From nobody Thu Mar 3 06:38:26 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5B5A3A0841 for ; Thu, 3 Mar 2022 06:38:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.108 X-Spam-Level: X-Spam-Status: No, score=-7.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NWDDeCiGGkQS for ; Thu, 3 Mar 2022 06:38:19 -0800 (PST) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D75BB3A08C6 for ; Thu, 3 Mar 2022 06:38:18 -0800 (PST) Received: by mail-io1-xd2e.google.com with SMTP id c14so5909829ioa.12 for ; Thu, 03 Mar 2022 06:38:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari.net; s=google; h=mime-version:from:date:message-id:subject:to; bh=esl0lcNcTk+jnCiowtIDyYyy0N5ci+GV3Ycuz8UaM64=; b=f7dqzhajDUMovDXluIYSatmxVNWMvoQMqhsOPYufcApulYeNmCk9rQNXAnqxi+RWI3 5o/0WbmZVOkW6a3a0Uzq8C0vrnAuk+2iuhnUFj6DRDfqF2Y5DEXyuuCMaAMLCXr0fUBh u36NaAcLL/y+RiUZ32j7cwfD8ftafgBRn3Px96bCGw371cThbvoU8KSozmGJgbdFkhdL IF1K8TGchIBkPNhISS+DChnAjL5amV9zmzKqnH+UL8ytDxRdaGrBkWciDa/zF7WEWkFa 6Lr6P24RrcCSzhGa8stHZrZTln5VEYAkiTTi7u3L2HjtinCYaycX1fnW5K10vmO/TZmm UVQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=esl0lcNcTk+jnCiowtIDyYyy0N5ci+GV3Ycuz8UaM64=; b=StSLQs+0diRXmO1BTuSYT4FTi8LvYlTDp2oO0aAS01lc8TWLg7WnwB1Ej+yipVYyp3 kRLuSxoJhdP6HSrgcJhlUduLHbjeyMO2TMc7pW7VQGgN2s+HYBovg1j/aysQb25h7Duc hQalTylRC/2Dugh8Eqs0KXtySTKPezvM/l1VTkCX16I/3FbnOq7YaWWGNG3p6v9odebv 5Myu0HzXKfnF10ZNKcj14cYmQwcJEjR6XacqLbuPotbs5sRTwC18KDDDO5JE8MJMbyhL +64xHHNkevQuFAsGp26rYPf9nme6J6BWHnd1rbwBXVH8XA9ze6Ox9DQ+bgpse/MUa798 sO+Q== X-Gm-Message-State: AOAM5321O59B4IULjALebURnCckw7L+gonfrh2q7To5tVoSikB/FJ+xt 7OzcUzNhUUG5n9ZFb1yCCUksS991ZOqOdnrfji8iXfUZBHuJ7A== X-Google-Smtp-Source: ABdhPJzQWW1H1kzNysV+Gl3MGSZ3/6SfokExwi2YWFWv596ZwP0FXm7FKcqcxhDEctkjx2+c8yYBXHsd5YIXF4Ej7u0= X-Received: by 2002:a02:ce25:0:b0:314:d4cc:b1db with SMTP id v5-20020a02ce25000000b00314d4ccb1dbmr28564860jar.231.1646318296872; Thu, 03 Mar 2022 06:38:16 -0800 (PST) MIME-Version: 1.0 From: Warren Kumari Date: Thu, 3 Mar 2022 09:37:41 -0500 Message-ID: To: SIDR Operations WG , draft-ietf-sidrops-rpki-has-no-identity@ietf.org Content-Type: multipart/alternative; boundary="000000000000460aaa05d9515993" Archived-At: Subject: [Sidrops] AD Review of: draft-ietf-sidrops-rpki-has-no-identity X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2022 14:38:24 -0000 --000000000000460aaa05d9515993 Content-Type: text/plain; charset="UTF-8" Hi there authors and WG, Firstly, thank you very much for this document, and apologies it has taken a while for me to review it. I must admit that I *wanted* to / felt I should be able to use the RPKI to do things like sign LOAs and similar "the RIR says I'm the 'owner', seem mah cert!" type things, and so, even though the document makes me sad, it's useful and needed. I do have a number of editorial comments / nits. Addressing these before IETF LC and IESG review should make progressing the document easier and smoother, as well as being politer to the RFC Editor. Please let me know LOUDLY once you'd had a chance to address them, and I'll start IETF LC. Issues / comments: Sec 1: O: "Though since, it has grown to include..." C: I don't have suggested text, but "Though since" is difficult to parse -- it's not clear from the prior sentence what the "though" or "since" refer to. Perhaps "Since publication of [RFC6480], the term has grown to include ..."? Actually, I'm not really sure what the sentence was trying to say though, so I have no idea if my suggestion works... Nits: Sec 1: O: "In security terms the phrase "Public Key"... " P: "In security terms, the phrase "Public Key" ..." C: Comma. O: "But in reality, the RPKI certificate is only an authorization to speak for for the explicitly identified INRs;" P: "But in reality, the RPKI certificate is only an authorization to speak for the explicitly identified INRs;" C: Repeated 'for' Sec 2: O: "Registries such as the Regional Internet Resistries (RIRs)" P: "Registries such as the Regional Internet Registries (RIRs)" C: Typo O: "That the RPKI does not authenticate real world identity is a feature not a bug." P: "That the RPKI does not authenticate real world identity is a feature, not a bug " C: Comma O: "Note that, if there is sufficient external, i.e. non-RPKI, verifcation of authority" P: Note that, if there is sufficient external, i.e. non-RPKI, verification of authority" C: Typo Sec 4: O: "When a document is signed with the private key associated with a RPKI certificate" P: "When a document is signed with the private key associated with a RPKI certificate" C: s/a/an/ - grammar Misc: s/real world/real-world/g -- I think? ---- Again, I know that many of these are nits, but they'll have to be addressed at some point, and before everyone reads it and gets riled up is best :-) W -- Perhaps they really do strive for incomprehensibility in their specs. After all, when the liturgy was in Latin, the laity knew their place. -- Michael Padlipsky --000000000000460aaa05d9515993 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi there authors and WG,

Firstly, thank= you very much for this document, and apologies it has taken a while for me= to review it.

I must admit that I *wanted* to / f= elt I should be able to use the RPKI to do things like sign LOAs and simila= r "the RIR says I'm the 'owner', seem mah cert!" type= things, and so, even though the document makes me sad, it's useful and= needed.

I do have a number of editorial comments = / nits. Addressing these
before IETF LC and IESG=C2=A0review=C2=A0should make progressing the document
easier an= d smoother, as well as being politer to the RFC Editor.

Please let me know LOUDLY once you'd had a chance=C2=A0to address= them, and I'll start IETF LC.

Issues / commen= ts:=C2=A0
Sec 1:
O: "Though since, it has grown to i= nclude..."
C: I don't have suggested text, but "Though sin= ce" is difficult to
parse -- it's not clear from the prior sent= ence what the "though" or
"since" refer to. Perhaps= "Since publication of [RFC6480], the term has grown
to include ...= "? Actually, I'm not really sure what the sentence was trying to <= br>say though, so I have no idea if my suggestion works...

Nits:
= Sec 1:
O: "In security terms the phrase "Public Key"... &= quot;
P: "In security terms, the phrase "Public Key" =C2= =A0..."
C: Comma.

O: "But in reality, the RPKI certific= ate is only an
=C2=A0 =C2=A0authorization to speak for for the explicitl= y identified INRs;"
P: "But in reality, the RPKI certificate i= s only an
=C2=A0 =C2=A0authorization to speak for the explicitly identif= ied INRs;"
C: Repeated 'for'

Sec 2:
O: "Regi= stries such as the Regional Internet Resistries (RIRs)"
P: "Re= gistries such as the Regional Internet Registries (RIRs)"
C: Typo
O: "That the RPKI does not authenticate real world identity is a= feature
=C2=A0 =C2=A0not a bug."
P: "That the RPKI does no= t authenticate real world identity is a feature,
=C2=A0 =C2=A0not a bug = "
C: Comma


O: "Note that, if there is sufficient ex= ternal, i.e. non-RPKI,
=C2=A0 =C2=A0verifcation of authority"
P:= Note that, if there is sufficient external, i.e. non-RPKI,
=C2=A0 =C2= =A0verification of authority"
C: Typo

Sec 4:
O: "Whe= n a document is signed with the private key associated with a RPKI
=C2= =A0 =C2=A0certificate"
P: "When a document is signed with the = private key associated with a RPKI
=C2=A0 =C2=A0certificate"
C:= s/a/an/ - grammar

=C2=A0Misc:
=C2=A0s/real world/real-world/g --= I think?

----
<= div>Again, I know that many of these are nits, but they'll have to be a= ddressed at some point, and before everyone reads it and gets riled up is b= est :-)

W


--
Perhaps they really do strive for incomprehensibility= in their specs.
After all, when the liturgy was in Latin, the laity kne= w their place.
-- Michael Padlipsky
--000000000000460aaa05d9515993-- From nobody Thu Mar 3 07:52:19 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 693F13A0D5D; Thu, 3 Mar 2022 07:52:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SvogczMKcpYU; Thu, 3 Mar 2022 07:52:11 -0800 (PST) Received: from mail3.g24.pair.com (mail3.g24.pair.com [66.39.134.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E678B3A0D5B; Thu, 3 Mar 2022 07:52:10 -0800 (PST) Received: from mail3.g24.pair.com (localhost [127.0.0.1]) by mail3.g24.pair.com (Postfix) with ESMTP id 711DDE826E; Thu, 3 Mar 2022 10:52:09 -0500 (EST) Received: from [10.0.1.2] (pfs.iad.rg.net [198.180.150.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail3.g24.pair.com (Postfix) with ESMTPSA id 5A069E88AE; Thu, 3 Mar 2022 10:52:09 -0500 (EST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.21\)) From: Russ Housley In-Reply-To: Date: Thu, 3 Mar 2022 10:52:08 -0500 Cc: SIDR Operations WG , draft-ietf-sidrops-rpki-has-no-identity@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <1C80C283-B3B4-41C4-B983-95C7B1775A5C@vigilsec.com> References: To: Warren Kumari X-Mailer: Apple Mail (2.3445.104.21) Archived-At: Subject: Re: [Sidrops] AD Review of: draft-ietf-sidrops-rpki-has-no-identity X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2022 15:52:16 -0000 Warren: Thanks for the review. > Firstly, thank you very much for this document, and apologies it has = taken a while for me to review it. >=20 > I must admit that I *wanted* to / felt I should be able to use the = RPKI to do things like sign LOAs and similar "the RIR says I'm the = 'owner', seem mah cert!" type things, and so, even though the document = makes me sad, it's useful and needed. >=20 > I do have a number of editorial comments / nits. Addressing these > before IETF LC and IESG review should make progressing the document > easier and smoother, as well as being politer to the RFC Editor. >=20 > Please let me know LOUDLY once you'd had a chance to address them, and = I'll start IETF LC. >=20 > Issues / comments:=20 > Sec 1: > O: "Though since, it has grown to include..." > C: I don't have suggested text, but "Though since" is difficult to > parse -- it's not clear from the prior sentence what the "though" or=20= > "since" refer to. Perhaps "Since publication of [RFC6480], the term = has grown > to include ..."? Actually, I'm not really sure what the sentence was = trying to=20 > say though, so I have no idea if my suggestion works... I suggest: "Since initial deployment, the RPKI has grown to include ..." > Nits: > Sec 1: > O: "In security terms the phrase "Public Key"... " > P: "In security terms, the phrase "Public Key" ..." > C: Comma. >=20 > O: "But in reality, the RPKI certificate is only an > authorization to speak for for the explicitly identified INRs;" > P: "But in reality, the RPKI certificate is only an > authorization to speak for the explicitly identified INRs;" > C: Repeated 'for' >=20 > Sec 2: > O: "Registries such as the Regional Internet Resistries (RIRs)" > P: "Registries such as the Regional Internet Registries (RIRs)" > C: Typo >=20 > O: "That the RPKI does not authenticate real world identity is a = feature > not a bug." > P: "That the RPKI does not authenticate real world identity is a = feature, > not a bug " > C: Comma The above suggestions seem fine to me. > O: "Note that, if there is sufficient external, i.e. non-RPKI, > verifcation of authority" > P: Note that, if there is sufficient external, i.e. non-RPKI, > verification of authority" > C: Typo Suggestion for the whole paragraph: Given sufficient external, i.e. non-RPKI, verification of authority, the use of RPKI-based credentials seems superfluous. > Sec 4: > O: "When a document is signed with the private key associated with a = RPKI > certificate" > P: "When a document is signed with the private key associated with a = RPKI > certificate"=20 > C: s/a/an/ - grammar I can see this one either way. >=20 > Misc: > s/real world/real-world/g -- I think? If you mean in Sec 2: s/real world identity/real-world identity/ s/real world documents/real-world documents/ Russ From nobody Thu Mar 3 08:01:57 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 857233A0D62 for ; Thu, 3 Mar 2022 08:01:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.108 X-Spam-Level: X-Spam-Status: No, score=-2.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ntzHr6a4j5CK for ; Thu, 3 Mar 2022 08:01:51 -0800 (PST) Received: from mail-il1-x12e.google.com (mail-il1-x12e.google.com [IPv6:2607:f8b0:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA0D23A0D9E for ; Thu, 3 Mar 2022 08:01:50 -0800 (PST) Received: by mail-il1-x12e.google.com with SMTP id j5so4383461ila.2 for ; Thu, 03 Mar 2022 08:01:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari.net; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=yibGBtPnPfZBVqsiHh6G5Zg0MviLglaoOtEkBTM7mEM=; b=Q/xzLAoBsoAJsUryi5HD2g/eB3CYiqQhDSDtEZ9bMss8x8tAX9UxhIIW7H3iJN5FtW gaCgrWWlWzJd9kD8Yo5mdykXa/1Ezjm1/db9vcaZz3XUZl68UPoJ28u1RgI5KBLRU+1G 1RUQTMGbWpYEGvqPW/DKFLAAvklu8JCuXar2dFXe1MKq+LnTlvXXQfDozZviwsK6V9a1 mDl74hcB3Hz84VjiqCJaUy50Lz2xJ9TZns6UqFhQZLlQdepQTTxnRSokULWUTIoQAZfw LlAI8oTES01cqMsdr4m30ybChMBBOqO44AXR9GKCaDL0T3aYgYFhGM76eEdrm0A+QeJO /L4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=yibGBtPnPfZBVqsiHh6G5Zg0MviLglaoOtEkBTM7mEM=; b=l8RT0PgPt3uLiXXPPE+3HCzFrRYDmi4rOXTZkT/obUAljeCo9KYR4a1MjtcXJSMdwP 94B/DqW/0nCTpoEve2+D3oEOS5tXXZu+bVg0ACgiHRWcr0IsvzHGnmwCVhCIZsI08SBi Se5l8+/Dbtf5EnBLGVRJ1wKXti40cy0ri6oU9Eu3E5qkwp6KSNwive2HBYAVe9+ab8D6 /Zy0cpCzKce8rKL4SmvG/KhS71Evn/kvVbfd6V1SFkRK49/9O0pcte7QPucpxHmbHSk5 WVOdgHlHHahwS+49EFCMMqQu8W1hGYNgPRgmC2PVmV2pdWOauNu+ezfpP2yZM2/Hn68b GnrQ== X-Gm-Message-State: AOAM533qMuxb2u3LvJGiLYBJE1C2G0dZsdBE1/tEkmfResjX4DYUIqpE 5EfDBJhUa/X2deYdCW9wRyyyYeluecs80KGoxM/a5tw+adc= X-Google-Smtp-Source: ABdhPJyaHbOee+hSrS/0oRmQAn7AK36EXc7zSuH3zrwDvk+Uzq0ZNCXz0v1uK3VdWlSWT2bTdCY0XuQR8jJG6E1VntI= X-Received: by 2002:a92:ca47:0:b0:2c2:ab28:1163 with SMTP id q7-20020a92ca47000000b002c2ab281163mr28584982ilo.260.1646323309075; Thu, 03 Mar 2022 08:01:49 -0800 (PST) MIME-Version: 1.0 References: <1C80C283-B3B4-41C4-B983-95C7B1775A5C@vigilsec.com> In-Reply-To: <1C80C283-B3B4-41C4-B983-95C7B1775A5C@vigilsec.com> From: Warren Kumari Date: Thu, 3 Mar 2022 11:01:13 -0500 Message-ID: To: Russ Housley Cc: SIDR Operations WG , draft-ietf-sidrops-rpki-has-no-identity@ietf.org Content-Type: multipart/alternative; boundary="0000000000000602b505d95284b6" Archived-At: Subject: Re: [Sidrops] AD Review of: draft-ietf-sidrops-rpki-has-no-identity X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2022 16:01:56 -0000 --0000000000000602b505d95284b6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Mar 3, 2022 at 10:52 AM Russ Housley wrote: > Warren: > > Thanks for the review. > > > Firstly, thank you very much for this document, and apologies it has > taken a while for me to review it. > > > > I must admit that I *wanted* to / felt I should be able to use the RPKI > to do things like sign LOAs and similar "the RIR says I'm the 'owner', se= em > mah cert!" type things, and so, even though the document makes me sad, it= 's > useful and needed. > > > > I do have a number of editorial comments / nits. Addressing these > > before IETF LC and IESG review should make progressing the document > > easier and smoother, as well as being politer to the RFC Editor. > > > > Please let me know LOUDLY once you'd had a chance to address them, and > I'll start IETF LC. > > > > Issues / comments: > > Sec 1: > > O: "Though since, it has grown to include..." > > C: I don't have suggested text, but "Though since" is difficult to > > parse -- it's not clear from the prior sentence what the "though" or > > "since" refer to. Perhaps "Since publication of [RFC6480], the term has > grown > > to include ..."? Actually, I'm not really sure what the sentence was > trying to > > say though, so I have no idea if my suggestion works... > > I suggest: "Since initial deployment, the RPKI has grown to include ..." > Perfect. > > > Nits: > > Sec 1: > > O: "In security terms the phrase "Public Key"... " > > P: "In security terms, the phrase "Public Key" ..." > > C: Comma. > > > > O: "But in reality, the RPKI certificate is only an > > authorization to speak for for the explicitly identified INRs;" > > P: "But in reality, the RPKI certificate is only an > > authorization to speak for the explicitly identified INRs;" > > C: Repeated 'for' > > > > Sec 2: > > O: "Registries such as the Regional Internet Resistries (RIRs)" > > P: "Registries such as the Regional Internet Registries (RIRs)" > > C: Typo > > > > O: "That the RPKI does not authenticate real world identity is a featur= e > > not a bug." > > P: "That the RPKI does not authenticate real world identity is a featur= e, > > not a bug " > > C: Comma > > The above suggestions seem fine to me. > Thanks! > > > O: "Note that, if there is sufficient external, i.e. non-RPKI, > > verifcation of authority" > > P: Note that, if there is sufficient external, i.e. non-RPKI, > > verification of authority" > > C: Typo > > Suggestion for the whole paragraph: > > Given sufficient external, i.e. non-RPKI, verification of authority, > the use of RPKI-based credentials seems superfluous. > Grteat! > > > Sec 4: > > O: "When a document is signed with the private key associated with a RP= KI > > certificate" > > P: "When a document is signed with the private key associated with a RP= KI > > certificate" > > C: s/a/an/ - grammar > > I can see this one either way. > Me too; I don't really care / whatever you want... > > > > > Misc: > > s/real world/real-world/g -- I think? > > If you mean in Sec 2: > s/real world identity/real-world identity/ > s/real world documents/real-world documents/ There are 12 "real world" instances -- I think that the hyphenated version is cleaner (and some random grammar tool seems to agree), but again, I don't really care. Whatever y'all think. W > > Russ > > --=20 The computing scientist=E2=80=99s main challenge is not to get confused by = the complexities of his own making. -- E. W. Dijkstra --0000000000000602b505d95284b6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Mar 3, 2022 at 10:52 AM Russ = Housley <housley@vigilsec.com> wrote:
War= ren:

Thanks for the review.

> Firstly, thank you very much for this document, and apologies it has t= aken a while for me to review it.
>
> I must admit that I *wanted* to / felt I should be able to use the RPK= I to do things like sign LOAs and similar "the RIR says I'm the &#= 39;owner', seem mah cert!" type things, and so, even though the do= cument makes me sad, it's useful and needed.
>
> I do have a number of editorial comments / nits. Addressing these
> before IETF LC and IESG review should make progressing the document > easier and smoother, as well as being politer to the RFC Editor.
>
> Please let me know LOUDLY once you'd had a chance to address them,= and I'll start IETF LC.
>
> Issues / comments:
> Sec 1:
> O: "Though since, it has grown to include..."
> C: I don't have suggested text, but "Though since" is di= fficult to
> parse -- it's not clear from the prior sentence what the "tho= ugh" or
> "since" refer to. Perhaps "Since publication of [RFC648= 0], the term has grown
> to include ..."? Actually, I'm not really sure what the sente= nce was trying to
> say though, so I have no idea if my suggestion works...

I suggest: "Since initial deployment, the RPKI has grown to include ..= ."


> Nits:
> Sec 1:
> O: "In security terms the phrase "Public Key"... "=
> P: "In security terms, the phrase "Public Key"=C2=A0 ..= ."
> C: Comma.
>
> O: "But in reality, the RPKI certificate is only an
>=C2=A0 =C2=A0 authorization to speak for for the explicitly identified = INRs;"
> P: "But in reality, the RPKI certificate is only an
>=C2=A0 =C2=A0 authorization to speak for the explicitly identified INRs= ;"
> C: Repeated 'for'
>
> Sec 2:
> O: "Registries such as the Regional Internet Resistries (RIRs)&qu= ot;
> P: "Registries such as the Regional Internet Registries (RIRs)&qu= ot;
> C: Typo
>
> O: "That the RPKI does not authenticate real world identity is a = feature
>=C2=A0 =C2=A0 not a bug."
> P: "That the RPKI does not authenticate real world identity is a = feature,
>=C2=A0 =C2=A0 not a bug "
> C: Comma

The above suggestions seem fine to me.


> O: "Note that, if there is sufficient external, i.e. non-RPKI, >=C2=A0 =C2=A0 verifcation of authority"
> P: Note that, if there is sufficient external, i.e. non-RPKI,
>=C2=A0 =C2=A0 verification of authority"
> C: Typo

Suggestion for the whole paragraph:

=C2=A0 =C2=A0Given sufficient external, i.e. non-RPKI, verification of auth= ority,
=C2=A0 =C2=A0the use of RPKI-based credentials seems superfluous.

Grteat!
=C2=A0

> Sec 4:
> O: "When a document is signed with the private key associated wit= h a RPKI
>=C2=A0 =C2=A0 certificate"
> P: "When a document is signed with the private key associated wit= h a RPKI
>=C2=A0 =C2=A0 certificate"
> C: s/a/an/ - grammar

I can see this one either way.

Me too; = I don't really care / whatever you want...=C2=A0
=C2=A0
=

>
>=C2=A0 Misc:
>=C2=A0 s/real world/real-world/g -- I think?

If you mean in Sec 2:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 s/real world identity/real-world identity/
=C2=A0 =C2=A0 =C2=A0 =C2=A0 s/real world documents/real-world documents/=C2= =A0

There are 12 "real world" ins= tances -- I think that the hyphenated version is cleaner (and some random g= rammar tool seems to agree), but again, I don't really care. Whatever y= 'all think.
W
=C2=A0

Russ



--
The computing scientist=E2=80= =99s main challenge is not to get confused by the
complexities of his ow= n making.
=C2=A0 -- E. W. Dijkstra
--0000000000000602b505d95284b6-- From nobody Thu Mar 3 12:30:11 2022 Return-Path: X-Original-To: sidrops@ietf.org Delivered-To: sidrops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E62FB3A07A0; Thu, 3 Mar 2022 12:29:52 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: sidrops@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.46.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: sidrops@ietf.org Message-ID: <164633939288.28333.18303763098050950495@ietfa.amsl.com> Date: Thu, 03 Mar 2022 12:29:52 -0800 Archived-At: Subject: [Sidrops] I-D Action: draft-ietf-sidrops-rpki-has-no-identity-04.txt X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2022 20:30:00 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the SIDR Operations WG of the IETF. Title : The I in RPKI does not stand for Identity Authors : Randy Bush Russ Housley Filename : draft-ietf-sidrops-rpki-has-no-identity-04.txt Pages : 7 Date : 2022-03-03 Abstract: There is a false notion that Internet Number Resources (INRs) in the RPKI can be associated with the real-world identity of the 'owner' of an INR. This document attempts to put that notion to rest. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidrops-rpki-has-no-identity/ There is also an htmlized version available at: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-has-no-identity-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-rpki-has-no-identity-04 Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts From nobody Thu Mar 3 12:33:17 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC0FD3A0120; Thu, 3 Mar 2022 12:33:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VK_l8CCmODdC; Thu, 3 Mar 2022 12:33:15 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 483893A011F; Thu, 3 Mar 2022 12:33:15 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nPs8O-00043C-OY; Thu, 03 Mar 2022 20:33:12 +0000 Date: Thu, 03 Mar 2022 12:33:11 -0800 Message-ID: From: Randy Bush To: Warren Kumari Cc: SIDR Operations WG , draft-ietf-sidrops-rpki-has-no-identity@ietf.org In-Reply-To: References: <1C80C283-B3B4-41C4-B983-95C7B1775A5C@vigilsec.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: [Sidrops] LOUDLY Re: AD Review of: draft-ietf-sidrops-rpki-has-no-identity X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2022 20:33:17 -0000 -04 pushed there were many cases of 'real world' i whacked them all, though i personally thing 'real world' is fine as it is quite unusual. i had to run out and buy a bag of commas; as you seem to like them a lot. randy From nobody Fri Mar 4 11:24:08 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 042363A0D67 for ; Fri, 4 Mar 2022 11:24:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.108 X-Spam-Level: X-Spam-Status: No, score=-2.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gRTWBl6DOjBp for ; Fri, 4 Mar 2022 11:24:00 -0800 (PST) Received: from mail-yb1-xb35.google.com (mail-yb1-xb35.google.com [IPv6:2607:f8b0:4864:20::b35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 474593A0C9F for ; Fri, 4 Mar 2022 11:24:00 -0800 (PST) Received: by mail-yb1-xb35.google.com with SMTP id f5so18795864ybg.9 for ; Fri, 04 Mar 2022 11:24:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari.net; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=57Eyu0D5+VTD4uWyti5zdVR4ud2ei5mtH4n1N1R9TJw=; b=Q6R007WudBewZ3iqOS+KnYNxRrL3Hqw9jwuSVUoYwzwGZAIfRy4ApgnTjOQhBuLZZH OHFY5MtcSj6pKa32Ls3XHtH56/08EW/bsv8Z5dSjr/Q/rsTtWGlno0/gBFfuTe1Kr1W2 foQXvgBTxjEq4J9NmOF0w8YeWp4u/sIeHcwSsDMoKpstIQFzRFlQyGJa/T4awGOGI3cD I106xkQvBEXlAOwm/a+yl46xzzNYRDB+RITkWgAcYWCgWxN7thncpUR0HPH8faZ9nfQA mS+tEa4ugYonAHtn0S4Su4JXnlbgQXYeP+A272m7DURTuqomArnzE8iisB6B4TeAnNaN 7Jig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=57Eyu0D5+VTD4uWyti5zdVR4ud2ei5mtH4n1N1R9TJw=; b=BlklS9fDSr/rMjBUF7aDk1MOGAMv1+X2mZtVJTs7AKwV7XIafF2/U0vBx3vy8bwXnt /YZAAAnI+qTDsMj08qDawlRWYI75m+5hLBIyenN0B+JSodswZaZUgr8aFyrae3po5ncy xViuWVi7JerjHX1DK9P9k+EJDYhgkO41KNBk9ZTRlq4FAoVRJbK3RKgOJX9/EeTE/D9q YL8I4OYqzZFaDNZOjoejgXAfZ5+FCoTx2nBqEzeiH1C3g74t6XPon54gRQ5OUNpknqKh We/Qu29AmG9TC5+2fRK+RnKL2lzqxAKPiVGZZRTw73f9kNHou2FA80/Fy2WTVFcGZvN4 gFCg== X-Gm-Message-State: AOAM533SDbJG71wthG2tdAN0EM+WKAgIKcPuhQBdXp1M7HpPdcp1PJIV RfKXKfW1LhBveNypXMMI0bFaVqMxFCKSzedLWkmIRg== X-Google-Smtp-Source: ABdhPJyG45/gFCmDVAHEgheY9dH2WSXFNFSNVDeR2COj/w70ORbkrHYVo//4zPiK+4MwHTbhlQX8q/xZZzC2EHvGOWY= X-Received: by 2002:a25:32c2:0:b0:628:86af:da05 with SMTP id y185-20020a2532c2000000b0062886afda05mr17755295yby.278.1646421838710; Fri, 04 Mar 2022 11:23:58 -0800 (PST) MIME-Version: 1.0 References: <1C80C283-B3B4-41C4-B983-95C7B1775A5C@vigilsec.com> In-Reply-To: From: Warren Kumari Date: Fri, 4 Mar 2022 14:23:22 -0500 Message-ID: To: Randy Bush Cc: SIDR Operations WG , draft-ietf-sidrops-rpki-has-no-identity@ietf.org Content-Type: multipart/alternative; boundary="000000000000d8e28605d969742e" Archived-At: Subject: Re: [Sidrops] LOUDLY Re: AD Review of: draft-ietf-sidrops-rpki-has-no-identity X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2022 19:24:06 -0000 --000000000000d8e28605d969742e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Mar 3, 2022 at 3:33 PM Randy Bush wrote: > -04 pushed > Thanks, IETF LC requested / started. > > there were many cases of 'real world' i whacked them all, though i > personally thing 'real world' is fine as it is quite unusual. > > i had to run out and buy a bag of commas; as you seem to like them a > lot. > Yup, I get mine in bulk at Costco.... (actually, I run drafts through a grammar tool (Grammarly); it doesn't do a perfect job (to some extent because it believes that every hard newline in a text document is a new sentence, and also because, well, terminology), but it is useful to me for review) W > > randy > --=20 The computing scientist=E2=80=99s main challenge is not to get confused by = the complexities of his own making. -- E. W. Dijkstra --000000000000d8e28605d969742e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Mar 3, 2022 at 3:33 PM Randy = Bush <randy@psg.com> wrote:
<= /div>
-04 pushed

Thanks, IETF LC requested / started.
= =C2=A0

there were many cases of 'real world'=C2=A0 i whacked them all, tho= ugh i
personally thing 'real world' is fine as it is quite unusual.

i had to run out and buy a bag of commas; as you seem to like them a
lot.

Yup, I get mine in bulk at Costco.= ...


(actually, I run drafts through= a grammar tool (Grammarly); it doesn't=C2=A0do a perfect job (to some = extent because it believes=C2=A0that every hard newline in a text document = is a new sentence, and also because, well, terminology), but it is useful t= o me for review)
W


=C2=A0

randy


--
The computing scientist=E2=80= =99s main challenge is not to get confused by the
complexities of his ow= n making.
=C2=A0 -- E. W. Dijkstra
--000000000000d8e28605d969742e-- From nobody Fri Mar 4 12:08:13 2022 Return-Path: X-Original-To: sidrops@ietf.org Delivered-To: sidrops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D9273A0ED3; Fri, 4 Mar 2022 12:07:54 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 7.46.0 Auto-Submitted: auto-generated Precedence: bulk CC: draft-ietf-sidrops-rpki-has-no-identity@ietf.org, morrowc@ops-netman.net, sidrops-chairs@ietf.org, sidrops@ietf.org, warren@kumari.net Reply-To: last-call@ietf.org Sender: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <164642447410.28300.14979172722907480601@ietfa.amsl.com> Date: Fri, 04 Mar 2022 12:07:54 -0800 Archived-At: Subject: [Sidrops] Last Call: (The I in RPKI does not stand for Identity) to Proposed Standard X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2022 20:07:55 -0000 The IESG has received a request from the SIDR Operations WG (sidrops) to consider the following document: - 'The I in RPKI does not stand for Identity' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the last-call@ietf.org mailing lists by 2022-03-18. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract There is a false notion that Internet Number Resources (INRs) in the RPKI can be associated with the real-world identity of the 'owner' of an INR. This document attempts to put that notion to rest. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-sidrops-rpki-has-no-identity/ No IPR declarations have been submitted directly on this I-D. From nobody Sat Mar 5 08:59:28 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D4AB3A080B for ; Sat, 5 Mar 2022 08:59:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zs18QIPO4smb for ; Sat, 5 Mar 2022 08:59:23 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C7663A0029 for ; Sat, 5 Mar 2022 08:59:23 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nQXkV-000E5b-NP; Sat, 05 Mar 2022 16:59:19 +0000 Date: Sat, 05 Mar 2022 08:59:19 -0800 Message-ID: From: Randy Bush To: Keyur Patel Cc: SIDR Operations WG In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Mar 2022 16:59:27 -0000 why i signed on to co-author this document: fasten seat belts, and take the little yellow pill to think at internet scale. the numbers below are fictitious; no prefixes or ASs were harmed ... i have 420 /24s registered in the repo for my AS 666, folk do seem to deaggrgate, and we are being taught not to use max-len, eh? i move one of those /24s to my other pop/continent/whatever, AS 777 we have seen that the CA withdraws the ROA for 420 prefixes on AS 666 and then issues a new ROA for 419 prefixes on AS 666 (and one on AS777) these two *separate* actions are published in the CA's PP 234 RPs across the internet pick them up 234 RPs across the internet chop the withdrawn ROA into 420 withdraw VRPs and send the VRPs to their routers ghod knows what those routers then do to BGP the 234 RPs chop the new announcement into 419 VRPs and send to their routers ghod knows what those routers then do to BGP and the poor routers are processing all that dren. and we know the quality of their implementations has a bit of variance and i just wanted to move one little /24 and this whole protocol set was designed to minimize impact on routers so it could run lightly on existing hardware yes, i am suggesting you publish 420 separate ROAs; they're cheap. and then we can act on them individually. my mommy taught me that it was not polite to 'support' a draft on which one is a co-author. but i do suggest others read, comment, and, if they agree, support. randy From nobody Sun Mar 6 17:06:43 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 936FE3A07D6 for ; Sun, 6 Mar 2022 17:06:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x5eGTHe1zqjp for ; Sun, 6 Mar 2022 17:06:35 -0800 (PST) Received: from khatovar.hactrn.net (khatovar.hactrn.net [198.180.150.30]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CAFE3A07AC for ; Sun, 6 Mar 2022 17:06:35 -0800 (PST) Received: from minas-ithil.hactrn.net (c-73-100-88-186.hsd1.ma.comcast.net [73.100.88.186]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "nargothrond.hactrn.net", Issuer "Grunchweather Associates" (not verified)) by khatovar.hactrn.net (Postfix) with ESMTPS id C87584E614; Mon, 7 Mar 2022 01:06:33 +0000 (UTC) Received: from minas-ithil.hactrn.net (localhost [127.0.0.1]) by minas-ithil.hactrn.net (Postfix) with ESMTP id 8FFE72EA00F6; Sun, 6 Mar 2022 20:06:32 -0500 (EST) Date: Sun, 06 Mar 2022 20:06:32 -0500 From: Rob Austein To: Keyur Patel Cc: "sidrops@ietf.org" In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.1 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Message-Id: <20220307010632.8FFE72EA00F6@minas-ithil.hactrn.net> Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Mar 2022 01:06:41 -0000 I support publication of this draft. Two comments, for whatever they're worth: 1) In retrospect, the ability to specify multiple prefixes in a single ROA seems like premature optimization: it's solving a problem I'm not convinced we really have, at the expense of creating a new one. 2) I tend to think about the multiple-prefix ROA problem in terms of "fate sharing": unless all the prefixes involved are in some way so closely tied to each other that there will never be a change to one of them that isn't a change to all, they should be separate ROAs. From nobody Sun Mar 6 17:37:47 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11BED3A088F for ; Sun, 6 Mar 2022 17:37:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=algebras-org.20210112.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FZKsnQA-DKmy for ; Sun, 6 Mar 2022 17:37:28 -0800 (PST) Received: from mail-lj1-x230.google.com (mail-lj1-x230.google.com [IPv6:2a00:1450:4864:20::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 910B03A08AE for ; Sun, 6 Mar 2022 17:37:27 -0800 (PST) Received: by mail-lj1-x230.google.com with SMTP id u7so18222239ljk.13 for ; Sun, 06 Mar 2022 17:37:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=algebras-org.20210112.gappssmtp.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=vF/I1EkwrJhHpQxjDb0TFSI5o+BUkqMfg5HK7T5/xFA=; b=t30OuZZ3mS1QrPX1pVHHp475AkHXDsmc33BDb6XpM8wJDCSRzXUcjllfrXJJIGnN24 tQ0Ay+q0RWMUAnq0CdNz8MYqGYS6bKIHz/X2y3wq+mgHq12kopxz3UwWR7i1+gsvEJwQ kRBBFxGhezDELDNMIr1FxgmNZBVZNci7cYOCfJExbR3jFJRnXtTLAyWshbv9SbDwXIxy k5g7ZjtypYdtrU/57PkAd/tignAfdIGzKCicR7ZfIZ+IK2ad0q0APyb0hoGOoyGAQYZ4 md/UsBhLQEQczysfcz2mWlyNzTgDwjtNHuuYERUV22YdNgGdiMeuB5vFw+zjdjcOIM9Y /rcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=vF/I1EkwrJhHpQxjDb0TFSI5o+BUkqMfg5HK7T5/xFA=; b=FETpVrjFzxcLzEj9jL2uY3rPrDeXFB2J6kguy0MohhMq8O1VROYaVYL9zG2MEsPOiI 5q3018LaK5oGRCEL8PjCWaRIUlbw8eo70ojJkl6oM8nuWd14zLUpBUdJ+5gG4swscgJr iN0aBjMmDGIBxBmEdlqlztWfPixT22FZFB3guQVfl1IL4yela4+SifMjQl+O2WijuPug 3fmYkt9xYQfYuCYc6w2MWZ+BfdL1D95nVQUU2Gxcbsb1ph/m9L4+bhCi5lKyHq9/3wZx o2iICO5llk9UsaoDFbmCY7SPR5fq+vPSG/I78buhdxt/NRq6wet0UOcFtISOuAPDFAe+ 8/Sg== X-Gm-Message-State: AOAM532wc1plYxGNQDM5bggiByZcrOznaEe0Cf5XuLBPe3mtbo7Cg0Xd bu2lBjMaRPZ6oAUdvuRPr6fLbJBGPSN0BJCeSZelBTkW9Dw= X-Google-Smtp-Source: ABdhPJzftHK3WX/elORIhxVM+MOeSzwL7UnvsM2uiLif9e+4j96GIO11Le/YnDD8W/3N+3kgMj3xL8BHQxDvhGX1Vy8= X-Received: by 2002:a2e:8496:0:b0:246:4e82:c7d3 with SMTP id b22-20020a2e8496000000b002464e82c7d3mr5919996ljh.460.1646617044761; Sun, 06 Mar 2022 17:37:24 -0800 (PST) MIME-Version: 1.0 References: <20220307010632.8FFE72EA00F6@minas-ithil.hactrn.net> In-Reply-To: <20220307010632.8FFE72EA00F6@minas-ithil.hactrn.net> From: George Michaelson Date: Mon, 7 Mar 2022 11:37:13 +1000 Message-ID: To: "sidrops@ietf.org" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Mar 2022 01:37:39 -0000 I am not a BGP speaker and I don't forward packets. I no longer have a role in the Registry RPKI service delivery here at APNIC so in many respects my comments are superfluous. That noted, I support publication. I was asked by one of the authors to comment, otherwise I would have remained silent given my lack of role in things: On the whole, I think it is better for the BGP speakers, the RP and CA developers, to be the voices heard here these days. I have read this draft, and I think it provides useful information regarding the distribution of ROA and contents under each TA, as of last year. It also provides non normative recommendations to single prefix per ROA. Any quibbles I have to language could be dealt with, and have no impact on the semantic intent of the document: I would be amazed if they aren't ironed-out in the publication process anyway. The analysis shows that many ROA are made by hosted services in two RIR (RIPE and APNIC) as of 2021 so we probably need to reflect on what has to change to stop grouping up the contents, or how to specify if you want this not to be done as a delegate controlling resources. This may be OBE anyway, understanding the producer side code behaviours would be good but doesn't really hinder publication noting that the document is non normative advice. Thats for other people to speak to, I no longer occupy the role which has to determine what to do here. I think Rob's comment to "premature optimisation" is a good one. Allowing multiple prefix per ROA was done for good intent, that it turns out to be counter-productive is a shame, but reality trumps. I do have some concerns about the impact of unwinding the multiple prefix per ROA model, but this has to go to scale/time questions not absolute ones: we can expect the volume of ROA to increase anyway so this is about changing the rate of update and volume of discrete objects, and consequence to RRDP delta size, and rsync serial fetch size/delay which was going to be met anyway in due course. I think RP implementations which unpick VRP to then subsequently re-assert validity possibly need to change to do more of the 'hysteresis' preserving behaviour in FIB and RIB we see in BGP seeking to limit change. To me, this goes to the 'all information, not atoms' idea behind the repository fetch model that we have. It would not be this document which helped fix or ameliorate that problem so I see no barrier to publication. -George From nobody Sun Mar 6 18:02:28 2022 Return-Path: X-Original-To: sidrops@ietf.org Delivered-To: sidrops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6288C3A0817; Sun, 6 Mar 2022 18:02:25 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: sidrops@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.46.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: sidrops@ietf.org Message-ID: <164661854534.9143.14008577014418310525@ietfa.amsl.com> Date: Sun, 06 Mar 2022 18:02:25 -0800 Archived-At: Subject: [Sidrops] I-D Action: draft-ietf-sidrops-signed-tal-09.txt X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Mar 2022 02:02:26 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the SIDR Operations WG of the IETF. Title : RPKI Signed Object for Trust Anchor Key Authors : Carlos Martinez George G. Michaelson Tom Harrison Tim Bruijnzeels Rob Austein Filename : draft-ietf-sidrops-signed-tal-09.txt Pages : 18 Date : 2022-03-06 Abstract: A Trust Anchor Locator (TAL) is used by Relying Parties (RPs) in the Resource Public Key Infrastructure (RPKI) to locate and validate a Trust Anchor (TA) Certification Authority (CA) certificate used in RPKI validation. This document defines an RPKI signed object for a Trust Anchor Key (TAK), that can be used by a TA to signal the location(s) of the accompanying CA certificate for the current key to RPs, as well as the successor key and the location(s) of its CA certificate. This object helps to support planned key rolls without impacting RPKI validation. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidrops-signed-tal/ There is also an HTML version available at: https://www.ietf.org/archive/id/draft-ietf-sidrops-signed-tal-09.html A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-signed-tal-09 Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts From nobody Sun Mar 6 20:53:46 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81ED13A0D41 for ; Sun, 6 Mar 2022 20:53:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.11 X-Spam-Level: X-Spam-Status: No, score=-7.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=apnic.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mfogXy-Xs7_8 for ; Sun, 6 Mar 2022 20:53:38 -0800 (PST) Received: from AUS01-ME3-obe.outbound.protection.outlook.com (mail-me3aus01on20621.outbound.protection.outlook.com [IPv6:2a01:111:f403:7004::621]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DF9C3A0D3F for ; Sun, 6 Mar 2022 20:53:37 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cVs8FKvkGjp4Oaw3wd/gTMbbl8kqABsnJl8utEI5p+70C7e/BYJoqyFi3TPxPLKXXgHV2i09EsYsxCDs/hvIoE/zas6rsk7DFdgUsTxMHd9zBFrvyOIh5t+KMtBViEYEiVtbTzHnRkvSOk2WRwEQjyJt3ZYbI59A7WUOsKIWCsXK2cu2Pl6ltUNwl40MdfexHvcSwIDwpDAqCWuT7bymvrHWrij+SoKqMm+j5Erfe+0Fd359sYgR+ceofsvMMadHduZbUeBNWa6gPNjKWrpGmBe+vjNQoroJ9t33jIkE006JK5HFzuU0lnrYXJjE25yYc1JuL7EmPi7FXbz6RtfQLg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dhwEI9FUyzrTcKJAJUNtLYyWKLuTDRq+SoVcRpw1sC8=; b=VM9a5g0NFg6LHtP+1gR4D1ezN2wdJz5xxUoVTh4NmHdtcC2sZkOyOaTG9rQlQlaoUqy4BkmN5hzqSLbkj8AHYLU5GpMrBw0LugdRlD/LZugzDBYxfyoxuxehK25DG5Rvs5S35AGwzY3rPKLT5+vpfZhH3hmr/OaZBXx19hFQE+EM+6LbIu3KiDug8+PqdiaszWa/G2+SQh52iOSr7ZZCJ5hiQep9r2YUrIWLHiX32tPUFInLF4bZFiRoxyhImtKWjhIi68bJNeAFDzaxVWN0NRENqcUJ0rt8Ru2QshhzNiBkWEEZKDjBmnNPQv6XzdzXKIZwhqm2K1EHEcx74wllIQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=apnic.net; dmarc=pass action=none header.from=apnic.net; dkim=pass header.d=apnic.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apnic.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dhwEI9FUyzrTcKJAJUNtLYyWKLuTDRq+SoVcRpw1sC8=; b=ieoFCEdpNdue2eOlM8bTk2NzW9cd2Jbv0e6zpVzAEHELZ5U2SpIKpb4axlyYZpXASkmBVRFb3EeHoSn/6hnDhZSQMUkdemP3qUaNk7WN0YPslFVi8RBBrcTEjs9nmZXv3TFmjTayyq/U9tfw5M07SkQbqQR2cRgsceNaxUOe/1c= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=apnic.net; Received: from SYBP282MB0553.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:68::12) by MEAP282MB0694.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:63::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5038.17; Mon, 7 Mar 2022 04:53:28 +0000 Received: from SYBP282MB0553.AUSP282.PROD.OUTLOOK.COM ([fe80::701a:7895:90e3:60b5]) by SYBP282MB0553.AUSP282.PROD.OUTLOOK.COM ([fe80::701a:7895:90e3:60b5%4]) with mapi id 15.20.5038.026; Mon, 7 Mar 2022 04:53:28 +0000 Date: Mon, 7 Mar 2022 14:53:27 +1000 From: Tom Harrison To: Keyur Patel Cc: "sidrops@ietf.org" Message-ID: Mail-Followup-To: Keyur Patel , "sidrops@ietf.org" References: Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-ClientProxiedBy: SYAPR01CA0039.ausprd01.prod.outlook.com (2603:10c6:1:1::27) To SYBP282MB0553.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:68::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0a056a33-4fac-4aeb-6238-08d9fff66be1 X-MS-TrafficTypeDiagnostic: MEAP282MB0694:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: q0lM63Kku0MsiKZ8uv0gQjYa/ecXRUK+pE3XbGv6Z44ibi7e8ztE76nyQgjiNLjpVPQ3Qmq5H9XNscqYv640K1B6d9gdDmcVvGqjsee7qCRzlUYlBd6u0EphETX3aVkb3agpT7XTwgYtVP9dd2Gbud7V9316U7JwyP8dZphZqT1uekZNG9eV0yA8z/eJ1EW+3OxFNItRePQLWBcsnDl6pD0YkTQeKEKRY4oC4RYqq3akTYevzrE8MIGwzrAT2C/ue+8RX1jkrRoC4n66UDMLAZXfe+u2upwqXdS5s8HfkOLd1KzUpirTQUbY4CirF6h9CxqPebsj09mcWeKlsLWaoLMoZHnfhKWNrfjpdKBW5Uoa2C/nlDwh9k9Lqhcl/Ix5+m4TMmIS9QPgSbwOJQbYcSk1KNuLtL4hetN3te5C4ozdv1HD48d9/oc7pzXeOVEWfEyrcISXJzBjeJ1IZonwh59i2YWoajspwiAeJwiDNu5Ra8DGi+ReITnZtU+4sKBdMWXJSCLVtwO/PI6Zo0fDHSzQwA0UezuGT5Ugqn74KavX61BPcmUbGVMzxTzuIgDE1WKTx5zqcZcsgkKibxvbzCVuqkxy5gb3+fRvC/3S4/V6N0g+KQl4+FJVbPDznlqmbENHlH+NOJDx4NTYeoRfNFjK9lgZYm1PnrkU8uKjLy/IVCgYxdu1oXB8LesGvMg9/C4UzPqAqkR/am0B8GQA3CtuaFbWURrnwoaWzO57ZP5yOxhEsloz06/M6Ldoqg0EIhDMEyCmiqqAL+/huxf8KjPon5lr41vALHKb/4xlouYclolp4qMVsNgRS/HmKFuW X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SYBP282MB0553.AUSP282.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230001)(4636009)(7916004)(346002)(39840400004)(366004)(376002)(396003)(136003)(6916009)(38100700002)(38350700002)(6512007)(9686003)(316002)(26005)(186003)(508600001)(6486002)(966005)(6506007)(52116002)(5660300002)(33716001)(2906002)(8936002)(66476007)(66556008)(8676002)(4326008)(4744005)(66946007)(86362001)(67856001); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?eGlmNk5nc0Q2VGs1MzcyUDdaWGtPUGhTUXNrNHBGMUsxdHFBNDlvQ3ZvQ01N?= =?utf-8?B?YVN4c3Nlazc5RCtic2sxc1N3WEhBN21TZEpEbjc0UDNFVHRYbTdHTFJ3TFhs?= =?utf-8?B?TFFIbWxLYVlDOWZsU3BTb1NOZ05NWkhlem91UW1uZUNzV015RjNUV21NMEY2?= =?utf-8?B?RXNxS1JlT0RSL2VpUnBlRGhDRlJNVGZldUdMc29xMWc2ZE5VazloTkxQNDhU?= =?utf-8?B?QnFTcnVMczNlV0FITjhuOHRSZzJrb1Q1alFJMEs5WGRvaEFoYkZ1UXNBWE5z?= =?utf-8?B?TXh1ZHBOSTlCbDdwUjNxcDVWaWlEUkE1ZDhrYmtBWEFURjhrWnhTSXRTM2JC?= =?utf-8?B?QzdPQzFxeHRTK0VTa0NycklsTGpDM1hCbURrWExWMS9IZ205aTRna0F0MzU5?= =?utf-8?B?ejM0RFJDQ1lOTjRGbzBacWdveHYwQnQwS0xaQmE2S0JJeFNaUVF1YjU5Vnd1?= =?utf-8?B?YXFZSFlVZ1MzTkNVU3N5SWtHTmZiSkZ2VGs2NnhDWWI4Sk9KTzJOdUovZWpS?= =?utf-8?B?dWpjRzVUQzc2N0p0N1drRUQ4akV0T3VTakZrQTFDcWhqcU1sMEVIQzBIMUhC?= =?utf-8?B?aE81RWVXcS8xVFFZdkp2Y1pvTW53SkwrZDlmQ00zK1N0NHI1VUY3UlByVzhK?= =?utf-8?B?SkFYR3ZYdmdkK2F3Q3oxTHUzaVRheFpVMG55aXRMckU3bUFiVElGellKaERE?= =?utf-8?B?cnBqWVhDQU85MFVkQm5hVkI2WWVzUGNMZEdzYmtsRnlxYzE1dDBoNVltWS8r?= =?utf-8?B?bjNuV215a3ZVZkUxNWpqRHptVG5iREd4dDZOdXVyR3JUTzc3QlJQTVNxeGN2?= =?utf-8?B?ZCtETjh5L3ZEYXJLOTlQSE9BbGtaaDNSeC9nb29oRFVqZWg3VUUrellsajNY?= =?utf-8?B?Lzl1OFRFQ2VpREs2dXRzYUZIVFhUZVgvdFFyVW9hdUJTd1JnSEpIQ0xPUkdN?= =?utf-8?B?SlJ0b2NWQzI1Ti8vSzB4dGRJQXRPOHNibWJZSnN2MFN0ZGdmZXR5UUkrdWZS?= =?utf-8?B?N0VBOVpGcTlhalE2ZmR6V04zVVIwbHk1Z2dIZ0JFeU9XS2cvd3B0Uzd2ZHVO?= =?utf-8?B?SW5TaFJoSWZjZ2lwVmpoYXc5UEsyVC9SbTRWSkZPT29ueGxjUytSdnAvTlpr?= =?utf-8?B?RnRHRnBaaGFESExvQlVEMUNuTkpqbjRxOG9vVUhFcURkV1lsNFpwWXkyTWVk?= =?utf-8?B?c1pDejJXQWlVM2xkR09DUUFrTnlYT2l5L0ZqbEM3RncxbE83VFZISVpLZmpk?= =?utf-8?B?QTMya1NZUFdsa0p1dm5MTit3RWJINVJnbmZsUzlHWTN4Ujl3bENYV3Vvbk1Z?= =?utf-8?B?aHo0SlBjc0E0N1dsNmtBY0Rsc0M3SEZ3dUpOaFlrUFpROXVOK05zS0Q1MTMv?= =?utf-8?B?MVA1MHkrQ3Y3Q0tXbFJvOG9LdzdPRklXckdwZ290QWVlb2N1S1YrQ0Y2dVBv?= =?utf-8?B?dy9TK1ZXTE5MRHZxdkNtbFNMYjF3WEkrSlFXK3I0QkZERjYzMkZic3FKbG01?= =?utf-8?B?Nm9iZmxWb2xOWnAzOUN1NUwyMGpIdlhhRTVlbTlTLzdMamNVUE16cmlCSWNJ?= =?utf-8?B?UStLSU9PRWtablNzZXJOS01EcXM3bk9aZ2hzRUxmUmRqbFJkRTlGRXdBT1hL?= =?utf-8?B?OWd2N2x3MXROQk5vd0daVzE3LytvV09qNldvcGc5VWxFS1c4dUMxc2lUUVFV?= =?utf-8?B?SUVuYlk3TTlQQkJDZk5GMzZxRFFDWUE0Q2g1WXozQXhDQjlCcDAwWnB5K01S?= =?utf-8?B?QkVqN0NxdHdNY3NSVGplQjM3TGxRWTRIRE8wR09uN3FSbjFtbTc2cHBmbSt3?= =?utf-8?B?bzZxWS8rTjdnTHlhMFNRUmtvTXJWMVVGUm5iTFdWM05jOWpKbXUzVTdZU3pD?= =?utf-8?B?N2s3eUtxUWZETHUzbzgxa2lBRGZLVHNESDdnTU9nSEdlWW1LbWxHM1lvSmNy?= =?utf-8?B?a2tMVnQyc1RvV211M0VXNE1nNWR0NGszZWhteXZqVURQK3pzQmJSUldmMTV5?= =?utf-8?B?LzVmV0xUVm5JSVV2T0c0ZmpnMEJKKzhzay9jRVl2by83L2k3NzBCdTJDUWx2?= =?utf-8?B?WDBCeXVQWE9mMTBySWY3NkVoY0pZQ0JYNVBqQXNvaGZaSmpwelBBTlRrcUMw?= =?utf-8?Q?QKaM=3D?= X-OriginatorOrg: apnic.net X-MS-Exchange-CrossTenant-Network-Message-Id: 0a056a33-4fac-4aeb-6238-08d9fff66be1 X-MS-Exchange-CrossTenant-AuthSource: SYBP282MB0553.AUSP282.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Mar 2022 04:53:28.8637 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 127d8d0d-7ccf-473d-ab09-6e44ad752ded X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: fDKjhDnO0JmJFEpN6XlZmpaeNN0YdomRYS+xQprCjSikLKS3zmCXfxsPqgsbFOnY X-MS-Exchange-Transport-CrossTenantHeadersStamped: MEAP282MB0694 Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Mar 2022 04:53:44 -0000 On Thu, Feb 24, 2022 at 10:47:16PM +0000, Keyur Patel wrote: > A working group last call has been issued for > draft-ietf-sidrops-roa- considerations-01, “Problem Statement and > Considerations for ROA containing Multiple Prefixesâ€. Please reply > to the list with your comments. The WGLC will end on March 10th, > 2022. > > The draft can be found at: > https://datatracker.ietf.org/doc/draft-ietf-sidrops-roa-considerations/. I've read this document and support publication. -Tom From nobody Mon Mar 7 01:49:08 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBB223A0D3B for ; Mon, 7 Mar 2022 01:49:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zuQQ3noDqI1X for ; Mon, 7 Mar 2022 01:48:52 -0800 (PST) Received: from outbound.soverin.net (outbound.soverin.net [116.202.126.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F94C3A0D25 for ; Mon, 7 Mar 2022 01:48:51 -0800 (PST) Received: from smtp.soverin.net (unknown [10.10.3.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by outbound.soverin.net (Postfix) with ESMTPS id 6E8872C1 for ; Mon, 7 Mar 2022 09:48:46 +0000 (UTC) Received: from smtp.soverin.net (smtp.soverin.net []) by soverin.net Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.40.0.1.81\)) From: Tim Bruijnzeels In-Reply-To: Date: Mon, 7 Mar 2022 10:48:44 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> References: To: "sidrops@ietf.org" Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Mar 2022 09:49:03 -0000 Hi, I agree with the general sentiment that one VRP per ROA should be used. But I think this text is not correct: > The potential influence of operations of ROAs containing multiple = IP > prefixes on BGP routers must be considered. For the ROA containing > multiple prefixes, once increase or delete one pair > in it, this whole ROA must be withdrawn and reissued. Through > sychronization with repository, Relying Party (RP) fetches a new = ROA > object and then notify and send all the pairs in = this > ROA to BGP routers. That is to say, the update of the ROA = containing > multiple IP address prefixes will lead to redundant transmission > between RP and BGP routers. So frequent update of these ROAs will > increase the convergency time of BGP routers and reduce their > performance obviously. This is an issue if, per Randy's example, the entire ROA is withdrawn = first, the RPs fetches and revalidates and sends withdraws for VRPs to the = router, and then the new ROA is published later, validated, etc Taking the RIPE NCC system, and krill, as examples operators don't get = to do this. They get to specify which *VRPs* they want and the system then takes care of republishing.. It will publish a new ROA in the same delta where the previous ROA is either withdrawn or replaced by name. The = added language on failed fetches in the manifest bis further ensures that RPs will see the complete delta. RPs will work out what the diff in *VRPs* is. And it's this diff that is sent to routers. So replacing a ROA with 319 prefixes with one that has those 319 + 1 new prefix results in a 1 VRP diff. Similarly if an RP encounter multiple ROAs with the same VRP, then it will exclude duplicates when talking to the routers. Another example here.. key rolls.. When a key roll happens all ROAs are re-issued under a new key. But the VRP set is unchanged. Re-issuance of a ROA object before it would expire, essentially = replacing it with a new object of the same semantic content: no VRP change. That said, the following *is* an issue, and in my opinion reason enough: > In addition, the validity period of ROA is a long time in default, > the prefix ownership change is more possible during this period, = this > will cause the withdraw or re-issurance of the whole set of = prefixes > containing within the same ROA Indeed, resource shrink is troublesome. (I don't think validity period matters here, as the shrink can happen at any time) If VRPS are combined then this could result in the following scenario: a ROA for 319 is suddenly invalid because of 1 overclaiming VRP - = leading to a drop in 319 VRPs and router churn. Later the child discovers the shrink and issues a ROA for the remaining 318 VRPs. Resulting in router churn again. This is also why krill prefers one VRP per ROA. So, with single VRP ROAs, a shrink by the parent may cause a child to temporarily have one, or a couple of single VRP ROAs which are = overclaiming, and then clean them up as soon as it finds out. Still - this is not the same for the RIPE NCC system. Their hosted = system contains both the parent *and* the child. Context matters. In their case the child can re-issue ROAs before the parent changes the CA certificate issued to them - preventing overclaims. They also publish in the same repository so both changes would be seen together. Regarding: > The extreme case (a single ROA can only contain one IP address > prefix) may lead to too many ROA objects globally, which may in = turn > become a burden for RPs to synchronize and validate all these ROA > objects with the fully deployment of RPKI. So it seems that a > tradeoff between the number of ROAs and the number of IP prefixes = in > a single ROA should be considered. However, considering the > stability and security of RPKI and BGP routing system is the most > important target, containing one IP address prefix in a single ROA = is > recommended if the CA wants to avoids the potential instability and > risks. An example to consider where multi-VRP ROAs may be applicable are the = AS0 ROAs for unallocated space that some RIRs publish. There is almost no risk wrt overclaim - while publishing separate objects would result in excessive numbers. Currently krill has a strategy for this trade-off. By default it will start aggregating when a CA has more than 100 VRPs defined. And it will start de-aggregating (i.e. start using one ROA per VRP again) when this number drops below 90. The defaults can be changed in future releases based on feedback and research.. users can also override them. If we are to stop using multi-VRP ROAs altogether then this could also be done, but in my opinion there are contexts where they are not an = issue but a useful optimisation. To conclude: - I think the text on router churn needs to be changed. - I interpret the trade-off discussion to mean that implementers can make a decision that in their context multi-VRP ROAs are not an issue. - I am happy to change the default strategy in krill if RP implementers are fine with potentially more objects. Tim > On 24 Feb 2022, at 23:47, Keyur Patel wrote: >=20 > Hi Folks: > =20 > A working group last call has been issued for draft-ietf-sidrops-roa- = considerations-01, =E2=80=9CProblem Statement and Considerations for ROA = containing Multiple Prefixes=E2=80=9D. Please reply to the list with = your comments. The WGLC will end on March 10th, 2022. > =20 > The draft can be found at: = https://datatracker.ietf.org/doc/draft-ietf-sidrops-roa-considerations/. > =20 > Regards, > Nathalie, Chris & Keyur > =20 > =20 > _______________________________________________ > Sidrops mailing list > Sidrops@ietf.org > https://www.ietf.org/mailman/listinfo/sidrops From nobody Mon Mar 7 10:17:12 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8E0D3A11B3 for ; Mon, 7 Mar 2022 10:17:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.908 X-Spam-Level: X-Spam-Status: No, score=-6.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JIg6ZWeRrYke for ; Mon, 7 Mar 2022 10:17:09 -0800 (PST) Received: from mail3.g24.pair.com (mail3.g24.pair.com [66.39.134.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 155293A1605 for ; Mon, 7 Mar 2022 10:13:49 -0800 (PST) Received: from mail3.g24.pair.com (localhost [127.0.0.1]) by mail3.g24.pair.com (Postfix) with ESMTP id C13B3113DDA for ; Mon, 7 Mar 2022 13:13:46 -0500 (EST) Received: from [10.0.1.2] (pfs.iad.rg.net [198.180.150.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail3.g24.pair.com (Postfix) with ESMTPSA id B78BC113DD9 for ; Mon, 7 Mar 2022 13:13:46 -0500 (EST) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.21\)) Date: Mon, 7 Mar 2022 13:13:46 -0500 References: <164661854534.9143.14008577014418310525@ietfa.amsl.com> To: SIDR Operations WG In-Reply-To: <164661854534.9143.14008577014418310525@ietfa.amsl.com> Message-Id: X-Mailer: Apple Mail (2.3445.104.21) Archived-At: Subject: Re: [Sidrops] I-D Action: draft-ietf-sidrops-signed-tal-09.txt X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Mar 2022 18:17:11 -0000 The revised ASN.1 does not compile. There are two OPTIONAL TAKey values = in a row (predecessor and successor). If only one of them is present, = the receiver canntt tell which one the sender wanted to include. The following fixes the problem: TAK ::=3D SEQUENCE {=09 version INTEGER DEFAULT 0,=09 current TAKey, predecessor [0] TAKey OPTIONAL, successor [1] TAKey OPTIONAL=09 } Russ > On Mar 6, 2022, at 9:02 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the SIDR Operations WG of the IETF. >=20 > Title : RPKI Signed Object for Trust Anchor Key > Authors : Carlos Martinez > George G. Michaelson > Tom Harrison > Tim Bruijnzeels > Rob Austein > Filename : draft-ietf-sidrops-signed-tal-09.txt > Pages : 18 > Date : 2022-03-06 >=20 > Abstract: > A Trust Anchor Locator (TAL) is used by Relying Parties (RPs) in the > Resource Public Key Infrastructure (RPKI) to locate and validate a > Trust Anchor (TA) Certification Authority (CA) certificate used in > RPKI validation. This document defines an RPKI signed object for a > Trust Anchor Key (TAK), that can be used by a TA to signal the > location(s) of the accompanying CA certificate for the current key = to > RPs, as well as the successor key and the location(s) of its CA > certificate. This object helps to support planned key rolls without > impacting RPKI validation. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-sidrops-signed-tal/ >=20 > There is also an HTML version available at: > https://www.ietf.org/archive/id/draft-ietf-sidrops-signed-tal-09.html >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidrops-signed-tal-09 >=20 >=20 > Internet-Drafts are also available by rsync at = rsync.ietf.org::internet-drafts >=20 From nobody Mon Mar 7 14:23:49 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DDC93A0A13; Sat, 5 Mar 2022 10:45:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.109 X-Spam-Level: X-Spam-Status: No, score=-7.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sandelman.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8iIh451cllRB; Sat, 5 Mar 2022 10:45:10 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0167E3A0A16; Sat, 5 Mar 2022 10:45:08 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id A82BF38CE3; Sat, 5 Mar 2022 13:54:17 -0500 (EST) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 6V_0wrCfR9V1; Sat, 5 Mar 2022 13:54:16 -0500 (EST) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 7DFED38CDA; Sat, 5 Mar 2022 13:54:16 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sandelman.ca; s=mail; t=1646506456; bh=R4pih95pPV1opG+yxGmbTwkZfypuIqRtsedQjrSdA+M=; h=From:To:Reply-To:cc:Subject:In-Reply-To:References:Date:From; b=YlD/8kH22YIlzgmcZ96TgZ1W2YcxDTNSg6vqW9JGqeAcva32GGniG2lqvRGdBdreT Oo2CsDyJAdiQqQUL9XD5aK4Byvh38U3YpXAPwVaBJCSm+XtasD74B8r1BlvWY+FA5N Z14bqRg4o1jxgj8cIwNST/5z89AISi853BDC0wrprFgHdncGwwKvaXTwSblkxJiddE uliZNu9GSq833+4N9CaNwMUkZJGud6895XE9tEtplyUgbLBYCI5auG+oZrSY/tnE7h dl95tufVoA+fIwth99x91y/EsTtaeLuwHB0ELVBuSj/A4/Ox4k61GZW0sXLiya216e LUavSvSAMq9FQ== Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 4734E1D3; Sat, 5 Mar 2022 13:45:04 -0500 (EST) From: Michael Richardson To: Benjamin Kaduk , last-call@ietf.org, sidrops@ietf.org Reply-To: last-call@ietf.org cc: LAMPS WG In-Reply-To: <20220305043121.GH22457@mit.edu> References: <164642447410.28300.14979172722907480601@ietfa.amsl.com> <20220305043121.GH22457@mit.edu> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: X-Mailman-Approved-At: Mon, 07 Mar 2022 14:23:42 -0800 Subject: Re: [Sidrops] [lamps] Fwd: Last Call: (The I in RPKI does not stand for Identity) to Proposed Standard X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Mar 2022 18:45:16 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I have read the document. I was unaware of it until it was posted. It seems like this document is fighting some kind of guerilla fight against pressures to provide a higher RoI for doing RPKI. I'm personally really annoyed that ARIN has been so restrictive with access to the public key that can used to validate the RPKI that originates with them. } It has been suggested that one could authenticate real-world business } transactions with the signatures of INR holders. E.g. Bill's Bait and Sus= hi } could use their AS in the RPKI to sign a Letter of Authorization (LOA) for } some other party to rack and stack hardware owned by BB&S. Unfortunately, } this is not formally feasible. I think that it would be nice if some specific proposals were mentioned. I don't really know what: } no proof of termination means. I feel like this document might better be written by an ARIN or ICANN lawyer in a cease and decist kind of fashion, and that really, adults should be allowed to do whatever they like with their private keys in the privacy of their own HSMs. It isn't clear that we gain by publishing this document. At some poine in the 1990s, I was assured that Dunn & Bradstreet where going to issue certificates useful for business transactions. That never, AFAIK, happened. } Government of Elbonia citation! citation! :-) :-) =2D- ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iPMEAQEKAB0WIQSk7ZHEG9TCGBNASfm/sjw/rPYc8wUCYiOvsAAKCRC/sjw/rPYc 82JZBgCS1t68QRpaz/jdv1h7xloqstIhH1kR6ZDVmBOhK8qxA2cAfHJFuTDXxotR 8SmVB0sIhkwQt33Vg8DugQ5lUrr56ad8ZnmTjC1bMEpOH2Dt3qBH0G0D2igUiHWf sLd1ZFuivSsjymaRY1cTvqHoOvGM2qoTRHTiHunMmd7BDxk6lXlm7zvo0pxV1Os/ ylptUPSuDJhpFmDGNIG/74/4O2y1VFVAENGQCCoe63r3xmUTbm+HEJyy9b+QU1Ic aynek/I= =mcYI -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Mar 7 14:23:53 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F53D3A0A42; Sat, 5 Mar 2022 10:55:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.11 X-Spam-Level: X-Spam-Status: No, score=-2.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sandelman.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g_7HgNzSmQAd; Sat, 5 Mar 2022 10:55:37 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 746B83A0A40; Sat, 5 Mar 2022 10:55:35 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 5F6ED38CEB; Sat, 5 Mar 2022 14:04:46 -0500 (EST) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 5sIfQz8uTGUi; Sat, 5 Mar 2022 14:04:45 -0500 (EST) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 1374338CE9; Sat, 5 Mar 2022 14:04:45 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sandelman.ca; s=mail; t=1646507085; bh=jIlrzv+4T/Ut/O8tVlm82CalDqfMRjiCUd4C+roDdiA=; h=From:To:cc:Subject:In-Reply-To:References:Date:From; b=DWvP5BDQThXliLD/G2O04kGGm1NsBfSFGFqZyuW1Sva7nxbhHVu8zn1Sp+WGkQjbq Wy8vkHvBLEmSnkF2TRUx2eVcoQQLugAJrVhqvbWPPCcddmWidhAq0TpBRs/7z4SjQf ly+VZ1Io0gD3uPUvlSNT4m3WLxHX/ndiQRYEC87ejmmGk5N59bfSRuYU8tvhdlBaIo sRf93SNoGXCskQrwTyeQ7TQBbkNh7pI1rmjQdnDqpwjCXpfM0SIWZw/aIUZ1hKyoVj bmGrZ6LUy4reqy/H6g0yG5n/3dKydoh5h/B/7hYlwxg3ctXoid3fffC04UJYM+UlP5 /+fM0obOfSKxg== Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id CC4191D3; Sat, 5 Mar 2022 13:55:32 -0500 (EST) From: Michael Richardson To: Michael Jenkins , last-call@ietf.org, sidrops@ietf.org cc: Benjamin Kaduk , LAMPS WG In-Reply-To: References: <164642447410.28300.14979172722907480601@ietfa.amsl.com> <20220305043121.GH22457@mit.edu> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: X-Mailman-Approved-At: Mon, 07 Mar 2022 14:23:43 -0800 Subject: Re: [Sidrops] [lamps] Fwd: Last Call: (The I in RPKI does not stand for Identity) to Proposed Standard X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Mar 2022 18:55:43 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Michael Jenkins wrote: > It appears that RPKI certificates are actually authorization bearer t= okens > issued by the CA. The CA holds the private key, and the INR holder do= esn't? > But somehow does, and is somehow using it to sign invoices and love > letters. I read that part too, and I was a bit confused as well. It's not that the CA holds the private key to the EE RPKI certificate. It's that, the EE RPKI certificate, being a certificate, is signed by the C= A. (Exactly as you'd expect any CA->EE certificate). The RPKI certificate is a statement of ownership of INRs by that EE. That certificate can be updated/replaced based upon somewhat weak username/passwords logins to the RIR's web sites. The EE certificate can then be used in various forms of BGP security (mostly not yet well deployed), and also to sign policy objects about which ASN is authoritative for which prefixes. > Ultimately, I'm not sure why anyone will pay attention to this RFC(-t= o-be) > any more than RFC 6480, which apparently already says "An important > property of this PKI is that certificates do not attest to the identi= ty of > the subject" - which again calls into question whether these are > certificates at all (as opposed to authorization tokens). Maybe the > solution isn't more RFCs asserting the lack of identity binding, but = more > token management? I agree. I don't think another RFC will help among those technical people who really understand things, nor will help among the semi-technical lawyers who don't= understand things. It's only the people in between that might be impressed by an RFC. If I want to sign an agreement with AS64512 for something, and my lawyer sa= ys that I can obtain AS64512's public key from the RPKI, then it seems like maybe that's between me and my lawyer. Maybe we also want to exchange some hashes of SubjectPublicKeyInfo as well, but that would really be a private discussion. Should I be concerned that the people who control the HSM for AS64512 might not be authoritative to sign contracts? Sure. Do I need an RFC to tell me that? I dunno. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iPMEAQEKAB0WIQSk7ZHEG9TCGBNASfm/sjw/rPYc8wUCYiOyJAAKCRC/sjw/rPYc 82N4Bf9iQYr7q8I2r8UWGv5lkKSZFsQ59rLg0t6f9PspnscJXqX8IKXPjbsxjndf lhNlXi0CAsNJv9rSk2ZnpcaCERlg+uWseczuF+TeHzIdVIRa8mwK2FssjfquaFRc KITK9yNOhSWDvh5p7U9USzSOWbcKcZMxAAoom/DQiRQp63PQqp5K2xPwF9KTwwRZ V7vBewKi4ToGAwa0SJdJl0l88cboTyvz4gDV9zQr+FXfQwadcK8Obmz3Nx04ED6i X6JqDLo= =6mkH -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Mar 7 22:27:05 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 924E03A11AE for ; Mon, 7 Mar 2022 22:27:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.722 X-Spam-Level: X-Spam-Status: No, score=-1.722 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.186, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kei6AxgZWW13 for ; Mon, 7 Mar 2022 22:26:59 -0800 (PST) Received: from smtpbg.qq.com (smtpbg127.qq.com [109.244.180.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 205E93A0DE4 for ; Mon, 7 Mar 2022 22:26:57 -0800 (PST) X-QQ-mid: bizesmtp65t1646720810twsceiou Received: from smtpclient.apple ( [202.173.9.210]) by bizesmtp.qq.com (ESMTP) with id ; Tue, 08 Mar 2022 14:26:49 +0800 (CST) X-QQ-SSF: 00100000002000D0Y000B00A0000000 X-QQ-FEAT: PoHafD3Y+f8+1R+tc/fhTwVbqz323bM9jFJ0BxIFChU22ofNGJhZtf/JHdIMt pQcSuqFRobT+7JEGypAmINbtvO3DSWd+0c6cM3e4/yCW78KyyxRWBRwezf7YK8LrXFezzr0 wUvYTJDhenRGY5qtb9SuEbkE0JzHF4Radv5ZNLouKunxZlW41jrWuWsEea5Q7l/Zxfbtmqc 02Q8hmDPsj8VJbEyCfzXqxn55SAfr9avuwiHgSTQaQGeic0Z4/7P/EwO/3UxLsTQXURIyBG VQryEfivEgeU0o0HVjNTlcWp1gQeyy3lGdyCVKCu+Swt6ZJ3aUDxv2YBA= X-QQ-GoodBg: 0 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.60.0.1.1\)) From: Di Ma In-Reply-To: Date: Tue, 8 Mar 2022 14:26:46 +0800 Cc: "sidrops@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <934F78A5-D895-408F-8C6B-6154CD29BDBD@juicybun.cn> References: To: Keyur Patel X-Mailer: Apple Mail (2.3693.60.0.1.1) X-QQ-SENDSIZE: 520 Feedback-ID: bizesmtp:juicybun.cn:qybgspam:qybgspam1 Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 06:27:04 -0000 I think suggestions given by this informational document make real sense = with regard to ROA generation. And it would make no requirement on RP update but bring more ROAs for = RPs to fetch, which is a tradeoff. Granted, it is fair for the community to know about that. Di > 2022=E5=B9=B42=E6=9C=8825=E6=97=A5 06:47=EF=BC=8CKeyur Patel = =E5=86=99=E9=81=93=EF=BC=9A >=20 > Hi Folks: > =20 > A working group last call has been issued for draft-ietf-sidrops-roa- = considerations-01, =E2=80=9CProblem Statement and Considerations for ROA = containing Multiple Prefixes=E2=80=9D. Please reply to the list with = your comments. The WGLC will end on March 10th, 2022. > =20 > The draft can be found at: = https://datatracker.ietf.org/doc/draft-ietf-sidrops-roa-considerations/. > =20 > Regards, > Nathalie, Chris & Keyur > =20 > =20 > _______________________________________________ > Sidrops mailing list > Sidrops@ietf.org > https://www.ietf.org/mailman/listinfo/sidrops From nobody Tue Mar 8 11:36:45 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D27133A129B; Tue, 8 Mar 2022 11:36:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5rMZ1h2Qd40z; Tue, 8 Mar 2022 11:36:39 -0800 (PST) Received: from GCC02-BL0-obe.outbound.protection.outlook.com (mail-bl0gcc02on20704.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d05::704]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0FC53A121C; Tue, 8 Mar 2022 11:36:38 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Z3HB74KrQcQ3i+XnKqLilYjtFeed7TpDTX0Xckffq/iYzSDTEVnEwGftknWtmldPr2+9SV/zx4nUPUwNKYKjaZ1C5GLotA9DPqzev4cILMyup8rd2OEldv91063PeWGukmFU5FX+lyvH1VeItWMeLpO8jG3OEm0d47TxPt3TjC8s0wpueXqKg4d2YxEdk/V58ETXUaAdlEz0/VsXpBUMY6Be3I+wq1cJvXy1IaB5jPzAwkueLsw+zxxh/ib6epDaWicxR90HrqOe3eW78takTSUQN27Syref25ZC7uM+L57fxfwA6Q0PI/yZNMiv6udV4f2NzpLAqIdTcOs+KZBXhg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=JsiTOA+JgP9WuBVJhsplSONsVlGNT03IPcuP0YY3bMs=; b=W9Xd/1nC1OoNLuOBg0goTdHkeRfQBG/3QxmmEu5tbA1BUu5a5eXzua3UBOfbSnDBNAgGhEfZkQmuVYcksCCCh6aYpIamz1IpKtoJUpbqDcT8RXjDbhiPwJ/PyAsCMQqwnceWC9nJc/S8H+BD9fpehjdVEg0Dw0iT+dfBgVUYA61Xf70W4gsGsSDXsdBvn+fw8y2yhZYx1iZbecFLEdFCsShNJeJIPA93mlNpUGLyFga767cxkUGG0ZqVDvypz8BY45Mo6yhJ0OB2rZxT+AetkkmcSBXPgZPt+LWlEsiVlh3H6vfo1/4ctNaHTrjlMPpOe5J0nA8Zpw80A8GG/2/UZg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JsiTOA+JgP9WuBVJhsplSONsVlGNT03IPcuP0YY3bMs=; b=qmLZk/zb13C643WlvAgS48akyLxdGk2I39Zx6FvjvRkm3eQLoR25MLpqZ4QvMNOqSubxzBmxAgCakLBYChjGHO/eiDV/VZslzTtuCyOClWRShzZv0CrNEH+MRwixx4BtplWPMbgKDfE2bEPL5Pp0vmeEW0xk339sFKR0p4SaVw0= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SA1PR09MB8541.namprd09.prod.outlook.com (2603:10b6:806:181::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5038.14; Tue, 8 Mar 2022 19:36:33 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5038.027; Tue, 8 Mar 2022 19:36:33 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "grow@ietf.org" CC: "sidrops@ietf.org" Thread-Topic: IXP Route Server question Thread-Index: AdgzI9AepbPeSUXIRROpCLpxuIKvkg== Date: Tue, 8 Mar 2022 19:36:33 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 45f21ffd-5561-4840-c8a6-08da013af3b1 x-ms-traffictypediagnostic: SA1PR09MB8541:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: mYOsSxV+Tbq07cPtfEz7/gqmHKxQyaiiHDtePLt2I431fW4rHAjlXVQtP4ifxePZo3J0rwzqX3pTrlSSmoLifqxTfnMyL8Y2iOTrD56UmFX0xFudluY1IP33IlJmTw6v585i0x2h8ghviZ94UzOVuAjTYOS0cHG6gLXGmZVC59WFwOv7b0Egtq5++C283l6OpPbBqVIy9remrYvXXErNYGl6iWmifw4aHS1/9J+46liENxtjGfAldFLzi99FtVcZtzh2XN+opyidEukOasrh41dp+765CrzyK8qwSSD/fIqMC3FsjdHKnbKUlqfZmxyqTtXUyXctqoLANc4h151/hfF8hRz++TXygEj3fAvaVg1tx3qkf7M7gZ6we9TcJlTJtnGSwe/kpY9qTvbguw6Apu942rRbxvkeNfQUUhikdbp4M9WyGhrvHc0dk2C3Zbmp4pQPzK2gkWVQmONpDnHeW5BGI04uqatkf03y7XNPeGFw0ngCt59Mq5LjbJne64GuULVKqUFel61IMmFR7pi2Ym72pGPb0Gs3QSRQ4wnXfyuO6KVhKOLEht952eymKJL+fSbEwMJC1VIAiw+gsP4Vc5YWHN5q/m5/vOHhY3Xs+uP/NUf7+/v7t4uBdAByzdpmRlen9ceEiAars82Cqf0ReqmtENEhsb5YFXqcBmc6MK8Jo17LauyHxK6FsnWzgRhXUhZaLF0/LIIz4uhIJOfvDQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(82960400001)(4744005)(64756008)(5660300002)(76116006)(66556008)(66476007)(4326008)(66946007)(8936002)(86362001)(83380400001)(66446008)(508600001)(33656002)(38100700002)(6916009)(8676002)(2906002)(450100002)(316002)(52536014)(7696005)(9686003)(55016003)(122000001)(6506007)(38070700005)(26005)(71200400001)(186003)(3480700007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?2ojE/XF620QWVgG0/gBP9q8uzmtDVSQ0LJ3RQtRZO2uDsChAXCkyZO/G4HC9?= =?us-ascii?Q?4gYmIKXIiyvDLgtEmGW4cTrA7D99GyVV2U72dlwLVsAuFk4D1cyO42OjzJkh?= =?us-ascii?Q?NxY1zYN0uz1cJ8XYkhPev2sZk9XYAjGatYJujGsMUFx57rlJA0YkXC3xdbUn?= =?us-ascii?Q?8RvFjT2ZIyjiIPa6puh0Pmvc06viW3GgMLRJUyic34ZTFK42nNKJDg5rnltW?= =?us-ascii?Q?TL/DnkuYZZAOCfTZjmKLhAdikW9qoWHHIc26KffdaImsInA5h5zafPobV4Q/?= =?us-ascii?Q?Yh3daLDInVgI+mQS7LTULcxFzWnC7lRuTdnRs18MSJgL1aN0FbQoIoz0OZRZ?= =?us-ascii?Q?i18ae+xOLoLSfRZ++Us9shXIdKyH3zdphP7vTmGi85anqmlCHVFigvbMBgSd?= =?us-ascii?Q?ztUcpoW1Qbh5YKAmCWGkneqANkKonc28Iuiwqg2BVSOmbNWNx5/JFIq5dnBt?= =?us-ascii?Q?lzVgbq2WYUetbZ75ml8LSjYCeoNQaQKsMiihMGR5eEGSCwWIk7qjCXZkchJl?= =?us-ascii?Q?NoRdF3qynXCcrYfjqh1mijvawuQkzqQ/IluTzicDJG0aNjDrikuW4crwcwcb?= =?us-ascii?Q?/ubjBrmLXd4islzm8QPWW99Q+DcIb5eAlgZNX3Q4DppaqPXnD8CReKMvEo/I?= =?us-ascii?Q?pDP/efbmoHHoCmDJk+EUae2NfEgXahzcDYWR6nZHEuZW7MckBkhncxLdg1qC?= =?us-ascii?Q?MjdLXpw61ov6BSdbGJoNy0Hy77Ka1URBtwzaz7wA5EWz09HTNuoTHryGfnZt?= =?us-ascii?Q?QEqb0f0Y4jPraHoc0bBWMCqr2PDEMlkKA8f7KITk1hZETp26nKx5kmD+YKWj?= =?us-ascii?Q?vng+sIjoBr8z6ZuI6+Q7dYFxSZjAx1tg6Vpcg4LuzhVDRMQszXjhrqhfv4Ed?= =?us-ascii?Q?vZTlQo/bM3noZQxv2wTFNbGJ1dOCA9vsByms6B8C95nIyDjdAW9N+2jRcGhZ?= =?us-ascii?Q?YYDsy6rbYzwaIOKscGAnxTeLC4G+AKmOptsBZO1qtkYS8sgYVJ6uAPlPlGB2?= =?us-ascii?Q?4GtJUadXCqGrDIrUmpUoJr5W+qqgphjJA8m8a9kan8CYAiWAelB6xFOz/+ex?= =?us-ascii?Q?ek264J6kp9jR9iMYj4e2tSrDsYSE6k5Clxrpn8ZiIA3/a3OhHP3f48YgY9YS?= =?us-ascii?Q?zFpI0Nz59v5F4A4QEp0XNNcfA4097Uvdh9z1Cf620F9Si2P0B6CSgZs+EgM4?= =?us-ascii?Q?+ILJrdYMWmyPgKQBFFe4dr6XmuRqVPKBsHHmexYGmVzrcCPZCVjElBm0BMi2?= =?us-ascii?Q?/0NOkmhNuDczXu9DtPPwKg50Vo67xWvGYeUzxteOei8hTPlNBwEJj4H42hiU?= =?us-ascii?Q?5MarOg9bLgjnS0zzsOhc+9Ei?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 45f21ffd-5561-4840-c8a6-08da013af3b1 X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Mar 2022 19:36:33.3498 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR09MB8541 Archived-At: Subject: [Sidrops] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 19:36:44 -0000 This question has relevance to the ASPA method for route leak detection. Is it possible that an ISP AS A peers with a customer AS C via a non-transp= arent IXP AS B?=20 IOW, the AS path in routes propagated by the ISP A for customer C's prefixe= s looks like this: A B C. I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the mi= ddle between an ISP and its customer? Sriram=20 =20 From nobody Tue Mar 8 12:04:15 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D1543A13ED; Tue, 8 Mar 2022 12:04:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.107 X-Spam-Level: X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1XiVaK-cfoxq; Tue, 8 Mar 2022 12:04:11 -0800 (PST) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 367F23A1941; Tue, 8 Mar 2022 12:02:53 -0800 (PST) Received: by mail-qt1-x834.google.com with SMTP id bt3so144643qtb.0; Tue, 08 Mar 2022 12:02:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JOJab311AM497SCI9UOBLSgwlbozAyhfxkcQ0Nx3m24=; b=eMxxAJGELMy4LfuNsQ0/OCSWrtGnrHCoEaEAGMpBKz6+kNXuRad8X+tp0k+/DMEtS+ hKykUXq6erjKfLXu8Ys1T9ybhu/0bHNCsurd73787kfJ5zmlQAlOlmKlHFT0ghi/EOe1 qJjDGmohDM2GaEZecVJj93oulOAh71F7/A5Q2LGpTVg5ui2sGDNH/f39h7Q2APOJ1At9 Gjtdn5XD0btrKbC1v9BXw/VrRriLCaCksUeP3FysYbT0N49Ro9L1ZpA9qJ4NgAQbZz6y UMP2PZh9acykoDZ1GVMyVr7MGvIh6KHu2iItBmU7lF0NcZTL60zYBBXtXCyLU9QWTKcj rZdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JOJab311AM497SCI9UOBLSgwlbozAyhfxkcQ0Nx3m24=; b=N4JJhxeYbJEeVKD+DmUoVdo+F3sW4teSKp9csyQbq2gQOuC/x6i6v9MZX3iNr/hSem b2tegENgjfB2d7oYNnAqBZck8VBuykMIR+CiSzUBl+9Af2wtXAaAf0SIXSiuRaYmlqUr g4yuj0m3IlS6GfAgcIqp1PF5fsumd1ZijLovi/Je5Q08bBtNoqreuDkbwk149ePmA786 p4M72Jje4XK4EPYoHSnSfIMFgyB9efJsLdQKCbqcOMbllDvNmFsE0uLZNB6FbRipTOXX 9tythF0blOPyajPU6Ug4LtsKl5cuMp5iZmFHV0Cdbo3mpjKlD/NNCxzW3Cc5I916GXTq X1cg== X-Gm-Message-State: AOAM532N0MSotrK9FLwqlZ5yiMJFQzMASyFmYSLUQfDq4DVLMULu4ffo EyyfRhaiDiZw0sdxD+hyEqZr/ci6KYkm/3G32QS+MhLSu9o= X-Google-Smtp-Source: ABdhPJz26pX7z7aEzkM8f+CYq5wbURZOn6TNsu6Zde0Rc2iTlXItG2ooPIdY+cilxizJf86seOTSXXg6UiIyAg2g7XQ= X-Received: by 2002:ac8:7dd1:0:b0:2e0:6fe1:189b with SMTP id c17-20020ac87dd1000000b002e06fe1189bmr4453863qte.629.1646769771542; Tue, 08 Mar 2022 12:02:51 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Christopher Morrow Date: Tue, 8 Mar 2022 15:02:40 -0500 Message-ID: To: "Sriram, Kotikalapudi (Fed)" Cc: "grow@ietf.org" , "sidrops@ietf.org" Content-Type: multipart/alternative; boundary="000000000000427f3205d9ba77b7" Archived-At: Subject: Re: [Sidrops] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 20:04:14 -0000 --000000000000427f3205d9ba77b7 Content-Type: text/plain; charset="UTF-8" On Tue, Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (Fed) wrote: > This question has relevance to the ASPA method for route leak detection. > > Is it possible that an ISP AS A peers with a customer AS C via a > non-transparent IXP AS B? > IOW, the AS path in routes propagated by the ISP A for customer C's > prefixes looks like this: A B C. > I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the > middle between an ISP and its customer? > > it seems unlikely to me that an ISP would pick up a 'customer' (someone that pays them to transport packets) at an IXP fabric. Might it happen? sure? is it messy? yes! 1) that's probably a shared port 2) there are other folk feeding routes and packets into the mix 3) how many came through the 'customer' port (which you can't really know easily) vs other participants on the ix 4) what capacity planning could the 'customer' do here? (none, basically with respect to the remote ISP port) Your question might work also as: "ISP A has a customer C on a direct link in location Y. ISP A is present at IXP-Z, so is customer C, though they do not bilaterally peer (not do they interconnect at the IXP). ISP A can still see Customer C's routes through the IXP-Z Route Server." that seems plausible, but not a desired outcome for the ISP :) since they will be unlikely to collect pesos for the traffic which MAY pass across that interconnect. --000000000000427f3205d9ba77b7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Mar 8, 2022 at 2:36 PM Sriram= , Kotikalapudi (Fed) <kotikalapudi.sriram=3D40nist.gov@dmarc.ietf.org> wrote:
This question has relevance to th= e ASPA method for route leak detection.

Is it possible that an ISP AS A peers with a customer AS C via a non-transp= arent IXP AS B?
IOW, the AS path in routes propagated by the ISP A for customer C's pre= fixes looks like this:=C2=A0 A B C.
I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the mi= ddle between an ISP and its customer?


it seems unlikely to me that an ISP would pick up a 'customer' (= someone that pays them to transport packets) at an IXP fabric.
Mi= ght it happen? sure? is it messy? yes!

1) that'= ;s probably a shared port
2) there are other folk feeding routes = and packets into the mix
3) how many came through the 'custom= er' port (which you can't really know easily) vs other participants= on the ix=C2=A0
4) what capacity planning could the 'custome= r' do here? (none, basically with respect to the remote ISP port)
=

Your question might work also as:
=C2=A0 "ISP A= has a customer C on a direct link in location Y.
=C2=A0 =C2=A0IS= P A is present at IXP-Z, so is customer=C2=A0C, though they do not bilatera= lly peer (not do they interconnect at the IXP).
=C2=A0 ISP A can = still see Customer C's routes through the IXP-Z Route Server."
=
that seems plausible, but not a desired outcome for the ISP :) since th= ey will be unlikely to collect=C2=A0pesos for the traffic
which M= AY pass across that interconnect.
=C2=A0=C2=A0
--000000000000427f3205d9ba77b7-- From nobody Tue Mar 8 12:26:53 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C71F3A16AE; Tue, 8 Mar 2022 12:26:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.107 X-Spam-Level: X-Spam-Status: No, score=-2.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l0J4iLddq8gE; Tue, 8 Mar 2022 12:26:41 -0800 (PST) Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D37523A16A8; Tue, 8 Mar 2022 12:26:40 -0800 (PST) Received: by mail-qk1-x733.google.com with SMTP id q4so45626qki.11; Tue, 08 Mar 2022 12:26:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3vfnEeApcQfgbGp2OFjURLx9ke4jm+86REbta0IX7kU=; b=d5EU7Nrs/18FGuYyJZDvs8vu0gPyGIDLitW8NYa5skX7pll36sWEGJ1G3/VRFFqKX8 EfhhF+Jiq5ac2ZM9uz0MghCNBFghS5M25S5OlrvqP0148GA2MP85XorPmKxcjBc7z1qK 927NFecXzskpq+P01h1lNE9Uhwz3dTxrF1p+TfA50D4N1pE5YHU1jb1FJR0p2Vmd0dPP kq7B7bR21RTy704KNHsW60i+GNSoohcBkGSUX+sE40r01i19HkArbtJOl65qMKVMVsqi WlKGAE5Qp5DP0XZsKUrbrQPcWLHAA2fVTs5Uzc01ygRjLKZBNj+vaxG2frW8JKTlnICX FyLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3vfnEeApcQfgbGp2OFjURLx9ke4jm+86REbta0IX7kU=; b=AjqHqY2cchdkidHMoJmor6z4FaRIL0FCmUBH4gVb8Dk6Gp5TOjZGN+d35ADAsQS8iP LuGZQv59Qxhva3DiZTuBIo8p9mpRg5B+0r6l87THVx4ETti6QbU0rTdNkLGXLQ0qwTht +BdvWTMAaJqIoBCnxJQnUJnY7oh8hk/iozUC0fEfL22NbX18C+7IFtANxb/p3bmCPx4z 3AwyQaJNNAMChqssExKNnWdhoHk89PA1UueGMPsKvPmq6hs0UbKtpiI7Z6gxslNRTpBl 1awF/vj6xKDD9ZSGlS+7nQov6OcF6VlB2CndigIeBZ80Gqdam7hwY1Rtvh5/KhgHh2/g EWzQ== X-Gm-Message-State: AOAM5315Pirgi/ZdP4IZcqbL+cWONPcyIRU8yHQB3gNygSdMtrL0xwXr wpLXhHz0QVF3yV26Y04JVTl0Gh4ZucAT9BL/Qhw= X-Google-Smtp-Source: ABdhPJzjKsqqHsQe2G5jfNWq/CRbYA2vzphzVOaqS7xGfXPzgHpRT8G3TjhaUTH3xhftZLDW8RfBfevKneBhH8BTWoQ= X-Received: by 2002:a05:620a:2544:b0:67d:15ed:ea9a with SMTP id s4-20020a05620a254400b0067d15edea9amr3539920qko.63.1646771198916; Tue, 08 Mar 2022 12:26:38 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Christopher Morrow Date: Tue, 8 Mar 2022 15:26:28 -0500 Message-ID: To: Robert Raszuk Cc: "Sriram, Kotikalapudi (Fed)" , "grow@ietf.org" , "sidrops@ietf.org" Content-Type: multipart/alternative; boundary="000000000000567df505d9baccea" Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 20:26:47 -0000 --000000000000567df505d9baccea Content-Type: text/plain; charset="UTF-8" On Tue, Mar 8, 2022 at 3:15 PM Robert Raszuk wrote: > Well I think the answer is - it depends. > > First IXP fabric can be used as pure L3 share LAN or can be used (and it > is often the case) as a p2p emulated VLAN over such L3 shared LAN. > > Now if this is L3 shared LAN still customer and ISP may peer directly and > no third party traffic would be accepted at either end. > > If we talk about emulating L2 IXP fabric becomes just an emulated circuit > and from the perspective of routing it a p2p interface. > > Sure the other aspects of the IXP quality, port monitoring, > oversubscription etc... always will apply but there are ways to mitigate or > handle those in real IXPs. > > I don't dispute your content here, except that Sriram's question was about seeing 'customer routes via the RS'... which I think would obviate the emulation examples you provided. (well in a bunch of cases it would, you COULD hook up some tomfoolery to get this to work, but... that sounds complex and prone to disaster) > Best, > R. > > > > > > > > > On Tue, Mar 8, 2022 at 9:05 PM Christopher Morrow < > christopher.morrow@gmail.com> wrote: > >> >> >> On Tue, Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (Fed) >> wrote: >> >>> This question has relevance to the ASPA method for route leak detection. >>> >>> Is it possible that an ISP AS A peers with a customer AS C via a >>> non-transparent IXP AS B? >>> IOW, the AS path in routes propagated by the ISP A for customer C's >>> prefixes looks like this: A B C. >>> I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the >>> middle between an ISP and its customer? >>> >>> >> it seems unlikely to me that an ISP would pick up a 'customer' (someone >> that pays them to transport packets) at an IXP fabric. >> Might it happen? sure? is it messy? yes! >> >> 1) that's probably a shared port >> 2) there are other folk feeding routes and packets into the mix >> 3) how many came through the 'customer' port (which you can't really know >> easily) vs other participants on the ix >> 4) what capacity planning could the 'customer' do here? (none, basically >> with respect to the remote ISP port) >> >> Your question might work also as: >> "ISP A has a customer C on a direct link in location Y. >> ISP A is present at IXP-Z, so is customer C, though they do not >> bilaterally peer (not do they interconnect at the IXP). >> ISP A can still see Customer C's routes through the IXP-Z Route Server." >> >> that seems plausible, but not a desired outcome for the ISP :) since they >> will be unlikely to collect pesos for the traffic >> which MAY pass across that interconnect. >> >> _______________________________________________ >> GROW mailing list >> GROW@ietf.org >> https://www.ietf.org/mailman/listinfo/grow >> > --000000000000567df505d9baccea Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Mar 8, 2022 at 3:15 PM Robert= Raszuk <robert@raszuk.net> = wrote:
Well I think the answer is - it depends.=C2=A0

= First IXP fabric can be used as pure L3 share LAN or can be used (and it is= often the case) as a p2p emulated VLAN over such L3 shared LAN.=C2=A0

Now if this is L3 shared LAN still customer and ISP ma= y peer directly and no third=C2=A0party traffic would be accepted at either= end.=C2=A0

If we talk about emulating L2 IXP fabr= ic becomes just an emulated circuit and from the perspective of routing it = a p2p interface.=C2=A0

Sure the other aspects of t= he IXP quality, port monitoring, oversubscription etc... always will apply = but there are ways to mitigate or handle those in real IXPs.=C2=A0


I don't dispute your= content here, except that Sriram's question was about seeing 'cust= omer routes via the RS'... which I think would obviate the emulation ex= amples you provided.
(well in a bunch of cases it would, you COUL= D hook up some tomfoolery to get this to work, but... that sounds complex a= nd prone to disaster)
=C2=A0
Best,
R.








On Tue, Mar 8, 2022 at 9:05 PM Christopher M= orrow <christopher.morrow@gmail.com> wrote:

On Tue, = Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (Fed) <kotikalapudi.sriram= =3D40nist.go= v@dmarc.ietf.org> wrote:
This question has relevance to the ASPA method for route le= ak detection.

Is it possible that an ISP AS A peers with a customer AS C via a non-transp= arent IXP AS B?
IOW, the AS path in routes propagated by the ISP A for customer C's pre= fixes looks like this:=C2=A0 A B C.
I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the mi= ddle between an ISP and its customer?


it seems unlikely to me that an ISP would pick up a 'customer' (= someone that pays them to transport packets) at an IXP fabric.
Mi= ght it happen? sure? is it messy? yes!

1) that'= ;s probably a shared port
2) there are other folk feeding routes = and packets into the mix
3) how many came through the 'custom= er' port (which you can't really know easily) vs other participants= on the ix=C2=A0
4) what capacity planning could the 'custome= r' do here? (none, basically with respect to the remote ISP port)
=

Your question might work also as:
=C2=A0 "ISP A= has a customer C on a direct link in location Y.
=C2=A0 =C2=A0IS= P A is present at IXP-Z, so is customer=C2=A0C, though they do not bilatera= lly peer (not do they interconnect at the IXP).
=C2=A0 ISP A can = still see Customer C's routes through the IXP-Z Route Server."
=
that seems plausible, but not a desired outcome for the ISP :) since th= ey will be unlikely to collect=C2=A0pesos for the traffic
which M= AY pass across that interconnect.
=C2=A0=C2=A0
_______________________________________________
GROW mailing list
GROW@ietf.org
https://www.ietf.org/mailman/listinfo/grow
--000000000000567df505d9baccea-- From nobody Tue Mar 8 13:28:26 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51E503A17DE; Tue, 8 Mar 2022 13:28:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5hikJwiOZhjk; Tue, 8 Mar 2022 13:28:16 -0800 (PST) Received: from mail.netability.ie (mail.netability.ie [IPv6:2a03:8900:0:100::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20F413A0EE3; Tue, 8 Mar 2022 13:28:15 -0800 (PST) Received: from crumpet.local (admin.ibn.ie [46.182.8.8]) by mail.netability.ie (Postfix) with ESMTPSA id F07089CEB1; Tue, 8 Mar 2022 21:28:10 +0000 (GMT) To: "Sriram, Kotikalapudi (Fed)" Cc: "grow@ietf.org" , "sidrops@ietf.org" References: From: Nick Hilliard Message-ID: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> Date: Tue, 8 Mar 2022 21:28:09 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:52.0) Gecko/20100101 PostboxApp/7.0.54 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 21:28:19 -0000 Sriram, Kotikalapudi (Fed) wrote on 08/03/2022 19:36: > This question has relevance to the ASPA method for route leak > detection. > > Is it possible that an ISP AS A peers with a customer AS C via a > non-transparent IXP AS B? > IOW, the AS path in routes propagated by the ISP A for customer C's > prefixes looks like this: A B C. > I.e., can the AS of a non-transparent IXP/RS appear in an AS path in > the middle between an ISP and its customer? Almost all RS's are transparent these days. Usually IXPs go to lengths to ensure that the RS ASN doesn't appear in the AS path. Some organisations provide transit over IXPs, but it's a minority thing. It would be very peculiar if an organisation provided transit over an IXP via an RS. Some organisations provide transit to ASNs over a direct physical connection while maintain peering with their customer over an IXP port. Usually this happens by accident, but occasionally it can happen by design. The answer to your question is that it would be technically possible, but it would be so peculiar and stupid that it should be considered a mistake in the situations where it was intentional. In all other situations, it would be a leak. Generally it would be safe to assume that this sort of configuration was in error. Nick From nobody Tue Mar 8 13:29:24 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98F993A13F3 for ; Tue, 8 Mar 2022 12:16:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.108 X-Spam-Level: X-Spam-Status: No, score=-2.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=raszuk.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nOOrE5-IRiNm for ; Tue, 8 Mar 2022 12:15:57 -0800 (PST) Received: from mail-vs1-xe2d.google.com (mail-vs1-xe2d.google.com [IPv6:2607:f8b0:4864:20::e2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC1573A13ED for ; Tue, 8 Mar 2022 12:15:56 -0800 (PST) Received: by mail-vs1-xe2d.google.com with SMTP id u82so71557vsu.0 for ; Tue, 08 Mar 2022 12:15:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raszuk.net; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Y7RGZFHfO+nov+4hnHIX69PWk5TrVGhPqGi6fHv5hWU=; b=LqIdSYZb5m0ngEkjN58/nlF496uz2wxPIvV8jvaLcYnnxhp4Nuk4vmPJkGWs1cwanj k2BD6M1JJM/CeZ/0cqWf+ur1Kxv6vgdR+idNVnCYyLkB3tSuLMrS/73Tz1rmcj+qtZE3 S3XXBESUJLWGwpyK+9jrfLL97bcIYqw8I/v1TNixLTN2VWANIL/L+80Iv6cTYMqKc97B P8O7F9rgaxHZb+bWGbPtpZesVcaj01pm4DegOEgAvJaP4vOScfEO4Dm8Kf97C9G8aExE n/crS5ysez9OWatNSEP/FXmv/RL1wMNJ/6Nk5WmLnxRkTQG17jS3xfjbgKsyoJ5J1pYv Qpzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Y7RGZFHfO+nov+4hnHIX69PWk5TrVGhPqGi6fHv5hWU=; b=X9mwQzjgo+SPSwdO9ZgxlNq36ZiwKWGyNns2TfbTtiifABfryhaxfE81dB/743fYKy M3MWlY/0zIBO2f0mGp8UGta+pbZXmqTSSh9WtRehBuk8714POpd3JrzzgBWqH7g3ZS6h u/6pSj1oKobTMk0o4NtVlA+F0fTHG5ceSq7XgCnx/3Z/tawK/Zjc8Hxj3w4dFv56+Bij 2NRDMsES4w9ZAjyKtHlMHg+FN4PX63VG5B1I+jYp87bxAbV5Dxcc7JAW6MkvuzNr/xXi VsBX4vBRl9ApX5+FiIZ/pwRiSJnzEgAdogvIBIO4wLcm4x6XA/tgYEJPyCttFXz9Sukp qKDw== X-Gm-Message-State: AOAM532uuLPzHr95vOa7sZiYBV9hk747KMNyFXBGsKh2obi4K3FL6DLk DxjCbASzfSRqvh600wjdvCFQleCTXXvEd+HE8tYeDA== X-Google-Smtp-Source: ABdhPJx7h/HlWhsM+qgOZSNA9vipqTz3hr0Jm+hHoKSQCkSZmeMF97MxMZmBITcMk4JpNZqgwJ5avnLqHh+/ioSTHlk= X-Received: by 2002:a67:e893:0:b0:31c:e6c:6f69 with SMTP id x19-20020a67e893000000b0031c0e6c6f69mr7885208vsn.85.1646770555491; Tue, 08 Mar 2022 12:15:55 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Robert Raszuk Date: Tue, 8 Mar 2022 21:16:18 +0100 Message-ID: To: Christopher Morrow Cc: "Sriram, Kotikalapudi (Fed)" , "grow@ietf.org" , "sidrops@ietf.org" Content-Type: multipart/alternative; boundary="000000000000fca96d05d9baa535" Archived-At: X-Mailman-Approved-At: Tue, 08 Mar 2022 13:29:22 -0800 Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 20:16:03 -0000 --000000000000fca96d05d9baa535 Content-Type: text/plain; charset="UTF-8" Well I think the answer is - it depends. First IXP fabric can be used as pure L3 share LAN or can be used (and it is often the case) as a p2p emulated VLAN over such L3 shared LAN. Now if this is L3 shared LAN still customer and ISP may peer directly and no third party traffic would be accepted at either end. If we talk about emulating L2 IXP fabric becomes just an emulated circuit and from the perspective of routing it a p2p interface. Sure the other aspects of the IXP quality, port monitoring, oversubscription etc... always will apply but there are ways to mitigate or handle those in real IXPs. Best, R. On Tue, Mar 8, 2022 at 9:05 PM Christopher Morrow < christopher.morrow@gmail.com> wrote: > > > On Tue, Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (Fed) > wrote: > >> This question has relevance to the ASPA method for route leak detection. >> >> Is it possible that an ISP AS A peers with a customer AS C via a >> non-transparent IXP AS B? >> IOW, the AS path in routes propagated by the ISP A for customer C's >> prefixes looks like this: A B C. >> I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the >> middle between an ISP and its customer? >> >> > it seems unlikely to me that an ISP would pick up a 'customer' (someone > that pays them to transport packets) at an IXP fabric. > Might it happen? sure? is it messy? yes! > > 1) that's probably a shared port > 2) there are other folk feeding routes and packets into the mix > 3) how many came through the 'customer' port (which you can't really know > easily) vs other participants on the ix > 4) what capacity planning could the 'customer' do here? (none, basically > with respect to the remote ISP port) > > Your question might work also as: > "ISP A has a customer C on a direct link in location Y. > ISP A is present at IXP-Z, so is customer C, though they do not > bilaterally peer (not do they interconnect at the IXP). > ISP A can still see Customer C's routes through the IXP-Z Route Server." > > that seems plausible, but not a desired outcome for the ISP :) since they > will be unlikely to collect pesos for the traffic > which MAY pass across that interconnect. > > _______________________________________________ > GROW mailing list > GROW@ietf.org > https://www.ietf.org/mailman/listinfo/grow > --000000000000fca96d05d9baa535 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Well I think the answer is - it depends.=C2=A0

First IXP fabric can be used as pure L3 share LAN or can be used (a= nd it is often the case) as a p2p emulated VLAN over such L3 shared LAN.=C2= =A0

Now if this is L3 shared LAN still customer an= d ISP may peer directly and no third=C2=A0party traffic would be accepted a= t either end.=C2=A0

If we talk about emulating L2 = IXP fabric becomes just an emulated circuit and from the perspective of rou= ting it a p2p interface.=C2=A0

Sure the other aspe= cts of the IXP quality, port monitoring, oversubscription etc... always wil= l apply but there are ways to mitigate or handle those in real IXPs.=C2=A0<= /div>

Best,
R.








On Tue, Mar 8, 2022 at 9:05 PM Christopher Morrow <christopher.morrow@gmail.com> wrote:<= br>


On Tue, Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (= Fed) <kotikalapudi.sriram=3D40nist.gov@dmarc.ietf.org> wrote:
This question has relevance to = the ASPA method for route leak detection.

Is it possible that an ISP AS A peers with a customer AS C via a non-transp= arent IXP AS B?
IOW, the AS path in routes propagated by the ISP A for customer C's pre= fixes looks like this:=C2=A0 A B C.
I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the mi= ddle between an ISP and its customer?


it seems unlikely to me that an ISP would pick up a 'customer' (= someone that pays them to transport packets) at an IXP fabric.
Mi= ght it happen? sure? is it messy? yes!

1) that'= ;s probably a shared port
2) there are other folk feeding routes = and packets into the mix
3) how many came through the 'custom= er' port (which you can't really know easily) vs other participants= on the ix=C2=A0
4) what capacity planning could the 'custome= r' do here? (none, basically with respect to the remote ISP port)
=

Your question might work also as:
=C2=A0 "ISP A= has a customer C on a direct link in location Y.
=C2=A0 =C2=A0IS= P A is present at IXP-Z, so is customer=C2=A0C, though they do not bilatera= lly peer (not do they interconnect at the IXP).
=C2=A0 ISP A can = still see Customer C's routes through the IXP-Z Route Server."
=
that seems plausible, but not a desired outcome for the ISP :) since th= ey will be unlikely to collect=C2=A0pesos for the traffic
which M= AY pass across that interconnect.
=C2=A0=C2=A0
_______________________________________________
GROW mailing list
GROW@ietf.org
https://www.ietf.org/mailman/listinfo/grow
--000000000000fca96d05d9baa535-- From nobody Tue Mar 8 13:29:30 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C7803A170A for ; Tue, 8 Mar 2022 12:33:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.108 X-Spam-Level: X-Spam-Status: No, score=-2.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=raszuk.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id abjRA3DAPIUU for ; Tue, 8 Mar 2022 12:33:39 -0800 (PST) Received: from mail-vk1-xa2f.google.com (mail-vk1-xa2f.google.com [IPv6:2607:f8b0:4864:20::a2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CA893A1708 for ; Tue, 8 Mar 2022 12:33:39 -0800 (PST) Received: by mail-vk1-xa2f.google.com with SMTP id bk1so183691vkb.5 for ; Tue, 08 Mar 2022 12:33:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raszuk.net; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=w+v18HPFnunaJk8GodX8KHFv4pg2QkeQUDPfxLnGbbA=; b=CZb3mQjALBbp2eJtUV1TeH2Vt9YjaeQ+mdi22nYXFUV81JDveJHGc6Xi2UMsUM3csq 7VJwi3LQTuOGYuXvHeuNia/0zJ8PIIvyLusMlxif5lL+B+oc9+9kqdxbVZ8VlPCK/tsn 5egF8shnNJWB46/0T/Yn15pMudcwzZ1lAtDI4lg13EhW7vfQ0iGyaQHD32D2TAfDn6ah 4RBnlYcgXxYkJI5o+7ixq/V4RBs4hoM8wiKcP0Lkv/SO7Bezp7Ph5+BKISZIwBaOZ7oK XwhO0jvB2vVii76OmVlXcrA7vF/fkZBMJBRR9aeFY+Qh1w2PnMPZF1ahupyljv5y0q3q ssVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=w+v18HPFnunaJk8GodX8KHFv4pg2QkeQUDPfxLnGbbA=; b=0eEU4kHLUkOQCtvepiV/JmrXftY3yLWIrL6BJ/g0J/QTek0sne6llwT99GsbhIAYf0 blpFZuWvwYDGi1wv9PQ4Q5mHRU0Xou4a2VejebjMS1Pwpn3P328xkg2DwR3R5OfCqb71 KysTTDv3QAJWawmqsbmltMEloUjCco+Baiwa/Wcn/WoCESoqChBSctkkdbJQL+Q4gpUY bb6ZSyZB06LPTm6+4fHtmHI6hJdwyEpqO9XwYfrrvaYiIDp/CD1xji7ijWjQByemDIWc 0FBZX2Ruz+8QEBSYnlIae0hjgDN8XrpndCB524nr0QRndWlYj37ZUcdQR2OgLsUD9szn TtTw== X-Gm-Message-State: AOAM531h7I8Gbobjm9HlFbKZmOzrPjmdHDfBrpxwFsnY1YKaF7dkrDQw j6OkCJFq7mg4WHzAgMFG/v1JHBlCGzMhOB/KeqHEvw== X-Google-Smtp-Source: ABdhPJzy8AjqPjsEZnZqAjjxA+Ste8BxpsFILcBzHltUiDVCW34SGX3EFH3b+EtuM4lb9p2pzrcD/XJpri9RbQbJLfc= X-Received: by 2002:a05:6122:12b1:b0:32d:7e4b:91b7 with SMTP id j17-20020a05612212b100b0032d7e4b91b7mr8467925vkp.18.1646771618233; Tue, 08 Mar 2022 12:33:38 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Robert Raszuk Date: Tue, 8 Mar 2022 21:34:01 +0100 Message-ID: To: Christopher Morrow Cc: "Sriram, Kotikalapudi (Fed)" , "grow@ietf.org" , "sidrops@ietf.org" Content-Type: multipart/alternative; boundary="00000000000054da0605d9bae5f6" Archived-At: X-Mailman-Approved-At: Tue, 08 Mar 2022 13:29:22 -0800 Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 20:33:46 -0000 --00000000000054da0605d9bae5f6 Content-Type: text/plain; charset="UTF-8" Right - but IMO route leaking can happen both in the Internet or in customer <- via IXP -> content provider interconnects. And in the latter case - especially for those with open peering policy - often going via RS. After all this is how route servers are mainly used today :) So both sides will be peering to IXP RS while IXP RS will (in most cases) not appear in the AS_PATH. Kind regards, R. On Tue, Mar 8, 2022 at 9:26 PM Christopher Morrow < christopher.morrow@gmail.com> wrote: > > > On Tue, Mar 8, 2022 at 3:15 PM Robert Raszuk wrote: > >> Well I think the answer is - it depends. >> >> First IXP fabric can be used as pure L3 share LAN or can be used (and it >> is often the case) as a p2p emulated VLAN over such L3 shared LAN. >> >> Now if this is L3 shared LAN still customer and ISP may peer directly and >> no third party traffic would be accepted at either end. >> >> If we talk about emulating L2 IXP fabric becomes just an emulated circuit >> and from the perspective of routing it a p2p interface. >> >> Sure the other aspects of the IXP quality, port monitoring, >> oversubscription etc... always will apply but there are ways to mitigate or >> handle those in real IXPs. >> >> > I don't dispute your content here, except that Sriram's question was about > seeing 'customer routes via the RS'... which I think would obviate the > emulation examples you provided. > (well in a bunch of cases it would, you COULD hook up some tomfoolery to > get this to work, but... that sounds complex and prone to disaster) > > >> Best, >> R. >> >> >> >> >> >> >> >> >> On Tue, Mar 8, 2022 at 9:05 PM Christopher Morrow < >> christopher.morrow@gmail.com> wrote: >> >>> >>> >>> On Tue, Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (Fed) >>> wrote: >>> >>>> This question has relevance to the ASPA method for route leak detection. >>>> >>>> Is it possible that an ISP AS A peers with a customer AS C via a >>>> non-transparent IXP AS B? >>>> IOW, the AS path in routes propagated by the ISP A for customer C's >>>> prefixes looks like this: A B C. >>>> I.e., can the AS of a non-transparent IXP/RS appear in an AS path in >>>> the middle between an ISP and its customer? >>>> >>>> >>> it seems unlikely to me that an ISP would pick up a 'customer' (someone >>> that pays them to transport packets) at an IXP fabric. >>> Might it happen? sure? is it messy? yes! >>> >>> 1) that's probably a shared port >>> 2) there are other folk feeding routes and packets into the mix >>> 3) how many came through the 'customer' port (which you can't really >>> know easily) vs other participants on the ix >>> 4) what capacity planning could the 'customer' do here? (none, basically >>> with respect to the remote ISP port) >>> >>> Your question might work also as: >>> "ISP A has a customer C on a direct link in location Y. >>> ISP A is present at IXP-Z, so is customer C, though they do not >>> bilaterally peer (not do they interconnect at the IXP). >>> ISP A can still see Customer C's routes through the IXP-Z Route >>> Server." >>> >>> that seems plausible, but not a desired outcome for the ISP :) since >>> they will be unlikely to collect pesos for the traffic >>> which MAY pass across that interconnect. >>> >>> _______________________________________________ >>> GROW mailing list >>> GROW@ietf.org >>> https://www.ietf.org/mailman/listinfo/grow >>> >> --00000000000054da0605d9bae5f6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Right=C2=A0- but IMO route leaking can happ= en both in the Internet or in customer <- via IXP -> content provider= interconnects.=C2=A0

And in the latter case - especiall= y for those with open peering policy - often going via RS. After all this i= s how route servers are mainly=C2=A0used today :) So both sides will be pee= ring to IXP RS while IXP RS will (in most cases) not appear in the AS_PATH.= =C2=A0

Kind regards,
R.



On Tue, Mar 8, 2022 at 9:26 PM Christopher Morrow <christopher.morrow@gmail.com<= /a>> wrote:
<= div dir=3D"ltr">


<= div dir=3D"ltr" class=3D"gmail_attr">On Tue, Mar 8, 2022 at 3:15 PM Robert = Raszuk <robert@ra= szuk.net> wrote:
Well I think the answer is - it depends.=C2=A0
First IXP fabric can be used as pure L3 share LAN or can be= used (and it is often the case) as a p2p emulated VLAN over such L3 shared= LAN.=C2=A0

Now if this is L3 shared LAN still cus= tomer and ISP may peer directly and no third=C2=A0party traffic would be ac= cepted at either end.=C2=A0

If we talk about emula= ting L2 IXP fabric becomes just an emulated circuit and from the perspectiv= e of routing it a p2p interface.=C2=A0

Sure the ot= her aspects of the IXP quality, port monitoring, oversubscription etc... al= ways will apply but there are ways to mitigate or handle those in real IXPs= .=C2=A0


I don= 9;t dispute your content here, except that Sriram's question was about = seeing 'customer routes via the RS'... which I think would obviate = the emulation examples you provided.
(well in a bunch of cases it= would, you COULD hook up some tomfoolery to get this to work, but... that = sounds complex and prone to disaster)
=C2=A0
Best,
R.








On Tue, Mar 8, 2022 at 9:05 = PM Christopher Morrow <christopher.morrow@gmail.com> wrote:


On Tue, Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (Fed) <kotik= alapudi.sriram=3D40nist.gov@dmarc.ietf.org> wrote:
This question has relevance to the ASPA metho= d for route leak detection.

Is it possible that an ISP AS A peers with a customer AS C via a non-transp= arent IXP AS B?
IOW, the AS path in routes propagated by the ISP A for customer C's pre= fixes looks like this:=C2=A0 A B C.
I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the mi= ddle between an ISP and its customer?


it seems unlikely to me that an ISP would pick up a 'customer' (= someone that pays them to transport packets) at an IXP fabric.
Mi= ght it happen? sure? is it messy? yes!

1) that'= ;s probably a shared port
2) there are other folk feeding routes = and packets into the mix
3) how many came through the 'custom= er' port (which you can't really know easily) vs other participants= on the ix=C2=A0
4) what capacity planning could the 'custome= r' do here? (none, basically with respect to the remote ISP port)
=

Your question might work also as:
=C2=A0 "ISP A= has a customer C on a direct link in location Y.
=C2=A0 =C2=A0IS= P A is present at IXP-Z, so is customer=C2=A0C, though they do not bilatera= lly peer (not do they interconnect at the IXP).
=C2=A0 ISP A can = still see Customer C's routes through the IXP-Z Route Server."
=
that seems plausible, but not a desired outcome for the ISP :) since th= ey will be unlikely to collect=C2=A0pesos for the traffic
which M= AY pass across that interconnect.
=C2=A0=C2=A0
_______________________________________________
GROW mailing list
GROW@ietf.org
https://www.ietf.org/mailman/listinfo/grow
--00000000000054da0605d9bae5f6-- From nobody Tue Mar 8 13:30:47 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A4973A17F2; Tue, 8 Mar 2022 13:30:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.107 X-Spam-Level: X-Spam-Status: No, score=-2.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vgwOixxOng9P; Tue, 8 Mar 2022 13:30:36 -0800 (PST) Received: from mail-qt1-x82d.google.com (mail-qt1-x82d.google.com [IPv6:2607:f8b0:4864:20::82d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 334733A17E9; Tue, 8 Mar 2022 13:30:36 -0800 (PST) Received: by mail-qt1-x82d.google.com with SMTP id o22so292948qta.8; Tue, 08 Mar 2022 13:30:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LXnceGUyCoU6Lr6PuZvG7FT4CmQEHn6gzikqrx6U1G4=; b=ILCie6ezQPHqkxJ3H+Eh2Xcr+VJsw+uqgDd8CJcyTvisdpu9azQ5qJy3xYPl+d4E0G KMViBgOkgpRTQ2PeEBWnS0bAKpxDpNYVQ/KcHXHAy9eO/0B11D0dhEkWMihEKZYA7cU0 klNkUjeRjRD91xenEPbx0ggRI0ek9md9L54xAKjG3pGuawZDhTiUVbUh4YfPxOex8ZR7 9v/F5vdUkDNG1VfKaeZmCMlrT+MW86VbjbO/TLrM01RO2D+o5/EcG9yiOItwstT7pAGs znPp25Hsk++0LLJZiXMSzcOaR7r9gRHqosmmmpf34eRVHjRZ7rPtywcLMkvK/I0KVd/Q TOwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LXnceGUyCoU6Lr6PuZvG7FT4CmQEHn6gzikqrx6U1G4=; b=IFTbXHGDKnS+cY7+GsntmO3k1W3audvYS6/FzGxEJP9t1mn4saMkIoeunFuLfZ/z6q dGIWXdUJoIUo/vWRb+TWQm3Ah2JxmbP7FacvkNLB9EnPeIzo76MmvNT1eZwf3avZK7ZI pe2pK57CjAtJI9NvFgFjM89yN11MBNGhqsxcDTa7i6tUAK/qQwrGbGL9yUCxJ/Gcj4Vt 5dpb1gnTOh+zsdD+XRcnLv5VbiVnyjIVEnf8+uy457jegp1trVBfUAxs0UdN7TMWfNSY ECokD8FgTrmRZUG6q7PuCBZ67ucKULWRmCLFAx1SJ4o4cXUKObwkhKonGg7pm/VbeiJ4 44dA== X-Gm-Message-State: AOAM531gK2GKdelKIh+YpluHh1vVQTUlReDH7ODZUHLjagnxETv6zhFu tCQ6vhEOdLSPoB2EbzmoB2z1BdgiK06M538U/c8= X-Google-Smtp-Source: ABdhPJx2qQuOX7ionvWoLZHfpY5C9Rym/pGqk+F6DacbcR0CGG7+QslobdQXcxXwYVasJwoSF8IeXKrFBDfXiNP9RpY= X-Received: by 2002:ac8:5dc8:0:b0:2de:61eb:331f with SMTP id e8-20020ac85dc8000000b002de61eb331fmr15450804qtx.2.1646775034729; Tue, 08 Mar 2022 13:30:34 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Christopher Morrow Date: Tue, 8 Mar 2022 16:30:23 -0500 Message-ID: To: Robert Raszuk Cc: "Sriram, Kotikalapudi (Fed)" , "grow@ietf.org" , "sidrops@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f8599705d9bbb073" Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 21:30:41 -0000 --000000000000f8599705d9bbb073 Content-Type: text/plain; charset="UTF-8" On Tue, Mar 8, 2022 at 3:33 PM Robert Raszuk wrote: > > Right - but IMO route leaking can happen both in the Internet or in > customer <- via IXP -> content provider interconnects. > > And in the latter case - especially for those with open peering policy - > often going via RS. After all this is how route servers are mainly used > today :) So both sides will be peering to IXP RS while IXP RS will (in most > cases) not appear in the AS_PATH. > > > sure! that was my re-wording of sriram's question, effectively. (or I think that was the re-wording!) > > > On Tue, Mar 8, 2022 at 9:26 PM Christopher Morrow < > christopher.morrow@gmail.com> wrote: > >> >> >> On Tue, Mar 8, 2022 at 3:15 PM Robert Raszuk wrote: >> >>> Well I think the answer is - it depends. >>> >>> First IXP fabric can be used as pure L3 share LAN or can be used (and it >>> is often the case) as a p2p emulated VLAN over such L3 shared LAN. >>> >>> Now if this is L3 shared LAN still customer and ISP may peer directly >>> and no third party traffic would be accepted at either end. >>> >>> If we talk about emulating L2 IXP fabric becomes just an emulated >>> circuit and from the perspective of routing it a p2p interface. >>> >>> Sure the other aspects of the IXP quality, port monitoring, >>> oversubscription etc... always will apply but there are ways to mitigate or >>> handle those in real IXPs. >>> >>> >> I don't dispute your content here, except that Sriram's question was >> about seeing 'customer routes via the RS'... which I think would obviate >> the emulation examples you provided. >> (well in a bunch of cases it would, you COULD hook up some tomfoolery to >> get this to work, but... that sounds complex and prone to disaster) >> >> >>> Best, >>> R. >>> >>> >>> >>> >>> >>> >>> >>> >>> On Tue, Mar 8, 2022 at 9:05 PM Christopher Morrow < >>> christopher.morrow@gmail.com> wrote: >>> >>>> >>>> >>>> On Tue, Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (Fed) >>>> wrote: >>>> >>>>> This question has relevance to the ASPA method for route leak >>>>> detection. >>>>> >>>>> Is it possible that an ISP AS A peers with a customer AS C via a >>>>> non-transparent IXP AS B? >>>>> IOW, the AS path in routes propagated by the ISP A for customer C's >>>>> prefixes looks like this: A B C. >>>>> I.e., can the AS of a non-transparent IXP/RS appear in an AS path in >>>>> the middle between an ISP and its customer? >>>>> >>>>> >>>> it seems unlikely to me that an ISP would pick up a 'customer' (someone >>>> that pays them to transport packets) at an IXP fabric. >>>> Might it happen? sure? is it messy? yes! >>>> >>>> 1) that's probably a shared port >>>> 2) there are other folk feeding routes and packets into the mix >>>> 3) how many came through the 'customer' port (which you can't really >>>> know easily) vs other participants on the ix >>>> 4) what capacity planning could the 'customer' do here? (none, >>>> basically with respect to the remote ISP port) >>>> >>>> Your question might work also as: >>>> "ISP A has a customer C on a direct link in location Y. >>>> ISP A is present at IXP-Z, so is customer C, though they do not >>>> bilaterally peer (not do they interconnect at the IXP). >>>> ISP A can still see Customer C's routes through the IXP-Z Route >>>> Server." >>>> >>>> that seems plausible, but not a desired outcome for the ISP :) since >>>> they will be unlikely to collect pesos for the traffic >>>> which MAY pass across that interconnect. >>>> >>>> _______________________________________________ >>>> GROW mailing list >>>> GROW@ietf.org >>>> https://www.ietf.org/mailman/listinfo/grow >>>> >>> --000000000000f8599705d9bbb073 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Mar 8, 2022 at 3:33 PM Robert= Raszuk <robert@raszuk.net> = wrote:

Right=C2=A0- but IMO route leaking can happen both = in the Internet or in customer <- via IXP -> content provider interco= nnects.=C2=A0

And in the latter case - especially for th= ose with open peering policy - often going via RS. After all this is how ro= ute servers are mainly=C2=A0used today :) So both sides will be peering to = IXP RS while IXP RS will (in most cases) not appear in the AS_PATH.=C2=A0



su= re! that was my re-wording of sriram's question, effectively. (or I thi= nk that was the re-wording!)
=C2=A0

=
On Tue= , Mar 8, 2022 at 9:26 PM Christopher Morrow <christopher.morrow@gmail.com>= wrote:


On Tue, Mar 8, 2022 at 3:15 PM Robert Raszuk = <robert@raszuk.ne= t> wrote:
Well I think the answer is - it depends.=C2=A0

First IXP fabric can be used as pure L3 share LAN or can be used (= and it is often the case) as a p2p emulated VLAN over such L3 shared LAN.= =C2=A0

Now if this is L3 shared LAN still customer= and ISP may peer directly and no third=C2=A0party traffic would be accepte= d at either end.=C2=A0

If we talk about emulating = L2 IXP fabric becomes just an emulated circuit and from the perspective of = routing it a p2p interface.=C2=A0

Sure the other a= spects of the IXP quality, port monitoring, oversubscription etc... always = will apply but there are ways to mitigate or handle those in real IXPs.=C2= =A0


I don't = dispute your content here, except that Sriram's question was about seei= ng 'customer routes via the RS'... which I think would obviate the = emulation examples you provided.
(well in a bunch of cases it wou= ld, you COULD hook up some tomfoolery to get this to work, but... that soun= ds complex and prone to disaster)
=C2=A0
Best,
R.




=




On Tue, Mar 8, 2022 at 9:05 PM= Christopher Morrow <christopher.morrow@gmail.com> wrote:


On Tue, Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (Fed) <kotikal= apudi.sriram=3D40nist.gov@dmarc.ietf.org> wrote:
This question has relevance to the ASPA method = for route leak detection.

Is it possible that an ISP AS A peers with a customer AS C via a non-transp= arent IXP AS B?
IOW, the AS path in routes propagated by the ISP A for customer C's pre= fixes looks like this:=C2=A0 A B C.
I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the mi= ddle between an ISP and its customer?


it seems unlikely to me that an ISP would pick up a 'customer' (= someone that pays them to transport packets) at an IXP fabric.
Mi= ght it happen? sure? is it messy? yes!

1) that'= ;s probably a shared port
2) there are other folk feeding routes = and packets into the mix
3) how many came through the 'custom= er' port (which you can't really know easily) vs other participants= on the ix=C2=A0
4) what capacity planning could the 'custome= r' do here? (none, basically with respect to the remote ISP port)
=

Your question might work also as:
=C2=A0 "ISP A= has a customer C on a direct link in location Y.
=C2=A0 =C2=A0IS= P A is present at IXP-Z, so is customer=C2=A0C, though they do not bilatera= lly peer (not do they interconnect at the IXP).
=C2=A0 ISP A can = still see Customer C's routes through the IXP-Z Route Server."
=
that seems plausible, but not a desired outcome for the ISP :) since th= ey will be unlikely to collect=C2=A0pesos for the traffic
which M= AY pass across that interconnect.
=C2=A0=C2=A0
_______________________________________________
GROW mailing list
GROW@ietf.org
https://www.ietf.org/mailman/listinfo/grow
--000000000000f8599705d9bbb073-- From nobody Tue Mar 8 13:39:34 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B1EC13A1854; Tue, 8 Mar 2022 13:39:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.11 X-Spam-Level: X-Spam-Status: No, score=-2.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=workonline.africa Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7f8ASNotNgOu; Tue, 8 Mar 2022 13:39:24 -0800 (PST) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-ve1eur02on062a.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe06::62a]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 368913A184D; Tue, 8 Mar 2022 13:39:21 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WUEcgndOVmwtwTYUb1i066kVO52sqk9HBWjpPdNytl0njcp7DfzpJ4luhOHsZlpPT5UyBfg4f4QFI78M4oG8xil6reGPPJuFDOs5JP8p+GTFXfNcxlpYilgeNuaH1uxQNVxNn0FkUEtKqLm5Do/2ve9mnBStntoOUBZ8JMv8zML3MzvGGbKfIPqbRCblWVnnlT4OJt7ZFnZWyzqVRg+cJbGuNOQwG3bP/PBiFWQraMWfWXOJoWR+9F/NqDGdm+pP474wKS63pyh0nIcKwUwqrxAZ04m4NCcMx6rIVQcHXRIwaOzVczp7pUWMJYpt0G9jSfKIJRyLk4lkGzDk0B7W8A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=25WrRrNtCaJFz4Jx56aIiteq1rAUMT6zFxzJZIDuCsg=; b=BZedST+e0WNsv/fa3FkaUw4RIqUvskSXUr4YV2OYuDd7ovwzAApm4h3UtxKgGEYupzHnaFYszT3fFgqVODIDSNaZzJRN0AZrpjyOvyJo8Eu421ZEfF4/ddDWFWlVx0jzM++W1st1VWQKOfxKtYsm0+QHaeBwoQNEhTgBaETkUNLMAjFi9QLoSC5oLyf/FIVmm3AC/GjeGjT4cphsl/w67I+fnDR7sXn7SpVAV7NzaHawobXSCmtrdSj1HHDsbxM4qqkLdE/PJfGBtNt4k5tVnwCEkLyCaN1s5wi/XtVTZnmJ+2Gkkh1cTxQ0VBY918y+3MuowDeKADidwsAKBli1Cg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=workonline.africa; dmarc=pass action=none header.from=workonline.africa; dkim=pass header.d=workonline.africa; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=workonline.africa; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=25WrRrNtCaJFz4Jx56aIiteq1rAUMT6zFxzJZIDuCsg=; b=Vo/Yyl6ajzGA7T1oqT5pZjaSI2Ss46yuyGY7s8wE0ycnov9cSRCs4rAuhSfucvmuj9BdOnKOvxWygM8wvvJMtHjydBbrVaCIeUEJ/6bKGNmguAo2AX0G6IrSLchs/zD+MLUVVQM/+UuKFD8Oj8YixM90UED6+dZM+ISScI2eVdk= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=workonline.africa; Received: from AS8P190MB1078.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:2e7::13) by AM4P190MB0115.EURP190.PROD.OUTLOOK.COM (2603:10a6:200:5e::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5038.19; Tue, 8 Mar 2022 21:39:16 +0000 Received: from AS8P190MB1078.EURP190.PROD.OUTLOOK.COM ([fe80::c1c0:78a0:e699:848b]) by AS8P190MB1078.EURP190.PROD.OUTLOOK.COM ([fe80::c1c0:78a0:e699:848b%6]) with mapi id 15.20.5038.027; Tue, 8 Mar 2022 21:39:16 +0000 Date: Tue, 8 Mar 2022 23:39:07 +0200 From: Ben Maddison To: Christopher Morrow Cc: "Sriram, Kotikalapudi (Fed)" , "grow@ietf.org" , "sidrops@ietf.org" Message-ID: <20220308213907.nwb6oe7qwixattga@benm-laptop> References: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="dwjegeeqldshwhhs" Content-Disposition: inline In-Reply-To: X-ClientProxiedBy: CTXP275CA0014.ZAFP275.PROD.OUTLOOK.COM (2603:1086:100::26) To AS8P190MB1078.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:2e7::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 2ed35ade-c96f-411f-72a5-08da014c1808 X-MS-TrafficTypeDiagnostic: AM4P190MB0115:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: P9fOz5xdO1G4iaTBwizNU1H4Kuss1kjg2Jr3SxCiudSCOrc/4YSglZB+D5UdVVo9v2l02dTcektIx1VpfKRe10wL+uX3T42ZLEo96NEvuiC6OPcy7l3BvVJMztrC/zlbw8YyOaLcNQbTCvY1oLp9VXKFGNIb+R6zPKm4lj/B2lhEZfdKG63VI36brp9S1lHbKGSKtsFMHMpyPUCj74Oc72lPjt5n5xap5b/unHLfny9n+awF3FbER6PyF+3PsQcUwb0AlN4mCAbfmAs9AaPBMcNmjQKiiwn11X48dWQpwYPa1HvZP7jTmxK9sHYhlZV6SCRSeAFQ1qi1l6Edc9anB+/p+/+KRkjagcickkPgV6S4K0OfFYizP5B+xyTf6rzpM+6UO0mKo73kFgudXjT1OST5LajHD/71oOkaiz1wr1RCgV/+qTjr9iNJltLknGqI+RZDJxNk6ADIjHqeqUtBAKJCv2/v4nuBvwGo7eaSOOvIWXiCiJeRuyBS3KXrYeb69K4yPsFSZ8exNKi1kv5lOGxI7eWZmTDUU75NMpIl8Z2vUbJbfYgUSw1xsAupiz4OEgeXY/wNoCO8ax3yEzaPUEp22WTDdz6w+vHphtxO/kab4T1cgwmmXy498JE33RKhFAW/ghgjFhVFvS8EByNJ241tqDeFThSHl5+k9Xp4v8SsSFtymZy38HK1OanDM8QJhS0dQav6IdBmaBz4nsZVmBwnAJFfebnwtbglV29XVTxRgYP5CCUej/X0nnD8p+Xu X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AS8P190MB1078.EURP190.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230001)(7916004)(346002)(366004)(33716001)(26005)(38350700002)(38100700002)(21480400003)(83380400001)(6666004)(6916009)(54906003)(66946007)(66556008)(8676002)(66476007)(186003)(6512007)(9686003)(4326008)(2906002)(6486002)(1076003)(5660300002)(8936002)(86362001)(52116002)(508600001)(44144004)(53546011)(6506007)(46492015)(2700100001); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?f5gEleA8wM3w9JEnZuIPexvX+yFh5UKMzG8kmGJSuPQbTyUkz5pAgA/MFQfk?= =?us-ascii?Q?oXrntfMOHJnkTONb4NqJkNnbzFe5jXW1oT1mA4l7NvR8z7TrvxQAyvq9UzBa?= =?us-ascii?Q?sEjXut/eqhjfeHk1YeM2BXkaL9GDj+OhEE8mH0h8n3EdThkWF9bNHnqfuei0?= =?us-ascii?Q?1qrdx2J2ZJXU2u+dkM9PykoqNKbKVZGSRjQOelPfJ4iWReDiPdYf5fRSipH3?= =?us-ascii?Q?ipQro66DQcwMpP/TD+bdBjJGlgzXSPjjFJfxwMkPEob9wOndUrS+XIPacqQW?= =?us-ascii?Q?tuwye1H6WxHJIjpDuC8EBt25oRxzEEAZX1POBRQ45tb5QZ90ycweKlboqOdd?= =?us-ascii?Q?cL1FMqNptzFdZPPXTJW7++I9+CX84fycMA19cjRwp99cDjeooyDxj9lj6eAE?= =?us-ascii?Q?YplBxzGDbHKQqh8KSmfLxAy0dTCVPfAqv5Odj3FSA5nj/+msifADc8WEKt3D?= =?us-ascii?Q?wnh3hS8RKHKAlSGK0goeD4YOw/0Rw/5Px7+xN2+4/UcOC+vJl7OLZlsv1TU2?= =?us-ascii?Q?O5MyIR3sylP+hv2XTo81TVLGXo+XPo8NVqYhI8ZtZHoTPnOef90v65DBoB4E?= =?us-ascii?Q?q4eAMK4aJ2qpUrTxGqPNe0yLkldk9UIFk+IxvjBnVq0iENjXz7u78EAzX5gM?= =?us-ascii?Q?wqr9TaEsi8AztEVyoy9jBqOzPClVs5PkxVKfWxTFa/oewBI5eNERuVjcB4mL?= =?us-ascii?Q?kY5miI+55THkxygine7659cJxcuPTYidx+oWLpkDk6OEZYyGhJhRwg7yEbIn?= =?us-ascii?Q?UwLhcf+L0OIKp3hAYWdwjuxhOA+VHmCDv3KYKF9XrRW1HbjEMyyU4XfXYPuU?= =?us-ascii?Q?774kRbRNjiEVrfbb9PMYx7UReqQvmyOdAs7EOz/EVhus8yb9c+NlRFMS9T8b?= =?us-ascii?Q?clMHD7av7O327BFUC9u1o0tgGlSw67s+t/yuOVTixYlL0x/jGtHDhOma5sHQ?= =?us-ascii?Q?wQxcgcrcchHZviQGKSFhh6dMlFXrDy4pq+B5j97h+l1H1irHj9GizB0c953o?= =?us-ascii?Q?6jv+KBDxx6tAbvbZ+yUKElR8zsqSBUVUeJcU/JXTL2okluxyk2/moVWbxNTr?= =?us-ascii?Q?Lgd+Vfg1D0K9T3fQ/5UZN64eJ+V0r9fLV7nDKYdXpLy7mH7d/ZhQojPzX1Wa?= =?us-ascii?Q?SEkZXAT49WJStH/xVauETp8pj9icmWJ1xSSS2TwGIl4AiRGxVUVzU1skqIEU?= =?us-ascii?Q?gIWg+Kz07fFFrCVamE7AxUkVwMX9bFYmEoQZXmMIQIHck1XxCpq5SF/FWyaM?= =?us-ascii?Q?i+XEuAb+QhMt/2rouORU962XJuLjuszwJ2nycGmRxkqXFUdwaua5WgnH9mpi?= =?us-ascii?Q?Z8p/8Azdg+sxSYYfHB3SChod+4XDJAAuXeVeneff++IpD/90B3Pd8G5lnPst?= =?us-ascii?Q?30bzmXZx3IIipp8QVNTR/7rap22Yf/TO/APDW+QyAPH/dP92LnHr97rc/T8R?= =?us-ascii?Q?nRmqG4gWm03P3wwhGZDIHLKcDfPwv2UTRWgktkM/FRtZr6ff6Gu9lU1MMsZR?= =?us-ascii?Q?GXKZyj30IuoPr6A3p4ig2nd1/3ClAiI8ANgxLSpZ/OxULFvVU7LWmGQbZNUk?= =?us-ascii?Q?cK0nUhrLoNqInSMwO1wbp5EiebC3xzcoS4XAxyRO5Yw/RWacuz2IlSSQV0pe?= =?us-ascii?Q?c1/7UAQzLwWhKeDHoh2XMcY=3D?= X-OriginatorOrg: workonline.africa X-MS-Exchange-CrossTenant-Network-Message-Id: 2ed35ade-c96f-411f-72a5-08da014c1808 X-MS-Exchange-CrossTenant-AuthSource: AS8P190MB1078.EURP190.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Mar 2022 21:39:16.2131 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: b4e811d5-95e8-453a-b640-0fba8d3b9ef7 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 8dvEDb/cikMuXw5eT5AcRRiQA4BQzL0kEREjShQaOiD6zTEnD/1o5d7rbi8au4u7deyxTKfeXPZKRZrJ+rqODA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4P190MB0115 Archived-At: Subject: Re: [Sidrops] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 21:39:30 -0000 --dwjegeeqldshwhhs Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 03/08, Christopher Morrow wrote: > On Tue, Mar 8, 2022 at 2:36 PM Sriram, Kotikalapudi (Fed) > wrote: >=20 > > This question has relevance to the ASPA method for route leak detection. > > > > Is it possible that an ISP AS A peers with a customer AS C via a > > non-transparent IXP AS B? > > IOW, the AS path in routes propagated by the ISP A for customer C's > > prefixes looks like this: A B C. > > I.e., can the AS of a non-transparent IXP/RS appear in an AS path in the > > middle between an ISP and its customer? > > > > > it seems unlikely to me that an ISP would pick up a 'customer' (someone > that pays them to transport packets) at an IXP fabric. > Might it happen? sure? is it messy? yes! >=20 I know of several transit providers that will allow customers to use an IXP as a kind of virtual access circuit (which itself is a poor idea), but I would be *very* surprised if any of them allow RS peerings to be the control plane interconnection (intentionally, at least). If the underlying question is "should the ASPA path validation algorithm have a corner case that accommodates this?", that is a very, very firm "no" from me! Cheers, Ben --dwjegeeqldshwhhs Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEadkaB2uV5dm5UllaOkYk/rSLaGAFAmInzPoACgkQOkYk/rSL aGAIKQ/+J+HQaxc2yZ3vQZBC6ZUiqN8gTuCN4PEx+VhKDx5khGHwmjZ3kLTNX4Iy SSMc/v/WNIsl5cy/x8TO6IJnUtGJH4oRowgrc/KwxP421ieKSwybnMm2uheuSPOv xnm/ocWc7DvvF1q9DAXYwZc7xeXe2PHzvHp+APZ6cwS/PbM7yxLA/zxCvcSm1iVn 0UJisZ39Fa88I7ETn8C4mr74nampexzEIlno/cheicxQnWOfi73/izOIYy203HQx oUSqDvW1vF79TS4smJBfIwVyAa3AuAc9IV7QtpD7KdlzUmxwcnjU5KDr3CzSwhPd AjIP+Rp0RRX0s4u1XC605J/EzQKThjdAcjgOAEQMp2f2Pjymj/jobL5UT6Seje8w FxEwTnsjkF9nzUPrIDVxzpsYUdsWwiJyqZbTDaWYbD1eluJRojEXc8F9g4EWHdDj TcXM4iMCjGRZS2M1hOdDPr9PtvX5DvD/1Fhv4wfLh003858yhhJEtq0hdSYroaBK XNdxNQjmLltPn55OaCwUVUcR51VVoR4boPpLtlWMle+CTvOgqpAdnsZ41S3FsVOZ WVg7RLEJDmp0+THhQQ/SXURezAmh5n9qtTKQt0wsbge2NE+x48zr998Iyh0n6yfF UsQkxEGvsY3zcnQsoNkDp7WbEvs2NdVw+08wOMXLHeiGm6S+9n4= =HyzQ -----END PGP SIGNATURE----- --dwjegeeqldshwhhs-- From nobody Tue Mar 8 15:06:04 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA7383A1B3D; Tue, 8 Mar 2022 15:05:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ROeuhd9kXVKO; Tue, 8 Mar 2022 15:05:53 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86E833A1B3F; Tue, 8 Mar 2022 15:05:53 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nRitp-000PWl-OU; Tue, 08 Mar 2022 23:05:49 +0000 Date: Tue, 08 Mar 2022 15:05:48 -0800 Message-ID: From: Randy Bush To: Ben Maddison Cc: Christopher Morrow , "sidrops@ietf.org" , "grow@ietf.org" , "Sriram, Kotikalapudi (Fed)" In-Reply-To: <20220308213907.nwb6oe7qwixattga@benm-laptop> References: <20220308213907.nwb6oe7qwixattga@benm-laptop> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2022 23:05:56 -0000 > If the underlying question is "should the ASPA path validation > algorithm have a corner case that accommodates this?", that is a > very, very firm "no" from me! aol From nobody Wed Mar 9 08:40:31 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 596623A0D63; Wed, 9 Mar 2022 08:39:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iTTIv_jLyqpo; Wed, 9 Mar 2022 08:39:52 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3338F3A0D61; Wed, 9 Mar 2022 08:39:52 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nRzLp-000WLO-Uw; Wed, 09 Mar 2022 16:39:50 +0000 Date: Wed, 09 Mar 2022 08:39:49 -0800 Message-ID: From: Randy Bush To: SIDR Operations WG , GMO Crops User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2022 16:39:55 -0000 >> If the underlying question is "should the ASPA path validation >> algorithm have a corner case that accommodates this?", that is a >> very, very firm "no" from me! > > aol opologies, it seems i used an american idiom, and an antique one at that. a few folk were brave enough to ask, so ... tl;dr: precursor of +1 long, and probably somewhat incorrect, answer in the spirit of trying to keep net cultural history alive. someone better at net cultural history than i can probably point you to historical documents. back in the '80s, there were two large walled gardens of dial-up users, America Online (AOL) and CompuServe. when the pressure of the internet's success started forcing their gates, the first breach was gateways to the usenet. aol citizens were over enthusiastic eager beavers known for "meee tooo!" so the first shorthand for "me too" became "aol." i am not sure when "+1" came in, but a decade or so later. maybe folk had to learn to count first. along a similar vein, the precursor to the SWAT attack was having a truckload of compuserve install cd-roms sent to someone's home. i am not sure it was actually done, or was just apocrypha. randy From nobody Wed Mar 9 15:18:33 2022 Return-Path: X-Original-To: sidrops@ietf.org Delivered-To: sidrops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E6E73A11EA; Wed, 9 Mar 2022 15:17:56 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Tim Bray via Datatracker To: Cc: draft-ietf-sidrops-rpki-has-no-identity.all@ietf.org, last-call@ietf.org, sidrops@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.46.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <164686787641.27464.13731142773840437850@ietfa.amsl.com> Reply-To: Tim Bray Date: Wed, 09 Mar 2022 15:17:56 -0800 Archived-At: Subject: [Sidrops] Artart last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2022 23:17:57 -0000 Reviewer: Tim Bray Review result: On the Right Track I have reviewed draft-ietf-sidrops-rpki-has-no-identity-04. Preliminary disclosures: I have never previously encountered RPKI and don't know much about BGP. I do understand PKI issues reasonably well. Summary: The authors point out that RFC 6480 is at pains to establish that its certs and keypairs do not assert the identity of any organization, but rather just the capability of issuing ROAs to support routing. They discuss problems that could occur should these certs be used in a way that implies they identify some organization, and go on to say, in section 2, “RPKI-based credentials of INRs MUST NOT be used to authenticate real-world documents or transactions without some formal external authentication of the INR and the authority for the actually anonymous INR holder to authenticate the particular document or transaction.†Then they repeat this MUST in section 4. Upon reading this, the following issues occur. None of the questions below are rhetorical; as mentioned above, my expertise here is very limited. 1. Is this sort of bad-practice use of RPKI keypairs actually occurring? Ie. is there a threat that needs to be staved off? I hypothesize that some Internet-Draft somewhere has suggested this mis-use of RPKIs and the purpose of draft-ietf-sidrops-rpki-has-no-identity is to give reviewers an extra leg to stand on when saying "Don't do that". Which seems reasonable but shouldn't be necessary? 2. Assuming that people are doing this and we want them to stop, is issuing this sort of RFC the best way, or even likely to be effective, at doing so? I grant that it might be effective in suppressing this bad practice in I-Ds but 6480 seems pretty clear to me. 3. The single MUST assertion being repeated twice is unnecessary. 4. The MUST assertion feels unnecessarily complicated and long-winded. I think what they're trying to say is "You MUST NOT perform PKI operations with these certs except exactly as described, and for the purposes described, in 6480.†5. The discussion in section 3 about how the holders of RPKI keys probably don't issue their own certs but get CAs to do that left me a bit puzzled. Is the conclusion that we should admonish CAs not to do this? Or is it the case that some key-holders do issue their own certs but are Being Bad? 6. Section 3 is kind of long and discursive and could likely be shortened without loss of value. The document might be more useful if there were subsection 3.1 Issuers of RPKI certificates, 3.2 Organizational issues, etc It should be obvious that I don't understand whether there's a bad-practice problem out there, who the bad practitioners are, and whether this document as an RFC will help stop them. If it is the case that there is some organization that is mis-using RFC6480 keys and there is a case to be made that a follow-up RFC will curtail this practice, then this draft contains the basis of such an RFC. [It is also possibly the case that those better acquainted with RPKI will instantly understand what the problem is and why the language herein will help deal with it, in which case feel free to ignore most of my comments. ] From nobody Wed Mar 9 15:51:09 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DC693A12A3; Wed, 9 Mar 2022 15:50:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.11 X-Spam-Level: X-Spam-Status: No, score=-7.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=apnic.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id khGwVVSLRXIZ; Wed, 9 Mar 2022 15:50:47 -0800 (PST) Received: from AUS01-SY4-obe.outbound.protection.outlook.com (mail-sy4aus01on2060a.outbound.protection.outlook.com [IPv6:2a01:111:f403:7005::60a]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8AA1E3A12A7; Wed, 9 Mar 2022 15:50:43 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lSiV014Gmn9lnOUCzj1C9AqHtdk7C/jOuZrFWqqRVTo4ilMJ/Mk1/y6Se6RqbulCWhqY1Yu3OVsgk1OCHtpIbZvQC6KnibHRndhyexu4McLCwsLJ2cKCLAIOJLRk+hRK3ytjhK9TRGs6NoyuKY4mMMiGh7lf+rSOw8uOXXD71hRpyNCqNTZgIYor8xaJIX0Yx2URB9OGyMNEQhztRSbMlVJDJGEgNYoRH9icF7Lo/yi/h2RlUHPbEmaZsX+I1UVtEKuvk1Rlts/xTH7R7dlZKCJ/1UzFl+46A3Nyc/NgefyBFuBBRs5veyEsgRtzeeVV/1KVeQkZdizmMo7K4lH7Ag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=hRvRIywu8Smu4izNHjgdUatYfhnyf7bxhSuXZ5mt9DY=; b=D4BAC8SjLR8i1bceiyNNNRePIcvADh0kSAU5SMyiegztuhcDyhQw+MqkeCXABtNFbLbGGyPmG8/nIYy9CQBJopZKaE5mUeRGrtohRNyuIIXS7W5ng6EIxMg4C5VIbZUy0jl7OPjzf6dU1vUk6x5hx52XWZuvBm5ShVsWwvJKM2lGncfBmGSbNdAq2Rwn/jj9ZIHhdYRNS0wer46iIPwVrK1GIieuEIwfRDYT1XKuop2QGJTfmt4HFywFyun4S8ij6Q4+GLfZIEdzFcapPuDCaegwMbPUvK4/0/YxxVIqO41gRNjaAFqcikoabb6LZyYIp4KY/3nBsv8CN/kXdIF9Gg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=apnic.net; dmarc=pass action=none header.from=apnic.net; dkim=pass header.d=apnic.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apnic.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hRvRIywu8Smu4izNHjgdUatYfhnyf7bxhSuXZ5mt9DY=; b=YG1gHr1Fwrd5UXwjFILNGn+8K3aG3pQf8mCFOeoJi2uyOvDQHClrTlh20dYS3PawetzLV6dEHh+6P4Z7AGnNyr4QUohOR8+tOhuZ9VOmU3Hd/wpfEInEx3kvr4sK5h7/nu0IJh/W3AU/dWwFJiyapeHLduFY/6zHgSB8hiKwHCE= Received: from SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:176::18) by MEAP282MB0103.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:66::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5038.18; Wed, 9 Mar 2022 23:50:33 +0000 Received: from SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM ([fe80::2d75:2788:316:de9]) by SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM ([fe80::2d75:2788:316:de9%4]) with mapi id 15.20.5061.022; Wed, 9 Mar 2022 23:50:33 +0000 From: Geoff Huston To: Tim Bray CC: "art@ietf.org" , "last-call@ietf.org" , "sidrops@ietf.org" , "draft-ietf-sidrops-rpki-has-no-identity.all@ietf.org" Thread-Topic: [Sidrops] Artart last call review of draft-ietf-sidrops-rpki-has-no-identity-04 Thread-Index: AQHYNAwocOrt8SbVskSPnUl5qJ9ODKy3uNQA Date: Wed, 9 Mar 2022 23:50:33 +0000 Message-ID: <8C8BA519-74D9-4BD4-952C-28002C07C329@apnic.net> References: <164686787641.27464.13731142773840437850@ietfa.amsl.com> In-Reply-To: <164686787641.27464.13731142773840437850@ietfa.amsl.com> Accept-Language: en-AU, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3693.60.0.1.1) authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=apnic.net; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a085f131-4fb3-4052-f491-08da022799c8 x-ms-traffictypediagnostic: MEAP282MB0103:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: V7rzkbb44ZmvfnDSLjjtuMbhRdqOdJ8KmGYS+IviwPzLCx6MZDb2r/rIXE95VRDzij4JWyquu55jz6qkro7rxAeK03Gh6zf6Pzan4fNrNmPiVePUFqCFJjSPtEifDmUIQDPbhSw33B73hIvgVok9ShycMqth2ncRoGiMq2GSThcT40NKWom5cyG54949nkNZM6oZd5FaQtYMN1nzQ7x1aHFAe/xRLmjlaDN6f7rq0K8uDvPqEtcOFD1RDFUvzhZnts81bKxChIDXdtrNvy1UxJunhQgAT9zmjGfdM1CZUuUfdMIH+mVC2P8mtisRa33dEyXL8MGHmSlHGbM1jLrPhRcFoWS44JrY++GIpr2LluLINHTCOkH0Ok4D7WDAxQq0ylUroPIXLLHlOIWdllSCiZWVkfafTETQPOrZfzu+uPVKjZ375WsbiUXl/6Ny5p2jZfQE2SFUn9OMQ9GzLxVl0L60ifrs/pHtDSQqL5Olsir3k7QV1oY8njpJJ8lVO8cJamtA5uJG1GOs3iPov7czbJVnmi3bHwY9z5Os4Bqd3Ozpd+azA4BQ/CD2j85mRAw6fA6OMDJPu363tHIXLvfXbDwyYSxOSob9uT4eXYGwWI/296tYf5FW7bsLZ8ubU5B5mVn6KflKVv0C60GuJ7g/5QWnIVg1yqWYXe4Hs3YREiyL6tUXLGKeE82+GbDaQO9h7L3SZauDSs0owL316Sq+rGUOLGt32Wg0hUnBER5B5fiQ9WHF79osPM8OzMArO/oy x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230001)(4636009)(396003)(39840400004)(376002)(136003)(366004)(346002)(66476007)(8676002)(66556008)(4326008)(122000001)(64756008)(66446008)(66946007)(53546011)(38070700005)(8936002)(38100700002)(54906003)(6916009)(316002)(508600001)(2616005)(6512007)(6506007)(6486002)(186003)(5660300002)(86362001)(71200400001)(2906002)(33656002)(36756003)(76116006)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?dFhvdnZuKzc5MVNXTjBCWnM2N2FxdFZNMnU0MXl0SkppaVlOWDBEemFaaGVY?= =?utf-8?B?V1JSOXdwNjZsVmNNK09zeHZ6TnArUGUrK3dmek1kbFBlZFZiRDczRjluREo5?= =?utf-8?B?bVFVd2h1WGFybE8rei9DSEdMVmNHT2tnWHBZeUdsRXpaaEhTdkEwaTNkV0dI?= =?utf-8?B?ekVFNzREVVVhRW0wdGF3Z3N2MDQwNE54bEErRU9GNlRURXFySWdJUkt1VjE2?= =?utf-8?B?M1Byb3NJTGpYSVlTR3l4N1NVMUhkRW1yaFAzV040Ris4TElDTHhWQldvVXVv?= =?utf-8?B?NDE3Q2dGb3Q0Wi96bzJpWmFRRkJsakFkcVRrdHVVUzlScUdiRVlHR1NIS0hT?= =?utf-8?B?UldCL0l4K05QTG44alBBU0lXN2xkMlQzbHk0aTFEUWlrSmdaeVhEcHdwZ0Fw?= =?utf-8?B?SmtrbE9zOTRFRjc2NnVHbTVwcHNmcHZkMDQ1b1lpQjlJVmlFZzJiUDVPajBR?= =?utf-8?B?NVcyNzdONTVwSDdOcm54d2JOekVRVWFheUMzOUY2SnJvNU5iMXVISVVVaDJk?= =?utf-8?B?Tmllb2VjVkNxRFBrazlkMG1lQXZ0Mlg0amdkKzR5VjVwREtNM2NLeVFidVRF?= =?utf-8?B?bmRWb2g2VGtDZ3RxVTNQcnRmZnp5TGx6SUNYbXQwWVd2UkU0L3FYUnNzL1dJ?= =?utf-8?B?RWY2b3ZrbHZwaFZFVkJMVUVlVVlIQ1kyUzE3YmJlcjVQNXJzQVp2OFBNL244?= =?utf-8?B?RTJCRm5rT0pXWTNOd2ViaGNpUU9nbXQyNUREY0VTREU1M0E3QmdOdHFNK1RR?= =?utf-8?B?eHVLNzdsMWFBUi9hUDFvV3F2R25LV05JTnlkby9DMFgxTk9waDJnYmtSVElR?= =?utf-8?B?NFNlbC8xbC94Y2xmaE9pVEpYYmg4RWlKbU9mbXhGSVdlODFLMlQzTTl0aG8r?= =?utf-8?B?VWkvS1RGMUZ5YWdGeGswdy8vTlVtQllRR1hRNmM3QjRxUTlxaFVWdlJRYUY2?= =?utf-8?B?MDlVVVc4YUNQUXpISkFxRjNQeER4SUtDNEZKMWJEbGtIN08ydXRGSWlWYmhI?= =?utf-8?B?RE1WNGtuSkM2elF6SkJYMnlPdy9kV1MyMlBGTkJpeUR2ekFsZGhzSU5FdW9N?= =?utf-8?B?S1pZSE1nblI3eW9SY0ZTS3NBM3hGQ1lORCtNcFJraCtQNUthVTU0blRncDU5?= =?utf-8?B?Y2ZsVW9KUmNWU2d5dnJaOVVVTmo2UGN2dW5VanpmSEtOTE9KSXpaUzAvb0tW?= =?utf-8?B?TThVOWp1NVdpWXNlRUpXRjlQcTZaNzN3em0zU0dUQm14MzNVa21PaCthb0xr?= =?utf-8?B?bnQyNmRqZGIvVFhzc0plNXJUdmI2ZzZOdjJlMG9NSUltcW5tSkp5SVlxbkhI?= =?utf-8?B?RmowVUliSFRuNHFIZTRnR004TklWbjNOaWNCNDRSNVJLTFFwb2YxWHZiMDlD?= =?utf-8?B?bE0yeHJSYVh1MkZ3VGJ3alJtM002WFFZYyt1VnFIZE8wRFlKRll4aEJObG5X?= =?utf-8?B?dm90Y3Yxck9yMmZ1Q2c3aUxDbE9tKzhBc0VyTXhrNncyTWlRUlBhMjVsMzNQ?= =?utf-8?B?VW1HYUNheGd1QXpKdTVKTEdwako0UWtVSWhUYWJiK3hzOWJhQjF5ejF6WDJj?= =?utf-8?B?U1FDa0RNakgvYjhNclVaR2diMTFvTzdyazBXdnZtM1dPc0k4OG13Y3BBSWhF?= =?utf-8?B?OUJNcU03ZE1ldjBaV0JhTnpNYytZcUh6ZXhDN2Y5WGxyektnc3pObG5HVDNV?= =?utf-8?B?MUoxZTNiMTE0WWhLZk45YnF2ZiswL01ONkZIQ2RQRFplT0trcDVuWHBQTytk?= =?utf-8?B?UUo4Vjh5WFIwZ3k5b1VMMUtOYUkyUlZjWU9LSDdBMHI1clcwZlF6S2x3cEtX?= =?utf-8?B?Y2VNSGl2YUMvUUtDSE9hRFo0NjRSVjdHYUYrWWFxeEk4c0hCLzEwMTZEY1Zv?= =?utf-8?B?UWNWVTB1eWg2ZnRjLzF1KzVpcmM5Ukg3M1JYSzZHZVk2SFhyVzRxU25OSXEz?= =?utf-8?B?OWVONVBVNlFrT1U0ZGFFMmFTV1N4cUZlMzM4b2JlcHV4SjBvcGEvU04xNWhE?= =?utf-8?B?QndwbkFDWUFUMjRJdkllNnlGSmIrUURaSS9ZTUorNGVyR3UxZVJ3Y25UZlFT?= =?utf-8?B?TE14YzR1aWVxUDkwbEtBVlFQOVowcTVLRDgxeEE4VHVlTmZIQk9CNnJEQ29k?= =?utf-8?B?dkxQYzVvVU9HbE9BSVJiYThHaUo3K2VTODVoelAvWjMyZ0ZZTTJNOTdLdisw?= =?utf-8?Q?NEk5ib6MuJEIU4d7kdjhvkDJA5+8ZDjoYAzn5O5PZDDQ?= Content-Type: text/plain; charset="utf-8" Content-ID: <4606A709358F484689F0281E719A2F7F@AUSP282.PROD.OUTLOOK.COM> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: apnic.net X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: a085f131-4fb3-4052-f491-08da022799c8 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Mar 2022 23:50:33.2629 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 127d8d0d-7ccf-473d-ab09-6e44ad752ded X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: IdSOIXcBiNq2KE5/mrVauJph1NaegDfZ37zfjoTpmTejFLmuRfO3ITqyqBcPKDDC X-MS-Exchange-Transport-CrossTenantHeadersStamped: MEAP282MB0103 Archived-At: Subject: Re: [Sidrops] Artart last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2022 23:50:52 -0000 T24gMTAgTWFyIDIwMjIsIGF0IDEwOjE3IGFtLCBUaW0gQnJheSB2aWEgRGF0YXRyYWNrZXIgPG5v cmVwbHlAaWV0Zi5vcmc+IHdyb3RlOg0KPiANCj4gUmV2aWV3ZXI6IFRpbSBCcmF5DQo+IFJldmll dyByZXN1bHQ6IE9uIHRoZSBSaWdodCBUcmFjaw0KPiANCj4gLi4uDQoNCj4gW0l0IGlzIGFsc28g cG9zc2libHkgdGhlIGNhc2UgdGhhdCB0aG9zZSBiZXR0ZXIgYWNxdWFpbnRlZCB3aXRoIFJQS0kg d2lsbA0KPiBpbnN0YW50bHkgdW5kZXJzdGFuZCB3aGF0IHRoZSBwcm9ibGVtIGlzIGFuZCB3aHkg dGhlIGxhbmd1YWdlIGhlcmVpbiB3aWxsIGhlbHANCj4gZGVhbCB3aXRoIGl0LCBpbiB3aGljaCBj YXNlIGZlZWwgZnJlZSB0byBpZ25vcmUgbW9zdCBvZiBteSBjb21tZW50cy4gXQ0KPiANCg0KDQpU aGVzZSBhcmUgaW50ZXJlc3RpbmcgcmV2aWV3IGNvbW1lbnRzIFRpbS4gSeKAmW0gbm90IGFuIGF1 dGhvciBvZiB0aGlzDQpkcmFmdCwgYnV0IHRoZSBwb2ludHMgeW91IG1ha2UgcmVzb25hdGUgd2l0 aCBtZS4NCg0KVGhlIGRyYWZ0IGFwcGVhcnMgdG8gYmUgYSB2ZXJib3NlIHJlc3RhdGVtZW50IG9m IFNlY3Rpb24gMi4xIFJGQzY0ODAuIFRoYXQNCm9yaWdpbmFsIHRleHQgaXMgc2hvcnQgZW5vdWdo IHRvIHJlcHJvZHVjZSBoZXJlOiAiQW4gaW1wb3J0YW50IHByb3BlcnR5IG9mDQp0aGlzIFBLSSBp cyB0aGF0IGNlcnRpZmljYXRlcyBkbyBub3QgYXR0ZXN0IHRvIHRoZSBpZGVudGl0eSBvZiB0aGUg c3ViamVjdC4gDQpUaGVyZWZvcmUsIHRoZSBzdWJqZWN0IG5hbWVzIHVzZWQgaW4gY2VydGlmaWNh dGVzIGFyZSBub3QgaW50ZW5kZWQgdG8gYmUNCiJkZXNjcmlwdGl2ZSIuICBUaGF0IGlzLCB0aGUg cmVzb3VyY2UgUEtJIGlzIGludGVuZGVkIHRvIHByb3ZpZGUNCmF1dGhvcml6YXRpb24sIGJ1dCBu b3QgYXV0aGVudGljYXRpb24u4oCdDQoNCihUaGVyZSBpcyBhbHNvIGFuIGV2ZW4gc2hvcnRlciBl eHBvc2l0aW9uIGluIFJGQzY0ODcgKG5vdCByZWZlcmVuY2VzIGJ5IHRoaXMNCmRyYWZ0KSB3aGlj aCBzdGF0ZXMgaW4gc2VjdGlvbiA0LjU6IOKAnFN1YmplY3QgbmFtZXMgYXJlIG5vdCBpbnRlbmRl ZCB0byBiZSANCmRlc2NyaXB0aXZlIG9mIHRoZSBpZGVudGl0eSBvZiBzdWJqZWN0LuKAnQ0KDQpJ ZiB0aGUgcG9pbnQgb2YgdGhpcyBkcmFmdCBpcyDigJxnbyByZWFkIFJGQzY0ODDigJ0gdGhlbiB3 aHkgZG8gd2UgbmVlZCBhIG1ldGEtUkZDDQp0byB0ZWxsIHRoZSByZWFkZXIgdG8gcmVhZCBhbm90 aGVyIFJGQz8gSWYgdGhlIHBvaW50IG9mIHRoZSBkcmFmdCBpcyB0aGF0IOKAnHBlb3BsZQ0KYXJl IGRvaW5nIGJhZCBwcmFjdGljZXMgd2l0aCB0aGlzIHRlY2ggYmVjYXVzZSB0aGV5IGhhdmUgbm90 IHJlYWQgdGhlIFJGQ3Mgb24NCnRoaXMgdG9waWPigJ0gdGhlbiBJIGZpbmQgaXQgZGlmZmljdWx0 IHRvIGNvbXByZWhlbmQgd2h5IHB1Ymxpc2hpbmcgeWV0IGFub3RoZXIgUkZDDQp3b3VsZCBmaXgg dGhlIHVuZGVybHlpbmcgaXNzdWUuIElmIHRoZXkgZGlkbid0IHJlYWQgdGhlIHByaW1hcnkgc291 cmNlIFJGQ3MgdGhlbg0Kd2h5IHNob3VsZCB0aGV5IHJlYWQgdGhpcyBvbmU/IEFsdGVybmF0aXZl bHksIGlmIHRoaXMgZHJhZnQgaXMgbWFraW5nDQphIG5vdmVsIHBvaW50IHRoYXQgaXMgbm90IGFk ZXF1YXRlbHkgY292ZXJlZCBpbiBleGlzdGluZyBSRkNzIHRoZW4gdGhlIGRyYWZ0DQptYW5hZ2Vz IHRvIGhpZGUgdGhhdCBhc3BlY3Qgc28gd2VsbCB0aGF0IGl0IGlzIGNvbXBsZXRlbHkgbG9zdCBv biBtZS4NCg0KU28gSSBjbGVhcmx5IGRvbid0IHVuZGVyc3RhbmQgd2hhdCB0cmFjayB0aGlzIGRy YWZ0IGlzIHN1cHBvc2VkIHRvIGJlIG9uLCByaWdodA0Kd3JvbmcuIEkgY2xlYXJseSBqdXN0IGRv bid0IHVuZGVyc3RhbmQgdGhlIG5hdHVyZSBvZiB0aGUgcHJvYmxlbSB0aGF0IHB1Ymxpc2hpbmcN CnRoaXMgZHJhZnQgYXMgYW4gUkZDIHdvdWxkIHNvbHZlLg0KDQpHZW9mZg0KDQo= From nobody Wed Mar 9 16:49:34 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 015003A0596; Wed, 9 Mar 2022 16:49:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sandelman.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ga0C_la3m-eB; Wed, 9 Mar 2022 16:49:08 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 850A63A0163; Wed, 9 Mar 2022 16:49:07 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id ECEBE38A0D; Wed, 9 Mar 2022 19:58:33 -0500 (EST) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id hK9jcDbibPhx; Wed, 9 Mar 2022 19:58:32 -0500 (EST) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 867DD38A0B; Wed, 9 Mar 2022 19:58:32 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sandelman.ca; s=mail; t=1646873912; bh=py/oyBDWuhOkYsoLwOw+g7O7EYjvShaWbIgwwMCbQXY=; h=From:To:cc:Subject:In-Reply-To:References:Date:From; b=Ur5p5L0bT6VPkTib3ilttX4JC/nMf/+h9NcYaYyvJHefzFvKgSuu26xNm0f7k5NN1 9N8xLb6aotWwK7TBo3TAH9KOUdE8keCUvfeAxrxWPrqn8rQvZin2+XYel/4duVCYPa vvtTONqMJIGtwJ76AGX/jDE+3eMhKStzjr9ZYyseBvHEJBpVLsge1y5vQ6zIEvqEO2 Zr1Q8ahM888soXbzi1dgKakh5vyd+cFk0LNrTRsFbW2uLdahIPpbajXxagMlw4WKlN Bwt4BqINlSpq4AjARedX+K1j8895YlUbZUxN/2Ra0f8Ku9Cq8LteGvnAz+F1kkMLhv xTVchZgYPN5lA== Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 55477559; Wed, 9 Mar 2022 19:49:04 -0500 (EST) From: Michael Richardson To: Geoff Huston cc: Tim Bray , "art\@ietf.org" , "sidrops\@ietf.org" , "draft-ietf-sidrops-rpki-has-no-identity.all\@ietf.org" , "last-call\@ietf.org" In-Reply-To: <8C8BA519-74D9-4BD4-952C-28002C07C329@apnic.net> References: <164686787641.27464.13731142773840437850@ietfa.amsl.com> <8C8BA519-74D9-4BD4-952C-28002C07C329@apnic.net> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Sidrops] [Last-Call] Artart last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 00:49:15 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Geoff Huston wrote: > So I clearly don't understand what track this draft is supposed to be= on, right > wrong. I clearly just don't understand the nature of the problem that= publishing > this draft as an RFC would solve. I had the same question as you and Tim when I read the document. (My email didn't get through to sidrops... it's not using the global acceptlist I guess) =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmIpSv8ACgkQgItw+93Q 3WU0wwf/SfTn/hHQUpU870jn6X+hFx1d1cF14zdFMZwJndKOuJqyuBP5fg6o0Kig fZFJEUzADAR6P66GhqKCNKDhq9eu3FconHG9l8R4+a5ggs3ThqRult+Te1DVMcU5 8riord0RJLppCY3YJVHA1J/gXFBIMy/5TEBG8+amH9RdT/6ckyIxBX5+16nRURP2 7zwh8hecYvCqvQ85tJhtwJrTnYpY562geRQ9cPLwG/vSXdo6Mw2hDU8aWRhtqmpI 6EEGsggQCYoVJ3HWIQI/Ul9mMITLyRJo1a3nL6uViy/E/Q/TYvTeZSJUZpWe3OM4 BtaBAh1IpVXN1lwMcDW+cUKNOPhTEQ== =4X5p -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Mar 9 19:01:18 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B30D3A109C for ; Wed, 9 Mar 2022 19:01:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.107 X-Spam-Level: X-Spam-Status: No, score=-2.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=twnic.tw Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FT5LXYQfBvQE for ; Wed, 9 Mar 2022 19:01:09 -0800 (PST) Received: from mailgw.twnic.net.tw (mailgw.twnic.net.tw [203.73.24.9]) by ietfa.amsl.com (Postfix) with ESMTP id 23B053A0938 for ; Wed, 9 Mar 2022 19:01:08 -0800 (PST) X-MailGates: (flag:4,DYNAMIC,BADHELO,RELAY,NOHOST:PASS)(compute_score:DE LIVER,40,3) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=twnic.tw; s=tw168; t=1646881255; bh=r4ltrbHbHZYawC2vW80usIO9soDLvprNN1P1sARToUA=; l=7285; h=From:Subject:Message-ID:To:Date:MIME-Version; b=AelxdNtRYEw1tBe0e9a7ykv5NeiOFP4Wk+NuNygak4Xhe0PT3m1AAosLfhkQNSfUQ oAIT3TUKG2QrH7cHRR1JbUvzcQjDnlCT0JyFWkTG8onsov2x5ZJ2cYVwGKmTiFj7n4 POQbwe1HcM1jKTTfkyNReqIB4cYlFD8//UvqkKLI= Received: from 210.201.136.11 by mailgw.twnic.net.tw with MailGates ESMTP Server V5.0(118555:0:AUTH_RELAY) (envelope-from ); Thu, 10 Mar 2022 11:00:41 +0800 (CST) Received: By OpenMail Mailer;Thu, 10 Mar 2022 11:00:06 +0800 (CST) From: "chku" Reply-To: "chku" Message-ID: <1646881206.100893.chku@twnic.tw> In-Reply-To: References: To: "Keyur Patel" Cc: "sidrops@ietf.org" Date: Thu, 10 Mar 2022 11:00:06 +0800 (CST) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="---Qkm)5BNQ-WbuDlIi8DingtXJ.c0" Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 03:01:15 -0000 -----Qkm)5BNQ-WbuDlIi8DingtXJ.c0 Content-Type: text/plain; charset=big5 Content-Transfer-Encoding: quoted-printable Keyur, I=20have=20read=20this=20draft=20and=20think=20it=20provides=20useful=20info= rmation.=20 I=20support=20publication. Ching-Heng=20Ku=20 -----Original=20message----- From:Keyur=20Patel To:sidrops@ietf.org Date:=20Fri,=2025=20Feb=202022=2006:47:16 Subject:=20[Sidrops]=20[WGLC]=20draft-ietf-sidrops-roa-considerations-01=20-= =20Ends=2010/March/2022 Hi=20Folks: =20 A=20working=20group=20last=20call=20has=20been=20issued=20for=20draft-ietf-s= idrops-roa-=20considerations-01,=20=93Problem=20Statement=20and=20Considerat= ions=20for=20ROA=20containing=20Multiple=20Prefixes_.=20Please=20reply=20to=20= the=20list=20with=20your=20comments.=20The=20WGLC=20will=20end=20on=20March=20= 10th,=202022. =20 The=20draft=20can=20be=20found=20at:=20https://datatracker.ietf.org/doc/draf= t-ietf-sidrops-roa-considerations/. =20 Regards, Nathalie,=20Chris=20&=20Keyur =20 =20 _______________________________________________ Sidrops=20mailing=20list Sidrops@ietf.org https://www.ietf.org/mailman/listinfo/sidrops -----Qkm)5BNQ-WbuDlIi8DingtXJ.c0 Content-Type: text/html; charset=big5 Content-Transfer-Encoding: quoted-printable html,body{height:100%;}body{box= -sizing:border-box;padding:8px;margin:0;}
Keyur,

I=20have=20read=20this=20draft=20= and=20think=20it provides=20useful=20information.=20

I=20support=20publication.

