is out-sourcing security, which is generally unwise. But the trade-off is likely out-sourcing security or buying bigger hardware." randy From nobody Tue Dec 20 05:15:46 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C08A91296E5; Tue, 20 Dec 2016 05:15:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.621 X-Spam-Level: X-Spam-Status: No, score=-17.621 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Sx13XoKQREv; Tue, 20 Dec 2016 05:15:42 -0800 (PST) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDA771296ED; Tue, 20 Dec 2016 05:15:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=36838; q=dns/txt; s=iport; t=1482239738; x=1483449338; h=from:to:cc:subject:date:message-id:mime-version; bh=V0si8uFWAu4ouQLItpivC9gRxUnLYxKqrELMTJRv/68=; b=dNl+S1PQL2shxtHcLrkST0XewKyoTRqH1ioEhbylyqyiUGavgsQ9sP4M bZBwCRr+KpI3rhnLsJ406PEkQod1Az6+SIsrsUZqjMPMFyOcI+SzrgCAg dIJMBEnnM1AyZLYcfNnlT1NNioLXljUp4XMfjWLGS+QBMFvu9k1TsoN1s 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AaAQClLllY/4cNJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgnNEAQEBAQEfWoENjUmraIIKhiIcgWc/FAECAQEBAQEBAWIdC4R?= =?us-ascii?q?rBBIRTwcSAQY6CgIEMCcEDieISYwoj1UBjEcPgSCCKC+KaQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAR2GNoF9CIZ+AoMYLYIwBYhzh1CEQIVtAYljh1CBdIUDiVaHcIo?= =?us-ascii?q?3AR83gSY7AYNRHIFdhygBJAeBA4ENAQEB?= X-IronPort-AV: E=Sophos;i="5.33,378,1477958400"; d="scan'208,217";a="183642423" Received: from alln-core-2.cisco.com ([173.36.13.135]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 20 Dec 2016 13:15:37 +0000 Received: from XCH-ALN-003.cisco.com (xch-aln-003.cisco.com [173.36.7.13]) by alln-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id uBKDFbwD026405 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 20 Dec 2016 13:15:37 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-003.cisco.com (173.36.7.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 20 Dec 2016 07:15:36 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Tue, 20 Dec 2016 07:15:36 -0600 From: "Alvaro Retana (aretana)" To: "draft-ietf-sidr-delta-protocol@ietf.org" Thread-Topic: AD Review of draft-ietf-sidr-delta-protocol-04 Thread-Index: AQHSWsMmv8FEfthKGUScz+TLnYEy7A== Date: Tue, 20 Dec 2016 13:15:36 +0000 Message-ID: <7DE58D01-AC82-4099-9A46-99E625315637@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1d.0.161209 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_7DE58D01AC8240999A4699E625315637ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "sidr@ietf.org" Subject: [sidr] AD Review of draft-ietf-sidr-delta-protocol-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 13:15:45 -0000 --_000_7DE58D01AC8240999A4699E625315637ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RGVhciBhdXRob3JzOg0KDQpIaSEgIEkganVzdCBmaW5pc2hlZCByZWFkaW5nIHRoaXMgZG9jdW1l bnQuDQoNCkkgaGF2ZSBzZXZlcmFsIGNvbW1lbnRzIChwbGVhc2Ugc2VlIGJlbG93KTsgSSBtYXJr ZWQgbWFueSBvZiB0aGVtIGFzIOKAnE1ham9y4oCdLCBzb21lIGJlY2F1c2Ugb2YgdGhlIHVzZSBv ZiBOb3JtYXRpdmUgbGFuZ3VhZ2UsIGJ1dCBteSBtYWluIGNvbmNlcm4gaXMgdGhhdCBJIHRoaW5r IGVycm9yIGNvbmRpdGlvbnMgaW4gdGhlIHByb3RvY29sIGFyZSB1bmRlcnNwZWNpZmllZCAoc2Vl IE03LCBNOCwgTTEwLCBiZWxvdykuICBBbG9uZyB0aGUgc2FtZSBsaW5lcywgSSB0aGluayB0aGF0 IGFuIE9wZXJhdGlvbnMgQ29uc2lkZXJhdGlvbnMgc2VjdGlvbiB3b3VsZCBiZSBvZiBiZW5lZml0 IChzZWUgTTggYmVsb3cpOyB5b3UgbWlnaHQgYWxzbyB3YW50IHRvIHRha2UgYSBsb29rIGF0IFJG QzU3MDYgKEd1aWRlbGluZXMgZm9yIENvbnNpZGVyaW5nIE9wZXJhdGlvbnMgYW5kIE1hbmFnZW1l bnQgb2YgTmV3IFByb3RvY29scyBhbmQgUHJvdG9jb2wgRXh0ZW5zaW9ucykuDQoNCkkgd291bGQg bGlrZSB0byBzZWUgdGhlIGVycm9yIGNvbmRpdGlvbnMgY29tbWVudHMgYWRkcmVzc2VkIGJlZm9y ZSBtb3ZpbmcgdGhpcyBkb2N1bWVudCBmb3J3YXJkIHRvIElFVEYgTGFzdCBDYWxsLg0KDQpUaGFu a3MhIQ0KDQpBbHZhcm8uDQoNCg0KTWFqb3I6DQoNCk0xLiAgSSBhc3N1bWUgdGhhdCB0aGUgaWQt YWQtcnBraU5vdGlmeSB2YWx1ZSB3YXMgYXNzaWduZWQgdGhyb3VnaCB0aGUgZWFybHkgYWxsb2Nh dGlvbiBwcm9jZXNzLiAgSW5zdGVhZCBvZiBwb2ludGluZyBhdCB0aGUgcmVnaXN0cnkgaW4gU2Vj dGlvbiAzLjIsIHBvaW50IGF0IHRoZSBJQU5BIENvbnNpZGVyYXRpb24gU2VjdGlvbiAtLS0gYW5k IHRoZXJlLCBwbGVhc2UgcmVtaW5kIElBTkEgb2YgdGhlIGVhcmx5IGFsbG9jYXRpb24gYW5kIHJl cXVlc3QgdGhlIHVwZGF0ZS4NCg0KTTIuIFNlY3Rpb24gMy4yLiAoQ2VydGlmaWNhdGUgQXV0aG9y aXR5IFVzZSk6IOKAnFJlbHlpbmcgUGFydGllcyB0aGF0IGRvIG5vdCBzdXBwb3J0IHRoaXMgZGVs dGEgcHJvdG9jb2wgTVVTVCBOT1QgcmVqZWN0IGEgQ0EgY2VydGlmaWNhdGUgbWVyZWx5IGJlY2F1 c2UgaXQgaGFzIGFuIFNJQSBleHRlbnNpb24gY29udGFpbmluZyB0aGlzIG5ldyBraW5kIG9mIEFj Y2Vzc0Rlc2NyaXB0aW9uLuKAnSAgQnkgZGVmaW5pdGlvbiwgYW4gUlAgdGhhdCBoYXMgbmV2ZXIg ZXZlbiBjb25zaWRlcmVkIHRoaXMgZG9jdW1lbnQgd2lsbCBub3Qgc3VwcG9ydCB0aGUgZGVsdGEg cHJvdG9jb2wg4oCTIElPVywgdHJ5aW5nIHRvIHNwZWNpZnkgdGhlIGJlaGF2aW9yIG9mIFJQcyB0 aGF0IG1heSBoYXZlIG5ldmVyIGV2ZW4gc2VlbiB0aGlzIGRvY3VtZW50IG1ha2VzIG5vIHNlbnNl IHRvIG1lLCBhbmQgY2Fu4oCZdCBiZSBlbmZvcmNlZC4gIFdoYXQgaXMgdGhlIGN1cnJlbnQgYmVo YXZpb3Igd2hlbiBhbiBSUCByZWNlaXZlcyB0aGUgZXh0cmEgU0lBIGV4dGVuc2lvbj8NCg0KTTMu IFNlY3Rpb24gMy4zLjIuIChQdWJsaXNoaW5nIFVwZGF0ZXMpOiDigJxXaGVuZXZlciB0aGUgcmVw b3NpdG9yeSBzZXJ2ZXIgcmVjZWl2ZXMgdXBkYXRlcyBmcm9tIGEgQ0EgaXQgU0hPVUxEIGdlbmVy YXRlIG5ldyBzbmFwc2hvdCBhbmQgZGVsdGEgZmlsZXMuICBIb3dldmVyLCBpZiBhIHB1YmxpY2F0 aW9uIHNlcnZlciBzZXJ2aWNlcyBhIGxhcmdlIG51bWJlciBvZiBDQXMgaXQgTUFZIGNob29zZSB0 byBjb21iaW5lIHVwZGF0ZXMgZnJvbSBtdWx0aXBsZSBDQXMuICBJZiBhIHB1YmxpY2F0aW9uIHNl cnZlciBjb21iaW5lcyB1cGRhdGVzIGluIHRoaXMgd2F5LCBpdCBNVVNUIE5PVCBwb3N0cG9uZSBw dWJsaXNoaW5nIGZvciBsb25nZXIgdGhhbiBvbmUgbWludXRlLuKAnSAgVGhlIOKAnE1VU1QgTk9U 4oCdIGF0IHRoZSBlbmQgKG1ha2luZyBpdCBtYW5kYXRvcnkgdG8gcHVibGlzaCkgZG9lc27igJl0 IHdvcmsgd2l0aCB0aGUg4oCcU0hPVUxE4oCdIGF0IHRoZSBiZWdpbm5pbmcsIHdoaWNoIGhhcyBu byB0aW1lIGNvbnN0cmFpbnQgYW5kIG9wZW5zIHRvIHRoZSBkb29yIHRvIGEgc2l0dWF0aW9uIHdo ZXJlIG5vIHB1Ymxpc2hpbmcgaXMgZG9uZS4gIFN1Z2dlc3Rpb246DQpORVc+DQogIFdoZW5ldmVy IHRoZSByZXBvc2l0b3J5IHNlcnZlciByZWNlaXZlcyB1cGRhdGVzIGZyb20gYSBDQSBpdCBNVVNU DQogICBnZW5lcmF0ZSBuZXcgc25hcHNob3QgYW5kIGRlbHRhLiAgSWYgYSBwdWJsaWNhdGlvbg0K ICAgc2VydmVyIHNlcnZpY2VzIGEgbGFyZ2UgbnVtYmVyIG9mIENBcyBpdCBNQVkgY2hvb3NlIHRv IGNvbWJpbmUNCiAgIHVwZGF0ZXMgZnJvbSBtdWx0aXBsZSBDQXMsIGJ1dCBpdCBNVVNUIE5PVCBw b3N0cG9uZSBwdWJsaXNoaW5nIGZvciBsb25nZXIgdGhhbiBvbmUNCiAgIG1pbnV0ZS4NCg0KTTQu IEZyb20gMy4zLjIuIChQdWJsaXNoaW5nIFVwZGF0ZXMpOiDigJxUaGUgdXBkYXRlIG5vdGlmaWNh dGlvbiBmaWxlIFNIT1VMRCBiZSBrZXB0IHNtYWxs4oCmb2xkZXIgZGVsdGEgZmlsZXMgdGhhdOKA pndpbGwgcmVzdWx0IGluIHRvdGFsIHNpemUgb2YgZGVsdGFzIGV4Y2VlZGluZyB0aGUgc2l6ZSBv ZiB0aGUgc25hcHNob3QsIE1VU1QgYmUgZXhjbHVkZWQu4oCdICBIZXJlIHRoZSDigJxTSE9VTETi gJ0gYW5kIHRoZSDigJxNVVNU4oCdIGFyZSBpbiBjb250cmFkaWN0aW9uOiB5b3UgZWl0aGVyIGRv IGl0IGFsd2F5cyAoTVVTVCkgb3IgdGhlcmUgbWF5IGJlIGNhc2VzIHdoZW4geW91IGRvbuKAmXQg KFNIT1VMRCkuICBzL1NIT1VMRC9zaG91bGQNCg0KTTUuIFNlY3Rpb24gMy40LjEuIChQcm9jZXNz aW5nIHRoZSBVcGRhdGUgTm90aWZpY2F0aW9uIEZpbGUpIHNheXMgdGhhdCDigJxhIFJlbHlpbmcg UGFydHkgKFJQKeKAplNIT1VMRCBwcmVmZXIgdG8gdXNlIHRoaXMgcHJvdG9jb2wgYXMgZm9sbG93 cy7igJ0gIEkgdGhpbmsgeW91IHJlYWxseSB3YW50IHRvIGJlIGV4cGxpY2l0OiBzL1NIT1VMRCBw cmVmZXIgdG8gdXNlL1NIT1VMRCB1c2UNCg0KTTYuIDMuNC4xLiAoUHJvY2Vzc2luZyB0aGUgVXBk YXRlIE5vdGlmaWNhdGlvbiBGaWxlKTog4oCcVGhlIFJQIFNIT1VMRCBkb3dubG9hZCB0aGUgdXBk YXRlIG5vdGlmaWNhdGlvbiBmaWxlLCB1bmxlc3MgYW4gdXBkYXRlIG5vdGlmaWNhdGlvbiBmaWxl IHdhcyBhbHJlYWR5IGRvd25sb2FkZWQgYW5kIHByb2Nlc3NlZCBmcm9tIHRoZSBzYW1lIGxvY2F0 aW9uIGluIHRoaXMgdmFsaWRhdGlvbiBydW4u4oCdICBJcyB0aGVyZSBhbnkgb3RoZXIgcmVhc29u IGZvciB0aGUgZmlsZSBub3QgdG8gYmUgZG93bmxvYWRlZD8gIFdoeSB3b3VsZCB0aGUgUlAgZGVj aWRlIG5vdCB0byAo4oCcU0hPVUxE4oCdKT8gIElmIHRoZXJlIGFyZSBubyBvdGhlciByZWFzb25z LCB0aGVuIHdoeSBpc27igJl0IHRoZSDigJxTSE9VTETigJ0gYSDigJxNVVNU4oCdPw0KDQpNNy4g My40LjEuIChQcm9jZXNzaW5nIHRoZSBVcGRhdGUgTm90aWZpY2F0aW9uIEZpbGUpOiDigJxNVVNU IGlzc3VlIGFuIG9wZXJhdG9yIGVycm9y4oCdICBXaGF0IGlzIGFuIOKAnG9wZXJhdG9yIGVycm9y 4oCdIGFuZCBob3cgZG8geW91IGlzc3VlIG9uZT8gIEkgZGlkbuKAmXQgc2VlIGFuIGVycm9yIGRl ZmluaXRpb24gaW4gdGhlIHNjaGVtYS4NCg0KTTguIDMuNC4xLiAoUHJvY2Vzc2luZyB0aGUgVXBk YXRlIE5vdGlmaWNhdGlvbiBGaWxlKTog4oCcSWYgbmVpdGhlciB1cGRhdGUgbm90aWZpY2F0aW9u IGZpbGUgYW5kIG9uZSBzbmFwc2hvdCBmaWxlIG9yIGRlbHRhIGZpbGVzIGNvdWxkIGJlIHByb2Nl c3NlZOKAplNIT1VMRCB1c2UgYW4gYWx0ZXJuYXRlIHJlcG9zaXRvcnkgcmV0cmlldmFsIG1lY2hh bmlzbSBpZiBpdCBpcyBhdmFpbGFibGUu4oCdICBUaGlzIOKAnFNIT1VMROKAnSBkb2VzbuKAmXQg ZGVmaW5lIGFueXRoaW5nIG5vcm1hdGl2ZSB3aXRoIHJlc3BlY3QgdG8gdGhlIERlbHRhIFByb3Rv Y29sLiAgSSB0aGluayB0aGF0IHRoaXMgZG9jdW1lbnQgd291bGQgYmVuZWZpdCBmcm9tIGEgc2hv cnQgT3BlcmF0aW9uIENvbnNpZGVyYXRpb25zIHNlY3Rpb247IGEgcGxhY2UgdG8gaW5kaWNhdGUg ZXhwZWN0YXRpb25zIG9mIHRoZSBvcGVyYXRvcnMsIHBvdGVudGlhbCBpc3N1ZXMsIHRoZSBmYWN0 IChhcyBleHByZXNzZWQgaW4gdGhpcyBwaWVjZSBvZiB0ZXh0KSB0aGF0IGFuIGFsdGVybmF0ZSBt ZWNoYW5pc20gc2hvdWxkIGJlIGVuYWJsZWQgKG9yIGF0IGxlYXN0IGNvbnNpZGVyZWQpLCBvdGhl ciBjb25zaWRlcmF0aW9ucyByZWxhdGVkIHRvIGxvZ2dpbmcgZXJyb3JzIGZvciB0aGUgb3BlcmF0 b3IgKHNlZSBhYm92ZSksIGV0Yy4NCg0KTTkuIFRoZXJlIGFyZSBzb21lIHBsYWNlcyB3aGVyZSBu b24tbm9ybWF0aXZlIGFuZCBub3JtYXRpdmUgKFJGQzIxMTkpIGxhbmd1YWdlIGlzIHVzZWQgdGhh dCBtYXkgY2F1c2UgY29uZnVzaW9uLiAgRm9yIGV4YW1wbGUsIGluIDMuNC4yOiDigJxzaG91bGQg cGVyZm9ybSB0aGUgZm9sbG93aW5nIGFjdGlvbnPigJ0sIHRoZSBhY3Rpb25zIGNvbnRhaW4gYSBz ZXQgb2Yg4oCcTVVTVHPigJ0gYW5kIOKAnFNIT1VMRHPigJ0uICBQbGVhc2UgZmluZCBhbiBhbHRl cm5hdGUgd2F5IHRvIHdyaXRlIHRoZSBsZWFkLWluIGhlYWRlciB0byBhdm9pZCBjb25mdXNpb24u ICBTdWdnZXN0aW9uOiBzL2l0IHNob3VsZCBwZXJmb3JtIHRoZSBmb2xsb3dpbmcgYWN0aW9ucy9p dCBwZXJmb3JtcyB0aGUgZm9sbG93aW5nIGFjdGlvbnMuICBbTm90ZSB0aGF0IHRoZSBzYW1lIGNv bnN0cnVjdCBpZiB1c2VkIGluIHNldmVyYWwgZGlmZmVyZW50IHBsYWNlc+KApl0NCg0KTTEwLiBJ biBzZXZlcmFsIHBsYWNlcyAocmVsYXRlZCB0byB2ZXJpZmljYXRpb24sIGJ1dCBpbiBvdGhlciBw bGFjZXMgYXMgd2VsbCksIOKAnHRoZSBmaWxlIE1VU1QgYmUgcmVqZWN0ZWTigJ0gaXMgdXNlZC4g IFdoYXQgZG9lcyB0aGlzIG1lYW4gZXhhY3RseT8gIEFyZSB0aGVyZSBhY3Rpb25zIHRoYXQgc2hv dWxkIGJlIHRha2VuIGFzIGEgcmVzdWx0PyAgQW4gZXhhbXBsZSBvZiB3aHkgSeKAmW0gYXNraW5n OiBhbiBSUCB3aWxsIGRvd25sb2FkIGFuZCBwcm9jZXNzIGRlbHRhIGZpbGVzIGJhc2VkIG9uIGlu Zm9ybWF0aW9uIGluIGEgbm90aWZpY2F0aW9uIGZpbGUg4oCTIGlmIGEgZGVsdGEgZmlsZSBpcyBu b3Qgd2VsbC1mb3JtZWQgKGZvciBleGFtcGxlKSwgdGhlbiB0aGUgdmFsaWRhdGlvbiB3aWxsIGZh aWwgYW5kIHRoZSBSUCBNVVNUIHJlamVjdCBpdCDigJMgdGhlcmUgYXJlIG11bHRpcGxlIHJlYXNv bnMgd2h5IHRoZSBmaWxlIG1heSBub3QgYmUgd2VsbC1mb3JtZWQsIGJ1dCB0aGUgYm90dG9tIGxp bmUgaXMgdGhhdCB3aGF0ZXZlciBpbmZvcm1hdGlvbiB3YXMgdGhlcmUgdGhhdCB0aGUgcmVwb3Np dG9yeSBwb2ludGVkIHRvIGluIHRoZSBub3RpZmljYXRpb24gbWVzc2FnZSBpcyBsb3N0ICg/KSDi gJMgZG9lcyB0aGlzIG1lYW4gdGhhdCB0aGUgUlAgaXMgbm93IG91dCBvZiBzeW5jPyAgU2hvdWxk IHRoZSBSUCBub3cgdHJ5IGFuZCByZS1zeW5jIHVzaW5nIHRoZSBzbmFwc2hvdCBmaWxlPyAgV2hh dCBpZiB0aGF0IGlzIGFsc28gcmVqZWN0ZWQ/ICBNYXliZSB0aGUgbm90aWZpY2F0aW9uIGZpbGUg d2FzIHNvbWVob3cgY29ycnVwdGVkIGFuZCBwb2ludGVkIGF0IHRoZSB3cm9uZyBmaWxlKHMp4oCm c2hvdWxkIHRoZSByZWxhdGlvbnNoaXAgd2l0aCB0aGUgcmVwb3NpdG9yeSBiZSByZXNldC9yZXN0 YXJ0ZWQ/ICAgSXQgaXMgbm90IGNsZWFyIGF0IGFsbCB3aGF0IHNob3VsZCBiZSBkb25lLCBvciB3 aGF0IHRoZSBpbXBsaWNhdGlvbnMgYXJlIG9mIHRoZXNlIGVycm9yIGNvbmRpdGlvbnM7IGl0IGp1 c3QgbG9va3MgbGlrZSB3ZSByZWplY3QgYW5kIGdvIG9uLiBbU2VlIGNvbW1lbnQgTTggYWJvdmU6 IGl0IGxvb2tzIGxpa2Ugb25seSB3aGVuIOKAnG5laXRoZXIgdXBkYXRlIG5vdGlmaWNhdGlvbiBm aWxlIGFuZCBvbmUgc25hcHNob3QgZmlsZSBvciBkZWx0YSBmaWxlcyBjb3VsZCBiZSBwcm9jZXNz ZWTigJ0gdGhhdCB3ZSB3b3VsZCBhYmFuZG9uIHVzaW5nIFJSRFAuXQ0KDQpNMTEuIEZyb20gMy40 LjMuIChQcm9jZXNzaW5nIERlbHRhIEZpbGVzKTog4oCcaXQgaXMgUkVDT01NRU5ERUQgdGhhdCBh IFJQIHVzZXMgYWRkaXRpb25hbCBzdHJhdGVnaWVzIHRvIGRldGVybWluZSBpZiBhbiBvYmplY3Qg aXMgc3RpbGwgcmVsZXZhbnQgZm9yIHZhbGlkYXRpb24gYmVmb3JlIHJlbW92aW5nIGl0IGZyb20g aXRzIGxvY2FsIHN0b3JhZ2XigJ0uICBPaywgbGlrZSB3aGF0Pw0KDQpNMTIuIDMuNS4xLjIuIChV cGRhdGUgTm90aWZpY2F0aW9uIEZpbGUpOiDigJzigKZ0aGUgcmVwb3NpdG9yeSBzZXJ2ZXIgTVVT VCBlbnN1cmUgdGhhdCB0aGlzIGZpbGUgaXMgbm90IGNhY2hlZCBmb3IgbG9uZ2VyIHRoYW4gMSBt aW51dGUuICBBbiBleGNlcHRpb24gdG8gdGhpcyBydWxl4oCm4oCdICBVc2luZyDigJxNVVNU4oCd IGltcGxpZXMgbm8gZXhjZXB0aW9ucy4gIHMvTVVTVC9TSE9VTEQgICAgcy90aGVuIG5vL3RoYW4g bm8NCg0KTTEzLiBXaHkgaXNu4oCZdCBhbiBJRVRGIG5hbWVzcGFjZSBbUkZDMzY4OF0gdXNlZCBp biB0aGUgWE1MIHNjaGVtYT8gIEkgd291bGQgc3Ryb25nbHkgc3VnZ2VzdCB0aGF0IHlvdSB1c2Ug b25lIGFuZCByZXF1ZXN0IGl0IGluIHRoZSBJQU5BIENvbnNpZGVyYXRpb25zIFNlY3Rpb24uICBV bmxpa2UgdGhlIHB1YmxpY2F0aW9uIHByb3RvY29sLCB0aGlzIGRvY3VtZW50IHNwZWNpZmllcyB2 ZXJzaW9uIDEg4oCTIHdoaWNoIG9mIGNvdXJzZSBkb2VzbuKAmXQgbWVhbiB0aGVyZSBpc27igJl0 IGEgbG9uZ2VyIGhpc3RvcnkgYmVoaW5kIGl0LCBzbyBJ4oCZbSBvcGVuIHRvIGtlZXBpbmcgYSBu b24tSUVURiBuYW1lc3BhY2UgaWYgdGhhdCBpcyB0aGUgY2FzZS4NCg0KTTE0LiAzLjUuMi4zOiDi gJxOb3RlIHRoYXQgdGhlIHB1Ymxpc2ggZWxlbWVudCBpcyBkZWZpbmVkIGluIHRoZSBwdWJsaWNh dGlvbiBwcm90b2NvbCBbSS1ELmlldGYtc2lkci1wdWJsaWNhdGlvbl3igJ0gIEJ1dCB0aGUgZXhh bXBsZSBkb2VzbuKAmXQgY29ycmVzcG9uZCB0byB0aGUgZGVmaW5pdGlvbiBpbiBJLUQuaWV0Zi1z aWRyLXB1YmxpY2F0aW9uLCBldmVuIGlmIGl0IGRvZXMgY29tcGx5IHdpdGggdGhlIHNjaGVtYSBp biB0aGlzIGRvY3VtZW50LiAgU2hvdWxkIHRoZSBwdWJsaXNoIGVsZW1lbnQgYmVoYXZlIHRoZSBz YW1lIHdheSBhcyBzcGVjaWZpZWQgaW4gSS1ELmlldGYtc2lkci1wdWJsaWNhdGlvbj8gIEl0IGlz IGdvb2QgdGhhdCB0aGUgUlJEUCBkZXNpZ24gZ29lcyBiYWNrIHRvIHRoZSBQdWJsaWNhdGlvbiBQ cm90b2NvbCwgYnV0IGlmIGl0IGRvZXNu4oCZdCB1c2UgdGhlIGV4YWN0IGRlZmluaXRpb24gZnJv bSB0aGVyZSAoaW5jbHVkaW5nIHRoZSBzY2hlbWEpLCB0aGVuIHRoZSBkaWZmZXJlbmNlcyBzaG91 bGQgYmUgaGlnaGxpZ2h0ZWQgaGVyZS4NCg0KTTE1LiAzLjUuMy4zOiDigJxOb3RlIHRoYXQgdGhl IHB1Ymxpc2ggYW5kIHdpdGhkcmF3IGVsZW1lbnRzIGFyZSBkZWZpbmVkIGluIHRoZSBwdWJsaWNh dGlvbiBwcm90b2NvbCBbSS1ELmlldGYtc2lkci1wdWJsaWNhdGlvbl3igJ0gIFNhbWUgY29tbWVu dCBhcyBhYm92ZS4NCg0KTTE2LiBTZWN0aW9uIDUuIChTZWN1cml0eSBDb25zaWRlcmF0aW9ucyk6 IOKAnFJSRFAgcmVwbGFjZXMgdGhlIHVzZSBvZiByc3luYyBieSBIVFRQU+KApuKAnS4gR2l2ZW4g dGhlIHN0YXRlbWVudCBpbiAzLjQuMSBhYm91dCB1c2luZyDigJxhbiBhbHRlcm5hdGUgcmVwb3Np dG9yeSByZXRyaWV2YWwgbWVjaGFuaXNt4oCdIGFuZCB0aGUgcmVzdCBvZiB0aGUgdGV4dCBpbiB0 aGlzIHNlY3Rpb24sIEkgd291bGQgYXNzdW1lIHRoYXQgdGhlIGludGVudCBpcyBub3QgcmVhbGx5 IHRvIOKAnHJlcGxhY2UgdGhlIHVzZSBvZiByc3luY+KAnSAod2l0aCBhbiB1cGRhdGUgdG8gUkZD NjQ4MCkuICAgTWF5YmUgSeKAmW0gcmVhZGluZyB0b28gbXVjaCBpbnRvIHRoZSBwaHJhc2UgYWJv dmUsIGJ1dCBwbGVhc2UgY2xhcmlmeS4NCg0KDQpNaW5vcjoNCg0KUDEuIEluIDMuMy4xLiAoSW5p dGlhbGlzYXRpb24pOiDigJxOb3RlIHRoYXQgdGhpcyBzbmFwc2hvdCBmaWxlIE1BWSBjb250YWlu IHplcm8gcHVibGlzaCBlbGVtZW50cyBhdCB0aGlzIHBvaW50IGlmIG5vIG9iamVjdHMgaGF2ZSBi ZWVuIHN1Ym1pdHRlZCBmb3IgcHVibGljYXRpb24geWV0LuKAnSAgVGhpcyB0ZXh0IGlzIG5vdCBk ZXNjcmliaW5nIGFuIG9wdGlvbjogcy9NQVkvbWF5DQoNClAyLiBQbGVhc2UgZXhwYW5kIFJSRFAg aW4gZmlyc3QgdXNlLg0KDQpQMy4gU2VjdGlvbiAzLjQuNC4gKFBvbGxpbmcgdGhlIFVwZGF0ZSBO b3RpZmljYXRpb24gRmlsZSkgc2F5czog4oCcQSBkZXRhaWxlZCBkZXNjcmlwdGlvbiBvZiB0aGUg dmFsaWRhdGlvbiBwcm9jZXNzIGl0c2VsZiBpcyBvdXQgb2Ygc2NvcGUgb2YgdGhpcyBkb2N1bWVu dC7igJ0gIElzbuKAmXQgdGhhdCB3aGF0IGlzIGRlc2NyaWJlZCBpbiAzLjQuMSBhbmQgMy41LjEu Mz8/DQoNClA0LiDigJx2ZXJzaW9uIDQgVVVJROKAnSAgUGxlYXNlIHByb3ZpZGUgYSByZWZlcmVu Y2UuDQoNClA1LiAzLjUuMS4zOiDigJxUaGUgc2VyaWFsIGF0dHJpYnV0ZSBtdXN0IGJl4oCm4oCd ICBUaGlzIGlzIHRoZSBvbmx5IHBsYWNlIHdoZXJlIFJGQzIxMTkgbGFuZ3VhZ2UgaXMgbm90IHVz ZWQgaW4gdGhpcyBzZWN0aW9uLiAgQW55IHNwZWNpYWwgcmVhc29uPw0KDQpQNi4gMy41LjEuMzog 4oCcSWYgZGVsdGEgZWxlbWVudHMgYXJlIGluY2x1ZGVkIHRoZXkgTVVTVCBmb3JtIGEgY29udGln dW91cyBzZXF1ZW5jZSBvZiBzZXJpYWwgbnVtYmVyc+KApnVwIHRvIHRoZSBzZXJpYWwgbnVtYmVy IG1lbnRpb25lZCBpbiB0aGUgbm90aWZpY2F0aW9uIGVsZW1lbnQu4oCdICBUaGUgZXhhbXBsZSBp biB0aGlzIHNlY3Rpb24gbGlzdHMgdGhlIHNlcmlhbCBudW1iZXJzIGluIOKAnHJldmVyc2Ugb3Jk ZXLigJ0gKDMsIDIpIOKAkyBpcyB0aGVyZSBhbiBvcmRlciByZXF1aXJlbWVudD8gIFRoZSB0ZXh0 IHNlZW1zIHRvIGltcGx5IGl0LCBidXQgaXQgY291bGQgZ28gZWl0aGVyIHdheS4NCg0KUDcuIFRo ZSBmb2xsb3dpbmcgcmVmZXJlbmNlcyBzaG91bGQgYmUgSW5mb3JtYXRpdmU6IElBTkEtQUQtTlVN QkVSUywgUkZDNjQ4MSwgUkZDNjQ4NiwgUkZDNjQ4OCBzaG91bGQgYmUgbWFkZSBJbmZvcm1hdGl2 ZS4NCg0KDQpOaXRzOg0KDQpOMS4gSW4gYm90aCAzLjMuMS8zLjMuMiwgdGhlIG5vdGVzIGFib3V0 IOKAnGZvcm1hdCBhbmQgY2FjaGluZyBjb25jZXJuc+KAnSB3b3VsZCB3b3JrIGJldHRlciBpZiB0 aGV5IGFyZSBwYXJ0IG9mIHRoZSBwcmV2aW91cyBwYXJhZ3JhcGguDQoNCk4yLiBzL2FyZSBubyBu byBsb25nZXIvYXJlIG5vIGxvbmdlcg0K --_000_7DE58D01AC8240999A4699E625315637ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eTpDYWxpYnJpO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFu LkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDsNCglmb250LXdlaWdodDpub3JtYWw7 DQoJZm9udC1zdHlsZTpub3JtYWw7fQ0Kc3Bhbi5tc29JbnMNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGlu ZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3Np emU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYu V29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+ DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5r PSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+RGVhciBhdXRob3JzOjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SGkhJm5ic3A7IEkganVzdCBmaW5p c2hlZCByZWFkaW5nIHRoaXMgZG9jdW1lbnQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij5JIGhhdmUgc2V2ZXJhbCBjb21tZW50cyAocGxlYXNlIHNlZSBiZWxvdyk7 IEkgbWFya2VkIG1hbnkgb2YgdGhlbSBhcyDigJxNYWpvcuKAnSwgc29tZSBiZWNhdXNlIG9mIHRo ZSB1c2Ugb2YgTm9ybWF0aXZlIGxhbmd1YWdlLCBidXQgbXkgbWFpbiBjb25jZXJuIGlzIHRoYXQg SSB0aGluayBlcnJvciBjb25kaXRpb25zIGluIHRoZSBwcm90b2NvbCBhcmUgdW5kZXJzcGVjaWZp ZWQNCiAoc2VlIE03LCBNOCwgTTEwLCBiZWxvdykuJm5ic3A7IEFsb25nIHRoZSBzYW1lIGxpbmVz LCBJIHRoaW5rIHRoYXQgYW4gT3BlcmF0aW9ucyBDb25zaWRlcmF0aW9ucyBzZWN0aW9uIHdvdWxk IGJlIG9mIGJlbmVmaXQgKHNlZSBNOCBiZWxvdyk7IHlvdSBtaWdodCBhbHNvIHdhbnQgdG8gdGFr ZSBhIGxvb2sgYXQgUkZDNTcwNiAoR3VpZGVsaW5lcyBmb3IgQ29uc2lkZXJpbmcgT3BlcmF0aW9u cyBhbmQgTWFuYWdlbWVudCBvZiBOZXcgUHJvdG9jb2xzIGFuZA0KIFByb3RvY29sIEV4dGVuc2lv bnMpLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SSB3b3VsZCBs aWtlIHRvIHNlZSB0aGUgZXJyb3IgY29uZGl0aW9ucyBjb21tZW50cyBhZGRyZXNzZWQgYmVmb3Jl IG1vdmluZyB0aGlzIGRvY3VtZW50IGZvcndhcmQgdG8gSUVURiBMYXN0IENhbGwuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGFua3MhITxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QWx2YXJvLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPk1ham9yOjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+TTEuJm5ic3A7IEkgYXNz dW1lIHRoYXQgdGhlIGlkLWFkLXJwa2lOb3RpZnkgdmFsdWUgd2FzIGFzc2lnbmVkIHRocm91Z2gg dGhlIGVhcmx5IGFsbG9jYXRpb24gcHJvY2Vzcy4mbmJzcDsgSW5zdGVhZCBvZiBwb2ludGluZyBh dCB0aGUgcmVnaXN0cnkgaW4gU2VjdGlvbiAzLjIsIHBvaW50IGF0IHRoZSBJQU5BIENvbnNpZGVy YXRpb24gU2VjdGlvbiAtLS0gYW5kIHRoZXJlLA0KIHBsZWFzZSByZW1pbmQgSUFOQSBvZiB0aGUg ZWFybHkgYWxsb2NhdGlvbiBhbmQgcmVxdWVzdCB0aGUgdXBkYXRlLiZuYnNwOyA8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPk0yLiBTZWN0aW9uIDMuMi4gKENlcnRp ZmljYXRlIEF1dGhvcml0eSBVc2UpOiDigJxSZWx5aW5nIFBhcnRpZXMgdGhhdCBkbyBub3Qgc3Vw cG9ydCB0aGlzIGRlbHRhIHByb3RvY29sIE1VU1QgTk9UIHJlamVjdCBhIENBIGNlcnRpZmljYXRl IG1lcmVseSBiZWNhdXNlIGl0IGhhcyBhbiBTSUEgZXh0ZW5zaW9uIGNvbnRhaW5pbmcgdGhpcyBu ZXcga2luZCBvZiBBY2Nlc3NEZXNjcmlwdGlvbi7igJ0mbmJzcDsNCiBCeSBkZWZpbml0aW9uLCBh biBSUCB0aGF0IGhhcyBuZXZlciBldmVuIGNvbnNpZGVyZWQgdGhpcyBkb2N1bWVudCB3aWxsIG5v dCBzdXBwb3J0IHRoZSBkZWx0YSBwcm90b2NvbCDigJMgSU9XLCB0cnlpbmcgdG8gc3BlY2lmeSB0 aGUgYmVoYXZpb3Igb2YgUlBzIHRoYXQgbWF5IGhhdmUgbmV2ZXIgZXZlbiBzZWVuIHRoaXMgZG9j dW1lbnQgbWFrZXMgbm8gc2Vuc2UgdG8gbWUsIGFuZCBjYW7igJl0IGJlIGVuZm9yY2VkLiZuYnNw OyBXaGF0IGlzIHRoZSBjdXJyZW50DQogYmVoYXZpb3Igd2hlbiBhbiBSUCByZWNlaXZlcyB0aGUg ZXh0cmEgU0lBIGV4dGVuc2lvbj88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPk0zLiBTZWN0aW9uIDMuMy4yLiAoUHVibGlzaGluZyBVcGRhdGVzKTog4oCcV2hlbmV2 ZXIgdGhlIHJlcG9zaXRvcnkgc2VydmVyIHJlY2VpdmVzIHVwZGF0ZXMgZnJvbSBhIENBIGl0IFNI T1VMRCBnZW5lcmF0ZSBuZXcgc25hcHNob3QgYW5kIGRlbHRhIGZpbGVzLiZuYnNwOyBIb3dldmVy LCBpZiBhIHB1YmxpY2F0aW9uIHNlcnZlciBzZXJ2aWNlcyBhIGxhcmdlIG51bWJlcg0KIG9mIENB cyBpdCBNQVkgY2hvb3NlIHRvIGNvbWJpbmUgdXBkYXRlcyBmcm9tIG11bHRpcGxlIENBcy4mbmJz cDsgSWYgYSBwdWJsaWNhdGlvbiBzZXJ2ZXIgY29tYmluZXMgdXBkYXRlcyBpbiB0aGlzIHdheSwg aXQgTVVTVCBOT1QgcG9zdHBvbmUgcHVibGlzaGluZyBmb3IgbG9uZ2VyIHRoYW4gb25lIG1pbnV0 ZS7igJ0mbmJzcDsgVGhlIOKAnE1VU1QgTk9U4oCdIGF0IHRoZSBlbmQgKG1ha2luZyBpdCBtYW5k YXRvcnkgdG8gcHVibGlzaCkgZG9lc27igJl0IHdvcmsgd2l0aCB0aGUNCiDigJxTSE9VTETigJ0g YXQgdGhlIGJlZ2lubmluZywgd2hpY2ggaGFzIG5vIHRpbWUgY29uc3RyYWludCBhbmQgb3BlbnMg dG8gdGhlIGRvb3IgdG8gYSBzaXR1YXRpb24gd2hlcmUgbm8gcHVibGlzaGluZyBpcyBkb25lLiZu YnNwOyBTdWdnZXN0aW9uOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5ORVcmZ3Q7PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPiZuYnNwOyBXaGVuZXZlciB0aGUgcmVwb3NpdG9yeSBzZXJ2ZXIgcmVjZWl2ZXMgdXBkYXRl cyBmcm9tIGEgQ0EgaXQgTVVTVA0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiZuYnNwOyZuYnNwOyZuYnNw O2dlbmVyYXRlIG5ldyBzbmFwc2hvdCBhbmQgZGVsdGEuJm5ic3A7IElmIGEgcHVibGljYXRpb248 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+Jm5ic3A7Jm5ic3A7IHNlcnZlciBzZXJ2aWNlcyBhIGxhcmdlIG51 bWJlciBvZiBDQXMgaXQgTUFZIGNob29zZSB0byBjb21iaW5lPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiZu YnNwOyZuYnNwOyB1cGRhdGVzIGZyb20gbXVsdGlwbGUgQ0FzLCBidXQgaXQgTVVTVCBOT1QgcG9z dHBvbmUgcHVibGlzaGluZyBmb3IgbG9uZ2VyIHRoYW4gb25lPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiZu YnNwOyZuYnNwOyBtaW51dGUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij5NNC4gRnJvbSAzLjMuMi4gKFB1Ymxpc2hpbmcgVXBkYXRlcyk6IOKAnFRoZSB1cGRhdGUg bm90aWZpY2F0aW9uIGZpbGUgU0hPVUxEIGJlIGtlcHQgc21hbGzigKZvbGRlciBkZWx0YSBmaWxl cyB0aGF04oCmd2lsbCByZXN1bHQgaW4gdG90YWwgc2l6ZSBvZiBkZWx0YXMgZXhjZWVkaW5nIHRo ZSBzaXplIG9mIHRoZSBzbmFwc2hvdCwgTVVTVCBiZSBleGNsdWRlZC7igJ0mbmJzcDsgSGVyZQ0K IHRoZSDigJxTSE9VTETigJ0gYW5kIHRoZSDigJxNVVNU4oCdIGFyZSBpbiBjb250cmFkaWN0aW9u OiB5b3UgZWl0aGVyIGRvIGl0IGFsd2F5cyAoTVVTVCkgb3IgdGhlcmUgbWF5IGJlIGNhc2VzIHdo ZW4geW91IGRvbuKAmXQgKFNIT1VMRCkuJm5ic3A7IHMvU0hPVUxEL3Nob3VsZDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+TTUuIFNlY3Rpb24gMy40LjEuIChQcm9j ZXNzaW5nIHRoZSBVcGRhdGUgTm90aWZpY2F0aW9uIEZpbGUpIHNheXMgdGhhdCDigJxhIFJlbHlp bmcgUGFydHkgKFJQKeKAplNIT1VMRCBwcmVmZXIgdG8gdXNlIHRoaXMgcHJvdG9jb2wgYXMgZm9s bG93cy7igJ0mbmJzcDsgSSB0aGluayB5b3UgcmVhbGx5IHdhbnQgdG8gYmUgZXhwbGljaXQ6IHMv U0hPVUxEIHByZWZlciB0byB1c2UvU0hPVUxEDQogdXNlPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij5NNi4gMy40LjEuIChQcm9jZXNzaW5nIHRoZSBVcGRhdGUgTm90 aWZpY2F0aW9uIEZpbGUpOiDigJxUaGUgUlAgU0hPVUxEIGRvd25sb2FkIHRoZSB1cGRhdGUgbm90 aWZpY2F0aW9uIGZpbGUsIHVubGVzcyBhbiB1cGRhdGUgbm90aWZpY2F0aW9uIGZpbGUgd2FzIGFs cmVhZHkgZG93bmxvYWRlZCBhbmQgcHJvY2Vzc2VkIGZyb20gdGhlIHNhbWUgbG9jYXRpb24gaW4N CiB0aGlzIHZhbGlkYXRpb24gcnVuLuKAnSZuYnNwOyBJcyB0aGVyZSBhbnkgb3RoZXIgcmVhc29u IGZvciB0aGUgZmlsZSBub3QgdG8gYmUgZG93bmxvYWRlZD8mbmJzcDsgV2h5IHdvdWxkIHRoZSBS UCBkZWNpZGUgbm90IHRvICjigJxTSE9VTETigJ0pPyZuYnNwOyBJZiB0aGVyZSBhcmUgbm8gb3Ro ZXIgcmVhc29ucywgdGhlbiB3aHkgaXNu4oCZdCB0aGUg4oCcU0hPVUxE4oCdIGEg4oCcTVVTVOKA nT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPk03LiAzLjQuMS4g KFByb2Nlc3NpbmcgdGhlIFVwZGF0ZSBOb3RpZmljYXRpb24gRmlsZSk6IOKAnE1VU1QgaXNzdWUg YW4gb3BlcmF0b3IgZXJyb3LigJ0mbmJzcDsgV2hhdCBpcyBhbiDigJxvcGVyYXRvciBlcnJvcuKA nSBhbmQgaG93IGRvIHlvdSBpc3N1ZSBvbmU/Jm5ic3A7IEkgZGlkbuKAmXQgc2VlIGFuIGVycm9y IGRlZmluaXRpb24gaW4gdGhlIHNjaGVtYS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQiPk04LiAzLjQuMS4gKFByb2Nlc3NpbmcgdGhlIFVwZGF0ZSBOb3RpZmljYXRp b24gRmlsZSk6IOKAnElmIG5laXRoZXIgdXBkYXRlIG5vdGlmaWNhdGlvbiBmaWxlIGFuZCBvbmUg c25hcHNob3QgZmlsZSBvciBkZWx0YSBmaWxlcyBjb3VsZCBiZSBwcm9jZXNzZWTigKZTSE9VTEQg dXNlIGFuIGFsdGVybmF0ZSByZXBvc2l0b3J5IHJldHJpZXZhbCBtZWNoYW5pc20gaWYNCiBpdCBp cyBhdmFpbGFibGUu4oCdJm5ic3A7IFRoaXMg4oCcU0hPVUxE4oCdIGRvZXNu4oCZdCBkZWZpbmUg YW55dGhpbmcgbm9ybWF0aXZlIHdpdGggcmVzcGVjdCB0byB0aGUgRGVsdGEgUHJvdG9jb2wuJm5i c3A7IEkgdGhpbmsgdGhhdCB0aGlzIGRvY3VtZW50IHdvdWxkIGJlbmVmaXQgZnJvbSBhIHNob3J0 IE9wZXJhdGlvbiBDb25zaWRlcmF0aW9ucyBzZWN0aW9uOyBhIHBsYWNlIHRvIGluZGljYXRlIGV4 cGVjdGF0aW9ucyBvZiB0aGUgb3BlcmF0b3JzLCBwb3RlbnRpYWwgaXNzdWVzLA0KIHRoZSBmYWN0 IChhcyBleHByZXNzZWQgaW4gdGhpcyBwaWVjZSBvZiB0ZXh0KSB0aGF0IGFuIGFsdGVybmF0ZSBt ZWNoYW5pc20gc2hvdWxkIGJlIGVuYWJsZWQgKG9yIGF0IGxlYXN0IGNvbnNpZGVyZWQpLCBvdGhl ciBjb25zaWRlcmF0aW9ucyByZWxhdGVkIHRvIGxvZ2dpbmcgZXJyb3JzIGZvciB0aGUgb3BlcmF0 b3IgKHNlZSBhYm92ZSksIGV0Yy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPk05LiBUaGVyZSBhcmUgc29tZSBwbGFjZXMgd2hlcmUgbm9uLW5vcm1hdGl2ZSBhbmQg bm9ybWF0aXZlIChSRkMyMTE5KSBsYW5ndWFnZSBpcyB1c2VkIHRoYXQgbWF5IGNhdXNlIGNvbmZ1 c2lvbi4mbmJzcDsgRm9yIGV4YW1wbGUsIGluIDMuNC4yOiDigJxzaG91bGQgcGVyZm9ybSB0aGUg Zm9sbG93aW5nIGFjdGlvbnPigJ0sIHRoZSBhY3Rpb25zIGNvbnRhaW4gYSBzZXQgb2YNCiDigJxN VVNUc+KAnSBhbmQg4oCcU0hPVUxEc+KAnS4mbmJzcDsgUGxlYXNlIGZpbmQgYW4gYWx0ZXJuYXRl IHdheSB0byB3cml0ZSB0aGUgbGVhZC1pbiBoZWFkZXIgdG8gYXZvaWQgY29uZnVzaW9uLiZuYnNw OyBTdWdnZXN0aW9uOiBzL2l0IHNob3VsZCBwZXJmb3JtIHRoZSBmb2xsb3dpbmcgYWN0aW9ucy9p dCBwZXJmb3JtcyB0aGUgZm9sbG93aW5nIGFjdGlvbnMuJm5ic3A7IFtOb3RlIHRoYXQgdGhlIHNh bWUgY29uc3RydWN0IGlmIHVzZWQgaW4gc2V2ZXJhbCBkaWZmZXJlbnQgcGxhY2Vz4oCmXTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+TTEwLiBJbiBzZXZlcmFsIHBs YWNlcyAocmVsYXRlZCB0byB2ZXJpZmljYXRpb24sIGJ1dCBpbiBvdGhlciBwbGFjZXMgYXMgd2Vs bCksIOKAnHRoZSBmaWxlIE1VU1QgYmUgcmVqZWN0ZWTigJ0gaXMgdXNlZC4mbmJzcDsgV2hhdCBk b2VzIHRoaXMgbWVhbiBleGFjdGx5PyZuYnNwOyBBcmUgdGhlcmUgYWN0aW9ucyB0aGF0IHNob3Vs ZCBiZSB0YWtlbiBhcyBhIHJlc3VsdD8mbmJzcDsgQW4gZXhhbXBsZQ0KIG9mIHdoeSBJ4oCZbSBh c2tpbmc6IGFuIFJQIHdpbGwgZG93bmxvYWQgYW5kIHByb2Nlc3MgZGVsdGEgZmlsZXMgYmFzZWQg b24gaW5mb3JtYXRpb24gaW4gYSBub3RpZmljYXRpb24gZmlsZSDigJMgaWYgYSBkZWx0YSBmaWxl IGlzIG5vdCB3ZWxsLWZvcm1lZCAoZm9yIGV4YW1wbGUpLCB0aGVuIHRoZSB2YWxpZGF0aW9uIHdp bGwgZmFpbCBhbmQgdGhlIFJQIE1VU1QgcmVqZWN0IGl0IOKAkyB0aGVyZSBhcmUgbXVsdGlwbGUg cmVhc29ucyB3aHkgdGhlIGZpbGUNCiBtYXkgbm90IGJlIHdlbGwtZm9ybWVkLCBidXQgdGhlIGJv dHRvbSBsaW5lIGlzIHRoYXQgd2hhdGV2ZXIgaW5mb3JtYXRpb24gd2FzIHRoZXJlIHRoYXQgdGhl IHJlcG9zaXRvcnkgcG9pbnRlZCB0byBpbiB0aGUgbm90aWZpY2F0aW9uIG1lc3NhZ2UgaXMgbG9z dCAoPykg4oCTIGRvZXMgdGhpcyBtZWFuIHRoYXQgdGhlIFJQIGlzIG5vdyBvdXQgb2Ygc3luYz8m bmJzcDsgU2hvdWxkIHRoZSBSUCBub3cgdHJ5IGFuZCByZS1zeW5jIHVzaW5nIHRoZSBzbmFwc2hv dA0KIGZpbGU/Jm5ic3A7IFdoYXQgaWYgdGhhdCBpcyBhbHNvIHJlamVjdGVkPyZuYnNwOyBNYXli ZSB0aGUgbm90aWZpY2F0aW9uIGZpbGUgd2FzIHNvbWVob3cgY29ycnVwdGVkIGFuZCBwb2ludGVk IGF0IHRoZSB3cm9uZyBmaWxlKHMp4oCmc2hvdWxkIHRoZSByZWxhdGlvbnNoaXAgd2l0aCB0aGUg cmVwb3NpdG9yeSBiZSByZXNldC9yZXN0YXJ0ZWQ/Jm5ic3A7Jm5ic3A7IEl0IGlzIG5vdCBjbGVh ciBhdCBhbGwgd2hhdCBzaG91bGQgYmUgZG9uZSwgb3Igd2hhdCB0aGUgaW1wbGljYXRpb25zDQog YXJlIG9mIHRoZXNlIGVycm9yIGNvbmRpdGlvbnM7IGl0IGp1c3QgbG9va3MgbGlrZSB3ZSByZWpl Y3QgYW5kIGdvIG9uLiBbU2VlIGNvbW1lbnQgTTggYWJvdmU6IGl0IGxvb2tzIGxpa2Ugb25seSB3 aGVuIOKAnG5laXRoZXIgdXBkYXRlIG5vdGlmaWNhdGlvbiBmaWxlIGFuZCBvbmUgc25hcHNob3Qg ZmlsZSBvciBkZWx0YSBmaWxlcyBjb3VsZCBiZSBwcm9jZXNzZWTigJ0gdGhhdCB3ZSB3b3VsZCBh YmFuZG9uIHVzaW5nIFJSRFAuXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdCI+TTExLiBGcm9tIDMuNC4zLiAoUHJvY2Vzc2luZyBEZWx0YSBGaWxlcyk6IOKAnGl0IGlz IFJFQ09NTUVOREVEIHRoYXQgYSBSUCB1c2VzIGFkZGl0aW9uYWwgc3RyYXRlZ2llcyB0byBkZXRl cm1pbmUgaWYgYW4gb2JqZWN0IGlzIHN0aWxsIHJlbGV2YW50IGZvciB2YWxpZGF0aW9uIGJlZm9y ZSByZW1vdmluZyBpdCBmcm9tIGl0cyBsb2NhbCBzdG9yYWdl4oCdLiZuYnNwOyBPaywNCiBsaWtl IHdoYXQ/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5NMTIuIDMu NS4xLjIuIChVcGRhdGUgTm90aWZpY2F0aW9uIEZpbGUpOiDigJzigKZ0aGUgcmVwb3NpdG9yeSBz ZXJ2ZXIgTVVTVCBlbnN1cmUgdGhhdCB0aGlzIGZpbGUgaXMgbm90IGNhY2hlZCBmb3IgbG9uZ2Vy IHRoYW4gMSBtaW51dGUuJm5ic3A7IEFuIGV4Y2VwdGlvbiB0byB0aGlzIHJ1bGXigKbigJ0mbmJz cDsgVXNpbmcg4oCcTVVTVOKAnSBpbXBsaWVzIG5vIGV4Y2VwdGlvbnMuJm5ic3A7IHMvTVVTVC9T SE9VTEQmbmJzcDsmbmJzcDsmbmJzcDsNCiBzL3RoZW4gbm8vdGhhbiBubyA8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPk0xMy4gV2h5IGlzbuKAmXQgYW4gSUVURiBu YW1lc3BhY2UgW1JGQzM2ODhdIHVzZWQgaW4gdGhlIFhNTCBzY2hlbWE/Jm5ic3A7IEkgd291bGQg c3Ryb25nbHkgc3VnZ2VzdCB0aGF0IHlvdSB1c2Ugb25lIGFuZCByZXF1ZXN0IGl0IGluIHRoZSBJ QU5BIENvbnNpZGVyYXRpb25zIFNlY3Rpb24uJm5ic3A7IFVubGlrZSB0aGUgcHVibGljYXRpb24g cHJvdG9jb2wsIHRoaXMgZG9jdW1lbnQNCiBzcGVjaWZpZXMgdmVyc2lvbiAxIOKAkyB3aGljaCBv ZiBjb3Vyc2UgZG9lc27igJl0IG1lYW4gdGhlcmUgaXNu4oCZdCBhIGxvbmdlciBoaXN0b3J5IGJl aGluZCBpdCwgc28gSeKAmW0gb3BlbiB0byBrZWVwaW5nIGEgbm9uLUlFVEYgbmFtZXNwYWNlIGlm IHRoYXQgaXMgdGhlIGNhc2UuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij5NMTQuIDMuNS4yLjM6IOKAnE5vdGUgdGhhdCB0aGUgcHVibGlzaCBlbGVtZW50IGlzIGRl ZmluZWQgaW4gdGhlIHB1YmxpY2F0aW9uIHByb3RvY29sIFtJLUQuaWV0Zi1zaWRyLXB1YmxpY2F0 aW9uXeKAnSZuYnNwOyBCdXQgdGhlIGV4YW1wbGUgZG9lc27igJl0IGNvcnJlc3BvbmQgdG8gdGhl IGRlZmluaXRpb24gaW4gSS1ELmlldGYtc2lkci1wdWJsaWNhdGlvbiwgZXZlbiBpZg0KIGl0IGRv ZXMgY29tcGx5IHdpdGggdGhlIHNjaGVtYSBpbiB0aGlzIGRvY3VtZW50LiZuYnNwOyBTaG91bGQg dGhlIHB1Ymxpc2ggZWxlbWVudCBiZWhhdmUgdGhlIHNhbWUgd2F5IGFzIHNwZWNpZmllZCBpbiBJ LUQuaWV0Zi1zaWRyLXB1YmxpY2F0aW9uPyZuYnNwOyBJdCBpcyBnb29kIHRoYXQgdGhlIFJSRFAg ZGVzaWduIGdvZXMgYmFjayB0byB0aGUgUHVibGljYXRpb24gUHJvdG9jb2wsIGJ1dCBpZiBpdCBk b2VzbuKAmXQgdXNlIHRoZSBleGFjdCBkZWZpbml0aW9uIGZyb20NCiB0aGVyZSAoaW5jbHVkaW5n IHRoZSBzY2hlbWEpLCB0aGVuIHRoZSBkaWZmZXJlbmNlcyBzaG91bGQgYmUgaGlnaGxpZ2h0ZWQg aGVyZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPk0xNS4gMy41 LjMuMzog4oCcTm90ZSB0aGF0IHRoZSBwdWJsaXNoIGFuZCB3aXRoZHJhdyBlbGVtZW50cyBhcmUg ZGVmaW5lZCBpbiB0aGUgcHVibGljYXRpb24gcHJvdG9jb2wgW0ktRC5pZXRmLXNpZHItcHVibGlj YXRpb25d4oCdJm5ic3A7IFNhbWUgY29tbWVudCBhcyBhYm92ZS4mbmJzcDsNCjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+TTE2LiBTZWN0aW9uIDUuIChTZWN1cml0 eSBDb25zaWRlcmF0aW9ucyk6IOKAnFJSRFAgcmVwbGFjZXMgdGhlIHVzZSBvZiByc3luYyBieSBI VFRQU+KApuKAnS4gR2l2ZW4gdGhlIHN0YXRlbWVudCBpbiAzLjQuMSBhYm91dCB1c2luZyDigJxh biBhbHRlcm5hdGUgcmVwb3NpdG9yeSByZXRyaWV2YWwgbWVjaGFuaXNt4oCdIGFuZCB0aGUgcmVz dCBvZiB0aGUgdGV4dCBpbiB0aGlzDQogc2VjdGlvbiwgSSB3b3VsZCBhc3N1bWUgdGhhdCB0aGUg aW50ZW50IGlzIG5vdCByZWFsbHkgdG8g4oCccmVwbGFjZSB0aGUgdXNlIG9mIHJzeW5j4oCdICh3 aXRoIGFuIHVwZGF0ZSB0byBSRkM2NDgwKS4mbmJzcDsmbmJzcDsgTWF5YmUgSeKAmW0gcmVhZGlu ZyB0b28gbXVjaCBpbnRvIHRoZSBwaHJhc2UgYWJvdmUsIGJ1dCBwbGVhc2UgY2xhcmlmeS48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij5NaW5vcjo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PlAxLiBJbiAzLjMuMS4gKEluaXRpYWxpc2F0aW9uKTog4oCcTm90ZSB0aGF0IHRoaXMgc25hcHNo b3QgZmlsZSBNQVkgY29udGFpbiB6ZXJvIHB1Ymxpc2ggZWxlbWVudHMgYXQgdGhpcyBwb2ludCBp ZiBubyBvYmplY3RzIGhhdmUgYmVlbiBzdWJtaXR0ZWQgZm9yIHB1YmxpY2F0aW9uIHlldC7igJ0m bmJzcDsgVGhpcyB0ZXh0IGlzIG5vdCBkZXNjcmliaW5nIGFuIG9wdGlvbjoNCiBzL01BWS9tYXk8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlAyLiBQbGVhc2UgZXhw YW5kIFJSRFAgaW4gZmlyc3QgdXNlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+UDMuIFNlY3Rpb24gMy40LjQuIChQb2xsaW5nIHRoZSBVcGRhdGUgTm90aWZpY2F0 aW9uIEZpbGUpIHNheXM6IOKAnEEgZGV0YWlsZWQgZGVzY3JpcHRpb24gb2YgdGhlIHZhbGlkYXRp b24gcHJvY2VzcyBpdHNlbGYgaXMgb3V0IG9mIHNjb3BlIG9mIHRoaXMgZG9jdW1lbnQu4oCdJm5i c3A7IElzbuKAmXQgdGhhdCB3aGF0IGlzIGRlc2NyaWJlZCBpbiAzLjQuMSBhbmQgMy41LjEuMz8/ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5QNC4g4oCcdmVyc2lv biA0IFVVSUTigJ0mbmJzcDsgUGxlYXNlIHByb3ZpZGUgYSByZWZlcmVuY2UuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5QNS4gMy41LjEuMzog4oCcVGhlIHNlcmlh bCBhdHRyaWJ1dGUgbXVzdCBiZeKApuKAnSZuYnNwOyBUaGlzIGlzIHRoZSBvbmx5IHBsYWNlIHdo ZXJlIFJGQzIxMTkgbGFuZ3VhZ2UgaXMgbm90IHVzZWQgaW4gdGhpcyBzZWN0aW9uLiZuYnNwOyBB bnkgc3BlY2lhbCByZWFzb24/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij5QNi4gMy41LjEuMzog4oCcSWYgZGVsdGEgZWxlbWVudHMgYXJlIGluY2x1ZGVkIHRoZXkg TVVTVCBmb3JtIGEgY29udGlndW91cyBzZXF1ZW5jZSBvZiBzZXJpYWwgbnVtYmVyc+KApnVwIHRv IHRoZSBzZXJpYWwgbnVtYmVyIG1lbnRpb25lZCBpbiB0aGUgbm90aWZpY2F0aW9uIGVsZW1lbnQu 4oCdJm5ic3A7IFRoZSBleGFtcGxlIGluIHRoaXMgc2VjdGlvbiBsaXN0cyB0aGUgc2VyaWFsDQog bnVtYmVycyBpbiDigJxyZXZlcnNlIG9yZGVy4oCdICgzLCAyKSDigJMgaXMgdGhlcmUgYW4gb3Jk ZXIgcmVxdWlyZW1lbnQ/Jm5ic3A7IFRoZSB0ZXh0IHNlZW1zIHRvIGltcGx5IGl0LCBidXQgaXQg Y291bGQgZ28gZWl0aGVyIHdheS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPlA3LiBUaGUgZm9sbG93aW5nIHJlZmVyZW5jZXMgc2hvdWxkIGJlIEluZm9ybWF0aXZl OiBJQU5BLUFELU5VTUJFUlMsIFJGQzY0ODEsIFJGQzY0ODYsIFJGQzY0ODggc2hvdWxkIGJlIG1h ZGUgSW5mb3JtYXRpdmUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Tml0czo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPk4xLiBJbiBib3RoIDMuMy4xLzMuMy4yLCB0aGUgbm90ZXMgYWJv dXQg4oCcZm9ybWF0IGFuZCBjYWNoaW5nIGNvbmNlcm5z4oCdIHdvdWxkIHdvcmsgYmV0dGVyIGlm IHRoZXkgYXJlIHBhcnQgb2YgdGhlIHByZXZpb3VzIHBhcmFncmFwaC48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPk4yLiBzL2FyZSBubyBubyBsb25nZXIvYXJlIG5v IGxvbmdlcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_7DE58D01AC8240999A4699E625315637ciscocom_-- From nobody Tue Dec 20 06:24:40 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BE851298A6; Tue, 20 Dec 2016 06:24:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.621 X-Spam-Level: X-Spam-Status: No, score=-17.621 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CVLzCw5o9OzN; Tue, 20 Dec 2016 06:24:37 -0800 (PST) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C2461298A8; Tue, 20 Dec 2016 06:24:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=12162; q=dns/txt; s=iport; t=1482243869; x=1483453469; h=from:to:cc:subject:date:message-id:mime-version; bh=xmYUmBQyKbZQdnQkIHN+SjlaoGcTkI+3/r0LDKRBPVU=; b=NQQ+OR3lRG9wR+N0QRvLq12cTaV/b4lL9kU0JdO/5kMfC6m4dy+B/9rA JyzOxD0dVXJlHY9Tf6yK62I7qT4tBY3QBHM1jpwctIjrTqIXeDVd3E+B4 Hyx5W5v/ZGsung1Z+yZJKQ1bJx7EaGJffODfICP0aH/x0SmVWgvmf1aic c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DeAgBrPllY/5RdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgnNEAQEBAQEfWoENtAyFJYIKhiIcgUlAEwECAQEBAQEBAWIdC4R?= =?us-ascii?q?rBBIRCkwSAUoCBDAnBA4niEmbVwGNdoIoL4pqAQEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBHYY2gX2KIC2CMAWVA4VtAYljh1CBdIUDiVaSJwEhATSBJjsBhUqIV4ENAQE?= =?us-ascii?q?B?