From spkm-bounces@ietf.org Fri Nov 03 14:36:37 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gg4qD-0000Q8-SM; Fri, 03 Nov 2006 14:36:37 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gg4qD-0000NN-4E for spkm@ietf.org; Fri, 03 Nov 2006 14:36:37 -0500 Received: from smtpde02.sap-ag.de ([155.56.68.170]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Gg4q9-0005ki-N4 for spkm@ietf.org; Fri, 03 Nov 2006 14:36:37 -0500 Received: from sap-ag.de (smtpde02) by smtpde02.sap-ag.de (out) with ESMTP id UAA21089; Fri, 3 Nov 2006 20:36:20 +0100 (MEZ) From: Martin Rex Message-Id: <200611031936.UAA16703@uw1048.wdf.sap.corp> Subject: Re: [SPKM] Interoperability To: Nicolas.Williams@sun.com (Nicolas Williams) Date: Fri, 3 Nov 2006 20:36:19 +0100 (MET) In-Reply-To: <20061031211246.GT28107@binky.Central.Sun.COM> from "Nicolas Williams" at Oct 31, 6 03:12:46 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Cc: hartmans-ietf@mit.edu, spkm@ietf.org X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org Nicolas Williams wrote: > > On Tue, Oct 31, 2006 at 02:23:50PM -0500, Sam Hartman wrote: > > * When will we get a spec out? How long will the market wait? > > Sometimes, you have to accept that the market will deploy something > > and you have little influence on it. In those cases it's better to > > write a compelling spec and hope that people will migrate. Other > > times, if you can stretch to meet market timing, you can avoid the > > market deploying something that does not meet your spec. That is > > very desirable. > > If we cannot get a spec that will meet our needs in time for the market > then the proposed protocol could go to Informational and a spec that > does meet our needs can later go to Proposed-Standard, using a different > OID. There is a problem in the traditional (simple) GSS-API and how it is embedded within several application protocols, that there is no negotiation of a mechanism (OID). In real distributed environments, where a component is both, server and client, a switch to a new OID might require a "flag day". Depending on the implementation (and we know that SPKM is underspecified in this area), an updated enhanced GSS-API mechanism might use the new OID also in the generic framing of the exported binary canonical name, and as a result might not reuse any of the existing ACLs based on binary canonical names... The use of the mechanism OID in the generic framing of exported binary canonical names was (primarily) meant to prevent accidental collisions of two names from distinct namespaces referring to distinct entities, not to ultimately require distinct exported names based on the employed authentication mechanism (although I admit that some saw this as a potential feature, being able to distinguish mechanisms of different strength in the ACL). Personally, I see a real benefit if mechanisms sharing a common namespace can share ACLs, be that ACLs with printable or binary canonical names. -Martin _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Fri Nov 03 15:25:45 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gg5bl-0006Xf-Om; Fri, 03 Nov 2006 15:25:45 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gg5bk-0006XN-9h; Fri, 03 Nov 2006 15:25:44 -0500 Received: from smtpde01.sap-ag.de ([155.56.68.171]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Gg5bh-0005AG-SI; Fri, 03 Nov 2006 15:25:44 -0500 Received: from sap-ag.de (smtpde01) by smtpde01.sap-ag.de (out) with ESMTP id VAA11519; Fri, 3 Nov 2006 21:25:38 +0100 (MEZ) From: Martin Rex Message-Id: <200611032025.VAA17840@uw1048.wdf.sap.corp> To: hartmans-ietf@mit.edu (Sam Hartman) Date: Fri, 3 Nov 2006 21:25:38 +0100 (MET) In-Reply-To: from "Sam Hartman" at Oct 31, 6 12:08:25 pm MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-SAP: out X-SAP: out X-Spam-Score: 0.0 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 Cc: tls@ietf.org, spkm@ietf.org Subject: [SPKM] Re: [TLS] DTLS and GSS-API X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org Sam Hartman wrote: > > Monday morning at IETF 67 there is a really important BOF: SPKM. > > The purpose of this BOF is to decide how we will get a standards track > solution for NFSV4 to use PKI credentials. Two modes are important: a > mode where both parties have credentials and a mode where the server > has a certificate and the client has a password. > > The current proposal is based off draft-adamson-rfc2847-01.txt. > Several reviewers including Eric Rescorla and myself have expressed > concerns about this draft. I noticed Erics comments about the crypto algorithms, how they're enumerated and combined. Without checking the details, I believe this stuff is more-or-less a straight copy from the original SPKM spec (rfc-2025), not a conscious selection of the current document author, and a result of trying to remain backwards compatible as much as possible, and not because it is any useful. > > > An alternate proposal for solving this problem was discussed in the > past: construct a GSS-API mechanism based on DTLS. Advantages of this > solution include reuse of code and specification between GSS-API and > TLS implementations. When new ciphers are specified for TLS they > would be available for NFS. We would not need to keep updating a GSS > mechanism as public-key algorithms evolve and problems are found. > > There are two main drawbacks I've heard to the DTLS proposal. First, > we don't have a draft. Second, it would not be interoperable with > SPKM-3 deployments. There is a substantial difference between GSS-API and TLS which should not be ignored: In the GSS-API architecture, context level tokens (which exchange cryptographic material and perform the authentication) can only be exchanged at the beginning. After a security context has been established, the message flow depends entirely on the communication characteristics of the application, and may be entirey uni-directional and may preclude even alien attempts of a gssapi mechanism to piggy-back context-token on protected message tokens. With TLS, on the other hand, each of the communication peers may request a renegotiation of context parameters at (almost) any time during the communication. A GSS-API mechanism built on TLS should not attempt to piggy-back any additional information on protected message tokens (and make assumptions about the communcation characteritics of the application caller). Some applications will break when the message protection token size (get_mic) or the message size increase (wrap) increases considerably in order to accomodate piggy-backed context-update. Some GSS-API applications may not be able to cope with it -- the message protection overhead is expected to be fairly low in GSS-API, and applications have been encouraged to squeeze tighltly with the introduction of "gss_wrap_size_limit()" in GSS-API v2. -Martin _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Fri Nov 03 17:28:29 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gg7WW-0005Ij-Uy; Fri, 03 Nov 2006 17:28:28 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gg7VW-0003rR-Sv for spkm@ietf.org; Fri, 03 Nov 2006 17:27:26 -0500 Received: from carter-zimmerman.suchdamage.org ([69.25.196.178] helo=carter-zimmerman.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Gg7Ut-00048y-41 for spkm@ietf.org; Fri, 03 Nov 2006 17:26:48 -0500 Received: by carter-zimmerman.mit.edu (Postfix, from userid 8042) id EF63EE0035; Fri, 3 Nov 2006 17:26:35 -0500 (EST) From: Sam Hartman To: martin.rex@sap.com Subject: Re: [SPKM] Interoperability References: <200611031936.UAA16703@uw1048.wdf.sap.corp> Date: Fri, 03 Nov 2006 17:26:35 -0500 In-Reply-To: <200611031936.UAA16703@uw1048.wdf.sap.corp> (Martin Rex's message of "Fri, 3 Nov 2006 20:36:19 +0100 (MET)") Message-ID: User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.1 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Cc: spkm@ietf.org X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org >>>>> "Martin" == Martin Rex writes: Martin> Nicolas Williams wrote: >> >> On Tue, Oct 31, 2006 at 02:23:50PM -0500, Sam Hartman wrote: >> > * When will we get a spec out? How long will the market >> wait? > Sometimes, you have to accept that the market will >> deploy something > and you have little influence on it. In >> those cases it's better to > write a compelling spec and hope >> that people will migrate. Other > times, if you can stretch to >> meet market timing, you can avoid the > market deploying >> something that does not meet your spec. That is > very >> desirable. >> >> If we cannot get a spec that will meet our needs in time for >> the market then the proposed protocol could go to Informational >> and a spec that does meet our needs can later go to >> Proposed-Standard, using a different OID. Martin> There is a problem in the traditional (simple) GSS-API and Martin> how it is embedded within several application protocols, Martin> that there is no negotiation of a mechanism (OID). In Martin> real distributed environments, where a component is both, Martin> server and client, a switch to a new OID might require a Martin> "flag day". This BOF at least is has a primary goal of trying to solve the problem for NFS which does have a negotiation mechanism. We, implementeres are also trying to make SPNEGO much more widely available. However you are completely correct that upgrading a specific deployment can be difficult in the absence of negotiation. I'm not sure what to do about this problem other than acknowledge it and encourage use of negotiation. _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Sun Nov 05 14:42:08 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ggnsa-0007vB-7n; Sun, 05 Nov 2006 14:42:04 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GgnsY-0007v0-Ld; Sun, 05 Nov 2006 14:42:02 -0500 Received: from [130.129.68.116] (helo=carter-zimmerman.