Ching-Heng=20= Ku 


-----Original=20message-----
From:Keyur=20Patel<keyur@arrcus.com>
To:sidrops@ietf.org<sidrops@ietf.org>
Date:=20=20Fri,=2025=20Feb=202022=2006:47:16
Subject:=20[Sidrops]=20[WGLC]=20draft-ietf-sidrops-roa-considerations= -01=20-=20Ends=2010/March/2022
Hi=20Folks:

=  

= A=20working=20group=20last=20call=20has=20been= =20issued=20for <= span=20style=3D"color:#070706;background:#FFEE94">draft-ietf-sidrops-roa-=20= considerations-01,=20=93Problem=20State= ment =20and=20Considerations=20for=20ROA=20containing=20Multiple=20Prefixes_.=20P= lease=20reply=20to=20the=20list=20with=20your=20comments.=20The WGLC will=20end=20on=20March=2010th,=202022.=

 

= The=20draft=20can=20be=20found=20at: https://datatracker.iet= f.org/doc/draft-ietf-sidrops-roa-considerations/.

 

= Regards,

= Nathalie,=20Chris=20&=20Keyur

=  

 

_______________________________________________
Sidrops=20mailing=20list
Sidrops@ietf.org
https://www.ietf.org/mailman/listinfo/sidrops

-----Qkm)5BNQ-WbuDlIi8DingtXJ.c0-- From nobody Wed Mar 9 19:32:13 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B8FB3A1004; Wed, 9 Mar 2022 19:31:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.111 X-Spam-Level: X-Spam-Status: No, score=-2.111 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sIlNIrJAzMLD; Wed, 9 Mar 2022 19:31:30 -0800 (PST) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on20702.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::702]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 661FC3A1122; Wed, 9 Mar 2022 19:31:29 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=itEbvyaSiutz4JqXbBFLj2dr98xG+LJaPgT329wemyj0LBxcH3eMWngynfaIxDRxx/hMtKk8ZremFERhVnlSNVJq3V5mdYUWQSjG9gan6WZandVjvjZcTeoxmykAG22sUnmXCqgPHNtARaJ9cueEjBcsBGM9F3uy2Y+ttzxZnqaFX85/mh0vxhKWBkeTBPQqV8lRMJuRdKeZMt5UYXIUm0wVQ63OPtZxP0TrGhdlU3k3fG8iYvOrJVsujYI92sVLeEMOJHbh/wADlSn4VZfqDlaeBigXEPfC7erPA278Vk9D5QDOjC5ZI3DPrZ+oU7WWIaEJMzkM+srLNHHXzSY4YA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zyAdPQlGcJ0iwc10fgBbyjxd6FpcQPMREB2ITi9M2T4=; b=n991VGmNyJMPIUs48vsluE3UQWS2YSGDdpk3oXweX+A1Li+NvZ019WEDHP2QIIa7IQQS1mJYL2zxH0SkOC2nyZAoNkUl3Oma+1OM8H/Y1QH+63NlIBB8soWVusvQ1M2eNvrAGg+GXyz47K4m02VK4rW9bvOkMpndcbsfJikIuguHB25iIpRkUJ6wUYeJyHn9rXofxX90mfUsrW8M8hbPuC04A5f/VmFlKN9HBKFoa7zm8OEJ7Ksmpth9hViLYTnElO2Any/ZOhL9VuWsBk9dUiXETSTjLdC556XLh50fAVtOZd/5ZwHDyW6ozsleeVQanhvQFjUtFjVpeAzGhU1DMg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zyAdPQlGcJ0iwc10fgBbyjxd6FpcQPMREB2ITi9M2T4=; b=JhuK4Phx7iu7S3TGu5zqs+YLfmBA1hC5vK0snvavKsg341o7+tr1giHRMsf6LAK+F9xKU88ikZrUnwRQUPdgQCw5gLNh5s26MBwKIsmSsFR4u9Ngx46pqxmug/9onccAMyZif6BWihjYFCSam5qExjrJghwNUxwv86NrjaOx/ew= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SA1PR09MB7519.namprd09.prod.outlook.com (2603:10b6:806:174::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5038.14; Thu, 10 Mar 2022 03:31:25 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5038.029; Thu, 10 Mar 2022 03:31:25 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Nick Hilliard CC: "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: [GROW] IXP Route Server question Thread-Index: AdgzI9AepbPeSUXIRROpCLpxuIKvkgAD5f2AAD5dAsA= Date: Thu, 10 Mar 2022 03:31:25 +0000 Message-ID: References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> In-Reply-To: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d179d794-9f89-4dc6-6995-08da024674c5 x-ms-traffictypediagnostic: SA1PR09MB7519:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: axUBq/yTiufXc5Xo7FoVgMIETEZLGATeTA5oZGrpOEUlkaJ5lXy1dX1aZ7lBuoT/5iATHqQHueUb7bjj88KDK+cQnjk7x/2nuGWL4qIlW3UT9hroYbchcSDSQc+tF3VJdo6CSBbafHMAQgQDI55uLYVykbJk4RcfiqgRi89LH7pYzKi9VMfknbB9l459gKmUZgP5ZyjXE6yKjincBx4oONsuqJce0HN8R01r9dSEhR7aWilREpeHeamAmFOTIzt8Is73Tpy4CEpl6jE5l8ylIEuY45tWsWWtO4n98MgLE92cwTpbX3pCt8+YDgUBZTTpEzQbtDkQwRRuUHOL45MiRfdHwQ8QXEf2H2bS1yVI1dQ8HA+knd3vf4AykjYRHjUeIN5RD2w4nnoH9XLziAzfUHqQ2gJRT5GZuUKYjWg+SbHhVJTu1qqAFemCLBe206rU8xNem1kU073ECto24OEej8FGmywCXvKUTj1Nuk/BbT7CJWWaHzjguokb3yqwKY9TX0x8EF1xBSkv4IXmtq3bckS2J48YPkU2doc/kSNxrcz+B5VESN/zOK0AMbvG6UTBbPwR7AqD1SY2mnns0tTJ+25jWXLg/NjxrRCxMiclVb7iy8a2ga+z+f1RXbaOYx2f6Yj0PbnJgDHrpoSXqCqKBCrKK70tUxLATOfKoJGFfFJGoAa4uRk22JA0f2fWgJAit2ICGip+/J0IdiQm7XQwmw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(9686003)(508600001)(71200400001)(66946007)(6916009)(52536014)(4326008)(6506007)(55016003)(7696005)(186003)(26005)(76116006)(33656002)(83380400001)(54906003)(38100700002)(66446008)(8676002)(64756008)(316002)(66556008)(82960400001)(122000001)(8936002)(2906002)(5660300002)(66476007)(86362001)(38070700005)(53546011); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?UGJabkF3bUFvL1JKZXMrWVEvV3NmRDJXSDN4eFdiUkFzSHUxZHRuQlhXMC9H?= =?utf-8?B?aTJXSlcwMisxN213aWoyeTJpbVViZnlYMFJOTTBkY0wxRlh1Y2RtcjVTWTQv?= =?utf-8?B?Sk8xMGNITUhYZENPMXBPMVoxc2NRR0dVTFZJRFFnNHFVSzluTE5aQ1FISGIv?= =?utf-8?B?c0FmeCtTVHkrRTUxN3E1dmM0Y01yWTdNL0VyUUtJdnZjWGRvOUF4eldEaEpC?= =?utf-8?B?clRySXpTc01JR21uM1pLYzlQQURHbWlNV1RaYk9iQ0ZjSzY3NjJjZmFXQnNh?= =?utf-8?B?endONzFOcTJFL0pUS2tvK1JTSkFRR0xMa0VrOWtlUlJQSWVlRWcvYWxacFBa?= =?utf-8?B?bUJQVy9Ia1hCL1o3UUpWeFpwNHQ1NE1TSnU3dkVDeUlDb00rOEFBeVB6Ui81?= =?utf-8?B?YlE3RjA1YW1UUXB3c2NuMVkvNVBWaFJCTVV3NHJWelgvdVdrZHZ4dXVOUUxY?= =?utf-8?B?ZFprRDQrc0Zjckt4Mi9penJOb3dPME80blpXVGhURW9SL01IN2lFWFBqVzBq?= =?utf-8?B?MDQ3bGpTT3VQYnZ4TURLTysxdE1WK3hTWVVIQ1ZSODI4TTduNnRsaHUrNkJF?= =?utf-8?B?Q0ZHcXQ1Y3JPZXRyTnF2NlJ2eWVsL3dPV1dDMmp5djdKcFk3MDdUWUx5eklR?= =?utf-8?B?T3ljWEo4SXVJMGdWQ3lPN3R3NTkrc2NDKzZZUFpjTEY3Zm1RVXdUMDNsaCsw?= =?utf-8?B?SkRRem12ZVNGVmFibnZtVTVkNmxDdUtXWHFiMkpoSExRUU85RzhmVlNNcE9w?= =?utf-8?B?Ukl4QUhYNm82QXFweXFVZU50ZHF0blRVQWpoV1pQUXVtOUx4dmhlKzV0anY3?= =?utf-8?B?dDR0U0JEcllSNW93SWlFSldpNXVFYzJWNllPV3hKVjYwSjY3TjdiZUNhd2N0?= =?utf-8?B?WlpVK1pYUFI2VVg2M0svVml6ZVhLUjd0Y3RWZjl6dis1ZWxHWVFicElaTzlH?= =?utf-8?B?R2RjR3VpWUNpWTNRZGFzNXBxeHBIb0tOc2tjSGY5MjFaaDhqellweWRndit3?= =?utf-8?B?S0RyazljUGNNRFVhN2hIbnNKM2xtQkpaQ0FMc1RDMUVUOHRIb3FUUzM3dW5i?= =?utf-8?B?TGs3a1ZISHBxU3g0OEIyWHlQSnRUeUdRMVdUdXl3bFA5NjByNUZXQVNPckhj?= =?utf-8?B?UDNvTDNEeVIwMkVCdmlsaGRib2ZsckVpQURWcDYrU3RoZkZDT0Q0U2JNS3hs?= =?utf-8?B?ZmIvRnVoMGhyR084akgxY1JyRHJUZVJlall5VnpSR0tIS214ZGVnSitMelR3?= =?utf-8?B?M1VOcEVRVmh3L3NkMWwzbXl1TkJEV29Sem9TR3VSYkF6WTJ6L3FFVkdCWFZD?= =?utf-8?B?TUhsVU1SNkNTM1V3UlFkNytnYnRScVRSWkZ5cXFEUzYxMWExVmk2VGJTM09I?= =?utf-8?B?S3gwZkROOUN1cjYreVV0RDFVbUpPOXVkc1JSdFhHTE1MQnNzaDhjd1NzWXln?= =?utf-8?B?a2Q2NjVGdVJGU1hrUjRWdXgzZXcxc05DbWdqRUFWS3hOVXlsTERLcjBGeWNO?= =?utf-8?B?cklybjV5TndIZFh2V2JZTDhhVTJoRWMvNmVBWEUvWlVkdTFHbHVidXJuaEtF?= =?utf-8?B?ZlBxcW9WcndyMXhJU1ZzU3VFdm10OWhDS3lXNm1kYnh5QnhpbDhXd0IxMVpG?= =?utf-8?B?bjlPZ2lZK0gzOWNDRVZFeGhZbWd0M3ZucUFPVXVNOGU4K21HY3FySkJRWWxH?= =?utf-8?B?RTh2VmVHNHVKUXc2dmtsY1JIQ0tvUEF6SWsvcTRITEgwaFFEV2RmZlVPTlZs?= =?utf-8?Q?5jrA8zI18gJNMB1MSlMoBhv8OeTUUpxe4svbVxX?= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: d179d794-9f89-4dc6-6995-08da024674c5 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2022 03:31:25.5158 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR09MB7519 Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 03:31:37 -0000 TmljayBhbmQgYWxsLA0KDQpUaGFuayB5b3UuIFdoYXQgeW91IGFsbCBzaGFyZWQvZGlzY3Vzc2Vk IGlzIHZlcnkgdXNlZnVsIGluZm8uDQoNCj5BbG1vc3QgYWxsIFJTJ3MgYXJlIHRyYW5zcGFyZW50 IHRoZXNlIGRheXMuICBVc3VhbGx5IElYUHMgZ28gdG8gbGVuZ3RocyB0byBlbnN1cmUgdGhhdCB0 aGUgUlMgQVNOIGRvZXNuJ3QgYXBwZWFyIGluIHRoZSBBUyBwYXRoLg0KDQpHb29kIHRvIGtub3cg dGhhdC4gV2VsbCwgdGhhdCBtZWFucyB0aGVyZSBjYW4gYmUgYW4gb2NjYXNpb25hbCBSUyB0aGF0 IGlzIG5vbi10cmFuc3BhcmVudC4gV2hlbiB0aGVyZSBpcyBhIG5vbi10cmFuc3BhcmVudCBSUywg Y291bGQgdGhlcmUgYmUgYmlnIElTUHMgKFRpZXItMSwgVGllci0yKSBwcmVzZW50IHRoZXJlIGFz IFJTLWNsaWVudHM/DQoNClRoZSBBU1BBIHZlcmlmaWNhdGlvbiBkcmFmdCB0cmVhdHMgdGhlIHJl bGF0aW9uc2hpcCBvZiBSUyB0byBSUy1jbGllbnQgYXMgc2ltaWxhciB0byB0aGF0IG9mIFByb3Zp ZGVyIHRvIEN1c3RvbWVyLiBTZWVtcyByZWFzb25hYmxlPyBUaGUgQVMgb2YgYW4gUlMgY2xpZW50 IGluY2x1ZGVzIHRoZSBSUydzIEFTIGluIGl0cyBBU1BBIGFzIGEgIlByb3ZpZGVyIi4NCg0KU3Jp cmFtICANCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IE5pY2sgSGlsbGlhcmQg PG5pY2tAZm9vYmFyLm9yZz4gDQpTZW50OiBUdWVzZGF5LCBNYXJjaCA4LCAyMDIyIDQ6MjggUE0N ClRvOiBTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSA8a290aWthbGFwdWRpLnNyaXJhbUBuaXN0 Lmdvdj4NCkNjOiBncm93QGlldGYub3JnOyBzaWRyb3BzQGlldGYub3JnDQpTdWJqZWN0OiBSZTog W0dST1ddIElYUCBSb3V0ZSBTZXJ2ZXIgcXVlc3Rpb24NCg0KU3JpcmFtLCBLb3Rpa2FsYXB1ZGkg KEZlZCkgd3JvdGUgb24gMDgvMDMvMjAyMiAxOTozNjoNCj4gVGhpcyBxdWVzdGlvbiBoYXMgcmVs ZXZhbmNlIHRvIHRoZSBBU1BBIG1ldGhvZCBmb3Igcm91dGUgbGVhayANCj4gZGV0ZWN0aW9uLg0K PiANCj4gSXMgaXQgcG9zc2libGUgdGhhdCBhbiBJU1AgQVMgQSBwZWVycyB3aXRoIGEgY3VzdG9t ZXIgQVMgQyB2aWEgYSANCj4gbm9uLXRyYW5zcGFyZW50IElYUCBBUyBCPw0KPiBJT1csIHRoZSBB UyBwYXRoIGluIHJvdXRlcyBwcm9wYWdhdGVkIGJ5IHRoZSBJU1AgQSBmb3IgY3VzdG9tZXIgQydz IA0KPiBwcmVmaXhlcyBsb29rcyBsaWtlIHRoaXM6ICBBIEIgQy4NCj4gSS5lLiwgY2FuIHRoZSBB UyBvZiBhIG5vbi10cmFuc3BhcmVudCBJWFAvUlMgYXBwZWFyIGluIGFuIEFTIHBhdGggaW4gDQo+ IHRoZSBtaWRkbGUgYmV0d2VlbiBhbiBJU1AgYW5kIGl0cyBjdXN0b21lcj8NCg0KQWxtb3N0IGFs bCBSUydzIGFyZSB0cmFuc3BhcmVudCB0aGVzZSBkYXlzLiAgVXN1YWxseSBJWFBzIGdvIHRvIGxl bmd0aHMgdG8gZW5zdXJlIHRoYXQgdGhlIFJTIEFTTiBkb2Vzbid0IGFwcGVhciBpbiB0aGUgQVMg cGF0aC4NCg0KU29tZSBvcmdhbmlzYXRpb25zIHByb3ZpZGUgdHJhbnNpdCBvdmVyIElYUHMsIGJ1 dCBpdCdzIGEgbWlub3JpdHkgdGhpbmcuIA0KSXQgd291bGQgYmUgdmVyeSBwZWN1bGlhciBpZiBh biBvcmdhbmlzYXRpb24gcHJvdmlkZWQgdHJhbnNpdCBvdmVyIGFuIElYUCB2aWEgYW4gUlMuDQoN ClNvbWUgb3JnYW5pc2F0aW9ucyBwcm92aWRlIHRyYW5zaXQgdG8gQVNOcyBvdmVyIGEgZGlyZWN0 IHBoeXNpY2FsIGNvbm5lY3Rpb24gd2hpbGUgbWFpbnRhaW4gcGVlcmluZyB3aXRoIHRoZWlyIGN1 c3RvbWVyIG92ZXIgYW4gSVhQIHBvcnQuIA0KVXN1YWxseSB0aGlzIGhhcHBlbnMgYnkgYWNjaWRl bnQsIGJ1dCBvY2Nhc2lvbmFsbHkgaXQgY2FuIGhhcHBlbiBieSBkZXNpZ24uDQoNClRoZSBhbnN3 ZXIgdG8geW91ciBxdWVzdGlvbiBpcyB0aGF0IGl0IHdvdWxkIGJlIHRlY2huaWNhbGx5IHBvc3Np YmxlLCBidXQgaXQgd291bGQgYmUgc28gcGVjdWxpYXIgYW5kIHN0dXBpZCB0aGF0IGl0IHNob3Vs ZCBiZSBjb25zaWRlcmVkIGEgbWlzdGFrZSBpbiB0aGUgc2l0dWF0aW9ucyB3aGVyZSBpdCB3YXMg aW50ZW50aW9uYWwuIEluIGFsbCBvdGhlciBzaXR1YXRpb25zLCBpdCB3b3VsZCBiZSBhIGxlYWsu ICBHZW5lcmFsbHkgaXQgd291bGQgYmUgc2FmZSB0byBhc3N1bWUgdGhhdCB0aGlzIHNvcnQgb2Yg Y29uZmlndXJhdGlvbiB3YXMgaW4gZXJyb3IuDQoNCk5pY2sNCg== From nobody Wed Mar 9 19:41:08 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 932063A09FA; Wed, 9 Mar 2022 19:41:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4MLdUf7C4zoB; Wed, 9 Mar 2022 19:40:56 -0800 (PST) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on20723.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::723]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF6C33A0990; Wed, 9 Mar 2022 19:40:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=EB87q8U84iu3A67784R4azHX8/1ZSXR5VBZlmZRlnFtyMkrLtEZhiYX3U8lar29k6T56oa0ihKUGhP1im4BK/1twUhMU8zNSDkBaHdP0W86kJysDvowZd8o2c0JiOE/Mblwuk4emQuQDUZ6T0okYAs5fnJrAcctXIEcl4FZzpYNr/nx/YH97qMUaTcAKVYi+lhudqt5tsbSO8O7hDr30q+bnimTkegfy/wUIg4hCFpfXn6IYot3EL2DEb2a2qdOpCStPFDQ8LUDpC9384fpAiH6krzc+q1B9aImtt2etm3x+DGSWM0TRsymbycJpzYIaccAWrpFfKFAr6ZxOY+ScDw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=SLqcCnl9w85lllU+Q9EicrnJkKxu+c6Z+z6YBy0JzPw=; b=W0GWMq8/Q6uNUwM9zN+72lEIdEH0iUvfe10y3/BPD31rLfi4vlzuxJ3agcfsfDdx9nB8CJBG8zLirwiRt81Hd47gYHXdpt9JFd5QQLNpl1+1uCR+UoSlHmUUFe6YNrJ01LaV2axeKGPKYOt1O0V3i8YfKuhYMsZWGbCYfWDwlnnqcOIBEkdd8tUM8766oCAobA7t8xzr/yM1rhJf+h/IRqU2gaZyR5q2HsFHPp9ktkuoWuiBOtQVwLgPkyHlhmt8hYimcMaNMlxnmrVn3i00wTpisW3UlAS7wIR7E2mA71Hq7yFEa8BAjpTvLZCaZvP3WvL4gNNTf6x8Vqnn/ZpQ3Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SLqcCnl9w85lllU+Q9EicrnJkKxu+c6Z+z6YBy0JzPw=; b=FyhLs5rdtcYxSPlpTVOsKaROLFdSQ6WRBLnDBPJBex66AfDmG9pIykWbMwViMKdR1eHpaJ2n/ANGNv28c5QpAeef/lxwKdrCz5d9cVxApHq/PzrCe296u30fh5y9HluYxVib4nkOpy5dSEGdmVvrdBeYKK6EASOixs/O1eQH6PU= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SA1PR09MB8318.namprd09.prod.outlook.com (2603:10b6:806:17f::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5038.14; Thu, 10 Mar 2022 03:40:52 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5038.029; Thu, 10 Mar 2022 03:40:52 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Ben Maddison , Christopher Morrow CC: "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: [Sidrops] IXP Route Server question Thread-Index: AdgzI9AepbPeSUXIRROpCLpxuIKvkgAA6bUAAANeVYAAPqClEA== Date: Thu, 10 Mar 2022 03:40:51 +0000 Message-ID: References: <20220308213907.nwb6oe7qwixattga@benm-laptop> In-Reply-To: <20220308213907.nwb6oe7qwixattga@benm-laptop> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 47502122-b0f0-44df-c36f-08da0247c660 x-ms-traffictypediagnostic: SA1PR09MB8318:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 48FfaGNzMh4ihd5TSbNmKS2s0SnSOSTlxo1Xf7weRUjWhgN8nZzGqlPtAozcoObgL89Tm3XXKec6a4i3vHPgh3SnowBEBqsPkvpC/4IzzwT08dSoNlB7dckNXx5sLPRV6GkMUsfOTCBymo9kuX38YXGZNN+ErySbdFeUiqH6TTAzFOEwsXdNgggp057n5Lfc7fTH7rETgNStU7ShNmSoyJ8WfRdr6tZHLaEI9avKw14j4jvTgQuwEWYuhGeIEUohfnbUNA0+i4LLkr7PCgGxu9zuFsF6ngDAyA9aOziq126ccZoYLbxv2musl/IQm1we1bk6BlSq/4whyH+Cf/HDowChPao09OAwVSwvbqsb9DPJpEhB4p+tjnFckmwz/8S7hJRZ8y+z3RsQKVi/BAjweaPIym4E/1kdj7A8ma/KJ0cuy4qwFYmmWmJYDHb8c9BqXY63CL7HHrqLiXsLgNuFp5SOf/jpxLauLJDXkVL/PmCOTbF4Jyf8iIHFvhrjQd7YKDsnW+Nsoobi3mkhU7K7pgBqpBucDE4p6GcjLfA8ewDDzlalTvlRxFPya0vtW8aVR7ag7Kcrm1Dli5swvdKMZXzo4ECZwFvV6YvWivS3hLriJ+qVoOmVs1nl34ZGSObDgAdQTcrOHCNP6u4brMSwjTGnZIxKA8HOB5RziJlXKEwzb+6JRX/521B62M7sqCO49xl8GD2TJhx1UY/GYvkkEQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(8676002)(64756008)(76116006)(316002)(54906003)(66946007)(4326008)(66476007)(66556008)(38100700002)(86362001)(38070700005)(4744005)(52536014)(8936002)(122000001)(82960400001)(2906002)(5660300002)(9686003)(6506007)(110136005)(66446008)(186003)(26005)(7696005)(55016003)(71200400001)(83380400001)(508600001)(33656002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?sy8DgYgAGLFixKzhwb/BaUTtxGqO0HhqpaKkIVmueTBWyvxz5iZ+ovX+P4ZK?= =?us-ascii?Q?YuNcUBS8Z5SL7BakcCNgKuQLVLo6fkmLGgOB9FfvD3HvFRj7KTQwv+2pmBDP?= =?us-ascii?Q?O8HlpNYLCc+5Tx+VW2OJ2lVwmLJ7JBnWo3DI91fKg1mbPU9y8mfm6r51pf5d?= =?us-ascii?Q?N/hT3XzYF+GK1eSPxLhnvPZ2nqslFjNF08oi8yYRtnCnJpdiQQn9MijVOJXU?= =?us-ascii?Q?kO3ZH+mJYcBYUy77Rdu1/1cXTHlBiu4RVCNgmtBWnpfY/0rVhE06zMBqlZdv?= =?us-ascii?Q?iHnSfnTRWknkeJvMNvPvOyhQwDdZrB2FQpH2DxkRzJYYlRWsTkjS6G8hEQ6J?= =?us-ascii?Q?jJhk5HFSeIGjAFq0UFMfGwiaWDWveB3wHmhVNoUMqVsPqQ036PnhU8L9tHNk?= =?us-ascii?Q?llqumQ8Qemm3f+UVeoyGtG97r3ogu6gJRuchlk2J4u3ow23GY/o+/l8SQ8Uo?= =?us-ascii?Q?wSvTjJ7wvRbB/VqMu3KIimyD55LKp67zc0JaoukewE4FF3nBur8uxoDTqqAU?= =?us-ascii?Q?dK4ASccYvBd+9MsKt+erKc4PtYJC3zTaVvgCNBxf0yuJtv+SOiXgCFCjBT2C?= =?us-ascii?Q?SKkkECG3MYHgIwxKVUYsD+IjvN6tg63ivz3BoG6XcwsqzlUWNlkS72o1Hbt9?= =?us-ascii?Q?32sl0ZaakdugZhqqGN9Hn8KMuwKlnrBVa0OcMkzB3Op2MSX29YBKjQ1ChsDg?= =?us-ascii?Q?3mSm9aufiTgJLIHk3U4GYjQFff2leMxIvqFfUKMhxJmruldOy9Sa4Jm+tnN7?= =?us-ascii?Q?/sSY0uiZ410MI1Jzbyq9Q9tl6rdEPTjRwDfpF3pBowqcJOa+yk3ca6cbNI/t?= =?us-ascii?Q?zK38fxXvNcFxuL4IlJlfJhJNyUv5I4HqdJJiagYMeclpTwNkSd29ONIRwpIy?= =?us-ascii?Q?gvhkWz5SAJ/mldsrzfFHVHzX4kF/Ps3hE6DsJHwo+Tzo0gDcKk5KQPi/cniH?= =?us-ascii?Q?VYJtNO5dll9k8dJzt2fPZHJxs1RU1Oo/E6di1VNoDPQlwhwxBJ3oOQ9T7mgu?= =?us-ascii?Q?9vJ09+pueSlstZ/7fgROscWOyLveQieu2dY7ZBTmR5UNGfV/IXmSzA/EFK1x?= =?us-ascii?Q?8oJVBPVO9U8ulRz1ysk1iPPYcg1GyhZasMSEW1+rpXqXwcei9mxMju7ypk3T?= =?us-ascii?Q?Ra4lZC4tqGhHKgeNEunrYRbO+QIiF+qduO6np3cu17F2TAkt7OnIAR4lBNPW?= =?us-ascii?Q?hREe0lV5CzjVA9+5F3fuAU1pOvNtVu04Us67cfp5e3qnarlbS3+FpaQrCkde?= =?us-ascii?Q?Ra7ek84iorwdkiQ5dZDTeZnAN5tNnB5z5mCyZT5DbKxnx0cdYNbfGe4RYQkV?= =?us-ascii?Q?z/bzO/sAQx+ZbWzPl4+xV28R?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 47502122-b0f0-44df-c36f-08da0247c660 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2022 03:40:51.9729 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR09MB8318 Archived-At: Subject: Re: [Sidrops] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 03:41:01 -0000 Ben, >I know of several transit providers that will allow customers to use an IX= P as a kind of virtual access circuit (which itself is a poor idea), but I = would be *very* surprised if any of them allow RS peerings to be the contro= l plane interconnection (intentionally, at least). Good. Thanks for that insight. Consistent with what Nick and others observe= d. >If the underlying question is "should the ASPA path validation algorithm h= ave a corner case that accommodates this?", that is a very, very firm "no" = from me! No. I didn't have that question or idea in mind. But see a couple of other new questions I asked in my reply to Nick. Thank you. Sriram From nobody Wed Mar 9 19:42:16 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A32DE3A0A29; Wed, 9 Mar 2022 19:42:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.316 X-Spam-Level: X-Spam-Status: No, score=-1.316 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=ops-netman.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Di-ZMnFbGaOF; Wed, 9 Mar 2022 19:42:11 -0800 (PST) Received: from relay.ops-netman.net (unknown [IPv6:2606:700:e:550:5c82:28ff:fe4c:9503]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 004A83A0990; Wed, 9 Mar 2022 19:42:09 -0800 (PST) Received: from mail.ops-netman.net (mailserver.ops-netman.net [199.168.90.119]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by relay.ops-netman.net (Postfix) with ESMTPS id BC89B3C210A; Thu, 10 Mar 2022 03:42:06 +0000 (UTC) Received: from mailserver.ops-netman.net.ops-netman.net (mailserver.ops-netman.net [199.168.90.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.ops-netman.net (Postfix) with ESMTPSA id 685F8256; Thu, 10 Mar 2022 03:42:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=ops-netman.net; s=2021; t=1646883726; bh=P+bu+q+Jq0T7oDP0mdu0ApzmSqzilpGDHaKJ7FAudp0=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=Ey9sd1C75OTWTaj5dhuKzEtCQ+hLvb496tsXpw2AL81IBlsvxdPzl3fwYdVHlEP/E hpQM4rK0UpBkRFQR4nGjI43/BPFAwOcXsGbYLXKx37xEYjsL6tmMIzKcE+uOdep0MM mNk0+EjitRwFYdkmiWcQBMzL7IU8sysa4nm0RpheqD7IJdDDOaePVwcjk7eWgQbkMU DdzlREJ73IWxUNVkQr8vX6sUE2FOSCy9fq2GUzRv+U4Mx2oyK2KiOFpM97hILHPdoP xZ7ji3rRdQjv38nUZMzcDKJDWQRx6JXJYp/RBEgJXnLl9/2ywGzjIZvyRCd0uEvNYA 8qnZoIJqBmMkKlBnOMSGJVg6TB4MFjdxB2SfgHYLyxcql0MoIqwzTH9t09WnlpduuZ kwg8x/XUp6uLa6dgXlIv1T0NXzwE7BYh48wlXZbl8odLkgxmOM9BM+QLYGi6cb5tNB 1vE+778lZayVQmvwJYV6xkp8ETOp80GNWiAK5PYs8OVdyQXKbDIP7cfzWBp/iCGaGM GKWgVjS2e+isN0jqAccJ46WogA40VHogVKYMaTODDIg7DEmM0g01WqAk8V3sO5lpVI EjYRITgBNU9gx+1SKRIPRGB8KUQfp9OYBroVAx6nbVN6/F349dclCI7CofqN0Yvve4 IHrtgEAYLHlJr7XD2pRi8ZqA= Date: Thu, 10 Mar 2022 03:42:06 +0000 Message-ID: <87ee3afp81.wl-morrowc@ops-netman.net> From: Chris Morrow To: Michael Richardson Cc: Geoff Huston , Tim Bray , "art@ietf.org" , "sidrops@ietf.org" , "draft-ietf-sidrops-rpki-has-no-identity.all@ietf.org" , "last-call@ietf.org" In-Reply-To: <30513.1646873344@localhost> References: <164686787641.27464.13731142773840437850@ietfa.amsl.com> <8C8BA519-74D9-4BD4-952C-28002C07C329@apnic.net> <30513.1646873344@localhost> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.2 Mule/6.0 (HANACHIRUSATO) Organization: Operations Network Management, Ltd. MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] [Last-Call] Artart last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 03:42:16 -0000 On Thu, 10 Mar 2022 00:49:04 +0000, Michael Richardson wrote: > > [1 ] > > Geoff Huston wrote: > > So I clearly don't understand what track this draft is supposed to be on, right > > wrong. I clearly just don't understand the nature of the problem that publishing > > this draft as an RFC would solve. > > I had the same question as you and Tim when I read the document. > (My email didn't get through to sidrops... it's not using the global > acceptlist I guess) I don't think there is such a list? ('global acceptlist') (I think I did ack your messages through though (I thought) earlier this week?) From nobody Wed Mar 9 19:53:29 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77CA93A0B60 for ; Wed, 9 Mar 2022 19:53:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wc1NbfEz_G7m for ; Wed, 9 Mar 2022 19:53:24 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A2293A115D for ; Wed, 9 Mar 2022 19:53:23 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nS9rb-0001is-RP; Thu, 10 Mar 2022 03:53:20 +0000 Date: Wed, 09 Mar 2022 19:53:19 -0800 Message-ID: From: Randy Bush To: Tim Bruijnzeels Cc: "sidrops@ietf.org" In-Reply-To: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 03:53:27 -0000 > This is an issue if, per Randy's example, the entire ROA is withdrawn first, > the RPs fetches and revalidates and sends withdraws for VRPs to the router, > and then the new ROA is published later, validated, etc no need. CA publishes old an new ROAs. RP fetches both and processes sequentially. oups! and now we can expect to hear folk suggest that the RP should swallow and digest the entire ROA set (think of the scale of this a few more years out), reconcile it all, and only then send the reconciled VRPs to the router. if the current state of RP software is any indication, i would not want to bet my routing on this. randy From nobody Wed Mar 9 20:45:46 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D593C3A0891; Wed, 9 Mar 2022 20:45:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.721 X-Spam-Level: X-Spam-Status: No, score=-1.721 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.186, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZBPw9E8HfKTJ; Wed, 9 Mar 2022 20:45:26 -0800 (PST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 127B63A088F; Wed, 9 Mar 2022 20:45:25 -0800 (PST) Received: from mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 22A4j55o001526 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 9 Mar 2022 23:45:11 -0500 Date: Wed, 9 Mar 2022 20:45:04 -0800 From: Benjamin Kaduk To: Chris Morrow Cc: Michael Richardson , "art@ietf.org" , "sidrops@ietf.org" , "draft-ietf-sidrops-rpki-has-no-identity.all@ietf.org" , "last-call@ietf.org" , Tim Bray , Geoff Huston Message-ID: <20220310044504.GU22457@mit.edu> References: <164686787641.27464.13731142773840437850@ietfa.amsl.com> <8C8BA519-74D9-4BD4-952C-28002C07C329@apnic.net> <30513.1646873344@localhost> <87ee3afp81.wl-morrowc@ops-netman.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87ee3afp81.wl-morrowc@ops-netman.net> Archived-At: Subject: Re: [Sidrops] [Last-Call] Artart last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 04:45:32 -0000 On Thu, Mar 10, 2022 at 03:42:06AM +0000, Chris Morrow wrote: > On Thu, 10 Mar 2022 00:49:04 +0000, > Michael Richardson wrote: > > > > [1 ] > > > > Geoff Huston wrote: > > > So I clearly don't understand what track this draft is supposed to be on, right > > > wrong. I clearly just don't understand the nature of the problem that publishing > > > this draft as an RFC would solve. > > > > I had the same question as you and Tim when I read the document. > > (My email didn't get through to sidrops... it's not using the global > > acceptlist I guess) > > I don't think there is such a list? ('global acceptlist') > (I think I did ack your messages through though (I thought) earlier this week?) See https://mailarchive.ietf.org/arch/msg/wgchairs/9bHUvKCKqXRT35EC7yE88yQ1WZI/ (The mailarchive finds a few other threads, including a call for chairs to opt-out of a bulk conversion pass.) The main guidance seems to be, email ietf-action@ietf.org if you want something changed. -Ben From nobody Thu Mar 10 03:22:37 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E7C63A099D for ; Thu, 10 Mar 2022 03:22:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.108 X-Spam-Level: X-Spam-Status: No, score=-2.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ripe.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UdTVtakjawSC for ; Thu, 10 Mar 2022 03:22:29 -0800 (PST) Received: from molamola.ripe.net (molamola.ripe.net [IPv6:2001:67c:2e8:11::c100:1371]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 442A83A0064 for ; Thu, 10 Mar 2022 03:22:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ripe.net; s=s1-ripe-net; h=To:Message-Id:Cc:Date:From:Subject:Mime-Version:Content-Type ; bh=ltKXGUKVEPTBCVZP5nESd79AhJ4/wFFB3FFwmWaL3Sg=; b=TFNlJaNCvEkOLn1HtoE+kS4A x9fokOVb37zU3yoxJaRnLGMi+vVyDWHcyqjYTzT6/0OJAzcZKxvqbHamVciP+g4XllPXKhgY0S917 QLX13Bz+9zJNGGMQkNlpl083vs2hNhB4L0k+DD+YjznE2sBl+6kzwRW5LnYOqLdB55SDJqMTAnja1 FHnFuniBIHMis/bJNER9ETlSdItkUCVL69p/3q0v+5OhUgeVrCQSk94IjvwOCIdiDCGlkV0vinQZN XBDpp2P6rNi9V6MFazsRP09chUYlefOTEoH1/S4ypqdSuKrGKD1KExJDMdQlSfZR0D4t5Pii891ea WY6+6tDTCQ==; Received: from bufobufo.ripe.net ([2001:67c:2e8:23::c100:170d]:34532) by molamola.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nSGsD-00096q-QG; Thu, 10 Mar 2022 12:22:25 +0100 Received: from sslvpn.ipv6.ripe.net ([2001:67c:2e8:9::c100:14e6] helo=smtpclient.apple) by bufobufo.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nSGsD-0007y4-Lb; Thu, 10 Mar 2022 12:22:25 +0100 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.60.0.1.1\)) From: Ties de Kock In-Reply-To: Date: Thu, 10 Mar 2022 12:22:24 +0100 Cc: Tim Bruijnzeels , "sidrops@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> To: Randy Bush X-Mailer: Apple Mail (2.3693.60.0.1.1) X-RIPE-Signature: 059faafd1cc22ebb05e1592c815fe1e1d0a0755a557439d275e2278114af00b5 Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 11:22:35 -0000 > On 10 Mar 2022, at 04:53, Randy Bush wrote: >=20 >> This is an issue if, per Randy's example, the entire ROA is withdrawn = first, >> the RPs fetches and revalidates and sends withdraws for VRPs to the = router, >> and then the new ROA is published later, validated, etc >=20 > no need. CA publishes old an new ROAs. RP fetches both and processes > sequentially. oups! >=20 > and now we can expect to hear folk suggest that the RP should swallow > and digest the entire ROA set (think of the scale of this a few more > years out), reconcile it all, and only then send the reconciled VRPs > to the router. if the current state of RP software is any indication, > i would not want to bet my routing on this. I checked two (StayRTR, routinator) implementations for their behaviour = and they handle this case properly: only the delta in the VRPs after a = complete update is transmitted. If not, imo, that's a bug. I agree with the information in the draft for de-aggregating VRPs = especially for CAs that do not form one system with their parent CA. In the case where = the parent CA is not under your control, you may not want to have = fate-sharing for all your VRPs. The risk is mostly there w.r.t. overclaiming, it may be good to spell = that out. -Ties From nobody Thu Mar 10 03:41:24 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37D403A0C02 for ; Thu, 10 Mar 2022 03:41:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.91 X-Spam-Level: X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 30Ns04afCyaH for ; Thu, 10 Mar 2022 03:41:22 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03D813A0B8F for ; Thu, 10 Mar 2022 03:41:21 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nSHAS-0003jp-Fg; Thu, 10 Mar 2022 11:41:16 +0000 Date: Thu, 10 Mar 2022 03:41:15 -0800 Message-ID: From: Randy Bush To: Ties de Kock Cc: Tim Bruijnzeels , "sidrops@ietf.org" In-Reply-To: References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 11:41:23 -0000 maybe i just don't get it. the CA, in some thought of saving bandwidth or something, packs data up into AS-based blobs which the RPs are then supposed to unpack and reconcile. where's the win that is worth all that work? and i do not see the RPKI data as having epochs, times when it is stable. times when there is a complete snapshot of the data. data are being added and removed asynchronously in the distributed tree cross the net topology. like bgp, it does not converge to a stable point; it is constantly in motion. randy From nobody Thu Mar 10 03:57:46 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96EC93A0D12 for ; Thu, 10 Mar 2022 03:57:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.109 X-Spam-Level: X-Spam-Status: No, score=-7.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ripe.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MYsQjav_mt-R for ; Thu, 10 Mar 2022 03:57:39 -0800 (PST) Received: from molamola.ripe.net (molamola.ripe.net [IPv6:2001:67c:2e8:11::c100:1371]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86E713A0D54 for ; Thu, 10 Mar 2022 03:57:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ripe.net; s=s1-ripe-net; h=To:Message-Id:Cc:Date:From:Subject:Mime-Version:Content-Type ; bh=cmEDTyvBrU/x/Ph/iaG9OCT4v2NiiwfnfkTYJWKwwOc=; b=q52Bjz/rkVL8P7hWQx9evlWU qqUW+0OCEnoFKorGWysgbK04Z6zBzzRdijfffdtUSmlPSrHTdXT7b3HbviLd8C+OLG2/SmzpV9HP1 VU+HJkho0rnzsMrK5e3/0C2DuLIwZNrcm8VCOCkGwkbZDsKgOiZuVO8FawoW8vCnrM031daLSpeio rHJAO+On41Xm6ui7wkQg+e+pJgqhPnUebRVhAxvnlogrhioqUqQN4gYEdMnvNb4VgSdE5a8lwa2ET YkH7jdcRwdg0Q5szfDYNp8GYLSMEAsLwp6p0rLuMuNELqIfSS+Lti1ywEhHo/W2/fC5GxKe9KvTpF 6CEal6U+tw==; Received: from allealle.ripe.net ([2001:67c:2e8:23::c100:170c]:53112) by molamola.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nSHQG-000BEY-QY; Thu, 10 Mar 2022 12:57:36 +0100 Received: from sslvpn.ipv6.ripe.net ([2001:67c:2e8:9::c100:14e6] helo=smtpclient.apple) by allealle.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nSHQG-0004wh-Ly; Thu, 10 Mar 2022 12:57:36 +0100 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.60.0.1.1\)) From: Ties de Kock In-Reply-To: Date: Thu, 10 Mar 2022 12:57:35 +0100 Cc: "sidrops@ietf.org" , Tim Bruijnzeels Content-Transfer-Encoding: quoted-printable Message-Id: <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> To: Randy Bush X-Mailer: Apple Mail (2.3693.60.0.1.1) X-RIPE-Signature: 059faafd1cc22ebb05e1592c815fe1e1bc0e2a6e766c698603e6e2f63bc1e25f Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 11:57:45 -0000 > On 10 Mar 2022, at 12:41, Randy Bush wrote: >=20 > maybe i just don't get it. >=20 > the CA, in some thought of saving bandwidth or something, packs data > up into AS-based blobs which the RPs are then supposed to unpack and > reconcile. where's the win that is worth all that work? =E2=80=9Cless objects, smaller=E2=80=9D It sounds like an attractive optimisation on paper. I would need benchmark results (with a rir-sized repo with = 1-vrp-one-ROA) to see how much it does in practice. > and i do not see the RPKI data as having epochs, times when it is > stable. times when there is a complete snapshot of the data. data > are being added and removed asynchronously in the distributed tree > cross the net topology. like bgp, it does not converge to a stable > point; it is constantly in motion. My mental model: The RPKI is a directed rooted forest. =46rom a single = point of view, for all CAs, you see a consistent snapshot for a CA (or encounter = a failed fetch). If there are no split views on the repository content, RPs will = eventually see the same updates. If a CA shows an intermediate state where part of the VRPs are missing, = some RPs will see that state until their next update. From nobody Thu Mar 10 04:07:35 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CB943A0DB5 for ; Thu, 10 Mar 2022 04:07:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.91 X-Spam-Level: X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZyknoJQOjZ2B for ; Thu, 10 Mar 2022 04:07:31 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3CDA3A0C77 for ; Thu, 10 Mar 2022 04:07:30 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nSHZn-0003nQ-7y; Thu, 10 Mar 2022 12:07:27 +0000 Date: Thu, 10 Mar 2022 04:07:26 -0800 Message-ID: From: Randy Bush To: Ties de Kock Cc: "sidrops@ietf.org" , Tim Bruijnzeels In-Reply-To: <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-2022-JP Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 12:07:33 -0000 >> the CA, in some thought of saving bandwidth or something, packs data >> up into AS-based blobs which the RPs are then supposed to unpack and >> reconcile. where's the win that is worth all that work? > > $B!H(Bless objects, smaller$B!I(B > > It sounds like an attractive optimisation on paper. "Premature optimization is the root of all evil (or at least most of it) in programming.$B!I(B -- D Knuth > I would need benchmark results (with a rir-sized repo with > 1-vrp-one-ROA) to see how much it does in practice. i think one would want to measure whole system, from CA repo to the router > My mental model: The RPKI is a directed rooted forest. From a single > point of view, for all CAs, you see a consistent snapshot for a CA (or > encounter a failed fetch). [ s/for all/for each/ ? ] > If there are no split views on the repository content, RPs will > eventually see the same updates. except the CA PPs publish asynchronously, on varied schedules, etc. and the RPs fetch asynchronously. and the routers ... randy From nobody Thu Mar 10 04:33:31 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E865A3A0B70 for ; Thu, 10 Mar 2022 04:33:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, T_SPF_TEMPERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ripe.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jW1uw6EoHyk8 for ; Thu, 10 Mar 2022 04:33:03 -0800 (PST) Received: from mahimahi.ripe.net (mahimahi.ripe.net [IPv6:2001:67c:2e8:11::c100:1372]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88B653A0981 for ; Thu, 10 Mar 2022 04:33:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ripe.net; s=s1-ripe-net; h=To:Message-Id:Cc:Date:From:Subject:Mime-Version:Content-Type ; bh=q7i/dnYlvPe2rG91CcO8mKVaxciKWYu00Gt7O9svLU0=; b=kotP2wwH1msuT8eC87AHDPY2 xzXGkAP7HJkyr5zNh3oUeR9wUAlGuS5gkr0o13C7X2xR7wveahhho0onrDAgVmKxFRweXAh5BMfqD /tPTG0X1GQxp7UQLSoj4dLUzfhQLbeW1MFe/IoFHZbWWqELqbYwMHG7NIucqk3FmqyVxWm7H2O285 hmsOrehUYtoT2ZAsjDO+6CcTzQHaI3lbAO5XqMN4cYjKHVjHRkwVoocAjlawTZAkcxY2D2g9MWsnE mfcegeCoyp6I5rB1joKY2/dlZu4C8v+gy0VPJYKkN9UY8EGdGznwxg/8bxHTIdgpdtybq53TnwpD+ QYAhN+VS/w==; Received: from bufobufo.ripe.net ([2001:67c:2e8:23::c100:170d]:37968) by mahimahi.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nSHyX-0002hi-2X; Thu, 10 Mar 2022 13:33:01 +0100 Received: from sslvpn.ipv6.ripe.net ([2001:67c:2e8:9::c100:14e6] helo=smtpclient.apple) by bufobufo.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nSHyW-00043V-Vh; Thu, 10 Mar 2022 13:33:00 +0100 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.60.0.1.1\)) From: Ties de Kock In-Reply-To: Date: Thu, 10 Mar 2022 13:33:00 +0100 Cc: "sidrops@ietf.org" , Tim Bruijnzeels Content-Transfer-Encoding: quoted-printable Message-Id: <739620E8-2689-4B8E-9072-BCF8F58A7D59@ripe.net> References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> To: Randy Bush X-Mailer: Apple Mail (2.3693.60.0.1.1) X-RIPE-Signature: 059faafd1cc22ebb05e1592c815fe1e12fe6258cad4d9ab51eaca7c36cb5a806 Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 12:33:11 -0000 > On 10 Mar 2022, at 13:07, Randy Bush wrote: >=20 >>> the CA, in some thought of saving bandwidth or something, packs data >>> up into AS-based blobs which the RPs are then supposed to unpack and >>> reconcile. where's the win that is worth all that work? >>=20 >> =E2=80=9Cless objects, smaller=E2=80=9D >>=20 >> It sounds like an attractive optimisation on paper. >=20 > "Premature optimization is the root of all evil (or at least most of = it) > in programming.=E2=80=9D -- D Knuth >=20 >> I would need benchmark results (with a rir-sized repo with >> 1-vrp-one-ROA) to see how much it does in practice. >=20 > i think one would want to measure whole system, from CA repo to the > router Might be even better. My underlying assumption was that - in a static situation - the = resulting set of VRPs, for a fixed input, is the same independent of VRPs. The dynamic behaviour is an even lager experiment... >> My mental model: The RPKI is a directed rooted forest. =46rom a = single >> point of view, for all CAs, you see a consistent snapshot for a CA = (or >> encounter a failed fetch). >=20 > [ s/for all/for each/ ? ] Yes - for each. >=20 >> If there are no split views on the repository content, RPs will >> eventually see the same updates. >=20 > except the CA PPs publish asynchronously, on varied schedules, etc. >=20 > and the RPs fetch asynchronously. >=20 > and the routers ... are all =E2=80=9Cobserving points in time on a set of timelines=E2=80=9D (given no split views of repo content, etc) -Ties= From nobody Thu Mar 10 06:59:03 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADEF83A17FB for ; Thu, 10 Mar 2022 06:59:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fastly.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tV1mIQeYTmLd for ; Thu, 10 Mar 2022 06:58:57 -0800 (PST) Received: from mail-ed1-x52c.google.com (mail-ed1-x52c.google.com [IPv6:2a00:1450:4864:20::52c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CEC83A17FA for ; Thu, 10 Mar 2022 06:58:56 -0800 (PST) Received: by mail-ed1-x52c.google.com with SMTP id w4so7306128edc.7 for ; Thu, 10 Mar 2022 06:58:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastly.com; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=qdgfmXaXfCaJ/NFzEFx1CwfIEli6YiBOXkHIX/T1LLw=; b=MDRDldoXwlpBOBUAM7sYxHFDxkWMFzouTxpPQnzQfne8z1/osMTcI7KQHd8QTxjxtm 5N3lLBImOOj+uvdRCaru1Pfn2MF/t9USZ39He8bGrseExrCAM15YRKkc+/2m1Oc+n13f n+5AioNCgkF+LA+0D8tvMF1lbd6eW7mhdG0nI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=qdgfmXaXfCaJ/NFzEFx1CwfIEli6YiBOXkHIX/T1LLw=; b=T6tnAUrcpcta4QWdMqvtinCQXYjoNalDVMDGxOTgwc2rYl+3TrITX6h7O3Y4MH7x52 c93QN5E+qKw+8jeo+7ZkyxYEgwh6QL3Heir1u/ob61dEAe7viCN6cTUghoJOTXkmVVW8 sM9zF2w/gp9spZUBp7NlDrd+nlzRJiGJXQP3S1aARgrMOTzAiBthvJorgqRhAfFuL8/T mn6eNHbh7Ndj0BTYHAZPczLwTfojcWUBehgVmRkKYv9Y70BVYRpNL6bge2CO8wuvM6FL sbDi3UtZSrP0dWgzofQDQnr334COhs2xPf9b2uB/mpqVY/qmXpNWi7rFeis9+lhUM6GB aXNg== X-Gm-Message-State: AOAM533e4eZLDB3cNV6NVxKk7rdndieWh/kxELFtWBWfbv+4x51GryIh Ac2FpafHgx1HbVJDeIsv18h01g== X-Google-Smtp-Source: ABdhPJxrNFxGBSlOxlx55PFpZ3X8V0vuSEjV5dzDV/Uu2ou+oI/gXEWMR0joNx4XJ+WU87EFbYXqAQ== X-Received: by 2002:aa7:da93:0:b0:416:4aca:bef7 with SMTP id q19-20020aa7da93000000b004164acabef7mr4845832eds.296.1646924334726; Thu, 10 Mar 2022 06:58:54 -0800 (PST) Received: from snel ([2a10:3781:276:2:16f6:d8ff:fe47:2eb7]) by smtp.gmail.com with ESMTPSA id g2-20020aa7c842000000b0041314b98872sm2058151edt.22.2022.03.10.06.58.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Mar 2022 06:58:54 -0800 (PST) Date: Thu, 10 Mar 2022 15:58:52 +0100 From: Job Snijders To: Rob Austein Cc: Benjamin Kaduk , The IESG , sidrops-chairs@ietf.org, morrowc@ops-netman.net, sidrops@ietf.org, draft-ietf-sidrops-6486bis@ietf.org Message-ID: References: <164366773060.21391.16732854790829264927@ietfa.amsl.com> <20220225235526.GY12881@kduck.mit.edu> <20220227002536.3516E2EA009D@minas-ithil.hactrn.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220227002536.3516E2EA009D@minas-ithil.hactrn.net> X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Sidrops] Benjamin Kaduk's Discuss on draft-ietf-sidrops-6486bis-09: (with DISCUSS and COMMENT) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 14:59:02 -0000 Hi Rob, everyone, Quick note from my side: this has not fallen off my radar. Based on Rob's feedback I'm now trying to research the origins of the DISCUSS at hand for a better understanding, and assessing what currently deployed RP / CA implementations do. At times this work feels like attempting to thread an arrow through two rings [1] :-) Next week I hope to be able to circle back to the group with more information, or a proposal for a path forward. Kind regards, Job [1]: The Legend of Zelda: Breath of the Wild On Sat, Feb 26, 2022 at 07:25:36PM -0500, Rob Austein wrote: > Apologies for jumping in late here, I've been distracted by $dayjob > (which has not been RPKI for many years now) and only just saw this. > > I fear that I must object, strongly, to Job's proposed change: > > > > ----- section 4: Manifest Definition ---- > > > > > > OLD section 4.2.1 second paragraph: > > > Because a "one-time-use" EE certificate is employed to verify a > > > manifest, it is RECOMMENDED that the EE certificate have a validity > > > period that coincides with the interval from thisUpdate to nextUpdate > > > in the manifest, to prevent needless growth of the CA's CRL. > > > > > > NEW Section 4.2.1: > > > Because a "one-time-use" EE certificate is employed to verify a > > > manifest, the EE certificate MUST be issued with a validity period > > > that coincides with the interval from thisUpdate to nextUpdate in the > > > manifest, to prevent needless growth of the CA's CRL. > > > > > > ----- Section 5: Manifest Generation ---- > > > > > > OLD Section 5.1 last paragraph: > > > It is RECOMMENDED that the validity interval of the EE > > > certificate exactly match the thisUpdate and nextUpdate times of > > > the manifest. > > > Note: An RP MUST verify all mandated syntactic constraints, i.e., > > > constraints imposed on a CA via a "MUST". > > > > > > NEW section 5.1: > > > The validity interval of the EE certificate MUST exactly match > > > the thisUpdate and nextUpdate times specified in the manifest's > > > eContent. (An RP MUST NOT consider misalignment of the validity > > > interval misalignment in and of itself to be an error.) > > This business of pinning the manifiest EE certificate's validity > period to the manifest's thisUpdate/nextUpdate interval has always > been a bad idea, I've objected to it in the WG before, and we have a > long sad history of operational disasters resulting from > implementations that followed that recommendation. > > The typical failure mode (demonstrated at least once each by three of > the RIRs) is to pick a thisUpdate/nextUpdate cycle on the order of a > day or so (reasonable), then go home for a long weekend, during which > something breaks and no new updates occur. > > The manifest thisUpdate/nextUpdate semantics are (deliberately) very > much like the CRL semantics: failure to issue a new manifest by the > nextUpdate time does not automatically invalidate all the existing > data, it's just a hint that something might be wrong. Think of it as > a staleness indication. Slightly stale, log a warning but no big > deal (yet). Gets stale enough, maybe you don't want to eat that. > > Certificate expiration, on the other hand, is a hard failure. When a > manifest's EE certificate expires without being replaced, the data > listed in the manifest is just gone. > > So when an RIR does this with the manifest directly under their root > certificate, a large portion of the total database goes away. Oops. > > Manifests only have EE certificates because they're a patch on the > side of X.509. If X.509 had allowed us to sign manifests using the CA > certificate, as with CRLs, we would have done that. But it doesn't, > so we have the manifest EE certificates, OK, but that's no reason to > kill large portions of the database every time an operator near the > root of the tree says "oops". > > All of this has been discussed before, and should be both in WG > archives and in notes from face to face meetings (probably both the > SIDR and SIDROPS WGs, not a new topic). > > My own RPKI CA implementation uses the validity interval of the parent > CA certificate as the validity interval of the manifest EE > certificate, and has for about fifteen years now. I'm not aware of > any operational problems that have arisen as a result. > > Yes, there's a potential issue of a CRL getting too long, but if it > happens at all, it happens at a predictable rate, and one can always > rekey if it's really becoming big enough to be a problem. > > Job's proposed change makes the bad idea a requirement rather than > just bad advice, hence my objection. From nobody Thu Mar 10 11:34:51 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 199173A1B89; Thu, 10 Mar 2022 11:34:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OnY1pWmCHpHy; Thu, 10 Mar 2022 11:34:33 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F5B43A1B83; Thu, 10 Mar 2022 11:34:33 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nSOYP-0004oS-8b; Thu, 10 Mar 2022 19:34:29 +0000 Date: Thu, 10 Mar 2022 11:34:28 -0800 Message-ID: From: Randy Bush To: Tim Bray via Datatracker Cc: , draft-ietf-sidrops-rpki-has-no-identity.all@ietf.org, last-call@ietf.org, sidrops@ietf.org In-Reply-To: <164686787641.27464.13731142773840437850@ietfa.amsl.com> References: <164686787641.27464.13731142773840437850@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-2022-JP Archived-At: Subject: Re: [Sidrops] Artart last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 19:34:39 -0000 hi tim, thanks for reading and commenting. > 1. Is this sort of bad-practice use of RPKI keypairs actually > occurring? a few years back, two of the co-authors of a lot of sidr rfcs, working at apnic (supposedly a prudent steward of the net infra), put up a "sign arbitrary blob" service, with no warnings of the semantics. one of them just wrote to say he thought 6480 was sufficient; which pretty much says it all. and early drafts and discussions of the first two informative references [I-D.ietf-sidrops-rpki-rsc] Snijders, J., Harrison, T., and B. Maddison, "Resource Public Key Infrastructure (RPKI) object profile for Signed Checklist (RSC)", Work in Progress, Internet-Draft, draft- ietf-sidrops-rpki-rsc-06, 12 February 2022, . [I-D.ietf-sidrops-rpki-rta] Michaelson, G. G., Huston, G., Harrison, T., Bruijnzeels, T., and M. Hoffmann, "A profile for Resource Tagged Attestations (RTAs)", Work in Progress, Internet-Draft, draft-ietf-sidrops-rpki-rta-00, 21 January 2021, . brought to light massive misunderstanding and misrepresentation, despite 6480 > this mis-use of RPKIs and the purpose of > draft-ietf-sidrops-rpki-has-no-identity is to give reviewers an extra > leg to stand on when saying "Don't do that". more operators and implementors than ietf reviewers. this is from an ops area wg. > Which seems reasonable but shouldn't be necessary? sad to say, it seems to be. > I grant that it might be effective in suppressing this bad practice in > I-Ds but 6480 seems pretty clear to me. tl;dr: ibid long: tragic to say, but a long line of trucks have been driven through 6480. this aspect is merely one. the code and operations providing rpki infrastructure and its use is not what you want to tell your mom about. > 3. The single MUST assertion being repeated twice is unnecessary. > > 4. The MUST assertion feels unnecessarily complicated and > long-winded. I think what they're trying to say is "You MUST NOT > perform PKI operations with these certs except exactly as described, > and for the purposes described, in 6480.$B!I(B will take those on. > 5. The discussion in section 3 about how the holders of RPKI keys > probably don't issue their own certs but get CAs to do that left me a > bit puzzled. Is the conclusion that we should admonish CAs not to do > this? Or is it the case that some key-holders do issue their own > certs but are Being Bad? both. operationally, there are two paths of issuance. the RIRs provide "hosted" service, where their customers have no mechanics and merely use the RIR's web or api interfaces. in the "delegated" version of the service, the RIR issues the base cert for the registrant's resources, with the SIA pointing to the registrant's repository, and the registrant CA issues whatever from there. > 6. Section 3 is kind of long and discursive and could likely be > shortened without loss of value. The document might be more useful if > there were subsection 3.1 Issuers of RPKI certificates, 3.2 > Organizational issues, etc > > It should be obvious that I don't understand whether there's a > bad-practice problem out there has been tiny, but was threatening to be large. the discussion of this draft in the wg has helped ameliorate the fantasies considerably. > [It is also possibly the case that those better acquainted with RPKI > will instantly understand what the problem is and why the language > herein will help deal with it, in which case feel free to ignore most > of my comments. ] others will be more eloquent. steve for example https://mailarchive.ietf.org/arch/msg/sidrops/V5OHy_p0po6VmAYFxjK3Wz_2lLI/ or our esteemed AD, to qute him, > I must admit that I *wanted* to / felt I should be able to use the > RPKI to do things like sign LOAs and similar "the RIR says I'm the > 'owner', seem mah cert!" type things, and so, even though the document > makes me sad, it's useful and needed. and, as usual, ben is articulate, see https://mailarchive.ietf.org/arch/msg/sidrops/93mFbfcBFfngb90MGeR7VaAD28g/ randy From nobody Thu Mar 10 11:53:34 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5ECD3A094A for ; Thu, 10 Mar 2022 11:53:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.11 X-Spam-Level: X-Spam-Status: No, score=-2.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=apnic.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lCvpkztQfwbo for ; Thu, 10 Mar 2022 11:53:26 -0800 (PST) Received: from AUS01-ME3-obe.outbound.protection.outlook.com (mail-me3aus01on20610.outbound.protection.outlook.com [IPv6:2a01:111:f403:7004::610]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A488D3A094B for ; Thu, 10 Mar 2022 11:53:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nZpiwsnDlb2nph8QcU5YCC6M+UeT0QcriXrBA2zbtdjLA9H0m3C5H/W0tCAUZK6kWlPoWUvE/GctUCIiIXMbRB0wEwDm2/FtVl1lPOnLAWtZA0Oi8HuhtYXWi3S79Lym5vJHGGxBndeSOUD0B7284tE9MnQlbGtV2LIjvtZwgpY75p9IBr6aaaQHdihXzJ+0MfODg80wnws+A3IfOsZBCe+6K5flDAeNWB2WwhNc5cHDZqnXQFAcTtfNE8v280nbPXKwTe5DjQNpSecV6h7QaJn0OIEc6iCM7KXZ7D2KXjHWoOpBTTHsDin22oW0cQQmejbCI+x5f7uoOYUIIoDynQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=bmtN9R6eTZnXWE0ScjQMBW5fU/XO73TBgNRrQRMWAsM=; b=bkWNpRf4T72cunyagzSubihVp+lWzbBnVwMbMHYRDzyGQSLtTPl/Tjo6YIGHpJsfgG/G7wRemxc/EUulw1ft3uLVpm749DLr9Wr9R5qHt7ImUYBXVJPgsX3HV+5nDa4hybjj8/XRjWapUTc8VEOqkCn66sRoMivzbw372MbkVpYCxP/m7iSFhhDSIJuR1mbDvXyY2To0f/0Cv/pYrtSfWO2udD4SsTk6iiEOSqn3sEufgPOrd4Sz60FGCmOo5GsI3lb2a8RKTwu+cy0rgbW9VV5wXiCsevRlf+nuJVEaXWBX1jv6PCswBnaPH1ONY19rriQiteRtxhYktSggz9+4bw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=apnic.net; dmarc=pass action=none header.from=apnic.net; dkim=pass header.d=apnic.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apnic.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bmtN9R6eTZnXWE0ScjQMBW5fU/XO73TBgNRrQRMWAsM=; b=Sz/qYfsTvyoSD7Sj78ph0ceg+LsLd76lLFz7Tso3l5tu6HAwp25JGLgOPF2eM51iBPe48067OtwvKQlyzMznBxoYdjrM0s27BLmFq4fHDKlO/7vSvPrxVQVj9QhpeGlzlbasPfoA+9P0AWEO88xk8u9ou78VwXnFAozqd4WisDU= Received: from SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:176::18) by ME4P282MB1238.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:92::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5038.14; Thu, 10 Mar 2022 19:53:21 +0000 Received: from SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM ([fe80::2d75:2788:316:de9]) by SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM ([fe80::2d75:2788:316:de9%4]) with mapi id 15.20.5061.022; Thu, 10 Mar 2022 19:53:21 +0000 From: Geoff Huston To: Randy Bush CC: Ties de Kock , "sidrops@ietf.org" , Tim Bruijnzeels Thread-Topic: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 Thread-Index: AQHYNDJhPUxJk93DPE+sp2OhMnXz66y4edYAgAAFRICAAASQgIAAAsEAgACCLYA= Date: Thu, 10 Mar 2022 19:53:21 +0000 Message-ID: <9B0B0DBF-9F7A-4A61-9EBE-BCE556150475@apnic.net> References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> In-Reply-To: Accept-Language: en-AU, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3693.60.0.1.1) authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=apnic.net; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d65b628d-1e5a-42d3-622f-08da02cfa196 x-ms-traffictypediagnostic: ME4P282MB1238:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Q/SEN0J7EcUsiUfJep4ECgmB2o6c7iytiCS8EQ0sEA0Nbo7IvclRbBc41pyJnqcAEvv0TR9zlRdALV/U0iMXtL/Qa/mQCJ8glYcQH70TbXUbkjFnIsRAY8U+mL0CSan6kzoYeAp1Vb2IGGte6mqFuETY/druEe4qhriIetrQSuWfmPkYu3VMTD+haxrbk7Sy1vQcnKaEDbKRlKn1i6l9U6acUAZLeLMJXgD/a2rZhPzOeSwRyDCIkO3s0W2p/quaNl+SLRn+iODSCbsKObPfNfsXXu2VN6TBDY9z7MRl9IDOsyUIeFGpWMZbvJlt+0j0elp5o6l/QEfjxv9PPbbs7nz3ykTgQq6b+e7CeqOUh+Y4bK8lzRn8l0r49EAuZyfJtgiw03DXyXh8dfMkd+1LeQtja1DD/QIWXQ5OT7vXi+YgYCdSezD5w0Gsrlw2il0LhMITlkU9y+1rhIH69IVQ0sIJktTwxQikuYCAVW5j+4hp2qJ2oHK3De7qcQ2Zru7Rzv+/CB0cqDAd1TpzitZpjUAFkhb7/KksdMU8ppoX/737yWT9dMTwdYtMcoalH+hC4qOoESNG7I0kcEhnMdzlT4g9NNjL1x7VUyHQmJjHN1Qp/8M38ohNasHEcADplKE8rkqiaBeOX82yjEiUV4VPeskHLU1fWhNAEgJbmWB/n34jYBb1GEYw24xxKusJXp6AE5Q9bSgkhkpMj04Fw3FzXIGRBogAkhA2GWP+fNd+8Ts0oLt2YR1qpoFis8SpVsRO x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230001)(4636009)(376002)(136003)(39840400004)(396003)(346002)(366004)(6916009)(66446008)(54906003)(66476007)(76116006)(66946007)(8676002)(4326008)(66556008)(122000001)(33656002)(64756008)(36756003)(5660300002)(2906002)(316002)(508600001)(6512007)(6506007)(53546011)(71200400001)(83380400001)(38100700002)(86362001)(66574015)(2616005)(186003)(8936002)(38070700005)(6486002)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?SS9YVnhlTUcxd2ZKaEdURUdETHR6U045NE9XdU1hUkxIUTRvZ3c1b3Ywc2Jk?= =?utf-8?B?OGdIQlFyL0pTYjdUaVdrRy8xNEpUUTVaUm54Wjh0VGxWZERDU1pvTnZ4Q3dt?= =?utf-8?B?ZlNOYjczbk5FTExKZzJ3Mkx5UEV6TXZCNzJhYm45K1FPUlNVSm9TWkI0eUxC?= =?utf-8?B?a0UwOUFTeEpUR0lpdXZ0MTk1QWY0b3NQTVkwMGQvcE0rbWFkcUt4TERHT0xn?= =?utf-8?B?UDNXTnVjV2JWZE4wZmd0V1BGUFB6NmhOdjMvUEd3VVhvdkhOUTc5QTBKT0c4?= =?utf-8?B?d21SZjVkM0dJKzBZNDFaKzFiTVhDcElxS2lDVy9RWG5wbkVxUkYzTUd0NHl5?= =?utf-8?B?dElXdzNWVHFFa1FUY2hpb3BvZFZRdEkyQ1BnVVJQOGtxYkpHTktlL2xXbEVC?= =?utf-8?B?cU1UaFU3S2crUkE0WFg3cDdrb2NPRXo2c0w3NEJIaGYyTDRsaDJzZzdwUzkw?= =?utf-8?B?dzRKcW9oaTdSR2p0c1h6ZE5QVVRNbXdTZHY2YWswODlLaWVmNGNvT2p4aFlD?= =?utf-8?B?dGZKU0hJOU9lYVVtUmplR2hvV2xNQlpHY3hrN2lmYnhWT0lPK3lFVlp1My9L?= =?utf-8?B?T0E0UDdWVFovZDNUemdQYzFGWCsxV0M3NkRXV1laQitMd3dDK0lpckJXSWpM?= =?utf-8?B?OGhBcUNROTBVdHZVdWYrbk5sckx2R2xFRUlwYTU2akVackxQdnUwVzBKQWti?= =?utf-8?B?dEtmT3RjbmNzQlVGcnkzR3VkL0t3aDVKUzhUczFDVUFRZFJ0Uyt3dCsva0F4?= =?utf-8?B?VEppZnpxZjdPaDA5SjN4QzFtanRzWUdQcTNMMW0vNFFvclF1NzBzL1dFSThj?= =?utf-8?B?cnMxMFFkQlB2WDVWUHovM0R5dDhNNXRldnFkOGhPenE5Wkx2OXpzL3hlNVVi?= =?utf-8?B?MDdjQTc4RkFEYlIzMzlwVlRaTFZ1SHBZdTJkYVIwM2h2SmpKNUovdURsbVEr?= =?utf-8?B?K0Y5ME95RUQxTlBrcWkxYldjNG0xOFBpRFh6Z0FBaFJPbkw5RlV2TGRsVy9u?= =?utf-8?B?a2MyZll2U3NheERaVVdjN09iMVZlNEdqcXNHMTJkM1VBcUF3Q3I3K2xPODB2?= =?utf-8?B?MDZzSytQMmhHMm9QdzU1QjhxTUZaeUlubzRaZGYyRkU2Nkg4SzU3d2JodlJF?= =?utf-8?B?OWQwYjE1TEE1UWxkYlJqQ1prd0pwdWhOSXFWQnhBVlJWYi9qY3NINlBkWk1s?= =?utf-8?B?eFJrMkplY0FuZ1pIMjdFaEllUGVLY09yanRpOXNkTVNIcHZ3WU1SZUEwMFYr?= =?utf-8?B?MnJUL0gzTDFTbGZ0MGduVEZzU2pIV3liU2xMRE0rNmJTUWtKME56ZEJSam8w?= =?utf-8?B?ZGlqaEEzRjhWSWtpQVZLaFhhWWdaY29IN1hRSUpuSnRrN09jZXFITG1DRjUy?= =?utf-8?B?WHBqOXEyWlRSNW0vYnNmTWxMNVlxNjNHYmJlenA2TnVSeUNIRWdjK28ybVdw?= =?utf-8?B?V3AydU1xU2kzWTBkMVA1RktMM3hMOFQzUlBpMUdNaGZYN0l3Yk1YSlNkYzNH?= =?utf-8?B?aWk3aUFkVzF3WnZlRWlrL2tyV20vdXNtcTFkZldPMmRmbmYrbkRJRDNMUWpX?= =?utf-8?B?b2w1c3NlSUpra1NpTDVXNUxHdXR4Q21ROWhGZ3FLZlFoc08xMTVMZUlBRTR3?= =?utf-8?B?WkxzcytWNVp1bnRENzg2aGVabklwYWd0Y1JmOUVUdCsvWjY0eFoySlM0YmVP?= =?utf-8?B?bEgxVU8rMUZySjdPS0FJeUUrZXBDWlpZYVh4TExhK1EzRjdUQi82TmJzSW8w?= =?utf-8?B?TjZ4cFBkSzdXRmh4TXg5R1BNcXEwSStEQzJkQ3RwYTJ1QVdEUGtOT0xwakRu?= =?utf-8?B?TFYvRFRsQUVjSlBWcklWUUpHalYvZ0NHOWVocjRJYXdhazdrUi9DcWwvQmpy?= =?utf-8?B?NnFwdG8zM3BIMWxtSGlteEUxK3pJUzd0QlI0SStJWVpVMEJPNXphTVBpTVpi?= =?utf-8?B?c25tZHh6YnJlRXV0MmtlV1VlY2x0b2VJUEo1WW5ycmpFbHllUzN4aXdNOUw3?= =?utf-8?B?Z3d1Z1hFeXQydzQvUExFLysrb2tYTVlwZDlKOG1EZ0pBT3BVZ3ZhcnBFbkZh?= =?utf-8?B?RUFlcGIzS1NRV2JNemp6dEFHVWJRMWNLUE9Ca3VzOVdzdEhjcW0wSGJkaTlK?= =?utf-8?B?OWVTVUxSeWYyN3YzMW9xRFg2YkJDcXpteHpaWmEvMUJLeTMxeFJmTXQ0RTNL?= =?utf-8?Q?amux2BBdVA7HjdQfr3YUnyvJlRoC8SbK6m27GxropCmn?= Content-Type: text/plain; charset="utf-8" Content-ID: <57A088F202F0E9468F5546BCCDA61AD3@AUSP282.PROD.OUTLOOK.COM> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: apnic.net X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: d65b628d-1e5a-42d3-622f-08da02cfa196 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2022 19:53:21.8507 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 127d8d0d-7ccf-473d-ab09-6e44ad752ded X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: LPbpQzka/T1sosh97Ag6NIhv9qzXaWL3sHPmdw2f02/lTbLesps1XOZwaw568Bo+ X-MS-Exchange-Transport-CrossTenantHeadersStamped: ME4P282MB1238 Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 19:53:32 -0000 DQoNCj4gT24gMTAgTWFyIDIwMjIsIGF0IDExOjA3IHBtLCBSYW5keSBCdXNoIDxyYW5keUBwc2cu Y29tPiB3cm90ZToNCj4gDQo+Pj4gdGhlIENBLCBpbiBzb21lIHRob3VnaHQgb2Ygc2F2aW5nIGJh bmR3aWR0aCBvciBzb21ldGhpbmcsIHBhY2tzIGRhdGENCj4+PiB1cCBpbnRvIEFTLWJhc2VkIGJs b2JzIHdoaWNoIHRoZSBSUHMgYXJlIHRoZW4gc3VwcG9zZWQgdG8gdW5wYWNrIGFuZA0KPj4+IHJl Y29uY2lsZS4gIHdoZXJlJ3MgdGhlIHdpbiB0aGF0IGlzIHdvcnRoIGFsbCB0aGF0IHdvcms/DQo+ PiANCj4+IOKAnGxlc3Mgb2JqZWN0cywgc21hbGxlcuKAnQ0KPj4gDQo+PiBJdCBzb3VuZHMgbGlr ZSBhbiBhdHRyYWN0aXZlIG9wdGltaXNhdGlvbiBvbiBwYXBlci4NCj4gDQo+ICJQcmVtYXR1cmUg b3B0aW1pemF0aW9uIGlzIHRoZSByb290IG9mIGFsbCBldmlsIChvciBhdCBsZWFzdCBtb3N0IG9m IGl0KQ0KPiBpbiBwcm9ncmFtbWluZy7igJ0gIC0tIEQgS251dGgNCj4gDQo+PiBJIHdvdWxkIG5l ZWQgYmVuY2htYXJrIHJlc3VsdHMgKHdpdGggYSByaXItc2l6ZWQgcmVwbyB3aXRoDQo+PiAxLXZy cC1vbmUtUk9BKSB0byBzZWUgaG93IG11Y2ggaXQgZG9lcyBpbiBwcmFjdGljZS4NCj4gDQo+IGkg dGhpbmsgb25lIHdvdWxkIHdhbnQgdG8gbWVhc3VyZSB3aG9sZSBzeXN0ZW0sIGZyb20gQ0EgcmVw byB0byB0aGUNCj4gcm91dGVyDQo+IA0KPj4gTXkgbWVudGFsIG1vZGVsOiBUaGUgUlBLSSBpcyBh IGRpcmVjdGVkIHJvb3RlZCBmb3Jlc3QuIEZyb20gYSBzaW5nbGUNCj4+IHBvaW50IG9mIHZpZXcs IGZvciBhbGwgQ0FzLCB5b3Ugc2VlIGEgY29uc2lzdGVudCBzbmFwc2hvdCBmb3IgYSBDQSAob3IN Cj4+IGVuY291bnRlciBhIGZhaWxlZCBmZXRjaCkuDQo+IA0KPiBbIHMvZm9yIGFsbC9mb3IgZWFj aC8gPyBdDQo+IA0KPj4gSWYgdGhlcmUgYXJlIG5vIHNwbGl0IHZpZXdzIG9uIHRoZSByZXBvc2l0 b3J5IGNvbnRlbnQsIFJQcyB3aWxsDQo+PiBldmVudHVhbGx5IHNlZSB0aGUgc2FtZSB1cGRhdGVz Lg0KPiANCj4gZXhjZXB0IHRoZSBDQSBQUHMgcHVibGlzaCBhc3luY2hyb25vdXNseSwgb24gdmFy aWVkIHNjaGVkdWxlcywgZXRjLg0KPiANCj4gYW5kIHRoZSBSUHMgZmV0Y2ggYXN5bmNocm9ub3Vz bHkuDQo+IA0KPiBhbmQgdGhlIHJvdXRlcnMgLi4uDQo+IA0KDQoNCkhvdyBtYW55IHRpbWVzIGRv IHdlIG5lZWQgdG8gZ28gYXJvdW5kIGFuZCBhcm91bmQgdGhpcyBzcGFjZSBiZWZvcmUgd2UgcmVh bGlzZQ0KdGhhdCBhc3luY2hyb25vdXMgZGVtYW5kLXB1bGwgZmxvb2RpbmcgZGVzaWducyBhcmUg aW50cmluc2ljYWxseSBicm9rZW4/DQoNCkF0IGxlYXN0IG9uZSBtb3JlIHRpbWUsIGl0IHNlZW1z Lg0KDQpHZW9mZg0KDQoNCg== From nobody Thu Mar 10 12:19:46 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 882A13A1BA1 for ; Thu, 10 Mar 2022 12:19:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PECvYjFYva3Q for ; Thu, 10 Mar 2022 12:19:43 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F8693A1B9E for ; Thu, 10 Mar 2022 12:19:43 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nSPG8-0004up-S0; Thu, 10 Mar 2022 20:19:41 +0000 Date: Thu, 10 Mar 2022 12:19:40 -0800 Message-ID: From: Randy Bush To: Geoff Huston Cc: SIDR Operations WG In-Reply-To: <9B0B0DBF-9F7A-4A61-9EBE-BCE556150475@apnic.net> References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> <9B0B0DBF-9F7A-4A61-9EBE-BCE556150475@apnic.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 20:19:45 -0000 > How many times do we need to go around and around this space before we > realise that asynchronous demand-pull flooding designs are > intrinsically broken? the internet is probably intriniscally broken; but we plod on. i would be *extremely* interested in your description of how the dns and rpki would work in push models; and suspect that others would be as well. very large scale, wide distribution, and variable connectivity make difficult bedfellows. randy From nobody Thu Mar 10 12:25:16 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4DC33A0D5D for ; Thu, 10 Mar 2022 12:25:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.11 X-Spam-Level: X-Spam-Status: No, score=-2.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=apnic.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4SkXdzyXp2WA for ; Thu, 10 Mar 2022 12:25:09 -0800 (PST) Received: from AUS01-ME3-obe.outbound.protection.outlook.com (mail-me3aus01on20607.outbound.protection.outlook.com [IPv6:2a01:111:f403:7004::607]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF87E3A0D65 for ; Thu, 10 Mar 2022 12:25:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eZLBXaicoStz8ftw/Gz/Mf450Ch3bxKCDUv0QddPxIYiykaeWJC6JNWyC/I0OlDRBw0fb3q1inSaTD87B5cxl2Y9viX5PorApB+lSflD1XE0KX6aAF9Gz1SUeUWWDPl3P1pOKPjWQ7+5GhTfAFKLg3rHD8NG0dmkBivOykJjuOjbX7fQQyh+VbassB+AIyca8tuxGXwBvUp+KC48eqSzsJrsWvdVOkBwnyrNNattOJtkxa2caunvK1FRhI9ipj8ykw4DF9KczJMfO+DU8JQg42mvS+iBP3lhxhvDXHKnCTwskp5J9SQE8KYTpDIipggp8rwPDEhqJaaJtZxH38Dvlg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=wt4TzvibyY3QjD0PDdy4+yNP2cdJs+GJBlBbXRdMGyA=; b=IVGlKJOZwlhd7PMOIceJOXvTUTSe9YqKN+dz72b/9vpLizdPu7MFiDci/V2SO5yZwRBl+w+3marzvQoxA4qD64SBIee7zhHbeWo3Ulb1LNrrJIPY8FWHR8F3FqA0Qua8iNfJo9+ii54Ctd+0oUHN1St5oug5qWr0/lUUBJSm5gv7U3XQvXKN7M6CLmHvTmcg4EN45vn7IxCmWtEAfFtIcgYPQdqQ9e7Kt7TcsbZ44SmbiEayPJilv5yioLCTIMiB+MOL7BOp3ws9Oj5y++h6wBuHV7ofK7yz4GjTc2YLaXZ2Jq0gaVgxrAsWc2NcnGjE0ufLxCX5X5LyDEi+euuJxw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=apnic.net; dmarc=pass action=none header.from=apnic.net; dkim=pass header.d=apnic.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apnic.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wt4TzvibyY3QjD0PDdy4+yNP2cdJs+GJBlBbXRdMGyA=; b=aJp3MOUd5KO6PvqEjsd33ocV/uBlXcAx/mPKyp4qkG19whhKImud6mKGo42H7k7xm93390oiwex1KE4B7lVKklCXl0B7z3QVBdOYbAEOyrX5GdjKYaiCn/hlfdWzSH2GW+wl10eJTafxOblyydLGilHWcoW1d+xewj9AliXsvi0= Received: from SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:176::18) by MEYP282MB1750.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:ba::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5038.14; Thu, 10 Mar 2022 20:25:01 +0000 Received: from SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM ([fe80::2d75:2788:316:de9]) by SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM ([fe80::2d75:2788:316:de9%4]) with mapi id 15.20.5061.022; Thu, 10 Mar 2022 20:25:01 +0000 From: Geoff Huston To: Randy Bush CC: SIDR Operations WG Thread-Topic: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 Thread-Index: AQHYNDJhPUxJk93DPE+sp2OhMnXz66y4edYAgAAFRICAAASQgIAAAsEAgACCLYCAAAdaAIAAAX4A Date: Thu, 10 Mar 2022 20:25:01 +0000 Message-ID: <56A29364-EB28-4224-96D0-8A5FE95D1880@apnic.net> References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> <9B0B0DBF-9F7A-4A61-9EBE-BCE556150475@apnic.net> In-Reply-To: Accept-Language: en-AU, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3693.60.0.1.1) authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=apnic.net; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 136a47b9-3fd2-445f-1654-08da02d40db8 x-ms-traffictypediagnostic: MEYP282MB1750:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: BewtDERnqr68uRAehiTwoFyautfKzjOM186rALXVwTXHP5YbaQeFixPqy3h/fuVQrFUYAkNfRT+fMfH5x2DtDYr7nOQHFmICaP3aSDjgRYoeCppNYP7WholqNLAzUJri1vDCWjzxwL7jHUZHpQqaOUvRWnsdk/lKxQdMZ4QgTkRmKxGFg80R4Oy7N5egErFmgzyI5/xW3edgNP08K86bD+DdF7UdBtHIxpUtp0v4kBb8nZH3N+YBpf9IomZc4dUvVun+2PinIYcmeppHuQurjUufLF5zyz22g7tX/oL5rExFchbB0MUy31zZsEsY4STlbmw9ga0KmmHg98t7pidmQAI7N0httMQk4KQXXosQrDOlA6DIZ3PC+z+Z0bEOV0JDC5YPoLlicQcoMgwAj5DF8U0ZzCdrWcmamEe5+vkfExVqC0YaMB/+gSoe8MHDYBuINsKLgXm4fAvNpY8jW5/I+8hi4oNlD/9lWqRA7Ohr2EKLClI1FL2Xv7T4x1ypi8rvT14pKZrWGD0YfV0l9q/vmGNDGVxksambVFMubu36u2MdrVtwcP+qkDyKz9+cn7raKxeiA+P/HJJB3W0+TG4jrdKc0CzV4E20qQIpI5YstSv2dGUEmNTGOwgL8/0w8jhp3abFC4XNCi0WEx3I4h7gpfHiW23ArMJ4Cv33xK893bSif2HyZffeaMtArej0xVIsMhtYedvBAjUqMQDBz3r/TuyzaVO23cOBFp0UlXrjNYZB6GIvVFiMC8Mziy0f2oMx x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230001)(4636009)(396003)(39840400004)(376002)(366004)(346002)(136003)(76116006)(8676002)(53546011)(38100700002)(2906002)(64756008)(66556008)(66446008)(66946007)(4326008)(122000001)(71200400001)(6916009)(38070700005)(5660300002)(8936002)(508600001)(316002)(86362001)(6506007)(6486002)(33656002)(186003)(36756003)(66574015)(6512007)(2616005)(66476007)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?CNp52Lfuy0Hwx6sD3JTXBaQX6mpIA8r5z7tziI5LWsmjThBmaJR2KN2UcfZ0?= =?us-ascii?Q?ehgxzLgR42qnPqrw0AMHuOkiLFtqY7csj4cnQl21Pma62nlL43wldAX1A3t/?= =?us-ascii?Q?LtN6fQjwEqgpPu5U4vJEXuuOBOz3xFOppNZ9Mdn1Z4KiY3DsMJDSRt0/NVdT?= =?us-ascii?Q?1k7lEXBjRigXtDVC/rc03maHcnwiQ5WEaVaDs2Qr+ctZJUKYTAVynKpprhO3?= =?us-ascii?Q?BZAY5j2NjxLebuEisa2g19wRMXY8Ayntgdf5h6PTTJgP1UKEiWqLoOjLJVBX?= =?us-ascii?Q?RnTVkLaVq8AR13qz1XcmPBLDK7VquOjyMy+KyYAST+z0lYqs4jKymjeMvgeq?= =?us-ascii?Q?emkldFUmqdlVS8zOsBCCrv4zPtCInlPO10TEZuG+FeQ3vh8WQTOteBhYQzEB?= =?us-ascii?Q?DJkAo2YT+DtFQZb+x3S+e2+qyGkPnjzQMJyTodpuzMhJLjeqgugJBn1uKXi9?= =?us-ascii?Q?0JX5SbixPFHHsNJj/qrP9EzDBmvb8mwr08h2Q2KZjlZ+zazOPXESpdIVTMMo?= =?us-ascii?Q?7W0KuPmnw5BMaQvcORRplCpqKKYIOREyhYO5uSPP4jINrNWJUqFhKLOqt1YU?= =?us-ascii?Q?hCxDZeT+2IS94K0AFuaG91hxi0yjTywgU5YJNxfLu3Bg16QA7RQl9s/2GsaR?= =?us-ascii?Q?g8c/0R/JtoSuiB+8UBTNCkNXO2X4+JfRE43S/VhmdCDNGD5i0n0PPM6J6fuP?= =?us-ascii?Q?RK1EJ3OWSYis8goalJJHY/2piQx2RNkyJV4MVURSR9QFoQ2c5PwEKcNMafaU?= =?us-ascii?Q?NTK/1tY3Tas47WJbAQHmXKiLdS01KFNpKyghJpON+Air1qgq8r+K949NO1/i?= =?us-ascii?Q?UdYLiEFRmGlotrXaKkOMDIAlvFw5HlBo2k5P9Awkchn4ny9nFsaLjrIO23b3?= =?us-ascii?Q?nwl/6VmfEbui+eEpDpmbe5eJYwXYs045Wo9p9NgsLbYaUxI87n9eh2ShB8Xp?= =?us-ascii?Q?+Yu9C+gqUsdGaxBpkYwRHqBMN7xbhFwB3fPYypuQw+CY6Ox4MF/IZ1MpX6yD?= =?us-ascii?Q?80UoMn9pqOi5cDcKbE3Ne7r6sIyWe8CTQd4OvvZT6nWi7ytS97uHGu+5tlcN?= =?us-ascii?Q?JbRLjp6QUwymKRkEc9sEFa/KvEgOM+LziPNZPINKyBi9NzMTpTsQQ/Uat/Sx?= =?us-ascii?Q?YjrL8YvOymkVt8Za322JQkQq0UE7ofC70tCYbXfaRm8tjqT8NYuWe+ee1lX0?= =?us-ascii?Q?6YfHGNP6nwS6rCdUf3zDClFMVmvafkXcoWBvMDMmUaRh/S1tqSZ0KqS7+U8v?= =?us-ascii?Q?ysDebaCA+CngWNpoQzCe84TqirWaQAuE8fXQx6TA99HekFrUa1W6VquLLUDS?= =?us-ascii?Q?p/aq8H97TBM+e+PjdY55W7ICwuZZlThoPrZDC/C6/Vr2nqPeczv13M1/VW1Z?= =?us-ascii?Q?oWZMmrkBHytf43hfjSYQmTvRZpdbB2Mg0KJZyNG/Mnim5cVebWw5bKupoDpf?= =?us-ascii?Q?vodxfikiATJ80Hr0dexdPDGh7JbJPmZ4KyG8P7YT8NbS1mDtqITKBdwgHzZp?= =?us-ascii?Q?AcFXW2U3VJuCwQO9cdjedv2gGheCTccDRDr/Oq5qy0rsQ5WmQmyqA515Xf1n?= =?us-ascii?Q?7teuGPoXSkg/JUpSvEc5Of0SQmfAhe9mRXoZTFqcPDVvEZJ86M62pd5SmOFP?= =?us-ascii?Q?o2AvsChDuc015vjJFcTynTI+mNo6SQRSXjn3pD/mRCOp?= Content-Type: text/plain; charset="us-ascii" Content-ID: <79FD74A94CEC3040A20BEC2F87102C0E@AUSP282.PROD.OUTLOOK.COM> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: apnic.net X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SYZP282MB3169.AUSP282.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 136a47b9-3fd2-445f-1654-08da02d40db8 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2022 20:25:01.2367 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 127d8d0d-7ccf-473d-ab09-6e44ad752ded X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: r2G/FcO6DSQ9s9bYw2bKbMZq7CVtMG1ituEj7CKSfeaYo2xK7fbl0jvW9skSCXYl X-MS-Exchange-Transport-CrossTenantHeadersStamped: MEYP282MB1750 Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 20:25:15 -0000 > On 11 Mar 2022, at 7:19 am, Randy Bush wrote: >=20 >> How many times do we need to go around and around this space before we >> realise that asynchronous demand-pull flooding designs are >> intrinsically broken? >=20 > the internet is probably intriniscally broken; but we plod on. >=20 > i would be *extremely* interested in your description of how the dns and > rpki would work in push models; and suspect that others would be as > well. very large scale, wide distribution, and variable connectivity > make difficult bedfellows. >=20 agreed, yet we have TLS using just-in-time credential provisioning in the initial handshake which has very different scaling properties. The models of DNSSEC provisioning also staple the credentials to the data. RPKI is one of the few models that attempt to pre-provision the entirety of the credential sets to all relying parties all of the time, and I find myself wondering why we ever thought that such an approach would scale! yes, I agree its just one more aspect of the intrinsic brokenness of the Internet, and, as you say, we plod on! :-) Geoff From nobody Thu Mar 10 12:43:07 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FFB53A1BED for ; Thu, 10 Mar 2022 12:43:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u4ZRW66gTrib for ; Thu, 10 Mar 2022 12:43:05 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 27A2E3A1BC7 for ; Thu, 10 Mar 2022 12:43:05 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nSPcl-00050m-59; Thu, 10 Mar 2022 20:43:03 +0000 Date: Thu, 10 Mar 2022 12:43:02 -0800 Message-ID: From: Randy Bush To: Geoff Huston Cc: SIDR Operations WG In-Reply-To: <56A29364-EB28-4224-96D0-8A5FE95D1880@apnic.net> References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> <9B0B0DBF-9F7A-4A61-9EBE-BCE556150475@apnic.net> <56A29364-EB28-4224-96D0-8A5FE95D1880@apnic.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 20:43:06 -0000 note that dns and rpki-rtr try to alleviate this somewhat with NOTIFY. we both regret that we are old enough to remember when a dns change might take days to propagate; now we're annoyed if it takes O(10) minutes. similarly, the RP cache NOTIFYs (cf 8210) the router "now would be a good time to pull." pretty hacky, but improves operation greatly. randy From nobody Thu Mar 10 12:46:58 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14C553A1BF0 for ; Thu, 10 Mar 2022 12:46:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verizon.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VfKCJQRvi2uN for ; Thu, 10 Mar 2022 12:46:51 -0800 (PST) Received: from sonic304-22.consmr.mail.ne1.yahoo.com (sonic304-22.consmr.mail.ne1.yahoo.com [66.163.191.148]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F1E13A1BEF for ; Thu, 10 Mar 2022 12:46:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verizon.net; s=a2048; t=1646945209; bh=GKe/juS/Ar1iKHyzvndG17en5D5/JOuCIbJ+FpTo8u0=; h=Date:Subject:To:References:From:In-Reply-To:From:Subject:Reply-To; b=GvqqMyynL7uU5y+iODlxqbzwLnrc411TOAt/cY9vTTWRoUJTmzcOlWdVImm9dvyRqAb8YVNVzYb5PCVarsDEb5Y5I8WdUwoTjdZCKYSs6YkBSGQijM4WSr5YPS2VAiBj+ukj5bfX8o9XzDBuKOH0pylZtqd0xS0Wc17h+ECl0YjWvLvluRcxH+3cbuQrUNEwKrkm0ziHVRIkSGxQcNvbr2AQNu4x/jNSHK7jFx9LEeg4VZs5Mb5ggYkRkXlIoTANfxdmvvBU/TJAZ57ejRTijIP9JFnumWgTljdJP9wO/DFkitqZBuuHnUc0UNRAX5k5soiDws4EEF3S5LpS+X8Mlg== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1646945209; bh=z82hMlmQYanic6IEb79KmquKyC3fs8IoUZ34Maxyg4l=; h=X-Sonic-MF:Date:Subject:To:From:From:Subject; b=bQl1hswWcyJVPHEj/LLH6AINthGMrVIBPmsG/8nK5gggutncLIy0ARcy4vqYjHHf7noCFtUBAA6KeVlfZJQcnguZEj3ah4XaaARgdRsIvjqWJMDKRoaWEBTxVW5CPV6LplM6GxjYBcSlO9M1wpIdiD/oZE+MTEBLs1f56yCfsq53/i2167nMeUiE8tmdM5W3bBj6OYP9uOdihuY3W8HpTGn6mXl9AU5q7Sl+7NMspkUDaqrd3us/yjabUAQ/bkq6+lQ9z8Ozk1Cx9GRcfd9hWOxo6TRbji1fJAItjNS0rIYf5QnS9DhrV4M9IYRachjedyjQ/0fv/O1gnIysaIzWJA== X-YMail-OSG: y3ZzW.cVM1lGnqdoZoPQDhV89F0G9Bsx8dp3sIhuApVppz3r_SKy7cyV.j7qw5y thWLEi9Ubjqu8gZpWoe046vtxyroc1DwO331K4Y_Fx_J4zhjPfHgC89nTcklio.snF9R4PPdPElw e01ZKyfT.z1VyOvGSN8jeV9V0Hczd60Sg2u28VeH.ULMIxZtDAATyFqo8tkNXB5JZeDXMgJDCo.5 M2Wb7VCvCMYKP8pREtdVJkVLhCzSxaphDVhplmj30pzD4G.rfciHeg7c1OX8vDLZGw2ecZbUcGIH mENmidzGH_rKtcEoMvo6qrKncLB.E6ElQ7_Zxl8wE.xqSXHhgUQhVmLN58ytEGa4V_dvWRVJL14v _T.EOHxhqNdCLJAdZj.pM_.ihhseHwlDTxJJFs1rZn8aEifaLtmAdgcBfd98MvJ2fhDW6mXUebVk w1c.v.shTEQME9X8YUyJp5CwV5qsY0KcnGiMs8kALlCcJS6pjpeMJrLZznFiGFUCk_puoW_w._nS RBPdmLRIHcT91z55BS7X7h3HRmVw4iQ6r.iAXsJLFQTJ6KGJNlP_twp0oiFes78qnT0705x3V4fN ix7lcOFSAffxWOYac7rFGgvCtDUN5mXfB_jetiF5cGdoGpew3ZU3XhfYoSlExwv9UVHN08SeCB2R GvA2swiorVU7.9wNyze8R30nwwvC1NvwHIuUtPpkLo4XPa6qG1.lb5YtKB6_uQOmaP0QEqVwFQ4u F6m4PRGiVcvWxBV4SwRGmcfwcYKvOGP_UtFfsiJXauYyi86bt.qtHi9nEjDkavtamt.H3Mn8RunG EWZp7EmKPQ7zY3c2M_MjnHVcG8v5yUuISeKYzIB10bRs9h9wSEWDwnaxLK6s_j2c88mZegQntUrb RQ0Tn7uMRCg8JoZ58og__6lBpxNN1Y8IUBhpLEWErh62Jovl7lKVX1WULq2XIqxylXzh3aXzqwzU WRmIwj4LusaurjUP__yaGWB2DHYKhofCcVM5n7BcAWqf_2CK.1c1qGOUEWzUExyZR1QgDUj1.MDD hUZymC__5U3LLVBvh9NIgNTCsmwwT09fKkPHNT0WuGSWrpP5Zzo6t9705RBYhYuE4iHU53szd90b hofpykerZUSYMnCTJAL2KuRX.LnL8sFyvPtVp5PNXQcuyK3720hGLUkg2.ko295ADM_wh91M6XTw JaxQQNfC0_zMkif828Ai9y1XLzRIlI3IrZ6sKb9d88FbWy5X3fd9j2J.vE8LveKEAkQE2qf9VH6N 6NwDBwV_KSWqBEI1P.HKKSR_tX2hGeno3f_G7m6auzq7RaNcSWFR7CC3Tt7Vf7GvW4xJ0Dy2vjrc viV2YqluPMXZiRZ_lFrZmrdC16H2aF3gAIOXZpebI.XBxQvcHXnSqZAsg2SFvKuG6203JGu0UfFF .N8.cCEfDjhKDya8WUQ8NxshLE_Yyvni1ey5HestB.i2TwFUXJhB0IPT.OkikqiSIJ7oYD3Le7eL LE9rgoySfuXbVj2ybyX3CGlEeNrkwpOeLoMe633PRa_StsVzletMhuuoobC6DRM1_vrZm9hZS5qc B8Rpbfk76fCpFZjjeWPdG82bZ.wJJH8C9qQHTU7_bgNQpH0ReXEalxOFZT6y_Reuyepb1xEPYwXK FCqoJ2Um..2HJ2PhdsCYhSObF9gugEkKlpkZfeOiFAm_qHu0G.a5v7efU178AwXleLt7YeSZjw5k T76toFaKL7K7uVVA5gMVCchGBwsLmk26Y3A_97sZzWEJZ2Ah4oTHTMwjKCqIo6aB70a3F3EuVK.P 3PM.HodCR4G5pNi87lcN1joL8B8.vMq_71MLR_vR3RVWIKsudfk0OchQg_Yo7idYJUYqjOGyCN_3 3Ki3fpbr5m3hp2HX3fxhUwRc1aINBBwCc7G94FThqvmtZiaWKPL.zSNY6aD64hm2wz6JVaXy5uXX 1sxVq2qGzxJQS9nHCLHXW2a4Hcvp0qGGJAj91XvLm2HWKQwf5Iz2xVnUyjNr8bNFvJN1zF8iou7I xONmPhQnG7KDNFAyMBM1pAhTDHMB1FwEhHF.IoevGNnasONvcnYVzl.mwWWolAzP6GkOIoTcKltl d1RdR7oX_UX92dQKNOmNPywzfzKNp9sveF24wPhXOhlM6M.9fz1ogkCyKVVZcQPX_beQ6w4dc741 WyDoZhaSNnQBpIvQyvqwe75LlBTUDSHSBkEvF8z9GhqTU_PoMVV0fpnRGG_zl7PDTwfwIoTpF89a rSxXfpmlg X-Sonic-MF: Received: from sonic.gate.mail.ne1.yahoo.com by sonic304.consmr.mail.ne1.yahoo.com with HTTP; Thu, 10 Mar 2022 20:46:49 +0000 Received: by kubenode550.mail-prod1.omega.bf1.yahoo.com (VZM Hermes SMTP Server) with ESMTPA ID e731f71dff88f318a1721529e92110c6; Thu, 10 Mar 2022 20:46:44 +0000 (UTC) Message-ID: <2ca4980f-5b36-13d6-29e8-c73c9f0958bf@verizon.net> Date: Thu, 10 Mar 2022 15:46:43 -0500 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Thunderbird/91.6.2 Content-Language: en-US To: sidrops@ietf.org References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> <9B0B0DBF-9F7A-4A61-9EBE-BCE556150475@apnic.net> <56A29364-EB28-4224-96D0-8A5FE95D1880@apnic.net> From: Stephen Kent In-Reply-To: <56A29364-EB28-4224-96D0-8A5FE95D1880@apnic.net> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Mailer: WebService/1.1.19878 mail.backend.jedi.jws.acl:role.jedi.acl.token.atz.jws.hermes.aol Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 20:46:56 -0000 Geoff, > > agreed, yet we have TLS using just-in-time credential provisioning in the > initial handshake which has very different scaling properties. The models > of DNSSEC provisioning also staple the credentials to the data. RPKI > is one of the few models that attempt to pre-provision the entirety of the > credential sets to all relying parties all of the time, and I find myself > wondering why we ever thought that such an approach would scale! > > yes, I agree its just one more aspect of the intrinsic brokenness of the > Internet, and, as you say, we plod on! :-) TLS creates a pairwise connection between two entities, so transmitting the cert of the server is an obvious, simple approach to solve the problem in question. And, because of the artificially shallow PKI underlying the issuance of certs to servers (thanks to the browser vendors and the cabal of for-profit CAs), it's easy to ensure that a client gets the certs (and CRLs) it needs. The RPKI requires essentially ALL RPs to have access to the certs for essentially ALL address space holders. It is much more logical to have a bulk distribution mechanism to facilitate this, vs. some sort of pairwise distribution mechanism of the sorts you cite. The requirements for cert and CRL distribution are completely different for the RPKI vs. the Web PKI- apples vs. kumquats (as Randy might say). Steve From nobody Thu Mar 10 15:12:12 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A46413A07B7; Thu, 10 Mar 2022 15:12:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T0rrQjjHqvW8; Thu, 10 Mar 2022 15:11:56 -0800 (PST) Received: from mail.netability.ie (mail.netability.ie [46.182.8.5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DABDF3A07D4; Thu, 10 Mar 2022 15:11:53 -0800 (PST) Received: from crumpet.local (admin.ibn.ie [46.182.8.8]) by mail.netability.ie (Postfix) with ESMTPSA id 8FBB79CC2D; Thu, 10 Mar 2022 23:11:49 +0000 (GMT) To: "Sriram, Kotikalapudi (Fed)" Cc: "grow@ietf.org" , "sidrops@ietf.org" References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> From: Nick Hilliard Message-ID: Date: Thu, 10 Mar 2022 23:11:47 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:52.0) Gecko/20100101 PostboxApp/7.0.54 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 23:12:01 -0000 Sriram, Kotikalapudi (Fed) wrote on 10/03/2022 03:31: > Nick and all, > > Thank you. What you all shared/discussed is very useful info. >> Almost all RS's are transparent these days. Usually IXPs go to >> lengths to ensure that the RS ASN doesn't appear in the AS path. > Good to know that. Well, that means there can be an occasional RS > that is non-transparent. When there is a non-transparent RS, could > there be big ISPs (Tier-1, Tier-2) present there as RS-clients? I would seriously doubt it. There are some "Tier 1" and "Tier 2" providers who peer using route servers at IXPs, but it's a bit unusual (and entertaining to hear them strenuously denying that this ever happens). Non-transparent RS's were used until a couple of years ago but I'm not aware of any left at this point. Even when non-transparent RS's were more widespread, I would have expected the intersection of these two groups to be null, and that if there were an intersection, the Tier1/Tier2 providers would not be upset if those paths were dropped / marked as invalid. > The ASPA verification draft treats the relationship of RS to > RS-client as similar to that of Provider to Customer. Seems > reasonable? The AS of an RS client includes the RS's AS in its ASPA > as a "Provider". yes, this is reasonable. Nick From nobody Thu Mar 10 16:12:57 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02B693A0C43; Thu, 10 Mar 2022 16:12:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.908 X-Spam-Level: X-Spam-Status: No, score=-6.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q1ul2STZ0dh6; Thu, 10 Mar 2022 16:12:50 -0800 (PST) Received: from mail3.g24.pair.com (mail3.g24.pair.com [66.39.134.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 02FA73A0C3D; Thu, 10 Mar 2022 16:12:50 -0800 (PST) Received: from mail3.g24.pair.com (localhost [127.0.0.1]) by mail3.g24.pair.com (Postfix) with ESMTP id D711E1232B9; Thu, 10 Mar 2022 19:12:45 -0500 (EST) Received: from a860b60074bd.fios-router.home (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail3.g24.pair.com (Postfix) with ESMTPSA id C4F5A1232B8; Thu, 10 Mar 2022 19:12:45 -0500 (EST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.21\)) From: Russ Housley In-Reply-To: <19977.1646505904@localhost> Date: Thu, 10 Mar 2022 19:12:45 -0500 Cc: Ben Kaduk , SIDR Operations WG , LAMPS Content-Transfer-Encoding: quoted-printable Message-Id: <6AE9245C-A721-41B4-AE08-3D7CF680341F@vigilsec.com> References: <164642447410.28300.14979172722907480601@ietfa.amsl.com> <20220305043121.GH22457@mit.edu> <19977.1646505904@localhost> To: Michael Richardson X-Mailer: Apple Mail (2.3445.104.21) Archived-At: Subject: Re: [Sidrops] [Last-Call] [lamps] Fwd: Last Call: (The I in RPKI does not stand for Identity) to Proposed Standard X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Mar 2022 00:12:55 -0000 Michael: Did you see the ARTART review on the last-call@ietf.org mail list? I = think you questions were answered by Randy in response to that review. Russ > On Mar 5, 2022, at 1:45 PM, Michael Richardson = wrote: >=20 > I have read the document. > I was unaware of it until it was posted. >=20 > It seems like this document is fighting some kind of guerilla fight = against > pressures to provide a higher RoI for doing RPKI. >=20 > I'm personally really annoyed that ARIN has been so restrictive with = access > to the public key that can used to validate the RPKI that originates = with > them. >=20 > } It has been suggested that one could authenticate real-world = business > } transactions with the signatures of INR holders. E.g. Bill's Bait = and Sushi > } could use their AS in the RPKI to sign a Letter of Authorization = (LOA) for > } some other party to rack and stack hardware owned by BB&S. = Unfortunately, > } this is not formally feasible. >=20 > I think that it would be nice if some specific proposals were = mentioned. >=20 > I don't really know what: > } no proof of termination >=20 > means. >=20 > I feel like this document might better be written by an ARIN or ICANN = lawyer > in a cease and decist kind of fashion, and that really, adults should = be > allowed to do whatever they like with their private keys in the = privacy of > their own HSMs. >=20 > It isn't clear that we gain by publishing this document. >=20 > At some poine in the 1990s, I was assured that Dunn & Bradstreet where = going > to issue certificates useful for business transactions. That never, = AFAIK, > happened. >=20 > } Government of Elbonia >=20 > citation! citation! :-) :-) >=20 > -- > ] Never tell me the odds! | ipv6 mesh = networks [ > ] Michael Richardson, Sandelman Software Works | IoT = architect [ > ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on = rails [ >=20 >=20 > -- > Michael Richardson . o O ( IPv6 I=C3=B8T = consulting ) > Sandelman Software Works Inc, Ottawa and Worldwide >=20 From nobody Thu Mar 10 17:44:08 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7238B3A07D7; Thu, 10 Mar 2022 17:44:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.109 X-Spam-Level: X-Spam-Status: No, score=-7.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sandelman.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IBzseITHsQxb; Thu, 10 Mar 2022 17:44:01 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6A623A07CD; Thu, 10 Mar 2022 17:43:59 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 5241538AEF; Thu, 10 Mar 2022 20:53:29 -0500 (EST) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id KmH7kXAoI30i; Thu, 10 Mar 2022 20:53:27 -0500 (EST) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 1BED238AED; Thu, 10 Mar 2022 20:53:27 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sandelman.ca; s=mail; t=1646963607; bh=+5vDk0HopJOYBnSiXPN2QgmsH72q1IVRSJ3LtvJn/tA=; h=From:To:Subject:In-Reply-To:References:Date:From; b=MdSVCC/eae9ZArp02L+bmDKIQ3KtUivqw1Zwhd8jazhkFkGzhTfhr2W4BSiSlbi6y r5RapZMSENwJjHGm66VLvLufolKTCkhntfzDhY2tGikevbXNcQ6EFhvtNcPS4jFhyM EGS7glEV5QKA9T7RXbNjnehrx+O/wXDwF4N9biRO89iRmUHpnFao7RG+0fvGQSpHU/ 1m6kJg8LyV7MUPR4eNgskm/WFc13swkSO8wX3zd6h/9FLWQDDTuYvql9Mc5Jxf22Ez JQLlmQPQwvT0J6i3RXxVrNROIxrGfw6UOW4UtCgEKadJyWqxZKx0M9R6gf2cYzHb8R jLuuhspUEF18A== Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 0411668E; Thu, 10 Mar 2022 20:43:55 -0500 (EST) From: Michael Richardson To: Russ Housley , Ben Kaduk , SIDR Operations WG , LAMPS In-Reply-To: <6AE9245C-A721-41B4-AE08-3D7CF680341F@vigilsec.com> References: <164642447410.28300.14979172722907480601@ietfa.amsl.com> <20220305043121.GH22457@mit.edu> <19977.1646505904@localhost> <6AE9245C-A721-41B4-AE08-3D7CF680341F@vigilsec.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Sidrops] [Last-Call] [lamps] Fwd: Last Call: (The I in RPKI does not stand for Identity) to Proposed Standard X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Mar 2022 01:44:07 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Russ Housley wrote: > Did you see the ARTART review on the last-call@ietf.org mail list? I > think you questions were answered by Randy in response to that review. I did. I'm still skeptical that an RFC will help, but I don't object to trying. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmIqqVoACgkQgItw+93Q 3WUu3wf/Si5MOIIShAXTorNdc8TD5hGMOW+57WCFZJVG55rof588PB+kljf00eil 7TnXzNP152n7B7/GkhYQNOJYAG1HP0qlRD6pbN+qnGyws1ZFzK2aONnIikzgqDZj SGAZ4xTZwfgymsFspntTcqwRUoXqn06A0SnVi9ij+pBIXxc3f6s05BZezz/WPA1U A/veO0SBn9ZGqe2mK0gHPRel4g5xqNqm0Jw5CmmX07PkA5qvvrNiG5WrSIwJjLtH 1qG1dnIHxyAWCl6JrmxpLMBEDz3CU56CbP5rVw5ycDvakuVYmipEHbEhW8c3HsTM 0X6eoc0X0xMsFGl+ks7QlNtp588x/A== =Fk23 -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Mar 10 23:23:38 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41D0A3A0E8F; Thu, 10 Mar 2022 23:23:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.11 X-Spam-Level: X-Spam-Status: No, score=-2.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=workonline.africa Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XLLDpzaIbdXg; Thu, 10 Mar 2022 23:23:23 -0800 (PST) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-he1eur02on0609.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe05::609]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F280C3A0BED; Thu, 10 Mar 2022 23:23:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BHR7SU/ObuIl7V4wfdoRTUAiHAwLK3FWGqFJaAUisoREq2P+wOGNKezuLMTa0F4sRovtXiM6dWSIE0l7SzxmUMcklDspuLF8HeS1UgoQh06ZQPBXhYhXl2OSwVBay+7zZi+AHA6EqCD+twdkgKPs+82V/k2ExkL32Hk78vD7VxHzEUkqW5daxtnDkV4fFm6A/2XF/7r4689xGmWxzmg7UXaIKrUncw3AoNclsrciEN7ioQymdFn1Ls04usKihilj9/mg+X6kT7GSB6fkYQFAAB81UKLuJlabVUEeFpA7Jx0SpRuritXCFoOc27gt53mUyXEEZgM4Bx9xIZ8uHJClww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Onfb94zWxqJho/Mfv+iiob2caQ8fZ4ojY+BibWJWoIE=; b=Vfs+cvMbP9r4ltnkB2l5pXi+PknRMiDuX7PpZMvsQPYryQMSMN/+QJSLTSAjitPzFVTQy3wf1KbUtFaCcSefyEIA3Otv2VgahNWT7uw4Ttghi+L8ob3Aqm/xgVkJIhWIWOiJ8zeaVoI6Wo7mZZmd6P3q90uj8RgAJWfFCR0+4uOH8UvqywbPQiMcCZrMj3XFNufFwbo1PvKeaGccL0KT9uhyyZ9eWS4E5sOUrON4QMoohFhFf155eEpzdpPy+bM8XsalWJBWTxsAat36eY7Um+yS973RNBI4qY/gESFDG4c+UcuRoXCp5gJhGIOnuAoEh0wbUC1nGY66zH4pe8Z5aQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=workonline.africa; dmarc=pass action=none header.from=workonline.africa; dkim=pass header.d=workonline.africa; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=workonline.africa; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Onfb94zWxqJho/Mfv+iiob2caQ8fZ4ojY+BibWJWoIE=; b=HCoPqlyNkIewImG8HSFG4+HiKT0tk+bYBLh/jwsVy6Q192IBOZBUpOUnLngweXp+IKnhTgOdqrWz/KtI3/3Fdxaz+hv9fFnjE0tEPpAnCn1ERbxVcxqT+RpAjZmEJIM6KoHwYDSSgJ5a99OOEXn2qv/BxdzzxLgcADorpZsZ+g0= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=workonline.africa; Received: from AS8P190MB1078.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:2e7::13) by AM5P190MB0292.EURP190.PROD.OUTLOOK.COM (2603:10a6:206:21::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5038.14; Fri, 11 Mar 2022 07:23:15 +0000 Received: from AS8P190MB1078.EURP190.PROD.OUTLOOK.COM ([fe80::c1c0:78a0:e699:848b]) by AS8P190MB1078.EURP190.PROD.OUTLOOK.COM ([fe80::c1c0:78a0:e699:848b%6]) with mapi id 15.20.5038.027; Fri, 11 Mar 2022 07:23:15 +0000 Date: Fri, 11 Mar 2022 09:23:07 +0200 From: Ben Maddison To: Nick Hilliard Cc: "Sriram, Kotikalapudi (Fed)" , "grow@ietf.org" , "sidrops@ietf.org" Message-ID: <20220311072307.gymne3ofnfsrinkc@benm-laptop> References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="u2uyvszxmrvriw2w" Content-Disposition: inline In-Reply-To: X-ClientProxiedBy: CTXP275CA0045.ZAFP275.PROD.OUTLOOK.COM (2603:1086:100:1::33) To AS8P190MB1078.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:2e7::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b3c0b3b7-b801-4625-2131-08da033001e2 X-MS-TrafficTypeDiagnostic: AM5P190MB0292:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: E1k6faCpTFO4246sVHvNCCR2rqbPtrRMmCFtD7ZKWQAtOPBxXcH7pgxCUvWlRdu+1tPBvApqjNgvCy//NWUIZ3+Z+L48OMj+ETMQOwdUM5OH2PboGrLM8IZbjCT0hE585ive3wg/pFS3EASeZyMQpIzCsC0ZTbjtvfOEJ3mFAMYRh+2iiMXa8891aDZ0juBbyryCHLMJPywVs1hl0nROQPiHQ6JGREva8a5NL2EyUxNEkR3cVDgAZBgLpSKlsKbiTgPmqGB+RodKyNjV7G0488SsAYGHUPHX1sVmZfopOvwakI39S/bghGfA018+z2VIql4skgAEHfprVtykwHnXcdpuluoJ6v4GUeDu/jUXufhylqS0dH+3Jw9bDY//fGTS0ZGS0s1gNIUGuFBIYkb/7dBxRJDcAZlamoVRAegQG3FZ9BU8kAuIdPYxpyc5oMf176EkebCbl5BKFe12JYGEETAYh+pbniXQJ1I4imu9ujdznpXD04mDAbCjKZSzrEZ5hqFReWcoZYJ2eHpRw6Nu+3A9DR4keUyA8X1vaf5SN+ASutHt/+wJ7fg4kyskMNCLVPe0yNF1b6Ux+I6mS0L+LIBMrevickS9YahbxKAbj0Ldg+6AT9BSdJqSjT54zl8Lwoj0z8ldT3szGBJ0O2Q6Q9x0V5ltduZeV+QuTAHGxISmgSReXNvxwTKpl70rQwM2x4RFuuqcjgl6VWvCTFLjvIRrIaSm/vW+wDtGbBLLlSQe6RGM/JZCysjrL/vXP/m/ X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AS8P190MB1078.EURP190.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230001)(7916004)(366004)(346002)(52116002)(44144004)(38100700002)(38350700002)(83380400001)(6506007)(9686003)(6512007)(8936002)(5660300002)(33716001)(2906002)(6666004)(66946007)(66556008)(66476007)(6486002)(508600001)(1076003)(26005)(186003)(21480400003)(54906003)(6916009)(8676002)(4326008)(86362001)(46492015)(2700100001); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Sj+H+dIPB/RQcJPyDVh0JEp8dlOVbxi1/2/k2xbC4IUuZnJuThkOPqB2CvQQ?= =?us-ascii?Q?DuCYEwBudSb277GcYFBuy1hGY0Ej6xyi+jT+kdSYE8twPLbVy/qR/3bnR/kM?= =?us-ascii?Q?5oMxRyOag6XVVloyzdrC9IUXZrgTNImbYabIIFdZSkn1mSkDVeCEg1peeYD5?= =?us-ascii?Q?Ri63H9uYsiZoSjFqRuH3J0A/pZ6gITDp5HE5uLPhzMn65XI8dtcCjDfm2saq?= =?us-ascii?Q?R2KtHXNJPemYwFsmMrym5DBegNuS2ALRIs30qx1IZ/tNTvXu7ly3Tfc+Ef2c?= =?us-ascii?Q?T1lH60vmCM+s6sNjNS5lriEWDGgXj3Osd8dcg0ob9HaTOjy8vKaU1OBYs1wo?= =?us-ascii?Q?F5k+1wdsNV5jjHiFZpeE1KyVz/g2CWLaYh2O/m81yc7qw532oO9MH3OquiM3?= =?us-ascii?Q?oVWjYhxR8KhKbJ4jDckowl50v0/hsYFCQBc56H/2Co108hrzc0wkmjHWImhF?= =?us-ascii?Q?CkrZ9SWEzSM2me8Sh/AAQG1a6x0QrmyX/cTgPqgOk9LBIc6QZ/u+faxq0hzO?= =?us-ascii?Q?3EV+2Kjl5zCIq/8+fL/ebe6MJDE1S//R0ELeYQjL1IqYu2aoKENBeKEMXMwQ?= =?us-ascii?Q?+aXalAyzujGmu6gdzwRdEO2vvK7AlPlg5a87MbO/nOcA+hKQNKZIcLNV5Fu7?= =?us-ascii?Q?2PpVxLxk3iyviIyAkOTPrCWlcg/28Mo8jq/vZTZPXLxYvQyYtTXJUZ8MI1NC?= =?us-ascii?Q?JQaK1ttIDxQ3EyYpVfeOrW4c4Lc3ZYWs/oLAQGZh6ZURFU5PlZSbqkETt1n1?= =?us-ascii?Q?eL5XrHYVEdmTHTHXeP2FbCn4G9S45Lq7yv+ZQlc2JNl/1E4HYdFFas71YGyW?= =?us-ascii?Q?v0PQDF0Gi5gfahtDON1J8BSf2RgaMKxPc3gdedVTfJW2aTYZEXGsYN4FjGIy?= =?us-ascii?Q?twgvpz1K0xgYF97MiQmJrlnjD0Ux/D4CIaFRfTPBe/Vd1JK6AX6K10Oc2jCn?= =?us-ascii?Q?mGzQCrI1XmJNz7oPdqW/xrEql6yh7ce285Qgy2AU/XOE0PuBqQ6u1EoLnfHz?= =?us-ascii?Q?mpX3mDnlvuXynJSVSRoqWzACT/2U0VAkNgucqnzkIMHg8ARxMc5L12PN3ZVU?= =?us-ascii?Q?XX7lUsU8OxlqFlytsLX2ac/xpK3DrdA3HX/YF+UVI0YXQvKD4SKdKMK/kJ0/?= =?us-ascii?Q?SKdFm8v+H2jtO4MhztPlk5DUna7WAorTCK7uXRkmSpEM5yZxIbE0mM0HBQg2?= =?us-ascii?Q?PlEgdb4wrYF/tLeNXu7r2BUq93OjGSP67/wJzlps2YcuozUlcLnMVrnXsS/W?= =?us-ascii?Q?T78hTKyH8tSSg6Pj5iSj/e0C2Ll4lScttxDFKPFzS+4+ABRQx/mdUCSz5c2J?= =?us-ascii?Q?ASnqNXCmZjJq6OMY9l2fn0puHpfZwz7PeRjgDTfx8Rl/gyf2ozzRgw20h9qt?= =?us-ascii?Q?VqavKf54GicrgOGRKIgCWat8I+W/F2OYVmzaAmTs6SzNyEQvvj/W8Y602N/V?= =?us-ascii?Q?nWDrzo7YXLILLEo0QQ/YjsG1UNCtlx8EfymtbO+sBLq0bRYi5iIsbeWJvgfv?= =?us-ascii?Q?W7AalJv/DQQ9sC+utS/ARm7nj3tPCya9RRwkcmbaatbGJbnk8gSElZ7aBewd?= =?us-ascii?Q?7M73VhKi2r2JnBhJA0owoe8kx+Y0MAh6wYlXUd59li1sa1xDTiURgMyRCnXY?= =?us-ascii?Q?kNpDnGQlPrgTnZ/C9e0uaiY=3D?= X-OriginatorOrg: workonline.africa X-MS-Exchange-CrossTenant-Network-Message-Id: b3c0b3b7-b801-4625-2131-08da033001e2 X-MS-Exchange-CrossTenant-AuthSource: AS8P190MB1078.EURP190.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2022 07:23:15.4068 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: b4e811d5-95e8-453a-b640-0fba8d3b9ef7 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 67rgi3NNQKfVLaUxLkyKlDvPpDuhcypisAfsiz1sLo9Db02skEep54MleEHBadYJG4lP5059ttQlFemk23rY/Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5P190MB0292 Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Mar 2022 07:23:30 -0000 --u2uyvszxmrvriw2w Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi Sriram, On 03/10, Nick Hilliard wrote: > Sriram, Kotikalapudi (Fed) wrote on 10/03/2022 03:31: [...] > > The ASPA verification draft treats the relationship of RS to > > RS-client as similar to that of Provider to Customer. Seems > > reasonable? The AS of an RS client includes the RS's AS in its ASPA > > as a "Provider". >=20 > yes, this is reasonable. >=20 Essential, I would think: how could a far end relying party know that an AS in the middle of a received AS_PATH is a non-transparent IXP RS in order to apply any other treatment? A special mark in the ASPA itself perhaps, but yuk ;-) Cheers, Ben --u2uyvszxmrvriw2w Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEadkaB2uV5dm5UllaOkYk/rSLaGAFAmIq+NsACgkQOkYk/rSL aGATCQ/+PbybgFh+7tgI01mYtT2g2qWe8GRry2bI0cWE1SGk8OXCOkd5AAHYCx4U ejMxpjg0Npk8wec/Ew8NECUhZmb/KpldZ70MtZtWymVaZZ6LEf8M3EKYS7D2aRM/ 2zG1Oi0scVxOTgGcP7LFJKWkYpluYbxAh+4bNCjC1Bls3/IsrxxaXJNulViFOYnX 2AJVrBkGZUup16RceV6l1O+zRxE89swAjljKCvn8g/+0xFOmkY9saqrENMM/xKSG fvx0cp82vOvaXMxIh5ZGN/ye4xSGVakmeGd5z4PC9QayXr4r4T9g2vlaEVmwEDt9 vh1nMzESe5nMCdVBmN8MR/GmyWrZjY9N4mMFrs8XaHqnzvjvMCSf2IdWaXz0egAv 7iwQMv3XqFJ8yLlv7/JM1ZpBmcRAPYFQ8KpEUXQqBN6cNt3SHgqqV8XDVpzkPFWH f9crtw840dXyiHRC0xAiWjCRphIQbTECC9cqIrX3p3BbD5qkXSgJIZlNYPHFzjvM wFgOfrTL0I3pG5MJyXDYvc3wvC3FfTtcDQM3Urdq6vK8b7SzkOrnIGjpvJYoyBuE SZPVrX79oh9z4DN5F6jtjVPgfuk3enfcOdQUwwFFML/cxN/piFg0Un7eAalQ0auB Nmf+NiiR9j/1WISmjWmcWuICha4pPfEz36ppDl5En6DY7zluP0M= =uBWs -----END PGP SIGNATURE----- --u2uyvszxmrvriw2w-- From nobody Fri Mar 11 08:20:55 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FF853A040B; Fri, 11 Mar 2022 08:20:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.113 X-Spam-Level: X-Spam-Status: No, score=-2.113 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E4C7dxeXfpyV; Fri, 11 Mar 2022 08:20:42 -0800 (PST) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on20714.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::714]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 626073A05F0; Fri, 11 Mar 2022 08:20:41 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WOp0wUaFyYlcwrkqFz8XGi1acCsVDjnXEHg+RZGNLQTv09dTc0p8y672QGFcqVK+SXE7SIRWjEFsFxQelrL1IQ709s8EObs3z0morQ6JdTSHA5K44KLuyfnDLJA71H8GD/sRqs/hZDXvNgCGIYNCTaTwwfRTyDjjJmgXJRSuw91aLOExCSS6n/A9aB/F1qDg/hCbAIznnZlZ4Ar2DKhH1g2buYPYMe2uWWDaqCJiPXv1yyaeC6gibSpuJWszC1P5VMaEOZdKBENlSvuMUwlOpiQW9iG3e9Bs+FHEDMLsxzTj1orbfti3/FyfB+Quz5LCyVNlDPMzSFpY9Vhe0IvkXg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IXTALoJndkd88IiYeucV2XZo0Ia28PvkvC5Dg4mfRGM=; b=KZczXiK4c0Rdja7ZaZzteAp028OBuOBYoWpWr54OX5oQ0e5HAEpp5AYRIQ1yxaE2dGIQjh/eTm7r8k+66INlYWjGZsh4TRPnwIz5tBt8sCRNEoLd4RtEyu0P5YRJ4ldl2+GPiDMCoVaYe/CiU1wzCLVOygh6GOAF1epAwIsaMESOAQ+MPsiEhrLWeevWozKlLDpRGQ427567wK8wnjslB7ytcNbteFfNghSo1iKjR7ctZTQ0YcsfXTTXcszQLx06lY4F8fat/AqsmudRvKCqWsi0qt4k4dsp4Zxq+ekEjCovjmPNzJEVdUJOQHQ9dLehnliB6y5/mtdfb7oBBjo2pw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IXTALoJndkd88IiYeucV2XZo0Ia28PvkvC5Dg4mfRGM=; b=Gws9mBsfvDBjzTh0liwPq8COhDVmFsKuwePbRZxw4bQreMMRG+Lesy2gYl/yPU+tLTND03CSh+wxrDYBPb4bj9TYSspNXqNxOYhGZXX5QHHT+PTafF80qYsoY4+pSFBGgtTrg8zm/H7CZjqI84ycQ4Stbf6vCvPc5jRaGs/qmDA= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SA1PR09MB8574.namprd09.prod.outlook.com (2603:10b6:806:178::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5061.22; Fri, 11 Mar 2022 16:20:38 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5061.022; Fri, 11 Mar 2022 16:20:38 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Ben Maddison , Nick Hilliard CC: "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: [GROW] IXP Route Server question Thread-Index: AdgzI9AepbPeSUXIRROpCLpxuIKvkgAD5f2AAD5dAsAAKdbBgAARKN2AABKr2JA= Date: Fri, 11 Mar 2022 16:20:38 +0000 Message-ID: References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> <20220311072307.gymne3ofnfsrinkc@benm-laptop> In-Reply-To: <20220311072307.gymne3ofnfsrinkc@benm-laptop> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1711f5db-1cc2-45b7-b97e-08da037b1467 x-ms-traffictypediagnostic: SA1PR09MB8574:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: GX+Lbvdz8m60EKsMgPyeLbe4ol5lklp+eqODiLKRIGhy8Q0RcIB8lXVfEiqasyC2VeJoanT049r3tV+X3cvi10t0W0qawCj3NVBGO4k9eT0V1blCD0VVaZJLshtYW/NhbqfGM/pCv0M34f5bLdckV7HiWp4NameZvbFTkcQYG9xN2HvaJBtVkStjYyVJv73nRbAf+56Q6RzaYS0bFR1GmdDF0eVknkRmiOGJGH8ITDGjmWXcY5Zs05uP0WV7AeyXOy22MiUQLdDGtUx+O2XNGQSVJfzQDXTTNVJyPnKJmdzdS4y4LYn2ai07g5Ljeaugv9maE51QJ51e5g2LYkDoOHSfVdfyTHauyB2W+uhTR+RGwMdwTIhx0XQgn+fYseSILVK/UD+ZYDiYCVa9u1sDZW2bv9ui7PrL3mkA0r8yXkkk/Vyc/ony2DrkfDDEXTXKy54k6Rlk0pwmk6NePOr7jZSgeBqJqEyoDXVV9WBYR+qPt1SnNcjmAmxxfCSOyEnyFR8OPJt/7zO6M6WBU81K5aoZZq7EBu48J5PZeJGcq8NDwXjKfet0qwtwNUv/IrxLaxH97UqFhPrE/22bBthTV9VroTDMmoa4u81mTDl7A1hFw1lKaOERmK47ZPliOrDjrgcyMx+H+ZtWpiI4H9W1ZL3J8Y/3lhgYmPAijs1sGqK4gS2ehkFpyfQt4ygzR+Bpm7jvWeUf9vqcIbTydBjsyg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(71200400001)(7696005)(6506007)(53546011)(83380400001)(86362001)(5660300002)(33656002)(316002)(54906003)(110136005)(76116006)(26005)(4744005)(186003)(38070700005)(55016003)(9686003)(8936002)(2906002)(82960400001)(122000001)(4326008)(66946007)(8676002)(64756008)(52536014)(66476007)(66446008)(66556008)(38100700002)(508600001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?KbTFbVkVrD9M9ya179/nN0D9AWghZXvbzEYAxRKzbnwBDH3wrACNBPR19tCf?= =?us-ascii?Q?b0pXJsUVpP7KO15Mcfy9iQvKlB8YcQEtdR9GfEn5co+TPq8w/HLq9ojXh9Yn?= =?us-ascii?Q?MGiKjSWHN+F2LyVVx/J5LrJ0pq5RUS20+SHS1JtUHKZ5+t3h9mUwdHU+4B9D?= =?us-ascii?Q?oyLykAk3OsBIkhRz6CpJ+j2F3vxw4QoN6uZQXbnCc4nkjmzzFMMWmfY8sSQm?= =?us-ascii?Q?cXB3vygm5vSZZ434tve17Jfuodp7QzFDAVp25P7TRHEQ916OeIFYNHVQVHSA?= =?us-ascii?Q?xbWZqmwsfE+WS4gY382wf09mKrWceCqEcI5xd2/7d0sEAYlF3tRq9B1GOctM?= =?us-ascii?Q?x8oPLQ581J1wqRpaPkC9TJFae52SxvKC7J0ZGEKvlKuiI56RLbZBitBaR8pA?= =?us-ascii?Q?C7dAqtJjHdI93tthgCW7cF4NZw10AaCDrZJ1fNVSXyiUjzCs7X2MxLA1+OPa?= =?us-ascii?Q?SM1U3gSmQqHHkq8BvcvMsreSj4oNNIssZwmjw4Lqs0rzZCkyAfCtPtet0GtC?= =?us-ascii?Q?4LsX3mw9PjClcc8+/KHV0IXjygr6NmNVxQ0DGmi6yF2NBJPhJ/fkOvqlCUJs?= =?us-ascii?Q?hANcMujFrmeTuRadyfO3LVTUOLsco3u9gKnWmONq0cFgcvU7gNbdUsAEi307?= =?us-ascii?Q?dWchpA/fBhX7Fpuok7Jqm8JIX86SXTtiw4Yjx/RIW9Ak5kbGOSTLeKjhYwQH?= =?us-ascii?Q?ALNQ7a8fwGVZuJ7NBltJ5hRMSL2Icg+NYKBWwsS2/vl9f6jrAfN/rR30vAQw?= =?us-ascii?Q?fqWB9ufjhH5vjenHBZkDYt9prUizFW5uxcVo3ZzhUsBlr12SxXLK6Qt+yGoI?= =?us-ascii?Q?VblhQgwUV8+FzCV02DnOwk7PHKhFRRSq5+wv3VJYTGMuqpnsYVywFqm9u8Dx?= =?us-ascii?Q?ecozDQ789xrVzdIw6OX4qlSgUJlXbWMMYaJTrFLSHpH9Hd2By0BULSxQoanB?= =?us-ascii?Q?FUys+9VFA6EUo/AXZcCq0YMZ8e4E3g6NbESuVxvHJLxkCL50rX9kbuvlD7eO?= =?us-ascii?Q?Ca7fbYtM88JT7Pw1wqgFj8WMiIAwdBZOZcpokLI+cnJ6VBJswLYEKglgGdUB?= =?us-ascii?Q?Qz3BtdM6s607hlNOmZBc+Z6bNhDwkROBoUrgwLFDmNFd/KwwvvFdgBLNIVqK?= =?us-ascii?Q?6TIE2FrX24fIAG8xr85Oq/W0uW3igVmYcvWkcWoyweGn2AZdJMzV1o5SgaCt?= =?us-ascii?Q?lB2c3gCaajqCefvHDImiVaNg1R0Ksuuods55xTzrDHSYQEj5BK07BPtJ0cTG?= =?us-ascii?Q?lJ12lAU0DCpLU6/1G4pbgfjsBpqbCbV2JnxNqt8C3DkCKGqbE17YrSQynwLN?= =?us-ascii?Q?GrJCtrXflDx1WJY7eWu6Cc7ftaXfReCdBkr2fKM40wLUAKKa24qSzidy0Qgx?= =?us-ascii?Q?a5YGZXC0N6FTg+kMU2T9uiIxUIqoqeNIufsb2aqR0KhQDIalh656mvAw69p6?= =?us-ascii?Q?auUl2/w+psA=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1711f5db-1cc2-45b7-b97e-08da037b1467 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Mar 2022 16:20:38.3299 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR09MB8574 Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Mar 2022 16:20:48 -0000 Sounds good. Thank you so much for the discussions and info. Sriram=20 -----Original Message----- From: Ben Maddison =20 Sent: Friday, March 11, 2022 2:23 AM To: Nick Hilliard Cc: Sriram, Kotikalapudi (Fed) ; grow@ietf.or= g; sidrops@ietf.org Subject: Re: [GROW] IXP Route Server question Hi Sriram, On 03/10, Nick Hilliard wrote: > Sriram, Kotikalapudi (Fed) wrote on 10/03/2022 03:31: [...] > > The ASPA verification draft treats the relationship of RS to=20 > > RS-client as similar to that of Provider to Customer. Seems=20 > > reasonable? The AS of an RS client includes the RS's AS in its ASPA=20 > > as a "Provider". >=20 > yes, this is reasonable. >=20 Essential, I would think: how could a far end relying party know that an AS= in the middle of a received AS_PATH is a non-transparent IXP RS in order t= o apply any other treatment? A special mark in the ASPA itself perhaps, but yuk ;-) Cheers, Ben From nobody Fri Mar 11 17:44:16 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90FBF3A0D31; Fri, 11 Mar 2022 17:43:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.906 X-Spam-Level: X-Spam-Status: No, score=-1.906 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qNBsrWatpIJR; Fri, 11 Mar 2022 17:43:26 -0800 (PST) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22DAA3A0D3E; Fri, 11 Mar 2022 17:43:26 -0800 (PST) Received: from fraeml703-chm.china.huawei.com (unknown [172.18.147.206]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4KFlsH0vv1z67ZTx; Sat, 12 Mar 2022 09:41:55 +0800 (CST) Received: from kwepeml500004.china.huawei.com (7.221.188.141) by fraeml703-chm.china.huawei.com (10.206.15.52) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2308.21; Sat, 12 Mar 2022 02:43:20 +0100 Received: from kwepeml500004.china.huawei.com (7.221.188.141) by kwepeml500004.china.huawei.com (7.221.188.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.21; Sat, 12 Mar 2022 09:43:19 +0800 Received: from kwepeml500004.china.huawei.com ([7.221.188.141]) by kwepeml500004.china.huawei.com ([7.221.188.141]) with mapi id 15.01.2308.021; Sat, 12 Mar 2022 09:43:19 +0800 From: Zhuangshunwan To: "Sriram, Kotikalapudi (Fed)" , Nick Hilliard CC: "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: [GROW] IXP Route Server question Thread-Index: AdgzI9AepbPeSUXIRROpCLpxuIKvkgAD5f2AAD5dAsAAYRU1MA== Date: Sat, 12 Mar 2022 01:43:19 +0000 Message-ID: <82b678f2254b42fabe3bfbcef4b8d28c@huawei.com> References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.108.152.178] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Mar 2022 01:43:31 -0000 Hi Sriram, > The ASPA verification draft treats the relationship of RS to RS-client as= similar > to that of Provider to Customer. Seems reasonable? The AS of an RS client > includes the RS's AS in its ASPA as a "Provider". > IMO, the ASPA verification draft regards the relationship between RS and RS= -client as "peer-to-peer", maybe my understanding is wrong, I will read the= ASPA verification draft again. BR, Shunwan > -----Original Message----- > From: GROW [mailto:grow-bounces@ietf.org] On Behalf Of Sriram, > Kotikalapudi (Fed) > Sent: Thursday, March 10, 2022 11:31 AM > To: Nick Hilliard > Cc: grow@ietf.org; sidrops@ietf.org > Subject: Re: [GROW] IXP Route Server question >=20 > Nick and all, >=20 > Thank you. What you all shared/discussed is very useful info. >=20 > >Almost all RS's are transparent these days. Usually IXPs go to lengths = to > ensure that the RS ASN doesn't appear in the AS path. >=20 > Good to know that. Well, that means there can be an occasional RS that is > non-transparent. When there is a non-transparent RS, could there be big I= SPs > (Tier-1, Tier-2) present there as RS-clients? >=20 > The ASPA verification draft treats the relationship of RS to RS-client as= similar > to that of Provider to Customer. Seems reasonable? The AS of an RS client > includes the RS's AS in its ASPA as a "Provider". >=20 > Sriram >=20 > -----Original Message----- > From: Nick Hilliard > Sent: Tuesday, March 8, 2022 4:28 PM > To: Sriram, Kotikalapudi (Fed) > Cc: grow@ietf.org; sidrops@ietf.org > Subject: Re: [GROW] IXP Route Server question >=20 > Sriram, Kotikalapudi (Fed) wrote on 08/03/2022 19:36: > > This question has relevance to the ASPA method for route leak > > detection. > > > > Is it possible that an ISP AS A peers with a customer AS C via a > > non-transparent IXP AS B? > > IOW, the AS path in routes propagated by the ISP A for customer C's > > prefixes looks like this: A B C. > > I.e., can the AS of a non-transparent IXP/RS appear in an AS path in > > the middle between an ISP and its customer? >=20 > Almost all RS's are transparent these days. Usually IXPs go to lengths t= o > ensure that the RS ASN doesn't appear in the AS path. >=20 > Some organisations provide transit over IXPs, but it's a minority thing. > It would be very peculiar if an organisation provided transit over an IXP= via > an RS. >=20 > Some organisations provide transit to ASNs over a direct physical connect= ion > while maintain peering with their customer over an IXP port. > Usually this happens by accident, but occasionally it can happen by desig= n. >=20 > The answer to your question is that it would be technically possible, but= it > would be so peculiar and stupid that it should be considered a mistake in= the > situations where it was intentional. In all other situations, it would be= a leak. > Generally it would be safe to assume that this sort of configuration was = in > error. >=20 > Nick > _______________________________________________ > GROW mailing list > GROW@ietf.org > https://www.ietf.org/mailman/listinfo/grow From nobody Sat Mar 12 14:00:34 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA0703A1051; Sat, 12 Mar 2022 13:59:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id voeaVzGcz04h; Sat, 12 Mar 2022 13:59:37 -0800 (PST) Received: from mail.netability.ie (mail.netability.ie [46.182.8.5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2E8E3A1047; Sat, 12 Mar 2022 13:59:33 -0800 (PST) Received: from crumpet.local (admin.ibn.ie [46.182.8.8]) by mail.netability.ie (Postfix) with ESMTPSA id 9FE4D9CC3B; Sat, 12 Mar 2022 21:59:29 +0000 (GMT) To: Ben Maddison Cc: "Sriram, Kotikalapudi (Fed)" , "grow@ietf.org" , "sidrops@ietf.org" References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> <20220311072307.gymne3ofnfsrinkc@benm-laptop> From: Nick Hilliard Message-ID: <517ea9bd-4ee1-44cb-3373-eb0552191b2b@foobar.org> Date: Sat, 12 Mar 2022 21:59:28 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:52.0) Gecko/20100101 PostboxApp/7.0.54 MIME-Version: 1.0 In-Reply-To: <20220311072307.gymne3ofnfsrinkc@benm-laptop> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Mar 2022 21:59:42 -0000 Ben Maddison wrote on 11/03/2022 07:23: > Essential, I would think: how could a far end relying party know that an > AS in the middle of a received AS_PATH is a non-transparent IXP RS in > order to apply any other treatment? given that they're a shrinking rarity, would it not make sense to completely exclude non-transparent RSs from the ASPA definition? In the short term this would cause problems for ASNs which connect to non-transparent RSs, but there are hardly any left, and only one sizeable one. I wonder whether it's a good idea to design a long term security mechanism which includes a specific carve-out for a legacy corner case like this. Nick From nobody Sat Mar 12 14:41:39 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EF7C3A0863; Sat, 12 Mar 2022 14:41:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jTc_I2cZyUHh; Sat, 12 Mar 2022 14:41:34 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D1543A085E; Sat, 12 Mar 2022 14:41:33 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nTAQT-000DLs-DH; Sat, 12 Mar 2022 22:41:29 +0000 Date: Sat, 12 Mar 2022 14:41:28 -0800 Message-ID: From: Randy Bush To: Nick Hilliard Cc: GMO Crops , SIDR Operations WG In-Reply-To: <517ea9bd-4ee1-44cb-3373-eb0552191b2b@foobar.org> References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> <20220311072307.gymne3ofnfsrinkc@benm-laptop> <517ea9bd-4ee1-44cb-3373-eb0552191b2b@foobar.org> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Mar 2022 22:41:37 -0000 > given that they're a shrinking rarity, would it not make sense to > completely exclude non-transparent RSs from the ASPA definition? In > the short term this would cause problems for ASNs which connect to > non-transparent RSs, but there are hardly any left, and only one > sizeable one. > > I wonder whether it's a good idea to design a long term security > mechanism which includes a specific carve-out for a legacy corner case > like this. i do not wonder about adding complexity to specs and code in a security application. i know it's a bad idea. randy From nobody Sun Mar 13 09:20:31 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B0993A0D7E; Sun, 13 Mar 2022 09:20:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oiEB-f_ec6ZV; Sun, 13 Mar 2022 09:20:09 -0700 (PDT) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on2071a.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::71a]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5A0B3A0D77; Sun, 13 Mar 2022 09:20:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ikzyqBbWDHTeC66dKERdZahrcZv8ZH7GTk/u8bXTDChrjgLskLQobdpw8+/JXJSksJmcquqFPDC0LQ13ode+g4oo5zywWTSMPBQug0JvFrEgnt8D8Ch8Tu0UbtC1XNzGJN9DvKwd7Up6N+c3ivDNg17fG/2ploDiXHlChYrlXCp7e1ZWg0MsUdrGd3wuqwqjzl+lTENh/ZkggpjVtTbwc5j9WV+FVwGjHYBQ9OB1tMuQGcM6AerQ1HbqiFp9Y8T3H7OP6oghKiEiajlG6GvHCIUCTJU4Sg12TcPk/vvVPo2XfY1S0vrOSW0SJ+h8QvIkQFe5jGWlymxWQ4RwZzm5RA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=E3B18YyePMx3lultaVjOnRQ/j1CHaWT1lJ/ivAABSX0=; b=GpIiENl5NEyKmBS4cwXvUUF9k3t2MUFEWcE7qOhu991wkhFHAdBCJrDH1X+OxqbL53gbeEmjRavm8AKm/zzWHRszMGAPTMPKaVZxrqdgMPWqXlbdpNGdyZVth5VqVnTyKtcePFGmmljtAZuqWGxRWrCUgiqGazmjqY6YwKf1MtcO9+tLqJ0PUEjDiYiwpWObLLzIKOh2hLolpd571XwCeL5gtpIYzOmymvW8sj/stXPKsieLmFvXFlCSux4wDwdbvyRi7EslE8N/ON1y7jOL9sWWT0tpjqkQpypvpKWiF8VGUi+RRlhSSIwt47K3YC80igQqnxystedHLj+urS7R1A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=E3B18YyePMx3lultaVjOnRQ/j1CHaWT1lJ/ivAABSX0=; b=ZXBp0KDntMPcD9hUQrXLFDDWO6xsxOKI22V5emOp6OhanPP1NQD5HFwPb5w0G6x4PrXJS7XvVuxSZ+Qd8mV9ayIPxJI77HoVwrmaznPpnGHj4SkZlDEBgXXQXmMkFvqwzd9+zytO+rkYcZUHV/vAnTnLJHp2S7VZllRvbtQBC28= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SA1PR09MB7806.namprd09.prod.outlook.com (2603:10b6:806:17d::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5061.21; Sun, 13 Mar 2022 16:20:02 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5061.026; Sun, 13 Mar 2022 16:20:02 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Nick Hilliard , Ben Maddison CC: "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: [GROW] IXP Route Server question Thread-Index: AdgzI9AepbPeSUXIRROpCLpxuIKvkgAD5f2AAD5dAsAAKdbBgAARKN2AAFDlyAAAJHTCoA== Date: Sun, 13 Mar 2022 16:20:02 +0000 Message-ID: References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> <20220311072307.gymne3ofnfsrinkc@benm-laptop> <517ea9bd-4ee1-44cb-3373-eb0552191b2b@foobar.org> In-Reply-To: <517ea9bd-4ee1-44cb-3373-eb0552191b2b@foobar.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a5f3ad07-626e-4433-db2c-08da050d53e0 x-ms-traffictypediagnostic: SA1PR09MB7806:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Dhp52VAu9eKDUXlwsbNIQt3p3KIodRgsiSRAiXflHVkPpqsaciGbzZ8djBf327wzY0HeSJKLEYUyFhcVfwXUh6zHlL2yuk40fVqOjhFP1Ga4iWEmcDAZOuwYCjmOzj3OAE1IscYK+ZV1HJ7LLEMT3jmR0AvfgfI88QBDBWvHjCBy/PRlvitzL8VHi4aQ/ppNXstbyva39EfF3umIMRaBUpWMzr1rL0KYFrat1d65cqX+YICYTgxmyAOYL46UJV8tg465iEEZGqQMZEEvUCxFpMo3KCbQCDtcGYq4JE4q3gx38AbrQsP49x+rYGE1rpcetlJCs7/GnQ/W69ekLuv0U+M8+/CQkYp+Owii8rCZq49l0YBr2G1b8eh3dbgLbMe3baMVZ+yoHifP+x/bkaau161CGvIOK0afDPAgRVY7i3WoD9MMHcj9oP9pt5fehytRCaBgSg1zHGg9IcYP55N9F69N8hFWNDyLBeL7TfS9NXwzBvUaM8lf0oEX2uiDd0VaLLpgYkA4EHF8VxZWUF53kAOGArOTJBpMX8s8cFMuSwwxqds8phDJ7OVECoZrraE0WeMwxTEm5ru83X+ap1TSIMON2i4oRltwRmFD4Jztr72L0uzQzqL7mSSws1Poh1O+84KwPZuV388pjR5zrqKNPR0GFY2lKyuTZ5y0PxoxysouzeXf/iUQvqI2f4ePzzDcXFP6Vec7U/UUI8NEhhQBlg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(54906003)(71200400001)(110136005)(186003)(83380400001)(26005)(508600001)(33656002)(66556008)(4326008)(76116006)(8936002)(38070700005)(5660300002)(86362001)(82960400001)(66476007)(66446008)(64756008)(122000001)(8676002)(66946007)(316002)(9686003)(7696005)(2906002)(6506007)(38100700002)(52536014)(55016003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?Ze/sskyEHhwejk+tbyxVCcx8Hpjv8vs1SHdlxsunpYsh7y+D21BpXML/ovZF?= =?us-ascii?Q?u5bnGqXBs66VtyGEFIceiUaF+HQ6NUakNY2cs2XFyZsoyStFIepjGx1NILaw?= =?us-ascii?Q?ssyvW1jsTNyYq5ON0twaUOavyyxlevxxFcC6amC1lS0jCRy36DZ5YObN3x/x?= =?us-ascii?Q?RmwGYl5+ed2OCvha6APeggRyLAWZyNhnJrVo7ycafSXTo0Vi+fA44ko88r2P?= =?us-ascii?Q?v7hiiMIeKvc5DWVAJ9h8xMQakQ2WoeWElK+aKMGa35QmH3YUsjXrSqSkk0J3?= =?us-ascii?Q?PgbcBpTvXUOq+yKL4XrI901fjWI+3XGUlr+vPRXK1krKRyCO1B6mQlpYAhoI?= =?us-ascii?Q?swQTRWW5b2vDSj9RXLrwzmoO+WfWI7W8/djnCXneyaO36gl/HNS5hI4aLkBw?= =?us-ascii?Q?r/jfC5G9iFnHGTiwBHgIcWLhtCTNZNb0ecDzJEZ2fQVAJwV47HWJSwO+pek9?= =?us-ascii?Q?ycXohxDk3MQQgDfjmkFjXzPT54Ys9VAmkjFpXAO6uGWLYhUwhf7C+JOCltPn?= =?us-ascii?Q?I9+F9uCcX+joZOI1xRrFvFVljuGO1nOTsSSwkuezn6JcgvIaDI6KIt7bQ/eV?= =?us-ascii?Q?KjcLDu/bcaG0DYG0VeIMOqTCG444hjMH91sukM7u9hPHN+dQFpprYZwEnl1T?= =?us-ascii?Q?gzAxKZhq7BTKdWsUsyFp579/CO7PQvwc9qBR1BzPThTYamcf+IrSBC0PSy1T?= =?us-ascii?Q?DLi0eJbReXAQVeLIBRG+a5yBcTsx6b632YUvNVyBUAHP/3E5qWgWkau2EUyt?= =?us-ascii?Q?gobm6xoiehFNaL2+K1Vn7cITrran5Z299fpit05mogyIecWJnevoOrIpDvqK?= =?us-ascii?Q?c3r59vNfyGlccrC2lA5/iAdkC/ctGhrqutOviS92rshfCvexRc+3zykaNngR?= =?us-ascii?Q?iveH8j/PASkXvS1O41CBcXO9QKmE4FiL4/h1+8dM20sCPLc5OpnhP71prcnw?= =?us-ascii?Q?kchkp3quiPmiCU+zIoWOx0jITrnfGi+qufet1a5dhV9ODu2OWCLOhvPnc+le?= =?us-ascii?Q?3IPF0bs8NxXhBtmFpM2DDkX1oucxMmdn9QMTWM26snl90tl5DGq5uVv7TsZ8?= =?us-ascii?Q?gSf3rhzug0ZkvUKkU9f3UX3vanp+2bwCo6c093+R6WnySVXSWpYz2/MDChri?= =?us-ascii?Q?bYOAzwCeaSMO+wZ6npNC9BhXHkM574fua7j7iUwOikov267seTyvDw8DayXN?= =?us-ascii?Q?q6Cr+Y86N3exeTu8L7qleiAAX62iMd66frletm5m4eoeZ0D0oHC06LiWCF4t?= =?us-ascii?Q?yBIxW0JJD0etAPVd997tjIJJDtb4cJhBPI+Y8uW18TAL7n4TUYRTLATqo5n5?= =?us-ascii?Q?WVtuCcVQDK3CVagoMSEvmBZg161RUobrZPXdQMI6/f9esGkqsycpET5fVChN?= =?us-ascii?Q?jgcq5SiiPKotTQsrmBkYzonge6M8InpJOfghlueQFMwS/1+mJ9M6ZTzTFEvu?= =?us-ascii?Q?Fh13rCt3ZFg=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: a5f3ad07-626e-4433-db2c-08da050d53e0 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Mar 2022 16:20:02.5210 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR09MB7806 Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Mar 2022 16:20:14 -0000 Nick, >Ben Maddison wrote on 11/03/2022 07:23: >> Essential, I would think: how could a far end relying party know that=20 >> an AS in the middle of a received AS_PATH is a non-transparent IXP RS=20 >> in order to apply any other treatment? >given that they're a shrinking rarity, would it not make sense to complete= ly exclude non-transparent RSs from the ASPA definition? In the short term = this would cause problems for ASNs which connect to non-transparent RSs, bu= t there are hardly any left, and only one sizeable one. >I wonder whether it's a good idea to design a long term security mechanism= which includes a specific carve-out for a legacy corner case like this. Not sure why Ben even raised that question. To me, it doesn't seem relevant= . In the route leak detection procedures, the receiving/validating AS does = not require information about the nature of ASes (RS or not RS) in the AS P= ath except for the sending/neighbor AS which it knows to be an RS in case i= t knows itself to be an RS-client. The procedures rely only on ASPA objects= for the origin AS and ASes in the middle.=20 Sriram =20 From nobody Sun Mar 13 09:45:51 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E5773A0E5B; Sun, 13 Mar 2022 09:45:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QQFz2MRuEumM; Sun, 13 Mar 2022 09:44:58 -0700 (PDT) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on20726.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::726]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0620F3A0E4E; Sun, 13 Mar 2022 09:44:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FZXseVVssngLAto5asKd024FhHeRwkDh6Wc6iL96gcGBUmlbff2VI4hiKyPTxFxd22P4jZDzZCMSOPEr8vNFG+enWSTx2TCvVOSRjC5L3m7rKbSDCd7sjTJywtMCRu3miygbui1hacEp+Xk5PYEAXFDNrJYxWv0jlLqDVkiboaUxHgoaeUUakZ+BChDpaadd2QoDaoMUOIT0Tfeyv+LIA3uzsQY2cSuVmXjicYktVqZG96/NeYYSJ1B5Actaq28fXmpPSHR3wKMaI1Spp8zA8QriVcD1njrhJRwnlvveQLtWNAsPFocXx7q9hLVzu+xaedDSbputfpDjB4JB2V9y8Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OjKGpLiwfdEj3hpDKHPHCGDLQ0jVoTlSiqyVkPfi7LE=; b=Srr3Gp6EGj/gTGJoAP9Qb0YVHs0GdsNK+PhOb1SVdC8NfHvesTbzMAYKsJsK5XuqFOAmUX1+6q8HjPAjFmg5Dvld6pMbuLFW0C+hKTSb9uyEUL5750F/doTYNGQCGqEBiHVMoA2yo+F408Z0d5VEc5hAkNA1GEz2FfSnEV2MlQ9Jkypal/8LnYCifwrGHqOkYKfnoi90T2Re5EqkuNxlOobayrKS1dAsx6/kOLIERCCVHGWmnsEidEoN6bl1PkNgXcYmEsXXbPruP9cbLLbtUO+V6WAqh1geX7eITpFGBUstF48iz97CpychxYMGz2S++nyOBlM6VIly8FPVmZF5Bg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OjKGpLiwfdEj3hpDKHPHCGDLQ0jVoTlSiqyVkPfi7LE=; b=zs394Rc9yVCI500Uitia+q1c/GtshkLk3gyyqNBAkT5PPu3Ge22eSIgfO9BW6kq9pi5CLSZi5bXNq/WlFmaB7LZW5ojd7fwjS39e8mzVKy+M1abIqnugqQNkyTjJMwTQj2D2EPCXR4f5TICg+FQK0Nm6aWZ1KRUiwAEP9Gt2GqI= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SA1PR09MB8733.namprd09.prod.outlook.com (2603:10b6:806:176::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5061.22; Sun, 13 Mar 2022 16:44:53 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5061.026; Sun, 13 Mar 2022 16:44:53 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Zhuangshunwan CC: "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: [GROW] IXP Route Server question Thread-Index: AdgzI9AepbPeSUXIRROpCLpxuIKvkgAD5f2AAD5dAsAAYRU1MABRQkyg Date: Sun, 13 Mar 2022 16:44:53 +0000 Message-ID: References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> <82b678f2254b42fabe3bfbcef4b8d28c@huawei.com> In-Reply-To: <82b678f2254b42fabe3bfbcef4b8d28c@huawei.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 96a82b9a-756b-439a-0466-08da0510cc9d x-ms-traffictypediagnostic: SA1PR09MB8733:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: zQLGx0A5WIYBXqH0+fa7iqEHQ3UYR0+SmS7zCojr7FIki+SU9dYP/5UrdkdqKxmLshejfP0eNCyw+8m8ODOaM0IF85wyEqgJn+Dh2tQQbddIQeX8YEWBW0Hr0TD7sBsCXfWoQwRSd5uS8yBYc+YCKpXy3mUViUJRad0gXmQ4ljwVh7DolWlrn4A6Cf/r0K1J7zvfGtgVR8Kr7HLX32FsbHV1wZGMs7g30wURgB6DM5r/e06bgDvgUJopipNyvqc4cydnY9RwzRfKec+7tzO782LuyLLcG5AY1veY9PyDgx1DpsqilE5O/0zJn/swhIXbWTcpedGZQ3lsUCj9x3GzK/9WNT26MSEmj6q/C5XsUojEV9z7gkLYsbUUvP6jIxqcdswMkacsirtM3mcREQjHVqBCEFppqnTxCA1efezVC+8SgeG1Z7C9WkNJopLcpxZgjiiLcjT4YwF6SifLAxr4gCj3nKMlC2PuzhBR5SqG3FQOObS8+vfDp2KdWW+nNQcN1IwWP8nDZxvJjfngBi5MNJRnd54mLjX3XIi7gY/ZAkNO41NrVQPmlLRpggBkBfFdwPLHpR2TlhkXUnNVd54MWEsYczDa0ZfqhroLLvvOgO2hElNL4gUzA7WAWJtSQFY3Oum97hsTB3/3Z2IzwXnauDJtKQdVj5h/ne2jOh1bG5haZXepYQQavbXJ5FOGeJ/gk5JKnq3JY4Fg4j7SdDV5HbWSS2WpxrNIqTaFKj/AgAdojvGk/HhCE3nju4pGI2sbsbddRDFGbbnIIJw7Ii5GjSQo5ZldIuq0SKM7Haw7cCc= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(38100700002)(38070700005)(71200400001)(54906003)(55016003)(6916009)(66556008)(8676002)(64756008)(66446008)(66476007)(316002)(4326008)(966005)(82960400001)(122000001)(66946007)(76116006)(4744005)(52536014)(6506007)(7696005)(508600001)(86362001)(83380400001)(8936002)(26005)(186003)(2906002)(9686003)(5660300002)(33656002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?J8rH9pSPPraKFbuv0OJo8eIohpuAByFWeRhts0957u5xwxENEfvDUHHNHFQ0?= =?us-ascii?Q?FV7sIHSkECqmk6fxiNaHjrjGdoFSSI3Eijy5R0Gs/ErG+hB05z1/xPr7Zl76?= =?us-ascii?Q?JbV7vDhqk/E1ab6XbHQrJXLX07NFyyoztkB/ry0Mm4YzkGpuZ24wC+ieDB4H?= =?us-ascii?Q?LGvsoXdtKP9Ne+4Ph7+ArCPBxuVdAoHuadRTwo60Q0A+fC2bWfswihCTzG67?= =?us-ascii?Q?xP0ix9FtndGr/reSrdI2x19zebfL5AERxaF8M9MZ9SK3PPI7UHBwgx5yUm41?= =?us-ascii?Q?kBQh2M2YcePR0n5Ij0R3CdiAZ07de/0pgnK1CwRhQ/H91DaaEx5p5xHl1t7i?= =?us-ascii?Q?uK6c+UooFj2g0ZmWlMONGlxNBVjzo3QoyxoBE0qsK29Py4GDIeEIEby+aqPJ?= =?us-ascii?Q?dnzjwj07XAV3A60SFxAheYhQDIhbWuUI/gE+V5WAATb57v2wF5PD84uVgwGU?= =?us-ascii?Q?kU6zTCIKIkpQ4ddTrIV4aJZRVctVDwMlUvte6E5T8CprStegYn9uXoH9F0gn?= =?us-ascii?Q?4yBrbMooWdeDm0qHuYC7SVtp70yekNyO+aHAKUfldGvclADvNA8bG3kcpIgl?= =?us-ascii?Q?ETA6W+8y5lu3AUNIklkDa7sI3Yd8O+rHP9Jzl3AHV3rIVFAAbyrISyLuCSTW?= =?us-ascii?Q?3o6vWrJlijBWWTsQU+3HX4X6AJT+39+UglQYOdy8gGA10KwuE3M8pyzKd7Ly?= =?us-ascii?Q?Ijq5Omzhot6HoaAwM5M54At9fALM+L59dOg6JlwtIYYzDQiM+6mkEzIfuRxi?= =?us-ascii?Q?PvtW7hdwJEqjEkn30uKAPmjks5R9V+Hc+GbZZWe2Ewx0uCsLw8H79DT2QrJp?= =?us-ascii?Q?hImRbCOYtMDnWfMEhen7kiDkP5s1YrbM7vAAa71pTOmtGQ8daXUXJmxGm7RL?= =?us-ascii?Q?hz8OHn5abjox6MVbN0qoyJPdcRlwEqDL055m8cFdBnltXhcP+R3uLwsn1raV?= =?us-ascii?Q?BrBRSSbznj7oL03ikNeEra8BBWHhDHP3Kdlyt8r6SPD297oiuQ8OrMTHbVR6?= =?us-ascii?Q?5Dmbxh27wN2G3qgBRej0iMNSqgVyhdYyucWwU6lassR/3Cwl7PNlIT6fgraH?= =?us-ascii?Q?IuziMnoSZ1u/puC+NXxYG6juynHp8n4rfMK4Ke4sFXOYcgiAOpj2lONIDQlE?= =?us-ascii?Q?oOIDLT4aseoZ/+ujJVIUnseKfsEumXPlXSOvKqJlWXWtY3qeEyjHn+UKv0xa?= =?us-ascii?Q?Tg0nMS9oE6Zs7v8eKbVj+wsZ7qk/NHzW39ITWXv6okaXNnMdzuY2MPE20DuA?= =?us-ascii?Q?iEvntPeRZbaASQ4+ePROfwq3vEWXlqBeBHfU6ch7ha12cDkcMRZV0DhuWx63?= =?us-ascii?Q?6OILsA6Zn1FY0Xl9A6SEcZHFucQDy+cevya+adrOxO3wXNVEcQW36sVS7H1j?= =?us-ascii?Q?qLCkxvdNENaed+p5+0RmLfZkL+COO/VMy5/WC6yYDPZ/xYcHFizL/EO/m64l?= =?us-ascii?Q?qiI5+cK3NNo=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 96a82b9a-756b-439a-0466-08da0510cc9d X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Mar 2022 16:44:53.5398 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR09MB8733 Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Mar 2022 16:45:05 -0000 Hi Shunwan, >> The ASPA verification draft treats the relationship of RS to RS-client=20 >> as similar to that of Provider to Customer. Seems reasonable? The AS=20 >> of an RS client includes the RS's AS in its ASPA as a "Provider". >IMO, the ASPA verification draft regards the relationship between RS and R= S-client as "peer-to-peer",=20 That is not correct. >maybe my understanding is wrong, I will read the ASPA verification draft a= gain. OK. Just FYI... the draft needs a revision. It does not contain yet the enh= anced ASPA upstream/downstream verification algorithms/procedures. Not sure= if you've followed sidrops discussions on the algorithms since January 202= 1. Some pointers: https://datatracker.ietf.org/meeting/110/materials/slides-110-sidrops-srira= m-aspa-alg-accuracy-01 https://mailarchive.ietf.org/arch/msg/sidrops/C6Ethp2aC9sJsxDtBrLQDjmCqk4/ Thanks. Sriram =20 =20 From nobody Sun Mar 13 16:56:45 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DFE53A1843; Sun, 13 Mar 2022 16:56:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UHlg84W2uEQG; Sun, 13 Mar 2022 16:56:22 -0700 (PDT) Received: from mail.netability.ie (mail.netability.ie [46.182.8.5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8BB03A183D; Sun, 13 Mar 2022 16:56:18 -0700 (PDT) Received: from crumpet.local (admin.ibn.ie [46.182.8.8]) by mail.netability.ie (Postfix) with ESMTPSA id A77479EB95; Sun, 13 Mar 2022 23:56:15 +0000 (GMT) To: "Sriram, Kotikalapudi (Fed)" Cc: Ben Maddison , "grow@ietf.org" , "sidrops@ietf.org" References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> <20220311072307.gymne3ofnfsrinkc@benm-laptop> <517ea9bd-4ee1-44cb-3373-eb0552191b2b@foobar.org> From: Nick Hilliard Message-ID: Date: Sun, 13 Mar 2022 23:56:14 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:52.0) Gecko/20100101 PostboxApp/7.0.54 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Mar 2022 23:56:26 -0000 Sriram, Kotikalapudi (Fed) wrote on 13/03/2022 16:20: > Not sure why Ben even raised that question. To me, it doesn't seem > relevant. In the route leak detection procedures, the > receiving/validating AS does not require information about the nature > of ASes (RS or not RS) in the AS Path except for the sending/neighbor > AS which it knows to be an RS in case it knows itself to be an > RS-client. The procedures rely only on ASPA objects for the origin AS > and ASes in the middle. Stepping back a bit, there's no fundamental difference between the behaviour of a transparent RS and a non-transparent RS, except that the transparent RS happens to elide the RS AS number from the AS path. The remainder of the AS path will be the same in either case. The algorithm for check_ix_path() implements a check to flip between upstream path verification and downstream path verification based on whether the RS is transparent or non-transparent. Even if it gives a workable outcome, I think this is the wrong approach from an algorithmic point of view. The algorithm needs to accept that the two situations are basically the same except that in one (rare) case, the RS ASN is present in the AS path, and in the other, it isn't. Section 5.3 says that the client has prior knowledge about whether the peer is a RS. I.e. the draft already admits that rs client implementations will need a config flag. So rather than discussing whether non-transparent ASNs are included in the specification, the discussion needs to focus on whether RS ASN's should be included in the ASPA verification algorithm at all, and if so / if not, how this should be done. The answer to this question is (surprisingly) not immediately clear. RSs do not partake in traffic forwarding, so they are not part of the data path between two ASNs; they're only part of the signaling path between the two ASNs. This is a useful hack from a practical point of view, but it causes algorithmic breakage in places which assume congruency between the data plane and the signaling plane. One of these places is AS path verification. This changes the question of whether or not a hack is deployed to mitigate the effects of RS hackiness, but simply what style of hack should be used. The current proposal is a mitigation approach, but can I propose an alternative approach, namely that the draft reintroduces congruence between the data plane and the signaling plane from the point of view of ASPA verification? I.e. if the WG opinion is to include RS's as being in scope, then the AS path that the aspa algorithm operates on should include the RS ASN, regardless of how the RS is transparent or non-transparent. Alternatively, if WG opinion is to exclude RS's from the scope of this draft, then ASPA should be handled on the basis that the RS ASN is deleted from the as path list. The only information necessary is whether the rs-client is aware that it's talking to a RS, but we already know that. If RS's are kept in scope, then the RS should be treated as a provider by the rs client; the rs client should include the RS ASN in its SPAS; the rs client should evaluate ASPA as if the RS ASN were included in the path; the rs should evaluate clients as customers If they're out of scope, then ASPA verification should elide the RS ASN from the AS PATH if it has not already been elided, and ASPA verification should proceed as if the two rs-client ASNs were directly connected and each should treat the other as a provider. Nick From nobody Sun Mar 13 18:45:48 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F7BE3A18A7; Sun, 13 Mar 2022 18:45:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.907 X-Spam-Level: X-Spam-Status: No, score=-1.907 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id urRvZJxVAhgR; Sun, 13 Mar 2022 18:45:26 -0700 (PDT) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF3A93A0C66; Sun, 13 Mar 2022 18:45:25 -0700 (PDT) Received: from fraeml702-chm.china.huawei.com (unknown [172.18.147.206]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4KGzqZ4xNfz67ts3; Mon, 14 Mar 2022 09:44:42 +0800 (CST) Received: from kwepeml100001.china.huawei.com (7.221.188.249) by fraeml702-chm.china.huawei.com (10.206.15.51) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2375.24; Mon, 14 Mar 2022 02:45:22 +0100 Received: from kwepeml500004.china.huawei.com (7.221.188.141) by kwepeml100001.china.huawei.com (7.221.188.249) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.21; Mon, 14 Mar 2022 09:45:21 +0800 Received: from kwepeml500004.china.huawei.com ([7.221.188.141]) by kwepeml500004.china.huawei.com ([7.221.188.141]) with mapi id 15.01.2308.021; Mon, 14 Mar 2022 09:45:21 +0800 From: Zhuangshunwan To: "Sriram, Kotikalapudi (Fed)" CC: "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: [GROW] IXP Route Server question Thread-Index: AdgzI9AeBV4234ykpkmw38R5LhMrNQAD5f2AAD5dAsAAYRU1MABRQkygABOGoeA= Date: Mon, 14 Mar 2022 01:45:20 +0000 Message-ID: <2ad9d317fdf9441aa207628d4bfd6098@huawei.com> References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> <82b678f2254b42fabe3bfbcef4b8d28c@huawei.com> In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.108.152.178] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Mar 2022 01:45:31 -0000 Hi Sriram, Thanks for your pointers! I will read them carefully. Best regards, Shunwan > -----Original Message----- > From: Sriram, Kotikalapudi (Fed) [mailto:kotikalapudi.sriram@nist.gov] > Sent: Monday, March 14, 2022 12:45 AM > To: Zhuangshunwan > Cc: grow@ietf.org; sidrops@ietf.org > Subject: RE: [GROW] IXP Route Server question >=20 > Hi Shunwan, >=20 > >> The ASPA verification draft treats the relationship of RS to > >> RS-client as similar to that of Provider to Customer. Seems > >> reasonable? The AS of an RS client includes the RS's AS in its ASPA as= a > "Provider". >=20 > >IMO, the ASPA verification draft regards the relationship between RS > >and RS-client as "peer-to-peer", >=20 > That is not correct. >=20 > >maybe my understanding is wrong, I will read the ASPA verification draft > again. >=20 > OK. Just FYI... the draft needs a revision. It does not contain yet the e= nhanced > ASPA upstream/downstream verification algorithms/procedures. Not sure if > you've followed sidrops discussions on the algorithms since January 2021. > Some pointers: > https://datatracker.ietf.org/meeting/110/materials/slides-110-sidrops-sri= ra > m-aspa-alg-accuracy-01 > https://mailarchive.ietf.org/arch/msg/sidrops/C6Ethp2aC9sJsxDtBrLQDjmCq > k4/ >=20 > Thanks. >=20 > Sriram >=20 >=20 >=20 >=20 >=20 >=20 From prvs=062d6cf8c=rmosher@amazon.com Thu Mar 10 18:37:45 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DA6D3A1196; Thu, 10 Mar 2022 18:37:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.608 X-Spam-Level: X-Spam-Status: No, score=-14.608 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HqFR5_MUXfnj; Thu, 10 Mar 2022 18:37:40 -0800 (PST) Received: from smtp-fw-6001.amazon.com (smtp-fw-6001.amazon.com [52.95.48.154]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3969B3A116C; Thu, 10 Mar 2022 18:37:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1646966261; x=1678502261; h=from:to:cc:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version:subject; bh=WZ+UMD8nBZC4Y32PRLaem7pcJ+iiGd/XrD6hRkuaD14=; b=MMOZzvy/Y4BbyIvAdxJG9/c3dpNUwsN8BiRzcBAHJnNcoQS++8d9e/Gb S/BAgO8UNHHBGP8LmH5J3UteoKhv+bZyLwJ/ruLWdgIFFJ0TOZkt8jIr7 3bAH7+WpW6DIiqEfEMDbb6nQHQTdDjd+xgk4dxxJzPF39X1TgMP7v8AiO k=; X-IronPort-AV: E=Sophos;i="5.90,172,1643673600"; d="scan'208";a="185113092" Thread-Topic: [Sidrops] [GROW] IXP Route Server question Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-iad-1e-8be8ed69.us-east-1.amazon.com) ([10.43.8.6]) by smtp-border-fw-6001.iad6.amazon.com with ESMTP; 11 Mar 2022 02:37:30 +0000 Received: from EX13MTAUEE002.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan3.iad.amazon.com [10.40.163.38]) by email-inbound-relay-iad-1e-8be8ed69.us-east-1.amazon.com (Postfix) with ESMTPS id 69F4AC0A20; Fri, 11 Mar 2022 02:37:28 +0000 (UTC) Received: from EX13D14UEE003.ant.amazon.com (10.43.62.11) by EX13MTAUEE002.ant.amazon.com (10.43.62.24) with Microsoft SMTP Server (TLS) id 15.0.1497.28; Fri, 11 Mar 2022 02:37:27 +0000 Received: from EX13D14UEE003.ant.amazon.com (10.43.62.11) by EX13D14UEE003.ant.amazon.com (10.43.62.11) with Microsoft SMTP Server (TLS) id 15.0.1497.32; Fri, 11 Mar 2022 02:37:27 +0000 Received: from EX13D14UEE003.ant.amazon.com ([10.43.62.11]) by EX13D14UEE003.ant.amazon.com ([10.43.62.11]) with mapi id 15.00.1497.033; Fri, 11 Mar 2022 02:37:27 +0000 From: "Mosher, Rob" To: Nick Hilliard , "Sriram, Kotikalapudi (Fed)" CC: "grow@ietf.org" , "sidrops@ietf.org" Thread-Index: AQHYMzOTj7J0F5wxK0qmWvLm6zmdXay3+DyAgAFJy4CAADcGgA== Date: Fri, 11 Mar 2022 02:37:27 +0000 Message-ID: <5665d2c20e4c45f0acfa55fa08987247@EX13D14UEE003.ant.amazon.com> References: <0db7749f-66fd-5def-a8bb-3ee316cf2ca1@foobar.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.62.53] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: X-Mailman-Approved-At: Mon, 14 Mar 2022 08:35:20 -0700 Subject: Re: [Sidrops] [GROW] IXP Route Server question X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Mar 2022 02:43:14 -0000 HKIX inserts their ASN 4635 in the path, and they're quite large. Having c= onnected to route servers on hundreds of exchanges, this is the only one th= at I can think of that still does this.=20 https://www.hkix.net/hkix/route-server.htm https://bgp.he.net/AS4635 -rm -----Original Message----- From: Sidrops On Behalf Of Nick Hilliard Sent: Thursday, March 10, 2022 6:12 PM To: Sriram, Kotikalapudi (Fed) Cc: grow@ietf.org; sidrops@ietf.org Subject: RE: [EXTERNAL] [Sidrops] [GROW] IXP Route Server question CAUTION: This email originated from outside of the organization. Do not cli= ck links or open attachments unless you can confirm the sender and know the= content is safe. CAUTION: This email originated from outside of the organization. Do not cli= ck links or open attachments unless you can confirm the sender and know the= content is safe. Sriram, Kotikalapudi (Fed) wrote on 10/03/2022 03:31: > Nick and all, > > Thank you. What you all shared/discussed is very useful info. >> Almost all RS's are transparent these days. Usually IXPs go to=20 >> lengths to ensure that the RS ASN doesn't appear in the AS path. > Good to know that. Well, that means there can be an occasional RS that=20 > is non-transparent. When there is a non-transparent RS, could there be=20 > big ISPs (Tier-1, Tier-2) present there as RS-clients? I would seriously doubt it. There are some "Tier 1" and "Tier 2" providers who peer using route servers at IXPs, but it's a bit unusual (and= entertaining to hear them strenuously denying that this ever happens). Non-transparent RS's were used until a couple of years ago but I'm not awar= e of any left at this point. Even when non-transparent RS's were more wides= pread, I would have expected the intersection of these two groups to be nul= l, and that if there were an intersection, the Tier1/Tier2 providers would not be upset if those paths were dropped / mark= ed as invalid. > The ASPA verification draft treats the relationship of RS to RS-client=20 > as similar to that of Provider to Customer. Seems reasonable? The AS=20 > of an RS client includes the RS's AS in its ASPA as a "Provider". yes, this is reasonable. Nick _______________________________________________ Sidrops mailing list Sidrops@ietf.org https://www.ietf.org/mailman/listinfo/sidrops From nobody Tue Mar 15 08:34:00 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A50E93A1584; Tue, 15 Mar 2022 08:33:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TWsk9VMC1qs3; Tue, 15 Mar 2022 08:33:53 -0700 (PDT) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on2072d.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 920633A1583; Tue, 15 Mar 2022 08:33:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OSzJRSaT4tYgYgnY/5Tz4oQJRHg9c2RXO4YXZ6evRFAkEO84A2plk7oDLupTxwkshrxTulngqMdVELBeersx0zbu9CcPAkyFSj4bG2Tn9N1jgHWvPOdKFIc5MTDypCQ56ruPP1+kh6EjaxDiGuiHxRD2nm0el3wmc8ZQeQiOyj2E9HtlABBg18UYd8CawEfYDBgn/xEolaHUh8vhBPM5tMPVPakFxAEmy4H4+RLKmu1sqqglsNt4fRWNhk6YnCQ3Dqn7aOqc+q9pVWNAeyzfeclEg9DCbVDW/bDl2A/yuSeFcgBLKmcS/i4ikIjCRiZXRYQ2d0lVTn5Jd07NiE8hNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5iC9fqOT73vBCzONV4Av+R2Gl+xO1fmiRAzWA2RRn68=; b=ZS5d3u2zpIx/QEXq5TtpYcgOcZhQMW3yF4l/H3xTqDDpdLCaq53K4e/JLO9IHVlqRUN8mYm7AfdMtXpqmsX9HDqaE2vHPnHR+E0decGE4LhT0qyDFdV1RsQXcMKoLmYD2uqbxxiVrsEsmPbtkpzURChgKYn0K0JaLyPQesSRL9nh3h5cw37xoiHgBE2OzPWOYZ4a0e7fsnIj9i7AmlOxyxt6RwHeYZlBxnMOkNM4w/KejadPuAU8SCfrDq4I2vuW0Ec1yoOF4bTO0y1YLpwh4rsY3nPpE8DrDOumsETOdG4E1NxDxSOAT8I8qObtOgHDOdD0g5fpA4Wp/jfOQfxPPQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5iC9fqOT73vBCzONV4Av+R2Gl+xO1fmiRAzWA2RRn68=; b=tGapFfznMw3U9vTIZb1CYlUyH3F12LVW9fHxbUimVGf4BAkgcFaQxUWfgWNXpeylcUEErSLA5dF3DsCawjjcAdLWaSXyd+CJid8B747Aa977VOyW8/ERgT3L/EWzXrlG1KttBVAtl8wq6Nsqx8ejkRJGx33QrZ573+kRN51peKw= Received: from BY3PR09MB8131.namprd09.prod.outlook.com (2603:10b6:a03:34d::9) by BY3PR09MB7347.namprd09.prod.outlook.com (2603:10b6:a03:340::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.14; Tue, 15 Mar 2022 15:33:42 +0000 Received: from BY3PR09MB8131.namprd09.prod.outlook.com ([fe80::fc92:b68c:f535:6750]) by BY3PR09MB8131.namprd09.prod.outlook.com ([fe80::fc92:b68c:f535:6750%2]) with mapi id 15.20.5081.014; Tue, 15 Mar 2022 15:33:42 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Nick Hilliard CC: Ben Maddison , "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: ASPA and Route Server (was RE: [Sidrops] [GROW] IXP Route Server question) Thread-Index: Adg4ggI9zgEhWGRXSB+h1e3Exyc49g== Date: Tue, 15 Mar 2022 15:33:42 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 10e90952-65ae-47ae-7c9c-08da06992f92 x-ms-traffictypediagnostic: BY3PR09MB7347:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: FXpudX/uG5xPEbYhr/xUvSiACIYnruC6BUqNVKT/EBrqQYalnNEa7WuLJi5eOE732AWUgqgRt6rJ8swVRsc7hexPvueDXb3iQ9bmUl/jeXLm5rl+SDjK8W9hzyL28dJk0ByG6/oMT94VhHrWqJh/tMb0VQWstzTOIqFbnXcsjUvZhhzAFMS/+wWnkTxHf8DJlEBz+IRhYZG78kAMYHB9fJPGnn7X6lLLhKVJKMFUendXCTSoHdu/z8VX/nUcabOgcNFvAy8XSWXxUtJjqTukTMxv2IdZ87xUcZ7O9CqtD04Z6KmfNozdaSxJ5JI0F+VMqGcFJX8aa45bskia7M5XAWsdNN5CXy7ewpRc59XEKm1nLvbQk8S1X/7F3m8jIqHccyLnyQt/7/vhkysMrr5eaxiKlsJOB27CsQ+pyngSxJ2Gf2eCqwqDXEZEGnFza5kSYa2MvC/elbxZutLuSRvhfGbZ1AlMTn91n4tmeiznh5eRAW65kiVHkXVqfG1Nb/sncneteS85fa55KQxNtEvw9Z7q8Y9uJ4Gqk19lpe4KGyCyEjZO0xv1JBD4lpnSq01u/dnptEWRLTl6ZO+aHXhaAcAOMrzr/vWViqXoe6+WQz51PV6Z10SUmg9lVbcoXT04kVFa+TPV1M536v8TXA6ivAY89NIyPPzcv3keykNbGeMj6ZzPVxWQvtpUCQHj0rQE+rSX5snChqyJGzARhPxPRA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY3PR09MB8131.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(83380400001)(26005)(82960400001)(186003)(122000001)(54906003)(6916009)(52536014)(8936002)(5660300002)(9686003)(86362001)(2906002)(38100700002)(55016003)(71200400001)(7696005)(6506007)(33656002)(66946007)(66556008)(66476007)(66446008)(508600001)(64756008)(4326008)(8676002)(76116006)(316002)(38070700005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?Z3ZQbEczNk5CZWIyWkdnU24wOEwrcWxnQzBnYWJpRmlDRFdlNWFlTjQwUno3?= =?utf-8?B?WHBHbnhyYnVEMnJtdXBNd3ArUmprYWtoQ2JrMlQzQklWNkpZY2pNdzZvZEhH?= =?utf-8?B?K3V2K0MycElLTW41OCt4d2JWUDBMbkpSQUpOYThTRTZMNmZJbTAxMGpRMFZl?= =?utf-8?B?YmFUNC9mRmNJNXdlblRZMlJ5VCtsc0VXNWV3bWl5cWk4V3JGWFAzMHE5UytG?= =?utf-8?B?RlZHSW5FdkJvZmZFQkZZdGw4M3puU2JaSWxVSFRQTURGRlF2alFJelZjVTF4?= =?utf-8?B?cjlxNlM2bHZHc1p2SldDeXlMSEYrTVMwaFY2cXZ0OEVPZC9BaEl6REZHRzVK?= =?utf-8?B?TnRrdDhzbkl6cjRucWhINFZOREhIQkNVM09JUVU0emt1S3g2TWJzSlNaaTJU?= =?utf-8?B?bHBxR0dsVkV5N0x2MWZQbmtnS3MvaHVQQytUajhjTmNSMkVoY0ZGWVN6bUdX?= =?utf-8?B?WEpmY05pUmYxRkRBNWJaTmN4cjh2RkVOb3RoSDJmQ3NWcG9BWlhwNTJiLzYw?= =?utf-8?B?Z2tCZTlwdFhVdFNVSHc5UjdVMjV3ZFBLWUtUODdQVVdTUVRpaUpqa1hHeXRj?= =?utf-8?B?eGtVSERNVlN0cWoxK2l0eHNzWEpmL2tFei9FLzJXdXk2dzVHa1MyOUFmN25n?= =?utf-8?B?akpKRS9jMzliMms4R0U2N2IvUkliN0l5TTNtL1BXakFFVXJPeTgyVUY5WGVH?= =?utf-8?B?M05RR1BLblY3aE16eGlyTXFMYWJ1b1RXTTZnem9rd0RNKytrc1JvTzUvWjdn?= =?utf-8?B?ejFiMUp4UlVxQVcvSDcvdjdYeTN0TlhHUXlrY2hHUVpERXlZNHJEdFNlYjQ0?= =?utf-8?B?VFM4ZitaRXF2NFlIQ3JEcVlZSDB2ejJuV0ZnOEFic1o3eHU0bEQxcTNRTUda?= =?utf-8?B?OXVUKzdoZ3dkOGplRGpFYjd5Qjh3YjB4T2RIaG9wMVdGaXFVbElvZ3NIbm1Y?= =?utf-8?B?OE81MkdHR3NzcEx4SkFyalVXdjdPNGg3QWNDYkNlektRTTVrZk4xWWpRZEV5?= =?utf-8?B?d2lMaHdaWWZCNjBZVnVnaWd0bjQ2MGNTcHpndUp5akdrV0pEYlRyL0hqck00?= =?utf-8?B?Rndmd1dXdUtFMEpjbUZiWUt6SDdxMzk2cXUrQ3RyWVA4VGQ0QUtUTkFSSkw2?= =?utf-8?B?N0JKRW01YWI3Vjl0TFpQd1dJNXdVbzFXVENuMUJRaGNpWTV0bXQ2TDU4cGgw?= =?utf-8?B?SG0rWlphTDBldVNxQlRsd3Vmc3NKd2kxOGhBUUg4L1cyZDF6c2hBbGd3MjhW?= =?utf-8?B?cms5ZStRY3dNbVVTenRYZUxJRWt6YURBcmtqWjhGQno3Y3REM0lVZm5SWklB?= =?utf-8?B?dFh3bysyTHZ3OGlCcjlRakh1ZHdNM21NeGxCN2QyV09yQis4VHkwM1VCa3d1?= =?utf-8?B?SlhxVG84MjlIREJHMVZ2TS9ZT0Z0MjBVVVN2MHBwZzhKSDFVNjRYaGh3OWtu?= =?utf-8?B?c3FXRk5ERVU5YUFtemxBcUFSemZlVkU5R0NKck5BVDJtRlRXMkVDVUZDRXlz?= =?utf-8?B?TlF2VTU3RWwrcEZFUkZoNmdNdS9sUTJYT1dPMUpWTFZERmJmOEhRd0x3YTZV?= =?utf-8?B?ZmNMV3NuNlZEaEVyajR2dlMrTm03dlVFQmF3dkFjSFJwdGdhSTJPQ1Bzc3FV?= =?utf-8?B?Y0pnVVlzYzBqSFlqOU5oNXZkMlZ0WmR5RDFONzBDMStRdkdqbGhua1pER0hw?= =?utf-8?B?MHMyRWpGZ3J3bVBaNXVOWVRJWmpQRkpuakRzVVBmeFZPeHNyME1nWHZBZHd0?= =?utf-8?B?SUpXUVBNcGFPeU0rUGVNTnJSdDFMRjJZbGlPQXRPYjZZeEpyM0NqWXVsdHcy?= =?utf-8?B?QmtjZ0hqNHhUbHBIVkRYRW1EeG02d2F0dUZ1VVQ0TDZ1QjBiSFJqZ2hLMmNW?= =?utf-8?B?M25BK0JYQ0FsUkhBMjZxcmhieGhiRmF3ckI3SCtMZDVMV044QzMzdDc5cVVz?= =?utf-8?Q?JNtI6Lolnq0=3D?= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY3PR09MB8131.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 10e90952-65ae-47ae-7c9c-08da06992f92 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2022 15:33:42.2520 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY3PR09MB7347 Archived-At: Subject: [Sidrops] ASPA and Route Server (was RE: [GROW] IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Mar 2022 15:33:58 -0000 TmljayAoYW5kIGFsbCksDQoNCkkgd2FzIGFsc28gcmVyZWFkaW5nL3Jldmlld2luZyBTZWN0aW9u IDUuMyBhbmQgaGFkIHNpbWlsYXIgdGhvdWdodHMgYWJvdXQgdGhlIHR3byBvcHRpb25zIHlvdSBv dXRsaW5lZC4gQXMgeW91IG5vdGVkLCAidGhlIGFwcHJvYWNoIGluIFNlY3Rpb24gNS4zIGdpdmVz IGEgd29ya2FibGUgb3V0Y29tZSIuICBIb3dldmVy4oCmIA0KDQo+Li4uIHRoZSBSUyBzaG91bGQg YmUgdHJlYXRlZCBhcyBhIHByb3ZpZGVyIGJ5IHRoZSBycyBjbGllbnQ7IHRoZSBycyBjbGllbnQg c2hvdWxkIGluY2x1ZGUgdGhlIFJTIEFTTiBpbiBpdHMgU1BBUzsgdGhlIHJzIGNsaWVudCBzaG91 bGQgZXZhbHVhdGUgQVNQQSBhcyBpZiB0aGUgUlMgQVNOIHdlcmUgaW5jbHVkZWQgaW4gdGhlIHBh dGg7IHRoZSBycyBzaG91bGQgZXZhbHVhdGUgY2xpZW50cyBhcyBjdXN0b21lcnMNCg0KWWVzLCBJ IGFncmVlIHRoYXQgInRoZSBycyBjbGllbnQgc2hvdWxkIGluY2x1ZGUgdGhlIFJTIEFTTiBpbiBp dHMgU1BBUy4iIEFsZXhhbmRlciBhbmQgSSBoYXZlIHRhbGtlZCBhYm91dCB0aGlzLCBhbmQgaGUg bWVudGlvbmVkIHRoYXQgdGhpcyB3b3VsZCBiZSBhZGRlZCB0byB0aGUgZHJhZnQuIA0KDQpZZXMs IEkgYWxzbyBmZWVsIHRoYXQgaXQgaXMgYSBiZXR0ZXIgb3B0aW9uIHRoYXQgdGhlIFJTIGNsaWVu dCBhZGRzIHRoZSBBU04gb2YgdGhlIHRyYW5zcGFyZW50IFJTIHRvIHRoZSBBUyBwYXRoIChmb3Ig QVNQQSB2YWxpZGF0aW9uIHB1cnBvc2VzIG9ubHkpIGFuZCBhcHBsaWVzIHRoZSBkb3duc3RyZWFt IEFTUEEgYWxnb3JpdGhtLiBBbGdvcml0aG1pY2FsbHkgdGhpcyBzZWVtcyBtb3JlIGFwcHJvcHJp YXRlLiBUaGlzIGlzIGFsc28gYmV0dGVyIGZyb20gYSBkaWFnbm9zdGljcyBwb2ludCBvZiB2aWV3 IChpZiB0aGUgbmVlZCBldmVyIGFyaXNlcykgYmVjYXVzZSBpbiB0aGlzIGFwcHJvYWNoIHRoZSBy ZWxldmFudCBBU1BBIGlzIHVzZWQgZm9yIHZhbGlkYXRpbmcgdGhlIGhvcCBmcm9tIHRoZSBBUyBq dXN0IGJlZm9yZSB0aGUgUlMgdG8gdGhlIFJTLiAgDQoNClRoYXQgc2FpZCwgSSB0aGluayB0aGVy ZSBpcyBhIGJpZ2dlciBpc3N1ZSBhYm91dCB0cmFuc3BhcmVudCBSUyBpbiB0aGUgbWlkZGxlIG9m IHRoZSBBUyBwYXRoLiBNYXliZSB0aGlzIGlzIHdoYXQgQmVu4oCZcyBxdWVzdGlvbiB3YXMgaGlu dGluZyBhdC4gSSB0aGluayB5b3UgYXJlIGFsc28gcmFpc2luZyB0aGlzIGlzc3VlIHdoZW4geW91 IHNheToNCg0KPlJTcyBkbyBub3QgcGFydGFrZSBpbiB0cmFmZmljIGZvcndhcmRpbmcsIHNvIHRo ZXkgYXJlIG5vdCBwYXJ0IG9mIHRoZSBkYXRhIHBhdGggYmV0d2VlbiB0d28gQVNOczsgdGhleSdy ZSBvbmx5IHBhcnQgb2YgdGhlIHNpZ25hbGluZyBwYXRoIGJldHdlZW4gdGhlIHR3byBBU05zLiAg VGhpcyBpcyBhIHVzZWZ1bCBoYWNrIGZyb20gYSBwcmFjdGljYWwgcG9pbnQgb2YgdmlldywgYnV0 IGl0IGNhdXNlcyBhbGdvcml0aG1pYyBicmVha2FnZSBpbiBwbGFjZXMgd2hpY2ggYXNzdW1lIGNv bmdydWVuY3kgYmV0d2VlbiB0aGUgZGF0YSBwbGFuZSBhbmQgdGhlIHNpZ25hbGluZyBwbGFuZS4g IE9uZSBvZiB0aGVzZSBwbGFjZXMgaXMgQVMgcGF0aCB2ZXJpZmljYXRpb24uDQoNCj4g4oCmLkFT UEEgdmVyaWZpY2F0aW9uIHNob3VsZCBwcm9jZWVkIGFzIGlmIHRoZSB0d28gcnMtY2xpZW50IEFT TnMgd2VyZSBkaXJlY3RseSBjb25uZWN0ZWQgYW5kIGVhY2ggc2hvdWxkIHRyZWF0IHRoZSBvdGhl ciBhcyBhIHByb3ZpZGVyDQoNCkJhc2VkIG9uIHRoZSBhYm92ZSBvYnNlcnZhdGlvbnMgZnJvbSB5 b3UsIEkgYW0gcHJvcG9zaW5nIHRoZSBmb2xsb3dpbmc6DQoNCkFuIFJTIGNsaWVudCBvZiBhbiBS UyAodHJhbnNwYXJlbnQgb3Igbm90KSBpbmNsdWRlcyB0aGUgUlMgQVMgaW4gdGhlaXIgU1BBUy9B U1BBLiBUaGUgUlMgY2xpZW50IGFsc28gaW5jbHVkZXMgaW4gaXRzIFNQQVMvQVNQQSBhbnkgQVMg d2l0aCB3aG9tIGl0IGNvbm5lY3RzIGluIHRoZSBjb250cm9sIHBsYW5lIHZpYSB0aGUgUlMuDQoN ClRoZSBpZGVhIGlzIHRoYXQgYSBwYXRoIHNlZ21lbnQgQVN4LVJTLUFTeSAod2hlcmUgQVN4IGFu ZCBBU3kgYXJlIFJTLWNsaWVudHMgY29ubmVjdGVkIGluIEJHUCB2aWEgdGhlIFJTKSB3aWxsIGJl IGFsd2F5cyB2ZXJpZmlhYmxlIHdpdGggdGhpcyBwcm9wb3NhbCB3aGV0aGVyIG9yIG5vdCB0aGUg UlMgaXMgdHJhbnNwYXJlbnQuIElmIHRoZSBBU1BBcyBhcmUgY3JlYXRlZCBieSBBU3ggYW5kIEFT eSBwZXIgdGhlIHByb3Bvc2FsIGFib3ZlLCB0aGVuIHRoZSBBU3gtUlMtQVN5IHNlZ21lbnQgd2ls bCBiZSBldmFsdWF0ZWQgYXMgVmFsaWQgaW4gZWl0aGVyIGRpcmVjdGlvbi4gSSAgdGhpbmsgdGhp cyBwcm9wb3NhbCBpbiBjb25qdW5jdGlvbiB3aXRoIG90aGVyIGlkZWFzIGRpc2N1c3NlZCBhYm92 ZSB0YWtlcyBjYXJlIG9mIGJvdGggdHJhbnNwYXJlbnQgYW5kIG5vbi10cmFuc3BhcmVudCBSU3Mg aW4gdGhlIEFTUEEgdmVyaWZpY2F0aW9uIGFsZ29yaXRobXMuIERvZXMgdGhpcyBzZWVtIHJlYXNv bmFibGU/DQoNClRoYW5rIHlvdS4NCg0KU3JpcmFtDQoNCg== From nobody Tue Mar 15 10:05:42 2022 Return-Path: X-Original-To: sidrops@ietf.org Delivered-To: sidrops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 118FF3A09A1; Tue, 15 Mar 2022 10:05:19 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Kyle Rose via Datatracker To: Cc: draft-ietf-sidrops-rpki-has-no-identity.all@ietf.org, last-call@ietf.org, sidrops@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.46.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <164736391901.8166.304606388310583653@ietfa.amsl.com> Reply-To: Kyle Rose Date: Tue, 15 Mar 2022 10:05:19 -0700 Archived-At: Subject: [Sidrops] Secdir last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Mar 2022 17:05:19 -0000 Reviewer: Kyle Rose Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document is Almost Ready, but its publication as an RFC may or may not be the right way to address the problem it is targeted at. Can one of the authors cite a specific reference to the problem that this draft is trying to address? A written example of where this "false notion" exists? If the sole purpose of this document is to state a normative prohibition on one aspect of RPKI as described in the informational RFC 6480, would a better approach not be to normatively specify RPKI via a 6480bis on standards track? It feels weird to create a single normative prohibition for a specification that is otherwise classified as informational, but perhaps there is sufficient precedent for this. My one nit suggestion would be to make some of the language a little less casual, starting with the abstract. From nobody Tue Mar 15 10:23:04 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FD873A1064; Tue, 15 Mar 2022 10:23:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sqKng4gRwxp3; Tue, 15 Mar 2022 10:23:00 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0AA6F3A0D1C; Tue, 15 Mar 2022 10:23:00 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1nUAss-0009nd-0q; Tue, 15 Mar 2022 17:22:58 +0000 Date: Tue, 15 Mar 2022 10:22:57 -0700 Message-ID: From: Randy Bush To: Kyle Rose via Datatracker Cc: , draft-ietf-sidrops-rpki-has-no-identity.all@ietf.org, last-call@ietf.org, sidrops@ietf.org In-Reply-To: <164736391901.8166.304606388310583653@ietfa.amsl.com> References: <164736391901.8166.304606388310583653@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Sidrops] Secdir last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Mar 2022 17:23:03 -0000 hi kyle > Can one of the authors cite a specific reference to the problem that > this draft is trying to address? A written example of where this > "false notion" exists? let be be lazy and quote the response to a similar question in an artart review a few years back, two of the co-authors of a lot of sidr rfcs, working at apnic (supposedly a prudent steward of the net infra), put up a "sign arbitrary blob" service, with no warnings of the semantics. one of them just wrote to say he thought 6480 was sufficient; which pretty much says it all. and early drafts and discussions of the first two informative references [I-D.ietf-sidrops-rpki-rsc] Snijders, J., Harrison, T., and B. Maddison, "Resource Public Key Infrastructure (RPKI) object profile for Signed Checklist (RSC)", Work in Progress, Internet-Draft, draft- ietf-sidrops-rpki-rsc-06, 12 February 2022, . [I-D.ietf-sidrops-rpki-rta] Michaelson, G. G., Huston, G., Harrison, T., Bruijnzeels, T., and M. Hoffmann, "A profile for Resource Tagged Attestations (RTAs)", Work in Progress, Internet-Draft, draft-ietf-sidrops-rpki-rta-00, 21 January 2021, . brought to light massive misunderstanding and misrepresentation, despite 6480 yes, this is depressing and a bit shocking. sad to say, those terms can be applied to a fair bit of RPKI deployment. randy From nobody Wed Mar 16 17:38:50 2022 Return-Path: X-Original-To: sidrops@ietf.org Delivered-To: sidrops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 067733A1530; Wed, 16 Mar 2022 17:38:48 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Matt Joras via Datatracker To: Cc: draft-ietf-sidrops-rpki-has-no-identity.all@ietf.org, last-call@ietf.org, sidrops@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.46.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <164747752793.7856.7321473192898082077@ietfa.amsl.com> Reply-To: Matt Joras Date: Wed, 16 Mar 2022 17:38:48 -0700 Archived-At: Subject: [Sidrops] Genart last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Mar 2022 00:38:48 -0000 Reviewer: Matt Joras Review result: Ready with Nits I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat these comments just like any other last call comments. For more information, please see the FAQ at . Document: draft-ietf-sidrops-rpki-has-no-identity-?? Reviewer: Matt Joras Review Date: 2022-03-16 IETF LC End Date: 2022-03-18 IESG Telechat date: Not scheduled for a telechat Nits/editorial comments: 2. The Bottom Line This choice of idiom for a section title feels a bit weird. I understand what's trying to be conveyed but I have to imagine there's a way to do it without relying on an idiom. That the RPKI does not authenticate real-world identity is a feature, not a bug. If it tried to do so, aside from the liability, it would end in a world of complexity with no proof of termination, as X.400 learned. Again, "is a feature, not a bug" feels gratuitous, I would consider simply stating a fact (e.g. "RPKI does not authenticate real-world identities. This was a deliberate choice in its design") rather than relying on this expression. If it tried to do so, aside from the liability, it would end in a world of complexity with no proof of termination, as X.400 learned. What "liability" exactly is this referring to? Referencing X.400 in this way without an actual reference feels wrong. Similar to above, "world of complexity", is another expression that feels out of place in this document when a more straightforward statement on complexity would do. From nobody Wed Mar 16 20:34:52 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ED7E3A0C64 for ; Wed, 16 Mar 2022 13:01:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.108 X-Spam-Level: X-Spam-Status: No, score=-2.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=krose.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6mIUdepzQU3G for ; Wed, 16 Mar 2022 13:01:47 -0700 (PDT) Received: from mail-wr1-x429.google.com (mail-wr1-x429.google.com [IPv6:2a00:1450:4864:20::429]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 011193A0C83 for ; Wed, 16 Mar 2022 13:01:46 -0700 (PDT) Received: by mail-wr1-x429.google.com with SMTP id h23so3886260wrb.8 for ; Wed, 16 Mar 2022 13:01:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=krose.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/IK/nIciDnUsE4fHwS31SRwC4zkouoEM5aDaHgju09I=; b=F9mL/hWBOcy4iDyCSbVBTk/3tenHlalzd0BrNdMhmN1Wbp+XL81KcpvASysdhwo2FE MFZW5IsJ7nlaFBEdHVSXpo2XTv6EMJHlZx0Hkv4R8DbRmVqt8/cBnJEmHREcSyAllqof T0z1M05DQRufgFlepWU78QP0Auzp1wqBRCL7I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/IK/nIciDnUsE4fHwS31SRwC4zkouoEM5aDaHgju09I=; b=MK+JCLYcJGRAU2tN0rNoFxfsKFtH7jyuaI5SJgT9lGZuetrlsnNInMPwjiQI4bQfoD BjF0oT1WD83ZNpIYH+t61M4zmadMpWK8BEWoJidtbhZWtmV0V/0Xfim9U9a1JdjknroY /O4+vKYF2J2wzKpgK8n3P/XNnISSuMa/5dJ/U/Mj5OCHw1isIpDOiGlt0dbBqvbZrejg tEkQMMm6eFXPsQ9tFZTT5nOVbtjP2q9HRtNCYJWPDNrCt3kRc0+A4HmAfGBILFKFyF+n lzre9D3qU0a69t0J4rXl3zF+rn8JeY1HgIaNpjc5n6ZNqmZ5HoKYujjTXaOGeqz07hww Lb1g== X-Gm-Message-State: AOAM533/iKTD190Vgc++2KOaa8E5Uy7qG94Iw5AjnyHOyKhk3Fejpbt1 PnvC1oKqXPoKutSQtOmIXTorA9nIOnCDf/gnKONVqQ== X-Google-Smtp-Source: ABdhPJz9Fe8rf5P2+DwvyeoBqTSq7p3Lrlwnsb0Ki8fEvYMbtzADOu/8ItTyXf2gJv/cjzJPMGqIzaIuAPVX49QGn4k= X-Received: by 2002:a5d:6c67:0:b0:203:bf25:f311 with SMTP id r7-20020a5d6c67000000b00203bf25f311mr1251050wrz.108.1647460904705; Wed, 16 Mar 2022 13:01:44 -0700 (PDT) MIME-Version: 1.0 References: <164736391901.8166.304606388310583653@ietfa.amsl.com> In-Reply-To: From: Kyle Rose Date: Wed, 16 Mar 2022 16:01:33 -0400 Message-ID: To: Randy Bush Cc: Kyle Rose via Datatracker , last-call@ietf.org, sidrops@ietf.org, draft-ietf-sidrops-rpki-has-no-identity.all@ietf.org, secdir@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: X-Mailman-Approved-At: Wed, 16 Mar 2022 20:34:51 -0700 Subject: Re: [Sidrops] [secdir] Secdir last call review of draft-ietf-sidrops-rpki-has-no-identity-04 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Mar 2022 20:01:53 -0000 On Tue, Mar 15, 2022 at 1:23 PM Randy Bush wrote: > > hi kyle > > > Can one of the authors cite a specific reference to the problem that > > this draft is trying to address? A written example of where this > > "false notion" exists? > > let be be lazy and quote the response to a similar question in an > artart review Heh... serves me right. I did read the artart review, but not any follow-ups. > a few years back, two of the co-authors of a lot of sidr rfcs, working > ... > yes, this is depressing and a bit shocking. sad to say, those terms can > be applied to a fair bit of RPKI deployment. Ok, so I appreciate the problem. I'm still not sure this is quite the right way to address it. This feels a bit too "protocol police"-ish to me. Publishing a new RFC to reiterate something that is already covered by an earlier spec in the hopes that it will deter willfulness seems like trying to fix something by repeatedly banging on it. Do we need a "No, we *really* mean it" track in the series? It seems like vigilance around implementations will be required either way. ISTM that the best way to address this particular problem is to make sure the folks in industries that develop RPKI implementations understand this, which probably means contacting them directly and pointing them at the existing text that already makes clear that this is a bad idea, whether in 6480 or in a mailing list archive someplace. To be clear, I don't feel *especially* strongly about this; I'm mostly just expressing skepticism of the degree of value in this approach. Kyle From nobody Thu Mar 17 07:41:29 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D5903A0BD2 for ; Thu, 17 Mar 2022 07:40:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.109 X-Spam-Level: X-Spam-Status: No, score=-7.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fastly.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z4wFlZmJQsVW for ; Thu, 17 Mar 2022 07:40:42 -0700 (PDT) Received: from mail-ed1-x52c.google.com (mail-ed1-x52c.google.com [IPv6:2a00:1450:4864:20::52c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 390BA3A0A94 for ; Thu, 17 Mar 2022 07:40:42 -0700 (PDT) Received: by mail-ed1-x52c.google.com with SMTP id y22so6853592eds.2 for ; Thu, 17 Mar 2022 07:40:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastly.com; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=fb6zJwh/ErI4Gn3xghrcAVD2ZsVeeDlFIUsrrbXyegk=; b=R6o8pHYA8KC67rxvplV51HEG8QDLoLR6OtVr7h+37T39M/UNE8lSePwGROi9bsCmze 3o20rzCM1lQoI3JyyaOQWIzJ6lUazp8FQoTk20eVOiSKVeQEKF8ilpQ9o4U5G7979+ST 5E0cmXFtKY4g/9m4rom98NL7lkug5f+ttXZ3Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=fb6zJwh/ErI4Gn3xghrcAVD2ZsVeeDlFIUsrrbXyegk=; b=vBMtuLyzWK5ns7jO4MsY3yIz99I08CRNyx+bdMUNffzng5itpUbJLb8V37ZQL+tauu OjflBNbYP/0bf369mcyUzH4NokYNiBlAEayqqBGB+DdjV0Jbf6/wZBKavrYsksFZ2epD alSHCt2uk/dcOomv6RzyPKD9QMzva28P1wlWrGCcVxO3xQ/vrpRLmZBxt8zi8PCXEviY AL8Zd5zW6hh82Xzlsonb8b00fiQrkx+zTx9B1Zt1KnJl7LAgEQMwwUGY0m37UZELqcMP f2Cyjc4LsgzBZw1Yt9i/JhCdskhsWguzRy5sBWIKYc6XeE64kQaaAmP+wF4ZXD9HIz09 0cCQ== X-Gm-Message-State: AOAM530oCRFwRP5jGzNBvmJs6qyeC25R2qcf40UQGXPB6TMpK1J5qvZ5 UW+sDaM2uzizK5zJYYtmn5n7Yw== X-Google-Smtp-Source: ABdhPJzKyfaD+75KjtGXvwVPZVEsDGY/+RKTk+Kfoj+hO+f7Oi6H+F0YZQiLoRxxLTTixpYygaIklQ== X-Received: by 2002:a05:6402:368f:b0:418:e826:1f19 with SMTP id ej15-20020a056402368f00b00418e8261f19mr4830614edb.98.1647528039914; Thu, 17 Mar 2022 07:40:39 -0700 (PDT) Received: from snel ([2a10:3781:276:2:16f6:d8ff:fe47:2eb7]) by smtp.gmail.com with ESMTPSA id u5-20020aa7d985000000b004024027e7dasm2626967eds.28.2022.03.17.07.40.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Mar 2022 07:40:39 -0700 (PDT) Date: Thu, 17 Mar 2022 15:40:37 +0100 From: Job Snijders To: Rob Austein Cc: Benjamin Kaduk , The IESG , sidrops-chairs@ietf.org, morrowc@ops-netman.net, sidrops@ietf.org, draft-ietf-sidrops-6486bis@ietf.org Message-ID: References: <164366773060.21391.16732854790829264927@ietfa.amsl.com> <20220225235526.GY12881@kduck.mit.edu> <20220227002536.3516E2EA009D@minas-ithil.hactrn.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220227002536.3516E2EA009D@minas-ithil.hactrn.net> X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Sidrops] Benjamin Kaduk's Discuss on draft-ietf-sidrops-6486bis-09: (with DISCUSS and COMMENT) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Mar 2022 14:40:58 -0000 Dear Rob, others, On Sat, Feb 26, 2022 at 07:25:36PM -0500, Rob Austein wrote: > Apologies for jumping in late here, I've been distracted by $dayjob > (which has not been RPKI for many years now) and only just saw this. The document's ink didn't dry yet, it wasn't even sent to the printer, so there still is time! :-) I consider your feedback most welcome. See below for my response. > I fear that I must object, strongly, to Job's proposed change: Indeed I was the one to recently submit a suggestion to replace "RECOMMENDED" with "MUST", ... I am not the first to do so! :-) > > > ----- section 4: Manifest Definition ---- > > > > > > OLD section 4.2.1 second paragraph: > > > Because a "one-time-use" EE certificate is employed to verify a > > > manifest, it is RECOMMENDED that the EE certificate have a validity > > > period that coincides with the interval from thisUpdate to nextUpdate > > > in the manifest, to prevent needless growth of the CA's CRL. > > > > > > NEW Section 4.2.1: > > > Because a "one-time-use" EE certificate is employed to verify a > > > manifest, the EE certificate MUST be issued with a validity period > > > that coincides with the interval from thisUpdate to nextUpdate in the > > > manifest, to prevent needless growth of the CA's CRL. > > > > > > ----- Section 5: Manifest Generation ---- > > > > > > OLD Section 5.1 last paragraph: > > > It is RECOMMENDED that the validity interval of the EE > > > certificate exactly match the thisUpdate and nextUpdate times of > > > the manifest. > > > Note: An RP MUST verify all mandated syntactic constraints, i.e., > > > constraints imposed on a CA via a "MUST". > > > > > > NEW section 5.1: > > > The validity interval of the EE certificate MUST exactly match > > > the thisUpdate and nextUpdate times specified in the manifest's > > > eContent. (An RP MUST NOT consider misalignment of the validity > > > interval misalignment in and of itself to be an error.) For people just now catching up on this thread, here is some background: https://datatracker.ietf.org/doc/html/rfc6486#section-4.2 Feb 2012 - (paraphrased) "Manifest nextUpdate MUST equal CRL nextUpdate" The first iteration of the bis-effort draft-ymbk-sidrops-6486bis-00 (July 2020), and the adopted version draft-ietf-sidrops-6486bis-00 (August 2020) up to draft-ietf-sidrops-6486bis-05 (July (2021): all had something along these lines: "Each manifest encompasses a CRL, and the nextUpdate field of the manifest SHOULD match that of the CRL's nextUpdate field, as the manifest will be re-issued when a new CRL is published." Then, in draft-ietf-sidrops-6486bis-06 the MUST was watered down to a RECOMMENDED: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-6486bis-06.txt The 'watering down' happened because it was observed that if RPs would consider validity time window misalignment a hard error, many currently deployed CAs would flip to invalid for no security benefit, see this thread: https://mailarchive.ietf.org/arch/msg/sidrops/VNG77j05I2JXOwv4qkSy-DCgRNE/ My sense of the working group's consensus is that there is a desire to proscribe slightly different behavior for RPs and CAs to ensure that currently deployed CAs are not pointlessly tossed out, but on the other hand encourage future CAs to align their validity time window. This -bis effort (un)fortunately deals with a "brownfield" situation. > This business of pinning the manifiest EE certificate's validity > period to the manifest's thisUpdate/nextUpdate interval has always > been a bad idea, I've objected to it in the WG before, and we have a > long sad history of operational disasters resulting from > implementations that followed that recommendation. > > The typical failure mode (demonstrated at least once each by three of > the RIRs) is to pick a thisUpdate/nextUpdate cycle on the order of a > day or so (reasonable), then go home for a long weekend, during which > something breaks and no new updates occur. I believe that at this point in time, all RIRs have had to "learn the hard way" they must take extreme care to properly monitor and maintain their tree. Be it because of CRL expiration, manifest thisUpdate/nextUpdate, or some other potential for issues: there are many moving parts. In the last 2 years all RIRs have experienced the wrath of upset Relying Parties (or subordinate CAs) when things went south. Luckily, nowadays auxiliary tooling such as BGPAlerter exists which warns (days of even a few hours ahead of time) of the imminent failure of RPKI trees. TA operators should take note of this utility, if they haven't already done so. https://github.com/nttgin/BGPalerter/blob/main/docs/configuration.md#monitorroas At the end of the day, these (and a few other) timers make the event horizon collapse - at some point. The decisions in the RP decision tree are composed of "hard decisions", in the sense that ultimately the verification outcome is quite polarized: valid or invalid. > The manifest thisUpdate/nextUpdate semantics are (deliberately) very > much like the CRL semantics: failure to issue a new manifest by the > nextUpdate time does not automatically invalidate all the existing > data, it's just a hint that something might be wrong. Think of it as > a staleness indication. Slightly stale, log a warning but no big > deal (yet). Gets stale enough, maybe you don't want to eat that. The above paragraph (for me) is a description of a "difficult to implement" procedure, because it does not describe a "hard decision tree" (as is used in today's commonly deployed RP implementations). I consulted with TA operators who told me they appreciate cutting down on divergence between RP implementations, and all TA operators nowadays CLOSELY monitor their trees. I do not intend to update the OpenBSD validator to consider any manifest "current", despite the Manifest's eContent nextUpdate being in the past. I do not anticipate other currently deployed RP implementations to update their implementation from "hard error" to "soft warning" in this context either. > Certificate expiration, on the other hand, is a hard failure. When a > manifest's EE certificate expires without being replaced, the data > listed in the manifest is just gone. > > So when an RIR does this with the manifest directly under their root > certificate, a large portion of the total database goes away. Oops. Right, "don't touch the stove when it is hot". :-) > Manifests only have EE certificates because they're a patch on the > side of X.509. If X.509 had allowed us to sign manifests using the CA > certificate, as with CRLs, we would have done that. But it doesn't, > so we have the manifest EE certificates, OK, but that's no reason to > kill large portions of the database every time an operator near the > root of the tree says "oops". > > All of this has been discussed before, and should be both in WG > archives and in notes from face to face meetings (probably both the > SIDR and SIDROPS WGs, not a new topic). > > My own RPKI CA implementation uses the validity interval of the parent > CA certificate as the validity interval of the manifest EE > certificate, and has for about fifteen years now. I'm not aware of > any operational problems that have arisen as a result. > > Yes, there's a potential issue of a CRL getting too long, but if it > happens at all, it happens at a predictable rate, and one can always > rekey if it's really becoming big enough to be a problem. > > Job's proposed change makes the bad idea a requirement rather than > just bad advice, hence my objection. Indeed, you have not seen operational issues, because the proposed change does not require your CA implementation be changed, as you can rely on the RPs not rejecting the cryptographic products from your CA implementation based on a validity time window misalignment. CA operators are free to set the Manifest's eContent nextUpdate and the CRLs nextUpdate as far into the future as they wish, each CA needs to make a trade-off about how they schedule on-call on the weekends. CA operators can nowadays rely on RP implementations only permitting the narrowest validity window transitively concluded from the entire chain. I appreciate your concern, but think the danger you warn about should be addressed through other methods: be it through pain or monitoring. I hope the above message makes it clear that your concern has been considered. Kind regards, Job From nobody Thu Mar 17 19:51:20 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4AFFD3A1569; Thu, 17 Mar 2022 19:50:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.906 X-Spam-Level: X-Spam-Status: No, score=-1.906 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C9ehPyxOfEvv; Thu, 17 Mar 2022 19:50:21 -0700 (PDT) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6002C3A17D4; Thu, 17 Mar 2022 19:50:21 -0700 (PDT) Received: from fraeml701-chm.china.huawei.com (unknown [172.18.147.226]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4KKT4P0FwQz67XkF; Fri, 18 Mar 2022 10:49:25 +0800 (CST) Received: from kwepeml500003.china.huawei.com (7.221.188.182) by fraeml701-chm.china.huawei.com (10.206.15.50) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2375.24; Fri, 18 Mar 2022 03:50:16 +0100 Received: from kwepeml500004.china.huawei.com (7.221.188.141) by kwepeml500003.china.huawei.com (7.221.188.182) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.21; Fri, 18 Mar 2022 10:50:13 +0800 Received: from kwepeml500004.china.huawei.com ([7.221.188.141]) by kwepeml500004.china.huawei.com ([7.221.188.141]) with mapi id 15.01.2308.021; Fri, 18 Mar 2022 10:50:13 +0800 From: Zhuangshunwan To: "Sriram, Kotikalapudi (Fed)" , Nick Hilliard CC: Ben Maddison , "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: [Sidrops] ASPA and Route Server (was RE: [GROW] IXP Route Server question) Thread-Index: Adg4ggI9zgEhWGRXSB+h1e3Exyc49gB7Ubsw Date: Fri, 18 Mar 2022 02:50:13 +0000 Message-ID: References: In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.108.152.178] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Sidrops] ASPA and Route Server (was RE: [GROW] IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Mar 2022 02:50:27 -0000 SGkgU3JpcmFtIGFuZCBhbGwsDQoNCj4gQW4gUlMgY2xpZW50IG9mIGFuIFJTICh0cmFuc3BhcmVu dCBvciBub3QpIGluY2x1ZGVzIHRoZSBSUyBBUyBpbiB0aGVpcg0KPiBTUEFTL0FTUEEuIFRoZSBS UyBjbGllbnQgYWxzbyBpbmNsdWRlcyBpbiBpdHMgU1BBUy9BU1BBIGFueSBBUyB3aXRoIHdob20g aXQNCj4gY29ubmVjdHMgaW4gdGhlIGNvbnRyb2wgcGxhbmUgdmlhIHRoZSBSUy4NCj4gDQo+IFRo ZSBpZGVhIGlzIHRoYXQgYSBwYXRoIHNlZ21lbnQgQVN4LVJTLUFTeSAod2hlcmUgQVN4IGFuZCBB U3kgYXJlIFJTLWNsaWVudHMNCj4gY29ubmVjdGVkIGluIEJHUCB2aWEgdGhlIFJTKSB3aWxsIGJl IGFsd2F5cyB2ZXJpZmlhYmxlIHdpdGggdGhpcyBwcm9wb3NhbA0KPiB3aGV0aGVyIG9yIG5vdCB0 aGUgUlMgaXMgdHJhbnNwYXJlbnQuIElmIHRoZSBBU1BBcyBhcmUgY3JlYXRlZCBieSBBU3ggYW5k IEFTeQ0KPiBwZXIgdGhlIHByb3Bvc2FsIGFib3ZlLCB0aGVuIHRoZSBBU3gtUlMtQVN5IHNlZ21l bnQgd2lsbCBiZSBldmFsdWF0ZWQgYXMNCj4gVmFsaWQgaW4gZWl0aGVyIGRpcmVjdGlvbi4gSSAg dGhpbmsgdGhpcyBwcm9wb3NhbCBpbiBjb25qdW5jdGlvbiB3aXRoIG90aGVyDQo+IGlkZWFzIGRp c2N1c3NlZCBhYm92ZSB0YWtlcyBjYXJlIG9mIGJvdGggdHJhbnNwYXJlbnQgYW5kIG5vbi10cmFu c3BhcmVudA0KPiBSU3MgaW4gdGhlIEFTUEEgdmVyaWZpY2F0aW9uIGFsZ29yaXRobXMuIERvZXMg dGhpcyBzZWVtIHJlYXNvbmFibGU/DQoNCltTV10gSU1PLCB0aGlzIGlkZWEgZXNzZW50aWFsbHkg c29sdmVzIHRoZSBwcm9ibGVtIG9mIEFTUEEgdmVyaWZpY2F0aW9uLg0KUmVnYXJkaW5nICJUaGUg UlMgY2xpZW50IGFsc28gaW5jbHVkZXMgaW4gaXRzIFNQQVMvQVNQQSBhbnkgQVMgd2l0aCB3aG9t IGl0IGNvbm5lY3RzIGluIHRoZSBjb250cm9sIHBsYW5lIHZpYSB0aGUgUlMuIiwgIGlzIHRoaXMg ZXF1aXZhbGVudCB0byBzaWduIHRoZSBBUyBwYWlyIG9mIHRoZSBQMlAgYXMtcmVsYXRpb25zaGlw IHRvIHRoZSBBU1BBIGRhdGFiYXNlPw0KQmFjayB0byBTZWN0aW9uIDUuMywgaXQgc2FpZCAiQSBy b3V0ZSByZWNlaXZlZCBmcm9tIGEgUlMgYXQgSVggaGFzIG11Y2ggaW4gY29tbW9uIHdpdGggcm91 dGUgcmVjZWl2ZWQgZnJvbSBhIHByb3ZpZGVyLiIgQWN0dWFsbHkgSSBhbHNvIHRoaW5rIHRoYXQg IkEgcm91dGUgcmVjZWl2ZWQgZnJvbSBQMlAgQkdQIG5laWdoYm9yIGhhcyBtdWNoIGluIGNvbW1v biB3aXRoIHJvdXRlIHJlY2VpdmVkIGZyb20gYSBwcm92aWRlci4gKGZvciBBU1BBIHZhbGlkYXRp b24gcHVycG9zZXMgb25seSkiLiBEb2VzIHRoaXMgc2VlbSByZWFzb25hYmxlPw0KDQpUaGFua3Ms DQpTaHVud2FuDQoNCj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gRnJvbTogU2lkcm9w cyBbbWFpbHRvOnNpZHJvcHMtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIFNyaXJhbSwN Cj4gS290aWthbGFwdWRpIChGZWQpDQo+IFNlbnQ6IFR1ZXNkYXksIE1hcmNoIDE1LCAyMDIyIDEx OjM0IFBNDQo+IFRvOiBOaWNrIEhpbGxpYXJkIDxuaWNrQGZvb2Jhci5vcmc+DQo+IENjOiBCZW4g TWFkZGlzb24gPGJlbm1Ad29ya29ubGluZS5hZnJpY2E+OyBncm93QGlldGYub3JnOw0KPiBzaWRy b3BzQGlldGYub3JnDQo+IFN1YmplY3Q6IFtTaWRyb3BzXSBBU1BBIGFuZCBSb3V0ZSBTZXJ2ZXIg KHdhcyBSRTogW0dST1ddIElYUCBSb3V0ZSBTZXJ2ZXINCj4gcXVlc3Rpb24pDQo+IA0KPiBOaWNr IChhbmQgYWxsKSwNCj4gDQo+IEkgd2FzIGFsc28gcmVyZWFkaW5nL3Jldmlld2luZyBTZWN0aW9u IDUuMyBhbmQgaGFkIHNpbWlsYXIgdGhvdWdodHMgYWJvdXQNCj4gdGhlIHR3byBvcHRpb25zIHlv dSBvdXRsaW5lZC4gQXMgeW91IG5vdGVkLCAidGhlIGFwcHJvYWNoIGluIFNlY3Rpb24gNS4zDQo+ IGdpdmVzIGEgd29ya2FibGUgb3V0Y29tZSIuICBIb3dldmVy4oCmDQo+IA0KPiA+Li4uIHRoZSBS UyBzaG91bGQgYmUgdHJlYXRlZCBhcyBhIHByb3ZpZGVyIGJ5IHRoZSBycyBjbGllbnQ7IHRoZSBy cyBjbGllbnQNCj4gc2hvdWxkIGluY2x1ZGUgdGhlIFJTIEFTTiBpbiBpdHMgU1BBUzsgdGhlIHJz IGNsaWVudCBzaG91bGQgZXZhbHVhdGUgQVNQQSBhcyBpZg0KPiB0aGUgUlMgQVNOIHdlcmUgaW5j bHVkZWQgaW4gdGhlIHBhdGg7IHRoZSBycyBzaG91bGQgZXZhbHVhdGUgY2xpZW50cyBhcw0KPiBj dXN0b21lcnMNCj4gDQo+IFllcywgSSBhZ3JlZSB0aGF0ICJ0aGUgcnMgY2xpZW50IHNob3VsZCBp bmNsdWRlIHRoZSBSUyBBU04gaW4gaXRzIFNQQVMuIg0KPiBBbGV4YW5kZXIgYW5kIEkgaGF2ZSB0 YWxrZWQgYWJvdXQgdGhpcywgYW5kIGhlIG1lbnRpb25lZCB0aGF0IHRoaXMgd291bGQgYmUNCj4g YWRkZWQgdG8gdGhlIGRyYWZ0Lg0KPiANCj4gWWVzLCBJIGFsc28gZmVlbCB0aGF0IGl0IGlzIGEg YmV0dGVyIG9wdGlvbiB0aGF0IHRoZSBSUyBjbGllbnQgYWRkcyB0aGUgQVNOIG9mIHRoZQ0KPiB0 cmFuc3BhcmVudCBSUyB0byB0aGUgQVMgcGF0aCAoZm9yIEFTUEEgdmFsaWRhdGlvbiBwdXJwb3Nl cyBvbmx5KSBhbmQNCj4gYXBwbGllcyB0aGUgZG93bnN0cmVhbSBBU1BBIGFsZ29yaXRobS4gQWxn b3JpdGhtaWNhbGx5IHRoaXMgc2VlbXMgbW9yZQ0KPiBhcHByb3ByaWF0ZS4gVGhpcyBpcyBhbHNv IGJldHRlciBmcm9tIGEgZGlhZ25vc3RpY3MgcG9pbnQgb2YgdmlldyAoaWYgdGhlIG5lZWQNCj4g ZXZlciBhcmlzZXMpIGJlY2F1c2UgaW4gdGhpcyBhcHByb2FjaCB0aGUgcmVsZXZhbnQgQVNQQSBp cyB1c2VkIGZvciB2YWxpZGF0aW5nDQo+IHRoZSBob3AgZnJvbSB0aGUgQVMganVzdCBiZWZvcmUg dGhlIFJTIHRvIHRoZSBSUy4NCj4gDQo+IFRoYXQgc2FpZCwgSSB0aGluayB0aGVyZSBpcyBhIGJp Z2dlciBpc3N1ZSBhYm91dCB0cmFuc3BhcmVudCBSUyBpbiB0aGUgbWlkZGxlIG9mDQo+IHRoZSBB UyBwYXRoLiBNYXliZSB0aGlzIGlzIHdoYXQgQmVu4oCZcyBxdWVzdGlvbiB3YXMgaGludGluZyBh dC4gSSB0aGluayB5b3UNCj4gYXJlIGFsc28gcmFpc2luZyB0aGlzIGlzc3VlIHdoZW4geW91IHNh eToNCj4gDQo+ID5SU3MgZG8gbm90IHBhcnRha2UgaW4gdHJhZmZpYyBmb3J3YXJkaW5nLCBzbyB0 aGV5IGFyZSBub3QgcGFydCBvZiB0aGUgZGF0YQ0KPiBwYXRoIGJldHdlZW4gdHdvIEFTTnM7IHRo ZXkncmUgb25seSBwYXJ0IG9mIHRoZSBzaWduYWxpbmcgcGF0aCBiZXR3ZWVuIHRoZQ0KPiB0d28g QVNOcy4gIFRoaXMgaXMgYSB1c2VmdWwgaGFjayBmcm9tIGEgcHJhY3RpY2FsIHBvaW50IG9mIHZp ZXcsIGJ1dCBpdCBjYXVzZXMNCj4gYWxnb3JpdGhtaWMgYnJlYWthZ2UgaW4gcGxhY2VzIHdoaWNo IGFzc3VtZSBjb25ncnVlbmN5IGJldHdlZW4gdGhlIGRhdGENCj4gcGxhbmUgYW5kIHRoZSBzaWdu YWxpbmcgcGxhbmUuICBPbmUgb2YgdGhlc2UgcGxhY2VzIGlzIEFTIHBhdGggdmVyaWZpY2F0aW9u Lg0KPiANCj4gPiDigKYuQVNQQSB2ZXJpZmljYXRpb24gc2hvdWxkIHByb2NlZWQgYXMgaWYgdGhl IHR3byBycy1jbGllbnQgQVNOcyB3ZXJlDQo+IGRpcmVjdGx5IGNvbm5lY3RlZCBhbmQgZWFjaCBz aG91bGQgdHJlYXQgdGhlIG90aGVyIGFzIGEgcHJvdmlkZXINCj4gDQo+IEJhc2VkIG9uIHRoZSBh Ym92ZSBvYnNlcnZhdGlvbnMgZnJvbSB5b3UsIEkgYW0gcHJvcG9zaW5nIHRoZSBmb2xsb3dpbmc6 DQo+IA0KPiBBbiBSUyBjbGllbnQgb2YgYW4gUlMgKHRyYW5zcGFyZW50IG9yIG5vdCkgaW5jbHVk ZXMgdGhlIFJTIEFTIGluIHRoZWlyDQo+IFNQQVMvQVNQQS4gVGhlIFJTIGNsaWVudCBhbHNvIGlu Y2x1ZGVzIGluIGl0cyBTUEFTL0FTUEEgYW55IEFTIHdpdGggd2hvbSBpdA0KPiBjb25uZWN0cyBp biB0aGUgY29udHJvbCBwbGFuZSB2aWEgdGhlIFJTLg0KPiANCj4gVGhlIGlkZWEgaXMgdGhhdCBh IHBhdGggc2VnbWVudCBBU3gtUlMtQVN5ICh3aGVyZSBBU3ggYW5kIEFTeSBhcmUgUlMtY2xpZW50 cw0KPiBjb25uZWN0ZWQgaW4gQkdQIHZpYSB0aGUgUlMpIHdpbGwgYmUgYWx3YXlzIHZlcmlmaWFi bGUgd2l0aCB0aGlzIHByb3Bvc2FsDQo+IHdoZXRoZXIgb3Igbm90IHRoZSBSUyBpcyB0cmFuc3Bh cmVudC4gSWYgdGhlIEFTUEFzIGFyZSBjcmVhdGVkIGJ5IEFTeCBhbmQgQVN5DQo+IHBlciB0aGUg cHJvcG9zYWwgYWJvdmUsIHRoZW4gdGhlIEFTeC1SUy1BU3kgc2VnbWVudCB3aWxsIGJlIGV2YWx1 YXRlZCBhcw0KPiBWYWxpZCBpbiBlaXRoZXIgZGlyZWN0aW9uLiBJICB0aGluayB0aGlzIHByb3Bv c2FsIGluIGNvbmp1bmN0aW9uIHdpdGggb3RoZXINCj4gaWRlYXMgZGlzY3Vzc2VkIGFib3ZlIHRh a2VzIGNhcmUgb2YgYm90aCB0cmFuc3BhcmVudCBhbmQgbm9uLXRyYW5zcGFyZW50DQo+IFJTcyBp biB0aGUgQVNQQSB2ZXJpZmljYXRpb24gYWxnb3JpdGhtcy4gRG9lcyB0aGlzIHNlZW0gcmVhc29u YWJsZT8NCj4gDQo+IFRoYW5rIHlvdS4NCj4gDQo+IFNyaXJhbQ0KPiANCj4gX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gU2lkcm9wcyBtYWlsaW5nIGxp c3QNCj4gU2lkcm9wc0BpZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3NpZHJvcHMNCg== From nobody Sun Mar 20 06:29:00 2022 Return-Path: X-Original-To: sidrops@ietf.org Delivered-To: sidrops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CC4CC3A0A42; Sun, 20 Mar 2022 06:28:57 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: sidrops@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.46.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: sidrops@ietf.org Message-ID: <164778293776.16673.1673261240391367587@ietfa.amsl.com> Date: Sun, 20 Mar 2022 06:28:57 -0700 Archived-At: Subject: [Sidrops] I-D Action: draft-ietf-sidrops-6486bis-10.txt X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Mar 2022 13:28:58 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the SIDR Operations WG of the IETF. Title : Manifests for the Resource Public Key Infrastructure (RPKI) Authors : Rob Austein Geoff Huston Stephen Kent Matt Lepinski Filename : draft-ietf-sidrops-6486bis-10.txt Pages : 18 Date : 2022-03-20 Abstract: This document defines a "manifest" for use in the Resource Public Key Infrastructure (RPKI). A manifest is a signed object (file) that contains a listing of all the signed objects (files) in the repository publication point (directory) associated with an authority responsible for publishing in the repository. For each certificate, Certificate Revocation List (CRL), or other type of signed objects issued by the authority that are published at this repository publication point, the manifest contains both the name of the file containing the object and a hash of the file content. Manifests are intended to enable a relying party (RP) to detect certain forms of attacks against a repository. Specifically, if an RP checks a manifest's contents against the signed objects retrieved from a repository publication point, then the RP can detect replay attacks, and unauthorized in-flight modification or deletion of signed objects. This document obsoletes RFC 6486. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidrops-6486bis/ There is also an htmlized version available at: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-6486bis-10 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-6486bis-10 Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts From nobody Sun Mar 20 06:44:23 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DCF23A0A79 for ; Sun, 20 Mar 2022 06:44:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.106 X-Spam-Level: X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DC_PNG_UNO_LARGO=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fastly.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DKXs3muFg0oE for ; Sun, 20 Mar 2022 06:44:15 -0700 (PDT) Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 361903A0A8C for ; Sun, 20 Mar 2022 06:44:15 -0700 (PDT) Received: by mail-io1-xd36.google.com with SMTP id q11so14176265iod.6 for ; Sun, 20 Mar 2022 06:44:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastly.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ex27BALJpxhFKg7V6obfNnDM6hoD5kbva65ECC64dW4=; b=JWI/QW6inopuTdy7Hy0bhPK9ViQiw6OtfIvb8ZKyGU9D6KxbWRRuEw64ow8PhDvuA9 QzEron2DUrY/DA4Wtdzv6qBFJMAm6rVFZpzIbrue0yKcG5TRw5Hl5BTBeznEYukqTpzC 7fwkLxo6MiBy0ZRwRiIFYk40gcjwtmlRUBwwc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ex27BALJpxhFKg7V6obfNnDM6hoD5kbva65ECC64dW4=; b=ZVesdykOefcmp64XfRdwz/9T3qp2Qb4vq4XFdXtmXIiMxY9SgQRr6YybLbjzPKUG9F mJuI0X3Ba8HmujkulpEx3w8aPMwH1uM+xLv4ytJdYq0AndB8XwE3JNY5gtQapRaPgGIQ Mp3+LoEesfsHGGQQvhSBDd00ZgeOYFEM2DiCOSM0KUuUe56cU12WmIzLqrqMQnUsrV28 Ls1U+uCQOFNL0qn/t3dVNXGILehB+EavO6XNdwJzm1PE2qsKJggRYAO6Fse+4z1OQVz4 qGRtjH9Svdh9WadgsW3sJpXyDPcgnGTvbewYvXW5l/kyjQt2bqj0zbpqaLTuhkhbzzHl AD9w== X-Gm-Message-State: AOAM5322hiwqe01i21SmxhzzXQOmMRKZQlUX5ifu1eeYDvfIwHyezODa BVMGVlyk30CAUMfYfrBSObaHzTPpiwoRWMgUWbG83w== X-Google-Smtp-Source: ABdhPJxie/9b2wFYzgFWl0HXe+qwSQUmew1RR8kstLL3qe/aPWx6bceBooguF0/AXtg3rJeWDEyK/XyT4oH++HFtDnk= X-Received: by 2002:a02:aa0b:0:b0:317:c63a:6625 with SMTP id r11-20020a02aa0b000000b00317c63a6625mr8611242jam.222.1647783853806; Sun, 20 Mar 2022 06:44:13 -0700 (PDT) MIME-Version: 1.0 References: <164366773060.21391.16732854790829264927@ietfa.amsl.com> <20220225235526.GY12881@kduck.mit.edu> In-Reply-To: <20220225235526.GY12881@kduck.mit.edu> From: Job Snijders Date: Sun, 20 Mar 2022 14:44:02 +0100 Message-ID: To: Benjamin Kaduk Cc: The IESG , draft-ietf-sidrops-6486bis@ietf.org, morrowc@ops-netman.net, sidrops@ietf.org, sidrops-chairs@ietf.org Content-Type: multipart/related; boundary="0000000000004623c405daa69340" Archived-At: Subject: Re: [Sidrops] Benjamin Kaduk's Discuss on draft-ietf-sidrops-6486bis-09: (with DISCUSS and COMMENT) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Mar 2022 13:44:21 -0000 --0000000000004623c405daa69340 Content-Type: multipart/alternative; boundary="0000000000004623c305daa6933f" --0000000000004623c305daa6933f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Dear Benjamin, others, A new version has been uploaded - which addresses all IESG input, including the notion of a potential for interoperability as pointed out by Benjamin. The new text brings the bis document back closer to the original RFC, and earlier versions of the bis draft. My perception is that most large scale operational stakeholders both on CA and RP side expect behaviour as outlined in -10: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidrops-6486bis-10.txt Not everyone agrees fully, one author raised a concern: https://mailarchive.ietf.org/arch/msg/sidrops/-fZC3suTFyGSe1tRhyFY5UOgAMw/ To which I responded as following: https://mailarchive.ietf.org/arch/msg/sidrops/YhMOdHIW4ACR4wZVMvOMQW__Db4/ I believe there no longer are any outstanding action items. https://sobornost.net/~job/my_job_here_is_done.gif Kind regards, Job On Sat, 26 Feb 2022 at 00:55, Benjamin Kaduk wrote: > Hi Job, > > My pleasure! Sorry to have taken a bit long to get back to you. > > On Fri, Feb 11, 2022 at 01:16:26PM +0100, Job Snijders wrote: > > Dear Benjamin, > > > > To me it's always is a pleasure to receive your thorough reviews. Thank > > you for sharing your insights! > > > > On Mon, Jan 31, 2022 at 02:22:11PM -0800, Benjamin Kaduk via Datatracke= r > wrote: > > > ---------------------------------------------------------------------= - > > > DISCUSS: > > > ---------------------------------------------------------------------= - > > > > > > It looks like we may have a setup where a compliant RP and compliant > > > CA/repository fail to interoperate. This is sufficiently surprising > that > > > I want to confirm that it's the intended behavior. In particular, bo= th > > > manifests and CRLs have thisUpdate and nextUpdate fields, and since > > > issuing an update to one requires issuing an update to the other > (though > > > the CRL is always actually generated first), it is only natural for u= s > to > > > give guidance that the times in question should match between manifes= t > and > > > corresponding CRL. However, we do this only as > RECOMMENDED/SHOULD-level > > > guidance, and accompany it by guidance to RPs that they SHOULD NOT > reject > > > a manifest of the fields do not match the CRL. Accordingly, when a C= A > > > violates the first SHOULD and issues manifeset+CRL with mismatched > > > thisUpdate/nextUpdate, and an RP violates the second SHOULD (NOT) and > > > rejects such a setup, the RP will be unable to get any RPKI data for > that > > > CA. (As a tangent, we also have one place where we give related > guidance > > > that the validity period of the single-use EE cert that signs the > manifest > > > match the thisUpdate/nextUpdate period, which we might want to keep i= n > > > mind if we make any changes in this space.) > > > > > > It looks like RFC 6486 had a conditional MUST-level requirement that > *if* a > > > manifest encompasses a CRL, then the "nextUpdate" fields MUST match (= no > > > guidance on thisUpdate), which we change to a statement of fact that > each > > > manifest does encompass a CRL and guidance that the "nextUpdate"s > SHOULD > > > match. > > > Additionally, RFC 6486 had a MUST-level requirement for the validity > > > period of the EE cert to exactly match the thisUpdate/nextUpdate time > > > interval of the manifest, which we currently are relaxing to a SHOULD= . > > > > > > Often in this scenario we would strengthen one of the SHOULDs to be a > > > MUST so that interoperability is guaranteed, but I'm not sure that I > see a > > > clear argument for which requirement is better to make the MUST. > > > > I agree with your analysis and think your suggestion to reinforce one o= f > > the two SHOULDs into a MUST is a reasonable way to resolve this frictio= n. > > From my perspective, upgrading some normative terms in this context > > won't be perceived as controversial by the WG, as the current 'watered > > down' text is the result of concerns in relationship to retaining > > interopability with CAs 'in the field'. > > > > Some background on the ability for RP's to deploy a strict ("MUST") at > > this point in time: > https://mailarchive.ietf.org/arch/msg/sidrops/VNG77j05I2JXOwv4qkSy-DCgRNE= / > > > > One CA implementation rectified the lack of validity window alignment: > > > https://github.com/NLnetLabs/krill/commit/51c58ec58b266697dd1843a5504e79b= fc385932d > > There appears to be agreement enforcing alignment on the CA side 'going > > forward', while RPs remain relaxed: > > > https://mailarchive.ietf.org/arch/msg/sidrops/W-SrezAc5Oa1HoTW0w64EdaD1gk= / > > > > Thus, I propose the following adjustments to resolve this DISCUSS. > > > > ----- section 4: Manifest Definition ---- > > > > OLD section 4.2.1 second paragraph: > > Because a "one-time-use" EE certificate is employed to verify a > > manifest, it is RECOMMENDED that the EE certificate have a validity > > period that coincides with the interval from thisUpdate to nextUpdat= e > > in the manifest, to prevent needless growth of the CA's CRL. > > > > NEW Section 4.2.1: > > Because a "one-time-use" EE certificate is employed to verify a > > manifest, the EE certificate MUST be issued with a validity period > > that coincides with the interval from thisUpdate to nextUpdate in th= e > > manifest, to prevent needless growth of the CA's CRL. > > > > ----- Section 5: Manifest Generation ---- > > > > OLD Section 5.1 last paragraph: > > It is RECOMMENDED that the validity interval of the EE > > certificate exactly match the thisUpdate and nextUpdate times of > > the manifest. > > Note: An RP MUST verify all mandated syntactic constraints, i.e.= , > > constraints imposed on a CA via a "MUST". > > > > NEW section 5.1: > > The validity interval of the EE certificate MUST exactly match > > the thisUpdate and nextUpdate times specified in the manifest's > > eContent. (An RP MUST NOT consider misalignment of the validity > > interval misalignment in and of itself to be an error.) > > This seems like a good approach to me, thanks. > In this last chunk, should we add a clause at the beginning of the > parenthetical like "In order to remain compatible with implementations of= a > previous version of this specification", to motivate the "MUST NOT"? > > > > ---------------------------------------------------------------------= - > > > COMMENT: > > > ---------------------------------------------------------------------= - > > > > > > My reading of the changes in the diff from RFC 6486 indicate that > there is > > > something of a fundamental shift in the processing model being made, > but > > > this does not seem to be mentioned specifically in the list of change= s > in > > > Appendix B (or the introduction/abstract). Specifically, it seems th= at > > > the old RFC 6486 model involved the manifest being a tool that's usef= ul > > > for the RP and SHOULD be used, but that ultimately the RP policy > decides > > > which signed objects from the repository to use and fundamentally > places > > > trust in the signatures on those objects; the new model in this draft > > > seems to place the manifest as the primary control on what signed > objects > > > to use, with phrasing like "MUST use the current manifest"/"files not > > > listed on the manifest MUST NOT be used" and the error-handling > behavior > > > in =C2=A76.6 being to fall back to the previous cached state (at a > SHOULD-level > > > requirement), which as I understand it would mean using the previous > > > cached manifest. (Maybe I'm wrong about that last bit.) While the ne= w > > > focus doesn't seem problematic per se, and it's perfectly reasonable > from > > > a process perspective to make that sort of behavior change in a > Proposed > > > Standard, it seems that if this was a deliberate decision it ought to > be > > > emphasized a bit more. The final bullet point in the change list of > > > removing the notion of "local policy" is perhaps related to this > > > fundamental shift, but seems to only cover part of the shift. > > > > I appreciate the observations in the above text, but don't see an > > actionable remark. However, I can provide a bit of background: > > > > A write-up on the /why/ of RPKI Manifests can be found here: > > > https://blog.apnic.net/2020/11/10/rpki-manifests-securely-declare-content= s/ > > > > Manifests are the only way to verify the completeness of a SET of signe= d > > objects. The notion of 'local policy' in the original RFC appears to > > have been the result of an awkward compromise (this was before my time)= . > > I think by now all implementers understand that just like car seatbelts= , > > Manifests are not optional, and never were optional. > > The background is much appreciated, thanks. > > My intention here was mostly to ask for another bullet point in the list = of > changes in Appendix B. In light of the above clarifiations, it might tak= e > the form of replacing the last bullet ("Removed the notion of 'local > policy'") or it might be a standalone point. If replacing/modifying the > existing item, maybe: > > * Clarified that use of a manifest is the only way to ensure that a > consistent and complete view of a publication point's contents is used, > removing the notion of "local policy" that modifies manifest processing > and use. > > There might also be room for wording tweaks in the Abstract/Introduction = to > reflect this change of emphasis, but I'm inclined to say that the potenti= al > benefit is not really worth the effort of thinking about them. > > > > Section 3 > > > > > > The CA MUST sign only one manifest with each generated private key= , > > > and MUST generate a new key pair for each new version of the > > > manifest. This form of use of the associated EE certificate is > > > termed a "one-time-use" EE certificate [RFC6487] > > > > > > Not really a comment on *this* document (6486bis), but since RFC 6487 > > > generically defines the "sequential use" EE certificate that we are > > > disallowing for RPKI Manifest use, it seems reasonable to ask whether > the > > > issues that cause us to forbid sequential use in this context might > also > > > apply to other scenarios where "sequential use" certificates might ha= ve > > > been used. (I did not make a survey of the RPKI specification corpus > to > > > investigate whether such scenarios are likely to exist.) > > > > I didn't perform an extensive survey either, but AFAIK the Manifest -bi= s > > document is one of the few places to be so explicit about the use of > > one-time-use certificates. I believe the primary motivation for this > > requirement is that Manifests / CRLs are the "#1 top churning object" > > type in the RPKI ecosystem. CRLs (and thus Manifests) generally have a > > validity window measured in hours, whereas other object types such as > > ROAs often times have a validity window of 12 to 18 months, or longer. > > > > I expect that going forward, where needed, new object types or -bis > > documents will be mor explicit whether to "recycle keypairs" or mandate > > one-time-use. > > > > As you highlighted, your above comment is not really a comment on *this= * > > document. > > Indeed, no action for this document, and thanks for the insight into the > RPKI ecosystem. > > > > Section 4.2.1 > > > > > > fileHashAlg: > > > This field contains the OID of the hash algorithm used to hash > the > > > files that the authority has placed into the repository. The > hash > > > algorithm used MUST conform to the RPKI Algorithms and Key Size > > > Profile specification [RFC6485]. > > > > > > RFC 6485 has been obsoleted by RFC 7935. > > > > Correct, this has been rectified in my working copy, also noted in > > > https://mailarchive.ietf.org/arch/msg/sidrops/NzCcNzcN46FD7RgV3D5ULMnEhxs= / > > > > > Section 5.1 > > > > > > 2. Issue an EE certificate for this key pair. The CA MUST revoke > > > the EE certificate used for the manifest being replaced. > > > > > > Do the mechanics of revocation still need to be undertaken even if th= e > EE > > > certificate in question has expired? > > > > No, in the wild one can observe how the property of expired Manifest EE > > certificates is a helpful utility to prevent needless growth of CRLs. > > Also, trimming of CRLs is permitted. Do you have suggested text to > > capture that in a concise succinct manner? Or leave as-is? > > Maybe "revoke or otherwise ensure invalidity of"? > > > > Section 6.x > > > > > > The old RFC 6486 procedures allowed ("MAY") the RP to verify that eac= h > > > file at a publication point is listed in exactly one current manifest= , > > > which is no longer allowed. I think I can see how this was a > problematic > > > thing to try, but want to confirm that it is intentionally removed. > > > > Ack. > > > > > Similarly, RFC 6486 wanted a warning produced if there were objects > > > present in the repository that are not listed in any manifest, which > does > > > not seem particularly useful and I do not mind seeing removed. > > > > Ack. > > > > > RFC 6486 also wanted a warning issued if a publication point containe= d > > > both valid and invalid manifests; removing that guidance seems correc= t > to > > > me. > > > > Ack. > > > > > Section 6.3 > > > > > > The two "proceed to Section 6.4"s seem redundant (I suggest removing > the > > > last one). > > > > > > Section 6.5 > > > > > > the publication point. If the computed hash value of a file liste= d > > > on the manifest does not match the hash value contained in the > > > manifest, then the fetch has failed and the RP MUST proceed to > > > Section 6.6; otherwise proceed to Section 6.6. > > > > > > This looks an awful lot like "if X; goto Y; else; goto Y", which coul= d > > > just be written as "goto Y". However, since =C2=A76.6 is the "failed > fetches" > > > processing, in the successful verification case perhaps we don't want > to > > > do that and should instead proceed to use the content of the files > listed > > > in the manifest. > > > > Nice catch! I'll remove the last sentnce. > > > > > Section 8 > > > > > > Perhaps it is sufficiently obvious so as to go without saying, but I > trust > > > that in a prolonged period of failed fetches, the human operator is > > > expected to go figure out (via out of band channels) what's up with t= he > > > CA/repository in question and whether an attack is underway. > > > > > > The requirement for every repository > > > publication point to contain at least one manifest allows an RP to > > > determine if the manifest itself has been occluded from view. [..= .] > > > > > > Do we want to say anything about how these properties change during a > CA > > > key rollover or if multiple "unrelated" CAs are publishing at the sam= e > > > publication point (the latter of which would be quite unusual, if I > > > understand correctly)? > > > > Multiple 'repositories' can exist in a single rsync directory, akin to > > how multiple CA Repositories can be fetched via a single RRDP > > publication server. My preference would be to leave this as-is, I do no= t > > recall a perception of ambiguity in the wider CA operator community abo= u > > this aspect. > > Okay, let's leave it as-is, then. > > > > Section 9 > > > > > > I see that the latest update from IANA has the registry (entry) > references > > > being updated from RFC 6488 to [this document], which is great and > > > obviates what I would otherwise have remarked upon. > > > > Ack. > > > > > Section 11.1 > > > > > > Now that we're obsoleting RFC 6486, that should probably bump it off > into > > > the Informative References section. > > > > Done! > > > > > RFCs 6482, 6493, 8209, and 8488 appear to not actually be referenced > > > from anywhere and thus could probably be removed. > > > > Done, this was addressed in > > > https://mailarchive.ietf.org/arch/msg/sidrops/NzCcNzcN46FD7RgV3D5ULMnEhxs= / > > > > > Section 11.2 > > > > > > Do we really want to reference RFC 3370 ("CMS Algorithms") for "the C= MS > > > wrapper of the object" rather than something like RFC 5652 ("CMS")? > > > > Good suggestion, I've replaced 3370 with 5652. > > > > Please let me know if the suggested changes to Section 4 and 5 seem > > appropriate, if so I'll make the changes and share a patchset. > > They look good; please go ahead and publish at your convenience. > > Thanks again, > > Ben > --0000000000004623c305daa6933f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Dear Benjamin, others,

