From nobody Thu Sep 14 16:19:36 2017 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AEA9413214D; Thu, 14 Sep 2017 16:19:28 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: stir@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.61.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <150543116865.2799.3691831788589432548@ietfa.amsl.com> Date: Thu, 14 Sep 2017 16:19:28 -0700 Archived-At: Subject: [stir] I-D Action: draft-ietf-stir-rph-01.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Sep 2017 23:19:29 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited WG of the IETF. Title : PASSporT Extension for Resource-Priority Authorization Authors : Ray P. Singh Martin Dolly Subir Das An Nguyen Filename : draft-ietf-stir-rph-01.txt Pages : 9 Date : 2017-09-14 Abstract: This document extends the PASSporT object to convey cryptographically-signed assertions of authorization for communications 'Resource-Priority'. It extends PASSporT to allow cryptographic-signing of the SIP 'Resource-Priority" header field which is used for communications resource prioritization. It also describes how the PASSPorT extension is used in SIP signaling to convey assertions of authorization of the information in the SIP 'Resource-Priority' header field. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-rph/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-stir-rph-01 https://datatracker.ietf.org/doc/html/draft-ietf-stir-rph-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-rph-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Sep 26 04:09:54 2017 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FF3D13302A for ; Tue, 26 Sep 2017 04:09:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.219 X-Spam-Level: X-Spam-Status: No, score=-4.219 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NZLwqXAtbso8 for ; Tue, 26 Sep 2017 04:09:51 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7F68813293A for ; Tue, 26 Sep 2017 04:09:50 -0700 (PDT) X-AuditID: c1b4fb30-cd5ff70000001911-6f-59ca357c48c9 Received: from ESESSHC006.ericsson.se (Unknown_Domain [153.88.183.36]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id A6.20.06417.C753AC95; Tue, 26 Sep 2017 13:09:48 +0200 (CEST) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (153.88.183.145) by oa.msg.ericsson.com (153.88.183.36) with Microsoft SMTP Server (TLS) id 14.3.352.0; Tue, 26 Sep 2017 13:09:47 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.onmicrosoft.com; s=selector1-ericsson-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=4Uzl1NoDfOrxKwp7c81/IuaiqjuerRZHn02wP+u5g5s=; b=RiIIKsCW8zI8hhn2+P0nPwiskFmU8ky4WYaUHdpn5FiaRmaDvCtDIUaJqob8YcPgW0LmCoSsTd7KQ98PDraI0c7qI+6meZCydufjbHqMuJiKIeE4i9OesSPMT+oSOpPQJAC0FGgHQ7au5g0NVUkLiXJD3+Vvuz2BuhT6l8VOVNQ= Received: from DB5PR07MB1127.eurprd07.prod.outlook.com (10.163.103.157) by DB5PR07MB1125.eurprd07.prod.outlook.com (10.163.103.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.5; Tue, 26 Sep 2017 11:09:46 +0000 Received: from DB5PR07MB1127.eurprd07.prod.outlook.com ([fe80::d972:4dd:2365:1fad]) by DB5PR07MB1127.eurprd07.prod.outlook.com ([fe80::d972:4dd:2365:1fad%13]) with mapi id 15.20.0077.011; Tue, 26 Sep 2017 11:09:46 +0000 From: Julio Martinez-Minguito To: "stir@ietf.org" Thread-Topic: [stir] Validating TN authority together with number portability Thread-Index: AdMWbZ5Gal6PDfc1QQq1QCbE62ZgWAAHWvaAAABhs+A= Date: Tue, 26 Sep 2017 11:09:46 +0000 Message-ID: References: <391A1CF8-4CED-4ECF-92EF-FA988B4881C4@chriswendt.net> In-Reply-To: <391A1CF8-4CED-4ECF-92EF-FA988B4881C4@chriswendt.net> Accept-Language: sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=julio.martinez-minguito@ericsson.com; x-originating-ip: [192.176.1.86] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DB5PR07MB1125; 6:oGvYWd67sDCZVqVI6hN/jfjE4fOlrBB4qz8EHMoTgQ72HpOwngEvrSzKPWDPs+5Hkjy9aOhCrRzpscftXOlnAnDUw4VLv2RGxBp/+st7HN58j5mRkj8RZeXgmAfAFl8+KoBxdA7fTOO85kLuJ6YDghg2QTjvkBSpp1Fxvi+lEvDoFAp5qP4w01eVS/KRg0eOCIjyMR6XKIv++/uU/x9PrIj7r2RFqHdr8OKA0EKcsky3D1IkWpvEHZ6BrpUZM7JSImiZ5d9rAWs61eqji+uQHUjOxLgGKKPyQfvJ9E374zRcbHqANHFZWJ9TZMrbHLP/6+/2V0DgXsxPnfv2quInTw==; 5:Fo1u2XLgfC2Nyv1PqsL3Sdp24gTyLxnBk20IFhx9GmxofCWkASRMbx+RPE0sepsoK31svsoKb7lASwmq+/Zxm1xO/LLwQKQeiHRzP3mgUFE6NBJwd+XBamf72YxNaV6ketzeYCIK81wb5OVT6APx5w==; 24:NN+Qz+Bm/wPLGeeWkXKq17CcGpQQRzwQ0/HifGa8lYTvhmGMHJ6iHBxqoJTzTp+ByXCd2Bffp8z369vhyMLpY/Bkw01Ls9CU50a+J8yJQkQ=; 7:Iqd5DuTNoPI1notFv8ynZpwHU9uUhQYK1Rlq4xR6stu5qpn74Awq0InVoXPflqtrRtW80SWc4Vf2oZ79S2IiFT2RANVwOdHsATGBWQYQ1X1gyid85aKyqGF9R5xvNdwq1QZl/nPuyaa4qyBhcz86ZkySFOWOawYQvihELAqqG0Oo9KLiepM87izrOOKwP1EzeYchvtl8Q1gECWNqlzhYvtZPjG+Wj8nWfZzmodgLdXE= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 47aa14f8-f148-43b7-aaa5-08d504cf18f8 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254152)(2017052603199)(201703131423075)(201703031133081)(201702281549075); SRVR:DB5PR07MB1125; x-ms-traffictypediagnostic: DB5PR07MB1125: x-exchange-antispam-report-test: UriScan:(37575265505322)(158342451672863)(21748063052155)(21532816269658); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(3002001)(100000703101)(100105400095)(10201501046)(93006095)(93001095)(6041248)(20161123564025)(20161123555025)(20161123558100)(20161123562025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:DB5PR07MB1125; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:DB5PR07MB1125; x-forefront-prvs: 0442E569BC x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(24454002)(199003)(377454003)(189002)(1730700003)(6506006)(86362001)(81166006)(81156014)(8676002)(790700001)(2351001)(3280700002)(6436002)(102836003)(3846002)(6116002)(7696004)(33656002)(106356001)(74316002)(5660300001)(7736002)(105586002)(68736007)(54896002)(6306002)(229853002)(3660700001)(14454004)(2950100002)(6916009)(5630700001)(5640700003)(236005)(9686003)(2906002)(99286003)(53546010)(55016002)(66066001)(606006)(478600001)(966005)(101416001)(53936002)(97736004)(25786009)(6246003)(76176999)(54356999)(50986999)(316002)(189998001)(2501003)(5250100002)(8936002)(2900100001); DIR:OUT; SFP:1101; SCL:1; SRVR:DB5PR07MB1125; H:DB5PR07MB1127.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DB5PR07MB11275A21EE79065EBC7C262FC77B0DB5PR07MB1127eurp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Sep 2017 11:09:46.4765 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5PR07MB1125 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrIKsWRmVeSWpSXmKPExsUyM2K7im6N6alIg2eXjCyWr93G5MDosWTJ T6YAxigum5TUnMyy1CJ9uwSujLsrZ7EXdB1krGi/s5GpgfHbGsYuRk4OCQETiUf9k9lAbCGB I4wS67aUdjFyAdknGCU65nxjBXFYBHqZJW7/OsICkZnOJHF77n1WCOcho8SCS9tZQPrZBFwk bp24CzZXREBZYsu6O+wgtrCAj8Te2ZeYuhg5gOK+EpOWCEKUWEnsap4ItppFQFXi1eMnzCA2 r0CMxKqZh5khTprCKLH8oQWIzSngJHFrxh+wkYwCshL3v98DW8ssIC5x68l8Joh3BCSW7DnP DGGLSrx8/I8Voj5d4nvzOVaIuILE/V+ToWpkJS7N72YE+UVCoI1dYnfvUxaIhJ7E1olvoWHk K9G7uI0Jomgeo8SunXehEloSHVN2QNnZEtO+3YGzj/zuZ4VoOM0q8aR7JTtEQkbi5Y7vbBB2 H5vE0h16Exi1ZyH5AsLOl3i5/jv7LHBoCEqcnPmEBSKuI7Fg9yc2CFtbYtnC18ww9pkDj5mQ xRcwsq9iFC1OLU7KTTcy0kstykwuLs7P08tLLdnECEw4B7f8NtjB+PK54yFGAQ5GJR7eFdKn IoVYE8uKK3MPMUpwMCuJ8JboAoV4UxIrq1KL8uOLSnNSiw8xSnOwKInzOu67ECEkkJ5Ykpqd mlqQWgSTZeLglGpgjFvvc9Xi6dGMTvXT//g/bjvbsIHffqHp2rYtQjtmXF9ymYdJ1v/uldl9 c+euCBHlSSvlumMZrMu0YtL22mX5ms8YWF9+KZy1+OTBVceYRPiPWT/d3/09+8O656u1n7JE x4puPvzqxe6n29cwT201mJqqOHXzH1YvJYUlbBsPWr+IjLG08Ts54YYSS3FGoqEWc1FxIgAR P78NNAMAAA== Archived-At: Subject: Re: [stir] Validating TN authority together with number portability X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Sep 2017 11:09:54 -0000 --_000_DB5PR07MB11275A21EE79065EBC7C262FC77B0DB5PR07MB1127eurp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable As you mentioned, SHAKEN does not care about for which TNs a certificate ha= s authority. It is trusted that the TN belongs to the certificate, and if n= ot, measures are taken later and the reputation of the operator/certificate= will be affected. But back to the IETF draft for certificates and TN authority declaration, t= he current method to specify the authority can get difficult to implement. = If number is ported out we split a range in 2 ranges. And we'll keep splitt= ing the ranges as more numbers are being ported out. Using different certificates for different ranges would result on a high nu= mber of certificates. Specifying all the ranges within 1 certificate will r= esult also in a complex specification. The specification should be extended to simplify the way to indicate the au= thority over telephone numbers, specially when numbers are ported out from = ranges. >Brian Rosen Wed, 23 August 2017 14:32 UTCShow header >Resellers complicate it. >> On Aug 23, 2017, at 10:01 AM, Eric Burger ; wrote: >> >> For that matter, in North America the NPAC already has which operator is= supposed to manage a given ported TN. I'm not sure I see the issue here. I= suppose one could cross check to make sure the right operator is signing, = or is the root of distribution, for a given number. >> >>> On Aug 16, 2017, at 8:27 AM, Chris Wendt ; wrote: >>> >>> I think you would just cover this scenario with two different certifica= tes with the two smaller ranges. >>> >>> That said, for North America the SHAKEN approach is not to use certific= ates for number blocks, so not sure if you looking at a generic solution or= not. >>> >>>> On Aug 16, 2017, at 5:21 AM, Julio Martinez-Minguito ; wrot= e: >>>> Hi, >>>> The current drafts for RFC4474bis and certificates describe how to val= idate that a telephone number is owned by the operator signing the calling = Identity. A TNAuthorizationList may be included in the certificate listing = the numbers the operator is authoritative for. >>>> >>>> However, I see some issues handling this together with number portabil= ity which need to be clarified. >>>> Subscribers will be ported in and out quite frequently, making the inf= ormation in the certificates obsolete. To keep up the pace with the number = portability, the operators certificates would have to be updated frequently= . Should the certificates have short validity times? E.g. 1 week, or even s= horter? >>>> >>>> Instead of having the TN information in the certificate and need to up= date it constantly, it would be more appropriate to have a trusted server c= onnected to the national Number Portability DB (to update the information) = to which the verifiers can connect and retrieve the authority information. = Each verifier could retrieve the TN lists for operators and refresh the lis= t daily, without needing to re-issue operator certificates, so it would be = updated with the latest portability. >>>> >>>> About how to represent the TN lists, e.g. if an operator owns the rang= e 555-xxxx, with the current definitions it will be easy to describe: >>>> TelephoneNumberRange ::=3D SEQUENCE { >>>> start TelephoneNumber =3D 5550000, >>>> count INTEGER (2..MAX) =3D 10000 >>>> } >>>> >>>> Now, if number 555-6789 moves to another operator we have to represent= with: >>>> ({start =3D 5550000, count =3D 6789}, {start =3D 5556790, count =3D 32= 10}) >>>> >>>> As more numbers are moved out from the range, this representation form= at will get messy and difficult to manage. >>>> >>>> To handle NP it would be easier to keep the original range, and includ= e a list of excluded numbers which have been ported out, e.g.: >>>> >>>> TelephoneNumberRange ::=3D SEQUENCE { >>>> start TelephoneNumber, >>>> count INTEGER (2..MAX), >>>> excludedNumbers SEQUENCE SIZE (1..MAX) OF TNEntry >>>> } >>>> >>>> >>>> Is this a feasible solution? Is it too late to handle now due to the c= urrent state? >>>> _______________________________________________ >>>> stir mailing list >>>> stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>> >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir --_000_DB5PR07MB11275A21EE79065EBC7C262FC77B0DB5PR07MB1127eurp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

As you mentioned, SHAKEN does not care about for wh= ich TNs a certificate has authority. It is trusted that the TN belongs to t= he certificate, and if not, measures are taken later and the reputation of the operator/certificate will be affected.

 

But back to the IETF draft for certificates and TN = authority declaration, the current method to specify the authority can get = difficult to implement. If number is ported out we split a range in 2 ranges. And we’ll keep splitting the ranges as= more numbers are being ported out.

Using different certificates for different ranges w= ould result on a high number of certificates. Specifying all the ranges wit= hin 1 certificate will result also in a complex specification.

 

The specification should be extended to simplify th= e way to indicate the authority over telephone numbers, specially when numb= ers are ported out from ranges.

 

>Brian R= osen <br@brianrosen.net> Wed, 23 August 2017 14:32 UTCShow header

>Reseller= s complicate it.

>> On = Aug 23, 2017, at 10:01 AM, Eric Burger <eburger@standardstrack.c= om>; wrote:

>>

>> For= that matter, in North America the NPAC already has which operator is suppo= sed to manage a given ported TN. I’m not sure I see the issue here. I suppose one could cross check to make sure the rig= ht operator is signing, or is the root of distribution, for a given number.=

>>

>>>= On Aug 16, 2017, at 8:27 AM, Chris Wendt <chris-ietf@chriswendt.= net>; wrote:

>>>

>>>= I think you would just cover this scenario with two different certificates= with the two smaller ranges.

>>>

>>>= That said, for North America the SHAKEN approach is not to use certificate= s for number blocks, so not sure if you looking at a generic solution or not.

>>>

>>>= > On Aug 16, 2017, at 5:21 AM, Julio Martinez-Minguito <julio.martinez-minguito@ericsson.com>; wrote:

>>>= > Hi,

>>>= > The current drafts for RFC4474bis and certificates describe how to val= idate that a telephone number is owned by the operator signing the calling Identity. A TNAuthorizationList may be included in the= certificate listing the numbers the operator is authoritative for.

>>>= >

>>>= > However, I see some issues handling this together with number portabil= ity which need to be clarified.

>>>= > Subscribers will be ported in and out quite frequently, making the inf= ormation in the certificates obsolete. To keep up the pace with the number portability, the operators certificates would hav= e to be updated frequently. Should the certificates have short validity tim= es? E.g. 1 week, or even shorter?

>>>= >

>>>= > Instead of having the TN information in the certificate and need to up= date it constantly, it would be more appropriate to have a trusted server connected to the national Number Portability DB (to = update the information) to which the verifiers can connect and retrieve the= authority information. Each verifier could retrieve the TN lists for opera= tors and refresh the list daily, without needing to re-issue operator certificates, so it would be updated = with the latest portability.

>>>= >

>>>= > About how to represent the TN lists, e.g. if an operator owns the rang= e 555-xxxx, with the current definitions it will be easy to describe:

>>>= > TelephoneNumberRange ::=3D SEQUENCE {

>>>= >      start TelephoneNumber =3D 5550000,<= /o:p>

>>>= >      count INTEGER (2..MAX) =3D 10000

>>>= >      }

>>>= >

>>>= > Now, if number 555-6789 moves to another operator we have to represent= with:

>>>= > ({start =3D 5550000, count =3D 6789}, {start =3D 5556790, count =3D 32= 10})

>>>= >

>>>= > As more numbers are moved out from the range, this representation form= at will get messy and difficult to manage.

>>>= >

>>>= > To handle NP it would be easier to keep the original range, and includ= e a list of excluded numbers which have been ported out, e.g.:

>>>= >

>>>= > TelephoneNumberRange ::=3D SEQUENCE {

>>>= >      start TelephoneNumber,=

>>>= >      count INTEGER (2..MAX),

>>>= >      excludedNumbers SEQUENCE SIZE (1..MAX) O= F TNEntry

>>>= >      }

>>>= >

>>>= >

>>>= > Is this a feasible solution? Is it too late to handle now due to the c= urrent state?

