From nobody Wed Aug 1 12:02:40 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D3F6130E43 for ; Wed, 1 Aug 2018 12:02:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id snVyHqfepwNj for ; Wed, 1 Aug 2018 12:02:37 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0135.outbound.protection.outlook.com [104.47.37.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B2D4130E01 for ; Wed, 1 Aug 2018 12:02:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QAXUyIXditeogINqSFquXaGi60zOCaKNqX3xZaC6mMU=; b=idDIzUZHUEAgIGNNJBGmSOqdqVXTYRPDfid/un1XCAnCbGa+8076+UI7BXwQUk3DTjjyoHFX9WJ4f/7h9Pd4tgGFqZaIEjC+Yd+SLrhx+oDxxd35QJA4sz6s4A/dURirZGtBj3W5FcQQ8O45cXn2FZvScZvk58LVXDErJchi6fk= Received: from DM5PR2101MB0805.namprd21.prod.outlook.com (10.167.105.149) by DM5PR2101MB0968.namprd21.prod.outlook.com (52.132.133.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1038.6; Wed, 1 Aug 2018 19:02:36 +0000 Received: from DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::a090:26ec:6846:6ff5]) by DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::a090:26ec:6846:6ff5%3]) with mapi id 15.20.1038.003; Wed, 1 Aug 2018 19:02:36 +0000 From: Dave Thaler To: "suit@ietf.org" Thread-Topic: IETF 102 minutes posted Thread-Index: AdQpyg8kJTJOLeKbSwerzcPrO/eJPA== Date: Wed, 1 Aug 2018 19:02:36 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-08-01T19:02:37.4177680Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:3:5219:d1b3:3891:f35b] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2101MB0968; 6:BdrgvfzfcviWG3XevDJ8FCeVyTDXufnSyKPsP4hXf/hzgG+rodZucYI8sOajh06fUjvHcryyIXQGAm4PPhsGJBcy+/75ZnQayrHjLyXYdxEV+oPYmR+hw/kRH1b33A8h5CwwBiZxu37+i3rVs72RFxmKqlaJ07PU9y2AsiDYRfIZZZZIUYEYyrlNztfCZqrNCJkNedVZYxCH//W3nUFwyiD+CWJePSEVNyCw2nB3CP60AN3Vcwwd21jipuHUO077bHNww4Liwppk6P5ZaSxG0x0nJAMyb7TO36xW4ianpuHvK583XVpXOHYmiYu22BvG7AWnf5zp4tkCikoTg7jimwkofJ3A4RBMf/VLr0BCM3PgjcneUxdVarp5DTBat56jghNCIET3Zh/q/AGgDNzcwxIRBIMYQylu3ixdf26X0EqFPTEj8GJZ3xa2lQ0hY+xzbsGafMdnepIcQOwspC5xGQ==; 5:TKP8w5Darw23RHE1EwnPciE5yggWjHdquZdoGz+R1vvOOAZ/d9C+tY9sGx/6L5BRccn0KW/5AFOan5gJ/QSm9z2ZUWDk6w5DiLzRmhbqAzjWYzWGSOVANJX387lis316sGjvHfiOrbn0aWBm8knhqjDUmNEJhxbbAGnO/VUNfkA=; 7:LrmUldvQLaGE1HIxcNuXpkQYw7gP7rZYC28wlmYMpf2RGBsYSI4099oDurQiPAQVcLEl1ISDUWrXhYGP+gBoMI+1n5dvhBfyRB93UBIStNE9Uwm2KBfPRtSKjAFcblv7qtWy2bZJVCLuBNsBQVGbVNOY0ZD0cxxyFF83RCgOmrI/BURXegc8qy7DhkRVCSu3PLqNL0P5MIr+2G5LcZ1PwseQrgvvYTmNE3Dt1qrt9WY66IIr/PzLiOjbtdse8BX+ x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 3ffc5456-8ea6-45ae-9fb9-08d5f7e15831 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7193020); SRVR:DM5PR2101MB0968; x-ms-traffictypediagnostic: DM5PR2101MB0968: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(120809045254105)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3002001)(3231311)(944501410)(52105095)(2018427008)(10201501046)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123558120)(20161123564045)(20161123560045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011)(7699016); SRVR:DM5PR2101MB0968; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2101MB0968; x-forefront-prvs: 0751474A44 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(136003)(39860400002)(376002)(366004)(396003)(346002)(199004)(189003)(68736007)(256004)(46003)(5630700001)(97736004)(476003)(2351001)(558084003)(7696005)(486006)(25786009)(7116003)(5660300001)(10290500003)(5250100002)(2501003)(22452003)(99286004)(186003)(316002)(2900100001)(86362001)(86612001)(53936002)(102836004)(6306002)(6506007)(8936002)(33656002)(2906002)(7736002)(236005)(74316002)(790700001)(10090500001)(81166006)(5640700003)(1730700003)(81156014)(8990500004)(55016002)(106356001)(478600001)(966005)(6436002)(14454004)(6916009)(606006)(8676002)(6116002)(54896002)(9686003)(105586002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB0968; H:DM5PR2101MB0805.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 4ehWV4bkZC2bx8grL8zGJL05jLdqPaP9462XPHZqoCwFvv60tjn4tUBVz+pzezEB68X5KRRkC3xptvN5byyJhvZpzlHlv3r7xCq/wAmwpmsvIPKnW0whpCU50rUdnLnsvc/Arp1F2092WCyg9e1XHc5eXk/hrn3cRfrhmC9mI0/24Ky5qXxWPKc0lxB+wv6nehE2SkWicVx7ytVzv00ITA/ds3cO+ffWfP70Kgbz5FemZSqjBrv//e11s8UsAslHZgHz7rbqzkfqr/trSXLPzyG8K9+kcDvHKu8iOghLyLRO9pJ+nzwQoFvYJQ+Xf6XomG01P3Ygn5Nc8hSfTinXAmGWxuZlfTBJYR6z6a/24y0= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2101MB0805D53E16C060E74B7A4867A32D0DM5PR2101MB0805_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3ffc5456-8ea6-45ae-9fb9-08d5f7e15831 X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Aug 2018 19:02:36.0736 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0968 Archived-At: Subject: [Suit] IETF 102 minutes posted X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Aug 2018 19:02:39 -0000 --_000_DM5PR2101MB0805D53E16C060E74B7A4867A32D0DM5PR2101MB0805_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The minutes are now posted at https://datatracker.ietf.org/meeting/102/materials/minutes-102-suit-00 If there are errors, or omissions, let me know. Thanks again to our note takers, Jessica Fitzgerald-McKay and Carsten Borma= nn! Dave --_000_DM5PR2101MB0805D53E16C060E74B7A4867A32D0DM5PR2101MB0805_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

The minutes are now posted at

https://datatracker.ietf.org/meeting/102/mat= erials/minutes-102-suit-00

If there are errors, or omissions, let me know.=

 

Thanks again to our note takers, Jessica Fitzgerald-McKay and Carsten Bormann!