<= div dir=3D"auto">A new version has been uploaded - which addresses all IESG= input, including the notion of a potential for interoperability as pointed= out by Benjamin.

The ne= w text brings the bis document back closer to the original RFC, and earlier= versions of the bis draft. My perception is that most large scale operatio= nal stakeholders both on CA and RP side expect behaviour as outlined in -10= :

Not everyone agrees fully, one author raised a concern:=C2=A0

=
I believe there no longer are any outstanding a= ction items. https://sobornost.net/~job/my_job_here_is_done.gif

Kind regards= ,

Job
On Sat, = 26 Feb 2022 at 00:55, Benjamin Kaduk <k= aduk@mit.edu> wrote:
Hi Job,

My pleasure!=C2=A0 Sorry to have taken a bit long to get back to you.

On Fri, Feb 11, 2022 at 01:16:26PM +0100, Job Snijders wrote:
> Dear Benjamin,
>
> To me it's always is a pleasure to receive your thorough reviews. = Thank
> you for sharing your insights!
>
> On Mon, Jan 31, 2022 at 02:22:11PM -0800, Benjamin Kaduk via Datatrack= er wrote:
> > -----------------------------------------------------------------= -----
> > DISCUSS:
> > -----------------------------------------------------------------= -----
> >
> > It looks like we may have a setup where a compliant RP and compli= ant
> > CA/repository fail to interoperate.=C2=A0 This is sufficiently su= rprising that
> > I want to confirm that it's the intended behavior.=C2=A0 In p= articular, both
> > manifests and CRLs have thisUpdate and nextUpdate fields, and sin= ce
> > issuing an update to one requires issuing an update to the other = (though
> > the CRL is always actually generated first), it is only natural f= or us to
> > give guidance that the times in question should match between man= ifest and
> > corresponding CRL.=C2=A0 However, we do this only as RECOMMENDED/= SHOULD-level
> > guidance, and accompany it by guidance to RPs that they SHOULD NO= T reject
> > a manifest of the fields do not match the CRL.=C2=A0 Accordingly,= when a CA
> > violates the first SHOULD and issues manifeset+CRL with mismatche= d
> > thisUpdate/nextUpdate, and an RP violates the second SHOULD (NOT)= and
> > rejects such a setup, the RP will be unable to get any RPKI data = for that
> > CA.=C2=A0 (As a tangent, we also have one place where we give rel= ated guidance
> > that the validity period of the single-use EE cert that signs the= manifest
> > match the thisUpdate/nextUpdate period, which we might want to ke= ep in
> > mind if we make any changes in this space.)
> >
> > It looks like RFC 6486 had a conditional MUST-level requirement t= hat *if* a
> > manifest encompasses a CRL, then the "nextUpdate" field= s MUST match (no
> > guidance on thisUpdate), which we change to a statement of fact t= hat each
> > manifest does encompass a CRL and guidance that the "nextUpd= ate"s SHOULD
> > match.
> > Additionally, RFC 6486 had a MUST-level requirement for the valid= ity
> > period of the EE cert to exactly match the thisUpdate/nextUpdate = time
> > interval of the manifest, which we currently are relaxing to a SH= OULD.
> >
> > Often in this scenario we would strengthen one of the SHOULDs to = be a
> > MUST so that interoperability is guaranteed, but I'm not sure= that I see a
> > clear argument for which requirement is better to make the MUST.<= br> >
> I agree with your analysis and think your suggestion to reinforce one = of
> the two SHOULDs into a MUST is a reasonable way to resolve this fricti= on.
> From my perspective, upgrading some normative terms in this context > won't be perceived as controversial by the WG, as the current '= ;watered
> down' text is the result of concerns in relationship to retaining<= br> > interopability with CAs 'in the field'.
>
> Some background on the ability for RP's to deploy a strict ("= MUST") at
> this point in time: h= ttps://mailarchive.ietf.org/arch/msg/sidrops/VNG77j05I2JXOwv4qkSy-DCgRNE/
>
> One CA implementation rectified the lack of validity window alignment:=
> https://githu= b.com/NLnetLabs/krill/commit/51c58ec58b266697dd1843a5504e79bfc385932d > There appears to be agreement enforcing alignment on the CA side '= going
> forward', while RPs remain relaxed:
> https://mailarchive.i= etf.org/arch/msg/sidrops/W-SrezAc5Oa1HoTW0w64EdaD1gk/
>
> Thus, I propose the following adjustments to resolve this DISCUSS.
>
> ----- section 4: Manifest Definition ----
>
> OLD section 4.2.1 second paragraph:
>=C2=A0 =C2=A0 Because a "one-time-use" EE certificate is empl= oyed to verify a
>=C2=A0 =C2=A0 manifest, it is RECOMMENDED that the EE certificate have = a validity
>=C2=A0 =C2=A0 period that coincides with the interval from thisUpdate t= o nextUpdate
>=C2=A0 =C2=A0 in the manifest, to prevent needless growth of the CA'= ;s CRL.
>
> NEW Section 4.2.1:
>=C2=A0 =C2=A0 Because a "one-time-use" EE certificate is empl= oyed to verify a
>=C2=A0 =C2=A0 manifest, the EE certificate MUST be issued with a validi= ty period
>=C2=A0 =C2=A0 that coincides with the interval from thisUpdate to nextU= pdate in the
>=C2=A0 =C2=A0 manifest, to prevent needless growth of the CA's CRL.=
>
> ----- Section 5: Manifest Generation ----
>
> OLD Section 5.1 last paragraph:
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 It is RECOMMENDED that the validity interva= l of the EE
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate exactly match the thisUpdate an= d nextUpdate times of
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 the manifest.
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Note: An RP MUST verify all mandated syntac= tic constraints, i.e.,
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 constraints imposed on a CA via a "MUS= T".
>
> NEW section 5.1:
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 The validity interval of the EE certificate= MUST exactly match
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 the thisUpdate and nextUpdate times specifi= ed in the manifest's
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 eContent. (An RP MUST NOT consider misalign= ment of the validity
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 interval misalignment in and of itself to b= e an error.)

This seems like a good approach to me, thanks.
In this last chunk, should we add a clause at the beginning of the
parenthetical like "In order to remain compatible with implementations= of a
previous version of this specification", to motivate the "MUST NO= T"?

> > -----------------------------------------------------------------= -----
> > COMMENT:
> > -----------------------------------------------------------------= -----
> >
> > My reading of the changes in the diff from RFC 6486 indicate that= there is
> > something of a fundamental shift in the processing model being ma= de, but
> > this does not seem to be mentioned specifically in the list of ch= anges in
> > Appendix B (or the introduction/abstract).=C2=A0 Specifically, it= seems that
> > the old RFC 6486 model involved the manifest being a tool that= 9;s useful
> > for the RP and SHOULD be used, but that ultimately the RP policy = decides
> > which signed objects from the repository to use and fundamentally= places
> > trust in the signatures on those objects; the new model in this d= raft
> > seems to place the manifest as the primary control on what signed= objects
> > to use, with phrasing like "MUST use the current manifest&qu= ot;/"files not
> > listed on the manifest MUST NOT be used" and the error-handl= ing behavior
> > in =C2=A76.6 being to fall back to the previous cached state (at = a SHOULD-level
> > requirement), which as I understand it would mean using the previ= ous
> > cached manifest.=C2=A0 (Maybe I'm wrong about that last bit.)= While the new
> > focus doesn't seem problematic per se, and it's perfectly= reasonable from
> > a process perspective to make that sort of behavior change in a P= roposed
> > Standard, it seems that if this was a deliberate decision it ough= t to be
> > emphasized a bit more.=C2=A0 The final bullet point in the change= list of
> > removing the notion of "local policy" is perhaps relate= d to this
> > fundamental shift, but seems to only cover part of the shift.
>
> I appreciate the observations in the above text, but don't see an<= br> > actionable remark. However, I can provide a bit of background:
>
> A write-up on the /why/ of RPKI Manifests can be found here:
> https://blog.apnic.n= et/2020/11/10/rpki-manifests-securely-declare-contents/
>
> Manifests are the only way to verify the completeness of a SET of sign= ed
> objects. The notion of 'local policy' in the original RFC appe= ars to
> have been the result of an awkward compromise (this was before my time= ).
> I think by now all implementers understand that just like car seatbelt= s,
> Manifests are not optional, and never were optional.

The background is much appreciated, thanks.

My intention here was mostly to ask for another bullet point in the list of=
changes in Appendix B.=C2=A0 In light of the above clarifiations, it might = take
the form of replacing the last bullet ("Removed the notion of 'loc= al
policy'") or it might be a standalone point.=C2=A0 If replacing/mo= difying the
existing item, maybe:

* Clarified that use of a manifest is the only way to ensure that a
=C2=A0 consistent and complete view of a publication point's contents i= s used,
=C2=A0 removing the notion of "local policy" that modifies manife= st processing
=C2=A0 and use.

There might also be room for wording tweaks in the Abstract/Introduction to=
reflect this change of emphasis, but I'm inclined to say that the poten= tial
benefit is not really worth the effort of thinking about them.

> > Section 3
> >
> >=C2=A0 =C2=A0 The CA MUST sign only one manifest with each generat= ed private key,
> >=C2=A0 =C2=A0 and MUST generate a new key pair for each new versio= n of the
> >=C2=A0 =C2=A0 manifest.=C2=A0 This form of use of the associated E= E certificate is
> >=C2=A0 =C2=A0 termed a "one-time-use" EE certificate [RF= C6487]
> >
> > Not really a comment on *this* document (6486bis), but since RFC = 6487
> > generically defines the "sequential use" EE certificate= that we are
> > disallowing for RPKI Manifest use, it seems reasonable to ask whe= ther the
> > issues that cause us to forbid sequential use in this context mig= ht also
> > apply to other scenarios where "sequential use" certifi= cates might have
> > been used.=C2=A0 (I did not make a survey of the RPKI specificati= on corpus to
> > investigate whether such scenarios are likely to exist.)
>
> I didn't perform an extensive survey either, but AFAIK the Manifes= t -bis
> document is one of the few places to be so explicit about the use of > one-time-use certificates. I believe the primary motivation for this > requirement is that Manifests / CRLs are the "#1 top churning obj= ect"
> type in the RPKI ecosystem. CRLs (and thus Manifests) generally have a=
> validity window measured in hours, whereas other object types such as<= br> > ROAs often times have a validity window of 12 to 18 months, or longer.=
>
> I expect that going forward, where needed, new object types or -bis > documents will be mor explicit whether to "recycle keypairs"= or mandate
> one-time-use.
>
> As you highlighted, your above comment is not really a comment on *thi= s*
> document.

Indeed, no action for this document, and thanks for the insight into the RPKI ecosystem.

> > Section 4.2.1
> >
> >=C2=A0 =C2=A0 fileHashAlg:
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0This field contains the OID of the hash= algorithm used to hash the
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0files that the authority has placed int= o the repository.=C2=A0 The hash
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0algorithm used MUST conform to the RPKI= Algorithms and Key Size
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0Profile specification [RFC6485].
> >
> > RFC 6485 has been obsoleted by RFC 7935.
>
> Correct, this has been rectified in my working copy, also noted in
> https://mailarchive.i= etf.org/arch/msg/sidrops/NzCcNzcN46FD7RgV3D5ULMnEhxs/
>
> > Section 5.1
> >
> >=C2=A0 =C2=A0 2.=C2=A0 Issue an EE certificate for this key pair.= =C2=A0 The CA MUST revoke
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 the EE certificate used for the manife= st being replaced.
> >
> > Do the mechanics of revocation still need to be undertaken even i= f the EE
> > certificate in question has expired?
>
> No, in the wild one can observe how the property of expired Manifest E= E
> certificates is a helpful utility to prevent needless growth of CRLs.<= br> > Also, trimming of CRLs is permitted. Do you have suggested text to
> capture that in a concise succinct manner? Or leave as-is?

Maybe "revoke or otherwise ensure invalidity of"?

> > Section 6.x
> >
> > The old RFC 6486 procedures allowed ("MAY") the RP to v= erify that each
> > file at a publication point is listed in exactly one current mani= fest,
> > which is no longer allowed.=C2=A0 I think I can see how this was = a problematic
> > thing to try, but want to confirm that it is intentionally remove= d.
>
> Ack.
>
> > Similarly, RFC 6486 wanted a warning produced if there were objec= ts
> > present in the repository that are not listed in any manifest, wh= ich does
> > not seem particularly useful and I do not mind seeing removed. >
> Ack.
>
> > RFC 6486 also wanted a warning issued if a publication point cont= ained
> > both valid and invalid manifests; removing that guidance seems co= rrect to
> > me.
>
> Ack.
>
> > Section 6.3
> >
> > The two "proceed to Section 6.4"s seem redundant (I sug= gest removing the
> > last one).
> >
> > Section 6.5
> >
> >=C2=A0 =C2=A0 the publication point.=C2=A0 If the computed hash va= lue of a file listed
> >=C2=A0 =C2=A0 on the manifest does not match the hash value contai= ned in the
> >=C2=A0 =C2=A0 manifest, then the fetch has failed and the RP MUST = proceed to
> >=C2=A0 =C2=A0 Section 6.6; otherwise proceed to Section 6.6.
> >
> > This looks an awful lot like "if X; goto Y; else; goto Y&quo= t;, which could
> > just be written as "goto Y".=C2=A0 However, since =C2= =A76.6 is the "failed fetches"
> > processing, in the successful verification case perhaps we don= 9;t want to
> > do that and should instead proceed to use the content of the file= s listed
> > in the manifest.
>
> Nice catch! I'll remove the last sentnce.
>
> > Section 8
> >
> > Perhaps it is sufficiently obvious so as to go without saying, bu= t I trust
> > that in a prolonged period of failed fetches, the human operator = is
> > expected to go figure out (via out of band channels) what's u= p with the
> > CA/repository in question and whether an attack is underway.
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 The requirement for every repository=
> >=C2=A0 =C2=A0 publication point to contain at least one manifest a= llows an RP to
> >=C2=A0 =C2=A0 determine if the manifest itself has been occluded f= rom view.=C2=A0 [...]
> >
> > Do we want to say anything about how these properties change duri= ng a CA
> > key rollover or if multiple "unrelated" CAs are publish= ing at the same
> > publication point (the latter of which would be quite unusual, if= I
> > understand correctly)?
>
> Multiple 'repositories' can exist in a single rsync directory,= akin to
> how multiple CA Repositories can be fetched via a single RRDP
> publication server. My preference would be to leave this as-is, I do n= ot
> recall a perception of ambiguity in the wider CA operator community ab= ou
> this aspect.

Okay, let's leave it as-is, then.

> > Section 9
> >
> > I see that the latest update from IANA has the registry (entry) r= eferences
> > being updated from RFC 6488 to [this document], which is great an= d
> > obviates what I would otherwise have remarked upon.
>
> Ack.
>
> > Section 11.1
> >
> > Now that we're obsoleting RFC 6486, that should probably bump= it off into
> > the Informative References section.
>
> Done!
>
> > RFCs 6482, 6493, 8209, and 8488 appear to not actually be referen= ced
> > from anywhere and thus could probably be removed.
>
> Done, this was addressed in
> https://mailarchive.i= etf.org/arch/msg/sidrops/NzCcNzcN46FD7RgV3D5ULMnEhxs/
>
> > Section 11.2
> >
> > Do we really want to reference RFC 3370 ("CMS Algorithms&quo= t;) for "the CMS
> > wrapper of the object" rather than something like RFC 5652 (= "CMS")?
>
> Good suggestion, I've replaced 3370 with 5652.
>
> Please let me know if the suggested changes to Section 4 and 5 seem > appropriate, if so I'll make the changes and share a patchset.

They look good; please go ahead and publish at your convenience.