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1GgnsX-0006r9-BZ; Sun, 05 Nov 2006 14:42:02 -0500 Received: by carter-zimmerman.mit.edu (Postfix, from userid 8042) id 20EE6E0038; Sun, 5 Nov 2006 14:41:53 -0500 (EST) From: Sam Hartman To: martin.rex@sap.com Subject: Re: [SPKM] Re: [TLS] DTLS and GSS-API References: <200611032025.VAA17840@uw1048.wdf.sap.corp> Date: Sun, 05 Nov 2006 14:41:53 -0500 In-Reply-To: <200611032025.VAA17840@uw1048.wdf.sap.corp> (Martin Rex's message of "Fri, 3 Nov 2006 21:25:38 +0100 (MET)") Message-ID: User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Cc: tls@ietf.org, spkm@ietf.org X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org >>>>> "Martin" == Martin Rex writes: >> >> An alternate proposal for solving this problem was discussed in >> the past: construct a GSS-API mechanism based on DTLS. >> Advantages of this solution include reuse of code and >> specification between GSS-API and TLS implementations. When >> new ciphers are specified for TLS they would be available for >> NFS. We would not need to keep updating a GSS mechanism as >> public-key algorithms evolve and problems are found. >> >> There are two main drawbacks I've heard to the DTLS proposal. >> First, we don't have a draft. Second, it would not be >> interoperable with SPKM-3 deployments. Martin> There is a substantial difference between GSS-API and TLS Martin> which should not be ignored: In the GSS-API architecture, Martin> context level tokens (which exchange cryptographic Martin> material and perform the authentication) can only be Martin> exchanged at the beginning. Martin> After a security context has been established, the message Martin> flow depends entirely on the communication characteristics Martin> of the application, and may be entirey uni-directional and Martin> may preclude even alien attempts of a gssapi mechanism to Martin> piggy-back context-token on protected message tokens. Martin> With TLS, on the other hand, each of the communication Martin> peers may request a renegotiation of context parameters at Martin> (almost) any time during the communication. I talked to Eric about this in another context. He claimed that as a practical matter it does not work if animplementation does a new handshake without the cooperation of the upper-layer application. You are correct though that a DTLS GSS-API mechanism could only be specified on the standards track if this issue were dealt with in some manner that preserved the GSS-API model. _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Sun Nov 05 19:39:42 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1GgsWc-0000qG-Qg; Sun, 05 Nov 2006 19:39:42 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GgsWa-0000nk-MR; Sun, 05 Nov 2006 19:39:40 -0500 Received: from nwkea-mail-1.sun.com ([192.18.42.13]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1GgsWV-00035g-Sl; Sun, 05 Nov 2006 19:39:40 -0500 Received: from centralmail3brm.Central.Sun.COM ([129.147.62.199]) by nwkea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id kA60dYDH013228; Sun, 5 Nov 2006 16:39:35 -0800 (PST) Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by centralmail3brm.Central.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id kA60dX2U008726; Sun, 5 Nov 2006 17:39:34 -0700 (MST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.13.6+Sun/8.13.6) with ESMTP id kA60dWL9026426; Sun, 5 Nov 2006 18:39:33 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.13.6+Sun/8.13.6/Submit) id kA60dWnN026425; Sun, 5 Nov 2006 18:39:32 -0600 (CST) Date: Sun, 5 Nov 2006 18:39:32 -0600 From: Nicolas Williams To: Sam Hartman Subject: Re: [SPKM] Re: [TLS] DTLS and GSS-API Message-ID: <20061106003931.GD25646@binky.Central.Sun.COM> References: <200611032025.VAA17840@uw1048.wdf.sap.corp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.7i X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Cc: spkm@ietf.org, tls@ietf.org X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org On Sun, Nov 05, 2006 at 02:41:53PM -0500, Sam Hartman wrote: > Martin> With TLS, on the other hand, each of the communication > Martin> peers may request a renegotiation of context parameters at > Martin> (almost) any time during the communication. > > I talked to Eric about this in another context. He claimed that as a > practical matter it does not work if animplementation does a new > handshake without the cooperation of the upper-layer application. You > are correct though that a DTLS GSS-API mechanism could only be > specified on the standards track if this issue were dealt with in some > manner that preserved the GSS-API model. I would expect that a GSS-TLS mechanism wouldn't renegotiate anything after initial security context establishment. If there is a hard need to (e.g., for re-keying), then expire the security context[*]. Alternatively, one of the things we've discussed is using TLS for security context establishment, but the Kerberos V mechanism's per-message tokens for per-message tokens, using the TLS PRF and master secret to derive keys for them. That would hand wave TLS re-negotiation issues away as well, and would deal with re-key crypto needs no better nor worse than the Kerberos V mechanisms. IOW, this is not an issue (and if it is, then it's an issue for GSS-API applications, and, maybe, for the GSS-APIv3 and v3 apps). [*] GSS apps have to be prepared to deal with this; the SASL GSS bridges, admittedly, don't. Nico -- _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Mon Nov 06 12:42:01 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gh8Tw-0008NQ-VM; Mon, 06 Nov 2006 12:42:00 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gh88d-0002CI-9Y for spkm@ietf.org; Mon, 06 Nov 2006 12:19:59 -0500 Received: from [130.129.68.116] (helo=carter-zimmerman.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Gh88W-0005yu-Fa for spkm@ietf.org; Mon, 06 Nov 2006 12:19:59 -0500 Received: by carter-zimmerman.mit.edu (Postfix, from userid 8042) id DA029E0038; Mon, 6 Nov 2006 12:19:49 -0500 (EST) From: Sam Hartman To: spkm@ietf.org Date: Mon, 06 Nov 2006 12:19:49 -0500 Message-ID: User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.1 (/) X-Scan-Signature: 6d62ab47271805379d7172ee693a45db X-Mailman-Approved-At: Mon, 06 Nov 2006 12:41:59 -0500 Subject: [SPKM] Alternate jabber room: spkm@conference.ecotroph.net X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org Folks, while we are waiting for the ietf jabber server to be fixed, let's use spkm@conference.ecotroph.net --Sam _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Mon Nov 06 13:04:26 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gh8pe-0005uS-HD; Mon, 06 Nov 2006 13:04:26 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gh8pd-0005uI-LP for spkm@ietf.org; Mon, 06 Nov 2006 13:04:25 -0500 Received: from [130.129.68.116] (helo=carter-zimmerman.mit.edu) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Gh8pb-0003Vg-HI for spkm@ietf.org; Mon, 06 Nov 2006 13:04:25 -0500 Received: by carter-zimmerman.mit.edu (Postfix, from userid 8042) id 23128E0038; Mon, 6 Nov 2006 13:04:10 -0500 (EST) From: Sam Hartman To: spkm@ietf.org Subject: Re: [SPKM] Alternate jabber room: spkm@conference.ecotroph.net References: Date: Mon, 06 Nov 2006 13:04:10 -0500 In-Reply-To: (Sam Hartman's message of "Mon, 06 Nov 2006 12:19:49 -0500") Message-ID: User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.1 (/) X-Scan-Signature: bb8eae9af85e4fcfe76f325e38493bf4 X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org Although it appears people are actually hanging out on spkm@conference.jis.mit.edu _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Mon Nov 06 14:52:25 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1GhAW9-0004tw-1B; Mon, 06 Nov 2006 14:52:25 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GhAW7-0004tj-Cb for spkm@ietf.org; Mon, 06 Nov 2006 14:52:23 -0500 Received: from brmea-mail-1.sun.com ([192.18.98.31]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1GhAW3-0007Tl-WF for spkm@ietf.org; Mon, 06 Nov 2006 14:52:23 -0500 Received: from centralmail3brm.Central.Sun.COM ([129.147.62.199]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id kA6JqJD9026663 for ; Mon, 6 Nov 2006 12:52:19 -0700 (MST) Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by centralmail3brm.Central.