 =

Dave

--_000_DM5PR2101MB0805D53E16C060E74B7A4867A32D0DM5PR2101MB0805_-- From nobody Thu Aug 2 08:11:14 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E828F130F2C for ; Thu, 2 Aug 2018 08:11:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 93glC2ui0ccI for ; Thu, 2 Aug 2018 08:10:59 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C32EA124C04 for ; Thu, 2 Aug 2018 08:10:59 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 337BF20491 for ; Thu, 2 Aug 2018 11:27:38 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 6F9C1149C; Thu, 2 Aug 2018 11:10:58 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 6D4076D for ; Thu, 2 Aug 2018 11:10:58 -0400 (EDT) From: Michael Richardson To: suit X-Attribution: mcr X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Suit] Human rights issues and *manifest* encryption X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Aug 2018 15:11:08 -0000 --=-=-= Content-Type: text/plain {watching the Youtube video of the WG session from two weeks ago} I think that there are many specific non-human rights related reasons to encrypt the firmware. I think that the WG is in the right direction on that. Encryption of the manifest is a complex question to me. My take is that the concern is that if a person is identifiable when they (or rather, their personal network) asks questions like: ** Is there a new firmware for device type X? ** or receives notices like: ** In order to do X, your device Y needs firmware at least Z ** (and this might be done by sending a manifest) When device type X is a medical device, or some other socially awkward device (a sex toy, a diaper, etc.) one can easily see why privacy is important. As far as I understand, the process of asking questions like above, and/or receiving notices of new firmware available is explicitely out-of-scope today. The problem that I see with encrypting manifests is that either it prevents much of the supporting infrastructure from being useful (if it's well encrypted), or the encryption key is so well known as to be a joke. I suspect that much of the problem can and SHOULD be solved with transport layer security around the transactions about updates. I think that the SUIT architecture should deal with this issue, and rule manifest encryption out of scope, mentioning that the (out of scope) transport protocol MUST provide transport encryption. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAltjHwIACgkQgItw+93Q 3WU03Af/eBAJBfkvdcfi2NbLKZ3kCo9N97FlL5t1cLpQEo6QPCnsucsrRP1LRPMK xUEowhcAom/SsmsAODHk/PzmrlIobtaK4qQIifkhxMYsmsY4Sf2/J90lZiV2EdNZ XiVHgn8MNUP8EfnY5rCJ3W5iGesNkjubkBhkXbWe0yZd9tUWuWLGg9bpE2G74o4L aN1iref5YXlJVj4ekpV/eR/X8UMeWmhbTMA+uYpwS+kOiZBnW/uSZheKizZ0iFRp 6Tg05cnKJOBShQZV4KDfCtFb6x/pb0izufe8sdHAsbSXxCxJofUwP5Y2Ny4v3K4T pGvd9LX2WYBrKslIxLaiTkxOwOF+Ig== =EVQs -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Aug 2 12:01:46 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2914130F53 for ; Thu, 2 Aug 2018 12:01:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l9atDJxAxT_C for ; Thu, 2 Aug 2018 12:01:37 -0700 (PDT) Received: from mail-ed1-x532.google.com (mail-ed1-x532.google.com [IPv6:2a00:1450:4864:20::532]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57F52130F61 for ; Thu, 2 Aug 2018 12:01:11 -0700 (PDT) Received: by mail-ed1-x532.google.com with SMTP id o8-v6so1279537edt.13 for ; Thu, 02 Aug 2018 12:01:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=bYg0M5gFKRqcgIMAtg4Xuoz+vBL+YtyC8iXihkvrA7I=; b=iNv1ojg5wNPtB5PKoJwXXp6pwTGNGV54mNoA0X9bbP3Wqj32vdzHboSx0G9mSGzsqb ED+LXDIVUywxbdk57Sa+LQGLz5RaHoXi87doR2gWK2jqioK85ScMnerG+yi4ogmQV16V llKjig02irHoPNWdXJkdYxuCuIhtI+VjfRQs+RXXgSMbEkvElXo9nNPD3sHNMqVbIlyj 63Joit8tWiOPiyuxT7PSp4+LrTfqmfwYDWgfkJbA1zeBXvLt1tuAsm51byn5DJUNl5Ch POrGtw0M213HHqcvooqSXDvFQOxYlxOCFqrFdn9CkTNiK4VOSHZ9KFbXTT0tP6yAzCNB P8PQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=bYg0M5gFKRqcgIMAtg4Xuoz+vBL+YtyC8iXihkvrA7I=; b=nZhQtAggvldQFF7K5qca5IjkfuYBLlDgcNpGk6huHwDEfYgf7HbhCS5i2OosX7R47K domSgns4uKddd0Io/+hr40Qoi3D7FapbjzztAA2MArtBC2f/vBJmuTlxtg8FLENODjBm 0IeHZb6cFaJ0Sx7UDI2spS+Opu3EkdelArWiCikvQ7Z/uVN+sGtuj2HvVyYnp0BNMxDK LqQEe3i71wuWjFj0bFfSenxXrmIurGtuvkFn+CQZhlke2ExL4iTfTlRN3k3cTVaNeR9Q pnZ/34gUt1T0uu5U7Ldy0Ox5MMMuqdcArE72gTpy0xrpVeZS/YgevmYQTKtPb1HIKfPr OjUw== X-Gm-Message-State: AOUpUlESLc+FvwlMN3ziVC3RBTdYwelbgJqnbwWeWWqiY7/k5kfkZQAZ R79x9LsLaQOyfUo0+/zFLqGTtQpA X-Google-Smtp-Source: AAOMgpfVuucnqqmv2XuLm4MEcxvtctZKz4HJCG5l/yylsGmCP6fHzQdxMKiHJa69a3ldCcLDPx/4Ew== X-Received: by 2002:a50:92c5:: with SMTP id l5-v6mr4458422eda.52.1533236469849; Thu, 02 Aug 2018 12:01:09 -0700 (PDT) Received: from ?IPv6:2600:8802:5600:1546::102f? ([2600:8802:5600:1546::102f]) by smtp.gmail.com with ESMTPSA id c21-v6sm1444357eda.21.2018.08.02.12.01.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 02 Aug 2018 12:01:08 -0700 (PDT) From: Fred Baker Message-Id: <1CF35D35-DB14-4859-8399-472FD9DFC13C@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_9CBB4419-8D38-452A-8D94-3FC5737D201D"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Thu, 2 Aug 2018 12:01:06 -0700 In-Reply-To: <16119.1533222658@localhost> Cc: suit To: Michael Richardson References: <16119.1533222658@localhost> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Suit] Human rights issues and *manifest* encryption X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Aug 2018 19:01:45 -0000 --Apple-Mail=_9CBB4419-8D38-452A-8D94-3FC5737D201D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Aug 2, 2018, at 8:10 AM, Michael Richardson = wrote: > I think that the SUIT architecture should deal with this issue, and = rule > manifest encryption out of scope, mentioning that the (out of scope) > transport protocol MUST provide transport encryption. I kind of half agree. I don't think that going to the level of "you = should encrypt this or that" makes sense. That said, the more I learn = about communications on the Internet the more I think they should be = encrypted as a class, and I would agree that the obvious tools include = TLS or DTLS. If everything is encrypted, the manifest is encrypted, as = is the exchange that surrounds it. It's one thing to get an email saying "your needs a = firmware upgrade" and another thing to get an email from a company that, = on the long list of products of products that it manufactures or sells, = includes sex toys. In the latter case, the most one might validly = conclude from the metadata is that you have done business in the past = with that company. = --------------------------------------------------------------------------= ------ The fact that there is a highway to hell and a stairway to heaven is an = interesting comment on projected traffic volume... --Apple-Mail=_9CBB4419-8D38-452A-8D94-3FC5737D201D Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEctjlJjQmVrp9uMq7EhdRnd2GP+AFAltjVPIACgkQEhdRnd2G P+D1Ag//XNKq2oF0LY2ygTCw47PqcA2At6LO8XlaAee03zH1ztugJbdmSf/wpjKi ICtDPkiQgQas/uMQwZknNJ+10WHbiIVamhAS25K4pCdbELo4Z70ZyLN3oWHJQTmO oTjtFzXhZqfzLrqxWcA8MEbu1hddplYbhoxYa/WPQN5uOFpjKTWfGNd9b050IXOl MVlbci8Zxx3Z/KqND/GcAbrfZx5OVVr05xzKKIydpT4GfweHaFwzhd79evPMriL3 rjJgtjJ5Ua3kt4eDlJ+kOZs2FEy9nnO/kxhUYDU2oxxgk1nZtwA19inH8VBzSrDd Ze1KmE6QvE//I+cSSWrxMx1mlsrRo8j6Rz3wPGFK0CRPiQXEcH2gnaHeLDYC/gp9 4qzCk7t1aN1q7IAZl1wMkzTs7ak2a9Bxk/qxNA22eF4t2eRfhF0IGfuw08q040D/ zCMlbWurfxuMIRHuMTl4WEFI+AcYEYeTg7dqIfJqkzH7UPuiaOZ2KkSeQPXVDNqG 1s3O5sBwB1JHIuoQbFWZMpaZ43mNGPm386vsePHFJdYeadLEBXX8g7/UTStnv84X /1RKvhW0r7UYJXU17CxjjR9sQY46dtD3nhw5g+w0ns7FgBuazENxb5yBK89iewqf C4kSnv3yKZRaBTVzlMApoJClwc5H/XtQPO5ZcIMvL69+rQkgE8c= =qxyU -----END PGP SIGNATURE----- --Apple-Mail=_9CBB4419-8D38-452A-8D94-3FC5737D201D-- From nobody Thu Aug 2 16:48:12 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 921B6130DBE for ; Thu, 2 Aug 2018 16:48:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rMkUR0Z7qDln for ; Thu, 2 Aug 2018 16:48:08 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00056.outbound.protection.outlook.com [40.107.0.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E658126CC7 for ; Thu, 2 Aug 2018 16:48:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iJMhL2ZyEsVb391JdKWuJPjlBDHYdP6jAagOnjpxhag=; b=RAXCK/Mh29DDgqQLY76sDga8LT9Zq/3s+B3QN6cHwjUUZH6RR0X1K4JgTmog6Me5V/D0Ka9RRVtaDX2STu1ANeSI2pLwYUTGEvOJfT1TA3DDYZFkZde42i8aeg4dQ1EDtVjxUa1dRFzKMfeQO1WEhhOd/U6G7S/1oWhCJiDGqMk= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB1919.eurprd08.prod.outlook.com (10.173.73.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.995.19; Thu, 2 Aug 2018 23:48:05 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::adfc:4f29:e0df:9e9f]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::adfc:4f29:e0df:9e9f%10]) with mapi id 15.20.1017.010; Thu, 2 Aug 2018 23:48:05 +0000 From: Hannes Tschofenig To: Michael Richardson , suit Thread-Topic: [Suit] Human rights issues and *manifest* encryption Thread-Index: AQHUKnMbtP6llGQnAUe5a9jhRM2L9KStIVzQ Date: Thu, 2 Aug 2018 23:48:05 +0000 Message-ID: References: <16119.1533222658@localhost> In-Reply-To: <16119.1533222658@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [12.1.75.136] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB1919; 6:AmoS8Xrmgz1QiSnIGUmtI2lcoWF6fYOqS1gUx5DN6/VTl3hW4zPCVRvglncQLlTGBsU7wqseWC3eyFXrBYjeR14ISEEjiC5Gff069PPO910DB1GizZe1JWl6ItU+c526sMZfX526dpUK1rMxuKtT8bm/EzTtGwm9Db7382nmTWRCWsFreOrQ5nqrU4N5L+9s/gznOgXR52nzwucbOhja/azmwllZpcC3RzdXGw+yC0yjJn0B1tKwjig/L42PUiXkXRTcC3BGbxG8FS6SvGHjWUYY5VgP8RC9BzlGfGRXZNUGefDsIbTq58yCblaqYqWA3fi/JbvzM2VcrggwMf8SWRnrLHLb3ifJfVRtCet84iKJZk0NUzPhBvTH7+zyHCgaIZx6xlKopTAkfpD0pudYUmKYMjvK020YpKMczg/h4ZXSt1UJzZRffSv/RcqSP+1GtiLp9sM+oSeKo+vXE44uTw==; 5:JeGJwMgld0gDJB3PiKO5ZdOmm9Ydgud2MKUWz48qo8oaxOCwDoE2qxurlmFaWiqxLG8AjCgiEdqCBNmdylENAkU8qehUHp43bq8rH6ECqLWRqcy8BZQbz8kPXzWAWlwNtJnhFz8NA/K26J9HyTvPsEOEtx6yAz/HbEkxYQ/ebxk=; 7:InfQ8vQPnbOaXrhdwHqsEfmL/OEsbd65I+RHFsSavWdFXOCpJYFn3VA8D/FwoC91hOAg92EDFQ6qKDUhNkRKIb/jOEHwchSdIj289O/ygzri3/umVxLeyJcKD9l2U7CGEnEl4EyRYgDIpgxR01O52KVTU9npvD2jJtPGRJ87IcdAKPUbVDf+YaLDU+qz0m9hmkEFx4k3cdj90hh8OXKE0V4H600EXbg5TaRXsf1anU+G1LlSN6wIPhubpbf+ebcy x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 943a8f37-2853-42f0-06f6-08d5f8d26453 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB1919; x-ms-traffictypediagnostic: VI1PR0801MB1919: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(223705240517415); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(3231311)(944501410)(52105095)(10201501046)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123564045)(20161123558120)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB1919; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB1919; x-forefront-prvs: 07521929C1 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(136003)(396003)(376002)(366004)(346002)(51444003)(13464003)(189003)(199004)(40434004)(486006)(81156014)(76176011)(229853002)(2900100001)(53546011)(7736002)(6436002)(305945005)(68736007)(81166006)(14454004)(6246003)(99286004)(186003)(86362001)(74316002)(8936002)(6506007)(11346002)(476003)(55016002)(8676002)(72206003)(7696005)(478600001)(106356001)(6116002)(97736004)(110136005)(256004)(14444005)(316002)(33656002)(5024004)(105586002)(446003)(25786009)(3846002)(53936002)(2906002)(5660300001)(9686003)(26005)(102836004)(5250100002)(66066001); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB1919; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: JE3paFaXWldl3OiOxAZENOef/cym/zfViNOz8L9tP5TslePClVUmcB8Jj9OK7QlRg/OgfIWHnv8yvEJjxOvtFtRB+rUSmttrLTwirNNKhlr82jDjfrebZ0WxQ+ZdezzL1wpyVHc+MILTu19gaCUfmZg+RWS8Mgrw27VC5/orEmn5Uz0pagFvCeGvrqkp8NKG+ew7qC8PUqJM3uT9FOTQCBSqJHHdmstKDQl23UJrslN4Il5flawN9L68B0FcuKKy7DeqGq7OTDX60nqURoroE97tYfk1UNJ8UpBQtNLeFF4Oghvux4xd6ratoPni7Ll7RclqqH7xKMX6Rt+EgsNUPZW+BbkQnHqZnsIlAdYAhd8= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 943a8f37-2853-42f0-06f6-08d5f8d26453 X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Aug 2018 23:48:05.1165 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1919 Archived-At: Subject: Re: [Suit] Human rights issues and *manifest* encryption X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Aug 2018 23:48:11 -0000 Everything you say below, Michael, makes sense to me. I agree with your con= clusion. -----Original Message----- From: Suit [mailto:suit-bounces@ietf.org] On Behalf Of Michael Richardson Sent: 02 August 2018 08:11 To: suit Subject: [Suit] Human rights issues and *manifest* encryption {watching the Youtube video of the WG session from two weeks ago} I think that there are many specific non-human rights related reasons to en= crypt the firmware. I think that the WG is in the right direction on that. Encryption of the manifest is a complex question to me. My take is that the concern is that if a person is identifiable when they (= or rather, their personal network) asks questions like: ** Is there a new firmware for device type X? ** or receives notices li= ke: ** In order to do X, your device Y needs firmware at least Z ** (and this might be done by sending a manifest) When device type X is a medical device, or some other socially awkward devi= ce (a sex toy, a diaper, etc.) one can easily see why privacy is important.= As far as I understand, the process of asking questions like above, and/o= r receiving notices of new firmware available is explicitely out-of-scope t= oday. The problem that I see with encrypting manifests is that either it prevents= much of the supporting infrastructure from being useful (if it's well encr= ypted), or the encryption key is so well known as to be a joke. I suspect that much of the problem can and SHOULD be solved with transport = layer security around the transactions about updates. I think that the SUIT architecture should deal with this issue, and rule ma= nifest encryption out of scope, mentioning that the (out of scope) transpor= t protocol MUST provide transport encryption. -- Michael Richardson , Sandelman Software Works -=3D = IPv6 IoT consulting =3D- IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Sat Aug 4 10:50:51 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0BCF130DEF for ; Sat, 4 Aug 2018 10:50:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u-xzDmdH5k-j for ; Sat, 4 Aug 2018 10:50:46 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40057.outbound.protection.outlook.com [40.107.4.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AAB1130DC1 for ; Sat, 4 Aug 2018 10:50:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Tgs3QqyvaGjx1K9pWGW5s37zXHhru0JQRem3e3tW1Pc=; b=fj0X+s1JcALImWMaCEpKXDe50aJvEuUUeBTKWeWqqFG9BJ8TW1DMk8Dc9t7nbCMucLy7c/s12qoAaWf6L44uEsblyecsA0e3r5By4p/5TSslxaGD8ltQMlrMvKkFK3KPy7ekMHSdzb/p42oG9wKwpbu84bRnRO/5JYnvysUabGI= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB2718.eurprd08.prod.outlook.com (10.166.198.