Thanks again,

Ben
--0000000000004623c305daa6933f-- --0000000000004623c405daa69340 Content-Type: image/png; name="151A0239-E7F0-4B82-8159-DEC0D3D85156.png" Content-Disposition: inline; filename="151A0239-E7F0-4B82-8159-DEC0D3D85156.png" Content-Transfer-Encoding: base64 Content-ID: <17fa78fdf24d5a6925e1> X-Attachment-Id: 17fa78fdf24d5a6925e1 iVBORw0KGgoAAAANSUhEUgAAAfIAAAFzCAIAAABKHxz6AAAAAXNSR0IArs4c6QAAAERlWElmTU0A KgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAB8qADAAQAAAAB AAABcwAAAADTnBUKAAAAHGlET1QAAAACAAAAAAAAALoAAAAoAAAAugAAALkAANx/p/XO+wAAQABJ REFUeAHkvXusdd9Vnud/S1EKDsE4qZKoVcEXVCgYYwJSlZYa/wApgSBskwZVUGNzK1SVwHaaSDQB G9MUQxxjbrmIi7nFpASoEbQChAPmUqgIlwCKAEFEmpKiGtrCX33WfvZ+z3vGXHud/X3fDxOp0tTQ O8ccc8y51l7r2fPMvfY+z3j1//G7r/hXv4tdxSve9fs0Wf7C/74F/A+/8n/+wG//3tf+i6288p/9 a5yUc0wFp9fTJRwlwymG/fh/8a4bPUT+0Rbm6QQUbQ/8a9gajIcwS+s4I2ztGF+s/+xb3vHHP+wT 3+dZH2f5E+/3HyGwKVSf/e89f/hXp71in//8j/7YT3zNV37V13zX9//Tn/uJn/mZf/Ybv/Zbv/N7 //K3/+D/+X+PC2Hf/RO//tKv/ok3vuPXX/Njv/Wh3/iLH/3WX6G86C0/S/lTX/iP/94v/87/9ru/ 35flX/3l3+HitKAtBPz/vHDPrmdgOEd1jX/Qs2aIJ8Iko/pg5gT8r//qd3/wF3+LS4jrZ/cS+h9/ /rde9U0//dK3/swLX/v9L/ycf8jV8nHf+y+wz/+qn/53P+sfv/Htv/BD/9f/zVXxCb/4G7lIcsEg vH6wzDCTjMg0/k0Wz9gF+ob4d/2+oPdu5/6n+nd+9w+4hSgcZCMbWJyrgXvE5Y2h3yS67zVtzmSW RwS3oCqY4qfaqDJY5x+hdRqxmWFEmoYYAR6CMTbFtvC0tKXVKiIlnkQinvu679jFegAN09WSPdVd Z7dC9ud+8KdhP/AjX/GSF3/sp7/ilX/jb77ubd/2NihPacqPe5W79FO+7dfAt1jnjSdkf97r3/kP fuzXuEu5x7g4WXZ4W3Ig3pxWvUX/SO7DgYOutj6em5G3WPIk7SocpfMMj2eyAx5Vj4RWsT2Z1mka znSMMACgg3WY7sogawKvGS0XzF/91p/nIgHrz3n1D4h1yA7WWQf89bf/ci6V0Nyr5dN/9Ffbw+Xk oJlbZptZ/ZspnsENELL/tXf9gSjXUqU1xXtDrPPyx6+ANcOzVVe4nxL2KISNanc0baxEI0CxssxI yYXuAKuB2rtfZAItonvOmVu3tiagq2ir7UySFpw6qtr268T/vC/8uvd+/497z2d9yHs+6+WCu4Ge RXqcgXuaGuVhPa0WMiOwhIF4yoe/6M8D+i/4vC/4oXe8s+HuHcv1ti2+vu83uce4IbNa515Fg3X8 XI0U7j0KVylH4V0a4aUrs7ilvRUJ1vNuuDObCwy3W9WZplG9ZZLpuxu8Jrzm2e3ezpxDnD3obsIE RHSvdvYQ8Uek1dX6P/+lX+EK4YLxOonggiGS1TpXyIte/+ONdS6Y9//sf5TVehM8GuHF4zXj6G2d xuppf6bagmlbjejWp1dvq3Wu/gb65rm/VCfAQhOvKDcDVg8cSesmwvHOcHKON4l7vS75cTofxJb5 1NEhsC3UwggtoYxZq3raDqKlusbg0ZkYxG6YASO4I1uPJDStrXquReLnLKU1Qmcsf2meT+YpmLAu hunhbBP8Ea98I1iX0WF3kxpta4vgO12MSZ5kwEOx7xAg/rM+96+xfnchlhuVBRpAZ7UO3F/05u/h 5qSw+GIThpsW6HNBUrjTQDxHlNvSe5Uq5em9bczWdEv+OBXe/7a2vua55k/fTqszTd23m0YAYcPT 1e7YY6m1PVCyJUlnOIjcjY/TjrtWrPdqPZeKiHe1zl94YJ0FO5eKxQsmq/VswnidfMY/+W0FfxQq uJyYQB/y7nyuOW85lmt9n9B/bxOGWwKqWs5kv2AaxKSVm4QYjhzPLSWk3oIvCRX3mpZsDkovBbaF VXFGDEIbvx2pGqMQYcMmJv72pCOi/QYPT6oRhKFTuleaFLEeyFrFQ0mrVQcaTpuwPY3uO+Kp8oq8 4Ed+koUzS2no/D7P/KRmdHDcBG9YJzjOCPqmNbqZbnI9H/D+HwjfX/7yv/IPvuGbWb9z97K3/sqv eSdY54bsHRjuUlbr3MMs0FxqSHAshxPLhcr92Tdn6ye8f9L99pwHkddAgJ8DzFgt0iWiW1sbkDBF JhPRXXZ1MtDauqvxH4iOHwOlV8e0062YQXOYzpWApRebMO6t92qd9TubMLurda4WUZ59GDxcNhlU 4VkaTicf5ziWW6pP0nc3f23CnNbXclbb62vowK2i3RBwUAR32xMyustK8zvPfe5n3FWQUGzRNPiF Ryd+S6pDpNphw2nyXeeaPx57dV8zrDaRuwJnJ7Hanp6Y2jOjJTInKn0jOgas+3npGeunT02l8IBy eB2/Hqzxu72kNtZWg9//2f+hQn8sTvjO/swHfcxnPvslr/qwl33+V377T/GX9Z973dtYs1NcrYv1 Xq17fw6b2+Z2eO3eLXEmYTwHIoNGEJwMilTXpmTuyN1Ua9/uMvKkGmGwmVu3x+B1dONpPRDpZcxq u3tm1SLJ85FpyB5xh/Wv/glW6+y6ZG9drLta5wppgsN0r5kIqj3DnsYT6nfTJoz4BqyyVRHObiKo vZHstZcCOO5K5YkzA431O4QyRoFtYVVPkyt+BH6rilhEl0Q+6EwGu6Rqx86TgORMa0S6J5jjbSf+ DqbJAK2LC/dYRhNVi5GtO0PCEJ789/2Cr2AH5m6d/sxPagoL8YYy8MUZLhugswHdHfF3QPriD+Jx Utx/NwBLEj5xpXzMq7+LtRhkf/EbfpSb1tU6yzRuQu9MjrFvTpz+NT3uxlAGf3gxYp6w+uRpjzN0 aw6nnZl/nBHGW43T+FHFqSdDxJNIRdvEHIvR6h8lGajz5+8VN2GwjXK3X1yw08QKgE0YdmB442+s +yQMg3qpaL2VtPEjGD0TyJTo23O2Oix/WQ7Pu7l63oQR5dwPUwTEFwFoCNNuOLjsfiC2cgm70/Gc RCAeca9LvwecdA+HHlUmoDMz6SraAGxHxmmArdecto7IBKfvruheq8bTzt0MOD3Do9Wz7YvF5dhh xnev1msePSYE6zA9mzASvK14bU/rtOJsPaqD/kRSjBnWqq302so2vZc/88O/6M9+7N+ivOBlXxKs c9uD79yi3Ja5RXNzPnh3rZHtaf1gqg7Y7RhnkBFP90XrT1jECDNS/NmlE0ZfE6PLqDrWcI5q5qPf +XTH9rROvMHHFmrzorM7x3Mvkr0fg4HsBLzm6374Y776Z1mtU9xYf+nbf2Os1pvjaK+WCKquBnK2 14N9pGnzF8bxcT2NraePTC/bL2Iillsd3Vsx3vxakITQtthag/JatpPKjnd2L+yuNVh/1+9LQJoU XZVoeBDdarWtMXhG2fWvTj23+DsmuruvuqfEYVqNSKtngKqf9nAdcM1x8RmQsRLfgr70wrOmpSMv GRf0+37G3/pj7/k8uCl5r9lwVrFSG799I4hJ2OieJAa0pYn3GPvKdC2eTTzr4/jb4jVf+lY237nP ORvcZlxmAj2W48LPicpy78b7h16P2mVkXm97Pau/O94SY7yRgzs0df6RLU3DT6/kGWJE7lbTvVvV PZ9rHs6zg2oTRt/ubhWbvXWBnqW6goDsrbNgh+YwHbgjWK2zCUMAn4vmI9MAvZlOwO4febxnZBpD jGmPVqsH3Q1IkojdPMfOu9U6d7vkjd0BcVB7EnSZZZfUcZZI8ohMIDk33FzeOdBrVQ+oslURcuGM pwV6VEdkB9ik59i/m7OdI1UGjeBge6ChDTOG6w/BS8ttwEWJ1n/NmspWdLZuMoTvxMG63GzbgIan QXNiFM3oNKUvHXGmpJqANK2CLRqd9HrOMz/IvkCfz1f5mPfjP/WLPuPN38atSOF+4KLitGgRx3fI cevx/XN767VR2o9e30hGgCO2c8whSdaYNAXc9B0kTa8I848wnAlItnhWcRzvELHrSbApad1bB+LZ h1FoCWa1zlfYWKpnE8bVOs/vurfOdRKIt4jmshHrGTSC/C4jMuEnFE/7ps3V1ToI2IB7eU4x8AUE NFmiI9J0FuH4pcsMeMgPy5jDZpelukiiqXmnjtNqIhXHtrt05K5f525T90UnBtG94h/x6dIBas8h 1x+XneTCs3aPx9bEKJLKMFfr7/PJn7+t1t/7U4GmJSSNCIIFqxxHRxCZanohDEhruivi78h0sRUL 3Im3ULVQZdlOeY+nPpv79sV/53u5ab0tuRUfxHruydy34VSaELvODlh1Eq5NeLq1tcHDM6ojoa2J GeK4NalGr55GmnDmPCgeTJ4AYZ1UQySsh+iYsJ4F74OrdR6dypMwrNNhOoXnYt1bJy33DndQIK5O 1euHsBysZ2OX5jdC+d29CQMapHbs8LiUAwcWiECJjv8sRHkDPfokHGX2uiQffgfKiFZFHpFU0Qg9 VodNVSHFtGnqqqna0x1bGxM7mlIdYre668xMaDXAI3Wt3SeKSJtWm+kp6GuqjKg/WIfp7q1LUsAq drEiNTDtpgQrjKGLMdLZPOoERCSbnrZ2CdDTdJ7Y5XPdpPq3PuBV7LkDdz434/7ka6jck4GC96d2 lxod8LToHmWMu+YfHBlV4ke2EZDWkRn/LlWNT68hUu1xh85Anap1AnqqyRyRsAcFB+JqPUt1lu29 GwP3eeldrfuAI0z/hHf8OrvtPuDIELzZcy9gg3K1fEdT+ih25ynQdy+tHMWN0E/80yLOmzBsoIvy Brr87b11WBCaXNMJuCdC9sJ3+H4WS4xDxEaQGZ0CmNBY/OpuElurtcvqv8WTvhH2sjqca8IOSzCi tb08InQLtHQ2/hqpO4PdsesQJqeJS5/Vrqv1fMUUVjbQQ2r9kjREbnA3vg3Tnll82Y0x+QhY+zpu wjJiPAg+Td3ss85fkWXxzq8g8HDkq97wA3//+3+Bu4Xb7/gOXO+oJtHa+qAHFjw4YngRQdrWXT2Y T3dRt+0kHRl/nBE0jVZH77ToUU0XROIz7Q5OZMLSBXFcdlfroTyt7K37kWmwzuXNFx2ytx6IRwTo gj5Y353JHwmsPXvOp/U6w7u9dYEey30e2p5FEZlWGaE4sP2ukIR38aJ8AXoCwBA6VipZhUcRxFg1 QFTpwT5SSYbRXT82wrRdVY/hEoBI6b4ZyNZURx6qHCYQN6DTdhdPhcFYS49rx/gV9GJ1Awe3HRi+ iHRBpKCMjRCsjVdZ3NQW2caw1m5BHjxYi71SjcBvWjzGmKR76XfCW9hl8Y7fPzvg+wc/9cXAnR8L 4wYQ7qFtbo+BnvVWeVo8GW7Nlil1E/GrvzlowoR1/uhVMEScGS5nIK3tSVhEMkSkae2YmFWkV0Ri 8AzNSpwT4mq999b9sFRLTPbWg3W+RArW/fEA0vJn3Fiti3Usz7PD9GA9E4jIPB9bMP/H7ntLx6tY F8G7QAcEUAA6xCIeLoPdo7qXoYcQTBnRKjNBtG1/NwmvJ7Qj4ahmGo5ia0Yc1V1/x0RzyAlugb/X 7DRdi6SJbJZkSH470veFr/16ti/EOkC8tmC/CtZCcFgcQIfL7TnQwtoAR8y4nfzM9NPa/w7oJ7LL dALwq/lbhJ9G4EuG7JCCBgGxQtPbZgXTLbfTiAkIIhIQj8Lh1GnqOXRYkrRIrwhah/Zg41SkarZR TZIER6QpgqbMeQ3Tk2DEetSJ6TB0F144sZ7lefOdbzAE6/1TX2Cd9fu11XrW7AIdm8dgrl0hPaV/ 0/QO1rnDoblAd63dK27ezQgYBUYMz1H18jGsMbvvHOluZpGEUxGExaNofhEZhD2SsOPonmq3RiOi x1jtVzvJDovfpq4mLDsteDhY/RF2TPAa09NIWAYiD+U5r/xyUL7trbtgP30yGRw3QONECNkwN2Eu xqna5GrdeJxUjcRzYzGVwQ5qBrPh3x6PyVK9/tqgSbIDd3dmXva5X/6m7/w+P/6CAsf3bTh1463b YLqxy4Nh5ByTdJS2naTnnJhdptsrMWvVJvwRu3q3daTtjplhd3T03Y8lu4kDAeuwG6z3lnoW7PjX 1TqbMAdYz1I9Aqz3u46TH6+Cs1rtwSE8UjDHuMbf4tnBepgucHexCxEAgVYoPL69sg+TISLkEQMp 8CNinY8etU0GP54dGTKW2Q5ad5vGHDoGPaoG52BHX6vN+t2AdiaVA7X1I/H3e9kbsgMDK13hitFQ WDGounHzsleuNgAdYZ7Ya34DOptJ2pO+CPw2BejEw3ds/OJesttXuLNy5+YXEMDduyWUCXduuYtu jEnyIUaVbHri3/X0oANAu/HJFpGwXaGz3wx6Vq3TPZkjchr19DwTo7i2W70icne1zisYrBOwPQlz esCxN2HAOo/w8o7OhFmPuwmTdbpAp8omDFs0mR7Ba8lxddM61W69cePlIOx2yp+xznpcmrcFBBvT r++WgAZiKBFWH7ZXUL52NLMMolVOKWJtpQmhbtFoe1B3KoPjMX+cGSj+jkxYi7WLrbGdoTUBOfYE KzosuoOP0W8XXmJ+5Isvbbpah4DB6B033egoKyJla+CrU6raxDuB1bwlJDn+LnnzwGmvbkXTMcPt JukF++jLu9SpXH5t+HSMJOGfe/g7YvDr9tumb9fogGBX3LjQS7aIZBse/aN1dXbAro4zgoGiIxy9 q+p4utr47mw5hDVbwpJwBHcV9vUvOAboLt55Hf/aW38UrLsJ4wOO7q2zCcOnqbwW4huUi/WGu5pp jKPoCTyS3sX9Ab47+bWw42t1f7UOF+S7YpBdytBEgQuKW+0J6Nu7RXZyVk9lNn+4lmqgdgbTaSaG 4bEkRnGjNeEIbmfr3bAOULeHLlTjUadq60i7Vh81vjPYl/Ovc3sh3vX7L/men2PreduBOX3FVGjG NnBxrmxNpPAdUJb1WgJG664nUM5w6U5TTyA6XRR07IEyQ0T+EFGzeOenxNhz53bKsr1vrT9U3TRs zaANuCwPIzKr0Wv4kyfZDkSCV5FeK+zSlKEj0qTARhCzpkrHa4t3AiAasMMC8d5eD9xp4u+wl33Z D469db5l+qc/5Rv9lmk4HhHE56H1TObdLI6Rfctk9rF+Zrqb4Pe3wjl4iQwdgubWce6KM9Avq/U7 vusJ64vs5CG/Q7RoP4SySZEqTuF1i+1gdXuSOal2Y2zd7TicnXCkWiN302YmEaMjp6g7jlaaWMtj eRV4yvt9n/NZG9Mvy1jgGBSGpM1WWkVqnKMazpon1Rb9htH+VSdJRMY12H0YWxMzRLcOzVdV+Z4q 98xjL6tvud8C5fDuWi8CDmZi92RLkoYmzjFKqqvo4OPWMVbmYK9ja9/kXwftJoOb77SCPE7Lulpv vvPeDNb7AUceWme1LtZZyLtad9dFmgt3bEQfSM/TWT2SvRHT1xbmGWs3YDf5Ptb9jFTm3pH3PnND bWARfSQuKJ8xDwHdeOjjQNgUnLTapE5TBP4nL2TrJKNKk572t2fXvwbshvW46u64O/RBF/paEsMJ 5CX2MZhtA/qyYIeVAR9CZOtsfCemA1YoD4+9hvNa1eAedIw1sqWVhK0zVfzR6csSnuc7X/u3v4W7 6ICnucd2RVMpOmLtQpNjJSbCYKur7VTdGn/y7LYSloDWcQ7RSdBpHcN12GjKKMYcrNMTmQxDALJg /dpHptmE4ftH0Nx9GAQfIGUTJlj3iUb5jmW1zuel6zE6jWv+TFLO7tKWmGv+dH9QJEOEXbq6j3Xu cwt/nq9YhwiwADoI3KHjPBIr4he4m1/riNi1isfCcAa0pYnqIxW7tL3WfTfmYMRuiu4krXvQa/7E JFs8DwpPF2EILmW+lrltrJ+ehIF0lN6pCFIDwYiwWA+R8Sh6JyQ8HTFW15xrmDE9Vo84WlMN3OPJ TPCk4ITs/JEOah+b7Nduy6xq14C1afWMXrtYHM4BIKvtVF8bqyMzejvV7RlhaYpYxxpJEplULWyF X8G6Gy9ZqitcrfO7zfwmDB+ZwnQKC/as1skJu/N8elboITueHld9PLc1Xk/TNjGuu23aXYMbmaaI ZLgmzLlh3c9Lx6em3O0b0PewTlPKxoWFyDg5QYm5E6fIvE+Yn9Z47iJrEwZm4ZdTEfIotsGHThf9 9n3Q7gbr3G3qhGtAe1aNx2ISAxK2ih4LnYD4jzPkvEW4/YLFw/W9PQZzwfq2FXN5woR95xBQyNIk SRXDrsH2ih2UT84EDEF+N2pE8zWIZ1bpjgcdoOvXiTZ+Vp/5SRwvf7/DhcfD+o13/m6Yzm5qj0B8 EIve7deSdGvH4O+x0rTrTPAqOj6t15xjFOLTRa3tTRg9K9azq65orOffaPiAI0/CZLXOZd8cj2a7 Jqv1Mfouo3u2D+prgB6Zr4XlDGSgdIyg6Q7rsBWyB+4IbnjJO7ArC2i1AJRoKBN9JJZ3gvHekJwK 04ow0urE4sEmRq0z1l6PZM28dolf0dbgBIzq8Cdz/J0qzoSNbLvVEUz1Wp7RxPlkIcP3MIN1YJci AdsGlBGBo+iUvLv4NqDt6JsmUZ6EHYZ2CFozh4hExkNYnCZMBv1W1fwzJn5D5jFW64FU7reIg6YV 0/Y66EKArSNmdSZgV/i+NXqtkT2fDl4j48kM7ZtqAlaRmNEl1Qg4C7+gHoW1eW/CZM3eWOfRF//z rU/C8JFp9tZdrfsBqQt2NXwP1jPujSJsVaRq91G9Mee1sINsVzdhuNuh+QD6NVJDkGtNO/6V6Zd3 iA42p1Zm0drw6iY0TQaosZbu8qjaVPSKuCVDB6vjSTUiCduT+LRGHDQZ0wGdc23l7ZkA3lD5X3fP /PBX3WH98qkppBN2rtkHZG3C2avplaH22vyX7wrFcyP6E48Q6A6dCWzJ7z84Hw/+0aWrSciOE5p/ s8evt8v0Xq0HQ9xgra/db/jHKs/I9I1ov87bm+h70KUzJ3JXHEceD5HZ7oq1726YE2ibsHZG89LA 9J/7iZ8Jx8dqHd7xJ5ebMGKdpbqrdf4qFeuAG3xnhd77MOCe1gyn2J1SP7l4ANmDpjHK41WTX4G9 W61nnS7Nw3SX7Q3cJ9fH7xYba2pJLqxjbQ3m4m9sEUNJzCMJO6Z7xMg/cq69hucgviPRVolv0f5O lZjh1J/WdB9+enECn/u679h+NsBNmNP2evZhwKLElI9qoSmU48H55OUY9Adj+dbSExirdaur02OR 9U995Ev5jxy5SY7vsZVZx/GP2rrLEZLsjjuca7XX5kkSMcbq6iPpMW7yH4jRpYej127hBeJl8rn1 Xq0H7q7WfRIGrPNTMDA9q/VswgTrML3Lk6zWnbBbKONC6mrr3WO85rRjLKI1vazewzoEH3Dnnj9G MAGPU64s2IEO2TZ7+Y11uSOVbJJfaJusRhuJjScBER0T5ypMEv+o4l89cdrUNk0mHE3dmrRrTIcN bdrV7mbDmeScSf7X3fYAzKX4PAwMtQi+1kIQj6JhGk1r9KOK0XdUk63fAzKZ8N1ezXE66hxN9uUv En5UgBsSKOSmuoUyBO+GxRkxIvVfs+scOk9S7ToP+ib+mrjmN6eta0xG7DB0IlvHGdGtZmg7/vSB XMer9Q3rb3q7q3X21hvrvVrnr9VerUt2PKzWx4g9mV0tTGmKMMzqcD5GhtGlE6JH4eTcYd3leWOd G16mb/YKiImxgInoJxHmiY0gJ9qq8MIzBK14EmO8HiMftGa4PSwjrl1GqkRGXOsyOq5h8dweaZce +qN+aduBofDK8jlSmH5+wPG0D8OaXRRmE0YCisUANJxVNG31GO93+tszOlI1sv1rttVDvE67i/IG emuTG4lNE//8mt/vhQiN9d6K8dYKiXa3xdM67sPHq67Z4kFkbjq7ieFGtT1quidmbcXTzjHEtaYR 1tWM1c7O0yMmuHc5DMBCMfxuwvRqPXsyG9YvmzDrR6brJkwv1dFjtZ7JrLPNlJyV1WZuAnyx8pLF f6OA1KZNcsRBucO6QG+sy3Q8Z0w/RPZbaX4lz4aY05uErLGKVQAmNSJAT1M7gzBa7aVHnSS2pmmI bo2OGMFWbcW2aE2Y1d3u7UxYRLceaGB90JqmzAqmcxHfYf20D8Nq/VzuL9hDQBga/kY0LpvLYe5w xp8MzX1b0zT6tl8dT4RdurU1rVbz1vXpr3gl90kzPeDuG3vchzQd3Ku7HYcz1VU4lv7d1jg7MjNM awRNrVON80D0EGtYUnVY69HF6mrt8qAFcz/0jnfK8Sa7+zD489x6NmHYh2HZ7nPr5BffAXov28X6 wRzGm01QS5dV4/EKaWHyDl6HGyinan56jcJ+FB53pbR3WAfiXMfYLgBUuLcQvmd7hdH3Yi4r+ged 4IaY1cIj/LEtWtMxBT8aq4iOR/EY1lSr7VQZLoLW7pLgdnbwbkCcQ4TmuxkIjr+H08+fouefDTh9 EWnbVd9+yfb8jGNQGBHC6tldOyem3wDifBLhoGsGp8EbT0Y00rcibHdJkgj+IepXfvtPcW8cMJqb KmwK8b0b419vznjWmJGk86OPW5NNkWCro9U5DGequ61jMiPttS7da+2SEVdhwpG2na15mWDcwUem vVoH634dib11dtvzJEx/ZBq4K8D6ugmTOfdMopkSWqszOkzHf3x1jQzJQ6rkR3DssLshztvYKHdY H+t04Q5Mg/UHofy0BMCdbKyjt2ptv8Qj12hqMSKDM3oZpmibmGsBHZw8Bg/braNXV0evUe3ITpiw 253poqBjJ3cThlPNTuLdP0XyK6au1uvDUpjoPkwW7AAxAA0xZWuqgWY8iF1nB1zTjnjQ2smZSaYa v0NnAqnyGAzPNXK3gANuPBDZ1rvr+K42Zo28sdcIozru/w64phl9t0lnmiISH88qErOKNXj10Gvt uOu0bzIY07abQNv6kWmv2RvrfMvUvXVW6zzpyB+mecDRFbooz6ONVh+cT89N5saTqgLLq2khJq2J V6x+uuDUr+USRQB07OA4Vc6ATv5kucM6+B5kh5L34H68MD9ufWjBDnEYLmWrXj41tQk2rQInXZpf xHRJE04zDJuA+Fdh345Ud860tjMdb3cmT8RIsvrjeSRh2mD9vLd+f6nuF03BXwgYRIrXFZ36b7f8 ZdDBYW47b9F5RxlvNiQU8STpNTv+VPlmKVuxIWnEuPF2q1km77auzjUegjhik8uOqycJR1NXoyPW bGlaRQfbusYMP12OPWuGdFGMc574DkOnPLha52+vfhLGb5nym46s1n0SxtX6WKcLd0Z3AmNWGb2F wMUTEY1HpyIBpu3WJDRGcHOMFtfmxrtID8RFuW9pOPMs0B3WZfou2aVtlu2bOEH87HkyoAflCFiz 2jgRavlFpCJOPYmnNR40/sR3Vedo2g0ezu7Y2rC2tI5qx6sJ6JIuu5Gr8/E8vI4vevP38HTjtvFS mzBQT8K2gIzSMOg0ZsXuNf8aiSdETqueW5JkJvTt9xiqdE/mpEIY1sEs1Vn99a56bjPEALE3/HB2 fPQxm7p17dKtGauddLHazughdqvD6Rx0pulgYokZojOkKbONSFNEmjLogYB3Ai6L9IYaLyVYz3Pr bMKwVIfs+fEAwArQ80WkAfeeUs8Bv9hldPyrjtMmqgykXi2tax49WApdPEYER6fleC0ebw4/QrI/ o2nOvO8tz8dq3dX0AvGnBe4QDQSnWI1VQK6BaatauZYAujTpdqvtVB/bToheuxswkiRs+JMhASN/ Z0twxxx37MhdTXcKP/LFBov76W6sX/SHAEGBGBqKS/krUoNOnbfb8QHp7R0fjGRKrsR72vTSObpz 7J/w2q/lHluxHp7Seq0EAau41mX47Zjuo3WtrpHtiY4ww6gOp60d057420mG4T/wrJEdfKMmzALg oN7u3rp0G1hnEwamQ/ZP+bZfc2+dPL1aR0t2QJ+pOtao9hyiFcxKiGMt+BFpRRDTlqrHEgvHObQs yWE3hYMaFnaH4/I96/Qz1oFyr9Bby+sztU/Mbc+dfwE9bH28AmXsqJA7eLoKofAMTukxvnupE0w1 ehW2JiZVRLS9EjOSGLkbPzLQcXjSd20aoyRg9bfH3fP2DM2IrNZP/+tu+8+lW3FvHZpf/v+nZNcC xAYleiCyqwP3Hbz9s4ul7+rpbA92obs0N8/IRlP70a7W3VU/WKp7T2r7Dm/dMcc6vSJGvH5t3lTa 2TPpJCMmTbv+OIVOgkmepkxseHar6bgrTJUPIa9l6L52ObBhX+gWAdfEuv8dKQ84Qnawzieor/qm n+bAg3IEKBPrzM3pHUxGNDs3NdYzmSY9scyHAKoGYLMYh+ApAPqf/9KvNME5qJRG+YD4Wr3bhOHY KME6oNSjtYrdSu3A0Hqv6bGADm7OmYvgjLJxpzxWZRN+ew3bMegORuuJ31ZtN606kd23dQIezJZe CHU89F09w9nBY9BUA/Q8ITOSGMkZRmz/FOn0z0vFOkB3tS7EtUJQK20FZXuMbJo3W9tvhtgOcwnP BNJq2q4ea6ZkgDPUXuvCUp1f4s395r0anh5gJU3HwWFE4ocYjButo7pmWz10iTOina2vBSTmwYBE Iga409RJcMa/K9ppMDYPFEaARR5wbJSLNpeuYJT/bCfW84AjWKeIdXIG69mBwcNU4W9PWBBnJhHx D0FVghtptZku0IN1ApizKA/BW3BcHlSze/V0K3rDegpMD9ab1+rgO9Uzi5+O1Tq0Omc7vTFYxa4C Esn0FoSJqhYJs2kExGmXazZh10R3HDE9GZpSTVh7Ok/8Eemi6ODRtFZD+e6L5vzwdOOzX/Kq8676 ZW9924qp7RexG/gimua7vE7wytOB7DVgeK7t1Qy/+HZiTsl5JptT6omxVOfDUkjBTcKNlzu2xaB2 bvhrfvompvPsOjsgHTsyOmI3TJ4ak8hrAr8H2/EjONUxXHdJEyJAb+dukjhXQd+UtMYzBFjkbyxp OIhmVazz35HygCNMZ2+dxftYrYN1gC7TxyhrFQoztH40YtgwHX+aEPTKqpwqM08B4h7IweF4UOvb 2O6x47yH9fCdGz5aiE+UnwIIM1LxeFa+2Bda7QpjsAYgUohPq3okoWpJF6rqCKqtE7kKw9omZjfD 6tztmyQKYkbHUR3xa7VRfq0vp+se1vNdpBPTIeAoTfOBy1TfPWK8NzSsewL6sVnC26qfpfrHf+oX cR+yuFtv4OEZHB+t16ornuLphHEmz+pJU8S1mPZHR9B9V+tMU8TucGm9EejXBjV5D53MGXcVvGRQ kr31xlzrsVrnkRg/MsXyvCNYJ6erde0b3/HrPW6/NI4eQK9VmtYCwXG2DcRbBOgI579a4sG0/msQ 71bjn8ExUBriau75Fegr3AlLSSsPhIoMrDoxDwoYZIwiVciFP4RC62mi6dRjEjRdLIk3SVJ1ddWd 32yrTa+I7rXr7AB1h6Gtdtjq6dahbwnmFPGfqXkOxE0Y916wUC8L9qBcFDY0H0lf6z4A/Ug5RzBD ONtYAnbnfzrAD+G/3LGmgxGUlR03ehoH6bLrTOsjiSDGnCNzO9FdZZQEXxOrf+2VmDTF86BIwO4h 27obM4567Q7WKSCsidaa/0ybvfWB9Ze+9WdIyBsSH5C6TkdnMl4MbWU6XcR3hH6dsUwJrXWjHL0W pkrBv5K6j2JtxcOb1uo3FdbuG9bBMUeF5e+RdRNGWAfZ4vKe002YJ9iKAUmkhUQmb62TAEQ0AU0x q3F2VW1fbHpFryIxigR0VWeaRrUjR7bdpuRJMJ7dnAlQZEm+ZhiRa5UunBz+M/X2k7z1LaQAHfbJ YkX0gGlXB6PH/syodsdr2kHTOqrxI8B3qj1V9WhlJnj4t9TswHCT7GI9ZBlMCYYQ3TH+EZ/qbkA7 1fFcmwAJE5PkQ3RA6/SNcwirx84k2RXO5CDDGKLjrx1yshnMaRfrwlHGNQ1drbMqzyaMq3X2Yfhn SXxwSh7X6RAPlPXfHBmCUQLra8L1uBxHQ1UtwsKsRG2LFcqrpw/H1pXmZKbJ/AiHMOwZnDKKNA/T ueE52ma3Wj92lLTG/6iL9HQUN1QV8MgmRfiFU88AVvuj6ZVCvEnatnP4aZKe7Y+OyDT0WF316klH RFojrjl7Sp3hds0QnJ/zL62D9XoGBhSmwMqmZNA5BDErtQflR5fdKl06T2vjV09PDx2CI2yiY8dQ ZVedHRh/Wt3b+MCGNdwmzfFrXQaDCBueJEyGERC/oltH3zQp2o5xR1Nah99qWp2A9pbIazHJk/wZ oj1xjsNMdwWvAu/H6wOOjUJ+tS0fmbJaf9X3/SYb6wAdrPcmDFgfE2AIMK09pnn2WACrZEfsFibm 3GgNf4W1nvhttUmbg1JgHYLWgN7RnS1veHzq8AzOESeRIsd3Lfc/ZWW3j8TY+iQWGNFdax6ho9WP thjZXVoT09UOTgYCDNOmiliLveJPl/SKpyPjTMch1oB4IkaXrt4S0/GrJgMnh19af9/nfNbG9AvZ z6v107MooWH4GBaveE3T7WJ87HnQcZ1AgjMTgZ45GyDc02T12nONt1BbsqwsWD1E7jrNkDzroOkV sabqpk6YtHGOSKp64t+tZsTRGv8qkrCb0KkS4MF2JK1CPK126Y7tQZMkmzArB+UdWAff/C9TPjIF 6wAdrAN3sM4mDGOxQvfDUifjxCAj+eVjLBhFa3tfZSzMpS1W8mIDYqaEHzvKrjMxdu+E5pHm+CnM QY6z6cSPIrzya95JedmX/eAzCKIE6xyk+I4V9NK2bQJWZzwHa/ZrTeKGDBEgiapWnFlFW6wS0NV0 ScfE40mwYtcmTNFVU8VPFa2NM+Ja6xofz9olTUn7hIKEvASnh9bPj6sL9LaNSPRg66iGs8eil/Cd YRfxHTzSdl+aUpXg4jv+tCrGc43ezIMdN1aFwo3BHUbHAfQnSUVmu3eS6LXJmSRgVNsfPZIMfw5t +FMdQ1CV5unYnrWp84h1V+uyD941Q6mCOf7VOED399Z9DAa4P+/178TpoOzD5InJQFzhSlxuyvQV 4oxIaezqCZcVTmw4j6vmsSMWPusJylmP877FryDwoxf8UQLH2W7iSHnT4gApZ6xznOJ7WOAovhFD 6znbh/6T9b3g+3s44IlWLawxUqFNU6rdBW0xSceALbeVbCKM1pSumoEmxajGP4SpzDNsqqYaduQZ rY9dzVZ7Z8hY7UTzlxaPwQyss2YHfMAUy5JWCG6e+98eGtUBXKorow8AHfh2nuP4jozObJNQxBvQ rTzX+OBXkEKWiJAlopGkXoP1p0sC0jdNqydNCm0ytDN9Eek1dKoEJKaTXNOdPEl0HuRJr06r8/gQ kjMZVnG8CQP+oB5Y5/cDfG5drLNgx8Nqne4scrOl3igX6HrEaK/Q9WDhLBY6a0Uw1V1/Wg1YmZ5U dqdqAegIJsOsuGJ5YkeUw/GPefV3gXIKf5HcK2/5Wb5Ve8Y6p1KgR1gFiGKdP1gE7h+eBUBJHr0B 6PQ2oMAvp7Q6YxGtmTkXEO/tZABh9m1LcPJEG2CqYQ1Ol1UkSURiTDWqhuHU39b4R7Jr8oPuBPM2 wM9PZ/sFkm5L9RPTT3rDesM9uAxJFWyDDNCPasJGx1F9JJT3O4fDuUJfV+u2ajkcBl3/C9IKjvYc gyaQ6i7Rx30fNSzxQzhKxoog7FpT+xMfMTp28GhKFdG6U3XT6u9eRj4YD5QhHRAMMSOE5nd9/z9l y4WFOVhn9QrQ3VsHiOAeUIp1+W42UY4NVVchdtuG0QRHK5zSmFhi0mpHrGkNcGgmxj9M5y8Pt1ZE OUtyy0pzgL45wTpnkOuSwukW5W0Bolhn2RvmDmFA9tnP1ftL8mtbLiMVVUikcwiqYisxBmBTbIqf KtN25vRNMd5sWjwRyTYC2j+COxJ90NpJdnWcT5fouXVO/HkMJkDPxro036XzYPEt1Wx/3xJ8S8w6 sXgUqZINLfERFJ78canODdwQOdBjt8TIY5ofZLPpmG5pjejhdLbNcIlfW0cTXeJp/Ugdk2H0uuYf 8zQshzaSJLgFMW7CgLxB0gCURS7fQc1qnd0JdirYgcFSoCR9KTBdrDfKZWsgG9SaPEOEzkMwNJ41 zKnGmpYqxSU5wgty4/hpVc5nA7wJgWmetd9B+WlVDsGf/1U/vdH8LT/r9stWff2Pbw84cqawTXM1 WJTRIXUETev6vVvTF/FgATfEaDu4/WohZTCeEUCVAFsRvpewTk9yu9BkMV6nGv9w2rrr13kcnxjz jOCRdg1OryESuYrdrZh0z4iI53zXT25PN15+jBch1mH6toQ/bcLAwYhbgLvGkGF1Hnv6baA1vXqR PpIwkMHZe9HjBGI/4pVvZKHHvcSNDS9gRKgdvjRHWoc76bK24jFM0ZFr/kR2nsfQnad1JqMzTUMc tybJrshWRnI6/92qZ2A0Gb/aa2GcUl67Xq2vGAXr7FeARVbrYN39ihd+zj9kwct+NO/rZliBLnCx FBkNpoNjIW41g1pNcIPePGYgrEvT3PcY3oecs7N1r9ztctfgWP7+sAyOw3RbeffiH4ZsDzhmAxou r4VluLwe1G7+ntfyl0fXz9X7QD/oDnSSDdxQqGptGjZVRGt74Vn70tT7MMbYnWBFnHraXgvoGLTV 5Emv1ZPIxKyeNN0oDp56THKEhZeVn+T1ofVerZ8X7Beaw/TQUzKmqniknZPR94DRI/I81vIOkdEB esCN6A2Z+EnCh6U8MMDNbBkouYbgFcejIzdR9x2tVNcMo0sQFkGv6FvEGp9ePZ84Famme/tXnTBz dvf2xK9YD59gnWkaXcw2rDG8dnDw+AFHNmF4oT/5td/FTx5R+OHGMJ0m3hKasMIXjyIsbkDfqOlL JNZsPQo6fOcQeGthYc4PCINyFub8GcG+f6/KN1KfFuNw/Ix1V+inbZaszVme+5APNPcLVrzR7v94 gHAHhQ8CnZhZLnDXf43mx9syoMfuEY02mqjapB+PtNLixCPHbTLe4MQghj9VmxI//N0xkXEOYZJk 6Gr6prU9iVRkGZ78I+C42pnRYP19v+Ar+KX1sbe+rc1PP98I3+EgTHS1vstZnOtqWoxei99yXh5O 78hGfGCdJKsnTQpSZVd9G+LyBqDQciD9FaSAGFhEhyOrJ00RIVE8iDgjunXVu2G7zrVve+yStXOa 9F+zhHXT6LXbusa3R508LULwCFu7Czpnfvg7lWtt0SlGxa5URf/cO37481779R/81Bfz/O7HfuJr WKFDc0jK558y177hrx2xCrPFrs7EG5NsVNVYilWEywj2fNhgobAwl+MszF2Pi2mtK3HsVl7/44Cb ci/gtGznO1Z8fgDKedHJ7OnCUuYvOAr0WJh4K9kvi/p0QdxSgFGHpbqh57IzozMeqoGUMVQtRmIj ukk/Nt1b60xTRHol+Frk2iWeIZIBkdIDrToZuil5MjdE3gDamV62ct7u/jN1fsExH5leaJ7VOmSM Hki9Vs0KOgG7dN51HndJawtm6CJdpyiPpokHYPi9RuggOIKPCJogTlcbJaFMRLferg+6X2uKP0CM J6InoLObWhOZaoSZrcYZkS6rJ00tokdC/Ck5lngiepQ4I1ytu+K+Rl5Iyg/+cGk994M/7e9+7ddL 80BWfGtxDmqvyM4oHWx38T0sM2R6FGjLe4kPlbMq95NPVuV/7nVvc2EOteG17Jbj/Ge+AB0Rmutn j0WU83QmZymnF7JTdCJ2Vuvc8EG5fMeTT0Q3fXMxTxIed4Q7BigAFtW2+oelakz8iBSaUoxsS1Mi FfEorvXdTTL6dsyaPJlXYfCwI3mqHabThMOf+MTwp8z7fPLnu1Tn6t/2XvJc4+XH1rNOb0SeQXlZ cVPthbat1+xY2l8L2/Vf65t3BSe5C3eb+PUb/uyF2pZgIqL9DR30Ndan7zUSdZ4R09XW5rzFk9Gv dcHfeVpfmxgxHGxau0uG23U+2GqvtW/8jLu2mhY+KlinB5rhcrAbQMNxFulPfeRLv+K1b2KdDnYN bmsvu7RNtlUYNiBu1fU406P4+ApL8uyu+CRiL8zP7D4tybfPOS8ia3MEuyssybMq5+NMkO0pkuOi XJpjU3awLsoDdNHcdtB52065bLwYtgVcPB1813p6YwAx3draprZwioDY4Kn5hdZPZITOjkd3NRni jLCpq7foTCPCXl3Fs1vWEfWsdp1J8q/BaXJQXh2w/l5Pvf68A3NarZ/gft6BiYaw4eYubXV2DJRf 3wZuR78JG+KtxxySVpqfJ3PagXEO/c7EX+XcewF0RHjUgtbjAILDPvQa3K2dGX0NXoZ1a+skSea0 DmF1ONfkYyaJH5GdrWN2/WuAo+T8RODPgTjiriVhd+EVhJsshAH3yuWAmNY3fdmb/8E3fLPrdHGc 1gdF4vNBaNjtMlyLk/nwlkPJEywsyd1gYQ3uHotMP2+wnDZVwnQhThXhZ6GiPLsr4ttzxalICcEV fmM2zjusg0Kw2/i2Oljc8N3XJ6Df3gvQdB4AZFV/W5sklP546KJfoU4kwZQEq9vS1F129a6zk6hN leCI0aof525JL4TFsNWfgAMxhqYK1vN04/299e0ZmDPTheP9/2gRqoan8SB2nY3aDj7Q/SZxEEZT v3+om+8E8BmpZEfw5zB3Kfeh+GhYNFDwX2vqsF19C6dGx10OXot5jPymchQshxadUdY5ZKBuSjys iY7YjRytxiR5Wg8Er5fFdboWqoLUwHfFNK04R4DV4Uxfu1jlOiEMj4UJMKJvJ9gUV+Vw/FVv+AG2 ViiiHI4H4hvBTx9yIthIgd132yxv+dmsx/sDT86GJyoWId8HxMFsgI6gSgDiDuu4UoCjWnG2ewtw mkah45HnkmSDy9I3Hlvbgi1aY2lCr1bnbmSCIwju0n61rateI9uTnLtOWvGnialavWZ3syU4rabt qh4Haj+eDetveFv/Z+oN5ZevmMrBrHMnPe+DPgiG6XRZKZyAB5vI0Jhe46957OVHpsSE72dx2lNi p5Wbk9v1QWoTEO6osQfcsYkuB2Hen7ld7RLn8K+teoa1e6Zq9ZodfXuITCOiW9Frzt0AncOOnN3a aePPZgseCa6Fqrx84SxCOiOC7/aEzqH2NWEGrWtzNGt8RuRhG0YX6KLcx1f4zJPVNEtyn1HJ1kqW 3sE31JbmG9xPBQ8lW+QgGF5zKvJOqcCjE0wjsgyX2lr6UtAgV41Vn7EOXJrj6vYQ8PSXy7+1S2bo o97Qc39jnaqtEmq0pskwY7DBn3Qb1qrBoyl907oGpKnFbk6c3Z1JsgeCTTEA2iJwWm2b+cSpx6Hb EjCaRherL3jZl7ifjrVsZL88qx4WD86O/ZDd5Xn6XqPw0+IfM2ma54NTJk/hoPiwlGchXPTBiwP+ yhcCEhMR9CAC06E7Bs0NOTxWr/l3Ww3uLq138w9nZ2jdYcnZATlMnH0eErybIYSytYOTMB1Ny0uD xxeoOQ5SgWwXF9EwWhAjpHlTWzq3Z9WJMQ+W0RlOiDfKmY8bLOyVg+OsyqE5y3BW5dAcZANrV+KC G+uqXD9WlH/6j/6qjM5ZQngSOFForIIwhODW2jEa0UWg27qzWgcrRGgj4kQ8WOx1tctlwX6QB/TQ ulqAhV9s0bryKx7DrKbLbkfzpONIO1o7LJERtF4rxBjGZCjbKfI8+AQROuWCdVPZi8dXKNeSX/Nn Yo5+nsC7fp9U2+eldx+Tnv7LXf1sQPjeuBw4HsvzXcTT5Zo/2Y4D8r4SkY6IvIXYGqBvTZefsuFY +PSMZWCW6k2o8CXiuDVhjyq4RXe7tL/1g8EJSC/FatdIPCMsZEmwIsnTJQGdIc4WIVc7Vw1PsyiW 7M1xiEwVdg+gS/MwXTo3vtPUTrRAN1tznCuExThW4QaLv6XFwtzdFSDuRrkol+bwGmqjXaS7KicA Z3/aKabHSWMsPZwrArApQjxWXstxnABEHWFVO1frEjnQsSqJVrs+e34cv9sKkswMdBBW1VQV2FXY Gr8dY/EPractAWvpgKFHlb56IlKNJ4ImYMp/I+InztnXxn7CO34dgeU0Ung9OD++YOcTdeG+54dU FvIcDJSwjmknfqbB/wb6Y+/5vMtOOgv2y4elFxoGo7Iyq+P4g1Q529VjUofLCUvONCkyaPyrJ5Em GZbqtlT/0rfKC+B1TG1a1xXlSqIbPbupAsqINVuaIkZMMhNwfER0NEki07dztlOdoSOMH9U4OcO3 cByC0wWeEi9VEeG4tJXRclmmC3cBfY3XwXcCxpLcgdxgYRoUCQ7Nz7srb99+FhGIy3Eg7hf3722U nxbmohxw+yNiAN21OZYmaJ5vBo1zQpUTKM252YV42I2Qy3oChEZ2YuKUHljiKfjvrdbBhw0KrN8X xbmRRcrcsFrfgi9L/lXrObBwh9a2VvF0AVVUtR3QfnFmGJqwtTUxCUvaNO2KhEUkufFtiQHHfF+f LwGxUn6Ppz6bgqDwHRl+SZEvtfM0K1veL/4738uPzEF8/l6j8Gox7fPrclrRk8rS+aOFvlPCGWEA VV5Hvl+6fZZ4+o11cEzZVu4A3X2YkwWXjUirK1Wb5oGvYrcJp0l2W6+NMjKv1Z5qa96ueANj5cUd ntU6t3cTrbWIfBCU3eV2vQtEu3cTekwgrQ3fHjcBEWtaPN3dyPYQkO6j1WpaiZRW7XFErezmPHuq FTgVWLEemitkugSPRgTTiKy1A/EhgnL9dHE430Kw0hywclW4uyLK84GnT5S7Yx5YuzCH411coesJ zaFqnxxOEQUPOMZGEyagJbiMjrZJRtt0YDtMvb9a32h+gThxYOUPr4Abkm+4udizuL/RnFYju1fg lSS26seZgBboUYjsYLVdVr1GJiZpRwxVyc4/r4DjfHHf5zRADwXNupLSxOc9gEI8IN6W9qcdeV4d 7kZfI3L2KJlt/HoyJV5WXtDtreUEcdh6/qTU7x+J9WXBDkYD9DM0739wmnU34hqvO8nK5dUz8mSI 4bcjs/KvirEPw1n9hNd+Lazh3oaVA5dNoug1Rk/7r+EsSVocBD9eE8kPOjp0B1xjd0d2TOvO0/Hq A8sJb45TtQDW0BzmBujSPDZQRoh1InVqR7Wb1CbP2tw3EqbEwhy85qFyf06rUc7aXIj7zHhzHMpT 1SJYqvsEi4yGxZwukgffVCkD1ruAluOjCWcjO3kMSxdX6xBSP+KMdRhBfwteyp2ur4/aNKzLyeFM lTzRtwh45DvKJgT96Q3mrnrZqAmwRBjBA2rxCDXChrB6zZq2W82QPDS1tgq4u0u02bCeBE4a2y9s xbzfl3wz3/YE5QBdvgdwVrGgSuI/+yWvYmnPoh7K0/fuzJ9W8Tlv68ScFaPzQvMXwPZXwgnoMn1b tp9+3gvn5j9tyDANAdqL38xtCCNx0nc0pZqYeB5JOI1rXdLas2UynDduYIgMU8Kg1nEeiAb6Qdja xC292xf/CNbT1oBEroKA8HcVdo+/g9Fm61bjM0pi0rGbDI5tfKtlqBb+DpQL3FiEOjhGSO22K7gT 1k2kogrN2XmjAHGmJM35ARYh7kedbLBw9503WE474+F1FuDNcSDO0grWi1EYyjmh7EI8zB2kpmoT YOymrqrbYyQd16YOy8TuNmHADRGUbRkI2U8wpSqGIqxi75hyy1r+ofcGEgZ5m3Cpfh3oxAOvtvSi xKluTwi7KxKPUBMW56p3mw46moEACtPmADnPFF4wOAujn/eFXwdtWV1a4Bc0x26QPS2lqaJtdVFP /Atf+/Uu5L3afAW3/KchHC6zYg6My6XJ28P29IuPqLc9Ab3JzgSCY8WoXuPso/rD5UfquP1xUD// wp8UVLNgR/MuyF0ngFwtRiMG30Vwgzg6wu6jqvPYXsPiNf9xtgdbO23ju/0m0RO/wVa7426wENd6 erXgeC3hONhFs1uCtchlNEKU6xnWJsIOYuwC1nmkld+Eec2b3g7NsQCdn2/ctla+8OuwPkvOsyu9 GFe7tYK1cG9yc7EqF5qwlZNjQac0o0Ph4SQYDzcpNgg2ZlRHx67avT30xRlL04Z1EIC1qM/2BhZv +DiVDRkXPYRDDGdXu++ZehfKW21rR7pQ8KeYhJDUiAAAAEAASURBVGqEvQxra0w8CEv83bQ69aw2 vWhae6UVwV4Kr4EHkjOPE+CyEmfxflq5b7+0RQFScgpIBWF82kmTlA/i2dhhu4Y/Ara9mqzfT2+Q zMc9dwblbWDL7z8vPT2rTp4s2Ld3kdMGSwQDBeXobIagRxOzygxtvcU+Rpc1LUma5gQwT94CeZIh Dxs0CgfQuwk9qG11OEeXG6uhJ/Gt7d6e6FWEtqPJapzrlNLU7E5Y0saDWHMmSbY1RLlL8t/7pV8R 6MI3WnzHDl6nSgBaGyeCPPYV6KZVd1g07zT8sxTI/qF/+Rv4BUcsKGf3vDnOJ1jNdCDug+ex0hxK inJ3V7BBuZhuwhrcnt0YIc7NaOSodvfWsIKqvbR6cJpBgfNutR6+0MEFOx60FvEY5Un6MhwwyqBq mGjBj9DahMWDjbBqvNb49kTbi2rEaFrTdmTrdFxFkiByaBG+BHyGzgLBT1bhL2wS32BLnMnBpqFN 2A94/w90o4YlCR+9injS+pcB9y0vPPQ/5Tx9Rrr9HbD9GszFssufz05Pv+B42pZhXGK2cnpriXV1 3H4je57tmf7LL6TrNxt6E6e3lnuey6o8zpwHPGZIfs8Yn0JzU3HUIZHAOmZ6oHbA8SZgJ29tntWT /O8G4Tzb7g7KJK8d7OoX4lhWxMErzEW3tSqLtTAXEfJG4Byfc9IUj0MYg5MqQ/MWwi+qY82JM9kU 7L3wzU9W6ACdH8ngh3n54XWwzgebFoHOHgtl+1YRa/M3fw8a1ue3tLh4ODO9xyKjcXIfoa2irSpu sdySCQuR40mrTakmIKLfD9BEYimn1fplVY4XxFyzRAdAreNssQaYNvk7eNVNPbWIJBKhbU9wSRO6 SwevnG1PkuBc9XCOakaMP8JUVEfJVBEpnKVszrBYAM0AGlK796IFXhBtW01fSIcnZMePJjKreP4C 4H3CJ6747aHTDszWdyv1GSkdYTqpsFtyOX7Zapezm/PUa5vDBfRqbEpPLM6EyeXB4oR139YE2EWn ejcJARQOn1/c5g709tvF2TXnYJnV4bzWVz/jjoD2rDqeA7FmTvAYi2q/8aTV+PTK9lQCWOSitYpA HCda20APdmXrNSvQw99ViGP8shvBWBQ3x6na5Bz4V6Vf+VVfQ9Pu+wSpgD5Md+OFX1rnYXP+K8W9 f0xxWpv7MRVMF+XcI5wcz4+XzbDwVJS3DWR1prorACN+LYIb37CI7gUNEhkxArqa5Pur9ZXs4c4Q JMIDsIb/aakCxORRO1CsxMSmVW1AdOIRFPyKtgm2tWN2mzoswavoIVrnpKVLjpRTyvnn2oLvvq5s zrCUYP0u32Huhkh/s+W0+QDHxTp+xAnQ29M1//Z7/HEsHhhHX/4mNYPgO9sTuNmE2XJeUB5kT88z P2nbabkfZsd0R2z6xFZFbJoUWtBMcACtiMeqR4czIjlxdjZjeFdjV53bjNPIdY8Ac4/E5ZDuQHj/ G9D6uMtjT+NgiIb4OFJ7HfR1tuASESu+w3GERbxqQepaQCqtMvqRrDkdkX0zPuj2q0D84gqPITo6 HPdhREjNHgtVhxjvGThpYrXu4+dZpINvtmJYuWNdlfOxVh4w5/DdZuFcudPilcPFY4zVOFNtgT4o 3M5pjR68jj+RkCEasb55jAzE3+2tUyEjRcHmrJrqk5ROEr2Ka0NAPZq0YBEtHBVt8RPWRY/x2PSN Z1eQQX9EV9upbkvkGjBG6QCbnBivDdUcEWLbH79YzhgBrCl4sJ1dlGzOgLmAT+TJOzVWxCO61RgI SCuM1kakunnqIRm0Huxu2cY6xYha7HkI34FO+yp0lMLGqJ1be/Q7T224TxXdwTk6nACdIbCf8eZv 8/70TkDfyNM1LJ4IMZoqRFA3PYPadspQ7fB39ZpO9wQgehoJ2BXpRavgjgjH3TG/xnHgu6JczzHE B+upuirXuioH39B8e/Tw+36TPyvZG6EAZYpfEaIKkVl0s6/Cfz66ZbXOR6Pst5DQ58ohOw/A8N7g +eEwFZwZN1uAZrgZ0VR9Eh3+KkaVe3wkT4D+a/OxI60IDgRxXq27MAQiNOzajS/3n35hSJ2x8USk ybSpXhPdEfx1WCNvgNLqLl5NchCfvkR2hugIIq9pm2xNQsVuNfF04Rip5kj5tHOMkiYEp5Gyvcbf +vM8A8MPiMMvCQjaoKq6CSj+hqVK2fBda+qV1GJ6I7vlQu2t6qesaToJMmzfXHUPJ0PwHnAaa6Pz HtNpddraVCMCcTzRHG9XPRYyKPgKEr/HxB3LJc5FxbUeyHobP2hl5S3EbFaa9lHHenAyNwb0uGNW oyrORHmALsoBLgI7SmgOvmnCukbWpjrgDrXbY05RzvsHQ4Nyfg8dlHNJUzb4Xn5CCyIDcQrb4lif XcFCeTZVwDrde9zMBCfJtx2Y07sCKPe7oPAdzR++EJw5WDi3nJxeng+2HiN1N/jYyQVJwPlGPm3I RHfH4RxMT5XJW/BwAaCx+6t1KC9EYhsuq24wra33PPVHAPO+17T8WdDUcwhsxoqHJNF06WJ8Wluk KWLwFP+NHsMSn4TtSYzOrnY8msOhdQT44DkXBCeNwivHFcCfkCze81hkFq3QTeohAscNxJfteMTW FMiexNZaK/dN36f2WiVm4/j9MJynPOf/y2H15LkblCoTuKVk/og+qPDdY6QpR8SB8CgbN6pnSaxz ud/CaGLotWL0lr5rr/YwAQkSa6v+RHa1dXrFGZG+LQ4mLMd7VT4Inip8RAv0ALTpqW4PYaNIdt8q GJQl9vaP305f02dJ7q+TuxiHudtXgU6/n4VgWZ2HygG0H3UCaARkh9rrap3ZOjp76+ecpx/F9QNS +vKUCzkhoEz37Y0zGUpyW7HlEry2TpPO0ZQu14Q0T6tVbnY9ozVhEVKeeSqwTNvCFevFYJXL4OG9 dQYmBfagMKfd1nSMuBfmJsNh5sSDObTUGxxMtWNaJ2BXCNDVEtzOUV2b9DjENZ3W0V1/LK2dIf4I TwtnlTMP3PlklZ13vtPE4p0C18Sca3lpGCbKwUBQwg5LhjPlT8hudrcW6PTtgpOq3WHxOc/pPePe KPWHApPJrFrE35OPM8KDtcpw/OAwqz8uce9VzpIXfVNvV3N7SMNmYuv0WtG/ehJ8u7hxnh2mjidi DCq/cIbmfOx5sCoHjgIdsUvt4RxVu2sZhTcSv6zPehyOu46G1OfVNOS9oFyOa31MJUQGyjxEQGFH hSSs1lnmM4QlQLea1TqZyeBqHcuIJOd9pbHuddJkD0yl7a7VmchbBLetYbt9uVDXOeCx8MoisBa3 jNS8rIi84ujzan0szxmAwiT0CxGmotitdtOBNm1v3J8993d4yADCsNDNbF1VJ8YqliIQH8RiQ1M9 7HHVgTJcV9EHZYzb1e6F39KZR7CnBcsJhClcLnyyys4Mi3cwRwFwzTupl6fOJSzOIe6R98LrM6kv e+up7mP9QnCZbjBpz6A/rdPvjXL57DeYPgsja4uGhC7SPa7WNKU7Hwtz0XOVc2ZyS+SiX0VuiV2C d/wakL4Ji2cViVEkgGrrEdbVgzCa1umBVDnuCh0L/kJzWExVfItFPZBRTGttCkB1JiZ+hQmxLsy3 R1b4NtDX/bBAd6Mc1Lqp0hDPUn3bJzn9nJY4lsjCHctSnVT8NcavcpI8kxnTYHRW6wzHELw92J23 BDKzNd9Yz/ZLc9mVOMSTvy0Glw3ovg9qunBldliqXK76ETh5TUc5uFR6YXHDar22TYKSCLgTHcG8 1cwsztZx3iIcAqgRrI5FRHerTrtIQ1u37+mc3irsiKXVgLa2XvPYK/ZasP5Ys3UVz3B2qxPugOju SBiFc8sbsHDniuTTQp4D6aW6yMMGf/Gs4szc2hAPkWnqEmTjZBV/rymb76et9rwBbGGs0095nI9T umcvWzSZLSIQ70gz0JSj4KjZmPJmaKavyGtcHusn6TsyM7HhOagafK2Lb13d3XlCbRfICqxkR8hc UIiIlYxa/OGjnlTdS0lVYTzWsdgVofjJJ/DlaRMW5kG5NG+Uq0FtFuaIrKxhcfulM2jmCuevMR5w 5LiYRuYZgVOsuzYnvzlXrHP2xHp4KlWFNdaCs0XHtLaXnlvsGJSq1y038njRg2z8vsoG6E9rLoa5 WgcQ8ret7BiWY2gPSOpqa1NtnkfZdSEefiWP+fWIP5rCwQjZlyarozVVhTFt8Xd16K4aOTzXfhbm YDibsOvMTZ6AiPb7dkVfTrV8Zz3CojWwE39dRW+gvAB0C9hbHd/5bb2PdbpI9ua7zo3j5y86nb7C 6hMyl3hi7pUT6H3zmCNe1vKs0FfKC/T28wNq7sBwu3Lpr3dILv1HFQ33cSP1TXisk6TDGtBsVuxO LPEJSKrEZ0kuZNlm8QHzAD00byijm+ajutIcDwClCwV6MijzF+X5j8yiHKq6u+InnwE6nE0Z7E5V oGP5ygVQhsj+qBZjcQYYlKHHtD0oLa1s1DA6xaU6liRMiQ9g2dl3E4ZT12zNIh0oN8fldai9ihXi ibEpVe7QBKMZ3cLr++C1Oq66vO6ruLdalwvaM4v3QMwUpQ/2Mco5c/U14bVUwo5WQIZt9nW1NTFS T2d3QadVYWRsxAhLdQ1oT8IQoximMzpiDb7WNDJQ5TAJpiA4vbzMoE2sg7wNl5cnvoGmJSgMRjdx YeidvtA8YSdeXx5kHHS+UJsRg/st/rJ7cw/ll779p0BGIfJO359VdpYG6InH4zdLuUlc+3AqvBmC xfUeeBLPtbTX/I8xFgijF2geffGI+IBemgvctlBYEGc9GyBGDJpTbaBHmxZo8pkkW9vwkT0WaM7e iI8kSlIILtAHymErQA9nEcH3EOwo8h1pUC4EfeeT6Z4N/iMd0xDiHlcfC6dCrDMBRpmr9RPWeV/0 Ommyy1+shdHb01Unxh2n2K0mnruyw6hKc1HONCjr+/R4xR+s5qo7r9YZpot0wKPAUjg8xYEdMWYw vjWeUV090sq+Aiv8UmBTCIuWhm3TlDBb9UevgoCRZ1QToEgGMz9oD+JpWsdaEyZG4WnkQ1Q3YSDm BseF6TqvNeFPOYP+Allo62YLAcDaj09xyvGN4Nl7uaA8TN9aL4jvLuiURrxOJ8k0LKkqsF3cgeHm 5/rGUh7pVuEeW+NXz7W7KzfVtQD8HdN6dBHlccprnIi2+rEADitztaI8FvzJPj2pisUDC9BJSHJ2 V9jLhuOsGFyVs/LtAq9hKAvzgXIX5tdQzqMpAp0A/htBVuVAkPOzFsnOfDgP/C1ybebMmUn61tJY H6t1soFXF+lB8C1AT4yw5r5raq/adw5R3gc1Lom84ohx4VEdng5Wc1oUG9bH56Wi4Wz3Vus0PV1l hfvIDMj0gC2E1dZ6wrvExN+ehLUgm0zU0pTq8IxeqSZMD9X2REdc6+hUu7W7tE4MQj+WQgYuKb4S DeA2wp5+8VE0u7aNhYZZ7UrMbnJfvokJZK1uwQHxRctumjZwu/dyQTzBOPMGYDV8P3e8vDGY2XeO IJ5xPQTnmVn1brsBfEvLHRjuHO5YL3H0egO0h4AHb5iOR48/h60eJBlz2B2xF90M0fhWc9OK71QF rhx3vwW9olz2ifVwMJTHk6Z2mpyx2GDhZxigpDT3uXL4uC3M2U452aDc38nCD6zhaa/BqeofTpbS 6+8jhoACkatajy8rp4LVuge7e3Q09Wqddwt3cpjD9pHpZbVOtkYwsKY67Kgmvv1xRkA2tJPHMhAv OsVLpa2XVi4Jr6JYhIUwncZL8HDc1gTfrdZXuMMIscsBoG8va/yW5/QOoTBtEqYakaYWYksLzmhq ulmltUnXAbua+NHluJrkLUbmkcHIOCPsZfVaBlp3AxKfADf0Ocn89crDMA10sQi1EVohmI1p+ZhW Y6SnkWSzio1HsWG6HnhHh9QSPBxPFbHq7mWAdhuR+NNqPaM7dKYU4beQvH+wXOvaFt4Vt1juPW+k Frd07JhrExjTswt3aZcmu0DHAiyLv5UIiKWbNoAW1r150vgWhW3teJf8X/42o+eLQj5VsqHcbfEL ymF6fu/QdXcDHR2yJ0zc418X5uCP0yIKw8cWLKt98+MssQvkar0POUfEgTBnprc9cvOW7Zl3R+QQ wDrv/ZwZznmP1Zi+ppnM2tQzhGCpejgcUa6BvjDU3RRqK1brtUFHxJqqPfdW61J1l+/itXndGsp0 tVl8oB0uKI9Yx8LDEFpApohnt4pT5I1WgdisVMczqsYf2DV+N9Uats5kHSW9kpOY4aQaDwfLM46u taWhKMxKHCCG7w3H6DA9Yc30ANR4hgjTXaTrCdzvxP2PTIU4NmXreFrgb9O+pFVjt6M4wd3DifVI nSpT4h8hsbTkduISzw0Tkes+ngiaXEAZI8dzm6XjKkL8NCVnRJpakJzijZrVt1XYjacJHtq2CNAH 1wLoMK6FrR3TOX0bYBoIFpjgDw5Kc9bjG9OL4y665bU6EJfdIl7cu1jmkXN3PHiNugSFQ2R7RD9d slrn/GQThkPoY0TjcRMGrDN/RqcId7DOUzocIOef10hMkx+h1oIjnQ7dTWr9q2WSpE3pF129Xhi5 9rwqCOMlQCti7Z4qMdE26aHjMwDBHcfrWUadtFIGcHUeWA57bU2SiDUGz0Er8CIArrUVhXpW5Nm6 a0VhukQEke1pp9nS3Wo7aer4VZu5/XoObJoQXXoslursqrtUF7LgDxFAh90RBIylOh4KXYjBNtOz M2P30Jb4s+e0pj5vwriEv9Cc4OzDDJTTpGcD90kr7qxbPZcNnx7O2Tq6OzD5a5cLPffPKrwNnsRe A7q3lpmhsyIbLPEQpkZYIBGoQmc7ReCCYEQsIkWW0RqotY4TQResrbEICoCjlXHRWGbFbHmSCgRv QL8szKEzmNbKa1G+Al2mg3iKNM8nn0E5NGy9wlGgB6ZUKXTxfDJP9vqPV+vButPAjidhwB8JSRtM ZzjmEx3RzmhnTh7AheWq8GLDyuggm5nnOvQohpXjODk6m1qgLaNXV5NhW61TQnapqm3IcmxUH6Mk VfftUTL0+vhjBgVkdNdKQ6vxR+gn5sF489CxyUhVz7D647TaGRLQTQYM29WR8CBJmjJoPAr8nMDz v8g4PfoC7CAsLAbNWdXiBNZSO0AXiyAyTQqhqT82TgTkbbutzU9Db/ay4j45Tz/pfkE8EN9aL3aI O5qL+8uuzjnP6Z3DCcfSxIR5BsalXJOdi/74Xuq74ljn/oy4Fh+IXwsAnblLhamEHRba4tEq4mlk D2p3E72smhmtwEJzLNPQivLt49Dv+02eN98W5qfiWlvdHL+mw3FRDuksvCgKOdh2cNN9dpz6jVT7 UgIvpu1fM5yQPt5oDipYZ/Ku1sE6cOff1GS1zpQyimK1TKCdmTl94VgutnGZhbAR1y6G+I3k0BDp RTUBLfDbpE0XqujT3vppkd6oXTWUHCXPSgegiHaOeKtm3m3C2ePuxmzwOu2uwDKERIugSoDga2vY NTsiu6o2bbrHGY9i7ZjIbkqvtMajyOEkYO2OJ60ZHQ+X7IbU86r5DrIbfE+PCQp0qghsiq36u0nd Nl1WcY/ylzlsmL4stBvZaIDeS3i1VtYbg+b9afOcP5I9/Rb8fb7zvsVXGbm1vM24AdTeCeOWszU3 SWO6NQGjmi63CEDJDeaSHKvmrpPpvTAPrIFRQ9yq5EKHWQid2vaj4TXWeKwlEGcCaOaPYIacLhfm oDz7Le66QMOsxNEA0Wr8IbvLYdAJkV1lwz6oFwJG2NqUbJ1FPc74FTSR0PdLZk7pBxzHGfDwwTq/ CObeEXNzklieW++99azWMyizRcMihbZbPRzmw3XVl1brW64QY7gwEFqOS6cCiz+aptZGdl+CLefV OijhMChj7SxnaaVwYIrVHjQluFOp44nYDdYJvBCQK1U9jUKa4jQ41RZ2aSsisRG2dlWdXqlGpAkR 5xCpJkZP2+TZdaZVQYz/zU7Bs+piHeYCwbFID7ttBdbtaUzTNFA+qluGWqqb0Awbi122n4TVjcin JTxVyy7TuzVhJ6yfvtN0+cIqTWaL5cC557mvVqz3zdY6d8XTKOSOCQU69+FaQlshHouwCOXQKtWI NBGP1sZpGJbC6FqnwWcPcJxHQaCeBdKF4whgDbjD8UA8mzChuQtzeYcVdqsN6G0ysi1+k0RY1Qa7 YNQT64Fkb30cuyeBQ85qPe86wp3ddp61570NAnI9OBOHXi1oMiBhxNCL93uvpaflimImHBrHJZSj c7xDJN5IrB4t1bvV+h3Q7++nr8wVrByn4glt8itSHWnBFh5JZ5NcQzfpCLDgNHg3rLuoDY6N6Dzt PM6QXnTpXqmug64JkyRNpkrVAHNiX/AjP8mjIGd6njAKi6lKWxBvNYAGtWirPhVjZAJstWqwAVjj /YUZNWEZC+waqTjb/lZRbaOvy/ON2rVjs2H9VNqPtjDotlR/09u5K0L2hnuude+Nx7O7y/aRWdyQ 3/V4r8ppyo45GAI62BZWsUGzmsh4ImzqYMOwDIRVOB/OCTOR5qxSWZXzFVDB7eefghv2wWusRXa7 A4OOgIzs0risdj2uBXaNb3U8QbOegBJhkaepRuDPEp7X1BPucbG37lHntAzhkzC9WicVRzeehMnc GDTTQAAWrJ72w/HHRjnzzyG04IhGE1WdbXVygeHsy9hq23urdY5Eql5DvDxdLXzRyakZwmpg3ex2 lDXbNQ/kosmxYiO6qSPRxFiMSdWmBAzRrWlKX0QHDP9o2q3aZTSNtLa6Hu8hWhNDcWMdwG1Yv2xQ yGItfoqMhrlSPtUIkU0VWGuf//yP5l+kBuXPe/afUSeA6m4Bu/oVTINq222q56X9+R+obtUL0NFW z1g/bbJvR3HZjTn3fe9Pfe4HfxrYYv3F/QZluP/Fem6/CG8Gq8PZ98k17a1IqzchNxJl4NvdFZsk LBYEMz2sWh6tdAZMDevdAGJIFYQlIcJBmQAzhOacBJhF2bbLv/on+Ba+ND8/03LZY5HgTXM8RLo8 R9PkwlzMcd4sATr+wetBwyZm6+ASp2X1GM+x+KJw5jl8jpRNmAc/Ms0mTD+3ziYMj+GbhEPocXva Q6faF08uoUzv2pUTPzP3KvISamsTnsTEkzDy4NQiLO1U363WAa4F9g0K4+HgsX8YZRf0mUBG3Mh1 2YQBaujYME6nKBR2NulPWAuD40mvJLFpt5peiGsBq3940reFmROp0DlsYsD6+33JN29Y99/Xncge jIpX6AyLe3EdmkcQiZbd2s//zM96+cv/ihDH85z3/pPkoaiJR3R3x4oFvtGI+1i//NPU098WG75P oGf9HmQ32dVpEvHYj/pP/zxrNy59QcPN5m3WdyCXe25CNIV4xWPY3E6BOIICW7s0x9EUiSyvJbKA 1qMdcO8qXahqmUPGQvPu4qqcJfn2yec3/TQLc2HN7zYLdHmNU1i7TgffXXSKcpa3WSzDNdgdlMtx nZLXYCzVtnJTj5F6DqwMTUeq/Rp58vMkjCcwNu95PM4I1n1u3e0X5sBx9QOOHo4DcUQIh24Liwzg MTP84yrqia2aqepUYL3qImjVM/wG4LRYTS9Ej5VqxHm1vmH08nRjL9WbucAxheOMRjz4SanBnU3d STpm9cMvnFpbBRwaoUV0WPuHprpbpCRNCmzEcXxaR3xXV51eGbHF0B0cTU7W8rx2FH5yXSwCPgEK Q90nedF7vd9ffPaf+cKnPuH1T/2lV37YR1AV0w1cdEgNpoU7+P7Bb/mOv/u1X//iF304rcSQ59tf 89/93Fv+PtnQOC00CXffNkZmm2KF+zZb99xPb0LnyfunxmmpTpKwntaTXh6qedbHveZL38oFTYHm 3KjY3HsIb5i+DR5bk8qBpDlUjQhhFcE01eZy6DOEYe0MnnDSSkIsTqxzwMJxVuXbXvnpeUQhDrLF dwAtxNPKst2Y0DyR/AwLdAN/oTYgU7cVf80+wXejvdax/WoHyquZF45jz7dM11PHGeN0jb11Dt8H HLMJw6vJ1cIQ8rpHxwmg8MSpIN45OKVxdTGrzDBideLxmkR0idPLLJZUdknAQXKD763WgWNouwpa OVrscdmNSbbRV3/bEUDVhPALrQVq6KAt2gD8DdBrwXYn0uDRqzMkIF0UXe2Y9I0zntFl198x6CTR PyytbtGA9ed94dfBwTPTweJp0wMP6+vPeN8/BYt//lv/0e+9/X/BfsWr/usXPXdbblPEN2F4XIYr 6EXrq17y8b/w9v+Z8vIXfSRVnH/zE58iw7t+7Kd+4XNe/ZanPulbP/O/edlTH08Xad5Mj3YmDIRo y6DbhC+fpm76QnOX5FrJjt2q2YGB/qcNHP5A4cuQIk+sc7OtIMjmeJoicpNcE95guQN3V+WipBEM WYS73AmmIwgeZURSTXF0OM4kQbl75aCWNSkbLHmIBUAD65BdMaoG8CwswcKut8shF0WiYcN3BHci nqy7rWJ3C0u9Xb9OKdkBw2MVG5Jy4L5kORWernEOrdIUrHOYrNbdR+J4wbo/HkAeEno4GS6i5xkn k9m9bASu1w9pETdaO4bXXmnY9oyqyRPZYzGoHe/trd+yTgedKTcu0hOvOIb4tTcA+oKwWASA07YQ gqNVFCZ4kPGW6i5bd51kiz8iTj2r3zm0P11sOrCu1jlvrNYhHctzrAVQSufvfNl/8bvf8p2wmMIy B/u3X/PfvuBDt09TgbX2za97PU0UIP7mL/8yl+d/4QOeD8Qpn/eRLyaS8iOv/iLeG37na7/xn3zU x7/xOR/yM1/6lWR727e97SUv/lg4DrW15KRQxeIR6Oh9svvnxQnTZ8rXml183y3VL9vrHqNYh5UU eMeN5w6M99jtNjfP6MKt4pK8ac5YAheIKIS4HA9oRjV+Rbc2603IuBGuysdDLKAcSOUhFthNNRxH p5pVOQKnjANnQpMzlhKIN3ADOOJvYfo1oAtHskVkFD3DUqWsGOXMULJaH2c159ZNGD9I8Il1LM48 4EgSDnwMmulxQ6k7gHgvD99fc6mQSh3RVYKlcFoR8pcwdTxdtVdshL3adjb827dMOYAAXar2h5l6 CBuFYx6ernZrMkScIy/bPlRn0+ljaE4ifptAHiVDSD090pAmnNq0GrAy0S76V62nrQljryVMqvRF rE7zJMZsCUvyeAC3zohUiaGwVOeEP+eVX+6uNLyTqvCU/ZY3vfA/Zs8ErLO+/qXX/A35Dppf87L/ nFZhzRqc+yR3CMTh86jv/5q//7de/mksyWmF77xDYL/njV8Kx0H/D33sS1//rD/7mmf96e/+4jeI 9XAcQbBzwELqzV5mFX+aFGyz2KTY9mQuC3nJrt2+xXrZiz+Jl/OPcliwcz9wQYfpXOi51vGvpVvR dofd3IRYSp5dAa+cEEoEJwqtDZ31WB3OxPcZjtO0WObAuM7EzzzdXWE1zU/9QOQ8gKjGWrIedwFu Nct2iU8GdhukucSU5moR5pKcMKpuTYTjETRZ9Ei99iSgxejevTpMnemtTOd15PxQfBLGF8WzOt4a +amv7K33R6as1vsBRw/W+Thu5hChn0jOWC4wZ+J15bXkC6c/VxTOXGkJa4G2GGmSWCOTc3fQZEvY aRPmRFXpGaBb1QamCo52eB6pumbuUdAWXtEUAzZ+Xd5d4BpaqOmXdGibsGr9BCvSOgLSeovozK3t G88QqXZYnIq2hI3qmButBmx76/9qW61vKDwt1RWw9S/+O3/C9TVAf9uH/ydf/Sf/fVbu//oNX8kP RcH6V7/wRZCdMrDufcI9I8H51DRYd3nugp33CTLQ9JIPfAkbOKzNKb5PsC1DCdz5G8K3HPf6tUIc NJ8x/ayX45HmeGT91npZy589lwN0c0bW87gOv0XMv4ViSctVzh2O9d7IjcFF34VWChCnwFAwIdDB axdOguxoQUCgrN8z1hZ/V413mc9ADOeIzEGgI5wGKPdjTzdY8oFnMx2aC2sJHgvW1eIemFKkkrZR jsflOXd01umGSbTVDjpfCyCJTRFrJB5bOwZNYZLe+7xeK9k5h75wnLf1JOec5xccOSdinT9TOId8 iMrpJQmF5Jmnb2mZjCIW4Sla5xOYDmF1OLkavSAVuTgVHBfi2JqwY9YhNqxnqQ4aBGhbnClgJbqF uzGcIJ0RibmWUL9h0QhfV089u6JU4RdhWoTIi9OJxeK3KR7E0HqwBqeqZ60StjrjsTUxQ3QrelST BJGO6o7ssNbZW3/u675jexLmspgFglCVXfVf/ZI3QmdQzvoarLPE/o6nPpF9FdAM8dlI+a8+4IMo eHJLDMFC/rV/9a9vpH6v92PxTiQJKWRg7c9nsAwEzWG6Ag9b+RRwL9lFc2iu0y0aYZ21OdUzvt2I b6af9HjrEut0wc/PwrzgZV8C2bnouXi47bG5c7j6Kd423gnNdJBKvMXDb47fzm76rqwhLVNiJQ7K t//t+aa38984+ed8PGnnHJgzrIFE/Je4bd/g9T/u7gorbqjkh5w+oYjtFXovybPHAnxlkBCHRAjA pJVQwVmqck1LBvdSsOimeWuTaF32tmfVa19GJ4w7GoumMEkmnOKrFsvLdwbfO97JWeVUY8flShWn WPdJmGzCcOqyt04exspROxOnkZnjNMC5YRvrvKYULyqvKHIO4cwJs6lb0Ti7i9na0mrfDrOjqdoa g+e8CcNpBaYWNbaF1ba+GO25UYtvrV1a46HK6WaKvlrcmUwUwLkmhWj22jwX0KsDO/zRkjFVhc4O 6wBaDRh9h3O0JkPCImg61iMg1eQ8EGS2cDis7N7jqc92/QvpoDCPvrAPLoXdEP/c93zvL3/PZ2XR DZfxA2v2W1jCr3eIHu4fNiX++1d8Gm8AvBO4mQPWXfX/xY/+UIYT0/CdjXtHZJnPRhBNOCU+VbRW gaYjBS4TyeSDe6oUOd6CmM15slsX0X9Z4AP3T3/FK/mfDxCTW4I7XMQH4hBcDWdppUhtRA42TjzB tKLtOF0dSQZGZwiGYzL8Dgkf4mnPP7py+hUt8d2W5TYopzS+1VhasdJcJ7srYAtiih7uHYqfHiPC o5VfgVezjPj2P+2a/Fyozsrkaqcdmjc9uf0pYRZnlcIryLkd579fLD5JZhOGN0jOmB8nYDlj+ad3 JGSUHKDT4CxlbgharcY6mWGZT0/PVpyINBGgNrL9eNKqv22SxBlPROck7PyR6QbWy063kA1qI3gx dgtHvutv5znJ8k852t8DcbqZKHcjrxOWBbuk65zBGQK/NvjrKq34tQloQTBVrf5oRHR3iba1bVI9 6OzMrXsOqz9DRxBD4a8uLkp+wRHeCUQeQAzWQTDbL9/8H3zw//QBL2DN/t2f9l9uUL4Ulu0HC/aN 3e/4YSyFpTp52K/H0suderbpYXTYzfYOWCeSB2lwMhmYTmG7hkiew+G5GhbyVNPLCWt9J1DnWBRn uyzh75H9mZ/EXy18R+nj/tJf5tlHFsjc/2G6gkufAnmD8nAcNFu49tK64kOPAV6oaAppGY5BedyC n6lh9Z1/03z+Z81v+Vm/58mq3IW5S/JwXFhj3U7RUiVApsspVseU4EYsUm2U25r1ZjCK6IWzuq2R 48PPrrYmeFRXDzMxJzba6WGZ8wC6W9jCXQvChJcE5Az7daR+afJ68Qq6t56PTGG6a/ZswpCHzP6R 4ZSGdXpOWM2ZpAsvsTzFjlmR00kS4zzXSD1GGqw1W5LrNA9akZjVkybEvR/mBayytW2TFI6kytFG r2K3tdOq7dgaD1VOIqfPu4UDQIMtg52DVpzh//+4e99Yfbarvq9vQyMVOw3XdiSIWjU2iiU71w42 BSlFiYgv9gsDFb03gJV/4D/BMVIk29zGVFbAvrVJDAk1NsaREY5BVoAoDc21HF0lVhxqiAoKRBZX V5ESkRd+YSlq6Yu862fPZ+b7rLP2zJznnN/PF1Fpa+m71157zZ6Zvb+zzpr9zBGkiSrYUrEa7AFV L66aGNSmGATosMrZHk1VahwPrbVaxqb638U6gda5bqSYycPAiZCjOROZl1QMnP65t/wNYnOSMOTZ jeIhX8gdjIbW3/t3PRXDCvmxd/4lcugkVUbiZUm4Q9ySO67AGJhbh6Y5qJbZFindk+Xn5Soe0NOF 8vTf+Sn+RCBj4/53OkL9NVSv/M4ZVWZvVZpSfB5oAL/zQvXxt3+ILAcjZ0aFgqlK3HABWEYAWGjS oLJGxWmlI8Unh/8WjpCcUFE2J1oceQAC8+0Lt7L5yunbjznD6YTtEnqldWNz0i8E5mwtl2jC49z0 SuUhcQHGtVQ2r/oZz0ytzZF+9jBrGKpKQEo4fZfKZStIgBLmguO44BTvYL0vYu5yaJ1LbbTOpeOq 1iQMxOKQuFaOh+GpEWSQAofqMJBSsAML7VagDQYqtY+BHdMdfczsUqvNlWOoBmLN7vPKVHq9XjbW PukYSy4imIsOVcnyMBcdlfEAx6lUTxWgUkwrIBqxTWLto78f0El1FdxAtQTX6jye1mp1HmHMuFYs ueV764PWKRAloTGsDZl+7om/QpBO7oUqexMJt6FyMKRv4f0n2RXYNoTlCqEK+VKgY4gYg/EkePY5 fFIle8PeR1+oSt8cFD86J1qnih5OR0nH8WDY/kQQo2RUPCTG+9slfU8XMzMh6AaMzaOU7lsVJYka CxhyJ7jz1MLjgpkUzjXyOJKFROzvf2qGytcEy7KLfMTjT/2a3A0pW9CMwHzh91UuyRY43WJgblQu VhJmshmGuFL2CYkHqIeJZO0QkxyqNCwVh9zl6F2mrvbVjL61yoTEpxqWG1jpgSIdUsix8SMrHT5S 7oKwGEDK48rP0XpuHDfaJAy3gOsJrfsPr6H1moRhGD78MjwHXC+gY47MIB0SUj4NO0cjiMRAG0Hs UxWEqemoDXL3EBjoXLNgqmsShjsBKSAl1tBrNIBbi3f0VrNrDKRyLiXAUnsxk6gyk5CQGqWCRnw0 NU2r7tJluFLjatOaqrfZjNZZWTXNoFarmbjKelx7Sev5Ni805y9CZU/CatIvkLL0jZReYVVpnSo2 FOyzPASk1AnAWSojD/P0M2A2ucPyw/OSloH02QUfWoegoWnMstudkeSIeZDgCox0hDwJ4Hfjd/h9 ZvZK3+LK72iI9Ff9FrxzEVSif81rv+UnP/hhQjzJnVMLaLidPtVK5fz5byE25/0nbE5gaIJlpMiX wLwSeig7AHIxKkdjVI60FSCJw54tYy6zJK4M0QBYelWmKkk1WUmZJsP/2LTWph/2e78zmpWsO4yV gIw2hE5mdZfNZ94MwUlk0hy0nqcywFsWQLXRuszO5U20TkTPsRxbnotWM2BAsKdQhwfbZmwyb62C ozwCMrJ+Ij1Bu9SOcVgNxFVidrckDDdJlsw9U8NNFTRZHw+tqVZjBuAi0jRrUEJqtZc4SoCsB8fR FBn6Uxl9jGNwV6CHKvWAJsoZYHOiTGuAxqkCakkrSnevQ+tjK+GSXodMSX9DmrAnfE2aRbBG5SVU l15hVZpIlVS+Y4Xw/QBy9PC4i4coCYwxBTC4nk3uT3/me77j1Qbm/CnAfnaOTiH0ppC4H38HLEeE vikcUemhabLwmKGwO57fQ9WcjAkZpKcWAHGLpe+aw6FJY4CFfZBveNN7ia8T6LUz9QSVoXITLFC5 bz7HVpaf+dxbPvDPSLOwoYXi/miSLXyWB0IfIfkSgAsk7jA4oEbl2FDFBt7x154Q31zgHQvkIgcp K5snBg9gNYVwBanSlLh7xmjsG1cBNqVaHdrUJCPkdJAQogXeCTk2kGq1AVtCfIPsPv8FkzD1lgVz 73zWJlr38krr3Ec4HSrkcFxGBlwvY6qCNAE8CzoyHgdTBya32hQbeTnVc5ATrGZ6iJ8AbMQ5Ynr1 JEzlU3jQqpKTlEmbPNJXs7itynvgQV6FsiE1qlJb1WOmsjZVNhRXG/GsP+rV9O2HQkfeoq+Hjqum rNUZp1cAF5nCj5KMYSE7+JQf9xsLQ+vkYeBQ4miBJNvoFfv53SmszcZ2fp2UZQMwTickh4UhRwpc CR0ToeOBrAtH900pkvgdEueI4XSOOxeZnQGzpZJvElRaD0fL1JXcwYnTw+ABaZXxkZA7r1Jr2F7P CwwpsGAw4AFgSA6PQxMUM+bwOOF52BxCNzyXRGRwmR0esSSpEn5XMzanT/tYDGkhEfldQlGG01l3 FvWpzqASerCAydPsY6DeasXNoHWnyniUAE8E9myxufStpElyvEbKZZAy0bq0XiP0eh+5WfnLCU6n 8Cjij6RE69xiBpChVn7PWaQ1J0UX2VMyRVKtmlQr51Zju6ixo5ZgAbL2rTZzr1mD/SUJIym0/TBw 5Qkjc84YnJej7q0vZk2D26ph/rUDwXRolAANkGgkQZVoUqLRIF1iEL2aVo1Za8WsWoqrMho6xnJW pilmsyZjqE0q3QC6/taUj3y94CUQa3a8EEEbpJtpkUBnYoWjSZcTm//7f/NPs0igbEL4+SdLg82X yJ0k+xq2Lxqc+CEwaZ1hkFqZj4UmAXtaw+zZRcNfAHI0D6qQNUBmDwhrB4TQ7RV7DSD3v/tTP+3f 8pXKicphc0JyN5gTlRuSG5V/ww/8IkUer2yeID0kHkIHyOBqpBipHKKRlJH8CqmSuBgZg/COkbJE wxo5KSZYQsTME4xTtWOrxluSMwHpG5sAB0k1owXAgCmwDzgSUItNaurPOKuN7IZG1gutZ5bC9cEA vwkDs/P3UK45twBa343WvZ4SkbhJqhSGGp6twwsRO8IqtUemY9PYhAd7xUyfVAU5xBGI2f7HA+Ti XUZmZkCO15Td7nTk3p90P+plF48+j8Fe6CE7LAGW4IC5SU1lSXCq4miij58Am2LQQG2dcZwA0jG4 2lfLirHhHLkOfPBL/oIEIURfmcKVROjshOFHSQBemUKju8yOEqoluCZ7UxcJ9A3PtoBdA8kdKqeM vwyWHSZE7hhLzdA6Dj1ipDweWue4ahwVfh77pv8JOuYUeO258vKyr9GUi1JOr1jK1l4Ze6pgpT+M oso+SD47DL//7M99ik8g7CRY4PEnPwsXUOBxaMLA3EjQkDxZF6rEgwnMw+aJx421JQhlom+qtbVS PE0SaJg9fApIPqQqg2XtVj2k8r28uX2bnzis5+KYDcwrocNWjdPZy48yenGTleslPg2gb/grtL4b raOE1n1xfUTr+OEQnEhOQeypsZRSjQGALtJuRttItlaxoaoMWXsu1aw2Vfuqb7h1b61TtF7Cc7lS CWVcU7gQt5rF4QxO+kJhtdWqXMZB3TCDAXqVSItKGbBiNZEY21eNfdPamqo+TXpItdmcV48OF5+t +6zXA9eBXyTxexzJCz7NvnUIFELnvSWcTpE9w6pSaoiVGN+NK3K09M2PjMZD4uAnS1gSsJOFh9zH JvclLUMuhSwNu9RJspOIh6zrgcSMIcMIp+OEXpzFTNM+tBJ6YwPWTNYGs9sSvYVW9VQD0iogcqe8 4s+/lR+pvuq7f47ytX/hk2yZkM0BBuZy+iD0bWOixJ2qTXI9+xFJsJAul6yhgxZ6Q8fStDG7UgbB stozwyt3B4dq1Vz0yybItALEqyytVcNRqpnV+KRaS5hOKnfAjNkCkQGQJljEVcYA0LCaKuUsNdCZ JbRep2jFya1D6wTpBOz82TFH69m3zhlxgrdKziLjkYIZGJooBaFdq01pR5Qxa8DqrjK9qo04TSut w7Ayo1RbZSVTaVENM6A1HVVP6DtN9K34yBV6CM5WiUxs3zQJNBAjLfEQjWAmSvR6SJMgSkH8xKxp 0kuH1W3tEnwC4nkG9KKMzTCf/w/scYStCEgpvqscQfQShvsJgd9501upzgwbWgeQqyEbcyMV8+xz PCTInidIr+H8qlw+NQP7w8tZY9A9rnhOwOzo23HldAmdJgCj5WGQT8ocMTvnGHIHiDFmL+Pb3v4e gn2Y2uswLJdIH2DJZwys+gcBHtjy/8LXvJcCrSc2r4F55XH4Iin1NYRfdrZAhYm7w3rhQUBa5ZFQ iYAuADsC0toYtlGwnKsy/FurFc/GOGdSoZ/N4g0bx+PwIDjKHJuf0Hcl6/thmavm1tskzKxjJ8yI 1pcHcJIwAJMwhPO4Yqi5vJ4aJ6smQL2SG+fZ1cHjR2ZHVqrdVWKc0gzQh52bq3TRIK3qZ+WF1uE7 yNEiljE5H8G5ZE7EgCsi3mVqlbtN8VCBsw0NtBW9h1PDRESvJnqbkGjSJK7SjtFoj0xHmqIMjr2a 2eBEUz3X7vqkNcXW6AWt6gdh0kR6nfv1jW/+cdhKNuTVJW9BJU2pnN/9Q+6NW1sVS8wgcYi4Lpt/ 9Mmn2OxYv/VYW4OJ6NkBScI9exVgaoYBs/OLp8H4274XnzcOjB9M8dUaHick4sdG+Be+Imch+dYq cbc8LkgVKmd4rG0OTWoFiuf/u37Ny97G75LovhD3SOmsPL59wZgq24fg9FFe8CZonYAdUiC4I6li MQY3YIfEa2KdJizdx8L1n6lcjqBJQpcfw5ICbEL3Mjv2FPSU3V3kdKSJ+S8XK1Xay9aGY59WO8as AgfgSBgVpEbuG0mphA7RyHdVGqrvNlUzDCw1q65BmgLkPoiMNA63WBIPlWcGAmoShodxjdb93jqu OAoXNufIieeCAyCH1kR1d2ChXQBDVYajm9JzsTU29sJy1qOhVX1AO0T8CC60LqFXzt1lXkgn3NoA F6Vpbq3uHuKkVz26uGroCMEp0dsUDYDpa2uUaMBzoS9KndiqRuWJjHE8RCOwr57jU+WJtG/sA9Tb ESVnx1riG1LLN78Gf0Hr5mGgTjhU+k7So7F5qvIsRMyLVmLtrBbWD2kWcixowKMsv/FZsZpFSS8S 63wrJs8ALHFI2A5xk7jnsQGP84BhMGCUkD7bIvnzgkJK3TelCdUlcc5IdkbfNDZB4mx9Y3LzR7qb WNhX/l1P/uMXv+4tL3zNKH/opWtZLtH4r3t+yR1CJ6IfeCk8CcLsULacnthcog+Vh6BZ9nNpLCl3 yyBhjdZrpvU4kYKrtElNxb7qXC2XxEucAKp91Qc7JB9RcJkFWpHXqpS+1Wgg6cS4AnAr6dj0R1Vu LkVaZx7W3DrzMHOV+95y6yZheB5D6/Qyt95uAaevJqDdmnm0OVkplWEL1LdWqiet6RugcZWtKdUK ttz68kGYmdM5JZji1sIU2bXh0lR9SDyA1oqrcbBspUQpgMhiAHAAKiOxBFuwAVRNmgRzkxpkmipO 95id+09rvMVDBWltbqOvxg1jw2myxviSFOl1CZH0OsxOjFxpPfQNgFUry2OmRmaHbUmp13z6hcqX PTDQNwVjJGE4ZfziacE/+Ma/SX6cZ0lWGn4wkMEhcT9Qw4+kwHyAjHEOuWx1Z/DQejhdKofH1SBb UkVORxKt831E95WzicXd5Sxvtq/w1zeb+nmlzF8zVF/0+Ad4BsjycDosH1oHDLwkZOgFm5ufhcel cqi5bVxx8ScYlxSk+xpoY5ZngDZo7KXUjzJxd/WAsjJyrQYHYAnmQEwVpB1rd5S7hQEYm8NitcAd VgHMNDlulpXobbVjk6kCrilhNwAblnhyVx7PNBNA6+xG9a+rJGG4fdzQGq3n+nMdwLkaDefO5nTq gB2YDA6mqXJ6qNwuMasgNjOgV/wLWnU2OIvW5c1Gu3KHTfeTcRjQ/HBlm2a36kiQAZoxgwFVKf2h tKlWxU3SV00FYmQtmEUfXEHDVNXopLY2TXVrr1slXVixpNeZkcuXYUa0boadnAbZakgcVg2nS9xW K7NHgwH2/IiJVMy8ftAQtmPAjhfyLfhHyulE9DD7SLBsv9evS05yZ8ckMTu9kETxJF74q4IPgbFn pkbrRNOhck4nzA5OIQOjDa0wNbE5mxFZvRTedrKPxTeZvEzmgcebTLIlbE1Rss7dfo4xRJ9w3tBe Ca1jz3puxZhaGVIOO1ReCFkIaGol3aNvXaxWXp7xbheUJzzOokivHLqdprkRpaSmAWySqoRlNfqA Wa/9/SSkRqCdaD0zs4btzDe/sxZaJ1SnmFuv31vnrLkCnrtgviDVgNstHTt4cAoaxoZUE/JVY6t9 bYpGJbLpm0F1GCxoHW/QOvcYqpVtq0TfChTDqTblUTX0HYBlxUcdo+dwYGgLKU5VZWRsMAMjtRfc Veqhyuoh/qtBxdUYfNSE3qZz+12b2gUDbgq0Tqz07U9+zPQxlAezE7P7DXQou7J5KH4GEv0Iw3/g 3cTX8HWlZjEr6qTM9tGsvZafpw7qN5OzAB8VfN6d36ySw+GbBNnWInfD5pxUOF2it4n4GlqHoN1a PgCcvmw6hL7Zl0IJ8HdAVEeC5cO/Ql4FY54HhHh/8X3/AFIgpmM3BRktHgBMV9azDB76a1xMXEyR Jmiq7CAvKCuPxFUAh8DMEDseAKHmyuYa1CY6pjq3VofBHprjStaRcEqS3fLykcTS8BygTQXgWp0N otHyVgmFUbITprF55liide6v0bqSJAxNPBhMwngTuRq5L8FeIq+PSjCjlYUZZ4CYqqU2aSPtzrhq 6NXYubbOTU2T7vTqSRjZtkrOJPQaMo0GWgkGcPK1usvdu8raa8bNbQ4KkWGsVBnuix6NRQNkBQ3b iowfQZOpBtjRarqnFRBcD6E+TQHxpsGuw/gJyCmzxohJycPwa6DQH5iYndA4DF75XRKfJTYoeZNJ IQDPmrkVJIaK5Y6GbTO//pvscM+zoRqjh+IJ/N/5jne+9Ynv5VsCcDcvNnNG8ju0LrMjTYjD6eNn /R8d379FsiMC7iZOHzz+87+JhhdoLHUT5RA6CRaqXDGCONiN5VHpTCpXusLrOmdmSsEowRTATMq2 2jFy9pyj6KrJRui12qicjlVTcXwyDFYiJMVBkRSmjZIrAEDOQPqeW2fLaHaNdX69hMJiDIaRoXUK E6bOq4qTW+dGQ+iG6syERuu5NVyZhr1T6sU8Azgd2dbxOLAwLEpbkVEK1M94NotNAzhXM3dJk8e9 Ea1zm+XcMG/ATLXnGq5FM2iuUg1o9lbjB4JDowTAZRoIIgWyofbBNIEjKwAfldpFHMtUq01aA2Km plYrjn3Andzai1NmDROwc92WTzmOPIz05w8++ddIvKhshC6bh+5bVT072Xkk0DHMuwvquto1iJII nZQLmXTyMCR5kKZxyOokgYNxGJ9tD/xuiM91EbwbrcPjJMR5esnsJExC6JI4DE5hJQvqfsT//v2/ RBUqJ23NWnW5smIt0DpkZ8nalqxD2QFc6pRZqSZ8AZC7q/QQahhJvCWl3ngZhorNNSCjyoE4TQ6X 84UUwLsyyl0Qpd1TBdSS1mpQldX4HIfXjNaP5hu8n2idG11pnb/JWrTONcxlz51CyWryiiG5hmKH LUc71JAsSvUBGNiqHowmOGaAmKmsNvEfm+pWZZX0vdA65wDDSrJKTgNlK3BN01Bl2s3KXc05iaeL 19QqhBU9IFVBk1QdIdJCF4D6AKtIi/pUZ9A6xh7QmqrD3SYM0l2sE2VtReP5ViV4t3gLaKKL95F/ bVoDWzDMzlYTkipuQQmPA3apPEqy5CNR/vQzpGKIoE2bhKBPwCDlLcECWVOoak+TmXQ4new8hd3u ZNjZP8OHBwA/8eRPEqrXdQvm6DA7YTv5FgidwvtPCB1mJzMOm4+M+Ud/ncBcKh8Jlu2Tin/sXf+7 gblmWaUsVAtMZ7GpSiYkVeRJiUFoVGP1epNM56NUze4hZHYJPSwfsNslx6WVE+QQTAzPFF4AIANq GJ4mlbHZBTppUg/xY2u8VeNmU5uOMBQGa/PK1O2zScLUqcIcM1rnLzZp3QwME6NF6xJ6vVbBFYAt dcCS75HcZWGMZz1nqpPKzrNZbY0f+qr3cokvtC4XKKWGJqneu+B29N3+O9Javc4hk9LjylkVRyOI BMiJjTHpa1MpcdNtAABAAElEQVQsQ6ZoakEfS/VNk47qd42PlDqcZVzVpigDamvDniCXlyVEQArr DTZ/4StgPTaWQOvsOWE3oUkVNhcmbIfBQ+KV7sHYDE5f0ugAomksjakTVvOrJfgaOSyXHTIYUKBs Xo1SeCnKi1CyQGNfzbILDfmZj74bGz0rycnI/rA8u2gYMx+GrI8NvtbC74wI0vlF6J//6x8jFQ6J s3mR9Avny6KV0FnM5liQLGPIHZZnYRP/SqAsTgCStRpKTeQuS7qqE8cZOyvDpwGVWKV1LdHXQM8j coNyUEAoQ1BdgeshKm5mqVZvniMHtbDyAZGVyqPUYKZg9ZilKZrqE4NajprStxofYagqTaG2+ZUp 8yQUL627E6bSOnOg0XquOcBr2EC9nmAuKZQqC1cuZoRVGRsHPFuq97xiY6/qJ2axoQu4dVSZgw5a hwuQFjEyQAOqnDPMYtO9ZbzpwWqUXLV45nDBAbBYsCAaASN0kFTF0QjUI68vdNRY0PzUarPMsdKx +akGrW/tAk6rHmbJgueCoPe6kYeBj9wPY46CxAUsyT50f2gKvycbI6EfMbtMDVnzj5OQFMkdsjZ/ MkL45V8djd8fLV/rZT8l+9PZ08JRYHMOyi4XwNht+eKv45dKMjsO+X0TDitxy+/QPTE7zH7Z9v6l L8Pp/LzI3xZB6IRjZMPh8W948uO+HVWybgeVL//lmeCdIodCJRRx1iqXC6zkAqYK2C0nxNqC9HT3 WB66SkZCk5IloBm9fAyku6Aet2J7RdYz9XxhYQDLPgCMRu6QHTRQr6bhZhabBnb9xMbW2ER/VwCp URKtO5cyhVI1WmcanCdhcum4zmCvtqBJLRl/aDfXUM7lREKsNqkP1gCJvuIYAOwyS5vse2JmxzVa hwWYWBYmd3g2QA5VQjG12jDX5VbNnQxwCFuli1heQ5kq2IHZFAygRAlQE6VNTbbW3arKKuMk9gFp mkE8VGNPDeOq3O1bTzzYW5nvw9RoHVqHdkmyky43MN+N01WuofrC5nK6tDvkRvGwvAXjkWbZPqoO 18PyPDwAKMHuSUf+/Y99nHWIEz5FQBkPjMWhoTqcTkJmZGC2BA6E/uTf+4VXPvajcPqynfwt/FbI UJ1zZCs6GRg43UKoXqmcNcBSJF2ODKfzzHOVHnGxy1uZuJtq7AGVXpMeUa+ZMnTAALgvSDSV08Uo 85dBPfoJpgt3XP8zoUMBFo4IqPJEbzCOMdctvbSP1FV1kiZAWuub52pQcYyrcsbyIHoZzSSMr0xr hB5yB1Ra5/2KSRhfmRIN4BAnHD3XnMvojQZwzZtMlevsMCIdm5fLkYuRAql2rmKcpnjTLDI2ATSl F7jqgy9JmCNmZ96cFIiGS4ABU3w2s2nW30/DsWpHKQ8NxIesrWhkQ/WpYnNNsa+9gj1cul+jb13S twEPpDIDrjYq0QR4dDR1GGkFMAtZn0xTX5xC62RgCJb52DpUDs8SO4tbyoVqgnfwGqovGZiV0KXa WzWF9H0AEHcTffN1X/LmMDtsLpUb9RPp+ykx/gIYz4bNP/thPvyhD5JP5yNcbEiH2f/4t/1tOB0G 57MtYDgdfofKDd5ZpbIJf6Qzy8EUeTNUzsWxnDDmlU0St8YVy/hoOBDcYaQMsDAeAE1ycR0PePfQ 1TkGmPGE0E/cAjjlyICqBKcqjtTequTemm41iP1DAXKWMg6pUmDk+ZUpc6bSOltUk4uT05UmYXTC GXElnRhedq//rkRJqReBUTk8R4WUcNHPIEq7hJqjVzPLuK3AXrMTnV9onVlyK7NDIlDG70uR1GSu DEDuo+rAlJX+JD4NxE1SbaUSpU1qYpYqoBpXfeuYJvS7XTyvmMWmaeYx2HFXcjdZ9iQoll/JPwqt 8zNOd7MQO5MYocDgBteyOVU53SpNa4S+cLQsvMotjl75N1wfS3k5Zoue/7BB0pxHBeTOPnqi8hGz P/scVI6GCH0Q+pKTwS0YA+Tf+pH3sxudTDobydnrApv7FScAH29h6ULczG8mOsVVh3TFcgVcjVmo Um2jzhp316ZD/bQXRdqt9moMzx2P0seMhC41Z5DyNdIQ0jG3pxHG+hH4wJCF0XMFKlajrNen4vPW XFK7ICvj177VMvqAdH9AcOHE5b8jOf0qmwcnWneDY43WacIPzwbuhdMjV967X5XiSM7IMXAigBTP yyaVaJyWVOVfbXZx61g92JQZLtBJmgBqlBdaD6fDEcw2pKXiKB8uuOshYLc6AKswIEqlGiTVFKoW NDZFE9CarM7GR3r9pLV1jB5giX1tUpm+sdQmlpxsLAVqvDLMTm4oK5C/NwnY2e5NqE6ymwzMCMCX f1vKf6xOeh0eTwm5r6F6mFqO3uLoldCphrvT1LpsBjxIoHU68nKVmJ0s0CUwX2wGyy9f6UJPFE8I b3W8Hf3rH3OhEqdD65AdElrnBJnTLFEKy4aFysLjl/1ZhwAXbYBL9wGlDD5L3EroHC4UzI1gYAyP sVHQM+cDqM6jzZirH7vjDaBUo2ckSmQFVpFY7uI0YSBNHDmZPWCv8dwXtzTpMMcVxE9AM6jV2QPM lWidCZMkDFMlnA5YaX35gYKf+kq0njkjrdeHaCZJAAuq3p02ZoeHFIRt1ey2enaxpCo+l7jSIPYB s37QeggdbOFMAqSJKmGWWj3BTM2T1jSdmLFsNIO5AEpB7aXegVVLMEoL2EJVffv8ocrYxKzqba1S s3NNbQ32LKzOTtBHGTAb05TLQmswgMJNZGn5T6uhdV5jwt1wOnzNZhjS6/7baGPzRuvYrLQe4g7Y aJqFtHK6hF71tUn9l77sr1VHry99GefQOq9SjdkldNiclAsbH/mPFv5MyXVLmoU4HR5n0zHfAzB7 zj4HAvYsUWY5/BiKZHrctdRYe+4rWdeovHJ6WqGA0DoUwPVHygU+cqxi5mgdMNKoHBkNlrWLHZWc LEAJ8ChUo59B7DWLgXqVwQHRy1BWOZygyqqsuNo0t2mq+opjAIC8SLwAJLj6TZgQeiheWncnDNG6 uXXef5hb5+OO+OHZwLG87BK3Nx0MiLRJya2ZhxfudmzIlEa4WkaJmbh6iAZls7epynho4BKtQwGV 3+WFu0oux1GXk6ajLuf6ymhYSmoBtNYiIdoacsRAXKXKNLVqLJs+9nEOQLmrzzBiIKiS7prpoeKM oQINkBS6CJiLLDBeKvIBLGjdD36N1MrySQC2qcCzEn04XYonYF85vTL1xs4XNq8amb3JavDscxxu /H0Qxn/6GTY+UmBzDge/s2l93QRZtscwj8mqQ+vLppfxj4rYrQhmkwO0DvG5AFhvFDnRNVlXqVhZ 6RjNLps3m9p9dTL9Mwr0EjqAATASLr6jYtVVgmat0XpU7FIl3akiLeJITj+tJ6B1jyu5Ix3Rg1WK dzuilLtrx2Z/1DH6+wHmA4V3J74yDadD5bXUaL3l1t/z87/KCfrn3Ryqc/u4QfJ4k9yy3TF7uSRc DKhawFFWrFJZ+0aDstpEHxCDXXCD1jkZCoxQpQTxfMqwUj1oaA6luAIwNyP2w8P/85/1gxSEBNVQ BUSZapQB2rRqOh7pYxDPs8a+1YMnhSbKGTQ/dkEp8CJYBXMrmbiv/87v5i0lO9YhdCgbbkVCsp/+ 6hevDL79Vw2qUvwIwysph4ujFBxJ+f1m6xqto1S/+GSHDITOW1z4nS2Y0Dq/OXJ9umKZynziRlqH yonWoXX2uohZLa5PWTLrsJIsuNI02CpXqYLYBKQjfK0SzVBuufXwuJoap8t3SjidcYKPSh4AAdqn V0B1K5ZelZhpKVlgIFBpa2xSjZkOZwM0sakHioem1E/1FkuAV6Nqgn3RneoMmAwWad0ZUoP0MDtv Yka0XpIw3CP4nVemROtclhqtc0+ZOVVmIgmYXQDOqJ0pI/QKIwUML8pgQDUQxz5NAo11kqYoG9it 3qD1ROvSgQQhxYt3JdM9eq5LcOvYqjE7B9V5tWRBeiwkxcudQ0hqkmOlSPRhSXAt6qu0dde+mp1n cuZDNLfxz9lVY3COEqBBs6SVglKJjRfN68M1YTo+/tgbeF0pg/Ov72BzmB2WJ71eQ3hJH1q/hOpS cGHhS6xdiTukH5Aumi16aJ0xDA8xE2D89DO8MiX7TxLGtZr1ycQlCTNS6k//LkkYAKE6hVQMmJDN 9cmZerKuQyfGLMPOAdWmKsFh7Wpzjln/zMa5VGavNqxejJts1dkgmoB0Ce/YFD2g4bmqTZPxc43+ yPjKY9VDcN9rVawSeWu07pfaiABMwsjpTJt5J0y7ocwfNM6iJuez2x1khi1xUxVgHJpGWaviaDCL JpZpDdBzqjnKhdbD6ZJjlZVP5RQ1nHxrul/1Gj+sMQ89G6NhKlMYs2YOI2Qn8YU0W7XqwbRGI5g1 1SCtAXFSNXbxFGIAUDNbVpvdVh3apNSV5470QnFN+PLJ617+Ol5RwtewJ/saP/SHHyFGpspHd0nF qKcJYFlpPeQrR1emDg5oxnN12X5DYL7SOgbFhiPC6e3b7jI7sZi0zpo0t54kjLTObGa9sQI5Wdek 545MYWJQrAqqRN+qQ7OF5HESpXRfSR8sBUjZCUhDBAALS1Fl499YYpASpWCW8WYXDFzbAbOr1qV2 bENK3wYcRpStGv314DxIh7ZwhTS3DqDUaD0RQA0IoHVexkjr9b8jMYX4MCdXKdE6t9VpE+mtbNI7 O5+Uw6t6b4EaW5EqazUaAbJqjrCXQnnk9kLrLAkLjADFhx1QBt8PcNXSseIo7wrChnQE4zMj178G kF0tKKW/XYAyes1ibFOVJ01xErBrjFJ9k+rT6gnqquIMBqUeBLEBULwyX//+f8hPTImFpe/6WyQw AbsvTkPrgDVJUtm84oWR1x+dys6FoC+sXRl/SaMTrQ/ndqmtfOzlI5+A1pN+yUIF8OkPkzD87cya JNrixRdJGCN3ZzbM4slmZVKdyy6zY3akj4cYRNOAFMAwamHtSXlHMgYAy2wZG5uozuSrpvZNrwrA tcRPVVacI6JszqtZ8GxvU9XH+H4gtOgrU6ZHpfI6bdgNBX0nWif9wqOXmcO0yQZHxuCE4W5m5ngr 5yokU8d860k5VLvMHI0mpByshmrTRD8D/KuMRHOhdaN1JYwgm1/D6VwRSUQeCb430CELqXqAyGoV XDXVOOOB7zALUYYK5cFUZ2CXWX+umd1GcwLwudvqCdJka2wyhmiqgb24ApiBKdxBfrDz5772Ddmx Tu6F3yIRp8PyxM4Agnf4XdIftCutVx4/wmHzkLsa7MPafHVg+YfX7G7soXp6Pf0MW2LGCG/uUXOV Qut5ZUo+HVonbE9unQiONcAacx1yvlmQXIdaGjWn2kCtGo+racG7R8k+CgZAgSiRhuoJ2JN+qaQw YzrOyqapRKx9lTFuZlyfNM1HiWYG9oo+Tpr+yACzk6bm7coq5MUdRxKtMzGIuI+YvSZhjNZJ4kHu /IU359a5m7mV4FoI0qkeheoMm8GcDN5WpGStvXdEaRP6ZmBVqU0s4y2gukV5oXXWwxGnH5F7CFQG qfKoS7W5ErOosPRYshUy1fBX8wbZ1UIrlpZGiFVpl1gCNE6X2hTcbGIcED8BjicGGR6aYP3HRpBq XKlJLwHS68aM5If1JNb9BT+UTXabnY7+FonUB6E6Ox3z0yQMemI93F2YOhE38fXqOa0ha8Gzz8HX /qJ17bXp44SfI5Ej4riJtuR3pUkYXpmGygnBWrTOqmNKyOmcMni3rAS9ZGMqxtjqbq+mrGse2nLB A2YKU3OkZym2plbFIDa1qWJtYhZCn23ShHHF8XA9mJ2nb5oA0laaAvLAO8+9xL4CiQw2l9bldOdJ Jo9gl9Zh9krreHa21Hsq5qY7nW6l9To8sSfOUFONRppGb6uytnqCaARK7atZNZhbV1qX0DkNC6SA BklBI3gQyTV6kO67feG1qp8PAd9hgLTIkrKhVBiNyqOmaia2e3VyhON5dqKGEVafMcNhPUr1j02q 1UZXccgFYfVCf3zg0MT6eF25JNDZtE6ETtgOk6Ikvc4He6kmYL8kWCTrWW5cjwfewVJ4Bzu+47iE 28hLWaL18aiIsjwAWIGE8PzEFNmWpa5QEpTxWySD9CRhzLMnt+7a45SzSsG1VBI37r6h2YgeZeN3 AvZosvg5HNwkhSlrSB5qc1XfSYbydns1z0dV9eHugOazmsUmoDoPDoiraALSdFdg6txeu4x/klvP bMksktbJuvDKdI7WOQrMyJgN0vnMRp05udEBPryPzkh2Pm+VlLEJcaOxNO6OPsbp0ixjQJfYgHei dXm8SpiiFlZLrVY8mrav71b9g2P4CycwWmSAVDhX6XJU7CInipusHW2ad7zULnElqFIzHabLib2W MbCLZweeQXymNZeCWfuOJz/Ol2x5QSqhS9zEzvW3SKS8+d/Q6zaVfIYX8g3/ziAcDVg+44VPyN2P /V46amb3WdL67HM8cojWXZZZnAGsUuYrtA6DQ+UmYcytu8HRJAyrjrnHImTeOj+RlkrfarhQABlc adXWKk3C1LUdNmdFSWS7dLarTBfAXI66aNlaa7Xi2W3T3MmYvne1b4ez+uBOKuPjk2gdDc/7Nm3C 6YCf/T//PTn0+sqUUJ1CfEDOXScMjJsrs3Pfc6ODDRd8ikOX7ezkX5WyKpJqcLpUjcpqWT3MrTmK TqgKcqB0SdOF1lvAniA9ALKYC+evkuUxtz6gRp46cmIr9KeBYLeK0kIXgDKaqpS7qz2t1Z4md8TH pvrROA6PqugZc2QArsDNoZboTwpdqhkYDTeOacqXbH/wjX/TOF1mRxKYQ+vJpxNof+q/eyXMvr47 hX9DwQ3MNL1piMdJtsDsSJ4iIzyPH22Qekt1eVMKrRPmsw4rldf1OZIwhdbdrybFs4ddWmd9Zily 1uCUSusVcz21iVLAIk9f17mRGoeQnqpkaVkNSDUaAIXngavO6kOXc5QdDceqo5qrbTDNOK1VX3EM BLWp4maW6m5gntZdAK/B6ZSTaSOtM0+YMJA7WfXk1tkhg1t3wkjczhlvd8MYUHaHUflUjIySLuBw sVXkuYbWahMPtZc4GkF6AS60DgukwAuyuZJqNOI7SRbJneybMcsPzSxjZhNV2U1atCpuEns1AmRj c1rH3xz+oGkBVi+SC6I+YKvmWLpFWtAHV+CpVZvqoVpeg/U2xr+k0Xg1xLcP+TdDIXSjdSRvSknF JOsC0f/Tl76aMt5qhsobEU+kDBGPUvXLf1CC2XlC4NO/Em4YFPvf/vS7yekztpD4LrMza6F10i/m 1t0JwxI1WndOQ2GsRs46azLUDJCv1YTEqwHXNtWsbYCEzjqRnqpE+byVkGMDqZ6MpNpUnJMKOGqN wdFR0jHg1i7nVF5bW5zuGGq0vjtnmFFslSEPA61nwpB8s8q6wI+0Xm93MJMhmDnAI5nCTKNXiDu4 8rg2scTG+XkOmodUBcgUvVmdfaLXYND6HKfL7ywSSmV2NddLrk6M7+GHxZbuM6itYqWkJo3SKywZ gBkl1Qog6zFOOHp55QgFkHR73a/8W35/z/8y5v/v1IIGPbvC+SdqzBgs6evFlPQ5Ch48XCSHE3sI MCCt14Bmn/HHLQZceUbCBhJ2rNcMTHicsJqUumG1kTX5E0gWrodnL0QMZTeWVxOloJA19jjk8QC5 88NR/ia4PCqKGR8M4M1t0i8nzD5y68s3YUaE/pHfyio1IeM8Zu1lHQLC0RVwfWp1F8eJhC5Pha2O QPSsNEqrqjyRJ/YnTXGYqDzG0cTm3iA+9ZBqwL0973ashL5roJKbbrTu70sbs1vlG/3Sun/emYEx CVOjde64f5/l1jfATGBUYdJ5VM5A9NggrYZhq9LWWM5Nu5r4r2A+UDSAG9E6twpikn8D4AiKygrU R7JIgk/AlWazB9Ykyiq1UVMxNEdVSasl3BeAfthsUbYeGB40DVmz15v/BcpHsvj84Vc99tf4b5mU P/TStywfuX1CgOS/ytmEDcaQ/mD5p8fDAEIfPot/NB4dvaOaQQa8C2JfW/FZq+OgS2F28t+RyMCE ygEWaNc3pSTEB4nDtgvhEl+TjRmPgUbWIXEtN/u149JXDxfNovRAYwB4iM/lO1/kXvjUl+kXOZ2+ IfcKmM1G64PWlw2O5tZZrr4yJeyqtM5N5NyRdyp0YZKzBCSsRlupzoBVdNfCGd21S+wzgGhOAMYy RYg+wF6zt1lz4p+mu9qfe7um1asnrWfOMAfqnAGPaP3z/4HAPLRutM6/tIXWGTZdOFwj8VZlXhGn t1F5SVECxMhwblViE32wXdSn9QjoLf4DtE81zgU3aF0qD6FL5QR9YYoZsHJmJZrodbJrc66Eqq4x GNS8sKSgSslO1tPm4nBhW8YG1VIgYugYUn7Zmz8kffMveP7wC940pAC8V/jgrfr/+oX/I4AqRM/O EwqueDwYwueSOozKwruD9NxjdtKLs/MEWxeOSMqCz5TzK6RB3OUXpGF53pGSihmh+sbLbIAhxIbr Ry4e5VEpBF3JutmztFZNsR/KZcsjgTzfaGxLcbfKAub/UJOEgdZZoizL+srU+V1p/XpO58K6jFnk FlZFLSecxXGr5fOPK0Ef4ZNRzadWNcEzOPH5vDVx8fPKlDm2O20wgNYNBZgwrHFegLtvvb4yPQrV YTAWEfMqV8A7Ls9ypgHOQKooxQGzTTNLVYfpOIPZ1WyTkVxovaVimPGcFfJhlRD9XR2GsOhYcatW QhdrXFlvjGFJsABk89d9YFA5O7svbC6VHxC69F2pHIyy6teHwSNP4BPP/CML+R0GWVM0y2OPgTEG Bon0XAAoHbAaWlupBnbHUg+5IADWOSHJ179y2WRyk9MN2CF68jDE5oP0pd1FwvLoScWsdL8x/g59 F7IerbXkeRCbDfjkgNM57rwad5cok5VondzLTOsoncqsPe6pHM3pHzE7FxMzCzYuWvpSZEbXsJJl Q5k16p8feevR61DbkNJUSb/Z3K8azwHxc2sWpQa/MQ6In4DaxL1GD18TaCMpuxPGeUW0zltT5wy0 TqjuW1PmTE3CtIDAKRRZR+uQHIN0HKqlyXkYEL5ulpqlY61WD/jBJq1xG80RUH+hdSPKKlkeK7Mv VEj1PHLH4OEWFmFzWDXBMB1mSgB6ihQp1jJPKW4waXFyLF/92FMw7yUkv4bQq82C+X9ya0S/Nj06 SP8R5Qj5MSBdQzKHI/I3AZwyRrJd0jbyNn5J3FPjLFL1vDC2eGo5QZSsZKiQH5eO/0Sx0ToxuJyu 5K0m3/waPyaShWXe7UehhO0wOytktC5NYzN7tZzx08+QKx8ON1fpGw+45a8EEus0ufwCZpZXM3Lr yytTViPRurn1vD5lxrPI4ZcsRfk9UhJHclmCw+l0T2kk1aoxuxWwtG61OTKYeSSWjudkVCdNOolB QNPnWIDYBFRltRRX/kWTExG01rn7NRp4HDP4LrS+m1t32mAMrdckTKV1Toq+eEu07r9eqSxfQ/U6 PO+vfB16xWDGUVYgrho7zvowezyj8bjnR79B65wq1NA4YiWL0FDAxikhl68okJo9RLBAsqMpeqPX 6DMw/gqD0GFzePaSXYGO9xIss3JE5Y+8PrG5oCrBl16PPLFaDrofLE+KhuOanGEywby54LBMrjyj 9ZqHzT01zs4ThJs0RspTvrAF60fPJtbH68qF1sPpApS+I72RSZepl38494WXf+PvvOmtl5h9I/eV 2VtV3v+FX+Yt6NglKa1v3tYuzz5HExmeyumN2XcpXlo3Wnf3S5IwsLwznivJuXsFuFxiLw5VAdIm rhv2rCKKoMWzVl05ml0jGQlFyxlISdf4ucYm49f4qNr0zXNrtdqUrcvzUD1/AHi7Q+u7E0blNdE6 p8NKZLZYdjm9XpDc1lyHc3rVHpsKqNorffEWHIDSk0VjiUZ9WgNicKH1moRh9kscAAvV4BppXpSb 5axxOc36WzWh6VhWjVjuw6CSYKoM1b8wyHGziYK3mvybtAuhj7B6y54fk7tkfeHoLesyNLL8xvXD cmHzweOLZzXrEeX3R54g/06ymHiTacSsorDZhu00SJRcLu8FJ2jxKbVmWpYz4nbQi3Qh7wP45Avn xdPCBwb/LQhWYg/A2Nq4fN4rEXqYPXkYAmd4do3Ka4j9pS+zmZ3M+w5HN8quvSBuwnCzOlW/PAP8 QsDM6UdBevTM2uTWofWaW69JGFcmt15Ot1oJXcwqPeKvRu4skisLq45BxrjiKL8SoDLOuf9qWfF5 r2taZxaOJmD2c9JUjeuz0KuqDK23aL2yPNHAJz77RRYUz37idEN1lkxNwnCsSuXMmVQBRxcq9xfg rUfiyqq4VVVWGePaN70Camu60Ip+borBhdbl8UiWh1S+Jl4M0rdQ3SZsHlY5p/7K5hwxVUGickkQ g0HxDHUpRLJ/8qd+w5TLCNITmB/zuDYrjy8kjmatwtpL1mXh60dl7a1pVEfr8rRY8ZaNsZd+YHlG wmtV/rkPXJz9NmjAL3rfp+B3ZhXjz5lyUlxz6X48opYkEomdG68EXvAm/xrgD8/H3/4h/iMSGQ8Z PIRegQE73E3YDoeyJGqUDdfD7Oxkxwn6YRBCDzAenxh8uNq80ZHtLjjhGTP+dDjNvey28mZ1JGGW /44krftNGDc7OpWZ6EwhCV36rliNBrtr9RpC50Ac5daya7arvNUVBvNoTwgxxgG7HubjJmHSmnb1 u8rW8fpqTifgpK+XEQmjwfiUTJgEAQG0mltnnvDn3UzreqvRuqGAzM5p1suYUcmnTdKqt0q1FWuA pp5C7RXjqkwvWlOi9DrYMd0Ft9N6I+6V5e9F6Kyr5o3qrhJ9wvB0qRyHslabsU8dyJFI9o9/29/+ mpe9TaY2gl5xDdXD9RMYxL0xO91Xdl7JevD4H33Rn6IIhvGI0x9dzEbADkC56ifnl5HUpkcehax5 y8pZMLGQMhTROoROeM5r2HFG/llgx+Uvg3F2VB95glaOyNZGaBRal8qRlhA9tA5383aUreU3ki2S 8sLLJMp5rUrMvmPQyH3j8UHotSz/H4MPqROnZ8k1UBdnxZoxfeF0d8LUDY5gAjFW75xbl8G9buF3 wO5CZZ3cqWRltl7qXXWRAEbYLO9XPeHT3fPaVXLoI/2to2oDaNVreJlDXGlWB1O7cDFhLi41gEK0 Pk8Yp41JGHPrRutEeHO0zqxIkdCVR1eJQ1NmMkWjMq2cQnCAZtUSTGs1bhq7xEBXVakmesANWjcY lBO73OL0lWRb9V4sH76+FYTBBanSUUJXMmZOgSXtS1GC2RGeS3mhvwUMnq2aLXKPXhAJGARdiuny weALlSvl99C6Si0H9vHgIyGPigIuLL8kanhD6AxjLsLyPKJu7NhpHcPsCyCP/+H3PzW4ePlko1Te pNkS9qoTsBtHX+i4UDYxOz9TMmZfDdIaEE5XE/3Tz7A/HU5nJI3Kr6+OaJ2fIy0bHPkLGipnewN/ XBOzm4SB1pn0oW8DBatVoud6Yklh0bIwxNdLFsyusfoqd82OlI0fMTvilHi41SCW9wPzkO7qp3Kx fWfNXX3mlnGpKdC6nF4l88oqSRiYnXnC49+dMKwj+J3fOmQnDANwiVVmR5N5gkG7FBw3lArwpjuw 2lRx7FXis7ZSPTHwEJHNMn6a/gatQ4sW6FJa78AfYS4kPhscsbPLrLbOmto64/kV6JpoTsy+ZZzx TIJC+lsJXcreiPtCndL6gbyw8MKeVOXoASR32XzBLVrH4MLs5Umgk0hZfrjdHcOyP3JEqT/wi5dk S30UBW+nNlwtnM4A+L8ZP/T49/i+dND3thmmBu/g8c3Fp58hww5r93g8BP3sc7xWJRvzT97z2JqN WYLxdWNMzGqEvmRacAin8233kzj9GnJn7rrB0c82QeXrK9OP/BZcT2uide5+5XHXapSAXTZkSbC0 Tkoz4IjNuBnYGrMZtO6/79XKXBU7sFlTB9zIulWxnDW1+wmGtedWLqbXE9ammFvfnUXSOl/7ShKG aI+AoNE6Zzdzej1lMTL30duNtDBImjIHxFbF0VSlpxYDnVRldatZbOJwtvEQh7QOt+4Td2H2ajNz 8QNppr8GWpqlOvdRxD1j+yCp6kuEvnDcIM2N+PYJtLJqzWwUQpepF1dbeP7I6webK7dUDJooxfK7 yoGXxwO9BOfjWRnfs/AUdk+kjHkZ59iBwxH5d8/8vyHeiBJum4ep5G7kPqh82aDCvpfB/gm6NxDu /uxPf+LGG9TE45vl6FsK32H/wbe+jf83/WPf95ev/NlRXZwGXGpYn4nWCdWhdaN1/pdpaJ35TZK0 Mnj4HcBssYmpgiUle12yGtUrm7JVqyWYNdY0R8rZ7HpNJZq51+7jajabNffuOLt6WJpdNo9zrzYS s9B6ZksAMwcDonV2EDBnWrTOr1Vw6B95u9G6hwuht4ufO+7EoAqgBNC94pg1vTYo7R4nVRM/MRZU GbcoxZ3WWQCyZHhTcq/SJjUxOwIsp6Mm9M1Jq7aOMnvNw2BP4RAQ+rLLZUu5SIV7hC5Xrow55zG2 ELiagSXiGoMPpl4CdgB6q0iLTSH9ELpmqXoUyD0gRD9rLg+nXXJfRr4cd2TYOdDLXvASImV2HBKM U9itGH6H0weJLwVmpzp2vEjroemE4RuDuyGSX/zfiOu31ssLVb7L+PnPveFN733iie+F2f/5L/zD uthk6llTOb1hJmuL1qV18+y0JlqXykPuRmGpAu7EYq5GJavFxbYLqo0G10gX4TWWRzZ3Op3m5EH6 NprD8xySz5o2AKsxC2hmu3ouHQXidiLtxuyQPq9MoXWTMKbXza0//sF/zukzbbhxnIvzRH5HoskJ ArBs18obR18A0rsfqdKzCI6lZrV6boOfZpC+aWoGHOJC65KsxDrLlYKXINrWyrmzprZWHMsAW1t1 bGIppJ+Ui8zO+sSegIv74XvRSxpdKj8mvnBoeDMgTRKo+iX+XV+BDnK/GZ6v1UUZQhdUiau0htMB HnE90F42hiZbsdwvy5lebJaXtLolD0OkDFnz2pOYnVj7X33zG3hBCr+TT5fZjdZh5ADWyVp2+Xp5 g3rZExnjgGefg8fh9Le9/T1ssmRd/YvPf+FOJN44nSqzNtG6VL4mYZ76Naq0GnbVaJ3JI8U32dZn Y5BazSqNkgMFC5rGLs3mAau7pIZPTuQrcbh5tCE4m1oV5TzCWTO7vbcm1xzWhtZ3Cd0pNEfrMnuS MPTlGnJG0joSTqc4SdBTwO10MgD6egvQBHBewc3gSE+XeGg20TeAmZr5EOoHrbu5Je9LZdjw7E51 y5DEphL3CYaOT1rPmyD05GEYqq9GeZEIobstZORetlh7gD1mv9DfYtmqsmE4fZD4lkmXi6FmeXyA jakrfVe8w/jbI+HC7AfDWE/E09mL5WPgKVzklpBxJLyrlFJhbfLsJND5MADvP/l2IwByJzlzI/Se Q/XwteDZ53hI4IHuveOSTydX81f/7Ev5yDuEzrpi4zB/CD8grZuEMfdiEkZaJwmTV6YsPxm8xuZZ rk48qpUNXUK7/GLTbKAmayxrOE7SlL7R1NVblenbQGOT1vo8VCG1nMVDOVw9I+bG/Xxy6eiIxEOS MPJ4m2ah9UTrhOoUaJ1oHSdGA43WqTowpgpFZgeorBdEjBR4Tyt2nDFIVVeeiPZoADk1lcq4Dah+ VFZpr0u0DkdboNfwtSDVMO+sSdOtIH1ncDn09ORYd78smX1WKVmXG+9FNwa8sZdxU4YEBRcS3BhT zcVsIUeUUPOg4IWOA8Lsg9wXg8rmYoyjrBifo9eSvRn+t2B8aLbBXIaxaXZbVfIQutG6VdETrY/v fJXPaTHv4WKoHEInbGfnoltceKU5OLqF56kuhH75csCXvowHOpLe8bu+uB19n32OHxy99utf/pbX vQE2Z/KxJBqtZ+EFzLH5rGHWrh8PWL6xXnPrYFZvovXG7Far8pr96a4xZIrLJlVXTqqAGNSmKGNZ W6NsIAzS9H8gqpW4H3DA5664tjOtt5lzofVt33o2OFZa54IzQyxgr38kwLQMp+Pt49CeWu6vIK2A 4Nqr6sUxE8QAoM92iF0lh2gDoHqD1sOqEm6VrelW7o5Bi9B3fcZ4gInQUYbTwTxv2eq3fsvlgLh3 Q/WZLi9MamgvJ65yZXOI2zLzdYhbpq7VGUO+VTm4OG9QC6ejl6Yd7S5WqaXPmIHzGpZzWU7hZS98 BQx7tAsF/T/50Q8YvxN6m3kf6fWbbD4o26J+a+U/YEDrI+p/y98gfidrT3aeF6S8p/27P/XTTDXD HL55fWu0HooPaOuTaWoShltvEoZda25cm6P1SuUNU3W5uix3pUsryywLpurtGJvZD72qUstoWrUZ YzZr0ncGt57R3OVWzUPxyQTIiZxz9Pl4Wl/IWnucg03C7M6cmdaN1pkz/JWPkzlaZ8w6l83NyYTW M04OXeeDN1QlNlSbQZoCapdg+jaDW13lQOlLF8pK69AlhJtC1cwMwCbBQ5GV2Wc8H0Ib9AnSL3td jmj9VF9pMcwuSw4yXTgRlkx4HiCHVnZumN3it9pwIHqth7vJ7KHyjFDNLEf35W8I3otSCMyHzzHm 5eNiy3OCwUCyv/Lj/+vupEc5ypJVh5eJ38mYJzPTyX1j8/QCkJ0nWudbjLxEhdzBpPL5rx1P/r1f YFUQFyNJxcy0Tl+JO6DxeNOPJMz2BUdpPa9M+ad3zGzXJ7/VkseZJ4BwOjMnmCG5ipRZqA24NpQ0 xbiuIheSHatB01ilI6CZparNrrTjbtO5kjM9N9htPeoVvguge3Bj3l3P58qQ9ZWuuHRcGabWrbl1 3riQrCNrB6fzSShfxbEThjM1tw6AuJkhSDCekSpD61QZv/fLOeDpOAxwlAEqaxPG8VD1drEp+vgR IFtTesXAwShvROvSOsvgiG3DsDP5Xq+Jk4B2xOoKG5P+3A9+VU8mfTDX8uP7kN0l8bKQcvRHQEqV OrFpHLqQ47ITcUuFy8I1l9LY/B5VSdmR0J1hjEfCQse7w06TXez+6lc9+tYnvvcd3/St0vrws/3Z gROq6J947TeR725E2WiUKjwOTfNa9aMv+W/ZNgNN8zwgHW8CfRgkbF8eBuF9DHz7ioaXpfw77B/6 mc+xDKT1loSZj3uNholbo/X8HIndjdA60x1a54jhbmm9kTtVVjjGlqyiaAJcJzHTEmlRH5vqJ5Zx BcAyrmq12lyP5Zdz+3ObtAace7tf6zXOQ+V3OoRXnksNuCZa57uM7ls3VEcSrWeDI354OIXWHQmD j0ZmR+8RNaj3tN509VoiW9OsPzeoZ6plNI4HGU0zGLQub0qyyoTqVkO7lXCvx6yoGNejHGGM7aIB URiZdLIuvhrdZb0rlZJjpch0XJuWVIbh+ZA3MycQpXwKgIWRdy3VoRgpYCQA3AqazDiH/pHXk2B5 /LE38DvS33nmJyg/9s6/9MY/9yoHA7Pjx+7QOokRMi0Q9Php0hYmH5EpyXGN+ZwvzG5yBo1vVqX4 C7/fDOHx+Y4nP84X3t/z87/KwuDeIVlUdSeMA9gdxq7SceZXpqzJmoTx9Slr22hdHp8l0ymMz5Bc AK7PJl0krhnMYln1th51jN6+cRJXtTtuY39XwInctcu5/QM6TPdG1q3KGGbN+cDSWi8X1xM/lBqt O4WYDE4bWgnns8GRyZPceovWDdVhcM6CcEROZwLL6Tm1o5uI3hkC0EaZaZNWz6XpU013zNIlrU2T qsbpIhi0zrxHplhtkmqKXVK9B4gHwVzlueLDBkK/ZNJLKCptyV+V8q7EdAz32UUNjAmbD832zlNN 2PyEx6Hak9baxLFS9eExBrPtd+Tojq2dS5SAb33ta/7RJ5/6vWd/+P/9jXf95//4vwA+89F3o3zx f/Mn8WxHnhDQOokR6JiN5ITSMLv/ZO6IQ6F1QntWBQb0wp7UCrRupgVJDv1G/v0ms7MBhu+L8bs+ 1obLYzcJ46rLGALUt1aqzGCidYIsci+V1onWUTKPWxImJB4g11PFOMW1V6uuK/XKLJ6mpJcau1ds l7g9ArXLrg1+1Afsmt2qDCvdarlrkEzLPVpbl+sJPamYuYtXgzsOoBW5O3+YNrQy/YzW+X0yuxsN 2Gu0jh9OkIlBkcTl9GCAF9D75dEjUapP6y5QydWgI7jZtOqujcp4CIixINX9JEyi9YAT7uaKHLUa dKeV6szgaQXQSoERkATp/ENRPmrYMumQWs26VLzQ8e0fT5cfK0uCLSulbnH6sNn4PUQMaAxuFeM0 qVEmrqeqTVxZjcQS3Ni8VTGArH/orX+GIB02/93/6w2/9+x3Ar74r977/rddaB0zCml3Inrn/Uib PP0MYTjsDMtXDg1m5wzvQlMF0Fd+h9CJ383PQPQ8ReR3bZSv+9Zv45vDxEesBIvRenUY+6ZMdV6l bnCExFmWRujm1lmfFKYyi5PDMQ/nUN0ZmCbMssYa6URfl5m4SldO+lINBsRJlLGvIK23gpnXWhfO qGpatTY9IA6/B5w7ZCTt4uzah8FpvfVk44HrjDGlRuuZQgKmzaD1p7+4m4RheEwb/ITWZXaYpzE7 B8Usd9aTsqrMncUy2C7NIK2C2lpx/FTl3CVmc9N/IZmGWzmr4H2w7VTZb92C+kro+Eyh1wUvuxVT BUDoXO7xzy6e+jW+vLhuRV+S6bAbDC7rKTuh19ekxvVVU3B1EgwYeCH0IZfEevj3AQGezz1wuDEA 39OWZ8zM6Twb3vhf/dHxeZbfeNd/+uI3U2B2JOT+9CdeS8AOldMLb1iCs3XduU60DtHD7OyEgejb SiBaJ6hvylSx53lgCO8vV/FDOM8DZjwznn2OaN0d69xECwkZ1pVrb3263JYIyuECmLVHuXVonbXN +mSKM+UqrTPTWKghdJsYlUsF+1bQ11VEqxqVSBdP9AA0VmuT+jRRtehHezXaxOD/B6By9FfidHLF uONgcixwt/Nk5ncmBgYwO7ROqdF6dsIYEMjjzpZI6AjMhOFEnAn1nmZW2IqkVbPgCoJjowd7pRVQ PcdnNVY5d6yaG0kYOfecr+/aytWxi2DI7asy4FrMuhCI8V2X+s8udul7UPCWrBA3BhzVQu6zfTQA scEy+BYKvs0g4flwWB4PBu/I/AVga6QjcTBV1jNF32j9//43/4PMjvyr3/Xa//Kr/kj6Qut88Itw OxQJgF7hdJItbHAc5F54FsaHtavxLobBMWP/DLTOZ2d4Z0uY76Z1fl9qNCetw+m8Nc0hZuB4PEpa 20GZr9A6T/pE625whNNJ0DHjpfXshAmVB4Txs2wAwXjIWhJH02yidwmlCohlXV0eZVfapTXRN5qK o7wSHPWVpK5xck1Ifo3NNcc6t5kfFZydtA5xh9bbnKEqrUPZZGCgdTMwSH6OtPvKNIQeQF/G1u5y G21ufTWrSj0w5hiIlbZG1qYZY6ZS/8GC2nqJ1i+0u0Xcd2Vw7Osnc9M9nkPiNAXD5gTpyLEV6X/7 P/iRkUH6GqofRNlhugC5bLD5HqGv+qU1rAdoBUIfrVsSxlS18pzra2ulcvSyOaCxvF0unG5afzl0 RliHDcYD3kLrEHotxOzkYdjUmJMC88p0d48j1ExgTjoFfh/fcVzIHQzRzyvkSIMxn53hQcKQ3vji r2NsJGHYjMhHro2LCZcola8rPnLb9ARirEOTMDW3To5uNwnD7HJlCmoI76hYAClZgWqsirNsZpu6 rrKoUEbf/FONmVgD7aum4VaFqux4V3kloe+aXUPfuzaVkStm8K165elwDbHkos3ROppMG+eYtE4a UFo3cTcig3f9jK9M6ULhlMPjFcDp8JKH47ge2mpkQAbmDc1tBTQNllVjtcr4TN/aal81YAFdqg3V S7Qu1SItcnGq9wDVgzgSkGImnX/5tnyr672XxEsh9MZush7KAA0qG7amahyzgEG4SwyubBxNLrtq Gp67xCCEjqaaVTya3Em55GG0xIAh5aypUnKOr/3qF/3Idzz2u599c+V0MLROzl1ax9hhELATTRNK E19D5Zn6AgL5zz79GRLutvIAaPF7s0+VlUP65anHvtPPqZP84flBwucnP/jhb3/yY+xDhdx5dyqt 117ic3JvrUzZROvSOouTgP3KV6YJ1Vm0zPhaXCRN43KKtDULqVbBesjqQpMFpqUacQ4XEPsY3w9U Oq4MG3094v0OkV7Vf5QV3IOy0yWgOgzm2oo5HTCz69ZofTcJcx6tQ+iwE5KrB+976Thcjp7xAGht RSUSe/siK1ZZNenSmrRBWfUqkfaKTfQYP4RonWVzQvrSNwbh8QAidC4c3QnS138bvVC5zG7uZc3A bOmUsFsoL2QHOGqdjUOUEjrEOvo+8ugJv5+T+8qh02YY3Nq0axBCpxVsTt+/FRzhGFX5C8NzhNb5 7sq//tRIqYfZTa8TrTtOLNcjvuAlbIaBteFcUiWDtSdyJ2OOngJHuxMmRLwLiO5Jv/Bo4WkxXpx+ 6cv0YoO8b2JZmYRI/INs9qSSauff7/FbU5YfZo2vcT5r5iMyX7/ryTUJA61n3zr/KGo3Wq/hufGX GjDzzRXCkqglyhlk2bRVRNUm9cp0p0mDpqeaku7aRALsXgH4yuIY4uF6J3kGHB3oVkI/6niiP//7 Y7fV64ak9YTWaWIqws5G6+TW3eA4J2FqkA6mC9KT5WJyII/oWYDr6Xi1kQKaNI6m6eNKMEvt4wQQ nwHVJkpA9A+B1sPpLQMDfdsk4EpJ7kqCdIp/E9VMeqPgG9WN3Ktyl/g0aE1WIwEpMOkg1psUjAaK hG1D6LKwdLkr9WCQXr2pQValHvBJkkfPq7wZm9OFwhlFEoATkv/yB/8Mr0nD7GBeohKt49YuSEaO 8d//2MfhSljbbTAruZeUuvQKw9IEQZ9QLU1k5I3Qa/jPo4IPFdTXrfwR8PJv+j4eky/4E6+H3PlI 71/5vje/8x3vJJxnH/p8iBMNSRh+KAihE6G7E2Y3tx7uDmCmheIBLFemviWLLZroacryEEdTgesN jSuQ7ra2ddj8V+PWdI/qg/DsrSTOeK7xf2RT4+6KcduquydebYJzbQmiwddE6yZhYHZ/aNqSMNwy rkOjdbLBhuoMzPvlcXfHWaeEGKllmnQSZdxqWaWWrSPVDEPjOKx6cDzvJGEaHUvNu5Klgj4fVmw2 +kHOxcQLi5PtLje+7iJxI1OOUzEhd/ku1RMQZhTAgIbGUuHKsxO5q39ACcGdewinY8bwkOtfEuXx k2FD1rwdZVPjsml9bHCE1j/5d17N707tjiWFBwmWMKkhMNQpuUPfhNvzNkc0vAidw/lE0LxTffOf /kaYvbEwVXy+67Fvz+tZuBge54nlIzPnzrfAoHiGEZ8B+myeaWW+8m0maJ01iaSYJyVaBzOVWeRI ZmNInKnIWk1VzFpl4mFpcYXM1ayZrC5sogxOq34io8dS5XyIaATVzMWJPqAZ37t6DY/f27kdjyj+ Ad227lwuab1G6/NOGKJ1eJ8kzIjWn/q17IQxWudqmGDhmQFBVWZnnhgBeCtzdzy7+Rw1iJm9HLPT xiaxktaqpNoso6mALtVJ65JWwH60LiM3mraakDwAPViKTxc9RAJSyL2waYH01lc99tcu9L3w+OU1 6fJ/lk8I2l0u0lwzU5mmuYrGIqeH2aGexkEho4cLjiieUXkgQR0kmNOkoxK6JGDnl6U/9uTL2ddI QobgnSokPs5iy9tA63TJ1nUJFN4kbOdVJ0E3WZTKsBC622NCtQBSLvz0iYIf3ouST88r1mpGXxg/ ORyWGbti2ttmxsx4GCSPH0j/3/76b84kjs+mZPpC62TqoHWWKIkXAMwurbs4WaUEWfL4TOhZtCyS 3bK7xtqKSlXjKusCi1kOZGuq1aA2gWnSbYxVKu2YpocLngfSfygDrhcE1qZaJ2HFN2h9+Ygj04bC K1NmDuzMzKEwKqcHVA6Q07ka3Ih6L7BHuXuVMGMYsQ+ORj9VasOhVaYakL7RzAAblcraZSdaDzVX cBSSV3Kv9iF0lGCo3ALmyi5bGLf/ZAQHGZtfEZivDI79bLyrLGYyIx2ly1HddrwMKnzYe9V3nwRm Y3abVDIqQKRDzZgDNIYfX/onXk5SG0LnpSWBsGfkxaGvHMoex/Zv56BgOBoGp4yw/SOfMKOCHqI3 D0PcDePTxGdnOASW6EnQY4Ayb1krBZOEIY/vc4Ijvv47v5tNMjB7slg5cR+fGPytH3m/6dHqpy5O ME+IN//0FyB0qJywK7l1MEpms4uzxeYsUeYeMnpWbI3WZ5bBlStN0BZSqrtmtQs4Nlm6gOahDcAu TflwqwzgeodJfdwJ6D9d2uGO9M3svMpZWPDm5GkTxio28P66E2aK1jmE0wYgoUvuSONxbkcuFxpp 3aY2PG+3t48uVrFRU/UoNQio9rUpBnRXX2WUMQvQ7A7RusyubGzeqvK7zA6bUw2nsw7XLYyVhSsu RCyLSVJd7nWByMJosVcpPwav9Lek1MVhnF0wE9Ou2ZFSNodkzbTsmjG2qreasXE6aPAQDcYwJsxu oQqop489hUPzVUUy3c512RMJL5NyAcDC0DHkbpzOi1ADeTRwPTakVtjlAsYDvB+6h+JxkqzLaP3S l8mwY49P+JrHDEMiQh9jW14mc/opniwfG+DjNkTuT/7PP8wg2+Mn6xNaJ70urSdaZ4Mj04l5HFoP g1c2B8vvgDnaytoLyApR4zpBabFam9IRYMFSZXoJdpU0tUOkF/rggF0lrY0xU91965jrEBD/Dwhy 3OpnV1kHVnEzblVPnzvOxay59TkJg+X4lem2wZHcOr9zJKYkCUO0DpXPtM4ffHThmngUpLfMEB5Z TypYG6QFfYAeNJixlsi5qXnYtUkvQbXZp3WWgaQsQSNn4laTf0cXS4HdkYnTWXKv/fCvkHi5ZFpk cAhajt5j6sFTtyZktteJofIKZDf9iFfNEqrDkvLLmtouvx5Svysby98ag+86OVIyPJsEdczoL8qb Qx10uT3VPH2qI1p/4Sug1/oyU/4l6I4SOmZDC1wMR6OHxNmHDq1L2Wjg+pqIH/bLRwXoQivPA9My OCQPQ18+PUZoT/WXPv1LZNL5kyJnJK0zKi+4etifRxRff/TNKi8DiMI8CqNl1rJX0nx6onXWJ5gZ RSvrk6UIa8vmIfcAm5BM/d3iKspaOlqHbf3gSsvWsXb3cOlYj76rxAB9M4uTqg+unBjlg4DdmLQ6 vNWgGj9E7IXFIZeIAuPvRuvMHKcNBqH1mlv/hic/zoRh2nipjdaVObXcBTQY06qsp6NN5gBNdSY0 7LCrMd3nqpoYU9VM/YxjGW+AnSRMI/TK11I5kgUz66OxFT8U/uyF2dla9DXv/Imx4+VmML4S+sLd c5M81dhqNavPgIqb/6XaPRRCH00bs0sxt8qWL57tG8u36mxfNRozqigdXg3SaR0lke/C5uNEbp67 ZjiEVaFXI19nPBg6NtmiPpJ4HDomEofWMSBIJ/rmdahxdLrHHrrHFTbE6YPTX/x19PXvAG1IoJMg 4nQYCWNWroPfXnLYiiRpg2TAfF6GFA1R/Pd/+NN/8X3/4Bvf/OPscTRmh83dCQOnE4IZuDG55fRd Zk8TKxNLSpZTBVk5WSrRACz2TbUpW0eqFsyCY1M1YG1my2Z2jyrr/B69apcWMj94U/VwPebicC6e DpLn2S6tO/EwMAkzfzyAXzxA1tI6ZlA27E+oPnM6E0Y2x4bCUDOF6rBxktsHyE0U0IpxlNUYfatG g32a9FCrtMZAz7Xao/Uaa4emdxMvtkr0jeXjBEJnRZlMH0F6+BcgrrKwEtvV5andLwc0/hrV9V8a Xb5Ji1IPstuoLvHsWi1ZdXiEJuRDL3J0cxtlQDNoVce2yuUh5CmM07Fs5Oj5J1RRfgAAHCdJREFU 5uJo5lHc4xguBowEC5tebm5zjAF6qJlgnEJifc7OxxJAUE/+3VxQdq/HAFfE4JwUf+JsF/+JeeTt rKnypwYSiueXq9xfYoJXPvajbJ161Xf/HG9QKSxOfs7K4qSwGJhpvjVlNhJPINEwFcPpANakawD7 WqJ05VBVk4Wkca22Lhik1abqhNbYB1QlfT1E5IlmbkqvgHObo+uQ7vcAJ9R/4u2o18mfIJ4akr5I ZtqcgVF5ya0v34QhGhhc9O5/RrQeWmdsIW7HiU+Kt4kmLOV0aR2bdgeppsQDGp3YhN5qPJ9XYx9w TUeOpf210br0zSJJwC53V1lfq0Lo7mLky7r85vAGp0vfofjC5pWSxI2qhrJ1LJ8XX1ljcWjHSJuU kAWgSapHBT6Cs9JacZTnoGbVPfS5fW0dcbo/Q91CeDyoHOS44FyrUS3XkyoFb9njeGHbZ5/zN6XR zABGphCqE4bD77NBNDw2SPXwO6ndB4C0zjBk8/UZvD136+A9cQkd7B9G62lu58WTHoq3QPGsf5nd xQmbt1JpnUmf0paiS8LWLKGsE0GqdU2mCWDBSSyrMm4zBgDK2Kc6G1TNHzgc7g6YWTtNAe00vVAq wRRYGz+ZhA1owJN+JOvKp76IBtgMA1nzMDBgl7uROOd+5UCV05lFu7Rul4wqtzugNsWYQ2BwXtVA S72J03cXqOzR+kkGpr4yrWzOKkrV7kgTL7ya2Em8bOuzEhC4BeapSlWNsFpf+WuWmEUJhimUg2I2 lpRK7ipPyJ0AOcQUcI1/Oppy0TgjlNZv5GE2os/ZAXKyAbbiFmomu1LnPXztO9KqDKY1GEInx5JE fPQVENqPrThf/SJ81r7YUIXWfXHKeTkkRuggZ1DPCMzgkZo1iR6H/NaJzxXwNeCEVIBQuTG7U9Ro PWvJ9eaCEbMkAHW1tCrGtrrklLHHON50lapAe31qjKygYVub1HNTPkhVOqseZo2tTX/Evxqft9bD XY+9gF5wJIcwCeOUaxMP1oa7oXXeq9dPfcHy3/ADv5hoPdczztGorHG6k4qhapZbmSrAos2uHrex EWN8K2gGeIifGXjcnWg9HB2+TqhemR1l3pfGAEK3kEznkXgJ0luILbMvytB3W+d1MQcHVDpAaYmy aoIFMguyEijVh1UaNT+gWwcprTN+vIEHvy/pF4lemdPMRfB62gteJsddiZg1wB5H97dU/YyxJAa/ hdZ//TfZ0AKt7x7oe77j1Yx8Db2Xm+XY6lCDcyIV2Nr+UNOAByfTjB+1kZ8hM8Mylr4bs1NV77wP lbgwkHXFapM1U9debap6jXWCTStxDrimOJ5YWm3KtN4K7t1Rz43Nzw/3lWDzFtpzOpYarTdOZxpj w2BGtP6R34LZSb9Y/JRQpXXvKVK35vQw4MSdNnI6Ust6BaJpoFXxjEblLj5vmrswBpUzQL8frXMy IXdBiNtqzbdUS5Pp/N9RXpCuvzYqDL4uTjR7m1tYpVnbF0u7L7IZWHVtV0zfVCtGCQUgpVq58px2 a0he8W6vWw12e50rM0iHfYPlbzJ7O1PsKSoBpLznLApMDa3P66ExOwakzvPStbVa5YUqe+f9jiO7 HutfBnQnWieWf9vb30OixltQRwuu1fHE2p7TGnsijdPN5IymLQsHgN9Jy7CGZfAatrs+G0NlYbCo xFWerLSspdigAVutQH1kPaJOkILqKkrBucRnDCqOcgbtOswGd9Vcyea7ZrtKB9AIHaUnyLUC0PEk CQM7s1tRWk+0zh7HSusmYXLl8UmxmlCdmcNEstjEMCpIdwAlHgS2VhtPrbZ6XtoEU6U0b61ajWvT jWgdgjaLUpk6hA6o0Xr4PRQvp/Nrkct/wCgr1tU7FufNyH1dtIW+s8jXLqUpxgKkxS4DE8yWxEs1 Gxyx5S7OyfTWVkLyW200uN7yyKFjNiTHZpzgEq1XDac5mrarIfDq2UQOZOZlXnWSXmdv4szUjeuJ 1tkVM5upwQ9vX9kW+f1f88f8piN/B/AUQU/hycEmGbpD/aT42ah+g6y3m8s4vXHrdVv247uRdDQ5 ZzJzahWcgrclYuDlKu/HIC+ZnZVpFM9azeJpq8tVZKuyLjxbs4oAzebIoJp5xCptVaqvuFqKGdKs /AOh2eXuxtq7Nu3scj25FOfROkkYaJ3snEmYbHCE1imJ1nFo4UBhxsrpUKKzaPdZ6HjioQFbvWvK qgkWIDOAOpgoG4h9gAZUe7ReCX0Xy/JSeRhfS/7GIfEygvRldSFrgkWWaZy+Km/G11EGZM2jEeMH sGKVm6YqxVoipQxBqiofupwJHY0cfXKs9MpDCOPdoa6PKFl+I3SvD/YBYMourRNTsxnx1jwMFM8+ dL7M3rieKil1GJwNjjjh96X8Sw0AhG6B66lC6MTv7o+U2V/z2m8Zl2IZpLfYQSo5X9icL94Q/puR 5wHWpk3tuzZVol+mH98EZUOkQZacbgjPpKdIFnWdZCGhFCO1jCZ90zEGghhUfVPGOeC8eNxd+zSd e7D1TsZ02eWvaw70/NhwOhYeAzW3TpBRt8SA4f3QOr97gNl52EvrnCOheqJ17xFu0XAW0DpbHv0L z2hdmVuZM42GvsENWEXSK2atGn21CU5rAzEAVIc3onVDdU4ghG56XZlMuq2V0zF49b/8169+/H2D xw2dtijMdZvVO8CyAlmZGNf1KZ41tW9sAKvl5u3S0f8xvQxAM6QsCTih1CubarKl4rk7B43yoRwa b/ODQc9w32jdEk2Aet0YJ5tVGi+zDCBcaHfWG4ZHDzsThkPi0fNIoC972ymQuBTPh92xxIbqKM8+ B49TAHEFYCTE7IzWESIZrQUMp//gW9/GP9Lj36Xy/WF/yuSkGiclfTu7lpmWM423AF7Xy+yuTyie 2e8CcKW5KpQumNpa10m1b9gu1VXtqD4aqhYOV7uAtYlSsybtFWWqAWn6yoHfR9Kvl4hTrkmYTDCn KNJoHXYmA8NrUhProfVE6/ih4JniZTRUd85UOZ+447GvksuuEqBbb0SwrTli7GsvldrEMh4aoGO1 9LiD1mVzZQj9BITQYXMSL1jyTzAIjsLpLUivi9Yl1wxQqnGJZqEGYFCbqn44vGRXH9V/tc+f/LJe chdUv0IlEffD9V/jd0k8/rkgYKQn6+lT9UIhCXth4cz4AAiXgJ1USTS7gDVDep3fmiavYoQO0ePB LtjwvlRa33USJZb8zgj6riMM5uqxnWb5JuUPw+x+gWBJPW3Jli0ySHywcn1l/M1GZmehsiYrrTv7 lXWlsULSlAVTDSpOd9cVTbYis/Zme3pR1DecXuodjLjKI321uSueOesaDzVtUrF9W47lrg5ney8s eq4AJdF6plYFGBitS+s1CcMOPc4XY2wIz3Vr8I7zmdbhRvjdS1RvHMZWo8QhuBZHG0sNqKq3o8ra V/vaGnuUcdJAPKxJmMrsjd8N1RvLy+xwOq382G/9uO4SPYVYK3DRIquyYVvD+LOxmiol9NVyL0in iSLlhQTnam163vA17O/gK6FneDeSMNs7A5Sech5mXGSwIXDbDOMagNYJt+t62MUQOl98JDaHuCX3 OT66ktbxz9/O/I603j6HzWj5w4Jt8vzvJ5jdL8ivAfvG1CFxuuihTaS1urF8ZXaXk2uGNeBScTG0 FeKKauuqVdNFt3GIWbNM1UN7XHtVqVnVzJYepdmcV+cu15P49ZYZw8zmJ4w/N8XPDHIZAZwUfX1l mqkINWf23sitl099LT9H+iznhTFOdIXUOT5N3NU4XQwxalMHlo66ShUbjdUgNVAfY6rRx62aKqtZ 7KuBx4rmRhKmcXetyuN5O0oTJ8n3dV/0vk+NnekS+jGtu9LGOmRxbqF3sPpIQCyzblurNqvZtoCr Q5rW0HX5QalB+kmonnRKQAjUDG+q5wCy5rjaSNzX0Df2zaxVzw9KK+erjQBp8SLgjQ9+VfrOSoCm zaJkPRwB0ik1PJ/NiLLZXRPPs0HV8AqXJLvDY6jOCgBDZaMk3xmG0/maPNkYdtEMs/EWYQTsw7iC ZUZ5648k7/D5T9kuMNeV6+SaFZJeMY4mwCarSNdnlAE2UdXAMVTjWX+iad3PLdN6DbgHlV/j9n42 R5cL/dErU2fgjdz6loQhFZNXpsxGnFC4L4bqnLihOsweKg+/18uSuyxApnCa+lRDVRtBmqpZMK1g LaMMSKtOtKytGUNPwrRQXWZvWXU5nQvEt9Au/wRDbl3W2+7qkmVoSjweM1c1+tikaQA938zArpbj cCPxYlU/VmVwo9cTNr+VLqvBrV+DqcYn+HrKls7iihMULxy3JtM5uygBNFkNY9pr960pMxtO590m a6By7pW4MTiu2FoD+1/THTO++jIGvD2BvHFcHJ6svH397U+/m4CdjTrQOt+KCa2v82GbFWOGXFF4 8cMCYN6zJCxipWujSZrQqARbdUVVGYPaPfbplVZAxRoobYrkKMENnDQ1S6p3Mp67V02ltqq/Hs+x vH2P9PGcS5qLn2id+damIhqmNAbJrfPKFMoit94+HpAbBIDTk4EJs5OQECMzhjoqsE4iYwbIaNNq X2+KSm0qjibAo6QKsOQQGNgKWJMwPJESm+8ye1pJvGAwdqZ///aPjZb9wiytytdZq5WsVbp6la3L 2pQVu4C4AqSvbE511sReNq+cTpOUd1f5sAj9rse90l4qvyG31NO4UI88CqfDlfOXYcZ68Bvr25d7 r2HkZpMVhSs2xuzumGxdrBL7E7Bzjt4ybyVPI1JGbIEnlQ+zS+uM3wh93PG8SlnwZQKck/sjT/Bj VGa8cVn+AHcxuB6UrJO6wDCoVXGV6aUlTdVe/2rAVgUNnyuPjE/0cXgluAdlh4sDYNIcruIoHwTk wuKEy47/k099Ga2vtL59PGCj9csGR/x4B5FcAbg7JJ44XbD7sf4MCWBhbCoFYmUOFEs1sU+12oPR 177VTOwF0RJ5I1oPoVeWJ1TneYWklcI5+x+lL0FTWPhgXd2g45s2oeB1YeOq7FNMa1VmGet2rPNS UMIL2hiuzsyIvirnrEtt3SX0O6Vlqrc74RrUV9ycwNpNYxWWzwVEw5jHJwTKVwFCtehP9sPE7FYA reOqpnrOuzAYMuyMzTuV0QK4KQyY96Xf/Ge/xdw6ZvVGB2McfASGzbKfnf+X/S8+/wVWAmteZgez JGpR01YLS4WiWZpUpin6ABdbnKNvHqzGcyyfTxA2v3UYD0LTrW+tVuwlqpJLkSojDAbQkccJc6zO 6vzdKa2zwXG8Mv3I5VemROv1vyPhx1LTL7AcXNdoHWXudW5QNF69SABuU/Us5qqaXUuaamurVoeO HwP9IFdaD6EH+KZUadbF84TTX/y67R8bSehVwrDbL0jrejMqR2PwzvKzdbXZPFAdmqUqHn96a7yk yF3bNMnd8zIe3beczIjTt4wEevpSAqzeVZ4Qusw7Sw5xQsq3DuAefdtZe8oQJb/v331rSk6cd6HZ 03LOxSetrK7xw6WrA38WHrTulpgwO4BTRo7r9oKX+KlesHe2zhw10c+ToWseeZT/l80/zobc//Fn f9vFoMwicWG4aINdXa6rKjVTVr24tuKqVsW7SvrOlrua3e67lrMyVD43NU3l3NZ0v+qRw93TUZlr YhWJBomrROuV2Z2iofV8E4ZQ3Q2OM61zLqF1o3U5HQIMuXPR5jvrRXCEts7YAWN5Auhlq93Fuxr9 xCA20eDhQuuwdjhdHk/iBT1/gPCbDj5oeUmmlxh5XT+yc9E3Es+aBKRpVW6vwlilKaNpCzkHR0v6 2yOB1rloMzhi6XhOmieMuRuk73o7IXrsHclux+uVw8n2WNrtNQfsMvsql/eQdORV5C7nkgxx+/kJ ZV/ZdOXvm/TGUrx83HG5udwR5wPnK7N7vt5W5HzHr9Hc6MgsHZ/5fQv/alVyN2xHsh6yqLIIXS2u XrAgZoCsK5rUK+PBLlYjoxSkS9PP1YxhblJzq8FRx6Y/4t/oA+h4DW7+d6sOvkrN0HCJvEpiJAc1 Wm+TU4qX1kcSZvnniMmtj099PXnZCeOxWlZ9l9mhwYyhDt5RnUvsPZAeNI7G1ihjA8AmUjM16VIN gm/QeqLyEDoPK06Gx5Sczjc3xgrZ4nFWlGG4S6viebFlaQVcbJaVhl7n6AWDmi00BWzx+KX7Fp7r YeX05eeXuyQomw8G2UtfXE/os3M9Vz6abXY1dpybjvRYcrLNPqcToE0s8Uaypa0BqiwDdy7OTXfV 4P+aretx+7M/9ykyLZwIY/P2IcHj5tY/2vae6FiuU2V7wKupE+OCjTlM8S1zCf98yR1y//Gnvwin U7JsAGJBpAuPal14wXbRJmtPZTzYl9ZqXFuPsF2OWk/09+544vMr0XQyzjRVAA6ty+PKTC1oHQN/ ZeqnvhKtV1r3vrdQPbRutK40WufcvcX1vlcNBowtmlS1T1U/KDXWPjgeGrCKpBiIzBr0N2gdBqeE 02V5Tma8Z3jzh+B0ymWdbGtpLD/XTDQb3bdl1qqrqxKno4G+8YblMAasK3AN1fWw72fZoK2Hxcl+ xjlUiJPgK8F5YI6TKwn9hKyvHMlsxinzQLoQ+pJ9oooeY06Wg5LT4KssbfazDNCc/9w0S+VW4L6a +RBHHXkj+upXPVqvG0Ndb/rG7JlyR/c9Bkdg7bjNNC7LOmMXQFLxPT//qy4VFpsLz1XnmonGVpvE WauCKjXAQwWpqqzShV01teOsf4ga1nj11qppqiH5XZVX9vX6VMmBvDIoK6AaWt+dXTUJw3/Ryq9M a25dn3A6pwyVW8i6hNaTgQHklWnulKDJWtV/7GtV3M4OyxSaYgOQxGmNE0FtSpeV1hm0nF5pHcy+ l7E5/fEPSOgjHt8Y/BKbl+Cd1os+LL912V91y1NhLLxt1S2k7Pbk5Qu0C8WP1S7Xb7F5vG2Ldtnp uATpaAaXbYn1SoJGhU1Tqw0fBe+V4qHL9PLQqd4DSPp3pf4Qej1iOF0lPkmStBy6FAwd88PRW39u urt+qhKaJvC/fjMMa4+Xohl8bhyAkls8/gIrVfSpBsS4gt6aqbjsix1TbpkwMDv/XY/BsEhcLa4Q pCUrMyvH5UfVpiqjxJXdm4xeUJ03yz9Y1V3uvvIUspem2tcL5VVSg6TK4VpuHe7LbDRa508x3peG 1iF3kzBQOcYUXOEn0Tr83mgdGpTc69MutzvAYVNtBb02jplqA6nakWps0NhqU/Qo1adVjdQP7tF6 8jCcg5z+tX/hk/tBelj7VrDwtQvsxjLb1hjKtWyZFmiI9TbKoPsRqo8IqyzmunRZ81ZjXKktGFIL fYTmmibGDwucs7OtVdbj1hj2yKbaX4P5IejuThXI/U6bWLJ4GuCZwY9R2yHOg3e3pefxORjcZ3Mm wPEEG3d8alW507TGDdsXJpZ4wnmF/PpX/uWf/OXPuM6zWv4/4s4YR5IiiKJzC4S1R0DC4wSsiYc4 AcLC3xOssADhYODhISHOAeJOvKxX9etPVnVN9+5ISKXUz8iIqMysjN8x2dk1CacEZ0tUS7AFoAPu C01bI1Ry1IzCQ0Bv95hM7NlUdWH+wXx9y/BU3rM0jciJipAqmLFw3Vpd0vo4CfP+76Z1s3UGjgKP m1GbmydVl8SP5a25sm+UXjhUIhDTW0GaMttHBSRcMXHUVk9L2RyHtIqf4G4vP5SgdcajhE+25Onk NSH3PR+v3Dythpk6C8/OWzQddSqsasTnJ9/ATVRXTm9aH61bQFYkxxtAW8vmaziRqgr3cB86YZlT fQ5vRN6pukIpOAqAJuXg7mErN25X4Ji0vPUnzDQi6YHz+tzTb01hZ87DTHQ8UfY9VWKMVzk+5IfD MPzpw4Q7q3mOroFmbZq49o/wWgatdopXw5XK13O0rLdxrVt/n/OTJb5EDbMbQgZn8ASMwC47mJEb vQHGnsKHSu571D8VHtVeV9KM3Ljv8qj8dCAKUzrJ3gUhl7Tusjwl97wThr113rTuPgws7zthfNA4 bFoHy4RJ0uV35NmE6ZH2o08Pfdz08FSinLLpuE3a8IgjEaQMwO2crTMYeg+t7/+DtIJnJ/RBsiMe JjafIiqxJHgWk0tEDcnihxK8VFf+XZndRJ70rbrRWJ/aat5J7kRzqUqL92jGBNAbLy0X30m1R0Mk 6YlOJldT9dTDncKvPn3z1+/vTwmarzo//vQ60TUdhul4a5w+8L7GnEzPKHiU4LE2xvb3sz/UfOJZ A6kGpClgbdrW2Kjq2WW8LEUlfIMKWRAYXESvYZngNHIiFxjkhmUHp3JMBMfq1ISC5tE/KqTpRcAo XtS5VpCabxF020YnoFvF9zQ53tNRMzPKM89U8XnM1rPGSMZXWl9OwsjpbsLkgKNOQusTlXfCjg7Z +vSAGFr6c8TdxI2otkSM1TSu+ImJCqlqYrVLPyRwi/AJEmcw9Bgql9Mp4XReo2FUSOXPCH1h2JuE Lk3f2DDZImoj8SVRQrjI1//ltqfq20a5rYnSBuNv9s0cIgCP8mxXXcqQIpP2KuzymKcfJa3feGfn 2m1HgZt6xyggbEzVnjuc9tk4/C5ItXUa6xOJQ6Dkk4nf94dSGxAPP7375aFEu82D+XiA2V/cpk/4 8dcD2+ucTzdbZ1A8PqaLzkvoPO4db6ur18AtPKx6HS70vbgaGYlNq+eV2cfB9u/f/UbkyOySe4IH uUE1hagKNClPqxKtEAoo0Q9+EZwqnwp1ddGUe93aT1DhujVOPh4013e3xZEIpgnk0cDa2VvP8gO4 tELrpOpswnDuA06nNFvP3jqjgL7D7E3lwXL66bTYqzxxq3Q4kiPucanWVurHqqt0lWpLJkxVch/Z upwOrUPxjOTrX/+5fiOj0dKxtFP8EnUozDpr2OzhNMy3MEtiPsJ4XCNH250syVrfLti7qAl5AZ6R WpG7DDgxaSt/AD5uvxyd3KVz9r+WJuKOnx4Cs3S841GSaYHT8TO+NX3+W9NU+en/rS2aDptrzPY6 P0riLPy1WlrR9Lem3XM/mMeTXSh+XS2umWJqFLIYAF0dtqF1l6V/8y2ry7VHOXSWdbjhsfy++PbH n//4V9Ih5AgVAiZBJZ0lbo+RiYKBqqaGYv1MeFKO1SuCvu8rum1ePrq9aL1o6q5O2IlCCKB0E8bV mzUc4N6659Y5tC6tm61zwBFaZwXSZ3oip0vuwVbD7JAk1+mTitCOUfXC+YSdIoRqWgUDYttWUYuJ rK3csiWqIXmS0902Ygz8iNQ3MsLUXh02Ro7RsubvS8Ag35l9yYMmKw23yFliiSDsrXN43ADeom6J t5XcvePqpPwjN71VGV6Q6XDVKTatTRngJk3xpGD1etclJu0twgmEjnO7gEnzzmocXuhn4CbCZuts epz+1pRVziYM2XoCI8z7EMD81hezp3545xe0ns8th+MDbU5XMtaVXLytH+RL00rQU1X9US6GWYG7 Hxew+zPbgiRn50j7Z19+9/aHP/nOLdsyBEwiMIBY6lC0moAE2ErppeSIowBonZb/v/iCi9Oxe3Si HJDxHgE6kzDkJa2fLiqEoXWydS5one11yrzBEQUeKPxOait9BzS5y+/wZHrboB93VgIKYC+VGQJV S1sprUYtCq3Whq0QNleBKkAhav8BAAD//wgt+ekAAEAASURBVOy9fex2W1nnd/6dDqnCjDziNGqm Fc5wSLWIgmWSZiqFczwkCprxHF8IA4McGN+aSeScY8eEVvEAKoiAIDrVCOLLjENRmEOgE8aUQaQW WouokIkYNZgZpqSFvvhXP2t/9v7e12+tvfe9f7/nOQ+HpsnKyndd61rXuvZ6+e7rXve+933Lvf/2 M2/688++7jN/+YMf+/Qz7n37o2998SMe+ZwL6drdKf71R30LKcUZFIWVKmunvLW9dvecX7tzAk9E 8ohrTwz+69fuVAeJCZutdvHq33/E41Ml+KIv/k8A5BXMxWt3CshvfdRXRk0h/aa2A49/zJd1Eoud /NZHfsmotioc1ZTgFcB8BLU2OqOpnaqq/NjH/Mf4dvsTbv/9X3nbX/5f//eY3vvL/+TBn/jpz/7R x8eqS0lecsezPvrgf3+wySc++envePaTqp9OU/K2PNqqaEsFgHzO63KaVoiLpy0Y9Fkwy9qzic2b cLJjbpPZJsanNOk8EQuPfOydf+1rnv3M57z01Q9+9D2f+uy//N//z//p33wmiSJJObnyFAGXTVjQ 4FZDFFarIg+I2ihJ1fWA/+73P9k1HyVR2KmKzqqfVQjOgINJ7/2DT/7mB//ks3/xKVaauUsumH5f /b4/efor3v+MN/7ePe/6s2998E9Jj3/gA197/8/9xMf/NxYeBv/bj30a6qNIEpB3CYbET0gy3gZg oTrm9ClBJ0B5JJEDIuyAOjv5//yZ/ye9q4YEQLoFWucanv/+P/7a+9/9Vx53T9jT1U8eom9Lf6H1 CE/6C+0qQRNQm5zwvKnYpTObU8Wubk2KpG3jwWbTWVg+/C6paSTskOJBykvDjrgjv04QNwQ4Xw1y scjJEQZUnQhtbtuKbVhtVsxowOlIuDoS9L3KuR/54Id/7b7/+iPv+63V2uPCn7znv9y6c2TLxdq/ /qOP33XHM70X6iR+On3JXRiNc7MIJ66Pwlw1Kbh0qQI0/bQyYljyqtA0VSNfjLS2U3N6Z2t83Qtf /Y/e+n6Ygm3D/nFTsa/qjmVnkpRErpBWgtWc2uhXTeVVstp8VXipVjJX7NTiWVKGGdMwYFWYWoDu dU6uClVmfFIrhtZJ44pyacHaeP5DD34MTv/WN37wu/7Vp0Lrt977HtxzErlSCV0mHJkdhToa9RLE deLE5nqrq7kEQVeMvso0FIy5qy4KKQIUKmm0/rS3fvyx/+BtPVNPQU2Ite2BQrIpBlhrseZhYYSm eYsuG6Yph82XHVj7ioWASuhpXllsFXckWHV24uvH/M3bqmbwyP6j/R2zsXMWVLNgxsomVc4gxE7F EQq4FlzC83f/zM+HVStgh/zKi/7hFulXzX0Mp//mj7wCvt5Sq1sRfN9d3wGhO9Rcl5cg8HqlWq4C /iVHYSHfFshTbEsoYFlR0aRW4p7pO8weoMFl+Wm/KbvsNX7tzr/1Vc970l0ve+HPfIAgkV3EFiJl owKS2JAkiuaRC2gbibtxVY5wtXnaboFqf0tH+T5hjW3PUjxNtmzqFUQ8mkXS+WyxCiNhTMAkZuHD f/inrB+XUxZVAN520fqz3vcnROv/6Y/+OrTO4sQUwNhccheH4mX5VYcR6klyryJFAKlTi04HumKM cJkjRih9Ow4dRnjL7e/4yK0vfNWFON1Pr0ucLt27vsGCebkvgbMsXKuCO9B22nQwQt624rIhlVM0 tX1Y7iLisLk6raipQmqSXaU8LO+k45qjkcraNbIeNSPpurO42lbj0Q+IqSuA0Prrf/SBVcJlP0DH kH42xqraWSHHOD913391MOqnr5+8/7VP+uonjnfK0xQvqyULZuZx5RM7h7sbv08JXh6F08IrsXlb gaegvjVZznDKapz0p75Q4FjmK5/xoue+7C2/8NufcIOxrwDZw+5ki+CzibbZ1bZSYsOKq6nIA2pt h4/odE1q8WzoXZXP4s6ZFAUpxk7kDE7GhzGvhzDjmjRah9af8sDv5BDmznf+eWhdNuQmJJXL4JXc lazeperkxqUIA/C8Yq8ol0NRXC3YZCevJE7DFCu+5Uu/7c1yetswA5MqcX2nNsVTk2kztP2wGBGo WXPIqBULHTfNKRqadmBj8yaZPAlIUUnb7ReNyHGVH8Wy4cieV2PJkXdWubXSfRRqj9XPKAjGtlEW pHjwohgoLedjB10QHXPeMu4EJHAx5zCfffBfrNYeFMLUP/zsO45H/f/4TT8HrdehcIUgmZfKEgpQ 9IrmvMpnKp/C9oXus9JGfm+SicG1ST7z+7T82gKbkgsS3BbhFPWTo8yx+6OefM/9P/XLxIzsT3aX G8ytyx5LUnIkp8mqWieXC9IRoFNYNXJEKIWFyAK6tjVmP8v4huerQXq9kK6LsUoJOYnrhbUTrbMs VwMRFKB1jpc5XudsHU4nWofljdadMq5R+q7kHpwByQgHxBP90f/gDnRFlLWjnLxKwJGjBq7cXauQ U6wKat7CUq7HL4nHWcTKU1sXumu9LfS21qcAZ9kGboBuS1CEj8jdutlsVWIT89my9qccuZ0KKgW0 zT9ZNk9xFVR6HTlUs2fpu2tYbWohedUMI59qp+9LLVYjalZJxWkekNqxi+iE1rk6vNriXLbHj73g eR95w/opzUFaR407x1YXoxG+X336U56Mqx7FeMKec3bkE+c2Mm3YuZ5wV0ShJhumrVWh5rZupyN1 81bLGrsQuS/f5LdFPn98nHW8Byzk/qz73wSDwFwyhZst+98N3+VuTnTSRKAkuWq2BVcjo/1OAeVR Ui2IR+4eLY+tRslZfh+bRKKfo7dVDsYxE5jEgJMk9JHWu2g9Z+u3/fSHQusYkdYrs+cEhsh9dXBo hefmAIeLor5Z1eEI0zDNbahcPOapTRWABUMvnUTNW0Kg0ndbtSVeTm2EKijfUo4cUFMLc8qenHHb Sy1Sm7dfcQCSigPaQQIwz5YGhNfA15POEvpovDLpcTeuoGlHWw0dzOpep8nwwuxwJQla/4Vf/KWR XpVwDvPhl79m3Cdb+qty7g1naT1d8NHh9qd/A87n3pMLkYspCsjFkXRFLHilnSZqJ/q+yP6xPINp Qbresux7cO1uonX0vUmAH3P7PXd9z6t+/Vd/vZK7/M7Gq4mtGCpnE8KGBL/kPGxDeu0/exdfzL7m 137XZ2+yddGkoZuWPAnLwQFu9RQBq2pV4QiuQTr6XXHVwqrOjjP7VdaSS2cMNXdTVlEWkksxRXrv ztZ9EgZah69RxmdGvh68dLijdaeAVvoQoFyvyC2qU3H0cwlbtVUT5SwD9GtRrLXoAE60zsI1VGdB h+LBEmsF4khUyLpHblIy44XQ2yYcImvpPg0BsRkAqcUgRmqCv7wxVCKruCpfAW9xfY3ED5q9mlf1 zpGOtkytyo18ZTrc/qv/3l97/atemdXf8fL/8du/++N3P+/dD76rk1+qyPH98TN6vlz9pqd9dTi9 G/DQLtceLKgSCd3x8UrJFUK7apq39bbcHrRzIXcBz8H7FLAnWi/RPTeJktpjXR7LELlDJTCOW449 1iV3cjsfePCj97ylRY48Y8NdgSP7Jzz1BeTsPhL4u17/qxCTzbGWra4Fi8hTheTmpFWyrl0fjNyr 52KNrMoRksKDYL4v9SvT1ZXJ8mYW+P6DExgPYeD0dgjzht+jCF8TzmNtn9brRQXrHm3rRASjFj8R BtsqRgQRCshJaSWuxdSyKiIHVzm40bokHgINiFyelXZTCwj/RsFaNZO3vVSofN5Ri2Tm9GUXVbOx plCDsQaA77TWwGQQYXhNNkwxAJ2aKjtXXHWCO8aJHFDtd3ZqVW2SViqM+Sqh26q7k41dVImDI7lz CZDdNz7uNh8tH8kdCbR+NtZe3UsR0pwz+k/8L/88kgq6TqF1ovVu0LqBojivnIWRIxHI4GNeay/Q 91rMrvK8Jid+B7sO5/OZFsvnG9QGJPdm2TB/MssDM/A7QTf0LTWzjaVy5NRyDyBNzdtH1dbj4o/F 1um1J0L3BO/eJNiu7l5MsaU7grC4JafhqL/PzglU9zk6atjf16wOcEW1WPHoqpLkABkNI0brq0vL w3donbP1fGWaaB1XvV/if07SATmB8VgGx+oFUnSEa64/VMUx1SKvVdFJbSfx0sa8GrF2i9mpvRCt t3U5kbWg4iqZV3k58laCTpfaJln2BsCiuTunKlSzwbQCxyxUpZ2YAlwtnSURzO6Q+FanlUxHHWtr rg6jIciNKpIY2bccNccH5dECOmH2p3zhF2895sgmgZRbrL39hGLdSKuYcxXuDQcfhoHW7/zmb/cS 4OVciwC+A3R5igCpPJKq3NUmbLdJ1RSj35IEvazntgIXYUhccg/Fo3ARt+Cd0JuvVb/mru/nsRmO aGBzQiXkGpny5TdWpbl2lrzZ4fdQUJg0BAtIBOxetvpqCmWs1u6zOU06IouRsw2juQq2qBxv0TdP w1GIhMRVS2pgDLLMDBG6QME1iUKi9ZytE613hzCh9XoCE1rvxjlFAbkgvkVS5V5XJ7GJ124rJBkK a5MDjMorm0dIc7Gg0XpbxBNHm1vcF3a1aZ62gLZPpu0RqkKi0JzaJDgoRiqgLUXUmpHJWixozZwq gMSHZq0KPsLjUT4CqsEtzq061WbGxOuiKqCqreL0JXeTe/kop8qGGYqmM5GjCpAadyzOSVY3A1sC OSfsB0l5lda5JUDrB39rSnff/6IXe8vB84B6+RLxFh2jyQVGpxZHXCWNr5fbRgCr0cVm3hak69Mv VNs6nAN2mkzsfIrfLS75/LAN1GxHi51ptZdjHGrRUa3p5OtcY/a/eRt3BUjKrSu/u73N5QtzdADi sOQOCIkH7Cin6iDF78fvuBqDgh0JVdaSc3XkDAiJqHx9BS6HMDz6kkMYonW+Mr39Fe1s3UMYgAwe ck+Rqvyy1PE01w1wihVzIfGwKtjKquiMoLYNjhoGEZpGfrcWeR+tt3VcKF5KTb5aFaFtyUkhKXDb RSV3zyhEjRVMbWckRYC11YLbkpzUEZnCs1VV7SC+bOQ+EvqOqzs+dK0oMoA7+qHyqiNhIdEavMnl vOju79x6zJF9whHK1i9FV3dRJ4Sp+WXTweN1lPkKN884ws64GnLX+dUcnVX5DvtDnRjvWq0Iy6dM lNuCXLj+xLkLubc13Pj99KOneVUvCqcVLl8b0PjJYMkXI8sNAx0/IkyfFfD5G55938+/+6McO3iw 0xErWz0UL8vUIrxwo1LXr2YrfVe81Sne1iqLEXZFNCMJUSKB0xOt1+XHcqLI5aNgtM4hzH2//Uk4 3UOYp7/unR7CYE1ah8o5fumidap00k7NkQCSLOqhwkgCbOglVJxWghTrxYJNNKzAolOMvALwBVqv ZBp8WpET3acYUJkXIalx+hQBtf0zEXqARdXIbStoFD/cUahq1opNMNZMwbLVKqNFOSB8sSoJfY+8 rH4U0lzQ8W9Xm+JZJ9NvDApSxNRZI+hUfbGT4uVzFU/5W0/YOYehqv2kaOPx9rqLtjAnOVg4eJJD R6H1boTl7jB4QIbU60oeTkfhtA6XWF5hdNJKOcXQN5gF1sh64vQpP/1wiSqVFwZf1ELcc/PplUpF iL5dNAsLd4vta5ZfjHWae5MyvzLhYIffQ33VHT/yjO99Eyf1nPDc99oH7/vZ3+IUnq9hITKYN9zK npcCyE3QR5fQ6SQpxs4qm6MWhTQZAfSqMCA6O12jY21yAJdgW1k7Z+tSebcUpfWcrXMOw6PrHsKE 1gEv/MN/V0P1Gq3bXTpdHcDqVVxFU3kn8aJSW69RYVXQgvIQt8JarFjlE62zaCTZ5G0dL8FyBcFZ fx1gCZqQuxyTt4VrKpZjEGDSoHJxLMyWl9sGhOUmUT7msljN1Rkl4dPRiJKRbpBrZ6uJ8qpTMbW1 04qp8n6mhYqVtLbTY++heIvmnU6KAVwL3TXanUKbbj9Q5Lz7B77vBw6eoozNkfB9aXsE/tiNATee /JS/g0sQrglXAeQyr543ql3OTGoVQga2q0pzgFU2SdEgPcIYPClL60vQLSO3ZbnE7225TpRtzloF tNrcDJa2s3Dh92kXTJrTRsiCr2teYc1d6k0yjUPLF+ypvb+A/eK7XvH4l/wsjM+zNHA9MT5cL93D GpAdmx8uSIIpwMkBpDAOYD+pPOrQUVeVovyeYgcoSk/kSfoTOTpbT8JkSUvrnMDUaL3+HAlr0PrI 6UbuBO8o0G+X6x5C5bnwXEWtAqsf/22lcDWPZmoDnDIsALRcAWoWZ1pncbCefPRF3NbrRVrvim09 LXcCMTmcQt62xxJTsxBrUTmmAOYB1T7CpMZoC4kjxNpOqqTWsWRadcQa+Q5YJfRV/RgHSCtRS1Uk W2DL8+jXy4xQkCEK3XcKKXJR/Ahoi7jZGz/2A39vJ5xfpfIq5OzyntufefCAXlrXNxxj2dTRk4gZ QFeC19gW20WKD1/PQzFF6GDUrKp51enstCaNoOefWTSmnoptiU4YffGp2IKVKZZvmupPxyk2jGQp Nh1JeVnq2Q6tr9bRdC6vvjeS2Ujzqia7y41fVzHuST2b2kcn+eYWor/v5W81tIfr3/7u/9Vc0ieH 43LyILlIEzKIErjDVON3JNQmeeew2FXZVmrT4KoaQnVsnlyh/tBLovW68ILhfS7Ks/UcwkjrXKaX loMXn4GhGIlDkR47l5TrfC6h+glOW7FuJ7d2tUoheUDoG0kwQAVBiqdova2kJc0LayqKq8T1Z448 KZvBDZNt0+Ruv2mNxtQIdCAGBZqtNvfxKieuUuqqsDO+ai06Wqh5qgSrXawK1bc774WdKYqy+Q5f 71R11qBO086DjPym/+DheDZSBTA1vzXdum1UTTDKPLquk5AvgFwwL57c2q/deSL05TZfdUaca7fK IliWH4ssPIRzbug9USpNSG3lL/F4gDQ9c/FS24pjeO4NYOL0yt10V4vd/ppvA0urWXkhel3SPXP8 n7puz01iFopP3nqZ0uz8dCjEwQ4PU5J4iJ5vFHmg3l9FGenD4CQYBCYlJ0FkglpEqIKEVSkvxBeh RlIMiHGNkFf6Uw0JFEZf7bn17ee1UIDW+2h9eW4dC9gxWq9snmccV2kd9+KSjuFSfM5VAKyt+mKr 0qSqaQoJtbonNleoEWujlirlK7TeVszC7x1IFUAsIHcbsFwaKDEUxVRFuTObogoUo9k28GI8pgAy ozRXc3XIj9BxlEcwNh8lY6t9ycjm1aZXMVrYko+aVbLVqvI+vZPg7o5hU+R3STwPs/XsedS2AEy9 //w7CmkL9hnHMVTnuhw61hVgXl0XCR0d5RVkQLIg5fGwOfJOMjZn+bGq0WxUyL6YSLmR7MLCbbme apc4vdVOLydQbcKLhSmob01OxzXN2rLsZzX7WoQozJ4sYHZmUqCJCuTtEgy2li7my5+qmuZygwR7 