>>>= > _______________________________________________

>>>= > stir mailing list

>>>= > stir@ietf.or= g

>>>= > https://www.ietf.org/mailman/listinfo/stir<= /span>

>>>

>>>= _______________________________________________

>>>= stir mailing list

>>> stir@ietf.or= g

>>> https://www.ietf.org/mailman/listinfo/stir<= /span>

>>

>> ___= ____________________________________________

>> sti= r mailing list

>> stir@ietf.or= g

>> https://www.ietf.org/mailman/listinfo/stir<= /span>

 

--_000_DB5PR07MB11275A21EE79065EBC7C262FC77B0DB5PR07MB1127eurp_-- From nobody Tue Sep 26 06:11:48 2017 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F19B61332DA for ; Tue, 26 Sep 2017 06:11:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nsTY3zww4QzX for ; Tue, 26 Sep 2017 06:11:44 -0700 (PDT) Received: from mail-it0-x233.google.com (mail-it0-x233.google.com [IPv6:2607:f8b0:4001:c0b::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 951E3133200 for ; Tue, 26 Sep 2017 06:11:42 -0700 (PDT) Received: by mail-it0-x233.google.com with SMTP id c195so2808235itb.1 for ; Tue, 26 Sep 2017 06:11:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=QkYy+1MqtXH+Zjl/3drfu6Iucf8rjqkPUWgPHgyriTE=; b=cizNaBRYv0L7/YQ/4jjXXrJHYkkDGTKPth/HVohyjigdwjY1oGm05nNHRJ//s9saAv 55stgfq/lfti5OmHYbou+JexH0F3FXSbGyvD119JFYu/0TuV8YTqCn6MG7poM7ytDNMF zdH6flXWPk1j5v7U2Vd7RA4z7xfxZ6BQtUQEuvzKkqM5Bjc9/h+p8bfh9EEJvBiAWJ6R pJkMa0TwworYm21tNvHT1d1LB+mSlvu55aL3PD8nGROTDbApEn13lvJUWMgfDjaW0dUW lA1qqv7uq60A3Zkp3NdwLhylk7R15FE44VEvKOrMPVShs1EbzraO3d5lTJ26cMRy1Twz e9GQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=QkYy+1MqtXH+Zjl/3drfu6Iucf8rjqkPUWgPHgyriTE=; b=aV88A5egCdLt6LlVYhjANWBYXuOnTCnH25KLkOzZLTuD0/z/J9GlQhbPUmtZ/M2rtZ ULaqTxgwVKz+nPWjfIiq1xJ5qWaDuvjAApJyULNOIYFY05fvQ1BlNWlD0RvtDz10kuev TaGPUGG9jA5s0uFVeTyLOWKPyi0HnhQsWMbZywu2JoViH7Lu61qYamOS2+4iFR0/F5u3 CubaP/PmmvH7UefJHNGslwk1kydXOPS6xQ4Lfm5zuDGK4jhfAGUvPgwNtIsHcd2yJiHj RhgEj3zOoxord1BpsVv0rx87tSU11+L8l4TfugfeXLTWrHVtgI2phoFcdGaeNEk940Ha cLTw== X-Gm-Message-State: AHPjjUgH8b7eBUj5e9s4jFEHbBA+mDEiygpKGGDnWrF3ydKZUCqaieCq kZ09AfdlcO9gbVTre1aB/8cLmQ== X-Google-Smtp-Source: AOwi7QCQmGt3nFF0a3UTv05kwFqkSbmeML0kdjKwE8pliHTRNAmvE/ku/m4xV/ucaqGVK0tnWE53vQ== X-Received: by 10.36.5.84 with SMTP id 81mr5427240itl.96.1506431501867; Tue, 26 Sep 2017 06:11:41 -0700 (PDT) Received: from [10.136.137.61] ([192.42.83.150]) by smtp.gmail.com with ESMTPSA id f64sm4147829ioa.45.2017.09.26.06.11.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Sep 2017 06:11:40 -0700 (PDT) From: Chris Wendt Message-Id: <543B5C94-D117-44DA-B66D-56DB809A068D@chriswendt.net> Content-Type: multipart/alternative; boundary="Apple-Mail=_19A3A09B-EEDC-4B2F-9495-518F2E7CDD9E" Mime-Version: 1.0 (Mac OS X Mail 11.0 \(3445.1.6\)) Date: Tue, 26 Sep 2017 08:11:39 -0500 In-Reply-To: Cc: "stir@ietf.org" To: Julio Martinez-Minguito References: <391A1CF8-4CED-4ECF-92EF-FA988B4881C4@chriswendt.net> X-Mailer: Apple Mail (2.3445.1.6) Archived-At: Subject: Re: [stir] Validating TN authority together with number portability X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Sep 2017 13:11:47 -0000 --Apple-Mail=_19A3A09B-EEDC-4B2F-9495-518F2E7CDD9E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I get your point but I=E2=80=99d be curious to hear a good proposal on = how to do this simpler than the specs already provide. This is an information theory problem, it=E2=80=99s hard to represent a = disparate set/grouping of numbers no matter how you attack it. > On Sep 26, 2017, at 6:09 AM, Julio Martinez-Minguito = wrote: >=20 > As you mentioned, SHAKEN does not care about for which TNs a = certificate has authority. It is trusted that the TN belongs to the = certificate, and if not, measures are taken later and the reputation of = the operator/certificate will be affected.=20 > =20 > But back to the IETF draft for certificates and TN authority = declaration, the current method to specify the authority can get = difficult to implement. If number is ported out we split a range in 2 = ranges. And we=E2=80=99ll keep splitting the ranges as more numbers are = being ported out. > Using different certificates for different ranges would result on a = high number of certificates. Specifying all the ranges within 1 = certificate will result also in a complex specification.=20 > =20 > The specification should be extended to simplify the way to indicate = the authority over telephone numbers, specially when numbers are ported = out from ranges. > =20 >=20 > >Brian Rosen > Wed, 23 = August 2017 14:32 UTCShow header = > >Resellers complicate it. >=20 > >> On Aug 23, 2017, at 10:01 AM, Eric Burger = ; = wrote: >=20 > >> >=20 > >> For that matter, in North America the NPAC already has which = operator is supposed to manage a given ported TN. I=E2=80=99m not sure I = see the issue here. I suppose one could cross check to make sure the = right operator is signing, or is the root of distribution, for a given = number. >=20 > >> >=20 > >>> On Aug 16, 2017, at 8:27 AM, Chris Wendt = ; = wrote: >=20 > >>> >=20 > >>> I think you would just cover this scenario with two different = certificates with the two smaller ranges. >=20 > >>> >=20 > >>> That said, for North America the SHAKEN approach is not to use = certificates for number blocks, so not sure if you looking at a generic = solution or not. >=20 > >>> >=20 > >>>> On Aug 16, 2017, at 5:21 AM, Julio Martinez-Minguito = = ; wrote: >=20 > >>>> Hi, >=20 > >>>> The current drafts for RFC4474bis and certificates describe how = to validate that a telephone number is owned by the operator signing the = calling Identity. A TNAuthorizationList may be included in the = certificate listing the numbers the operator is authoritative for. >=20 > >>>> >=20 > >>>> However, I see some issues handling this together with number = portability which need to be clarified. >=20 > >>>> Subscribers will be ported in and out quite frequently, making = the information in the certificates obsolete. To keep up the pace with = the number portability, the operators certificates would have to be = updated frequently. Should the certificates have short validity times? = E.g. 1 week, or even shorter? >=20 > >>>> >=20 > >>>> Instead of having the TN information in the certificate and need = to update it constantly, it would be more appropriate to have a trusted = server connected to the national Number Portability DB (to update the = information) to which the verifiers can connect and retrieve the = authority information. Each verifier could retrieve the TN lists for = operators and refresh the list daily, without needing to re-issue = operator certificates, so it would be updated with the latest = portability. >=20 > >>>> >=20 > >>>> About how to represent the TN lists, e.g. if an operator owns the = range 555-xxxx, with the current definitions it will be easy to = describe: >=20 > >>>> TelephoneNumberRange ::=3D SEQUENCE { >=20 > >>>> start TelephoneNumber =3D 5550000, >=20 > >>>> count INTEGER (2..MAX) =3D 10000 >=20 > >>>> } >=20 > >>>> >=20 > >>>> Now, if number 555-6789 moves to another operator we have to = represent with: >=20 > >>>> ({start =3D 5550000, count =3D 6789}, {start =3D 5556790, count =3D= 3210}) >=20 > >>>> >=20 > >>>> As more numbers are moved out from the range, this representation = format will get messy and difficult to manage. >=20 > >>>> >=20 > >>>> To handle NP it would be easier to keep the original range, and = include a list of excluded numbers which have been ported out, e.g.: >=20 > >>>> >=20 > >>>> TelephoneNumberRange ::=3D SEQUENCE { >=20 > >>>> start TelephoneNumber, >=20 > >>>> count INTEGER (2..MAX), >=20 > >>>> excludedNumbers SEQUENCE SIZE (1..MAX) OF TNEntry >=20 > >>>> } >=20 > >>>> >=20 > >>>> >=20 > >>>> Is this a feasible solution? Is it too late to handle now due to = the current state? >=20 > >>>> _______________________________________________ >=20 > >>>> stir mailing list >=20 > >>>> stir@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/stir = > >>> >=20 > >>> _______________________________________________ >=20 > >>> stir mailing list >=20 > >>> stir@ietf.org > >>> https://www.ietf.org/mailman/listinfo/stir = > >> >=20 > >> _______________________________________________ >=20 > >> stir mailing list >=20 > >> stir@ietf.org > >> https://www.ietf.org/mailman/listinfo/stir = > =20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir = --Apple-Mail=_19A3A09B-EEDC-4B2F-9495-518F2E7CDD9E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = get your point but I=E2=80=99d be curious to hear a good proposal on how = to do this simpler than the specs already provide.

This is an information theory problem, = it=E2=80=99s hard to represent a disparate set/grouping of numbers no = matter how you attack it.


On Sep 26, 2017, at 6:09 AM, Julio Martinez-Minguito <julio.martinez-minguito@ericsson.com> wrote:

As you mentioned, SHAKEN = does not care about for which TNs a certificate has authority. It is = trusted that the TN belongs to the certificate, and if not, measures are = taken later and the reputation of the operator/certificate will be = affected. 
 
But back to the IETF = draft for certificates and TN authority declaration, the current method = to specify the authority can get difficult to implement. If number is = ported out we split a range in 2 ranges. And we=E2=80=99ll keep = splitting the ranges as more numbers are being ported out.
Using different certificates for different = ranges would result on a high number of certificates. Specifying all the = ranges within 1 certificate will result also in a complex = specification. 
 
The specification = should be extended to simplify the way to indicate the authority over = telephone numbers, specially when numbers are ported out from = ranges.

 

>Brian Rosen <br@brianrosen.net> Wed, 23 August 2017 14:32 = UTCShow = header

>Resellers complicate it.

>> On = Aug 23, 2017, at 10:01 AM, Eric Burger <eburger@standardstrack.com>; = wrote:

>>

>> For that matter, in North America = the NPAC already has which operator is supposed to manage a given ported = TN. I=E2=80=99m not sure I see the issue here. I suppose one could cross = check to make sure the right operator is signing, or is the root of = distribution, for a given number.

>>

>>> On Aug 16, 2017, at 8:27 AM, = Chris Wendt <chris-ietf@chriswendt.net>; wrote:

>>>

>>> I think you would just cover = this scenario with two different certificates with the two smaller = ranges.

>>>

>>> That said, for North America = the SHAKEN approach is not to use certificates for number blocks, so not = sure if you looking at a generic solution or not.

>>>

>>>> On Aug 16, 2017, at 5:21 = AM, Julio Martinez-Minguito <julio.martinez-minguito@ericsson.com>; = wrote:

>>>> Hi,

>>>> The current drafts for = RFC4474bis and certificates describe how to validate that a telephone = number is owned by the operator signing the calling Identity. A = TNAuthorizationList may be included in the certificate listing the = numbers the operator is authoritative for.

>>>>

>>>> However, I see some issues = handling this together with number portability which need to be = clarified.

>>>> Subscribers will be ported in and out = quite frequently, making the information in the certificates obsolete. = To keep up the pace with the number portability, the operators = certificates would have to be updated frequently. Should the = certificates have short validity times? E.g. 1 week, or even = shorter?

>>>>

>>>> Instead of having the TN = information in the certificate and need to update it constantly, it = would be more appropriate to have a trusted server connected to the = national Number Portability DB (to update the information) to which the = verifiers can connect and retrieve the authority information. Each = verifier could retrieve the TN lists for operators and refresh the list = daily, without needing to re-issue operator certificates, so it would be = updated with the latest portability.

>>>>

>>>> About how to represent the TN lists, e.g. if = an operator owns the range 555-xxxx, with the current definitions it = will be easy to describe:

>>>> TelephoneNumberRange ::=3D = SEQUENCE {

>>>>      start = TelephoneNumber =3D 5550000,

>>>>      count INTEGER = (2..MAX) =3D 10000

>>>>      }

>>>>

>>>> Now, if number 555-6789 = moves to another operator we have to represent with:

>>>> ({start =3D 5550000, count =3D 6789}, {start = =3D 5556790, count =3D 3210})

>>>>

>>>> As more numbers are moved out from the = range, this representation format will get messy and difficult to = manage.

>>>>

>>>> To handle NP it would be = easier to keep the original range, and include a list of excluded = numbers which have been ported out, e.g.:

>>>>

>>>> TelephoneNumberRange ::=3D = SEQUENCE {

>>>>      start = TelephoneNumber,

>>>>      count = INTEGER (2..MAX),

>>>>      = excludedNumbers SEQUENCE SIZE (1..MAX) OF TNEntry

>>>>      }

>>>>

>>>>

>>>> Is this a feasible solution? Is it too late = to handle now due to the current state?

>>>> = _______________________________________________

>>>> stir mailing list

>>>> stir@ietf.org

>>>> https://www.ietf.org/mailman/listinfo/stir

>>>

>>> = _______________________________________________

>>> = stir mailing list

>>> stir@ietf.org

>>> https://www.ietf.org/mailman/listinfo/stir

>>

>> = _______________________________________________

>> stir = mailing list

>> stir@ietf.org

>> https://www.ietf.org/mailman/listinfo/stir

 

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_19A3A09B-EEDC-4B2F-9495-518F2E7CDD9E-- From nobody Tue Sep 26 06:22:08 2017 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0FC71332E4 for ; Tue, 26 Sep 2017 06:22:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.588 X-Spam-Level: X-Spam-Status: No, score=-2.588 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=brianrosen-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 12mCq2SSdCn6 for ; Tue, 26 Sep 2017 06:22:03 -0700 (PDT) Received: from mail-yw0-x230.google.com (mail-yw0-x230.google.com [IPv6:2607:f8b0:4002:c05::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DD8E1332CE for ; Tue, 26 Sep 2017 06:22:03 -0700 (PDT) Received: by mail-yw0-x230.google.com with SMTP id w9so7031725ywi.11 for ; Tue, 26 Sep 2017 06:22:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brianrosen-net.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=vI7sTMpFMlbpnkjHv4A7DWUr8OmuGU+hG40qoKsdh0U=; b=0kkgYCCVHw66JX1PaTGAa9qGnMWO3M9AivJ+vavqIcpzI+N5gql9veA5+/cCkWQqhq /clMYDq6GBAyRDdIRetReyltPuN2MiCP2GSty/924H+0ubEmhUZ1xn13FUEbHxOCt6xB niTDAzsW96lDDCCLTzjMrOkDcjiLHMyBnIrD3KJhIcPOCquMp6AiO7UflZylcKX9JBKw qe46eiKUhwHUbYUwe9hVbMiXXFo9p+PIxW89dcld7v9ddnJnUAnFUKoTXmtmBQVFoqoI ZdAt43xm/Ub7AzgeH5Po0Db6u9WKAgYkN5dgzO/uaEOcAMLHePi2BmBJnOBj1WjIDti5 9Jzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=vI7sTMpFMlbpnkjHv4A7DWUr8OmuGU+hG40qoKsdh0U=; b=UkkUCHYYjUDujqoDa1TSyjvTbfB/P+Q4uVm6oPkN0dUSZ7A96ax0DzSizetTFU6p0v 8o9RmSljFUeZ7uMdcIrZcyRCPcuF9OdktOmqTLxG3hFfIXYIs+7VAyfrQyHrQlgF5a1+ 1VQ/evmAcxKHJhIjuu2/HvPHlOttunA9ej5yeLoAqom+i4fNybDCyIVUmz5jTuuLWsLC f8HhnqyCAiCGf8nmchfz6HhxE6gupjL7/wsMErULBqGuC09xbtVTmSvlTnX+uNSrcXb7 +GpO5YpSnfWAEgOQvPoLdRuUbBriGMXsk30BiME9YRpSbH2ZSvLVLYMvY/TH/3UBs8xT qubg== X-Gm-Message-State: AHPjjUimSw5JohrP/3iyG1rC7kmpS8ni1JICDPkpoJrR6e5LH5EuS5fq 81iFUN2Lc4Sl3QfLbkI7t/x0Hg== X-Google-Smtp-Source: AOwi7QDmX2PCpBWmpiA6opvydQtzNVkCEkrW1YXM/iuw11vDHFSdnKUtbQCXhdqzCzLE1jKAIrk31Q== X-Received: by 10.37.35.146 with SMTP id j140mr6235138ybj.399.1506432122647; Tue, 26 Sep 2017 06:22:02 -0700 (PDT) Received: from [10.33.192.12] (neustar-sthide-nat1.neustar.biz. [156.154.81.54]) by smtp.gmail.com with ESMTPSA id d145sm3646473ywh.7.2017.09.26.06.22.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Sep 2017 06:22:01 -0700 (PDT) From: Brian Rosen Message-Id: <1B5F167F-234F-43AE-99DF-3B627A0C4A30@brianrosen.net> Content-Type: multipart/alternative; boundary="Apple-Mail=_B4A98864-94BE-4D51-9E35-A8D153FAA18B" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Tue, 26 Sep 2017 09:21:58 -0400 In-Reply-To: <543B5C94-D117-44DA-B66D-56DB809A068D@chriswendt.net> Cc: Julio Martinez-Minguito , "stir@ietf.org" To: Chris Wendt References: <391A1CF8-4CED-4ECF-92EF-FA988B4881C4@chriswendt.net> <543B5C94-D117-44DA-B66D-56DB809A068D@chriswendt.net> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [stir] Validating TN authority together with number portability X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Sep 2017 13:22:07 -0000 --Apple-Mail=_B4A98864-94BE-4D51-9E35-A8D153FAA18B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 One idea we tossed around was to extend an OCSP check to include a check = of whether the TN in question was still in the range. Brian > On Sep 26, 2017, at 9:11 AM, Chris Wendt = wrote: >=20 > I get your point but I=E2=80=99d be curious to hear a good proposal on = how to do this simpler than the specs already provide. >=20 > This is an information theory problem, it=E2=80=99s hard to represent = a disparate set/grouping of numbers no matter how you attack it. >=20 >=20 >> On Sep 26, 2017, at 6:09 AM, Julio Martinez-Minguito = > wrote: >>=20 >> As you mentioned, SHAKEN does not care about for which TNs a = certificate has authority. It is trusted that the TN belongs to the = certificate, and if not, measures are taken later and the reputation of = the operator/certificate will be affected.=20 >> =20 >> But back to the IETF draft for certificates and TN authority = declaration, the current method to specify the authority can get = difficult to implement. If number is ported out we split a range in 2 = ranges. And we=E2=80=99ll keep splitting the ranges as more numbers are = being ported out. >> Using different certificates for different ranges would result on a = high number of certificates. Specifying all the ranges within 1 = certificate will result also in a complex specification.=20 >> =20 >> The specification should be extended to simplify the way to indicate = the authority over telephone numbers, specially when numbers are ported = out from ranges. >> =20 >>=20 >> >Brian Rosen > Wed, 23 = August 2017 14:32 UTCShow header = >> >Resellers complicate it. >>=20 >> >> On Aug 23, 2017, at 10:01 AM, Eric Burger = ; = wrote: >>=20 >> >> >>=20 >> >> For that matter, in North America the NPAC already has which = operator is supposed to manage a given ported TN. I=E2=80=99m not sure I = see the issue here. I suppose one could cross check to make sure the = right operator is signing, or is the root of distribution, for a given = number. >>=20 >> >> >>=20 >> >>> On Aug 16, 2017, at 8:27 AM, Chris Wendt = ; = wrote: >>=20 >> >>> >>=20 >> >>> I think you would just cover this scenario with two different = certificates with the two smaller ranges. >>=20 >> >>> >>=20 >> >>> That said, for North America the SHAKEN approach is not to use = certificates for number blocks, so not sure if you looking at a generic = solution or not. >>=20 >> >>> >>=20 >> >>>> On Aug 16, 2017, at 5:21 AM, Julio Martinez-Minguito = = ; wrote: >>=20 >> >>>> Hi, >>=20 >> >>>> The current drafts for RFC4474bis and certificates describe how = to validate that a telephone number is owned by the operator signing the = calling Identity. A TNAuthorizationList may be included in the = certificate listing the numbers the operator is authoritative for. >>=20 >> >>>> >>=20 >> >>>> However, I see some issues handling this together with number = portability which need to be clarified. >>=20 >> >>>> Subscribers will be ported in and out quite frequently, making = the information in the certificates obsolete. To keep up the pace with = the number portability, the operators certificates would have to be = updated frequently. Should the certificates have short validity times? = E.g. 1 week, or even shorter? >>=20 >> >>>> >>=20 >> >>>> Instead of having the TN information in the certificate and need = to update it constantly, it would be more appropriate to have a trusted = server connected to the national Number Portability DB (to update the = information) to which the verifiers can connect and retrieve the = authority information. Each verifier could retrieve the TN lists for = operators and refresh the list daily, without needing to re-issue = operator certificates, so it would be updated with the latest = portability. >>=20 >> >>>> >>=20 >> >>>> About how to represent the TN lists, e.g. if an operator owns = the range 555-xxxx, with the current definitions it will be easy to = describe: >>=20 >> >>>> TelephoneNumberRange ::=3D SEQUENCE { >>=20 >> >>>> start TelephoneNumber =3D 5550000, >>=20 >> >>>> count INTEGER (2..MAX) =3D 10000 >>=20 >> >>>> } >>=20 >> >>>> >>=20 >> >>>> Now, if number 555-6789 moves to another operator we have to = represent with: >>=20 >> >>>> ({start =3D 5550000, count =3D 6789}, {start =3D 5556790, count = =3D 3210}) >>=20 >> >>>> >>=20 >> >>>> As more numbers are moved out from the range, this = representation format will get messy and difficult to manage. >>=20 >> >>>> >>=20 >> >>>> To handle NP it would be easier to keep the original range, and = include a list of excluded numbers which have been ported out, e.g.: >>=20 >> >>>> >>=20 >> >>>> TelephoneNumberRange ::=3D SEQUENCE { >>=20 >> >>>> start TelephoneNumber, >>=20 >> >>>> count INTEGER (2..MAX), >>=20 >> >>>> excludedNumbers SEQUENCE SIZE (1..MAX) OF TNEntry >>=20 >> >>>> } >>=20 >> >>>> >>=20 >> >>>> >>=20 >> >>>> Is this a feasible solution? Is it too late to handle now due to = the current state? >>=20 >> >>>> _______________________________________________ >>=20 >> >>>> stir mailing list >>=20 >> >>>> stir@ietf.org >> >>>> https://www.ietf.org/mailman/listinfo/stir = >> >>> >>=20 >> >>> _______________________________________________ >>=20 >> >>> stir mailing list >>=20 >> >>> stir@ietf.org >> >>> https://www.ietf.org/mailman/listinfo/stir = >> >> >>=20 >> >> _______________________________________________ >>=20 >> >> stir mailing list >>=20 >> >> stir@ietf.org >> >> https://www.ietf.org/mailman/listinfo/stir = >> =20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir = > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail=_B4A98864-94BE-4D51-9E35-A8D153FAA18B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 One idea we tossed around was to extend an OCSP check to = include a check of whether the TN in question was still in the = range.

Brian

On Sep 26, 2017, at 9:11 AM, Chris Wendt <chris-ietf@chriswendt.net> wrote:

I get your point but = I=E2=80=99d be curious to hear a good proposal on how to do this simpler = than the specs already provide.

This is an information theory problem, it=E2=80=99s hard to = represent a disparate set/grouping of numbers no matter how you attack = it.


On Sep 26, 2017, at 6:09 AM, Julio Martinez-Minguito <julio.martinez-minguito@ericsson.com> wrote:

As you mentioned, SHAKEN = does not care about for which TNs a certificate has authority. It is = trusted that the TN belongs to the certificate, and if not, measures are = taken later and the reputation of the operator/certificate will be = affected. 
 
But back to the IETF = draft for certificates and TN authority declaration, the current method = to specify the authority can get difficult to implement. If number is = ported out we split a range in 2 ranges. And we=E2=80=99ll keep = splitting the ranges as more numbers are being ported out.
Using different certificates for different = ranges would result on a high number of certificates. Specifying all the = ranges within 1 certificate will result also in a complex = specification. 
 
The specification = should be extended to simplify the way to indicate the authority over = telephone numbers, specially when numbers are ported out from = ranges.

 

>Brian Rosen <br@brianrosen.net> Wed, 23 August 2017 14:32 = UTCShow = header

>Resellers complicate it.

>> On = Aug 23, 2017, at 10:01 AM, Eric Burger <eburger@standardstrack.com>; = wrote:

>>

>> For that matter, in North America = the NPAC already has which operator is supposed to manage a given ported = TN. I=E2=80=99m not sure I see the issue here. I suppose one could cross = check to make sure the right operator is signing, or is the root of = distribution, for a given number.

>>

>>> On Aug 16, 2017, at 8:27 AM, = Chris Wendt <chris-ietf@chriswendt.net>; wrote:

>>>

>>> I think you would just cover = this scenario with two different certificates with the two smaller = ranges.

>>>

>>> That said, for North America = the SHAKEN approach is not to use certificates for number blocks, so not = sure if you looking at a generic solution or not.

>>>

>>>> On Aug 16, 2017, at 5:21 = AM, Julio Martinez-Minguito <julio.martinez-minguito@ericsson.com>; = wrote:

>>>> Hi,

>>>> The current drafts for = RFC4474bis and certificates describe how to validate that a telephone = number is owned by the operator signing the calling Identity. A = TNAuthorizationList may be included in the certificate listing the = numbers the operator is authoritative for.

>>>>

>>>> However, I see some issues = handling this together with number portability which need to be = clarified.

>>>> Subscribers will be ported in and out = quite frequently, making the information in the certificates obsolete. = To keep up the pace with the number portability, the operators = certificates would have to be updated frequently. Should the = certificates have short validity times? E.g. 1 week, or even = shorter?

>>>>

>>>> Instead of having the TN = information in the certificate and need to update it constantly, it = would be more appropriate to have a trusted server connected to the = national Number Portability DB (to update the information) to which the = verifiers can connect and retrieve the authority information. Each = verifier could retrieve the TN lists for operators and refresh the list = daily, without needing to re-issue operator certificates, so it would be = updated with the latest portability.

>>>>

>>>> About how to represent the TN lists, e.g. if = an operator owns the range 555-xxxx, with the current definitions it = will be easy to describe:

>>>> TelephoneNumberRange ::=3D = SEQUENCE {

>>>>      start = TelephoneNumber =3D 5550000,

>>>>      count INTEGER = (2..MAX) =3D 10000

>>>>      }

>>>>

>>>> Now, if number 555-6789 = moves to another operator we have to represent with:

>>>> ({start =3D 5550000, count =3D 6789}, {start = =3D 5556790, count =3D 3210})

>>>>

>>>> As more numbers are moved out from the = range, this representation format will get messy and difficult to = manage.

>>>>

>>>> To handle NP it would be = easier to keep the original range, and include a list of excluded = numbers which have been ported out, e.g.:

>>>>

>>>> TelephoneNumberRange ::=3D = SEQUENCE {

>>>>      start = TelephoneNumber,

>>>>      count = INTEGER (2..MAX),

>>>>      = excludedNumbers SEQUENCE SIZE (1..MAX) OF TNEntry

>>>>      }

>>>>

>>>>

>>>> Is this a feasible solution? Is it too late = to handle now due to the current state?

>>>> = _______________________________________________

>>>> stir mailing list

>>>> stir@ietf.org

>>>> https://www.ietf.org/mailman/listinfo/stir

>>>

>>> = _______________________________________________

>>> = stir mailing list

>>> stir@ietf.org

>>> https://www.ietf.org/mailman/listinfo/stir

>>

>> = _______________________________________________

>> stir = mailing list

>> stir@ietf.org

>> https://www.ietf.org/mailman/listinfo/stir

 