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1017.15; Sat, 4 Aug 2018 17:50:40 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::adfc:4f29:e0df:9e9f]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::adfc:4f29:e0df:9e9f%10]) with mapi id 15.20.1017.018; Sat, 4 Aug 2018 17:50:40 +0000 From: Hannes Tschofenig To: David Brown , "suit@ietf.org" Thread-Topic: [Suit] Parsing CDDL Thread-Index: AQHUKSJswQwmcEVzSE2RMJ4Z96bh36Sv5MCw Date: Sat, 4 Aug 2018 17:50:40 +0000 Message-ID: References: <20180731230118.GB18176@davidb.org> In-Reply-To: <20180731230118.GB18176@davidb.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [66.77.72.75] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB2718; 6:3pgVUM/Pxqbs4WJxuk5gLZOaRx9gK+p3OQ8zFJrgJWCvfWX37qNJ7DLZnA9ACemYwj8upe6znofrfuymJg5Ad+vt5AdvTWYzfe+bfGCpQlsZ9r8E/nI1LqiyhhSkjOnLx37yAdrWL0cf4gZ8W1jBlmLY1ULPBbp3SPzA8zOssAxqHVtlv3kJHCK44yHSp+XlPJY/RaMjkO1WfmX7MohBOwJ5xZPbLm+c33GRTFIZx9Xrz06IOe3KRv5CquhHXGQUP/kmg9Sz9RumGQAhV+cDTu4NunKgEicRBKln9S+xvLuTYEzC6/fDPCeEvuTpqLgd64UaDCqF7kY5ErYNfIekHRYJhWgd1RJ859mAqPe77q+6rjv6AB/ar8Iu48L4T80ouw300dl0/IChmICuOdV/sPGMlMAHrAkx/99qIfjFN/FWmW8KCvpUDUyT62on4Xc2AZOdu61qi7HU6X7Q0Yi/9A==; 5:mg27DWGokdb8vL51kScq27mV/g1hpPqqkCJKd8HqsDAXT7PcBTQrZAxPBzsRV/zM92alLupcz5hBT7CHcG2LnrOS7ixm2I4i22b6gVzB8QdjyGMFFHRBDQrz+vSrDv/T/4bxeAhdbG/COUnzuRmlCuS+3rg0W1554+0fARvRi6Y=; 7:UbG9ZfeU9lfPKxqwiR2GvSQbkxOoyOYIDno8byO64Q6rZ8VDAblEQwcAsBqwWepqwAHR8gJYMZQ8CbXJt5gzRqfnLYr/iZACQPhv+X5+EzntOUQDtYf7Db/qzLf1iQnV1N9lz6ZNNjePyXjNGXrAmNsPF5yleKzm3huKZUpR4+1yuVzi1B2tl1iuQDj8ZLEhzGJsRHKRNyjjPKBC04+i/z8Atf4Cyps/akGY9FBB07q6yQEYQR5yOJLLMDOKwp0f x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 7085859a-d68c-44f7-1449-08d5fa32cb38 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB2718; x-ms-traffictypediagnostic: VI1PR0801MB2718: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820)(223705240517415); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3231311)(944501410)(52105095)(3002001)(93006095)(93001095)(10201501046)(6055026)(149027)(150027)(6041310)(20161123562045)(20161123564045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB2718; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB2718; x-forefront-prvs: 0754F7E325 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(396003)(366004)(39860400002)(136003)(40434004)(189003)(199004)(13464003)(74316002)(5660300001)(14454004)(110136005)(316002)(53936002)(9686003)(55016002)(7736002)(33656002)(6306002)(229853002)(25786009)(97736004)(305945005)(106356001)(6246003)(6436002)(446003)(105586002)(2900100001)(486006)(256004)(476003)(5250100002)(2501003)(8676002)(14444005)(5024004)(66066001)(81166006)(81156014)(8936002)(2906002)(966005)(86362001)(6116002)(26005)(478600001)(68736007)(6506007)(186003)(102836004)(99286004)(53546011)(72206003)(3846002)(11346002)(76176011)(7696005); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB2718; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: jwqZY9PTQ7aCwHtWJC59YrZ01ket1aticJNYND6/SDGSZeRjgDS82h5pFh0YcCagxzwQ97FVqQ7BbboKUtjymhhVXNV7y64C9hDM0qrCB+Uv0vPybY6cRRMYeHR/Klzv1UlUlNa/0DANNTJcVuvZbNEFchbCC64Uq90rnRl2IWsKGbjEIWHbs7g5waKMCtmzexqb3BbQjpxLGD3Xg2rgEBzZbdbyNfkSOGkw2JGGmEJhoh4L2EqXazFKEgqAdrhJHXJquG1XG0mAXEHoEoqQiWpmzV0tF06jmmYkOAHdgautakB6N9rr3VqCxdOtMEYceyNWxVKgHtahMW+lmLdF9KoERdznUUMhgfCEE2W/Trs= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7085859a-d68c-44f7-1449-08d5fa32cb38 X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Aug 2018 17:50:40.6311 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB2718 Archived-At: Subject: Re: [Suit] Parsing CDDL X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Aug 2018 17:50:50 -0000 Hi David, Out of curiosity why did you write a CDDL parser? I would have expected tha= t you would instead work on a small CBOR parser for use with bootloader. Ciao Hannes -----Original Message----- From: Suit [mailto:suit-bounces@ietf.org] On Behalf Of David Brown Sent: 31 July 2018 16:01 To: suit@ietf.org Subject: [Suit] Parsing CDDL (I posted this to the IETF CBOR mailing list, and replies related to CBOR/CDDL should be there. I am posting this to the SUIT mailing list because of our interest in CDDL, and that we discovered one of the ambiguities in the CDDL draft) ----- Forwarded message from David Brown ----- Date: Tue, 31 Jul 2018 16:58:54 -0600 From: David Brown To: cbor@ietf.org Subject: Parsing CDDL I have written up a small (220 line) parser based on the draft-ietf-cbor-cddl-03 document. The code can be found at https://github.com/d3zd3z/suit-play/blob/master/cddl.rkt. I used the Racket lexer and parser tools to make this easier. I believe this parser parses (nearly) the same language described in the ABNF grammar in the draft (see below about spaces). However, a couple of observations: - in the rule for 'rule', since a 'type' by itself is a valid 'grpent', this rule is ambiguous. I made the parser work by simply commenting out the first alternate. I would gather that a tool using the output of this parser would have to store all entities, and check that a name used elsewhere as a type must be restricted to the 'type' form. - Spaces are a little complicated, and I'm not sure quite as intended. One production (for #6(...)) has a comment "note no space", however there are a few other places that are missing spaces (such as the space after the open paren on the "(" type ")" alternate. I found this much easier to handle by consuming spaces in the lexer and not making them part of the grammar at all. In order to do this, three things: "#" "6" ["." uint] "(" S type S ")" "#" DIGIT ["." uint] [uint] "*" [uint] must be captured by the lexer, since these production would make the grammar ambiguous unless the space is not allowed. I assume the intent is to interpret these with "maximal munch" (mostly thanks to the comma being optional). I also capture the repetition operation with numbers at lex time to avoid additional ambiguity. - The ABNF grammar references code points such as %x5D-10FFFD. Is it intentional to include the invalid range D800-DFFF, which are reserved for surrogate pairs in UTF-16? They are not considered valid codepoints for UTF-8, and depending on the tools/language used, may be rejected before codepoints are given to the parser. - The text of the draft states that hexidecimal numbers "... are case insensitive", however the ABNF grammar only accepts hexidecimal digits in uppercase. - There are productions allowed by the grammar whose meaning is not described by the text of the draft. For example: item =3D [ int =3D> bstr ] is valid with the grammar, but it is unclear what this means. Perhaps this could describe an ordered map, or an array of pairs of items. Related are arrays that contain more than a single item: item =3D [ int, bstr, 5 ] - What is the intended interpretation of: groupname =3D (a b // c d) My parser interprets this as ((a b) // (c d)), however (a (b // c) d) is also a valid interpretation, an probably what is intended, especially if commas are used (a, b // c, d). - Related to the above, the grammar allows things like like grp =3D (// //) is this intentional? With some work, I believe it would be possible to transform this grammar into something LALR(1) (my grammar is part way there), but it would make some of the productions difficult to read. However, it may be a useful exercise because it would force any other ambiguities in the grammar. I wrote this starting with a LALR(1) parser, and wrote as much as I could without any shift/reduce conflicts, and reverted to a general backtracking parser near the end. The LALR(1) parser is significantly easier to debug, and tends to produce better error messages. David Brown ----- End forwarded message ----- _______________________________________________ Suit mailing list Suit@ietf.org https://www.ietf.org/mailman/listinfo/suit IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Sat Aug 4 11:37:49 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D7F5130DF1 for ; Sat, 4 Aug 2018 11:37:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id An-2sk1M-23C for ; Sat, 4 Aug 2018 11:37:45 -0700 (PDT) Received: from mailhost.informatik.uni-bremen.de (mailhost.informatik.uni-bremen.de [IPv6:2001:638:708:30c9::12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D02951274D0 for ; Sat, 4 Aug 2018 11:37:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at informatik.uni-bremen.de Received: from submithost.informatik.uni-bremen.de (submithost.informatik.uni-bremen.de [134.102.201.11]) by mailhost.informatik.uni-bremen.de (8.14.5/8.14.5) with ESMTP id w74Ibcqd028815; Sat, 4 Aug 2018 20:37:38 +0200 (CEST) Received: from [192.168.4.254] (b2b-78-94-84-234.unitymedia.biz [78.94.84.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by submithost.informatik.uni-bremen.de (Postfix) with ESMTPSA id 41jXhf21J3zDWSm; Sat, 4 Aug 2018 20:37:38 +0200 (CEST) Content-Type: multipart/alternative; boundary=Apple-Mail-5AD8F35C-31F2-4C5A-A6AE-CE5F37CF3D55 Mime-Version: 1.0 (1.0) From: Carsten Bormann X-Mailer: iPhone Mail (15G77) In-Reply-To: Date: Sat, 4 Aug 2018 20:37:37 +0200 Cc: David Brown , "suit@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: <57DE5FB4-EB58-4393-8F38-4119D90354BE@tzi.org> References: <20180731230118.GB18176@davidb.org> To: Hannes Tschofenig Archived-At: Subject: Re: [Suit] Parsing CDDL X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Aug 2018 18:37:49 -0000 --Apple-Mail-5AD8F35C-31F2-4C5A-A6AE-CE5F37CF3D55 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Hi Hannes,=20 A generic CBOR parser is a useful component for a bootloader. However, might= also translate CDDL into code that directly (maybe via a few library routin= es) consumes the binary CBOR. Sent from mobile > On 4. Aug 2018, at 19:50, Hannes Tschofenig wr= ote: >=20 > Hi David, >=20 > Out of curiosity why did you write a CDDL parser? I would have expected th= at you would instead work on a small CBOR parser for use with bootloader. >=20 > Ciao > Hannes >=20 > -----Original Message----- > From: Suit [mailto:suit-bounces@ietf.org] On Behalf Of David Brown > Sent: 31 July 2018 16:01 > To: suit@ietf.org > Subject: [Suit] Parsing CDDL >=20 > (I posted this to the IETF CBOR mailing list, and replies related to > CBOR/CDDL should be there. I am posting this to the SUIT mailing list > because of our interest in CDDL, and that we discovered one of the > ambiguities in the CDDL draft) >=20 > ----- Forwarded message from David Brown ----- >=20 > Date: Tue, 31 Jul 2018 16:58:54 -0600 > From: David Brown > To: cbor@ietf.org > Subject: Parsing CDDL >=20 > I have written up a small (220 line) parser based on the > draft-ietf-cbor-cddl-03 document. The code can be found at > https://github.com/d3zd3z/suit-play/blob/master/cddl.rkt. I used the > Racket lexer and parser tools to make this easier. >=20 > I believe this parser parses (nearly) the same language described in > the ABNF grammar in the draft (see below about spaces). However, a > couple of observations: >=20 > - in the rule for 'rule', since a 'type' by itself is a valid > 'grpent', this rule is ambiguous. I made the parser work by > simply commenting out the first alternate. I would gather that a > tool using the output of this parser would have to store all > entities, and check that a name used elsewhere as a type must be > restricted to the 'type' form. >=20 > - Spaces are a little complicated, and I'm not sure quite as > intended. One production (for #6(...)) has a comment "note no > space", however there are a few other places that are missing > spaces (such as the space after the open paren on the >=20 > "(" type ")" >=20 > alternate. I found this much easier to handle by consuming spaces > in the lexer and not making them part of the grammar at all. In > order to do this, three things: >=20 > "#" "6" ["." uint] "(" S type S ")" > "#" DIGIT ["." uint] >=20 > [uint] "*" [uint] >=20 > must be captured by the lexer, since these production would make > the grammar ambiguous unless the space is not allowed. I assume > the intent is to interpret these with "maximal munch" (mostly > thanks to the comma being optional). >=20 > I also capture the repetition operation with numbers at lex time > to avoid additional ambiguity. >=20 > - The ABNF grammar references code points such as %x5D-10FFFD. Is > it intentional to include the invalid range D800-DFFF, which are > reserved for surrogate pairs in UTF-16? They are not considered > valid codepoints for UTF-8, and depending on the tools/language > used, may be rejected before codepoints are given to the parser. >=20 > - The text of the draft states that hexidecimal numbers "... are > case insensitive", however the ABNF grammar only accepts > hexidecimal digits in uppercase. >=20 > - There are productions allowed by the grammar whose meaning is not > described by the text of the draft. For example: >=20 > item =3D [ int =3D> bstr ] >=20 > is valid with the grammar, but it is unclear what this means. > Perhaps this could describe an ordered map, or an array of pairs > of items. Related are arrays that contain more than a single > item: >=20 > item =3D [ int, bstr, 5 ] >=20 > - What is the intended interpretation of: >=20 > groupname =3D (a b // c d) >=20 > My parser interprets this as ((a b) // (c d)), however > (a (b // c) d) is also a valid interpretation, an probably what is > intended, especially if commas are used (a, b // c, d). >=20 > - Related to the above, the grammar allows things like like >=20 > grp =3D (// //) >=20 > is this intentional? >=20 > With some work, I believe it would be possible to transform this > grammar into something LALR(1) (my grammar is part way there), but it > would make some of the productions difficult to read. However, it may > be a useful exercise because it would force any other ambiguities in > the grammar. >=20 > I wrote this starting with a LALR(1) parser, and wrote as much as I > could without any shift/reduce conflicts, and reverted to a general > backtracking parser near the end. The LALR(1) parser is significantly > easier to debug, and tends to produce better error messages. >=20 > David Brown >=20 > ----- End forwarded message ----- >=20 > _______________________________________________ > Suit mailing list > Suit@ietf.org > https://www.ietf.org/mailman/listinfo/suit > IMPORTANT NOTICE: The contents of this email and any attachments are confi= dential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any o= ther person, use it for any purpose, or store or copy the information in any= medium. Thank you. >=20 > _______________________________________________ > Suit mailing list > Suit@ietf.org > https://www.ietf.org/mailman/listinfo/suit >=20 --Apple-Mail-5AD8F35C-31F2-4C5A-A6AE-CE5F37CF3D55 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Hannes, 