vQqRmxgTfONOQJLueRsgdH/XK9/LCT6JE3yS39zKRKEVAeSC3CryGtdThG3hKakqOhWAa63KSrAP UBk7JJ+EyVoKYGlRC2tXWud4nWid+xZyGTCxeY5iQvHo6Am5ya5T7AC+IdHDiiMU1Evw0tIkIHIk pJA4cnUAVQhWzdrztN4WUwnbxVmCLiAWh0sEUBOrJHIXnA1jpAI7Sl4/VFabq7iy1apChCO3UgWV RKEDlXlr1aqdKHS1XTFqAfSSgYpQkEuTqcdijKtQCb1irWVLz8rTa7+24h12SDscv47Xr7/j1S8/ +L8c9MWTORAKfnbMrs8X8nB6wEJVucCAOp7VSMgdBeS12CQTHQOYl4mgl3xiW2pdqDM1N+Fy5BI6 lusXQp8MTjqL3C6yleiok1iswlHHbYLOrHwxnPfSvBxyJp0rbUYWBs+ATJd5ks86mG36jeInhQZu u+1pvKAYuudpeh675FSHX10RFMPd8KBxfeWvsJKURJW1Xa48QoDUFknozCqIbOtsPbECtI4/0rp/ oyGt550wdEFILqHD5jmHEXA5KNBdl/REx6oCcoXkOm+t+vEfYbAgpqpmp0ORFPrWfhVaixyd87Re mdclmIXoYsqiCUAOZh00Sdlv8+KbbhKd2WoZ7GLtDFI0hcgiOQKu1uqI5R2dy3Za7yIyr4O508VY FeqnquKR5SFQnofZOieBannM8XreIsAtgb/U2PrWtAZWbMX7f/CHHvfYJ+AzDCu/mythITGYWU71 qjNEqe2ARfIY7BSwNkoipEpSA7RkAB4qL7VNbZG3JT0pJ7e2tzBZazZLYI4mEtPcaum09D7dBpa7 SFOb0/ykTfN/ue0Fq0PR1JwpRF+FyFurKffG1op6deGS272K43sPcAjqoXse0fEEH8bPMU4lL3AN 4aEka8lNkciMUqE6YTRY27P1biGF1jFCL56tQ+gyO0/CnI3WJXqj9bgE0JlIuqI+Wwu2VhCfAV1V FARdniJkbdsAqsTIARQjabQ+T5U3/Ilz29Lxw91SrDqpBYQ1WC4UXRZOf81tjs3VVA1Wf2JNUO13 VTvFVWJVyCbvanfC9nQRHYEWxjz6AVUHYdd11AQ78XunWYsjcVvr0DFHFr1wHECfjnZe+wXjE3Ff zznMSw7/Ad7b3vxAHobBz1Aw2LEK0bickGdJUJVar7HVFh6vwuAt0BbzEo5oR00HsPU1h7EthKfY Fu2Ut2Lj30k4U/xM9G3lL8ontWXTTa1O0bq7gO5aq7JDZ/kiaX5OnrTe565PniPU7QCvxSJ55AG5 2OhUSZpUEIUGpnsPtdUxikT3PJHJf2rC8nCxBEQefgRQhJ4CxKFI5VUHIsMUaYvTIXfCeaN1AvZE 6/wcCaLHIBbI6yGM2LCdPGfrcQag23pSHdZV/UReq2xVJatqEWo8XQCk78gt6r+1VkWtj9bbxKyR b+RtGZXkXJKvptZqiiAELd8wXm2CvVsAYl9sLx159cW1/xcNpUoWlTJWPV8VbhFxrFXQ9UgxtZ3x LbPzxV68HC82l9wVq+XoVKGYnRYhtE6YvLU3OJ9pz8Ncx2u/vu+pTz/YnNAeWscx75cMV0ZMh1Oc r2LtySuqUEYz1yhQyGrMhXcKNkwetcZQ8tQ0aDN2YTemnmth1YabvBy7Xzxen2obU2skIHJ3Ry2C TRhvtVPO7mg6E7k3if8YpXtumTK/Xki92HFwOh0HwSbz9S73AIokLYjJ1TdfBmG+Rc3+T62oIqjn 3IYQmwNxWSlsCJD4zOW4WgtzkZSjQzobraMArXM74QHHGq378gBJMFQ+nq1L66uO6UByWdUcYXWy FqMgqGrVQodTBIS4ARYjVGJxpnVXiatqzLOG5kmaltq8FEqErqTm6LfJnvTnVbhB66l1ydqwmhJX OWxosTWZno4Y9ZFImh0jhEkBqcoByAg6y6s201eUYzkSwKqwKhzE3vmqciQQOluIqkiqGjg+eCE8 5rjDvND6ztMy+cC7BY6/eJ0n5fEETo97gjpZjUoKm3MtWRKyDE0kGi8zuGkOZIdwNTl60ReQN846 5Y3H27pFIuGuEfqkP4fwE/XP0X1j/6kh/rv4AQ1rs7B5hFGzu8jnLparo+jF1qGIJEA1Lx+cMa8K MVWFmqUqtTOYnNerC7kjNs2aA8gpDSczEhDUZpIiZTqqIg8GkMKksNiRaN0nYYjWpXXf4PiU178D ypYipfUcrwM4WFc4Ruu6R169lbgVqmCt3sZnFVJMbZrsSHQ1CrUYLDDvo/W2YtZSm6cpOghTIHFN kDNbbeKLREyeZPMt41ED0AV5Z9C+diJQFc7m4YizmqsKY/NRMjYcdXKSU5VzO1FYixVnClTbL1b7 YGeqCvEE93hR+BYvczbCr5aufA7zrjfe2/5uafsptPTLJwbe48hLgyvF6OrIUMjrIhE34UV2qxJN ySzgOhTBaa4yRatm5loY05CcTrVGPlP2tE3m2qltW/AL+6Nvk7YXJk5vzScj8+4onG6rWT5tvdpc eSSAdqUlb8XFW7BDWiUVd8opApKiL+C706jNVfYuiZs7Plz1UowmzXmInlA6nFhpESzZCcRqmkNw JGidr23GD5qRoAOt++9Ip2h9+g88aR3LMHhldr8szXenKMRDAAY7l+KPteRVUou0rVW5qCpUZyeH tTseRzmSNDxE666eOZ/CpUx2pjYS15ZF8Lxwl3XJchxTtR87O6CyZOW7NFkVpnYVjE2qpOLV5p0w rF1dVadKLmu262W/eOQW6G7HWx5zzGYIzwqQH4+4u7YUfXv7kcdp6AhaxyX80bFuxCAFRk9qoMqV diFfOL0bmVOTiwozyyz0x1qlYVuxk8Ri62ihKmubRC5OxI3CRfqm7SS58OaAk9CGRvdla9SNIOae jR27mztdivaoWvN52Wu4p88CMeM5DkK9/E7ZYi7c5g6IhK7ZU77cUdo1LodCzauFLnCvKU+5rbDD L6R4UDLUCSt1WO4jF0hb4UGOzs/+HAkFQnUO008/R1p7br1G6yH67hAmbgDk63giqMUoxGckwR2w 2OUhaxumFpCqCCMBkHpab4ujMG+KABNTMqZu8lBoEbd7o6zaarniGG+tLk7/2JeSSo5VZ4sow7NV eRVvWVhVHoXHOxrbXlZSiXsLa9O5ALsza0c4TIK4t+Jx2JbHHK/8c1Oa8+TiziFP7gRofsezn4Rv 4xjivzOeC8k64cLFuSh1aj5eeB2HimMEcOpruRkgIclWU3h+Olif5KcH0ufgvSkPwiV6ZQtorYGF lDGeYtsjNi+7smkueyqtZrDcn3IV2AeH0wNydSggVD9Yr2LE8amjpCa5dmbgJTg+E8b5prDs6A5o kK9SeRAeJpI0w5gpAiCvyEOdCKH1f/m+D7BssoQ6gA7Rep6EIWDnVV+t+Lp3YlAqNFQPlcPv4C5a t1Nz/YkEINZJciXkwWkSYSQBqbJVl0vWUaY2Cl4FxQBM9bTeVtKU2kJZAJjE/mEmnBunMzkgSQWb mMdmBVRRrGrgyk0aRBjL+2Bsi37H0V1xpI/9LsZaLHQ2O52utiuq3AnPejVeqVODtVTlthpJdcxt iSRbmk53zmF4GIbfJe3sn2471SKt+FHSkZdBovni7/lHuFQTTkLo8bNeBdj1cwEsFNxpHi+GrWzS FVtf0tnCVm4Kc6qypJG0BV/iaKqW4vT3v1OMr/6svOyIbmssreaQ3OhHYbFZ9qa+HR4KryiXFlCv PZi5AG/OyFqnOOlgkut8rpoizE7MLlWZh79gKHDNLUqCW4cwWX6G8x7CJFrnSRi+Qa2HMIbq5h6s y/LkdLeV9AqHUSCnGD9rUWwezSqMHUCVg1eLUjzK4fGoKSHvab2tkoXNu7UVpsgMVcBMd4vPBacR bSa3F6fWHPYRVJtbeCtU39I/K4fUuLpRrQol30rBYC55bKWkaiLpiqutqk5wQG1SheF0FRjGqrmF Q50qUNz5GzxOMI+/PD2bKuD4O35f89M/w3scccZ7m9xhrp9M/cwv02W6bKxSDg5Q3klqbcWZSoTp scOdQZuTt7RQNjiE65JuVUs83sCkcAEsH4XVp/lcq7Jcv3RB1fRR4MKpCw31DePteidnqqQJrdrI VVbNy0cf0OWrdiLUiB1FePJtcnJ2Qzz5KbPzJSp8BEPJfeQj34UWqeJZGmg9hzA15vB3pyw/rBGt 8ySMX5kSqs9/eldezAt3G6HX3Ggd6ifpBl3XVH2rrsbDADkXfUHk1YJV5KYoUwx3I6xYTSXkATbp ab0tmiW5yMgldKfnNEnL+sh+aMvR707rElystZU6re8AijUZV2ZNuERuQl4pMt2tClMLQCEX3slr cR+f7aU2P6vsANYmFUuIIawAdaBRiHvri032zA8/+44rPw9DqH7wt6ac1eRhGDwkVX6fGWFaeLjt UnQJteKwIK+8lmIKB6qR1e8JWQZ6kjOH5tKyBcBtXyyLH/mM51g+RzRzaL/ULnKZfQn5W+1k2cu3 X7vQT/OMBsAUeRYtku7qlNS20VGTPNYqHnsZu7NfHW5dLBSPpsr+Twj0JGFJf+SkyoAWJT6j9ZB4 ZXZDCqN1D2GI1j2EefwDH0i0jh1pPQF7onVZPr3rSc3xM45VHOEq2NJEuVaJV/MweJooUVnc0zrD 3VZJVuESBWTm5nm9KHdi2vo2VJlWnnYw1aXYty/ydtu4aLDrrismZOvkq8VVNpQsVvVHYffhYIvQ q82qU0N+jK/6M3a6L9ky0vXVuluOnrMPK79HCMD/raMSNgyPOTZq3j7HTGw+Ar415XSefKzqJJzv /+2vb4+u61jc2xoNl03ymTsW3k+r/dVVmY4m+Urw1LwwIC652uelLj0tedsCE4+f8mkrnYoLm7dD 84X63W7otJS9U07Vp+YL0U9d2DseUqWfFczjoFfTlpx1ljtfa1gwxW7oUusUpGjDDIJmYy21yi+0 Wvw8NVncU8Kwj//tB3GHvGTJkdZdk6srE1r3AUeY3Z8j8b51DmFW/0ajhu0h98rjwXhiQgKZ6lKw 9FrdVqKCDZVEM1VIUhUQU0pGEkfecX1P61JwW0bTcmTEXakA101Wj5PhahA3HWl9iVBWCf3CIp6W cm0ePIJ07XIZFY5IJN+R/tK2srPCLQ5NkyPgCkbGJlvxeOQZIiUpVg/DlQJy71v7/256PecwPJB+ 8FWOaPowDF4xEfEQ/8W5o3tpNUcnC+MEBjapQxGMPvZZzPZiUSPBVCkZO4pmBWDcc/uQz3uhY/OF xFFu+yL5EuA3ycLjGmz5ImyeSI7LZVIVYfychYXHtyQ28UozFAhNtqo6nbwr4nlTXnwTz8LiJ2YV knPO7i9R4SnYKnwHIEFw5gAPYSDukdAjCa1zCJOzdSh+K1r37CXxO8B+x7x6Qq2EO4JOHoK2ubXm qaIYuaDyeKrQr1QeHcEmrTMZLYieRt/ZGvNucTAr0wy1sKIj9LGoTp3y2Hc9pSjoQuZaDKl1TS5b HAl9tDBS7Y7OEeWx+apk9RovZd8Ry4QC6jhbu/OvGoTVvAZgK5zvgu6uyNkOtH6kLbTO63lxjLlg OVUPV4fF9TPnC23JEav6EXbjUJt0VTSJRKxXF7ou3Bp52w4X4xuKs2SKxD0in9l84W5azZsl0fqs PJ/SxEi8ErTuFn7UTyUNL+4hORWX4UKShIX56pZaitq3KnmaAGazpUm6Vi0W0mqWLIw/D8X0S13C dg5keBe8BCdPSaySGhghqR7ChMrr2pPW+coUKucEhtT+HWl6Eob3vWg5JO45TI3Zt2hdUpaIQ+X4 Bg47q1NZWFzl4FrUwtgEiUIdrrlVSqID6GndRUO+xemrYWCWy7zmhoOXSuvpAoA18kw2oPJ1lV8K dyRY6a9ibK5S+U4sv+pGZ3NVJ8ItZT2ptRWnuYAqxzzy6nMuPyBqAWHMAGy2v8Hbfk8Ah++cw9Rt cxATWHHDOPKIJLTO63l1iZwxCcZz1kYliCwelxBVlV9ypQ81yEQAZk8M0peYWjlVNVVhY/YpEkoe TdSsVWIrc64LIXkrTpQaSVdscjm37LVZkoa7hK6F2gTcFdFJGqtwshmZHDDXZpyfmyyj9ISnvoB3 Q/p7JcmLXHKXDXei9SxLv1NtPD79ytT/MuVVX/VXpnwpmoP1SvFbnB4fJHFy+VRgrQ7rZ83V3Mq1 MNZioRJ3jKuZqgD0T7TOWGcBtQ2z3HszVZmVKnFuzJuFxBoDs1f7YBMNne9moaw5ilLSSExKRvaP fuyMbTF72bTPrZe1Nuqv3lc6tZHEO4WxmEEYqyIJSyKBPSnizM5jjoTb7XWMl39PL5EUX7dyvL71 lWz2IbTuo+tcsrSe5RG3BWEBZtmLRULa0r8hiyE+2DvFuBGMA6ltwkJkYBIK2WhNeZLUfGb5ZSul VQVY9koRgtORuPqg5aqQUQIwyHp7oUmRVx1wUhraPDlyfWg9ThxSLSNMUcf0f24+XYsTihph+5d/ w4/zv32wM5wli8F9EiVFgnGqxjg9Emk9vzJ9/vv/uD23Xn6OhLVK5fC7p+r5vlSaHnN8QBiXOpBa dZLvNEmVpsyx01mutcGV0BXOtN6GePlup8Xpy1rJ3GSqRjBPzLJesZOk2RTTBXJSOtKClplgKbvV lhCj25ZW0SS7Ovqjh6uSfT7dql1l+QgDmmMXX9E1+tApdMVR/4jNpjP9wWmad8XIBXUTMuyknefT 2S2cw+zwfth5BBB6+wO8c/9rCq3fffd3+npepiDuCVLUeZdNcogA+bxmliC0u96mUNb2WNtJssw6 +VYxzqAgbiw29Uh+SksgjwQF90XdHRHapJ1RsK3QnI7mm00YdrmQ6uQFPCmorMPUUgwer6I2p5YB jwSQWQAr14ea0ypNatdNvjjcYZvQyr0cazQn0SlnMjz+CMcRoct0kKDROsQNYL2Fyuvak9aJ1j2E qdG6hzDY6Wg9RzFE8dRuJdwgUdvRbiThXB1OvgNqE+1UiZjmIfGAKtT+LQxiWzETp4dn63zUvTRy ROYgdrS2latGbsNxgpEcSVL/viaXo0LHmJWya1WV07BWVbzf6U7tlhHkDPhOw7Eql2ZV5sWNMeqP kgyggFl2ojkEh1vr3qiYP62+2vMw7Loj/2uK2ut/9AFoHWe66fAS8Das4RKa8xBNYS6aZJl1eByQ plBuBhVHeRTG/gmUWMSGtLIhedtZC7+D3XdIxNa6d1SLvAmno+cJzMfo8cfeUc5VnKou+hNPOs3o +yAQxUgATIeSyK21X/2fJXZXcjvSt4YruXe+TVVhodYXYzV5wmsG+BM++StkR7ROktbrKg2G1vMk zOkrU6L1170T1pYWK62L0QR0tJ4iPoTr9aRSebBq4eJVeYQdoFUaCnRVyk4eMPJ7o/Wa6rhnJhDW FBJROc1djvu5ys4cuJoVh27GqoePpCPorlj93Kmqalt4v3mdiFULKGxNovrsGXesRQb/Gx93287z 6bx+nd8WnQ26s68C4OuDD8PwaYBfJBmqm+Obt5xcI267TlhC3sm4TIQoBFi0yepKm6umVrF8ncCO 6pifvJo2WnNvInFyAftFPEqsmvN8cSq5T7/Lx1uNNHCRSZFkKLyo6pUSW2VssSAWVIPg9eK0hfGh mTK/6EbtVAt2Gt9sdfJnMYW8GkSBv+ngQAYGhMUgO3OIe4zTI4H0+b1SztbnlwdMtJ6vTOHrerYO oZPGP9Cg36RK2TJyqmRhhahVzbCwOuYRCiKMhY7Qo688tbUIbocwDJ/RH2PtNNTJ6Ea8Y4o2PS7Q yQ7WkpAH20vNYxYwz980o1V+w/FqAEgvHXuOxQwIVcH77m1pxnjAqp1VV7eayO/tZllIKjPl5I69 ZD9LkRbpl3g5GwNevoD/6OMcr2/9m1JIfAQY4Wx954aRJnxn66Pr4XQ9x8k4jKSumbbSpnU4XqNq o/zGSmov1TGXSiTNySVg12GqAG2blMg9QpTBpqqPJCNQgRc1d1FWQmu7sG3F6DOkVqVtgFVRiIUK qifNz4n9o4CpiinSe4Qj8A6dGzagGXQEpnHjkwR/bMT3qNAf5FXP1usqzVoyWvdJGJ9b92ydr0xD 60bosrn8bmCe8FxAj3I3xAogN4V/w8gVdLUpakTNKrQX8lR1tTQMleuAmhGqf0sb3GltAQ4m59KG Dnr4ui3Qkprlhe6DAY1xHvkcLdROncgqeejwKkWuCld9WNVcFab5wdqqtsXIJ5vTSbq7JcKDwP0T ZYuQ6V13PHP86ZDbhpxDGF4Rs7qLsp1WwfximY0Tnhjko8AqrXd+Wmx3ssJxlUTEaeWdL0XBqrDT OV7Uk+h3DiCf3Vscbgy7sDbAIrlbxqropNZeoo9ZqmJcHB8ir5LgeAhIQ7C3z1obOwrJZ7Bw7uzP cvPouqgeWuVVnNSWkC5Xd+pxGS56xA5/xPHcl70FZg+t7xzCGK37BkdDdWidh9brIUwXrVMMoUOR XZJ2Iwz5ClKbIsxbdSKXfCu5j1VIatuYCqBWO3K6+jZptL6fHGj5pU4GmFGWxBsubF6xVeQ1td24 RBPI40DFEQrqDuz4qGpG7QQufnVZSZOGXfGCqdJwR23VSNWvuNq/FE7wHmu5wM7OzuB0mhTdwDWn I462d8JqGJ+AfeT9VSqvQh6h4RHJsw/ScLIPreMGqwvHuN7qXq7OpRJy4VpmSVlOXu/qosropRZJ 8DhQp+W6rNtRZ1XSeZUuKuBKKSZZjLAr0ottL+SLV/OAFHqleXUMhWbwor4KnXA0lR4BDJe3H/1B 0tIUXGOfDc5MzRaGGYk/Gpx7X9QUdnkYA+OPvvXFvvQR1iYIqF+ZJjhw4cFxHML4JIzROvnT3vrx /EU1hEjYfuRrUjlUQpdAQ8oyafIA+Vfm7YQWR4KOmq1W21YSr5i2SedpvRt0Z9Gcoa8MvorVISe1 uZlAjLTFsSw7au3rCnl26WXb2vvxrsOqWx0dN9VZ6Cx3xU55tRjKq7WrQhQi7wB8Stc7z5izcw7+ tqhyOpiGR37QxC7lF0nMC2wuoXs58bNeHZgV1eVjMRLA6lLRCLVJdBeaUzg60CmkbUBndnS1Smjl aqytggNQCw6owtgB1IS32WtVDh4vRIn2V3OEY2qmHvUtt932NP68tHYxW1sc0GB2ikXbXmi1zOyp o2ahvez3jqd+K3wNi8HsW0/Nst6ozVemHa1z6sJKgxahTk9gCNL3j9TRlGeh40rZYOWpxbGKqzJV FpOjWZVDzSqkiKtg84AUVfOKyPdo3Q1QtwGYlcEoMyWOtXfsVUJXeJqSZR3YlrnBGrVOZECd14cI rzLmGA7bexbfFZxZ7WhVWI1fT4/Vzlkc0gxgEEz/zQ//6EjKkfAQJInVE8lB8MAd37z6OaAGWZgl WsclPIljq9eSNSPoiqtNOuG4wjuFneLI8jvK8Q2drWVfdXJFHdGHfwFz1RR3h6/b9lyLxKOAAyFZ 8JY8zsST1rBsfHBN2GG/owOh3/9Tv/zaV77ev6W1FfmYtNzJFZI7vNGZ5cvZPd393fvfDrND3Dvr kFq/MuVb00rrHNBL61AnCbxz8CLtVvLtsJRaaRqJRfnaPMIK0nbUoapSeRg8wLbmDAKA3LRO6y73 yi8VM8SmHTZPVZQBGCF3IgO6eb2ZxXpRl+q3o+YUA1atMap1F6mT28lqky0hHWlqv8et5pGPvCmt 8xrF+rhLpV0YnBdyHXyspaN7XgPp54AYDIgmEl8Lg5O65xCJOzJlFW2xZK4xK61b1U5HV2urCGPk CmA0oqTmc3cLEVMMKY89VjoGd8XRVJXEbED6ip26GGah8fLkHm6PSTaPnA3Fzw6k2u9/0Yv5/8J1 HxYSoDbT18DygFN8Y7ozXNSSpqc821vSHvXke+577YOs0tUl5HKC6aB1z9aldc/WpXX4kQT/QqmV 1mmFhESVtUgEki84EkFyQHDUIqlATQ2aKyHXMYFCWVvM8ALIKwihb9K64+h8JI8QIDsD4G7zCkLo ClGoTdqEXZzUynRuPDvtNnA86cBBtdBfQGfnoSte+eYRl45Qf65rBLEDiKmOJR1GOZ0cI/s/O+Kx Fv6kNFx8EPzKi/7h2f81ZZe+5Ae+W/cq0XgVo8TlRB6CiCQXXtdVhAFOUF2WqaoAKtkq7rTtnLHY dtDCldqciwrX8lGBhnHJYaEYYO04XOmuVnWtYrk6D87GB1tsm335+A6Gx+//wR+CWVgPPNHEg6p1 e2anZ0fUecm10Dut6vW2mZ3GBE7nYZh2L5mOYnjBwP4qhf74crXSumfr0DrnLfgJgUKpSfJmSFZ5 R+gRotwRtw3V72pThdx7iX11OVWdBCerxFtmzeVxc+9w5JvReubAdZDcGSXv6LsWg6MsyHRiLTOa JZ4uRhAysqorjvqXksSTrtXIj5F0mlvFql8x+l1xVYLwhlzp2Fd12C2dTW6P7M96vD4GRDzj2F4k cO5Xox3d8/oB7gdnW/FnGv4iCT+rY8H6z6ICtD1vULkU69VVzVE+Tv0ooRWcUulptFNrdWbUiaR6 q/FUBdAjF9vl1kpw5pFkZJTbttamVcxSG2GsAdI2FxKHATsJxmAvQ+tOurdnA/aT/SWki83ZyUUe rwJoq/IUpzdCN6nwfff/3PjruSxX6M9onW9NidO/7Vc/EVrn4EUOlaZXc/i0crTUnNwm6pArl+jF EQJqqjcDNY27eRwTQI6yuXLyyt1gRticS6hbzAsn72l9dZNIxwxuo+BlasPdHUAhkiinYZuMZROy DsQIV9M+H+032WmbqrqHI8QseOuulk4dE4td2+isgs54bRv9VaG1x4l+xwimJAJzLQfTBW3h33HD ZA2xdHisZfWgPDojwCD/a3r2sXcDPRghLgVkiAR1/bjGkEcYNmnCKdxL8xBxJ49CQDQjCdipUufk ybLmlbvwqJ3BdNvAEy6z86cWVcCCo6FyRqbTjJMBo3GqYlOgERxz/QtaPn0uB4wJTWsBTAHvdMu8 847+9N7UlocjItwBeGLSSXMkGJny6TWx1+7mRb6869Eew+ZxAEIkKudgnb/OgNZN9UkYmVdurXmV i5MDTOjbJFReLShEcwzAoWw0+RgBqDlFkzxOW64oCR73AnOZXVGi99p7Wl8daOayDWuZ1BB3B9BR IqhNsutWu7ge4VmmO6twtvd9ijzb/KFQuJpLYQFcyrBAT52cqu7npllM2UJ+cXqpJx15aIFD+dWb QbUvreMhXsVJx3BkUtaYSwuADkTJyMw54JFfYhNyOXS0oASysIsAizcwn0l88rMza6fkOENeKXgU qtxZoGhbAXm1MzbRrPNu7YV8YnaHVNaue7ni7Hd65AL5LVtYlRMSvqRBboKR6zJrHpahEOtVq6on UQv/NE6HhWR86ejanb/wi7+UHrM4BTCjX5k+/iU/G1r/L375fT7gCA+iEC4GVFyrRhxlqsYklVdC l8EhcfxJ4v+1kXfBOBtBgjav+yJ4BN0IrNM6+8SZcCFmApzOjsprEQUXgbn6dddpFrngUnm3w7vi cVNs9QQOXmmVnLWDcqczSjqF6yw+FPbdYHWbBcMO9EgaDy6znlhGfHHKV6BnQ++64FipRHMcxVQ7 VUHMKQ3Hshk0HWO64yFVLqE5XxiZ5Uri/0BI3/SYL3valz4TQEOEXpS5lsHpQiCVdMKx2FFPp1DN 0m9d6iNGgr791oZ2sepP7d0B0cKFwVkGBN+q/XRUlfU/aujglZoNTFu1bmckbB8lbB8BRsA8d1hv 88wyZzIsJLtz0zVqLu7R0C50w1zJ7MPC7zZsXS9vokeNTvlb85EBXUgwprQOj+crU6J1TtuJ4qVd CTp5GDwgXC991yOUhOQds9MEBicPmwvITThGk9A3AyXGbQG+ZV+kKpKzYJ3WuyFm+EjMn6niCGuV +jVn9LNQnN15/i5OcO03XBZAbXBAbbKDL6uvqbOttm4tXcMttR2HacKg7SiMVWMvnRtjEyTdDmd7 K8GabxHYomDkHNR8+OWvObvIqsI/ftPPtW9Nd/88z2iddYIn3UV13uI/y8wcIK2/6hHXfukrvuo3 HvMVb/yS/5B037Uv/aYv+CK5PgPS2WFxIunoJsYBR1LXXMdsWHG4HlDNzhtk2BFVzuzUJh3uHKC2 SqqdrYbRx2FSY9IlUJsl5SmJbHmruBzeBFfnGsx0O4MMb9348a0Kc2uxFmeSlOgPwsrsPCaf+KNb V9I6JM7ZOgfrpBazv/GDldbDyJW+R4waVBtOB6gT4obHDca5YYg7BoedTQxL/KyUHaFj2BWrZjfI Y3GP1rP+nNqOwcdiXQGZ8kboyz2/W0w3qpi9isGwwAjsriofd2BsNUouy8Jd7zo8mh3VOp1caTQ7 hcgrqLwmrpSBTRIHJjX46lYPy464m18Ynf0KtDYkuudQvju1rysY/PpXvRKXRg+r/2DWVcuXj+Rg Viz0DZX/9hc/1vThL3+C/A7Xf88jHkmqFC+x1gvvuqhFu6uSy+JsqDTcscl1RQ0QyuvkXbE2Cd7p 5aRjUFzukVSxi82xYEICYKkLUkR4+xNuD71mxvlRMd+m1K9JwuMBdOFVmHdXmioAKcxOj2Jynqpc XYTQuj9HgtaJ1v3K9Fvf+mGehHn1+/4EooSsYWcJOqG3RasqmyOXxCVuLHOsnxMVALX0mEhcEid3 eZvLzuYJybP+AzKAlwLp6AKtM1KZZqjBce9mkYncSW2sl/t5CD2rOQbTyw0HldEqXu3IXU1Vp7nP sBmZ2EzzIww7Ko+tYrlWBTuM6nTOxHgs7IPY7NSQk/izpP1zcM7Ked3uqs7WcqQJRzerm9AmrPjn v+CF0nrnXiV6HXbFuvOVQOvwOGz+p4/+jz726K8gCRCG34nfv/dxX5lTGgYtzB6AtYq78emK1YFa VTdUxdkRKts8CtUaODR3wfJF0l+tsm2tGnHty9p5SBcep+h+F9QiOIkrIlRfZSU+89V5tMeaz/0u V1SrwCZ0Gph6ZP0H25anHscTdpYTDAvzGq3f85YPweyk9k6Y5RDGcxi5G2yRXGZPJA6Dk1794EdJ vPmdWwJFQ/KRxOXx0HcA/qyOz47cHVFzrXV2wuYxdYHWV9dxaHqHzevEq5/5BtwENnd2d/LKdxWn yaowtYDLBuOjwVES+53xHc00OaKDclUDhxnrTovNTkhx5181XG1wOk+j7wT1dVG2ZbdG63WZsnB5 eQDxHc846g8+x7EsUdZVu7rl8Nr1RpHz9NA6hC6nC5JD+tA94fyvfuFjSAby3/Xov8EtwVieXryv pDuHiCKEAjZHh37p1NqKm2OTphZiJ3KbdMXYF6SocpfHpoDuOknVr1Wdpm47gMlpC24EuuQNPPI5 idUoirkEjf/k/a/t5toin8z8x6usveoYdmqxYgdQCXimkYXoJXdOY1TghB2G7RyQ1vk96jPufXuj 9bd8iID99nd8BEDEzapjscHpJs9MJGtYm+g7OVROsf2Vx/s+gE0SDWVYcuy4gJW0Rb57xliV04RW FXcXYhX3G41TJPnhwColsXyB1rtxd8TPsnkUnHjyJKbclVFnS0zVKIwk2xhJcGWoaF4P6MhUU10v qzpdp10Tii7BTm0sdg07hVobfMSfzs7BYjf7tGK7EozXA5PV9fqGO76lPuTerciuiAVeIbDzRSvf xNb3rVfnw00IGyFOjCC5iJEbrRukh8c7YBQvsxvFkz9w7cs5oiGQz1k8Y441cldg7b16BU7vkY8S qyJ3/acohYXIAprxJYyN8Q6MCqMkdrqqOOC6opjxBJNYyR2bN1PLPZWrcJQYKM7WuGevrhDeRZEF fPKkEHq8EqzmCGf51FAf5vzanby0YOUI6IMfRnjPK95z1yvf+4O/8vtE2T/04MdI0DqULY97ikKR BHFL5ZC7tVInvA9vwqpcndwaMmV5S6muc+UKyR2NCFcHx4ZbucbtGown3FTwytvMa37td5HY1l50 7wKtM+Ld3m7zuhyqhL63QJQBJNdHFkFACN2VhJxUZ13J2Tx0H5AmsRaQqtpphKNaqipIRwf1bavy wSYH1eLVvn5qRxALAV5dXQC0QrhFwVmjH3nDz5/97WhWLa1Qrn+xFDvogDlY583A+YMk/cnIx1sB ywzgegOwtI7QOiwfZhcQvxO8Q+4E71I85E78zkENBukdN05jOEQkWVRZ252fzcmJnaMQkCqbeEVN WFjPKnPuLpqqwuBataNZb1F4YuRbB9NozC3s8CKxmL4YEAaHxECRXn3rE1kJdTYz6XwHzkMydWnF SAXVeeQWqzAeWktRzzXCi2jSo2sJBoTWX/gzHyBg56WPEjcHKWByT8ZzPi6PJxKHJb0WQYqrF1j7 PYv3LcjLkDXhFM4kSeWwOcB7DzcqblcwOxL0aYiTANJM6454P9nTMXobu93z9NQ6/cnbIlgCDYR1 /h46vLX/7TE784gDVXnf7Kq12hwF1l/UuqrIA1A4q6+RqmZz5Ue6SHcdyDJgVXAYwp7cX6nEaLwA hK9P99WUUyYrAABAAElEQVRSy31i69W+LGW+p4XZ+SVLPYTBQ70yz3IK0SBhKGAoiBhe7sLzg0Uo 3vOZBPIe0XBK0yh+epxGOu5IOeu8G0mL8TZFmiN0g2S0AaMdJFXemVrtLr3s1IZhVw3iHuuHBGWD 5W4u3+Q3z4yJyYMs74g8gASzZ6Ir4IUQ4ybK9Qbgs7jLKUZywsvBgFfKy8Xg6HQKe1LkCUt+iQqt Q38coZD4XgdylC5Zb1BhpWxambCDnDwsbDHyFFUwjzBuBNQquRuJXAyAi3EJguaDQv0AwWERJG7i 04YfOMz9noCvCrhv8REETeTkpEbrmeOANrhLuB3WHgE6pMgtpqFGHPHkrJKRiaitNFSnv+IYiTCt AqJTAfunFoNxBmyucEtztTadjiBdVBC1KtzHNBmHa8vOlvxsFyqkeZYB40zq/iypLnSXLAuav8jg gfR6XJPVPAIO4rsXr592zvQSMRQIsniPI45lrsEjA7LYkLdFON015SDi7oM83qnB5kiM381hKxOE xSlNyB2CY7jorrrkMFY/IxGg7wJrhF4CnfkqlhgoPB7jnZ2tYhqOCrW71KKPSy0tcbcMTs4FcrEw ODmJzy5cPo8YkfuBhmHxI443QnOI3ph9nHS/OGU2s7q6q5O1UxsSx9vgE6FPY+W859IYVU57spbw ge9ReUjmvpe/FX6HNGFPEzqqVeXRZySjwihBDbNprkIkAnk8JI6w8jhszv2GIyCS3F1zKJu/VyU2 9yvf9iXB9FQPj/TwvGZ7vGeSoEOiIXkfrTuszDSD1UbtWJyOmvrJs3SQBAsqddJRV7tVZEGEd7Z0 zspjISBN4lXlEWtH5bQ6C2J2RzM91o7AI6GPRmqTsRZJFCrYtxx/aM564Ejk7H9fEAG1Jx3f91tZ 3DuAdY/y6tkOFgjkuT2wyjlhx2cXJC4JwgWNwqavKxlhV127WKL1L/giGKfj69WiJL5V1dVS5G7h g/BQWyieHjNc8c01b+4KJ7eIk4AIKe6kNPHSomnzFDuQVrXTTgdXGVtynG8k/pgvC33D4LAzV8ow mntj4/Ll8W5k6gCiA+m/9mv/s/GjG9PNN+FZhNWfNpXldwM7mFYyuznLmIslh380yMu/ErCzzAgO +CKXtQSuicVJMTmgY+Gd1dtVaacTWkxIjnGSnw8Sj9cAHOyxPqQ8c/e7/gw2h7hhbRO/ohJA5ejk R7PqQ+XtO4N3/RmAfKb1uiLbSB07T48mwGTDrCeEDneAxf11qc5+vro+uiZHdLomB4s31vIR6tex 6+l3pPJqDSxvmtdxYOezPcaFWxc0mOfbjv8Z3hat8+Mmon5OdbhPEK3L5ubVJXa1RdcVea4OkjpI 65WPRix5hcIANcFf9OIRjV+0ekBB74ykdEleR7j6D3aPrG6EbrN0xXYbWy6/s4mmG7maxQeSAbi5 pyjJIXGvhZzrMuViKQYLdsYKBUfm15/8n3/6TW9mzWSRuEJwOAsMV7kQirmcrpgqFcgrsDj/Lml5 nh37vCcuHA2TspDoWjdqnvWsMMUjoDaxrzC48bjHKebweD1UgbghcWNqKFgWlpphbU5UnvKG3+Ml NoCvfvMfQOXkkjs8fuc7/9zwXE7nb/z8Jz9BitTe4iibu4DISRD0flJH5R5Pd9G65sbVVmtvLN7Z S3Q0cqj6+63i4aoavBNaQXNVRwtdVVdMLx0Y1TpJV+yaX2eRq+O8++wBiz88WY3Bx63S3v44HMKy W+io0fpffIrueOu6nrs4wXhC7loCsOrI5cdgmAtmIa4c2edqEqiqaxiak8JgQxKBLXEuXIkDJrxl XnAPh+sExX+cv2yS11ZbSeXkLS23Fj3xRIUc94zE/diB2//8cU/iKhyxXNcW6MahFm2CRMANj2Mr FkNlQM5h8DyzCcjlALoimtYyXIIL+TT1jXzgevlq+e6KaIDwvFtycSNABYudsFZ1djoSp7aG4TK4 obfRdw3D+ZKWgNqYGh6HxGFtEgxuaoReEoQeHkdfKjdHnsTzmhihqDVa8dKbOVrPQpnH6Byn13Ce JhYBfiI+WfMIrOSpCqgrPsLPLdClONYVj/vWWTjY8FLdjXep1V7iyWpthG65bDzkMim/SxpP2LsV T5EYnIB9lI8SHobhifjuVsHu4nlKnpUESOv+OhEf4pKcyErDN/hLQE7izoqE8wRIqjLOzcEeUEBn HtHMD9IsLy2Q4nF+HOEMvpdmjhAgkYG7VtEEVP3cURgEEj7kRAXHPFHxEDwsHCIeQSX3I2OIvmoA poD7xz+767n1Bw38xIFzmFxvQL1SLpmL9cIjtzjn00SDTUx6XiQg+dCcgH1cckpWGXxLGblhOK0k dA7E5XEZnAMfInEY3ARxm6Tv5C0Ynx6ZJ+4Ocd/20x8yMCc3MAdI0DC1ZC2Jh9PlbnOaYIEEMN36 9v8x4AKtuz3aDjlM62kCaMMqgy9nL85cXXl1LoOPgy162pKPluWpS1GnRmo8Pprt6LUrjvqdpHp1 pLuueVfUWiekGPnx4XLuaMhPw3m/x/6uYN/yS3E+9m7tkzT3mcie1qffrPrgjbROv+xS3Y7zXAj0 Te4gu/D8WUqj9elsPRRzhI/O6mjtrE0USDAaITCBsEc0sBvJEw8PasjDvwDm4mCqrcDaiU27sDsY nN79GEGOSzgGoVdO11skXD7YPKAKa1XkgCRN2VYFzHqHq68M8okpbtVZmSFuJFJHBVGbWWWJDkMy AHZl46tyPMCCGX+alIW3tTKVRw0AfedbzZyiQN/hbjHczZeZJKJvY3DPUgjA4eiZxB/4nQDkM55I 3BBbNofEoWyjeHIwCX6HrG3C64XhcXIkNEGfHjl78TCHP9oW8Cr5E60zOm1Mj3F6wnP0SY3Qlw9E mYwKmICQe5Xv47qT9zWP1GptlXAjPM53tccrtLrypV2hL1yluymuOT1kWf0fcSYrtI4FYvbVn2hn q7AZ+H71yAk7X6m1h2Eu3gBoSLTuMQ6bilcI0Cm7FPfMvXa4u623JYAQt3VrtL5B6yGdkNFxUNtW PFqgNkkaDbdyKAHbEssbRBvO80WlBE1w3YA5jxISbk/s38CEBfWLTSz4ycATlVA5/cLjpjgTIO0m 9xKojUQ8ypVUeSeJEfvCAdz7zef9/Rqw86QKtJ7VlUl0BVqsOBLmF3n0AZXQG/lMybY8Gnv22yAW rSQug5MTSZA4EOcMBx4nEifB3Ryk8HAkxC2Dh8d5rJAYnJxXEZg4E5d25d/QtywMocva0LHcLXFL 0PL7TPqvf0drO1nDoFW0qgwOd/sXrPxdXxKPNoLnBxzncVyGpgvV24bZCN6tqgOqqS7PLCKvmOLV SKraP8uPKIS1a8ODuPMwxYBqZxSOkqovHnVGydjqoGR/fOxovzu5VWLl9dlsGPdD2LwCjlA4H+/4 WoXaSlqvB/HU8q4YztyJ6dxyPOnso+t0vephI/QlFmlLcaJ1iA9CqYxzQ3AlOwzKXJ3l8JoKNVc/ OR6CZV6i2rPJe4P6aauF2ATEn2BrI9elTqhymlTlDu/oaLPLcbt7kj0vdKyr10lUEh6PQiTzXC+3 c+SSe2OnJVqPqe5JR1aUpyjkJLibBGtD2eSwNvRNXlONwX2CkCMUGBbmbeRLAD4leZzcJJWHiCVu w2qo3OOUsLlnJjYExwKH41iwFTE49C1f86Ya/3M1OXL5PSwvuKWNzkLogI7BI1Gn1tZWNXrKfFwP kESwEDBaWyUshatV1QI0wVKIZJU1Op0oj2DsbsugbVdrU1Udi3DsNJL0Xs1WHM0ta7XHWEsrp4Cc hFm+ksoPlCpTy93sGc5h+DHRWKWCObTePRCJ/vc99ekc49iQnB8ldb81xSXv0Kw9YnZyJDXHPYJc iE/+6ljpasVVLgt/xaaSWgTbNlW1qNDcuD45QnCXV/2K7UWJvYM7N+JJVahqozy1gq3i2FCJObTO Z4h6DsP36nd+87e7tIzwTqw98TVrrJOofBIuky6VI5/BRGJZyfyolYibxVYPUjw2kbthbX5rSiLc FpODSby51zTT9+vfMQfRU/icGBwgfZt7bEIOHSfB4NSSG56nLQze8BSVQ+LQPYnPAZyiyMvyeOgb QFJI3rF5ZfaF1hdOr5R9BFdad+iP513MnoYjp6RKMCocjMR3aK7rYrW42nxVODY/q7ajsFNFR/u1 nScHlSVx2jpH3UxRyxQQs4fZK1mLicE5ihmfXK6a6EDi1Qivgrn7KU/Nk+/Q+tve/ED9Mw0vJ4Ru qE5RYK1n69J65ZewUhXeENxZphhJsJLkFaiTHJdqbVdMlfJa9Fq0U1sFB1SdiqOwCiK0U4pKLGon 1qwlZyI4h/kf7n1pnXo+hHEOk40ML3drjKlEmHUooVcdJr1R+RSPwlQWZzAVteDHSoNxqPy+1z4o j0vfLQB/y4cqg3OQQgDOK3zJOUUhN3xuGAp+QwvSPU4x3DaHr6Vy8sglepRplRgcbBiOmpE4JG4w LmsTjCceh7jB8ngIHTAyOBKNkAuQ3HKWwduoDYcwCJPavprutNl4gjHPVFF1kGVGI0q2miNnymtt xV2/+1W583c+dK262hTPqo0K3qJGeWzeWJCOArLZ6kzZqRI00SGX2Y2ss2lTJOjmKCbPmUUeTc5b 66PrKPBsTIvfy2k7pO9fpsU9PBmD9KxD/Uy0HuoJy1wZhLxioUoq7jqtVTuYqpowonK1VptHnlZp koZVv+JoViMKq1q1A04xrSpIbdUUc770W3c/34M1Zz8/N2W+JOuwR4BTSbGuQ2uZbmrBgEbuU17J 3ds8Oe8M4KSFCB1+JydJ6LCzDO4pCqxtktCbcCLxROLha7hY4uaMu4vHUQ6J01z2R8gXnhzd1Ehc ppbBay6zw8gqrNJ3JwybRx7JFWndcaw7yuF2PswlqSq5Gq5Tu2MhlLSjs1UFcWyROE32a6tNCWhf X53a6iBOwxHEQqqUbI0JalvX62jX4CjGsUYrbWKBh9VquN1xN7TOl6LE4G7mrhZar9E6X1X9/a9/ HO//Cu8DuCv4/oAsADjdnezWdcnVvHm1cQgT6pGPrjOPtQAMiiPpQFes+rUhOMXgeJuqUdJV1aI4 PQo6YdXXeJVs4biRJmhGGeA5DLf5zCwfwvhY1i1UpjgkLpDEWXtdsUkmZs9zjRRXE784JUiHzT11 IVTnxVhf+93/9LH/4G233vue/+DFv/E3XvIbEro8Dt2HygWSOAweORKwOdwtlc9H4dNP+ROGS7UJ t/mPDpNUDokDKpWHmgNoGzyCMLhV9/7bzyCJcJ3WM0zzbXA7WneDZecHOPQpngWrBJT9bPNVHaq2 5Gc7RUGm6DR3WG+1qlujnbXWy/D3p53OlsKWvGu+X4yRgH391EruleKZEYxUZs+xSfatwGOW+qbG qvDZB/9FjdZR5ibRmeKWkF8kxSXXVXKXX8unz4v4FlrvGOeGFyUvzIbFQm2dsNNM7Y5+1yTFtK2d 1tpOYato16lNMZJVm6mtoLYd5ZzD8Mwlb+TPff0z//pt3PJZSHXbhsTld6bbvW/ez/7yran3ePJG UxyyX3wdPJKvuuNHeMkX+TOf81Lfuk5ILq0bqnuuIn2Hr8PpAkgfNWNwqdxg3FbPf/8f5ywFhoWp /T+8GokHUyvRkwtGvq4SyJomSACRy90pVkIX02SF1tkzDFAIPUWFyhGaHHGwIJ+RMxOCOj11OqPW Mc6qTpSvAGI/YNUItaySsWq11apwbLsqSduxx1R1Dbfkndqliowz15vRZppC5XXKFEaCPokiLhFQ Vzp295pD1u0pxvKy1uxtovX2y6Pp3ZAIUSOCS2jvDYAQHuN2Gg+5OhcbeWL2LD9qQ+shpsqAHQdd uVhtjjhmOx/CeshrUl4lO1jjKsRgBcHoRDnCVYma0d/R6eyouZND690D7Ex39zbHOn1wsTMu0dfc hZ3Zpwo809R0GjMXkbfvUe8m51+TnnX/m77623/xUU9+6Zd/w48TqkPrcDRH6tC0rG2QbsDe5SFx DlIShsuqUCcpfF2BVcnl38rFW4QenQDaBgcotEhuitBiT+sOTRh8FaiTTXUpHhmV644da3ckB2lu xz43oR37Vh3spbPTtUrxSI9jvzRfvdmk03qNFUdhH3TGQ9+0Co5ZAXIAOV9/8QUpBB3KTlSOxAcZ 83zLqeqPPk60Lq3D5i/8mq8bf8XKQzXQerrDGZccgBVohA6wKGCg6gOOHU/tsM8NrOoosvpQcXpE ODZRWPOqHyywOXi0E2GadMqRB+wYOdu2GkHZxFM9fHH6T+54dm7/0Dorh8nK6mISSRalciU1j1zQ WChsbsC+xJpyOrWA577sLRzCwOzQ+hfe8cCXftubT2foHqMvzynK6bK8j6bk1z1wNFwMd4fKE5KH vg3AzaVycxRqMRj+TRVYeTg6ah2IJnKwUbytat7T+haPM4gmb4/ixOYUMwHst+Cz4CxhjRbY57Sq 8hQDqK24KoupDZdtObxvYbQ5Wt7SuR5555WsF4P1ulJVm3hfGS9Z5TTBINht1h3CpC9rybHPEQqx +cjs8Lhfn3bMDpXnEIaXwBCq0zykLyBa5xAG+9UrVlq36urao4ofW/okTDhIrumKIaCrAa2N+Za1 9B7QacZUVQCnGAUbrhY7m5ctpq/LNlzVx5oJWveEnUdiXCH+WRLT6h6EppnlmazrwxcTtspFGEJn ETLvoXWwRdiJtQ2bN2afFPzFKY/BQOgk+J2cg3US5zCQOIkvRcPj0KXUXAPwkHiYHR1IuculYIQd F3dF2bwStApKRnlqQ+JIolwB2HSi9TYK517c6PAlZwTB2ecdqGxiVd2fFXcNt4ppEkbe0uzk1RNw mnfsVtU6CxSr8r5mbSuNVklwNRjhjQWjn2On2V10zRbSgYD4E0kFtqUXEhRcn2OpHE0knp+PKvdJ GB+V4ctSfohUH5ZQB+r3ECbzjjOuPa4CIL+L3fC4UaN16ObGUtUqf20Jz3atQtQCqtudzlZfkVcj o52oHQGdqTTZkkchQE2fx/enSb7W8V1vvNdHV7OWmFmIm0mUvit2ZtvUL0fqYpmHnO0c4kJnxo3Z 20OQ/BmezzhC6Mbpfl/KCTtUDgX756WVxMWQL+B1n/lLQBJ8Cq5sLud2OTqdxGIoOLWehsvXVUds v7SqClRpRx0tyOapmmm9jc42p1MbBTF5207l1spYh8JGNqGWVGdRydn8Ck3O2uwU4nbkW/5HYQek 7WiWVqldtVD5qyrvt1o1tSPsZm1HU3+cAvdblBWSk3DPHGZP0F0jdyibFwO0X58uL2TPA45UtSdq ptd71TsBoTr/uNQ9t86qk8pxA1xzb9XUhtaPs09o6CDQcux3IMVY6/SRR6dWgU1RqLVaq5ItXDVj qhNaPJLbS2fnsg1h9g884es4ZOdV7HzXwm2eF1FkVbMgWT9Zlhaz0gCyvBLVMvtG5RQbiS8nCjOY DtmhKZ+EaQfr3/1PjdDld35iShjOy7xIMDg/XCKHssPa4VZBSLNj566ocng2xRjRjgpdW4u5i3Rs PhbTPNYEJ1p3LCT3OkBITAhTm91VR/96cOa4o7brsXn9beNVwGhTh3cUbIKC1LNlYZSPktVeDgq7 20xoemzOFbHNau9RrlXoUOSiHAHzFrMv3F1pGpaH1sPs0Dpfk3K2ziZvX6uWx9W9H/zYC56HKWi9 euKyNDzHPYriDCyvVeFNKfUQJqx0hIk+Jzp4aOp6vwme73SxU9X5uVWsFyUm56kY/j7pGx93G7Se RVU53VU3c/cUvIflLxD69H2pa4DZPxHUgptkInpWCCcwBOw8CQOb88Q6py6QO4A43dMVCb1yesLk ysXSsZLwaRVW2o1CBXJumnRFLYfTAUjMrRr1lSTXMsVG6/L1aWgWHrcqbJ5i3UvU1v3fccdIGVX5 +rFUMtrZkqsZrzpvRzv7kq1esB+iwQK91GK1uWWhtbr4/UFtFTw2X23V+WPzVc1YFrDxwqoBVInp neuqGAnFrX9TIgDnq9H21pe/+BQ8ztk6jz9y/DKG6tTC6fzjMAejtV9GkvVmCrnjT8PTB0cuKtE6 dHP93FQ5q1oTjxL1x9oqj2O1eRUij4VgLRzJY3YH7NhJq+hEMoLojEDl2gTMUQzMzt3X5efkOnfM I+sNLN3XeY+CQM4BZzE0ML1FoLIZQpmd3yXx9Po9r3iPDzXyAEz7dvSB3yFaJ05PkN4RaCgypBlQ q8TJAbWWJqnq8FishA72/CcGAd1tQ3+67hSeovWMSBuONa6vg+i2v3I+8tGqqaq2hWlYGSpqq8LV XiKsTXaE6SI6lwWrHcXIai3C7t4wSmJhH4w3s9qjm8q8s1Mv3F1HHoAyCurw69DVmD0PxkDxfE1K 1JZ3eyW051iGoJ4XwqDja2GwjIcuP3DWoVhOd3BQg9YroYRWRt65aZKzPpxV0NVRLZKAm3ZRRzqK VwATpzG8/Iu3UWapMIkmKZvlNHP3xVBdxm8zXk7YZW1y+ErKCnfNYOL6Rz35Hjid3yJ5AmO0DrPz 0hhPYIjZoVGPX6TRSqYSZThUeo1QVh1bRY6meARVDsYHPjGQBNA6QqncPBaQmyKPP4ILtN6xuYOV 8arbKZMBYF/V4mVxyEKQ4mXtHNGv/IX+jued5mg8CgGjTpUcVKtNwGOrUWKTyAPG5iOhd91RlKY7 +ZFJQYcNZnN88Deo9YQd4qYIs0PlJD6GE7V1r45Bgb/XeMMd3wKng3kPMG/7whlZ2xXYeLwcslNr EYBBaB3ugHTkkSPs8/DRCQ8+fFy6Tk9C6KF1AnYOypipealMDxkbRkjZzGOiirA8wjbRhdNDR4KZ rArFK6EWwC+SnnHv20/R+vRQI4cwNVoPVwpClBTDpxFGslqrsCqPuDYES+XkNYW1O+XRWiRqrtO6 Y1HHJYMoFVJ0oG9IXpnoUgZXGyKUBQ6aOkJ2MbXaY2oriOZxf46wZ+0CfCnn0e/uZNk/VLnNIgEo 6XqkqE7V7HRoyLVwkMI3pTzQAkGTjMcBPOxIqM7GJiqHvk9x+l98igMZjtrlemmd4/XMpoRelyKY EchFYZNHpCXHEMp1EtPNb67/9Btw8324gT06EbkcvvmA2Q3Yu2WTFRU2h8cVzoS+PKMh/7AwAOQw VQMXY/aT/Nrdj771xY3Wl5e9yO8ewnikDhuGOgPClQFWpRgA/67iLX2U0wsgVG6objGcDgi2F7tT qB0lsblO6w5QhslRY+BMdTKQ1OJBLH+F+GqrUMllOW7VmpbHqlGypbkvr54HbxmPwgjGi8VI6Ex9 +CuSsHkko81Okiad/ArFzFHXNnIuB8coEpLD4Dz5AFNzLCO5k3OwzsaG38PpAB9mz1G7tG60TkdZ fgESel2B0Dpvgq2EfnOY8cq9pGHAKp/u1642efgIcb4mPkvB7HyocpHUJcSCScCOHEKvxbYGhmgd oex0IiufWC8UzwqB1tvTL6H16WydU5dE6yHEsLOSFLeAfLpVuyOPfUi8HryA66m63I0d9IO3zMaZ mdYdlAwQAxEscC8lLKp7KRNzBTpL24CR4KiKcARpeBAcd3JHM+Owo3PEn1zOvnIl9KoZN6pQ3JH4 aCGRUdrqDFtLMCqgGYc7ZaqiT1WMMD4UeSUIDz7yjkYSj77A77znizA8r3iE0z1Sby8PKfE7j8o8 +Sl/Rw9dclmHc/HanU4BvQOgdR60gDXkwR023Km6OYT4OXfg5lwmvXCluVgxzM45DK95yNpj+sLg FYfoI8wyoG2wq0ISww5FMbHFzGPX7ua59UrrvOTLBxw9WIc0TRLoFm9eSh7iFtTcXpAYmIfWQ/EA akmhcpunYYqjSzRZp/V5UJZHYhw18o4snJVVYSasA+GFTn6kyL6twan7+UjDIzqsmyNqV+i0a5Ii oF4Ovadqy5MM9UjoqQrAyKjWeimvTNi5anZU3Dg7a1HuAEXa+lsknm/hTIYnF+F0QnV+XBoGByBH zS9aDerhengf9vcqsggF9UK8CjqCKYzWZZOOuUIunfyGF8eOqqTiG971jsHPSb92mhwAp5NzVlZp 3ZXGPNb1E6IHID8Vl58ssH2yKiqPt1+ZXozWkfDjUp9u9CtTaZ1oHVonbB9ZcpR0BJrQuJMfLGKf RNc5eAmQ08PsemIxxhFWxtcZhKih0x/CzDe3hdAzOsrZYA4uo5k9f0NAGK1jkK54pK+YCthvlS6q fsU074r7BlN7vNWoGYksvErQzbHC0ekX0OlHrZPXJmCHIlsrI9Op5WYwAo2w3zRCjhESx+hwN3xN 2A6t86Rj/eESX5PyVEz39Sm0zp3As3V3b1t+F78s1TH9JFTnoz2/eZFEILgdsEN/n+9Vueo6Ap/D i8IfXSL32+wuWs8qYjbD3QprVatdCL1ihKy3E1Mtrw1oknIgwzthoHWebuRVAYTtoXXINLQugYY6 byAYLSMJp9dovbK5xG1b8q2EGq1I+U1sH607OjV3Rzmg7qKbnIfgrqdfd/4VTF22yWX1r+eiurb7 N4BOmWLdM45PCL1WjQ0PSrDpxxHJvb1694Mf9vel9blGjmXaa7+GH5pC63yh6iFMFqFAfsc+pP/m n3gSJ/i4RJEAkK/jKo+E2mSWh5rdul5qseK4EaFgtRjh2CqSzyPA5ZD4UNVF63Xt1fAczGqco8nh bD2EDmW5Nip3zRjSn7419QFHyJ1Uaf04fb/wD//dC/5N+3YUkPx4czVlZzhdLg6nh+Urs9cmoXUb ds0pYsrUaJ3vE1bGYvlymcGilpydUwc3Y438LAtsKcgmlSaQZIKrfB+Pdqo+VCu/VGHFl+LiKAdo qvrQVdW+jmOMVLcrayf6xlrFnfFUAaqpqDnU1fOuimJqc1HMpg07oKZVXU5bavmlEoctD9zxzQnV idCRVE7PCUxoHRJ3BbIIJXRXI2zOfzJ89F+9lBuG9onWoXU4TipMLpV8HnHfpVz1Mi/V5HOorLft 6fUv+KKsKJaZ3MKyEbgOXUWVdjoiomhyhcwsnyA9Z+uPfM5fedw9vDyAV/IarUPxnq3Dg/u8LIPL 5moq2W9lbc5JohxqDolL65Jy5Ws0KZorVzM5gOQPZcXJ16N1RiobScB2qgOdaVBIXok7sxVGiFok gphFQYkTGf0RxIJVXXHUv4Ik/gNW2fAKNneapLsdnSNVdTCrfpWH6FGoU6Y+g69wrKoGz+I6KZlW AG/x5bCFIxe5m2OZ1Tg9zJ5onUXIVWQP4wCD5peuPD/Dr5+oxX6l9ZCdoOY3itTSxfUY7Ix0xeux /LBqm+sCkIjWeddmVh0gSy4MEIm1oXuWAZKZzcfj9enshQXT0nTIHjbjxbzQur8yzVemMCac619h 8J8YNQzv6LtWhaYBkXvAbRV0XHWCkdc4vZI7pIwz5FVBSfi6ghA6P5QFWxSs07qDkuFwBJ0DBrcb 7jol6lw2ryxQ227J1elqKzl2VdVm8BGdKFfjCGl7BbqnVbVz1oEoy8WVnU+OTWfrXZX6lcGjD6jK dSqj0+0r3ei8rQ27qtgZAaZIMDtcTDAOfROt54tTJeRJ0joOsyBdhHUpQuvYIVrvaL1jENktwocJ 2Z31JwoBDxPPr9MNL8dova4QVl2I29UVyYVofTmHYQNmScxB+rJIekKf3vnVKP7a3Ty9zosb+dY0 tA5RwrnSesi3giOnLpXQa9tg2Ny4G8qWtStBi3cYHIWQeBgcNpfQqfUVCMnP0zpjVImAmXDbM9bZ /3V6Kg4xVeFxvNV8S14tH9FBf1QbJdXsKpbXxoajZLV5FR6kyC3K7uTdxNXaystxIMKAVOU2hoeZ 904tzqtQNbFjLTmJtzPK5gnMQ+VzID/9fCnRet3A2fzQOj9D9XWA2udzvU83VioURzKC6+Sp2jzG q/D/x90IMEqerbtBWC2ZU1ZULTKtSKQadVgJCJNL7glDkU+cPn+DeorWOZaZ/jKJv0maA/YHfgd6 5UkYOFHyDbMnSM/BSydJeB7WXgVSubnfaoLpTvoOiQdQNSa5u8ql9TA4QMYXmJ+h9Xk7Tbc7RpM0 bmn3drfDVU5eCa7iKFTg/q+S4LHtKIlyQAzuKK9WjcJRkl4CjuhEuQIahj0j76gZedg5IMoBXasd zTTpQCY68gyjkigIUuzU0jwKAB5whI5HTpfcIwcYiU97su1VrLmlASw5vlDFlGvPJ2HylWll2C3c 0c3nRbFey+eFw52T+M+TMGO0zoSyMORu10xXTFXH6XIUawMgv0/M3p5xnCXTV6b8AZ7y9gD79PIA aF1CrKQMZdfQeyR0FTpmD3cDoGlSHkoJkL63SBy5zlQGB7/3Dz5JLpUnX6VyapUDGq178ckBNTnE l8qvQCLa32IEaneqbBsiW2XVTnjWWsewXfM6GjtVqO3XVjsVb7UaBzZX3fpae9gRIbOp8aqspN6M MyZVWL3awWm7qlMNRpMvPBuzlx8fwekh9JnfpydhvNV5FV5CrjQDRRdgz9Yr8VVc+WVLXnVuOD7b 6VmF0aXapOKqWeUVV52bjD1bz4LMLX9clsxsT+jTC7zkKKP1GV+kMqoaj09JBXKZnZid0xjfCQNp wtGcqkPulazBKQaoU4sSeti8EjqWt0icqrO16oTKKYLJVzldoY/hg0+0Xvk9o8D+ydBnx1IbfCmQ TZhWkWS3p0oQhU7+UBQv1ddZZRTG0Lu2qnjr8udBuMjX44ygFqYLrtNEk+yNKMzGD7wBWM0x33e7 06/KbGOKjdlf9cqOyiu5U0U87jC2SygfwOsgeO2MZ/3KtOOp0FlAp3DDize8oxtu8IZf8nGDHsLk fh/uBkjxhuqh+yi4jLMSACQZvIGFxwNOwsLyPBUDrUOR8CAxO6QMU3sII2Ubv4PD4AHE8tHxaIV4 HFMy+D6PRw2wleRua8PpldDBkrh5V1R4OoTJ9QvIu43U7dIU69xEKKhc01WdLVbWm60NBDTqnDV7 PQpHujuiM/qw0ypjWIlstBBJVaMt80gVudMUa9HfATte7bSyqpL4qEwtOxb7MHt9M4wUH6KX1mtz LqTzKleUQxjJ5TgJHtc8S1tXM7XVakt+1o2Hv0Ki9RB3QI0/mHoJPcJ5PU9vCKCWYlIXns9xah6G 8WFHIv2J+nmn46vfN7+Y11OXkPUYttcgPbWAVSo/y+w7hC6PoyCPA6TpEahZ+V3MjQow0zpDM4/C 9EHGkWq0vrwyrW6t4BB6JAC3WTbbqgTh/ravBh86rA8dTdhdhAFbbpxVoOGOTleVYh3Ases6yOLK 5vMlLJxusZvNLftb8s6H1elbFdKwysFt+00/Q2UnU+T0nMfPQ+Uev8yHMFO0nq5ZlsGdnyxFTOUr 05HXQpEjGJUfCkn6fSiMr9q8+T2uutEJ9cqz9bownFnJPcQC/3R07xpA3ihreYNjw0Oc3iQlQld/ VpueinnW/W/yHIZonVC90nq4G6EJSZc8ftni6FU5hCtBW2uxSoKjWekbjLxKLI55H61z8UkOdLd/ sq9GEEpK1cg1VFW1itOqE3bFqHWgLpEtTJNa1VmwePZ6c1Fosm5Wjdwo4djFWfdyFfGNCa3+VJv1 Wjqd2c7FT0hnR68a6TBt45JVPMbOpmV+62lM5fcxWqdhHYGKE61LHDuktlMFB+3XdiR15eLN6eXK 7j2kDbn2ROtMaKVy40gkAMldiTnKtRimqmDkd2pnip/YvBWnEJ6jmOe+7C1wIvF1R9lSfJdbrJo0 PB6b05FsHu4egQStvNI3OMKAqlCZnYD9XLR+kRHcjTVf5dyQRTRHSaoeItA51hXp9Iik821s0ims mq06Ryyg3w2X5FUpLAoB9qIOwnn1T9OHkKXcfCtn9F3D2ulYpfHk9SoqjsJZ9keBrauau5qnFes5 u+Te0Xr1v/br/g+tr1KSNPp5RKaXdfWy+qujdHOEuOrZugvG6avkrlwJGIULbD49mOeSJp9o+vTi 9dB6kyeEPxH69D3qROso8HgMf5zE8brM3gXmKQbA6ZXcK6fLvHDumOBcOX3M5WibhJojjCQN6UWh OikqvPCVaS7eMSJvvHCO0J2M7GS2WReLpaqCfbXQQd20Nh8lKkdeQfXkLElV98Cr+hqvZpGkmK5j SknkAZ1CigGjZudPVzw1LJTdCdPEOaWY2Cea+yBeAXLVq02i2dUyWTYMUIEiSYpvzH7x2Riek8mL edUfl2V6xM7qIcwRvjui81BT3o3yodqp+KH2/6B9XTJaz9zNk7scuYTQw+ZIaqTiMiBnUbU89L0A FnkVokNzlJtw4vTU8uoUmZ1DFVnbAxnpO4Re2dyAHX1one9LO0K3WHNZu8vD1MprMThA+qaoWYB4 Kz8dwnCdDhB5tydTrNMQHLCjNupEWbClsCWnVdiqM3Xl4tjXKLmy8a2G6SJgS/OI3DHJDAo6Eq/F xL8B9FLxTqc4zD6BTPd1dmpTJa1T5DSGF/byK6Q84Pi3v35+37rKBhOOVRdY7EfrkE7luIoP8tER tVWzq8Ij1v4/qeNorD63Xic0WMCincHETvPCXk6M5WuEpPC14CSZAnY4vUnEyz0AZv+7979dWk88 Hh4fQaX1Stah8oDUyr/KV3mcKnSoIjcpqXJxTAmS28qA/UTrDgp5i+Ycu+V3utl+NwrsU5h8caP6 qna2+h3lN8GHsdMdV1epNsKAWFCSO988ocsNe9SnYZQ7IykCRp/ZUVVhB3MDUDmxWAbZQ3bts3vv vvs7P/yHfwqzf+KTnyZap3Y06yav/mA/DzhKiOHTgJtMlA9Rv6PZUXKTr/R4d7hKMlp3WrMe4O5g qsCGIAlEXMZUARCSs6JaXh706Gg95K5+lJu8fXXf3igw4buf8b1v4tmYnMbA3eP3qBI6ud+X1kOY MLgACgaEmi2Ggqty1USuTqdf7cRIhJ2E4gVa5/LkdC5+3EiRuJfqjrJqlKTJDjjSamSc1SCxmgo+ q7njW6piLSBVgCpcxVVYGwafVYhm627tvCUK1jqDmUeF5M4vyqlKw9HyOOxV+Qq4btqxeQaBP7rj XY/8h4a0nlZSufnY3Gh9/6+RjtPfcc3jjBbNHeM7VWn+eQ24QFI9W3cqmdZMdAg9wo7ZLbKGTZI7 OCQOSHFibY9fyiHMwubL7eFuvkHl2RiPViDuGqQHH6R1SVlal8Fl3rB2hMirsFOzeDZHodO5QOuO kaMMHncOG8+Aq1ZlN0ZYeafiKBwEo+Wx4aiz6qQNR+VqMA0DqK24U67FIzgsuWVzy8jqGCo013LU 0pEGncqaI6/N8Wer605zRy1VuY92ZpG7eKpcjq4S7bCx+Yfr+17+Vg7cY3kEXIUXy+bEyOrZuiRY 6bLiG0uRD53lG+Lnw8c9/x2JWQ6Vh7iZZVdFyJ0qJFGoKxmc1FP5csZSuX7WmeJ0GrYzmeldMVP+ RJid0xh/oJRQHU6X1slzULMarYfNZW2LEG6IuyPfkLtxd2oBaRWhOuZbBi98Zeq4cMHskOlSTxtp JPFxa21JRpaJZKvJcflIBKOkWtup3amqFnbw9VhgTMZBrgajELKOZMslJtGqDDgSsPKao7bS+/Jp IM1rR9W3KgeH0Dt5V8xOrvL0pX03vHlVE0e5VtVo/eHDXzeEjmPk8/e6Os/zp3d1isHQK3md1mBp fc4vHsKwpFnGHa034RKzi9VB2FJOYDyHmYJ31Hg2hh+g5tmYGraPoTqPvW8xeGXhysUycsfLFNGJ MG0Bwav8PtaqdksuHkAKd2Q0t0Dd3qvbjIY71mpzu+gkXVGdkThW1eLzfm3URrDTcKcKO7W24rGL TjIqIxk5t7Yah7dKmE2VnR2LYIB5Va5mwV1VV5zNTjH+6PaqMk125g5/6pVWzW6Td915aRin+Rat SyihlYBw5UMEbk5HN6eXGzhEOpxo3bVELl8bp1N03g3SV0L15Ws/FrMpDF7BicGXyB3lRuiN1tup Op2aT/L5H1CRcBoDs/OUi1SeaJ2iATs5ChBxTVKqXJwcYfi6UnMUtmpRrvo7uKtqz607KGxFQIb4 asAt12280dRZha7JZfW75seLOx3tVGF/v7YqnNVc5cSu1f/b3tmF7NulZb3tEkxFXqYd3bFRHJjh dWxGRhBTbMYZKC1sXjIp03QkP7ZGRlOo/KJJRnSYIDOSykxDIwRH3FFhSpHAIrMvgok2bCNoI+lj q9+6jus67uM+18d93ffz///nfd8RLhbHOtd5nutca53ruNaz7vt5HnPZyaFpZbXEYABpLduy6PKM MDeSexn2m3RsTYMkaAvvBWX4ae6QROv8P3v/Yd7ku8RmqKHQrQ8AOzR4wEkxeYauiudPbJWV4jWc 7+xC6FplFET3VPdzehA6i06uuiyE3poONr9q8vE8mL2Re3N1/G/rl96t78boE9RyZhenzz4vTZKF sn2gNn0boFmUXU0dvQDcRLW00iSJ5X+gzddG6N7SuW2egnM3Ju59ls1fqqlvPwbD1hQKW78HvbIl Vk6JiaxvTTXjGbC5wUxT8qJmRksrLWVKhBunx36QmpXvWvrhiyd7HC5fDT5u8xdN6Va4KCPU6wqg 07r+sT2cJUJ0+arlxz6wXiIKnskLQZ9UK1Yvsqp/Uc1SmtYLd7OaebBI7KQFYNXKg74Nrkh8Y/a9 yRc1cU7Xab0Rej7c3rz0br4bww079K0Tus7sYB5xemF206tP4qJgSpHyEJiLk7iFC1lbwUD+qfJI WaCd1plElYB8CnH0OyqVz+CTHlATdZ7RH+pYaLAIL3USL0wWTXgw76N2kwQXroZNdphLllhWlrCI xgCToISUBjbULtLpSTmg0l2XwJ4+acVhX+276CWidUhNT6FCk51BT2RuMuh1bkpmtilPfNPh0xVe cHc3AyYevorKemmhlV3QqC9eTPc+rRtkuoLLUb1Jrk/ovQSTpnMwewPbOV2lzIX5BPVzv+lDZnaR O6X+hDo0mo8YFgnA9C2qtUStYl7rUE0FE7Rs1Zql5FnKFTpWa6f1xTPbyQuTfamu2W2h3+/PhfIL aypRlWoJY92KshSsZlD8ZFVn3rXmenW0W+yTTE1Op8pDq8reVVPeDvh9E1ZJ9+4igc/sCdhR6xGl h7swoxCtly84itEoC7WtqzeJqVcoDnuFk5J7/aR+4pPdfULUWKNve+ObyQTTtzJNJwkLSQBJ1KoS ofMWUB5zOnJjgKq78ODxpmCsCxlZHVcxOr+/9b0/8L0f/U/QqI7ts6N64VmoVhJTtsg35VYwMC9b uUikaaFBegBPaZ19yyzctbVOKg9pQramgJmrGSn08iJxNXu3cNZdL7/X5Ix+6iTuez8pMaF7BRtH HyQOUBWgVQa4lS6GS+95s/NZMF5Em8w0i3w49iIsVUUrPzRxBjStQ1jQnJnO4LkSWfaSuO903drr v24kDJw14n9asV76uVbcXZLBx3OBnd+PHEZ55/p20L58B4Y0NomL1iURvpzTm9X2kekGms5G5QZm fHrhuzFidhE65K4H9iyPKNuMDNBjznWT6VgKqlqNamJ0StV+BNBPh+AxrbN1NeP7hvE33uJKVE35 akXiLa3W51R6bxtkR06XFC6wnRhYOSU9SWXr0MTCBwDOx0uwrcWQW1NIgpZOFT9y1Cj9IAe3kq9+ Hwudtr3QUyFQ5sGt6aTH96ZKmRA7dHfnT+vPm1LP+0/NxGdI/F79Mz5fgA5h848JoXUSINkD4iYD i4RV3ul7+8GxVcXsx6260tjMTnVn8OOEboKWfFeIe5gmiTP7oXC5mdkUXv70t33zez/4K3z7RSTr rzZCuPmIkZN2zcgG8iAittCgELRdWZ6axgLqnXJM694zM9DvyV4i215uicGsl5TfpWzDwjilarUC erVekibD1qEwrcBndIrJA1UTH7bkKFWXgHykgGTYS8/vvVqevM4vWT8P2DpsWvMNp06Lid5J5deR THwGL4C2fr+L9QywFny70RfrThgT+pDfRe4tP49P/htujNy+DKMH4m6So9wI/XKQF63vZRzVN7XL Vxun1Zde4dj+gQ9/lH8uKoaFSfvHlC2eVWlqdqsk2WqfPbCagBRK6SoAtTGt60Cn/fOsyrIPcet9 m3vY3fWkkB4Sy6RIqPZcYOeAop9NZ/B586JZqn1fRcFk6unqTSwhrY0BZR2pahvQhGbh99Y6+eKj 954Me89ImrD7YU7ye8vH/GB1/hLm6UTfe+gla4J78a2vhgi5gfnWT/k0aJ0NbionQ+DrntBRmBF6 MzkI/YrNdRJPco8vw0jzcjxv1+vH19h91b6B/QVwjT/vLV/Pn3vkqC72hEB9bIfuTdbiX5Xm9FI1 ERe59Q2siSSF2Us6QX9A64zc+9CccpGMtm4ujzQf25mFyodOCrupiqZJvCg4Hit4LG4yKDpDV8W8 VIcx7/7L1VbM5MIK21kYuTq5apjQ1DI4/g5XUaAqHUB5PCLkbacd+aCN51b1ktXE+SZAXlY2Ne/F s7lCnqd1UViWotEhtQ2FL5521z0+EOQDJusYnt4KrfOl9eR0sUfhEBG6sojEU1WpooSkJL1dskcg 4laFiHtwcP3epA9Frwldhrpkb9i37Ru2Z+T8Gmo5s5vlC9WabQ3gZePka2E3GaS+ON1NmNgDIOUD Wu+3WdJH33qvxNvyrq1uq3u76/XtyqDo9HJLDDBJXDzcbO31e0nvf7EQi6besyRkKoD9AMCcVKYE 61k4VFMz3H4iXmgOu851L2PMpqFtCostVWide1tzWQJjiClxz1Pr1l7fEhlm6aangGE8Q2H2clMh lV8kZoH4oYrF0lrD13kCMLmn0OcJZazLlqhxyb5Ttjn9oHLURNkGvA+uiNt369sr4cLsqma5aeKH r7T/5K9/XMRqShWxqpoka1yAq5j4GG6hgVqt4O6S8RGmfErr9+7V3G+JWbzZYTPVEpftmk03cdom vmkoBUzyhHvSKtWGHnrhE6f3gaEpSHNxVtv22B5tDBE9EiuD0VdJ5AI5avBslWdMfXIINu9BCYAq tM6fBtSXYW7S6zMkvntd3av/Imn3ufbFwH/mD79BX4MRgxcevzD49cenOkCwxHsq6ob9+Nu8O6Ef PC4S34UbKWNl4QXsZ/bjYh1Nn9CPpmbYkb6EfD3mR3/2X4lPXYqLTbKFmpEnO7tqNQM3oZ/0nQrW KULkV7ROuPmS7Dfqeitq4611+q0oCbZ9d2o66RC1NSObSc87PBnASYceYIZqYZkZ+7yEPfqaSrFy laUE49z7wU0CuNXPsFRRbpoHuQN67nYYMrdn+anO436pNFH10PqmxyROPAD3tjqwwyB+oCoxaZYz /pLOrPUx+WM+H7N6LMIXY8WI9Cd5WSkI3ZzOug+xWJ6SVqU0mgKUSmCAHvN1azqO2D1ukp21jzN7 HN6boXh8+D44mgiJ581/4n1/+SM/w4UMf4ZF3OrSQOSb1GxmTzq2EJDK1rGCHFpOlad0d0Xrj22q XI+ZB228Yeuiaahvodnhpgdr2jaBWmf0mprCa2/oWEE+qa7fN+7Chpa8GKBdQVnIXXJiADyTSBYr paacASunMMMocvIQCQf2D33KSz6wwyMix1IW+YshtZO9KNSTyq8tNd64fA1GC5cnyFzWxOIWCNRC pSJlIe4m2djZTQbSLFWbXwHRvV4JxgfYutiO9vtbQfhl/noMH5zC7DwiWfOsqwKi5qRg5CZxya2Z PJ4kLrnVAMUQyR20XnaRJ3oBvDOtk5Khw1SwlcHQxK0C1jEoCq6icJJw7fkufXcEcDAG2ZqjHiqU w3Lazppm8rQFk6wqAXpUFcVbAfDwk6M742Q4A2tDuuDBkK9Y8Ikc9FGYvdA6bGj2NHi2FHmv23v1 Fe1jVs92pOe9cQPDj1MsU3J64lxl5CZ045ai20nZ6Qovg8XpQwZvrcfhfVc+7t/lxMJdbWPttLpg mo4De1Peqvp9pR/56O8krYt2ewZPOfrmaJO4OXpo69ZiiFtJpLDT+mxmc5Z7/MB2vYsWZ/697Q2I LXEfakpuahaFUrUryw0eCwPz89MislaPSdzGBoqzVB18AnRIXCTK8r5UU5oMcZ9FsxUcmiO8ORU5 1emErnWyo0cO7OVPOcJ9eiCggh8jx2dCps/EyXlKfTVo6gaGfOtTJVfTmDUVs5vf9+qIqcXspmAD kXWpXrGzCNqlgfl9AyJx/PC/Ty9vgoPZuZD5wN/9Nf6fV5J7YeFk3sLjVFPZWHydhmZwCV0F0PUV rXseme7ZzpnJtZ3sQeDe/VzM++qs915zIcHJkEBnzhnFUH/YRXFunwZDq4XwpKGvj9r5+vhqCsmH ZzcteqFJypQGOqpTNSgepFmEWR3u29mIZtky08+OjHEiP1hxZueH/Tyz94QuVu25tZe8GgjxTAyv 8shZDv2FL+dGTx1uYllJZlUpL7S+ZWkyOKm4HZwnv3kER3fPbnItP/y0q5XEm/P9Y1XkamplcP3G +C8TJP/PS1ftkKwY1vRtCYAn5SZoTEzoCPWkYVrNnKBzdQnDfjjPYt5OBrPNaYWboPfQb2wH2QP5 F5elYeJ1DGtNtxpkj2vP2Yr5cJ7ttiioauGQrMmz7GKBZ+d3M/ieu8dN5ZbB+xeEcXtHR8cHpx5X iapf7qJwsio/4giVSPhhn0t2qASyE9+57CUiTSmcIdCHdV5AFw/H9lwNGXj7DsynfqZ/v7Tn9Fxu 8ztcKU2AUrflZ3wHhry9EHd8Gabl7TVxZ1WtVzqiaUw6cFH2t2J8FbOd1veD/PZPOb7wvd+hb8hw dtbJ3UxtgoZ5k/QTYyLutlVS+RlML1e0ntP6DHHu3tzhKU+srnvJOqT0vNZ0a5qATbUpt/IQnNEc svDQ2zMUJncnXnRB7uphHi54O7lQFekvzJ9JU1n0Us0u+iZLxAgsDSTi3zsVlZfSRJZsK2xJD2x1 EtjDSf0zas/D55l+H9YhYG5g4HTWhZVac3ouNBgSl0Rgz9JrykZI3oq4G75uXVdxuyuY0MuB/WDz rZfL9frlNuYgd1xx1c4fkOFCRsd2MXs5WZdqknVSPPJStWGC/gXwImidJRnSXwpvcl8ql1Uv1aJZ PJfWYquq+V3VMyb2k8qJrQCYyVPnJE7KFlZZhnDSG1mLJqVIXCUZj0SPWk96e+Zq0EGZulJ1jzC7 lOERmL18mV3cBNH4QSKiVHkveT1m5V6eaG4/BTwnt6WXk1V+bNJ3YPT2PUnrun5BWUDpNzx2mJdJ 1DWJl1brGxSFVhXdb9zd1ETi25uDaiP3g9Z9bIfc3/utH/r7v/w78K+ZXVwMWS943HwtnVJNQzf1 4ELrsx2iraLF8LYBLJanV07DBS4xlGpvuFYorVQfI7vs1z7L2wKde/3Lgx26l5uSgcLoK+3i90bN x2HHXQwBCYpcyU2ZQFWV0sE51eJHPSLsIyyamSGJi9q9VZ3TbYVnHpidCxluAKA5PWIiVxMUkqKp SFxdNKGzbrWTTx6Q34FJTp+ligmd1SwJ3DLz+IESziXDdyI+TutUm04c2Es1m1ZYbB5+Cn2Xqvid aBUwQULuf+EH/tGvfuw3YF7InYeTtWg9j+HncX8wN6cn419o3ZuhgFyD0vSsqrOl7f2f10xb9nZP 6LiScOYz5ca9Hzpya3b6TLA8DzuVf5jUrX7TnKfyEqSYupkfB3btB0ksLFZ3VXsSfyazBws4UU3u mhkxO2d2M7tptxC6udggaXcoTIVnhbOjxM/K/yfEj25gvExerDPJI5Z02XjzOHYkKStXVaa8x0Pz VKtODn7XrUuyOZr9aR0F/rMS6UeoMDu37d/zj/9l3skkBSc+w++pb04HJL5N62fmXTqLpfLWNZBJ qZY9n61/6A9+xiKS1FyonWw6722h2Td5dH3TcDaG0drWR2PUTOhg8mxoeEao94E8UPKY0MHkvYSU vbeMp29F4uG71WOxpFfrrVK5xyUJVcUJD5+gwuz6PjvUBmP6UdVlIb7kIKGONwAAQABJREFU1sRF 7fersxn4qc95S/nzXl64YQ64VWd2vacvtL6d1pWNzslGysdpXbnaJNtTqkVYWkt1c7t/DWZ3uN23 NLWXXulZPhkfQqeKJo/uZP75L/9bndkpk53vxYXEMZcHMTvvhguta37Xs+zpLpvH8h7cuy17D71k EeSwycKnB2NXfVQPSNbeaPVJHOdrZRTIHh9UHwimediua/Ajb+24cRyLBFSqte9ChpZnwGUs1lmA NEeNtcu3V2n1wAUyP8HY8ugXUH1mN6cLQElJ2cIpmXHWA/Knu114eKzpgVGcNCEebtWZfJaMtcil Waw+66hsRF8AZecnmbaTbF7C6O7lIHcrFJC22TSTNx2d1jdCvxC35EW4VUXo0iTm9myvAb7brr/r K3KfsfnszD7T9znd5H6h9cUUZ1O/KkXiqkGaD3HZor3OTYXc8L35EyWL3rMp8c0eUU7Kvqk/VFiM Wmfn4Qm6CEtVHYnQwaTj8MEK+TCqm8KbE7VWmL2bM9/M8hkMbrHlNsbfeoRxRIJ9OeQsqZWmofAB nWLyQPVMJA+4faIJUYnWWQvmn6XJlTq5EXZCP65flJMQLkDUbEkytZt6oSW9oX3uOuJ0nf1HJH4h +kkrweOqddS+AfnyW971/XxPRn+0vRzbT16d9/xuZpeHG7SeC5A75Ol4tjnv9bymgLu82ZXB0Hzd WkyK8r2jtrlB8e/qkJ1PtlqNzBMWoNQljJJSpSQ0mfrV9eIdY/83wb3zI4dplYTeTxqa+gQVZu// ugAEJGaclRCcmsR0iZP7ZvLUKa5K07OqnozkWXU39EMM/ENqpj2XZpEJ7cQQH/KDMZRkL+MnSDEv uZcpaqzWLFveiqC3MquJdx0TusBRbsm//Ve8+YF9wfWMguM8f9r3u//JvxMLQ+66V/E5HeI2LpSd nK4mSaQvyQ1a77fNTLJYp3ubvBsN0oOFBovWh3Xsc+hBrW4qjGa5nRSAgo/qqSyckmK493t870V8 WgjdVYGMrTS5OuwFQ/KPDG5g2wwA0h2sR1ataftnHYD0o0OZjgWL/VwGm9GmN3Byd2m6q5rMDuPM HhjKTcIuRV60CmSZQuGUFA8zw5Q/b3wyvKeEQRf8hASta60XycA6ZhaJxJtQd4PHDaHST6noMom4 5eTB3YkllKQvs9XmF7BxeloV4m5N6Iwe4kfedtMGms72PnjDO7+Z/8jBlyB1J2Nyh6aTux/AO63P dnjZS6Wq7WShAfLEUqPMPTzEKbSVwVNaS+/2OQSzjpCbjoeGKRw6mXkYKqc3cFJe4mxiHRVhUSiu +momAJgctQ5YD7lYwXb5jmbqJ6HTNPuBbzYV7tdgmEu0zuQ2NBCVeJIJCZbhr36X2xgISA8sliBJ DXlWjWdyK7zawIsJmB+J+DCD2fZiZaqQaX2iisRZO60aVYCELf10Tx3XL0rLTE5LAPlgntVUa563 pyjsFOzuDkZuNL3xuEqqw+/DNPPR00axUTzD5x/pfft3/cSPfOy/ctCG2fmrMgCePK0Lp2TN9fW0 ntvbu+IpwMv5mBNvxcfMn5VVz0F9Os76engIQ8OhcNZ1yr2ygPPUT9YyUpXaBmALE2dfpnIBV1Nn iDNb+pH2EpykMM0Tl75o4oFryt96FPOK70pJtUgWNC1NK7i6AFZ+GNh572HR1Cs/E4l75MXJLw0w 1eJoFsKgLIqrFxI/rmLM6ego5ZKRr7DY9h42d1YD2BetNIkbHGxO75fWFI64OwldJG42z6bW6Uuv 6NPUX/jNndzz5C6WX/O4Ws37ldY9uTeBtk1uKkxyL81w7xlNEU3ftJa4d0B6cNUK9mOJAU3GBim0 bQ+sL+Bqr1kk5zWLYVbF1PmCMXdbLSWpWRRSzU0CLZWPr8RoUzm5Xd1B/LDM5jzP5nSU2dJPDpJc XwXWq0neE4ck6sJRUeXrGTC7vhvT05m4yQzVKyB5SuvQ4etMCK1zA6N1cSmadjUBiUQ1FZCY6FvT cawGmGFnWBztUmquXpkvCf3KsGPzck4XgyMUEIML46fJt2O+mZ0mJDxcuPMfl/KvDojcoezC2hD9 UCJax+pC64uNnfN+BrNhvHlSP7duyod4tmmHyi9S+PwC65fAfRncHKm5u/dm20VTWTiRKTmnM3vL yO0IkwCsB//agXKiEol9nh+FQz0JRNyp7N4tRKIMVEkwSCjhHf91ATN18nXyu+UGvUk2vc5o+q7h MA/8rgBHda1Fv/rKlrJ2EnrVABBfK8X4W7KZkQ2ckEjykdwSV1P/Ity+qWJlmHdvyisXHeEPct91 ttP6FY8f3L0gdDO7QOvrpVcg9/d83V/jj4X515egaZH4ujTXo3ahdSau3+1aD5r0rHlZrb1JkeCq 99MvuTsFuLUHqTbDZrqZwkLuHhc6pckmBkVhUb0Z6tBnv3DuYuFQVjMF5OSZ/AhQSgjQwwYwNnDX gH7ps7UfS0oSpxW4zx/3BSmo0yQLhyFgcwASeIeLApgdGhIju+wlJvG7CO6TU5mLdX4YYnrL8pEq ReKqGPxSPX4VozC7Es9lD+gC4fDJJuFWNl7e/7RvKjR5+nE1GH+zHd+hD5vUnel+pPMyfyzsq77r xyF3DuDQuo7t5cJ9xvKYXGidTa6j2WI7ebrP6Fj5KWBGOukzg5lh9GdNlrsvS9xLkWTV2MBWPYBH Uk04S5lYxwA5OC8ieipPSeLd5/b9Gck90j7CXkIWIqT0k+QO1qaitcnjHsauzKqWJMgxpvyFYS2K vs8++9aj+N10P6NpKWRrShKnzusVc1TnmkvvztlqOruk4KM6iaQXszLKcifbFduOLsTxLB2DNElh w9sFt8orwo3r9d2kEDpdH2f5K4Le5E0SCltHx2et/lZMe6O0h37V9Y4//c98xhd+Nf9Rb/hpqq/R Re66f5cQfKH12bw/V3m/pXvJLIDzmjMPN+U36Y8YkmqHDp9rnD19EwPCm1GNQw3qT8/icZWkph5V yVqlu+UAnKvMI/OwRwtzlnJWi9z69wLIxSbGCcDJ7KJaiFhcLGDsVjOymmZVy3vD0vS6qTIh5cNS z79B5piEmTYidOQCSjCqmXLGjT1PPDgpartkY1UuQMytZtidmuX8oGAJm+1B3M2tWgUcjCh705T+ VbmRe/Yl3Mrd4cv6NJV/qgeD58m9P62L3JHvtO75nRGZN4CXxGDWVOTrKt5yA/dVdVd0HINbobOi k9XExdbVhc6iyeYJ0F/Q69qbW3NFhkIraBFdJRJJvLiAEk9RyODRlCuyELlLhOD+QU4iSm59OYTc dWA/z/IZyRpnXg1xCosrzyfhgbku0P9UEonDsAKlehfzYit9gzQfClPhtYv5uYejOlPq1S+Tr6oz UAlmHXhN2IBqZp3YGYmAcq8I3WqQaqlML41Jtz/OtYHt+Lzl+YXBjxMMkt1h4XFRfBK68HGcb1YH zs9O1WP2u78htpfNhl/mb4fxxyA//PO/BHfrTobSx3MJfXJfndZnPzvP9ok2bd9aNnOv4N3lRTVY NFkHgJoJyyAVemzPIi9XrdlLZk3WlCvULLHJ8wDm65lzx4MCmLyx5k1bawqQkQBKPc3bgbU9vEkk 7/0rnfqkSk3mLZevVEtIJZEemHN7AIjZYSIzO5Qq2qX0Y2GCxK9jpmaYsyfnBx04vd3AbH8qwKvW L70yygoCmaWSQCAIJVd2JTsjcQYmbsLCswfhFrXmc+N0Eaj62iQ7ue9+Nm+77Uboxc+lx601q03z IHThra928dLkKuN7MqkTmi+/6R3fCLmX32DKY7uI/kLrubvKRN+s9jvKVG6Ak8QLn723omy2Gmoi hBqySfq9vLidVdPVTOek/C5XRVnxDzvS2nla0FmsppvW+lbDW9tXB60jB5eHDG6JuG2bbMKWlHUJ eCZPzkzi4rxvgr4Ztdk89fkToWZ2Pugrn6CKrEVehdqGPD4U2nDdarXXCtBwPCgAs8cNjOY/d72Y PSWkU77IWRG17mmjrDtSqOXY9l1bZ5pAX3U20nQGH5zbvkLeutjeIhvbSnJ8cHrwdfpsJsep/Ar7 vRKErm9DYr45r4Te3KqLg+tdNeCmqP077A9/NL8qo+sXlZziL7SeKT7E3gzeLQapz6qU17KrBqlv bG9lmaXgVqqOBGxuMrDDbE2h5TZJ5wWXYGhNSVbTsHS3aCqa4p0i7KvmXA8hdfqtkq3goZV05Lko aI+h0NJxe1Awbrl4XL8YIJRDbEmJi4f4iUEKlDcDlmauu217MJztoVC2aiJIHrqg6jM7xApJ6elx oV3zWpF/MlRz7PoCDHOoncKsap5n2/+SKkHiXtar5DnSTylnyi7VnWSvCd3CHmBOfvIQMKVu2MFm 0uZ/4+4dmHkPefMpcldTVoU3uc0FssR8r24nd3d9BXZXLTB9DxJy/8lf/7gu3HUzo5P7cbd+/Ddh ZnOxATzX94LZhpScHpMr5dxhFIpZdz10hYm9rc0XrTPPC5NhkyMpwNViJfmstSiXqtm/B0XzfBVX 5J8fVoecVikhVbcC8Kxy3cVilWfJs3b4xFYuhTmzly/GiNmzTNKXvEg+GTjdY9TY+fUuPnx+LGO9 as6Zy4FgyyVlV6PRyYNhaUpJ4qLWiDXIfaP1l4lno/vjWI3C9g7AtrkqJK6QilBVlzs1t+udJz5t 022/nlr+R8d9p3XP+HngF7VMcqVf5F6l33xtZBgeSxEWE6v1AznTVJwXk2G1mJT4r6rHX/7Cj+g7 KRLsjTHuaDNPk6LmV4LkzeG2wQSG+4Qm5T2tTe36hF6yQm7ls3SdVSeMAKVPf25Cv8xbergL44er Yd2z/9Znv0mn0TNlkr757pMBiNP5tVImrf+uek6+Fy6FxsqEWZLQylMZ+ZripXBSTa7kttF6I+t2 ZiceSg7FqramuAeHT2XSqFlMbb4eVq02YfOt3wvRU9V1zYr6jx75qzJ8yZ0Ld47qOrnfuITxAuTO 8QIYrFutNgRs+17Opkrm6hVSMux9KEwr4ZtqJ2nipFoGMBw4Cg+4SreJSY6sQtDMqvoVWUtSdFQt bI5Qkj3jjwM73kjrLL1PECr1sXUkBtnpGmuNnIoGWA03f/E2W2LJc7bBmXVUuUnwL6CK00XQojAx eHK9JC6l/ElSak44qjNp0DrL1KeQpjcnOXFZOKeKgEonm9LsZomVdRJbKNCautP6nuoboYvWzew7 2Kwq8x5s2zybxBMnxUteWjcrhXTxYFcGF9t2LcOfcdenqdywX9F6pniZ4lm17BlXDewz94yFxW0v T4l9YiWcremK1lm6YDJrkoeZz/R/HmfMC/9P7/QBD+SNQhLoN+F6mOhj6Mf7BEliVUXxa4dnWst8 JsXbfDYVtjWwyRA0Yuq+9ZgkbmzwyUzoTAJHdb4Aoy81lill0w0Xq6ipSs70cmXahYUhtYeezE97 kNDcTe+c0ymRZGkFaBScX1JsrgrhqpryW/8n7+LBrs4BgiEAdtlnf+UP8w+Yrmi9n8oiyf2QONVm myp1XjC+GZIUmJRZYMVDqc6sJJfbu0wwdDAyNOemH51VacoX1UXzuJyxBLeJF2FLbY88fkfJJtp4 KHizgbVJJNn3SfA+tgjxTGk/BjO50gxGMJAJYzdNzFLRzs8AAshplAldQFIcP2ErXcVAXiZxYUuS 06UzlLwuD++Ml88h9AWYshw5q8ZMrPFidZwqSg9MnFdm5AKkUIRUe3lKdryRtQIzoROq2FxAH6hK 0sg0udsMLuBqT83R1LpOhe7WPhUSN6vDzx4/1U/7Ol4299H6bAGSa2Y6yG+qlYS4qV/66vV7iU3U tFCQphScgjf1i39Xe3DeVW97U+K3Qq9Zmtgw1kls4QyQSTSJ2b1tnF4ClDzSMcAKPHNb5OylIqHq PJldwuTcWjn9pALyMidI0jPKfF2PK+PC4+JuCc3gErr6uiTxflCMWl+AyVt175qc+SR0FPr1VW5Q lmxEwuNMa4wWj5pSYlyaSjXVaDKDEzNYVE4yGANoMrlfMbJ5VmyrMil7iffA4kSPpL9hb2rx591V NcWruqJ1z7hBLs9JXPZPb3VTIbfccIsWnwuHSpSFAq7OdFF6PGm16FdNVjDoO0LiVgOr5VxZ2Exu fS6aysVJ2vY7DUMyCRNKP2wV4bpnTrN5xnMe9xNSbM8sbhI65lQZNQ9n9p/6nLf0H5+ax03lJvoh /VmYhha+RgFj4QcaPmTWhD+FMcqSkUhIXAJINuUV2AlmIGGWM+VivpvETbo4nd41HJdm9haY9I/k 3+k13jd7YIXQN8ZvPUp+vAB2yVE1WQPURNmIPhWK56260/qZdC/T7Sp7afhatsJJUPZkcZsRWrMH pS85sZpaH4u2OHFHGZiFazBzNbSycmHbVC5se7PJ+gLyDM6ZcZOS2D5JLOEE4HxyjyGnqlYMW3X7 J3l2OAQPzOrQTwqZyTNdYyJmz5lnNjiH8pVHro9h9iRfkbg52iB1XveYo7r+AgzcJ/pjGg1yFR7G yhyllpKqx068WVMaFmWqtLanXa3sX4ZhCFQ9EGPfvCPZ9EdfjIF89STz3mLknejT5MDE1nN6G9Gh YHA5rTuJZ/NedlqpzqwWcnsoXZfqwsOs6V4PqT/Ds76K3OY9KJrrqs3XasNWMXI2+ZXQN6XavVg/ nMqK9NIxquXZ8d0YpbUkKlFmG9hk0aP30kJHTU4kVT11AirRGXK6lWVbjuq7w+OeSsxuWjeDC7gK iScunL5oKpqvoWr7Asz2P6c0zzfXjmRgbslGAc2zSwuVKqpS6hH/7oxp6tSV9KjMJOxt8SmhAeRI JHvXxz0MI9KgkCegqger5uEoG8OKwRWSqx0FN83tkbmJW9XS6mqC1BS+0LrndAZuLlUxLJstW9Vk rsmmHufmVKu3ogFyqw13r93axMBNJ0ExdNVg5uemwszQ8t4DEo83KVs4JXZiUFpdNbDmEDjvaSWZ WE1KAW2k3EIt23LLbZ99Dd2eETq1DM5YnddpFy/xC3oyFOOL2aFmsbNAX+0ZWfq9/HUg4ScYfo7x jCVRODn7ySfNSmuppgnJRqsSLHPJmVaAdJxypXVRbYbbB6eZ3kSiqkIyTh1bNbA5aczr0/pG8bs8 8B6nTY43QTPszHfh8RpwR/39+w1azxXKWZ7hss280tbvJW4qLF+qVjsPSl9UF3mD26J/vqObmr3n lJRJK95SszRl9a7pSuJOjMOhn6LjfstpHfmepiTlQeI4VHLTlI+dFOfD87KV161WewpgwjNPFJ6D hNZ5IDITOryclC2ckiFxF4WsJh7avqqEXL/wYTIfPPRzntOYraSBq8N8o/VCnYdyS63jP10oo4Zl U4v0cxVh4t5WrZTt2c7gCgMOpOoSobCDNLnLqpV6N0TZukuaNk75FvaVWt+aEvG7JH4xbMIBra9Z RqOiLI+tZjQ0k+OnNJVq6aivol8SqJf0Vg9IHNgsF+1Tmta3HDCLrSiXqjz0woHk+tNRh2piAmi6 3ITzxHtfmx9btciPuwgpkLsA5bQk5C5+tDHKtmmJvu0rKQinH+EXUzpXZ931sypNvVQw5x4ZZofR oGA/5nfx8k12vqnwqqLvYTAMQb9/xIxp0ijLZpxO8uQGBnMllf1QbcI4FpBFJcGUURI62bLaY0my tGGj5utvrHsUyE3xwsTGVbvCbkHqW49k+8HvO1OLyvtyyOZz+m7e4mkxH1XjAa17AGfAzR1yxslC xxtsAWzec5Oahqk2U7a3vkc3JbBaCs/j3ryXFG83FYr+vVXTt6fIIF31B2eyCgVK9Clbkh1HJGFv IbVSpsMnYk/LIidLzEWzVIlHU+EJUYQ44cCu/7nhL7Ob9WC65GtjgSxlYgV7eA0Bgs9fKz2/gkyp WdtWvQRmVGvLn43ZKZ1FAiW1nHJFbV1VQsq24WtaN48TDFhxqtRnp8gVagtys93LjXO34A8u3vi6 xqyztqlc1K+q8HXJrcvFw/U5XRS/03qf0J5rwLo1NYfY+620ptuZTjHJqqY1JTfxupd1a++817cE 4PBSmE4sT+F5nObChbPkypRkMOsiFYY8bsPUtFCgbYntwcNlk2z8Lol3l9UAdpJDYP9khlgngQZe psIzj6YcpluZF8nNjuxK5uhz7ZB/CwwuNmUDTNYGJmtLDNz02gLED6d/aPu10pxAFk6z9FgpflSJ h70qqt0SySlkQAoZC1hikAoSZmmrXV8/HBwHdgfD0MTjgIxziBHirTncTtMCKvW5aMNw9/bsn5Qe 1SY0uRunJIUbs+cN+9VpPbfHbEly/XqdMx7Saqg/FKaVcWoa98D6Q7AYEa6SI2Ru/0NvC6FdDd0u DGkqNITE3mxYtpPJd8bR9mlNXCW2Z4NhK0IyuJUbQQPoUSlLyWNCVzWbwHLu4A3c6RAMI7Fmv0a4 9XitBrDmBRx3TZakvjA5Qytndv0tMNExNKeH6pqy162vFXLXlxqHt+r9jPUSreBwHcWSmFzRpSjy +PnPRGxmTKAcs6RULTewAmDH27nbu0yRkEWSUIJ9VC8A5csTzA5TX/xvDE61Enpy9/Y+aEFaKMnx K0u77SHU+4Pyitb7qUdycpv1tgu67JVnksXWmpkM5fjxCqXPlNswFSwUGOoXnb46I1ZrZo/Gyvi0 RZJVmycQeaHp8WbrTfNUBisGlaXJVVLTGEAXLaeD0IUptYsSqMnm2jxD/rXOIpiTo1v7d0drQHrz 6LdPIbiTXCxCP8n+J30+V7XFG4hzOpyudHXSlrm1fDaZJUuVABIKW9LSpruBIaOcTgUr2WalrQqg ytNyeMtqxwANgkXrInEHaYaUgk0Aehqbbxfura+NghvYaH1aiqmlAxazC8wMQ+02rc/W42H5kO77 5S+SrCbOMGZcljrGxUmpWg0wa7opnymk8zO4bJU0mXVhgjM4Y2Ud0m7Bno6n6Fi+Z/axQ0hKwqBU NjunBfambQ8QgGwViR06sAJKALQyIckUmWz9XMl/ls1DvBE1e8MwtJnhNX18mty6oELU1q3p5xOI FWSWDsbxcwfFzyua1X5uy0qVKpPM6qdQq2auVJPIFNz4UcfeI4uSEJ1RElJVUpXES5Mey4nL1uP2 Ua16pyQ24tEjIRihMhaMUA8SqvKwlyZ0faCqC/GNoOlRnRLS5eQeHF2P5D2tF7r3aT2z38ElKAql mpprXHbdMBuKztohrcVJVhPLz73Ob/b+RIWMkFzkX68NH5re+gXtj/oPWyWkdT267CvDlrl6dwyA 1ClVNyWxpi1YVWWtdwu5m3ms3YU3hNK3Ew/Kfc0AJrOmm/Kk7MS9YWnV9mZK9fHpj3zuy1A82CWA xyQoWnTVwHR5EvCTgTxnycH5YYcn+7V/AE8LY7uJSjrzpM0yzQoGs7UTV16Vo9O68qrn6JnE+jOA vDVtd+uibBG0SwkpLWEsxv3Nu2jdB/YGRhcvjgcFk7sBw7lgSNykr1O8yiD3G6f1nr57CUPyIhmk WmIrnF/4XtOpQBPza5/PG/SR3Nujp2LoCiJ795/+c3/vx3/iR//236Hk+cl/8FOUCGn64i/70jf+ 0Te98sqfV5NKadKEQh+MODeZt+ioifl8X7jFJx3hUCub5mDttOJHVUy+433fQsyK6m983w9ChTjX VlHiZkmyUkUB0MqXXv7O9/8Vjw7zYS8IsZo1nZSXQWFVWHvoZ7hqCBub8yHqGz7rb73/L37kB3+I 5xe+/29+4L1fi1wkOKNOc+VMocjR51NK3P7sB/76Rz70QXqh/IaveTs/MZy/CCo+b1ZLkFT5cmd+ UqqsXk9gTl1Ofpln87hZxRIWvSSPuFtCYZe9sJegbKEApYHp2wEQkthcgMhFPnknk8PxhTseeMzs ey86sB/H9tav+bo/j6dEalkmuW+40rp5J+N7Os5FnXljY8+aLD+jY2WD7D1xr1BaXQVoCWViuT0A mLoMb6iT+sJpAi1+13d/7//73/+nPOJZuJvn537m50or1b/0jd+ErfYVZd+1JQKuokyOYgsXp9vy niBINMk8x192pqq4zfA+/rv/821v/1JsMaTULtpzOnaUtqKc/+rHfsNh/NZ/+G/8gEJs7jQBPToe sKZRM+DYenDlofs9Uk9Lqg2xPdPKBLL02DJp/+U//mfH/8sf/SWEkGChxTWN3lSG1t/5FV/5e//9 f7gj0oNvW/7Gm75o7fnh1j4kYuBFojnX/GjmwTkzw6mTMG17Ne018ykKGy3uf5XX3G1AJhgDsppY OjOJ5JQ8e7pulzAKQ0GKqX0kT+JGQVX0SQmXyKnShIRH3C2gvlq/B7nnKJqm+FpAzH6c5XV4z3JX 3tQqrSv6x8rzr4Sb+2eoMBRmqJlSN5VlKLWk7LU8uwMPe3GKp6s0HFqhAIVxRPV2NYAgoAw4jjP1 b//mb1luwBkZW82/N4xng+40QDVZQXFSYssPAbADD6c/YuC0jpoHYjCLXKPDJGkdjjOta6u49AZz ZisqRupBMVLdO8l5v0Y5pcbyo9JCgCQMREOwQg4tu2Ar2qqYILeVuhCtY8LUMYGaSRYFQ3EiJQ8H 6vL0jFnIt1jxNXmOySQDr0xPlGjdf6lGHtSjzClL61CH2Ep3kpSQCIC3CD8xaB686z0nmluln+dZ E9WXzlI3QXnG4keqyhMWiMwBK38KdjUVCMDKBaSamySkbGC7N1c8GRXxKFWkoFRxzOZ6Scz1Lfh2 xN6/2L5T+UboW19xOXNwt6K6un4RuY/KpPgLrXt5HN+LAYUp+jD6hc/A1EqpiabpZibJvPSbPmf4 pAlqDmbmqsg1Cuh1eFqH4LiHYWY4led50Btbp3XMefAswDx8/ud/OZuNKpjHcnS8CaVPSXbC5iql iVCasDOPNN2EMhKtl7zR1NO6YlAAlGSwypbKW3YKUDJvSes6recnCsyqtpCDBxAGsaGmAbpUeETo /PHwBVRiixOsvDnlkLBTDWyH+Bw+6DAbqCkqhoMEThRX/tzb/jjfhuSQmw8SUSc6hT2p0sQZnFt7 mXCZLg9/6su/oKf1X3zjW+UBBqcvPs9EP/virwrj0L3oxG3PAli5O0n4zxjE5vDw8G1vfPM3feEX MVLNjyacqhdlODkzIeueTdo4cCjLkXwKdp6Ygg3U5CqAqLKauCjb7QAcn5o6EqLiEVMbEH8GPKwy LjlJZqfH1qmZXWQdZ3OFtAcfXC8Gl+2F9OOFd6H1nNwZZvFm1MYgbZXYwgQzJ6kDRm3Gj/KwUOhd FUlfdVTkRN/aS9a921saFqEZRzrskyGts4e/9qvfSiv0nfvZtK7TOiduWJW7aW5UYCv0+Wmdkx0+ keiB/pA7JG1FefalNqc/q0FSEBwl7xX8oPPP/uEP6VBPd+SD11quelpHAU3OsNh++IMfwQ+ToF2n rHWJMC9hdFqna1+4E4Do2/ETG/4pmRlOygRGL5RgBo5Dh4cJ/SL/8M//kqYCbwjxT3hMFE4YAv6R 8DClRCtNHKIsh+paC6eNigRD5hArbtUx0Uy+/9vfz5FW7Ayl4hmfBKBW+Xzl7e+AfGFY86ZpF/Dh P/Ylf/KNn8/VOcp6lAbQen8Jo/M4rwGO0qw+AfvnBmyZQ1zRRF/qAtZGQrS0EhIA54wF55pJ5AwB HY7nCo8uGAiL/q53/FkcoqDB0hHzz/CZcEqcMNWzndtau79LgVCPpzQljRN1dj6OAknTYKVQEWa1 V+gl9qOmVm7na4XkwMTpGp1KmkizLAm+r+YAab08G7lv3R2fhY4O4zmcHccL4ELu7QeCE99bJxoW 0rN8Lyi2pSpvZIPdFuKz/AzobXsJfobChf/z+sPRne8RamA3mqwN2MM6j8MLFiZQK7vLQqgKbzAR NGquxA8S5IQkFtaokbCxbQuA5hCSrG//vHYWZp9DsuWNws8N7GrYyt4wyeM2+vjBNg1/5d//LldJ Lae3LUrpp9A6VswG7wmbA6gSj8iaIUAijAh+4WifTIcmAdM1K6K9R5BYoeZh4goJ9MT8wF+4oiqH NPUOUSMe6WjewAIqv+Ltb8ufpX7lp/8pmQMVws40MVfZShgEjE/WFGbnjJyEDo1yLv72d3wFrQzE MeOBQbHcOViGD19zQufAznuCpWcVPGmyxRCh+uIATl/Q+ne+66vsGcDomFtnCxKcIMQ54TEQflaA 5XGCTvHPdOGfZFN2aUJyX+dErTHrlZwIRl9JQpPJV9SmLCqUl8LEqWa5QJbuogm3N8oew0bfCp6l 95ld0WbY6KDgUdDUhrCZSw3sp53WdecOm2+k3OIUZWdprt90dh6XwtG0Bdxu5O84rc/YbcZlGn+W eNAIizCrPc4jbeJe8zHJbFxDb0PloXBoLqH1M+8RsiXYRbnTjEXcamVH5a5GJ1tlIgmcC4eaywB5 5BSzs3z0C+m4L5yL/SnJznxb4AHN5G52OL1oMzMECNF+AChjnkyBEJ7iaMzYtX+8ozBPz2hSxUPy GkJYjKgInvCYzzShI1qzO6roKDwoO13hGRpiMqE8yJ2QcMhrLB2C8WArZgZWHa4sw2EekrixZUQc b7m1+LEP/FUi14Ocl6h9YvKB930JzA7V+swO4FjNy8Bq2BKq4qG0NwARitYhX87ajoFoWQ6GaQmA 7+rQF/6h9W9+53vSD255DcPa6Z8V/76vfhf+/8UXv4eSdHLuEQ/O6QIgP0RbmH04V7mLE1sZmusx eaJUaax3/RR5qRZlJV4RysSGrjZw3J8oKqp5YCdOKZCTjlkKaqLEUK0elwDl/jA0fVWmdXec2Qun H9XLwVw/pqT+oXOhdbOzgaNMQKZmdYbXTpLOigf7H+oMhTYprkoVtfJS6SVpsnar1tRxbBaWlLVC 9gK2Wk/r7Fh2DhsJ3qEVTmH/QJTlcM1WpJXSG0z6up3wrta+JQwRevZbHEJwOOTsxi5NZqELyLGc 6YgKoQaVtE7Y3/Kt3wPZQRZJtQSJPmF487DHNDlJKKjRHeYlBuJhkyg83l4mJvTpCH2CT+qB6eiO RcEqx4K+qgCmS+PixUlVPvUWxCHn3xQiKSvYFvHT/gjTgonj0WmdEy4naA8fQDzwdS4WS4y5OV38 ztUH7xh7AzA5siXalJMkMDWndVrzHYw+HfGkPgEQD1FhUk7rXK/pa5r87JL+qaLMOwPDXF/6ZSrI seyUREqC6yfKkpYAQd/am0gKA6K/cx/EB5FtZSHlWdU0TV+9Dq2ZgcYGrTvpHMwO5xJPhuqANS4T uqqeCtQ0kHW5c7qYWl+POXCLX6ztV5qaJE+cp3WTkQIq5ZCmi7BU08OiyWp9AEWS1cT2AJA8SwkL oadJ4qHboVBWT3Gb/YLpBaoqp3VoSxLRNPsHfrHQew8JCURp2oIp2HJMO8RqSpIw+yXd0aHfpHU4 EX5EiCaUbYqkO5gLOU9ub5gC7ujl9EsMyIkt9XEIhyLXtvHmIRjTH31BkSJQlJPukSvm4pa3FxKF 4TcZfhgCflgp/KR/zx5xMr3Ylo5QZgZwiLkdEjwOhymRajgnZu7WxYam+0bN2zfc3/uu99gnk4Nm oXWd1r12OGT5UOOUne8t5Dqtq6McIPrQMU+eyv/1//q/0LQ+UC20zgcD+OdIzjfuPTkAftRgvDqq eyDIyUzNNq8o6xMAyZM51mOfJ/omScSVpkKWBswKinAbwR1PUrCFC1A8ZDVdgVXV+2DvXTFsBK2N bxJXwGU4il86UigS9JFIKABxN7Cd2VU2yVbVIV1RJd65fqP1/SB/5m7djOxUNijDGFZlzuwMW58o nEVyk21nhmfiwbb3XxwOddK59JXfznI2SdI6DMI5EcZhb7N1MRets21SjR0lWodWzJ7sLp2486QG HzmGDJh+oQDvTPqVLfI8iKFguTtCCD0hxzP6yb/ICQkh2zLlDAcC3TcMKbttUWVIqvGKknlhW9yK vhlC6ltOj2APh1DxgJDSrz23AqAqZolWnqRFMFY8ha9xiLCkNBLeedkvp3WSHwL9hi97o+UEDK1z LcMlNXPL25SZhxYZS7lb57TO6TvjRBmObow8+iYMcl4VrJ1NdIqnu6R1WqFvOBpXhdahb4Q9rXNv Q3g0kWZ2DhjSupKW2XCmPQZgN1ZZtiI+8mQjuPqHeZPExXopWWCU9UhHtvbgpibRG2U7s2vvKzwF lkFa7uABUiul5M3zcRXDC0C4MfX2bF037Kh2EtdbDR1AErqqeVp/bPaHVn4TDFsRWsEgNZNxJE9J YlsNhW59DAx9IkxOH+pkd0U/m4ztkM2QfM0OYSPB7ADogLsICAWCgNYh6NxgqGHL40M31NnTutTc r0Eayq3p2w4lH57W6QuiwQkOe7pHziqnnOFAoKZ17R9K5ipZFbaFT1FDeUjfbIzUZ2b8FjGNEjY6 eCA2ykLrRA6hM5804Q3zVABLzmwUhwzKtO4cKOwvWofBubvwIZce9dunXLDA7LTq4QxeaF2n9Vxl nb6hb+JhDt2k03p7f3zN21PO2uF2QOsf+uCU1t/wWaJ1DvX2T7IxXoY5pHUmNo8OWPEDopLBCZbA hxiEiakmY1IVDwrs3HccApKslT8pGeILM4oT9ZI4SkykYG+u7k0Hpysq0XFSNphQFa3k0nQpoUvv eh/nsTWzYwVfc/re4zmI/orWNxLfT+ga1KF2uVtXTLPSuWuFXkLTkKZtMlMYukJ5Jk+HBXuzPWZe vKl6VxhD5V6IxOuqmJGwGZLW2SFwOmwOp0AH0JNK6KOocdzDlicP15zdikO8IVEwe7l91Qxh0jfU ANMh5MlTPPGY7pOmicrywr96DZDKKUefC1mca8N4/zAPSdNQIdyHEG5Nc2YDh5iTbKlPeKgRcMaG EHYW3eMn9QmDeUOIKy0BOGmdeZDD7B2HOLGJE4b5pBfTt4JBCKtyQ8W1NRI9H/83v8g1CEOjlS+A c3nC7+Lz3KR1nb7btXj3BUfom9cDp/KkdelD0/W0vqD10WldtM6Q87KFsbAQTDVPThpy0brT21PU A5Y+hSyrqqJCcAKwU2VI3AuhDKVgXLy5mgrgVt1O6wCFpKGJoCURVrQZs+Sp6UFZOVtbRy+9G3KH vgE8OoyruuPjSN6q12y+S3wJc5OOicaPGMFVwBnzmzrpVtssu+ix9W8qW7N3khKrGQxbUwi2soEU SrVYDavsnORrtijnI8giaYVdBPvMTuspF4nz5WsTiiR0TSZlAPQ7o++ke/wMT+tsb4gGh/hJSkVu Wk854xKZkpT7ttkA65i0m6f1lJvW6bEQikeaAFu6Q7mwNraSeyqgWr5/mbZDLFq3lQDBs1LEZhNW jQnhtppMKOdrZgAnXHrorhxOz4t1f2TK+8DeADqtcznDS5d3kpt0WofuOa2nnLXj5mR4Wm/y5SVM f1pnLNB6vjYcQAIU1qd1pqsc0j2Toku4zExHk6uN5jaG7em7yUVw50rpF6sUggfVjXMVLcFkbBYq csdvtVS2jq3UyvA3Qt+vZUTleNjZPH4dqQ02q8az03ohXyJQ3yofoKrisKfgmz57kwypx/qaB/KZ 5xKSqigrq+xwZr7wbNshkMPerbOcnZO0zm7RtUlyLudx1JK+UdNpHZJC3wdG2eb5XWdqxUanmlim C4dJ3+xMn76zazoa0jpUIn2yJekbjpOcGc43E/rltM4WUjCplrSectM6bpPuCY/BMoFMTj5cESiN mZ/UB5vWlTPQer4niDP9GPe0hTnxw8KefIIxrUOscChcjCRpEf9ICA8Fzto3T+uiad2tpx9fwuS3 DwlAp3Wcc7lP1Q+zNL2EuXVaz36ZQM9JAhZ9tmed6iThTCf3jhgQifhxxt2iYLfOqvRYdFIT7Mdq AOmoqZ2mjzM7sZkxCE85pjg1BAupqlVAVmq1jhVaF8dns3knswm3e/aN6B1VhuoXwNlLGAW6LgeE FVzZt6699a0zDylP3HuQ5IxO2t6rn7bgRfpmltNL4Wu2kKiZ/ek9CQv07C+i4bQo7pCyNG0L4+hq JcNTADhM+qZfaRY5bukCIU/SN/Sku3WGkHL4d3Fa1x6j1IbRbknaJeDZJQyETgzshKJPeDA1tMLD EAQo9eamKVkbjAcvLgDzPK3rOI/QfuSWQWkO9TKQBwaCZjmto0bXHMnhVgC8z8ePSf1MKbOnY3ue 2Tm8cyovp3XROnLCSHo1rXPthjenimj9sUuYM6d1qJwJ9PxowimRmO8y2QrWihchVfiLEkYTpgtJ KJUqJjKqwj2wTlHoq72telGJflbBikrk69gcqgHRulWYJg0KoCZK6adVStTLdoTf72Rw1U7x28BV EuHlev04tj+J1klr7wqiuffRZksrMaB99gDloTCdPBPsXtJbES6qpSmdLDBUNTyt89UF71UR/VCN 7USi+NwNU2cVkmLLaYaJId8o9GsrdQRxIORJuqdpcVrHJ/rlWD2kdagHhkVZe8Y7h9h6miazUS5u GRfm9Jg07VM8TZjoIcekLGHq0xdNuRxMYFFQK7ZoypUd9kuMeaF1DNHn5QRBc43OZ6TvfNM7WYUc DrOKFQdt+Np/swVa7z8y9Wmd390f0nr5yFS0zhvlOd2tk4QMUGNkfphwlRKWuc15Tpx5aHnaQmTI KdvTLmGOC+W4bzHBkUv5zOSZeNZHWfouU7Lj7SjtkBSwyJqYJTdQq8ZCkwdlcpeQDLdEtqrSChCz H2Ujdx3JHaTjv5C7vwlD8hFEn6mKTKV0LEGZzlxdg4XyutPe7clOh27PCIc6JQyTY5H31fSWGdxj JOyH5Guf1jkWmdZ135JqNElITuDBty7QFodo8zLnaMjaubW/QScfmZrWC90PaR1W0mmd4c9O60lk onUCIDUxUYJq6lJtcVrXSEnI8hpAIk7BD+ZwNLHxcSWMg3/K1Adn2hMPvFwU5A1etkPc4hB5yUMk TE6hdQ2KJjriUdhUccixPamZZeKiptA6q+B1B0gH9me20zZP60WOz/60zsctyHlOfsGR9CNmHo4U 6d+0zmc2DJyHT4OZc508NPZhmcnfK8BcCEV5xpL0XCZSk9wE14NUSIxmVoVL6SqghXEc2FlNhWeg ICkFJLeO5AgNzObSt9VB4u02RsIEYB7IvfH48a32fNshv31aV+orlHWZFIZmqRbbvrWXFBNVUSs7 KvuaOZnJh130wux06CoVevOUkNOKv7wbqLJzCl9rh3Cd4u09PK37tjc9wJ4QgY+fbH5oS5GUfYVV oW9OlAh5/FZQAKb7lLOf0ccz+oXWpU8KpRxqgGFRZoe0PXPcV+Kh0DoBMy0op5zu1BelR0d4yNkz ChvsGYOpTeupjxx9YnM6odYr4LAcwzFESO/lKWrErGCQM11UefQrP5ygoea8MGF+4Fn/FUbu2fnL LcNLGO7Wme2kV9M69Pp7MXCd7ntah6Zv3q3PLmE8qwDTOqeKlOv2z7NaZmlRlYnY0GpQmCSNzrZs WbO2W5vy9eE9q3vubQrSdGmAvtUEWtN2YCc8B6ZQVbVcQE2KXyXmOUCs0IHfLZREpb1ZTb2jj2SP bWP2PKoT9g1apzNF9kzKISEuPN+r37tae8jWxPIzlCjz+o5S0hvuDg9CT2VjrGCBpHW2rkicUtuY ku87FjV2lNRwhRM2VZKa9xvUr9V0eCZ3qDNpnV5M31CGPQB8Wk+ehQphLqLCf9I3YaBPVEXuS5iW l5fsbK+cdMu5GLdDWsch3RV9uhN905SMiU/kCCnLYVz6+OFhNorCb3/s15DD+4RBMJ4HHOKNwGRI ufjIlFCZTK8ItnA6tzF8md1CPIvWfVqH1oeXMNAx33iZ0Xr+5io+Wbt2Kr/+yBS+5ir/Jq17sACf 1nlt5MSa1vPYgYIOGYudosRz+nkaBUgJJg0sQClMmbycuLHtnMFpkoLVelB0ULBJghbJcVoH6xkG rCYGovhdNZA8FSTRER48PMtjTpPIHbDh/XeXcgZu0LqC6MuHj/C9K1imZIB5J5WLsFSlORSmk5v4 6R6yi4W3zGljyCJpnR2lrySybUQrEMGa1iEgTPLI6f0pVxmeiIkg6TdP35iI1lFgS+uNIj8QCtxH LiZ96+cAhPhJOTscPxw5MUm+Fv+i3DZM+9un+59dJbZU09uCGPCccszRxBwyJTwPEDmXG8wAyZns Q3iib8pkZ53WtUaaChTy9YYCEoaQvEx3dKpp1EemKvFD18TgeIiZINFE7tcJQnwyJ8OPN03rulvH ME/NrBHvA+7oF7TOq8gBoM+E8LD0FjID3L3wo8C9lzDMKrnngWgeGAtP0jr+UdP8rEut+0wHwmLd s3VnsThfJ5E9gMXXSehm8BTKs5rIk9Z0EKuJS9FSKuBFVTqi7DYDxzDTxEK8SZ+pEChqVK+etqEa y09pfUbcMzkRJIst1HKpjNPWQgFYz9OHBM1SLfrSkVDbtVd4VpISdqk6TssNFEAZGiyQtA43cQxn RdmW4jU2lQg31dhgulvHOV8chAsKR2tL97TuSaDfNPFpnR0LKeROJgxIDe4z1xMkLCOSZdGT1umX OImH8Aqf4llLw25pebmdgJBomAoYE2wRopwxQJ10JHOa8h3GKOgxY5ATjbQo4xOJmNdTwfRmX7wS GG9GBcZK+iJ0YfwM79YJlVH49cN0MXvFJ0Hyt865NNffTNf31vu/CcNImWqO+USlKVJJlSM5f/6X b0nmX+liorjzoa8cERIInW/d8BtM/GnG9IMmTRzky9+EQc7oyENKGNxLTzx8kMOTi4sCavnC89ze BOYsETpVTEopehXV3lumrXBKGl/HIV1Vl+SbWned7ThCeCJo0y6SxBpRDlxD07g8zALUah3PQNqq lab6bEPYad0sbIDZyee8SZJa4uwo5WAzY+o8EZ8PWB1lSO56KHTrwrDoZJX9UPhatA7XiHYp4Yih GkJcsfAAf2rqTQub6Jiv7sSJwqK2pHWs9PJAAW+FlHHljc1+ptXZhnJSKmpEAunkGRZzBmVmpIu2 tV5q9A1OAvJpHeUkVrzRY9tm27bndWUresS/R40HRu0UwgqJW7FyGPqBSWSUf8oY5QyeMPqjqGyJ p6d1JkSTw6ph69jSJ0J4ky9Bwun5S0kwL2fzfIMSDDGzUmWxmGG4WP99CZPsKCeEjjBEgdt5+oLW yzdk9DdheEP88Ctfnz8liNadLXTngQCM6YsmT6n0+1LT1ctTopWVBN7UHLaPBzkmdzcqSNZPS7Br nZQYC1AajK2OHy4JRoE5WkmG1RR6pNZ3ikrNcjSN6Ssx02JlQHmmp3X3rdCpig1NZwbWFBjKh8Ji +JTqU/z3tpYAPOOEZ/k61JNqOEl6BcMC+fMsG8YMKKbWBkOtZ3/M4Q5Oc3ATu8vkJQD/mqkzeE73 mLDEaUK/fIWOXkRzIiwCgBNpElPgEBN8ahujiRMGnrTOd8BR4MIBNsGQBw+MKGd1T83jtG6CJmzM GRG9F1qna/pCzvbTWFBjQrB1eHREePCssxdN/KR/sFo1TE8LeY4hUy2HihzMDDBdGqaUC0MRRvI1 U5HJQ++MHc5FhznUNKIDt0LK/AmB5HT9ahLX6LAwkWBCGJTEQC+8yah6ib/rx34aD3zcigcoGxPe tSJ32FkdUW1/1f0Nn+WfCQqt+86dIz+ndazsP2ld08i7zWsq/8wPo8vZLrPq6QV44Sy0RPmAHwEp gCUBiHML4Z6v2lyglK72akiuWnV5eH3r0oY2kmhaNARhj4gqSZJVeZBEDmVo59IvMyMdrPSsaF0R yP5mOeOymdwObyqgaR2fjGw+BLnfbFsO6ZYPPZwX2o/BeVs0M/thUh6mXQ+tklheqtaUHKaDoznf QXzekwJsQuggA9MUwV9wBAyYfIQ5cnxan6lzSAASi1aAFQQUhqOSUPpgwNCK3UKrfEpBHhgOVUqB dCt522nHLtLbRT26X0xSghVV+6EqiXRyIZCccZiGrL4c2j+tSEpWMJMIFRhNVKFR/tWGr19E6Co5 sLdL8O3LkWjygHkw5HRPlSApqcLR8iATmB0F+RfAio54efj6nncGTURiP1R5Pcg/cs+AxqXButQQ KHk0IklyTsBXO/HT36y1tpMCyIGUiNpUIhdhweCi1weofGhSvKmapXtESCq2po2IKRWw41TwGbAl il9TJIW0Vat10iEmVFEWcJkmwqi1Z9sUK1pH+8xD9ijEooy8SNbV1D9L39ddpIdZXzd1birg+aYO y68AnNY2uYDtO+NSM6ewQ8Ri2kv2U7aWqi7lkyo3p3nOEqdD07qBUVbRY8vOjRDheg5Z+RrAnJOv t7TCU+nuAMMVz8ilrB5tKCuHgVuFQS6CacVDPt6HCMF9U0vi48xOqzsaRlgUVNXMe1G8EMST3sCa BEop20RyxSYTd2QTgDynGjSq+xBO2f1RXcyOHCLmnh2+pgQjAZTHZG0r6VuNqrsQGPpBjZAILMdO zBoIU+189hil6XzIaUHZq5NTscZKCXQASpU9STbOol9nxcNAaYM5QE4E+lI6yN0vuKnF/7HzcErA BO+xOOeLTg5T1/TyJjWZJ3YrQD7Vi0o09VzRei6J7HmTC9xV4sfLPDM86bkPSZIi73t0Llqz15nF 9kzkrH36uTkhqewkSOEQe5vRygbj52VdGnD65oGv+TFf1yxDc24VYHz9wI4ydxdwOr0ze0lwabuO jVZG2g92bXXZJ9ueadX4/Eobb1iiqccR0lH25dW3wkkwG/5J87WaIoQ9ORpzVC+knAd2yNcsjFxV DuZ+kIClk4bmd5n0CpLLFiyH+uHAk7aeBI0iZ9ujJi29AS2cAVZQTWIxcBLZFT4SQ8mgPBkmRgpn apYnEM6yd9UoXhf927HdAQtQMicei7EkrqLmjw2sLOCqPVuOudlfgCaEaKpfmey0fpJkZfzE8mRf hYWdauq9Jw5HVTQtX4OTUaWT7OgKxzH8fHKn57uwuiAAnZtYY8ailTbow9CO5VSOFcolMxzAemNb 7WHgDGYj4YQSCQ97aba1yjazCaHKFj8eTgbmsQhkiVqpynBo0vssaqlgzwmkgBXMzmVI4WVTsEHP 1ycl6SHx0Jy3CzfvhJTJ7FAFzpdeWZlofW3eH+StIENKLaL9wKSYOzEyDRZYWVQULDSwWyQSZpNb DXa1oHUNjZgdsIbgat+EiVul3DtpQ46fDFDrqc/8bvOr07qkL6zM7DE2eDFhiM3ptJ8sB5CMn9gK Bew8u5E7y19aSWj6yuMMuOg8XBWzUxKDyjOuZIUmoNd/3iuizN7L7cdb7RmGoK0F8HYC6FGT5NK/ 8nPcuTMcyftxPSY5Pxv9sva2pBPfKYTZ9YEnzKsH2hUL3+TiIUGnMP0svMHpum1nWoYvxcV0lRmu 1W4LsF5Db5abAXEl3MoJ4TolbgI8WMdYYFYqwWzlasvJ9g3x/ff7GY5C9bgcuSSak6EQheRladph mtCjlsZCT1SRX2i9zzlck3YzvkuCG9pqPFmmScqfgk923XdxM5ibCr1PS8gSY4F+k0tOfqSC1QyK n6dUfaicOVdyzKb0XvmZUElQJVjbV2ySo9Q2y+1kXJqo8tDXXj47Qvd4DXJE/Rx6elNNuPdgZU7H fODJ7QfEmhRsZk+Ofk6YfrkLap+XfupnkgOzLd+P64kSJb8Wzq7EayoRJtBaKxPATokZuKmTCsJZ 4tYKgL7J4RGkGVY4h6Mmba4cTpFIjcRAR+lR3Ko7Wck/K2UnAC/chdYdx/MASZF9ij+rHtNz4nv9 r6NdeC5N2vne/yQxmaFgzOalKnlpXccv/wsTR2Vgh45NEhScGda5CR4wSZ+ek7ZtgtkZEZImjN2l DZxCY3yCW7ld45g3s68Flv4ZqzLVZQ4XXbhJJtqQJBtkCrPrU81kdrCqPcVbfpPoi6aqKQRzC8RR nTB4xyiqm2OUggbiGdD85zCdG21l440rnZSkrenMnIV+W9YjGQRmbD6Tp5VxAVT1ZNZZR54vmdkN qgScVQ3Bkh543lJTQpRzTjRveca3iR1ICIcAAAAHSURBVNT+Py4dCLk0RMJCAAAAAElFTkSuQmCC --0000000000004623c405daa69340-- From nobody Sun Mar 20 07:59:52 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 302CA3A0CC3; Sun, 20 Mar 2022 07:59:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xmf-9YgGka0c; Sun, 20 Mar 2022 07:59:21 -0700 (PDT) Received: from GCC02-BL0-obe.outbound.protection.outlook.com (mail-bl0gcc02on20721.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d05::721]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBBCC3A0980; Sun, 20 Mar 2022 07:59:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gs8cC55NAOwtpWovCr7HO4aqQd0td68Wqzx3KMdn9L9lpTq/QHMd5BhM+La/sblHmy45yqF56z1pDDcJBVieOc1KDjZLtztxPWmghuLzNw+NlTKGF6k6EOOEqFng8+2hGONPgLrM2jz53AN2NoUrQm8dZgQQhCXrjI/bgtYUNyLIyyl3+tkvrAWVDW+RNGrOxx1qNwX7f22l9IY/rgs7fR8FSqiKVCGl7hf+Xox9w2/x2vM9WkjwimXWZ2hIQwpZvZCTmiKpjc9nafqYVHxezUu2yJMJYBvbteuhQ4B0PCQ20QHrSLKfqj9QC6Kzxn5nf9SeCmWCV/t4RElgSuyr1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zgFVJIIs57/sxdgCTCOX3+py18m1a7aY8mMP8C0Xcrs=; b=VWcIqvZmvfGr+Fg0qxIeqR4LqIrd2pBTjFjCyMOis38XCd1d8AhcjZFiCphI/xZDmguIyLZYTz5NpKP4lz5s7GTP+SdRkyrML/jL1qWDWvBAhF7AcKWQYZrIi2H0ap7X3L2u9xvn2L4Blm/IwWpLX73l24idSaEegJ4gfLs7GCXa3V/6fhUJU2QXydufhbx9JyvR5NiG+pFMYHGRBn75CUOxr5gIxxItvLO1UAlEkyT81Rqo75pymFqqqc4xD0SvJrKeJ0FSK4MOvzCKJRlHDB9/xK61XRQEfvui+7v9ITwYdFbHqSe6F+5lqk+zKkSGH5K4hxnXf7K3cw896LQ9lA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zgFVJIIs57/sxdgCTCOX3+py18m1a7aY8mMP8C0Xcrs=; b=wMqWkdiBX/G3tIQwwHNYmMYe+OlPydetX9yqDUM7sr677m7ljUwv+MLafsJFPLncQB/n5hj1MC9DTwy95Hnb0o60eiE6fzBxotvmowDgN/Syb4kTyzGU1fMFRsicOJho3P9wr4d0s3wjCKc7UATFOT5tZfs2DscdPaeoq/TDUu8= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by BY5PR09MB5859.namprd09.prod.outlook.com (2603:10b6:a03:245::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.18; Sun, 20 Mar 2022 14:59:14 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5081.022; Sun, 20 Mar 2022 14:59:14 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Nick Hilliard , Zhuangshunwan CC: Ben Maddison , "grow@ietf.org" , "sidrops@ietf.org" Thread-Topic: [GROW] ASPA and Route Server (was RE: [Sidrops] IXP Route Server question) Thread-Index: AQHYPGsQzjpOcZn830G15B6fX+k4Fg== Date: Sun, 20 Mar 2022 14:59:13 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: bfa1f168-8704-468a-8697-08da0a8232d1 x-ms-traffictypediagnostic: BY5PR09MB5859:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: zh/yKPtOr8NNpslLDdpgC9NDNm1gAYHeKj2fE8dG52OJI771/OO4+3IismnjSChN4/k/0OhzPQ9ENsvxz9ksoS6XVJcrXmiCjLOq39mXy4KoYsnMCjQ5DLK2vdZIta+uYOJM89ezrBcDmmUEEHDNDnn378d46WoFtTwAXJs8AjDoB1qJsI1el2v1XHnMdlpCc6ZaO/R4oc8LQN5xm+/7LGF9wfVgyO9PJWjbT7cngTwoZ5hm2x7nMs4FktyWDZwh0CMVAXviWLa7u33nf3t+PBjyIySKyVQbPdHx+OcS8vtpMGFQu95HWAT7RRe8CVm0X63F8Dr/yw9etCae+ZL0DPRrkwuUIRLAEfTuviFysKD0FMlgGNd+xRhqY5QcJ+GiJOgoDkIifFhIhx0BIYqTDkAw7K2wktmWVFOpF8bQMLA7EL25fS8pRAQb+IYYU27WktRe120cvYn4HVDgIPrpICoeIFhoSe9VUCbCdZHLcEtdbW94ul9jE/UZiV3q4Eizoon+oRc80oMx+GpSnWwpoqPCVnTyqs9cNqm9aBumaCI1K7/VZnwIPoFLEEoH4uHvefC1wj/7preqfv58Un7YzYeHrDkN1/n/DTp/Ln4n0IY13mAq3F6sL8Cj/ZZvVuk83O8nnJJB7gSoOEK8UXM5wWAXKOy8OlK8Dz0PrN+8fetHgBfmizs4QN0vo1XfSD6bk+G04l4Cz85GXG/42A2eTQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(55016003)(122000001)(53546011)(110136005)(54906003)(9686003)(7696005)(6506007)(71200400001)(33656002)(2906002)(508600001)(186003)(26005)(82960400001)(4326008)(316002)(8676002)(76116006)(66476007)(66446008)(64756008)(38070700005)(66556008)(66946007)(38100700002)(86362001)(52536014)(5660300002)(8936002)(83380400001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?voJEn84k1yShTPeQUeWAeJ/cQcXhgEJSJWGvmry4rn9DBiIOwlzdl6aBgFV+?= =?us-ascii?Q?lNxGJbeiJYyF+G53C1nZK8s4U52iTdGGfIE3jb4p6BSFygHrcFqPo6iXNAkM?= =?us-ascii?Q?gZadS5+TbSI88aGzHIFZXaFm/YfWVcFxejrVkQ0hVameSfyCvYxgDw++mmd1?= =?us-ascii?Q?K4yf07FzYwNLQUB6MYekOlYwWqp/G3UXKJ30erTWwfv1gtC8gCxX5TSK7C82?= =?us-ascii?Q?G6Oca8hDPL2POLyDtB3IJ998VpZLIbvSJZZje4ejJelH6uhkBxgQjH8n4wKb?= =?us-ascii?Q?dWNWqbubpxiiuDwbRivAIlxOSy9uQG7tSDxziTrKWSX1OGnDXkxxZHD7nfLA?= =?us-ascii?Q?xUrct/KLLNmx88UIHJ24MBlUsJE+ucuy7RRGzph2S0DKdlHCVktQC8ujsr5p?= =?us-ascii?Q?rCo87ln7oop68hQx/64za3m1ENf6c7ZcRHtBLxjWQ3okR3mRq2D9ofpOzUex?= =?us-ascii?Q?809aXUn9uRwe8GnRMXOxakuL3Z56d1gwUdn8+TNb2KwOd991Pai0sMURfWbk?= =?us-ascii?Q?bjNH5ZA+fZio5heoqMnxUBIa/yTKY+i3vXNJgBIpTSP3rC+PcaXtNPyS/RLV?= =?us-ascii?Q?C9KxYwlOCPnKn7qayVfqF0n5XnEYkNa6U1I52iEj25HgD5QcG1wI8ET1tKvU?= =?us-ascii?Q?2ua0IfFslI74vY2CxpuYC0YS0VY2foVhbD3p0rI3J+ypbXD19NN50n4LtgFx?= =?us-ascii?Q?1VHh6poaBaawHfanwCDtX0hPmwjeDW4kJ0LoMCvFZvTWGnc9aFkuW3WzBkwN?= =?us-ascii?Q?1SSWyVzRZpWP03oxrdr9zmWDmroLl0fRDgJN5vgrMfQDPs36Ad9pwBfaxDBc?= =?us-ascii?Q?z8p6cPz8jeA/uRI66x4r/QgRKGugeeYyhVGjZbhYQIlMIv10MgsDop0XIzMU?= =?us-ascii?Q?knXZeB6cWblsDtS96GAZmaw6chJcv0Aoic1KSIOUs3HYc4gR/SOPm19gI/XC?= =?us-ascii?Q?bYBDcRPsvXUDw3oNlTxdaMybedcChS3G0gowu3ZYp2bDNxKMy8c3Vc/s09Ke?= =?us-ascii?Q?hZFrO3JYuDehCD2DPELXptPwPqjWcdjZY9TW178ZnX0IiEKh75Ak30mfySAj?= =?us-ascii?Q?0c71C/ci0sUvr/x9hNd1yUBa8kKrIslMESbuCqbi5eZ3lGIF8R2XoNaWdhZ0?= =?us-ascii?Q?1+es9ywvxr1bkDf36xURTo2TjpApQWcHKGLzJREfEPKpp5xGjlbws9m8wGvF?= =?us-ascii?Q?yRvpjr09dgtA7MdP4nvTDIW+nFzxIBPM1Wv1L+Rp1y2GfjjTpEJEX/7cLVRK?= =?us-ascii?Q?e4PN/oFrOsm4y5B+eEiqH9uZK4/3KrkuELHtMOLBSH4ZpHY9I+G0EfcDT90b?= =?us-ascii?Q?0ylK6XqfV/g6nkb0AwWsHXRuAR8jvfYTjN+DkYdfRrzq2syc9bbq5lkeLLCl?= =?us-ascii?Q?49oXLc2t5qcJAAtOip0u1ySI4bxpCYSekTeLTTTm7LfUisgyujlQUpoHW0eW?= =?us-ascii?Q?lVp+Z1UDQHM=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: bfa1f168-8704-468a-8697-08da0a8232d1 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Mar 2022 14:59:13.9871 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR09MB5859 Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Mar 2022 14:59:27 -0000 I think a correction is required. Instead of what was said before - =20 #1: An RS client of an RS (transparent or not) includes the RS AS in their = SPAS/ASPA. The RS client also includes in its SPAS/ASPA any AS with whom it= connects in the control plane via the RS. only the following simpler statement is required in the draft: #2: An RS client of an RS (transparent or not) includes the RS AS in their = SPAS/ASPA.=20 The reason is as follows. Consider the following topology and Update flow p= er arrows: AS1 (RS Client) -----> AS2 (RS) -----> AS3 (RS Client) ---p2p (lateral pee= r) ---> AS4 (validating AS) AS4 is the receiving/validating AS. Regardless of whether the RS inserts it= s ASN in the AS path or not, the Update is Invalid (route leak) at AS4. Bec= ause once the Update transitioned to a downward path after the RS, it canno= t be subsequently sent to a provider or lateral peer. But with #1, the Upda= te will be evaluated as Valid (not route leak) by the ASPA verification pro= cedure in case the RS is transparent. But with #2, the Update will be corre= ctly detected as a route leak (whether the RS is transparent or not).=20 Explanation: With #1, the hop AS1-AS3 in the transparent case is evaluated = as Valid (C2P) (as part of an ascending up-ramp on the left) by the procedu= re and that is not good. I.e., the detection of the apex in the AS path at = the RS (not visible in the path) and inversion (non-upward flow) after the = RS is obscured with #1 (in the transparent case). However, with #2, the hop= AS1-AS3 is evaluated as "attested not Provider". That means that the detec= tion of apex/inversion at the RS (though not visible in the path) is effect= ively not missed out by the procedure with #2.=20 Thank you. Sriram =20 -----Original Message----- From: GROW On Behalf Of Sriram, Kotikalapudi (Fed) Sent: Tuesday, March 15, 2022 11:34 AM To: Nick Hilliard Cc: Ben Maddison ; grow@ietf.org; sidrops@ietf.org Subject: [GROW] ASPA and Route Server (was RE: [Sidrops] IXP Route Server q= uestion) Nick (and all), I was also rereading/reviewing Section 5.3 and had similar thoughts about t= he two options you outlined. As you noted, "the approach in Section 5.3 giv= es a workable outcome". However...=20 >... the RS should be treated as a provider by the rs client; the rs client= should include the RS ASN in its SPAS; the rs client should evaluate ASPA = as if the RS ASN were included in the path; the rs should evaluate clients = as customers Yes, I agree that "the rs client should include the RS ASN in its SPAS." Al= exander and I have talked about this, and he mentioned that this would be a= dded to the draft.=20 Yes, I also feel that it is a better option that the RS client adds the ASN= of the transparent RS to the AS path (for ASPA validation purposes only) a= nd applies the downstream ASPA algorithm. Algorithmically this seems more a= ppropriate. This is also better from a diagnostics point of view (if the ne= ed ever arises) because in this approach the relevant ASPA is used for vali= dating the hop from the AS just before the RS to the RS. =20 That said, I think there is a bigger issue about transparent RS in the midd= le of the AS path. Maybe this is what Ben's question was hinting at. I thin= k you are also raising this issue when you say: >RSs do not partake in traffic forwarding, so they are not part of the data= path between two ASNs; they're only part of the signaling path between the= two ASNs. This is a useful hack from a practical point of view, but it ca= uses algorithmic breakage in places which assume congruency between the dat= a plane and the signaling plane. One of these places is AS path verificati= on. > ....ASPA verification should proceed as if the two rs-client ASNs were di= rectly connected and each should treat the other as a provider Based on the above observations from you, I am proposing the following: An RS client of an RS (transparent or not) includes the RS AS in their SPAS= /ASPA. The RS client also includes in its SPAS/ASPA any AS with whom it con= nects in the control plane via the RS. The idea is that a path segment ASx-RS-ASy (where ASx and ASy are RS-client= s connected in BGP via the RS) will be always verifiable with this proposal= whether or not the RS is transparent. If the ASPAs are created by ASx and = ASy per the proposal above, then the ASx-RS-ASy segment will be evaluated a= s Valid in either direction. I think this proposal in conjunction with oth= er ideas discussed above takes care of both transparent and non-transparent= RSs in the ASPA verification algorithms. Does this seem reasonable? Thank you. Sriram From nobody Sun Mar 20 08:36:48 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FC4F3A0DD9; Sun, 20 Mar 2022 08:36:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.113 X-Spam-Level: X-Spam-Status: No, score=-2.113 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TFyIhmTcsNTl; Sun, 20 Mar 2022 08:36:34 -0700 (PDT) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on2116.outbound.protection.outlook.com [40.107.91.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37D343A0DE1; Sun, 20 Mar 2022 08:36:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nFodeg2U/eg4lRaBEIQNt+Mo0Dyj5nS4Bf/eSvxSH7dyoGAS2KjxDRsiDORZj69uECT8dnmuK/MHxFxD45cdJRXRIdeXtLNaQvZrFfAY/9qt29mEjeOJpxrQEMZUGhHoFsfCqRkjbYelPKYMdiBEWd3qLfYFani4PTfizx4jLeoyrk1tVFXfOgFRGlZPIUDMTAzHTmt8KTBmLe7YW3RglHvF9pXvIC8gVDopLIFrwDEtB+JfBLLs3QIWrabS92yhbl64BlFwXhvKaocElHqYOAtN5EWnErF52V4qtBbBsRVTHhn0s9RE0Cq4oxTNIUgxJ5+cB03udIXufivJqORg+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=POeCNtXRdBVL25aYggNdJGo1/UyT72eI6WEE2VowQmQ=; b=buS0faY1WZ89P1ITNkAlbF9rOLCBfCR61qZ9KlrEp5n92huhjUCQStUjh+mb/cA87A9SSrQsWMl4rcG76wADcq+PP+ltio1JID/5fH67ankAkAt0nTLG+icIkj4cj/vzOmkk774vLXIOM7k+S4WZafEUhgqz9SO4Zq+KslIfpY1Ca7BhIzOHY3EeaQwPnf1Gd+wbp7tM5Tq5E+f8fpD59Ri8Bu8UvowP/aTnGeKqLwqjL9Iki6tHaWP8O/dBPnmzfidFenc1dEDLGaw9APdvmBuzXo1kIqvwO7WQchukXdyMZDlMMf4yf8f+o7m6+aSNOLHnNxFLbSK1pcB+uHkDGg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=POeCNtXRdBVL25aYggNdJGo1/UyT72eI6WEE2VowQmQ=; b=K+dehvPV6AjxavTKcwdMi5ogi5/yni5CA0lhVGpeSkwUmPogDOtT7lxi1t5PkymmJEuBjRJCFBbE7pD56HJFKHjhCK5cUSxd8uR/ITvi1JCk5YrZllfLH/HARhQWlA4nCKzDfrUfrBpUnUquNN1Db2vFOvQt/4L0nAKAo8PEUSY= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by DM6PR09MB4807.namprd09.prod.outlook.com (2603:10b6:5:260::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.18; Sun, 20 Mar 2022 15:36:28 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5081.022; Sun, 20 Mar 2022 15:36:28 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Zhuangshunwan CC: "sidrops@ietf.org" , "grow@ietf.org" Thread-Topic: [Sidrops] ASPA and Route Server (was RE: [GROW] IXP Route Server question) Thread-Index: AQHYOnL2eGdqxDQHOUaGAFJVFwqZ7azIYnow Date: Sun, 20 Mar 2022 15:36:28 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d0f27807-544e-429f-94c9-08da0a87666d x-ms-traffictypediagnostic: DM6PR09MB4807:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: cttgVIBaFeGuRQcaC95oVvFgO6D5O3tUY2XEtFkACO2YRev5AJCZg6qRvr0AdDIFywvbXUj9w9euQEqi0iI//EOfvKm3zrXdcjwPNVCgkOpsoP/HAVcN44libcMyBUY8GtIn/RpWhTck4nBHBVneyv1Fy7rXVZNtijvR4ZBnA29FHko5fmFDeJ4KYQ4GWjia2ILI9zDdpKBzrak6fjyFTuiu43YsVU0dEcaG01/3Qp8PGlm1txSDlPv00mvyLbtheDNBrRiw8z5N2z2HS0gpK0ANaJrIwIFkI1rCzBulSAPkZwols1fNctOdDY6lCnd1hZ44KwHKpNDxq9lDLIhkY3gNrhxSxlO5gouiAld0mZ8bvcc4UZlsfL2EtOpsNzveO0iNpJH5ecfclhvtyVM25dZZonnEWen/krxiSnd/tma0eNTQm1o9lrc8lTXI6UqeqjG7R6aP6LOEklu00IYKmQroKiZfyPzGh0RXPYXugUXwy5cgQnpsVPKxAzDnnhYDXDIkyrqkWVO6h8NsLztPhhQ4NVsrRVFAw1cG0YANEzC7mjtchQ3bopZFZMqQ2VNIWuX7S4Bo/wcZmISiPcQ8FaDnftrEW004Zi+CMUu6+LORLoJVnqEiNw6qGmEM7onHR0SHT8w1fCZEugFh0rkXBHHIHlXTce0rtbTZZb+XckWHirdvVQcnaDZrn0L3fsYjisGYYT91V8GJ2XwTIbqexQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(38100700002)(66446008)(66476007)(66556008)(55016003)(64756008)(66946007)(9686003)(38070700005)(76116006)(186003)(52536014)(86362001)(4326008)(5660300002)(8676002)(7696005)(26005)(122000001)(54906003)(83380400001)(316002)(6916009)(82960400001)(2906002)(508600001)(8936002)(6506007)(71200400001)(33656002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?uYcvdW8JtbRbtUKTpCf/u/EEcYd1lbfS+povpXKOEg3WeGfIm3FPjIisw11I?= =?us-ascii?Q?n2YhVXjMBsvSEbKsj0WxSh/aVKLPX+HZBnhD+qHXVl9STQpv2sS3bijjX9ki?= =?us-ascii?Q?DWEPpPZN3/zPlsbRX17XvcoeuPVY9h+CPf2/XBqs+2tCdHMaQKindb1qAEDv?= =?us-ascii?Q?lNczxJjhyiV9q+EHt8tOP49Vlg6Oj3yOSnx90Kl03CCj5HxkUE0BPJuGGINF?= =?us-ascii?Q?z1NUppsXog/4f1Q2P9SCtr8mqhE48YPhqA8QM2xRS2+nEHoQfTh+O/cRhmk2?= =?us-ascii?Q?WHps7W3BxrJ6PoDNpCrAkAz5zYP0rzM/9Yxpm5c2XmQ6qfuY5eOIdap4o2KE?= =?us-ascii?Q?hjhDxtTns/FED1pkdveV0MSHSXWRDBjpWaUdoJp2itQFJb7sGkjxwvZlRz1O?= =?us-ascii?Q?B2+p9gUhrXccXqRq52y8TyyKaVwdR0AWoq616FHJspO2xGbHc/OShfPYygXE?= =?us-ascii?Q?bhkOrdLAQ2jwisD3l1DiiBplTD2we5ns1p2fj3H6cQ44/O5BA1DquniRuUn7?= =?us-ascii?Q?dw3vuqoAZWGnRtlUAWtwwWCc0e30MS8YE7JJ76UujJO1xkg8Dt9FvJpBckJJ?= =?us-ascii?Q?zIFg1KJJsIFGctZbWZz7hEgYr+Aa+yiNR/silRqOnfWsPhmNebM9OEzwo9C3?= =?us-ascii?Q?e84ZWD5CqcfjLhzhPTJQToXTlJpecjeSgtShEIqWS9gCjfABYMQQHloBq/EN?= =?us-ascii?Q?dDA+T/Tw7l9lVGwg7EyG06ecd+z1FKU6zG6rIhbkhJg0vf5M3N29uwHLFuDh?= =?us-ascii?Q?Rd8uGONv1CVEAfg11WW4r1FMBSa+/Gznk9VsImqoEPBtkZTAm/ADdguwYs3Z?= =?us-ascii?Q?sJyRIE5b6jrL/xtyaNj0ebE9+2xtAh0PJDFtueAAc7C97Q9NyXkAIjpc2L9b?= =?us-ascii?Q?69Ff4psUA+DV8j+cj/VIb/boFXWcQpGag+y+mo4e/WEQYyYSjGfQS0MkaYkO?= =?us-ascii?Q?7F8sUqF/XVE92SJsvP8hc1B1L7nXNBOG2vC/U0+8BchezQmxY+0KHcF1X6av?= =?us-ascii?Q?YOwtNSNHIpVrpX6kPTriONBKtLrVWALwX0nEbFeemr2KFSSifFHYP/OJSfS3?= =?us-ascii?Q?ObgjvWJdR9U4zhujFGN7KFLfapFJta7kaRbWTHxGiTj5CBZT7sfrP147B9L3?= =?us-ascii?Q?oNABHjoOXAUgzkiZUGqqTn9153pG/JHsynQsbH1PVy+6Yc1AO3qzd5TFgYT6?= =?us-ascii?Q?tpZ1H8QdGyYawoe53Nu3evb9wkqaaRPqqj88RgicxGWMiNbehxEkWv129EFm?= =?us-ascii?Q?4pWY0GZ0rekg0KpXVQV5xwUjh4yJNRusRoOl78NHyMiHWWVaKgLjjkEe/Akc?= =?us-ascii?Q?KFUGEeX9klKcSHTiUd63IEzsY2RjycwSVQbPJCiFAMp2AUcmVPYFsUMTRBfi?= =?us-ascii?Q?BYIhVazTwOCA+dZ9/N9F8lK0Dez9m8uS06XoWg6dPQNS+gaBjnG7R/y7lRHh?= =?us-ascii?Q?3E4ngJNIEYM=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: d0f27807-544e-429f-94c9-08da0a87666d X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Mar 2022 15:36:28.0885 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR09MB4807 Archived-At: Subject: Re: [Sidrops] ASPA and Route Server (was RE: [GROW] IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Mar 2022 15:36:39 -0000 Hi Shunwan, Please see the comments below marked with [KS]. >> An RS client of an RS (transparent or not) includes the RS AS in their=20 >> SPAS/ASPA. The RS client also includes in its SPAS/ASPA any AS with=20 >> whom it connects in the control plane via the RS. >> .... [SW] IMO, this idea essentially solves the problem of ASPA verification. [KS] Please see the previous message I posted on the list. [SW] Regarding "The RS client also includes in its SPAS/ASPA any AS with wh= om it connects in the control plane via the RS.", is this equivalent to si= gn the AS pair of the P2P as-relationship to the ASPA database? [KS] p2p relationship is not signed/registered in ASPA. The way it works is= ... if a hop ASx-ASy is such that ASx has signed ASPA but has not included = ASy as a Provider, then that means that ASy is "attested not Provider" of A= Sx. In turn, that means that ASy is a customer or lateral peer of ASx. =20 [SW] Back to Section 5.3, it said "A route received from a RS at IX has muc= h in common with route received from a provider." Actually I also think tha= t "A route received from P2P BGP neighbor has much in common with route rec= eived from a provider. (for ASPA validation purposes only)". Does this seem= reasonable? [KS] I don't see it that way. A provider may send any available routes to a= customer but lateral peers (p2p) may send only their customer routes to ea= ch other. =20 Thank you. Sriram From nobody Sun Mar 20 09:20:05 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2F643A0FFF; Sun, 20 Mar 2022 09:20:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YXMF4WpT4-Im; Sun, 20 Mar 2022 09:19:52 -0700 (PDT) Received: from mail-pg1-x529.google.com (mail-pg1-x529.google.com [IPv6:2607:f8b0:4864:20::529]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65C433A0F9D; Sun, 20 Mar 2022 09:19:52 -0700 (PDT) Received: by mail-pg1-x529.google.com with SMTP id bc27so8680841pgb.4; Sun, 20 Mar 2022 09:19:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=P+XdRKNiUFXL+BNNYULrHtRSji1Z7Dck/bXEP2RdlXg=; b=iP8Sg1pu7Hwevpl+D1wurkPpZPZoz6Cf1GLIDlXazu82hz0MkaBOirT3YCyt7aSigz lr27irnDQDa7DsrHWORxl3hvU0tm5rVXsfGb2lupxsdf1LUzhVvuvgTCZpvy/hQrKecz tZ2btqDlMjirMsnNImw8HMiVMrSaAUrfF7VyqonMzOibgbBvAoW5R8YAiJrKiUieigKp cdeNE8YhGsLf1KqC+M8TUxP2gPZoWYTjJPbzVQsIJT+c5KrM427kt2Y3ILd1yafgP4KE hePskTGx8q0ObtjjAgdXoc83wkSR1y8IW7HrOJwoIx5ipgA5wET1uAgKPwxZAfMTIu2v Y3EA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=P+XdRKNiUFXL+BNNYULrHtRSji1Z7Dck/bXEP2RdlXg=; b=7b+nlq/N9Ao48bz23VNRGFfgj0RWzqqBkLJlsqct3LuP16VI+/2MHaAuc3EMgiTnXb RZBiMj3VU6/yJCb9iYp/QcYCnEkzLy2DZRlvqF1a2kBbp+KtrnHPore2GNI4hoPLQtMX tSncOTl1h0CwmgjU2+23Gx/Ei8bk62afpJLDxZJFZe9zrFKYh07xCIjBD4tiRivSKMHM qIjWpVhDDBah6gMxeqzssgbTE3ujqRFSbx71wKPQVS0RbrOj1FAYWtkl4vHkMOf0A2UP W+RscuVUvAg5BYI7musNlJDcrwbRXIRmRWufWsKWLtpczceuzwPfrB7DutYc2WdetpHS 2+IA== X-Gm-Message-State: AOAM531B7Lgl476ybR14eJcgHIcp2D+eDKPuo95DERpsD1UC6cJ3kHk9 t+DqEy5qat23G1E9x9N4FjlXHLpyckaefTS+WWs= X-Google-Smtp-Source: ABdhPJx8QLR5gGuhj415+VhkSXNCt0HRX2p5EOD4FNRXu9DPI7ovlhPaUeC1H5yv8WyAyF9zuoic2nlMN7c93NmdacI= X-Received: by 2002:a63:6c01:0:b0:37c:73a0:a175 with SMTP id h1-20020a636c01000000b0037c73a0a175mr14923941pgc.415.1647793191118; Sun, 20 Mar 2022 09:19:51 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Gyan Mishra Date: Sun, 20 Mar 2022 12:19:40 -0400 Message-ID: To: "Sriram, Kotikalapudi (Fed)" Cc: Ben Maddison , Nick Hilliard , Zhuangshunwan , "grow@ietf.org" , "sidrops@ietf.org" Content-Type: multipart/alternative; boundary="000000000000d1ecc605daa8bf1b" Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Mar 2022 16:20:02 -0000 --000000000000d1ecc605daa8bf1b Content-Type: text/plain; charset="UTF-8" Hi Sriram On Sun, Mar 20, 2022 at 10:59 AM Sriram, Kotikalapudi (Fed) wrote: > I think a correction is required. Instead of what was said before - > > #1: An RS client of an RS (transparent or not) includes the RS AS in their > SPAS/ASPA. The RS client also includes in its SPAS/ASPA any AS with whom it > connects in the control plane via the RS. > > only the following simpler statement is required in the draft: > > #2: An RS client of an RS (transparent or not) includes the RS AS in their > SPAS/ASPA. > > The reason is as follows. Consider the following topology and Update flow > per arrows: > > AS1 (RS Client) -----> AS2 (RS) -----> AS3 (RS Client) ---p2p (lateral > peer) ---> AS4 (validating AS) > > AS4 is the receiving/validating AS. Regardless of whether the RS inserts > its ASN in the AS path or not, the Update is Invalid (route leak) at AS4. > Because once the Update transitioned to a downward path after the RS, it > cannot be subsequently sent to a provider or lateral peer. But with #1, the > Update will be evaluated as Valid (not route leak) by the ASPA verification > procedure in case the RS is transparent. But with #2, the Update will be > correctly detected as a route leak (whether the RS is transparent or not). > > Explanation: With #1, the hop AS1-AS3 in the transparent case is evaluated > as Valid (C2P) (as part of an ascending up-ramp on the left) by the > procedure and that is not good. I.e., the detection of the apex in the AS > path at the RS (not visible in the path) and inversion (non-upward flow) > after the RS is obscured with #1 (in the transparent case). However, with > #2, the hop AS1-AS3 is evaluated as "attested not Provider". That means > that the detection of apex/inversion at the RS (though not visible in the > path) is effectively not missed out by the procedure with #2. > > Thank you. > > Sriram > > -----Original Message----- > From: GROW On Behalf Of Sriram, Kotikalapudi (Fed) > Sent: Tuesday, March 15, 2022 11:34 AM > To: Nick Hilliard > Cc: Ben Maddison ; grow@ietf.org; sidrops@ietf.org > Subject: [GROW] ASPA and Route Server (was RE: [Sidrops] IXP Route Server > question) > > Nick (and all), > > I was also rereading/reviewing Section 5.3 and had similar thoughts about > the two options you outlined. As you noted, "the approach in Section 5.3 > gives a workable outcome". However... > > >... the RS should be treated as a provider by the rs client; the rs > client should include the RS ASN in its SPAS; the rs client should evaluate > ASPA as if the RS ASN were included in the path; the rs should evaluate > clients as customers > > Yes, I agree that "the rs client should include the RS ASN in its SPAS." > Alexander and I have talked about this, and he mentioned that this would be > added to the draft. > > Yes, I also feel that it is a better option that the RS client adds the > ASN of the transparent RS to the AS path (for ASPA validation purposes > only) and applies the downstream ASPA algorithm. Algorithmically this seems > more appropriate. This is also better from a diagnostics point of view (if > the need ever arises) because in this approach the relevant ASPA is used > for validating the hop from the AS just before the RS to the RS. > > That said, I think there is a bigger issue about transparent RS in the > middle of the AS path. Maybe this is what Ben's question was hinting at. I > think you are also raising this issue when you say: > > >RSs do not partake in traffic forwarding, so they are not part of the > data path between two ASNs; they're only part of the signaling path between > the two ASNs. This is a useful hack from a practical point of view, but it > causes algorithmic breakage in places which assume congruency between the > data plane and the signaling plane. One of these places is AS path > verification. > > > ....ASPA verification should proceed as if the two rs-client ASNs were > directly connected and each should treat the other as a provider Gyan>I understand the issue with the ASPA path verification, however if the RS AS added to ASPA then that would influence the forwarding plane is the issue. How do you insert RS AS for the ASPA path verification but not allow RS to be part of forwarding plane? I guess you could do a next-hop-unchanged between the clients connected through the RS. > > > Based on the above observations from you, I am proposing the following: > > An RS client of an RS (transparent or not) includes the RS AS in their > SPAS/ASPA. The RS client also includes in its SPAS/ASPA any AS with whom it > connects in the control plane via the RS. > > The idea is that a path segment ASx-RS-ASy (where ASx and ASy are > RS-clients connected in BGP via the RS) will be always verifiable with this > proposal whether or not the RS is transparent. If the ASPAs are created by > ASx and ASy per the proposal above, then the ASx-RS-ASy segment will be > evaluated as Valid in either direction. I think this proposal in > conjunction with other ideas discussed above takes care of both transparent > and non-transparent RSs in the ASPA verification algorithms. Does this seem > reasonable? > > Thank you. > > Sriram > > _______________________________________________ > GROW mailing list > GROW@ietf.org > https://www.ietf.org/mailman/listinfo/grow > -- *Gyan Mishra* *Network Solutions A**rchitect * *Email gyan.s.mishra@verizon.com * *M 301 502-1347* --000000000000d1ecc605daa8bf1b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Hi Sriram