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_B4A98864-94BE-4D51-9E35-A8D153FAA18B-- From nobody Tue Sep 26 06:44:09 2017 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6CF7134214 for ; Tue, 26 Sep 2017 06:44:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Un61nVx3SCs for ; Tue, 26 Sep 2017 06:44:04 -0700 (PDT) Received: from resqmta-po-01v.sys.comcast.net (resqmta-po-01v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:160]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADEE3133343 for ; Tue, 26 Sep 2017 06:44:04 -0700 (PDT) Received: from resomta-po-02v.sys.comcast.net ([96.114.154.226]) by resqmta-po-01v.sys.comcast.net with ESMTP id wq9WdZYeGC2yEwq9cdUz5d; Tue, 26 Sep 2017 13:44:04 +0000 Received: from BOBO1A.bobotek.net ([76.104.190.59]) by resomta-po-02v.sys.comcast.net with SMTP id wq9Yd3tIkVLADwq9ZdR1Hu; Tue, 26 Sep 2017 13:44:03 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Tue, 26 Sep 2017 06:44:00 -0700 From: Alex Bobotek To: 'Brian Rosen' , Chris Wendt CC: Julio Martinez-Minguito , "stir@ietf.org" Date: Tue, 26 Sep 2017 06:43:59 -0700 Thread-Topic: [stir] Validating TN authority together with number portability Thread-Index: AdM2ynUceH4kp9uiSYqB3xRj/14VJgAAuf2A Message-ID: <4B1956260CD29F4A9622F00322FE053101B8A33E34F1@BOBO1A.bobotek.net> References: <391A1CF8-4CED-4ECF-92EF-FA988B4881C4@chriswendt.net> <543B5C94-D117-44DA-B66D-56DB809A068D@chriswendt.net> <1B5F167F-234F-43AE-99DF-3B627A0C4A30@brianrosen.net> In-Reply-To: <1B5F167F-234F-43AE-99DF-3B627A0C4A30@brianrosen.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/alternative; boundary="_000_4B1956260CD29F4A9622F00322FE053101B8A33E34F1BOBO1Abobot_" MIME-Version: 1.0 X-CMAE-Envelope: MS4wfIfV0vBPKb/do2bc4c1drkC7Ewn5aGUSirJ8aX3DSzRCf7i4jmUaT5ZQasQ5w39Fi4auMOtpqxePu+lyCYPjM7qyOfBYvN74BRzgRz0JDa73DCWpJS6U UdfIJrbnGyM3or6Do7MAZK+m22wOD9EHBUQ8XVHbNFs1Ys5Xq3iefQ3AUy2fcHCOANUIN+bY8bXfGHuJR7hqUiZ+OGBzzJDPqWb+XfzsDJB92OlQ6yQyRna7 Bn01GxGM4PZbKOmEzJlfr6BekN/PaOb1am7b9xud5oKf1LamChc2NpTiTv/7lGCb Archived-At: Subject: Re: [stir] Validating TN authority together with number portability X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Sep 2017 13:44:08 -0000 --_000_4B1956260CD29F4A9622F00322FE053101B8A33E34F1BOBO1Abobot_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T3IgaW5jbHVkZSByZWZlcmVuY2VzIHRvIGF1dGhvcml6ZWQgY2VydHMgaW4gYSByZWdpc3RyeSBz dWNoIGFzIG9uZSB1c2VkIGZvciByb3V0aW5nLg0KDQoNCg0KRnJvbTogc3RpciBbbWFpbHRvOnN0 aXItYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEJyaWFuIFJvc2VuDQpTZW50OiBUdWVz ZGF5LCBTZXB0ZW1iZXIgMjYsIDIwMTcgNjoyMiBBTQ0KVG86IENocmlzIFdlbmR0IDxjaHJpcy1p ZXRmQGNocmlzd2VuZHQubmV0Pg0KQ2M6IEp1bGlvIE1hcnRpbmV6LU1pbmd1aXRvIDxqdWxpby5t YXJ0aW5lei1taW5ndWl0b0Blcmljc3Nvbi5jb20+OyBzdGlyQGlldGYub3JnDQpTdWJqZWN0OiBS ZTogW3N0aXJdIFZhbGlkYXRpbmcgVE4gYXV0aG9yaXR5IHRvZ2V0aGVyIHdpdGggbnVtYmVyIHBv cnRhYmlsaXR5DQoNCk9uZSBpZGVhIHdlIHRvc3NlZCBhcm91bmQgd2FzIHRvIGV4dGVuZCBhbiBP Q1NQIGNoZWNrIHRvIGluY2x1ZGUgYSBjaGVjayBvZiB3aGV0aGVyIHRoZSBUTiBpbiBxdWVzdGlv biB3YXMgc3RpbGwgaW4gdGhlIHJhbmdlLg0KDQpCcmlhbg0KDQpPbiBTZXAgMjYsIDIwMTcsIGF0 IDk6MTEgQU0sIENocmlzIFdlbmR0IDxjaHJpcy1pZXRmQGNocmlzd2VuZHQubmV0PG1haWx0bzpj aHJpcy1pZXRmQGNocmlzd2VuZHQubmV0Pj4gd3JvdGU6DQoNCkkgZ2V0IHlvdXIgcG9pbnQgYnV0 IEnigJlkIGJlIGN1cmlvdXMgdG8gaGVhciBhIGdvb2QgcHJvcG9zYWwgb24gaG93IHRvIGRvIHRo aXMgc2ltcGxlciB0aGFuIHRoZSBzcGVjcyBhbHJlYWR5IHByb3ZpZGUuDQoNClRoaXMgaXMgYW4g aW5mb3JtYXRpb24gdGhlb3J5IHByb2JsZW0sIGl04oCZcyBoYXJkIHRvIHJlcHJlc2VudCBhIGRp c3BhcmF0ZSBzZXQvZ3JvdXBpbmcgb2YgbnVtYmVycyBubyBtYXR0ZXIgaG93IHlvdSBhdHRhY2sg aXQuDQoNCg0KDQpPbiBTZXAgMjYsIDIwMTcsIGF0IDY6MDkgQU0sIEp1bGlvIE1hcnRpbmV6LU1p bmd1aXRvIDxqdWxpby5tYXJ0aW5lei1taW5ndWl0b0Blcmljc3Nvbi5jb208bWFpbHRvOmp1bGlv Lm1hcnRpbmV6LW1pbmd1aXRvQGVyaWNzc29uLmNvbT4+IHdyb3RlOg0KDQpBcyB5b3UgbWVudGlv bmVkLCBTSEFLRU4gZG9lcyBub3QgY2FyZSBhYm91dCBmb3Igd2hpY2ggVE5zIGEgY2VydGlmaWNh dGUgaGFzIGF1dGhvcml0eS4gSXQgaXMgdHJ1c3RlZCB0aGF0IHRoZSBUTiBiZWxvbmdzIHRvIHRo ZSBjZXJ0aWZpY2F0ZSwgYW5kIGlmIG5vdCwgbWVhc3VyZXMgYXJlIHRha2VuIGxhdGVyIGFuZCB0 aGUgcmVwdXRhdGlvbiBvZiB0aGUgb3BlcmF0b3IvY2VydGlmaWNhdGUgd2lsbCBiZSBhZmZlY3Rl ZC4NCg0KQnV0IGJhY2sgdG8gdGhlIElFVEYgZHJhZnQgZm9yIGNlcnRpZmljYXRlcyBhbmQgVE4g YXV0aG9yaXR5IGRlY2xhcmF0aW9uLCB0aGUgY3VycmVudCBtZXRob2QgdG8gc3BlY2lmeSB0aGUg YXV0aG9yaXR5IGNhbiBnZXQgZGlmZmljdWx0IHRvIGltcGxlbWVudC4gSWYgbnVtYmVyIGlzIHBv cnRlZCBvdXQgd2Ugc3BsaXQgYSByYW5nZSBpbiAyIHJhbmdlcy4gQW5kIHdl4oCZbGwga2VlcCBz cGxpdHRpbmcgdGhlIHJhbmdlcyBhcyBtb3JlIG51bWJlcnMgYXJlIGJlaW5nIHBvcnRlZCBvdXQu DQpVc2luZyBkaWZmZXJlbnQgY2VydGlmaWNhdGVzIGZvciBkaWZmZXJlbnQgcmFuZ2VzIHdvdWxk IHJlc3VsdCBvbiBhIGhpZ2ggbnVtYmVyIG9mIGNlcnRpZmljYXRlcy4gU3BlY2lmeWluZyBhbGwg dGhlIHJhbmdlcyB3aXRoaW4gMSBjZXJ0aWZpY2F0ZSB3aWxsIHJlc3VsdCBhbHNvIGluIGEgY29t cGxleCBzcGVjaWZpY2F0aW9uLg0KDQpUaGUgc3BlY2lmaWNhdGlvbiBzaG91bGQgYmUgZXh0ZW5k ZWQgdG8gc2ltcGxpZnkgdGhlIHdheSB0byBpbmRpY2F0ZSB0aGUgYXV0aG9yaXR5IG92ZXIgdGVs ZXBob25lIG51bWJlcnMsIHNwZWNpYWxseSB3aGVuIG51bWJlcnMgYXJlIHBvcnRlZCBvdXQgZnJv bSByYW5nZXMuDQoNCj5CcmlhbiBSb3NlbiA8YnJAYnJpYW5yb3Nlbi5uZXQ8bWFpbHRvOmJyQGJy aWFucm9zZW4ubmV0Pj4gV2VkLCAyMyBBdWd1c3QgMjAxNyAxNDozMiBVVENTaG93IGhlYWRlcjxo dHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvc2VhcmNoLz9lbWFpbF9saXN0PXN0aXI+ DQo+UmVzZWxsZXJzIGNvbXBsaWNhdGUgaXQuDQo+PiBPbiBBdWcgMjMsIDIwMTcsIGF0IDEwOjAx IEFNLCBFcmljIEJ1cmdlciA8ZWJ1cmdlckBzdGFuZGFyZHN0cmFjay5jb20+PG1haWx0bzplYnVy Z2VyQHN0YW5kYXJkc3RyYWNrLmNvbSZndD47IHdyb3RlOg0KPj4NCj4+IEZvciB0aGF0IG1hdHRl ciwgaW4gTm9ydGggQW1lcmljYSB0aGUgTlBBQyBhbHJlYWR5IGhhcyB3aGljaCBvcGVyYXRvciBp cyBzdXBwb3NlZCB0byBtYW5hZ2UgYSBnaXZlbiBwb3J0ZWQgVE4uIEnigJltIG5vdCBzdXJlIEkg c2VlIHRoZSBpc3N1ZSBoZXJlLiBJIHN1cHBvc2Ugb25lIGNvdWxkIGNyb3NzIGNoZWNrIHRvIG1h a2Ugc3VyZSB0aGUgcmlnaHQgb3BlcmF0b3IgaXMgc2lnbmluZywgb3IgaXMgdGhlIHJvb3Qgb2Yg ZGlzdHJpYnV0aW9uLCBmb3IgYSBnaXZlbiBudW1iZXIuDQo+Pg0KPj4+IE9uIEF1ZyAxNiwgMjAx NywgYXQgODoyNyBBTSwgQ2hyaXMgV2VuZHQgPGNocmlzLWlldGZAY2hyaXN3ZW5kdC5uZXQ+PG1h aWx0bzpjaHJpcy1pZXRmQGNocmlzd2VuZHQubmV0Jmd0Pjsgd3JvdGU6DQo+Pj4NCj4+PiBJIHRo aW5rIHlvdSB3b3VsZCBqdXN0IGNvdmVyIHRoaXMgc2NlbmFyaW8gd2l0aCB0d28gZGlmZmVyZW50 IGNlcnRpZmljYXRlcyB3aXRoIHRoZSB0d28gc21hbGxlciByYW5nZXMuDQo+Pj4NCj4+PiBUaGF0 IHNhaWQsIGZvciBOb3J0aCBBbWVyaWNhIHRoZSBTSEFLRU4gYXBwcm9hY2ggaXMgbm90IHRvIHVz ZSBjZXJ0aWZpY2F0ZXMgZm9yIG51bWJlciBibG9ja3MsIHNvIG5vdCBzdXJlIGlmIHlvdSBsb29r aW5nIGF0IGEgZ2VuZXJpYyBzb2x1dGlvbiBvciBub3QuDQo+Pj4NCj4+Pj4gT24gQXVnIDE2LCAy MDE3LCBhdCA1OjIxIEFNLCBKdWxpbyBNYXJ0aW5lei1NaW5ndWl0byA8anVsaW8ubWFydGluZXot bWluZ3VpdG9AZXJpY3Nzb24uY29tPjxtYWlsdG86anVsaW8ubWFydGluZXotbWluZ3VpdG9AZXJp Y3Nzb24uY29tJmd0Pjsgd3JvdGU6DQo+Pj4+IEhpLA0KPj4+PiBUaGUgY3VycmVudCBkcmFmdHMg Zm9yIFJGQzQ0NzRiaXMgYW5kIGNlcnRpZmljYXRlcyBkZXNjcmliZSBob3cgdG8gdmFsaWRhdGUg dGhhdCBhIHRlbGVwaG9uZSBudW1iZXIgaXMgb3duZWQgYnkgdGhlIG9wZXJhdG9yIHNpZ25pbmcg dGhlIGNhbGxpbmcgSWRlbnRpdHkuIEEgVE5BdXRob3JpemF0aW9uTGlzdCBtYXkgYmUgaW5jbHVk ZWQgaW4gdGhlIGNlcnRpZmljYXRlIGxpc3RpbmcgdGhlIG51bWJlcnMgdGhlIG9wZXJhdG9yIGlz IGF1dGhvcml0YXRpdmUgZm9yLg0KPj4+Pg0KPj4+PiBIb3dldmVyLCBJIHNlZSBzb21lIGlzc3Vl cyBoYW5kbGluZyB0aGlzIHRvZ2V0aGVyIHdpdGggbnVtYmVyIHBvcnRhYmlsaXR5IHdoaWNoIG5l ZWQgdG8gYmUgY2xhcmlmaWVkLg0KPj4+PiBTdWJzY3JpYmVycyB3aWxsIGJlIHBvcnRlZCBpbiBh bmQgb3V0IHF1aXRlIGZyZXF1ZW50bHksIG1ha2luZyB0aGUgaW5mb3JtYXRpb24gaW4gdGhlIGNl cnRpZmljYXRlcyBvYnNvbGV0ZS4gVG8ga2VlcCB1cCB0aGUgcGFjZSB3aXRoIHRoZSBudW1iZXIg cG9ydGFiaWxpdHksIHRoZSBvcGVyYXRvcnMgY2VydGlmaWNhdGVzIHdvdWxkIGhhdmUgdG8gYmUg dXBkYXRlZCBmcmVxdWVudGx5LiBTaG91bGQgdGhlIGNlcnRpZmljYXRlcyBoYXZlIHNob3J0IHZh bGlkaXR5IHRpbWVzPyBFLmcuIDEgd2Vlaywgb3IgZXZlbiBzaG9ydGVyPw0KPj4+Pg0KPj4+PiBJ bnN0ZWFkIG9mIGhhdmluZyB0aGUgVE4gaW5mb3JtYXRpb24gaW4gdGhlIGNlcnRpZmljYXRlIGFu ZCBuZWVkIHRvIHVwZGF0ZSBpdCBjb25zdGFudGx5LCBpdCB3b3VsZCBiZSBtb3JlIGFwcHJvcHJp YXRlIHRvIGhhdmUgYSB0cnVzdGVkIHNlcnZlciBjb25uZWN0ZWQgdG8gdGhlIG5hdGlvbmFsIE51 bWJlciBQb3J0YWJpbGl0eSBEQiAodG8gdXBkYXRlIHRoZSBpbmZvcm1hdGlvbikgdG8gd2hpY2gg dGhlIHZlcmlmaWVycyBjYW4gY29ubmVjdCBhbmQgcmV0cmlldmUgdGhlIGF1dGhvcml0eSBpbmZv cm1hdGlvbi4gRWFjaCB2ZXJpZmllciBjb3VsZCByZXRyaWV2ZSB0aGUgVE4gbGlzdHMgZm9yIG9w ZXJhdG9ycyBhbmQgcmVmcmVzaCB0aGUgbGlzdCBkYWlseSwgd2l0aG91dCBuZWVkaW5nIHRvIHJl LWlzc3VlIG9wZXJhdG9yIGNlcnRpZmljYXRlcywgc28gaXQgd291bGQgYmUgdXBkYXRlZCB3aXRo IHRoZSBsYXRlc3QgcG9ydGFiaWxpdHkuDQo+Pj4+DQo+Pj4+IEFib3V0IGhvdyB0byByZXByZXNl bnQgdGhlIFROIGxpc3RzLCBlLmcuIGlmIGFuIG9wZXJhdG9yIG93bnMgdGhlIHJhbmdlIDU1NS14 eHh4LCB3aXRoIHRoZSBjdXJyZW50IGRlZmluaXRpb25zIGl0IHdpbGwgYmUgZWFzeSB0byBkZXNj cmliZToNCj4+Pj4gVGVsZXBob25lTnVtYmVyUmFuZ2UgOjo9IFNFUVVFTkNFIHsNCj4+Pj4gICAg ICBzdGFydCBUZWxlcGhvbmVOdW1iZXIgPSA1NTUwMDAwLA0KPj4+PiAgICAgIGNvdW50IElOVEVH RVIgKDIuLk1BWCkgPSAxMDAwMA0KPj4+PiAgICAgIH0NCj4+Pj4NCj4+Pj4gTm93LCBpZiBudW1i ZXIgNTU1LTY3ODkgbW92ZXMgdG8gYW5vdGhlciBvcGVyYXRvciB3ZSBoYXZlIHRvIHJlcHJlc2Vu dCB3aXRoOg0KPj4+PiAoe3N0YXJ0ID0gNTU1MDAwMCwgY291bnQgPSA2Nzg5fSwge3N0YXJ0ID0g NTU1Njc5MCwgY291bnQgPSAzMjEwfSkNCj4+Pj4NCj4+Pj4gQXMgbW9yZSBudW1iZXJzIGFyZSBt b3ZlZCBvdXQgZnJvbSB0aGUgcmFuZ2UsIHRoaXMgcmVwcmVzZW50YXRpb24gZm9ybWF0IHdpbGwg Z2V0IG1lc3N5IGFuZCBkaWZmaWN1bHQgdG8gbWFuYWdlLg0KPj4+Pg0KPj4+PiBUbyBoYW5kbGUg TlAgaXQgd291bGQgYmUgZWFzaWVyIHRvIGtlZXAgdGhlIG9yaWdpbmFsIHJhbmdlLCBhbmQgaW5j bHVkZSBhIGxpc3Qgb2YgZXhjbHVkZWQgbnVtYmVycyB3aGljaCBoYXZlIGJlZW4gcG9ydGVkIG91 dCwgZS5nLjoNCj4+Pj4NCj4+Pj4gVGVsZXBob25lTnVtYmVyUmFuZ2UgOjo9IFNFUVVFTkNFIHsN Cj4+Pj4gICAgICBzdGFydCBUZWxlcGhvbmVOdW1iZXIsDQo+Pj4+ICAgICAgY291bnQgSU5URUdF UiAoMi4uTUFYKSwNCj4+Pj4gICAgICBleGNsdWRlZE51bWJlcnMgU0VRVUVOQ0UgU0laRSAoMS4u TUFYKSBPRiBUTkVudHJ5DQo+Pj4+ICAgICAgfQ0KPj4+Pg0KPj4+Pg0KPj4+PiBJcyB0aGlzIGEg ZmVhc2libGUgc29sdXRpb24/IElzIGl0IHRvbyBsYXRlIHRvIGhhbmRsZSBub3cgZHVlIHRvIHRo ZSBjdXJyZW50IHN0YXRlPw0KPj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0KPj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4+PiBzdGlyQGlldGYub3Jn PG1haWx0bzpzdGlyQGlldGYub3JnPg0KPj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3N0aXINCj4+Pg0KPj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQo+Pj4gc3RpciBtYWlsaW5nIGxpc3QNCj4+PiBzdGlyQGlldGYub3Jn PG1haWx0bzpzdGlyQGlldGYub3JnPg0KPj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vc3Rpcg0KPj4NCj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQo+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4gc3RpckBpZXRmLm9yZzxtYWls dG86c3RpckBpZXRmLm9yZz4NCj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vc3Rpcg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0Kc3RpciBtYWlsaW5nIGxpc3QNCnN0aXJAaWV0Zi5vcmc8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+ DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCnN0aXIgbWFpbGluZyBsaXN0 DQpzdGlyQGlldGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9zdGlyDQoNCg== --_000_4B1956260CD29F4A9622F00322FE053101B8A33E34F1BOBO1Abobot_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu dD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij48bWV0YSBuYW1lPUdlbmVyYXRvciBjb250ZW50 PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQgbWVkaXVtKSI+PHN0eWxlPjwhLS0NCi8qIEZv bnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6SGVsdmV0aWNhOw0K CXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1p bHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9u dC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToy IDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnNw YW4uYXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRl ZC1zcGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1y ZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdE O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0K CW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3Bh Z2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8 bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFb ZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0i ZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91 dD48L3htbD48IVtlbmRpZl0tLT48L2hlYWQ+PGJvZHkgbGFuZz1FTi1VUyBsaW5rPWJsdWUgdmxp bms9cHVycGxlPjxkaXYgY2xhc3M9V29yZFNlY3Rpb24xPjxwIGNsYXNzPU1zb05vcm1hbD48c3Bh biBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEJz5PciBpbmNsdWRlIHJlZmVyZW5jZXMgdG8gYXV0aG9yaXplZCBjZXJ0 cyBpbiBhIHJlZ2lzdHJ5IHN1Y2ggYXMgb25lIHVzZWQgZm9yIHJvdXRpbmcuwqAgPG86cD48L286 cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEJz48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QnPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNw YW4gc3R5bGU9J2ZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCc+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjxkaXY+PGRpdiBz dHlsZT0nYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6 My4wcHQgMGluIDBpbiAwaW4nPjxwIGNsYXNzPU1zb05vcm1hbD48Yj48c3BhbiBzdHlsZT0nZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZic+RnJvbTo8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmJz4gc3RpciBbbWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZ10gPGI+T24g QmVoYWxmIE9mIDwvYj5CcmlhbiBSb3Nlbjxicj48Yj5TZW50OjwvYj4gVHVlc2RheSwgU2VwdGVt