= X-IronPort-AV: E=Sophos;i="5.33,379,1477958400"; d="scan'208,217";a="183681605" Received: from rcdn-core-12.cisco.com ([173.37.93.148]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Dec 2016 14:24:28 +0000 Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by rcdn-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id uBKEOSts010397 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 20 Dec 2016 14:24:28 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 20 Dec 2016 08:24:27 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Tue, 20 Dec 2016 08:24:27 -0600 From: "Alvaro Retana (aretana)" To: "draft-ietf-sidr-rpki-oob-setup@ietf.org" Thread-Topic: AD Review of draft-ietf-sidr-rpki-oob-setup-04 Thread-Index: AQHSWszFsmJTivNev0GoI5fThLpGTA== Date: Tue, 20 Dec 2016 14:24:27 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1d.0.161209 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_C219759D6DE44B2395C3E39156FEAFC2ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "sidr@ietf.org" Subject: [sidr] AD Review of draft-ietf-sidr-rpki-oob-setup-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 14:24:39 -0000 --_000_C219759D6DE44B2395C3E39156FEAFC2ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Um9iOg0KDQpIaSEgIEhvdyBhcmUgeW91Pw0KDQpJIGp1c3QgZmluaXNoZWQgcmVhZGluZyB0aGlz IGRvY3VtZW50LiAgVGhhbmtzIGZvciB0aGUgd29yayENCg0KSSBoYXZlIHNvbWUgY29tbWVudHMg KGJlbG93KSB0aGF0IHNob3VsZCBiZSBlYXN5IHRvIGFkZHJlc3MuICBJIHRoaW5rIHRoZSBtYWpv ciBvbmUgaXMgYWJvdXQgdGhlIG9yZGVyaW5nIG9mIHRoZSBYTUwgYXR0cmlidXRlcyAoQzIpOyBJ 4oCZbGwgc3RhcnQgdGhlIElFVEYgTGFzdCBDYWxsIG9uY2UgKGF0IGxlYXN0KSB0aGF0IHBvaW50 IGlzIHJlc29sdmVkLg0KDQpUaGFua3MhDQoNCkFsdmFyby4NCg0KDQpDMS4gV2h5IGlzbuKAmXQg YW4gSUVURiBuYW1lc3BhY2UgW1JGQzM2ODhdIHVzZWQgaW4gdGhlIFhNTCBzY2hlbWE/ICBJIHdv dWxkIHN0cm9uZ2x5IHN1Z2dlc3QgdGhhdCB5b3UgdXNlIG9uZSBhbmQgcmVxdWVzdCBpdCBpbiB0 aGUgSUFOQSBDb25zaWRlcmF0aW9ucyBTZWN0aW9uLiAgVW5saWtlIHRoZSBwdWJsaWNhdGlvbiBw cm90b2NvbCwgdGhpcyBkb2N1bWVudCBzcGVjaWZpZXMgdmVyc2lvbiAxIOKAkyB3aGljaCBvZiBj b3Vyc2UgZG9lc27igJl0IG1lYW4gdGhlcmUgaXNu4oCZdCBhIGxvbmdlciBoaXN0b3J5IGJlaGlu ZCBpdCwgc28gSeKAmW0gb3BlbiB0byBrZWVwaW5nIGEgbm9uLUlFVEYgbmFtZXNwYWNlIGlmIHRo YXQgaXMgdGhlIGNhc2UuDQoNCkMyLiBTZWN0aW9uIDQuMS4gKENvbW1vbiBQcm90b2NvbCBFbGVt ZW50cykgc2F5cyB0aGF0IOKAnFRoZSBmaXJzdCBYTUwgYXR0cmlidXRlIGluIGVhY2ggbWVzc2Fn ZSBpcyBhIHZlcnNpb24gZmllbGQu4oCdLCBhbmQgQXBwZW5kaXggQS4gKFJlbGF4TkcgU2NoZW1h KSByZWZsZWN0cyB0aGF0LiAgSG93ZXZlciwgdGhlIGV4YW1wbGVzICh0aHJvdWdob3V0IHRoZSBk b2N1bWVudCkgZG9u4oCZdCByZWZsZWN0IHRoZSBzYW1lIG9yZGVyaW5nLg0KDQpDMi4xLiBJdCB3 b3VsZCBiZSB2ZXJ5IG5pY2UgaWYgdGhlIGRlc2NyaXB0aW9uIG9mIHRoZSBmaWVsZHMgd2FzIGlu IHRoZSBzYW1lIG9yZGVyIGFzIHdoYXQgdGhlIHNjaGVtYSBkZWZpbmVzLiAgRm9yIGV4YW1wbGUs IHRoZSBzY2hlbWEgc2F5cyB0aGF0IGZvciBhIGNoaWxkX3JlcXVlc3QgdGhlIG9yZGVyIGlzOiB2 ZXJzaW9uLCBjaGlsZF9oYW5kbGUsIHRhZyBhbmQgY2hpbGRfYnBraV90YSwgYnV0IHRoZSB0ZXh0 IGluIDQuMi4xLiAoPGNoaWxkX3JlcXVlc3QvPikgcmV2ZXJzZXMgdGhlIHRhZyBhbmQgY2hpbGRf aGFuZGxlLg0KDQpDMy4gSW4gNC4yLjIuICg8cGFyZW50X3Jlc3BvbnNlLz4pLCBhcmUgdGhlIG9m ZmVyIGFuZCByZWZlcnJhbCBlbGVtZW50cyBtdXR1YWxseSBleGNsdXNpdmU/ICBXaGF0IGhhcHBl bnMgaWYgdGhlIGNsaWVudCByZWNlaXZlcyBhIHBhcmVudF9yZXNwb25zZSB3aXRoIGJvdGg/ICBJ ZiBpdCBpcyBhbiBlcnJvciwgaXMgaXQgY29uc2lkZXJlZCBhIHN5bnRheC1lcnJvciBvciBzb21l dGhpbmcgZWxzZT8gIFNlY3Rpb24gNS4gKFByb3RvY29sIFdhbGstVGhyb3VnaCkgb2ZmZXJzIGEg aGludCAo4oCcQm9iIGRvZXNuJ3QgaGF2ZSB0byBhY2NlcHQgQWxpY2UncyBvZmZlciwgYnV0IG1h eSBjaG9vc2UgdG8gZG8gc28u4oCdKSwgYnV0IHRoZSBzcGVjaWZpY2F0aW9uIGlzIHN0aWxsIG5v dCBjbGVhci4NCg0KQzQuIFRoZSBTaGVwaGVyZOKAmXMgd3JpdGUtdXAgZG9lc27igJl0IG1lbnRp b24gYW55IFhNTCBjaGVja3MgZG9uZSwgYnV0IEkgc3VzcGVjdCB0aGlzIHN0ZXAgaGFzIGluIGZh Y3QgaGFwcGVuZWQuICBQbGVhc2UgcHJvdmlkZSBkZXRhaWxzIHNvIHRoZSBTaGVwaGVyZCBjYW4g Y29tcGxldGUgdGhlIHdyaXRldXAuDQoNCkM1LiBUaGUgZXhhbXBsZSBpbiBTZWN0aW9uIDQuNC4g KDxlcnJvci8+KSBkb2VzbuKAmXQgaW5jbHVkZSB0aGUgY29tcGxldGUgY2hpbGRfcmVxdWVzdCBt ZXNzYWdlIHdoaWNoIHByZXN1bWFibHkgY2F1c2VkIHRoZSBlcnJvci4NCg0KQzYuIEkgdGhpbmsg dGhlIGZvbGxvd2luZyByZWZlcmVuY2VzIGNhbiBiZSBtYWRlIEluZm9ybWF0aXZlOiBSRkM1Mjgw LCBSRkM1NjUyLg0K --_000_C219759D6DE44B2395C3E39156FEAFC2ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <2B8B8917B54284448B9381A0560D2C5C@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxuczptdj0iaHR0cDovL21hY1ZtbFNj aGVtYVVyaSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1odG1sNDAiPg0KPGhlYWQ+ DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hh cnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJUaXRsZSIgY29udGVudD0iIj4NCjxtZXRhIG5hbWU9 IktleXdvcmRzIiBjb250ZW50PSIiPg0KPG1ldGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJN aWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQgbWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9u dCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ291cmllciBOZXci Ow0KCXBhbm9zZS0xOjIgNyAzIDkgMiAyIDUgMiA0IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZh bWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBm b250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIg NCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05v cm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFw dDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KYTpsaW5rLCBz cGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjND MTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6 OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpzcGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbDsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3RleHQ7DQoJ Zm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCnNwYW4uRW1haWxTdHls ZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLWNvbXBvc2U7DQoJZm9udC1mYW1pbHk6Q2Fs aWJyaTsNCgljb2xvcjp3aW5kb3d0ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0 eWxlOm5vcm1hbDt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1l OiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNv LXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseToiQ291cmllciBO ZXciO30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1z dHlsZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9 DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4 PSIxMDI3Ii8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxv OnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIx Ii8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBi Z2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0Rjcy Ij4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Um9iOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+SGkhJm5ic3A7IEhvdyBhcmUgeW91PzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SSBqdXN0IGZpbmlzaGVkIHJlYWRpbmcgdGhpcyBk b2N1bWVudC4mbmJzcDsgVGhhbmtzIGZvciB0aGUgd29yayE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkkgaGF2ZSBzb21lIGNvbW1lbnRzIChiZWxvdykgdGhhdCBz aG91bGQgYmUgZWFzeSB0byBhZGRyZXNzLiZuYnNwOyBJIHRoaW5rIHRoZSBtYWpvciBvbmUgaXMg YWJvdXQgdGhlIG9yZGVyaW5nIG9mIHRoZSBYTUwgYXR0cmlidXRlcyAoQzIpOyBJ4oCZbGwgc3Rh cnQgdGhlIElFVEYgTGFzdCBDYWxsIG9uY2UgKGF0IGxlYXN0KSB0aGF0IHBvaW50IGlzIHJlc29s dmVkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VGhhbmtzITxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QWx2YXJvLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPkMxLiBXaHkgaXNu4oCZdCBhbiBJRVRGIG5hbWVzcGFjZSBbUkZDMzY4OF0gdXNlZCBpbiB0 aGUgWE1MIHNjaGVtYT8mbmJzcDsgSSB3b3VsZCBzdHJvbmdseSBzdWdnZXN0IHRoYXQgeW91IHVz ZSBvbmUgYW5kIHJlcXVlc3QgaXQgaW4gdGhlIElBTkEgQ29uc2lkZXJhdGlvbnMgU2VjdGlvbi4m bmJzcDsgVW5saWtlIHRoZSBwdWJsaWNhdGlvbiBwcm90b2NvbCwgdGhpcyBkb2N1bWVudA0KIHNw ZWNpZmllcyB2ZXJzaW9uIDEg4oCTIHdoaWNoIG9mIGNvdXJzZSBkb2VzbuKAmXQgbWVhbiB0aGVy ZSBpc27igJl0IGEgbG9uZ2VyIGhpc3RvcnkgYmVoaW5kIGl0LCBzbyBJ4oCZbSBvcGVuIHRvIGtl ZXBpbmcgYSBub24tSUVURiBuYW1lc3BhY2UgaWYgdGhhdCBpcyB0aGUgY2FzZS4NCjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QzIuIFNlY3Rpb24gNC4xLiAoQ29t bW9uIFByb3RvY29sIEVsZW1lbnRzKSBzYXlzIHRoYXQg4oCcVGhlIGZpcnN0IFhNTCBhdHRyaWJ1 dGUgaW4gZWFjaCBtZXNzYWdlIGlzIGEgdmVyc2lvbiBmaWVsZC7igJ0sIGFuZCBBcHBlbmRpeCBB LiAoUmVsYXhORyBTY2hlbWEpIHJlZmxlY3RzIHRoYXQuJm5ic3A7IEhvd2V2ZXIsIHRoZSBleGFt cGxlcyAodGhyb3VnaG91dCB0aGUgZG9jdW1lbnQpDQogZG9u4oCZdCByZWZsZWN0IHRoZSBzYW1l IG9yZGVyaW5nLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QzIu MS4gSXQgd291bGQgYmUgdmVyeSBuaWNlIGlmIHRoZSBkZXNjcmlwdGlvbiBvZiB0aGUgZmllbGRz IHdhcyBpbiB0aGUgc2FtZSBvcmRlciBhcyB3aGF0IHRoZSBzY2hlbWEgZGVmaW5lcy4mbmJzcDsg Rm9yIGV4YW1wbGUsIHRoZSBzY2hlbWEgc2F5cyB0aGF0IGZvciBhIGNoaWxkX3JlcXVlc3QgdGhl IG9yZGVyIGlzOiB2ZXJzaW9uLCBjaGlsZF9oYW5kbGUsIHRhZw0KIGFuZCBjaGlsZF9icGtpX3Rh LCBidXQgdGhlIHRleHQgaW4gNC4yLjEuICgmbHQ7Y2hpbGRfcmVxdWVzdC8mZ3Q7KSByZXZlcnNl cyB0aGUgdGFnIGFuZCBjaGlsZF9oYW5kbGUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij5DMy4gSW4gNC4yLjIuICgmbHQ7cGFyZW50X3Jlc3BvbnNlLyZndDspLCBh cmUgdGhlIG9mZmVyIGFuZCByZWZlcnJhbCBlbGVtZW50cyBtdXR1YWxseSBleGNsdXNpdmU/ICZu YnNwO1doYXQgaGFwcGVucyBpZiB0aGUgY2xpZW50IHJlY2VpdmVzIGEgcGFyZW50X3Jlc3BvbnNl IHdpdGggYm90aD8mbmJzcDsgSWYgaXQgaXMgYW4gZXJyb3IsIGlzIGl0IGNvbnNpZGVyZWQgYSBz eW50YXgtZXJyb3INCiBvciBzb21ldGhpbmcgZWxzZT8mbmJzcDsgU2VjdGlvbiA1LiAoUHJvdG9j b2wgV2Fsay1UaHJvdWdoKSBvZmZlcnMgYSBoaW50ICjigJxCb2IgZG9lc24ndCBoYXZlIHRvIGFj Y2VwdCBBbGljZSdzIG9mZmVyLCBidXQgbWF5IGNob29zZSB0byBkbyBzby7igJ0pLCBidXQgdGhl IHNwZWNpZmljYXRpb24gaXMgc3RpbGwgbm90IGNsZWFyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+QzQuIFRoZSBTaGVwaGVyZOKAmXMgd3JpdGUtdXAgZG9lc27i gJl0IG1lbnRpb24gYW55IFhNTCBjaGVja3MgZG9uZSwgYnV0IEkgc3VzcGVjdCB0aGlzIHN0ZXAg aGFzIGluIGZhY3QgaGFwcGVuZWQuJm5ic3A7IFBsZWFzZSBwcm92aWRlIGRldGFpbHMgc28gdGhl IFNoZXBoZXJkIGNhbiBjb21wbGV0ZSB0aGUgd3JpdGV1cC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkM1LiBUaGUgZXhhbXBsZSBpbiBTZWN0aW9uIDQuNC4gKCZs dDtlcnJvci8mZ3Q7KSBkb2VzbuKAmXQgaW5jbHVkZSB0aGUgY29tcGxldGUgY2hpbGRfcmVxdWVz dCBtZXNzYWdlIHdoaWNoIHByZXN1bWFibHkgY2F1c2VkIHRoZSBlcnJvci48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkM2LiBJIHRoaW5rIHRoZSBmb2xsb3dpbmcg cmVmZXJlbmNlcyBjYW4gYmUgbWFkZSBJbmZvcm1hdGl2ZTogUkZDNTI4MCwgUkZDNTY1Mi48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_C219759D6DE44B2395C3E39156FEAFC2ciscocom_-- From nobody Tue Dec 20 09:34:46 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF7E9129BB8; Tue, 20 Dec 2016 09:34:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.001 X-Spam-Level: X-Spam-Status: No, score=-5.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3-HglI168UEL; Tue, 20 Dec 2016 09:34:43 -0800 (PST) Received: from adrilankha.hactrn.net (adrilankha.hactrn.net [IPv6:2001:418:1::19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0ABB1294FD; Tue, 20 Dec 2016 09:34:40 -0800 (PST) Received: from minas-ithil.hactrn.net (c-73-47-197-23.hsd1.ma.comcast.net [73.47.197.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "nargothrond.hactrn.net", Issuer "Grunchweather Associates" (not verified)) by adrilankha.hactrn.net (Postfix) with ESMTPS id AFBA83983C; Tue, 20 Dec 2016 17:34:39 +0000 (UTC) Received: from minas-ithil.hactrn.net (localhost [IPv6:::1]) by minas-ithil.hactrn.net (Postfix) with ESMTP id DD3B64469FFE; Tue, 20 Dec 2016 12:33:36 -0500 (EST) Date: Tue, 20 Dec 2016 12:33:36 -0500 From: Rob Austein To: "Alvaro Retana (aretana)" In-Reply-To: References: User-Agent: Wanderlust/2.15.5 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Message-Id: <20161220173336.DD3B64469FFE@minas-ithil.hactrn.net> Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "draft-ietf-sidr-rpki-oob-setup@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-rpki-oob-setup-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 17:34:45 -0000 At Tue, 20 Dec 2016 14:24:27 +0000, Alvaro Retana (aretana) wrote: >=20 > C1. Why isn?t an IETF namespace [RFC3688] used in the XML schema? I > would strongly suggest that you use one and request it in the IANA > Considerations Section. Unlike the publication protocol, this > document specifies version 1 ? which of course doesn?t mean there > isn?t a longer history behind it, so I?m open to keeping a non-IETF > namespace if that is the case. There's a longer history behind it :) This protocol started out circa 2010 as part of another non-IETF protocol ("myrpki", which long since went to the big bit-bucket in the sky). So this is a revised protocol with semantics identical to the useful subset of the "myrpki" protocol, with some syntax changes to make the protocol operation clearer (some of the "myrpki" syntax choices were obscure, to put it mildly, mea culpa). All that said, this protocol in its current form has been in use for years now, so there's deployed code which I'd really rather not break if we can avoid it. > C2. Section 4.1. (Common Protocol Elements) says that ?The first XML > attribute in each message is a version field.?, and Appendix > A. (RelaxNG Schema) reflects that. However, the examples > (throughout the document) don?t reflect the same ordering. >=20 > C2.1. It would be very nice if the description of the fields was in > the same order as what the schema defines. For example, the schema > says that for a child_request the order is: version, child_handle, > tag and child_bpki_ta, but the text in 4.2.1. () > reverses the tag and child_handle. Good catch(es). If I recall correctly, XML attributes are an unordered set, so "first" doesn't really make sense for attributes (elements are a different story). So my text cited in 4.1 is wrong. That said, I agree that having attribute order in the examples agree with attribute order in the text would be clearer. Order in the examples is arbitrary because the examples are produced by a program which doesn't preserve ordering, but I think I know how to convince the lxml library to use a particular order, so this is probably just a small tweak to the example generator. > C3. In 4.2.2. (), are the offer and referral > elements mutually exclusive? What happens if the client receives a > parent_response with both? If it is an error, is it considered a > syntax-error or something else? Section 5. (Protocol Walk-Through) > offers a hint (?Bob doesn't have to accept Alice's offer, but may > choose to do so.?), but the specification is still not clear. A containing both an offer and referrals would be unusual, but I don't think it's illegal, nor can I think of any reason why we should make it illegal. > C4. The Shepherd?s write-up doesn?t mention any XML checks done, but > I suspect this step has in fact happened. Please provide details so > the Shepherd can complete the writeup. Yep, libxml2 RelaxNG, examples validated during compilation, same as with the publication protocol. > C5. The example in Section 4.4. () doesn?t include the > complete child_request message which presumably caused the error. Good catch. Guess that should have been "syntax-error" rather than "refused" :(. Schema validation doesn't help here, as the schema deliberately allows encapsulation of a non-compliant PDU (otherwise "syntax-error" would be problematic). Root cause is a bug in the way the example generator constructs the error examples, will fix. > C6. I think the following references can be made Informative: > RFC5280, RFC5652. Grey area, since one can't generate some of the PDUs unless one can generate X.509 and CMS, but I have no objection to changing these to Informative if you prefer. From nobody Tue Dec 20 12:55:30 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 21644129605; Tue, 20 Dec 2016 12:55:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.621 X-Spam-Level: X-Spam-Status: No, score=-17.621 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BJOqhmN3m2R2; Tue, 20 Dec 2016 12:55:27 -0800 (PST) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33D031295F8; Tue, 20 Dec 2016 12:55:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=11780; q=dns/txt; s=iport; t=1482267327; x=1483476927; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=xGFWiwKfFJiB+z+QcIfIuuo9W8jXO0XfMtbHMnmAb+E=; b=KQ5g9dlf+OIbWdE45X3gJBca/SlZHyzHOidvRJhEdB+S3SbnIlhBsWTu TWLzWWaD4JyAf5DtVplPCmWkhaDRccx8Pn1C2KPUHglMsaXR5UPVKAhwA /GBpuhCwdlDAwY4NBAq45mJKSKMqOm/3P0j/+czP0zQxd04iRUVNGIl/x U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AkAQCMmVlY/49dJa1XBhkBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYJzRAEBAQEBH1qBBgeNSZZaj2mFJYIKhiICGoFPPxQBAgEBAQE?= =?us-ascii?q?BAQFiKIRpAgQSEVYQAgEIDjQCAgIwJQIEDgUiiEmbMgGNdoIoL4pbAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBHYY2gX0IglSEMiWCbS2CMAWVA4VtAYx4hDuBdBiEa4l?= =?us-ascii?q?WjhqEDgEfN4EmOwGFSnKHZYENAQEB?= X-IronPort-AV: E=Sophos;i="5.33,380,1477958400"; d="scan'208,217";a="362791515" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Dec 2016 20:55:26 +0000 Received: from XCH-ALN-002.cisco.com (xch-aln-002.cisco.com [173.36.7.12]) by rcdn-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id uBKKtQvN017978 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 20 Dec 2016 20:55:26 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-002.cisco.com (173.36.7.12) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 20 Dec 2016 14:55:25 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Tue, 20 Dec 2016 14:55:25 -0600 From: "Alvaro Retana (aretana)" To: Rob Austein Thread-Topic: AD Review of draft-ietf-sidr-rpki-oob-setup-04 Thread-Index: AQHSWszFsmJTivNev0GoI5fThLpGTKERfV4A///kkAA= Date: Tue, 20 Dec 2016 20:55:25 +0000 Message-ID: <51D959C0-064D-451F-8224-737613A60F86@cisco.com> References: <20161220173336.DD3B64469FFE@minas-ithil.hactrn.net> In-Reply-To: <20161220173336.DD3B64469FFE@minas-ithil.hactrn.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1d.0.161209 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_51D959C0064D451F8224737613A60F86ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "draft-ietf-sidr-rpki-oob-setup@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-rpki-oob-setup-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 20:55:29 -0000 --_000_51D959C0064D451F8224737613A60F86ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gMTIvMjAvMTYsIDEyOjMzIFBNLCAiUm9iIEF1c3RlaW4iIDxzcmFAaGFjdHJuLm5ldD4gd3Jv dGU6DQoNCg0KDQp8IEF0IFR1ZSwgMjAgRGVjIDIwMTYgMTQ6MjQ6MjcgKzAwMDAsIEFsdmFybyBS ZXRhbmEgKGFyZXRhbmEpIHdyb3RlOg0KDQp8IHwgQzEuIFdoeSBpc24/dCBhbiBJRVRGIG5hbWVz cGFjZSBbUkZDMzY4OF0gdXNlZCBpbiB0aGUgWE1MIHNjaGVtYT8gIEkNCg0KfCB8IHdvdWxkIHN0 cm9uZ2x5IHN1Z2dlc3QgdGhhdCB5b3UgdXNlIG9uZSBhbmQgcmVxdWVzdCBpdCBpbiB0aGUgSUFO QQ0KDQp8IHwgQ29uc2lkZXJhdGlvbnMgU2VjdGlvbi4gIFVubGlrZSB0aGUgcHVibGljYXRpb24g cHJvdG9jb2wsIHRoaXMNCg0KfCB8IGRvY3VtZW50IHNwZWNpZmllcyB2ZXJzaW9uIDEgPyB3aGlj aCBvZiBjb3Vyc2UgZG9lc24/dCBtZWFuIHRoZXJlDQoNCnwgfCBpc24/dCBhIGxvbmdlciBoaXN0 b3J5IGJlaGluZCBpdCwgc28gST9tIG9wZW4gdG8ga2VlcGluZyBhIG5vbi1JRVRGDQoNCnwgfCBu YW1lc3BhY2UgaWYgdGhhdCBpcyB0aGUgY2FzZS4NCg0KfA0KDQp8IFRoZXJlJ3MgYSBsb25nZXIg aGlzdG9yeSBiZWhpbmQgaXQgOikNCg0KDQoNCk9rLCBwbGVhc2UgaW5jbHVkZSBzb21lIG9mIHRo YXQgaW4gdGhlIGRvY3VtZW50Lg0KDQoNCg0K4oCmDQoNCnwgfCBDMi4gU2VjdGlvbiA0LjEuIChD b21tb24gUHJvdG9jb2wgRWxlbWVudHMpIHNheXMgdGhhdCA/VGhlIGZpcnN0IFhNTA0KDQp8IHwg YXR0cmlidXRlIGluIGVhY2ggbWVzc2FnZSBpcyBhIHZlcnNpb24gZmllbGQuPywgYW5kIEFwcGVu ZGl4DQoNCnwgfCBBLiAoUmVsYXhORyBTY2hlbWEpIHJlZmxlY3RzIHRoYXQuICBIb3dldmVyLCB0 aGUgZXhhbXBsZXMNCg0KfCB8ICh0aHJvdWdob3V0IHRoZSBkb2N1bWVudCkgZG9uP3QgcmVmbGVj dCB0aGUgc2FtZSBvcmRlcmluZy4NCg0K4oCmDQoNCnwgR29vZCBjYXRjaChlcykuICBJZiBJIHJl Y2FsbCBjb3JyZWN0bHksIFhNTCBhdHRyaWJ1dGVzIGFyZSBhbg0KDQp8IHVub3JkZXJlZCBzZXQs IHNvICJmaXJzdCIgZG9lc24ndCByZWFsbHkgbWFrZSBzZW5zZSBmb3IgYXR0cmlidXRlcw0KDQp8 IChlbGVtZW50cyBhcmUgYSBkaWZmZXJlbnQgc3RvcnkpLiAgU28gbXkgdGV4dCBjaXRlZCBpbiA0 LjEgaXMgd3JvbmcuDQoNCg0KDQpZZXMsIHlvdeKAmXJlIHJpZ2h0LiAgV2hlbiBJIGxvb2tlZCBp bnRvIGl0IEkgZGlkbuKAmXQgbm90aWNlIHRoZSBkaWZmZXJlbmNlIGJldHdlZW4gYXR0cmlidXRl cyBhbmQgZWxlbWVudHMuICDimLkNCg0KDQoNCknigJlsbCBnbyBhaGVhZCBhbmQgc3RhcnQgdGhl IElFVEYgTGFzdCBDYWxsLg0KDQoNCg0K4oCmDQoNCnwgfCBDMy4gSW4gNC4yLjIuICg8cGFyZW50 X3Jlc3BvbnNlLz4pLCBhcmUgdGhlIG9mZmVyIGFuZCByZWZlcnJhbA0KDQp8IHwgZWxlbWVudHMg bXV0dWFsbHkgZXhjbHVzaXZlPyAgV2hhdCBoYXBwZW5zIGlmIHRoZSBjbGllbnQgcmVjZWl2ZXMg YQ0KDQp8IHwgcGFyZW50X3Jlc3BvbnNlIHdpdGggYm90aD8gIElmIGl0IGlzIGFuIGVycm9yLCBp cyBpdCBjb25zaWRlcmVkIGENCg0KfCB8IHN5bnRheC1lcnJvciBvciBzb21ldGhpbmcgZWxzZT8g IFNlY3Rpb24gNS4gKFByb3RvY29sIFdhbGstVGhyb3VnaCkNCg0KfCB8IG9mZmVycyBhIGhpbnQg KD9Cb2IgZG9lc24ndCBoYXZlIHRvIGFjY2VwdCBBbGljZSdzIG9mZmVyLCBidXQgbWF5DQoNCnwg fCBjaG9vc2UgdG8gZG8gc28uPyksIGJ1dCB0aGUgc3BlY2lmaWNhdGlvbiBpcyBzdGlsbCBub3Qg Y2xlYXIuDQoNCnwNCg0KfCBBIDxwYXJlbnRfcmVzcG9uc2UvPiBjb250YWluaW5nIGJvdGggYW4g b2ZmZXIgYW5kIHJlZmVycmFscyB3b3VsZCBiZQ0KDQp8IHVudXN1YWwsIGJ1dCBJIGRvbid0IHRo aW5rIGl0J3MgaWxsZWdhbCwgbm9yIGNhbiBJIHRoaW5rIG9mIGFueSByZWFzb24NCg0KfCB3aHkg d2Ugc2hvdWxkIG1ha2UgaXQgaWxsZWdhbC4NCg0KDQoNCklmIGl0IGlzIG5vdCBpbGxlZ2FsLCB3 aGF0IHNob3VsZCB0aGUgY2hpbGQgZG8/DQoNCg0KDQpJbiBTZWN0aW9uIDUgeW91IGhpbnRlZCBh dCB0aGUgZmFjdCB0aGF0IEJvYiBjb3VsZCBjaG9vc2UuICBQbGVhc2UgbWFrZSB0aGF0IGNsZWFy IOKAkyBpdCB3b3VsZCBhbHNvIGJlIGEgZ29vZCBpZGVhIHRvIGluY2x1ZGUgc29tZSBvZiB0aGUg Y29uc2lkZXJhdGlvbnMgdGhhdCBtYXkgY29tZSBpbnRvIHBsYXkgd2hlbiBkZWNpZGluZy4NCg0K DQoNClRoYW5rcyENCg0KDQoNCkFsdmFyby4NCg== --_000_51D959C0064D451F8224737613A60F86ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <7B2E8D301226CF419B3E48D06412C7DB@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAg MCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsN CglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1p bHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBE ZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0K CXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnAuTXNvUGxhaW5UZXh0LCBsaS5Nc29QbGFpblRleHQsIGRpdi5Nc29Q bGFpblRleHQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFp biBUZXh0IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZv bnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTt9DQpzcGFuLkVtYWlsU3R5bGUx Nw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNv bG9yOndpbmRvd3RleHQ7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFs O30NCnNwYW4uUGxhaW5UZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiUGxhaW4gVGV4dCBDaGFy IjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IlBsYWluIFRleHQi Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5tc29JbnMNCgl7bXNvLXN0eWxlLXR5cGU6 ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3Np emU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYu V29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+ DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJw dXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPk9uIDEyLzIwLzE2LCAxMjozMyBQTSwgJnF1b3Q7Um9iIEF1c3RlaW4mcXVvdDsgJmx0O3Ny YUBoYWN0cm4ubmV0Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCBB dCBUdWUsIDIwIERlYyAyMDE2IDE0OjI0OjI3ICYjNDM7MDAwMCwgQWx2YXJvIFJldGFuYSAoYXJl dGFuYSkgd3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IHwg QzEuIFdoeSBpc24/dCBhbiBJRVRGIG5hbWVzcGFjZSBbUkZDMzY4OF0gdXNlZCBpbiB0aGUgWE1M IHNjaGVtYT8mbmJzcDsmbmJzcDtJPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij58IHwgd291bGQgc3Ryb25nbHkgc3VnZ2VzdCB0aGF0IHlvdSB1c2Ugb25lIGFuZCByZXF1 ZXN0IGl0IGluIHRoZSBJQU5BPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij58IHwgQ29uc2lkZXJhdGlvbnMgU2VjdGlvbi4mbmJzcDsmbmJzcDtVbmxpa2UgdGhlIHB1Ymxp Y2F0aW9uIHByb3RvY29sLCB0aGlzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij58IHwgZG9jdW1lbnQgc3BlY2lmaWVzIHZlcnNpb24gMSA/IHdoaWNoIG9mIGNvdXJzZSBk b2Vzbj90IG1lYW4gdGhlcmU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PnwgfCBpc24/dCBhIGxvbmdlciBoaXN0b3J5IGJlaGluZCBpdCwgc28gST9tIG9wZW4gdG8ga2Vl cGluZyBhIG5vbi1JRVRGPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58 IHwgbmFtZXNwYWNlIGlmIHRoYXQgaXMgdGhlIGNhc2UuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij58PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij58IFRoZXJlJ3MgYSBsb25nZXIgaGlzdG9yeSBiZWhpbmQgaXQgOik8L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPk9rLCBwbGVhc2UgaW5jbHVkZSBzb21lIG9mIHRoYXQgaW4gdGhlIGRvY3VtZW50LjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+4oCmPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij58IHwgQzIuIFNlY3Rpb24gNC4xLiAoQ29tbW9uIFByb3RvY29sIEVsZW1lbnRzKSBzYXlzIHRo YXQgP1RoZSBmaXJzdCBYTUw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PnwgfCBhdHRyaWJ1dGUgaW4gZWFjaCBtZXNzYWdlIGlzIGEgdmVyc2lvbiBmaWVsZC4/LCBhbmQg QXBwZW5kaXg8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgfCBBLiAo UmVsYXhORyBTY2hlbWEpIHJlZmxlY3RzIHRoYXQuJm5ic3A7Jm5ic3A7SG93ZXZlciwgdGhlIGV4 YW1wbGVzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IHwgKHRocm91 Z2hvdXQgdGhlIGRvY3VtZW50KSBkb24/dCByZWZsZWN0IHRoZSBzYW1lIG9yZGVyaW5nLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+4oCmPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IEdvb2QgY2F0Y2goZXMpLiZuYnNwOyZuYnNwO0lmIEkg cmVjYWxsIGNvcnJlY3RseSwgWE1MIGF0dHJpYnV0ZXMgYXJlIGFuPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IHVub3JkZXJlZCBzZXQsIHNvICZxdW90O2ZpcnN0JnF1 b3Q7IGRvZXNuJ3QgcmVhbGx5IG1ha2Ugc2Vuc2UgZm9yIGF0dHJpYnV0ZXM8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgKGVsZW1lbnRzIGFyZSBhIGRpZmZlcmVudCBz dG9yeSkuJm5ic3A7Jm5ic3A7U28gbXkgdGV4dCBjaXRlZCBpbiA0LjEgaXMgd3JvbmcuPC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij5ZZXMsIHlvdeKAmXJlIHJpZ2h0LiZuYnNwOyBXaGVuIEkgbG9va2VkIGlu dG8gaXQgSSBkaWRu4oCZdCBub3RpY2UgdGhlIGRpZmZlcmVuY2UgYmV0d2VlbiBhdHRyaWJ1dGVz IGFuZCBlbGVtZW50cy4mbmJzcDsNCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3Mi Pkw8L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5J4oCZbGwgZ28gYWhlYWQgYW5kIHN0YXJ0IHRo ZSBJRVRGIExhc3QgQ2FsbC48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPuKApjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCB8IEMzLiBJbiA0LjIuMi4gKCZsdDtwYXJlbnRfcmVz cG9uc2UvJmd0OyksIGFyZSB0aGUgb2ZmZXIgYW5kIHJlZmVycmFsPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IHwgZWxlbWVudHMgbXV0dWFsbHkgZXhjbHVzaXZlPyZu YnNwOyZuYnNwO1doYXQgaGFwcGVucyBpZiB0aGUgY2xpZW50IHJlY2VpdmVzIGE8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgfCBwYXJlbnRfcmVzcG9uc2Ugd2l0aCBi b3RoPyZuYnNwOyZuYnNwO0lmIGl0IGlzIGFuIGVycm9yLCBpcyBpdCBjb25zaWRlcmVkIGE8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgfCBzeW50YXgtZXJyb3Igb3Ig c29tZXRoaW5nIGVsc2U/Jm5ic3A7Jm5ic3A7U2VjdGlvbiA1LiAoUHJvdG9jb2wgV2Fsay1UaHJv dWdoKTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCB8IG9mZmVycyBh IGhpbnQgKD9Cb2IgZG9lc24ndCBoYXZlIHRvIGFjY2VwdCBBbGljZSdzIG9mZmVyLCBidXQgbWF5 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IHwgY2hvb3NlIHRvIGRv IHNvLj8pLCBidXQgdGhlIHNwZWNpZmljYXRpb24gaXMgc3RpbGwgbm90IGNsZWFyLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+fCBBICZsdDtwYXJlbnRfcmVzcG9uc2UvJmd0OyBjb250YWluaW5n IGJvdGggYW4gb2ZmZXIgYW5kIHJlZmVycmFscyB3b3VsZCBiZTxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+fCB1bnVzdWFsLCBidXQgSSBkb24ndCB0aGluayBpdCdzIGls bGVnYWwsIG5vciBjYW4gSSB0aGluayBvZiBhbnkgcmVhc29uPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij58IHdoeSB3ZSBzaG91bGQgbWFrZSBpdCBpbGxlZ2FsLjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+SWYgaXQgaXMgbm90IGlsbGVnYWwsIHdoYXQgc2hvdWxkIHRoZSBjaGls ZCBkbz88L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPkluIFNlY3Rpb24gNSB5b3UgaGludGVkIGF0IHRoZSBm YWN0IHRoYXQgQm9iIGNvdWxkIGNob29zZS4mbmJzcDsgUGxlYXNlIG1ha2UgdGhhdCBjbGVhciDi gJMgaXQgd291bGQgYWxzbyBiZSBhIGdvb2QgaWRlYSB0byBpbmNsdWRlIHNvbWUgb2YgdGhlIGNv bnNpZGVyYXRpb25zIHRoYXQgbWF5IGNvbWUgaW50byBwbGF5IHdoZW4gZGVjaWRpbmcuPC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij5UaGFua3MhPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5BbHZhcm8uPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_51D959C0064D451F8224737613A60F86ciscocom_-- From nobody Tue Dec 20 13:06:11 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B17681279EB; Tue, 20 Dec 2016 13:06:06 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.40.2 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <148226796672.23778.11324483834700038816.idtracker@ietfa.amsl.com> Date: Tue, 20 Dec 2016 13:06:06 -0800 Archived-At: Cc: Chris Morrow , sidr-chairs@ietf.org, draft-ietf-sidr-rpki-oob-setup@ietf.org, sidr@ietf.org Subject: [sidr] Last Call: (An Out-Of-Band Setup Protocol For RPKI Production Services) to Proposed Standard X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Reply-To: ietf@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 21:06:06 -0000 The IESG has received a request from the Secure Inter-Domain Routing WG (sidr) to consider the following document: - 'An Out-Of-Band Setup Protocol For RPKI Production Services' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2017-01-10. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This note describes a simple out-of-band protocol to ease setup of the RPKI provisioning and publication protocols between two parties. The protocol is encoded in a small number of XML messages, which can be passed back and forth by any mutually agreeable secure means. This setup protocol is not part of the provisioning or publication protocol, rather, it is intended to simplify configuration of these protocols by setting up relationships and exchanging BPKI keying material. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-oob-setup/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-oob-setup/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Tue Dec 20 14:56:17 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D607C129573; Tue, 20 Dec 2016 14:56:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GpQNwT_wfDZr; Tue, 20 Dec 2016 14:56:11 -0800 (PST) Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0095.outbound.protection.outlook.com [23.103.200.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3ED4C1294B0; Tue, 20 Dec 2016 14:56:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=6lUr8UYcMCfWXBQP8qVdUvMiBdfy3BfYWcCb4epAVwM=; b=oUTmoIYOIW04/ZvjVMSLjNLhvjl461iWKveBpn/VJlDqmD1OmoamyO4nCFW9c8XiHHZL5iUoK8qezMchkrhclyE51KTE71qulexvXRC0P72FmUecRR6UlnB+e0G5ajr4C+cLZuebe38y2owoke4vpZllxAxeDVMdfEUaX+WXo/s= Received: from DM2PR09MB0446.namprd09.prod.outlook.com (10.161.252.145) by DM2PR09MB0445.namprd09.prod.outlook.com (10.161.252.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Tue, 20 Dec 2016 22:56:09 +0000 Received: from DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) by DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) with mapi id 15.01.0789.018; Tue, 20 Dec 2016 22:56:09 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "Alvaro Retana (aretana)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" , "keyur@arrcus.com" Thread-Topic: Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) Thread-Index: AQHSUmenE2EHhTbiU0q7IXrD4ZYx2aEF0Iz4gAN2lwCACDChKA== Date: Tue, 20 Dec 2016 22:56:09 +0000 Message-ID: References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> , <98186E08-8CAC-4EB0-9E84-BBABACC43678@cisco.com> In-Reply-To: <98186E08-8CAC-4EB0-9E84-BBABACC43678@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=kotikalapudi.sriram@nist.gov; x-originating-ip: [129.6.223.52] x-ms-office365-filtering-correlation-id: d6b86271-9178-4564-093b-08d4292b6376 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DM2PR09MB0445; x-microsoft-exchange-diagnostics: 1; DM2PR09MB0445; 7:WvSRLorkwKS22tfSq3oAUsKq8M4fF5kW50woiKYv+WaIYO60KIfcC8GmkeJ8hsr0G1GOyFkPmnT13pfyQZMa9LtZeDQPdVjK02Z0ZpBZJdOzrDwxGMaOyJPKkPiwwExCqZwR8XC8zfROUnsKS/DiWkI+kurHCPBwfPuHyFgH5PfjGSvTYzgIjCFzuxNnYGZyarZcLMyeOBV7gOUZHH6KliIjWNaO6im+8ytKEUlIKXoHocupKMNfDPCAhS/NHZxhAuZWoH/jfL80QhFP9WvRkt5C170SR3Byvp6K4nPzQol0CB/ypyNQNSnT2mi+bIUgH9B+dq2LcEt+vIGHI/pDDFqi+kvsh9JXr9yNVqG3zgjSVaDeLINvRMNJh3G4WA6AjdBC5YamBcgE5Mu+soE8268N8OSUQIKgxKweykFgA9yPDduuQS4B81sbNl2zv6mrmUyaAt1GHXoY86Q3JTw2XA== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(6072148); SRVR:DM2PR09MB0445; BCL:0; PCL:0; RULEID:; SRVR:DM2PR09MB0445; x-forefront-prvs: 0162ACCC24 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39850400002)(39860400002)(39410400002)(39840400002)(39450400003)(189002)(199003)(9686002)(8676002)(6606003)(5660300001)(189998001)(122556002)(2501003)(2950100002)(97736004)(86362001)(25786008)(7736002)(6436002)(5001770100001)(230783001)(2201001)(74316002)(2906002)(3280700002)(66066001)(81156014)(3660700001)(54356999)(50986999)(229853002)(81166006)(76176999)(101416001)(38730400001)(2900100001)(77096006)(106356001)(7696004)(6116002)(19627405001)(33656002)(3846002)(105586002)(106116001)(92566002)(68736007)(99286002)(4326007)(102836003)(8936002)(6506006)(76576001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0445; H:DM2PR09MB0446.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR09MB044634DCE6C5D55112DDEF6384900DM2PR09MB0446namp_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Dec 2016 22:56:09.2463 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR09MB0445 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 22:56:14 -0000 --_000_DM2PR09MB044634DCE6C5D55112DDEF6384900DM2PR09MB0446namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Thinking about it some more, I now find that your proposed solution of addi= ng a signature with pCount =3D 0 at the border of the confederation works w= ell and fully addresses these two concerns (the second concern is new). (1) Your proposed solution addresses the concern you brought up in an earli= er message - https://www.ietf.org/mail-archive/web/sidr/current/msg08081.html (2) It also keeps confed ASes from failing to validate properly the signatu= re injected at the boundary. This is explained below. First let us take note of the following two instructions that are in the sp= ec: (a) From page Section 4.3 (page 16): "When a confederation member sends a BGPsec update message to a peer that is a member of the same confederation but is a different Member-AS, the confederation member puts its (private) Member-AS Number (as opposed to the public AS Confederation Identifier) in the AS Number field of the Secure_Path Segment that it adds to the BGPsec update message." (b) From Section 5.2 (page 25): (note: this one is part of the method of = identifying the Target AS while assembling the data to be hashed for signat= ure validation) "For each other Signature Segment (N smaller than K), the 'Target AS Number' is AS(N+1), the AS number in the Secure_Path segment that corresponds to the Signature Segment added immediately after the one being processed." Now I will explain what I mean by (2) above using the same example that you= presented earlier: AS1 -> AS2/AS65001 -> AS65002/AS2 -> AS3 (AS2 is the Confederation ID and A= S65001 and AS65002 are Members) In this example, by "signature injected at the boundary", we mean the signa= ture of AS1 to AS2 (in the update received by AS65001). Let us think about = the step where AS65002 is processing the update from AS65001 and validating= the "signature injected at the boundary". Following step (a) above, AS6500= 1 put in its own private AS number (i.e. AS65001) in the Secure_Path Segmen= t that it added to the BGPsec update message forwarded to AS65002. Therefor= e, following step (b), AS65002 identifies AS65001 to be the 'Target AS Numb= er' for the data to be hashed for validating the signature. However, this w= ould falsely result in 'Invalid' outcome for the signature being validated = by AS65002. Because AS1 actually signed to AS2 (the public AS number), and = hence the 'Target AS Number' is actually AS2. Now the solution: Your suggested solution says that AS65001 should add a si= gnature where it uses the private key of the public AS (i.e. AS2) to sign a= nd forward the update to itself (AS65001) with pCount =3D 0. Correspondingl= y, AS65001 also puts in the public AS number (i.e. AS2) in the Secure_Path = Segment that it adds to the BGPsec update message sent to itself. (Please c= orrect me if I misunderstood.) This helps to fully address the problem iden= tified above. (Note that AS65001 follows instruction (a) when it subsequent= ly forwards the update to AS65002, and AS65002 follows instruction (b) whil= e validating. The validation now works without the error identified above.) If we agree and others on the WG list express no objection or find no fault= in this solution, I will be happy to go ahead and add this solution for th= e confederation case (it requires just a couple of sentences to be added th= e spec). Thank you. Sriram --_000_DM2PR09MB044634DCE6C5D55112DDEF6384900DM2PR09MB0446namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Thinking about it some more, I now find that your proposed solution= of adding a signature with pCount =3D 0 at the border of the confederation= works well and fully addresses these two concerns (the second concern= is new).