On Sun, Mar = 20, 2022 at 10:59 AM Sriram, Kotikalapudi (Fed) <kotikalapudi.sriram=3D<= a href=3D"mailto:40nist.gov@dmarc.ietf.org" target=3D"_blank">40nist.gov@dm= arc.ietf.org> wrote:
I think= a correction is required. Instead of what was said before -

#1: An RS client of an RS (transparent or not) includes the RS AS in their = SPAS/ASPA. The RS client also includes in its SPAS/ASPA any AS with whom it= connects in the control plane via the RS.

only the following simpler statement is required in the draft:

#2: An RS client of an RS (transparent or not) includes the RS AS in their = SPAS/ASPA.

The reason is as follows. Consider the following topology and Update flow p= er arrows:

AS1 (RS Client) -----> AS2 (RS) ----->=C2=A0 AS3 (RS Client) ---p2p (= lateral peer) --->=C2=A0 AS4 (validating AS)

AS4 is the receiving/validating AS. Regardless of whether the RS inserts it= s ASN in the AS path or not, the Update is Invalid (route leak) at AS4. Bec= ause once the Update transitioned to a downward path after the RS, it canno= t be subsequently sent to a provider or lateral peer. But with #1, the Upda= te will be evaluated as Valid (not route leak) by the ASPA verification pro= cedure in case the RS is transparent. But with #2, the Update will be corre= ctly detected as a route leak (whether the RS is transparent or not).

Explanation: With #1, the hop AS1-AS3 in the transparent case is evaluated = as Valid (C2P) (as part of an ascending up-ramp on the left) by the procedu= re and that is not good. I.e., the detection of the apex in the AS path at = the RS (not visible in the path) and inversion (non-upward flow) after the = RS is obscured with #1 (in the transparent case). However, with #2, the hop= AS1-AS3 is evaluated as "attested not Provider". That means that= the detection of apex/inversion at the RS (though not visible in the path)= is effectively not missed out by the procedure with #2.

Thank you.

Sriram=C2=A0 =C2=A0 =C2=A0

-----Original Message-----
From: GROW <g= row-bounces@ietf.org> On Behalf Of Sriram, Kotikalapudi (Fed)
Sent: Tuesday, March 15, 2022 11:34 AM
To: Nick Hilliard <= nick@foobar.org>
Cc: Ben Maddison <benm@workonline.africa>; grow@ietf.org; sidrops@ietf.org
Subject: [GROW] ASPA and Route Server (was RE: [Sidrops] IXP Route Server q= uestion)

Nick (and all),

I was also rereading/reviewing Section 5.3 and had similar thoughts about t= he two options you outlined. As you noted, "the approach in Section 5.= 3 gives a workable outcome".=C2=A0 However...

>... the RS should be treated as a provider by the rs client; the rs cli= ent should include the RS ASN in its SPAS; the rs client should evaluate AS= PA as if the RS ASN were included in the path; the rs should evaluate clien= ts as customers

Yes, I agree that "the rs client should include the RS ASN in its SPAS= ." Alexander and I have talked about this, and he mentioned that this = would be added to the draft.

Yes, I also feel that it is a better option that the RS client adds the ASN= of the transparent RS to the AS path (for ASPA validation purposes only) a= nd applies the downstream ASPA algorithm. Algorithmically this seems more a= ppropriate. This is also better from a diagnostics point of view (if the ne= ed ever arises) because in this approach the relevant ASPA is used for vali= dating the hop from the AS just before the RS to the RS.=C2=A0

That said, I think there is a bigger issue about transparent RS in the midd= le of the AS path. Maybe this is what Ben's question was hinting at. I = think you are also raising this issue when you say:

>RSs do not partake in traffic forwarding, so they are not part of the d= ata path between two ASNs; they're only part of the signaling path betw= een the two ASNs.=C2=A0 This is a useful hack from a practical point of vie= w, but it causes algorithmic breakage in places which assume congruency bet= ween the data plane and the signaling plane.=C2=A0 One of these places is A= S path verification.

> ....ASPA verification should proceed as if the two rs-client ASNs were= directly connected and each should treat the other as a provider

=C2=A0 =C2=A0 Gyan>I un= derstand the issue with the ASPA path verification, however if the RS AS ad= ded to ASPA then that would influence the forwarding plane is the issue.=C2= =A0 How do you insert RS AS for the ASPA path verification but not allow RS= to be part of forwarding plane?=C2=A0 I guess you could do a next-hop-unch= anged between the clients connected through the RS.


Based on the above observations from you, I am proposing the following:

An RS client of an RS (transparent or not) includes the RS AS in their SPAS= /ASPA. The RS client also includes in its SPAS/ASPA any AS with whom it con= nects in the control plane via the RS.

The idea is that a path segment ASx-RS-ASy (where ASx and ASy are RS-client= s connected in BGP via the RS) will be always verifiable with this proposal= whether or not the RS is transparent. If the ASPAs are created by ASx and = ASy per the proposal above, then the ASx-RS-ASy segment will be evaluated a= s Valid in either direction. I=C2=A0 think this proposal in conjunction wit= h other ideas discussed above takes care of both transparent and non-transp= arent RSs in the ASPA verification algorithms. Does this seem reasonable?
Thank you.

Sriram

_______________________________________________
GROW mailing list
GROW@ietf.org
https://www.ietf.org/mailman/listinfo/grow
--

=

Gyan Mishra

Network Solutions Architect=C2=A0<= /p>

Email gyan.s.mishra@ver= izon.com<= br>

M 301 502-1347


--000000000000d1ecc605daa8bf1b-- From nobody Sun Mar 20 12:26:11 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 995873A0859; Sun, 20 Mar 2022 12:25:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.91 X-Spam-Level: X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Li8aG_gpdXn4; Sun, 20 Mar 2022 12:25:40 -0700 (PDT) Received: from khatovar.hactrn.net (khatovar.hactrn.net [198.180.150.30]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8D523A0854; Sun, 20 Mar 2022 12:25:39 -0700 (PDT) Received: from minas-ithil.hactrn.net (c-73-100-88-186.hsd1.ma.comcast.net [73.100.88.186]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) client-signature RSA-PSS (2048 bits)) (Client CN "nargothrond.hactrn.net", Issuer "Grunchweather Associates" (not verified)) by khatovar.hactrn.net (Postfix) with ESMTPS id B8D9D4E614; Sun, 20 Mar 2022 19:25:37 +0000 (UTC) Received: from minas-ithil.hactrn.net (localhost [127.0.0.1]) by minas-ithil.hactrn.net (Postfix) with ESMTP id 4AD522EA00A9; Sun, 20 Mar 2022 15:25:37 -0400 (EDT) Date: Sun, 20 Mar 2022 15:25:37 -0400 From: Rob Austein To: Job Snijders Cc: Rob Austein , Benjamin Kaduk , The IESG , sidrops-chairs@ietf.org, morrowc@ops-netman.net, sidrops@ietf.org, draft-ietf-sidrops-6486bis@ietf.org In-Reply-To: References: <164366773060.21391.16732854790829264927@ietfa.amsl.com> <20220225235526.GY12881@kduck.mit.edu> <20220227002536.3516E2EA009D@minas-ithil.hactrn.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.1 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Message-Id: <20220320192537.4AD522EA00A9@minas-ithil.hactrn.net> Archived-At: Subject: Re: [Sidrops] Benjamin Kaduk's Discuss on draft-ietf-sidrops-6486bis-09: (with DISCUSS and COMMENT) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Mar 2022 19:25:43 -0000 On Thu, 17 Mar 2022 10:40:37 -0400, Job Snijders wrote: ... > > > > NEW Section 4.2.1: > > > > Because a "one-time-use" EE certificate is employed to verify a > > > > manifest, the EE certificate MUST be issued with a validity period > > > > that coincides with the interval from thisUpdate to nextUpdate in the > > > > manifest, to prevent needless growth of the CA's CRL. ... > CA operators are free to set the Manifest's eContent nextUpdate and the > CRLs nextUpdate as far into the future as they wish, each CA needs to > make a trade-off about how they schedule on-call on the weekends. CA > operators can nowadays rely on RP implementations only permitting the > narrowest validity window transitively concluded from the entire chain. Except that you're changing the semantics of nextUpdate from "stale" to "hard failure", which is dangerously wrong and is not what the semantics were intended to be by the original authors before you took up the pen. E pur si muove. From nobody Mon Mar 21 05:43:42 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 091A43A13A7; Mon, 21 Mar 2022 05:43:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=workonline.africa Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id by_QoDDo1i3L; Mon, 21 Mar 2022 05:43:22 -0700 (PDT) Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on20604.outbound.protection.outlook.com [IPv6:2a01:111:f400:7e1b::604]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ECD523A1379; Mon, 21 Mar 2022 05:43:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Z1tRkETylZ+reHG6g9DtA4ysl2JoSyT0q7ec9JOfzuJ2msbtiW/XLA/A7qL6V2INK+PqIWokzV1u0zoihPrcynB6kdAkky4v6XvUytb5JcCnpMpki3IBFJ4gi3w5xk2B9kynBo499xw5aPPvAPF/ofBHQEfuC6rOZxF880z6Km9jObGx8cCUtGazeqGK+QbztzGUMuUewRPnOwoE/UHUi1ARjZ6iXcl6036OWZV41rwdYc7mDicD4pXVgKvkO/7Oi2tnOrgXeut7h4ATZmHL2Wq8teV/xa8qn3M3+aTVaBxq5AIR6nPnCptrgzFfjllkIEm7YzeykrXLao0o/BpAZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=jiQ5VcrD9k+c8pPJLb2LtEpYm4XrzUJGPp/Mw/Y7Ob0=; b=TRNdd93+2EY73dtzw8hjt+0m5CVXdQI98Kkaun3urSaGUc12NxvEWrO0x2ytgM+bN6rQu9UmFaSoDlYnbgNkffLXlDvnl1bzVzpDeXKmdAKplXePyynHQg7LYEHyu21sdKIvmZNCI0G+4FmFwfPTBMPIbaPSKBrstH6m3/cUSt6t8/ILWQSUWxTqo07IJnfsx+oglzVTsZ+ypYDw5weRwDAQj/xaCuUuZFs3LJ1n7RJXMkHNSC505mqr2ffB62f3ziYIL7MuEt72voEk9Mv5Wkd7y8/eu7dQvVUfMPSiABDyvn7661PPtpAhH36v570ZcT8hYCoKBznPd/hvTmS+qA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=workonline.africa; dmarc=pass action=none header.from=workonline.africa; dkim=pass header.d=workonline.africa; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=workonline.africa; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jiQ5VcrD9k+c8pPJLb2LtEpYm4XrzUJGPp/Mw/Y7Ob0=; b=oX8lwmOPWzrmV7b/qp5OJjl0t7ea6joiTA6KNeqFR8EQGHk0QdoKGeZCd2WvfFJj1QAIKEXt3BxaQdTlw0KEm5vZvoSdCBkOCQirJu6+K8ENscWlxZFFn4SHfoKnRkbTdpfvCSAHXIc35kZUiPOKbnEGAUNgP2I2nXAe6vIMi2w= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=workonline.africa; Received: from DB9P190MB1083.EURP190.PROD.OUTLOOK.COM (2603:10a6:10:227::9) by DB9P190MB1404.EURP190.PROD.OUTLOOK.COM (2603:10a6:10:243::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.15; Mon, 21 Mar 2022 12:43:08 +0000 Received: from DB9P190MB1083.EURP190.PROD.OUTLOOK.COM ([fe80::ac44:12ae:28e1:e4c8]) by DB9P190MB1083.EURP190.PROD.OUTLOOK.COM ([fe80::ac44:12ae:28e1:e4c8%5]) with mapi id 15.20.5081.022; Mon, 21 Mar 2022 12:43:08 +0000 Date: Mon, 21 Mar 2022 14:43:05 +0200 From: Ben Maddison To: Rob Austein Cc: Job Snijders , morrowc@ops-netman.net, sidrops@ietf.org, sidrops-chairs@ietf.org, The IESG , draft-ietf-sidrops-6486bis@ietf.org, Benjamin Kaduk Message-ID: <20220321124305.kidxww4pje6dbndd@benm-laptop> References: <164366773060.21391.16732854790829264927@ietfa.amsl.com> <20220225235526.GY12881@kduck.mit.edu> <20220227002536.3516E2EA009D@minas-ithil.hactrn.net> <20220320192537.4AD522EA00A9@minas-ithil.hactrn.net> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="joyypo2haemdam5f" Content-Disposition: inline In-Reply-To: <20220320192537.4AD522EA00A9@minas-ithil.hactrn.net> X-ClientProxiedBy: VI1PR03CA0071.eurprd03.prod.outlook.com (2603:10a6:803:50::42) To DB9P190MB1083.EURP190.PROD.OUTLOOK.COM (2603:10a6:10:227::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c751e4ea-9295-4630-f522-08da0b3859c7 X-MS-TrafficTypeDiagnostic: DB9P190MB1404:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: wfbbIitRTR5S5iIi/GGpswiKtImQZYaR+E81THRqAbORNwVDeyhksrn+6P/pnOu20KQXDva7HRdGhki8HZTJt7zuyR6mCOGprbGUR5EzIxNih1DJ06XLvEclyC1ctMays8KgzspKHPxjAzokmKPlmQTwj4DF6St+JKN0+06WDUl12wFIP4jZB/JgC9WrRwX+FFXoh7A/l1HYv90bnhiKFYHqTcYAqwk8TFV06BxOsNO8ErBcgDDRSGB+p12pIJa1s4Yzwgo0JdPjz0lKxjR1cuT7xtedrcUqR39GC+mXJhvITW49fC21WwI4RPdQq4UC6ZHJhhvs6V5Vq7R+c2BlvWkwCJdd5fmuCWv31P7hntjoy2A8Uu6N4U0KDYmND2xUMxl2OE+V6NQdUtO3rP+mzlMwZQnoByHBjQoZ/S71GcfNDN69vjW1banzzgxUdNCKULh1n/5helOjGzut7DA61PZESOHZ+7kgMFFPMB9+Dlcf+lz86Paa4lDYKwYkbK3Pxz4igv+1soeCGxOQScgZrcNIMPydzLi/LjjFx+nE/A0y/punsipu4u8203Q9BgA3Jf2MOT1hlssziWcQlAcmNfLTQ2nvJKm0jTg+Q6ydoT8Q8B3F9dPySpbMX/UWYR1SqzQbISieoyJT9mP8BcWf0lMZEIQyKUUWqmL6e2iaOosmNogm6caaog2wrag728OiupCr315glxIHb+TX21XY7IPig0sIraLuueCE6qJ6mPs= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB9P190MB1083.EURP190.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230001)(7916004)(376002)(136003)(346002)(396003)(39830400003)(366004)(2906002)(38100700002)(52116002)(6506007)(6512007)(44144004)(9686003)(186003)(21480400003)(83380400001)(33716001)(1076003)(6486002)(508600001)(8936002)(6916009)(54906003)(66476007)(316002)(86362001)(8676002)(66946007)(66556008)(4326008)(5660300002)(6666004)(46492015)(2700100001); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?zq3bwz7AmT59GSULS5R6iHgW1OlavDE/1+UaaUK1j4kszXf5RB7AmARu4gUY?= =?us-ascii?Q?7O7tmi+7L1AUxmx3rmZXW/AMGjS/DxZzQ+b8DYClHlrMGaAhGWq1qzLcCl4v?= =?us-ascii?Q?utXA6GgUQrYtIWHSEGJmpqVyv6dvJj00ygTyTcAxzRtX+HW5ncegXZmj5IRx?= =?us-ascii?Q?UrRHwwY+QRjKPIit8Jil6UFYhf/1Y5X3vDvWzRFq4u5ikPZrcetl4WU+b3mv?= =?us-ascii?Q?iSitAw9cYaLR/Bs2HBcLU1S1O9j4aRoAinroiC/UTBaYy+cfhg6rCTRwgbiC?= =?us-ascii?Q?nXMYPz2jX8Q2qfKb5PiBrtXc/3nStfpZfovvH0ylVrV0BbrCqLVHRjIh9QLq?= =?us-ascii?Q?bhnJyDP35LJ4IWnnN81qietIxyhwv/NPG3pn9SnrNdsFEnvRLfvTztKjtMpX?= =?us-ascii?Q?kVbFCAntPj55M19meO1WoSYNvabaVw2eyLP++aq/tWga2cnXb3kZfwV5tx1l?= =?us-ascii?Q?BnHz8VuWnTxlMU+1g6aLdjaFzx2JSYPYa4K3hy9Geuk1o+i+c/ZAb+ss4HWu?= =?us-ascii?Q?adryceLA5lje/9QnWqXj4HfuEeSB36bw8XZ5PEUbI7LG6dm0cHR4F9vSxO7g?= =?us-ascii?Q?vt1R0HLXRz6MhbCX+U0UD0DOXl/auMAAvg0v73NWQ327VwcFwmAY084kuO4X?= =?us-ascii?Q?LRK0GwH6R0IGXRWgkmd/d90kG4KMJjps3s1uom75+x3Nikq36AypDP6jEFue?= =?us-ascii?Q?Xd3YHcWSpd2XZWqlK48NgKVUdVubSRvTP/MiP4TGa/1sJZPQXvQIkhrVrvbU?= =?us-ascii?Q?yXGCmcMGgg4RYJBMnxveH75tL3S6vfw0gU08Axbh1aPofJJ8/wspYFeEm48s?= =?us-ascii?Q?OfKemhxPAgvDumjzI9kWyCCl54nlciCV5wGL7qj/DF3prNnc4cKUNynNUu6l?= =?us-ascii?Q?ijSugAumiCk626ppvsFgaS1JuO0jFagFm/lh+CCNJ6WDvc1mCdZG/bYznPAt?= =?us-ascii?Q?XojPR1C3W4MIHUnRYlfQ+I+PCEMhMHRdVsaZm8OF32FvhW1j13L3HtyUTfWT?= =?us-ascii?Q?Dg2O5xpPw0ubnqjEEFytJrS0/R9HmpNE8DsbPP8MKgEyLaIW7LwfRNLhudME?= =?us-ascii?Q?Vnts8snIL5W1ifjUNbX484WJ20uZH/0ckXg2tCxDVpIJtXs+DnuPzxUNggTw?= =?us-ascii?Q?cNOMWI9RksFtBm3vICkEdhtJe6mowuqKYhJcJimjVMkzxdJJEFo2tCvicgpz?= =?us-ascii?Q?vTWR34klzq5E6JPgF+vaHFk1UDnHl9zJVjUVg/5P3D+Ol8te/U398vI4NAnl?= =?us-ascii?Q?KBwcFig27aiWSiJCCygpcxKmj/S/QP4O5fGGdt+C4hSfNDCtDgKqyrNRx0Ky?= =?us-ascii?Q?/4xmuLmDaEzhl6/oMYj4wvHszAv/OoTECoZ2MM8Dqqftmcnv2gqby1Rx6f9/?= =?us-ascii?Q?fpU3cG8RUPXK09g7m+8UMlQqPjDiq93yFu/i2fBzSP9Ri7WEUkJUw5uraZ3c?= =?us-ascii?Q?goprm/t0atL+RlVOhlM5BSe6pPpjzVnNuNHWKWFeKRLMZmN6jcIRKv3/cv6r?= =?us-ascii?Q?egOQrf/7BfH64WXHxDMAD8dXGs9O8gepLx/c?= X-OriginatorOrg: workonline.africa X-MS-Exchange-CrossTenant-Network-Message-Id: c751e4ea-9295-4630-f522-08da0b3859c7 X-MS-Exchange-CrossTenant-AuthSource: DB9P190MB1083.EURP190.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Mar 2022 12:43:08.1196 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: b4e811d5-95e8-453a-b640-0fba8d3b9ef7 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: SpkKc5hLdnKVXLJWQ8kPF2eMd3tmaCeZwEAm+IOMciNR5diwnTQz1cSD3rkGCfc0QD0rObkqgFABs/vnKvux2Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P190MB1404 Archived-At: Subject: Re: [Sidrops] Benjamin Kaduk's Discuss on draft-ietf-sidrops-6486bis-09: (with DISCUSS and COMMENT) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2022 12:43:28 -0000 --joyypo2haemdam5f Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi Rob, On 03/20, Rob Austein wrote: > On Thu, 17 Mar 2022 10:40:37 -0400, Job Snijders wrote: > ... > > > > > NEW Section 4.2.1: > > > > > Because a "one-time-use" EE certificate is employed to verify a > > > > > manifest, the EE certificate MUST be issued with a validity pe= riod > > > > > that coincides with the interval from thisUpdate to nextUpdate= in the > > > > > manifest, to prevent needless growth of the CA's CRL. > ... > > CA operators are free to set the Manifest's eContent nextUpdate and the > > CRLs nextUpdate as far into the future as they wish, each CA needs to > > make a trade-off about how they schedule on-call on the weekends. CA > > operators can nowadays rely on RP implementations only permitting the > > narrowest validity window transitively concluded from the entire chain. >=20 > Except that you're changing the semantics of nextUpdate from "stale" > to "hard failure", which is dangerously wrong and is not what the > semantics were intended to be by the original authors before you took > up the pen. tl;dr: I think -10 accurately reflects the consensus in the WG. One of the primary motivations for this document was, from it's inception, to clarify that a Manifest with nextUpdate in the past is stale *and should result in a failed fetch*. This is set out in section 6.3: If the current time is later than nextUpdate, then the manifest is stale; this is a failed fetch and RP MUST proceed to Section 6.6; Then, in section 6.6: Termination of processing means that the RP SHOULD continue to use cached versions of the objects associated with this CA instance, until such time as they become stale or they can be replaced by objects from a successful fetch. Both sentences have been present since -00. Thus, an RP that encounters a manifest with nextUpdate in the past will attempt to fall back to its local cache. If the manifest (if any) in the cache also has nextUpdate in the past then it is discarded, and its associated repository is not processed further. Clearly an RP will similarly refuse to process a manifest whose signing EE cert has a notAfter in the past. Thus, for all practical purposes, the terms "stale" and "expired" are synonymous when applied to manifests. The time at which that happens is the *earlier of either nextUpdate or notAfter*. The text of 4.2.1 is merely incidental to all of this. It is there for no reason other than to limit CRL growth. Cheers, Ben --joyypo2haemdam5f Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEadkaB2uV5dm5UllaOkYk/rSLaGAFAmI4ctgACgkQOkYk/rSL aGCzJRAArfh3m+YnAhg3zYUVd3WZmIwAqudfkLMOhM+qepYAi3AYBoEQuEqKcNt7 l7sYrdvWtMoGmEv7HNmXOiyTQfA60tK1FBoW3UZtal9nln5gtLdCHmt1TZBW6yUy KJckjrualmna+JW3/NzldazL5DHS02VnaPJOP82cq3S3T8bOLJC7dfKIkBipRRRV C+UpWQDgHE3QAG6Tk8QT4/09JQBtwnqQ3N4OWbAj+puiiG/pskO+WeXRp6SNynuD hb+DrHxMFkgCvIyy8pxuG3BSC/wI7o/jDVXVIxivb0ECR/aiSvPoIKvJLkOcPLq6 jLLO4m8nNZvNBtVjOsAENtM7obbeUKhjSGhnVcLQiupeQR6jnrZlnmYL4j5fV5bs VKS3unXrM+MYQjtGbWyMPxngVDe1xQ3uoSyodjIXzpi31b6fHgcuzz+Sy/Vm7XhD zt4MN/hFsMDv6OfB3mjedjdZDERzV0bnIkvhoEvtPCPvVHyFnx8OCn5znOMYEzqK W8kUWSiBZD35xTyYOV4VODTh/EKXoX0xMmomgI8EhHv3+K6moFGuDVz4Y6GzV9t5 k0+TpWKguK4sQ8HmT2N/+NZa22AA7Po87yKxgMHlrZuNauMeeAwFGyFvaR4kdfEY O+iK2oErHdyXEkgEGCUuUPOHKJtNviz7logFlqFvQdHgpRCfiNI= =7CMV -----END PGP SIGNATURE----- --joyypo2haemdam5f-- From nobody Mon Mar 21 08:13:26 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B76F3A08A1; Mon, 21 Mar 2022 08:13:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.594 X-Spam-Level: X-Spam-Status: No, score=-9.594 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=DK0A9R68; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=VU8Eg8IW Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X9lFOIhuRGdY; Mon, 21 Mar 2022 08:13:11 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 414883A088D; Mon, 21 Mar 2022 08:13:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=26996; q=dns/txt; s=iport; t=1647875591; x=1649085191; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=p7bL9qr7GMkiRt6aYJ+2PiMbPKUk2FVyPNu3FaTSD7Q=; b=DK0A9R68SOwWLsQCadNGJfppSkwuDZS25chBj+fHIn9jY8QIBHnMq2CV RCmVkfjs2AcLhRGNd1xVpY5fQPgTqJnB1ihHVZHo1gkq8GX2s0Z92x/M1 UofxrRD2+xu6mFLbXHCaz5F0wkMMxu++uqI6A8Xja3C4Kr4KoUpfMDEP6 o=; IronPort-PHdr: =?us-ascii?q?A9a23=3AZvfoPhQXFUakEdDaNA1KVb3HQNpso7vLVj580?= =?us-ascii?q?XJvo75Nc6H2+ZPkMQSf4Ph2l1bGUM3d7O4MkOvZta3sGAliqZaMuXwPatpAA?= =?us-ascii?q?hkCj8hFkwkpGsXQD0r9IbbjZDA7G8IXUlhj8jm7PEFZFdy4aUfVpyi57CUZH?= =?us-ascii?q?VP0Mg8mTtk=3D?= IronPort-Data: =?us-ascii?q?A9a23=3Am8GspKvHJiC9/JeQHzFZT29GZ+fnVOBcMUV32?= =?us-ascii?q?f8akzHdYApBsoF/qtZmKTvXMvyOazH9fYwjaoy/8EkG6sTWzN9qSQJopXgxF?= =?us-ascii?q?SMTgMeUXt7xwmUckM+xwmwvdK/shiknQoGowPscEzmN/n9BDpC79SMmjfrSH?= =?us-ascii?q?+KlYAL5EnkZqTFMGX9JZS1Lw4bVsqYw6TSIK1vlVeHa+qUzC3f9s9JACV/43?= =?us-ascii?q?orYwP9ZUFsejxtD1rA2TagjUFYzDBD5BrpHTU26ByOQroW5goeHq+j/ILGRp?= =?us-ascii?q?gs1/j83Ad+j1738aEBPG+eUNgmVgX0QUK+n6vRAjnVtieBga7xNMgEO12rhc?= =?us-ascii?q?9NZkL2hsbSySQooIr/kk+UGWB4eGCZ7VUFD0OafeSHl6J3Inheun3zEhq8G4?= =?us-ascii?q?FsNFYsZ8eVfD2ZJ//UCbjcXYXirleKrybS0UelxgNsqKuHrIYoAt3AmxjbcZ?= =?us-ascii?q?d4pW5fca6TH+dEe2y0/7uhVHPrEYNICQTticBqGZAdAUn8dBZQ7tPivnHr4d?= =?us-ascii?q?TlZrl/TrKQt4mPapCRy16TsM9PRc8SXScQThVyZvGvDqjihBBABKJqQziSt/?= =?us-ascii?q?nelnOSJnC7nVsQVDrLQ3v5jkVSZ23caBwYTfVS+qPi9zEW5Xrpix+Y8ksY1h?= =?us-ascii?q?bI5+EruRd7nUljh+TiPvwUXXJxbFOhS1e1E8YKMiy7xO4TOZmcRADD+iPILe?= =?us-ascii?q?A=3D=3D?= IronPort-HdrOrdr: =?us-ascii?q?A9a23=3AsV2q/q4qsX9icnWY2QPXwXyBI+orL9Y04l?= =?us-ascii?q?Q7vn2ZFiY6TiXIra+TdaoguSMc0AxhJE3Jmbi7Sc29qADnhOFICOgqTPuftW?= =?us-ascii?q?zd2VdAQ7sSlbcKrweQeREWs9QtqJuIEJIOR+EYb2IK9voSiTPQe71Lrbn3k5?= =?us-ascii?q?xAx92utUuFJjsaDJ2Imj0JczpzZXcGIjWua6BJcaa0145inX6NaH4XZsO0Cj?= =?us-ascii?q?0uRO7YveDGk5rgfFovGwMnwBPmt0Ln1JfKVzyjmjsOWTJGxrkvtULflRbi26?= =?us-ascii?q?mlu/anjjfBym7o6YhMkteJ8KoDOCXMsLlUFtzfsHfrWG1TYczGgNnzmpDq1L?= =?us-ascii?q?8eqqiOn/7nBbU115qeRBDynfKn4Xif7N9n0Q6S9bbfuwq7nSQ8LwhKUPaoQu?= =?us-ascii?q?liA0PkAgMbzaFB+bMO0GSDu5VNCxTc2Cz7+tjTThlv0lG5uHw4jIco/jdiuK?= =?us-ascii?q?YlGfZsRLYkjQto+VY7bVbHwZFiFPMrANDX5f5Qf1/fZ3fFvnN3yNjpWngoBB?= =?us-ascii?q?+JTkULp8TQilFt7T1E5lpdwNZakmYL9Zo7RZUB7+PYMr5wnLULSsMNd6pyCO?= =?us-ascii?q?oIXMPyAG3QRhDHNn6UPD3cZes6EmOIr4Sy7KQ+5emsdpBNxJwumI7ZWFcdrm?= =?us-ascii?q?I2c1KGM7z54HSKyGG7fIyQZ0We9igF3ekLhlTVfsufDRG+?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CwAAB2lThi/5NdJa1XAx0BAQEBCQE?= =?us-ascii?q?SAQUFAYIHBwELAYEgMVYHd1o3RIRUg0oDhTmFEIMCA5YfhRaBLhSBEQNUCwE?= =?us-ascii?q?BAQ0BASoBCgwEAQGFBwIXhCACJTUIDgECBAEBARIBAQUBAQECAQcEgQkThWg?= =?us-ascii?q?NhkIBAQEBAwEBEBEEBhMBASwEBwELBAIBCAcHAwQBASgDAgICJQsUCQgCBA4?= =?us-ascii?q?FCBMHgmOCDlcDLgEOoG0BgToCgQ6JEXp/MoEBgggBAQYEBIE3AYNTGII3CYE?= =?us-ascii?q?lF4MRhCQBAYMBhBEnHIFJRIEVQ4I3MD6CIUIBAQKBKQESAQkaFQoMCQgJglM?= =?us-ascii?q?XIIIulzFbRxMFDyIhDwEFEgk7GCUzARILFAdKAxYBlShGiWKNfpJtCoNJiw+?= =?us-ascii?q?VAhWDdIwwmBqUdYFmgkmKTJlEAgQCBAUCDgEBBoFjAzdpcHAVO4JpCUgZD44?= =?us-ascii?q?gDBaDUIUUhUp1AgE1AgYLAQEDCY8sLYIZAQE?= X-IronPort-AV: E=Sophos;i="5.90,198,1643673600"; d="scan'208,217";a="1001219392" Received: from rcdn-core-11.cisco.com ([173.37.93.147]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 21 Mar 2022 15:13:07 +0000 Received: from mail.cisco.com (xfe-rcd-001.cisco.com [173.37.227.249]) by rcdn-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id 22LFD7JI025760 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Mon, 21 Mar 2022 15:13:07 GMT Received: from xfe-rtp-002.cisco.com (64.101.210.232) by xfe-rcd-001.cisco.com (173.37.227.249) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14; Mon, 21 Mar 2022 10:13:07 -0500 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (64.101.32.56) by xfe-rtp-002.cisco.com (64.101.210.232) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14 via Frontend Transport; Mon, 21 Mar 2022 11:13:06 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kJSpaej7ObH2fusz5AoBTFH+SJ7mUFmwdv9w+TCvv1GBceTt/tEcOYnlPZcaIOcS33cOffp/msNWpS+4scQw/wb8YL+f6v2NmIpGKSLm8KRGzQLN4uVZX4lUFnvbIknOdCXwnLCHcFn6oGf37cWQo0QAmnhiZOyr8Sigxhnct6VBWJ5FYviSn/TE+rnFzanZVhS9bQF0hDxGGmiLTW5HEdW7z3HrjjmDp9Tb/HCC223QFSZtUmvQGLGZbqbtnPZbnyz3pE+8xRaxAHifXQrX1hbWuezPDnerjUJP8Gb9LDz0WWuNfYXnaZGxN0QK3D6ABYxae1vrOrh8vE84dFwwEA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=p7bL9qr7GMkiRt6aYJ+2PiMbPKUk2FVyPNu3FaTSD7Q=; b=CBYE1oWiYSPOG3sbQGo6g9gLS7leXiEVbkr4nFL3WbeU7u3vg8GR1qgOltAiB6Yreuz9Np1pU80upBXzkTiIwK9X+i/vemwN2dCi42PaXo2XQDqzZSMG9BGo8Rmb0DoFPKCzKxtH/4BYfQbkc851KQq5am6B5fFtxSiwplDKnXotMfFh1mikVivp+/cbN7QXFZB5HDeLFdf4RSMoVA6gToIqSC67lkhXORka7kqpqlKCeNkUgGHSsk9tqcNOJmNE0V0b8K9KwyXqf20ISxUxAEoDtgg7OgwpH43E2wG/hAEc6Rj9lm3VeAvzHPxNyldSdTgtUxlDXDp3KiLgFaS9OQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=p7bL9qr7GMkiRt6aYJ+2PiMbPKUk2FVyPNu3FaTSD7Q=; b=VU8Eg8IWdRmlVw7YiOrgDaLFvtpQoJ2lN3ckYQ8vuLQD4kYX1BQ31Jk9MBALab0X3858MEdpHC2CyF4+vAVb557Y24LdkNgsexLL+0wwPzxgz1OVzNZAODXvlFcVVggzYLTqQPPtTuXDvq514qNpmYYPctbbJmgBnZ24d4h8kYg= Received: from BYAPR11MB3207.namprd11.prod.outlook.com (2603:10b6:a03:7c::14) by BN6PR1101MB2339.namprd11.prod.outlook.com (2603:10b6:404:94::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.15; Mon, 21 Mar 2022 15:13:05 +0000 Received: from BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167]) by BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167%7]) with mapi id 15.20.5081.022; Mon, 21 Mar 2022 15:13:05 +0000 From: "Jakob Heitz (jheitz)" To: Gyan Mishra , "Sriram, Kotikalapudi (Fed)" CC: Ben Maddison , "sidrops@ietf.org" , "grow@ietf.org" , Zhuangshunwan , Nick Hilliard Thread-Topic: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPHZ5DD0pwhuq8ES1+K9Q/TYBZqzJ769Q Date: Mon, 21 Mar 2022 15:13:05 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cisco.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1d78403e-5953-4e2f-36e8-08da0b4d4cae x-ms-traffictypediagnostic: BN6PR1101MB2339:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: fnR4b8ylN7V7DC1xSUBZ9GZQd+umAhrQPn2/z/KfoIzSFlpTll6WMmo7pih49GWRw9Wjg5B1uDITdKYcDfRfUnSpIWWtYJCIROaeq2Lnt0kzQUG2nxSzYWQSCfeLt9sJFEiP20xONZuCRTq6CtyY1lY0swQaq/Apro8zwnssQF1rlqsPEVbESgbQO5j82MFpGZRcER7lpbKaGigtWvcyyuTjL8yuYEbY/Gkmc3TBC/9bjp85AP+28LZzPeJm3KZ8VLHHfhAvv8keKKvDbmeJpp0w8eQM+ml9ezoe/ymr5Uasqk82dp6cicgYc7XofXuoW1cMIZsl8PyTUhMNiIUVGLqnTUP5oR7Pa3N8zGfuNBplHd7jvp+YAOZEbNC5OfKtCn9dcfYF9NyIy1zD+YzMLcNITie4oHLUrSFMswuZzWaMKYN4MbhfsBTykcgz3E+VBI/WAgGsi9KHH2VYsIduGQNocV9l9DIhCFtriHzgkoaXKbGNrPbfR+XlbvmJnanUFoI/3vbZqgxGqopSRdn7bzNSOhRyD8hUM/C8463iZU2GPbZs+fVqZ3ihtUmrRW15h3/aBim5+4le409oawZ7YGbvfVfg4oaidR14gyZpsM15+EFP4onM/sM2MVkeXGKw7G7OuA09uJHwyV/+Md8WTQKPzU28ZBa1vqQ8ZLhX0t7s3fYeqvRhv9FfUjfrySTdt9xn54x5xoXBmUT8V6vNSU3s7ESZoip/ugqEGK/tww00DNlneVVns3wkHgil0tLiZm0JXG3PZk+zResmc8tO4aD2Jvf68v5UunTL6uaRWjmSD2ljluHoZxg/aapemDI7CBzhEQsCu9GaTW+uPv4s0g== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3207.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(366004)(2906002)(83380400001)(52536014)(8936002)(186003)(55016003)(38100700002)(40140700001)(122000001)(166002)(33656002)(38070700005)(76116006)(86362001)(66946007)(66476007)(66556008)(4326008)(8676002)(66446008)(64756008)(966005)(53546011)(316002)(6506007)(54906003)(7696005)(9686003)(110136005)(508600001)(5660300002)(71200400001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?U3FXTkJWSjRzc2pETGc4N3U4UmZ0cU00Q2sxb0wxeU92R3lRSzBuVUg3a2hq?= =?utf-8?B?a2laM293cFIzUU9SMEVyQTJPNHJIOVY5UVk5Nlh1Sy9NSzNTQlRiMWVDem90?= =?utf-8?B?TWp0OWhDMnVCYnFjalZtY3dxcVlNQjh1VHFHbld0dnZtMFI5Ukt0T1o4aGIy?= =?utf-8?B?WTRaOVdTb0lSTjc0bDRGWFI4OHgveTVvWEg3azNzQ1duZ1RldDZ3OThiTjRF?= =?utf-8?B?eW5FL3JRa2ozL2g3eHJCa0l5SVR5UXl1ZnA3alZ5OXJlS1JhOWxEV0NYTnY2?= =?utf-8?B?eDhHMTBzMW94VS92cVdXYXNTSkxFeXB5UXB5U0xiaEZuenNvUVMyN3BGZExz?= =?utf-8?B?NjZIQ2RxNzFpSUMrMnNTYUdrbDlleFVFb2svOGx5R0dtOVJOV094M0JSenBP?= =?utf-8?B?elRyNlJBSkZIRlEyRUxIRzdtUTBiTEVDVlRFOVpBSU5ndWhuM2x4c1dTYmt5?= =?utf-8?B?bCtlSTUwQXRHc0Zkc1NyaHU3NEJacmU1OXd6dzBBRjhVOTQ4dW5LeVhTZEl1?= =?utf-8?B?aHRmYUdTcGdRSmcwelNZUFY3TnNYQ2hiRlNBTGNvaW1DcWE1L0xOTTFET2Zw?= =?utf-8?B?ZXNsQlRWNmRrY1NLQytnWENJQS9HUE1lcWgxQWRkemowUnhKU3VmRTZYdDQ0?= =?utf-8?B?T2MzeGpxRFdtQmpReTJ1N3RoSU90QjFXdjVNbGEvQ2pJbFhUODYrOVBCd2Fm?= =?utf-8?B?K2ViNyttMUVIK2JnemFSdGN2d2lUM0IyeEVxZUlTVjVnYlVBSjA1amRGd283?= =?utf-8?B?czNCc0xrU1BFUW9Wc1dvdWlKdDR4UjNyeEJNQ3pOSFlCck9NQmFJWUo3UzRH?= =?utf-8?B?anhOYzdPeDRRWWtaL2lXWXRvaU1kSCsrZkZhWWtRdFRzdkp2bzZMd0U3bUY4?= =?utf-8?B?WnVQQTk4WlF0d0hnbzRaZU5zQlBmUG1uTGovWTBWTmRQbXEwc2N5L29rd1A1?= =?utf-8?B?UGpybTlwa0JaRlRUZFZsUDQrd1diaG43YjlockRhVWhMTSttMjNhU21SbkE0?= =?utf-8?B?M053QWhLTTB0ZUwzblM0KzNHcHpUYTJHenU2bUdvNkpUNWVjNmpQVnpEdWtT?= =?utf-8?B?SmdzTGJEVW9Ta2ZuRXRMcVU2UEVjQlVnT1BsZTBrMmFua1Bqck1xZDhwcjNw?= =?utf-8?B?N1QrMHZieVJwV0hDUXRRU1FCcE9DWUNiOVl0eXU1Q1ZPaGtxTkFZZ1lQMEI3?= =?utf-8?B?RjVWZ2U0ZXR0bmhWZW1nOFQ5aVBxMDVyY2x0aDNxM1F0OWQxcS8rUDlGTnJM?= =?utf-8?B?WEZTbXpKTVg0cmJRa2xhWStwOUlPWUNaNlBUcmJYYytaOTV1ZDA5U1R2ck8y?= =?utf-8?B?YW1sQkoxVE9wYWM2cWJGL1k5VHVGS0x5WXRja1lvaER6QnJCbW1LWjlsL092?= =?utf-8?B?QkdQSS80R09kOHE5WWhrUDJhVGI4K2NRaE8rdS9WU2I2UDAzRXBmSTJ5a3Zx?= =?utf-8?B?TldHbEgzNUpqQWVoUi9WU0J1cHhoUFhyWlNzb0xsT3ZUTmh4VkhmVE5CaUxJ?= =?utf-8?B?ZlZvY3ZLemlBYWdNV0J1cFlqazNyMjc4djJGRlRueVdBRG9SVnk0SHRxbUlF?= =?utf-8?B?QWt4Zjh5T1lPRUV3d2FjTnBiYXZKTnhSNndrYURLYTlab1ZnMUNsWmFRdlkr?= =?utf-8?B?bEZ6OXRibU92M05UV3dXdzBvTm5Pc2RibkFWVjNOOTFodjNpWXU5M0xmR2pY?= =?utf-8?B?eEJMM0RiNHVDR3dYYUduZ1RHOTVPa1dZbWUvbnhxWDMyVUdXTDdOTTNXTW9t?= =?utf-8?B?K3dSeFI4ZDJOVnRXZWVSRGxGM3FjVHo3N1YwQVFybjJkNyttcnJkdk9sUzhS?= =?utf-8?B?VEtvRFhVd2tyL0VuT1FTWTh1QTNWTnBYdDVrT0dSUUc4bk9qNHRZZnhQcWM5?= =?utf-8?B?RG0rbDJyNkp0eDhkY1VsbHhTWW9zS0YzR2IzZUtFV1JuUjhKcUM3NVZSMjNs?= =?utf-8?B?NTdjd0Y0b3htZjZxaUxYdmxFYm1BQmNSSXh5cGFRTFU0LzJGZFpWY1h5dW4y?= =?utf-8?B?MTBDY2kwUWZsYmFzZUt4dG1CNWhVdm9RRmlpYjVCcm5IbDkrWFBWSVE0N2Fk?= =?utf-8?Q?qBDCeq?= Content-Type: multipart/alternative; boundary="_000_BYAPR11MB3207DE083AD888F3C963E347C0169BYAPR11MB3207namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR11MB3207.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1d78403e-5953-4e2f-36e8-08da0b4d4cae X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Mar 2022 15:13:05.2282 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: o61Nk0LMrmVqhIyqbiKzZIPLrIk8JDla9R/+ik16JnnPDqKu1/hF0uf/q/H3Wneb2TZhThGvm30ntSzbomXiSw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR1101MB2339 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.227.249, xfe-rcd-001.cisco.com X-Outbound-Node: rcdn-core-11.cisco.com Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2022 15:13:18 -0000 --_000_BYAPR11MB3207DE083AD888F3C963E347C0169BYAPR11MB3207namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Um91dGUgc2VydmVycyBhcmUgYSBkaXN0cmFjdGlvbiBmb3IgQVNQQS4NCkFTUEEgaXMgYWJvdXQg QkdQIHBhdGggdmFsaWRhdGlvbi4NCkFzIHN1Y2ggaXQgY29uY2VybnMgaXRzZWxmIHdpdGggQVNO cyBpbiB0aGUgQVMgcGF0aC4NCkl0IGlzIGFib3V0IHJlbGF0aW9uc2hpcHMgYmV0d2VlbiBhZGph Y2VudCBBU2VzIGluIHRoZSBBUyBwYXRoLg0KU2luY2UgUlNlcyBhcmUgbm90IGluIHRoZSBBUyBw YXRoLCB0aGV5IGNhbm5vdCBiZSBpbmNsdWRlZCBpbiBBU1BBLg0KUlNlcyBhcmUgb25seSB2aXNp YmxlIGFuZCByZWxldmFudCB0byB0aGUgZGlyZWN0IG5laWdoYm9ycyBvZiB0aGUgUlMuDQpUaGUg QVNOIG9mIHRoZSBSUyBkb2VzIG5vdCBhcHBlYXIgaW4gdGhlIEFTIHBhdGgsIHRoZXJlZm9yZSBp dCBpcyBvZiBubyBjb25jZXJuIHRvIGFueW9uZSB0aGF0IGlzIHRyeWluZyB0byB2YWxpZGF0ZSB0 aGUgQVMgcGF0aC4NCkNvdWxkIHdlIHBsZWFzZSByZW1vdmUgYWxsIHJlZmVyZW5jZXMgdG8gcm91 dGUgc2VydmVycyBmcm9tIHRoZSBBU1BBIGRyYWZ0IGFuZCBpc3N1ZSBhIG5ldyBkcmFmdCBhYm91 dCB0cmVhdG1lbnQgb2Ygcm91dGUgc2VydmVycyBvbmx5Pw0KDQpSZWdhcmRzLA0KSmFrb2IuDQoN CkZyb206IFNpZHJvcHMgPHNpZHJvcHMtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIEd5 YW4gTWlzaHJhDQpTZW50OiBTdW5kYXksIE1hcmNoIDIwLCAyMDIyIDk6MjAgQU0NClRvOiBTcmly YW0sIEtvdGlrYWxhcHVkaSAoRmVkKSA8a290aWthbGFwdWRpLnNyaXJhbT00MG5pc3QuZ292QGRt YXJjLmlldGYub3JnPg0KQ2M6IEJlbiBNYWRkaXNvbiA8YmVubUB3b3Jrb25saW5lLmFmcmljYT47 IHNpZHJvcHNAaWV0Zi5vcmc7IGdyb3dAaWV0Zi5vcmc7IFpodWFuZ3NodW53YW4gPHpodWFuZ3No dW53YW5AaHVhd2VpLmNvbT47IE5pY2sgSGlsbGlhcmQgPG5pY2tAZm9vYmFyLm9yZz4NClN1Ympl Y3Q6IFJlOiBbU2lkcm9wc10gW0dST1ddIEFTUEEgYW5kIFJvdXRlIFNlcnZlciAod2FzIFJFOiBJ WFAgUm91dGUgU2VydmVyIHF1ZXN0aW9uKQ0KDQoNCkhpIFNyaXJhbQ0KDQpPbiBTdW4sIE1hciAy MCwgMjAyMiBhdCAxMDo1OSBBTSBTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSA8a290aWthbGFw dWRpLnNyaXJhbT00MG5pc3QuZ292QGRtYXJjLmlldGYub3JnPG1haWx0bzo0MG5pc3QuZ292QGRt YXJjLmlldGYub3JnPj4gd3JvdGU6DQpJIHRoaW5rIGEgY29ycmVjdGlvbiBpcyByZXF1aXJlZC4g SW5zdGVhZCBvZiB3aGF0IHdhcyBzYWlkIGJlZm9yZSAtDQoNCiMxOiBBbiBSUyBjbGllbnQgb2Yg YW4gUlMgKHRyYW5zcGFyZW50IG9yIG5vdCkgaW5jbHVkZXMgdGhlIFJTIEFTIGluIHRoZWlyIFNQ QVMvQVNQQS4gVGhlIFJTIGNsaWVudCBhbHNvIGluY2x1ZGVzIGluIGl0cyBTUEFTL0FTUEEgYW55 IEFTIHdpdGggd2hvbSBpdCBjb25uZWN0cyBpbiB0aGUgY29udHJvbCBwbGFuZSB2aWEgdGhlIFJT Lg0KDQpvbmx5IHRoZSBmb2xsb3dpbmcgc2ltcGxlciBzdGF0ZW1lbnQgaXMgcmVxdWlyZWQgaW4g dGhlIGRyYWZ0Og0KDQojMjogQW4gUlMgY2xpZW50IG9mIGFuIFJTICh0cmFuc3BhcmVudCBvciBu b3QpIGluY2x1ZGVzIHRoZSBSUyBBUyBpbiB0aGVpciBTUEFTL0FTUEEuDQoNClRoZSByZWFzb24g aXMgYXMgZm9sbG93cy4gQ29uc2lkZXIgdGhlIGZvbGxvd2luZyB0b3BvbG9neSBhbmQgVXBkYXRl IGZsb3cgcGVyIGFycm93czoNCg0KQVMxIChSUyBDbGllbnQpIC0tLS0tPiBBUzIgKFJTKSAtLS0t LT4gIEFTMyAoUlMgQ2xpZW50KSAtLS1wMnAgKGxhdGVyYWwgcGVlcikgLS0tPiAgQVM0ICh2YWxp ZGF0aW5nIEFTKQ0KDQpBUzQgaXMgdGhlIHJlY2VpdmluZy92YWxpZGF0aW5nIEFTLiBSZWdhcmRs ZXNzIG9mIHdoZXRoZXIgdGhlIFJTIGluc2VydHMgaXRzIEFTTiBpbiB0aGUgQVMgcGF0aCBvciBu b3QsIHRoZSBVcGRhdGUgaXMgSW52YWxpZCAocm91dGUgbGVhaykgYXQgQVM0LiBCZWNhdXNlIG9u Y2UgdGhlIFVwZGF0ZSB0cmFuc2l0aW9uZWQgdG8gYSBkb3dud2FyZCBwYXRoIGFmdGVyIHRoZSBS UywgaXQgY2Fubm90IGJlIHN1YnNlcXVlbnRseSBzZW50IHRvIGEgcHJvdmlkZXIgb3IgbGF0ZXJh bCBwZWVyLiBCdXQgd2l0aCAjMSwgdGhlIFVwZGF0ZSB3aWxsIGJlIGV2YWx1YXRlZCBhcyBWYWxp ZCAobm90IHJvdXRlIGxlYWspIGJ5IHRoZSBBU1BBIHZlcmlmaWNhdGlvbiBwcm9jZWR1cmUgaW4g Y2FzZSB0aGUgUlMgaXMgdHJhbnNwYXJlbnQuIEJ1dCB3aXRoICMyLCB0aGUgVXBkYXRlIHdpbGwg YmUgY29ycmVjdGx5IGRldGVjdGVkIGFzIGEgcm91dGUgbGVhayAod2hldGhlciB0aGUgUlMgaXMg dHJhbnNwYXJlbnQgb3Igbm90KS4NCg0KRXhwbGFuYXRpb246IFdpdGggIzEsIHRoZSBob3AgQVMx LUFTMyBpbiB0aGUgdHJhbnNwYXJlbnQgY2FzZSBpcyBldmFsdWF0ZWQgYXMgVmFsaWQgKEMyUCkg KGFzIHBhcnQgb2YgYW4gYXNjZW5kaW5nIHVwLXJhbXAgb24gdGhlIGxlZnQpIGJ5IHRoZSBwcm9j ZWR1cmUgYW5kIHRoYXQgaXMgbm90IGdvb2QuIEkuZS4sIHRoZSBkZXRlY3Rpb24gb2YgdGhlIGFw ZXggaW4gdGhlIEFTIHBhdGggYXQgdGhlIFJTIChub3QgdmlzaWJsZSBpbiB0aGUgcGF0aCkgYW5k IGludmVyc2lvbiAobm9uLXVwd2FyZCBmbG93KSBhZnRlciB0aGUgUlMgaXMgb2JzY3VyZWQgd2l0 aCAjMSAoaW4gdGhlIHRyYW5zcGFyZW50IGNhc2UpLiBIb3dldmVyLCB3aXRoICMyLCB0aGUgaG9w IEFTMS1BUzMgaXMgZXZhbHVhdGVkIGFzICJhdHRlc3RlZCBub3QgUHJvdmlkZXIiLiBUaGF0IG1l YW5zIHRoYXQgdGhlIGRldGVjdGlvbiBvZiBhcGV4L2ludmVyc2lvbiBhdCB0aGUgUlMgKHRob3Vn aCBub3QgdmlzaWJsZSBpbiB0aGUgcGF0aCkgaXMgZWZmZWN0aXZlbHkgbm90IG1pc3NlZCBvdXQg YnkgdGhlIHByb2NlZHVyZSB3aXRoICMyLg0KDQpUaGFuayB5b3UuDQoNClNyaXJhbQ0KDQotLS0t LU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogR1JPVyA8Z3Jvdy1ib3VuY2VzQGlldGYub3Jn PG1haWx0bzpncm93LWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgU3JpcmFtLCBLb3Rp a2FsYXB1ZGkgKEZlZCkNClNlbnQ6IFR1ZXNkYXksIE1hcmNoIDE1LCAyMDIyIDExOjM0IEFNDQpU bzogTmljayBIaWxsaWFyZCA8bmlja0Bmb29iYXIub3JnPG1haWx0bzpuaWNrQGZvb2Jhci5vcmc+ Pg0KQ2M6IEJlbiBNYWRkaXNvbiA8YmVubUB3b3Jrb25saW5lLmFmcmljYTxtYWlsdG86YmVubUB3 b3Jrb25saW5lLmFmcmljYT4+OyBncm93QGlldGYub3JnPG1haWx0bzpncm93QGlldGYub3JnPjsg c2lkcm9wc0BpZXRmLm9yZzxtYWlsdG86c2lkcm9wc0BpZXRmLm9yZz4NClN1YmplY3Q6IFtHUk9X XSBBU1BBIGFuZCBSb3V0ZSBTZXJ2ZXIgKHdhcyBSRTogW1NpZHJvcHNdIElYUCBSb3V0ZSBTZXJ2 ZXIgcXVlc3Rpb24pDQoNCk5pY2sgKGFuZCBhbGwpLA0KDQpJIHdhcyBhbHNvIHJlcmVhZGluZy9y ZXZpZXdpbmcgU2VjdGlvbiA1LjMgYW5kIGhhZCBzaW1pbGFyIHRob3VnaHRzIGFib3V0IHRoZSB0 d28gb3B0aW9ucyB5b3Ugb3V0bGluZWQuIEFzIHlvdSBub3RlZCwgInRoZSBhcHByb2FjaCBpbiBT ZWN0aW9uIDUuMyBnaXZlcyBhIHdvcmthYmxlIG91dGNvbWUiLiAgSG93ZXZlci4uLg0KDQo+Li4u IHRoZSBSUyBzaG91bGQgYmUgdHJlYXRlZCBhcyBhIHByb3ZpZGVyIGJ5IHRoZSBycyBjbGllbnQ7 IHRoZSBycyBjbGllbnQgc2hvdWxkIGluY2x1ZGUgdGhlIFJTIEFTTiBpbiBpdHMgU1BBUzsgdGhl IHJzIGNsaWVudCBzaG91bGQgZXZhbHVhdGUgQVNQQSBhcyBpZiB0aGUgUlMgQVNOIHdlcmUgaW5j bHVkZWQgaW4gdGhlIHBhdGg7IHRoZSBycyBzaG91bGQgZXZhbHVhdGUgY2xpZW50cyBhcyBjdXN0 b21lcnMNCg0KWWVzLCBJIGFncmVlIHRoYXQgInRoZSBycyBjbGllbnQgc2hvdWxkIGluY2x1ZGUg dGhlIFJTIEFTTiBpbiBpdHMgU1BBUy4iIEFsZXhhbmRlciBhbmQgSSBoYXZlIHRhbGtlZCBhYm91 dCB0aGlzLCBhbmQgaGUgbWVudGlvbmVkIHRoYXQgdGhpcyB3b3VsZCBiZSBhZGRlZCB0byB0aGUg ZHJhZnQuDQoNClllcywgSSBhbHNvIGZlZWwgdGhhdCBpdCBpcyBhIGJldHRlciBvcHRpb24gdGhh dCB0aGUgUlMgY2xpZW50IGFkZHMgdGhlIEFTTiBvZiB0aGUgdHJhbnNwYXJlbnQgUlMgdG8gdGhl IEFTIHBhdGggKGZvciBBU1BBIHZhbGlkYXRpb24gcHVycG9zZXMgb25seSkgYW5kIGFwcGxpZXMg dGhlIGRvd25zdHJlYW0gQVNQQSBhbGdvcml0aG0uIEFsZ29yaXRobWljYWxseSB0aGlzIHNlZW1z IG1vcmUgYXBwcm9wcmlhdGUuIFRoaXMgaXMgYWxzbyBiZXR0ZXIgZnJvbSBhIGRpYWdub3N0aWNz IHBvaW50IG9mIHZpZXcgKGlmIHRoZSBuZWVkIGV2ZXIgYXJpc2VzKSBiZWNhdXNlIGluIHRoaXMg YXBwcm9hY2ggdGhlIHJlbGV2YW50IEFTUEEgaXMgdXNlZCBmb3IgdmFsaWRhdGluZyB0aGUgaG9w IGZyb20gdGhlIEFTIGp1c3QgYmVmb3JlIHRoZSBSUyB0byB0aGUgUlMuDQoNClRoYXQgc2FpZCwg SSB0aGluayB0aGVyZSBpcyBhIGJpZ2dlciBpc3N1ZSBhYm91dCB0cmFuc3BhcmVudCBSUyBpbiB0 aGUgbWlkZGxlIG9mIHRoZSBBUyBwYXRoLiBNYXliZSB0aGlzIGlzIHdoYXQgQmVuJ3MgcXVlc3Rp b24gd2FzIGhpbnRpbmcgYXQuIEkgdGhpbmsgeW91IGFyZSBhbHNvIHJhaXNpbmcgdGhpcyBpc3N1 ZSB3aGVuIHlvdSBzYXk6DQoNCj5SU3MgZG8gbm90IHBhcnRha2UgaW4gdHJhZmZpYyBmb3J3YXJk aW5nLCBzbyB0aGV5IGFyZSBub3QgcGFydCBvZiB0aGUgZGF0YSBwYXRoIGJldHdlZW4gdHdvIEFT TnM7IHRoZXkncmUgb25seSBwYXJ0IG9mIHRoZSBzaWduYWxpbmcgcGF0aCBiZXR3ZWVuIHRoZSB0 d28gQVNOcy4gIFRoaXMgaXMgYSB1c2VmdWwgaGFjayBmcm9tIGEgcHJhY3RpY2FsIHBvaW50IG9m IHZpZXcsIGJ1dCBpdCBjYXVzZXMgYWxnb3JpdGhtaWMgYnJlYWthZ2UgaW4gcGxhY2VzIHdoaWNo IGFzc3VtZSBjb25ncnVlbmN5IGJldHdlZW4gdGhlIGRhdGEgcGxhbmUgYW5kIHRoZSBzaWduYWxp bmcgcGxhbmUuICBPbmUgb2YgdGhlc2UgcGxhY2VzIGlzIEFTIHBhdGggdmVyaWZpY2F0aW9uLg0K DQo+IC4uLi5BU1BBIHZlcmlmaWNhdGlvbiBzaG91bGQgcHJvY2VlZCBhcyBpZiB0aGUgdHdvIHJz LWNsaWVudCBBU05zIHdlcmUgZGlyZWN0bHkgY29ubmVjdGVkIGFuZCBlYWNoIHNob3VsZCB0cmVh dCB0aGUgb3RoZXIgYXMgYSBwcm92aWRlcg0KDQogICAgR3lhbj5JIHVuZGVyc3RhbmQgdGhlIGlz c3VlIHdpdGggdGhlIEFTUEEgcGF0aCB2ZXJpZmljYXRpb24sIGhvd2V2ZXIgaWYgdGhlIFJTIEFT IGFkZGVkIHRvIEFTUEEgdGhlbiB0aGF0IHdvdWxkIGluZmx1ZW5jZSB0aGUgZm9yd2FyZGluZyBw bGFuZSBpcyB0aGUgaXNzdWUuICBIb3cgZG8geW91IGluc2VydCBSUyBBUyBmb3IgdGhlIEFTUEEg cGF0aCB2ZXJpZmljYXRpb24gYnV0IG5vdCBhbGxvdyBSUyB0byBiZSBwYXJ0IG9mIGZvcndhcmRp bmcgcGxhbmU/ICBJIGd1ZXNzIHlvdSBjb3VsZCBkbyBhIG5leHQtaG9wLXVuY2hhbmdlZCBiZXR3 ZWVuIHRoZSBjbGllbnRzIGNvbm5lY3RlZCB0aHJvdWdoIHRoZSBSUy4NCg0KDQpCYXNlZCBvbiB0 aGUgYWJvdmUgb2JzZXJ2YXRpb25zIGZyb20geW91LCBJIGFtIHByb3Bvc2luZyB0aGUgZm9sbG93 aW5nOg0KDQpBbiBSUyBjbGllbnQgb2YgYW4gUlMgKHRyYW5zcGFyZW50IG9yIG5vdCkgaW5jbHVk ZXMgdGhlIFJTIEFTIGluIHRoZWlyIFNQQVMvQVNQQS4gVGhlIFJTIGNsaWVudCBhbHNvIGluY2x1 ZGVzIGluIGl0cyBTUEFTL0FTUEEgYW55IEFTIHdpdGggd2hvbSBpdCBjb25uZWN0cyBpbiB0aGUg Y29udHJvbCBwbGFuZSB2aWEgdGhlIFJTLg0KDQpUaGUgaWRlYSBpcyB0aGF0IGEgcGF0aCBzZWdt ZW50IEFTeC1SUy1BU3kgKHdoZXJlIEFTeCBhbmQgQVN5IGFyZSBSUy1jbGllbnRzIGNvbm5lY3Rl ZCBpbiBCR1AgdmlhIHRoZSBSUykgd2lsbCBiZSBhbHdheXMgdmVyaWZpYWJsZSB3aXRoIHRoaXMg cHJvcG9zYWwgd2hldGhlciBvciBub3QgdGhlIFJTIGlzIHRyYW5zcGFyZW50LiBJZiB0aGUgQVNQ QXMgYXJlIGNyZWF0ZWQgYnkgQVN4IGFuZCBBU3kgcGVyIHRoZSBwcm9wb3NhbCBhYm92ZSwgdGhl biB0aGUgQVN4LVJTLUFTeSBzZWdtZW50IHdpbGwgYmUgZXZhbHVhdGVkIGFzIFZhbGlkIGluIGVp dGhlciBkaXJlY3Rpb24uIEkgIHRoaW5rIHRoaXMgcHJvcG9zYWwgaW4gY29uanVuY3Rpb24gd2l0 aCBvdGhlciBpZGVhcyBkaXNjdXNzZWQgYWJvdmUgdGFrZXMgY2FyZSBvZiBib3RoIHRyYW5zcGFy ZW50IGFuZCBub24tdHJhbnNwYXJlbnQgUlNzIGluIHRoZSBBU1BBIHZlcmlmaWNhdGlvbiBhbGdv cml0aG1zLiBEb2VzIHRoaXMgc2VlbSByZWFzb25hYmxlPw0KDQpUaGFuayB5b3UuDQoNClNyaXJh bQ0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KR1JP VyBtYWlsaW5nIGxpc3QNCkdST1dAaWV0Zi5vcmc8bWFpbHRvOkdST1dAaWV0Zi5vcmc+DQpodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2dyb3cNCi0tDQoNCltodHRwOi8vc3M3 LnZ6dy5jb20vaXMvaW1hZ2UvVmVyaXpvbldpcmVsZXNzL3Z6LWxvZ28tZW1haWxdPGh0dHA6Ly93 d3cudmVyaXpvbi5jb20vPg0KDQpHeWFuIE1pc2hyYQ0KDQpOZXR3b3JrIFNvbHV0aW9ucyBBcmNo aXRlY3QNCg0KRW1haWwgZ3lhbi5zLm1pc2hyYUB2ZXJpem9uLmNvbTxtYWlsdG86Z3lhbi5zLm1p c2hyYUB2ZXJpem9uLmNvbT4NCg0KTSAzMDEgNTAyLTEzNDcNCg0K --_000_BYAPR11MB3207DE083AD888F3C963E347C0169BYAPR11MB3207namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpEZW5nWGlhbjsNCglwYW5vc2UtMToy IDEgNiAwIDMgMSAxIDEgMSAxO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsN CglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5Okdlb3JnaWE7DQoJcGFub3NlLTE6MiA0IDUgMiA1IDQgNSAyIDMgMzt9DQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJcQERlbmdYaWFuIjsNCglwYW5vc2UtMToyIDEgNiAwIDMgMSAxIDEg MSAxO30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFs LCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5r DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlv bjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzQ0 MUQ2MTt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRp di5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lm IGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9 IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxv OnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIx IiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkg bGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiIHN0eWxlPSJ3b3JkLXdyYXA6 YnJlYWstd29yZCI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+Um91dGUg c2VydmVycyBhcmUgYSBkaXN0cmFjdGlvbiBmb3IgQVNQQS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xv cjojNDQxRDYxIj5BU1BBIGlzIGFib3V0IEJHUCBwYXRoIHZhbGlkYXRpb24uPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+QXMgc3VjaCBpdCBjb25jZXJucyBpdHNlbGYgd2l0aCBBU05z IGluIHRoZSBBUyBwYXRoLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPkl0IGlzIGFi b3V0IHJlbGF0aW9uc2hpcHMgYmV0d2VlbiBhZGphY2VudCBBU2VzIGluIHRoZSBBUyBwYXRoLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPlNpbmNlIFJTZXMgYXJlIG5vdCBpbiB0aGUg QVMgcGF0aCwgdGhleSBjYW5ub3QgYmUgaW5jbHVkZWQgaW4gQVNQQS48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dDtjb2xvcjojNDQxRDYxIj5SU2VzIGFyZSBvbmx5IHZpc2libGUgYW5kIHJlbGV2YW50IHRvIHRo ZSBkaXJlY3QgbmVpZ2hib3JzIG9mIHRoZSBSUy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQx RDYxIj5UaGUgQVNOIG9mIHRoZSBSUyBkb2VzIG5vdCBhcHBlYXIgaW4gdGhlIEFTIHBhdGgsIHRo ZXJlZm9yZSBpdCBpcyBvZiBubyBjb25jZXJuIHRvIGFueW9uZSB0aGF0IGlzIHRyeWluZyB0byB2 YWxpZGF0ZSB0aGUgQVMgcGF0aC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj5Db3Vs ZCB3ZSBwbGVhc2UgcmVtb3ZlIGFsbCByZWZlcmVuY2VzIHRvIHJvdXRlIHNlcnZlcnMgZnJvbSB0 aGUgQVNQQSBkcmFmdCBhbmQgaXNzdWUgYSBuZXcgZHJhZnQgYWJvdXQgdHJlYXRtZW50IG9mIHJv dXRlIHNlcnZlcnMgb25seT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0 O2NvbG9yOiM0NDFENjEiPkpha29iLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBTaWRyb3BzICZsdDtzaWRyb3BzLWJvdW5j ZXNAaWV0Zi5vcmcmZ3Q7IDxiPk9uIEJlaGFsZiBPZg0KPC9iPkd5YW4gTWlzaHJhPGJyPg0KPGI+ U2VudDo8L2I+IFN1bmRheSwgTWFyY2ggMjAsIDIwMjIgOToyMCBBTTxicj4NCjxiPlRvOjwvYj4g U3JpcmFtLCBLb3Rpa2FsYXB1ZGkgKEZlZCkgJmx0O2tvdGlrYWxhcHVkaS5zcmlyYW09NDBuaXN0 LmdvdkBkbWFyYy5pZXRmLm9yZyZndDs8YnI+DQo8Yj5DYzo8L2I+IEJlbiBNYWRkaXNvbiAmbHQ7 YmVubUB3b3Jrb25saW5lLmFmcmljYSZndDs7IHNpZHJvcHNAaWV0Zi5vcmc7IGdyb3dAaWV0Zi5v cmc7IFpodWFuZ3NodW53YW4gJmx0O3podWFuZ3NodW53YW5AaHVhd2VpLmNvbSZndDs7IE5pY2sg SGlsbGlhcmQgJmx0O25pY2tAZm9vYmFyLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6 IFtTaWRyb3BzXSBbR1JPV10gQVNQQSBhbmQgUm91dGUgU2VydmVyICh3YXMgUkU6IElYUCBSb3V0 ZSBTZXJ2ZXIgcXVlc3Rpb24pPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkhpIFNyaXJhbTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFN1biwgTWFyIDIwLCAyMDIyIGF0IDEw OjU5IEFNIFNyaXJhbSwgS290aWthbGFwdWRpIChGZWQpICZsdDtrb3Rpa2FsYXB1ZGkuc3JpcmFt PTxhIGhyZWY9Im1haWx0bzo0MG5pc3QuZ292QGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFu ayI+NDBuaXN0LmdvdkBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQu OHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB0aGluayBhIGNv cnJlY3Rpb24gaXMgcmVxdWlyZWQuIEluc3RlYWQgb2Ygd2hhdCB3YXMgc2FpZCBiZWZvcmUgLTxi cj4NCjxicj4NCiMxOiBBbiBSUyBjbGllbnQgb2YgYW4gUlMgKHRyYW5zcGFyZW50IG9yIG5vdCkg aW5jbHVkZXMgdGhlIFJTIEFTIGluIHRoZWlyIFNQQVMvQVNQQS4gVGhlIFJTIGNsaWVudCBhbHNv IGluY2x1ZGVzIGluIGl0cyBTUEFTL0FTUEEgYW55IEFTIHdpdGggd2hvbSBpdCBjb25uZWN0cyBp biB0aGUgY29udHJvbCBwbGFuZSB2aWEgdGhlIFJTLjxicj4NCjxicj4NCm9ubHkgdGhlIGZvbGxv d2luZyBzaW1wbGVyIHN0YXRlbWVudCBpcyByZXF1aXJlZCBpbiB0aGUgZHJhZnQ6PGJyPg0KPGJy Pg0KIzI6IEFuIFJTIGNsaWVudCBvZiBhbiBSUyAodHJhbnNwYXJlbnQgb3Igbm90KSBpbmNsdWRl cyB0aGUgUlMgQVMgaW4gdGhlaXIgU1BBUy9BU1BBLg0KPGJyPg0KPGJyPg0KVGhlIHJlYXNvbiBp cyBhcyBmb2xsb3dzLiBDb25zaWRlciB0aGUgZm9sbG93aW5nIHRvcG9sb2d5IGFuZCBVcGRhdGUg ZmxvdyBwZXIgYXJyb3dzOjxicj4NCjxicj4NCkFTMSAoUlMgQ2xpZW50KSAtLS0tLSZndDsgQVMy IChSUykgLS0tLS0mZ3Q7Jm5ic3A7IEFTMyAoUlMgQ2xpZW50KSAtLS1wMnAgKGxhdGVyYWwgcGVl cikgLS0tJmd0OyZuYnNwOyBBUzQgKHZhbGlkYXRpbmcgQVMpPGJyPg0KPGJyPg0KQVM0IGlzIHRo ZSByZWNlaXZpbmcvdmFsaWRhdGluZyBBUy4gUmVnYXJkbGVzcyBvZiB3aGV0aGVyIHRoZSBSUyBp bnNlcnRzIGl0cyBBU04gaW4gdGhlIEFTIHBhdGggb3Igbm90LCB0aGUgVXBkYXRlIGlzIEludmFs aWQgKHJvdXRlIGxlYWspIGF0IEFTNC4gQmVjYXVzZSBvbmNlIHRoZSBVcGRhdGUgdHJhbnNpdGlv bmVkIHRvIGEgZG93bndhcmQgcGF0aCBhZnRlciB0aGUgUlMsIGl0IGNhbm5vdCBiZSBzdWJzZXF1 ZW50bHkgc2VudCB0byBhIHByb3ZpZGVyDQogb3IgbGF0ZXJhbCBwZWVyLiBCdXQgd2l0aCAjMSwg dGhlIFVwZGF0ZSB3aWxsIGJlIGV2YWx1YXRlZCBhcyBWYWxpZCAobm90IHJvdXRlIGxlYWspIGJ5 IHRoZSBBU1BBIHZlcmlmaWNhdGlvbiBwcm9jZWR1cmUgaW4gY2FzZSB0aGUgUlMgaXMgdHJhbnNw YXJlbnQuIEJ1dCB3aXRoICMyLCB0aGUgVXBkYXRlIHdpbGwgYmUgY29ycmVjdGx5IGRldGVjdGVk IGFzIGEgcm91dGUgbGVhayAod2hldGhlciB0aGUgUlMgaXMgdHJhbnNwYXJlbnQgb3Igbm90KS4N Cjxicj4NCjxicj4NCkV4cGxhbmF0aW9uOiBXaXRoICMxLCB0aGUgaG9wIEFTMS1BUzMgaW4gdGhl IHRyYW5zcGFyZW50IGNhc2UgaXMgZXZhbHVhdGVkIGFzIFZhbGlkIChDMlApIChhcyBwYXJ0IG9m IGFuIGFzY2VuZGluZyB1cC1yYW1wIG9uIHRoZSBsZWZ0KSBieSB0aGUgcHJvY2VkdXJlIGFuZCB0 aGF0IGlzIG5vdCBnb29kLiBJLmUuLCB0aGUgZGV0ZWN0aW9uIG9mIHRoZSBhcGV4IGluIHRoZSBB UyBwYXRoIGF0IHRoZSBSUyAobm90IHZpc2libGUgaW4gdGhlIHBhdGgpDQogYW5kIGludmVyc2lv biAobm9uLXVwd2FyZCBmbG93KSBhZnRlciB0aGUgUlMgaXMgb2JzY3VyZWQgd2l0aCAjMSAoaW4g dGhlIHRyYW5zcGFyZW50IGNhc2UpLiBIb3dldmVyLCB3aXRoICMyLCB0aGUgaG9wIEFTMS1BUzMg aXMgZXZhbHVhdGVkIGFzICZxdW90O2F0dGVzdGVkIG5vdCBQcm92aWRlciZxdW90Oy4gVGhhdCBt ZWFucyB0aGF0IHRoZSBkZXRlY3Rpb24gb2YgYXBleC9pbnZlcnNpb24gYXQgdGhlIFJTICh0aG91 Z2ggbm90IHZpc2libGUgaW4gdGhlIHBhdGgpDQogaXMgZWZmZWN0aXZlbHkgbm90IG1pc3NlZCBv dXQgYnkgdGhlIHByb2NlZHVyZSB3aXRoICMyLiA8YnI+DQo8YnI+DQpUaGFuayB5b3UuPGJyPg0K PGJyPg0KU3JpcmFtJm5ic3A7ICZuYnNwOyAmbmJzcDsgPGJyPg0KPGJyPg0KLS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS08YnI+DQpGcm9tOiBHUk9XICZsdDs8YSBocmVmPSJtYWlsdG86Z3Jvdy1i b3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+Z3Jvdy1ib3VuY2VzQGlldGYub3JnPC9h PiZndDsgT24gQmVoYWxmIE9mIFNyaXJhbSwgS290aWthbGFwdWRpIChGZWQpPGJyPg0KU2VudDog VHVlc2RheSwgTWFyY2ggMTUsIDIwMjIgMTE6MzQgQU08YnI+DQpUbzogTmljayBIaWxsaWFyZCAm bHQ7PGEgaHJlZj0ibWFpbHRvOm5pY2tAZm9vYmFyLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPm5pY2tA Zm9vYmFyLm9yZzwvYT4mZ3Q7PGJyPg0KQ2M6IEJlbiBNYWRkaXNvbiAmbHQ7PGEgaHJlZj0ibWFp bHRvOmJlbm1Ad29ya29ubGluZS5hZnJpY2EiPmJlbm1Ad29ya29ubGluZS5hZnJpY2E8L2E+Jmd0 OzsNCjxhIGhyZWY9Im1haWx0bzpncm93QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+Z3Jvd0Bp ZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpzaWRyb3BzQGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+DQpzaWRyb3BzQGlldGYub3JnPC9hPjxicj4NClN1YmplY3Q6IFtHUk9XXSBBU1BBIGFu ZCBSb3V0ZSBTZXJ2ZXIgKHdhcyBSRTogW1NpZHJvcHNdIElYUCBSb3V0ZSBTZXJ2ZXIgcXVlc3Rp b24pPGJyPg0KPGJyPg0KTmljayAoYW5kIGFsbCksPGJyPg0KPGJyPg0KSSB3YXMgYWxzbyByZXJl YWRpbmcvcmV2aWV3aW5nIFNlY3Rpb24gNS4zIGFuZCBoYWQgc2ltaWxhciB0aG91Z2h0cyBhYm91 dCB0aGUgdHdvIG9wdGlvbnMgeW91IG91dGxpbmVkLiBBcyB5b3Ugbm90ZWQsICZxdW90O3RoZSBh cHByb2FjaCBpbiBTZWN0aW9uIDUuMyBnaXZlcyBhIHdvcmthYmxlIG91dGNvbWUmcXVvdDsuJm5i c3A7IEhvd2V2ZXIuLi4NCjxicj4NCjxicj4NCiZndDsuLi4gdGhlIFJTIHNob3VsZCBiZSB0cmVh dGVkIGFzIGEgcHJvdmlkZXIgYnkgdGhlIHJzIGNsaWVudDsgdGhlIHJzIGNsaWVudCBzaG91bGQg aW5jbHVkZSB0aGUgUlMgQVNOIGluIGl0cyBTUEFTOyB0aGUgcnMgY2xpZW50IHNob3VsZCBldmFs dWF0ZSBBU1BBIGFzIGlmIHRoZSBSUyBBU04gd2VyZSBpbmNsdWRlZCBpbiB0aGUgcGF0aDsgdGhl IHJzIHNob3VsZCBldmFsdWF0ZSBjbGllbnRzIGFzIGN1c3RvbWVyczxicj4NCjxicj4NClllcywg SSBhZ3JlZSB0aGF0ICZxdW90O3RoZSBycyBjbGllbnQgc2hvdWxkIGluY2x1ZGUgdGhlIFJTIEFT TiBpbiBpdHMgU1BBUy4mcXVvdDsgQWxleGFuZGVyIGFuZCBJIGhhdmUgdGFsa2VkIGFib3V0IHRo aXMsIGFuZCBoZSBtZW50aW9uZWQgdGhhdCB0aGlzIHdvdWxkIGJlIGFkZGVkIHRvIHRoZSBkcmFm dC4NCjxicj4NCjxicj4NClllcywgSSBhbHNvIGZlZWwgdGhhdCBpdCBpcyBhIGJldHRlciBvcHRp b24gdGhhdCB0aGUgUlMgY2xpZW50IGFkZHMgdGhlIEFTTiBvZiB0aGUgdHJhbnNwYXJlbnQgUlMg dG8gdGhlIEFTIHBhdGggKGZvciBBU1BBIHZhbGlkYXRpb24gcHVycG9zZXMgb25seSkgYW5kIGFw cGxpZXMgdGhlIGRvd25zdHJlYW0gQVNQQSBhbGdvcml0aG0uIEFsZ29yaXRobWljYWxseSB0aGlz IHNlZW1zIG1vcmUgYXBwcm9wcmlhdGUuIFRoaXMgaXMgYWxzbyBiZXR0ZXINCiBmcm9tIGEgZGlh Z25vc3RpY3MgcG9pbnQgb2YgdmlldyAoaWYgdGhlIG5lZWQgZXZlciBhcmlzZXMpIGJlY2F1c2Ug aW4gdGhpcyBhcHByb2FjaCB0aGUgcmVsZXZhbnQgQVNQQSBpcyB1c2VkIGZvciB2YWxpZGF0aW5n IHRoZSBob3AgZnJvbSB0aGUgQVMganVzdCBiZWZvcmUgdGhlIFJTIHRvIHRoZSBSUy4mbmJzcDsN Cjxicj4NCjxicj4NClRoYXQgc2FpZCwgSSB0aGluayB0aGVyZSBpcyBhIGJpZ2dlciBpc3N1ZSBh Ym91dCB0cmFuc3BhcmVudCBSUyBpbiB0aGUgbWlkZGxlIG9mIHRoZSBBUyBwYXRoLiBNYXliZSB0 aGlzIGlzIHdoYXQgQmVuJ3MgcXVlc3Rpb24gd2FzIGhpbnRpbmcgYXQuIEkgdGhpbmsgeW91IGFy ZSBhbHNvIHJhaXNpbmcgdGhpcyBpc3N1ZSB3aGVuIHlvdSBzYXk6PGJyPg0KPGJyPg0KJmd0O1JT cyBkbyBub3QgcGFydGFrZSBpbiB0cmFmZmljIGZvcndhcmRpbmcsIHNvIHRoZXkgYXJlIG5vdCBw YXJ0IG9mIHRoZSBkYXRhIHBhdGggYmV0d2VlbiB0d28gQVNOczsgdGhleSdyZSBvbmx5IHBhcnQg b2YgdGhlIHNpZ25hbGluZyBwYXRoIGJldHdlZW4gdGhlIHR3byBBU05zLiZuYnNwOyBUaGlzIGlz IGEgdXNlZnVsIGhhY2sgZnJvbSBhIHByYWN0aWNhbCBwb2ludCBvZiB2aWV3LCBidXQgaXQgY2F1 c2VzIGFsZ29yaXRobWljIGJyZWFrYWdlIGluIHBsYWNlcw0KIHdoaWNoIGFzc3VtZSBjb25ncnVl bmN5IGJldHdlZW4gdGhlIGRhdGEgcGxhbmUgYW5kIHRoZSBzaWduYWxpbmcgcGxhbmUuJm5ic3A7 IE9uZSBvZiB0aGVzZSBwbGFjZXMgaXMgQVMgcGF0aCB2ZXJpZmljYXRpb24uPGJyPg0KPGJyPg0K Jmd0OyAuLi4uQVNQQSB2ZXJpZmljYXRpb24gc2hvdWxkIHByb2NlZWQgYXMgaWYgdGhlIHR3byBy cy1jbGllbnQgQVNOcyB3ZXJlIGRpcmVjdGx5IGNvbm5lY3RlZCBhbmQgZWFjaCBzaG91bGQgdHJl YXQgdGhlIG90aGVyIGFzIGEgcHJvdmlkZXI8bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgR3lhbiZndDtJIHVu ZGVyc3RhbmQgdGhlIGlzc3VlIHdpdGggdGhlIEFTUEEgcGF0aCB2ZXJpZmljYXRpb24sIGhvd2V2 ZXIgaWYgdGhlIFJTIEFTIGFkZGVkIHRvIEFTUEEgdGhlbiB0aGF0IHdvdWxkIGluZmx1ZW5jZSB0 aGUgZm9yd2FyZGluZyBwbGFuZSBpcyB0aGUgaXNzdWUuJm5ic3A7IEhvdyBkbyB5b3UgaW5zZXJ0 IFJTIEFTIGZvciB0aGUgQVNQQSBwYXRoIHZlcmlmaWNhdGlvbiBidXQgbm90IGFsbG93IFJTIHRv DQogYmUgcGFydCBvZiBmb3J3YXJkaW5nIHBsYW5lPyZuYnNwOyBJIGd1ZXNzIHlvdSBjb3VsZCBk byBhIG5leHQtaG9wLXVuY2hhbmdlZCBiZXR3ZWVuIHRoZSBjbGllbnRzIGNvbm5lY3RlZCB0aHJv dWdoIHRoZSBSUy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGlu IDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCkJhc2VkIG9uIHRoZSBhYm92ZSBvYnNlcnZhdGlvbnMg ZnJvbSB5b3UsIEkgYW0gcHJvcG9zaW5nIHRoZSBmb2xsb3dpbmc6PGJyPg0KPGJyPg0KQW4gUlMg Y2xpZW50IG9mIGFuIFJTICh0cmFuc3BhcmVudCBvciBub3QpIGluY2x1ZGVzIHRoZSBSUyBBUyBp biB0aGVpciBTUEFTL0FTUEEuIFRoZSBSUyBjbGllbnQgYWxzbyBpbmNsdWRlcyBpbiBpdHMgU1BB Uy9BU1BBIGFueSBBUyB3aXRoIHdob20gaXQgY29ubmVjdHMgaW4gdGhlIGNvbnRyb2wgcGxhbmUg dmlhIHRoZSBSUy48YnI+DQo8YnI+DQpUaGUgaWRlYSBpcyB0aGF0IGEgcGF0aCBzZWdtZW50IEFT eC1SUy1BU3kgKHdoZXJlIEFTeCBhbmQgQVN5IGFyZSBSUy1jbGllbnRzIGNvbm5lY3RlZCBpbiBC R1AgdmlhIHRoZSBSUykgd2lsbCBiZSBhbHdheXMgdmVyaWZpYWJsZSB3aXRoIHRoaXMgcHJvcG9z YWwgd2hldGhlciBvciBub3QgdGhlIFJTIGlzIHRyYW5zcGFyZW50LiBJZiB0aGUgQVNQQXMgYXJl IGNyZWF0ZWQgYnkgQVN4IGFuZCBBU3kgcGVyIHRoZSBwcm9wb3NhbCBhYm92ZSwgdGhlbg0KIHRo ZSBBU3gtUlMtQVN5IHNlZ21lbnQgd2lsbCBiZSBldmFsdWF0ZWQgYXMgVmFsaWQgaW4gZWl0aGVy IGRpcmVjdGlvbi4gSSZuYnNwOyB0aGluayB0aGlzIHByb3Bvc2FsIGluIGNvbmp1bmN0aW9uIHdp dGggb3RoZXIgaWRlYXMgZGlzY3Vzc2VkIGFib3ZlIHRha2VzIGNhcmUgb2YgYm90aCB0cmFuc3Bh cmVudCBhbmQgbm9uLXRyYW5zcGFyZW50IFJTcyBpbiB0aGUgQVNQQSB2ZXJpZmljYXRpb24gYWxn b3JpdGhtcy4gRG9lcyB0aGlzIHNlZW0gcmVhc29uYWJsZT88YnI+DQo8YnI+DQpUaGFuayB5b3Uu PGJyPg0KPGJyPg0KU3JpcmFtPGJyPg0KPGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX188YnI+DQpHUk9XIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9 Im1haWx0bzpHUk9XQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+R1JPV0BpZXRmLm9yZzwvYT48 YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2dyb3ci IHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2dy b3c8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwPjxh IGhyZWY9Imh0dHA6Ly93d3cudmVyaXpvbi5jb20vIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMxMTU1Q0M7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPjxpbWcgYm9yZGVyPSIwIiB3 aWR0aD0iODEiIGhlaWdodD0iMTgiIHN0eWxlPSJ3aWR0aDouODQzN2luO2hlaWdodDouMTg3NWlu IiBpZD0iX3gwMDAwX2kxMDI1IiBzcmM9Imh0dHA6Ly9zczcudnp3LmNvbS9pcy9pbWFnZS9WZXJp em9uV2lyZWxlc3MvdnotbG9nby1lbWFpbCI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iY29sb3I6 IzIyMjIyMiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowaW47bXNv LWxpbmUtaGVpZ2h0LWFsdDo5Ljc1cHQiPjxiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5HeWFuIE1pc2hyYTwvc3Bhbj48 L2I+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGlu O21zby1saW5lLWhlaWdodC1hbHQ6OS43NXB0Ij48aT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7R2VvcmdpYSZxdW90OyxzZXJpZjtjb2xvcjpibGFjayI+TmV0d29yayBTb2x1dGlvbnMg QXJjaGl0ZWN0Jm5ic3A7PC9zcGFuPjwvaT48c3BhbiBzdHlsZT0iY29sb3I6IzIyMjIyMiI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowaW47bXNvLWxpbmUtaGVpZ2h0 LWFsdDo5Ljc1cHQiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0dlb3JnaWEmcXVvdDssc2VyaWY7Y29sb3I6YmxhY2siPkVtYWlsDQo8YSBocmVmPSJt YWlsdG86Z3lhbi5zLm1pc2hyYUB2ZXJpem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmd5YW4ucy5t aXNocmFAdmVyaXpvbi5jb208L2E+PC9zcGFuPjwvaT48c3BhbiBzdHlsZT0iY29sb3I6IzIyMjIy MiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow aW47bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowaW47 bXNvLWxpbmUtaGVpZ2h0LWFsdDo5Ljc1cHQiPg0KPGk+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0dlb3JnaWEmcXVvdDssc2VyaWY7Y29sb3I6YmxhY2siPk0gMzAxIDUwMi0xMzQ3PC9z cGFuPjwvaT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_BYAPR11MB3207DE083AD888F3C963E347C0169BYAPR11MB3207namp_-- From nobody Mon Mar 21 08:48:40 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C02843A0D84; Mon, 21 Mar 2022 08:48:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5sdfuZlmkMtV; Mon, 21 Mar 2022 08:48:33 -0700 (PDT) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 663A93A0D78; Mon, 21 Mar 2022 08:48:33 -0700 (PDT) Received: from fraeml701-chm.china.huawei.com (unknown [172.18.147.207]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4KMfBl6LCgz67Mww; Mon, 21 Mar 2022 23:47:27 +0800 (CST) Received: from kwepeml100004.china.huawei.com (7.221.188.19) by fraeml701-chm.china.huawei.com (10.206.15.50) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2375.24; Mon, 21 Mar 2022 16:48:29 +0100 Received: from kwepeml500004.china.huawei.com (7.221.188.141) by kwepeml100004.china.huawei.com (7.221.188.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.21; Mon, 21 Mar 2022 23:48:27 +0800 Received: from kwepeml500004.china.huawei.com ([7.221.188.141]) by kwepeml500004.china.huawei.com ([7.221.188.141]) with mapi id 15.01.2308.021; Mon, 21 Mar 2022 23:48:27 +0800 From: Zhuangshunwan To: "Jakob Heitz (jheitz)" , Gyan Mishra , "Sriram, Kotikalapudi (Fed)" CC: Ben Maddison , "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPHZ5DD0pwhuq8ES1+K9Q/TYBZqzJ769QgAAIfUA= Date: Mon, 21 Mar 2022 15:48:27 +0000 Message-ID: References: In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.108.152.178] Content-Type: multipart/alternative; boundary="_000_a07986fb2d7147c0abb36229237d8982huaweicom_" MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2022 15:48:39 -0000 --_000_a07986fb2d7147c0abb36229237d8982huaweicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 KzENCkkgdGhpbmsgSmFjb2IncyBzdWdnZXN0aW9uIGlzIHJlYXNvbmFibGUuDQpJIG9uY2Ugd29y a2VkIG9uIGEgcm91dGUgbGVhayBhbmFseXNpcyBwcm9qZWN0LiBUaGVyZSBpcyBhIGZpcnN0IHN0 ZXAgaW4gdGhhdCBwcm9qZWN0LCB3aGljaCBpcyB0byBjbGVhciB0aGUgSVhQ4oCZcyBBUyBudW1i ZXIgYWRkZWQgdG8gdGhlIEFTLVBBVEggYnkgdGhlIG5vbi10cmFuc3BhcmVudCBSUy4NClRoZSBi YXNpYyBpZGVhIGlzIHRoYXQgYSBwYXRoIHNlZ21lbnQg4oCcQVMxIC0gQVN4IC0gUlPigJlzIEFT TiAtIEFTeSAtIEFTbuKAnSAod2hlcmUgQVN4IGFuZCBBU3kgYXJlIFJTLWNsaWVudHMgY29ubmVj dGVkIGluIEJHUCB2aWEgdGhlIFJTKSB3aWxsIGJlIGNvcnJlY3RlZCB0byDigJxBUzEgLSBBU3gg LSBBU3kgLSBBU27igJ0uDQpXaXRoIHRoaXMgcHJvY2Vzcywgd2UgY2FuIGV4Y2x1ZGUgdGhlIGlu Zmx1ZW5jZSBvZiBub24tdHJhbnNwYXJlbnQgUlMgb24gdGhlIGFjY3VyYWN5IG9mIHJvdXRlLWxl YWsgYW5hbHlzaXMuDQoNCktpbmQgUmVnYXJkcywNClNodW53YW4NCg0KRnJvbTogSmFrb2IgSGVp dHogKGpoZWl0eikgW21haWx0bzpqaGVpdHpAY2lzY28uY29tXQ0KU2VudDogTW9uZGF5LCBNYXJj aCAyMSwgMjAyMiAxMToxMyBQTQ0KVG86IEd5YW4gTWlzaHJhIDxoYXlhYnVzYWdzbUBnbWFpbC5j b20+OyBTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSA8a290aWthbGFwdWRpLnNyaXJhbT00MG5p c3QuZ292QGRtYXJjLmlldGYub3JnPg0KQ2M6IEJlbiBNYWRkaXNvbiA8YmVubUB3b3Jrb25saW5l LmFmcmljYT47IHNpZHJvcHNAaWV0Zi5vcmc7IGdyb3dAaWV0Zi5vcmc7IFpodWFuZ3NodW53YW4g PHpodWFuZ3NodW53YW5AaHVhd2VpLmNvbT47IE5pY2sgSGlsbGlhcmQgPG5pY2tAZm9vYmFyLm9y Zz4NClN1YmplY3Q6IFJFOiBbU2lkcm9wc10gW0dST1ddIEFTUEEgYW5kIFJvdXRlIFNlcnZlciAo d2FzIFJFOiBJWFAgUm91dGUgU2VydmVyIHF1ZXN0aW9uKQ0KDQpSb3V0ZSBzZXJ2ZXJzIGFyZSBh IGRpc3RyYWN0aW9uIGZvciBBU1BBLg0KQVNQQSBpcyBhYm91dCBCR1AgcGF0aCB2YWxpZGF0aW9u Lg0KQXMgc3VjaCBpdCBjb25jZXJucyBpdHNlbGYgd2l0aCBBU05zIGluIHRoZSBBUyBwYXRoLg0K SXQgaXMgYWJvdXQgcmVsYXRpb25zaGlwcyBiZXR3ZWVuIGFkamFjZW50IEFTZXMgaW4gdGhlIEFT IHBhdGguDQpTaW5jZSBSU2VzIGFyZSBub3QgaW4gdGhlIEFTIHBhdGgsIHRoZXkgY2Fubm90IGJl IGluY2x1ZGVkIGluIEFTUEEuDQpSU2VzIGFyZSBvbmx5IHZpc2libGUgYW5kIHJlbGV2YW50IHRv IHRoZSBkaXJlY3QgbmVpZ2hib3JzIG9mIHRoZSBSUy4NClRoZSBBU04gb2YgdGhlIFJTIGRvZXMg bm90IGFwcGVhciBpbiB0aGUgQVMgcGF0aCwgdGhlcmVmb3JlIGl0IGlzIG9mIG5vIGNvbmNlcm4g dG8gYW55b25lIHRoYXQgaXMgdHJ5aW5nIHRvIHZhbGlkYXRlIHRoZSBBUyBwYXRoLg0KQ291bGQg d2UgcGxlYXNlIHJlbW92ZSBhbGwgcmVmZXJlbmNlcyB0byByb3V0ZSBzZXJ2ZXJzIGZyb20gdGhl IEFTUEEgZHJhZnQgYW5kIGlzc3VlIGEgbmV3IGRyYWZ0IGFib3V0IHRyZWF0bWVudCBvZiByb3V0 ZSBzZXJ2ZXJzIG9ubHk/DQoNClJlZ2FyZHMsDQpKYWtvYi4NCg0KRnJvbTogU2lkcm9wcyA8c2lk cm9wcy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpzaWRyb3BzLWJvdW5jZXNAaWV0Zi5vcmc+PiBP biBCZWhhbGYgT2YgR3lhbiBNaXNocmENClNlbnQ6IFN1bmRheSwgTWFyY2ggMjAsIDIwMjIgOToy MCBBTQ0KVG86IFNyaXJhbSwgS290aWthbGFwdWRpIChGZWQpIDxrb3Rpa2FsYXB1ZGkuc3JpcmFt PTQwbmlzdC5nb3ZAZG1hcmMuaWV0Zi5vcmc8bWFpbHRvOmtvdGlrYWxhcHVkaS5zcmlyYW09NDBu aXN0LmdvdkBkbWFyYy5pZXRmLm9yZz4+DQpDYzogQmVuIE1hZGRpc29uIDxiZW5tQHdvcmtvbmxp bmUuYWZyaWNhPG1haWx0bzpiZW5tQHdvcmtvbmxpbmUuYWZyaWNhPj47IHNpZHJvcHNAaWV0Zi5v cmc8bWFpbHRvOnNpZHJvcHNAaWV0Zi5vcmc+OyBncm93QGlldGYub3JnPG1haWx0bzpncm93QGll dGYub3JnPjsgWmh1YW5nc2h1bndhbiA8emh1YW5nc2h1bndhbkBodWF3ZWkuY29tPG1haWx0bzp6 aHVhbmdzaHVud2FuQGh1YXdlaS5jb20+PjsgTmljayBIaWxsaWFyZCA8bmlja0Bmb29iYXIub3Jn PG1haWx0bzpuaWNrQGZvb2Jhci5vcmc+Pg0KU3ViamVjdDogUmU6IFtTaWRyb3BzXSBbR1JPV10g QVNQQSBhbmQgUm91dGUgU2VydmVyICh3YXMgUkU6IElYUCBSb3V0ZSBTZXJ2ZXIgcXVlc3Rpb24p DQoNCg0KSGkgU3JpcmFtDQoNCk9uIFN1biwgTWFyIDIwLCAyMDIyIGF0IDEwOjU5IEFNIFNyaXJh bSwgS290aWthbGFwdWRpIChGZWQpIDxrb3Rpa2FsYXB1ZGkuc3JpcmFtPTQwbmlzdC5nb3ZAZG1h cmMuaWV0Zi5vcmc8bWFpbHRvOjQwbmlzdC5nb3ZAZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNCkkg dGhpbmsgYSBjb3JyZWN0aW9uIGlzIHJlcXVpcmVkLiBJbnN0ZWFkIG9mIHdoYXQgd2FzIHNhaWQg YmVmb3JlIC0NCg0KIzE6IEFuIFJTIGNsaWVudCBvZiBhbiBSUyAodHJhbnNwYXJlbnQgb3Igbm90 KSBpbmNsdWRlcyB0aGUgUlMgQVMgaW4gdGhlaXIgU1BBUy9BU1BBLiBUaGUgUlMgY2xpZW50IGFs c28gaW5jbHVkZXMgaW4gaXRzIFNQQVMvQVNQQSBhbnkgQVMgd2l0aCB3aG9tIGl0IGNvbm5lY3Rz IGluIHRoZSBjb250cm9sIHBsYW5lIHZpYSB0aGUgUlMuDQoNCm9ubHkgdGhlIGZvbGxvd2luZyBz aW1wbGVyIHN0YXRlbWVudCBpcyByZXF1aXJlZCBpbiB0aGUgZHJhZnQ6DQoNCiMyOiBBbiBSUyBj bGllbnQgb2YgYW4gUlMgKHRyYW5zcGFyZW50IG9yIG5vdCkgaW5jbHVkZXMgdGhlIFJTIEFTIGlu IHRoZWlyIFNQQVMvQVNQQS4NCg0KVGhlIHJlYXNvbiBpcyBhcyBmb2xsb3dzLiBDb25zaWRlciB0 aGUgZm9sbG93aW5nIHRvcG9sb2d5IGFuZCBVcGRhdGUgZmxvdyBwZXIgYXJyb3dzOg0KDQpBUzEg KFJTIENsaWVudCkgLS0tLS0+IEFTMiAoUlMpIC0tLS0tPiAgQVMzIChSUyBDbGllbnQpIC0tLXAy cCAobGF0ZXJhbCBwZWVyKSAtLS0+ICBBUzQgKHZhbGlkYXRpbmcgQVMpDQoNCkFTNCBpcyB0aGUg cmVjZWl2aW5nL3ZhbGlkYXRpbmcgQVMuIFJlZ2FyZGxlc3Mgb2Ygd2hldGhlciB0aGUgUlMgaW5z ZXJ0cyBpdHMgQVNOIGluIHRoZSBBUyBwYXRoIG9yIG5vdCwgdGhlIFVwZGF0ZSBpcyBJbnZhbGlk IChyb3V0ZSBsZWFrKSBhdCBBUzQuIEJlY2F1c2Ugb25jZSB0aGUgVXBkYXRlIHRyYW5zaXRpb25l ZCB0byBhIGRvd253YXJkIHBhdGggYWZ0ZXIgdGhlIFJTLCBpdCBjYW5ub3QgYmUgc3Vic2VxdWVu dGx5IHNlbnQgdG8gYSBwcm92aWRlciBvciBsYXRlcmFsIHBlZXIuIEJ1dCB3aXRoICMxLCB0aGUg VXBkYXRlIHdpbGwgYmUgZXZhbHVhdGVkIGFzIFZhbGlkIChub3Qgcm91dGUgbGVhaykgYnkgdGhl IEFTUEEgdmVyaWZpY2F0aW9uIHByb2NlZHVyZSBpbiBjYXNlIHRoZSBSUyBpcyB0cmFuc3BhcmVu dC4gQnV0IHdpdGggIzIsIHRoZSBVcGRhdGUgd2lsbCBiZSBjb3JyZWN0bHkgZGV0ZWN0ZWQgYXMg YSByb3V0ZSBsZWFrICh3aGV0aGVyIHRoZSBSUyBpcyB0cmFuc3BhcmVudCBvciBub3QpLg0KDQpF eHBsYW5hdGlvbjogV2l0aCAjMSwgdGhlIGhvcCBBUzEtQVMzIGluIHRoZSB0cmFuc3BhcmVudCBj YXNlIGlzIGV2YWx1YXRlZCBhcyBWYWxpZCAoQzJQKSAoYXMgcGFydCBvZiBhbiBhc2NlbmRpbmcg dXAtcmFtcCBvbiB0aGUgbGVmdCkgYnkgdGhlIHByb2NlZHVyZSBhbmQgdGhhdCBpcyBub3QgZ29v ZC4gSS5lLiwgdGhlIGRldGVjdGlvbiBvZiB0aGUgYXBleCBpbiB0aGUgQVMgcGF0aCBhdCB0aGUg UlMgKG5vdCB2aXNpYmxlIGluIHRoZSBwYXRoKSBhbmQgaW52ZXJzaW9uIChub24tdXB3YXJkIGZs b3cpIGFmdGVyIHRoZSBSUyBpcyBvYnNjdXJlZCB3aXRoICMxIChpbiB0aGUgdHJhbnNwYXJlbnQg Y2FzZSkuIEhvd2V2ZXIsIHdpdGggIzIsIHRoZSBob3AgQVMxLUFTMyBpcyBldmFsdWF0ZWQgYXMg ImF0dGVzdGVkIG5vdCBQcm92aWRlciIuIFRoYXQgbWVhbnMgdGhhdCB0aGUgZGV0ZWN0aW9uIG9m IGFwZXgvaW52ZXJzaW9uIGF0IHRoZSBSUyAodGhvdWdoIG5vdCB2aXNpYmxlIGluIHRoZSBwYXRo KSBpcyBlZmZlY3RpdmVseSBub3QgbWlzc2VkIG91dCBieSB0aGUgcHJvY2VkdXJlIHdpdGggIzIu DQoNClRoYW5rIHlvdS4NCg0KU3JpcmFtDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpG cm9tOiBHUk9XIDxncm93LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmdyb3ctYm91bmNlc0BpZXRm Lm9yZz4+IE9uIEJlaGFsZiBPZiBTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKQ0KU2VudDogVHVl c2RheSwgTWFyY2ggMTUsIDIwMjIgMTE6MzQgQU0NClRvOiBOaWNrIEhpbGxpYXJkIDxuaWNrQGZv b2Jhci5vcmc8bWFpbHRvOm5pY2tAZm9vYmFyLm9yZz4+DQpDYzogQmVuIE1hZGRpc29uIDxiZW5t QHdvcmtvbmxpbmUuYWZyaWNhPG1haWx0bzpiZW5tQHdvcmtvbmxpbmUuYWZyaWNhPj47IGdyb3dA aWV0Zi5vcmc8bWFpbHRvOmdyb3dAaWV0Zi5vcmc+OyBzaWRyb3BzQGlldGYub3JnPG1haWx0bzpz aWRyb3BzQGlldGYub3JnPg0KU3ViamVjdDogW0dST1ddIEFTUEEgYW5kIFJvdXRlIFNlcnZlciAo d2FzIFJFOiBbU2lkcm9wc10gSVhQIFJvdXRlIFNlcnZlciBxdWVzdGlvbikNCg0KTmljayAoYW5k IGFsbCksDQoNCkkgd2FzIGFsc28gcmVyZWFkaW5nL3Jldmlld2luZyBTZWN0aW9uIDUuMyBhbmQg aGFkIHNpbWlsYXIgdGhvdWdodHMgYWJvdXQgdGhlIHR3byBvcHRpb25zIHlvdSBvdXRsaW5lZC4g QXMgeW91IG5vdGVkLCAidGhlIGFwcHJvYWNoIGluIFNlY3Rpb24gNS4zIGdpdmVzIGEgd29ya2Fi bGUgb3V0Y29tZSIuICBIb3dldmVyLi4uDQoNCj4uLi4gdGhlIFJTIHNob3VsZCBiZSB0cmVhdGVk IGFzIGEgcHJvdmlkZXIgYnkgdGhlIHJzIGNsaWVudDsgdGhlIHJzIGNsaWVudCBzaG91bGQgaW5j bHVkZSB0aGUgUlMgQVNOIGluIGl0cyBTUEFTOyB0aGUgcnMgY2xpZW50IHNob3VsZCBldmFsdWF0 ZSBBU1BBIGFzIGlmIHRoZSBSUyBBU04gd2VyZSBpbmNsdWRlZCBpbiB0aGUgcGF0aDsgdGhlIHJz IHNob3VsZCBldmFsdWF0ZSBjbGllbnRzIGFzIGN1c3RvbWVycw0KDQpZZXMsIEkgYWdyZWUgdGhh dCAidGhlIHJzIGNsaWVudCBzaG91bGQgaW5jbHVkZSB0aGUgUlMgQVNOIGluIGl0cyBTUEFTLiIg QWxleGFuZGVyIGFuZCBJIGhhdmUgdGFsa2VkIGFib3V0IHRoaXMsIGFuZCBoZSBtZW50aW9uZWQg dGhhdCB0aGlzIHdvdWxkIGJlIGFkZGVkIHRvIHRoZSBkcmFmdC4NCg0KWWVzLCBJIGFsc28gZmVl bCB0aGF0IGl0IGlzIGEgYmV0dGVyIG9wdGlvbiB0aGF0IHRoZSBSUyBjbGllbnQgYWRkcyB0aGUg QVNOIG9mIHRoZSB0cmFuc3BhcmVudCBSUyB0byB0aGUgQVMgcGF0aCAoZm9yIEFTUEEgdmFsaWRh dGlvbiBwdXJwb3NlcyBvbmx5KSBhbmQgYXBwbGllcyB0aGUgZG93bnN0cmVhbSBBU1BBIGFsZ29y aXRobS4gQWxnb3JpdGhtaWNhbGx5IHRoaXMgc2VlbXMgbW9yZSBhcHByb3ByaWF0ZS4gVGhpcyBp cyBhbHNvIGJldHRlciBmcm9tIGEgZGlhZ25vc3RpY3MgcG9pbnQgb2YgdmlldyAoaWYgdGhlIG5l ZWQgZXZlciBhcmlzZXMpIGJlY2F1c2UgaW4gdGhpcyBhcHByb2FjaCB0aGUgcmVsZXZhbnQgQVNQ QSBpcyB1c2VkIGZvciB2YWxpZGF0aW5nIHRoZSBob3AgZnJvbSB0aGUgQVMganVzdCBiZWZvcmUg dGhlIFJTIHRvIHRoZSBSUy4NCg0KVGhhdCBzYWlkLCBJIHRoaW5rIHRoZXJlIGlzIGEgYmlnZ2Vy IGlzc3VlIGFib3V0IHRyYW5zcGFyZW50IFJTIGluIHRoZSBtaWRkbGUgb2YgdGhlIEFTIHBhdGgu IE1heWJlIHRoaXMgaXMgd2hhdCBCZW4ncyBxdWVzdGlvbiB3YXMgaGludGluZyBhdC4gSSB0aGlu ayB5b3UgYXJlIGFsc28gcmFpc2luZyB0aGlzIGlzc3VlIHdoZW4geW91IHNheToNCg0KPlJTcyBk byBub3QgcGFydGFrZSBpbiB0cmFmZmljIGZvcndhcmRpbmcsIHNvIHRoZXkgYXJlIG5vdCBwYXJ0 IG9mIHRoZSBkYXRhIHBhdGggYmV0d2VlbiB0d28gQVNOczsgdGhleSdyZSBvbmx5IHBhcnQgb2Yg dGhlIHNpZ25hbGluZyBwYXRoIGJldHdlZW4gdGhlIHR3byBBU05zLiAgVGhpcyBpcyBhIHVzZWZ1 bCBoYWNrIGZyb20gYSBwcmFjdGljYWwgcG9pbnQgb2YgdmlldywgYnV0IGl0IGNhdXNlcyBhbGdv cml0aG1pYyBicmVha2FnZSBpbiBwbGFjZXMgd2hpY2ggYXNzdW1lIGNvbmdydWVuY3kgYmV0d2Vl biB0aGUgZGF0YSBwbGFuZSBhbmQgdGhlIHNpZ25hbGluZyBwbGFuZS4gIE9uZSBvZiB0aGVzZSBw bGFjZXMgaXMgQVMgcGF0aCB2ZXJpZmljYXRpb24uDQoNCj4gLi4uLkFTUEEgdmVyaWZpY2F0aW9u IHNob3VsZCBwcm9jZWVkIGFzIGlmIHRoZSB0d28gcnMtY2xpZW50IEFTTnMgd2VyZSBkaXJlY3Rs eSBjb25uZWN0ZWQgYW5kIGVhY2ggc2hvdWxkIHRyZWF0IHRoZSBvdGhlciBhcyBhIHByb3ZpZGVy DQoNCiAgICBHeWFuPkkgdW5kZXJzdGFuZCB0aGUgaXNzdWUgd2l0aCB0aGUgQVNQQSBwYXRoIHZl cmlmaWNhdGlvbiwgaG93ZXZlciBpZiB0aGUgUlMgQVMgYWRkZWQgdG8gQVNQQSB0aGVuIHRoYXQg d291bGQgaW5mbHVlbmNlIHRoZSBmb3J3YXJkaW5nIHBsYW5lIGlzIHRoZSBpc3N1ZS4gIEhvdyBk byB5b3UgaW5zZXJ0IFJTIEFTIGZvciB0aGUgQVNQQSBwYXRoIHZlcmlmaWNhdGlvbiBidXQgbm90 IGFsbG93IFJTIHRvIGJlIHBhcnQgb2YgZm9yd2FyZGluZyBwbGFuZT8gIEkgZ3Vlc3MgeW91IGNv dWxkIGRvIGEgbmV4dC1ob3AtdW5jaGFuZ2VkIGJldHdlZW4gdGhlIGNsaWVudHMgY29ubmVjdGVk IHRocm91Z2ggdGhlIFJTLg0KDQoNCkJhc2VkIG9uIHRoZSBhYm92ZSBvYnNlcnZhdGlvbnMgZnJv bSB5b3UsIEkgYW0gcHJvcG9zaW5nIHRoZSBmb2xsb3dpbmc6DQoNCkFuIFJTIGNsaWVudCBvZiBh biBSUyAodHJhbnNwYXJlbnQgb3Igbm90KSBpbmNsdWRlcyB0aGUgUlMgQVMgaW4gdGhlaXIgU1BB Uy9BU1BBLiBUaGUgUlMgY2xpZW50IGFsc28gaW5jbHVkZXMgaW4gaXRzIFNQQVMvQVNQQSBhbnkg QVMgd2l0aCB3aG9tIGl0IGNvbm5lY3RzIGluIHRoZSBjb250cm9sIHBsYW5lIHZpYSB0aGUgUlMu DQoNClRoZSBpZGVhIGlzIHRoYXQgYSBwYXRoIHNlZ21lbnQgQVN4LVJTLUFTeSAod2hlcmUgQVN4 IGFuZCBBU3kgYXJlIFJTLWNsaWVudHMgY29ubmVjdGVkIGluIEJHUCB2aWEgdGhlIFJTKSB3aWxs IGJlIGFsd2F5cyB2ZXJpZmlhYmxlIHdpdGggdGhpcyBwcm9wb3NhbCB3aGV0aGVyIG9yIG5vdCB0 aGUgUlMgaXMgdHJhbnNwYXJlbnQuIElmIHRoZSBBU1BBcyBhcmUgY3JlYXRlZCBieSBBU3ggYW5k IEFTeSBwZXIgdGhlIHByb3Bvc2FsIGFib3ZlLCB0aGVuIHRoZSBBU3gtUlMtQVN5IHNlZ21lbnQg d2lsbCBiZSBldmFsdWF0ZWQgYXMgVmFsaWQgaW4gZWl0aGVyIGRpcmVjdGlvbi4gSSAgdGhpbmsg dGhpcyBwcm9wb3NhbCBpbiBjb25qdW5jdGlvbiB3aXRoIG90aGVyIGlkZWFzIGRpc2N1c3NlZCBh Ym92ZSB0YWtlcyBjYXJlIG9mIGJvdGggdHJhbnNwYXJlbnQgYW5kIG5vbi10cmFuc3BhcmVudCBS U3MgaW4gdGhlIEFTUEEgdmVyaWZpY2F0aW9uIGFsZ29yaXRobXMuIERvZXMgdGhpcyBzZWVtIHJl YXNvbmFibGU/DQoNClRoYW5rIHlvdS4NCg0KU3JpcmFtDQoNCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQpHUk9XIG1haWxpbmcgbGlzdA0KR1JPV0BpZXRm Lm9yZzxtYWlsdG86R1JPV0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vZ3Jvdw0KLS0NCg0KW2h0dHA6Ly9zczcudnp3LmNvbS9pcy9pbWFnZS9WZXJpem9u V2lyZWxlc3MvdnotbG9nby1lbWFpbF08aHR0cDovL3d3dy52ZXJpem9uLmNvbS8+DQoNCkd5YW4g TWlzaHJhDQoNCk5ldHdvcmsgU29sdXRpb25zIEFyY2hpdGVjdA0KDQpFbWFpbCBneWFuLnMubWlz aHJhQHZlcml6b24uY29tPG1haWx0bzpneWFuLnMubWlzaHJhQHZlcml6b24uY29tPg0KDQpNIDMw MSA1MDItMTM0Nw0KDQo= --_000_a07986fb2d7147c0abb36229237d8982huaweicom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OuWui+S9kzsNCglwYW5vc2UtMToyIDEgNiAwIDMgMSAxIDEgMSAxO30N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eTpHZW9yZ2lhOw0KCXBhbm9zZS0xOjIgNCA1IDIgNSA0IDUgMiAzIDM7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiXEDlrovkvZMiOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7 fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRp di5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9u dC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxp bmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpi bHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5 cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7 DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OuWui+S9kzt9DQpzcGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjojNDQxRDYxO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMx RjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ Zm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5 Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAv Pg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxh eW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwv bzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IlpI LUNOIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQt c2l6ZToxMC41cHQ7Y29sb3I6IzFGNDk3RCI+JiM0MzsxPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6 MTAuNXB0O2NvbG9yOiMxRjQ5N0QiPkkgdGhpbmsgSmFjb2IncyBzdWdnZXN0aW9uIGlzIHJlYXNv bmFibGUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2NvbG9yOiMxRjQ5N0QiPkkgb25j ZSB3b3JrZWQgb24gYSByb3V0ZSBsZWFrIGFuYWx5c2lzIHByb2plY3QuIFRoZXJlIGlzIGEgZmly c3Qgc3RlcCBpbiB0aGF0IHByb2plY3QsIHdoaWNoIGlzIHRvIGNsZWFyIHRoZSBJWFDigJlzIEFT IG51bWJlciBhZGRlZCB0byB0aGUgQVMtUEFUSCBieSB0aGUgbm9uLXRyYW5zcGFyZW50IFJTLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xvcjojMUY0OTdEIj5UaGUgYmFzaWMgaWRl YSBpcyB0aGF0IGEgcGF0aCBzZWdtZW50IOKAnEFTMSAtIEFTeCAtIFJT4oCZcyBBU04gLSBBU3kg LSBBU27igJ0gKHdoZXJlIEFTeCBhbmQgQVN5IGFyZSBSUy1jbGllbnRzIGNvbm5lY3RlZCBpbiBC R1AgdmlhIHRoZSBSUykgd2lsbCBiZSBjb3JyZWN0ZWQgdG8g4oCcQVMxIC0gQVN4IC0gQVN5IC0g QVNu4oCdLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xvcjojMUY0OTdEIj5XaXRo IHRoaXMgcHJvY2Vzcywgd2UgY2FuIGV4Y2x1ZGUgdGhlIGluZmx1ZW5jZSBvZiBub24tdHJhbnNw YXJlbnQgUlMgb24gdGhlIGFjY3VyYWN5IG9mIHJvdXRlLWxlYWsgYW5hbHlzaXMuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJmb250LXNpemU6MTAuNXB0O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0i Zm9udC1zaXplOjEwLjVwdDtjb2xvcjojMUY0OTdEIj5LaW5kIFJlZ2FyZHMsPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxl PSJmb250LXNpemU6MTAuNXB0O2NvbG9yOiMxRjQ5N0QiPlNodW53YW48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZv bnQtc2l6ZToxMC41cHQ7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtw YWRkaW5nOjBjbSAwY20gMGNtIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBj bSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1VUyI+RnJvbTo8L3Nw YW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gSmFrb2IgSGVpdHogKGpoZWl0eikgW21haWx0bzpq aGVpdHpAY2lzY28uY29tXQ0KPGJyPg0KPGI+U2VudDo8L2I+IE1vbmRheSwgTWFyY2ggMjEsIDIw MjIgMTE6MTMgUE08YnI+DQo8Yj5Ubzo8L2I+IEd5YW4gTWlzaHJhICZsdDtoYXlhYnVzYWdzbUBn bWFpbC5jb20mZ3Q7OyBTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSAmbHQ7a290aWthbGFwdWRp LnNyaXJhbT00MG5pc3QuZ292QGRtYXJjLmlldGYub3JnJmd0Ozxicj4NCjxiPkNjOjwvYj4gQmVu IE1hZGRpc29uICZsdDtiZW5tQHdvcmtvbmxpbmUuYWZyaWNhJmd0Ozsgc2lkcm9wc0BpZXRmLm9y ZzsgZ3Jvd0BpZXRmLm9yZzsgWmh1YW5nc2h1bndhbiAmbHQ7emh1YW5nc2h1bndhbkBodWF3ZWku Y29tJmd0OzsgTmljayBIaWxsaWFyZCAmbHQ7bmlja0Bmb29iYXIub3JnJmd0Ozxicj4NCjxiPlN1 YmplY3Q6PC9iPiBSRTogW1NpZHJvcHNdIFtHUk9XXSBBU1BBIGFuZCBSb3V0ZSBTZXJ2ZXIgKHdh cyBSRTogSVhQIFJvdXRlIFNlcnZlciBxdWVzdGlvbik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj5Sb3V0ZSBz ZXJ2ZXJzIGFyZSBhIGRpc3RyYWN0aW9uIGZvciBBU1BBLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdDtjb2xvcjojNDQxRDYxIj5BU1BBIGlzIGFib3V0IEJHUCBwYXRoIHZhbGlkYXRpb24u PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPkFzIHN1Y2ggaXQg Y29uY2VybnMgaXRzZWxmIHdpdGggQVNOcyBpbiB0aGUgQVMgcGF0aC48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+SXQgaXMgYWJvdXQgcmVsYXRpb25zaGlwcyBi ZXR3ZWVuIGFkamFjZW50IEFTZXMgaW4gdGhlIEFTIHBhdGguPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPlNpbmNlIFJTZXMgYXJlIG5vdCBpbiB0aGUgQVMgcGF0 aCwgdGhleSBjYW5ub3QgYmUgaW5jbHVkZWQgaW4gQVNQQS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+UlNlcyBhcmUgb25seSB2aXNpYmxlIGFuZCByZWxldmFu dCB0byB0aGUgZGlyZWN0IG5laWdoYm9ycyBvZiB0aGUgUlMuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPlRoZSBBU04gb2YgdGhlIFJTIGRvZXMgbm90IGFwcGVh ciBpbiB0aGUgQVMgcGF0aCwgdGhlcmVmb3JlIGl0IGlzIG9mIG5vIGNvbmNlcm4gdG8gYW55b25l IHRoYXQgaXMgdHJ5aW5nIHRvIHZhbGlkYXRlIHRoZSBBUyBwYXRoLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj5Db3VsZCB3ZSBwbGVhc2UgcmVtb3ZlIGFsbCBy ZWZlcmVuY2VzIHRvIHJvdXRlIHNlcnZlcnMgZnJvbSB0aGUgQVNQQSBkcmFmdCBhbmQgaXNzdWUg YSBuZXcgZHJhZnQgYWJvdXQgdHJlYXRtZW50IG9mIHJvdXRlIHNlcnZlcnMgb25seT88bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIg c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPlJlZ2FyZHMsPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPkpha29iLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFk ZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBs YW5nPSJFTi1VUyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gU2lkcm9wcyAm bHQ7PGEgaHJlZj0ibWFpbHRvOnNpZHJvcHMtYm91bmNlc0BpZXRmLm9yZyI+c2lkcm9wcy1ib3Vu Y2VzQGlldGYub3JnPC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+R3lhbiBNaXNocmE8YnI+ DQo8Yj5TZW50OjwvYj4gU3VuZGF5LCBNYXJjaCAyMCwgMjAyMiA5OjIwIEFNPGJyPg0KPGI+VG86 PC9iPiBTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmtvdGlr YWxhcHVkaS5zcmlyYW09NDBuaXN0LmdvdkBkbWFyYy5pZXRmLm9yZyI+a290aWthbGFwdWRpLnNy aXJhbT00MG5pc3QuZ292QGRtYXJjLmlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IEJl biBNYWRkaXNvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJlbm1Ad29ya29ubGluZS5hZnJpY2EiPmJl bm1Ad29ya29ubGluZS5hZnJpY2E8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpzaWRyb3BzQGll dGYub3JnIj5zaWRyb3BzQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmdyb3dAaWV0Zi5v cmciPg0KZ3Jvd0BpZXRmLm9yZzwvYT47IFpodWFuZ3NodW53YW4gJmx0OzxhIGhyZWY9Im1haWx0 bzp6aHVhbmdzaHVud2FuQGh1YXdlaS5jb20iPnpodWFuZ3NodW53YW5AaHVhd2VpLmNvbTwvYT4m Z3Q7OyBOaWNrIEhpbGxpYXJkICZsdDs8YSBocmVmPSJtYWlsdG86bmlja0Bmb29iYXIub3JnIj5u aWNrQGZvb2Jhci5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1NpZHJvcHNd IFtHUk9XXSBBU1BBIGFuZCBSb3V0ZSBTZXJ2ZXIgKHdhcyBSRTogSVhQIFJvdXRlIFNlcnZlciBx dWVzdGlvbik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1VUyI+SGkgU3JpcmFtPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPk9uIFN1biwgTWFyIDIwLCAyMDIy IGF0IDEwOjU5IEFNIFNyaXJhbSwgS290aWthbGFwdWRpIChGZWQpICZsdDtrb3Rpa2FsYXB1ZGku c3JpcmFtPTxhIGhyZWY9Im1haWx0bzo0MG5pc3QuZ292QGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9 Il9ibGFuayI+NDBuaXN0LmdvdkBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDtt YXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowY207bWFyZ2lu LWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+ SSB0aGluayBhIGNvcnJlY3Rpb24gaXMgcmVxdWlyZWQuIEluc3RlYWQgb2Ygd2hhdCB3YXMgc2Fp ZCBiZWZvcmUgLTxicj4NCjxicj4NCiMxOiBBbiBSUyBjbGllbnQgb2YgYW4gUlMgKHRyYW5zcGFy ZW50IG9yIG5vdCkgaW5jbHVkZXMgdGhlIFJTIEFTIGluIHRoZWlyIFNQQVMvQVNQQS4gVGhlIFJT IGNsaWVudCBhbHNvIGluY2x1ZGVzIGluIGl0cyBTUEFTL0FTUEEgYW55IEFTIHdpdGggd2hvbSBp dCBjb25uZWN0cyBpbiB0aGUgY29udHJvbCBwbGFuZSB2aWEgdGhlIFJTLjxicj4NCjxicj4NCm9u bHkgdGhlIGZvbGxvd2luZyBzaW1wbGVyIHN0YXRlbWVudCBpcyByZXF1aXJlZCBpbiB0aGUgZHJh ZnQ6PGJyPg0KPGJyPg0KIzI6IEFuIFJTIGNsaWVudCBvZiBhbiBSUyAodHJhbnNwYXJlbnQgb3Ig bm90KSBpbmNsdWRlcyB0aGUgUlMgQVMgaW4gdGhlaXIgU1BBUy9BU1BBLg0KPGJyPg0KPGJyPg0K VGhlIHJlYXNvbiBpcyBhcyBmb2xsb3dzLiBDb25zaWRlciB0aGUgZm9sbG93aW5nIHRvcG9sb2d5 IGFuZCBVcGRhdGUgZmxvdyBwZXIgYXJyb3dzOjxicj4NCjxicj4NCkFTMSAoUlMgQ2xpZW50KSAt LS0tLSZndDsgQVMyIChSUykgLS0tLS0mZ3Q7Jm5ic3A7IEFTMyAoUlMgQ2xpZW50KSAtLS1wMnAg KGxhdGVyYWwgcGVlcikgLS0tJmd0OyZuYnNwOyBBUzQgKHZhbGlkYXRpbmcgQVMpPGJyPg0KPGJy Pg0KQVM0IGlzIHRoZSByZWNlaXZpbmcvdmFsaWRhdGluZyBBUy4gUmVnYXJkbGVzcyBvZiB3aGV0 aGVyIHRoZSBSUyBpbnNlcnRzIGl0cyBBU04gaW4gdGhlIEFTIHBhdGggb3Igbm90LCB0aGUgVXBk YXRlIGlzIEludmFsaWQgKHJvdXRlIGxlYWspIGF0IEFTNC4gQmVjYXVzZSBvbmNlIHRoZSBVcGRh dGUgdHJhbnNpdGlvbmVkIHRvIGEgZG93bndhcmQgcGF0aCBhZnRlciB0aGUgUlMsIGl0IGNhbm5v dCBiZSBzdWJzZXF1ZW50bHkgc2VudCB0byBhIHByb3ZpZGVyDQogb3IgbGF0ZXJhbCBwZWVyLiBC dXQgd2l0aCAjMSwgdGhlIFVwZGF0ZSB3aWxsIGJlIGV2YWx1YXRlZCBhcyBWYWxpZCAobm90IHJv dXRlIGxlYWspIGJ5IHRoZSBBU1BBIHZlcmlmaWNhdGlvbiBwcm9jZWR1cmUgaW4gY2FzZSB0aGUg UlMgaXMgdHJhbnNwYXJlbnQuIEJ1dCB3aXRoICMyLCB0aGUgVXBkYXRlIHdpbGwgYmUgY29ycmVj dGx5IGRldGVjdGVkIGFzIGEgcm91dGUgbGVhayAod2hldGhlciB0aGUgUlMgaXMgdHJhbnNwYXJl bnQgb3Igbm90KS4NCjxicj4NCjxicj4NCkV4cGxhbmF0aW9uOiBXaXRoICMxLCB0aGUgaG9wIEFT MS1BUzMgaW4gdGhlIHRyYW5zcGFyZW50IGNhc2UgaXMgZXZhbHVhdGVkIGFzIFZhbGlkIChDMlAp IChhcyBwYXJ0IG9mIGFuIGFzY2VuZGluZyB1cC1yYW1wIG9uIHRoZSBsZWZ0KSBieSB0aGUgcHJv Y2VkdXJlIGFuZCB0aGF0IGlzIG5vdCBnb29kLiBJLmUuLCB0aGUgZGV0ZWN0aW9uIG9mIHRoZSBh cGV4IGluIHRoZSBBUyBwYXRoIGF0IHRoZSBSUyAobm90IHZpc2libGUgaW4gdGhlIHBhdGgpDQog YW5kIGludmVyc2lvbiAobm9uLXVwd2FyZCBmbG93KSBhZnRlciB0aGUgUlMgaXMgb2JzY3VyZWQg d2l0aCAjMSAoaW4gdGhlIHRyYW5zcGFyZW50IGNhc2UpLiBIb3dldmVyLCB3aXRoICMyLCB0aGUg aG9wIEFTMS1BUzMgaXMgZXZhbHVhdGVkIGFzICZxdW90O2F0dGVzdGVkIG5vdCBQcm92aWRlciZx dW90Oy4gVGhhdCBtZWFucyB0aGF0IHRoZSBkZXRlY3Rpb24gb2YgYXBleC9pbnZlcnNpb24gYXQg dGhlIFJTICh0aG91Z2ggbm90IHZpc2libGUgaW4gdGhlIHBhdGgpDQogaXMgZWZmZWN0aXZlbHkg bm90IG1pc3NlZCBvdXQgYnkgdGhlIHByb2NlZHVyZSB3aXRoICMyLiA8YnI+DQo8YnI+DQpUaGFu ayB5b3UuPGJyPg0KPGJyPg0KU3JpcmFtJm5ic3A7ICZuYnNwOyAmbmJzcDsgPGJyPg0KPGJyPg0K LS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS08YnI+DQpGcm9tOiBHUk9XICZsdDs8YSBocmVmPSJt YWlsdG86Z3Jvdy1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+Z3Jvdy1ib3VuY2Vz QGlldGYub3JnPC9hPiZndDsgT24gQmVoYWxmIE9mIFNyaXJhbSwgS290aWthbGFwdWRpIChGZWQp PGJyPg0KU2VudDogVHVlc2RheSwgTWFyY2ggMTUsIDIwMjIgMTE6MzQgQU08YnI+DQpUbzogTmlj ayBIaWxsaWFyZCAmbHQ7PGEgaHJlZj0ibWFpbHRvOm5pY2tAZm9vYmFyLm9yZyIgdGFyZ2V0PSJf YmxhbmsiPm5pY2tAZm9vYmFyLm9yZzwvYT4mZ3Q7PGJyPg0KQ2M6IEJlbiBNYWRkaXNvbiAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmJlbm1Ad29ya29ubGluZS5hZnJpY2EiPmJlbm1Ad29ya29ubGluZS5h ZnJpY2E8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpncm93QGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+Z3Jvd0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpzaWRyb3BzQGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayI+DQpzaWRyb3BzQGlldGYub3JnPC9hPjxicj4NClN1YmplY3Q6IFtH Uk9XXSBBU1BBIGFuZCBSb3V0ZSBTZXJ2ZXIgKHdhcyBSRTogW1NpZHJvcHNdIElYUCBSb3V0ZSBT ZXJ2ZXIgcXVlc3Rpb24pPGJyPg0KPGJyPg0KTmljayAoYW5kIGFsbCksPGJyPg0KPGJyPg0KSSB3 YXMgYWxzbyByZXJlYWRpbmcvcmV2aWV3aW5nIFNlY3Rpb24gNS4zIGFuZCBoYWQgc2ltaWxhciB0 aG91Z2h0cyBhYm91dCB0aGUgdHdvIG9wdGlvbnMgeW91IG91dGxpbmVkLiBBcyB5b3Ugbm90ZWQs ICZxdW90O3RoZSBhcHByb2FjaCBpbiBTZWN0aW9uIDUuMyBnaXZlcyBhIHdvcmthYmxlIG91dGNv bWUmcXVvdDsuJm5ic3A7IEhvd2V2ZXIuLi4NCjxicj4NCjxicj4NCiZndDsuLi4gdGhlIFJTIHNo b3VsZCBiZSB0cmVhdGVkIGFzIGEgcHJvdmlkZXIgYnkgdGhlIHJzIGNsaWVudDsgdGhlIHJzIGNs aWVudCBzaG91bGQgaW5jbHVkZSB0aGUgUlMgQVNOIGluIGl0cyBTUEFTOyB0aGUgcnMgY2xpZW50 IHNob3VsZCBldmFsdWF0ZSBBU1BBIGFzIGlmIHRoZSBSUyBBU04gd2VyZSBpbmNsdWRlZCBpbiB0 aGUgcGF0aDsgdGhlIHJzIHNob3VsZCBldmFsdWF0ZSBjbGllbnRzIGFzIGN1c3RvbWVyczxicj4N Cjxicj4NClllcywgSSBhZ3JlZSB0aGF0ICZxdW90O3RoZSBycyBjbGllbnQgc2hvdWxkIGluY2x1 ZGUgdGhlIFJTIEFTTiBpbiBpdHMgU1BBUy4mcXVvdDsgQWxleGFuZGVyIGFuZCBJIGhhdmUgdGFs a2VkIGFib3V0IHRoaXMsIGFuZCBoZSBtZW50aW9uZWQgdGhhdCB0aGlzIHdvdWxkIGJlIGFkZGVk IHRvIHRoZSBkcmFmdC4NCjxicj4NCjxicj4NClllcywgSSBhbHNvIGZlZWwgdGhhdCBpdCBpcyBh IGJldHRlciBvcHRpb24gdGhhdCB0aGUgUlMgY2xpZW50IGFkZHMgdGhlIEFTTiBvZiB0aGUgdHJh bnNwYXJlbnQgUlMgdG8gdGhlIEFTIHBhdGggKGZvciBBU1BBIHZhbGlkYXRpb24gcHVycG9zZXMg b25seSkgYW5kIGFwcGxpZXMgdGhlIGRvd25zdHJlYW0gQVNQQSBhbGdvcml0aG0uIEFsZ29yaXRo bWljYWxseSB0aGlzIHNlZW1zIG1vcmUgYXBwcm9wcmlhdGUuIFRoaXMgaXMgYWxzbyBiZXR0ZXIN CiBmcm9tIGEgZGlhZ25vc3RpY3MgcG9pbnQgb2YgdmlldyAoaWYgdGhlIG5lZWQgZXZlciBhcmlz ZXMpIGJlY2F1c2UgaW4gdGhpcyBhcHByb2FjaCB0aGUgcmVsZXZhbnQgQVNQQSBpcyB1c2VkIGZv ciB2YWxpZGF0aW5nIHRoZSBob3AgZnJvbSB0aGUgQVMganVzdCBiZWZvcmUgdGhlIFJTIHRvIHRo ZSBSUy4mbmJzcDsNCjxicj4NCjxicj4NClRoYXQgc2FpZCwgSSB0aGluayB0aGVyZSBpcyBhIGJp Z2dlciBpc3N1ZSBhYm91dCB0cmFuc3BhcmVudCBSUyBpbiB0aGUgbWlkZGxlIG9mIHRoZSBBUyBw YXRoLiBNYXliZSB0aGlzIGlzIHdoYXQgQmVuJ3MgcXVlc3Rpb24gd2FzIGhpbnRpbmcgYXQuIEkg dGhpbmsgeW91IGFyZSBhbHNvIHJhaXNpbmcgdGhpcyBpc3N1ZSB3aGVuIHlvdSBzYXk6PGJyPg0K PGJyPg0KJmd0O1JTcyBkbyBub3QgcGFydGFrZSBpbiB0cmFmZmljIGZvcndhcmRpbmcsIHNvIHRo ZXkgYXJlIG5vdCBwYXJ0IG9mIHRoZSBkYXRhIHBhdGggYmV0d2VlbiB0d28gQVNOczsgdGhleSdy ZSBvbmx5IHBhcnQgb2YgdGhlIHNpZ25hbGluZyBwYXRoIGJldHdlZW4gdGhlIHR3byBBU05zLiZu YnNwOyBUaGlzIGlzIGEgdXNlZnVsIGhhY2sgZnJvbSBhIHByYWN0aWNhbCBwb2ludCBvZiB2aWV3 LCBidXQgaXQgY2F1c2VzIGFsZ29yaXRobWljIGJyZWFrYWdlIGluIHBsYWNlcw0KIHdoaWNoIGFz c3VtZSBjb25ncnVlbmN5IGJldHdlZW4gdGhlIGRhdGEgcGxhbmUgYW5kIHRoZSBzaWduYWxpbmcg cGxhbmUuJm5ic3A7IE9uZSBvZiB0aGVzZSBwbGFjZXMgaXMgQVMgcGF0aCB2ZXJpZmljYXRpb24u PGJyPg0KPGJyPg0KJmd0OyAuLi4uQVNQQSB2ZXJpZmljYXRpb24gc2hvdWxkIHByb2NlZWQgYXMg aWYgdGhlIHR3byBycy1jbGllbnQgQVNOcyB3ZXJlIGRpcmVjdGx5IGNvbm5lY3RlZCBhbmQgZWFj aCBzaG91bGQgdHJlYXQgdGhlIG90aGVyIGFzIGEgcHJvdmlkZXI8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsgJm5ic3A7IEd5YW4m Z3Q7SSB1bmRlcnN0YW5kIHRoZSBpc3N1ZSB3aXRoIHRoZSBBU1BBIHBhdGggdmVyaWZpY2F0aW9u LCBob3dldmVyIGlmIHRoZSBSUyBBUyBhZGRlZCB0byBBU1BBIHRoZW4gdGhhdCB3b3VsZCBpbmZs dWVuY2UgdGhlIGZvcndhcmRpbmcgcGxhbmUgaXMgdGhlIGlzc3VlLiZuYnNwOyBIb3cgZG8geW91 IGluc2VydCBSUyBBUyBmb3IgdGhlIEFTUEEgcGF0aCB2ZXJpZmljYXRpb24NCiBidXQgbm90IGFs bG93IFJTIHRvIGJlIHBhcnQgb2YgZm9yd2FyZGluZyBwbGFuZT8mbmJzcDsgSSBndWVzcyB5b3Ug Y291bGQgZG8gYSBuZXh0LWhvcC11bmNoYW5nZWQgYmV0d2VlbiB0aGUgY2xpZW50cyBjb25uZWN0 ZWQgdGhyb3VnaCB0aGUgUlMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtw YWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48YnI+DQo8YnI+DQpCYXNlZCBvbiB0aGUgYWJvdmUg b2JzZXJ2YXRpb25zIGZyb20geW91LCBJIGFtIHByb3Bvc2luZyB0aGUgZm9sbG93aW5nOjxicj4N Cjxicj4NCkFuIFJTIGNsaWVudCBvZiBhbiBSUyAodHJhbnNwYXJlbnQgb3Igbm90KSBpbmNsdWRl cyB0aGUgUlMgQVMgaW4gdGhlaXIgU1BBUy9BU1BBLiBUaGUgUlMgY2xpZW50IGFsc28gaW5jbHVk ZXMgaW4gaXRzIFNQQVMvQVNQQSBhbnkgQVMgd2l0aCB3aG9tIGl0IGNvbm5lY3RzIGluIHRoZSBj b250cm9sIHBsYW5lIHZpYSB0aGUgUlMuPGJyPg0KPGJyPg0KVGhlIGlkZWEgaXMgdGhhdCBhIHBh dGggc2VnbWVudCBBU3gtUlMtQVN5ICh3aGVyZSBBU3ggYW5kIEFTeSBhcmUgUlMtY2xpZW50cyBj b25uZWN0ZWQgaW4gQkdQIHZpYSB0aGUgUlMpIHdpbGwgYmUgYWx3YXlzIHZlcmlmaWFibGUgd2l0 aCB0aGlzIHByb3Bvc2FsIHdoZXRoZXIgb3Igbm90IHRoZSBSUyBpcyB0cmFuc3BhcmVudC4gSWYg dGhlIEFTUEFzIGFyZSBjcmVhdGVkIGJ5IEFTeCBhbmQgQVN5IHBlciB0aGUgcHJvcG9zYWwgYWJv dmUsIHRoZW4NCiB0aGUgQVN4LVJTLUFTeSBzZWdtZW50IHdpbGwgYmUgZXZhbHVhdGVkIGFzIFZh bGlkIGluIGVpdGhlciBkaXJlY3Rpb24uIEkmbmJzcDsgdGhpbmsgdGhpcyBwcm9wb3NhbCBpbiBj b25qdW5jdGlvbiB3aXRoIG90aGVyIGlkZWFzIGRpc2N1c3NlZCBhYm92ZSB0YWtlcyBjYXJlIG9m IGJvdGggdHJhbnNwYXJlbnQgYW5kIG5vbi10cmFuc3BhcmVudCBSU3MgaW4gdGhlIEFTUEEgdmVy aWZpY2F0aW9uIGFsZ29yaXRobXMuIERvZXMgdGhpcyBzZWVtIHJlYXNvbmFibGU/PGJyPg0KPGJy Pg0KVGhhbmsgeW91Ljxicj4NCjxicj4NClNyaXJhbTxicj4NCjxicj4NCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KR1JPVyBtYWlsaW5nIGxpc3Q8 YnI+DQo8YSBocmVmPSJtYWlsdG86R1JPV0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkdST1dA aWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9ncm93IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9ncm93PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLVVTIj4tLSA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cD48c3BhbiBsYW5nPSJF Ti1VUyI+PGEgaHJlZj0iaHR0cDovL3d3dy52ZXJpem9uLmNvbS8iIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6IzExNTVDQzt0ZXh0LWRlY29yYXRpb246bm9uZSI+PGltZyBib3Jk ZXI9IjAiIHdpZHRoPSI4MSIgaGVpZ2h0PSIxOCIgaWQ9Il94MDAwMF9pMTAyNSIgc3JjPSJodHRw Oi8vc3M3LnZ6dy5jb20vaXMvaW1hZ2UvVmVyaXpvbldpcmVsZXNzL3Z6LWxvZ28tZW1haWwiPjwv c3Bhbj48L2E+PHNwYW4gc3R5bGU9ImNvbG9yOiMyMjIyMjIiPjxvOnA+PC9vOnA+PC9zcGFuPjwv c3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQ7bXNv LWxpbmUtaGVpZ2h0LWFsdDo5Ljc1cHQiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+R3lhbiBN aXNocmE8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0O21zby1saW5l LWhlaWdodC1hbHQ6OS43NXB0Ij48aT48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0dlb3JnaWEmcXVvdDssc2VyaWY7Y29sb3I6YmxhY2siPk5ldHdvcmsgU29sdXRp b25zIEFyY2hpdGVjdCZuYnNwOzwvc3Bhbj48L2k+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJj b2xvcjojMjIyMjIyIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBj bTttYXJnaW4tYm90dG9tOi4wMDAxcHQ7bXNvLWxpbmUtaGVpZ2h0LWFsdDo5Ljc1cHQiPjxpPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtHZW9yZ2lhJnF1b3Q7LHNlcmlmO2NvbG9yOmJsYWNrIj5FbWFpbA0KPGEgaHJlZj0ibWFpbHRv Omd5YW4ucy5taXNocmFAdmVyaXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj5neWFuLnMubWlzaHJh QHZlcml6b24uY29tPC9hPjwvc3Bhbj48L2k+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xv cjojMjIyMjIyIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1s ZWZ0OjBjbTttc28tbGluZS1oZWlnaHQtYWx0OjkuNzVwdCI+DQo8aT48c3BhbiBsYW5nPSJFTi1V UyIgc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0dlb3JnaWEmcXVvdDssc2VyaWY7Y29sb3I6Ymxh Y2siPk0gMzAxIDUwMi0xMzQ3PC9zcGFuPjwvaT48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNv bG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_a07986fb2d7147c0abb36229237d8982huaweicom_-- From nobody Mon Mar 21 08:52:36 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9D873A0D52; Mon, 21 Mar 2022 08:52:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.112 X-Spam-Level: X-Spam-Status: No, score=-7.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yT8xU2r6Caeo; Mon, 21 Mar 2022 08:52:20 -0700 (PDT) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on20730.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::730]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 777CD3A0D39; Mon, 21 Mar 2022 08:52:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GT8hQRZ/3TH5r14MVvXrIhxbcw3rmCq8CpFNnM4mrQWwOaRRklFdxb/TuEptDQdhnZgkLQfqrpMb361KMe2bhjOXd2Vgt07e7COGnHmz69aBCQpR32LTXxZOgzwEqxLxpi5wIMfcSh/NsfnHbnOUKxKyO8DDV1eDlq4IMPzEbI/+9z289uo3rHw3an9zxVslmm67bw4TASE8J3E0tFo+oezCYOVCJPjktT+HYeO1UzyY+F2UG35l1zEEFFGOkYFJBk3Ow+/J/IO+WjsOhVnEZ3YKGbHNQLxKSQ6cfhe8ukYzNKsL/fSiT1Hu1EyecjYGWIlTDyHq70o55/vdzjO3AQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=tdxtvzJx3IPk8le4FM0vBMERRujkYhZzzFhbSv/LoCI=; b=VuMm8vGvVcbDksex+6kekAMyL0tIajXDKfK1fWxzR4t8fHSdznRLwFpfwV3JW3slcG69fyukV1AH+JqDMmf/IQNmLXEhK5/OVqYp6kYZE5XXynLS8Myzzwl/1hyWa0I6ecLDmxwk+5nti0DciJmiCMv8pv+p2g0jH1+dVExMtrXtMmqIJwqLoLyQ5tHYnLvZKg0jDCSQklUX0+PN2offt423rIqCTPCMUqrQ5h9BhVuBF4JcPtVvi/Z/esLLpK7KsBuEtezZoaVa9x+H4KL5e0gRZtfXHwtw4H9D/TPbAWSLcO/M/PWZUgbckHUa3Qq7sEa/luAB2otwaU6aGa/cLA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tdxtvzJx3IPk8le4FM0vBMERRujkYhZzzFhbSv/LoCI=; b=Za+Gygmle2B22NSQyw+07ZCOj0zEBaqrdZ3LYKsh+Xq+UnHj68uyRDusAGmQdpMezk9dsZllS7Kqgx8kgmfaVsmaciOOomEHNYpe5/f/PYV+MJxu1l/0HUPF8k9W7idRM3GM9V04JYLycDwpvSQtRKNcRSNrsJzJ2YjRw1BdRJg= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by BLAPR09MB6097.namprd09.prod.outlook.com (2603:10b6:208:289::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.18; Mon, 21 Mar 2022 15:52:17 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5081.023; Mon, 21 Mar 2022 15:52:16 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Gyan Mishra CC: Nick Hilliard , "grow@ietf.org" , "sidrops@ietf.org" , "Jakob Heitz (jheitz)" Thread-Topic: [GROW] ASPA and Route Server (was RE: [Sidrops] IXP Route Server question) Thread-Index: AQHYPGsQzjpOcZn830G15B6fX+k4FqzIc8MAgAGG7aA= Date: Mon, 21 Mar 2022 15:52:16 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e7b9d7a6-6aa1-4d39-0a5c-08da0b52c662 x-ms-traffictypediagnostic: BLAPR09MB6097:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: H2N+RapOWFGT50wcipWUodKjKf+tX62QnOulK28tIkiIMMVl24vuiQyYnm70AmXQWv6qnqcpTYAoTzOHOySjRoJ/odXti4OeD9Io9+YQJQEo33AJEqvBKjdP1+y8+dNrXDj/aiM0HQdi6Ccj5OHLl43x0a0wW+MI8iZ875JPTnsJZAg9GK/Ng36mqkLH/wPYonWZAyMC8LiTucco6YO7w9OCKvJIV0VlNjFr5YWm3KNkw0zBFxYWS/oYhn1w/yVt5wWVzVskLmUKyn4zWfx/kC6+xCEZTjTNOptBAeCUs4YmLmckwmxMB7k9Yi6deQJYsPS/zfxBpKtMRq+C9aQNN4cXTVkfCJVM0mdyE346TbkNjoi1CJLSv+Md3zceTFBiUpMQGQCaL5Ri61HO1YAmF6stesi0a96I7VoCacRxNFM5UNGvtK17n0JbO7x2nf6jJJASx8yei8dnaGQSqByZ49siPOgeOtd0QU9GAMGNDkOJA9A6VU4S1Mj7BtzTjEGrCyXabimEyNi2n9pqNQp/B2OQ6R0lOQRRGsluKs1f7yzLNwk2IYtielvIuKzuKEV/vZcgDfPjDwD92jKff7SHpMRsBuE044ZHk/z2Yt8zK00YgxhtRCurAWzgbsbKghplV88xevPQhoqEnPhgYZnkcApTbvh1qjihFa/7asi83kpM0kK79GFbQlIczPCQCcNjqVjJoVfe32BOC5FVfHZLvg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(2906002)(52536014)(8936002)(55016003)(26005)(38070700005)(186003)(316002)(54906003)(6916009)(6506007)(7696005)(33656002)(9686003)(122000001)(76116006)(66946007)(508600001)(86362001)(71200400001)(5660300002)(82960400001)(4744005)(4326008)(8676002)(38100700002)(64756008)(66446008)(66476007)(66556008)(83380400001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?JGMehZysLd1JQmGYpKv6ZjFtZdnJJPtnR1iPjOgu6wNaEunnX6X3wyK0Gp?= =?iso-8859-1?Q?/5Lnyp9dRxI2DFI7Sl/pDQRidjy6vGjo+uGMag3vyor9BQIrOGGHppwkh/?= =?iso-8859-1?Q?LjqdBx/5aVcnnXtajzfjXxrx4B0AjEEAggQdIB5kwXgc2aRsUtSZP4GZNE?= =?iso-8859-1?Q?8wzAz2gTmDFqLWu4Q3Cc0Nyx05YXriAK+qOyrUOKZCCtp+m1lWXSKwBZkP?= =?iso-8859-1?Q?B8Oj1ybkpEho7f8kJkmtaNzgZQzqRBGkrNdMuTdvqNzvuOThrm1YeQPRhz?= =?iso-8859-1?Q?300HVfdiUDSAMxePrDmUiX2JqdjPKYsidcYW6VcT/pdeUlzAK/CaHmvZAe?= =?iso-8859-1?Q?91NpmHC9JzTWP9c5rC78rdJdXrSFeKnh3tjtCdksj0kaOr9wwdMOV/ZWjN?= =?iso-8859-1?Q?31y5wbVDokXfAn3V824xLcXkrETUftREJJWzd0uLzOF6qw1AutnxhDj2Ex?= =?iso-8859-1?Q?oDOQJfObxrDa4hRK7DVe3chCA01ky/Q+3CgViN/Ydl0cddJezNTLXQZvqV?= =?iso-8859-1?Q?YSHIWqu+Mafwu/01i/Bn3AHS+h9pN400e6clbmKXFZ2alBVOKPqDaUqO8F?= =?iso-8859-1?Q?R9IKRpnBhAUIwe9j8sdCuttBUyr1NFgJ9Mu+Du4j4vIp+XtRBX85uE1x7T?= =?iso-8859-1?Q?4m75LcbT43/8BjhH+nj2SZ+5UVTHo2W0b9bWZvEx8KGGDahPwnoSLlS5AZ?= =?iso-8859-1?Q?qHUdFGOoA2ua7zp6YFEKO5/pwKt4IVwM9vvZ9yTBEyXwg2YP4fCV1h+m4U?= =?iso-8859-1?Q?n+Fudgwvfr+zx+RHThsbA/JwUbk50Gsp9X5AZGPYx5hWi0aUdr5qx+M1qq?= =?iso-8859-1?Q?X6HGWOP5xT42pObannx7XFzC75MHBO5ajf6wU8iw5tqTlrmlgq3sa6jFkh?= =?iso-8859-1?Q?dh0v0X4v8J6KL1LW7C+JXq8PRKkU33SmBCa+h/jzMZRToY0uRwLcTkV958?= =?iso-8859-1?Q?PkLrhJ3sqdZjiIU0CBTqgzgRnk3z70OjnXwA6akPqiefOcN5+L0jZz0hlm?= =?iso-8859-1?Q?/jhfnSRcIp5R201Ej6btKiALlqbirfFiFy4GEiUc8dQunhXQVr4atCiCrd?= =?iso-8859-1?Q?oFGXMj7anRcoMPSJdWcgKdRrdxxjvu7yON9dZwIQbORdiXzy4plTYqnH2N?= =?iso-8859-1?Q?Igq4qP9e/VhwFG06BdBWHMWpXgMUuHbj2aKL69sOl4+6HaiTc+FtYwN/f/?= =?iso-8859-1?Q?HnDePCybdp9rxEQxRiPKS7Kl8MD0A8kqeX9u+YIUuEHX6WE75t48rJctPz?= =?iso-8859-1?Q?YO8AeaeMEV/eIkPhY1Y1qc9bn2vQjvEfGuqSAgtjxFx3VsiwJjR0Q8Gbw8?= =?iso-8859-1?Q?Zx2ItMBelnRomNbysZg20zX33nVPeDs4QXSzMLpEzM7Ikk9tWbdcnXuJcZ?= =?iso-8859-1?Q?X2hw3OG6LSZxHu1V2brLBD3v1xyJZboCDchEtEgI1pOe5mOyGCAzql097D?= =?iso-8859-1?Q?OqaiZKXLIAcYThkQcmeSryzfakqRIbUvQHMpesP1HUPw6ZfnaH8X7kFSoo?= =?iso-8859-1?Q?w=3D?= Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e7b9d7a6-6aa1-4d39-0a5c-08da0b52c662 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Mar 2022 15:52:16.8165 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR09MB6097 Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2022 15:52:26 -0000 Hi Gyan, >Gyan>I understand the issue with the ASPA path verification, however if th= e RS AS added to ASPA then that would influence the forwarding plane is the= issue.=A0 How do you insert RS AS for the ASPA path verification but not a= llow RS to be part of forwarding plane?=A0 I guess you could do a next-hop-= unchanged between the clients connected through the RS. Is this the confirmation (from RFC7947, Sec. 2.2.1) that you are looking fo= r? "... As the route server does not participate in the actual routing of traffic, the NEXT_HOP attribute MUST be passed unmodified to the route server clients,..." Sriram =20 From nobody Mon Mar 21 08:57:42 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BA563A0D6F; Mon, 21 Mar 2022 08:57:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.096 X-Spam-Level: X-Spam-Status: No, score=-7.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p_xWgyIekBAg; Mon, 21 Mar 2022 08:57:10 -0700 (PDT) Received: from mail-pg1-x52d.google.com (mail-pg1-x52d.google.com [IPv6:2607:f8b0:4864:20::52d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D27DC3A0FB0; Mon, 21 Mar 2022 08:57:09 -0700 (PDT) Received: by mail-pg1-x52d.google.com with SMTP id bc27so10604530pgb.4; Mon, 21 Mar 2022 08:57:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+M6vTP+YTbbKrQ6bJPDpDW88wMXCFR6lpt71kVVQHcU=; b=p/b58Vtz7d6vfLQbf7AJucVt9bh4l+jBpfg5rC++dqpd6B1v6cnRvL2m2HPqZcqeHv 0P9cxb7Px64eRAcfaKiBa1VLE5V52vl/+mcckPKDuyWQZaqqEtZw490shkI0Bju+0o7f 1X1ZsBYryB4/Z+8ABfFbUnzDjtaIoVW6svvslMT3/+uCzmVP+v1PuniL/Ge7K682EUT5 6IkUp5eWeKkdYXCcdTik0psTneEPh3IOhGtiTsutMNJkbjHnglv5/blb72Bp/OlKA7TD buoCcxzB4uxfbfj+Fo86Ki8cetjl2Ih1Jt4Kpporya5BjAVfJ1jWGlneOW9JEh2GNmEI 7ixA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+M6vTP+YTbbKrQ6bJPDpDW88wMXCFR6lpt71kVVQHcU=; b=fXjHtOdnq700bN5Uhom0dS1j8fWl99fD1vzhpyn+7RS8IIhhHbwt/ykiD+M3T5AuAO cJi2MiAeUO4J2RiJ1bvX0pQI9/JRnxbWhGxlRQ0/VUtP2jjUVSEcTRkpSYGk3Y6kxYoz Ztwe7HUsmt09/8sW7YYJuaS/EDQgN9z9akZXEajMXQXIp0JKl6Bdq0sy5wxwor6AidBX 8Md+lCUkFMbXUUoAnpfGtAkpa0a8xV11hTzVXn3GvSvrbrbkcuviL3Nv+lfeoVnTC7U9 l9yWh2m+OusDdVGV6K3ux5lgDjO/UDRCU6b5I2YCiAlcvykemQoya3O8G6Jw2R+7YbsQ E2Mw== X-Gm-Message-State: AOAM530h81Q1WDSzVf3P5/FLJ915TuJSVQ9ULJxiYmuh5eioxEqWrfvH HgvC2/y6YvIGRf+T6DAjohoOaj2q9+3I+NrDjbI= X-Google-Smtp-Source: ABdhPJwqU/k5BCk0Xhbt1RtDy1A8IT+CgxBH/HCPAX6bcFv/KBqDESzmGawhDhFYPmpoS7lkYJgnbQOXVuVQ/cCPKYA= X-Received: by 2002:a63:544:0:b0:382:1f3d:1ebe with SMTP id 65-20020a630544000000b003821f3d1ebemr14963518pgf.180.1647878228658; Mon, 21 Mar 2022 08:57:08 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Gyan Mishra Date: Mon, 21 Mar 2022 11:56:57 -0400 Message-ID: To: "Sriram, Kotikalapudi (Fed)" Cc: "Jakob Heitz (jheitz)" , Nick Hilliard , "grow@ietf.org" , "sidrops@ietf.org" Content-Type: multipart/alternative; boundary="00000000000073cd6505dabc8cc6" Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2022 15:57:15 -0000 --00000000000073cd6505dabc8cc6 Content-Type: text/plain; charset="UTF-8" Thanks Sriram Gyan On Mon, Mar 21, 2022 at 11:53 AM Sriram, Kotikalapudi (Fed) wrote: > Hi Gyan, > > >Gyan>I understand the issue with the ASPA path verification, however if > the RS AS added to ASPA then that would influence the forwarding plane is > the issue. How do you insert RS AS for the ASPA path verification but not > allow RS to be part of forwarding plane? I guess you could do a > next-hop-unchanged between the clients connected through the RS. > > Is this the confirmation (from RFC7947, Sec. 2.2.1) that you are looking > for? > > "... As the route server > does not participate in the actual routing of traffic, the NEXT_HOP > attribute MUST be passed unmodified to the route server clients,..." > > Sriram > > > _______________________________________________ > Sidrops mailing list > Sidrops@ietf.org > https://www.ietf.org/mailman/listinfo/sidrops > -- *Gyan Mishra* *Network Solutions A**rchitect * *Email gyan.s.mishra@verizon.com * *M 301 502-1347* --00000000000073cd6505dabc8cc6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Thanks Sriram

<= /div>
Gyan
On Mon, Mar 21, 2022 at 11:53 AM Sriram, = Kotikalapudi (Fed) <kotikalapudi.sriram=3D40nist.gov@dmarc.ietf.org> wrote:
Hi Gyan,

>Gyan>I understand the issue with the ASPA path verification, however= if the RS AS added to ASPA then that would influence the forwarding plane = is the issue.=C2=A0 How do you insert RS AS for the ASPA path verification = but not allow RS to be part of forwarding plane?=C2=A0 I guess you could do= a next-hop-unchanged between the clients connected through the RS.

Is this the confirmation (from RFC7947, Sec. 2.2.1) that you are looking fo= r?

"... As the route server
=C2=A0 =C2=A0does not participate in the actual routing of traffic, the NEX= T_HOP
=C2=A0 =C2=A0attribute MUST be passed unmodified to the route server client= s,..."