YmVyIDI2LCAyMDE3IDY6MjIgQU08YnI+PGI+VG86PC9iPiBDaHJpcyBXZW5kdCAmbHQ7Y2hyaXMt aWV0ZkBjaHJpc3dlbmR0Lm5ldCZndDs8YnI+PGI+Q2M6PC9iPiBKdWxpbyBNYXJ0aW5lei1NaW5n dWl0byAmbHQ7anVsaW8ubWFydGluZXotbWluZ3VpdG9AZXJpY3Nzb24uY29tJmd0Ozsgc3RpckBp ZXRmLm9yZzxicj48Yj5TdWJqZWN0OjwvYj4gUmU6IFtzdGlyXSBWYWxpZGF0aW5nIFROIGF1dGhv cml0eSB0b2dldGhlciB3aXRoIG51bWJlciBwb3J0YWJpbGl0eTxvOnA+PC9vOnA+PC9zcGFuPjwv cD48L2Rpdj48L2Rpdj48cCBjbGFzcz1Nc29Ob3JtYWw+PG86cD4mbmJzcDs8L286cD48L3A+PHAg Y2xhc3M9TXNvTm9ybWFsPk9uZSBpZGVhIHdlIHRvc3NlZCBhcm91bmQgd2FzIHRvIGV4dGVuZCBh biBPQ1NQIGNoZWNrIHRvIGluY2x1ZGUgYSBjaGVjayBvZiB3aGV0aGVyIHRoZSBUTiBpbiBxdWVz dGlvbiB3YXMgc3RpbGwgaW4gdGhlIHJhbmdlLjxvOnA+PC9vOnA+PC9wPjxkaXY+PHAgY2xhc3M9 TXNvTm9ybWFsPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9TXNvTm9y bWFsPkJyaWFuPG86cD48L286cD48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz1Nc29Ob3JtYWw+PG86 cD4mbmJzcDs8L286cD48L3A+PGRpdj48YmxvY2txdW90ZSBzdHlsZT0nbWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tYm90dG9tOjUuMHB0Jz48ZGl2PjxwIGNsYXNzPU1zb05vcm1hbD5PbiBTZXAgMjYs IDIwMTcsIGF0IDk6MTEgQU0sIENocmlzIFdlbmR0ICZsdDs8YSBocmVmPSJtYWlsdG86Y2hyaXMt aWV0ZkBjaHJpc3dlbmR0Lm5ldCI+Y2hyaXMtaWV0ZkBjaHJpc3dlbmR0Lm5ldDwvYT4mZ3Q7IHdy b3RlOjxvOnA+PC9vOnA+PC9wPjwvZGl2PjxwIGNsYXNzPU1zb05vcm1hbD48bzpwPiZuYnNwOzwv bzpwPjwvcD48ZGl2PjxkaXY+PHAgY2xhc3M9TXNvTm9ybWFsPkkgZ2V0IHlvdXIgcG9pbnQgYnV0 IEnigJlkIGJlIGN1cmlvdXMgdG8gaGVhciBhIGdvb2QgcHJvcG9zYWwgb24gaG93IHRvIGRvIHRo aXMgc2ltcGxlciB0aGFuIHRoZSBzcGVjcyBhbHJlYWR5IHByb3ZpZGUuPG86cD48L286cD48L3A+ PGRpdj48cCBjbGFzcz1Nc29Ob3JtYWw+PG86cD4mbmJzcDs8L286cD48L3A+PC9kaXY+PGRpdj48 cCBjbGFzcz1Nc29Ob3JtYWw+VGhpcyBpcyBhbiBpbmZvcm1hdGlvbiB0aGVvcnkgcHJvYmxlbSwg aXTigJlzIGhhcmQgdG8gcmVwcmVzZW50IGEgZGlzcGFyYXRlIHNldC9ncm91cGluZyBvZiBudW1i ZXJzIG5vIG1hdHRlciBob3cgeW91IGF0dGFjayBpdC48bzpwPjwvbzpwPjwvcD48L2Rpdj48ZGl2 PjxwIGNsYXNzPU1zb05vcm1hbD48bzpwPiZuYnNwOzwvbzpwPjwvcD48L2Rpdj48ZGl2PjxkaXY+ PHAgY2xhc3M9TXNvTm9ybWFsPjxicj48YnI+PG86cD48L286cD48L3A+PGJsb2NrcXVvdGUgc3R5 bGU9J21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCc+PGRpdj48cCBjbGFzcz1N c29Ob3JtYWw+T24gU2VwIDI2LCAyMDE3LCBhdCA2OjA5IEFNLCBKdWxpbyBNYXJ0aW5lei1NaW5n dWl0byAmbHQ7PGEgaHJlZj0ibWFpbHRvOmp1bGlvLm1hcnRpbmV6LW1pbmd1aXRvQGVyaWNzc29u LmNvbSI+anVsaW8ubWFydGluZXotbWluZ3VpdG9AZXJpY3Nzb24uY29tPC9hPiZndDsgd3JvdGU6 PG86cD48L286cD48L3A+PC9kaXY+PHAgY2xhc3M9TXNvTm9ybWFsPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPjxkaXY+PGRpdj48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWYnPkFzIHlvdSBtZW50aW9uZWQs IFNIQUtFTiBkb2VzIG5vdCBjYXJlIGFib3V0IGZvciB3aGljaCBUTnMgYSBjZXJ0aWZpY2F0ZSBo YXMgYXV0aG9yaXR5LiBJdCBpcyB0cnVzdGVkIHRoYXQgdGhlIFROIGJlbG9uZ3MgdG8gdGhlIGNl cnRpZmljYXRlLCBhbmQgaWYgbm90LCBtZWFzdXJlcyBhcmUgdGFrZW4gbGF0ZXIgYW5kIHRoZSBy ZXB1dGF0aW9uIG9mIHRoZSBvcGVyYXRvci9jZXJ0aWZpY2F0ZSB3aWxsIGJlIGFmZmVjdGVkLjxz cGFuIGNsYXNzPWFwcGxlLWNvbnZlcnRlZC1zcGFjZT4mbmJzcDs8L3NwYW4+PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmJz4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5 bGU9J2ZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWYnPkJ1 dCBiYWNrIHRvIHRoZSBJRVRGIGRyYWZ0IGZvciBjZXJ0aWZpY2F0ZXMgYW5kIFROIGF1dGhvcml0 eSBkZWNsYXJhdGlvbiwgdGhlIGN1cnJlbnQgbWV0aG9kIHRvIHNwZWNpZnkgdGhlIGF1dGhvcml0 eSBjYW4gZ2V0IGRpZmZpY3VsdCB0byBpbXBsZW1lbnQuIElmIG51bWJlciBpcyBwb3J0ZWQgb3V0 IHdlIHNwbGl0IGEgcmFuZ2UgaW4gMiByYW5nZXMuIEFuZCB3ZeKAmWxsIGtlZXAgc3BsaXR0aW5n IHRoZSByYW5nZXMgYXMgbW9yZSBudW1iZXJzIGFyZSBiZWluZyBwb3J0ZWQgb3V0Ljwvc3Bhbj48 bzpwPjwvbzpwPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0n Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZic+VXNpbmcg ZGlmZmVyZW50IGNlcnRpZmljYXRlcyBmb3IgZGlmZmVyZW50IHJhbmdlcyB3b3VsZCByZXN1bHQg b24gYSBoaWdoIG51bWJlciBvZiBjZXJ0aWZpY2F0ZXMuIFNwZWNpZnlpbmcgYWxsIHRoZSByYW5n ZXMgd2l0aGluIDEgY2VydGlmaWNhdGUgd2lsbCByZXN1bHQgYWxzbyBpbiBhIGNvbXBsZXggc3Bl Y2lmaWNhdGlvbi48c3BhbiBjbGFzcz1hcHBsZS1jb252ZXJ0ZWQtc3BhY2U+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPU1zb05vcm1hbD48c3Bh biBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zic+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9TXNvTm9y bWFsPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmJz5UaGUgc3BlY2lmaWNhdGlvbiBzaG91bGQgYmUgZXh0ZW5kZWQgdG8gc2ltcGxp ZnkgdGhlIHdheSB0byBpbmRpY2F0ZSB0aGUgYXV0aG9yaXR5IG92ZXIgdGVsZXBob25lIG51bWJl cnMsIHNwZWNpYWxseSB3aGVuIG51bWJlcnMgYXJlIHBvcnRlZCBvdXQgZnJvbSByYW5nZXMuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPjwvZGl2PjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2lu LWJvdHRvbToxNS4wcHQ7YmFja2dyb3VuZDp3aGl0ZTtiYWNrZ3JvdW5kLXBvc2l0aW9uOmluaXRp YWwgaW5pdGlhbDtiYWNrZ3JvdW5kLXJlcGVhdDppbml0aWFsIGluaXRpYWwnPjxzcGFuIHN0eWxl PSdmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiJIZWx2ZXRpY2EiLHNhbnMtc2VyaWY7Y29s b3I6Z3JheSc+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBz dHlsZT0nbWFyZ2luLWJvdHRvbToxNS4wcHQ7YmFja2dyb3VuZDp3aGl0ZTtiYWNrZ3JvdW5kLXBv c2l0aW9uOmluaXRpYWwgaW5pdGlhbDtiYWNrZ3JvdW5kLXJlcGVhdDppbml0aWFsIGluaXRpYWwn PjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9y OiMzMzMzMzMnPiZndDtCcmlhbiBSb3NlbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJyQGJyaWFucm9z ZW4ubmV0Ij48c3BhbiBzdHlsZT0nY29sb3I6cHVycGxlJz5ickBicmlhbnJvc2VuLm5ldDwvc3Bh bj48L2E+Jmd0OyZuYnNwO1dlZCwgMjMgQXVndXN0IDIwMTcgMTQ6MzIgVVRDPGEgaHJlZj0iaHR0 cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL3NlYXJjaC8/ZW1haWxfbGlzdD1zdGlyIj48 c3BhbiBzdHlsZT0nY29sb3I6IzMzMzMzMzt0ZXh0LWRlY29yYXRpb246bm9uZSc+U2hvdyBoZWFk ZXI8L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5 bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZTtiYWNrZ3JvdW5kLXBvc2l0 aW9uOmluaXRpYWwgaW5pdGlhbDtiYWNrZ3JvdW5kLXJlcGVhdDppbml0aWFsIGluaXRpYWwnPjxz cGFuIHN0eWxlPSdmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMz MzMzMzMnPiZndDtSZXNlbGxlcnMgY29tcGxpY2F0ZSBpdC48L3NwYW4+PG86cD48L286cD48L3A+ PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4tYm90dG9tOjcuNXB0O2JhY2tncm91bmQ6 d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dyb3VuZC1yZXBl YXQ6aW5pdGlhbCBpbml0aWFsJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyBPbiBBdWcgMjMsIDIwMTcsIGF0 IDEwOjAxIEFNLCBFcmljIEJ1cmdlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVidXJnZXJAc3RhbmRh cmRzdHJhY2suY29tJmFtcDtndCI+PHNwYW4gc3R5bGU9J2NvbG9yOiMzMzdBQjcnPmVidXJnZXJA c3RhbmRhcmRzdHJhY2suY29tJmd0Ozwvc3Bhbj48L2E+OyB3cm90ZTo8L3NwYW4+PG86cD48L286 cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4tYm90dG9tOjcuNXB0O2JhY2tn cm91bmQ6d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dyb3Vu ZC1yZXBlYXQ6aW5pdGlhbCBpbml0aWFsJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0Ozwvc3Bhbj48bzpwPiZu YnNwOzwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41 cHQ7YmFja2dyb3VuZDp3aGl0ZTtiYWNrZ3JvdW5kLXBvc2l0aW9uOmluaXRpYWwgaW5pdGlhbDti YWNrZ3JvdW5kLXJlcGVhdDppbml0aWFsIGluaXRpYWwnPjxzcGFuIHN0eWxlPSdmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMzMzMzMzMnPiZndDsmZ3Q7IEZvciB0 aGF0IG1hdHRlciwgaW4gTm9ydGggQW1lcmljYSB0aGUgTlBBQyBhbHJlYWR5IGhhcyB3aGljaCBv cGVyYXRvciBpcyBzdXBwb3NlZCB0byBtYW5hZ2UgYSBnaXZlbiBwb3J0ZWQgVE4uIEnigJltIG5v dCBzdXJlIEkgc2VlIHRoZSBpc3N1ZSBoZXJlLiBJIHN1cHBvc2Ugb25lIGNvdWxkIGNyb3NzIGNo ZWNrIHRvIG1ha2Ugc3VyZSB0aGUgcmlnaHQgb3BlcmF0b3IgaXMgc2lnbmluZywgb3IgaXMgdGhl IHJvb3Qgb2YgZGlzdHJpYnV0aW9uLCBmb3IgYSBnaXZlbiBudW1iZXIuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNr Z3JvdW5kOndoaXRlO2JhY2tncm91bmQtcG9zaXRpb246aW5pdGlhbCBpbml0aWFsO2JhY2tncm91 bmQtcmVwZWF0OmluaXRpYWwgaW5pdGlhbCc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDs8L3NwYW4+PG86cD4m bmJzcDs8L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4tYm90dG9tOjcu NXB0O2JhY2tncm91bmQ6d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7 YmFja2dyb3VuZC1yZXBlYXQ6aW5pdGlhbCBpbml0aWFsJz48c3BhbiBzdHlsZT0nZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsg T24gQXVnIDE2LCAyMDE3LCBhdCA4OjI3IEFNLCBDaHJpcyBXZW5kdCAmbHQ7PGEgaHJlZj0ibWFp bHRvOmNocmlzLWlldGZAY2hyaXN3ZW5kdC5uZXQmYW1wO2d0Ij48c3BhbiBzdHlsZT0nY29sb3I6 IzMzN0FCNyc+Y2hyaXMtaWV0ZkBjaHJpc3dlbmR0Lm5ldCZndDs8L3NwYW4+PC9hPjsgd3JvdGU6 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJv dHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlO2JhY2tncm91bmQtcG9zaXRpb246aW5pdGlhbCBp bml0aWFsO2JhY2tncm91bmQtcmVwZWF0OmluaXRpYWwgaW5pdGlhbCc+PHNwYW4gc3R5bGU9J2Zv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZn dDsmZ3Q7PC9zcGFuPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHls ZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0 OyZndDsgSSB0aGluayB5b3Ugd291bGQganVzdCBjb3ZlciB0aGlzIHNjZW5hcmlvIHdpdGggdHdv IGRpZmZlcmVudCBjZXJ0aWZpY2F0ZXMgd2l0aCB0aGUgdHdvIHNtYWxsZXIgcmFuZ2VzLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206 Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7PC9zcGFuPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3 LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsgVGhhdCBzYWlkLCBm b3IgTm9ydGggQW1lcmljYSB0aGUgU0hBS0VOIGFwcHJvYWNoIGlzIG5vdCB0byB1c2UgY2VydGlm aWNhdGVzIGZvciBudW1iZXIgYmxvY2tzLCBzbyBub3Qgc3VyZSBpZiB5b3UgbG9va2luZyBhdCBh IGdlbmVyaWMgc29sdXRpb24gb3Igbm90Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1N c29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNw YW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMz MzMzMyc+Jmd0OyZndDsmZ3Q7PC9zcGFuPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1z b05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3Bh biBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMz MzMzJz4mZ3Q7Jmd0OyZndDsmZ3Q7IE9uIEF1ZyAxNiwgMjAxNywgYXQgNToyMSBBTSwgSnVsaW8g TWFydGluZXotTWluZ3VpdG8gJmx0OzxhIGhyZWY9Im1haWx0bzpqdWxpby5tYXJ0aW5lei1taW5n dWl0b0Blcmljc3Nvbi5jb20mYW1wO2d0Ij48c3BhbiBzdHlsZT0nY29sb3I6IzMzN0FCNyc+anVs aW8ubWFydGluZXotbWluZ3VpdG9AZXJpY3Nzb24uY29tJmd0Ozwvc3Bhbj48L2E+OyB3cm90ZTo8 L3NwYW4+PG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4tYm90 dG9tOjcuNXB0O2JhY2tncm91bmQ6d2hpdGUnPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMzMzMzMzMnPiZndDsmZ3Q7Jmd0OyZndDsgSGks PC9zcGFuPjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJv dHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsmZ3Q7IFRo ZSBjdXJyZW50IGRyYWZ0cyBmb3IgUkZDNDQ3NGJpcyBhbmQgY2VydGlmaWNhdGVzIGRlc2NyaWJl IGhvdyB0byB2YWxpZGF0ZSB0aGF0IGEgdGVsZXBob25lIG51bWJlciBpcyBvd25lZCBieSB0aGUg b3BlcmF0b3Igc2lnbmluZyB0aGUgY2FsbGluZyBJZGVudGl0eS4gQSBUTkF1dGhvcml6YXRpb25M aXN0IG1heSBiZSBpbmNsdWRlZCBpbiB0aGUgY2VydGlmaWNhdGUgbGlzdGluZyB0aGUgbnVtYmVy cyB0aGUgb3BlcmF0b3IgaXMgYXV0aG9yaXRhdGl2ZSBmb3IuPC9zcGFuPjxvOnA+PC9vOnA+PC9w PjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNrZ3JvdW5k OndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xh cztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsmZ3Q7PC9zcGFuPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNrZ3Jv dW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25z b2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsmZ3Q7IEhvd2V2ZXIsIEkgc2VlIHNvbWUg aXNzdWVzIGhhbmRsaW5nIHRoaXMgdG9nZXRoZXIgd2l0aCBudW1iZXIgcG9ydGFiaWxpdHkgd2hp Y2ggbmVlZCB0byBiZSBjbGFyaWZpZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1z b05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3Bh biBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMz MzMzJz4mZ3Q7Jmd0OyZndDsmZ3Q7IFN1YnNjcmliZXJzIHdpbGwgYmUgcG9ydGVkIGluIGFuZCBv dXQgcXVpdGUgZnJlcXVlbnRseSwgbWFraW5nIHRoZSBpbmZvcm1hdGlvbiBpbiB0aGUgY2VydGlm aWNhdGVzIG9ic29sZXRlLiBUbyBrZWVwIHVwIHRoZSBwYWNlIHdpdGggdGhlIG51bWJlciBwb3J0 YWJpbGl0eSwgdGhlIG9wZXJhdG9ycyBjZXJ0aWZpY2F0ZXMgd291bGQgaGF2ZSB0byBiZSB1cGRh dGVkIGZyZXF1ZW50bHkuIFNob3VsZCB0aGUgY2VydGlmaWNhdGVzIGhhdmUgc2hvcnQgdmFsaWRp dHkgdGltZXM/IEUuZy4gMSB3ZWVrLCBvciBldmVuIHNob3J0ZXI/PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNrZ3Jv dW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25z b2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsmZ3Q7PC9zcGFuPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNr Z3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpD b25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsmZ3Q7IEluc3RlYWQgb2YgaGF2aW5n IHRoZSBUTiBpbmZvcm1hdGlvbiBpbiB0aGUgY2VydGlmaWNhdGUgYW5kIG5lZWQgdG8gdXBkYXRl IGl0IGNvbnN0YW50bHksIGl0IHdvdWxkIGJlIG1vcmUgYXBwcm9wcmlhdGUgdG8gaGF2ZSBhIHRy dXN0ZWQgc2VydmVyIGNvbm5lY3RlZCB0byB0aGUgbmF0aW9uYWwgTnVtYmVyIFBvcnRhYmlsaXR5 IERCICh0byB1cGRhdGUgdGhlIGluZm9ybWF0aW9uKSB0byB3aGljaCB0aGUgdmVyaWZpZXJzIGNh biBjb25uZWN0IGFuZCByZXRyaWV2ZSB0aGUgYXV0aG9yaXR5IGluZm9ybWF0aW9uLiBFYWNoIHZl cmlmaWVyIGNvdWxkIHJldHJpZXZlIHRoZSBUTiBsaXN0cyBmb3Igb3BlcmF0b3JzIGFuZCByZWZy ZXNoIHRoZSBsaXN0IGRhaWx5LCB3aXRob3V0IG5lZWRpbmcgdG8gcmUtaXNzdWUgb3BlcmF0b3Ig Y2VydGlmaWNhdGVzLCBzbyBpdCB3b3VsZCBiZSB1cGRhdGVkIHdpdGggdGhlIGxhdGVzdCBwb3J0 YWJpbGl0eS48L3NwYW4+PG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdt YXJnaW4tYm90dG9tOjcuNXB0O2JhY2tncm91bmQ6d2hpdGUnPjxzcGFuIHN0eWxlPSdmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMzMzMzMzMnPiZndDsmZ3Q7Jmd0 OyZndDs8L3NwYW4+PG86cD4mbmJzcDs8L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxl PSdtYXJnaW4tYm90dG9tOjcuNXB0O2JhY2tncm91bmQ6d2hpdGUnPjxzcGFuIHN0eWxlPSdmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMzMzMzMzMnPiZndDsmZ3Q7 Jmd0OyZndDsgQWJvdXQgaG93IHRvIHJlcHJlc2VudCB0aGUgVE4gbGlzdHMsIGUuZy4gaWYgYW4g b3BlcmF0b3Igb3ducyB0aGUgcmFuZ2UgNTU1LXh4eHgsIHdpdGggdGhlIGN1cnJlbnQgZGVmaW5p dGlvbnMgaXQgd2lsbCBiZSBlYXN5IHRvIGRlc2NyaWJlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD48 cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3 aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7 Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7Jmd0OyBUZWxlcGhvbmVOdW1iZXJSYW5nZSA6Oj0g U0VRVUVOQ0Ugezwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9 J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsm Z3Q7Jmd0OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBzdGFydCBUZWxlcGhvbmVOdW1i ZXIgPSA1NTUwMDAwLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5 bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2Zv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZn dDsmZ3Q7Jmd0OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBjb3VudCBJTlRFR0VSICgy Li5NQVgpID0gMTAwMDA8L3NwYW4+PG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0 eWxlPSdtYXJnaW4tYm90dG9tOjcuNXB0O2JhY2tncm91bmQ6d2hpdGUnPjxzcGFuIHN0eWxlPSdm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMzMzMzMzMnPiZndDsm Z3Q7Jmd0OyZndDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTwvc3Bhbj48bzpwPjwv bzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFj a2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7Jmd0Ozwvc3Bhbj48bzpwPiZuYnNw OzwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7 YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7Jmd0OyBOb3csIGlmIG51bWJl ciA1NTUtNjc4OSBtb3ZlcyB0byBhbm90aGVyIG9wZXJhdG9yIHdlIGhhdmUgdG8gcmVwcmVzZW50 IHdpdGg6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFy Z2luLWJvdHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsm Z3Q7ICh7c3RhcnQgPSA1NTUwMDAwLCBjb3VudCA9IDY3ODl9LCB7c3RhcnQgPSA1NTU2NzkwLCBj b3VudCA9IDMyMTB9KTwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5 bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2Zv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZn dDsmZ3Q7Jmd0Ozwvc3Bhbj48bzpwPiZuYnNwOzwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwg c3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9 J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0 OyZndDsmZ3Q7Jmd0OyBBcyBtb3JlIG51bWJlcnMgYXJlIG1vdmVkIG91dCBmcm9tIHRoZSByYW5n ZSwgdGhpcyByZXByZXNlbnRhdGlvbiBmb3JtYXQgd2lsbCBnZXQgbWVzc3kgYW5kIGRpZmZpY3Vs dCB0byBtYW5hZ2UuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHls ZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0 OyZndDsmZ3Q7PC9zcGFuPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBz dHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0n Zm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7 Jmd0OyZndDsmZ3Q7IFRvIGhhbmRsZSBOUCBpdCB3b3VsZCBiZSBlYXNpZXIgdG8ga2VlcCB0aGUg b3JpZ2luYWwgcmFuZ2UsIGFuZCBpbmNsdWRlIGEgbGlzdCBvZiBleGNsdWRlZCBudW1iZXJzIHdo aWNoIGhhdmUgYmVlbiBwb3J0ZWQgb3V0LCBlLmcuOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBj bGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0 ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29s b3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7Jmd0Ozwvc3Bhbj48bzpwPiZuYnNwOzwvbzpwPjwvcD48 cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3 aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7 Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7Jmd0OyBUZWxlcGhvbmVOdW1iZXJSYW5nZSA6Oj0g U0VRVUVOQ0Ugezwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9 J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsm Z3Q7Jmd0OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBzdGFydCBUZWxlcGhvbmVOdW1i ZXIsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2lu LWJvdHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsmZ3Q7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGNvdW50IElOVEVHRVIgKDIuLk1BWCksPC9z cGFuPjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRv bTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGV4Y2x1ZGVkTnVtYmVycyBTRVFVRU5DRSBTSVpFICgx Li5NQVgpIE9GIFRORW50cnk8L3NwYW4+PG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFs IHN0eWxlPSdtYXJnaW4tYm90dG9tOjcuNXB0O2JhY2tncm91bmQ6d2hpdGUnPjxzcGFuIHN0eWxl PSdmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMzMzMzMzMnPiZn dDsmZ3Q7Jmd0OyZndDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTwvc3Bhbj48bzpw PjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7 YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7Jmd0Ozwvc3Bhbj48bzpwPiZu YnNwOzwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41 cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7Jmd0Ozwvc3Bhbj48bzpw PiZuYnNwOzwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206 Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7Jmd0OyBJcyB0aGlz IGEgZmVhc2libGUgc29sdXRpb24/IElzIGl0IHRvbyBsYXRlIHRvIGhhbmRsZSBub3cgZHVlIHRv IHRoZSBjdXJyZW50IHN0YXRlPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3Jt YWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5 bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+ Jmd0OyZndDsmZ3Q7Jmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXzwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21h cmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7 Jmd0OyBzdGlyIG1haWxpbmcgbGlzdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29O b3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZSc+PHNwYW4g c3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMz Myc+Jmd0OyZndDsmZ3Q7Jmd0OzxzcGFuIGNsYXNzPWFwcGxlLWNvbnZlcnRlZC1zcGFjZT4mbmJz cDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSdjb2xv cjojMzM3QUI3Jz5zdGlyQGlldGYub3JnPC9zcGFuPjwvYT48L3NwYW4+PG86cD48L286cD48L3A+ PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4tYm90dG9tOjcuNXB0O2JhY2tncm91bmQ6 d2hpdGUnPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFz O2NvbG9yOiMzMzMzMzMnPiZndDsmZ3Q7Jmd0OyZndDs8c3BhbiBjbGFzcz1hcHBsZS1jb252ZXJ0 ZWQtc3BhY2U+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vc3RpciI+PHNwYW4gc3R5bGU9J2NvbG9yOiMzMzdBQjcnPmh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcjwvc3Bhbj48L2E+PC9zcGFuPjxvOnA+PC9v OnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNr Z3JvdW5kOndoaXRlJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpD b25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDs8L3NwYW4+PG86cD4mbmJzcDs8L286 cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4tYm90dG9tOjcuNXB0O2JhY2tn cm91bmQ6d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dyb3Vu ZC1yZXBlYXQ6aW5pdGlhbCBpbml0aWFsJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsgX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188L3NwYW4+PG86cD48L286cD48 L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4tYm90dG9tOjcuNXB0O2JhY2tncm91 bmQ6d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dyb3VuZC1y ZXBlYXQ6aW5pdGlhbCBpbml0aWFsJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyZndDsgc3RpciBtYWlsaW5n IGxpc3Q8L3NwYW4+PG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJn aW4tYm90dG9tOjcuNXB0O2JhY2tncm91bmQ6d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0 aWFsIGluaXRpYWw7YmFja2dyb3VuZC1yZXBlYXQ6aW5pdGlhbCBpbml0aWFsJz48c3BhbiBzdHls ZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4m Z3Q7Jmd0OyZndDs8c3BhbiBjbGFzcz1hcHBsZS1jb252ZXJ0ZWQtc3BhY2U+Jm5ic3A7PC9zcGFu PjxhIGhyZWY9Im1haWx0bzpzdGlyQGlldGYub3JnIj48c3BhbiBzdHlsZT0nY29sb3I6IzMzN0FC Nyc+c3RpckBpZXRmLm9yZzwvc3Bhbj48L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNz PU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3LjVwdDtiYWNrZ3JvdW5kOndoaXRlO2Jh Y2tncm91bmQtcG9zaXRpb246aW5pdGlhbCBpbml0aWFsO2JhY2tncm91bmQtcmVwZWF0OmluaXRp YWwgaW5pdGlhbCc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29u c29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsmZ3Q7PHNwYW4gY2xhc3M9YXBwbGUtY29udmVy dGVkLXNwYWNlPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3N0aXIiPjxzcGFuIHN0eWxlPSdjb2xvcjojMzM3QUI3Jz5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXI8L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwv bzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFj a2dyb3VuZDp3aGl0ZTtiYWNrZ3JvdW5kLXBvc2l0aW9uOmluaXRpYWwgaW5pdGlhbDtiYWNrZ3Jv dW5kLXJlcGVhdDppbml0aWFsIGluaXRpYWwnPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMzMzMzMzMnPiZndDsmZ3Q7PC9zcGFuPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbWFyZ2luLWJvdHRvbTo3 LjVwdDtiYWNrZ3JvdW5kOndoaXRlO2JhY2tncm91bmQtcG9zaXRpb246aW5pdGlhbCBpbml0aWFs O2JhY2tncm91bmQtcmVwZWF0OmluaXRpYWwgaW5pdGlhbCc+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzMzMzMzMyc+Jmd0OyZndDsgX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188L3NwYW4+PG86cD48 L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdtYXJnaW4tYm90dG9tOjcuNXB0O2Jh Y2tncm91bmQ6d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dy b3VuZC1yZXBlYXQ6aW5pdGlhbCBpbml0aWFsJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMzMzMzMzJz4mZ3Q7Jmd0OyBzdGlyIG1haWxp bmcgbGlzdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21h cmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZTtiYWNrZ3JvdW5kLXBvc2l0aW9uOmlu aXRpYWwgaW5pdGlhbDtiYWNrZ3JvdW5kLXJlcGVhdDppbml0aWFsIGluaXRpYWwnPjxzcGFuIHN0 eWxlPSdmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMzMzMzMzMn PiZndDsmZ3Q7PHNwYW4gY2xhc3M9YXBwbGUtY29udmVydGVkLXNwYWNlPiZuYnNwOzwvc3Bhbj48 YSBocmVmPSJtYWlsdG86c3RpckBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9J2NvbG9yOiMzMzdBQjcn PnN0aXJAaWV0Zi5vcmc8L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1N c29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206Ny41cHQ7YmFja2dyb3VuZDp3aGl0ZTtiYWNr Z3JvdW5kLXBvc2l0aW9uOmluaXRpYWwgaW5pdGlhbDtiYWNrZ3JvdW5kLXJlcGVhdDppbml0aWFs IGluaXRpYWwnPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNv bGFzO2NvbG9yOiMzMzMzMzMnPiZndDsmZ3Q7PHNwYW4gY2xhc3M9YXBwbGUtY29udmVydGVkLXNw YWNlPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3N0aXIiPjxzcGFuIHN0eWxlPSdjb2xvcjojMzM3QUI3Jz5odHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXI8L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwv cD48cCBjbGFzcz1Nc29Ob3JtYWwgc3R5bGU9J21hcmdpbi1ib3R0b206MTUuMHB0O2JhY2tncm91 bmQ6d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dyb3VuZC1y ZXBlYXQ6aW5pdGlhbCBpbml0aWFsJz4mbmJzcDs8bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29O b3JtYWw+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseToiSGVsdmV0aWNh IixzYW5zLXNlcmlmJz5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj5zdGlyIG1haWxpbmcgbGlzdDxicj48L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnN0aXJA aWV0Zi5vcmciPjxzcGFuIHN0eWxlPSdmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6IkhlbHZl dGljYSIsc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUnPnN0aXJAaWV0Zi5vcmc8L3NwYW4+PC9hPjxz cGFuIHN0eWxlPSdmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6IkhlbHZldGljYSIsc2Fucy1z ZXJpZic+PGJyPjwvc3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3N0aXIiPjxzcGFuIHN0eWxlPSdmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Ikhl bHZldGljYSIsc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUnPmh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vc3Rpcjwvc3Bhbj48L2E+PG86cD48L286cD48L3A+PC9kaXY+PC9ibG9j a3F1b3RlPjwvZGl2PjxwIGNsYXNzPU1zb05vcm1hbD48bzpwPiZuYnNwOzwvbzpwPjwvcD48L2Rp dj48L2Rpdj48cCBjbGFzcz1Nc29Ob3JtYWw+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188YnI+c3RpciBtYWlsaW5nIGxpc3Q8YnI+PGEgaHJlZj0ibWFpbHRv OnN0aXJAaWV0Zi5vcmciPnN0aXJAaWV0Zi5vcmc8L2E+PGJyPjxhIGhyZWY9Imh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3RpciI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9zdGlyPC9hPjxvOnA+PC9vOnA+PC9wPjwvZGl2PjwvYmxvY2txdW90ZT48 L2Rpdj48cCBjbGFzcz1Nc29Ob3JtYWw+PG86cD4mbmJzcDs8L286cD48L3A+PC9kaXY+PC9kaXY+ PC9ib2R5PjwvaHRtbD4= --_000_4B1956260CD29F4A9622F00322FE053101B8A33E34F1BOBO1Abobot_-- From nobody Tue Sep 26 08:05:38 2017 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D55D1201F8 for ; Tue, 26 Sep 2017 08:05:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yJOjZSXE8ozk for ; Tue, 26 Sep 2017 08:05:30 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B30F313321F for ; Tue, 26 Sep 2017 08:05:27 -0700 (PDT) X-AuditID: c1b4fb30-0adfd9c000001911-f9-59ca6cb509dc Received: from ESESSHC005.ericsson.se (Unknown_Domain [153.88.183.33]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id FE.35.06417.5BC6AC95; Tue, 26 Sep 2017 17:05:26 +0200 (CEST) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (153.88.183.145) by oa.msg.ericsson.com (153.88.183.33) with Microsoft SMTP Server (TLS) id 14.3.352.0; Tue, 26 Sep 2017 17:05:16 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.onmicrosoft.com; s=selector1-ericsson-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=KvtQScg8xhfsLllGSdyGoa4qzzSROvmPlSLtM0evQ8c=; b=MkSvJurapV+NIJgSU7/Xeou3UqPu/uK/wZK5olEzI0/+2KYMrHVwKK2/BOrNWaid3eSEcwb0RDFwdB2JXXFzG+zA04XKZVC8OQwelxVRyR5hD/gxuoR+LFHRxN4HNspatKTWIMPkdvoceDxiYqqshoyzqz0SOKFBNSyzqVfFaaE= Received: from DB5PR07MB1127.eurprd07.prod.outlook.com (10.163.103.157) by DB5PR07MB1126.eurprd07.prod.outlook.com (10.163.103.