(1) Your proposed solution addresses the concern you b= rought up in an earlier message -

https://www.ietf.org/mail-archive/web/sidr/current/msg08081.html

(2) It also keeps confed ASes from failing to validate properly the sign= ature injected at the boundary.  This is explained below.

First let us take note of the following two instructions that are in the= spec:

(a)  From page Section 4.3 (page 16):

"When a confederation

   member sends a BGPsec update message to a peer that is a me= mber of

   the same confederation but is a different Member-AS, the

   confederation member puts its (private) Member-AS Number (a= s opposed

   to the public AS Confederation Identifier) in the AS Number= field of

   the Secure_Path Segment that it adds to the BGPsec update m= essage."

(b)  From Section 5.2 (page 25):  (note: this one is part of t= he method of identifying the Target AS while assembling the data to be hash= ed for signature validation)

"For each other Signature Segment (N smaller than K), the 'Target

      AS Number' is AS(N+1), the AS number = in the Secure_Path segment

      that corresponds to the Signature Segment= added immediately after

      the one being processed."

Now I will explain what I mean by (2) above using the same example that = you presented earlier:

AS1 -> AS2/AS65001 -> AS65002/AS2 -> AS3 (AS2 is the Confederat= ion ID and AS65001 and AS65002 are Members) 

In this example, by "signature injected at the boundary", we m= ean the signature of AS1 to AS2 (in the update received by AS65001). Let us= think about the step where AS65002 is processing the update from AS65001 a= nd validating the "signature injected at the boundary". Following step (a) above, AS65001 put in its own private A= S number (i.e. AS65001) in the Secure_Path Segment that it added to the BGP= sec update message forwarded to AS65002. Therefore, following step (b), AS6= 5002 identifies AS65001 to be the 'Target AS Number' for the data to be hashed for validating the signature. However= , this would falsely result in 'Invalid' outcome for the signature being va= lidated by AS65002. Because AS1 actually signed to AS2 (the public AS numbe= r), and hence the 'Target AS Number' is actually AS2.

Now the solution: Your suggested solution says that AS65001 should add a= signature where it uses the private key of the public AS (i.e. AS2) to sig= n and forward the update to itself (AS65001) with pCount =3D 0. Correspondi= ngly, AS65001 also puts in the public AS number (i.e. AS2) in the Secure_Path Segment that it adds to the BGPsec= update message sent to itself. (Please correct me if I misunderstood.) Thi= s helps to fully address the problem identified above. (Note that AS65001 f= ollows instruction (a) when it subsequently forwards the update to AS65002, and AS65002 follows instruction (b) while = validating. The validation now works without the error identified above.)&n= bsp;   

If we agree and others on the WG list express no objection or find = no fault in this solution, I will be happy to go ahead and add this solutio= n for the confederation case (it requires just a couple of sentences t= o be added the spec).

Thank you.

Sriram

--_000_DM2PR09MB044634DCE6C5D55112DDEF6384900DM2PR09MB0446namp_-- From nobody Tue Dec 20 15:14:42 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DF14129409; Tue, 20 Dec 2016 15:14:41 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.40.2 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <148227568116.23845.9629515365054901514.idtracker@ietfa.amsl.com> Date: Tue, 20 Dec 2016 15:14:41 -0800 Archived-At: Cc: Chris Morrow , draft-ietf-sidr-adverse-actions@ietf.org, sidr-chairs@ietf.org, sidr@ietf.org Subject: [sidr] Last Call: (Adverse Actions by a Certification Authority (CA) or Repository Manager in the Resource Public Key Infrastructure (RPKI)) to Informational RFC X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Reply-To: ietf@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 23:14:41 -0000 The IESG has received a request from the Secure Inter-Domain Routing WG (sidr) to consider the following document: - 'Adverse Actions by a Certification Authority (CA) or Repository Manager in the Resource Public Key Infrastructure (RPKI)' as Informational RFC The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2017-01-10. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document analyzes actions by or against a CA or independent repository manager in the RPKI that can adversely affect the Internet Number Resources (INRs) associated with that CA or its subordinate CAs. The analysis is done from the perspective of an affected INR holder. The analysis is based on examination of the data items in the RPKI repository, as controlled by a CA (or independent repository manager) and fetched by Relying Parties (RPs). The analysis does not purport to be comprehensive; it does represent an orderly way to analyze a number of ways that errors by or attacks against a CA or repository manager can affect the RPKI and routing decisions based on RPKI data. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-sidr-adverse-actions/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-sidr-adverse-actions/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Tue Dec 20 15:37:32 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79CF21293F5; Tue, 20 Dec 2016 15:37:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.622 X-Spam-Level: X-Spam-Status: No, score=-17.622 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ESybJyJt2EXc; Tue, 20 Dec 2016 15:37:29 -0800 (PST) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D49C12711D; Tue, 20 Dec 2016 15:37:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=450; q=dns/txt; s=iport; t=1482277049; x=1483486649; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=GX9xjh5Xatwqr9mPaVgHb/OincaMhavm5cTmiF+X5xc=; b=L4IIBW6xbnAvs1p6Ni8XQznOzOAWwqXg7yqoIQsz1c9tmIESC/IKWWpb 8Y/6+cG/Gg5u3NS+gwyRLXXvsdKpJ5PYTF4nEmJekwl3b2pPxcMC1gwYR RrscUDQ202DyT5VHP9USKypCGETw4ps5Bctsm4cwTA0AVfWUcmmFMWsp2 s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AbAQA8wFlY/5FdJa1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgzcBAQEBAR+BYI1QllqVDoIKhiICgWo/FAECAQEBAQEBAWIohGg?= =?us-ascii?q?BAQEDARIoPwULAgEIGB4QMiUCBA4FGweIQQiaCQGQHosRAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBHYY2gX0IglSEQIMxgjABBJUDhW0BkTOBXY5wjhqEDgEfN4EmLA8?= =?us-ascii?q?BhAWBRXKJBwEBAQ?= X-IronPort-AV: E=Sophos;i="5.33,380,1477958400"; d="scan'208";a="183848306" Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Dec 2016 23:37:28 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by rcdn-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id uBKNbSvA014722 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 20 Dec 2016 23:37:28 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 20 Dec 2016 17:37:27 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Tue, 20 Dec 2016 17:37:27 -0600 From: "Alvaro Retana (aretana)" To: "Sriram, Kotikalapudi (Fed)" Thread-Topic: Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) Thread-Index: AQHSUmenE2EHhTbiU0q7IXrD4ZYx2aEF0Iz4gAN2lwCACDChKIAAF3mv Date: Tue, 20 Dec 2016 23:37:27 +0000 Message-ID: References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> , <98186E08-8CAC-4EB0-9E84-BBABACC43678@cisco.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" , Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 23:37:30 -0000 Hi! I am (obviously) fine with it. Thanks! Alvaro. Thumb-typed and autocorrected.. > On Dec 20, 2016, at 5:56 PM, Sriram, Kotikalapudi (Fed) wrote: >=20 > If we agree and others on the WG list express no objection or find no fau= lt in this solution, I will be happy to go ahead and add this solution for = the confederation case (it requires just a couple of sentences to be added = the spec). From nobody Tue Dec 20 17:15:53 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50D0C1296E4; Tue, 20 Dec 2016 17:15:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.001 X-Spam-Level: X-Spam-Status: No, score=-5.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yll6dcXQ1WHB; Tue, 20 Dec 2016 17:15:50 -0800 (PST) Received: from khatovar.hactrn.net (khatovar.hactrn.net [IPv6:2001:418:8006::30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29C2B1296D5; Tue, 20 Dec 2016 17:15:50 -0800 (PST) Received: from minas-ithil.hactrn.net (c-73-47-197-23.hsd1.ma.comcast.net [73.47.197.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "nargothrond.hactrn.net", Issuer "Grunchweather Associates" (not verified)) by khatovar.hactrn.net (Postfix) with ESMTPS id 944AB1399E; Wed, 21 Dec 2016 01:15:48 +0000 (UTC) Received: from minas-ithil.hactrn.net (localhost [IPv6:::1]) by minas-ithil.hactrn.net (Postfix) with ESMTP id D34DF446EADB; Tue, 20 Dec 2016 20:14:42 -0500 (EST) Date: Tue, 20 Dec 2016 20:14:42 -0500 From: Rob Austein To: "Alvaro Retana (aretana)" In-Reply-To: <51D959C0-064D-451F-8224-737613A60F86@cisco.com> References: <20161220173336.DD3B64469FFE@minas-ithil.hactrn.net> <51D959C0-064D-451F-8224-737613A60F86@cisco.com> User-Agent: Wanderlust/2.15.5 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20161221011442.D34DF446EADB@minas-ithil.hactrn.net> Archived-At: Cc: Chris Morrow , sidr-chairs@ietf.org, Rob Austein , draft-ietf-sidr-rpki-oob-setup@ietf.org, sidr@ietf.org Subject: Re: [sidr] AD Review of draft-ietf-sidr-rpki-oob-setup-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 01:15:51 -0000 Proposed -05, reflecting comments from AD review: https://subvert-ietf.hactrn.net/rpki-oob-setup/draft-ietf-sidr-rpki-oob-setup-05.txt https://subvert-ietf.hactrn.net/rpki-oob-setup/draft-ietf-sidr-rpki-oob-setup-05-from-04.diff.html Absent objections, I will post to I-D repository, probably tomorrow. Note for anybody going over the changes with a fine-tooth comb: there was one minor correction which could be construed as substantive. It's purely a syntax issue, with no effect on protocol semantics. The textual description of the token reflected an earlier version of the protocol syntax in which there was an extra element nested within the element. This changed some time ago in the schema, the examples, and the running code, but apparently nobody (including me) noticed the old syntax lurking in the text. Had this come up after publication I would called it an erratum, but since we caught it now, I just went ahead and fixed it. :) From nobody Wed Dec 21 04:20:59 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2F0E129D70; Wed, 21 Dec 2016 04:20:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.621 X-Spam-Level: X-Spam-Status: No, score=-17.621 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mBEG-jzKQtio; Wed, 21 Dec 2016 04:20:56 -0800 (PST) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 280EA1293E1; Wed, 21 Dec 2016 04:20:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=12040; q=dns/txt; s=iport; t=1482322856; x=1483532456; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=9ijr0PcYcs5CvGNfmVhl75IQBJn6fsdNro2WF2mDpxs=; b=XConKo53H3tf2yQ7FN0U+lIIrM2gWxoGJutGYJQy3NG5+NaR9xb6dUNG ybO9XAqsK/1vO7PwJazZuh9Yu1FuwE2+ptMmfJPBK/p8OezqmXVGImEtm xXkSx8bkAxK1XgEs4QEOpNPtji/IRSMwSc/DyxujD8CpPJ+LFi5dYeBj5 Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AZAQBwclpY/5BdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgnE5CwEBAQEBH1qBBweNSaZAhSaCCiyFdgIagVY/FAECAQEBAQE?= =?us-ascii?q?BAWIohGkGI1YQAgEIDh8SAwICAjAUEQIEDgWIaw6oMIIoL4plAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBGAWGNoF9glyEf4JFLYIwBZUHhXABhlGKZ5BRkjIBHzeBKjw?= =?us-ascii?q?BhU9yAQGHSYENAQEB?= X-IronPort-AV: E=Sophos;i="5.33,383,1477958400"; d="scan'208,217";a="184030849" Received: from rcdn-core-8.cisco.com ([173.37.93.144]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Dec 2016 12:20:55 +0000 Received: from XCH-ALN-005.cisco.com (xch-aln-005.cisco.com [173.36.7.15]) by rcdn-core-8.cisco.com (8.14.5/8.14.5) with ESMTP id uBLCKtb0021804 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 21 Dec 2016 12:20:55 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 21 Dec 2016 06:20:54 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Wed, 21 Dec 2016 06:20:54 -0600 From: "Alvaro Retana (aretana)" To: Rob Austein Thread-Topic: AD Review of draft-ietf-sidr-rpki-oob-setup-04 Thread-Index: AQHSWszFsmJTivNev0GoI5fThLpGTA== Date: Wed, 21 Dec 2016 12:20:54 +0000 Message-ID: References: <20161220173336.DD3B64469FFE@minas-ithil.hactrn.net> <51D959C0-064D-451F-8224-737613A60F86@cisco.com> <20161221011442.D34DF446EADB@minas-ithil.hactrn.net> In-Reply-To: <20161221011442.D34DF446EADB@minas-ithil.hactrn.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1d.0.161209 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_CAA3F9569CA94A3B9AFFC5D4D87A815Dciscocom_" MIME-Version: 1.0 Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "draft-ietf-sidr-rpki-oob-setup@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-rpki-oob-setup-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 12:20:58 -0000 --_000_CAA3F9569CA94A3B9AFFC5D4D87A815Dciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Um9iOg0KDQpIaSENCg0KWW91IGFkZGVkIHNvbWUgdGV4dCBhYm91dCBvZmZlciBhbmQgcmVmZXJy YWw6DQoNCiAgQSBwYXJlbnQgaXMgdW5saWtlbHkgdG8gbmVlZCB0byBzZW5kIGJvdGggPG9mZmVy PiBhbmQgPHJlZmVycmFsPg0KICBlbGVtZW50cywgYnV0IHN0cmljdGx5IHNwZWFraW5nIHRoZXkg YXJlIG5vdCBtdXR1YWxseSBleGNsdXNpdmUsIHNvIGENCiAgcGFyZW50IHdoaWNoIHJlYWxseSBu ZWVkcyB0byBleHByZXNzIHRoYXQgaXQgYm90aCBvZmZlcnMgcmVwb3NpdG9yeQ0KICBzZXJ2aWNl IHRvIGl0cyBjaGlsZCBhbmQgaXMgYWxzbyB3aWxsaW5nIHRvIHJlZmVyIGl0cyBjaGlsZCB0byBv bmUgb3INCiAgbW9yZSBvdGhlciByZXBvc2l0b3J5IHNlcnZlcnMgY2FuIGRvIHNvLg0KDQpUaGF0 4oCZcyBmaW5lLCBidXQgaXQgc3RpbGwgZG9lc27igJl0IHRlbGwgbWUgd2hhdCB0aGUgY2hpbGQg c2hvdWxkIGRvLiAgSSBkb27igJl0IHRoaW5rIHlvdSB3YW50IHRvIHNwZWNpZnkgdGFraW5nIHVw IG9uZSBvciB0aGUgb3RoZXIsIGJ1dCBhdCBsZWFzdCBpbmNsdWRlIHNvbWUgdGV4dCB0aGF0IHNh eXMgdGhhdCB0aGUgY2hpbGQgY2FuIGNob29zZS4NCg0KSW4gdGhpbmtpbmcgYWJvdXQgdGhpcyBJ IGNhbWUgdXAgd2l0aCBhbm90aGVyIHF1ZXN0aW9uLiAgQSByZXBvc2l0b3J5IGRvZXNu4oCZdCBo YXZlIHRvIGhvbm9yIGV2ZXJ5IHB1Ymxpc2hlcl9yZXF1ZXN0IGl0IHJlY2VpdmVzLCByaWdodD8g ICBTcGVjaWFsbHkgb25lcyB0aGF0IGFyZSB0aGUgcmVzdWx0IG9mIGEgcmVmZXJyYWzigKYgIFRo ZXJlIGlzIGEg4oCccmVmdXNlZOKAnSBlcnJvciByZWFzb24gZGVmaW5lZCwgc28gdGhhdCB0YWtl cyBjYXJlIG9mIHRoYXTigKZidXQgSeKAmW0gdGhpbmtpbmcgdGhhdCBhcyBhIGNsaWVudCBJIG1p Z2h0IHdhbnQgdG8gdGFrZSBhbiA8b2ZmZXI+IGluc3RlYWQgb2YgcGxheWluZyBhcm91bmQgd2l0 aCBhIDxyZWZlcnJhbD4gYmVjYXVzZSBJIGtub3cgZm9yIHN1cmUgbXkgcGFyZW50IGNhbiBkbyB0 aGUgam9iLiAgSeKAmW0gc3VyZSB0aGVyZSBhcmUgb3RoZXIgY29uc2lkZXJhdGlvbnMgdGhhdCB0 aGUgY2hpbGQgc2hvdWxkIHRha2UgaW50byBhY2NvdW50LiAgSeKAmW0gb2sgaWYgeW91IGp1c3Qg d3JpdGUgdGhhdCB0aGUgc2VsZWN0aW9uIGNyaXRlcmlhIGlzIG91dCBvZiBzY29wZS4NCg0KVGhh bmtzIQ0KDQpBbHZhcm8uDQoNCg0KT24gMTIvMjAvMTYsIDg6MTQgUE0sICJSb2IgQXVzdGVpbiIg PHNyYUBoYWN0cm4ubmV0PG1haWx0bzpzcmFAaGFjdHJuLm5ldD4+IHdyb3RlOg0KDQpQcm9wb3Nl ZCAtMDUsIHJlZmxlY3RpbmcgY29tbWVudHMgZnJvbSBBRCByZXZpZXc6DQoNCiAgaHR0cHM6Ly9z dWJ2ZXJ0LWlldGYuaGFjdHJuLm5ldC9ycGtpLW9vYi1zZXR1cC9kcmFmdC1pZXRmLXNpZHItcnBr aS1vb2Itc2V0dXAtMDUudHh0DQogIGh0dHBzOi8vc3VidmVydC1pZXRmLmhhY3Rybi5uZXQvcnBr aS1vb2Itc2V0dXAvZHJhZnQtaWV0Zi1zaWRyLXJwa2ktb29iLXNldHVwLTA1LWZyb20tMDQuZGlm Zi5odG1sDQoNCkFic2VudCBvYmplY3Rpb25zLCBJIHdpbGwgcG9zdCB0byBJLUQgcmVwb3NpdG9y eSwgcHJvYmFibHkgdG9tb3Jyb3cuDQo= --_000_CAA3F9569CA94A3B9AFFC5D4D87A815Dciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eTotd2Via2l0LXN0YW5kYXJkOw0KCXBhbm9zZS0xOjAgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KLyog U3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29O b3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXpl OjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4u TXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRl eHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0Zv bGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1k ZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3Rl eHQ7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCnNwYW4ubXNv SW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1zdHlsZS1uYW1lOiIiOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9DQouTXNvQ2hwRGVmYXVs dA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBw YWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4w aW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVT IiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj5Sb2I6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SGkhPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+WW91IGFkZGVkIHNvbWUgdGV4dCBhYm91dCBvZmZlciBhbmQg cmVmZXJyYWw6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7IEEgcGFyZW50IGlzIHVu bGlrZWx5IHRvIG5lZWQgdG8gc2VuZCBib3RoICZsdDtvZmZlciZndDsgYW5kICZsdDtyZWZlcnJh bCZndDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOyBlbGVtZW50cywgYnV0 IHN0cmljdGx5IHNwZWFraW5nIHRoZXkgYXJlIG5vdCBtdXR1YWxseSBleGNsdXNpdmUsIHNvIGEN CjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOyBwYXJlbnQgd2hp Y2ggcmVhbGx5IG5lZWRzIHRvIGV4cHJlc3MgdGhhdCBpdCBib3RoIG9mZmVycyByZXBvc2l0b3J5 Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij4mbmJzcDsgc2VydmljZSB0byBpdHMgY2hpbGQgYW5kIGlzIGFsc28gd2lsbGluZyB0byByZWZl ciBpdHMgY2hpbGQgdG8gb25lIG9yJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpIj4mbmJzcDsgbW9yZSBvdGhlciByZXBvc2l0b3J5IHNlcnZlcnMgY2FuIGRv IHNvLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlRoYXTigJlzIGZpbmUsIGJ1dCBpdCBzdGls bCBkb2VzbuKAmXQgdGVsbCBtZSB3aGF0IHRoZSBjaGlsZCBzaG91bGQgZG8uJm5ic3A7IEkgZG9u 4oCZdCB0aGluayB5b3Ugd2FudCB0byBzcGVjaWZ5IHRha2luZyB1cCBvbmUgb3IgdGhlIG90aGVy LCBidXQgYXQgbGVhc3QgaW5jbHVkZSBzb21lIHRleHQgdGhhdCBzYXlzIHRoYXQgdGhlIGNoaWxk DQogY2FuIGNob29zZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5JbiB0aGlua2luZyBhYm91 dCB0aGlzIEkgY2FtZSB1cCB3aXRoIGFub3RoZXIgcXVlc3Rpb24uJm5ic3A7IEEgcmVwb3NpdG9y eSBkb2VzbuKAmXQgaGF2ZSB0byBob25vciBldmVyeSBwdWJsaXNoZXJfcmVxdWVzdCBpdCByZWNl aXZlcywgcmlnaHQ/Jm5ic3A7ICZuYnNwO1NwZWNpYWxseSBvbmVzIHRoYXQgYXJlIHRoZSByZXN1 bHQgb2YgYSByZWZlcnJhbOKApiZuYnNwOw0KIFRoZXJlIGlzIGEg4oCccmVmdXNlZOKAnSBlcnJv ciByZWFzb24gZGVmaW5lZCwgc28gdGhhdCB0YWtlcyBjYXJlIG9mIHRoYXTigKZidXQgSeKAmW0g dGhpbmtpbmcgdGhhdCBhcyBhIGNsaWVudCBJIG1pZ2h0IHdhbnQgdG8gdGFrZSBhbiAmbHQ7b2Zm ZXImZ3Q7IGluc3RlYWQgb2YgcGxheWluZyBhcm91bmQgd2l0aCBhICZsdDtyZWZlcnJhbCZndDsg YmVjYXVzZSBJIGtub3cgZm9yIHN1cmUgbXkgcGFyZW50IGNhbiBkbyB0aGUgam9iLiZuYnNwOyBJ 4oCZbSBzdXJlIHRoZXJlIGFyZSBvdGhlcg0KIGNvbnNpZGVyYXRpb25zIHRoYXQgdGhlIGNoaWxk IHNob3VsZCB0YWtlIGludG8gYWNjb3VudC4mbmJzcDsgSeKAmW0gb2sgaWYgeW91IGp1c3Qgd3Jp dGUgdGhhdCB0aGUgc2VsZWN0aW9uIGNyaXRlcmlhIGlzIG91dCBvZiBzY29wZS48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj5UaGFua3MhPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+QWx2YXJv LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQjVDNERG IDQuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQ7bWFyZ2luLWxlZnQ6My43NXB0O21hcmdp bi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiAxMi8y MC8xNiwgODoxNCBQTSwgJnF1b3Q7Um9iIEF1c3RlaW4mcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0 bzpzcmFAaGFjdHJuLm5ldCI+c3JhQGhhY3Rybi5uZXQ8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7LXdlYmtpdC1zdGFuZGFyZCZxdW90OywmcXVvdDtz ZXJpZiZxdW90Oztjb2xvcjpibGFjayI+UHJvcG9zZWQgLTA1LCByZWZsZWN0aW5nIGNvbW1lbnRz IGZyb20gQUQgcmV2aWV3OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDstd2Via2l0 LXN0YW5kYXJkJnF1b3Q7LCZxdW90O3NlcmlmJnF1b3Q7O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7LXdlYmtpdC1zdGFuZGFyZCZxdW90OywmcXVv dDtzZXJpZiZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9z dWJ2ZXJ0LWlldGYuaGFjdHJuLm5ldC9ycGtpLW9vYi1zZXR1cC9kcmFmdC1pZXRmLXNpZHItcnBr aS1vb2Itc2V0dXAtMDUudHh0Ij5odHRwczovL3N1YnZlcnQtaWV0Zi5oYWN0cm4ubmV0L3Jwa2kt b29iLXNldHVwL2RyYWZ0LWlldGYtc2lkci1ycGtpLW9vYi1zZXR1cC0wNS50eHQ8L2E+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90Oy13ZWJraXQtc3RhbmRhcmQmcXVvdDssJnF1b3Q7 c2VyaWYmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vc3Vi dmVydC1pZXRmLmhhY3Rybi5uZXQvcnBraS1vb2Itc2V0dXAvZHJhZnQtaWV0Zi1zaWRyLXJwa2kt b29iLXNldHVwLTA1LWZyb20tMDQuZGlmZi5odG1sIj5odHRwczovL3N1YnZlcnQtaWV0Zi5oYWN0 cm4ubmV0L3Jwa2ktb29iLXNldHVwL2RyYWZ0LWlldGYtc2lkci1ycGtpLW9vYi1zZXR1cC0wNS1m cm9tLTA0LmRpZmYuaHRtbDwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7LXdl YmtpdC1zdGFuZGFyZCZxdW90OywmcXVvdDtzZXJpZiZxdW90Oztjb2xvcjpibGFjayI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90Oy13ZWJraXQtc3RhbmRhcmQmcXVvdDss JnF1b3Q7c2VyaWYmcXVvdDs7Y29sb3I6YmxhY2siPkFic2VudCBvYmplY3Rpb25zLCBJIHdpbGwg cG9zdCB0byBJLUQgcmVwb3NpdG9yeSwgcHJvYmFibHkgdG9tb3Jyb3cuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_CAA3F9569CA94A3B9AFFC5D4D87A815Dciscocom_-- From nobody Wed Dec 21 09:47:14 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB9711294BD; Wed, 21 Dec 2016 09:47:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 49GGvcRWAsSk; Wed, 21 Dec 2016 09:47:05 -0800 (PST) Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0122.outbound.protection.outlook.com [23.103.201.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEC0D1293DB; Wed, 21 Dec 2016 09:47:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=g2mN48a33DoYfCvMVawzf4iTCGLto3GkkKMX/RoHZM8=; b=MKyT9KGjzDzdqvPFB8XfccDg1M2XHxuxXnRHvyNsM9Ylsh4BIu/UUj6lg7vZutXhDD0APuij8JRqML9lTJ6MG29V+rfb7H3mThwT7nNtcDwwPm98czU4lQc55YopdpQ3qTP4tayX+bxzhGfWcxDeq6s3eJ6FBCFh0d/Gh5AncnU= Received: from DM2PR09MB0446.namprd09.prod.outlook.com (10.161.252.145) by DM2PR09MB0448.namprd09.prod.outlook.com (10.161.252.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Wed, 21 Dec 2016 17:47:03 +0000 Received: from DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) by DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) with mapi id 15.01.0789.018; Wed, 21 Dec 2016 17:47:03 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "Alvaro Retana (aretana)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" , "keyur@arrcus.com" Thread-Topic: Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) Thread-Index: AQHSUmenE2EHhTbiU0q7IXrD4ZYx2aEF0Iz4gAN2lwCACDChKIABJNo0 Date: Wed, 21 Dec 2016 17:47:03 +0000 Message-ID: References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> , <98186E08-8CAC-4EB0-9E84-BBABACC43678@cisco.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=kotikalapudi.sriram@nist.gov; x-originating-ip: [129.6.219.26] x-ms-office365-filtering-correlation-id: b3cc05cf-aabc-4e8d-1749-08d429c95fc6 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DM2PR09MB0448; x-microsoft-exchange-diagnostics: 1; DM2PR09MB0448; 7:NVkt5/BfYvP3p0j0oFo2i3/iJM5dJ2lGT83JPmpGmrw2rPYCQXTb28osxBPNDOfGusB8iKibPym2NzZfrYrlUC/cGi6JRxiTkPjn4e37D41dV3WBfJnxuExX7ZRdHreChmKTB9c6CkzogQXY+g7XxXBgjpvRO+bULmQo9y8Tql197qqqmYezeIT8zfsdCX9xH+uy5G5EUdumV8/w6OsbUBrI2KixbS0a8fmmsEtHlve0N884c/hndONM84QrrIUg/tPu1bOoAe5sjIUab+eoCG6eomaOrAJksqcj3e/Wit9gwSAjxZnQONmfWmF9JeTse9cfhUzj/2pg5WlNp4bKMOr1nAdUivgDGlJcy3viNG1RCPbVLLHbGOSHMsPgQezhIzpoPinZNozBshOCcTPfU7Ot2kM40ImKni1MQXkLz8Tskc/LT/naBZF8Xgr+lV97lWUV2A/GxCSupauFNl1Esw== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(17755550239193); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(6072148); SRVR:DM2PR09MB0448; BCL:0; PCL:0; RULEID:; SRVR:DM2PR09MB0448; x-forefront-prvs: 01630974C0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39860400002)(39450400003)(39840400002)(39850400002)(39410400002)(199003)(189002)(102836003)(86362001)(93886004)(101416001)(2950100002)(66066001)(76576001)(6606003)(68736007)(5660300001)(33656002)(7696004)(8676002)(3846002)(6116002)(230783001)(2501003)(76176999)(81156014)(81166006)(122556002)(2906002)(4326007)(9686002)(50986999)(54356999)(2201001)(5001770100001)(2900100001)(92566002)(19627405001)(8936002)(189998001)(106116001)(99286002)(106356001)(105586002)(6506006)(3660700001)(74316002)(3280700002)(77096006)(7736002)(7906003)(97736004)(6436002)(38730400001)(606005)(25786008)(229853002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0448; H:DM2PR09MB0446.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR09MB0446772C784D57BE2A005E1284930DM2PR09MB0446namp_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Dec 2016 17:47:03.6163 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR09MB0448 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 17:47:12 -0000 --_000_DM2PR09MB0446772C784D57BE2A005E1284930DM2PR09MB0446namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Alvaro, I said in my previous post: "(2) It also keeps confed ASes from failing to validate properly the signat= ure injected at the boundary." I retract my observation that the document had a problem in that "confed ASes fail to validate properly the signature injected at the bounda= ry." The document does not have that problem. My apologies for not being careful= earlier. Confed ASes do validate properly the signature injected at the boundary :) Because the document says the following in Section 4.3 (page 18): When validating a received BGPsec update message, confederation members need to make the following adjustment to the algorithm presented in Section 5.2. When a confederation member processes (validates) a Signature Segment and its corresponding Secure_Path Segment, the confederation member must note the following. For a signature produced by a peer BGPsec speaker outside of a confederation, the 'Target AS Number' will always be the AS Confederation Identifier (the public AS number of the confederation) as opposed to the Member-AS Number. So let us focus back on only your original concern. If we need the solution of "confed AS signing to itself with pCount =3D 0"= , it would be only to address your original concern of an apparent discontinu= ity. I looked at the implications of the solution once again. While it may be easy to describe it in terms of sender actions, the solution would have ripple effects in several places in the document. So I wish to take another fresh look at your concern with your help, and try to understand if there isn't another way to address it. The example scenario is: AS1 -> AS2/AS65001 -> AS65002/AS2 -> AS3 (AS2 is the Confederation ID and A= S65001 and AS65002 are Members) With the current specification, we have the following sequence of signed up= dates: (Notation: (S-i-j) means signature from AS i to AS j, P is the prefix; and most recent AS appears in the right most position) #1 AS1 to AS2/AS65001: P [AS1 {(S-1-2)}] #2 AS2/AS65001 to AS2/AS65002: P [AS1, AS65001 {(S-1-2), (S-65001-65002)}= ], #3 AS2/AS65002 to AS3: P [AS1, AS2, {(S-1-2), ( S-2-3)}] (Secure_Path Segment and Signature within the confed are stripped) The discontinuity you are concerned about is in the middle (2nd) update abo= ve, i.e., the first signature is from AS1 to AS2 while the second signature is from A= S65001 to AS65002. Am I right? But then you have observed the following earlier: "Well, the PE with both AS2 and AS65001 *is* both AS2 *and* AS65001...so I = don't see it as a proxy." https://www.ietf.org/mail-archive/web/sidr/current/msg08107.html Given this observation, would you accept that there is no discontinuity in = update #2 above since AS65001 is AS2? If this is acceptable, then can we assert that the security guarantee is Se= ction 8.1 is good inside confederations as well with the understanding that each memb= er AS is also the public AS of the confed? For instance, AS65002 is cognizant tha= t AS65001 is also AS2. So AS65002 does not see a discontinuity. Thank you. Sriram --_000_DM2PR09MB0446772C784D57BE2A005E1284930DM2PR09MB0446namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi Alvaro,