A gener= ic CBOR parser is a useful component for a bootloader. However, might also t= ranslate CDDL into code that directly (maybe via a few library routines) con= sumes the binary CBOR.

Sent from = mobile

On 4. Aug 2018,= at 19:50, Hannes Tschofenig <Hannes.Tschofenig@arm.com> wrote:

Hi David,

Out of curiosity= why did you write a CDDL parser? I would have expected that you would inste= ad work on a small CBOR parser for use with bootloader.

Ciao
Hannes

--= ---Original Message-----
From: Suit [mailto:suit-bounces@ietf.org] On Behalf Of David Brown=
Sent: 31 July 2018 16:01
To: suit@ietf.org
Subject: [Suit] Parsing= CDDL

(I posted this to the IETF CBOR maili= ng list, and replies related to
CBOR/CDDL should be there. &= nbsp;I am posting this to the SUIT mailing list
because of o= ur interest in CDDL, and that we discovered one of the
ambig= uities in the CDDL draft)

----- Forwarded m= essage from David Brown <david.= brown@linaro.org> -----

Date: Tue, 3= 1 Jul 2018 16:58:54 -0600
From: David Brown <david.brown@linaro.org>
To: cbor@ietf.org
Subj= ect: Parsing CDDL

I have written up a small= (220 line) parser based on the
draft-ietf-cbor-cddl-03 docu= ment.  The code can be found at
https://github.com/d3zd3z/suit= -play/blob/master/cddl.rkt.  I used the
Racket lexe= r and parser tools to make this easier.

I b= elieve this parser parses (nearly) the same language described in
= the ABNF grammar in the draft (see below about spaces).  However,= a
couple of observations:

= - in the rule for 'rule', since a 'type' by itself is a valid
  'grpent', this rule is ambiguous.  I made the parser wo= rk by
  simply commenting out the first alternate= .  I would gather that a
  tool using the ou= tput of this parser would have to store all
  ent= ities, and check that a name used elsewhere as a type must be
  restricted to the 'type' form.

- Spaces are a little complicated, and I'm not sure quite as
<= span>   intended.  One production (for #6(...)) has a comment= "note no
  space", however there are a few other= places that are missing
  spaces (such as the sp= ace after the open paren on the

 &nbs= p;   "(" type ")"

 &nb= sp;alternate.  I found this much easier to handle by consuming spaces
  in the lexer and not making them part of the gra= mmar at all.  In
  order to do this, three t= hings:

     "#" "= 6" ["." uint] "(" S type S ")"
    &nbs= p;"#" DIGIT ["." uint]

   &= nbsp; [uint] "*" [uint]

  m= ust be captured by the lexer, since these production would make
  the grammar ambiguous unless the space is not allowed. &nbs= p;I assume
  the intent is to interpret these wit= h "maximal munch" (mostly
  thanks to the comma b= eing optional).

  I also capture= the repetition operation with numbers at lex time
 &n= bsp;to avoid additional ambiguity.

- The A= BNF grammar references code points such as %x5D-10FFFD.  Is
<= span>   it intentional to include the invalid range D800-DFFF, whi= ch are
  reserved for surrogate pairs in UTF-16? &= nbsp;They are not considered
  valid codepoints f= or UTF-8, and depending on the tools/language
  u= sed, may be rejected before codepoints are given to the parser.

- The text of the draft states that hexidecimal number= s "... are
  case insensitive", however the ABNF g= rammar only accepts
  hexidecimal digits in upper= case.

- There are productions allowed by t= he grammar whose meaning is not
  described by th= e text of the draft.  For example:

&n= bsp;    item =3D [ int =3D> bstr ]

  is valid with the grammar, but it is unclear wha= t this means.
  Perhaps this could describe an or= dered map, or an array of pairs
  of items.  = ;Related are arrays that contain more than a single
 &= nbsp;item:

     i= tem =3D [ int, bstr, 5 ]

- What is the int= ended interpretation of:

   = ;  groupname =3D (a b // c d)

&n= bsp; My parser interprets this as ((a b) // (c d)), however
<= span>   (a (b // c) d) is also a valid interpretation, an probably= what is
  intended, especially if commas are use= d  (a, b // c, d).