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.5; Tue, 26 Sep 2017 15:05:15 +0000 Received: from DB5PR07MB1127.eurprd07.prod.outlook.com ([fe80::d972:4dd:2365:1fad]) by DB5PR07MB1127.eurprd07.prod.outlook.com ([fe80::d972:4dd:2365:1fad%13]) with mapi id 15.20.0077.011; Tue, 26 Sep 2017 15:05:14 +0000 From: Julio Martinez-Minguito To: Alex Bobotek , 'Brian Rosen' , "Chris Wendt" CC: "stir@ietf.org" Thread-Topic: [stir] Validating TN authority together with number portability Thread-Index: AdMWbZ5Gal6PDfc1QQq1QCbE62ZgWAAHWvaAAABhs+AIDxsFgAAAXD0AAADE2YAAAhN98A== Date: Tue, 26 Sep 2017 15:05:14 +0000 Message-ID: References: <391A1CF8-4CED-4ECF-92EF-FA988B4881C4@chriswendt.net> <543B5C94-D117-44DA-B66D-56DB809A068D@chriswendt.net> <1B5F167F-234F-43AE-99DF-3B627A0C4A30@brianrosen.net> <4B1956260CD29F4A9622F00322FE053101B8A33E34F1@BOBO1A.bobotek.net> In-Reply-To: <4B1956260CD29F4A9622F00322FE053101B8A33E34F1@BOBO1A.bobotek.net> Accept-Language: sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=julio.martinez-minguito@ericsson.com; x-originating-ip: [192.176.1.86] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DB5PR07MB1126; 6:lgBHvrEsbBbkJFWci3kIRZLs0AGM1oV7rSX8J4pKJrs88nCiZYxyl9hrQepOEQLgHNRskqrtvNEVgwcJB2KYFumYnr1qVxPiAuO0Ell/7iZ1prusrnb2zkVDrrVUJzXV4sadiczPwP+LzXX7XWmSMkZXQIA7owykagNB5hlAUaFMzyHewLe64eCBH3izH7eUHLTGuIbl32wxifNAYXP1FhH0xz2QdhMH56rvpvDF5JzjEuUqCgKhQYKTrnqP/7N8LXlJrRO9oIEEBiWbc2ybM6TwXoaOKUHxGF/eQqVpI4lpAB+eUIBg1qKXDfXVCDFB0H9pUofrl8+OYII17nIjgA==; 5:7gjLULBczl76P3X6MgCMGwXmVDBXZxaQ0cXsWA4BJgcX0WE1psuEZ1XCODZdD+fXoC/8moYf+YdJGbj0B4CkyNxcWAGwzYquwQVDBt1dU0nfWCJ0uQEDvSa+T1uLX4vl36lFX5Bg5Kl7p1A7VomCuQ==; 24:gbKflbCrPYMuuSx8MXlCsMVSrvsRnRAWLBvr01d4HnlV67cr9uTdE0kzCPrQPGjrFn85hik88isJfcsoPG35a5nekZadEWssbxl4jbWsFe0=; 7:AvYjF5lBPmDvHDBCDjQkUiJHz2mXisWPF+GAg2UXT9Vnj3FkAeW3GJsR/kxFFdJYBuA1+U4o8lhU3zT7iLWfQAJxLFgk10yVn8xVs49gcMdFbua5EjGUVic7yJWplqRggxJw3gWB23YDhmpd0w1glV1XdYFSsvHzBtaUFGQOuF7lxosaDV8uFrLQr3K6HPLp21Xf2gV6FrwBLvWMp4yksCZGWAplNuDxcdUhE9lTpJc= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 5312215f-5aa1-4deb-bbe6-08d504effde6 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254152)(2017052603199)(201703131423075)(201703031133081)(201702281549075); SRVR:DB5PR07MB1126; x-ms-traffictypediagnostic: DB5PR07MB1126: x-exchange-antispam-report-test: UriScan:(37575265505322)(158342451672863)(21532816269658); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(10201501046)(93006095)(93001095)(3002001)(100000703101)(100105400095)(6041248)(20161123555025)(20161123560025)(20161123558100)(20161123562025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:DB5PR07MB1126; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:DB5PR07MB1126; x-forefront-prvs: 0442E569BC x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(376002)(346002)(24454002)(189002)(377454003)(199003)(81156014)(81166006)(8936002)(189998001)(3280700002)(3660700001)(101416001)(561944003)(2900100001)(2906002)(74316002)(54356999)(33656002)(76176999)(50986999)(105586002)(6506006)(6436002)(5250100002)(14454004)(2950100002)(93886005)(25786009)(316002)(110136005)(102836003)(106356001)(3846002)(6116002)(97736004)(229853002)(6246003)(53546010)(4326008)(86362001)(5660300001)(8676002)(66066001)(478600001)(9686003)(6306002)(305945005)(68736007)(99286003)(7736002)(966005)(55016002)(53936002)(7696004); DIR:OUT; SFP:1101; SCL:1; SRVR:DB5PR07MB1126; H:DB5PR07MB1127.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Sep 2017 15:05:14.4995 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5PR07MB1126 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02Sa0hTYRjHec85287Ewaub+KQJOYtQ8JJILQgv0IdBWYYR2gW39DDFOW3H hvZJCS285VQmTlOThSGmITaHZqSIt8hCqUBQp65y5WWKZs6S3M6Cvv2e//N/nxsvTfrW8wLo LE0+o9Uo1VK+F9WQ0hccblZPpkZZdbJVfTEl+7Jg4MvqtwZIWftzMxFPyc2VBfKFn38E8uqq Tp7cZNojkqjrXucyGHWWjtFGxiq8Mnet+0Re3ZWCTscUKkIPL5chIQ04Bj7VDvHKkBfti0cQ 1NlGSS4YR2BZr6BcAYUrSTCXtHky9QQMNjcJuGARwWpxEXIV4+PzMDs+52YJZuFpn4MoQzRN 4hA4GIhzyWJ8EQYbp92yBCdCjcmHc1+DsbVJgYspfAKWxtoIF4vwTegyGhDXqpGEpc037oQQ X4KN3gG+ixEOgoXdecrFJPaHWVsLwe2GwfTqPcmxH9iXD3icXwW796d4nH4MFpy1Hk8QTLeU u5sBLhWAccbkMUXAS/0a4jgRdj6aKc7UjKBrpMZjCoOe7c+eSjdgfeeXh7PB3rpOcA/e8mDF 9sQz3lGwW3b51Sjc+N/kRvfBQqG7P5KTg6GufFFgdF/DByYabFQrojqQH8uwt3NU0dERjDYr nWVzNREaJr8HHX6Xod79KAuyf0sYRphGUm/RYNpkqi9PqWMLc4YR0KRUIjp561ASZSgL7zHa 3DTtXTXDDqNAmpL6ixJef0jxxSplPpPNMHmM9l+WoIUBReh0qPVqMD9QlBJ/YVUYmxX4G7Xm ewuS9MXNywM/ttofJIcpFv0eiy1z2YqJEP3oM2/NnCquhBxN8HlR7hAss3nxVkWKeDu943jp mY62/nZxoTPIcCcwrdvwbiVbKfk+31S16bQ4o2f2YjYe7Xz1r9AdkVc0+pytnEq+pnCUjEgp NlN5KozUssq/CLTjoCoDAAA= Archived-At: Subject: Re: [stir] Validating TN authority together with number portability X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Sep 2017 15:05:32 -0000 QSBwcm9wb3NhbCB0byBoYW5kbGUgdGhlIG51bWJlcnMgcG9ydGVkIG91dCBpcyB0byBleHBsaWNp dGx5IGluZGljYXRlIHRoZW0sIHdoaWxlIGtlZXBpbmcgdGhlIG9yaWdpbmFsIHJhbmdlLiBUaHVz IHRoZSByYW5nZXMgZG8gbm90IG5lZWQgdG8gYmUgc3BsaXQgc2V2ZXJhbCB0aW1lcy4gDQogVGVs ZXBob25lTnVtYmVyUmFuZ2UgOjo9IFNFUVVFTkNFIHsNCiAgICAgIHN0YXJ0IFRlbGVwaG9uZU51 bWJlciwNCiAgICAgIGNvdW50IElOVEVHRVIgKDIuLk1BWCksDQogICAgIGV4Y2x1ZGVkTnVtYmVy cyBTRVFVRU5DRSBTSVpFICgxLi5NQVgpIE9GIFRORW50cnkNCiAgICAgfQ0KDQpBIHBvc3NpYmxl IGlzc3VlIGlzIHRoYXQgdGhlIGxpc3Qgb2YgZXhjbHVkZWROdW1iZXJzIChudW1iZXJzIHBvcnRl ZCBvdXQpIGNvdWxkIGdldCBsb25nIGFzIG51bWJlcnMgYXJlIGJlaW5nIHBvcnRlZCBvdXQsICBh bmQgdGhlIGxpc3Qgb2YgZXhjbHVkZWQgbnVtYmVycyBtaWdodCBldmVuIGluY2x1ZGUgIG1vcmUg dGhhbiB0aGUgNTAlIG9mIHRoZSBudW1iZXJzIGluIHRoZSByYW5nZS4gSW4gdGhvc2UgY2FzZXMg J2NsZWFudXBzJyBjb3VsZCBiZSBkb25lIHRvIGNoYW5nZSBob3cgdGhlIG51bWJlcnMgdGhlIG9w ZXJhdG9yIGlzIGF1dGhvcml0YXRpdmUgYXJlIHJlcHJlc2VudGVkLCBlLmcuIGxpc3Qgb2YgbnVt YmVycyBpbnN0ZWFkIG9mIHVzaW5nIHJhbmdlcy4gDQoNCkFib3V0IGRvaW5nIHF1ZXJpZXMgdG8g ZXh0ZXJuYWwgc3lzdGVtcyAoT0NTUCBvciBvdGhlcnMgcHJvdG9jb2xzKSB0byBjaGVjayBpZiBu dW1iZXJzIGFyZSBzdGlsbCBpbiB0aGUgcmFuZ2UgZm9yIHRoZSBvcGVyYXRvciwgaXQgd291bGQg cmVxdWlyZSBtYWtpbmcgcXVlcmllcyBmb3IgZXZlcnkgY2FsbCwgYW5kIHRoYXQgd291bGQgaW1w YWN0IGxhdGVuY3kgYW5kIGNhcGFjaXR5Lg0KDQpUbyBhdm9pZCB1cGRhdGluZyBjZXJ0aWZpY2F0 ZXMgZXZlcnl0aW1lIG51bWJlcnMgYXJlIHBvcnRlZCwgdGhlcmUgY2FuIGJlIGEgcXVlcnkgdG8g YW4gZXh0ZXJuYWwgdHJ1c3RlZCBzZXJ2ZXIgdG8gZG93bmxvYWQgdGhlIGxpc3Qgb2YgbnVtYmVy cyBhbiBvcGVyYXRvciBpcyBhdXRob3JpdGF0aXZlLiBUaGlzIGxpc3QgY291bGQgIGJlIHVwZGF0 ZWQgYW5kIGRvd25sb2FkZWQgZXZlcnlkYXksIHdpdGhvdXQgaGF2aW5nIHRvIHVwZGF0ZSB0aGUg Y2VydGlmaWNhdGVzLiBUaGUgZm9ybWF0IHRvIHJlcHJlc2VudCB0aGUgbGlzdCBjYW4gYmUgYWNj b3JkaW5nIHRvIHRoZSBmb3JtYXQgZGVzY3JpYmVkIGluIHRoZSBkcmFmdCAobWF5YmUgd2l0aCB0 aGUgaW5jbHVzaW9uIG9mICJleGNsdWRlZE51bWJlcnMiLg0KDQoNCkZyb206IEFsZXggQm9ib3Rl ayBbbWFpbHRvOmFsZXhAYm9ib3Rlay5uZXRdIA0KU2VudDogZGVuIDI2IHNlcHRlbWJlciAyMDE3 IDE1OjQ0DQpUbzogJ0JyaWFuIFJvc2VuJyA8YnJAYnJpYW5yb3Nlbi5uZXQ+OyBDaHJpcyBXZW5k dCA8Y2hyaXMtaWV0ZkBjaHJpc3dlbmR0Lm5ldD4NCkNjOiBKdWxpbyBNYXJ0aW5lei1NaW5ndWl0 byA8anVsaW8ubWFydGluZXotbWluZ3VpdG9AZXJpY3Nzb24uY29tPjsgc3RpckBpZXRmLm9yZw0K U3ViamVjdDogUkU6IFtzdGlyXSBWYWxpZGF0aW5nIFROIGF1dGhvcml0eSB0b2dldGhlciB3aXRo IG51bWJlciBwb3J0YWJpbGl0eQ0KDQpPciBpbmNsdWRlIHJlZmVyZW5jZXMgdG8gYXV0aG9yaXpl ZCBjZXJ0cyBpbiBhIHJlZ2lzdHJ5IHN1Y2ggYXMgb25lIHVzZWQgZm9yIHJvdXRpbmcuwqAgDQoN Cg0KDQpGcm9tOiBzdGlyIFttYWlsdG86c3Rpci1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYg T2YgQnJpYW4gUm9zZW4NClNlbnQ6IFR1ZXNkYXksIFNlcHRlbWJlciAyNiwgMjAxNyA2OjIyIEFN DQpUbzogQ2hyaXMgV2VuZHQgPGNocmlzLWlldGZAY2hyaXN3ZW5kdC5uZXQ+DQpDYzogSnVsaW8g TWFydGluZXotTWluZ3VpdG8gPGp1bGlvLm1hcnRpbmV6LW1pbmd1aXRvQGVyaWNzc29uLmNvbT47 IHN0aXJAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbc3Rpcl0gVmFsaWRhdGluZyBUTiBhdXRob3Jp dHkgdG9nZXRoZXIgd2l0aCBudW1iZXIgcG9ydGFiaWxpdHkNCg0KT25lIGlkZWEgd2UgdG9zc2Vk IGFyb3VuZCB3YXMgdG8gZXh0ZW5kIGFuIE9DU1AgY2hlY2sgdG8gaW5jbHVkZSBhIGNoZWNrIG9m IHdoZXRoZXIgdGhlIFROIGluIHF1ZXN0aW9uIHdhcyBzdGlsbCBpbiB0aGUgcmFuZ2UuDQoNCkJy aWFuDQoNCk9uIFNlcCAyNiwgMjAxNywgYXQgOToxMSBBTSwgQ2hyaXMgV2VuZHQgPG1haWx0bzpj aHJpcy1pZXRmQGNocmlzd2VuZHQubmV0PiB3cm90ZToNCg0KSSBnZXQgeW91ciBwb2ludCBidXQg SeKAmWQgYmUgY3VyaW91cyB0byBoZWFyIGEgZ29vZCBwcm9wb3NhbCBvbiBob3cgdG8gZG8gdGhp cyBzaW1wbGVyIHRoYW4gdGhlIHNwZWNzIGFscmVhZHkgcHJvdmlkZS4NCg0KVGhpcyBpcyBhbiBp bmZvcm1hdGlvbiB0aGVvcnkgcHJvYmxlbSwgaXTigJlzIGhhcmQgdG8gcmVwcmVzZW50IGEgZGlz cGFyYXRlIHNldC9ncm91cGluZyBvZiBudW1iZXJzIG5vIG1hdHRlciBob3cgeW91IGF0dGFjayBp dC4NCg0KDQpPbiBTZXAgMjYsIDIwMTcsIGF0IDY6MDkgQU0sIEp1bGlvIE1hcnRpbmV6LU1pbmd1 aXRvIDxtYWlsdG86anVsaW8ubWFydGluZXotbWluZ3VpdG9AZXJpY3Nzb24uY29tPiB3cm90ZToN Cg0KQXMgeW91IG1lbnRpb25lZCwgU0hBS0VOIGRvZXMgbm90IGNhcmUgYWJvdXQgZm9yIHdoaWNo IFROcyBhIGNlcnRpZmljYXRlIGhhcyBhdXRob3JpdHkuIEl0IGlzIHRydXN0ZWQgdGhhdCB0aGUg VE4gYmVsb25ncyB0byB0aGUgY2VydGlmaWNhdGUsIGFuZCBpZiBub3QsIG1lYXN1cmVzIGFyZSB0 YWtlbiBsYXRlciBhbmQgdGhlIHJlcHV0YXRpb24gb2YgdGhlIG9wZXJhdG9yL2NlcnRpZmljYXRl IHdpbGwgYmUgYWZmZWN0ZWQuwqANCsKgDQpCdXQgYmFjayB0byB0aGUgSUVURiBkcmFmdCBmb3Ig Y2VydGlmaWNhdGVzIGFuZCBUTiBhdXRob3JpdHkgZGVjbGFyYXRpb24sIHRoZSBjdXJyZW50IG1l dGhvZCB0byBzcGVjaWZ5IHRoZSBhdXRob3JpdHkgY2FuIGdldCBkaWZmaWN1bHQgdG8gaW1wbGVt ZW50LiBJZiBudW1iZXIgaXMgcG9ydGVkIG91dCB3ZSBzcGxpdCBhIHJhbmdlIGluIDIgcmFuZ2Vz LiBBbmQgd2XigJlsbCBrZWVwIHNwbGl0dGluZyB0aGUgcmFuZ2VzIGFzIG1vcmUgbnVtYmVycyBh cmUgYmVpbmcgcG9ydGVkIG91dC4NClVzaW5nIGRpZmZlcmVudCBjZXJ0aWZpY2F0ZXMgZm9yIGRp ZmZlcmVudCByYW5nZXMgd291bGQgcmVzdWx0IG9uIGEgaGlnaCBudW1iZXIgb2YgY2VydGlmaWNh dGVzLiBTcGVjaWZ5aW5nIGFsbCB0aGUgcmFuZ2VzIHdpdGhpbiAxIGNlcnRpZmljYXRlIHdpbGwg cmVzdWx0IGFsc28gaW4gYSBjb21wbGV4IHNwZWNpZmljYXRpb24uwqANCsKgDQpUaGUgc3BlY2lm aWNhdGlvbiBzaG91bGQgYmUgZXh0ZW5kZWQgdG8gc2ltcGxpZnkgdGhlIHdheSB0byBpbmRpY2F0 ZSB0aGUgYXV0aG9yaXR5IG92ZXIgdGVsZXBob25lIG51bWJlcnMsIHNwZWNpYWxseSB3aGVuIG51 bWJlcnMgYXJlIHBvcnRlZCBvdXQgZnJvbSByYW5nZXMuDQrCoA0KPkJyaWFuIFJvc2VuIDxtYWls dG86YnJAYnJpYW5yb3Nlbi5uZXQ+wqBXZWQsIDIzIEF1Z3VzdCAyMDE3IDE0OjMyIFVUQ2h0dHBz Oi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9zZWFyY2gvP2VtYWlsX2xpc3Q9c3Rpcg0KPlJl c2VsbGVycyBjb21wbGljYXRlIGl0Lg0KPj4gT24gQXVnIDIzLCAyMDE3LCBhdCAxMDowMSBBTSwg RXJpYyBCdXJnZXIgPG1haWx0bzplYnVyZ2VyQHN0YW5kYXJkc3RyYWNrLmNvbSZndDsgd3JvdGU6 DQo+Pg0KPj4gRm9yIHRoYXQgbWF0dGVyLCBpbiBOb3J0aCBBbWVyaWNhIHRoZSBOUEFDIGFscmVh ZHkgaGFzIHdoaWNoIG9wZXJhdG9yIGlzIHN1cHBvc2VkIHRvIG1hbmFnZSBhIGdpdmVuIHBvcnRl ZCBUTi4gSeKAmW0gbm90IHN1cmUgSSBzZWUgdGhlIGlzc3VlIGhlcmUuIEkgc3VwcG9zZSBvbmUg Y291bGQgY3Jvc3MgY2hlY2sgdG8gbWFrZSBzdXJlIHRoZSByaWdodCBvcGVyYXRvciBpcyBzaWdu aW5nLCBvciBpcyB0aGUgcm9vdCBvZiBkaXN0cmlidXRpb24sIGZvciBhIGdpdmVuIG51bWJlci4N Cj4+DQo+Pj4gT24gQXVnIDE2LCAyMDE3LCBhdCA4OjI3IEFNLCBDaHJpcyBXZW5kdCA8bWFpbHRv OmNocmlzLWlldGZAY2hyaXN3ZW5kdC5uZXQmZ3Q7IHdyb3RlOg0KPj4+DQo+Pj4gSSB0aGluayB5 b3Ugd291bGQganVzdCBjb3ZlciB0aGlzIHNjZW5hcmlvIHdpdGggdHdvIGRpZmZlcmVudCBjZXJ0 aWZpY2F0ZXMgd2l0aCB0aGUgdHdvIHNtYWxsZXIgcmFuZ2VzLg0KPj4+DQo+Pj4gVGhhdCBzYWlk LCBmb3IgTm9ydGggQW1lcmljYSB0aGUgU0hBS0VOIGFwcHJvYWNoIGlzIG5vdCB0byB1c2UgY2Vy dGlmaWNhdGVzIGZvciBudW1iZXIgYmxvY2tzLCBzbyBub3Qgc3VyZSBpZiB5b3UgbG9va2luZyBh dCBhIGdlbmVyaWMgc29sdXRpb24gb3Igbm90Lg0KPj4+DQo+Pj4+IE9uIEF1ZyAxNiwgMjAxNywg YXQgNToyMSBBTSwgSnVsaW8gTWFydGluZXotTWluZ3VpdG8gPG1haWx0bzpqdWxpby5tYXJ0aW5l ei1taW5ndWl0b0Blcmljc3Nvbi5jb20mZ3Q7IHdyb3RlOg0KPj4+PiBIaSwNCj4+Pj4gVGhlIGN1 cnJlbnQgZHJhZnRzIGZvciBSRkM0NDc0YmlzIGFuZCBjZXJ0aWZpY2F0ZXMgZGVzY3JpYmUgaG93 IHRvIHZhbGlkYXRlIHRoYXQgYSB0ZWxlcGhvbmUgbnVtYmVyIGlzIG93bmVkIGJ5IHRoZSBvcGVy YXRvciBzaWduaW5nIHRoZSBjYWxsaW5nIElkZW50aXR5LiBBIFROQXV0aG9yaXphdGlvbkxpc3Qg bWF5IGJlIGluY2x1ZGVkIGluIHRoZSBjZXJ0aWZpY2F0ZSBsaXN0aW5nIHRoZSBudW1iZXJzIHRo ZSBvcGVyYXRvciBpcyBhdXRob3JpdGF0aXZlIGZvci4NCj4+Pj4NCj4+Pj4gSG93ZXZlciwgSSBz ZWUgc29tZSBpc3N1ZXMgaGFuZGxpbmcgdGhpcyB0b2dldGhlciB3aXRoIG51bWJlciBwb3J0YWJp bGl0eSB3aGljaCBuZWVkIHRvIGJlIGNsYXJpZmllZC4NCj4+Pj4gU3Vic2NyaWJlcnMgd2lsbCBi ZSBwb3J0ZWQgaW4gYW5kIG91dCBxdWl0ZSBmcmVxdWVudGx5LCBtYWtpbmcgdGhlIGluZm9ybWF0 aW9uIGluIHRoZSBjZXJ0aWZpY2F0ZXMgb2Jzb2xldGUuIFRvIGtlZXAgdXAgdGhlIHBhY2Ugd2l0 aCB0aGUgbnVtYmVyIHBvcnRhYmlsaXR5LCB0aGUgb3BlcmF0b3JzIGNlcnRpZmljYXRlcyB3b3Vs ZCBoYXZlIHRvIGJlIHVwZGF0ZWQgZnJlcXVlbnRseS4gU2hvdWxkIHRoZSBjZXJ0aWZpY2F0ZXMg aGF2ZSBzaG9ydCB2YWxpZGl0eSB0aW1lcz8gRS5nLiAxIHdlZWssIG9yIGV2ZW4gc2hvcnRlcj8N Cj4+Pj4NCj4+Pj4gSW5zdGVhZCBvZiBoYXZpbmcgdGhlIFROIGluZm9ybWF0aW9uIGluIHRoZSBj ZXJ0aWZpY2F0ZSBhbmQgbmVlZCB0byB1cGRhdGUgaXQgY29uc3RhbnRseSwgaXQgd291bGQgYmUg bW9yZSBhcHByb3ByaWF0ZSB0byBoYXZlIGEgdHJ1c3RlZCBzZXJ2ZXIgY29ubmVjdGVkIHRvIHRo ZSBuYXRpb25hbCBOdW1iZXIgUG9ydGFiaWxpdHkgREIgKHRvIHVwZGF0ZSB0aGUgaW5mb3JtYXRp b24pIHRvIHdoaWNoIHRoZSB2ZXJpZmllcnMgY2FuIGNvbm5lY3QgYW5kIHJldHJpZXZlIHRoZSBh dXRob3JpdHkgaW5mb3JtYXRpb24uIEVhY2ggdmVyaWZpZXIgY291bGQgcmV0cmlldmUgdGhlIFRO