I said in my previous post:

"(2) It also keeps confed ASes from failing to validate prope= rly the signature injected at the boundary."




I retract my observation that the document had a problem in that

"confed ASes fail to validate properly the signature in= jected at the boundary."

The document does not have that problem. My apologies for no= t being careful earlier.

Confed ASes do validate properly the signature in= jected at the boundary :)

Because the document says the following in Section 4.3 (page 18):



When validating a received BGPsec update message, confederation
   members need to make the following adjustment to the algorithm=
   presented in Section 5.2.  When a confederation member processes
   (validates) a Signature Segment and its corresponding Secure_P= ath
   Segment, the confederation member must note the following.&nbs= p; For a
   signature produced by a peer BGPsec speaker outside of a
   confederation, the 'Target AS Number' will always be the AS    Confederation Identifier (the public AS number of the confeder= ation)
   as opposed to the Member-AS Number.


So let us focus back on only your original concern.
If we need the solution of "confed AS signing to itself with=  pCount =3D 0",
it would be only to address your original concern of an apparent disco= ntinuity.
I looked at the implications of the solution once again.
While it may be easy to describe it in terms of sender actions, <= /div>
the solution would have ripple effects in several places in the d= ocument.


So I wish to take another fresh look at your concern with your help,
and try to understand if there isn't another way to address it.


The example scenario is:
AS1 -> AS2/AS65001 -> AS65002/AS2 -> AS3 (AS2 is the Co= nfederation ID and AS65001 and AS65002 are Members) 


With the current specification, we have the following sequence of sign= ed updates:
(Notation: (S-i-j) means signature from AS i to AS j,
P is the prefix; and most recent AS appears in the right most position= )


#1  AS1 to AS2/AS65001:  P [AS1 {(S-1-2)}]

 
#2  AS2/AS65001 to AS2/AS65002= :  = P [AS1, = AS65001 {(S-1-2), (S-65001-65002)}],


#3  AS2/AS65002 to AS3:  P [AS1, AS2, {(S-1-2), ( S-2-3)}] 
(Secure_Path Segment and Signature within the confed = are stripped)


The discontinuity you are concerned about is in the m= iddle (2nd) update above, i.e.,
the first signature is from AS1 to AS2 while the= second signature is from AS65001 to AS65002. 
Am I right?


But then you have observed the following earlier:


"Well, the PE with both AS2 and AS65001 *is* both AS2 *and* AS65001…so I don’t see it as a proxy."


Given this observation, would you accept that there is no discontinuity in updat= e #2 above
since AS65001 is AS2?


If this is acceptable, then can we assert that the security guarantee is Sect= ion 8.1
is good inside confederations as well with the understanding that each member= AS
is also the public AS of the confed? For instance, AS65002 is cognizant that<= /span>
AS65001 is also AS2. So AS65002 does not see a discontinuity.=


Thank you.


Sriram


--_000_DM2PR09MB0446772C784D57BE2A005E1284930DM2PR09MB0446namp_-- From nobody Wed Dec 21 10:14:35 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5E4B1294FE; Wed, 21 Dec 2016 10:14:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.001 X-Spam-Level: X-Spam-Status: No, score=-5.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vlw00egK449F; Wed, 21 Dec 2016 10:14:32 -0800 (PST) Received: from adrilankha.hactrn.net (adrilankha.hactrn.net [IPv6:2001:418:1::19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5CF5D129501; Wed, 21 Dec 2016 10:14:32 -0800 (PST) Received: from minas-ithil.hactrn.net (c-73-47-197-23.hsd1.ma.comcast.net [73.47.197.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "nargothrond.hactrn.net", Issuer "Grunchweather Associates" (not verified)) by adrilankha.hactrn.net (Postfix) with ESMTPS id 0D98339917; Wed, 21 Dec 2016 18:14:32 +0000 (UTC) Received: from minas-ithil.hactrn.net (localhost [IPv6:::1]) by minas-ithil.hactrn.net (Postfix) with ESMTP id 5C8754470DE7; Wed, 21 Dec 2016 13:13:23 -0500 (EST) Date: Wed, 21 Dec 2016 13:13:23 -0500 From: Rob Austein To: "Alvaro Retana (aretana)" In-Reply-To: References: <20161220173336.DD3B64469FFE@minas-ithil.hactrn.net> <51D959C0-064D-451F-8224-737613A60F86@cisco.com> <20161221011442.D34DF446EADB@minas-ithil.hactrn.net> User-Agent: Wanderlust/2.15.5 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Message-Id: <20161221181323.5C8754470DE7@minas-ithil.hactrn.net> Archived-At: Cc: Chris Morrow , sidr-chairs@ietf.org, Rob Austein , draft-ietf-sidr-rpki-oob-setup@ietf.org, sidr@ietf.org Subject: Re: [sidr] AD Review of draft-ietf-sidr-rpki-oob-setup-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 18:14:34 -0000 At Wed, 21 Dec 2016 12:20:54 +0000, Alvaro Retana (aretana) wrote: ... > it still doesn?t tell me what the child should do. I don?t think > you want to specify taking up one or the other, but at least include > some text that says that the child can choose. >=20 > In thinking about this I came up with another question. A > repository doesn?t have to honor every publisher_request it > receives, right? Specially ones that are the result of a referral? > There is a ?refused? error reason defined, so that takes care of > that?but I?m thinking that as a client I might want to take an > instead of playing around with a because I know > for sure my parent can do the job. I?m sure there are other > considerations that the child should take into account. I?m ok if > you just write that the selection criteria is out of scope. I just added this to the end of "Protocol Walk-Through": Any RPKI operator is free to run their own publication service should they feel a need to do so, and a child need not accept any particular <offer/> or <referral/>. In general, having a smaller number of larger publication repositories is probably good for overall system performance, because it will tend to reduce the number of distinct repositories from which each relying party will need to fetch, but the decision on where to publish is up to individual RPKI CA operators and out of scope for this protocol. I hope this addresses the issue. Same URLs for updated version: > Proposed -05, reflecting comments from AD review: >=20 > https://subvert-ietf.hactrn.net/rpki-oob-setup/draft-ietf-sidr-rpki-oob= -setup-05.txt > https://subvert-ietf.hactrn.net/rpki-oob-setup/draft-ietf-sidr-rpki-oob= -setup-05-from-04.diff.html >=20 > Absent objections, I will post to I-D repository, probably tomorrow. I think we are close enough at this point that I will push this version this afternoon. Can always do another rev if we must, but I want to get these changes into the version that directorates are being asked to review. From nobody Wed Dec 21 10:50:31 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2448128874; Wed, 21 Dec 2016 10:50:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.621 X-Spam-Level: X-Spam-Status: No, score=-17.621 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bMnN0-YG9I3K; Wed, 21 Dec 2016 10:50:28 -0800 (PST) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CCE7127ABE; Wed, 21 Dec 2016 10:50:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4452; q=dns/txt; s=iport; t=1482346228; x=1483555828; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=hEn9MhsT8OnfS4JXt5bVX8ByMU0pJEMEKtD3uVUb7fI=; b=O22Qy9sK0FzuApQ01pOeKeoGEyhDzbdUCquSWBE/mAvtB4vNFtzfPYaj EsnrVnwLdSC4kIK7dwIWDn+1Mj0ohjcmSsqNTBVbjybCLuRiM6gcaduqX q44PfuvW92vTei5SZ3SEm5j1MihBh4+L34Nmp58X6WZlh+A07T1BpGPC1 I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DoAgDAzVpY/5RdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgnFEAQEBAQEfXIEIB7QHhSaCCoYiAhqBREESAQIBAQEBAQEBYii?= =?us-ascii?q?EaQYjVhACAQgECjEDAgICMBQRAgQOBYhsqE+CKC+KUgEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAR2GNoF9glyHRC2CMAWVB4VwAZE4kFGSMgEmAi6BKjwBhU9yh0uBDQE?= =?us-ascii?q?BAQ?= X-IronPort-AV: E=Sophos;i="5.33,384,1477958400"; d="scan'208,217";a="363784277" Received: from rcdn-core-12.cisco.com ([173.37.93.148]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Dec 2016 18:50:27 +0000 Received: from XCH-ALN-003.cisco.com (xch-aln-003.cisco.com [173.36.7.13]) by rcdn-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id uBLIoRJE016488 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 21 Dec 2016 18:50:27 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-003.cisco.com (173.36.7.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 21 Dec 2016 12:50:26 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Wed, 21 Dec 2016 12:50:26 -0600 From: "Alvaro Retana (aretana)" To: Rob Austein Thread-Topic: AD Review of draft-ietf-sidr-rpki-oob-setup-04 Thread-Index: AQHSWszFsmJTivNev0GoI5fThLpGTKETGtCA//+2iQA= Date: Wed, 21 Dec 2016 18:50:26 +0000 Message-ID: References: <20161220173336.DD3B64469FFE@minas-ithil.hactrn.net> <51D959C0-064D-451F-8224-737613A60F86@cisco.com> <20161221011442.D34DF446EADB@minas-ithil.hactrn.net> <20161221181323.5C8754470DE7@minas-ithil.hactrn.net> In-Reply-To: <20161221181323.5C8754470DE7@minas-ithil.hactrn.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1d.0.161209 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_DE1E82DD1BB4412CB7D2802FAB18718Fciscocom_" MIME-Version: 1.0 Archived-At: Cc: Chris Morrow , "sidr-chairs@ietf.org" , "draft-ietf-sidr-rpki-oob-setup@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-rpki-oob-setup-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 18:50:30 -0000 --_000_DE1E82DD1BB4412CB7D2802FAB18718Fciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WWVzLCBJ4oCZbSBnb29kLg0KDQpUaGFua3MhIQ0KDQpBbHZhcm8uDQoNCk9uIDEyLzIxLzE2LCAx OjEzIFBNLCAiUm9iIEF1c3RlaW4iIDxzcmFAaGFjdHJuLm5ldDxtYWlsdG86c3JhQGhhY3Rybi5u ZXQ+PiB3cm90ZToNCg0KSSBob3BlIHRoaXMgYWRkcmVzc2VzIHRoZSBpc3N1ZS4NCg== --_000_DE1E82DD1BB4412CB7D2802FAB18718Fciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <02CE49C60C1D5245B37CF40757EA96DC@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eTotd2Via2l0LXN0YW5kYXJkOw0KCXBhbm9zZS0xOjAgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KLyog U3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29O b3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXpl OjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4u TXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRl eHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0Zv bGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1k ZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3Rl eHQ7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCnNwYW4ubXNv SW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1zdHlsZS1uYW1lOiIiOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9DQouTXNvQ2hwRGVmYXVs dA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBw YWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4w aW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVT IiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj5ZZXMsIEnigJltIGdvb2QuPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+VGhhbmtzISE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5BbHZhcm8uPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNCNUM0REYg NC41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdDttYXJnaW4tbGVmdDozLjc1cHQ7bWFyZ2lu LXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIDEyLzIx LzE2LCAxOjEzIFBNLCAmcXVvdDtSb2IgQXVzdGVpbiZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRv OnNyYUBoYWN0cm4ubmV0Ij5zcmFAaGFjdHJuLm5ldDwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7LXdlYmtpdC1zdGFuZGFyZCZxdW90 OywmcXVvdDtzZXJpZiZxdW90Oztjb2xvcjpibGFjayI+SSBob3BlIHRoaXMgYWRkcmVzc2VzIHRo ZSBpc3N1ZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_DE1E82DD1BB4412CB7D2802FAB18718Fciscocom_-- From nobody Wed Dec 21 11:18:14 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 53A1A127735; Wed, 21 Dec 2016 11:18:12 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.40.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148234789233.12666.10237887458590419486.idtracker@ietfa.amsl.com> Date: Wed, 21 Dec 2016 11:18:12 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-rpki-oob-setup-05.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 19:18:12 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing of the IETF. Title : An Out-Of-Band Setup Protocol For RPKI Production Services Author : Rob Austein Filename : draft-ietf-sidr-rpki-oob-setup-05.txt Pages : 21 Date : 2016-12-21 Abstract: This note describes a simple out-of-band protocol to ease setup of the RPKI provisioning and publication protocols between two parties. The protocol is encoded in a small number of XML messages, which can be passed back and forth by any mutually agreeable secure means. This setup protocol is not part of the provisioning or publication protocol, rather, it is intended to simplify configuration of these protocols by setting up relationships and exchanging BPKI keying material. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-oob-setup/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-rpki-oob-setup-05 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-rpki-oob-setup-05 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Dec 21 11:28:39 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DFCF129580; Wed, 21 Dec 2016 11:28:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.621 X-Spam-Level: X-Spam-Status: No, score=-17.621 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BMf0wv0M0Hhs; Wed, 21 Dec 2016 11:28:35 -0800 (PST) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AAE71298CF; Wed, 21 Dec 2016 11:28:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=19240; q=dns/txt; s=iport; t=1482348509; x=1483558109; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=latnrnCLQg8ejf7+nV9Ujv0n10dhSZnO7fSoWVKiIoU=; b=NhtRp8FOejiU6dKO3Knr1NC+PWbN/68fDwVXotS6Zo9V0du+RcSl5z/T b9nkfMTJz8xJWyyZIhz961hHuD8z0mD3w8B8N+34zkWHnKflIWVUn9GIA 0ttRq32PWaqyX2ZfukQkGtVdwQcPlCCbtcKv+cWMtYOq4tAVBGQh+YBb1 E=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AfAQAj11pY/5pdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgnFEAQEBAQEfXIEIB41Kpj2FJoIKKoV4AhqBRD8UAQIBAQEBAQE?= =?us-ascii?q?BYiiEaQYjBFIQAgEIQgICAjAlAgQBDQUbiFEOqEGBbDwvilEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEYBYY2gX2CXIQjAQEygm0tgjAFlQeFcAGROIF1jlyHeYo5AR8?= =?us-ascii?q?3gSo8AYNWHBiBRXIBhhwNFweBA4ENAQEB?= X-IronPort-AV: E=Sophos;i="5.33,384,1477958400"; d="scan'208,217";a="185990793" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Dec 2016 19:28:28 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id uBLJSStY012534 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 21 Dec 2016 19:28:28 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 21 Dec 2016 13:28:27 -0600 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Wed, 21 Dec 2016 13:28:27 -0600 From: "Alvaro Retana (aretana)" To: "Sriram, Kotikalapudi (Fed)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" , "keyur@arrcus.com" Thread-Topic: Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) Thread-Index: AQHSUmenE2EHhTbiU0q7IXrD4ZYx2aEF0Iz4gAN2lwCACDChKIABJNo0gABQJIA= Date: Wed, 21 Dec 2016 19:28:27 +0000 Message-ID: References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> <98186E08-8CAC-4EB0-9E84-BBABACC43678@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1d.0.161209 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: multipart/alternative; boundary="_000_F318D2E50A4A430FBDC17C8AAF96C68Bciscocom_" MIME-Version: 1.0 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 19:28:38 -0000 --_000_F318D2E50A4A430FBDC17C8AAF96C68Bciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gMTIvMjEvMTYsIDEyOjQ3IFBNLCAiU3JpcmFtLCBLb3Rpa2FsYXB1ZGkgKEZlZCkiIDxrb3Rp a2FsYXB1ZGkuc3JpcmFtQG5pc3QuZ292PiB3cm90ZToNCg0KDQoNClNyaXJhbToNCg0KDQoNCkhp IQ0KDQoNCg0KfCBJIHNhaWQgaW4gbXkgcHJldmlvdXMgcG9zdDoNCg0KfCAiKDIpIEl0IGFsc28g a2VlcHMgY29uZmVkIEFTZXMgZnJvbSBmYWlsaW5nIHRvIHZhbGlkYXRlIHByb3Blcmx5IHRoZSBz aWduYXR1cmUgaW5qZWN0ZWQgYXQgdGhlIGJvdW5kYXJ5LiINCg0KfA0KDQp8IEkgcmV0cmFjdCBt eSBvYnNlcnZhdGlvbuKApg0KDQrigKYNCg0KfA0KDQp8IFNvIGxldCB1cyBmb2N1cyBiYWNrIG9u IG9ubHkgeW91ciBvcmlnaW5hbCBjb25jZXJuLg0KDQp8IElmIHdlIG5lZWQgdGhlIHNvbHV0aW9u IG9mICJjb25mZWQgQVMgc2lnbmluZyB0byBpdHNlbGYgd2l0aCAgcENvdW50ID0gMCIsDQoNCnwg aXQgd291bGQgYmUgb25seSB0byBhZGRyZXNzIHlvdXIgb3JpZ2luYWwgY29uY2VybiBvZiBhbiBh cHBhcmVudCBkaXNjb250aW51aXR5Lg0KDQp8IEkgbG9va2VkIGF0IHRoZSBpbXBsaWNhdGlvbnMg b2YgdGhlIHNvbHV0aW9uIG9uY2UgYWdhaW4uDQoNCnwgV2hpbGUgaXQgbWF5IGJlIGVhc3kgdG8g ZGVzY3JpYmUgaXQgaW4gdGVybXMgb2Ygc2VuZGVyIGFjdGlvbnMsDQoNCnwgdGhlIHNvbHV0aW9u IHdvdWxkIGhhdmUgcmlwcGxlIGVmZmVjdHMgaW4gc2V2ZXJhbCBwbGFjZXMgaW4gdGhlIGRvY3Vt ZW50Lg0KDQp8DQoNCnwgU28gSSB3aXNoIHRvIHRha2UgYW5vdGhlciBmcmVzaCBsb29rIGF0IHlv dXIgY29uY2VybiB3aXRoIHlvdXIgaGVscCwNCg0KfCBhbmQgdHJ5IHRvIHVuZGVyc3RhbmQgaWYg dGhlcmUgaXNuJ3QgYW5vdGhlciB3YXkgdG8gYWRkcmVzcyBpdC4NCg0KfA0KDQp8IFRoZSBleGFt cGxlIHNjZW5hcmlvIGlzOg0KDQp8IEFTMSAtPiBBUzIvQVM2NTAwMSAtPiBBUzY1MDAyL0FTMiAt PiBBUzMgKEFTMiBpcyB0aGUgQ29uZmVkZXJhdGlvbiBJRCBhbmQgQVM2NTAwMSBhbmQgQVM2NTAw MiBhcmUgTWVtYmVycykNCg0KfA0KDQp8IFdpdGggdGhlIGN1cnJlbnQgc3BlY2lmaWNhdGlvbiwg d2UgaGF2ZSB0aGUgZm9sbG93aW5nIHNlcXVlbmNlIG9mIHNpZ25lZCB1cGRhdGVzOg0KDQp8IChO b3RhdGlvbjogKFMtaS1qKSBtZWFucyBzaWduYXR1cmUgZnJvbSBBUyBpIHRvIEFTIGosDQoNCnwg UCBpcyB0aGUgcHJlZml4OyBhbmQgbW9zdCByZWNlbnQgQVMgYXBwZWFycyBpbiB0aGUgcmlnaHQg bW9zdCBwb3NpdGlvbikNCg0KfA0KDQp8ICMxICBBUzEgdG8gQVMyL0FTNjUwMDE6ICBQIFtBUzEg eyhTLTEtMil9XQ0KDQp8DQoNCnwgIzIgIEFTMi9BUzY1MDAxIHRvIEFTMi9BUzY1MDAyOiAgUCBb QVMxLCBBUzY1MDAxIHsoUy0xLTIpLCAoUy02NTAwMS02NTAwMil9XSwNCg0KfA0KDQp8ICMzICBB UzIvQVM2NTAwMiB0byBBUzM6ICBQIFtBUzEsIEFTMiwgeyhTLTEtMiksICggUy0yLTMpfV0NCg0K fCAoU2VjdXJlX1BhdGggU2VnbWVudCBhbmQgU2lnbmF0dXJlIHdpdGhpbiB0aGUgY29uZmVkIGFy ZSBzdHJpcHBlZCkNCg0KfA0KDQp8IFRoZSBkaXNjb250aW51aXR5IHlvdSBhcmUgY29uY2VybmVk IGFib3V0IGlzIGluIHRoZSBtaWRkbGUgKDJuZCkgdXBkYXRlIGFib3ZlLCBpLmUuLA0KDQp8IHRo ZSBmaXJzdCBzaWduYXR1cmUgaXMgZnJvbSBBUzEgdG8gQVMyIHdoaWxlIHRoZSBzZWNvbmQgc2ln bmF0dXJlIGlzIGZyb20gQVM2NTAwMSB0byBBUzY1MDAyLg0KDQp8IEFtIEkgcmlnaHQ/DQoNCg0K DQpZZXMuDQoNCg0KDQoNCg0KfCBCdXQgdGhlbiB5b3UgaGF2ZSBvYnNlcnZlZCB0aGUgZm9sbG93 aW5nIGVhcmxpZXI6DQoNCnwNCg0KfCAiV2VsbCwgdGhlIFBFIHdpdGggYm90aCBBUzIgYW5kIEFT NjUwMDEgKmlzKiBib3RoIEFTMiAqYW5kKiBBUzY1MDAx4oCmc28gSSBkb27igJl0IHNlZSBpdCBh cyBhIHByb3h5LiINCg0KfCBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL3Np ZHIvY3VycmVudC9tc2cwODEwNy5odG1sDQoNCnwNCg0KfCBHaXZlbiB0aGlzIG9ic2VydmF0aW9u LCB3b3VsZCB5b3UgYWNjZXB0IHRoYXQgdGhlcmUgaXMgbm8gZGlzY29udGludWl0eSBpbiB1cGRh dGUgIzIgYWJvdmUNCg0KfCBzaW5jZSBBUzY1MDAxIGlzIEFTMj8NCg0KfA0KDQp8IElmIHRoaXMg aXMgYWNjZXB0YWJsZSwgdGhlbiBjYW4gd2UgYXNzZXJ0IHRoYXQgdGhlIHNlY3VyaXR5IGd1YXJh bnRlZSBpcyBTZWN0aW9uIDguMQ0KDQp8IGlzIGdvb2QgaW5zaWRlIGNvbmZlZGVyYXRpb25zIGFz IHdlbGwgd2l0aCB0aGUgdW5kZXJzdGFuZGluZyB0aGF0IGVhY2ggbWVtYmVyIEFTDQoNCnwgaXMg YWxzbyB0aGUgcHVibGljIEFTIG9mIHRoZSBjb25mZWQ/IEZvciBpbnN0YW5jZSwgQVM2NTAwMiBp cyBjb2duaXphbnQgdGhhdA0KDQp8IEFTNjUwMDEgaXMgYWxzbyBBUzIuIFNvIEFTNjUwMDIgZG9l cyBub3Qgc2VlIGEgZGlzY29udGludWl0eS4NCg0KDQoNCk5vLCBpdCBpcyBub3Qgb2sgdG8gbWUu DQoNCg0KDQpFdmVuIHRob3VnaCBpbiB0aGVvcnkgYWxsIHRoZSByb3V0ZXJzIGluIGEgY29uZmVk ZXJhdGlvbiBrbm93IHRoZSBjb25mZWRlcmF0aW9uIElELCBpbiBwcmFjdGljZSB0aGUgb25seSBy ZWFzb24gdGhhdCBpdCBpcyBuZWVkZWQgaXMgaWYgYW4gZXh0ZXJuYWwgKHRvIHRoZSBjb25mZWRl cmF0aW9uKSBwZWVyaW5nIHNlc3Npb24gZXhpc3RzIGluIHRoYXQgbWVtYmVyIEFTLiAgSW4gb3Ro ZXIgd29yZHMsIGl0IGlzIHBvc3NpYmxlIHRvIGNvbmZpZ3VyZSBhIHJvdXRlciB0byBiZSBhbiDi gJxpbnRlcm5hbOKAnSBtZW1iZXIgKGkuZS4gbm90IGhhdmluZyBhbnkgZXh0ZXJuYWwtdG8tdGhl LWNvbmZlZGVyYXRpb24gcGVlcnMpIGJ5IG9ubHkgaW5kaWNhdGluZyB0aGUgY29uZmVkZXJhdGlv biBwZWVycyBhbmQgbm90IHRoZSBjb25mZWRlcmF0aW9uIElELg0KDQoNCg0KRm9yIGV4YW1wbGUs IGV4dGVuZGluZyB0aGUgbmV0d29yayBhYm92ZToNCg0KDQoNCkFTMSAtPiBBUzIvQVM2NTAwMSAt PiBBUzY1MDAzIC0+IEFTNjUwMDQgLT4gQVM2NTAwMi9BUzIgLT4gQVMzDQoNCihBUzIgaXMgdGhl IENvbmZlZGVyYXRpb24gSUQgYW5kIEFTNjUwMDEsIEFTNjUwMDIgQVM2NTAwMywgQVM2NTAwNCBh cmUgTWVtYmVycykNCg0KDQoNCkluIHRoaXMgbmV0d29yayBBUzY1MDAzIChmb3IgZXhhbXBsZSkg b25seSBuZWVkcyB0byBrbm93IChpLmUuIGJlIGNvbmZpZ3VyZWQpIHRoYXQgQVM2NTAwMSBhbmQg QVM2NTAwNCBhcyBjb25mZWRlcmF0aW9uIHBlZXJzLCBhbmQgbm90IHRoZSBzcGVjaWZpYyBrbm93 bGVkZ2Ugb2Ygd2hpY2ggaXMgdGhlIGNvbmZlZGVyYXRpb24gSUQuICBJbiBmYWN0LCBpZiBBUzY1 MDAzIHdhcyBjb25maWd1cmVkIHdpdGggdGhlIHdyb25nIGNvbmZlZGVyYXRpb24gSUQgKEFTNCwg Zm9yIGV4YW1wbGUpLCBldmVyeXRoaW5nIHdvdWxkIHN0aWxsIHdvcmsgd2l0aCBubyBpc3N1ZXMs IGJlY2F1c2UgdGhlIGNvbmZlZGVyYXRpb24gSUQgd291bGRu4oCZdCBiZSB1c2VkIGluIHRoZSBl eGlzdGluZyBwZWVyaW5nIHNlc3Npb25zLg0KDQoNCg0KSU9XLCBBUzY1MDAzIGRvZXNu4oCZdCBu ZWNlc3NhcmlseSBhbHdheXMga25vdyB0aGF0IEFTNjUwMDEgaXMgYWxzbyBBUzIuICBJdCBtYXkg bm90IGtub3cgdGhlIGNvbmZlZGVyYXRpb24gSUQgYXQgYWxsLCBvciBpdCBtYXkgZXZlbiB0aGlu ayB0aGF0IEFTNjUwMDEgaXMgYWxzbyBzb21lIG90aGVyIEFTLg0KDQoNCg0KWWVzLCBJIGhhdmUg dG8gYWRtaXQgdGhhdCB3ZSBjb3VsZCBhcmd1ZSB3aGV0aGVyIGVpdGhlciBjYXNlL29yIGJvdGgg KG9mIG5vdCBrbm93aW5nIHRoZSBwcm9wZXIgY29uZmVkZXJhdGlvbiBJRCkgaXMgYSBtaXNjb25m aWd1cmF0aW9u4oCmYnV0IHRoZSBmYWN0IHBlcnNpc3RzIHRoYXQgdGhlcmUgaXMgbm8gZXhwbGlj aXQgaW5kaWNhdGlvbiB0aGF0IEFTMiBpbnRlbmRlZCB0byBzZW5kIHRoZSBVcGRhdGUgdG8gQVM2 NTAwMSAoZXZlbiBpZiB0aGV5IGFyZSwgb3Igc2hvdWxkIGJlLCB0aGUgc2FtZSBib3gpLg0KDQoN Cg0KDQoNClRoaXMgaXMgd2hlcmUgSSB0aGluayB3ZeKAmXJlIGFnYWluIGF0IGEgcGxhY2Ugd2hl cmUgd2XigJlyZSBwcm9iYWJseSBhZ3JlZWluZyB0byBkaXNhZ3JlZSDigJMgYW5kIHdoZXJlIG1v cmUgaW5wdXQgZnJvbSB0aGUgV0cgd291bGQgYmUgZ3JlYXQuICAgSSBhbSBoYXBweSB0byBiZSBp biB0aGUgcm91Z2ggaWYgdGhlIFdHIGFncmVlcyB3aXRoIHlvdS4NCg0KDQoNCg0KDQpUaGFua3Mh DQoNCg0KDQpBbHZhcm8uDQo= --_000_F318D2E50A4A430FBDC17C8AAF96C68Bciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpwLk1zb1BsYWluVGV4dCwgbGkuTXNvUGxhaW5UZXh0LCBkaXYuTXNvUGxhaW5UZXh0DQoJe21z by1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCBDaGFyIjsN CgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KcA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJ bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsN Cglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndp bmRvd3RleHQ7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCnNw YW4uUGxhaW5UZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiUGxhaW4gVGV4dCBDaGFyIjsNCglt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IlBsYWluIFRleHQiOw0KCWZv bnQtZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5tc29JbnMNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTsN Cgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1v bmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41 aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9k eSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk9u IDEyLzIxLzE2LCAxMjo0NyBQTSwgJnF1b3Q7U3JpcmFtLCBLb3Rpa2FsYXB1ZGkgKEZlZCkmcXVv dDsgJmx0O2tvdGlrYWxhcHVkaS5zcmlyYW1AbmlzdC5nb3YmZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij5TcmlyYW06PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PkhpITxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IEkgc2FpZCBpbiBteSBwcmV2aW91 cyBwb3N0OjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCAmcXVvdDso MikgSXQgYWxzbyBrZWVwcyBjb25mZWQgQVNlcyBmcm9tIGZhaWxpbmcgdG8gdmFsaWRhdGUgcHJv cGVybHkgdGhlIHNpZ25hdHVyZSBpbmplY3RlZCBhdCB0aGUgYm91bmRhcnkuJnF1b3Q7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij58IEkgcmV0cmFjdCBteSBvYnNlcnZhdGlvbuKApjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+4oCmIDxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+fDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+fCBTbyBsZXQgdXMgZm9jdXMgYmFjayBvbiBvbmx5IHlvdXIgb3JpZ2luYWwgY29uY2Vy bi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgSWYmbmJzcDt3ZSBu ZWVkIHRoZSBzb2x1dGlvbiBvZiAmcXVvdDtjb25mZWQgQVMgc2lnbmluZyB0byBpdHNlbGYgd2l0 aCAmbmJzcDtwQ291bnQgPSAwJnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+fCBpdCB3b3VsZCBiZSBvbmx5IHRvIGFkZHJlc3MgeW91ciBvcmlnaW5hbCBjb25j ZXJuIG9mIGFuIGFwcGFyZW50IGRpc2NvbnRpbnVpdHkuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij58IEkgbG9va2VkIGF0IHRoZSBpbXBsaWNhdGlvbnMgb2YgdGhlIHNv bHV0aW9uIG9uY2UgYWdhaW4uDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPnwgV2hpbGUgaXQgbWF5IGJlIGVhc3kgdG8gZGVzY3JpYmUgaXQgaW4gdGVybXMgb2YmbmJz cDtzZW5kZXIgYWN0aW9ucywNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+fCB0aGUgc29sdXRpb24gd291bGQgaGF2ZSByaXBwbGUgZWZmZWN0cyZuYnNwO2luIHNldmVy YWwgcGxhY2VzIGluIHRoZSBkb2N1bWVudC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPnw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgU28g SSB3aXNoIHRvIHRha2UgYW5vdGhlciBmcmVzaCBsb29rIGF0IHlvdXIgY29uY2VybiB3aXRoIHlv dXIgaGVscCw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgYW5kIHRy eSB0byB1bmRlcnN0YW5kIGlmIHRoZXJlIGlzbid0IGFub3RoZXIgd2F5IHRvIGFkZHJlc3MgaXQu PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IFRoZSBleGFtcGxlIHNjZW5hcmlvIGlzOjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCBBUzEgLSZndDsgQVMyL0FTNjUw MDEgLSZndDsgQVM2NTAwMi9BUzIgLSZndDsgQVMzIChBUzIgaXMgdGhlIENvbmZlZGVyYXRpb24g SUQgYW5kIEFTNjUwMDEgYW5kIEFTNjUwMDIgYXJlIE1lbWJlcnMpJm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij58IFdpdGggdGhlIGN1cnJlbnQgc3BlY2lmaWNhdGlvbiwgd2UgaGF2ZSB0 aGUgZm9sbG93aW5nIHNlcXVlbmNlIG9mIHNpZ25lZCB1cGRhdGVzOjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCAoTm90YXRpb246IChTLWktaikgbWVhbnMgc2lnbmF0 dXJlIGZyb20gQVMgaSB0byBBUyBqLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+fCBQIGlzIHRoZSBwcmVmaXg7IGFuZCBtb3N0IHJlY2VudCBBUyBhcHBlYXJzIGluIHRo ZSByaWdodCBtb3N0IHBvc2l0aW9uKTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+fDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCAjMSZuYnNw OyBBUzEgdG8gQVMyL0FTNjUwMDE6Jm5ic3A7IFAgW0FTMSB7KFMtMS0yKX1dPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij58ICMyJm5ic3A7IEFTMi9BUzY1MDAxJm5ic3A7dG8gQVMyL0FT NjUwMDI6Jm5ic3A7IFAgW0FTMSwgQVM2NTAwMSB7KFMtMS0yKSwgKFMtNjUwMDEtNjUwMDIpfV0s DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnw8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgIzMmbmJzcDsgQVMyL0FTNjUwMDImbmJzcDt0 byBBUzM6Jm5ic3A7IFAgW0FTMSwgQVMyLCB7KFMtMS0yKSwgKCBTLTItMyl9XSZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCAoU2VjdXJlX1BhdGggU2VnbWVu dCBhbmQgU2lnbmF0dXJlIHdpdGhpbiB0aGUgY29uZmVkIGFyZSBzdHJpcHBlZCk8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPnwgVGhlIGRpc2NvbnRpbnVpdHkgeW91IGFyZSBjb25jZXJuZWQgYWJv dXQgaXMgaW4gdGhlIG1pZGRsZSAoMm5kKSB1cGRhdGUgYWJvdmUsIGkuZS4sPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IHRoZSZuYnNwO2ZpcnN0IHNpZ25hdHVyZSBp cyBmcm9tIEFTMSB0byBBUzIgd2hpbGUgdGhlIHNlY29uZCBzaWduYXR1cmUgaXMgZnJvbSBBUzY1 MDAxJm5ic3A7dG8gQVM2NTAwMi4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPnwgQW0gSSByaWdodD88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+WWVz LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPnwgQnV0IHRoZW4geW91IGhhdmUgb2JzZXJ2ZWQgdGhlIGZv bGxvd2luZyBlYXJsaWVyOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ fDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCAmcXVvdDtXZWxsLCB0 aGUgUEUgd2l0aCBib3RoIEFTMiBhbmQgQVM2NTAwMSAqaXMqIGJvdGggQVMyICphbmQqIEFTNjUw MDHigKZzbyBJIGRvbuKAmXQgc2VlIGl0IGFzIGEgcHJveHkuJnF1b3Q7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWwtYXJj aGl2ZS93ZWIvc2lkci9jdXJyZW50L21zZzA4MTA3Lmh0bWw8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPnw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPnwgR2l2ZW4gdGhpcyBvYnNlcnZhdGlvbiwgd291bGQgeW91IGFjY2VwdCB0aGF0IHRoZXJl IGlzIG5vIGRpc2NvbnRpbnVpdHkgaW4gdXBkYXRlICMyIGFib3ZlPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij58IHNpbmNlIEFTNjUwMDEgaXMgQVMyPzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+fCBJZiB0aGlzIGlzIGFjY2VwdGFibGUsIHRoZW4gY2FuIHdlIGFzc2Vy dCB0aGF0IHRoZSBzZWN1cml0eSBndWFyYW50ZWUgaXMgU2VjdGlvbiA4LjE8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgaXMgZ29vZCBpbnNpZGUgY29uZmVkZXJhdGlv bnMgYXMgd2VsbCB3aXRoIHRoZSB1bmRlcnN0YW5kaW5nIHRoYXQgZWFjaCBtZW1iZXIgQVM8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPnwgaXMgYWxzbyB0aGUgcHVibGlj IEFTIG9mIHRoZSBjb25mZWQ/IEZvciBpbnN0YW5jZSwgQVM2NTAwMiBpcyBjb2duaXphbnQgdGhh dDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+fCBBUzY1MDAxIGlzIGFs c28gQVMyLiBTbyBBUzY1MDAyIGRvZXMgbm90IHNlZSBhIGRpc2NvbnRpbnVpdHkuPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPk5vLCBpdCBpcyBub3Qgb2sgdG8gbWUuPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPkV2ZW4gdGhvdWdoIGluIHRoZW9yeSBhbGwgdGhlIHJvdXRlcnMg aW4gYSBjb25mZWRlcmF0aW9uIGtub3cgdGhlIGNvbmZlZGVyYXRpb24gSUQsIGluIHByYWN0aWNl IHRoZSBvbmx5IHJlYXNvbiB0aGF0IGl0IGlzIG5lZWRlZCBpcyBpZiBhbiBleHRlcm5hbCAodG8g dGhlIGNvbmZlZGVyYXRpb24pIHBlZXJpbmcgc2Vzc2lvbiBleGlzdHMgaW4gdGhhdCBtZW1iZXIg QVMuJm5ic3A7IEluIG90aGVyIHdvcmRzLCBpdA0KIGlzIHBvc3NpYmxlIHRvIGNvbmZpZ3VyZSBh IHJvdXRlciB0byBiZSBhbiDigJxpbnRlcm5hbOKAnSBtZW1iZXIgKGkuZS4gbm90IGhhdmluZyBh bnkgZXh0ZXJuYWwtdG8tdGhlLWNvbmZlZGVyYXRpb24gcGVlcnMpIGJ5IG9ubHkgaW5kaWNhdGlu ZyB0aGUgY29uZmVkZXJhdGlvbiBwZWVycyBhbmQgbm90IHRoZSBjb25mZWRlcmF0aW9uIElELjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5Gb3IgZXhhbXBsZSwgZXh0ZW5kaW5nIHRoZSBu ZXR3b3JrIGFib3ZlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5BUzEgLSZndDsgQVMy L0FTNjUwMDEgLSZndDsgQVM2NTAwMyAtJmd0OyBBUzY1MDA0IC0mZ3Q7IEFTNjUwMDIvQVMyIC0m Z3Q7IEFTMw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4oQVMyIGlz IHRoZSBDb25mZWRlcmF0aW9uIElEIGFuZCBBUzY1MDAxLCBBUzY1MDAyIEFTNjUwMDMsIEFTNjUw MDQgYXJlIE1lbWJlcnMpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPkluIHRoaXMgbmV0 d29yayBBUzY1MDAzIChmb3IgZXhhbXBsZSkgb25seSBuZWVkcyB0byBrbm93IChpLmUuIGJlIGNv bmZpZ3VyZWQpIHRoYXQgQVM2NTAwMSBhbmQgQVM2NTAwNCBhcyBjb25mZWRlcmF0aW9uIHBlZXJz LCBhbmQgbm90IHRoZSBzcGVjaWZpYyBrbm93bGVkZ2Ugb2Ygd2hpY2ggaXMgdGhlIGNvbmZlZGVy YXRpb24gSUQuJm5ic3A7IEluIGZhY3QsIGlmIEFTNjUwMDMgd2FzIGNvbmZpZ3VyZWQgd2l0aA0K IHRoZSB3cm9uZyBjb25mZWRlcmF0aW9uIElEIChBUzQsIGZvciBleGFtcGxlKSwgZXZlcnl0aGlu ZyB3b3VsZCBzdGlsbCB3b3JrIHdpdGggbm8gaXNzdWVzLCBiZWNhdXNlIHRoZSBjb25mZWRlcmF0 aW9uIElEIHdvdWxkbuKAmXQgYmUgdXNlZCBpbiB0aGUgZXhpc3RpbmcgcGVlcmluZyBzZXNzaW9u cy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+SU9XLCBBUzY1MDAzIGRvZXNu4oCZdCBu ZWNlc3NhcmlseSBhbHdheXMga25vdyB0aGF0IEFTNjUwMDEgaXMgYWxzbyBBUzIuJm5ic3A7IEl0 IG1heSBub3Qga25vdyB0aGUgY29uZmVkZXJhdGlvbiBJRCBhdCBhbGwsIG9yIGl0IG1heSBldmVu IHRoaW5rIHRoYXQgQVM2NTAwMSBpcyBhbHNvIHNvbWUgb3RoZXIgQVMuPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPlllcywgSSBoYXZlIHRvIGFkbWl0IHRoYXQgd2UgY291bGQgYXJndWUg d2hldGhlciBlaXRoZXIgY2FzZS9vciBib3RoIChvZiBub3Qga25vd2luZyB0aGUgcHJvcGVyIGNv bmZlZGVyYXRpb24gSUQpIGlzIGEgbWlzY29uZmlndXJhdGlvbuKApmJ1dCB0aGUgZmFjdCBwZXJz aXN0cyB0aGF0IHRoZXJlIGlzIG5vIGV4cGxpY2l0IGluZGljYXRpb24gdGhhdCBBUzIgaW50ZW5k ZWQgdG8gc2VuZCB0aGUgVXBkYXRlIHRvDQogQVM2NTAwMSAoZXZlbiBpZiB0aGV5IGFyZSwgb3Ig c2hvdWxkIGJlLCB0aGUgc2FtZSBib3gpLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPlRoaXMgaXMgd2hl cmUgSSB0aGluayB3ZeKAmXJlIGFnYWluIGF0IGEgcGxhY2Ugd2hlcmUgd2XigJlyZSBwcm9iYWJs eSBhZ3JlZWluZyB0byBkaXNhZ3JlZSDigJMgYW5kIHdoZXJlIG1vcmUgaW5wdXQgZnJvbSB0aGUg V0cgd291bGQgYmUgZ3JlYXQuJm5ic3A7Jm5ic3A7IEkgYW0gaGFwcHkgdG8gYmUgaW4gdGhlIHJv dWdoIGlmIHRoZSBXRyBhZ3JlZXMgd2l0aCB5b3UuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+VGhhbmtz ITxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5BbHZhcm8uPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_F318D2E50A4A430FBDC17C8AAF96C68Bciscocom_-- From nobody Wed Dec 21 16:53:06 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6967E129465 for ; Wed, 21 Dec 2016 16:53:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.001 X-Spam-Level: X-Spam-Status: No, score=-10.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id epiiXjiOab4b for ; Wed, 21 Dec 2016 16:53:04 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 883BD1293F5 for ; Wed, 21 Dec 2016 16:53:04 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cJrcy-0004oh-9J; Thu, 22 Dec 2016 00:53:00 +0000 Date: Thu, 22 Dec 2016 09:52:58 +0900 Message-ID: From: Randy Bush To: Alvaro Retana In-Reply-To: References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> <98186E08-8CAC-4EB0-9E84-BBABACC43678@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-8859-7 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: Kotikalapudi Sriram , sidr wg list Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Dec 2016 00:53:05 -0000 > IOW, AS65003 doesn=A2t necessarily always know that AS65001 is also AS2. > It may not know the confederation ID at all, or it may even think that > AS65001 is also some other AS. and this is within spec. we have no measure of how common this is, and it would be hard to measure due to the problem of vantage points. such is life with bgp. randy From nobody Thu Dec 22 09:42:05 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC6EF129621; Thu, 22 Dec 2016 09:42:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DME0GYaGjgBX; Thu, 22 Dec 2016 09:42:02 -0800 (PST) Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0115.outbound.protection.outlook.com [23.103.201.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09C6E129406; Thu, 22 Dec 2016 09:42:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=7E9lDqGsbYT67LFIjkgIp6wLqaws6cYZM53Ieyda9Go=; b=CjKDU9CQ26mRoQkdnAWXJb6MTjvkJ9LSgwfaAG9nHwT6UA7y14y2snucWrI8ontq/QuNhXs5Hnx1J1eci53+L4SeAsBAAnHFDzxO23XQVc9UF+gSTlZs6gJHIxrkAvDA9gkG+f1CICbqrVAp7Be9DqDU4YNzv+sai//IMJIPS/s= Received: from DM2PR09MB0446.namprd09.prod.outlook.com (10.161.252.145) by SN1PR09MB1006.namprd09.prod.outlook.com (10.166.69.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.803.11; Thu, 22 Dec 2016 17:41:59 +0000 Received: from DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) by DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) with mapi id 15.01.0789.018; Thu, 22 Dec 2016 17:41:59 +0000 From: "Sriram, Kotikalapudi (Fed)" To: sidr wg list Thread-Topic: Implementer inputs requested (Fw: SecDir Review of draft-ietf-sidr-bgpsec-protocol-20) Thread-Index: AQHSXHqyAyzM0B3CfkavQnhoYfx3Qw== Date: Thu, 22 Dec 2016 17:41:59 +0000 Message-ID: References: , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=kotikalapudi.sriram@nist.gov; x-originating-ip: [129.6.220.81] x-microsoft-exchange-diagnostics: 1; SN1PR09MB1006; 7:akLOHmkLQnd4SdbXNeosSXvpSTIVon6N9bTpleyQtoezmvKT32f//GhHnm7OMZHZpDJF/ZcphLSqa58NToGo5DhU/IAYjFQ9CECTM4AnzlWRalT4YGlzt7WKbgTyZQm27cQYf+9i3Ub3uOoUiCYuEoCsR1HFe1rkZYE6LyFi7ZoAhtmocIHMQqBIxz+FZ+oykhYZF7loeg98gjC7R3ZUPOiYuFG48TJdp/3K28dvlXEmbGLN72b8ooTQtis/2JDP6kILKN0kjg0yX0Us+7bKrmp5GaLDEasIrHGIwj0DkGgFKjQBx1FGsDriRD22bQVnZ8jS8LgqfBzJpSomlrn6caPLiQyYDgmDmCNGqQXVVMmVDN7nt8ktubT12w5JsNCYF0qQ1XZjnmzPfSExU617q9Z5WIYgExIELOAyRX5E5xsIOoqWLSK4hVZWrkVKIY/kB2EGA+MAQJkqWLVnJqRPAg== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39410400002)(39850400002)(39450400003)(39860400002)(39840400002)(199003)(189002)(5660300001)(81166006)(110136003)(19627405001)(99286002)(105586002)(189998001)(106356001)(2906002)(106116001)(9686002)(4326007)(101416001)(54356999)(50986999)(76176999)(68736007)(3280700002)(7736002)(74316002)(66066001)(92566002)(230783001)(33656002)(25786008)(3660700001)(76576001)(102836003)(3846002)(6116002)(38730400001)(77096006)(97736004)(2900100001)(6506006)(6436002)(8936002)(6916009)(6606003)(2950100002)(81156014)(7696004)(122556002)(8676002)(86362001); DIR:OUT; SFP:1102; SCL:1; SRVR:SN1PR09MB1006; H:DM2PR09MB0446.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; x-ms-office365-filtering-correlation-id: 7877078f-78fb-4453-3f61-08d42a91d4b0 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:SN1PR09MB1006; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123562025)(20161123560025)(20161123564025)(20161123555025)(6072148); SRVR:SN1PR09MB1006; BCL:0; PCL:0; RULEID:; SRVR:SN1PR09MB1006; x-forefront-prvs: 01644DCF4A received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR09MB0446A2C482C53D6602E2E3D784920DM2PR09MB0446namp_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Dec 2016 17:41:59.1065 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR09MB1006 Archived-At: Cc: "sidr-chairs@ietf.org" , Michael Baer Subject: [sidr] Implementer inputs requested (Fw: SecDir Review of draft-ietf-sidr-bgpsec-protocol-20) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Dec 2016 17:42:04 -0000 --_000_DM2PR09MB0446A2C482C53D6602E2E3D784920DM2PR09MB0446namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Russ Housley had suggested these changes (#1 and #2 below) as part of his S= ecDir review. But he also suggested to me to put it out on the mailing list so that implementers in particular and anyone having an opinion can have a say. Russ's comment: Minor: #1 In Section 3.2, the Signature Length within the Signature Segment does not count the length field itself. It seems that all of the other length values in this specification count the size of the length too. Consistency will avoid implementation errors. Russ's comment: Minor: #2 Section 2.1 says: ... The BGP speaker sets this bit to 0 to indicate the capability to receive BGPsec update messages. The BGP speaker sets this bit to 1 to indicate the capability to send BGPsec update messages. It seems a bit wasteful to repeat the whole capability for each direction. Wouldn't it be better to follow the example used in other capability definitions (such as RFC 7911) by using one of the unassigned bits? The Send/Receive pair of bits would have these semantics: This field indicates whether the sender is (a) able to receive BGPsec update messages from its peer (value 1), (b) able to send BGPsec update messages to its peer (value 2), or (c) both (value 3) for the address family identified in the AFI. [Sriram] Observation: Two implementations exist and they were shown to interoperate at the IETF-97 in Seoul. The changes would cause those implementations to make code modifications. Sriram --_000_DM2PR09MB0446A2C482C53D6602E2E3D784920DM2PR09MB0446namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Russ Housley had suggested these changes (#1 and #2 below) as part of hi= s SecDir review.