- Related to the a= bove, the grammar allows things like like

&= nbsp;    grp =3D (// //)

  is this intentional?

With so= me work, I believe it would be possible to transform this
gr= ammar into something LALR(1) (my grammar is part way there), but itwould make some of the productions difficult to read.  However,= it may
be a useful exercise because it would force any othe= r ambiguities in
the grammar.

I wrote this starting with a LALR(1) parser, and wrote as much as I
could without any shift/reduce conflicts, and reverted to a gener= al
backtracking parser near the end.  The LALR(1) parse= r is significantly
easier to debug, and tends to produce bet= ter error messages.

David Brown
<= span>
----- End forwarded message -----

_______________________________________________
Suit mailing list
Suit@iet= f.org
https://www.ietf.org/mailman/listinfo/suit
IMPORTAN= T NOTICE: The contents of this email and any attachments are confidential an= d may also be privileged. If you are not the intended recipient, please noti= fy the sender immediately and do not disclose the contents to any other pers= on, use it for any purpose, or store or copy the information in any medium. T= hank you.

_________________________________= ______________
Suit mailing list
Suit@ietf.org
https://www.ietf.org/mailman/listinfo/sui= t

= --Apple-Mail-5AD8F35C-31F2-4C5A-A6AE-CE5F37CF3D55-- From nobody Sat Aug 4 11:37:58 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07FFA1274D0 for ; Sat, 4 Aug 2018 11:37:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IgaCqvx5XZ-B for ; Sat, 4 Aug 2018 11:37:48 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0E22130DC5 for ; Sat, 4 Aug 2018 11:37:47 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 2478A20491; Sat, 4 Aug 2018 14:54:32 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 3566518A5; Sat, 4 Aug 2018 14:37:45 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 3342B1899; Sat, 4 Aug 2018 14:37:45 -0400 (EDT) From: Michael Richardson To: Hannes Tschofenig cc: David Brown , "suit\@ietf.org" In-Reply-To: References: <20180731230118.GB18176@davidb.org> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Suit] Parsing CDDL X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Aug 2018 18:37:50 -0000 --=-=-= Content-Type: text/plain Hannes Tschofenig wrote: > Out of curiosity why did you write a CDDL parser? I would have expected > that you would instead work on a small CBOR parser for use with > bootloader. I think that David just wanted to validate the CDDL. I took it to be more about about CDDL (as applied in the real world, such as SUIT), than it is about SUIT itself. > -----Original Message----- > From: Suit [mailto:suit-bounces@ietf.org] On Behalf Of David Brown > Sent: 31 July 2018 16:01 > To: suit@ietf.org > Subject: [Suit] Parsing CDDL > (I posted this to the IETF CBOR mailing list, and replies related to > CBOR/CDDL should be there. I am posting this to the SUIT mailing list > because of our interest in CDDL, and that we discovered one of the > ambiguities in the CDDL draft) > ------- Forwarded Message > Date: Tue, 31 Jul 2018 16:58:54 -0600 > From: David Brown > To: cbor@ietf.org > Subject: Parsing CDDL > I have written up a small (220 line) parser based on the > draft-ietf-cbor-cddl-03 document. The code can be found at > https://github.com/d3zd3z/suit-play/blob/master/cddl.rkt. I used the > Racket lexer and parser tools to make this easier. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAltl8ngACgkQgItw+93Q 3WU8Lgf7BEOkEKFPFcyplw29ViTOqjg0u4Yh346sKSm40nQ6CSh1KFt3ye6b7coA 7ZDtgThv5WVvotQ6/VlHuIVC+Cqi6I3lnG04TtI3vXNCtbpuQXsWw2cMpu44l+wR fSkEjC8IyjTWRqDc7apv7RgF+7rHW5dc2G14zSa3FS3INiz0FFh112bWPzNzGs0E 5qad/KNvtQyz31NzFZfr0F4vJ5jaT6wRg3bOiiXyUcfjyD4VW7RYaTelTnYYwhrV lnq+GLJf3MWGlsSx5OM2Cxa25o5oLAhIUgpJR+9EBW4TpNIhRaLp0YPO5NvMdyBL kOsDf4GgQt+5mobmJF658lZdIrWv8Q== =Rm2Y -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Aug 15 12:56:15 2018 Return-Path: X-Original-To: suit@ietf.org Delivered-To: suit@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 283FC1274D0; Wed, 15 Aug 2018 12:56:14 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: housley@vigilsec.com, suit-chairs@ietf.org, suit@ietf.org, ekr@rtfm.com X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153436297415.3176.4687642555247513867.idtracker@ietfa.amsl.com> Date: Wed, 15 Aug 2018 12:56:14 -0700 Archived-At: Subject: [Suit] suit - New Meeting Session Request for IETF 103 X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Aug 2018 19:56:14 -0000 A new meeting session request has just been submitted by Russ Housley, a Chair of the suit working group. --------------------------------------------------------- Working Group Name: Software Updates for Internet of Things Area Name: Security Area Session Requester: Russ Housley Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 100 Conflicts to Avoid: First Priority: ipwave lamps stir ipsecme tls sipbrandy curdle sacm mile teep core ace saag Second Priority: t2trg lwig 6lo cfrg acme perc cbor Third Priority: v6ops 6man intarea People who must be present: Russ Housley Eric Rescorla Dave Thaler Hannes Tschofenig David Waltermire Resources Requested: Special Requests: --------------------------------------------------------- From nobody Thu Aug 16 07:20:27 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DF36130F5C for ; Thu, 16 Aug 2018 07:20:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.021 X-Spam-Level: X-Spam-Status: No, score=-1.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.979, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nordicsemi.no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hXBc0PdxaOWq for ; Thu, 16 Aug 2018 07:20:13 -0700 (PDT) Received: from ironport02.nordicsemi.no (mx02.nordicsemi.no [194.19.86.151]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A768130FF1 for ; Thu, 16 Aug 2018 07:20:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nordicsemi.no; l=24477; s=default; t=1534429212; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=QnSUwY0VYex1P1z927YG4KddyDtf+gVe5wPh/DrSRUM=; b=ZyNtw7mEUrwHDwvdn952f1RmU6ByPVpMWZ/q9HB+96mKpgHET9j2bxPR +zTU0wWusLQMnvJTY+rVKyAEsexhCYgBer0hFyAYEyAu4ylR6eTjiYtVd po+eoaoQXGUcYkeHALvAEsqC7YSKeymuktPJYSb6gFmWV65pGyVt/f6WM M=; X-IronPort-AV: E=Sophos;i="5.53,247,1531778400"; d="scan'208,217";a="4861285" From: =?utf-8?B?UsO4bm5pbmdzdGFkLCDDmHl2aW5k?= To: Carsten Bormann , Hannes Tschofenig , David Brown CC: "suit@ietf.org" Thread-Topic: [Suit] Parsing CDDL Thread-Index: AQHUKSJx6DtUqCOV9EqcQcmFYB/FoKSvw4QAgAANHoCAESnxAA== Date: Thu, 16 Aug 2018 14:20:07 +0000 Message-ID: <13a615c302b04c77b8728418a0f15f18@nordicsemi.no> References: <20180731230118.GB18176@davidb.org> <57DE5FB4-EB58-4393-8F38-4119D90354BE@tzi.org> In-Reply-To: <57DE5FB4-EB58-4393-8F38-4119D90354BE@tzi.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [192.9.200.83] Content-Type: multipart/alternative; boundary="_000_13a615c302b04c77b8728418a0f15f18nordicsemino_" MIME-Version: 1.0 Archived-At: Subject: Re: [Suit] Parsing CDDL X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Aug 2018 14:20:22 -0000 --_000_13a615c302b04c77b8728418a0f15f18nordicsemino_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhpcyBpcyBncmVhdCwgRGF2aWQsIHRob3VnaCBJ4oCZbSBub3QgYXQgYWxsIGZhbWlsaWFyIHdp dGggUmFja2V0LCBzbyBJIGNhbuKAmXQgcmVhbGx5IGNvbW1lbnQuDQoNCknigJltIGhvcGluZyBt YW5pZmVzdCBwYXJzaW5nIGNhbiBiZSBzb2x2ZWQgYnkgYSBoYXZpbmcgYSBwYXJzZXItZ2VuZXJh dG9yIGdlbmVyYXRlLCBkaXJlY3RseSBmcm9tIENEREwsIGNvZGUgdGhhdCBwYXJzZXMgYW5kIHZh bGlkYXRlcyBDQk9SIGRhdGEuIFRoZSB3b3JrZmxvdyBJIGVudmlzaW9uIGlzOiBUaGVyZSBpcyBh IGNhbm9uaWNhbCBDRERMICh0aGUgUkZDKSB0aGF0IGlzIHBhcnNlZCB0byBwcm9kdWNlIGNvZGUg dGhhdCBwbHVncyBpbnRvIHRoZSByZXN0IG9mIHRoZSBTVUlUIGltcGxlbWVudGF0aW9uLiBUaGUg dXNlciBjYW4gY2hvb3NlIHRvIGVkaXQgdGhlIENEREwgKHByZWZlcmFibHkgdG8gcmVwcmVzZW50 IGEgc3Vic2V0IG9mIHRoZSBvcmlnaW5hbCksIGFzIGEgc2ltcGxlIHdheSB0byByZXN0cmljdCB0 aGVpciBmZWF0dXJlLXNldC4gSeKAmW0gaG9wZWZ1bCB0aGF0IHRoZSBpbnRlcmZhY2UgYmV0d2Vl biB0aGUgZ2VuZXJhdGVkIGNvZGUgYW5kIHRoZSBjb2RlIHRoYXQgdXNlcyBpdCBjYW4gYmUgbWFk ZSBmbGV4aWJsZSB0byBzdWNoIGNoYW5nZXMgaW4gdGhlIENEREwuDQoNCsOYeXZpbmQNCg0KRnJv bTogU3VpdCBbbWFpbHRvOnN1aXQtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIENhcnN0 ZW4gQm9ybWFubg0KU2VudDogNC4gYXVndXN0IDIwMTggMjA6MzgNClRvOiBIYW5uZXMgVHNjaG9m ZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbT4NCkNjOiBEYXZpZCBCcm93biA8ZGF2aWQu YnJvd25AbGluYXJvLm9yZz47IHN1aXRAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbU3VpdF0gUGFy c2luZyBDRERMDQoNCkhpIEhhbm5lcywNCg0KQSBnZW5lcmljIENCT1IgcGFyc2VyIGlzIGEgdXNl ZnVsIGNvbXBvbmVudCBmb3IgYSBib290bG9hZGVyLiBIb3dldmVyLCBtaWdodCBhbHNvIHRyYW5z bGF0ZSBDRERMIGludG8gY29kZSB0aGF0IGRpcmVjdGx5IChtYXliZSB2aWEgYSBmZXcgbGlicmFy eSByb3V0aW5lcykgY29uc3VtZXMgdGhlIGJpbmFyeSBDQk9SLg0KU2VudCBmcm9tIG1vYmlsZQ0K DQpPbiA0LiBBdWcgMjAxOCwgYXQgMTk6NTAsIEhhbm5lcyBUc2Nob2ZlbmlnIDxIYW5uZXMuVHNj aG9mZW5pZ0Bhcm0uY29tPG1haWx0bzpIYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tPj4gd3JvdGU6 DQpIaSBEYXZpZCwNCg0KT3V0IG9mIGN1cmlvc2l0eSB3aHkgZGlkIHlvdSB3cml0ZSBhIENEREwg cGFyc2VyPyBJIHdvdWxkIGhhdmUgZXhwZWN0ZWQgdGhhdCB5b3Ugd291bGQgaW5zdGVhZCB3b3Jr IG9uIGEgc21hbGwgQ0JPUiBwYXJzZXIgZm9yIHVzZSB3aXRoIGJvb3Rsb2FkZXIuDQoNCkNpYW8N Ckhhbm5lcw0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogU3VpdCBbbWFpbHRv OnN1aXQtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIERhdmlkIEJyb3duDQpTZW50OiAz MSBKdWx5IDIwMTggMTY6MDENClRvOiBzdWl0QGlldGYub3JnPG1haWx0bzpzdWl0QGlldGYub3Jn Pg0KU3ViamVjdDogW1N1aXRdIFBhcnNpbmcgQ0RETA0KDQooSSBwb3N0ZWQgdGhpcyB0byB0aGUg SUVURiBDQk9SIG1haWxpbmcgbGlzdCwgYW5kIHJlcGxpZXMgcmVsYXRlZCB0bw0KQ0JPUi9DRERM IHNob3VsZCBiZSB0aGVyZS4gIEkgYW0gcG9zdGluZyB0aGlzIHRvIHRoZSBTVUlUIG1haWxpbmcg bGlzdA0KYmVjYXVzZSBvZiBvdXIgaW50ZXJlc3QgaW4gQ0RETCwgYW5kIHRoYXQgd2UgZGlzY292 ZXJlZCBvbmUgb2YgdGhlDQphbWJpZ3VpdGllcyBpbiB0aGUgQ0RETCBkcmFmdCkNCg0KLS0tLS0g Rm9yd2FyZGVkIG1lc3NhZ2UgZnJvbSBEYXZpZCBCcm93biA8ZGF2aWQuYnJvd25AbGluYXJvLm9y ZzxtYWlsdG86ZGF2aWQuYnJvd25AbGluYXJvLm9yZz4+IC0tLS0tDQoNCkRhdGU6IFR1ZSwgMzEg SnVsIDIwMTggMTY6NTg6NTQgLTA2MDANCkZyb206IERhdmlkIEJyb3duIDxkYXZpZC5icm93bkBs aW5hcm8ub3JnPG1haWx0bzpkYXZpZC5icm93bkBsaW5hcm8ub3JnPj4NClRvOiBjYm9yQGlldGYu b3JnPG1haWx0bzpjYm9yQGlldGYub3JnPg0KU3ViamVjdDogUGFyc2luZyBDRERMDQoNCkkgaGF2 ZSB3cml0dGVuIHVwIGEgc21hbGwgKDIyMCBsaW5lKSBwYXJzZXIgYmFzZWQgb24gdGhlDQpkcmFm dC1pZXRmLWNib3ItY2RkbC0wMyBkb2N1bWVudC4gIFRoZSBjb2RlIGNhbiBiZSBmb3VuZCBhdA0K aHR0cHM6Ly9naXRodWIuY29tL2QzemQzei9zdWl0LXBsYXkvYmxvYi9tYXN0ZXIvY2RkbC5ya3Qu ICBJIHVzZWQgdGhlDQpSYWNrZXQgbGV4ZXIgYW5kIHBhcnNlciB0b29scyB0byBtYWtlIHRoaXMg ZWFzaWVyLg0KDQpJIGJlbGlldmUgdGhpcyBwYXJzZXIgcGFyc2VzIChuZWFybHkpIHRoZSBzYW1l IGxhbmd1YWdlIGRlc2NyaWJlZCBpbg0KdGhlIEFCTkYgZ3JhbW1hciBpbiB0aGUgZHJhZnQgKHNl ZSBiZWxvdyBhYm91dCBzcGFjZXMpLiAgSG93ZXZlciwgYQ0KY291cGxlIG9mIG9ic2VydmF0aW9u czoNCg0KLSBpbiB0aGUgcnVsZSBmb3IgJ3J1bGUnLCBzaW5jZSBhICd0eXBlJyBieSBpdHNlbGYg aXMgYSB2YWxpZA0KICAnZ3JwZW50JywgdGhpcyBydWxlIGlzIGFtYmlndW91cy4gIEkgbWFkZSB0 aGUgcGFyc2VyIHdvcmsgYnkNCiAgc2ltcGx5IGNvbW1lbnRpbmcgb3V0IHRoZSBmaXJzdCBhbHRl cm5hdGUuLiAgSSB3b3VsZCBnYXRoZXIgdGhhdCBhDQogIHRvb2wgdXNpbmcgdGhlIG91dHB1dCBv ZiB0aGlzIHBhcnNlciB3b3VsZCBoYXZlIHRvIHN0b3JlIGFsbA0KICBlbnRpdGllcywgYW5kIGNo ZWNrIHRoYXQgYSBuYW1lIHVzZWQgZWxzZXdoZXJlIGFzIGEgdHlwZSBtdXN0IGJlDQogIHJlc3Ry aWN0ZWQgdG8gdGhlICd0eXBlJyBmb3JtLg0KDQotIFNwYWNlcyBhcmUgYSBsaXR0bGUgY29tcGxp Y2F0ZWQsIGFuZCBJJ20gbm90IHN1cmUgcXVpdGUgYXMNCiAgaW50ZW5kZWQuICBPbmUgcHJvZHVj dGlvbiAoZm9yICM2KC4uLikpIGhhcyBhIGNvbW1lbnQgIm5vdGUgbm8NCiAgc3BhY2UiLCBob3dl dmVyIHRoZXJlIGFyZSBhIGZldyBvdGhlciBwbGFjZXMgdGhhdCBhcmUgbWlzc2luZw0KICBzcGFj ZXMgKHN1Y2ggYXMgdGhlIHNwYWNlIGFmdGVyIHRoZSBvcGVuIHBhcmVuIG9uIHRoZQ0KDQogICAg ICIoIiB0eXBlICIpIg0KDQogIGFsdGVybmF0ZS4gIEkgZm91bmQgdGhpcyBtdWNoIGVhc2llciB0 byBoYW5kbGUgYnkgY29uc3VtaW5nIHNwYWNlcw0KICBpbiB0aGUgbGV4ZXIgYW5kIG5vdCBtYWtp bmcgdGhlbSBwYXJ0IG9mIHRoZSBncmFtbWFyIGF0IGFsbC4gIEluDQogIG9yZGVyIHRvIGRvIHRo aXMsIHRocmVlIHRoaW5nczoNCg0KICAgICAiIyIgIjYiIFsiLiIgdWludF0gIigiIFMgdHlwZSBT ICIpIg0KICAgICAiIyIgRElHSVQgWyIuIiB1aW50XQ0KDQogICAgIFt1aW50XSAiKiIgW3VpbnRd DQoNCiAgbXVzdCBiZSBjYXB0dXJlZCBieSB0aGUgbGV4ZXIsIHNpbmNlIHRoZXNlIHByb2R1Y3Rp b24gd291bGQgbWFrZQ0KICB0aGUgZ3JhbW1hciBhbWJpZ3VvdXMgdW5sZXNzIHRoZSBzcGFjZSBp