Sriram


_______________________________________________
Sidrops mailing list
Sidrops@ietf.org<= br> https://www.ietf.org/mailman/listinfo/sidrops
--
--00000000000073cd6505dabc8cc6-- From nobody Mon Mar 21 09:43:26 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 005993A1A8F; Mon, 21 Mar 2022 09:43:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h-ZFrG6S_fiB; Mon, 21 Mar 2022 09:43:15 -0700 (PDT) Received: from slice.pfrc.org (slice.pfrc.org [67.207.130.108]) by ietfa.amsl.com (Postfix) with ESMTP id 6C1FA3A1AA9; Mon, 21 Mar 2022 09:43:14 -0700 (PDT) Received: from smtpclient.apple (99-59-193-67.lightspeed.livnmi.sbcglobal.net [99.59.193.67]) by slice.pfrc.org (Postfix) with ESMTPSA id 1FFA21E342; Mon, 21 Mar 2022 12:43:13 -0400 (EDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_43C58376-4683-445A-94B7-855469CBBFA6" Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\)) From: Jeffrey Haas In-Reply-To: Date: Mon, 21 Mar 2022 12:43:12 -0400 Cc: "Jakob Heitz (jheitz)" , Gyan Mishra , "Sriram, Kotikalapudi (Fed)" , Ben Maddison , "sidrops@ietf.org" , "grow@ietf.org" Message-Id: References: To: Zhuangshunwan X-Mailer: Apple Mail (2.3654.120.0.1.13) Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2022 16:43:25 -0000 --Apple-Mail=_43C58376-4683-445A-94B7-855469CBBFA6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Two comments here: If the BGP Speaker is inserting itself into the AS_PATH, it's not really = a Route Server in the traditional sense. A normal BGP Speaker can happily pass along routes via eBGP peering with = the nexthop unchanged with all devices that it shares a common nexthop = subnet with. My recommendation is to not to try to consider these devices a Route = Server. For ASPA purposes, just add the BGP connections to the inputs. If providers are unhappy with having a IXP router's AS in the ASPA data = and thus lose the desired ASPA filtering properties, the IXP should = install a real route server. -- Jeff > On Mar 21, 2022, at 11:48 AM, Zhuangshunwan = wrote: >=20 > +1 > I think Jacob's suggestion is reasonable. > I once worked on a route leak analysis project. There is a first step = in that project, which is to clear the IXP=E2=80=99s AS number added to = the AS-PATH by the non-transparent RS. > The basic idea is that a path segment =E2=80=9CAS1 - ASx - RS=E2=80=99s = ASN - ASy - ASn=E2=80=9D (where ASx and ASy are RS-clients connected in = BGP via the RS) will be corrected to =E2=80=9CAS1 - ASx - ASy - ASn=E2=80=9D= . > With this process, we can exclude the influence of non-transparent RS = on the accuracy of route-leak analysis. > =20 > Kind Regards, > Shunwan > =20 > From: Jakob Heitz (jheitz) [mailto:jheitz@cisco.com]=20 > Sent: Monday, March 21, 2022 11:13 PM > To: Gyan Mishra ; Sriram, Kotikalapudi (Fed) = > Cc: Ben Maddison ; sidrops@ietf.org; = grow@ietf.org; Zhuangshunwan ; Nick Hilliard = > Subject: RE: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route = Server question) > =20 > Route servers are a distraction for ASPA. > ASPA is about BGP path validation. > As such it concerns itself with ASNs in the AS path. > It is about relationships between adjacent ASes in the AS path. > Since RSes are not in the AS path, they cannot be included in ASPA. > RSes are only visible and relevant to the direct neighbors of the RS. > The ASN of the RS does not appear in the AS path, therefore it is of = no concern to anyone that is trying to validate the AS path. > Could we please remove all references to route servers from the ASPA = draft and issue a new draft about treatment of route servers only? > =20 > Regards, > Jakob. > =20 > From: Sidrops > On Behalf Of Gyan Mishra > Sent: Sunday, March 20, 2022 9:20 AM > To: Sriram, Kotikalapudi (Fed) = > > Cc: Ben Maddison >; sidrops@ietf.org = ; grow@ietf.org ; = Zhuangshunwan >; Nick Hilliard > > Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route = Server question) > =20 > =20 > Hi Sriram > =20 > On Sun, Mar 20, 2022 at 10:59 AM Sriram, Kotikalapudi (Fed) = > wrote: > I think a correction is required. Instead of what was said before - >=20 > #1: An RS client of an RS (transparent or not) includes the RS AS in = their SPAS/ASPA. The RS client also includes in its SPAS/ASPA any AS = with whom it connects in the control plane via the RS. >=20 > only the following simpler statement is required in the draft: >=20 > #2: An RS client of an RS (transparent or not) includes the RS AS in = their SPAS/ASPA.=20 >=20 > The reason is as follows. Consider the following topology and Update = flow per arrows: >=20 > AS1 (RS Client) -----> AS2 (RS) -----> AS3 (RS Client) ---p2p = (lateral peer) ---> AS4 (validating AS) >=20 > AS4 is the receiving/validating AS. Regardless of whether the RS = inserts its ASN in the AS path or not, the Update is Invalid (route = leak) at AS4. Because once the Update transitioned to a downward path = after the RS, it cannot be subsequently sent to a provider or lateral = peer. But with #1, the Update will be evaluated as Valid (not route = leak) by the ASPA verification procedure in case the RS is transparent. = But with #2, the Update will be correctly detected as a route leak = (whether the RS is transparent or not).=20 >=20 > Explanation: With #1, the hop AS1-AS3 in the transparent case is = evaluated as Valid (C2P) (as part of an ascending up-ramp on the left) = by the procedure and that is not good. I.e., the detection of the apex = in the AS path at the RS (not visible in the path) and inversion = (non-upward flow) after the RS is obscured with #1 (in the transparent = case). However, with #2, the hop AS1-AS3 is evaluated as "attested not = Provider". That means that the detection of apex/inversion at the RS = (though not visible in the path) is effectively not missed out by the = procedure with #2.=20 >=20 > Thank you. >=20 > Sriram =20 >=20 > -----Original Message----- > From: GROW > On = Behalf Of Sriram, Kotikalapudi (Fed) > Sent: Tuesday, March 15, 2022 11:34 AM > To: Nick Hilliard > > Cc: Ben Maddison >; grow@ietf.org ; = sidrops@ietf.org > Subject: [GROW] ASPA and Route Server (was RE: [Sidrops] IXP Route = Server question) >=20 > Nick (and all), >=20 > I was also rereading/reviewing Section 5.3 and had similar thoughts = about the two options you outlined. As you noted, "the approach in = Section 5.3 gives a workable outcome". However...=20 >=20 > >... the RS should be treated as a provider by the rs client; the rs = client should include the RS ASN in its SPAS; the rs client should = evaluate ASPA as if the RS ASN were included in the path; the rs should = evaluate clients as customers >=20 > Yes, I agree that "the rs client should include the RS ASN in its = SPAS." Alexander and I have talked about this, and he mentioned that = this would be added to the draft.=20 >=20 > Yes, I also feel that it is a better option that the RS client adds = the ASN of the transparent RS to the AS path (for ASPA validation = purposes only) and applies the downstream ASPA algorithm. = Algorithmically this seems more appropriate. This is also better from a = diagnostics point of view (if the need ever arises) because in this = approach the relevant ASPA is used for validating the hop from the AS = just before the RS to the RS. =20 >=20 > That said, I think there is a bigger issue about transparent RS in the = middle of the AS path. Maybe this is what Ben's question was hinting at. = I think you are also raising this issue when you say: >=20 > >RSs do not partake in traffic forwarding, so they are not part of the = data path between two ASNs; they're only part of the signaling path = between the two ASNs. This is a useful hack from a practical point of = view, but it causes algorithmic breakage in places which assume = congruency between the data plane and the signaling plane. One of these = places is AS path verification. >=20 > > ....ASPA verification should proceed as if the two rs-client ASNs = were directly connected and each should treat the other as a provider > =20 > Gyan>I understand the issue with the ASPA path verification, = however if the RS AS added to ASPA then that would influence the = forwarding plane is the issue. How do you insert RS AS for the ASPA = path verification but not allow RS to be part of forwarding plane? I = guess you could do a next-hop-unchanged between the clients connected = through the RS. >=20 >=20 > Based on the above observations from you, I am proposing the = following: >=20 > An RS client of an RS (transparent or not) includes the RS AS in their = SPAS/ASPA. The RS client also includes in its SPAS/ASPA any AS with whom = it connects in the control plane via the RS. >=20 > The idea is that a path segment ASx-RS-ASy (where ASx and ASy are = RS-clients connected in BGP via the RS) will be always verifiable with = this proposal whether or not the RS is transparent. If the ASPAs are = created by ASx and ASy per the proposal above, then the ASx-RS-ASy = segment will be evaluated as Valid in either direction. I think this = proposal in conjunction with other ideas discussed above takes care of = both transparent and non-transparent RSs in the ASPA verification = algorithms. Does this seem reasonable? >=20 > Thank you. >=20 > Sriram >=20 > _______________________________________________ > GROW mailing list > GROW@ietf.org > https://www.ietf.org/mailman/listinfo/grow = > --=20 > > Gyan Mishra > Network Solutions Architect=20 > Email gyan.s.mishra@verizon.com > M 301 502-1347 >=20 > =20 > _______________________________________________ > GROW mailing list > GROW@ietf.org > https://www.ietf.org/mailman/listinfo/grow --Apple-Mail=_43C58376-4683-445A-94B7-855469CBBFA6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Two = comments here:

If = the BGP Speaker is inserting itself into the AS_PATH, it's not really a = Route Server in the traditional sense.

A normal BGP Speaker can happily pass = along routes via eBGP peering with the nexthop unchanged with all = devices that it shares a common nexthop subnet with.

My recommendation is to = not to try to consider these devices a Route Server.  For ASPA = purposes, just add the BGP connections to the inputs.

If providers are unhappy = with having a IXP router's AS in the ASPA data and thus lose the desired = ASPA filtering properties, the IXP should install a real route = server.

-- = Jeff


On Mar = 21, 2022, at 11:48 AM, Zhuangshunwan <zhuangshunwan=3D40huawei.com@dmarc.ietf.org> = wrote:

+1
I think Jacob's suggestion is reasonable.
I once worked on a route leak analysis project. There is a = first step in that project, which is to clear the IXP=E2=80=99s AS = number added to the AS-PATH by the non-transparent RS.
The basic idea is that a path segment =E2=80=9CAS1 - ASx - = RS=E2=80=99s ASN - ASy - ASn=E2=80=9D (where ASx and ASy are RS-clients = connected in BGP via the RS) will be corrected to =E2=80=9CAS1 - ASx - = ASy - ASn=E2=80=9D.
With this process, we can = exclude the influence of non-transparent RS on the accuracy of = route-leak analysis.
 
Kind Regards,
Shunwan
 
From: Jakob = Heitz (jheitz) [mailto:jheitz@cisco.com] 
Sent: Monday, March 21, 2022 = 11:13 PM
To: Gyan Mishra <hayabusagsm@gmail.com>; Sriram, Kotikalapudi (Fed) = <kotikalapudi.sriram=3D40nist.gov@dmarc.ietf.org>
Cc: Ben Maddison <benm@workonline.africa>; sidrops@ietf.org; grow@ietf.org; = Zhuangshunwan <zhuangshunwan@huawei.com>; Nick Hilliard <nick@foobar.org>
Subject: RE: [Sidrops] [GROW] ASPA = and Route Server (was RE: IXP Route Server question)
 
Route servers are a distraction for ASPA.
ASPA is about BGP path validation.
As such it concerns itself with ASNs in the AS path.
It is about relationships between adjacent ASes in the AS = path.
Since RSes are not in the AS path, they cannot be = included in ASPA.
RSes are only visible and relevant to the direct = neighbors of the RS.
The ASN of the RS does not = appear in the AS path, therefore it is of no concern to anyone that is = trying to validate the AS path.
Could we please remove all = references to route servers from the ASPA draft and issue a new draft = about treatment of route servers only?
 
Regards,
Jakob.
 
From: Sidrops = <sidrops-bounces@ietf.org> On Behalf = Of Gyan Mishra
Sent: Sunday, March 20, 2022 9:20 = AM
To: Sriram, Kotikalapudi (Fed) = <kotikalapudi.sriram=3D40nist.gov@dmarc.ietf.org>
Cc: Ben Maddison <benm@workonline.africa>; sidrops@ietf.org; grow@ietf.org; Zhuangshunwan <zhuangshunwan@huawei.com>; = Nick Hilliard <nick@foobar.org>Subject: Re: [Sidrops] [GROW] ASPA = and Route Server (was RE: IXP Route Server question)
 
 
Hi = Sriram
 
On Sun, Mar 20, 2022 at 10:59 AM Sriram, Kotikalapudi (Fed) = <kotikalapudi.sriram=3D40nist.gov@dmarc.ietf.org> wrote:
I think a correction is required. Instead of what was said = before -

#1: An RS client of an RS = (transparent or not) includes the RS AS in their SPAS/ASPA. The RS = client also includes in its SPAS/ASPA any AS with whom it connects in = the control plane via the RS.

only the = following simpler statement is required in the draft:

#2: An RS client of an RS (transparent or not) includes the = RS AS in their SPAS/ASPA. 

The reason is as follows. Consider the following topology and = Update flow per arrows:

AS1 (RS Client) = -----> AS2 (RS) ----->  AS3 (RS Client) ---p2p (lateral peer) = --->  AS4 (validating AS)

AS4 is = the receiving/validating AS. Regardless of whether the RS inserts its = ASN in the AS path or not, the Update is Invalid (route leak) at AS4. = Because once the Update transitioned to a downward path after the RS, it = cannot be subsequently sent to a provider or lateral peer. But with #1, = the Update will be evaluated as Valid (not route leak) by the ASPA = verification procedure in case the RS is transparent. But with #2, the = Update will be correctly detected as a route leak (whether the RS is = transparent or not). 
Explanation: With #1, the hop AS1-AS3 in the = transparent case is evaluated as Valid (C2P) (as part of an ascending = up-ramp on the left) by the procedure and that is not good. I.e., the = detection of the apex in the AS path at the RS (not visible in the path) = and inversion (non-upward flow) after the RS is obscured with #1 (in the = transparent case). However, with #2, the hop AS1-AS3 is evaluated as = "attested not Provider". That means that the detection of apex/inversion = at the RS (though not visible in the path) is effectively not missed out = by the procedure with #2. 

Thank you.

Sriram    =   

-----Original Message-----
From: = GROW <grow-bounces@ietf.org> On Behalf Of Sriram, = Kotikalapudi (Fed)
Sent: Tuesday, March 15, 2022 11:34 = AM
To: Nick Hilliard <nick@foobar.org>
Cc: Ben Maddison <benm@workonline.africa>; grow@ietf.org; sidrops@ietf.org
Subject: [GROW] ASPA and Route Server (was RE: [Sidrops] IXP = Route Server question)

Nick (and all),

I was also rereading/reviewing Section 5.3 and = had similar thoughts about the two options you outlined. As you noted, = "the approach in Section 5.3 gives a workable outcome".  = However... 

>... the RS should be treated as a provider = by the rs client; the rs client should include the RS ASN in its SPAS; = the rs client should evaluate ASPA as if the RS ASN were included in the = path; the rs should evaluate clients as customers

Yes, I agree that "the rs client should include the RS ASN in = its SPAS." Alexander and I have talked about this, and he mentioned that = this would be added to the draft. 

Yes, I also feel that it is a better option that the RS = client adds the ASN of the transparent RS to the AS path (for ASPA = validation purposes only) and applies the downstream ASPA algorithm. = Algorithmically this seems more appropriate. This is also better from a = diagnostics point of view (if the need ever arises) because in this = approach the relevant ASPA is used for validating the hop from the AS = just before the RS to the RS.  

That said, I think there is a bigger issue about transparent = RS in the middle of the AS path. Maybe this is what Ben's question was = hinting at. I think you are also raising this issue when you say:

>RSs do not partake in traffic forwarding, = so they are not part of the data path between two ASNs; they're only = part of the signaling path between the two ASNs.  This is a useful = hack from a practical point of view, but it causes algorithmic breakage = in places which assume congruency between the data plane and the = signaling plane.  One of these places is AS path verification.

> ....ASPA verification should proceed as = if the two rs-client ASNs were directly connected and each should treat = the other as a provider
 
  =   Gyan>I understand the issue with the ASPA path verification, = however if the RS AS added to ASPA then that would influence the = forwarding plane is the issue.  How do you insert RS AS for the = ASPA path verification but not allow RS to be part of forwarding = plane?  I guess you could do a next-hop-unchanged between the = clients connected through the RS.


Based on the above observations = from you, I am proposing the following:

An = RS client of an RS (transparent or not) includes the RS AS in their = SPAS/ASPA. The RS client also includes in its SPAS/ASPA any AS with whom = it connects in the control plane via the RS.

The idea is that a path segment ASx-RS-ASy (where ASx and ASy = are RS-clients connected in BGP via the RS) will be always verifiable = with this proposal whether or not the RS is transparent. If the ASPAs = are created by ASx and ASy per the proposal above, then the ASx-RS-ASy = segment will be evaluated as Valid in either direction. I  think = this proposal in conjunction with other ideas discussed above takes care = of both transparent and non-transparent RSs in the ASPA verification = algorithms. Does this seem reasonable?

Thank = you.

Sriram

_______________________________________________
GROW mailing list
GROW@ietf.org
https://www.ietf.org/mailman/listinfo/grow
-- 

Gyan Mishra
Network Solutions Architect 
Email gyan.s.mishra@verizon.com

M 301 = 502-1347

 
_______________________________________________
GROW mailing list
GROW@ietf.org
https://www.ietf.org/mailman/listinfo/grow

= --Apple-Mail=_43C58376-4683-445A-94B7-855469CBBFA6-- From nobody Mon Mar 21 10:14:35 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9AEE3A1A63; Mon, 21 Mar 2022 10:14:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.594 X-Spam-Level: X-Spam-Status: No, score=-9.594 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=evJpO5y6; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=0nZFpCx+ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gZlOvSGHgP7F; Mon, 21 Mar 2022 10:14:16 -0700 (PDT) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 841633A0FFA; Mon, 21 Mar 2022 10:14:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=43906; q=dns/txt; s=iport; t=1647882856; x=1649092456; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=u31GO7861tjfdHmyjLoh/yiM6k4qR2jBldYQc2fmzfc=; b=evJpO5y64qvt0RFsCHoHLxW0TuN997z3FNNHZ7DeFzZVdvNY8/JKORXX EqGa1wzf/uD4ga6tcVQYezAsLOCSQEe+ju1RBvMCAXQ7D67iZ92l8oTI3 sh3K2+tLW6UJQZ8jZK9saxtVHPyv4dTQ2yNzmzy7GU7S/4iyf0+SdOlVv U=; X-IPAS-Result: =?us-ascii?q?A0BKAQAHsjhimIkNJK1XAx4BAQsSDIIPC4EhMVZ+WjdEh?= =?us-ascii?q?FSDSgOFOYUQgwIDgROJfpAkgS4UgREDTwULAQEBDQEBKgEKDAQBAYUHAheEJ?= =?us-ascii?q?QIlNgcOAQIEAQEBAQMCAwEBAQEBAQMBAQUBAQECAQcEFAEBAQEBAQEBCRQHB?= =?us-ascii?q?gwFDhAnhWgNhkIBAQEBAwEBEBEEBhMBASwEBwELBAIBCAcHAwQBASEBBgMCA?= =?us-ascii?q?gIfBgsUCQgCBAENBQgTB4JiAYIOVwMuAQ6gfwGBOgKBDokRen8ygQGCCAEBB?= =?us-ascii?q?gQEgTcBg1MNC4I3CYElF4MRgwCBJAEBgR+FcyccgUlEgRVDeYE3Nz6CIUIBA?= =?us-ascii?q?QKBKQESAQkaFQoMCQgJglMXIIIulzJbRxMFDyIhDwEFEgkPLBgSEwgrAQERC?= =?us-ascii?q?xQHSgMWAZUnR4lijX6SAmsKg0mLD4gxhjiGGRWDdIwwmBqUdYFmIIIpikyDU?= =?us-ascii?q?pVyAgQCBAUCDgEBBoFoAYEdcHAVO4JpCUgZD44gDA0Jg1CFFIVKdQIBNQIGA?= =?us-ascii?q?QoBAQMJjywtghkBAQ?= IronPort-PHdr: A9a23:scLNqhXCeX7S7oBmfAYecdPGjAXV8K36AWYlg6HPw5pCcaWmqpLlO kGXpfBgl0TAUoiT7fVYw/HXvKbtVS1lg96BvXkOfYYKW0oDjsMbzAAlCdSOXEv8KvOiZicmH cNEAVli+XzzMUVcFMvkIVPIpXjn5j8JERK5Pg1wdYzI IronPort-Data: A9a23:JoRj2ajYC6wsClHffh4iHaAEX161zhAKZh0ujC45NGQN5FlHY01je htvWmqPO/eJZDD9Lo8gPYSx9hkPucfVndAwHVBl+yswRiljpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+lH1dOKJQUBUjclkfJKkYAL/En03FFcMpBsJ00o5wbZi2Ncw27BVPivU0 T/Mi5yHULOa82Yc3lI8s8pvfzs24ZweEBtB1rAPTagjUG32zhH5P7pDTU2FFEYUd6EPdgKMq 0kv+5nilo/R109F5tpICd8XeGVSKlLZFVDmZna7x8FOjzAazhHe3JrXO9IfVG1Zlm6Fm+p49 /BO6p/zUTY0ZZLTzbF1vxlwS0mSPIVP/LvBZHO4q8HWkwvNcmDnxLNlC0Re0Y8wo7ksRzoQs 6VDbmlWMXhvhMruqF6/Yutsi8U/PuHgPZgUvTdryjSx4fMOEc+eGv6WuIcHtNs2rp9eA+/jT PI+Uz4sdx6DZjROFAgQJo1ryY9EgVGmI2EH9zp5v5Ef7HLU0yRw3aTjdt3PdbSiXsRZhEGAv UrH8nj3RBYAO7S3wzeD91qzgfXMmiX/WYQfUrS27P9hiTW7xWsPCR4fUVKjvPW4zFWkWshWL hlIoiwvtrR0+0u1ZtX4Vgez5n+JohBaXMBfe8U64RCEwLfP6gmCA0ALSzdAbJots8pebS4qy 1aPkMjpGDpwubvAFSqd676LoDL0Mi8QBWMHbDUPCwoI/9elp5s85jrNTt9qC4atgMf+Xzbqz Fi3QDMWjrEXi4sA0L+2uAyBiDO3rZ+PRQkwjunKYo67xgBEToC4PICs01HkyPUfL8WBf0Tag 2dRzqBy89syJZ2KkSWMRsAEE7eo++uJPVXgbbhHQsBJG9OFpiLLQGxA3N1tDBwya59bJ1cFd GeW6F0Pu84KVJe/RfYvO+qM59IWIb8M/DgPftnQatdICnSaXFDapHg1DaJ8MpyEraTBuag7P ZHeesG2ADNGT69m1zGxAewa1NfHJxzSJ0uOFfgXLDz+jNJygUJ5r59fYTNiichitsu5TP39q Yo3Cidz40w3vBfCSifW65UPClsBMGI2A5v7w+QOKLLcclI3Qz94WqCLqV/ER2CDt/kJ/gsv1 iziMnK0NHKj7ZE6AVzQMys6OO+HsWhX9C9iZ0TAwmpEK1B6Mdrws8/zhrM8fKIs86R43OVoQ vweE/hs8dwRIgkrDw81NMGnxKQ7LUzDrVvXY0KNPWhuF7Y9Fleh0oK1IWPHqnJUZgLp7pRWn lFV/l6BKXb1b148XJ++hTPG5w7ZgEXxb8opBhqWeIYPIBuwmGWoQgSo5sIKzwg3AU2r7lOnO 8y+WH/0ecGlT1cJzeT0 IronPort-HdrOrdr: A9a23:3BFNiquPbpMU6tM9oUNkAIvT7skCwoMji2hC6mlwRA09TyXGra 6TdaUguiMc1gx8ZJh5o6H9BEGBKUmskaKdkrNhQotKPTOW9FdASbsC0WKM+UyZJ8STzJ8+6U 4kSdkCNDSSNyk0sS+Z2njCLz9I+rDum8rE5Za8854ud3ARV0gK1XYfNu/vKDwOeOAwP+teKH Pz3LsjmxOQPVAsKuirDHgMWObO4/fRkoj9XBIADxk7rCGTkDKB8tfBYlal9yZbdwkK7aYp8G DDnQC8zL6kqeuHxhjV0HKWx4hKmeHm1sBICKW3+4kow3TX+0aVjbZaKv+/VQMO0aSSAZER4Z 3xSiIbTodOArXqDyaISFXWqk/dOX0VmgHfIBej8AreSIrCNWsH4w4rv/MDTvMfgHBQ5O2UmZ g7r16xpt5ZCwjNkz/64MWNXxZ2llCsqX5niuILiWdDOLFuI4O5gLZvtX+9Kq1wVB4SKbpXZN VGHYXZ/rJbYFmaZ3fWsi1mx8GtRG06GlODTlIZssKY3jBKlDQhpnFoifA3jzMF7tYwWpNE7+ PLPuBhk6xPVNYfaeZ4CP0aScW6B2TRSVbHMX6UI17gCKYbUki94aLf8fEw/qWnaZYIxJw9lN DIV05Zr3c7fwb0BciHzPRwg2bwqaWGLEPQI+1llupEU+fHNcnW2AW4OSUTr/c= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.90,199,1643673600"; d="scan'208,217";a="875134507" Received: from alln-core-4.cisco.com ([173.36.13.137]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 21 Mar 2022 17:14:15 +0000 Received: from mail.cisco.com (xfe-rtp-004.cisco.com [64.101.210.234]) by alln-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id 22LHEEJY031702 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Mon, 21 Mar 2022 17:14:15 GMT Received: from xfe-aln-002.cisco.com (173.37.135.122) by xfe-rtp-004.cisco.com (64.101.210.234) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14; Mon, 21 Mar 2022 13:14:13 -0400 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (173.37.151.57) by xfe-aln-002.cisco.com (173.37.135.122) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14 via Frontend Transport; Mon, 21 Mar 2022 12:14:13 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HXsCS6T5+Ug8XmeIt4lfZ+LYscioUDZsWPXpJzKy+aLsmC0+cafBrtGXy+CQQAnENwchKLybu7kXnjTNRGjbc9C4ditQe+PkA0UUeWoGXJIc9P4W8Mwp4lWHes/154CFs3gFjM6Xyo7zeIGKq5Ghp0cJrVBloDJtePmMPTSI4u49sswJIMIkvdWrr1LK9dDvQk5qvv8TrViyqEtlPbJ1DMjPg2eK0H4ftB+QZigfqmtyRMqX5gx5ZnpBLFNub2m6rk5BY9ryUNm37P45Rgr6R6yxGyyFDROPZ5iYxAtbB2lnx5JVP6nCZ1FZ40dCw0F6pFkaxP3ZoKU1adP9iP3kfg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=u31GO7861tjfdHmyjLoh/yiM6k4qR2jBldYQc2fmzfc=; b=dhZMjyNmZOoZn91fJ5XokGjpv+gTXXLLXKRqwNMXwc2Qj4454lal95KcC3HksmL4elsS2OYYK+RS7mJibdk47oAkjRSAhyMzhHCd0dTzV7dGZyofLLE+qEc+cqYkWheghLMA4z02FmVltWBlYUZFLJKH5BdrE2TMEmU9dMjCuAEh+k33RwQFM1vBVHgKAz3MzFxQzmQYByHRYtSw47WVTs07jPqfVfrr9NT3KKmGBSEc/O39QD3ck2YvnJjOMnLLGpH9AjWRCOh1ZY9KQK/XrZN4odguEiPv1y07fLUBCUZ8n1fNGYmp2JU89Sfuedlgf8+d93cETtJW6R6SIAx9ng== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=u31GO7861tjfdHmyjLoh/yiM6k4qR2jBldYQc2fmzfc=; b=0nZFpCx+4EQcyXisVt3gzDtSC5CffEmFdGx5hBq6W6zUS8RhIhB6OJLdWQgxmF+x11LA9m6+ewh7cI5mc4vGZKO9utgMpEatCQaqoQxrJiN/ng0ktpYgrf2eKVirrs7bUftP8/cFqHdWSjmDttU7FzxdGFZ7WmWzoSIvIyDJQAI= Received: from BYAPR11MB3207.namprd11.prod.outlook.com (2603:10b6:a03:7c::14) by DM6PR11MB3324.namprd11.prod.outlook.com (2603:10b6:5:59::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.18; Mon, 21 Mar 2022 17:14:10 +0000 Received: from BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167]) by BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167%7]) with mapi id 15.20.5081.022; Mon, 21 Mar 2022 17:14:10 +0000 From: "Jakob Heitz (jheitz)" To: Jeffrey Haas , Zhuangshunwan CC: Gyan Mishra , "Sriram, Kotikalapudi (Fed)" , Ben Maddison , "sidrops@ietf.org" , "grow@ietf.org" Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULHMv5fXHQ9ykCZDKiXb5OfaqzKEtuQ Date: Mon, 21 Mar 2022 17:14:09 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cisco.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: cfe46ba3-453e-4f94-9e7c-08da0b5e3729 x-ms-traffictypediagnostic: DM6PR11MB3324:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: xnOaP9bwWGIqvs49hZDcM8sSRFNTIf2++n0nRcW2BMmS7vJ5fO6LIPv2j/PEMtRqE9SFmhlE7UPnvSq4c2EJsHA2ADzJMaonfZPWGsB458PRidiP6XglJpO5SOCOeIQ4gHdT2IHAjNpuqfUW3zi98slv3n35iLRtKjM9vrV5Zc072xNFhjVsam01djzpEZKgRBFYuIaD7TfyA/tBqPLUTHFzBLM6CviOG/sIideGJAgCetrHF4htBf/0Sx4Q4tSTgVz5mo1KAstQpnbR0yE5x92UtT5vTOIbQdTK2lpIdQo2HWCeOVnP8JUeJLPk5oN474hsMlylxLYK7INeiqRPGL3Bn2+cXlTjuJTSSBeHC1i5zYtHc4p9GtiYzb55DbxehdQdeL+zam4sc3KlHMITYEfYTbIIwspy5VIYK6qxNYvuIoAacU3HR847XTtXroaUksYftV0UXmmWdcthOmUe2aCn9WMDJraXROmm0i73jD1z37TKvg2JBzQPaSyFTP/axh7qSKUYTqPbNH7s0GpIPUV9TklKHQ5SQqtPVEPhIicF36D6ePCaIxL03tt6rCpmvMZTth4jThAPYWfGdw7AZoQgA7to8/5UnXZRtlPiOIV4z4Xu+hpNfc3fWmBVEuZ2mF1KNHG/Wz3CdwAB0IASWOUzSDpw0FjqW+HYuuF7h9cjobvhrELi+Q5EYZkwjWbbYvhoIMFyy0LQe2x6UibAXlvy4T9bBq+ArNaChukVonDGBT0Z1WltyRQDOWXvUyCBedP/vSdODd3He0WiL87W46Z9109S72K4a+V8KjbOhWbPKIRL4ywjO3/fkMTkpAAlaul+t3fHeKRCLPWBbItlZA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3207.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(366004)(2906002)(316002)(53546011)(9686003)(71200400001)(55016003)(166002)(110136005)(86362001)(54906003)(38100700002)(186003)(40140700001)(7696005)(33656002)(5660300002)(6506007)(66556008)(66946007)(4326008)(8676002)(508600001)(66446008)(64756008)(66476007)(8936002)(38070700005)(83380400001)(122000001)(66574015)(76116006)(52536014)(966005); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?Y2taQmQ4M1hkM2pYbmZWcW16UjZEekMxL2JVMCtZRGxiaWhGaS84bWppallO?= =?utf-8?B?bXcvblpVZzh4UzQrY2crcEk0WXlMaXo2Mkp1ZWJkZnM2Uko1UU0wUkQ3d0Q1?= =?utf-8?B?M0FKV0hBWGVNMWJxcWhsTjZkYktKVkNMOVQ3V0Noa2JhOEtQWG1OMys4cFRo?= =?utf-8?B?S2psb2pZNk0yYmYrdjN6aGgrM2pBaWo3enF2cGtOdUxDQkZxMzlBN09PQ3hC?= =?utf-8?B?RmZ3RU5oYUUzMGpCRWlDL2tyVnFjYXJZbUxrTWh0alJxUDE2bER5YlJaSHJQ?= =?utf-8?B?Tkp5dTlQak1tcEk3NTZlaDlXbUNqSjFINmpRcXNmWVVwTlZlWjBWMmN4bDJE?= =?utf-8?B?bDdUUEZOaHdEWDJMTk5YRUo1YWhoTzMrcHh5alVhVllmb1BNU1pmZlQ4UEdj?= =?utf-8?B?UWZoYTNSV0QzTy8vd3NlREJzV1Z1L3VuN21pOVVicm15QitGUjBIWFpFdGdK?= =?utf-8?B?WUl0MHZHWDkrZ2J1Rys3WGlNeEpBbmlqTllqMjA1Z0JmM2lub09RcWNQSEVi?= =?utf-8?B?MkI2S0RsWDdwSk9zemdOUTBKTG9JUUs1aUZTZ0kram5JTlp4V2lmcHVhWjNw?= =?utf-8?B?alN0NXVrejYweXZBQlFDVlZ3QXBCSi93ZDJCd3RBTUR0WDNyRStHUlgwamhZ?= =?utf-8?B?d0pobE1URkIxUlJqQktRRFB2NGZKK1F1NTJ2VjNNb2FHRFk2V011M1VWRzV0?= =?utf-8?B?REcwL1R4dklKUTAySGltemdwenNGT3ZGdXZPVHk4UCtFaG8ybVp4WDBmU2k2?= =?utf-8?B?Q2dYZm5rZC8yaWlBY3hESXNBK1VJZS9xZFBpQkZIb2F0LzhxNlRMMEFKWEpD?= =?utf-8?B?SUdWUU1SOW8wTEQzbC9UdEs0dlBydXNaTGdNOHlGNE1sNnU1R29PZk5YUnU4?= =?utf-8?B?MnZOMGZ6OFN0Si9NU0xITGlUZEUzdUhaNFk2RWF0bUhsckdObE9PSDFHZlph?= =?utf-8?B?a1JKcFJLQnFBSFA0N293ZnplcTNoS0I1d3hOTWNDRlYrR1BSNHN3YU81eXVB?= =?utf-8?B?NEpVQWRuZzhteHZsdUNvSlVFdXUzVmdPaVBqeWNVT01HYUpzRVAxK1NNcllU?= =?utf-8?B?WmYwc2lNZU9qOFBtclY4VHZxS3kxVHlKdEpYcDZtWSs2SUlCRWJIOTBZQzE4?= =?utf-8?B?ZFk0RnlMUHJHKzkyTGNZcEFVcFZwWjRvSTArSG04cktHUmZPSjViajBLZ1FL?= =?utf-8?B?Y0Zaczg2cFU4Vi9yN2QxOXRUcUNuSGlLYkh5QUhJa2lGdXd2M01sT1ZzcHZZ?= =?utf-8?B?bEFIa2VsQnR0K1dDUVM0WkFoK0xzWkt2NVpaWmZZSjlWdzVnTFVDblZuV09p?= =?utf-8?B?NTc2WjVSYTdRdDVTclNEMDlxYW1vYy85WlJlMHpMS0xzdjFXZk81ajF3NmQ2?= =?utf-8?B?d1g0Y1NpRHRJL0wwLzJOdzFjM2w4eXplM2ZxVGQ3YUxkUjBuSzJ5N3BoaDJp?= =?utf-8?B?ME5yRmhicGx5VnhtOC9ZR2pVVmZmQWxJc01ISWswYlh2U1FTUkRXdVNhL2w0?= =?utf-8?B?dW9GNmthcTNobE50ZTRHakZwdDVvdEdVMVhSaXJiK1V3RVppUTRINHRqSHBI?= =?utf-8?B?TDBnWm9NbTdkRks5bDk4NlVCTU5XcGVaVGVFU3NHdDIwMGVZSWJPY2ZVSXdt?= =?utf-8?B?Qm9CT1J2QkYyQnRKcVpaall0Tm9Yc1pPMWk2Y2FpQWNta0p2cXF1Z1NHYjRu?= =?utf-8?B?alBBdnhzbDRjaktrbmVJR2x1Z3dEWVQ1VEFVVmx2YUgvbGlSS2dqV3ljSTFZ?= =?utf-8?B?bUJxQ3pSYlBCZ1M5WngzM2xNdGFPekhyZDVQY1F5d2xYOFlKL3F4djRSQ3pJ?= =?utf-8?B?Rko3bm5SNkIxMGhOWHJGVGIyWVY2MXJMcmxVb2pWTDJBSUE5SnlxSk9TMVhU?= =?utf-8?B?VW1EMUNIVjJrcEpGUkp0ZFVGbitUMndobi9aVFZDdnZ1UFJMRmZJVmhtbmJr?= =?utf-8?B?RlZyaGtOUWdWakdOYXMvSmUwQjd1UE1QWWRxYktTQkZrUjZLNzdHNWlIak1M?= =?utf-8?B?bkVVWDlKa3B3TXBzYVV2WkVwcjBPaklxSTJnN0JmTnBtZUtmc2RRYlNhTTVD?= =?utf-8?Q?buQ9oJ?= Content-Type: multipart/alternative; boundary="_000_BYAPR11MB32077BA1382FC96F88A26248C0169BYAPR11MB3207namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR11MB3207.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: cfe46ba3-453e-4f94-9e7c-08da0b5e3729 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Mar 2022 17:14:10.4777 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 29PFPrSwK2TC/AkFDDoYOsDKXxFAkAqX/RQw4+hDa5nCn2uIJlBfkKqLD8qbC9ImXIklGwsiOLXzEnWbrHR1Vw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3324 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 64.101.210.234, xfe-rtp-004.cisco.com X-Outbound-Node: alln-core-4.cisco.com Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2022 17:14:22 -0000 --_000_BYAPR11MB32077BA1382FC96F88A26248C0169BYAPR11MB3207namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VG8gYmUgY2xlYXIsIEknbSB0YWxraW5nIGFib3V0IEJHUCBkZXZpY2VzIHRoYXQgZG8gbm90IGlu c2VydCB0aGVpciBBU04gaW50byB0aGUgQVMgcGF0aC4NCkkgdW5kZXJzdGFuZCB0aGF0IHJvdXRl IGxlYWtzIGNhbiBoYXBwZW4gYWZ0ZXIgYSByb3V0ZSBzZXJ2ZXIuDQpNeSBwb2ludCBpcyB0aGF0 IHN1Y2ggYSByb3V0ZSBsZWFrIGlzIG9mIG5vIGNvbmNlcm4gdG8gQVNQQS4NCg0KUmVnYXJkcywN Ckpha29iLg0KDQpGcm9tOiBKZWZmcmV5IEhhYXMgPGpoYWFzQHBmcmMub3JnPg0KU2VudDogTW9u ZGF5LCBNYXJjaCAyMSwgMjAyMiA5OjQzIEFNDQpUbzogWmh1YW5nc2h1bndhbiA8emh1YW5nc2h1 bndhbj00MGh1YXdlaS5jb21AZG1hcmMuaWV0Zi5vcmc+DQpDYzogSmFrb2IgSGVpdHogKGpoZWl0 eikgPGpoZWl0ekBjaXNjby5jb20+OyBHeWFuIE1pc2hyYSA8aGF5YWJ1c2Fnc21AZ21haWwuY29t PjsgU3JpcmFtLCBLb3Rpa2FsYXB1ZGkgKEZlZCkgPGtvdGlrYWxhcHVkaS5zcmlyYW09NDBuaXN0 LmdvdkBkbWFyYy5pZXRmLm9yZz47IEJlbiBNYWRkaXNvbiA8YmVubUB3b3Jrb25saW5lLmFmcmlj YT47IHNpZHJvcHNAaWV0Zi5vcmc7IGdyb3dAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbR1JPV10g W1NpZHJvcHNdIEFTUEEgYW5kIFJvdXRlIFNlcnZlciAod2FzIFJFOiBJWFAgUm91dGUgU2VydmVy IHF1ZXN0aW9uKQ0KDQpUd28gY29tbWVudHMgaGVyZToNCg0KSWYgdGhlIEJHUCBTcGVha2VyIGlz IGluc2VydGluZyBpdHNlbGYgaW50byB0aGUgQVNfUEFUSCwgaXQncyBub3QgcmVhbGx5IGEgUm91 dGUgU2VydmVyIGluIHRoZSB0cmFkaXRpb25hbCBzZW5zZS4NCg0KQSBub3JtYWwgQkdQIFNwZWFr ZXIgY2FuIGhhcHBpbHkgcGFzcyBhbG9uZyByb3V0ZXMgdmlhIGVCR1AgcGVlcmluZyB3aXRoIHRo ZSBuZXh0aG9wIHVuY2hhbmdlZCB3aXRoIGFsbCBkZXZpY2VzIHRoYXQgaXQgc2hhcmVzIGEgY29t bW9uIG5leHRob3Agc3VibmV0IHdpdGguDQoNCk15IHJlY29tbWVuZGF0aW9uIGlzIHRvIG5vdCB0 byB0cnkgdG8gY29uc2lkZXIgdGhlc2UgZGV2aWNlcyBhIFJvdXRlIFNlcnZlci4gIEZvciBBU1BB IHB1cnBvc2VzLCBqdXN0IGFkZCB0aGUgQkdQIGNvbm5lY3Rpb25zIHRvIHRoZSBpbnB1dHMuDQoN CklmIHByb3ZpZGVycyBhcmUgdW5oYXBweSB3aXRoIGhhdmluZyBhIElYUCByb3V0ZXIncyBBUyBp biB0aGUgQVNQQSBkYXRhIGFuZCB0aHVzIGxvc2UgdGhlIGRlc2lyZWQgQVNQQSBmaWx0ZXJpbmcg cHJvcGVydGllcywgdGhlIElYUCBzaG91bGQgaW5zdGFsbCBhIHJlYWwgcm91dGUgc2VydmVyLg0K DQotLSBKZWZmDQoNCg0KDQpPbiBNYXIgMjEsIDIwMjIsIGF0IDExOjQ4IEFNLCBaaHVhbmdzaHVu d2FuIDx6aHVhbmdzaHVud2FuPTQwaHVhd2VpLmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86emh1 YW5nc2h1bndhbj00MGh1YXdlaS5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNCg0KKzENCkkg dGhpbmsgSmFjb2IncyBzdWdnZXN0aW9uIGlzIHJlYXNvbmFibGUuDQpJIG9uY2Ugd29ya2VkIG9u IGEgcm91dGUgbGVhayBhbmFseXNpcyBwcm9qZWN0LiBUaGVyZSBpcyBhIGZpcnN0IHN0ZXAgaW4g dGhhdCBwcm9qZWN0LCB3aGljaCBpcyB0byBjbGVhciB0aGUgSVhQ4oCZcyBBUyBudW1iZXIgYWRk ZWQgdG8gdGhlIEFTLVBBVEggYnkgdGhlIG5vbi10cmFuc3BhcmVudCBSUy4NClRoZSBiYXNpYyBp ZGVhIGlzIHRoYXQgYSBwYXRoIHNlZ21lbnQg4oCcQVMxIC0gQVN4IC0gUlPigJlzIEFTTiAtIEFT eSAtIEFTbuKAnSAod2hlcmUgQVN4IGFuZCBBU3kgYXJlIFJTLWNsaWVudHMgY29ubmVjdGVkIGlu IEJHUCB2aWEgdGhlIFJTKSB3aWxsIGJlIGNvcnJlY3RlZCB0byDigJxBUzEgLSBBU3ggLSBBU3kg LSBBU27igJ0uDQpXaXRoIHRoaXMgcHJvY2Vzcywgd2UgY2FuIGV4Y2x1ZGUgdGhlIGluZmx1ZW5j ZSBvZiBub24tdHJhbnNwYXJlbnQgUlMgb24gdGhlIGFjY3VyYWN5IG9mIHJvdXRlLWxlYWsgYW5h bHlzaXMuDQoNCktpbmQgUmVnYXJkcywNClNodW53YW4NCg0KRnJvbTogSmFrb2IgSGVpdHogKGpo ZWl0eikgW21haWx0bzpqaGVpdHpAY2lzY28uY29tXQ0KU2VudDogTW9uZGF5LCBNYXJjaCAyMSwg MjAyMiAxMToxMyBQTQ0KVG86IEd5YW4gTWlzaHJhIDxoYXlhYnVzYWdzbUBnbWFpbC5jb208bWFp bHRvOmhheWFidXNhZ3NtQGdtYWlsLmNvbT4+OyBTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSA8 a290aWthbGFwdWRpLnNyaXJhbT00MG5pc3QuZ292QGRtYXJjLmlldGYub3JnPG1haWx0bzprb3Rp a2FsYXB1ZGkuc3JpcmFtPTQwbmlzdC5nb3ZAZG1hcmMuaWV0Zi5vcmc+Pg0KQ2M6IEJlbiBNYWRk aXNvbiA8YmVubUB3b3Jrb25saW5lLmFmcmljYTxtYWlsdG86YmVubUB3b3Jrb25saW5lLmFmcmlj YT4+OyBzaWRyb3BzQGlldGYub3JnPG1haWx0bzpzaWRyb3BzQGlldGYub3JnPjsgZ3Jvd0BpZXRm Lm9yZzxtYWlsdG86Z3Jvd0BpZXRmLm9yZz47IFpodWFuZ3NodW53YW4gPHpodWFuZ3NodW53YW5A aHVhd2VpLmNvbTxtYWlsdG86emh1YW5nc2h1bndhbkBodWF3ZWkuY29tPj47IE5pY2sgSGlsbGlh cmQgPG5pY2tAZm9vYmFyLm9yZzxtYWlsdG86bmlja0Bmb29iYXIub3JnPj4NClN1YmplY3Q6IFJF OiBbU2lkcm9wc10gW0dST1ddIEFTUEEgYW5kIFJvdXRlIFNlcnZlciAod2FzIFJFOiBJWFAgUm91 dGUgU2VydmVyIHF1ZXN0aW9uKQ0KDQpSb3V0ZSBzZXJ2ZXJzIGFyZSBhIGRpc3RyYWN0aW9uIGZv ciBBU1BBLg0KQVNQQSBpcyBhYm91dCBCR1AgcGF0aCB2YWxpZGF0aW9uLg0KQXMgc3VjaCBpdCBj b25jZXJucyBpdHNlbGYgd2l0aCBBU05zIGluIHRoZSBBUyBwYXRoLg0KSXQgaXMgYWJvdXQgcmVs YXRpb25zaGlwcyBiZXR3ZWVuIGFkamFjZW50IEFTZXMgaW4gdGhlIEFTIHBhdGguDQpTaW5jZSBS U2VzIGFyZSBub3QgaW4gdGhlIEFTIHBhdGgsIHRoZXkgY2Fubm90IGJlIGluY2x1ZGVkIGluIEFT UEEuDQpSU2VzIGFyZSBvbmx5IHZpc2libGUgYW5kIHJlbGV2YW50IHRvIHRoZSBkaXJlY3QgbmVp Z2hib3JzIG9mIHRoZSBSUy4NClRoZSBBU04gb2YgdGhlIFJTIGRvZXMgbm90IGFwcGVhciBpbiB0 aGUgQVMgcGF0aCwgdGhlcmVmb3JlIGl0IGlzIG9mIG5vIGNvbmNlcm4gdG8gYW55b25lIHRoYXQg aXMgdHJ5aW5nIHRvIHZhbGlkYXRlIHRoZSBBUyBwYXRoLg0KQ291bGQgd2UgcGxlYXNlIHJlbW92 ZSBhbGwgcmVmZXJlbmNlcyB0byByb3V0ZSBzZXJ2ZXJzIGZyb20gdGhlIEFTUEEgZHJhZnQgYW5k IGlzc3VlIGEgbmV3IGRyYWZ0IGFib3V0IHRyZWF0bWVudCBvZiByb3V0ZSBzZXJ2ZXJzIG9ubHk/ DQoNClJlZ2FyZHMsDQpKYWtvYi4NCg0KRnJvbTogU2lkcm9wcyA8c2lkcm9wcy1ib3VuY2VzQGll dGYub3JnPG1haWx0bzpzaWRyb3BzLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgR3lh biBNaXNocmENClNlbnQ6IFN1bmRheSwgTWFyY2ggMjAsIDIwMjIgOToyMCBBTQ0KVG86IFNyaXJh bSwgS290aWthbGFwdWRpIChGZWQpIDxrb3Rpa2FsYXB1ZGkuc3JpcmFtPTQwbmlzdC5nb3ZAZG1h cmMuaWV0Zi5vcmc8bWFpbHRvOmtvdGlrYWxhcHVkaS5zcmlyYW09NDBuaXN0LmdvdkBkbWFyYy5p ZXRmLm9yZz4+DQpDYzogQmVuIE1hZGRpc29uIDxiZW5tQHdvcmtvbmxpbmUuYWZyaWNhPG1haWx0 bzpiZW5tQHdvcmtvbmxpbmUuYWZyaWNhPj47IHNpZHJvcHNAaWV0Zi5vcmc8bWFpbHRvOnNpZHJv cHNAaWV0Zi5vcmc+OyBncm93QGlldGYub3JnPG1haWx0bzpncm93QGlldGYub3JnPjsgWmh1YW5n c2h1bndhbiA8emh1YW5nc2h1bndhbkBodWF3ZWkuY29tPG1haWx0bzp6aHVhbmdzaHVud2FuQGh1 YXdlaS5jb20+PjsgTmljayBIaWxsaWFyZCA8bmlja0Bmb29iYXIub3JnPG1haWx0bzpuaWNrQGZv b2Jhci5vcmc+Pg0KU3ViamVjdDogUmU6IFtTaWRyb3BzXSBbR1JPV10gQVNQQSBhbmQgUm91dGUg U2VydmVyICh3YXMgUkU6IElYUCBSb3V0ZSBTZXJ2ZXIgcXVlc3Rpb24pDQoNCg0KSGkgU3JpcmFt DQoNCk9uIFN1biwgTWFyIDIwLCAyMDIyIGF0IDEwOjU5IEFNIFNyaXJhbSwgS290aWthbGFwdWRp IChGZWQpIDxrb3Rpa2FsYXB1ZGkuc3JpcmFtPTQwbmlzdC5nb3ZAZG1hcmMuaWV0Zi5vcmc8bWFp bHRvOjQwbmlzdC5nb3ZAZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNCkkgdGhpbmsgYSBjb3JyZWN0 aW9uIGlzIHJlcXVpcmVkLiBJbnN0ZWFkIG9mIHdoYXQgd2FzIHNhaWQgYmVmb3JlIC0NCg0KIzE6 IEFuIFJTIGNsaWVudCBvZiBhbiBSUyAodHJhbnNwYXJlbnQgb3Igbm90KSBpbmNsdWRlcyB0aGUg UlMgQVMgaW4gdGhlaXIgU1BBUy9BU1BBLiBUaGUgUlMgY2xpZW50IGFsc28gaW5jbHVkZXMgaW4g aXRzIFNQQVMvQVNQQSBhbnkgQVMgd2l0aCB3aG9tIGl0IGNvbm5lY3RzIGluIHRoZSBjb250cm9s IHBsYW5lIHZpYSB0aGUgUlMuDQoNCm9ubHkgdGhlIGZvbGxvd2luZyBzaW1wbGVyIHN0YXRlbWVu dCBpcyByZXF1aXJlZCBpbiB0aGUgZHJhZnQ6DQoNCiMyOiBBbiBSUyBjbGllbnQgb2YgYW4gUlMg KHRyYW5zcGFyZW50IG9yIG5vdCkgaW5jbHVkZXMgdGhlIFJTIEFTIGluIHRoZWlyIFNQQVMvQVNQ QS4NCg0KVGhlIHJlYXNvbiBpcyBhcyBmb2xsb3dzLiBDb25zaWRlciB0aGUgZm9sbG93aW5nIHRv cG9sb2d5IGFuZCBVcGRhdGUgZmxvdyBwZXIgYXJyb3dzOg0KDQpBUzEgKFJTIENsaWVudCkgLS0t LS0+IEFTMiAoUlMpIC0tLS0tPiAgQVMzIChSUyBDbGllbnQpIC0tLXAycCAobGF0ZXJhbCBwZWVy KSAtLS0+ICBBUzQgKHZhbGlkYXRpbmcgQVMpDQoNCkFTNCBpcyB0aGUgcmVjZWl2aW5nL3ZhbGlk YXRpbmcgQVMuIFJlZ2FyZGxlc3Mgb2Ygd2hldGhlciB0aGUgUlMgaW5zZXJ0cyBpdHMgQVNOIGlu IHRoZSBBUyBwYXRoIG9yIG5vdCwgdGhlIFVwZGF0ZSBpcyBJbnZhbGlkIChyb3V0ZSBsZWFrKSBh dCBBUzQuIEJlY2F1c2Ugb25jZSB0aGUgVXBkYXRlIHRyYW5zaXRpb25lZCB0byBhIGRvd253YXJk IHBhdGggYWZ0ZXIgdGhlIFJTLCBpdCBjYW5ub3QgYmUgc3Vic2VxdWVudGx5IHNlbnQgdG8gYSBw cm92aWRlciBvciBsYXRlcmFsIHBlZXIuIEJ1dCB3aXRoICMxLCB0aGUgVXBkYXRlIHdpbGwgYmUg ZXZhbHVhdGVkIGFzIFZhbGlkIChub3Qgcm91dGUgbGVhaykgYnkgdGhlIEFTUEEgdmVyaWZpY2F0 aW9uIHByb2NlZHVyZSBpbiBjYXNlIHRoZSBSUyBpcyB0cmFuc3BhcmVudC4gQnV0IHdpdGggIzIs IHRoZSBVcGRhdGUgd2lsbCBiZSBjb3JyZWN0bHkgZGV0ZWN0ZWQgYXMgYSByb3V0ZSBsZWFrICh3 aGV0aGVyIHRoZSBSUyBpcyB0cmFuc3BhcmVudCBvciBub3QpLg0KDQpFeHBsYW5hdGlvbjogV2l0 aCAjMSwgdGhlIGhvcCBBUzEtQVMzIGluIHRoZSB0cmFuc3BhcmVudCBjYXNlIGlzIGV2YWx1YXRl ZCBhcyBWYWxpZCAoQzJQKSAoYXMgcGFydCBvZiBhbiBhc2NlbmRpbmcgdXAtcmFtcCBvbiB0aGUg bGVmdCkgYnkgdGhlIHByb2NlZHVyZSBhbmQgdGhhdCBpcyBub3QgZ29vZC4gSS5lLiwgdGhlIGRl dGVjdGlvbiBvZiB0aGUgYXBleCBpbiB0aGUgQVMgcGF0aCBhdCB0aGUgUlMgKG5vdCB2aXNpYmxl IGluIHRoZSBwYXRoKSBhbmQgaW52ZXJzaW9uIChub24tdXB3YXJkIGZsb3cpIGFmdGVyIHRoZSBS UyBpcyBvYnNjdXJlZCB3aXRoICMxIChpbiB0aGUgdHJhbnNwYXJlbnQgY2FzZSkuIEhvd2V2ZXIs IHdpdGggIzIsIHRoZSBob3AgQVMxLUFTMyBpcyBldmFsdWF0ZWQgYXMgImF0dGVzdGVkIG5vdCBQ cm92aWRlciIuIFRoYXQgbWVhbnMgdGhhdCB0aGUgZGV0ZWN0aW9uIG9mIGFwZXgvaW52ZXJzaW9u IGF0IHRoZSBSUyAodGhvdWdoIG5vdCB2aXNpYmxlIGluIHRoZSBwYXRoKSBpcyBlZmZlY3RpdmVs eSBub3QgbWlzc2VkIG91dCBieSB0aGUgcHJvY2VkdXJlIHdpdGggIzIuDQoNClRoYW5rIHlvdS4N Cg0KU3JpcmFtDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBHUk9XIDxncm93 LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmdyb3ctYm91bmNlc0BpZXRmLm9yZz4+IE9uIEJlaGFs ZiBPZiBTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKQ0KU2VudDogVHVlc2RheSwgTWFyY2ggMTUs IDIwMjIgMTE6MzQgQU0NClRvOiBOaWNrIEhpbGxpYXJkIDxuaWNrQGZvb2Jhci5vcmc8bWFpbHRv Om5pY2tAZm9vYmFyLm9yZz4+DQpDYzogQmVuIE1hZGRpc29uIDxiZW5tQHdvcmtvbmxpbmUuYWZy aWNhPG1haWx0bzpiZW5tQHdvcmtvbmxpbmUuYWZyaWNhPj47IGdyb3dAaWV0Zi5vcmc8bWFpbHRv Omdyb3dAaWV0Zi5vcmc+OyBzaWRyb3BzQGlldGYub3JnPG1haWx0bzpzaWRyb3BzQGlldGYub3Jn Pg0KU3ViamVjdDogW0dST1ddIEFTUEEgYW5kIFJvdXRlIFNlcnZlciAod2FzIFJFOiBbU2lkcm9w c10gSVhQIFJvdXRlIFNlcnZlciBxdWVzdGlvbikNCg0KTmljayAoYW5kIGFsbCksDQoNCkkgd2Fz IGFsc28gcmVyZWFkaW5nL3Jldmlld2luZyBTZWN0aW9uIDUuMyBhbmQgaGFkIHNpbWlsYXIgdGhv dWdodHMgYWJvdXQgdGhlIHR3byBvcHRpb25zIHlvdSBvdXRsaW5lZC4gQXMgeW91IG5vdGVkLCAi dGhlIGFwcHJvYWNoIGluIFNlY3Rpb24gNS4zIGdpdmVzIGEgd29ya2FibGUgb3V0Y29tZSIuICBI b3dldmVyLi4uDQoNCj4uLi4gdGhlIFJTIHNob3VsZCBiZSB0cmVhdGVkIGFzIGEgcHJvdmlkZXIg YnkgdGhlIHJzIGNsaWVudDsgdGhlIHJzIGNsaWVudCBzaG91bGQgaW5jbHVkZSB0aGUgUlMgQVNO IGluIGl0cyBTUEFTOyB0aGUgcnMgY2xpZW50IHNob3VsZCBldmFsdWF0ZSBBU1BBIGFzIGlmIHRo ZSBSUyBBU04gd2VyZSBpbmNsdWRlZCBpbiB0aGUgcGF0aDsgdGhlIHJzIHNob3VsZCBldmFsdWF0 ZSBjbGllbnRzIGFzIGN1c3RvbWVycw0KDQpZZXMsIEkgYWdyZWUgdGhhdCAidGhlIHJzIGNsaWVu dCBzaG91bGQgaW5jbHVkZSB0aGUgUlMgQVNOIGluIGl0cyBTUEFTLiIgQWxleGFuZGVyIGFuZCBJ IGhhdmUgdGFsa2VkIGFib3V0IHRoaXMsIGFuZCBoZSBtZW50aW9uZWQgdGhhdCB0aGlzIHdvdWxk IGJlIGFkZGVkIHRvIHRoZSBkcmFmdC4NCg0KWWVzLCBJIGFsc28gZmVlbCB0aGF0IGl0IGlzIGEg YmV0dGVyIG9wdGlvbiB0aGF0IHRoZSBSUyBjbGllbnQgYWRkcyB0aGUgQVNOIG9mIHRoZSB0cmFu c3BhcmVudCBSUyB0byB0aGUgQVMgcGF0aCAoZm9yIEFTUEEgdmFsaWRhdGlvbiBwdXJwb3NlcyBv bmx5KSBhbmQgYXBwbGllcyB0aGUgZG93bnN0cmVhbSBBU1BBIGFsZ29yaXRobS4gQWxnb3JpdGht aWNhbGx5IHRoaXMgc2VlbXMgbW9yZSBhcHByb3ByaWF0ZS4gVGhpcyBpcyBhbHNvIGJldHRlciBm cm9tIGEgZGlhZ25vc3RpY3MgcG9pbnQgb2YgdmlldyAoaWYgdGhlIG5lZWQgZXZlciBhcmlzZXMp IGJlY2F1c2UgaW4gdGhpcyBhcHByb2FjaCB0aGUgcmVsZXZhbnQgQVNQQSBpcyB1c2VkIGZvciB2 YWxpZGF0aW5nIHRoZSBob3AgZnJvbSB0aGUgQVMganVzdCBiZWZvcmUgdGhlIFJTIHRvIHRoZSBS Uy4NCg0KVGhhdCBzYWlkLCBJIHRoaW5rIHRoZXJlIGlzIGEgYmlnZ2VyIGlzc3VlIGFib3V0IHRy YW5zcGFyZW50IFJTIGluIHRoZSBtaWRkbGUgb2YgdGhlIEFTIHBhdGguIE1heWJlIHRoaXMgaXMg d2hhdCBCZW4ncyBxdWVzdGlvbiB3YXMgaGludGluZyBhdC4gSSB0aGluayB5b3UgYXJlIGFsc28g cmFpc2luZyB0aGlzIGlzc3VlIHdoZW4geW91IHNheToNCg0KPlJTcyBkbyBub3QgcGFydGFrZSBp biB0cmFmZmljIGZvcndhcmRpbmcsIHNvIHRoZXkgYXJlIG5vdCBwYXJ0IG9mIHRoZSBkYXRhIHBh dGggYmV0d2VlbiB0d28gQVNOczsgdGhleSdyZSBvbmx5IHBhcnQgb2YgdGhlIHNpZ25hbGluZyBw YXRoIGJldHdlZW4gdGhlIHR3byBBU05zLiAgVGhpcyBpcyBhIHVzZWZ1bCBoYWNrIGZyb20gYSBw cmFjdGljYWwgcG9pbnQgb2YgdmlldywgYnV0IGl0IGNhdXNlcyBhbGdvcml0aG1pYyBicmVha2Fn ZSBpbiBwbGFjZXMgd2hpY2ggYXNzdW1lIGNvbmdydWVuY3kgYmV0d2VlbiB0aGUgZGF0YSBwbGFu ZSBhbmQgdGhlIHNpZ25hbGluZyBwbGFuZS4gIE9uZSBvZiB0aGVzZSBwbGFjZXMgaXMgQVMgcGF0 aCB2ZXJpZmljYXRpb24uDQoNCj4gLi4uLkFTUEEgdmVyaWZpY2F0aW9uIHNob3VsZCBwcm9jZWVk IGFzIGlmIHRoZSB0d28gcnMtY2xpZW50IEFTTnMgd2VyZSBkaXJlY3RseSBjb25uZWN0ZWQgYW5k IGVhY2ggc2hvdWxkIHRyZWF0IHRoZSBvdGhlciBhcyBhIHByb3ZpZGVyDQoNCiAgICBHeWFuPkkg dW5kZXJzdGFuZCB0aGUgaXNzdWUgd2l0aCB0aGUgQVNQQSBwYXRoIHZlcmlmaWNhdGlvbiwgaG93 ZXZlciBpZiB0aGUgUlMgQVMgYWRkZWQgdG8gQVNQQSB0aGVuIHRoYXQgd291bGQgaW5mbHVlbmNl IHRoZSBmb3J3YXJkaW5nIHBsYW5lIGlzIHRoZSBpc3N1ZS4gIEhvdyBkbyB5b3UgaW5zZXJ0IFJT IEFTIGZvciB0aGUgQVNQQSBwYXRoIHZlcmlmaWNhdGlvbiBidXQgbm90IGFsbG93IFJTIHRvIGJl IHBhcnQgb2YgZm9yd2FyZGluZyBwbGFuZT8gIEkgZ3Vlc3MgeW91IGNvdWxkIGRvIGEgbmV4dC1o b3AtdW5jaGFuZ2VkIGJldHdlZW4gdGhlIGNsaWVudHMgY29ubmVjdGVkIHRocm91Z2ggdGhlIFJT Lg0KDQoNCkJhc2VkIG9uIHRoZSBhYm92ZSBvYnNlcnZhdGlvbnMgZnJvbSB5b3UsIEkgYW0gcHJv cG9zaW5nIHRoZSBmb2xsb3dpbmc6DQoNCkFuIFJTIGNsaWVudCBvZiBhbiBSUyAodHJhbnNwYXJl bnQgb3Igbm90KSBpbmNsdWRlcyB0aGUgUlMgQVMgaW4gdGhlaXIgU1BBUy9BU1BBLiBUaGUgUlMg Y2xpZW50IGFsc28gaW5jbHVkZXMgaW4gaXRzIFNQQVMvQVNQQSBhbnkgQVMgd2l0aCB3aG9tIGl0 IGNvbm5lY3RzIGluIHRoZSBjb250cm9sIHBsYW5lIHZpYSB0aGUgUlMuDQoNClRoZSBpZGVhIGlz IHRoYXQgYSBwYXRoIHNlZ21lbnQgQVN4LVJTLUFTeSAod2hlcmUgQVN4IGFuZCBBU3kgYXJlIFJT LWNsaWVudHMgY29ubmVjdGVkIGluIEJHUCB2aWEgdGhlIFJTKSB3aWxsIGJlIGFsd2F5cyB2ZXJp ZmlhYmxlIHdpdGggdGhpcyBwcm9wb3NhbCB3aGV0aGVyIG9yIG5vdCB0aGUgUlMgaXMgdHJhbnNw YXJlbnQuIElmIHRoZSBBU1BBcyBhcmUgY3JlYXRlZCBieSBBU3ggYW5kIEFTeSBwZXIgdGhlIHBy b3Bvc2FsIGFib3ZlLCB0aGVuIHRoZSBBU3gtUlMtQVN5IHNlZ21lbnQgd2lsbCBiZSBldmFsdWF0 ZWQgYXMgVmFsaWQgaW4gZWl0aGVyIGRpcmVjdGlvbi4gSSAgdGhpbmsgdGhpcyBwcm9wb3NhbCBp biBjb25qdW5jdGlvbiB3aXRoIG90aGVyIGlkZWFzIGRpc2N1c3NlZCBhYm92ZSB0YWtlcyBjYXJl IG9mIGJvdGggdHJhbnNwYXJlbnQgYW5kIG5vbi10cmFuc3BhcmVudCBSU3MgaW4gdGhlIEFTUEEg dmVyaWZpY2F0aW9uIGFsZ29yaXRobXMuIERvZXMgdGhpcyBzZWVtIHJlYXNvbmFibGU/DQoNClRo YW5rIHlvdS4NCg0KU3JpcmFtDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQpHUk9XIG1haWxpbmcgbGlzdA0KR1JPV0BpZXRmLm9yZzxtYWlsdG86R1JP V0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZ3Jvdw0K LS0NCltodHRwOi8vc3M3LnZ6dy5jb20vaXMvaW1hZ2UvVmVyaXpvbldpcmVsZXNzL3Z6LWxvZ28t ZW1haWxdPGh0dHA6Ly93d3cudmVyaXpvbi5jb20vPg0KR3lhbiBNaXNocmENCk5ldHdvcmsgU29s dXRpb25zIEFyY2hpdGVjdA0KRW1haWwgZ3lhbi5zLm1pc2hyYUB2ZXJpem9uLmNvbTxtYWlsdG86 Z3lhbi5zLm1pc2hyYUB2ZXJpem9uLmNvbT4NCk0gMzAxIDUwMi0xMzQ3DQoNCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpHUk9XIG1haWxpbmcgbGlzdA0K R1JPV0BpZXRmLm9yZzxtYWlsdG86R1JPV0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vZ3Jvdw0KDQo= --_000_BYAPR11MB32077BA1382FC96F88A26248C0169BYAPR11MB3207namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OlNpbVN1bjsNCglwYW5vc2UtMToyIDEgNiAw IDMgMSAxIDEgMSAxO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7 DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5OkRlbmdYaWFuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6R2VvcmdpYTsNCglwYW5vc2UtMToyIDQgNSAy IDUgNCA1IDIgMyAzO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IlxAU2ltU3VuIjsNCglw YW5vc2UtMToyIDEgNiAwIDMgMSAxIDEgMSAxO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IlxARGVuZ1hpYW4iOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KLyogU3R5bGUg RGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwN Cgl7bWFyZ2luOjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0 ZWQtc3BhY2U7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwt cmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzQ0MUQ2 MTt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250 LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsN CgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtw YWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9 ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlv dXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0i Ymx1ZSIgdmxpbms9InB1cnBsZSIgc3R5bGU9IndvcmQtd3JhcDpicmVhay13b3JkIj4NCjxkaXYg Y2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj5UbyBiZSBjbGVhciwgSSdtIHRhbGtpbmcg YWJvdXQgQkdQIGRldmljZXMgdGhhdCBkbyBub3QgaW5zZXJ0IHRoZWlyIEFTTiBpbnRvIHRoZSBB UyBwYXRoLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPkkgdW5kZXJzdGFuZCB0aGF0 IHJvdXRlIGxlYWtzIGNhbiBoYXBwZW4gYWZ0ZXIgYSByb3V0ZSBzZXJ2ZXIuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+TXkgcG9pbnQgaXMgdGhhdCBzdWNoIGEgcm91dGUgbGVhayBp cyBvZiBubyBjb25jZXJuIHRvIEFTUEEuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEiPlJlZ2FyZHMsPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+SmFrb2IuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjojNDQxRDYxIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0K PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3Bh ZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8 L2I+IEplZmZyZXkgSGFhcyAmbHQ7amhhYXNAcGZyYy5vcmcmZ3Q7IDxicj4NCjxiPlNlbnQ6PC9i PiBNb25kYXksIE1hcmNoIDIxLCAyMDIyIDk6NDMgQU08YnI+DQo8Yj5Ubzo8L2I+IFpodWFuZ3No dW53YW4gJmx0O3podWFuZ3NodW53YW49NDBodWF3ZWkuY29tQGRtYXJjLmlldGYub3JnJmd0Ozxi cj4NCjxiPkNjOjwvYj4gSmFrb2IgSGVpdHogKGpoZWl0eikgJmx0O2poZWl0ekBjaXNjby5jb20m Z3Q7OyBHeWFuIE1pc2hyYSAmbHQ7aGF5YWJ1c2Fnc21AZ21haWwuY29tJmd0OzsgU3JpcmFtLCBL b3Rpa2FsYXB1ZGkgKEZlZCkgJmx0O2tvdGlrYWxhcHVkaS5zcmlyYW09NDBuaXN0LmdvdkBkbWFy Yy5pZXRmLm9yZyZndDs7IEJlbiBNYWRkaXNvbiAmbHQ7YmVubUB3b3Jrb25saW5lLmFmcmljYSZn dDs7IHNpZHJvcHNAaWV0Zi5vcmc7IGdyb3dAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4g UmU6IFtHUk9XXSBbU2lkcm9wc10gQVNQQSBhbmQgUm91dGUgU2VydmVyICh3YXMgUkU6IElYUCBS b3V0ZSBTZXJ2ZXIgcXVlc3Rpb24pPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5Ud28gY29tbWVudHMgaGVyZTo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPklmIHRoZSBCR1AgU3BlYWtlciBpcyBpbnNlcnRpbmcgaXRzZWxmIGludG8g dGhlIEFTX1BBVEgsIGl0J3Mgbm90IHJlYWxseSBhIFJvdXRlIFNlcnZlciBpbiB0aGUgdHJhZGl0 aW9uYWwgc2Vuc2UuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkEgbm9ybWFsIEJHUCBTcGVha2VyIGNhbiBoYXBwaWx5IHBhc3MgYWxvbmcgcm91 dGVzIHZpYSBlQkdQIHBlZXJpbmcgd2l0aCB0aGUgbmV4dGhvcCB1bmNoYW5nZWQgd2l0aCBhbGwg ZGV2aWNlcyB0aGF0IGl0IHNoYXJlcyBhIGNvbW1vbiBuZXh0aG9wIHN1Ym5ldCB3aXRoLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NeSByZWNv bW1lbmRhdGlvbiBpcyB0byBub3QgdG8gdHJ5IHRvIGNvbnNpZGVyIHRoZXNlIGRldmljZXMgYSBS b3V0ZSBTZXJ2ZXIuICZuYnNwO0ZvciBBU1BBIHB1cnBvc2VzLCBqdXN0IGFkZCB0aGUgQkdQIGNv bm5lY3Rpb25zIHRvIHRoZSBpbnB1dHMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPklmIHByb3ZpZGVycyBhcmUgdW5oYXBweSB3aXRoIGhhdmlu ZyBhIElYUCByb3V0ZXIncyBBUyBpbiB0aGUgQVNQQSBkYXRhIGFuZCB0aHVzIGxvc2UgdGhlIGRl c2lyZWQgQVNQQSBmaWx0ZXJpbmcgcHJvcGVydGllcywgdGhlIElYUCBzaG91bGQgaW5zdGFsbCBh IHJlYWwgcm91dGUgc2VydmVyLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4tLSBKZWZmPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4N CjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQi Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIE1hciAyMSwgMjAyMiwgYXQgMTE6NDgg QU0sIFpodWFuZ3NodW53YW4gJmx0OzxhIGhyZWY9Im1haWx0bzp6aHVhbmdzaHVud2FuPTQwaHVh d2VpLmNvbUBkbWFyYy5pZXRmLm9yZyI+emh1YW5nc2h1bndhbj00MGh1YXdlaS5jb21AZG1hcmMu aWV0Zi5vcmc8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2NvbG9yOiMxRjQ5N0Qi PisxPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Y29sb3I6IzFGNDk3RCI+SSB0aGlu ayBKYWNvYidzIHN1Z2dlc3Rpb24gaXMgcmVhc29uYWJsZS48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjVwdDtjb2xvcjojMUY0OTdEIj5JIG9uY2Ugd29ya2VkIG9uIGEgcm91dGUgbGVhayBh bmFseXNpcyBwcm9qZWN0LiBUaGVyZSBpcyBhIGZpcnN0IHN0ZXAgaW4gdGhhdCBwcm9qZWN0LCB3 aGljaCBpcyB0byBjbGVhciB0aGUgSVhQ4oCZcyBBUyBudW1iZXIgYWRkZWQgdG8gdGhlIEFTLVBB VEggYnkgdGhlIG5vbi10cmFuc3BhcmVudCBSUy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjVwdDtjb2xvcjojMUY0OTdEIj5UaGUgYmFzaWMgaWRlYSBpcyB0aGF0IGEgcGF0aCBzZWdtZW50 IOKAnEFTMSAtIEFTeCAtIFJT4oCZcyBBU04gLSBBU3kgLSBBU27igJ0gKHdoZXJlIEFTeCBhbmQg QVN5IGFyZSBSUy1jbGllbnRzIGNvbm5lY3RlZCBpbiBCR1AgdmlhIHRoZSBSUykgd2lsbCBiZSBj b3JyZWN0ZWQgdG8g4oCcQVMxIC0gQVN4IC0gQVN5IC0gQVNu4oCdLjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuNXB0O2NvbG9yOiMxRjQ5N0QiPldpdGggdGhpcyBwcm9jZXNzLCB3ZSBjYW4g ZXhjbHVkZSB0aGUgaW5mbHVlbmNlIG9mIG5vbi10cmFuc3BhcmVudCBSUyBvbiB0aGUgYWNjdXJh Y3kgb2Ygcm91dGUtbGVhayBhbmFseXNpcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVw dDtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtj b2xvcjojMUY0OTdEIj5LaW5kIFJlZ2FyZHMsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41 cHQ7Y29sb3I6IzFGNDk3RCI+U2h1bndhbjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0 O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5n OjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPkpha29iIEhlaXR6IChqaGVpdHopIFs8YSBo cmVmPSJtYWlsdG86amhlaXR6QGNpc2NvLmNvbSI+bWFpbHRvOmpoZWl0ekBjaXNjby5jb208L2E+ XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQo8 Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+TW9uZGF5LCBNYXJjaCAyMSwgMjAyMiAxMToxMyBQTTxicj4NCjxiPlRvOjwvYj48c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+R3lhbiBNaXNocmEgJmx0 OzxhIGhyZWY9Im1haWx0bzpoYXlhYnVzYWdzbUBnbWFpbC5jb20iPmhheWFidXNhZ3NtQGdtYWls LmNvbTwvYT4mZ3Q7OyBTcmlyYW0sIEtvdGlrYWxhcHVkaSAoRmVkKSAmbHQ7PGEgaHJlZj0ibWFp bHRvOmtvdGlrYWxhcHVkaS5zcmlyYW09NDBuaXN0LmdvdkBkbWFyYy5pZXRmLm9yZyI+a290aWth bGFwdWRpLnNyaXJhbT00MG5pc3QuZ292QGRtYXJjLmlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5D Yzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPkJl biBNYWRkaXNvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJlbm1Ad29ya29ubGluZS5hZnJpY2EiPmJl bm1Ad29ya29ubGluZS5hZnJpY2E8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpzaWRyb3BzQGll dGYub3JnIj5zaWRyb3BzQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmdyb3dAaWV0Zi5v cmciPg0KZ3Jvd0BpZXRmLm9yZzwvYT47IFpodWFuZ3NodW53YW4gJmx0OzxhIGhyZWY9Im1haWx0 bzp6aHVhbmdzaHVud2FuQGh1YXdlaS5jb20iPnpodWFuZ3NodW53YW5AaHVhd2VpLmNvbTwvYT4m Z3Q7OyBOaWNrIEhpbGxpYXJkICZsdDs8YSBocmVmPSJtYWlsdG86bmlja0Bmb29iYXIub3JnIj5u aWNrQGZvb2Jhci5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SRTogW1NpZHJvcHNdIFtHUk9XXSBB U1BBIGFuZCBSb3V0ZSBTZXJ2ZXIgKHdhcyBSRTogSVhQIFJvdXRlIFNlcnZlciBxdWVzdGlvbik8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEi PlJvdXRlIHNlcnZlcnMgYXJlIGEgZGlzdHJhY3Rpb24gZm9yIEFTUEEuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+QVNQQSBpcyBhYm91dCBCR1AgcGF0aCB2 YWxpZGF0aW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiM0NDFENjEi PkFzIHN1Y2ggaXQgY29uY2VybnMgaXRzZWxmIHdpdGggQVNOcyBpbiB0aGUgQVMgcGF0aC48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj5JdCBpcyBhYm91dCBy ZWxhdGlvbnNoaXBzIGJldHdlZW4gYWRqYWNlbnQgQVNlcyBpbiB0aGUgQVMgcGF0aC48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj5TaW5jZSBSU2VzIGFyZSBu b3QgaW4gdGhlIEFTIHBhdGgsIHRoZXkgY2Fubm90IGJlIGluY2x1ZGVkIGluIEFTUEEuPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+UlNlcyBhcmUgb25seSB2 aXNpYmxlIGFuZCByZWxldmFudCB0byB0aGUgZGlyZWN0IG5laWdoYm9ycyBvZiB0aGUgUlMuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+VGhlIEFTTiBvZiB0 aGUgUlMgZG9lcyBub3QgYXBwZWFyIGluIHRoZSBBUyBwYXRoLCB0aGVyZWZvcmUgaXQgaXMgb2Yg bm8gY29uY2VybiB0byBhbnlvbmUgdGhhdCBpcyB0cnlpbmcgdG8gdmFsaWRhdGUgdGhlIEFTIHBh dGguPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2MSI+Q291bGQg d2UgcGxlYXNlIHJlbW92ZSBhbGwgcmVmZXJlbmNlcyB0byByb3V0ZSBzZXJ2ZXJzIGZyb20gdGhl IEFTUEEgZHJhZnQgYW5kIGlzc3VlIGEgbmV3IGRyYWZ0IGFib3V0IHRyZWF0bWVudCBvZiByb3V0 ZSBzZXJ2ZXJzIG9ubHk/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0 MUQ2MSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzQ0MUQ2 MSI+UmVnYXJkcyw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYx Ij5KYWtvYi48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojNDQxRDYxIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4g MGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj48c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+U2lkcm9wcyAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnNpZHJvcHMtYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+c2lkcm9wcy1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uIEJlaGFsZiBPZjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+R3lhbg0KIE1p c2hyYTxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj5TdW5kYXksIE1hcmNoIDIwLCAyMDIyIDk6MjAgQU08YnI+DQo8Yj5Ubzo8 L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlNyaXJh bSwgS290aWthbGFwdWRpIChGZWQpICZsdDs8YSBocmVmPSJtYWlsdG86a290aWthbGFwdWRpLnNy aXJhbT00MG5pc3QuZ292QGRtYXJjLmlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5rb3Rpa2FsYXB1ZGkuc3JpcmFtPTQwbmlzdC5nb3ZAZG1hcmMuaWV0Zi5vcmc8L3NwYW4+PC9h PiZndDs8YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPkJlbiBNYWRkaXNvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJlbm1Ad29ya29u bGluZS5hZnJpY2EiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmJlbm1Ad29ya29ubGluZS5h ZnJpY2E8L3NwYW4+PC9hPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzaWRyb3BzQGlldGYub3JnIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5zaWRyb3BzQGlldGYub3JnPC9zcGFuPjwvYT47PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpncm93 QGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5ncm93QGlldGYub3JnPC9zcGFu PjwvYT47DQogWmh1YW5nc2h1bndhbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOnpodWFuZ3NodW53YW5A aHVhd2VpLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+emh1YW5nc2h1bndhbkBodWF3 ZWkuY29tPC9zcGFuPjwvYT4mZ3Q7OyBOaWNrIEhpbGxpYXJkICZsdDs8YSBocmVmPSJtYWlsdG86 bmlja0Bmb29iYXIub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5uaWNrQGZvb2Jhci5v cmc8L3NwYW4+PC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtTaWRyb3BzXSBbR1JPV10gQVNQQSBh bmQgUm91dGUgU2VydmVyICh3YXMgUkU6IElYUCBSb3V0ZSBTZXJ2ZXIgcXVlc3Rpb24pPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIFNyaXJhbTxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFN1biwgTWFyIDIwLCAyMDIyIGF0IDEwOjU5IEFN IFNyaXJhbSwgS290aWthbGFwdWRpIChGZWQpICZsdDtrb3Rpa2FsYXB1ZGkuc3JpcmFtPTxhIGhy ZWY9Im1haWx0bzo0MG5pc3QuZ292QGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+NDBuaXN0LmdvdkBkbWFyYy5pZXRmLm9yZzwvc3Bhbj48 L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRk aW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JIHRoaW5rIGEgY29ycmVjdGlvbiBpcyByZXF1aXJlZC4gSW5zdGVhZCBvZiB3 aGF0IHdhcyBzYWlkIGJlZm9yZSAtPGJyPg0KPGJyPg0KIzE6IEFuIFJTIGNsaWVudCBvZiBhbiBS UyAodHJhbnNwYXJlbnQgb3Igbm90KSBpbmNsdWRlcyB0aGUgUlMgQVMgaW4gdGhlaXIgU1BBUy9B U1BBLiBUaGUgUlMgY2xpZW50IGFsc28gaW5jbHVkZXMgaW4gaXRzIFNQQVMvQVNQQSBhbnkgQVMg d2l0aCB3aG9tIGl0IGNvbm5lY3RzIGluIHRoZSBjb250cm9sIHBsYW5lIHZpYSB0aGUgUlMuPGJy Pg0KPGJyPg0Kb25seSB0aGUgZm9sbG93aW5nIHNpbXBsZXIgc3RhdGVtZW50IGlzIHJlcXVpcmVk IGluIHRoZSBkcmFmdDo8YnI+DQo8YnI+DQojMjogQW4gUlMgY2xpZW50IG9mIGFuIFJTICh0cmFu c3BhcmVudCBvciBub3QpIGluY2x1ZGVzIHRoZSBSUyBBUyBpbiB0aGVpciBTUEFTL0FTUEEuPHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4NCjxicj4N ClRoZSByZWFzb24gaXMgYXMgZm9sbG93cy4gQ29uc2lkZXIgdGhlIGZvbGxvd2luZyB0b3BvbG9n eSBhbmQgVXBkYXRlIGZsb3cgcGVyIGFycm93czo8YnI+DQo8YnI+DQpBUzEgKFJTIENsaWVudCkg LS0tLS0mZ3Q7IEFTMiAoUlMpIC0tLS0tJmd0OyZuYnNwOyBBUzMgKFJTIENsaWVudCkgLS0tcDJw IChsYXRlcmFsIHBlZXIpIC0tLSZndDsmbmJzcDsgQVM0ICh2YWxpZGF0aW5nIEFTKTxicj4NCjxi cj4NCkFTNCBpcyB0aGUgcmVjZWl2aW5nL3ZhbGlkYXRpbmcgQVMuIFJlZ2FyZGxlc3Mgb2Ygd2hl dGhlciB0aGUgUlMgaW5zZXJ0cyBpdHMgQVNOIGluIHRoZSBBUyBwYXRoIG9yIG5vdCwgdGhlIFVw ZGF0ZSBpcyBJbnZhbGlkIChyb3V0ZSBsZWFrKSBhdCBBUzQuIEJlY2F1c2Ugb25jZSB0aGUgVXBk YXRlIHRyYW5zaXRpb25lZCB0byBhIGRvd253YXJkIHBhdGggYWZ0ZXIgdGhlIFJTLCBpdCBjYW5u b3QgYmUgc3Vic2VxdWVudGx5IHNlbnQgdG8gYSBwcm92aWRlcg0KIG9yIGxhdGVyYWwgcGVlci4g QnV0IHdpdGggIzEsIHRoZSBVcGRhdGUgd2lsbCBiZSBldmFsdWF0ZWQgYXMgVmFsaWQgKG5vdCBy b3V0ZSBsZWFrKSBieSB0aGUgQVNQQSB2ZXJpZmljYXRpb24gcHJvY2VkdXJlIGluIGNhc2UgdGhl IFJTIGlzIHRyYW5zcGFyZW50LiBCdXQgd2l0aCAjMiwgdGhlIFVwZGF0ZSB3aWxsIGJlIGNvcnJl Y3RseSBkZXRlY3RlZCBhcyBhIHJvdXRlIGxlYWsgKHdoZXRoZXIgdGhlIFJTIGlzIHRyYW5zcGFy ZW50IG9yIG5vdCkuPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjxicj4NCjxicj4NCkV4cGxhbmF0aW9uOiBXaXRoICMxLCB0aGUgaG9wIEFTMS1BUzMgaW4g dGhlIHRyYW5zcGFyZW50IGNhc2UgaXMgZXZhbHVhdGVkIGFzIFZhbGlkIChDMlApIChhcyBwYXJ0 IG9mIGFuIGFzY2VuZGluZyB1cC1yYW1wIG9uIHRoZSBsZWZ0KSBieSB0aGUgcHJvY2VkdXJlIGFu ZCB0aGF0IGlzIG5vdCBnb29kLiBJLmUuLCB0aGUgZGV0ZWN0aW9uIG9mIHRoZSBhcGV4IGluIHRo ZSBBUyBwYXRoIGF0IHRoZSBSUyAobm90IHZpc2libGUgaW4gdGhlIHBhdGgpDQogYW5kIGludmVy c2lvbiAobm9uLXVwd2FyZCBmbG93KSBhZnRlciB0aGUgUlMgaXMgb2JzY3VyZWQgd2l0aCAjMSAo aW4gdGhlIHRyYW5zcGFyZW50IGNhc2UpLiBIb3dldmVyLCB3aXRoICMyLCB0aGUgaG9wIEFTMS1B UzMgaXMgZXZhbHVhdGVkIGFzICZxdW90O2F0dGVzdGVkIG5vdCBQcm92aWRlciZxdW90Oy4gVGhh dCBtZWFucyB0aGF0IHRoZSBkZXRlY3Rpb24gb2YgYXBleC9pbnZlcnNpb24gYXQgdGhlIFJTICh0 aG91Z2ggbm90IHZpc2libGUgaW4gdGhlIHBhdGgpDQogaXMgZWZmZWN0aXZlbHkgbm90IG1pc3Nl ZCBvdXQgYnkgdGhlIHByb2NlZHVyZSB3aXRoICMyLjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQo8YnI+DQpUaGFuayB5b3UuPGJyPg0KPGJyPg0K U3JpcmFtJm5ic3A7ICZuYnNwOyAmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KPGJyPg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS08 YnI+DQpGcm9tOiBHUk9XICZsdDs8YSBocmVmPSJtYWlsdG86Z3Jvdy1ib3VuY2VzQGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+Z3Jvdy1ib3VuY2Vz QGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7IE9uIEJlaGFsZiBPZiBTcmlyYW0sIEtvdGlrYWxhcHVk aSAoRmVkKTxicj4NClNlbnQ6IFR1ZXNkYXksIE1hcmNoIDE1LCAyMDIyIDExOjM0IEFNPGJyPg0K VG86IE5pY2sgSGlsbGlhcmQgJmx0OzxhIGhyZWY9Im1haWx0bzpuaWNrQGZvb2Jhci5vcmciIHRh cmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5uaWNrQGZvb2Jhci5vcmc8 L3NwYW4+PC9hPiZndDs8YnI+DQpDYzogQmVuIE1hZGRpc29uICZsdDs8YSBocmVmPSJtYWlsdG86 YmVubUB3b3Jrb25saW5lLmFmcmljYSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+YmVubUB3 b3Jrb25saW5lLmFmcmljYTwvc3Bhbj48L2E+Jmd0Ozs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmdyb3dAaWV0Zi5vcmciIHRh cmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5ncm93QGlldGYub3JnPC9z cGFuPjwvYT47PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PjxhIGhyZWY9Im1haWx0bzpzaWRyb3BzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+c2lkcm9wc0BpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KU3Vi amVjdDogW0dST1ddIEFTUEEgYW5kIFJvdXRlIFNlcnZlciAod2FzIFJFOiBbU2lkcm9wc10gSVhQ IFJvdXRlIFNlcnZlciBxdWVzdGlvbik8YnI+DQo8YnI+DQpOaWNrIChhbmQgYWxsKSw8YnI+DQo8 YnI+DQpJIHdhcyBhbHNvIHJlcmVhZGluZy9yZXZpZXdpbmcgU2VjdGlvbiA1LjMgYW5kIGhhZCBz aW1pbGFyIHRob3VnaHRzIGFib3V0IHRoZSB0d28gb3B0aW9ucyB5b3Ugb3V0bGluZWQuIEFzIHlv dSBub3RlZCwgJnF1b3Q7dGhlIGFwcHJvYWNoIGluIFNlY3Rpb24gNS4zIGdpdmVzIGEgd29ya2Fi bGUgb3V0Y29tZSZxdW90Oy4mbmJzcDsgSG93ZXZlci4uLjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQo8YnI+DQomZ3Q7Li4uIHRoZSBSUyBzaG91 bGQgYmUgdHJlYXRlZCBhcyBhIHByb3ZpZGVyIGJ5IHRoZSBycyBjbGllbnQ7IHRoZSBycyBjbGll bnQgc2hvdWxkIGluY2x1ZGUgdGhlIFJTIEFTTiBpbiBpdHMgU1BBUzsgdGhlIHJzIGNsaWVudCBz aG91bGQgZXZhbHVhdGUgQVNQQSBhcyBpZiB0aGUgUlMgQVNOIHdlcmUgaW5jbHVkZWQgaW4gdGhl IHBhdGg7IHRoZSBycyBzaG91bGQgZXZhbHVhdGUgY2xpZW50cyBhcyBjdXN0b21lcnM8YnI+DQo8 YnI+DQpZZXMsIEkgYWdyZWUgdGhhdCAmcXVvdDt0aGUgcnMgY2xpZW50IHNob3VsZCBpbmNsdWRl IHRoZSBSUyBBU04gaW4gaXRzIFNQQVMuJnF1b3Q7IEFsZXhhbmRlciBhbmQgSSBoYXZlIHRhbGtl ZCBhYm91dCB0aGlzLCBhbmQgaGUgbWVudGlvbmVkIHRoYXQgdGhpcyB3b3VsZCBiZSBhZGRlZCB0 byB0aGUgZHJhZnQuPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjxicj4NCjxicj4NClllcywgSSBhbHNvIGZlZWwgdGhhdCBpdCBpcyBhIGJldHRlciBvcHRp b24gdGhhdCB0aGUgUlMgY2xpZW50IGFkZHMgdGhlIEFTTiBvZiB0aGUgdHJhbnNwYXJlbnQgUlMg dG8gdGhlIEFTIHBhdGggKGZvciBBU1BBIHZhbGlkYXRpb24gcHVycG9zZXMgb25seSkgYW5kIGFw cGxpZXMgdGhlIGRvd25zdHJlYW0gQVNQQSBhbGdvcml0aG0uIEFsZ29yaXRobWljYWxseSB0aGlz IHNlZW1zIG1vcmUgYXBwcm9wcmlhdGUuIFRoaXMgaXMgYWxzbyBiZXR0ZXINCiBmcm9tIGEgZGlh Z25vc3RpY3MgcG9pbnQgb2YgdmlldyAoaWYgdGhlIG5lZWQgZXZlciBhcmlzZXMpIGJlY2F1c2Ug aW4gdGhpcyBhcHByb2FjaCB0aGUgcmVsZXZhbnQgQVNQQSBpcyB1c2VkIGZvciB2YWxpZGF0aW5n IHRoZSBob3AgZnJvbSB0aGUgQVMganVzdCBiZWZvcmUgdGhlIFJTIHRvIHRoZSBSUy4mbmJzcDs8 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KPGJy Pg0KVGhhdCBzYWlkLCBJIHRoaW5rIHRoZXJlIGlzIGEgYmlnZ2VyIGlzc3VlIGFib3V0IHRyYW5z cGFyZW50IFJTIGluIHRoZSBtaWRkbGUgb2YgdGhlIEFTIHBhdGguIE1heWJlIHRoaXMgaXMgd2hh dCBCZW4ncyBxdWVzdGlvbiB3YXMgaGludGluZyBhdC4gSSB0aGluayB5b3UgYXJlIGFsc28gcmFp c2luZyB0aGlzIGlzc3VlIHdoZW4geW91IHNheTo8YnI+DQo8YnI+DQomZ3Q7UlNzIGRvIG5vdCBw YXJ0YWtlIGluIHRyYWZmaWMgZm9yd2FyZGluZywgc28gdGhleSBhcmUgbm90IHBhcnQgb2YgdGhl IGRhdGEgcGF0aCBiZXR3ZWVuIHR3byBBU05zOyB0aGV5J3JlIG9ubHkgcGFydCBvZiB0aGUgc2ln bmFsaW5nIHBhdGggYmV0d2VlbiB0aGUgdHdvIEFTTnMuJm5ic3A7IFRoaXMgaXMgYSB1c2VmdWwg aGFjayBmcm9tIGEgcHJhY3RpY2FsIHBvaW50IG9mIHZpZXcsIGJ1dCBpdCBjYXVzZXMgYWxnb3Jp dGhtaWMgYnJlYWthZ2UgaW4gcGxhY2VzDQogd2hpY2ggYXNzdW1lIGNvbmdydWVuY3kgYmV0d2Vl biB0aGUgZGF0YSBwbGFuZSBhbmQgdGhlIHNpZ25hbGluZyBwbGFuZS4mbmJzcDsgT25lIG9mIHRo ZXNlIHBsYWNlcyBpcyBBUyBwYXRoIHZlcmlmaWNhdGlvbi48YnI+DQo8YnI+DQomZ3Q7IC4uLi5B U1BBIHZlcmlmaWNhdGlvbiBzaG91bGQgcHJvY2VlZCBhcyBpZiB0aGUgdHdvIHJzLWNsaWVudCBB U05zIHdlcmUgZGlyZWN0bHkgY29ubmVjdGVkIGFuZCBlYWNoIHNob3VsZCB0cmVhdCB0aGUgb3Ro ZXIgYXMgYSBwcm92aWRlcjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 ICZuYnNwOyBHeWFuJmd0O0kgdW5kZXJzdGFuZCB0aGUgaXNzdWUgd2l0aCB0aGUgQVNQQSBwYXRo IHZlcmlmaWNhdGlvbiwgaG93ZXZlciBpZiB0aGUgUlMgQVMgYWRkZWQgdG8gQVNQQSB0aGVuIHRo YXQgd291bGQgaW5mbHVlbmNlIHRoZSBmb3J3YXJkaW5nIHBsYW5lIGlzIHRoZSBpc3N1ZS4mbmJz cDsgSG93IGRvIHlvdSBpbnNlcnQgUlMgQVMgZm9yIHRoZSBBU1BBIHBhdGggdmVyaWZpY2F0aW9u IGJ1dCBub3QgYWxsb3cgUlMgdG8NCiBiZSBwYXJ0IG9mIGZvcndhcmRpbmcgcGxhbmU/Jm5ic3A7 IEkgZ3Vlc3MgeW91IGNvdWxkIGRvIGEgbmV4dC1ob3AtdW5jaGFuZ2VkIGJldHdlZW4gdGhlIGNs aWVudHMgY29ubmVjdGVkIHRocm91Z2ggdGhlIFJTLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCkJhc2VkIG9uIHRoZSBhYm92 ZSBvYnNlcnZhdGlvbnMgZnJvbSB5b3UsIEkgYW0gcHJvcG9zaW5nIHRoZSBmb2xsb3dpbmc6PGJy Pg0KPGJyPg0KQW4gUlMgY2xpZW50IG9mIGFuIFJTICh0cmFuc3BhcmVudCBvciBub3QpIGluY2x1 ZGVzIHRoZSBSUyBBUyBpbiB0aGVpciBTUEFTL0FTUEEuIFRoZSBSUyBjbGllbnQgYWxzbyBpbmNs dWRlcyBpbiBpdHMgU1BBUy9BU1BBIGFueSBBUyB3aXRoIHdob20gaXQgY29ubmVjdHMgaW4gdGhl IGNvbnRyb2wgcGxhbmUgdmlhIHRoZSBSUy48YnI+DQo8YnI+DQpUaGUgaWRlYSBpcyB0aGF0IGEg cGF0aCBzZWdtZW50IEFTeC1SUy1BU3kgKHdoZXJlIEFTeCBhbmQgQVN5IGFyZSBSUy1jbGllbnRz IGNvbm5lY3RlZCBpbiBCR1AgdmlhIHRoZSBSUykgd2lsbCBiZSBhbHdheXMgdmVyaWZpYWJsZSB3 aXRoIHRoaXMgcHJvcG9zYWwgd2hldGhlciBvciBub3QgdGhlIFJTIGlzIHRyYW5zcGFyZW50LiBJ ZiB0aGUgQVNQQXMgYXJlIGNyZWF0ZWQgYnkgQVN4IGFuZCBBU3kgcGVyIHRoZSBwcm9wb3NhbCBh Ym92ZSwgdGhlbg0KIHRoZSBBU3gtUlMtQVN5IHNlZ21lbnQgd2lsbCBiZSBldmFsdWF0ZWQgYXMg VmFsaWQgaW4gZWl0aGVyIGRpcmVjdGlvbi4gSSZuYnNwOyB0aGluayB0aGlzIHByb3Bvc2FsIGlu IGNvbmp1bmN0aW9uIHdpdGggb3RoZXIgaWRlYXMgZGlzY3Vzc2VkIGFib3ZlIHRha2VzIGNhcmUg b2YgYm90aCB0cmFuc3BhcmVudCBhbmQgbm9uLXRyYW5zcGFyZW50IFJTcyBpbiB0aGUgQVNQQSB2 ZXJpZmljYXRpb24gYWxnb3JpdGhtcy4gRG9lcyB0aGlzIHNlZW0gcmVhc29uYWJsZT88YnI+DQo8 YnI+DQpUaGFuayB5b3UuPGJyPg0KPGJyPg0KU3JpcmFtPGJyPg0KPGJyPg0KX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpHUk9XIG1haWxpbmcgbGlz dDxicj4NCjxhIGhyZWY9Im1haWx0bzpHUk9XQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+R1JPV0BpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEg aHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9ncm93IiB0YXJnZXQ9 Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9ncm93PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPi0tPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxhIGhyZWY9Imh0dHA6Ly93d3cudmVyaXpvbi5jb20vIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6U2ltU3VuO2NvbG9yOiMxMTU1Q0M7 dGV4dC1kZWNvcmF0aW9uOm5vbmUiPjxpbWcgYm9yZGVyPSIwIiB3aWR0aD0iODEiIGhlaWdodD0i MTgiIHN0eWxlPSJ3aWR0aDouODQzN2luO2hlaWdodDouMTg3NWluIiBpZD0iX3gwMDAwX2kxMDI1 IiBzcmM9Imh0dHA6Ly9zczcudnp3LmNvbS9pcy9pbWFnZS9WZXJpem9uV2lyZWxlc3MvdnotbG9n by1lbWFpbCI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZh bWlseTpTaW1TdW4iPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmIj5HeWFuIE1pc2hyYTwvc3Bhbj48L2I+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6U2ltU3VuIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48aT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtHZW9yZ2lhJnF1b3Q7LHNlcmlm Ij5OZXR3b3JrIFNvbHV0aW9ucyBBcmNoaXRlY3QmbmJzcDs8L3NwYW4+PC9pPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OlNpbVN1biI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGk+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7R2VvcmdpYSZxdW90OyxzZXJpZiI+ RW1haWw8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEg aHJlZj0ibWFpbHRvOmd5YW4ucy5taXNocmFAdmVyaXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5neWFuLnMubWlzaHJhQHZlcml6b24uY29tPC9zcGFu PjwvYT48L3NwYW4+PC9pPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5 OlNpbVN1biI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2luLWJvdHRvbToxMi4wcHQi PjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0dlb3Jn aWEmcXVvdDssc2VyaWYiPk0gMzAxIDUwMi0xMzQ3PC9zcGFuPjwvaT48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtmb250LWZhbWlseTpTaW1TdW4iPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXzxicj4NCkdST1cgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRv OkdST1dAaWV0Zi5vcmciPkdST1dAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9ncm93Ij5odHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2dyb3c8L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_BYAPR11MB32077BA1382FC96F88A26248C0169BYAPR11MB3207namp_-- From nobody Mon Mar 21 13:56:56 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9AE7F3A1B38; Mon, 21 Mar 2022 13:56:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.721 X-Spam-Level: X-Spam-Status: No, score=-1.721 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.186, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5MHIFjxuWlmp; Mon, 21 Mar 2022 13:56:38 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 064C53A1B25; Mon, 21 Mar 2022 13:56:36 -0700 (PDT) Received: from mit.edu (c-73-169-244-254.hsd1.wa.comcast.net [73.169.244.254]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 22LKuRpj010925 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 21 Mar 2022 16:56:33 -0400 Date: Mon, 21 Mar 2022 13:56:26 -0700 From: Benjamin Kaduk To: Job Snijders Cc: The IESG , draft-ietf-sidrops-6486bis@ietf.org, morrowc@ops-netman.net, sidrops@ietf.org, sidrops-chairs@ietf.org Message-ID: <20220321205626.GY13021@mit.edu> References: <164366773060.21391.16732854790829264927@ietfa.amsl.com> <20220225235526.GY12881@kduck.mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Archived-At: Subject: Re: [Sidrops] Benjamin Kaduk's Discuss on draft-ietf-sidrops-6486bis-09: (with DISCUSS and COMMENT) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2022 20:56:48 -0000 Hi Job, On Sun, Mar 20, 2022 at 02:44:02PM +0100, Job Snijders wrote: > Dear Benjamin, others, > > A new version has been uploaded - which addresses all IESG input, including > the notion of a potential for interoperability as pointed out by Benjamin. > > The new text brings the bis document back closer to the original RFC, and > earlier versions of the bis draft. My perception is that most large scale > operational stakeholders both on CA and RP side expect behaviour as > outlined in -10: > https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-6486bis-10.txt > > Not everyone agrees fully, one author raised a concern: > https://mailarchive.ietf.org/arch/msg/sidrops/-fZC3suTFyGSe1tRhyFY5UOgAMw/ > > To which I responded as following: > https://mailarchive.ietf.org/arch/msg/sidrops/YhMOdHIW4ACR4wZVMvOMQW__Db4/ Thanks for the updates and explanation of the context. I just wanted to check: the -10 still contains in §4.4 this text: Note: Although it is RECOMMENDED that the thisUpdate and nextUpdate fields in the manifest match the corresponding fields in the CRL associated with the manifest, RPs SHOULD NOT reject a manifest if these fields do not match. Does that pose a potential for interop failure that we should be concerned about? Thanks, Ben From nobody Mon Mar 21 14:09:39 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E2BC3A1B2B; Mon, 21 Mar 2022 14:09:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.111 X-Spam-Level: X-Spam-Status: No, score=-2.111 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TQ4RDWh89RGz; Mon, 21 Mar 2022 14:09:13 -0700 (PDT) Received: from GCC02-BL0-obe.outbound.protection.outlook.com (mail-bl0gcc02on2072b.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d05::72b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86ADC3A0D98; Mon, 21 Mar 2022 14:09:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PZe3O3sVF5ygf96G+Jj7qSKgzENwU4OMqVIS0Q5ML/HZZY8wQDhPbtIryYNQpwh4G2svEXlFMQ56++Oy2fHtErPNNnfiuLrmgCol5xiDjuvBa4LGxZ4vghBx6rm0wtOv6Btuh6GjwTm7JoS0MCfsbutQT7caCaCIGQbpEHbm8XVNtfykkSmMRKQdbiAf1pmmcmW2NckqP3/r4pmPXaJ0ETo/HPvIB2CJ+9IEzVV8lCz2KxYzSNxjn80t2IAWChBlRaMyVhIYTaL65Ir5xeLfNRTNW8FQ6BcoZlF7l7h+MDcj9/K5fUmJ13FV1o3kdcSZ2vLVnDbRABcn9BteKhNDXA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=/xq0ka9heRdSwDNoYh6vQFQwuyTu+wOmE3gTb1t86AY=; b=Sp4iKJ+QKGQDXYufYEHQaMlZ4uYWTQN3JF9TS9IhnYoR3I5/wFkYrIPXVH11xeDjoLEWW2qzGVZ321pkIv5u5gRZo+mXIJki3oxfHHU6As0kokFtyQ8n0u5qXz7gxpTIufmgbrQrNLyoes9Cu8/1Vb/TC+K1HGtA9xJRuVqHjGUjRtWQlLTgVmhTUl2s2MYqiZFv6B7y+P+ldjsaoXEKSS2eiw6tcO7Gl5xK/V7GaGRGKBmQK0AGz+pev3gewMmvUGdEYGLKGp9JK95TEETqeKouSwljUAkwnlGb0zwl/OEKSgVOqMSS3IMHFgq/Cy9Ev6GMtAU9j5BbRKBs0+Og0g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/xq0ka9heRdSwDNoYh6vQFQwuyTu+wOmE3gTb1t86AY=; b=baC0kK4BIfgeOCqvAh6fKUj8+5DeTWHA05DH4nwPCTveTvk00PtwhoxEYZvNi6ceuzC3hn+iAmCoSJGVzVJ7klhhhU1milvyPrbFtqzcowh3YupWBYuwF0pgFD3/L/ivpZTOrvJrcapm8fWbOZ1Ihq/CGNaK4QxhkYT14CuOTT8= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by BY3PR09MB8034.namprd09.prod.outlook.com (2603:10b6:a03:353::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.14; Mon, 21 Mar 2022 21:09:07 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5081.023; Mon, 21 Mar 2022 21:09:07 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "Jakob Heitz (jheitz)" , Jeffrey Haas CC: "sidrops@ietf.org" , "grow@ietf.org" , Zhuangshunwan , Nick Hilliard Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULXMMKnMnklKEmxZqImduurxazKE6GAgAA0FfA= Date: Mon, 21 Mar 2022 21:09:06 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 382bb201-2167-4f68-05ff-08da0b7f0949 x-ms-traffictypediagnostic: BY3PR09MB8034:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: EEOER99ryqTVKn4MRdAcZWkDJKe1XRxA8dFgKYAfF28o17a/iAE7vNk3Q5GYjzj9h5mXd76S3eEY41MaKEvBxAfu61N2W/P9iZ82awVAtoBb4MYLAMfF+KGOQupc6FXDMeOEFwopln/e0kQmU/3TUuQx0llR90gKuhfjNnc7OEyfDMy8RL1962udVqD4zXebQe85vYNWdiwYJDAzl13hMXv3xhH+ctPj9fGOQno7sKP3erH2zvxrWrLAV42TAqtkNj2T7JGqwKHGYXzocIW6ECTaXIxBhLH529nbyck4y5E6sc0ParfejTdT31799Scg7re/1VRRgJbVURQ30Zk3X/x3XJ9ewsoiSS4SiqTtvDd+idBZgktH5mEfCq4Y9BXkavDp6n/lcm2/b0/Co3FTcnjTrjzbULI5QVfsNP/2C9vRgqWnbeEUJKasvOKX/9p8EzluTuWFVNQ4xT7nxSfZR0I7T/s3XMyUvD6d6bxeUJYAhribe8rmVy8Eoe4WSd1DgNuPCxMwad5v+KcZNRxyq8/A+srxx4kruQWaNHWl7ah1b1BIq+v1bklNoFYgeScFHOfl35JOX2SBKafleApjR+0JmCpjTO6JCBB2LcsOLIFgStehijxOGzMZImw5X9jebW0d9/9iuhRX200sSwBzAO0RJRvWqcBWmHKPLk3+kd57aSGCOX69GGhLBJfabSCjHtofWEHIzUTQf/jRPtMZnL8EIkgE6JaIwSPUoNqzChdReifYxGu8A91fm801QuJMTsMoHxwXOwX5tA0wRb3NlHHJCx8H54vXLl6Mc2IGB58= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(9686003)(7696005)(86362001)(6506007)(2906002)(54906003)(966005)(38100700002)(316002)(110136005)(122000001)(5660300002)(38070700005)(8936002)(52536014)(82960400001)(508600001)(64756008)(66446008)(4326008)(8676002)(26005)(186003)(66476007)(76116006)(33656002)(66556008)(55016003)(83380400001)(66946007)(71200400001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?OsG/GENYfFjYQxFKSpNsBEoQ7QZf//pdbVfh3RYxKgfi5wZ6vS3srkW57Vsg?= =?us-ascii?Q?pmFMIB/uraK0D+w1QGc91Qzs2PY4d5jOl4FUlA6Goa7doLx3cXOFtiFmC6tu?= =?us-ascii?Q?ws+zXJdsSubOG6HSkp67lCeKU+9sLkVliLIzcJnHiFbJvUxcW8xyv6i8+nLj?= =?us-ascii?Q?jw1RhtkHiv+EcalOj0SXRkLhpaZ9QPwHjoOoZj3k5N2R8riG1TXkTuAnV4i0?= =?us-ascii?Q?HWhV2rKHjSv6SeV4anVj5ZCeQKw5AoRtqRi68P/LzpfWDvL4Ctvupv6u89oV?= =?us-ascii?Q?hK9MjXy/fD2fMf1ZSfVZ8vVAOJe/fMmHqMaUNIxbl8B2AKkiXfdZ7lwKgkNl?= =?us-ascii?Q?47ibwZ9Dy+/SpHutbKkxHtWtc2l98Pmo2R2gDFvrUDveKHtGP+DQMk70ncWp?= =?us-ascii?Q?QfIL7wGCLr6bHG5dHwbmatJj1BVvjQ8YnAvQfYHT2HLn5RTL4GOiI6nfjsA7?= =?us-ascii?Q?rYGoNThZh9KPrcj3qdUeu5FQrzH5QZ6GRfLUh8TLHNpNCX7d+8tvIDZZbhYD?= =?us-ascii?Q?n4PM8m0JI713Ym7jvNzSEmbfcFl2M1dItuY+U21UIDu2YXgYl3M9Lyaa8J65?= =?us-ascii?Q?YTaVfV9uKoOIZWqNZB/XlpMyq65TsNjBeKpuKkutA+xZc0qO7Sy8sspKE/8j?= =?us-ascii?Q?KM225iNKXJLMoFaQMVDG8+zzIsahTndWxQ4pTM63RT+eGzNWfND0qDiyQdLK?= =?us-ascii?Q?oM7bajn6u5EOPJwnkAuQanQPRdk3yDj1lV3A03imdKWZOc5+h7H8Qkxxosrv?= =?us-ascii?Q?oCeLqUqzQ9iBwIcmp82ueVgo11ef6uOu2kc6O7Ve8kxWRQHqzv70+Tq+kKUo?= =?us-ascii?Q?wu4FkbjuNMPhRDL8c//EC/UyAc1g9g//rf0kW8IDMWf805Aac0Ew+o2NyFLA?= =?us-ascii?Q?WRFfbeylaIfN3ecW273OAhITlm4dQ+7aLTnibG7ivG2FY7dEBY6mCOlCYi3L?= =?us-ascii?Q?WNedWffZecO2t/znSaS7NvhYOjiJxhmj6YbINuKY3+iPPlg6phIfq+jDryUC?= =?us-ascii?Q?lgrATmIpjT+2dVr5ctwOhUqgh07rwGDvXhKOEqarzons9B81G7kswiFrNubS?= =?us-ascii?Q?78AUbdlQNKGvZ/YH7T91NzCmpeqtRlb+wQ9RsmaVkwrMc8yx8XqXK4NlTWEn?= =?us-ascii?Q?nms7EUHkvJ0yIiR/Ct67779twlRFYs5WvmsPwuNpj8cvF1hHFc7dOppFMjJs?= =?us-ascii?Q?nfhOt4SVzXLVI04UVHN+CvXHYSUggLJkseVfurV0ZJF/7C4QqQUQ27jsVxjQ?= =?us-ascii?Q?XQL5b/hSsW1Frs7egkm6YJ1lpEtDRJe1M9xNFiyMX1xW6dQgxFMb9nJl7jt1?= =?us-ascii?Q?s0I56RvjfeaisZJL+q79OViKOv59Ow4UL5LqiSqYqoP/FusOIv/6FXG/g4IB?= =?us-ascii?Q?RdRymzAGtCJoU9f36N4cZ8yfZLW0D9cUUz7YKyOlwdUStvmNhKb6tnncavcV?= =?us-ascii?Q?R6r/CUaOZ0E=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 382bb201-2167-4f68-05ff-08da0b7f0949 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Mar 2022 21:09:06.9629 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY3PR09MB8034 Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2022 21:09:19 -0000 Hi Jakob, >To be clear, I'm talking about BGP devices that do not insert their ASN in= to the AS path. Even if you assume that all route servers are transparent, what would you l= ike to propose to solve the following problem?=20 AS1 (RS Client) -----> AS2 (RS) -----> AS3 (RS Client) ---p2p (lateral pee= r) ---> AS4 (validating AS) The arrows indicate the direction of the flow of the Update. Let us say tha= t the RS is transparent. AS4 is the receiving/validating AS. The AS path is {AS3 AS1}. Do you agree = this is a route leak as seen at AS4? The question is how will AS4 detect it= ? What ASPAs should be in place? Suppose the RS-clients (i.e., AS1 and AS3) have ASPAs each attesting the RS= 's AS (i.e., AS2) as a provider. That is all that it takes for AS4 to be ab= le to detect the leak. Is there another way? Do we assume that AS1 and AS3 have some other ISP pro= vider(s) for which they have ASPA attestation?=20 In this solution, AS4 does not have to know anything about the presence of = an RS, etc.=20 This solution works fine even if the RS happens to be non-transparent. In an earlier related thread, https://mailarchive.ietf.org/arch/browse/sidrops/?gbt=3D1&index=3DI2a05YrOE= YrRRdEg1ZHOOln6BCw Nick Hillard and Rob Mosher left the door slightly open for a possibility t= hat there might be a rare RS out there that is non-transparent. Sriram From nobody Mon Mar 21 22:32:17 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3EB13A07D9; Mon, 21 Mar 2022 22:31:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.906 X-Spam-Level: X-Spam-Status: No, score=-1.906 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pJIUvzRHraNN; Mon, 21 Mar 2022 22:31:33 -0700 (PDT) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 730FD3A07D7; Mon, 21 Mar 2022 22:31:33 -0700 (PDT) Received: from fraeml734-chm.china.huawei.com (unknown [172.18.147.200]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4KN0SK5PdHz67bZ4; Tue, 22 Mar 2022 13:30:25 +0800 (CST) Received: from kwepeml100005.china.huawei.com (7.221.188.221) by fraeml734-chm.china.huawei.com (10.206.15.215) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 22 Mar 2022 06:31:28 +0100 Received: from kwepeml500004.china.huawei.com (7.221.188.141) by kwepeml100005.china.huawei.com (7.221.188.221) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.21; Tue, 22 Mar 2022 13:31:26 +0800 Received: from kwepeml500004.china.huawei.com ([7.221.188.141]) by kwepeml500004.china.huawei.com ([7.221.188.141]) with mapi id 15.01.2308.021; Tue, 22 Mar 2022 13:31:26 +0800 From: Zhuangshunwan To: "Sriram, Kotikalapudi (Fed)" , "Jakob Heitz (jheitz)" , Jeffrey Haas CC: "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPUcq6Q0d8qhJzU2X5AsQ917b66zJzyEAgAENQ2A= Date: Tue, 22 Mar 2022 05:31:26 +0000 Message-ID: <473f0482508e4b2e86e76986c74828f9@huawei.com> References: In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.108.152.178] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Mar 2022 05:31:40 -0000 Hi Sriram and all, IMO, for the scenario described in the following email (AS4 and AS3 are P2P= connection; AS3 and AS1 are connected via a RS and being treated as a P2P = connection ), it can be determined that AS-PATH: AS4 AS3 AS1 is a route lea= k if one of the following conditions is met: 1. If AS1 is a Tier 1 ISP; 2. AS3 is not included in the set of C2P AS numbers set registered by AS1; 3. Determine that AS1 and AS3 are P2P relationships (one of the ways is to = obtain them is: a) Create a P2P relationships database; b) lookup in the P2= P relationships database); 4. AS4 detects that AS3 and AS1 are interconnected through IXP (for example= , Traceroute), which is equivalent to a specific way of obtaining the P2P r= elationship between AS1 and AS3 in branch 3. 5. Make sure that AS3 is not the Customer of AS1 (it may be P2P, that is, b= ranch 3;(or) it may be P2C). Thanks, Shunwan > -----Original Message----- > From: Sriram, Kotikalapudi (Fed) [mailto:kotikalapudi.sriram@nist.gov] > Sent: Tuesday, March 22, 2022 5:09 AM > To: Jakob Heitz (jheitz) ; Jeffrey Haas > Cc: sidrops@ietf.org; grow@ietf.org; Zhuangshunwan > ; Nick Hilliard > Subject: RE: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route > Server question) >=20 > Hi Jakob, >=20 > >To be clear, I'm talking about BGP devices that do not insert their ASN = into > the AS path. >=20 > Even if you assume that all route servers are transparent, what would you > like to propose to solve the following problem? >=20 > AS1 (RS Client) -----> AS2 (RS) -----> AS3 (RS Client) ---p2p (lateral p= eer) ---> > AS4 (validating AS) >=20 > The arrows indicate the direction of the flow of the Update. Let us say t= hat > the RS is transparent. >=20 > AS4 is the receiving/validating AS. The AS path is {AS3 AS1}. Do you agre= e > this is a route leak as seen at AS4? The question is how will AS4 detect = it? > What ASPAs should be in place? >=20 > Suppose the RS-clients (i.e., AS1 and AS3) have ASPAs each attesting the = RS's > AS (i.e., AS2) as a provider. That is all that it takes for AS4 to be abl= e to detect > the leak. >=20 > Is there another way? Do we assume that AS1 and AS3 have some other ISP > provider(s) for which they have ASPA attestation? >=20 > In this solution, AS4 does not have to know anything about the presence o= f > an RS, etc. >=20 > This solution works fine even if the RS happens to be non-transparent. >=20 > In an earlier related thread, >=20 > https://mailarchive.ietf.org/arch/browse/sidrops/?gbt=3D1&index=3DI2a05Yr= OEY > rRRdEg1ZHOOln6BCw >=20 > Nick Hillard and Rob Mosher left the door slightly open for a possibility= that > there might be a rare RS out there that is non-transparent. >=20 > Sriram From nobody Tue Mar 22 00:21:07 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A1D23A0B57; Tue, 22 Mar 2022 00:20:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.605 X-Spam-Level: X-Spam-Status: No, score=-9.605 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=IhBwonXJ; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=f19fFtM1 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p1DIqFooFWym; Tue, 22 Mar 2022 00:20:10 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D2283A0B47; Tue, 22 Mar 2022 00:20:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4340; q=dns/txt; s=iport; t=1647933610; x=1649143210; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=7rlIbabTv47BEAyQzAlns64cqlSwI+nSLp72nQjaf4Q=; b=IhBwonXJ0bpFcrCiyhtda505MkYP8+wQnW9b1UJo2dRlPO7y1CYz7kob NWyDzkj0SHpdLb2C98aLkONwbFHFg9+OoGSHnXc1fyu1fyAfG9a8nzhh0 vIBeGce3jdbGSQ8L5/gRus160NUitOCTN9iU34eDALIUc1TP0ju6hj7+w o=; IronPort-PHdr: =?us-ascii?q?A9a23=3ApkIRohzpD9Jm41TXCzPZngc9DxPP8534PQ8Qv?= =?us-ascii?q?5wgjb8GMqGu5I/rM0GX4/JxxETIUoPW57Mh6aLWvqnsVHZG7cOHt3YPI5BJX?= =?us-ascii?q?gUO3MMRmQFoCcWZCEr9efjtaSFyHMlLWFJ/uX+hNk0AE8flbFqUqXq3vlYv?= IronPort-Data: =?us-ascii?q?A9a23=3AOJbGHKNW3AHbSN7vrR0hlcFynXyQoLVcMsEvi?= =?us-ascii?q?/4bfWQNrUp00zBTz2EbUW+Ba/3cZGXzLtEjbtyy8E0OuJ7RnYRrT3M5pCpnJ?= =?us-ascii?q?55oRWUpJjg4wn8dtEp+F+WbJK5cx5hYO4GowPwcFCeG/E/2aOK59xGQ6InRL?= =?us-ascii?q?lbCIL+cUsxObVcMpBcJ0XqPqsZh6mJaqYHR7zCl4bsel/bi1GqNgFaYBI67B?= =?us-ascii?q?5Wr83uDtNyq0N8RU8dXifpj5DcynFFNZH4TyD3YEpf2fmVUNrbSq+fr1rq1+?= =?us-ascii?q?CbS+A0gT4r81L36aUYNBLXVOGBiiFIPBPPk2UcE93d0i/pkXBYfQR8/ZzGhn?= =?us-ascii?q?dB8yclfnZexUgwueKbLnYzxVjEJSnEnZ/YcouevzX+X9Jb7I1f9W2ns3vxoA?= =?us-ascii?q?1o2IIsH8+BfAXxH6vEZbjsKa3irgeO9w5q1Te5mj95lK9PkVKsQoHZ/5TDUE?= =?us-ascii?q?fhgRorMK43R5NNC2y8rrsFDAfiYYNAWARJtbB3JeDVXNE0cTpUkk4+AhX7jc?= =?us-ascii?q?j5RrFuNuKY2pXPJzRZ41ZDrMcHJPNONW61ocuywzo7d137yDhdfP9uFxH/cq?= =?us-ascii?q?zSnh/TEmmXwX4d6KVFxzdYy6HX7+4DZIE1+uYOHnMSE?= IronPort-HdrOrdr: =?us-ascii?q?A9a23=3A1vouLqAJOghIxEflHegGsceALOsnbusQ8z?= =?us-ascii?q?AXPh9KJyC9I/b2qynxppgmPEfP+UossHFJo6HlBEDyewKiyXcT2/hfAV7CZn?= =?us-ascii?q?irhILMFuBfBOTZskXd8kHFh4xgPOJbAtVD4b7LfBZHZKTBkXKF+r8bqbHtms?= =?us-ascii?q?3J9ITjJjVWPHtXgspbnmBE43OgYzRLrX59dPwE/fSnl696jgvlXU5SQtWwB3?= =?us-ascii?q?EDUeSGjcbMjojabRkPAANiwBWSjBuzgYSKUiSw71M7aXdi0L0i+W/Kn0jS/a?= =?us-ascii?q?O4qcy2zRfayiv684lWot380dFObfb8yvT9aw+cyTpAVr4RHoFqjwpF5N1HL2?= =?us-ascii?q?xa1+Ukli1QffibLUmhOF1d7yGdgjUImwxelUMKgWXo8EcL5/aJHA7Tz6F69N?= =?us-ascii?q?hkmtyz0Tt6gDg06tM640uJ85VQFh/OhyL7+pzBUAxrjFO9pT44nfcUlGE3a/?= =?us-ascii?q?pUVFZ9l/1XwKpuKuZJIMs60vFSLMB+SMXHoPpGe1KTaH7U+mFp3dy3R3w2Wh?= =?us-ascii?q?OLWFILtMCZ2yVf2CkR9TpU+OUP2nMbsJ4tQZhN4OrJdqxuibFVV8cTKaZwHv?= =?us-ascii?q?0IT8e7AnHEBRjMLGWRK1L6E7xvAQOGl7fnpLEuoO26cp0By5U/3JzHTVNDrG?= =?us-ascii?q?Y3P1njDMWftac7hCwlgF/NKggF5vsulaSR4IeMN4YDGRfzPWwTrw=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B1AABkeDli/5NdJa1aHAEBAQEBAQc?= =?us-ascii?q?BARIBAQQEAQFAgUcGAQELAYFRVgd3WjdEhFSDSgOFOYUQgwIDmzWBLhSBEQN?= =?us-ascii?q?UCwEBAQ0BATcKBAEBhQcCF4QmAiU1CA4BAgQBAQESAQEFAQEBAgEHBIEJE4U?= =?us-ascii?q?7CCUNhkIBAQEBAgESEQQNDAEBMAcBBAcEAgEIEQQBAQECAiMDAgICMBQBCAg?= =?us-ascii?q?CBA4FGweCYgGCZQMNIQEOn28BgToCgQ6JEXp/MoEBgggBAQYEBIULGII3Awa?= =?us-ascii?q?BECwBgxCEJocSJxyBSUSBFScMEIJnPoJjAgIYgREBEgEJgzI3gi6XNYEhe4E?= =?us-ascii?q?RBy0ZC2iVP0apH4EuCoNJiw+UZAUug3SkSpZbgkmKTJlEAgQCBAUCDgEBBoF?= =?us-ascii?q?jAjhGI3BwFWUBgj5RGQ+DKYp3g3KFFIVKdTgCBgEKAQEDCY4MLYIZAQE?= X-IronPort-AV: E=Sophos;i="5.90,201,1643673600"; d="scan'208";a="918123220" Received: from rcdn-core-11.cisco.com ([173.37.93.147]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 22 Mar 2022 07:20:08 +0000 Received: from mail.cisco.com (xfe-rcd-002.cisco.com [173.37.227.250]) by rcdn-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id 22M7K7tQ010828 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Tue, 22 Mar 2022 07:20:08 GMT Received: from xfe-rtp-003.cisco.com (64.101.210.233) by xfe-rcd-002.cisco.com (173.37.227.250) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14; Tue, 22 Mar 2022 02:20:07 -0500 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (64.101.32.56) by xfe-rtp-003.cisco.com (64.101.210.233) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14 via Frontend Transport; Tue, 22 Mar 2022 03:20:06 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Tet/dFKSApmtg6gh9pcJo/0GXZYmoJ6AkIQT+PWlXuO6nPxvTY8doLrCsFMtJ85uJb5o7pteKgWdOkOinYRNrQG0+poqy48h0M/bwBFx6CZ9icUw+3ZVlQAZPWGmD1XCzrlaAiPRGSgDeE71sWFyKDWfm8QqO/iMUkJ4eB/dyUAWA3XAx3kg8xrLl0ZGjKb7DUAjKg5DJ2Q0uqqmHx0hlQZ3NB4rGM2bd3gBw2TpZotjvL6tVtL62cEQ0ydbqn6i65G4A0Tltgce9584sq0sdsxh6A+L3fwszgnMmlH6ng8QQwlVOPsQCe9UqYKImfEwWg0SXz1CaNoozuiN7Kr3EQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=7rlIbabTv47BEAyQzAlns64cqlSwI+nSLp72nQjaf4Q=; b=ZG05RLG7nrKspJxW2jILdaZ87clUDueXAYMMsXSNIG7pbYe/nSqBbXm/CiUc7GqC3wdIgfDfdJxRcWsAlyenfDh7v99bHaacv/EAD6sRPUztzpD8vbA+5EGq69J6rBJ7Jaft21xgAxYsjy+ws8/hljslFJIBm1Wbnga9Uk+dojq3QqqUaYb9BDBK252F3HFQu+jE7TuKr7kneiUn4MhCpagwBzmKclq1v9lTT2a/wYCX7Gvnpc1IhVLZP2PbKgqVGfRTfrTDOryi08nsUikc1p7QGIApTcQE4YRmuivYokfpyMezia9Kr6xYBiLdxHFlkvvZtXRq7wNVPqhI5vzhmg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7rlIbabTv47BEAyQzAlns64cqlSwI+nSLp72nQjaf4Q=; b=f19fFtM1GFep/C81PeMQPq0gyBi+7VBX4SeXWKRD9VSAfgh8tHQMKDr3ghfgiiVOEV1H6c0j7aMkXHs9iWBzIgUQv6Vi6uLsz3MMArSonth/gWoPZ3HTCgI70fmvuvC1f5eajeIt2j0VNMfJzusr37A5P/c4D38hYB38nNPHF/s= Received: from BYAPR11MB3207.namprd11.prod.outlook.com (2603:10b6:a03:7c::14) by CY4PR1101MB2101.namprd11.prod.outlook.com (2603:10b6:910:24::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5061.26; Tue, 22 Mar 2022 07:20:05 +0000 Received: from BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167]) by BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167%7]) with mapi id 15.20.5081.023; Tue, 22 Mar 2022 07:20:05 +0000 From: "Jakob Heitz (jheitz)" To: Zhuangshunwan CC: "Sriram, Kotikalapudi (Fed)" , Jeffrey Haas , "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULHMv5fXHQ9ykCZDKiXb5OfaqzKEtuQgABCawCAAIxaAIAAHlua Date: Tue, 22 Mar 2022 07:20:05 +0000 Message-ID: <384BFD6B-1477-469E-A255-B822F8B0CB05@cisco.com> References: <473f0482508e4b2e86e76986c74828f9@huawei.com> In-Reply-To: <473f0482508e4b2e86e76986c74828f9@huawei.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cisco.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 81293d9e-4795-40d3-9544-08da0bd46338 x-ms-traffictypediagnostic: CY4PR1101MB2101:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: NZsEGOzH5O7owyvFx1lCBD567DYVaHp3orWIA+YE4Bdwv14FdsQ2oyRn6GbH9bSaU97o8IpSxJbg2jNwSN68obN3nanQ9G8VdKCUyxBGcXOCUlx43oGvBLY9B2M8carGPJUZ69LKUDyZFEEKkG9gNVMLAWnFbmdSiP3p2bhjjiOzJzupVAKztZ210KELoHejczRxYV2mJE8w21qK1/498TuK7HBj81MjDjaAm7V7mP8kD2eEkZbxH4arIlTvPZWzRZtspLB3ZhNY6GgeanujbTnG4EtiJey5qTLzbzJCcDM4OBVyfA+VR8Wyxoo2C1om/+FdJBZNuvUpsXZiPTq9rhwKZx8L8PleBXHdmU2UTICP93iFm0WfX6BaE7qylu8E8M+Oo0tWtc4Mu7O3tYKGr2zvMDIJVDb3EvurFfASToDCP98/4lXxrDiVKhGTYxL6xtNby048agfJ0IAGa7mTcc19PR7ieWXxkvCETpv2e8kH0pDJ0Q/jELWcDIJ29R6DvjJDPNaLZpXzIr5mdee0iRJ8wMmloacvhOCO84PjveKGv67T4zW8QCvhT5x3/dlqclXWsPXa+/7Y6jfZREaO/fu88bNJ6JeU7znw6b8HG8OXJyILD5C+F2fyihw7Ku3xx0TRKJL18O3GRlP4Hcl111pYEMMk4pynIPTfWKio091vv+O3XK14zob4a+Va49QDfa/6U1MJvUuBHd6t/vJAUftyeAYrb3mRZec9vavpcw1pQzjIowH+kxjqEu9zICCHWrPgTcDqpFanPWySZUDlm4u30BgcBBmKimoDjNgYtA+UUmu0JvLh6by1FZKiVtxb x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3207.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(366004)(54906003)(316002)(6916009)(33656002)(966005)(36756003)(76116006)(508600001)(66946007)(38070700005)(71200400001)(66476007)(6486002)(5660300002)(2906002)(8936002)(66556008)(38100700002)(4326008)(64756008)(8676002)(66446008)(86362001)(6506007)(6512007)(2616005)(83380400001)(186003)(122000001)(53546011)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?dVBRV2w3OThTWStPZ2JHSFdXRWVzYXFXdFY1Y3h4c1Yzd2xrWHAxSUdVUW9h?= =?utf-8?B?UWRyQ0RuYVV5Z1hiSVdKdGRhVG9hS2pvMjNRNTlpbXJRU0QrTEx4Q1UxMHFB?= =?utf-8?B?OG83Uzl1ZlBjVVZ1YytVU0RUYUIxdm9LQUpjZjNhUTZ0cG95TStCM05KVk9H?= =?utf-8?B?WlNMQ0VNbDdGSjQxYkp4NzlQK0N6WERXVnNtRjVybytYRG55VDFSRmpkbGR2?= =?utf-8?B?RkJTaWV2WWFvODNNY2lYNTRHai84WlNieGZ4UFhtb2oxN1Azb0RWclpZdS9Y?= =?utf-8?B?UGZHRzJ2YmF2Q0FnQXJGZ1N1MFgwTzBNTXNnWVlJVW1pbk1JZTVHdlZPakwr?= =?utf-8?B?aE5sdWVjRTJJWlEyakhoTjVtQTZLUVZxWlAzaFdlbmtUVUl3aWdtc0FuUTgw?= =?utf-8?B?aSs3cVJoSC9xQStQbVdBVXN2SkpKQTQ1bXhlOXpLbVdySnplc2pnL29odm5C?= =?utf-8?B?cENvVXhpTTFiTllzOXlHZm9zdDRNMlNBOGJMckZtcDlndHR3THZIV1gzRWJz?= =?utf-8?B?cm5aWUU5eXpXZ25KeVdKRUlJZHhBWGM5RGRweUpLOTRvSE1lazZxbGdNbkpz?= =?utf-8?B?WGJYc2t2RjNSbExzbVJCVVVEeGZYM3I3ak93SWFpZVNSY3hTd1JPbGplbXpy?= =?utf-8?B?OXBPOGgrTFN0b0kwWkNXQ0pNYkROOFY4RUFMZTBXTG9kMlRYb3QrYmN1ZmZF?= =?utf-8?B?S3laL2FMZ2t5RFRSZ3l1ajBNdnRkSkMvN3ZlZkFiZG5HM3F2YVJ1ZkRYdHU1?= =?utf-8?B?R0NSNGFIVXRyRy9ja1NsYUpCeUM1dFlkSHlhTWNZa0hYajhSODRuYXNrOTF6?= =?utf-8?B?czd6SWRuNmJFT1VNZjl2TjBuMWNQVEFrcVh1QXI3SjA2RDVqOGF2dzhKUlli?= =?utf-8?B?em9mb1F0enhPNCtLaTF2SDlUUXFidzhIQ3YvZlhkVnlONHFOWmo0aFJ2RDd2?= =?utf-8?B?RkZxbDhwOENtaHRMSUxjaGovbnY0RkRHWlNLclJYOUc5SGhSSFMwQ01MSjZu?= =?utf-8?B?SStiTk1IV25yVFM5bWpVLzdQS01iREo1S216OSszOGFxdXp2dnBJdUIwN3Nv?= =?utf-8?B?NnJnWEJwZ3FjREZNMmZNQ2txdXlXbFlKUGNvZFU5WmN6allGcXRHSmM4bjZa?= =?utf-8?B?cUUrR1MreW8ySGo3SFdleHpOTkU1eUI2MTd4R29zZlNMOUwrSDZsNDZ0TnNU?= =?utf-8?B?a2dOdjh6dGZYbGd4UzIvYS9VYldSd1MrM0g2NVFWMGhaZk4yQXJGOXVSM2da?= =?utf-8?B?T1FVRG5zZmJyT3gwMU9NMTl2SDFDc1RxSXo2NGx6WDgxUXluR0I0MjdkOTM0?= =?utf-8?B?ck90WTlhYjhTa0FuZEMxa1U3cXZCbFBma0ZjMXZIOGV0SWFHY1hQcnh6SW42?= =?utf-8?B?K3pQZUdPZTdBVGRuc09Oczg4MmxzQXozUDNKWXpzNTJYNERhZlFsbmxNTmJl?= =?utf-8?B?L0VCd0FKdFVrbXNnRVlDWXpQVXBkSEVjUXhnOHlGeGlRZFR5dEd3Y2JHZnN2?= =?utf-8?B?Qyt5T3k1cytXY3lJYjhXZmFQV0M5OWp3TkRoTUI2Y01iaENjM1FlYWdKenAy?= =?utf-8?B?bXlVdndnWVY0NzdmSkI3M2FjcXA1NHZNVkhWSDZEamxLS00zV1M4VjRqWWpp?= =?utf-8?B?ZnZtUGZZR2RPTDd2NDFVMGV5dWxEVC94Y2FiVkVsd3owOCtDMGRxSC9Fek9j?= =?utf-8?B?RkQ4NExsL0ZNMy8yZDdGTDdrN0s1cXZiWVk0YmlmdG1hSVNTd3RTcXgxdjlK?= =?utf-8?B?NEhaWHdPQXZyM2pHcVRlZUR5LzhRQjdFOVdPQjl4SkdISkZBOHV3bURUWmlI?= =?utf-8?B?M0lCUzhpTGErWU4wSUhUTXNQWUNQZmNyRk8xWGs0MXdXR1VrY1NoNmtqTDBM?= =?utf-8?B?VmFsalBwakVpbTRSN3lUV3NaY0N5dkpkNTUrU2RtekJqTnlsd3JlTmV1Y0tZ?= =?utf-8?B?Y2lBTjBvWHVXWkVHRDhpeG1WRHVqTWhsQm1jbXpXQXpDUEZRYTB5a0lUeXJa?= =?utf-8?B?RWM0UmVYNEJQTWNMblFXc2lZYnNqVWNCMU1Jc0V5VVlHUHhJUGkySGdmTndC?= =?utf-8?Q?+dDpWS?= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR11MB3207.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 81293d9e-4795-40d3-9544-08da0bd46338 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Mar 2022 07:20:05.0409 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: eNGMbitYkUGiMqpnw57FEYcdrVxJ8UWAOB0y5FaC+nhxHcaGYXXcC4VWTu7vQpXvXVhzleS2JKueDNI+KdojHA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1101MB2101 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.227.250, xfe-rcd-002.cisco.com X-Outbound-Node: rcdn-core-11.cisco.com Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Mar 2022 07:20:17 -0000 VGhlIEFTLXBhdGggYXQgQVM0IGlzICg0IDMgMSkuDQpJZiB5b3UgYXNzdW1lIHRoYXQgQVMxIGFu ZCBBUzMgYXJlIGJpbGF0ZXJhbCBwZWVycywgdGhlbiBib3RoIHNpZGVzIG9mIEFTMyBkZWNsYXJl IEFTMyBub3QgdG8gYmUgaXRzIHByb3ZpZGVyLiBBUzMgaGFzIGJvdGggc2lkZXMgbm9uLWN1c3Rv bWVyLiBUaGF0J3MgYSBsZWFrLg0KDQpSZWdhcmRzLA0KSmFrb2IuDQoNCg0KPiBPbiBNYXIgMjEs IDIwMjIsIGF0IDEwOjMxIFBNLCBaaHVhbmdzaHVud2FuIDx6aHVhbmdzaHVud2FuQGh1YXdlaS5j b20+IHdyb3RlOg0KPiANCj4g77u/SGkgU3JpcmFtIGFuZCBhbGwsDQo+IA0KPiBJTU8sIGZvciB0 aGUgc2NlbmFyaW8gZGVzY3JpYmVkIGluIHRoZSBmb2xsb3dpbmcgZW1haWwgKEFTNCBhbmQgQVMz IGFyZSBQMlAgY29ubmVjdGlvbjsgQVMzIGFuZCBBUzEgYXJlIGNvbm5lY3RlZCB2aWEgYSBSUyBh bmQgYmVpbmcgdHJlYXRlZCBhcyBhIFAyUCBjb25uZWN0aW9uICksIGl0IGNhbiBiZSBkZXRlcm1p bmVkIHRoYXQgQVMtUEFUSDogQVM0IEFTMyBBUzEgaXMgYSByb3V0ZSBsZWFrIGlmIG9uZSBvZiB0 aGUgZm9sbG93aW5nIGNvbmRpdGlvbnMgaXMgbWV0Og0KPiAxLiBJZiBBUzEgaXMgYSBUaWVyIDEg SVNQOw0KPiAyLiBBUzMgaXMgbm90IGluY2x1ZGVkIGluIHRoZSBzZXQgb2YgQzJQIEFTIG51bWJl cnMgc2V0IHJlZ2lzdGVyZWQgYnkgQVMxOw0KPiAzLiBEZXRlcm1pbmUgdGhhdCBBUzEgYW5kIEFT MyBhcmUgUDJQIHJlbGF0aW9uc2hpcHMgKG9uZSBvZiB0aGUgd2F5cyBpcyB0byBvYnRhaW4gdGhl bSBpczogYSkgQ3JlYXRlIGEgUDJQIHJlbGF0aW9uc2hpcHMgZGF0YWJhc2U7IGIpIGxvb2t1cCBp biB0aGUgUDJQIHJlbGF0aW9uc2hpcHMgZGF0YWJhc2UpOw0KPiA0LiBBUzQgZGV0ZWN0cyB0aGF0 IEFTMyBhbmQgQVMxIGFyZSBpbnRlcmNvbm5lY3RlZCB0aHJvdWdoIElYUCAoZm9yIGV4YW1wbGUs IFRyYWNlcm91dGUpLCB3aGljaCBpcyBlcXVpdmFsZW50IHRvIGEgc3BlY2lmaWMgd2F5IG9mIG9i dGFpbmluZyB0aGUgUDJQIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIEFTMSBhbmQgQVMzIGluIGJyYW5j aCAzLg0KPiA1LiBNYWtlIHN1cmUgdGhhdCBBUzMgaXMgbm90IHRoZSBDdXN0b21lciBvZiBBUzEg KGl0IG1heSBiZSBQMlAsIHRoYXQgaXMsIGJyYW5jaCAzOyhvcikgaXQgbWF5IGJlIFAyQykuDQo+ IA0KPiBUaGFua3MsDQo+IFNodW53YW4NCj4gDQo+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0t LQ0KPj4gRnJvbTogU3JpcmFtLCBLb3Rpa2FsYXB1ZGkgKEZlZCkgW21haWx0bzprb3Rpa2FsYXB1 ZGkuc3JpcmFtQG5pc3QuZ292XQ0KPj4gU2VudDogVHVlc2RheSwgTWFyY2ggMjIsIDIwMjIgNTow OSBBTQ0KPj4gVG86IEpha29iIEhlaXR6IChqaGVpdHopIDxqaGVpdHpAY2lzY28uY29tPjsgSmVm ZnJleSBIYWFzIDxqaGFhc0BwZnJjLm9yZz4NCj4+IENjOiBzaWRyb3BzQGlldGYub3JnOyBncm93 QGlldGYub3JnOyBaaHVhbmdzaHVud2FuDQo+PiA8emh1YW5nc2h1bndhbkBodWF3ZWkuY29tPjsg TmljayBIaWxsaWFyZCA8bmlja0Bmb29iYXIub3JnPg0KPj4gU3ViamVjdDogUkU6IFtHUk9XXSBb U2lkcm9wc10gQVNQQSBhbmQgUm91dGUgU2VydmVyICh3YXMgUkU6IElYUCBSb3V0ZQ0KPj4gU2Vy dmVyIHF1ZXN0aW9uKQ0KPj4gDQo+PiBIaSBKYWtvYiwNCj4+IA0KPj4+IFRvIGJlIGNsZWFyLCBJ J20gdGFsa2luZyBhYm91dCBCR1AgZGV2aWNlcyB0aGF0IGRvIG5vdCBpbnNlcnQgdGhlaXIgQVNO IGludG8NCj4+IHRoZSBBUyBwYXRoLg0KPj4gDQo+PiBFdmVuIGlmIHlvdSBhc3N1bWUgdGhhdCBh bGwgcm91dGUgc2VydmVycyBhcmUgdHJhbnNwYXJlbnQsIHdoYXQgd291bGQgeW91DQo+PiBsaWtl IHRvIHByb3Bvc2UgdG8gc29sdmUgdGhlIGZvbGxvd2luZyBwcm9ibGVtPw0KPj4gDQo+PiBBUzEg KFJTIENsaWVudCkgLS0tLS0+IEFTMiAoUlMpIC0tLS0tPiAgQVMzIChSUyBDbGllbnQpIC0tLXAy cCAobGF0ZXJhbCBwZWVyKSAtLS0+DQo+PiBBUzQgKHZhbGlkYXRpbmcgQVMpDQo+PiANCj4+IFRo ZSBhcnJvd3MgaW5kaWNhdGUgdGhlIGRpcmVjdGlvbiBvZiB0aGUgZmxvdyBvZiB0aGUgVXBkYXRl LiBMZXQgdXMgc2F5IHRoYXQNCj4+IHRoZSBSUyBpcyB0cmFuc3BhcmVudC4NCj4+IA0KPj4gQVM0 IGlzIHRoZSByZWNlaXZpbmcvdmFsaWRhdGluZyBBUy4gVGhlIEFTIHBhdGggaXMge0FTMyBBUzF9 LiBEbyB5b3UgYWdyZWUNCj4+IHRoaXMgaXMgYSByb3V0ZSBsZWFrIGFzIHNlZW4gYXQgQVM0PyBU aGUgcXVlc3Rpb24gaXMgaG93IHdpbGwgQVM0IGRldGVjdCBpdD8NCj4+IFdoYXQgQVNQQXMgc2hv dWxkIGJlIGluIHBsYWNlPw0KPj4gDQo+PiBTdXBwb3NlIHRoZSBSUy1jbGllbnRzIChpLmUuLCBB UzEgYW5kIEFTMykgaGF2ZSBBU1BBcyBlYWNoIGF0dGVzdGluZyB0aGUgUlMncw0KPj4gQVMgKGku ZS4sIEFTMikgYXMgYSBwcm92aWRlci4gVGhhdCBpcyBhbGwgdGhhdCBpdCB0YWtlcyBmb3IgQVM0 IHRvIGJlIGFibGUgdG8gZGV0ZWN0DQo+PiB0aGUgbGVhay4NCj4+IA0KPj4gSXMgdGhlcmUgYW5v dGhlciB3YXk/IERvIHdlIGFzc3VtZSB0aGF0IEFTMSBhbmQgQVMzIGhhdmUgc29tZSBvdGhlciBJ U1ANCj4+IHByb3ZpZGVyKHMpIGZvciB3aGljaCB0aGV5IGhhdmUgQVNQQSBhdHRlc3RhdGlvbj8N Cj4+IA0KPj4gSW4gdGhpcyBzb2x1dGlvbiwgQVM0IGRvZXMgbm90IGhhdmUgdG8ga25vdyBhbnl0 aGluZyBhYm91dCB0aGUgcHJlc2VuY2Ugb2YNCj4+IGFuIFJTLCBldGMuDQo+PiANCj4+IFRoaXMg c29sdXRpb24gd29ya3MgZmluZSBldmVuIGlmIHRoZSBSUyBoYXBwZW5zIHRvIGJlIG5vbi10cmFu c3BhcmVudC4NCj4+IA0KPj4gSW4gYW4gZWFybGllciByZWxhdGVkIHRocmVhZCwNCj4+IA0KPj4g aHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL2Jyb3dzZS9zaWRyb3BzLz9nYnQ9MSZp bmRleD1JMmEwNVlyT0VZDQo+PiByUlJkRWcxWkhPT2xuNkJDdw0KPj4gDQo+PiBOaWNrIEhpbGxh cmQgYW5kIFJvYiBNb3NoZXIgbGVmdCB0aGUgZG9vciBzbGlnaHRseSBvcGVuIGZvciBhIHBvc3Np YmlsaXR5IHRoYXQNCj4+IHRoZXJlIG1pZ2h0IGJlIGEgcmFyZSBSUyBvdXQgdGhlcmUgdGhhdCBp cyBub24tdHJhbnNwYXJlbnQuDQo+PiANCj4+IFNyaXJhbQ0K From nobody Tue Mar 22 04:06:45 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31ED13A1078 for ; Tue, 22 Mar 2022 04:06:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fastly.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zMbnp7w6HzDg for ; Tue, 22 Mar 2022 04:06:37 -0700 (PDT) Received: from mail-ej1-x62b.google.com (mail-ej1-x62b.google.com [IPv6:2a00:1450:4864:20::62b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7962A3A1068 for ; Tue, 22 Mar 2022 04:06:36 -0700 (PDT) Received: by mail-ej1-x62b.google.com with SMTP id pv16so35465964ejb.0 for ; Tue, 22 Mar 2022 04:06:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastly.com; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=yQk3CIQOja+Kxm6ENC+WNs+XrXsNfIoYnwuU0MdyVMA=; b=DN7OfCWNSZWOh7CuHFFkad5F//b5riQD2CnPH6VvpxHaYY0yMCbJWCkQbNHzoCIO9n 2ImV6aFwP8X0dsWyoykfQ6m8DvlLZxKo1EThOK1FRqxMjID7gCLwsiTwaQIzPGEHu7Cl 5HKVAVQO+bL9ihTLSftYR8re0BraPjNaNZGbo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=yQk3CIQOja+Kxm6ENC+WNs+XrXsNfIoYnwuU0MdyVMA=; b=fLmRiJojGI0Vj+C7HOTv/bo+7zRr+cCePvbBV3KNE4JsIPlOyr0yIWxAW2E21zUSfc xj8wzHgfFfB89RkU5BJWnczRy08oXYxHd6oWD5C9JQhZcdEhD8jfrVgrZyPuT8Qsv/PJ 6I3JP4zfwfs1ez2EnLqL4H8XMh2wKlgqA6NsVkKLtopSP7rwLf/oDlO6k0hg2tANlgMc HIKupWHnuk/raDqW2lDoiftMkse9UWUR0kvjduv3qOwSlNc1lbWSCQ1LTvSaeKQKhbJd DMb7nd2KA2BvtvthUAzW7TvnVLLUPDxnfgjxrclmNEK42/xAplo2lExhUGAjnYbOsjxE 1aJA== X-Gm-Message-State: AOAM533hq4JzXHO0td/jk1vKTC07NIoWqq0FDJunWTpvdHl1pw8aV5mp zwiDVx2NXWJJhfl37oA805vzqU0Y50JQ2dpVUzE= X-Google-Smtp-Source: ABdhPJwXkNC0Zppdbjy/PADs+igLtJpHw9HjBi7k537vukYndiIFn/cLT00PPren4nnowdzGTVWw/Q== X-Received: by 2002:a17:906:1e42:b0:6d6:df12:7f8d with SMTP id i2-20020a1709061e4200b006d6df127f8dmr25808088ejj.15.1647947194463; Tue, 22 Mar 2022 04:06:34 -0700 (PDT) Received: from snel (mieli.sobornost.net. [45.138.228.4]) by smtp.gmail.com with ESMTPSA id d4-20020a056402000400b00412d60fee38sm9389817edu.11.2022.03.22.04.06.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Mar 2022 04:06:33 -0700 (PDT) Date: Tue, 22 Mar 2022 12:06:02 +0100 From: Job Snijders To: Benjamin Kaduk Cc: The IESG , draft-ietf-sidrops-6486bis@ietf.org, morrowc@ops-netman.net, sidrops@ietf.org, sidrops-chairs@ietf.org Message-ID: References: <164366773060.21391.16732854790829264927@ietfa.amsl.com> <20220225235526.GY12881@kduck.mit.edu> <20220321205626.GY13021@mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20220321205626.GY13021@mit.edu> X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Sidrops] Benjamin Kaduk's Discuss on draft-ietf-sidrops-6486bis-09: (with DISCUSS and COMMENT) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Mar 2022 11:06:43 -0000 On Mon, Mar 21, 2022 at 01:56:26PM -0700, Benjamin Kaduk wrote: > On Sun, Mar 20, 2022 at 02:44:02PM +0100, Job Snijders wrote: > Thanks for the updates and explanation of the context. > > I just wanted to check: the -10 still contains in §4.4 this text: > > Note: Although it is RECOMMENDED that the thisUpdate and nextUpdate > fields in the manifest match the corresponding fields in the CRL > associated with the manifest, RPs SHOULD NOT reject a manifest if > these fields do not match. > > Does that pose a potential for interop failure that we should be concerned > about? I think you are correct observing this discrepancy. The following is perhaps better: NEW: """ Note: Although the thisUpdate and nextUpdate fields in the Manifest eContent MUST match the corresponding fields in the CRL associated with the Manifest, RPs MUST NOT reject a manifest solely because these fields are not identical. """ The above description should provide clear guidance to both CAs and RPs on where we are / we're heading, without needlessly cutting off some existing deployments [1]. Thanks for catching this, if this aligns with your understanding -11 can be uploaded. Kind regards, Job [1]: https://mailarchive.ietf.org/arch/msg/sidrops/VNG77j05I2JXOwv4qkSy-DCgRNE/ From nobody Tue Mar 22 04:20:19 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD1223A0D75; Tue, 22 Mar 2022 04:20:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.722 X-Spam-Level: X-Spam-Status: No, score=-1.722 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.186, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aJEm1sSqKXTd; Tue, 22 Mar 2022 04:20:05 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F032A3A10D1; Tue, 22 Mar 2022 04:20:04 -0700 (PDT) Received: from mit.edu (c-73-169-244-254.hsd1.wa.comcast.net [73.169.244.254]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 22MBJrKm012013 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 22 Mar 2022 07:19:59 -0400 Date: Tue, 22 Mar 2022 04:19:53 -0700 From: Benjamin Kaduk To: Job Snijders Cc: The IESG , draft-ietf-sidrops-6486bis@ietf.org, morrowc@ops-netman.net, sidrops@ietf.org, sidrops-chairs@ietf.org Message-ID: <20220322111953.GD13021@mit.edu> References: <164366773060.21391.16732854790829264927@ietfa.amsl.com> <20220225235526.GY12881@kduck.mit.edu> <20220321205626.GY13021@mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Archived-At: Subject: Re: [Sidrops] Benjamin Kaduk's Discuss on draft-ietf-sidrops-6486bis-09: (with DISCUSS and COMMENT) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Mar 2022 11:20:10 -0000 On Tue, Mar 22, 2022 at 12:06:02PM +0100, Job Snijders wrote: > On Mon, Mar 21, 2022 at 01:56:26PM -0700, Benjamin Kaduk wrote: > > On Sun, Mar 20, 2022 at 02:44:02PM +0100, Job Snijders wrote: > > Thanks for the updates and explanation of the context. > > > > I just wanted to check: the -10 still contains in §4.4 this text: > > > > Note: Although it is RECOMMENDED that the thisUpdate and nextUpdate > > fields in the manifest match the corresponding fields in the CRL > > associated with the manifest, RPs SHOULD NOT reject a manifest if > > these fields do not match. > > > > Does that pose a potential for interop failure that we should be concerned > > about? > > I think you are correct observing this discrepancy. The following is > perhaps better: > > NEW: > """ > Note: Although the thisUpdate and nextUpdate fields in the Manifest > eContent MUST match the corresponding fields in the CRL associated > with the Manifest, RPs MUST NOT reject a manifest solely because > these fields are not identical. > """ > > The above description should provide clear guidance to both CAs and RPs > on where we are / we're heading, without needlessly cutting off some > existing deployments [1]. > > Thanks for catching this, if this aligns with your understanding -11 can > be uploaded. This would certainly resolve my concern, yes. I am not really in a position to speak to whether it reflects current reality, though :) Thanks, Ben From nobody Tue Mar 22 08:47:01 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44DDB3A163A for ; Tue, 22 Mar 2022 08:46:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.107 X-Spam-Level: X-Spam-Status: No, score=-2.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YUg6XrsZP7x7 for ; Tue, 22 Mar 2022 08:46:45 -0700 (PDT) Received: from mail-ej1-x62f.google.com (mail-ej1-x62f.google.com [IPv6:2a00:1450:4864:20::62f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6BCC93A1702 for ; Tue, 22 Mar 2022 08:46:40 -0700 (PDT) Received: by mail-ej1-x62f.google.com with SMTP id p15so37091086ejc.7 for ; Tue, 22 Mar 2022 08:46:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari.net; s=google; h=mime-version:from:date:message-id:subject:to; bh=IVGiVscHiySM22W1h1t6t4SP6yS1wn3xWyKRWcJJHrI=; b=Ri1rxeyNAAHzCsetQ876Z6RCvUj2UVs0axMm/4cI/abUr1UWGKmMRGrw3Ad1LdfLr8 rEUd/3lYDWFu18LupGaXbI7vLQGC49rxv5hm9ENOU/OG1Q9+VwW7IrXYwcdOxsQQWY6Z m/SiOiVNCKFdRdlGxQnGtN7wgMGl4z0+q8kPzyVMWOTn9xDHInTEOimQIXvMeaQSAAOL D6UVcqPbu83uWpqnskGgvEVhFqHKJQsdZnOm+Il1s4ZINJhODSNp7orRHJe0oF7abnUH BlbdE9vbPbQU4VOJI3hQ8QM6oyB4/5gNR2kQdgKCAjycIXMwjGvGiHzQFyGaBecyO1gM eLdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=IVGiVscHiySM22W1h1t6t4SP6yS1wn3xWyKRWcJJHrI=; b=XFnDt/SLvB7XWy/R5VK4ulmovV0vhL2xAELj+EjG4ztRf/SFl4noLkykkBP3ME287N S2zkkcxeBv2uLbokkNVkE7wq+1sKyFt6NhaXR1Af7YEh9XkxVg8INQwSDxCKm7TIGkYX +GFcgBMfmb3vsXk5TW+qwrQIXF4x8d22JPRzhmLhS0UJ55smzGNo79V2xoIMI/fK0ddb zjyKu3i5I7YdUVQ3hZZufCneiaSPIhAy3SPV+dNKUy5Uiwcttbsw4D+1aY/vdVF+s8gP KgV1Zwqd3SP47TuU8MkB2rWxd3AyjtoBA3MZxJWPuI2Uyfp0keO83H2bysXwAIFjBdW6 5Nog== X-Gm-Message-State: AOAM5333dUOR9V/6vxqbR/Ym+Wg4NzbLXsscx4PFaD0bSL0jvxoZYZJ8 9hSv3hLxdgeAyn2VmHsUFw24PFEhnzkm1Fh06cn5c8eV4KCsbu41 X-Google-Smtp-Source: ABdhPJzX7lzdz5LvMsIoayGPltk11ZOHxAcnr76Qj36ijrmSl5WPeF0cCkHkMlWAM0SQHV2daSj8Y9wp5HEhyfgf0VA= X-Received: by 2002:a17:906:9b96:b0:6e0:17e:fe3 with SMTP id dd22-20020a1709069b9600b006e0017e0fe3mr11135184ejc.514.1647963997745; Tue, 22 Mar 2022 08:46:37 -0700 (PDT) Received: from 649336022844 named unknown by gmailapi.google.com with HTTPREST; Tue, 22 Mar 2022 08:46:36 -0700 Mime-Version: 1.0 X-Superhuman-ID: l12b79pa.6e8c50a3-3756-457f-b7ea-8f1a7a794886 X-Superhuman-Thread-ID: draft00e22d1729f741cc From: Warren Kumari X-Mailer: Superhuman Desktop (2022-03-21T22:05:48Z) X-Superhuman-Draft-ID: draft003632380d84af47 Date: Tue, 22 Mar 2022 08:46:36 -0700 Message-ID: To: SIDR Operations WG Content-Type: multipart/alternative; boundary="000000000000b05cbb05dad084d4" Archived-At: Subject: [Sidrops] Important: Concerns... X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Mar 2022 15:46:58 -0000 --000000000000b05cbb05dad084d4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi there all, I must admit that I haven't been following the SIDROPS list nearly as closely as I used to, or should be. I had I horrible suspicion that I need to change this, and be should be paying more attention to the tone of discussions... but I'd been putting it off and hoping that magically everything would resolve itself. In Vienna I've been bumping into people, and have heard a number of comments which have been concerning, including a conversation with the Ombudsteam. I hadn't realized quite how bad the tone and culture had become, and I apologize to the WG for this =E2=80=94 it's easy, especially when we are no= t meeting in person, to forget that: 1: we are all here trying to make things better 2: it's easy for the tone to get lost in email. I know I often have a joking / slightly snarky tone in my head, but when it gets written down it's easy for the smiling / joking part of the tone to get lost and it's easy for just the snark to remain. 3: the latency in email (and the fact that things are written down and public) can make what was meant to just be a vague, in passing comment, into a much larger and hurtful message. 4: we sometimes forget that firstname@exmaple.com is actually a *person*, who has their own stuff going on, and not just a email address. 5: many of us, who've been working in the IETF / SIDROPS for a long time have the opposite problem - we know *exactly* who firstname@exmaple.com is, and know that calling his/her momma fat isn't going to bother them *at all* =E2=80=94 but what we may forget is that anyone who doesn't know this / doe= sn't have the history here will view this as aggressive, objectionable and just mean. So, I'm going to be trying much harder to keep up with the mail on SIDROPS, and also ask everyone to please please take a minute or two before hitting send on mails (or speaking in meetings!) to consider if what they are about to say is actually helpful and if communicating it differently might be more better. We have a CoC for a reason, let's follow it, W --000000000000b05cbb05dad084d4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi there all,
<= div class=3D"">
I must admit that I haven't be= en following the SIDROPS list nearly as closely as I used to, or should be.=
I had I horrible suspicion that I need to change = this, and be should be paying=C2=A0=C2=A0more attention to the tone of disc= ussions... but I'd been putting it off and hoping that magically everyt= hing would resolve itself.

In Vienna I've been bumping into people, and have heard a number of = comments which have been concerning, including a conversation with the Ombu= dsteam.=C2=A0

I hadn'= ;t realized quite how bad the tone and culture had become, and I apologize = to the WG for this =E2=80=94 it's easy, especially when we are not meet= ing in person, to forget that:
1: we are all here = trying to make things better

2: it's easy for the tone to get lost in email.=C2=A0I know I oft= en have a joking / slightly snarky tone in my head, but when it gets writte= n down it's easy for the smiling / joking part of the tone to get lost = and it's easy for just the snark to remain.
3: the latency in email (and the fact that things a= re written down and public) can make what was meant to just be a vague, in = passing comment, into a much larger and hurtful message.

4:=C2=A0 we sometimes forget that firstname@exmaple.com=C2=A0is actually a *person*, who = has their own stuff going on, and not just a email address.

5: many of us, who've been working = in the IETF / SIDROPS for a long time have the opposite problem - we know *= exactly* who firstname@exmaple.com= =C2=A0is, and know that calling his/her momma fat isn't going to bo= ther them *at all* =E2=80=94 but what we may forget is that anyone who does= n't know this / doesn't have the history here will view this as agg= ressive, objectionable and just mean.

So, I'm going to be trying much harder to keep up with th= e mail on SIDROPS, and also ask everyone to please please take a minute or = two before hitting send on mails (or speaking in meetings!) to consider if = what they are about to say is actually helpful and if communicating it diff= erently might be more better.

We have a CoC for a reason, let's follow it,
W



--000000000000b05cbb05dad084d4-- From nobody Tue Mar 22 10:40:56 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1D923A0D61 for ; Tue, 22 Mar 2022 10:40:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fastly.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TWfO82r0F70l for ; Tue, 22 Mar 2022 10:40:49 -0700 (PDT) Received: from mail-ed1-x536.google.com (mail-ed1-x536.google.com [IPv6:2a00:1450:4864:20::536]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E486F3A0E69 for ; Tue, 22 Mar 2022 10:40:47 -0700 (PDT) Received: by mail-ed1-x536.google.com with SMTP id b24so22560005edu.10 for ; Tue, 22 Mar 2022 10:40:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastly.com; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=lnBz2yzt/yoxRv/5h0ZMzF1k032cseiN3hx3pZJNAhU=; b=OfXM/KwRwn9yrcpJEsCk8LzQ2sWmjF0u+UINaSRzQ1TwzdP92IgV8eyxLsXtaz1Ubb +bL3G0CxWK3OyY9OEIuoUquPYJDsH7C8O9oyKvY1U0tKqRR7d69SqmkT+g3NgMjisESS cUcCt5/ZaKQtk0gpkihooNBbcrYo7GRwNYy7s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=lnBz2yzt/yoxRv/5h0ZMzF1k032cseiN3hx3pZJNAhU=; b=zEG3TPG+xurqb7R4EUwPJeuskIY83Z9BDtBUMpp5BYmzfW4hsklz3rcHNXbkkwQqga go2bSTodNVsUuX0WSO1nop3cz44ohUWdRrDU7K5wJ3bGvYwhnxEnNbE0lMh+qIYCYZfj TL7/IpqXZcRAzeqtXuxPyChY+A7vKNiCut+S0zLaOc5VSnJndofecGU2OvPDj9rTcV/x i5U0ccnCkBDl6U0MS6Cxkz7Qt6PSgYpW1H/gO48lMmuHTVikxLehEqxsIvtjAviw+r6q 13/6UZIl99xfD6HXtnj00O0Qu5yE59fBaZapynzb/1b7G6P5mctX83qZTq80SAYXyqLu WINg== X-Gm-Message-State: AOAM533PwCAE5OwcWI2+mjoQfPLoJBTp0BRrXa89nUf2MMK59tq6r4Ij MmdQC7eulL6doOyPQqIbSftlNg== X-Google-Smtp-Source: ABdhPJyRi3PVCzBEIocc3AMwhGC5qKDTx1nq84NrbKGWQForHz1mgtUq1JA6cjM4dDjshvHiK8492g== X-Received: by 2002:a50:875c:0:b0:419:29a:4c35 with SMTP id 28-20020a50875c000000b00419029a4c35mr25954545edv.188.1647970845294; Tue, 22 Mar 2022 10:40:45 -0700 (PDT) Received: from snel ([2a10:3781:276:2:16f6:d8ff:fe47:2eb7]) by smtp.gmail.com with ESMTPSA id hp12-20020a1709073e0c00b006e02924bf20sm2441389ejc.117.2022.03.22.10.40.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Mar 2022 10:40:44 -0700 (PDT) Date: Tue, 22 Mar 2022 18:40:42 +0100 From: Job Snijders To: Benjamin Kaduk Cc: The IESG , draft-ietf-sidrops-6486bis@ietf.org, morrowc@ops-netman.net, sidrops@ietf.org, sidrops-chairs@ietf.org Message-ID: References: <164366773060.21391.16732854790829264927@ietfa.amsl.com> <20220225235526.GY12881@kduck.mit.edu> <20220321205626.GY13021@mit.edu> <20220322111953.GD13021@mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20220322111953.GD13021@mit.edu> X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Sidrops] Benjamin Kaduk's Discuss on draft-ietf-sidrops-6486bis-09: (with DISCUSS and COMMENT) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Mar 2022 17:40:54 -0000 On Tue, Mar 22, 2022 at 04:19:53AM -0700, Benjamin Kaduk wrote: > On Tue, Mar 22, 2022 at 12:06:02PM +0100, Job Snijders wrote: > > On Mon, Mar 21, 2022 at 01:56:26PM -0700, Benjamin Kaduk wrote: > > > On Sun, Mar 20, 2022 at 02:44:02PM +0100, Job Snijders wrote: > > > Thanks for the updates and explanation of the context. > > > > > > I just wanted to check: the -10 still contains in §4.4 this text: > > > > > > Note: Although it is RECOMMENDED that the thisUpdate and nextUpdate > > > fields in the manifest match the corresponding fields in the CRL > > > associated with the manifest, RPs SHOULD NOT reject a manifest if > > > these fields do not match. > > > > > > Does that pose a potential for interop failure that we should be concerned > > > about? > > > > I think you are correct observing this discrepancy. The following is > > perhaps better: > > > > NEW: > > """ > > Note: Although the thisUpdate and nextUpdate fields in the Manifest > > eContent MUST match the corresponding fields in the CRL associated > > with the Manifest, RPs MUST NOT reject a manifest solely because > > these fields are not identical. > > """ > > > > The above description should provide clear guidance to both CAs and RPs > > on where we are / we're heading, without needlessly cutting off some > > existing deployments [1]. > > > > Thanks for catching this, if this aligns with your understanding -11 can > > be uploaded. > > This would certainly resolve my concern, yes. I am not really in a > position to speak to whether it reflects current reality, though :) As there are two sides of the coin: On the CA ('sending') side there are indeed numerous CAs which produce a "mis-aligned" timestamp values, I anticipate that over time this number will reduce. As for the RP ('receiving') side, it is my understanding that the world's most widely used [1] RP implementations nowadays all consider a Manifest nextUpdate which is in the past (aka 'stale') to be a hard error (in the default configuration). FORT: https://github.com/NICMx/FORT-validator/blob/ce8ed0b9b112d7eebd0330745fb8aac7e73f1e5f/src/object/manifest.c#L73-L77 OctoRPKI: https://github.com/cloudflare/cfrpki/commit/8721e758ee24fb37ee2df81d482d9a453ed52ae3 OpenBSD: https://github.com/openbsd/src/blob/7f8722a4d0c042401934f19a69408a62d0f71ebd/usr.sbin/rpki-client/parser.c#L400-L411 Routinator: https://routinator.docs.nlnetlabs.nl/en/stable/data-processing.html?highlight=stale#stale-objects Kind regards, Job [1] Routinator, OpenBSD rpki-client, FORT, OctoRPKI, popularity gauged from operating a RPKI Repository as part of the global RPKI, and looking at strings in the HTTP User-Agent to identify the RP implementation https://dataplane.org/statistics/rpki.html for a view specific to the ARIN Trust Anchor (keeping in mind that other Trust Anchors might see other stats!). Aside from the ones I mentioned on this shortlist, some other RP implementations can be observed in the wild, some of which aren't actively maintained (such as the RIPE validator). From nobody Wed Mar 23 04:03:35 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 158283A15F2 for ; Wed, 23 Mar 2022 04:03:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nlnetlabs.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2NHJSO4LhTle for ; Wed, 23 Mar 2022 04:03:28 -0700 (PDT) Received: from outbound.soverin.net (outbound.soverin.net [IPv6:2a01:4f8:fff0:65::8:228]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2080E3A15F4 for ; Wed, 23 Mar 2022 04:03:27 -0700 (PDT) Received: from smtp.soverin.net (unknown [10.10.3.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by outbound.soverin.net (Postfix) with ESMTPS id 3403F95C; Wed, 23 Mar 2022 11:03:20 +0000 (UTC) Received: from smtp.soverin.net (smtp.soverin.net []) by soverin.net DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nlnetlabs.nl; s=soverin; t=1648033399; bh=RQAjg/KAmT60VQdnW8f4QlR4ZoCNASc+8LhEUX95j9U=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=NVEJSP3EnDwX0SVwd3abvuE/LKl6spoNeSv6105qWyluuQ0vWQch2rWQpZdRbQutB bJSEvkxDHSn3ju3oY0bORi88ek1RHI6Wqg5+ABxHKuGmRdkEm3af9HWQ7EzmIxyJOg oqxVCdLpbzlVLyiGlEVj8PqiimvC7pRzfuSdyAl9lYhbairhpByhkru+lvzu3300nV QYqP6fadQ/YZ/4wxzN4+f1daipqfko7VmL9OGLZIRGrMKQYWKvYOS7sFxKe5dA38M5 hBuyv83aPFuEzlKwK6AjAPsoQ3V0VLgYi9fOZHHSP15tcEUnfQEh52/iz1oPy1a0iZ jOuihu1txarIA== Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\)) From: Tim Bruijnzeels In-Reply-To: Date: Wed, 23 Mar 2022 12:03:17 +0100 Cc: "sidrops@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> To: Randy Bush Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2022 11:03:33 -0000 Hi Randy, As I said I don't oppose the single VRP per ROA recommendation. On the contrary. > On 10 Mar 2022, at 04:53, Randy Bush wrote: >=20 >> This is an issue if, per Randy's example, the entire ROA is withdrawn = first, >> the RPs fetches and revalidates and sends withdraws for VRPs to the = router, >> and then the new ROA is published later, validated, etc >=20 > no need. CA publishes old an new ROAs. RP fetches both and processes > sequentially. oups! >=20 > and now we can expect to hear folk suggest that the RP should swallow > and digest the entire ROA set (think of the scale of this a few more > years out), reconcile it all, and only then send the reconciled VRPs > to the router. if the current state of RP software is any indication, > i would not want to bet my routing on this. Indeed. Typically what happens in practice is: 1. CAs will publish objects as a set 2. RPs will fetch objects as a set (and reject failed fetches per = mft-bis) 3. RPs will do a full analyis of fetched objects to make a set of VRPs 4. RTR servers will send the diff in VRPs to routers and do work to = avoid duplicates and race conditions I did not dig up all the normative language in specs, but in my = understanding the above is what is specified. There is a lot of text - some of it is = being discussed but not yet published as RFC - I may have missed something. In any case if it's bugs or scaling issues that you are worried about, then I think it would good to spell that out in the draft. I am not opposing that at all - and indeed single VRPs per ROA may help to keep things simple. But as written it seems to say that current = implementations do things they are (to my knowledge) not currently doing and I think that is confusing. Furthermore.. this draft is informational and avoids using normative language.. so am I correct in concluding that it does not try to forbid combining multiple prefixes? Essentially it gives advice to CAs. For example the APNIC AS0 currently has close to 14k prefixes. They = could of course be split into as many objects but that's a lot of objects.. This is of course an extreme case. But what about a 100 for example? Would that be enough to decide to combine prefixes in a single object? It would be useful to me to hear from RP implementers what they believe a good threshold value might be, or that they prefer to have separate objects always.. it would help me to set sensible defaults in CA = software. Including possibly: don't aggregate unless specifically instructed by = the operator. Thanks Tim >=20 > randy >=20 > _______________________________________________ > Sidrops mailing list > Sidrops@ietf.org > https://www.ietf.org/mailman/listinfo/sidrops From nobody Wed Mar 23 11:57:33 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BF7F3A194C; Wed, 23 Mar 2022 11:56:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id STXCwbV9zbHd; Wed, 23 Mar 2022 11:56:46 -0700 (PDT) Received: from GCC02-BL0-obe.outbound.protection.outlook.com (mail-bl0gcc02on2071b.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d05::71b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D9DF3A194B; Wed, 23 Mar 2022 11:56:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SU4i4KvtV8LdcG1WaHlExckDNvHy67MPKv8YJ/H6wHp13uJzct/LHv3DqHTPmSOlSTiFrSYns7xHo0yfy6eXKg7eu0ukOdUdHC3MLMgS3IjuewV6b0B81OQlsAXrqsPd64fFdj5S5mj3/TT3Msi0npaSk5T+fMBe2g8CW1gYzNBhC1r+Lw0mJ52JBBJlGMESMEya13AQySxtMyAdj6QSiMb/BGFGsJ9j3DXoyADcwBkG0o1Vl/g00tZcm62DLhRtroh9j3YYxZPLeSxr0JIljcQgsf2eFY7anqtYiONLkpSwQ1Z0Kd8LlbZxj2rA+Alp6RmDpJL/1reSjZnkbc5bkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+SPndSQwhfpGbmJktiAnOaqLKjHDxleJ8Oh9Ps3azOg=; b=VTVY+zWw1Y/dpLphudOspTpDJrbXoGs7HEz56IsvbeBL6Pc6XvgPguSNVezMGCzwj7jRJs+HjSVIw31BDP0n2JWoE331jr/hf3L+F6og+89FcWJabG01X75tV7/xwDPYk7yzpXgDZeDn+U9AftCQY1Kg37LezLJre78qpFOzKlD18Vz6fmjtLlr8VMWut0I9iaocFQRb/1w0LAFVBVp2o55nN3iQw60GFFU29noY8XsnzzVmEnEk0DMLctN6ZQB8ZE9tlRJ20DBz6pWSwbiBFhF7VbwaQqXEWwYNO/WLENLjq52VrjJa5L7qEeFynyu9xsa2XX0min4Bk/s0WR4VDA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+SPndSQwhfpGbmJktiAnOaqLKjHDxleJ8Oh9Ps3azOg=; b=GHjAeWM9UyNuxuAf4e8MSpJ64gS1/gm2FtYJ1jQBcoQu+rKDFRvXh0w1L82qYvGZHhTXg7RLXFXOp56WJcB+2CHqqDnjEhijniQ6fYBqjDH9RZkuFquuDioorfFZ4/ePK0cl5oc9nxQKbbeW04YDiRrlREdkdtZPE9/aMsmQhNg= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by BY5PR09MB4964.namprd09.prod.outlook.com (2603:10b6:a03:247::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.19; Wed, 23 Mar 2022 18:56:41 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5102.017; Wed, 23 Mar 2022 18:56:41 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "Jakob Heitz (jheitz)" , Zhuangshunwan CC: Jeffrey Haas , "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULXMMKnMnklKEmxZqImduurxazKE6GAgAA0FfCAAJnqAIAAHluAgAIZtbA= Date: Wed, 23 Mar 2022 18:56:41 +0000 Message-ID: References: <473f0482508e4b2e86e76986c74828f9@huawei.com> <384BFD6B-1477-469E-A255-B822F8B0CB05@cisco.com> In-Reply-To: <384BFD6B-1477-469E-A255-B822F8B0CB05@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 20f8dedf-3c66-4ecb-65d6-08da0cfede10 x-ms-traffictypediagnostic: BY5PR09MB4964:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: MAFCMOqHmAU/XDC+bHRHNqyNjKbVyG5VIVI3tDmKnxA9e369eRoyy7F13CYapKNxpOSCpkxbzng3zNetXLV3igPLdowmkM7L+kaPJSkWyBo9DSY1O+DMBt5bx1QStu8LXBj3QQhTrlTJYfB5dsQWodMQvlIpiuL3TEHQReGo1pJFPpdqcdkehYBRKejAz7DIoRD41UeslvBoLuiF8PZbMzJMHKox5WGZhz9wi3w8wS3ngMigYqDvSAXZjY9/A1vGmRBHmuKHMk2HJhxMqAaKarHOlfimHE3H0hIn45+ukDBBMxkC0USgFlWlHuAalN+mj9hCVa6S9NBrtxNqz5oRVg2l/EjWu8IcxutB8f9rrclcrdAzCQDcq7+cuAYvTeyKz/DHO7V1ojV8nNO0ZMHyPfTL/ekqPva3He0XAuSPoaGfP0PdMIA0e7d7pw9/B35PNRfNCVD0MLxrDNSJxUDypBxV0MRqikgrhDqn3ecScC35n43W8RGVLBZ73KDT1gvB+t4H2/1sURjmHAgR4cq7mUgkZvTzMcfxUtJifpu3CvZep3P8yD+48ErlDudcHMEem5PJIIQbionAm6oiPIIXYedSWWCrKhQTU8bCaAM3AroKU+jTcS2ux5IQKcv3RQcewYZzkiNVDtWd6BxmeL7x7SCpyJ2QjoxvU+CO2tHT+KC3qIs/543Dc6zOSO1K1zjoFLOQYfLZS9sTw9TSDOMfrQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(52536014)(8936002)(4744005)(86362001)(186003)(2906002)(6506007)(5660300002)(7696005)(33656002)(9686003)(38100700002)(82960400001)(55016003)(122000001)(71200400001)(26005)(38070700005)(4326008)(110136005)(8676002)(54906003)(66946007)(66556008)(66476007)(76116006)(316002)(66446008)(64756008)(508600001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?ZFZ4ZWpYaHRCUmt0Wk1iekxPZkRVRllNNnZUR29tUjZiZXp2bVdzQ0RaNVFB?= =?utf-8?B?YWtlb1l4ZDZjMFpKVzl2VzJ4Z1RDVDduQWhaWk5GUTdYN3RBSXRkampJcjlJ?= =?utf-8?B?RWoyeTFXWmg1bjhITmVuT0FhMTJIbXo4TThsYzBBMGtQUXNaWmZBNlpsOFVv?= =?utf-8?B?S3ZiTUgvQnQ1VE9xdEI5S2tCNWZJbDBGcXhPOXVwOFZ5dWpuWmo4VitwdmpP?= =?utf-8?B?TUpEK2pMQUVCb3NyOHlPZ3RKUFYyZy9CNllBL245b1Fqc0pQSEMxMTB5TDV0?= =?utf-8?B?U0RhSTBLY2REais2RWUzWEU3eWlsMTZvYmpZOXVZVXpidVpzVGVqOUpodGU0?= =?utf-8?B?SGdTU1ppckwybGdxMWtIZ2dCY2lrek50TDdPVzVtdkdQMEREV2paNFRHRHM5?= =?utf-8?B?NGR1L2pMRmQ2d0NRTVZZcUdFOVZwV3plTWk2SGRTT0xoclZWT1NUbFhvTHlM?= =?utf-8?B?SXR3Vm44d0trMmo5cEYxWXlPS2hEdFk5dllmNS9MeGVvZGE5ZkNJekZTakh2?= =?utf-8?B?cDZWMWVmWVV2TkU1cXVwYkFUaGgyMEtsWXRzc3psd293elE4QzMrMWp3ZXBW?= =?utf-8?B?OHgyUWcrQnQ3YUp6RWhGcDMwRmtIelIwYk11SktRRmdEZXZwVUJtcmhtaFNy?= =?utf-8?B?N0NhMnh3QUVWTHVLRitoY2YvZVRZM3ZPS05aYTVzOUZFM0VQdTBaQ2MzL0tU?= =?utf-8?B?Q3hUL0FGVi9vVjBpb0tvWlR5UWlCam1wSkR4VHg2SWExZ2Q4bkpGaWw2cTFG?= =?utf-8?B?U3Y1ZFpUVkZTSDhOWlFJMHdzZUVaYXh0b0x6eWpudXoyTFI3MHB5Mnh6b2xJ?= =?utf-8?B?K24vM0dhcUdsMWhJTHczTE5mV0tDV01adXdvbXhRQTRDTXgvamgvVjg1cnRj?= =?utf-8?B?czdyT0pFUGxUSldxSE53Q2EwMklMN0dUbklOKzJCWm5zQUZCSEJIRGUvRzN0?= =?utf-8?B?M3ZQUTd0b0UyYzFYNzdsOFNCcGJFSE1xbHJYenRQdWxva0c2ajdrN3B2QUR5?= =?utf-8?B?eStSQU5JT0loQUdMM1JlSGNmMENHeTVRYllKWmZ2NkRBY1JlU2NJM25zN3dQ?= =?utf-8?B?ZWx1NGxHblZuSitzcHZyeGo4RVdqaUVSTDdZVVdBTE44aEZRVGxuOWhZOFlQ?= =?utf-8?B?RkRMT0pJbzc2c04yeWRrb1dqaVBIWlFrREVuRERQTnVnb096VStTRStwRnR4?= =?utf-8?B?Q0xEQTl4TzgzR0U5cm9jY2crZkI4RWlBWlV2YjViS0FUZGZlUEJpYWhkV0lS?= =?utf-8?B?a0FPc0JWVHRVUnB1S1IyY3BnLzVMMGtJbTBMZUNRWFAyZzZoTEVmQjRzN3hO?= =?utf-8?B?SW5FZ0dOY3FpNE5tQm9oNHpMZXJCalF0WmdPTlNQK1lYUHpGeEZPWDFrQk1S?= =?utf-8?B?RGRkT054cldpNlplWnowdi9MMmozcE02dHhRVXRNZTZsVEJWalZ1WVBoV0ow?= =?utf-8?B?eHkwc2o3TVQ1WjE1Wko2aGY0WHk4b1BienNiZHR3UDI4dkFxMHZnUlhxQlRW?= =?utf-8?B?dTBPdStBb283YXc3TytsZnBtM0k4bllVbUF6VmhZVnE1WktnS0xuS3Rrcitt?= =?utf-8?B?RENaZm14VVlxVzAyT056Q0hUU1BLeFBGeHNIbmJpTW1taUNjOVZnTW1CbEVS?= =?utf-8?B?MWNBSlE0dXVvaHFoNUhjZU85UHVHeTREV0VaWjA1WVRvNjMwWDNTRms0OCsw?= =?utf-8?B?RzA5UUdqL3dlU3o5dGtKZEVNVnJ5YXFHYmJFV1VNVWkyUTY2Z2FJRTNyaGRp?= =?utf-8?B?cW5BOUxRVW9sM2VJSkhEV0tnTVdyYlZKai9UUlliLzY0ZmRDVFNNZEx6Y2ZC?= =?utf-8?B?V0R6YWdUTzJ5YzBhbE1mY1dMMjZOcS9CVTRyTDA0Y25SWlc2YXBzcnFoTk5k?= =?utf-8?B?b00vR21NTzhxd29yaEF3TTNtTHJvWW9Cd3R6d0pjbXNmdndyWmEzOW1mOTd2?= =?utf-8?Q?m+iCkpQVEVU=3D?= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 20f8dedf-3c66-4ecb-65d6-08da0cfede10 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2022 18:56:41.2252 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR09MB4964 Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2022 18:56:52 -0000 SGkgSmFrb2IsDQoNCj4+IEFTMSAoUlMgQ2xpZW50KSAtLS0tLT4gQVMyIChSUykgLS0tLS0+ICBB UzMgKFJTIENsaWVudCkgLS0tcDJwIChsYXRlcmFsIHBlZXIpIC0tLT4gQVM0ICh2YWxpZGF0aW5n IEFTKQ0KLi4uDQo+VGhlIEFTLXBhdGggYXQgQVM0IGlzICg0IDMgMSkuDQo+SWYgeW91IGFzc3Vt ZSB0aGF0IEFTMSBhbmQgQVMzIGFyZSBiaWxhdGVyYWwgcGVlcnMsIHRoZW4gYm90aCBzaWRlcyBv ZiBBUzMgZGVjbGFyZSBBUzMgbm90IHRvIGJlIGl0cyBwcm92aWRlci4gQVMzID5oYXMgYm90aCBz aWRlcyBub24tY3VzdG9tZXIuIFRoYXQncyBhIGxlYWsuDQoNClJpZ2h0LiBJdCBzZWVtcyB3ZSBh Z3JlZS4gQSBzZXQgb2YgQVBTQXMgbmVlZHMgdG8gYmUgaW4gcGxhY2UuIFRoZXkgY2FuICBiZSBl bnVtZXJhdGVkIGFzIGZvbGxvd3M6DQp7QVMxLCBBUzJ9IOKAkyBBUzEgYXR0ZXN0cyBBUzIgKFJT KSBhcyBhIHByb3ZpZGVyDQp7QVMzLCBBUzJ9IOKAkyBBUzMgYXR0ZXN0cyBBUzIgKFJTKSBhcyBh IHByb3ZpZGVyDQp7QVMyLCBBUyAwfSDigJMgUlMgKEFTMikgY3JlYXRlcyBhbiBBU1BBIHdpdGgg QVMgMCAgKHRoaXMgaXMgYWxyZWFkeSBzcGVjaWZpZWQgaW4gdGhlIGRyYWZ0KQ0KDQpUaGUgZmly c3QgdHdvIEFTUEFzICppbXBsaWNpdGx5KiBkZWNsYXJlIHRoYXQgQVMzIGlzIG5vdCBhIHByb3Zp ZGVyIG9mIEFTMSBhbmQgdmljZSB2ZXJzYS4gVGhhdCBpbXBsaWVzIHRoYXQgdGhleSBhcmUgcDJw LiBBUzQgZG9lcyBub3QgbmVlZCB0byBsb29rIGF0IGl0cyBvd24gQVNQQS4gSXQga25vd3MgaXQg aXMgcDJwIHdpdGggQVMzLg0KDQpTcGVjaWZ5aW5nIHRoYXQgZWFjaCBSUy1jbGllbnQgY3JlYXRl cyBBU1BBIHNob3dpbmcgdGhlIFJTIGFzIGEgcHJvdmlkZXIgaXMgYSBzb2x1dGlvbiBjb21wb25l bnQgdGhhdCB3ZSAoTmljaywgbWUsIFNodW53YW4sIC4uLikgc2VlbSB0byBiZSBjb252ZXJnaW5n IHRvLg0KDQpKdXN0IHRvIGJlIHN1cmUgdGhlIGZvY3VzIGlzIG9uIHRyYW5zcGFyZW50IFJTLiAg DQoNClNyaXJhbSANCg0K From nobody Wed Mar 23 12:02:03 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 905B03A1B1F; Wed, 23 Mar 2022 12:01:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dROVBIFNv466; Wed, 23 Mar 2022 12:01:42 -0700 (PDT) Received: from GCC02-BL0-obe.outbound.protection.outlook.com (mail-bl0gcc02on2070b.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d05::70b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34BFF3A1A0F; Wed, 23 Mar 2022 12:01:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DL3RL2SacJ982k215UEw1brOi98Lm+FqSiNVe1hF3H8Q+uyjBaCY1Z6JbyYxyE2sYSG3kR9cZNOb7MEyop+i2yKW2SrU0CwVhqwpMwa9yE7Dt2pkBHqOjnW1dpehe1ZkuUk+A4u8qs0vZoV0ShJPsdTdtFt5G5RbzpX9LGTJlBJfPRTYah0BZOYkNEpE5Ug29ltuqC54bBixi6rD2TpPCnk9Qg9EAJQvkX1dDVdqzLdvfpxPXMv3JFIdGVBfgiP1lYDi/u43YZ8q1EU6UVWnywtQc38TmJ9WplapbN77z7NFovh/1u5wV3qzlbauiSkE2xOB5W9EQRchpHKKHp07Iw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Ip1eezNPrS38795RviYt1jIk6MzNevKaorK6sj5Qyw0=; b=ed9b7dz/zxTwYn2zQ2wsyMkYpdo4FY15vFS92gKHsZDQdklu7TmrttbVhAA6uVfGLCruMHaFVT3uGwZ7tpbMz8OAx9iEXoBwpHNRtdXCSV7MSyKgdiumTpUWZlLbrBBBxi2CZlhaMv9WXu1xzJ3SIgIFCmznblW2DAND79bY9DiU3qQPZmlXxPv5lT5Rjhe+ThCabi6+De97fDjWOQ7RlyZodghjgDNFJkCs5Ul0wKwhYEGM3LL6E3+k1EFVugtjeiabXymUFv/riYrS/rOM/yIb4SUeqMOEwh23pjEDkKl4Mk4FeO09C5JHQrObiavc0A3ZKZHZKCOYaZIDRh9w8Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ip1eezNPrS38795RviYt1jIk6MzNevKaorK6sj5Qyw0=; b=eMxEBNIPvzJ5Vc32H7WOUje/pYAD8oZDRwfCxraiHx20W+HYkiozTew7KIe2FZA8GB1HWujvUUv2ZLm9PykrcLezqCzDql2LHgjqP3VpnQ8boVI5mpLZPSZn5lQ7eK0UnwD+XAB1hsRp+S85+6tnpDyoI/t/xqcaXEsxV0xKQNY= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SA9PR09MB5311.namprd09.prod.outlook.com (2603:10b6:806:4e::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5102.17; Wed, 23 Mar 2022 19:01:22 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5102.017; Wed, 23 Mar 2022 19:01:22 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Zhuangshunwan , "Jakob Heitz (jheitz)" , Jeffrey Haas CC: "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULXMMKnMnklKEmxZqImduurxazKE6GAgAA0FfCAAJnqAIACbjJQ Date: Wed, 23 Mar 2022 19:01:22 +0000 Message-ID: References: <473f0482508e4b2e86e76986c74828f9@huawei.com> In-Reply-To: <473f0482508e4b2e86e76986c74828f9@huawei.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 193d9d30-56d3-48ab-b539-08da0cff85ab x-ms-traffictypediagnostic: SA9PR09MB5311:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: vxOGLd2vOg6TAT+dOmvUW60P3/VCZBLL2Q4O7u3AZMm49vEx8HRLWK6mm0D77TlgrtMOZmgom52l5CkTs0J+CpG/2FwIt6XWOgbEHpvMKsdI600Klf1JU6VW8lVU9W83+52T+WdBVxHS4A6khx9OSx1RB3pP2HS9gJ1BI6oOrrogb/mnjot4yaLkbMOK1JeG7TDw3sJINus1o4uXZIi9X5ykmHIRS1A98/fzcT+neV3g5Z3u8d1L3YkjfDFKQP9kG2vMXI1Kt73w4s2KGz9MJqfZHy71nIVZJeBiTn8ch7pi4cPoRBwa8/O39lE4AJHccbV5AKjiGRR3+iSGdXU75p5WqiSNIw/A5bTjfUhsoU4D4eR9XD+ppEyCgtxhVOvIbcmv+tr4Hj2h3dQzRe6FGTSsL19WnDcWN2xyyl2KXh1LkEd4AShrNfHnYsiN+dWWqqpv0cSez8jlcsM38cg/+Nu44GZfOxkpiX1p8LYmnxoTW5Y8M4L7Oh+xyq4qObvf1XIVFjqe2lEUBh6YjJ8DAveZNViLH1O2qhxp7OR9opnGVz+HBznKyG7OQo/04NQ3UmS8RJTuptp6gbDlFyI4tr5OTSQ8wPwK/8Pr8j/jGvng/QEpRHS2RO5JIMgPIA72fHD6Ev4GpI7nsh9T9YyNX4by677Bkdm3cT5HLS/ZrG30vLZ3aW1zW8K6Q4LCOyOL/ohv0E8rugLBKv3g4FxWFg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(122000001)(55016003)(38100700002)(4744005)(2906002)(33656002)(26005)(186003)(7696005)(6506007)(8936002)(52536014)(38070700005)(5660300002)(71200400001)(9686003)(8676002)(64756008)(66446008)(66476007)(66946007)(76116006)(66556008)(82960400001)(508600001)(4326008)(54906003)(110136005)(316002)(86362001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?M3FzYZv7ekhJK8d/br3oCbP4R7jje5McIe9f9pG2b9nSYV6tiwQGwRhrSjAp?= =?us-ascii?Q?bYbXsRTVLzqKTFzAKenChxRjVwfbKgQfBjxGgtfUV7YrO1TR9joF8C7A9Cam?= =?us-ascii?Q?VBXo/9oTV2DumlhWT/GkiMvlV7dyHngpxnH1vDSBFbVXmomHPKVNox6HQWQe?= =?us-ascii?Q?EHEO8DhQDjDYuWDWbWutvibOEjXvS4dH3RhYsRCkfk+cedBEksJRfPi0j7+O?= =?us-ascii?Q?J5/r1OlUua0f0mMm2PaBCGDKJDjNktMy4kwSa2q3NVHLDytMYaAGsvg/2Ew5?= =?us-ascii?Q?BM3OvKnQrM6ElRhN5+bRAbzM7mFlW/Nr/qnfaVJGoiAqKo8Gk44RM3rr1H/O?= =?us-ascii?Q?XsdMXvezNbsN7PjTeKwtBSo7myNlYRDnXcOV3yzQT3wlO79lrtss8KnpnJJv?= =?us-ascii?Q?5fJPMQNbKy8Irt5Jc2eKlsBx9gQbuoLE4D+Qaq0GV9uRHmF4Yr3piYGmTDfU?= =?us-ascii?Q?5LoFtqB520nza1mJIclhctVTl02j93sJRRKN3gOQxtOuMIBpjo5MeEens2mo?= =?us-ascii?Q?7vE5Be2l3bgKRJK27hLmwMeBqNNZ3VUQDomMtWKxj4wLbxuXTPc6PLAelifI?= =?us-ascii?Q?nzoCx/tnFi7Dq8ICCXyCMhIDpF94jQF+pe3pQ7l5iwPSR1Gr1aDyhdhG05XB?= =?us-ascii?Q?cSO9Ndagui1VolRf1cRTNLgQaQRpR1LKkHlRL7IbJQCHUrg+FrhO4VPfJ9V9?= =?us-ascii?Q?LhFeeV9TpIs/SJky7wgHuDxWUoct63j7BPgaeNhvjZAMuJmd347NWOnFj1Ml?= =?us-ascii?Q?+DAzqzVgO0+AB68Jyal6SdpObd22VdPgir0Wve7wELvh9Rex9t1zoRNC8X2f?= =?us-ascii?Q?7w0bVVOQyhVEsCY0g1Lquv0Dx7xNBarjFXA9vS1Bre5V6a704EvQ28Rqcyq0?= =?us-ascii?Q?CXMkdwFZ0Td7KexFx5nW89nfTk4zBDbsUizEgmvavIu0VKoEqzd3sgehkjxX?= =?us-ascii?Q?5asfvHX8at7fPhOTPG+eEYZZ1UFrN7tO4MpBLp++2MSwHL3b1BF6FfD6ZfES?= =?us-ascii?Q?0dlzMfeDZ+m8K2asE0E+EBnI23pwEjhaulbQ0VvVcHzAS37BHbJ44HX2dx/0?= =?us-ascii?Q?sXqiNqnRCHP02tfeSjaCREubqYztBeRNjaKEVfFuKanqOo3xsKFq8UefGjg1?= =?us-ascii?Q?jwBrEV2BSn9payz1+JI98fnmf0guiFd3LsGQLenvXtIg298BgXzLQpW/iMbX?= =?us-ascii?Q?Go8Qc9xvh4c/e+6c2nlx6c/B8TP0UL7GkDTYSuws9hbJILqAphEQUtaFlFHQ?= =?us-ascii?Q?CBKnh3ZMd5E1o/MfSSjpEYcCfUZzHczCFjS6LI89KxL7O6IeNhGYf1sJagb3?= =?us-ascii?Q?3JMdhEkEAYmRFVj3uji07aWpf65J4yxA7azfDnzQq4TWT0tazkXM5aHQq3qA?= =?us-ascii?Q?5TOxv5sl8xTCgaFRqJdRGUTtHEYtAQGviwSDnFtkABn7LRhWchszEj0qGY+r?= =?us-ascii?Q?rZemMf57oWc=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 193d9d30-56d3-48ab-b539-08da0cff85ab X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2022 19:01:22.3913 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA9PR09MB5311 Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2022 19:02:02 -0000 Hi Shunwan, >> AS1 (RS Client) -----> AS2 (RS) -----> AS3 (RS Client) ---p2p (lateral = peer) ---> AS4 (validating AS) >2. AS3 is not included in the set of C2P AS numbers set registered by AS1; #2 (above) from your list is what we have focused on as a solution. Please = see my previous post responding to Jakob where the set of ASPAs is enumerat= ed. =20 Sriram From nobody Wed Mar 23 12:03:37 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84D273A1ACC; Wed, 23 Mar 2022 12:03:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.605 X-Spam-Level: X-Spam-Status: No, score=-9.605 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=iyrY9BZo; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=0tJFd4h3 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SWSpqEgFVDEU; Wed, 23 Mar 2022 12:03:13 -0700 (PDT) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C12923A1B3A; Wed, 23 Mar 2022 12:02:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2280; q=dns/txt; s=iport; t=1648062146; x=1649271746; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=ogR6ICDKLszYFzK79gWUOgSPjTzSXa82hsGAFou7EgM=; b=iyrY9BZoMP/7Rvjc2zJTL3cx0Q9i+2wxTMC7KJCiNCITZbVnp1gQT/qM jv7OsXX2LBgV4rDwKJCAIqz5LBt20DAWOWk+Y7eYRyzFiLwgXOfrZvPyF 2rMOqSEsGO5XYLbEw3d6S5KHr/O2HNgTdmLcbulDnD4eyWTSz+ghEW6HE 8=; X-IPAS-Result: =?us-ascii?q?A0AQAACqbTtimIsNJK1aHQEBAQEJARIBBQUBQIFGCAELA?= =?us-ascii?q?YFRLiiBWDdEhFSDSgOEWWCFEIMCA5s1gS6BJQNUCwEBAQ0BAUMEAQGFBwIXh?= =?us-ascii?q?DUCJTQJDgECBAEBAQEDAgMBAQEBAQEDAQEFAQEBAgEHBBQBAQEBAQEBAQkUB?= =?us-ascii?q?wYMBQ4QJ4VoDYZCAQEBAQIBEhEEDQwBATcBCwQCAQgRBAEBAwImAgICMBUIC?= =?us-ascii?q?AIEAQ0FCBMHgmIrAYI6Aw0hAaFvAYE6AoEOiRF6fzKBAYIIAQEGBASFCxiCN?= =?us-ascii?q?wmBECwBgxCEJ4MBhBEnHIFJRIEVQ4JnPoQtGhWDAzeCLpdBgSEogWtGcyaVX?= =?us-ascii?q?6pNCoNJoBEVqECWWyCmOQIEAgQFAg4BAQaBYYIVcBWDJFEZD44gGYNZil51O?= =?us-ascii?q?AIGAQoBAQMJjgwtghkBAQ?= IronPort-PHdr: A9a23:t4R4pxMMCSLGIleKhv4l6ncDWUAX0o4cdiYZ6Zsi3rRJdKnrv5HvJ 1fW6vgliljVFZ7a5PRJh6uz0ejgVGUM7IzHvCUEd5pBBBMAgN8dygonBsPNAEbnLfnsOio9G skKVFJs83yhd0ZPH8OrbFzJqXr05jkXSX3C IronPort-Data: A9a23:7gnYeqsJFmy+RpwCCJMtM8hIv+fnVLleMUV32f8akzHdYApBsoF/q tZmKW/VbqmCZGPwfdolatjk80IP75LUzNIyHAA5pSg9EihAgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0vrav67xZVF/fngqoDUUIYoAQgsA148IMsdoUg7wbRh2dQz2YHR7z6l4 LseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3ecldG0DFrrx8RYZWc QpsIIaRpQs19z91Yj+sfy2SnkciGtY+NiDW4pZatjTLbhVq/kQPPqgH2PU0VXVlkh+PkvFIl +5D6qeTYyA0Y4bBsbFIO/VYO3kW0axu8bvDJz20ttaeihOAeHr3yPIoB0YzVWEa0r8oWicVq 7pBc3ZUNUHra+GemNpXTsFuhskiMNvDN4IEsXYmxjbcZRojacCcHfmRvoYAgV/cgOhDR9PPN sgiRwBLLx3ae01oPWhLAqwHybLAan7XKm0E9w39SbAMy27Sxw9Z3r/qOtPPPNuQSq19kVyfu UrH8nj3RBYAO7S30juJ6HW0ncfOkD/1HoUIG9WQ9P5jiUa73mIJA1sRT1TTieu5l0e4VMlfN koL8ywGrbU760GqCNL6WnWQo3mYvx0VX9NIDuE7rhqXy7Dd5i6fB3MYCDFGdrQbWNQeTDgu0 BqCmMnkQGIpu7yOQnXb/bCRxd+vBcQLBVMwVzYuSwYk2obYrt4IrTjoU4tIHYfg27UZBgrM6 zyNqSE/gZAagsgKy7i38Dj7b9SE+8Shoukdu16/Y4610u9qTNX+PtX3tzA3+d4FfdjHEQjY1 JQRs5HGtIgz4YexeDthqQnnNJit4/uDWNE3qQEyR8B6n9hBFoLKQGy9yDh6IEEsOcEedHq3J kTSoghWopRUORNGjJObgarsVqzGLoC5SLwJs8w4iPIVPvCdkyfcpUlTiba4hTyFraTVufhX1 W2nWcitF20GLq9s0SC7QewQuZdymHxhlDyIFcmilEj5uVZ7WJJzYepaWLdpRr1nhJ5oXC2Jm zqiH5LQkk4GALGWjtf/qNJCdjjm0kTX9biv+5AIKYZv0yJtGXoqDLfK0Kg9dol+95m5Zc+Wl kxRrnRwkQKl7VWecF3iQik6NNvHAMYuxVpmbHdEFQv5hBALP931hI9BLMRfQFXS3LE5pRKCZ 6NbK5zo7zUmYmmvxgnxmrGh8904KEX6317m0ujMSGFXQqOMjjfhorfMFjYDPgFXZsZrnaPSe 4Gd6z4= IronPort-HdrOrdr: A9a23:QMRyYarwYJkwcT8NBNkL0pEaV5uBL9V00zEX/kB9WHVpm5Oj+f xGzc516farslossSkb6Ky90KnpewK5yXcH2/hvAV7EZniohILIFvAv0WKG+Vzd8kLFh5ZgPM tbAspD4ZjLfCVHZKXBkUeF+rQbsaK6GcmT7I+0pRoMPGJXguNbnn1E422gYypLrXx9dOME/e 2nl6x6TlSbCBEqR/X+IkNAc/nIptXNmp6jSwUBHQQb5A6Hii7twKLmEjCDty1uEg9n8PMHyy zoggb57qKsv7WQ0RnHzVLe6JxQhZ/I1sZDPsqRkcIYQw+cyjpAJb4RGIFqjgpF5d1H22xa1O UkZC1QePib3kmhPF1dZyGdnTUIngxeskMKgmXo/0cL6faJNQ7STfAx3b6wtnDimhAdVBYW6t MR44vRjesmMTrQ2Cv6/NTGTBdsiw69pmcji/caizhFXZIZc6I5l/1VwKp5KuZIIMvB0vFuLA CuNrCp2N9GNVeBK3zJtGhmx9KhGnw1AxedW0AH/siYySJfknx1x1YRgJV3pAZMyLstD51fo+ jUOKVhk79DCscQcKJmHe8EBc+6EHbETx7AOH+bZV7nCKYEMXTQrIOf2sR+2Mi6PJgTiJcikp XIV11V8WY0ZkL1EMWLmIZG9xjcKV/NKwgFCvsukKSRloeMNoYDaxfzO2zGu/HQ1skiPg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.90,204,1643673600"; d="scan'208";a="876433105" Received: from alln-core-6.cisco.com ([173.36.13.139]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 23 Mar 2022 19:02:25 +0000 Received: from mail.cisco.com (xfe-rtp-003.cisco.com [64.101.210.233]) by alln-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id 22NJ2PdM031914 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Wed, 23 Mar 2022 19:02:25 GMT Received: from xfe-aln-001.cisco.com (173.37.135.121) by xfe-rtp-003.cisco.com (64.101.210.233) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14; Wed, 23 Mar 2022 15:02:24 -0400 Received: from NAM11-BN8-obe.outbound.protection.outlook.com (173.37.151.57) by xfe-aln-001.cisco.com (173.37.135.121) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14 via Frontend Transport; Wed, 23 Mar 2022 14:02:24 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Lh2RcvXNgg4fEayk4GesTNfi/7ihgDhYpXbXAB19OOx6R2yzPEkR6WOsTcG37ck9mO/q7bjBmzDMqZItRezB6lzUh8tg0caO48v/eVXCCgpBJa3kSWRa+S4xIOxOqOZmAd8s1PTHOa/mqvivrgJRbE8c3sWBjhiRxPWKgUmH7PHFMlsUVCrhArspLKAexihhkjo4R6V4t7oDTSVbDAAJ1seGxo43FlaopLvhK18duX40CdUflnD1kbgeh35WgCmWTWkmCtMUv2P0r3gdMwG9KbjudihutfkFHWuSCBWrjaeUqB7tRS+q3bHHkT7rV9wjZ4YfhJJozUCH9QiJ6jcWng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ogR6ICDKLszYFzK79gWUOgSPjTzSXa82hsGAFou7EgM=; b=UbOGtj+mXOmt5NusB+TLIVIuoi5Ta8m1kB4kQYZCfCGSFd3d1FRji8J79qmgVrwUjbxuYlqX0c76HnwkSX1a/1Da512KnRV3EcFOoXNiYw+Dwdi9VZzq6KWCfOe7+j5kDh4HnKtdF4iglLak6LJcQBTvYsghunus6ICbDwXqrgNADS9fDxyU7+Oqn+gBOO/o/lDh2ABvMRsXGIOWmmsK7Sf503ZsgiGdW9QPo4/irX9ecxQ7zNsYPqgLnofuXuWFEpE4u57lG6qHNSS2r10V4r2g4tJ35XIyOiJw/xYRoXKn46wMhbcn2Dxt54Y/JAzACdLnyuNr7FJY6NdYB+Q4TQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ogR6ICDKLszYFzK79gWUOgSPjTzSXa82hsGAFou7EgM=; b=0tJFd4h3TwuB+w0BFTbJv3gGCSVY6lQdkx0UjPnCz6CwF6olio3MrQNqpfE4PVeNSVKiMzGRzxzrBUhMSNoFlcr6RorMAe4wRPMydwyiwEz/S9n6HoLte9ec1bxlq1zM+S5M+6RWZaXVPIy3W6ZPrkCKsP6Qog0mzUIGDtlFOL4= Received: from BYAPR11MB3207.namprd11.prod.outlook.com (2603:10b6:a03:7c::14) by MN2PR11MB4645.namprd11.prod.outlook.com (2603:10b6:208:269::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.23; Wed, 23 Mar 2022 19:02:22 +0000 Received: from BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167]) by BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167%7]) with mapi id 15.20.5081.023; Wed, 23 Mar 2022 19:02:22 +0000 From: "Jakob Heitz (jheitz)" To: "Sriram, Kotikalapudi (Fed)" , Zhuangshunwan CC: Jeffrey Haas , "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULHMv5fXHQ9ykCZDKiXb5OfaqzKEtuQgABCawCAAIxaAIAAHluagAJU9oCAAACjkA== Date: Wed, 23 Mar 2022 19:02:22 +0000 Message-ID: References: <473f0482508e4b2e86e76986c74828f9@huawei.com> <384BFD6B-1477-469E-A255-B822F8B0CB05@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cisco.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6ac33672-df86-4feb-b70b-08da0cffa9a1 x-ms-traffictypediagnostic: MN2PR11MB4645:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: kjgh2YPc/N6jSGCJHLvsQCRctaEyE+lFWuPEV54oxKbP15IL+ifVVABM7QAh/2zh2YRjzM2cECTp1R4KFkchRruPA8M5r/KuLiz1JDcW2ccL+t2kh1w/RL9/DDWdaOj4Qfr1hkuSazMEQx2rev1jM5HlezkCQRPCmL9FqUYCKDecdStf5haBpDEvOIY/OS8ad0DejXUWG4iaAjaV2GldUHNgBmpg6Wa70sokH0yHRTOE1Y9O1uWK8sV+9Zug6giN3VY+sVg8YU+ci9DZ9HHudWw7ymn7h4qCteQ94+DmU1DFIveZpiJfiyj9tqbeSs7UdNUIMcw0wlsTCgxX/JnsPDwWO4BGGA+J9SIZvCKEFkUQKYCrjYx7H/mM3i1QCUSHmNIF4Q2rpbC+j0cQo/5y/0ciJWJy5U215Lfpq9xpjl1aKL4gagJ+iee8qwgrO5/2KvKQQv8QDukJ8kkrUMVDvvpg9MJ3Gz7riuglsldQ8KqMYlVLc6tlhVy6bh2n5l/5GET7L6Z+yWWsJn1ziAGBo1uTlJLfWa8f20Fomabu3C0IP5PXGAjJqUrb/3U9WxeWS9JaICP+zoAwp/V3SCQcicRBVibn2+1RnmFWfsnWPFI9hPZpM5lVlEnPbGvrZ/U9Rmrya9KI+Lhxpzp4Ks0qjoeup6FqRHCjd41sJ+UQ1roF5H8A1xkvwnWZzVUvTEQKUzG0NE/93ZjlOFx9Lk/HMw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3207.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(366004)(2906002)(64756008)(53546011)(33656002)(4326008)(7696005)(110136005)(6506007)(83380400001)(8676002)(8936002)(86362001)(52536014)(508600001)(9686003)(66446008)(316002)(66556008)(66476007)(66946007)(55016003)(76116006)(54906003)(38100700002)(5660300002)(71200400001)(38070700005)(122000001)(186003); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?anMrVTZ1Z2ZidGFIRDI2SUVBY1o5R2NoUDJiTjFZMXBMZG95cytJeUQ0SlNp?= =?utf-8?B?YjhhZkNFZGpTbG1RNk1yQUx1QllCdmxlTGtQVWxtSUQ1MEhNTVNGWEgyTUxE?= =?utf-8?B?NnEyV2JqWFl4Z21sNEVRaml3L0wzNFpIRFZnTDVKTnFjeHBUWjY5Y0VWWk9n?= =?utf-8?B?SFFPSlhiZzBSWm9JL0RGUkR1UktrWEFwc1gxS3UzWllObzM5bzZuOWpGM2dR?= =?utf-8?B?a1lIUzdaM3JHSVNrRVFyZStrWXJLbVhpOUFMV2dUYjc0U2U4S1ZDU3ZmVW5E?= =?utf-8?B?MXE2RVpzbzM1d1JSUnhKMzJmL0R5V2hGdlcwYmJ4ZXFWQU1idVpsNHFnb0F2?= =?utf-8?B?TURIUlREUGlVcUlyenNnR0oxT09FWCtsV3g2U056RnQ4RWIzR3hiN2QzZ21r?= =?utf-8?B?elBkYkgyMXY4RHZidTNNMWlzdjJIVGtPUjRiMDVDLzRoUXEwVElUWGxHZnVL?= =?utf-8?B?US9Ic2U0KzJGZGh5R1B1ZTZyOVduNWw3SkdjTFlrZk0rak1WWGUxNlg3Y3Bu?= =?utf-8?B?MDBpeFF3eS9OcFJ5NGRianRrb1ZHdk1ubUxVSkVhNUxMVTkzUFRMQ3gzbjdI?= =?utf-8?B?cnZYS3lIMnlXSTg4S0gxa3NXMHZ2RG1nMU5NQW5ySTAyNmRiMUs4aVprdnBz?= =?utf-8?B?R3JqdSsvaFNLWEVGbE5MT2w4R2ZRdXFoT1ptcUpzRFJQZlZDNXFhbStiY2Js?= =?utf-8?B?UnlNT2tjTWNoYUI4MmpQdUpCaEFnQ3JwdFNWRjlFbkhEQ1N1U0JQVSsrbjl5?= =?utf-8?B?anJ4cnVjVmcrelVKamtBd3ZLbzRQVzV1RlFiZ0xYRzQ0Rm9TbDlMZ2lIWHdm?= =?utf-8?B?WVY5N3Jua28xWGQycUZxcHhrUWQyamtpUmNEZ2lQRUhyWlRTSzZ0THdpNllF?= =?utf-8?B?LzNFRnAxd2hMOFF0bVdRV3NUdUVGVEZqNTFsUFhDS2NFb0xhVFJScFY2b1VO?= =?utf-8?B?VW9JUHQrNDluM1RnN0hFSmJvWjh1WU1qS05QOFd0bUZGR3ByWTU5b1hJN2ov?= =?utf-8?B?YjZmTzJLWnRlYzdjTUJuQXd0UmdnNHBYcU13ZnJ5T0MzRytNWUpEQmJSR2Zi?= =?utf-8?B?a25LOHozaDEwcTV1Z3ZCckpUWDVzQUpxZFBzQ05ScGppOTR0djUvc2IvUDl0?= =?utf-8?B?T3VlMjc4VzNMbjNMblNGcDR2NVhVcmFDdnJheE9JNVdwNXplNWdLbnNYY2tJ?= =?utf-8?B?SE0rSWI2cU5RNEtUTU5NcVVDMkc2VlByeDhRUHFMdTl0Z3lnZWV2WUVrbFdG?= =?utf-8?B?eTNQN2ppV0dBWEVPVkxNWnJtVWdiNk42MnIrRnorZkdUQWlVajBiZHBza1NK?= =?utf-8?B?T3Z1RmswcnhWZmtEU1dZNjBWOXpnbG5OODNIZjduaUFuZ2tPU3FIdXJSekx3?= =?utf-8?B?MU1EeDd6SVJGc24xZEVqUGJVWnVLNDk3elVML1hTNzdaUmkrWTFPWHBLamt6?= =?utf-8?B?ZTgzanRob0pCU3plcEpQWGwzSWRRYnVUbnpDeFcvbm1vakFTbEhZOHlqaGJS?= =?utf-8?B?UENtMFRzbHNBa2NtQlNIQ2ZhUHZVcGxlc0d4RmR4UzhOa3RmNlpXYlVPOG8x?= =?utf-8?B?SE9yTHFwR0NqVDcyWTk1YVk2amYxRHo0K085WjRpaVNoU2o4QmVuUkxVdWFp?= =?utf-8?B?bDBaMmZiR2Z3TXdaSTh6aDFkcDlCcUttcy9ZTkZpMG9xSUQ2M0N6WmNSSHAr?= =?utf-8?B?L3BYZXY2TDZjd25HcStNcThGTGc3bERNK2trdFFKalNFOXZDTFpoc3dlSVRs?= =?utf-8?B?bzBXUFJiZEt1OUlMazR1NlZlWk5OdUVBdW9EVEVGK2VIRjArNktLQnRwS3Y1?= =?utf-8?B?OTZEaExnMGpvZEZXR1EyVlE4RGxBcnRaa0l3dEdoVVRYYTA3blI5eGJNeFRq?= =?utf-8?B?ZDZmbGNqSGs3eDI5dXRqclI2TFVoVlc5cUhsUy8ydDNlVVZFSHF0UEg4ZjhN?= =?utf-8?B?S3Yyb1ljRU5lVnFONVNEQmxCbUVxRm5YTlNKTlFtSzZDbDlyZFlObkNBM3pj?= =?utf-8?Q?pKeYJmhaP9nRcKIj2GlmGpcHU3h44M=3D?= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR11MB3207.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6ac33672-df86-4feb-b70b-08da0cffa9a1 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2022 19:02:22.7238 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: KzMoc4jUaNHN+pEhgX8S8qmHgsYvQLIVGT2g5F4q38IxgC4t1UHKxj7itAUKlCvbIKxNbHYXTaXDDZXVtDXnOA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4645 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 64.101.210.233, xfe-rtp-003.cisco.com X-Outbound-Node: alln-core-6.cisco.com Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2022 19:03:27 -0000 VGhhdCB3b3VsZCB3b3JrLg0KQVMxIGFuZCBBUzMgY291bGQgYXR0ZXN0IEFTMCBhcyBwcm92aWRl ci4gVGhhdCB3b3VsZCB3b3JrIHRvby4NCkFTMiBkb2VzIG5vdCBuZWVkIGFuIGF0dGVzdGF0aW9u LCBidXQgYW55IGF0dGVzdGF0aW9uIHRoYXQgQVMyIHdhbnRzIHRvIG1ha2Ugd2lsbCBtYWtlIG5v IGRpZmZlcmVuY2UuDQoNClJlZ2FyZHMsDQpKYWtvYi4NCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdl LS0tLS0NCkZyb206IFNyaXJhbSwgS290aWthbGFwdWRpIChGZWQpIDxrb3Rpa2FsYXB1ZGkuc3Jp cmFtQG5pc3QuZ292PiANClNlbnQ6IFdlZG5lc2RheSwgTWFyY2ggMjMsIDIwMjIgMTE6NTcgQU0N ClRvOiBKYWtvYiBIZWl0eiAoamhlaXR6KSA8amhlaXR6QGNpc2NvLmNvbT47IFpodWFuZ3NodW53 YW4gPHpodWFuZ3NodW53YW5AaHVhd2VpLmNvbT4NCkNjOiBKZWZmcmV5IEhhYXMgPGpoYWFzQHBm cmMub3JnPjsgc2lkcm9wc0BpZXRmLm9yZzsgZ3Jvd0BpZXRmLm9yZzsgTmljayBIaWxsaWFyZCA8 bmlja0Bmb29iYXIub3JnPg0KU3ViamVjdDogUkU6IFtHUk9XXSBbU2lkcm9wc10gQVNQQSBhbmQg Um91dGUgU2VydmVyICh3YXMgUkU6IElYUCBSb3V0ZSBTZXJ2ZXIgcXVlc3Rpb24pDQoNCkhpIEph a29iLA0KDQo+PiBBUzEgKFJTIENsaWVudCkgLS0tLS0+IEFTMiAoUlMpIC0tLS0tPiAgQVMzIChS UyBDbGllbnQpIC0tLXAycCAobGF0ZXJhbCBwZWVyKSAtLS0+IEFTNCAodmFsaWRhdGluZyBBUykN Ci4uLg0KPlRoZSBBUy1wYXRoIGF0IEFTNCBpcyAoNCAzIDEpLg0KPklmIHlvdSBhc3N1bWUgdGhh dCBBUzEgYW5kIEFTMyBhcmUgYmlsYXRlcmFsIHBlZXJzLCB0aGVuIGJvdGggc2lkZXMgb2YgQVMz IGRlY2xhcmUgQVMzIG5vdCB0byBiZSBpdHMgcHJvdmlkZXIuIEFTMyA+aGFzIGJvdGggc2lkZXMg bm9uLWN1c3RvbWVyLiBUaGF0J3MgYSBsZWFrLg0KDQpSaWdodC4gSXQgc2VlbXMgd2UgYWdyZWUu IEEgc2V0IG9mIEFQU0FzIG5lZWRzIHRvIGJlIGluIHBsYWNlLiBUaGV5IGNhbiAgYmUgZW51bWVy YXRlZCBhcyBmb2xsb3dzOg0Ke0FTMSwgQVMyfSDigJMgQVMxIGF0dGVzdHMgQVMyIChSUykgYXMg YSBwcm92aWRlcg0Ke0FTMywgQVMyfSDigJMgQVMzIGF0dGVzdHMgQVMyIChSUykgYXMgYSBwcm92 aWRlcg0Ke0FTMiwgQVMgMH0g4oCTIFJTIChBUzIpIGNyZWF0ZXMgYW4gQVNQQSB3aXRoIEFTIDAg ICh0aGlzIGlzIGFscmVhZHkgc3BlY2lmaWVkIGluIHRoZSBkcmFmdCkNCg0KVGhlIGZpcnN0IHR3 byBBU1BBcyAqaW1wbGljaXRseSogZGVjbGFyZSB0aGF0IEFTMyBpcyBub3QgYSBwcm92aWRlciBv ZiBBUzEgYW5kIHZpY2UgdmVyc2EuIFRoYXQgaW1wbGllcyB0aGF0IHRoZXkgYXJlIHAycC4gQVM0 IGRvZXMgbm90IG5lZWQgdG8gbG9vayBhdCBpdHMgb3duIEFTUEEuIEl0IGtub3dzIGl0IGlzIHAy cCB3aXRoIEFTMy4NCg0KU3BlY2lmeWluZyB0aGF0IGVhY2ggUlMtY2xpZW50IGNyZWF0ZXMgQVNQ QSBzaG93aW5nIHRoZSBSUyBhcyBhIHByb3ZpZGVyIGlzIGEgc29sdXRpb24gY29tcG9uZW50IHRo YXQgd2UgKE5pY2ssIG1lLCBTaHVud2FuLCAuLi4pIHNlZW0gdG8gYmUgY29udmVyZ2luZyB0by4N Cg0KSnVzdCB0byBiZSBzdXJlIHRoZSBmb2N1cyBpcyBvbiB0cmFuc3BhcmVudCBSUy4gIA0KDQpT cmlyYW0gDQoNCg== From nobody Wed Mar 23 12:07:09 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52BAD3A0120; Wed, 23 Mar 2022 12:07:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.605 X-Spam-Level: X-Spam-Status: No, score=-9.605 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=IEvoV8qz; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=vMbn7myO Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lZAkNy_YlmG7; Wed, 23 Mar 2022 12:07:02 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D8883A011B; Wed, 23 Mar 2022 12:07:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=932; q=dns/txt; s=iport; t=1648062422; x=1649272022; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=Jgk85xqskh+7lv6C7VW0abrBcH2Fxi7LLVkpeoIXprk=; b=IEvoV8qzLbOb7XMh4HV3Q+6W7UTLtCZ9vMbUvvbeCYTp0w2jATxuQsel vbBogashcTtTZY+6xOJ8InwJon0u1IaTrDPp4sbawLu/ksIl3ajtdwJn8 e0Qt6WOkkhST6ShNfC/F651wx7dIyEnb3rFRvE3CZm1nKspSWnlR1Ol1T 8=; IronPort-PHdr: =?us-ascii?q?A9a23=3Aq8uJ1B06KnCh15UGsmDPr1BlVkEcU/3cMg0U7?= =?us-ascii?q?88hjLRDOuSm8o/5NUPSrfNqkBfSXIrd5v4F7oies63pVWEap5rUtncEfc9AU?= =?us-ascii?q?hYfgpAQmAotSMeOFUz8KqvsaCo3VMRPXVNo5Te1K09QTc3/fFbV5Ha16G16J?= =?us-ascii?q?w=3D=3D?= IronPort-Data: =?us-ascii?q?A9a23=3AMcYlvate+B81wbjbpUeAexsN++fnVNJcMUV32?= =?us-ascii?q?f8akzHdYApBsoF/qtZmKWGCb/6KNzGhfNt3bdvlphkDvZPSzd4yHQVspS43Q?= =?us-ascii?q?SlDgMeUXt7xwmUckM+xwmwvdK/shiknQoGowPscEzmN/n9BDpC79SMmjfrSH?= =?us-ascii?q?eKlYAL5EnkZqTFMGX9JZS1Lw4bVsqYw6TSIK1vlVeHa+qUzC3f9s9JACV/43?= =?us-ascii?q?orYwP9ZUFsejxtD1rA2TagjUFYzDBD5BrpHTU26ByOQroW5goeHq+j/ILGRp?= =?us-ascii?q?gs1/j83Ad+j1738aEBPG+aUNgmVgX0QUK+n6vRAjnVtieBga7xNMgEO12vhc?= =?us-ascii?q?9NZkL2hsbSySQooIr/kk+UGWB4eGCZ7VUFD0O6ecSfi6JTDliUqdFOpmZ2CF?= =?us-ascii?q?noeO4wT+c55BmZE/OZeLyoCBjiMneWp6LO2Vucqgd4sROHwPY8FvWl75TDUE?= =?us-ascii?q?fhgRorMK43I5dZRxx8oiNpFW/HEaKIxezpyZRLPeB1SPEgeDro+ge63i3i5e?= =?us-ascii?q?DpdwHqWorY24GHXxRRs3LmrK8DUYNWPbcNUhVreqWXYl1kVqDly2Me30zGJ9?= =?us-ascii?q?DengfXC2HqjHokTD7a/sPVthTWuKqUoIEV+fTOGTTOR0yZSg+5iFnE=3D?= IronPort-HdrOrdr: =?us-ascii?q?A9a23=3AxYF80K2gDZRjahZDy18NswqjBRhyeYIsim?= =?us-ascii?q?QD101hICG9Lfb3qyn+ppsmPEHP5Ar5AEtQ5expOMG7MBfhHO1OkPYs1NCZLU?= =?us-ascii?q?bbUQqTXc1fBO7ZogEIdBeOjtK1uZ0QEZSWTeeAcGSS7vyKrjVQcexQu+VvmZ?= =?us-ascii?q?rA7Yy1ohcdLj2CKZsQlTuRYTzrdXGeMTM2fKbRY6DsgPavyQDQHEg/X4CePD?= =?us-ascii?q?0oTuLDr9rEmNbNehgdHSMq7wGIkHeB9KP6OwLw5GZebxp/hZMZtUTVmQ3w4a?= =?us-ascii?q?uu99uhzAXH6mPV55NK3PP819p4AtCWgMR9EESttu/oXvUjZ1SxhkFxnAid0i?= =?us-ascii?q?dvrDAKmWZmAy1H0QKSQohym2qq5+Cv6kd215ao8y7nvZKqm72JeNt9MbsYuW?= =?us-ascii?q?qcGSGpsXbJe7pHofl2NiuixupqJAKFkyLn69fSURZ20kKyvHo5iOYWy2dSSI?= =?us-ascii?q?0EddZq3MciFW5uYd499RjBmcga+ShVfbXhzecTdUnfY2HSv2FpztDpVnMvHg?= =?us-ascii?q?2eSkxHvsCOyTBZkH1w0kNdnaUk7zo93YN4T4MB6/XPM6xumr0LRsgKbbhlDO?= =?us-ascii?q?NERcesEGTCTR/FLWrXK1X6E6MMPW7LtvfMkf8IzfDvfIZNwIo5mZzHXl8dvW?= =?us-ascii?q?kue1j2AcnLx5FP+gClehTKYd0s8LAo23FUgMyPeFOwC1zxdLkHqbrUn8ki?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BsAADdbjti/5JdJa1aHQEBAQEJARI?= =?us-ascii?q?BBQUBQIFGCAELAYFRLigHgVE3RIgeA4RZYIUQgwIDmzWBLoElA1QLAQEBDQE?= =?us-ascii?q?BQwQBAYFPgzgChEwCJTQJDgECBAEBARIBAQUBAQECAQcEgQkThWgNhkIBAQE?= =?us-ascii?q?BAgESFRMGAQE3AQsEAgEIEQQBAR8QMh0IAgQBDQUIEweDDQGCOgMNIQGhcwG?= =?us-ascii?q?BOgKBDokReIEBMoEBgggBAQYEBIULGII3CYE8AYMQhyiEESccgUlEgRVDgmc?= =?us-ascii?q?+hC0ag0+CLpp1HCpzwFIKg0mgERWDdIwwmByWWyCmOQIEAgQFAg4BAQaBYTy?= =?us-ascii?q?BWXAVO4JpURkPjiCDcopedTgCBgsBAQMJjgwtghkBAQ?= X-IronPort-AV: E=Sophos;i="5.90,204,1643673600"; d="scan'208";a="918751081" Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 23 Mar 2022 19:06:59 +0000 Received: from mail.cisco.com (xfe-rtp-004.cisco.com [64.101.210.234]) by rcdn-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id 22NJ6xMT014741 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Wed, 23 Mar 2022 19:06:59 GMT Received: from xfe-rtp-003.cisco.com (64.101.210.233) by xfe-rtp-004.cisco.com (64.101.210.234) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14; Wed, 23 Mar 2022 15:06:58 -0400 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (64.101.32.56) by xfe-rtp-003.cisco.com (64.101.210.233) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14 via Frontend Transport; Wed, 23 Mar 2022 15:06:58 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JTpMXCgc7kSlvYP+aUBUY7bPDnRQmSYYdOuLkm8N5V7Y6ItbD2A5yEkoKYpw6Qae0lixYoW0kI8C3g6HnbDu6iedvs9lz6v/rSxIKoIiBtfLeRHIXGbvf9mabHrr+fbrXDBX0tdm82bvcTr0qwPTBvm6DAb4/9+JtfB/mHs+e+oU2xtNg5HVmRMUsCnwJxT0cxpqR556AAAaJgCdjBdTpm22jfY7BMoXhrL8Es8x55a0EceuG+kKJbdbFFp5sD3qSmB6w5D2Sx/lmnBrBqVKNQWb5cqWTaWlMqNNAjxsKHqlj8GZMNpi+a9naHgnbpCY3bLaShomGouFFhUR8EvM+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=x/OAQeMxsmjZNm1Jltof7Na/uIqxhaaP1AH83aTVOtw=; b=h/m+ZvQjMSUETNvAVG6ePVmcC5lcAyaaHKmms2s+95eWKCWKbQuPemD/SfrRw/w8HTl8yTIwnFUcOPta/puNEVjKVyGuWrvcfM6Sq0heVnPk6L8Hr56eDqFxaZL0Jw3NqkEIO9zyYtJM4b1l1wObgScISK2Wh8t0zcx2ZsplDGLbH9fnmqyo0JF0FgesFC9WxgiSywRzQigpV41is0a667CDERyOt/73R5Tnnox3otonUSZAHdv0RNwpNQRrD/P4TJmC0aRzl4AV2UWtL3AMGN+Cz6L9cOimijZKxOw5tAULcRshF4/G99T4rRd81MCrfLn+FK0JnFRkPjisT3DMRg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=x/OAQeMxsmjZNm1Jltof7Na/uIqxhaaP1AH83aTVOtw=; b=vMbn7myO1ZoJmYEZ3oKXYSb2vbXJdgwBJSDDLzEUWtIvBO7qaa5a5YHImcRPvFVhi6Sx83GMED4MmypKFDQd4jHetI1CoLz2e+ojJNXXXFJnlG+KA+fRyV151WSbrC9ZG7I6y7rzUw437HseJA1fE5AV856UnWJBgN4mUG4rTN4= Received: from BYAPR11MB3207.namprd11.prod.outlook.com (2603:10b6:a03:7c::14) by MN0PR11MB6009.namprd11.prod.outlook.com (2603:10b6:208:370::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.15; Wed, 23 Mar 2022 19:06:52 +0000 Received: from BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167]) by BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167%7]) with mapi id 15.20.5081.023; Wed, 23 Mar 2022 19:06:52 +0000 From: "Jakob Heitz (jheitz)" To: "Sriram, Kotikalapudi (Fed)" , Zhuangshunwan , Jeffrey Haas CC: "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULHMv5fXHQ9ykCZDKiXb5OfaqzKEtuQgABCawCAAIxaAIACdKAAgAABA1A= Date: Wed, 23 Mar 2022 19:06:52 +0000 Message-ID: References: <473f0482508e4b2e86e76986c74828f9@huawei.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cisco.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 191d6b51-b485-4d6a-1437-08da0d004a2e x-ms-traffictypediagnostic: MN0PR11MB6009:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: jhxS64JkjXxh0GwBMkZalE316bNNJUcmdDlKc2ISPpHDaXZOfIYO4jvDf+Q0iqHZab5vGypXKqhN5FScYzwPcYgoiIt72CILlTFTHmx6eYkW5rPAbOXBGXrFLahEBcGehp8xaIn5+FmcJlAO1k9AyG7mb4pIYNpoot/y7n8age0bqdpqb+8pYqq7KtjWHzvzfeRORwgvwofbxYc5gmN3byJOXOVZKHO/I+n0hCTiYc+X1QfSojiH/rVgIyGc9fAfTIyCpP49lavjqGwEg0XDJ9zOpi6KirB9Ks2YIIcfFsL1TbFfs9uvo4CFSVfX8xq3DnuH9Cn+2pV8eMS27068SO7oBFRfrYsP9K7tj+KFBne4K5DXAOQNmASNN6HirU/rXHHPjfDqZEXQyJpV6b7hw/ByybHQG8NGhcErNz1wD1xSExG0UzcN1CG+VUA3EW6zoy1/s0+JMMOi0HOEs556aFbcJOinJpfNVx4rpkSxLoLLQvCcnEBJViNxeBzYKtlqG82CLwgEd3/M0zzZKbDu4dIAsI9lnQ54MkURNxJ1ZITlM6KMPJ3fObuCQjKaUIG/ICrt6rYYHRXBKwSGDoRvYGjHVUh7rFZU0r5Gr4iioNdJEegDkhh6whF/jh55jQPSMlcAmsVpv1JfdsMwDq3K+8Gtyvqh9xcHimUS3kq9H2mu4fSsBTF4QUA/ivtKa3P2Jp9/iiqGcNo4RkHTbbHVCQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3207.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(366004)(53546011)(7696005)(9686003)(122000001)(2906002)(508600001)(83380400001)(71200400001)(186003)(6506007)(33656002)(54906003)(76116006)(8936002)(66556008)(66476007)(8676002)(5660300002)(52536014)(4326008)(66446008)(64756008)(66946007)(55016003)(86362001)(38070700005)(316002)(38100700002)(4744005)(110136005); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?dNQulkxFoEU7o1L1Jhai5rWoXeuSkXMHMHD7ABSCkfrIh2A0Jxzz0xOGwklL?= =?us-ascii?Q?aLL8hRmhgOXoA8yo/PKXTG3CLJmRX3YcrA+XqkWN220cF5CSmOwhNzZloqOe?= =?us-ascii?Q?bt1r9pAvifG2VNCpLJ9AwjMbxnfF3mEnft62pR7y36+hJCFcrBiKM0Am4R/b?= =?us-ascii?Q?hKAJAvHNSppobxEv9tQJHJNUpwu7uiu3EmnwFKC6FlUht+xGCPiAMEb0O4Jp?= =?us-ascii?Q?j35OM1FcG8he6I+0A2tzX4caw6fdL+5QllkxCnSDB0KyWLP1FSkjMyW5SxbT?= =?us-ascii?Q?R5vvzcPnbQ1KmHuCqMNMyRW41SVNwInxJO1D3shgdeQZ3RpKxGEPqrsbUTdF?= =?us-ascii?Q?MqcJrdwaG54NKglIFf7QGi8ACXjRnf7VUTTg/pkIBWpb14z5Pc+WfCVdTGrn?= =?us-ascii?Q?tRhS6DtxgI2Ypg+2/5CSqGRct3nH1L68i5Mv4gR5RSlaZO9jusJqwXjMxS74?= =?us-ascii?Q?rXEGn0XhvgfUBquJY/NFQmeTfh3AyVmD664nn4d7kVfYQ3IP1atCflfmi7yq?= =?us-ascii?Q?yazsWckAJ9n+m/8NhKcqgx0bKRAN4tkUW1KKSmt3CUXTM0dpu6cV0zkB4Kn5?= =?us-ascii?Q?KCweFczLqTM53aMr/4mUAc9HY1K8AH17PKka5UrM+r6kO45/7v1R+b4zQK3r?= =?us-ascii?Q?FgEt6aeEIWVL2hcuvSYzy3sDEUmg1pKEDKm9b5w+cTC0Nti2gj3mVYZI0jWy?= =?us-ascii?Q?I+mOM9yG7Je2Vxa7vLfMy/3dIO0g2FQ9QLzecDKRTiRLRdFDTqVFpzl565/v?= =?us-ascii?Q?1a/bmDZSv81W9r6ZCNo1xC18TTQPPbtKWQydd39FsPlZyehjw9VFVDKyoub/?= =?us-ascii?Q?p1DoQDTePMsUViK9gEVxaGXmKvTo5iR0kjhvY2vBD24oD6GoGIGQPodOOW78?= =?us-ascii?Q?oM1nTdLJ+UUsTRvKHuQguk92bRRC08JAZ08F+IVjws/1MjfBD+RoXicZAvYQ?= =?us-ascii?Q?par3ESdvHgstWUmmg0kHMRSkcTdV0D/6mJlKHrUFvv/B0KeCHHuG34/LQgRM?= =?us-ascii?Q?5m1hEkIx/Mqnn007Ni1LRKKT/FRnljTUvQYX35pogvtb+IQdT92v3n3pMtWl?= =?us-ascii?Q?y65f0yqFLjC0pQxAennwiubOQp5TCk+3VgDgZDJzJI1U/nWAZ7MLm2flT1b9?= =?us-ascii?Q?DpZLtTMm4vciFWoBcVYUuHnU3C8RkESmIlZaLBZrndofrbalbMVXKwuzb3Qx?= =?us-ascii?Q?AM9D8AgZrHcSbqhkXIkKBeK+AtP5mQ0CuF0QrbCj/50uv4EN9hHd7HX0ApX1?= =?us-ascii?Q?jO1bbsFO0m+qiFrRgnD6f0RyvDKH3smRTpURfOifUaIxELuPZZGyL93uuvv9?= =?us-ascii?Q?e6+5IzE28LKMgW1PNOYYo+tf/l3ZuD5O22HE5ZS3nJ3IWrSZUpoIp0nls8CN?= =?us-ascii?Q?HI5yC/fl3VnnN+mqkNuOuc7ZHZ7yHV52PwmgZ3BvZRqbDlEYwo5cXIKFFCzX?= =?us-ascii?Q?GU3z5HSIyhNUWcx/7HlU/B1vz650MOaS6gmMt9ghucKOzcod4xbVy9pCQL0u?= =?us-ascii?Q?BojrBVwuWjeDzGc=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR11MB3207.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 191d6b51-b485-4d6a-1437-08da0d004a2e X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2022 19:06:52.0947 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: aFRwPtP62bRk+rBNoaRFd1UVSJWlwgEd1vUiGOE74oLE5S3Y/sazB7Lqv8oAxU9y8aSt6+3S2pHk7P0NSV05+w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN0PR11MB6009 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 64.101.210.234, xfe-rtp-004.cisco.com X-Outbound-Node: rcdn-core-10.cisco.com Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2022 19:07:08 -0000 If AS1 attests that AS3 is its provider, then there is no leak. That would be weird, but is it illegal? Regards, Jakob. -----Original Message----- From: Sriram, Kotikalapudi (Fed) =20 Sent: Wednesday, March 23, 2022 12:01 PM To: Zhuangshunwan ; Jakob Heitz (jheitz) ; Jeffrey Haas Cc: sidrops@ietf.org; grow@ietf.org; Nick Hilliard Subject: RE: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Serv= er question) Hi Shunwan, >> AS1 (RS Client) -----> AS2 (RS) -----> AS3 (RS Client) ---p2p (lateral = peer) ---> AS4 (validating AS) >2. AS3 is not included in the set of C2P AS numbers set registered by AS1; #2 (above) from your list is what we have focused on as a solution. Please = see my previous post responding to Jakob where the set of ASPAs is enumerat= ed. =20 Sriram From nobody Wed Mar 23 12:45:28 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE8D83A099D; Wed, 23 Mar 2022 12:45:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.112 X-Spam-Level: X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W-XKUiDP5Ive; Wed, 23 Mar 2022 12:45:20 -0700 (PDT) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on2072c.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B9303A0966; Wed, 23 Mar 2022 12:45:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NjLMNLvWCr3B50NwgK3eebGCXjY+cZtv5jgKQ3j0bYFS1WF1VJB2nBeDKAfpaGz6K+uVNttZ3Q7eYG5N50Z9UuPfD1yW9jroUxlXXPj11MCoyd3nJEL8LpAfqJ+m8n2Zk/hBxsUX+ESwepF+osZf1j3aE1AhF7VCeRDYdX+CVXd4+ZGtwUC8gFglnen3O7FChqHuB4EuVNO64770YMY/YirVieeltap9/AXAMNDLY4WZR/EoqAv/FLbS+z9gGRqjjwNEUic7BBjPPtdeZZTEUTeFefOSXHMwkB665lRR+kDcMAwRYOpvihzCyjifnDgUwq2fkU8m8NF+dx6eJW9t+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=M04zrmVqQt4VsqFCIQJwhm+AIN9AGDXkpIQw5eZPUd4=; b=i/y13I6l1b5fCevqJ9nLmgbNADBcmvcUy7HOkxN8udea4qrqTzXnGuqjpB0KvN7/ZzYTit0RBFr+gMLS0RczLjLBkjbIDysUDqPjT/Je/6SJ/MONv1dQ5HzagKIp3t3Jk9tvkc/uJNz9pt/XO5C2pGjNLVFUMem6cNYxc/Tyt49kZ6N6wlOcPzbqALOy+uKDXTaSQFY2oBMquus7uRNqcDgfQIZqimfEKEoQaroG7X3U10jz5sB9RDqkDCUgTD2X0ilJlo+zzRmaZVih4Ikh0FsmXri876vFJC71dHl31W7YJMdCrAN3VHOZxkUMqYzuwrpEvi275hOjqkfA0RC2TA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=M04zrmVqQt4VsqFCIQJwhm+AIN9AGDXkpIQw5eZPUd4=; b=mzda3bDXRVwME5bBhAEEatcyc9UVT2+lXCcljvoiXpge8MuSvBpo2SKzYjbhIAd9x0iCVTyKZI2jcoRfXct/qqo2UgUHSt3tFyI3uMDXika7dFx1fJlT/PLr5nCnK4hDDgGBiLGs7GAoz4meYKh972JHObXJiBW/6XJ/qvFSzF4= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SJ0PR09MB6798.namprd09.prod.outlook.com (2603:10b6:a03:263::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5102.17; Wed, 23 Mar 2022 19:45:15 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5102.017; Wed, 23 Mar 2022 19:45:15 +0000 From: "Sriram, Kotikalapudi (Fed)" To: "Jakob Heitz (jheitz)" , Zhuangshunwan , Jeffrey Haas CC: "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULXMMKnMnklKEmxZqImduurxazKE6GAgAA0FfCAAJnqAIACbjJQgAAH9wCAAAaqcA== Date: Wed, 23 Mar 2022 19:45:14 +0000 Message-ID: References: <473f0482508e4b2e86e76986c74828f9@huawei.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ccc14f9b-93a5-437b-f744-08da0d05a6ce x-ms-traffictypediagnostic: SJ0PR09MB6798:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: /Y0oxfYOQWPhjd9k+M8EntsqgpH+31Yjm6sZ9eIVvlqc/TwYrs9kpIAFA2VH2H5iDufY1vVIFbHTlQQSno+Kkarqo/EHCwCqXT6AC5ET00Y+fVMCZmZJ5ujCYhS0XmAmC2hiIH9fq9Wen56UqRdGpS+hByZYHa6GgwQtbTmH7rcMSzZbvjTFYP6IlmAXr7PGFWHAOpAtI5zwyshQTLjqbi6DoS8lyTAE8barJsprhrK7BgEAkOq7pO+Qj9nLUVWJo/k21Y3oyxnSXhsu6V0Si8KcgY7BvjxnoDqvE1DlboP4qf/ofuPfPpq2ctX/dcLljhre5So+Ds5kVBqY8RlzupEhwcoqm3baApmV89pX0QM828TflAZ5BA3sLR7N6tqJL9OpVMp4SVTg26sAEc76MbzTmfD05nXMSU0G3XYINOYmKSk6jXT4nVUoEqYPO9I+FpMHSWcKzZNsmYgYYs1hVQFPaqsFOF9qSXcbiVF6oi7wQCz4sBWoWVyzoaQxACPhdndWAmihAMK1eQMc4X1xtld6VVUz17CVnlXKyeMqDFEsQYlOSr5bFpIHG0fkBunu3q77TwWu3HspcY9Vrw1Su2SOM1J5nnu/nVPCH2OK5jZWE2D6EnMiC2wMXAcXdlK1+fGPtzjp8+Ks8zYMmOIKa+cc+xCqMtmlpGrB1mddjpdm9DZUk/HQ+M9YBrCWAUSSTKQtYM8UnMwoB1NPzR7cLb+oqxDitFnrf8y5rBQK1nksxElOb+esng1AJbdUnKvqp82Q7zqgYMfwCjhgYmjytnlRna65Ukvf3ogNWxNh5Ig= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(33656002)(38070700005)(186003)(26005)(83380400001)(2906002)(316002)(8676002)(66556008)(64756008)(66476007)(66446008)(9686003)(82960400001)(4326008)(76116006)(66946007)(52536014)(71200400001)(5660300002)(8936002)(4744005)(86362001)(122000001)(6506007)(7696005)(966005)(55016003)(38100700002)(508600001)(54906003)(110136005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?dWfZq7/kzGXsP68LJoHqwlCP38I3yVe1VIxYm+RLmNxpPq3YIa1byxmS3GbD?= =?us-ascii?Q?f4nO63NoTa85eV66gWRwFZUL47T7jjyvaB/xp1ttITmXX1yrhutP+0FNSyKk?= =?us-ascii?Q?ezlhTzm+uK/jEwYCQl/tfjGojlwEQkl/f/cVIIEfw4uAxmJ33Ve+77LseUe2?= =?us-ascii?Q?W3ZrPJaxdoVZLwtFlpxDqcJ4Zz3MqDI8J7FMDP8OoNv3IeA4ChJdvtHtu/jx?= =?us-ascii?Q?njv7mA7ZCYqGiy9RAUr2tqkfNaZwhg/8ANC6zcPRhmoHcGtL8TG6um4DLKt0?= =?us-ascii?Q?pHmt4pMa9Pou55fDxNM6j02FSBW5IpSdyiCRRTeVisUoLVJJxNoS7W2aLXPc?= =?us-ascii?Q?ZW+HXQRVp9SGYq3yceIs1qzO1Qqzd+0ohJ3WTntXmaChcNgZ/+KkioYZOSfm?= =?us-ascii?Q?xlD0UtaMSCDoDxMZjOXn630n5HeS43RrY+8eqluEiQwg1PBdro5mg90a4G/+?= =?us-ascii?Q?ZMoAXT5IvKD3rEvqqUP5MCo9Ji/icuK0+fdged2nRLOJppLfU+vdTHFcd0Tj?= =?us-ascii?Q?KSVLAsJeV8bXRNa7A3kFuptOYy4dFEfMJIXNFUpig0XsA72n8uTpBsODzE7H?= =?us-ascii?Q?zkaMY4kEzmI5XaT3DKGp3qPg7eYpNl+yg1gNS2JIO210w946VtidgkLa53SO?= =?us-ascii?Q?6dpIwouOHLTlxiTWiTSSF1PnbHxtiIdNHcWLQ+yM06Xy/gaVdNNff/rZSjJP?= =?us-ascii?Q?6mxRFeURanN5zofWEcbKVJQxyImSAIH279Qu9Issm4b88qR6anh8q9QNiB9/?= =?us-ascii?Q?DKIa0OUgV05fvd2/y3pHq2OcySl/IBBRqVf0LoxaTP7znQQIzVBz23uO9oyy?= =?us-ascii?Q?XwBZLgYTmgBLmBRYnKWr6gRXpi3HEhDq/pX9p2oU6tujGjBnyOs0AZ77VIxU?= =?us-ascii?Q?7fxKiqSqVqRrS7Ag6U7yNrdqZlrBmWzZIQvkrq/dxLU5fS4uThiKfSYE5vxv?= =?us-ascii?Q?FEnNyfX1NQ9xM9Fon6zFtokc5SLt+3Wa0uQptBvUTWgteGbYtaEfpA+kjYh4?= =?us-ascii?Q?tX/U4uWR4xdSy2yzFc7v+yG4kWJ3M6y62D0/JPODHkNnh5zdXiHDy8DUCv6P?= =?us-ascii?Q?cNx4irhtb8yqkqsB/Wd8zA7aa3KAdKc1QsC6ySDedk4iCaGv8Kpg2YUSj4cH?= =?us-ascii?Q?KgT2YlCzZS7s0zDT4zvmTHbJK+OEc8tb09I5iJEaQMm+qXEgCkd44zds69UR?= =?us-ascii?Q?qpqjNfqsXrfPLBta9jIX5GbeYqiWeiGOCjDWGEscw+5MJOfsiDbo3bVZtRMx?= =?us-ascii?Q?yZjUADZSW0t4FErI9CxbMLlSogv4TU0ssi66UeH9s3UMfLHGrTCdcOf7gx0U?= =?us-ascii?Q?1NUsAyPYbQgbJhMRE9P7vQnt3Egy2hJ/gcxQEWRlx3bs64877Aq8Un3V0MKd?= =?us-ascii?Q?EBSAZl4EY9dWhXZEVMcF9YY1y60pi3TykO89LxmpNieKSGuB+9HneSGUFECz?= =?us-ascii?Q?GjdX9v89uQ4=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: ccc14f9b-93a5-437b-f744-08da0d05a6ce X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2022 19:45:15.0144 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR09MB6798 Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2022 19:45:26 -0000 >If AS1 attests that AS3 is its provider, then there is no leak. >That would be weird, but is it illegal? No that wouldn't work. If you propose that then for an Update that is propa= gating in the opposite direction, you would also want the reverse: 'AS3 att= ests that AS1 is its provider'. That would make AS1 and AS3 siblings. Then = the leak in question will not be detected (the ASPA verification outcome wi= ll be Valid)! We considered and dismissed it before: https://mailarchive.ietf.org/arch/msg/grow/bfchBrjqMqvMRoP7WrPR-OKOXT8/ Sriram =20 From nobody Wed Mar 23 13:01:19 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C7103A0A8A; Wed, 23 Mar 2022 13:00:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.606 X-Spam-Level: X-Spam-Status: No, score=-14.606 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=ANSoLmx9; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=HWDQ6OUT Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0975q11Sf8yc; Wed, 23 Mar 2022 13:00:46 -0700 (PDT) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 800A83A0A80; Wed, 23 Mar 2022 13:00:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1366; q=dns/txt; s=iport; t=1648065646; x=1649275246; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=wtxs1j3RrZlmD+KPrVdQLW1yO0PKqeLvdB2bp17zevs=; b=ANSoLmx9dp0SKsnf4yMGP1aCBeBsO78YipAwP6uW6Od+c18mgT/h3uLO Z4e/v8G+yNwd8cG2BOEzwD75y4G69gg0B/pA9xhKH3VMydY5vYxq4DN1p 2pVLJ6L5wGgfTGLhtH9YsA3KFbYSA2X+X/6z0UOslSTXY3wVArJhReo4I o=; X-IPAS-Result: =?us-ascii?q?A0ALAAB5eztimIsNJK1aHAEBAQEBAQcBARIBAQQEAQFAg?= =?us-ascii?q?UYHAQELAYFRVn5aN0SIHgOEWWCFEIMCA5s1gS6BJQNUCwEBAQ0BASwLDAQBA?= =?us-ascii?q?YFPgnNFAoRMAiU0CQ4BAgQBAQEBAwIDAQEBAQEBAwEBBQEBAQIBBwQUAQEBA?= =?us-ascii?q?QEBAQEJFAcGDAUOECeFaA2GQgEBAQEDAQEQKAYBASwLAQsEAgEIEQQBAR8QJ?= =?us-ascii?q?wsdCAIEAQ0FCBqCYgGCZQMuAQ6hagGBOgKBDokReIEzgQGCCAEBBgQEhQsYg?= =?us-ascii?q?jcDBoE8AYMQhyiEESccgUlEgRVDgjcwPoJjAQGBSBqDT4IumGMTFFNbPUZBL?= =?us-ascii?q?ykDwCkKg0mLD5UCFYN0pEyWWyCCKYpMmUQCBAIEBQIOAQEGgWGCFXAVO4I1A?= =?us-ascii?q?QEyURkPjiAZg1mFFIVKdTgCBgsBAQMJkFIBAQ?= IronPort-PHdr: A9a23:cGgzlxCvWvFROwX1dZwBUyQVaBdPi9zP1kY95pkmjudIdaKut9TnM VfE7PpgxFnOQc3A6v1ChuaX1sKoWWEJ7Zub9nxXdptKWkwJjMwMlFkmB8iIQUTwMP/taXk8G 8JPHF9o9n22Kw5bAsH7MlbTuXa1qzUVH0aXCA== IronPort-Data: A9a23:WkgaEau0LAig/dBYWrsJB0R9oefnVKheMUV32f8akzHdYApBsoF/q tZmKWGCPP2IY2r8fop0b9i/p0gGscTXzNFjSVNp+3hhRCxDgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0vrav67xZVF/fngqoDUUIYoAQgsA148IMsdoUg7wbRh2dQz2YHR7z6l4 LseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3ecldG0DFrrx8RYZWc QpsIIaRpQs19z91Yj+sfy2SnkciGtY+NiDW4pZatjTLbhVq/kQPPqgH2PU0SndKiAiYxIpKy Ytrl4XvVVcbGofqsbFIO/VYO3kW0axu8bvDJz20ttaeihOAeHr3yPIoB0YzVWEa0r8oWicVq 7pBc3ZUNUHra+GemNpXTsFuhskiMNvDN4IEsXYmxjbcZRojacCZE/2UtY4Gg1/cgOh2PcjTZ NAEeQFrfT3qQkdiN0xLL8IHybLAan7XKm0E9w39SbAMy27Sxw9Z3r/qOtPPPNuQSq19kVyfu UrH8nj3RBYAO7S30juJ6HW0ncfOkD/1HoUIG9WQ9P5jiUa73mIJA1sRT1TTieu5l0e4VMlfN koL8ywGrbU760GqCNL6WnWQo3mYvx0VX9NIDuE7rhqXy7Dd5lPFXm4FVSIHZ9s4nMMzTCYhk F6Eg92vAiZg2IB5UlqU8rOS6Di1IyVQcykJZDQPSk0O5NyLTJwPYgznbeZ+E5Ok1YfOGG/W4 SnVsHgMo581pJtev0mkxmzvjzWpr5nPawc64ATLQ26ohj+Vgqb4O+REDnCGtp59wJalokqp5 yNdwpfAhAwaJdTcynLSEbxl8KSBvq7dWAAwl2KDCHXIG96F0nqncIY4DNpWexoxa51sldMEn CbuVe557ZtXOj6harV6Jtz3AMUxxq+mHtPgPhw1UjasSsUsHONk1HgzDaJ144wLuBNw+U3YE czCGftA9V5AVcxaIMOeHo/xK4MDyCEk3n/0Tpvm1Rmh2rf2TCfLFehUbwDeN7lisP3sTODpH zB3apTiJ/J3DbOWX8Ur2dJ7wa0idCJiXsmm96S7iMbafls9cI3eNxMh6epxJ9M690ikvuzJ5 Xq6ElRJ00bygGavFOl5Qi4LVV8bZr4m9ShTFXV1ZT6AgiF/Ca7yvPZ3X8ZmJtEPqb08pdYqF KNtU5vbXZxypsHvpm51gW/V9tIyLXxGRGumYkKYXdTIV8I/FlaVq46+ImMCNkAmV0KKiCf3m JX4viuzfHbJb1kK4Br+AB53826MgA== IronPort-HdrOrdr: A9a23:YUlhe6z0sPz99WVPJBJgKrPxhuskLtp133Aq2lEZdPULSKKlfp GV88jziyWZtN9IYgBdpTiBUJPwJU80hqQFnrX5Wo3SEzUO2VHYYL2KiLGC/9SOIVyHygcw79 YDT0E6MqyMMbEYt7e13ODbKada/DDvysnB7o2yrwYPcegpUdAb0+4TMHf9LqQCfng+OXNPLu v72iMonUvERV0nKuCAQlUVVenKoNPG0Lj8ZwQdOhIh4A6SyRu19b/TCXGjr1YjegIK5Y1n3X nOkgT/6Knmmeq80AXg22ja6IkTsMf9y+FEGNeHhqEuW3XRY0eTFcdcso+5zXUISdKUmRIXeR 730lAd1vFImjHsl6eO0F3QMkfboW8TAjTZuCGlaDPY0L3ErXQBepJ8bUYzSGqC16Lm1+sMi5 6jlljpx6Z/HFfOmj/w6MPPUAwvnk2ooWA6mepWlHBHV5ACAYUh5rD30XklWavoJhiKoLzP0d MeeP309bJTaxeXfnrZtm5gzJilWWkyBA6PRgwHttaO2zZbkXhlxw9ArfZv00so5dY4Ud1J9u 7EOqNnmPVHSdIXd7t0AKMETdGsAmLATBrQOCaZIEjhFqsAJ3XRwqSHqokd9aWvYtgF3ZEykJ POXBdRsnMzYVvnDYmU0JhC4nn2MROAtPTWu7ZjDrRCy8/BreDQQF6+oXgV4r6dn8k= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.90,204,1643673600"; d="scan'208";a="828068967" Received: from alln-core-6.cisco.com ([173.36.13.139]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 23 Mar 2022 20:00:45 +0000 Received: from mail.cisco.com (xfe-aln-001.cisco.com [173.37.135.121]) by alln-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id 22NK0iEl025998 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Wed, 23 Mar 2022 20:00:45 GMT Received: from xfe-rcd-005.cisco.com (173.37.227.253) by xfe-aln-001.cisco.com (173.37.135.121) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14; Wed, 23 Mar 2022 15:00:44 -0500 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (72.163.14.9) by xfe-rcd-005.cisco.com (173.37.227.253) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.14 via Frontend Transport; Wed, 23 Mar 2022 15:00:44 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=LAxMDz56sqIlSb+9OqE3JtrxRnbN05pwTfdn2Ur3ONWpD/fVP5kXsPlwpxXHssb3mK6huic7mQ2+Z1L8+VeLxpBvqW3JhKeY8imb2zfZcIjaxGwFlLblnLQTXoR5F+O4btzaP/fT2Mqwpo8+SXc8JfkOGZywGhoa8WYptOM+o6xyrO29mTUuViCEn92m2bHgGASepkcMtjHshMLCzjrQhp5np6A7ibKSHGQunXBz45vM3buSSOO/fCBEQHWdBMqHq82+PGBMnT8t+bke3mIXpzdzbpuxdJ0uNcc/EOn86ibyNubLSmANA66fppQALEAmBqsCOU4rdGpyH5pWjYeFmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=KcVAazi9NM3Zd77Bhrw5CqgCQJLSh3MvvhUS6ikPygM=; b=cX1ecMrKpZoUabnDVRhsgc7XZkH0aUfp5inx2TZ8kAHvwIcLayHdQdmTCX2ArptDi7WxiIEotaiLK3xV0ty/PeB6iZEAyoEodB6Nt0GghoxxBm1rLDcLJ6Eha5klxh0reYxZgzazWzpx6XwjsnK7jzLtjprfqOR8mNPIoF2fyFGyNBNbvo97VQI+FCWgwHMHkHOGNSzZBhN6T5G3Lz/Zh+PAgkyvD8aucq+jRQsCkLffv/Q0OSZtYniRqFY4k+/tGGISUEDfoeEa5BtljfBDaTZo27GV6swAdgUxdYyLwwlzxMSyYqFMonHQOi/vh5Ea6nADixwh9/xGbyuNBpcUQA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KcVAazi9NM3Zd77Bhrw5CqgCQJLSh3MvvhUS6ikPygM=; b=HWDQ6OUTMHpM4CE8JB2LjNrCD91EFWMewDu1V3HqoIh5JN865MggSohEpze+nVnD/qnySWa88D6qpwiQoYpeKCaCCbs/BchCUu8O4DIukB0QiBn5/7Gb620OUj0zVrnEfv+d6w6mUOxFDG+85bjFUlQuZMur1EHLTQ7F102WVPg= Received: from BYAPR11MB3207.namprd11.prod.outlook.com (2603:10b6:a03:7c::14) by SA0PR11MB4541.namprd11.prod.outlook.com (2603:10b6:806:94::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5102.16; Wed, 23 Mar 2022 19:59:29 +0000 Received: from BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167]) by BYAPR11MB3207.namprd11.prod.outlook.com ([fe80::a428:75b3:6530:4167%7]) with mapi id 15.20.5081.023; Wed, 23 Mar 2022 19:59:29 +0000 From: "Jakob Heitz (jheitz)" To: "Sriram, Kotikalapudi (Fed)" , Zhuangshunwan , Jeffrey Haas CC: "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPu6aDJ1aUcqdqU+Ly2DP7NRaVKzNYExw Date: Wed, 23 Mar 2022 19:59:29 +0000 Message-ID: References: <473f0482508e4b2e86e76986c74828f9@huawei.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cisco.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 57f3f960-7adb-415b-762f-08da0d07a418 x-ms-traffictypediagnostic: SA0PR11MB4541:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Ed9nQDbmErSdFfP6laO/QzLB8BagqmsUVddy1Sn3FNA8XMU5lQsc8UWBFWAQYQoKzQXj/VIRuc/Vw6kZo3XNRiBuX0nPqvJp8iQ+QHLcHw5a/KIyDQkKX9CXPnaaAWxMMTdJ7e1l1HSsEGGDbMrx0O5oAmXfD7vMfByM150tOzpVCGU0vdnA0ji4zRLz3bz1CfDJhWAGFbPHwznpJbVE/yEk8u0/6p/nzM1RbpTkqNDB6XW9l6ng6RoUt08NLjVA8499Y60KFupbbn2URe+Ao8gvu28/4faE+QffXl5ZuyB+y/pOlbgIpVsA/ZYL/UBHF9+fqkOCfuf2NtILJsHDB8fuj7LZdUdTVPpV9RuYyjGDxEkBlw0ZUP3by1FLOvH+EvOJrM6hiJBXrJGC2ZJnXnGQIXMiVirNnnBoMq3qgHaS+prd6Dc20T56U/T+SjOC0xGLj6QHOpIgm88/S+XSFysVoBVNao8O34o7Z8FuZ+5i1RMS5SpDJrQJzWcEA0XhrWLIcQZL/ITZikccETZ8r66ZY2biAYliY/h0cKGB1qsrtCoGpeeVAgu7XNuzE19Uef02oSj+FblG/I0HNWmC1TTW0q/bV2XC9/HsEWI2oVZPPk+W/QzwiDEWt/m1F3HBtBrF9UBgEQ5gfpaTlt+nrKpCJZOcRw+2AXqt8oSP9VnUeUaNOThwmZmxilcZgyyPIxqxFeIK8VS2ZYtzort06qonigsBJNzu2sTtqqW0NvBOmTa+CzpvpQKK+KtTzN8VsxUx5KeKTMaHNfD0zHXWn/+zBWey+q6E+P/RrWRuHtuS5BNKP7i8PQE6qOWzvDP1Jji7Kt73bmmjzGo+yZYuXA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3207.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(366004)(64756008)(66556008)(186003)(5660300002)(316002)(54906003)(4326008)(110136005)(33656002)(55016003)(8676002)(76116006)(66946007)(122000001)(508600001)(66446008)(71200400001)(66476007)(38100700002)(7696005)(53546011)(9686003)(52536014)(6506007)(966005)(83380400001)(8936002)(86362001)(2906002)(38070700005); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?g1orYr1b0U5tRslz7pNGvDOZMzuBmTgZT9TeMYtqBl0dTbHsph61TqLMzthg?= =?us-ascii?Q?Vd76EFgSh0uOkuJrXLyJxwn4ZoU+D5mlYbbKaI4+wv8sRfZGkYpvBZqzeJRO?= =?us-ascii?Q?Ng8hJDjszmC/V9GAcIjfra0TMVk8Yf7iDwV5efr7KoxXeSdKy+8J+6VtRyed?= =?us-ascii?Q?Zqf2+Y9hZ19n7lxbNKLFEmMLLCp7hAfAFtzUAVjSW1of3t6ew7OMHQROK6lj?= =?us-ascii?Q?B2rECwXxV4GOUaJAnxw0xrYH16CxlqnhaaxzNl6ehMvdhlB7afhDPnSZBAj0?= =?us-ascii?Q?fP8md/tJeewkvYBOZJVaw7Ui0bRGNLZz2t842gSc0FiH7exM6r869Z3XHLjV?= =?us-ascii?Q?Eid2d9WNQdHEEG4Y4xWL38Hsq5/O6RpA+GAxv/4SGqyHJe7Ldwe9kdOTi0GW?= =?us-ascii?Q?kViJXUjgFq67X+TAD39G7nOVmW+iccP+N4i0t4WHkt+TXtHQtSU8Pmto9bci?= =?us-ascii?Q?LiMDy33rzF/5HQqLi9WTO3oMBOgFziw9z4OKbCnosml4d0ae7fkhCV4cJ5tq?= =?us-ascii?Q?Wz/0Wk4yXOkTCoeXl0anrbIVghbe+gHRleM3zbY2mebLbL9kltJBH8KMrr/j?= =?us-ascii?Q?tVBkxJ4AGCAMeJxnL2COQvooCaTvoZaghJBOjRLGRGS7uO6qRMghTpbUSsi3?= =?us-ascii?Q?TxeS56zFeuszWjr8Y1O34c8daQckAA92fL3yJPRufL5Scqua3a/08Xzgf5Q9?= =?us-ascii?Q?pUmREEMyBeEJk4CgBjVSKv8dyYb/KA+DVXKW+gZ4HwWVPX2EAmSiMqRCqU1J?= =?us-ascii?Q?nkasRalAqZWC2aFK2iiHzFUGy/KI1qI6RzU3s9nLrtTnhZaqTDqCnA0sz1Kz?= =?us-ascii?Q?enr+UYDUHFXRfzECC1xEqa0fbXd0STtEJI3R8RTfh7S5iSvHZxPix4l7SWH5?= =?us-ascii?Q?VhaFGhFsah+27yn8xFY3DMVzIfEYKTMpAhSjTdIcyBjLNzWAYmjyE1tZge7b?= =?us-ascii?Q?zGMHd5sRtTa3SnjFKFnaXDI1pQhcnHpwWUnkR4NDjQByaQfmy3Lb7jGKCwAc?= =?us-ascii?Q?1fhHznVqHdA5DTVYD4Cv5xVcDg9Ix/JJPuhLaN5agSps69qsgE9b8/i1nZvp?= =?us-ascii?Q?E0li0WMhH75Q0S7BnGrYzFTajnTMPXxQVGpiNYDEMnvzI2emMUVGdsIyDQaG?= =?us-ascii?Q?WpUJS3AXNklQeLJXFPvVBySvbKqCzQLcq7fDwYnw1Ivn9iHZY+exHTIvT2D8?= =?us-ascii?Q?OYpcYZw/JIPwpO4Ps8gh7CGdZ5yttpaLi43COgywpInIPvNPVEEDGu47bBB/?= =?us-ascii?Q?XIxMyqP85ORzALP3q8eavBMcqpku1MiKfuvkAf6MZoMqK2y33jQ5KQXNzIQS?= =?us-ascii?Q?fmEnFS8UpVN4nQiM5SnqQQRg6H6oVNvyOUiiMJFNv+jNgmW5qKorBUaB0cFo?= =?us-ascii?Q?sp4NTpmrmABNdAXlfMWNTfl2G0Ra2GHwe2QqPVB5pFAu05Ewlxs1de1QyU6W?= =?us-ascii?Q?gzVuymRA9jGfCKdTnHe+Zv4eIpSDu33KwryNuLpnjJtr5oZG9yvKx9TZLguy?= =?us-ascii?Q?GMZw7qxMkIbfR+s=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR11MB3207.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 57f3f960-7adb-415b-762f-08da0d07a418 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2022 19:59:29.3939 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: WFOvdkjfwQ3ZKtJCGk/o33v301QC8q9BI+rVH5AGT+zRuQb96GSTJwlR4CDgl0UesTPSmvpIYxTgyQZU1OCK1Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR11MB4541 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.135.121, xfe-aln-001.cisco.com X-Outbound-Node: alln-core-6.cisco.com Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2022 20:00:52 -0000 Ok. You are saying that's illegal. A RS rule is that clients cannot be customers or providers of other clients= . That's fine, but it has nothing to do with ASPA. Write it into another draft. Regards, Jakob. -----Original Message----- From: Sidrops On Behalf Of Sriram, Kotikalapudi = (Fed) Sent: Wednesday, March 23, 2022 12:45 PM To: Jakob Heitz (jheitz) ; Zhuangshunwan ; Jeffrey Haas Cc: sidrops@ietf.org; grow@ietf.org; Nick Hilliard Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Serv= er question) >If AS1 attests that AS3 is its provider, then there is no leak. >That would be weird, but is it illegal? No that wouldn't work. If you propose that then for an Update that is propa= gating in the opposite direction, you would also want the reverse: 'AS3 att= ests that AS1 is its provider'. That would make AS1 and AS3 siblings. Then = the leak in question will not be detected (the ASPA verification outcome wi= ll be Valid)! We considered and dismissed it before: https://mailarchive.ietf.org/arch/msg/grow/bfchBrjqMqvMRoP7WrPR-OKOXT8/ Sriram =20 _______________________________________________ Sidrops mailing list Sidrops@ietf.org https://www.ietf.org/mailman/listinfo/sidrops From nobody Wed Mar 23 13:29:31 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E28013A07A0; Wed, 23 Mar 2022 13:29:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.112 X-Spam-Level: X-Spam-Status: No, score=-7.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p1U0obkXIRtv; Wed, 23 Mar 2022 13:29:09 -0700 (PDT) Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on2071b.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::71b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C309B3A0C83; Wed, 23 Mar 2022 13:29:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Ou/d4tO935BUcbFUCyEmenPkYuPP3Lp36/8URw2ZPYEekyNqT8hxQ44NcJNWXhjK7nhEOI8tXdr7tIxusA5v8z+0gX/pdfgTbFecI7gcGmK7g2UUBQFbZs/1kPUbbhu8Dp+TOaoB+/nRYz8ToPNn6Y+0S9vKZbfouFOmGHeutSxqqtZbR8F8NWXy6xexRTEu8pLiM273g7YEo078x/izO/rXwc1sg9dCgcGJgJTOTZDHtPxVlUBQF6ee1X2CPwu27CfJ/NMWTIjaSHnXL/GosAu3WovzRW4HD4NRxAttdKX51QLDndklDZDwRVtEQ0TG6iaPMhTD6LjxHHC6vjhmsQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=RCBpTNe5SUZrPCDawh8hZoHINNjgaP0B1XGg5xM5O/w=; b=a2IvbLmpyy/9AURc6PIEdE7l8av1qr5NSOahOU0/UCym6Cx4Ch36uSa0cFNF/WE3E35CV/u+1kUMhkgWm/7w9o76nyamneYan7ZkS/5NwtMUnXU89q/TqZYLDPeeg4i1GFqVmJqvcRHiAVkuGt0IJgzVatOUvpZ2Shw2+WuBJnGgooyLxm/mUVqP4kz6gh1l8dK58IQDSvRrf7DE33kO2NqowFu10tM/hv/jaCRcfgCXfUDr04eGc2GCWlhALHTX8Gq8kuapErN1OX8C/6rX2jmruO/HBC0SDlj8gwxzQRw4T9f2bplO8jtI2zS6Ti0UHs2S/baJJc2oEo6WDITjZQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RCBpTNe5SUZrPCDawh8hZoHINNjgaP0B1XGg5xM5O/w=; b=viEBqSxrivoEgpc/AmdjKtcPaU0HAWAn7l+Si0D3HyzLuGye0th61msoRWPXYilI7liF43UEx0zl+nM6uW+cOPLfKSnFENrJNfcqJEtth1xH09377PUdWLnnZbyLkyCeOnC4xlHDo8SFAjBwNHNmIEt/QArMxzMUxQKdKzEhFp8= Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SJ0PR09MB6976.namprd09.prod.outlook.com (2603:10b6:a03:26a::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5081.14; Wed, 23 Mar 2022 20:29:04 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c99c:1af3:8454:5d6a%6]) with mapi id 15.20.5102.017; Wed, 23 Mar 2022 20:29:04 +0000 From: "Sriram, Kotikalapudi (Fed)" To: Jeffrey Haas CC: "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard , Zhuangshunwan , "Jakob Heitz (jheitz)" Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULXMMKnMnklKEmxZqImduurxazNZA5Q Date: Wed, 23 Mar 2022 20:29:04 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 54aa47be-d402-4364-991a-08da0d0bc623 x-ms-traffictypediagnostic: SJ0PR09MB6976:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: tUl7nUrMeY9qSZTt3U87b028MUahTnRFnlK0evSDZ1I7QaCvThXcyF7ircNECAxZDimFs/Ld+WDgD1V6E/79jt8k9yj4dF+AmG06Ce1ef7cpnsB7sUXqfXB4hXSxcYgMSovUs3hrgfHyyYUxq2jHVLGNSGtTBe4PimpsdpBvb2bipRsFpFeBarvZgtEqKVA6x7Qg6Bd8FKRraBJvI6297+BiGxj2PdjxNMrhCqytFmWQSvg1YEZy6TxyjjSUEkz67YLQvilyr+BKgX2xIf7WFtAqQ/kZCnqgnIjn1ifXRJaxEUtFHYC//XRRUkOWRa5hS040KCBtRGzDoulNY9HTZKSqAl+sKBTpwAQbhxhTt6DLqtLIDn5hdu+QIUGFATflr/dCGnXnaGfrxUh3R2Kc1YXPwt6nBV/g0E8Jm4mq4nUOSyz66dhXT6aloe0uXzn26muRTxJt6OIFC5PZpxHCWPMvXxeYwnuXZh5ti0K+pzI/6deWOq24kjdHYA1kk7mwnGFSbosBuw/zTv13ZPKfJdeNRtGlMQY6Ngrp+/UzZVBcULwBeIpiNFbfeqbpzWhydnXL42bboBzsm9ngO1hXMdgmsiu9CMh9PG2Zc+ewKlwvwXs8bGn+tB8xDmdvBfa4NiTXay5Krm3bUucybAWYTAyZUEwasEY5Ww5BWZdsiGX0iL3Hrj4nCOf48JOpboUHQy4Hvv7BerWSAHuTQBAvMA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(122000001)(82960400001)(186003)(26005)(53546011)(38100700002)(9686003)(83380400001)(66574015)(5660300002)(8936002)(52536014)(2906002)(86362001)(55016003)(508600001)(33656002)(71200400001)(6506007)(7696005)(66476007)(66446008)(38070700005)(76116006)(64756008)(4326008)(8676002)(66556008)(66946007)(316002)(54906003)(6916009); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?4MuPbDP6nHeqfrAXC5diNRKN7N33Ext32guVfDA1Sq7C7qKznLjF4tUcTr?= =?iso-8859-1?Q?m1MzXo3+aVEmMAZqKrLtPoL4i/aIE/8ssrL7azyj6oPUQ8hblfvBaNp/41?= =?iso-8859-1?Q?679yAzgwOHKAVYUsxgBhW0vkNZwtS2ePL4j6JiX6fiYK0LZuC5vQGvn5v/?= =?iso-8859-1?Q?tEonnFpf86uUE5MJmXX4o1GR5DZWzmarZCtnrM4m+/L93xZSxq27QEumZ9?= =?iso-8859-1?Q?Xq+qPn659PFf7oa0bKqaiK7ZvVPT06z+OxVy5czGcGDuzbyG0WG9wUHDY/?= =?iso-8859-1?Q?i1PpuV8P71d3whCH1dHpfbU8g8RoVUX4xTDDbEQ8cZdpUsvPB7MXgFMJrb?= =?iso-8859-1?Q?kil64dWZbHEPnog7YwDFLq4BbDQoVhIhFOQNaglpq/WGP3yp6HWgk07qJI?= =?iso-8859-1?Q?WAoQkunBctJ1FNjpH3UlRfw64LBt4uf+Q2KQd9m1gTJI5xkExx9dZYDH+c?= =?iso-8859-1?Q?2pYWcr4OklkXe5GNkwFPmZgrHqZ8mRmHI9aPatT1cPhcNAgCmj0lY/FoAs?= =?iso-8859-1?Q?emTKeyj7DjBwXjbuYjowA3XDYUBbZt2jbEORWwkmj8TY6t7Qv/w4Yp+2Tb?= =?iso-8859-1?Q?AmZSZgeXWy8NOjx4+j6d9scxqIVieW8NuRF94nItgNuHVLLkvmBqgiY+lF?= =?iso-8859-1?Q?nYpa5fdzplwq2xI/LJEf/K1DxxsNnr6J03iNzWwS/tG8S7TNIXcHyfGC6d?= =?iso-8859-1?Q?RwIinXPQlcO/KKPQ/tYoGQWLBHTMPdGIyULKEWil5lNj2GBzk7ufS3Kd+Y?= =?iso-8859-1?Q?NvOjXtIUE27rrTlMldWaSDTjg2sJdN1OB3b8QcEBGCOm0zDyeWZaox+JFo?= =?iso-8859-1?Q?9LAbQqsbsGE4HGwTnCBt48QM0RDrMMOhGomCC4e0CMdmWYQHBtylG2l4fk?= =?iso-8859-1?Q?k1D5PUKh4+1D8lfWr0xY69DxF7Z4B++60manTgNHxqiTqSmYUBvx7E1k4h?= =?iso-8859-1?Q?qUMEHKlWOxyDZvpv+Lh1zePb1SPr6h2OsKg1bWnr5oqeUzi9womPqbzpAH?= =?iso-8859-1?Q?eYZUF6bONKKUFPwDx6AT0r/exnBfayPusvm5+ydxvn/quy+EV4VJWScSSp?= =?iso-8859-1?Q?KPoePC7FFF8+ybbwMhKGYv9/+1uTI6Z2vHJf2GXbafkl+9BN7zWNretryY?= =?iso-8859-1?Q?NSOon4zr600LA263cKL14sWl4ycka7wbf2GadaRTKYd6ar1NFtOqau6zgL?= =?iso-8859-1?Q?c18eA3WXKKGYloesvlCpxk2ecE06bGCMC6px09DLpNgEos8hQsht+au55t?= =?iso-8859-1?Q?H6P4NBAtlILQASMlNu2f/Owg8FGMMoEiuOwNQU0eA73+xjcZwKGcUKcajq?= =?iso-8859-1?Q?UtKtpWqpRB4ppKEP/Rip7QASTL16JCqTQ5A9ZLpfH6nHJiATneBOrJsJgi?= =?iso-8859-1?Q?ckfWGguWbV7XrWewAxJ+fijA3X3RoYLzARH9WtrmgrzD7ZwfU2YLmMQwjl?= =?iso-8859-1?Q?x5vmJJgsHVz2g8ighM+QhSSbNKsM9sHSXSe7+cIqjzozzA+FpNcXlCKwKa?= =?iso-8859-1?Q?E=3D?= Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 54aa47be-d402-4364-991a-08da0d0bc623 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2022 20:29:04.5432 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR09MB6976 Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2022 20:29:14 -0000 Hi Jeff, Thank you. We are now in sync with you. The design focuses only on transpar= ent RS (i.e., the RS ASN does not appear in the AS path in BGP). We are ass= uming that non-transparent RS is rare/abnormal. =20 It turns out that the solution that works for transparent RS also works for= non-transparent RS with no extra effort. Just an observation, not saying t= hat the non-transparent RS case has any importance.=20 I have a talk in SIDROPS on Friday where the WG discussions will be summari= zed and a solution presented:=20 "ASPA Verification Procedures: Enhancements and RS Considerations". Sriram =20 From: Jeffrey Haas =20 Sent: Monday, March 21, 2022 12:43 PM To: Zhuangshunwan Cc: Jakob Heitz (jheitz) ; Gyan Mishra ; Sriram, Kotikalapudi (Fed) ; Ben Maddi= son ; sidrops@ietf.org; grow@ietf.org Subject: Re: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Serv= er question) Two comments here: If the BGP Speaker is inserting itself into the AS_PATH, it's not really a = Route Server in the traditional sense. A normal BGP Speaker can happily pass along routes via eBGP peering with th= e nexthop unchanged with all devices that it shares a common nexthop subnet= with. My recommendation is to not to try to consider these devices a Route Server= . =A0For ASPA purposes, just add the BGP connections to the inputs. If providers are unhappy with having a IXP router's AS in the ASPA data and= thus lose the desired ASPA filtering properties, the IXP should install a = real route server. -- Jeff From nobody Thu Mar 24 00:57:05 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FA673A1211 for ; Thu, 24 Mar 2022 00:57:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nlnetlabs.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FhamLcsT8x-l for ; Thu, 24 Mar 2022 00:56:56 -0700 (PDT) Received: from outbound.soverin.net (outbound.soverin.net [IPv6:2a01:4f8:fff0:65::8:228]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1E833A1205 for ; Thu, 24 Mar 2022 00:56:55 -0700 (PDT) Received: from smtp.soverin.net (unknown [10.10.3.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by outbound.soverin.net (Postfix) with ESMTPS id 8A0DF43D for ; Thu, 24 Mar 2022 07:56:44 +0000 (UTC) Received: from smtp.soverin.net (smtp.soverin.net []) by soverin.net DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nlnetlabs.nl; s=soverin; t=1648108604; bh=QMeJVlw3nD3O76E0VZGdPukA/VCyxvzaqK4TwkMSZBw=; h=Subject:From:In-Reply-To:Date:References:To:From; b=lNxHPH3GBfT+iSpNlSzupMWRDikQ/XIJuwbQHDLfS8lewfmdG9C9oS9INMGzj72wO XcXlhyVAqaiIpytYUzUzrxtr1O5nzBMYdIjCUjXrhCHYkomBXLMOiyAjqSVqLlrdNt Cmh1G6+X4yua8/0gVNc7RVJ977QCxTCTAspGfk44gAh9q8UmxqBLv/aievyALi+Zxt jlNN1iFrMaEeqxgvr5OU9PFbFbS9j4WvAqJz/ehe4Y5srLLY1L5LH8O0ktEhAqM1Mk 3v39PektQ8/yc40fMCPqVfvxRlwqJ7ywpi2XnvROctrCoRm306SLD+TTPwYGF+pDzz 3O5nmuXvQ8QBA== Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\)) From: Tim Bruijnzeels In-Reply-To: <2ca4980f-5b36-13d6-29e8-c73c9f0958bf@verizon.net> Date: Thu, 24 Mar 2022 08:56:40 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: <73C4FCC8-42DF-455F-9EF2-56DC6BD80476@nlnetlabs.nl> References: <851649A5-9075-4956-8B57-E51F612DF6BD@nlnetlabs.nl> <8961B085-5022-49C8-8775-77031B3DD814@ripe.net> <9B0B0DBF-9F7A-4A61-9EBE-BCE556150475@apnic.net> <56A29364-EB28-4224-96D0-8A5FE95D1880@apnic.net> <2ca4980f-5b36-13d6-29e8-c73c9f0958bf@verizon.net> To: SIDR Operations WG Archived-At: Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-roa-considerations-01 - Ends 10/March/2022 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2022 07:57:04 -0000 Dear WG Allow me to share some thoughts outside of the box.. the things below may not work but I believe they are worth thinking about. > On 10 Mar 2022, at 21:46, Stephen Kent = wrote: >=20 > Geoff, >>=20 >> agreed, yet we have TLS using just-in-time credential provisioning in = the >> initial handshake which has very different scaling properties. The = models >> of DNSSEC provisioning also staple the credentials to the data. RPKI >> is one of the few models that attempt to pre-provision the entirety = of the >> credential sets to all relying parties all of the time, and I find = myself >> wondering why we ever thought that such an approach would scale! >>=20 >> yes, I agree its just one more aspect of the intrinsic brokenness of = the >> Internet, and, as you say, we plod on! :-) >=20 > TLS creates a pairwise connection between two entities, so = transmitting the cert of the server is an obvious, simple approach to = solve the problem in question. And, because of the artificially shallow = PKI underlying the issuance of certs to servers (thanks to the browser = vendors and the cabal of for-profit CAs), it's easy to ensure that a = client gets the certs (and CRLs) it needs. >=20 > The RPKI requires essentially ALL RPs to have access to the certs for = essentially ALL address space holders. It is much more logical to have a = bulk distribution mechanism to facilitate this, vs. some sort of = pairwise distribution mechanism of the sorts you cite. The requirements = for cert and CRL distribution are completely different for the RPKI vs. = the Web PKI- apples vs. kumquats (as Randy might say). I believe there may be merit in *combining* current repositories with = information that may be sent in BGP itself. There are some issues with relying on the current RPKI repositories that = may benefit from this approach. - Delays New announcements may be invalid regarding to current ROAs, similarly a = new provider may be invalid under known ASPA providers (when deployed), and a new = BGPSec router key may be unknown. RPKI objects will have to published, retrieved, validated and the = validated content (VRP, providers, ASN-router-key) have to make their way into routers. = Until that time announcements and routes may be rejected. The delay can be significant. Optimistically it can be as low as 20 = minutes between a CA publishing a new object and on-path routers getting the validated = content, but it may take much longer as well - more than an hour would not be = uncommon. - Repository unreachable Consider that an RPKI Repository becomes unreachable because for example = a mistake was made in ROA configuration - and this ROAs is published in said = repository.. Obviously this should be avoided, but if it does happen then recovery is = painful. RPs are not going to be able to retreive any updated corrective ROA, = until the old information expires and ROV goes to "not found" rather than "invalid". = Slurm may help a bit but I don't think that expecting all ASNs to start using = exceptions would be realistic. For BGPSec things may be worse - suppose the old router key is lost and = unusable.. The repository could publish a new BGPSec router key, but its route = would be invalid, so RPs in validating networks would not be able to find out. - Publishing CA (client) unreachable In this case a delegated CA has invalidated the prefix for their CA = software and is no longer able to reach the repository server. Again this should be avoided, but if it happens.. If the CA can use an alternative path or Slurm between itself and the = repository server then this may help to fix things. Alternatively it can wait for = manifests and CRLs to expire. Or it can ask the parent to be revoked. I would say all of these are painful. - Include objects in BGP Suppose that in some future we would not do full TLS but allow routers = to send the necessary authorization objects for the context of their = announcement/update along. This could simply be the applicable ROA object, ASPA object of = BGPSec router certificate. Dedicated objects could be invented if needed - but = there may be no need. Routers that receive such objects for routes lacking a current = VRP/ASPA/router key entry could then dispatch this (rtr++) to RP software which can then = validate these objects directly under the applicable CA certificate that it has. = Much like Job was describing for RSC objects. Routers that already have = received the entries through rtr (or lack this capability of finding the objects = in BGP) can ignore the included objects. In other words: it would allow capable routers to discover new = attestations sooner, but it would not require any or all routers to do this. This would of course require that routers have a way to include = necessary object. There could be APIs that allow operators push relevant objects = manually, but one could even consider an RTR like protocol where routers can talk = to a CA to get objects. ROAs/ASPAs/BGPSec certificates are usually = long-lived, so this exchange would be low volume and infrequent. A slightly more involved approach would be to CMS objects with a full = path of certificates and CRLs. But.. this would require regular updates of = all those - and make the validation process more involved. So, just = expecting objects that are signed directly under a known CA certificate (which btw could also revoke these objects if needed) would still be complicated, = but much simpler. I understand that all of this would add complexity to an already = complicated infrastructure. So, not doing any of this may be a valid answer, but.. I don't see other obvious ways to deal the situations described above. If anyone has other ideas about ways to handle them I would be very = interested. Tim >=20 > Steve >=20 > _______________________________________________ > Sidrops mailing list > Sidrops@ietf.org > https://www.ietf.org/mailman/listinfo/sidrops From nobody Thu Mar 24 05:11:45 2022 Return-Path: X-Original-To: sidrops@ietf.org Delivered-To: sidrops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 634CE3A0C57; Thu, 24 Mar 2022 05:11:44 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: sidrops@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.46.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: sidrops@ietf.org Message-ID: <164812390435.30480.12764127485870815859@ietfa.amsl.com> Date: Thu, 24 Mar 2022 05:11:44 -0700 Archived-At: Subject: [Sidrops] I-D Action: draft-ietf-sidrops-6486bis-11.txt X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2022 12:11:45 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the SIDR Operations WG of the IETF. Title : Manifests for the Resource Public Key Infrastructure (RPKI) Authors : Rob Austein Geoff Huston Stephen Kent Matt Lepinski Filename : draft-ietf-sidrops-6486bis-11.txt Pages : 18 Date : 2022-03-24 Abstract: This document defines a "manifest" for use in the Resource Public Key Infrastructure (RPKI). A manifest is a signed object (file) that contains a listing of all the signed objects (files) in the repository publication point (directory) associated with an authority responsible for publishing in the repository. For each certificate, Certificate Revocation List (CRL), or other type of signed objects issued by the authority that are published at this repository publication point, the manifest contains both the name of the file containing the object and a hash of the file content. Manifests are intended to enable a relying party (RP) to detect certain forms of attacks against a repository. Specifically, if an RP checks a manifest's contents against the signed objects retrieved from a repository publication point, then the RP can detect replay attacks, and unauthorized in-flight modification or deletion of signed objects. This document obsoletes RFC 6486. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidrops-6486bis/ There is also an htmlized version available at: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-6486bis-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-6486bis-11 Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts From nobody Thu Mar 24 05:19:48 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F00F73A1111; Thu, 24 Mar 2022 05:19:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.907 X-Spam-Level: X-Spam-Status: No, score=-1.907 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9CTu1P8NXofm; Thu, 24 Mar 2022 05:19:39 -0700 (PDT) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73A0E3A0E1D; Thu, 24 Mar 2022 05:19:39 -0700 (PDT) Received: from fraeml715-chm.china.huawei.com (unknown [172.18.147.207]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4KPPQ86PVzz67yJg; Thu, 24 Mar 2022 20:18:24 +0800 (CST) Received: from kwepeml500001.china.huawei.com (7.221.188.162) by fraeml715-chm.china.huawei.com (10.206.15.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Thu, 24 Mar 2022 13:19:34 +0100 Received: from kwepeml500004.china.huawei.com (7.221.188.141) by kwepeml500001.china.huawei.com (7.221.188.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.21; Thu, 24 Mar 2022 20:19:33 +0800 Received: from kwepeml500004.china.huawei.com ([7.221.188.141]) by kwepeml500004.china.huawei.com ([7.221.188.141]) with mapi id 15.01.2308.021; Thu, 24 Mar 2022 20:19:33 +0800 From: Zhuangshunwan To: "Sriram, Kotikalapudi (Fed)" , "Jakob Heitz (jheitz)" , Jeffrey Haas CC: "sidrops@ietf.org" , "grow@ietf.org" , Nick Hilliard Thread-Topic: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route Server question) Thread-Index: AQHYPULXMMKnMnklKEmxZqImduurxazKE6GAgAA0FfCAAJnqAIACbjJQgAEiQvA= Date: Thu, 24 Mar 2022 12:19:32 +0000 Message-ID: <1261bf25fc5e49b7a09a3837eafa668b@huawei.com> References: <473f0482508e4b2e86e76986c74828f9@huawei.com> In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.108.152.178] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Sidrops] [GROW] ASPA and Route Server (was RE: IXP Route Server question) X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2022 12:19:46 -0000 Hi Sriram, Functionally, your solution does detect the route leak. But the actual operation may be difficult, how to encourage so many RS Clie= nts to claim their ASPAs? Or do we need to create an ASPA database with such ASPAs locally by collect= ing and analyzing Internet routing and data? In a project I've been through, we did do something similar. We mine those = RS Clients that are interconnected by IXP RS, and then create a P2P relatio= nal database for them. Take the following topology as an example: AS1 (RS Client) -----> AS2 (RS) -----> AS3 (RS Client) ---p2p (lateral pee= r) ---> AS4 (validating AS) \ \ AS5(RS Client)=20 By some probing we can find AS1/AS3/AS5 are AS2 (RS)'s clients, so we can a= dd AS-Pairs: {AS1 AS3}, {AS1 AS5}, {AS3 AS5} into the local P2P AS-Relation= ships database. By the similar method, we can also create a local RS-Client to RS ASPA data= base.=20 Kind Regards, Shunwan > -----Original Message----- > From: Sriram, Kotikalapudi (Fed) [mailto:kotikalapudi.sriram@nist.gov] > Sent: Thursday, March 24, 2022 3:01 AM > To: Zhuangshunwan ; Jakob Heitz (jheitz) > ; Jeffrey Haas > Cc: sidrops@ietf.org; grow@ietf.org; Nick Hilliard > Subject: RE: [GROW] [Sidrops] ASPA and Route Server (was RE: IXP Route > Server question) >=20 > Hi Shunwan, >=20 > >> AS1 (RS Client) -----> AS2 (RS) -----> AS3 (RS Client) ---p2p (latera= l peer) ---> > AS4 (validating AS) >=20 > >2. AS3 is not included in the set of C2P AS numbers set registered by AS= 1; >=20 > #2 (above) from your list is what we have focused on as a solution. Pleas= e > see my previous post responding to Jakob where the set of ASPAs is > enumerated. >=20 > Sriram From nobody Thu Mar 24 07:42:04 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2B393A0E00; Thu, 24 Mar 2022 07:42:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.106 X-Spam-Level: X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1QPdNShFD275; Thu, 24 Mar 2022 07:41:59 -0700 (PDT) Received: from mail-qt1-x82d.google.com (mail-qt1-x82d.google.com [IPv6:2607:f8b0:4864:20::82d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 80BF53A0DBC; Thu, 24 Mar 2022 07:41:56 -0700 (PDT) Received: by mail-qt1-x82d.google.com with SMTP id v2so3979983qtc.5; Thu, 24 Mar 2022 07:41:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:from:date:message-id:subject:to; bh=MSIKP4X4Km8YIPUsWhLeClBeWyDavrphU/VBReMV9aw=; b=Z3aJRU0Lmu7sWbBw/rVWFUQ8fdRLeaYaonUeuSwBL3scDgsn2nGUt55SMXyH9gDkUs Gds/IhzpFRjmCE12ru3FUeU7yUpL6ZqLl3dPac1jeEEzw/n3PEz1C0ziD56oFbE1SLgp 9kPw8Hd0yCgkC8SomG1QNhOACmzNhfIoWK7s/NYmuvnMDS4QvhF3cTl4IpB6i9gLacJ3 1ZkCVsMhY9MID44AkLEE4SZi3c4SdcRYwHPerRAXsCszZRh0P0a1Nx1Vm3+ev+wqmvNH vP9K7TiT1PSCxDfbVMCJTUDJTKFSPNzZHPvKdNv0KZJVgrYDk9FujUpaJPZ2yL8mlJru LebA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=MSIKP4X4Km8YIPUsWhLeClBeWyDavrphU/VBReMV9aw=; b=qPLB0WrijnUQRJQozcmDew0pem3dfFJjILqZteXPZro5+HkDyir9hO11egw6/+adXR gc/pxcfZz/6VEpXWJViwyeaEZJpSrr9XyaXK+Tato8lFy4XlU+p3E/szGnFkejJBrjXT wqxMge/RFt96Ozc/HhXb8DoSh/oUfstN5cuXaPBOlsaejJqXBCKLc4H8OBjUSgXtaq/e N7ZyE8OIx8UgZ+5e0h2PAahbYdQLZ4CL4dGezB7Ud//zBvwZhnhxErR11z0nzcU+cwm7 Y2zG7nElxH9r7hotj9Gx757qu/+oLALRzLAPmqzTGlFlL58ua/Z7gajoHijUsB8XQXHT rHpQ== X-Gm-Message-State: AOAM533VsXdKrQX0a2UArVCi+WSGxnQ9jWYXpfhUnLPmOY4vN5QRAlPp QDyuQ7ndXp6Wo/8J13OolAZ/adxSH3P2i4TDs7f3qIeNhUg= X-Google-Smtp-Source: ABdhPJx3pvy0spTHNPlXoJoQ15WSLfYwgsGd5seVjbrM9usR8naeeyshnI1n+1HzPgBuSJLr4uFJhJYL2dHh0r3FIGw= X-Received: by 2002:ac8:5ac8:0:b0:2e1:df01:1a4b with SMTP id d8-20020ac85ac8000000b002e1df011a4bmr4678242qtd.675.1648132914734; Thu, 24 Mar 2022 07:41:54 -0700 (PDT) MIME-Version: 1.0 From: Christopher Morrow Date: Thu, 24 Mar 2022 10:41:44 -0400 Message-ID: To: SIDROps Chairs , SIDR Operations WG , sidrops-ads@ietf.org Content-Type: multipart/alternative; boundary="000000000000ecebe005daf7d89a" Archived-At: Subject: [Sidrops] Meeting Preparations X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2022 14:42:01 -0000 --000000000000ecebe005daf7d89a Content-Type: text/plain; charset="UTF-8" Howdy folks! Tomorrow we have a meeting scheduled. There are ~8 people presenting, one of which is an invited guest who won't have slides (I think). The other 7 folks (job counts as 3 here) need to provide slides... We currently have slides for 3 folks, none of which are Job... Please have your slides sent to sidrops-chairs@ietf.org prior to sleepy-time in EU timezone tonight. kthxbi! -chris co-chair-persona --000000000000ecebe005daf7d89a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Howdy folks!
Tomorrow <sometime in EU timezone> w= e have a meeting scheduled.
There are ~8 people presenting, one of which= is an invited guest who won't have slides (I think).
The other 7 fo= lks (job counts as 3 here) need to provide slides...

We = currently have slides for 3 folks, none of which are Job... Please have you= r slides=C2=A0sent
to = sidrops-chairs@ietf.org prior to sleepy-time in EU timezone tonight.

kthxbi!
-chris
co-chair-persona<= /div>
--000000000000ecebe005daf7d89a-- From nobody Fri Mar 25 07:41:36 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 415993A1126 for ; Fri, 25 Mar 2022 07:41:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fastly.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cht8gKHSlPVQ for ; Fri, 25 Mar 2022 07:41:19 -0700 (PDT) Received: from mail-ej1-x62e.google.com (mail-ej1-x62e.google.com [IPv6:2a00:1450:4864:20::62e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F4593A1053 for ; Fri, 25 Mar 2022 07:41:14 -0700 (PDT) Received: by mail-ej1-x62e.google.com with SMTP id bi12so15841669ejb.3 for ; Fri, 25 Mar 2022 07:41:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastly.com; s=google; h=date:from:to:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=lmfR2ZSkrRNxhu6v5Vg/1ydivaCxISa4MNCWdgAWyMs=; b=PCW3f52a3linsoNFZVWT84o9lfneRXix0PJC4U+PFzm0+qJvLHHNb5pQQtq/msc+m8 clTz4snY11gshMQ1Dbfel/ZxPD/Kb2LRBYroB7CyQ41X4Aj0AIZt2DIrA/D7XDft11cI VZ0Q2XvQ/d1On7N+4NSYat36nr8yQXx4ISO/A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=lmfR2ZSkrRNxhu6v5Vg/1ydivaCxISa4MNCWdgAWyMs=; b=XqzcCFyQtLc8HYb0VwgIGRLEYCczipXIA2VrUWrPEhU5V52HlAi4UopOj6nNnurOTG PcbHQfVPzfb48GPFlx/mZQD2dcBxNuBB1V2m5+Jj7JhAWlzTTaRQjmJ6/7y7/RkUVZns bmy90A//mXcXKg3bDdAX/f9kXlOiTrsCm5moyJXZVn0OfAWLyqN7D/+DhcQlMht/OUQI rIlrTOWt3vaRca6m9bMGOpJ+3t36jM3IUI+wPBtW+ssfQGyH3QUZOW/IPHFKjrzxEQKE Cnhbk/Wo9OA+FbKfyfZ2qx6oGmv0emQBPW4RXx0nxUdCjPupYQdllynHleaoZv8DQNqT dXYA== X-Gm-Message-State: AOAM530DsSzyFUzD5BUD9w/AjVCJ8vLPxb0/GGMQ17Dyo4kZdHYOwOV5 y/aHGql/kx2nYDb9B151YjLvItOC3q/4JTeOuJW2t352Yue02M3U8O/Yj3MNkcS1thzmeiOCcjO FW2TYvFxuFm8f93Za4R+8Gar4tfSzD+1naSPrUqbyfRQGn1HrGqRE+Tv81w== X-Google-Smtp-Source: ABdhPJzMdrEbYtgthdeWq7Z8lLmb0HNUz9Nrd3HojnSmFV8Hb+QjFoyoWBeOGgMIjbBy8vcomAU5eQ== X-Received: by 2002:a17:907:8d1a:b0:6df:e513:540a with SMTP id tc26-20020a1709078d1a00b006dfe513540amr11898866ejc.340.1648219271740; Fri, 25 Mar 2022 07:41:11 -0700 (PDT) Received: from snel ([2a10:3781:276:2:16f6:d8ff:fe47:2eb7]) by smtp.gmail.com with ESMTPSA id a1-20020a1709063e8100b006ce06ed8aa7sm2430551ejj.142.2022.03.25.07.41.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Mar 2022 07:41:11 -0700 (PDT) Date: Fri, 25 Mar 2022 15:41:09 +0100 From: Job Snijders To: sidrops@ietf.org Message-ID: References: <164467776886.6200.12411287308620405950@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <164467776886.6200.12411287308620405950@ietfa.amsl.com> X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Sidrops] I-D Action: draft-ietf-sidrops-rpki-rsc-06.txt X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Mar 2022 14:41:34 -0000 Dear chairs, WG, Following up on today's SIDROPS session @ IETF 113: the authors would like to request Working Group Last Call for this Internet-Draft. Warren "Ace" Kumari asked about interaction between draft-ietf-sidrops-rpki-has-no-identity and the RSC draft at hand, I believe this is covered in the second paragraph of Section 7: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-rsc#section-7 Kind regards, Job On Sat, Feb 12, 2022 at 06:56:08AM -0800, internet-drafts@ietf.org wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the SIDR Operations WG of the IETF. > > Title : Resource Public Key Infrastructure (RPKI) object profile for Signed Checklist (RSC) > Authors : Job Snijders > Tom Harrison > Ben Maddison > Filename : draft-ietf-sidrops-rpki-rsc-06.txt > Pages : 15 > Date : 2022-02-12 > > Abstract: > This document defines a Cryptographic Message Syntax (CMS) profile > for a general purpose listing of checksums (a 'checklist'), for use > with the Resource Public Key Infrastructure (RPKI). The objective is > to allow an attestation, in the form of a listing of one or more > checksums of arbitrary digital objects (files), to be signed "with > resources", and for validation to provide a means to confirm a > specific Internet Resource Holder produced the Signed Checklist. The > profile is intended to provide for the signing of an arbitrary > checksum listing with a specific set of Internet Number Resources. > > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-sidrops-rpki-rsc/ > > There is also an HTML version available at: > https://www.ietf.org/archive/id/draft-ietf-sidrops-rpki-rsc-06.html > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-rpki-rsc-06 > > > Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts > > > _______________________________________________ > Sidrops mailing list > Sidrops@ietf.org > https://www.ietf.org/mailman/listinfo/sidrops From nobody Thu Mar 31 05:33:19 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5774F3A12E7 for ; Thu, 31 Mar 2022 05:33:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ripe.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9TErF38CyRhe for ; Thu, 31 Mar 2022 05:33:11 -0700 (PDT) Received: from molamola.ripe.net (molamola.ripe.net [IPv6:2001:67c:2e8:11::c100:1371]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70B5D3A10C7 for ; Thu, 31 Mar 2022 05:32:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ripe.net; s=s1-ripe-net; h=To:Date:Message-Id:Subject:Mime-Version:Content-Type:From:CC ; bh=NWQGixGGhtiC63G4ClEpmoBP7V2cqyRqoYo6UFCEUO8=; b=s/7RT+E86DvF38ZDv6kNyzht s95j2Zhg4sg4u9DIng/B08D+hPdgDpIVc7ATmYQ+vkYoRlOKOG/t+0qACmk99wJvorx0qxkUBDBY7 CVKaFof3rStJ3ti+YRQFVyU42YR6SCe/lX9ZxMldMb1+5HKeHja0T0fQIzdVbPJc/mnGjsZ6ZOoos c9qMSDpYflyJk2RQJbRmV7ftP+ScEEXBLRtRpF4ExQHWWvF3VU3nSF8f97gyF/spH8RLxpi/pCDxD s0/w1lVV2oPv72LqDgb70EVPeX/rOpKrnJQNX9rtsutkOXrcu3jRQaIv5sVN8hYYTMIxq6bZdIpUt A0aK86SnTQ==; Received: from allealle.ripe.net ([2001:67c:2e8:23::c100:170c]:56400) by molamola.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nZtyX-0002ZL-9d for sidrops@ietf.org; Thu, 31 Mar 2022 14:32:29 +0200 Received: from sslvpn.ipv6.ripe.net ([2001:67c:2e8:9::c100:14e6] helo=smtpclient.apple) by allealle.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nZtyX-00056D-6K for sidrops@ietf.org; Thu, 31 Mar 2022 12:32:29 +0000 From: Ties de Kock Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.80.82.1.1\)) Message-Id: Date: Thu, 31 Mar 2022 14:32:28 +0200 To: SIDR Operations WG X-Mailer: Apple Mail (2.3696.80.82.1.1) X-RIPE-Signature: 059faafd1cc22ebb05e1592c815fe1e1631e58697e8cecab26a724c1cd5b95f7 Archived-At: Subject: [Sidrops] ASPA Validation section in draft-ietf-sidrops-aspa-profile-07 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Mar 2022 12:33:17 -0000 Hi all, I just reviewed a parser/generator for the ASPA object profile, and I = realised that the ASPA validation section currently only includes a single = ASPA-specific validation step. I want to propose expanding this section. At a minimum, I would recommend that this section (also) lists checks = that ensure that: * The version is 0 * The eContentType and content-type signed attribute contain the = correct OID. Please let me know what you think. Kind regards, Ties From nobody Thu Mar 31 06:36:53 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EC723A0FE3 for ; Thu, 31 Mar 2022 06:36:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fastly.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qFak-iuHcOs5 for ; Thu, 31 Mar 2022 06:36:47 -0700 (PDT) Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B6903A0EAF for ; Thu, 31 Mar 2022 06:36:47 -0700 (PDT) Received: by mail-ej1-x631.google.com with SMTP id p15so48132990ejc.7 for ; Thu, 31 Mar 2022 06:36:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastly.com; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=hd3OSHmg7MXCooVr2VzlTJKO8a11EIufq93NygDy6xQ=; b=Oj5V4c/+UN66iiwZohrcAEyxebAdAwp7Ubv3AyfP9ZPtnJsEWEpxU9RPudZcSjwePC ZMRXi7mMRNt/MvDCjCG9prynNaQLLUz39q0HC4TkFOWU7HZXrUH6msJ1FuRiRR0l3cYJ Bx2PHUAawQOhjvH0BHSqut8twnkqh0Zk4+lDE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=hd3OSHmg7MXCooVr2VzlTJKO8a11EIufq93NygDy6xQ=; b=GmzOX40NlhmQtIjE4wdydjb/kbcVmSsp6qNI0votr9VrqJFPaLF4fxBLFkNyxVvcaZ coZTpqngyTYxriZVwPy3j6heBpISnywW6dQqVm8axZ1E+q/gguMFhgUdchb23v611nG6 YDD0wLTr3uownvVXG9hPQmHFC/IJRsBiYe/w9t9xEKf/UiaRhGmquIUSBZ4UGgfBCh7V PZZKGo8mcsb9zZ2GJRrI6xmuTT6fCJSbEKQ5XbUIOICh8xs/MNrdzONk4d5mH5/nTqvB NB0eC7MZYvTXz6VHeE4XHpfmAhmi1HPjFVWAA87yO0gqoqn0q/xCDFhVaJxLruLbUg4z tZsQ== X-Gm-Message-State: AOAM532fTQ/jhAzYR43g4M4tsvHoogFb17AcKfFw4ktQ/g7ovXvBqMhw 4JtfeA5LVMVUj8gvwLZIr3qpIg/7F0jcsw== X-Google-Smtp-Source: ABdhPJwv/ccwrwLeu2yVCNlE/oWtWN1x/kBGxv5hHXQdPU1+gaaD8oAJFNaiVx1v0fh0WnjNo0A8Fg== X-Received: by 2002:a17:906:cc93:b0:6e0:afec:b005 with SMTP id oq19-20020a170906cc9300b006e0afecb005mr4933189ejb.219.1648733805627; Thu, 31 Mar 2022 06:36:45 -0700 (PDT) Received: from snel ([2a10:3781:276:2:16f6:d8ff:fe47:2eb7]) by smtp.gmail.com with ESMTPSA id hr13-20020a1709073f8d00b006dfcc331a42sm9309980ejc.203.2022.03.31.06.36.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 31 Mar 2022 06:36:44 -0700 (PDT) Date: Thu, 31 Mar 2022 15:36:42 +0200 From: Job Snijders To: Ties de Kock Cc: SIDR Operations WG Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Sidrops] ASPA Validation section in draft-ietf-sidrops-aspa-profile-07 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Mar 2022 13:36:53 -0000 Hi Ties, Thanks for reviewing On Thu, Mar 31, 2022 at 02:32:28PM +0200, Ties de Kock wrote: > I just reviewed a parser/generator for the ASPA object profile, and I > realised that the ASPA validation section currently only includes a > single ASPA-specific validation step. I want to propose expanding this > section. > > At a minimum, I would recommend that this section (also) lists checks > that ensure that: > > * The version is 0 I think this already is covered in the draft: § 3.1 states "The version number of the ASProviderAttestation MUST be v0." The above type of text triggers RP developers to implement checks like these: https://github.com/openbsd/src/blob/326af693966ccfc600796f445a88b37549ae3e64/usr.sbin/rpki-client/roa.c#L276-L294 > * The eContentType and content-type signed attribute contain the > correct OID. I think those aspects are covered through RFC 6488, specially § 2.1.3.1 "The eContentType is an OID specifying the type of payload in this signed object and MUST be specified by the Internet Standards Track document that defines the object. > Please let me know what you think. Section 4 of draft-ietf-sidrops-aspa-profile seems to have taken inspiration from RFC 6493 (GBRs) and RFC 6482 (ROAs)'s section on validation, by referencing to RFC 6488. This makes for concise text. Personally I think there is an advantage to making it very clear the RPKI signed object template model is followed, rather than (redundantly) outlining (a subset of) the full decision tree. On the other hand, perhaps this type of section historically has suffered from brevity, and more elaboration is useful? I'm somewhat undecided. Kind regards, Job From nobody Thu Mar 31 08:50:38 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A14813A0EBD for ; Thu, 31 Mar 2022 08:50:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ripe.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vize7LU-Tm8Q for ; Thu, 31 Mar 2022 08:50:30 -0700 (PDT) Received: from mahimahi.ripe.net (mahimahi.ripe.net [IPv6:2001:67c:2e8:11::c100:1372]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76A673A1C93 for ; Thu, 31 Mar 2022 08:49:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ripe.net; s=s1-ripe-net; h=To:Message-Id:Cc:Date:From:Subject:Mime-Version:Content-Type ; bh=19PBt9e5EWBC4sovVaFmHtb4EOihpGoD8F5v8FyvHec=; b=clsp09OHqDMXlmdf1Y4mmwNE gzaz5Qz9y4uyU0N4xnR94NEgf9CTjtfZ8VYNGUPB8mt8UozrXAxrlYeM+QC0OJenqYgNK8sHG5CJe 6b44xKZK2OmXomOGl9iMl64Tb7n1+qcn/EG0mv/sUcC0+yNQmKMCYT8LIFxxTtHDrbbPek/nww0DN j7cyFgDlTLT2y2eer8w1G3bKqh3LKRXh0l9xmrD9nJoajcxwAUMcO//EJ//3RqTqjvcTrL982Y37s OQG6ajP07AcWDmHzPbNTo4jt9w/ucdqt3DLTxzNaqwMgNqIiblbrU2SITGJqU4JbXyUXLFD+S6BBr vvEARLC0dA==; Received: from allealle.ripe.net ([2001:67c:2e8:23::c100:170c]:54550) by mahimahi.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nZx3Z-0008bW-T8; Thu, 31 Mar 2022 17:49:53 +0200 Received: from sslvpn.ipv6.ripe.net ([2001:67c:2e8:9::c100:14e6] helo=smtpclient.apple) by allealle.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nZx3Z-0000qn-Pq; Thu, 31 Mar 2022 15:49:53 +0000 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.80.82.1.1\)) From: Ties de Kock In-Reply-To: Date: Thu, 31 Mar 2022 17:49:53 +0200 Cc: SIDR Operations WG Content-Transfer-Encoding: quoted-printable Message-Id: <22893999-A652-406B-BC02-1E723C798EFC@ripe.net> References: To: Job Snijders X-Mailer: Apple Mail (2.3696.80.82.1.1) X-RIPE-Signature: 059faafd1cc22ebb05e1592c815fe1e1140a35357a027d9284467f25532eb3da Archived-At: Subject: Re: [Sidrops] ASPA Validation section in draft-ietf-sidrops-aspa-profile-07 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Mar 2022 15:50:36 -0000 Hi Job, > On 31 Mar 2022, at 15:36, Job Snijders wrote: >=20 > Hi Ties, >=20 > Thanks for reviewing >=20 > On Thu, Mar 31, 2022 at 02:32:28PM +0200, Ties de Kock wrote: >> I just reviewed a parser/generator for the ASPA object profile, and I >> realised that the ASPA validation section currently only includes a >> single ASPA-specific validation step. I want to propose expanding = this >> section. >>=20 >> At a minimum, I would recommend that this section (also) lists checks >> that ensure that: >>=20 >> * The version is 0 >=20 > I think this already is covered in the draft: =C2=A7 3.1 states "The = version > number of the ASProviderAttestation MUST be v0." >=20 > The above type of text triggers RP developers to implement checks like > these: = https://github.com/openbsd/src/blob/326af693966ccfc600796f445a88b37549ae3e= 64/usr.sbin/rpki-client/roa.c#L276-L294 And if you want to be really strict, that clause is redundant as well. = The default value must not be present in a DER object, and from 6488#3.l it = follows that a non-DER object is invalid. X.690 11.5 Set and sequence components with default value: > The encoding of a set value or sequence value shall not include an = encoding for > any component value which is equal to its default value. But my point here is that RPKI software is written by humans and that = some level of redundancy helps implementations to be closer to first-time-right. >> * The eContentType and content-type signed attribute contain the >> correct OID. >=20 > I think those aspects are covered through RFC 6488, specially =C2=A7 = 2.1.3.1 >=20 > "The eContentType is an OID specifying the type of payload in this > signed object and MUST be specified by the Internet Standards Track > document that defines the object. >=20 >> Please let me know what you think. >=20 > Section 4 of draft-ietf-sidrops-aspa-profile seems to have taken > inspiration from RFC 6493 (GBRs) and RFC 6482 (ROAs)'s section on > validation, by referencing to RFC 6488. This makes for concise text. >=20 > Personally I think there is an advantage to making it very clear the > RPKI signed object template model is followed, rather than = (redundantly) > outlining (a subset of) the full decision tree. >=20 > On the other hand, perhaps this type of section historically has > suffered from brevity, and more elaboration is useful? I'm somewhat > undecided. I agree that it is good to be very clear that the RPKI signed object = model is followed. That is a key concept to understand when implementing. However, there is a balance between trusting that the reader is aware of = implicit information and redundantly outlining processing steps. At this point in = time I feel like that there is a benefit to more explicitly list the MUSTs from = the other sections of the draft that we expect RPs to check. Kind regards, Ties= From nobody Thu Mar 31 09:33:44 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1705E3A1356 for ; Thu, 31 Mar 2022 09:33:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.109 X-Spam-Level: X-Spam-Status: No, score=-7.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fastly.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mvv_ELtKz3E9 for ; Thu, 31 Mar 2022 09:33:37 -0700 (PDT) Received: from mail-ej1-x62f.google.com (mail-ej1-x62f.google.com [IPv6:2a00:1450:4864:20::62f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 682293A0EF9 for ; Thu, 31 Mar 2022 09:33:37 -0700 (PDT) Received: by mail-ej1-x62f.google.com with SMTP id c10so392644ejs.13 for ; Thu, 31 Mar 2022 09:33:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastly.com; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=MbsyrSiGi3IITP71GPoDXhs4q2oFCbIDKhyqsQSFCxw=; b=EizDDvJqjbu2td0ehqY+QSW+BEV6VPXJYxYAbrLb65va02Ke7X1diWML9pwi0RFp/2 N3HY0N/ooJPDk7XBM+Ln/01jSjGV3lxkLD5vAwhfLhdpo0asMq0JIZytwwEqDV5wu0++ x9q3OM84cZrNXJEY53MkaLnY4pAL/5iyMrPfo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=MbsyrSiGi3IITP71GPoDXhs4q2oFCbIDKhyqsQSFCxw=; b=138h1epLG5u944xRyxW4hrXvNk9PjEtxiizvW3lCb13xwDBk+6vNcwmjI4lqPJqZVy 7BM5/34FCgYAAcGMCWW9SSuPIZnRwt0lWptaGsZY68fy7EepDx7SvmdTK/hCbuJaWBBx V24frce1aMRUG94kZCv+chFau5wzPCNh6RUT1JJHLESGuJ91JGdFxxyJ9Ld3ZbqnzrEi 8NAHoT4I4P+/U91+7r+oRSyGcpyVD5tnGqPlo3qrrd9PxZZSh3bf/esJFnP/4wz01ELm E/UYbuhFNq0cVc4Vfc71NOHZVDcPYzbCkN2VRuN15CRjTieMwTjGTC1pr7XW9RH0J9T8 P8ZA== X-Gm-Message-State: AOAM530cPqXc5J/cnpeuPWj+hVAQ9sRnE8TW1ZXYleThBCzuleTepgDF KzM5tDeS5esVCGq4HbzNuEUDtw== X-Google-Smtp-Source: ABdhPJyHJcOZPt6ATP4vfaSS+rbCfQjLmPf00O1BZPoKS6xG+QVDv+AUXUh3Axtty5u/k/n/h6aEKg== X-Received: by 2002:a17:907:7289:b0:6df:9746:e7c4 with SMTP id dt9-20020a170907728900b006df9746e7c4mr5838607ejc.497.1648744415364; Thu, 31 Mar 2022 09:33:35 -0700 (PDT) Received: from snel ([2a10:3781:276:2:16f6:d8ff:fe47:2eb7]) by smtp.gmail.com with ESMTPSA id a5-20020aa7cf05000000b0041919e52a38sm11248279edy.46.2022.03.31.09.33.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 31 Mar 2022 09:33:34 -0700 (PDT) Date: Thu, 31 Mar 2022 18:33:33 +0200 From: Job Snijders To: Ties de Kock Cc: SIDR Operations WG Message-ID: References: <22893999-A652-406B-BC02-1E723C798EFC@ripe.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <22893999-A652-406B-BC02-1E723C798EFC@ripe.net> X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Sidrops] ASPA Validation section in draft-ietf-sidrops-aspa-profile-07 X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Mar 2022 16:33:42 -0000 Dear Ties, On Thu, Mar 31, 2022 at 05:49:53PM +0200, Ties de Kock wrote: > However, there is a balance between trusting that the reader is aware > of implicit information and redundantly outlining processing steps. At > this point in time I feel like that there is a benefit to more > explicitly list the MUSTs from the other sections of the draft that we > expect RPs to check. A potential downside of repeating normative language from the Signed Object Template RFC is that if there ever is an update to the template, all the RFCs that duplicated the checklist also must be patched. But it's worth a try to see if the spec seems improved if it is made a bit more verbose. Please feel free to suggest text to the document authors! :-) The XML lives here: https://github.com/QratorLabs/ASPA Kind regards, Job From nobody Thu Mar 31 12:46:38 2022 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B48003A0105 for ; Thu, 31 Mar 2022 12:46:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RwGOwI8xbDz3 for ; Thu, 31 Mar 2022 12:46:35 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9EC533A0063 for ; Thu, 31 Mar 2022 12:46:35 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.93) (envelope-from ) id 1na0kb-000VDz-FC for sidrops@ietf.org; Thu, 31 Mar 2022 19:46:33 +0000 Date: Thu, 31 Mar 2022 12:46:32 -0700 Message-ID: From: Randy Bush To: SIDR Operations WG User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: [Sidrops] draft-ietf-sidrops-rov-no-rr X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Mar 2022 19:46:37 -0000 could we do a wglc on draft-ietf-sidrops-rov-no-rr? randy