But he also suggested to me to put it out on the mailing list so that

implementers in particular and anyone having an opinion can have a say. =


Russ's comment:

Minor:

#1

In Section 3.2, the Signature Length within the Signature Segment does

not count the length field itself.  It seems that all of the other<= /p>

length values in this specification count the size of the length too.

Consistency will avoid implementation errors.

Russ's comment:

Minor:

#2

Section 2.1 says:

    ...  The BGP speaker

    sets this bit to 0 to indicate the capability to rece= ive BGPsec

    update messages.  The BGP speaker sets this bit = to 1 to indicate the

    capability to send BGPsec update messages.

It seems a bit wasteful to repeat the whole capability for each

direction.  Wouldn't it be better to follow the example used in

other capability definitions (such as RFC 7911) by using one of the

unassigned bits?  The Send/Receive pair of bits would have these

semantics:

    This field indicates whether the sender is (a) able t= o receive

    BGPsec update messages from its peer (value 1), (b) a= ble to send

    BGPsec update messages to its peer (value 2), or (c) = both (value 3)

    for the address family identified in the AFI.

[Sriram] Observation: Two implementations exist and

they were shown to interoperate at the IETF-97 in Seoul.

The changes would cause those implementations to make code modific= ations. 

Sriram

--_000_DM2PR09MB0446A2C482C53D6602E2E3D784920DM2PR09MB0446namp_-- From nobody Thu Dec 22 13:31:39 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 130CD129766 for ; Thu, 22 Dec 2016 13:31:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zuNRx8m3KSL5 for ; Thu, 22 Dec 2016 13:31:37 -0800 (PST) Received: from mail-qk0-x22a.google.com (mail-qk0-x22a.google.com [IPv6:2607:f8b0:400d:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10B6712959E for ; Thu, 22 Dec 2016 13:31:37 -0800 (PST) Received: by mail-qk0-x22a.google.com with SMTP id t184so126789443qkd.0 for ; Thu, 22 Dec 2016 13:31:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=h05FFmLDdI0v51TrORiPjVO8v/rWpADoc6M3mWCffOE=; b=PcGqKwzoGjVtb3xGgk2zvS980SI3pgjFyyWymCPAOJFORWU6N6wvyPe2XpZGQCZ0QW EocmZDUWJQabMKQpN7GinytD+rG+d/olCxz0p9ZinoQCTX1vBW7TXmokBkViSzMI/zMX c5G55Fg7N9I8Ucwzz+GSTwGxTY5ivw+rKEUTk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=h05FFmLDdI0v51TrORiPjVO8v/rWpADoc6M3mWCffOE=; b=YoLMzVPtfk9uIRUHkdhLTzU9GYsZdMmLbrwLqWCMUGjKnxRTnPTMu+G5+2UsGXMlaX mGU9xoBiIb38tiqrCAB+lp2ucMd0ONCSlXKHAlSeBUcgh1YTynK9LzP+lf7LKF6m/Kss lNmITl7imXt92I9Gj/M9Q4kic7dJDXvtdkF7qaTmfs2obVnDvfPWIIO7tmdywkCKxQAb V/v6UW0d2vpV3bFAMpwn3ZLJf92HMN3CNKC+HOWRyC80gMKIoCTY6wJOwdO3aIJua2D4 RR3QNkBvGR1KSz0gmaNzLxHoqe3r+KE0ukTdO+z+cXnPeHDR0BUbWHhnOfG+cgjZdhO/ Rr2Q== X-Gm-Message-State: AIkVDXLmsPLU6RsdvnM8yHsndIKDo5YJ7FnnWSfT6KBbtHpyH9e3qd8kYpUAGqeMKqHGQQ== X-Received: by 10.233.221.130 with SMTP id r124mr12043826qkf.183.1482442295893; Thu, 22 Dec 2016 13:31:35 -0800 (PST) Received: from [172.16.0.92] (pool-173-73-120-80.washdc.east.verizon.net. [173.73.120.80]) by smtp.gmail.com with ESMTPSA id a69sm18789390qkj.38.2016.12.22.13.31.34 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 22 Dec 2016 13:31:35 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: <148166550959.10904.12174161860330524758.idtracker@ietfa.amsl.com> Date: Thu, 22 Dec 2016 16:31:33 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: <148166550959.10904.12174161860330524758.idtracker@ietfa.amsl.com> To: Dale Worley X-Mailer: Apple Mail (2.3124) Archived-At: Cc: gen-art@ietf.org, draft-ietf-sidr-bgpsec-pki-profiles.all@ietf.org, IETF discussion list , sidr wg list Subject: Re: [sidr] Review of draft-ietf-sidr-bgpsec-pki-profiles-18 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Dec 2016 21:31:39 -0000 Dale, Thanks for the review. Responses inline. And, assuming Steve agrees = I=E2=80=99ll submit a version that incorporates these and other changes = before the IESG does its eval. spt > On Dec 13, 2016, at 16:45, Dale Worley wrote: >=20 > Reviewer: Dale Worley > Review result: Ready with Nits >=20 > I am the assigned Gen-ART reviewer for this draft. The General Area > Review Team (Gen-ART) reviews all IETF documents being processed by > the IESG for the IETF Chair. Please treat these comments just like > any other last call comments. >=20 > Document: draft-ietf-sidr-bgpsec-pki-profiles-18 > Reviewer: Dale R. Worley > Review Date: 12 Dec 2016 > IETF LC End Date: 19 Dec 2016 > IESG Telechat date: unknown >=20 > Summary: >=20 > This draft is basically ready for publication, but has nits that > should be fixed before publication. >=20 > Some of these items appear to be technical, but I suspect that the > intended meanings are clear to people well-versed in PKI and are known > to work. However, they are unclear to a naive reader. >=20 > 2. Describing Resources in Certificates >=20 > The RIR, in turn, issues a CA certificate to an Internet Service > Providers (ISP).=20 >=20 > s/Providers/Provider/ > =20 > The CA also > generate. The CA also generates Certificate Revocation Lists > (CRLs). >=20 > The first "The CA also generate." is extraneous. Alvaro caught these too in his AD review so I=E2=80=99ve got them in the = editor's copy I=E2=80=99m working with. > 3.1 BGPsec Router Certificate Fields >=20 > A BGPsec Router Certificate is a valid X.509 public key > certificate, > consistent with the PKIX profile [RFC5280], containing the fields > listed in this section. This profile is also based on [RFC6487] > and > only the differences between this profile and the profile in > [RFC6487] are specified below. >=20 > I suspect this paragraph is going to cause implementers some trouble. > What, exactly, are the constraints on the BGPsec Router Certificate? >=20 > It looks like the certificate must conform to: >=20 > - X.509 >=20 > - RFC 5280 >=20 > - RFC 6487 as modified by "below" >=20 > and I see that RFC 6487 requires that certificates conform to RFC > 5280. So it seems that the first two items are directly required by > this document and transitively required by RFC 6487. >=20 > I suggest changing the first two items to be required only by > transitivity, only mentioning X.509 and RFC 5280 as explanatory: >=20 > A BGPsec Router Certificate is consistent with the profile in > [RFC6487] as modified by the specifications in this section. As > such, it must be a valid X.509 public key certificate and > consistent with the PKIX profile [RFC5280]. >=20 > Also, "below" is vague. I suspect you mean "The differences between > this profile and the profile in [RFC6487] are specified in this > section.=E2=80=9D It=E2=80=99s basically profile of a profile of a profile plus some = stuff. I=E2=80=99m happy to adopt your suggestion modulo s/must be/is. > 3.1.1.1. Subject=20 >=20 > However, each > certificate issued by an individual CA MUST contain a Subject name > that is unique within that context. >=20 > What is "that context"? Do you mean: >=20 > However, the certificates issued by an individual CA MUST contain > unique Subject names. >=20 > However that has difficulties when it comes time for the CA to issue > new certificates with later validity times. >=20 > Why there is a constraint based on "issued by an individual CA" is not > clear, given that there is no constraint regarding which CA issues > certificates to which routers. Merely aggregating the work of > multiple CAs into one CA could require changing the subject names in > the next revision of issued certificates, whereas splitting the > work of one CA into multiple CAs would loosen this requirement. In > addition, the definition of "an individual CA" is not clear. Is there > really an operational requirement for this uniqueness constraint? >=20 > More to the point, is the combination of common name (i.e. AS number) > and serial number (router ID) required to be globally unique or not? > That seems to be the only question that can be operationally > significant. >=20 > I suspect that someone well-versed in PKI knows these answers, but for > the naive, what is required and why seems confusing. I think this is just a case of a missing =E2=80=9CCA=E2=80=9D in front = of the word =E2=80=9Ccontext=E2=80=9D so tweaking it to: =E2=80=9C=E2=80=A6= . that is unique to that CA context=E2=80=9D. The certs only need to be = unique on a per CA basis the subject name does not need to be unique = across the whole of the RPKI. The combination of issuer+subject+serial = # plus all the parent certs provides the uniqueness. > 3.2. BGPsec Router Certificate Request Profile >=20 > o The SubjectPublicKeyInfo and PublicKey fields are specified in > [ID.sidr-bgpsec-algs]. >=20 > There is no "PublicKey field" discussed in ID.sidr-bgpsec-algs. Is > "subjectPublicKey" intended? If so, "subjectPublicKey" seems to be a > sub-field of SubjectPublicKeyInfo (per ID.sidr-bgpsec-algs section > 3.1), which is also listed here, so it is not clear why it is > mentioned individually here. I think this was hold over from the CRMF request description; =E2=80=9Cand= PublicKey=E2=80=9D can be dropped. > 3.3. BGPsec Router Certificate Validation=20 >=20 > The validation procedure used for BGPsec Router Certificates is > identical to the validation procedure described in Section 7 of > [RFC6487] (and any RFC that updates this procedure), but using the > constraints applied come from this specification. >=20 > I assume you mean "and any RFC that updates the procedure of > [RFC6487]". In that case, I think that "that procedure" would be > required, but "the procedure of [RFC6487]" would eliminate any > ambiguity. >=20 > "but using the constraints applied come from this specification" is > unclear. Sure - how about: The validation procedure used for BGPsec Router Certificates is identical to the validation procedure described in Section 7 of [RFC6487] (and any RFC that updates that procedure), but using the constraints applied come from this specification > step 3: "the certificate contains all the field that must be > present" >=20 > This doesn't match the text in RFC 6487, despite claiming to be > quoted: > s/the certificate/The certificate/ > s/all the field/all fields/ fair enough ;) > o BGPsec Router Certificate MUST include the "Subject Public Key > Info" described in [ID.sidr-bgpsec-algs] as it updates [ID.sidr- > rfc6485bis]. >=20 > There is no "Subject Public Key Info" in ID.sidr-bgpsec-algs. Is > "subjectPublicKeyInfo" intended? Yes > The construction "[ID.sidr-bgpsec-algs] as it updates > [ID.sidr-rfc6485bis]" is awkward. Is "[ID.sidr-rfc6485bis] as updated > by [ID.sidr-bgpsec-algs]" intended? If the latter construction is > used, it is well-defined, though it means that the actual place to > look for the description of "subjectPublicKeyInfo" is in > [ID.sidr-bgpsec-algs]. It=E2=80=99s a tangled web the SIDR drafts have weaved :) The latter. > Better, though, is to ask, What will this look like when the RFCs are > published? Will [ID.sidr-bgpsec-algs] and [ID.sidr-rfc6485bis] be > separate RFCs? If so, the desired format of "subjectPublicKeyInfo" > will be described in one or the other of the RFCs, but (it seems) you > could name just one of them. They are separate as ID.sidr-rfc6485bis is now RFC 7935. I think I = agree we should just refer to the bgpsec-pki-algs draft - it=E2=80=99s = clearer. > (It seems to me that if you have one draft modifying another draft, > you should combine them into one draft, or move the modifying text > into the draft it modifies.) >=20 > NOTE: The cryptographic algorithms used by BGPsec routers are found > in [ID.sidr-bgpsec-algs]. Currently, the algorithms specified in > [ID.sidr-bgpsec-algs] and [ID.sidr-rfc6485bis] are different.=20 > BGPsec > RPs will need to support algorithms that are used to validate > BGPsec > signatures as well as the algorithms that are needed to validate > signatures on BGPsec certificates, RPKI CA certificates, and RPKI > CRLs. >=20 > I assume that there are two dichotomies: >=20 > [ID.sidr-bgpsec-algs] vs. [ID.sidr-rfc6485bis] >=20 > {the algorithms that are used to validate BGPsec signatures} vs. > {the algorithms that are needed to validate signatures on BGPsec > certificates, RPKI CA certificates, and RPKI CRLs} You got it. > It would be easier on the reader if it was clear how these paired. > E.g., >=20 > NOTE: BGPsec RPs will need to support the algorithms in > [ID.sidr-bgpsec-algs], which are used to validate BGPsec > signatures, as well as the algorithms in [ID.sidr-rfc6485bis], > which are needed to validate signatures on BGPsec certificates, > RPKI CA certificates, and RPKI CRLs. >=20 > or vice-versa. It=E2=80=99s funny we say the RPKI and BGPsec algs are different at = least twice. I=E2=80=99m happy to change the wording here to make this = paragraph easier to digest. > 4. Design Notes=20 >=20 > Note that this behavior is similar to the CA including the AS > Resource Identifier Delegation extension in issued BGPsec Router > Certificates despite the fact it is not present in the request. >=20 > This text is indented as if it is a continuation of the immediately > preceding bullet point. I can't tell for sure, but it seems to me > that the text is actually a continuation of the paragraph containing > the bulleted list, and so should be out-dented by two spaces from > where it is now. Yep it=E2=80=99s a note for the para before the bullets so I fixed the = ident. > 6. Security Considerations=20 >=20 > A BGPsec Router Certificate will fail RPKI validation, as defined > in > [RFC6487], because the algorithm suite is different. >=20 > Different from what? Also, "algorithm suite" doesn't appear to be a > defined datum in certificates; at least, it's not mentioned anywhere > else in this document. An algorithm suite refers to the signature and hashing algorithm used. = We could make it more explicit and change it to: =E2=80=A6 because the = cryptographic algorithms used to are different. > Consequently, a > RP needs to identify the EKU to determine the appropriate > Validation > constraint. >=20 > I *think* this means that a RP needs to examine the EKU value to > determine the algorithms that are used for [something]. (What does it > mean to "identify" the EKU?) The RP needs to find it in the cert and then know that the value means = do this validation routine not the other one. I think identify works = here because I=E2=80=99d say all of the previous sentence is = associating, which is a meaning of the word identify. > Also, this paragraph discusses "the certificate will fail validation > as defined in 6487", and then talks about "the appropriate validation > constraint", but it doesn't state that "the appropriate validation > constraint" modifies the process in 6487. I suspect that the EKU > value determines an algorithm suite (based on some unstated > correspondence), which is then used to replace the algorithm suite > demanded by some part of the 6487 process, and then after that, the > certificate will pass the modified process. But the text doesn't > assert that the certificate has to pass the modified process. >=20 > I suspect that the intended meaning of this paragraph is obvious to > anyone well-versed in PKI, but I don't think the words actually say > that meaning. The validation constraints are found in s3.3 we could put a forward = pointer in here, but I think that might be overkill. > Hash functions [ID.sidr-bgpsec-algs] are used when generating the > two > key identifiers extension included in BGPsec certificates. >=20 > I suspect s/key identifiers extension/key identifier extensions/. sigh - yep > However > as noted in [RFC6818], collision resistance is not a required > property of one-way hash functions when used to generate key > identifiers. Regardless, hash collisions are possible and if > detected an operator should be alerted. >=20 > The fact that "an operator should be alerted" suggests that if a hash > collision happens it will cause an operational problem of some sort. > What that problem is should be described and some bound stated for the > amount of ensuing trouble. Conversely, if no operational problem can > arise, then there is no reason to alert an operator. Key identifiers are used to build certification paths which is then used = to validate the signature. i.e., build up validate down. As an = attacker, I can insert a certificate with a collision that might get = picked up and used when validating the BGPsec signatures; it=E2=80=99ll = obviously fail because the math won=E2=80=99t work so this is really a = DoS. How about something like the following: Regardless, hash collisions are unlikely, but they are possible and if detected an operator should be alerted. A subject key identifier collision might cause the incorrect certificate to be selected from the cache, resulting in a failed signature validation > 7. IANA Considerations >=20 > No IANA allocations are request of IANA, ... >=20 > This should be "No IANA allocations are requested of IANA", or > probably better "No allocations are requested of IANA=E2=80=9D. Alvaro had a similar comment on the IANA considerations and he suggested = the first option. > 9.2. Informative References=20 >=20 > Appendix A. ASN.1 Module >=20 > id-kp OBJECT IDENTIFIER ::=3D { > iso(1) identified-organization(3) dod(6) internet(1) > security(5) mechanisms(5) kp(3) } >=20 > Is this correct? I believe this should be >=20 > id-kp OBJECT IDENTIFIER ::=3D { > iso(1) identified-organization(3) dod(6) internet(1) > security(5) mechanisms(5) pkix(7) kp(3) } This is great catch! And, yes the pkix(7) is missing. From nobody Thu Dec 22 13:54:19 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDE951295FB; Thu, 22 Dec 2016 13:54:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IMuyUpo2qBqv; Thu, 22 Dec 2016 13:54:11 -0800 (PST) Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0126.outbound.protection.outlook.com [23.103.201.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 340641279EB; Thu, 22 Dec 2016 13:54:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=OYgFhPVG57dgYSzV2NUreqIeYvYIEAKxsyTZNxzEUfg=; b=2hIyzFf5ud0w1b2cNmjP7ObK4413PQNWxeq1yoKGJFXslaxBU48Y5M6HYIJcxL8rvsLfvS/NPcXe5rNIcwWeGnotqnPYGnZQrJZ86anGm9O7ioB329ZTYOU7w5H89y3F8+pT/HnUz133FvKpk3n6LkNax5Nb/hQnOFzvJAg1OBc= Received: from BL2PR09MB0996.namprd09.prod.outlook.com (10.167.102.15) by DM2PR09MB0445.namprd09.prod.outlook.com (10.161.252.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Thu, 22 Dec 2016 21:54:08 +0000 Received: from BL2PR09MB0996.namprd09.prod.outlook.com ([10.167.102.15]) by BL2PR09MB0996.namprd09.prod.outlook.com ([10.167.102.15]) with mapi id 15.01.0789.018; Thu, 22 Dec 2016 21:54:07 +0000 From: "Borchert, Oliver (Fed)" To: "Sriram, Kotikalapudi (Fed)" , sidr wg list Thread-Topic: Implementer inputs requested (Fw: SecDir Review of draft-ietf-sidr-bgpsec-protocol-20) Thread-Index: AQHSXHqyAyzM0B3CfkavQnhoYfx3Q6EULw0A Date: Thu, 22 Dec 2016 21:54:07 +0000 Message-ID: <71F0A322-DB63-4BD2-A07E-B162BE83AF34@nist.gov> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1d.0.161209 authentication-results: spf=none (sender IP is ) smtp.mailfrom=oliver.borchert@nist.gov; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [129.6.140.59] x-microsoft-exchange-diagnostics: 1; DM2PR09MB0445; 7:dnVJYUqf4UVWmpcU8TwcqNWxdmHVP5nUZEmnef4gfr9NuFgIsNKWH417HASeQYhDfXdPBmxAieFb/pvB0u98LIo9x81L08orBozQ2uSBOinh4hesj/eS609s0m3oaPM9m4pmpECBWJmzwW3o13DLGuAZkuxinn5OGawalwtaDi9YZuoj8A+zYb13ZmBHxhf8giyjuzVLSjgKVXrCi4h70oS+fnMwgu5Nsv6M++LRvuqyGIExtqXyRQfcIHflyEaw23kC7p5PoaQk6+0c9w6KBXKowytgN8hvdTF6y8ne5bvMq4HngSQdF2U6zy8kOODlVmJeuspaT62QHAsBaJwwTSgcGu4B6rs91nfhVmhgi6TFBuMsXvtV4KksYS6bf9gOywucUm6F52es+8GWRuVI0oFly8yWkKZdC+EHAugfjRvZNLc1Wdud2ybWLiDvZ2AQ09uu+NbWT2m5iVW8tm8Beg== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39840400002)(39860400002)(39850400002)(39450400003)(39410400002)(377454003)(189002)(199003)(5001770100001)(8936002)(33656002)(25786008)(77096006)(4001350100001)(5660300001)(81156014)(6506006)(6512006)(81166006)(6436002)(3280700002)(97736004)(2906002)(82746002)(83716003)(4326007)(92566002)(2900100001)(86362001)(83506001)(7736002)(99286002)(122556002)(189998001)(230783001)(229853002)(6116002)(3846002)(102836003)(38730400001)(101416001)(8676002)(54356999)(66066001)(6486002)(36756003)(3660700001)(2950100002)(106116001)(106356001)(105586002)(68736007)(76176999)(50986999)(104396002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0445; H:BL2PR09MB0996.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; x-ms-office365-filtering-correlation-id: ac0d9459-8eeb-4575-22f5-08d42ab50e00 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DM2PR09MB0445; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(65766998875637)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(6041248)(20161123564025)(20161123560025)(20161123555025)(20161123562025)(6072148); SRVR:DM2PR09MB0445; BCL:0; PCL:0; RULEID:; SRVR:DM2PR09MB0445; x-forefront-prvs: 01644DCF4A received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_71F0A322DB634BD2A07EB162BE83AF34nistgov_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Dec 2016 21:54:07.5357 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR09MB0445 Archived-At: Cc: "sidr-chairs@ietf.org" , Michael Baer Subject: Re: [sidr] Implementer inputs requested (Fw: SecDir Review of draft-ietf-sidr-bgpsec-protocol-20) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Dec 2016 21:54:15 -0000 --_000_71F0A322DB634BD2A07EB162BE83AF34nistgov_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U3JpcmFtLA0KcmVnYXJkaW5nIHRoZSBpbXBsZW1lbnRlciBpbnB1dCwgaGVyZSBhcmUgbXkgdGhv dWdodHM6DQoNClRvIGNvbW1lbnQgMToNCj09PT09PT09PT09PT09DQpJdCBpcyBub3QgdW5jb21t b24gdG8gaGF2ZSBhIGxlbmd0aCBmaWVsZCBub3QgaW5jbHVkZSBpdHMgb3duIHNpemUuIEFuIGV4 YW1wbGUNCmlzIHRoZSBsZW5ndGggZmllbGQgb2YgdGhlIGNhcGFiaWxpdGllcyB3aGljaCBkb2Vz IHNwZWNpZnkgdGhlIGxlbmd0aCAoc2l6ZSkgb2YgdGhlDQpmb2xsb3dpbmcgY2FwYWJpbGl0eSAo cGF5bG9hZCkuIEluIG91ciBjYXNlIHRoZSBsZW5ndGggZmllbGQgc3BlY2lmaWVzIHRoZSBsZW5n dGggKHNpemUpDQpvZiB0aGUgc2lnbmF0dXJlIGl0c2VsZiAocGF5bG9hZCkgYW5kIG5vdCB0aGUg dG90YWwgbGVuZ3RoIG9mIGFsbCB0aGUgc2lnbmF0dXJlDQpmaWVsZHMgKHNraSwgbGVuZ3RoLCBz aWduYXR1cmUpIGFzIGRvIHRoZSBvdGhlciBsZW5ndGggZmllbGRzLg0KSW4gYWRkaXRpb24sIGFk ZGluZyB0aGUgMiBieXRlcyBmb3IgdGhlIGZpZWxkIGl0c2VsZiwgd2lsbCBhZGQgbW9yZSBjb21w bGV4aXR5IHRvIHRoZQ0KcHJvY2Vzc2luZyByZWdhcmRpbmcgdGhlIGNyeXB0by4gQ3VycmVudGx5 IHdlIGNhbiB1c2UgdGhlIHZhbHVlIOKAnGFzIGlz4oCdIHdpdGhvdXQgYW55DQphZGRpdGlvbmFs IG1hdGggYXBwbHlpbmcgdG8gaXQgd2hpY2ggd2lsbCBjaGFuZ2Ugb25jZSB3ZSBpbmNsdWRlIHRo ZSAyIGJ5dGVzIGZvciB0aGUgZmllbGQgaXRzZWxmLg0KDQpTbywgSSBwcmVmZXIgdG8ga2VlcCBp dCBhcyBpcy4NCg0KVG8gY29tbWVudCAyOg0KPT09PT09PT09PT09PT0NCkkgZG8gbm90IGJlbGll dmUgdGhhdCBieSBzZW5kaW5nIDIgc2VwYXJhdGUgY2FwYWJpbGl0aWVzIHdlIHJlYWxseSDigJx3 YXN0ZeKAnSBhbnl0aGluZy4gVGhlIHJlYXNvbg0KaXMgdGhhdCBjb21wYXJlZCB0byB0aGUgb3Zl cmFsbCBCR1AgdHJhZmZpYywgYSBoYW5kZnVsIG9mIGJ5dGVzIGV4Y2hhbmdlZCBkdXJpbmcgdGhl IHNlc3Npb24NCmVzdGFibGlzaG1lbnQgZG9lc27igJl0IGRvIGFueSBoYXJtLg0KQnV0IG9uIGEg bW9yZSBzZXJpb3VzIG5vdGUsIGludHJvZHVjaW5nIGEgMi1iaXQgZW5jb2RpbmcgYWRkcyBhZGRp dGlvbmFsIGNvbXBsZXhpdHkuIFRoZSBwcm9wb3NlZA0KZW5jb2RpbmcgMDEg4oCTIDEwIOKAkyAx MSAob3IgMSwgMiwgMykgaXMgZmluZSBleGNlcHQgdGhhdCBpdCBsZWF2ZXMgb3V0IHR3byBhZGRp dGlvbmFsIHN0YWdlcy4NCiAgKEEpIHRoZSBlbmNvZGluZyAwMCBhbmQNCiAgKEIpIG5vIGNhcGFi aWxpdHkgc2VudCBhdCBhbGwuDQoNCkxvb2tpbmcgYXQgb3RoZXIgY2FwYWJpbGl0aWVzLCB0aGUg 4oCcbm9uLWV4aXN0ZW5jZeKAnSBvZiBhIGNhcGFiaWxpdHkgc3RhdGVzIG5vIHN1cHBvcnQuIE5v dyBieSBhZGRpbmcNCmFuIHVudXNlZCAwMCwgd2hhdCBkb2VzIHRoaXMgbWVhbj8gRG9lcyBpdCBt ZWFuIHdlIGRvbuKAmXQgc3VwcG9ydCB0aGUgY2FwYWJpbGl0eSB3aGljaCBtZWFucyB3ZSBoYXZl DQp0d28gZm9ybXMgb2Ygc2lnbmFsaW5nIG5vIHN1cHBvcnQ/IEFuZCBpZiBpdCBkb2VzIG5vdCBt ZWFuIHRoYXQsIGlzIGl0IGFuIGVycm9yIGluIHdoaWNoIHdlIG5lZWQgdG8gYWRkDQplcnJvciBo YW5kbGluZy4NCkkgdGhpbmsgdGhpcyBhZGRzIHVubmVjZXNzYXJ5IGNvbXBsZXhpdHkgdGhhdCB0 aGUgaW1wbGVtZW50ZXIgbXVzdCBjaGVjayBmb3IgMDAgYW5kIHRoZSBub24tZXhpc3RlbmNlDQph bmQgZGVhbCB3aXRoIHRoZW0gdGhlIHNhbWUgd2F5IG9yIGRpZmZlcmVudGx5Pw0KDQpUbyBrZWVw IGl0IHNpbXBsZSwgSSBwcmVmZXIgdG8ga2VlcCBpdCBhcyBpdCBpcywgdGhpcyB3YXkgd2UgZG8g bm90IGFkZCBhZGRpdGlvbmFsIGNvbmZ1c2lvbjoNCihJKSAgICAgICAgICAgICAgICAgIEFubm91 bmNlIHRoZSBwcm9wZXIgY2FwYWJpbGl0eSBpZiBzdXBwb3J0ZWQNCihJSSkgICAgICAgICAgICAg ICAgYW5kIGlmIG5vdCBzdXBwb3J0ZWQgZG9u4oCZdCBhbm5vdW5jZSB0aGUgY2FwYWJpbGl0eS4N Cg0KVGhpcyBpcyBzdHJhaWdodCBmb3J3YXJkIGFuZCBmYWxscyBpbiBsaW5lIHdpdGggb3RoZXIg Y2FwYWJpbGl0aWVzLiAoQXMgRXhhbXBsZSBNUE5MUkksIDQgQnl0ZSBBU04sIGV0Yy4pDQoNClRo YW5rcywNCg0KT2xpdmVyDQoNCg0KRnJvbTogS290aWthbGFwdWRpIFNyaXJhbSA8a290aWthbGFw dWRpLnNyaXJhbUBuaXN0Lmdvdj4NCkRhdGU6IFRodXJzZGF5LCBEZWNlbWJlciAyMiwgMjAxNiBh dCAxMjo0MSBQTQ0KVG86IHNpZHIgbGlzdCA8c2lkckBpZXRmLm9yZz4NCkNjOiBSdXNzIEhvdXNs ZXkgPGhvdXNsZXlAdmlnaWxzZWMuY29tPiwgImJhZXJtQHRpc2xhYnMuY29tIiA8YmFlcm1AdGlz bGFicy5jb20+LCBPbGl2ZXIgQm9yY2hlcnQgPG9saXZlci5ib3JjaGVydEBuaXN0Lmdvdj4sICJz aWRyLWNoYWlyc0BpZXRmLm9yZyIgPHNpZHItY2hhaXJzQGlldGYub3JnPg0KU3ViamVjdDogSW1w bGVtZW50ZXIgaW5wdXRzIHJlcXVlc3RlZCAoRnc6IFNlY0RpciBSZXZpZXcgb2YgZHJhZnQtaWV0 Zi1zaWRyLWJncHNlYy1wcm90b2NvbC0yMCkNCg0KDQpSdXNzIEhvdXNsZXkgaGFkIHN1Z2dlc3Rl ZCB0aGVzZSBjaGFuZ2VzICgjMSBhbmQgIzIgYmVsb3cpIGFzIHBhcnQgb2YgaGlzIFNlY0RpciBy ZXZpZXcuDQoNCkJ1dCBoZSBhbHNvIHN1Z2dlc3RlZCB0byBtZSB0byBwdXQgaXQgb3V0IG9uIHRo ZSBtYWlsaW5nIGxpc3Qgc28gdGhhdA0KDQppbXBsZW1lbnRlcnMgaW4gcGFydGljdWxhciBhbmQg YW55b25lIGhhdmluZyBhbiBvcGluaW9uIGNhbiBoYXZlIGEgc2F5Lg0KDQoNCg0KUnVzcydzIGNv bW1lbnQ6DQoNCk1pbm9yOg0KDQojMQ0KDQpJbiBTZWN0aW9uIDMuMiwgdGhlIFNpZ25hdHVyZSBM ZW5ndGggd2l0aGluIHRoZSBTaWduYXR1cmUgU2VnbWVudCBkb2VzDQoNCm5vdCBjb3VudCB0aGUg bGVuZ3RoIGZpZWxkIGl0c2VsZi4gIEl0IHNlZW1zIHRoYXQgYWxsIG9mIHRoZSBvdGhlcg0KDQps ZW5ndGggdmFsdWVzIGluIHRoaXMgc3BlY2lmaWNhdGlvbiBjb3VudCB0aGUgc2l6ZSBvZiB0aGUg bGVuZ3RoIHRvby4NCg0KQ29uc2lzdGVuY3kgd2lsbCBhdm9pZCBpbXBsZW1lbnRhdGlvbiBlcnJv cnMuDQoNClJ1c3MncyBjb21tZW50Og0KDQpNaW5vcjoNCg0KIzINCg0KU2VjdGlvbiAyLjEgc2F5 czoNCg0KICAgIC4uLiAgVGhlIEJHUCBzcGVha2VyDQoNCiAgICBzZXRzIHRoaXMgYml0IHRvIDAg dG8gaW5kaWNhdGUgdGhlIGNhcGFiaWxpdHkgdG8gcmVjZWl2ZSBCR1BzZWMNCg0KICAgIHVwZGF0 ZSBtZXNzYWdlcy4gIFRoZSBCR1Agc3BlYWtlciBzZXRzIHRoaXMgYml0IHRvIDEgdG8gaW5kaWNh dGUgdGhlDQoNCiAgICBjYXBhYmlsaXR5IHRvIHNlbmQgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcy4N Cg0KSXQgc2VlbXMgYSBiaXQgd2FzdGVmdWwgdG8gcmVwZWF0IHRoZSB3aG9sZSBjYXBhYmlsaXR5 IGZvciBlYWNoDQoNCmRpcmVjdGlvbi4gIFdvdWxkbid0IGl0IGJlIGJldHRlciB0byBmb2xsb3cg dGhlIGV4YW1wbGUgdXNlZCBpbg0KDQpvdGhlciBjYXBhYmlsaXR5IGRlZmluaXRpb25zIChzdWNo IGFzIFJGQyA3OTExKSBieSB1c2luZyBvbmUgb2YgdGhlDQoNCnVuYXNzaWduZWQgYml0cz8gIFRo ZSBTZW5kL1JlY2VpdmUgcGFpciBvZiBiaXRzIHdvdWxkIGhhdmUgdGhlc2UNCg0Kc2VtYW50aWNz Og0KDQogICAgVGhpcyBmaWVsZCBpbmRpY2F0ZXMgd2hldGhlciB0aGUgc2VuZGVyIGlzIChhKSBh YmxlIHRvIHJlY2VpdmUNCg0KICAgIEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMgZnJvbSBpdHMgcGVl ciAodmFsdWUgMSksIChiKSBhYmxlIHRvIHNlbmQNCg0KICAgIEJHUHNlYyB1cGRhdGUgbWVzc2Fn ZXMgdG8gaXRzIHBlZXIgKHZhbHVlIDIpLCBvciAoYykgYm90aCAodmFsdWUgMykNCg0KICAgIGZv ciB0aGUgYWRkcmVzcyBmYW1pbHkgaWRlbnRpZmllZCBpbiB0aGUgQUZJLg0KDQpbU3JpcmFtXSBP YnNlcnZhdGlvbjogVHdvIGltcGxlbWVudGF0aW9ucyBleGlzdCBhbmQNCg0KdGhleSB3ZXJlIHNo b3duIHRvIGludGVyb3BlcmF0ZSBhdCB0aGUgSUVURi05NyBpbiBTZW91bC4NCg0KVGhlIGNoYW5n ZXMgd291bGQgY2F1c2UgdGhvc2UgaW1wbGVtZW50YXRpb25zIHRvIG1ha2UgY29kZSBtb2RpZmlj YXRpb25zLg0KDQpTcmlyYW0NCg== --_000_71F0A322DB634BD2A07EB162BE83AF34nistgov_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHls ZS1wcmlvcml0eTo5OTsNCgljb2xvcjojOTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KcA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25h bC1yZXBseTsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bh bi5tc29JbnMNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6 IiI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBE ZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7 fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBp biAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rp b24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0i RU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRT ZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5TcmlyYW0sPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaSI+cmVnYXJkaW5nIHRoZSBpbXBsZW1lbnRlciBpbnB1dCwgaGVyZSBhcmUg bXkgdGhvdWdodHM6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VG8gY29tbWVudCAxOjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPj09PT09PT09PT09PT09PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SXQgaXMgbm90IHVuY29tbW9uIHRvIGhhdmUg YSBsZW5ndGggZmllbGQgbm90IGluY2x1ZGUgaXRzIG93biBzaXplLiBBbiBleGFtcGxlDQo8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5pcyB0aGUgbGVuZ3RoIGZpZWxkIG9m IHRoZSBjYXBhYmlsaXRpZXMgd2hpY2ggZG9lcyBzcGVjaWZ5IHRoZSBsZW5ndGggKHNpemUpIG9m IHRoZQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Zm9sbG93aW5nIGNh cGFiaWxpdHkgKHBheWxvYWQpLiBJbiBvdXIgY2FzZSB0aGUgbGVuZ3RoIGZpZWxkIHNwZWNpZmll cyB0aGUgbGVuZ3RoIChzaXplKQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+b2YgdGhlIHNpZ25hdHVyZSBpdHNlbGYgKHBheWxvYWQpIGFuZCBub3QgdGhlIHRvdGFsIGxl bmd0aCBvZiBhbGwgdGhlIHNpZ25hdHVyZQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaSI+ZmllbGRzIChza2ksIGxlbmd0aCwgc2lnbmF0dXJlKSBhcyBkbyB0aGUgb3RoZXIg bGVuZ3RoIGZpZWxkcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5JbiBh ZGRpdGlvbiwgYWRkaW5nIHRoZSAyIGJ5dGVzIGZvciB0aGUgZmllbGQgaXRzZWxmLCB3aWxsIGFk ZCBtb3JlIGNvbXBsZXhpdHkgdG8gdGhlDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj5wcm9jZXNzaW5nIHJlZ2FyZGluZyB0aGUgY3J5cHRvLiBDdXJyZW50bHkgd2UgY2Fu IHVzZSB0aGUgdmFsdWUg4oCcYXMgaXPigJ0gd2l0aG91dCBhbnkNCjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPmFkZGl0aW9uYWwgbWF0aCBhcHBseWluZyB0byBpdCB3aGlj aCB3aWxsIGNoYW5nZSBvbmNlIHdlIGluY2x1ZGUgdGhlIDIgYnl0ZXMgZm9yIHRoZSBmaWVsZCBp dHNlbGYuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+U28sIEkgcHJlZmVyIHRvIGtlZXAgaXQg YXMgaXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VG8gY29tbWVudCAyOjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPj09PT09PT09PT09PT09PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SSBkbyBub3QgYmVsaWV2ZSB0aGF0IGJ5IHNlbmRpbmcg MiBzZXBhcmF0ZSBjYXBhYmlsaXRpZXMgd2UgcmVhbGx5IOKAnHdhc3Rl4oCdIGFueXRoaW5nLiBU aGUgcmVhc29uDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5pcyB0aGF0 IGNvbXBhcmVkIHRvIHRoZSBvdmVyYWxsIEJHUCB0cmFmZmljLCBhIGhhbmRmdWwgb2YgYnl0ZXMg ZXhjaGFuZ2VkIGR1cmluZyB0aGUgc2Vzc2lvbg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6Q2FsaWJyaSI+ZXN0YWJsaXNobWVudCBkb2VzbuKAmXQgZG8gYW55IGhhcm0uPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+QnV0IG9uIGEgbW9yZSBzZXJpb3VzIG5vdGUs IGludHJvZHVjaW5nIGEgMi1iaXQgZW5jb2RpbmcgYWRkcyBhZGRpdGlvbmFsIGNvbXBsZXhpdHku IFRoZSBwcm9wb3NlZA0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+ZW5j b2RpbmcgMDEg4oCTIDEwIOKAkyAxMSAob3IgMSwgMiwgMykgaXMgZmluZSBleGNlcHQgdGhhdCBp dCBsZWF2ZXMgb3V0IHR3byBhZGRpdGlvbmFsIHN0YWdlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj4mbmJzcDsmbmJzcDsoQSkgdGhlIGVuY29kaW5nIDAwIGFuZDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOyZuYnNwOyhCKSBubyBjYXBh YmlsaXR5IHNlbnQgYXQgYWxsLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkxvb2tpbmcgYXQg b3RoZXIgY2FwYWJpbGl0aWVzLCB0aGUg4oCcbm9uLWV4aXN0ZW5jZeKAnSBvZiBhIGNhcGFiaWxp dHkgc3RhdGVzIG5vIHN1cHBvcnQuIE5vdyBieSBhZGRpbmcNCjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPmFuIHVudXNlZCAwMCwgd2hhdCBkb2VzIHRoaXMgbWVhbj8gRG9l cyBpdCBtZWFuIHdlIGRvbuKAmXQgc3VwcG9ydCB0aGUgY2FwYWJpbGl0eSB3aGljaCBtZWFucyB3 ZSBoYXZlDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj50d28gZm9ybXMg b2Ygc2lnbmFsaW5nIG5vIHN1cHBvcnQ/IEFuZCBpZiBpdCBkb2VzIG5vdCBtZWFuIHRoYXQsIGlz IGl0IGFuIGVycm9yIGluIHdoaWNoIHdlIG5lZWQgdG8gYWRkDQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpDYWxpYnJpIj5lcnJvciBoYW5kbGluZy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj5JIHRoaW5rIHRoaXMgYWRkcyB1bm5lY2Vzc2FyeSBjb21wbGV4aXR5 IHRoYXQgdGhlIGltcGxlbWVudGVyIG11c3QgY2hlY2sgZm9yIDAwIGFuZCB0aGUgbm9uLWV4aXN0 ZW5jZQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+YW5kIGRlYWwgd2l0 aCB0aGVtIHRoZSBzYW1lIHdheSBvciBkaWZmZXJlbnRseT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj5UbyBrZWVwIGl0IHNpbXBsZSwgSSBwcmVmZXIgdG8ga2VlcCBpdCBhcyBpdCBpcywgdGhp cyB3YXkgd2UgZG8gbm90IGFkZCBhZGRpdGlvbmFsIGNvbmZ1c2lvbjo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj4oSSkmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgQW5ub3VuY2UgdGhlIHByb3BlciBjYXBhYmlsaXR5IGlmIHN1cHBvcnRl ZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPihJSSkmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgYW5kIGlmIG5vdCBzdXBwb3J0ZWQgZG9u4oCZdCBhbm5vdW5j ZSB0aGUgY2FwYWJpbGl0eS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4m bmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5UaGlzIGlzIHN0cmFp Z2h0IGZvcndhcmQgYW5kIGZhbGxzIGluIGxpbmUgd2l0aCBvdGhlciBjYXBhYmlsaXRpZXMuIChB cyBFeGFtcGxlIE1QTkxSSSwgNCBCeXRlIEFTTiwgZXRjLik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj5UaGFua3MsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7 PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+T2xpdmVyPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQg MGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5Gcm9t Og0KPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFj ayI+S290aWthbGFwdWRpIFNyaXJhbSAmbHQ7a290aWthbGFwdWRpLnNyaXJhbUBuaXN0LmdvdiZn dDs8YnI+DQo8Yj5EYXRlOiA8L2I+VGh1cnNkYXksIERlY2VtYmVyIDIyLCAyMDE2IGF0IDEyOjQx IFBNPGJyPg0KPGI+VG86IDwvYj5zaWRyIGxpc3QgJmx0O3NpZHJAaWV0Zi5vcmcmZ3Q7PGJyPg0K PGI+Q2M6IDwvYj5SdXNzIEhvdXNsZXkgJmx0O2hvdXNsZXlAdmlnaWxzZWMuY29tJmd0OywgJnF1 b3Q7YmFlcm1AdGlzbGFicy5jb20mcXVvdDsgJmx0O2JhZXJtQHRpc2xhYnMuY29tJmd0OywgT2xp dmVyIEJvcmNoZXJ0ICZsdDtvbGl2ZXIuYm9yY2hlcnRAbmlzdC5nb3YmZ3Q7LCAmcXVvdDtzaWRy LWNoYWlyc0BpZXRmLm9yZyZxdW90OyAmbHQ7c2lkci1jaGFpcnNAaWV0Zi5vcmcmZ3Q7PGJyPg0K PGI+U3ViamVjdDogPC9iPkltcGxlbWVudGVyIGlucHV0cyByZXF1ZXN0ZWQgKEZ3OiBTZWNEaXIg UmV2aWV3IG9mIGRyYWZ0LWlldGYtc2lkci1iZ3BzZWMtcHJvdG9jb2wtMjApPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJk aXZ0YWdkZWZhdWx0d3JhcHBlciI+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPlJ1c3MgSG91c2xleSBoYWQg c3VnZ2VzdGVkIHRoZXNlIGNoYW5nZXMgKCMxIGFuZCAjMiBiZWxvdykgYXMgcGFydCBvZiBoaXMg U2VjRGlyIHJldmlldy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPkJ1 dCBoZSBhbHNvIHN1Z2dlc3RlZCB0byBtZSB0byBwdXQgaXQgb3V0IG9uIHRoZSBtYWlsaW5nIGxp c3Qgc28gdGhhdA0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5pbXBs ZW1lbnRlcnMgaW4gcGFydGljdWxhciBhbmQgYW55b25lIGhhdmluZyBhbiBvcGluaW9uIGNhbiBo YXZlIGEgc2F5Lg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPlJ1c3MncyBjb21tZW50 OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+TWlub3I6PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj4jMTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2Fs aWJyaTtjb2xvcjpibGFjayI+SW4gU2VjdGlvbiAzLjIsIHRoZSBTaWduYXR1cmUgTGVuZ3RoIHdp dGhpbiB0aGUgU2lnbmF0dXJlIFNlZ21lbnQgZG9lczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJy aTtjb2xvcjpibGFjayI+bm90IGNvdW50IHRoZSBsZW5ndGggZmllbGQgaXRzZWxmLiZuYnNwOyBJ dCBzZWVtcyB0aGF0IGFsbCBvZiB0aGUgb3RoZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7 Y29sb3I6YmxhY2siPmxlbmd0aCB2YWx1ZXMgaW4gdGhpcyBzcGVjaWZpY2F0aW9uIGNvdW50IHRo ZSBzaXplIG9mIHRoZSBsZW5ndGggdG9vLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xv cjpibGFjayI+Q29uc2lzdGVuY3kgd2lsbCBhdm9pZCBpbXBsZW1lbnRhdGlvbiBlcnJvcnMuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5SdXNzJ3MgY29tbWVudDo8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPk1pbm9yOjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+IzI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7 Y29sb3I6YmxhY2siPlNlY3Rpb24gMi4xIHNheXM6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJp O2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsgLi4uJm5ic3A7IFRoZSBCR1Agc3BlYWtl cjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7Jm5i c3A7IHNldHMgdGhpcyBiaXQgdG8gMCB0byBpbmRpY2F0ZSB0aGUgY2FwYWJpbGl0eSB0byByZWNl aXZlIEJHUHNlYzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHVwZGF0ZSBtZXNzYWdlcy4mbmJzcDsgVGhlIEJHUCBzcGVha2VyIHNldHMg dGhpcyBiaXQgdG8gMSB0byBpbmRpY2F0ZSB0aGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7 Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyZuYnNwOyBjYXBhYmlsaXR5IHRvIHNlbmQgQkdQc2Vj IHVwZGF0ZSBtZXNzYWdlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2si Pkl0IHNlZW1zIGEgYml0IHdhc3RlZnVsIHRvIHJlcGVhdCB0aGUgd2hvbGUgY2FwYWJpbGl0eSBm b3IgZWFjaDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+ZGlyZWN0aW9u LiZuYnNwOyBXb3VsZG4ndCBpdCBiZSBiZXR0ZXIgdG8gZm9sbG93IHRoZSBleGFtcGxlIHVzZWQg aW48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPm90aGVyIGNhcGFiaWxp dHkgZGVmaW5pdGlvbnMgKHN1Y2ggYXMgUkZDIDc5MTEpIGJ5IHVzaW5nIG9uZSBvZiB0aGU8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPnVuYXNzaWduZWQgYml0cz8mbmJz cDsgVGhlIFNlbmQvUmVjZWl2ZSBwYWlyIG9mIGJpdHMgd291bGQgaGF2ZSB0aGVzZTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+c2VtYW50aWNzOjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IFRoaXMgZmllbGQg aW5kaWNhdGVzIHdoZXRoZXIgdGhlIHNlbmRlciBpcyAoYSkgYWJsZSB0byByZWNlaXZlPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsgQkdQ c2VjIHVwZGF0ZSBtZXNzYWdlcyBmcm9tIGl0cyBwZWVyICh2YWx1ZSAxKSwgKGIpIGFibGUgdG8g c2VuZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7IEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMgdG8gaXRzIHBlZXIgKHZhbHVlIDIpLCBvciAo YykgYm90aCAodmFsdWUgMyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2si PiZuYnNwOyZuYnNwOyZuYnNwOyBmb3IgdGhlIGFkZHJlc3MgZmFtaWx5IGlkZW50aWZpZWQgaW4g dGhlIEFGSS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPltTcmlyYW1d IE9ic2VydmF0aW9uOiBUd28gaW1wbGVtZW50YXRpb25zIGV4aXN0IGFuZA0KPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj50aGV5IHdlcmUgc2hvd24gdG8gaW50ZXJvcGVy YXRlIGF0IHRoZSBJRVRGLTk3IGluIFNlb3VsLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtj b2xvcjpibGFjayI+VGhlIGNoYW5nZXMgd291bGQgY2F1c2UgdGhvc2UgaW1wbGVtZW50YXRpb25z IHRvIG1ha2UgY29kZSBtb2RpZmljYXRpb25zLiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2Fs aWJyaTtjb2xvcjpibGFjayI+U3JpcmFtPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_71F0A322DB634BD2A07EB162BE83AF34nistgov_-- From nobody Fri Dec 23 15:53:43 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 218CE1295B0; Fri, 23 Dec 2016 15:53:37 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.40.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148253721713.16750.15627388169076790432.idtracker@ietfa.amsl.com> Date: Fri, 23 Dec 2016 15:53:37 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-protocol-21.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Dec 2016 23:53:37 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing of the IETF. Title : BGPsec Protocol Specification Authors : Matthew Lepinski Kotikalapudi Sriram Filename : draft-ietf-sidr-bgpsec-protocol-21.txt Pages : 41 Date : 2016-12-23 Abstract: This document describes BGPsec, an extension to the Border Gateway Protocol (BGP) that provides security for the path of autonomous systems (ASes) through which a BGP update message passes. BGPsec is implemented via an optional non-transitive BGP path attribute that carries digital signatures produced by each autonomous system that propagates the update message. The digital signatures provide confidence that every AS on the path of ASes listed in the update message has explicitly authorized the advertisement of the route. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-protocol/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-protocol-21 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-bgpsec-protocol-21 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Dec 23 16:33:54 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A459129518; Fri, 23 Dec 2016 16:33:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IoGXs0dUwiHI; Fri, 23 Dec 2016 16:33:51 -0800 (PST) Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0100.outbound.protection.outlook.com [23.103.200.