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL, v2.2) with ESMTP id kA6JqIMB003805 for ; Mon, 6 Nov 2006 12:52:19 -0700 (MST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.13.6+Sun/8.13.6) with ESMTP id kA6JqIc4027162 for ; Mon, 6 Nov 2006 13:52:18 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.13.6+Sun/8.13.6/Submit) id kA6JqHHp027161 for spkm@ietf.org; Mon, 6 Nov 2006 13:52:17 -0600 (CST) Date: Mon, 6 Nov 2006 13:52:17 -0600 From: Nicolas Williams To: spkm@ietf.org Message-ID: <20061106195216.GL25646@binky.Central.Sun.COM> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.7i X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Subject: [SPKM] One more solution path X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org No WG, no design team to make a decision, just this: The first proposal in this space that makes it past the IESG as Proposed Standard is the only one that does. If more than one proposal makes it to the IESG before the IESG approves of one, then the IESG will decide which one to progress to Proposed Standard (unless the IESG feels generous, I suppose). It sounded like Mike wants something that re-uses RFC4121 per-msg tokens to make kernel-land implementations trivial. I agree. I too would like to drop the idea of using DTLS record messages for per-msg tokens (I had that option in my proposal only to satisfy any purists). It also sounds like Larry wants something that re-uses technology that's already at his disposal, that being either PKINIT or TLS. And I'm willing to go with any of SSiLKeY/PKU2U/GSS-TLS. I prefer GSS-TLS (with RFC4121 per-msg tokens) and believe it will be easier for Mike and Larry to implement GSS-TLS than it will be to implement their alternatives, but I'm very much open to being convinced that either SSiLKEY or PKU2U will do. So it sounds like Mike, Larry and I can work on a proposal that isn't SPKM. I.e., there are really only TWO proposals here: SPKM-3+ and not-SPKM-3. The not-SPKM-3 proposals being aimed at re-using existing specs and code as much as possible. Cheers, Nico -- _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Mon Nov 06 15:08:44 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1GhAlw-0007tw-2r; Mon, 06 Nov 2006 15:08:44 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GhAlu-0007qW-Or for spkm@ietf.org; Mon, 06 Nov 2006 15:08:42 -0500 Received: from smtpde03.sap-ag.de ([155.56.68.140]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1GhAlt-0000zs-CX for spkm@ietf.org; Mon, 06 Nov 2006 15:08:42 -0500 Received: from sap-ag.de (smtpde03) by smtpde03.sap-ag.de (out) with ESMTP id VAA16779 for ; Mon, 6 Nov 2006 21:08:28 +0100 (MEZ) From: Martin Rex Message-Id: <200611062008.VAA27797@uw1048.wdf.sap.corp> To: spkm@ietf.org Date: Mon, 6 Nov 2006 21:08:28 +0100 (MET) MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SAP: out X-Spam-Score: 1.1 (+) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 Subject: [SPKM] DName canonicalization rules in draft-adamson-rfc2847-bis X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: martin.rex@sap.com List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org The canonicalization rules in draft-adamson-rfc2847-bis-01.txt currently says 2.5.1.4 Exported Name Object Form -- DirectoryString attribute values of type PrintableString and UTF8String are not in hexadecimal format -- DirectoryString attribute values of types other than PrintableString and UTF8String are output in hexadecimal format What about IA5String? I don't think that IA5String has ever been (ab)used in a controversial fashion, and since it is a subset of UTF8String, I would prefer to see then NOT hexencoded as well. -Martin _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Tue Nov 07 04:50:48 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1GhNbU-000481-0r; Tue, 07 Nov 2006 04:50:48 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GhNbS-00047r-Np; Tue, 07 Nov 2006 04:50:46 -0500 Received: from maila.microsoft.com ([131.107.115.212] helo=smtp.microsoft.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1GhNbK-0000Ve-9z; Tue, 07 Nov 2006 04:50:46 -0500 Received: from mailout6.microsoft.com (157.54.69.150) by TK5-EXGWY-E801.partners.extranet.microsoft.com (10.251.56.50) with Microsoft SMTP Server id 8.0.685.10; Tue, 7 Nov 2006 01:50:37 -0800 Received: from IGT-HUB-01.redmond.corp.microsoft.com ([157.54.69.148]) by mailout6.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 7 Nov 2006 01:50:36 -0800 Received: from TK5-EXHUB-C101.redmond.corp.microsoft.com ([157.54.70.76]) by IGT-HUB-01.redmond.corp.microsoft.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.2786); Tue, 7 Nov 2006 01:50:36 -0800 Received: from win-imc-01.wingroup.windeploy.ntdev.microsoft.com (157.54.0.39) by TK5-EXHUB-C101.redmond.corp.microsoft.com (157.54.70.76) with Microsoft SMTP Server id 8.0.685.0; Tue, 7 Nov 2006 01:50:35 -0800 Received: from WIN-MSG-20.wingroup.windeploy.ntdev.microsoft.com ([157.54.62.24]) by win-imc-01.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.2786); Tue, 7 Nov 2006 01:50:35 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C70252.137285A1" Date: Tue, 7 Nov 2006 01:49:54 -0800 Message-ID: X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: PKU2U ID Thread-Index: AccCUhOie6a+Br7iTSWJo47zceIgvA== From: "Liqiang(Larry) Zhu" To: , X-OriginalArrivalTime: 07 Nov 2006 09:50:35.0460 (UTC) FILETIME=[2C25D840:01C70252] X-Spam-Score: 0.2 (/) X-Scan-Signature: 5a5294b34f62cf4aba63c62e30e627ff Cc: jaltman@secure-endpoints.com Subject: [SPKM] PKU2U ID X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org ------_=_NextPart_001_01C70252.137285A1 Content-Type: multipart/alternative; boundary="----_=_NextPart_002_01C70252.137285A1" ------_=_NextPart_002_01C70252.137285A1 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Per discussion in the BOF on Monday I am posting the PKU2U ID.=20 =20 Per an request from Jeff, I included kitten. =20 I spent sometime today to unify PKU2U with WS-KERB, and updated WS-KERB to have consistent terminology here. The updated -01 is also attached. Thanks. =20 --Larry ------_=_NextPart_002_01C70252.137285A1 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Per discussion in the BOF on Monday I am posting = the PKU2U ID.

 

Per an request from Jeff, I included = kitten.

 

I spent sometime today to unify PKU2U with WS-KERB, = and updated WS-KERB to have consistent terminology here. The updated -01 is = also attached. Thanks.

 

--Larry

------_=_NextPart_002_01C70252.137285A1-- ------_=_NextPart_001_01C70252.137285A1 Content-Type: text/plain; name="draft-zhu-pku2u-00.txt" Content-Transfer-Encoding: base64 Content-Description: draft-zhu-pku2u-00.txt Content-Disposition: attachment; filename="draft-zhu-pku2u-00.txt" DQoNCk5FVFdPUksgV09SS0lORyBHUk9VUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEwuIFpodQ0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgQS4gTWVkdmluc2t5DQpVcGRhdGVzOiA0MTIwIChpZiBh cHByb3ZlZCkgICAgICAgICAgICAgICAgICAgICAgICBNaWNyb3NvZnQgQ29ycG9yYXRpb24NCklu dGVuZGVkIHN0YXR1czogU3RhbmRhcmRzIFRyYWNrICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIEouIEFsdG1hbg0KRXhwaXJlczogTWF5IDExLCAyMDA3ICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIFNlY3VyZSBFbmQgUG9pbnRzDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE5vdmVtYmVyIDcsIDIwMDYNCg0KDQogIFB1 YmxpYyBLZXkgQ3J5cHRvZ3JhcGh5IGJhc2VkIFVzZXIgdG8gVXNlciBBdXRoZW50aWNhdGlvbiAt IChQS1UyVSkNCiAgICAgICAgICAgICAgICAgICAgICAgICAgIGRyYWZ0LXpodS1wa3UydS0wMA0K DQpTdGF0dXMgb2YgdGhpcyBNZW1vDQoNCiAgIEJ5IHN1Ym1pdHRpbmcgdGhpcyBJbnRlcm5ldC1E cmFmdCwgZWFjaCBhdXRob3IgcmVwcmVzZW50cyB0aGF0IGFueQ0KICAgYXBwbGljYWJsZSBwYXRl bnQgb3Igb3RoZXIgSVBSIGNsYWltcyBvZiB3aGljaCBoZSBvciBzaGUgaXMgYXdhcmUNCiAgIGhh dmUgYmVlbiBvciB3aWxsIGJlIGRpc2Nsb3NlZCwgYW5kIGFueSBvZiB3aGljaCBoZSBvciBzaGUg YmVjb21lcw0KICAgYXdhcmUgd2lsbCBiZSBkaXNjbG9zZWQsIGluIGFjY29yZGFuY2Ugd2l0aCBT ZWN0aW9uIDYgb2YgQkNQIDc5Lg0KDQogICBJbnRlcm5ldC1EcmFmdHMgYXJlIHdvcmtpbmcgZG9j dW1lbnRzIG9mIHRoZSBJbnRlcm5ldCBFbmdpbmVlcmluZw0KICAgVGFzayBGb3JjZSAoSUVURiks IGl0cyBhcmVhcywgYW5kIGl0cyB3b3JraW5nIGdyb3Vwcy4gIE5vdGUgdGhhdA0KICAgb3RoZXIg Z3JvdXBzIG1heSBhbHNvIGRpc3RyaWJ1dGUgd29ya2luZyBkb2N1bWVudHMgYXMgSW50ZXJuZXQt DQogICBEcmFmdHMuDQoNCiAgIEludGVybmV0LURyYWZ0cyBhcmUgZHJhZnQgZG9jdW1lbnRzIHZh bGlkIGZvciBhIG1heGltdW0gb2Ygc2l4IG1vbnRocw0KICAgYW5kIG1heSBiZSB1cGRhdGVkLCBy ZXBsYWNlZCwgb3Igb2Jzb2xldGVkIGJ5IG90aGVyIGRvY3VtZW50cyBhdCBhbnkNCiAgIHRpbWUu ICBJdCBpcyBpbmFwcHJvcHJpYXRlIHRvIHVzZSBJbnRlcm5ldC1EcmFmdHMgYXMgcmVmZXJlbmNl DQogICBtYXRlcmlhbCBvciB0byBjaXRlIHRoZW0gb3RoZXIgdGhhbiBhcyAid29yayBpbiBwcm9n cmVzcy4iDQoNCiAgIFRoZSBsaXN0IG9mIGN1cnJlbnQgSW50ZXJuZXQtRHJhZnRzIGNhbiBiZSBh Y2Nlc3NlZCBhdA0KICAgaHR0cDovL3d3dy5pZXRmLm9yZy9pZXRmLzFpZC1hYnN0cmFjdHMudHh0 Lg0KDQogICBUaGUgbGlzdCBvZiBJbnRlcm5ldC1EcmFmdCBTaGFkb3cgRGlyZWN0b3JpZXMgY2Fu IGJlIGFjY2Vzc2VkIGF0DQogICBodHRwOi8vd3d3LmlldGYub3JnL3NoYWRvdy5odG1sLg0KDQog ICBUaGlzIEludGVybmV0LURyYWZ0IHdpbGwgZXhwaXJlIG9uIE1heSAxMSwgMjAwNy4NCg0KQ29w eXJpZ2h0IE5vdGljZQ0KDQogICBDb3B5cmlnaHQgKEMpIFRoZSBJbnRlcm5ldCBTb2NpZXR5ICgy MDA2KS4NCg0KQWJzdHJhY3QNCg0KICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIHRoZSBQdWJsaWMg S2V5IENyeXB0b2dyYXBoeSBiYXNlZCBVc2VyIHRvIFVzZXINCiAgIGF1dGhlbnRpY2F0aW9uIHBy b3RvY29sIC0gUEtVMlUuIFBLVTJVIGlzIGJhc2VkIG9uIFJGQzQ0NTYgYW5kDQogICBSRkM0MTIw LiAgVGhpcyBlbmFibGVzIHBlZXIgdG8gcGVlciBhdXRoZW50aWNhdGlvbiB1c2luZyBLZXJiZXJv cw0KICAgbWVzc2FnZXMgd2l0aG91dCByZXF1aXJpbmcgYW4gb25saW5lIHRydXN0ZWQgdGhpcmQg cGFydHkuICBJbg0KICAgYWRkaXRpb24sIHRoZSBiaW5kaW5nIG9mIFBLVTJVIGZvciB0aGUgR2Vu ZXJpYyBTZWN1cml0eSBTZXJ2aWNlDQogICBBcHBsaWNhdGlvbiBQcm9ncmFtIEludGVyZmFjZSAo R1NTLUFQSSkgcGVyIFJGQzI3NDMgaXMgZGVmaW5lZCBiYXNlZA0KDQoNCg0KWmh1LCBldCBhbC4g ICAgICAgICAgICAgICBFeHBpcmVzIE1heSAxMSwgMjAwNyAgICAgICAgICAgICAgICAgIFtQYWdl IDFdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICAgUEtVMlUgICAgICAgICAg ICAgICAgICAgIE5vdmVtYmVyIDIwMDYNCg0KDQogICBvbiBSRkM0MTIxLg0KDQoNClRhYmxlIG9m IENvbnRlbnRzDQoNCiAgIDEgIEludHJvZHVjdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMw0KICAgMiAgQ29udmVudGlvbnMgVXNlZCBpbiBU aGlzIERvY3VtZW50ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAzDQogICAzICBQcm90 b2NvbCBkZXNjcmlwdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIDMNCiAgIDQgIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zICAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gNA0KICAgNSAgQWNrbm93bGVkZ2VtZW50cyAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiA1DQogICA2ICBJQU5BIENvbnNp ZGVyYXRpb25zICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDUN CiAgIDcgIE5vcm1hdGl2ZSBSZWZlcmVuY2VzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gNQ0KICAgQXV0aG9ycycgQWRkcmVzc2VzICAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiA1DQogICBJbnRlbGxlY3R1YWwgUHJvcGVy dHkgYW5kIENvcHlyaWdodCBTdGF0ZW1lbnRzICAuIC4gLiAuIC4gLiAuIC4gLiAuIDcNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIE1heSAxMSwgMjAw NyAgICAgICAgICAgICAgICAgIFtQYWdlIDJdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAg ICAgICAgICAgUEtVMlUgICAgICAgICAgICAgICAgICAgIE5vdmVtYmVyIDIwMDYNCg0KDQoxICBJ bnRyb2R1Y3Rpb24NCg0KICAgUGVlci10by1wZWVyIHN5c3RlbXMgYXJlIGluY3JlYXNpbmdseSBw b3B1bGFyIHRvZGF5LiAgSW4gYSBwZWVyLXRvLQ0KICAgcGVlciBzeXN0ZW0sIGFsbCBjbGllbnRz IHByb3ZpZGUgcmVzb3VyY2VzIHRoYXQgY29udHJpYnV0ZSBwb3NpdGl2ZWx5DQogICB0byB0aGUg dG90YWwgY2FwYWNpdHkgb2YgdGhlIG92ZXJhbGwgc3lzdGVtIGFuZCB0aGVyZSBpcyBubyBzaW5n bGUNCiAgIHBvaW50IG9mIGZhaWx1cmUuICBUaGlzIGRpc3RyaWJ1dGVkIG5hdHVyZSBtYWtlcyB0 aGUgc3lzdGVtIGhpZ2hseQ0KICAgc2NhbGFibGUgYW5kIHJvYnVzdC4gIEluIGFkZGl0aW9uLCB0 aGUgcGVlci10by1wZWVyIHN5c3RlbSBpcyBzZWxmLQ0KICAgb3JnYW5pemVkLiAgVGhlc2UgZW5h YmxlIHNlcnZpY2VzIHRoYXQganVzdCB3b3JrLg0KDQogICBJbiBhIHBlZXItdG8tcGVlciBzeXN0 ZW0sIGlmIHRoZSBpbml0aWF0b3IgY2FuIGF1dGhlbnRpY2F0ZSB0aGUNCiAgIGFjY2VwdG9yIGFu ZCB0aGVuIGVzdGFibGlzaCB0cnVzdCBpbiB0aGUgaW5mb3JtYXRpb24gcmVjZWl2ZWQgZnJvbQ0K ICAgdGhlIHBlZXIsIG1hbnkgYXR0YWNrcyBzdWNoIGFzIHBvaXNvbmluZyAoZS5nLiBwcm92aWRp bmcgZGF0YQ0KICAgY29udGVudHMgYXJlIGRpZmZlcmVudCBmcm9tIHRoZSBkZXNjcmlwdGlvbikg YW5kIHBvbGx1dGluZyAoZS5nLg0KICAgaW5zZXJ0aW5nICJiYWQiIGNodW5rcy9wYWNrZXRzKSBj YW4gYmUgbWl0aWdhdGVkIG9yIGVsaW1pbmF0ZWQuDQogICBIb3dldmVyLCBjdXJyZW50bHkgdGhl cmUgaXMgbm8gaW50ZXJvcGVyYWJsZSBHU1MtQVBJIG1lY2hhbmlzbSBmb3INCiAgIHVzZSBpbiB0 aGVzZSBlbnZpcm9ubWVudHMuDQoNCiAgIFRoZSBQS1UyVSBwcm90b2NvbCBkZWZpbmVkIGluIHRo aXMgZG9jdW1lbnQgZXh0ZW5kcyBQS0lOSVQgdG8gc3VwcG9ydA0KICAgcGVlci10by1wZWVyIGF1 dGhlbnRpY2F0aW9ucyB3aXRob3V0IHRoZSB1c2Ugb2YgS2V5IERpc3RyaWJ1dGlvbg0KICAgQ2Vu dGVyIChLREMpIFtSRkM0MTIwXS4gIFRodXMgaXQgZW5hYmxlcyBwZWVyIHRvIHBlZXIgYXV0aGVu dGljYXRpb24NCiAgIGJhc2VkIG9uIHB1YmxpYyBrZXkgY3J5cHRvZ3JhcGh5LiAgSW4gYWRkaXRp b24sIHRoaXMgZG9jdW1lbnQgZGVmaW5lcw0KICAgdGhlIGJpbmRpbmcgZm9yIEdTUy1BUEkgYmFz ZWQgb24gW1JGQzQxMjFdIGFuZCBbV1MtS0VSQl0sIHdoaWNoIG1ha2VzDQogICBQS1UyVSByZWFk aWx5IGF2YWlsYWJsZSB0byB0aGUgd2lkZWx5IGRlcGxveWVkIEdTUy1BUEkgYXBwbGljYXRpb25z Lg0KDQoNCjIgIENvbnZlbnRpb25zIFVzZWQgaW4gVGhpcyBEb2N1bWVudA0KDQogICBUaGUga2V5 IHdvcmRzICJNVVNUIiwgIk1VU1QgTk9UIiwgIlJFUVVJUkVEIiwgIlNIQUxMIiwgIlNIQUxMIE5P VCIsDQogICAiU0hPVUxEIiwgIlNIT1VMRCBOT1QiLCAiUkVDT01NRU5ERUQiLCAiTUFZIiwgYW5k ICJPUFRJT05BTCIgaW4gdGhpcw0KICAgZG9jdW1lbnQgYXJlIHRvIGJlIGludGVycHJldGVkIGFz IGRlc2NyaWJlZCBpbiBbUkZDMjExOV0uDQoNCg0KMyAgUHJvdG9jb2wgZGVzY3JpcHRpb24NCg0K ICAgVGhlIFBLVTJVIHJlYWxtIG5hbWUgaXMgYSByZXNlcnZlZCBuYW1lIHRoYXQgaXMgZGVmaW5l ZCBhY2NvcmRpbmcgdG8NCiAgIFtLUkItTkFNRV0uICBJdCBoYXMgdGhlIHZhbHVlIG9mICJSRVNF UlZFRDpQS1UyVSIuDQoNCiAgIFBLVTJVIHJlcGxhY2VzIHRoZSBLREMgaW4gW1JGQzQ1NTZdIHdp dGggdGhlIGlkZW50aXR5IG9mIHRoZQ0KICAgYWNjZXB0b3IsIGFuZCBpdCB1cGRhdGVzIHRoZSBw cm90b2NvbCB3aXRoIHRoZSBmb2xsb3dpbmcgY2hhbmdlczoNCg0KICAgQWxsIHRoZSByZWFsbSBu YW1lcyBpbiBLZXJiZXJvcyBtZXNzYWdlcyBhcmUgZmlsbGVkIHdpdGggdGhlIFBLVTJVDQogICBy ZXNlcnZlZCByZWFsbS4NCg0KICAgVGhlIGNsaWVudCBuYW1lIGluIEFTLVJFUSBbUkZDNDEyMF0g Y29udGFpbnMgdGhlIG5hbWUgb2YgdGhlDQogICBpbml0aWF0b3IsIGFuZCB0aGUgc2VydmVyIG5h bWUgY29udGFpbnMgdGhlIEtlcmJlcm9zIG5hbWUgb2YgdGhlDQogICBhY2NlcHRvci4NCg0KICAg VGhlIGluaXRpYXRvciBzaWducyB0aGUgcHJlLWF1dGhlbnRpY2F0aW9uIGRhdGEgYXMgbmVlZGVk IHBlcg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBFeHBpcmVzIE1heSAxMSwgMjAw NyAgICAgICAgICAgICAgICAgIFtQYWdlIDNdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAg ICAgICAgICAgUEtVMlUgICAgICAgICAgICAgICAgICAgIE5vdmVtYmVyIDIwMDYNCg0KDQogICBb UkZDNDEyMF0gYW5kIGNvbnN0cnVjdHMgYW4gQVMtUkVRLCBhbmQgdGhlbiBzZW5kcyB0aGUgcmVx dWVzdCB0byB0aGUNCiAgIGFjY2VwdG9yIHVzaW5nIHRoZSBzYW1lIEdTUy1BUEkgZW5jYXBzdWxh dGlvbiBkZWZpbmVkIGluIFtXUy1LRVJCXSwNCiAgIGV4Y2VwdCB0aGUgbWVjaGFuaXNtIE9iamVj dGlvbiBJZGVudGlmaWVyIChPSUQpIGZvciBQS1UyVSBpcyBpZC0NCiAgIGtlcmJlcm9zLXBrdTJ1 Lg0KDQogICAgICBpZC1rZXJiZXJvcy1wa3UydSA6Oj0NCiAgICAgICAgeyBpc28oMSkgb3JnKDMp IGRvZCg2KSBpbnRlcm5ldCgxKSBzZWN1cml0eSg1KSBrZXJiZXJvc1Y1KDIpDQogICAgICAgICAg cGt1MnUoNykgfQ0KDQogICBUaGUgY2xpZW50IGZpbGxzIG91dCB0aGUgcmVhbG0gZmllbGQgaW4g dGhlIFByb3h5RGF0YSBbV1MtS0VSQl0gdXNpbmcNCiAgIHRoZSByZXNlcnZlZCBQS1UyVSByZWFs bS4gIFVwb24gcmVjZWlwdCBvZiB0aGUgV1NfS1JCX1BST1hZIG1lc3NhZ2UsDQogICB0aGUgR1NT LUFQSSBhY2NlcHRvciBwcm9jZXNzZXMgdGhlIEtlcmJlcm9zIG1lc3NhZ2UgKGFuIEFTLVJFUSkg dGhhdA0KICAgZm9sbG93cyB0aGUgV1NfS1JCX1BST1hZIGhlYWRlci4NCg0KICAgVGhlIGFjY2Vw dG9yIHZhbGlkYXRlcyB0aGUgcHJlLWF1dGhlbnRpY2F0aW9uIGRhdGEgaW4gdGhlIHJlcXVlc3Qg cGVyDQogICBTZWN0aW9uIDMuMi4yIG9mIFtSRkM0NTU2XSBhbmQgaXQgTVVTVCB2ZXJpZnkgdGhl IGJpbmRpbmcgYmV0d2VlbiB0aGUNCiAgIGNsaWVudCBuYW1lIGFuZCB0aGUgY2xpZW50J3Mgc2ln bmluZyBrZXksIGlmIHRoZSBwcmUtYXV0aGVudGljYXRpb24NCiAgIGRhdGEgaW4gdGhlIHJlcXVl c3QgaXMgc2lnbmVkLiAgVGhlIGNsaWVudCdzIFguNTA5IGNlcnRpZmljYXRlLCBpZg0KICAgcHJl c2VudCwgTVVTVCBjb250YWluIGlkLXBraW5pdC1LUENsaWVudEF1dGggW1JGQzQ1NTZdIG9yIGlk LWtwLQ0KICAgY2xpZW50QXV0aCBbUkZDMzI4MF0uICBJZiB0aGUgY2xpZW50IGlzIGF1dGhlbnRp Y2F0ZWQgYXMgZXhwZWN0ZWQsDQogICB0aGUgYWNjZXB0b3IgaXNzdWVzIGEgc2VydmljZSB0aWNr ZXQgdG8gdGhlIGluaXRpYXRvciBwZXIgW1JGQzQxMjBdLg0KDQogICBVcG9uIHJlY2VpcHQgb2Yg dGhlIHJlcGx5LCB0aGUgaW5pdGlhdG9yIHZhbGlkYXRlcyB0aGUgcHJlLQ0KICAgYXV0aGVudGlj YXRpb24gZGF0YSBpbiB0aGUgcmVwbHkgcGVyIFNlY3Rpb24gMy4yLjQgb2YgW1JGQzQ1NTZdLiAg QXMNCiAgIHN0YXRlZCBlYXJsaWVyLCB0aGVyZSBpcyBubyBLREMgaW4gUEtVMlUsIHRodXMgdGhl IHJlcXVpcmVtZW50IG9mIHRoZQ0KICAgaWQtcGtpbml0LUtQS2RjIGlzIG5vdCBhcHBsaWNhYmxl IHdoZW4gUEtVMlUgaXMgdXNlZC4gIFRoZSBpbml0aWF0b3INCiAgIE1VU1QgdmVyaWZ5IHRoZSBi aW5kaW5nIGJldHdlZW4gdGhlIHNpZ25pbmcga2V5IGluIHRoZSByZXBseSBhbmQgdGhlDQogICBh Y2NlcHRvci4gIFdoZW4gdGhlIEdTUy1BUEkgYWNjZXB0b3IgaXMgaWRlbnRpZmllZCB1c2luZyB0 aGUNCiAgIHRhcmdfbmFtZSBwYXJhbWV0ZXIgb2YgdGhlIEdTU19Jbml0X3NlY19jb250ZXh0KCkg Y2FsbCwgdGhlIHNpZ25pbmcNCiAgIGtleSBNVVNUIGJlIGJvdW5kIHdpdGggdGhlIHRhcmdfbmFt ZS4gIFRoZSBhY2NlcHRvcidzIFguNTA5DQogICBjZXJ0aWZpY2F0ZSBNVVNUIGNvbnRhaW4gaWQt a3AtY2xpZW50QXV0aCBbUkZDMzI4MF0gb3IgaWQta3AtDQogICBzZXJ2ZXJBdXRoIFtSRkMzMjgw XSBvciBpZC1wa2luaXQtS1BDbGllbnRBdXRoIFtSRkM0NTU2XS4NCg0KICAgVGhlIEtlcmJlcm9z IHByaW5jaXBhbCBuYW1lIGZvcm0gYW5kIHRoZSBob3N0LWJhc2VkIHNlcnZpY2UgTmFtZQ0KICAg ZGVzY3JpYmVkIGluIFtSRkMxOTY0XSBNVVNUIGJlIHN1cHBvcnRlZCBieSBjb25mb3JtaW5nDQog ICBpbXBsZW1lbnRhdGlvbnMgb2YgdGhpcyBzcGVjaWZpY2F0aW9uLg0KDQogICBPbmNlIHRoZSBB Uy1SRVAgaW4gdGhlIHJlcGx5IGlzIGFjY2VwdGVkLCB0aGUgaW5pdGlhdG9yIGNhbiB1c2UgdGhl DQogICBvYnRhaW5lZCBzZXJ2aWNlIHRvIGNvbnN0cnVjdCBhbiBBUC1SRVEgYW5kIGNvbW11bmlj YXRlIHdpdGggdGhlDQogICBhY2NlcHRvci4gIFRoZSByZXN0IG9mIHRoZSBwcm90b2NvbCBhbmQg dGhlIEdTUy1BUEkgYmluZGluZyBhcmUgdGhlDQogICBzYW1lIGFzIGRlZmluZWQgaW4gW1dTLUtF UkJdIGFuZCBbUkZDNDEyMV0uDQoNCg0KNCAgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMNCg0KICAg VGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGluIFtSRkM0NTU2XSBhcHBseSBoZXJlLiAgSW4g YWRkaXRpb24sDQogICB0aGUgaW5pdGlhdG9yIGFuZCB0aGUgYWNjZXB0b3IgTVVTVCBiZSBhYmxl IHRvIHZlcmlmeSB0aGUgYmluZGluZw0KICAgYmV0d2VlbiB0aGUgc2lnbmluZyBrZXkgYW5kIHRo ZSBhc3NvY2lhdGVkIGlkZW50aXR5Lg0KDQoNCg0KWmh1LCBldCBhbC4gICAgICAgICAgICAgICBF eHBpcmVzIE1heSAxMSwgMjAwNyAgICAgICAgICAgICAgICAgIFtQYWdlIDRdDQoMDQpJbnRlcm5l dC1EcmFmdCAgICAgICAgICAgICAgICAgICAgUEtVMlUgICAgICAgICAgICAgICAgICAgIE5vdmVt YmVyIDIwMDYNCg0KDQo1ICBBY2tub3dsZWRnZW1lbnRzDQoNCiAgIFRoZSBhdXRob3JzIHdvdWxk IGxpa2UgdGhhbmtzIEplZmZlcnkgSHV0emVsbWFuIGZvciBoaXMgY29tbWVudHMgd2l0aA0KICAg cmVnYXJkaW5nIHRvIHVuaWZ5aW5nIFtXUy1LRVJCXSB3aXRoIFBLVTJVIC4NCg0KDQo2ICBJQU5B IENvbnNpZGVyYXRpb25zDQoNCiAgIFNlY3Rpb24gMyBkZWZpbmVzIHRoZSBQS1UyVSByZWFsbS4g IFRoZSBJQU5BIHJlZ2lzdHJ5IGZvciB0aGUNCiAgIHJlc2VydmVkIG5hbWVzIHNob3VsZCBiZSB1 cGRhdGVkIHRvIHJlZmVyZW5jZSB0aGlzIGRvY3VtZW50Lg0KDQoNCjcuICBOb3JtYXRpdmUgUmVm ZXJlbmNlcw0KDQogICBbS1JCLU5BTUVdIEwuIFpodSwgIkFkZGl0aW9uYWwgS2VyYmVyb3MgTmFt aW5nIENvbnN0cmFpbnRzIiwgDQogICAgICAgICAgICAgIGRyYWZ0LWlldGYta3JiLXdnLW5hbWlu Zywgd29yayBpbiBwcm9ncmVzcy4NCg0KICAgW1JGQzE5NjRdICBMaW5uLCBKLiwgIlRoZSBLZXJi ZXJvcyBWZXJzaW9uIDUgR1NTLUFQSSBNZWNoYW5pc20iLA0KICAgICAgICAgICAgICBSRkMgMTk2 NCwgSnVuZSAxOTk2Lg0KDQogICBbUkZDMjExOV0gIEJyYWRuZXIsIFMuLCAiS2V5IHdvcmRzIGZv ciB1c2UgaW4gUkZDcyB0byBJbmRpY2F0ZQ0KICAgICAgICAgICAgICBSZXF1aXJlbWVudCBMZXZl bHMiLCBCQ1AgMTQsIFJGQyAyMTE5LCBNYXJjaCAxOTk3Lg0KDQogICBbUkZDMjc0M10gIExpbm4s IEouLCAiR2VuZXJpYyBTZWN1cml0eSBTZXJ2aWNlIEFwcGxpY2F0aW9uIFByb2dyYW0NCiAgICAg ICAgICAgICAgSW50ZXJmYWNlIFZlcnNpb24gMiwgVXBkYXRlIDEiLCBSRkMgMjc0MywgSmFudWFy eSAyMDAwLg0KDQogICBbUkZDMzI4MF0gIEhvdXNsZXksIFIuLCBQb2xrLCBXLiwgRm9yZCwgVy4s IGFuZCBELiBTb2xvLCAiSW50ZXJuZXQNCiAgICAgICAgICAgICAgWC41MDkgUHVibGljIEtleSBJ bmZyYXN0cnVjdHVyZSBDZXJ0aWZpY2F0ZSBhbmQNCiAgICAgICAgICAgICAgQ2VydGlmaWNhdGUg UmV2b2NhdGlvbiBMaXN0IChDUkwpIFByb2ZpbGUiLCBSRkMgMzI4MCwNCiAgICAgICAgICAgICAg QXByaWwgMjAwMi4NCg0KICAgW1JGQzQxMjBdICBOZXVtYW4sIEMuLCBZdSwgVC4sIEhhcnRtYW4s IFMuLCBhbmQgSy4gUmFlYnVybiwgIlRoZQ0KICAgICAgICAgICAgICBLZXJiZXJvcyBOZXR3b3Jr IEF1dGhlbnRpY2F0aW9uIFNlcnZpY2UgKFY1KSIsIFJGQyA0MTIwLA0KICAgICAgICAgICAgICBK dWx5IDIwMDUuDQoNCiAgIFtSRkM0MTIxXSAgWmh1LCBMLiwgSmFnYW5hdGhhbiwgSy4sIGFuZCBT LiBIYXJ0bWFuLCAiVGhlIEtlcmJlcm9zDQogICAgICAgICAgICAgIFZlcnNpb24gNSBHZW5lcmlj IFNlY3VyaXR5IFNlcnZpY2UgQXBwbGljYXRpb24gUHJvZ3JhbQ0KICAgICAgICAgICAgICBJbnRl cmZhY2UgKEdTUy1BUEkpIE1lY2hhbmlzbTogVmVyc2lvbiAyIiwgUkZDIDQxMjEsDQogICAgICAg ICAgICAgIEp1bHkgMjAwNS4NCg0KICAgW1JGQzQxNzhdICBaaHUsIEwuLCBMZWFjaCwgUC4sIEph Z2FuYXRoYW4sIEsuLCBhbmQgVy4gSW5nZXJzb2xsLCAiVGhlDQogICAgICAgICAgICAgIFNpbXBs ZSBhbmQgUHJvdGVjdGVkIEdlbmVyaWMgU2VjdXJpdHkgU2VydmljZSBBcHBsaWNhdGlvbg0KICAg ICAgICAgICAgICBQcm9ncmFtIEludGVyZmFjZSAoR1NTLUFQSSkgTmVnb3RpYXRpb24gTWVjaGFu aXNtIiwNCiAgICAgICAgICAgICAgUkZDIDQxNzgsIE9jdG9iZXIgMjAwNS4NCg0KICAgW1JGQzQ1 NTZdICBaaHUsIEwuIGFuZCBCLiBUdW5nLCAiUHVibGljIEtleSBDcnlwdG9ncmFwaHkgZm9yIElu aXRpYWwNCiAgICAgICAgICAgICAgQXV0aGVudGljYXRpb24gaW4gS2VyYmVyb3MgKFBLSU5JVCki LCBSRkMgNDU1NiwgSnVuZSAyMDA2Lg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAgICAg IEV4cGlyZXMgTWF5IDExLCAyMDA3ICAgICAgICAgICAgICAgICAgW1BhZ2UgNV0NCgwNCkludGVy bmV0LURyYWZ0ICAgICAgICAgICAgICAgICAgICBQS1UyVSAgICAgICAgICAgICAgICAgICAgTm92 ZW1iZXIgMjAwNg0KDQoNCiAgIFtXUy1LRVJCXSBMLiBaaHUsICJLZXJiZXJvcyBmb3IgV2ViIFNl cnZpY2VzIiwgZHJhZnQtemh1LXdzLWtlcmIsIHdvcmsNCiAgICAgICAgICAgICBpbiBwcm9ncmVz cy4NCiAgICAgICAgICAgICANCkF1dGhvcnMnIEFkZHJlc3Nlcw0KDQogICBMYXJyeSBaaHUNCiAg IE1pY3Jvc29mdCBDb3Jwb3JhdGlvbg0KICAgT25lIE1pY3Jvc29mdCBXYXkNCiAgIFJlZG1vbmQs IFdBICA5ODA1Mg0KICAgVVMNCg0KICAgRW1haWw6IGx6aHVAbWljcm9zb2Z0LmNvbQ0KDQoNCiAg IEFyaSBNZWR2aW5za3kNCiAgIE1pY3Jvc29mdCBDb3Jwb3JhdGlvbg0KICAgT25lIE1pY3Jvc29m dCBXYXkNCiAgIFJlZG1vbmQsIFdBICA5ODA1Mg0KICAgVVMNCg0KICAgRW1haWw6IGFyaW1lZEBt aWNyb3NvZnQuY29tDQoNCg0KICAgSmVmZmVyeQ0KICAgU2VjdXJlIEVuZCBQb2ludHMNCiAgIDYx MiBXZXN0IDExNXRoIFN0cmVldCBSb29tIDcxNg0KICAgTmV3IFlvcmssIE5ZICAxMDAyNQ0KICAg VVMNCg0KICAgRW1haWw6IGphbHRtYW5Ac2VjdXJlZW5kcG9pbnQuY29tDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQpaaHUsIGV0IGFsLiAgICAgICAgICAg ICAgIEV4cGlyZXMgTWF5IDExLCAyMDA3ICAgICAgICAgICAgICAgICAgW1BhZ2UgNl0NCgwNCklu dGVybmV0LURyYWZ0ICAgICAgICAgICAgICAgICAgICBQS1UyVSAgICAgICAgICAgICAgICAgICAg Tm92ZW1iZXIgMjAwNg0KDQoNCkZ1bGwgQ29weXJpZ2h0IFN0YXRlbWVudA0KDQogICBDb3B5cmln aHQgKEMpIFRoZSBJbnRlcm5ldCBTb2NpZXR5ICgyMDA2KS4NCg0KICAgVGhpcyBkb2N1bWVudCBp cyBzdWJqZWN0IHRvIHRoZSByaWdodHMsIGxpY2Vuc2VzIGFuZCByZXN0cmljdGlvbnMNCiAgIGNv bnRhaW5lZCBpbiBCQ1AgNzgsIGFuZCBleGNlcHQgYXMgc2V0IGZvcnRoIHRoZXJlaW4sIHRoZSBh dXRob3JzDQogICByZXRhaW4gYWxsIHRoZWlyIHJpZ2h0cy4NCg0KICAgVGhpcyBkb2N1bWVudCBh bmQgdGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBoZXJlaW4gYXJlIHByb3ZpZGVkIG9uIGFuDQog ICAiQVMgSVMiIGJhc2lzIGFuZCBUSEUgQ09OVFJJQlVUT1IsIFRIRSBPUkdBTklaQVRJT04gSEUv U0hFIFJFUFJFU0VOVFMNCiAgIE9SIElTIFNQT05TT1JFRCBCWSAoSUYgQU5ZKSwgVEhFIElOVEVS TkVUIFNPQ0lFVFkgQU5EIFRIRSBJTlRFUk5FVA0KICAgRU5HSU5FRVJJTkcgVEFTSyBGT1JDRSBE SVNDTEFJTSBBTEwgV0FSUkFOVElFUywgRVhQUkVTUyBPUiBJTVBMSUVELA0KICAgSU5DTFVESU5H IEJVVCBOT1QgTElNSVRFRCBUTyBBTlkgV0FSUkFOVFkgVEhBVCBUSEUgVVNFIE9GIFRIRQ0KICAg SU5GT1JNQVRJT04gSEVSRUlOIFdJTEwgTk9UIElORlJJTkdFIEFOWSBSSUdIVFMgT1IgQU5ZIElN UExJRUQNCiAgIFdBUlJBTlRJRVMgT0YgTUVSQ0hBTlRBQklMSVRZIE9SIEZJVE5FU1MgRk9SIEEg UEFSVElDVUxBUiBQVVJQT1NFLg0KDQoNCkludGVsbGVjdHVhbCBQcm9wZXJ0eQ0KDQogICBUaGUg SUVURiB0YWtlcyBubyBwb3NpdGlvbiByZWdhcmRpbmcgdGhlIHZhbGlkaXR5IG9yIHNjb3BlIG9m IGFueQ0KICAgSW50ZWxsZWN0dWFsIFByb3BlcnR5IFJpZ2h0cyBvciBvdGhlciByaWdodHMgdGhh dCBtaWdodCBiZSBjbGFpbWVkIHRvDQogICBwZXJ0YWluIHRvIHRoZSBpbXBsZW1lbnRhdGlvbiBv ciB1c2Ugb2YgdGhlIHRlY2hub2xvZ3kgZGVzY3JpYmVkIGluDQogICB0aGlzIGRvY3VtZW50IG9y IHRoZSBleHRlbnQgdG8gd2hpY2ggYW55IGxpY2Vuc2UgdW5kZXIgc3VjaCByaWdodHMNCiAgIG1p Z2h0IG9yIG1pZ2h0IG5vdCBiZSBhdmFpbGFibGU7IG5vciBkb2VzIGl0IHJlcHJlc2VudCB0aGF0 IGl0IGhhcw0KICAgbWFkZSBhbnkgaW5kZXBlbmRlbnQgZWZmb3J0IHRvIGlkZW50aWZ5IGFueSBz dWNoIHJpZ2h0cy4gIEluZm9ybWF0aW9uDQogICBvbiB0aGUgcHJvY2VkdXJlcyB3aXRoIHJlc3Bl Y3QgdG8gcmlnaHRzIGluIFJGQyBkb2N1bWVudHMgY2FuIGJlDQogICBmb3VuZCBpbiBCQ1AgNzgg YW5kIEJDUCA3OS4NCg0KICAgQ29waWVzIG9mIElQUiBkaXNjbG9zdXJlcyBtYWRlIHRvIHRoZSBJ RVRGIFNlY3JldGFyaWF0IGFuZCBhbnkNCiAgIGFzc3VyYW5jZXMgb2YgbGljZW5zZXMgdG8gYmUg bWFkZSBhdmFpbGFibGUsIG9yIHRoZSByZXN1bHQgb2YgYW4NCiAgIGF0dGVtcHQgbWFkZSB0byBv YnRhaW4gYSBnZW5lcmFsIGxpY2Vuc2Ugb3IgcGVybWlzc2lvbiBmb3IgdGhlIHVzZSBvZg0KICAg c3VjaCBwcm9wcmlldGFyeSByaWdodHMgYnkgaW1wbGVtZW50ZXJzIG9yIHVzZXJzIG9mIHRoaXMN CiAgIHNwZWNpZmljYXRpb24gY2FuIGJlIG9idGFpbmVkIGZyb20gdGhlIElFVEYgb24tbGluZSBJ UFIgcmVwb3NpdG9yeSBhdA0KICAgaHR0cDovL3d3dy5pZXRmLm9yZy9pcHIuDQoNCiAgIFRoZSBJ RVRGIGludml0ZXMgYW55IGludGVyZXN0ZWQgcGFydHkgdG8gYnJpbmcgdG8gaXRzIGF0dGVudGlv biBhbnkNCiAgIGNvcHlyaWdodHMsIHBhdGVudHMgb3IgcGF0ZW50IGFwcGxpY2F0aW9ucywgb3Ig b3RoZXIgcHJvcHJpZXRhcnkNCiAgIHJpZ2h0cyB0aGF0IG1heSBjb3ZlciB0ZWNobm9sb2d5IHRo YXQgbWF5IGJlIHJlcXVpcmVkIHRvIGltcGxlbWVudA0KICAgdGhpcyBzdGFuZGFyZC4gIFBsZWFz ZSBhZGRyZXNzIHRoZSBpbmZvcm1hdGlvbiB0byB0aGUgSUVURiBhdA0KICAgaWV0Zi1pcHJAaWV0 Zi5vcmcuDQoNCg0KQWNrbm93bGVkZ21lbnQNCg0KICAgRnVuZGluZyBmb3IgdGhlIFJGQyBFZGl0 b3IgZnVuY3Rpb24gaXMgcHJvdmlkZWQgYnkgdGhlIElFVEYNCiAgIEFkbWluaXN0cmF0aXZlIFN1 cHBvcnQgQWN0aXZpdHkgKElBU0EpLg0KDQoNCg0KDQoNClpodSwgZXQgYWwuICAgICAgICAgICAg ICAgRXhwaXJlcyBNYXkgMTEsIDIwMDcgICAgICAgICAgICAgICAgICBbUGFnZSA3XQ0KDA0KDQo= ------_=_NextPart_001_01C70252.137285A1 Content-Type: text/plain; name="draft-zhu-ws-kerb-01.txt" Content-Transfer-Encoding: base64 Content-Description: draft-zhu-ws-kerb-01.txt Content-Disposition: attachment; filename="draft-zhu-ws-kerb-01.txt" DQoNCk5FVFdPUksgV09SS0lORyBHUk9VUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEwuIFpodQ0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgTWljcm9zb2Z0IENvcnBvcmF0aW9uDQpVcGRhdGVzOiA0MTIwIChpZiBh cHByb3ZlZCkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPY3RvYmVyIDIwMDYNCklu dGVuZGVkIHN0YXR1czogU3RhbmRhcmRzIFRyYWNrDQpFeHBpcmVzOiBBcHJpbCA0LCAyMDA3DQoN Cg0KICAgICAgICAgICAgICAgICAgICAgICBLZXJiZXJvcyBmb3IgV2ViIFNlcnZpY2VzDQogICAg ICAgICAgICAgICAgICAgICAgICAgIGRyYWZ0LXpodS13cy1rZXJiLTAxDQoNClN0YXR1cyBvZiB0 aGlzIE1lbW8NCg0KICAgQnkgc3VibWl0dGluZyB0aGlzIEludGVybmV0LURyYWZ0LCBlYWNoIGF1 dGhvciByZXByZXNlbnRzIHRoYXQgYW55DQogICBhcHBsaWNhYmxlIHBhdGVudCBvciBvdGhlciBJ UFIgY2xhaW1zIG9mIHdoaWNoIGhlIG9yIHNoZSBpcyBhd2FyZQ0KICAgaGF2ZSBiZWVuIG9yIHdp bGwgYmUgZGlzY2xvc2VkLCBhbmQgYW55IG9mIHdoaWNoIGhlIG9yIHNoZSBiZWNvbWVzDQogICBh d2FyZSB3aWxsIGJlIGRpc2Nsb3NlZCwgaW4gYWNjb3JkYW5jZSB3aXRoIFNlY3Rpb24gNiBvZiBC Q1AgNzkuDQoNCiAgIEludGVybmV0LURyYWZ0cyBhcmUgd29ya2luZyBkb2N1bWVudHMgb2YgdGhl IEludGVybmV0IEVuZ2luZWVyaW5nDQogICBUYXNrIEZvcmNlIChJRVRGKSwgaXRzIGFyZWFzLCBh bmQgaXRzIHdvcmtpbmcgZ3JvdXBzLiAgTm90ZSB0aGF0DQogICBvdGhlciBncm91cHMgbWF5IGFs c28gZGlzdHJpYnV0ZSB3b3JraW5nIGRvY3VtZW50cyBhcyBJbnRlcm5ldC0NCiAgIERyYWZ0cy4N Cg0KICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBkcmFmdCBkb2N1bWVudHMgdmFsaWQgZm9yIGEgbWF4 aW11bSBvZiBzaXggbW9udGhzDQogICBhbmQgbWF5IGJlIHVwZGF0ZWQsIHJlcGxhY2VkLCBvciBv YnNvbGV0ZWQgYnkgb3RoZXIgZG9jdW1lbnRzIGF0IGFueQ0KICAgdGltZS4gIEl0IGlzIGluYXBw cm9wcmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBhcyByZWZlcmVuY2UNCiAgIG1hdGVyaWFs IG9yIHRvIGNpdGUgdGhlbSBvdGhlciB0aGFuIGFzICJ3b3JrIGluIHByb2dyZXNzLiINCg0KICAg VGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC1EcmFmdHMgY2FuIGJlIGFjY2Vzc2VkIGF0DQog ICBodHRwOi8vd3d3LmlldGYub3JnL2lldGYvMWlkLWFic3RyYWN0cy50eHQuDQoNCiAgIFRoZSBs aXN0IG9mIEludGVybmV0LURyYWZ0IFNoYWRvdyBEaXJlY3RvcmllcyBjYW4gYmUgYWNjZXNzZWQg YXQNCiAgIGh0dHA6Ly93d3cuaWV0Zi5vcmcvc2hhZG93Lmh0bWwuDQoNCiAgIFRoaXMgSW50ZXJu ZXQtRHJhZnQgd2lsbCBleHBpcmUgb24gQXByaWwgNCwgMjAwNy4NCg0KQ29weXJpZ2h0IE5vdGlj ZQ0KDQogICBDb3B5cmlnaHQgKEMpIFRoZSBJbnRlcm5ldCBTb2NpZXR5ICgyMDA2KS4NCg0KQWJz dHJhY3QNCg0KICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIGV4dGVuc2lvbnMgdG8gdGhlIEtlcmJl cm9zIHByb3RvY29sIGFuZCB0aGUNCiAgIEdTUy1BUEkgS2VyYmVyb3MgbWVjaGFuaXNtIHRoYXQg ZW5hYmxlIGEgR1NTLUFQSSBLZXJiZXJvcyBjbGllbnQgdG8NCiAgIGV4Y2hhbmdlIG1lc3NhZ2Vz IHdpdGggdGhlIEtEQyB1c2luZyB0aGUgR1NTLUFQSSBhY2NlcHRvciBhcyB0aGUNCiAgIHByb3h5 LCBieSBlbmNhcHN1bGF0aW5nIHRoZSBLZXJiZXJvcyBtZXNzYWdlcyBpbnNpZGUgR1NTLUFQSSB0 b2tlbnMuDQogICBXaXRoIHRoZXNlIGV4dGVuc2lvbnMsIEtlcmJlcm9zIGlzIHN1aXRhYmxlIGZv ciBzZWN1cmluZw0KICAgY29tbXVuaWNhdGlvbiBiZXR3ZWVuIHRoZSBjbGllbnQgYW5kIHdlYiBz ZXJ2aWNlcyBvdmVyIHRoZSBJbnRlcm5ldC4NCg0KDQoNCg0KWmh1ICAgICAgICAgICAgICAgICAg ICAgICBFeHBpcmVzIEFwcmlsIDQsIDIwMDcgICAgICAgICAgICAgICAgIFtQYWdlIDFdDQoMDQpJ bnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICBXUy1LRVJCICAgICAgICAgICAgICAgICAg ICBPY3RvYmVyIDIwMDYNCg0KDQpUYWJsZSBvZiBDb250ZW50cw0KDQogICAxLiAgSW50cm9kdWN0 aW9uICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDMN CiAgIDIuICBDb252ZW50aW9ucyBVc2VkIGluIFRoaXMgRG9jdW1lbnQgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gMw0KICAgMy4gIEdTUy1BUEkgRW5jYXBzdWxhdGlvbiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAzDQogICA0LiAgQWRkcmVzc2VzIGluIFRp Y2tldHMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDYNCiAgIDUu ICBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gNg0KICAgNi4gIEFja25vd2xlZGdlbWVudHMgIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiA3DQogICA3LiAgSUFOQSBDb25zaWRlcmF0aW9ucyAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDcNCiAgIDguICBOb3Jt YXRpdmUgUmVmZXJlbmNlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gNw0KICAgQXV0aG9yJ3MgQWRkcmVzcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiA4DQogICBJbnRlbGxlY3R1YWwgUHJvcGVydHkgYW5kIENvcHly aWdodCBTdGF0ZW1lbnRzICAuIC4gLiAuIC4gLiAuIC4gLiAuIDkNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNClpodSAgICAgICAgICAgICAgICAgICAgICAgRXhwaXJlcyBBcHJpbCA0LCAyMDA3ICAgICAg ICAgICAgICAgICBbUGFnZSAyXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgICAgICAg V1MtS0VSQiAgICAgICAgICAgICAgICAgICAgT2N0b2JlciAyMDA2DQoNCg0KMS4gIEludHJvZHVj dGlvbg0KDQogICBUaGUgS2VyYmVyb3MgW1JGQzQxMjBdIHByZS1hdXRoZW50aWNhdGlvbiBmcmFt ZXdvcmsgW0tSQi1QQUZXXQ0KICAgcHJvbWlzZXMgbWluaW1hbCBvciBubyBleHBvc3VyZSBvZiB3 ZWFrIGNsaWVudCBrZXlzIGFuZCBzdHJvbmcgY2xpZW50DQogICBhdXRoZW50aWNhdGlvbi4gIFRo ZSBLZXJiZXJvcyBzdXBwb3J0IG9mIGFub255bWl0eSBbS1JCLUFOT05dDQogICBwcm92aWRlcyBm b3IgcHJpdmFjeS4gIFRoZXNlIGFkdmFuY2VtZW50cyBtYWtlIEtlcmJlcm9zIHN1aXRhYmxlIG92 ZXINCiAgIHRoZSBJbnRlcm5ldC4NCg0KICAgVGhlIHRyYWRpdGlvbmFsIGNsaWVudC1wdXNoIEtl cmJlcm9zIHByb3RvY29sIGRvZXMgbm90IHdvcmsgd2VsbCBpbg0KICAgdGhlIFdlYiBzZXJ2aWNl cyBlbnZpcm9ubWVudHMgd2hlcmUgdGhlIEtEQyBpcyBub3QgYWNjZXNzaWJsZSB0byB0aGUNCiAg IGNsaWVudCwgYnV0IGlzIGFjY2Vzc2libGUgdG8gdGhlIHdlYiBzZXJ2ZXIuICBGb3IgZXhhbXBs ZSwgdGhlIEtEQyBpcw0KICAgY29tbW9ubHkgcGxhY2VkIGJlaGluZCBhIGZpcmV3YWxsIHRvZ2V0 aGVyIHdpdGggdGhlIGFwcGxpY2F0aW9uDQogICBzZXJ2ZXIuICBUaGUgbGFjayBvZiBhY2Nlc3Np YmlsaXR5IHRvIHRoZSBLREMgYnkgdGhlIGNsaWVudCBjb3VsZA0KICAgYWxzbyBvY2N1ciBhcmUg d2hlbiB0aGUgY2xpZW50IGRvZXMgbm90IGhhdmUgYW4gSVAgYWRkcmVzcyBwcmlvciB0bw0KICAg YXV0aGVudGljYXRpbmcgdG8gYW4gYWNjZXNzIHBvaW50Lg0KDQogICBHZW5lcmljIFNlY3VyaXR5 IFNlcnZpY2UgQXBwbGljYXRpb24gUHJvZ3JhbSBJbnRlcmZhY2UgKEdTUy1BUEkpDQogICBbUkZD Mjc0M10gYWxsb3dzIHNlY3VyaXR5IG1lY2hhbmlzbXMgZXhjaGFuZ2UgYXJiaXRyYXJ5IG1lc3Nh Z2VzDQogICBiZXR3ZWVuIHRoZSBpbml0aWF0b3IgYW5kIHRoZSBhY2NlcHRvciB2aWEgdGhlIGFw cGxpY2F0aW9uIHRyYWZmaWMsDQogICBpbmRlcGVuZGVudCBvZiB0aGUgdW5kZXJseWluZyB0cmFu c3BvcnRzLiAgQSBwcm90b2NvbCBiYXNlZCBvbg0KICAgW1JGQzQxMjFdIGlzIHRodXMgZGVmaW5l ZCB0byBhbGxvdyB0aGUgR1NTLUFQSSBpbml0aWF0b3IgdG8gZXhjaGFuZ2UNCiAgIEtlcmJlcm9z IG1lc3NhZ2VzIHdpdGggdGhlIEtEQyBieSB1c2luZyB0aGUgR1NTLUFQSSBhY2NlcHRvciBhcyB0 aGUNCiAgIHByb3h5LiAgVGhlIGFjY2VwdG9yLXB1bGwgbW9kZWwgZGVmaW5lZCBpbiB0aGlzIHNw ZWNpZmljYXRpb24gaXMNCiAgIGJlbmVmaWNhbCBmb3IgaW5pdGlhdG9ycyB3aXRoIGxpbWl0ZWQg cHJvY2Vzc2luZyBwb3dlciBzdWNoIGFzIG1vYmlsZQ0KICAgZGV2aWNlcywgb3Igd2hlbiB0aGUg dHJhbnNwb3J0IGxheWVyIGJldHdlZW4gdGhlIGluaXRpYXRvciBhbmQgdGhlDQogICBhY2NlcHRv ciBoYXMgaGlnaCBuZXR3b3JrIGxhdGVuY3kuDQoNCiAgICAgICAgICAgQ2xpZW50IC0tLS0tLS0t LSBXUy1LRVJCIHByb3h5IC0tLS0tLS0tLS0gS0RDDQoNCiAgIFRoZSBLZXJiZXJvcyBjbGllbnQg TVVTVCBhdm9pZCBleHBvc3VyZSBvZiBsb25nIHRlcm0gY2xpZW50IGtleXMgdG8NCiAgIHRoZSBH U1MtQVBJIGFjY2VwdG9yLCBiZWZvcmUgYW5kIGFmdGVyIHRoZSBLZXJiZXJvcyBzZXJ2ZXIgaXMN CiAgIGF1dGhlbnRpY2F0ZWQuICBUaGlzIGNhbiBiZSBhY2NvbXBsaXNoZWQgYnkgdXNpbmcgS2Vy YmVyb3MtRkFTVCBbS1JCLQ0KICAgUEFGV10uICBGdXJ0aGVybW9yZSwgdGhlIGluaXRpYXRvciBj YW4gdXNlIHRoZSBhbm9ueW1vdXMgb3B0aW9uIGFzDQogICBkZWZpbmVkIGluIFNlY3Rpb24gNi41 LjIgb2YgW0tSQi1QQUZXXSwgdG8gaGlkZSB0aGUgY2xpZW50IGlkZW50aXR5DQogICBmcm9tIGFk dmVyc2FyeSB3aG8gY2FuIGVhdmVzZHJvcCB0aGUgYXBwbGljYXRpb24gdHJhZmZpYy4NCg0KDQoy LiAgQ29udmVudGlvbnMgVXNlZCBpbiBUaGlzIERvY3VtZW50DQoNCiAgIFRoZSBrZXkgd29yZHMg Ik1VU1QiLCAiTVVTVCBOT1QiLCAiUkVRVUlSRUQiLCAiU0hBTEwiLCAiU0hBTEwgTk9UIiwNCiAg ICJTSE9VTEQiLCAiU0hPVUxEIE5PVCIsICJSRUNPTU1FTkRFRCIsICJNQVkiLCBhbmQgIk9QVElP TkFMIiBpbiB0aGlzDQogICBkb2N1bWVudCBhcmUgdG8gYmUgaW50ZXJwcmV0ZWQgYXMgZGVzY3Jp YmVkIGluIFtSRkMyMTE5XS4NCg0KDQozLiAgR1NTLUFQSSBFbmNhcHN1bGF0aW9uDQoNCiAgIFRo ZSBtZWNoYW5pc20gT2JqZWN0aW9uIElkZW50aWZpZXIgKE9JRCkgZm9yIEdTUy1BUEkgV1MtS0VS QiwgaW4NCiAgIGFjY29yZGFuY2Ugd2l0aCB0aGUgbWVjaGFuaXNtIHByb3Bvc2VkIGJ5IFtSRkM0 MTc4XSBmb3IgbmVnb3RpYXRpbmcNCg0KDQoNClpodSAgICAgICAgICAgICAgICAgICAgICAgRXhw aXJlcyBBcHJpbCA0LCAyMDA3ICAgICAgICAgICAgICAgICBbUGFnZSAzXQ0KDA0KSW50ZXJuZXQt RHJhZnQgICAgICAgICAgICAgICAgICAgV1MtS0VSQiAgICAgICAgICAgICAgICAgICAgT2N0b2Jl ciAyMDA2DQoNCg0KICAgcHJvdG9jb2wgdmFyaWF0aW9ucywgaXMgaWQta2VyYmVyb3Mtd3MuDQoN CiAgICAgIGlkLWtlcmJlcm9zLXdzIDo6PQ0KICAgICAgICB7IGlzbygxKSBvcmcoMykgZG9kKDYp IGludGVybmV0KDEpIHNlY3VyaXR5KDUpIGtlcmJlcm9zVjUoMikNCiAgICAgICAgICB3ZWJTZXJ2 aWNlKDYpIH0NCg0KICAgVGhlIGZpcnN0IHRva2VuIG9mIHRoZSBHU1MtQVBJIFdTLUtFUkIgbWVj aGFuaXNtIE1VU1QgaGF2ZSB0aGUNCiAgIGdlbmVyaWMgdG9rZW4gZnJhbWluZyBkZXNjcmliZWQg aW4gc2VjdGlvbiAzLjEgb2YgW1JGQzI3NDNdIHdpdGggdGhlDQogICBtZWNoYW5pc20gT0lEIGJl aW5nIGlkLWtlcmJlcm9zLXdzLCBhbmQgYW55IHN1YnNlcXVlbnQgR1NTLUFQSSBXUy0NCiAgIEtF UkIgdG9rZW4gTVVTVCBOT1QgaGF2ZSB0aGlzIGZyYW1pbmcuDQoNCiAgIFRoZSBHU1MtQVBJIFdT LUtFUkIgbWVjaGFuaXNtIE1VU1QgYWx3YXlzIHByb3ZpZGUgbXV0dWFsDQogICBhdXRoZW50aWNh dGlvbiwgZXZlbiBpZiB0aGUgaW5pdGlhdG9yIGRvZXMgbm90IGFzayBmb3IgaXQuICBXaGVuDQog ICBtdXR1YWwtYXV0aGVudGljYXRpb24gaXMgcGVyZm9ybWVkLCB0aGUgR1NTLUFQSSBhY2NlcHRv ciB3aWxsIGFsd2F5cw0KICAgc2VuZCBiYWNrIGFuIEFQLVJFUCwgYW5kIGFzIGRlc2NyaWJlZCBs YXRlciBpbiB0aGlzIHNlY3Rpb24gdGhpcw0KICAgbWVjaGFuaXNtIHByb3ZpZGVzIGludGVncml0 eSBwcm90ZWN0aW9uIGZvciBhbGwgaW5pdGlhdG9yLWFjY2VwdG9yDQogICBwcm94eSBtZXNzYWdl IGV4Y2hhbmdlcy4NCg0KICAgVGhlIGlubmVyVG9rZW4gZGVzY3JpYmVkIGluIHNlY3Rpb24gMy4x IG9mIFtSRkMyNzQzXSBhbmQgc3Vic2VxdWVudA0KICAgR1NTLUFQSSB0b2tlbnMgaGF2ZSB0aGUg Zm9sbG93aW5nIGZvcm1hdHM6IGl0IHN0YXJ0cyB3aXRoIGEgdHdvLW9jdGV0DQogICB0b2tlbi1p ZGVudGlmaWVyIChUT0tfSUQpLCBmb2xsb3dlZCBieSBhIFdTLUtFUkIgbWVzc2FnZSBvciBhDQog ICBLZXJiZXJvcyBtZXNzYWdlLg0KDQoNCiAgICAgICAgICAgICBUb2tlbi9NZXNzYWdlICAgICAg IFRPS19JRCBWYWx1ZSBpbiBIZXgNCiAgICAgICAgICAgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0NCiAgICAgICAgICAgICBXU19LUkJfUFJPWFkgICAgICAgICAwNSAw MQ0KDQogICBPbmx5IG9uZSBXUy1LRVJCIHNwZWNpZmljIG1lc3NhZ2UsIG5hbWVseSB0aGUgV1Nf S1JCX1BST1hZIG1lc3NhZ2UsDQogICBpcyBkZWZpbmVkIGluIHRoaXMgZG9jdW1lbnQuICBUaGUg VE9LX0lEIHZhbHVlcyBmb3IgW1JGQzQxMjBdDQogICBLZXJiZXJvcyBtZXNzYWdlcyBhcmUgdGhl IHNhbWUgYXMgdGhvc2UgZGVmaW5lZCBmb3IgdGhlIEdTUy1BUEkNCiAgIEtlcmJlcm9zIG1lY2hh bmlzbSBbUkZDNDEyMV0uDQoNCiAgIFRoZSBtZXNzYWdlIG9mIHRoZSBXU19LUkJfUFJPWFkgdHlw ZSBpcyBkZWZpbmVkIGFzIGEgV1MtS1JCLUhFQURFUg0KICAgc3RydWN0dXJlIGltbWVkaWF0ZWx5 IGZvbGxvd2VkIGJ5IGEgS2VyYmVyb3MgbWVzc2FnZS4gIFRoZSBLZXJiZXJvcw0KICAgbWVzc2Fn ZSBjYW4gYmUgYW4gQVMtUkVRLCBhbiBBUy1SRVAsIGEgVEdTLVJFUSwgYSBUR1MtUkVQLCBvciBh IEtSQi0NCiAgIEVSUk9SIGFzIGRlZmluZWQgaW4gW1JGQzQxMjBdLg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNClpodSAgICAgICAgICAgICAgICAgICAgICAgRXhwaXJlcyBBcHJpbCA0LCAy MDA3ICAgICAgICAgICAgICAgICBbUGFnZSA0XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAg ICAgICAgICAgV1MtS0VSQiAgICAgICAgICAgICAgICAgICAgT2N0b2JlciAyMDA2DQoNCg0KICAg ICAgICAgICBXUy1LUkItSEVBREVSIDo6PSBTRVFVRU5DRSB7DQogICAgICAgICAgICAgICBwcm94 eS1kYXRhICAgICAgWzFdIFByb3h5RGF0YSwNCiAgICAgICAgICAgICAgIC4uLg0KICAgICAgICAg ICB9DQoNCiAgICAgICAgICAgUHJveHlEYXRhIDo6ID0gU0VRVUVOQ0Ugew0KICAgICAgICAgICAg ICAgcmVhbG0gICAgICAgICAgIFsxXSBSZWFsbSwNCiAgICAgICAgICAgICAgIGNvb2tpZSAgICAg ICAgICBbM10gT0NURVQgU1RSSU5HIE9QVElPTkFMLA0KICAgICAgICAgICAgICAgICAgLS0gb3Bh cXVlIGRhdGEsIGlmIHNlbnQgYnkgdGhlIGFjY2VwdG9yLA0KICAgICAgICAgICAgICAgICAgLS0g TVVTVCBiZSBjb3BpZWQgYnkgdGhlIGNsaWVudCB1bmNoYW5nZWQgaW50bw0KICAgICAgICAgICAg ICAgICAgLS0gdGhlIG5leHQgV1MtS0VSQiBtZXNzYWdlLg0KICAgICAgICAgICAgICAgLi4uDQog ICAgICAgICAgIH0NCg0KDQogICBUaGUgV1MtS1JCLUhFQURFUiBzdHJ1Y3R1cmUgYW5kIGFsbCB0 aGUgS2VyYmVyb3MgbWVzc2FnZXMgTVVTVCBiZQ0KICAgZW5jb2RlZCB1c2luZyBBYnN0cmFjdCBT eW50YXggTm90YXRpb24gT25lIChBU04uMSkgRGlzdGluZ3Vpc2hlZA0KICAgRW5jb2RpbmcgUnVs ZXMgKERFUikgW1g2ODBdIFtYNjkwXS4NCg0KICAgVGhlIEdTUy1BUEkgaW5pdGlhdG9yIGZpbGxz IG91dCB0aGUgcmVhbG0gZmllbGQgaW4gdGhlIFByb3h5RGF0YSBvZg0KICAgdGhlIGZpcnN0IHJl cXVlc3Qgd2l0aCB0aGUgY2xpZW50IHJlYWxtLiAgSWYgdGhlIGNsaWVudCBkb2VzIG5vdCBrbm93 DQogICB0aGUgY2xpZW50IHJlYWxtIFtSRUZFUkFMU10sIGl0IE1VU1QgZmlsbCBpdCBvdXQgdXNp bmcgdGhlIGNsaWVudCdzDQogICBkZWZhdWx0IHJlYWxtIG5hbWUgc3VjaCBhcyB0aGUgcmVhbG0g b2YgdGhlIGNsaWVudCBob3N0LiAgVHlwaWNhbGx5DQogICB0aGUgS2VyYmVyb3MgbWVzc2FnZSBp biB0aGUgZmlyc3QgV1NfS1JCX1BST1hZIG1lc3NhZ2UgZnJvbSB0aGUNCiAgIGNsaWVudCBpcyBh biBBUy1SRVEgbWVzc2FnZS4NCg0KICAgVXBvbiByZWNlaXB0IG9mIHRoZSBXU19LUkJfUFJPWFkg bWVzc2FnZSwgdGhlIEdTUy1BUEkgV1MtS0VSQg0KICAgYWNjZXB0b3IgTVVTVCB1c2UgdGhlIHBy b3h5LWRhdGEgaW4gdGhlIG1lc3NhZ2UgZnJvbSB0aGUgY2xpZW50IHRvDQogICBsb2NhdGUgdGhl IEtEQyBhbmQgc2VuZHMgdGhlIGVuY2Fwc3VsYXRlZCBLZXJiZXJvcyBtZXNzYWdlIHRvIHRoYXQN CiAgIEtEQy4gIFVubGVzcyBvdGhlcndpc2Ugc3BlY2lmaWVkLCB0aGUgYWNjZXB0b3IgY2FuIGxv Y2F0ZSB0aGUgS0RDIHBlcg0KICAgU2VjdGlvbiA3LjIuMy4yIG9mIFtSRkM0MTIwXS4NCg0KICAg SW4gb3JkZXIgdG8gcmVkdWNlIHRoZSBudW1iZXIgb2Ygcm91bmR0cmlwcyBiZXR3ZWVuIHRoZSBp bml0aWF0b3IgYW5kDQogICB0aGUgYWNjZXB0b3IsIHRoZSBhY2NlcHRvciBTSE9VTEQgcHJvY2Vz cyBhbnkgbWVzc2FnZSBleGNoYW5nZSB3aXRoDQogICB0aGUgS0RDIGlmIHRoZSBleGNoYW5nZSBp cyB1bmF1dGhlbnRpY2F0ZWQsIHN1Y2ggYXMgY2xpZW50LXJlZmVycmFsDQogICBtZXNzYWdlIGV4 Y2hhbmdlIFtSRUZFUkFMU10uICBJZiB0aGUgYWNjZXB0b3IgY2FuIG5vdCBwcm9jZXNzIHRoZSBL REMNCiAgIHJlc3BvbnNlIGJ5IGl0c2VsZiwgZm9yIGV4YW1wbGUgd2hlbiB0aGUga25vd2xlZGdl IG9mIHRoZSBjbGllbnQga2V5cw0KICAgaXMgcmVxdWlyZWQsIGl0IHNlbmRzIGJhY2sgdG8gdGhl IGNsaWVudCB0aGUgS0RDIHJlcGx5IG1lc3NhZ2UNCiAgIGVuY2Fwc3VsYXRlZCBpbiBhIFdTX0tS Ql9QUk9YWSBtZXNzYWdlLiAgVGhlIGFjY2VwdG9yIE1VU1QgZmlsbCBvdXQNCiAgIHRoZSByZWFs bSBuYW1lIHdob3NlIEtEQyBwcm9kdWNlZCB0aGUgcmVzcG9uc2UuICBUaGUgYWNjZXB0b3IgU0hP VUxEDQogICB1c2UgdGhlIGtkYy1yZWZlcnJhbHMgb3B0aW9uIGRlc2NyaWJlZCBpbiBTZWN0aW9u IDYuNS4yIG9mIFtLUkItUEFGV10NCiAgIHRvIGFsbG93IHRoZSBLREMgb2YgdGhlIGNsaWVudCdz