IGxpc3RzIGZvciBvcGVyYXRvcnMgYW5kIHJlZnJlc2ggdGhlIGxpc3QgZGFpbHksIHdpdGhvdXQg bmVlZGluZyB0byByZS1pc3N1ZSBvcGVyYXRvciBjZXJ0aWZpY2F0ZXMsIHNvIGl0IHdvdWxkIGJl IHVwZGF0ZWQgd2l0aCB0aGUgbGF0ZXN0IHBvcnRhYmlsaXR5Lg0KPj4+Pg0KPj4+PiBBYm91dCBo b3cgdG8gcmVwcmVzZW50IHRoZSBUTiBsaXN0cywgZS5nLiBpZiBhbiBvcGVyYXRvciBvd25zIHRo ZSByYW5nZSA1NTUteHh4eCwgd2l0aCB0aGUgY3VycmVudCBkZWZpbml0aW9ucyBpdCB3aWxsIGJl IGVhc3kgdG8gZGVzY3JpYmU6DQo+Pj4+IFRlbGVwaG9uZU51bWJlclJhbmdlIDo6PSBTRVFVRU5D RSB7DQo+Pj4+wqDCoMKgwqDCoCBzdGFydCBUZWxlcGhvbmVOdW1iZXIgPSA1NTUwMDAwLA0KPj4+ PsKgwqDCoMKgwqAgY291bnQgSU5URUdFUiAoMi4uTUFYKSA9IDEwMDAwDQo+Pj4+wqDCoMKgwqDC oCB9DQo+Pj4+DQo+Pj4+IE5vdywgaWYgbnVtYmVyIDU1NS02Nzg5IG1vdmVzIHRvIGFub3RoZXIg b3BlcmF0b3Igd2UgaGF2ZSB0byByZXByZXNlbnQgd2l0aDoNCj4+Pj4gKHtzdGFydCA9IDU1NTAw MDAsIGNvdW50ID0gNjc4OX0sIHtzdGFydCA9IDU1NTY3OTAsIGNvdW50ID0gMzIxMH0pDQo+Pj4+ DQo+Pj4+IEFzIG1vcmUgbnVtYmVycyBhcmUgbW92ZWQgb3V0IGZyb20gdGhlIHJhbmdlLCB0aGlz IHJlcHJlc2VudGF0aW9uIGZvcm1hdCB3aWxsIGdldCBtZXNzeSBhbmQgZGlmZmljdWx0IHRvIG1h bmFnZS4NCj4+Pj4NCj4+Pj4gVG8gaGFuZGxlIE5QIGl0IHdvdWxkIGJlIGVhc2llciB0byBrZWVw IHRoZSBvcmlnaW5hbCByYW5nZSwgYW5kIGluY2x1ZGUgYSBsaXN0IG9mIGV4Y2x1ZGVkIG51bWJl cnMgd2hpY2ggaGF2ZSBiZWVuIHBvcnRlZCBvdXQsIGUuZy46DQo+Pj4+DQo+Pj4+IFRlbGVwaG9u ZU51bWJlclJhbmdlIDo6PSBTRVFVRU5DRSB7DQo+Pj4+wqDCoMKgwqDCoCBzdGFydCBUZWxlcGhv bmVOdW1iZXIsDQo+Pj4+wqDCoMKgwqDCoCBjb3VudCBJTlRFR0VSICgyLi5NQVgpLA0KPj4+PsKg wqDCoMKgwqAgZXhjbHVkZWROdW1iZXJzIFNFUVVFTkNFIFNJWkUgKDEuLk1BWCkgT0YgVE5FbnRy eQ0KPj4+PsKgwqDCoMKgwqAgfQ0KPj4+Pg0KPj4+Pg0KPj4+PiBJcyB0aGlzIGEgZmVhc2libGUg c29sdXRpb24/IElzIGl0IHRvbyBsYXRlIHRvIGhhbmRsZSBub3cgZHVlIHRvIHRoZSBjdXJyZW50 IHN0YXRlPw0KPj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KPj4+PiBzdGlyIG1haWxpbmcgbGlzdA0KPj4+PsKgbWFpbHRvOnN0aXJAaWV0Zi5vcmcN Cj4+Pj7CoGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KPj4+DQo+ Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+PiBz dGlyIG1haWxpbmcgbGlzdA0KPj4+wqBtYWlsdG86c3RpckBpZXRmLm9yZw0KPj4+wqBodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXINCj4+DQo+PiBfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4gc3RpciBtYWlsaW5nIGxpc3QN Cj4+wqBtYWlsdG86c3RpckBpZXRmLm9yZw0KPj7CoGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vc3Rpcg0KwqANCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQpzdGlyIG1haWxpbmcgbGlzdA0KbWFpbHRvOnN0aXJAaWV0Zi5vcmcNCmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KDQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0Kc3RpciBtYWlsaW5nIGxpc3QNCm1h aWx0bzpzdGlyQGlldGYub3JnDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3N0aXINCg0K From nobody Wed Sep 27 09:32:47 2017 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 972E6126BF3 for ; Wed, 27 Sep 2017 09:32:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WuNoq5Rwr0Br for ; Wed, 27 Sep 2017 09:32:44 -0700 (PDT) Received: from mail-it0-x235.google.com (mail-it0-x235.google.com [IPv6:2607:f8b0:4001:c0b::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 141411342CC for ; Wed, 27 Sep 2017 09:32:44 -0700 (PDT) Received: by mail-it0-x235.google.com with SMTP id c195so7270027itb.1 for ; Wed, 27 Sep 2017 09:32:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=V8QWgz17tmw9CgQwTR3FNUJPO+xyAwQEvPqb3D5p0LU=; b=KAIiE417D+2cYHnra9sEk5BlxaiB7M3rFkDlcu9vbj1Aj/AAeoVhqWBw8u9ah8YdiZ iuRHyJ3EAWaDK4mfD4TkV+Sc+U35f7mNua8BBtVoRWcn79DR/hxRsJf8JzQ/RCRvTEYr NnttSWMAPHY6HkRAIJRInGayjQ5JW2YJBSeuj6Kv1UBWlAJAo+MATpPZb5lidQILuKFk QnHv7hkEpITsvHvpTzXsN4o75xnqxUc0g2EbZN1TNzSje/dhmhibNns8hv4FUZq/PVWf lfm0mXSuyVx5vqjocBOlGqjeG6ZIQfM65P1bfOOzkbMx3BTz5E2z2Aq/VM8NA9a4oLKQ DrZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=V8QWgz17tmw9CgQwTR3FNUJPO+xyAwQEvPqb3D5p0LU=; b=tzVXRva8ysMnpiOJ3CxJLBvN4AXdaZto/oLuwkF69GG+m0qRAVO+hAn9qnnnSmFnMh PprYxxIML96G+/+uwlN085/E7pTMN+q3QK+JtLqlDA8tgzzbR4Aoyp9YjThAM3vccrum g36QSOC+J6z5uAM3DU4RrumvUwwH9KXJeFw2TIlgYljUUh7U/GIwLZ6ySdET41SVljzS GT6UHGXy2uCsaueOEJM0oaWXNNUe0bJw5IK0meUz3RLTTLhuT1HVVS1/JB0VvZl0VSOB WDFQjZHZ67DM/EIdLKZH7BLsLjf+n8FcPZXw85hyXrNWZdMFxjLtUmbUQHBCAk6cVb7Y 7Qvw== X-Gm-Message-State: AHPjjUhM397TGgSsz99juPIheY/+DLViWnv672YfKUKmGwRZ9OlNlJah z8HrK1JctbEnP4tbkzss5HXe6g== X-Google-Smtp-Source: AOwi7QBKtpTtQV/knj22Mec536qe9WX90sQav6upcybbfJ48kk/nh4VtOZLLPipN2bzkE+E5qeqmvw== X-Received: by 10.36.65.72 with SMTP id x69mr1599071ita.30.1506529963290; Wed, 27 Sep 2017 09:32:43 -0700 (PDT) Received: from [10.136.137.61] ([192.42.83.150]) by smtp.gmail.com with ESMTPSA id p124sm6822264ite.3.2017.09.27.09.32.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 Sep 2017 09:32:41 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.0 \(3445.1.6\)) From: Chris Wendt In-Reply-To: Date: Wed, 27 Sep 2017 11:32:39 -0500 Cc: Alex Bobotek , Brian Rosen , "stir@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <1F533164-AA31-4EF6-855F-05EB908E4FD7@chriswendt.net> References: <391A1CF8-4CED-4ECF-92EF-FA988B4881C4@chriswendt.net> <543B5C94-D117-44DA-B66D-56DB809A068D@chriswendt.net> <1B5F167F-234F-43AE-99DF-3B627A0C4A30@brianrosen.net> <4B1956260CD29F4A9622F00322FE053101B8A33E34F1@BOBO1A.bobotek.net> To: Julio Martinez-Minguito X-Mailer: Apple Mail (2.3445.1.6) Archived-At: Subject: Re: [stir] Validating TN authority together with number portability X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Sep 2017 16:32:46 -0000 Regarding your last comment, you should pay attention to the discussions = in modern working group :) > On Sep 26, 2017, at 10:05 AM, Julio Martinez-Minguito = wrote: >=20 > A proposal to handle the numbers ported out is to explicitly indicate = them, while keeping the original range. Thus the ranges do not need to = be split several times.=20 > TelephoneNumberRange ::=3D SEQUENCE { > start TelephoneNumber, > count INTEGER (2..MAX), > excludedNumbers SEQUENCE SIZE (1..MAX) OF TNEntry > } >=20 > A possible issue is that the list of excludedNumbers (numbers ported = out) could get long as numbers are being ported out, and the list of = excluded numbers might even include more than the 50% of the numbers in = the range. In those cases 'cleanups' could be done to change how the = numbers the operator is authoritative are represented, e.g. list of = numbers instead of using ranges.=20 >=20 > About doing queries to external systems (OCSP or others protocols) to = check if numbers are still in the range for the operator, it would = require making queries for every call, and that would impact latency and = capacity. >=20 > To avoid updating certificates everytime numbers are ported, there can = be a query to an external trusted server to download the list of numbers = an operator is authoritative. This list could be updated and downloaded = everyday, without having to update the certificates. The format to = represent the list can be according to the format described in the draft = (maybe with the inclusion of "excludedNumbers". >=20 >=20 > From: Alex Bobotek [mailto:alex@bobotek.net]=20 > Sent: den 26 september 2017 15:44 > To: 'Brian Rosen' ; Chris Wendt = > Cc: Julio Martinez-Minguito ; = stir@ietf.org > Subject: RE: [stir] Validating TN authority together with number = portability >=20 > Or include references to authorized certs in a registry such as one = used for routing. =20 >=20 >=20 >=20 > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Brian Rosen > Sent: Tuesday, September 26, 2017 6:22 AM > To: Chris Wendt > Cc: Julio Martinez-Minguito ; = stir@ietf.org > Subject: Re: [stir] Validating TN authority together with number = portability >=20 > One idea we tossed around was to extend an OCSP check to include a = check of whether the TN in question was still in the range. >=20 > Brian >=20 > On Sep 26, 2017, at 9:11 AM, Chris Wendt = wrote: >=20 > I get your point but I=E2=80=99d be curious to hear a good proposal on = how to do this simpler than the specs already provide. >=20 > This is an information theory problem, it=E2=80=99s hard to represent = a disparate set/grouping of numbers no matter how you attack it. >=20 >=20 > On Sep 26, 2017, at 6:09 AM, Julio Martinez-Minguito = wrote: >=20 > As you mentioned, SHAKEN does not care about for which TNs a = certificate has authority. It is trusted that the TN belongs to the = certificate, and if not, measures are taken later and the reputation of = the operator/certificate will be affected.=20 > =20 > But back to the IETF draft for certificates and TN authority = declaration, the current method to specify the authority can get = difficult to implement. If number is ported out we split a range in 2 = ranges. And we=E2=80=99ll keep splitting the ranges as more numbers are = being ported out. > Using different certificates for different ranges would result on a = high number of certificates. Specifying all the ranges within 1 = certificate will result also in a complex specification.=20 > =20 > The specification should be extended to simplify the way to indicate = the authority over telephone numbers, specially when numbers are ported = out from ranges. > =20 >> Brian Rosen Wed, 23 August 2017 14:32 = UTChttps://mailarchive.ietf.org/arch/search/?email_list=3Dstir >> Resellers complicate it. >>> On Aug 23, 2017, at 10:01 AM, Eric Burger = >>=20 >>> For that matter, in North America the NPAC already has which = operator is supposed to manage a given ported TN. I=E2=80=99m not sure I = see the issue here. I suppose one could cross check to make sure the = right operator is signing, or is the root of distribution, for a given = number. >>>=20 >>>> On Aug 16, 2017, at 8:27 AM, Chris Wendt = >>>=20 >>>> I think you would just cover this scenario with two different = certificates with the two smaller ranges. >>>>=20 >>>> That said, for North America the SHAKEN approach is not to use = certificates for number blocks, so not sure if you looking at a generic = solution or not. >>>>=20 >>>>> On Aug 16, 2017, at 5:21 AM, Julio Martinez-Minguito = >>>> Hi, >>>>> The current drafts for RFC4474bis and certificates describe how to = validate that a telephone number is owned by the operator signing the = calling Identity. A TNAuthorizationList may be included in the = certificate listing the numbers the operator is authoritative for. >>>>>=20 >>>>> However, I see some issues handling this together with number = portability which need to be clarified. >>>>> Subscribers will be ported in and out quite frequently, making the = information in the certificates obsolete. To keep up the pace with the = number portability, the operators certificates would have to be updated = frequently. Should the certificates have short validity times? E.g. 1 = week, or even shorter? >>>>>=20 >>>>> Instead of having the TN information in the certificate and need = to update it constantly, it would be more appropriate to have a trusted = server connected to the national Number Portability DB (to update the = information) to which the verifiers can connect and retrieve the = authority information. Each verifier could retrieve the TN lists for = operators and refresh the list daily, without needing to re-issue = operator certificates, so it would be updated with the latest = portability. >>>>>=20 >>>>> About how to represent the TN lists, e.g. if an operator owns the = range 555-xxxx, with the current definitions it will be easy to = describe: >>>>> TelephoneNumberRange ::=3D SEQUENCE { >>>>> start TelephoneNumber =3D 5550000, >>>>> count INTEGER (2..MAX) =3D 10000 >>>>> } >>>>>=20 >>>>> Now, if number 555-6789 moves to another operator we have to = represent with: >>>>> ({start =3D 5550000, count =3D 6789}, {start =3D 5556790, count =3D = 3210}) >>>>>=20 >>>>> As more numbers are moved out from the range, this representation = format will get messy and difficult to manage. >>>>>=20 >>>>> To handle NP it would be easier to keep the original range, and = include a list of excluded numbers which have been ported out, e.g.: >>>>>=20 >>>>> TelephoneNumberRange ::=3D SEQUENCE { >>>>> start TelephoneNumber, >>>>> count INTEGER (2..MAX), >>>>> excludedNumbers SEQUENCE SIZE (1..MAX) OF TNEntry >>>>> } >>>>>=20 >>>>>=20 >>>>> Is this a feasible solution? Is it too late to handle now due to = the current state? >>>>> _______________________________________________ >>>>> stir mailing list >>>>> mailto:stir@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/stir >>>>=20 >>>> _______________________________________________ >>>> stir mailing list >>>> mailto:stir@ietf.org >>>> https://www.ietf.org/mailman/listinfo/stir >>>=20 >>> _______________________________________________ >>> stir mailing list >>> mailto:stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir > =20 > _______________________________________________ > stir mailing list > mailto:stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > mailto:stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir >=20