cyBub3QgYWxsb3dlZC4gIEkgYXNzdW1lDQogIHRoZSBpbnRlbnQgaXMgdG8gaW50ZXJwcmV0IHRo ZXNlIHdpdGggIm1heGltYWwgbXVuY2giIChtb3N0bHkNCiAgdGhhbmtzIHRvIHRoZSBjb21tYSBi ZWluZyBvcHRpb25hbCkuDQoNCiAgSSBhbHNvIGNhcHR1cmUgdGhlIHJlcGV0aXRpb24gb3BlcmF0 aW9uIHdpdGggbnVtYmVycyBhdCBsZXggdGltZQ0KICB0byBhdm9pZCBhZGRpdGlvbmFsIGFtYmln dWl0eS4NCg0KLSBUaGUgQUJORiBncmFtbWFyIHJlZmVyZW5jZXMgY29kZSBwb2ludHMgc3VjaCBh cyAleDVELTEwRkZGRC4gIElzDQogIGl0IGludGVudGlvbmFsIHRvIGluY2x1ZGUgdGhlIGludmFs aWQgcmFuZ2UgRDgwMC1ERkZGLCB3aGljaCBhcmUNCiAgcmVzZXJ2ZWQgZm9yIHN1cnJvZ2F0ZSBw YWlycyBpbiBVVEYtMTY/ICBUaGV5IGFyZSBub3QgY29uc2lkZXJlZA0KICB2YWxpZCBjb2RlcG9p bnRzIGZvciBVVEYtOCwgYW5kIGRlcGVuZGluZyBvbiB0aGUgdG9vbHMvbGFuZ3VhZ2UNCiAgdXNl ZCwgbWF5IGJlIHJlamVjdGVkIGJlZm9yZSBjb2RlcG9pbnRzIGFyZSBnaXZlbiB0byB0aGUgcGFy c2VyLg0KDQotIFRoZSB0ZXh0IG9mIHRoZSBkcmFmdCBzdGF0ZXMgdGhhdCBoZXhpZGVjaW1hbCBu dW1iZXJzICIuLi4gYXJlDQogIGNhc2UgaW5zZW5zaXRpdmUiLCBob3dldmVyIHRoZSBBQk5GIGdy YW1tYXIgb25seSBhY2NlcHRzDQogIGhleGlkZWNpbWFsIGRpZ2l0cyBpbiB1cHBlcmNhc2UuDQoN Ci0gVGhlcmUgYXJlIHByb2R1Y3Rpb25zIGFsbG93ZWQgYnkgdGhlIGdyYW1tYXIgd2hvc2UgbWVh bmluZyBpcyBub3QNCiAgZGVzY3JpYmVkIGJ5IHRoZSB0ZXh0IG9mIHRoZSBkcmFmdC4gIEZvciBl eGFtcGxlOg0KDQogICAgIGl0ZW0gPSBbIGludCA9PiBic3RyIF0NCg0KICBpcyB2YWxpZCB3aXRo IHRoZSBncmFtbWFyLCBidXQgaXQgaXMgdW5jbGVhciB3aGF0IHRoaXMgbWVhbnMuDQogIFBlcmhh cHMgdGhpcyBjb3VsZCBkZXNjcmliZSBhbiBvcmRlcmVkIG1hcCwgb3IgYW4gYXJyYXkgb2YgcGFp cnMNCiAgb2YgaXRlbXMuICBSZWxhdGVkIGFyZSBhcnJheXMgdGhhdCBjb250YWluIG1vcmUgdGhh biBhIHNpbmdsZQ0KICBpdGVtOg0KDQogICAgIGl0ZW0gPSBbIGludCwgYnN0ciwgNSBdDQoNCi0g V2hhdCBpcyB0aGUgaW50ZW5kZWQgaW50ZXJwcmV0YXRpb24gb2Y6DQoNCiAgICAgZ3JvdXBuYW1l ID0gKGEgYiAvLyBjIGQpDQoNCiAgTXkgcGFyc2VyIGludGVycHJldHMgdGhpcyBhcyAoKGEgYikg Ly8gKGMgZCkpLCBob3dldmVyDQogIChhIChiIC8vIGMpIGQpIGlzIGFsc28gYSB2YWxpZCBpbnRl cnByZXRhdGlvbiwgYW4gcHJvYmFibHkgd2hhdCBpcw0KICBpbnRlbmRlZCwgZXNwZWNpYWxseSBp ZiBjb21tYXMgYXJlIHVzZWQgIChhLCBiIC8vIGMsIGQpLg0KDQotIFJlbGF0ZWQgdG8gdGhlIGFi b3ZlLCB0aGUgZ3JhbW1hciBhbGxvd3MgdGhpbmdzIGxpa2UgbGlrZQ0KDQogICAgIGdycCA9ICgv LyAvLykNCg0KICBpcyB0aGlzIGludGVudGlvbmFsPw0KDQpXaXRoIHNvbWUgd29yaywgSSBiZWxp ZXZlIGl0IHdvdWxkIGJlIHBvc3NpYmxlIHRvIHRyYW5zZm9ybSB0aGlzDQpncmFtbWFyIGludG8g c29tZXRoaW5nIExBTFIoMSkgKG15IGdyYW1tYXIgaXMgcGFydCB3YXkgdGhlcmUpLCBidXQgaXQN CndvdWxkIG1ha2Ugc29tZSBvZiB0aGUgcHJvZHVjdGlvbnMgZGlmZmljdWx0IHRvIHJlYWQuICBI b3dldmVyLCBpdCBtYXkNCmJlIGEgdXNlZnVsIGV4ZXJjaXNlIGJlY2F1c2UgaXQgd291bGQgZm9y Y2UgYW55IG90aGVyIGFtYmlndWl0aWVzIGluDQp0aGUgZ3JhbW1hci4NCg0KSSB3cm90ZSB0aGlz IHN0YXJ0aW5nIHdpdGggYSBMQUxSKDEpIHBhcnNlciwgYW5kIHdyb3RlIGFzIG11Y2ggYXMgSQ0K Y291bGQgd2l0aG91dCBhbnkgc2hpZnQvcmVkdWNlIGNvbmZsaWN0cywgYW5kIHJldmVydGVkIHRv IGEgZ2VuZXJhbA0KYmFja3RyYWNraW5nIHBhcnNlciBuZWFyIHRoZSBlbmQuICBUaGUgTEFMUigx KSBwYXJzZXIgaXMgc2lnbmlmaWNhbnRseQ0KZWFzaWVyIHRvIGRlYnVnLCBhbmQgdGVuZHMgdG8g cHJvZHVjZSBiZXR0ZXIgZXJyb3IgbWVzc2FnZXMuDQoNCkRhdmlkIEJyb3duDQoNCi0tLS0tIEVu ZCBmb3J3YXJkZWQgbWVzc2FnZSAtLS0tLQ0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXw0KU3VpdCBtYWlsaW5nIGxpc3QNClN1aXRAaWV0Zi5vcmc8bWFp bHRvOlN1aXRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3N1aXQNCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBh bnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdl ZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0 aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRv IGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNv cHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClN1aXQgbWFpbGluZyBsaXN0 DQpTdWl0QGlldGYub3JnPG1haWx0bzpTdWl0QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9zdWl0DQo= --_000_13a615c302b04c77b8728418a0f15f18nordicsemino_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlv bjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcwLjg1cHQgNzAuODVwdCA3MC44 NXB0IDcwLjg1cHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQot LT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4 dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3Rl IG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpl eHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+ DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJOTy1CT0siIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlRoaXMgaXMg Z3JlYXQsIERhdmlkLCB0aG91Z2ggSeKAmW0gbm90IGF0IGFsbCBmYW1pbGlhciB3aXRoIFJhY2tl dCwgc28gSSBjYW7igJl0IHJlYWxseSBjb21tZW50LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6 RU4tVVMiPknigJltIGhvcGluZyBtYW5pZmVzdCBwYXJzaW5nIGNhbiBiZSBzb2x2ZWQgYnkgYSBo YXZpbmcgYSBwYXJzZXItZ2VuZXJhdG9yIGdlbmVyYXRlLCBkaXJlY3RseSBmcm9tIENEREwsIGNv ZGUgdGhhdCBwYXJzZXMgYW5kIHZhbGlkYXRlcyBDQk9SIGRhdGEuIFRoZSB3b3JrZmxvdyBJIGVu dmlzaW9uIGlzOiBUaGVyZSBpcw0KIGEgY2Fub25pY2FsIENEREwgKHRoZSBSRkMpIHRoYXQgaXMg cGFyc2VkIHRvIHByb2R1Y2UgY29kZSB0aGF0IHBsdWdzIGludG8gdGhlIHJlc3Qgb2YgdGhlIFNV SVQgaW1wbGVtZW50YXRpb24uIFRoZSB1c2VyIGNhbiBjaG9vc2UgdG8gZWRpdCB0aGUgQ0RETCAo cHJlZmVyYWJseSB0byByZXByZXNlbnQgYSBzdWJzZXQgb2YgdGhlIG9yaWdpbmFsKSwgYXMgYSBz aW1wbGUgd2F5IHRvIHJlc3RyaWN0IHRoZWlyIGZlYXR1cmUtc2V0LiBJ4oCZbSBob3BlZnVsDQog dGhhdCB0aGUgaW50ZXJmYWNlIGJldHdlZW4gdGhlIGdlbmVyYXRlZCBjb2RlIGFuZCB0aGUgY29k ZSB0aGF0IHVzZXMgaXQgY2FuIGJlIG1hZGUgZmxleGlibGUgdG8gc3VjaCBjaGFuZ2VzIGluIHRo ZSBDRERMLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPsOYeXZpbmQ8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5 bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0 O3BhZGRpbmc6MGNtIDBjbSAwY20gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20g MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiPiBTdWl0IFttYWlsdG86c3VpdC1ib3VuY2VzQGll dGYub3JnXQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5DYXJzdGVuIEJvcm1hbm48YnI+DQo8Yj5TZW50 OjwvYj4gNC4gYXVndXN0IDIwMTggMjA6Mzg8YnI+DQo8Yj5Ubzo8L2I+IEhhbm5lcyBUc2Nob2Zl bmlnICZsdDtIYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gRGF2 aWQgQnJvd24gJmx0O2RhdmlkLmJyb3duQGxpbmFyby5vcmcmZ3Q7OyBzdWl0QGlldGYub3JnPGJy Pg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbU3VpdF0gUGFyc2luZyBDRERMPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgSGFubmVzLCZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0 b206MTIuMHB0Ij5BIGdlbmVyaWMgQ0JPUiBwYXJzZXIgaXMgYSB1c2VmdWwgY29tcG9uZW50IGZv ciBhIGJvb3Rsb2FkZXIuIEhvd2V2ZXIsIG1pZ2h0IGFsc28gdHJhbnNsYXRlIENEREwgaW50byBj b2RlIHRoYXQgZGlyZWN0bHkgKG1heWJlIHZpYSBhIGZldyBsaWJyYXJ5IHJvdXRpbmVzKSBjb25z dW1lcyB0aGUgYmluYXJ5IENCT1IuPG86cD48L286cD48L3A+DQo8ZGl2IGlkPSJBcHBsZU1haWxT aWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2VudCBmcm9tJm5ic3A7PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMy4wcHQiPm1vYmlsZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBw dCI+PGJyPg0KT24gNC4gQXVnIDIwMTgsIGF0IDE5OjUwLCBIYW5uZXMgVHNjaG9mZW5pZyAmbHQ7 PGEgaHJlZj0ibWFpbHRvOkhhbm5lcy5Uc2Nob2ZlbmlnQGFybS5jb20iPkhhbm5lcy5Uc2Nob2Zl bmlnQGFybS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5IaSBE YXZpZCw8YnI+DQo8YnI+DQpPdXQgb2YgY3VyaW9zaXR5IHdoeSBkaWQgeW91IHdyaXRlIGEgQ0RE TCBwYXJzZXI/IEkgd291bGQgaGF2ZSBleHBlY3RlZCB0aGF0IHlvdSB3b3VsZCBpbnN0ZWFkIHdv cmsgb24gYSBzbWFsbCBDQk9SIHBhcnNlciBmb3IgdXNlIHdpdGggYm9vdGxvYWRlci48YnI+DQo8 YnI+DQpDaWFvPGJyPg0KSGFubmVzPGJyPg0KPGJyPg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0t LS08YnI+DQpGcm9tOiBTdWl0IFs8YSBocmVmPSJtYWlsdG86c3VpdC1ib3VuY2VzQGlldGYub3Jn Ij5tYWlsdG86c3VpdC1ib3VuY2VzQGlldGYub3JnPC9hPl0gT24gQmVoYWxmIE9mIERhdmlkIEJy b3duPGJyPg0KU2VudDogMzEgSnVseSAyMDE4IDE2OjAxPGJyPg0KVG86IDxhIGhyZWY9Im1haWx0 bzpzdWl0QGlldGYub3JnIj5zdWl0QGlldGYub3JnPC9hPjxicj4NClN1YmplY3Q6IFtTdWl0XSBQ YXJzaW5nIENEREw8YnI+DQo8YnI+DQooSSBwb3N0ZWQgdGhpcyB0byB0aGUgSUVURiBDQk9SIG1h aWxpbmcgbGlzdCwgYW5kIHJlcGxpZXMgcmVsYXRlZCB0bzxicj4NCkNCT1IvQ0RETCBzaG91bGQg YmUgdGhlcmUuICZuYnNwO0kgYW0gcG9zdGluZyB0aGlzIHRvIHRoZSBTVUlUIG1haWxpbmcgbGlz dDxicj4NCmJlY2F1c2Ugb2Ygb3VyIGludGVyZXN0IGluIENEREwsIGFuZCB0aGF0IHdlIGRpc2Nv dmVyZWQgb25lIG9mIHRoZTxicj4NCmFtYmlndWl0aWVzIGluIHRoZSBDRERMIGRyYWZ0KTxicj4N Cjxicj4NCi0tLS0tIEZvcndhcmRlZCBtZXNzYWdlIGZyb20gRGF2aWQgQnJvd24gJmx0OzxhIGhy ZWY9Im1haWx0bzpkYXZpZC5icm93bkBsaW5hcm8ub3JnIj5kYXZpZC5icm93bkBsaW5hcm8ub3Jn PC9hPiZndDsgLS0tLS08YnI+DQo8YnI+DQpEYXRlOiBUdWUsIDMxIEp1bCAyMDE4IDE2OjU4OjU0 IC0wNjAwPGJyPg0KRnJvbTogRGF2aWQgQnJvd24gJmx0OzxhIGhyZWY9Im1haWx0bzpkYXZpZC5i cm93bkBsaW5hcm8ub3JnIj5kYXZpZC5icm93bkBsaW5hcm8ub3JnPC9hPiZndDs8YnI+DQpUbzog PGEgaHJlZj0ibWFpbHRvOmNib3JAaWV0Zi5vcmciPmNib3JAaWV0Zi5vcmc8L2E+PGJyPg0KU3Vi amVjdDogUGFyc2luZyBDRERMPGJyPg0KPGJyPg0KSSBoYXZlIHdyaXR0ZW4gdXAgYSBzbWFsbCAo MjIwIGxpbmUpIHBhcnNlciBiYXNlZCBvbiB0aGU8YnI+DQpkcmFmdC1pZXRmLWNib3ItY2RkbC0w MyBkb2N1bWVudC4gJm5ic3A7VGhlIGNvZGUgY2FuIGJlIGZvdW5kIGF0PGJyPg0KPGEgaHJlZj0i aHR0cHM6Ly9naXRodWIuY29tL2QzemQzei9zdWl0LXBsYXkvYmxvYi9tYXN0ZXIvY2RkbC5ya3Qi Pmh0dHBzOi8vZ2l0aHViLmNvbS9kM3pkM3ovc3VpdC1wbGF5L2Jsb2IvbWFzdGVyL2NkZGwucmt0 PC9hPi4gJm5ic3A7SSB1c2VkIHRoZTxicj4NClJhY2tldCBsZXhlciBhbmQgcGFyc2VyIHRvb2xz IHRvIG1ha2UgdGhpcyBlYXNpZXIuPGJyPg0KPGJyPg0KSSBiZWxpZXZlIHRoaXMgcGFyc2VyIHBh cnNlcyAobmVhcmx5KSB0aGUgc2FtZSBsYW5ndWFnZSBkZXNjcmliZWQgaW48YnI+DQp0aGUgQUJO RiBncmFtbWFyIGluIHRoZSBkcmFmdCAoc2VlIGJlbG93IGFib3V0IHNwYWNlcykuICZuYnNwO0hv d2V2ZXIsIGE8YnI+DQpjb3VwbGUgb2Ygb2JzZXJ2YXRpb25zOjxicj4NCjxicj4NCi0gaW4gdGhl IHJ1bGUgZm9yICdydWxlJywgc2luY2UgYSAndHlwZScgYnkgaXRzZWxmIGlzIGEgdmFsaWQ8YnI+ DQombmJzcDsmbmJzcDsnZ3JwZW50JywgdGhpcyBydWxlIGlzIGFtYmlndW91cy4gJm5ic3A7SSBt YWRlIHRoZSBwYXJzZXIgd29yayBieTxicj4NCiZuYnNwOyZuYnNwO3NpbXBseSBjb21tZW50aW5n IG91dCB0aGUgZmlyc3QgYWx0ZXJuYXRlLi4gJm5ic3A7SSB3b3VsZCBnYXRoZXIgdGhhdCBhPGJy Pg0KJm5ic3A7Jm5ic3A7dG9vbCB1c2luZyB0aGUgb3V0cHV0IG9mIHRoaXMgcGFyc2VyIHdvdWxk IGhhdmUgdG8gc3RvcmUgYWxsPGJyPg0KJm5ic3A7Jm5ic3A7ZW50aXRpZXMsIGFuZCBjaGVjayB0 aGF0IGEgbmFtZSB1c2VkIGVsc2V3aGVyZSBhcyBhIHR5cGUgbXVzdCBiZTxicj4NCiZuYnNwOyZu YnNwO3Jlc3RyaWN0ZWQgdG8gdGhlICd0eXBlJyBmb3JtLjxicj4NCjxicj4NCi0gU3BhY2VzIGFy ZSBhIGxpdHRsZSBjb21wbGljYXRlZCwgYW5kIEknbSBub3Qgc3VyZSBxdWl0ZSBhczxicj4NCiZu YnNwOyZuYnNwO2ludGVuZGVkLiAmbmJzcDtPbmUgcHJvZHVjdGlvbiAoZm9yICM2KC4uLikpIGhh cyBhIGNvbW1lbnQgJnF1b3Q7bm90ZSBubzxicj4NCiZuYnNwOyZuYnNwO3NwYWNlJnF1b3Q7LCBo b3dldmVyIHRoZXJlIGFyZSBhIGZldyBvdGhlciBwbGFjZXMgdGhhdCBhcmUgbWlzc2luZzxicj4N CiZuYnNwOyZuYnNwO3NwYWNlcyAoc3VjaCBhcyB0aGUgc3BhY2UgYWZ0ZXIgdGhlIG9wZW4gcGFy ZW4gb24gdGhlPGJyPg0KPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7JnF1b3Q7 KCZxdW90OyB0eXBlICZxdW90OykmcXVvdDs8YnI+DQo8YnI+DQombmJzcDsmbmJzcDthbHRlcm5h dGUuICZuYnNwO0kgZm91bmQgdGhpcyBtdWNoIGVhc2llciB0byBoYW5kbGUgYnkgY29uc3VtaW5n IHNwYWNlczxicj4NCiZuYnNwOyZuYnNwO2luIHRoZSBsZXhlciBhbmQgbm90IG1ha2luZyB0aGVt IHBhcnQgb2YgdGhlIGdyYW1tYXIgYXQgYWxsLiAmbmJzcDtJbjxicj4NCiZuYnNwOyZuYnNwO29y ZGVyIHRvIGRvIHRoaXMsIHRocmVlIHRoaW5nczo8YnI+DQo8YnI+DQombmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmcXVvdDsjJnF1b3Q7ICZxdW90OzYmcXVvdDsgWyZxdW90Oy4mcXVvdDsg dWludF0gJnF1b3Q7KCZxdW90OyBTIHR5cGUgUyAmcXVvdDspJnF1b3Q7PGJyPg0KJm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7JnF1b3Q7IyZxdW90OyBESUdJVCBbJnF1b3Q7LiZxdW90OyB1 aW50XTxicj4NCjxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO1t1aW50XSAmcXVv dDsqJnF1b3Q7IFt1aW50XTxicj4NCjxicj4NCiZuYnNwOyZuYnNwO211c3QgYmUgY2FwdHVyZWQg YnkgdGhlIGxleGVyLCBzaW5jZSB0aGVzZSBwcm9kdWN0aW9uIHdvdWxkIG1ha2U8YnI+DQombmJz cDsmbmJzcDt0aGUgZ3JhbW1hciBhbWJpZ3VvdXMgdW5sZXNzIHRoZSBzcGFjZSBpcyBub3QgYWxs b3dlZC4gJm5ic3A7SSBhc3N1bWU8YnI+DQombmJzcDsmbmJzcDt0aGUgaW50ZW50IGlzIHRvIGlu dGVycHJldCB0aGVzZSB3aXRoICZxdW90O21heGltYWwgbXVuY2gmcXVvdDsgKG1vc3RseTxicj4N CiZuYnNwOyZuYnNwO3RoYW5rcyB0byB0aGUgY29tbWEgYmVpbmcgb3B0aW9uYWwpLjxicj4NCjxi cj4NCiZuYnNwOyZuYnNwO0kgYWxzbyBjYXB0dXJlIHRoZSByZXBldGl0aW9uIG9wZXJhdGlvbiB3 aXRoIG51bWJlcnMgYXQgbGV4IHRpbWU8YnI+DQombmJzcDsmbmJzcDt0byBhdm9pZCBhZGRpdGlv bmFsIGFtYmlndWl0eS48YnI+DQo8YnI+DQotIFRoZSBBQk5GIGdyYW1tYXIgcmVmZXJlbmNlcyBj b2RlIHBvaW50cyBzdWNoIGFzICV4NUQtMTBGRkZELiAmbmJzcDtJczxicj4NCiZuYnNwOyZuYnNw O2l0IGludGVudGlvbmFsIHRvIGluY2x1ZGUgdGhlIGludmFsaWQgcmFuZ2UgRDgwMC1ERkZGLCB3 aGljaCBhcmU8YnI+DQombmJzcDsmbmJzcDtyZXNlcnZlZCBmb3Igc3Vycm9nYXRlIHBhaXJzIGlu IFVURi0xNj8gJm5ic3A7VGhleSBhcmUgbm90IGNvbnNpZGVyZWQ8YnI+DQombmJzcDsmbmJzcDt2 YWxpZCBjb2RlcG9pbnRzIGZvciBVVEYtOCwgYW5kIGRlcGVuZGluZyBvbiB0aGUgdG9vbHMvbGFu Z3VhZ2U8YnI+DQombmJzcDsmbmJzcDt1c2VkLCBtYXkgYmUgcmVqZWN0ZWQgYmVmb3JlIGNvZGVw b2ludHMgYXJlIGdpdmVuIHRvIHRoZSBwYXJzZXIuPGJyPg0KPGJyPg0KLSBUaGUgdGV4dCBvZiB0 aGUgZHJhZnQgc3RhdGVzIHRoYXQgaGV4aWRlY2ltYWwgbnVtYmVycyAmcXVvdDsuLi4gYXJlPGJy Pg0KJm5ic3A7Jm5ic3A7Y2FzZSBpbnNlbnNpdGl2ZSZxdW90OywgaG93ZXZlciB0aGUgQUJORiBn cmFtbWFyIG9ubHkgYWNjZXB0czxicj4NCiZuYnNwOyZuYnNwO2hleGlkZWNpbWFsIGRpZ2l0cyBp biB1cHBlcmNhc2UuPGJyPg0KPGJyPg0KLSBUaGVyZSBhcmUgcHJvZHVjdGlvbnMgYWxsb3dlZCBi eSB0aGUgZ3JhbW1hciB3aG9zZSBtZWFuaW5nIGlzIG5vdDxicj4NCiZuYnNwOyZuYnNwO2Rlc2Ny aWJlZCBieSB0aGUgdGV4dCBvZiB0aGUgZHJhZnQuICZuYnNwO0ZvciBleGFtcGxlOjxicj4NCjxi cj4NCiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO2l0ZW0gPSBbIGludCA9Jmd0OyBic3Ry IF08YnI+DQo8YnI+DQombmJzcDsmbmJzcDtpcyB2YWxpZCB3aXRoIHRoZSBncmFtbWFyLCBidXQg aXQgaXMgdW5jbGVhciB3aGF0IHRoaXMgbWVhbnMuPGJyPg0KJm5ic3A7Jm5ic3A7UGVyaGFwcyB0 aGlzIGNvdWxkIGRlc2NyaWJlIGFuIG9yZGVyZWQgbWFwLCBvciBhbiBhcnJheSBvZiBwYWlyczxi cj4NCiZuYnNwOyZuYnNwO29mIGl0ZW1zLiAmbmJzcDtSZWxhdGVkIGFyZSBhcnJheXMgdGhhdCBj b250YWluIG1vcmUgdGhhbiBhIHNpbmdsZTxicj4NCiZuYnNwOyZuYnNwO2l0ZW06PGJyPg0KPGJy Pg0KJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7aXRlbSA9IFsgaW50LCBic3RyLCA1IF08 YnI+DQo8YnI+DQotIFdoYXQgaXMgdGhlIGludGVuZGVkIGludGVycHJldGF0aW9uIG9mOjxicj4N Cjxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO2dyb3VwbmFtZSA9IChhIGIgLy8g YyBkKTxicj4NCjxicj4NCiZuYnNwOyZuYnNwO015IHBhcnNlciBpbnRlcnByZXRzIHRoaXMgYXMg KChhIGIpIC8vIChjIGQpKSwgaG93ZXZlcjxicj4NCiZuYnNwOyZuYnNwOyhhIChiIC8vIGMpIGQp IGlzIGFsc28gYSB2YWxpZCBpbnRlcnByZXRhdGlvbiwgYW4gcHJvYmFibHkgd2hhdCBpczxicj4N CiZuYnNwOyZuYnNwO2ludGVuZGVkLCBlc3BlY2lhbGx5IGlmIGNvbW1hcyBhcmUgdXNlZCAmbmJz cDsoYSwgYiAvLyBjLCBkKS48YnI+DQo8YnI+DQotIFJlbGF0ZWQgdG8gdGhlIGFib3ZlLCB0aGUg Z3JhbW1hciBhbGxvd3MgdGhpbmdzIGxpa2UgbGlrZTxicj4NCjxicj4NCiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwO2dycCA9ICgvLyAvLyk8YnI+DQo8YnI+DQombmJzcDsmbmJzcDtpcyB0 aGlzIGludGVudGlvbmFsPzxicj4NCjxicj4NCldpdGggc29tZSB3b3JrLCBJIGJlbGlldmUgaXQg d291bGQgYmUgcG9zc2libGUgdG8gdHJhbnNmb3JtIHRoaXM8YnI+DQpncmFtbWFyIGludG8gc29t ZXRoaW5nIExBTFIoMSkgKG15IGdyYW1tYXIgaXMgcGFydCB3YXkgdGhlcmUpLCBidXQgaXQ8YnI+ DQp3b3VsZCBtYWtlIHNvbWUgb2YgdGhlIHByb2R1Y3Rpb25zIGRpZmZpY3VsdCB0byByZWFkLiAm bmJzcDtIb3dldmVyLCBpdCBtYXk8YnI+DQpiZSBhIHVzZWZ1bCBleGVyY2lzZSBiZWNhdXNlIGl0 IHdvdWxkIGZvcmNlIGFueSBvdGhlciBhbWJpZ3VpdGllcyBpbjxicj4NCnRoZSBncmFtbWFyLjxi cj4NCjxicj4NCkkgd3JvdGUgdGhpcyBzdGFydGluZyB3aXRoIGEgTEFMUigxKSBwYXJzZXIsIGFu ZCB3cm90ZSBhcyBtdWNoIGFzIEk8YnI+DQpjb3VsZCB3aXRob3V0IGFueSBzaGlmdC9yZWR1Y2Ug Y29uZmxpY3RzLCBhbmQgcmV2ZXJ0ZWQgdG8gYSBnZW5lcmFsPGJyPg0KYmFja3RyYWNraW5nIHBh cnNlciBuZWFyIHRoZSBlbmQuICZuYnNwO1RoZSBMQUxSKDEpIHBhcnNlciBpcyBzaWduaWZpY2Fu dGx5PGJyPg0KZWFzaWVyIHRvIGRlYnVnLCBhbmQgdGVuZHMgdG8gcHJvZHVjZSBiZXR0ZXIgZXJy b3IgbWVzc2FnZXMuPGJyPg0KPGJyPg0KRGF2aWQgQnJvd248YnI+DQo8YnI+DQotLS0tLSBFbmQg Zm9yd2FyZGVkIG1lc3NhZ2UgLS0tLS08YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NClN1aXQgbWFpbGluZyBsaXN0PGJyPg0KPGEg aHJlZj0ibWFpbHRvOlN1aXRAaWV0Zi5vcmciPlN1aXRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJl Zj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdWl0Ij5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N1aXQ8L2E+PGJyPg0KSU1QT1JUQU5UIE5PVElD RTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29u ZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUg aW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkg YW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNl IGl0IGZvciBhbnkgcHVycG9zZSwNCiBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBp biBhbnkgbWVkaXVtLiBUaGFuayB5b3UuPGJyPg0KPGJyPg0KX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpTdWl0IG1haWxpbmcgbGlzdDxicj4NCjxh IGhyZWY9Im1haWx0bzpTdWl0QGlldGYub3JnIj5TdWl0QGlldGYub3JnPC9hPjxicj4NCjxhIGhy ZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3VpdCI+aHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdWl0PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_13a615c302b04c77b8728418a0f15f18nordicsemino_-- From nobody Fri Aug 17 14:10:45 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4E6A130E08 for ; Fri, 17 Aug 2018 14:10:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=linaro.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5O6f8EsL9Y6V for ; Fri, 17 Aug 2018 14:10:42 -0700 (PDT) Received: from mail-it0-x22c.google.com (mail-it0-x22c.google.com [IPv6:2607:f8b0:4001:c0b::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12865130DE2 for ; Fri, 17 Aug 2018 14:10:41 -0700 (PDT) Received: by mail-it0-x22c.google.com with SMTP id d9-v6so13157346itf.2 for ; Fri, 17 Aug 2018 14:10:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to :user-agent; bh=3fdYbiX8J1B5XLPUXxJRBAAKsgHaqZZ/xcnz/M5XgPQ=; b=I1HHS+BpaSGhivULLkAE2v/9laKvMnmzcbJJypv35dwoeiqexm54wFBl7mLyTM8qXd ER9AHDezeykbGmDnWZTAoH+Cj5PWW5U06W5iw3ub1ZUYTAFY88vaWmg+xIwvTbTlH/CP alSqH3lNwdl5vw3fY/58ve/X4I/au3dBNlsLc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to:user-agent; bh=3fdYbiX8J1B5XLPUXxJRBAAKsgHaqZZ/xcnz/M5XgPQ=; b=DJwte/E0hFafgnxkfn+Y6R0N64E14TaJQU+gKE/5xrsYewf1np8jn4qQOtIAsmakdJ MirGimvh9V32JCgC1Qo0NnZ+ynEkhWuqiW/cQFsWS/rk2Gqs99G8QQMAZzqwnjTESQJv lue80yY3u5VhaiXEs4nUpwuAaHAglaAniakzLtDUVIy0a6hWIff3yHZYB8o5q07oH7ka dQ3XZjQxFWnxDY0ki5MWTjnwQBpYXT16SMu0bDauoxhZyfuSzxjIM8MVoaBw+SxkBEAR pYQ9MpSr+OfvX/L4p1AlSZtM08bWpQFhZZjrlAe0nDbcwop18LmIjCxS26q8ZTH20I+Z M4uQ== X-Gm-Message-State: AOUpUlHNydkCpydAZH3nQHS8tZBWQhHErmte/zqxy9fLbEbam0ILsgDE o4qku/kVujPIDWyj1glTwD0fZt3tGUe26g== X-Google-Smtp-Source: AA+uWPyYZGl/Wb411Ev7bXu7/s7I1fQsN/EvyS7P3wZ8sxOG+0SG9jpyoghd609akyzxhQaBwTx/DQ== X-Received: by 2002:a02:b422:: with SMTP id i31-v6mr1520312jaj.81.1534540240925; Fri, 17 Aug 2018 14:10:40 -0700 (PDT) Received: from davidb.org ([2601:283:4300:987c::9]) by smtp.gmail.com with ESMTPSA id b186-v6sm98679itc.11.2018.08.17.14.10.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 17 Aug 2018 14:10:40 -0700 (PDT) Date: Fri, 17 Aug 2018 15:10:38 -0600 From: David Brown To: =?iso-8859-1?Q?R=F8nningstad=2C_=D8yvind?= Cc: Carsten Bormann , Hannes Tschofenig , "suit@ietf.org" Message-ID: <20180817211038.GA26119@davidb.org> References: <20180731230118.GB18176@davidb.org> <57DE5FB4-EB58-4393-8F38-4119D90354BE@tzi.org> <13a615c302b04c77b8728418a0f15f18@nordicsemi.no> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <13a615c302b04c77b8728418a0f15f18@nordicsemi.no> User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: Re: [Suit] Parsing CDDL X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 21:10:44 -0000 On Thu, Aug 16, 2018 at 02:20:07PM +0000, Rønningstad, Øyvind wrote: >This is great, David, though I’m not at all familiar with Racket, so I can’t >really comment. I basically chose Racket for this because the language is fairly oriented around extending itself with other grammars, and as such includes numerous parsing tools. >I’m hoping manifest parsing can be solved by a having a parser-generator >generate, directly from CDDL, code that parses and validates CBOR data. The >workflow I envision is: There is a canonical CDDL (the RFC) that is parsed to >produce code that plugs into the rest of the SUIT implementation. The user can >choose to edit the CDDL (preferably to represent a subset of the original), as >a simple way to restrict their feature-set. I’m hopeful that the interface >between the generated code and the code that uses it can be made flexible to >such changes in the CDDL. My goals are something along these lines. My primary goal was just to make sure I understood everything. But, ideally, it would be nice to have something that would read a CDDL description, and generate (using a small library) code to parse or process that structure. David From nobody Wed Aug 22 07:14:07 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B5DE130DDD; Wed, 22 Aug 2018 07:14:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.29 X-Spam-Level: X-Spam-Status: No, score=-4.29 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=infineon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P2z1jF1NXLqI; Wed, 22 Aug 2018 07:13:58 -0700 (PDT) Received: from smtp2.infineon.com (smtp2.infineon.com [IPv6:2a00:18f0:1e00:4::4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8176130DDC; Wed, 22 Aug 2018 07:13:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=infineon.com; i=@infineon.com; q=dns/txt; s=IFXMAIL; t=1534947238; x=1566483238; h=from:to:cc:subject:date:message-id: content-transfer-encoding:mime-version; bh=2noDcVZoz9Ap4grEPxIFqtmSkfsc56MBcF8F8BYkYIY=; b=apZYzMytVepnmT2Hn3ObziVHw9AkJh+CdumgTE5eu26H4Z6VJRc4mlOE KzEHp+ocQEUe3N+SquWNN5/TbtpeGy+jRxvorulhgVVXExllpmrWAhixh KN7Q4kr3GSkqSL+kUAh3sz8jKs/jqwBm16sTxmAYM7ZPKYWnE2Tg4ubv7 M=; X-SBRS: None X-IronPort-AV: E=McAfee;i="5900,7806,8992"; a="77339520" X-IronPort-AV: E=Sophos;i="5.53,274,1531778400"; d="scan'208";a="77339520" Received: from unknown (HELO mucxv001.muc.infineon.com) ([172.23.11.16]) by smtp2.infineon.com with ESMTP/TLS/AES256-GCM-SHA384; 22 Aug 2018 16:13:54 +0200 Received: from MUCSE707.infineon.com (MUCSE707.infineon.com [172.23.7.81]) by mucxv001.muc.infineon.com (Postfix) with ESMTPS; Wed, 22 Aug 2018 16:13:54 +0200 (CEST) Received: from MUCSE701.infineon.com (172.23.7.90) by MUCSE707.infineon.com (172.23.7.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1466.3; Wed, 22 Aug 2018 16:13:53 +0200 Received: from MUCSE702.infineon.com (172.23.7.91) by MUCSE701.infineon.com (172.23.7.90) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1466.3; Wed, 22 Aug 2018 16:13:54 +0200 Received: from MUCSE702.infineon.com ([fe80::88ef:90c6:2960:fe26]) by MUCSE702.infineon.com ([fe80::88ef:90c6:2960:fe26%17]) with mapi id 15.01.1466.008; Wed, 22 Aug 2018 16:13:54 +0200 From: To: CC: , Thread-Topic: AES/FIPS Approved Algorithm Usage Thread-Index: AdQ6D7+D4cJKQB3WQqa3VdmEG//D4Q== Date: Wed, 22 Aug 2018 14:13:54 +0000 Message-ID: <6433f2b697f74428886660d1e62ba6a7@infineon.com> Accept-Language: de-DE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.23.8.247] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Suit] AES/FIPS Approved Algorithm Usage X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 14:14:00 -0000 All, In the context of SUIT we did some analysis how to 'map' SUIT Manifest and = Payload into some COSE Crypto Containers with the focus on usage of Algorit= hms, with the following properties: (1) Usage of FIPS Approved Algorithms AND (2) Usage of Cipher (AES) Based Algorithms=20 Below are some observations, potential suggestions based on our current und= erstanding we would like to share, in case others have interest in usage of= AES Based/FIPS Approved Algorithms in COSE. A. Cipher Based MAC [COSE-9.2] Currently AES-CBC-MAC is specified in COSE. Algorithm Identifier for AES-CMAC as specified in [800-38B]/[RFC4493] would= allow the FIPS approved AES-CMAC Algorithm for usage in COSE MAC Crypto Co= ntainers. B. Key Derivation Functions [COSE-11] For KDF Usage of Secrets that are _uniformly random_: _PRF_ Algorithm Identifier(s) based on CMAC, as specified in [800-38B]/[RFC= 4493] and approved in [800-108] would allow for an FIPS Approved Cipher bas= ed PRF. _KDF_ Algorithm Identifier(s) (specifying Modes of Iteration) that refer to= [800-108] FIPS Approved KDF Algorithm=A0=20 would present a preferred option to allow the Cipher based FIPS Approved KD= Fs in COSE, since [800-108] seems to be the relevant FIPS Approved KDF Spec= for the use case of secrets that are _uniformly random_. C. Content Key Distribution 'Direct Key with KDF' [COSE-12.1.2]=20 Algorithm Identifiers for Direct Key with KDF using the KDFs from Point=A0 = B. above would allow Cipher based FIPS Approved 'Direct Key with KDF' in Co= ntent Key Distribution/ Recipient Algorithms in COSE. D. AES Key Wrap [COSE-12.2.1] COSE Key Wrap is referring to [RFC3394], which is satisfying NIST Key Wrap = Requirements. My understanding is that COSE usage of [RFC3394] supports AES Key Wrap (KW)= Mode of [800-38F],=20 but does not support AES Key Wrap with Padding (KWP) Mode of [800-38F].=20 Algorithm Identifier for KWP would provide and additional Approved Key Wrap= Mode within COSE. Thanks, Markus [COSE-9.2] https://tools.ietf.org/html/rfc8152#section-9.2 [COSE-ref] https://tools.ietf.org/html/rfc8152#ref-MAC [COSE-11] https://tools.ietf.org/html/rfc8152#section-11 [COSE-12.1.2] https://tools.ietf.org/html/rfc8152#section-12.1.2 [COSE-12.2.1] https://tools.ietf.org/html/rfc8152#section-12.2.1 [RFC4493] https://tools.ietf.org/html/rfc4493 [800-38B] https://csrc.nist.gov/publications/detail/sp/800-38b/final [800-108] https://csrc.nist.gov/publications/detail/sp/800-108/final [800-38F] https://csrc.nist.gov/publications/detail/sp/800-38f/final From nobody Wed Aug 22 12:33:29 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0A791292AD; Wed, 22 Aug 2018 12:33:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JTpGQ52wNVrw; Wed, 22 Aug 2018 12:33:25 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1148A12426A; Wed, 22 Aug 2018 12:33:25 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Wed, 22 Aug 2018 12:29:32 -0700 From: Jim Schaad To: , CC: , References: <6433f2b697f74428886660d1e62ba6a7@infineon.com> In-Reply-To: <6433f2b697f74428886660d1e62ba6a7@infineon.com> Date: Wed, 22 Aug 2018 12:33:16 -0700 Message-ID: <006c01d43a4e$fb12f250$f138d6f0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQNy9adOjxZVgmRU/HVQHs/vKM+a96GOrhZQ Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Suit] [COSE] AES/FIPS Approved Algorithm Usage X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 19:33:28 -0000 > -----Original Message----- > From: COSE On Behalf Of > Markus.Gueller@infineon.com > Sent: Wednesday, August 22, 2018 7:14 AM > To: cose@ietf.org > Cc: Ralph.Hamm@infineon.com; suit@ietf.org > Subject: [COSE] AES/FIPS Approved Algorithm Usage >=20 > All, >=20 > In the context of SUIT we did some analysis how to 'map' SUIT Manifest = and > Payload into some COSE Crypto Containers with the focus on usage of > Algorithms, with the following properties: >=20 > (1) Usage of FIPS Approved Algorithms AND > (2) Usage of Cipher (AES) Based Algorithms >=20 > Below are some observations, potential suggestions based on our = current > understanding we would like to share, in case others have interest in usage of > AES Based/FIPS Approved Algorithms in COSE. >=20 >=20 > A. Cipher Based MAC [COSE-9.2] >=20 > Currently AES-CBC-MAC is specified in COSE. > Algorithm Identifier for AES-CMAC as specified in [800-38B]/[RFC4493] would > allow the FIPS approved AES-CMAC Algorithm for usage in COSE MAC = Crypto > Containers. >=20 >=20 > B. Key Derivation Functions [COSE-11] >=20 > For KDF Usage of Secrets that are _uniformly random_: >=20 > _PRF_ Algorithm Identifier(s) based on CMAC, as specified in [800- > 38B]/[RFC4493] and approved in [800-108] would allow for an FIPS = Approved > Cipher based PRF. >=20 > _KDF_ Algorithm Identifier(s) (specifying Modes of Iteration) that = refer to [800- > 108] FIPS Approved KDF Algorithm would present a preferred option to = allow > the Cipher based FIPS Approved KDFs in COSE, since [800-108] seems to = be the > relevant FIPS Approved KDF Spec for the use case of secrets that are _uniformly > random_. >=20 >=20 > C. Content Key Distribution 'Direct Key with KDF' [COSE-12.1.2] >=20 > Algorithm Identifiers for Direct Key with KDF using the KDFs from = Point=A0 B. > above would allow Cipher based FIPS Approved 'Direct Key with KDF' in Content > Key Distribution/ Recipient Algorithms in COSE. >=20 >=20 > D. AES Key Wrap [COSE-12.2.1] >=20 > COSE Key Wrap is referring to [RFC3394], which is satisfying NIST Key = Wrap > Requirements. > My understanding is that COSE usage of [RFC3394] supports AES Key Wrap > (KW) Mode of [800-38F], but does not support AES Key Wrap with Padding > (KWP) Mode of [800-38F]. > Algorithm Identifier for KWP would provide and additional Approved Key Wrap > Mode within COSE. I am trying to figure out what you believe that is going to be added by this. Unless you see a need to have authenticated attributes at the key wrap level there is no additional benefit from using the KWP mode rather than the KW mode. As these have the same construction and are built on = the same primitive they have the same set of variabilities. Jim >=20 >=20 >=20 > Thanks, > Markus >=20 >=20 > [COSE-9.2] https://tools.ietf.org/html/rfc8152#section-9.2 > [COSE-ref] https://tools.ietf.org/html/rfc8152#ref-MAC > [COSE-11] https://tools.ietf.org/html/rfc8152#section-11 > [COSE-12.1.2] https://tools.ietf.org/html/rfc8152#section-12.1.2 > [COSE-12.2.1] https://tools.ietf.org/html/rfc8152#section-12.2.1 >=20 >=20 > [RFC4493] https://tools.ietf.org/html/rfc4493 > [800-38B] https://csrc.nist.gov/publications/detail/sp/800-38b/final >=20 > [800-108] https://csrc.nist.gov/publications/detail/sp/800-108/final >=20 > [800-38F] https://csrc.nist.gov/publications/detail/sp/800-38f/final >=20 > _______________________________________________ > COSE mailing list > COSE@ietf.org > https://www.ietf.org/mailman/listinfo/cose From nobody Thu Aug 23 09:43:30 2018 Return-Path: X-Original-To: suit@ietfa.amsl.com Delivered-To: suit@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72FCE130DE4 for ; Thu, 23 Aug 2018 09:43:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BVxZvWy6IjnE for ; Thu, 23 Aug 2018 09:43:26 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0124.outbound.protection.outlook.com [104.47.33.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EA35130E3B for ; Thu, 23 Aug 2018 09:43:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UiXfOpVk57QmZMW23/LpQCf669y3uiHXZeEUhTbLjyc=; b=Pw6//7PP6Gp/8BNh9JhdQGIS7VclWTUFFEcj2rhq4ttyWj4NE5lQWFRy+KvMB3BTfwrzPcsX+yO2N9Y3dxkZDgfNR8CU4L2y+PGEGMe8XJ2ZJFpUfbd2dlHYk+vJjjLHjnGSMtDcdQW9dinu0sPunTkpE0/H+DoLcgImzTIt/8o= Received: from MWHPR21MB0783.namprd21.prod.outlook.com (10.173.51.149) by MWHPR21MB0768.namprd21.prod.outlook.com (10.173.51.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.1101.1; Thu, 23 Aug 2018 16:43:23 +0000 Received: from MWHPR21MB0783.namprd21.prod.outlook.com ([fe80::55c5:b70a:ca63:cc35]) by MWHPR21MB0783.namprd21.prod.outlook.com ([fe80::55c5:b70a:ca63:cc35%8]) with mapi id 15.20.1101.007; Thu, 23 Aug 2018 16:43:23 +0000 From: Martin Pagel To: Michael Richardson , suit Thread-Topic: [Suit] Human rights issues and *manifest* encryption Thread-Index: AQHUKnMbZMcz8wNWZ0m8K6/a8U7pKKStIZ2AgCCAjBA= Date: Thu, 23 Aug 2018 16:43:23 +0000 Message-ID: References: <16119.1533222658@localhost> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mapagel@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-08-23T16:43:21.7773900Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:f:31c0:1275:eccd:3ba0] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR21MB0768; 6:3sfaiwJyHTCd57NpzrFDJudur07O9EsL3/t7x4kOv0udFmxnFaSgVFoYuYiVPIhDKxqlSbS4jXPYW51PbV07qyv8ke12k+4jLDpLNIIrCK0/QI8P6wu2T98k+GZx3m+pU7ffpEMwzMwq53hAi4EzbNeO57Xt4PIkw3tfmxcxdtBixzCUKQ1jM3KijWicnUpq3ETkfQbVrGD030XRUvNdoyieXbdgx7tS2twMCVJxWzja2CBSxkjXotpKcBP0wbxEykSnBLL5gYZN4DIRq32ZDYkDKPSIfM4sbYJDvz+A8OBmDNmPcF9seNPH/+uB+fB1BgdKGMHFvrDJff4wmhk/VsRh/a+d9UTzUgzp1xwrRExEl6l5rLOdsoMelRreN5VamLlaOrX1hZneH60AnrwmiusG7thoAc7EWfQkb7lEU2c/U1p92jPmjQLQNLd5YGyZn/X18JCSLewjegR6PjeuCA==; 5:rBBKelVIvtZqr6nm6U9bFJu9zrdWt0r14QzOHZDn2MdcycVVuJartcOgHmUhZdFlZsbUCYWYPwwvj7BcgL/ltBBdbLSJQfZmHympeR7mj033fTOv8Dv2t3TyKtq4+Fv7dOktL7d5veihCELeW36LsloHJIfpqX1zOvLyaZM8AfE=; 7:ve1vdczXcVd5jzFhPd76Hv33+ysQb0/07nNBCWaALmc7Mb562j8XVK9ib9XUVVlJhrwgDtSVw9xBPKh9wY8ni4dEkY5xFxmDfRKjzOIKHna2AxppAveNB/nPX1WEhSjnr/VdOCcVElHlgNzreQZqvxbwo5y3NUuUHWWZz+DziZkJw69VjTj+bnhwU0lvM5JuiMmhMRlrNvqq/Yx8Sn6GF/w3o9wYqTE1t8oRqBSTcQlX9NKUg5STrmc6g5ZSipJl x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: d78d75a2-1da9-4192-8829-08d609178a89 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0768; x-ms-traffictypediagnostic: MWHPR21MB0768: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(192374486261705)(189930954265078)(223705240517415)(219752817060721); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3231336)(944501410)(52105095)(2018427008)(3002001)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123558120)(20161123560045)(20161123564045)(201708071742011)(7699037)(76991021); SRVR:MWHPR21MB0768; BCL:0; PCL:0; RULEID:; SRVR:MWHPR21MB0768; x-forefront-prvs: 0773BB46AC x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(136003)(366004)(396003)(376002)(346002)(13464003)(51444003)(40434004)(189003)(199004)(76176011)(68736007)(2906002)(6346003)(186003)(86362001)(14444005)(53546011)(102836004)(6506007)(7696005)(476003)(14454004)(229853002)(966005)(446003)(11346002)(486006)(5024004)(46003)(86612001)(2900100001)(256004)(8936002)(99286004)(316002)(110136005)(97736004)(22452003)(8990500004)(53936002)(8676002)(10090500001)(81156014)(6116002)(33656002)(5660300001)(81166006)(5250100002)(25786009)(9686003)(55016002)(74316002)(10290500003)(105586002)(72206003)(7736002)(478600001)(106356001)(305945005)(6436002)(6246003)(6306002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0768; H:MWHPR21MB0783.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Martin.Pagel@microsoft.com; x-microsoft-antispam-message-info: uf4sCFwU4oaYWiwd7I8LBzI+hCUVxUWqYCUlccqGl3S2UKcUcpl96TP5kIO+8ummrUoXFLJ9dk4C4uthTWDSL7Gf0BvZ8ht4yebp3H27aQrOpmO5GwWbDOtUgqByaYQ3IBhuLcpkorFSuzrISj5njGSx1cK9jBycgN1P0ZcGJfAABfnI7zTmIBXta+jVP0+oqyHUuS5s0Eyj/m3a+fBM3ik3N1t8xm37Cb9KpESldJ2cJFm4z7PHLajfEr7UftinjHclhOgYhFUXpoioTIPGhvySI24oTa3c6Pg2PNEH2yEvOMrbuBL5CDE7ySJBZ4R+KILhwHOU3IWc78A6YYDo/66wvXbn9A+FJ/3YPNZM020= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: d78d75a2-1da9-4192-8829-08d609178a89 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Aug 2018 16:43:23.1239 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0768 Archived-At: Subject: Re: [Suit] Human rights issues and *manifest* encryption X-BeenThere: suit@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Software Updates for Internet of Things List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Aug 2018 16:43:30 -0000 If a device needs to collect updated images from multiple source servers, p= rivacy may be at stake as a sex toy may request an updated image from its m= anufacturer. But that exposure even applies if the manifest is encrypted.=20 However a centralized Update Server would hide such traffic exposure and I = believe channel encryption / transport layer security would then be suffici= ent.=20 Martin -----Original Message----- From: Suit On Behalf Of Hannes Tschofenig Sent: Thursday, August 2, 2018 4:48 PM To: Michael Richardson ; suit Subject: Re: [Suit] Human rights issues and *manifest* encryption Everything you say below, Michael, makes sense to me. I agree with your con= clusion. -----Original Message----- From: Suit [mailto:suit-bounces@ietf.org] On Behalf Of Michael Richardson Sent: 02 August 2018 08:11 To: suit Subject: [Suit] Human rights issues and *manifest* encryption {watching the Youtube video of the WG session from two weeks ago} I think that there are many specific non-human rights related reasons to en= crypt the firmware. I think that the WG is in the right direction on that. Encryption of the manifest is a complex question to me. My take is that the concern is that if a person is identifiable when they (= or rather, their personal network) asks questions like: ** Is there a new firmware for device type X? ** or receives notices li= ke: ** In order to do X, your device Y needs firmware at least Z ** (and this might be done by sending a manifest) When device type X is a medical device, or some other socially awkward devi= ce (a sex toy, a diaper, etc.) one can easily see why privacy is important.= As far as I understand, the process of asking questions like above, and/o= r receiving notices of new firmware available is explicitely out-of-scope t= oday. The problem that I see with encrypting manifests is that either it prevents= much of the supporting infrastructure from being useful (if it's well encr= ypted), or the encryption key is so well known as to be a joke. I suspect that much of the problem can and SHOULD be solved with transport = layer security around the transactions about updates. I think that the SUIT architecture should deal with this issue, and rule ma= nifest encryption out of scope, mentioning that the (out of scope) transpor= t protocol MUST provide transport encryption. -- Michael Richardson , Sandelman Software Works -=3D = IPv6 IoT consulting =3D- IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ Suit mailing list Suit@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fsuit&data=3D02%7C01%7Cmartin.pagel%40micros= oft.com%7Ceb92920d114e4ca6253508d5f8d26c15%7C72f988bf86f141af91ab2d7cd011db= 47%7C1%7C0%7C636688505018117746&sdata=3DU6P1KScm4IDtA5WK%2FxPHeX29d5peZ= wKIO4O%2FD843Jok%3D&reserved=3D0