IHJlYWxtIHRvIG9idGFpbiBhIHNlcnZpY2UgdGlja2V0DQogICBhZGRyZXNzZWQgdG8gdGhlIGFj Y2VwdG9yLCB0aHVzIGZ1cnRoZXIgcmVkdWNlIHRoZSBudW1iZXIgb2YNCiAgIHJvdW5kdHJpcHMg YmV0d2VlbiB0aGUgR1NTLUFQSSBpbml0aWF0b3IgYW5kIHRoZSBHU1MtQVBJIGFjY2VwdG9yLg0K ICAgVGhlIEdTUy1BUEkgYWNjZXB0b3IgY2FuIHNlbmQgb3BhcXVlIGRhdGEgaW4gdGhlIGNvb2tp ZSBmaWVsZCBvZiB0aGUNCiAgIFdTLUtSQi1IRUFERVIgc3RydWN0dXJlIGluIHRoZSByZXBseSBm cm9tIHRoZSBhY2NlcHRvciB0byB0aGUNCiAgIGluaXRpYXRvciwgaW4gb3JkZXIgdG8sIGZvciBl eGFtcGxlLCB0byBmYWNpbGl0YXRlIHN0YXRlIG1hbmFnZW1lbnRzDQogICBvbiB0aGUgR1NTLUFQ SSBhY2NlcHRvci4gIFRoZSBjb250ZW50IGFuZCB0aGUgZW5jb2Rpbmcgb2YgdGhlIGNvb2tpZQ0K DQoNCg0KWmh1ICAgICAgICAgICAgICAgICAgICAgICBFeHBpcmVzIEFwcmlsIDQsIDIwMDcgICAg ICAgICAgICAgICAgIFtQYWdlIDVdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAg ICBXUy1LRVJCICAgICAgICAgICAgICAgICAgICBPY3RvYmVyIDIwMDYNCg0KDQogICBmaWVsZCBp cyBhIGxvY2FsIG1hdHRlciBvZiB0aGUgYWNjZXB0b3IuICBUaGUgaW5pdGlhdG9yIE1VU1QgY29w eSB0aGUNCiAgIHZlcmJhdGltIGNvb2tpZSBmcm9tIHRoZSBwcmV2aW91cyBhY2NlcHRvciByZXNw b25zZSwgd2hlbiB0aGUgY29va2llDQogICBpcyBwcmVzZW50LCB3aGVuZXZlciBpdCBzZW5kcyBh biBhZGRpdGlvbmFsIFdTLUtSQi1QUk9YWSBtZXNzYWdlIHRvDQogICB0aGUgYWNjZXB0b3IuICBU aGUgY2xpZW50IHByb2Nlc3NlcyB0aGUgS0RDIHJlc3BvbnNlLCBhbmQgZmlsbHMgb3V0DQogICB0 aGUgcmVhbG0gbmFtZSBpdCBiZWxpZXZlcyB0byB3aG9tIHRoZSBhY2NlcHRvciBzaG91bGQgc2Vu ZCB0aGUNCiAgIGVuY2Fwc3VsYXRlZCBLZXJiZXJvcyBtZXNzYWdlLg0KDQogICBXaGVuIHRoZSBj bGllbnQgb2J0YWlucyBhIHNlcnZpY2UgdGlja2V0LCB0aGUgaW5pdGlhdG9yIHRoZW4gc2VuZHMg YQ0KICAgS1JCX0FQX1JFUSBtZXNzYWdlIHRvIHRoZSBhY2NlcHRvciwgYW5kIHByb2NlZWQgYXMg ZGVmaW5lZCBpbg0KICAgW1JGQzQxMjFdLiAgQSBHU1MtQVBJIGF1dGhlbnRpY2F0b3IgZXh0ZW5z aW9uIFtHU1MtRVhUU10gTVVTVCBiZSBzZW50DQogICBieSB0aGUgaW5pdGlhdG9yLiAgVGhlIGV4 dGVuc2lvbiB0eXBlIGlzIDIgYW5kIHRoZSBjb250ZW50IGlzIHRoZQ0KICAgQVNOLjEgREVSIGVu Y29kaW5nIG9mIHRoZSB0eXBlIENoZWNrc3VtLiAgVGhlIGNoZWNrc3VtIGlzIHBlcmZvcm1lZA0K ICAgb3ZlciBhbGwgR1NTLUFQSSBtZXNzYWdlcyBhcyBleGNoYW5nZWQgYmV0d2VlbiB0aGUgaW5p dGlhdG9yIGFuZCB0aGUNCiAgIGFjY2VwdG9yIGJlZm9yZSB0aGUgS1JCX0FQX1JFUSBtZXNzYWdl LCBhbmQgaW4gdGhlIG9yZGVyIG9mIHRoZQ0KICAgZXhjaGFuZ2UuICBUaGUgY2hlY2tzdW0gdHlw ZSBpcyB0aGUgcmVxdWlyZWQgY2hlY2tzdW0gdHlwZSBmb3IgdGhlDQogICBlbmN0eXBlIG9mIHRo ZSBzdWJrZXkgaW4gdGhlIGF1dGhlbnRpY2F0b3IsIHRoZSBwcm90b2NvbCBrZXkgaXMgdGhlDQog ICBhdXRoZW50aWNhdG9yIHN1YmtleSwgYW5kIHRoZSBrZXkgdXNhZ2UgbnVtYmVyIGlzIFRCQS0x LiAgVGhlDQogICBhY2NlcHRvciBNVVNUIHZlcmlmeSB0aGlzIGNoZWNrc3VtIGluIHRoZSBHU1Mt QVBJIGF1dGhlbnRpY2F0b3INCiAgIGV4dGVuc2lvbiwgdGhlbiByZXNwb25kIHdpdGggYW4gQVAt UkVQIGV4dGVuc2lvbiBbR1NTLUVYVFNdLiAgVGhlIEFQLQ0KICAgUkVQIGV4dGVuc2lvbiB0eXBl IGlzIDIgYW5kIHRoZSB0aGUgY29udGVudCBpcyB0aGUgQVNOLjEgREVSIGVuY29kaW5nDQogICBv ZiB0aGUgdHlwZSBDaGVja3N1bS4gIFRoaXMgY2hlY2tzdW0gaXMgcGVyZm9ybWVkIG92ZXIgYWxs IEdTUy1BUEkNCiAgIG1lc3NhZ2VzIGFzIGV4Y2hhbmdlZCBiZXR3ZWVuIHRoZSBpbml0aWF0b3Ig YW5kIHRoZSBhY2NlcHRvciBiZWZvcmUNCiAgIHRoZSBLUkJfQVBfUkVRIG1lc3NhZ2UsIGFuZCBp biB0aGUgb3JkZXIgb2YgdGhlIGV4Y2hhbmdlLiAgVGhlDQogICBjaGVja3N1bSB0eXBlIGlzIHRo ZSByZXF1aXJlZCBjaGVja3N1bSB0eXBlIGZvciB0aGUgZW5jdHlwZSBvZiB0aGUNCiAgIGF1dGhl bnRpY2F0b3Igc3Via2V5IGluIHRoZSByZXF1ZXN0LCBhbmQgdGhlIHByb3RvY29sIGtleSBpcyB0 aGUNCiAgIGF1dGhlbnRpY2F0b3Igc3Via2V5LCBhbmQgdGhlIGtleSB1c2FnZSBudW1iZXIgaXMg VEJBLTIuICBUaGUNCiAgIGluaXRpYXRvciBNVVNUIHRoZW4gdmVyaWZ5IHRoaXMgY2hlY2tzdW0u DQoNCg0KNC4gIEFkZHJlc3NlcyBpbiBUaWNrZXRzDQoNCiAgIEluIFdTLUtFUkIsIHRoZSBtYWNo aW5lIHNlbmRpbmcgcmVxdWVzdHMgdG8gdGhlIEtEQyBpcyB0aGUgR1NTLUFQSQ0KICAgYWNjZXB0 b3IgYW5kIG5vdCB0aGUgaW5pdGlhdG9yLiAgQXMgYSByZXN1bHQsIHRoZSBpbml0aWF0b3Igc2hv dWxkDQogICBub3QgaW5jbHVkZSBpdHMgYWRkcmVzc2VzIGluIGFueSBLREMgcmVxdWVzdHMgZm9y IHR3byByZWFzb25zLg0KICAgRmlyc3QsIHRoZSBLREMgbWF5IHJlamVjdCB0aGUgZm9yd2FyZGVk IHJlcXVlc3QgYXMgYmVpbmcgZnJvbSB0aGUNCiAgIHdyb25nIGNsaWVudC4gIFNlY29uZCwgaW4g dGhlIGNhc2Ugb2YgaW5pdGlhbCBhdXRoZW50aWNhdGlvbiBmb3IgYQ0KICAgZGlhbC11cCBjbGll bnQsIHRoZSBjbGllbnQgbWFjaGluZSBtYXkgbm90IHlldCBwb3NzZXNzIGEgbmV0d29yaw0KICAg YWRkcmVzcy4gIEhlbmNlLCBhcyBhbGxvd2VkIGJ5IFtSRkM0MTIwXSwgdGhlIGFkZHJlc3NlcyBm aWVsZCBvZiB0aGUNCiAgIEFTLVJFUSBhbmQgVEdTLVJFUSByZXF1ZXN0cyBTSE9VTEQgYmUgYmxh bmsgYW5kIHRoZSBjYWRkciBmaWVsZCBvZg0KICAgdGhlIHRpY2tldCBTSE9VTEQgc2ltaWxhcmx5 IGJlIGxlZnQgYmxhbmsuDQoNCg0KNS4gIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zDQoNCiAgIFNp bWlsYXIgdG8gb3RoZXIgbmV0d29yayBhY2Nlc3MgcHJvdG9jb2xzLCBXUy1LRVJCIGFsbG93cyBh bg0KICAgdW5hdXRoZW50aWNhdGVkIGNsaWVudCAocG9zc2libHkgb3V0c2lkZSB0aGUgc2VjdXJp dHkgcGVyaW1ldGVyIG9mIGFuDQogICBvcmdhbml6YXRpb24pIHRvIHNlbmQgbWVzc2FnZXMgdGhh dCBhcmUgcHJveGllZCB0byBpbnRlcmlvciBzZXJ2ZXJzLg0KDQoNCg0KDQpaaHUgICAgICAgICAg ICAgICAgICAgICAgIEV4cGlyZXMgQXByaWwgNCwgMjAwNyAgICAgICAgICAgICAgICAgW1BhZ2Ug Nl0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICAgICAgIFdTLUtFUkIgICAgICAgICAg ICAgICAgICAgIE9jdG9iZXIgMjAwNg0KDQoNCiAgIEluIGEgc2NlbmFyaW8gd2hlcmUgRE5TIFNS ViBSUidzIGFyZSBiZWluZyB1c2VkIHRvIGxvY2F0ZSB0aGUgS0RDLA0KICAgV1MtS0VSQiBpcyBi ZWluZyB1c2VkLCBhbmQgYW4gZXh0ZXJuYWwgYXR0YWNrZXIgY2FuIG1vZGlmeSBETlMNCiAgIHJl c3BvbnNlcyB0byB0aGUgV1MtS0VSQiBwcm94eSwgdGhlcmUgYXJlIHNldmVyYWwgY291bnRlcm1l YXN1cmVzIHRvDQogICBwcmV2ZW50IGFyYml0cmFyeSBtZXNzYWdlcyBmcm9tIGJlaW5nIHNlbnQg dG8gaW50ZXJuYWwgc2VydmVyczoNCg0KICAgMS4gIEtEQyBwb3J0IG51bWJlcnMgY2FuIGJlIHN0 YXRpY2FsbHkgY29uZmlndXJlZCBvbiB0aGUgV1MtS0VSQg0KICAgICAgIHByb3h5LiAgSW4gdGhp cyBjYXNlLCB0aGUgbWVzc2FnZXMgd2lsbCBhbHdheXMgYmUgc2VudCB0byBLREMncy4NCiAgICAg ICBGb3IgYW4gb3JnYW5pemF0aW9uIHRoYXQgcnVucyBLREMncyBvbiBhIHN0YXRpYyBwb3J0ICh1 c3VhbGx5DQogICAgICAgcG9ydCA4OCkgYW5kIGRvZXMgbm90IHJ1biBhbnkgb3RoZXIgc2VydmVy cyBvbiB0aGUgc2FtZSBwb3J0LA0KICAgICAgIHRoaXMgY291bnRlcm1lYXN1cmUgd291bGQgYmUg ZWFzeSB0byBhZG1pbmlzdGVyIGFuZCBzaG91bGQgYmUNCiAgICAgICBlZmZlY3RpdmUuDQoNCiAg IDIuICBUaGUgcHJveHkgY2FuIGRvIGFwcGxpY2F0aW9uIGxldmVsIHNhbml0eSBjaGVja2luZyBh bmQgZmlsdGVyaW5nLg0KICAgICAgIFRoaXMgY291bnRlcm1lYXN1cmUgc2hvdWxkIGVsaW1pbmF0 ZSBtYW55IG9mIHRoZSBhYm92ZSBhdHRhY2tzLg0KDQogICAzLiAgRE5TIHNlY3VyaXR5IGNhbiBi ZSBkZXBsb3llZC4gIFRoaXMgY291bnRlcm1lYXN1cmUgaXMgcHJvYmFibHkNCiAgICAgICBvdmVy a2lsbCBmb3IgdGhpcyBwYXJ0aWN1bGFyIHByb2JsZW0sIGJ1dCBpZiBhbiBvcmdhbml6YXRpb24g aGFzDQogICAgICAgYWxyZWFkeSBkZXBsb3llZCBETlMgc2VjdXJpdHkgZm9yIG90aGVyIHJlYXNv bnMsIHRoZW4gaXQgbWlnaHQNCiAgICAgICBtYWtlIHNlbnNlIHRvIGxldmVyYWdlIGl0IGhlcmUu ICBOb3RlIHRoYXQgS2VyYmVyb3MgY291bGQgYmUgdXNlZA0KICAgICAgIHRvIHByb3RlY3QgdGhl IEROUyBleGNoYW5nZXMuICBUaGUgaW5pdGlhbCBETlMgU1JWIEtEQyBsb29rdXAgYnkNCiAgICAg ICB0aGUgcHJveHkgd2lsbCBiZSB1bnByb3RlY3RlZCwgYnV0IGFuIGF0dGFjayBoZXJlIGlzIGF0 IG1vc3QgYQ0KICAgICAgIGRlbmlhbCBvZiBzZXJ2aWNlICh0aGUgaW5pdGlhbCBsb29rdXAgd2ls bCBiZSBmb3IgdGhlIHByb3h5J3MgS0RDDQogICAgICAgdG8gZmFjaWxpdGF0ZSBLZXJiZXJvcyBw cm90ZWN0aW9uIG9mIHN1YnNlcXVlbnQgRE5TIGV4Y2hhbmdlcw0KICAgICAgIGJldHdlZW4gaXRz ZWxmIGFuZCB0aGUgRE5TIHNlcnZlcikuDQoNCg0KNi4gIEFja25vd2xlZGdlbWVudHMNCg0KICAg VGhlIGFjY2VwdG9yLXByb3h5IGlkZWEgaXMgYmFzZWQgb24gdGhlIGVhcmx5IHJldmlzaW9ucyBv ZiB0aGlzDQogICBkb2N1bWVudCB3cml0dGVuIGJ5IEpvbmF0aGFuIFRyb3N0bGUsIE1pY2hhZWwg U3dpZnQsIEJlcm5hcmQgQWJvYmENCiAgIGFuZCBHbGVuIFpvcm4uDQoNCiAgIFRoZSByZXN0IG9m IHRoZSBpZGVhcyBtb3N0bHkgY2FtZSBmcm9tIGhhbGx3YXkgY29udmVyc2F0aW9ucyBiZXR3ZWVu DQogICB0aGUgYXV0aG9yIGFuZCBOaWNvbGFzIFdpbGxpYW1zLg0KDQoNCjcuICBJQU5BIENvbnNp ZGVyYXRpb25zDQoNCiAgIFRoZXJlIGlzIG5vIElBTkEgYWN0aW9uIHJlcXVpcmVkIGZvciB0aGlz IGRvY3VtZW50Lg0KDQoNCjguICBOb3JtYXRpdmUgUmVmZXJlbmNlcw0KDQogICBbUkZDMjExOV0g IEJyYWRuZXIsIFMuLCAiS2V5IHdvcmRzIGZvciB1c2UgaW4gUkZDcyB0byBJbmRpY2F0ZQ0KICAg ICAgICAgICAgICBSZXF1aXJlbWVudCBMZXZlbHMiLCBCQ1AgMTQsIFJGQyAyMTE5LCBNYXJjaCAx OTk3Lg0KDQogICBbUkZDMjc0M10gIExpbm4sIEouLCAiR2VuZXJpYyBTZWN1cml0eSBTZXJ2aWNl IEFwcGxpY2F0aW9uIFByb2dyYW0NCiAgICAgICAgICAgICAgSW50ZXJmYWNlIFZlcnNpb24gMiwg VXBkYXRlIDEiLCBSRkMgMjc0MywgSmFudWFyeSAyMDAwLg0KDQoNCg0KWmh1ICAgICAgICAgICAg ICAgICAgICAgICBFeHBpcmVzIEFwcmlsIDQsIDIwMDcgICAgICAgICAgICAgICAgIFtQYWdlIDdd DQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICBXUy1LRVJCICAgICAgICAgICAg ICAgICAgICBPY3RvYmVyIDIwMDYNCg0KDQogICBbUkZDNDEyMF0gIE5ldW1hbiwgQy4sIFl1LCBU LiwgSGFydG1hbiwgUy4sIGFuZCBLLiBSYWVidXJuLCAiVGhlDQogICAgICAgICAgICAgIEtlcmJl cm9zIE5ldHdvcmsgQXV0aGVudGljYXRpb24gU2VydmljZSAoVjUpIiwgUkZDIDQxMjAsDQogICAg ICAgICAgICAgIEp1bHkgMjAwNS4NCg0KICAgW1JGQzQxMjFdICBaaHUsIEwuLCBKYWdhbmF0aGFu LCBLLiwgYW5kIFMuIEhhcnRtYW4sICJUaGUgS2VyYmVyb3MNCiAgICAgICAgICAgICAgVmVyc2lv biA1IEdlbmVyaWMgU2VjdXJpdHkgU2VydmljZSBBcHBsaWNhdGlvbiBQcm9ncmFtDQogICAgICAg ICAgICAgIEludGVyZmFjZSAoR1NTLUFQSSkgTWVjaGFuaXNtOiBWZXJzaW9uIDIiLCBSRkMgNDEy MSwNCiAgICAgICAgICAgICAgSnVseSAyMDA1Lg0KDQogICBbUkZDNDE3OF0gIFpodSwgTC4sIExl YWNoLCBQLiwgSmFnYW5hdGhhbiwgSy4sIGFuZCBXLiBJbmdlcnNvbGwsICJUaGUNCiAgICAgICAg ICAgICAgU2ltcGxlIGFuZCBQcm90ZWN0ZWQgR2VuZXJpYyBTZWN1cml0eSBTZXJ2aWNlIEFwcGxp Y2F0aW9uDQogICAgICAgICAgICAgIFByb2dyYW0gSW50ZXJmYWNlIChHU1MtQVBJKSBOZWdvdGlh dGlvbiBNZWNoYW5pc20iLA0KICAgICAgICAgICAgICBSRkMgNDE3OCwgT2N0b2JlciAyMDA1Lg0K DQogICBbS1JCLUFOT05dIFpodSwgTC4sIExlYWNoLCBQLiBhbmQgSmFnYW5hdGhhbiwgSy4sICJL ZXJiZXJvcyBBbm9ueW1pdHkgDQogICAgICAgICAgICAgIFN1cHBvcnQiLCBkcmFmdC1pZXRmLWty Yi13Zy1hbm9uLCB3b3JrIGluIHByb2dyZXNzLg0KDQogICBbS1JCLVBBRlddIFpodSwgZXRsLCAi S2VyYmVyb3MgUHJlLUF1dGhlbnRpY2F0aW9uIGZyYW1ld29yayIsIA0KICAgICAgICAgICAgICBk cmFmdC1pZXRmLWtyYi13Zy1wcmVhdXRoLWZyYW1ld29yaywgd29yayBpbiBwcm9ncmVzcy4NCiAg ICAgICAgICAgICAgDQogICBbR1NTLUVYVFNdIEVtZXJ5LCBTLiwgZHJhZnQtaWV0Zi1rcmItd2ct Z3NzLWNiLWhhc2gtYWdpbGl0eSwgd29yayBpbiANCiAgICAgICAgICAgICAgcHJvZ2Vzcy4NCg0K ICAgW1JFRkVSQUxTXSBSYWVidXJuLCBLLiwgIkdlbmVyYXRpbmcgS0RDIFJlZmVycmFscyB0byBM