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0155612942F; Fri, 23 Dec 2016 16:33:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=HJRh+pOYiHqHui9XiiS3j63nhIYi8jG3bCCSlS8U5pE=; b=KxLdFpedxdE2bJq/U6ipUQyKciTkDAlw5gljW/dxlWvwVIcCK3vKi24t5M2LcjJgvIR9gKwJiBz6rp2zk9IIFX2Np+lI2Gb5M1ngA3dwwGetG8Iw5qVI0jfw4yblR++nF5QRYHvZEjf0lOdhscGxdhXVNwU1el5KfqRogoORZG0= Received: from DM2PR09MB0446.namprd09.prod.outlook.com (10.161.252.145) by DM2PR09MB0446.namprd09.prod.outlook.com (10.161.252.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Sat, 24 Dec 2016 00:33:49 +0000 Received: from DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) by DM2PR09MB0446.namprd09.prod.outlook.com ([10.161.252.145]) with mapi id 15.01.0789.021; Sat, 24 Dec 2016 00:33:49 +0000 From: "Sriram, Kotikalapudi (Fed)" To: sidr wg list Thread-Topic: New Version Notification for draft-ietf-sidr-bgpsec-protocol-21.txt Thread-Index: AQHSXXfMpVms2hVh00WVwq4SMvHc56EWN6Af Date: Sat, 24 Dec 2016 00:33:49 +0000 Message-ID: References: <148253721729.16750.2302111025562983417.idtracker@ietfa.amsl.com> In-Reply-To: <148253721729.16750.2302111025562983417.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=kotikalapudi.sriram@nist.gov; x-originating-ip: [129.6.222.179] x-ms-office365-filtering-correlation-id: 2bdb7d68-afa3-49d4-7171-08d42b948766 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DM2PR09MB0446; x-microsoft-exchange-diagnostics: 1; DM2PR09MB0446; 7:0egNP9LstHH3fKBw27wpO06eh5OLTt500gkPADrT4a22ha0czLyDueEaAN+Ek/RA6BgkEfxu1aj8h7W4eL5b7IlISJzMm7ZVo5UQEEAPSamsSkTZk6iLhRlqCug3ClI8ynY/mgEK+rqOPKB1qaNMTTy+JWNaeNgnM+XhsP2K9+kVemBYXSbAOOhrsvUyxsgmitveLPTy2D6Oy5k2tiPw7Z02xOPbVJwltZLIuRc0A3V2KBbSxTXTgOifgr1GYhX3ha7G0q4Ohl2hJscrquMxmGblyTurbZ3paMUKLX/EPU7PAEbUDQh1DSLhnW60KnAjV0veuRAOiypo3VeBv/oUPLZTfFDQqZBp+CUxIGzSjqvKtmtNziRBSk4HWMS6hiy0PUKofX8lVTIn/JnH2+Y+DY7oSUrVM4/xFYvI0BjRTwiOU3D2DQXLo1a/iMdMjI6tNnCzHMgfKGmXVJ7xoRk18w== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(120809045254105)(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123564025)(20161123562025)(20161123555025)(20161123558021)(20161123560025)(6072148); SRVR:DM2PR09MB0446; BCL:0; PCL:0; RULEID:; SRVR:DM2PR09MB0446; x-forefront-prvs: 0166B75B74 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39410400002)(39840400002)(39850400002)(39860400002)(39450400003)(189002)(199003)(66654002)(377424004)(377454003)(189998001)(4001150100001)(305945005)(106356001)(106116001)(2900100001)(92566002)(105586002)(74316002)(97736004)(9686002)(99286002)(230783001)(3280700002)(3846002)(6116002)(4326007)(2906002)(8936002)(102836003)(3660700001)(101416001)(6436002)(15650500001)(229853002)(76576001)(38730400001)(33656002)(39060400001)(66066001)(5660300001)(77096006)(50986999)(86362001)(110136003)(6506006)(122556002)(7736002)(8676002)(25786008)(68736007)(3900700001)(54356999)(76176999)(6916009)(2950100002)(81156014)(81166006)(7696004); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0446; H:DM2PR09MB0446.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Dec 2016 00:33:49.0102 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR09MB0446 Archived-At: Cc: "sidr-chairs@ietf.org" , Nevil Brownlee , Matthias Waehlisch Subject: Re: [sidr] New Version Notification for draft-ietf-sidr-bgpsec-protocol-21.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Dec 2016 00:33:53 -0000 This new version incorporates all (except two minor) comments received during the IETF LC review process from Alvaro, SECDIR/Gen-ART (Russ Housle= y), and OPSDIR (Nevil Brownlee). The two minor comments not addressed yet are from Russ, and are pending feedback from WG members (particularly implementers). These have to do with minor tweaks to the BGPsec update format structure. Many thanks to Alvaro, Russ, and Nevil for the detailed reviews and comment= s/suggestions. Sriram ________________________________________ From: internet-drafts@ietf.org Sent: Friday, December 23, 2016 6:53 PM To: Matthew Lepinski; Sriram, Kotikalapudi (Fed) Subject: New Version Notification for draft-ietf-sidr-bgpsec-protocol-21.tx= t A new version of I-D, draft-ietf-sidr-bgpsec-protocol-21.txt has been successfully submitted by Kotikalapudi Sriram and posted to the IETF repository. Name: draft-ietf-sidr-bgpsec-protocol Revision: 21 Title: BGPsec Protocol Specification Document date: 2016-12-23 Group: sidr Pages: 41 URL: https://www.ietf.org/internet-drafts/draft-ietf-sidr-bgpsec= -protocol-21.txt Status: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-pro= tocol/ Htmlized: https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-protocol= -21 Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-bgpsec-= protocol-21 Abstract: This document describes BGPsec, an extension to the Border Gateway Protocol (BGP) that provides security for the path of autonomous systems (ASes) through which a BGP update message passes. BGPsec is implemented via an optional non-transitive BGP path attribute that carries digital signatures produced by each autonomous system that propagates the update message. The digital signatures provide confidence that every AS on the path of ASes listed in the update message has explicitly authorized the advertisement of the route. Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat From nobody Wed Dec 28 03:03:52 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4938D1294BC; Wed, 28 Dec 2016 03:03:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l6RrOz8GLrQK; Wed, 28 Dec 2016 03:03:47 -0800 (PST) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30126.outbound.protection.outlook.com [40.107.3.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A2C61294A3; Wed, 28 Dec 2016 03:03:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector1-btconnect-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=xPEPx9vcbtZEswwcOQbacpVW8pDUdpNLKhZqKdbFATI=; b=UoTPY+UCspMGInu2dJuv6xUAa5GmWb1pyUqHUAwAChoyAFgDKuJTi/EzjRO6l4iHdhFwwxgHiLxaI1hEeoDSqBAATvyuAZ+TjfRMzZjubRwgrUEd4wKRj8W/d/w4Jzfn+D4UyL8J+ObocZ7PrxERPeWlkvORSoTl0kOxRJ0i6zI= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=daedulus@btconnect.com; Received: from pc6 (81.135.210.62) by DB5PR07MB1560.eurprd07.prod.outlook.com (10.165.212.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.817.5; Wed, 28 Dec 2016 11:03:44 +0000 Message-ID: <01f101d260f9$dee15c00$4001a8c0@gateway.2wire.net> From: tom p. To: References: <148226796672.23778.11324483834700038816.idtracker@ietfa.amsl.com> Date: Wed, 28 Dec 2016 10:55:15 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Originating-IP: [81.135.210.62] X-ClientProxiedBy: DB5PR08CA0047.eurprd08.prod.outlook.com (10.166.166.143) To DB5PR07MB1560.eurprd07.prod.outlook.com (10.165.212.138) X-MS-Office365-Filtering-Correlation-Id: c39449dc-cdfd-42d5-f5b6-08d42f11311f X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DB5PR07MB1560; X-Microsoft-Exchange-Diagnostics: 1; DB5PR07MB1560; 3:CvS7yvuugTGBsbxHWfFv9c5UH9fiVyWqe5bEA8/L1hEeQfD0kJptkAeQGX+PRMjYEUzfBy9q3skzZ9y2JoJHwxLmdr93yY+zqGoCcoMLNakMSTwKTm0EF4j5PAhdHsWrzlkAy55V1psdjh/i+H0QXG5URP9M2fVjYRhgGac1lJmRR/zh0UpTFx7pmkkByH6G886dtCBAyt/dft6+Uqksy61efVxi2/HEpCZxJa4GLP4am4lpzT8UXmKDL8dH8EU1kvxlOQ8ryLGOsE8skzViZw==; 25:rfG/tfTZgAPkh+K76KEGgeWJrYyZcEFCCy/3upiWP0isspNEvgCcW54p3GXKblMx7mnclN8fx6AnQcE4p4oRluxSNMQwJcJeGW6tYGkmunNFMvqWCpn65NPfwtGZPpkw41gqy1dywWZqPyQZYOCj3Ons0i2MsYGWY5OkAa93pcFsRLN5zKbA5epIOcndyMJVTxxSTUBbkPfYXTsXiE1ymhUnIXXhIPxAXG8F7X8pcJH+lz0e8iyzVWfDOjwIfm5208XBvRS1Jz7LQiFkKClOjxj/TONUKVPDASFZRDfl5fiIjhRfuOgHNX2h1ZR6HxOXLetl3nObA9kOk+W6sPYnCxETEx6U4sHT4T1Npmh1PE6QmrBuuijGCr1j3J8NC+bUemmo/rT1clamsDwXC5b/8Sylfhzyv+NOQFgtrrF4JXFNAo1QBJwKK9rJD/vYNz9TybUUkYqaw4OlFeNs7I+gEA== X-Microsoft-Exchange-Diagnostics: 1; DB5PR07MB1560; 31:8J2LFa/f/LCO3LHzOemIEz1Cllcdn2ZRzq5HJ6dVBjyIvZGd6Vj8mLNJEW2R4iHVatDSTdzcEKlDcIbPR9IwnE1DfvcNIOTX5VAc4/es76vr/rSaVrIDcV6InktPfnmM2kEMn/h4q8pd9sK5Ys4ATeuHyV88rSpa1e1BMr9jEctkXubSs5HVFvvxxbWK7sSgqrMd3D420keLtcwfN7q9xSE3iYPj3dh/qmV8oL4BYRIVGFyjAX6RayXrBKVme8FROcVvQt4N2OBfRzBFBlKKmw==; 4:gDCmiOnSVoUFcq9qFTtLz39H2yQgnhqGYweysgMpS+JhHWoLFanvGhJEsQP0UgyfE4dLmyqVEeP4UIG8ktE/exciJBP08wITmMP2VxSay2Po7dE6lFXN0QNwMLf8LTFusZNo+Gev+uSFly4V9r6NggnBzTQQA503plv6HmJ6bnq64udSb96gZVj6K89oPvHCNaOx7QgQ2CAZgwyMilYX9rlJifIzRY0IoCTUWwthmNdbvfCiII+GaljvcxIR0ZXyNbASpkZ3brXHzZoJab0fbYkuFEHCU0FiHxzDb0aBc/e+Lj68Jw79fWF1r2gVrG2/9ehqK38lBPJDfGOMf6T3ZuRc0MPFuRJq1R46vcfTqKs88HRhFXWCTG/k+kfeNJpLOSiUQhrRhxYf3P0K/Ue3N6srSkNPiVWaq7yZ2kYfwQqNRlDq/wSXCjtjB2wuLABazVj5m/h6dSEa4IQknfDSk3Wsgwkj7NfXvgLSVAnc5M6N8j4vCxqSRbZfdlNP8m4xWoovWvH2E4TAUSIjba3mQTmk4NH83BERRcVyAy5ZPf/mZrcYR0ADvoBSU6BGs4+mRTiv8+v6D2Jnft4IW/vNNEtj18EwMuM8lqxw37BBUwoRUZ0DmpFNxWRCywi50Dy4 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(120809045254105); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123564025)(20161123562025)(20161123555025)(20161123560025)(6072148); SRVR:DB5PR07MB1560; BCL:0; PCL:0; RULEID:; SRVR:DB5PR07MB1560; X-Forefront-PRVS: 0170DAF08C X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(6009001)(7916002)(39450400003)(377454003)(189002)(13464003)(199003)(106356001)(68736007)(62236002)(44716002)(97736004)(229853002)(14496001)(50226002)(5660300001)(47776003)(1456003)(4720700003)(189998001)(33646002)(6916009)(6666003)(9686002)(105586002)(25786008)(7736002)(23756003)(230783001)(38730400001)(6496003)(92566002)(6486002)(44736005)(116806002)(76176999)(50466002)(2351001)(305945005)(61296003)(110136003)(84392002)(81686999)(4326007)(3846002)(6116002)(81816999)(42186005)(101416001)(81166006)(81156014)(50986999)(66066001)(8676002)(2906002)(230700001)(86362001)(1556002)(74416001)(7726001); DIR:OUT; SFP:1102; SCL:1; SRVR:DB5PR07MB1560; H:pc6; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:0; LANG:en; Received-SPF: None (protection.outlook.com: btconnect.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; DB5PR07MB1560; 23:gm5WQlNqfle/QwYE/L4IVlct3PEIZMQRaz42ETQ?= =?iso-8859-1?Q?7UXKzj2uEAQdp9nsobblsjLgo8BAPte79Q/kiL0ehGrJ6QrbrJUK6/B084?= =?iso-8859-1?Q?fCDe4zyUbWrEQDf1R4wBuZkK8SJ7YZgkTw5TUNCwgKpbZkMY8reIxyvXxP?= =?iso-8859-1?Q?u07kWKH+PnA6WLvJgp4IyJBttTVMskG5RXwnp2LTlSwnKOYFJ6txhsuyo4?= =?iso-8859-1?Q?J8oyAzngmjIn0NTlZV+CpQFE6v9JmZgoQAPfFFgDjDYX5oQRA83gPuuTG2?= =?iso-8859-1?Q?2btZ2MtcZFutIg6idxM9JRaX7fFMeiueCkUII4u04DH1T8BiG4N8R77uEH?= =?iso-8859-1?Q?AY0rBpQy3KIJAbubYsI6WB/ry9Vbb16xuCSOgiwUdToxtD3eqZppUCMisl?= =?iso-8859-1?Q?xQQBQCLGHAeNgQzPzxLI0fxbPQGay49gcKnXq5QmDHYm+5qbFcnI96A0uW?= =?iso-8859-1?Q?wfMHbu0MQQ/nNjxgDW7r1RmLOPM+mzZv7h7Lt3hPcKcOQdw9A7BktxzCT0?= =?iso-8859-1?Q?UmCM/6Mi1QfMdxKGtq1hoiw7gohZhpDV4S7WMnHCt0xL+vCH6tew21aRY9?= =?iso-8859-1?Q?kbYeaksHrVJQulMTUmtfA8iUTOgq4GalY9qLcMRZvtUPD/bjeIDLLo97yC?= =?iso-8859-1?Q?7exphHyyZVRnoqJzLb/5fbiQjIW+NariapqL0Z5kTCYe7I3Pm6NKtqAb4P?= =?iso-8859-1?Q?Wmcd/6HwqFvL3hUY0DcDr1/qV9FkaYhARyOm51Ad3fXpSOpm5cib+cRdHC?= =?iso-8859-1?Q?WlFft0UvdvWCuMhqpG5K1RVJoNaym7MZaRW2/Iq3xxBcWE7RtqewaQE24h?= =?iso-8859-1?Q?Ljf4YSxY0OnHNbwsb+1IcNBg7HvfR6NcL2OvGinPkmSNiv3tq76vboy4JA?= =?iso-8859-1?Q?qWBOZg3VYTzdJzDpIW9lGelFSYMU+3jeTZO1NRoalji2JpBXlA9tgtD51/?= =?iso-8859-1?Q?fpBXsC9Pa4l6iM6ud1mz5WN0bDkzCwh+6OXlmxKOmJEEkbDlPtGW1XkXNb?= =?iso-8859-1?Q?D1RTkHe4/RiIuh6DWRU46/a8sF/isxJyOp9BbH6rjjYm8N6uuUyuLZOTrD?= =?iso-8859-1?Q?0JqrP3m49SNaFwB7pK7WkiD7de/+iw7QRcfXqI9kJdHZWdUPWp1iZcKoo6?= =?iso-8859-1?Q?bCzBcS2hpwfYjQSxF06+YLo6p1zNRiCh5vj/SEhza5HfmSbbcnsivhIh6r?= =?iso-8859-1?Q?RSoO2lMEeXamTFTLs9hBcIRiXlmLtwf4km3W4UJ3hdCXdumdJooySKwIT1?= =?iso-8859-1?Q?0QLFNst8MzWf5CCrwc/FWshK4jahJhYTuHDnDs6BAvr7KVH/2zFvgVyffo?= =?iso-8859-1?Q?3kU64c/ETo/9glOS1OqHdDJVqqbXO5Zs/IDuWTOJM+5aZE876LmfTONWg9?= =?iso-8859-1?Q?tlzXu5NZuZaD+joqlx30Nfwu0D5HGDhs73WLA17jiAasSnd+k1AyyrAPry?= =?iso-8859-1?Q?5aMarhRZcuY1d324YDSwbhMsn3PhH0QBzuZFVC6ZQtOyrvZHyNEup0tDw?= =?iso-8859-1?Q?=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; DB5PR07MB1560; 6:k31vVEEZ5a7L6WYGmP6n6tNvUufhUk3uPl4LBq7LZnJBIsuMwwsF+/RMg7W0yZ0BGZVmmHyZnAK8b5m9S7r2I95+K5OIRQS1wMSATGI14huUIZpNOX3wdSakmE9acyaBGA2dHW3EkEbpg3l5gUmERxkgeGjK60/FaXuzE/HG0+MVV1H13JD7p303LEUyFeAqNjXSlwiyZGex/N12svMi6+o/2TzegqNQaM5mWznJxGfIPT+aI/q41OBE9ogTErSQ6inAVMaCbo3xAFWxO8BIeo1mxHxSqjsiq/lUaGBhR42KSYkQkTzryzEiP09c8JB14klO68igHwbbW21VfjxsMV7IubrOpbzILOVN6idEaC9NzP+SeEB8Z4QOz10ZfUWD8fWwUdJl4A/swqVjIojgmjeiDMBwSgYp2RKYyhrJoHA=; 5:ovPxfH+KjrL3EqIdXD+8+EEm9KHIK5xJ9KzDCPHUv151LwcsT7UF242CKzs0neUR98yzvVi4ZimBeQUpHNmKVEgpxpMyIKjeSTv/3898xjIY+eGNIbBw7lVGDP71WhWZQ27Iu5ho+/RM6OmKF8mBRgH/OHph+EiIxl85kowITu4=; 24:GLu8VR0O8otdHu5YKtqBC8WIiqFfVfC4x9WwTNpPE/mrjnt1DfeU2G43YKpTD+rB1QuzM3o864iqAP05sEOhU5JEJO7xTKHX4DQrzX/X/fI= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; DB5PR07MB1560; 7:4gHBNC6W8fjHd3IOfrTgz95+ClsF9InpVfwjxRvRSr/r44jYNlw9q4Ju4t8VZWWJc/IOPHZR8tiDszqLhyyJep8rtGAzfd5RLDcixXwEdI2Y1Kg1niBsjjdpSa8/SDoi4g5bpeNaQ5BGiFTT4jKx8IzBkXgha9y36nnqaz4kqzFjQpUWRUSROaVazQO+u/mLPyr5BFI5cIpNzP7S2PiiwmdVqDOpV9XY6FlAVHYvMnojRsdIPCk+W2RRZmaHJ1T3lkLvO2fbSR6t+wZW9pk5DbL3dmoU2L33iRMpPB0skw/vxaKNk7u87y7boHrN3WX8SpmhLhfYBP2UyjZbhGNIPgSbVlw1aH9Mik5ZDchVMSJnJzUGPXfMGc9d8Hp051VnwweGGwkrNOIKzqtD8vejiJVxLyK735FZm7rox4M9S5ISFTJMkI2Ks9Y5Bh001OFh3LpbLFDmuBqUJLdg1IH33w== X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2016 11:03:44.7487 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5PR07MB1560 Archived-At: Cc: Chris Morrow , sidr-chairs@ietf.org, draft-ietf-sidr-rpki-oob-setup@ietf.org, sidr@ietf.org Subject: Re: [sidr] Last Call: (An Out-Of-Band Setup Protocol For RPKI Production Services) to Proposed Standard X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Dec 2016 11:03:50 -0000 When I saw BPKI in the Abstract, I thought 'typo'! Reading on, it isn't; in which case, it needs expanding in the Abstract. Appendix A is in RelaxNG; I would like a reference for that language. Is Appendix A Normative? i.e. in the event of a mismatch between the body of the I-D and Appendix A, which wins? If Appendix A, then that reference should be Normative. Tom Petch ----- Original Message ----- From: "The IESG" To: "IETF-Announce" Cc: "Chris Morrow" ; ; ; Sent: Tuesday, December 20, 2016 9:06 PM > > The IESG has received a request from the Secure Inter-Domain Routing WG > (sidr) to consider the following document: > - 'An Out-Of-Band Setup Protocol For RPKI Production Services' > as Proposed Standard > > The IESG plans to make a decision in the next few weeks, and solicits > final comments on this action. Please send substantive comments to the > ietf@ietf.org mailing lists by 2017-01-10. Exceptionally, comments may be > sent to iesg@ietf.org instead. In either case, please retain the > beginning of the Subject line to allow automated sorting. > > Abstract > > This note describes a simple out-of-band protocol to ease setup of > the RPKI provisioning and publication protocols between two parties. > The protocol is encoded in a small number of XML messages, which can > be passed back and forth by any mutually agreeable secure means. > > This setup protocol is not part of the provisioning or publication > protocol, rather, it is intended to simplify configuration of these > protocols by setting up relationships and exchanging BPKI keying > material. > > The file can be obtained via > https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-oob-setup/ > > IESG discussion can be tracked via > https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-oob-setup/ballot/ > > > No IPR declarations have been submitted directly on this I-D. > From nobody Wed Dec 28 08:43:33 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3668512961A; Wed, 28 Dec 2016 08:43:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10 X-Spam-Level: X-Spam-Status: No, score=-10 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-3.1] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pqFrlVTwutB8; Wed, 28 Dec 2016 08:43:29 -0800 (PST) Received: from mahimahi.ripe.net (mahimahi.ripe.net [IPv6:2001:67c:2e8:11::c100:1372]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2138512961C; Wed, 28 Dec 2016 08:43:25 -0800 (PST) Received: from nene.ripe.net ([193.0.23.10]) by mahimahi.ripe.net with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.84_2) (envelope-from ) id 1cMHJt-000Ajy-FI; Wed, 28 Dec 2016 17:43:21 +0100 Received: from sslvpn.ripe.net ([193.0.20.230] helo=vpn-216.ripe.net) by nene.ripe.net with esmtps (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.84_2) (envelope-from ) id 1cMHJr-0000uw-3x; Wed, 28 Dec 2016 17:43:17 +0100 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: multipart/mixed; boundary="Apple-Mail=_7C926A38-13BD-4007-BE31-52E9B6CF54D2" From: Tim Bruijnzeels In-Reply-To: <7DE58D01-AC82-4099-9A46-99E625315637@cisco.com> Date: Wed, 28 Dec 2016 17:43:13 +0100 Message-Id: <99DD12D4-6E13-40A4-95C7-17B12CB61F1C@ripe.net> References: <7DE58D01-AC82-4099-9A46-99E625315637@cisco.com> To: "Alvaro Retana (aretana)" X-Mailer: Apple Mail (2.3124) X-ACL-Warn: Delaying message X-RIPE-Spam-Level: ------------ X-RIPE-Spam-Report: Spam Total Points: -12.5 points pts rule name description ---- ---------------------- ------------------------------------ -7.5 ALL_TRUSTED Passed through trusted hosts only via SMTP -3.1 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a071914229dff0e700e47d9387ab463138c83 Archived-At: Cc: "draft-ietf-sidr-delta-protocol@ietf.org" , Chris Morrow , "sidr-chairs@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] AD Review of draft-ietf-sidr-delta-protocol-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Dec 2016 16:43:32 -0000 --Apple-Mail=_7C926A38-13BD-4007-BE31-52E9B6CF54D2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Dear Alvaro, all, Thank you for your in-depth review :) It really helps to clarify the = document. Replies in-line. I attached an updated document, but.. I did not discuss this with = co-authors yet. So, I invite any of them to disagree or suggest changes = to the things below. > On 20 Dec 2016, at 14:15, Alvaro Retana (aretana) = wrote: >=20 > Dear authors: > =20 > Hi! I just finished reading this document. > =20 > I have several comments (please see below); I marked many of them as = =E2=80=9CMajor=E2=80=9D, some because of the use of Normative language, = but my main concern is that I think error conditions in the protocol are = underspecified (see M7, M8, M10, below). Along the same lines, I think = that an Operations Considerations section would be of benefit (see M8 = below); you might also want to take a look at RFC5706 (Guidelines for = Considering Operations and Management of New Protocols and Protocol = Extensions). > =20 > I would like to see the error conditions comments addressed before = moving this document forward to IETF Last Call. > =20 > Thanks!! > =20 > Alvaro. > =20 > =20 > Major: > =20 > M1. I assume that the id-ad-rpkiNotify value was assigned through the = early allocation process. Instead of pointing at the registry in = Section 3.2, point at the IANA Consideration Section --- and there, = please remind IANA of the early allocation and request the update. ack > M2. Section 3.2. (Certificate Authority Use): =E2=80=9CRelying Parties = that do not support this delta protocol MUST NOT reject a CA certificate = merely because it has an SIA extension containing this new kind of = AccessDescription.=E2=80=9D By definition, an RP that has never even = considered this document will not support the delta protocol =E2=80=93 = IOW, trying to specify the behavior of RPs that may have never even seen = this document makes no sense to me, and can=E2=80=99t be enforced. What = is the current behavior when an RP receives the extra SIA extension? The point of documenting this is to give RP software the option of = recognising that a new protocol exists, even if they do not fully = support it yet. In practice all current RPs do this (see below), and = future RPs should consider this document. We have in fact been = publishing these additional SIAs in the RIPE NCC production RPKI for = more than a year without problems. I changed it slightly to this: "Relying Parties that choose not to support this delta protocol yet, = MUST NOT reject a CA certificate merely because it has an SIA extension = containing this new kind of AccessDescription." But, I can also live with taking this sentence out altogether. In time we will also seek to phase out rsync altogether. When we do we = will probably need to define timelines for both CAs and RPs to support = RRPD, make rsync SIAs optional (they are currently still mandatory), and = ultimately phase out rsync altogether. But.. we believe that documenting = this should be a separate effort. RP behaviour in detail: - RIPE NCC RPKI Validator All versions will ignore the additional SIA as written. Recent versions = provide full support of RRDP if the RRPD option is enabled in the = configuration file. By default this option is still switched off, but we = plan to change this as soon as RRDP is an accepted standard RFC. - Rcynic I know that current versions ignore the additional SIA. Recent versions = also provide full support of RRDP. But I am not sure what users need to = do in order to get a version (branch?) and/or enable support. Maybe Rob = can elaborate. - RPSTIR Will also ignore the additional SIA. Declan Ma has indicated to the = working group that building support for this new protocol is on the = roadmap. > M3. Section 3.3.2. (Publishing Updates): =E2=80=9CWhenever the = repository server receives updates from a CA it SHOULD generate new = snapshot and delta files. However, if a publication server services a = large number of CAs it MAY choose to combine updates from multiple CAs. = If a publication server combines updates in this way, it MUST NOT = postpone publishing for longer than one minute.=E2=80=9D The =E2=80=9CMUS= T NOT=E2=80=9D at the end (making it mandatory to publish) doesn=E2=80=99t= work with the =E2=80=9CSHOULD=E2=80=9D at the beginning, which has no = time constraint and opens to the door to a situation where no publishing = is done. Suggestion: > NEW> > Whenever the repository server receives updates from a CA it MUST > generate new snapshot and delta. If a publication > server services a large number of CAs it MAY choose to combine > updates from multiple CAs, but it MUST NOT postpone publishing for = longer than one > minute. I changed it to: Whenever the repository server receives updates from a CA it MUST = generate new snapshot and delta files within one minute. If a = publication server services a large number of CAs it MAY choose to = combine updates from multiple CAs. If a publication server combines = updates in this way, it MUST ensure that publication never postponed for = longer than one minute for any of the CAs involved. > M4. =46rom 3.3.2. (Publishing Updates): =E2=80=9CThe update = notification file SHOULD be kept small=E2=80=A6older delta files = that=E2=80=A6will result in total size of deltas exceeding the size of = the snapshot, MUST be excluded.=E2=80=9D Here the =E2=80=9CSHOULD=E2=80=9D= and the =E2=80=9CMUST=E2=80=9D are in contradiction: you either do it = always (MUST) or there may be cases when you don=E2=80=99t (SHOULD). = s/SHOULD/should Ok, I moved the file size concern to the next bullet point instead, so = that we have: o Any older delta files that, when combined with all more recent delta = files, will result in a total size of deltas exceeding the size of the snapshot, MUST be = excluded to avoid that RPs download more data than necessary. o The server MAY also exclude more recent delta files if it finds that = their usage by a small number of RPs that would be forced to perform a full = synchronisation is outweighed performance benefits of having a smaller update notification file. = However, the repository server MUST include all deltas that it has available for the last two = hours. I hope that explains it better. I changed the SHOULD in the second = bullet point to a MUST. The unspoken reason for the SHOULD was that a = publication server may not have deltas. =20 > M5. Section 3.4.1. (Processing the Update Notification File) says that = =E2=80=9Ca Relying Party (RP)=E2=80=A6SHOULD prefer to use this protocol = as follows.=E2=80=9D I think you really want to be explicit: s/SHOULD = prefer to use/SHOULD use ok, what I meant to convey here was the RRPD SHOULD be preferred over = rsync. But.. I am fine with your suggestion, and leaving any rsync = phase-out concerns to a future document. =20 > M6. 3.4.1. (Processing the Update Notification File): =E2=80=9CThe RP = SHOULD download the update notification file, unless an update = notification file was already downloaded and processed from the same = location in this validation run.=E2=80=9D Is there any other reason for = the file not to be downloaded? Why would the RP decide not to = (=E2=80=9CSHOULD=E2=80=9D)? If there are no other reasons, then why = isn=E2=80=99t the =E2=80=9CSHOULD=E2=80=9D a =E2=80=9CMUST=E2=80=9D? With polling one would download and process and only start validation in = case there is a change, and then there is no need to this again, but to = make this more clear I changed it to: The RP MUST download the update notification file, unless an update = notification file was already downloaded and processed from the same = location in this validation run, or because a polling strategy was used = (see Section 3.4.4). =20 > M7. 3.4.1. (Processing the Update Notification File): =E2=80=9CMUST = issue an operator error=E2=80=9D What is an =E2=80=9Coperator error=E2=80= =9D and how do you issue one? I didn=E2=80=99t see an error definition = in the schema. I see your point, but.. afaik none of the other sidr RFCs and I-Ds = define this, and just avoid talking about this altogether. This was = undefined in over five years of deployment with rsync, and yet = operational issues with rsync also happen and get reported and resolved = somehow. In short I suggest that I just leave it out here as well. But to continue: All RPs do have the common sense to inform their users = about issues (e.g. also things like: hey, this certificate is invalid = because..), but there is no standard defined, so they use various = formats and ways. I do see some benefit in defining at least a common = standard because it might help (1) monitoring, (2) normative documenting = of error conditions and responses, and (3) interop testing between RPs = (Rob, David and I have done this a few times and it's a bit of a = hassle). Doing so is imo major work and something for a separate = sidr-ops document. =20 > M8. 3.4.1. (Processing the Update Notification File): =E2=80=9CIf = neither update notification file and one snapshot file or delta files = could be processed=E2=80=A6SHOULD use an alternate repository retrieval = mechanism if it is available.=E2=80=9D This =E2=80=9CSHOULD=E2=80=9D = doesn=E2=80=99t define anything normative with respect to the Delta = Protocol. I think that this document would benefit from a short = Operation Considerations section; a place to indicate expectations of = the operators, potential issues, the fact (as expressed in this piece of = text) that an alternate mechanism should be enabled (or at least = considered), other considerations related to logging errors for the = operator (see above), etc. I am adding a "considerations" section and moving things there. However, we do not wish to say in the context of this protocol that = other mechanisms should be enabled. In fact, I expect we will seek to = phase out rsync in future and only have RRDP. As below (M10) operational issues with retrieving RRDP data will mean = that the the RP is witheld potentially important information and will be = out-of-sync. As long as we do have rsync it would make sense for an RP = to try to use that instead in such cases, but of course there is no = guarantee that that will work either (e.g. a network outage may well = affect both RRDP and rsync for a given publication server). So.. first and foremost people should monitor their things and fix = issues. =20 > M9. There are some places where non-normative and normative (RFC2119) = language is used that may cause confusion. For example, in 3.4.2: = =E2=80=9Cshould perform the following actions=E2=80=9D, the actions = contain a set of =E2=80=9CMUSTs=E2=80=9D and =E2=80=9CSHOULDs=E2=80=9D. = Please find an alternate way to write the lead-in header to avoid = confusion. Suggestion: s/it should perform the following actions/it = performs the following actions. [Note that the same construct if used = in several different places=E2=80=A6] > =20 > M10. In several places (related to verification, but in other places = as well), =E2=80=9Cthe file MUST be rejected=E2=80=9D is used. What = does this mean exactly? That it cannot be used. If it's the update notification file there is no = recovery - RRDP cannot be used now. If it's a delta then deltas cannot = be used -> a snapshot may still be used. If it's a snapshot there is no = recovery (since they are only used if deltas are not useable). I added clarifying text for all this and references to the = "considerations" section. > Are there actions that should be taken as a result? An example of = why I=E2=80=99m asking: an RP will download and process delta files = based on information in a notification file =E2=80=93 if a delta file is = not well-formed (for example), then the validation will fail and the RP = MUST reject it =E2=80=93 there are multiple reasons why the file may not = be well-formed, but the bottom line is that whatever information was = there that the repository pointed to in the notification message is lost = (?) =E2=80=93 does this mean that the RP is now out of sync? Should the = RP now try and re-sync using the snapshot file? Yes, as was written: "..or if delta files could not be used, the RP MUST = update its last known session_id to this session_id and download and = process snapshot file on the update notification file". But made this = more explicit in the "delta" section. > What if that is also rejected? Then RRPD cannot be used. Added a reference to the "considerations" = section. > Maybe the notification file was somehow corrupted and pointed at the = wrong file(s)=E2=80=A6should the relationship with the repository be = reset/restarted? It is not clear at all what should be done, or what = the implications are of these error conditions; it just looks like we = reject and go on. [See comment M8 above: it looks like only when = =E2=80=9Cneither update notification file and one snapshot file or delta = files could be processed=E2=80=9D that we would abandon using RRDP.] This problem is not specific to just this protocol. What do you do when = you have no network? What do you do when an rsync server is down, or = starts speaking in a funny dialect? What if a CA starts publishing = malformed CA certificates for its children, manifests etc? See section 3.4.5 of attached file for clarifications that I think we = can do in the context of this document. Following your previous remark = the only normative addition I feel I can add is this: "In order to help = prevent this Publication Servers MUST perform regular validation of = their own RRDP repository." > =20 > M11. =46rom 3.4.3. (Processing Delta Files): =E2=80=9Cit is = RECOMMENDED that a RP uses additional strategies to determine if an = object is still relevant for validation before removing it from its = local storage=E2=80=9D. Ok, like what? I think going into too much detail is out of scope because it cannot be = explained without having a document formally describing validation = strategies. But I added this: In particular objects should not be removed if they are included in a = current validated manifest. =20 > M12. 3.5.1.2. (Update Notification File): =E2=80=9C=E2=80=A6the = repository server MUST ensure that this file is not cached for longer = than 1 minute. An exception to this rule=E2=80=A6=E2=80=9D Using = =E2=80=9CMUST=E2=80=9D implies no exceptions. s/MUST/SHOULD s/then = no/than no ack=20 > =20 > M13. Why isn=E2=80=99t an IETF namespace [RFC3688] used in the XML = schema? I would strongly suggest that you use one and request it in the = IANA Considerations Section. Unlike the publication protocol, this = document specifies version 1 =E2=80=93 which of course doesn=E2=80=99t = mean there isn=E2=80=99t a longer history behind it, so I=E2=80=99m open = to keeping a non-IETF namespace if that is the case. To be honest, because I wasn't aware :) We now have running code based on this. Speaking for our own = implementation I do not think we care about the namespace when = validating the XML - just that it conforms everything else defined here. = So I have no problem with changing this. Rob, do you see an issue with = deployed versions of rcynic if we do this? > M14. 3.5.2.3: =E2=80=9CNote that the publish element is defined in the = publication protocol [I-D.ietf-sidr-publication]=E2=80=9D But the = example doesn=E2=80=99t correspond to the definition in = I-D.ietf-sidr-publication, even if it does comply with the schema in = this document. Should the publish element behave the same way as = specified in I-D.ietf-sidr-publication? It is good that the RRDP design = goes back to the Publication Protocol, but if it doesn=E2=80=99t use the = exact definition from there (including the schema), then the differences = should be highlighted here. > =20 > M15. 3.5.3.3: =E2=80=9CNote that the publish and withdraw elements are = defined in the publication protocol [I-D.ietf-sidr-publication]=E2=80=9D = Same comment as above. Ok, updated text to explain that the "tag" attribute is not used here, = and that the "hash" attribute is not used in snapshot files. > M16. Section 5. (Security Considerations): =E2=80=9CRRDP replaces the = use of rsync by HTTPS=E2=80=A6=E2=80=9D. Given the statement in 3.4.1 = about using =E2=80=9Can alternate repository retrieval mechanism=E2=80=9D = and the rest of the text in this section, I would assume that the intent = is not really to =E2=80=9Creplace the use of rsync=E2=80=9D (with an = update to RFC6480). Maybe I=E2=80=99m reading too much into the phrase = above, but please clarify. As explained above it is the intent to replace rsync. But.. a migration = document should be written as a separate effort. That said I would be fine with just taking out:=20 The original RPKI transport mechanism is rsync, which offers no = channel security mechanism. RRDP replaces the use of rsync by HTTPS; Please let me know if you prefer this. > Minor: > =20 > P1. In 3.3.1. (Initialisation): =E2=80=9CNote that this snapshot file = MAY contain zero publish elements at this point if no objects have been = submitted for publication yet.=E2=80=9D This text is not describing an = option: s/MAY/may ack =20 > P2. Please expand RRDP in first use. ack, added to introduction > =20 > P3. Section 3.4.4. (Polling the Update Notification File) says: =E2=80=9C= A detailed description of the validation process itself is out of scope = of this document.=E2=80=9D Isn=E2=80=99t that what is described in = 3.4.1 and 3.5.1.3?? No, but changed to this to clarify: ..and initiate a new RPKI object validation process. However, a = detailed description of the RPKI object validation process itself is out of scope of = this document. =20 > P4. =E2=80=9Cversion 4 UUID=E2=80=9D Please provide a reference. ack, I assumed informative. > =20 > P5. 3.5.1.3: =E2=80=9CThe serial attribute must be=E2=80=A6=E2=80=9D = This is the only place where RFC2119 language is not used in this = section. Any special reason? changed to MUST > =20 > P6. 3.5.1.3: =E2=80=9CIf delta elements are included they MUST form a = contiguous sequence of serial numbers=E2=80=A6up to the serial number = mentioned in the notification element.=E2=80=9D The example in this = section lists the serial numbers in =E2=80=9Creverse order=E2=80=9D (3, = 2) =E2=80=93 is there an order requirement? The text seems to imply it, = but it could go either way. No, order in the XML elements is not required. Although most = applications will probably end up using some kind of order. So I added:=20= Note that the elements may not be ordered. > =20 > P7. The following references should be Informative: IANA-AD-NUMBERS, = RFC6481, RFC6486, RFC6488 should be made Informative. ok > Nits: > =20 > N1. In both 3.3.1/3.3.2, the notes about =E2=80=9Cformat and caching = concerns=E2=80=9D would work better if they are part of the previous = paragraph. ok > =20 > N2. s/are no no longer/are no longer ok --Apple-Mail=_7C926A38-13BD-4007-BE31-52E9B6CF54D2 Content-Disposition: attachment; filename=draft-ietf-sidr-delta-protocol-04.txt Content-Type: text/plain; name="draft-ietf-sidr-delta-protocol-04.txt" Content-Transfer-Encoding: quoted-printable Network Working Group T. Bruijnzeels Internet-Draft O. Muravskiy Intended status: Standards Track RIPE NCC Expires: July 1, 2017 B. Weber Cobenian R. Austein Dragon Research Labs December 28, 2016 RPKI Repository Delta Protocol draft-ietf-sidr-delta-protocol-04 Abstract In the Resource Public Key Infrastructure (RPKI), certificate authorities publish certificates, including end entity certificates, Certificate Revocation Lists (CRL), and RPKI signed objects to repositories. Relying Parties (RP) retrieve the published information from those repositories. This document specifies a delta protocol which provides relying parties with a mechanism to query a repository for incremental updates, thus enabling the RP to keep its state in sync with the repository. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on July 1, 2017. Copyright Notice Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents Bruijnzeels, et al. Expires July 1, 2017 [Page 1] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Requirements notation . . . . . . . . . . . . . . . . . . . . 2 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 3. RPKI Repository Delta Protocol Implementation . . . . . . . . 3 3.1. Informal Overview . . . . . . . . . . . . . . . . . . . . 3 3.2. Certificate Authority Use . . . . . . . . . . . . . . . . 4 3.3. Repository Server Use . . . . . . . . . . . . . . . . . . 5 3.3.1. Initialisation . . . . . . . . . . . . . . . . . . . 5 3.3.2. Publishing Updates . . . . . . . . . . . . . . . . . 5 3.4. Relying Party Use . . . . . . . . . . . . . . . . . . . . 7 3.4.1. Processing the Update Notification File . . . . . . . 7 3.4.2. Processing Delta Files . . . . . . . . . . . . . . . 8 3.4.3. Processing a Snapshot File . . . . . . . . . . . . . 8 3.4.4. Polling the Update Notification File . . . . . . . . 9 3.4.5. Considerations Regarding Operational Failures in RRDP 9 3.5. File Definitions . . . . . . . . . . . . . . . . . . . . 10 3.5.1. Update Notification File . . . . . . . . . . . . . . 10 3.5.2. Snapshot File . . . . . . . . . . . . . . . . . . . . 12 3.5.3. Delta File . . . . . . . . . . . . . . . . . . . . . 13 3.5.4. XML Schema . . . . . . . . . . . . . . . . . . . . . 15 4. HTTPS considerations . . . . . . . . . . . . . . . . . . . . 17 5. Security Considerations . . . . . . . . . . . . . . . . . . . 17 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 18 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 18 8.1. Normative References . . . . . . . . . . . . . . . . . . 19 8.2. Informative References . . . . . . . . . . . . . . . . . 19 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 1. Requirements notation The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Bruijnzeels, et al. Expires July 1, 2017 [Page 2] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 2. Introduction In the Resource Public Key Infrastructure (RPKI), Certificate Authorities (CAs) publish certificates [RFC6487], RPKI signed objects [RFC6488], manifests [RFC6486], and CRLs to repositories. CAs may have an embedded mechanism to publish to these repositories, or they may use a separate repository server and publication protocol. RPKI repositories are currently accessible using the rsync protocol, allowing Relying Parties (RPs) to synchronise a local copy of the RPKI repository used for validation with the remote repositories [RFC6481]. This document specifies an alternative repository access protocol based on notification, snapshot and delta files that a RP can retrieve over the HTTPS protocol. This allows RPs to perform either a full (re-)synchronisation of their local copy of the repository using snapshot files, or use delta files to keep their local repository updated after initial synchronisation. We call this the RPKI Repository Delta Protocol, or RRDP in short. This protocol is designed to be consistent (in terms of data structures) with the publication protocol [I-D.ietf-sidr-publication] and treats publication events of one or more repository objects as discrete events that can be communicated to relying parties. This approach helps to minimize the amount of data that traverses the network and thus helps minimize the amount of time until repository convergence occurs. This protocol also provides a standards based way to obtain consistent, point in time views of a single repository, eliminating a number of consistency related issues. Finally, this approach allows these discrete events to be communicated as immutable files, so that caching infrastructure can be used to reduce the load on a repository server when a large number of relying parties are querying it. 3. RPKI Repository Delta Protocol Implementation 3.1. Informal Overview Certification Authorities (CA) in the RPKI use a repository server to publish their RPKI products, such as manifests, CRLs, signed certificates and RPKI signed objects. This repository server may be remote, or embedded in the CA engine itself. Certificates in the RPKI that use a repository server that supports this delta protocol include a special Subject Information Access (SIA) pointer referring to a notification file. The notification file includes a globally unique session_id in the form of a version 4 UUID, and serial number that can be used by the Bruijnzeels, et al. Expires July 1, 2017 [Page 3] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 Relying Party (RP) to determine if it and the repository are synchronised. Furthermore it includes a link to the most recent complete snapshot of current objects that are published by the repository server, and a list of links to delta files, for each revision starting at a point determined by the repository server, up to the current revision of the repository. A RP that learns about a notification file location for the first time can download it, and then proceed to download the latest snapshot file, and thus create a local copy of the repository that is in sync with the repository server. The RP should remember the location of this notification file, the session_id and current serial number. RPs are encouraged to re-fetch this notification file at regular intervals, but not more often than once per minute. After re- fetching the notification file, the RP may find that there are one or more delta files available that allow it to synchronise its local repository with the current state of the repository server. If no contiguous chain of deltas from RP's serial to the latest repository serial is available, or if the session_id has changed, the RP should perform a full resynchronisation instead. As soon as the RP fetches new content in this way it should start a validation process. An example of a reason why a RP may not do this immediately is because it has learned of more than one notification location and it prefers to complete all its updates before validating. The repository server may use caching infrastructure to reduce its load. It should be noted that snapshots and deltas for any given session_id and serial number contain an immutable record of the state of the repository server at a certain point in time. For this reason these files can be cached indefinitely. Notification files are polled by RPs to discover if updates exist, and for this reason notification files may not be cached for longer than one minute. 3.2. Certificate Authority Use Certificate Authorities that use this delta protocol MUST include an instance of an SIA AccessDescription extension in resource certificates they produce, in addition to the ones defined in [RFC6487], AccessDescription ::=3D SEQUENCE { accessMethod OBJECT IDENTIFIER, accessLocation GeneralName } Bruijnzeels, et al. Expires July 1, 2017 [Page 4] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 This extension MUST use an accessMethod of id-ad-rpkiNotify, see: Section 6, id-ad OBJECT IDENTIFIER ::=3D { id-pkix 48 } id-ad-rpkiNotify OBJECT IDENTIFIER ::=3D { id-ad 13 } The accessLocation MUST be an HTTPS URI as defined in [RFC2818], that will point to the update notification file for the repository server that publishes the products of this CA certificate. Relying Parties that choose not to support this delta protocol yet, MUST NOT reject a CA certificate merely because it has an SIA extension containing this new kind of AccessDescription. 3.3. Repository Server Use 3.3.1. Initialisation When the repository server initialises it must perform the following actions: The server MUST generate a new random version 4 UUID to be used as the session_id The server MUST then generate a snapshot file for serial number ONE for this new session that includes all currently known published objects that the repository server is responsible for. Note that this snapshot file may contain zero publish elements at this point if no objects have been submitted for publication yet. This snapshot file MUST be made available at a URL that is unique to this session_id and serial number, so that it can be cached indefinitely. The format and caching concerns for snapshot files are explained in more detail in Section 3.5.2. After the snapshot file has been published the repository server MUST publish a new notification file that contains the new session_id, has serial number ONE, has one reference to the snapshot file that was just published, and that contains no delta references. The format and caching concerns for update notification files are explained in more detail in Section 3.5.1. 3.3.2. Publishing Updates Whenever the repository server receives updates from a CA it MUST generate new snapshot and delta files within one minute. If a publication server services a large number of CAs it MAY choose to combine updates from multiple CAs. If a publication server combines Bruijnzeels, et al. Expires July 1, 2017 [Page 5] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 updates in this way, it MUST ensure that publication never postponed for longer than one minute for any of the CAs involved. Updates must be processed as follows: o The new repository serial number MUST be one greater than the current repository serial number. o A new delta file MUST be generated for this new serial. This delta file MUST include all new, replaced and withdrawn objects for multiple CAs if applicable, as a single change set. o This delta file MUST be made available at a URL that is unique to the current session_id and serial number, so that it can be cached indefinitely. o The format and caching concerns for delta files are explained in more detail in Section 3.5.3. o The repository server MUST also generate a new snapshot file for this new serial. This file MUST contain all "publish" elements for all current objects. o The snapshot file MUST be made available at a URL that is unique to this session and new serial, so that it can be cached indefinitely. o The format and caching concerns for snapshot files are explained in more detail in Section 3.5.2. o Any older delta files that, when combined with all more recent delta files, will result in total size of deltas exceeding the size of the snapshot, MUST be excluded to avoid that RPs download more data than necessary. o The server MAY also exclude more recent delta files if it finds that their usage by a small number of RPs that would be forced to perform a full synchronisation is outweighed performance benefits of having a smaller update notification file. However, the repository server MUST include all deltas that it has available for the last two hours. o A new notification file MUST now be created by the repository server. This new notification file MUST include a reference to the new snapshot file, and all delta files selected in the previous steps. Bruijnzeels, et al. Expires July 1, 2017 [Page 6] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 o The format and caching concerns for update notification files are explained in more detail in Section 3.5.1. If the repository server is not capable of performing the above for some reason, then it MUST perform a full re-initialisation, as explained above in Section 3.3.1. 3.4. Relying Party Use 3.4.1. Processing the Update Notification File When a Relying Party (RP) performs RPKI validation and learns about a valid certificate with an SIA entry for the RRDP protocol, it SHOULD use this protocol as follows. The RP MUST download the update notification file, unless an update notification file was already downloaded and processed from the same location in this validation run, or because a polling strategy was used (see Section 3.4.4). The RP MAY use a "User-Agent" header explained in section 5.5.3. of [RFC7231] to identify the name and version of the RP software used. This is not required, but would be useful to help track capabilities of Relying Parties in the event of changes to the RPKI standards. When the RP downloads an update notification file it MUST verify the file format and validation steps described in section Section 3.5.1.3. If this verification fails, the file MUST be rejected and RRDP cannot be used. See Section 3.4.5 for considerations. The RP MUST verify whether the session_id in this update notification file matches the last known session_id for this update notification file location. If the session_id matches the last known session_id, then an RP MAY download and process missing delta files as described in section Section 3.4.2, provided that all delta files for serial numbers between the last processed serial number and the current serial number in the notification file can be processed this way. If the session_id was not previously known, or if delta files could not be used, then the RP MUST update its last known session_id to this session_id and download and process snapshot file on the update notification file as described in section Section 3.4.3. Bruijnzeels, et al. Expires July 1, 2017 [Page 7] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 3.4.2. Processing Delta Files If an update notification file contains a contiguous chain of links to delta files from the last processed serial number to the current serial number, then RPs MUST attempt to download and process all delta files in order of serial number as follows. When the RP downloads a delta file it MUST verify the file format and perform validation steps described in Section 3.5.3.3. If this verification fails, the file MUST be rejected. Furthermore the RP MUST verify that the hash of the contents of this file matches the hash on the update notification file that referenced it. In case of a mismatch of this hash, the file MUST be rejected. If an RP retrieved a delta file that is valid according to the above criteria, it should perform the following actions: The RP MUST verify that the session_id matches the session_id of the notification file. If the session_id values do not match the file MUST be rejected. The RP MUST verify that the serial number of this delta file is exactly one greater than the last processed serial number for this session_id, and if not this file MUST be rejected. The RP SHOULD add all publish elements to a local storage and update its last processed serial number to the serial number of this snapshot file. The RP SHOULD NOT remove objects from its local storage solely because it encounters a "withdraw" element, because this would enable a publication server to withdraw any object without the signing Certificate Authority consent. Instead it is RECOMMENDED that a RP uses additional strategies to determine if an object is still relevant for validation before removing it from its local storage. In particular objects should not be removed if they are included in a current validated manifest. If any delta file is rejected RPs MUST process the current Snapshot File instead, as described in Section 3.4.3. 3.4.3. Processing a Snapshot File Snapshot Files MUST only be used if Delta Files are unavailable, or were rejected. As is ensured, if the process described in Section 3.4.1 is followed. Bruijnzeels, et al. Expires July 1, 2017 [Page 8] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 When the RP downloads a snapshot file it MUST verify the file format and validation steps described in Section 3.5.2.3. If this verification fails, the file MUST be rejected. Furthermore the RP MUST verify that the hash of the contents of this file matches the hash on the update notification file that referenced it. In case of a mismatch of this hash, the file MUST be rejected. If an RP retrieved a snapshot file that is valid according to the above criteria, it should perform the following actions: The RP MUST verify that the session_id matches the session_id of the notification file. If the session_id values do not match the file MUST be rejected. The RP MUST verify that the serial number of this snapshot file is greater than the last processed serial number for this session_id. If this fails the file MUST be rejected. The RP SHOULD then add all publish elements to a local storage and update its last processed serial number to the serial number of this snapshot file. If a Snapshot File is rejected that means that RRDP cannot be used. See Section 3.4.5 for considerations. 3.4.4. Polling the Update Notification File Once a Relying Party has learned about the location, session_id and last processed serial number of repository that uses the RRDP protocol, the RP MAY start polling the repository server for updates. However the RP MUST NOT poll for updates more often than once every 1 minute, and in order to reduce data usage RPs MUST use the "If- Modified-Since" header explained in section 3.3 of [RFC7232]in requests. If an RP finds that updates are available it SHOULD download and process the file as described in Section 3.4.1, and initiate a new RPKI object validation process. However, a detailed description of the RPKI object validation process itself is out of scope of this document. 3.4.5. Considerations Regarding Operational Failures in RRDP If an RP experiences any issues with retrieving or processing any of the files used in this protocol, it will be unable to retrieve new RPKI data from the affected publication server. Bruijnzeels, et al. Expires July 1, 2017 [Page 9] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 In order to help prevent this Publication Servers MUST perform regular validation of their own RRDP repository. This protocol document cannot define normative text on recovery strategies for Relying Parties in case of failures with this protocol, as they are by definition out of scope with regard to this specification. That being said Relying Parties would do well to attempt to use an alternative repository retrieval mechanism, such as rsync, if it is available. However, it should be noted that an issue with RRDP at a publication server may well affect its rsync repository as well. Furthermore Relying Parties may wish to employ re-try strategies in case of network issues. Relying Parties are also advised to keep old objects in their local cache so that validation can be done using old objects. It is also recommendable that re-validation and retrieval is performed pro-actively before manifests or CRLs go stale, or certificates expire, to ensure that problems on the side of the RP can be identified and resolved before they cause major concerns. 3.5. File Definitions 3.5.1. Update Notification File 3.5.1.1. Purpose The update notification file is used by RPs to discover whether any changes exist between the state of the repository and the RP's cache. It describes the location of the files containing the snapshot and incremental deltas which can be used by the RP to synchronise with the repository. 3.5.1.2. Cache Concerns A repository server MAY use caching infrastructure to cache the notification file and reduce the load of HTTPS requests. However, since this file is used by RPs to determine whether any updates are available the repository server SHOULD ensure that this file is not cached for longer than 1 minute. An exception to this rule is that it is better to serve a stale notification file, than no notification file. How this is achieved exactly depends on the caching infrastructure used. In general a repository server may find certain HTTP headers to be useful, such as: Cache-Control: max-age=3D60. Another approach Bruijnzeels, et al. Expires July 1, 2017 [Page 10] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 can be to have the repository server push out new versions of the notification file to the caching infrastructure when appropriate. Relying Parties SHOULD NOT cache the notification file for longer than 1 minute, regardless of the headers set by the repository server or CDN. 3.5.1.3. File Format and Validation Example notification file: Note: URIs and hash values in this example are shortened because of formatting. The following validation rules must be observed when creating or parsing notification files: o A RP MUST reject any update notification file that is not well- formed, or which does not conform to the RELAX NG schema outlined in Section 3.5.4 of this document. o The XML namespace MUST be http://www.ripe.net/rpki/rrdp o The encoding MUST be US-ASCII o The version attribute in the notification root element MUST be 1 o The session_id attribute MUST be a random version 4 UUID unique to this session ([RFC4122]) o The serial attribute MUST be an unbounded, unsigned positive integer in decimal format indicating the current version of the repository. o The notification file MUST contain exactly one 'snapshot' element for the current repository version. o If delta elements are included they MUST form a contiguous sequence of serial numbers starting at a revision determined by Bruijnzeels, et al. Expires July 1, 2017 [Page 11] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 the repository server, up to the serial number mentioned in the notification element. Note that the elements may not be ordered. o The hash attribute in snapshot and delta elements must be the hexadecimal encoding of the SHA-256 hash of the referenced file. The RP MUST verify this hash when the file is retrieved and reject the file if the hash does not match. 3.5.2. Snapshot File 3.5.2.1. Purpose A snapshot is intended to reflect the complete and current contents of the repository for a specific session and version. Therefore it MUST contain all objects from the repository current as of the time of the publication. 3.5.2.2. Cache Concerns A snapshot reflects the content of the repository at a specific point in time, and for that reason can be considered immutable data. Snapshot files MUST be published at a URL that is unique to the specific session and serial. Because these files never change, they MAY be cached indefinitely. However, in order to prevent that these files use a lot of space in caching infrastructure it is RECOMMENDED that a limited interval is used in the order of hours or days. To avoid race conditions where an RP downloads a notification file moments before it's updated, Repository Servers SHOULD retain old snapshot files for at least 5 minutes after a new notification file is published. 3.5.2.3. File Format and Validation Example snapshot file: Bruijnzeels, et al. Expires July 1, 2017 [Page 12] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 ZXhhbXBsZTE=3D ZXhhbXBsZTI=3D ZXhhbXBsZTM=3D The following rules must be observed when creating or parsing snapshot files: o A RP MUST reject any snapshot file that is not well-formed, or which does not conform to the RELAX NG schema outlined in Section 3.5.4 of this document. o The XML namespace MUST be http://www.ripe.net/rpki/rrdp. o The encoding MUST be US-ASCII. o The version attribute in the notification root element MUST be 1 o The session_id attribute MUST match the expected session_id in the reference in the notification file. o The serial attribute MUST match the expected serial in the reference in the notification file. o Note that the publish element is similar to the publish element defined in the publication protocol [I-D.ietf-sidr-publication]. However, the "tag" attribute is not used here because it is not relevant to relying parties. The "hash" attribute is not used here because this file represents a complete current state of the repository, and therefore it is not relevant to know which existing RPKI object (if any) is updated. 3.5.3. Delta File Bruijnzeels, et al. Expires July 1, 2017 [Page 13] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 3.5.3.1. Purpose An incremental delta file contains all changes for exactly one serial increment of the repository server. In other words a single delta will typically include all the new objects, updated objects and withdrawn objects that a Certification Authority sent to the repository server. In its simplest form the update could concern only a single object, but it is recommended that CAs send all changes for one of their key pairs: i.e. updated objects as well as a new manifest and CRL as one atomic update message. 3.5.3.2. Cache Concerns Deltas reflect the difference between two consecutive versions of a repository for a given session. For that reason deltas can be considered immutable data. Delta files MUST be published at a URL that is unique to the specific session and serial. Because these files never change, they MAY be cached indefinitely. However, in order to prevent these files from using a lot of space in caching infrastructure it is RECOMMENDED that a limited interval is used in the order of hours or days. To avoid race conditions where an RP downloads a notification file moments before it's updated, Repository Servers SHOULD retain old delta files for at least 5 minutes after they are no longer included in the latest notification file. 3.5.3.3. File Format and Validation Example delta file: ZXhhbXBsZTQ=3D ZXhhbXBsZTU=3D Bruijnzeels, et al. Expires July 1, 2017 [Page 14] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 Note that a formal RELAX NG specification of this file format is included later in this document. A RP MUST NOT process any delta file that is incomplete or not well-formed. The following validation rules must be observed when creating or parsing delta files: o A RP MUST reject any delta file that is not well-formed, or which does not conform to the RELAX NG schema outlined in Section 3.5.4 of this document. o The XML namespace MUST be http://www.ripe.net/rpki/rrdp. o The encoding MUST be US-ASCII. o The version attribute in the delta root element MUST be 1 o The session_id attribute MUST be a random version 4 UUID unique to this session o The session_id attribute MUST match the expected session_id in the reference in the notification file. o The serial attribute MUST match the expected serial in the reference in the notification file. o Note that the publish element is similar to the publish element defined in the publication protocol [I-D.ietf-sidr-publication]. However, the "tag" attribute is not used here because it is not relevant to relying parties. 3.5.4. XML Schema The following is a RELAX NG compact form schema describing version 1 of this protocol. # # RelaxNG schema for RPKI Repository Delta Protocol (RRDP). # default namespace =3D "http://www.ripe.net/rpki/rrdp" version =3D xsd:positiveInteger { maxInclusive=3D"1" } serial =3D xsd:nonNegativeInteger uri =3D xsd:anyURI uuid =3D xsd:string { pattern =3D "[\-0-9a-fA-F]+" } hash =3D xsd:string { pattern =3D "[0-9a-fA-F]+" } base64 =3D xsd:base64Binary Bruijnzeels, et al. Expires July 1, 2017 [Page 15] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 # Notification file: lists current snapshots and deltas start |=3D element notification { attribute version { version }, attribute session_id { uuid }, attribute serial { serial }, element snapshot { attribute uri { uri }, attribute hash { hash } }, element delta { attribute serial { serial }, attribute uri { uri }, attribute hash { hash } }* } # Snapshot segment: think DNS AXFR. start |=3D element snapshot { attribute version { version }, attribute session_id { uuid }, attribute serial { serial }, element publish { attribute uri { uri }, base64 }* } # Delta segment: think DNS IXFR. start |=3D element delta { attribute version { version }, attribute session_id { uuid }, attribute serial { serial }, delta_element+ } delta_element |=3D element publish { attribute uri { uri }, attribute hash { hash }?, base64 } delta_element |=3D element withdraw { attribute uri { uri }, attribute hash { hash } } Bruijnzeels, et al. Expires July 1, 2017 [Page 16] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 # Local Variables: # indent-tabs-mode: nil # comment-start: "# " # comment-start-skip: "#[ \t]*" # End: 4. HTTPS considerations It is RECOMMENDED that Relying Parties and Publication Servers follow the Best Current Practices outlined in [RFC7525] on the use of HTTP over TLS (https). Note that a Man-in-the-Middle (MITM) cannot produce validly signed RPKI data, but they can perform withhold or replay attacks targeting an RP, and keep the RP from learning about changes in the RPKI. Because of this RPs SHOULD do TLS certificate and host name validation when they fetch from an RRDP Publication Server However, such validation issues are often due to configuration errors, or a lack of a common TLS trust anchor. In these cases it would be better that the RP retrieves the signed RPKI data regardless, and performs validation on it. Therefore RPs SHOULD log any TLS certificate or host name validation issues they find, so that an operator can investigate the cause. But the RP MUST continue to retrieve the data. The RP MAY choose to log this issue only when fetching the notification update file, but not when it subsequently fetches snapshot or delta files from the same host. Furthermore the RP MAY provide a way for operators to accept untrusted connections for a given host, after the cause has been identified. 5. Security Considerations RRDP deals exclusively with transfer of RPKI objects from a repository server to a relying party. The trust relation between a CA and its repository server is out of scope for this document. However, it should be noted the from a relying party point of view all RPKI objects (certificates, CRLs, and CMS-wrapped objects) are already covered by object security mechanisms including signed manifests. This allows validation of these objects even though the repository server itself is not trusted. This document makes no change to RPKI validation procedures per se. The original RPKI transport mechanism is rsync, which offers no channel security mechanism. RRDP replaces the use of rsync by HTTPS; while the channel security mechanism underlying RRDP (HTTPS) is not a cure-all, it does make some forms of denial of service attack more Bruijnzeels, et al. Expires July 1, 2017 [Page 17] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 difficult for the attacker. HTTPS issues are discussed in more detail in Section 4. Supporting both RRDP and rsync necessarily increases the number of opportunities for a malicious RPKI CA to perform denial of service attacks on relying parties, by expanding the number of URIs which the RP may need to contact in order to complete a validation run. However, other than the relative cost of HTTPS versus rsync, adding RRDP to the mix does not change this picture significantly: with either RRDP or rsync a malicious CA can supply an effectively infinite series of URIs for the RP to follow. The only real solution to this is for the RP to apply some kind of bound to the amount of work it is willing to do. Note also that the attacker in this scenario must be an RPKI CA, since otherwise the normal RPKI object security checks would reject the malicious URIs. Processing costs for objects retrieved using RRDP may be somewhat different from the same objects retrieved using rsync: because RRDP treats an entire set of changes as a unit (one "delta"), it may not be practical to start processing any of the objects in the delta until the entire delta has been received. With rsync, by contrast, incremental processing may be easy, but the overall cost of transfer may be higher, as may be the number of corner cases in which the RP retrieves some but not all of the updated objects. Overall, RRDP's behavior is closer to a proper transactional system, which (probably) leads to an overall reliability increase. RRDP is designed to scale much better than rsync. In particular, RRDP is designed to allow use of HTTPS caching infrastructure to reduce load on primary publication servers and increase resilience against denial of service attacks on the RPKI publication service. 6. IANA Considerations IANA is requested to update the reference for id-ad-rpkiNotify to this document in the PKIX Access Descriptor registry [IANA-AD-NUMBERS]. 7. Acknowledgements The authors would like to thank David Mandelberg for reviewing this document. 8. References Bruijnzeels, et al. Expires July 1, 2017 [Page 18] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 8.1. Normative References [I-D.ietf-sidr-publication] Weiler, S., Sonalker, A., and R. Austein, "A Publication Protocol for the Resource Public Key Infrastructure (RPKI)", draft-ietf-sidr-publication-09 (work in progress), September 2016. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC2818] Rescorla, E., "HTTP Over TLS", RFC 2818, DOI 10.17487/RFC2818, May 2000, . [RFC6487] Huston, G., Michaelson, G., and R. Loomans, "A Profile for X.509 PKIX Resource Certificates", RFC 6487, DOI 10.17487/RFC6487, February 2012, . [RFC7231] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, . [RFC7232] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Conditional Requests", RFC 7232, DOI 10.17487/RFC7232, June 2014, . [RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre, "Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May 2015, . 8.2. Informative References [IANA-AD-NUMBERS] "SMI Security for PKIX Access Descriptor", . Bruijnzeels, et al. Expires July 1, 2017 [Page 19] =0C Internet-Draft RPKI Repository Delta Protocol December 2016 [RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, July 2005, . [RFC6481] Huston, G., Loomans, R., and G. Michaelson, "A Profile for Resource Certificate Repository Structure", RFC 6481, DOI 10.17487/RFC6481, February 2012, . [RFC6486] Austein, R., Huston, G., Kent, S., and M. Lepinski, "Manifests for the Resource Public Key Infrastructure (RPKI)", RFC 6486, DOI 10.17487/RFC6486, February 2012, . [RFC6488] Lepinski, M., Chi, A., and S. Kent, "Signed Object Template for the Resource Public Key Infrastructure (RPKI)", RFC 6488, DOI 10.17487/RFC6488, February 2012, . Authors' Addresses Tim Bruijnzeels RIPE NCC Email: tim@ripe.net Oleg Muravskiy RIPE NCC Email: oleg@ripe.net Bryan Weber Cobenian Email: bryan@cobenian.com Rob Austein Dragon Research Labs Email: sra@hactrn.net Bruijnzeels, et al. Expires July 1, 2017 [Page 20] --Apple-Mail=_7C926A38-13BD-4007-BE31-52E9B6CF54D2 Content-Disposition: attachment; filename=draft-ietf-sidr-delta-protocol-04.xml Content-Type: application/xml; name="draft-ietf-sidr-delta-protocol-04.xml" Content-Transfer-Encoding: 7bit ]> RPKI Repository Delta Protocol RIPE NCC
tim@ripe.net
RIPE NCC
oleg@ripe.net
Cobenian
bryan@cobenian.com
Dragon Research Labs
sra@hactrn.net
In the Resource Public Key Infrastructure (RPKI), certificate authorities publish certificates, including end entity certificates, Certificate Revocation Lists (CRL), and RPKI signed objects to repositories. Relying Parties (RP) retrieve the published information from those repositories. This document specifies a delta protocol which provides relying parties with a mechanism to query a repository for incremental updates, thus enabling the RP to keep its state in sync with the repository.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .
In the Resource Public Key Infrastructure (RPKI), Certificate Authorities (CAs) publish certificates , RPKI signed objects , manifests , and CRLs to repositories. CAs may have an embedded mechanism to publish to these repositories, or they may use a separate repository server and publication protocol. RPKI repositories are currently accessible using the rsync protocol, allowing Relying Parties (RPs) to synchronise a local copy of the RPKI repository used for validation with the remote repositories . This document specifies an alternative repository access protocol based on notification, snapshot and delta files that a RP can retrieve over the HTTPS protocol. This allows RPs to perform either a full (re-)synchronisation of their local copy of the repository using snapshot files, or use delta files to keep their local repository updated after initial synchronisation. We call this the RPKI Repository Delta Protocol, or RRDP in short. This protocol is designed to be consistent (in terms of data structures) with the publication protocol and treats publication events of one or more repository objects as discrete events that can be communicated to relying parties. This approach helps to minimize the amount of data that traverses the network and thus helps minimize the amount of time until repository convergence occurs. This protocol also provides a standards based way to obtain consistent, point in time views of a single repository, eliminating a number of consistency related issues. Finally, this approach allows these discrete events to be communicated as immutable files, so that caching infrastructure can be used to reduce the load on a repository server when a large number of relying parties are querying it.
Certification Authorities (CA) in the RPKI use a repository server to publish their RPKI products, such as manifests, CRLs, signed certificates and RPKI signed objects. This repository server may be remote, or embedded in the CA engine itself. Certificates in the RPKI that use a repository server that supports this delta protocol include a special Subject Information Access (SIA) pointer referring to a notification file. The notification file includes a globally unique session_id in the form of a version 4 UUID, and serial number that can be used by the Relying Party (RP) to determine if it and the repository are synchronised. Furthermore it includes a link to the most recent complete snapshot of current objects that are published by the repository server, and a list of links to delta files, for each revision starting at a point determined by the repository server, up to the current revision of the repository. A RP that learns about a notification file location for the first time can download it, and then proceed to download the latest snapshot file, and thus create a local copy of the repository that is in sync with the repository server. The RP should remember the location of this notification file, the session_id and current serial number. RPs are encouraged to re-fetch this notification file at regular intervals, but not more often than once per minute. After re-fetching the notification file, the RP may find that there are one or more delta files available that allow it to synchronise its local repository with the current state of the repository server. If no contiguous chain of deltas from RP's serial to the latest repository serial is available, or if the session_id has changed, the RP should perform a full resynchronisation instead. As soon as the RP fetches new content in this way it should start a validation process. An example of a reason why a RP may not do this immediately is because it has learned of more than one notification location and it prefers to complete all its updates before validating. The repository server may use caching infrastructure to reduce its load. It should be noted that snapshots and deltas for any given session_id and serial number contain an immutable record of the state of the repository server at a certain point in time. For this reason these files can be cached indefinitely. Notification files are polled by RPs to discover if updates exist, and for this reason notification files may not be cached for longer than one minute.
Certificate Authorities that use this delta protocol MUST include an instance of an SIA AccessDescription extension in resource certificates they produce, in addition to the ones defined in ,
This extension MUST use an accessMethod of id-ad-rpkiNotify, see: ,
The accessLocation MUST be an HTTPS URI as defined in , that will point to the update notification file for the repository server that publishes the products of this CA certificate. Relying Parties that choose not to support this delta protocol yet, MUST NOT reject a CA certificate merely because it has an SIA extension containing this new kind of AccessDescription.
When the repository server initialises it must perform the following actions: The server MUST generate a new random version 4 UUID to be used as the session_id The server MUST then generate a snapshot file for serial number ONE for this new session that includes all currently known published objects that the repository server is responsible for. Note that this snapshot file may contain zero publish elements at this point if no objects have been submitted for publication yet. This snapshot file MUST be made available at a URL that is unique to this session_id and serial number, so that it can be cached indefinitely. The format and caching concerns for snapshot files are explained in more detail in . After the snapshot file has been published the repository server MUST publish a new notification file that contains the new session_id, has serial number ONE, has one reference to the snapshot file that was just published, and that contains no delta references. The format and caching concerns for update notification files are explained in more detail in .