b2NhdGUgS2VyYmVyb3MgDQogICAgICAgICAgICAgIFJlYWxtcyIsIGRyYWZ0LWlldGYta3JiLXdn LWtlcmJlcm9zLXJlZmVycmFscywgd29yayBpbg0KICAgICAgICAgICAgICBwcm9ncmVzcy4NCiAg ICAgICAgICAgICAgDQogICBbWDY4MF0gICAgIElUVS1UIFJlY29tbWVuZGF0aW9uIFguNjgwICgy MDAyKSB8IElTTy9JRUMgODgyNC0xOjIwMDIsDQogICAgICAgICAgICAgIEluZm9ybWF0aW9uIHRl Y2hub2xvZ3kgLSBBYnN0cmFjdCBTeW50YXggTm90YXRpb24gT25lDQogICAgICAgICAgICAgIChB U04uMSk6IFNwZWNpZmljYXRpb24gb2YgYmFzaWMgbm90YXRpb24uDQoNCiAgIFtYNjkwXSAgICAg SVRVLVQgUmVjb21tZW5kYXRpb24gWC42OTAgKDIwMDIpIHwgSVNPL0lFQyA4ODI1LTE6MjAwMiwN CiAgICAgICAgICAgICAgSW5mb3JtYXRpb24gdGVjaG5vbG9neSAtIEFTTi4xIGVuY29kaW5nIFJ1 bGVzOg0KICAgICAgICAgICAgICBTcGVjaWZpY2F0aW9uIG9mIEJhc2ljIEVuY29kaW5nIFJ1bGVz IChCRVIpLCBDYW5vbmljYWwNCiAgICAgICAgICAgICAgRW5jb2RpbmcgUnVsZXMgKENFUikgYW5k IERpc3Rpbmd1aXNoZWQgRW5jb2RpbmcgUnVsZXMNCiAgICAgICAgICAgICAgKERFUikuDQoNCg0K QXV0aG9yJ3MgQWRkcmVzcw0KDQogICBMYXJyeSBaaHUNCiAgIE1pY3Jvc29mdCBDb3Jwb3JhdGlv bg0KICAgT25lIE1pY3Jvc29mdCBXYXkNCiAgIFJlZG1vbmQsIFdBICA5ODA1Mg0KICAgVVMNCg0K ICAgRW1haWw6IGx6aHVAbWljcm9zb2Z0LmNvbQ0KDQoNCg0KDQoNClpodSAgICAgICAgICAgICAg ICAgICAgICAgRXhwaXJlcyBBcHJpbCA0LCAyMDA3ICAgICAgICAgICAgICAgICBbUGFnZSA4XQ0K DA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgICAgICAgV1MtS0VSQiAgICAgICAgICAgICAg ICAgICAgT2N0b2JlciAyMDA2DQoNCg0KRnVsbCBDb3B5cmlnaHQgU3RhdGVtZW50DQoNCiAgIENv cHlyaWdodCAoQykgVGhlIEludGVybmV0IFNvY2lldHkgKDIwMDYpLg0KDQogICBUaGlzIGRvY3Vt ZW50IGlzIHN1YmplY3QgdG8gdGhlIHJpZ2h0cywgbGljZW5zZXMgYW5kIHJlc3RyaWN0aW9ucw0K ICAgY29udGFpbmVkIGluIEJDUCA3OCwgYW5kIGV4Y2VwdCBhcyBzZXQgZm9ydGggdGhlcmVpbiwg dGhlIGF1dGhvcnMNCiAgIHJldGFpbiBhbGwgdGhlaXIgcmlnaHRzLg0KDQogICBUaGlzIGRvY3Vt ZW50IGFuZCB0aGUgaW5mb3JtYXRpb24gY29udGFpbmVkIGhlcmVpbiBhcmUgcHJvdmlkZWQgb24g YW4NCiAgICJBUyBJUyIgYmFzaXMgYW5kIFRIRSBDT05UUklCVVRPUiwgVEhFIE9SR0FOSVpBVElP TiBIRS9TSEUgUkVQUkVTRU5UUw0KICAgT1IgSVMgU1BPTlNPUkVEIEJZIChJRiBBTlkpLCBUSEUg SU5URVJORVQgU09DSUVUWSBBTkQgVEhFIElOVEVSTkVUDQogICBFTkdJTkVFUklORyBUQVNLIEZP UkNFIERJU0NMQUlNIEFMTCBXQVJSQU5USUVTLCBFWFBSRVNTIE9SIElNUExJRUQsDQogICBJTkNM VURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIEFOWSBXQVJSQU5UWSBUSEFUIFRIRSBVU0UgT0YgVEhF DQogICBJTkZPUk1BVElPTiBIRVJFSU4gV0lMTCBOT1QgSU5GUklOR0UgQU5ZIFJJR0hUUyBPUiBB TlkgSU1QTElFRA0KICAgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgT1IgRklUTkVTUyBG T1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuDQoNCg0KSW50ZWxsZWN0dWFsIFByb3BlcnR5DQoNCiAg IFRoZSBJRVRGIHRha2VzIG5vIHBvc2l0aW9uIHJlZ2FyZGluZyB0aGUgdmFsaWRpdHkgb3Igc2Nv cGUgb2YgYW55DQogICBJbnRlbGxlY3R1YWwgUHJvcGVydHkgUmlnaHRzIG9yIG90aGVyIHJpZ2h0 cyB0aGF0IG1pZ2h0IGJlIGNsYWltZWQgdG8NCiAgIHBlcnRhaW4gdG8gdGhlIGltcGxlbWVudGF0 aW9uIG9yIHVzZSBvZiB0aGUgdGVjaG5vbG9neSBkZXNjcmliZWQgaW4NCiAgIHRoaXMgZG9jdW1l bnQgb3IgdGhlIGV4dGVudCB0byB3aGljaCBhbnkgbGljZW5zZSB1bmRlciBzdWNoIHJpZ2h0cw0K ICAgbWlnaHQgb3IgbWlnaHQgbm90IGJlIGF2YWlsYWJsZTsgbm9yIGRvZXMgaXQgcmVwcmVzZW50 IHRoYXQgaXQgaGFzDQogICBtYWRlIGFueSBpbmRlcGVuZGVudCBlZmZvcnQgdG8gaWRlbnRpZnkg YW55IHN1Y2ggcmlnaHRzLiAgSW5mb3JtYXRpb24NCiAgIG9uIHRoZSBwcm9jZWR1cmVzIHdpdGgg cmVzcGVjdCB0byByaWdodHMgaW4gUkZDIGRvY3VtZW50cyBjYW4gYmUNCiAgIGZvdW5kIGluIEJD UCA3OCBhbmQgQkNQIDc5Lg0KDQogICBDb3BpZXMgb2YgSVBSIGRpc2Nsb3N1cmVzIG1hZGUgdG8g dGhlIElFVEYgU2VjcmV0YXJpYXQgYW5kIGFueQ0KICAgYXNzdXJhbmNlcyBvZiBsaWNlbnNlcyB0 byBiZSBtYWRlIGF2YWlsYWJsZSwgb3IgdGhlIHJlc3VsdCBvZiBhbg0KICAgYXR0ZW1wdCBtYWRl IHRvIG9idGFpbiBhIGdlbmVyYWwgbGljZW5zZSBvciBwZXJtaXNzaW9uIGZvciB0aGUgdXNlIG9m DQogICBzdWNoIHByb3ByaWV0YXJ5IHJpZ2h0cyBieSBpbXBsZW1lbnRlcnMgb3IgdXNlcnMgb2Yg dGhpcw0KICAgc3BlY2lmaWNhdGlvbiBjYW4gYmUgb2J0YWluZWQgZnJvbSB0aGUgSUVURiBvbi1s aW5lIElQUiByZXBvc2l0b3J5IGF0DQogICBodHRwOi8vd3d3LmlldGYub3JnL2lwci4NCg0KICAg VGhlIElFVEYgaW52aXRlcyBhbnkgaW50ZXJlc3RlZCBwYXJ0eSB0byBicmluZyB0byBpdHMgYXR0 ZW50aW9uIGFueQ0KICAgY29weXJpZ2h0cywgcGF0ZW50cyBvciBwYXRlbnQgYXBwbGljYXRpb25z LCBvciBvdGhlciBwcm9wcmlldGFyeQ0KICAgcmlnaHRzIHRoYXQgbWF5IGNvdmVyIHRlY2hub2xv Z3kgdGhhdCBtYXkgYmUgcmVxdWlyZWQgdG8gaW1wbGVtZW50DQogICB0aGlzIHN0YW5kYXJkLiAg UGxlYXNlIGFkZHJlc3MgdGhlIGluZm9ybWF0aW9uIHRvIHRoZSBJRVRGIGF0DQogICBpZXRmLWlw ckBpZXRmLm9yZy4NCg0KDQpBY2tub3dsZWRnbWVudA0KDQogICBGdW5kaW5nIGZvciB0aGUgUkZD IEVkaXRvciBmdW5jdGlvbiBpcyBwcm92aWRlZCBieSB0aGUgSUVURg0KICAgQWRtaW5pc3RyYXRp dmUgU3VwcG9ydCBBY3Rpdml0eSAoSUFTQSkuDQoNCg0KDQoNCg0KWmh1ICAgICAgICAgICAgICAg ICAgICAgICBFeHBpcmVzIEFwcmlsIDQsIDIwMDcgICAgICAgICAgICAgICAgIFtQYWdlIDldDQoM DQoNCg== ------_=_NextPart_001_01C70252.137285A1 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm ------_=_NextPart_001_01C70252.137285A1-- From spkm-bounces@ietf.org Thu Nov 09 14:27:24 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1GiFYa-00032R-Fz; Thu, 09 Nov 2006 14:27:24 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GiFYZ-00031Z-I4 for spkm@ietf.org; Thu, 09 Nov 2006 14:27:23 -0500 Received: from minbar.fac.cs.cmu.edu ([128.2.185.161]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1GiFWO-0001g5-VI for spkm@ietf.org; Thu, 09 Nov 2006 14:25:11 -0500 Received: from minbar.fac.cs.cmu.edu ([127.0.0.1]) by minbar.fac.cs.cmu.edu id aa15556; 9 Nov 2006 14:24 EST Date: Thu, 9 Nov 2006 14:24:23 -0500 (EST) From: Jeffrey Hutzelman X-X-Sender: To: , Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Cc: hartmans-ietf@mit.edu, housley@vigilsec.com Subject: [SPKM] SPKM BOF summary from IETF 67 X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spkm-bounces@ietf.org What follows is a short summary of the SPKM BOF that was held this Monday. Presentations are on the IETF web site: https://datatracker.ietf.org/public/meeting_materials.cgi?meeting_num=67#wg-spkm Full minutes will be uploaded to that site and posted to the spkm@ietf.org mailing list in the near future. -- Jeff SPKM BOF - IETF 67 meeting summary We held a BOF on the topic of building a lightweight public-key-based GSS-API mechanism, motivated in large part by a need for such a mechanism for NFSv4. We began with a problem statement presentation, which was followed by presentations on proposals for four approaches to solutions: * Updating SPKM3 * PKU2U -- user-to-user auth based on PKINIT and GSS-krb5 * GSS-TLS -- a mechanism built on TLS and/or DTLS * SSiLKey -- use HTTPS to obtain a token used in GSS context establishment Polls indicated there was sufficient interest in this work and enough people willing to work on it; however, it was not clear whether formation of a working group was actually necessary to proceed. The sense of the room seemed to be that leaving the choice of solution up to the proposed WG would be counter-productive, and that any WG formed should be constrained to a particular solution. This led to a discussion about the relative merits of the solutions proposed. The conclusion was that selection of a particlar proposal was not possible in the short time remaining in the BOF session. As a next step, Sam will form an AD-sponsored design team to evaluate the proposals and select one. This group will include one of the authors of of each of the four proposals, and possibly a small number of others. A poll of the room indicated that the output of such a design team would likely be acceptable to the group. _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm From spkm-bounces@ietf.org Mon Nov 13 09:20:44 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Gjcfw-0002KS-Oo; Mon, 13 Nov 2006 09:20:40 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GgpJv-0003Rq-5S for spkm@ietf.org; Sun, 05 Nov 2006 16:14:23 -0500 Received: from wx-out-0506.google.com ([66.249.82.228]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1GgpJr-0001w4-RK for spkm@ietf.org; Sun, 05 Nov 2006 16:14:23 -0500 Received: by wx-out-0506.google.com with SMTP id t4so918134wxc for ; Sun, 05 Nov 2006 13:14:19 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:mime-version:content-type; b=t5LAglXBMClXTEvOaL2kKJjqMBjFzYeQUR8gJ33cvXS0arRhcUlVHgU0VEqYUhG2OT5qqMZns/xYdPWH4z91Md48BAVwgGHxI7UytW5G0Z3piZ14Xl+BJKJ9zVMHRDwY9Amr0BIm7koc/Ofz/4I6A5PyTOmMvbcJblz3M+aUAsY= Received: by 10.70.109.6 with SMTP id h6mr3284369wxc.1162761259379; Sun, 05 Nov 2006 13:14:19 -0800 (PST) Received: by 10.70.18.20 with HTTP; Sun, 5 Nov 2006 13:14:19 -0800 (PST) Message-ID: Date: Mon, 6 Nov 2006 05:14:19 +0800 From: "CAO, ZHEN" To: spkm@ietf.org MIME-Version: 1.0 X-Spam-Score: 0.1 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 X-Mailman-Approved-At: Mon, 13 Nov 2006 09:20:39 -0500 Subject: [SPKM] subscribe X-BeenThere: spkm@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Low Infrastructure Public Key GSS mechanism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1844535934==" Errors-To: spkm-bounces@ietf.org --===============1844535934== Content-Type: multipart/alternative; boundary="----=_Part_34397_2521989.1162761259344" ------=_Part_34397_2521989.1162761259344 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Hi, Would you please include me in your discussion in this BOF. Many thanks, Zhen Cao Ph. D. Student, Peking University China ------=_Part_34397_2521989.1162761259344 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline
Hi,
 
Would you please include me in your discussion in this BOF.
 
Many thanks,
Zhen Cao
 
Ph. D. Student,
Peking University
China
------=_Part_34397_2521989.1162761259344-- --===============1844535934== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ SPKM mailing list SPKM@ietf.org https://www1.ietf.org/mailman/listinfo/spkm --===============1844535934==--