Whenever the repository server receives updates from a CA it MUST generate new snapshot and delta files within one minute. If a publication server services a large number of CAs it MAY choose to combine updates from multiple CAs. If a publication server combines updates in this way, it MUST ensure that publication never postponed for longer than one minute for any of the CAs involved. Updates must be processed as follows: The new repository serial number MUST be one greater than the current repository serial number. A new delta file MUST be generated for this new serial. This delta file MUST include all new, replaced and withdrawn objects for multiple CAs if applicable, as a single change set. This delta file MUST be made available at a URL that is unique to the current session_id and serial number, so that it can be cached indefinitely. The format and caching concerns for delta files are explained in more detail in . The repository server MUST also generate a new snapshot file for this new serial. This file MUST contain all "publish" elements for all current objects. The snapshot file MUST be made available at a URL that is unique to this session and new serial, so that it can be cached indefinitely. The format and caching concerns for snapshot files are explained in more detail in . Any older delta files that, when combined with all more recent delta files, will result in total size of deltas exceeding the size of the snapshot, MUST be excluded to avoid that RPs download more data than necessary. The server MAY also exclude more recent delta files if it finds that their usage by a small number of RPs that would be forced to perform a full synchronisation is outweighed performance benefits of having a smaller update notification file. However, the repository server MUST include all deltas that it has available for the last two hours. A new notification file MUST now be created by the repository server. This new notification file MUST include a reference to the new snapshot file, and all delta files selected in the previous steps. The format and caching concerns for update notification files are explained in more detail in . If the repository server is not capable of performing the above for some reason, then it MUST perform a full re-initialisation, as explained above in .
When a Relying Party (RP) performs RPKI validation and learns about a valid certificate with an SIA entry for the RRDP protocol, it SHOULD use this protocol as follows. The RP MUST download the update notification file, unless an update notification file was already downloaded and processed from the same location in this validation run, or because a polling strategy was used (see ). The RP MAY use a "User-Agent" header explained in section 5.5.3. of to identify the name and version of the RP software used. This is not required, but would be useful to help track capabilities of Relying Parties in the event of changes to the RPKI standards. When the RP downloads an update notification file it MUST verify the file format and validation steps described in section . If this verification fails, the file MUST be rejected and RRDP cannot be used. See for considerations. The RP MUST verify whether the session_id in this update notification file matches the last known session_id for this update notification file location. If the session_id matches the last known session_id, then an RP MAY download and process missing delta files as described in section , provided that all delta files for serial numbers between the last processed serial number and the current serial number in the notification file can be processed this way. If the session_id was not previously known, or if delta files could not be used, then the RP MUST update its last known session_id to this session_id and download and process snapshot file on the update notification file as described in section .
If an update notification file contains a contiguous chain of links to delta files from the last processed serial number to the current serial number, then RPs MUST attempt to download and process all delta files in order of serial number as follows. When the RP downloads a delta file it MUST verify the file format and perform validation steps described in . If this verification fails, the file MUST be rejected. Furthermore the RP MUST verify that the hash of the contents of this file matches the hash on the update notification file that referenced it. In case of a mismatch of this hash, the file MUST be rejected. If an RP retrieved a delta file that is valid according to the above criteria, it should perform the following actions: The RP MUST verify that the session_id matches the session_id of the notification file. If the session_id values do not match the file MUST be rejected. The RP MUST verify that the serial number of this delta file is exactly one greater than the last processed serial number for this session_id, and if not this file MUST be rejected. The RP SHOULD add all publish elements to a local storage and update its last processed serial number to the serial number of this snapshot file. The RP SHOULD NOT remove objects from its local storage solely because it encounters a "withdraw" element, because this would enable a publication server to withdraw any object without the signing Certificate Authority consent. Instead it is RECOMMENDED that a RP uses additional strategies to determine if an object is still relevant for validation before removing it from its local storage. In particular objects should not be removed if they are included in a current validated manifest. If any delta file is rejected RPs MUST process the current Snapshot File instead, as described in .
Snapshot Files MUST only be used if Delta Files are unavailable, or were rejected. As is ensured, if the process described in is followed. When the RP downloads a snapshot file it MUST verify the file format and validation steps described in . If this verification fails, the file MUST be rejected. Furthermore the RP MUST verify that the hash of the contents of this file matches the hash on the update notification file that referenced it. In case of a mismatch of this hash, the file MUST be rejected. If an RP retrieved a snapshot file that is valid according to the above criteria, it should perform the following actions: The RP MUST verify that the session_id matches the session_id of the notification file. If the session_id values do not match the file MUST be rejected. The RP MUST verify that the serial number of this snapshot file is greater than the last processed serial number for this session_id. If this fails the file MUST be rejected. The RP SHOULD then add all publish elements to a local storage and update its last processed serial number to the serial number of this snapshot file. If a Snapshot File is rejected that means that RRDP cannot be used. See for considerations.
Once a Relying Party has learned about the location, session_id and last processed serial number of repository that uses the RRDP protocol, the RP MAY start polling the repository server for updates. However the RP MUST NOT poll for updates more often than once every 1 minute, and in order to reduce data usage RPs MUST use the "If-Modified-Since" header explained in section 3.3 of in requests. If an RP finds that updates are available it SHOULD download and process the file as described in , and initiate a new RPKI object validation process. However, a detailed description of the RPKI object validation process itself is out of scope of this document.
If an RP experiences any issues with retrieving or processing any of the files used in this protocol, it will be unable to retrieve new RPKI data from the affected publication server. In order to help prevent this Publication Servers MUST perform regular validation of their own RRDP repository. This protocol document cannot define normative text on recovery strategies for Relying Parties in case of failures with this protocol, as they are by definition out of scope with regard to this specification. That being said Relying Parties would do well to attempt to use an alternative repository retrieval mechanism, such as rsync, if it is available. However, it should be noted that an issue with RRDP at a publication server may well affect its rsync repository as well. Furthermore Relying Parties may wish to employ re-try strategies in case of network issues. Relying Parties are also advised to keep old objects in their local cache so that validation can be done using old objects. It is also recommendable that re-validation and retrieval is performed pro-actively before manifests or CRLs go stale, or certificates expire, to ensure that problems on the side of the RP can be identified and resolved before they cause major concerns.
The update notification file is used by RPs to discover whether any changes exist between the state of the repository and the RP's cache. It describes the location of the files containing the snapshot and incremental deltas which can be used by the RP to synchronise with the repository.
A repository server MAY use caching infrastructure to cache the notification file and reduce the load of HTTPS requests. However, since this file is used by RPs to determine whether any updates are available the repository server SHOULD ensure that this file is not cached for longer than 1 minute. An exception to this rule is that it is better to serve a stale notification file, than no notification file. How this is achieved exactly depends on the caching infrastructure used. In general a repository server may find certain HTTP headers to be useful, such as: Cache-Control: max-age=60. Another approach can be to have the repository server push out new versions of the notification file to the caching infrastructure when appropriate. Relying Parties SHOULD NOT cache the notification file for longer than 1 minute, regardless of the headers set by the repository server or CDN.
Example notification file:
]]>
Note: URIs and hash values in this example are shortened because of formatting. The following validation rules must be observed when creating or parsing notification files: A RP MUST reject any update notification file that is not well-formed, or which does not conform to the RELAX NG schema outlined in of this document. The XML namespace MUST be http://www.ripe.net/rpki/rrdp The encoding MUST be US-ASCII The version attribute in the notification root element MUST be 1 The session_id attribute MUST be a random version 4 UUID unique to this session () The serial attribute MUST be an unbounded, unsigned positive integer in decimal format indicating the current version of the repository. The notification file MUST contain exactly one 'snapshot' element for the current repository version. If delta elements are included they MUST form a contiguous sequence of serial numbers starting at a revision determined by the repository server, up to the serial number mentioned in the notification element. Note that the elements may not be ordered. The hash attribute in snapshot and delta elements must be the hexadecimal encoding of the SHA-256 hash of the referenced file. The RP MUST verify this hash when the file is retrieved and reject the file if the hash does not match.
A snapshot is intended to reflect the complete and current contents of the repository for a specific session and version. Therefore it MUST contain all objects from the repository current as of the time of the publication.
A snapshot reflects the content of the repository at a specific point in time, and for that reason can be considered immutable data. Snapshot files MUST be published at a URL that is unique to the specific session and serial. Because these files never change, they MAY be cached indefinitely. However, in order to prevent that these files use a lot of space in caching infrastructure it is RECOMMENDED that a limited interval is used in the order of hours or days. To avoid race conditions where an RP downloads a notification file moments before it's updated, Repository Servers SHOULD retain old snapshot files for at least 5 minutes after a new notification file is published.
Example snapshot file:
ZXhhbXBsZTE= ZXhhbXBsZTI= ZXhhbXBsZTM= ]]>
The following rules must be observed when creating or parsing snapshot files: A RP MUST reject any snapshot file that is not well-formed, or which does not conform to the RELAX NG schema outlined in of this document. The XML namespace MUST be http://www.ripe.net/rpki/rrdp. The encoding MUST be US-ASCII. The version attribute in the notification root element MUST be 1 The session_id attribute MUST match the expected session_id in the reference in the notification file. The serial attribute MUST match the expected serial in the reference in the notification file. Note that the publish element is similar to the publish element defined in the publication protocol . However, the "tag" attribute is not used here because it is not relevant to relying parties. The "hash" attribute is not used here because this file represents a complete current state of the repository, and therefore it is not relevant to know which existing RPKI object (if any) is updated.
An incremental delta file contains all changes for exactly one serial increment of the repository server. In other words a single delta will typically include all the new objects, updated objects and withdrawn objects that a Certification Authority sent to the repository server. In its simplest form the update could concern only a single object, but it is recommended that CAs send all changes for one of their key pairs: i.e. updated objects as well as a new manifest and CRL as one atomic update message.
Deltas reflect the difference between two consecutive versions of a repository for a given session. For that reason deltas can be considered immutable data. Delta files MUST be published at a URL that is unique to the specific session and serial. Because these files never change, they MAY be cached indefinitely. However, in order to prevent these files from using a lot of space in caching infrastructure it is RECOMMENDED that a limited interval is used in the order of hours or days. To avoid race conditions where an RP downloads a notification file moments before it's updated, Repository Servers SHOULD retain old delta files for at least 5 minutes after they are no longer included in the latest notification file.
Example delta file:
ZXhhbXBsZTQ= ZXhhbXBsZTU= ]]>
Note that a formal RELAX NG specification of this file format is included later in this document. A RP MUST NOT process any delta file that is incomplete or not well-formed. The following validation rules must be observed when creating or parsing delta files: A RP MUST reject any delta file that is not well-formed, or which does not conform to the RELAX NG schema outlined in of this document. The XML namespace MUST be http://www.ripe.net/rpki/rrdp. The encoding MUST be US-ASCII. The version attribute in the delta root element MUST be 1 The session_id attribute MUST be a random version 4 UUID unique to this session The session_id attribute MUST match the expected session_id in the reference in the notification file. The serial attribute MUST match the expected serial in the reference in the notification file. Note that the publish element is similar to the publish element defined in the publication protocol . However, the "tag" attribute is not used here because it is not relevant to relying parties.
The following is a RELAX NG compact form schema describing version 1 of this protocol.
It is RECOMMENDED that Relying Parties and Publication Servers follow the Best Current Practices outlined in on the use of HTTP over TLS (https). Note that a Man-in-the-Middle (MITM) cannot produce validly signed RPKI data, but they can perform withhold or replay attacks targeting an RP, and keep the RP from learning about changes in the RPKI. Because of this RPs SHOULD do TLS certificate and host name validation when they fetch from an RRDP Publication Server However, such validation issues are often due to configuration errors, or a lack of a common TLS trust anchor. In these cases it would be better that the RP retrieves the signed RPKI data regardless, and performs validation on it. Therefore RPs SHOULD log any TLS certificate or host name validation issues they find, so that an operator can investigate the cause. But the RP MUST continue to retrieve the data. The RP MAY choose to log this issue only when fetching the notification update file, but not when it subsequently fetches snapshot or delta files from the same host. Furthermore the RP MAY provide a way for operators to accept untrusted connections for a given host, after the cause has been identified.
RRDP deals exclusively with transfer of RPKI objects from a repository server to a relying party. The trust relation between a CA and its repository server is out of scope for this document. However, it should be noted the from a relying party point of view all RPKI objects (certificates, CRLs, and CMS-wrapped objects) are already covered by object security mechanisms including signed manifests. This allows validation of these objects even though the repository server itself is not trusted. This document makes no change to RPKI validation procedures per se. The original RPKI transport mechanism is rsync, which offers no channel security mechanism. RRDP replaces the use of rsync by HTTPS; while the channel security mechanism underlying RRDP (HTTPS) is not a cure-all, it does make some forms of denial of service attack more difficult for the attacker. HTTPS issues are discussed in more detail in . Supporting both RRDP and rsync necessarily increases the number of opportunities for a malicious RPKI CA to perform denial of service attacks on relying parties, by expanding the number of URIs which the RP may need to contact in order to complete a validation run. However, other than the relative cost of HTTPS versus rsync, adding RRDP to the mix does not change this picture significantly: with either RRDP or rsync a malicious CA can supply an effectively infinite series of URIs for the RP to follow. The only real solution to this is for the RP to apply some kind of bound to the amount of work it is willing to do. Note also that the attacker in this scenario must be an RPKI CA, since otherwise the normal RPKI object security checks would reject the malicious URIs. Processing costs for objects retrieved using RRDP may be somewhat different from the same objects retrieved using rsync: because RRDP treats an entire set of changes as a unit (one "delta"), it may not be practical to start processing any of the objects in the delta until the entire delta has been received. With rsync, by contrast, incremental processing may be easy, but the overall cost of transfer may be higher, as may be the number of corner cases in which the RP retrieves some but not all of the updated objects. Overall, RRDP's behavior is closer to a proper transactional system, which (probably) leads to an overall reliability increase. RRDP is designed to scale much better than rsync. In particular, RRDP is designed to allow use of HTTPS caching infrastructure to reduce load on primary publication servers and increase resilience against denial of service attacks on the RPKI publication service.
IANA is requested to update the reference for id-ad-rpkiNotify to this document in the PKIX Access Descriptor registry .
The authors would like to thank David Mandelberg for reviewing this document.
SMI Security for PKIX Access Descriptor --Apple-Mail=_7C926A38-13BD-4007-BE31-52E9B6CF54D2 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr --Apple-Mail=_7C926A38-13BD-4007-BE31-52E9B6CF54D2-- From nobody Thu Dec 29 09:15:03 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F0E71296AC; Thu, 29 Dec 2016 09:15:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m834OZyWzFW7; Thu, 29 Dec 2016 09:14:59 -0800 (PST) Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0107.outbound.protection.outlook.com [23.103.200.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37B7B129868; Thu, 29 Dec 2016 09:14:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=hS2eRsM0Q/YMdS08xQbXdSRaV13iI0If0+LKNu/a9zw=; b=U2SEsGutuy/wCm2jkrG1nJuu2sMzFCzV+ey0gqhUX81DzJ8Y2+RJm8P89oKv6CO3AoNH/yICV/JW/9f/VGwVmBfXHvd8vtEXxKd3zm2sy2zNhK2qKDsm/zgJxEwhqI/UJPVmzEv+NSDZnNR3ONBqzc8Ibi+6SgTsSFqtxeq91iE= Received: from CY1PR09MB0444.namprd09.prod.outlook.com (10.160.150.25) by CY1PR09MB0443.namprd09.prod.outlook.com (10.160.150.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.803.11; Thu, 29 Dec 2016 17:14:57 +0000 Received: from CY1PR09MB0444.namprd09.prod.outlook.com ([10.160.150.25]) by CY1PR09MB0444.namprd09.prod.outlook.com ([10.160.150.25]) with mapi id 15.01.0803.021; Thu, 29 Dec 2016 17:14:57 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "Alvaro Retana (aretana)" , "draft-ietf-sidr-bgpsec-protocol@ietf.org" , "sidr-chairs@ietf.org" Thread-Topic: Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) Thread-Index: AQHSUmenE2EHhTbiU0q7IXrD4ZYx2aEfNZ3Q Date: Thu, 29 Dec 2016 17:14:56 +0000 Message-ID: References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> In-Reply-To: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=kotikalapudi.sriram@nist.gov; x-originating-ip: [129.6.140.122] x-ms-office365-filtering-correlation-id: efd1aea0-086f-4fd8-8adc-08d4300e36b0 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:CY1PR09MB0443; x-microsoft-exchange-diagnostics: 1; CY1PR09MB0443; 7:DYSeRUQnzW+BiNyloXeNFsPc/gsjgadkoYemyzK0+1W7lA5SeQ9n8BvC0sg/SuSTmvGaeXwciss0E3w6bHthtN+2sShuSSA0GjqURuLE/6NoXtmbrd+EDvk9N5RFKgArfokgRWwjZmWsEnKLVHbsURv4NQy1jjK80+UYefiI/fNozuifR/wJ+4cbvSjvG1f7dPhPmmhqaZ6sZEY7e7DFkvDEKDPWMFuCnb/qfGsAl5Izl8oF2F1FfIMG9CrEpl3Z72EwOygb9Cbypd24paJQqfaq5TqGcRXfdtIGM3Pj7rHFm0t0ympqzBpA2SgGzyE7u5VukcpzWpR6LlKJrvBcl2OT26N4YpPQKD+EQJqa/10QDkFxCnl7cbV7quFTSwNNEjGaPoSVb2yiuuU1q+dwIJXPmgcbPhXfPrG/6nrgSkqRWIqLKwkatxhP12LgyPSoJLFELJ+xUpdkue9eQ8Ju4Q== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(95692535739014)(17755550239193); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123564025)(20161123562025)(20161123555025)(20161123558021)(20161123560025)(6072148); SRVR:CY1PR09MB0443; BCL:0; PCL:0; RULEID:; SRVR:CY1PR09MB0443; x-forefront-prvs: 01713B2841 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39840400002)(39410400002)(39860400002)(39450400003)(39850400002)(377454003)(199003)(189002)(92566002)(54356999)(38730400001)(6506006)(230783001)(6436002)(2900100001)(66066001)(25786008)(2501003)(229853002)(77096006)(33656002)(68736007)(2201001)(81166006)(9686002)(2950100002)(101416001)(74316002)(81156014)(50986999)(6116002)(3660700001)(8676002)(86362001)(102836003)(7736002)(97736004)(122556002)(2906002)(4326007)(106116001)(189998001)(76176999)(7696004)(3846002)(99286002)(105586002)(55016002)(106356001)(5660300001)(5001770100001)(8936002)(305945005)(3280700002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR09MB0443; H:CY1PR09MB0444.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Dec 2016 17:14:56.3797 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR09MB0443 Archived-At: Cc: Matthias Waehlisch , "sidr@ietf.org" Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 17:15:02 -0000 SGkgQWx2YXJvLA0KDQpQbGVhc2Ugc2VlIG15IGNvbW1lbnRzIGlubGluZSBiZWxvdy4NCg0KPkZy b206IEFsdmFybyBSZXRhbmEgKGFyZXRhbmEpIFttYWlsdG86YXJldGFuYUBjaXNjby5jb21dIA0K PlNlbnQ6IEZyaWRheSwgRGVjZW1iZXIgMDksIDIwMTYgNTowMCBQTQ0K4oCmLg0KDQo+SGkhwqAg SSB0aGluayB0aGUgb25seSBpdGVtIGxlZnQgaXMgdGhlIENvbmZlZGVyYXRpb25zIG9uZeKApg0K 4oCmLg0KDQo+WWVzLCBJIGFncmVlIHRoYXQgdGhlIGNvbGx1c2lvbiBwcm9ibGVtIGlzIG9uZSB0 aGF0IChhcyB5b3UgbWVudGlvbmVkIGJlbG93KSANCg0KPmlzIG91dCBvZiB0aGUgc2NvcGUgb2Yg QkdQc2VjLsKgIFlvdSBhcmUgcmlnaHQgdGhhdCBwQ291bnQ9MCAoYXMgcHJvcG9zZWQgYmVsb3cp IA0KDQo+ZG9lc27igJl0IHNvbHZlIHRoZSBjb2xsdXNpb24gcHJvYmxlbSDigJMgYnV0IGl0IGRv ZXMgYWRkcmVzcyB0aGUgZm9sbG93aW5nIA0KDQo+c2VjdXJpdHkgZ3VhcmFudGVlIHRoYXQgaXMg Y3VycmVudGx5IG5vdCBtZXQgaW4gdGhlIENvbmZlZGVyYXRpb25zIGNhc2UgKGZyb20gOC4xKToN CuKApi4NCg0KSW4gdGhlIGxhdGVzdCB2ZXJzaW9uLTIxIG9mIHRoZSBkcmFmdCB0aGF0IEkgdXBs b2FkZWQgbGFzdCBGcmlkYXksIA0KSSBoYXZlIGluY29ycG9yYXRlZCB0aGUgc29sdXRpb24gdGhh dCB5b3UgaGF2ZSBwcm9wb3NlZCwgDQpuYW1lbHksIGFkZGluZyBhIHNpZ25hdHVyZSB3aXRoIHBD b3VudCA9IDAsIA0KYXQgdGhlIGJvcmRlciBvZiB0aGUgY29uZmVkZXJhdGlvbiAoc2VlIDJuZCwg M3JkLCBhbmQgNHRoIHBhcmFncmFwaHMgDQphZGRlZCBuZXdseSBpbiBTZWN0aW9uIDQuMywgcGFn ZSAxOCkuDQoNCkFzIEkgc2VlIGl0LCB0aGlzIHNvbHV0aW9uIG9mZmVycyB0aGUgZm9sbG93aW5n IHRocmVlIGJlbmVmaXRzOg0KDQoxLiBJdCBlbGltaW5hdGVzIHRoZSBkaXNjb250aW51aXR5IGlz c3VlIGF0IHRoZSBjb25mZWRlcmF0aW9uIGJvdW5kYXJ5IGFuZCANCmhlbmNlIGZhY2lsaXRhdGVz IG1haW50YWluaW5nIHRoZSBzZWN1cml0eSBndWFyYW50ZWUgd2l0aGluIGNvbmZlZGVyYXRpb25z IGFzIHdlbGwuDQoNCjIuIEl0IGFsbG93cyBmb3IgdG9sZXJhbmNlIHRvIGxhY2sgb2YgcHJvcGVy IGNvbmZpZ3VyYXRpb24gaW4gYSBCR1BzZWMgc3BlYWtlcg0KaW4gYW4gaW50ZXJpb3IgQVMgaW4g YSBjb25mZWRlcmF0aW9uLCBpLmUuIHdoZW4gc3VjaCBhIEJHUHNlYyBzcGVha2VyDQppcyBub3Qg Y29uZmlndXJlZCB0byBrbm93IGl0cyBjb25mZWRlcmF0aW9u4oCZcyBwdWJsaWMgQVMgbnVtYmVy Lg0KDQpTbyBpdCBhZGRyZXNzZXMgdGhlIGZvbGxvd2luZyBjb21tZW50IHlvdSBtYWRlIGVhcmxp ZXI6DQrigJxJbiB0aGlzIG5ldHdvcmsgQVM2NTAwMyAoZm9yIGV4YW1wbGUpIG9ubHkgbmVlZHMg dG8ga25vdyAoaS5lLiBiZSBjb25maWd1cmVkKSANCnRoYXQgQVM2NTAwMSBhbmQgQVM2NTAwNCBh cyBjb25mZWRlcmF0aW9uIHBlZXJzLCANCmFuZCBub3QgdGhlIHNwZWNpZmljIGtub3dsZWRnZSBv ZiB3aGljaCBpcyB0aGUgY29uZmVkZXJhdGlvbiBJRC7igJ0NCmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWwtYXJjaGl2ZS93ZWIvc2lkci9jdXJyZW50L21zZzA4MTI2Lmh0bWwgDQoNCihSYW5keeKA mXMgcG9zdCBhbHNvIHNlZW1lZCB0byBoaW50IHRoYXQgdGhpcyB0b2xlcmFuY2Ugd291bGQgYmUg dXNlZnVsOg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbC1hcmNoaXZlL3dlYi9zaWRyL2N1cnJl bnQvbXNnMDgxMjcuaHRtbCApDQoNCjMuIEEgY29tbW9uIGRlc2NyaXB0aW9uIG9mIHRoZSB2YWxp ZGF0aW9uIGFsZ29yaXRobSAoU2VjdGlvbiA1LjIpIGFwcGxpZXMgdG8NCmFsbCBCR1BzZWMgc3Bl YWtlcnMuIFRoYXQgaXMsIG5vIGV4Y2VwdGlvbnMgbmVlZCB0byBiZSBzdGF0ZWQgZm9yIA0KQkdQ c2VjICBzcGVha2VycyBpbnNpZGUgYSBjb25mZWRlcmF0aW9uLg0KKFByZXZpb3VzbHkgd2UgaGFk IGRlc2NyaWJlZCBzdWNoIGV4Y2VwdGlvbnMgaW4gU2VjdGlvbiA0LjMsDQpidXQgbm93IHRoZXkg YXJlIG5vdCBuZWVkZWQgYW55IG1vcmUgYW5kIGhlbmNlIGRlbGV0ZWQuKQ0KDQo+UmVsYXRlZCB0 byB0aGUgYWJvdmUsIGlzIHRoZSBzdXBwb3J0IGZvciBwcml2YXRlIEFTTnMgLS0tIA0KdGhpcyB0 b3BpYyBhbHNvIGNhbWUgdXAgaW4gdGhlIHJldmlldyBvZiBkcmFmdC1pZXRmLXNpZHItYmdwc2Vj LW9wcywgDQphbmQgdGhlIEdlbkFydC9TZWNEaXIgcmV2aWV3cy7CoCBUaGVyZSBhcmUgdHdvIHJl bGF0ZWQgcG9pbnRzOg0KDQo+IDEuIEl0IGlzIGNvbW1vbiB0byB1c2UgcHJpdmF0ZSBBU05zIGlu IENvbmZlZGVyYXRpb25zLCANCmJ1dCB0aGUgZ2xvYmFsIFJQS0kgY2Fu4oCZdCBzdXBwb3J0IHRo YXQuICBkcmFmdC1pZXRmLXNpZHItc2x1cm0gc2VlbXMgdG8gYWRkcmVzcyANCnRoZSBpc3N1ZSBv ZiBsb2NhbCBtYW5hZ2VtZW50IG9mIHByaXZhdGUgcmVzb3VyY2VzIGluIHRoZSBSUEtJLiAgDQri gKYNCg0KPiAyLiBQcml2YXRlIEFTTnMgKGFzIHBvaW50ZWQgb3V0IGluIHRoZSBTZWNEaXIgcmV2 aWV3KSBhcmUgY29tbW9ubHkgdXNlZCBmb3Igc3R1YnMuICANClRoaXMgZG9jdW1lbnQgc2hvdWxk IGluY2x1ZGUgc29tZXRoaW5nIChJ4oCZbSB0aGlua2luZyBpbiB0aGUgT3BzIFNlY3Rpb24pIA0K YWJvdXQgdGhlIHByb3RvY29sIGNvbnNpZGVyYXRpb25zOiB0aGVyZSBtdXN0IGJlIGEgUk9BIGZy b20gDQp0aGUgcmVzb3VyY2Ugb3duZXIgZm9yIHRoZSBJU1AgdG8gcHJvcGVybHkgcmUtb3JpZ2lu YXRlIHRoZSBVcGRhdGUsIGV0Yy4uDQoNClRoZXJlIGFyZSB0d28gbmV3IHBhcmFncmFwaHMgaW4g dGhlIG9wcyBhbmQgbWdtdC4gc2VjdGlvbiAoU2VjdGlvbiA3LCBwYWdlIDMwKQ0KdGhhdCBkaXNj dXNzIHByb3BlciBoYW5kbGluZyBvZiBwcml2YXRlIEFTTnMgdGhhdCBtYXkgYmUgdXNlZCBmb3Ig c3R1YiBBU2VzIA0Kb3IgaW5zaWRlIGNvbmZlZGVyYXRpb25zLg0KDQpQbGVhc2UgbGV0IG1lIGtu b3cgaWYgSSBtaXNzZWQgYW55dGhpbmcgb3IgaWYgeW91IHdvdWxkIGxpa2UgdG8gc3VnZ2VzdCAN CmFueSB3b3JkaW5nIGltcHJvdmVtZW50cy4NCg0KVGhhbmsgeW91Lg0KDQpTcmlyYW0NCg0K From nobody Thu Dec 29 15:02:29 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1417E12964B for ; Thu, 29 Dec 2016 15:02:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.001 X-Spam-Level: X-Spam-Status: No, score=-10.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0J76DerZdrFx for ; Thu, 29 Dec 2016 15:02:26 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0131312940C for ; Thu, 29 Dec 2016 15:02:25 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cMjiI-00066E-40; Thu, 29 Dec 2016 23:02:22 +0000 Date: Fri, 30 Dec 2016 08:02:20 +0900 Message-ID: From: Randy Bush To: Kotikalapudi Sriram In-Reply-To: References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-8859-7 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: sidr wg list Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 23:02:27 -0000 >> 2. Private ASNs (as pointed out in the SecDir review) are commonly >> used for stubs. > This document should include something (I=A2m thinking in the Ops > Section) about the protocol considerations: there must be a ROA from > the resource owner for the ISP to properly re-originate the Update, > etc.. that is not the core of the problem. the bgpsec protocol doc has to specifically say that the public AS upon receiving the update from the private AS o if the private signed to the public, public should check sig, then strip it and then might sign as the originating AS or might not. on what criteria does it decide? o if the private did not sign, the public might sign or it might not. on what criteria does it decide? as i said, once you burn that in, i will hack the ops doc randy From nobody Thu Dec 29 15:15:17 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E6C0129736; Thu, 29 Dec 2016 15:15:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.001 X-Spam-Level: X-Spam-Status: No, score=-5.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zceQlcZPjxKl; Thu, 29 Dec 2016 15:15:14 -0800 (PST) Received: from khatovar.hactrn.net (khatovar.hactrn.net [IPv6:2001:418:8006::30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5FBD612970A; Thu, 29 Dec 2016 15:15:14 -0800 (PST) Received: from minas-ithil.hactrn.net (c-73-47-197-23.hsd1.ma.comcast.net [73.47.197.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "nargothrond.hactrn.net", Issuer "Grunchweather Associates" (not verified)) by khatovar.hactrn.net (Postfix) with ESMTPS id 1482313998; Thu, 29 Dec 2016 23:15:13 +0000 (UTC) Received: from minas-ithil.hactrn.net (localhost [IPv6:::1]) by minas-ithil.hactrn.net (Postfix) with ESMTP id 4552D456B7F2; Thu, 29 Dec 2016 18:15:47 -0500 (EST) Date: Thu, 29 Dec 2016 18:15:47 -0500 From: Rob Austein To: tom p. In-Reply-To: <01f101d260f9$dee15c00$4001a8c0@gateway.2wire.net> References: <148226796672.23778.11324483834700038816.idtracker@ietfa.amsl.com> <01f101d260f9$dee15c00$4001a8c0@gateway.2wire.net> User-Agent: Wanderlust/2.15.5 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20161229231547.4552D456B7F2@minas-ithil.hactrn.net> Archived-At: Cc: Chris Morrow , sidr-chairs@ietf.org, ietf@ietf.org, draft-ietf-sidr-rpki-oob-setup@ietf.org, sidr@ietf.org Subject: Re: [sidr] Last Call: (An Out-Of-Band Setup Protocol For RPKI Production Services) to Proposed Standard X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 23:15:15 -0000 At Wed, 28 Dec 2016 10:55:15 +0000, tom p. wrote: > > When I saw BPKI in the Abstract, I thought 'typo'! Reading on, it > isn't; in which case, it needs expanding in the Abstract. > > Appendix A is in RelaxNG; I would like a reference for that language. > > Is Appendix A Normative? i.e. in the event of a mismatch between the > body of the I-D and Appendix A, which wins? If Appendix A, then that > reference should be Normative. Thanks for the review! I agree with all of the above, will post revisions post-LC unless there is reason to update sooner. Yes, I think the RelaxNG schema had best be normative. We already found and fixed one minor disagreement between text and schema; unsurprisingly, running code in that case agreed with the schema. From nobody Thu Dec 29 15:23:46 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E45012988F for ; Thu, 29 Dec 2016 15:23:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.001 X-Spam-Level: X-Spam-Status: No, score=-10.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZgfcOOiNe16r for ; Thu, 29 Dec 2016 15:23:43 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B299C129715 for ; Thu, 29 Dec 2016 15:23:43 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1cMk2v-0006BW-Fc; Thu, 29 Dec 2016 23:23:41 +0000 Date: Fri, 30 Dec 2016 08:23:39 +0900 Message-ID: From: Randy Bush To: Kotikalapudi Sriram In-Reply-To: References: <7055D209-5BF7-4B5D-A675-356CD2CBFF4D@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-2022-JP Archived-At: Cc: sidr wg list Subject: Re: [sidr] Confederations and Private ASNs (WAS: AD Review of draft-ietf-sidr-bgpsec-protocol-18) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 23:23:44 -0000 >> 1. It is common to use private ASNs in Confederations, > but the global RPKI can$B!G(Bt support that. draft-ietf-sidr-slurm seems > to address the issue of local management of private resources in the > RPKI. $B!D(B the issue is not how the confed AS validates ROAs of the private ASs in the confed. that is trivial and supported by existing software. my questions revolve around path processing. 4.3 confuses me by using 'private' ambiguously. i have tried to read that section yet again and drowned in the mass of words. perhaps more coffee will help; but i am not optimistic. i pity the implementors. randy From nobody Fri Dec 30 11:52:20 2016 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AC84E1295F1; Fri, 30 Dec 2016 11:52:18 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.40.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148312753870.21726.3239053599479350203.idtracker@ietfa.amsl.com> Date: Fri, 30 Dec 2016 11:52:18 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-19.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Dec 2016 19:52:18 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing of the IETF. Title : A Profile for BGPsec Router Certificates, Certificate Revocation Lists, and Certification Requests Authors : Mark Reynolds Sean Turner Stephen Kent Filename : draft-ietf-sidr-bgpsec-pki-profiles-19.txt Pages : 13 Date : 2016-12-30 Abstract: This document defines a standard profile for X.509 certificates used to enable validation of Autonomous System (AS) paths in the Border Gateway Protocol (BGP), as part of an extension to that protocol known as BGPsec. BGP is the standard for inter-domain routing in the Internet; it is the "glue" that holds the Internet together. BGPsec is being developed as one component of a solution that addresses the requirement to provide security for BGP. The goal of BGPsec is to provide full AS path validation based on the use of strong cryptographic primitives. The end-entity (EE) certificates specified by this profile are issued (to routers within an Autonomous System). Each of these certificates is issued under a Resource Public Key Infrastructure (RPKI) Certification Authority (CA) certificate. These CA certificates and EE certificates both contain the AS Identifier Delegation extension. An EE certificate of this type asserts that the router(s) holding the corresponding private key are authorized to emit secure route advertisements on behalf of the AS(es) specified in the certificate. This document also profiles the format of certification requests, and specifies Relying Party (RP) certificate path validation procedures for these EE certificates. This document extends the RPKI; therefore, this documents updates the RPKI Resource Certificates Profile (RFC 6487). The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-pki-profiles/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-pki-profiles-19 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-bgpsec-pki-profiles-19 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Dec 30 11:59:14 2016 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ADA61295F7 for ; Fri, 30 Dec 2016 11:59:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2hbtkPktEZdm for ; Fri, 30 Dec 2016 11:59:05 -0800 (PST) Received: from mail-qk0-x22c.google.com (mail-qk0-x22c.google.com [IPv6:2607:f8b0:400d:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F7351295F1 for ; Fri, 30 Dec 2016 11:59:03 -0800 (PST) Received: by mail-qk0-x22c.google.com with SMTP id h201so165432675qke.1 for ; Fri, 30 Dec 2016 11:59:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=QIG0oxHw5T9QwuTaW8aM93mnwPo9ZpJ6U8jshNeXD44=; b=S8l8eP/ti5nqQqSgb8xNjmhLn66C7AmxF03ghAhQJ0TjBluWojrzY1qVdYeBNldS7w Z0kcpBa7ZpmTjhzWy1tKK8GtEnD/E8QUH7IxCnuKfeMpT3bvdIHfQboDc9bJ9SaMzEJ2 ftqn2aDRnGjDER4NBoLSc/nFPNjc3ua/2Oobg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=QIG0oxHw5T9QwuTaW8aM93mnwPo9ZpJ6U8jshNeXD44=; b=B6SpNhPdmYChnnM/gLHInQlXqsjK1cwX8vv98fBmYQF73RJySorx+BSzVGnaDBsQUC tPKi7oKLpK3tSHQz2HhJ0AQhP2O6VQp+bQF+teXU4Wro+FnaPQrNL4RxnpceP5mdPjmY ieqjECbyOJ9aLSrtozhULCBrXoS3Iy8utGgDABWgVtqWiDTYxVY/pmz27qBeNc2d1RYI kjNTFmMYqg6UCcU5HRIN7wWu9u6lOWP7XRFytWTPBd2mhOPzI1kfuaj5+v7I0hE/LxEq tUl60EdMVYyNhAdulmZi4ojizYANL84gfV+yR3xXgnkGNT9N/ZeqdaAiRI9JmAjF2AEe GlUg== X-Gm-Message-State: AIkVDXIXtgv6tAaTFn/aIBkQdTaxvw7Axqs48RE3FOXsoklGUM93387BXDSi3qGlHNgosg== X-Received: by 10.55.44.133 with SMTP id s127mr45288073qkh.131.1483127942465; Fri, 30 Dec 2016 11:59:02 -0800 (PST) Received: from [172.16.0.92] (pool-173-73-120-80.washdc.east.verizon.net. [173.73.120.80]) by smtp.gmail.com with ESMTPSA id 21sm35862666qkh.4.2016.12.30.11.59.01 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 30 Dec 2016 11:59:02 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: <148312753870.21726.3239053599479350203.idtracker@ietfa.amsl.com> Date: Fri, 30 Dec 2016 14:59:00 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: <148312753870.21726.3239053599479350203.idtracker@ietfa.amsl.com> To: sidr wg list X-Mailer: Apple Mail (2.3124) Archived-At: Cc: The IESG Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-19.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Dec 2016 19:59:07 -0000 This version incorporates the comments received to date (Alvaro=E2=80=99s = AD review and GENART). Figured it was better to address these before = the IESG begins their reviews. spt > On Dec 30, 2016, at 14:52, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Secure Inter-Domain Routing of the = IETF. >=20 > Title : A Profile for BGPsec Router Certificates, = Certificate Revocation Lists, and Certification Requests > Authors : Mark Reynolds > Sean Turner > Stephen Kent > Filename : draft-ietf-sidr-bgpsec-pki-profiles-19.txt > Pages : 13 > Date : 2016-12-30 >=20 > Abstract: > This document defines a standard profile for X.509 certificates used > to enable validation of Autonomous System (AS) paths in the Border > Gateway Protocol (BGP), as part of an extension to that protocol > known as BGPsec. BGP is the standard for inter-domain routing in = the > Internet; it is the "glue" that holds the Internet together. BGPsec > is being developed as one component of a solution that addresses the > requirement to provide security for BGP. The goal of BGPsec is to > provide full AS path validation based on the use of strong > cryptographic primitives. The end-entity (EE) certificates = specified > by this profile are issued (to routers within an Autonomous System). > Each of these certificates is issued under a Resource Public Key > Infrastructure (RPKI) Certification Authority (CA) certificate. > These CA certificates and EE certificates both contain the AS > Identifier Delegation extension. An EE certificate of this type > asserts that the router(s) holding the corresponding private key are > authorized to emit secure route advertisements on behalf of the > AS(es) specified in the certificate. This document also profiles = the > format of certification requests, and specifies Relying Party (RP) > certificate path validation procedures for these EE certificates. > This document extends the RPKI; therefore, this documents updates = the > RPKI Resource Certificates Profile (RFC 6487). >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-pki-profiles/ >=20 > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-pki-profiles-19 >=20 > A diff from the previous version is available at: > = https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-bgpsec-pki-profiles-19= >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr