From nobody Sun Jul 1 10:49:17 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4280F130ECF; Sun, 1 Jul 2018 10:49:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vtyhPSoIMaAb; Sun, 1 Jul 2018 10:48:57 -0700 (PDT) Received: from mailhost.informatik.uni-bremen.de (mailhost.informatik.uni-bremen.de [IPv6:2001:638:708:30c9::12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13D72130E7B; Sun, 1 Jul 2018 10:48:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at informatik.uni-bremen.de Received: from submithost.informatik.uni-bremen.de (submithost.informatik.uni-bremen.de [134.102.201.11]) by mailhost.informatik.uni-bremen.de (8.14.5/8.14.5) with ESMTP id w61Hmqwp023279; Sun, 1 Jul 2018 19:48:52 +0200 (CEST) Received: from [192.168.217.114] (p5DC7FF04.dip0.t-ipconnect.de [93.199.255.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by submithost.informatik.uni-bremen.de (Postfix) with ESMTPSA id 41JdD42gxwzDXdT; Sun, 1 Jul 2018 19:48:52 +0200 (CEST) From: Carsten Bormann Content-Type: text/plain; charset=utf-8 X-Mao-Original-Outgoing-Id: 552160130.262315-1c6e6210815636f22af02fa159785a11 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.4 \(3445.8.2\)) Message-Id: Date: Sun, 1 Jul 2018 19:48:51 +0200 To: suit , teep@ietf.org, din@irtf.org X-Mailer: Apple Mail (2.3445.8.2) Archived-At: Subject: [Teep] Constrained Node/Network Cluster @ IETF102: FINAL AGENDA X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 01 Jul 2018 17:49:08 -0000 I forgot to send the update of my usual eclectic condensed agenda based on the "FINAL" AGENDA for IETF102. Remember that "FINAL" means this will be the basis for printed agenda sheets, there is still some potential for changes after that. The only change from the previous draft agenda (apart from different room assignments) seems to be the move of SECDISPATCH on top of the first CORE slot and of SUIT into what previously was the SECDISPATCH slot. The conflicts ACE vs. DISPATCH as well as CBOR vs. 6LO vs. TEEP remain. All times are EDT (UTC-0400). (You can get pure UTC times on https://datatracker.ietf.org/meeting/agenda-utc, for those who want to listen from remote.) Gr=C3=BC=C3=9Fe, Carsten SATURDAY/SUNDAY -- Hackathon (including various interops) (Centre Ville) -- Sun 1800-2000: HotRFC (Viger) MONDAY, July 16, 2018 0930-1200 Morning Session I Duluth ART dispatch Dispatch WG - Joint with ARTAREA Laurier INT 6man IPv6 Maintenance WG Place du Canada RTG detnet Deterministic Networking WG Viger SEC *** ace Authentication and Authorization for = Constrained Environments WG 1330-1530 Afternoon Session I Laurier INT ipwave IP Wireless Access in Vehicular = Environments WG Place du Canada SEC tls Transport Layer Security WG 1550-1750 Afternoon Session II Duluth ART *** core Constrained RESTful Environments WG Laurier INT intarea Internet Area Working Group WG Viger SEC secdispatch Security Dispatch WG 1810-1940 Afternoon Session III Laurier GEN rfcplusplus The label "RFC" BOF TUESDAY, July 17, 2018 0930-1200 Morning Session I Place du Canada IRTF irtfopen IRTF Open Meeting St-Paul/St-Cath RTG babel Babel routing protocol WG Duluth RTG *** roll Routing Over Low power and Lossy = networks WG 1330-1530 Afternoon Session I Van Horne ART *** cbor Concise Binary Object Representation = Maintenance and Extensions WG Duluth INT *** 6lo IPv6 over Networks of = Resource-constrained Nodes WG Laurier RTG rtgarea Routing Area Open Meeting Viger SEC *** teep Trusted Execution Environment = Provisioning WG 1550-1820 Afternoon Session II Place du Canada ART httpbis Hypertext Transfer Protocol WG Viger IRTF cfrg Crypto Forum - 1720 - 1820 Centre Ville IRTF icnrg Information-Centric Networking Van Horne SEC acme Automated Certificate Management = Environment WG - 1720 - 1820 Van Horne SEC oauth Web Authorization Protocol WG - 1550 - = 1720 Duluth TSV taps Transport Services WG WEDNESDAY, July 18, 2018 0930-1200 Morning Session I Van Horne OPS anima Autonomic Networking Integrated Model = and Approach WG St-Paul/St-Cath RTG bier Bit Indexed Explicit Replication WG Duluth SEC *** suit Software Updates for Internet of Things = WG Place du Canada TSV quic QUIC WG 1330-1500 Afternoon Session I Laurier ART httpbis Hypertext Transfer Protocol WG Duluth INT *** 6tisch IPv6 over the TSCH mode of IEEE = 802.15.4e WG 1520-1650 Afternoon Session II Centre Ville INT homenet Home Networking WG Viger TSV tsvarea Transport Area Open Meeting THURSDAY, July 19, 2018 0930-1200 Morning Session I Duluth INT dnssd Extensions for Scalable DNS Service = Discovery WG Centre Ville INT *** lpwan IPv6 over Low Power Wide-Area Networks = WG Place du Canada IRTF maprg Measurement and Analysis for Protocols Viger SEC mls Messaging Layer Security WG Van Horne SEC oauth Web Authorization Protocol WG - 0930 - = 1100 1330-1530 Afternoon Session I Laurier OPS v6ops IPv6 Operations WG Centre Ville RTG rift Routing In Fat Trees WG Place du Canada SEC saag Security Area Open Meeting 1550-1750 Afternoon Session II Laurier IRTF*** t2trg Thing-to-Thing Viger OPS driu DNS Resolver Identification and Use BOF Centre Ville TSV tsvwg Transport Area Working Group WG 1810-1910 Afternoon Session III Van Horne ART *** core Constrained RESTful Environments WG Laurier SEC tls Transport Layer Security WG Centre Ville TSV tsvwg Transport Area Working Group WG FRIDAY, July 20, 2018 0930-1130 Morning Session I Centre Ville IRTF*** dinrg Decentralized Internet Infrastructure = Proposed RG Place du Canada OPS v6ops IPv6 Operations WG St-Paul/St-Cath TSV rmcat RTP Media Congestion Avoidance = Techniques WG 1150-1320 Afternoon Session I Duluth INT *** lwig Light-Weight Implementation Guidance WG Laurier IRTF panrg Path Aware Networking Proposed RG Centre Ville SEC tokbind Token Binding WG From nobody Tue Jul 3 08:06:07 2018 Return-Path: X-Original-To: teep@ietf.org Delivered-To: teep@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E498C130DE1; Tue, 3 Jul 2018 08:05:57 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: teep@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.81.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153063035780.5095.4334986260748390262@ietfa.amsl.com> Date: Tue, 03 Jul 2018 08:05:57 -0700 Archived-At: Subject: [Teep] I-D Action: draft-ietf-teep-opentrustprotocol-01.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Jul 2018 15:05:59 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Trusted Execution Environment Provisioning WG of the IETF. Title : The Open Trust Protocol (OTrP) Authors : Mingliang Pei Andrew Atyeo Nick Cook Minho Yoo Hannes Tschofenig Filename : draft-ietf-teep-opentrustprotocol-01.txt Pages : 111 Date : 2018-07-02 Abstract: This document specifies the Open Trust Protocol (OTrP), a protocol that follows the Trust Execution Environment Provisioning (TEEP) architecture and provides a message protocol that provisions and manages Trusted Applications into a device with a Trusted Execution Environment (TEE). The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-teep-opentrustprotocol/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-teep-opentrustprotocol-01 https://datatracker.ietf.org/doc/html/draft-ietf-teep-opentrustprotocol-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-teep-opentrustprotocol-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Jul 3 09:03:01 2018 Return-Path: X-Original-To: teep@ietf.org Delivered-To: teep@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C01A130FAE; Tue, 3 Jul 2018 09:00:16 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: teep@ietf.org, kaduk@mit.edu X-Test-IDTracker: no X-IETF-IDTracker: 6.81.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153063361604.4893.9212799533261017315.idtracker@ietfa.amsl.com> Date: Tue, 03 Jul 2018 09:00:16 -0700 Archived-At: Subject: [Teep] teep - Requested session has been scheduled for IETF 102 X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Jul 2018 16:00:24 -0000 Dear Nancy Cam-Winget, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. teep Session 1 (2:00 requested) Tuesday, 17 July 2018, Afternoon Session I 1330-1530 Room Name: Viger size: 200 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/102/sessions/teep.ics Request Information: --------------------------------------------------------- Working Group Name: Trusted Execution Environment Provisioning Area Name: Security Area Session Requester: Nancy Cam-Winget Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 75 Conflicts to Avoid: First Priority: mile core ace sacm t2trg suit oauth Second Priority: tls saag v6ops 6man intarea anima Third Priority: doh dots People who must be present: Dave Thaler Nancy Cam-Winget Benjamin Kaduk Resources Requested: Special Requests: --------------------------------------------------------- From nobody Wed Jul 4 07:49:10 2018 Return-Path: X-Original-To: teep@ietf.org Delivered-To: teep@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E2F8D126CC7; Wed, 4 Jul 2018 07:49:07 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: teep@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.81.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153071574775.27525.7336699878298332673@ietfa.amsl.com> Date: Wed, 04 Jul 2018 07:49:07 -0700 Archived-At: Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Jul 2018 14:49:09 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Trusted Execution Environment Provisioning WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP) Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-teep-architecture-00 https://datatracker.ietf.org/doc/html/draft-ietf-teep-architecture-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Jul 5 09:11:00 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5387130E70 for ; Thu, 5 Jul 2018 09:10:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zZ_VsO6w9tNM for ; Thu, 5 Jul 2018 09:10:54 -0700 (PDT) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5597D130E15 for ; Thu, 5 Jul 2018 09:10:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4124; q=dns/txt; s=iport; t=1530807054; x=1532016654; h=from:to:subject:date:message-id:mime-version; bh=2Ml/DAfpi5ddn+jCF/te27y6obnfHrToS+J/d6jlg24=; b=ci6/dXf4crqPnzimw7i+NegQu2n1YLqngxD5WrRda+vp2w42X7/rF6TK z3bA+XivkyMgq8rOu2QdhDdcYuzBGZsofKI3l5zhnBjyLZEZqRzyoIn3h yvEcDICxKe083kEE/CkCSNsXYTNgGdBGhkJqSq5zeuU+oI35cm1Jv3B5p w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BtAgCGQj5b/40NJK1cGgEBAQEBAgE?= =?us-ascii?q?BAQEIAQEBAYJTdmJ/KAqDcJQ4gWWQRIUOgXoLhQWCFiE1FwECAQECAQECbR0?= =?us-ascii?q?LhVoGaAEMDi0DAgQwFAMQBBODIAGBG2SpHoIchFuDcIE6iG2CFYEPJwyEHYY?= =?us-ascii?q?6MYIkAplMCQKPHgKBPoQMiAuRYgIREwGBJB8DM4FScBVlAYI+gjCOIm+POIE?= =?us-ascii?q?aAQE?= X-IronPort-AV: E=Sophos;i="5.51,313,1526342400"; d="scan'208,217";a="417654106" Received: from alln-core-8.cisco.com ([173.36.13.141]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jul 2018 16:10:40 +0000 Received: from XCH-RTP-011.cisco.com (xch-rtp-011.cisco.com [64.101.220.151]) by alln-core-8.cisco.com (8.14.5/8.14.5) with ESMTP id w65GAdJc021515 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Thu, 5 Jul 2018 16:10:40 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-011.cisco.com (64.101.220.151) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Thu, 5 Jul 2018 12:10:39 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1320.000; Thu, 5 Jul 2018 12:10:39 -0400 From: "Nancy Cam-Winget (ncamwing)" To: "teep@ietf.org" Thread-Topic: IETF102 TEEP call for Agenda Thread-Index: AQHUFHq3WB4jPTa+aUe2RKqfI0edBQ== Date: Thu, 5 Jul 2018 16:10:39 +0000 Message-ID: <91707432-3024-4B13-87CA-FAABB34E4C0C@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.c.0.180410 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.84.33] Content-Type: multipart/alternative; boundary="_000_9170743230244B1387CAFAABB34E4C0Cciscocom_" MIME-Version: 1.0 Archived-At: Subject: [Teep] IETF102 TEEP call for Agenda X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 16:10:57 -0000 --_000_9170743230244B1387CAFAABB34E4C0Cciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGVsbG8gVEVFUCBwYXJ0aWNpcGFudHMsDQoNCldlIHdpbGwgYmUgbWVldGluZyBhdCBJRVRGMTAy IFR1ZXNkYXksIDE3IEp1bHkgMjAxOCwgQWZ0ZXJub29uIFNlc3Npb24gSSAxMzMwLTE1MzANCg0K V2UgaGF2ZSBhIHR3byBob3VyIGJsb2NrIGFsbG9jYXRlZCB0byBhbGxvdyB1cyB0byBjb250aW51 ZSBvdXIgd29yayB3aXRoIHRoZSBPVHJQIGRyYWZ0IGFuZCB0aGUgbmV3bHkgcG9zdGVkIGFyY2hp dGVjdHVyZSBkcmFmdC4gIElmIHRoZXJlIGFyZSBvdGhlciByZXF1ZXN0cyBmb3IgcHJlc2VudGF0 aW9ucy9kaXNjdXNzaW9ucyBwbGVhc2Ugc2VuZCB1cyAodGVlcC1jaGFpcnNAaWV0Zi5vcmc8bWFp bHRvOnRlZXAtY2hhaXJzQGlldGYub3JnPikgcmVxdWVzdHMgZm9yIHRpbWUgc2xvdHMgYnkgSnVs eSAxMHRoLg0KDQpUaGFua3MsIE5hbmN5DQo= --_000_9170743230244B1387CAFAABB34E4C0Cciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <414E70616258B742A39A21248E00A938@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7fQ0KQHBhZ2UgV29yZFNl Y3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAx LjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5 bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5 NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5IZWxsbyBURUVQIHBhcnRpY2lwYW50cyw8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPldlIHdpbGwgYmUgbWVl dGluZyBhdCBJRVRGMTAyIFR1ZXNkYXksIDE3IEp1bHkgMjAxOCwgQWZ0ZXJub29uIFNlc3Npb24g SSAxMzMwLTE1MzA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPldl IGhhdmUgYSB0d28gaG91ciBibG9jayBhbGxvY2F0ZWQgdG8gYWxsb3cgdXMgdG8gY29udGludWUg b3VyIHdvcmsgd2l0aCB0aGUgT1RyUCBkcmFmdCBhbmQgdGhlIG5ld2x5IHBvc3RlZCBhcmNoaXRl Y3R1cmUgZHJhZnQuJm5ic3A7IElmIHRoZXJlIGFyZSBvdGhlciByZXF1ZXN0cyBmb3IgcHJlc2Vu dGF0aW9ucy9kaXNjdXNzaW9ucyBwbGVhc2Ugc2VuZCB1cyAoPGEgaHJlZj0ibWFpbHRvOnRlZXAt Y2hhaXJzQGlldGYub3JnIj50ZWVwLWNoYWlyc0BpZXRmLm9yZzwvYT4pDQogcmVxdWVzdHMgZm9y IHRpbWUgc2xvdHMgYnkgSnVseSAxMDxzdXA+dGg8L3N1cD4uPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGFua3MsIE5hbmN5IDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_9170743230244B1387CAFAABB34E4C0Cciscocom_-- From nobody Thu Jul 5 09:59:06 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E386130E19 for ; Thu, 5 Jul 2018 09:58:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nTM0j_oLDyM7 for ; Thu, 5 Jul 2018 09:58:56 -0700 (PDT) Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F980130EDC for ; Thu, 5 Jul 2018 09:58:54 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga105.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jul 2018 09:58:54 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,313,1526367600"; d="scan'208";a="64689859" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by orsmga003.jf.intel.com with ESMTP; 05 Jul 2018 09:58:42 -0700 Received: from fmsmsx120.amr.corp.intel.com (10.18.124.208) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 09:58:42 -0700 Received: from crsmsx103.amr.corp.intel.com (172.18.63.31) by fmsmsx120.amr.corp.intel.com (10.18.124.208) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 09:58:41 -0700 Received: from crsmsx102.amr.corp.intel.com ([169.254.2.60]) by CRSMSX103.amr.corp.intel.com ([169.254.4.183]) with mapi id 14.03.0319.002; Thu, 5 Jul 2018 10:58:40 -0600 From: "Wheeler, David M" To: "teep@ietf.org" Thread-Topic: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AQHUE6Y9Xr9n5+vFFECvNS2N8cLnxaSA18zA Date: Thu, 5 Jul 2018 16:58:40 +0000 Message-ID: <0627F5240443D2498FAA65332EE46C843B669ECC@CRSMSX102.amr.corp.intel.com> References: <153071574775.27525.7336699878298332673@ietfa.amsl.com> In-Reply-To: <153071574775.27525.7336699878298332673@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNzU3MWVmNzgtOTU1Zi00ZGIzLWE1ZTItYzQwOWZiZGM0MTY2IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiT0hsWG1KWnhuMzlJSTRWMHhsWEVqZ21zTWRHSElxbXJqMU9JajNFNmRhdm9BMkZrdHNveGhGSSs0ZkpwMTlsNyJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.200.100 dlp-reaction: no-action x-originating-ip: [172.18.205.10] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 16:58:59 -0000 Another comment on the new architecture draft: Section 3 is titled scope and assumptions, however the introduction of secu= rity domains and TA binaries seems to creep past the listed title, and jump= into concept definition. A Security Domain "feels" like a system component= , and yet section 5 does not have any such section - instead it has a secti= on on SD owners and cryptographic binding. I suggest a more complete section on security domains be added to section 5= , and section 3 paragraph be modified to something like the following: This specification assumes the existence of a Security Domain (SD) concept = which enables easier management of multiple Trusted Applications (TAs) by S= ervice Providers (SPs) and the TAM. The SD concept is further described in = section 5.x. The other confusion (for me) is the paragraph on TA binary and configuratio= n data coming from two different sources. This paragraph is not clearly sta= ted as an assumption, IMHO. The last sentence of the paragraph "The second case calls for an extension when a TAM is abs= ent." Does this mean that the current architecture does not provide for a Client = Application providing the TA binary? This seems problematic for me, because= this vector (Client App supplying the TA) is the exact vector used by Inte= l SGX. Is the assumption here that such vector will not be covered by the architec= ture? Why? Perhaps we can help correct that so it does not have to be defer= red until an extension. Thanks, Dave Wheeler -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-teep-architecture-00 https://datatracker.ietf.org/doc/html/draft-ietf-teep-architecture-00 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep From nobody Thu Jul 5 10:48:30 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4532E130EA5 for ; Thu, 5 Jul 2018 10:48:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UhTnqMqMbwP5 for ; Thu, 5 Jul 2018 10:48:26 -0700 (PDT) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75A35130E80 for ; Thu, 5 Jul 2018 10:48:26 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga106.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jul 2018 10:48:26 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,313,1526367600"; d="scan'208";a="70359598" Received: from fmsmsx104.amr.corp.intel.com ([10.18.124.202]) by orsmga001.jf.intel.com with ESMTP; 05 Jul 2018 10:48:25 -0700 Received: from fmsmsx113.amr.corp.intel.com (10.18.116.7) by fmsmsx104.amr.corp.intel.com (10.18.124.202) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 10:48:25 -0700 Received: from crsmsx103.amr.corp.intel.com (172.18.63.31) by FMSMSX113.amr.corp.intel.com (10.18.116.7) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 10:48:25 -0700 Received: from crsmsx102.amr.corp.intel.com ([169.254.2.60]) by CRSMSX103.amr.corp.intel.com ([169.254.4.183]) with mapi id 14.03.0319.002; Thu, 5 Jul 2018 11:48:23 -0600 From: "Wheeler, David M" To: "teep@ietf.org" Thread-Topic: Comments on: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUiFyKudTuNMtRRHCNwqD1TweQcA== Date: Thu, 5 Jul 2018 17:48:23 +0000 Message-ID: <0627F5240443D2498FAA65332EE46C843B669EFC@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZjQ2ZWIyMmUtMDc4ZS00MGJiLWI0NWEtNTZiOTQwNzQzNzlkIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiXC9pSmFtSVNaOEo1ZUVJUGxOQnhrQU9tS2dZejhxR2dqRDZtZVZWNmhnNzdhN2NId2hLQmt3WmpcLzd4K1NiXC9hMSJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.200.100 dlp-reaction: no-action x-originating-ip: [172.18.205.10] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Teep] Comments on: I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 17:48:29 -0000 Suggest the following modification to the definition of a "Certificate Auth= ority", in section 5.1 page 8, because the current definition does not actu= ally define what a CA is, but only talks about the relationship between the= TAM and the device.=20 Certification Authority (CA):=20 A Certificate Authority is a trusted entity that verifies the ident= ity and claims for other entities and issues signed certificates that communicate = verified claims. The level of verification performed by any particular CA may vary, = and=20 therefore different devices and device manufacturers may choose to = trust different CAs. =20 The certificate-based credentials issued by CAs are used for authenticating a device, a TAM and an SP. A device embeds a list of root certificates from CAs that it trusts, and maintains this l= ist as the set of "trust anchors" for the device. A device will valida= te a TAM's certificate against this list of CAs (trust anchors) to det= ermine if the TAM can be trusted by the device. A TAM will remotely attest a device and verify if the device's Roo= t-of-Trust Key is contained within a certificate signed by a CA that the TAM = trusts.=20 The CAs that sign the TAM certificate and that sign the device's R= oot-of-Trust certificate do not need to be the same; different CAs can be chos= en by each=20 TAM, and different device CAs can be used by different device manu= facturers. As long as the TAM trusts the CA that signs the device certificate= , and the device trusts the CA that signs the TAM certificate, the trust relationsh= ip between the TAM and the device will be accepted. =20 Dave Wheeler -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-teep-architecture-00 https://datatracker.ietf.org/doc/html/draft-ietf-teep-architecture-00 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep From nobody Thu Jul 5 10:50:30 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BA17130EA5 for ; Thu, 5 Jul 2018 10:50:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.011 X-Spam-Level: X-Spam-Status: No, score=-2.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sT4jE9WcMOht for ; Thu, 5 Jul 2018 10:50:25 -0700 (PDT) Received: from NAM05-CO1-obe.outbound.protection.outlook.com (mail-co1nam05on0720.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe50::720]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4213130F14 for ; Thu, 5 Jul 2018 10:50:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ixJtR11RjapFPkFAfdFS4OTvBikpT4UoSFy0JliYDVI=; b=TMNwBpTtpF79EG7f5kLddM+aQASLMKl1ealxbbhtWwM9rRDhPHrAvvfeHRbGycS+0Kt1HBoX4cG9VFX1h+CTtTLCr5jrtUTbpeUoTbkChBwzR0tHjt9p0RJei4RCiQwBOmhq8USqnC+zpZymwRSveVbo5QhPzU3KZvnHVPDrfeg= Received: from DM5PR2101MB0805.namprd21.prod.outlook.com (10.167.105.149) by DM5PR2101MB0998.namprd21.prod.outlook.com (52.132.133.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.952.4; Thu, 5 Jul 2018 17:50:23 +0000 Received: from DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::30ec:e30c:8f5c:b685]) by DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::30ec:e30c:8f5c:b685%2]) with mapi id 15.20.0952.008; Thu, 5 Jul 2018 17:50:23 +0000 From: Dave Thaler To: "Wheeler, David M" , "teep@ietf.org" Thread-Topic: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AQHUE6Yt8+UXJZ7E3UycFiERT3RPGKSA24wAgAAN4iA= Date: Thu, 5 Jul 2018 17:50:23 +0000 Message-ID: References: <153071574775.27525.7336699878298332673@ietfa.amsl.com> <0627F5240443D2498FAA65332EE46C843B669ECC@CRSMSX102.amr.corp.intel.com> In-Reply-To: <0627F5240443D2498FAA65332EE46C843B669ECC@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-07-05T17:50:21.7555929Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [73.59.106.235] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2101MB0998; 7:muIzqWQC63S8MPF+UXqCfmcgx4YN0ccRVJTjULtwLrGE86O69kzH/c5ks80fjVZObTyIHrUTYlqIZBqEhLcaVOzD9syVDCw5k7TxxT7jVb9sp2cR9CBAry7tK/zmpMRNlLPR9R0kfZqAmxFdpsjWmRKYWDLAbvB3hcLTWurO8caa5IOG1ntVTopZqwJpwVfsNwg6IcoMLy1Jtl0P+M03cGLXMFa6YSgpbqBrxRbOgStZ3yOU9BmjPyWEseI4xtAl x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 93b407f9-153f-45bd-a4ac-08d5e29fc89b x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7193020); SRVR:DM5PR2101MB0998; x-ms-traffictypediagnostic: DM5PR2101MB0998: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(10201501046)(93006095)(93001095)(3002001)(3231280)(2018427008)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011)(7699016); SRVR:DM5PR2101MB0998; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2101MB0998; x-forefront-prvs: 0724FCD4CD x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(136003)(376002)(366004)(39860400002)(346002)(189003)(199004)(7696005)(2900100001)(229853002)(53936002)(7736002)(26005)(305945005)(102836004)(76176011)(446003)(68736007)(33656002)(11346002)(25786009)(6246003)(486006)(106356001)(6506007)(74316002)(2906002)(86612001)(105586002)(476003)(97736004)(99286004)(110136005)(86362001)(9686003)(6436002)(316002)(55016002)(22452003)(8990500004)(478600001)(10090500001)(256004)(2501003)(5660300001)(66066001)(10290500003)(5250100002)(8936002)(81166006)(8676002)(186003)(81156014)(6116002)(14454004)(3846002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB0998; H:DM5PR2101MB0805.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: Kw5gzzJv04VI/rmTSo+rYUIo/24uY8JvVsttTWJT24wqBSD7bmNsXwq44mVfS53zGeeZW0s42Sfn9WaMvLUDkah+SX0Tgz7Ni+hfbm0HdlSxqARZGdJDeO7bVftQidAG/rF8jU0hI61AJfPwMwgqYiCIk+3yRbjthGkP3g8k/pqnBhvymfuccNvQKQSDZrnhNJdodh5tlofp5gxWCCtMmk34h3AYi1l5R/utM6joACfPA4Jy+haOqbmVFyeAc3fo/KlVW+ShTbgEp7QnngBC44v+nhuEMnVjJIeMrhUsztOIGKQyJUFRdiBT7kj8qzD7D30GIeH0Yw14J2tgUB6TKWbuNOTT1+TKKlVuGq+68wM= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 93b407f9-153f-45bd-a4ac-08d5e29fc89b X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Jul 2018 17:50:23.5593 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0998 Archived-At: Subject: Re: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 17:50:29 -0000 David Wheeler wrote: > Does this mean that the current architecture does not provide for a Clien= t Application providing the TA binary? > This seems problematic for me, because this vector (Client App supplying = the TA) is the exact vector used by Intel SGX. As shown in the original BOF poster, and the chairs presentations at IETF m= eetings, the WG needs to solve the case where the TA binary comes via either of two paths. So yes the architecture= needs to provide for it. Dave From nobody Thu Jul 5 10:51:07 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7679F130F66 for ; Thu, 5 Jul 2018 10:50:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symantec.com header.b=iKwVCi0v; dkim=pass (1024-bit key) header.d=symantec.com header.b=bjjL/ivd Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iv8qXylGaQgX for ; Thu, 5 Jul 2018 10:50:50 -0700 (PDT) Received: from asbsmtoutape02.symantec.com (asbsmtoutape02.symantec.com [155.64.138.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAB3E12DD85 for ; Thu, 5 Jul 2018 10:50:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=Symantec.com; s=2; c=relaxed/simple; q=dns/txt; i=@Symantec.com; t=1530813040; x=2394726640; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=06xR2mO4eYkr7a9fShzNH7EHEO4pnYQuI7dt2ERtEgY=; b=iKwVCi0vnXwGwg//tzheY37iqD3f3oYYxLWYcAiWAI+17w2pvVR5x0EbAeRINkvx 9w6To3qc+NyWnjFuNquekIow84t5Uo6xZNtztVML43YVyVFI4HY+hDglAzlpfOlI BzPBagVX6pS6DtekaxE+9qZlOgZFVl6UUCu9uq5Poao=; Received: from asbsmtmtaapi01.symc.symantec.com (asb1-f5-symc-ext-prd-snat1.net.symantec.com [10.90.75.1]) by asbsmtoutape02.symantec.com (Symantec Messaging Gateway) with SMTP id 92.62.41495.F6A5E3B5; Thu, 5 Jul 2018 17:50:39 +0000 (GMT) X-AuditID: 0a5af81a-b7aee9e00001a217-ba-5b3e5a6fbebc Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat4.net.symantec.com [10.90.75.4]) by asbsmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 27.22.00857.F6A5E3B5; Thu, 5 Jul 2018 17:50:39 +0000 (GMT) Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 5 Jul 2018 10:50:38 -0700 Received: from NAM01-BY2-obe.outbound.protection.outlook.com (10.44.128.4) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Thu, 5 Jul 2018 10:50:38 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symantec.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=06xR2mO4eYkr7a9fShzNH7EHEO4pnYQuI7dt2ERtEgY=; b=bjjL/ivdeU26eRIuEWs/mOcZ6YTo5Hyfh7WujZy5tZCR0471cxPvwQEeoLl4n6nrWkMJzzNS+8O9JL3aNp86oiyHeCZyznGKRJzby6a+olpm5oWyzvPS5teEO5dyhHxlKMkErqqmTqub6ICRAKJJI5zDnKyI8j1Efp3gg9QXzHU= Received: from BL0PR16MB2260.namprd16.prod.outlook.com (52.132.28.27) by BL0PR16MB2177.namprd16.prod.outlook.com (52.132.27.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.906.26; Thu, 5 Jul 2018 17:50:37 +0000 Received: from BL0PR16MB2260.namprd16.prod.outlook.com ([fe80::c016:d0d7:8777:29a1]) by BL0PR16MB2260.namprd16.prod.outlook.com ([fe80::c016:d0d7:8777:29a1%5]) with mapi id 15.20.0930.016; Thu, 5 Jul 2018 17:50:37 +0000 From: Mingliang Pei To: "Wheeler, David M" , "teep@ietf.org" Thread-Topic: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AQHUE6Y+nMafALo76EyyEAwxRzVJf6SA24wA//+ZKQA= Date: Thu, 5 Jul 2018 17:50:36 +0000 Message-ID: <6CBD4920-BCF3-4A42-8AA4-07D0BDF3490E@symantec.com> References: <153071574775.27525.7336699878298332673@ietfa.amsl.com> <0627F5240443D2498FAA65332EE46C843B669ECC@CRSMSX102.amr.corp.intel.com> In-Reply-To: <0627F5240443D2498FAA65332EE46C843B669ECC@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.d.1.180523 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Mingliang_Pei@symantec.com; x-originating-ip: [155.64.23.48] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BL0PR16MB2177; 7:vh0DkeLAUAopKQpYJ0DMyhYbDQs0Zu5UnskWFiWRfCSjLZZOVOmLFkOqXpRqx7zHcuDuWylNsmEPjHyDbmwtqh/uUFGIMaqogoizv2nODRJ1s6KZY3ES4csqBGx7ZLonQ4NQBtPKmzFinpRXDCv+qj/OTwWRoR4SxPMWHOSQ8dVn5ZaO0s57o/kbXik1iNn1HiNqQkBmcycpsMDioBP1MWLOgyLauxG8xrM01gSu4k6HY726nJknCp7UnVKuT6PC x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 2f73bc10-0cbd-431b-af44-08d5e29fd0b0 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:BL0PR16MB2177; x-ms-traffictypediagnostic: BL0PR16MB2177: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(258766100185102)(228905959029699)(17755550239193); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3231254)(944501410)(52105095)(3002001)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123560045)(20161123558120)(20161123562045)(6072148)(201708071742011)(7699016); SRVR:BL0PR16MB2177; BCL:0; PCL:0; RULEID:; SRVR:BL0PR16MB2177; x-forefront-prvs: 0724FCD4CD x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(376002)(39860400002)(366004)(396003)(346002)(13464003)(189003)(199004)(102836004)(446003)(53546011)(99286004)(25786009)(7736002)(11346002)(476003)(82746002)(8936002)(2900100001)(66066001)(2501003)(14454004)(6306002)(6512007)(105586002)(486006)(76176011)(53936002)(83716003)(2616005)(5250100002)(36756003)(106356001)(575784001)(33656002)(6436002)(10290500003)(229853002)(5660300001)(86362001)(110136005)(72206003)(68736007)(478600001)(345774005)(97736004)(80792005)(6506007)(6116002)(81156014)(316002)(6486002)(26005)(305945005)(8676002)(966005)(3846002)(81166006)(186003)(2906002)(256004)(14444005)(6246003)(58126008); DIR:OUT; SFP:1101; SCL:1; SRVR:BL0PR16MB2177; H:BL0PR16MB2260.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: yOuOI3wj1m5qJSrDlKasv5u/EPfSenRdfg+y1yjaE3Efl2xo6iGwAeqINb6anKvizsDKkCiVXE1HgDu+Fcuv8BOG8kLY9cHAtWiuV5Jj+Y6vInVNLBndYdJi0hyFHKKxnf+7AAYWa/MyPKICAiPj3LaO0DcV4Ht+XNQxE4JrsWJtX/Pkz4fsZ/8F0QN8/DFAcOZV7VFHFnJbB2raAzJpW1mXNt1tbIoRS64/HsyeYvghPPOG1USdkH7PpAepdX6Gi/jdNitJRrbFBsl0uPdSM9iBuAUYhs3zJ7XcIA5f3yEimRq4lrFrjgDpMx8K8SNx9nqS4mr4bBHCABSdb884QMdu25+3CEgcB/0LtmYxJ3Y= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <59A12201B3F4EA43B9C3F8CC37EE916B@namprd16.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 2f73bc10-0cbd-431b-af44-08d5e29fd0b0 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Jul 2018 17:50:36.9539 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR16MB2177 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprBKsWRmVeSWpSXmKPExsXCFeXNqJsfZRdt0PTZxqLp4ik2i6V/vjE7 MHksWfKTyWPxnpdMAUxRXDYpqTmZZalF+nYJXBnXJtQVNARU9E1eyd7A+MO3i5GTQ0LARGL1 hkWsXYxcHEICHxkl9qxrYoJJrH/+mw0i8Y1R4sucK1DOYUaJ+weeskM4zxklDj2cC5ZhEZjA LHHq0GOozAQmidddP5ghnIeMErtXLwVyODjYBAwkLtzJAzFFBEIldn7gBjGFBZwlJmzMAlkt IuAicWHPHBYI20qicdVHdpASFgEViTPTYkDCvAL2EjeOHWKEGN7LKDHxfQ9YPadAiMSf5WfY QWxGATGJ76fWgL3DLCAucevJfKjXBCSW7DnPDGGLSrx8/I8VxBYV0JPo2XmVDaI3VuJnywNG kL0SAgoSq5tTIcplJS7N7wbbKyGwhUli0qQWNoiErsSHqVOhZvpKrPxzD6roAqNE0/cPUEVa EsdmN7NA2NkSW3Z8YZ7AaDYLyX2zgPYxC2hKrN+lD2F6SPRvzYaoUJSY0v2QfRbY+4ISJ2c+ YVnAyLqKUSGxOKk4tyS/tCSxINXASK+4MjcZRCQCU0uyXnJ+7iZGcHr5IbWD8ckdn0OMAhyM Sjy838LsooVYE8uAKg8xSnAwK4nw7g0ECvGmJFZWpRblxxeV5qQWH2KU5mBREue9zTs9Skgg PbEkNTs1tSC1CCbLxMEp1cC46HrnIl3LgA+dz1mY5gfnrr7z98vC9sa9Cv/sfbyWumRprYxk OTYp8Qz/asnn2dNyvqYqzJhesPrnXau4dkaGXaY/T1zoa1JU8Xikv26zU7bAmy/7YxnVVNXL 4hWDJz/yyH6QFZOuduYxg/tZ3ZkHFrMp+5zf9diI+/0c3a2HXswpVuni9l+oxFKckWioxVxU nAgAcIEPAysDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrDIsWRmVeSWpSXmKPExsXCFeXNopsfZRdt0HPIyqLp4ik2i6V/vjE7 MHksWfKTyWPxnpdMAUxRXDYpqTmZZalF+nYJXBnXJtQVNARU9E1eyd7A+MO3i5GTQ0LARGL9 899sXYxcHEIC3xglvsy5AuUcZpS4f+ApO4TznFHi0MO5YBkWgQnMEqcOPYbKTGCSeN31gxnC ecgosXv1UiCHg4NNwEDiwp08EFNEIFRi5wduEFNYwFliwsYskNUiAi4SF/bMYYGwrSQaV31k BylhEVCRODMtBiTMK2AvcePYIUaI4b2MEhPf94DVcwqESPxZfoYdxGYUEJP4fmoNE4jNLCAu cevJfCaI1wQkluw5zwxhi0q8fPyPFcQWFdCT6Nl5lQ2iN1biZ8sDRpC9EgIKEqubUyHKZSUu ze8G2yshsIVJYtKkFjaIhK7Eh6lToWb6Sqz8cw+q6AKjRNP3D1BFWhLHZjezQNjZElt2fIFq qJM4fP4WK4QtJ7Gq9yHLBEajWUjungV0B7OApsT6XfoQpodE/9ZsiApFiSndD9lngYNFUOLk zCcsCxhZVzEqJBYnFeeW5JYkJhZkGhjqFVfmJoOIRGBiSdZLzs/dxAhOLr/FdjAe+ONziFGA g1GJhzdC1i5aiDWxDKjyEKM0B4uSOK88980oIYH0xJLU7NTUgtSi+KLSnNTiQ4xMHJxSDYya Z7X6Xf/OLju2PLKt9+jONeeXrldast/XNetJRMT6h//u3OZ7P/vV/uXh55rFjyx+cfn9tXt3 fD+Yb5Y1e24YW9xlcmL/6+N2varrlS7x+qhyVu1l2mA9p77/hWp0mZLOt555JXZXZhp8c8zT iMmK6kj4qG61Zfe6ZbWznhqzrKo9qPL7e6y8EktxRqKhFnNRcSIA9yTmkw8DAAA= X-CFilter-Loop: ASB03 Archived-At: Subject: Re: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 17:51:01 -0000 SGkgRGF2aWQsDQoNClRoYW5rIHlvdSBmb3IgcmV2aWV3aW5nIHRoZSBkcmFmdCwgYW5kIHlvdXIg c3VnZ2VzdGlvbnMuIFdlIG1hZGUgU0QgdXNhZ2UgYW5kIFRBIGJpbmFyeSBhcyBwYXJ0IG9mICJh c3N1bXB0aW9ucyIgZm9yIHRoZSBzeXN0ZW0gZGVzaWduLiBJbiB0aGUgc2VjdGlvbiA1LCBzeXN0 ZW0gY29tcG9uZW50cyB0cmllZCB0byBjb3ZlciB0aGUgaGlnaCBsZXZlbCBtYWpvciBjb21wb25l bnRzIHdoZXJlIFNEIGFuZCBUQSBhcmUgcGFydCBvZiBlbnRpdGllcyB1c2VkIGluc2lkZSBhIFRF RSBmb3Igc3VwcG9ydCB0aGUgVEVFUC4gSSBhZ3JlZSB3aXRoIHlvdXIgc3VnZ2VzdGlvbjsgdGhh bmtzLiBBIHNlY3Rpb24gb24gU0QgYWxvbmUgaW4gc2VjdGlvbiA1IGFsb25lIGNhbiBoZWxwIGNs YXJpZnkgdGhpcyBiZXR0ZXIuDQoNCk9uIHRoZSBUQSBiaW5hcnkgZGlzdHJpYnV0aW9uIGZyb20g YSBjbGllbnQgYXBwLCBJIHdvdWxkIGxpa2UgdG8gaGVhciB5b3VyIHN1Z2dlc3Rpb25zIHRvby4g VGhlIHJlYXNvbiB0aGF0ICJjb25maWd1cmF0aW9uIGRhdGEiIG5lZWRzIHRvIGJlIGZyb20gYSBk aWZmZXJlbnQgc291cmNlIGlzIGhvdyBhIGNsaWVudCBoYXMgZHluYW1pYyBkYXRhIHBlciBkZXZp Y2UgaWYgaXQgaXMgZG93bmxvYWRlZCBmcm9tIGFuIGFwcCBzdG9yZSAobW9iaWxlIGNhc2UpLiBC dXQgSSB3b3VsZCBsaWtlIHRvIHNlZSBob3cgU0dYIGNhc2UgYmUgY292ZXJlZCBoZXJlLiBBcHBy ZWNpYXRlIHlvdXIgaGVscCBvbiBob3cgeW91IHdvdWxkIHN1Z2dlc3QgdG8gc3VwcG9ydCBkeW5h bWljIGNvbmZpZ3VyYXRpb24gZGF0YSBpbiBhIFNHWCBmcm9tIGEgY2xpZW50IGFwcCwgb3IgdGhl IGNhc2UgZG9lc24ndCBhcHBseT8NCg0KVGhhbmtzLA0KDQpNaW5nDQoNCu+7v09uIDcvNS8xOCwg OTo1OSBBTSwgIlRFRVAgb24gYmVoYWxmIG9mIFdoZWVsZXIsIERhdmlkIE0iIDx0ZWVwLWJvdW5j ZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIGRhdmlkLm0ud2hlZWxlckBpbnRlbC5jb20+IHdyb3Rl Og0KDQogICAgQW5vdGhlciBjb21tZW50IG9uIHRoZSBuZXcgYXJjaGl0ZWN0dXJlIGRyYWZ0Og0K ICAgIA0KICAgIFNlY3Rpb24gMyBpcyB0aXRsZWQgc2NvcGUgYW5kIGFzc3VtcHRpb25zLCBob3dl dmVyIHRoZSBpbnRyb2R1Y3Rpb24gb2Ygc2VjdXJpdHkgZG9tYWlucyBhbmQgVEEgYmluYXJpZXMg c2VlbXMgdG8gY3JlZXAgcGFzdCB0aGUgbGlzdGVkIHRpdGxlLCBhbmQganVtcCBpbnRvIGNvbmNl cHQgZGVmaW5pdGlvbi4gQSBTZWN1cml0eSBEb21haW4gImZlZWxzIiBsaWtlIGEgc3lzdGVtIGNv bXBvbmVudCwgYW5kIHlldCBzZWN0aW9uIDUgZG9lcyBub3QgaGF2ZSBhbnkgc3VjaCBzZWN0aW9u IC0gaW5zdGVhZCBpdCBoYXMgYSBzZWN0aW9uIG9uIFNEIG93bmVycyBhbmQgY3J5cHRvZ3JhcGhp YyBiaW5kaW5nLg0KICAgIA0KICAgIEkgc3VnZ2VzdCBhIG1vcmUgY29tcGxldGUgc2VjdGlvbiBv biBzZWN1cml0eSBkb21haW5zIGJlIGFkZGVkIHRvIHNlY3Rpb24gNSwgYW5kIHNlY3Rpb24gMyBw YXJhZ3JhcGggYmUgbW9kaWZpZWQgdG8gc29tZXRoaW5nIGxpa2UgdGhlIGZvbGxvd2luZzoNCiAg ICANCiAgICBUaGlzIHNwZWNpZmljYXRpb24gYXNzdW1lcyB0aGUgZXhpc3RlbmNlIG9mIGEgU2Vj dXJpdHkgRG9tYWluIChTRCkgY29uY2VwdCB3aGljaCBlbmFibGVzIGVhc2llciBtYW5hZ2VtZW50 IG9mIG11bHRpcGxlIFRydXN0ZWQgQXBwbGljYXRpb25zIChUQXMpIGJ5IFNlcnZpY2UgUHJvdmlk ZXJzIChTUHMpIGFuZCB0aGUgVEFNLiBUaGUgU0QgY29uY2VwdCBpcyBmdXJ0aGVyIGRlc2NyaWJl ZCBpbiBzZWN0aW9uIDUueC4NCiAgICANCiAgICANCiAgICBUaGUgb3RoZXIgY29uZnVzaW9uIChm b3IgbWUpIGlzIHRoZSBwYXJhZ3JhcGggb24gVEEgYmluYXJ5IGFuZCBjb25maWd1cmF0aW9uIGRh dGEgY29taW5nIGZyb20gdHdvIGRpZmZlcmVudCBzb3VyY2VzLiBUaGlzIHBhcmFncmFwaCBpcyBu b3QgY2xlYXJseSBzdGF0ZWQgYXMgYW4gYXNzdW1wdGlvbiwgSU1ITy4gVGhlIGxhc3Qgc2VudGVu Y2Ugb2YgdGhlIHBhcmFncmFwaA0KICAgICAgICAgICAgICAgICAgICAgICJUaGUgc2Vjb25kIGNh c2UgY2FsbHMgZm9yIGFuIGV4dGVuc2lvbiB3aGVuIGEgVEFNIGlzIGFic2VudC4iDQogICAgRG9l cyB0aGlzIG1lYW4gdGhhdCB0aGUgY3VycmVudCBhcmNoaXRlY3R1cmUgZG9lcyBub3QgcHJvdmlk ZSBmb3IgYSBDbGllbnQgQXBwbGljYXRpb24gcHJvdmlkaW5nIHRoZSBUQSBiaW5hcnk/IFRoaXMg c2VlbXMgcHJvYmxlbWF0aWMgZm9yIG1lLCBiZWNhdXNlIHRoaXMgdmVjdG9yIChDbGllbnQgQXBw IHN1cHBseWluZyB0aGUgVEEpIGlzIHRoZSBleGFjdCB2ZWN0b3IgdXNlZCBieSBJbnRlbCBTR1gu DQogICAgDQogICAgSXMgdGhlIGFzc3VtcHRpb24gaGVyZSB0aGF0IHN1Y2ggdmVjdG9yIHdpbGwg bm90IGJlIGNvdmVyZWQgYnkgdGhlIGFyY2hpdGVjdHVyZT8gV2h5PyBQZXJoYXBzIHdlIGNhbiBo ZWxwIGNvcnJlY3QgdGhhdCBzbyBpdCBkb2VzIG5vdCBoYXZlIHRvIGJlIGRlZmVycmVkIHVudGls IGFuIGV4dGVuc2lvbi4NCiAgICANCiAgICBUaGFua3MsDQogICAgRGF2ZSBXaGVlbGVyDQogICAg DQogICAgDQogICAgLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCiAgICBGcm9tOiBURUVQIFtt YWlsdG86dGVlcC1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgaW50ZXJuZXQtZHJhZnRz QGlldGYub3JnDQogICAgU2VudDogV2VkbmVzZGF5LCBKdWx5IDQsIDIwMTggNzo0OSBBTQ0KICAg IFRvOiBpLWQtYW5ub3VuY2VAaWV0Zi5vcmcNCiAgICBDYzogdGVlcEBpZXRmLm9yZw0KICAgIFN1 YmplY3Q6IFtUZWVwXSBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlLTAw LnR4dA0KICAgIA0KICAgIA0KICAgIEEgTmV3IEludGVybmV0LURyYWZ0IGlzIGF2YWlsYWJsZSBm cm9tIHRoZSBvbi1saW5lIEludGVybmV0LURyYWZ0cyBkaXJlY3Rvcmllcy4NCiAgICBUaGlzIGRy YWZ0IGlzIGEgd29yayBpdGVtIG9mIHRoZSBUcnVzdGVkIEV4ZWN1dGlvbiBFbnZpcm9ubWVudCBQ cm92aXNpb25pbmcgV0cgb2YgdGhlIElFVEYuDQogICAgDQogICAgICAgICAgICBUaXRsZSAgICAg ICAgICAgOiBUcnVzdGVkIEV4ZWN1dGlvbiBFbnZpcm9ubWVudCBQcm92aXNpb25pbmcgKFRFRVAp IEFyY2hpdGVjdHVyZQ0KICAgICAgICAgICAgQXV0aG9ycyAgICAgICAgIDogTWluZ2xpYW5nIFBl aQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSGFubmVzIFRzY2hvZmVuaWcNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEFuZHJldyBBdHllbw0KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgRGFwZW5nDQogICAgCUZpbGVuYW1lICAgICAgICA6IGRyYWZ0LWlldGYtdGVl cC1hcmNoaXRlY3R1cmUtMDAudHh0DQogICAgCVBhZ2VzICAgICAgICAgICA6IDI0DQogICAgCURh dGUgICAgICAgICAgICA6IDIwMTgtMDctMDINCiAgICANCiAgICBBYnN0cmFjdDoNCiAgICAgICBB IFRydXN0ZWQgRXhlY3V0aW9uIEVudmlyb25tZW50IChURUUpIHdhcyBkZXNpZ25lZCB0byBwcm92 aWRlIGENCiAgICAgICBoYXJkd2FyZS1pc29sYXRpb24gbWVjaGFuaXNtIHRvIHNlcGFyYXRlIGEg cmVndWxhciBvcGVyYXRpbmcgc3lzdGVtDQogICAgICAgZnJvbSBzZWN1cml0eS0gc2Vuc2l0aXZl IGFwcGxpY2F0aW9ucy4NCiAgICANCiAgICAgICBUaGlzIGFyY2hpdGVjdHVyZSBkb2N1bWVudCBt b3RpdmF0ZXMgdGhlIGRlc2lnbiBhbmQgc3RhbmRhcmRpemF0aW9uDQogICAgICAgb2YgYSBwcm90 b2NvbCBmb3IgbWFuYWdpbmcgdGhlIGxpZmVjeWxlIG9mIHRydXN0ZWQgYXBwbGljYXRpb25zDQog ICAgICAgcnVubmluZyBpbnNpZGUgYSBURUUuDQogICAgDQogICAgDQogICAgVGhlIElFVEYgZGF0 YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQogICAgaHR0cHM6Ly9jbGlj a3RpbWUuc3ltYW50ZWMuY29tL2EvMS83LXcyX0ZRT1hSTWkyRG41V3dLRF8weTlwdzJFRklXOXhr QWJVem9WNy00PT9kPUszOW4wV2x1enFBQ01lamJyNXZwbVFpd3hEUGVseUNFT1VxcGZLQnJ6eXpk SkFDcFlDTXhRQnRZdjI4WVNSQnJ3cGpRenZoY3VveEZtMjd3djNRa1gtdjA5WXBkT3l6YUd0QXlf MFN2SlgwZ0JaTmx2WVVTem16aW1POW5oWFEteHpYbXYwYXdydElvcldNWTBIZ2xHZWtMdThaVFVj aGZxYm9QbVd1dTF3OUd1RTNiZGNCUGxmbEJCU3VwSE5PYkFTeDFYZkptakRBNnNuVXpQU2NWNDd0 RnZ0MG1BMjhOWnRabHVHTkkxV2RCbXd0TktjSjB4UEJCQ2o0alNxaG9kM3A0WHMxVDl0Z2lZYnkw aHVhcE5XNTgyT216SEdtWDdheEt1U2w2MndmeUUzWVhkYnQ3RW9kS1hldjJLUXlhYmVXWFE1OU1p TXk2cTl6QlA0bGhWYlRZVFhRSkdxOHVVWVp3UzRHcmlINWxWVzA0T1BLV1ppb3hNY2dvYTdtQUUt dF9PeTVxSmFpYmNESkcyempjYjBTX24wUUY5QWFKWVlaM3lMbERXQlZiaUYyN0hYOGMmdT1odHRw cyUzQSUyRiUyRmRhdGF0cmFja2VyLmlldGYub3JnJTJGZG9jJTJGZHJhZnQtaWV0Zi10ZWVwLWFy Y2hpdGVjdHVyZSUyRg0KICAgIA0KICAgIFRoZXJlIGFyZSBhbHNvIGh0bWxpemVkIHZlcnNpb25z IGF2YWlsYWJsZSBhdDoNCiAgICBodHRwczovL2NsaWNrdGltZS5zeW1hbnRlYy5jb20vYS8xLzRS WXhnd0FPMUhQaWc3YkxkYUYzRTctYnRidWZjQmptQVVEZHJSU20yaUU9P2Q9SzM5bjBXbHV6cUFD TWVqYnI1dnBtUWl3eERQZWx5Q0VPVXFwZktCcnp5emRKQUNwWUNNeFFCdFl2MjhZU1JCcndwalF6 dmhjdW94Rm0yN3d2M1FrWC12MDlZcGRPeXphR3RBeV8wU3ZKWDBnQlpObHZZVVN6bXppbU85bmhY US14elhtdjBhd3J0SW9yV01ZMEhnbEdla0x1OFpUVWNoZnFib1BtV3V1MXc5R3VFM2JkY0JQbGZs QkJTdXBITk9iQVN4MVhmSm1qREE2c25VelBTY1Y0N3RGdnQwbUEyOE5adFpsdUdOSTFXZEJtd3RO S2NKMHhQQkJDajRqU3Fob2QzcDRYczFUOXRnaVlieTBodWFwTlc1ODJPbXpIR21YN2F4S3VTbDYy d2Z5RTNZWGRidDdFb2RLWGV2MktReWFiZVdYUTU5TWlNeTZxOXpCUDRsaFZiVFlUWFFKR3E4dVVZ WndTNEdyaUg1bFZXMDRPUEtXWmlveE1jZ29hN21BRS10X095NXFKYWliY0RKRzJ6amNiMFNfbjBR RjlBYUpZWVozeUxsRFdCVmJpRjI3SFg4YyZ1PWh0dHBzJTNBJTJGJTJGdG9vbHMuaWV0Zi5vcmcl MkZodG1sJTJGZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVjdHVyZS0wMA0KICAgIGh0dHBzOi8vY2xp Y2t0aW1lLnN5bWFudGVjLmNvbS9hLzEvTEsySE1pdmswX1NRWHNCMVVZNUh4VFBydnRwcF9jWHR5 YUthc3doLW1Edz0/ZD1LMzluMFdsdXpxQUNNZWpicjV2cG1RaXd4RFBlbHlDRU9VcXBmS0Jyenl6 ZEpBQ3BZQ014UUJ0WXYyOFlTUkJyd3BqUXp2aGN1b3hGbTI3d3YzUWtYLXYwOVlwZE95emFHdEF5 XzBTdkpYMGdCWk5sdllVU3ptemltTzluaFhRLXh6WG12MGF3cnRJb3JXTVkwSGdsR2VrTHU4WlRV Y2hmcWJvUG1XdXUxdzlHdUUzYmRjQlBsZmxCQlN1cEhOT2JBU3gxWGZKbWpEQTZzblV6UFNjVjQ3 dEZ2dDBtQTI4Tlp0Wmx1R05JMVdkQm13dE5LY0oweFBCQkNqNGpTcWhvZDNwNFhzMVQ5dGdpWWJ5 MGh1YXBOVzU4Mk9tekhHbVg3YXhLdVNsNjJ3ZnlFM1lYZGJ0N0VvZEtYZXYyS1F5YWJlV1hRNTlN aU15NnE5ekJQNGxoVmJUWVRYUUpHcTh1VVlad1M0R3JpSDVsVlcwNE9QS1daaW94TWNnb2E3bUFF LXRfT3k1cUphaWJjREpHMnpqY2IwU19uMFFGOUFhSllZWjN5TGxEV0JWYmlGMjdIWDhjJnU9aHR0 cHMlM0ElMkYlMkZkYXRhdHJhY2tlci5pZXRmLm9yZyUyRmRvYyUyRmh0bWwlMkZkcmFmdC1pZXRm LXRlZXAtYXJjaGl0ZWN0dXJlLTAwDQogICAgDQogICAgDQogICAgUGxlYXNlIG5vdGUgdGhhdCBp dCBtYXkgdGFrZSBhIGNvdXBsZSBvZiBtaW51dGVzIGZyb20gdGhlIHRpbWUgb2Ygc3VibWlzc2lv biB1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0IHRv b2xzLmlldGYub3JnLg0KICAgIA0KICAgIEludGVybmV0LURyYWZ0cyBhcmUgYWxzbyBhdmFpbGFi bGUgYnkgYW5vbnltb3VzIEZUUCBhdDoNCiAgICBmdHA6Ly9mdHAuaWV0Zi5vcmcvaW50ZXJuZXQt ZHJhZnRzLw0KICAgIA0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQogICAgVEVFUCBtYWlsaW5nIGxpc3QNCiAgICBURUVQQGlldGYub3JnDQogICAg aHR0cHM6Ly9jbGlja3RpbWUuc3ltYW50ZWMuY29tL2EvMS9aY3hNTUdSbDE1cmF2X3U3UHZPRzBF emFLZ0FNZUx1NjRhLTFodEp0UVg4PT9kPUszOW4wV2x1enFBQ01lamJyNXZwbVFpd3hEUGVseUNF T1VxcGZLQnJ6eXpkSkFDcFlDTXhRQnRZdjI4WVNSQnJ3cGpRenZoY3VveEZtMjd3djNRa1gtdjA5 WXBkT3l6YUd0QXlfMFN2SlgwZ0JaTmx2WVVTem16aW1POW5oWFEteHpYbXYwYXdydElvcldNWTBI Z2xHZWtMdThaVFVjaGZxYm9QbVd1dTF3OUd1RTNiZGNCUGxmbEJCU3VwSE5PYkFTeDFYZkptakRB NnNuVXpQU2NWNDd0RnZ0MG1BMjhOWnRabHVHTkkxV2RCbXd0TktjSjB4UEJCQ2o0alNxaG9kM3A0 WHMxVDl0Z2lZYnkwaHVhcE5XNTgyT216SEdtWDdheEt1U2w2MndmeUUzWVhkYnQ3RW9kS1hldjJL UXlhYmVXWFE1OU1pTXk2cTl6QlA0bGhWYlRZVFhRSkdxOHVVWVp3UzRHcmlINWxWVzA0T1BLV1pp b3hNY2dvYTdtQUUtdF9PeTVxSmFpYmNESkcyempjYjBTX24wUUY5QWFKWVlaM3lMbERXQlZiaUYy N0hYOGMmdT1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUy RnRlZXANCiAgICANCiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KICAgIFRFRVAgbWFpbGluZyBsaXN0DQogICAgVEVFUEBpZXRmLm9yZw0KICAgIGh0 dHBzOi8vY2xpY2t0aW1lLnN5bWFudGVjLmNvbS9hLzEvWmN4TU1HUmwxNXJhdl91N1B2T0cwRXph S2dBTWVMdTY0YS0xaHRKdFFYOD0/ZD1LMzluMFdsdXpxQUNNZWpicjV2cG1RaXd4RFBlbHlDRU9V cXBmS0Jyenl6ZEpBQ3BZQ014UUJ0WXYyOFlTUkJyd3BqUXp2aGN1b3hGbTI3d3YzUWtYLXYwOVlw ZE95emFHdEF5XzBTdkpYMGdCWk5sdllVU3ptemltTzluaFhRLXh6WG12MGF3cnRJb3JXTVkwSGds R2VrTHU4WlRVY2hmcWJvUG1XdXUxdzlHdUUzYmRjQlBsZmxCQlN1cEhOT2JBU3gxWGZKbWpEQTZz blV6UFNjVjQ3dEZ2dDBtQTI4Tlp0Wmx1R05JMVdkQm13dE5LY0oweFBCQkNqNGpTcWhvZDNwNFhz MVQ5dGdpWWJ5MGh1YXBOVzU4Mk9tekhHbVg3YXhLdVNsNjJ3ZnlFM1lYZGJ0N0VvZEtYZXYyS1F5 YWJlV1hRNTlNaU15NnE5ekJQNGxoVmJUWVRYUUpHcTh1VVlad1M0R3JpSDVsVlcwNE9QS1daaW94 TWNnb2E3bUFFLXRfT3k1cUphaWJjREpHMnpqY2IwU19uMFFGOUFhSllZWjN5TGxEV0JWYmlGMjdI WDhjJnU9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0 ZWVwDQogICAgDQoNCg== From nobody Thu Jul 5 11:04:05 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49DA912DD85 for ; Thu, 5 Jul 2018 11:04:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symantec.com header.b=drBtmgcS; dkim=pass (1024-bit key) header.d=symantec.com header.b=0c6bbFUC Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id soXIGK8Ifo5u for ; Thu, 5 Jul 2018 11:04:00 -0700 (PDT) Received: from asbsmtoutape02.symantec.com (asbsmtoutape02.symantec.com [155.64.138.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE0D512F1AB for ; Thu, 5 Jul 2018 11:03:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=Symantec.com; s=2; c=relaxed/simple; q=dns/txt; i=@Symantec.com; t=1530813839; x=2394727439; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=UnlIvKlzfkNMN8JjgQyIs8oUyRKUrXwNEaB81RhK7Y4=; b=drBtmgcSs2b/q7sB+0XOkl/NBdBYXEErRJcz6OcInNvW3AG7CpbgJ0USpizt0YSe GjSXW+i6xzqkVTE7Cm+fQGoooPpdoZkoqGMlPwW1gtQzlDVreB08r9f1hZlr+iWf 5uBYEenUal2CoS2l5akbbxU5sf//yRUUksKFRtIG4Bk=; Received: from asbsmtmtaapi01.symc.symantec.com (asb1-f5-symc-ext-prd-snat8.net.symantec.com [10.90.75.8]) by asbsmtoutape02.symantec.com (Symantec Messaging Gateway) with SMTP id 3D.23.41495.F8D5E3B5; Thu, 5 Jul 2018 18:03:59 +0000 (GMT) X-AuditID: 0a5af81a-b7aee9e00001a217-e8-5b3e5d8f39b4 Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat3.net.symantec.com [10.90.75.3]) by asbsmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 98.53.00857.E8D5E3B5; Thu, 5 Jul 2018 18:03:59 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 5 Jul 2018 11:03:57 -0700 Received: from NAM01-BY2-obe.outbound.protection.outlook.com (10.44.128.2) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Thu, 5 Jul 2018 11:03:57 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symantec.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UnlIvKlzfkNMN8JjgQyIs8oUyRKUrXwNEaB81RhK7Y4=; b=0c6bbFUCIqj5GYsKSDMc62zRW+pRkOHU3+FVKlDv+sTBMAHnHl4JqvvCn9vbvlduuwe14FhSUbZXHLcpw9dW4G4BRjKbqSsor09hiiX0jVsHoMHFWnpZEPer8vI9+9w5dKUDXxEseQQUVzEsV3VJtwMCM6nZ1lseGxkGNr2ZUYg= Received: from BL0PR16MB2260.namprd16.prod.outlook.com (52.132.28.27) by BL0PR16MB2242.namprd16.prod.outlook.com (52.132.28.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.930.18; Thu, 5 Jul 2018 18:03:56 +0000 Received: from BL0PR16MB2260.namprd16.prod.outlook.com ([fe80::c016:d0d7:8777:29a1]) by BL0PR16MB2260.namprd16.prod.outlook.com ([fe80::c016:d0d7:8777:29a1%5]) with mapi id 15.20.0930.016; Thu, 5 Jul 2018 18:03:56 +0000 From: Mingliang Pei To: "Wheeler, David M" , "teep@ietf.org" Thread-Topic: [Teep] Comments on: I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUiFyKudTuNMtRRHCNwqD1TweQcP//jwGA Date: Thu, 5 Jul 2018 18:03:56 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B669EFC@CRSMSX102.amr.corp.intel.com> In-Reply-To: <0627F5240443D2498FAA65332EE46C843B669EFC@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.d.1.180523 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Mingliang_Pei@symantec.com; x-originating-ip: [155.64.23.48] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BL0PR16MB2242; 7:wlvtV7dSQX3msp3V0rR94iEDdeDN5Xqu7SNynKlVvH/ZuAkltYgPQDxBJnmF60UVfxwC4YrckkSnRfuh77bQpqA5Vvb4qi7lbZ+JtNmW7FegTm2ERuWxaixuNwO8Iawt3jHP1iPgalP6oTvKnD7OmYpQIK58lIoLSDeM59msBv9eyi+F0Y7uUvKmSzF3PNq+b9yrhXWFtWWBf1POU/24ZKqimRPabi8h2jsUwN6eNVAY7zPz3ASVF5KB/A2JMr8q x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 2a963c24-bfa4-4d91-9638-08d5e2a1ad09 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:BL0PR16MB2242; x-ms-traffictypediagnostic: BL0PR16MB2242: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(258766100185102)(228905959029699)(17755550239193); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(3231254)(944501410)(52105095)(3002001)(10201501046)(93006095)(93001095)(149027)(150027)(6041310)(20161123558120)(20161123564045)(20161123560045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011)(7699016); SRVR:BL0PR16MB2242; BCL:0; PCL:0; RULEID:; SRVR:BL0PR16MB2242; x-forefront-prvs: 0724FCD4CD x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(39860400002)(136003)(366004)(346002)(199004)(189003)(13464003)(80792005)(110136005)(36756003)(11346002)(316002)(66066001)(256004)(14444005)(575784001)(7736002)(305945005)(25786009)(2501003)(6306002)(6512007)(5250100002)(83716003)(99286004)(476003)(6246003)(102836004)(2616005)(446003)(6506007)(26005)(97736004)(53546011)(486006)(58126008)(86362001)(14454004)(8936002)(81166006)(8676002)(72206003)(81156014)(6436002)(76176011)(10290500003)(53936002)(105586002)(106356001)(6486002)(5660300001)(3846002)(6116002)(186003)(966005)(82746002)(33656002)(478600001)(2906002)(229853002)(2900100001)(68736007); DIR:OUT; SFP:1101; SCL:1; SRVR:BL0PR16MB2242; H:BL0PR16MB2260.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: iMobT1rU4tWyQ1QoqOewweq2FJRh2ueC5v3puXVZzSoKBdYZCzAKpi6SwX25VZP+TT/gRnGF+qwuk9kSQM5VAggJ1sOaHpHmohih7HlkT7JVN9kXs86uMxWH4hoGmup/PX14x0pg7qKQb2GIs+oJ+heAOiiQdkFK07UtpwYWQmc2oOK8dwrtX2qZsgiumbJv4EPZVwD2vb9x1oiR2SFdtgoTjWWZYCAFRKV3h5kpL/3KtEoMoM82vfgZ6MuyWzKnFUBSWlZc5Qs18B3HwbxXSerywBV0IGfe20WdRurMByzF2Hd0yyPDXDlGQvpz6vcHQ/1qc08d3PVldwQtaVIS7JhF7VP616qFj9yCga8V8LM= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <47FC8860B4D43647B157138EFF9185C2@namprd16.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 2a963c24-bfa4-4d91-9638-08d5e2a1ad09 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Jul 2018 18:03:56.1740 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR16MB2242 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprBKsWRmVeSWpSXmKPExsXCFeXNodsfaxdtMPUsh0XTxVNsFkv/fGN2 YPJYsuQnk8fiPS+ZApiiuGxSUnMyy1KL9O0SuDKu37/LVDDHu2LH9BesDYxLPLsYOTkkBEwk Zm44xt7FyMUhJPCRUeLmlf9ADgdY4schRoj4N0aJizP3s0E4hxklmo71QznPGSVW3u5lAXFY BCYwS7QdfcEKkelnkri64wELhPOQUWL/2QPMIIPZBAwkLtzJAzFFBEIldn7gBrlDWCBIYsOv aewgtohAsMSt37uYIGwjiVcr/7KC2CwCKhKLv60Gq+EVsJdY93EzC4gtBFR/cc1dRhCbUyBE YuuexWD1jAJiEt9PrQGbwywgLnHryXwmiJ8FJJbsOc8MYYtKvHz8D6xeVEBPomfnVTaI3liJ ny0PGCFBoSCxujkVolxW4tL8bnCwSAhsYZL4++k+K0RCV+LD1KnMEPW+El96CiFqLjBK9Mzo Z4Go0ZK4+n8mNHizJd7sU5rAaDYLyXWzgDLMApoS63fpQ4Q9JE5sW8wMYStKTOl+yD4L7HlB iZMzn7AsYGRdxaiQWJxUnFuSX1qSWJBqYKRXXJmbDCISgaklWS85P3cTIzi9/JDawfjkjs8h RgEORiUe3m9hdtFCrIllQJWHGCU4mJVEePcGAoV4UxIrq1KL8uOLSnNSiw8xSnOwKInz3uad HiUkkJ5YkpqdmlqQWgSTZeLglGpgXBdZNan9HO+jJZfvsF7YaR0kO3/xd4EYnuQtZsc3Pueo fB2z6I7rxRPr37GqWdtWTJEveC/Y4bfiZjCXeLdXjeIri13KOyw6v/Gash49/PNkmoTeD772 eVmb1Bv/XHghaLK0ba1DbZ7dDaZEW8m5axPTGkvdejS2ztpwT2Tm+u4OnriqczcuKbEUZyQa ajEXFScCAEw9krgrAwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrNIsWRmVeSWpSXmKPExsXCFeXNrNsfaxdtsHgDi0XTxVNsFkv/fGN2 YPJYsuQnk8fiPS+ZApiiuGxSUnMyy1KL9O0SuDKu37/LVDDHu2LH9BesDYxLPLsYOTgkBEwk fhxi7GLk4hAS+MYocXHmfjYI5zCjRNOxfijnOaPEytu9LCAOi8AEZom2oy9YITL9TBJXdzxg gXAeMkrsP3uAGWQwm4CBxIU7eSCmiECoxM4P3F2MnBzCAkESG35NYwexRQSCJW793sUEYRtJ vFr5lxXEZhFQkVj8bTVYDa+AvcS6j5tZQGwhoPqLa+4ygticAiESW/csBqtnFBCT+H5qDdgc ZgFxiVtP5oPZEgICEkv2nGeGsEUlXj7+B1YvKqAn0bPzKhtEb6zEz5YHjJCgUJBY3ZwKUS4r cWl+NzhYJAS2MEn8/XSfFSKhK/Fh6lRmiHpfiS89hRA1Fxglemb0s0DUaElc/T+THaImW+LN PiUIM1eiZX8kRIWcxKrehywTGI1mITl6FlAVs4CmxPpd+hBhD4kT2xYzQ9iKElO6H7LPAoeJ oMTJmU9YFjCyrmJUSCxOKs4tyS1JTCzINDDUK67MTQYRicC0kqyXnJ+7iRGcWn6L7WA88Mfn EKMAB6MSD2+ErF20EGtiGVDlIUZpDhYlcV557ptRQgLpiSWp2ampBalF8UWlOanFhxiZODil GhhtdtzZem7qncm8xwWeFvrNuD1lgVKJiZJVx9qyRVyV4iFp/j/P2yxRn/Tx1vVPsTk9/p9M p2szL92veeuOZ/OFDit+tZ3Rdn1Vc7gf2Jsf3mp2sHl9ge8Vnti0ZQZbrGIX3Stz2ykeW8dY xad6bGYxT4CZmtL7fuuAmHOfl+ty/GCYJ+BeF6rEUpyRaKjFXFScCACcDJPHDgMAAA== X-CFilter-Loop: ASB01 Archived-At: Subject: Re: [Teep] Comments on: I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 18:04:04 -0000 VGhhbmsgeW91IERhdmUuIEkgd2lsbCBpbmNsdWRlIHRoZSBkZWZpbml0aW9uIG9mIENBIHRvIHRo ZSBkcmFmdCBhcyB5b3Ugc3VnZ2VzdGVkLg0KDQpNaW5nDQoNCu+7v09uIDcvNS8xOCwgMTA6NDgg QU0sICJURUVQIG9uIGJlaGFsZiBvZiBXaGVlbGVyLCBEYXZpZCBNIiA8dGVlcC1ib3VuY2VzQGll dGYub3JnIG9uIGJlaGFsZiBvZiBkYXZpZC5tLndoZWVsZXJAaW50ZWwuY29tPiB3cm90ZToNCg0K ICAgIFN1Z2dlc3QgdGhlIGZvbGxvd2luZyBtb2RpZmljYXRpb24gdG8gdGhlIGRlZmluaXRpb24g b2YgYSAiQ2VydGlmaWNhdGUgQXV0aG9yaXR5IiwgaW4gc2VjdGlvbiA1LjEgcGFnZSA4LCBiZWNh dXNlIHRoZSBjdXJyZW50IGRlZmluaXRpb24gZG9lcyBub3QgYWN0dWFsbHkgZGVmaW5lIHdoYXQg YSBDQSBpcywgYnV0IG9ubHkgdGFsa3MgYWJvdXQgdGhlIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIHRo ZSBUQU0gYW5kIHRoZSBkZXZpY2UuIA0KICAgIA0KICAgIENlcnRpZmljYXRpb24gQXV0aG9yaXR5 IChDQSk6IA0KICAgICAgICAgICAgQSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgaXMgYSB0cnVzdGVk IGVudGl0eSB0aGF0IHZlcmlmaWVzIHRoZSBpZGVudGl0eSBhbmQgY2xhaW1zDQogICAgICAgICAg ICBmb3Igb3RoZXIgZW50aXRpZXMgYW5kIGlzc3VlcyBzaWduZWQgY2VydGlmaWNhdGVzIHRoYXQg Y29tbXVuaWNhdGUgdmVyaWZpZWQgY2xhaW1zLg0KICAgICAgICAgICAgVGhlIGxldmVsIG9mIHZl cmlmaWNhdGlvbiBwZXJmb3JtZWQgYnkgYW55IHBhcnRpY3VsYXIgQ0EgbWF5IHZhcnksIGFuZCAN CiAgICAgICAgICAgIHRoZXJlZm9yZSBkaWZmZXJlbnQgZGV2aWNlcyBhbmQgZGV2aWNlIG1hbnVm YWN0dXJlcnMgbWF5IGNob29zZSB0byB0cnVzdA0KICAgICAgICAgICAgZGlmZmVyZW50IENBcy4N CiAgICAgIA0KICAgICAgICAgICAgVGhlIGNlcnRpZmljYXRlLWJhc2VkIGNyZWRlbnRpYWxzIGlz c3VlZCBieSBDQXMgYXJlIHVzZWQgZm9yDQogICAgICAgICAgICAgYXV0aGVudGljYXRpbmcgYSBk ZXZpY2UsIGEgVEFNIGFuZCBhbiBTUC4gQSBkZXZpY2UgZW1iZWRzIGEgbGlzdA0KICAgICAgICAg ICAgIG9mIHJvb3QgY2VydGlmaWNhdGVzIGZyb20gQ0FzIHRoYXQgaXQgdHJ1c3RzLCBhbmQgbWFp bnRhaW5zIHRoaXMgbGlzdA0KICAgICAgICAgICAgIGFzIHRoZSBzZXQgb2YgInRydXN0IGFuY2hv cnMiIGZvciB0aGUgZGV2aWNlLiBBIGRldmljZSB3aWxsIHZhbGlkYXRlDQogICAgICAgICAgICBh IFRBTSdzIGNlcnRpZmljYXRlIGFnYWluc3QgdGhpcyBsaXN0IG9mIENBcyAodHJ1c3QgYW5jaG9y cykgdG8gZGV0ZXJtaW5lDQogICAgICAgICAgICBpZiB0aGUgVEFNIGNhbiBiZSB0cnVzdGVkIGJ5 IHRoZSBkZXZpY2UuDQogICAgICAgICAgICAgQSBUQU0gd2lsbCByZW1vdGVseSBhdHRlc3QgYSBk ZXZpY2UgYW5kIHZlcmlmeSBpZiB0aGUgZGV2aWNlJ3MgUm9vdC1vZi1UcnVzdA0KICAgICAgICAg ICAgIEtleSBpcyBjb250YWluZWQgd2l0aGluIGEgY2VydGlmaWNhdGUgc2lnbmVkIGJ5IGEgQ0Eg dGhhdCB0aGUgVEFNIHRydXN0cy4gDQogICAgDQogICAgICAgICAgICAgVGhlIENBcyB0aGF0IHNp Z24gdGhlIFRBTSBjZXJ0aWZpY2F0ZSBhbmQgdGhhdCBzaWduIHRoZSBkZXZpY2UncyBSb290LW9m LVRydXN0DQogICAgICAgICAgICAgY2VydGlmaWNhdGUgZG8gbm90IG5lZWQgdG8gYmUgdGhlIHNh bWU7ICBkaWZmZXJlbnQgQ0FzIGNhbiBiZSBjaG9zZW4gYnkgZWFjaCANCiAgICAgICAgICAgICBU QU0sIGFuZCBkaWZmZXJlbnQgZGV2aWNlIENBcyBjYW4gYmUgdXNlZCBieSBkaWZmZXJlbnQgZGV2 aWNlIG1hbnVmYWN0dXJlcnMuDQogICAgICAgICAgICAgQXMgbG9uZyBhcyB0aGUgVEFNIHRydXN0 cyB0aGUgQ0EgdGhhdCBzaWducyB0aGUgZGV2aWNlIGNlcnRpZmljYXRlLCBhbmQgdGhlIGRldmlj ZQ0KICAgICAgICAgICAgIHRydXN0cyB0aGUgQ0EgdGhhdCBzaWducyB0aGUgVEFNIGNlcnRpZmlj YXRlLCB0aGUgdHJ1c3QgcmVsYXRpb25zaGlwIGJldHdlZW4gdGhlDQogICAgICAgICAgICAgVEFN IGFuZCB0aGUgZGV2aWNlIHdpbGwgYmUgYWNjZXB0ZWQuICANCiAgICANCiAgICANCiAgICBEYXZl IFdoZWVsZXINCiAgICANCiAgICAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KICAgIEZyb206 IFRFRVAgW21haWx0bzp0ZWVwLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBpbnRlcm5l dC1kcmFmdHNAaWV0Zi5vcmcNCiAgICBTZW50OiBXZWRuZXNkYXksIEp1bHkgNCwgMjAxOCA3OjQ5 IEFNDQogICAgVG86IGktZC1hbm5vdW5jZUBpZXRmLm9yZw0KICAgIENjOiB0ZWVwQGlldGYub3Jn DQogICAgU3ViamVjdDogW1RlZXBdIEktRCBBY3Rpb246IGRyYWZ0LWlldGYtdGVlcC1hcmNoaXRl Y3R1cmUtMDAudHh0DQogICAgDQogICAgDQogICAgQSBOZXcgSW50ZXJuZXQtRHJhZnQgaXMgYXZh aWxhYmxlIGZyb20gdGhlIG9uLWxpbmUgSW50ZXJuZXQtRHJhZnRzIGRpcmVjdG9yaWVzLg0KICAg IFRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2YgdGhlIFRydXN0ZWQgRXhlY3V0aW9uIEVudmly b25tZW50IFByb3Zpc2lvbmluZyBXRyBvZiB0aGUgSUVURi4NCiAgICANCiAgICAgICAgICAgIFRp dGxlICAgICAgICAgICA6IFRydXN0ZWQgRXhlY3V0aW9uIEVudmlyb25tZW50IFByb3Zpc2lvbmlu ZyAoVEVFUCkgQXJjaGl0ZWN0dXJlDQogICAgICAgICAgICBBdXRob3JzICAgICAgICAgOiBNaW5n bGlhbmcgUGVpDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIYW5uZXMgVHNjaG9mZW5p Zw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQW5kcmV3IEF0eWVvDQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBEYXBlbmcNCiAgICAJRmlsZW5hbWUgICAgICAgIDogZHJhZnQt aWV0Zi10ZWVwLWFyY2hpdGVjdHVyZS0wMC50eHQNCiAgICAJUGFnZXMgICAgICAgICAgIDogMjQN CiAgICAJRGF0ZSAgICAgICAgICAgIDogMjAxOC0wNy0wMg0KICAgIA0KICAgIEFic3RyYWN0Og0K ICAgICAgIEEgVHJ1c3RlZCBFeGVjdXRpb24gRW52aXJvbm1lbnQgKFRFRSkgd2FzIGRlc2lnbmVk IHRvIHByb3ZpZGUgYQ0KICAgICAgIGhhcmR3YXJlLWlzb2xhdGlvbiBtZWNoYW5pc20gdG8gc2Vw YXJhdGUgYSByZWd1bGFyIG9wZXJhdGluZyBzeXN0ZW0NCiAgICAgICBmcm9tIHNlY3VyaXR5LSBz ZW5zaXRpdmUgYXBwbGljYXRpb25zLg0KICAgIA0KICAgICAgIFRoaXMgYXJjaGl0ZWN0dXJlIGRv Y3VtZW50IG1vdGl2YXRlcyB0aGUgZGVzaWduIGFuZCBzdGFuZGFyZGl6YXRpb24NCiAgICAgICBv ZiBhIHByb3RvY29sIGZvciBtYW5hZ2luZyB0aGUgbGlmZWN5bGUgb2YgdHJ1c3RlZCBhcHBsaWNh dGlvbnMNCiAgICAgICBydW5uaW5nIGluc2lkZSBhIFRFRS4NCiAgICANCiAgICANCiAgICBUaGUg SUVURiBkYXRhdHJhY2tlciBzdGF0dXMgcGFnZSBmb3IgdGhpcyBkcmFmdCBpczoNCiAgICBodHRw czovL2NsaWNrdGltZS5zeW1hbnRlYy5jb20vYS8xL1NTd1V1MjVwOG5fMUY3ZWNfdkRaUkJMUlly bjJ0ZHAwd1lLMHVjZVh2VWM9P2Q9VHRnS2FjZ3F1bHRPdUM0cUNnRFpQSFk2bzdWUHN5WmFJc0pJ MklsQ0xhOFVaVmRSRzlZdHZPQXVJUFhFWEdqa2RqRmFHQS1LR3F5bjVVbXl0VXRCV2k3QW5NU2V2 NE52Mk14ajVuWHNMSWFrSlhZaTducXFoVURVV1YxYmc0WnRFWHJTWmpXUS0wSnJBVWxKLUJZVldU T0o4WkxndmxCa0swaXRjdk5RLUw0NjFLX1ZhM0RKUXpoaFVwaWJ2NXlRWlMtRl91a2RvOEkwR0xH cEIwX2g0NEl6MmJGTWZ2MjlQS0dYbFU5UHNtWGd5R2ZYbHVldFRtTHNCajVYTzVSQ1VqaGkzQS0z dXQ0WmRJYkVwWjljTzYwOVhMTDIwMTBEZ2RkbElXdzZWT0tETmxQZ1ZvRzVSbnBrNUF0R2J6aUJK eEw1X1dhTTV4aTlPTGd3eTdTVlVaREtLS3FYY1lzSXVzUEtURVBmaTJFNXJFRVh3dXhEV1NBSlAt WXJSUjdTY2dWNmNLR2otcGJHM1U2bEVqdUV4WmpFc243cU4tQ01ONl9hRzBpV1h4SVVOSnlJM0Q5 dFV5aTRvTjhhd2Z5LSZ1PWh0dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2Ml MkZkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlJTJGDQogICAgDQogICAgVGhlcmUgYXJlIGFs c28gaHRtbGl6ZWQgdmVyc2lvbnMgYXZhaWxhYmxlIGF0Og0KICAgIGh0dHBzOi8vY2xpY2t0aW1l LnN5bWFudGVjLmNvbS9hLzEvRVlfMnNNZ2NJNFNDX3dVc01jT3AzdFp1LXVHWFdTNjV3QkU2YlpD ZXlaWT0/ZD1UdGdLYWNncXVsdE91QzRxQ2dEWlBIWTZvN1ZQc3laYUlzSkkySWxDTGE4VVpWZFJH OVl0dk9BdUlQWEVYR2prZGpGYUdBLUtHcXluNVVteXRVdEJXaTdBbk1TZXY0TnYyTXhqNW5Yc0xJ YWtKWFlpN25xcWhVRFVXVjFiZzRadEVYclNaaldRLTBKckFVbEotQllWV1RPSjhaTGd2bEJrSzBp dGN2TlEtTDQ2MUtfVmEzREpRemhoVXBpYnY1eVFaUy1GX3VrZG84STBHTEdwQjBfaDQ0SXoyYkZN ZnYyOVBLR1hsVTlQc21YZ3lHZlhsdWV0VG1Mc0JqNVhPNVJDVWpoaTNBLTN1dDRaZEliRXBaOWNP NjA5WExMMjAxMERnZGRsSVd3NlZPS0RObFBnVm9HNVJucGs1QXRHYnppQkp4TDVfV2FNNXhpOU9M Z3d5N1NWVVpES0tLcVhjWXNJdXNQS1RFUGZpMkU1ckVFWHd1eERXU0FKUC1ZclJSN1NjZ1Y2Y0tH ai1wYkczVTZsRWp1RXhaakVzbjdxTi1DTU42X2FHMGlXWHhJVU5KeUkzRDl0VXlpNG9OOGF3Znkt JnU9aHR0cHMlM0ElMkYlMkZ0b29scy5pZXRmLm9yZyUyRmh0bWwlMkZkcmFmdC1pZXRmLXRlZXAt YXJjaGl0ZWN0dXJlLTAwDQogICAgaHR0cHM6Ly9jbGlja3RpbWUuc3ltYW50ZWMuY29tL2EvMS9P ak1PaTVOQ2xhMnZwblR5cHc4M1htb1kwMDcxVHVoWmpOZXVvcnR4UEFrPT9kPVR0Z0thY2dxdWx0 T3VDNHFDZ0RaUEhZNm83VlBzeVphSXNKSTJJbENMYThVWlZkUkc5WXR2T0F1SVBYRVhHamtkakZh R0EtS0dxeW41VW15dFV0QldpN0FuTVNldjROdjJNeGo1blhzTElha0pYWWk3bnFxaFVEVVdWMWJn NFp0RVhyU1pqV1EtMEpyQVVsSi1CWVZXVE9KOFpMZ3ZsQmtLMGl0Y3ZOUS1MNDYxS19WYTNESlF6 aGhVcGlidjV5UVpTLUZfdWtkbzhJMEdMR3BCMF9oNDRJejJiRk1mdjI5UEtHWGxVOVBzbVhneUdm WGx1ZXRUbUxzQmo1WE81UkNVamhpM0EtM3V0NFpkSWJFcFo5Y082MDlYTEwyMDEwRGdkZGxJV3c2 Vk9LRE5sUGdWb0c1Um5wazVBdEdiemlCSnhMNV9XYU01eGk5T0xnd3k3U1ZVWkRLS0txWGNZc0l1 c1BLVEVQZmkyRTVyRUVYd3V4RFdTQUpQLVlyUlI3U2NnVjZjS0dqLXBiRzNVNmxFanVFeFpqRXNu N3FOLUNNTjZfYUcwaVdYeElVTkp5STNEOXRVeWk0b044YXdmeS0mdT1odHRwcyUzQSUyRiUyRmRh dGF0cmFja2VyLmlldGYub3JnJTJGZG9jJTJGaHRtbCUyRmRyYWZ0LWlldGYtdGVlcC1hcmNoaXRl Y3R1cmUtMDANCiAgICANCiAgICANCiAgICBQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEg Y291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uIHVudGlsIHRoZSBo dG1saXplZCB2ZXJzaW9uIGFuZCBkaWZmIGFyZSBhdmFpbGFibGUgYXQgdG9vbHMuaWV0Zi5vcmcu DQogICAgDQogICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBhbHNvIGF2YWlsYWJsZSBieSBhbm9ueW1v dXMgRlRQIGF0Og0KICAgIGZ0cDovL2Z0cC5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvDQogICAg DQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCiAg ICBURUVQIG1haWxpbmcgbGlzdA0KICAgIFRFRVBAaWV0Zi5vcmcNCiAgICBodHRwczovL2NsaWNr dGltZS5zeW1hbnRlYy5jb20vYS8xL1FiRWlmazZUVTRxcVJpT3Z3Z3VIakx6MlI0cXdrWkxQbFha cVBkM253Uk09P2Q9VHRnS2FjZ3F1bHRPdUM0cUNnRFpQSFk2bzdWUHN5WmFJc0pJMklsQ0xhOFVa VmRSRzlZdHZPQXVJUFhFWEdqa2RqRmFHQS1LR3F5bjVVbXl0VXRCV2k3QW5NU2V2NE52Mk14ajVu WHNMSWFrSlhZaTducXFoVURVV1YxYmc0WnRFWHJTWmpXUS0wSnJBVWxKLUJZVldUT0o4WkxndmxC a0swaXRjdk5RLUw0NjFLX1ZhM0RKUXpoaFVwaWJ2NXlRWlMtRl91a2RvOEkwR0xHcEIwX2g0NEl6 MmJGTWZ2MjlQS0dYbFU5UHNtWGd5R2ZYbHVldFRtTHNCajVYTzVSQ1VqaGkzQS0zdXQ0WmRJYkVw WjljTzYwOVhMTDIwMTBEZ2RkbElXdzZWT0tETmxQZ1ZvRzVSbnBrNUF0R2J6aUJKeEw1X1dhTTV4 aTlPTGd3eTdTVlVaREtLS3FYY1lzSXVzUEtURVBmaTJFNXJFRVh3dXhEV1NBSlAtWXJSUjdTY2dW NmNLR2otcGJHM1U2bEVqdUV4WmpFc243cU4tQ01ONl9hRzBpV1h4SVVOSnlJM0Q5dFV5aTRvTjhh d2Z5LSZ1PWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJG dGVlcA0KICAgIA0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fDQogICAgVEVFUCBtYWlsaW5nIGxpc3QNCiAgICBURUVQQGlldGYub3JnDQogICAgaHR0 cHM6Ly9jbGlja3RpbWUuc3ltYW50ZWMuY29tL2EvMS9RYkVpZms2VFU0cXFSaU92d2d1SGpMejJS NHF3a1pMUGxYWnFQZDNud1JNPT9kPVR0Z0thY2dxdWx0T3VDNHFDZ0RaUEhZNm83VlBzeVphSXNK STJJbENMYThVWlZkUkc5WXR2T0F1SVBYRVhHamtkakZhR0EtS0dxeW41VW15dFV0QldpN0FuTVNl djROdjJNeGo1blhzTElha0pYWWk3bnFxaFVEVVdWMWJnNFp0RVhyU1pqV1EtMEpyQVVsSi1CWVZX VE9KOFpMZ3ZsQmtLMGl0Y3ZOUS1MNDYxS19WYTNESlF6aGhVcGlidjV5UVpTLUZfdWtkbzhJMEdM R3BCMF9oNDRJejJiRk1mdjI5UEtHWGxVOVBzbVhneUdmWGx1ZXRUbUxzQmo1WE81UkNVamhpM0Et M3V0NFpkSWJFcFo5Y082MDlYTEwyMDEwRGdkZGxJV3c2Vk9LRE5sUGdWb0c1Um5wazVBdEdiemlC SnhMNV9XYU01eGk5T0xnd3k3U1ZVWkRLS0txWGNZc0l1c1BLVEVQZmkyRTVyRUVYd3V4RFdTQUpQ LVlyUlI3U2NnVjZjS0dqLXBiRzNVNmxFanVFeFpqRXNuN3FOLUNNTjZfYUcwaVdYeElVTkp5STNE OXRVeWk0b044YXdmeS0mdT1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZs aXN0aW5mbyUyRnRlZXANCiAgICANCg0K From nobody Thu Jul 5 11:41:43 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4865130F44 for ; Thu, 5 Jul 2018 11:41:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GNuoM2A548HP for ; Thu, 5 Jul 2018 11:41:37 -0700 (PDT) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE173130F06 for ; Thu, 5 Jul 2018 11:41:37 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jul 2018 11:41:37 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,313,1526367600"; d="scan'208";a="213717538" Received: from fmsmsx108.amr.corp.intel.com ([10.18.124.206]) by orsmga004.jf.intel.com with ESMTP; 05 Jul 2018 11:41:37 -0700 Received: from fmsmsx151.amr.corp.intel.com (10.18.125.4) by FMSMSX108.amr.corp.intel.com (10.18.124.206) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 11:41:36 -0700 Received: from crsmsx152.amr.corp.intel.com (172.18.7.35) by FMSMSX151.amr.corp.intel.com (10.18.125.4) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 11:41:36 -0700 Received: from crsmsx102.amr.corp.intel.com ([169.254.2.60]) by CRSMSX152.amr.corp.intel.com ([169.254.5.31]) with mapi id 14.03.0319.002; Thu, 5 Jul 2018 12:41:34 -0600 From: "Wheeler, David M" To: Mingliang Pei , "teep@ietf.org" Thread-Topic: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AQHUE6Y9Xr9n5+vFFECvNS2N8cLnxaSA18zAgAB21wD//6kZoA== Date: Thu, 5 Jul 2018 18:41:34 +0000 Message-ID: <0627F5240443D2498FAA65332EE46C843B669FBE@CRSMSX102.amr.corp.intel.com> References: <153071574775.27525.7336699878298332673@ietfa.amsl.com> <0627F5240443D2498FAA65332EE46C843B669ECC@CRSMSX102.amr.corp.intel.com> <6CBD4920-BCF3-4A42-8AA4-07D0BDF3490E@symantec.com> In-Reply-To: <6CBD4920-BCF3-4A42-8AA4-07D0BDF3490E@symantec.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZTI4MGRkZWItMjllYS00MWE1LThiZjYtZTk0YmYyZDRhODU2IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiY3ZDYXRVZ2Rmck9uYlNWaVhaY3hHQzBxWjhTRWwxakxST1FPVVdvcXJ1Q1l2UERITXdCMVwvekxGeVRHRGNuNDkifQ== x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.200.100 dlp-reaction: no-action x-originating-ip: [172.18.205.10] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 18:41:41 -0000 TWluZywNCldlIGNhbiBkZWZpbml0ZWx5IGNoYXQgaW4gTW9udHJlYWwsIGFuZCBwZXJoYXBzIGEg c2hvcnQgZGlzY3Vzc2lvbiBvZiBob3cgU0dYIHdvcmtzIG1heSBiZSBhcHByb3ByaWF0ZS4gSWYg b3RoZXJzIG9uIHRoZSBtYWlsIGxpc3QgYXJlIGludGVyZXN0ZWQsIHBlcmhhcHMgd2UgY2FuIGZp bmQgdGltZSBmb3IgbWUgdG8gZG8gYSBwcmVzZW50YXRpb24gKEknbGwgYmUgaW4gTW9udHJlYWwg YWxsIHdlZWspLg0KSXQgbWF5IG5vdCBiZSBnb29kIGZvciB0aGUgVEVFUCBzZXNzaW9uIHNpbmNl IHdlIGhhdmUgc28gbXVjaCB0byBkaXNjdXNzIGFuZCBvbmx5IDIgaG91cnMuDQoNCkkgYW0gb3Bl biB0byBzdWdnZXN0aW9ucy4NCg0KSSBhbHNvIG11c3QgYWRtaXQgdGhhdCBJIGFtIG5vdCBjbGVh ciBvbiB0aGUgZHluYW1pYyBjb25maWd1cmF0aW9uIGRhdGEgcmVxdWlyZWQuIFBlcmhhcHMgeW91 IGNhbiBjbGFyaWZ5IGEgYml0IG1vcmUgZm9yIG1lLg0KVGhhbmtzLA0KRGF2ZSBXaGVlbGVyDQoN Ci0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBNaW5nbGlhbmcgUGVpIFttYWlsdG86 TWluZ2xpYW5nX1BlaUBzeW1hbnRlYy5jb21dIA0KU2VudDogVGh1cnNkYXksIEp1bHkgNSwgMjAx OCAxMDo1MSBBTQ0KVG86IFdoZWVsZXIsIERhdmlkIE0gPGRhdmlkLm0ud2hlZWxlckBpbnRlbC5j b20+OyB0ZWVwQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW1RlZXBdIEktRCBBY3Rpb246IGRyYWZ0 LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUtMDAudHh0DQoNCkhpIERhdmlkLA0KDQpUaGFuayB5b3Ug Zm9yIHJldmlld2luZyB0aGUgZHJhZnQsIGFuZCB5b3VyIHN1Z2dlc3Rpb25zLiBXZSBtYWRlIFNE IHVzYWdlIGFuZCBUQSBiaW5hcnkgYXMgcGFydCBvZiAiYXNzdW1wdGlvbnMiIGZvciB0aGUgc3lz dGVtIGRlc2lnbi4gSW4gdGhlIHNlY3Rpb24gNSwgc3lzdGVtIGNvbXBvbmVudHMgdHJpZWQgdG8g Y292ZXIgdGhlIGhpZ2ggbGV2ZWwgbWFqb3IgY29tcG9uZW50cyB3aGVyZSBTRCBhbmQgVEEgYXJl IHBhcnQgb2YgZW50aXRpZXMgdXNlZCBpbnNpZGUgYSBURUUgZm9yIHN1cHBvcnQgdGhlIFRFRVAu IEkgYWdyZWUgd2l0aCB5b3VyIHN1Z2dlc3Rpb247IHRoYW5rcy4gQSBzZWN0aW9uIG9uIFNEIGFs b25lIGluIHNlY3Rpb24gNSBhbG9uZSBjYW4gaGVscCBjbGFyaWZ5IHRoaXMgYmV0dGVyLg0KDQpP biB0aGUgVEEgYmluYXJ5IGRpc3RyaWJ1dGlvbiBmcm9tIGEgY2xpZW50IGFwcCwgSSB3b3VsZCBs aWtlIHRvIGhlYXIgeW91ciBzdWdnZXN0aW9ucyB0b28uIFRoZSByZWFzb24gdGhhdCAiY29uZmln dXJhdGlvbiBkYXRhIiBuZWVkcyB0byBiZSBmcm9tIGEgZGlmZmVyZW50IHNvdXJjZSBpcyBob3cg YSBjbGllbnQgaGFzIGR5bmFtaWMgZGF0YSBwZXIgZGV2aWNlIGlmIGl0IGlzIGRvd25sb2FkZWQg ZnJvbSBhbiBhcHAgc3RvcmUgKG1vYmlsZSBjYXNlKS4gQnV0IEkgd291bGQgbGlrZSB0byBzZWUg aG93IFNHWCBjYXNlIGJlIGNvdmVyZWQgaGVyZS4gQXBwcmVjaWF0ZSB5b3VyIGhlbHAgb24gaG93 IHlvdSB3b3VsZCBzdWdnZXN0IHRvIHN1cHBvcnQgZHluYW1pYyBjb25maWd1cmF0aW9uIGRhdGEg aW4gYSBTR1ggZnJvbSBhIGNsaWVudCBhcHAsIG9yIHRoZSBjYXNlIGRvZXNuJ3QgYXBwbHk/DQoN ClRoYW5rcywNCg0KTWluZw0KDQrvu79PbiA3LzUvMTgsIDk6NTkgQU0sICJURUVQIG9uIGJlaGFs ZiBvZiBXaGVlbGVyLCBEYXZpZCBNIiA8dGVlcC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBv ZiBkYXZpZC5tLndoZWVsZXJAaW50ZWwuY29tPiB3cm90ZToNCg0KICAgIEFub3RoZXIgY29tbWVu dCBvbiB0aGUgbmV3IGFyY2hpdGVjdHVyZSBkcmFmdDoNCiAgICANCiAgICBTZWN0aW9uIDMgaXMg dGl0bGVkIHNjb3BlIGFuZCBhc3N1bXB0aW9ucywgaG93ZXZlciB0aGUgaW50cm9kdWN0aW9uIG9m IHNlY3VyaXR5IGRvbWFpbnMgYW5kIFRBIGJpbmFyaWVzIHNlZW1zIHRvIGNyZWVwIHBhc3QgdGhl IGxpc3RlZCB0aXRsZSwgYW5kIGp1bXAgaW50byBjb25jZXB0IGRlZmluaXRpb24uIEEgU2VjdXJp dHkgRG9tYWluICJmZWVscyIgbGlrZSBhIHN5c3RlbSBjb21wb25lbnQsIGFuZCB5ZXQgc2VjdGlv biA1IGRvZXMgbm90IGhhdmUgYW55IHN1Y2ggc2VjdGlvbiAtIGluc3RlYWQgaXQgaGFzIGEgc2Vj dGlvbiBvbiBTRCBvd25lcnMgYW5kIGNyeXB0b2dyYXBoaWMgYmluZGluZy4NCiAgICANCiAgICBJ IHN1Z2dlc3QgYSBtb3JlIGNvbXBsZXRlIHNlY3Rpb24gb24gc2VjdXJpdHkgZG9tYWlucyBiZSBh ZGRlZCB0byBzZWN0aW9uIDUsIGFuZCBzZWN0aW9uIDMgcGFyYWdyYXBoIGJlIG1vZGlmaWVkIHRv IHNvbWV0aGluZyBsaWtlIHRoZSBmb2xsb3dpbmc6DQogICAgDQogICAgVGhpcyBzcGVjaWZpY2F0 aW9uIGFzc3VtZXMgdGhlIGV4aXN0ZW5jZSBvZiBhIFNlY3VyaXR5IERvbWFpbiAoU0QpIGNvbmNl cHQgd2hpY2ggZW5hYmxlcyBlYXNpZXIgbWFuYWdlbWVudCBvZiBtdWx0aXBsZSBUcnVzdGVkIEFw cGxpY2F0aW9ucyAoVEFzKSBieSBTZXJ2aWNlIFByb3ZpZGVycyAoU1BzKSBhbmQgdGhlIFRBTS4g VGhlIFNEIGNvbmNlcHQgaXMgZnVydGhlciBkZXNjcmliZWQgaW4gc2VjdGlvbiA1LnguDQogICAg DQogICAgDQogICAgVGhlIG90aGVyIGNvbmZ1c2lvbiAoZm9yIG1lKSBpcyB0aGUgcGFyYWdyYXBo IG9uIFRBIGJpbmFyeSBhbmQgY29uZmlndXJhdGlvbiBkYXRhIGNvbWluZyBmcm9tIHR3byBkaWZm ZXJlbnQgc291cmNlcy4gVGhpcyBwYXJhZ3JhcGggaXMgbm90IGNsZWFybHkgc3RhdGVkIGFzIGFu IGFzc3VtcHRpb24sIElNSE8uIFRoZSBsYXN0IHNlbnRlbmNlIG9mIHRoZSBwYXJhZ3JhcGgNCiAg ICAgICAgICAgICAgICAgICAgICAiVGhlIHNlY29uZCBjYXNlIGNhbGxzIGZvciBhbiBleHRlbnNp b24gd2hlbiBhIFRBTSBpcyBhYnNlbnQuIg0KICAgIERvZXMgdGhpcyBtZWFuIHRoYXQgdGhlIGN1 cnJlbnQgYXJjaGl0ZWN0dXJlIGRvZXMgbm90IHByb3ZpZGUgZm9yIGEgQ2xpZW50IEFwcGxpY2F0 aW9uIHByb3ZpZGluZyB0aGUgVEEgYmluYXJ5PyBUaGlzIHNlZW1zIHByb2JsZW1hdGljIGZvciBt ZSwgYmVjYXVzZSB0aGlzIHZlY3RvciAoQ2xpZW50IEFwcCBzdXBwbHlpbmcgdGhlIFRBKSBpcyB0 aGUgZXhhY3QgdmVjdG9yIHVzZWQgYnkgSW50ZWwgU0dYLg0KICAgIA0KICAgIElzIHRoZSBhc3N1 bXB0aW9uIGhlcmUgdGhhdCBzdWNoIHZlY3RvciB3aWxsIG5vdCBiZSBjb3ZlcmVkIGJ5IHRoZSBh cmNoaXRlY3R1cmU/IFdoeT8gUGVyaGFwcyB3ZSBjYW4gaGVscCBjb3JyZWN0IHRoYXQgc28gaXQg ZG9lcyBub3QgaGF2ZSB0byBiZSBkZWZlcnJlZCB1bnRpbCBhbiBleHRlbnNpb24uDQogICAgDQog ICAgVGhhbmtzLA0KICAgIERhdmUgV2hlZWxlcg0KICAgIA0KICAgIA0KICAgIC0tLS0tT3JpZ2lu YWwgTWVzc2FnZS0tLS0tDQogICAgRnJvbTogVEVFUCBbbWFpbHRvOnRlZXAtYm91bmNlc0BpZXRm Lm9yZ10gT24gQmVoYWxmIE9mIGludGVybmV0LWRyYWZ0c0BpZXRmLm9yZw0KICAgIFNlbnQ6IFdl ZG5lc2RheSwgSnVseSA0LCAyMDE4IDc6NDkgQU0NCiAgICBUbzogaS1kLWFubm91bmNlQGlldGYu b3JnDQogICAgQ2M6IHRlZXBAaWV0Zi5vcmcNCiAgICBTdWJqZWN0OiBbVGVlcF0gSS1EIEFjdGlv bjogZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVjdHVyZS0wMC50eHQNCiAgICANCiAgICANCiAgICBB IE5ldyBJbnRlcm5ldC1EcmFmdCBpcyBhdmFpbGFibGUgZnJvbSB0aGUgb24tbGluZSBJbnRlcm5l dC1EcmFmdHMgZGlyZWN0b3JpZXMuDQogICAgVGhpcyBkcmFmdCBpcyBhIHdvcmsgaXRlbSBvZiB0 aGUgVHJ1c3RlZCBFeGVjdXRpb24gRW52aXJvbm1lbnQgUHJvdmlzaW9uaW5nIFdHIG9mIHRoZSBJ RVRGLg0KICAgIA0KICAgICAgICAgICAgVGl0bGUgICAgICAgICAgIDogVHJ1c3RlZCBFeGVjdXRp b24gRW52aXJvbm1lbnQgUHJvdmlzaW9uaW5nIChURUVQKSBBcmNoaXRlY3R1cmUNCiAgICAgICAg ICAgIEF1dGhvcnMgICAgICAgICA6IE1pbmdsaWFuZyBQZWkNCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIEhhbm5lcyBUc2Nob2ZlbmlnDQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBBbmRyZXcgQXR5ZW8NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERhcGVuZw0KICAg IAlGaWxlbmFtZSAgICAgICAgOiBkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlLTAwLnR4dA0K ICAgIAlQYWdlcyAgICAgICAgICAgOiAyNA0KICAgIAlEYXRlICAgICAgICAgICAgOiAyMDE4LTA3 LTAyDQogICAgDQogICAgQWJzdHJhY3Q6DQogICAgICAgQSBUcnVzdGVkIEV4ZWN1dGlvbiBFbnZp cm9ubWVudCAoVEVFKSB3YXMgZGVzaWduZWQgdG8gcHJvdmlkZSBhDQogICAgICAgaGFyZHdhcmUt aXNvbGF0aW9uIG1lY2hhbmlzbSB0byBzZXBhcmF0ZSBhIHJlZ3VsYXIgb3BlcmF0aW5nIHN5c3Rl bQ0KICAgICAgIGZyb20gc2VjdXJpdHktIHNlbnNpdGl2ZSBhcHBsaWNhdGlvbnMuDQogICAgDQog ICAgICAgVGhpcyBhcmNoaXRlY3R1cmUgZG9jdW1lbnQgbW90aXZhdGVzIHRoZSBkZXNpZ24gYW5k IHN0YW5kYXJkaXphdGlvbg0KICAgICAgIG9mIGEgcHJvdG9jb2wgZm9yIG1hbmFnaW5nIHRoZSBs aWZlY3lsZSBvZiB0cnVzdGVkIGFwcGxpY2F0aW9ucw0KICAgICAgIHJ1bm5pbmcgaW5zaWRlIGEg VEVFLg0KICAgIA0KICAgIA0KICAgIFRoZSBJRVRGIGRhdGF0cmFja2VyIHN0YXR1cyBwYWdlIGZv ciB0aGlzIGRyYWZ0IGlzOg0KICAgIGh0dHBzOi8vY2xpY2t0aW1lLnN5bWFudGVjLmNvbS9hLzEv Ny13Ml9GUU9YUk1pMkRuNVd3S0RfMHk5cHcyRUZJVzl4a0FiVXpvVjctND0/ZD1LMzluMFdsdXpx QUNNZWpicjV2cG1RaXd4RFBlbHlDRU9VcXBmS0Jyenl6ZEpBQ3BZQ014UUJ0WXYyOFlTUkJyd3Bq UXp2aGN1b3hGbTI3d3YzUWtYLXYwOVlwZE95emFHdEF5XzBTdkpYMGdCWk5sdllVU3ptemltTzlu aFhRLXh6WG12MGF3cnRJb3JXTVkwSGdsR2VrTHU4WlRVY2hmcWJvUG1XdXUxdzlHdUUzYmRjQlBs ZmxCQlN1cEhOT2JBU3gxWGZKbWpEQTZzblV6UFNjVjQ3dEZ2dDBtQTI4Tlp0Wmx1R05JMVdkQm13 dE5LY0oweFBCQkNqNGpTcWhvZDNwNFhzMVQ5dGdpWWJ5MGh1YXBOVzU4Mk9tekhHbVg3YXhLdVNs NjJ3ZnlFM1lYZGJ0N0VvZEtYZXYyS1F5YWJlV1hRNTlNaU15NnE5ekJQNGxoVmJUWVRYUUpHcTh1 VVlad1M0R3JpSDVsVlcwNE9QS1daaW94TWNnb2E3bUFFLXRfT3k1cUphaWJjREpHMnpqY2IwU19u MFFGOUFhSllZWjN5TGxEV0JWYmlGMjdIWDhjJnU9aHR0cHMlM0ElMkYlMkZkYXRhdHJhY2tlci5p ZXRmLm9yZyUyRmRvYyUyRmRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUlMkYNCiAgICANCiAg ICBUaGVyZSBhcmUgYWxzbyBodG1saXplZCB2ZXJzaW9ucyBhdmFpbGFibGUgYXQ6DQogICAgaHR0 cHM6Ly9jbGlja3RpbWUuc3ltYW50ZWMuY29tL2EvMS80Ull4Z3dBTzFIUGlnN2JMZGFGM0U3LWJ0 YnVmY0JqbUFVRGRyUlNtMmlFPT9kPUszOW4wV2x1enFBQ01lamJyNXZwbVFpd3hEUGVseUNFT1Vx cGZLQnJ6eXpkSkFDcFlDTXhRQnRZdjI4WVNSQnJ3cGpRenZoY3VveEZtMjd3djNRa1gtdjA5WXBk T3l6YUd0QXlfMFN2SlgwZ0JaTmx2WVVTem16aW1POW5oWFEteHpYbXYwYXdydElvcldNWTBIZ2xH ZWtMdThaVFVjaGZxYm9QbVd1dTF3OUd1RTNiZGNCUGxmbEJCU3VwSE5PYkFTeDFYZkptakRBNnNu VXpQU2NWNDd0RnZ0MG1BMjhOWnRabHVHTkkxV2RCbXd0TktjSjB4UEJCQ2o0alNxaG9kM3A0WHMx VDl0Z2lZYnkwaHVhcE5XNTgyT216SEdtWDdheEt1U2w2MndmeUUzWVhkYnQ3RW9kS1hldjJLUXlh YmVXWFE1OU1pTXk2cTl6QlA0bGhWYlRZVFhRSkdxOHVVWVp3UzRHcmlINWxWVzA0T1BLV1ppb3hN Y2dvYTdtQUUtdF9PeTVxSmFpYmNESkcyempjYjBTX24wUUY5QWFKWVlaM3lMbERXQlZiaUYyN0hY OGMmdT1odHRwcyUzQSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRtbCUyRmRyYWZ0LWlldGYtdGVl cC1hcmNoaXRlY3R1cmUtMDANCiAgICBodHRwczovL2NsaWNrdGltZS5zeW1hbnRlYy5jb20vYS8x L0xLMkhNaXZrMF9TUVhzQjFVWTVIeFRQcnZ0cHBfY1h0eWFLYXN3aC1tRHc9P2Q9SzM5bjBXbHV6 cUFDTWVqYnI1dnBtUWl3eERQZWx5Q0VPVXFwZktCcnp5emRKQUNwWUNNeFFCdFl2MjhZU1JCcndw alF6dmhjdW94Rm0yN3d2M1FrWC12MDlZcGRPeXphR3RBeV8wU3ZKWDBnQlpObHZZVVN6bXppbU85 bmhYUS14elhtdjBhd3J0SW9yV01ZMEhnbEdla0x1OFpUVWNoZnFib1BtV3V1MXc5R3VFM2JkY0JQ bGZsQkJTdXBITk9iQVN4MVhmSm1qREE2c25VelBTY1Y0N3RGdnQwbUEyOE5adFpsdUdOSTFXZEJt d3ROS2NKMHhQQkJDajRqU3Fob2QzcDRYczFUOXRnaVlieTBodWFwTlc1ODJPbXpIR21YN2F4S3VT bDYyd2Z5RTNZWGRidDdFb2RLWGV2MktReWFiZVdYUTU5TWlNeTZxOXpCUDRsaFZiVFlUWFFKR3E4 dVVZWndTNEdyaUg1bFZXMDRPUEtXWmlveE1jZ29hN21BRS10X095NXFKYWliY0RKRzJ6amNiMFNf bjBRRjlBYUpZWVozeUxsRFdCVmJpRjI3SFg4YyZ1PWh0dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIu aWV0Zi5vcmclMkZkb2MlMkZodG1sJTJGZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVjdHVyZS0wMA0K ICAgIA0KICAgIA0KICAgIFBsZWFzZSBub3RlIHRoYXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2Yg bWludXRlcyBmcm9tIHRoZSB0aW1lIG9mIHN1Ym1pc3Npb24gdW50aWwgdGhlIGh0bWxpemVkIHZl cnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9yZy4NCiAgICANCiAg ICBJbnRlcm5ldC1EcmFmdHMgYXJlIGFsc28gYXZhaWxhYmxlIGJ5IGFub255bW91cyBGVFAgYXQ6 DQogICAgZnRwOi8vZnRwLmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy8NCiAgICANCiAgICBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KICAgIFRFRVAgbWFp bGluZyBsaXN0DQogICAgVEVFUEBpZXRmLm9yZw0KICAgIGh0dHBzOi8vY2xpY2t0aW1lLnN5bWFu dGVjLmNvbS9hLzEvWmN4TU1HUmwxNXJhdl91N1B2T0cwRXphS2dBTWVMdTY0YS0xaHRKdFFYOD0/ ZD1LMzluMFdsdXpxQUNNZWpicjV2cG1RaXd4RFBlbHlDRU9VcXBmS0Jyenl6ZEpBQ3BZQ014UUJ0 WXYyOFlTUkJyd3BqUXp2aGN1b3hGbTI3d3YzUWtYLXYwOVlwZE95emFHdEF5XzBTdkpYMGdCWk5s dllVU3ptemltTzluaFhRLXh6WG12MGF3cnRJb3JXTVkwSGdsR2VrTHU4WlRVY2hmcWJvUG1XdXUx dzlHdUUzYmRjQlBsZmxCQlN1cEhOT2JBU3gxWGZKbWpEQTZzblV6UFNjVjQ3dEZ2dDBtQTI4Tlp0 Wmx1R05JMVdkQm13dE5LY0oweFBCQkNqNGpTcWhvZDNwNFhzMVQ5dGdpWWJ5MGh1YXBOVzU4Mk9t ekhHbVg3YXhLdVNsNjJ3ZnlFM1lYZGJ0N0VvZEtYZXYyS1F5YWJlV1hRNTlNaU15NnE5ekJQNGxo VmJUWVRYUUpHcTh1VVlad1M0R3JpSDVsVlcwNE9QS1daaW94TWNnb2E3bUFFLXRfT3k1cUphaWJj REpHMnpqY2IwU19uMFFGOUFhSllZWjN5TGxEV0JWYmlGMjdIWDhjJnU9aHR0cHMlM0ElMkYlMkZ3 d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0ZWVwDQogICAgDQogICAgX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCiAgICBURUVQIG1haWxp bmcgbGlzdA0KICAgIFRFRVBAaWV0Zi5vcmcNCiAgICBodHRwczovL2NsaWNrdGltZS5zeW1hbnRl Yy5jb20vYS8xL1pjeE1NR1JsMTVyYXZfdTdQdk9HMEV6YUtnQU1lTHU2NGEtMWh0SnRRWDg9P2Q9 SzM5bjBXbHV6cUFDTWVqYnI1dnBtUWl3eERQZWx5Q0VPVXFwZktCcnp5emRKQUNwWUNNeFFCdFl2 MjhZU1JCcndwalF6dmhjdW94Rm0yN3d2M1FrWC12MDlZcGRPeXphR3RBeV8wU3ZKWDBnQlpObHZZ VVN6bXppbU85bmhYUS14elhtdjBhd3J0SW9yV01ZMEhnbEdla0x1OFpUVWNoZnFib1BtV3V1MXc5 R3VFM2JkY0JQbGZsQkJTdXBITk9iQVN4MVhmSm1qREE2c25VelBTY1Y0N3RGdnQwbUEyOE5adFps dUdOSTFXZEJtd3ROS2NKMHhQQkJDajRqU3Fob2QzcDRYczFUOXRnaVlieTBodWFwTlc1ODJPbXpI R21YN2F4S3VTbDYyd2Z5RTNZWGRidDdFb2RLWGV2MktReWFiZVdYUTU5TWlNeTZxOXpCUDRsaFZi VFlUWFFKR3E4dVVZWndTNEdyaUg1bFZXMDRPUEtXWmlveE1jZ29hN21BRS10X095NXFKYWliY0RK RzJ6amNiMFNfbjBRRjlBYUpZWVozeUxsRFdCVmJpRjI3SFg4YyZ1PWh0dHBzJTNBJTJGJTJGd3d3 LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGdGVlcA0KICAgIA0KDQo= From nobody Thu Jul 5 12:37:57 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40099130DCD for ; Thu, 5 Jul 2018 12:37:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qKIZvwTVRSsF for ; Thu, 5 Jul 2018 12:37:53 -0700 (PDT) Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E2881294D0 for ; Thu, 5 Jul 2018 12:37:53 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga007.jf.intel.com ([10.7.209.58]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jul 2018 12:37:52 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,313,1526367600"; d="scan'208";a="54334569" Received: from fmsmsx108.amr.corp.intel.com ([10.18.124.206]) by orsmga007.jf.intel.com with ESMTP; 05 Jul 2018 12:37:50 -0700 Received: from fmsmsx126.amr.corp.intel.com (10.18.125.43) by FMSMSX108.amr.corp.intel.com (10.18.124.206) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 12:37:52 -0700 Received: from crsmsx101.amr.corp.intel.com (172.18.63.136) by FMSMSX126.amr.corp.intel.com (10.18.125.43) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 12:37:52 -0700 Received: from crsmsx102.amr.corp.intel.com ([169.254.2.60]) by CRSMSX101.amr.corp.intel.com ([169.254.1.192]) with mapi id 14.03.0319.002; Thu, 5 Jul 2018 13:37:50 -0600 From: "Wheeler, David M" To: "teep@ietf.org" Thread-Topic: Comments on [Teep] I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdw== Date: Thu, 5 Jul 2018 19:37:50 +0000 Message-ID: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMmJhYjQ4YmUtYzQ5ZS00NTVkLWJmYTAtZTJjNmIxOTU2MjQ3IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiNHVpU0FGMklVOHhSTjViMllVZVJYblBDUFlQcUthMlpVUzVCbzRack5pYWQyZFR3bnZ4WWNmVEF5Y2tsejZTOSJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.200.100 dlp-reaction: no-action x-originating-ip: [172.18.205.10] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 19:37:55 -0000 I have several comments on the new architecture draft. The first comment has to do with the definition of the "Trust Anchor" (page= 4) The definition states: Trust Anchor: A root certificate that can be used to validate its certificates. It is usually embedded in a devic= e or configured by a TAM for validating the trust of= a remote entity's certificate. Then later in section 3 (page 6) This specification assumes that an applicable device is equipped with one or more TEEs and each TEE is pre-provisioned with a device-unique public/private key pair, which is securely stored. This key pair is referred to as the 'root of trust' for remote attestation of the associated TEE in a device by an TAM. It is not clear whether the "Trust Anchor" is the same as the "root-of-trus= t" key pair, since the "root-of-trust" is not included in the definitions. If they are intended to be different (which is what I believe), then I sugg= est we add the "root-of-trust" to the definitions, and explain the differen= ce. Oftentimes, in my experience, these terms are used interchangeably. Here is my attempt to create definitions for these two types of keys: Trust Anchor: A trust anchor is public asymmetric key, preferably contained= in a certificate=20 that represents a trusted entity to a device. T= his public key may be used by=20 the holder of the corresponding private key to = sign other certificates, thereby communicating the signed certificate ma= y also be trusted.=20 The trust anchor is usually embedded in a devic= e or configured by a TAM=20 and used by the device to validate the trust o= f a remote entity by verifying that entity's certificate is signed b= y a trust anchor. Trust anchors must be stored in a way that pre= vents or strongly resists modification by unauthorized software and hard= ware adversaries. An example of a trust anchor is the public key of a TAM or SP wh= ich is=20 "pinned" or securely stored inside the device, an= d that trust anchor is used=20 like a CA certificate to validate the trust in = other keys/certificates. A trust anchor may be viewed by both trusted and= untrusted entities on the device, But may only be modified or deleted by a trusted = entity. Root-of-Trust Key: A device-unique key generated at device manufacturing o= r at TEE provisioning, which is securely stored and = only accessible to the TEE. The Root-of-Trust Key is used for attestation s= igning which proves the signed message originated or was approved by the TEE, = and may be trusted to the same degree as the TEE. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-teep-architecture-00 https://datatracker.ietf.org/doc/html/draft-ietf-teep-architecture-00 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep From nobody Thu Jul 5 12:41:03 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 944C7130F6C for ; Thu, 5 Jul 2018 12:41:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qUxNmvTI_4pY for ; Thu, 5 Jul 2018 12:40:57 -0700 (PDT) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20053.outbound.protection.outlook.com [40.107.2.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A1BD130DCD for ; Thu, 5 Jul 2018 12:40:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7jppSfdZjZtxvJEssViq2PAoa/0KPTH927W5o7xfp28=; b=k4UIUA5aDM16qNnjHTqftVIJzuRypuXyqnSXeRBQGmS58Nz0+3IooHqZi+85WAzd+MTvJ9STLMjtsmD7Sbal8jg83hodpK1h+Tz+A710pe9X3V1jmV6s5+isXcf1VhIy/LS4jm8e5OpdW4sUY7OMRwST8TjLVfqt/AqOBJ6x2W0= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB2032.eurprd08.prod.outlook.com (10.173.74.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.906.26; Thu, 5 Jul 2018 19:40:53 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db%10]) with mapi id 15.20.0906.026; Thu, 5 Jul 2018 19:40:53 +0000 From: Hannes Tschofenig To: "Wheeler, David M" , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrw Date: Thu, 5 Jul 2018 19:40:53 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> In-Reply-To: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.118.234] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB2032; 7:2j1shpnSG/xz6CPo0puuTu8E+ZWbhbjQNPV+MGbb5DJE5iH6PFfWeBnD37VY3CvKIgYC0v8ISNICGv2F6L5+Gk+nAHECBDHVkr9a2itTgIFiOqsqlpDarekVBJRBh5HojO0/POX/G0AIP61ufhTO3BGQ+AQp0PAgf0MMshrN75O2lKQ6AGq6Ffzb72hrMnYUqBiVzjo+RIIH6zjF98wApCUUhrx8r3FSe0rL4w4LL8Ni9eV4WJpJFSqQY/4l2l8a x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 5a8783ef-c86b-49b6-d4c4-08d5e2af3839 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB2032; x-ms-traffictypediagnostic: VI1PR0801MB2032: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(120809045254105)(223705240517415)(17755550239193); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006095)(93001095)(3231254)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123562045)(20161123558120)(20161123560045)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB2032; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB2032; x-forefront-prvs: 0724FCD4CD x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(136003)(366004)(376002)(396003)(346002)(189003)(199004)(13464003)(40434004)(2501003)(97736004)(14454004)(74316002)(66066001)(478600001)(5250100002)(7736002)(256004)(8676002)(305945005)(86362001)(5024004)(14444005)(966005)(316002)(6246003)(5660300001)(110136005)(53936002)(99286004)(7696005)(9686003)(106356001)(25786009)(6436002)(26005)(446003)(186003)(6116002)(55016002)(76176011)(6506007)(53546011)(8936002)(102836004)(486006)(476003)(6306002)(229853002)(3846002)(11346002)(2900100001)(72206003)(33656002)(2906002)(68736007)(81166006)(81156014)(105586002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB2032; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 6DXj6LhCtKChOJ1S8EGs0eN3IsQtAMVVEZpbD7bbWJPUtdS/nVhnQJZOoQ2brSRleRnfsjSQ+t2vFXQOQrGv7R5kbFocafdziNxCSbARMQjDevsbswEDxGx4DK93zu5PXO+19YsQcgc9mZ+ATxA67f5SeYd7InxJ7FuBlptHMjMRu0b5xpg8tCYmWODkq1qg/l4P/RwWhwWuI7G+QXAfZsyPi67NcBl2V2QvXmhM1vW/U3CrKJR8BHTw9QiYpnfnUD0zuvTTEWH2CwmcOvQwUpLFbnoOwOEum6drUxzkCTiXEsOhKBr8n5a80sY03WxwesJ+OATZDMV1Bszsmgq4W7Y0aecKEn/3yUsIwhw2aME= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5a8783ef-c86b-49b6-d4c4-08d5e2af3839 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Jul 2018 19:40:53.1510 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB2032 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 19:41:02 -0000 Just a quick remark: IMHO root of trust and trust anchor are the same thing= . I believe we should update the text to only talk about trust anchors and = forget the root of trust terminology. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M Sent: 05 July 2018 21:38 To: teep@ietf.org Subject: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt I have several comments on the new architecture draft. The first comment has to do with the definition of the "Trust Anchor" (page= 4) The definition states: Trust Anchor: A root certificate that can be used to validate its certificates. It is usually embedded in a devic= e or configured by a TAM for validating the trust of= a remote entity's certificate. Then later in section 3 (page 6) This specification assumes that an applicable device is equipped with one or more TEEs and each TEE is pre-provisioned with a device-unique public/private key pair, which is securely stored. This key pair is referred to as the 'root of trust' for remote attestation of the associated TEE in a device by an TAM. It is not clear whether the "Trust Anchor" is the same as the "root-of-trus= t" key pair, since the "root-of-trust" is not included in the definitions. If they are intended to be different (which is what I believe), then I sugg= est we add the "root-of-trust" to the definitions, and explain the differen= ce. Oftentimes, in my experience, these terms are used interchangeably. Here is my attempt to create definitions for these two types of keys: Trust Anchor: A trust anchor is public asymmetric key, preferably contained= in a certificate that represents a trusted entity to a device. T= his public key may be used by the holder of the corresponding private key to = sign other certificates, thereby communicating the signed certificate ma= y also be trusted. The trust anchor is usually embedded in a devic= e or configured by a TAM and used by the device to validate the trust o= f a remote entity by verifying that entity's certificate is signed b= y a trust anchor. Trust anchors must be stored in a way that pre= vents or strongly resists modification by unauthorized software and hard= ware adversaries. An example of a trust anchor is the public key of a TAM or SP whi= ch is "pinned" or securely stored inside the device, an= d that trust anchor is used like a CA certificate to validate the trust in = other keys/certificates. A trust anchor may be viewed by both trusted and= untrusted entities on the device, But may only be modified or deleted by a trusted = entity. Root-of-Trust Key: A device-unique key generated at device manufacturing o= r at TEE provisioning, which is securely stored and = only accessible to the TEE. The Root-of-Trust Key is used for attestation s= igning which proves the signed message originated or was approved by the TEE, = and may be trusted to the same degree as the TEE. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-teep-architecture-00 https://datatracker.ietf.org/doc/html/draft-ietf-teep-architecture-00 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Thu Jul 5 12:51:55 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91C66130F75 for ; Thu, 5 Jul 2018 12:51:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YrMFPl6Z7QTk for ; Thu, 5 Jul 2018 12:51:50 -0700 (PDT) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3897C130F6D for ; Thu, 5 Jul 2018 12:51:50 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jul 2018 12:51:49 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,313,1526367600"; d="scan'208";a="64733258" Received: from fmsmsx104.amr.corp.intel.com ([10.18.124.202]) by orsmga003.jf.intel.com with ESMTP; 05 Jul 2018 12:51:40 -0700 Received: from FMSMSX109.amr.corp.intel.com (10.18.116.9) by fmsmsx104.amr.corp.intel.com (10.18.124.202) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 12:51:39 -0700 Received: from crsmsx151.amr.corp.intel.com (172.18.7.86) by fmsmsx109.amr.corp.intel.com (10.18.116.9) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 12:51:39 -0700 Received: from crsmsx102.amr.corp.intel.com ([169.254.2.60]) by CRSMSX151.amr.corp.intel.com ([169.254.3.101]) with mapi id 14.03.0319.002; Thu, 5 Jul 2018 13:51:38 -0600 From: "Wheeler, David M" To: Hannes Tschofenig , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AQHUFJgg0lRWCPXA+UuJ2PLzqv/v86SBCEWg Date: Thu, 5 Jul 2018 19:51:38 +0000 Message-ID: <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiYTg5ZGY0ODQtOWM1Mi00MmM2LWI0N2QtYzE2OWI3OGI3ODgwIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiSjJnUnpnNWdON3h0VVJlMm52WXhyamxtcGk1eUtaTld3TFBxcWxvT1RtK0F0XC9sdkdXZHNzQ1ZiM1lhUGNoOXQifQ== x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.200.100 dlp-reaction: no-action x-originating-ip: [172.18.205.10] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 19:51:53 -0000 Hannes, If that is the case (trust root and trust anchors are the same), then I hav= e a concern regarding crypto separation. In one definition the Trust Anchor signs certificates, in the other definit= ion a Root-of-Trust signs attestations. If these are in fact the same key, then they are being used for two differe= nt functions, which is not recommended for cryptographic keys. Further, it seems to me (though I may be misunderstanding the intended func= tion), the private key of the Trust Anchor resides outside the device, in a= separate entity, like a CA or a TAM. However, the private key of a Root-of-Trust resides in the TEE (or is acces= sible only to the TEE). Can you pick apart my understanding of the two definitions of keys, and hel= p me understand where I got thrown off? Thanks, Dave Wheeler=20 -----Original Message----- From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com]=20 Sent: Thursday, July 5, 2018 12:41 PM To: Wheeler, David M ; teep@ietf.org Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Just a quick remark: IMHO root of trust and trust anchor are the same thing= . I believe we should update the text to only talk about trust anchors and = forget the root of trust terminology. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M Sent: 05 July 2018 21:38 To: teep@ietf.org Subject: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt I have several comments on the new architecture draft. The first comment has to do with the definition of the "Trust Anchor" (page= 4) The definition states: Trust Anchor: A root certificate that can be used to validate its certificates. It is usually embedded in a devic= e or configured by a TAM for validating the trust of= a remote entity's certificate. Then later in section 3 (page 6) This specification assumes that an applicable device is equipped with one = or more TEEs and each TEE is pre-provisioned with a device-unique public/p= rivate key pair, which is securely stored. This key pair is referred to as= the 'root of trust' for remote attestation of the associated TEE in a dev= ice by an TAM. It is not clear whether the "Trust Anchor" is the same as the "root-of-trus= t" key pair, since the "root-of-trust" is not included in the definitions. If they are intended to be different (which is what I believe), then I sugg= est we add the "root-of-trust" to the definitions, and explain the differen= ce. Oftentimes, in my experience, these terms are used interchangeably. Here is my attempt to create definitions for these two types of keys: Trust Anchor: A trust anchor is public asymmetric key, preferably contained= in a certificate that represents a trusted entity to a device. T= his public key may be used by the holder of the corresponding private key to = sign other certificates, thereby communicating the signed certificate ma= y also be trusted. The trust anchor is usually embedded in a devic= e or configured by a TAM and used by the device to validate the trust o= f a remote entity by verifying that entity's certificate is signed b= y a trust anchor. Trust anchors must be stored in a way that pre= vents or strongly resists modification by unauthorized software and hard= ware adversaries. An example of a trust anchor is the public key of a TAM or SP whi= ch is "pinned" or securely stored inside the device, an= d that trust anchor is used like a CA certificate to validate the trust in = other keys/certificates. A trust anchor may be viewed by both trusted and= untrusted entities on the device, But may only be modified or deleted by a trusted = entity. Root-of-Trust Key: A device-unique key generated at device manufacturing o= r at TEE provisioning, which is securely stored and = only accessible to the TEE. The Root-of-Trust Key is used for attestation s= igning which proves the signed message originated or was approved by the TEE, = and may be trusted to the same degree as the TEE. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-teep-architecture-00 https://datatracker.ietf.org/doc/html/draft-ietf-teep-architecture-00 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Thu Jul 5 13:34:40 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FB9C12D7F8 for ; Thu, 5 Jul 2018 13:34:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qHXwzuWjPd4N for ; Thu, 5 Jul 2018 13:34:35 -0700 (PDT) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 792D1130F78 for ; Thu, 5 Jul 2018 13:34:35 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jul 2018 13:34:35 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,313,1526367600"; d="scan'208";a="238148011" Received: from fmsmsx107.amr.corp.intel.com ([10.18.124.205]) by orsmga005.jf.intel.com with ESMTP; 05 Jul 2018 13:34:34 -0700 Received: from crsmsx101.amr.corp.intel.com (172.18.63.136) by fmsmsx107.amr.corp.intel.com (10.18.124.205) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 13:34:34 -0700 Received: from crsmsx102.amr.corp.intel.com ([169.254.2.60]) by CRSMSX101.amr.corp.intel.com ([169.254.1.192]) with mapi id 14.03.0319.002; Thu, 5 Jul 2018 14:34:32 -0600 From: "Wheeler, David M" To: "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAGHJA Date: Thu, 5 Jul 2018 20:34:32 +0000 Message-ID: <0627F5240443D2498FAA65332EE46C843B66A0E0@CRSMSX102.amr.corp.intel.com> References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> In-Reply-To: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMmJhYjQ4YmUtYzQ5ZS00NTVkLWJmYTAtZTJjNmIxOTU2MjQ3IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiNHVpU0FGMklVOHhSTjViMllVZVJYblBDUFlQcUthMlpVUzVCbzRack5pYWQyZFR3bnZ4WWNmVEF5Y2tsejZTOSJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.200.100 dlp-reaction: no-action x-originating-ip: [172.18.205.10] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 20:34:39 -0000 My comments to this point have been primarily grammatical or elucidatory, i= n order to improve the clarity of the document. The following comment is (I= MHO) a required change to the specification in order to accommodate multipl= e types of TEEs, not just ARM TrustZone implementations: Section 5.1 page 9: Secure Boot:=20 Secure boot must enable authenticity checking of TEEs by the TAM. Note that some TEE implementations do not require secure boot functionality. This definition is incomplete, as it does not elucidate how the secure boot= checks the authenticity for the TEE, or how the TEE receives something fro= m the SBM to trust the TEE. Part of the problem, IMHO, is the assumption about how the TEE is booted, a= nd what the TCB of the TEE actually is. I suggest the following paragraphs = to replace that definition with a further architectural explanation (as fol= lows): --- TEE Attestation, Secure Boot, Trusted Firmware, and the TEE TCB In order for the TAM to trust information received over the TEEP protocol, = the Device and TEE must provide sufficient proof that the device and TEE ar= e trust worthy. The TAM must make a trust decision. A trust decision is bas= ed on cryptographic proof (a signed attestation) that the subject of the at= testation has control of the private portion of a key pair that is register= ed with a trusted certificate authority. This trusted key pair is the Root-= of-Trust key in the TEE. However, the TAM is required to make a further pol= icy decision based upon this attestation proof, namely that the registered = key in fact represents a TEE the TAM is willing to trust and that the key h= as not been revoked.=20 The trust the TAM places in the TEE is a combination of the cryptographic v= erification of the signed attestation and knowledge of the TEE's implementa= tion of its trusted computing base (TCB). The TCB is merely the essential b= ase elements of the TEE that must be trusted for the TEE to operate in a tr= ustworthy fashion. For some TEEs, the TCB is rooted in the secure boot of t= he device; in this case a proper attestation of the TEE requires an additio= nal attestation of the secure boot of the device, as well as the attestatio= n of the TEE itself. This is the case for the ARM Trust Zone architecture.= =20 The TCB of other TEEs are independent of the device's boot state, and there= fore do not require an attestation for the secure boot of the device. An ex= ample of this type of TEE architecture is a separate physical hardware eng= ine with its own separate secure ROM containing the TEE implementation; exa= mples of such implementations include a Secure Element (SE), a TPM, or the = Intel SGX architecture where the TEE is built completely from microcode in = the CPU secure ROM. In these instances, the device boot is separate from th= e TEE; and whether the device is securely booted or not, there is no effect= on the secure state of the TEE. In other cases, the TEE may be composed of multiple secure firmware or hard= ware elements, and a proper attestation of the TEE could require several si= gned attestations from different keys. Such a device might use a TPM for a = keystore combined with protected FW on a separate co-processor; this combin= ation would require an attestation from the co-processor's Root-of-Trust ke= y and an attestation from the TPM.=20 These examples show specific distinctions that are important for the TAM to= properly make trust decisions. These decisions are based on knowledge of t= he TEE implementation, and will be verified by the TAM by looking for the a= ppropriate attestations in the TEE attestation response. In order to accommodate these different instances, the TEE attestation must= accommodate the consolidation of multiple attestations from potentially di= fferent trust roots. In the ARM TrustZone case, an attestation from the SBM= is required to ensure the software that booted the TZ environment came fro= m a trusted platform source. Then a further attestation is required for the= TZ root-of-trust key to be verified. In the SGX case, because SGX is completely separate from the REE and the se= cure boot of the platform, only an attestation of the SGX Root-of-Trust key= is required.=20 It is easy to see from these examples that Trusted Firmware (TFW) and Secur= e Boot Modules (SBM) may be required to be included in some TEE attestation= s, but are not required in others. In fact, it may not even be possible to = include an SBM attestation in some SGX implementations because SGX will ope= rate with secure boot turned off, making the secure boot attestation inacce= ssible. Secure Boot Module (CBM): Some TEEs require a secure boot module to verify the software or firmware o= f the TEE. In these cases, the TEE attestation must include an attestation = from the SBM. Trusted Firmware (TFW): Some TEEs require software which is loaded over a potentially insecure chan= nel or from an insecure storage device. This software is normally signed by= the developer or device manufacturer using a private key corresponding to = a device Trust Anchor. When the software is loaded, a TFW verifies the sign= ature on the software using the securely stored Trust Anchor. In these case= s, the TEE attestation must include an attestation of the software signed b= y the TFW Root-of-Trust key. TEE Attestation: A TEE attestation is a combination of one or more cryptographically signed = attestation records corresponding to the separate TCB elements that compose= the TEE. A complete TEE attestation must include attestations from all TCB= elements in order for a TAM to properly verify a TEE. The TEE attestation = must include at least a TEE Root-of-Trust key attestation, but may also inc= lude an SBM attestation and zero or more TFW attestations. --- Hopefully this provides clarity to the discussion and during the Montreal m= eeting we can discuss this further if necessary. Thanks, Dave Wheeler -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-teep-architecture-00 https://datatracker.ietf.org/doc/html/draft-ietf-teep-architecture-00 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep From nobody Thu Jul 5 13:35:58 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C54B130F78 for ; Thu, 5 Jul 2018 13:35:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.011 X-Spam-Level: X-Spam-Status: No, score=-2.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pW3Pu7WaCnG6 for ; Thu, 5 Jul 2018 13:35:53 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0092.outbound.protection.outlook.com [104.47.36.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E09612D7F8 for ; Thu, 5 Jul 2018 13:35:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dL/i7kfa+ZXNXAU4swVYZo5hlsGf+Hb60cISbV+4Wew=; b=A/2ncGfiEweAna70NTBikX3zZN8ceKcEWSR5zrFXW0NXnXy5LUIED4inbbuCyH2JsgccplLAYHRd0CcgkjziB5a0LFgTuYxhRsBqBxI+/BVNWP4fBPfXC2MKYfPjenyXpLxesf966vTVUMJlGCrmYCTfoWhXUdOq7Rf2pHB/Oxw= Received: from DM5PR2101MB0805.namprd21.prod.outlook.com (10.167.105.149) by DM5PR2101MB1061.namprd21.prod.outlook.com (52.132.128.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.952.4; Thu, 5 Jul 2018 20:35:51 +0000 Received: from DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::30ec:e30c:8f5c:b685]) by DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::30ec:e30c:8f5c:b685%2]) with mapi id 15.20.0952.008; Thu, 5 Jul 2018 20:35:51 +0000 From: Dave Thaler To: "Wheeler, David M" , Hannes Tschofenig , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrwAABlbQAAAV1OEA== Date: Thu, 5 Jul 2018 20:35:50 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> In-Reply-To: <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-07-05T20:35:48.9413526Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:0:29d7:1c9f:76b6:59d7] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2101MB1061; 7:GWCkdD2wj/JeBroKq4jr0yk7ZebJGOojcRySwOVOqbAVnzp6mdAVxA54YmHV+A2Hme4kAcWXXdfuG4NkQxc4S5IIeTjO192E5p/02G5ocUz24ammskgMpbefazjdr+qBfTlG9hmrK0mVUbpnOUwjRmq3aOlipVu4wCsQs9zY6hoWNzN6yFOVltygzPXqjGI9Yqq2SY6Lz5esYsKB7fsykcV6Fwy+zyiPYOV8proa9qrsOaW80OJr1LC+COfLc1RG x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 4f161a99-41b8-4390-f190-08d5e2b6e5de x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:(223705240517415); BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7193020); SRVR:DM5PR2101MB1061; x-ms-traffictypediagnostic: DM5PR2101MB1061: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-ld-processed: 72f988bf-86f1-41af-91ab-2d7cd011db47,ExtAddr x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(180628864354917)(278428928389397)(189930954265078)(223705240517415)(219752817060721)(211171220733660)(228905959029699)(17755550239193); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3002001)(3231280)(2018427008)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123560045)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123562045)(6072148)(201708071742011)(7699016); SRVR:DM5PR2101MB1061; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2101MB1061; x-forefront-prvs: 0724FCD4CD x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(396003)(346002)(376002)(136003)(39860400002)(199004)(189003)(13464003)(40434004)(14444005)(14454004)(76176011)(7696005)(106356001)(966005)(105586002)(5660300001)(478600001)(256004)(10290500003)(99286004)(305945005)(8936002)(6306002)(55016002)(229853002)(9686003)(6436002)(22452003)(110136005)(7736002)(316002)(8676002)(81156014)(81166006)(74316002)(68736007)(5024004)(33656002)(97736004)(186003)(486006)(5250100002)(11346002)(446003)(476003)(46003)(53546011)(102836004)(25786009)(6506007)(2906002)(86612001)(86362001)(575784001)(53936002)(2900100001)(6116002)(6246003)(8990500004)(10090500001)(2501003); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB1061; H:DM5PR2101MB0805.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: GTLUtBjeP6mLx/2Af/xFNbri3WSzPMzbICDq8dnDejDjLB4jEyw3GyG6H35IMyf7pfptTfQoGIRRtirBSv4jdk3XZ3qtUvjb7m6HULg11Rs6PwEaRm5WWyD70pl7eayYKsWTL0GW7Crup5exOCX3sFWnodIMim5yKq+HDBYRvl9vfSj6XPAQllN79hyEQFqqPn5CgUezSyupXRPX4o17iefiqVXGVEGDsl+4ilyX6hCopuJb+g8eVnsqmmdgPa+b26BXviINcqp1uafNT+Pi2zX80bG4YvGLCMAt/VcoKtbgBrxnxZm5WJL+GIS4r4ctc8hZLRKb2sTCZ5lx/9skSm/eFQJpKIiDlq7fZpYY+2A= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4f161a99-41b8-4390-f190-08d5e2b6e5de X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Jul 2018 20:35:51.0611 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB1061 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 20:35:57 -0000 [speaking as an individual] As David says, there's more than one type of "Root-of-Trust" aka "trust anc= hor".=20 There are industry terms of art for the different types. One example article that gives a decent summary is https://healthitsecurity= .com/news/nist-roots-of-trust-for-healthcare-mobile-devices In particular, the industry terms (from NIST SP 800-164, potentially among = others) are: Roof of Trust for Storage (RTS) Root of Trust for Verification (RTV) Root of Trust for Integrity (RTI) Root of Trust for Reporting (RTR) Root of Trust for Measurement (RTM) I would recommend using the above terms and not using "trust anchor" or the= unqualified "root of trust" term. Dave -----Original Message----- From: TEEP On Behalf Of Wheeler, David M Sent: Thursday, July 5, 2018 12:52 PM To: Hannes Tschofenig ; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Hannes, If that is the case (trust root and trust anchors are the same), then I hav= e a concern regarding crypto separation. In one definition the Trust Anchor signs certificates, in the other definit= ion a Root-of-Trust signs attestations. If these are in fact the same key, then they are being used for two differe= nt functions, which is not recommended for cryptographic keys. Further, it seems to me (though I may be misunderstanding the intended func= tion), the private key of the Trust Anchor resides outside the device, in a= separate entity, like a CA or a TAM. However, the private key of a Root-of-Trust resides in the TEE (or is acces= sible only to the TEE). Can you pick apart my understanding of the two definitions of keys, and hel= p me understand where I got thrown off? Thanks, Dave Wheeler=20 -----Original Message----- From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com]=20 Sent: Thursday, July 5, 2018 12:41 PM To: Wheeler, David M ; teep@ietf.org Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Just a quick remark: IMHO root of trust and trust anchor are the same thing= . I believe we should update the text to only talk about trust anchors and = forget the root of trust terminology. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M Sent: 05 July 2018 21:38 To: teep@ietf.org Subject: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt I have several comments on the new architecture draft. The first comment has to do with the definition of the "Trust Anchor" (page= 4) The definition states: Trust Anchor: A root certificate that can be used to validate its certificates. It is usually embedded in a devic= e or configured by a TAM for validating the trust of= a remote entity's certificate. Then later in section 3 (page 6) This specification assumes that an applicable device is equipped with one = or more TEEs and each TEE is pre-provisioned with a device-unique public/p= rivate key pair, which is securely stored. This key pair is referred to as= the 'root of trust' for remote attestation of the associated TEE in a dev= ice by an TAM. It is not clear whether the "Trust Anchor" is the same as the "root-of-trus= t" key pair, since the "root-of-trust" is not included in the definitions. If they are intended to be different (which is what I believe), then I sugg= est we add the "root-of-trust" to the definitions, and explain the differen= ce. Oftentimes, in my experience, these terms are used interchangeably. Here is my attempt to create definitions for these two types of keys: Trust Anchor: A trust anchor is public asymmetric key, preferably contained= in a certificate that represents a trusted entity to a device. T= his public key may be used by the holder of the corresponding private key to = sign other certificates, thereby communicating the signed certificate ma= y also be trusted. The trust anchor is usually embedded in a devic= e or configured by a TAM and used by the device to validate the trust o= f a remote entity by verifying that entity's certificate is signed b= y a trust anchor. Trust anchors must be stored in a way that pre= vents or strongly resists modification by unauthorized software and hard= ware adversaries. An example of a trust anchor is the public key of a TAM or SP whi= ch is "pinned" or securely stored inside the device, an= d that trust anchor is used like a CA certificate to validate the trust in = other keys/certificates. A trust anchor may be viewed by both trusted and= untrusted entities on the device, But may only be modified or deleted by a trusted = entity. Root-of-Trust Key: A device-unique key generated at device manufacturing o= r at TEE provisioning, which is securely stored and = only accessible to the TEE. The Root-of-Trust Key is used for attestation s= igning which proves the signed message originated or was approved by the TEE, = and may be trusted to the same degree as the TEE. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatrac= ker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=3D02%7C01%7Cd= thaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141a= f91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DXBuTlsiV5Ojkxkcq= ULdsmroTnWRZqApH3fBokJGvkTE%3D&reserved=3D0 There are also htmlized versions available at: https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools.ie= tf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7C01%7Cdthale= r%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab= 2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DheO1xlxfrVZyyzYziQy8V= 2P0vxiEbTVSF8sFdNaw8sc%3D&reserved=3D0 https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatrac= ker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7= C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf= 86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DaoKW%2FFn= lzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&reserved=3D0 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 From nobody Thu Jul 5 14:19:56 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF5C8130F8E for ; Thu, 5 Jul 2018 14:19:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symantec.com header.b=L303aJeZ; dkim=pass (1024-bit key) header.d=symantec.com header.b=wcW3VyVG Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3tdwscepyzTD for ; Thu, 5 Jul 2018 14:19:49 -0700 (PDT) Received: from asbsmtoutape01.symantec.com (asbsmtoutape01.symantec.com [155.64.138.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 885F9130F91 for ; Thu, 5 Jul 2018 14:19:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=Symantec.com; s=2; c=relaxed/simple; q=dns/txt; i=@Symantec.com; t=1530825588; x=2394739188; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=4zKf4uVVjbus1skQi9TPX9+XVBerZG4Sva1idCOL9zM=; b=L303aJeZ+pHBn7kyi+gjUsoVWeWPY6lP740Ni/ulgitsYEexbNyUfCxbACKCd5+Q 003FL0qv9q1y54IB8hEtH8+6jJEZnWVNK8nOWq/bOuMfIPaM04PIPHsSsnSF+Td+ 8G771cOuxUodUXOJHBAkYbsDYbDlRi6oMhGzt7IXfVA=; Received: from asbsmtmtaapi02.symc.symantec.com (asb1-f5-symc-ext-prd-snat8.net.symantec.com [10.90.75.8]) by asbsmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id 45.0B.32556.47B8E3B5; Thu, 5 Jul 2018 21:19:48 +0000 (GMT) X-AuditID: 0a5af819-a231d9e000017f2c-bb-5b3e8b74f3f7 Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat8.net.symantec.com [10.90.75.8]) by asbsmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 0D.86.63223.47B8E3B5; Thu, 5 Jul 2018 21:19:48 +0000 (GMT) Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 5 Jul 2018 14:19:47 -0700 Received: from NAM01-BN3-obe.outbound.protection.outlook.com (10.44.128.10) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Thu, 5 Jul 2018 14:19:47 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symantec.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4zKf4uVVjbus1skQi9TPX9+XVBerZG4Sva1idCOL9zM=; b=wcW3VyVGYLx3kHKIUVG+xRpzubk/tBG0Di02YuRXeO1CQvIH9qT0adoXZwLKRgFiG1jvNVHa8Zv/Jo3IHOBPVfIjS1J5AurxwYyH46c01VCpnpm5/cKzP5e1C6o9Q+Njer9EHYGVvPgyjir7qPmAH9SkQDHQ31+2bXDYIjxDpOY= Received: from BL0PR16MB2260.namprd16.prod.outlook.com (52.132.28.27) by BL0PR16MB2226.namprd16.prod.outlook.com (52.132.28.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.906.26; Thu, 5 Jul 2018 21:19:46 +0000 Received: from BL0PR16MB2260.namprd16.prod.outlook.com ([fe80::c016:d0d7:8777:29a1]) by BL0PR16MB2260.namprd16.prod.outlook.com ([fe80::c016:d0d7:8777:29a1%5]) with mapi id 15.20.0930.016; Thu, 5 Jul 2018 21:19:46 +0000 From: Mingliang Pei To: "Wheeler, David M" , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAGHJA//+mXwA= Date: Thu, 5 Jul 2018 21:19:45 +0000 Message-ID: <77BA523A-750B-4EC7-A197-1A313E32BCAD@symantec.com> References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0E0@CRSMSX102.amr.corp.intel.com> In-Reply-To: <0627F5240443D2498FAA65332EE46C843B66A0E0@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.d.1.180523 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Mingliang_Pei@symantec.com; x-originating-ip: [155.64.23.48] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BL0PR16MB2226; 7:GJ4AsNkWDhAJ7Ri3ZZKmQ822jZvJw9C0mWMb7sdq2QwA9XMbWzvnNcE5tkMue1dSDl7fItcINsvaFg3kjFA+HD/MyWh6b7zsBecOaLy0wZISL7PVZBjXG6uHguQ2yAk58uPZ5TEGlkoXoPR6cJbIzghMDrixKh/sP5iz/f2Nj1Vyw6n0H/DPrqx8sbIVBjqWwnWpQtF9XA0v08ncah04ajg6IpX9vs4dHmw5chGdX/P9CHvGAJ/P6FBsO21/9w/S x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 4af8791c-c3d9-479a-9e93-08d5e2bd0860 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:BL0PR16MB2226; x-ms-traffictypediagnostic: BL0PR16MB2226: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(131327999870524)(258766100185102)(788757137089)(228905959029699)(17755550239193); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(3231254)(944501410)(52105095)(10201501046)(3002001)(149027)(150027)(6041310)(20161123558120)(20161123564045)(20161123560045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011)(7699016); SRVR:BL0PR16MB2226; BCL:0; PCL:0; RULEID:; SRVR:BL0PR16MB2226; x-forefront-prvs: 0724FCD4CD x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(39860400002)(366004)(396003)(376002)(346002)(13464003)(199004)(189003)(7736002)(25786009)(478600001)(10290500003)(53936002)(6306002)(68736007)(6512007)(83716003)(2906002)(2900100001)(82746002)(105586002)(966005)(80792005)(106356001)(256004)(14454004)(66066001)(14444005)(186003)(6246003)(97736004)(72206003)(36756003)(6116002)(11346002)(305945005)(99286004)(229853002)(486006)(3846002)(446003)(5660300001)(8936002)(6486002)(86362001)(575784001)(53546011)(8676002)(476003)(2501003)(2616005)(5250100002)(76176011)(110136005)(58126008)(26005)(316002)(33656002)(6436002)(102836004)(81166006)(6506007)(81156014); DIR:OUT; SFP:1101; SCL:1; SRVR:BL0PR16MB2226; H:BL0PR16MB2260.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: bCo/inYWjpkxXWodPxz5wSavYIel6c9e1O91FqhdRrrntWq4/DoJtBgDTZdgEpOGggy/GLMuZgW7vuV3GomwEJAV04lZZiOsf9goaD8xrYNJ25t3lai714/6EChZ6jE248ArNPdRJz0rwM47lbVE3y9IrqQrE4NVkNdz01U+iwFZ1zeTw0xWB817MOu9ycRrOzbj270HkHnAxxb88qulqGBhsoula0qF1OJLdqSLHEPjtt+20ztIkysqjn5kjGUD5/FvZpB6bMONm4MZVNg4k1iA//w3OScnfvETTkQW924ctykUyjcs7rIli1ee5SnCZlKMoM1RbCKH+CA0VSU7vOsn7BbMEEmwjrXZsIo0iao= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 4af8791c-c3d9-479a-9e93-08d5e2bd0860 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Jul 2018 21:19:45.8678 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR16MB2226 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTYRTHee692+6mg8eleZoGNipIcSqVDS2VPg1SUKsvE9PrvKn5yjYl DUrNF3RpClo5kUVNK5UkFfOVdGqZftCS0DQ0SSnrixpqy7B2dxX68vDj/P//55wDhyZldQI5 nZJhYHUZTJpCKKEkmgu0r8EYEuNfvOOlKnw3LlQ1/tkiwwi1xWIj1I/7V4lIQiM5m8impeSw Or+QeElywdKiKKu3AF3fejGK8lHVzXIkpgGfgvq2dVE5ktAyvI6gsaOP2Beel3RRHMvwNoKm 6WjeNIJgY/aniBe+IRiqyOMECleRMGReEPLCXQImmnz4xBKC5rnf9gRNC7E/TH3K4NAVX4ae NSfOfgBHQYullOTYFUeD5aNNyHMQPNoqd/Si8FEYKJ1w1KU4FHZtTwX89w0I+u5ZHWExvgSD HRsORvggbI+3OrYhsTvMLZv3NsNg6Z8keXaD1S+7Ao7dsBLu9HwQ8tlYsBV9RtycgL2g5TbL 2w/De7MRcX0BdxJQU1GIeMEX1mprSd4fAWvbZ3jPFALjztyexxumuyeFPKdCe6tFUIUCTf+N Z7LHSXwC2nr9+LIa2l5vkjwfgRrjksjkWN8F3tYtUw+RoBl5MfoEfbohM9vAZLH+AUp9brqW exj7uWiV2sz0duQ4mF+HutHIWLgVYRopnKXKgpAYmYDJsTutCGhS4SodiLKXpIlMbh6ry4zT ZaexeivyoCmFu3Reel8jw0mMgU1l2SxWt68StFiej1pNRUMXFSrnJ5u3qps8y2bOD5+c/TEf nk0V53jIFwTB1lhVj6Yk2efBMfWsMux4pEvQ6Uqm41nwmN+jwZHv2SujwV+7DJ5vvJKGDQmB aucZfCVJfnV9WeO2UiaLrJRSN8ROisXqVxHXsC/Z+rJ+pd7ccC40/m+cdgMtLIhDOhWUPpkJ 8CZ1euYfdhqMsywDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTURjHO/fezet84bQ0nwzLzD5obZoFSYRFBEpplJWUFnnTWw6d2rYk C8SXyNhcSanUQBS9iakoqeRroMOMHKVlQQ6txLf8IJnWZCqj3R0/9OXw4/z//+d5zuFhabmD 8WdVmTpek8llBElljCzxFKvQGaKSwut++0cWfhySRj5ft9HHqBhBsFMxtb3z1BkqUXYklc9Q 5fCasKhkWVrB5He37O4CdNv28g3KR6V5euTOAj4IzfdfMSLL8QqCutF4PZI5eQDB0tdlNyL8 RNBvvCMKDC6lob/qm5QIjyiw1O0liUkEDdZVZ4JlpTgcRsYzRfTBF6Br0UO0b8FnoVEopkX2 wfEgjNmlhA9DjU3v6sXgYHhdbHHde+Gj4LDXS0j5SgQ9FWZX2B2fh762JRcjvBVWhpookWns B9bpKoq8DIPQO0wT9oX5KYdEZF+shJKuL1KSvQL2ez+QOCfgQGgs4ok9AD5VGZDYF3A7BWXG QkQEBSyWl9PEHweLK4eIZwSBYc264QmF0c5hKeF0aG0SJMRUgsC2+H5juB3QYJxkSlGE6b+5 Tc66NA6Blu4wch0DLYN/acK7oMww6WZy/ctmePdsmqlGkgYUyGmvadU6tY7jslXhEUptrjpF PDjnuqQoU7LUrci1MGt+nejDeqwZYRYFeXpdDIhKkku4HKfTjLazTJCf106PsUQ5vsHp+HSe z+Y1VzW3MnitGVGsu38+klxfqJ/tWE5XqqJVloFttec6FuRv46ypgx713dHJfd6PjQNKhY6f O5GQZzB4Mt6Zd+PMNfrmAy+masdvbgquzc3/9blNsM1enqhsj0Z9u588pRwTM1rPma6U4cKi EKXpQY9BMTFX0XP80p7TFnVewoB7Td/J6ljFvtU/wlrWwyBGm8btD6U1Wu4f6vSirhEDAAA= X-CFilter-Loop: ASB04 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 21:19:54 -0000 SGkgRGF2aWQsDQoNClRoYW5rcyBzbyBtdWNoIGZvciB5b3VyIGRldGFpbGVkIHJldmlldy4gV2Ug Y2FuIHN1cmVseSBkaXNjdXNzIHNvbWUgb2YgdGhlc2UgcG9pbnRzIGZ1cnRoZXIgaW4gTW9udHJl YWwuIEkgd2lsbCBnbyB0aHJvdWdoIHRoZSBsaXN0IHRvIGluY29ycG9yYXRlIGluIHRoZSBuZXh0 IHJldmlzaW9uLg0KDQpUaGFua3MsDQoNCk1pbmcNCg0K77u/T24gNy81LzE4LCAxOjM0IFBNLCAi VEVFUCBvbiBiZWhhbGYgb2YgV2hlZWxlciwgRGF2aWQgTSIgPHRlZXAtYm91bmNlc0BpZXRmLm9y ZyBvbiBiZWhhbGYgb2YgZGF2aWQubS53aGVlbGVyQGludGVsLmNvbT4gd3JvdGU6DQoNCiAgICBN eSBjb21tZW50cyB0byB0aGlzIHBvaW50IGhhdmUgYmVlbiBwcmltYXJpbHkgZ3JhbW1hdGljYWwg b3IgZWx1Y2lkYXRvcnksIGluIG9yZGVyIHRvIGltcHJvdmUgdGhlIGNsYXJpdHkgb2YgdGhlIGRv Y3VtZW50LiBUaGUgZm9sbG93aW5nIGNvbW1lbnQgaXMgKElNSE8pIGEgcmVxdWlyZWQgY2hhbmdl IHRvIHRoZSBzcGVjaWZpY2F0aW9uIGluIG9yZGVyIHRvIGFjY29tbW9kYXRlIG11bHRpcGxlIHR5 cGVzIG9mIFRFRXMsIG5vdCBqdXN0IEFSTSBUcnVzdFpvbmUgaW1wbGVtZW50YXRpb25zOg0KICAg IA0KICAgIFNlY3Rpb24gNS4xIHBhZ2UgOToNCiAgICBTZWN1cmUgQm9vdDogDQogICAgICAgICAg U2VjdXJlIGJvb3QgbXVzdCBlbmFibGUgYXV0aGVudGljaXR5IGNoZWNraW5nIG9mIFRFRXMNCiAg ICAgICAgICBieSB0aGUgVEFNLiBOb3RlIHRoYXQgc29tZSBURUUgaW1wbGVtZW50YXRpb25zIGRv IG5vdCByZXF1aXJlDQogICAgICAgICAgc2VjdXJlIGJvb3QgZnVuY3Rpb25hbGl0eS4NCiAgICAN CiAgICBUaGlzIGRlZmluaXRpb24gaXMgaW5jb21wbGV0ZSwgYXMgaXQgZG9lcyBub3QgZWx1Y2lk YXRlIGhvdyB0aGUgc2VjdXJlIGJvb3QgY2hlY2tzIHRoZSBhdXRoZW50aWNpdHkgZm9yIHRoZSBU RUUsIG9yIGhvdyB0aGUgVEVFIHJlY2VpdmVzIHNvbWV0aGluZyBmcm9tIHRoZSBTQk0gdG8gdHJ1 c3QgdGhlIFRFRS4NCiAgICANCiAgICBQYXJ0IG9mIHRoZSBwcm9ibGVtLCBJTUhPLCBpcyB0aGUg YXNzdW1wdGlvbiBhYm91dCBob3cgdGhlIFRFRSBpcyBib290ZWQsIGFuZCB3aGF0IHRoZSBUQ0Ig b2YgdGhlIFRFRSBhY3R1YWxseSBpcy4gSSBzdWdnZXN0IHRoZSBmb2xsb3dpbmcgcGFyYWdyYXBo cyB0byByZXBsYWNlIHRoYXQgZGVmaW5pdGlvbiB3aXRoIGEgZnVydGhlciBhcmNoaXRlY3R1cmFs IGV4cGxhbmF0aW9uIChhcyBmb2xsb3dzKToNCiAgICANCiAgICAtLS0NCiAgICANCiAgICBURUUg QXR0ZXN0YXRpb24sIFNlY3VyZSBCb290LCBUcnVzdGVkIEZpcm13YXJlLCBhbmQgdGhlIFRFRSBU Q0INCiAgICBJbiBvcmRlciBmb3IgdGhlIFRBTSB0byB0cnVzdCBpbmZvcm1hdGlvbiByZWNlaXZl ZCBvdmVyIHRoZSBURUVQIHByb3RvY29sLCB0aGUgRGV2aWNlIGFuZCBURUUgbXVzdCBwcm92aWRl IHN1ZmZpY2llbnQgcHJvb2YgdGhhdCB0aGUgZGV2aWNlIGFuZCBURUUgYXJlIHRydXN0IHdvcnRo eS4gVGhlIFRBTSBtdXN0IG1ha2UgYSB0cnVzdCBkZWNpc2lvbi4gQSB0cnVzdCBkZWNpc2lvbiBp cyBiYXNlZCBvbiBjcnlwdG9ncmFwaGljIHByb29mIChhIHNpZ25lZCBhdHRlc3RhdGlvbikgdGhh dCB0aGUgc3ViamVjdCBvZiB0aGUgYXR0ZXN0YXRpb24gaGFzIGNvbnRyb2wgb2YgdGhlIHByaXZh dGUgcG9ydGlvbiBvZiBhIGtleSBwYWlyIHRoYXQgaXMgcmVnaXN0ZXJlZCB3aXRoIGEgdHJ1c3Rl ZCBjZXJ0aWZpY2F0ZSBhdXRob3JpdHkuIFRoaXMgdHJ1c3RlZCBrZXkgcGFpciBpcyB0aGUgUm9v dC1vZi1UcnVzdCBrZXkgaW4gdGhlIFRFRS4gSG93ZXZlciwgdGhlIFRBTSBpcyByZXF1aXJlZCB0 byBtYWtlIGEgZnVydGhlciBwb2xpY3kgZGVjaXNpb24gYmFzZWQgdXBvbiB0aGlzIGF0dGVzdGF0 aW9uIHByb29mLCBuYW1lbHkgdGhhdCB0aGUgcmVnaXN0ZXJlZCBrZXkgaW4gZmFjdCByZXByZXNl bnRzIGEgVEVFIHRoZSBUQU0gaXMgd2lsbGluZyB0byB0cnVzdCBhbmQgdGhhdCB0aGUga2V5IGhh cyBub3QgYmVlbiByZXZva2VkLiANCiAgICANCiAgICBUaGUgdHJ1c3QgdGhlIFRBTSBwbGFjZXMg aW4gdGhlIFRFRSBpcyBhIGNvbWJpbmF0aW9uIG9mIHRoZSBjcnlwdG9ncmFwaGljIHZlcmlmaWNh dGlvbiBvZiB0aGUgc2lnbmVkIGF0dGVzdGF0aW9uIGFuZCBrbm93bGVkZ2Ugb2YgdGhlIFRFRSdz IGltcGxlbWVudGF0aW9uIG9mIGl0cyB0cnVzdGVkIGNvbXB1dGluZyBiYXNlIChUQ0IpLiBUaGUg VENCIGlzIG1lcmVseSB0aGUgZXNzZW50aWFsIGJhc2UgZWxlbWVudHMgb2YgdGhlIFRFRSB0aGF0 IG11c3QgYmUgdHJ1c3RlZCBmb3IgdGhlIFRFRSB0byBvcGVyYXRlIGluIGEgdHJ1c3R3b3J0aHkg ZmFzaGlvbi4gRm9yIHNvbWUgVEVFcywgdGhlIFRDQiBpcyByb290ZWQgaW4gdGhlIHNlY3VyZSBi b290IG9mIHRoZSBkZXZpY2U7IGluIHRoaXMgY2FzZSBhIHByb3BlciBhdHRlc3RhdGlvbiBvZiB0 aGUgVEVFIHJlcXVpcmVzIGFuIGFkZGl0aW9uYWwgYXR0ZXN0YXRpb24gb2YgdGhlIHNlY3VyZSBi b290IG9mIHRoZSBkZXZpY2UsIGFzIHdlbGwgYXMgdGhlIGF0dGVzdGF0aW9uIG9mIHRoZSBURUUg aXRzZWxmLiBUaGlzIGlzIHRoZSBjYXNlIGZvciB0aGUgQVJNIFRydXN0IFpvbmUgYXJjaGl0ZWN0 dXJlLiANCiAgICANCiAgICBUaGUgVENCIG9mIG90aGVyIFRFRXMgYXJlIGluZGVwZW5kZW50IG9m IHRoZSBkZXZpY2UncyBib290IHN0YXRlLCBhbmQgdGhlcmVmb3JlIGRvIG5vdCByZXF1aXJlIGFu IGF0dGVzdGF0aW9uIGZvciB0aGUgc2VjdXJlIGJvb3Qgb2YgdGhlIGRldmljZS4gQW4gZXhhbXBs ZSAgb2YgdGhpcyB0eXBlIG9mIFRFRSBhcmNoaXRlY3R1cmUgaXMgYSBzZXBhcmF0ZSBwaHlzaWNh bCBoYXJkd2FyZSBlbmdpbmUgd2l0aCBpdHMgb3duIHNlcGFyYXRlIHNlY3VyZSBST00gY29udGFp bmluZyB0aGUgVEVFIGltcGxlbWVudGF0aW9uOyBleGFtcGxlcyBvZiBzdWNoIGltcGxlbWVudGF0 aW9ucyBpbmNsdWRlIGEgU2VjdXJlIEVsZW1lbnQgKFNFKSwgYSBUUE0sIG9yIHRoZSBJbnRlbCBT R1ggYXJjaGl0ZWN0dXJlIHdoZXJlIHRoZSBURUUgaXMgYnVpbHQgY29tcGxldGVseSBmcm9tIG1p Y3JvY29kZSBpbiB0aGUgQ1BVIHNlY3VyZSBST00uIEluIHRoZXNlIGluc3RhbmNlcywgdGhlIGRl dmljZSBib290IGlzIHNlcGFyYXRlIGZyb20gdGhlIFRFRTsgYW5kIHdoZXRoZXIgdGhlIGRldmlj ZSBpcyBzZWN1cmVseSBib290ZWQgb3Igbm90LCB0aGVyZSBpcyBubyBlZmZlY3Qgb24gdGhlIHNl Y3VyZSBzdGF0ZSBvZiB0aGUgVEVFLg0KICAgIA0KICAgIEluIG90aGVyIGNhc2VzLCB0aGUgVEVF IG1heSBiZSBjb21wb3NlZCBvZiBtdWx0aXBsZSBzZWN1cmUgZmlybXdhcmUgb3IgaGFyZHdhcmUg ZWxlbWVudHMsIGFuZCBhIHByb3BlciBhdHRlc3RhdGlvbiBvZiB0aGUgVEVFIGNvdWxkIHJlcXVp cmUgc2V2ZXJhbCBzaWduZWQgYXR0ZXN0YXRpb25zIGZyb20gZGlmZmVyZW50IGtleXMuIFN1Y2gg YSBkZXZpY2UgbWlnaHQgdXNlIGEgVFBNIGZvciBhIGtleXN0b3JlIGNvbWJpbmVkIHdpdGggcHJv dGVjdGVkIEZXIG9uIGEgc2VwYXJhdGUgY28tcHJvY2Vzc29yOyB0aGlzIGNvbWJpbmF0aW9uIHdv dWxkIHJlcXVpcmUgYW4gYXR0ZXN0YXRpb24gZnJvbSB0aGUgY28tcHJvY2Vzc29yJ3MgUm9vdC1v Zi1UcnVzdCBrZXkgYW5kIGFuIGF0dGVzdGF0aW9uIGZyb20gdGhlIFRQTS4gDQogICAgDQogICAg VGhlc2UgZXhhbXBsZXMgc2hvdyBzcGVjaWZpYyBkaXN0aW5jdGlvbnMgdGhhdCBhcmUgaW1wb3J0 YW50IGZvciB0aGUgVEFNIHRvIHByb3Blcmx5IG1ha2UgdHJ1c3QgZGVjaXNpb25zLiBUaGVzZSBk ZWNpc2lvbnMgYXJlIGJhc2VkIG9uIGtub3dsZWRnZSBvZiB0aGUgVEVFIGltcGxlbWVudGF0aW9u LCBhbmQgd2lsbCBiZSB2ZXJpZmllZCBieSB0aGUgVEFNIGJ5IGxvb2tpbmcgZm9yIHRoZSBhcHBy b3ByaWF0ZSBhdHRlc3RhdGlvbnMgaW4gdGhlIFRFRSBhdHRlc3RhdGlvbiByZXNwb25zZS4NCiAg ICANCiAgICBJbiBvcmRlciB0byBhY2NvbW1vZGF0ZSB0aGVzZSBkaWZmZXJlbnQgaW5zdGFuY2Vz LCB0aGUgVEVFIGF0dGVzdGF0aW9uIG11c3QgYWNjb21tb2RhdGUgdGhlIGNvbnNvbGlkYXRpb24g b2YgbXVsdGlwbGUgYXR0ZXN0YXRpb25zIGZyb20gcG90ZW50aWFsbHkgZGlmZmVyZW50IHRydXN0 IHJvb3RzLiBJbiB0aGUgQVJNIFRydXN0Wm9uZSBjYXNlLCBhbiBhdHRlc3RhdGlvbiBmcm9tIHRo ZSBTQk0gaXMgcmVxdWlyZWQgdG8gZW5zdXJlIHRoZSBzb2Z0d2FyZSB0aGF0IGJvb3RlZCB0aGUg VFogZW52aXJvbm1lbnQgY2FtZSBmcm9tIGEgdHJ1c3RlZCBwbGF0Zm9ybSBzb3VyY2UuIFRoZW4g YSBmdXJ0aGVyIGF0dGVzdGF0aW9uIGlzIHJlcXVpcmVkIGZvciB0aGUgVFogcm9vdC1vZi10cnVz dCBrZXkgdG8gYmUgdmVyaWZpZWQuDQogICAgDQogICAgSW4gdGhlIFNHWCBjYXNlLCBiZWNhdXNl IFNHWCBpcyBjb21wbGV0ZWx5IHNlcGFyYXRlIGZyb20gdGhlIFJFRSBhbmQgdGhlIHNlY3VyZSBi b290IG9mIHRoZSBwbGF0Zm9ybSwgb25seSBhbiBhdHRlc3RhdGlvbiBvZiB0aGUgU0dYIFJvb3Qt b2YtVHJ1c3Qga2V5IGlzIHJlcXVpcmVkLiANCiAgICANCiAgICBJdCBpcyBlYXN5IHRvIHNlZSBm cm9tIHRoZXNlIGV4YW1wbGVzIHRoYXQgVHJ1c3RlZCBGaXJtd2FyZSAoVEZXKSBhbmQgU2VjdXJl IEJvb3QgTW9kdWxlcyAoU0JNKSBtYXkgYmUgcmVxdWlyZWQgdG8gYmUgaW5jbHVkZWQgaW4gc29t ZSBURUUgYXR0ZXN0YXRpb25zLCBidXQgYXJlIG5vdCByZXF1aXJlZCBpbiBvdGhlcnMuIEluIGZh Y3QsIGl0IG1heSBub3QgZXZlbiBiZSBwb3NzaWJsZSB0byBpbmNsdWRlIGFuIFNCTSBhdHRlc3Rh dGlvbiBpbiBzb21lIFNHWCBpbXBsZW1lbnRhdGlvbnMgYmVjYXVzZSBTR1ggd2lsbCBvcGVyYXRl IHdpdGggc2VjdXJlIGJvb3QgdHVybmVkIG9mZiwgbWFraW5nIHRoZSBzZWN1cmUgYm9vdCBhdHRl c3RhdGlvbiBpbmFjY2Vzc2libGUuDQogICAgDQogICAgU2VjdXJlIEJvb3QgTW9kdWxlIChDQk0p Og0KICAgIFNvbWUgVEVFcyByZXF1aXJlIGEgc2VjdXJlIGJvb3QgbW9kdWxlIHRvIHZlcmlmeSB0 aGUgc29mdHdhcmUgb3IgZmlybXdhcmUgb2YgdGhlIFRFRS4gSW4gdGhlc2UgY2FzZXMsIHRoZSBU RUUgYXR0ZXN0YXRpb24gbXVzdCBpbmNsdWRlIGFuIGF0dGVzdGF0aW9uIGZyb20gdGhlIFNCTS4N CiAgICANCiAgICBUcnVzdGVkIEZpcm13YXJlIChURlcpOg0KICAgIFNvbWUgVEVFcyByZXF1aXJl IHNvZnR3YXJlIHdoaWNoIGlzIGxvYWRlZCBvdmVyIGEgcG90ZW50aWFsbHkgaW5zZWN1cmUgY2hh bm5lbCBvciBmcm9tIGFuIGluc2VjdXJlIHN0b3JhZ2UgZGV2aWNlLiBUaGlzIHNvZnR3YXJlIGlz IG5vcm1hbGx5IHNpZ25lZCBieSB0aGUgZGV2ZWxvcGVyIG9yIGRldmljZSBtYW51ZmFjdHVyZXIg dXNpbmcgYSBwcml2YXRlIGtleSBjb3JyZXNwb25kaW5nIHRvIGEgZGV2aWNlIFRydXN0IEFuY2hv ci4gV2hlbiB0aGUgc29mdHdhcmUgaXMgbG9hZGVkLCBhIFRGVyB2ZXJpZmllcyB0aGUgc2lnbmF0 dXJlIG9uIHRoZSBzb2Z0d2FyZSB1c2luZyB0aGUgc2VjdXJlbHkgc3RvcmVkIFRydXN0IEFuY2hv ci4gSW4gdGhlc2UgY2FzZXMsIHRoZSBURUUgYXR0ZXN0YXRpb24gbXVzdCBpbmNsdWRlIGFuIGF0 dGVzdGF0aW9uIG9mIHRoZSBzb2Z0d2FyZSBzaWduZWQgYnkgdGhlIFRGVyBSb290LW9mLVRydXN0 IGtleS4NCiAgICANCiAgICBURUUgQXR0ZXN0YXRpb246DQogICAgQSBURUUgYXR0ZXN0YXRpb24g aXMgYSBjb21iaW5hdGlvbiBvZiBvbmUgb3IgbW9yZSBjcnlwdG9ncmFwaGljYWxseSBzaWduZWQg YXR0ZXN0YXRpb24gcmVjb3JkcyBjb3JyZXNwb25kaW5nIHRvIHRoZSBzZXBhcmF0ZSBUQ0IgZWxl bWVudHMgdGhhdCBjb21wb3NlIHRoZSBURUUuIEEgY29tcGxldGUgVEVFIGF0dGVzdGF0aW9uIG11 c3QgaW5jbHVkZSBhdHRlc3RhdGlvbnMgZnJvbSBhbGwgVENCIGVsZW1lbnRzIGluIG9yZGVyIGZv ciBhIFRBTSB0byBwcm9wZXJseSB2ZXJpZnkgYSBURUUuIFRoZSBURUUgYXR0ZXN0YXRpb24gbXVz dCBpbmNsdWRlIGF0IGxlYXN0IGEgVEVFIFJvb3Qtb2YtVHJ1c3Qga2V5IGF0dGVzdGF0aW9uLCBi dXQgbWF5IGFsc28gaW5jbHVkZSBhbiBTQk0gYXR0ZXN0YXRpb24gYW5kIHplcm8gb3IgbW9yZSBU RlcgYXR0ZXN0YXRpb25zLg0KICAgIA0KICAgIC0tLQ0KICAgIA0KICAgIEhvcGVmdWxseSB0aGlz IHByb3ZpZGVzIGNsYXJpdHkgdG8gdGhlIGRpc2N1c3Npb24gYW5kIGR1cmluZyB0aGUgTW9udHJl YWwgbWVldGluZyB3ZSBjYW4gZGlzY3VzcyB0aGlzIGZ1cnRoZXIgaWYgbmVjZXNzYXJ5Lg0KICAg IFRoYW5rcywNCiAgICBEYXZlIFdoZWVsZXINCiAgICANCiAgICANCiAgICANCiAgICAtLS0tLU9y aWdpbmFsIE1lc3NhZ2UtLS0tLQ0KICAgIEZyb206IFRFRVAgW21haWx0bzp0ZWVwLWJvdW5jZXNA aWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmcNCiAgICBTZW50 OiBXZWRuZXNkYXksIEp1bHkgNCwgMjAxOCA3OjQ5IEFNDQogICAgVG86IGktZC1hbm5vdW5jZUBp ZXRmLm9yZw0KICAgIENjOiB0ZWVwQGlldGYub3JnDQogICAgU3ViamVjdDogW1RlZXBdIEktRCBB Y3Rpb246IGRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUtMDAudHh0DQogICAgDQogICAgDQog ICAgQSBOZXcgSW50ZXJuZXQtRHJhZnQgaXMgYXZhaWxhYmxlIGZyb20gdGhlIG9uLWxpbmUgSW50 ZXJuZXQtRHJhZnRzIGRpcmVjdG9yaWVzLg0KICAgIFRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0g b2YgdGhlIFRydXN0ZWQgRXhlY3V0aW9uIEVudmlyb25tZW50IFByb3Zpc2lvbmluZyBXRyBvZiB0 aGUgSUVURi4NCiAgICANCiAgICAgICAgICAgIFRpdGxlICAgICAgICAgICA6IFRydXN0ZWQgRXhl Y3V0aW9uIEVudmlyb25tZW50IFByb3Zpc2lvbmluZyAoVEVFUCkgQXJjaGl0ZWN0dXJlDQogICAg ICAgICAgICBBdXRob3JzICAgICAgICAgOiBNaW5nbGlhbmcgUGVpDQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBIYW5uZXMgVHNjaG9mZW5pZw0KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgQW5kcmV3IEF0eWVvDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEYXBlbmcN CiAgICAJRmlsZW5hbWUgICAgICAgIDogZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVjdHVyZS0wMC50 eHQNCiAgICAJUGFnZXMgICAgICAgICAgIDogMjQNCiAgICAJRGF0ZSAgICAgICAgICAgIDogMjAx OC0wNy0wMg0KICAgIA0KICAgIEFic3RyYWN0Og0KICAgICAgIEEgVHJ1c3RlZCBFeGVjdXRpb24g RW52aXJvbm1lbnQgKFRFRSkgd2FzIGRlc2lnbmVkIHRvIHByb3ZpZGUgYQ0KICAgICAgIGhhcmR3 YXJlLWlzb2xhdGlvbiBtZWNoYW5pc20gdG8gc2VwYXJhdGUgYSByZWd1bGFyIG9wZXJhdGluZyBz eXN0ZW0NCiAgICAgICBmcm9tIHNlY3VyaXR5LSBzZW5zaXRpdmUgYXBwbGljYXRpb25zLg0KICAg IA0KICAgICAgIFRoaXMgYXJjaGl0ZWN0dXJlIGRvY3VtZW50IG1vdGl2YXRlcyB0aGUgZGVzaWdu IGFuZCBzdGFuZGFyZGl6YXRpb24NCiAgICAgICBvZiBhIHByb3RvY29sIGZvciBtYW5hZ2luZyB0 aGUgbGlmZWN5bGUgb2YgdHJ1c3RlZCBhcHBsaWNhdGlvbnMNCiAgICAgICBydW5uaW5nIGluc2lk ZSBhIFRFRS4NCiAgICANCiAgICANCiAgICBUaGUgSUVURiBkYXRhdHJhY2tlciBzdGF0dXMgcGFn ZSBmb3IgdGhpcyBkcmFmdCBpczoNCiAgICBodHRwczovL2NsaWNrdGltZS5zeW1hbnRlYy5jb20v YS8xLzdYbVRUdUk0dUJMUDdqOVJfZWFad3BuM3pkUHBsLTdubGRoZnpkMHNiQVU9P2Q9WS14U3JM Nlg2TjdQNXhsbEtLNk9FaTlWR3hIOGNBcHdPd29ybURiR2hqbGlJOUNSTkFDSHdOdHNRcnhZS1ps MlEyTkVGZWlRSnlqbldLb2MzZlRmM0RERHd4UzJVcjlDWUd5WXFZZV9WRHpuUkxDejRRRjZ2ZWRh TWdIVFlDLWZUeUhENVoyZ011bnJGVENUclRSZi1LY04zbXk0SUZZT1RKd2t6OG5UU0FoUjlUZkdI NEFrdzZaUmZlSHFvMnd1bGQtUjBuZVpGd3RpdVdvaUZ5UzRwczItX2oza2paZlBVY1pxbVFuY2RX Zm9uNFU1RF96cDRoVWxHRTVjLU1xN3NXVXUyNHZQRWhSelFmVzR4V19HUlNndG1iVmIycUhRQzB3 bHRaMHE5dEpzMFRIWDZTWHZwYkFsMGV0M3JXUUpsS3BGZV9GZFZVOENGXzhKT2pPSVpFaC00Tlg0 aUZpUzZidVlybXdkbE5KWDdtVnJTN0FrMWIya3pOUDFnLU1tbUZqSE94cXNvMnNTN0FYcm9WbXhx cmhpN2o0UFV3ejZTSWRXcUdVRThvQ25YZkdia3F0Y1lpbFpxYkJDYmVmc1BodXNsdyUzRCUzRCZ1 PWh0dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZkcmFmdC1pZXRmLXRl ZXAtYXJjaGl0ZWN0dXJlJTJGDQogICAgDQogICAgVGhlcmUgYXJlIGFsc28gaHRtbGl6ZWQgdmVy c2lvbnMgYXZhaWxhYmxlIGF0Og0KICAgIGh0dHBzOi8vY2xpY2t0aW1lLnN5bWFudGVjLmNvbS9h LzEvNmRNT1VGejEyQ0QyMXRDcndFNXdBRTBpelhSeGppMlVoaWsxX3Z6eTlVcz0/ZD1ZLXhTckw2 WDZON1A1eGxsS0s2T0VpOVZHeEg4Y0Fwd093b3JtRGJHaGpsaUk5Q1JOQUNId050c1FyeFlLWmwy UTJORUZlaVFKeWpuV0tvYzNmVGYzREREd3hTMlVyOUNZR3lZcVllX1ZEem5STEN6NFFGNnZlZGFN Z0hUWUMtZlR5SEQ1WjJnTXVuckZUQ1RyVFJmLUtjTjNteTRJRllPVEp3a3o4blRTQWhSOVRmR0g0 QWt3NlpSZmVIcW8yd3VsZC1SMG5lWkZ3dGl1V29pRnlTNHBzMi1fajNralpmUFVjWnFtUW5jZFdm b240VTVEX3pwNGhVbEdFNWMtTXE3c1dVdTI0dlBFaFJ6UWZXNHhXX0dSU2d0bWJWYjJxSFFDMHds dFowcTl0SnMwVEhYNlNYdnBiQWwwZXQzcldRSmxLcEZlX0ZkVlU4Q0ZfOEpPak9JWkVoLTROWDRp RmlTNmJ1WXJtd2RsTkpYN21WclM3QWsxYjJrek5QMWctTW1tRmpIT3hxc28yc1M3QVhyb1ZteHFy aGk3ajRQVXd6NlNJZFdxR1VFOG9DblhmR2JrcXRjWWlsWnFiQkNiZWZzUGh1c2x3JTNEJTNEJnU9 aHR0cHMlM0ElMkYlMkZ0b29scy5pZXRmLm9yZyUyRmh0bWwlMkZkcmFmdC1pZXRmLXRlZXAtYXJj aGl0ZWN0dXJlLTAwDQogICAgaHR0cHM6Ly9jbGlja3RpbWUuc3ltYW50ZWMuY29tL2EvMS9DSmpy elRQTjZLeGRFTnRKYlNYcVdVV1p0SHp2eFA2emVEYjFQV3BDdkVVPT9kPVkteFNyTDZYNk43UDV4 bGxLSzZPRWk5Vkd4SDhjQXB3T3dvcm1EYkdoamxpSTlDUk5BQ0h3TnRzUXJ4WUtabDJRMk5FRmVp UUp5am5XS29jM2ZUZjNERER3eFMyVXI5Q1lHeVlxWWVfVkR6blJMQ3o0UUY2dmVkYU1nSFRZQy1m VHlIRDVaMmdNdW5yRlRDVHJUUmYtS2NOM215NElGWU9USndrejhuVFNBaFI5VGZHSDRBa3c2WlJm ZUhxbzJ3dWxkLVIwbmVaRnd0aXVXb2lGeVM0cHMyLV9qM2tqWmZQVWNacW1RbmNkV2ZvbjRVNURf enA0aFVsR0U1Yy1NcTdzV1V1MjR2UEVoUnpRZlc0eFdfR1JTZ3RtYlZiMnFIUUMwd2x0WjBxOXRK czBUSFg2U1h2cGJBbDBldDNyV1FKbEtwRmVfRmRWVThDRl84Sk9qT0laRWgtNE5YNGlGaVM2YnVZ cm13ZGxOSlg3bVZyUzdBazFiMmt6TlAxZy1NbW1GakhPeHFzbzJzUzdBWHJvVm14cXJoaTdqNFBV d3o2U0lkV3FHVUU4b0NuWGZHYmtxdGNZaWxacWJCQ2JlZnNQaHVzbHclM0QlM0QmdT1odHRwcyUz QSUyRiUyRmRhdGF0cmFja2VyLmlldGYub3JnJTJGZG9jJTJGaHRtbCUyRmRyYWZ0LWlldGYtdGVl cC1hcmNoaXRlY3R1cmUtMDANCiAgICANCiAgICANCiAgICBQbGVhc2Ugbm90ZSB0aGF0IGl0IG1h eSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uIHVu dGlsIHRoZSBodG1saXplZCB2ZXJzaW9uIGFuZCBkaWZmIGFyZSBhdmFpbGFibGUgYXQgdG9vbHMu aWV0Zi5vcmcuDQogICAgDQogICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBhbHNvIGF2YWlsYWJsZSBi eSBhbm9ueW1vdXMgRlRQIGF0Og0KICAgIGZ0cDovL2Z0cC5pZXRmLm9yZy9pbnRlcm5ldC1kcmFm dHMvDQogICAgDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18NCiAgICBURUVQIG1haWxpbmcgbGlzdA0KICAgIFRFRVBAaWV0Zi5vcmcNCiAgICBodHRw czovL2NsaWNrdGltZS5zeW1hbnRlYy5jb20vYS8xLy01T2xYZFlkT3JGTTRmUXVXNnAzR0ZiS3Yw S2MzOWVSTWh1T2ZfcnNvbFk9P2Q9WS14U3JMNlg2TjdQNXhsbEtLNk9FaTlWR3hIOGNBcHdPd29y bURiR2hqbGlJOUNSTkFDSHdOdHNRcnhZS1psMlEyTkVGZWlRSnlqbldLb2MzZlRmM0RERHd4UzJV cjlDWUd5WXFZZV9WRHpuUkxDejRRRjZ2ZWRhTWdIVFlDLWZUeUhENVoyZ011bnJGVENUclRSZi1L Y04zbXk0SUZZT1RKd2t6OG5UU0FoUjlUZkdINEFrdzZaUmZlSHFvMnd1bGQtUjBuZVpGd3RpdVdv aUZ5UzRwczItX2oza2paZlBVY1pxbVFuY2RXZm9uNFU1RF96cDRoVWxHRTVjLU1xN3NXVXUyNHZQ RWhSelFmVzR4V19HUlNndG1iVmIycUhRQzB3bHRaMHE5dEpzMFRIWDZTWHZwYkFsMGV0M3JXUUps S3BGZV9GZFZVOENGXzhKT2pPSVpFaC00Tlg0aUZpUzZidVlybXdkbE5KWDdtVnJTN0FrMWIya3pO UDFnLU1tbUZqSE94cXNvMnNTN0FYcm9WbXhxcmhpN2o0UFV3ejZTSWRXcUdVRThvQ25YZkdia3F0 Y1lpbFpxYkJDYmVmc1BodXNsdyUzRCUzRCZ1PWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJG bWFpbG1hbiUyRmxpc3RpbmZvJTJGdGVlcA0KICAgIA0KICAgIF9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICAgVEVFUCBtYWlsaW5nIGxpc3QNCiAgICBU RUVQQGlldGYub3JnDQogICAgaHR0cHM6Ly9jbGlja3RpbWUuc3ltYW50ZWMuY29tL2EvMS8tNU9s WGRZZE9yRk00ZlF1VzZwM0dGYkt2MEtjMzllUk1odU9mX3Jzb2xZPT9kPVkteFNyTDZYNk43UDV4 bGxLSzZPRWk5Vkd4SDhjQXB3T3dvcm1EYkdoamxpSTlDUk5BQ0h3TnRzUXJ4WUtabDJRMk5FRmVp UUp5am5XS29jM2ZUZjNERER3eFMyVXI5Q1lHeVlxWWVfVkR6blJMQ3o0UUY2dmVkYU1nSFRZQy1m VHlIRDVaMmdNdW5yRlRDVHJUUmYtS2NOM215NElGWU9USndrejhuVFNBaFI5VGZHSDRBa3c2WlJm ZUhxbzJ3dWxkLVIwbmVaRnd0aXVXb2lGeVM0cHMyLV9qM2tqWmZQVWNacW1RbmNkV2ZvbjRVNURf enA0aFVsR0U1Yy1NcTdzV1V1MjR2UEVoUnpRZlc0eFdfR1JTZ3RtYlZiMnFIUUMwd2x0WjBxOXRK czBUSFg2U1h2cGJBbDBldDNyV1FKbEtwRmVfRmRWVThDRl84Sk9qT0laRWgtNE5YNGlGaVM2YnVZ cm13ZGxOSlg3bVZyUzdBazFiMmt6TlAxZy1NbW1GakhPeHFzbzJzUzdBWHJvVm14cXJoaTdqNFBV d3o2U0lkV3FHVUU4b0NuWGZHYmtxdGNZaWxacWJCQ2JlZnNQaHVzbHclM0QlM0QmdT1odHRwcyUz QSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRlZXANCiAgICANCiAg ICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KICAgIFRF RVAgbWFpbGluZyBsaXN0DQogICAgVEVFUEBpZXRmLm9yZw0KICAgIGh0dHBzOi8vY2xpY2t0aW1l LnN5bWFudGVjLmNvbS9hLzEvLTVPbFhkWWRPckZNNGZRdVc2cDNHRmJLdjBLYzM5ZVJNaHVPZl9y c29sWT0/ZD1ZLXhTckw2WDZON1A1eGxsS0s2T0VpOVZHeEg4Y0Fwd093b3JtRGJHaGpsaUk5Q1JO QUNId050c1FyeFlLWmwyUTJORUZlaVFKeWpuV0tvYzNmVGYzREREd3hTMlVyOUNZR3lZcVllX1ZE em5STEN6NFFGNnZlZGFNZ0hUWUMtZlR5SEQ1WjJnTXVuckZUQ1RyVFJmLUtjTjNteTRJRllPVEp3 a3o4blRTQWhSOVRmR0g0QWt3NlpSZmVIcW8yd3VsZC1SMG5lWkZ3dGl1V29pRnlTNHBzMi1fajNr alpmUFVjWnFtUW5jZFdmb240VTVEX3pwNGhVbEdFNWMtTXE3c1dVdTI0dlBFaFJ6UWZXNHhXX0dS U2d0bWJWYjJxSFFDMHdsdFowcTl0SnMwVEhYNlNYdnBiQWwwZXQzcldRSmxLcEZlX0ZkVlU4Q0Zf OEpPak9JWkVoLTROWDRpRmlTNmJ1WXJtd2RsTkpYN21WclM3QWsxYjJrek5QMWctTW1tRmpIT3hx c28yc1M3QVhyb1ZteHFyaGk3ajRQVXd6NlNJZFdxR1VFOG9DblhmR2JrcXRjWWlsWnFiQkNiZWZz UGh1c2x3JTNEJTNEJnU9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlz dGluZm8lMkZ0ZWVwDQogICAgDQoNCg== From nobody Thu Jul 5 14:44:28 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DC08124D68 for ; Thu, 5 Jul 2018 14:44:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bQTgDAabJJgD for ; Thu, 5 Jul 2018 14:44:24 -0700 (PDT) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 24C7C124BE5 for ; Thu, 5 Jul 2018 14:44:24 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Jul 2018 14:44:24 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,313,1526367600"; d="scan'208";a="62599442" Received: from fmsmsx108.amr.corp.intel.com ([10.18.124.206]) by FMSMGA003.fm.intel.com with ESMTP; 05 Jul 2018 14:44:23 -0700 Received: from fmsmsx119.amr.corp.intel.com (10.18.124.207) by FMSMSX108.amr.corp.intel.com (10.18.124.206) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 14:44:23 -0700 Received: from crsmsx101.amr.corp.intel.com (172.18.63.136) by FMSMSX119.amr.corp.intel.com (10.18.124.207) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 5 Jul 2018 14:44:23 -0700 Received: from crsmsx102.amr.corp.intel.com ([169.254.2.60]) by CRSMSX101.amr.corp.intel.com ([169.254.1.192]) with mapi id 14.03.0319.002; Thu, 5 Jul 2018 15:44:21 -0600 From: "Wheeler, David M" To: "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AQHUFJ+ghSpSZEAcWkiUm2lPBw9+/6SBI+fg Date: Thu, 5 Jul 2018 21:44:20 +0000 Message-ID: <0627F5240443D2498FAA65332EE46C843B66A159@CRSMSX102.amr.corp.intel.com> References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0E0@CRSMSX102.amr.corp.intel.com> In-Reply-To: <0627F5240443D2498FAA65332EE46C843B66A0E0@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMmJhYjQ4YmUtYzQ5ZS00NTVkLWJmYTAtZTJjNmIxOTU2MjQ3IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiNHVpU0FGMklVOHhSTjViMllVZVJYblBDUFlQcUthMlpVUzVCbzRack5pYWQyZFR3bnZ4WWNmVEF5Y2tsejZTOSJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.200.100 dlp-reaction: no-action x-originating-ip: [172.18.205.10] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jul 2018 21:44:28 -0000 Changes below to use D. Thaler's recommended NIST verbiage for RoT... Hopefully this clear with the /ADD/.../ and /REMOVE/.../REPLACE/.../ mar= ks :^) -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M Sent: Thursday, July 5, 2018 1:35 PM To: teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt My comments to this point have been primarily grammatical or elucidatory, i= n order to improve the clarity of the document. The following comment is (I= MHO) a required change to the specification in order to accommodate multipl= e types of TEEs, not just ARM TrustZone implementations: Section 5.1 page 9: Secure Boot:=20 Secure boot must enable authenticity checking of TEEs by the TAM. Note that some TEE implementations do not require secure boot functionality. This definition is incomplete, as it does not elucidate how the secure boot= checks the authenticity for the TEE, or how the TEE receives something fro= m the SBM to trust the TEE. Part of the problem, IMHO, is the assumption about how the TEE is booted, a= nd what the TCB of the TEE actually is. I suggest the following paragraphs = to replace that definition with a further architectural explanation (as fol= lows): --- TEE Attestation, Secure Boot, Trusted Firmware, and the TEE TCB=20 In order for the TAM to trust information received over the TEEP protocol, = the Device and TEE must provide sufficient proof that the device and TEE ar= e trust worthy. The TAM must make a trust decision. A trust decision is bas= ed on cryptographic proof (a signed attestation /ADD/from the Root-of-Trust= for Reporting (RTR)/) that the subject of the attestation (the Device/TEE)= has control of the private portion of a key pair that is registered with a= trusted certificate authority. This trusted key pair is the /REMOVE/Root-o= f-Trust/REPLACE/Device Identity/ key in the TEE. However, the TAM is requir= ed to make a further policy decision based upon this attestation proof, nam= ely that the registered key in fact represents a TEE the TAM is willing to = trust and that the key has not been revoked.=20 The trust the TAM places in the TEE is a combination of the cryptographic v= erification of the signed attestation and knowledge of the TEE's implementa= tion of its trusted computing base (TCB). The TCB is merely the essential b= ase elements of the TEE that must be trusted for the TEE to operate in a tr= ustworthy fashion. For some TEEs, the TCB is rooted in the secure boot of t= he device; in this case a proper attestation of the TEE requires an additio= nal attestation of the secure boot of the device, as well as the attestatio= n of the TEE itself. This is the case for the ARM Trust Zone architecture.= =20 The TCB of other TEEs are independent of the device's boot state, and there= fore do not require an attestation for the secure boot of the device. An ex= ample of this type of TEE architecture is a separate physical hardware eng= ine with its own separate secure ROM containing the TEE implementation; exa= mples of such implementations include a Secure Element (SE), a TPM, or the = Intel SGX architecture where the TEE is built completely from microcode in = the CPU secure ROM. In these instances, the device boot is separate from th= e TEE; and whether the device is securely booted or not, there is no effect= on the secure state of the TEE. In other cases, the TEE may be composed of multiple secure firmware or hard= ware elements, and a proper attestation of the TEE could require several si= gned attestations from different keys. Such a device might use a TPM for a = keystore combined with protected FW on a separate co-processor; this combin= ation would require an attestation from the co-processor's Root-of-Trust /A= DD/ for Reporting (RTR)/ key and an attestation from the TPM.=20 These examples show specific distinctions that are important for the TAM to= properly make trust decisions. These decisions are based on knowledge of t= he TEE implementation, and will be verified by the TAM by looking for the a= ppropriate attestations in the TEE attestation response. In order to accommodate these different instances, the TEE attestation must= accommodate the consolidation of multiple attestations from potentially di= fferent trust roots /ADD/ - collectively these are collected together in Ro= ot-of-Trust for Integrity (RTI) that manages the assertions on a platform./= In the ARM TrustZone case, an attestation from the SBM is required to ensu= re the software that booted the TZ environment came from a trusted platform= source. Then a further attestation is required for the TZ root-of-trust ke= y to be verified. /ADD/ These attestations or assertions must be provided b= y the platform in the signed attestation from the RTR./ In the SGX case, because SGX is completely separate from the REE and the se= cure boot of the platform, only an attestation of the SGX Root-of-Trust /AD= D/for Reporting (RTR)/ key is required.=20 It is easy to see from these examples that Trusted Firmware (TFW) and Secur= e Boot Modules (SBM) may be required to be included in some TEE attestation= s, but are not required in others. In fact, it may not even be possible to = include an SBM attestation in some SGX implementations because SGX will ope= rate with secure boot turned off, making the secure boot attestation inacce= ssible. Secure Boot Module (CBM): Some TEEs require a secure boot module to verify the software or firmware o= f the TEE. In these cases, the TEE attestation must include an /REMOVE/atte= station/REPLACE/assertion/ from the SBM. Trusted Firmware (TFW): Some TEEs require software which is loaded over a potentially insecure chan= nel or from an insecure storage device. This software is normally signed by= the developer or device manufacturer using a private key corresponding to = a device Trust Anchor. When the software is loaded, a TFW /ADD/(or a Root-o= f-Trust for Verification (RTV)/ verifies the signature on the software usin= g the securely stored Trust Anchor. In these cases, the TEE attestation mus= t include an /REMOVE/attestation/REPLACE/assertion/ of the software signed = by the /REMOVE/TFW Root-of-Trust key/REPALCE/Root of Trust for Reporting (R= TR)/. TEE Attestation: A TEE attestation is a combination of one or more cryptographically signed = /REMOVE/attestation records/REPLACE/assertions/ corresponding to the separ= ate TCB elements that compose the TEE. A complete TEE attestation must incl= ude /REMOVE/attestations/REPLACE/assertions/ from all TCB elements in order= for a TAM to properly verify a TEE. The TEE attestation must include at le= ast a /ADD/signed assertion from the/ TEE Root-of-Trust /ADD/for Reporting = (RTR)/ /REMOVE/key attestation/, but may also include an SBM /REMOVE/attest= ation/REPLACE/assertion/ and zero or more TFW /REMOVE/attestations/REPLACE/= assertions/. --- Hopefully this provides clarity to the discussion and during the Montreal m= eeting we can discuss this further if necessary. Thanks, Dave Wheeler -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-teep-architecture-00 https://datatracker.ietf.org/doc/html/draft-ietf-teep-architecture-00 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep From nobody Thu Jul 5 21:56:22 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24B7B130DEC for ; Thu, 5 Jul 2018 21:56:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cvbOVKCj9_A5 for ; Thu, 5 Jul 2018 21:56:19 -0700 (PDT) Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com [IPv6:2a00:1450:4864:20::42f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 64004130DDA for ; Thu, 5 Jul 2018 21:56:19 -0700 (PDT) Received: by mail-wr1-x42f.google.com with SMTP id c13-v6so2777324wrt.1 for ; Thu, 05 Jul 2018 21:56:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=cWuf8SjDDnWhxypfdT7WxXNn9qbmsM7C9pzGNavgLSk=; b=THBnc+Ve33WgaGBE0o0+bp2j5bBGJrYNK2lYB3hz7ZwuPQ5TbQ35EFewOoYm1X5+HG PbTuZTlv6gEKgB0jDOLf4Wba42rcYZVtMjQDcd577oLth9Ur4VDP/EwS4Gd1Q9gslljm OqiGXjJjj4F++p/c9SQ4oBr2kE+SV88+BaxZhyxtQc32PWXdIBR6+CDVKMuFV4rXNQu3 Pix9zMHSlX2rX4PpWykLYxqT2pCJtUd3k7J183VFfo5dCPoFWOxiYwKdhJj59mfwTXOf XUTjfXqbRspHupvhtmyaRCYS+5boHn0jzuMER+Ct57ltexxVMOBC31XHMnWWzPHZhV3j /0Iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=cWuf8SjDDnWhxypfdT7WxXNn9qbmsM7C9pzGNavgLSk=; b=eJMqMceLJXNjc0ttEUXWEqjIYQurSze8pFkO7kJKnMfOTWSTYDkpoCPRj15VqyaZXV JElVRlPQ3ASex3cKn0VYV9p4xgAKkE/ntP63NqQgEL2Onw4v70n/AX6WXQzv/gu6FWDS 7e09mJzcVMGrUIO6vfEGE4CjAE9C/KOnQ4Ghb/Q9O8eCBHn3zVS2ob27IcEVEVfqHz/X VbxmStQmw/Uf+atJ2UHUrxJBdgA0wlVwXu4eCLbGBOfAiofr4KoDP1pSE9MnD6kAR5h5 Tg6GnfxXbVfIbJ3pToSLLULi0543E5lrzA5d+TPMu4yn5RLOB+dufVMyemt+0r7nDi8G F50g== X-Gm-Message-State: APt69E3fNpnVEwLODyYfbLlcUUDd0CDRmX0mGHXqLYYrOSTUipklZtAh UlUtuw4mrnWkCsdukCTXobk= X-Google-Smtp-Source: AAOMgpc1FVjFIVE+OzKsuPA7Zwc4xCX/2qpq+FqlbQwilSTmp+RD0/s6rY0MdJhZeYAezH6O/Ty+ug== X-Received: by 2002:adf:abd3:: with SMTP id s77-v6mr4612827wrc.129.1530852977977; Thu, 05 Jul 2018 21:56:17 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id 35-v6sm1118670wri.78.2018.07.05.21.56.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 05 Jul 2018 21:56:16 -0700 (PDT) To: "Wheeler, David M" , "teep@ietf.org" , Hannes Tschofenig References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> From: Anders Rundgren Message-ID: <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> Date: Fri, 6 Jul 2018 06:56:13 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 04:56:21 -0000 I hope that you guys don't mind a (distantly) related architectural question. Using trusted hardware and TEEs is indeed cool since they enable security levels comparable to traditional smart cards although provisioned on-line. A quite popular use case is using a mobile phone as a "security device" together with a PC running a web applications like on-line banking. Such arrangements usually depend on an OOB channel from the phone. However, the majority of these applications are in spite of all the great security solutions still susceptible to fairly trivial phishing attacks. In fact, some of these systems have been exploited numerous times through social engineering over the phone! What is the problem then? Please don't take it personally but there are obviously some disconnects in this industry, high-lighted by the fact that QR code has become "the new black" although it is inconvenient and have poor security characteristics. Summary: for a certain kind of real world applications, trusted hardware offers only marginally better security than traditional passwords. Cheers, Anders From nobody Thu Jul 5 22:50:16 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F9C1130E0A for ; Thu, 5 Jul 2018 22:50:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GEYXV3QtjgKk for ; Thu, 5 Jul 2018 22:50:10 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40065.outbound.protection.outlook.com [40.107.4.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E97C1277CC for ; Thu, 5 Jul 2018 22:50:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dPAjKDpVVMuft2m5R8i5CVkLDcb4To/EU6eB7ZkqGdY=; b=px1vif54FjNhsZtfX9tDhakCNUfTprI7Ho1fdeFsNrRjKccUlTfp9pmnhiIAd7VYg5CiNFTfYQ7nPSOVnubNFDDjYq8Va3jldJaqDzR8QP8NEuGJ9F3gRTgVvNUqJGSCeUXvsWWPkuajclWSSt+t6OzNEDD7H8S92nopsYPdm2I= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB1951.eurprd08.prod.outlook.com (10.173.74.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.930.20; Fri, 6 Jul 2018 05:50:07 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db%10]) with mapi id 15.20.0906.026; Fri, 6 Jul 2018 05:50:07 +0000 From: Hannes Tschofenig To: Anders Rundgren , "Wheeler, David M" , "teep@ietf.org" Thread-Topic: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrwAABlbQAAEwT0gAAB0RiQ Date: Fri, 6 Jul 2018 05:50:06 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> In-Reply-To: <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.122.252] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB1951; 7:JSkOhOXUt3htGcsPjr/w/nrcjABiTaK40qcu0pPtc6mqXt2wVwjVyrPEyT0xaHelWbs1/OkQCJiXbWmn1sRRjPa/KFg7SyfSDYeewhV7+264MXDNH4BB8B4QLlh+vnDG9ss6nkQld/cGYEAsDBSqw3nXx7cOANF/4gKhBC5H0npX2OZZXiC+aXefG1KAKxGhllvPkylk348d0H7x95RRdfksDqANrMOwvXbjdfb6fxmSXqkzqGKk5H1FONIP+4Bc x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: e5f2c164-bd8e-4d67-0eed-08d5e30453f3 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB1951; x-ms-traffictypediagnostic: VI1PR0801MB1951: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(223705240517415)(85827821059158); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(3002001)(3231254)(944501410)(52105095)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123562045)(20161123558120)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB1951; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB1951; x-forefront-prvs: 0725D9E8D0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(39850400004)(366004)(396003)(136003)(199004)(189003)(13464003)(40434004)(6436002)(476003)(186003)(305945005)(446003)(11346002)(55016002)(9686003)(74316002)(256004)(7736002)(81166006)(81156014)(39060400002)(8676002)(2906002)(99286004)(97736004)(3846002)(6116002)(8936002)(102836004)(6246003)(93886005)(551544002)(14454004)(316002)(26005)(5660300001)(106356001)(53546011)(110136005)(105586002)(86362001)(6506007)(66066001)(229853002)(2900100001)(5024004)(5250100002)(7696005)(486006)(72206003)(478600001)(68736007)(2501003)(53936002)(33656002)(76176011)(25786009)(14444005); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB1951; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: PKxfS/ZrRtQD7v9Af1gNyYHj3/Qy+Q2w2ZBeUmwYE9cLv7jXU9kN+5qS7Gdu3wBYNVKCc66TEaDpNmpJss/UTUNY9wy/Ki0CBXtDsCd2KJY8vCmCfKCEKacijfDi9CFFjr7lZSGqcTqaHijlqdwovWh/dgGkNi76VahMawSjDhq0Qj9NBCIMiQSCso5iEI9WY4Bm6WT6866dTRcQon0oU/yj76xYlLFAfTTQCEYyPjYCzAKOtIehWZH2D9SQWxlUZ8J7yoO58+9Ym6YwgX+HcT/0ENW1f0DlrCYXXXHI0K86ADY+e+1ezDgiqFVmX0jvgm2CtslpvBQuvkplLOdTJdvZtaOQdadQvSpILGHPSwQ= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: e5f2c164-bd8e-4d67-0eed-08d5e30453f3 X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2018 05:50:06.8413 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1951 Archived-At: Subject: Re: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 05:50:15 -0000 SGkgQW5kZXJzLA0KDQpJIGFncmVlIHRoYXQgdGhlcmUgYXJlIG1vYmlsZSBwaG9uZSBhdXRoZW50 aWNhdGlvbiBhbmQgcGF5bWVudCBzb2x1dGlvbnMgdGhhdCBkbyBub3Qgb2ZmZXIgbXVjaCBiZXR0 ZXIgc2VjdXJpdHkgdGhhbiB0cmFkaXRpb25hbCBwYXNzd29yZHMuDQoNCldlIGRvLCBob3dldmVy LCBub3QgcHJvcG9zZSBhIHNpbmdsZSBhdXRoZW50aWNhdGlvbiBvciBwYXltZW50IHNvbHV0aW9u IGJ1dCBpbnN0ZWFkIHdhbnQgdG8gZW5hYmxlIGRldmVsb3BlcnMgdG8gdXBsb2FkIGFuZCBtYW5h Z2UgY29kZSBvbiB0aGUgVEVFLiBUaGlzIGNvdWxkLCBmb3IgZXhhbXBsZSwgZW5hYmxlIGltcHJv dmVkIHNlY3VyaXR5IGZvciBhbiBGSURPLWJhc2VkIGF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbS4N Cg0KQ2lhbw0KSGFubmVzDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBBbmRl cnMgUnVuZGdyZW4gW21haWx0bzphbmRlcnMucnVuZGdyZW4ubmV0QGdtYWlsLmNvbV0NClNlbnQ6 IDA2IEp1bHkgMjAxOCAwNjo1Ng0KVG86IFdoZWVsZXIsIERhdmlkIE07IHRlZXBAaWV0Zi5vcmc7 IEhhbm5lcyBUc2Nob2ZlbmlnDQpTdWJqZWN0OiBPT0IgSXNzdWVzLiBXYXM6IFtUZWVwXSBDb21t ZW50cyBvbiBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlLTAwLnR4dA0K DQpJIGhvcGUgdGhhdCB5b3UgZ3V5cyBkb24ndCBtaW5kIGEgKGRpc3RhbnRseSkgcmVsYXRlZCBh cmNoaXRlY3R1cmFsIHF1ZXN0aW9uLg0KDQpVc2luZyB0cnVzdGVkIGhhcmR3YXJlIGFuZCBURUVz IGlzIGluZGVlZCBjb29sIHNpbmNlIHRoZXkgZW5hYmxlIHNlY3VyaXR5IGxldmVscyBjb21wYXJh YmxlIHRvIHRyYWRpdGlvbmFsIHNtYXJ0IGNhcmRzIGFsdGhvdWdoIHByb3Zpc2lvbmVkIG9uLWxp bmUuDQoNCkEgcXVpdGUgcG9wdWxhciB1c2UgY2FzZSBpcyB1c2luZyBhIG1vYmlsZSBwaG9uZSBh cyBhICJzZWN1cml0eSBkZXZpY2UiIHRvZ2V0aGVyIHdpdGggYSBQQyBydW5uaW5nIGEgd2ViIGFw cGxpY2F0aW9ucyBsaWtlIG9uLWxpbmUgYmFua2luZy4gIFN1Y2ggYXJyYW5nZW1lbnRzIHVzdWFs bHkgZGVwZW5kIG9uIGFuIE9PQiBjaGFubmVsIGZyb20gdGhlIHBob25lLg0KDQpIb3dldmVyLCB0 aGUgbWFqb3JpdHkgb2YgdGhlc2UgYXBwbGljYXRpb25zIGFyZSBpbiBzcGl0ZSBvZiBhbGwgdGhl IGdyZWF0IHNlY3VyaXR5IHNvbHV0aW9ucyBzdGlsbCBzdXNjZXB0aWJsZSB0byBmYWlybHkgdHJp dmlhbCBwaGlzaGluZyBhdHRhY2tzLiAgSW4gZmFjdCwgc29tZSBvZiB0aGVzZSBzeXN0ZW1zIGhh dmUgYmVlbiBleHBsb2l0ZWQgbnVtZXJvdXMgdGltZXMgdGhyb3VnaCBzb2NpYWwgZW5naW5lZXJp bmcgb3ZlciB0aGUgcGhvbmUhDQoNCldoYXQgaXMgdGhlIHByb2JsZW0gdGhlbj8gIFBsZWFzZSBk b24ndCB0YWtlIGl0IHBlcnNvbmFsbHkgYnV0IHRoZXJlIGFyZSBvYnZpb3VzbHkgc29tZSBkaXNj b25uZWN0cyBpbiB0aGlzIGluZHVzdHJ5LCBoaWdoLWxpZ2h0ZWQgYnkgdGhlIGZhY3QgdGhhdCBR UiBjb2RlIGhhcyBiZWNvbWUgInRoZSBuZXcgYmxhY2siIGFsdGhvdWdoIGl0IGlzIGluY29udmVu aWVudCBhbmQgaGF2ZSBwb29yIHNlY3VyaXR5IGNoYXJhY3RlcmlzdGljcy4NCg0KU3VtbWFyeTog Zm9yIGEgY2VydGFpbiBraW5kIG9mIHJlYWwgd29ybGQgYXBwbGljYXRpb25zLCB0cnVzdGVkIGhh cmR3YXJlIG9mZmVycyBvbmx5IG1hcmdpbmFsbHkgYmV0dGVyIHNlY3VyaXR5IHRoYW4gdHJhZGl0 aW9uYWwgcGFzc3dvcmRzLg0KDQpDaGVlcnMsDQpBbmRlcnMNCklNUE9SVEFOVCBOT1RJQ0U6IFRo ZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVu dGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVu ZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBk byBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBm b3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBt ZWRpdW0uIFRoYW5rIHlvdS4NCg== From nobody Thu Jul 5 23:07:15 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3771130E1F for ; Thu, 5 Jul 2018 23:07:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fZd5VKEglfSa for ; Thu, 5 Jul 2018 23:07:12 -0700 (PDT) Received: from mail-wm0-x232.google.com (mail-wm0-x232.google.com [IPv6:2a00:1450:400c:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C10E1130DE2 for ; Thu, 5 Jul 2018 23:07:11 -0700 (PDT) Received: by mail-wm0-x232.google.com with SMTP id s14-v6so13317474wmc.1 for ; Thu, 05 Jul 2018 23:07:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=Sp1SzjTHQh6o/X3QITqowqyNZ5hVUW6Tp7jT1IPWmEU=; b=WM2PHEnFQMW952Pl3Gdvl088jRAedlu5WjOrcrGz37zZeRLo5N0AFozyvtikVDYSp1 MhMcrrHoTY6PxhmtvToHkaNrRAbZYHQsIWw2GcrQ/exdCCDxxR07zcRbKIw1bKMGMjUO VEcicwp6CHMceI8QzyhlJvliMqMawkqknvAeyqlWrDfx63ohygYC6narafvB0imFrdL0 +twGqNLJ1oqc89RXLbY6XXYNhr+68ocUGInuzzamhh3LSIIevN3YfFqOY5eIPNAhYhI4 vMh4saBTYfQ4YYDVYfLnq4owMS1ebc//QOe+nOUT7qu7CnVcf5yTxqbFHttLMFn5eYwU ySVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=Sp1SzjTHQh6o/X3QITqowqyNZ5hVUW6Tp7jT1IPWmEU=; b=ZJ0HSFxbxJTXotm+veM7vFZ6pmoUBoKfaRTMDP7BDtif8W2icFfx5ZqAQN8hAtl4kd vih43+gpBtq3vFKNKVXIIlSV6L+h/ofKbMqp7mm6YOAFVL3sKT6aMOer+AJNGLSZ+OQu ccCX4L+K9PMOcKvqyelYTEoKWP+dEVbwDwklFzK5CzKMid+YtO69eiXsLmrTQvuSFXgg OuvA54NXVTqSR2FLz05GuFMgYGSlSHHX6Xssvs0+SoiQsSL5rzxpDKH5wV9N2SrfCAjB 4SsuW9/WvOI/o1mmXGbEWjRD5TYcwsSxpCYw3OWDXOGJMY5Pw32w48m6orfnas38FDVQ hQpQ== X-Gm-Message-State: APt69E0pkJkUrOTxns8pyzyBnFofHO6xnsiN3wpM/9Fn6fFhTUIBRuXO e/IbaoWMkK3JTs4SCOVAKBcAZQ== X-Google-Smtp-Source: AAOMgpdBwg+ru93xHjv1QLb7VQY+m+j/MgXqCmbYf+q5xpxH9axUI3Xq9oCvbS0preeULaYAyo6u+g== X-Received: by 2002:a1c:570a:: with SMTP id l10-v6mr5964802wmb.56.1530857229852; Thu, 05 Jul 2018 23:07:09 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id k188-v6sm11161667wmd.47.2018.07.05.23.07.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 05 Jul 2018 23:07:08 -0700 (PDT) To: Hannes Tschofenig , "Wheeler, David M" , "teep@ietf.org" References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> From: Anders Rundgren Message-ID: Date: Fri, 6 Jul 2018 08:07:05 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 06:07:14 -0000 On 2018-07-06 07:50, Hannes Tschofenig wrote: > Hi Anders, Hi Hannes, > I agree that there are mobile phone authentication and payment solutions that do not offer much better security than traditional passwords. > > We do, however, not propose a single authentication or payment solution but instead want to enable developers to upload and manage code on the TEE. This could, for example, enable improved security for an FIDO-based authentication mechanism. What I was trying to explain is that it doesn't matter if you have TEEs or not if the system depends on an OOB channel (which currently is close to a de-facto standard). As a developer of such systems I find it deeply unsatisfying having to admit that in spite of using "state of the art security solutions", it doesn't really cope with phishing. What is your recommended solution/workaround to this problem? Dropping OOB? Replacing OOB with ...? Cheers, Anders > > Ciao > Hannes > > -----Original Message----- > From: Anders Rundgren [mailto:anders.rundgren.net@gmail.com] > Sent: 06 July 2018 06:56 > To: Wheeler, David M; teep@ietf.org; Hannes Tschofenig > Subject: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt > > I hope that you guys don't mind a (distantly) related architectural question. > > Using trusted hardware and TEEs is indeed cool since they enable security levels comparable to traditional smart cards although provisioned on-line. > > A quite popular use case is using a mobile phone as a "security device" together with a PC running a web applications like on-line banking. Such arrangements usually depend on an OOB channel from the phone. > > However, the majority of these applications are in spite of all the great security solutions still susceptible to fairly trivial phishing attacks. In fact, some of these systems have been exploited numerous times through social engineering over the phone! > > What is the problem then? Please don't take it personally but there are obviously some disconnects in this industry, high-lighted by the fact that QR code has become "the new black" although it is inconvenient and have poor security characteristics. > > Summary: for a certain kind of real world applications, trusted hardware offers only marginally better security than traditional passwords. > > Cheers, > Anders > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > From nobody Thu Jul 5 23:26:12 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3810A130DE2 for ; Thu, 5 Jul 2018 23:26:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i2lC-ZAoK56o for ; Thu, 5 Jul 2018 23:26:08 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-he1eur02on061f.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe05::61f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86C141271FF for ; Thu, 5 Jul 2018 23:26:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FIpVBqM+NKZy0CAiaeoTvqYj9BpBp/mQBEKvx3cKMns=; b=fovxHqaiRRLnrXR/ldwdevj4bpr0KXzKZGddtI7EzF7iAbsgEbJhlsLepzG5jrVn1fTkDUq/9pGWxUmDwCgPct1Rvkrddu0TDi9RFFiXfHLd4/99ss64AZNkFiuJcZYhtTxeamWw03rFGnnR4wpUUd7L1PkDU/bu64VXeteCcr0= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB2096.eurprd08.prod.outlook.com (10.173.75.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.930.18; Fri, 6 Jul 2018 06:26:04 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db%10]) with mapi id 15.20.0906.026; Fri, 6 Jul 2018 06:26:04 +0000 From: Hannes Tschofenig To: Anders Rundgren , "Wheeler, David M" , "teep@ietf.org" Thread-Topic: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrwAABlbQAAEwT0gAAB0RiQAACogYAAAJzPAA== Date: Fri, 6 Jul 2018 06:26:04 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.122.252] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB2096; 7:a3CrvdWD7P8G7aT0OTChCEBDsHeN0HiJNZU6el7bkD90DJXU154hEGvm57Ve7vURaK0coO99PRe2ROb8YYiboaxyLGX1xKmP2BSnb+fBXTQEO+HqHMofQlMMbNlmR98D+y2vCTyUx3D6zuhW7rG6R9MKmLV+23tpUKt4zWNKO7SY2ybi/oKX/Mnb9qUYg/Y17usatA4sUQ9DMUXrqXMDTZcEAfbzOT5GAB64dD/n96BEBqptjG3q0Xm+RtwVcDN7 x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 7049faca-3527-4141-617f-08d5e30959ec x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:(223705240517415); BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(48565401081)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB2096; x-ms-traffictypediagnostic: VI1PR0801MB2096: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(223705240517415)(85827821059158); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(10201501046)(3002001)(3231254)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123560045)(20161123564045)(20161123558120)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB2096; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB2096; x-forefront-prvs: 0725D9E8D0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(396003)(39860400002)(346002)(376002)(366004)(40434004)(13464003)(189003)(199004)(74316002)(7736002)(5250100002)(39060400002)(551544002)(476003)(3846002)(105586002)(2906002)(102836004)(2900100001)(2501003)(316002)(99286004)(106356001)(7696005)(55016002)(229853002)(93886005)(86362001)(110136005)(6436002)(14444005)(33656002)(68736007)(9686003)(14454004)(72206003)(8676002)(81156014)(256004)(76176011)(53546011)(53936002)(8936002)(81166006)(478600001)(97736004)(11346002)(5660300001)(6246003)(486006)(305945005)(6116002)(446003)(66066001)(26005)(186003)(5024004)(25786009)(6506007); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB2096; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: fZ2rHp9TK50Rc34cFBTM84wCkJPIQfCwxNKYS8jJD8xeBUvWcTeR9uXvskkGpxnSxMVD3YG0mABjJLt7DJ54IuK9M/Wrlh9zaNM2o1XkJ9h4YCWi8mAuTom/8oqYEFU+VURHndseDMZBuTUn3iqrBOuk0FfWY3h/sQVe2t0ooaQFKiWb7ZoOt7/mLQArSOJj7OrhBwcql6UNng8fObRZXEQGLEkHZqF3Yfki7EJlloHcs2n6frntdHcN5eqn+m/sg0TNqIVSxuffc4c3/hCUofDFmbQhp3S1OwXeBG7JIFgWcn6L51EsGN0rEtdUm84FgVdngUgLtcBa6j9dc/PYwH7/qnNhi2nRKMsbR1ZEPw0= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7049faca-3527-4141-617f-08d5e30959ec X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2018 06:26:04.4606 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB2096 Archived-At: Subject: Re: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 06:26:10 -0000 SGkgQW5kZXJzLA0KDQpJbiB0aGlzIHNwZWNpZmljIGV4YW1wbGUgSSBoYXZlIHRvIGFkbWl0IHRo YXQgSSBoYXZlIGEgYmlhcyB0b3dhcmRzIEZJRE8uIEluIHRoaXMgc2V0dXAgRklETyB3b3VsZG4n dCBuZWVkIGFuIG91dC1vZi1iYW5kIGNoYW5uZWwuDQpUaGUgVEVFIHdvdWxkIGhlbHBmdWwgYW5k IE9UclAgY291bGQgYmUgdXNlZCB0byBkaXN0cmlidXRlIHRoZSBGSURPIEF1dGhlbnRpY2F0b3Ig Y29kZSB0byBwaG9uZXMgYW5kIHRhYmxldHMuDQoNCkNpYW8NCkhhbm5lcw0KDQotLS0tLU9yaWdp bmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogQW5kZXJzIFJ1bmRncmVuIFttYWlsdG86YW5kZXJzLnJ1 bmRncmVuLm5ldEBnbWFpbC5jb21dDQpTZW50OiAwNiBKdWx5IDIwMTggMDg6MDcNClRvOiBIYW5u ZXMgVHNjaG9mZW5pZzsgV2hlZWxlciwgRGF2aWQgTTsgdGVlcEBpZXRmLm9yZw0KU3ViamVjdDog UmU6IE9PQiBJc3N1ZXMuIFdhczogW1RlZXBdIENvbW1lbnRzIG9uIEktRCBBY3Rpb246IGRyYWZ0 LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUtMDAudHh0DQoNCk9uIDIwMTgtMDctMDYgMDc6NTAsIEhh bm5lcyBUc2Nob2ZlbmlnIHdyb3RlOg0KPiBIaSBBbmRlcnMsDQoNCkhpIEhhbm5lcywNCg0KPiBJ IGFncmVlIHRoYXQgdGhlcmUgYXJlIG1vYmlsZSBwaG9uZSBhdXRoZW50aWNhdGlvbiBhbmQgcGF5 bWVudCBzb2x1dGlvbnMgdGhhdCBkbyBub3Qgb2ZmZXIgbXVjaCBiZXR0ZXIgc2VjdXJpdHkgdGhh biB0cmFkaXRpb25hbCBwYXNzd29yZHMuDQo+DQo+IFdlIGRvLCBob3dldmVyLCBub3QgcHJvcG9z ZSBhIHNpbmdsZSBhdXRoZW50aWNhdGlvbiBvciBwYXltZW50IHNvbHV0aW9uIGJ1dCBpbnN0ZWFk IHdhbnQgdG8gZW5hYmxlIGRldmVsb3BlcnMgdG8gdXBsb2FkIGFuZCBtYW5hZ2UgY29kZSBvbiB0 aGUgVEVFLiBUaGlzIGNvdWxkLCBmb3IgZXhhbXBsZSwgZW5hYmxlIGltcHJvdmVkIHNlY3VyaXR5 IGZvciBhbiBGSURPLWJhc2VkIGF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbS4NCg0KV2hhdCBJIHdh cyB0cnlpbmcgdG8gZXhwbGFpbiBpcyB0aGF0IGl0IGRvZXNuJ3QgbWF0dGVyIGlmIHlvdSBoYXZl IFRFRXMgb3Igbm90IGlmIHRoZSBzeXN0ZW0gZGVwZW5kcyBvbiBhbiBPT0IgY2hhbm5lbCAod2hp Y2ggY3VycmVudGx5IGlzIGNsb3NlIHRvIGEgZGUtZmFjdG8gc3RhbmRhcmQpLg0KDQpBcyBhIGRl dmVsb3BlciBvZiBzdWNoIHN5c3RlbXMgSSBmaW5kIGl0IGRlZXBseSB1bnNhdGlzZnlpbmcgaGF2 aW5nIHRvIGFkbWl0IHRoYXQgaW4gc3BpdGUgb2YgdXNpbmcgInN0YXRlIG9mIHRoZSBhcnQgc2Vj dXJpdHkgc29sdXRpb25zIiwgaXQgZG9lc24ndCByZWFsbHkgY29wZSB3aXRoIHBoaXNoaW5nLg0K DQpXaGF0IGlzIHlvdXIgcmVjb21tZW5kZWQgc29sdXRpb24vd29ya2Fyb3VuZCB0byB0aGlzIHBy b2JsZW0/ICBEcm9wcGluZyBPT0I/IFJlcGxhY2luZyBPT0Igd2l0aCAuLi4/DQoNCkNoZWVycywN CkFuZGVycw0KDQo+DQo+IENpYW8NCj4gSGFubmVzDQo+DQo+IC0tLS0tT3JpZ2luYWwgTWVzc2Fn ZS0tLS0tDQo+IEZyb206IEFuZGVycyBSdW5kZ3JlbiBbbWFpbHRvOmFuZGVycy5ydW5kZ3Jlbi5u ZXRAZ21haWwuY29tXQ0KPiBTZW50OiAwNiBKdWx5IDIwMTggMDY6NTYNCj4gVG86IFdoZWVsZXIs IERhdmlkIE07IHRlZXBAaWV0Zi5vcmc7IEhhbm5lcyBUc2Nob2ZlbmlnDQo+IFN1YmplY3Q6IE9P QiBJc3N1ZXMuIFdhczogW1RlZXBdIENvbW1lbnRzIG9uIEktRCBBY3Rpb246IGRyYWZ0LWlldGYt dGVlcC1hcmNoaXRlY3R1cmUtMDAudHh0DQo+DQo+IEkgaG9wZSB0aGF0IHlvdSBndXlzIGRvbid0 IG1pbmQgYSAoZGlzdGFudGx5KSByZWxhdGVkIGFyY2hpdGVjdHVyYWwgcXVlc3Rpb24uDQo+DQo+ IFVzaW5nIHRydXN0ZWQgaGFyZHdhcmUgYW5kIFRFRXMgaXMgaW5kZWVkIGNvb2wgc2luY2UgdGhl eSBlbmFibGUgc2VjdXJpdHkgbGV2ZWxzIGNvbXBhcmFibGUgdG8gdHJhZGl0aW9uYWwgc21hcnQg Y2FyZHMgYWx0aG91Z2ggcHJvdmlzaW9uZWQgb24tbGluZS4NCj4NCj4gQSBxdWl0ZSBwb3B1bGFy IHVzZSBjYXNlIGlzIHVzaW5nIGEgbW9iaWxlIHBob25lIGFzIGEgInNlY3VyaXR5IGRldmljZSIg dG9nZXRoZXIgd2l0aCBhIFBDIHJ1bm5pbmcgYSB3ZWIgYXBwbGljYXRpb25zIGxpa2Ugb24tbGlu ZSBiYW5raW5nLiAgU3VjaCBhcnJhbmdlbWVudHMgdXN1YWxseSBkZXBlbmQgb24gYW4gT09CIGNo YW5uZWwgZnJvbSB0aGUgcGhvbmUuDQo+DQo+IEhvd2V2ZXIsIHRoZSBtYWpvcml0eSBvZiB0aGVz ZSBhcHBsaWNhdGlvbnMgYXJlIGluIHNwaXRlIG9mIGFsbCB0aGUgZ3JlYXQgc2VjdXJpdHkgc29s dXRpb25zIHN0aWxsIHN1c2NlcHRpYmxlIHRvIGZhaXJseSB0cml2aWFsIHBoaXNoaW5nIGF0dGFj a3MuICBJbiBmYWN0LCBzb21lIG9mIHRoZXNlIHN5c3RlbXMgaGF2ZSBiZWVuIGV4cGxvaXRlZCBu dW1lcm91cyB0aW1lcyB0aHJvdWdoIHNvY2lhbCBlbmdpbmVlcmluZyBvdmVyIHRoZSBwaG9uZSEN Cj4NCj4gV2hhdCBpcyB0aGUgcHJvYmxlbSB0aGVuPyAgUGxlYXNlIGRvbid0IHRha2UgaXQgcGVy c29uYWxseSBidXQgdGhlcmUgYXJlIG9idmlvdXNseSBzb21lIGRpc2Nvbm5lY3RzIGluIHRoaXMg aW5kdXN0cnksIGhpZ2gtbGlnaHRlZCBieSB0aGUgZmFjdCB0aGF0IFFSIGNvZGUgaGFzIGJlY29t ZSAidGhlIG5ldyBibGFjayIgYWx0aG91Z2ggaXQgaXMgaW5jb252ZW5pZW50IGFuZCBoYXZlIHBv b3Igc2VjdXJpdHkgY2hhcmFjdGVyaXN0aWNzLg0KPg0KPiBTdW1tYXJ5OiBmb3IgYSBjZXJ0YWlu IGtpbmQgb2YgcmVhbCB3b3JsZCBhcHBsaWNhdGlvbnMsIHRydXN0ZWQgaGFyZHdhcmUgb2ZmZXJz IG9ubHkgbWFyZ2luYWxseSBiZXR0ZXIgc2VjdXJpdHkgdGhhbiB0cmFkaXRpb25hbCBwYXNzd29y ZHMuDQo+DQo+IENoZWVycywNCj4gQW5kZXJzDQo+IElNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250 ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBh bmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJl Y2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3Qg ZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55 IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0u IFRoYW5rIHlvdS4NCj4NCg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMg ZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBi ZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVh c2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUg Y29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Ig c3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0K From nobody Fri Jul 6 00:44:52 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 799E4130E91 for ; Fri, 6 Jul 2018 00:44:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7hLj47tJBdjk for ; Fri, 6 Jul 2018 00:44:47 -0700 (PDT) Received: from mail-wr1-x42d.google.com (mail-wr1-x42d.google.com [IPv6:2a00:1450:4864:20::42d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A806130DDF for ; Fri, 6 Jul 2018 00:44:47 -0700 (PDT) Received: by mail-wr1-x42d.google.com with SMTP id u7-v6so3176846wrn.12 for ; Fri, 06 Jul 2018 00:44:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=86o1G4Ke0dcp5lhvSeXSf2/HRkRUJTU2IapPUCpAUp0=; b=qdEkcJOFTuWIaBzu4+YVaV+7Zcl5Z0geO+nxKeuJ2jBr0bh6cGyqjZTUAOoQgI+w+N 1N0eukFzraVh46H93yiMLmMyK98ub193jDXl/Oi7vyc7b08FNk2JtCj+lox/TtwgSurR 5qQySkZPhnBzouJhGHYSqqh8hzErQo0EY4VGRmy+CgIEz9+MsAwks0odGOPNtv6+hkod ddpji+pustr/JPzZEhE1EK1J2r8DmXhigQGgh3f7jtfYWW6xBxom63R/wGIBYOJnyxRx FsaoHGtdZOK207EBr/yk8L0dMGdpoo3/DuBX2vTyER0CnCFsjxv6gAUAeRy0VlvOajpC OW5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=86o1G4Ke0dcp5lhvSeXSf2/HRkRUJTU2IapPUCpAUp0=; b=JaoX951RM6ktCHu1ENAbD40wATNgapK6KrFu93DaIzjKLzcuMbkiM2t83CZ8r6ylWH YNnWScAXeaSyHoMajYTC1meg+Dzj1HjzppaN2RfRfzo4ylOKMPEZeAKCdWga3D+AL5/B wC4NFtb+l8xUD2Y18Wa6zTwH4aGR6ef3FBMv65iUjA5vRvPeHedLg5xzKcf8r6oKcf20 ubu9xI7r54Ab8Cr+Q//oFvqgXg/HdSsYNLCcRzUSo3SHFARi/DtXcJHpznuFFTST4mZr XmXrpAclrlaUXaaaG2j/USYcw7Tfzm184hVY6mCLwQN2RBLlyikqJx5ZfIea97PLmeBS IbVA== X-Gm-Message-State: APt69E3Bs/YxHjuxHt/a74wA+/wyWq36Do0MPRjPuFHTbpFHKyAu0iK8 uOT2LeLZMvlEZN6WJUyLBpiGiQ== X-Google-Smtp-Source: AAOMgpekL0G9FSiXth8+MHN4NEZINcggOZCDWKP75YAhhIBswmdCO5zlfQUX3NOkrOliEnLNEX+KuA== X-Received: by 2002:adf:8712:: with SMTP id a18-v6mr7205352wra.178.1530863085001; Fri, 06 Jul 2018 00:44:45 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id s200-v6sm17318966wmb.44.2018.07.06.00.44.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 06 Jul 2018 00:44:43 -0700 (PDT) To: Hannes Tschofenig , "Wheeler, David M" , "teep@ietf.org" References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> From: Anders Rundgren Message-ID: <19fdc505-f0f1-ae9f-4fec-0605c7ee3690@gmail.com> Date: Fri, 6 Jul 2018 09:44:40 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 07:44:50 -0000 On 2018-07-06 08:26, Hannes Tschofenig wrote: > Hi Anders, Hi Hannes, > In this specific example I have to admit that I have a bias towards FIDO. In this setup FIDO wouldn't need an out-of-band channel. I assume you mean that the phone would be equipped with a FIDO authenticator and then connected to the PC though BLE (or worst-case through a cable), right? This obviously works but is incompatible with client side PKI as well as other schemes that do not have a natural tie to FIDO. Since this certainly isn't "common knowledge", the most reasonable would be that those who represent the platform vendors (ARM, Intel, MSFT) explained to governments and banks that they should carefully reexamine their design choices for the future. FWIW, I'm personally interested in creating more "neutral" security technology, including addressing OOB channel authentication beyond what the current standard (QR) offers (=zero). Cheers, Anders > The TEE would helpful and OTrP could be used to distribute the FIDO Authenticator code to phones and tablets. > > Ciao > Hannes > > -----Original Message----- > From: Anders Rundgren [mailto:anders.rundgren.net@gmail.com] > Sent: 06 July 2018 08:07 > To: Hannes Tschofenig; Wheeler, David M; teep@ietf.org > Subject: Re: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt > > On 2018-07-06 07:50, Hannes Tschofenig wrote: >> Hi Anders, > > Hi Hannes, > >> I agree that there are mobile phone authentication and payment solutions that do not offer much better security than traditional passwords. >> >> We do, however, not propose a single authentication or payment solution but instead want to enable developers to upload and manage code on the TEE. This could, for example, enable improved security for an FIDO-based authentication mechanism. > > What I was trying to explain is that it doesn't matter if you have TEEs or not if the system depends on an OOB channel (which currently is close to a de-facto standard). > > As a developer of such systems I find it deeply unsatisfying having to admit that in spite of using "state of the art security solutions", it doesn't really cope with phishing. > > What is your recommended solution/workaround to this problem? Dropping OOB? Replacing OOB with ...? > > Cheers, > Anders > >> >> Ciao >> Hannes >> >> -----Original Message----- >> From: Anders Rundgren [mailto:anders.rundgren.net@gmail.com] >> Sent: 06 July 2018 06:56 >> To: Wheeler, David M; teep@ietf.org; Hannes Tschofenig >> Subject: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt >> >> I hope that you guys don't mind a (distantly) related architectural question. >> >> Using trusted hardware and TEEs is indeed cool since they enable security levels comparable to traditional smart cards although provisioned on-line. >> >> A quite popular use case is using a mobile phone as a "security device" together with a PC running a web applications like on-line banking. Such arrangements usually depend on an OOB channel from the phone. >> >> However, the majority of these applications are in spite of all the great security solutions still susceptible to fairly trivial phishing attacks. In fact, some of these systems have been exploited numerous times through social engineering over the phone! >> >> What is the problem then? Please don't take it personally but there are obviously some disconnects in this industry, high-lighted by the fact that QR code has become "the new black" although it is inconvenient and have poor security characteristics. >> >> Summary: for a certain kind of real world applications, trusted hardware offers only marginally better security than traditional passwords. >> >> Cheers, >> Anders >> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. >> > > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > From nobody Fri Jul 6 01:38:35 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD5E6130EAF for ; Fri, 6 Jul 2018 01:38:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.09 X-Spam-Level: X-Spam-Status: No, score=0.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=intercedeltd.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R939czIJ-aHN for ; Fri, 6 Jul 2018 01:38:28 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0084.outbound.protection.outlook.com [104.47.2.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFC1E130E8D for ; Fri, 6 Jul 2018 01:38:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=IntercedeLtd.onmicrosoft.com; s=selector1-intercede-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6E8mLaCR/b0d7M/eH4XdpbDHnhyPlp3eP2V7pq3rdVs=; b=AFDofuX6e+drfUX5KghSttYk6L3iedd8PwUuTmxNP65OtVw8SCAgZl0lkyXfYv7jHNjpc7ZHACF9W+IwBwCegLc3NTujy2VXcTBS7gUFi0GDgPGxqa5Ksx9Z7H1GfrtmM2FCfbuXcIyGfnc0tbMBr8VWdh0dVWnFzY9pwZFOVNk= Received: from HE1PR06MB3147.eurprd06.prod.outlook.com (10.171.198.20) by HE1PR06MB3865.eurprd06.prod.outlook.com (20.176.164.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.930.18; Fri, 6 Jul 2018 08:38:25 +0000 Received: from HE1PR06MB3147.eurprd06.prod.outlook.com ([fe80::e8d0:4c89:2645:fb62]) by HE1PR06MB3147.eurprd06.prod.outlook.com ([fe80::e8d0:4c89:2645:fb62%2]) with mapi id 15.20.0930.016; Fri, 6 Jul 2018 08:38:25 +0000 From: Andrew Atyeo To: Dave Thaler , "Wheeler, David M" , Hannes Tschofenig , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrwAABlbQAAAV1OEAAYPB0Q Date: Fri, 6 Jul 2018 08:38:25 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrew.Atyeo@intercede.com; x-originating-ip: [62.172.117.190] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR06MB3865; 7:xs5ZVmxbMVpW2XkcfyaPFgnzcCIYIY7aAFScDp7SLRfm60HSpKIo07aR6xbuXv5KpDj449EYOfZuMsFsVLlJO0Gl2NSxjsSLQe+9RLsDV7JqqrnTwT+NPIqALtUkcCS85WlEI3OQmqQ9R4nIUR8nhiNnSfW4c5v39bCyuMCPmnMweA3UqWkVDOFluAoUBgvOUFNO/2pWuMQeH76m2hDukUhJvI/D01XZ6FkWADnNQTGkDrYjyvVCCN/hZFiDy7B5 x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: d470a96e-7d6d-477c-10a5-08d5e31bd6df x-microsoft-antispam: UriScan:(223705240517415); BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:HE1PR06MB3865; x-ms-traffictypediagnostic: HE1PR06MB3865: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(180628864354917)(278428928389397)(192374486261705)(189930954265078)(223705240517415)(219752817060721)(21748063052155)(211171220733660)(228905959029699); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(3002001)(10201501046)(93006095)(93001095)(3231254)(944501410)(52105095)(149027)(150027)(6041310)(20161123564045)(20161123558120)(20161123562045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011)(7699016); SRVR:HE1PR06MB3865; BCL:0; PCL:0; RULEID:; SRVR:HE1PR06MB3865; x-forefront-prvs: 0725D9E8D0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(366004)(376002)(346002)(39840400004)(396003)(13464003)(40434004)(189003)(199004)(14454004)(966005)(606006)(14444005)(5024004)(66066001)(5250100002)(76176011)(2501003)(7696005)(256004)(5660300001)(97736004)(6506007)(186003)(102836004)(53546011)(53936002)(99286004)(316002)(45080400002)(110136005)(486006)(446003)(11346002)(476003)(26005)(72206003)(93886005)(86362001)(575784001)(478600001)(81166006)(8676002)(6116002)(2906002)(33656002)(25786009)(8936002)(68736007)(81156014)(9686003)(106356001)(105586002)(236005)(7736002)(3846002)(74316002)(6246003)(2900100001)(53946003)(55016002)(6436002)(6306002)(229853002)(790700001)(54896002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR06MB3865; H:HE1PR06MB3147.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: intercede.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: lI1VL07X6qbumGTsUV3/6haB6Htkc1ypV/jZqlwdM+1+6sRC6mWw8+ROHCd9YuX7JibFIDmFLoBR66ill2CJcsntfq49WBqUrWXq5Mb0OofsnpJbIjm3MT/ujk1sf2PntsrONCfAUpf58Oq3rFa5TodF5gY5Egnjc8qqkxjj8LRsG72DCYQHkrA0pwa8Ba8CEOkh+YOv+V9FvyvgiKNopY8YPIpbceUKF32xNIggajWYRVhgkh+ERmT9AN0hyaAYQjJyjoX+bdWHOU7BZ9Gzm6cQEAfEGI0Idfl34viAQ9ZJolDMJAEIiuAjdRCOAW94MKFMCMAfIgB1MvcxmuSGu2Q5ZBBfhZL3fFWJCj/gZ/A= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_HE1PR06MB3147C0F424CE98CA7F3AE12795470HE1PR06MB3147eurp_" MIME-Version: 1.0 X-OriginatorOrg: intercede.com X-MS-Exchange-CrossTenant-Network-Message-Id: d470a96e-7d6d-477c-10a5-08d5e31bd6df X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2018 08:38:25.0567 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 1075719f-f133-43d2-8156-800f80fef316 X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR06MB3865 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 08:38:34 -0000 --_000_HE1PR06MB3147C0F424CE98CA7F3AE12795470HE1PR06MB3147eurp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable In OTrP, I believe "root of trust" and "trust anchor" are currently referri= ng to 2 different things in the OTrP spec. * Root of trust Excerpt from OTrP: "This specification assumes that an applicable device is= equipped with a TEE and is pre-provisioned with a device-unique public/private key pair, which is securely stored. This key pair is referred as the 'root of trust'. An entity that uses such a device to run Trusted Applications (TAs) is known as a Service Provider (SP)." Here, "Root of Trust" must be talking about either the TEE/TFW private key,= so "root of trust" is referring to the process of secure boot that results= in a TAM being able to use a signature from this key to know whether to tr= ust the TEE * Trust Anchor There is a problem this refers to 2 completely different concepts: "Setup trust anchors in devices 1. [TFW/TEE] Store the key and certificate encrypted with the eFuse key 2. [TEE vendor or OEM] Store trusted CA certificate list into devices" Here, "Trust Anchor" is referring to both the TFW private key and the TAM C= A root certificate store BUT later on in the spec: "The root CA certificates for a TAM, which are embedded into the trust anchor store in a device, should have long lifetimes that don't require device trust anchor update." And "Trust Anchor: A root certificate that can be used to validate its children certificates. It is usually embedded in a device or configured by a TAM for validating the trust of a remote entity's certificate." Here, "Trust Anchor" refers to the TAM root CA whitelist that is embedded i= n the TEE in order to allow the TEE to chain TAM certificates to the root C= A certs (to determine what certs to trust) ...So it is best if we can remove the term "trust anchor" wherever it refer= s to the concept of root CA certs, and refer to "TAM root CA certificate st= ore" (or something like that) , and for everywhere else that uses "trust anchor" to refer to the concept = of secureboot/attestation etc, we need to settle on some other term. In som= e cases e.g. "pair, which is securely stored in the TEE. This key pair is referred = to as the 'root of trust'." we can simply refer to the TFW key (since in places 'root of trust' is used= to describe the TFW key). Andrew Atyeo Security Architect Intercede Digital trust people | devices | apps Office: +44 (0) 1455 558 111 www.intercede.com -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Dave Thaler Sent: 05 July 2018 21:36 To: Wheeler, David M ; Hannes Tschofenig ; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt [speaking as an individual] As David says, there's more than one type of "Root-of-Trust" aka "trust anc= hor". There are industry terms of art for the different types. One example article that gives a decent summary is https://healthitsecurity= .com/news/nist-roots-of-trust-for-healthcare-mobile-devices In particular, the industry terms (from NIST SP 800-164, potentially among = others) are: Roof of Trust for Storage (RTS) Root of Trust for Verification (RTV) Root of Trust for Integrity (RTI) Root of Trust for Reporting (RTR) Root of Trust for Measurement (RTM) I would recommend using the above terms and not using "trust anchor" or the= unqualified "root of trust" term. Dave -----Original Message----- From: TEEP > On Behalf = Of Wheeler, David M Sent: Thursday, July 5, 2018 12:52 PM To: Hannes Tschofenig >; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Hannes, If that is the case (trust root and trust anchors are the same), then I hav= e a concern regarding crypto separation. In one definition the Trust Anchor signs certificates, in the other definit= ion a Root-of-Trust signs attestations. If these are in fact the same key, then they are being used for two differe= nt functions, which is not recommended for cryptographic keys. Further, it seems to me (though I may be misunderstanding the intended func= tion), the private key of the Trust Anchor resides outside the device, in a= separate entity, like a CA or a TAM. However, the private key of a Root-of-Trust resides in the TEE (or is acces= sible only to the TEE). Can you pick apart my understanding of the two definitions of keys, and hel= p me understand where I got thrown off? Thanks, Dave Wheeler -----Original Message----- From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com] Sent: Thursday, July 5, 2018 12:41 PM To: Wheeler, David M >; teep@ietf.org Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Just a quick remark: IMHO root of trust and trust anchor are the same thing= . I believe we should update the text to only talk about trust anchors and = forget the root of trust terminology. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M Sent: 05 July 2018 21:38 To: teep@ietf.org Subject: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt I have several comments on the new architecture draft. The first comment has to do with the definition of the "Trust Anchor" (page= 4) The definition states: Trust Anchor: A root certificate that can be used to validate its certificates. It is usually embedded in a devic= e or configured by a TAM for validating the trust of= a remote entity's certificate. Then later in section 3 (page 6) This specification assumes that an applicable device is equipped with one = or more TEEs and each TEE is pre-provisioned with a device-unique public/p= rivate key pair, which is securely stored. This key pair is referred to as= the 'root of trust' for remote attestation of the associated TEE in a dev= ice by an TAM. It is not clear whether the "Trust Anchor" is the same as the "root-of-trus= t" key pair, since the "root-of-trust" is not included in the definitions. If they are intended to be different (which is what I believe), then I sugg= est we add the "root-of-trust" to the definitions, and explain the differen= ce. Oftentimes, in my experience, these terms are used interchangeably. Here is my attempt to create definitions for these two types of keys: Trust Anchor: A trust anchor is public asymmetric key, preferably contained= in a certificate that represents a trusted entity to a device. T= his public key may be used by the holder of the corresponding private key to = sign other certificates, thereby communicating the signed certificate ma= y also be trusted. The trust anchor is usually embedded in a devic= e or configured by a TAM and used by the device to validate the trust o= f a remote entity by verifying that entity's certificate is signed b= y a trust anchor. Trust anchors must be stored in a way that pre= vents or strongly resists modification by unauthorized software and hard= ware adversaries. An example of a trust anchor is the public key of a TAM or SP whi= ch is "pinned" or securely stored inside the device, an= d that trust anchor is used like a CA certificate to validate the trust in = other keys/certificates. A trust anchor may be viewed by both trusted and= untrusted entities on the device, But may only be modified or deleted by a trusted = entity. Root-of-Trust Key: A device-unique key generated at device manufacturing o= r at TEE provisioning, which is securely stored and = only accessible to the TEE. The Root-of-Trust Key is used for attestation s= igning which proves the signed message originated or was approved by the TEE, = and may be trusted to the same degree as the TEE. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatrac= ker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=3D02%7C01%7Cd= thaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141a= f91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DXBuTlsiV5Ojkxkcq= ULdsmroTnWRZqApH3fBokJGvkTE%3D&reserved=3D0 There are also htmlized versions available at: https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools.ie= tf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7C01%7Cdthale= r%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab= 2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DheO1xlxfrVZyyzYziQy8V= 2P0vxiEbTVSF8sFdNaw8sc%3D&reserved=3D0 https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatrac= ker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7= C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf= 86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DaoKW%2FFn= lzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&reserved=3D0 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep --_000_HE1PR06MB3147C0F424CE98CA7F3AE12795470HE1PR06MB3147eurp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

In OTrP, I believe "root of trust" and = "trust anchor" are currently referring to 2 different things in t= he OTrP spec.

 

·         Root of trust

Excerpt from OTrP: “This specificati=
on assumes that an applicable device is equipped with

   a TEE =
and is pre-provisioned with a device-unique public/private key


   pair, =
which is securely stored.  This key pair is referred as the=



   'root =
of trust'.  An entity that uses such a device to run Trusted


   Applic=
ations (TAs) is known as a Service Provider (SP).”<=
/p>

Here, “Root of Trust” must be talking=
 about either the TEE/TFW private key, so “root of trust” is re=
ferring to the process of secure boot that results in a TAM being able to u=
se a signature from this key to know whether to trust the
 TEE


 



·        
Trust Anchor


There is a problem this refers to 2 completely di=
fferent concepts:


“Setup trust anchors in devices=



 


   1.  [TFW/TEE] Store the =
key and certificate encrypted with the eFuse


       key


 


   2.  [TEE vendor or OEM] =
Store trusted CA certificate list into


       devic=
es”


Here, “Trust Anchor” is referring to =
both the TFW private key and the TAM CA root certificate store

 


BUT later on in the spec:


“The root CA certificates for a TAM, which are <=
o:p>


embedded into the trust anchor store in a device, shou=
ld have long



lifetimes that don't require device trust anchor =
update.”


And


“Trust Anchor: A root certificate that can be used to validate its



children certific=
ates. It is usually embedded in a device or



configured by a T=
AM for validating the trust of a remote entity's



certificate.”


Here, “Trust Anchor” refers to the TA=
M root CA whitelist that is embedded in the TEE in order to allow the TEE t=
o chain TAM certificates to the root CA certs (to determine what certs to t=
rust)


 


…So it is best if we can remove the term &#=
8220;trust anchor” wherever it refers to the concept of root CA certs=
, and refer to “TAM root CA certificate store” (or something li=
ke that)


, and for everywhere else that uses “trust =
anchor” to refer to the concept of secureboot/attestation etc, we nee=
d to settle on some other term. In some cases



e.g. “pair, which is securely stored in the TEE. This k=
ey pair is referred to as the 'root of trust'.”


we can simply refer to the TFW key (since in plac=
es ‘root of trust’ is used to describe the TFW key).



 


 


Andrew Atyeo 


Security Architect


 


Intercede


Digital trust    people | devices =
| apps


 


Office: +44 (0) 1455 558 111


www.intercede.com


-----Original Message-----

From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Dave Thaler

Sent: 05 July 2018 21:36

To: Wheeler, David M <david.m.wheeler@intel.com>; Hannes Tschofenig &=
lt;Hannes.Tschofenig@arm.com>; teep@ietf.org

Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00=
.txt


 


[speaking as an individual]


 


As David says, there's more than one type of &quo=
t;Root-of-Trust" aka "trust anchor".



There are industry terms of art for the different=
 types.


One example article that gives a decent summary i=
s 
https://healthitsecur=
ity.com/news/nist-roots-of-trust-for-healthcare-mobile-devices


 


In particular, the industry terms (from NIST SP 8=
00-164, potentially among others) are:


Roof of Trust for Storage (RTS)


Root of Trust for Verification (RTV)

Root of Trust for Integrity (RTI)


Root of Trust for Reporting (RTR)


Root of Trust for Measurement (RTM)

 


I would recommend using the above terms and not u=
sing "trust anchor" or the unqualified "root of trust" =
term.


 


Dave


 


-----Original Message-----


From: TEEP <teep-bounces@i=
etf.org> On Behalf Of Wheeler, David M


Sent: Thursday, July 5, 2018 12:52 PM<=
/p>

To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>;
teep@ietf.org


Subject: Re: [Teep] Comments on I-D Action: draft=
-ietf-teep-architecture-00.txt


 


Hannes,


If that is the case (trust root and trust anchors=
 are the same), then I have a concern regarding crypto separation.


In one definition the Trust Anchor signs certific=
ates, in the other definition a Root-of-Trust signs attestations.


If these are in fact the same key, then they are =
being used for two different functions, which is not recommended for crypto=
graphic keys.


 


Further, it seems to me (though I may be misunder=
standing the intended function), the private key of the Trust Anchor reside=
s outside the device, in a separate entity, like a CA or a TAM.<=
/p>

However, the private key of a Root-of-Trust resid=
es in the TEE (or is accessible only to the TEE).


 


Can you pick apart my understanding of the two de=
finitions of keys, and help me understand where I got thrown off?


 


Thanks,


Dave Wheeler 


 


-----Original Message-----


From: Hannes Tschofenig [=
mailto:Hannes.Tschofenig@arm.com]



Sent: Thursday, July 5, 2018 12:41 PM<=
/p>

To: Wheeler, David M <=
david.m.wheeler@intel.com>;
teep@ietf.org


Subject: RE: [Teep] Comments on I-D Action: draft=
-ietf-teep-architecture-00.txt


 


Just a quick remark: IMHO root of trust and trust=
 anchor are the same thing. I believe we should update the text to only tal=
k about trust anchors and forget the root of trust terminology.<=
/p>

 


 


-----Original Message-----


From: TEEP [mailto:teep-bounc=
es@ietf.org] On Behalf Of Wheeler, David M


Sent: 05 July 2018 21:38


To: teep@ietf.org


Subject: [Teep] Comments on I-D Action: draft-iet=
f-teep-architecture-00.txt


 


I have several comments on the new architecture d=
raft.


 


The first comment has to do with the definition o=
f the "Trust Anchor" (page 4)


 


The definition states:


Trust Anchor: A root certificate that can be used=
 to validate its


        &=
nbsp;           &nbs=
p;       certificates. It is usually embedded=
 in a device or


        &=
nbsp;            &nb=
sp;      configured by a TAM for validating t=
he trust of a remote entity's


        &=
nbsp;           &nbs=
p;       certificate.


 


Then later in section 3 (page 6)


This specification assumes that an applicable dev=
ice is equipped with  one or more TEEs and each TEE is pre-provisioned=
 with a device-unique  public/private key pair, which is securely stor=
ed. This key pair is  referred to as the 'root
 of trust' for remote attestation of the  associated TEE in a device b=
y an TAM.


 


 


It is not clear whether the "Trust Anchor&qu=
ot; is the same as the "root-of-trust" key pair, since the "=
root-of-trust" is not included in the definitions.


 


If they are intended to be different (which is wh=
at I believe), then I suggest we add the "root-of-trust" to the d=
efinitions, and explain the difference. Oftentimes, in my experience, these=
 terms are used interchangeably.


 


Here is my attempt to create definitions for thes=
e two types of keys:


 


Trust Anchor: A trust anchor is public asymmetric=
 key, preferably contained in a certificate


        &=
nbsp;            &nb=
sp;      that represents a trusted entity to =
a device. This public key may be used by


        &=
nbsp;           &nbs=
p;       the holder of the corresponding priv=
ate key to sign other certificates,


        &=
nbsp;           &nbs=
p;       thereby communicating the signed cer=
tificate may also be trusted.


        &=
nbsp;           &nbs=
p;       The trust anchor is usually embedded=
 in a device or configured by a TAM


        &=
nbsp;           &nbs=
p;        and used by the device to vali=
date the trust of a remote entity by


        &=
nbsp;           &nbs=
p;       verifying that entity's certificate =
is signed by a trust anchor.


        &=
nbsp;           &nbs=
p;        Trust anchors must be stored i=
n a way that prevents or strongly resists


        &=
nbsp;           &nbs=
p;        modification by unauthorized s=
oftware and hardware adversaries.


        &=
nbsp; An example of a trust anchor is the public key of a TAM or SP which i=
s


        &=
nbsp;           &nbs=
p;     "pinned" or securely stored inside the=
 device, and that trust anchor is used


        &=
nbsp;           &nbs=
p;       like a CA certificate to validate th=
e trust in other keys/certificates.


        &=
nbsp;           &nbs=
p;      A trust anchor may be viewed by both trust=
ed and untrusted entities on the device,


        &=
nbsp;           &nbs=
p;     But may only be modified or deleted by a trusted=
 entity.


 


Root-of-Trust Key:  A device-unique key gene=
rated at device manufacturing or at


        &=
nbsp;           &nbs=
p;       TEE provisioning, which is securely =
stored and only accessible to the TEE.


        &=
nbsp;           &nbs=
p;       The Root-of-Trust Key is used for at=
testation signing which proves the signed


        &=
nbsp;           &nbs=
p;       message originated or was approved b=
y the TEE, and may be trusted to the same


        &=
nbsp;           &nbs=
p;      degree as the TEE.


 


-----Original Message-----


From: TEEP [mailto:teep-bounc=
es@ietf.org] On Behalf Of
internet-drafts@ietf.org


Sent: Wednesday, July 4, 2018 7:49 AM<=
/p>

To: i-d-announce@ietf.org


Cc: teep@ietf.org


Subject: [Teep] I-D Action: draft-ietf-teep-archi=
tecture-00.txt


 


 


A New Internet-Draft is available from the on-lin=
e Internet-Drafts directories.


This draft is a work item of the Trusted Executio=
n Environment Provisioning WG of the IETF.


 


        Title&=
nbsp;          : Trusted Execu=
tion Environment Provisioning (TEEP) Architecture


        Author=
s         : Mingliang Pei


        &=
nbsp;           &nbs=
p;     Hannes Tschofenig


        &=
nbsp;           &nbs=
p;     Andrew Atyeo


        &=
nbsp;           &nbs=
p;     Dapeng


Filename       =
; : draft-ietf-teep-architecture-00.txt


Pages       &n=
bsp;   : 24


Date       &nb=
sp;    : 2018-07-02


 


Abstract:


   A Trusted Execution Environment (TEE=
) was designed to provide a


   hardware-isolation mechanism to sepa=
rate a regular operating system


   from security- sensitive application=
s.


 


   This architecture document motivates=
 the design and standardization


   of a protocol for managing the lifec=
yle of trusted applications


   running inside a TEE.


 


 


The IETF datatracker status page for this draft i=
s:


https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatr=
acker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&amp;data=3D02%7C=
01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf8=
6f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&amp;sdata=3DXBuTls=
iV5OjkxkcqULdsmroTnWRZqApH3fBokJGvkTE%3D&amp;reserved=3D0


 


There are also htmlized versions available at:


htt=
ps://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools.ietf.=
org%2Fhtml%2Fdraft-ietf-teep-architecture-00&amp;data=3D02%7C01%7Cdthal=
er%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91a=
b2d7cd011db47%7C1%7C0%7C636664171223541902&amp;sdata=3DheO1xlxfrVZyyzYz=
iQy8V2P0vxiEbTVSF8sFdNaw8sc%3D&amp;reserved=3D0

https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F=
%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&=
amp;data=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0=
c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&am=
p;sdata=3DaoKW%2FFnlzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&amp;reserved=
=3D0


 


 


Please note that it may take a couple of minutes =
from the time of submission until the htmlized version and diff are availab=
le at tools.ietf.org.


 


Internet-Drafts are also available by anonymous F=
TP at:


<=
span style=3D"color:windowtext;text-decoration:none">ftp://ftp.ietf.org/int=
ernet-drafts/


 


_______________________________________________


TEEP mailing list


TEEP@ietf.org

https://na01.safel=
inks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2Fl=
istinfo%2Fteep&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856b=
a6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664=
171223541902&amp;sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okIPShXtd0%3D=
&amp;reserved=3D0


 


_______________________________________________


TEEP mailing list


TEEP@ietf.org

https://na01.safel=
inks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2Fl=
istinfo%2Fteep&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856b=
a6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664=
171223541902&amp;sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okIPShXtd0%3D=
&amp;reserved=3D0


IMPORTANT NOTICE: The contents of this email and =
any attachments are confidential and may also be privileged. If you are not=
 the intended recipient, please notify the sender immediately and do not di=
sclose the contents to any other person,
 use it for any purpose, or store or copy the information in any medium. Th=
ank you.


 


_______________________________________________


TEEP mailing list


TEEP@ietf.org

https://na01.safel=
inks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2Fl=
istinfo%2Fteep&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856b=
a6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664=
171223541902&amp;sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okIPShXtd0%3D=
&amp;reserved=3D0


 


_______________________________________________


TEEP mailing list


TEEP@ietf.org

https://www.iet=
f.org/mailman/listinfo/teep
--_000_HE1PR06MB3147C0F424CE98CA7F3AE12795470HE1PR06MB3147eurp_-- From nobody Fri Jul 6 04:21:55 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E632130F8D for ; Fri, 6 Jul 2018 04:21:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.09 X-Spam-Level: X-Spam-Status: No, score=0.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WXMvx2jyCxIZ for ; Fri, 6 Jul 2018 04:21:41 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40070.outbound.protection.outlook.com [40.107.4.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A564130FED for ; Fri, 6 Jul 2018 04:21:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iweObZD4td4rnLH3I4Lv+NiWDzrbbHnz22+w/BsQAuw=; b=GLE6JKogqcEFOxtb387WvmXSBJJkFDnTPnCqJIuzOM7tXF/IXBPmwGLY5MSljRbvQ+igliNfGsTFdeIHQlVnmZKVRljQjTQRrjmtN6OG3WT+e0YGhccnnxWVYCsHdvwDM1pzuGxVv9a9oB40bfbxj5KiAQTdMF6873aTCTXwx9c= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB1885.eurprd08.prod.outlook.com (10.173.73.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.930.19; Fri, 6 Jul 2018 11:21:32 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db%10]) with mapi id 15.20.0906.026; Fri, 6 Jul 2018 11:21:32 +0000 From: Hannes Tschofenig To: Andrew Atyeo , Dave Thaler , "Wheeler, David M" , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrwAABlbQAAAV1OEAAYPB0QAAbQUgA= Date: Fri, 6 Jul 2018 11:21:32 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [83.175.123.202] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB1885; 7:SSJ6CMp2RGw2Yk0W3fVGju7GPK6vJT5UgWQjdv0jq2Ew2itcekIOQXUyIbngx1SUu8pdWMXAoyLaSn5PrYJPuDBL8MUN9SdTDeNEYZXMXK5rEW9f/4kG+0VMxUsDye3i1wpXcz45w0Elbo+vJOxmm0Xa9mIqYm/oXz6HRo0ogVj7yFUsTEkfa3XHqb4LIO4J0iry2YQgVQnQZOVio4Q9aXmLC2vj7Q5jpzJ+3GfTOASiHdFgo3A/lpYYBRbadK50 x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 4665baf9-333e-449a-5bd0-08d5e332a0c8 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:(223705240517415); BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB1885; x-ms-traffictypediagnostic: VI1PR0801MB1885: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(180628864354917)(278428928389397)(192374486261705)(189930954265078)(223705240517415)(219752817060721)(21748063052155)(211171220733660)(228905959029699); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(10201501046)(3002001)(3231254)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123562045)(20161123558120)(20161123564045)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB1885; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB1885; x-forefront-prvs: 0725D9E8D0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(396003)(366004)(39860400002)(136003)(376002)(40434004)(189003)(199004)(13464003)(26005)(74316002)(7736002)(186003)(54896002)(6306002)(9686003)(55016002)(66066001)(236005)(6436002)(102836004)(6506007)(53546011)(7696005)(76176011)(33656002)(2900100001)(229853002)(72206003)(105586002)(966005)(256004)(478600001)(14444005)(5024004)(2906002)(97736004)(14454004)(106356001)(8936002)(93886005)(5660300001)(81166006)(81156014)(8676002)(6246003)(53946003)(45080400002)(606006)(53936002)(25786009)(446003)(575784001)(86362001)(99286004)(11346002)(2501003)(110136005)(68736007)(316002)(790700001)(5250100002)(6116002)(476003)(3846002)(486006); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB1885; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: RybtmB/jEdQ+SD7B0qKNzUZym487TvaS1E0kg/iWS4ApQB2pirkCHsezOU6LGSs/z9Rv1T0Ec8m3WWT1twU+yc8dNV8zwRMyXm/TsTLg7IGgX+yL6NF3SqbKFZN+lSufWVtSjeL3HS2D48at0rSK2aiG+yFco5pkaTTsJDSRhuKAgxAEXes9OeVYZK97633qRxEsjjNfeTVhTUStFTXxFNPoQUvMZjTJi7gMl0mIVqjSMtJHK+uQ+9+99X997fuYQbRwECg1bU5RIVyLQ0lUQs1bcQMnacz6VjLFd3/GKtm/1Rr2oo6NSLsbHu7bP68zulVbnd91qlc2StuGuOgRf73QM9RZdz+yW2Db5L+9lJU= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_VI1PR0801MB2112AD0899D6B23E0942E927FA470VI1PR0801MB2112_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4665baf9-333e-449a-5bd0-08d5e332a0c8 X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2018 11:21:32.6416 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1885 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 11:21:55 -0000 --_000_VI1PR0801MB2112AD0899D6B23E0942E927FA470VI1PR0801MB2112_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The problem is only that "root of trust" is not a well defined term in the = IETF, at least as far as I know. Trust anchor, on the other hand, is well d= efined. The definition currently in the document for root of trust seems to be simi= lar to trust anchor. However, I agree with both Andy and with David that we= need to find out whether we want to point out certain usages of the key (s= uch as for the purpose of the attestation). Whether this justifies the intr= oduction of another term is yet another discussion Ciao Hannes From: Andrew Atyeo [mailto:Andrew.Atyeo@intercede.com] Sent: 06 July 2018 10:38 To: Dave Thaler; Wheeler, David M; Hannes Tschofenig; teep@ietf.org Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt In OTrP, I believe "root of trust" and "trust anchor" are currently referri= ng to 2 different things in the OTrP spec. * Root of trust Excerpt from OTrP: "This specification assumes that an applicable device is= equipped with a TEE and is pre-provisioned with a device-unique public/private key pair, which is securely stored. This key pair is referred as the 'root of trust'. An entity that uses such a device to run Trusted Applications (TAs) is known as a Service Provider (SP)." Here, "Root of Trust" must be talking about either the TEE/TFW private key,= so "root of trust" is referring to the process of secure boot that results= in a TAM being able to use a signature from this key to know whether to tr= ust the TEE * Trust Anchor There is a problem this refers to 2 completely different concepts: "Setup trust anchors in devices 1. [TFW/TEE] Store the key and certificate encrypted with the eFuse key 2. [TEE vendor or OEM] Store trusted CA certificate list into devices" Here, "Trust Anchor" is referring to both the TFW private key and the TAM C= A root certificate store BUT later on in the spec: "The root CA certificates for a TAM, which are embedded into the trust anchor store in a device, should have long lifetimes that don't require device trust anchor update." And "Trust Anchor: A root certificate that can be used to validate its children certificates. It is usually embedded in a device or configured by a TAM for validating the trust of a remote entity's certificate." Here, "Trust Anchor" refers to the TAM root CA whitelist that is embedded i= n the TEE in order to allow the TEE to chain TAM certificates to the root C= A certs (to determine what certs to trust) ...So it is best if we can remove the term "trust anchor" wherever it refer= s to the concept of root CA certs, and refer to "TAM root CA certificate st= ore" (or something like that) , and for everywhere else that uses "trust anchor" to refer to the concept = of secureboot/attestation etc, we need to settle on some other term. In som= e cases e.g. "pair, which is securely stored in the TEE. This key pair is referred = to as the 'root of trust'." we can simply refer to the TFW key (since in places 'root of trust' is used= to describe the TFW key). Andrew Atyeo Security Architect Intercede Digital trust people | devices | apps Office: +44 (0) 1455 558 111 www.intercede.com -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Dave Thaler Sent: 05 July 2018 21:36 To: Wheeler, David M ; Hannes Tschofenig ; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt [speaking as an individual] As David says, there's more than one type of "Root-of-Trust" aka "trust anc= hor". There are industry terms of art for the different types. One example article that gives a decent summary is https://healthitsecurity= .com/news/nist-roots-of-trust-for-healthcare-mobile-devices In particular, the industry terms (from NIST SP 800-164, potentially among = others) are: Roof of Trust for Storage (RTS) Root of Trust for Verification (RTV) Root of Trust for Integrity (RTI) Root of Trust for Reporting (RTR) Root of Trust for Measurement (RTM) I would recommend using the above terms and not using "trust anchor" or the= unqualified "root of trust" term. Dave -----Original Message----- From: TEEP > On Behalf = Of Wheeler, David M Sent: Thursday, July 5, 2018 12:52 PM To: Hannes Tschofenig >; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Hannes, If that is the case (trust root and trust anchors are the same), then I hav= e a concern regarding crypto separation. In one definition the Trust Anchor signs certificates, in the other definit= ion a Root-of-Trust signs attestations. If these are in fact the same key, then they are being used for two differe= nt functions, which is not recommended for cryptographic keys. Further, it seems to me (though I may be misunderstanding the intended func= tion), the private key of the Trust Anchor resides outside the device, in a= separate entity, like a CA or a TAM. However, the private key of a Root-of-Trust resides in the TEE (or is acces= sible only to the TEE). Can you pick apart my understanding of the two definitions of keys, and hel= p me understand where I got thrown off? Thanks, Dave Wheeler -----Original Message----- From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com] Sent: Thursday, July 5, 2018 12:41 PM To: Wheeler, David M >; teep@ietf.org Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Just a quick remark: IMHO root of trust and trust anchor are the same thing= . I believe we should update the text to only talk about trust anchors and = forget the root of trust terminology. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M Sent: 05 July 2018 21:38 To: teep@ietf.org Subject: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt I have several comments on the new architecture draft. The first comment has to do with the definition of the "Trust Anchor" (page= 4) The definition states: Trust Anchor: A root certificate that can be used to validate its certificates. It is usually embedded in a devic= e or configured by a TAM for validating the trust of= a remote entity's certificate. Then later in section 3 (page 6) This specification assumes that an applicable device is equipped with one = or more TEEs and each TEE is pre-provisioned with a device-unique public/p= rivate key pair, which is securely stored. This key pair is referred to as= the 'root of trust' for remote attestation of the associated TEE in a dev= ice by an TAM. It is not clear whether the "Trust Anchor" is the same as the "root-of-trus= t" key pair, since the "root-of-trust" is not included in the definitions. If they are intended to be different (which is what I believe), then I sugg= est we add the "root-of-trust" to the definitions, and explain the differen= ce. Oftentimes, in my experience, these terms are used interchangeably. Here is my attempt to create definitions for these two types of keys: Trust Anchor: A trust anchor is public asymmetric key, preferably contained= in a certificate that represents a trusted entity to a device. T= his public key may be used by the holder of the corresponding private key to = sign other certificates, thereby communicating the signed certificate ma= y also be trusted. The trust anchor is usually embedded in a devic= e or configured by a TAM and used by the device to validate the trust o= f a remote entity by verifying that entity's certificate is signed b= y a trust anchor. Trust anchors must be stored in a way that pre= vents or strongly resists modification by unauthorized software and hard= ware adversaries. An example of a trust anchor is the public key of a TAM or SP whi= ch is "pinned" or securely stored inside the device, an= d that trust anchor is used like a CA certificate to validate the trust in = other keys/certificates. A trust anchor may be viewed by both trusted and= untrusted entities on the device, But may only be modified or deleted by a trusted = entity. Root-of-Trust Key: A device-unique key generated at device manufacturing o= r at TEE provisioning, which is securely stored and = only accessible to the TEE. The Root-of-Trust Key is used for attestation s= igning which proves the signed message originated or was approved by the TEE, = and may be trusted to the same degree as the TEE. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatrac= ker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=3D02%7C01%7Cd= thaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141a= f91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DXBuTlsiV5Ojkxkcq= ULdsmroTnWRZqApH3fBokJGvkTE%3D&reserved=3D0 There are also htmlized versions available at: https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools.ie= tf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7C01%7Cdthale= r%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab= 2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DheO1xlxfrVZyyzYziQy8V= 2P0vxiEbTVSF8sFdNaw8sc%3D&reserved=3D0 https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatrac= ker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7= C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf= 86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DaoKW%2FFn= lzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&reserved=3D0 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. --_000_VI1PR0801MB2112AD0899D6B23E0942E927FA470VI1PR0801MB2112_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

The problem is only th= at “root of trust” is not a well defined term in the IETF, at l= east as far as I know. Trust anchor, on the other hand, is well defined.

The definition current= ly in the document for root of trust seems to be similar to trust anchor. H= owever, I agree with both Andy and with David that we need to find out whet= her we want to point out certain usages of the key (such as for the purpose of the attestation). Whether this just= ifies the introduction of another term is yet another discussion

 

Ciao=

Hannes

 

 

From:= Andrew Atyeo [mailto:Andrew.Atyeo@intercede.com]
Sent: 06 July 2018 10:38
To: Dave Thaler; Wheeler, David M; Hannes Tschofenig; teep@ietf.org<= br> Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architec= ture-00.txt

 

In OTrP, I believe "root of trust" and = "trust anchor" are currently referring to 2 different things in t= he OTrP spec.

 

= · &nbs= p;       Root of trust

Excerpt from OTrP: “This specificati=
on assumes that an applicable device is equipped with

&=
nbsp;  a TEE and is pre-provisioned with a device-unique public/privat=
e key


&=
nbsp;  pair, which is securely stored.  This key pair is referred=
 as the


&=
nbsp;  'root of trust'.  An entity that uses such a device to run=
 Trusted


&=
nbsp;  Applications (TAs) is known as a Service Provider (SP).&=
#8221;


Here, “Root of Trust” must be talking=
 about either the TEE/TFW private key, so “root of trust” is re=
ferring to the process of secure boot that results in a TAM being able to u=
se a signature from this key to know whether to trust the
 TEE


 


=
· &nbs=
p;      
Trust Anchor


There is a problem this refers to 2 completely di=
fferent concepts:


“Setup trust anchors in devices=



 


   1.  [TFW/TEE] Store the =
key and certificate encrypted with the eFuse


       key


 


   2.  [TEE vendor or OEM] =
Store trusted CA certificate list into


       devic=
es”


Here, “Trust Anchor” is referring to =
both the TFW private key and the TAM CA root certificate store

 


BUT later on in the spec:


“The root CA certificates for a TAM, which are <=
o:p>


embedded into the trust anchor store in a device, shou=
ld have long



lifetimes that don't require device trust anchor =
update.”


And


“Trust Anchor: A root certificate that can be used to=
 validate its



children certificates. It is usually embedded in a device or



configured by a TAM for validating the trust of a remote entity's



certificate.”=



Here, “Trust Anchor” refers to the TA=
M root CA whitelist that is embedded in the TEE in order to allow the TEE t=
o chain TAM certificates to the root CA certs (to determine what certs to t=
rust)


 


…So it is best if we can remove the term &#=
8220;trust anchor” wherever it refers to the concept of root CA certs=
, and refer to “TAM root CA certificate store” (or something li=
ke that)


, and for everywhere else that uses “trust =
anchor” to refer to the concept of secureboot/attestation etc, we nee=
d to settle on some other term. In some cases



e.g. “pair, which is securely stored =
in the TEE. This key pair is referred to as the 'root of trust'.”


we can simply refer to the TFW key (since in plac=
es ‘root of trust’ is used to describe the TFW key).



 


 


Andrew Atyeo 


Security Architect


 


Intercede


Digital trust    people | devices =
| apps


 


Office: +44 (0) 1455 558 111


www.intercede.com


-----Original Message-----

From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Dave Thaler

Sent: 05 July 2018 21:36

To: Wheeler, David M <david.m.wheeler@intel.com>; Hannes Tschofenig &=
lt;Hannes.Tschofenig@arm.com>; teep@ietf.org

Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00=
.txt


 


[speaking as an individual]


 


As David says, there's more than one type of &quo=
t;Root-of-Trust" aka "trust anchor".



There are industry terms of art for the different=
 types.


One example article that gives a decent summary i=
s 
https://healthitsecur=
ity.com/news/nist-roots-of-trust-for-healthcare-mobile-devices


 


In particular, the industry terms (from NIST SP 8=
00-164, potentially among others) are:


Roof of Trust for Storage (RTS)


Root of Trust for Verification (RTV)

Root of Trust for Integrity (RTI)


Root of Trust for Reporting (RTR)


Root of Trust for Measurement (RTM)

 


I would recommend using the above terms and not u=
sing "trust anchor" or the unqualified "root of trust" =
term.


 


Dave


 


-----Original Message-----


From: TEEP <teep-bounces@i=
etf.org> On Behalf Of Wheeler, David M


Sent: Thursday, July 5, 2018 12:52 PM<=
/p>

To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>;
teep@ietf.org


Subject: Re: [Teep] Comments on I-D Action: draft=
-ietf-teep-architecture-00.txt


 


Hannes,


If that is the case (trust root and trust anchors=
 are the same), then I have a concern regarding crypto separation.


In one definition the Trust Anchor signs certific=
ates, in the other definition a Root-of-Trust signs attestations.


If these are in fact the same key, then they are =
being used for two different functions, which is not recommended for crypto=
graphic keys.


 


Further, it seems to me (though I may be misunder=
standing the intended function), the private key of the Trust Anchor reside=
s outside the device, in a separate entity, like a CA or a TAM.<=
/p>

However, the private key of a Root-of-Trust resid=
es in the TEE (or is accessible only to the TEE).


 


Can you pick apart my understanding of the two de=
finitions of keys, and help me understand where I got thrown off?


 


Thanks,


Dave Wheeler 


 


-----Original Message-----


From: Hannes Tschofenig [=
mailto:Hannes.Tschofenig@arm.com]



Sent: Thursday, July 5, 2018 12:41 PM<=
/p>

To: Wheeler, David M <=
david.m.wheeler@intel.com>;
teep@ietf.org


Subject: RE: [Teep] Comments on I-D Action: draft=
-ietf-teep-architecture-00.txt


 


Just a quick remark: IMHO root of trust and trust=
 anchor are the same thing. I believe we should update the text to only tal=
k about trust anchors and forget the root of trust terminology.<=
/p>

 


 


-----Original Message-----


From: TEEP [mailto:teep-bounc=
es@ietf.org] On Behalf Of Wheeler, David M


Sent: 05 July 2018 21:38


To: teep@ietf.org


Subject: [Teep] Comments on I-D Action: draft-iet=
f-teep-architecture-00.txt


 


I have several comments on the new architecture d=
raft.


 


The first comment has to do with the definition o=
f the "Trust Anchor" (page 4)


 


The definition states:


Trust Anchor: A root certificate that can be used=
 to validate its


        &=
nbsp;           &nbs=
p;       certificates. It is usually embedded=
 in a device or


        &=
nbsp;            &nb=
sp;      configured by a TAM for validating t=
he trust of a remote entity's


        &=
nbsp;           &nbs=
p;       certificate.


 


Then later in section 3 (page 6)


This specification assumes that an applicable dev=
ice is equipped with  one or more TEEs and each TEE is pre-provisioned=
 with a device-unique  public/private key pair, which is securely stor=
ed. This key pair is  referred to as the 'root
 of trust' for remote attestation of the  associated TEE in a device b=
y an TAM.


 


 


It is not clear whether the "Trust Anchor&qu=
ot; is the same as the "root-of-trust" key pair, since the "=
root-of-trust" is not included in the definitions.


 


If they are intended to be different (which is wh=
at I believe), then I suggest we add the "root-of-trust" to the d=
efinitions, and explain the difference. Oftentimes, in my experience, these=
 terms are used interchangeably.


 


Here is my attempt to create definitions for thes=
e two types of keys:


 


Trust Anchor: A trust anchor is public asymmetric=
 key, preferably contained in a certificate


        &=
nbsp;            &nb=
sp;      that represents a trusted entity to =
a device. This public key may be used by


        &=
nbsp;           &nbs=
p;       the holder of the corresponding priv=
ate key to sign other certificates,


        &=
nbsp;           &nbs=
p;       thereby communicating the signed cer=
tificate may also be trusted.


        &=
nbsp;           &nbs=
p;       The trust anchor is usually embedded=
 in a device or configured by a TAM


        &=
nbsp;           &nbs=
p;        and used by the device to vali=
date the trust of a remote entity by


        &=
nbsp;           &nbs=
p;       verifying that entity's certificate =
is signed by a trust anchor.


        &=
nbsp;           &nbs=
p;        Trust anchors must be stored i=
n a way that prevents or strongly resists


        &=
nbsp;           &nbs=
p;        modification by unauthorized s=
oftware and hardware adversaries.


        &=
nbsp; An example of a trust anchor is the public key of a TAM or SP which i=
s


        &=
nbsp;           &nbs=
p;     "pinned" or securely stored inside the=
 device, and that trust anchor is used


        &=
nbsp;           &nbs=
p;       like a CA certificate to validate th=
e trust in other keys/certificates.


        &=
nbsp;           &nbs=
p;      A trust anchor may be viewed by both trust=
ed and untrusted entities on the device,


        &=
nbsp;           &nbs=
p;     But may only be modified or deleted by a trusted=
 entity.


 


Root-of-Trust Key:  A device-unique key gene=
rated at device manufacturing or at


        &=
nbsp;           &nbs=
p;       TEE provisioning, which is securely =
stored and only accessible to the TEE.


        &=
nbsp;           &nbs=
p;       The Root-of-Trust Key is used for at=
testation signing which proves the signed


        &=
nbsp;           &nbs=
p;       message originated or was approved b=
y the TEE, and may be trusted to the same


        &=
nbsp;           &nbs=
p;      degree as the TEE.


 


-----Original Message-----


From: TEEP [mailto:teep-bounc=
es@ietf.org] On Behalf Of
internet-drafts@ietf.org


Sent: Wednesday, July 4, 2018 7:49 AM<=
/p>

To: i-d-announce@ietf.org


Cc: teep@ietf.org


Subject: [Teep] I-D Action: draft-ietf-teep-archi=
tecture-00.txt


 


 


A New Internet-Draft is available from the on-lin=
e Internet-Drafts directories.


This draft is a work item of the Trusted Executio=
n Environment Provisioning WG of the IETF.


 


        Title&=
nbsp;          : Trusted Execu=
tion Environment Provisioning (TEEP) Architecture


        Author=
s         : Mingliang Pei


        &=
nbsp;           &nbs=
p;     Hannes Tschofenig


        &=
nbsp;           &nbs=
p;     Andrew Atyeo


        &=
nbsp;           &nbs=
p;     Dapeng


Filename       =
; : draft-ietf-teep-architecture-00.txt


Pages       &n=
bsp;   : 24


Date       &nb=
sp;    : 2018-07-02


 


Abstract:


   A Trusted Execution Environment (TEE=
) was designed to provide a


   hardware-isolation mechanism to sepa=
rate a regular operating system


   from security- sensitive application=
s.


 


   This architecture document motivates=
 the design and standardization


   of a protocol for managing the lifec=
yle of trusted applications


   running inside a TEE.


 


 


The IETF datatracker status page for this draft i=
s:


https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatr=
acker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&amp;data=3D02%7C=
01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf8=
6f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&amp;sdata=3DXBuTls=
iV5OjkxkcqULdsmroTnWRZqApH3fBokJGvkTE%3D&amp;reserved=3D0


 


There are also htmlized versions available at:


htt=
ps://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools.ietf.=
org%2Fhtml%2Fdraft-ietf-teep-architecture-00&amp;data=3D02%7C01%7Cdthal=
er%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91a=
b2d7cd011db47%7C1%7C0%7C636664171223541902&amp;sdata=3DheO1xlxfrVZyyzYz=
iQy8V2P0vxiEbTVSF8sFdNaw8sc%3D&amp;reserved=3D0

https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F=
%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&=
amp;data=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0=
c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&am=
p;sdata=3DaoKW%2FFnlzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&amp;reserved=
=3D0


 


 


Please note that it may take a couple of minutes =
from the time of submission until the htmlized version and diff are availab=
le at tools.ietf.org.


 


Internet-Drafts are also available by anonymous F=
TP at:


<=
span style=3D"color:windowtext;text-decoration:none">ftp://ftp.ietf.org/int=
ernet-drafts/


 


_______________________________________________


TEEP mailing list


TEEP@ietf.org

https://na01.safel=
inks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2Fl=
istinfo%2Fteep&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856b=
a6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664=
171223541902&amp;sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okIPShXtd0%3D=
&amp;reserved=3D0


 


_______________________________________________


TEEP mailing list


TEEP@ietf.org

https://na01.safel=
inks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2Fl=
istinfo%2Fteep&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856b=
a6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664=
171223541902&amp;sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okIPShXtd0%3D=
&amp;reserved=3D0


IMPORTANT NOTICE: The contents of this email and =
any attachments are confidential and may also be privileged. If you are not=
 the intended recipient, please notify the sender immediately and do not di=
sclose the contents to any other person,
 use it for any purpose, or store or copy the information in any medium. Th=
ank you.


 


_______________________________________________


TEEP mailing list


TEEP@ietf.org

https://na01.safel=
inks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2Fl=
istinfo%2Fteep&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856b=
a6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664=
171223541902&amp;sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okIPShXtd0%3D=
&amp;reserved=3D0


 


_______________________________________________


TEEP mailing list


TEEP@ietf.org

https://www.iet=
f.org/mailman/listinfo/teep
IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you. --_000_VI1PR0801MB2112AD0899D6B23E0942E927FA470VI1PR0801MB2112_-- From nobody Fri Jul 6 04:35:42 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2F2B130EB3 for ; Fri, 6 Jul 2018 04:35:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f12nK79ZSl5s for ; Fri, 6 Jul 2018 04:35:38 -0700 (PDT) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30071.outbound.protection.outlook.com [40.107.3.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA032130EAA for ; Fri, 6 Jul 2018 04:35:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0i8QGIBQMgG1TBjPcN+IXnObuPkHxWoOtTir2X0/ZBE=; b=TYpC7UzZqJRVAwdxX072+vZKQ0GD32S/dRgr4uGIiOQO1g0JgB76V4VqueD12d18SVUDfAjjDdOh1mWklwbjatVCKCCuOEkjVhGIfa1aTXnS2qCtO6CEfnuM5+mP3EJeyWu4/5x4EoZesZkthsYlcNgY4XPrbgajaYP4cUdK3LM= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB1933.eurprd08.prod.outlook.com (10.173.73.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.930.19; Fri, 6 Jul 2018 11:35:34 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db%10]) with mapi id 15.20.0906.026; Fri, 6 Jul 2018 11:35:34 +0000 From: Hannes Tschofenig To: Anders Rundgren , "Wheeler, David M" , "teep@ietf.org" Thread-Topic: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrwAABlbQAAEwT0gAAB0RiQAACogYAAAJzPAAACy6gAAAfpeYA= Date: Fri, 6 Jul 2018 11:35:34 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> <19fdc505-f0f1-ae9f-4fec-0605c7ee3690@gmail.com> In-Reply-To: <19fdc505-f0f1-ae9f-4fec-0605c7ee3690@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [83.175.123.202] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB1933; 7:ZynlzRbUe9Cnojnyqb89XU43xd63D56Z4Sy45Lbwn9ECi5avK1TehqUORJ6+AYW8HVBQk7T2sBCUJDvl5xLMR/b3ODaqb3e7AAwfADMprOQsVJ3i0ZCGNkfwWJeEMcWZuo9eL575SyAnqqdwCYCypSRAHTr3bgl4jHb9hxtrpp4Z90SY9YLo3T3teBZPpHt5ahAmk81RGs3rpzjDZ9dkpsNF+6u4NsaT4KbP/gGa0wuG7A9KAOMOLf2X3LZG6dLQ x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 2eab50a8-a55f-4e17-cee8-08d5e3349662 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:(223705240517415); BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(48565401081)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB1933; x-ms-traffictypediagnostic: VI1PR0801MB1933: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(223705240517415)(85827821059158); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(10201501046)(3002001)(93006095)(93001095)(3231254)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123560045)(20161123564045)(20161123558120)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB1933; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB1933; x-forefront-prvs: 0725D9E8D0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(366004)(376002)(39850400004)(396003)(136003)(13464003)(199004)(189003)(40434004)(6436002)(7736002)(8936002)(476003)(486006)(229853002)(74316002)(9686003)(53546011)(76176011)(2900100001)(26005)(256004)(33656002)(14444005)(55016002)(186003)(305945005)(66066001)(2906002)(7696005)(102836004)(5024004)(53936002)(86362001)(68736007)(25786009)(6246003)(99286004)(5660300001)(6506007)(39060400002)(3846002)(2501003)(446003)(8676002)(93886005)(106356001)(81156014)(478600001)(6116002)(14454004)(81166006)(110136005)(5250100002)(551544002)(72206003)(105586002)(97736004)(316002)(11346002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB1933; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: NgJDMbPxOuoiPn6jN4zFJ3Y/049BqF7sFd21eBtEz0vYJSTcHRHlsQoqaZFhR6uayfF/lcR8aaVob31SeLAlHrxk+AiazZCAguhArod7/xWs21plXA15BHK/KuJdGrx5RnfG0dQg/HsOXgL12S76feIgAOaQkOpEAaGriThf2VJAyKxbLsTTYpFiHnoc6BFkKllnwlzT3TygdO8fWg6CUE+cw0hJ82v/bOkClmGVG6WMQk3sL0PlDJUhFdGT5nnXnjW/sS5pJqY8QZg23WP8/dAFo4PCnPcCAO3cLaO9nAhsMFMuA1eQ80Biw3gIF9Rm0fIb57lQRtc2OucRAKxtUVmD8AX4yWtYKE1J52Dr9uk= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2eab50a8-a55f-4e17-cee8-08d5e3349662 X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2018 11:35:34.2614 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1933 Archived-At: Subject: Re: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 11:35:41 -0000 SGkgQW5kZXJzLA0KDQpNb3N0IGxpa2VseSBpdCB3b3VsZCBtYWtlIG1vcmUgc2Vuc2UgdG8gdXNl IHRoZSBGSURPIEF1dGhlbnRpY2F0b3IgaW4gdGhlIFRFRSBvZiB0aGUgcGhvbmUgcmF0aGVyIHRo YW4gY29ubmVjdGVkIHRvIGFuIGV4dGVybmFsIGRldmljZS4gVXNpbmcgYW5vdGhlciBkZXZpY2Us IHN1Y2ggYXMgYSB3YXRjaCB2aWEgQkxFLCBtYXkgYmUgcG9zc2libGUgYnV0IGl0IGlzIHByb2Jh Ymx5IG5vdCB0aGUgbW9zdCBjb21tb24gYXBwcm9hY2guIChJbiBmYWN0IEkgaGF2ZSBhY3R1YWxs eSBjb250cmlidXRlZCB0byB0aGUgRklETyBzcGVjaWZpY2F0aW9uIHRoYXQgb2ZmZXJzIHRoYXQg ZnVuY3Rpb25hbGl0eS4pDQoNClRoZXJlIGlzIGEgbG90IG9mICJlZHVjYXRpbmciIGdvaW5nIG9u IGFzIHBhcnQgb2YgdGhlIEZJRE8gcHVibGljIHBvbGljeSBhbmQgcHJpdmFjeSBwcm9ncmFtLCB3 aGljaCBJIGhhZCB0aGUgcGxlYXN1cmUgdG8gY28tY2hhaXIgZm9yIHNvbWUgdGltZS4NCg0KWW91 IGFyZSBjb3JyZWN0IHRoYXQgRklETyBoYXMgbm90IGJlZW4gZGVzaWduZWQgd2l0aCB0aGUgY2xh c3NpY2FsIGNsaWVudC1zaWRlIFBLSSBpbiBtaW5kLiBJTUhPIHRoYXQncyBhIGdvb2QgdGhpbmcu DQoNCkZvciB3aGF0IG1hdHRlcnMgd2l0aCByZWdhcmRzIHRvIFRFRVAgaXMgd2hldGhlciB3ZSBj YW4gZ2V0IGEgc3RhbmRhcmRpemVkIG1lY2hhbmlzbSBkZWZpbmVkIHRoYXQgYWxsb3dzIHVzIHRv IGVuYWJsZSBlYXNpZXIgZGVwbG95bWVudHMgbGlrZSB0aGUgb25jZSBkZXNjcmliZWQgYWJvdmUu IFRvZGF5LCB0aGlzIGlzIHJhdGhlciBjaGFsbGVuZ2luZyBzaW5jZSBpdCBpcyB0b3VnaCB0byBn ZXQgdGhlIG5lY2Vzc2FyeSBGSURPIEF1dGhlbnRpY2F0b3IgY29kZSBvbiBwaG9uZXMgYW5kIHRh YmxldHMuDQoNCkNpYW8NCkhhbm5lcw0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJv bTogQW5kZXJzIFJ1bmRncmVuIFttYWlsdG86YW5kZXJzLnJ1bmRncmVuLm5ldEBnbWFpbC5jb21d DQpTZW50OiAwNiBKdWx5IDIwMTggMDk6NDUNClRvOiBIYW5uZXMgVHNjaG9mZW5pZzsgV2hlZWxl ciwgRGF2aWQgTTsgdGVlcEBpZXRmLm9yZw0KU3ViamVjdDogUmU6IE9PQiBJc3N1ZXMuIFdhczog W1RlZXBdIENvbW1lbnRzIG9uIEktRCBBY3Rpb246IGRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1 cmUtMDAudHh0DQoNCk9uIDIwMTgtMDctMDYgMDg6MjYsIEhhbm5lcyBUc2Nob2ZlbmlnIHdyb3Rl Og0KPiBIaSBBbmRlcnMsDQoNCkhpIEhhbm5lcywNCg0KPiBJbiB0aGlzIHNwZWNpZmljIGV4YW1w bGUgSSBoYXZlIHRvIGFkbWl0IHRoYXQgSSBoYXZlIGEgYmlhcyB0b3dhcmRzIEZJRE8uIEluIHRo aXMgc2V0dXAgRklETyB3b3VsZG4ndCBuZWVkIGFuIG91dC1vZi1iYW5kIGNoYW5uZWwuDQoNCkkg YXNzdW1lIHlvdSBtZWFuIHRoYXQgdGhlIHBob25lIHdvdWxkIGJlIGVxdWlwcGVkIHdpdGggYSBG SURPIGF1dGhlbnRpY2F0b3IgYW5kIHRoZW4gY29ubmVjdGVkIHRvIHRoZSBQQyB0aG91Z2ggQkxF IChvciB3b3JzdC1jYXNlIHRocm91Z2ggYSBjYWJsZSksIHJpZ2h0Pw0KDQpUaGlzIG9idmlvdXNs eSB3b3JrcyBidXQgaXMgaW5jb21wYXRpYmxlIHdpdGggY2xpZW50IHNpZGUgUEtJIGFzIHdlbGwg YXMgb3RoZXIgc2NoZW1lcyB0aGF0IGRvIG5vdCBoYXZlIGEgbmF0dXJhbCB0aWUgdG8gRklETy4N Cg0KU2luY2UgdGhpcyBjZXJ0YWlubHkgaXNuJ3QgImNvbW1vbiBrbm93bGVkZ2UiLCB0aGUgbW9z dCByZWFzb25hYmxlIHdvdWxkIGJlIHRoYXQgdGhvc2Ugd2hvIHJlcHJlc2VudCB0aGUgcGxhdGZv cm0gdmVuZG9ycyAoQVJNLCBJbnRlbCwgTVNGVCkgZXhwbGFpbmVkIHRvIGdvdmVybm1lbnRzIGFu ZCBiYW5rcyB0aGF0IHRoZXkgc2hvdWxkIGNhcmVmdWxseSByZWV4YW1pbmUgdGhlaXIgZGVzaWdu IGNob2ljZXMgZm9yIHRoZSBmdXR1cmUuDQoNCkZXSVcsIEknbSBwZXJzb25hbGx5IGludGVyZXN0 ZWQgaW4gY3JlYXRpbmcgbW9yZSAibmV1dHJhbCIgc2VjdXJpdHkgdGVjaG5vbG9neSwgaW5jbHVk aW5nIGFkZHJlc3NpbmcgT09CIGNoYW5uZWwgYXV0aGVudGljYXRpb24gYmV5b25kIHdoYXQgdGhl IGN1cnJlbnQgc3RhbmRhcmQgKFFSKSBvZmZlcnMgKD16ZXJvKS4NCg0KQ2hlZXJzLA0KQW5kZXJz DQoNCg0KPiBUaGUgVEVFIHdvdWxkIGhlbHBmdWwgYW5kIE9UclAgY291bGQgYmUgdXNlZCB0byBk aXN0cmlidXRlIHRoZSBGSURPIEF1dGhlbnRpY2F0b3IgY29kZSB0byBwaG9uZXMgYW5kIHRhYmxl dHMuDQo+DQo+IENpYW8NCj4gSGFubmVzDQo+DQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0t DQo+IEZyb206IEFuZGVycyBSdW5kZ3JlbiBbbWFpbHRvOmFuZGVycy5ydW5kZ3Jlbi5uZXRAZ21h aWwuY29tXQ0KPiBTZW50OiAwNiBKdWx5IDIwMTggMDg6MDcNCj4gVG86IEhhbm5lcyBUc2Nob2Zl bmlnOyBXaGVlbGVyLCBEYXZpZCBNOyB0ZWVwQGlldGYub3JnDQo+IFN1YmplY3Q6IFJlOiBPT0Ig SXNzdWVzLiBXYXM6IFtUZWVwXSBDb21tZW50cyBvbiBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLXRl ZXAtYXJjaGl0ZWN0dXJlLTAwLnR4dA0KPg0KPiBPbiAyMDE4LTA3LTA2IDA3OjUwLCBIYW5uZXMg VHNjaG9mZW5pZyB3cm90ZToNCj4+IEhpIEFuZGVycywNCj4NCj4gSGkgSGFubmVzLA0KPg0KPj4g SSBhZ3JlZSB0aGF0IHRoZXJlIGFyZSBtb2JpbGUgcGhvbmUgYXV0aGVudGljYXRpb24gYW5kIHBh eW1lbnQgc29sdXRpb25zIHRoYXQgZG8gbm90IG9mZmVyIG11Y2ggYmV0dGVyIHNlY3VyaXR5IHRo YW4gdHJhZGl0aW9uYWwgcGFzc3dvcmRzLg0KPj4NCj4+IFdlIGRvLCBob3dldmVyLCBub3QgcHJv cG9zZSBhIHNpbmdsZSBhdXRoZW50aWNhdGlvbiBvciBwYXltZW50IHNvbHV0aW9uIGJ1dCBpbnN0 ZWFkIHdhbnQgdG8gZW5hYmxlIGRldmVsb3BlcnMgdG8gdXBsb2FkIGFuZCBtYW5hZ2UgY29kZSBv biB0aGUgVEVFLiBUaGlzIGNvdWxkLCBmb3IgZXhhbXBsZSwgZW5hYmxlIGltcHJvdmVkIHNlY3Vy aXR5IGZvciBhbiBGSURPLWJhc2VkIGF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbS4NCj4NCj4gV2hh dCBJIHdhcyB0cnlpbmcgdG8gZXhwbGFpbiBpcyB0aGF0IGl0IGRvZXNuJ3QgbWF0dGVyIGlmIHlv dSBoYXZlIFRFRXMgb3Igbm90IGlmIHRoZSBzeXN0ZW0gZGVwZW5kcyBvbiBhbiBPT0IgY2hhbm5l bCAod2hpY2ggY3VycmVudGx5IGlzIGNsb3NlIHRvIGEgZGUtZmFjdG8gc3RhbmRhcmQpLg0KPg0K PiBBcyBhIGRldmVsb3BlciBvZiBzdWNoIHN5c3RlbXMgSSBmaW5kIGl0IGRlZXBseSB1bnNhdGlz ZnlpbmcgaGF2aW5nIHRvIGFkbWl0IHRoYXQgaW4gc3BpdGUgb2YgdXNpbmcgInN0YXRlIG9mIHRo ZSBhcnQgc2VjdXJpdHkgc29sdXRpb25zIiwgaXQgZG9lc24ndCByZWFsbHkgY29wZSB3aXRoIHBo aXNoaW5nLg0KPg0KPiBXaGF0IGlzIHlvdXIgcmVjb21tZW5kZWQgc29sdXRpb24vd29ya2Fyb3Vu ZCB0byB0aGlzIHByb2JsZW0/ICBEcm9wcGluZyBPT0I/IFJlcGxhY2luZyBPT0Igd2l0aCAuLi4/ DQo+DQo+IENoZWVycywNCj4gQW5kZXJzDQo+DQo+Pg0KPj4gQ2lhbw0KPj4gSGFubmVzDQo+Pg0K Pj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4+IEZyb206IEFuZGVycyBSdW5kZ3JlbiBb bWFpbHRvOmFuZGVycy5ydW5kZ3Jlbi5uZXRAZ21haWwuY29tXQ0KPj4gU2VudDogMDYgSnVseSAy MDE4IDA2OjU2DQo+PiBUbzogV2hlZWxlciwgRGF2aWQgTTsgdGVlcEBpZXRmLm9yZzsgSGFubmVz IFRzY2hvZmVuaWcNCj4+IFN1YmplY3Q6IE9PQiBJc3N1ZXMuIFdhczogW1RlZXBdIENvbW1lbnRz IG9uIEktRCBBY3Rpb246IGRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUtMDAudHh0DQo+Pg0K Pj4gSSBob3BlIHRoYXQgeW91IGd1eXMgZG9uJ3QgbWluZCBhIChkaXN0YW50bHkpIHJlbGF0ZWQg YXJjaGl0ZWN0dXJhbCBxdWVzdGlvbi4NCj4+DQo+PiBVc2luZyB0cnVzdGVkIGhhcmR3YXJlIGFu ZCBURUVzIGlzIGluZGVlZCBjb29sIHNpbmNlIHRoZXkgZW5hYmxlIHNlY3VyaXR5IGxldmVscyBj b21wYXJhYmxlIHRvIHRyYWRpdGlvbmFsIHNtYXJ0IGNhcmRzIGFsdGhvdWdoIHByb3Zpc2lvbmVk IG9uLWxpbmUuDQo+Pg0KPj4gQSBxdWl0ZSBwb3B1bGFyIHVzZSBjYXNlIGlzIHVzaW5nIGEgbW9i aWxlIHBob25lIGFzIGEgInNlY3VyaXR5IGRldmljZSIgdG9nZXRoZXIgd2l0aCBhIFBDIHJ1bm5p bmcgYSB3ZWIgYXBwbGljYXRpb25zIGxpa2Ugb24tbGluZSBiYW5raW5nLiAgU3VjaCBhcnJhbmdl bWVudHMgdXN1YWxseSBkZXBlbmQgb24gYW4gT09CIGNoYW5uZWwgZnJvbSB0aGUgcGhvbmUuDQo+ Pg0KPj4gSG93ZXZlciwgdGhlIG1ham9yaXR5IG9mIHRoZXNlIGFwcGxpY2F0aW9ucyBhcmUgaW4g c3BpdGUgb2YgYWxsIHRoZSBncmVhdCBzZWN1cml0eSBzb2x1dGlvbnMgc3RpbGwgc3VzY2VwdGli bGUgdG8gZmFpcmx5IHRyaXZpYWwgcGhpc2hpbmcgYXR0YWNrcy4gIEluIGZhY3QsIHNvbWUgb2Yg dGhlc2Ugc3lzdGVtcyBoYXZlIGJlZW4gZXhwbG9pdGVkIG51bWVyb3VzIHRpbWVzIHRocm91Z2gg c29jaWFsIGVuZ2luZWVyaW5nIG92ZXIgdGhlIHBob25lIQ0KPj4NCj4+IFdoYXQgaXMgdGhlIHBy b2JsZW0gdGhlbj8gIFBsZWFzZSBkb24ndCB0YWtlIGl0IHBlcnNvbmFsbHkgYnV0IHRoZXJlIGFy ZSBvYnZpb3VzbHkgc29tZSBkaXNjb25uZWN0cyBpbiB0aGlzIGluZHVzdHJ5LCBoaWdoLWxpZ2h0 ZWQgYnkgdGhlIGZhY3QgdGhhdCBRUiBjb2RlIGhhcyBiZWNvbWUgInRoZSBuZXcgYmxhY2siIGFs dGhvdWdoIGl0IGlzIGluY29udmVuaWVudCBhbmQgaGF2ZSBwb29yIHNlY3VyaXR5IGNoYXJhY3Rl cmlzdGljcy4NCj4+DQo+PiBTdW1tYXJ5OiBmb3IgYSBjZXJ0YWluIGtpbmQgb2YgcmVhbCB3b3Js ZCBhcHBsaWNhdGlvbnMsIHRydXN0ZWQgaGFyZHdhcmUgb2ZmZXJzIG9ubHkgbWFyZ2luYWxseSBi ZXR0ZXIgc2VjdXJpdHkgdGhhbiB0cmFkaXRpb25hbCBwYXNzd29yZHMuDQo+Pg0KPj4gQ2hlZXJz LA0KPj4gQW5kZXJzDQo+PiBJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBl bWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJl IHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFz ZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBj b250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBz dG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo+ Pg0KPg0KPiBJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQg YW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVn ZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkg dGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0 byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBj b3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo+DQoNCklNUE9S VEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVu dHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFy ZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGlt bWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBw ZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9y bWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCg== From nobody Fri Jul 6 07:37:16 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86B7D130EEE for ; Fri, 6 Jul 2018 07:37:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.01 X-Spam-Level: X-Spam-Status: No, score=-0.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Y-Ug668wIYy for ; Fri, 6 Jul 2018 07:37:08 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0113.outbound.protection.outlook.com [104.47.36.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 944D3130EBA for ; Fri, 6 Jul 2018 07:37:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NGTSYsV10psNRk2j7vXH5xlyiGhJdejh/0nbSILM7/4=; b=icbQYzdf8TmnJnZsb+YMa2rrWwWd4BwnEOz0WHForygR5tGF0ajdY+P2x5/VCMz1DX8VxZoEEGKu4KhKsn9Jtfe24KT4L98UZGfP+Jie0utHhLrchMVuG3/8q335Yu3mcw2AOfBQLbruPALQejRYABmHK3jabAWWkxiZzybBqe4= Received: from DM5PR2101MB0805.namprd21.prod.outlook.com (10.167.105.149) by DM5PR2101MB0935.namprd21.prod.outlook.com (52.132.131.165) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.952.4; Fri, 6 Jul 2018 14:37:06 +0000 Received: from DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::30ec:e30c:8f5c:b685]) by DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::30ec:e30c:8f5c:b685%2]) with mapi id 15.20.0952.008; Fri, 6 Jul 2018 14:37:06 +0000 From: Dave Thaler To: Hannes Tschofenig , Andrew Atyeo , "Wheeler, David M" , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrwAABlbQAAAV1OEAAYPB0QAAbQUgAABtCr0A== Date: Fri, 6 Jul 2018 14:37:05 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-07-06T14:37:05.6241924Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [73.59.106.235] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2101MB0935; 7:6kWM+g5Zid/UH/MJKcyTwyt6WeOVOlFLupsU3xp6BIlXuJugo2be1aUjpkFphISjsg6TgmZIbzLmswOjtczRyIsK949We3ivM3EYnv+/LCj+DUVwrSgfLe6YmMl2WUdIVOLJM1ZDsSMK/vFVGzZngwax+Mfh9sINL8Ox7WJPyWzGqeNo9FTrQ3WMed/Xc4zgkFOueL2TloFnj7qrqPfc6am0VWfhyzglyNHoyRVTGQtiE7E3sXrSNxez/dyt401Y x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 51980b49-7479-4f55-34cf-08d5e34df252 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:(223705240517415); BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7193020); SRVR:DM5PR2101MB0935; x-ms-traffictypediagnostic: DM5PR2101MB0935: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-ld-processed: 72f988bf-86f1-41af-91ab-2d7cd011db47,ExtAddr x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(180628864354917)(278428928389397)(89211679590171)(192374486261705)(189930954265078)(223705240517415)(219752817060721)(21748063052155)(211171220733660); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231291)(2018427008)(944501410)(52105095)(10201501046)(3002001)(6055026)(149027)(150027)(6041310)(20161123560045)(20161123564045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(6072148)(201708071742011)(7699016); SRVR:DM5PR2101MB0935; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2101MB0935; x-forefront-prvs: 0725D9E8D0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(366004)(396003)(136003)(376002)(39860400002)(13464003)(189003)(199004)(40434004)(66066001)(8990500004)(74316002)(6506007)(53546011)(14454004)(102836004)(606006)(3846002)(6116002)(790700001)(76176011)(478600001)(33656002)(10090500001)(10290500003)(22452003)(7696005)(5660300001)(110136005)(105586002)(966005)(229853002)(8936002)(1680700002)(93886005)(316002)(7736002)(106356001)(476003)(26005)(55016002)(256004)(81156014)(81166006)(25786009)(53946003)(99286004)(14444005)(5024004)(9686003)(6306002)(54896002)(186003)(8676002)(2501003)(86612001)(6436002)(486006)(575784001)(86362001)(236005)(2900100001)(11346002)(2906002)(53386004)(53936002)(446003)(6246003)(5250100002)(68736007)(97736004)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB0935; H:DM5PR2101MB0805.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: +7wrmKNqTL1LRCIOb2x7RXShUs1CK+wtdwo7tA85gyFY9z9cZTgdL5Wu6OXqJz08RbP3JDIDos6jWo7aLVKUD+nTL6DYohWHG6rD9EGVtLet5qsiFA3pEu029Uc+O7Xgl9IYFx8bVQJj2vyvxQgJGaCBudUk+WwQ1auhKLiTEQh//IjFGBttv7NVdBfDvRGqRAnPfp93MDQCN8z5N9yjtylFgPMfiramPbxMcdbjBizn7AepwH7ac7neLXZq/t4sRU1LTfUL5ccH2GV/KWDcc0X7hL7H+jmcWpBJSrKlLfOYU7Vmoal0cRQTnHmVs0c5H0fCxw/b17qk5HWSsiz1DOIGz8C6JTqOgQaTQ/BV6wI= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2101MB0805340C8B626F36956ABC87A3470DM5PR2101MB0805_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 51980b49-7479-4f55-34cf-08d5e34df252 X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2018 14:37:05.8922 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0935 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 14:37:14 -0000 --_000_DM5PR2101MB0805340C8B626F36956ABC87A3470DM5PR2101MB0805_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable [speaking as an individual participant] The WG charter says "The group will maintain a close relationship with the = ... Trusted Computing Group, and other relevant standards groups..." and I = think part of that is to use consistent terminology. Hence my recommendati= on that David Wheeler already incorporated into his proposed text. (Thanks= David) Dave From: Hannes Tschofenig Sent: Friday, July 6, 2018 4:22 AM To: Andrew Atyeo ; Dave Thaler ; Wheeler, David M ; teep@ietf.org Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt The problem is only that "root of trust" is not a well defined term in the = IETF, at least as far as I know. Trust anchor, on the other hand, is well d= efined. The definition currently in the document for root of trust seems to be simi= lar to trust anchor. However, I agree with both Andy and with David that we= need to find out whether we want to point out certain usages of the key (s= uch as for the purpose of the attestation). Whether this justifies the intr= oduction of another term is yet another discussion Ciao Hannes From: Andrew Atyeo [mailto:Andrew.Atyeo@intercede.com] Sent: 06 July 2018 10:38 To: Dave Thaler; Wheeler, David M; Hannes Tschofenig; teep@ietf.org Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt In OTrP, I believe "root of trust" and "trust anchor" are currently referri= ng to 2 different things in the OTrP spec. * Root of trust Excerpt from OTrP: "This specification assumes that an applicable device is= equipped with a TEE and is pre-provisioned with a device-unique public/private key pair, which is securely stored. This key pair is referred as the 'root of trust'. An entity that uses such a device to run Trusted Applications (TAs) is known as a Service Provider (SP)." Here, "Root of Trust" must be talking about either the TEE/TFW private key,= so "root of trust" is referring to the process of secure boot that results= in a TAM being able to use a signature from this key to know whether to tr= ust the TEE * Trust Anchor There is a problem this refers to 2 completely different concepts: "Setup trust anchors in devices 1. [TFW/TEE] Store the key and certificate encrypted with the eFuse key 2. [TEE vendor or OEM] Store trusted CA certificate list into devices" Here, "Trust Anchor" is referring to both the TFW private key and the TAM C= A root certificate store BUT later on in the spec: "The root CA certificates for a TAM, which are embedded into the trust anchor store in a device, should have long lifetimes that don't require device trust anchor update." And "Trust Anchor: A root certificate that can be used to validate its children certificates. It is usually embedded in a device or configured by a TAM for validating the trust of a remote entity's certificate." Here, "Trust Anchor" refers to the TAM root CA whitelist that is embedded i= n the TEE in order to allow the TEE to chain TAM certificates to the root C= A certs (to determine what certs to trust) ...So it is best if we can remove the term "trust anchor" wherever it refer= s to the concept of root CA certs, and refer to "TAM root CA certificate st= ore" (or something like that) , and for everywhere else that uses "trust anchor" to refer to the concept = of secureboot/attestation etc, we need to settle on some other term. In som= e cases e.g. "pair, which is securely stored in the TEE. This key pair is referred = to as the 'root of trust'." we can simply refer to the TFW key (since in places 'root of trust' is used= to describe the TFW key). Andrew Atyeo Security Architect Intercede Digital trust people | devices | apps Office: +44 (0) 1455 558 111 www.intercede.com -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Dave Thaler Sent: 05 July 2018 21:36 To: Wheeler, David M >; Hannes Tschofenig >; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= ..txt [speaking as an individual] As David says, there's more than one type of "Root-of-Trust" aka "trust anc= hor". There are industry terms of art for the different types. One example article that gives a decent summary is https://healthitsecurity= .com/news/nist-roots-of-trust-for-healthcare-mobile-devices In particular, the industry terms (from NIST SP 800-164, potentially among = others) are: Roof of Trust for Storage (RTS) Root of Trust for Verification (RTV) Root of Trust for Integrity (RTI) Root of Trust for Reporting (RTR) Root of Trust for Measurement (RTM) I would recommend using the above terms and not using "trust anchor" or the= unqualified "root of trust" term. Dave -----Original Message----- From: TEEP > On Behalf = Of Wheeler, David M Sent: Thursday, July 5, 2018 12:52 PM To: Hannes Tschofenig >; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Hannes, If that is the case (trust root and trust anchors are the same), then I hav= e a concern regarding crypto separation. In one definition the Trust Anchor signs certificates, in the other definit= ion a Root-of-Trust signs attestations. If these are in fact the same key, then they are being used for two differe= nt functions, which is not recommended for cryptographic keys. Further, it seems to me (though I may be misunderstanding the intended func= tion), the private key of the Trust Anchor resides outside the device, in a= separate entity, like a CA or a TAM. However, the private key of a Root-of-Trust resides in the TEE (or is acces= sible only to the TEE). Can you pick apart my understanding of the two definitions of keys, and hel= p me understand where I got thrown off? Thanks, Dave Wheeler -----Original Message----- From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com] Sent: Thursday, July 5, 2018 12:41 PM To: Wheeler, David M >; teep@ietf.org Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Just a quick remark: IMHO root of trust and trust anchor are the same thing= . I believe we should update the text to only talk about trust anchors and = forget the root of trust terminology. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M Sent: 05 July 2018 21:38 To: teep@ietf.org Subject: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt I have several comments on the new architecture draft. The first comment has to do with the definition of the "Trust Anchor" (page= 4) The definition states: Trust Anchor: A root certificate that can be used to validate its certificates. It is usually embedded in a devic= e or configured by a TAM for validating the trust of= a remote entity's certificate. Then later in section 3 (page 6) This specification assumes that an applicable device is equipped with one = or more TEEs and each TEE is pre-provisioned with a device-unique public/p= rivate key pair, which is securely stored. This key pair is referred to as= the 'root of trust' for remote attestation of the associated TEE in a dev= ice by an TAM. It is not clear whether the "Trust Anchor" is the same as the "root-of-trus= t" key pair, since the "root-of-trust" is not included in the definitions. If they are intended to be different (which is what I believe), then I sugg= est we add the "root-of-trust" to the definitions, and explain the differen= ce. Oftentimes, in my experience, these terms are used interchangeably. Here is my attempt to create definitions for these two types of keys: Trust Anchor: A trust anchor is public asymmetric key, preferably contained= in a certificate that represents a trusted entity to a device. T= his public key may be used by the holder of the corresponding private key to = sign other certificates, thereby communicating the signed certificate ma= y also be trusted. The trust anchor is usually embedded in a devic= e or configured by a TAM and used by the device to validate the trust o= f a remote entity by verifying that entity's certificate is signed b= y a trust anchor. Trust anchors must be stored in a way that pre= vents or strongly resists modification by unauthorized software and hard= ware adversaries. An example of a trust anchor is the public key of a TAM or SP whi= ch is "pinned" or securely stored inside the device, an= d that trust anchor is used like a CA certificate to validate the trust in = other keys/certificates. A trust anchor may be viewed by both trusted and= untrusted entities on the device, But may only be modified or deleted by a trusted = entity. Root-of-Trust Key: A device-unique key generated at device manufacturing o= r at TEE provisioning, which is securely stored and = only accessible to the TEE. The Root-of-Trust Key is used for attestation s= igning which proves the signed message originated or was approved by the TEE, = and may be trusted to the same degree as the TEE. -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of internet-drafts@ietf= .org Sent: Wednesday, July 4, 2018 7:49 AM To: i-d-announce@ietf.org Cc: teep@ietf.org Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Trusted Execution Environment Provisioning= WG of the IETF. Title : Trusted Execution Environment Provisioning (TEEP)= Architecture Authors : Mingliang Pei Hannes Tschofenig Andrew Atyeo Dapeng Filename : draft-ietf-teep-architecture-00.txt Pages : 24 Date : 2018-07-02 Abstract: A Trusted Execution Environment (TEE) was designed to provide a hardware-isolation mechanism to separate a regular operating system from security- sensitive applications. This architecture document motivates the design and standardization of a protocol for managing the lifecyle of trusted applications running inside a TEE. The IETF datatracker status page for this draft is: https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatrac= ker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=3D02%7C01%7Cd= thaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141a= f91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DXBuTlsiV5Ojkxkcq= ULdsmroTnWRZqApH3fBokJGvkTE%3D&reserved=3D0 There are also htmlized versions available at: https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools.ie= tf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7C01%7Cdthale= r%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab= 2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DheO1xlxfrVZyyzYziQy8V= 2P0vxiEbTVSF8sFdNaw8sc%3D&reserved=3D0 https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatrac= ker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7= C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf= 86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DaoKW%2FFn= lzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&reserved=3D0 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ TEEP mailing list TEEP@ietf.org https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsoft.c= om%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C= 1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okI= PShXtd0%3D&reserved=3D0 _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. --_000_DM5PR2101MB0805340C8B626F36956ABC87A3470DM5PR2101MB0805_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

[speaking as an individual participant]

 

The WG charter says “The group will maintain a= close relationship with the … Trusted Computing Group, and other rel= evant standards groups...” and I think part of that is to use consist= ent terminology.  Hence my recommendation that David Wheeler already incorporated into his proposed text.  (Thanks David)<= o:p>

 

Dave

 

From: Hannes Tschofenig <Hannes.Tschofenig= @arm.com>
Sent: Friday, July 6, 2018 4:22 AM
To: Andrew Atyeo <Andrew.Atyeo@intercede.com>; Dave Thaler <= ;dthaler@microsoft.com>; Wheeler, David M <david.m.wheeler@intel.com&= gt;; teep@ietf.org
Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architec= ture-00.txt

 

The pro= blem is only that “root of trust” is not a well defined term in= the IETF, at least as far as I know. Trust anchor, on the other hand, is w= ell defined.

The def= inition currently in the document for root of trust seems to be similar to = trust anchor. However, I agree with both Andy and with David that we need t= o find out whether we want to point out certain usages of the key (such as for the purpose of the attestation). Wh= ether this justifies the introduction of another term is yet another discus= sion

&n= bsp;

Ciao

Hannes<= o:p>

&n= bsp;

&n= bsp;

From: Andrew Atyeo [mailto:Andrew.Atyeo@intercede.com]
Sent: 06 July 2018 10:38
To: Dave Thaler; Wheeler, David M; Hannes Tschofenig; teep@ietf.org
Subject: RE: [Teep] Comments on I-D Action: draft-ietf-teep-architec= ture-00.txt

 

In OTrP, I believe "roo= t of trust" and "trust anchor" are currently referring to 2 = different things in the OTrP spec.

 

·         Root of trust

Excerpt from OTrP: “This specification assumes that an applicable device is equipped with<=
o:p>

&nbs= p;  a TEE and is pre-provisioned with a device-unique public/private k= ey

&nbs= p;  pair, which is securely stored.  This key pair is referred as= the

&nbs= p;  'root of trust'.  An entity that uses such a device to run Tr= usted

&nbs= p;  Applications (TAs) is known as a Service Provider (SP).”

Here, “Root of Trust&#= 8221; must be talking about either the TEE/TFW private key, so “root = of trust” is referring to the process of secure boot that results in = a TAM being able to use a signature from this key to know whether to trust the TEE

 

·         Trust Anchor

There is a problem this refe= rs to 2 completely different concepts:

“Setup trust an=
chors in devices
 

   1.  [TFW/=
TEE] Store the key and certificate encrypted with the eFuse


    &nb=
sp;  key


 

   2.  [TEE =
vendor or OEM] Store trusted CA certificate list into

    &nb=
sp;  devices”


Here, “Trust Anchor=
221; is referring to both the TFW private key and the TAM CA root certifica=
te store


 


BUT later on in the spec:


“The root CA certificates f=
or a TAM, which are



embedded into the trust anchor st=
ore in a device, should have long



lifetimes that don't require=
 device trust anchor update.”


And


“Trust Anchor: A root certif=
icate that can be used to validate its



ch=
ildren certificates. It is usually embedded in a device or



co=
nfigured by a TAM for validating the trust of a remote entity's



certificate.”


Here, “Trust Anchor=
221; refers to the TAM root CA whitelist that is embedded in the TEE in ord=
er to allow the TEE to chain TAM certificates to the root CA certs (to dete=
rmine what certs to trust)


 


…So it is best if we c=
an remove the term “trust anchor” wherever it refers to the con=
cept of root CA certs, and refer to “TAM root CA certificate store=
221; (or something like that)


, and for everywhere else th=
at uses “trust anchor” to refer to the concept of secureboot/at=
testation etc, we need to settle on some other term. In some cases



e.g. “pair, =
which is securely stored in the TEE. This key pair is referred to as the 'r=
oot of trust'.”


we can simply refer to the T=
FW key (since in places ‘root of trust’ is used to describe the=
 TFW key).



 


 


Andrew Atyeo 


Security Architect


 


Intercede<=
/p>

Digital trust  &nb=
sp; people | devices | apps


 


Office: +44 (0) 1455 558=
 111


www.intercede.com


-----O=
riginal Message-----

From: TEEP [mailto:teep-bounces@ie=
tf.org] On Behalf Of Dave Thaler

Sent: 05 July 2018 21:36

To: Wheeler, David M <david=
.m.wheeler@intel.com>; Hannes Tschofenig <Hannes.Tschofenig@arm.com>;
teep@ietf.org

Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00=
..txt


 


[speaking as an individual]<=
o:p>


 


As David says, there's more =
than one type of "Root-of-Trust" aka "trust anchor".



There are industry terms of =
art for the different types.


One example article that giv=
es a decent summary is

https://healthitsecur=
ity.com/news/nist-roots-of-trust-for-healthcare-mobile-devices


 


In particular, the industry =
terms (from NIST SP 800-164, potentially among others) are:


Roof of Trust for Storage (R=
TS)


Root of Trust for Verificati=
on (RTV)


Root of Trust for Integrity =
(RTI)


Root of Trust for Reporting =
(RTR)


Root of Trust for Measuremen=
t (RTM)


 


I would recommend using the =
above terms and not using "trust anchor" or the unqualified "=
;root of trust" term.


 


Dave


 


-----Original Message-----


From: TEEP <teep-bounces@ietf.org> On Behalf Of Wheeler, David M


Sent: Thursday, July 5, 2018=
 12:52 PM


To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>;
teep@ietf.org


Subject: Re: [Teep] Comments=
 on I-D Action: draft-ietf-teep-architecture-00.txt


 


Hannes,

If that is the case (trust r=
oot and trust anchors are the same), then I have a concern regarding crypto=
 separation.


In one definition the Trust =
Anchor signs certificates, in the other definition a Root-of-Trust signs at=
testations.


If these are in fact the sam=
e key, then they are being used for two different functions, which is not r=
ecommended for cryptographic keys.


 


Further, it seems to me (tho=
ugh I may be misunderstanding the intended function), the private key of th=
e Trust Anchor resides outside the device, in a separate entity, like a CA =
or a TAM.


However, the private key of =
a Root-of-Trust resides in the TEE (or is accessible only to the TEE).=



 


Can you pick apart my unders=
tanding of the two definitions of keys, and help me understand where I got =
thrown off?


 


Thanks,

Dave Wheeler 


 


-----Original Message-----


From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com]



Sent: Thursday, July 5, 2018=
 12:41 PM


To: Wheeler, David M <david.m.wheeler@intel.com>;
teep@ietf.org


Subject: RE: [Teep] Comments=
 on I-D Action: draft-ietf-teep-architecture-00.txt


 


Just a quick remark: IMHO ro=
ot of trust and trust anchor are the same thing. I believe we should update=
 the text to only talk about trust anchors and forget the root of trust ter=
minology.


 


 


-----Original Message-----


From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M<=
o:p>


Sent: 05 July 2018 21:38


To: teep@ietf.or=
g


Subject: [Teep] Comments on =
I-D Action: draft-ietf-teep-architecture-00.txt


 


I have several comments on t=
he new architecture draft.


 


The first comment has to do =
with the definition of the "Trust Anchor" (page 4)


 


The definition states:<=
/o:p>


Trust Anchor: A root certifi=
cate that can be used to validate its


    &nbs=
p;            &=
nbsp;          certificates. I=
t is usually embedded in a device or


    &nbs=
p;             =
          configured by a=
 TAM for validating the trust of a remote entity's


    &nbs=
p;            &=
nbsp;          certificate.


 


Then later in section 3 (pag=
e 6)


This specification assumes t=
hat an applicable device is equipped with  one or more TEEs and each T=
EE is pre-provisioned with a device-unique  public/private key pair, w=
hich is securely stored. This key pair is  referred
 to as the 'root of trust' for remote attestation of the  associated T=
EE in a device by an TAM.


 


 


It is not clear whether the =
"Trust Anchor" is the same as the "root-of-trust" key p=
air, since the "root-of-trust" is not included in the definitions=
.


 


If they are intended to be d=
ifferent (which is what I believe), then I suggest we add the "root-of=
-trust" to the definitions, and explain the difference. Oftentimes, in=
 my experience, these terms are used interchangeably.


 


Here is my attempt to create=
 definitions for these two types of keys:


 


Trust Anchor: A trust anchor=
 is public asymmetric key, preferably contained in a certificate=



    &nbs=
p;             =
          that represents=
 a trusted entity to a device. This public key may be used by


    &nbs=
p;            &=
nbsp;          the holder of t=
he corresponding private key to sign other certificates,<=
/p>

    &nbs=
p;            &=
nbsp;          thereby communi=
cating the signed certificate may also be trusted.


    &nbs=
p;            &=
nbsp;          The trust ancho=
r is usually embedded in a device or configured by a TAM<=
/p>

    &nbs=
p;            &=
nbsp;           and used =
by the device to validate the trust of a remote entity by=



    &nbs=
p;            &=
nbsp;          verifying that =
entity's certificate is signed by a trust anchor.


    &nbs=
p;            &=
nbsp;           Trust anc=
hors must be stored in a way that prevents or strongly resists


    &nbs=
p;            &=
nbsp;           modificat=
ion by unauthorized software and hardware adversaries.

    &nbs=
p;     An example of a trust anchor is the public key o=
f a TAM or SP which is


    &nbs=
p;            &=
nbsp;        "pinned" or secur=
ely stored inside the device, and that trust anchor is used


    &nbs=
p;            &=
nbsp;          like a CA certi=
ficate to validate the trust in other keys/certificates.<=
/p>

    &nbs=
p;            &=
nbsp;         A trust anchor may be=
 viewed by both trusted and untrusted entities on the device,


    &nbs=
p;            &=
nbsp;        But may only be modified or=
 deleted by a trusted entity.


 


Root-of-Trust Key:  A d=
evice-unique key generated at device manufacturing or at<=
/p>

    &nbs=
p;            &=
nbsp;          TEE provisionin=
g, which is securely stored and only accessible to the TEE.


    &nbs=
p;            &=
nbsp;          The Root-of-Tru=
st Key is used for attestation signing which proves the signed


    &nbs=
p;            &=
nbsp;          message origina=
ted or was approved by the TEE, and may be trusted to the same


    &nbs=
p;            &=
nbsp;         degree as the TEE.


 


-----Original Message-----


From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of
internet-drafts@ietf.org


Sent: Wednesday, July 4, 201=
8 7:49 AM


To: 
i-d-announce@ietf.org=



Cc: teep@ietf.or=
g


Subject: [Teep] I-D Action: =
draft-ietf-teep-architecture-00.txt


 


 


A New Internet-Draft is avai=
lable from the on-line Internet-Drafts directories.


This draft is a work item of=
 the Trusted Execution Environment Provisioning WG of the IETF.<=
/span>


 


    &nbs=
p;   Title         &=
nbsp; : Trusted Execution Environment Provisioning (TEEP) Architecture=



    &nbs=
p;   Authors         : Mi=
ngliang Pei


    &nbs=
p;            &=
nbsp;        Hannes Tschofenig


    &nbs=
p;            &=
nbsp;        Andrew Atyeo


    &nbs=
p;            &=
nbsp;        Dapeng

Filename   &n=
bsp;    : draft-ietf-teep-architecture-00.txt


Pages    =
;       : 24


Date    =
        : 2018-07-02

 


Abstract:<=
/p>

   A Trusted Execu=
tion Environment (TEE) was designed to provide a


   hardware-isolat=
ion mechanism to separate a regular operating system


   from security- =
sensitive applications.


 


   This architectu=
re document motivates the design and standardization


   of a protocol f=
or managing the lifecyle of trusted applications


   running inside =
a TEE.


 


 


The IETF datatracker status =
page for this draft is:


https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F=
%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&amp;dat=
a=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C=
72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&amp;sdata=
=3DXBuTlsiV5OjkxkcqULdsmroTnWRZqApH3fBokJGvkTE%3D&amp;reserved=3D0


 


There are also htmlized vers=
ions available at:


https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fto=
ols.ietf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&amp;data=3D02%7C0=
1%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86=
f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&amp;sdata=3DheO1xlx=
frVZyyzYziQy8V2P0vxiEbTVSF8sFdNaw8sc%3D&amp;reserved=3D0


https://na01.safelinks.protection.outlook.com/?url=3Dht=
tps%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architectur=
e-00&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926=
f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C6366641712235419=
02&amp;sdata=3DaoKW%2FFnlzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&amp=
;reserved=3D0


 


 


Please note that it may take=
 a couple of minutes from the time of submission until the htmlized version=
 and diff are available at tools.ietf.org.


 


Internet-Drafts are also ava=
ilable by anonymous FTP at:


f=
tp://ftp.ietf.org/internet-drafts/


 


____________________________=
___________________


TEEP mailing list=



TEEP@ietf.org


https:/=
/na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2F=
mailman%2Flistinfo%2Fteep&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%=
7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7=
C0%7C636664171223541902&amp;sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0ok=
IPShXtd0%3D&amp;reserved=3D0


 


____________________________=
___________________


TEEP mailing list=



TEEP@ietf.org


https:/=
/na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2F=
mailman%2Flistinfo%2Fteep&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%=
7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7=
C0%7C636664171223541902&amp;sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0ok=
IPShXtd0%3D&amp;reserved=3D0


IMPORTANT NOTICE: The conten=
ts of this email and any attachments are confidential and may also be privi=
leged. If you are not the intended recipient, please notify the sender imme=
diately and do not disclose the contents
 to any other person, use it for any purpose, or store or copy the informat=
ion in any medium. Thank you.


 


____________________________=
___________________


TEEP mailing list=



TEEP@ietf.org


https:/=
/na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2F=
mailman%2Flistinfo%2Fteep&amp;data=3D02%7C01%7Cdthaler%40microsoft.com%=
7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7=
C0%7C636664171223541902&amp;sdata=3D7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0ok=
IPShXtd0%3D&amp;reserved=3D0


 


____________________________=
___________________


TEEP mailing list=



TEEP@ietf.org


https://w=
ww.ietf.org/mailman/listinfo/teep


IMPORTANT NOTICE: The contents of=
 this email and any attachments are confidential and may also be privileged=
. If you are not the intended recipient, please
 notify the sender immediately and do not disclose the contents to any othe=
r person, use it for any purpose, or store or copy the information in any m=
edium. Thank you.
--_000_DM5PR2101MB0805340C8B626F36956ABC87A3470DM5PR2101MB0805_-- From nobody Fri Jul 6 08:17:21 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7965F130E86 for ; Fri, 6 Jul 2018 08:17:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.289 X-Spam-Level: X-Spam-Status: No, score=-4.289 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=qti.qualcomm.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cTuntJ9_-rqJ for ; Fri, 6 Jul 2018 08:17:14 -0700 (PDT) Received: from alexa-out-ams-02.qualcomm.com (alexa-out-ams-02.qualcomm.com [185.23.61.163]) (using TLSv1.2 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9C82130E5D for ; Fri, 6 Jul 2018 08:17:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qti.qualcomm.com; i=@qti.qualcomm.com; q=dns/txt; s=qcdkim; t=1530890234; x=1562426234; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=IEpx2/aMFVebasDRmET4Kzq/K7aZqO99lzoLFjyREmw=; b=JzfFTp4A3ouSwqHEVERERkFOYMDjxUUu4pX1IHRxJOe3uumpCqnJGRk/ EvTSHP06y0c1Bp6uG+PirMrvRKHEvcJneduYdybL0fujquUXlRVNXHZNB xPApgIpYOT+EH/jVNfcE0klqMrrb+j2MTFhWCxJxQg+K2GsAkglq3kuEk 8=; X-IronPort-AV: E=Sophos;i="5.51,316,1526335200"; d="scan'208,217";a="726548" Received: from ironmsg03-ams.qualcomm.com ([10.251.56.4]) by alexa-out-ams-02.qualcomm.com with ESMTP; 06 Jul 2018 17:17:12 +0200 X-IronPort-AV: E=McAfee;i="5900,7806,8945"; a="3731958" Received: from euamsexm01a.eu.qualcomm.com ([10.251.127.40]) by ironmsg03-ams.qualcomm.com with ESMTP/TLS/AES256-SHA; 06 Jul 2018 17:17:12 +0200 Received: from euamsexm01a.eu.qualcomm.com (10.251.127.40) by euamsexm01a.eu.qualcomm.com (10.251.127.40) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Fri, 6 Jul 2018 17:17:09 +0200 Received: from euamsexm01a.eu.qualcomm.com ([10.251.127.40]) by euamsexm01a.eu.qualcomm.com ([10.251.127.40]) with mapi id 15.00.1365.000; Fri, 6 Jul 2018 17:17:09 +0200 From: Jeremy O'Donoghue To: Dave Thaler CC: Hannes Tschofenig , Andrew Atyeo , "Wheeler, David M" , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrw///hpACAAAxZAIAAyeOAgAAtkwCAADajgIAACzEA Date: Fri, 6 Jul 2018 15:17:09 +0000 Message-ID: <9F2A757C-7D90-4755-BD91-BB522970F805@qti.qualcomm.com> References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3445.8.2) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.222.224.68] Content-Type: multipart/alternative; boundary="_000_9F2A757C7D904755BD91BB522970F805qtiqualcommcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 15:17:20 -0000 --_000_9F2A757C7D904755BD91BB522970F805qtiqualcommcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VXNlIG9mIHRoZSBOSVNUIHRlcm1pbm9sb2d5IHdvdWxkIGFsc28gbWFpbnRhaW4gYWxpZ25tZW50 IHdpdGggR2xvYmFsUGxhdGZvcm0gLSBib3RoIFRDRyBhbmQgR2xvYmFsUGxhdGZvcm0gZXhwYW5k IHNvbWV3aGF0IG9uIE5JU1QgZGVmaW5pdGlvbnMgZHVlIHRvIGRpZmZlcmVuY2VzIGluIHVzZS1j YXNlIGFuZCBhcmNoaXRlY3R1cmUsIGJ1dCBOSVNUIGlzIGEgY29tbW9uIHJvb3Qgd2hpY2ggaXMg d2VsbCB1bmRlcnN0b29kIGluIGJvdGggdGhlIEdsb2JhbFBsYXRmb3JtIGFuZCBUQ0cgc3BlY2lm aWNhdGlvbnMgLSB0aGVyZSBpcyBhbiBlbnRpcmUgZG9jdW1lbnQgY292ZXJpbmcgdGhpcyBhdCBH bG9iYWxQbGF0Zm9ybSAoaHR0cHM6Ly9nbG9iYWxwbGF0Zm9ybS5vcmcvd3AtY29udGVudC91cGxv YWRzLzIwMTgvMDYvR1BfUm9UX0RlZmluaXRpb25zX2FuZF9SZXF1aXJlbWVudHNfdjEuMC4xX1B1 YmxpY1JlbGVhc2VfQ0MucGRmIC0gbm90ZSB0aGF0IHRoaXMgd2lsbCBzaG9ydGx5IGJlIHVwZGF0 ZWQpDQoNCkplcmVteQ0KDQpPbiA2IEp1bCAyMDE4LCBhdCAxNTozNywgRGF2ZSBUaGFsZXIgPGR0 aGFsZXI9NDBtaWNyb3NvZnQuY29tQGRtYXJjLmlldGYub3JnPG1haWx0bzpkdGhhbGVyPTQwbWlj cm9zb2Z0LmNvbUBkbWFyYy5pZXRmLm9yZz4+IHdyb3RlOg0KDQpbc3BlYWtpbmcgYXMgYW4gaW5k aXZpZHVhbCBwYXJ0aWNpcGFudF0NCg0KVGhlIFdHIGNoYXJ0ZXIgc2F5cyDigJxUaGUgZ3JvdXAg d2lsbCBtYWludGFpbiBhIGNsb3NlIHJlbGF0aW9uc2hpcCB3aXRoIHRoZSDigKYgVHJ1c3RlZCBD b21wdXRpbmcgR3JvdXAsIGFuZCBvdGhlciByZWxldmFudCBzdGFuZGFyZHMgZ3JvdXBzLi4u4oCd IGFuZCBJIHRoaW5rIHBhcnQgb2YgdGhhdCBpcyB0byB1c2UgY29uc2lzdGVudCB0ZXJtaW5vbG9n eS4gIEhlbmNlIG15IHJlY29tbWVuZGF0aW9uIHRoYXQgRGF2aWQgV2hlZWxlciBhbHJlYWR5IGlu Y29ycG9yYXRlZCBpbnRvIGhpcyBwcm9wb3NlZCB0ZXh0LiAgKFRoYW5rcyBEYXZpZCkNCg0KRGF2 ZQ0KDQpGcm9tOiBIYW5uZXMgVHNjaG9mZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTxt YWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbT4+DQpTZW50OiBGcmlkYXksIEp1bHkgNiwg MjAxOCA0OjIyIEFNDQpUbzogQW5kcmV3IEF0eWVvIDxBbmRyZXcuQXR5ZW9AaW50ZXJjZWRlLmNv bTxtYWlsdG86QW5kcmV3LkF0eWVvQGludGVyY2VkZS5jb20+PjsgRGF2ZSBUaGFsZXIgPGR0aGFs ZXJAbWljcm9zb2Z0LmNvbTxtYWlsdG86ZHRoYWxlckBtaWNyb3NvZnQuY29tPj47IFdoZWVsZXIs IERhdmlkIE0gPGRhdmlkLm0ud2hlZWxlckBpbnRlbC5jb208bWFpbHRvOmRhdmlkLm0ud2hlZWxl ckBpbnRlbC5jb20+PjsgdGVlcEBpZXRmLm9yZzxtYWlsdG86dGVlcEBpZXRmLm9yZz4NClN1Ympl Y3Q6IFJFOiBbVGVlcF0gQ29tbWVudHMgb24gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi10ZWVwLWFy Y2hpdGVjdHVyZS0wMC50eHQNCg0KVGhlIHByb2JsZW0gaXMgb25seSB0aGF0IOKAnHJvb3Qgb2Yg dHJ1c3TigJ0gaXMgbm90IGEgd2VsbCBkZWZpbmVkIHRlcm0gaW4gdGhlIElFVEYsIGF0IGxlYXN0 IGFzIGZhciBhcyBJIGtub3cuIFRydXN0IGFuY2hvciwgb24gdGhlIG90aGVyIGhhbmQsIGlzIHdl bGwgZGVmaW5lZC4NClRoZSBkZWZpbml0aW9uIGN1cnJlbnRseSBpbiB0aGUgZG9jdW1lbnQgZm9y IHJvb3Qgb2YgdHJ1c3Qgc2VlbXMgdG8gYmUgc2ltaWxhciB0byB0cnVzdCBhbmNob3IuIEhvd2V2 ZXIsIEkgYWdyZWUgd2l0aCBib3RoIEFuZHkgYW5kIHdpdGggRGF2aWQgdGhhdCB3ZSBuZWVkIHRv IGZpbmQgb3V0IHdoZXRoZXIgd2Ugd2FudCB0byBwb2ludCBvdXQgY2VydGFpbiB1c2FnZXMgb2Yg dGhlIGtleSAoc3VjaCBhcyBmb3IgdGhlIHB1cnBvc2Ugb2YgdGhlIGF0dGVzdGF0aW9uKS4gV2hl dGhlciB0aGlzIGp1c3RpZmllcyB0aGUgaW50cm9kdWN0aW9uIG9mIGFub3RoZXIgdGVybSBpcyB5 ZXQgYW5vdGhlciBkaXNjdXNzaW9uDQoNCkNpYW8NCkhhbm5lcw0KDQoNCkZyb206IEFuZHJldyBB dHllbyBbbWFpbHRvOkFuZHJldy5BdHllb0BpbnRlcmNlZGUuY29tXQ0KU2VudDogMDYgSnVseSAy MDE4IDEwOjM4DQpUbzogRGF2ZSBUaGFsZXI7IFdoZWVsZXIsIERhdmlkIE07IEhhbm5lcyBUc2No b2ZlbmlnOyB0ZWVwQGlldGYub3JnPG1haWx0bzp0ZWVwQGlldGYub3JnPg0KU3ViamVjdDogUkU6 IFtUZWVwXSBDb21tZW50cyBvbiBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0 dXJlLTAwLnR4dA0KDQpJbiBPVHJQLCBJIGJlbGlldmUgInJvb3Qgb2YgdHJ1c3QiIGFuZCAidHJ1 c3QgYW5jaG9yIiBhcmUgY3VycmVudGx5IHJlZmVycmluZyB0byAyIGRpZmZlcmVudCB0aGluZ3Mg aW4gdGhlIE9UclAgc3BlYy4NCg0K4oCiICAgICAgICAgUm9vdCBvZiB0cnVzdA0KDQpFeGNlcnB0 IGZyb20gT1RyUDog4oCcVGhpcyBzcGVjaWZpY2F0aW9uIGFzc3VtZXMgdGhhdCBhbiBhcHBsaWNh YmxlIGRldmljZSBpcyBlcXVpcHBlZCB3aXRoDQoNCiAgIGEgVEVFIGFuZCBpcyBwcmUtcHJvdmlz aW9uZWQgd2l0aCBhIGRldmljZS11bmlxdWUgcHVibGljL3ByaXZhdGUga2V5DQogICBwYWlyLCB3 aGljaCBpcyBzZWN1cmVseSBzdG9yZWQuICBUaGlzIGtleSBwYWlyIGlzIHJlZmVycmVkIGFzIHRo ZQ0KICAgJ3Jvb3Qgb2YgdHJ1c3QnLiAgQW4gZW50aXR5IHRoYXQgdXNlcyBzdWNoIGEgZGV2aWNl IHRvIHJ1biBUcnVzdGVkDQogICBBcHBsaWNhdGlvbnMgKFRBcykgaXMga25vd24gYXMgYSBTZXJ2 aWNlIFByb3ZpZGVyIChTUCku4oCdDQpIZXJlLCDigJxSb290IG9mIFRydXN04oCdIG11c3QgYmUg dGFsa2luZyBhYm91dCBlaXRoZXIgdGhlIFRFRS9URlcgcHJpdmF0ZSBrZXksIHNvIOKAnHJvb3Qg b2YgdHJ1c3TigJ0gaXMgcmVmZXJyaW5nIHRvIHRoZSBwcm9jZXNzIG9mIHNlY3VyZSBib290IHRo YXQgcmVzdWx0cyBpbiBhIFRBTSBiZWluZyBhYmxlIHRvIHVzZSBhIHNpZ25hdHVyZSBmcm9tIHRo aXMga2V5IHRvIGtub3cgd2hldGhlciB0byB0cnVzdCB0aGUgVEVFDQoNCuKAoiAgICAgICAgIFRy dXN0IEFuY2hvcg0KVGhlcmUgaXMgYSBwcm9ibGVtIHRoaXMgcmVmZXJzIHRvIDIgY29tcGxldGVs eSBkaWZmZXJlbnQgY29uY2VwdHM6DQoNCuKAnFNldHVwIHRydXN0IGFuY2hvcnMgaW4gZGV2aWNl cw0KDQoNCg0KICAgMS4gIFtURlcvVEVFXSBTdG9yZSB0aGUga2V5IGFuZCBjZXJ0aWZpY2F0ZSBl bmNyeXB0ZWQgd2l0aCB0aGUgZUZ1c2UNCg0KICAgICAgIGtleQ0KDQoNCg0KICAgMi4gIFtURUUg dmVuZG9yIG9yIE9FTV0gU3RvcmUgdHJ1c3RlZCBDQSBjZXJ0aWZpY2F0ZSBsaXN0IGludG8NCg0K ICAgICAgIGRldmljZXPigJ0NCg0KSGVyZSwg4oCcVHJ1c3QgQW5jaG9y4oCdIGlzIHJlZmVycmlu ZyB0byBib3RoIHRoZSBURlcgcHJpdmF0ZSBrZXkgYW5kIHRoZSBUQU0gQ0Egcm9vdCBjZXJ0aWZp Y2F0ZSBzdG9yZQ0KDQpCVVQgbGF0ZXIgb24gaW4gdGhlIHNwZWM6DQrigJxUaGUgcm9vdCBDQSBj ZXJ0aWZpY2F0ZXMgZm9yIGEgVEFNLCB3aGljaCBhcmUNCmVtYmVkZGVkIGludG8gdGhlIHRydXN0 IGFuY2hvciBzdG9yZSBpbiBhIGRldmljZSwgc2hvdWxkIGhhdmUgbG9uZw0KbGlmZXRpbWVzIHRo YXQgZG9uJ3QgcmVxdWlyZSBkZXZpY2UgdHJ1c3QgYW5jaG9yIHVwZGF0ZS7igJ0NCkFuZA0K4oCc VHJ1c3QgQW5jaG9yOiBBIHJvb3QgY2VydGlmaWNhdGUgdGhhdCBjYW4gYmUgdXNlZCB0byB2YWxp ZGF0ZSBpdHMNCmNoaWxkcmVuIGNlcnRpZmljYXRlcy4gSXQgaXMgdXN1YWxseSBlbWJlZGRlZCBp biBhIGRldmljZSBvcg0KY29uZmlndXJlZCBieSBhIFRBTSBmb3IgdmFsaWRhdGluZyB0aGUgdHJ1 c3Qgb2YgYSByZW1vdGUgZW50aXR5J3MNCmNlcnRpZmljYXRlLuKAnQ0KSGVyZSwg4oCcVHJ1c3Qg QW5jaG9y4oCdIHJlZmVycyB0byB0aGUgVEFNIHJvb3QgQ0Egd2hpdGVsaXN0IHRoYXQgaXMgZW1i ZWRkZWQgaW4gdGhlIFRFRSBpbiBvcmRlciB0byBhbGxvdyB0aGUgVEVFIHRvIGNoYWluIFRBTSBj ZXJ0aWZpY2F0ZXMgdG8gdGhlIHJvb3QgQ0EgY2VydHMgKHRvIGRldGVybWluZSB3aGF0IGNlcnRz IHRvIHRydXN0KQ0KDQrigKZTbyBpdCBpcyBiZXN0IGlmIHdlIGNhbiByZW1vdmUgdGhlIHRlcm0g 4oCcdHJ1c3QgYW5jaG9y4oCdIHdoZXJldmVyIGl0IHJlZmVycyB0byB0aGUgY29uY2VwdCBvZiBy b290IENBIGNlcnRzLCBhbmQgcmVmZXIgdG8g4oCcVEFNIHJvb3QgQ0EgY2VydGlmaWNhdGUgc3Rv cmXigJ0gKG9yIHNvbWV0aGluZyBsaWtlIHRoYXQpDQosIGFuZCBmb3IgZXZlcnl3aGVyZSBlbHNl IHRoYXQgdXNlcyDigJx0cnVzdCBhbmNob3LigJ0gdG8gcmVmZXIgdG8gdGhlIGNvbmNlcHQgb2Yg c2VjdXJlYm9vdC9hdHRlc3RhdGlvbiBldGMsIHdlIG5lZWQgdG8gc2V0dGxlIG9uIHNvbWUgb3Ro ZXIgdGVybS4gSW4gc29tZSBjYXNlcw0KZS5nLiDigJxwYWlyLCB3aGljaCBpcyBzZWN1cmVseSBz dG9yZWQgaW4gdGhlIFRFRS4gVGhpcyBrZXkgcGFpciBpcyByZWZlcnJlZCB0byBhcyB0aGUgJ3Jv b3Qgb2YgdHJ1c3QnLuKAnQ0Kd2UgY2FuIHNpbXBseSByZWZlciB0byB0aGUgVEZXIGtleSAoc2lu Y2UgaW4gcGxhY2VzIOKAmHJvb3Qgb2YgdHJ1c3TigJkgaXMgdXNlZCB0byBkZXNjcmliZSB0aGUg VEZXIGtleSkuDQoNCg0KQW5kcmV3IEF0eWVvDQpTZWN1cml0eSBBcmNoaXRlY3QNCg0KSW50ZXJj ZWRlDQpEaWdpdGFsIHRydXN0ICAgIHBlb3BsZSB8IGRldmljZXMgfCBhcHBzDQoNCk9mZmljZTog KzQ0ICgwKSAxNDU1IDU1OCAxMTENCnd3dy5pbnRlcmNlZGUuY29tPGh0dHA6Ly93d3cuaW50ZXJj ZWRlLmNvbS8+DQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogVEVFUCBbbWFpbHRv OnRlZXAtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIERhdmUgVGhhbGVyDQpTZW50OiAw NSBKdWx5IDIwMTggMjE6MzYNClRvOiBXaGVlbGVyLCBEYXZpZCBNIDxkYXZpZC4ubS53aGVlbGVy QGludGVsLmNvbTxtYWlsdG86ZGF2aWQubS53aGVlbGVyQGludGVsLmNvbT4+OyBIYW5uZXMgVHNj aG9mZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTxtYWlsdG86SGFubmVzLlRzY2hvZmVu aWdAYXJtLmNvbT4+OyB0ZWVwQGlldGYub3JnPG1haWx0bzp0ZWVwQGlldGYub3JnPg0KU3ViamVj dDogUmU6IFtUZWVwXSBDb21tZW50cyBvbiBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLXRlZXAtYXJj aGl0ZWN0dXJlLTAwLi4udHh0DQoNCltzcGVha2luZyBhcyBhbiBpbmRpdmlkdWFsXQ0KDQpBcyBE YXZpZCBzYXlzLCB0aGVyZSdzIG1vcmUgdGhhbiBvbmUgdHlwZSBvZiAiUm9vdC1vZi1UcnVzdCIg YWthICJ0cnVzdCBhbmNob3IiLg0KVGhlcmUgYXJlIGluZHVzdHJ5IHRlcm1zIG9mIGFydCBmb3Ig dGhlIGRpZmZlcmVudCB0eXBlcy4NCk9uZSBleGFtcGxlIGFydGljbGUgdGhhdCBnaXZlcyBhIGRl Y2VudCBzdW1tYXJ5IGlzIGh0dHBzOi8vaGVhbHRoaXRzZWN1cml0eS5jb20vbmV3cy9uaXN0LXJv b3RzLW9mLXRydXN0LWZvci1oZWFsdGhjYXJlLW1vYmlsZS1kZXZpY2VzPGh0dHBzOi8vbmEwMS5z YWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGaGVhbHRo aXRzZWN1cml0eS5jb20lMkZuZXdzJTJGbmlzdC1yb290cy1vZi10cnVzdC1mb3ItaGVhbHRoY2Fy ZS1tb2JpbGUtZGV2aWNlcyZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3 Q2E5OTg2ZTAzM2U5YTRkZjhiYjM2MDhkNWUzMzJiMWEwJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNjY2NDcyOTI0MDcwMDgzMCZzZGF0YT1uV0V3VWl3cGxX byUyRjJpa29IQlI2bWc2czN2STd2S3IwWXl3UGpsOE51ejQlM0QmcmVzZXJ2ZWQ9MD4NCg0KSW4g cGFydGljdWxhciwgdGhlIGluZHVzdHJ5IHRlcm1zIChmcm9tIE5JU1QgU1AgODAwLTE2NCwgcG90 ZW50aWFsbHkgYW1vbmcgb3RoZXJzKSBhcmU6DQpSb29mIG9mIFRydXN0IGZvciBTdG9yYWdlIChS VFMpDQpSb290IG9mIFRydXN0IGZvciBWZXJpZmljYXRpb24gKFJUVikNClJvb3Qgb2YgVHJ1c3Qg Zm9yIEludGVncml0eSAoUlRJKQ0KUm9vdCBvZiBUcnVzdCBmb3IgUmVwb3J0aW5nIChSVFIpDQpS b290IG9mIFRydXN0IGZvciBNZWFzdXJlbWVudCAoUlRNKQ0KDQpJIHdvdWxkIHJlY29tbWVuZCB1 c2luZyB0aGUgYWJvdmUgdGVybXMgYW5kIG5vdCB1c2luZyAidHJ1c3QgYW5jaG9yIiBvciB0aGUg dW5xdWFsaWZpZWQgInJvb3Qgb2YgdHJ1c3QiIHRlcm0uDQoNCkRhdmUNCg0KLS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS0NCkZyb206IFRFRVAgPHRlZXAtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86 dGVlcC1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIFdoZWVsZXIsIERhdmlkIE0NClNl bnQ6IFRodXJzZGF5LCBKdWx5IDUsIDIwMTggMTI6NTIgUE0NClRvOiBIYW5uZXMgVHNjaG9mZW5p ZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTxtYWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJt LmNvbT4+OyB0ZWVwQGlldGYub3JnPG1haWx0bzp0ZWVwQGlldGYub3JnPg0KU3ViamVjdDogUmU6 IFtUZWVwXSBDb21tZW50cyBvbiBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0 dXJlLTAwLnR4dA0KDQpIYW5uZXMsDQpJZiB0aGF0IGlzIHRoZSBjYXNlICh0cnVzdCByb290IGFu ZCB0cnVzdCBhbmNob3JzIGFyZSB0aGUgc2FtZSksIHRoZW4gSSBoYXZlIGEgY29uY2VybiByZWdh cmRpbmcgY3J5cHRvIHNlcGFyYXRpb24uDQpJbiBvbmUgZGVmaW5pdGlvbiB0aGUgVHJ1c3QgQW5j aG9yIHNpZ25zIGNlcnRpZmljYXRlcywgaW4gdGhlIG90aGVyIGRlZmluaXRpb24gYSBSb290LW9m LVRydXN0IHNpZ25zIGF0dGVzdGF0aW9ucy4NCklmIHRoZXNlIGFyZSBpbiBmYWN0IHRoZSBzYW1l IGtleSwgdGhlbiB0aGV5IGFyZSBiZWluZyB1c2VkIGZvciB0d28gZGlmZmVyZW50IGZ1bmN0aW9u cywgd2hpY2ggaXMgbm90IHJlY29tbWVuZGVkIGZvciBjcnlwdG9ncmFwaGljIGtleXMuDQoNCkZ1 cnRoZXIsIGl0IHNlZW1zIHRvIG1lICh0aG91Z2ggSSBtYXkgYmUgbWlzdW5kZXJzdGFuZGluZyB0 aGUgaW50ZW5kZWQgZnVuY3Rpb24pLCB0aGUgcHJpdmF0ZSBrZXkgb2YgdGhlIFRydXN0IEFuY2hv ciByZXNpZGVzIG91dHNpZGUgdGhlIGRldmljZSwgaW4gYSBzZXBhcmF0ZSBlbnRpdHksIGxpa2Ug YSBDQSBvciBhIFRBTS4NCkhvd2V2ZXIsIHRoZSBwcml2YXRlIGtleSBvZiBhIFJvb3Qtb2YtVHJ1 c3QgcmVzaWRlcyBpbiB0aGUgVEVFIChvciBpcyBhY2Nlc3NpYmxlIG9ubHkgdG8gdGhlIFRFRSku DQoNCkNhbiB5b3UgcGljayBhcGFydCBteSB1bmRlcnN0YW5kaW5nIG9mIHRoZSB0d28gZGVmaW5p dGlvbnMgb2Yga2V5cywgYW5kIGhlbHAgbWUgdW5kZXJzdGFuZCB3aGVyZSBJIGdvdCB0aHJvd24g b2ZmPw0KDQpUaGFua3MsDQpEYXZlIFdoZWVsZXINCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0t LS0NCkZyb206IEhhbm5lcyBUc2Nob2ZlbmlnIFttYWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJt LmNvbTxtYWlsdG86SGFubmVzLi5Uc2Nob2ZlbmlnQGFybS5jb20+XQ0KU2VudDogVGh1cnNkYXks IEp1bHkgNSwgMjAxOCAxMjo0MSBQTQ0KVG86IFdoZWVsZXIsIERhdmlkIE0gPGRhdmlkLm0ud2hl ZWxlckBpbnRlbC5jb208bWFpbHRvOmRhdmlkLm0ud2hlZWxlckBpbnRlbC5jb20+PjsgdGVlcEBp ZXRmLm9yZzxtYWlsdG86dGVlcEBpZXRmLm9yZz4NClN1YmplY3Q6IFJFOiBbVGVlcF0gQ29tbWVu dHMgb24gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVjdHVyZS0wMC50eHQNCg0K SnVzdCBhIHF1aWNrIHJlbWFyazogSU1ITyByb290IG9mIHRydXN0IGFuZCB0cnVzdCBhbmNob3Ig YXJlIHRoZSBzYW1lIHRoaW5nLiBJIGJlbGlldmUgd2Ugc2hvdWxkIHVwZGF0ZSB0aGUgdGV4dCB0 byBvbmx5IHRhbGsgYWJvdXQgdHJ1c3QgYW5jaG9ycyBhbmQgZm9yZ2V0IHRoZSByb290IG9mIHRy dXN0IHRlcm1pbm9sb2d5Lg0KDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBU RUVQIFttYWlsdG86dGVlcC1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgV2hlZWxlciwg RGF2aWQgTQ0KU2VudDogMDUgSnVseSAyMDE4IDIxOjM4DQpUbzogdGVlcEBpZXRmLm9yZzxtYWls dG86dGVlcEBpZXRmLm9yZz4NClN1YmplY3Q6IFtUZWVwXSBDb21tZW50cyBvbiBJLUQgQWN0aW9u OiBkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlLTAwLnR4dA0KDQpJIGhhdmUgc2V2ZXJhbCBj b21tZW50cyBvbiB0aGUgbmV3IGFyY2hpdGVjdHVyZSBkcmFmdC4NCg0KVGhlIGZpcnN0IGNvbW1l bnQgaGFzIHRvIGRvIHdpdGggdGhlIGRlZmluaXRpb24gb2YgdGhlICJUcnVzdCBBbmNob3IiIChw YWdlIDQpDQoNClRoZSBkZWZpbml0aW9uIHN0YXRlczoNClRydXN0IEFuY2hvcjogQSByb290IGNl cnRpZmljYXRlIHRoYXQgY2FuIGJlIHVzZWQgdG8gdmFsaWRhdGUgaXRzDQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgY2VydGlmaWNhdGVzLiBJdCBpcyB1c3VhbGx5IGVtYmVkZGVkIGluIGEg ZGV2aWNlIG9yDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgY29uZmlndXJlZCBieSBhIFRB TSBmb3IgdmFsaWRhdGluZyB0aGUgdHJ1c3Qgb2YgYSByZW1vdGUgZW50aXR5J3MNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZS4NCg0KVGhlbiBsYXRlciBpbiBzZWN0aW9u IDMgKHBhZ2UgNikNClRoaXMgc3BlY2lmaWNhdGlvbiBhc3N1bWVzIHRoYXQgYW4gYXBwbGljYWJs ZSBkZXZpY2UgaXMgZXF1aXBwZWQgd2l0aCAgb25lIG9yIG1vcmUgVEVFcyBhbmQgZWFjaCBURUUg aXMgcHJlLXByb3Zpc2lvbmVkIHdpdGggYSBkZXZpY2UtdW5pcXVlICBwdWJsaWMvcHJpdmF0ZSBr ZXkgcGFpciwgd2hpY2ggaXMgc2VjdXJlbHkgc3RvcmVkLiBUaGlzIGtleSBwYWlyIGlzICByZWZl cnJlZCB0byBhcyB0aGUgJ3Jvb3Qgb2YgdHJ1c3QnIGZvciByZW1vdGUgYXR0ZXN0YXRpb24gb2Yg dGhlICBhc3NvY2lhdGVkIFRFRSBpbiBhIGRldmljZSBieSBhbiBUQU0uDQoNCg0KSXQgaXMgbm90 IGNsZWFyIHdoZXRoZXIgdGhlICJUcnVzdCBBbmNob3IiIGlzIHRoZSBzYW1lIGFzIHRoZSAicm9v dC1vZi10cnVzdCIga2V5IHBhaXIsIHNpbmNlIHRoZSAicm9vdC1vZi10cnVzdCIgaXMgbm90IGlu Y2x1ZGVkIGluIHRoZSBkZWZpbml0aW9ucy4uDQoNCklmIHRoZXkgYXJlIGludGVuZGVkIHRvIGJl IGRpZmZlcmVudCAod2hpY2ggaXMgd2hhdCBJIGJlbGlldmUpLCB0aGVuIEkgc3VnZ2VzdCB3ZSBh ZGQgdGhlICJyb290LW9mLXRydXN0IiB0byB0aGUgZGVmaW5pdGlvbnMsIGFuZCBleHBsYWluIHRo ZSBkaWZmZXJlbmNlLiBPZnRlbnRpbWVzLCBpbiBteSBleHBlcmllbmNlLCB0aGVzZSB0ZXJtcyBh cmUgdXNlZCBpbnRlcmNoYW5nZWFibHkuDQoNCkhlcmUgaXMgbXkgYXR0ZW1wdCB0byBjcmVhdGUg ZGVmaW5pdGlvbnMgZm9yIHRoZXNlIHR3byB0eXBlcyBvZiBrZXlzOg0KDQpUcnVzdCBBbmNob3I6 IEEgdHJ1c3QgYW5jaG9yIGlzIHB1YmxpYyBhc3ltbWV0cmljIGtleSwgcHJlZmVyYWJseSBjb250 YWluZWQgaW4gYSBjZXJ0aWZpY2F0ZQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoYXQg cmVwcmVzZW50cyBhIHRydXN0ZWQgZW50aXR5IHRvIGEgZGV2aWNlLiBUaGlzIHB1YmxpYyBrZXkg bWF5IGJlIHVzZWQgYnkNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgaG9sZGVyIG9m IHRoZSBjb3JyZXNwb25kaW5nIHByaXZhdGUga2V5IHRvIHNpZ24gb3RoZXIgY2VydGlmaWNhdGVz LA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZXJlYnkgY29tbXVuaWNhdGluZyB0aGUg c2lnbmVkIGNlcnRpZmljYXRlIG1heSBhbHNvIGJlIHRydXN0ZWQuDQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgVGhlIHRydXN0IGFuY2hvciBpcyB1c3VhbGx5IGVtYmVkZGVkIGluIGEgZGV2 aWNlIG9yIGNvbmZpZ3VyZWQgYnkgYSBUQU0NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg YW5kIHVzZWQgYnkgdGhlIGRldmljZSB0byB2YWxpZGF0ZSB0aGUgdHJ1c3Qgb2YgYSByZW1vdGUg ZW50aXR5IGJ5DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgdmVyaWZ5aW5nIHRoYXQgZW50 aXR5J3MgY2VydGlmaWNhdGUgaXMgc2lnbmVkIGJ5IGEgdHJ1c3QgYW5jaG9yLg0KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBUcnVzdCBhbmNob3JzIG11c3QgYmUgc3RvcmVkIGluIGEgd2F5 IHRoYXQgcHJldmVudHMgb3Igc3Ryb25nbHkgcmVzaXN0cw0KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBtb2RpZmljYXRpb24gYnkgdW5hdXRob3JpemVkIHNvZnR3YXJlIGFuZCBoYXJkd2Fy ZSBhZHZlcnNhcmllcy4NCiAgICAgICAgICBBbiBleGFtcGxlIG9mIGEgdHJ1c3QgYW5jaG9yIGlz IHRoZSBwdWJsaWMga2V5IG9mIGEgVEFNIG9yIFNQIHdoaWNoIGlzDQogICAgICAgICAgICAgICAg ICAgICAgICAgICJwaW5uZWQiIG9yIHNlY3VyZWx5IHN0b3JlZCBpbnNpZGUgdGhlIGRldmljZSwg YW5kIHRoYXQgdHJ1c3QgYW5jaG9yIGlzIHVzZWQNCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICBsaWtlIGEgQ0EgY2VydGlmaWNhdGUgdG8gdmFsaWRhdGUgdGhlIHRydXN0IGluIG90aGVyIGtl eXMvY2VydGlmaWNhdGVzLg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgQSB0cnVzdCBhbmNo b3IgbWF5IGJlIHZpZXdlZCBieSBib3RoIHRydXN0ZWQgYW5kIHVudHJ1c3RlZCBlbnRpdGllcyBv biB0aGUgZGV2aWNlLA0KICAgICAgICAgICAgICAgICAgICAgICAgICBCdXQgbWF5IG9ubHkgYmUg bW9kaWZpZWQgb3IgZGVsZXRlZCBieSBhIHRydXN0ZWQgZW50aXR5Lg0KDQpSb290LW9mLVRydXN0 IEtleTogIEEgZGV2aWNlLXVuaXF1ZSBrZXkgZ2VuZXJhdGVkIGF0IGRldmljZSBtYW51ZmFjdHVy aW5nIG9yIGF0DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgVEVFIHByb3Zpc2lvbmluZywg d2hpY2ggaXMgc2VjdXJlbHkgc3RvcmVkIGFuZCBvbmx5IGFjY2Vzc2libGUgdG8gdGhlIFRFRS4N CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGUgUm9vdC1vZi1UcnVzdCBLZXkgaXMgdXNl ZCBmb3IgYXR0ZXN0YXRpb24gc2lnbmluZyB3aGljaCBwcm92ZXMgdGhlIHNpZ25lZA0KICAgICAg ICAgICAgICAgICAgICAgICAgICAgIG1lc3NhZ2Ugb3JpZ2luYXRlZCBvciB3YXMgYXBwcm92ZWQg YnkgdGhlIFRFRSwgYW5kIG1heSBiZSB0cnVzdGVkIHRvIHRoZSBzYW1lDQogICAgICAgICAgICAg ICAgICAgICAgICAgICBkZWdyZWUgYXMgdGhlIFRFRS4NCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdl LS0tLS0NCkZyb206IFRFRVAgW21haWx0bzp0ZWVwLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFs ZiBPZiBpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc8bWFpbHRvOmludGVybmV0LWRyYWZ0c0BpZXRm Lm9yZz4NClNlbnQ6IFdlZG5lc2RheSwgSnVseSA0LCAyMDE4IDc6NDkgQU0NClRvOiBpLWQtYW5u b3VuY2VAaWV0Zi5vcmc8bWFpbHRvOmktZC1hbm5vdW5jZUBpZXRmLm9yZz4NCkNjOiB0ZWVwQGll dGYub3JnPG1haWx0bzp0ZWVwQGlldGYub3JnPg0KU3ViamVjdDogW1RlZXBdIEktRCBBY3Rpb246 IGRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUtMDAudHh0DQoNCg0KQSBOZXcgSW50ZXJuZXQt RHJhZnQgaXMgYXZhaWxhYmxlIGZyb20gdGhlIG9uLWxpbmUgSW50ZXJuZXQtRHJhZnRzIGRpcmVj dG9yaWVzLg0KVGhpcyBkcmFmdCBpcyBhIHdvcmsgaXRlbSBvZiB0aGUgVHJ1c3RlZCBFeGVjdXRp b24gRW52aXJvbm1lbnQgUHJvdmlzaW9uaW5nIFdHIG9mIHRoZSBJRVRGLg0KDQogICAgICAgIFRp dGxlICAgICAgICAgICA6IFRydXN0ZWQgRXhlY3V0aW9uIEVudmlyb25tZW50IFByb3Zpc2lvbmlu ZyAoVEVFUCkgQXJjaGl0ZWN0dXJlDQogICAgICAgIEF1dGhvcnMgICAgICAgICA6IE1pbmdsaWFu ZyBQZWkNCiAgICAgICAgICAgICAgICAgICAgICAgICAgSGFubmVzIFRzY2hvZmVuaWcNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgQW5kcmV3IEF0eWVvDQogICAgICAgICAgICAgICAgICAgICAg ICAgIERhcGVuZw0KRmlsZW5hbWUgICAgICAgIDogZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVjdHVy ZS0wMC50eHQNClBhZ2VzICAgICAgICAgICA6IDI0DQpEYXRlICAgICAgICAgICAgOiAyMDE4LTA3 LTAyDQoNCkFic3RyYWN0Og0KICAgQSBUcnVzdGVkIEV4ZWN1dGlvbiBFbnZpcm9ubWVudCAoVEVF KSB3YXMgZGVzaWduZWQgdG8gcHJvdmlkZSBhDQogICBoYXJkd2FyZS1pc29sYXRpb24gbWVjaGFu aXNtIHRvIHNlcGFyYXRlIGEgcmVndWxhciBvcGVyYXRpbmcgc3lzdGVtDQogICBmcm9tIHNlY3Vy aXR5LSBzZW5zaXRpdmUgYXBwbGljYXRpb25zLg0KDQogICBUaGlzIGFyY2hpdGVjdHVyZSBkb2N1 bWVudCBtb3RpdmF0ZXMgdGhlIGRlc2lnbiBhbmQgc3RhbmRhcmRpemF0aW9uDQogICBvZiBhIHBy b3RvY29sIGZvciBtYW5hZ2luZyB0aGUgbGlmZWN5bGUgb2YgdHJ1c3RlZCBhcHBsaWNhdGlvbnMN CiAgIHJ1bm5pbmcgaW5zaWRlIGEgVEVFLg0KDQoNClRoZSBJRVRGIGRhdGF0cmFja2VyIHN0YXR1 cyBwYWdlIGZvciB0aGlzIGRyYWZ0IGlzOg0KaHR0cHM6Ly9uYTAxLnNhZmVsaW5rcy5wcm90ZWN0 aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZkYXRhdHJhY2tlci5pZXRmLm9yZyUy RmRvYyUyRmRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUlMkYmYW1wO2RhdGE9MDIlN0MwMSU3 Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDOTZhNDc4NTZiYTY1NDllOTkyNmYwOGQ1ZTJiMGM1 ZmMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM2NjY0MTcx MjIzNTQxOTAyJmFtcDtzZGF0YT1YQnVUbHNpVjVPamt4a2NxVUxkc21yb1RuV1JacUFwSDNmQm9r Skd2a1RFJTNEJmFtcDtyZXNlcnZlZD0wPGh0dHBzOi8vbmEwMS5zYWZlbGlua3MucHJvdGVjdGlv bi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkZk b2MlMkZkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlJTJGJmRhdGE9MDIlN0MwMSU3Q2R0aGFs ZXIlNDBtaWNyb3NvZnQuY29tJTdDYTk5ODZlMDMzZTlhNGRmOGJiMzYwOGQ1ZTMzMmIxYTAlN0M3 MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM2NjY0NzI5MjQwNzAw ODMwJnNkYXRhPVFnSHBFUTZjcVB6ak5TTkFYbE9CVkpmbWJIenBEb2dWTkpOcFdJNnVQemclM0Qm cmVzZXJ2ZWQ9MD4NCg0KVGhlcmUgYXJlIGFsc28gaHRtbGl6ZWQgdmVyc2lvbnMgYXZhaWxhYmxl IGF0Og0KaHR0cHM6Ly9uYTAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9 aHR0cHMlM0ElMkYlMkZ0b29scy5pZXRmLm9yZyUyRmh0bWwlMkZkcmFmdC1pZXRmLXRlZXAtYXJj aGl0ZWN0dXJlLTAwJmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3 Qzk2YTQ3ODU2YmE2NTQ5ZTk5MjZmMDhkNWUyYjBjNWZjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNjY2NDE3MTIyMzU0MTkwMiZhbXA7c2RhdGE9aGVPMXhs eGZyVlp5eXpZemlReThWMlAwdnhpRWJUVlNGOHNGZE5hdzhzYyUzRCZhbXA7cmVzZXJ2ZWQ9MDxo dHRwczovL25hMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRtbCUyRmRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1 cmUtMDAmZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1pY3Jvc29mdC5jb20lN0NhOTk4NmUwMzNl OWE0ZGY4YmIzNjA4ZDVlMzMyYjFhMCU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3 JTdDMSU3QzAlN0M2MzY2NjQ3MjkyNDA3MTA4MzUmc2RhdGE9eUxia2d1S05wV29iR1NRYmZDSTNY VExhTEpQSE81cFg3eTB1ek01YVFwSSUzRCZyZXNlcnZlZD0wPg0KaHR0cHM6Ly9uYTAxLnNhZmVs aW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZkYXRhdHJhY2tl ci5pZXRmLm9yZyUyRmRvYyUyRmh0bWwlMkZkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlLTAw JmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Qzk2YTQ3ODU2YmE2 NTQ5ZTk5MjZmMDhkNWUyYjBjNWZjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzNjY2NDE3MTIyMzU0MTkwMiZhbXA7c2RhdGE9YW9LVyUyRkZubHp6THhwT3dF cG1LWjZJc092ZzhUamk4R3c0WWFiWEFjUzU0JTNEJmFtcDtyZXNlcnZlZD0wPGh0dHBzOi8vbmEw MS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZGF0 YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZodG1sJTJGZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVj dHVyZS0wMCZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Q2E5OTg2ZTAz M2U5YTRkZjhiYjM2MDhkNWUzMzJiMWEwJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRi NDclN0MxJTdDMCU3QzYzNjY2NDcyOTI0MDcyMDg0MCZzZGF0YT1pekVLcGR0akpQYWgyZG9yVWJF YzdaZEpaSkF2UElURTlpb3AlMkJ0dUZybXMlM0QmcmVzZXJ2ZWQ9MD4NCg0KDQpQbGVhc2Ugbm90 ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBz dWJtaXNzaW9uIHVudGlsIHRoZSBodG1saXplZCB2ZXJzaW9uIGFuZCBkaWZmIGFyZSBhdmFpbGFi bGUgYXQgdG9vbHMuaWV0Zi5vcmc8aHR0cDovL3Rvb2xzLmlldGYub3JnPi4NCg0KSW50ZXJuZXQt RHJhZnRzIGFyZSBhbHNvIGF2YWlsYWJsZSBieSBhbm9ueW1vdXMgRlRQIGF0Og0KZnRwOi8vZnRw LmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy8NCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18NClRFRVAgbWFpbGluZyBsaXN0DQpURUVQQGlldGYub3JnPG1h aWx0bzpURUVQQGlldGYub3JnPg0KaHR0cHM6Ly9uYTAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91 dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlz dGluZm8lMkZ0ZWVwJmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3 Qzk2YTQ3ODU2YmE2NTQ5ZTk5MjZmMDhkNWUyYjBjNWZjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNjY2NDE3MTIyMzU0MTkwMiZhbXA7c2RhdGE9N3g3Y2dU dldaT3NuV0VERDloUXVSUnZ3R3ZCNFRUcGwwb2tJUFNoWHRkMCUzRCZhbXA7cmVzZXJ2ZWQ9MDxo dHRwczovL25hMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRlZXAmZGF0YT0wMiU3 QzAxJTdDZHRoYWxlciU0MG1pY3Jvc29mdC5jb20lN0NhOTk4NmUwMzNlOWE0ZGY4YmIzNjA4ZDVl MzMyYjFhMCU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzY2 NjQ3MjkyNDA3MzA4NDkmc2RhdGE9dnhlZGVjRXdPWE1MMWtEREV2Q1ZPbVpXeVZwN0pGNmpreSUy Qm5HZ1plVTV3JTNEJnJlc2VydmVkPTA+DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQpURUVQIG1haWxpbmcgbGlzdA0KVEVFUEBpZXRmLm9yZzxtYWls dG86VEVFUEBpZXRmLm9yZz4NCmh0dHBzOi8vbmEwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRs b29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3Rp bmZvJTJGdGVlcCZhbXA7ZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1pY3Jvc29mdC5jb20lN0M5 NmE0Nzg1NmJhNjU0OWU5OTI2ZjA4ZDVlMmIwYzVmYyU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3 Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzY2NjQxNzEyMjM1NDE5MDImYW1wO3NkYXRhPTd4N2NnVHZX Wk9zbldFREQ5aFF1UlJ2d0d2QjRUVHBsMG9rSVBTaFh0ZDAlM0QmYW1wO3Jlc2VydmVkPTA8aHR0 cHM6Ly9uYTAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0El MkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0ZWVwJmRhdGE9MDIlN0Mw MSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDYTk5ODZlMDMzZTlhNGRmOGJiMzYwOGQ1ZTMz MmIxYTAlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM2NjY0 NzI5MjQwNzMwODQ5JnNkYXRhPXZ4ZWRlY0V3T1hNTDFrRERFdkNWT21aV3lWcDdKRjZqa3klMkJu R2daZVU1dyUzRCZyZXNlcnZlZD0wPg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9m IHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkg YWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50 LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9z ZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9z ZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsg eW91Lg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K VEVFUCBtYWlsaW5nIGxpc3QNClRFRVBAaWV0Zi5vcmc8bWFpbHRvOlRFRVBAaWV0Zi5vcmc+DQpo dHRwczovL25hMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRlZXAmYW1wO2RhdGE9 MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDOTZhNDc4NTZiYTY1NDllOTkyNmYw OGQ1ZTJiMGM1ZmMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdD NjM2NjY0MTcxMjIzNTQxOTAyJmFtcDtzZGF0YT03eDdjZ1R2V1pPc25XRUREOWhRdVJSdndHdkI0 VFRwbDBva0lQU2hYdGQwJTNEJmFtcDtyZXNlcnZlZD0wPGh0dHBzOi8vbmEwMS5zYWZlbGlua3Mu cHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJG bWFpbG1hbiUyRmxpc3RpbmZvJTJGdGVlcCZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9z b2Z0LmNvbSU3Q2E5OTg2ZTAzM2U5YTRkZjhiYjM2MDhkNWUzMzJiMWEwJTdDNzJmOTg4YmY4NmYx NDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNjY2NDcyOTI0MDc0MDg2MiZzZGF0YT1C TTNDR2dZZTk5ZXFVM0NyOWo4Q1ozUjlMSXhEMHljS25UOCUyRkVNd1VxalUlM0QmcmVzZXJ2ZWQ9 MD4NCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRF RVAgbWFpbGluZyBsaXN0DQpURUVQQGlldGYub3JnPG1haWx0bzpURUVQQGlldGYub3JnPg0KaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90ZWVwPGh0dHBzOi8vbmEwMS5zYWZl bGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmlldGYu b3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGdGVlcCZkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQw bWljcm9zb2Z0LmNvbSU3Q2E5OTg2ZTAzM2U5YTRkZjhiYjM2MDhkNWUzMzJiMWEwJTdDNzJmOTg4 YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNjY2NDcyOTI0MDc1MDg2MyZz ZGF0YT1LdVRUc0FoRVRaQ21DR3dvMVkzcm1na2hDTTh3NU1xOEpreHhjTEwyNk44JTNEJnJlc2Vy dmVkPTA+DQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQg YW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVn ZWQuLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5 IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMg dG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3Ig Y29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRFRVAgbWFpbGluZyBsaXN0 DQpURUVQQGlldGYub3JnPG1haWx0bzpURUVQQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby90ZWVwDQoNCg== --_000_9F2A757C7D904755BD91BB522970F805qtiqualcommcom_ Content-Type: text/html; charset="utf-8" Content-ID: <4B5026F0331FD146B2C393EDAE249874@qualcomm.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJ3b3JkLXdy YXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgbGluZS1icmVhazogYWZ0 ZXItd2hpdGUtc3BhY2U7IiBjbGFzcz0iIj4NCjxkaXYgY2xhc3M9IiI+VXNlIG9mIHRoZSBOSVNU IHRlcm1pbm9sb2d5IHdvdWxkIGFsc28gbWFpbnRhaW4gYWxpZ25tZW50IHdpdGggR2xvYmFsUGxh dGZvcm0gLSBib3RoIFRDRyBhbmQgR2xvYmFsUGxhdGZvcm0gZXhwYW5kIHNvbWV3aGF0IG9uIE5J U1QgZGVmaW5pdGlvbnMgZHVlIHRvIGRpZmZlcmVuY2VzIGluIHVzZS1jYXNlIGFuZCBhcmNoaXRl Y3R1cmUsIGJ1dCBOSVNUIGlzIGEgY29tbW9uIHJvb3Qgd2hpY2ggaXMgd2VsbCB1bmRlcnN0b29k DQogaW4gYm90aCB0aGUgR2xvYmFsUGxhdGZvcm0gYW5kIFRDRyBzcGVjaWZpY2F0aW9ucyAtIHRo ZXJlIGlzIGFuIGVudGlyZSBkb2N1bWVudCBjb3ZlcmluZyB0aGlzIGF0IEdsb2JhbFBsYXRmb3Jt ICg8YSBocmVmPSJodHRwczovL2dsb2JhbHBsYXRmb3JtLm9yZy93cC1jb250ZW50L3VwbG9hZHMv MjAxOC8wNi9HUF9Sb1RfRGVmaW5pdGlvbnNfYW5kX1JlcXVpcmVtZW50c192MS4wLjFfUHVibGlj UmVsZWFzZV9DQy5wZGYiIGNsYXNzPSIiPmh0dHBzOi8vZ2xvYmFscGxhdGZvcm0ub3JnL3dwLWNv bnRlbnQvdXBsb2Fkcy8yMDE4LzA2L0dQX1JvVF9EZWZpbml0aW9uc19hbmRfUmVxdWlyZW1lbnRz X3YxLjAuMV9QdWJsaWNSZWxlYXNlX0NDLnBkZjwvYT4mbmJzcDstDQogbm90ZSB0aGF0IHRoaXMg d2lsbCBzaG9ydGx5IGJlIHVwZGF0ZWQpPC9kaXY+DQo8ZGl2PjxiciBjbGFzcz0iIj4NCjwvZGl2 Pg0KPGRpdj5KZXJlbXk8L2Rpdj4NCjxkaXY+PGJyIGNsYXNzPSIiPg0KPGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSIgY2xhc3M9IiI+DQo8ZGl2IGNsYXNzPSIiPk9uIDYgSnVsIDIwMTgsIGF0IDE1OjM3 LCBEYXZlIFRoYWxlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOmR0aGFsZXI9NDBtaWNyb3NvZnQuY29t QGRtYXJjLmlldGYub3JnIiBjbGFzcz0iIj5kdGhhbGVyPTQwbWljcm9zb2Z0LmNvbUBkbWFyYy5p ZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjwvZGl2Pg0KPGJyIGNsYXNzPSJBcHBsZS1pbnRlcmNoYW5n ZS1uZXdsaW5lIj4NCjxkaXYgY2xhc3M9IiI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiIHN0 eWxlPSJwYWdlOiBXb3JkU2VjdGlvbjE7IGNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQt ZmFtaWx5OiBIZWx2ZXRpY2E7IGZvbnQtc2l6ZTogMTJweDsgZm9udC1zdHlsZTogbm9ybWFsOyBm b250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3Bh Y2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10 cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAt d2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiPg0K PGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZv bnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQpbc3BlYWtpbmcgYXMg YW4gaW5kaXZpZHVhbCBwYXJ0aWNpcGFudF08bzpwIGNsYXNzPSIiPjwvbzpwPjwvZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQt ZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8bzpwIGNsYXNzPSIiPiZu YnNwOzwvbzpwPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBm b250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9 IiI+DQpUaGUgV0cgY2hhcnRlciBzYXlzIOKAnFRoZSBncm91cCB3aWxsIG1haW50YWluIGEgY2xv c2UgcmVsYXRpb25zaGlwIHdpdGggdGhlIOKApiBUcnVzdGVkIENvbXB1dGluZyBHcm91cCwgYW5k IG90aGVyIHJlbGV2YW50IHN0YW5kYXJkcyBncm91cHMuLi7igJ0gYW5kIEkgdGhpbmsgcGFydCBv ZiB0aGF0IGlzIHRvIHVzZSBjb25zaXN0ZW50IHRlcm1pbm9sb2d5LiZuYnNwOyBIZW5jZSBteSBy ZWNvbW1lbmRhdGlvbiB0aGF0IERhdmlkIFdoZWVsZXIgYWxyZWFkeSBpbmNvcnBvcmF0ZWQNCiBp bnRvIGhpcyBwcm9wb3NlZCB0ZXh0LiZuYnNwOyAoVGhhbmtzIERhdmlkKTxvOnAgY2xhc3M9IiI+ PC9vOnA+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQt c2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4N CjxvOnAgY2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBp biAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7IiBjbGFzcz0iIj4NCkRhdmU8bzpwIGNsYXNzPSIiPjwvbzpwPjwvZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQt ZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBzdHlsZT0iY29s b3I6IHJnYigzMSwgNzMsIDEyNSk7IiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L2Rpdj4NCjxkaXYgY2xhc3M9IiI+DQo8ZGl2IHN0eWxlPSJib3JkZXItc3R5bGU6 IHNvbGlkIG5vbmUgbm9uZTsgYm9yZGVyLXRvcC13aWR0aDogMXB0OyBib3JkZXItdG9wLWNvbG9y OiByZ2IoMjI1LCAyMjUsIDIyNSk7IHBhZGRpbmc6IDNwdCAwaW4gMGluOyIgY2xhc3M9IiI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9u dC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxiIGNsYXNzPSIiPkZy b206PC9iPjxzcGFuIGNsYXNzPSJBcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5I YW5uZXMgVHNjaG9mZW5pZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkhhbm5lcy5Uc2Nob2ZlbmlnQGFy bS5jb20iIGNsYXNzPSIiPkhhbm5lcy5Uc2Nob2ZlbmlnQGFybS5jb208L2E+Jmd0OzxzcGFuIGNs YXNzPSJBcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnIgY2xhc3M9IiI+DQo8 YiBjbGFzcz0iIj5TZW50OjwvYj48c3BhbiBjbGFzcz0iQXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+RnJpZGF5LCBKdWx5IDYsIDIwMTggNDoyMiBBTTxiciBjbGFzcz0iIj4NCjxi IGNsYXNzPSIiPlRvOjwvYj48c3BhbiBjbGFzcz0iQXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+QW5kcmV3IEF0eWVvICZsdDs8YSBocmVmPSJtYWlsdG86QW5kcmV3LkF0eWVvQGlu dGVyY2VkZS5jb20iIGNsYXNzPSIiPkFuZHJldy5BdHllb0BpbnRlcmNlZGUuY29tPC9hPiZndDs7 IERhdmUgVGhhbGVyICZsdDs8YSBocmVmPSJtYWlsdG86ZHRoYWxlckBtaWNyb3NvZnQuY29tIiBj bGFzcz0iIj5kdGhhbGVyQG1pY3Jvc29mdC5jb208L2E+Jmd0OzsgV2hlZWxlciwNCiBEYXZpZCBN ICZsdDs8YSBocmVmPSJtYWlsdG86ZGF2aWQubS53aGVlbGVyQGludGVsLmNvbSIgY2xhc3M9IiI+ ZGF2aWQubS53aGVlbGVyQGludGVsLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOnRlZXBA aWV0Zi5vcmciIGNsYXNzPSIiPnRlZXBAaWV0Zi5vcmc8L2E+PGJyIGNsYXNzPSIiPg0KPGIgY2xh c3M9IiI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9IkFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPlJFOiBbVGVlcF0gQ29tbWVudHMgb24gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi10 ZWVwLWFyY2hpdGVjdHVyZS0wMC50eHQ8bzpwIGNsYXNzPSIiPjwvbzpwPjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXpl OiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPG86 cCBjbGFzcz0iIj4mbmJzcDs8L286cD48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBp biAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1z ZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJjb2xvcjogcmdiKDMx LCA3MywgMTI1KTsiIGNsYXNzPSIiPlRoZSBwcm9ibGVtIGlzIG9ubHkgdGhhdCDigJxyb290IG9m IHRydXN04oCdIGlzIG5vdCBhIHdlbGwgZGVmaW5lZCB0ZXJtIGluIHRoZSBJRVRGLCBhdCBsZWFz dCBhcyBmYXIgYXMgSSBrbm93LiBUcnVzdCBhbmNob3IsIG9uIHRoZSBvdGhlciBoYW5kLCBpcyB3 ZWxsIGRlZmluZWQuPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6 IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iY29sb3I6IHJnYigzMSwgNzMsIDEyNSk7IiBjbGFzcz0iIj5UaGUgZGVmaW5pdGlvbiBjdXJy ZW50bHkgaW4gdGhlIGRvY3VtZW50IGZvciByb290IG9mIHRydXN0IHNlZW1zIHRvIGJlIHNpbWls YXIgdG8gdHJ1c3QgYW5jaG9yLiBIb3dldmVyLCBJIGFncmVlIHdpdGggYm90aCBBbmR5IGFuZCB3 aXRoIERhdmlkIHRoYXQgd2UgbmVlZCB0byBmaW5kIG91dCB3aGV0aGVyIHdlIHdhbnQgdG8gcG9p bnQgb3V0DQogY2VydGFpbiB1c2FnZXMgb2YgdGhlIGtleSAoc3VjaCBhcyBmb3IgdGhlIHB1cnBv c2Ugb2YgdGhlIGF0dGVzdGF0aW9uKS4gV2hldGhlciB0aGlzIGp1c3RpZmllcyB0aGUgaW50cm9k dWN0aW9uIG9mIGFub3RoZXIgdGVybSBpcyB5ZXQgYW5vdGhlciBkaXNjdXNzaW9uPG86cCBjbGFz cz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4w MDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7 IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29sb3I6IHJnYigzMSwgNzMs IDEyNSk7IiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4N CjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBm b250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJjb2xvcjogcmdiKDMxLCA3MywgMTI1KTsiIGNsYXNzPSIiPkNpYW88bzpw IGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBp biAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1z ZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJjb2xvcjogcmdiKDMx LCA3MywgMTI1KTsiIGNsYXNzPSIiPkhhbm5lczxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwv ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDEx cHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImNvbG9yOiByZ2IoMzEsIDczLCAxMjUpOyIgY2xhc3M9IiI+PG86 cCBjbGFzcz0iIj4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46 IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmks IHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29sb3I6 IHJnYigzMSwgNzMsIDEyNSk7IiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwv c3Bhbj48L2Rpdj4NCjxkaXYgY2xhc3M9IiI+DQo8ZGl2IHN0eWxlPSJib3JkZXItc3R5bGU6IHNv bGlkIG5vbmUgbm9uZTsgYm9yZGVyLXRvcC13aWR0aDogMXB0OyBib3JkZXItdG9wLWNvbG9yOiBy Z2IoMTgxLCAxOTYsIDIyMyk7IHBhZGRpbmc6IDNwdCAwaW4gMGluOyIgY2xhc3M9IiI+DQo8ZGl2 IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1m YW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxiIGNsYXNzPSIiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5OiBUYWhvbWEsIHNhbnMtc2VyaWY7 IiBjbGFzcz0iIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTBwdDsg Zm9udC1mYW1pbHk6IFRhaG9tYSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPjxzcGFuIGNsYXNzPSJB cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5BbmRyZXcgQXR5ZW8gWzxhIGhyZWY9 Im1haWx0bzpBbmRyZXcuQXR5ZW9AaW50ZXJjZWRlLmNvbSIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5 LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0iIj5tYWlsdG86 QW5kcmV3LkF0eWVvQGludGVyY2VkZS5jb208L2E+XTxzcGFuIGNsYXNzPSJBcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnIgY2xhc3M9IiI+DQo8YiBjbGFzcz0iIj5TZW50Ojwv Yj48c3BhbiBjbGFzcz0iQXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+MDYgSnVs eSAyMDE4IDEwOjM4PGJyIGNsYXNzPSIiPg0KPGIgY2xhc3M9IiI+VG86PC9iPjxzcGFuIGNsYXNz PSJBcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5EYXZlIFRoYWxlcjsgV2hlZWxl ciwgRGF2aWQgTTsgSGFubmVzIFRzY2hvZmVuaWc7PHNwYW4gY2xhc3M9IkFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp0ZWVwQGlldGYub3JnIiBzdHls ZT0iY29sb3I6IHJnYigxNDksIDc5LCAxMTQpOyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsi IGNsYXNzPSIiPnRlZXBAaWV0Zi5vcmc8L2E+PGJyIGNsYXNzPSIiPg0KPGIgY2xhc3M9IiI+U3Vi amVjdDo8L2I+PHNwYW4gY2xhc3M9IkFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PlJFOiBbVGVlcF0gQ29tbWVudHMgb24gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi10ZWVwLWFyY2hp dGVjdHVyZS0wMC50eHQ8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTog MTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFu IGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAx MXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4g bGFuZz0iRU4tR0IiIGNsYXNzPSIiPkluIE9UclAsIEkgYmVsaWV2ZSAmcXVvdDtyb290IG9mIHRy dXN0JnF1b3Q7IGFuZCAmcXVvdDt0cnVzdCBhbmNob3ImcXVvdDsgYXJlIGN1cnJlbnRseSByZWZl cnJpbmcgdG8gMiBkaWZmZXJlbnQgdGhpbmdzIGluIHRoZSBPVHJQIHNwZWMuPG86cCBjbGFzcz0i Ij48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAx cHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBj bGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNw OzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFw dCAwLjVpbjsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJp ZjsgdGV4dC1pbmRlbnQ6IC0wLjI1aW47IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1mYW1pbHk6IFN5bWJvbDsiIGNsYXNzPSIiPsK3PC9zcGFuPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOiA3cHQ7IGZvbnQtZmFtaWx5OiAmcXVvdDtUaW1lcyBO ZXcgUm9tYW4mcXVvdDssIHNlcmlmOyIgY2xhc3M9IiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9IkFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YiBjbGFzcz0iIj48c3BhbiBsYW5nPSJFTi1HQiIgY2xh c3M9IiI+Um9vdA0KIG9mIHRydXN0PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9iPjwvZGl2 Pg0KPHByZSBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDEwcHQ7 IGZvbnQtZmFtaWx5OiAmcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsiIGNsYXNzPSIiPjxzcGFuIGxh bmc9IkVOLUdCIiBjbGFzcz0iIj5FeGNlcnB0IGZyb20gT1RyUDog4oCcPHNwYW4gc3R5bGU9IiIg Y2xhc3M9IiI+VGhpcyBzcGVjaWZpY2F0aW9uIGFzc3VtZXMgdGhhdCBhbiBhcHBsaWNhYmxlIGRl dmljZSBpcyBlcXVpcHBlZCB3aXRoPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9zcGFuPjwv cHJlPg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDEx cHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTogMTBwdDsgZm9udC1mYW1pbHk6ICZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7OyIgY2xhc3M9IiI+Jm5ic3A7Jm5ic3A7IGEgVEVFIGFuZCBpcyBwcmUt cHJvdmlzaW9uZWQgd2l0aCBhIGRldmljZS11bmlxdWUgcHVibGljL3ByaXZhdGUga2V5PG86cCBj bGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4g MC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2Vy aWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOiAxMHB0 OyBmb250LWZhbWlseTogJnF1b3Q7Q291cmllciBOZXcmcXVvdDs7IiBjbGFzcz0iIj4mbmJzcDsm bmJzcDsgcGFpciwgd2hpY2ggaXMgc2VjdXJlbHkgc3RvcmVkLiZuYnNwOyBUaGlzIGtleSBwYWly IGlzIHJlZmVycmVkIGFzIHRoZTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQt ZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZTogMTBwdDsgZm9udC1mYW1pbHk6ICZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7OyIgY2xhc3M9IiI+Jm5ic3A7Jm5ic3A7ICdyb290IG9mIHRydXN0Jy4mbmJzcDsgQW4g ZW50aXR5IHRoYXQgdXNlcyBzdWNoIGEgZGV2aWNlIHRvIHJ1biBUcnVzdGVkPG86cCBjbGFzcz0i Ij48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAx cHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBj bGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOiAxMHB0OyBmb250 LWZhbWlseTogJnF1b3Q7Q291cmllciBOZXcmcXVvdDs7IiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsg QXBwbGljYXRpb25zIChUQXMpIGlzIGtub3duIGFzIGEgU2VydmljZSBQcm92aWRlciAoU1ApLjwv c3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+4oCdPG86cCBjbGFzcz0iIj48L286cD48 L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQt c2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4N CjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5IZXJlLCDigJxSb290IG9mIFRydXN04oCdIG11 c3QgYmUgdGFsa2luZyBhYm91dCBlaXRoZXIgdGhlIFRFRS9URlcgcHJpdmF0ZSBrZXksIHNvIOKA nHJvb3Qgb2YgdHJ1c3TigJ0gaXMgcmVmZXJyaW5nIHRvIHRoZSBwcm9jZXNzIG9mIHNlY3VyZSBi b290IHRoYXQgcmVzdWx0cyBpbiBhIFRBTSBiZWluZyBhYmxlIHRvIHVzZSBhIHNpZ25hdHVyZSBm cm9tIHRoaXMga2V5IHRvIGtub3cgd2hldGhlciB0byB0cnVzdA0KIHRoZSBURUU8bzpwIGNsYXNz PSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAw MDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsi IGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAw MXB0IDAuNWluOyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNl cmlmOyB0ZXh0LWluZGVudDogLTAuMjVpbjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LWZhbWlseTogU3ltYm9sOyIgY2xhc3M9IiI+wrc8L3NwYW4+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6IDdwdDsgZm9udC1mYW1pbHk6ICZxdW90O1RpbWVz IE5ldyBSb21hbiZxdW90Oywgc2VyaWY7IiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8c3BhbiBjbGFzcz0iQXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxiIGNsYXNzPSIiPjxzcGFuIGxhbmc9IkVOLUdCIiBj bGFzcz0iIj5UcnVzdA0KIEFuY2hvcjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvYj48L2Rp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0 OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFu Zz0iRU4tR0IiIGNsYXNzPSIiPlRoZXJlIGlzIGEgcHJvYmxlbSB0aGlzIHJlZmVycyB0byAyIGNv bXBsZXRlbHkgZGlmZmVyZW50IGNvbmNlcHRzOjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwv ZGl2Pg0KPHByZSBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDEw cHQ7IGZvbnQtZmFtaWx5OiAmcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsiIGNsYXNzPSIiPjxzcGFu IGxhbmc9IkVOLUdCIiBjbGFzcz0iIj7igJw8c3BhbiBzdHlsZT0iIiBjbGFzcz0iIj5TZXR1cCB0 cnVzdCBhbmNob3JzIGluIGRldmljZXM8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L3NwYW4+ PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTog MTBwdDsgZm9udC1mYW1pbHk6ICZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7OyIgY2xhc3M9IiI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSIiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBm b250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5OiAmcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsiIGNs YXNzPSIiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iIiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsg MS4mbmJzcDsgW1RGVy9URUVdIFN0b3JlIHRoZSBrZXkgYW5kIGNlcnRpZmljYXRlIGVuY3J5cHRl ZCB3aXRoIHRoZSBlRnVzZTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBz dHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDEwcHQ7IGZvbnQtZmFt aWx5OiAmcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsiIGNsYXNzPSIiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iIiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg a2V5PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW46 IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTBwdDsgZm9udC1mYW1pbHk6ICZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7OyIgY2xhc3M9IiI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSIiIGNs YXNzPSIiPjxvOnAgY2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHls ZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5 OiAmcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsiIGNsYXNzPSIiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iIiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsgMi4mbmJzcDsgW1RFRSB2ZW5kb3Igb3IgT0VN XSBTdG9yZSB0cnVzdGVkIENBIGNlcnRpZmljYXRlIGxpc3QgaW50bzxvOnAgY2xhc3M9IiI+PC9v OnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBm b250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5OiAmcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsiIGNs YXNzPSIiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iIiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgZGV2aWNlczwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIg Y2xhc3M9IiI+4oCdPHNwYW4gc3R5bGU9IiIgY2xhc3M9IiI+PG86cCBjbGFzcz0iIj48L286cD48 L3NwYW4+PC9zcGFuPjwvcHJlPg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0 OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xh c3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+SGVyZSwg4oCcVHJ1c3QgQW5jaG9y 4oCdIGlzIHJlZmVycmluZyB0byBib3RoIHRoZSBURlcgcHJpdmF0ZSBrZXkgYW5kIHRoZSBUQU0g Q0Egcm9vdCBjZXJ0aWZpY2F0ZSBzdG9yZTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7 IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5n PSJFTi1HQiIgY2xhc3M9IiI+PG86cCBjbGFzcz0iIj4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsg Zm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9 IkVOLUdCIiBjbGFzcz0iIj5CVVQgbGF0ZXIgb24gaW4gdGhlIHNwZWM6PG86cCBjbGFzcz0iIj48 L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7 IGZvbnQtc2l6ZTogMTJwdDsgZm9udC1mYW1pbHk6ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90 Oywgc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj7igJxUaGUg cm9vdCBDQSBjZXJ0aWZpY2F0ZXMgZm9yIGEgVEFNLCB3aGljaCBhcmU8bzpwIGNsYXNzPSIiPjwv bzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsg Zm9udC1zaXplOiAxMnB0OyBmb250LWZhbWlseTogJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7 LCBzZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPmVtYmVkZGVk IGludG8gdGhlIHRydXN0IGFuY2hvciBzdG9yZSBpbiBhIGRldmljZSwgc2hvdWxkIGhhdmUgbG9u ZzxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAw aW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBz YW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+bGlmZXRp bWVzIHRoYXQgZG9uJ3QgcmVxdWlyZSBkZXZpY2UgdHJ1c3QgYW5jaG9yIHVwZGF0ZS7igJ08bzpw IGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBp biAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1z ZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPkFuZDxvOnAgY2xh c3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAu MDAwMXB0OyBmb250LXNpemU6IDEycHQ7IGZvbnQtZmFtaWx5OiAmcXVvdDtUaW1lcyBOZXcgUm9t YW4mcXVvdDssIHNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+ 4oCcPC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1mYW1pbHk6ICZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7OyIgY2xhc3M9IiI+VHJ1c3QgQW5jaG9yOiBBIHJvb3QgY2VydGlmaWNh dGUgdGhhdCBjYW4gYmUgdXNlZCB0byB2YWxpZGF0ZSBpdHM8bzpwIGNsYXNzPSIiPjwvbzpwPjwv c3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1z aXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0K PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6IDcuNXB0OyBmb250LWZhbWlseTog JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7IiBjbGFzcz0iIj5jaGlsZHJlbiBjZXJ0aWZpY2F0ZXMu IEl0IGlzIHVzdWFsbHkgZW1iZWRkZWQgaW4gYSBkZXZpY2Ugb3I8bzpwIGNsYXNzPSIiPjwvbzpw Pjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9u dC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIi Pg0KPHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6IDcuNXB0OyBmb250LWZhbWls eTogJnF1b3Q7Q291cmllciBOZXcmcXVvdDs7IiBjbGFzcz0iIj5jb25maWd1cmVkIGJ5IGEgVEFN IGZvciB2YWxpZGF0aW5nIHRoZSB0cnVzdCBvZiBhIHJlbW90ZSBlbnRpdHknczxvOnAgY2xhc3M9 IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAw MXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIg Y2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTogNy41cHQ7IGZv bnQtZmFtaWx5OiAmcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsiIGNsYXNzPSIiPmNlcnRpZmljYXRl Ljwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+4oCdPG86cCBjbGFzcz0iIj48L286 cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZv bnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0i Ij4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5IZXJlLCDigJxUcnVzdCBBbmNob3LigJ0g cmVmZXJzIHRvIHRoZSBUQU0gcm9vdCBDQSB3aGl0ZWxpc3QgdGhhdCBpcyBlbWJlZGRlZCBpbiB0 aGUgVEVFIGluIG9yZGVyIHRvIGFsbG93IHRoZSBURUUgdG8gY2hhaW4gVEFNIGNlcnRpZmljYXRl cyB0byB0aGUgcm9vdCBDQSBjZXJ0cyAodG8gZGV0ZXJtaW5lIHdoYXQgY2VydHMgdG8gdHJ1c3Qp PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBp biAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNs YXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGlu IDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fu cy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPuKAplNvIGl0 IGlzIGJlc3QgaWYgd2UgY2FuIHJlbW92ZSB0aGUgdGVybSDigJx0cnVzdCBhbmNob3LigJ0gd2hl cmV2ZXIgaXQgcmVmZXJzIHRvIHRoZSBjb25jZXB0IG9mIHJvb3QgQ0EgY2VydHMsIGFuZCByZWZl ciB0byDigJxUQU0gcm9vdCBDQSBjZXJ0aWZpY2F0ZSBzdG9yZeKAnSAob3Igc29tZXRoaW5nIGxp a2UgdGhhdCk8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2Fs aWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIi PiwgYW5kIGZvciBldmVyeXdoZXJlIGVsc2UgdGhhdCB1c2VzIOKAnHRydXN0IGFuY2hvcuKAnSB0 byByZWZlciB0byB0aGUgY29uY2VwdCBvZiBzZWN1cmVib290L2F0dGVzdGF0aW9uIGV0Yywgd2Ug bmVlZCB0byBzZXR0bGUgb24gc29tZSBvdGhlciB0ZXJtLiBJbiBzb21lIGNhc2VzPG86cCBjbGFz cz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4w MDAxcHQ7IGZvbnQtc2l6ZTogMTJwdDsgZm9udC1mYW1pbHk6ICZxdW90O1RpbWVzIE5ldyBSb21h biZxdW90Oywgc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5l LmcuIOKAnDwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTogNy41cHQ7 IGZvbnQtZmFtaWx5OiAmcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsiIGNsYXNzPSIiPnBhaXIsIHdo aWNoIGlzIHNlY3VyZWx5IHN0b3JlZCBpbiB0aGUgVEVFLiBUaGlzIGtleSBwYWlyIGlzIHJlZmVy cmVkIHRvIGFzIHRoZSAncm9vdCBvZiB0cnVzdCcu4oCdPC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdC IiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTog Q2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNz PSIiPndlIGNhbiBzaW1wbHkgcmVmZXIgdG8gdGhlIFRGVyBrZXkgKHNpbmNlIGluIHBsYWNlcyDi gJhyb290IG9mIHRydXN04oCZIGlzIHVzZWQgdG8gZGVzY3JpYmUgdGhlIFRGVyBrZXkpLjxvOnAg Y2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGlu IDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNl cmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PG86cCBjbGFzcz0i Ij4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4g MC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2Vy aWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIi PiZuYnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAw LjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJp ZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPkFuZHJldyBBdHllbzxz cGFuIGNsYXNzPSJBcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwIGNsYXNz PSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAw MDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsi IGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPlNlY3VyaXR5IEFyY2hpdGVj dDxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAw aW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBz YW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PG86cCBj bGFzcz0iIj4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBp biAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5JbnRlcmNl ZGU8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjog MGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwg c2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPkRpZ2l0 YWwgdHJ1c3QmbmJzcDsmbmJzcDsmbmJzcDsgcGVvcGxlIHwgZGV2aWNlcyB8IGFwcHM8bzpwIGNs YXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAw LjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJp ZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAu MDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlm OyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+T2ZmaWNlOiAmIzQzOzQ0 ICgwKSAxNDU1IDU1OCAxMTE8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZh bWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0Ii IGNsYXNzPSIiPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW50ZXJjZWRlLmNvbS8iIHN0eWxlPSJjb2xv cjogcmdiKDE0OSwgNzksIDExNCk7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIgY2xhc3M9 IiI+d3d3LmludGVyY2VkZS5jb208L2E+PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsg Zm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGNsYXNz PSIiPi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPGJyIGNsYXNzPSIiPg0KRnJvbTogVEVFUCBb PGEgaHJlZj0ibWFpbHRvOnRlZXAtYm91bmNlc0BpZXRmLm9yZyIgc3R5bGU9ImNvbG9yOiByZ2Io MTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0iIj5tYWls dG86dGVlcC1ib3VuY2VzQGlldGYub3JnPC9hPl0gT24gQmVoYWxmIE9mIERhdmUgVGhhbGVyPGJy IGNsYXNzPSIiPg0KU2VudDogMDUgSnVseSAyMDE4IDIxOjM2PGJyIGNsYXNzPSIiPg0KVG86IFdo ZWVsZXIsIERhdmlkIE0gJmx0OzxhIGhyZWY9Im1haWx0bzpkYXZpZC5tLndoZWVsZXJAaW50ZWwu Y29tIiBzdHlsZT0iY29sb3I6IHJnYigxNDksIDc5LCAxMTQpOyB0ZXh0LWRlY29yYXRpb246IHVu ZGVybGluZTsiIGNsYXNzPSIiPmRhdmlkLi5tLndoZWVsZXJAaW50ZWwuY29tPC9hPiZndDs7IEhh bm5lcyBUc2Nob2ZlbmlnICZsdDs8YSBocmVmPSJtYWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJt LmNvbSIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1 bmRlcmxpbmU7IiBjbGFzcz0iIj5IYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tPC9hPiZndDs7PHNw YW4gY2xhc3M9IkFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1h aWx0bzp0ZWVwQGlldGYub3JnIiBzdHlsZT0iY29sb3I6IHJnYigxNDksIDc5LCAxMTQpOyB0ZXh0 LWRlY29yYXRpb246IHVuZGVybGluZTsiIGNsYXNzPSIiPnRlZXBAaWV0Zi5vcmc8L2E+PGJyIGNs YXNzPSIiPg0KU3ViamVjdDogUmU6IFtUZWVwXSBDb21tZW50cyBvbiBJLUQgQWN0aW9uOiBkcmFm dC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlLTAwLi4udHh0PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdC IiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTog Q2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNz PSIiPjxvOnAgY2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBD YWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9 IiI+W3NwZWFraW5nIGFzIGFuIGluZGl2aWR1YWxdPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+ PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTog MTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFu IGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAx MXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4g bGFuZz0iRU4tR0IiIGNsYXNzPSIiPkFzIERhdmlkIHNheXMsIHRoZXJlJ3MgbW9yZSB0aGFuIG9u ZSB0eXBlIG9mICZxdW90O1Jvb3Qtb2YtVHJ1c3QmcXVvdDsgYWthICZxdW90O3RydXN0IGFuY2hv ciZxdW90Oy48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2Fs aWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIi PlRoZXJlIGFyZSBpbmR1c3RyeSB0ZXJtcyBvZiBhcnQgZm9yIHRoZSBkaWZmZXJlbnQgdHlwZXMu PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBp biAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5PbmUgZXhh bXBsZSBhcnRpY2xlIHRoYXQgZ2l2ZXMgYSBkZWNlbnQgc3VtbWFyeSBpczxzcGFuIGNsYXNzPSJB cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwczovL25hMDEu c2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRmhlYWx0 aGl0c2VjdXJpdHkuY29tJTJGbmV3cyUyRm5pc3Qtcm9vdHMtb2YtdHJ1c3QtZm9yLWhlYWx0aGNh cmUtbW9iaWxlLWRldmljZXMmYW1wO2RhdGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQu Y29tJTdDYTk5ODZlMDMzZTlhNGRmOGJiMzYwOGQ1ZTMzMmIxYTAlN0M3MmY5ODhiZjg2ZjE0MWFm OTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM2NjY0NzI5MjQwNzAwODMwJmFtcDtzZGF0YT1u V0V3VWl3cGxXbyUyRjJpa29IQlI2bWc2czN2STd2S3IwWXl3UGpsOE51ejQlM0QmYW1wO3Jlc2Vy dmVkPTAiIHN0eWxlPSJjb2xvcjogcmdiKDE0OSwgNzksIDExNCk7IHRleHQtZGVjb3JhdGlvbjog dW5kZXJsaW5lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNvbG9yOiB3aW5kb3d0ZXh0OyB0ZXh0 LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj5odHRwczovL2hlYWx0aGl0c2VjdXJpdHkuY29t L25ld3MvbmlzdC1yb290cy1vZi10cnVzdC1mb3ItaGVhbHRoY2FyZS1tb2JpbGUtZGV2aWNlczwv c3Bhbj48L2E+PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENh bGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0i Ij48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2Fs aWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIi PkluIHBhcnRpY3VsYXIsIHRoZSBpbmR1c3RyeSB0ZXJtcyAoZnJvbSBOSVNUIFNQIDgwMC0xNjQs IHBvdGVudGlhbGx5IGFtb25nIG90aGVycykgYXJlOjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFu PjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6 IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3Bh biBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+Um9vZiBvZiBUcnVzdCBmb3IgU3RvcmFnZSAoUlRTKTxv OnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4g MGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5z LXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+Um9vdCBvZiBU cnVzdCBmb3IgVmVyaWZpY2F0aW9uIChSVFYpPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9k aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFw dDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxh bmc9IkVOLUdCIiBjbGFzcz0iIj5Sb290IG9mIFRydXN0IGZvciBJbnRlZ3JpdHkgKFJUSSk8bzpw IGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBp biAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1z ZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPlJvb3Qgb2YgVHJ1 c3QgZm9yIFJlcG9ydGluZyAoUlRSKTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZv bnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJF Ti1HQiIgY2xhc3M9IiI+Um9vdCBvZiBUcnVzdCBmb3IgTWVhc3VyZW1lbnQgKFJUTSk8bzpwIGNs YXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAw LjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJp ZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAu MDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlm OyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+SSB3b3VsZCByZWNvbW1l bmQgdXNpbmcgdGhlIGFib3ZlIHRlcm1zIGFuZCBub3QgdXNpbmcgJnF1b3Q7dHJ1c3QgYW5jaG9y JnF1b3Q7IG9yIHRoZSB1bnF1YWxpZmllZCAmcXVvdDtyb290IG9mIHRydXN0JnF1b3Q7IHRlcm0u PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBp biAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNs YXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGlu IDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fu cy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPkRhdmU8bzpw IGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBp biAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1z ZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9 IiI+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGlu IDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNl cmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+LS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS08bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWls eTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNs YXNzPSIiPkZyb206IFRFRVAgJmx0OzxhIGhyZWY9Im1haWx0bzp0ZWVwLWJvdW5jZXNAaWV0Zi5v cmciIHN0eWxlPSJjb2xvcjogcmdiKDE0OSwgNzksIDExNCk7IHRleHQtZGVjb3JhdGlvbjogdW5k ZXJsaW5lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNvbG9yOiB3aW5kb3d0ZXh0OyB0ZXh0LWRl Y29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj50ZWVwLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9h PiZndDsgT24gQmVoYWxmDQogT2YgV2hlZWxlciwgRGF2aWQgTTxvOnAgY2xhc3M9IiI+PC9vOnA+ PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250 LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+ DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+U2VudDogVGh1cnNkYXksIEp1bHkgNSwgMjAx OCAxMjo1MiBQTTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBD YWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9 IiI+VG86IEhhbm5lcyBUc2Nob2ZlbmlnICZsdDs8YSBocmVmPSJtYWlsdG86SGFubmVzLlRzY2hv ZmVuaWdAYXJtLmNvbSIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNv cmF0aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0iIj48c3BhbiBzdHlsZT0iY29sb3I6IHdpbmRvd3Rl eHQ7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNzPSIiPkhhbm5lcy5Uc2Nob2ZlbmlnQGFy bS5jb208L3NwYW4+PC9hPiZndDs7PHNwYW4gY2xhc3M9IkFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp0ZWVwQGlldGYub3JnIiBzdHlsZT0iY29sb3I6 IHJnYigxNDksIDc5LCAxMTQpOyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiIGNsYXNzPSIi PjxzcGFuIHN0eWxlPSJjb2xvcjogd2luZG93dGV4dDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyIg Y2xhc3M9IiI+dGVlcEBpZXRmLm9yZzwvc3Bhbj48L2E+PG86cCBjbGFzcz0iIj48L286cD48L3Nw YW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6 ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxz cGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5TdWJqZWN0OiBSZTogW1RlZXBdIENvbW1lbnRzIG9u IEktRCBBY3Rpb246IGRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUtMDAudHh0PG86cCBjbGFz cz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4w MDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7 IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZu YnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAw MDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsi IGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPkhhbm5lcyw8bzpwIGNsYXNz PSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAw MDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsi IGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPklmIHRoYXQgaXMgdGhlIGNh c2UgKHRydXN0IHJvb3QgYW5kIHRydXN0IGFuY2hvcnMgYXJlIHRoZSBzYW1lKSwgdGhlbiBJIGhh dmUgYSBjb25jZXJuIHJlZ2FyZGluZyBjcnlwdG8gc2VwYXJhdGlvbi48bzpwIGNsYXNzPSIiPjwv bzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsg Zm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNz PSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPkluIG9uZSBkZWZpbml0aW9uIHRoZSBU cnVzdCBBbmNob3Igc2lnbnMgY2VydGlmaWNhdGVzLCBpbiB0aGUgb3RoZXIgZGVmaW5pdGlvbiBh IFJvb3Qtb2YtVHJ1c3Qgc2lnbnMgYXR0ZXN0YXRpb25zLjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9z cGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNp emU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8 c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+SWYgdGhlc2UgYXJlIGluIGZhY3QgdGhlIHNhbWUg a2V5LCB0aGVuIHRoZXkgYXJlIGJlaW5nIHVzZWQgZm9yIHR3byBkaWZmZXJlbnQgZnVuY3Rpb25z LCB3aGljaCBpcyBub3QgcmVjb21tZW5kZWQgZm9yIGNyeXB0b2dyYXBoaWMga2V5cy48bzpwIGNs YXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAw LjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJp ZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAu MDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlm OyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+RnVydGhlciwgaXQgc2Vl bXMgdG8gbWUgKHRob3VnaCBJIG1heSBiZSBtaXN1bmRlcnN0YW5kaW5nIHRoZSBpbnRlbmRlZCBm dW5jdGlvbiksIHRoZSBwcml2YXRlIGtleSBvZiB0aGUgVHJ1c3QgQW5jaG9yIHJlc2lkZXMgb3V0 c2lkZSB0aGUgZGV2aWNlLCBpbiBhIHNlcGFyYXRlIGVudGl0eSwgbGlrZSBhIENBIG9yIGEgVEFN LjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAw aW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBz YW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+SG93ZXZl ciwgdGhlIHByaXZhdGUga2V5IG9mIGEgUm9vdC1vZi1UcnVzdCByZXNpZGVzIGluIHRoZSBURUUg KG9yIGlzIGFjY2Vzc2libGUgb25seSB0byB0aGUgVEVFKS48bzpwIGNsYXNzPSIiPjwvbzpwPjwv c3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1z aXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0K PHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNp emU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8 c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+Q2FuIHlvdSBwaWNrIGFwYXJ0IG15IHVuZGVyc3Rh bmRpbmcgb2YgdGhlIHR3byBkZWZpbml0aW9ucyBvZiBrZXlzLCBhbmQgaGVscCBtZSB1bmRlcnN0 YW5kIHdoZXJlIEkgZ290IHRocm93biBvZmY/PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9k aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFw dDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxh bmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2Rp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0 OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFu Zz0iRU4tR0IiIGNsYXNzPSIiPlRoYW5rcyw8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0 OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFu Zz0iRU4tR0IiIGNsYXNzPSIiPkRhdmUgV2hlZWxlcjxzcGFuIGNsYXNzPSJBcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4N CjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBm b250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0i RU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZv bnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJF Ti1HQiIgY2xhc3M9IiI+LS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS08bzpwIGNsYXNzPSIiPjwv bzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsg Zm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNz PSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPkZyb206IEhhbm5lcyBUc2Nob2Zlbmln IFs8YSBocmVmPSJtYWlsdG86SGFubmVzLi5Uc2Nob2ZlbmlnQGFybS5jb20iIHN0eWxlPSJjb2xv cjogcmdiKDE0OSwgNzksIDExNCk7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIgY2xhc3M9 IiI+PHNwYW4gc3R5bGU9ImNvbG9yOiB3aW5kb3d0ZXh0OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7 IiBjbGFzcz0iIj5tYWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTwvc3Bhbj48L2E+XTxv OnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4g MGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5z LXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+U2VudDogVGh1 cnNkYXksIEp1bHkgNSwgMjAxOCAxMjo0MSBQTTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwv ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDEx cHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBs YW5nPSJFTi1HQiIgY2xhc3M9IiI+VG86IFdoZWVsZXIsIERhdmlkIE0gJmx0OzxhIGhyZWY9Im1h aWx0bzpkYXZpZC5tLndoZWVsZXJAaW50ZWwuY29tIiBzdHlsZT0iY29sb3I6IHJnYigxNDksIDc5 LCAxMTQpOyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiIGNsYXNzPSIiPjxzcGFuIHN0eWxl PSJjb2xvcjogd2luZG93dGV4dDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyIgY2xhc3M9IiI+ZGF2 aWQubS53aGVlbGVyQGludGVsLmNvbTwvc3Bhbj48L2E+Jmd0Ozs8c3BhbiBjbGFzcz0iQXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnRlZXBAaWV0Zi5v cmciIHN0eWxlPSJjb2xvcjogcmdiKDE0OSwgNzksIDExNCk7IHRleHQtZGVjb3JhdGlvbjogdW5k ZXJsaW5lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNvbG9yOiB3aW5kb3d0ZXh0OyB0ZXh0LWRl Y29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj50ZWVwQGlldGYub3JnPC9zcGFuPjwvYT48bzpwIGNs YXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAw LjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJp ZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPlN1YmplY3Q6IFJFOiBb VGVlcF0gQ29tbWVudHMgb24gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVjdHVy ZS0wMC50eHQ8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2Fs aWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIi PjxvOnAgY2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxp YnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+ SnVzdCBhIHF1aWNrIHJlbWFyazogSU1ITyByb290IG9mIHRydXN0IGFuZCB0cnVzdCBhbmNob3Ig YXJlIHRoZSBzYW1lIHRoaW5nLiBJIGJlbGlldmUgd2Ugc2hvdWxkIHVwZGF0ZSB0aGUgdGV4dCB0 byBvbmx5IHRhbGsgYWJvdXQgdHJ1c3QgYW5jaG9ycyBhbmQgZm9yZ2V0IHRoZSByb290IG9mIHRy dXN0IHRlcm1pbm9sb2d5LjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFt aWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIg Y2xhc3M9IiI+PG86cCBjbGFzcz0iIj4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1p bHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBj bGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWls eTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNs YXNzPSIiPi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPG86cCBjbGFzcz0iIj48L286cD48L3Nw YW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6 ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxz cGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5Gcm9tOiBURUVQIFs8YSBocmVmPSJtYWlsdG86dGVl cC1ib3VuY2VzQGlldGYub3JnIiBzdHlsZT0iY29sb3I6IHJnYigxNDksIDc5LCAxMTQpOyB0ZXh0 LWRlY29yYXRpb246IHVuZGVybGluZTsiIGNsYXNzPSIiPjxzcGFuIHN0eWxlPSJjb2xvcjogd2lu ZG93dGV4dDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyIgY2xhc3M9IiI+bWFpbHRvOnRlZXAtYm91 bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XSBPbg0KIEJlaGFsZiBPZiBXaGVlbGVyLCBEYXZpZCBN PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBp biAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5TZW50OiAw NSBKdWx5IDIwMTggMjE6Mzg8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZh bWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0Ii IGNsYXNzPSIiPlRvOjxzcGFuIGNsYXNzPSJBcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj48YSBocmVmPSJtYWlsdG86dGVlcEBpZXRmLm9yZyIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5 LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0iIj48c3BhbiBz dHlsZT0iY29sb3I6IHdpbmRvd3RleHQ7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNzPSIi PnRlZXBAaWV0Zi5vcmc8L3NwYW4+PC9hPjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7 IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5n PSJFTi1HQiIgY2xhc3M9IiI+U3ViamVjdDogW1RlZXBdIENvbW1lbnRzIG9uIEktRCBBY3Rpb246 IGRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUtMDAudHh0PG86cCBjbGFzcz0iIj48L286cD48 L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQt c2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4N CjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwv c3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1z aXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0K PHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPkkgaGF2ZSBzZXZlcmFsIGNvbW1lbnRzIG9uIHRo ZSBuZXcgYXJjaGl0ZWN0dXJlIGRyYWZ0LjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7 IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5n PSJFTi1HQiIgY2xhc3M9IiI+PG86cCBjbGFzcz0iIj4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsg Zm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9 IkVOLUdCIiBjbGFzcz0iIj5UaGUgZmlyc3QgY29tbWVudCBoYXMgdG8gZG8gd2l0aCB0aGUgZGVm aW5pdGlvbiBvZiB0aGUgJnF1b3Q7VHJ1c3QgQW5jaG9yJnF1b3Q7IChwYWdlIDQpPG86cCBjbGFz cz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4w MDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7 IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZu YnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAw MDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsi IGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPlRoZSBkZWZpbml0aW9uIHN0 YXRlczo8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJy aSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPlRy dXN0IEFuY2hvcjogQSByb290IGNlcnRpZmljYXRlIHRoYXQgY2FuIGJlIHVzZWQgdG8gdmFsaWRh dGUgaXRzPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGli cmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgY2VydGlmaWNh dGVzLiBJdCBpcyB1c3VhbGx5IGVtYmVkZGVkIGluIGEgZGV2aWNlIG9yPG86cCBjbGFzcz0iIj48 L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7 IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFz cz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Y29uZmlndXJlZCBieSBhIFRBTSBmb3IgdmFsaWRh dGluZyB0aGUgdHJ1c3Qgb2YgYSByZW1vdGUgZW50aXR5J3M8bzpwIGNsYXNzPSIiPjwvbzpwPjwv c3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1z aXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0K PHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyBjZXJ0aWZpY2F0ZS48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bh bj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXpl OiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNw YW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6 IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3Bh biBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+VGhlbiBsYXRlciBpbiBzZWN0aW9uIDMgKHBhZ2UgNik8 bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGlu IDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fu cy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPlRoaXMgc3Bl Y2lmaWNhdGlvbiBhc3N1bWVzIHRoYXQgYW4gYXBwbGljYWJsZSBkZXZpY2UgaXMgZXF1aXBwZWQg d2l0aCZuYnNwOyBvbmUgb3IgbW9yZSBURUVzIGFuZCBlYWNoIFRFRSBpcyBwcmUtcHJvdmlzaW9u ZWQgd2l0aCBhIGRldmljZS11bmlxdWUmbmJzcDsgcHVibGljL3ByaXZhdGUga2V5IHBhaXIsIHdo aWNoIGlzIHNlY3VyZWx5IHN0b3JlZC4gVGhpcyBrZXkgcGFpciBpcyZuYnNwOyByZWZlcnJlZCB0 byBhcyB0aGUNCiAncm9vdCBvZiB0cnVzdCcgZm9yIHJlbW90ZSBhdHRlc3RhdGlvbiBvZiB0aGUm bmJzcDsgYXNzb2NpYXRlZCBURUUgaW4gYSBkZXZpY2UgYnkgYW4gVEFNLjxvOnAgY2xhc3M9IiI+ PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0 OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xh c3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PG86cCBjbGFzcz0iIj4mbmJzcDs8 L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7 IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFz cz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwv bzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsg Zm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNz PSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPkl0IGlzIG5vdCBjbGVhciB3aGV0aGVy IHRoZSAmcXVvdDtUcnVzdCBBbmNob3ImcXVvdDsgaXMgdGhlIHNhbWUgYXMgdGhlICZxdW90O3Jv b3Qtb2YtdHJ1c3QmcXVvdDsga2V5IHBhaXIsIHNpbmNlIHRoZSAmcXVvdDtyb290LW9mLXRydXN0 JnF1b3Q7IGlzIG5vdCBpbmNsdWRlZCBpbiB0aGUgZGVmaW5pdGlvbnMuLjxvOnAgY2xhc3M9IiI+ PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0 OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xh c3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PG86cCBjbGFzcz0iIj4mbmJzcDs8 L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7 IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFz cz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5JZiB0aGV5IGFyZSBpbnRlbmRlZCB0 byBiZSBkaWZmZXJlbnQgKHdoaWNoIGlzIHdoYXQgSSBiZWxpZXZlKSwgdGhlbiBJIHN1Z2dlc3Qg d2UgYWRkIHRoZSAmcXVvdDtyb290LW9mLXRydXN0JnF1b3Q7IHRvIHRoZSBkZWZpbml0aW9ucywg YW5kIGV4cGxhaW4gdGhlIGRpZmZlcmVuY2UuIE9mdGVudGltZXMsIGluIG15IGV4cGVyaWVuY2Us IHRoZXNlIHRlcm1zIGFyZSB1c2VkIGludGVyY2hhbmdlYWJseS48bzpwIGNsYXNzPSIiPjwvbzpw Pjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9u dC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIi Pg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250 LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+ DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+SGVyZSBpcyBteSBhdHRlbXB0IHRvIGNyZWF0 ZSBkZWZpbml0aW9ucyBmb3IgdGhlc2UgdHdvIHR5cGVzIG9mIGtleXM6PG86cCBjbGFzcz0iIj48 L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7 IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFz cz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwv bzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsg Zm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNz PSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPlRydXN0IEFuY2hvcjogQSB0cnVzdCBh bmNob3IgaXMgcHVibGljIGFzeW1tZXRyaWMga2V5LCBwcmVmZXJhYmx5IGNvbnRhaW5lZCBpbiBh IGNlcnRpZmljYXRlPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6 IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFz cz0iIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7dGhh dCByZXByZXNlbnRzIGEgdHJ1c3RlZCBlbnRpdHkgdG8gYSBkZXZpY2UuIFRoaXMgcHVibGljIGtl eSBtYXkgYmUgdXNlZCBieTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFt aWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIg Y2xhc3M9IiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IHRoZSBob2xkZXIgb2YgdGhlIGNvcnJlc3BvbmRpbmcgcHJpdmF0ZSBrZXkgdG8gc2lnbiBvdGhl ciBjZXJ0aWZpY2F0ZXMsPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1p bHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBj bGFzcz0iIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg dGhlcmVieSBjb21tdW5pY2F0aW5nIHRoZSBzaWduZWQgY2VydGlmaWNhdGUgbWF5IGFsc28gYmUg dHJ1c3RlZC48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2Fs aWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBUaGUgdHJ1 c3QgYW5jaG9yIGlzIHVzdWFsbHkgZW1iZWRkZWQgaW4gYSBkZXZpY2Ugb3IgY29uZmlndXJlZCBi eSBhIFRBTTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxp YnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGFu ZCB1c2VkIGJ5IHRoZSBkZXZpY2UgdG8gdmFsaWRhdGUgdGhlIHRydXN0IG9mIGEgcmVtb3RlIGVu dGl0eSBieTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxp YnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHZlcmlmeWlu ZyB0aGF0IGVudGl0eSdzIGNlcnRpZmljYXRlIGlzIHNpZ25lZCBieSBhIHRydXN0IGFuY2hvci48 bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGlu IDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fu cy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBUcnVzdCBhbmNo b3JzIG11c3QgYmUgc3RvcmVkIGluIGEgd2F5IHRoYXQgcHJldmVudHMgb3Igc3Ryb25nbHkgcmVz aXN0czxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu OiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJp LCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IG1vZGlm aWNhdGlvbiBieSB1bmF1dGhvcml6ZWQgc29mdHdhcmUgYW5kIGhhcmR3YXJlIGFkdmVyc2FyaWVz LjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAw aW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBz YW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEFuIGV4YW1w bGUgb2YgYSB0cnVzdCBhbmNob3IgaXMgdGhlIHB1YmxpYyBrZXkgb2YgYSBUQU0gb3IgU1Agd2hp Y2ggaXM8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJy aSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtwaW5uZWQmcXVvdDsgb3Ig c2VjdXJlbHkgc3RvcmVkIGluc2lkZSB0aGUgZGV2aWNlLCBhbmQgdGhhdCB0cnVzdCBhbmNob3Ig aXMgdXNlZDxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxp YnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGxpa2UgYSBD QSBjZXJ0aWZpY2F0ZSB0byB2YWxpZGF0ZSB0aGUgdHJ1c3QgaW4gb3RoZXIga2V5cy9jZXJ0aWZp Y2F0ZXMuPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGli cmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgQSB0cnVzdCBhbmNob3Ig bWF5IGJlIHZpZXdlZCBieSBib3RoIHRydXN0ZWQgYW5kIHVudHJ1c3RlZCBlbnRpdGllcyBvbiB0 aGUgZGV2aWNlLDxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBD YWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9 IiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEJ1dCBtYXkgb25seSBiZSBt b2RpZmllZCBvciBkZWxldGVkIGJ5IGEgdHJ1c3RlZCBlbnRpdHkuPG86cCBjbGFzcz0iIj48L286 cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZv bnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0i Ij4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9u dC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIi Pg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPlJvb3Qtb2YtVHJ1c3QgS2V5OiZuYnNwOyBB IGRldmljZS11bmlxdWUga2V5IGdlbmVyYXRlZCBhdCBkZXZpY2UgbWFudWZhY3R1cmluZyBvciBh dDxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAw aW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBz YW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFRFRSBwcm92aXNpb25p bmcsIHdoaWNoIGlzIHNlY3VyZWx5IHN0b3JlZCBhbmQgb25seSBhY2Nlc3NpYmxlIHRvIHRoZSBU RUUuPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46 IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmks IHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgVGhlIFJvb3Qtb2Yt VHJ1c3QgS2V5IGlzIHVzZWQgZm9yIGF0dGVzdGF0aW9uIHNpZ25pbmcgd2hpY2ggcHJvdmVzIHRo ZSBzaWduZWQ8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2Fs aWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBtZXNzYWdl IG9yaWdpbmF0ZWQgb3Igd2FzIGFwcHJvdmVkIGJ5IHRoZSBURUUsIGFuZCBtYXkgYmUgdHJ1c3Rl ZCB0byB0aGUgc2FtZTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5 OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xh c3M9IiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGRlZ3JlZSBh cyB0aGUgVEVFLjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBD YWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9 IiI+PG86cCBjbGFzcz0iIj4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENh bGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0i Ij4tLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLTxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwv ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDEx cHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBs YW5nPSJFTi1HQiIgY2xhc3M9IiI+RnJvbTogVEVFUCBbPGEgaHJlZj0ibWFpbHRvOnRlZXAtYm91 bmNlc0BpZXRmLm9yZyIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNv cmF0aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0iIj48c3BhbiBzdHlsZT0iY29sb3I6IHdpbmRvd3Rl eHQ7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNzPSIiPm1haWx0bzp0ZWVwLWJvdW5jZXNA aWV0Zi5vcmc8L3NwYW4+PC9hPl0gT24NCiBCZWhhbGYgT2Y8c3BhbiBjbGFzcz0iQXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmludGVybmV0LWRyYWZ0 c0BpZXRmLm9yZyIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0 aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0iIj48c3BhbiBzdHlsZT0iY29sb3I6IHdpbmRvd3RleHQ7 IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNzPSIiPmludGVybmV0LWRyYWZ0c0BpZXRmLm9y Zzwvc3Bhbj48L2E+PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6 IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFz cz0iIj5TZW50OiBXZWRuZXNkYXksIEp1bHkgNCwgMjAxOCA3OjQ5IEFNPG86cCBjbGFzcz0iIj48 L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7 IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFz cz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5Ubzo8c3BhbiBjbGFzcz0iQXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmktZC1hbm5vdW5j ZUBpZXRmLm9yZyIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0 aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0iIj48c3BhbiBzdHlsZT0iY29sb3I6IHdpbmRvd3RleHQ7 IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNzPSIiPmktZC1hbm5vdW5jZUBpZXRmLm9yZzwv c3Bhbj48L2E+PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENh bGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0i Ij5DYzo8c3BhbiBjbGFzcz0iQXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEg aHJlZj0ibWFpbHRvOnRlZXBAaWV0Zi5vcmciIHN0eWxlPSJjb2xvcjogcmdiKDE0OSwgNzksIDEx NCk7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNv bG9yOiB3aW5kb3d0ZXh0OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj50ZWVwQGll dGYub3JnPC9zcGFuPjwvYT48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZh bWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0Ii IGNsYXNzPSIiPlN1YmplY3Q6IFtUZWVwXSBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLXRlZXAtYXJj aGl0ZWN0dXJlLTAwLnR4dDxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFt aWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIg Y2xhc3M9IiI+PG86cCBjbGFzcz0iIj4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1p bHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBj bGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWls eTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNs YXNzPSIiPkEgTmV3IEludGVybmV0LURyYWZ0IGlzIGF2YWlsYWJsZSBmcm9tIHRoZSBvbi1saW5l IEludGVybmV0LURyYWZ0cyBkaXJlY3Rvcmllcy48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAx MXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4g bGFuZz0iRU4tR0IiIGNsYXNzPSIiPlRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2YgdGhlIFRy dXN0ZWQgRXhlY3V0aW9uIEVudmlyb25tZW50IFByb3Zpc2lvbmluZyBXRyBvZiB0aGUgSUVURi48 bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGlu IDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fu cy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xh c3M9IiI+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4g MGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5z LXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFRpdGxlJm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IDogVHJ1c3RlZCBFeGVj dXRpb24gRW52aXJvbm1lbnQgUHJvdmlzaW9uaW5nIChURUVQKSBBcmNoaXRlY3R1cmU8bzpwIGNs YXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAw LjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJp ZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBBdXRob3JzJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IDogTWluZ2xpYW5nIFBlaTxvOnAgY2xhc3M9IiI+ PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0 OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xh c3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IEhhbm5lcyBUc2Nob2ZlbmlnPG86cCBjbGFzcz0iIj48L286cD48L3Nw YW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6 ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxz cGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgQW5kcmV3IEF0eWVvPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1m YW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdC IiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgRGFwZW5nPG86 cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAw aW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMt c2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5GaWxlbmFtZSZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA6IGRyYWZ0LWlldGYtdGVl cC1hcmNoaXRlY3R1cmUtMDAudHh0PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9u dC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVO LUdCIiBjbGFzcz0iIj5QYWdlcyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA6IDI0PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9k aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFw dDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxh bmc9IkVOLUdCIiBjbGFzcz0iIj5EYXRlJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IDogMjAxOC0wNy0wMjxvOnAgY2xhc3M9 IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAw MXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIg Y2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PG86cCBjbGFzcz0iIj4mbmJz cDs8L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAx cHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBj bGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5BYnN0cmFjdDo8bzpwIGNsYXNz PSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAw MDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsi IGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPiZuYnNwOyZuYnNwOyBBIFRy dXN0ZWQgRXhlY3V0aW9uIEVudmlyb25tZW50IChURUUpIHdhcyBkZXNpZ25lZCB0byBwcm92aWRl IGE8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjog MGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwg c2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPiZuYnNw OyZuYnNwOyBoYXJkd2FyZS1pc29sYXRpb24gbWVjaGFuaXNtIHRvIHNlcGFyYXRlIGEgcmVndWxh ciBvcGVyYXRpbmcgc3lzdGVtPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1m YW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdC IiBjbGFzcz0iIj4mbmJzcDsmbmJzcDsgZnJvbSBzZWN1cml0eS0gc2Vuc2l0aXZlIGFwcGxpY2F0 aW9ucy48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJy aSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxv OnAgY2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu OiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJp LCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+Jm5i c3A7Jm5ic3A7IFRoaXMgYXJjaGl0ZWN0dXJlIGRvY3VtZW50IG1vdGl2YXRlcyB0aGUgZGVzaWdu IGFuZCBzdGFuZGFyZGl6YXRpb248bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250 LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4t R0IiIGNsYXNzPSIiPiZuYnNwOyZuYnNwOyBvZiBhIHByb3RvY29sIGZvciBtYW5hZ2luZyB0aGUg bGlmZWN5bGUgb2YgdHJ1c3RlZCBhcHBsaWNhdGlvbnM8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bh bj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXpl OiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNw YW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPiZuYnNwOyZuYnNwOyBydW5uaW5nIGluc2lkZSBhIFRF RS48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjog MGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwg c2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAg Y2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAw aW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBz YW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PG86cCBj bGFzcz0iIj4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBp biAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5UaGUgSUVU RiBkYXRhdHJhY2tlciBzdGF0dXMgcGFnZSBmb3IgdGhpcyBkcmFmdCBpczo8bzpwIGNsYXNzPSIi PjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFw dDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNs YXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxhIGhyZWY9Imh0dHBzOi8vbmEw MS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZGF0 YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlJTJG JmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Q2E5OTg2ZTAzM2U5 YTRkZjhiYjM2MDhkNWUzMzJiMWEwJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzNjY2NDcyOTI0MDcwMDgzMCZhbXA7c2RhdGE9UWdIcEVRNmNxUHpqTlNOQVhs T0JWSmZtYkh6cERvZ1ZOSk5wV0k2dVB6ZyUzRCZhbXA7cmVzZXJ2ZWQ9MCIgc3R5bGU9ImNvbG9y OiByZ2IoMTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0i Ij48c3BhbiBzdHlsZT0iY29sb3I6IHdpbmRvd3RleHQ7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsi IGNsYXNzPSIiPmh0dHBzOi8vbmEwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/ dXJsPWh0dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZkcmFmdC1pZXRm LXRlZXAtYXJjaGl0ZWN0dXJlJTJGJmFtcDthbXA7ZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1p Y3Jvc29mdC5jb20lN0M5NmE0Nzg1NmJhNjU0OWU5OTI2ZjA4ZDVlMmIwYzVmYyU3QzcyZjk4OGJm ODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzY2NjQxNzEyMjM1NDE5MDImYW1w O2FtcDtzZGF0YT1YQnVUbHNpVjVPamt4a2NxVUxkc21yb1RuV1JacUFwSDNmQm9rSkd2a1RFJTNE JmFtcDthbXA7cmVzZXJ2ZWQ9MDwvc3Bhbj48L2E+PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+ PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTog MTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFu IGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAx MXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4g bGFuZz0iRU4tR0IiIGNsYXNzPSIiPlRoZXJlIGFyZSBhbHNvIGh0bWxpemVkIHZlcnNpb25zIGF2 YWlsYWJsZSBhdDo8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTog Q2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNz PSIiPjxhIGhyZWY9Imh0dHBzOi8vbmEwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNv bS8/dXJsPWh0dHBzJTNBJTJGJTJGdG9vbHMuaWV0Zi5vcmclMkZodG1sJTJGZHJhZnQtaWV0Zi10 ZWVwLWFyY2hpdGVjdHVyZS0wMCZhbXA7ZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1pY3Jvc29m dC5jb20lN0NhOTk4NmUwMzNlOWE0ZGY4YmIzNjA4ZDVlMzMyYjFhMCU3QzcyZjk4OGJmODZmMTQx YWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzY2NjQ3MjkyNDA3MTA4MzUmYW1wO3NkYXRh PXlMYmtndUtOcFdvYkdTUWJmQ0kzWFRMYUxKUEhPNXBYN3kwdXpNNWFRcEklM0QmYW1wO3Jlc2Vy dmVkPTAiIHN0eWxlPSJjb2xvcjogcmdiKDE0OSwgNzksIDExNCk7IHRleHQtZGVjb3JhdGlvbjog dW5kZXJsaW5lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNvbG9yOiB3aW5kb3d0ZXh0OyB0ZXh0 LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj5odHRwczovL25hMDEuc2FmZWxpbmtzLnByb3Rl Y3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRt bCUyRmRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUtMDAmYW1wO2FtcDtkYXRhPTAyJTdDMDEl N0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Qzk2YTQ3ODU2YmE2NTQ5ZTk5MjZmMDhkNWUyYjBj NWZjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNjY2NDE3 MTIyMzU0MTkwMiZhbXA7YW1wO3NkYXRhPWhlTzF4bHhmclZaeXl6WXppUXk4VjJQMHZ4aUViVFZT RjhzRmROYXc4c2MlM0QmYW1wO2FtcDtyZXNlcnZlZD0wPC9zcGFuPjwvYT48bzpwIGNsYXNzPSIi PjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFw dDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNs YXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxhIGhyZWY9Imh0dHBzOi8vbmEw MS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZGF0 YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZodG1sJTJGZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVj dHVyZS0wMCZhbXA7ZGF0YT0wMiU3QzAxJTdDZHRoYWxlciU0MG1pY3Jvc29mdC5jb20lN0NhOTk4 NmUwMzNlOWE0ZGY4YmIzNjA4ZDVlMzMyYjFhMCU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2Qw MTFkYjQ3JTdDMSU3QzAlN0M2MzY2NjQ3MjkyNDA3MjA4NDAmYW1wO3NkYXRhPWl6RUtwZHRqSlBh aDJkb3JVYkVjN1pkSlpKQXZQSVRFOWlvcCUyQnR1RnJtcyUzRCZhbXA7cmVzZXJ2ZWQ9MCIgc3R5 bGU9ImNvbG9yOiByZ2IoMTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7 IiBjbGFzcz0iIj48c3BhbiBzdHlsZT0iY29sb3I6IHdpbmRvd3RleHQ7IHRleHQtZGVjb3JhdGlv bjogbm9uZTsiIGNsYXNzPSIiPmh0dHBzOi8vbmEwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRs b29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZo dG1sJTJGZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVjdHVyZS0wMCZhbXA7YW1wO2RhdGE9MDIlN0Mw MSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDOTZhNDc4NTZiYTY1NDllOTkyNmYwOGQ1ZTJi MGM1ZmMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM2NjY0 MTcxMjIzNTQxOTAyJmFtcDthbXA7c2RhdGE9YW9LVyUyRkZubHp6THhwT3dFcG1LWjZJc092ZzhU amk4R3c0WWFiWEFjUzU0JTNEJmFtcDthbXA7cmVzZXJ2ZWQ9MDwvc3Bhbj48L2E+PG86cCBjbGFz cz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4w MDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7 IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZu YnNwOzwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAw MDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsi IGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAw MXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIg Y2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+UGxlYXNlIG5vdGUgdGhhdCBp dCBtYXkgdGFrZSBhIGNvdXBsZSBvZiBtaW51dGVzIGZyb20gdGhlIHRpbWUgb2Ygc3VibWlzc2lv biB1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0DQo8 YSBocmVmPSJodHRwOi8vdG9vbHMuaWV0Zi5vcmciIGNsYXNzPSIiPnRvb2xzLmlldGYub3JnPC9h Pi48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjog MGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwg c2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAg Y2xhc3M9IiI+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAw aW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBz YW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+SW50ZXJu ZXQtRHJhZnRzIGFyZSBhbHNvIGF2YWlsYWJsZSBieSBhbm9ueW1vdXMgRlRQIGF0OjxvOnAgY2xh c3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAu MDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlm OyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PGEgaHJlZj0iZnRwOi8v ZnRwLmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy8iIHN0eWxlPSJjb2xvcjogcmdiKDE0OSwgNzks IDExNCk7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9 ImNvbG9yOiB3aW5kb3d0ZXh0OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj5mdHA6 Ly9mdHAuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzLzwvc3Bhbj48L2E+PG86cCBjbGFzcz0iIj48 L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7 IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFz cz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48bzpwIGNsYXNzPSIiPiZuYnNwOzwv bzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsg Zm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNz PSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fPG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsg Zm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9 IkVOLUdCIiBjbGFzcz0iIj5URUVQIG1haWxpbmcgbGlzdDxvOnAgY2xhc3M9IiI+PC9vOnA+PC9z cGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNp emU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8 c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PGEgaHJlZj0ibWFpbHRvOlRFRVBAaWV0Zi5vcmci IHN0eWxlPSJjb2xvcjogcmdiKDE0OSwgNzksIDExNCk7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJs aW5lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNvbG9yOiB3aW5kb3d0ZXh0OyB0ZXh0LWRlY29y YXRpb246IG5vbmU7IiBjbGFzcz0iIj5URUVQQGlldGYub3JnPC9zcGFuPjwvYT48bzpwIGNsYXNz PSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAw MDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsi IGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxhIGhyZWY9Imh0dHBzOi8v bmEwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJG d3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGdGVlcCZhbXA7ZGF0YT0wMiU3QzAx JTdDZHRoYWxlciU0MG1pY3Jvc29mdC5jb20lN0NhOTk4NmUwMzNlOWE0ZGY4YmIzNjA4ZDVlMzMy YjFhMCU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzY2NjQ3 MjkyNDA3MzA4NDkmYW1wO3NkYXRhPXZ4ZWRlY0V3T1hNTDFrRERFdkNWT21aV3lWcDdKRjZqa3kl MkJuR2daZVU1dyUzRCZhbXA7cmVzZXJ2ZWQ9MCIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5LCA3OSwg MTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0iIj48c3BhbiBzdHlsZT0i Y29sb3I6IHdpbmRvd3RleHQ7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNzPSIiPmh0dHBz Oi8vbmEwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJG JTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGdGVlcCZhbXA7YW1wO2RhdGE9 MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDOTZhNDc4NTZiYTY1NDllOTkyNmYw OGQ1ZTJiMGM1ZmMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdD NjM2NjY0MTcxMjIzNTQxOTAyJmFtcDthbXA7c2RhdGE9N3g3Y2dUdldaT3NuV0VERDloUXVSUnZ3 R3ZCNFRUcGwwb2tJUFNoWHRkMCUzRCZhbXA7YW1wO3Jlc2VydmVkPTA8L3NwYW4+PC9hPjxvOnAg Y2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGlu IDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNl cmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PG86cCBjbGFzcz0i Ij4mbmJzcDs8L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4g MC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2Vy aWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxvOnAgY2xhc3M9IiI+PC9vOnA+PC9z cGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNp emU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8 c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+VEVFUCBtYWlsaW5nIGxpc3Q8bzpwIGNsYXNzPSIi PjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFw dDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNs YXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxhIGhyZWY9Im1haWx0bzpURUVQ QGlldGYub3JnIiBzdHlsZT0iY29sb3I6IHJnYigxNDksIDc5LCAxMTQpOyB0ZXh0LWRlY29yYXRp b246IHVuZGVybGluZTsiIGNsYXNzPSIiPjxzcGFuIHN0eWxlPSJjb2xvcjogd2luZG93dGV4dDsg dGV4dC1kZWNvcmF0aW9uOiBub25lOyIgY2xhc3M9IiI+VEVFUEBpZXRmLm9yZzwvc3Bhbj48L2E+ PG86cCBjbGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBp biAwaW4gMC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48YSBocmVm PSJodHRwczovL25hMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRw cyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRlZXAmYW1wO2Rh dGE9MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDYTk5ODZlMDMzZTlhNGRmOGJi MzYwOGQ1ZTMzMmIxYTAlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0Mw JTdDNjM2NjY0NzI5MjQwNzMwODQ5JmFtcDtzZGF0YT12eGVkZWNFd09YTUwxa0RERXZDVk9tWld5 VnA3SkY2amt5JTJCbkdnWmVVNXclM0QmYW1wO3Jlc2VydmVkPTAiIHN0eWxlPSJjb2xvcjogcmdi KDE0OSwgNzksIDExNCk7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIgY2xhc3M9IiI+PHNw YW4gc3R5bGU9ImNvbG9yOiB3aW5kb3d0ZXh0OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFz cz0iIj5odHRwczovL25hMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1o dHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRlZXAmYW1w O2FtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Qzk2YTQ3ODU2YmE2 NTQ5ZTk5MjZmMDhkNWUyYjBjNWZjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzNjY2NDE3MTIyMzU0MTkwMiZhbXA7YW1wO3NkYXRhPTd4N2NnVHZXWk9zbldF REQ5aFF1UlJ2d0d2QjRUVHBsMG9rSVBTaFh0ZDAlM0QmYW1wO2FtcDtyZXNlcnZlZD0wPC9zcGFu PjwvYT48bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJy aSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPklN UE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNo bWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91 IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVy IGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhl cg0KIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUg aW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91LjxvOnAgY2xhc3M9IiI+PC9vOnA+ PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250 LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+ DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PG86cCBjbGFzcz0iIj4mbmJzcDs8L286cD48 L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZvbnQt c2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0iIj4N CjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXzxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQt ZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1H QiIgY2xhc3M9IiI+VEVFUCBtYWlsaW5nIGxpc3Q8bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAx MXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4g bGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxhIGhyZWY9Im1haWx0bzpURUVQQGlldGYub3JnIiBzdHls ZT0iY29sb3I6IHJnYigxNDksIDc5LCAxMTQpOyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsi IGNsYXNzPSIiPjxzcGFuIHN0eWxlPSJjb2xvcjogd2luZG93dGV4dDsgdGV4dC1kZWNvcmF0aW9u OiBub25lOyIgY2xhc3M9IiI+VEVFUEBpZXRmLm9yZzwvc3Bhbj48L2E+PG86cCBjbGFzcz0iIj48 L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7 IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFz cz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48YSBocmVmPSJodHRwczovL25hMDEu c2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5p ZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRlZXAmYW1wO2RhdGE9MDIlN0MwMSU3Q2R0 aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDYTk5ODZlMDMzZTlhNGRmOGJiMzYwOGQ1ZTMzMmIxYTAl N0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM2NjY0NzI5MjQw NzQwODYyJmFtcDtzZGF0YT1CTTNDR2dZZTk5ZXFVM0NyOWo4Q1ozUjlMSXhEMHljS25UOCUyRkVN d1VxalUlM0QmYW1wO3Jlc2VydmVkPTAiIHN0eWxlPSJjb2xvcjogcmdiKDE0OSwgNzksIDExNCk7 IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNvbG9y OiB3aW5kb3d0ZXh0OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj5odHRwczovL25h MDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3 dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRlZXAmYW1wO2FtcDtkYXRhPTAyJTdD MDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Qzk2YTQ3ODU2YmE2NTQ5ZTk5MjZmMDhkNWUy YjBjNWZjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNjY2 NDE3MTIyMzU0MTkwMiZhbXA7YW1wO3NkYXRhPTd4N2NnVHZXWk9zbldFREQ5aFF1UlJ2d0d2QjRU VHBsMG9rSVBTaFh0ZDAlM0QmYW1wO2FtcDtyZXNlcnZlZD0wPC9zcGFuPjwvYT48bzpwIGNsYXNz PSIiPjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAw MDFwdDsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsi IGNsYXNzPSIiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIGNsYXNzPSIiPjxvOnAgY2xhc3M9IiI+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGluIDAuMDAw MXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyIg Y2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+X19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX188bzpwIGNsYXNzPSIiPjwvbzpwPjwvc3Bhbj48 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbjogMGluIDBpbiAwLjAwMDFwdDsgZm9udC1zaXplOiAx MXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiIGNsYXNzPSIiPg0KPHNwYW4g bGFuZz0iRU4tR0IiIGNsYXNzPSIiPlRFRVAgbWFpbGluZyBsaXN0PG86cCBjbGFzcz0iIj48L286 cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4gMC4wMDAxcHQ7IGZv bnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IiBjbGFzcz0i Ij4NCjxzcGFuIGxhbmc9IkVOLUdCIiBjbGFzcz0iIj48YSBocmVmPSJtYWlsdG86VEVFUEBpZXRm Lm9yZyIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1 bmRlcmxpbmU7IiBjbGFzcz0iIj48c3BhbiBzdHlsZT0iY29sb3I6IHdpbmRvd3RleHQ7IHRleHQt ZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNzPSIiPlRFRVBAaWV0Zi5vcmc8L3NwYW4+PC9hPjxvOnAg Y2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luOiAwaW4gMGlu IDAuMDAwMXB0OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNl cmlmOyIgY2xhc3M9IiI+DQo8c3BhbiBsYW5nPSJFTi1HQiIgY2xhc3M9IiI+PGEgaHJlZj0iaHR0 cHM6Ly9uYTAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0El MkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0ZWVwJmFtcDtkYXRhPTAy JTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Q2E5OTg2ZTAzM2U5YTRkZjhiYjM2MDhk NWUzMzJiMWEwJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYz NjY2NDcyOTI0MDc1MDg2MyZhbXA7c2RhdGE9S3VUVHNBaEVUWkNtQ0d3bzFZM3JtZ2toQ004dzVN cThKa3h4Y0xMMjZOOCUzRCZhbXA7cmVzZXJ2ZWQ9MCIgc3R5bGU9ImNvbG9yOiByZ2IoMTQ5LCA3 OSwgMTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7IiBjbGFzcz0iIj48c3BhbiBzdHls ZT0iY29sb3I6IHdpbmRvd3RleHQ7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNzPSIiPmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGVlcDwvc3Bhbj48L2E+PG86cCBj bGFzcz0iIj48L286cD48L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW46IDBpbiAwaW4g MC4wMDAxcHQ7IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2Vy aWY7IiBjbGFzcz0iIj4NCjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOiAxMnB0 OyBmb250LWZhbWlseTogJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LCBzZXJpZjsiIGNsYXNz PSIiPklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkg YXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4u IElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhl DQogc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRv IGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNv cHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS48bzpwIGNsYXNzPSIi PjwvbzpwPjwvc3Bhbj48L2Rpdj4NCjwvZGl2Pg0KPHNwYW4gc3R5bGU9ImNhcmV0LWNvbG9yOiBy Z2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBIZWx2ZXRpY2E7IGZvbnQtc2l6ZTogMTJweDsgZm9u dC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdodDog bm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1p bmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdv cmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVj b3JhdGlvbjogbm9uZTsgZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1wb3J0YW50OyIg Y2xhc3M9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188 L3NwYW4+PGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTog SGVsdmV0aWNhOyBmb250LXNpemU6IDEycHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJp YW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5v cm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3Jt OiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10 ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj4N CjxzcGFuIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogSGVs dmV0aWNhOyBmb250LXNpemU6IDEycHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50 LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1h bDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBu b25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0 LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IGZsb2F0OiBub25lOyBk aXNwbGF5OiBpbmxpbmUgIWltcG9ydGFudDsiIGNsYXNzPSIiPlRFRVANCiBtYWlsaW5nIGxpc3Q8 L3NwYW4+PGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTog SGVsdmV0aWNhOyBmb250LXNpemU6IDEycHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJp YW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5v cm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3Jt OiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10 ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj4N CjxzcGFuIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogSGVs dmV0aWNhOyBmb250LXNpemU6IDEycHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50 LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1h bDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBu b25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0 LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IGZsb2F0OiBub25lOyBk aXNwbGF5OiBpbmxpbmUgIWltcG9ydGFudDsiIGNsYXNzPSIiPjxhIGhyZWY9Im1haWx0bzpURUVQ QGlldGYub3JnIiBjbGFzcz0iIj5URUVQQGlldGYub3JnPC9hPjwvc3Bhbj48YnIgc3R5bGU9ImNh cmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBIZWx2ZXRpY2E7IGZvbnQtc2l6 ZTogMTJweDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBm b250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBz dGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNl OiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAw cHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNzPSIiPg0KPHNwYW4gc3R5bGU9ImNhcmV0 LWNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBIZWx2ZXRpY2E7IGZvbnQtc2l6ZTog MTJweDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250 LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFy dDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBu b3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7 IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1w b3J0YW50OyIgY2xhc3M9IiI+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby90ZWVwIiBjbGFzcz0iIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3RlZXA8L2E+PC9zcGFuPjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8YnIgY2xh c3M9IiI+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_9F2A757C7D904755BD91BB522970F805qtiqualcommcom_-- From nobody Fri Jul 6 08:18:32 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 942EB130EBA for ; Fri, 6 Jul 2018 08:18:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZrJQf8RjPVAF for ; Fri, 6 Jul 2018 08:18:27 -0700 (PDT) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8B34130E86 for ; Fri, 6 Jul 2018 08:18:26 -0700 (PDT) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id w66FHa8m009748 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 6 Jul 2018 17:17:37 +0200 Received: from [134.102.163.216] (134.102.163.216) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.399.0; Fri, 6 Jul 2018 17:17:31 +0200 To: Dave Thaler , Hannes Tschofenig , Andrew Atyeo , "Wheeler, David M" , "'Wiseman, Monty (GE Global Research, US)'" , "teep@ietf.org" References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> From: Henk Birkholz Message-ID: Date: Fri, 6 Jul 2018 17:11:57 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [134.102.163.216] Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 15:18:30 -0000 Hi all, the TCG's definition of RoT is: > A component that performs one or more security specific functions, such as measurement, storage, reporting, verification, and/or update. It is trusted always to behave in the expected manner, because its misbehavior cannot be detected (such as by measurement) under normal operation. This term is disconnected from the quality of being "securely stored". The TCG defines Shielded Location: > A place (memory, register, etc.) where it is safe to operate on sensitive data; data locations that can be accessed only by Protected Capabilities. Trust Anchor is defined by RFC494 already (and therefore difficult to redefine, I think): > An established point of trust (usually based on the authority of some person, office, or organization) from which a certificate user begins the validation of a certification path. Corresponding to the definition above, in the TCG context it is also common to define these "favors" of RoT: > RTC - Root of Trust for Confidentiality > RTI - Root of Trust for Integrity > RTM - Root of Trust for Measurement > RTR - Root of Trust for Reporting > RTS - Root of Trust for Storage > RTV - Root of Trust for Verification Maybe it can be of use to define a "flavor" here also? Arbitrary use of one single shielded secret for multiple uses might enable a variety of attack vectors. Viele Grüße, Henk On 07/06/2018 04:37 PM, Dave Thaler wrote: > [speaking as an individual participant] > > The WG charter says “The group will maintain a close relationship with > the … Trusted Computing Group, and other relevant standards groups...” > and I think part of that is to use consistent terminology.  Hence my > recommendation that David Wheeler already incorporated into his proposed > text.  (Thanks David) > > Dave > > *From:* Hannes Tschofenig > *Sent:* Friday, July 6, 2018 4:22 AM > *To:* Andrew Atyeo ; Dave Thaler > ; Wheeler, David M ; > teep@ietf.org > *Subject:* RE: [Teep] Comments on I-D Action: > draft-ietf-teep-architecture-00.txt > > The problem is only that “root of trust” is not a well defined term in > the IETF, at least as far as I know. Trust anchor, on the other hand, is > well defined. > > The definition currently in the document for root of trust seems to be > similar to trust anchor. However, I agree with both Andy and with David > that we need to find out whether we want to point out certain usages of > the key (such as for the purpose of the attestation). Whether this > justifies the introduction of another term is yet another discussion > > Ciao > > Hannes > > *From:*Andrew Atyeo [mailto:Andrew.Atyeo@intercede.com] > *Sent:* 06 July 2018 10:38 > *To:* Dave Thaler; Wheeler, David M; Hannes Tschofenig; teep@ietf.org > > *Subject:* RE: [Teep] Comments on I-D Action: > draft-ietf-teep-architecture-00.txt > > In OTrP, I believe "root of trust" and "trust anchor" are currently > referring to 2 different things in the OTrP spec. > > ·*Root of trust* > > Excerpt from OTrP: “This specification assumes that an applicable device > is equipped with > >    a TEE and is pre-provisioned with a device-unique public/private key > >    pair, which is securely stored.  This key pair is referred as the > >    'root of trust'.  An entity that uses such a device to run Trusted > >    Applications (TAs) is known as a Service Provider (SP).” > > Here, “Root of Trust” must be talking about either the TEE/TFW private > key, so “root of trust” is referring to the process of secure boot that > results in a TAM being able to use a signature from this key to know > whether to trust the TEE > > ·*Trust Anchor* > > There is a problem this refers to 2 completely different concepts: > > “Setup trust anchors in devices > >    1.  [TFW/TEE] Store the key and certificate encrypted with the eFuse > >        key > >    2.  [TEE vendor or OEM] Store trusted CA certificate list into > >        devices” > > Here, “Trust Anchor” is referring to both the TFW private key and the > TAM CA root certificate store > > BUT later on in the spec: > > “The root CA certificates for a TAM, which are > > embedded into the trust anchor store in a device, should have long > > lifetimes that don't require device trust anchor update.” > > And > > “Trust Anchor: A root certificate that can be used to validate its > > children certificates. It is usually embedded in a device or > > configured by a TAM for validating the trust of a remote entity's > > certificate.” > > Here, “Trust Anchor” refers to the TAM root CA whitelist that is > embedded in the TEE in order to allow the TEE to chain TAM certificates > to the root CA certs (to determine what certs to trust) > > …So it is best if we can remove the term “trust anchor” wherever it > refers to the concept of root CA certs, and refer to “TAM root CA > certificate store” (or something like that) > > , and for everywhere else that uses “trust anchor” to refer to the > concept of secureboot/attestation etc, we need to settle on some other > term. In some cases > > e.g. “pair, which is securely stored in the TEE. This key pair is > referred to as the 'root of trust'.” > > we can simply refer to the TFW key (since in places ‘root of trust’ is > used to describe the TFW key). > > Andrew Atyeo > > Security Architect > > Intercede > > Digital trust    people | devices | apps > > Office: +44 (0) 1455 558 111 > > www.intercede.com > > -----Original Message----- > From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Dave Thaler > Sent: 05 July 2018 21:36 > To: Wheeler, David M >; Hannes Tschofenig > >; > teep@ietf.org > Subject: Re: [Teep] Comments on I-D Action: > draft-ietf-teep-architecture-00...txt > > [speaking as an individual] > > As David says, there's more than one type of "Root-of-Trust" aka "trust > anchor". > > There are industry terms of art for the different types. > > One example article that gives a decent summary is > https://healthitsecurity.com/news/nist-roots-of-trust-for-healthcare-mobile-devices > > > In particular, the industry terms (from NIST SP 800-164, potentially > among others) are: > > Roof of Trust for Storage (RTS) > > Root of Trust for Verification (RTV) > > Root of Trust for Integrity (RTI) > > Root of Trust for Reporting (RTR) > > Root of Trust for Measurement (RTM) > > I would recommend using the above terms and not using "trust anchor" or > the unqualified "root of trust" term. > > Dave > > -----Original Message----- > > From: TEEP > On > Behalf Of Wheeler, David M > > Sent: Thursday, July 5, 2018 12:52 PM > > To: Hannes Tschofenig >; teep@ietf.org > > Subject: Re: [Teep] Comments on I-D Action: > draft-ietf-teep-architecture-00.txt > > Hannes, > > If that is the case (trust root and trust anchors are the same), then I > have a concern regarding crypto separation. > > In one definition the Trust Anchor signs certificates, in the other > definition a Root-of-Trust signs attestations. > > If these are in fact the same key, then they are being used for two > different functions, which is not recommended for cryptographic keys. > > Further, it seems to me (though I may be misunderstanding the intended > function), the private key of the Trust Anchor resides outside the > device, in a separate entity, like a CA or a TAM. > > However, the private key of a Root-of-Trust resides in the TEE (or is > accessible only to the TEE). > > Can you pick apart my understanding of the two definitions of keys, and > help me understand where I got thrown off? > > Thanks, > > Dave Wheeler > > -----Original Message----- > > From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com > ] > > Sent: Thursday, July 5, 2018 12:41 PM > > To: Wheeler, David M >; teep@ietf.org > > Subject: RE: [Teep] Comments on I-D Action: > draft-ietf-teep-architecture-00.txt > > Just a quick remark: IMHO root of trust and trust anchor are the same > thing. I believe we should update the text to only talk about trust > anchors and forget the root of trust terminology. > > -----Original Message----- > > From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M > > Sent: 05 July 2018 21:38 > > To: teep@ietf.org > > Subject: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt > > I have several comments on the new architecture draft. > > The first comment has to do with the definition of the "Trust Anchor" > (page 4) > > The definition states: > > Trust Anchor: A root certificate that can be used to validate its > >                             certificates. It is usually embedded in a > device or > >                             configured by a TAM for validating the > trust of a remote entity's > >                             certificate. > > Then later in section 3 (page 6) > > This specification assumes that an applicable device is equipped with > one or more TEEs and each TEE is pre-provisioned with a device-unique > public/private key pair, which is securely stored. This key pair is > referred to as the 'root of trust' for remote attestation of the > associated TEE in a device by an TAM. > > It is not clear whether the "Trust Anchor" is the same as the > "root-of-trust" key pair, since the "root-of-trust" is not included in > the definitions.. > > If they are intended to be different (which is what I believe), then I > suggest we add the "root-of-trust" to the definitions, and explain the > difference. Oftentimes, in my experience, these terms are used > interchangeably. > > Here is my attempt to create definitions for these two types of keys: > > Trust Anchor: A trust anchor is public asymmetric key, preferably > contained in a certificate > >                             that represents a trusted entity to a > device. This public key may be used by > >                             the holder of the corresponding private key > to sign other certificates, > >                             thereby communicating the signed > certificate may also be trusted. > >                             The trust anchor is usually embedded in a > device or configured by a TAM > >                              and used by the device to validate the > trust of a remote entity by > >                             verifying that entity's certificate is > signed by a trust anchor. > >                              Trust anchors must be stored in a way that > prevents or strongly resists > >                              modification by unauthorized software and > hardware adversaries. > >           An example of a trust anchor is the public key of a TAM or SP > which is > >                           "pinned" or securely stored inside the > device, and that trust anchor is used > >                             like a CA certificate to validate the trust > in other keys/certificates. > >                            A trust anchor may be viewed by both trusted > and untrusted entities on the device, > >                           But may only be modified or deleted by a > trusted entity. > > Root-of-Trust Key:  A device-unique key generated at device > manufacturing or at > >                             TEE provisioning, which is securely stored > and only accessible to the TEE. > >                             The Root-of-Trust Key is used for > attestation signing which proves the signed > >                             message originated or was approved by the > TEE, and may be trusted to the same > >                            degree as the TEE. > > -----Original Message----- > > From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of > internet-drafts@ietf.org > > Sent: Wednesday, July 4, 2018 7:49 AM > > To: i-d-announce@ietf.org > > Cc: teep@ietf.org > > Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > > This draft is a work item of the Trusted Execution Environment > Provisioning WG of the IETF. > >         Title           : Trusted Execution Environment Provisioning > (TEEP) Architecture > >         Authors         : Mingliang Pei > >                           Hannes Tschofenig > >                           Andrew Atyeo > >                           Dapeng > > Filename        : draft-ietf-teep-architecture-00.txt > > Pages           : 24 > > Date            : 2018-07-02 > > Abstract: > >    A Trusted Execution Environment (TEE) was designed to provide a > >    hardware-isolation mechanism to separate a regular operating system > >    from security- sensitive applications. > >    This architecture document motivates the design and standardization > >    of a protocol for managing the lifecyle of trusted applications > >    running inside a TEE. > > The IETF datatracker status page for this draft is: > > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=XBuTlsiV5OjkxkcqULdsmroTnWRZqApH3fBokJGvkTE%3D&reserved=0 > > > There are also htmlized versions available at: > > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=heO1xlxfrVZyyzYziQy8V2P0vxiEbTVSF8sFdNaw8sc%3D&reserved=0 > > > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=aoKW%2FFnlzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&reserved=0 > > > Please note that it may take a couple of minutes from the time of > submission until the htmlized version and diff are available at > tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > > TEEP mailing list > > TEEP@ietf.org > > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okIPShXtd0%3D&reserved=0 > > > _______________________________________________ > > TEEP mailing list > > TEEP@ietf.org > > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okIPShXtd0%3D&reserved=0 > > > IMPORTANT NOTICE: The contents of this email and any attachments are > confidential and may also be privileged. If you are not the intended > recipient, please notify the sender immediately and do not disclose the > contents to any other person, use it for any purpose, or store or copy > the information in any medium. Thank you. > > _______________________________________________ > > TEEP mailing list > > TEEP@ietf.org > > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=7x7cgTvWZOsnWEDD9hQuRRvwGvB4TTpl0okIPShXtd0%3D&reserved=0 > > > _______________________________________________ > > TEEP mailing list > > TEEP@ietf.org > > https://www.ietf.org/mailman/listinfo/teep > > > IMPORTANT NOTICE: The contents of this email and any attachments are > confidential and may also be privileged.. If you are not the intended > recipient, please notify the sender immediately and do not disclose the > contents to any other person, use it for any purpose, or store or copy > the information in any medium. Thank you. > > > > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep > From nobody Fri Jul 6 08:43:44 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABE4A130EB1 for ; Fri, 6 Jul 2018 08:43:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ED1w7eYi7Fn2 for ; Fri, 6 Jul 2018 08:43:34 -0700 (PDT) Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com [IPv6:2a00:1450:4864:20::432]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38F00130E6E for ; Fri, 6 Jul 2018 08:43:34 -0700 (PDT) Received: by mail-wr1-x432.google.com with SMTP id h40-v6so4625096wrh.2 for ; Fri, 06 Jul 2018 08:43:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:subject:to:references:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=zhNb0AYsKRBteAHH07+Hk2ohVc2R5qU0klfO73vRmyM=; b=BjIKYJsanGFxwHmkOT4Up57H+Y3TNiWr2in4n2vJPqHJi/wnyEGLisX1hOXaLY5wbB yBuDkizA3gi00oMTDVRsDddDyUWczFa1dO6Ze3AUAvpSl2Yts005L4WI8ifCFpsJYiTK 0uOrDav6dUB90MD/KtUTS0aognZhHpl2MMd20wzXv6QTVLMcAHRn19DuTqggwb+zABBi QsUg3g4tWYFEaX5X7hbAxLxuAQTNwkI+QOTI0c/H7hQMaNDJHaDGg4B4JAMhvKxZA5Pq z4FLCPVW95kjbkLGDHq3CX/QqCiE5lzqBmTzsEPfEymN2aLtOkZ//lorslKfsTLhp8qX R6EA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:subject:to:references:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=zhNb0AYsKRBteAHH07+Hk2ohVc2R5qU0klfO73vRmyM=; b=NBJX6ohFrMZW+0yx18IgggJ/JetMZReC1eYHAJWyTt288JcYYFRXvbRAqZy6GXL+Wi fglS3IZ1z0xp/GVESt/B1JBcwlXOxF5HRKGSAMSS6TX9T/eFGY5Sw5+P+lFOFLBbz5CC A+WssOC7r0aKzBPDIr7AkoHT1+QJ6Am5SoKaga9cC1zTcElll2/lxE0YVxmeHsw1Mu1s tkzo7H6QFg6P/3TdlTnqGhTiMZNb7z261mKCto8Hy/MOfMs5KOowi4vOwkupUKNw47F8 EpXpAlF6fR0THdEcccF7oYlaGGvOulIjgheBbmKsSuKS9RGPUOxBg9eU6Th+m9isdPr3 tR2g== X-Gm-Message-State: APt69E1l65fH+9uvFQ146Jb5wcUG514lx5Xe57KTD26w3VipFzKr9QXr p3uihuI42hBjOBsEvdEClHUzoQ== X-Google-Smtp-Source: AAOMgpfr0xDNTrBKF9msF4li7y3Hn2gdJYYy22nWaPMNDDH1ecYdzL5U1geaxKIzd2MEzMnRt5WC2w== X-Received: by 2002:adf:dfcd:: with SMTP id q13-v6mr7539307wrn.113.1530891812326; Fri, 06 Jul 2018 08:43:32 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id w24-v6sm6962018wmc.15.2018.07.06.08.43.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 06 Jul 2018 08:43:31 -0700 (PDT) From: Anders Rundgren To: Hannes Tschofenig , "Wheeler, David M" , "teep@ietf.org" References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> <19fdc505-f0f1-ae9f-4fec-0605c7ee3690@gmail.com> Message-ID: <20f8295d-68b5-fc96-c418-c4f1923d4a2b@gmail.com> Date: Fri, 6 Jul 2018 17:43:27 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 15:43:40 -0000 On 2018-07-06 13:35, Hannes Tschofenig wrote: > Hi Anders, Hi Hannes, I think you misunderstood what I meant. > > Most likely it would make more sense to use the FIDO Authenticator in the TEE of the phone rather than connected to an external device. Using another device, such as a watch via BLE, may be possible but it is probably not the most common approach. (In fact I have actually contributed to the FIDO specification that offers that functionality.) The scenario I tried to depict was a Phone used as security token together with a PC running a Web application. Using FIDO this can be done in a secure ("non-phishable") way through standardized (but specific) FIDO interfaces using BLE (or cable). For non-FIDO solutions like PKI and payments, there is nothing similar available leaving us with security broken OOB schemes like QR. Question: What's the value of OTrP if it in reality limits you to FIDO? This question becomes even more relevant given that FIDO (in contrast to OTrP...) already supports a perfectly working Web provisioning [1] system. Personally I would be extremely surprised [2] if a not so distant release of Win10 running on recent Intel HW doesn't come with WebAuth/FIDO support built-in. The same goes for Android/ARM. Having had two generations of TPMs with no use whatsoever, I was hoping for something more flexible this time :-| Anders 1] Web provisioning is as ugly as it was way back during the KEYPROV days. I would say it has actually gotten worse, due to new constraints introduced by the browser vendors. 2] Since I as early as 2007 together with a bunch of Nokia gurus brought the first(?) integrated TEE "secure key" solution to the market, I know there's no magic here. > There is a lot of "educating" going on as part of the FIDO public policy and privacy program, which I had the pleasure to co-chair for some time. > > You are correct that FIDO has not been designed with the classical client-side PKI in mind. IMHO that's a good thing. > > For what matters with regards to TEEP is whether we can get a standardized mechanism defined that allows us to enable easier deployments like the once described above. Today, this is rather challenging since it is tough to get the necessary FIDO Authenticator code on phones and tablets. > > Ciao > Hannes > > -----Original Message----- > From: Anders Rundgren [mailto:anders.rundgren.net@gmail.com] > Sent: 06 July 2018 09:45 > To: Hannes Tschofenig; Wheeler, David M; teep@ietf.org > Subject: Re: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt > > On 2018-07-06 08:26, Hannes Tschofenig wrote: >> Hi Anders, > > Hi Hannes, > >> In this specific example I have to admit that I have a bias towards FIDO. In this setup FIDO wouldn't need an out-of-band channel. > > I assume you mean that the phone would be equipped with a FIDO authenticator and then connected to the PC though BLE (or worst-case through a cable), right? > > This obviously works but is incompatible with client side PKI as well as other schemes that do not have a natural tie to FIDO. > > Since this certainly isn't "common knowledge", the most reasonable would be that those who represent the platform vendors (ARM, Intel, MSFT) explained to governments and banks that they should carefully reexamine their design choices for the future. > > FWIW, I'm personally interested in creating more "neutral" security technology, including addressing OOB channel authentication beyond what the current standard (QR) offers (=zero). > > Cheers, > Anders > > >> The TEE would helpful and OTrP could be used to distribute the FIDO Authenticator code to phones and tablets. >> >> Ciao >> Hannes >> >> -----Original Message----- >> From: Anders Rundgren [mailto:anders.rundgren.net@gmail.com] >> Sent: 06 July 2018 08:07 >> To: Hannes Tschofenig; Wheeler, David M; teep@ietf.org >> Subject: Re: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt >> >> On 2018-07-06 07:50, Hannes Tschofenig wrote: >>> Hi Anders, >> >> Hi Hannes, >> >>> I agree that there are mobile phone authentication and payment solutions that do not offer much better security than traditional passwords. >>> >>> We do, however, not propose a single authentication or payment solution but instead want to enable developers to upload and manage code on the TEE. This could, for example, enable improved security for an FIDO-based authentication mechanism. >> >> What I was trying to explain is that it doesn't matter if you have TEEs or not if the system depends on an OOB channel (which currently is close to a de-facto standard). >> >> As a developer of such systems I find it deeply unsatisfying having to admit that in spite of using "state of the art security solutions", it doesn't really cope with phishing. >> >> What is your recommended solution/workaround to this problem? Dropping OOB? Replacing OOB with ...? >> >> Cheers, >> Anders >> >>> >>> Ciao >>> Hannes >>> >>> -----Original Message----- >>> From: Anders Rundgren [mailto:anders.rundgren.net@gmail.com] >>> Sent: 06 July 2018 06:56 >>> To: Wheeler, David M; teep@ietf.org; Hannes Tschofenig >>> Subject: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt >>> >>> I hope that you guys don't mind a (distantly) related architectural question. >>> >>> Using trusted hardware and TEEs is indeed cool since they enable security levels comparable to traditional smart cards although provisioned on-line. >>> >>> A quite popular use case is using a mobile phone as a "security device" together with a PC running a web applications like on-line banking. Such arrangements usually depend on an OOB channel from the phone. >>> >>> However, the majority of these applications are in spite of all the great security solutions still susceptible to fairly trivial phishing attacks. In fact, some of these systems have been exploited numerous times through social engineering over the phone! >>> >>> What is the problem then? Please don't take it personally but there are obviously some disconnects in this industry, high-lighted by the fact that QR code has become "the new black" although it is inconvenient and have poor security characteristics. >>> >>> Summary: for a certain kind of real world applications, trusted hardware offers only marginally better security than traditional passwords. >>> >>> Cheers, >>> Anders >>> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. >>> >> >> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. >> > > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep > From nobody Fri Jul 6 08:48:07 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4AEC130E89 for ; Fri, 6 Jul 2018 08:48:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D0IH7vFhRmqb for ; Fri, 6 Jul 2018 08:48:01 -0700 (PDT) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03548130E6E for ; Fri, 6 Jul 2018 08:48:00 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Jul 2018 08:48:00 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,316,1526367600"; d="scan'208";a="64750493" Received: from fmsmsx104.amr.corp.intel.com ([10.18.124.202]) by fmsmga002.fm.intel.com with ESMTP; 06 Jul 2018 08:48:00 -0700 Received: from fmsmsx121.amr.corp.intel.com (10.18.125.36) by fmsmsx104.amr.corp.intel.com (10.18.124.202) with Microsoft SMTP Server (TLS) id 14.3.319.2; Fri, 6 Jul 2018 08:47:59 -0700 Received: from crsmsx152.amr.corp.intel.com (172.18.7.35) by fmsmsx121.amr.corp.intel.com (10.18.125.36) with Microsoft SMTP Server (TLS) id 14.3.319.2; Fri, 6 Jul 2018 08:47:59 -0700 Received: from crsmsx102.amr.corp.intel.com ([169.254.2.60]) by CRSMSX152.amr.corp.intel.com ([169.254.5.31]) with mapi id 14.03.0319.002; Fri, 6 Jul 2018 09:47:57 -0600 From: "Wheeler, David M" To: Henk Birkholz , Dave Thaler , Hannes Tschofenig , Andrew Atyeo , "'Wiseman, Monty (GE Global Research, US)'" , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AQHUFJgg0lRWCPXA+UuJ2PLzqv/v86SBCEWggABypQCAAMnjgIAALZMAgAA2o4CAAAm+gP//pTDg Date: Fri, 6 Jul 2018 15:47:56 +0000 Message-ID: <0627F5240443D2498FAA65332EE46C843B66B434@CRSMSX102.amr.corp.intel.com> References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiOWMzNzUyY2YtZGIzMi00OGNjLWIyOGMtNmFkMDE1ZTQxZTEwIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoibzh2ekdLcWw2OE1tWEZQNU8xTGlHWkRPWkJCZXdYSFd6MUx0ZzBnVHRuTUZlemZEYyt3UlJweDMyNE9VM2tcLysifQ== x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.200.100 dlp-reaction: no-action x-originating-ip: [172.18.205.10] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 15:48:05 -0000 Henk, I quickly reviewed the NIST document, and did not find a RTC - Root of Trust for Confidentiality Can you provide a reference and a short definition? Thanks, Dave Wheeler -----Original Message----- From: Henk Birkholz [mailto:henk.birkholz@sit.fraunhofer.de]=20 Sent: Friday, July 6, 2018 8:12 AM To: Dave Thaler ; Hannes Tschofen= ig ; Andrew Atyeo ; = Wheeler, David M ; 'Wiseman, Monty (GE Global Re= search, US)' ; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Hi all, the TCG's definition of RoT is: > A component that performs one or more security specific functions, such a= s measurement, storage, reporting, verification, and/or update. It is trust= ed always to behave in the expected manner, because its misbehavior cannot = be detected (such as by measurement) under normal operation. This term is disconnected from the quality of being "securely stored".=20 The TCG defines Shielded Location: > A place (memory, register, etc.) where it is safe to operate on sensitive= data; data locations that can be accessed only by Protected Capabilities. Trust Anchor is defined by RFC494 already (and therefore difficult to redef= ine, I think): > An established point of trust (usually based on the authority of some per= son, office, or organization) from which a certificate user begins the vali= dation of a certification path. Corresponding to the definition above, in the TCG context it is also common= to define these "favors" of RoT: > RTC - Root of Trust for Confidentiality RTI - Root of Trust for=20 > Integrity RTM - Root of Trust for Measurement RTR - Root of Trust for=20 > Reporting RTS - Root of Trust for Storage RTV - Root of Trust for=20 > Verification Maybe it can be of use to define a "flavor" here also? Arbitrary use of one= single shielded secret for multiple uses might enable a variety of attack = vectors. Viele Gr=FC=DFe, Henk On 07/06/2018 04:37 PM, Dave Thaler wrote: > [speaking as an individual participant] >=20 > The WG charter says "The group will maintain a close relationship with=20 > the . Trusted Computing Group, and other relevant standards groups..." > and I think part of that is to use consistent terminology.=A0 Hence my=20 > recommendation that David Wheeler already incorporated into his=20 > proposed text.=A0 (Thanks David) >=20 > Dave >=20 > *From:* Hannes Tschofenig > *Sent:* Friday, July 6, 2018 4:22 AM > *To:* Andrew Atyeo ; Dave Thaler=20 > ; Wheeler, David M ;=20 > teep@ietf.org > *Subject:* RE: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > The problem is only that "root of trust" is not a well defined term in=20 > the IETF, at least as far as I know. Trust anchor, on the other hand,=20 > is well defined. >=20 > The definition currently in the document for root of trust seems to be=20 > similar to trust anchor. However, I agree with both Andy and with=20 > David that we need to find out whether we want to point out certain=20 > usages of the key (such as for the purpose of the attestation).=20 > Whether this justifies the introduction of another term is yet another=20 > discussion >=20 > Ciao >=20 > Hannes >=20 > *From:*Andrew Atyeo [mailto:Andrew.Atyeo@intercede.com] > *Sent:* 06 July 2018 10:38 > *To:* Dave Thaler; Wheeler, David M; Hannes Tschofenig; teep@ietf.org=20 > > *Subject:* RE: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > In OTrP, I believe "root of trust" and "trust anchor" are currently=20 > referring to 2 different things in the OTrP spec. >=20 > =B7*Root of trust* >=20 > Excerpt from OTrP: "This specification assumes that an applicable=20 > device is equipped with >=20 > =A0=A0 a TEE and is pre-provisioned with a device-unique public/private= =20 > key >=20 > =A0=A0 pair, which is securely stored.=A0 This key pair is referred as t= he >=20 > =A0=A0 'root of trust'.=A0 An entity that uses such a device to run Trus= ted >=20 > =A0=A0 Applications (TAs) is known as a Service Provider (SP)." >=20 > Here, "Root of Trust" must be talking about either the TEE/TFW private=20 > key, so "root of trust" is referring to the process of secure boot=20 > that results in a TAM being able to use a signature from this key to=20 > know whether to trust the TEE >=20 > =B7*Trust Anchor* >=20 > There is a problem this refers to 2 completely different concepts: >=20 > "Setup trust anchors in devices >=20 > =A0=A0 1.=A0 [TFW/TEE] Store the key and certificate encrypted with the= =20 > eFuse >=20 > =A0=A0=A0=A0=A0=A0 key >=20 > =A0=A0 2.=A0 [TEE vendor or OEM] Store trusted CA certificate list into >=20 > =A0=A0=A0=A0=A0=A0 devices" >=20 > Here, "Trust Anchor" is referring to both the TFW private key and the=20 > TAM CA root certificate store >=20 > BUT later on in the spec: >=20 > "The root CA certificates for a TAM, which are >=20 > embedded into the trust anchor store in a device, should have long >=20 > lifetimes that don't require device trust anchor update." >=20 > And >=20 > "Trust Anchor: A root certificate that can be used to validate its >=20 > children certificates. It is usually embedded in a device or >=20 > configured by a TAM for validating the trust of a remote entity's >=20 > certificate." >=20 > Here, "Trust Anchor" refers to the TAM root CA whitelist that is=20 > embedded in the TEE in order to allow the TEE to chain TAM=20 > certificates to the root CA certs (to determine what certs to trust) >=20 > .So it is best if we can remove the term "trust anchor" wherever it=20 > refers to the concept of root CA certs, and refer to "TAM root CA=20 > certificate store" (or something like that) >=20 > , and for everywhere else that uses "trust anchor" to refer to the=20 > concept of secureboot/attestation etc, we need to settle on some other=20 > term. In some cases >=20 > e.g. "pair, which is securely stored in the TEE. This key pair is=20 > referred to as the 'root of trust'." >=20 > we can simply refer to the TFW key (since in places 'root of trust' is=20 > used to describe the TFW key). >=20 > Andrew Atyeo >=20 > Security Architect >=20 > Intercede >=20 > Digital trust=A0=A0=A0 people | devices | apps >=20 > Office: +44 (0) 1455 558 111 >=20 > www.intercede.com >=20 > -----Original Message----- > From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Dave Thaler > Sent: 05 July 2018 21:36 > To: Wheeler, David M >; Hannes Tschofenig=20 > >; > teep@ietf.org > Subject: Re: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00...txt >=20 > [speaking as an individual] >=20 > As David says, there's more than one type of "Root-of-Trust" aka=20 > "trust anchor". >=20 > There are industry terms of art for the different types. >=20 > One example article that gives a decent summary is=20 > https://healthitsecurity.com/news/nist-roots-of-trust-for-healthcare-m > obile-devices=20 > thitsecurity.com%2Fnews%2Fnist-roots-of-trust-for-healthcare-mobile-de > vices&data=3D02%7C01%7Cdthaler%40microsoft.com%7Ca9986e033e9a4df8bb3608d > 5e332b1a0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664729240700 > 830&sdata=3DnWEwUiwplWo%2F2ikoHBR6mg6s3vI7vKr0YywPjl8Nuz4%3D&reserved=3D0= > >=20 > In particular, the industry terms (from NIST SP 800-164, potentially=20 > among others) are: >=20 > Roof of Trust for Storage (RTS) >=20 > Root of Trust for Verification (RTV) >=20 > Root of Trust for Integrity (RTI) >=20 > Root of Trust for Reporting (RTR) >=20 > Root of Trust for Measurement (RTM) >=20 > I would recommend using the above terms and not using "trust anchor"=20 > or the unqualified "root of trust" term. >=20 > Dave >=20 > -----Original Message----- >=20 > From: TEEP > On=20 > Behalf Of Wheeler, David M >=20 > Sent: Thursday, July 5, 2018 12:52 PM >=20 > To: Hannes Tschofenig >; teep@ietf.org=20 > >=20 > Subject: Re: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > Hannes, >=20 > If that is the case (trust root and trust anchors are the same), then=20 > I have a concern regarding crypto separation. >=20 > In one definition the Trust Anchor signs certificates, in the other=20 > definition a Root-of-Trust signs attestations. >=20 > If these are in fact the same key, then they are being used for two=20 > different functions, which is not recommended for cryptographic keys. >=20 > Further, it seems to me (though I may be misunderstanding the intended=20 > function), the private key of the Trust Anchor resides outside the=20 > device, in a separate entity, like a CA or a TAM. >=20 > However, the private key of a Root-of-Trust resides in the TEE (or is=20 > accessible only to the TEE). >=20 > Can you pick apart my understanding of the two definitions of keys,=20 > and help me understand where I got thrown off? >=20 > Thanks, >=20 > Dave Wheeler >=20 > -----Original Message----- >=20 > From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com=20 > ] >=20 > Sent: Thursday, July 5, 2018 12:41 PM >=20 > To: Wheeler, David M >; teep@ietf.org=20 > >=20 > Subject: RE: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > Just a quick remark: IMHO root of trust and trust anchor are the same=20 > thing. I believe we should update the text to only talk about trust=20 > anchors and forget the root of trust terminology. >=20 > -----Original Message----- >=20 > From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David=20 > M >=20 > Sent: 05 July 2018 21:38 >=20 > To: teep@ietf.org >=20 > Subject: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > I have several comments on the new architecture draft. >=20 > The first comment has to do with the definition of the "Trust Anchor"=20 > (page 4) >=20 > The definition states: >=20 > Trust Anchor: A root certificate that can be used to validate its >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 certificates. It is usually embedded in a=20 > device or >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 =A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0configured by a TAM for validating the=20 > trust of a remote entity's >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 certificate. >=20 > Then later in section 3 (page 6) >=20 > This specification assumes that an applicable device is equipped with=20 > one or more TEEs and each TEE is pre-provisioned with a device-unique=20 > public/private key pair, which is securely stored. This key pair is=20 > referred to as the 'root of trust' for remote attestation of the=20 > associated TEE in a device by an TAM. >=20 > It is not clear whether the "Trust Anchor" is the same as the=20 > "root-of-trust" key pair, since the "root-of-trust" is not included in=20 > the definitions.. >=20 > If they are intended to be different (which is what I believe), then I=20 > suggest we add the "root-of-trust" to the definitions, and explain the=20 > difference. Oftentimes, in my experience, these terms are used=20 > interchangeably. >=20 > Here is my attempt to create definitions for these two types of keys: >=20 > Trust Anchor: A trust anchor is public asymmetric key, preferably=20 > contained in a certificate >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 =A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0that represents a trusted entity to a=20 > device. This public key may be used by >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 the holder of the corresponding private=20 > key to sign other certificates, >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 thereby communicating the signed=20 > certificate may also be trusted. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 The trust anchor is usually embedded in a=20 > device or configured by a TAM >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0 and used by the device to validate the=20 > trust of a remote entity by >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 verifying that entity's certificate is=20 > signed by a trust anchor. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0 Trust anchors must be stored in a way=20 > that prevents or strongly resists >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0 modification by unauthorized software=20 > and hardware adversaries. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0 An example of a trust anchor is the public k= ey of a TAM or=20 > SP which is >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 "pinned" or securely stored inside the=20 > device, and that trust anchor is used >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 like a CA certificate to validate the=20 > trust in other keys/certificates. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0 A trust anchor may be viewed by both=20 > trusted and untrusted entities on the device, >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 But may only be modified or deleted by a=20 > trusted entity. >=20 > Root-of-Trust Key:=A0 A device-unique key generated at device=20 > manufacturing or at >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 TEE provisioning, which is securely=20 > stored and only accessible to the TEE. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 The Root-of-Trust Key is used for=20 > attestation signing which proves the signed >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 message originated or was approved by the=20 > TEE, and may be trusted to the same >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0 degree as the TEE. >=20 > -----Original Message----- >=20 > From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of=20 > internet-drafts@ietf.org >=20 > Sent: Wednesday, July 4, 2018 7:49 AM >=20 > To: i-d-announce@ietf.org >=20 > Cc: teep@ietf.org >=20 > Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt >=20 > A New Internet-Draft is available from the on-line Internet-Drafts=20 > directories. >=20 > This draft is a work item of the Trusted Execution Environment=20 > Provisioning WG of the IETF. >=20 > =A0=A0=A0=A0=A0=A0=A0 Title=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 : Trusted Exec= ution Environment Provisioning > (TEEP) Architecture >=20 > =A0=A0=A0=A0=A0=A0=A0 Authors=A0=A0=A0=A0=A0=A0=A0=A0 : Mingliang Pei >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 Hannes Tschofenig >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 Andrew Atyeo >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 Dapeng >=20 > Filename=A0=A0=A0=A0=A0=A0=A0 : draft-ietf-teep-architecture-00.txt >=20 > Pages=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 : 24 >=20 > Date=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 : 2018-07-02 >=20 > Abstract: >=20 > =A0=A0 A Trusted Execution Environment (TEE) was designed to provide a >=20 > =A0=A0 hardware-isolation mechanism to separate a regular operating=20 > system >=20 > =A0=A0 from security- sensitive applications. >=20 > =A0=A0 This architecture document motivates the design and=20 > standardization >=20 > =A0=A0 of a protocol for managing the lifecyle of trusted applications >=20 > =A0=A0 running inside a TEE. >=20 > The IETF datatracker status page for this draft is: >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatat > racker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=3D02%7C > 01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f9 > 88bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DXB > uTlsiV5OjkxkcqULdsmroTnWRZqApH3fBokJGvkTE%3D&reserved=3D0 > tracker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=3D02%7C01% > 7Cdthaler%40microsoft.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988b > f86f141af91ab2d7cd011db47%7C1%7C0%7C636664729240700830&sdata=3DQgHpEQ6cq > PzjNSNAXlOBVJfmbHzpDogVNJNpWI6uPzg%3D&reserved=3D0> >=20 > There are also htmlized versions available at: >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools > .ietf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7C01%7C > dthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf8 > 6f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DheO1xlx > frVZyyzYziQy8V2P0vxiEbTVSF8sFdNaw8sc%3D&reserved=3D0 > s.ietf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7C01%7Cdth > aler%40microsoft.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f1 > 41af91ab2d7cd011db47%7C1%7C0%7C636664729240710835&sdata=3DyLbkguKNpWobGS > QbfCI3XTLaLJPHO5pX7y0uzM5aQpI%3D&reserved=3D0> >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatat > racker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&dat > a=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc > %7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&s > data=3DaoKW%2FFnlzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&reserved=3D0 > tracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D0 > 2%7C01%7Cdthaler%40microsoft.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C > 72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664729240720840&sdata=3Diz > EKpdtjJPah2dorUbEc7ZdJZJAvPITE9iop%2BtuFrms%3D&reserved=3D0> >=20 > Please note that it may take a couple of minutes from the time of=20 > submission until the htmlized version and diff are available at=20 > tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: >=20 > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ >=20 > TEEP mailing list >=20 > TEEP@ietf.org >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i > etf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40micro > soft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7c > d011db47%7C1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRR > vwGvB4TTpl0okIPShXtd0%3D&reserved=3D0 > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsof > t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 > 1db47%7C1%7C0%7C636664729240730849&sdata=3DvxedecEwOXML1kDDEvCVOmZWyVp7J > F6jky%2BnGgZeU5w%3D&reserved=3D0> >=20 > _______________________________________________ >=20 > TEEP mailing list >=20 > TEEP@ietf.org >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i > etf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40micro > soft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7c > d011db47%7C1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRR > vwGvB4TTpl0okIPShXtd0%3D&reserved=3D0 > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsof > t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 > 1db47%7C1%7C0%7C636664729240730849&sdata=3DvxedecEwOXML1kDDEvCVOmZWyVp7J > F6jky%2BnGgZeU5w%3D&reserved=3D0> >=20 > IMPORTANT NOTICE: The contents of this email and any attachments are=20 > confidential and may also be privileged. If you are not the intended=20 > recipient, please notify the sender immediately and do not disclose=20 > the contents to any other person, use it for any purpose, or store or=20 > copy the information in any medium. Thank you. >=20 > _______________________________________________ >=20 > TEEP mailing list >=20 > TEEP@ietf.org >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i > etf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40micro > soft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7c > d011db47%7C1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRR > vwGvB4TTpl0okIPShXtd0%3D&reserved=3D0 > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsof > t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 > 1db47%7C1%7C0%7C636664729240740862&sdata=3DBM3CGgYe99eqU3Cr9j8CZ3R9LIxD0 > ycKnT8%2FEMwUqjU%3D&reserved=3D0> >=20 > _______________________________________________ >=20 > TEEP mailing list >=20 > TEEP@ietf.org >=20 > https://www.ietf.org/mailman/listinfo/teep > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsof > t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 > 1db47%7C1%7C0%7C636664729240750863&sdata=3DKuTTsAhETZCmCGwo1Y3rmgkhCM8w5 > Mq8JkxxcLL26N8%3D&reserved=3D0> >=20 > IMPORTANT NOTICE: The contents of this email and any attachments are=20 > confidential and may also be privileged.. If you are not the intended=20 > recipient, please notify the sender immediately and do not disclose=20 > the contents to any other person, use it for any purpose, or store or=20 > copy the information in any medium. Thank you. >=20 >=20 >=20 > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep >=20 From nobody Fri Jul 6 08:51:26 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06386130E89 for ; Fri, 6 Jul 2018 08:51:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IEpX-yrhK7_x for ; Fri, 6 Jul 2018 08:51:22 -0700 (PDT) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D14C130E6E for ; Fri, 6 Jul 2018 08:51:21 -0700 (PDT) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id w66Fp71w010699 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 6 Jul 2018 17:51:08 +0200 Received: from [134.102.163.216] (134.102.163.216) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.399.0; Fri, 6 Jul 2018 17:51:02 +0200 To: "Wheeler, David M" , Dave Thaler , Hannes Tschofenig , Andrew Atyeo , "'Wiseman, Monty (GE Global Research, US)'" , "teep@ietf.org" References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66B434@CRSMSX102.amr.corp.intel.com> From: Henk Birkholz Message-ID: <8934322b-d759-c82f-bda0-6b70961fe11f@sit.fraunhofer.de> Date: Fri, 6 Jul 2018 17:45:28 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <0627F5240443D2498FAA65332EE46C843B66B434@CRSMSX102.amr.corp.intel.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [134.102.163.216] Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 15:51:25 -0000 Hi Dave, sure :) Root of Trust for Confidentiality is defined as: > An RoT providing confidentiality for data stored in TPM Shielded Locations. in > https://trustedcomputinggroup.org/wp-content/uploads/TCG-Glossary-V1.1-Rev-1.0.pdf Viele Grüße, Henk On 07/06/2018 05:47 PM, Wheeler, David M wrote: > Henk, > I quickly reviewed the NIST document, and did not find a > RTC - Root of Trust for Confidentiality > > Can you provide a reference and a short definition? > Thanks, > Dave Wheeler > > -----Original Message----- > From: Henk Birkholz [mailto:henk.birkholz@sit.fraunhofer.de] > Sent: Friday, July 6, 2018 8:12 AM > To: Dave Thaler ; Hannes Tschofenig ; Andrew Atyeo ; Wheeler, David M ; 'Wiseman, Monty (GE Global Research, US)' ; teep@ietf.org > Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt > > Hi all, > > the TCG's definition of RoT is: > >> A component that performs one or more security specific functions, such as measurement, storage, reporting, verification, and/or update. It is trusted always to behave in the expected manner, because its misbehavior cannot be detected (such as by measurement) under normal operation. > > This term is disconnected from the quality of being "securely stored". > The TCG defines Shielded Location: > >> A place (memory, register, etc.) where it is safe to operate on sensitive data; data locations that can be accessed only by Protected Capabilities. > > Trust Anchor is defined by RFC494 already (and therefore difficult to redefine, I think): > >> An established point of trust (usually based on the authority of some person, office, or organization) from which a certificate user begins the validation of a certification path. > > Corresponding to the definition above, in the TCG context it is also common to define these "favors" of RoT: > >> RTC - Root of Trust for Confidentiality RTI - Root of Trust for >> Integrity RTM - Root of Trust for Measurement RTR - Root of Trust for >> Reporting RTS - Root of Trust for Storage RTV - Root of Trust for >> Verification > > Maybe it can be of use to define a "flavor" here also? Arbitrary use of one single shielded secret for multiple uses might enable a variety of attack vectors. > > > Viele Grüße, > > Henk > > > > > On 07/06/2018 04:37 PM, Dave Thaler wrote: >> [speaking as an individual participant] >> >> The WG charter says "The group will maintain a close relationship with >> the . Trusted Computing Group, and other relevant standards groups..." >> and I think part of that is to use consistent terminology.  Hence my >> recommendation that David Wheeler already incorporated into his >> proposed text.  (Thanks David) >> >> Dave >> >> *From:* Hannes Tschofenig >> *Sent:* Friday, July 6, 2018 4:22 AM >> *To:* Andrew Atyeo ; Dave Thaler >> ; Wheeler, David M ; >> teep@ietf.org >> *Subject:* RE: [Teep] Comments on I-D Action: >> draft-ietf-teep-architecture-00.txt >> >> The problem is only that "root of trust" is not a well defined term in >> the IETF, at least as far as I know. Trust anchor, on the other hand, >> is well defined. >> >> The definition currently in the document for root of trust seems to be >> similar to trust anchor. However, I agree with both Andy and with >> David that we need to find out whether we want to point out certain >> usages of the key (such as for the purpose of the attestation). >> Whether this justifies the introduction of another term is yet another >> discussion >> >> Ciao >> >> Hannes >> >> *From:*Andrew Atyeo [mailto:Andrew.Atyeo@intercede.com] >> *Sent:* 06 July 2018 10:38 >> *To:* Dave Thaler; Wheeler, David M; Hannes Tschofenig; teep@ietf.org >> >> *Subject:* RE: [Teep] Comments on I-D Action: >> draft-ietf-teep-architecture-00.txt >> >> In OTrP, I believe "root of trust" and "trust anchor" are currently >> referring to 2 different things in the OTrP spec. >> >> ·*Root of trust* >> >> Excerpt from OTrP: "This specification assumes that an applicable >> device is equipped with >> >>    a TEE and is pre-provisioned with a device-unique public/private >> key >> >>    pair, which is securely stored.  This key pair is referred as the >> >>    'root of trust'.  An entity that uses such a device to run Trusted >> >>    Applications (TAs) is known as a Service Provider (SP)." >> >> Here, "Root of Trust" must be talking about either the TEE/TFW private >> key, so "root of trust" is referring to the process of secure boot >> that results in a TAM being able to use a signature from this key to >> know whether to trust the TEE >> >> ·*Trust Anchor* >> >> There is a problem this refers to 2 completely different concepts: >> >> "Setup trust anchors in devices >> >>    1.  [TFW/TEE] Store the key and certificate encrypted with the >> eFuse >> >>        key >> >>    2.  [TEE vendor or OEM] Store trusted CA certificate list into >> >>        devices" >> >> Here, "Trust Anchor" is referring to both the TFW private key and the >> TAM CA root certificate store >> >> BUT later on in the spec: >> >> "The root CA certificates for a TAM, which are >> >> embedded into the trust anchor store in a device, should have long >> >> lifetimes that don't require device trust anchor update." >> >> And >> >> "Trust Anchor: A root certificate that can be used to validate its >> >> children certificates. It is usually embedded in a device or >> >> configured by a TAM for validating the trust of a remote entity's >> >> certificate." >> >> Here, "Trust Anchor" refers to the TAM root CA whitelist that is >> embedded in the TEE in order to allow the TEE to chain TAM >> certificates to the root CA certs (to determine what certs to trust) >> >> .So it is best if we can remove the term "trust anchor" wherever it >> refers to the concept of root CA certs, and refer to "TAM root CA >> certificate store" (or something like that) >> >> , and for everywhere else that uses "trust anchor" to refer to the >> concept of secureboot/attestation etc, we need to settle on some other >> term. In some cases >> >> e.g. "pair, which is securely stored in the TEE. This key pair is >> referred to as the 'root of trust'." >> >> we can simply refer to the TFW key (since in places 'root of trust' is >> used to describe the TFW key). >> >> Andrew Atyeo >> >> Security Architect >> >> Intercede >> >> Digital trust    people | devices | apps >> >> Office: +44 (0) 1455 558 111 >> >> www.intercede.com >> >> -----Original Message----- >> From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Dave Thaler >> Sent: 05 July 2018 21:36 >> To: Wheeler, David M > >; Hannes Tschofenig >> >; >> teep@ietf.org >> Subject: Re: [Teep] Comments on I-D Action: >> draft-ietf-teep-architecture-00...txt >> >> [speaking as an individual] >> >> As David says, there's more than one type of "Root-of-Trust" aka >> "trust anchor". >> >> There are industry terms of art for the different types. >> >> One example article that gives a decent summary is >> https://healthitsecurity.com/news/nist-roots-of-trust-for-healthcare-m >> obile-devices >> > thitsecurity.com%2Fnews%2Fnist-roots-of-trust-for-healthcare-mobile-de >> vices&data=02%7C01%7Cdthaler%40microsoft.com%7Ca9986e033e9a4df8bb3608d >> 5e332b1a0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664729240700 >> 830&sdata=nWEwUiwplWo%2F2ikoHBR6mg6s3vI7vKr0YywPjl8Nuz4%3D&reserved=0> >> >> In particular, the industry terms (from NIST SP 800-164, potentially >> among others) are: >> >> Roof of Trust for Storage (RTS) >> >> Root of Trust for Verification (RTV) >> >> Root of Trust for Integrity (RTI) >> >> Root of Trust for Reporting (RTR) >> >> Root of Trust for Measurement (RTM) >> >> I would recommend using the above terms and not using "trust anchor" >> or the unqualified "root of trust" term. >> >> Dave >> >> -----Original Message----- >> >> From: TEEP > On >> Behalf Of Wheeler, David M >> >> Sent: Thursday, July 5, 2018 12:52 PM >> >> To: Hannes Tschofenig > >; teep@ietf.org >> >> >> Subject: Re: [Teep] Comments on I-D Action: >> draft-ietf-teep-architecture-00.txt >> >> Hannes, >> >> If that is the case (trust root and trust anchors are the same), then >> I have a concern regarding crypto separation. >> >> In one definition the Trust Anchor signs certificates, in the other >> definition a Root-of-Trust signs attestations. >> >> If these are in fact the same key, then they are being used for two >> different functions, which is not recommended for cryptographic keys. >> >> Further, it seems to me (though I may be misunderstanding the intended >> function), the private key of the Trust Anchor resides outside the >> device, in a separate entity, like a CA or a TAM. >> >> However, the private key of a Root-of-Trust resides in the TEE (or is >> accessible only to the TEE). >> >> Can you pick apart my understanding of the two definitions of keys, >> and help me understand where I got thrown off? >> >> Thanks, >> >> Dave Wheeler >> >> -----Original Message----- >> >> From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com >> ] >> >> Sent: Thursday, July 5, 2018 12:41 PM >> >> To: Wheeler, David M > >; teep@ietf.org >> >> >> Subject: RE: [Teep] Comments on I-D Action: >> draft-ietf-teep-architecture-00.txt >> >> Just a quick remark: IMHO root of trust and trust anchor are the same >> thing. I believe we should update the text to only talk about trust >> anchors and forget the root of trust terminology. >> >> -----Original Message----- >> >> From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David >> M >> >> Sent: 05 July 2018 21:38 >> >> To: teep@ietf.org >> >> Subject: [Teep] Comments on I-D Action: >> draft-ietf-teep-architecture-00.txt >> >> I have several comments on the new architecture draft. >> >> The first comment has to do with the definition of the "Trust Anchor" >> (page 4) >> >> The definition states: >> >> Trust Anchor: A root certificate that can be used to validate its >> >>                             certificates. It is usually embedded in a >> device or >> >>                             configured by a TAM for validating the >> trust of a remote entity's >> >>                             certificate. >> >> Then later in section 3 (page 6) >> >> This specification assumes that an applicable device is equipped with >> one or more TEEs and each TEE is pre-provisioned with a device-unique >> public/private key pair, which is securely stored. This key pair is >> referred to as the 'root of trust' for remote attestation of the >> associated TEE in a device by an TAM. >> >> It is not clear whether the "Trust Anchor" is the same as the >> "root-of-trust" key pair, since the "root-of-trust" is not included in >> the definitions.. >> >> If they are intended to be different (which is what I believe), then I >> suggest we add the "root-of-trust" to the definitions, and explain the >> difference. Oftentimes, in my experience, these terms are used >> interchangeably. >> >> Here is my attempt to create definitions for these two types of keys: >> >> Trust Anchor: A trust anchor is public asymmetric key, preferably >> contained in a certificate >> >>                             that represents a trusted entity to a >> device. This public key may be used by >> >>                             the holder of the corresponding private >> key to sign other certificates, >> >>                             thereby communicating the signed >> certificate may also be trusted. >> >>                             The trust anchor is usually embedded in a >> device or configured by a TAM >> >>                              and used by the device to validate the >> trust of a remote entity by >> >>                             verifying that entity's certificate is >> signed by a trust anchor. >> >>                              Trust anchors must be stored in a way >> that prevents or strongly resists >> >>                              modification by unauthorized software >> and hardware adversaries. >> >>           An example of a trust anchor is the public key of a TAM or >> SP which is >> >>                           "pinned" or securely stored inside the >> device, and that trust anchor is used >> >>                             like a CA certificate to validate the >> trust in other keys/certificates. >> >>                            A trust anchor may be viewed by both >> trusted and untrusted entities on the device, >> >>                           But may only be modified or deleted by a >> trusted entity. >> >> Root-of-Trust Key:  A device-unique key generated at device >> manufacturing or at >> >>                             TEE provisioning, which is securely >> stored and only accessible to the TEE. >> >>                             The Root-of-Trust Key is used for >> attestation signing which proves the signed >> >>                             message originated or was approved by the >> TEE, and may be trusted to the same >> >>                            degree as the TEE. >> >> -----Original Message----- >> >> From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of >> internet-drafts@ietf.org >> >> Sent: Wednesday, July 4, 2018 7:49 AM >> >> To: i-d-announce@ietf.org >> >> Cc: teep@ietf.org >> >> Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt >> >> A New Internet-Draft is available from the on-line Internet-Drafts >> directories. >> >> This draft is a work item of the Trusted Execution Environment >> Provisioning WG of the IETF. >> >>         Title           : Trusted Execution Environment Provisioning >> (TEEP) Architecture >> >>         Authors         : Mingliang Pei >> >>                           Hannes Tschofenig >> >>                           Andrew Atyeo >> >>                           Dapeng >> >> Filename        : draft-ietf-teep-architecture-00.txt >> >> Pages           : 24 >> >> Date            : 2018-07-02 >> >> Abstract: >> >>    A Trusted Execution Environment (TEE) was designed to provide a >> >>    hardware-isolation mechanism to separate a regular operating >> system >> >>    from security- sensitive applications. >> >>    This architecture document motivates the design and >> standardization >> >>    of a protocol for managing the lifecyle of trusted applications >> >>    running inside a TEE. >> >> The IETF datatracker status page for this draft is: >> >> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatat >> racker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=02%7C >> 01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f9 >> 88bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=XB >> uTlsiV5OjkxkcqULdsmroTnWRZqApH3fBokJGvkTE%3D&reserved=0 >> > tracker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=02%7C01% >> 7Cdthaler%40microsoft.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988b >> f86f141af91ab2d7cd011db47%7C1%7C0%7C636664729240700830&sdata=QgHpEQ6cq >> PzjNSNAXlOBVJfmbHzpDogVNJNpWI6uPzg%3D&reserved=0> >> >> There are also htmlized versions available at: >> >> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools >> .ietf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=02%7C01%7C >> dthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf8 >> 6f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=heO1xlx >> frVZyyzYziQy8V2P0vxiEbTVSF8sFdNaw8sc%3D&reserved=0 >> > s.ietf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=02%7C01%7Cdth >> aler%40microsoft.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f1 >> 41af91ab2d7cd011db47%7C1%7C0%7C636664729240710835&sdata=yLbkguKNpWobGS >> QbfCI3XTLaLJPHO5pX7y0uzM5aQpI%3D&reserved=0> >> >> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatat >> racker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&dat >> a=02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc >> %7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&s >> data=aoKW%2FFnlzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&reserved=0 >> > tracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=0 >> 2%7C01%7Cdthaler%40microsoft.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C >> 72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664729240720840&sdata=iz >> EKpdtjJPah2dorUbEc7ZdJZJAvPITE9iop%2BtuFrms%3D&reserved=0> >> >> Please note that it may take a couple of minutes from the time of >> submission until the htmlized version and diff are available at >> tools.ietf.org. >> >> Internet-Drafts are also available by anonymous FTP at: >> >> ftp://ftp.ietf.org/internet-drafts/ >> >> _______________________________________________ >> >> TEEP mailing list >> >> TEEP@ietf.org >> >> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i >> etf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40micro >> soft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7c >> d011db47%7C1%7C0%7C636664171223541902&sdata=7x7cgTvWZOsnWEDD9hQuRR >> vwGvB4TTpl0okIPShXtd0%3D&reserved=0 >> > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40microsof >> t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 >> 1db47%7C1%7C0%7C636664729240730849&sdata=vxedecEwOXML1kDDEvCVOmZWyVp7J >> F6jky%2BnGgZeU5w%3D&reserved=0> >> >> _______________________________________________ >> >> TEEP mailing list >> >> TEEP@ietf.org >> >> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i >> etf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40micro >> soft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7c >> d011db47%7C1%7C0%7C636664171223541902&sdata=7x7cgTvWZOsnWEDD9hQuRR >> vwGvB4TTpl0okIPShXtd0%3D&reserved=0 >> > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40microsof >> t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 >> 1db47%7C1%7C0%7C636664729240730849&sdata=vxedecEwOXML1kDDEvCVOmZWyVp7J >> F6jky%2BnGgZeU5w%3D&reserved=0> >> >> IMPORTANT NOTICE: The contents of this email and any attachments are >> confidential and may also be privileged. If you are not the intended >> recipient, please notify the sender immediately and do not disclose >> the contents to any other person, use it for any purpose, or store or >> copy the information in any medium. Thank you. >> >> _______________________________________________ >> >> TEEP mailing list >> >> TEEP@ietf.org >> >> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i >> etf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40micro >> soft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7c >> d011db47%7C1%7C0%7C636664171223541902&sdata=7x7cgTvWZOsnWEDD9hQuRR >> vwGvB4TTpl0okIPShXtd0%3D&reserved=0 >> > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40microsof >> t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 >> 1db47%7C1%7C0%7C636664729240740862&sdata=BM3CGgYe99eqU3Cr9j8CZ3R9LIxD0 >> ycKnT8%2FEMwUqjU%3D&reserved=0> >> >> _______________________________________________ >> >> TEEP mailing list >> >> TEEP@ietf.org >> >> https://www.ietf.org/mailman/listinfo/teep >> > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40microsof >> t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 >> 1db47%7C1%7C0%7C636664729240750863&sdata=KuTTsAhETZCmCGwo1Y3rmgkhCM8w5 >> Mq8JkxxcLL26N8%3D&reserved=0> >> >> IMPORTANT NOTICE: The contents of this email and any attachments are >> confidential and may also be privileged.. If you are not the intended >> recipient, please notify the sender immediately and do not disclose >> the contents to any other person, use it for any purpose, or store or >> copy the information in any medium. Thank you. >> >> >> >> _______________________________________________ >> TEEP mailing list >> TEEP@ietf.org >> https://www.ietf.org/mailman/listinfo/teep >> From nobody Fri Jul 6 16:22:43 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7EB3130DC0 for ; Fri, 6 Jul 2018 16:22:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.31 X-Spam-Level: X-Spam-Status: No, score=-4.31 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symantec.com header.b=SilxGPYH; dkim=pass (1024-bit key) header.d=symantec.com header.b=Mrsnj6Kx Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nHdDHeSYrreb for ; Fri, 6 Jul 2018 16:22:38 -0700 (PDT) Received: from tussmtoutape02.symantec.com (tussmtoutape02.symantec.com [155.64.38.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FE1B12777C for ; Fri, 6 Jul 2018 16:22:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=Symantec.com; s=1; c=relaxed/simple; q=dns/txt; i=@Symantec.com; t=1530919356; x=2394832956; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=RBkWUopmSMOo1CbSkSiI8artbq4XMf54qa3+QRGKGrw=; b=SilxGPYHrnW1Zyojp7sdJNkYOOABzrWNV9JAOZAFX6NCAPjJCCIO2INThD1wFiHA AHIq6DfOLyGuKw2JjZ1Gj9Owh7LcaZ/iAUpWtHd4NS+SiwxhTkv+LH8M+PBJ9bQB da29mK1ntXmWYLAHizcX4NrZ8wBBdRAihU/KG5WiDb8=; Received: from tussmtmtaapi02.symc.symantec.com (tus3-f5-symc-ext-prd-snat3.net.symantec.com [10.44.130.3]) by tussmtoutape02.symantec.com (Symantec Messaging Gateway) with SMTP id FE.9E.06850.CB9FF3B5; Fri, 6 Jul 2018 23:22:36 +0000 (GMT) X-AuditID: 0a2c7e32-681329e000001ac2-00-5b3ff9bc09f8 Received: from ASBXCHMBXWPI02.SYMC.SYMANTEC.COM (tus3-f5-symc-ext-prd-snat10.net.symantec.com [10.44.130.10]) by tussmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id FA.3F.06107.CB9FF3B5; Fri, 6 Jul 2018 23:22:36 +0000 (GMT) Received: from ASBXCHMBXWPI01.SYMC.SYMANTEC.COM (10.90.223.21) by ASBXCHMBXWPI02.SYMC.SYMANTEC.COM (10.90.223.22) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 6 Jul 2018 16:22:34 -0700 Received: from NAM05-CO1-obe.outbound.protection.outlook.com (10.90.74.10) by ASBXCHMBXWPI01.SYMC.SYMANTEC.COM (10.90.223.21) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Fri, 6 Jul 2018 16:22:34 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symantec.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RBkWUopmSMOo1CbSkSiI8artbq4XMf54qa3+QRGKGrw=; b=Mrsnj6KxVMDJ7TVSUjzYXH3Sm9ypfwx9w/Zg/VAgo5Ito3xxOfaSLcyvNw+hC29rrkNqPZy2tjqufnMm8Rszd8CNIcBZD+vVTIiWUTIP/s0KusV90jzlYyrLZTaEWrn2A+A92+OVp/39aeeWRNQ0292IpKmTVpvzOQd6DXh4Y/M= Received: from BL0PR16MB2260.namprd16.prod.outlook.com (52.132.28.27) by BL0SPR01MB03.namprd16.prod.outlook.com (52.132.24.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.930.19; Fri, 6 Jul 2018 23:22:32 +0000 Received: from BL0PR16MB2260.namprd16.prod.outlook.com ([fe80::c016:d0d7:8777:29a1]) by BL0PR16MB2260.namprd16.prod.outlook.com ([fe80::c016:d0d7:8777:29a1%5]) with mapi id 15.20.0930.016; Fri, 6 Jul 2018 23:22:32 +0000 From: Mingliang Pei To: Anders Rundgren , Hannes Tschofenig , "Wheeler, David M" , "teep@ietf.org" Thread-Topic: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AQHUFOW+DCiKM796/kaxcH1SqPgkq6SBsJYAgAAEvoCAAAVOAIAAFfYAgABAgwCAAEVCgIAACuuA Date: Fri, 6 Jul 2018 23:22:32 +0000 Message-ID: References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> <19fdc505-f0f1-ae9f-4fec-0605c7ee3690@gmail.com> <20f8295d-68b5-fc96-c418-c4f1923d4a2b@gmail.com> In-Reply-To: <20f8295d-68b5-fc96-c418-c4f1923d4a2b@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.d.1.180523 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Mingliang_Pei@symantec.com; x-originating-ip: [155.64.23.48] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BL0SPR01MB03; 7:feWs52AwoYftjz4aUMeTRh8TkK9QtpvK/gh9z6rIQDPVc/X6/459MCX4P6Tvc8fENetQHVIRaoIqF5P921LyQZ/RQHx4Emib/ur4QFXH3R7zjCJsJaYxKkPRAiazvgdsrLeK9pcPQGyDZBYJeiDQyfMWwkoNgBrMBkCz/++m2dD5cYQCvur8CBMkeiNf24sWpYUalH+ckdcsQo2xjYWMIBZPLv7rbcphzrc3/YK2GWq20Y9KPNIArbSul70MpWqI x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: e4d6ffb9-7cd7-46a7-4430-08d5e397595f x-microsoft-antispam: UriScan:(223705240517415); BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:BL0SPR01MB03; x-ms-traffictypediagnostic: BL0SPR01MB03: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(278428928389397)(192374486261705)(223705240517415)(258766100185102)(85827821059158)(17755550239193); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(3002001)(3231254)(944501410)(52105095)(10201501046)(93006095)(93001095)(149027)(150027)(6041310)(20161123562045)(20161123564045)(20161123560045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011)(7699016); SRVR:BL0SPR01MB03; BCL:0; PCL:0; RULEID:; SRVR:BL0SPR01MB03; x-forefront-prvs: 0725D9E8D0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(136003)(366004)(39860400002)(346002)(376002)(199004)(189003)(13464003)(40434004)(8936002)(14454004)(305945005)(82746002)(7736002)(966005)(86362001)(2501003)(575784001)(106356001)(256004)(5250100002)(2900100001)(72206003)(186003)(478600001)(229853002)(83716003)(551544002)(105586002)(11346002)(446003)(99286004)(5024004)(14444005)(68736007)(39060400002)(53936002)(76176011)(25786009)(2616005)(486006)(476003)(6246003)(33656002)(316002)(6486002)(5660300001)(58126008)(6436002)(6506007)(110136005)(80792005)(36756003)(53546011)(3846002)(26005)(10290500003)(97736004)(6116002)(2906002)(66066001)(93886005)(6512007)(6306002)(81156014)(81166006)(8676002)(102836004); DIR:OUT; SFP:1101; SCL:1; SRVR:BL0SPR01MB03; H:BL0PR16MB2260.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 5f+rmOAdTwAw0cEOKbU9GTpM0KnCX9pM3YMP1qmLCQ6YIm775yMQg6QoPCL7Oo/dySrV+qKDQW4sSjnBryID9+zUfZ156eb0GERkFaFuR0dfZTQhP1TVrxzV2bqKb1XD5Gtf0ujJvwe0SMP3TI9WX1hNzFvbxes/7HvqAVtXXzd3kLxYi7kamGQN+gSgUXzC7OlV99u1tzad/Wv33dUTlBKm+9SwL8RCRaJ8CXrmnDuOW6+ZwqnFoY+TFe+u1wRTEF8U8Fbs0niWlyGvmP71jBCbBgBPLg7dx37tQSeOfm6D9GhzI6RMF2CqoQDUmms/fx6dA91RFdbjCiynldwEsMIKvG6h8M15hN9Dm0aSHXs= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <6324D19FC1627141ADA76120E0A97B9B@namprd16.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: e4d6ffb9-7cd7-46a7-4430-08d5e397595f X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2018 23:22:32.0414 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0SPR01MB03 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA01Sa0hTYRjmO+dsni1Xx6X5sjBs1A8lr0QMulh/YtGF/hXej/OQI910m5IF pS7EW7pC0w3ToqW5Rlli5iUz0VCzy5QCl+ElI5dhteVlWtm2M6E/H8/3Ps/7Ps/78ZG4sJkj IuUKDaNS0OliLp/g7yrAw7qcMXGRRTaRZOqrkSMpsAxxJWM1Q5jkzu9F/CAhNdeZkbTd8NFH ajQ6MentLht2kojl70tl0uU5jCriQDI/zdK/jGV2Z50rns/n5KEBRQnikUDthisFTdwSxCeF lB3Bd20LWiccj8s4LOFEMK37jLOXfgQj/Q4vM4vAMX+N424hKB0OlR0ylijHwHy3wTt4CsHw aCtRgkiSS0XC23GPuT/VhsDULHLjzVQKPGvQ42xdBnWNjV4cC0W1bThrsAMmlls9WEDFwOyw BXkjcWBsutgTnEfth58Lax4RorbA0pAZc2OcCgTrTD3GLkeBsesNzuIAsH3669kggAqHsvZ3 XLY3AZyXJ5E7M1DBcE/LsPIgGKkv9fgC1YLB+6UK74OFwY+qKu/M42C/OkiwokkExfedBEuE wKhB622QQ91qA9KhPYb/8hlcfrhL9qAjgi1LwT5+HbF4O1SWTvkYPPv7waB+hriJOCYUrMlW qzM0ymwNnclERoerczNk7oN2/SJZuEyZ8Qh5/tHF6CfI3nysF1EkEvsKbs3FxAk5dI5L2YuA xMX+gtBLrpIglc49z6iUSarsdEbdi7aShDhQ8E1QHSukztAa5izDZDKqdRYjeaI8JLRl8Zo2 2v6kxR9eyWz017aG1KZw/TYJO5+OKAe4Vt2vhROOl6d5fejUhS/93X25HyZeywsVvq9MhcYX a/qeuVpiNchqWZF2xjdbE8uD94537Awh6A034lJbJpOrExOin1dMbzsSpWzSl6G5+sV8/dFD CzU9pUmmlOjEh8LCQDGhTqOjQnGVmv4HDS9yREMDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprKKsWRmVeSWpSXmKPExsXCpdPEpbvnp320wd/pghYPXy1htWi6eIrN 4uaMU0wWS/98Y3Zg8Vgzbw2jx85Zd9k9liz5yeSxeM9LpgCWKC6blNSczLLUIn27BK6Mi0d/ MBXsK6zofNfI2sB4Iq+LkZNDQsBE4vO2HtYuRi4OIYGfjBKPJjxlhnCOMkpcOvoZKvOCUeLz u0msIC0sAhOYJabsSoZI9DFJrFmxjA3CecgocebyVpYuRg4ONgEDiQt3wHaICGxnlFi1QQrE FhZIkti/bCYzRDxZYt7y5VB2lETHnO3MEAtUJO7/2Apm8wrYS7w4c5ER6iRWiZuPOhlBEpwC thIfv/4HK2IUEJP4fmoNE4jNLCAucevJfCaI5wQkluw5zwxhi0q8fPwP7ANRAT2Jnp1X2SB6 YyV+tjxgBLlZQkBBYnVzKkS5rMSl+d1geyUENjNJXPvezwiR0JX4MHUq1ExfiU8TT7JAFD1g lOhc95MFIqEpcXlWM1RDpsS838ugJs1nlHg86wNUt5zEqt6HLBMYjWYhOXwW0CHMQP3rd+lD hD0kPt2ZxghhK0pM6X7IPgscMIISJ2c+YVnAyLqKUaGktLg4tyS3JDGxINPASK+4MjcZRCQC U1GyXnJ+7iZGcDpyltzBeOiPzyFGAQ5GJR5ejSz7aCHWxDKgykOM0hwsSuK8r7luRgkJpCeW pGanphakFsUXleakFh9iZOLglGpglHlwyzVU3zOn/Jzy7LQ/t5WYxVZte/9gz8dGzapEy72h Z1YcXaN/NmgOR92/Pzpp27Y+5TnvvTDQsr1z6SeDGzabzlywlhWXjpuybt2ToK6gJaeb6hse fO+YcMZ527ZD5U4xGrNevehh+rGt8GzpvkSfY6deO269UJP+TJQxLoIz7k5ZjIE3uxJLcUai oRZzUXEiADo89bUoAwAA X-CFilter-Loop: TUS04 Archived-At: Subject: Re: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Jul 2018 23:22:41 -0000 SGkgQW5kZXJzLA0KDQpJIHdvdWxkIGxpa2UgdG8gc2VwYXJhdGUgdGhlIGF1dGhlbnRpY2F0aW9u IHNvbHV0aW9uIGZyb20gdGhlIGdlbmVyYWwgVEEgbWFuYWdlbWVudCB2YWx1ZSB0aGF0IE9UclAg cHJvdmlkZXMgd2hpbGUgYXV0aGVudGljYXRpb24gaXMgb25lIG9mIHRoZSBhcHBsaWNhdGlvbiBj YXNlIHRvIGFkZCB2YWx1ZS4gVGhlcmUgYXJlIG1hbnkgYXBwcyB0aGF0IG5lZWQgc2VjdXJpdHkg cHJvdGVjdGlvbiB0aGF0IGNhbiBsZXZlcmFnZSBhIFRFRSwgc2F5LCBiYW5raW5nIGFwcHMgdG9k YXkgaW4gcGhvbmVzLCB3aGljaCBuZWVkcyB0byBzdG9yZSBjb25maWRlbnRpYWwgZGF0YSwgYW5k IHNvbWUgZ2FtaW5nIGFwcHMgdG8gcnVuIHNvbWUgY29uZmlkZW50aWFsIGxvZ2ljLiBTdWNoIGEg bG9naWMgYW5kIGNvbmZpZGVudGlhbCBkYXRhIGNhbiBiZXR0ZXIgdXRpbGl6ZSBhIFRFRSwgYW5k IHVzZSBhIFRBIHRvIHJ1biBpbnNpZGUgdGhlIFRFRS4gVGhlcmUgaXMgYWxzbyB0aGUgVEVFIHVz ZSBjYXNlICJjbG91ZCBwcm92aWRlciIgd2hlcmUgYSBjbG91ZCBwcm92aWRlciBkb2Vzbid0IHdh bnQgdG8gaGF2ZSBjYXBhYmlsaXR5IHRvIGluc3BlY3QgYSBjdXN0b21lcidzIGFwcCBydW5uaW5n IGluIGl0cyBob3N0ZWQ7IGEgVEEgcnVubmluZyBpbiBhIFRFRSAoaW4gYSBzZXJ2ZXIgbWFjaGlu ZSkgd291bGQgb2ZmZXIgc3VjaCBhIHBvc2l0aW9uIGFzIHRoZSBob3N0IHByb3ZpZGVyIGlzbid0 IGFibGUgdG8gaW5zcGVjdCBjb2RlIGFuZCBkYXRhIHJ1bm5pbmcgaW4gdGhlIFRFRS4NCg0KVGhl cmUgaXMgYSBnYXAgdG9kYXkgaG93IHRoZXNlIFRBcyBhcmUgdHJ1c3RlZCwgZGlzdHJpYnV0ZWQg YW5kIHVwZGF0ZWQgYWNyb3NzIGRpZmZlcmVudCBURUUgZGV2aWNlcyBhbmQgYXBwIHByb3ZpZGVy cy4gV2UgYmVsaWV2ZSB0aGF0IFRFRVAgd2lsbCBwcm92aWRlIGdyZWF0ZXIgcmVhbGl6YXRpb24g b2Ygc2VjdXJpdHkgdmFsdWUgdGhhdCBURUUgYW5kIFRBIGNhbiBvZmZlci4gSGFwcHkgdG8gZGlz Y3VzcyBtb3JlLg0KDQpUaGFua3MsDQoNCk1pbmcNCg0K77u/T24gNy82LzE4LCA4OjQ0IEFNLCAi VEVFUCBvbiBiZWhhbGYgb2YgQW5kZXJzIFJ1bmRncmVuIiA8dGVlcC1ib3VuY2VzQGlldGYub3Jn IG9uIGJlaGFsZiBvZiBhbmRlcnMucnVuZGdyZW4ubmV0QGdtYWlsLmNvbT4gd3JvdGU6DQoNCiAg ICBPbiAyMDE4LTA3LTA2IDEzOjM1LCBIYW5uZXMgVHNjaG9mZW5pZyB3cm90ZToNCiAgICA+IEhp IEFuZGVycywNCiAgICANCiAgICBIaSBIYW5uZXMsDQogICAgSSB0aGluayB5b3UgbWlzdW5kZXJz dG9vZCB3aGF0IEkgbWVhbnQuDQogICAgPg0KICAgID4gTW9zdCBsaWtlbHkgaXQgd291bGQgbWFr ZSBtb3JlIHNlbnNlIHRvIHVzZSB0aGUgRklETyBBdXRoZW50aWNhdG9yIGluIHRoZSBURUUgb2Yg dGhlIHBob25lIHJhdGhlciB0aGFuIGNvbm5lY3RlZCB0byBhbiBleHRlcm5hbCBkZXZpY2UuIFVz aW5nIGFub3RoZXIgZGV2aWNlLCBzdWNoIGFzIGEgd2F0Y2ggdmlhIEJMRSwgbWF5IGJlIHBvc3Np YmxlIGJ1dCBpdCBpcyBwcm9iYWJseSBub3QgdGhlIG1vc3QgY29tbW9uIGFwcHJvYWNoLiAoSW4g ZmFjdCBJIGhhdmUgYWN0dWFsbHkgY29udHJpYnV0ZWQgdG8gdGhlIEZJRE8gc3BlY2lmaWNhdGlv biB0aGF0IG9mZmVycyB0aGF0IGZ1bmN0aW9uYWxpdHkuKQ0KICAgIA0KICAgIFRoZSBzY2VuYXJp byBJIHRyaWVkIHRvIGRlcGljdCB3YXMgYSBQaG9uZSB1c2VkIGFzIHNlY3VyaXR5IHRva2VuIHRv Z2V0aGVyIHdpdGggYSBQQyBydW5uaW5nIGEgV2ViIGFwcGxpY2F0aW9uLg0KICAgIA0KICAgIFVz aW5nIEZJRE8gdGhpcyBjYW4gYmUgZG9uZSBpbiBhIHNlY3VyZSAoIm5vbi1waGlzaGFibGUiKSB3 YXkgdGhyb3VnaCBzdGFuZGFyZGl6ZWQgKGJ1dCBzcGVjaWZpYykgRklETyBpbnRlcmZhY2VzIHVz aW5nIEJMRSAob3IgY2FibGUpLg0KICAgIA0KICAgIEZvciBub24tRklETyBzb2x1dGlvbnMgbGlr ZSBQS0kgYW5kIHBheW1lbnRzLCB0aGVyZSBpcyBub3RoaW5nIHNpbWlsYXIgYXZhaWxhYmxlIGxl YXZpbmcgdXMgd2l0aCBzZWN1cml0eSBicm9rZW4gT09CIHNjaGVtZXMgbGlrZSBRUi4NCiAgICAN CiAgICBRdWVzdGlvbjogV2hhdCdzIHRoZSB2YWx1ZSBvZiBPVHJQIGlmIGl0IGluIHJlYWxpdHkg bGltaXRzIHlvdSB0byBGSURPPyBUaGlzIHF1ZXN0aW9uIGJlY29tZXMgZXZlbiBtb3JlIHJlbGV2 YW50IGdpdmVuIHRoYXQgRklETyAoaW4gY29udHJhc3QgdG8gT1RyUC4uLikgYWxyZWFkeSBzdXBw b3J0cyBhIHBlcmZlY3RseSB3b3JraW5nIFdlYiBwcm92aXNpb25pbmcgWzFdIHN5c3RlbS4gIFBl cnNvbmFsbHkgSSB3b3VsZCBiZSBleHRyZW1lbHkgc3VycHJpc2VkIFsyXSBpZiBhIG5vdCBzbyBk aXN0YW50IHJlbGVhc2Ugb2YgV2luMTAgcnVubmluZyBvbiByZWNlbnQgSW50ZWwgSFcgZG9lc24n dCBjb21lIHdpdGggV2ViQXV0aC9GSURPIHN1cHBvcnQgYnVpbHQtaW4uICBUaGUgc2FtZSBnb2Vz IGZvciBBbmRyb2lkL0FSTS4NCiAgICANCiAgICBIYXZpbmcgaGFkIHR3byBnZW5lcmF0aW9ucyBv ZiBUUE1zIHdpdGggbm8gdXNlIHdoYXRzb2V2ZXIsIEkgd2FzIGhvcGluZyBmb3Igc29tZXRoaW5n IG1vcmUgZmxleGlibGUgdGhpcyB0aW1lIDotfA0KICAgIA0KICAgIEFuZGVycw0KICAgIA0KICAg IA0KICAgIDFdIFdlYiBwcm92aXNpb25pbmcgaXMgYXMgdWdseSBhcyBpdCB3YXMgd2F5IGJhY2sg ZHVyaW5nIHRoZSBLRVlQUk9WIGRheXMuICBJIHdvdWxkIHNheSBpdCBoYXMgYWN0dWFsbHkgZ290 dGVuIHdvcnNlLCBkdWUgdG8gbmV3IGNvbnN0cmFpbnRzIGludHJvZHVjZWQgYnkgdGhlIGJyb3dz ZXIgdmVuZG9ycy4NCiAgICANCiAgICAyXSBTaW5jZSBJIGFzIGVhcmx5IGFzIDIwMDcgdG9nZXRo ZXIgd2l0aCBhIGJ1bmNoIG9mIE5va2lhIGd1cnVzIGJyb3VnaHQgdGhlIGZpcnN0KD8pIGludGVn cmF0ZWQgVEVFICJzZWN1cmUga2V5IiBzb2x1dGlvbiB0byB0aGUgbWFya2V0LCBJIGtub3cgdGhl cmUncyBubyBtYWdpYyBoZXJlLg0KICAgIA0KICAgIA0KICAgID4gVGhlcmUgaXMgYSBsb3Qgb2Yg ImVkdWNhdGluZyIgZ29pbmcgb24gYXMgcGFydCBvZiB0aGUgRklETyBwdWJsaWMgcG9saWN5IGFu ZCBwcml2YWN5IHByb2dyYW0sIHdoaWNoIEkgaGFkIHRoZSBwbGVhc3VyZSB0byBjby1jaGFpciBm b3Igc29tZSB0aW1lLg0KICAgID4gDQogICAgPiBZb3UgYXJlIGNvcnJlY3QgdGhhdCBGSURPIGhh cyBub3QgYmVlbiBkZXNpZ25lZCB3aXRoIHRoZSBjbGFzc2ljYWwgY2xpZW50LXNpZGUgUEtJIGlu IG1pbmQuIElNSE8gdGhhdCdzIGEgZ29vZCB0aGluZy4NCiAgICA+IA0KICAgID4gRm9yIHdoYXQg bWF0dGVycyB3aXRoIHJlZ2FyZHMgdG8gVEVFUCBpcyB3aGV0aGVyIHdlIGNhbiBnZXQgYSBzdGFu ZGFyZGl6ZWQgbWVjaGFuaXNtIGRlZmluZWQgdGhhdCBhbGxvd3MgdXMgdG8gZW5hYmxlIGVhc2ll ciBkZXBsb3ltZW50cyBsaWtlIHRoZSBvbmNlIGRlc2NyaWJlZCBhYm92ZS4gVG9kYXksIHRoaXMg aXMgcmF0aGVyIGNoYWxsZW5naW5nIHNpbmNlIGl0IGlzIHRvdWdoIHRvIGdldCB0aGUgbmVjZXNz YXJ5IEZJRE8gQXV0aGVudGljYXRvciBjb2RlIG9uIHBob25lcyBhbmQgdGFibGV0cy4NCiAgICA+ IA0KICAgID4gQ2lhbw0KICAgID4gSGFubmVzDQogICAgPiANCiAgICA+IC0tLS0tT3JpZ2luYWwg TWVzc2FnZS0tLS0tDQogICAgPiBGcm9tOiBBbmRlcnMgUnVuZGdyZW4gW21haWx0bzphbmRlcnMu cnVuZGdyZW4ubmV0QGdtYWlsLmNvbV0NCiAgICA+IFNlbnQ6IDA2IEp1bHkgMjAxOCAwOTo0NQ0K ICAgID4gVG86IEhhbm5lcyBUc2Nob2ZlbmlnOyBXaGVlbGVyLCBEYXZpZCBNOyB0ZWVwQGlldGYu b3JnDQogICAgPiBTdWJqZWN0OiBSZTogT09CIElzc3Vlcy4gV2FzOiBbVGVlcF0gQ29tbWVudHMg b24gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi10ZWVwLWFyY2hpdGVjdHVyZS0wMC50eHQNCiAgICA+ IA0KICAgID4gT24gMjAxOC0wNy0wNiAwODoyNiwgSGFubmVzIFRzY2hvZmVuaWcgd3JvdGU6DQog ICAgPj4gSGkgQW5kZXJzLA0KICAgID4gDQogICAgPiBIaSBIYW5uZXMsDQogICAgPiANCiAgICA+ PiBJbiB0aGlzIHNwZWNpZmljIGV4YW1wbGUgSSBoYXZlIHRvIGFkbWl0IHRoYXQgSSBoYXZlIGEg YmlhcyB0b3dhcmRzIEZJRE8uIEluIHRoaXMgc2V0dXAgRklETyB3b3VsZG4ndCBuZWVkIGFuIG91 dC1vZi1iYW5kIGNoYW5uZWwuDQogICAgPiANCiAgICA+IEkgYXNzdW1lIHlvdSBtZWFuIHRoYXQg dGhlIHBob25lIHdvdWxkIGJlIGVxdWlwcGVkIHdpdGggYSBGSURPIGF1dGhlbnRpY2F0b3IgYW5k IHRoZW4gY29ubmVjdGVkIHRvIHRoZSBQQyB0aG91Z2ggQkxFIChvciB3b3JzdC1jYXNlIHRocm91 Z2ggYSBjYWJsZSksIHJpZ2h0Pw0KICAgID4gDQogICAgPiBUaGlzIG9idmlvdXNseSB3b3JrcyBi dXQgaXMgaW5jb21wYXRpYmxlIHdpdGggY2xpZW50IHNpZGUgUEtJIGFzIHdlbGwgYXMgb3RoZXIg c2NoZW1lcyB0aGF0IGRvIG5vdCBoYXZlIGEgbmF0dXJhbCB0aWUgdG8gRklETy4NCiAgICA+IA0K ICAgID4gU2luY2UgdGhpcyBjZXJ0YWlubHkgaXNuJ3QgImNvbW1vbiBrbm93bGVkZ2UiLCB0aGUg bW9zdCByZWFzb25hYmxlIHdvdWxkIGJlIHRoYXQgdGhvc2Ugd2hvIHJlcHJlc2VudCB0aGUgcGxh dGZvcm0gdmVuZG9ycyAoQVJNLCBJbnRlbCwgTVNGVCkgZXhwbGFpbmVkIHRvIGdvdmVybm1lbnRz IGFuZCBiYW5rcyB0aGF0IHRoZXkgc2hvdWxkIGNhcmVmdWxseSByZWV4YW1pbmUgdGhlaXIgZGVz aWduIGNob2ljZXMgZm9yIHRoZSBmdXR1cmUuDQogICAgPiANCiAgICA+IEZXSVcsIEknbSBwZXJz b25hbGx5IGludGVyZXN0ZWQgaW4gY3JlYXRpbmcgbW9yZSAibmV1dHJhbCIgc2VjdXJpdHkgdGVj aG5vbG9neSwgaW5jbHVkaW5nIGFkZHJlc3NpbmcgT09CIGNoYW5uZWwgYXV0aGVudGljYXRpb24g YmV5b25kIHdoYXQgdGhlIGN1cnJlbnQgc3RhbmRhcmQgKFFSKSBvZmZlcnMgKD16ZXJvKS4NCiAg ICA+IA0KICAgID4gQ2hlZXJzLA0KICAgID4gQW5kZXJzDQogICAgPiANCiAgICA+IA0KICAgID4+ IFRoZSBURUUgd291bGQgaGVscGZ1bCBhbmQgT1RyUCBjb3VsZCBiZSB1c2VkIHRvIGRpc3RyaWJ1 dGUgdGhlIEZJRE8gQXV0aGVudGljYXRvciBjb2RlIHRvIHBob25lcyBhbmQgdGFibGV0cy4NCiAg ICA+Pg0KICAgID4+IENpYW8NCiAgICA+PiBIYW5uZXMNCiAgICA+Pg0KICAgID4+IC0tLS0tT3Jp Z2luYWwgTWVzc2FnZS0tLS0tDQogICAgPj4gRnJvbTogQW5kZXJzIFJ1bmRncmVuIFttYWlsdG86 YW5kZXJzLnJ1bmRncmVuLm5ldEBnbWFpbC5jb21dDQogICAgPj4gU2VudDogMDYgSnVseSAyMDE4 IDA4OjA3DQogICAgPj4gVG86IEhhbm5lcyBUc2Nob2ZlbmlnOyBXaGVlbGVyLCBEYXZpZCBNOyB0 ZWVwQGlldGYub3JnDQogICAgPj4gU3ViamVjdDogUmU6IE9PQiBJc3N1ZXMuIFdhczogW1RlZXBd IENvbW1lbnRzIG9uIEktRCBBY3Rpb246IGRyYWZ0LWlldGYtdGVlcC1hcmNoaXRlY3R1cmUtMDAu dHh0DQogICAgPj4NCiAgICA+PiBPbiAyMDE4LTA3LTA2IDA3OjUwLCBIYW5uZXMgVHNjaG9mZW5p ZyB3cm90ZToNCiAgICA+Pj4gSGkgQW5kZXJzLA0KICAgID4+DQogICAgPj4gSGkgSGFubmVzLA0K ICAgID4+DQogICAgPj4+IEkgYWdyZWUgdGhhdCB0aGVyZSBhcmUgbW9iaWxlIHBob25lIGF1dGhl bnRpY2F0aW9uIGFuZCBwYXltZW50IHNvbHV0aW9ucyB0aGF0IGRvIG5vdCBvZmZlciBtdWNoIGJl dHRlciBzZWN1cml0eSB0aGFuIHRyYWRpdGlvbmFsIHBhc3N3b3Jkcy4NCiAgICA+Pj4NCiAgICA+ Pj4gV2UgZG8sIGhvd2V2ZXIsIG5vdCBwcm9wb3NlIGEgc2luZ2xlIGF1dGhlbnRpY2F0aW9uIG9y IHBheW1lbnQgc29sdXRpb24gYnV0IGluc3RlYWQgd2FudCB0byBlbmFibGUgZGV2ZWxvcGVycyB0 byB1cGxvYWQgYW5kIG1hbmFnZSBjb2RlIG9uIHRoZSBURUUuIFRoaXMgY291bGQsIGZvciBleGFt cGxlLCBlbmFibGUgaW1wcm92ZWQgc2VjdXJpdHkgZm9yIGFuIEZJRE8tYmFzZWQgYXV0aGVudGlj YXRpb24gbWVjaGFuaXNtLg0KICAgID4+DQogICAgPj4gV2hhdCBJIHdhcyB0cnlpbmcgdG8gZXhw bGFpbiBpcyB0aGF0IGl0IGRvZXNuJ3QgbWF0dGVyIGlmIHlvdSBoYXZlIFRFRXMgb3Igbm90IGlm IHRoZSBzeXN0ZW0gZGVwZW5kcyBvbiBhbiBPT0IgY2hhbm5lbCAod2hpY2ggY3VycmVudGx5IGlz IGNsb3NlIHRvIGEgZGUtZmFjdG8gc3RhbmRhcmQpLg0KICAgID4+DQogICAgPj4gQXMgYSBkZXZl bG9wZXIgb2Ygc3VjaCBzeXN0ZW1zIEkgZmluZCBpdCBkZWVwbHkgdW5zYXRpc2Z5aW5nIGhhdmlu ZyB0byBhZG1pdCB0aGF0IGluIHNwaXRlIG9mIHVzaW5nICJzdGF0ZSBvZiB0aGUgYXJ0IHNlY3Vy aXR5IHNvbHV0aW9ucyIsIGl0IGRvZXNuJ3QgcmVhbGx5IGNvcGUgd2l0aCBwaGlzaGluZy4NCiAg ICA+Pg0KICAgID4+IFdoYXQgaXMgeW91ciByZWNvbW1lbmRlZCBzb2x1dGlvbi93b3JrYXJvdW5k IHRvIHRoaXMgcHJvYmxlbT8gIERyb3BwaW5nIE9PQj8gUmVwbGFjaW5nIE9PQiB3aXRoIC4uLj8N CiAgICA+Pg0KICAgID4+IENoZWVycywNCiAgICA+PiBBbmRlcnMNCiAgICA+Pg0KICAgID4+Pg0K ICAgID4+PiBDaWFvDQogICAgPj4+IEhhbm5lcw0KICAgID4+Pg0KICAgID4+PiAtLS0tLU9yaWdp bmFsIE1lc3NhZ2UtLS0tLQ0KICAgID4+PiBGcm9tOiBBbmRlcnMgUnVuZGdyZW4gW21haWx0bzph bmRlcnMucnVuZGdyZW4ubmV0QGdtYWlsLmNvbV0NCiAgICA+Pj4gU2VudDogMDYgSnVseSAyMDE4 IDA2OjU2DQogICAgPj4+IFRvOiBXaGVlbGVyLCBEYXZpZCBNOyB0ZWVwQGlldGYub3JnOyBIYW5u ZXMgVHNjaG9mZW5pZw0KICAgID4+PiBTdWJqZWN0OiBPT0IgSXNzdWVzLiBXYXM6IFtUZWVwXSBD b21tZW50cyBvbiBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLXRlZXAtYXJjaGl0ZWN0dXJlLTAwLnR4 dA0KICAgID4+Pg0KICAgID4+PiBJIGhvcGUgdGhhdCB5b3UgZ3V5cyBkb24ndCBtaW5kIGEgKGRp c3RhbnRseSkgcmVsYXRlZCBhcmNoaXRlY3R1cmFsIHF1ZXN0aW9uLg0KICAgID4+Pg0KICAgID4+ PiBVc2luZyB0cnVzdGVkIGhhcmR3YXJlIGFuZCBURUVzIGlzIGluZGVlZCBjb29sIHNpbmNlIHRo ZXkgZW5hYmxlIHNlY3VyaXR5IGxldmVscyBjb21wYXJhYmxlIHRvIHRyYWRpdGlvbmFsIHNtYXJ0 IGNhcmRzIGFsdGhvdWdoIHByb3Zpc2lvbmVkIG9uLWxpbmUuDQogICAgPj4+DQogICAgPj4+IEEg cXVpdGUgcG9wdWxhciB1c2UgY2FzZSBpcyB1c2luZyBhIG1vYmlsZSBwaG9uZSBhcyBhICJzZWN1 cml0eSBkZXZpY2UiIHRvZ2V0aGVyIHdpdGggYSBQQyBydW5uaW5nIGEgd2ViIGFwcGxpY2F0aW9u cyBsaWtlIG9uLWxpbmUgYmFua2luZy4gIFN1Y2ggYXJyYW5nZW1lbnRzIHVzdWFsbHkgZGVwZW5k IG9uIGFuIE9PQiBjaGFubmVsIGZyb20gdGhlIHBob25lLg0KICAgID4+Pg0KICAgID4+PiBIb3dl dmVyLCB0aGUgbWFqb3JpdHkgb2YgdGhlc2UgYXBwbGljYXRpb25zIGFyZSBpbiBzcGl0ZSBvZiBh bGwgdGhlIGdyZWF0IHNlY3VyaXR5IHNvbHV0aW9ucyBzdGlsbCBzdXNjZXB0aWJsZSB0byBmYWly bHkgdHJpdmlhbCBwaGlzaGluZyBhdHRhY2tzLiAgSW4gZmFjdCwgc29tZSBvZiB0aGVzZSBzeXN0 ZW1zIGhhdmUgYmVlbiBleHBsb2l0ZWQgbnVtZXJvdXMgdGltZXMgdGhyb3VnaCBzb2NpYWwgZW5n aW5lZXJpbmcgb3ZlciB0aGUgcGhvbmUhDQogICAgPj4+DQogICAgPj4+IFdoYXQgaXMgdGhlIHBy b2JsZW0gdGhlbj8gIFBsZWFzZSBkb24ndCB0YWtlIGl0IHBlcnNvbmFsbHkgYnV0IHRoZXJlIGFy ZSBvYnZpb3VzbHkgc29tZSBkaXNjb25uZWN0cyBpbiB0aGlzIGluZHVzdHJ5LCBoaWdoLWxpZ2h0 ZWQgYnkgdGhlIGZhY3QgdGhhdCBRUiBjb2RlIGhhcyBiZWNvbWUgInRoZSBuZXcgYmxhY2siIGFs dGhvdWdoIGl0IGlzIGluY29udmVuaWVudCBhbmQgaGF2ZSBwb29yIHNlY3VyaXR5IGNoYXJhY3Rl cmlzdGljcy4NCiAgICA+Pj4NCiAgICA+Pj4gU3VtbWFyeTogZm9yIGEgY2VydGFpbiBraW5kIG9m IHJlYWwgd29ybGQgYXBwbGljYXRpb25zLCB0cnVzdGVkIGhhcmR3YXJlIG9mZmVycyBvbmx5IG1h cmdpbmFsbHkgYmV0dGVyIHNlY3VyaXR5IHRoYW4gdHJhZGl0aW9uYWwgcGFzc3dvcmRzLg0KICAg ID4+Pg0KICAgID4+PiBDaGVlcnMsDQogICAgPj4+IEFuZGVycw0KICAgID4+PiBJTVBPUlRBTlQg Tk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFy ZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90 IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlh dGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29u LCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlv biBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQogICAgPj4+DQogICAgPj4NCiAgICA+PiBJTVBP UlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1l bnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBh cmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBp bW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIg cGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZv cm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQogICAgPj4NCiAgICA+IA0KICAgID4g SU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRh Y2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5 b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5k ZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90 aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUg aW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0KICAgID4gX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCiAgICA+IFRFRVAgbWFpbGluZyBs aXN0DQogICAgPiBURUVQQGlldGYub3JnDQogICAgPiBodHRwczovL2NsaWNrdGltZS5zeW1hbnRl Yy5jb20vYS8xL0FHc0VVUHZja01tWG9VZ0pZdFJpS1oxNEtkbzRUV18yMnQxWm1xeDlnYWc9P2Q9 Smw3VWRHRGVab1NLZ004cGhXSk5Kb0RvRDVsS2stcHRmOEhCZ3N2ZENWTWpCaWxHVnFjTVE2Zmt1 VUF0NzFQVzZPSzlKTmUxS19SRWV0NDlqR1hJR3RSVHFKbGk5bEpVYjZ5Z0daeURienJNMnp3MXAy OVpuWjF2QzdRZENkblgtbjRsSXNOZmlPajVna1VDckgwN2xPQUR2a0Z0eFI4QmNlOGJMNGhqbWo0 WW9PNGNLYXFYQ0lzZGU4YTBDaUl2cDVRZjRpZVVQY0E2aDZGNUoyc0RhSDlmRDVSeW9OOWttVTM4 TzNuQ0RKLWZwdzh6RHRwX29FMG53cE56cWxzY1BfM0c1d0YzNGlBMDJxZUl3VWJyRnZkOE5wMVJj eWZPbnhLMDJzWm5nMUNXWFg2anVoUzNoa21jRmI1WUkxd0MtaDVJTmE2SnYxUzRNV2p0cHRPeXZu ODRMM3lWZ3A5TnBnSGNibllocnlpdUtIU1hSYWFBVVFOQndmVE5vSTZTZjVjM291TDNUN0NpbDJL elZ6dzVCWW1oVXlFVUVVb0d3alpXTHQ3QXRyTEFxR1cxdTlYUUo5cWdUTEZ0JnU9aHR0cHMlM0El MkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0ZWVwDQogICAgPiANCiAg ICANCiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K ICAgIFRFRVAgbWFpbGluZyBsaXN0DQogICAgVEVFUEBpZXRmLm9yZw0KICAgIGh0dHBzOi8vY2xp Y2t0aW1lLnN5bWFudGVjLmNvbS9hLzEvQUdzRVVQdmNrTW1Yb1VnSll0UmlLWjE0S2RvNFRXXzIy dDFabXF4OWdhZz0/ZD1KbDdVZEdEZVpvU0tnTThwaFdKTkpvRG9ENWxLay1wdGY4SEJnc3ZkQ1ZN akJpbEdWcWNNUTZma3VVQXQ3MVBXNk9LOUpOZTFLX1JFZXQ0OWpHWElHdFJUcUpsaTlsSlViNnln R1p5RGJ6ck0yencxcDI5Wm5aMXZDN1FkQ2RuWC1uNGxJc05maU9qNWdrVUNySDA3bE9BRHZrRnR4 UjhCY2U4Ykw0aGptajRZb080Y0thcVhDSXNkZThhMENpSXZwNVFmNGllVVBjQTZoNkY1SjJzRGFI OWZENVJ5b045a21VMzhPM25DREotZnB3OHpEdHBfb0UwbndwTnpxbHNjUF8zRzV3RjM0aUEwMnFl SXdVYnJGdmQ4TnAxUmN5Zk9ueEswMnNabmcxQ1dYWDZqdWhTM2hrbWNGYjVZSTF3Qy1oNUlOYTZK djFTNE1XanRwdE95dm44NEwzeVZncDlOcGdIY2JuWWhyeWl1S0hTWFJhYUFVUU5Cd2ZUTm9JNlNm NWMzb3VMM1Q3Q2lsMkt6Vnp3NUJZbWhVeUVVRVVvR3dqWldMdDdBdHJMQXFHVzF1OVhRSjlxZ1RM RnQmdT1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRl ZXANCiAgICANCg0K From nobody Fri Jul 6 20:37:41 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FFD1130DD4 for ; Fri, 6 Jul 2018 20:37:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vZt1yLMVlD7T for ; Fri, 6 Jul 2018 20:37:36 -0700 (PDT) Received: from mail-wr1-x42d.google.com (mail-wr1-x42d.google.com [IPv6:2a00:1450:4864:20::42d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 165F6130E10 for ; Fri, 6 Jul 2018 20:37:36 -0700 (PDT) Received: by mail-wr1-x42d.google.com with SMTP id k7-v6so5801410wrq.0 for ; Fri, 06 Jul 2018 20:37:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=Md0fdvL5c1YBSYypcswvM4o0s/DX+HNm/wT7NC4aKco=; b=meWm2emj55xa7EzBupeSvUISXp/5StDPCbVG64g9mCrUQpqTA17RAT+X1SaN1oogFW 1JU7yKkacNab8GdBCVrTvUMpD75BMR8foIvEftbiy5KcuvEqanDR/8Q+bt2tExRZosEn oUypyfjZDwPgboyqdjA36Dlp6x+Wv4nHG4qpSmmMLawdS4Ize9ORkXxACFma5bQ3WU9h bzkvhwTtF2ZoZZw330P2Bbk/QQjLmxDrfgdsGJrBdj1hKUqPJIwemBwYJpYlbg5qlHEK fEnQwPkIK5E93BdpztLtcKtpwKAVrw+/+R+b+IOIOktouG53k9bsx1rBa+/KAo+NtTn3 WwjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=Md0fdvL5c1YBSYypcswvM4o0s/DX+HNm/wT7NC4aKco=; b=LfUofYeqzqNwpZM7gL6GbAFbMUwAoIWzVmbIqMO1AxlCOwFFGULDFr/kE+lvjtWlJk TdTI/MJlIq6SzURyg9JFnpb8bfkBjwQUwSF8Ad8PjCh69kLWSiOyZPQm/JFBKgJ8cALb WSCxGJbnFzW4G0LaFrt7hEcTSwojjl/bHAYrZ6KzyB3lCK+sOf64w8m/og7NCYt++sYI aiq0qtE21KbRdyuP/3uXAELTUwlUgc1jAAiUY8JpPQveSFMrw2Z3DaFUa2z7S84Dt/yV ZE5YYd1xtHhh8EkhiILLADBBU68F2IlWyP1YB+gM+vmt8KjZOGQn26iJ3bWimsycxOeZ sW2w== X-Gm-Message-State: AOUpUlGKMxQl4Mk7concE4PpFkQbDQ9zYXzVnCP0okr8kT0S+N1FJwNr IffwjSEaX0VU5hIkrWCnPze2MA== X-Google-Smtp-Source: AAOMgpd+vQW89ak2/S2eY2OTCgw2uYPNd9cQpHmwDVUoahuCPqxfrJWR+3045VdwbOa1xeyaIxIopQ== X-Received: by 2002:adf:fd12:: with SMTP id e18-v6mr2233644wrr.280.1530934654015; Fri, 06 Jul 2018 20:37:34 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id n8-v6sm2346347wrt.56.2018.07.06.20.37.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 06 Jul 2018 20:37:32 -0700 (PDT) To: Mingliang Pei , Hannes Tschofenig , "Wheeler, David M" , "teep@ietf.org" References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <28d23752-7bf9-54b9-0f18-e0adc5ea4c25@gmail.com> <19fdc505-f0f1-ae9f-4fec-0605c7ee3690@gmail.com> <20f8295d-68b5-fc96-c418-c4f1923d4a2b@gmail.com> From: Anders Rundgren Message-ID: Date: Sat, 7 Jul 2018 05:37:27 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Teep] OOB Issues. Was: Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Jul 2018 03:37:40 -0000 Hi Ming, Now things became pretty confusing since my question was about applications like depicted in this one-page PDF: https://1drv.ms/b/s!AmhUDQ0Od0GTgWGG91dStYl166y5 According to Hannes, FIDO is the only recommendable solution since it can use an in-line connection, rather than relying on a "phishable" OOB connection using QR or similar. That is, this market has to give up on PKI. However, according to me, FIDO support doesn't need OTrP. In my younger days as an Electronics Engineer, I would have called this an "impedance mismatch" :-) BTW, since OTrP doesn't come with a Web interface it will not be particularly attractive to use for banks etc. The "cloud provider" use case OTOH, seems like a cool target! Thanx, Anders On 2018-07-07 01:22, Mingliang Pei wrote: > Hi Anders, > > I would like to separate the authentication solution from the general TA management value that OTrP provides while authentication is one of the application case to add value. There are many apps that need security protection that can leverage a TEE, say, banking apps today in phones, which needs to store confidential data, and some gaming apps to run some confidential logic. Such a logic and confidential data can better utilize a TEE, and use a TA to run inside the TEE. There is also the TEE use case "cloud provider" where a cloud provider doesn't want to have capability to inspect a customer's app running in its hosted; a TA running in a TEE (in a server machine) would offer such a position as the host provider isn't able to inspect code and data running in the TEE. > > There is a gap today how these TAs are trusted, distributed and updated across different TEE devices and app providers. We believe that TEEP will provide greater realization of security value that TEE and TA can offer. Happy to discuss more. > > Thanks, > > Ming > > On 7/6/18, 8:44 AM, "TEEP on behalf of Anders Rundgren" wrote: > > On 2018-07-06 13:35, Hannes Tschofenig wrote: > > Hi Anders, > > Hi Hannes, > I think you misunderstood what I meant. > > > > Most likely it would make more sense to use the FIDO Authenticator in the TEE of the phone rather than connected to an external device. Using another device, such as a watch via BLE, may be possible but it is probably not the most common approach. (In fact I have actually contributed to the FIDO specification that offers that functionality.) > > The scenario I tried to depict was a Phone used as security token together with a PC running a Web application. > > Using FIDO this can be done in a secure ("non-phishable") way through standardized (but specific) FIDO interfaces using BLE (or cable). > > For non-FIDO solutions like PKI and payments, there is nothing similar available leaving us with security broken OOB schemes like QR. > > Question: What's the value of OTrP if it in reality limits you to FIDO? This question becomes even more relevant given that FIDO (in contrast to OTrP...) already supports a perfectly working Web provisioning [1] system. Personally I would be extremely surprised [2] if a not so distant release of Win10 running on recent Intel HW doesn't come with WebAuth/FIDO support built-in. The same goes for Android/ARM. > > Having had two generations of TPMs with no use whatsoever, I was hoping for something more flexible this time :-| > > Anders > > > 1] Web provisioning is as ugly as it was way back during the KEYPROV days. I would say it has actually gotten worse, due to new constraints introduced by the browser vendors. > > 2] Since I as early as 2007 together with a bunch of Nokia gurus brought the first(?) integrated TEE "secure key" solution to the market, I know there's no magic here. > > > > There is a lot of "educating" going on as part of the FIDO public policy and privacy program, which I had the pleasure to co-chair for some time. > > > > You are correct that FIDO has not been designed with the classical client-side PKI in mind. IMHO that's a good thing. > > > > For what matters with regards to TEEP is whether we can get a standardized mechanism defined that allows us to enable easier deployments like the once described above. Today, this is rather challenging since it is tough to get the necessary FIDO Authenticator code on phones and tablets. > > > > Ciao > > Hannes > > > > -----Original Message----- > > From: Anders Rundgren [mailto:anders.rundgren.net@gmail.com] > > Sent: 06 July 2018 09:45 > > To: Hannes Tschofenig; Wheeler, David M; teep@ietf.org > > Subject: Re: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt > > > > On 2018-07-06 08:26, Hannes Tschofenig wrote: > >> Hi Anders, > > > > Hi Hannes, > > > >> In this specific example I have to admit that I have a bias towards FIDO. In this setup FIDO wouldn't need an out-of-band channel. > > > > I assume you mean that the phone would be equipped with a FIDO authenticator and then connected to the PC though BLE (or worst-case through a cable), right? > > > > This obviously works but is incompatible with client side PKI as well as other schemes that do not have a natural tie to FIDO. > > > > Since this certainly isn't "common knowledge", the most reasonable would be that those who represent the platform vendors (ARM, Intel, MSFT) explained to governments and banks that they should carefully reexamine their design choices for the future. > > > > FWIW, I'm personally interested in creating more "neutral" security technology, including addressing OOB channel authentication beyond what the current standard (QR) offers (=zero). > > > > Cheers, > > Anders > > > > > >> The TEE would helpful and OTrP could be used to distribute the FIDO Authenticator code to phones and tablets. > >> > >> Ciao > >> Hannes > >> > >> -----Original Message----- > >> From: Anders Rundgren [mailto:anders.rundgren.net@gmail.com] > >> Sent: 06 July 2018 08:07 > >> To: Hannes Tschofenig; Wheeler, David M; teep@ietf.org > >> Subject: Re: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt > >> > >> On 2018-07-06 07:50, Hannes Tschofenig wrote: > >>> Hi Anders, > >> > >> Hi Hannes, > >> > >>> I agree that there are mobile phone authentication and payment solutions that do not offer much better security than traditional passwords. > >>> > >>> We do, however, not propose a single authentication or payment solution but instead want to enable developers to upload and manage code on the TEE. This could, for example, enable improved security for an FIDO-based authentication mechanism. > >> > >> What I was trying to explain is that it doesn't matter if you have TEEs or not if the system depends on an OOB channel (which currently is close to a de-facto standard). > >> > >> As a developer of such systems I find it deeply unsatisfying having to admit that in spite of using "state of the art security solutions", it doesn't really cope with phishing. > >> > >> What is your recommended solution/workaround to this problem? Dropping OOB? Replacing OOB with ...? > >> > >> Cheers, > >> Anders > >> > >>> > >>> Ciao > >>> Hannes > >>> > >>> -----Original Message----- > >>> From: Anders Rundgren [mailto:anders.rundgren.net@gmail.com] > >>> Sent: 06 July 2018 06:56 > >>> To: Wheeler, David M; teep@ietf.org; Hannes Tschofenig > >>> Subject: OOB Issues. Was: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt > >>> > >>> I hope that you guys don't mind a (distantly) related architectural question. > >>> > >>> Using trusted hardware and TEEs is indeed cool since they enable security levels comparable to traditional smart cards although provisioned on-line. > >>> > >>> A quite popular use case is using a mobile phone as a "security device" together with a PC running a web applications like on-line banking. Such arrangements usually depend on an OOB channel from the phone. > >>> > >>> However, the majority of these applications are in spite of all the great security solutions still susceptible to fairly trivial phishing attacks. In fact, some of these systems have been exploited numerous times through social engineering over the phone! > >>> > >>> What is the problem then? Please don't take it personally but there are obviously some disconnects in this industry, high-lighted by the fact that QR code has become "the new black" although it is inconvenient and have poor security characteristics. > >>> > >>> Summary: for a certain kind of real world applications, trusted hardware offers only marginally better security than traditional passwords. > >>> > >>> Cheers, > >>> Anders > >>> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > >>> > >> > >> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > >> > > > > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > > _______________________________________________ > > TEEP mailing list > > TEEP@ietf.org > > https://clicktime.symantec.com/a/1/AGsEUPvckMmXoUgJYtRiKZ14Kdo4TW_22t1Zmqx9gag=?d=Jl7UdGDeZoSKgM8phWJNJoDoD5lKk-ptf8HBgsvdCVMjBilGVqcMQ6fkuUAt71PW6OK9JNe1K_REet49jGXIGtRTqJli9lJUb6ygGZyDbzrM2zw1p29ZnZ1vC7QdCdnX-n4lIsNfiOj5gkUCrH07lOADvkFtxR8Bce8bL4hjmj4YoO4cKaqXCIsde8a0CiIvp5Qf4ieUPcA6h6F5J2sDaH9fD5RyoN9kmU38O3nCDJ-fpw8zDtp_oE0nwpNzqlscP_3G5wF34iA02qeIwUbrFvd8Np1RcyfOnxK02sZng1CWXX6juhS3hkmcFb5YI1wC-h5INa6Jv1S4MWjtptOyvn84L3yVgp9NpgHcbnYhryiuKHSXRaaAUQNBwfTNoI6Sf5c3ouL3T7Cil2KzVzw5BYmhUyEUEUoGwjZWLt7AtrLAqGW1u9XQJ9qgTLFt&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep > > > > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://clicktime.symantec.com/a/1/AGsEUPvckMmXoUgJYtRiKZ14Kdo4TW_22t1Zmqx9gag=?d=Jl7UdGDeZoSKgM8phWJNJoDoD5lKk-ptf8HBgsvdCVMjBilGVqcMQ6fkuUAt71PW6OK9JNe1K_REet49jGXIGtRTqJli9lJUb6ygGZyDbzrM2zw1p29ZnZ1vC7QdCdnX-n4lIsNfiOj5gkUCrH07lOADvkFtxR8Bce8bL4hjmj4YoO4cKaqXCIsde8a0CiIvp5Qf4ieUPcA6h6F5J2sDaH9fD5RyoN9kmU38O3nCDJ-fpw8zDtp_oE0nwpNzqlscP_3G5wF34iA02qeIwUbrFvd8Np1RcyfOnxK02sZng1CWXX6juhS3hkmcFb5YI1wC-h5INa6Jv1S4MWjtptOyvn84L3yVgp9NpgHcbnYhryiuKHSXRaaAUQNBwfTNoI6Sf5c3ouL3T7Cil2KzVzw5BYmhUyEUEUoGwjZWLt7AtrLAqGW1u9XQJ9qgTLFt&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep > > From nobody Sat Jul 7 07:54:53 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95709130E4F for ; Sat, 7 Jul 2018 07:54:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.711 X-Spam-Level: X-Spam-Status: No, score=-2.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dell.com header.b=PbR2vE78; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=emc.com header.b=kjBDDSmK Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MwDSkAdcNi9q for ; Sat, 7 Jul 2018 07:54:46 -0700 (PDT) Received: from esa2.dell-outbound.iphmx.com (esa2.dell-outbound.iphmx.com [68.232.149.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C34681277BB for ; Sat, 7 Jul 2018 07:54:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dell.com; i=@dell.com; q=dns/txt; s=smtpout; t=1530975285; x=1562511285; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=tBt0cGfyHxwA0Qk+18m6q4vXHZTeGyb/OBd6eXHGBTw=; b=PbR2vE78mo/JqxrkgR9l69eMuwqAyi/IPnoKNH3iLouF2sz5SjxIhvm4 tdd1SFizyhTwoNch7R8G23XZpTqQASY/Itw8GXgEJ0lbeeS7ri6DP/2KR ZgX3IQqiMX0JF7LceuneCC0YyTJL6kHX7TGD6UVdlbrs5FlqLIqGJTcbj c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2EEAQAn00BbmGKa6ERcHAEBAQQBAQoBA?= =?us-ascii?q?YJ1JgR+Dn8oCpgogSJllUaBKxchAwsYCwuBA0YXgl4Cgi4hOBQBAgEBAgEBAgE?= =?us-ascii?q?BAhABAQEBAQgLCwYpIwyCNSQBDg4hAgICFi8IAQUBAQEBAQEBAQEjAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBARcCDwoOHAESAQEYAQEBAQIBAQEYJgklAgIIBAcCAgIBCBE?= =?us-ascii?q?BAwEBAQodBxYRCxQDBggCBAESCBKDAQQBAYFnAw0IAQ6rVoJ4hBoDgTiBMggFh?= =?us-ascii?q?jSBBSZtHYFWP4EOAYMPgxgBAQIBF4ETARIBCQIHDwUfBgyCeoIkh0slhR+MQgc?= =?us-ascii?q?CAoYGgmSCd4UDHiWDS4gNh32CO4RLgmYCBAIEBQIUgVgvVHFwLyGCaQmCGw4Je?= =?us-ascii?q?gECgkiFFIU+bwEBAQmNSwENFweBATBqAQE?= X-IPAS-Result: =?us-ascii?q?A2EEAQAn00BbmGKa6ERcHAEBAQQBAQoBAYJ1JgR+Dn8oCpg?= =?us-ascii?q?ogSJllUaBKxchAwsYCwuBA0YXgl4Cgi4hOBQBAgEBAgEBAgEBAhABAQEBAQgLC?= =?us-ascii?q?wYpIwyCNSQBDg4hAgICFi8IAQUBAQEBAQEBAQEjAQEBAQEBAQEBAQEBAQEBAQE?= =?us-ascii?q?BARcCDwoOHAESAQEYAQEBAQIBAQEYJgklAgIIBAcCAgIBCBEBAwEBAQodBxYRC?= =?us-ascii?q?xQDBggCBAESCBKDAQQBAYFnAw0IAQ6rVoJ4hBoDgTiBMggFhjSBBSZtHYFWP4E?= =?us-ascii?q?OAYMPgxgBAQIBF4ETARIBCQIHDwUfBgyCeoIkh0slhR+MQgcCAoYGgmSCd4UDH?= =?us-ascii?q?iWDS4gNh32CO4RLgmYCBAIEBQIUgVgvVHFwLyGCaQmCGw4JegECgkiFFIU+bwE?= =?us-ascii?q?BAQmNSwENFweBATBqAQE?= Received: from esa4.dell-outbound2.iphmx.com ([68.232.154.98]) by esa2.dell-outbound.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 07 Jul 2018 09:54:43 -0500 From: "faibish, sorin" Received: from mailuogwdur.emc.com ([128.221.224.79]) by esa4.dell-outbound2.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 07 Jul 2018 20:54:42 +0600 Received: from maildlpprd52.lss.emc.com (maildlpprd52.lss.emc.com [10.106.48.156]) by mailuogwprd52.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id w67Esd8Z030033 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 7 Jul 2018 10:54:39 -0400 X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd52.lss.emc.com w67Esd8Z030033 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=emc.com; s=jan2013; t=1530975281; bh=guUbEYdbveJ5aXUt3xeYneUtnHA=; h=From:To:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version; b=kjBDDSmKAblc+5fvbG0WdOFTwHx5P4t7cGY9eBvH62BOjRcfv45879lzjQqSeXkAM y4nFwKvnm9b1kMZY8feILWaTOkC0fGWdXDixH5sMx5Hqe2bXSFsusjuhmsMrPeYrbo 3q9MCDKccTNsNQ8c+yLbTRV/HiE+L/s9CbA1OZ0c= X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd52.lss.emc.com w67Esd8Z030033 Received: from mailusrhubprd01.lss.emc.com (mailusrhubprd01.lss.emc.com [10.253.24.19]) by maildlpprd52.lss.emc.com (RSA Interceptor); Sat, 7 Jul 2018 10:54:05 -0400 Received: from MXHUB306.corp.emc.com (MXHUB306.corp.emc.com [10.146.3.32]) by mailusrhubprd01.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id w67EsKZj021507 (version=TLSv1.2 cipher=AES128-SHA256 bits=128 verify=FAIL); Sat, 7 Jul 2018 10:54:21 -0400 Received: from MX304CL01.corp.emc.com ([fe80::2d21:ebf8:dc15:2b07]) by MXHUB306.corp.emc.com ([10.146.3.32]) with mapi id 14.03.0382.000; Sat, 7 Jul 2018 10:54:20 -0400 To: "Wheeler, David M" , Henk Birkholz , Dave Thaler , Hannes Tschofenig , Andrew Atyeo , "'Wiseman, Monty (GE Global Research, US)'" , "teep@ietf.org" Thread-Topic: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt Thread-Index: AdQUl6anjuGXP1amTk2tMyFIInlwdwAAFmrwAAjHMQAAAYsuAAAZPGaAAAWyYAAABtRbgAABN7uAAAFBuAAAJ2JPMA== Date: Sat, 7 Jul 2018 14:54:19 +0000 Message-ID: <2313358402DBCC4DB2F2DC03CB08BBFE0128C3FA@MX304CL01.corp.emc.com> References: <0627F5240443D2498FAA65332EE46C843B66A086@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66A0C5@CRSMSX102.amr.corp.intel.com> <0627F5240443D2498FAA65332EE46C843B66B434@CRSMSX102.amr.corp.intel.com> In-Reply-To: <0627F5240443D2498FAA65332EE46C843B66B434@CRSMSX102.amr.corp.intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.97.20.125] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Sentrion-Hostname: mailusrhubprd01.lss.emc.com X-RSA-Classifications: public Archived-At: Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00.txt X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Jul 2018 14:54:51 -0000 Hannes, After reviewing the definitions again I realized that the 2 definitions of = RTC and TA - trust anchors are representing to different functions. Same as= Dave I would like to see what definition and usage were intented by the dr= aft as well as the specific use in the protocol of each definition in order= to clarify the similarities/differences between the 2 definitions. On another note, while reviewing the draft, I was wondering if it shouldn't= also define the minimum OS requirements for IoT devices which will allow t= he implementation of the trusted protocols. I was looking at several types = of IoT used in the industry and I came up to this list including: No-OS, RT-OS, language-runtime OS, full-OS, application-OS, server OS= and container OS. =20 According to some publications the minimum OS requirements to support the s= ecurity of IoT devices is Language-runtime OS that according to the sources= is capable of TFW upgrades and implementation of full security of TEE. My = recommendation is to add such a definition/requirements for IoT TA.=20 ./Sorin -----Original Message----- From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David M Sent: Friday, July 6, 2018 11:48 AM To: Henk Birkholz; Dave Thaler; Hannes Tschofenig; Andrew Atyeo; 'Wiseman, = Monty (GE Global Research, US)'; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= .txt Henk, I quickly reviewed the NIST document, and did not find a RTC - Root of Trust for Confidentiality Can you provide a reference and a short definition? Thanks, Dave Wheeler -----Original Message----- From: Henk Birkholz [mailto:henk.birkholz@sit.fraunhofer.de] Sent: Friday, July 6, 2018 8:12 AM To: Dave Thaler ; Hannes Tschofen= ig ; Andrew Atyeo ; = Wheeler, David M ; 'Wiseman, Monty (GE Global Re= search, US)' ; teep@ietf.org Subject: Re: [Teep] Comments on I-D Action: draft-ietf-teep-architecture-00= ..txt Hi all, the TCG's definition of RoT is: > A component that performs one or more security specific functions, such a= s measurement, storage, reporting, verification, and/or update. It is trust= ed always to behave in the expected manner, because its misbehavior cannot = be detected (such as by measurement) under normal operation. This term is disconnected from the quality of being "securely stored".=20 The TCG defines Shielded Location: > A place (memory, register, etc.) where it is safe to operate on sensitive= data; data locations that can be accessed only by Protected Capabilities. Trust Anchor is defined by RFC494 already (and therefore difficult to redef= ine, I think): > An established point of trust (usually based on the authority of some per= son, office, or organization) from which a certificate user begins the vali= dation of a certification path. Corresponding to the definition above, in the TCG context it is also common= to define these "favors" of RoT: > RTC - Root of Trust for Confidentiality RTI - Root of Trust for=20 > Integrity RTM - Root of Trust for Measurement RTR - Root of Trust for=20 > Reporting RTS - Root of Trust for Storage RTV - Root of Trust for=20 > Verification Maybe it can be of use to define a "flavor" here also? Arbitrary use of one= single shielded secret for multiple uses might enable a variety of attack = vectors. Viele Gr=FC=DFe, Henk On 07/06/2018 04:37 PM, Dave Thaler wrote: > [speaking as an individual participant] >=20 > The WG charter says "The group will maintain a close relationship with=20 > the . Trusted Computing Group, and other relevant standards groups..." > and I think part of that is to use consistent terminology.=A0 Hence my=20 > recommendation that David Wheeler already incorporated into his=20 > proposed text.=A0 (Thanks David) >=20 > Dave >=20 > *From:* Hannes Tschofenig > *Sent:* Friday, July 6, 2018 4:22 AM > *To:* Andrew Atyeo ; Dave Thaler=20 > ; Wheeler, David M ;=20 > teep@ietf.org > *Subject:* RE: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > The problem is only that "root of trust" is not a well defined term in=20 > the IETF, at least as far as I know. Trust anchor, on the other hand,=20 > is well defined. >=20 > The definition currently in the document for root of trust seems to be=20 > similar to trust anchor. However, I agree with both Andy and with=20 > David that we need to find out whether we want to point out certain=20 > usages of the key (such as for the purpose of the attestation). > Whether this justifies the introduction of another term is yet another=20 > discussion >=20 > Ciao >=20 > Hannes >=20 > *From:*Andrew Atyeo [mailto:Andrew.Atyeo@intercede.com] > *Sent:* 06 July 2018 10:38 > *To:* Dave Thaler; Wheeler, David M; Hannes Tschofenig; teep@ietf.org=20 > > *Subject:* RE: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > In OTrP, I believe "root of trust" and "trust anchor" are currently=20 > referring to 2 different things in the OTrP spec. >=20 > =B7*Root of trust* >=20 > Excerpt from OTrP: "This specification assumes that an applicable=20 > device is equipped with >=20 > =A0=A0 a TEE and is pre-provisioned with a device-unique public/private= =20 > key >=20 > =A0=A0 pair, which is securely stored.=A0 This key pair is referred as t= he >=20 > =A0=A0 'root of trust'.=A0 An entity that uses such a device to run Trus= ted >=20 > =A0=A0 Applications (TAs) is known as a Service Provider (SP)." >=20 > Here, "Root of Trust" must be talking about either the TEE/TFW private=20 > key, so "root of trust" is referring to the process of secure boot=20 > that results in a TAM being able to use a signature from this key to=20 > know whether to trust the TEE >=20 > =B7*Trust Anchor* >=20 > There is a problem this refers to 2 completely different concepts: >=20 > "Setup trust anchors in devices >=20 > =A0=A0 1.=A0 [TFW/TEE] Store the key and certificate encrypted with the= =20 > eFuse >=20 > =A0=A0=A0=A0=A0=A0 key >=20 > =A0=A0 2.=A0 [TEE vendor or OEM] Store trusted CA certificate list into >=20 > =A0=A0=A0=A0=A0=A0 devices" >=20 > Here, "Trust Anchor" is referring to both the TFW private key and the=20 > TAM CA root certificate store >=20 > BUT later on in the spec: >=20 > "The root CA certificates for a TAM, which are >=20 > embedded into the trust anchor store in a device, should have long >=20 > lifetimes that don't require device trust anchor update." >=20 > And >=20 > "Trust Anchor: A root certificate that can be used to validate its >=20 > children certificates. It is usually embedded in a device or >=20 > configured by a TAM for validating the trust of a remote entity's >=20 > certificate." >=20 > Here, "Trust Anchor" refers to the TAM root CA whitelist that is=20 > embedded in the TEE in order to allow the TEE to chain TAM=20 > certificates to the root CA certs (to determine what certs to trust) >=20 > .So it is best if we can remove the term "trust anchor" wherever it=20 > refers to the concept of root CA certs, and refer to "TAM root CA=20 > certificate store" (or something like that) >=20 > , and for everywhere else that uses "trust anchor" to refer to the=20 > concept of secureboot/attestation etc, we need to settle on some other=20 > term. In some cases >=20 > e.g. "pair, which is securely stored in the TEE. This key pair is=20 > referred to as the 'root of trust'." >=20 > we can simply refer to the TFW key (since in places 'root of trust' is=20 > used to describe the TFW key). >=20 > Andrew Atyeo >=20 > Security Architect >=20 > Intercede >=20 > Digital trust=A0=A0=A0 people | devices | apps >=20 > Office: +44 (0) 1455 558 111 >=20 > www.intercede.com >=20 > -----Original Message----- > From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Dave Thaler > Sent: 05 July 2018 21:36 > To: Wheeler, David M >; Hannes Tschofenig=20 > >; > teep@ietf.org > Subject: Re: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00...txt >=20 > [speaking as an individual] >=20 > As David says, there's more than one type of "Root-of-Trust" aka=20 > "trust anchor". >=20 > There are industry terms of art for the different types. >=20 > One example article that gives a decent summary is=20 > https://healthitsecurity.com/news/nist-roots-of-trust-for-healthcare-m > obile-devices > thitsecurity.com%2Fnews%2Fnist-roots-of-trust-for-healthcare-mobile-de > vices&data=3D02%7C01%7Cdthaler%40microsoft.com%7Ca9986e033e9a4df8bb3608d > 5e332b1a0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664729240700 > 830&sdata=3DnWEwUiwplWo%2F2ikoHBR6mg6s3vI7vKr0YywPjl8Nuz4%3D&reserved=3D0= > >=20 > In particular, the industry terms (from NIST SP 800-164, potentially=20 > among others) are: >=20 > Roof of Trust for Storage (RTS) >=20 > Root of Trust for Verification (RTV) >=20 > Root of Trust for Integrity (RTI) >=20 > Root of Trust for Reporting (RTR) >=20 > Root of Trust for Measurement (RTM) >=20 > I would recommend using the above terms and not using "trust anchor"=20 > or the unqualified "root of trust" term. >=20 > Dave >=20 > -----Original Message----- >=20 > From: TEEP > On=20 > Behalf Of Wheeler, David M >=20 > Sent: Thursday, July 5, 2018 12:52 PM >=20 > To: Hannes Tschofenig >; teep@ietf.org=20 > >=20 > Subject: Re: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > Hannes, >=20 > If that is the case (trust root and trust anchors are the same), then=20 > I have a concern regarding crypto separation. >=20 > In one definition the Trust Anchor signs certificates, in the other=20 > definition a Root-of-Trust signs attestations. >=20 > If these are in fact the same key, then they are being used for two=20 > different functions, which is not recommended for cryptographic keys. >=20 > Further, it seems to me (though I may be misunderstanding the intended=20 > function), the private key of the Trust Anchor resides outside the=20 > device, in a separate entity, like a CA or a TAM. >=20 > However, the private key of a Root-of-Trust resides in the TEE (or is=20 > accessible only to the TEE). >=20 > Can you pick apart my understanding of the two definitions of keys,=20 > and help me understand where I got thrown off? >=20 > Thanks, >=20 > Dave Wheeler >=20 > -----Original Message----- >=20 > From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com=20 > ] >=20 > Sent: Thursday, July 5, 2018 12:41 PM >=20 > To: Wheeler, David M >; teep@ietf.org=20 > >=20 > Subject: RE: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > Just a quick remark: IMHO root of trust and trust anchor are the same=20 > thing. I believe we should update the text to only talk about trust=20 > anchors and forget the root of trust terminology. >=20 > -----Original Message----- >=20 > From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of Wheeler, David=20 > M >=20 > Sent: 05 July 2018 21:38 >=20 > To: teep@ietf.org >=20 > Subject: [Teep] Comments on I-D Action:=20 > draft-ietf-teep-architecture-00.txt >=20 > I have several comments on the new architecture draft. >=20 > The first comment has to do with the definition of the "Trust Anchor"=20 > (page 4) >=20 > The definition states: >=20 > Trust Anchor: A root certificate that can be used to validate its >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 certificates. It is usually embedded in a=20 > device or >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 =A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0configured by a TAM for validating the=20 > trust of a remote entity's >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 certificate. >=20 > Then later in section 3 (page 6) >=20 > This specification assumes that an applicable device is equipped with=20 > one or more TEEs and each TEE is pre-provisioned with a device-unique=20 > public/private key pair, which is securely stored. This key pair is=20 > referred to as the 'root of trust' for remote attestation of the=20 > associated TEE in a device by an TAM. >=20 > It is not clear whether the "Trust Anchor" is the same as the=20 > "root-of-trust" key pair, since the "root-of-trust" is not included in=20 > the definitions.. >=20 > If they are intended to be different (which is what I believe), then I=20 > suggest we add the "root-of-trust" to the definitions, and explain the=20 > difference. Oftentimes, in my experience, these terms are used=20 > interchangeably. >=20 > Here is my attempt to create definitions for these two types of keys: >=20 > Trust Anchor: A trust anchor is public asymmetric key, preferably=20 > contained in a certificate >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 =A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0that represents a trusted entity to a=20 > device. This public key may be used by >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 the holder of the corresponding private=20 > key to sign other certificates, >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 thereby communicating the signed=20 > certificate may also be trusted. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 The trust anchor is usually embedded in a=20 > device or configured by a TAM >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0 and used by the device to validate the=20 > trust of a remote entity by >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 verifying that entity's certificate is=20 > signed by a trust anchor. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0 Trust anchors must be stored in a way=20 > that prevents or strongly resists >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0 modification by unauthorized software=20 > and hardware adversaries. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0 An example of a trust anchor is the public k= ey of a TAM or=20 > SP which is >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 "pinned" or securely stored inside the=20 > device, and that trust anchor is used >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 like a CA certificate to validate the=20 > trust in other keys/certificates. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0 A trust anchor may be viewed by both=20 > trusted and untrusted entities on the device, >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 But may only be modified or deleted by a=20 > trusted entity. >=20 > Root-of-Trust Key:=A0 A device-unique key generated at device=20 > manufacturing or at >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 TEE provisioning, which is securely=20 > stored and only accessible to the TEE. >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 The Root-of-Trust Key is used for=20 > attestation signing which proves the signed >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0 message originated or was approved by the=20 > TEE, and may be trusted to the same >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0 degree as the TEE. >=20 > -----Original Message----- >=20 > From: TEEP [mailto:teep-bounces@ietf.org] On Behalf Of=20 > internet-drafts@ietf.org >=20 > Sent: Wednesday, July 4, 2018 7:49 AM >=20 > To: i-d-announce@ietf.org >=20 > Cc: teep@ietf.org >=20 > Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt >=20 > A New Internet-Draft is available from the on-line Internet-Drafts=20 > directories. >=20 > This draft is a work item of the Trusted Execution Environment=20 > Provisioning WG of the IETF. >=20 > =A0=A0=A0=A0=A0=A0=A0 Title=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 : Trusted Exec= ution Environment Provisioning > (TEEP) Architecture >=20 > =A0=A0=A0=A0=A0=A0=A0 Authors=A0=A0=A0=A0=A0=A0=A0=A0 : Mingliang Pei >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 Hannes Tschofenig >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 Andrew Atyeo >=20 > =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0 Dapeng >=20 > Filename=A0=A0=A0=A0=A0=A0=A0 : draft-ietf-teep-architecture-00.txt >=20 > Pages=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 : 24 >=20 > Date=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 : 2018-07-02 >=20 > Abstract: >=20 > =A0=A0 A Trusted Execution Environment (TEE) was designed to provide a >=20 > =A0=A0 hardware-isolation mechanism to separate a regular operating=20 > system >=20 > =A0=A0 from security- sensitive applications. >=20 > =A0=A0 This architecture document motivates the design and=20 > standardization >=20 > =A0=A0 of a protocol for managing the lifecyle of trusted applications >=20 > =A0=A0 running inside a TEE. >=20 > The IETF datatracker status page for this draft is: >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatat > racker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=3D02%7C > 01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f9 > 88bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DXB > uTlsiV5OjkxkcqULdsmroTnWRZqApH3fBokJGvkTE%3D&reserved=3D0 > tracker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F&data=3D02%7C01% > 7Cdthaler%40microsoft.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988b > f86f141af91ab2d7cd011db47%7C1%7C0%7C636664729240700830&sdata=3DQgHpEQ6cq > PzjNSNAXlOBVJfmbHzpDogVNJNpWI6uPzg%3D&reserved=3D0> >=20 > There are also htmlized versions available at: >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools > .ietf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7C01%7C > dthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf8 > 6f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&sdata=3DheO1xlx > frVZyyzYziQy8V2P0vxiEbTVSF8sFdNaw8sc%3D&reserved=3D0 > s.ietf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D02%7C01%7Cdth > aler%40microsoft.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f1 > 41af91ab2d7cd011db47%7C1%7C0%7C636664729240710835&sdata=3DyLbkguKNpWobGS > QbfCI3XTLaLJPHO5pX7y0uzM5aQpI%3D&reserved=3D0> >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatat > racker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&dat > a=3D02%7C01%7Cdthaler%40microsoft.com%7C96a47856ba6549e9926f08d5e2b0c5fc > %7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664171223541902&s > data=3DaoKW%2FFnlzzLxpOwEpmKZ6IsOvg8Tji8Gw4YabXAcS54%3D&reserved=3D0 > tracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00&data=3D0 > 2%7C01%7Cdthaler%40microsoft.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C > 72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636664729240720840&sdata=3Diz > EKpdtjJPah2dorUbEc7ZdJZJAvPITE9iop%2BtuFrms%3D&reserved=3D0> >=20 > Please note that it may take a couple of minutes from the time of=20 > submission until the htmlized version and diff are available at=20 > tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: >=20 > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ >=20 > TEEP mailing list >=20 > TEEP@ietf.org >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i > etf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40micro > soft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7c > d011db47%7C1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRR > vwGvB4TTpl0okIPShXtd0%3D&reserved=3D0 > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsof > t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 > 1db47%7C1%7C0%7C636664729240730849&sdata=3DvxedecEwOXML1kDDEvCVOmZWyVp7J > F6jky%2BnGgZeU5w%3D&reserved=3D0> >=20 > _______________________________________________ >=20 > TEEP mailing list >=20 > TEEP@ietf.org >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i > etf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40micro > soft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7c > d011db47%7C1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRR > vwGvB4TTpl0okIPShXtd0%3D&reserved=3D0 > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsof > t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 > 1db47%7C1%7C0%7C636664729240730849&sdata=3DvxedecEwOXML1kDDEvCVOmZWyVp7J > F6jky%2BnGgZeU5w%3D&reserved=3D0> >=20 > IMPORTANT NOTICE: The contents of this email and any attachments are=20 > confidential and may also be privileged. If you are not the intended=20 > recipient, please notify the sender immediately and do not disclose=20 > the contents to any other person, use it for any purpose, or store or=20 > copy the information in any medium. Thank you. >=20 > _______________________________________________ >=20 > TEEP mailing list >=20 > TEEP@ietf.org >=20 > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i > etf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40micro > soft.com%7C96a47856ba6549e9926f08d5e2b0c5fc%7C72f988bf86f141af91ab2d7c > d011db47%7C1%7C0%7C636664171223541902&sdata=3D7x7cgTvWZOsnWEDD9hQuRR > vwGvB4TTpl0okIPShXtd0%3D&reserved=3D0 > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsof > t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 > 1db47%7C1%7C0%7C636664729240740862&sdata=3DBM3CGgYe99eqU3Cr9j8CZ3R9LIxD0 > ycKnT8%2FEMwUqjU%3D&reserved=3D0> >=20 > _______________________________________________ >=20 > TEEP mailing list >=20 > TEEP@ietf.org >=20 > https://www.ietf.org/mailman/listinfo/teep > ietf.org%2Fmailman%2Flistinfo%2Fteep&data=3D02%7C01%7Cdthaler%40microsof > t.com%7Ca9986e033e9a4df8bb3608d5e332b1a0%7C72f988bf86f141af91ab2d7cd01 > 1db47%7C1%7C0%7C636664729240750863&sdata=3DKuTTsAhETZCmCGwo1Y3rmgkhCM8w5 > Mq8JkxxcLL26N8%3D&reserved=3D0> >=20 > IMPORTANT NOTICE: The contents of this email and any attachments are=20 > confidential and may also be privileged.. If you are not the intended=20 > recipient, please notify the sender immediately and do not disclose=20 > the contents to any other person, use it for any purpose, or store or=20 > copy the information in any medium. Thank you. >=20 >=20 >=20 > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep >=20 _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep From nobody Wed Jul 11 07:48:34 2018 Return-Path: X-Original-To: teep@ietf.org Delivered-To: teep@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B474130E21 for ; Wed, 11 Jul 2018 07:48:31 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit To: X-Test-IDTracker: no X-IETF-IDTracker: 6.81.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153132051123.22087.3811261649449003827.idtracker@ietfa.amsl.com> Date: Wed, 11 Jul 2018 07:48:31 -0700 From: IETF Secretariat Archived-At: Subject: [Teep] Milestones changed for teep WG X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2018 14:48:32 -0000 Changed milestone "Progress Solution document to the IESG for publication", set due date to August 2019 from August 2018. URL: https://datatracker.ietf.org/wg/teep/about/ From nobody Wed Jul 11 20:47:09 2018 Return-Path: X-Original-To: teep@ietf.org Delivered-To: teep@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EBC28130EC2 for ; Wed, 11 Jul 2018 20:47:06 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit To: X-Test-IDTracker: no X-IETF-IDTracker: 6.81.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153136722696.21989.6462999848319208743.idtracker@ietfa.amsl.com> Date: Wed, 11 Jul 2018 20:47:06 -0700 From: IETF Secretariat Archived-At: Subject: [Teep] Milestones changed for teep WG X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Jul 2018 03:47:07 -0000 Changed milestone "Progress Architecture document to the IESG for publication", set due date to April 2019 from January 2019. Changed milestone "Progress Solution document to the IESG for publication", set due date to December 2019 from August 2019. URL: https://datatracker.ietf.org/wg/teep/about/ From nobody Thu Jul 12 12:31:14 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BD8B1311AA for ; Thu, 12 Jul 2018 12:31:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.011 X-Spam-Level: X-Spam-Status: No, score=-2.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y-tvQqzkBVp6 for ; Thu, 12 Jul 2018 12:30:58 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0090.outbound.protection.outlook.com [104.47.36.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99E0C13119F for ; Thu, 12 Jul 2018 12:30:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CCrO4wanznnCgkuuqmcuzfqhm9PcZK1V3gGzmHeIjBQ=; b=BUPQvF6/1Ulgmho/fA323pY1J8Qee8RRFzumasmvl9+J94w+9/NhO7tLjRMC+dxiE3azaxbvx6gbigfK8OEjTuUicO98huR18wpE2X6UJbiFwJgDVKRH4cC4MRkGJe9E58QJcKct6wuZrzVi9keBWgAYbSyPM5iCiDrHyObMdIg= Received: from SN4PR2101MB0816.namprd21.prod.outlook.com (10.167.151.158) by SN4PR2101MB0878.namprd21.prod.outlook.com (10.167.151.159) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.973.12; Thu, 12 Jul 2018 19:30:57 +0000 Received: from SN4PR2101MB0816.namprd21.prod.outlook.com ([fe80::11f4:8db2:7397:4dc0]) by SN4PR2101MB0816.namprd21.prod.outlook.com ([fe80::11f4:8db2:7397:4dc0%9]) with mapi id 15.20.0952.017; Thu, 12 Jul 2018 19:30:57 +0000 From: Dave Thaler To: "teep@ietf.org" Thread-Topic: Comments on draft-ietf-teep-architecture-00 Thread-Index: AdQaFT53hPhoMfF0R9iuNBW1KxtF/w== Date: Thu, 12 Jul 2018 19:30:57 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-07-12T19:29:59.8919840Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:a:1989:110d:2ab8:f324] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; SN4PR2101MB0878; 6:ApyWpWVS3dCv+NFCR0muUDNtF1pItbsoswMn7KyQ8oG5vBl7uaZ+a77P2CNbmR6W2eipxNDaU5qVnDGJwMB8wTpCvsxLvRgKfnXy9+bR4dMwgKjsyvw6KuK11xz8ONTJILi0jrhe9RXR1t+ASICnjDZpmtw/TasPwO9lEMRZnQLAU70jCi00xt08uGovBr5GpTuk1+mu9lZFoIAEQJNedbGwCvqRXKkKKe2zuGQm3Pw0MMjl1nNQi/GdMByf6enmV4j4ztYBqPOZyDkyK9dBhl6GU5IRtvEnciwstFPJICWQVhkCGt6cEUZoJOhMRBTKP0nRXKyBw1by48mMw2zYawsA0xMhFkWGPVKoT0ZG1K31aujSjPWtIBTX2VePyt/1rbY26m+SB6FV4L9kpMwrFaRGFCubqkdPqTXGZ+utMJpMZYD+md/+0UMZWeqjX6AAsypbSoqqQJQDGozXP+1NOQ==; 5:koNDl4ijgGBhHBDZWl16cvTX6ICh5SHGyHDFXNJeOFE8Fe/SHc2HhUGhwsn22GISzEXndxACf512MV8iVYACZBuQmgvYaG6t7VIkAWeR+Q1uSzFfxC2JE8tYoHq2hk9kiFZnjbym8i0URulBy6IFBAvPLC5imGvG9TWP/5v7pj0=; 7:T3BjQEM7cX60rxREooxr5s2xbhG487BCdLB3dix5CwgH8WoovDgikNLTJYDnoTyzHMqRYdocosG7BKjS97uJfkv55fR5B+/gBCvhMX2nZXmhjo1JZj1hpXzJw7fqIsFt7ybcRzNjDMkCuFRwLhgFRaONlKZGoSBBz/+JmtB4UCCR8a8oWExvK8UaEGMkpWQm6bTEHfIyneJBiypBlIwi8BFJ5JMd3QJFNLu38+wyuzKGtxP/aWHQ2/adwyx3cWLj x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 055e711b-6f12-48fd-8431-08d5e82dfdec x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(48565401081)(2017052603328)(7193020); SRVR:SN4PR2101MB0878; x-ms-traffictypediagnostic: SN4PR2101MB0878: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(43050042349365); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006095)(93001095)(3231311)(944501410)(52105095)(2018427008)(6055026)(149027)(150027)(6041310)(20161123562045)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123558120)(6072148)(201708071742011)(7699016); SRVR:SN4PR2101MB0878; BCL:0; PCL:0; RULEID:; SRVR:SN4PR2101MB0878; x-forefront-prvs: 0731AA2DE6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(346002)(136003)(396003)(376002)(366004)(199004)(189003)(33656002)(22452003)(2351001)(10290500003)(7696005)(68736007)(102836004)(6436002)(6916009)(5250100002)(5640700003)(486006)(2501003)(55016002)(6306002)(5660300001)(9686003)(6506007)(256004)(186003)(966005)(25786009)(10090500001)(86362001)(74316002)(8676002)(81166006)(81156014)(1730700003)(8990500004)(99286004)(305945005)(7736002)(46003)(86612001)(14454004)(8936002)(53936002)(478600001)(2900100001)(476003)(105586002)(97736004)(106356001)(2906002)(6116002)(316002); DIR:OUT; SFP:1102; SCL:1; SRVR:SN4PR2101MB0878; H:SN4PR2101MB0816.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: +U2wR0+JAjrc5pJsfZTe14DsqeodU7MRNGCB2Fu8N0QhnfULvqjlncSinZfZeDln+sZwzkezK1I/a+kMyOhg3YdXHZGLpC3Cbxuo2ENq/K4wVKBmt+ZHnaHJdk0tXbBsCNbWcOdst+xJ9Kx10B1rS0/ddkwFhf0IdPqZQpVZFk6l88a1eWKUtioMO7vAUV052KFYs8SlW5ReIofMsSkg+ON9FJ597esP+pFAyJmxZRsnS/iHGipKE4ttTtS7jdmdwERxR+JvuR1psGiZprm4aKGglamgzFVxCmOukwW1Nrzs3KErYM2l5y1AUc6GdDNEjxCPqm1YmdMgNeK+DtXnkkrfkzbwYW43rKuMsV0H3Os= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 055e711b-6f12-48fd-8431-08d5e82dfdec X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jul 2018 19:30:57.2070 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN4PR2101MB0878 Archived-At: Subject: [Teep] Comments on draft-ietf-teep-architecture-00 X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Jul 2018 19:31:11 -0000 [speaking as an individual participant] I have reviewed draft-ietf-teep-architecture-00 and have comments for the a= uthors and WG to consider. A marked up copy with my comments is at https://www.microsoft.com/en-us/research/uploads/prod/2017/05/draft-ietf-te= ep-architecture-00.pdf The majority are editorial, but a couple example ones to highlight beyond t= hings covered in other threads, are summarized below: 1) If the Device Admin is responsible for controlling what apps run in the = TEE on an IoT class device (e.g., in a factory), is the Device Administrato= r just another type of SP, or are those terms disjoint? 2) The document seems to assume that every rich app that needs a TA, also n= eeds to have code to talk to a TAM. I agree that's one possible implementa= tion but the architecture should not require that. An alternative implemen= tation would be where the REE OS (e.g., the app store installer) contains c= ode for communicating with TAM(s) using data in (for example) the rich app'= s manifest, and the rich app has no need to run until the TA is already ins= talled. The installer/communicator is a rich app of a sort, but it's a di= fferent one from the client app that depends on the TA. In my opinion, th= e arch doc should not require that it's the same app, but should certainly = allow it to be. Dave From nobody Mon Jul 16 07:25:23 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 204D4131071 for ; Mon, 16 Jul 2018 07:25:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AQKupB8Bz9Yi for ; Mon, 16 Jul 2018 07:25:15 -0700 (PDT) Received: from NAM04-CO1-obe.outbound.protection.outlook.com (mail-eopbgr690090.outbound.protection.outlook.com [40.107.69.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 056E7131066 for ; Mon, 16 Jul 2018 07:25:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YiQlLJYF95wkkOF1WjMK46Sd8S98l0v5OtaqB70COPM=; b=Ug3/2qw7/ngkC2ug6b50tpqfbo4CnDMIh0qzoNxASRWlTScw2UuBbZTnkVtUkkME8PntywEpFMuBnXPwtRwqQsOHPhtiMoyktlQIcbNlcyFOk16pS4Jkoiy/9Kzk5/pldlITnzlb/PY/u3yAnMD/caVeNYCsg1K3bgBtcH25y3A= Received: from DM5PR2101MB0805.namprd21.prod.outlook.com (10.167.105.149) by DM5PR2101MB0725.namprd21.prod.outlook.com (10.167.107.167) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.995.1; Mon, 16 Jul 2018 14:25:13 +0000 Received: from DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::8416:6f:8f6b:3fb7]) by DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::8416:6f:8f6b:3fb7%3]) with mapi id 15.20.0995.000; Mon, 16 Jul 2018 14:25:13 +0000 From: Dave Thaler To: "teep@ietf.org" Thread-Topic: Implementation feedback on draft-ietf-teep-opentrustprotocol-01 Thread-Index: AdQdELD0WeWS9FafTXOUTGNyvJ0Bjg== Date: Mon, 16 Jul 2018 14:25:13 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-07-16T14:24:22.6802821Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:67c:370:128:f821:d3c7:b1c:b8cc] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2101MB0725; 6:jZwoVxMkkjDoSumrB/gkZmDw7O+u6dFCnvju4FzaHoPzjsi4KYg6ssDwRiWBO2NL7WwE0hrWXkbAPGaxq2AQYznf6B93mUx9AeJyp4vIofkuMLAlT/8NEeTB3TIFUpIRmeyvGL4qY6LpSl0ce2QnOqtFeZ1XM/X/Ei2tgz0wkFk8P+AWKlL2U2iCcUclQhJugkHTEBtjONA9SOoD4TMyRKN+ll+0wWR35LI2iiF4inDJJrVq67YokdjGrhDwy+UtdwzEaJBRsYSfPu/elk1jdzJ/XJTx1z20dBELrmQ2S2+0wqOnUrLisLsfkxohKu5C/kuymEYN7U3BO9fgoNPjpp3So/34VUui9ZnVm2yzgWWeuMxc2PWu8KGVvDyavP4Y2rHTWOBgHBoiRcExN4BcbKqwkKZkaQEmOeuSSDQn9CcxpdPFPp0QAomkPfZp21Y9om9kzmlG7nCoqnnTXrSNjQ==; 5:qpfHNvzRZU9BjJkgD5DlVcyoD2LvM+wdcCLQaszfQMniHl3XzSormL2J5MSFy4K/c0r2fc1i0my3J48vPQW6zSuWGyCs82EuPya49QLnuPOk1qXcCEltACuFkZJEETOPtbYpXYJqKml5uxPqURLk4ypxtxlkDOFBuOGyYjw6gzs=; 7:MqSJiLAchwtE8q7/RGDAf5GR2WePQnEX+KD/23ONHMMmoDXIixr1b5VpO9H+/q8noa3rDkYnTKCH+7Ygh1EankdAnkBZ3CDOjKBZ0AroyfgzSBIcHLbcsB6CE35Q+Z7RyhcFZT6oqC3MGC9lkai6uq7hpIsqe0r/9JiSKQEUgY+KQKt8DyA6tmp1UIY950nGQyo4twYt/jMwx0uL2ebQr5T+7RIyN9w4OMDy+XqJHDxklc9cgKdHlcgaiKUCufQi x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 72338767-2fb7-4328-f06b-08d5eb27f1eb x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(48565401081)(2017052603328)(7193020); SRVR:DM5PR2101MB0725; x-ms-traffictypediagnostic: DM5PR2101MB0725: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3002001)(10201501046)(93006095)(93001095)(3231311)(944501410)(52105095)(2018427008)(6055026)(149027)(150027)(6041310)(20161123560045)(20161123558120)(20161123564045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011)(7699016); SRVR:DM5PR2101MB0725; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2101MB0725; x-forefront-prvs: 073515755F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(376002)(366004)(346002)(396003)(136003)(52314003)(199004)(189003)(2351001)(5250100002)(105586002)(106356001)(8990500004)(53936002)(2906002)(102836004)(7696005)(25786009)(6116002)(790700001)(6506007)(478600001)(14454004)(2501003)(10290500003)(6916009)(6436002)(5640700003)(55016002)(54896002)(6306002)(9686003)(5660300001)(2900100001)(68736007)(97736004)(5630700001)(99286004)(33656002)(10090500001)(476003)(86612001)(8936002)(186003)(256004)(46003)(316002)(22452003)(74316002)(7736002)(1730700003)(81166006)(81156014)(486006)(8676002)(86362001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB0725; H:DM5PR2101MB0805.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: v7+aPybVad14jc6SQwltKOvjC2Oq8yjaL84WU/uNSeYhKl4tOe4mUtuMvQClhaIumUk+f2QCeg27Q7wtLsIq8VYvL+w9s+U/fNA+1GQj+8H8r0yoO6RpNfs64UElNI9Hx/Hrc9ebqbjpf90aHUQlEo6sUdGo/fHsrsGDB2u93YYcLvSbxOi6t7Ct1AvKdPF02MlYeZCWQU4cUoocnhCkbMDwbUm24E7N0z2fwDjy0qB9nzIfgVpwtS1OiM1YJ3XfGeEyWGFqJIE2eExIluCX18M6JFeH5QRxM8Oh+Z/hcoD0ssABArFbnjR0EstWMXA7EM/+IklloIXeicxbfMEfzBf5DB3Ve+d6WAHvbdn5cXE= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2101MB0805ECC14568567445C261D5A35D0DM5PR2101MB0805_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 72338767-2fb7-4328-f06b-08d5eb27f1eb X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jul 2018 14:25:13.7504 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0725 Archived-At: Subject: [Teep] Implementation feedback on draft-ietf-teep-opentrustprotocol-01 X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Jul 2018 14:25:20 -0000 --_000_DM5PR2101MB0805ECC14568567445C261D5A35D0DM5PR2101MB0805_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable During the Hackathon yesterday, I started trying to write code for OTrP to see what issues I would run into. Below are some issues I ran into, in addition to what I already gave as feedback on the arch doc. 1) Section 6.5 explains that the TAM needs to receive a list of one or = more TA's that are requested to be installed (S6.5.1 point 1A). However, no message is defined for doing so, which prevents interoperability. I think this message needs to be generated by the TEE (not the rich app), for reasons I will explain in #3 below. 2) Section 6.5 explains that the TAM needs to keep track of TAs install= ed on all devices, even though its list might be wrong. This has a scalabili= ty issue. Instead, I think there should be no such requirement. 3) Putting my issue #1 and issue #2 together means there's an extra rou= nd trip that is unnecessary. 6.5 says the TAM receive a list of TAs needed, and then the TAM just goes back and asks what is installed, just to get a list of what needs to be installed. This is unnecessary, the TEE can jus= t send a list of one or more TAs that need to be installed and aren't already= . Hopefully this explains why I said in issue #1 above why I think the messag= e needs to be generated by the TEE. 4) Section 9.1.1 requires a list of OCSP stapling data, but as far as I= can see, the document provides no information or citation about the correct format for such data. 5) The "did" field in 9.2.1.1 seems to be either (a) redundant and shou= ld be removed, or (b) missing from other messages like Install TA. The text expl= ains the field is to check that the message was received by the right device. M= y opinion is that since the TEE has to trust the TAM anyway, it's the TAM's responsibility to send messages to the right device over an authenticated channel (whether encrypted or not). So I think it should be removed. 6) Some fields, e.g. "signerreq", have boolean values that are encoded = as strings ("true", "false"). I think these should be boolean types, not strin= gs, which would also have the advantage of better compression if we can use CBOR encoding. 7) Section 6.5.1 point 9.A implies that to install a TA, one must have = an extra round trip first to create an SD if one isn't already there. I would expec= t one common case to be where there is one TA per SD, so that all TAs are isolate= d from each other. As such, requiring the extra delay is inefficient in time= , bandwidth, and processing. All the fields in CreateSD are already present in an InstallTA message (except the "did" field mentioned above in issue #5= ), so it could be done automatically by the first InstallTA message itself. 8) The scope of uniqueness of the "rid" and "tid" fields is underspecif= ied. They just say "unique". I think "rid" is just supposed to be unique within a given {session,"tid"} but I can't tell for sure. And I think "tid" is ju= st supposed to be unique within a given session (not globally across all sessions, all = TAMs, all devices), but I can't tell. They're also formatted as strings, but I'= m not sure why they can't be integers which I think would be much more efficient. 9) I found it confusing that the names of the messages don't match the = name values in the messages themselves ("GetDeviceStateResponse" vs "GetDeviceTEEStateTBSResponse", etc.) Having these not match is bug-prone= . 10) It's unclear whether a rich app can depend on two TA's from different T= AMs, and whether a TA can depend on a TA from a different TAM. In the use case where the device admin runs the TAM and controls all TAs on their devices t= he answer would be no. But in other use cases I'm not sure. If so, then the= question arises about how dependencies are expressed and whether a dependency needs to express which TAM is used. This then begs the questions of whether a TA= might be via more than one TAM, or might change TAMs over time. The answers her= e probably belong in the arch doc. Dave --_000_DM5PR2101MB0805ECC14568567445C261D5A35D0DM5PR2101MB0805_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

During the Hackathon yesterday, I started trying to = write code for OTrP
to see what issues I would run into.   Below are some issues I ra= n into, in
addition to what I already gave as feedback on the arch doc.

 

1)     Section 6.5 explains that the TAM needs to receive = a list of one or more

TA’s that are requested to be installed= (S6.5.1 point 1A).  However, no

message is defined for doing so, which preven= ts interoperability.  I
think this message needs to be generated by the TEE (not the rich app),
for reasons I will explain in #3 below.

2)     Section 6.5 explains that the TAM needs to keep tra= ck of TAs installed
on all devices, even though its list might be wrong.   This has a= scalability
issue.  Instead, I think there should be no such requirement.

3)     Putting my issue #1 and issue #2 together means the= re’s an extra round

trip that is unnecessary.  6.5 says the = TAM receive a list of TAs needed,

and then the TAM just goes back and asks what= is installed, just to get
a list of what needs to be installed.  This is unnecessary, the TEE ca= n just

send a list of one or more TAs that need to b= e installed and aren’t already.

Hopefully this explains why I said in issue #= 1 above why I think the message
needs to be generated by the TEE.

4)     Section 9.1.1 requires a list of OCSP stapling data= , but as far as I can see,

the document provides no information or citat= ion about the correct format
for such data.

5)     The “did” field in 9.2.1.1 seems to be = either (a) redundant and should be

removed, or (b) missing from other messages l= ike Install TA.  The text explains
the field is to check that the message was received by the right device.&nb= sp; My
opinion is that since the TEE has to trust the TAM anyway, it’s the T= AM’s
responsibility to send messages to the right device over an authenticated channel (whether encrypted or not).  So I think it should be removed.<= o:p>

6)     Some fields, e.g. “signerreq”, have boo= lean values that are encoded as
strings (“true”, “false”). I think these should be = boolean types, not strings,
which would also have the advantage of better compression if we can use
CBOR encoding.

7)     Section 6.5.1 point 9.A implies that to install a T= A, one must have an extra
round trip first to create an SD if one isn’t already there.  I = would expect one
common case to be where there is one TA per SD, so that all TAs are isolate= d
from each other.  As such, requiring the extra delay is inefficient in= time,
bandwidth, and processing.   All the fields in CreateSD are alrea= dy present
in an InstallTA message (except the “did” field mentioned above= in issue #5),
so it could be done automatically by the first InstallTA message itself.

8)     The scope of uniqueness of the “rid” an= d “tid” fields is underspecified.

They just say “unique”.  I t= hink “rid” is just supposed to be unique within

a given {session,”tid”} but I can= ’t tell for sure.  And I think “tid” is just suppose= d
to be unique within a given session (not globally across all sessions, all = TAMs,

all devices), but I can’t tell. &n= bsp; They’re also formatted as strings, but I’m not sure
why they can’t be integers which I think would be much more efficient= .

9)     I found it confusing that the names of the m= essages don’t match the name values
in the messages themselves (“GetDeviceStateResponse” vs

“GetDeviceTEEStateTBSResponse”, e= tc.)   Having these not match is bug-prone.

10) It’s unclear whether a rich app can de= pend on two TA’s from different TAMs,

and whether a TA can depend on a TA from a di= fferent TAM.  In the use case

where the device admin runs the TAM and contr= ols all TAs on their devices the

answer would be no.  But in other use ca= ses I’m not sure.   If so, then the question
arises about how dependencies are expressed and whether a dependency needs<= br> to express which TAM is used.  This then begs the questions of whether= a TA might
be via more than one TAM, or might change TAMs over time.   The a= nswers here
probably belong in the arch doc.

 

Dave

--_000_DM5PR2101MB0805ECC14568567445C261D5A35D0DM5PR2101MB0805_-- From nobody Mon Jul 16 08:36:55 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE3701310C5 for ; Mon, 16 Jul 2018 08:36:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=intercedeltd.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sPZjQoR_O4_e for ; Mon, 16 Jul 2018 08:36:48 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0069.outbound.protection.outlook.com [104.47.2.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32E391310C2 for ; Mon, 16 Jul 2018 08:36:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=IntercedeLtd.onmicrosoft.com; s=selector1-intercede-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CLwWxSesQZwYVCrx4PPC6okcnb1biWFDaP2ovy6+Bhk=; b=aPze/bOcKBM1g9o42+8gbYx133EhL6FiKY5iR1vDE6C4Kyu2GQHkKQeVG0sWUQ2ZtoeR4xKhRcdv7SFo8tJ46nkqzy9RqFmC/xT9U7fQbJAyZ/gFgvfD+b5qQT+YluEEbRaG0ojcUbvFBtuYu2p4tqcbTuMVRp0s62b+EZwOoBY= Received: from HE1PR06MB3147.eurprd06.prod.outlook.com (10.171.198.20) by HE1PR06MB3161.eurprd06.prod.outlook.com (10.171.198.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.952.18; Mon, 16 Jul 2018 15:36:43 +0000 Received: from HE1PR06MB3147.eurprd06.prod.outlook.com ([fe80::ec16:1065:dc4f:2e80]) by HE1PR06MB3147.eurprd06.prod.outlook.com ([fe80::ec16:1065:dc4f:2e80%4]) with mapi id 15.20.0952.021; Mon, 16 Jul 2018 15:36:43 +0000 From: Andrew Atyeo To: Dave Thaler , "teep@ietf.org" Thread-Topic: Implementation feedback on draft-ietf-teep-opentrustprotocol-01 Thread-Index: AdQdELD0WeWS9FafTXOUTGNyvJ0BjgAAIDtQ Date: Mon, 16 Jul 2018 15:36:43 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrew.Atyeo@intercede.com; x-originating-ip: [62.172.117.190] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR06MB3161; 7:kW4OJH/e5H75IZN/G945P3mVKvPGl+rimH5tiKXtuQ58KVgtuR0iqqcO6P74fFVsptw3wu3FCFuMxq2jcao0uO4j/halANet2L9R9lynQv9jVpQ8ztkMb+IyH1Q5jWrEsAr4vKUTiZF47QHLoO7la0f8waF1bdNM+JSIE9Op/q0Raj+x7vnuW/Bz33t7MV1l1j5fxkBs+3qQj40umWfYnmiA9ITMGP4mZehQnRVlWwZmWCRo/cLqo1K1hnMijX+C x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: b5967e11-c1d9-4231-4b56-08d5eb31eead x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:HE1PR06MB3161; x-ms-traffictypediagnostic: HE1PR06MB3161: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(192374486261705)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(3002001)(3231311)(944501410)(52105095)(10201501046)(93006095)(93001095)(149027)(150027)(6041310)(20161123564045)(20161123558120)(20161123562045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011)(7699016); SRVR:HE1PR06MB3161; BCL:0; PCL:0; RULEID:; SRVR:HE1PR06MB3161; x-forefront-prvs: 073515755F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(396003)(136003)(366004)(39840400004)(52314003)(199004)(189003)(72206003)(7696005)(14444005)(14454004)(68736007)(229853002)(256004)(9686003)(97736004)(54896002)(6436002)(6306002)(186003)(66066001)(53546011)(76176011)(55016002)(102836004)(26005)(6506007)(478600001)(105586002)(106356001)(3846002)(99286004)(33656002)(446003)(5250100002)(110136005)(86362001)(6246003)(2906002)(2900100001)(74316002)(25786009)(316002)(5660300001)(2501003)(7736002)(8936002)(6116002)(81166006)(81156014)(53936002)(8676002)(486006)(236005)(790700001)(606006)(476003)(11346002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR06MB3161; H:HE1PR06MB3147.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: intercede.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: WKwYOOeSmniN/EwHiAVCZW/KLUlHRjAt6IZpKiKv/cteMuVXB2PPxrUoXrVBrLEyROnPEq8A5r5vMNmit7DK5S7ijuFUe5RmVUJ2mFDozUmA3msBcjgTVGz6sy55RFL7CbqTmtOU2BsjV+HFobaCqAcjHIYaKYm6D2MBQFRK+wfhbenbXYiIlFN4rBslDj2a96yup8CObh2XoLLs1TITk7X6nw2n8Mp8CPpEtApnc4udyFmwZ6NENWxJ9jXfzVViYItM9OejvB0GBj7OjDuJKdVDwlfFQbfNDbpoPzksEP6tOoX2tvZIyYO/glfiXiZ3IqZZ04B0kYExlsHVbozqH9djh7tlombVz7Keg2/L6D4= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_HE1PR06MB3147E1F7E2F989977A104773955D0HE1PR06MB3147eurp_" MIME-Version: 1.0 X-OriginatorOrg: intercede.com X-MS-Exchange-CrossTenant-Network-Message-Id: b5967e11-c1d9-4231-4b56-08d5eb31eead X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jul 2018 15:36:43.2740 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 1075719f-f133-43d2-8156-800f80fef316 X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR06MB3161 Archived-At: Subject: Re: [Teep] Implementation feedback on draft-ietf-teep-opentrustprotocol-01 X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Jul 2018 15:36:53 -0000 --_000_HE1PR06MB3147E1F7E2F989977A104773955D0HE1PR06MB3147eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U29tZSByZWFsbHkgZ29vZCBmZWVkYmFjayBmcm9tIERhdmUg4oCTIG15IHRob3VnaHRzIFtBQV0g aW4gdGhlIGVtYWlsIGJlbG93Lg0KDQpBbmRyZXcgQXR5ZW8NClNlY3VyaXR5IEFyY2hpdGVjdA0K SW50ZXJjZWRlDQpEaWdpdGFsIHRydXN0ICAgIHBlb3BsZSDHgCBkZXZpY2VzIMeAIGFwcHMNCk9m ZmljZTogKzQ0ICgwKSAxNDU1IDU1OCAxMTENCnd3dy5pbnRlcmNlZGUuY29tPGh0dHBzOi8vd3d3 LmludGVyY2VkZS5jb20vPg0KTGVnYWwgRGlzY2xhaW1lciA8aHR0cHM6Ly93d3cuaW50ZXJjZWRl LmNvbS9wcml2YWN5LWNvb2tpZXM+DQpGcm9tOiBURUVQIFttYWlsdG86dGVlcC1ib3VuY2VzQGll dGYub3JnXSBPbiBCZWhhbGYgT2YgRGF2ZSBUaGFsZXINClNlbnQ6IDE2IEp1bHkgMjAxOCAxNToy NQ0KVG86IHRlZXBAaWV0Zi5vcmcNClN1YmplY3Q6IFtUZWVwXSBJbXBsZW1lbnRhdGlvbiBmZWVk YmFjayBvbiBkcmFmdC1pZXRmLXRlZXAtb3BlbnRydXN0cHJvdG9jb2wtMDENCg0KRHVyaW5nIHRo ZSBIYWNrYXRob24geWVzdGVyZGF5LCBJIHN0YXJ0ZWQgdHJ5aW5nIHRvIHdyaXRlIGNvZGUgZm9y IE9UclANCnRvIHNlZSB3aGF0IGlzc3VlcyBJIHdvdWxkIHJ1biBpbnRvLiAgIEJlbG93IGFyZSBz b21lIGlzc3VlcyBJIHJhbiBpbnRvLCBpbg0KYWRkaXRpb24gdG8gd2hhdCBJIGFscmVhZHkgZ2F2 ZSBhcyBmZWVkYmFjayBvbiB0aGUgYXJjaCBkb2MuDQoNCg0KMSkgICAgICBTZWN0aW9uIDYuNSBl eHBsYWlucyB0aGF0IHRoZSBUQU0gbmVlZHMgdG8gcmVjZWl2ZSBhIGxpc3Qgb2Ygb25lIG9yIG1v cmUNCg0KVEHigJlzIHRoYXQgYXJlIHJlcXVlc3RlZCB0byBiZSBpbnN0YWxsZWQgKFM2LjUuMSBw b2ludCAxQSkuICBIb3dldmVyLCBubw0KDQptZXNzYWdlIGlzIGRlZmluZWQgZm9yIGRvaW5nIHNv LCB3aGljaCBwcmV2ZW50cyBpbnRlcm9wZXJhYmlsaXR5LiAgSQ0KdGhpbmsgdGhpcyBtZXNzYWdl IG5lZWRzIHRvIGJlIGdlbmVyYXRlZCBieSB0aGUgVEVFIChub3QgdGhlIHJpY2ggYXBwKSwNCmZv ciByZWFzb25zIEkgd2lsbCBleHBsYWluIGluICMzIGJlbG93Lg0KDQpbQUFdIEkgZG9u4oCZdCBz ZWUgdGhlIG5lZWQgZm9yIGEgbWVzc2FnZSBmb3IgZGVmaW5pbmcgdGhlIFRBcyB0aGF0IG5lZWQg dG8gYmUgaW5zdGFsbGVkLiBUaGUgT1RyUCBtZXNzYWdlcyBhcmUgYmV0d2VlbiB0aGUgVEFNIGFu ZCB0aGUgVEVFLCBidXQgdGhlIGRlc2lyZSB0byBpbnN0YWxsIFRBcyBjb21lcyBmcm9tIHRoZSBy aWNoIGFwcC4gSW4gcHJhY3RpY2UsIGEgcmljaCBhcHAgd2lsbCBoYXZlIHRoZSBpZGVudGlmaWVy cyBvZiB0aGUgVEFzIGl0IHJlcXVpcmVzIGJ1aWx0IGludG8gaXRzIG93biBjb2RlLCBzaW5jZSBp dHMgb3duIGNvZGUgd2lsbCBhbHNvIGJlIGNhbGxpbmcgdGhvc2UgVEFzIChlLmcuIG9uY2UgaW5z dGFsbGVkLCB0byBwZXJmb3JtIHNvbWUgRFJNIG9yIHBheW1lbnQgYXV0aGVudGljYXRpb24pLiBU aGVyZWZvcmUgYSByaWNoIGFwcCBpcyBhd2FyZSBvZiB0aGUgVEFzIGl0IG5lZWRzLg0KDQpJIGRv buKAmXQgdGhpbmsgdGhpcyBpbmZvIGNhbiBjb21lIGZyb20gdGhlIFRFRSDigJMgc2luY2UgYXQg dGhpcyBwb2ludCB0aGUgVEEgaXMgbm90IGluc3RhbGxlZCB5ZXQsIHNvIHdoaWNoIHBhcnQgb2Yg dGhlIFRFRSB3b3VsZCBoYXZlIHRoZSBrbm93bGVkZ2Ugb2Ygd2hpY2ggVEFzIGFyZSBuZWVkZWQ/ DQoNCg0KDQoyKSAgICAgIFNlY3Rpb24gNi41IGV4cGxhaW5zIHRoYXQgdGhlIFRBTSBuZWVkcyB0 byBrZWVwIHRyYWNrIG9mIFRBcyBpbnN0YWxsZWQNCm9uIGFsbCBkZXZpY2VzLCBldmVuIHRob3Vn aCBpdHMgbGlzdCBtaWdodCBiZSB3cm9uZy4gICBUaGlzIGhhcyBhIHNjYWxhYmlsaXR5DQppc3N1 ZS4gIEluc3RlYWQsIEkgdGhpbmsgdGhlcmUgc2hvdWxkIGJlIG5vIHN1Y2ggcmVxdWlyZW1lbnQu DQpbQUFdIHRoZSBkb2N1bWVudCBzaG91bGQgbm90IG1hbmRhdGUgdGhhdCBhIFRBTSBuZWVkcyB0 byBrZWVwIHRyYWNrIG9mIFRBcy4gKE1vc3Qgd291bGQsIGJ1dCB0aGlzIGlzIGEgaW1wbGVtZW50 YXRpb24gZGV0YWlsKS4NClRoZSB3aG9sZSBvZiBzZWN0aW9uIDYuNSBpcyBmb3IgYSDigJhzYW1w bGUgZmxvd+KAmSwgc28gSSBkb27igJl0IHRoaW5rIGl0IGlzIG1hbmRhdGluZyBhbnl0aGluZy4N Cg0KMykgICAgICBQdXR0aW5nIG15IGlzc3VlICMxIGFuZCBpc3N1ZSAjMiB0b2dldGhlciBtZWFu cyB0aGVyZeKAmXMgYW4gZXh0cmEgcm91bmQNCg0KdHJpcCB0aGF0IGlzIHVubmVjZXNzYXJ5LiAg Ni41IHNheXMgdGhlIFRBTSByZWNlaXZlIGEgbGlzdCBvZiBUQXMgbmVlZGVkLA0KDQphbmQgdGhl biB0aGUgVEFNIGp1c3QgZ29lcyBiYWNrIGFuZCBhc2tzIHdoYXQgaXMgaW5zdGFsbGVkLCBqdXN0 IHRvIGdldA0KYSBsaXN0IG9mIHdoYXQgbmVlZHMgdG8gYmUgaW5zdGFsbGVkLiAgVGhpcyBpcyB1 bm5lY2Vzc2FyeSwgdGhlIFRFRSBjYW4ganVzdA0KDQpzZW5kIGEgbGlzdCBvZiBvbmUgb3IgbW9y ZSBUQXMgdGhhdCBuZWVkIHRvIGJlIGluc3RhbGxlZCBhbmQgYXJlbuKAmXQgYWxyZWFkeS4NCg0K SG9wZWZ1bGx5IHRoaXMgZXhwbGFpbnMgd2h5IEkgc2FpZCBpbiBpc3N1ZSAjMSBhYm92ZSB3aHkg SSB0aGluayB0aGUgbWVzc2FnZQ0KbmVlZHMgdG8gYmUgZ2VuZXJhdGVkIGJ5IHRoZSBURUUuDQoN CltBQV0gYnV0IGhvdyBjb3VsZCB0aGUgVEVFICh3aGljaCBkb2VzbuKAmXQgaGF2ZSBpdHMgVEFz IGxvYWRlZCB5ZXQpIGtub3cgd2hhdCBUQXMgc2hvdWxkIGJlIGxvYWRlZD8NCg0KNCkgICAgICBT ZWN0aW9uIDkuMS4xIHJlcXVpcmVzIGEgbGlzdCBvZiBPQ1NQIHN0YXBsaW5nIGRhdGEsIGJ1dCBh cyBmYXIgYXMgSSBjYW4gc2VlLA0KDQp0aGUgZG9jdW1lbnQgcHJvdmlkZXMgbm8gaW5mb3JtYXRp b24gb3IgY2l0YXRpb24gYWJvdXQgdGhlIGNvcnJlY3QgZm9ybWF0DQpmb3Igc3VjaCBkYXRhLg0K DQpbQUFdIFRoaXMgaXMgYSBnb29kIHBvaW50IOKAkyB0aGlzIHNob3VsZCByZWZlciB0byByZmM2 OTYwDQoNCjUpICAgICAgVGhlIOKAnGRpZOKAnSBmaWVsZCBpbiA5LjIuMS4xIHNlZW1zIHRvIGJl IGVpdGhlciAoYSkgcmVkdW5kYW50IGFuZCBzaG91bGQgYmUNCg0KcmVtb3ZlZCwgb3IgKGIpIG1p c3NpbmcgZnJvbSBvdGhlciBtZXNzYWdlcyBsaWtlIEluc3RhbGwgVEEuICBUaGUgdGV4dCBleHBs YWlucw0KdGhlIGZpZWxkIGlzIHRvIGNoZWNrIHRoYXQgdGhlIG1lc3NhZ2Ugd2FzIHJlY2VpdmVk IGJ5IHRoZSByaWdodCBkZXZpY2UuICBNeQ0Kb3BpbmlvbiBpcyB0aGF0IHNpbmNlIHRoZSBURUUg aGFzIHRvIHRydXN0IHRoZSBUQU0gYW55d2F5LCBpdOKAmXMgdGhlIFRBTeKAmXMNCnJlc3BvbnNp YmlsaXR5IHRvIHNlbmQgbWVzc2FnZXMgdG8gdGhlIHJpZ2h0IGRldmljZSBvdmVyIGFuIGF1dGhl bnRpY2F0ZWQNCmNoYW5uZWwgKHdoZXRoZXIgZW5jcnlwdGVkIG9yIG5vdCkuICBTbyBJIHRoaW5r IGl0IHNob3VsZCBiZSByZW1vdmVkLg0KDQo2KSAgICAgIFNvbWUgZmllbGRzLCBlLmcuIOKAnHNp Z25lcnJlceKAnSwgaGF2ZSBib29sZWFuIHZhbHVlcyB0aGF0IGFyZSBlbmNvZGVkIGFzDQpzdHJp bmdzICjigJx0cnVl4oCdLCDigJxmYWxzZeKAnSkuIEkgdGhpbmsgdGhlc2Ugc2hvdWxkIGJlIGJv b2xlYW4gdHlwZXMsIG5vdCBzdHJpbmdzLA0Kd2hpY2ggd291bGQgYWxzbyBoYXZlIHRoZSBhZHZh bnRhZ2Ugb2YgYmV0dGVyIGNvbXByZXNzaW9uIGlmIHdlIGNhbiB1c2UNCkNCT1IgZW5jb2Rpbmcu DQpbQUFdIEkgYWdyZWUuIEF0IG9uZSBwb2ludCB3ZSBoYWQgYSBidWcgb3BlbiB0byBhZGRyZXNz IHRoaXMsIGJ1dCBJIHRoaW5rIHRoZXJlIGFyZSBzb21lIGNhc2VzIHRoYXQgYXJlIG5vdCBhZGRy ZXNzZWQuIEZvciBleGFtcGxlIDkuMS41IHNob3dzIHNpZ25lcnJlcSBhcyBhIGpzb24gQm9vbGVh biAodHJ1ZSksIGJ1dCB0aGVuIHRoZSBleGFtcGxlIEdldERldmljZVRFRVN0YXRlUmVzcG9uc2Ug b24gcGFnZSAzNiwgYW5kIG90aGVyIHBsYWNlcyBzaG93cyBzaWduZXJyZXEgYXMgYSBzdHJpbmcg KOKAnHRydWXigJ0pLg0KVGhlcmUgbmVlZHMgdG8gYmUgYW4gY2xlYW51cCwgc2VhcmNoaW5nIG9u IHRydWUgYW5kIGZhbHNlLCB0byBpZGVudGlmeSBhbnkgbWlzc2VkIGNhc2VzIHdoZXJlIEJvb2xl YW5zIGFyZSBzdGlsbCByZXByZXNlbnRlZCBhcyBzdHJpbmdzLg0KDQo3KSAgICAgIFNlY3Rpb24g Ni41LjEgcG9pbnQgOS5BIGltcGxpZXMgdGhhdCB0byBpbnN0YWxsIGEgVEEsIG9uZSBtdXN0IGhh dmUgYW4gZXh0cmENCnJvdW5kIHRyaXAgZmlyc3QgdG8gY3JlYXRlIGFuIFNEIGlmIG9uZSBpc27i gJl0IGFscmVhZHkgdGhlcmUuICBJIHdvdWxkIGV4cGVjdCBvbmUNCmNvbW1vbiBjYXNlIHRvIGJl IHdoZXJlIHRoZXJlIGlzIG9uZSBUQSBwZXIgU0QsIHNvIHRoYXQgYWxsIFRBcyBhcmUgaXNvbGF0 ZWQNCmZyb20gZWFjaCBvdGhlci4gIEFzIHN1Y2gsIHJlcXVpcmluZyB0aGUgZXh0cmEgZGVsYXkg aXMgaW5lZmZpY2llbnQgaW4gdGltZSwNCmJhbmR3aWR0aCwgYW5kIHByb2Nlc3NpbmcuICAgQWxs IHRoZSBmaWVsZHMgaW4gQ3JlYXRlU0QgYXJlIGFscmVhZHkgcHJlc2VudA0KaW4gYW4gSW5zdGFs bFRBIG1lc3NhZ2UgKGV4Y2VwdCB0aGUg4oCcZGlk4oCdIGZpZWxkIG1lbnRpb25lZCBhYm92ZSBp biBpc3N1ZSAjNSksDQpzbyBpdCBjb3VsZCBiZSBkb25lIGF1dG9tYXRpY2FsbHkgYnkgdGhlIGZp cnN0IEluc3RhbGxUQSBtZXNzYWdlIGl0c2VsZi4NCltBQV0gd2hlbiB0aGUgU0QgaXMgY3JlYXRl ZCwgYW4gYXN5bW1ldHJpYyBrZXlwYWlyIGlzIGdlbmVyYXRlZCAoc3BhaWspLCBhbmQgdGhlIHB1 YmxpYyBwYXJ0IG9mIHRoaXMgaXMgcmV0dXJuZWQuIFdoZW4gYSBUQSBpcyBpbnN0YWxsZWQsIGl0 IGlzIGVuY3J5cHRlZCB3aXRoIHRoaXMga2V5LiBUaGlzIGVuYWJsZXMgc29tZSB1c2UgY2FzZXMg d2hlcmUgYSBUQU0gY291bGQgaW50ZXJmYWNlIHRvIGEgU1AgYW5kIGVuYWJsZSBhbiBTUCB0byBw cm92aWRlIHRoZSBUQSBlbmNyeXB0ZWQgc3VjaCB0aGF0IHRoZSBUQSBiaW5hcnkgaXMgbm90IGtu b3duIGJ5IHRoZSBUQU0uDQpUaGUgc3BhaWsgaXMgYWxzbyB1c2VkIHRvIGVuY3J5cHQgdGhlIHBl cnNvbmFsaXphdGlvbiBkYXRhICh0aGF0IGlzIGFsc28gc2VudCBpbiBJbnN0YWxsVEEpLCBhbmQg dGhlcmUgaXMgYWxzbyBhIHVzZSBjYXNlIGZvciBhIFRBTSBpbnRlcmZhY2luZyB0byBhbiBTUCBp biBvcmRlciB0aGF0IHRoZSBTUCBlbmNyeXB0cyBwZXJzbyBkYXRhIGZvciB0aGF0IFRFRSBzdWNo IHRoYXQgaXQgdHJhdmVscyB2aWEgdGhlIFRBTSB0byB0aGUgVEVFLCBidXQgd2l0aG91dCB0aGUg VEFNIGhhdmluZyBhY2Nlc3MgdG8gdGhhdCBkYXRhDQpTaW5jZSBJbnN0YWxsVEEgcmVxdWlyZXMg a25vd2xlZGdlIG9mIHRoZSBwdWJsaWMga2V5IHJldHVybmVkIGZyb20gQ3JlYXRlU0QsIGl0IGlz IHRydWUgdGhhdCB0aGUgZXh0cmEgcm91bmQgdHJpcCBpcyByZXF1aXJlZC4NClNvIHRoZSBxdWVz dGlvbiBpcyB3aGV0aGVyIHRoZXJlIGlzIGEgY2FzZSBmb3IgaW5zdGFsbGluZyBUQSAoYW5kIHRo ZWlyIGFjY29tcGFueWluZyBwZXJzbyBkYXRhKSB3aXRob3V0IHRoZSBhYmlsaXR5IHRvIHByb3Zp ZGUgY29uZmlkZW50aWFsaXR5IGJldHdlZW4gYW4gU1AgYW5kIHRoZSBURUUgYnkgbWFraW5nIHRo YXQgbGF5ZXIgb2YgZW5jcnlwdGlvbiBvcHRpb25hbCwgYW5kIGJ5IGFsbG93aW5nIHRoZSBUQSAo YW5kIHBlcnNvIGRhdGE/KSB0byBiZSBidW5kbGVkIGludG8gQ3JlYXRlU0QNCg0KDQo4KSAgICAg IFRoZSBzY29wZSBvZiB1bmlxdWVuZXNzIG9mIHRoZSDigJxyaWTigJ0gYW5kIOKAnHRpZOKAnSBm aWVsZHMgaXMgdW5kZXJzcGVjaWZpZWQuDQoNClRoZXkganVzdCBzYXkg4oCcdW5pcXVl4oCdLiAg SSB0aGluayDigJxyaWTigJ0gaXMganVzdCBzdXBwb3NlZCB0byBiZSB1bmlxdWUgd2l0aGluDQoN CmEgZ2l2ZW4ge3Nlc3Npb24s4oCddGlk4oCdfSBidXQgSSBjYW7igJl0IHRlbGwgZm9yIHN1cmUu ICBBbmQgSSB0aGluayDigJx0aWTigJ0gaXMganVzdCBzdXBwb3NlZA0KdG8gYmUgdW5pcXVlIHdp dGhpbiBhIGdpdmVuIHNlc3Npb24gKG5vdCBnbG9iYWxseSBhY3Jvc3MgYWxsIHNlc3Npb25zLCBh bGwgVEFNcywNCg0KYWxsIGRldmljZXMpLCBidXQgSSBjYW7igJl0IHRlbGwuICAgVGhleeKAmXJl IGFsc28gZm9ybWF0dGVkIGFzIHN0cmluZ3MsIGJ1dCBJ4oCZbSBub3Qgc3VyZQ0Kd2h5IHRoZXkg Y2Fu4oCZdCBiZSBpbnRlZ2VycyB3aGljaCBJIHRoaW5rIHdvdWxkIGJlIG11Y2ggbW9yZSBlZmZp Y2llbnQuLg0KDQpbQUFdIGFsdGhvdWdoIGl0IGlzIG5vdCBtYW5kYXRlZCwgcmFuZG9tIGd1aWRz IGNhbiBiZSBhIHZpYWJsZSBpbXBsZW1lbnRhdGlvbiBjaG9pY2UgZm9yIHRoZXNlIChhcyBpdCB0 YWtlcyBhd2F5IHRoZSByZXF1aXJlbWVudCB0byBtYW5hZ2UgaW5jcmVtZW50YWwgY291bnRlcnMp IOKAkyBzbyBJIHdvdWxkIG5vdCB3YW50IHRvIHNlZSB0aGVzZSBiZWNvbWUgaW50ZWdlcnMuIEJ5 IG1ha2luZyB0aGVtIHN0cmluZ3MsIGEgVEFNIGNhbiBjaG9vc2UgdGhlIG1lY2hhbmlzbSBpdCB3 YW50cy4NCg0KSSB0YWtlIHlvdXIgcG9pbnQgYWJvdXQg4oCccmlk4oCdIGFuZCDigJx0aWTigJ0g YmVpbmcgdW5kZXJzcGVjaWZpZWQuIFRoZSB0cnV0aCBpcyB0aGF0IHZhbHVlcyBjb250YWluZWQg aW4gdGhlc2UgZmllbGRzIGRvbuKAmXQgbWF0dGVyIHRvIHRoZSBwcm90b2NvbCBtdWNoLiAodGhl eSBhcmUgbW9zdGx5IGZvciB0aGUgY29udmVuaWVuY2Ugb2YgdGhlIFRBTSBpbiBvcmRlciB0byBt YXRjaCB1cCByZXF1ZXN0IGFuZCByZXNwb25zZSBtZXNzYWdlcyAocmlkKSwgYW5kICh0aWQpIHRv IHVuZGVyc3RhbmQgd2hpY2ggbWVzc2FnZXMgYmVsb25nIGluIGEg4oCYY29udmVyc2F0aW9u4oCZ KQ0KDQo5KSAgICAgIEkgZm91bmQgaXQgY29uZnVzaW5nIHRoYXQgdGhlIG5hbWVzIG9mIHRoZSBt ZXNzYWdlcyBkb27igJl0IG1hdGNoIHRoZSBuYW1lIHZhbHVlcw0KaW4gdGhlIG1lc3NhZ2VzIHRo ZW1zZWx2ZXMgKOKAnEdldERldmljZVN0YXRlUmVzcG9uc2XigJ0gdnMNCg0K4oCcR2V0RGV2aWNl VEVFU3RhdGVUQlNSZXNwb25zZeKAnSwgZXRjLikgICBIYXZpbmcgdGhlc2Ugbm90IG1hdGNoIGlz IGJ1Zy1wcm9uZS4NCg0KW0FBXSBJIGFncmVlLiBJbnN0ZWFkIG9mIGhhdmluZyBhIG1peHR1cmUg b2YgR2V0RGV2aWNlU3RhdGVYWFggYW5kIEdldERldmljZVRFRVN0YXRlWFhYIHRoZXkgc2hvdWxk IGFsbCBzdGFuZGFyZGl6ZSBvbiBHZXREZXZpY2VURUVTdGF0ZVhYWC4NCg0KTm9kZSB0aGF0IHRo ZXJlIGFyZSBpbnRlbnRpb25hbCBkaWZmZXJlbmNlcyBhdCB0aGUgZW5kIG9mIHRob3NlIHdvcmRz IChlLmcuIEdldERldmljZVRFRVN0YXRlVEJTUmVzcG9uc2UgdnMgR2V0RGV2aWNlVEVFU3RhdGVS ZXNwb25zZSBpcyBpbnRlbnRpb25hbCBhcyBvbmUgb2YgdGhlc2UgaXMgdGhlIOKAmHRvIGJlIHNp Z25lZOKAmSBkYXRhIGFuZCB0aGUgb3RoZXIgaXMgdGhlIHNpZ25lZCBkYXRhLg0KDQoxMCkgIEl0 4oCZcyB1bmNsZWFyIHdoZXRoZXIgYSByaWNoIGFwcCBjYW4gZGVwZW5kIG9uIHR3byBUQeKAmXMg ZnJvbSBkaWZmZXJlbnQgVEFNcywNCg0KYW5kIHdoZXRoZXIgYSBUQSBjYW4gZGVwZW5kIG9uIGEg VEEgZnJvbSBhIGRpZmZlcmVudCBUQU0uICBJbiB0aGUgdXNlIGNhc2UNCg0Kd2hlcmUgdGhlIGRl dmljZSBhZG1pbiBydW5zIHRoZSBUQU0gYW5kIGNvbnRyb2xzIGFsbCBUQXMgb24gdGhlaXIgZGV2 aWNlcyB0aGUNCg0KYW5zd2VyIHdvdWxkIGJlIG5vLiAgQnV0IGluIG90aGVyIHVzZSBjYXNlcyBJ 4oCZbSBub3Qgc3VyZS4gICBJZiBzbywgdGhlbiB0aGUgcXVlc3Rpb24NCmFyaXNlcyBhYm91dCBo b3cgZGVwZW5kZW5jaWVzIGFyZSBleHByZXNzZWQgYW5kIHdoZXRoZXIgYSBkZXBlbmRlbmN5IG5l ZWRzDQp0byBleHByZXNzIHdoaWNoIFRBTSBpcyB1c2VkLiAgVGhpcyB0aGVuIGJlZ3MgdGhlIHF1 ZXN0aW9ucyBvZiB3aGV0aGVyIGEgVEEgbWlnaHQNCmJlIHZpYSBtb3JlIHRoYW4gb25lIFRBTSwg b3IgbWlnaHQgY2hhbmdlIFRBTXMgb3ZlciB0aW1lLiAgIFRoZSBhbnN3ZXJzIGhlcmUNCnByb2Jh Ymx5IGJlbG9uZyBpbiB0aGUgYXJjaCBkb2MuDQpbQUFdIFRBIGludGVyLWRlcGVuZGVuY3kgaXMg Y29tcGxldGVseSBvdXQgb2YgdGhlIHNjb3BlIG9mIHRoZSBPVHJQIHByb3RvY29sLiAoc28gdGhl IHJpY2ggYXBwIHZlbmRvciBuZWVkcyB0byBrbm93IGFsbCB0aGUgVEEgSURzIHRoZXkgbmVlZCBp bnN0YWxsaW5nLCBhbmQgd2hpY2ggVEFNKHMpIHRvIGdldCB0aGVtIGZyb20pLg0KDQpEYXZlDQo= --_000_HE1PR06MB3147E1F7E2F989977A104773955D0HE1PR06MB3147eurp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBo LCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUt cHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowY207DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltYXJn aW4tYm90dG9tOjBjbTsNCgltYXJnaW4tbGVmdDozNi4wcHQ7DQoJbWFyZ2luLWJvdHRvbTouMDAw MXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28t c3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2lu LXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDow Y207DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixz ZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNw YW4uRW1haWxTdHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0No cERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBw dDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2lu OjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1s aXN0LWlkOjkyMzM0NTYwMzsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1w bGF0ZS1pZHM6LTEyNzY4NDgwNDAgNjc2OTg3MDUgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMg Njc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTU7fQ0KQGxpc3QgbDA6 bGV2ZWwxDQoJe21zby1sZXZlbC10ZXh0OiIlMVwpIjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBw dDt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93 ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0 O30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBs MDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGww OmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0x OC4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFu LWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCm9sDQoJe21hcmdpbi1ib3R0b206 MGNtO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGNtO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUg bXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2 IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4N CjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9 IkVOLUdCIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+DQo8ZGl2IGNsYXNzPSJXb3Jk U2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0 LWxhbmd1YWdlOkVOLVVTIj5Tb21lIHJlYWxseSBnb29kIGZlZWRiYWNrIGZyb20gRGF2ZSDigJMg bXkgdGhvdWdodHMgW0FBXSBpbiB0aGUgZW1haWwgYmVsb3cuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzEzMUI0RCI+ QW5kcmV3IEF0eWVvPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtjb2xv cjojMTMxQjREIj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZh bWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPjxicj4NCjwvc3Bhbj48Yj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojMTMxQjREIj5TZWN1cml0eSBBcmNo aXRlY3Q8bzpwPjwvbzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojMTMxQjREIj5JbnRlcmNlZGU8 L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+PGJyPg0KPC9zcGFuPjxiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiNGMzhBMDAiPkRpZ2l0YWwgdHJ1c3Q8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5l dyBSb21hbiZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiMxMzFCNEQiPnBlb3BsZSDHgCBkZXZpY2Vz IMeAIGFwcHM8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Nv bG9yOiMxMzFCNEQiPk9mZmljZTogJiM0Mzs0NCAoMCkgMTQ1NSA1NTggMTExPC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21h biZxdW90OyxzZXJpZiI+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaW50ZXJjZWRlLmNvbS8i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojRjM4QTAwIj53d3cuaW50ZXJjZWRlLmNvbTwvc3Bhbj48 L2E+DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5l dyBSb21hbiZxdW90OyxzZXJpZiI+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaW50ZXJjZWRlLmNvbS9w cml2YWN5LWNvb2tpZXMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiNGMzhBMDAiPkxlZ2FsIERpc2Ns YWltZXI8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiNGMzhBMDAiPg0KPC9zcGFuPjwvYT48L3Nw YW4+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xp ZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiPkZyb206PC9zcGFuPjwvYj48c3BhbiBsYW5n PSJFTi1VUyI+IFRFRVAgW21haWx0bzp0ZWVwLWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhh bGYgT2YgPC9iPkRhdmUgVGhhbGVyPGJyPg0KPGI+U2VudDo8L2I+IDE2IEp1bHkgMjAxOCAxNToy NTxicj4NCjxiPlRvOjwvYj4gdGVlcEBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBbVGVl cF0gSW1wbGVtZW50YXRpb24gZmVlZGJhY2sgb24gZHJhZnQtaWV0Zi10ZWVwLW9wZW50cnVzdHBy b3RvY29sLTAxPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tVVMiPkR1cmluZyB0aGUgSGFja2F0aG9uIHllc3RlcmRheSwgSSBzdGFy dGVkIHRyeWluZyB0byB3cml0ZSBjb2RlIGZvciBPVHJQPGJyPg0KdG8gc2VlIHdoYXQgaXNzdWVz IEkgd291bGQgcnVuIGludG8uJm5ic3A7Jm5ic3A7IEJlbG93IGFyZSBzb21lIGlzc3VlcyBJIHJh biBpbnRvLCBpbiA8YnI+DQphZGRpdGlvbiB0byB3aGF0IEkgYWxyZWFkeSBnYXZlIGFzIGZlZWRi YWNrIG9uIHRoZSBhcmNoIGRvYy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotMTguMHB0O21z by1saXN0OmwwIGxldmVsMSBsZm8yIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBsYW5nPSJF Ti1VUyI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+MSk8c3BhbiBzdHlsZT0iZm9udDo3 LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIGxhbmc9IkVOLVVT Ij5TZWN0aW9uIDYuNSBleHBsYWlucyB0aGF0IHRoZSBUQU0gbmVlZHMgdG8gcmVjZWl2ZSBhIGxp c3Qgb2Ygb25lIG9yIG1vcmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlz dFBhcmFncmFwaCI+PHNwYW4gbGFuZz0iRU4tVVMiPlRB4oCZcyB0aGF0IGFyZSByZXF1ZXN0ZWQg dG8gYmUgaW5zdGFsbGVkIChTNi41LjEgcG9pbnQgMUEpLiZuYnNwOyBIb3dldmVyLCBubzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIj48c3BhbiBsYW5n PSJFTi1VUyI+bWVzc2FnZSBpcyBkZWZpbmVkIGZvciBkb2luZyBzbywgd2hpY2ggcHJldmVudHMg aW50ZXJvcGVyYWJpbGl0eS4mbmJzcDsgSTxicj4NCnRoaW5rIHRoaXMgbWVzc2FnZSBuZWVkcyB0 byBiZSBnZW5lcmF0ZWQgYnkgdGhlIFRFRSAobm90IHRoZSByaWNoIGFwcCksPGJyPg0KZm9yIHJl YXNvbnMgSSB3aWxsIGV4cGxhaW4gaW4gIzMgYmVsb3cuPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowY20iPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+W0FBXSBJIGRvbuKAmXQgc2VlIHRo ZSBuZWVkIGZvciBhIG1lc3NhZ2UgZm9yIGRlZmluaW5nIHRoZSBUQXMgdGhhdCBuZWVkIHRvIGJl IGluc3RhbGxlZC4gVGhlIE9UclAgbWVzc2FnZXMgYXJlIGJldHdlZW4gdGhlIFRBTSBhbmQgdGhl IFRFRSwgYnV0IHRoZSBkZXNpcmUgdG8gaW5zdGFsbA0KIFRBcyBjb21lcyBmcm9tIHRoZSByaWNo IGFwcC4gSW4gcHJhY3RpY2UsIGEgcmljaCBhcHAgd2lsbCBoYXZlIHRoZSBpZGVudGlmaWVycyBv ZiB0aGUgVEFzIGl0IHJlcXVpcmVzIGJ1aWx0IGludG8gaXRzIG93biBjb2RlLCBzaW5jZSBpdHMg b3duIGNvZGUgd2lsbCBhbHNvIGJlIGNhbGxpbmcgdGhvc2UgVEFzIChlLmcuIG9uY2UgaW5zdGFs bGVkLCB0byBwZXJmb3JtIHNvbWUgRFJNIG9yIHBheW1lbnQgYXV0aGVudGljYXRpb24pLiBUaGVy ZWZvcmUNCiBhIHJpY2ggYXBwIGlzIGF3YXJlIG9mIHRoZSBUQXMgaXQgbmVlZHMuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4t bGVmdDowY20iPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+SSBkb27i gJl0IHRoaW5rIHRoaXMgaW5mbyBjYW4gY29tZSBmcm9tIHRoZSBURUUg4oCTIHNpbmNlIGF0IHRo aXMgcG9pbnQgdGhlIFRBIGlzIG5vdCBpbnN0YWxsZWQgeWV0LCBzbyB3aGljaCBwYXJ0IG9mIHRo ZSBURUUgd291bGQgaGF2ZSB0aGUga25vd2xlZGdlIG9mIHdoaWNoIFRBcyBhcmUNCiBuZWVkZWQ/ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxl PSJtYXJnaW4tbGVmdDowY20iPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50 Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxz cGFuIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj4yKTxzcGFuIHN0 eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4g bGFuZz0iRU4tVVMiPlNlY3Rpb24gNi41IGV4cGxhaW5zIHRoYXQgdGhlIFRBTSBuZWVkcyB0byBr ZWVwIHRyYWNrIG9mIFRBcyBpbnN0YWxsZWQ8YnI+DQpvbiBhbGwgZGV2aWNlcywgZXZlbiB0aG91 Z2ggaXRzIGxpc3QgbWlnaHQgYmUgd3JvbmcuJm5ic3A7Jm5ic3A7IFRoaXMgaGFzIGEgc2NhbGFi aWxpdHk8YnI+DQppc3N1ZS4mbmJzcDsgSW5zdGVhZCwgSSB0aGluayB0aGVyZSBzaG91bGQgYmUg bm8gc3VjaCByZXF1aXJlbWVudC4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj5bQUFdIHRo ZSBkb2N1bWVudCBzaG91bGQgbm90IG1hbmRhdGUgdGhhdCBhIFRBTSBuZWVkcyB0byBrZWVwIHRy YWNrIG9mIFRBcy4gKE1vc3Qgd291bGQsIGJ1dCB0aGlzIGlzIGEgaW1wbGVtZW50YXRpb24gZGV0 YWlsKS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+VGhlIHdob2xlIG9mIHNlY3Rpb24g Ni41IGlzIGZvciBhIOKAmHNhbXBsZSBmbG934oCZLCBzbyBJIGRvbuKAmXQgdGhpbmsgaXQgaXMg bWFuZGF0aW5nIGFueXRoaW5nLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMCBsZXZl bDEgbGZvMiI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gbGFuZz0iRU4tVVMiPjxzcGFuIHN0 eWxlPSJtc28tbGlzdDpJZ25vcmUiPjMpPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGlt ZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBsYW5nPSJFTi1VUyI+UHV0dGluZyBteSBp c3N1ZSAjMSBhbmQgaXNzdWUgIzIgdG9nZXRoZXIgbWVhbnMgdGhlcmXigJlzIGFuIGV4dHJhIHJv dW5kPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiPjxz cGFuIGxhbmc9IkVOLVVTIj50cmlwIHRoYXQgaXMgdW5uZWNlc3NhcnkuJm5ic3A7IDYuNSBzYXlz IHRoZSBUQU0gcmVjZWl2ZSBhIGxpc3Qgb2YgVEFzIG5lZWRlZCw8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PHNwYW4gbGFuZz0iRU4tVVMiPmFuZCB0 aGVuIHRoZSBUQU0ganVzdCBnb2VzIGJhY2sgYW5kIGFza3Mgd2hhdCBpcyBpbnN0YWxsZWQsIGp1 c3QgdG8gZ2V0PGJyPg0KYSBsaXN0IG9mIHdoYXQgbmVlZHMgdG8gYmUgaW5zdGFsbGVkLiZuYnNw OyBUaGlzIGlzIHVubmVjZXNzYXJ5LCB0aGUgVEVFIGNhbiBqdXN0PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiPjxzcGFuIGxhbmc9IkVOLVVTIj5zZW5k IGEgbGlzdCBvZiBvbmUgb3IgbW9yZSBUQXMgdGhhdCBuZWVkIHRvIGJlIGluc3RhbGxlZCBhbmQg YXJlbuKAmXQgYWxyZWFkeS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlz dFBhcmFncmFwaCI+PHNwYW4gbGFuZz0iRU4tVVMiPkhvcGVmdWxseSB0aGlzIGV4cGxhaW5zIHdo eSBJIHNhaWQgaW4gaXNzdWUgIzEgYWJvdmUgd2h5IEkgdGhpbmsgdGhlIG1lc3NhZ2U8YnI+DQpu ZWVkcyB0byBiZSBnZW5lcmF0ZWQgYnkgdGhlIFRFRS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBjbSI+PHNwYW4g bGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj5bQUFdIGJ1dCBob3cgY291bGQgdGhl IFRFRSAod2hpY2ggZG9lc27igJl0IGhhdmUgaXRzIFRBcyBsb2FkZWQgeWV0KSBrbm93IHdoYXQg VEFzIHNob3VsZCBiZSBsb2FkZWQ/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotMTguMHB0O21zby1saXN0OmwwIGxl dmVsMSBsZm8yIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBsYW5nPSJFTi1VUyI+PHNwYW4g c3R5bGU9Im1zby1saXN0Oklnbm9yZSI+NCk8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9z cGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIGxhbmc9IkVOLVVTIj5TZWN0aW9uIDku MS4xIHJlcXVpcmVzIGEgbGlzdCBvZiBPQ1NQIHN0YXBsaW5nIGRhdGEsIGJ1dCBhcyBmYXIgYXMg SSBjYW4gc2VlLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIj48c3BhbiBsYW5nPSJFTi1VUyI+dGhlIGRvY3VtZW50IHByb3ZpZGVzIG5vIGluZm9ybWF0 aW9uIG9yIGNpdGF0aW9uIGFib3V0IHRoZSBjb3JyZWN0IGZvcm1hdDxicj4NCmZvciBzdWNoIGRh dGEuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJtYXJnaW4tbGVmdDowY20iPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAw NzBDMCI+W0FBXSBUaGlzIGlzIGEgZ29vZCBwb2ludCDigJMgdGhpcyBzaG91bGQgcmVmZXIgdG8g cmZjNjk2MDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBo IiBzdHlsZT0idGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMiI+PCFb aWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28tbGlz dDpJZ25vcmUiPjUpPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFu JnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwhW2VuZGlmXT48c3BhbiBsYW5nPSJFTi1VUyI+VGhlIOKAnGRpZOKAnSBmaWVsZCBpbiA5 LjIuMS4xIHNlZW1zIHRvIGJlIGVpdGhlciAoYSkgcmVkdW5kYW50IGFuZCBzaG91bGQgYmU8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PHNwYW4gbGFu Zz0iRU4tVVMiPnJlbW92ZWQsIG9yIChiKSBtaXNzaW5nIGZyb20gb3RoZXIgbWVzc2FnZXMgbGlr ZSBJbnN0YWxsIFRBLiZuYnNwOyBUaGUgdGV4dCBleHBsYWluczxicj4NCnRoZSBmaWVsZCBpcyB0 byBjaGVjayB0aGF0IHRoZSBtZXNzYWdlIHdhcyByZWNlaXZlZCBieSB0aGUgcmlnaHQgZGV2aWNl LiZuYnNwOyBNeTxicj4NCm9waW5pb24gaXMgdGhhdCBzaW5jZSB0aGUgVEVFIGhhcyB0byB0cnVz dCB0aGUgVEFNIGFueXdheSwgaXTigJlzIHRoZSBUQU3igJlzPGJyPg0KcmVzcG9uc2liaWxpdHkg dG8gc2VuZCBtZXNzYWdlcyB0byB0aGUgcmlnaHQgZGV2aWNlIG92ZXIgYW4gYXV0aGVudGljYXRl ZDxicj4NCmNoYW5uZWwgKHdoZXRoZXIgZW5jcnlwdGVkIG9yIG5vdCkuJm5ic3A7IFNvIEkgdGhp bmsgaXQgc2hvdWxkIGJlIHJlbW92ZWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotMTguMHB0O21zby1saXN0Omww IGxldmVsMSBsZm8yIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBsYW5nPSJFTi1VUyI+PHNw YW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+Nik8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVv dDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0K PC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIGxhbmc9IkVOLVVTIj5Tb21lIGZp ZWxkcywgZS5nLiDigJxzaWduZXJyZXHigJ0sIGhhdmUgYm9vbGVhbiB2YWx1ZXMgdGhhdCBhcmUg ZW5jb2RlZCBhczxicj4NCnN0cmluZ3MgKOKAnHRydWXigJ0sIOKAnGZhbHNl4oCdKS4gSSB0aGlu ayB0aGVzZSBzaG91bGQgYmUgYm9vbGVhbiB0eXBlcywgbm90IHN0cmluZ3MsPGJyPg0Kd2hpY2gg d291bGQgYWxzbyBoYXZlIHRoZSBhZHZhbnRhZ2Ugb2YgYmV0dGVyIGNvbXByZXNzaW9uIGlmIHdl IGNhbiB1c2U8YnI+DQpDQk9SIGVuY29kaW5nLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+ W0FBXSBJIGFncmVlLiBBdCBvbmUgcG9pbnQgd2UgaGFkIGEgYnVnIG9wZW4gdG8gYWRkcmVzcyB0 aGlzLCBidXQgSSB0aGluayB0aGVyZSBhcmUgc29tZSBjYXNlcyB0aGF0IGFyZSBub3QgYWRkcmVz c2VkLiBGb3IgZXhhbXBsZSA5LjEuNSBzaG93cyBzaWduZXJyZXEgYXMgYSBqc29uIEJvb2xlYW4g KHRydWUpLCBidXQgdGhlbiB0aGUgZXhhbXBsZQ0KIEdldERldmljZVRFRVN0YXRlUmVzcG9uc2Ug b24gcGFnZSAzNiwgYW5kIG90aGVyIHBsYWNlcyBzaG93cyBzaWduZXJyZXEgYXMgYSBzdHJpbmcg KOKAnHRydWXigJ0pLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+VGhlcmUgbmVlZHMgdG8g YmUgYW4gY2xlYW51cCwgc2VhcmNoaW5nIG9uDQo8aT50cnVlPC9pPiBhbmQgPGk+ZmFsc2U8L2k+ LCB0byBpZGVudGlmeSBhbnkgbWlzc2VkIGNhc2VzIHdoZXJlIEJvb2xlYW5zIGFyZSBzdGlsbCBy ZXByZXNlbnRlZCBhcyBzdHJpbmdzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMCBs ZXZlbDEgbGZvMiI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gbGFuZz0iRU4tVVMiPjxzcGFu IHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjcpPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7 VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBsYW5nPSJFTi1VUyI+U2VjdGlvbiA2 LjUuMSBwb2ludCA5LkEgaW1wbGllcyB0aGF0IHRvIGluc3RhbGwgYSBUQSwgb25lIG11c3QgaGF2 ZSBhbiBleHRyYTxicj4NCnJvdW5kIHRyaXAgZmlyc3QgdG8gY3JlYXRlIGFuIFNEIGlmIG9uZSBp c27igJl0IGFscmVhZHkgdGhlcmUuJm5ic3A7IEkgd291bGQgZXhwZWN0IG9uZTxicj4NCmNvbW1v biBjYXNlIHRvIGJlIHdoZXJlIHRoZXJlIGlzIG9uZSBUQSBwZXIgU0QsIHNvIHRoYXQgYWxsIFRB cyBhcmUgaXNvbGF0ZWQ8YnI+DQpmcm9tIGVhY2ggb3RoZXIuJm5ic3A7IEFzIHN1Y2gsIHJlcXVp cmluZyB0aGUgZXh0cmEgZGVsYXkgaXMgaW5lZmZpY2llbnQgaW4gdGltZSw8YnI+DQpiYW5kd2lk dGgsIGFuZCBwcm9jZXNzaW5nLiZuYnNwOyZuYnNwOyBBbGwgdGhlIGZpZWxkcyBpbiBDcmVhdGVT RCBhcmUgYWxyZWFkeSBwcmVzZW50PGJyPg0KaW4gYW4gSW5zdGFsbFRBIG1lc3NhZ2UgKGV4Y2Vw dCB0aGUg4oCcZGlk4oCdIGZpZWxkIG1lbnRpb25lZCBhYm92ZSBpbiBpc3N1ZSAjNSksPGJyPg0K c28gaXQgY291bGQgYmUgZG9uZSBhdXRvbWF0aWNhbGx5IGJ5IHRoZSBmaXJzdCBJbnN0YWxsVEEg bWVzc2FnZSBpdHNlbGYuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj5bQUFdIHdoZW4gdGhl IFNEIGlzIGNyZWF0ZWQsIGFuIGFzeW1tZXRyaWMga2V5cGFpciBpcyBnZW5lcmF0ZWQgKHNwYWlr KSwgYW5kIHRoZSBwdWJsaWMgcGFydCBvZiB0aGlzIGlzIHJldHVybmVkLiBXaGVuIGEgVEEgaXMg aW5zdGFsbGVkLCBpdCBpcyBlbmNyeXB0ZWQgd2l0aCB0aGlzIGtleS4gVGhpcyBlbmFibGVzIHNv bWUgdXNlIGNhc2VzDQogd2hlcmUgYSBUQU0gY291bGQgaW50ZXJmYWNlIHRvIGEgU1AgYW5kIGVu YWJsZSBhbiBTUCB0byBwcm92aWRlIHRoZSBUQSBlbmNyeXB0ZWQgc3VjaCB0aGF0IHRoZSBUQSBi aW5hcnkgaXMgbm90IGtub3duIGJ5IHRoZSBUQU0uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMw Ij5UaGUgc3BhaWsgaXMgYWxzbyB1c2VkIHRvIGVuY3J5cHQgdGhlIHBlcnNvbmFsaXphdGlvbiBk YXRhICh0aGF0IGlzIGFsc28gc2VudCBpbiBJbnN0YWxsVEEpLCBhbmQgdGhlcmUgaXMgYWxzbyBh IHVzZSBjYXNlIGZvciBhIFRBTSBpbnRlcmZhY2luZyB0byBhbiBTUCBpbiBvcmRlciB0aGF0IHRo ZSBTUCBlbmNyeXB0cyBwZXJzbyBkYXRhIGZvcg0KIHRoYXQgVEVFIHN1Y2ggdGhhdCBpdCB0cmF2 ZWxzIHZpYSB0aGUgVEFNIHRvIHRoZSBURUUsIGJ1dCB3aXRob3V0IHRoZSBUQU0gaGF2aW5nIGFj Y2VzcyB0byB0aGF0IGRhdGE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPlNpbmNlIEluc3Rh bGxUQSByZXF1aXJlcyBrbm93bGVkZ2Ugb2YgdGhlIHB1YmxpYyBrZXkgcmV0dXJuZWQgZnJvbSBD cmVhdGVTRCwgaXQgaXMgdHJ1ZSB0aGF0IHRoZSBleHRyYSByb3VuZCB0cmlwIGlzIHJlcXVpcmVk LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+U28gdGhlIHF1ZXN0aW9uIGlzIHdoZXRoZXIg dGhlcmUgaXMgYSBjYXNlIGZvciBpbnN0YWxsaW5nIFRBIChhbmQgdGhlaXIgYWNjb21wYW55aW5n IHBlcnNvIGRhdGEpIHdpdGhvdXQgdGhlIGFiaWxpdHkgdG8gcHJvdmlkZSBjb25maWRlbnRpYWxp dHkgYmV0d2VlbiBhbiBTUCBhbmQgdGhlIFRFRSBieSBtYWtpbmcgdGhhdCBsYXllciBvZiBlbmNy eXB0aW9uDQogb3B0aW9uYWwsIGFuZCBieSBhbGxvd2luZyB0aGUgVEEgKGFuZCBwZXJzbyBkYXRh PykgdG8gYmUgYnVuZGxlZCBpbnRvIENyZWF0ZVNEPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMw Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9InRleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPjwh W2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLWxp c3Q6SWdub3JlIj44KTxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21h biZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwv c3Bhbj48IVtlbmRpZl0+PHNwYW4gbGFuZz0iRU4tVVMiPlRoZSBzY29wZSBvZiB1bmlxdWVuZXNz IG9mIHRoZSDigJxyaWTigJ0gYW5kIOKAnHRpZOKAnSBmaWVsZHMgaXMgdW5kZXJzcGVjaWZpZWQu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiPjxzcGFu IGxhbmc9IkVOLVVTIj5UaGV5IGp1c3Qgc2F5IOKAnHVuaXF1ZeKAnS4mbmJzcDsgSSB0aGluayDi gJxyaWTigJ0gaXMganVzdCBzdXBwb3NlZCB0byBiZSB1bmlxdWUgd2l0aGluPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiPjxzcGFuIGxhbmc9IkVOLVVT Ij5hIGdpdmVuIHtzZXNzaW9uLOKAnXRpZOKAnX0gYnV0IEkgY2Fu4oCZdCB0ZWxsIGZvciBzdXJl LiZuYnNwOyBBbmQgSSB0aGluayDigJx0aWTigJ0gaXMganVzdCBzdXBwb3NlZDxicj4NCnRvIGJl IHVuaXF1ZSB3aXRoaW4gYSBnaXZlbiBzZXNzaW9uIChub3QgZ2xvYmFsbHkgYWNyb3NzIGFsbCBz ZXNzaW9ucywgYWxsIFRBTXMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xp c3RQYXJhZ3JhcGgiPjxzcGFuIGxhbmc9IkVOLVVTIj5hbGwgZGV2aWNlcyksIGJ1dCBJIGNhbuKA mXQgdGVsbC4mbmJzcDsmbmJzcDsgVGhleeKAmXJlIGFsc28gZm9ybWF0dGVkIGFzIHN0cmluZ3Ms IGJ1dCBJ4oCZbSBub3Qgc3VyZTxicj4NCndoeSB0aGV5IGNhbuKAmXQgYmUgaW50ZWdlcnMgd2hp Y2ggSSB0aGluayB3b3VsZCBiZSBtdWNoIG1vcmUgZWZmaWNpZW50Li48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBj bSI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj5bQUFdIGFsdGhvdWdo IGl0IGlzIG5vdCBtYW5kYXRlZCwgcmFuZG9tIGd1aWRzIGNhbiBiZSBhIHZpYWJsZSBpbXBsZW1l bnRhdGlvbiBjaG9pY2UgZm9yIHRoZXNlIChhcyBpdCB0YWtlcyBhd2F5IHRoZSByZXF1aXJlbWVu dCB0byBtYW5hZ2UgaW5jcmVtZW50YWwgY291bnRlcnMpIOKAkyBzbw0KIEkgd291bGQgbm90IHdh bnQgdG8gc2VlIHRoZXNlIGJlY29tZSBpbnRlZ2Vycy4gQnkgbWFraW5nIHRoZW0gc3RyaW5ncywg YSBUQU0gY2FuIGNob29zZSB0aGUgbWVjaGFuaXNtIGl0IHdhbnRzLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGNt Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPkkgdGFrZSB5b3VyIHBv aW50IGFib3V0IOKAnHJpZOKAnSBhbmQg4oCcdGlk4oCdIGJlaW5nIHVuZGVyc3BlY2lmaWVkLiBU aGUgdHJ1dGggaXMgdGhhdCB2YWx1ZXMgY29udGFpbmVkIGluIHRoZXNlIGZpZWxkcyBkb27igJl0 IG1hdHRlciB0byB0aGUgcHJvdG9jb2wgbXVjaC4gKHRoZXkgYXJlIG1vc3RseQ0KIGZvciB0aGUg Y29udmVuaWVuY2Ugb2YgdGhlIFRBTSBpbiBvcmRlciB0byBtYXRjaCB1cCByZXF1ZXN0IGFuZCBy ZXNwb25zZSBtZXNzYWdlcyAocmlkKSwgYW5kICh0aWQpIHRvIHVuZGVyc3RhbmQgd2hpY2ggbWVz c2FnZXMgYmVsb25nIGluIGEg4oCYY29udmVyc2F0aW9u4oCZKTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LTE4LjBw dDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMiI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gbGFu Zz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVz IE5ldyBSb21hbiZxdW90OyxzZXJpZiI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+OSk8 c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZd PjxzcGFuIGxhbmc9IkVOLVVTIj5JIGZvdW5kIGl0IGNvbmZ1c2luZyB0aGF0IHRoZSBuYW1lcyBv ZiB0aGUgbWVzc2FnZXMgZG9u4oCZdCBtYXRjaCB0aGUgbmFtZSB2YWx1ZXM8YnI+DQppbiB0aGUg bWVzc2FnZXMgdGhlbXNlbHZlcyAo4oCcR2V0RGV2aWNlU3RhdGVSZXNwb25zZeKAnSB2cyA8L3Nw YW4+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiPjxzcGFuIGxhbmc9IkVOLVVTIj7igJxHZXRE ZXZpY2VURUVTdGF0ZVRCU1Jlc3BvbnNl4oCdLCBldGMuKSZuYnNwOyZuYnNwOyBIYXZpbmcgdGhl c2Ugbm90IG1hdGNoIGlzIGJ1Zy1wcm9uZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBjbSI+PHNwYW4gbGFuZz0i RU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj5bQUFdIEkgYWdyZWUuIEluc3RlYWQgb2YgaGF2 aW5nIGEgbWl4dHVyZSBvZg0KPGI+R2V0RGV2aWNlU3RhdGU8L2I+WFhYIGFuZCA8Yj5HZXREZXZp Y2VURUVTdGF0ZTwvYj5YWFggdGhleSBzaG91bGQgYWxsIHN0YW5kYXJkaXplIG9uDQo8Yj5HZXRE ZXZpY2VURUVTdGF0ZTwvYj5YWFguPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowY20iPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Tm9kZSB0aGF0IHRoZXJlIGFyZSBpbnRlbnRpb25hbCBk aWZmZXJlbmNlcyBhdCB0aGUgZW5kIG9mIHRob3NlIHdvcmRzIChlLmcuIEdldERldmljZVRFRVN0 YXRlPGI+VEJTUmVzcG9uc2U8L2I+IHZzIEdldERldmljZVRFRVN0YXRlPGI+UmVzcG9uc2U8L2I+ IGlzIGludGVudGlvbmFsIGFzDQogb25lIG9mIHRoZXNlIGlzIHRoZSDigJh0byBiZSBzaWduZWTi gJkgZGF0YSBhbmQgdGhlIG90aGVyIGlzIHRoZSBzaWduZWQgZGF0YS48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0x OC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUi PjEwKTxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+ Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gbGFuZz0iRU4tVVMi Pkl04oCZcyB1bmNsZWFyIHdoZXRoZXIgYSByaWNoIGFwcCBjYW4gZGVwZW5kIG9uIHR3byBUQeKA mXMgZnJvbSBkaWZmZXJlbnQgVEFNcyw8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90Oyxz ZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgi PjxzcGFuIGxhbmc9IkVOLVVTIj5hbmQgd2hldGhlciBhIFRBIGNhbiBkZXBlbmQgb24gYSBUQSBm cm9tIGEgZGlmZmVyZW50IFRBTS4mbmJzcDsgSW4gdGhlIHVzZSBjYXNlPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiPjxzcGFuIGxhbmc9IkVOLVVTIj53 aGVyZSB0aGUgZGV2aWNlIGFkbWluIHJ1bnMgdGhlIFRBTSBhbmQgY29udHJvbHMgYWxsIFRBcyBv biB0aGVpciBkZXZpY2VzIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIj48c3BhbiBsYW5nPSJFTi1VUyI+YW5zd2VyIHdvdWxkIGJlIG5vLiZuYnNw OyBCdXQgaW4gb3RoZXIgdXNlIGNhc2VzIEnigJltIG5vdCBzdXJlLiZuYnNwOyZuYnNwOyBJZiBz bywgdGhlbiB0aGUgcXVlc3Rpb248YnI+DQphcmlzZXMgYWJvdXQgaG93IGRlcGVuZGVuY2llcyBh cmUgZXhwcmVzc2VkIGFuZCB3aGV0aGVyIGEgZGVwZW5kZW5jeSBuZWVkczxicj4NCnRvIGV4cHJl c3Mgd2hpY2ggVEFNIGlzIHVzZWQuJm5ic3A7IFRoaXMgdGhlbiBiZWdzIHRoZSBxdWVzdGlvbnMg b2Ygd2hldGhlciBhIFRBIG1pZ2h0PGJyPg0KYmUgdmlhIG1vcmUgdGhhbiBvbmUgVEFNLCBvciBt aWdodCBjaGFuZ2UgVEFNcyBvdmVyIHRpbWUuJm5ic3A7Jm5ic3A7IFRoZSBhbnN3ZXJzIGhlcmU8 YnI+DQpwcm9iYWJseSBiZWxvbmcgaW4gdGhlIGFyY2ggZG9jLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6 IzAwNzBDMCI+W0FBXSBUQSBpbnRlci1kZXBlbmRlbmN5IGlzIGNvbXBsZXRlbHkgb3V0IG9mIHRo ZSBzY29wZSBvZiB0aGUgT1RyUCBwcm90b2NvbC4gKHNvIHRoZSByaWNoIGFwcCB2ZW5kb3IgbmVl ZHMgdG8ga25vdyBhbGwgdGhlIFRBIElEcyB0aGV5IG5lZWQgaW5zdGFsbGluZywgYW5kIHdoaWNo IFRBTShzKSB0byBnZXQgdGhlbSBmcm9tKS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPkRhdmU8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_HE1PR06MB3147E1F7E2F989977A104773955D0HE1PR06MB3147eurp_-- From nobody Mon Jul 16 10:59:56 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3155613118A for ; Mon, 16 Jul 2018 10:59:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9yMfkGlHc4jU for ; Mon, 16 Jul 2018 10:59:44 -0700 (PDT) Received: from NAM05-BY2-obe.outbound.protection.outlook.com (mail-eopbgr710124.outbound.protection.outlook.com [40.107.71.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20196131177 for ; Mon, 16 Jul 2018 10:59:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=V9VF8kUS4i+c7g8nX2FAft/Ji0lnrRBZ5PoA3VtRIR4=; b=fcuOfDMVDhicWmJt+e6Mz35+XN5P3xwRlMwbWuxXhL27Q3dXLf8ox7wmBni7dB40kLnw4BFLmv/EspDSwMd2ViQXt/pW2yRHuvJKD1PIIvlyvPi7w2WlsKqlxdPU0xjibRzfEb2ZJvMXQo/SojWOaJvqXOo25YKeZcDgGCzsKvc= Received: from DM5PR2101MB0805.namprd21.prod.outlook.com (10.167.105.149) by DM5PR2101MB0903.namprd21.prod.outlook.com (52.132.132.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.995.1; Mon, 16 Jul 2018 17:59:39 +0000 Received: from DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::8416:6f:8f6b:3fb7]) by DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::8416:6f:8f6b:3fb7%3]) with mapi id 15.20.0995.000; Mon, 16 Jul 2018 17:59:39 +0000 From: Dave Thaler To: Andrew Atyeo , "teep@ietf.org" Thread-Topic: Implementation feedback on draft-ietf-teep-opentrustprotocol-01 Thread-Index: AdQdELD0WeWS9FafTXOUTGNyvJ0BjgAAIDtQAAKGEoA= Date: Mon, 16 Jul 2018 17:59:39 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-07-16T17:53:21.3059708Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:67c:1232:144:f57f:f28c:b655:e32] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2101MB0903; 6:KgSE5mCheo2BlVU7ei8c2LYtk8godKH1cM+nRAPVESVFnLF40YTQcl/ZFLhW/5+4rwgVFmW1SHiMCOArposWyLSYITJ4ShNHxNZZH2+jNDSN3en+2tKpeyKeDRBBc4qOXi12aRL776XAVDX8WVylWoQmok51/zrBA55cofhGeG5t7xrW9k6pSZPgO/JUOY2IcVfq+39MZ2p1EEACnRzja0HgPlJbDJpTvaipzCc6GiNIpgAPJLVnUwvvC15vE2t8odGJUwI8/t81sHeNfqN0jOJd65uinKt/Rb248q4gtBNwkrW6ELLHvvcLuTrVSZA6IOb1E7+DXnkTYAIaxDYkX2id9ISSR/DShbFwHNDox6RytLZPo4rYBne+86rFiA7NIKBxB8MmhHbviaQHPUAO9U8lRkfBDeNVL0zqCCHOQAkz7jmqf7E1JHb1QWnO1r67/V2Etmiiv5ly6KBD3T+Mgg==; 5:EUFC+iA4l8+8EypqubZk6brNtggAr2UJVp1LWFn+ikp3ipP+hrVmy4wfmJvT8q+ogzGo2p1BRrA8Hjvt3mTUiPz/ODBd5yK6bwyt/P4C4Gjzw2XFNr9ekcQgFhhygYERTFcuVo3j5xz14iARzXg0HJ9tniTUEOmNPVfxRX2ALYA=; 7:ngWtGEBI/aymPlsuxNYWp2FmvFPK/lsAIFJP9VL9m5oTNEclCKqfj3TyaLY87Rf20UQsffQ8TuiK43S5A2dwsouvzZwcM556Rd37xu79oIhmSE9AeUeJZyr54mGLKrHMDIezC2y6S0/UAXujSQqq9BeLss5wleOBO4qYxW4Gyq6vk2G3SDjpmw/YcwtJP5lLtSsMuZ2+FGnMTmgDI+C0PNOCFgSGQVrCXLN483tdGKrCdYNYOp0GZpBR3ybWM272 x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: fd36e7c5-a9db-4d95-8305-08d5eb45e6b5 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(48565401081)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7193020); SRVR:DM5PR2101MB0903; x-ms-traffictypediagnostic: DM5PR2101MB0903: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231311)(944501410)(52105095)(2018427008)(3002001)(10201501046)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123564045)(20161123558120)(20161123560045)(6072148)(201708071742011)(7699016); SRVR:DM5PR2101MB0903; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2101MB0903; x-forefront-prvs: 073515755F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(366004)(346002)(396003)(136003)(376002)(189003)(199004)(60444003)(68736007)(53936002)(8676002)(790700001)(6116002)(76176011)(6436002)(74316002)(102836004)(229853002)(6506007)(8990500004)(55016002)(10090500001)(7696005)(54896002)(6306002)(14444005)(256004)(9686003)(6246003)(2900100001)(86362001)(25786009)(8936002)(14454004)(316002)(446003)(110136005)(2501003)(22452003)(2906002)(86612001)(186003)(476003)(486006)(7736002)(81166006)(105586002)(46003)(5660300001)(81156014)(11346002)(106356001)(33656002)(478600001)(99286004)(5250100002)(10290500003)(97736004); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB0903; H:DM5PR2101MB0805.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: Gfbbb2bN8gX64Tcz89qaXj5SrPdVAUP7YxLw9zeFULtULveGRPViV26xEoIkJYzaWWd2XVIQC4kllXqLizS6TpDT/gKtgekod7FuclfGF4nG/ObosvTU4TVrZzuaD9QlgNS1Y5w1HRgNsIK6aKL72NU7d5Kd4THuYIBSMiWHrobEMH1FD/XJSgP9dnGaUSTd6ADmJ1WJwEwx5FTIg7AqXoSNEJF9ehiNaYHfHIFOZIAKwuP+wp7jYGmN820I535YPV1AKvtkapffC2HS/HKTgrLqnEopFshE95Rb80Lhf+chZuDKfelf4XpbC/yzlZCY0hiRUl9MuMAPx9Fi0/YGlaKex3jrWj6Y/r5CYIfOCPU= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2101MB0805A7BEC6DE90EC6910088CA35D0DM5PR2101MB0805_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: fd36e7c5-a9db-4d95-8305-08d5eb45e6b5 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jul 2018 17:59:39.7048 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0903 Archived-At: Subject: Re: [Teep] Implementation feedback on draft-ietf-teep-opentrustprotocol-01 X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Jul 2018 17:59:55 -0000 --_000_DM5PR2101MB0805A7BEC6DE90EC6910088CA35D0DM5PR2101MB0805_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QW5kcmV3IHdyaXRlczoNCuKApg0KDQoxKSAgICAgU2VjdGlvbiA2LjUgZXhwbGFpbnMgdGhhdCB0 aGUgVEFNIG5lZWRzIHRvIHJlY2VpdmUgYSBsaXN0IG9mIG9uZSBvciBtb3JlDQoNClRB4oCZcyB0 aGF0IGFyZSByZXF1ZXN0ZWQgdG8gYmUgaW5zdGFsbGVkIChTNi41LjEgcG9pbnQgMUEpLiAgSG93 ZXZlciwgbm8NCg0KbWVzc2FnZSBpcyBkZWZpbmVkIGZvciBkb2luZyBzbywgd2hpY2ggcHJldmVu dHMgaW50ZXJvcGVyYWJpbGl0eS4gIEkNCnRoaW5rIHRoaXMgbWVzc2FnZSBuZWVkcyB0byBiZSBn ZW5lcmF0ZWQgYnkgdGhlIFRFRSAobm90IHRoZSByaWNoIGFwcCksDQpmb3IgcmVhc29ucyBJIHdp bGwgZXhwbGFpbiBpbiAjMyBiZWxvdy4NCg0KW0FBXSBJIGRvbuKAmXQgc2VlIHRoZSBuZWVkIGZv ciBhIG1lc3NhZ2UgZm9yIGRlZmluaW5nIHRoZSBUQXMgdGhhdCBuZWVkIHRvIGJlIGluc3RhbGxl ZC4gVGhlIE9UclAgbWVzc2FnZXMgYXJlIGJldHdlZW4gdGhlIFRBTSBhbmQgdGhlIFRFRSwgYnV0 IHRoZSBkZXNpcmUgdG8gaW5zdGFsbCBUQXMgY29tZXMgZnJvbSB0aGUgcmljaCBhcHAuICBJbiBw cmFjdGljZSwgYSByaWNoIGFwcCB3aWxsIGhhdmUgdGhlIGlkZW50aWZpZXJzIG9mIHRoZSBUQXMg aXQgcmVxdWlyZXMgYnVpbHQgaW50byBpdHMgb3duIGNvZGUsIHNpbmNlIGl0cyBvd24gY29kZSB3 aWxsIGFsc28gYmUgY2FsbGluZyB0aG9zZSBUQXMgKGUuZy4gb25jZSBpbnN0YWxsZWQsIHRvIHBl cmZvcm0gc29tZSBEUk0gb3IgcGF5bWVudCBhdXRoZW50aWNhdGlvbikuIFRoZXJlZm9yZSBhIHJp Y2ggYXBwIGlzIGF3YXJlIG9mIHRoZSBUQXMgaXQgbmVlZHMuICBJIGRvbuKAmXQgdGhpbmsgdGhp cyBpbmZvIGNhbiBjb21lIGZyb20gdGhlIFRFRSDigJMgc2luY2UgYXQgdGhpcyBwb2ludCB0aGUg VEEgaXMgbm90IGluc3RhbGxlZCB5ZXQsIHNvIHdoaWNoIHBhcnQgb2YgdGhlIFRFRSB3b3VsZCBo YXZlIHRoZSBrbm93bGVkZ2Ugb2Ygd2hpY2ggVEFzIGFyZSBuZWVkZWQ/DQoNCg0KDQpBcyBJIG5v dGVkIGluIG15IGFyY2ggZG9jIGNvbW1lbnRzLCBJIGRpc2FncmVlIHRoYXQgdGhlcmUgbmVlZHMg dG8gYmUgYW55IGNvbW11bmljYXRpb24gYmV0d2VlbiB0aGUgcmljaCBhcHAgYmVpbmcgaW5zdGFs bGVkLCBhbmQgdGhlIFRBTS4gIEEgdmFsaWQgaW1wbGVtZW50YXRpb24gbW9kZWwgc2hvdWxkIGJl IHRoYXQgdGhlIGFwcCBzdG9yZSBpbnN0YWxsZXIgcmVhZHMgdGhlIG1ldGFkYXRhIChpbmNsdWRp bmcgVEEgZGVwZW5kZW5jaWVzKSBhYm91dCB0aGUgcmljaCBhcHAsIGFuZCBhcyBwYXJ0IG9mIGlu c3RhbGxpbmcgdGhlIHJpY2ggYXBwICh3aXRob3V0IGV2ZXIgbmVlZGluZyB0byBydW4gaXQpLCB0 aGUgaW5zdGFsbGVyIGNhbiBjb21tdW5pY2F0ZSB3aXRoIHRoZSBURUUgdG8gZXhwcmVzcyB0aG9z ZSBkZXBlbmRlbmNpZXMsIHdoaWNoIHRoZW4gdHJpZ2dlcnMgdGhlIFRFRSB0byBnZW5lcmF0ZSBh IHNpZ25lZCBtZXNzYWdlIHRvIHRoZSBUQU0sIHdoaWNoIGNhbiBiZSByZWxhdGVkIGJ5IHRoZSBp bnN0YWxsZXIuDQoNCg0KDQpJbiB0aGUgbGVzcyBlZmZpY2llbnQgbW9kZWwgd2hlcmUgdGhlIHJp Y2ggYXBwIGhhcyB0byBiZSBydW4sIGFzIHRoZSBkb2MgaW1wbGllcywgdGhlIHNhbWUgcHJvY2Vz cyBjYW4gb2NjdXIgd2hlcmUgdGhlIFRFRSBnZW5lcmF0ZXMgdGhlIG1lc3NhZ2UgaW4gcmVzcG9u c2UgdG8gdGhlIHJpY2ggYXBwIHRlbGxpbmcgdGhlIGFnZW50IGl0IGhhcyBhIGRlcGVuZGVuY3ku DQoNCuKApg0KDQpQdXR0aW5nIG15IGlzc3VlICMxIGFuZCBpc3N1ZSAjMiB0b2dldGhlciBtZWFu cyB0aGVyZeKAmXMgYW4gZXh0cmEgcm91bmQNCg0KdHJpcCB0aGF0IGlzIHVubmVjZXNzYXJ5LiAg Ni41IHNheXMgdGhlIFRBTSByZWNlaXZlIGEgbGlzdCBvZiBUQXMgbmVlZGVkLA0KDQphbmQgdGhl biB0aGUgVEFNIGp1c3QgZ29lcyBiYWNrIGFuZCBhc2tzIHdoYXQgaXMgaW5zdGFsbGVkLCBqdXN0 IHRvIGdldA0KYSBsaXN0IG9mIHdoYXQgbmVlZHMgdG8gYmUgaW5zdGFsbGVkLiAgVGhpcyBpcyB1 bm5lY2Vzc2FyeSwgdGhlIFRFRSBjYW4ganVzdA0KDQpzZW5kIGEgbGlzdCBvZiBvbmUgb3IgbW9y ZSBUQXMgdGhhdCBuZWVkIHRvIGJlIGluc3RhbGxlZCBhbmQgYXJlbuKAmXQgYWxyZWFkeS4NCg0K SG9wZWZ1bGx5IHRoaXMgZXhwbGFpbnMgd2h5IEkgc2FpZCBpbiBpc3N1ZSAjMSBhYm92ZSB3aHkg SSB0aGluayB0aGUgbWVzc2FnZQ0KbmVlZHMgdG8gYmUgZ2VuZXJhdGVkIGJ5IHRoZSBURUUuDQoN CltBQV0gYnV0IGhvdyBjb3VsZCB0aGUgVEVFICh3aGljaCBkb2VzbuKAmXQgaGF2ZSBpdHMgVEFz IGxvYWRlZCB5ZXQpIGtub3cgd2hhdCBUQXMgc2hvdWxkIGJlIGxvYWRlZD8NCg0KDQoNClRoZSBz YW1lIHBpZWNlIG9mIGNvZGUgdGhhdCBjb25uZWN0cyB0byB0aGUgVEFNIHRlbGxzIHRoZSBURUUg d2hhdCBUQeKAmXMgaXQgZGVzaXJlcy4NCg0KVGhlIFRFRSB0aGVuIGdlbmVyYXRlcyBhIG1lc3Nh Z2Ugd2l0aCB0aGUgbGlzdCBvZiBUQXMgdGhhdCBhcmVu4oCZdCBhbHJlYWR5IGluc3RhbGxlZC4N Cg0KDQoNCuKApg0KDQozKSAgICAgU2VjdGlvbiA2LjUuMSBwb2ludCA5LkEgaW1wbGllcyB0aGF0 IHRvIGluc3RhbGwgYSBUQSwgb25lIG11c3QgaGF2ZSBhbiBleHRyYQ0Kcm91bmQgdHJpcCBmaXJz dCB0byBjcmVhdGUgYW4gU0QgaWYgb25lIGlzbuKAmXQgYWxyZWFkeSB0aGVyZS4gIEkgd291bGQg ZXhwZWN0IG9uZQ0KY29tbW9uIGNhc2UgdG8gYmUgd2hlcmUgdGhlcmUgaXMgb25lIFRBIHBlciBT RCwgc28gdGhhdCBhbGwgVEFzIGFyZSBpc29sYXRlZA0KZnJvbSBlYWNoIG90aGVyLiAgQXMgc3Vj aCwgcmVxdWlyaW5nIHRoZSBleHRyYSBkZWxheSBpcyBpbmVmZmljaWVudCBpbiB0aW1lLA0KYmFu ZHdpZHRoLCBhbmQgcHJvY2Vzc2luZy4gICBBbGwgdGhlIGZpZWxkcyBpbiBDcmVhdGVTRCBhcmUg YWxyZWFkeSBwcmVzZW50DQppbiBhbiBJbnN0YWxsVEEgbWVzc2FnZSAoZXhjZXB0IHRoZSDigJxk aWTigJ0gZmllbGQgbWVudGlvbmVkIGFib3ZlIGluIGlzc3VlICM1KSwNCnNvIGl0IGNvdWxkIGJl IGRvbmUgYXV0b21hdGljYWxseSBieSB0aGUgZmlyc3QgSW5zdGFsbFRBIG1lc3NhZ2UgaXRzZWxm Lg0KW0FBXSB3aGVuIHRoZSBTRCBpcyBjcmVhdGVkLCBhbiBhc3ltbWV0cmljIGtleXBhaXIgaXMg Z2VuZXJhdGVkIChzcGFpayksIGFuZCB0aGUgcHVibGljIHBhcnQgb2YgdGhpcyBpcyByZXR1cm5l ZC4gV2hlbiBhIFRBIGlzIGluc3RhbGxlZCwgaXQgaXMgZW5jcnlwdGVkIHdpdGggdGhpcyBrZXku IFRoaXMgZW5hYmxlcyBzb21lIHVzZSBjYXNlcyB3aGVyZSBhIFRBTSBjb3VsZCBpbnRlcmZhY2Ug dG8gYSBTUCBhbmQgZW5hYmxlIGFuIFNQIHRvIHByb3ZpZGUgdGhlIFRBIGVuY3J5cHRlZCBzdWNo IHRoYXQgdGhlIFRBIGJpbmFyeSBpcyBub3Qga25vd24gYnkgdGhlIFRBTS4NClRoZSBzcGFpayBp cyBhbHNvIHVzZWQgdG8gZW5jcnlwdCB0aGUgcGVyc29uYWxpemF0aW9uIGRhdGEgKHRoYXQgaXMg YWxzbyBzZW50IGluIEluc3RhbGxUQSksIGFuZCB0aGVyZSBpcyBhbHNvIGEgdXNlIGNhc2UgZm9y IGEgVEFNIGludGVyZmFjaW5nIHRvIGFuIFNQIGluIG9yZGVyIHRoYXQgdGhlIFNQIGVuY3J5cHRz IHBlcnNvIGRhdGEgZm9yIHRoYXQgVEVFIHN1Y2ggdGhhdCBpdCB0cmF2ZWxzIHZpYSB0aGUgVEFN IHRvIHRoZSBURUUsIGJ1dCB3aXRob3V0IHRoZSBUQU0gaGF2aW5nIGFjY2VzcyB0byB0aGF0IGRh dGENClNpbmNlIEluc3RhbGxUQSByZXF1aXJlcyBrbm93bGVkZ2Ugb2YgdGhlIHB1YmxpYyBrZXkg cmV0dXJuZWQgZnJvbSBDcmVhdGVTRCwgaXQgaXMgdHJ1ZSB0aGF0IHRoZSBleHRyYSByb3VuZCB0 cmlwIGlzIHJlcXVpcmVkLg0KU28gdGhlIHF1ZXN0aW9uIGlzIHdoZXRoZXIgdGhlcmUgaXMgYSBj YXNlIGZvciBpbnN0YWxsaW5nIFRBIChhbmQgdGhlaXIgYWNjb21wYW55aW5nIHBlcnNvIGRhdGEp IHdpdGhvdXQgdGhlIGFiaWxpdHkgdG8gcHJvdmlkZSBjb25maWRlbnRpYWxpdHkgYmV0d2VlbiBh biBTUCBhbmQgdGhlIFRFRSBieSBtYWtpbmcgdGhhdCBsYXllciBvZiBlbmNyeXB0aW9uIG9wdGlv bmFsLCBhbmQgYnkgYWxsb3dpbmcgdGhlIFRBIChhbmQgcGVyc28gZGF0YT8pIHRvIGJlIGJ1bmRs ZWQgaW50byBDcmVhdGVTRA0KDQpNeSBtYWluIHBvaW50IGlzIHRoYXQgaXQgc2hvdWxkIGJlIHBv c3NpYmxlIHRvIGNvbWJpbmUgQ3JlYXRlU0QgaW50byB0aGUgZmlyc3QgSW5zdGFsbFRBIGFuZCBi ZSBtb3JlIGVmZmljaWVudC4NCkFsc28gcmVtZW1iZXIgdGhhdCB0aGUgVEEgYmluYXJ5IG5lZWQg bm90IGNvbWUgZnJvbSB0aGUgVEFNLg0KDQoNCjQpICAgICBUaGUgc2NvcGUgb2YgdW5pcXVlbmVz cyBvZiB0aGUg4oCccmlk4oCdIGFuZCDigJx0aWTigJ0gZmllbGRzIGlzIHVuZGVyc3BlY2lmaWVk Lg0KDQpUaGV5IGp1c3Qgc2F5IOKAnHVuaXF1ZeKAnS4gIEkgdGhpbmsg4oCccmlk4oCdIGlzIGp1 c3Qgc3VwcG9zZWQgdG8gYmUgdW5pcXVlIHdpdGhpbg0KDQphIGdpdmVuIHtzZXNzaW9uLOKAnXRp ZOKAnX0gYnV0IEkgY2Fu4oCZdCB0ZWxsIGZvciBzdXJlLiAgQW5kIEkgdGhpbmsg4oCcdGlk4oCd IGlzIGp1c3Qgc3VwcG9zZWQNCnRvIGJlIHVuaXF1ZSB3aXRoaW4gYSBnaXZlbiBzZXNzaW9uIChu b3QgZ2xvYmFsbHkgYWNyb3NzIGFsbCBzZXNzaW9ucywgYWxsIFRBTXMsDQoNCmFsbCBkZXZpY2Vz KSwgYnV0IEkgY2Fu4oCZdCB0ZWxsLiAgIFRoZXnigJlyZSBhbHNvIGZvcm1hdHRlZCBhcyBzdHJp bmdzLCBidXQgSeKAmW0gbm90IHN1cmUNCndoeSB0aGV5IGNhbuKAmXQgYmUgaW50ZWdlcnMgd2hp Y2ggSSB0aGluayB3b3VsZCBiZSBtdWNoIG1vcmUgZWZmaWNpZW50Li4NCg0KW0FBXSBhbHRob3Vn aCBpdCBpcyBub3QgbWFuZGF0ZWQsIHJhbmRvbSBndWlkcyBjYW4gYmUgYSB2aWFibGUgaW1wbGVt ZW50YXRpb24gY2hvaWNlIGZvciB0aGVzZSAoYXMgaXQgdGFrZXMgYXdheSB0aGUgcmVxdWlyZW1l bnQgdG8gbWFuYWdlIGluY3JlbWVudGFsIGNvdW50ZXJzKSDigJMgc28gSSB3b3VsZCBub3Qgd2Fu dCB0byBzZWUgdGhlc2UgYmVjb21lIGludGVnZXJzLiBCeSBtYWtpbmcgdGhlbSBzdHJpbmdzLCBh IFRBTSBjYW4gY2hvb3NlIHRoZSBtZWNoYW5pc20gaXQgd2FudHMuDQoNCkkgdGFrZSB5b3VyIHBv aW50IGFib3V0IOKAnHJpZOKAnSBhbmQg4oCcdGlk4oCdIGJlaW5nIHVuZGVyc3BlY2lmaWVkLiBU aGUgdHJ1dGggaXMgdGhhdCB2YWx1ZXMgY29udGFpbmVkIGluIHRoZXNlIGZpZWxkcyBkb27igJl0 IG1hdHRlciB0byB0aGUgcHJvdG9jb2wgbXVjaC4gKHRoZXkgYXJlIG1vc3RseSBmb3IgdGhlIGNv bnZlbmllbmNlIG9mIHRoZSBUQU0gaW4gb3JkZXIgdG8gbWF0Y2ggdXAgcmVxdWVzdCBhbmQgcmVz cG9uc2UgbWVzc2FnZXMgKHJpZCksIGFuZCAodGlkKSB0byB1bmRlcnN0YW5kIHdoaWNoIG1lc3Nh Z2VzIGJlbG9uZyBpbiBhIOKAmGNvbnZlcnNhdGlvbuKAmSkNCg0KDQoNClVubGVzcyB0aGVyZSBp cyBhIHJlYXNvbiBhIGd1aWQgaXMgYWN0dWFsbHkgbmVlZGVkIChlLmcuLCBnbG9iYWwgdW5pcXVl bmVzcyksIEkgd291bGQgYXJndWUgYWdhaW5zdCB0aGF0IGFkZGl0aW9uYWwgY29tcGxleGl0eS4N Cg0KSWYgYWxsIHlvdSBuZWVkIGlzIHVuaXF1ZW5lc3Mgd2l0aGluIGEgc2Vzc2lvbiwgYSBzaW1w bGUgc2VxdWVuY2UgbnVtYmVyIHdvdWxkIHN1ZmZpY2UuDQoNCg0KDQo1KSAgICAgSSBmb3VuZCBp dCBjb25mdXNpbmcgdGhhdCB0aGUgbmFtZXMgb2YgdGhlIG1lc3NhZ2VzIGRvbuKAmXQgbWF0Y2gg dGhlIG5hbWUgdmFsdWVzDQppbiB0aGUgbWVzc2FnZXMgdGhlbXNlbHZlcyAo4oCcR2V0RGV2aWNl U3RhdGVSZXNwb25zZeKAnSB2cw0KDQrigJxHZXREZXZpY2VURUVTdGF0ZVRCU1Jlc3BvbnNl4oCd LCBldGMuKSAgIEhhdmluZyB0aGVzZSBub3QgbWF0Y2ggaXMgYnVnLXByb25lLg0KDQpbQUFdIEkg YWdyZWUuIEluc3RlYWQgb2YgaGF2aW5nIGEgbWl4dHVyZSBvZiBHZXREZXZpY2VTdGF0ZVhYWCBh bmQgR2V0RGV2aWNlVEVFU3RhdGVYWFggdGhleSBzaG91bGQgYWxsIHN0YW5kYXJkaXplIG9uIEdl dERldmljZVRFRVN0YXRlWFhYLg0KDQpOb2RlIHRoYXQgdGhlcmUgYXJlIGludGVudGlvbmFsIGRp ZmZlcmVuY2VzIGF0IHRoZSBlbmQgb2YgdGhvc2Ugd29yZHMgKGUuZy4gR2V0RGV2aWNlVEVFU3Rh dGVUQlNSZXNwb25zZSB2cyBHZXREZXZpY2VURUVTdGF0ZVJlc3BvbnNlIGlzIGludGVudGlvbmFs IGFzIG9uZSBvZiB0aGVzZSBpcyB0aGUg4oCYdG8gYmUgc2lnbmVk4oCZIGRhdGEgYW5kIHRoZSBv dGhlciBpcyB0aGUgc2lnbmVkIGRhdGEuDQoNCg0KDQpJIGRvbuKAmXQgdW5kZXJzdGFuZCwgYW5k IHRoZSB0ZXJtcyBzZWVtIHRvIGJlIGludGVyY2hhbmdlYWJsZSBpbiB0aGUgZG9jLCBzbyBpZiB0 aGVyZSBpcyBhIGRpc3RpbmN0aW9uLCBpdOKAmXMgbm90IGV4cGxhaW5lZCBjbGVhcmx5IGluIHRo ZSBkb2MuDQoNCg0KDQo2KSAgICAgSXTigJlzIHVuY2xlYXIgd2hldGhlciBhIHJpY2ggYXBwIGNh biBkZXBlbmQgb24gdHdvIFRB4oCZcyBmcm9tIGRpZmZlcmVudCBUQU1zLA0KDQphbmQgd2hldGhl ciBhIFRBIGNhbiBkZXBlbmQgb24gYSBUQSBmcm9tIGEgZGlmZmVyZW50IFRBTS4gIEluIHRoZSB1 c2UgY2FzZQ0KDQp3aGVyZSB0aGUgZGV2aWNlIGFkbWluIHJ1bnMgdGhlIFRBTSBhbmQgY29udHJv bHMgYWxsIFRBcyBvbiB0aGVpciBkZXZpY2VzIHRoZQ0KDQphbnN3ZXIgd291bGQgYmUgbm8uICBC dXQgaW4gb3RoZXIgdXNlIGNhc2VzIEnigJltIG5vdCBzdXJlLiAgIElmIHNvLCB0aGVuIHRoZSBx dWVzdGlvbg0KYXJpc2VzIGFib3V0IGhvdyBkZXBlbmRlbmNpZXMgYXJlIGV4cHJlc3NlZCBhbmQg d2hldGhlciBhIGRlcGVuZGVuY3kgbmVlZHMNCnRvIGV4cHJlc3Mgd2hpY2ggVEFNIGlzIHVzZWQu ICBUaGlzIHRoZW4gYmVncyB0aGUgcXVlc3Rpb25zIG9mIHdoZXRoZXIgYSBUQSBtaWdodA0KYmUg dmlhIG1vcmUgdGhhbiBvbmUgVEFNLCBvciBtaWdodCBjaGFuZ2UgVEFNcyBvdmVyIHRpbWUuICAg VGhlIGFuc3dlcnMgaGVyZQ0KcHJvYmFibHkgYmVsb25nIGluIHRoZSBhcmNoIGRvYy4NCltBQV0g VEEgaW50ZXItZGVwZW5kZW5jeSBpcyBjb21wbGV0ZWx5IG91dCBvZiB0aGUgc2NvcGUgb2YgdGhl IE9UclAgcHJvdG9jb2wuIChzbyB0aGUgcmljaCBhcHAgdmVuZG9yIG5lZWRzIHRvIGtub3cgYWxs IHRoZSBUQSBJRHMgdGhleSBuZWVkIGluc3RhbGxpbmcsIGFuZCB3aGljaCBUQU0ocykgdG8gZ2V0 IHRoZW0gZnJvbSkuDQoNClRBcyBpbmhlcmVudGx5IGNhbiBkZXBlbmQgb24gb3RoZXIgVEHigJlz LiAgSSBkb27igJl0IHRoaW5rIGl0IHNob3VsZCBiZSBvdXQgb2Ygc2NvcGUgZm9yIHRoZSBXRy4N Cg0KRGF2ZQ0K --_000_DM5PR2101MB0805A7BEC6DE90EC6910088CA35D0DM5PR2101MB0805_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6ZHQ9InV1aWQ6QzJGNDEwMTAtNjVC My0xMWQxLUEyOUYtMDBBQTAwQzE0ODgyIiB4bWxuczptPSJodHRwOi8vc2NoZW1hcy5taWNyb3Nv ZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy9UUi9S RUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250 ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1ldGEgbmFtZT0iR2VuZXJhdG9yIiBj b250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQgbWVkaXVtKSI+DQo8c3R5bGU+PCEt LQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2Ft YnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9 DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2 Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250 LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGlu aywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMw NTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNv SHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiM5NTRG NzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxp Lk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlv cml0eTozNDsNCgltYXJnaW4tdG9wOjBpbjsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1hcmdpbi1i b3R0b206MGluOw0KCW1hcmdpbi1sZWZ0Oi41aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0K CWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0K cC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUt bmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0 OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1h aWxTdHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjEN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERl ZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo4NTgzNTE3MzA7DQoJbXNvLWxp c3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjIwNzYxODYzMzYgMTM2MDAy NTQ3NCA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcw MyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0 LWF0OjM7DQoJbXNvLWxldmVsLXRleHQ6IiUxXCkiOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoxLjI1aW47 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KQGxpc3QgbDA6bGV2ZWwy DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVm dDoxLjc1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCW1hcmdpbi1sZWZ0OjIuMjVp bjsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4t bGVmdDoyLjc1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6My4y NWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgltYXJnaW4tbGVmdDozLjc1aW47DQoJ dGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6 NC4yNWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjQuNzVpbjsN Cgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJbWFyZ2luLWxlZnQ6NS4yNWluOw0KCXRleHQt aW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDo5MjMzNDU2MDM7DQoJbXNv LWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xMjc2ODQ4MDQwIDY3 Njk4NzA1IDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4 NzAzIDY3Njk4NzEzIDY3Njk4NzE1O30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28tbGV2ZWwtdGV4 dDoiJTFcKSI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDINCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4t bG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3Qg bDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJ dGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBo YS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05 LjBwdDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBp bjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0 cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRt YXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5k aWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9 IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5BbmRyZXcgd3JpdGVzOjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0 OTdEIj7igKY8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDps MSBsZXZlbDEgbGZvMiI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0ibXNvLWxp c3Q6SWdub3JlIj4xKTxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21h biZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwhW2VuZGlm XT5TZWN0aW9uIDYuNSBleHBsYWlucyB0aGF0IHRoZSBUQU0gbmVlZHMgdG8gcmVjZWl2ZSBhIGxp c3Qgb2Ygb25lIG9yIG1vcmU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPlRB4oCZcyB0aGF0IGFyZSByZXF1ZXN0ZWQg dG8gYmUgaW5zdGFsbGVkIChTNi41LjEgcG9pbnQgMUEpLiZuYnNwOyBIb3dldmVyLCBubzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVm dDoxLjBpbiI+bWVzc2FnZSBpcyBkZWZpbmVkIGZvciBkb2luZyBzbywgd2hpY2ggcHJldmVudHMg aW50ZXJvcGVyYWJpbGl0eS4mbmJzcDsgSTxicj4NCnRoaW5rIHRoaXMgbWVzc2FnZSBuZWVkcyB0 byBiZSBnZW5lcmF0ZWQgYnkgdGhlIFRFRSAobm90IHRoZSByaWNoIGFwcCksPGJyPg0KZm9yIHJl YXNvbnMgSSB3aWxsIGV4cGxhaW4gaW4gIzMgYmVsb3cuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTGlzdFBhcmFncmFwaCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDcwQzAiPltBQV0gSSBk b27igJl0IHNlZSB0aGUgbmVlZCBmb3IgYSBtZXNzYWdlIGZvciBkZWZpbmluZyB0aGUgVEFzIHRo YXQgbmVlZCB0byBiZSBpbnN0YWxsZWQuIFRoZSBPVHJQIG1lc3NhZ2VzIGFyZSBiZXR3ZWVuIHRo ZSBUQU0gYW5kIHRoZSBURUUsIGJ1dCB0aGUgZGVzaXJlIHRvIGluc3RhbGwgVEFzIGNvbWVzIGZy b20gdGhlIHJpY2ggYXBwLjwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7 DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDcwQzAiPkluIHByYWN0aWNlLCBhIHJpY2gg YXBwIHdpbGwgaGF2ZSB0aGUgaWRlbnRpZmllcnMgb2YgdGhlIFRBcyBpdCByZXF1aXJlcyBidWls dCBpbnRvIGl0cyBvd24gY29kZSwgc2luY2UgaXRzIG93biBjb2RlIHdpbGwgYWxzbyBiZSBjYWxs aW5nIHRob3NlIFRBcyAoZS5nLiBvbmNlIGluc3RhbGxlZCwgdG8gcGVyZm9ybSBzb21lIERSTSBv ciBwYXltZW50IGF1dGhlbnRpY2F0aW9uKS4gVGhlcmVmb3JlDQogYSByaWNoIGFwcCBpcyBhd2Fy ZSBvZiB0aGUgVEFzIGl0IG5lZWRzLiZuYnNwOyBJIGRvbuKAmXQgdGhpbmsgdGhpcyBpbmZvIGNh biBjb21lIGZyb20gdGhlIFRFRSDigJMgc2luY2UgYXQgdGhpcyBwb2ludCB0aGUgVEEgaXMgbm90 IGluc3RhbGxlZCB5ZXQsIHNvIHdoaWNoIHBhcnQgb2YgdGhlIFRFRSB3b3VsZCBoYXZlIHRoZSBr bm93bGVkZ2Ugb2Ygd2hpY2ggVEFzIGFyZSBuZWVkZWQ/PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxzcGFu IHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMxRjQ5N0QiPkFzIEkgbm90ZWQgaW4gbXkgYXJjaCBkb2MgY29tbWVudHMsIEkg ZGlzYWdyZWUgdGhhdCB0aGVyZSBuZWVkcyB0byBiZSBhbnkgY29tbXVuaWNhdGlvbiBiZXR3ZWVu IHRoZSByaWNoIGFwcCBiZWluZyBpbnN0YWxsZWQsIGFuZCB0aGUgVEFNLiZuYnNwOyBBIHZhbGlk IGltcGxlbWVudGF0aW9uIG1vZGVsIHNob3VsZCBiZQ0KIHRoYXQgdGhlIGFwcCBzdG9yZSBpbnN0 YWxsZXIgcmVhZHMgdGhlIG1ldGFkYXRhIChpbmNsdWRpbmcgVEEgZGVwZW5kZW5jaWVzKSBhYm91 dCB0aGUgcmljaCBhcHAsIGFuZCBhcyBwYXJ0IG9mIGluc3RhbGxpbmcgdGhlIHJpY2ggYXBwICh3 aXRob3V0IGV2ZXIgbmVlZGluZyB0byBydW4gaXQpLCB0aGUgaW5zdGFsbGVyIGNhbiBjb21tdW5p Y2F0ZSB3aXRoIHRoZSBURUUgdG8gZXhwcmVzcyB0aG9zZSBkZXBlbmRlbmNpZXMsIHdoaWNoIHRo ZW4gdHJpZ2dlcnMNCiB0aGUgVEVFIHRvIGdlbmVyYXRlIGEgc2lnbmVkIG1lc3NhZ2UgdG8gdGhl IFRBTSwgd2hpY2ggY2FuIGJlIHJlbGF0ZWQgYnkgdGhlIGluc3RhbGxlci48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGlu Ij48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SW4gdGhlIGxlc3MgZWZmaWNpZW50IG1vZGVs IHdoZXJlIHRoZSByaWNoIGFwcCBoYXMgdG8gYmUgcnVuLCBhcyB0aGUgZG9jIGltcGxpZXMsIHRo ZSBzYW1lIHByb2Nlc3MgY2FuIG9jY3VyIHdoZXJlIHRoZSBURUUgZ2VuZXJhdGVzIHRoZSBtZXNz YWdlIGluIHJlc3BvbnNlIHRvIHRoZSByaWNoIGFwcCB0ZWxsaW5nDQogdGhlIGFnZW50IGl0IGhh cyBhIGRlcGVuZGVuY3kuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzFGNDk3RCI+4oCmPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO3Rl eHQtaW5kZW50Oi41aW4iPlB1dHRpbmcgbXkgaXNzdWUgIzEgYW5kIGlzc3VlICMyIHRvZ2V0aGVy IG1lYW5zIHRoZXJl4oCZcyBhbiBleHRyYSByb3VuZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+dHJpcCB0aGF0IGlz IHVubmVjZXNzYXJ5LiZuYnNwOyA2LjUgc2F5cyB0aGUgVEFNIHJlY2VpdmUgYSBsaXN0IG9mIFRB cyBuZWVkZWQsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj5hbmQgdGhlbiB0aGUgVEFNIGp1c3QgZ29lcyBiYWNrIGFu ZCBhc2tzIHdoYXQgaXMgaW5zdGFsbGVkLCBqdXN0IHRvIGdldDxicj4NCmEgbGlzdCBvZiB3aGF0 IG5lZWRzIHRvIGJlIGluc3RhbGxlZC4mbmJzcDsgVGhpcyBpcyB1bm5lY2Vzc2FyeSwgdGhlIFRF RSBjYW4ganVzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+c2VuZCBhIGxpc3Qgb2Ygb25lIG9yIG1vcmUgVEFzIHRo YXQgbmVlZCB0byBiZSBpbnN0YWxsZWQgYW5kIGFyZW7igJl0IGFscmVhZHkuPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGlu Ij5Ib3BlZnVsbHkgdGhpcyBleHBsYWlucyB3aHkgSSBzYWlkIGluIGlzc3VlICMxIGFib3ZlIHdo eSBJIHRoaW5rIHRoZSBtZXNzYWdlPGJyPg0KbmVlZHMgdG8gYmUgZ2VuZXJhdGVkIGJ5IHRoZSBU RUUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMwMDcwQzAiPltBQV0gYnV0IGhvdyBjb3VsZCB0aGUgVEVFICh3aGljaCBkb2Vz buKAmXQgaGF2ZSBpdHMgVEFzIGxvYWRlZCB5ZXQpIGtub3cgd2hhdCBUQXMgc2hvdWxkIGJlIGxv YWRlZD88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+VGhlIHNhbWUg cGllY2Ugb2YgY29kZSB0aGF0IGNvbm5lY3RzIHRvIHRoZSBUQU0gdGVsbHMgdGhlIFRFRSB3aGF0 IFRB4oCZcyBpdCBkZXNpcmVzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6 IzFGNDk3RCI+VGhlIFRFRSB0aGVuIGdlbmVyYXRlcyBhIG1lc3NhZ2Ugd2l0aCB0aGUgbGlzdCBv ZiBUQXMgdGhhdCBhcmVu4oCZdCBhbHJlYWR5IGluc3RhbGxlZC48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3Bh biBzdHlsZT0iY29sb3I6IzFGNDk3RCI+4oCmPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjc1aW47dGV4dC1pbmRl bnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8zIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNd PjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3Jl Ij4zKTxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+ U2VjdGlvbiA2LjUuMSBwb2ludCA5LkEgaW1wbGllcyB0aGF0IHRvIGluc3RhbGwgYSBUQSwgb25l IG11c3QgaGF2ZSBhbiBleHRyYTxicj4NCnJvdW5kIHRyaXAgZmlyc3QgdG8gY3JlYXRlIGFuIFNE IGlmIG9uZSBpc27igJl0IGFscmVhZHkgdGhlcmUuJm5ic3A7IEkgd291bGQgZXhwZWN0IG9uZTxi cj4NCmNvbW1vbiBjYXNlIHRvIGJlIHdoZXJlIHRoZXJlIGlzIG9uZSBUQSBwZXIgU0QsIHNvIHRo YXQgYWxsIFRBcyBhcmUgaXNvbGF0ZWQ8YnI+DQpmcm9tIGVhY2ggb3RoZXIuJm5ic3A7IEFzIHN1 Y2gsIHJlcXVpcmluZyB0aGUgZXh0cmEgZGVsYXkgaXMgaW5lZmZpY2llbnQgaW4gdGltZSw8YnI+ DQpiYW5kd2lkdGgsIGFuZCBwcm9jZXNzaW5nLiZuYnNwOyZuYnNwOyBBbGwgdGhlIGZpZWxkcyBp biBDcmVhdGVTRCBhcmUgYWxyZWFkeSBwcmVzZW50PGJyPg0KaW4gYW4gSW5zdGFsbFRBIG1lc3Nh Z2UgKGV4Y2VwdCB0aGUg4oCcZGlk4oCdIGZpZWxkIG1lbnRpb25lZCBhYm92ZSBpbiBpc3N1ZSAj NSksPGJyPg0Kc28gaXQgY291bGQgYmUgZG9uZSBhdXRvbWF0aWNhbGx5IGJ5IHRoZSBmaXJzdCBJ bnN0YWxsVEEgbWVzc2FnZSBpdHNlbGYuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDcwQzAi PltBQV0gd2hlbiB0aGUgU0QgaXMgY3JlYXRlZCwgYW4gYXN5bW1ldHJpYyBrZXlwYWlyIGlzIGdl bmVyYXRlZCAoc3BhaWspLCBhbmQgdGhlIHB1YmxpYyBwYXJ0IG9mIHRoaXMgaXMgcmV0dXJuZWQu IFdoZW4gYSBUQSBpcyBpbnN0YWxsZWQsIGl0IGlzIGVuY3J5cHRlZCB3aXRoIHRoaXMga2V5LiBU aGlzIGVuYWJsZXMgc29tZQ0KIHVzZSBjYXNlcyB3aGVyZSBhIFRBTSBjb3VsZCBpbnRlcmZhY2Ug dG8gYSBTUCBhbmQgZW5hYmxlIGFuIFNQIHRvIHByb3ZpZGUgdGhlIFRBIGVuY3J5cHRlZCBzdWNo IHRoYXQgdGhlIFRBIGJpbmFyeSBpcyBub3Qga25vd24gYnkgdGhlIFRBTS48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDcwQzAiPlRoZSBzcGFpayBpcyBhbHNvIHVzZWQgdG8gZW5j cnlwdCB0aGUgcGVyc29uYWxpemF0aW9uIGRhdGEgKHRoYXQgaXMgYWxzbyBzZW50IGluIEluc3Rh bGxUQSksIGFuZCB0aGVyZSBpcyBhbHNvIGEgdXNlIGNhc2UgZm9yIGEgVEFNIGludGVyZmFjaW5n IHRvIGFuIFNQIGluIG9yZGVyIHRoYXQgdGhlIFNQIGVuY3J5cHRzDQogcGVyc28gZGF0YSBmb3Ig dGhhdCBURUUgc3VjaCB0aGF0IGl0IHRyYXZlbHMgdmlhIHRoZSBUQU0gdG8gdGhlIFRFRSwgYnV0 IHdpdGhvdXQgdGhlIFRBTSBoYXZpbmcgYWNjZXNzIHRvIHRoYXQgZGF0YTxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+U2luY2UgSW5zdGFsbFRBIHJlcXVpcmVzIGtub3ds ZWRnZSBvZiB0aGUgcHVibGljIGtleSByZXR1cm5lZCBmcm9tIENyZWF0ZVNELCBpdCBpcyB0cnVl IHRoYXQgdGhlIGV4dHJhIHJvdW5kIHRyaXAgaXMgcmVxdWlyZWQuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFu IHN0eWxlPSJjb2xvcjojMDA3MEMwIj5TbyB0aGUgcXVlc3Rpb24gaXMgd2hldGhlciB0aGVyZSBp cyBhIGNhc2UgZm9yIGluc3RhbGxpbmcgVEEgKGFuZCB0aGVpciBhY2NvbXBhbnlpbmcgcGVyc28g ZGF0YSkgd2l0aG91dCB0aGUgYWJpbGl0eSB0byBwcm92aWRlIGNvbmZpZGVudGlhbGl0eSBiZXR3 ZWVuIGFuIFNQIGFuZCB0aGUgVEVFIGJ5IG1ha2luZyB0aGF0DQogbGF5ZXIgb2YgZW5jcnlwdGlv biBvcHRpb25hbCwgYW5kIGJ5IGFsbG93aW5nIHRoZSBUQSAoYW5kIHBlcnNvIGRhdGE/KSB0byBi ZSBidW5kbGVkIGludG8gQ3JlYXRlU0Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5 N0QiPk15IG1haW4gcG9pbnQgaXMgdGhhdCBpdCBzaG91bGQgYmUgcG9zc2libGUgdG8gY29tYmlu ZSBDcmVhdGVTRCBpbnRvIHRoZSBmaXJzdCBJbnN0YWxsVEEgYW5kIGJlIG1vcmUgZWZmaWNpZW50 LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJjb2xvcjojMUY0OTdEIj5BbHNvIHJlbWVtYmVyIHRoYXQgdGhlIFRBIGJpbmFyeSBuZWVkIG5v dCBjb21lIGZyb20gdGhlIFRBTS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDcw QzAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS43NWluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlz dDpsMCBsZXZlbDEgbGZvMyI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+NCk8c3BhbiBzdHlsZT0i Zm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPlRoZSBzY29wZSBvZiB1bmlx dWVuZXNzIG9mIHRoZSDigJxyaWTigJ0gYW5kIOKAnHRpZOKAnSBmaWVsZHMgaXMgdW5kZXJzcGVj aWZpZWQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjEuMGluIj5UaGV5IGp1c3Qgc2F5IOKAnHVuaXF1ZeKAnS4mbmJzcDsgSSB0 aGluayDigJxyaWTigJ0gaXMganVzdCBzdXBwb3NlZCB0byBiZSB1bmlxdWUgd2l0aGluPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluIj5hIGdpdmVuIHtzZXNzaW9uLOKAnXRpZOKAnX0gYnV0IEkgY2Fu4oCZdCB0ZWxsIGZv ciBzdXJlLiZuYnNwOyBBbmQgSSB0aGluayDigJx0aWTigJ0gaXMganVzdCBzdXBwb3NlZDxicj4N CnRvIGJlIHVuaXF1ZSB3aXRoaW4gYSBnaXZlbiBzZXNzaW9uIChub3QgZ2xvYmFsbHkgYWNyb3Nz IGFsbCBzZXNzaW9ucywgYWxsIFRBTXMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlz dFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj5hbGwgZGV2aWNlcyksIGJ1dCBJ IGNhbuKAmXQgdGVsbC4mbmJzcDsmbmJzcDsgVGhleeKAmXJlIGFsc28gZm9ybWF0dGVkIGFzIHN0 cmluZ3MsIGJ1dCBJ4oCZbSBub3Qgc3VyZTxicj4NCndoeSB0aGV5IGNhbuKAmXQgYmUgaW50ZWdl cnMgd2hpY2ggSSB0aGluayB3b3VsZCBiZSBtdWNoIG1vcmUgZWZmaWNpZW50Li48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIj48c3BhbiBzdHlsZT0iY29sb3I6IzAw NzBDMCI+W0FBXSBhbHRob3VnaCBpdCBpcyBub3QgbWFuZGF0ZWQsIHJhbmRvbSBndWlkcyBjYW4g YmUgYSB2aWFibGUgaW1wbGVtZW50YXRpb24gY2hvaWNlIGZvciB0aGVzZSAoYXMgaXQgdGFrZXMg YXdheSB0aGUgcmVxdWlyZW1lbnQgdG8gbWFuYWdlIGluY3JlbWVudGFsIGNvdW50ZXJzKSDigJMg c28gSSB3b3VsZCBub3Qgd2FudCB0byBzZWUgdGhlc2UgYmVjb21lDQogaW50ZWdlcnMuIEJ5IG1h a2luZyB0aGVtIHN0cmluZ3MsIGEgVEFNIGNhbiBjaG9vc2UgdGhlIG1lY2hhbmlzbSBpdCB3YW50 cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDcwQzAiPkkgdGFrZSB5b3VyIHBvaW50IGFib3V0IOKAnHJpZOKA nSBhbmQg4oCcdGlk4oCdIGJlaW5nIHVuZGVyc3BlY2lmaWVkLiBUaGUgdHJ1dGggaXMgdGhhdCB2 YWx1ZXMgY29udGFpbmVkIGluIHRoZXNlIGZpZWxkcyBkb27igJl0IG1hdHRlciB0byB0aGUgcHJv dG9jb2wgbXVjaC4gKHRoZXkgYXJlIG1vc3RseSBmb3IgdGhlIGNvbnZlbmllbmNlIG9mIHRoZSBU QU0gaW4gb3JkZXINCiB0byBtYXRjaCB1cCByZXF1ZXN0IGFuZCByZXNwb25zZSBtZXNzYWdlcyAo cmlkKSwgYW5kICh0aWQpIHRvIHVuZGVyc3RhbmQgd2hpY2ggbWVzc2FnZXMgYmVsb25nIGluIGEg 4oCYY29udmVyc2F0aW9u4oCZKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQ YXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0 OTdEIj5Vbmxlc3MgdGhlcmUgaXMgYSByZWFzb24gYSBndWlkIGlzIGFjdHVhbGx5IG5lZWRlZCAo ZS5nLiwgZ2xvYmFsIHVuaXF1ZW5lc3MpLCBJIHdvdWxkIGFyZ3VlIGFnYWluc3QgdGhhdCBhZGRp dGlvbmFsIGNvbXBsZXhpdHkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xp c3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxzcGFuIHN0eWxlPSJjb2xvcjoj MUY0OTdEIj5JZiBhbGwgeW91IG5lZWQgaXMgdW5pcXVlbmVzcyB3aXRoaW4gYSBzZXNzaW9uLCBh IHNpbXBsZSBzZXF1ZW5jZSBudW1iZXIgd291bGQgc3VmZmljZS48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS43NWluO3Rl eHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMyI+DQo8IVtpZiAhc3VwcG9y dExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWY7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1z by1saXN0Oklnbm9yZSI+NSk8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcg Um9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3Nw YW4+PCFbZW5kaWZdPkkgZm91bmQgaXQgY29uZnVzaW5nIHRoYXQgdGhlIG5hbWVzIG9mIHRoZSBt ZXNzYWdlcyBkb27igJl0IG1hdGNoIHRoZSBuYW1lIHZhbHVlczxicj4NCmluIHRoZSBtZXNzYWdl cyB0aGVtc2VsdmVzICjigJxHZXREZXZpY2VTdGF0ZVJlc3BvbnNl4oCdIHZzIDxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90 OyxzZXJpZiI+DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFn cmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj7igJxHZXREZXZpY2VURUVTdGF0ZVRCU1Jl c3BvbnNl4oCdLCBldGMuKSZuYnNwOyZuYnNwOyBIYXZpbmcgdGhlc2Ugbm90IG1hdGNoIGlzIGJ1 Zy1wcm9uZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwNzBDMCI+W0FBXSBJIGFncmVlLiBJbnN0ZWFkIG9mIGhhdmluZyBh IG1peHR1cmUgb2YNCjxiPkdldERldmljZVN0YXRlPC9iPlhYWCBhbmQgPGI+R2V0RGV2aWNlVEVF U3RhdGU8L2I+WFhYIHRoZXkgc2hvdWxkIGFsbCBzdGFuZGFyZGl6ZSBvbg0KPGI+R2V0RGV2aWNl VEVFU3RhdGU8L2I+WFhYLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0 UGFyYWdyYXBoIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Tm9kZSB0aGF0IHRoZXJlIGFy ZSBpbnRlbnRpb25hbCBkaWZmZXJlbmNlcyBhdCB0aGUgZW5kIG9mIHRob3NlIHdvcmRzIChlLmcu IEdldERldmljZVRFRVN0YXRlPGI+VEJTUmVzcG9uc2U8L2I+IHZzIEdldERldmljZVRFRVN0YXRl PGI+UmVzcG9uc2U8L2I+IGlzIGludGVudGlvbmFsIGFzIG9uZSBvZiB0aGVzZSBpcyB0aGUg4oCY dG8gYmUgc2lnbmVk4oCZDQogZGF0YSBhbmQgdGhlIG90aGVyIGlzIHRoZSBzaWduZWQgZGF0YS48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SSBkb27igJl0IHVuZGVy c3RhbmQsIGFuZCB0aGUgdGVybXMgc2VlbSB0byBiZSBpbnRlcmNoYW5nZWFibGUgaW4gdGhlIGRv Yywgc28gaWYgdGhlcmUgaXMgYSBkaXN0aW5jdGlvbiwgaXTigJlzIG5vdCBleHBsYWluZWQgY2xl YXJseSBpbiB0aGUgZG9jLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0 UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFG NDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjc1aW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1s aXN0OmwwIGxldmVsMSBsZm8zIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90Oyxz ZXJpZjtjb2xvcjojMUY0OTdEIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj42KTxzcGFu IHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+SXTigJlzIHVu Y2xlYXIgd2hldGhlciBhIHJpY2ggYXBwIGNhbiBkZXBlbmQgb24gdHdvIFRB4oCZcyBmcm9tIGRp ZmZlcmVudCBUQU1zLDxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+YW5k IHdoZXRoZXIgYSBUQSBjYW4gZGVwZW5kIG9uIGEgVEEgZnJvbSBhIGRpZmZlcmVudCBUQU0uJm5i c3A7IEluIHRoZSB1c2UgY2FzZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+d2hlcmUgdGhlIGRldmljZSBhZG1pbiBy dW5zIHRoZSBUQU0gYW5kIGNvbnRyb2xzIGFsbCBUQXMgb24gdGhlaXIgZGV2aWNlcyB0aGU8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPmFuc3dlciB3b3VsZCBiZSBuby4mbmJzcDsgQnV0IGluIG90aGVyIHVzZSBjYXNl cyBJ4oCZbSBub3Qgc3VyZS4mbmJzcDsmbmJzcDsgSWYgc28sIHRoZW4gdGhlIHF1ZXN0aW9uPGJy Pg0KYXJpc2VzIGFib3V0IGhvdyBkZXBlbmRlbmNpZXMgYXJlIGV4cHJlc3NlZCBhbmQgd2hldGhl ciBhIGRlcGVuZGVuY3kgbmVlZHM8YnI+DQp0byBleHByZXNzIHdoaWNoIFRBTSBpcyB1c2VkLiZu YnNwOyBUaGlzIHRoZW4gYmVncyB0aGUgcXVlc3Rpb25zIG9mIHdoZXRoZXIgYSBUQSBtaWdodDxi cj4NCmJlIHZpYSBtb3JlIHRoYW4gb25lIFRBTSwgb3IgbWlnaHQgY2hhbmdlIFRBTXMgb3ZlciB0 aW1lLiZuYnNwOyZuYnNwOyBUaGUgYW5zd2VycyBoZXJlPGJyPg0KcHJvYmFibHkgYmVsb25nIGlu IHRoZSBhcmNoIGRvYy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+W0FBXSBUQSBp bnRlci1kZXBlbmRlbmN5IGlzIGNvbXBsZXRlbHkgb3V0IG9mIHRoZSBzY29wZSBvZiB0aGUgT1Ry UCBwcm90b2NvbC4gKHNvIHRoZSByaWNoIGFwcCB2ZW5kb3IgbmVlZHMgdG8ga25vdyBhbGwgdGhl IFRBIElEcyB0aGV5IG5lZWQgaW5zdGFsbGluZywgYW5kIHdoaWNoIFRBTShzKSB0byBnZXQgdGhl bSBmcm9tKS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPlRBcyBpbmhlcmVu dGx5IGNhbiBkZXBlbmQgb24gb3RoZXIgVEHigJlzLiZuYnNwOyBJIGRvbuKAmXQgdGhpbmsgaXQg c2hvdWxkIGJlIG91dCBvZiBzY29wZSBmb3IgdGhlIFdHLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6IzFGNDk3RCI+RGF2ZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ib2R5 Pg0KPC9odG1sPg0K --_000_DM5PR2101MB0805A7BEC6DE90EC6910088CA35D0DM5PR2101MB0805_-- From nobody Mon Jul 16 20:15:47 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40801130F02 for ; Mon, 16 Jul 2018 20:15:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.31 X-Spam-Level: X-Spam-Status: No, score=-4.31 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symantec.com header.b=dtBgQ9mm; dkim=pass (1024-bit key) header.d=symantec.com header.b=H9+l/RS3 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jOM2EtRWz_Xn for ; Mon, 16 Jul 2018 20:15:41 -0700 (PDT) Received: from tussmtoutape01.symantec.com (Tussmtoutape01.symantec.com [155.64.38.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4016130EF8 for ; Mon, 16 Jul 2018 20:15:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=Symantec.com; s=1; c=relaxed/simple; q=dns/txt; i=@Symantec.com; t=1531797340; x=2395710940; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=/FLf+0xRWOwPFKDsC7Xy/xtLRmMLv9VErTFNGAMbaQU=; b=dtBgQ9mmsB40kjJ53WWrzgeicaORr9moOIG1esHVMYoSrDymJI/X3JgPPfMDHe9Q tUpjmiOXQ038XBksSjwYpM0ph2pP1QTTWdjv+hBgE7f7SJVssGmSqVHYd4Q8lEMj hh4KW4QsHXHx7zt3uyZqQFp75kDN03IGkyLBPxuzP1U=; Received: from tussmtmtaapi02.symc.symantec.com (tus3-f5-symc-ext-prd-snat6.net.symantec.com [10.44.130.6]) by tussmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id BC.F4.35854.C5F5D4B5; Tue, 17 Jul 2018 03:15:40 +0000 (GMT) X-AuditID: 0a2c7e31-ae2839e000018c0e-9e-5b4d5f5c9c69 Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (tus3-f5-symc-ext-prd-snat10.net.symantec.com [10.44.130.10]) by tussmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id C3.7B.06107.95F5D4B5; Tue, 17 Jul 2018 03:15:37 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 16 Jul 2018 20:15:36 -0700 Received: from NAM01-BY2-obe.outbound.protection.outlook.com (10.44.128.2) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Mon, 16 Jul 2018 20:15:36 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symantec.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/FLf+0xRWOwPFKDsC7Xy/xtLRmMLv9VErTFNGAMbaQU=; b=H9+l/RS38jwhb8s6k1DZ+gCE3mu48vCQePznPIpaycVp1aLtcxm3/kH7X7uIbe+60Z87iyVv4VQnfEZA0y0cbyAk/JM3KqL/fZtlTe/Miza+TjPfD261AKMx0nKQ02Wf7m4LWSng0MxolDfkiTJAORLRg2CqkIDyJc59pEYL0Cg= Received: from BY2PR16MB0854.namprd16.prod.outlook.com (10.164.172.140) by BY2PR16MB0152.namprd16.prod.outlook.com (10.163.65.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.952.19; Tue, 17 Jul 2018 03:15:34 +0000 Received: from BY2PR16MB0854.namprd16.prod.outlook.com ([fe80::f45c:c55:6931:d9be]) by BY2PR16MB0854.namprd16.prod.outlook.com ([fe80::f45c:c55:6931:d9be%3]) with mapi id 15.20.0952.021; Tue, 17 Jul 2018 03:15:34 +0000 From: Mingliang Pei To: Dave Thaler , Andrew Atyeo , "teep@ietf.org" Thread-Topic: [Teep] Implementation feedback on draft-ietf-teep-opentrustprotocol-01 Thread-Index: AQHUHXxtkKoaWsfgnUel1QbgYTRqxA== Date: Tue, 17 Jul 2018 03:15:34 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.d.1.180523 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Mingliang_Pei@symantec.com; x-originating-ip: [207.115.96.130] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BY2PR16MB0152; 7:otrZx3f1WNSLbh5SjZ5Xp9b0T/zNLtIV56XNtMzz3DS22idP76pNz4gzz6+Alc0kVSdSYQIT9+XR3TRBuiNkXKUyqrskqGuDPO40aG3O2bqMbeo9Nr393hFy87EWvChXqIIaQIOGL3qXJRW2XzoWRjA1E0xtZjFSi/Tkn84VRZcTAyUAl05TO+v6nWAu0/SzEA5tyffD0g5Ke8nM+AI6Kuf43q3lxZuB/RU3fu96j4ifUM3yfpxM+Rv/XZdmiMkH x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 0a8aeca0-6646-4193-18ff-08d5eb938fcd x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:BY2PR16MB0152; x-ms-traffictypediagnostic: BY2PR16MB0152: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(10201501046)(3231311)(944501410)(52105095)(3002001)(93006095)(93001095)(149027)(150027)(6041310)(20161123558120)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(6072148)(201708071742011)(7699016); SRVR:BY2PR16MB0152; BCL:0; PCL:0; RULEID:; SRVR:BY2PR16MB0152; x-forefront-prvs: 073631BD3D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(39860400002)(136003)(346002)(366004)(60444003)(199004)(189003)(229853002)(58126008)(81156014)(6116002)(25786009)(83716003)(86362001)(478600001)(26005)(80792005)(66066001)(3846002)(68736007)(7736002)(5250100002)(72206003)(2616005)(102836004)(6486002)(790700001)(8936002)(8676002)(14444005)(110136005)(106356001)(81166006)(97736004)(186003)(10290500003)(256004)(105586002)(6512007)(54896002)(5660300001)(36756003)(2501003)(99286004)(486006)(82746002)(33656002)(316002)(6436002)(14454004)(6306002)(476003)(53936002)(2900100001)(53546011)(6506007)(2906002)(6246003); DIR:OUT; SFP:1101; SCL:1; SRVR:BY2PR16MB0152; H:BY2PR16MB0854.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: GK9mZ5wk4RdTykcQ2SCt6Mp5+p5y4AeENTnNc/qYcrbqkg3oAYVoFgDT2T5L+AaQvVA4+YHlgvgaZnzntWdfX86VQMNhZmi01iqkVfaMG7XujyOy1q2XCBrKtFbUk/ExBXz8NsYDrA3EcJ7UAQ6GDG/Q4qIEVpEXFBTpRa+nxFy9qpGzhqdEOfPhJxQlKoSlgUdUT8gXTLrKXtlfTcxFC8aF60wKMk1wTwChAgI6DEYbWoT+XEFxlw3TA74HFoVYiLfkQdBkU8ZVMyJMmlc/GVmF+zCkjw147prRDURX9nwkdS9NJN4fl3Vc59mszOg8ygkqRz69T8gx5Q2c4O3D+Na1YbBQaiJhDN4Kh3qtbgo= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_F77F1C855AA14554B565246A376294FCsymanteccom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 0a8aeca0-6646-4193-18ff-08d5eb938fcd X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Jul 2018 03:15:34.6835 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR16MB0152 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA01Sa0hTYRjmO+dsHpeLr6X5qmU1ElO8TAu0iC5/YpSiPyrCa0c9qKnTtikq ZOIVNFFJWw5FJS2wTFsiVoq1NOYFFE0kK/EWqClIpHPlpW3nCP75eL73eb7nex54aVIyKHCm ExVqVqlgkqVCESXyyhN6R0QHh8v6mx0DuzZ6icDp+nUisHlrg7xMyg3PvgjkTU0mQt7eMEOE kmGiC3FscmIGq/S9eEeU0Nz1HKXl7RCZI73bNrmo+A9RgmxpwGehULNOliARLcG/EbSNPxbu EZut2zYcYULwb+yHjYWQ4D4E09ogjlhEMFcwQlkuFK4gQVdXiTjmEQFLjcu88QyCr92rZmOa FmIZjH5XWKzscRGCSY2LZXwY34QXuxQ3vgUzjUYBh33gSU+VNRKF3WBVZ7JqxPgS9Cy/tiZC +AgYB19a+5DYEaYW6vluGJq6R0gOO8DS/I7V08Hs+fDthJB7GwmmghlkiQBYCu3zAZz8GIzV l1qrAO4g4INxgPfxhrXqah4Hw9ykTsiJRhEYyoz8x57wt6uIx0lgHBjm8TXYHS7nH7tCS9ks VYH8tftyczgWBt/oSa215yEYqFmgtOZ8JPaAtne+nOQkVJXO2nD4NBTW1vFYDpXfflL7NQ2I bkEn1OkqVYo6NV3NpLEyPx9VVkqs5WDM+xXrE5uaokPWDcvx60Jz7UF6hGkktRO7RQaHSwRM hlmpR0CTUntxUrh5JI5jsrJZZWq0Mj2ZVemRC01JHcUrYk2YBMczajaJZdNY5R5L0LbOucht XbH56WjUmdBAWWeO/0rV8RA6KyTG/aCpr/i+9sqSh8IpuiYhpj7Uw3R3zEnWUP5r82m8PJz5 qC+5MWSI6lg75TXl7avsN+jOb2wRrYufFXERiZW1189FXVXv5KcPvL/3KvuBdHjyQIV7gGZi Z3o8tPP2kLGoTONql5+J7FeWpJQqgfHzJJUq5j/oqrsgXQMAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrPKsWRmVeSWpSXmKPExsXCpdPEpRsZ7xttsHOzocWOb/uZLO7N/8pk sfTPN2YHZo8Ty66weixZ8pPJY8OCB0wBzFFcNimpOZllqUX6dglcGUt3LGcsaPrHVHF+/1/2 Bsb2L0xdjJwcEgImEj/W/mXvYuTiEBL4ySjx+9JddpCEkMARRol7s3wgEi8YJR61nGcBcVgE JjBLbJo7kREiM5lJ4uXCV8wQzgNGiZt73rJ1MXJwsAkYSFy4kwcySkSgjVHi+nRpkLCwQKjE 6v8sEOEwiQcLv7NC2HoSM/ZOYQOxWQRUJd5u+glWwytgL7H31UawixgFxCS+n1oDdjazgLjE rSfzoV4QkFiy5zwzhC0q8fLxP7CZokAze3ZeZYPojZX42fKAEeQECQEliQ2PzSHKZSUuze8G e0VCYAuTxIHvJ6Hm6Ep8mDoVyvaVeHR9ExtE0QVGiRO936EWa0n82tEGZWdLfD95Bsr2kvh/ ph+qWU5iVe9DFojmTcwSbzpXs0MkZCQOrDnNNIFRbxaShyDsZIlTmw8xzwIHgKDEyZlPWGYB Hc4soCmxfpc+RImixJTuh+wQtoZE65y5ULaHxMTbT1mQ1Sxg5FjFqFBSWlycW5JbkphYkGlg pFdcmZsMIhKB6StZLzk/dxMjOIU5S+5gPPTH5xCjAAejEg/vjbk+0UKsiWVAlYcYpTlYlMR5 X3PdjBISSE8sSc1OTS1ILYovKs1JLT7EyMTBKdXAWHCFb82bNWnGrZcbVh7OdevQaW/Y2D/l o9WuW98CZOeo9P1+1fv3+/kWx8j1brP8t763+sJst6o+gcWZsYb1xYR5jz4WvlhvVvcwzGjz q/Lo90q6s23vdN7pWM45XamEe+npOC0BB6npMt8ETLJezbvIr/U0rff4LPbeLP13TfMUXE49 M380V4mlOCPRUIu5qDgRAPGTq8JCAwAA X-CFilter-Loop: TUS03 Archived-At: Subject: Re: [Teep] Implementation feedback on draft-ietf-teep-opentrustprotocol-01 X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Jul 2018 03:15:45 -0000 --_000_F77F1C855AA14554B565246A376294FCsymanteccom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VmVyeSBnb29kIGNvbW1lbnRzLCBEYXZlLiBQbGVhc2Ugc2VlIG15IGNvbW1lbnRzIGlubGluZSAo d2l0aCBbTVBdKSwgTWluZw0KDQpGcm9tOiBURUVQIDx0ZWVwLWJvdW5jZXNAaWV0Zi5vcmc+IG9u IGJlaGFsZiBvZiBEYXZlIFRoYWxlciA8ZHRoYWxlcj00MG1pY3Jvc29mdC5jb21AZG1hcmMuaWV0 Zi5vcmc+DQpEYXRlOiBNb25kYXksIEp1bHkgMTYsIDIwMTggYXQgMTE6MDAgQU0NClRvOiBBbmRy ZXcgQXR5ZW8gPEFuZHJldy5BdHllb0BpbnRlcmNlZGUuY29tPiwgInRlZXBAaWV0Zi5vcmciIDx0 ZWVwQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtUZWVwXSBJbXBsZW1lbnRhdGlvbiBmZWVkYmFj ayBvbiBkcmFmdC1pZXRmLXRlZXAtb3BlbnRydXN0cHJvdG9jb2wtMDENCg0KQW5kcmV3IHdyaXRl czoNCuKApg0KDQoxKSAgICAgIFNlY3Rpb24gNi41IGV4cGxhaW5zIHRoYXQgdGhlIFRBTSBuZWVk cyB0byByZWNlaXZlIGEgbGlzdCBvZiBvbmUgb3IgbW9yZQ0KDQpUQeKAmXMgdGhhdCBhcmUgcmVx dWVzdGVkIHRvIGJlIGluc3RhbGxlZCAoUzYuNS4xIHBvaW50IDFBKS4gIEhvd2V2ZXIsIG5vDQoN Cm1lc3NhZ2UgaXMgZGVmaW5lZCBmb3IgZG9pbmcgc28sIHdoaWNoIHByZXZlbnRzIGludGVyb3Bl cmFiaWxpdHkuICBJDQp0aGluayB0aGlzIG1lc3NhZ2UgbmVlZHMgdG8gYmUgZ2VuZXJhdGVkIGJ5 IHRoZSBURUUgKG5vdCB0aGUgcmljaCBhcHApLA0KZm9yIHJlYXNvbnMgSSB3aWxsIGV4cGxhaW4g aW4gIzMgYmVsb3cuDQoNCltBQV0gSSBkb27igJl0IHNlZSB0aGUgbmVlZCBmb3IgYSBtZXNzYWdl IGZvciBkZWZpbmluZyB0aGUgVEFzIHRoYXQgbmVlZCB0byBiZSBpbnN0YWxsZWQuIFRoZSBPVHJQ IG1lc3NhZ2VzIGFyZSBiZXR3ZWVuIHRoZSBUQU0gYW5kIHRoZSBURUUsIGJ1dCB0aGUgZGVzaXJl IHRvIGluc3RhbGwgVEFzIGNvbWVzIGZyb20gdGhlIHJpY2ggYXBwLiAgSW4gcHJhY3RpY2UsIGEg cmljaCBhcHAgd2lsbCBoYXZlIHRoZSBpZGVudGlmaWVycyBvZiB0aGUgVEFzIGl0IHJlcXVpcmVz IGJ1aWx0IGludG8gaXRzIG93biBjb2RlLCBzaW5jZSBpdHMgb3duIGNvZGUgd2lsbCBhbHNvIGJl IGNhbGxpbmcgdGhvc2UgVEFzIChlLmcuIG9uY2UgaW5zdGFsbGVkLCB0byBwZXJmb3JtIHNvbWUg RFJNIG9yIHBheW1lbnQgYXV0aGVudGljYXRpb24pLiBUaGVyZWZvcmUgYSByaWNoIGFwcCBpcyBh d2FyZSBvZiB0aGUgVEFzIGl0IG5lZWRzLiAgSSBkb27igJl0IHRoaW5rIHRoaXMgaW5mbyBjYW4g Y29tZSBmcm9tIHRoZSBURUUg4oCTIHNpbmNlIGF0IHRoaXMgcG9pbnQgdGhlIFRBIGlzIG5vdCBp bnN0YWxsZWQgeWV0LCBzbyB3aGljaCBwYXJ0IG9mIHRoZSBURUUgd291bGQgaGF2ZSB0aGUga25v d2xlZGdlIG9mIHdoaWNoIFRBcyBhcmUgbmVlZGVkPw0KDQoNCg0KQXMgSSBub3RlZCBpbiBteSBh cmNoIGRvYyBjb21tZW50cywgSSBkaXNhZ3JlZSB0aGF0IHRoZXJlIG5lZWRzIHRvIGJlIGFueSBj b21tdW5pY2F0aW9uIGJldHdlZW4gdGhlIHJpY2ggYXBwIGJlaW5nIGluc3RhbGxlZCwgYW5kIHRo ZSBUQU0uICBBIHZhbGlkIGltcGxlbWVudGF0aW9uIG1vZGVsIHNob3VsZCBiZSB0aGF0IHRoZSBh cHAgc3RvcmUgaW5zdGFsbGVyIHJlYWRzIHRoZSBtZXRhZGF0YSAoaW5jbHVkaW5nIFRBIGRlcGVu ZGVuY2llcykgYWJvdXQgdGhlIHJpY2ggYXBwLCBhbmQgYXMgcGFydCBvZiBpbnN0YWxsaW5nIHRo ZSByaWNoIGFwcCAod2l0aG91dCBldmVyIG5lZWRpbmcgdG8gcnVuIGl0KSwgdGhlIGluc3RhbGxl ciBjYW4gY29tbXVuaWNhdGUgd2l0aCB0aGUgVEVFIHRvIGV4cHJlc3MgdGhvc2UgZGVwZW5kZW5j aWVzLCB3aGljaCB0aGVuIHRyaWdnZXJzIHRoZSBURUUgdG8gZ2VuZXJhdGUgYSBzaWduZWQgbWVz c2FnZSB0byB0aGUgVEFNLCB3aGljaCBjYW4gYmUgcmVsYXRlZCBieSB0aGUgaW5zdGFsbGVyLg0K DQoNCg0KW01QXSBUaGUgcmVxdWVzdGVkIFRBIGJ5IGEgUmljaCBBcHAgY2FuIGdvIGJ5IGl0c2Vs Ziwgb3Igbm90ZWQgYnkgYW4gaW5zdGFsbGVyIHZpYSBpdHMgbWV0YWRhdGEuIEl0IGZ1bmRhbWVu dGFsbHkgZXhwcmVzcyB0aGUgbmVlZC4gSXQgbWF5IG5vdCBtYXR0ZXIgaXQgaXMgdGhlIFJpY2gg QXBwIG9yIGFuIGluc3RhbGxlciB0aGF0IGRvZXMgdGhlIGpvYiBvbiBiZWhhbGYgb2YgdGhlIFJp Y2ggQXBwIHRvIG1ha2UgdGhlIGNhbGwuICBUaGF0IHdhcyBpbnRlbnRpb25hbGx5IGxlZnQgb3V0 IG9mIHRoZSBzY29wZS4gV2UgbGVmdCB0aGlzIGNob2ljZSB0byB0aGUgUmljaCBBcHAgaXRzZWxm LiBJdCBjYW4gZG8gaXRzZWxmLCBvciBsZXZlcmFnZSBhbiBpbnN0YWxsZXIgb3Igb3RoZXIgcHJv Z3JhbSB0byBkbyBpdC4NCg0KDQoNClRoZSBtYWluIGludGVyZmFjZSBmb3IgaW50ZXJvcGVyYWJp bGl0eSBpcyB3aGF0IFRFRSBzaG91bGQgcHJlcGFyZSB0byBhY2NlcHQgZnJvbSBhIFJpY2ggQXBw IG9yIGFuIGluc3RhbGxlciBpbiBSRUUuIFRoaXMgd2FzIHRoZSBpbnRlbnQgb2YgYW4gT1RyUCBh Z2VudC4NCg0KDQoNClRoZXJlIGlzIG9uZSBtYWpvciBkaWZmZXJlbmNlIGluIGNvbnRhY3Rpbmcg VEVFIGZpcnN0IHZzLiBjb250YWN0aW5nIFRBTSBmaXJzdC4gV2hlbiBhIFJpY2ggQXBwIG9yIGFu IGluc3RhbGxlciBiZWluZyBpdHMgZGVsZWdhdGUgbGV0cyBURUUgdG8gZ2VuZXJhdGUgYSByZXF1 ZXN0LCBhIFRFRSBuZWVkcyBhdXRob3JpemUgc3VjaCBhIHJlcXVlc3QuIFRoZXJlIGlzIHNvbWUg cm9sZSByZWxhdGlvbnNoaXAgdG8gYWdyZWUgb24gaGVyZS4gQSBkZXZpY2UgaXMgbWFuYWdlZCBi eSBhIFRBTSwgYW5kIFRBTeKAmXMgaW5pdGlhdGVkIGNhbGwgY2FuIGJlIGF1dGhvcml6ZWQgYnkg YSBURUUuIE5vdywgZG9lcyB0aGUgVEVFIGhhdmUgdG8gYXV0aG9yaXplIGJvdGggYW4gaW5zdGFs bGVyIC8gUmljaCBBcHAgaW50ZW50IGFuZCBhbHNvIGEgVEFNIGZvciBhIFRBIGluc3RhbGxhdGlv bj8gT3IgeW91IG1lYW4gYnkg4oCccmVsYXRlZCBieSB0aGUgaW5zdGFsbGVy4oCdIHRoYXQgdGhl IGZpcnN0IGF1dGhvcml6YXRpb24gaXMgZGVsZWdhdGVkIGZyb20gVEVFIHRvIFRBTSwgYW5kIFRB TSB3aWxsIG1ha2UgYSBkZWNpc2lvbiB3aGV0aGVyIGl0IHdpbGwgaG9ub3IgYW4gaW5zdGFsbGVy 4oCZcyByZXF1ZXN0IGFib3V0IGEgUmljaCBBcHDigJlzIGRlc2lyZSB0byB1c2UgYSBUQSB0aGF0 IGl0IG1hbmFnZXMsIHJpZ2h0Pw0KDQotLS0NCg0KSW4gdGhlIGxlc3MgZWZmaWNpZW50IG1vZGVs IHdoZXJlIHRoZSByaWNoIGFwcCBoYXMgdG8gYmUgcnVuLCBhcyB0aGUgZG9jIGltcGxpZXMsIHRo ZSBzYW1lIHByb2Nlc3MgY2FuIG9jY3VyIHdoZXJlIHRoZSBURUUgZ2VuZXJhdGVzIHRoZSBtZXNz YWdlIGluIHJlc3BvbnNlIHRvIHRoZSByaWNoIGFwcCB0ZWxsaW5nIHRoZSBhZ2VudCBpdCBoYXMg YSBkZXBlbmRlbmN5Lg0KDQpbTVBdIHRydWUsIHRoaXMgaXMgb25lIG9mIHRoZSBtb2RlbHMuDQoN CuKApg0KDQpQdXR0aW5nIG15IGlzc3VlICMxIGFuZCBpc3N1ZSAjMiB0b2dldGhlciBtZWFucyB0 aGVyZeKAmXMgYW4gZXh0cmEgcm91bmQNCg0KdHJpcCB0aGF0IGlzIHVubmVjZXNzYXJ5LiAgNi41 IHNheXMgdGhlIFRBTSByZWNlaXZlIGEgbGlzdCBvZiBUQXMgbmVlZGVkLA0KDQphbmQgdGhlbiB0 aGUgVEFNIGp1c3QgZ29lcyBiYWNrIGFuZCBhc2tzIHdoYXQgaXMgaW5zdGFsbGVkLCBqdXN0IHRv IGdldA0KYSBsaXN0IG9mIHdoYXQgbmVlZHMgdG8gYmUgaW5zdGFsbGVkLiAgVGhpcyBpcyB1bm5l Y2Vzc2FyeSwgdGhlIFRFRSBjYW4ganVzdA0KDQpzZW5kIGEgbGlzdCBvZiBvbmUgb3IgbW9yZSBU QXMgdGhhdCBuZWVkIHRvIGJlIGluc3RhbGxlZCBhbmQgYXJlbuKAmXQgYWxyZWFkeS4NCg0KSG9w ZWZ1bGx5IHRoaXMgZXhwbGFpbnMgd2h5IEkgc2FpZCBpbiBpc3N1ZSAjMSBhYm92ZSB3aHkgSSB0 aGluayB0aGUgbWVzc2FnZQ0KbmVlZHMgdG8gYmUgZ2VuZXJhdGVkIGJ5IHRoZSBURUUuDQoNCltB QV0gYnV0IGhvdyBjb3VsZCB0aGUgVEVFICh3aGljaCBkb2VzbuKAmXQgaGF2ZSBpdHMgVEFzIGxv YWRlZCB5ZXQpIGtub3cgd2hhdCBUQXMgc2hvdWxkIGJlIGxvYWRlZD8NCg0KDQoNClRoZSBzYW1l IHBpZWNlIG9mIGNvZGUgdGhhdCBjb25uZWN0cyB0byB0aGUgVEFNIHRlbGxzIHRoZSBURUUgd2hh dCBUQeKAmXMgaXQgZGVzaXJlcy4NCg0KVGhlIFRFRSB0aGVuIGdlbmVyYXRlcyBhIG1lc3NhZ2Ug d2l0aCB0aGUgbGlzdCBvZiBUQXMgdGhhdCBhcmVu4oCZdCBhbHJlYWR5IGluc3RhbGxlZC4NCg0K DQoNCltNUF0gU2VlIGF1dGhvcml6YXRpb24gY29tbWVudCBhYm92ZSBmb3IgaG93IGEgVEVFIGF1 dGhvcml6ZXMgYSByZXF1ZXN0IGZyb20gYSBSaWNoIEFwcCAvIGluc3RhbGxlci4gRGVsZWdhdGVk IGZsb3cgd291bGQgbWVhbiB0aGF0IGl0IGFsd2F5cyBhY2NlcHQgYSByZXF1ZXN0LCBhbmQgZ2Vu ZXJhdGVzIGEgcmVxdWVzdC4gV291bGQgdGhpcyBjYXVzZSBzb21lIHNwYW0gYW5kIGF0dGFjayBp c3N1ZSB0byB0aGUgVEVFPyBPbiB0aGUgb3RoZXIgaGFuZCwgVEFNIGlzIGdpdmVuIHRvIGhhbmRs ZSBpdHMgY2xpZW50cyBiZWluZyBSaWNoIEFwcCBvciBhbiBpbnN0YWxsZXIgaW4gYSBSRUUgZXRj LCB3aGljaCBpcyBvdXQgb2YgdGhlIHNjb3BlIGluIG91ciBkZXNpZ24uDQoNCg0KDQrigKYNCg0K MykgICAgICBTZWN0aW9uIDYuNS4xIHBvaW50IDkuQSBpbXBsaWVzIHRoYXQgdG8gaW5zdGFsbCBh IFRBLCBvbmUgbXVzdCBoYXZlIGFuIGV4dHJhDQpyb3VuZCB0cmlwIGZpcnN0IHRvIGNyZWF0ZSBh biBTRCBpZiBvbmUgaXNu4oCZdCBhbHJlYWR5IHRoZXJlLiAgSSB3b3VsZCBleHBlY3Qgb25lDQpj b21tb24gY2FzZSB0byBiZSB3aGVyZSB0aGVyZSBpcyBvbmUgVEEgcGVyIFNELCBzbyB0aGF0IGFs bCBUQXMgYXJlIGlzb2xhdGVkDQpmcm9tIGVhY2ggb3RoZXIuICBBcyBzdWNoLCByZXF1aXJpbmcg dGhlIGV4dHJhIGRlbGF5IGlzIGluZWZmaWNpZW50IGluIHRpbWUsDQpiYW5kd2lkdGgsIGFuZCBw cm9jZXNzaW5nLiAgIEFsbCB0aGUgZmllbGRzIGluIENyZWF0ZVNEIGFyZSBhbHJlYWR5IHByZXNl bnQNCmluIGFuIEluc3RhbGxUQSBtZXNzYWdlIChleGNlcHQgdGhlIOKAnGRpZOKAnSBmaWVsZCBt ZW50aW9uZWQgYWJvdmUgaW4gaXNzdWUgIzUpLA0Kc28gaXQgY291bGQgYmUgZG9uZSBhdXRvbWF0 aWNhbGx5IGJ5IHRoZSBmaXJzdCBJbnN0YWxsVEEgbWVzc2FnZSBpdHNlbGYuDQpbQUFdIHdoZW4g dGhlIFNEIGlzIGNyZWF0ZWQsIGFuIGFzeW1tZXRyaWMga2V5cGFpciBpcyBnZW5lcmF0ZWQgKHNw YWlrKSwgYW5kIHRoZSBwdWJsaWMgcGFydCBvZiB0aGlzIGlzIHJldHVybmVkLiBXaGVuIGEgVEEg aXMgaW5zdGFsbGVkLCBpdCBpcyBlbmNyeXB0ZWQgd2l0aCB0aGlzIGtleS4gVGhpcyBlbmFibGVz IHNvbWUgdXNlIGNhc2VzIHdoZXJlIGEgVEFNIGNvdWxkIGludGVyZmFjZSB0byBhIFNQIGFuZCBl bmFibGUgYW4gU1AgdG8gcHJvdmlkZSB0aGUgVEEgZW5jcnlwdGVkIHN1Y2ggdGhhdCB0aGUgVEEg YmluYXJ5IGlzIG5vdCBrbm93biBieSB0aGUgVEFNLg0KVGhlIHNwYWlrIGlzIGFsc28gdXNlZCB0 byBlbmNyeXB0IHRoZSBwZXJzb25hbGl6YXRpb24gZGF0YSAodGhhdCBpcyBhbHNvIHNlbnQgaW4g SW5zdGFsbFRBKSwgYW5kIHRoZXJlIGlzIGFsc28gYSB1c2UgY2FzZSBmb3IgYSBUQU0gaW50ZXJm YWNpbmcgdG8gYW4gU1AgaW4gb3JkZXIgdGhhdCB0aGUgU1AgZW5jcnlwdHMgcGVyc28gZGF0YSBm b3IgdGhhdCBURUUgc3VjaCB0aGF0IGl0IHRyYXZlbHMgdmlhIHRoZSBUQU0gdG8gdGhlIFRFRSwg YnV0IHdpdGhvdXQgdGhlIFRBTSBoYXZpbmcgYWNjZXNzIHRvIHRoYXQgZGF0YQ0KU2luY2UgSW5z dGFsbFRBIHJlcXVpcmVzIGtub3dsZWRnZSBvZiB0aGUgcHVibGljIGtleSByZXR1cm5lZCBmcm9t IENyZWF0ZVNELCBpdCBpcyB0cnVlIHRoYXQgdGhlIGV4dHJhIHJvdW5kIHRyaXAgaXMgcmVxdWly ZWQuDQpTbyB0aGUgcXVlc3Rpb24gaXMgd2hldGhlciB0aGVyZSBpcyBhIGNhc2UgZm9yIGluc3Rh bGxpbmcgVEEgKGFuZCB0aGVpciBhY2NvbXBhbnlpbmcgcGVyc28gZGF0YSkgd2l0aG91dCB0aGUg YWJpbGl0eSB0byBwcm92aWRlIGNvbmZpZGVudGlhbGl0eSBiZXR3ZWVuIGFuIFNQIGFuZCB0aGUg VEVFIGJ5IG1ha2luZyB0aGF0IGxheWVyIG9mIGVuY3J5cHRpb24gb3B0aW9uYWwsIGFuZCBieSBh bGxvd2luZyB0aGUgVEEgKGFuZCBwZXJzbyBkYXRhPykgdG8gYmUgYnVuZGxlZCBpbnRvIENyZWF0 ZVNEDQoNCk15IG1haW4gcG9pbnQgaXMgdGhhdCBpdCBzaG91bGQgYmUgcG9zc2libGUgdG8gY29t YmluZSBDcmVhdGVTRCBpbnRvIHRoZSBmaXJzdCBJbnN0YWxsVEEgYW5kIGJlIG1vcmUgZWZmaWNp ZW50Lg0KQWxzbyByZW1lbWJlciB0aGF0IHRoZSBUQSBiaW5hcnkgbmVlZCBub3QgY29tZSBmcm9t IHRoZSBUQU0uDQoNCltNUF0gVGhpcyBjb3VsZCBiZSBhbiBvcHRpb24sIEkgdGhpbmssIHdoZW4g YSBUQSBiaW5hcnkgZW5jcnlwdGlvbiBpc27igJl0IG5lZWRlZC4gSG93ZXZlciwgd2UgZGlkIGVs YWJvcmF0ZSB0aGlzIGluIHRoZSB2ZXJ5IGJlZ2lubmluZyBvZiBwcm90b2NvbCBkZXNpZ24gd2hl dGhlciB3ZSBnaXZlIHN1Y2ggYW4gb3B0aW9uLiBXZSAoT1RyUCBBbGxpYW5jZSBhdCB0aGUgdGlt ZSkgYWdyZWVkIHRoYXQgdGhlIHByb3RlY3Rpb24gb2YgVEEgYmluYXJ5IGl0c2VsZiBpcyB2ZXJ5 IHZhbHVhYmxlLiBZb3UgZG9u4oCZdCB3YW50IHNvbWVvbmUgdG8gcmV2ZXJzZSBlbmdpbmVlciB5 b3VyIFRBIGNvZGUgdGhhdCBtYWtlcyBleHBsb2l0IGZpbmRpbmcgZWFzaWVyLiBJbiB0aGUgY3Vy cmVudCBkZXNpZ24sIGEgVEEgYmluYXJ5IGNvZGUgaXMgbmV2ZXIgZ2l2ZW4gY2xlYXIgdG8gYW55 IFJpY2ggQXBwIG9yIE1JVE0uIEl0IGlzIG9ubHkga25vd24gYnkgdGhlIGRldmVsb3BlciBhbmQg dGhlbiB0aGUgcnVubmluZyBkZXZpY2UgVEVFIGl0c2VsZi4gVGhpcyB3YXMgYSB2ZXJ5IGltcG9y dGFudCBkZXNpZ24gZ29hbCBpbiB0aGlzIHByb3RvY29sLg0KDQoNCjQpICAgICAgVGhlIHNjb3Bl IG9mIHVuaXF1ZW5lc3Mgb2YgdGhlIOKAnHJpZOKAnSBhbmQg4oCcdGlk4oCdIGZpZWxkcyBpcyB1 bmRlcnNwZWNpZmllZC4NCg0KVGhleSBqdXN0IHNheSDigJx1bmlxdWXigJ0uICBJIHRoaW5rIOKA nHJpZOKAnSBpcyBqdXN0IHN1cHBvc2VkIHRvIGJlIHVuaXF1ZSB3aXRoaW4NCg0KYSBnaXZlbiB7 c2Vzc2lvbizigJ10aWTigJ19IGJ1dCBJIGNhbuKAmXQgdGVsbCBmb3Igc3VyZS4gIEFuZCBJIHRo aW5rIOKAnHRpZOKAnSBpcyBqdXN0IHN1cHBvc2VkDQp0byBiZSB1bmlxdWUgd2l0aGluIGEgZ2l2 ZW4gc2Vzc2lvbiAobm90IGdsb2JhbGx5IGFjcm9zcyBhbGwgc2Vzc2lvbnMsIGFsbCBUQU1zLA0K DQphbGwgZGV2aWNlcyksIGJ1dCBJIGNhbuKAmXQgdGVsbC4gICBUaGV54oCZcmUgYWxzbyBmb3Jt YXR0ZWQgYXMgc3RyaW5ncywgYnV0IEnigJltIG5vdCBzdXJlDQp3aHkgdGhleSBjYW7igJl0IGJl IGludGVnZXJzIHdoaWNoIEkgdGhpbmsgd291bGQgYmUgbXVjaCBtb3JlIGVmZmljaWVudC4uDQoN CltBQV0gYWx0aG91Z2ggaXQgaXMgbm90IG1hbmRhdGVkLCByYW5kb20gZ3VpZHMgY2FuIGJlIGEg dmlhYmxlIGltcGxlbWVudGF0aW9uIGNob2ljZSBmb3IgdGhlc2UgKGFzIGl0IHRha2VzIGF3YXkg dGhlIHJlcXVpcmVtZW50IHRvIG1hbmFnZSBpbmNyZW1lbnRhbCBjb3VudGVycykg4oCTIHNvIEkg d291bGQgbm90IHdhbnQgdG8gc2VlIHRoZXNlIGJlY29tZSBpbnRlZ2Vycy4gQnkgbWFraW5nIHRo ZW0gc3RyaW5ncywgYSBUQU0gY2FuIGNob29zZSB0aGUgbWVjaGFuaXNtIGl0IHdhbnRzLg0KDQpJ IHRha2UgeW91ciBwb2ludCBhYm91dCDigJxyaWTigJ0gYW5kIOKAnHRpZOKAnSBiZWluZyB1bmRl cnNwZWNpZmllZC4gVGhlIHRydXRoIGlzIHRoYXQgdmFsdWVzIGNvbnRhaW5lZCBpbiB0aGVzZSBm aWVsZHMgZG9u4oCZdCBtYXR0ZXIgdG8gdGhlIHByb3RvY29sIG11Y2guICh0aGV5IGFyZSBtb3N0 bHkgZm9yIHRoZSBjb252ZW5pZW5jZSBvZiB0aGUgVEFNIGluIG9yZGVyIHRvIG1hdGNoIHVwIHJl cXVlc3QgYW5kIHJlc3BvbnNlIG1lc3NhZ2VzIChyaWQpLCBhbmQgKHRpZCkgdG8gdW5kZXJzdGFu ZCB3aGljaCBtZXNzYWdlcyBiZWxvbmcgaW4gYSDigJhjb252ZXJzYXRpb27igJkpDQoNCg0KDQpV bmxlc3MgdGhlcmUgaXMgYSByZWFzb24gYSBndWlkIGlzIGFjdHVhbGx5IG5lZWRlZCAoZS5nLiwg Z2xvYmFsIHVuaXF1ZW5lc3MpLCBJIHdvdWxkIGFyZ3VlIGFnYWluc3QgdGhhdCBhZGRpdGlvbmFs IGNvbXBsZXhpdHkuDQoNCklmIGFsbCB5b3UgbmVlZCBpcyB1bmlxdWVuZXNzIHdpdGhpbiBhIHNl c3Npb24sIGEgc2ltcGxlIHNlcXVlbmNlIG51bWJlciB3b3VsZCBzdWZmaWNlLg0KDQoNCg0KW01Q XSBPcGVuIHN1Z2dlc3Rpb24gZm9yIHRoaXMgdG8gYmUgbW9yZSBub3JtYWxpemVkLiBJdCBpcyB1 c2VkIGFzIGFuIGludGVybmFsIGxpbmtpbmcgYnkgdGhlIFRBTSBpdHNlbGYsIGFzIEFuZHkgY29t bWVudGVkLg0KDQoNCg0KNSkgICAgICBJIGZvdW5kIGl0IGNvbmZ1c2luZyB0aGF0IHRoZSBuYW1l cyBvZiB0aGUgbWVzc2FnZXMgZG9u4oCZdCBtYXRjaCB0aGUgbmFtZSB2YWx1ZXMNCmluIHRoZSBt ZXNzYWdlcyB0aGVtc2VsdmVzICjigJxHZXREZXZpY2VTdGF0ZVJlc3BvbnNl4oCdIHZzDQoNCuKA nEdldERldmljZVRFRVN0YXRlVEJTUmVzcG9uc2XigJ0sIGV0Yy4pICAgSGF2aW5nIHRoZXNlIG5v dCBtYXRjaCBpcyBidWctcHJvbmUuDQoNCltBQV0gSSBhZ3JlZS4gSW5zdGVhZCBvZiBoYXZpbmcg YSBtaXh0dXJlIG9mIEdldERldmljZVN0YXRlWFhYIGFuZCBHZXREZXZpY2VURUVTdGF0ZVhYWCB0 aGV5IHNob3VsZCBhbGwgc3RhbmRhcmRpemUgb24gR2V0RGV2aWNlVEVFU3RhdGVYWFguDQoNCk5v ZGUgdGhhdCB0aGVyZSBhcmUgaW50ZW50aW9uYWwgZGlmZmVyZW5jZXMgYXQgdGhlIGVuZCBvZiB0 aG9zZSB3b3JkcyAoZS5nLiBHZXREZXZpY2VURUVTdGF0ZVRCU1Jlc3BvbnNlIHZzIEdldERldmlj ZVRFRVN0YXRlUmVzcG9uc2UgaXMgaW50ZW50aW9uYWwgYXMgb25lIG9mIHRoZXNlIGlzIHRoZSDi gJh0byBiZSBzaWduZWTigJkgZGF0YSBhbmQgdGhlIG90aGVyIGlzIHRoZSBzaWduZWQgZGF0YS4N Cg0KDQoNCkkgZG9u4oCZdCB1bmRlcnN0YW5kLCBhbmQgdGhlIHRlcm1zIHNlZW0gdG8gYmUgaW50 ZXJjaGFuZ2VhYmxlIGluIHRoZSBkb2MsIHNvIGlmIHRoZXJlIGlzIGEgZGlzdGluY3Rpb24sIGl0 4oCZcyBub3QgZXhwbGFpbmVkIGNsZWFybHkgaW4gdGhlIGRvYy4NCg0KDQoNCltNUF0gVGhlcmUg aXMgYSBkaWZmZXJlbmNlIHRoZXJlLiBUaGUgZG9jdW1lbnQgc2F5czoNCg0KDQrigJxUaGUgZmlu YWwgR2V0RGV2aWNlU3RhdGVSZXNwb25zZSByZXNwb25zZSBtZXNzYWdlIGNvbnNpc3RzIG9mIGFu IGFycmF5IG9mIFRFRSByZXNwb25zZXMu4oCdDQoNCg0KDQoNCg0KNikgICAgICBJdOKAmXMgdW5j bGVhciB3aGV0aGVyIGEgcmljaCBhcHAgY2FuIGRlcGVuZCBvbiB0d28gVEHigJlzIGZyb20gZGlm ZmVyZW50IFRBTXMsDQoNCmFuZCB3aGV0aGVyIGEgVEEgY2FuIGRlcGVuZCBvbiBhIFRBIGZyb20g YSBkaWZmZXJlbnQgVEFNLiAgSW4gdGhlIHVzZSBjYXNlDQoNCndoZXJlIHRoZSBkZXZpY2UgYWRt aW4gcnVucyB0aGUgVEFNIGFuZCBjb250cm9scyBhbGwgVEFzIG9uIHRoZWlyIGRldmljZXMgdGhl DQoNCmFuc3dlciB3b3VsZCBiZSBuby4gIEJ1dCBpbiBvdGhlciB1c2UgY2FzZXMgSeKAmW0gbm90 IHN1cmUuICAgSWYgc28sIHRoZW4gdGhlIHF1ZXN0aW9uDQphcmlzZXMgYWJvdXQgaG93IGRlcGVu ZGVuY2llcyBhcmUgZXhwcmVzc2VkIGFuZCB3aGV0aGVyIGEgZGVwZW5kZW5jeSBuZWVkcw0KdG8g ZXhwcmVzcyB3aGljaCBUQU0gaXMgdXNlZC4gIFRoaXMgdGhlbiBiZWdzIHRoZSBxdWVzdGlvbnMg b2Ygd2hldGhlciBhIFRBIG1pZ2h0DQpiZSB2aWEgbW9yZSB0aGFuIG9uZSBUQU0sIG9yIG1pZ2h0 IGNoYW5nZSBUQU1zIG92ZXIgdGltZS4gICBUaGUgYW5zd2VycyBoZXJlDQpwcm9iYWJseSBiZWxv bmcgaW4gdGhlIGFyY2ggZG9jLg0KW0FBXSBUQSBpbnRlci1kZXBlbmRlbmN5IGlzIGNvbXBsZXRl bHkgb3V0IG9mIHRoZSBzY29wZSBvZiB0aGUgT1RyUCBwcm90b2NvbC4gKHNvIHRoZSByaWNoIGFw cCB2ZW5kb3IgbmVlZHMgdG8ga25vdyBhbGwgdGhlIFRBIElEcyB0aGV5IG5lZWQgaW5zdGFsbGlu ZywgYW5kIHdoaWNoIFRBTShzKSB0byBnZXQgdGhlbSBmcm9tKS4NCg0KVEFzIGluaGVyZW50bHkg Y2FuIGRlcGVuZCBvbiBvdGhlciBUQeKAmXMuICBJIGRvbuKAmXQgdGhpbmsgaXQgc2hvdWxkIGJl IG91dCBvZiBzY29wZSBmb3IgdGhlIFdHLg0KDQpbTVBdIExldCB1cyBkaXNjdXNzIHRoaXMgbW9y ZS4gSW4gdGhlb3J5LCB0aGVyZSBjb3VsZCBiZSBhbGwgY2hhaW5pbmcgZGVwZW5kZW5jaWVzLiBJ dCBpc27igJl0IGNvbW1vbiB0b2RheS4gV2hlbiBUQTEgdXNlcyBUQTIsIHdvdWxkIFRBMSBpbnN0 YWxsYXRpb24gYnkgVEFNIGFuZCBURUUgd2lsbCBuZWVkIHRvIGNoZWNrIGV4aXN0aW5nIG9mIFRB Mj8NCg0KW01QXSBPdmVyYWxsLCB0aGFua3MgZm9yIHlvdXIgZ3JlYXQgcXVlc3Rpb25zIGFuZCBz dWdnZXN0aW9ucyBvZiBzb21lIGFsdGVybmF0aXZlIG1vZGVscy4NCg0KRGF2ZQ0K --_000_F77F1C855AA14554B565246A376294FCsymanteccom_ Content-Type: text/html; charset="utf-8" Content-ID: <3847BA9E9144A844B52672A5F60201BA@namprd16.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkRlbmdYaWFuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAx IDE7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUg NSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IlxARGVuZ1hpYW4i Ow0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMg Ki8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBp bjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlv bjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21z by1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojOTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1 bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGlu azoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXci O30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQ YXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1h cmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRp di5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93 dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4u RW1haWxTdHlsZTIyDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5IVE1M UHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hh ciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZv cm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4g MS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQov KiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo4NTgzNTE3MzA7 DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjIwNzYxODYz MzYgMTM2MDAyNTQ3NCA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcx NSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxl dmVsLXN0YXJ0LWF0OjM7DQoJbXNvLWxldmVsLXRleHQ6IiUxXCkiOw0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVm dDoxLjI1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KQGxpc3Qg bDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCglt YXJnaW4tbGVmdDoxLjc1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVs Mw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCW1hcmdpbi1s ZWZ0OjIuMjVpbjsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN CgltYXJnaW4tbGVmdDoyLjc1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxl dmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2lu LWxlZnQ6My4yNWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgltYXJnaW4tbGVmdDoz Ljc1aW47DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFy Z2luLWxlZnQ6NC4yNWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDgN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0 OjQuNzVpbjsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJbWFyZ2luLWxlZnQ6NS4yNWlu Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDo5MjMzNDU2 MDM7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xMjc2 ODQ4MDQwIDY3Njk4NzA1IDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4 NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1O30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28t bGV2ZWwtdGV4dDoiJTFcKSI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTps ZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2 ZWw0DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2Vy Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxl dmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQt aW5kZW50Oi05LjBwdDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4t Ym90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hh cGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlm XS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQi Pg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94 bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjND MSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPlZlcnkgZ29vZCBjb21tZW50cywgRGF2ZS4gUGxlYXNlIHNlZSBteSBjb21t ZW50cyBpbmxpbmUgKHdpdGggW01QXSksIE1pbmc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7 Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4w cHQ7Y29sb3I6YmxhY2siPlRFRVAgJmx0O3RlZXAtYm91bmNlc0BpZXRmLm9yZyZndDsgb24gYmVo YWxmIG9mIERhdmUgVGhhbGVyICZsdDtkdGhhbGVyPTQwbWljcm9zb2Z0LmNvbUBkbWFyYy5pZXRm Lm9yZyZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+TW9uZGF5LCBKdWx5IDE2LCAyMDE4IGF0IDExOjAw IEFNPGJyPg0KPGI+VG86IDwvYj5BbmRyZXcgQXR5ZW8gJmx0O0FuZHJldy5BdHllb0BpbnRlcmNl ZGUuY29tJmd0OywgJnF1b3Q7dGVlcEBpZXRmLm9yZyZxdW90OyAmbHQ7dGVlcEBpZXRmLm9yZyZn dDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UmU6IFtUZWVwXSBJbXBsZW1lbnRhdGlvbiBmZWVkYmFj ayBvbiBkcmFmdC1pZXRmLXRlZXAtb3BlbnRydXN0cHJvdG9jb2wtMDE8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OiMxRjQ5N0QiPkFuZHJldyB3cml0ZXM6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPuKApjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwxIGxldmVsMSBsZm8yIj4NCjwhW2lm ICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjEpPHNwYW4gc3R5 bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPlNlY3Rpb24gNi41IGV4 cGxhaW5zIHRoYXQgdGhlIFRBTSBuZWVkcyB0byByZWNlaXZlIGEgbGlzdCBvZiBvbmUgb3IgbW9y ZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJn aW4tbGVmdDoxLjBpbiI+VEHigJlzIHRoYXQgYXJlIHJlcXVlc3RlZCB0byBiZSBpbnN0YWxsZWQg KFM2LjUuMSBwb2ludCAxQSkuJm5ic3A7IEhvd2V2ZXIsIG5vPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj5tZXNzYWdl IGlzIGRlZmluZWQgZm9yIGRvaW5nIHNvLCB3aGljaCBwcmV2ZW50cyBpbnRlcm9wZXJhYmlsaXR5 LiZuYnNwOyBJPGJyPg0KdGhpbmsgdGhpcyBtZXNzYWdlIG5lZWRzIHRvIGJlIGdlbmVyYXRlZCBi eSB0aGUgVEVFIChub3QgdGhlIHJpY2ggYXBwKSw8YnI+DQpmb3IgcmVhc29ucyBJIHdpbGwgZXhw bGFpbiBpbiAjMyBiZWxvdy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+W0FBXSBJIGRvbuKAmXQgc2VlIHRoZSBu ZWVkIGZvciBhIG1lc3NhZ2UgZm9yIGRlZmluaW5nIHRoZSBUQXMgdGhhdCBuZWVkIHRvIGJlIGlu c3RhbGxlZC4gVGhlIE9UclAgbWVzc2FnZXMgYXJlIGJldHdlZW4gdGhlIFRBTSBhbmQgdGhlIFRF RSwgYnV0IHRoZSBkZXNpcmUgdG8gaW5zdGFsbCBUQXMgY29tZXMgZnJvbSB0aGUgcmljaCBhcHAu PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDsNCjwvc3Bhbj48c3BhbiBz dHlsZT0iY29sb3I6IzAwNzBDMCI+SW4gcHJhY3RpY2UsIGEgcmljaCBhcHAgd2lsbCBoYXZlIHRo ZSBpZGVudGlmaWVycyBvZiB0aGUgVEFzIGl0IHJlcXVpcmVzIGJ1aWx0IGludG8gaXRzIG93biBj b2RlLCBzaW5jZSBpdHMgb3duIGNvZGUgd2lsbCBhbHNvIGJlIGNhbGxpbmcgdGhvc2UgVEFzIChl LmcuIG9uY2UgaW5zdGFsbGVkLCB0byBwZXJmb3JtIHNvbWUgRFJNIG9yIHBheW1lbnQgYXV0aGVu dGljYXRpb24pLiBUaGVyZWZvcmUNCiBhIHJpY2ggYXBwIGlzIGF3YXJlIG9mIHRoZSBUQXMgaXQg bmVlZHMuJm5ic3A7IEkgZG9u4oCZdCB0aGluayB0aGlzIGluZm8gY2FuIGNvbWUgZnJvbSB0aGUg VEVFIOKAkyBzaW5jZSBhdCB0aGlzIHBvaW50IHRoZSBUQSBpcyBub3QgaW5zdGFsbGVkIHlldCwg c28gd2hpY2ggcGFydCBvZiB0aGUgVEVFIHdvdWxkIGhhdmUgdGhlIGtub3dsZWRnZSBvZiB3aGlj aCBUQXMgYXJlIG5lZWRlZD88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlz dFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMx RjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFy YWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3 RCI+QXMgSSBub3RlZCBpbiBteSBhcmNoIGRvYyBjb21tZW50cywgSSBkaXNhZ3JlZSB0aGF0IHRo ZXJlIG5lZWRzIHRvIGJlIGFueSBjb21tdW5pY2F0aW9uIGJldHdlZW4gdGhlIHJpY2ggYXBwIGJl aW5nIGluc3RhbGxlZCwgYW5kIHRoZSBUQU0uJm5ic3A7IEEgdmFsaWQgaW1wbGVtZW50YXRpb24g bW9kZWwgc2hvdWxkIGJlDQogdGhhdCB0aGUgYXBwIHN0b3JlIGluc3RhbGxlciByZWFkcyB0aGUg bWV0YWRhdGEgKGluY2x1ZGluZyBUQSBkZXBlbmRlbmNpZXMpIGFib3V0IHRoZSByaWNoIGFwcCwg YW5kIGFzIHBhcnQgb2YgaW5zdGFsbGluZyB0aGUgcmljaCBhcHAgKHdpdGhvdXQgZXZlciBuZWVk aW5nIHRvIHJ1biBpdCksIHRoZSBpbnN0YWxsZXIgY2FuIGNvbW11bmljYXRlIHdpdGggdGhlIFRF RSB0byBleHByZXNzIHRob3NlIGRlcGVuZGVuY2llcywgd2hpY2ggdGhlbiB0cmlnZ2Vycw0KIHRo ZSBURUUgdG8gZ2VuZXJhdGUgYSBzaWduZWQgbWVzc2FnZSB0byB0aGUgVEFNLCB3aGljaCBjYW4g YmUgcmVsYXRlZCBieSB0aGUgaW5zdGFsbGVyLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHls ZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPltNUF0gVGhlIHJlcXVl c3RlZCBUQSBieSBhIFJpY2ggQXBwIGNhbiBnbyBieSBpdHNlbGYsIG9yIG5vdGVkIGJ5IGFuIGlu c3RhbGxlciB2aWEgaXRzIG1ldGFkYXRhLiBJdCBmdW5kYW1lbnRhbGx5IGV4cHJlc3MgdGhlIG5l ZWQuIEl0IG1heSBub3QgbWF0dGVyIGl0IGlzIHRoZSBSaWNoIEFwcCBvciBhbiBpbnN0YWxsZXIg dGhhdCBkb2VzIHRoZSBqb2Igb24NCiBiZWhhbGYgb2YgdGhlIFJpY2ggQXBwIHRvIG1ha2UgdGhl IGNhbGwuICZuYnNwOzxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5UaGF0IHdhcyBpbnRlbnRp b25hbGx5IGxlZnQgb3V0IG9mIHRoZSBzY29wZS4gV2UgbGVmdCB0aGlzIGNob2ljZSB0byB0aGUg UmljaCBBcHAgaXRzZWxmLiBJdCBjYW4gZG8gaXRzZWxmLCBvciBsZXZlcmFnZSBhbiBpbnN0YWxs ZXIgb3Igb3RoZXIgcHJvZ3JhbSB0byBkbyBpdC48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjBpbiI+VGhlIG1haW4gaW50ZXJmYWNlIGZvciBpbnRlcm9wZXJhYmlsaXR5IGlzIHdoYXQg VEVFIHNob3VsZCBwcmVwYXJlIHRvIGFjY2VwdCBmcm9tIGEgUmljaCBBcHAgb3IgYW4gaW5zdGFs bGVyIGluIFJFRS4gVGhpcyB3YXMgdGhlIGludGVudCBvZiBhbiBPVHJQIGFnZW50LjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDow aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJtYXJnaW4tbGVmdDowaW4iPlRoZXJlIGlzIG9uZSBtYWpvciBkaWZmZXJlbmNlIGluIGNv bnRhY3RpbmcgVEVFIGZpcnN0IHZzLiBjb250YWN0aW5nIFRBTSBmaXJzdC4gV2hlbiBhIFJpY2gg QXBwIG9yIGFuIGluc3RhbGxlciBiZWluZyBpdHMgZGVsZWdhdGUgbGV0cyBURUUgdG8gZ2VuZXJh dGUgYSByZXF1ZXN0LCBhIFRFRSBuZWVkcyBhdXRob3JpemUgc3VjaCBhIHJlcXVlc3QuIFRoZXJl DQogaXMgc29tZSByb2xlIHJlbGF0aW9uc2hpcCB0byBhZ3JlZSBvbiBoZXJlLiBBIGRldmljZSBp cyBtYW5hZ2VkIGJ5IGEgVEFNLCBhbmQgVEFN4oCZcyBpbml0aWF0ZWQgY2FsbCBjYW4gYmUgYXV0 aG9yaXplZCBieSBhIFRFRS4gTm93LCBkb2VzIHRoZSBURUUgaGF2ZSB0byBhdXRob3JpemUgYm90 aCBhbiBpbnN0YWxsZXIgLyBSaWNoIEFwcCBpbnRlbnQgYW5kIGFsc28gYSBUQU0gZm9yIGEgVEEg aW5zdGFsbGF0aW9uPyBPciB5b3UgbWVhbiBieSDigJw8c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3 RCI+cmVsYXRlZA0KIGJ5IHRoZSBpbnN0YWxsZXLigJ0gdGhhdCB0aGUgZmlyc3QgYXV0aG9yaXph dGlvbiBpcyBkZWxlZ2F0ZWQgZnJvbSBURUUgdG8gVEFNLCBhbmQgVEFNIHdpbGwgbWFrZSBhIGRl Y2lzaW9uIHdoZXRoZXIgaXQgd2lsbCBob25vciBhbiBpbnN0YWxsZXLigJlzIHJlcXVlc3QgYWJv dXQgYSBSaWNoIEFwcOKAmXMgZGVzaXJlIHRvIHVzZSBhIFRBIHRoYXQgaXQgbWFuYWdlcywgcmln aHQ/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLS0mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48 c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SW4gdGhlIGxlc3MgZWZmaWNpZW50IG1vZGVsIHdo ZXJlIHRoZSByaWNoIGFwcCBoYXMgdG8gYmUgcnVuLCBhcyB0aGUgZG9jIGltcGxpZXMsIHRoZSBz YW1lIHByb2Nlc3MgY2FuIG9jY3VyIHdoZXJlIHRoZSBURUUgZ2VuZXJhdGVzIHRoZSBtZXNzYWdl IGluIHJlc3BvbnNlIHRvIHRoZSByaWNoIGFwcCB0ZWxsaW5nDQogdGhlIGFnZW50IGl0IGhhcyBh IGRlcGVuZGVuY3kuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bTVBdIHRydWUsIHRo aXMgaXMgb25lIG9mIHRoZSBtb2RlbHMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjojMUY0OTdEIj7igKY8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47 dGV4dC1pbmRlbnQ6LjVpbiI+UHV0dGluZyBteSBpc3N1ZSAjMSBhbmQgaXNzdWUgIzIgdG9nZXRo ZXIgbWVhbnMgdGhlcmXigJlzIGFuIGV4dHJhIHJvdW5kPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj50cmlwIHRoYXQg aXMgdW5uZWNlc3NhcnkuJm5ic3A7IDYuNSBzYXlzIHRoZSBUQU0gcmVjZWl2ZSBhIGxpc3Qgb2Yg VEFzIG5lZWRlZCw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPmFuZCB0aGVuIHRoZSBUQU0ganVzdCBnb2VzIGJhY2sg YW5kIGFza3Mgd2hhdCBpcyBpbnN0YWxsZWQsIGp1c3QgdG8gZ2V0PGJyPg0KYSBsaXN0IG9mIHdo YXQgbmVlZHMgdG8gYmUgaW5zdGFsbGVkLiZuYnNwOyBUaGlzIGlzIHVubmVjZXNzYXJ5LCB0aGUg VEVFIGNhbiBqdXN0PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj5zZW5kIGEgbGlzdCBvZiBvbmUgb3IgbW9yZSBUQXMg dGhhdCBuZWVkIHRvIGJlIGluc3RhbGxlZCBhbmQgYXJlbuKAmXQgYWxyZWFkeS48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPkhvcGVmdWxseSB0aGlzIGV4cGxhaW5zIHdoeSBJIHNhaWQgaW4gaXNzdWUgIzEgYWJvdmUg d2h5IEkgdGhpbmsgdGhlIG1lc3NhZ2U8YnI+DQpuZWVkcyB0byBiZSBnZW5lcmF0ZWQgYnkgdGhl IFRFRS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIj48c3BhbiBz dHlsZT0iY29sb3I6IzAwNzBDMCI+W0FBXSBidXQgaG93IGNvdWxkIHRoZSBURUUgKHdoaWNoIGRv ZXNu4oCZdCBoYXZlIGl0cyBUQXMgbG9hZGVkIHlldCkga25vdyB3aGF0IFRBcyBzaG91bGQgYmUg bG9hZGVkPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBo IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5UaGUgc2Ft ZSBwaWVjZSBvZiBjb2RlIHRoYXQgY29ubmVjdHMgdG8gdGhlIFRBTSB0ZWxscyB0aGUgVEVFIHdo YXQgVEHigJlzIGl0IGRlc2lyZXMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxzcGFuIHN0eWxlPSJjb2xv cjojMUY0OTdEIj5UaGUgVEVFIHRoZW4gZ2VuZXJhdGVzIGEgbWVzc2FnZSB3aXRoIHRoZSBsaXN0 IG9mIFRBcyB0aGF0IGFyZW7igJl0IGFscmVhZHkgaW5zdGFsbGVkLjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGlu Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MGluIj5bTVBdIFNlZSBhdXRob3JpemF0aW9uIGNvbW1lbnQgYWJvdmUg Zm9yIGhvdyBhIFRFRSBhdXRob3JpemVzIGEgcmVxdWVzdCBmcm9tIGEgUmljaCBBcHAgLyBpbnN0 YWxsZXIuIERlbGVnYXRlZCBmbG93IHdvdWxkIG1lYW4gdGhhdCBpdCBhbHdheXMgYWNjZXB0IGEg cmVxdWVzdCwgYW5kIGdlbmVyYXRlcyBhIHJlcXVlc3QuIFdvdWxkIHRoaXMgY2F1c2Ugc29tZQ0K IHNwYW0gYW5kIGF0dGFjayBpc3N1ZSB0byB0aGUgVEVFPyBPbiB0aGUgb3RoZXIgaGFuZCwgVEFN IGlzIGdpdmVuIHRvIGhhbmRsZSBpdHMgY2xpZW50cyBiZWluZyBSaWNoIEFwcCBvciBhbiBpbnN0 YWxsZXIgaW4gYSBSRUUgZXRjLCB3aGljaCBpcyBvdXQgb2YgdGhlIHNjb3BlIGluIG91ciBkZXNp Z24uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+4oCmPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDox Ljc1aW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm80Ij4NCjwhW2lm ICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48c3BhbiBzdHlsZT0i bXNvLWxpc3Q6SWdub3JlIj4zKTxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5l dyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9z cGFuPjwvc3Bhbj48IVtlbmRpZl0+U2VjdGlvbiA2LjUuMSBwb2ludCA5LkEgaW1wbGllcyB0aGF0 IHRvIGluc3RhbGwgYSBUQSwgb25lIG11c3QgaGF2ZSBhbiBleHRyYTxicj4NCnJvdW5kIHRyaXAg Zmlyc3QgdG8gY3JlYXRlIGFuIFNEIGlmIG9uZSBpc27igJl0IGFscmVhZHkgdGhlcmUuJm5ic3A7 IEkgd291bGQgZXhwZWN0IG9uZTxicj4NCmNvbW1vbiBjYXNlIHRvIGJlIHdoZXJlIHRoZXJlIGlz IG9uZSBUQSBwZXIgU0QsIHNvIHRoYXQgYWxsIFRBcyBhcmUgaXNvbGF0ZWQ8YnI+DQpmcm9tIGVh Y2ggb3RoZXIuJm5ic3A7IEFzIHN1Y2gsIHJlcXVpcmluZyB0aGUgZXh0cmEgZGVsYXkgaXMgaW5l ZmZpY2llbnQgaW4gdGltZSw8YnI+DQpiYW5kd2lkdGgsIGFuZCBwcm9jZXNzaW5nLiZuYnNwOyZu YnNwOyBBbGwgdGhlIGZpZWxkcyBpbiBDcmVhdGVTRCBhcmUgYWxyZWFkeSBwcmVzZW50PGJyPg0K aW4gYW4gSW5zdGFsbFRBIG1lc3NhZ2UgKGV4Y2VwdCB0aGUg4oCcZGlk4oCdIGZpZWxkIG1lbnRp b25lZCBhYm92ZSBpbiBpc3N1ZSAjNSksPGJyPg0Kc28gaXQgY291bGQgYmUgZG9uZSBhdXRvbWF0 aWNhbGx5IGJ5IHRoZSBmaXJzdCBJbnN0YWxsVEEgbWVzc2FnZSBpdHNlbGYuPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDcwQzAiPltBQV0gd2hlbiB0aGUgU0QgaXMgY3JlYXRlZCwgYW4gYXN5 bW1ldHJpYyBrZXlwYWlyIGlzIGdlbmVyYXRlZCAoc3BhaWspLCBhbmQgdGhlIHB1YmxpYyBwYXJ0 IG9mIHRoaXMgaXMgcmV0dXJuZWQuIFdoZW4gYSBUQSBpcyBpbnN0YWxsZWQsIGl0IGlzIGVuY3J5 cHRlZCB3aXRoIHRoaXMga2V5LiBUaGlzIGVuYWJsZXMgc29tZQ0KIHVzZSBjYXNlcyB3aGVyZSBh IFRBTSBjb3VsZCBpbnRlcmZhY2UgdG8gYSBTUCBhbmQgZW5hYmxlIGFuIFNQIHRvIHByb3ZpZGUg dGhlIFRBIGVuY3J5cHRlZCBzdWNoIHRoYXQgdGhlIFRBIGJpbmFyeSBpcyBub3Qga25vd24gYnkg dGhlIFRBTS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDcwQzAiPlRoZSBzcGFp ayBpcyBhbHNvIHVzZWQgdG8gZW5jcnlwdCB0aGUgcGVyc29uYWxpemF0aW9uIGRhdGEgKHRoYXQg aXMgYWxzbyBzZW50IGluIEluc3RhbGxUQSksIGFuZCB0aGVyZSBpcyBhbHNvIGEgdXNlIGNhc2Ug Zm9yIGEgVEFNIGludGVyZmFjaW5nIHRvIGFuIFNQIGluIG9yZGVyIHRoYXQgdGhlIFNQIGVuY3J5 cHRzDQogcGVyc28gZGF0YSBmb3IgdGhhdCBURUUgc3VjaCB0aGF0IGl0IHRyYXZlbHMgdmlhIHRo ZSBUQU0gdG8gdGhlIFRFRSwgYnV0IHdpdGhvdXQgdGhlIFRBTSBoYXZpbmcgYWNjZXNzIHRvIHRo YXQgZGF0YTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+U2luY2UgSW5z dGFsbFRBIHJlcXVpcmVzIGtub3dsZWRnZSBvZiB0aGUgcHVibGljIGtleSByZXR1cm5lZCBmcm9t IENyZWF0ZVNELCBpdCBpcyB0cnVlIHRoYXQgdGhlIGV4dHJhIHJvdW5kIHRyaXAgaXMgcmVxdWly ZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDA3MEMwIj5TbyB0aGUgcXVlc3Rp b24gaXMgd2hldGhlciB0aGVyZSBpcyBhIGNhc2UgZm9yIGluc3RhbGxpbmcgVEEgKGFuZCB0aGVp ciBhY2NvbXBhbnlpbmcgcGVyc28gZGF0YSkgd2l0aG91dCB0aGUgYWJpbGl0eSB0byBwcm92aWRl IGNvbmZpZGVudGlhbGl0eSBiZXR3ZWVuIGFuIFNQIGFuZCB0aGUgVEVFIGJ5IG1ha2luZyB0aGF0 DQogbGF5ZXIgb2YgZW5jcnlwdGlvbiBvcHRpb25hbCwgYW5kIGJ5IGFsbG93aW5nIHRoZSBUQSAo YW5kIHBlcnNvIGRhdGE/KSB0byBiZSBidW5kbGVkIGludG8gQ3JlYXRlU0Q8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3 RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPk15IG1haW4gcG9pbnQgaXMgdGhhdCBpdCBzaG91bGQg YmUgcG9zc2libGUgdG8gY29tYmluZSBDcmVhdGVTRCBpbnRvIHRoZSBmaXJzdCBJbnN0YWxsVEEg YW5kIGJlIG1vcmUgZWZmaWNpZW50Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5BbHNvIHJlbWVtYmVyIHRoYXQg dGhlIFRBIGJpbmFyeSBuZWVkIG5vdCBjb21lIGZyb20gdGhlIFRBTS48L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPltNUF0gVGhpcyBjb3VsZCBiZSBhbiBvcHRpb24sIEkgdGhpbmssIHdo ZW4gYSBUQSBiaW5hcnkgZW5jcnlwdGlvbiBpc27igJl0IG5lZWRlZC4gSG93ZXZlciwgd2UgZGlk IGVsYWJvcmF0ZSB0aGlzIGluIHRoZSB2ZXJ5IGJlZ2lubmluZyBvZiBwcm90b2NvbCBkZXNpZ24g d2hldGhlciB3ZSBnaXZlIHN1Y2ggYW4gb3B0aW9uLiBXZSAoT1RyUCBBbGxpYW5jZSBhdCB0aGUg dGltZSkgYWdyZWVkIHRoYXQgdGhlIHByb3RlY3Rpb24NCiBvZiBUQSBiaW5hcnkgaXRzZWxmIGlz IHZlcnkgdmFsdWFibGUuIFlvdSBkb27igJl0IHdhbnQgc29tZW9uZSB0byByZXZlcnNlIGVuZ2lu ZWVyIHlvdXIgVEEgY29kZSB0aGF0IG1ha2VzIGV4cGxvaXQgZmluZGluZyBlYXNpZXIuIEluIHRo ZSBjdXJyZW50IGRlc2lnbiwgYSBUQSBiaW5hcnkgY29kZSBpcyBuZXZlciBnaXZlbiBjbGVhciB0 byBhbnkgUmljaCBBcHAgb3IgTUlUTS4gSXQgaXMgb25seSBrbm93biBieSB0aGUgZGV2ZWxvcGVy IGFuZCB0aGVuDQogdGhlIHJ1bm5pbmcgZGV2aWNlIFRFRSBpdHNlbGYuIFRoaXMgd2FzIGEgdmVy eSBpbXBvcnRhbnQgZGVzaWduIGdvYWwgaW4gdGhpcyBwcm90b2NvbC48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHls ZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjc1aW47dGV4dC1pbmRlbnQ6 LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm80Ij4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxz cGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj40 KTxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRp Zl0+VGhlIHNjb3BlIG9mIHVuaXF1ZW5lc3Mgb2YgdGhlIOKAnHJpZOKAnSBhbmQg4oCcdGlk4oCd IGZpZWxkcyBpcyB1bmRlcnNwZWNpZmllZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPlRoZXkganVzdCBzYXkg4oCc dW5pcXVl4oCdLiZuYnNwOyBJIHRoaW5rIOKAnHJpZOKAnSBpcyBqdXN0IHN1cHBvc2VkIHRvIGJl IHVuaXF1ZSB3aXRoaW48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBo IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPmEgZ2l2ZW4ge3Nlc3Npb24s4oCddGlk4oCdfSBi dXQgSSBjYW7igJl0IHRlbGwgZm9yIHN1cmUuJm5ic3A7IEFuZCBJIHRoaW5rIOKAnHRpZOKAnSBp cyBqdXN0IHN1cHBvc2VkPGJyPg0KdG8gYmUgdW5pcXVlIHdpdGhpbiBhIGdpdmVuIHNlc3Npb24g KG5vdCBnbG9iYWxseSBhY3Jvc3MgYWxsIHNlc3Npb25zLCBhbGwgVEFNcyw8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4i PmFsbCBkZXZpY2VzKSwgYnV0IEkgY2Fu4oCZdCB0ZWxsLiZuYnNwOyZuYnNwOyBUaGV54oCZcmUg YWxzbyBmb3JtYXR0ZWQgYXMgc3RyaW5ncywgYnV0IEnigJltIG5vdCBzdXJlPGJyPg0Kd2h5IHRo ZXkgY2Fu4oCZdCBiZSBpbnRlZ2VycyB3aGljaCBJIHRoaW5rIHdvdWxkIGJlIG11Y2ggbW9yZSBl ZmZpY2llbnQuLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDA3MEMwIj5bQUFdIGFsdGhvdWdoIGl0IGlzIG5vdCBtYW5kYXRl ZCwgcmFuZG9tIGd1aWRzIGNhbiBiZSBhIHZpYWJsZSBpbXBsZW1lbnRhdGlvbiBjaG9pY2UgZm9y IHRoZXNlIChhcyBpdCB0YWtlcyBhd2F5IHRoZSByZXF1aXJlbWVudCB0byBtYW5hZ2UgaW5jcmVt ZW50YWwgY291bnRlcnMpIOKAkyBzbyBJIHdvdWxkIG5vdCB3YW50IHRvIHNlZSB0aGVzZSBiZWNv bWUNCiBpbnRlZ2Vycy4gQnkgbWFraW5nIHRoZW0gc3RyaW5ncywgYSBUQU0gY2FuIGNob29zZSB0 aGUgbWVjaGFuaXNtIGl0IHdhbnRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29MaXN0UGFyYWdyYXBoIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+SSB0YWtlIHlvdXIg cG9pbnQgYWJvdXQg4oCccmlk4oCdIGFuZCDigJx0aWTigJ0gYmVpbmcgdW5kZXJzcGVjaWZpZWQu IFRoZSB0cnV0aCBpcyB0aGF0IHZhbHVlcyBjb250YWluZWQgaW4gdGhlc2UgZmllbGRzIGRvbuKA mXQgbWF0dGVyIHRvIHRoZSBwcm90b2NvbCBtdWNoLiAodGhleSBhcmUgbW9zdGx5IGZvciB0aGUg Y29udmVuaWVuY2Ugb2YgdGhlIFRBTSBpbiBvcmRlcg0KIHRvIG1hdGNoIHVwIHJlcXVlc3QgYW5k IHJlc3BvbnNlIG1lc3NhZ2VzIChyaWQpLCBhbmQgKHRpZCkgdG8gdW5kZXJzdGFuZCB3aGljaCBt ZXNzYWdlcyBiZWxvbmcgaW4gYSDigJhjb252ZXJzYXRpb27igJkpPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4i PjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PHNw YW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPlVubGVzcyB0aGVyZSBpcyBhIHJlYXNvbiBhIGd1aWQg aXMgYWN0dWFsbHkgbmVlZGVkIChlLmcuLCBnbG9iYWwgdW5pcXVlbmVzcyksIEkgd291bGQgYXJn dWUgYWdhaW5zdCB0aGF0IGFkZGl0aW9uYWwgY29tcGxleGl0eS48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPklmIGFsbCB5b3UgbmVlZCBpcyB1bmlxdWVuZXNz IHdpdGhpbiBhIHNlc3Npb24sIGEgc2ltcGxlIHNlcXVlbmNlIG51bWJlciB3b3VsZCBzdWZmaWNl Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJt YXJnaW4tbGVmdDowaW4iPltNUF0gT3BlbiBzdWdnZXN0aW9uIGZvciB0aGlzIHRvIGJlIG1vcmUg bm9ybWFsaXplZC4gSXQgaXMgdXNlZCBhcyBhbiBpbnRlcm5hbCBsaW5raW5nIGJ5IHRoZSBUQU0g aXRzZWxmLCBhcyBBbmR5IGNvbW1lbnRlZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS43NWlu O3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvNCI+DQo8IVtpZiAhc3Vw cG9ydExpc3RzXT48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1s aXN0Oklnbm9yZSI+NSk8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9t YW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48 L3NwYW4+PCFbZW5kaWZdPkkgZm91bmQgaXQgY29uZnVzaW5nIHRoYXQgdGhlIG5hbWVzIG9mIHRo ZSBtZXNzYWdlcyBkb27igJl0IG1hdGNoIHRoZSBuYW1lIHZhbHVlczxicj4NCmluIHRoZSBtZXNz YWdlcyB0aGVtc2VsdmVzICjigJxHZXREZXZpY2VTdGF0ZVJlc3BvbnNl4oCdIHZzIDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDox LjBpbiI+4oCcR2V0RGV2aWNlVEVFU3RhdGVUQlNSZXNwb25zZeKAnSwgZXRjLikmbmJzcDsmbmJz cDsgSGF2aW5nIHRoZXNlIG5vdCBtYXRjaCBpcyBidWctcHJvbmUuPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDcwQzAiPltB QV0gSSBhZ3JlZS4gSW5zdGVhZCBvZiBoYXZpbmcgYSBtaXh0dXJlIG9mDQo8Yj5HZXREZXZpY2VT dGF0ZTwvYj5YWFggYW5kIDxiPkdldERldmljZVRFRVN0YXRlPC9iPlhYWCB0aGV5IHNob3VsZCBh bGwgc3RhbmRhcmRpemUgb24NCjxiPkdldERldmljZVRFRVN0YXRlPC9iPlhYWC48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMwMDcwQzAiPk5vZGUgdGhhdCB0aGVyZSBhcmUgaW50ZW50aW9uYWwgZGlmZmVyZW5jZXMg YXQgdGhlIGVuZCBvZiB0aG9zZSB3b3JkcyAoZS5nLiBHZXREZXZpY2VURUVTdGF0ZTxiPlRCU1Jl c3BvbnNlPC9iPiB2cyBHZXREZXZpY2VURUVTdGF0ZTxiPlJlc3BvbnNlPC9iPiBpcyBpbnRlbnRp b25hbCBhcyBvbmUgb2YgdGhlc2UgaXMgdGhlIOKAmHRvIGJlIHNpZ25lZOKAmQ0KIGRhdGEgYW5k IHRoZSBvdGhlciBpcyB0aGUgc2lnbmVkIGRhdGEuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxzcGFuIHN0 eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMxRjQ5N0QiPkkgZG9u4oCZdCB1bmRlcnN0YW5kLCBhbmQgdGhlIHRlcm1zIHNlZW0g dG8gYmUgaW50ZXJjaGFuZ2VhYmxlIGluIHRoZSBkb2MsIHNvIGlmIHRoZXJlIGlzIGEgZGlzdGlu Y3Rpb24sIGl04oCZcyBub3QgZXhwbGFpbmVkIGNsZWFybHkgaW4gdGhlIGRvYy48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjBpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+W01QXSBUaGVyZSBpcyBhIGRpZmZlcmVuY2UgdGhl cmUuIFRoZSBkb2N1bWVudCBzYXlzOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQ YXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPuKAnFRoZSBmaW5hbCBH ZXREZXZpY2VTdGF0ZVJlc3BvbnNlIHJlc3BvbnNlIG1lc3NhZ2UgY29uc2lzdHMgb2YgYW4gYXJy YXkgb2YgVEVFIHJlc3BvbnNlcy7igJ08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBp biI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuNzVpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2 ZWwxIGxmbzQiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5 N0QiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjYpPHNwYW4gc3R5bGU9ImZvbnQ6Ny4w cHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5JdOKAmXMgdW5jbGVhciB3aGV0 aGVyIGEgcmljaCBhcHAgY2FuIGRlcGVuZCBvbiB0d28gVEHigJlzIGZyb20gZGlmZmVyZW50IFRB TXMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluIj5hbmQgd2hldGhlciBhIFRBIGNhbiBkZXBlbmQgb24gYSBUQSBmcm9t IGEgZGlmZmVyZW50IFRBTS4mbmJzcDsgSW4gdGhlIHVzZSBjYXNlPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj53aGVy ZSB0aGUgZGV2aWNlIGFkbWluIHJ1bnMgdGhlIFRBTSBhbmQgY29udHJvbHMgYWxsIFRBcyBvbiB0 aGVpciBkZXZpY2VzIHRoZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3Jh cGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+YW5zd2VyIHdvdWxkIGJlIG5vLiZuYnNwOyBC dXQgaW4gb3RoZXIgdXNlIGNhc2VzIEnigJltIG5vdCBzdXJlLiZuYnNwOyZuYnNwOyBJZiBzbywg dGhlbiB0aGUgcXVlc3Rpb248YnI+DQphcmlzZXMgYWJvdXQgaG93IGRlcGVuZGVuY2llcyBhcmUg ZXhwcmVzc2VkIGFuZCB3aGV0aGVyIGEgZGVwZW5kZW5jeSBuZWVkczxicj4NCnRvIGV4cHJlc3Mg d2hpY2ggVEFNIGlzIHVzZWQuJm5ic3A7IFRoaXMgdGhlbiBiZWdzIHRoZSBxdWVzdGlvbnMgb2Yg d2hldGhlciBhIFRBIG1pZ2h0PGJyPg0KYmUgdmlhIG1vcmUgdGhhbiBvbmUgVEFNLCBvciBtaWdo dCBjaGFuZ2UgVEFNcyBvdmVyIHRpbWUuJm5ic3A7Jm5ic3A7IFRoZSBhbnN3ZXJzIGhlcmU8YnI+ DQpwcm9iYWJseSBiZWxvbmcgaW4gdGhlIGFyY2ggZG9jLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJjb2xv cjojMDA3MEMwIj5bQUFdIFRBIGludGVyLWRlcGVuZGVuY3kgaXMgY29tcGxldGVseSBvdXQgb2Yg dGhlIHNjb3BlIG9mIHRoZSBPVHJQIHByb3RvY29sLiAoc28gdGhlIHJpY2ggYXBwIHZlbmRvciBu ZWVkcyB0byBrbm93IGFsbCB0aGUgVEEgSURzIHRoZXkgbmVlZCBpbnN0YWxsaW5nLCBhbmQgd2hp Y2ggVEFNKHMpIHRvIGdldCB0aGVtIGZyb20pLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzFGNDk3RCI+VEFzIGluaGVyZW50bHkgY2FuIGRlcGVuZCBvbiBvdGhlciBUQeKAmXMuJm5ic3A7 IEkgZG9u4oCZdCB0aGluayBpdCBzaG91bGQgYmUgb3V0IG9mIHNjb3BlIGZvciB0aGUgV0cuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bTVBdIExldCB1cyBkaXNjdXNzIHRoaXMgbW9y ZS4gSW4gdGhlb3J5LCB0aGVyZSBjb3VsZCBiZSBhbGwgY2hhaW5pbmcgZGVwZW5kZW5jaWVzLiBJ dCBpc27igJl0IGNvbW1vbiB0b2RheS4gV2hlbiBUQTEgdXNlcyBUQTIsIHdvdWxkIFRBMSBpbnN0 YWxsYXRpb24gYnkgVEFNIGFuZCBURUUgd2lsbCBuZWVkIHRvIGNoZWNrIGV4aXN0aW5nIG9mIFRB Mj88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W01QXSBPdmVyYWxsLCB0aGFua3MgZm9yIHlvdXIg Z3JlYXQgcXVlc3Rpb25zIGFuZCBzdWdnZXN0aW9ucyBvZiBzb21lIGFsdGVybmF0aXZlIG1vZGVs cy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkRh dmU8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_F77F1C855AA14554B565246A376294FCsymanteccom_-- From nobody Tue Jul 17 06:31:00 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F3AE130EF4 for ; Tue, 17 Jul 2018 06:30:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AcBaTWLMvmXW for ; Tue, 17 Jul 2018 06:30:54 -0700 (PDT) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7AAD2130E58 for ; Tue, 17 Jul 2018 06:30:54 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga106.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 Jul 2018 06:30:54 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos; i="5.51,365,1526367600"; d="scan'208,217"; a="58346800" Received: from fmsmsx108.amr.corp.intel.com ([10.18.124.206]) by orsmga006.jf.intel.com with ESMTP; 17 Jul 2018 06:30:44 -0700 Received: from fmsmsx156.amr.corp.intel.com (10.18.116.74) by FMSMSX108.amr.corp.intel.com (10.18.124.206) with Microsoft SMTP Server (TLS) id 14.3.319.2; Tue, 17 Jul 2018 06:30:44 -0700 Received: from crsmsx151.amr.corp.intel.com (172.18.7.86) by fmsmsx156.amr.corp.intel.com (10.18.116.74) with Microsoft SMTP Server (TLS) id 14.3.319.2; Tue, 17 Jul 2018 06:30:44 -0700 Received: from crsmsx102.amr.corp.intel.com ([169.254.2.60]) by CRSMSX151.amr.corp.intel.com ([169.254.3.64]) with mapi id 14.03.0319.002; Tue, 17 Jul 2018 07:30:42 -0600 From: "Wheeler, David M" To: Mingliang Pei , Dave Thaler , Andrew Atyeo , "teep@ietf.org" Thread-Topic: [Teep] Implementation feedback on draft-ietf-teep-opentrustprotocol-01 Thread-Index: AQHUHXxtkKoaWsfgnUel1QbgYTRqxKSTaJpg Date: Tue, 17 Jul 2018 13:30:42 +0000 Message-ID: <0627F5240443D2498FAA65332EE46C843B671968@CRSMSX102.amr.corp.intel.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZTcwM2FmM2QtY2Q5My00ZjBiLWFlODMtYTQ0M2Q4MjM2MjJiIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiMEp3XC9EbnF1Y1wvbDNmMWljNHd0cUN0OGVSb1wvY1M3Y1hPWU4xQ2N6TVZOZkMyY01rNXI3RWJSOENRODBoU0pDcyJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.200.100 dlp-reaction: no-action x-originating-ip: [172.18.205.10] Content-Type: multipart/alternative; boundary="_000_0627F5240443D2498FAA65332EE46C843B671968CRSMSX102amrcor_" MIME-Version: 1.0 Archived-At: Subject: Re: [Teep] Implementation feedback on draft-ietf-teep-opentrustprotocol-01 X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Jul 2018 13:30:59 -0000 --_000_0627F5240443D2498FAA65332EE46C843B671968CRSMSX102amrcor_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSB0aGluayB0aGlzIGNvbnZlcnNhdGlvbiBhYm91dCB0aGUgY29tbXVuaWNhdGlvbiBvZiB0aGUg aW5zdGFsbGF0aW9uIG9mIHRoZSBBcHBsaWNhdGlvbiBhbmQgZGVwZW5kZW50IFRBcyBpcyBnb2lu ZyB0byBiZSBhIHZlcnkgaW50ZXJlc3Rpbmcgb25lLg0KDQpBcyBJIHdpbGwgZGlzY3VzcyBpbiBt eSB0YWxrIHRvZGF5LCB0aGUgbW9kZWwgdGhhdCBNaW5nIGhhcyBkb2VzIG5vdCB3b3JrIHdpdGgg U0dYLCBiZWNhdXNlIHRoZXJlIGlzIG5vIFRFRSByZXNpZGVudCBjb21wb25lbnQgdG8gdGFsayB3 aXRoIHRoYXQg4oCca25vd3PigJ0gYWxsIHRoZSBUQXMgaW5zdGFsbGVkLiBUaGUgbW9kZWwgdGhh dCBNaW5nIG91dGxpbmVzIGlzIGFyY2hpdGVjdHVyZSBzcGVjaWZpYyB0byBUWiwgYW5kIGlzIGJh c2VkIG9uIGFuIGFsbC1rbm93aW5nLCBvbW5pLXBvdGVudCBURUUgKGxpa2UgYSBUcnVzdCBab25l IGtlcm5lbCksIGJ1dCB0aGlzIGRvZXMgbm90IGV4aXN0IGluIG90aGVyIFRFRXMg4oCTIHNwZWNp ZmljYWxseSBTR1guDQoNCldlIG5lZWQgdG8gd29yayB0byBleHRyYWN0IHRoZSBtb3N0IGltcG9y dGFudCBlbGVtZW50cywgYW5kIGxlYXZlIHRoZSByZXN0IHRvIGltcGxlbWVudGF0aW9uIGRldGFp bHMuDQpJIGNvbXBsZXRlbHkgdW5kZXJzdGFuZCB0aGUgbmVlZCAoZm9ybSBUWiBwZXJzcGVjdGl2 ZSkgdG8gaGF2ZSB0aGUgZGVwZW5kZW5jeSBtZXNzYWdlLg0KDQpMb29rIGZvcndhcmQgdG8gYW4g ZXhoaWxhcmF0aW5nIGNvbnZlcnNhdGlvbiB0b2RheSENCg0KRGF2ZSBXaGVlbGVyDQoNCkZyb206 IFRFRVAgW21haWx0bzp0ZWVwLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBNaW5nbGlh bmcgUGVpDQpTZW50OiBNb25kYXksIEp1bHkgMTYsIDIwMTggODoxNiBQTQ0KVG86IERhdmUgVGhh bGVyIDxkdGhhbGVyPTQwbWljcm9zb2Z0LmNvbUBkbWFyYy5pZXRmLm9yZz47IEFuZHJldyBBdHll byA8QW5kcmV3LkF0eWVvQGludGVyY2VkZS5jb20+OyB0ZWVwQGlldGYub3JnDQpTdWJqZWN0OiBS ZTogW1RlZXBdIEltcGxlbWVudGF0aW9uIGZlZWRiYWNrIG9uIGRyYWZ0LWlldGYtdGVlcC1vcGVu dHJ1c3Rwcm90b2NvbC0wMQ0KDQpWZXJ5IGdvb2QgY29tbWVudHMsIERhdmUuIFBsZWFzZSBzZWUg bXkgY29tbWVudHMgaW5saW5lICh3aXRoIFtNUF0pLCBNaW5nDQoNCkZyb206IFRFRVAgPHRlZXAt Ym91bmNlc0BpZXRmLm9yZzxtYWlsdG86dGVlcC1ib3VuY2VzQGlldGYub3JnPj4gb24gYmVoYWxm IG9mIERhdmUgVGhhbGVyIDxkdGhhbGVyPTQwbWljcm9zb2Z0LmNvbUBkbWFyYy5pZXRmLm9yZzxt YWlsdG86ZHRoYWxlcj00MG1pY3Jvc29mdC5jb21AZG1hcmMuaWV0Zi5vcmc+Pg0KRGF0ZTogTW9u ZGF5LCBKdWx5IDE2LCAyMDE4IGF0IDExOjAwIEFNDQpUbzogQW5kcmV3IEF0eWVvIDxBbmRyZXcu QXR5ZW9AaW50ZXJjZWRlLmNvbTxtYWlsdG86QW5kcmV3LkF0eWVvQGludGVyY2VkZS5jb20+Piwg InRlZXBAaWV0Zi5vcmc8bWFpbHRvOnRlZXBAaWV0Zi5vcmc+IiA8dGVlcEBpZXRmLm9yZzxtYWls dG86dGVlcEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW1RlZXBdIEltcGxlbWVudGF0aW9uIGZl ZWRiYWNrIG9uIGRyYWZ0LWlldGYtdGVlcC1vcGVudHJ1c3Rwcm90b2NvbC0wMQ0KDQpBbmRyZXcg d3JpdGVzOg0K4oCmDQoNCjEpICAgICAgU2VjdGlvbiA2LjUgZXhwbGFpbnMgdGhhdCB0aGUgVEFN IG5lZWRzIHRvIHJlY2VpdmUgYSBsaXN0IG9mIG9uZSBvciBtb3JlDQoNClRB4oCZcyB0aGF0IGFy ZSByZXF1ZXN0ZWQgdG8gYmUgaW5zdGFsbGVkIChTNi41LjEgcG9pbnQgMUEpLiAgSG93ZXZlciwg bm8NCg0KbWVzc2FnZSBpcyBkZWZpbmVkIGZvciBkb2luZyBzbywgd2hpY2ggcHJldmVudHMgaW50 ZXJvcGVyYWJpbGl0eS4gIEkNCnRoaW5rIHRoaXMgbWVzc2FnZSBuZWVkcyB0byBiZSBnZW5lcmF0 ZWQgYnkgdGhlIFRFRSAobm90IHRoZSByaWNoIGFwcCksDQpmb3IgcmVhc29ucyBJIHdpbGwgZXhw bGFpbiBpbiAjMyBiZWxvdy4NCg0KW0FBXSBJIGRvbuKAmXQgc2VlIHRoZSBuZWVkIGZvciBhIG1l c3NhZ2UgZm9yIGRlZmluaW5nIHRoZSBUQXMgdGhhdCBuZWVkIHRvIGJlIGluc3RhbGxlZC4gVGhl IE9UclAgbWVzc2FnZXMgYXJlIGJldHdlZW4gdGhlIFRBTSBhbmQgdGhlIFRFRSwgYnV0IHRoZSBk ZXNpcmUgdG8gaW5zdGFsbCBUQXMgY29tZXMgZnJvbSB0aGUgcmljaCBhcHAuICBJbiBwcmFjdGlj ZSwgYSByaWNoIGFwcCB3aWxsIGhhdmUgdGhlIGlkZW50aWZpZXJzIG9mIHRoZSBUQXMgaXQgcmVx dWlyZXMgYnVpbHQgaW50byBpdHMgb3duIGNvZGUsIHNpbmNlIGl0cyBvd24gY29kZSB3aWxsIGFs c28gYmUgY2FsbGluZyB0aG9zZSBUQXMgKGUuZy4gb25jZSBpbnN0YWxsZWQsIHRvIHBlcmZvcm0g c29tZSBEUk0gb3IgcGF5bWVudCBhdXRoZW50aWNhdGlvbikuIFRoZXJlZm9yZSBhIHJpY2ggYXBw IGlzIGF3YXJlIG9mIHRoZSBUQXMgaXQgbmVlZHMuICBJIGRvbuKAmXQgdGhpbmsgdGhpcyBpbmZv IGNhbiBjb21lIGZyb20gdGhlIFRFRSDigJMgc2luY2UgYXQgdGhpcyBwb2ludCB0aGUgVEEgaXMg bm90IGluc3RhbGxlZCB5ZXQsIHNvIHdoaWNoIHBhcnQgb2YgdGhlIFRFRSB3b3VsZCBoYXZlIHRo ZSBrbm93bGVkZ2Ugb2Ygd2hpY2ggVEFzIGFyZSBuZWVkZWQ/DQoNCg0KDQpBcyBJIG5vdGVkIGlu IG15IGFyY2ggZG9jIGNvbW1lbnRzLCBJIGRpc2FncmVlIHRoYXQgdGhlcmUgbmVlZHMgdG8gYmUg YW55IGNvbW11bmljYXRpb24gYmV0d2VlbiB0aGUgcmljaCBhcHAgYmVpbmcgaW5zdGFsbGVkLCBh bmQgdGhlIFRBTS4gIEEgdmFsaWQgaW1wbGVtZW50YXRpb24gbW9kZWwgc2hvdWxkIGJlIHRoYXQg dGhlIGFwcCBzdG9yZSBpbnN0YWxsZXIgcmVhZHMgdGhlIG1ldGFkYXRhIChpbmNsdWRpbmcgVEEg ZGVwZW5kZW5jaWVzKSBhYm91dCB0aGUgcmljaCBhcHAsIGFuZCBhcyBwYXJ0IG9mIGluc3RhbGxp bmcgdGhlIHJpY2ggYXBwICh3aXRob3V0IGV2ZXIgbmVlZGluZyB0byBydW4gaXQpLCB0aGUgaW5z dGFsbGVyIGNhbiBjb21tdW5pY2F0ZSB3aXRoIHRoZSBURUUgdG8gZXhwcmVzcyB0aG9zZSBkZXBl bmRlbmNpZXMsIHdoaWNoIHRoZW4gdHJpZ2dlcnMgdGhlIFRFRSB0byBnZW5lcmF0ZSBhIHNpZ25l ZCBtZXNzYWdlIHRvIHRoZSBUQU0sIHdoaWNoIGNhbiBiZSByZWxhdGVkIGJ5IHRoZSBpbnN0YWxs ZXIuDQoNCg0KDQpbTVBdIFRoZSByZXF1ZXN0ZWQgVEEgYnkgYSBSaWNoIEFwcCBjYW4gZ28gYnkg aXRzZWxmLCBvciBub3RlZCBieSBhbiBpbnN0YWxsZXIgdmlhIGl0cyBtZXRhZGF0YS4gSXQgZnVu ZGFtZW50YWxseSBleHByZXNzIHRoZSBuZWVkLiBJdCBtYXkgbm90IG1hdHRlciBpdCBpcyB0aGUg UmljaCBBcHAgb3IgYW4gaW5zdGFsbGVyIHRoYXQgZG9lcyB0aGUgam9iIG9uIGJlaGFsZiBvZiB0 aGUgUmljaCBBcHAgdG8gbWFrZSB0aGUgY2FsbC4gIFRoYXQgd2FzIGludGVudGlvbmFsbHkgbGVm dCBvdXQgb2YgdGhlIHNjb3BlLiBXZSBsZWZ0IHRoaXMgY2hvaWNlIHRvIHRoZSBSaWNoIEFwcCBp dHNlbGYuIEl0IGNhbiBkbyBpdHNlbGYsIG9yIGxldmVyYWdlIGFuIGluc3RhbGxlciBvciBvdGhl ciBwcm9ncmFtIHRvIGRvIGl0Lg0KDQoNCg0KVGhlIG1haW4gaW50ZXJmYWNlIGZvciBpbnRlcm9w ZXJhYmlsaXR5IGlzIHdoYXQgVEVFIHNob3VsZCBwcmVwYXJlIHRvIGFjY2VwdCBmcm9tIGEgUmlj aCBBcHAgb3IgYW4gaW5zdGFsbGVyIGluIFJFRS4gVGhpcyB3YXMgdGhlIGludGVudCBvZiBhbiBP VHJQIGFnZW50Lg0KDQoNCg0KVGhlcmUgaXMgb25lIG1ham9yIGRpZmZlcmVuY2UgaW4gY29udGFj dGluZyBURUUgZmlyc3QgdnMuIGNvbnRhY3RpbmcgVEFNIGZpcnN0LiBXaGVuIGEgUmljaCBBcHAg b3IgYW4gaW5zdGFsbGVyIGJlaW5nIGl0cyBkZWxlZ2F0ZSBsZXRzIFRFRSB0byBnZW5lcmF0ZSBh IHJlcXVlc3QsIGEgVEVFIG5lZWRzIGF1dGhvcml6ZSBzdWNoIGEgcmVxdWVzdC4gVGhlcmUgaXMg c29tZSByb2xlIHJlbGF0aW9uc2hpcCB0byBhZ3JlZSBvbiBoZXJlLiBBIGRldmljZSBpcyBtYW5h Z2VkIGJ5IGEgVEFNLCBhbmQgVEFN4oCZcyBpbml0aWF0ZWQgY2FsbCBjYW4gYmUgYXV0aG9yaXpl ZCBieSBhIFRFRS4gTm93LCBkb2VzIHRoZSBURUUgaGF2ZSB0byBhdXRob3JpemUgYm90aCBhbiBp bnN0YWxsZXIgLyBSaWNoIEFwcCBpbnRlbnQgYW5kIGFsc28gYSBUQU0gZm9yIGEgVEEgaW5zdGFs bGF0aW9uPyBPciB5b3UgbWVhbiBieSDigJxyZWxhdGVkIGJ5IHRoZSBpbnN0YWxsZXLigJ0gdGhh dCB0aGUgZmlyc3QgYXV0aG9yaXphdGlvbiBpcyBkZWxlZ2F0ZWQgZnJvbSBURUUgdG8gVEFNLCBh bmQgVEFNIHdpbGwgbWFrZSBhIGRlY2lzaW9uIHdoZXRoZXIgaXQgd2lsbCBob25vciBhbiBpbnN0 YWxsZXLigJlzIHJlcXVlc3QgYWJvdXQgYSBSaWNoIEFwcOKAmXMgZGVzaXJlIHRvIHVzZSBhIFRB IHRoYXQgaXQgbWFuYWdlcywgcmlnaHQ/DQoNCi0tLQ0KDQpJbiB0aGUgbGVzcyBlZmZpY2llbnQg bW9kZWwgd2hlcmUgdGhlIHJpY2ggYXBwIGhhcyB0byBiZSBydW4sIGFzIHRoZSBkb2MgaW1wbGll cywgdGhlIHNhbWUgcHJvY2VzcyBjYW4gb2NjdXIgd2hlcmUgdGhlIFRFRSBnZW5lcmF0ZXMgdGhl IG1lc3NhZ2UgaW4gcmVzcG9uc2UgdG8gdGhlIHJpY2ggYXBwIHRlbGxpbmcgdGhlIGFnZW50IGl0 IGhhcyBhIGRlcGVuZGVuY3kuDQoNCltNUF0gdHJ1ZSwgdGhpcyBpcyBvbmUgb2YgdGhlIG1vZGVs cy4NCg0K4oCmDQoNClB1dHRpbmcgbXkgaXNzdWUgIzEgYW5kIGlzc3VlICMyIHRvZ2V0aGVyIG1l YW5zIHRoZXJl4oCZcyBhbiBleHRyYSByb3VuZA0KDQp0cmlwIHRoYXQgaXMgdW5uZWNlc3Nhcnku ICA2LjUgc2F5cyB0aGUgVEFNIHJlY2VpdmUgYSBsaXN0IG9mIFRBcyBuZWVkZWQsDQoNCmFuZCB0 aGVuIHRoZSBUQU0ganVzdCBnb2VzIGJhY2sgYW5kIGFza3Mgd2hhdCBpcyBpbnN0YWxsZWQsIGp1 c3QgdG8gZ2V0DQphIGxpc3Qgb2Ygd2hhdCBuZWVkcyB0byBiZSBpbnN0YWxsZWQuICBUaGlzIGlz IHVubmVjZXNzYXJ5LCB0aGUgVEVFIGNhbiBqdXN0DQoNCnNlbmQgYSBsaXN0IG9mIG9uZSBvciBt b3JlIFRBcyB0aGF0IG5lZWQgdG8gYmUgaW5zdGFsbGVkIGFuZCBhcmVu4oCZdCBhbHJlYWR5Lg0K DQpIb3BlZnVsbHkgdGhpcyBleHBsYWlucyB3aHkgSSBzYWlkIGluIGlzc3VlICMxIGFib3ZlIHdo eSBJIHRoaW5rIHRoZSBtZXNzYWdlDQpuZWVkcyB0byBiZSBnZW5lcmF0ZWQgYnkgdGhlIFRFRS4N Cg0KW0FBXSBidXQgaG93IGNvdWxkIHRoZSBURUUgKHdoaWNoIGRvZXNu4oCZdCBoYXZlIGl0cyBU QXMgbG9hZGVkIHlldCkga25vdyB3aGF0IFRBcyBzaG91bGQgYmUgbG9hZGVkPw0KDQoNCg0KVGhl IHNhbWUgcGllY2Ugb2YgY29kZSB0aGF0IGNvbm5lY3RzIHRvIHRoZSBUQU0gdGVsbHMgdGhlIFRF RSB3aGF0IFRB4oCZcyBpdCBkZXNpcmVzLg0KDQpUaGUgVEVFIHRoZW4gZ2VuZXJhdGVzIGEgbWVz c2FnZSB3aXRoIHRoZSBsaXN0IG9mIFRBcyB0aGF0IGFyZW7igJl0IGFscmVhZHkgaW5zdGFsbGVk Lg0KDQoNCg0KW01QXSBTZWUgYXV0aG9yaXphdGlvbiBjb21tZW50IGFib3ZlIGZvciBob3cgYSBU RUUgYXV0aG9yaXplcyBhIHJlcXVlc3QgZnJvbSBhIFJpY2ggQXBwIC8gaW5zdGFsbGVyLiBEZWxl Z2F0ZWQgZmxvdyB3b3VsZCBtZWFuIHRoYXQgaXQgYWx3YXlzIGFjY2VwdCBhIHJlcXVlc3QsIGFu ZCBnZW5lcmF0ZXMgYSByZXF1ZXN0LiBXb3VsZCB0aGlzIGNhdXNlIHNvbWUgc3BhbSBhbmQgYXR0 YWNrIGlzc3VlIHRvIHRoZSBURUU/IE9uIHRoZSBvdGhlciBoYW5kLCBUQU0gaXMgZ2l2ZW4gdG8g aGFuZGxlIGl0cyBjbGllbnRzIGJlaW5nIFJpY2ggQXBwIG9yIGFuIGluc3RhbGxlciBpbiBhIFJF RSBldGMsIHdoaWNoIGlzIG91dCBvZiB0aGUgc2NvcGUgaW4gb3VyIGRlc2lnbi4NCg0KDQoNCuKA pg0KDQozKSAgICAgIFNlY3Rpb24gNi41LjEgcG9pbnQgOS5BIGltcGxpZXMgdGhhdCB0byBpbnN0 YWxsIGEgVEEsIG9uZSBtdXN0IGhhdmUgYW4gZXh0cmENCnJvdW5kIHRyaXAgZmlyc3QgdG8gY3Jl YXRlIGFuIFNEIGlmIG9uZSBpc27igJl0IGFscmVhZHkgdGhlcmUuICBJIHdvdWxkIGV4cGVjdCBv bmUNCmNvbW1vbiBjYXNlIHRvIGJlIHdoZXJlIHRoZXJlIGlzIG9uZSBUQSBwZXIgU0QsIHNvIHRo YXQgYWxsIFRBcyBhcmUgaXNvbGF0ZWQNCmZyb20gZWFjaCBvdGhlci4gIEFzIHN1Y2gsIHJlcXVp cmluZyB0aGUgZXh0cmEgZGVsYXkgaXMgaW5lZmZpY2llbnQgaW4gdGltZSwNCmJhbmR3aWR0aCwg YW5kIHByb2Nlc3NpbmcuICAgQWxsIHRoZSBmaWVsZHMgaW4gQ3JlYXRlU0QgYXJlIGFscmVhZHkg cHJlc2VudA0KaW4gYW4gSW5zdGFsbFRBIG1lc3NhZ2UgKGV4Y2VwdCB0aGUg4oCcZGlk4oCdIGZp ZWxkIG1lbnRpb25lZCBhYm92ZSBpbiBpc3N1ZSAjNSksDQpzbyBpdCBjb3VsZCBiZSBkb25lIGF1 dG9tYXRpY2FsbHkgYnkgdGhlIGZpcnN0IEluc3RhbGxUQSBtZXNzYWdlIGl0c2VsZi4NCltBQV0g d2hlbiB0aGUgU0QgaXMgY3JlYXRlZCwgYW4gYXN5bW1ldHJpYyBrZXlwYWlyIGlzIGdlbmVyYXRl ZCAoc3BhaWspLCBhbmQgdGhlIHB1YmxpYyBwYXJ0IG9mIHRoaXMgaXMgcmV0dXJuZWQuIFdoZW4g YSBUQSBpcyBpbnN0YWxsZWQsIGl0IGlzIGVuY3J5cHRlZCB3aXRoIHRoaXMga2V5LiBUaGlzIGVu YWJsZXMgc29tZSB1c2UgY2FzZXMgd2hlcmUgYSBUQU0gY291bGQgaW50ZXJmYWNlIHRvIGEgU1Ag YW5kIGVuYWJsZSBhbiBTUCB0byBwcm92aWRlIHRoZSBUQSBlbmNyeXB0ZWQgc3VjaCB0aGF0IHRo ZSBUQSBiaW5hcnkgaXMgbm90IGtub3duIGJ5IHRoZSBUQU0uDQpUaGUgc3BhaWsgaXMgYWxzbyB1 c2VkIHRvIGVuY3J5cHQgdGhlIHBlcnNvbmFsaXphdGlvbiBkYXRhICh0aGF0IGlzIGFsc28gc2Vu dCBpbiBJbnN0YWxsVEEpLCBhbmQgdGhlcmUgaXMgYWxzbyBhIHVzZSBjYXNlIGZvciBhIFRBTSBp bnRlcmZhY2luZyB0byBhbiBTUCBpbiBvcmRlciB0aGF0IHRoZSBTUCBlbmNyeXB0cyBwZXJzbyBk YXRhIGZvciB0aGF0IFRFRSBzdWNoIHRoYXQgaXQgdHJhdmVscyB2aWEgdGhlIFRBTSB0byB0aGUg VEVFLCBidXQgd2l0aG91dCB0aGUgVEFNIGhhdmluZyBhY2Nlc3MgdG8gdGhhdCBkYXRhDQpTaW5j ZSBJbnN0YWxsVEEgcmVxdWlyZXMga25vd2xlZGdlIG9mIHRoZSBwdWJsaWMga2V5IHJldHVybmVk IGZyb20gQ3JlYXRlU0QsIGl0IGlzIHRydWUgdGhhdCB0aGUgZXh0cmEgcm91bmQgdHJpcCBpcyBy ZXF1aXJlZC4NClNvIHRoZSBxdWVzdGlvbiBpcyB3aGV0aGVyIHRoZXJlIGlzIGEgY2FzZSBmb3Ig aW5zdGFsbGluZyBUQSAoYW5kIHRoZWlyIGFjY29tcGFueWluZyBwZXJzbyBkYXRhKSB3aXRob3V0 IHRoZSBhYmlsaXR5IHRvIHByb3ZpZGUgY29uZmlkZW50aWFsaXR5IGJldHdlZW4gYW4gU1AgYW5k IHRoZSBURUUgYnkgbWFraW5nIHRoYXQgbGF5ZXIgb2YgZW5jcnlwdGlvbiBvcHRpb25hbCwgYW5k IGJ5IGFsbG93aW5nIHRoZSBUQSAoYW5kIHBlcnNvIGRhdGE/KSB0byBiZSBidW5kbGVkIGludG8g Q3JlYXRlU0QNCg0KTXkgbWFpbiBwb2ludCBpcyB0aGF0IGl0IHNob3VsZCBiZSBwb3NzaWJsZSB0 byBjb21iaW5lIENyZWF0ZVNEIGludG8gdGhlIGZpcnN0IEluc3RhbGxUQSBhbmQgYmUgbW9yZSBl ZmZpY2llbnQuDQpBbHNvIHJlbWVtYmVyIHRoYXQgdGhlIFRBIGJpbmFyeSBuZWVkIG5vdCBjb21l IGZyb20gdGhlIFRBTS4NCg0KW01QXSBUaGlzIGNvdWxkIGJlIGFuIG9wdGlvbiwgSSB0aGluaywg d2hlbiBhIFRBIGJpbmFyeSBlbmNyeXB0aW9uIGlzbuKAmXQgbmVlZGVkLiBIb3dldmVyLCB3ZSBk aWQgZWxhYm9yYXRlIHRoaXMgaW4gdGhlIHZlcnkgYmVnaW5uaW5nIG9mIHByb3RvY29sIGRlc2ln biB3aGV0aGVyIHdlIGdpdmUgc3VjaCBhbiBvcHRpb24uIFdlIChPVHJQIEFsbGlhbmNlIGF0IHRo ZSB0aW1lKSBhZ3JlZWQgdGhhdCB0aGUgcHJvdGVjdGlvbiBvZiBUQSBiaW5hcnkgaXRzZWxmIGlz IHZlcnkgdmFsdWFibGUuIFlvdSBkb27igJl0IHdhbnQgc29tZW9uZSB0byByZXZlcnNlIGVuZ2lu ZWVyIHlvdXIgVEEgY29kZSB0aGF0IG1ha2VzIGV4cGxvaXQgZmluZGluZyBlYXNpZXIuIEluIHRo ZSBjdXJyZW50IGRlc2lnbiwgYSBUQSBiaW5hcnkgY29kZSBpcyBuZXZlciBnaXZlbiBjbGVhciB0 byBhbnkgUmljaCBBcHAgb3IgTUlUTS4gSXQgaXMgb25seSBrbm93biBieSB0aGUgZGV2ZWxvcGVy IGFuZCB0aGVuIHRoZSBydW5uaW5nIGRldmljZSBURUUgaXRzZWxmLiBUaGlzIHdhcyBhIHZlcnkg aW1wb3J0YW50IGRlc2lnbiBnb2FsIGluIHRoaXMgcHJvdG9jb2wuDQoNCg0KNCkgICAgICBUaGUg c2NvcGUgb2YgdW5pcXVlbmVzcyBvZiB0aGUg4oCccmlk4oCdIGFuZCDigJx0aWTigJ0gZmllbGRz IGlzIHVuZGVyc3BlY2lmaWVkLg0KDQpUaGV5IGp1c3Qgc2F5IOKAnHVuaXF1ZeKAnS4gIEkgdGhp bmsg4oCccmlk4oCdIGlzIGp1c3Qgc3VwcG9zZWQgdG8gYmUgdW5pcXVlIHdpdGhpbg0KDQphIGdp dmVuIHtzZXNzaW9uLOKAnXRpZOKAnX0gYnV0IEkgY2Fu4oCZdCB0ZWxsIGZvciBzdXJlLiAgQW5k IEkgdGhpbmsg4oCcdGlk4oCdIGlzIGp1c3Qgc3VwcG9zZWQNCnRvIGJlIHVuaXF1ZSB3aXRoaW4g YSBnaXZlbiBzZXNzaW9uIChub3QgZ2xvYmFsbHkgYWNyb3NzIGFsbCBzZXNzaW9ucywgYWxsIFRB TXMsDQoNCmFsbCBkZXZpY2VzKSwgYnV0IEkgY2Fu4oCZdCB0ZWxsLiAgIFRoZXnigJlyZSBhbHNv IGZvcm1hdHRlZCBhcyBzdHJpbmdzLCBidXQgSeKAmW0gbm90IHN1cmUNCndoeSB0aGV5IGNhbuKA mXQgYmUgaW50ZWdlcnMgd2hpY2ggSSB0aGluayB3b3VsZCBiZSBtdWNoIG1vcmUgZWZmaWNpZW50 Li4NCg0KW0FBXSBhbHRob3VnaCBpdCBpcyBub3QgbWFuZGF0ZWQsIHJhbmRvbSBndWlkcyBjYW4g YmUgYSB2aWFibGUgaW1wbGVtZW50YXRpb24gY2hvaWNlIGZvciB0aGVzZSAoYXMgaXQgdGFrZXMg YXdheSB0aGUgcmVxdWlyZW1lbnQgdG8gbWFuYWdlIGluY3JlbWVudGFsIGNvdW50ZXJzKSDigJMg c28gSSB3b3VsZCBub3Qgd2FudCB0byBzZWUgdGhlc2UgYmVjb21lIGludGVnZXJzLiBCeSBtYWtp bmcgdGhlbSBzdHJpbmdzLCBhIFRBTSBjYW4gY2hvb3NlIHRoZSBtZWNoYW5pc20gaXQgd2FudHMu DQoNCkkgdGFrZSB5b3VyIHBvaW50IGFib3V0IOKAnHJpZOKAnSBhbmQg4oCcdGlk4oCdIGJlaW5n IHVuZGVyc3BlY2lmaWVkLiBUaGUgdHJ1dGggaXMgdGhhdCB2YWx1ZXMgY29udGFpbmVkIGluIHRo ZXNlIGZpZWxkcyBkb27igJl0IG1hdHRlciB0byB0aGUgcHJvdG9jb2wgbXVjaC4gKHRoZXkgYXJl IG1vc3RseSBmb3IgdGhlIGNvbnZlbmllbmNlIG9mIHRoZSBUQU0gaW4gb3JkZXIgdG8gbWF0Y2gg dXAgcmVxdWVzdCBhbmQgcmVzcG9uc2UgbWVzc2FnZXMgKHJpZCksIGFuZCAodGlkKSB0byB1bmRl cnN0YW5kIHdoaWNoIG1lc3NhZ2VzIGJlbG9uZyBpbiBhIOKAmGNvbnZlcnNhdGlvbuKAmSkNCg0K DQoNClVubGVzcyB0aGVyZSBpcyBhIHJlYXNvbiBhIGd1aWQgaXMgYWN0dWFsbHkgbmVlZGVkIChl LmcuLCBnbG9iYWwgdW5pcXVlbmVzcyksIEkgd291bGQgYXJndWUgYWdhaW5zdCB0aGF0IGFkZGl0 aW9uYWwgY29tcGxleGl0eS4NCg0KSWYgYWxsIHlvdSBuZWVkIGlzIHVuaXF1ZW5lc3Mgd2l0aGlu IGEgc2Vzc2lvbiwgYSBzaW1wbGUgc2VxdWVuY2UgbnVtYmVyIHdvdWxkIHN1ZmZpY2UuDQoNCg0K DQpbTVBdIE9wZW4gc3VnZ2VzdGlvbiBmb3IgdGhpcyB0byBiZSBtb3JlIG5vcm1hbGl6ZWQuIEl0 IGlzIHVzZWQgYXMgYW4gaW50ZXJuYWwgbGlua2luZyBieSB0aGUgVEFNIGl0c2VsZiwgYXMgQW5k eSBjb21tZW50ZWQuDQoNCg0KDQo1KSAgICAgIEkgZm91bmQgaXQgY29uZnVzaW5nIHRoYXQgdGhl IG5hbWVzIG9mIHRoZSBtZXNzYWdlcyBkb27igJl0IG1hdGNoIHRoZSBuYW1lIHZhbHVlcw0KaW4g dGhlIG1lc3NhZ2VzIHRoZW1zZWx2ZXMgKOKAnEdldERldmljZVN0YXRlUmVzcG9uc2XigJ0gdnMN Cg0K4oCcR2V0RGV2aWNlVEVFU3RhdGVUQlNSZXNwb25zZeKAnSwgZXRjLikgICBIYXZpbmcgdGhl c2Ugbm90IG1hdGNoIGlzIGJ1Zy1wcm9uZS4NCg0KW0FBXSBJIGFncmVlLiBJbnN0ZWFkIG9mIGhh dmluZyBhIG1peHR1cmUgb2YgR2V0RGV2aWNlU3RhdGVYWFggYW5kIEdldERldmljZVRFRVN0YXRl WFhYIHRoZXkgc2hvdWxkIGFsbCBzdGFuZGFyZGl6ZSBvbiBHZXREZXZpY2VURUVTdGF0ZVhYWC4N Cg0KTm9kZSB0aGF0IHRoZXJlIGFyZSBpbnRlbnRpb25hbCBkaWZmZXJlbmNlcyBhdCB0aGUgZW5k IG9mIHRob3NlIHdvcmRzIChlLmcuIEdldERldmljZVRFRVN0YXRlVEJTUmVzcG9uc2UgdnMgR2V0 RGV2aWNlVEVFU3RhdGVSZXNwb25zZSBpcyBpbnRlbnRpb25hbCBhcyBvbmUgb2YgdGhlc2UgaXMg dGhlIOKAmHRvIGJlIHNpZ25lZOKAmSBkYXRhIGFuZCB0aGUgb3RoZXIgaXMgdGhlIHNpZ25lZCBk YXRhLg0KDQoNCg0KSSBkb27igJl0IHVuZGVyc3RhbmQsIGFuZCB0aGUgdGVybXMgc2VlbSB0byBi ZSBpbnRlcmNoYW5nZWFibGUgaW4gdGhlIGRvYywgc28gaWYgdGhlcmUgaXMgYSBkaXN0aW5jdGlv biwgaXTigJlzIG5vdCBleHBsYWluZWQgY2xlYXJseSBpbiB0aGUgZG9jLg0KDQoNCg0KW01QXSBU aGVyZSBpcyBhIGRpZmZlcmVuY2UgdGhlcmUuIFRoZSBkb2N1bWVudCBzYXlzOg0KDQoNCuKAnFRo ZSBmaW5hbCBHZXREZXZpY2VTdGF0ZVJlc3BvbnNlIHJlc3BvbnNlIG1lc3NhZ2UgY29uc2lzdHMg b2YgYW4gYXJyYXkgb2YgVEVFIHJlc3BvbnNlcy7igJ0NCg0KDQoNCg0KDQo2KSAgICAgIEl04oCZ cyB1bmNsZWFyIHdoZXRoZXIgYSByaWNoIGFwcCBjYW4gZGVwZW5kIG9uIHR3byBUQeKAmXMgZnJv bSBkaWZmZXJlbnQgVEFNcywNCg0KYW5kIHdoZXRoZXIgYSBUQSBjYW4gZGVwZW5kIG9uIGEgVEEg ZnJvbSBhIGRpZmZlcmVudCBUQU0uICBJbiB0aGUgdXNlIGNhc2UNCg0Kd2hlcmUgdGhlIGRldmlj ZSBhZG1pbiBydW5zIHRoZSBUQU0gYW5kIGNvbnRyb2xzIGFsbCBUQXMgb24gdGhlaXIgZGV2aWNl cyB0aGUNCg0KYW5zd2VyIHdvdWxkIGJlIG5vLiAgQnV0IGluIG90aGVyIHVzZSBjYXNlcyBJ4oCZ bSBub3Qgc3VyZS4gICBJZiBzbywgdGhlbiB0aGUgcXVlc3Rpb24NCmFyaXNlcyBhYm91dCBob3cg ZGVwZW5kZW5jaWVzIGFyZSBleHByZXNzZWQgYW5kIHdoZXRoZXIgYSBkZXBlbmRlbmN5IG5lZWRz DQp0byBleHByZXNzIHdoaWNoIFRBTSBpcyB1c2VkLiAgVGhpcyB0aGVuIGJlZ3MgdGhlIHF1ZXN0 aW9ucyBvZiB3aGV0aGVyIGEgVEEgbWlnaHQNCmJlIHZpYSBtb3JlIHRoYW4gb25lIFRBTSwgb3Ig bWlnaHQgY2hhbmdlIFRBTXMgb3ZlciB0aW1lLiAgIFRoZSBhbnN3ZXJzIGhlcmUNCnByb2JhYmx5 IGJlbG9uZyBpbiB0aGUgYXJjaCBkb2MuDQpbQUFdIFRBIGludGVyLWRlcGVuZGVuY3kgaXMgY29t cGxldGVseSBvdXQgb2YgdGhlIHNjb3BlIG9mIHRoZSBPVHJQIHByb3RvY29sLiAoc28gdGhlIHJp Y2ggYXBwIHZlbmRvciBuZWVkcyB0byBrbm93IGFsbCB0aGUgVEEgSURzIHRoZXkgbmVlZCBpbnN0 YWxsaW5nLCBhbmQgd2hpY2ggVEFNKHMpIHRvIGdldCB0aGVtIGZyb20pLg0KDQpUQXMgaW5oZXJl bnRseSBjYW4gZGVwZW5kIG9uIG90aGVyIFRB4oCZcy4gIEkgZG9u4oCZdCB0aGluayBpdCBzaG91 bGQgYmUgb3V0IG9mIHNjb3BlIGZvciB0aGUgV0cuDQoNCltNUF0gTGV0IHVzIGRpc2N1c3MgdGhp cyBtb3JlLiBJbiB0aGVvcnksIHRoZXJlIGNvdWxkIGJlIGFsbCBjaGFpbmluZyBkZXBlbmRlbmNp ZXMuIEl0IGlzbuKAmXQgY29tbW9uIHRvZGF5LiBXaGVuIFRBMSB1c2VzIFRBMiwgd291bGQgVEEx IGluc3RhbGxhdGlvbiBieSBUQU0gYW5kIFRFRSB3aWxsIG5lZWQgdG8gY2hlY2sgZXhpc3Rpbmcg b2YgVEEyPw0KDQpbTVBdIE92ZXJhbGwsIHRoYW5rcyBmb3IgeW91ciBncmVhdCBxdWVzdGlvbnMg YW5kIHN1Z2dlc3Rpb25zIG9mIHNvbWUgYWx0ZXJuYXRpdmUgbW9kZWxzLg0KDQpEYXZlDQo= --_000_0627F5240443D2498FAA65332EE46C843B671968CRSMSX102amrcor_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJ bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNv TGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5 OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRv bTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9u dC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFu LkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRl ZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwg UHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCnAubXNvbm9ybWFs MCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9y bWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZTox Mi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0Kc3Bhbi5FbWFp bFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMg0K CXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIzDQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjQNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4 dDt9DQpzcGFuLkVtYWlsU3R5bGUyNQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5N c29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZTox MC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdp bjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0 LWlkOjg1ODM1MTczMDsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0 ZS1pZHM6MjA3NjE4NjMzNiAxMzYwMDI1NDc0IDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3 Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1O30NCkBsaXN0IGwwOmxl dmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MzsNCgltc28tbGV2ZWwtdGV4dDoiJTFcKSI7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCW1hcmdpbi1sZWZ0OjEuMjVpbjsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJY29sb3I6IzFG NDk3RDt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEt bG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjEuNzVpbjsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0K QGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmln aHQ7DQoJbWFyZ2luLWxlZnQ6Mi4yNWluOw0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBs MDpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjIuNzVpbjsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2Vy Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgltYXJnaW4tbGVmdDozLjI1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0 IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0K CW1hcmdpbi1sZWZ0OjMuNzVpbjsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDA6bGV2 ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgltYXJnaW4tbGVmdDo0LjI1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBs aXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJbWFyZ2luLWxlZnQ6NC43NWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDps ZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgltYXJn aW4tbGVmdDo1LjI1aW47DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwxDQoJe21zby1s aXN0LWlkOjkyMzM0NTYwMzsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1w bGF0ZS1pZHM6LTEyNzY4NDgwNDAgNjc2OTg3MDUgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMg Njc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTU7fQ0KQGxpc3QgbDE6 bGV2ZWwxDQoJe21zby1sZXZlbC10ZXh0OiIlMVwpIjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu O30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dl cjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9 DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTps ZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2 ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2Vy Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30N CnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDld Pjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0K PC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91 dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpz aGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVT IiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlv bjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkkg dGhpbmsgdGhpcyBjb252ZXJzYXRpb24gYWJvdXQgdGhlIGNvbW11bmljYXRpb24gb2YgdGhlIGlu c3RhbGxhdGlvbiBvZiB0aGUgQXBwbGljYXRpb24gYW5kIGRlcGVuZGVudCBUQXMgaXMgZ29pbmcg dG8gYmUgYSB2ZXJ5IGludGVyZXN0aW5nIG9uZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OiMxRjQ5N0QiPkFzIEkgd2lsbCBkaXNjdXNzIGluIG15IHRhbGsgdG9kYXksIHRoZSBtb2RlbCB0 aGF0IE1pbmcgaGFzIGRvZXMgbm90IHdvcmsgd2l0aCBTR1gsIGJlY2F1c2UgdGhlcmUgaXMgbm8g VEVFIHJlc2lkZW50IGNvbXBvbmVudCB0byB0YWxrIHdpdGggdGhhdCDigJxrbm93c+KAnSBhbGwg dGhlIFRBcyBpbnN0YWxsZWQuIFRoZSBtb2RlbCB0aGF0IE1pbmcgb3V0bGluZXMgaXMNCiBhcmNo aXRlY3R1cmUgc3BlY2lmaWMgdG8gVFosIGFuZCBpcyBiYXNlZCBvbiBhbiBhbGwta25vd2luZywg b21uaS1wb3RlbnQgVEVFIChsaWtlIGEgVHJ1c3QgWm9uZSBrZXJuZWwpLCBidXQgdGhpcyBkb2Vz IG5vdCBleGlzdCBpbiBvdGhlciBURUVzIOKAkyBzcGVjaWZpY2FsbHkgU0dYLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+V2UgbmVlZCB0byB3b3JrIHRvIGV4dHJhY3QgdGhl IG1vc3QgaW1wb3J0YW50IGVsZW1lbnRzLCBhbmQgbGVhdmUgdGhlIHJlc3QgdG8gaW1wbGVtZW50 YXRpb24gZGV0YWlscy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SSBjb21wbGV0ZWx5IHVuZGVyc3RhbmQgdGhl IG5lZWQgKGZvcm0gVFogcGVyc3BlY3RpdmUpIHRvIGhhdmUgdGhlIGRlcGVuZGVuY3kgbWVzc2Fn ZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkxvb2sgZm9yd2FyZCB0byBh biBleGhpbGFyYXRpbmcgY29udmVyc2F0aW9uIHRvZGF5ITxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6IzFGNDk3RCI+RGF2ZSBXaGVlbGVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0iX01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9hPjwvcD4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGlu ZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBuYW1lPSJfX19f X3JlcGx5c2VwYXJhdG9yIj48L2E+PGI+RnJvbTo8L2I+IFRFRVAgW21haWx0bzp0ZWVwLWJvdW5j ZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPk1pbmdsaWFuZyBQZWk8YnI+DQo8Yj5T ZW50OjwvYj4gTW9uZGF5LCBKdWx5IDE2LCAyMDE4IDg6MTYgUE08YnI+DQo8Yj5Ubzo8L2I+IERh dmUgVGhhbGVyICZsdDtkdGhhbGVyPTQwbWljcm9zb2Z0LmNvbUBkbWFyYy5pZXRmLm9yZyZndDs7 IEFuZHJldyBBdHllbyAmbHQ7QW5kcmV3LkF0eWVvQGludGVyY2VkZS5jb20mZ3Q7OyB0ZWVwQGll dGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVGVlcF0gSW1wbGVtZW50YXRpb24gZmVl ZGJhY2sgb24gZHJhZnQtaWV0Zi10ZWVwLW9wZW50cnVzdHByb3RvY29sLTAxPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5WZXJ5IGdvb2QgY29tbWVudHMsIERhdmUuIFBs ZWFzZSBzZWUgbXkgY29tbWVudHMgaW5saW5lICh3aXRoIFtNUF0pLCBNaW5nPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXYgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMu MHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5URUVQICZsdDs8YSBocmVmPSJtYWlsdG86 dGVlcC1ib3VuY2VzQGlldGYub3JnIj50ZWVwLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBvbiBi ZWhhbGYgb2YgRGF2ZSBUaGFsZXIgJmx0OzxhIGhyZWY9Im1haWx0bzpkdGhhbGVyPTQwbWljcm9z b2Z0LmNvbUBkbWFyYy5pZXRmLm9yZyI+ZHRoYWxlcj00MG1pY3Jvc29mdC5jb21AZG1hcmMuaWV0 Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5Nb25kYXksIEp1bHkgMTYsIDIwMTggYXQg MTE6MDAgQU08YnI+DQo8Yj5UbzogPC9iPkFuZHJldyBBdHllbyAmbHQ7PGEgaHJlZj0ibWFpbHRv OkFuZHJldy5BdHllb0BpbnRlcmNlZGUuY29tIj5BbmRyZXcuQXR5ZW9AaW50ZXJjZWRlLmNvbTwv YT4mZ3Q7LCAmcXVvdDs8YSBocmVmPSJtYWlsdG86dGVlcEBpZXRmLm9yZyI+dGVlcEBpZXRmLm9y ZzwvYT4mcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzp0ZWVwQGlldGYub3JnIj50ZWVwQGlldGYu b3JnPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UmU6IFtUZWVwXSBJbXBsZW1lbnRhdGlv biBmZWVkYmFjayBvbiBkcmFmdC1pZXRmLXRlZXAtb3BlbnRydXN0cHJvdG9jb2wtMDE8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMxRjQ5N0QiPkFuZHJldyB3cml0ZXM6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPuKApjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwxIGxldmVsMSBsZm8y Ij4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjEp PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPlNlY3Rp b24gNi41IGV4cGxhaW5zIHRoYXQgdGhlIFRBTSBuZWVkcyB0byByZWNlaXZlIGEgbGlzdCBvZiBv bmUgb3IgbW9yZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+VEHigJlzIHRoYXQgYXJlIHJlcXVlc3RlZCB0byBiZSBp bnN0YWxsZWQgKFM2LjUuMSBwb2ludCAxQSkuJm5ic3A7IEhvd2V2ZXIsIG5vPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGlu Ij5tZXNzYWdlIGlzIGRlZmluZWQgZm9yIGRvaW5nIHNvLCB3aGljaCBwcmV2ZW50cyBpbnRlcm9w ZXJhYmlsaXR5LiZuYnNwOyBJPGJyPg0KdGhpbmsgdGhpcyBtZXNzYWdlIG5lZWRzIHRvIGJlIGdl bmVyYXRlZCBieSB0aGUgVEVFIChub3QgdGhlIHJpY2ggYXBwKSw8YnI+DQpmb3IgcmVhc29ucyBJ IHdpbGwgZXhwbGFpbiBpbiAjMyBiZWxvdy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+W0FBXSBJIGRvbuKAmXQg c2VlIHRoZSBuZWVkIGZvciBhIG1lc3NhZ2UgZm9yIGRlZmluaW5nIHRoZSBUQXMgdGhhdCBuZWVk IHRvIGJlIGluc3RhbGxlZC4gVGhlIE9UclAgbWVzc2FnZXMgYXJlIGJldHdlZW4gdGhlIFRBTSBh bmQgdGhlIFRFRSwgYnV0IHRoZSBkZXNpcmUgdG8gaW5zdGFsbCBUQXMgY29tZXMgZnJvbSB0aGUg cmljaCBhcHAuPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDsNCjwvc3Bh bj48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+SW4gcHJhY3RpY2UsIGEgcmljaCBhcHAgd2ls bCBoYXZlIHRoZSBpZGVudGlmaWVycyBvZiB0aGUgVEFzIGl0IHJlcXVpcmVzIGJ1aWx0IGludG8g aXRzIG93biBjb2RlLCBzaW5jZSBpdHMgb3duIGNvZGUgd2lsbCBhbHNvIGJlIGNhbGxpbmcgdGhv c2UgVEFzIChlLmcuIG9uY2UgaW5zdGFsbGVkLCB0byBwZXJmb3JtIHNvbWUgRFJNIG9yIHBheW1l bnQgYXV0aGVudGljYXRpb24pLiBUaGVyZWZvcmUNCiBhIHJpY2ggYXBwIGlzIGF3YXJlIG9mIHRo ZSBUQXMgaXQgbmVlZHMuJm5ic3A7IEkgZG9u4oCZdCB0aGluayB0aGlzIGluZm8gY2FuIGNvbWUg ZnJvbSB0aGUgVEVFIOKAkyBzaW5jZSBhdCB0aGlzIHBvaW50IHRoZSBUQSBpcyBub3QgaW5zdGFs bGVkIHlldCwgc28gd2hpY2ggcGFydCBvZiB0aGUgVEVFIHdvdWxkIGhhdmUgdGhlIGtub3dsZWRn ZSBvZiB3aGljaCBUQXMgYXJlIG5lZWRlZD88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+QXMgSSBub3RlZCBpbiBteSBhcmNoIGRvYyBjb21tZW50cywgSSBkaXNhZ3Jl ZSB0aGF0IHRoZXJlIG5lZWRzIHRvIGJlIGFueSBjb21tdW5pY2F0aW9uIGJldHdlZW4gdGhlIHJp Y2ggYXBwIGJlaW5nIGluc3RhbGxlZCwgYW5kIHRoZSBUQU0uJm5ic3A7IEEgdmFsaWQgaW1wbGVt ZW50YXRpb24gbW9kZWwgc2hvdWxkIGJlDQogdGhhdCB0aGUgYXBwIHN0b3JlIGluc3RhbGxlciBy ZWFkcyB0aGUgbWV0YWRhdGEgKGluY2x1ZGluZyBUQSBkZXBlbmRlbmNpZXMpIGFib3V0IHRoZSBy aWNoIGFwcCwgYW5kIGFzIHBhcnQgb2YgaW5zdGFsbGluZyB0aGUgcmljaCBhcHAgKHdpdGhvdXQg ZXZlciBuZWVkaW5nIHRvIHJ1biBpdCksIHRoZSBpbnN0YWxsZXIgY2FuIGNvbW11bmljYXRlIHdp dGggdGhlIFRFRSB0byBleHByZXNzIHRob3NlIGRlcGVuZGVuY2llcywgd2hpY2ggdGhlbiB0cmln Z2Vycw0KIHRoZSBURUUgdG8gZ2VuZXJhdGUgYSBzaWduZWQgbWVzc2FnZSB0byB0aGUgVEFNLCB3 aGljaCBjYW4gYmUgcmVsYXRlZCBieSB0aGUgaW5zdGFsbGVyLjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48 c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPltNUF0g VGhlIHJlcXVlc3RlZCBUQSBieSBhIFJpY2ggQXBwIGNhbiBnbyBieSBpdHNlbGYsIG9yIG5vdGVk IGJ5IGFuIGluc3RhbGxlciB2aWEgaXRzIG1ldGFkYXRhLiBJdCBmdW5kYW1lbnRhbGx5IGV4cHJl c3MgdGhlIG5lZWQuIEl0IG1heSBub3QgbWF0dGVyIGl0IGlzIHRoZSBSaWNoIEFwcCBvciBhbiBp bnN0YWxsZXIgdGhhdCBkb2VzIHRoZSBqb2Igb24NCiBiZWhhbGYgb2YgdGhlIFJpY2ggQXBwIHRv IG1ha2UgdGhlIGNhbGwuICZuYnNwOzxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5UaGF0IHdh cyBpbnRlbnRpb25hbGx5IGxlZnQgb3V0IG9mIHRoZSBzY29wZS4gV2UgbGVmdCB0aGlzIGNob2lj ZSB0byB0aGUgUmljaCBBcHAgaXRzZWxmLiBJdCBjYW4gZG8gaXRzZWxmLCBvciBsZXZlcmFnZSBh biBpbnN0YWxsZXIgb3Igb3RoZXIgcHJvZ3JhbSB0byBkbyBpdC48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjBpbiI+VGhlIG1haW4gaW50ZXJmYWNlIGZvciBpbnRlcm9wZXJhYmlsaXR5 IGlzIHdoYXQgVEVFIHNob3VsZCBwcmVwYXJlIHRvIGFjY2VwdCBmcm9tIGEgUmljaCBBcHAgb3Ig YW4gaW5zdGFsbGVyIGluIFJFRS4gVGhpcyB3YXMgdGhlIGludGVudCBvZiBhbiBPVHJQIGFnZW50 LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJn aW4tbGVmdDowaW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPlRoZXJlIGlzIG9uZSBtYWpvciBkaWZmZXJl bmNlIGluIGNvbnRhY3RpbmcgVEVFIGZpcnN0IHZzLiBjb250YWN0aW5nIFRBTSBmaXJzdC4gV2hl biBhIFJpY2ggQXBwIG9yIGFuIGluc3RhbGxlciBiZWluZyBpdHMgZGVsZWdhdGUgbGV0cyBURUUg dG8gZ2VuZXJhdGUgYSByZXF1ZXN0LCBhIFRFRSBuZWVkcyBhdXRob3JpemUgc3VjaCBhIHJlcXVl c3QuIFRoZXJlDQogaXMgc29tZSByb2xlIHJlbGF0aW9uc2hpcCB0byBhZ3JlZSBvbiBoZXJlLiBB IGRldmljZSBpcyBtYW5hZ2VkIGJ5IGEgVEFNLCBhbmQgVEFN4oCZcyBpbml0aWF0ZWQgY2FsbCBj YW4gYmUgYXV0aG9yaXplZCBieSBhIFRFRS4gTm93LCBkb2VzIHRoZSBURUUgaGF2ZSB0byBhdXRo b3JpemUgYm90aCBhbiBpbnN0YWxsZXIgLyBSaWNoIEFwcCBpbnRlbnQgYW5kIGFsc28gYSBUQU0g Zm9yIGEgVEEgaW5zdGFsbGF0aW9uPyBPciB5b3UgbWVhbiBieSDigJw8c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+cmVsYXRlZA0KIGJ5IHRoZSBpbnN0YWxsZXLigJ0gdGhhdCB0aGUgZmlyc3Qg YXV0aG9yaXphdGlvbiBpcyBkZWxlZ2F0ZWQgZnJvbSBURUUgdG8gVEFNLCBhbmQgVEFNIHdpbGwg bWFrZSBhIGRlY2lzaW9uIHdoZXRoZXIgaXQgd2lsbCBob25vciBhbiBpbnN0YWxsZXLigJlzIHJl cXVlc3QgYWJvdXQgYSBSaWNoIEFwcOKAmXMgZGVzaXJlIHRvIHVzZSBhIFRBIHRoYXQgaXQgbWFu YWdlcywgcmlnaHQ/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLS0mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SW4gdGhlIGxlc3MgZWZmaWNpZW50 IG1vZGVsIHdoZXJlIHRoZSByaWNoIGFwcCBoYXMgdG8gYmUgcnVuLCBhcyB0aGUgZG9jIGltcGxp ZXMsIHRoZSBzYW1lIHByb2Nlc3MgY2FuIG9jY3VyIHdoZXJlIHRoZSBURUUgZ2VuZXJhdGVzIHRo ZSBtZXNzYWdlIGluIHJlc3BvbnNlIHRvIHRoZSByaWNoIGFwcCB0ZWxsaW5nDQogdGhlIGFnZW50 IGl0IGhhcyBhIGRlcGVuZGVuY3kuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bTVBd IHRydWUsIHRoaXMgaXMgb25lIG9mIHRoZSBtb2RlbHMuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj7igKY8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW47dGV4dC1pbmRlbnQ6LjVpbiI+UHV0dGluZyBteSBpc3N1ZSAjMSBhbmQgaXNzdWUg IzIgdG9nZXRoZXIgbWVhbnMgdGhlcmXigJlzIGFuIGV4dHJhIHJvdW5kPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj50 cmlwIHRoYXQgaXMgdW5uZWNlc3NhcnkuJm5ic3A7IDYuNSBzYXlzIHRoZSBUQU0gcmVjZWl2ZSBh IGxpc3Qgb2YgVEFzIG5lZWRlZCw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFy YWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPmFuZCB0aGVuIHRoZSBUQU0ganVzdCBn b2VzIGJhY2sgYW5kIGFza3Mgd2hhdCBpcyBpbnN0YWxsZWQsIGp1c3QgdG8gZ2V0PGJyPg0KYSBs aXN0IG9mIHdoYXQgbmVlZHMgdG8gYmUgaW5zdGFsbGVkLiZuYnNwOyBUaGlzIGlzIHVubmVjZXNz YXJ5LCB0aGUgVEVFIGNhbiBqdXN0PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj5zZW5kIGEgbGlzdCBvZiBvbmUgb3Ig bW9yZSBUQXMgdGhhdCBuZWVkIHRvIGJlIGluc3RhbGxlZCBhbmQgYXJlbuKAmXQgYWxyZWFkeS48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW4iPkhvcGVmdWxseSB0aGlzIGV4cGxhaW5zIHdoeSBJIHNhaWQgaW4gaXNzdWUg IzEgYWJvdmUgd2h5IEkgdGhpbmsgdGhlIG1lc3NhZ2U8YnI+DQpuZWVkcyB0byBiZSBnZW5lcmF0 ZWQgYnkgdGhlIFRFRS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBo Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+W0FBXSBidXQgaG93IGNvdWxkIHRoZSBURUUg KHdoaWNoIGRvZXNu4oCZdCBoYXZlIGl0cyBUQXMgbG9hZGVkIHlldCkga25vdyB3aGF0IFRBcyBz aG91bGQgYmUgbG9hZGVkPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0 UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFG NDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdE Ij5UaGUgc2FtZSBwaWVjZSBvZiBjb2RlIHRoYXQgY29ubmVjdHMgdG8gdGhlIFRBTSB0ZWxscyB0 aGUgVEVFIHdoYXQgVEHigJlzIGl0IGRlc2lyZXMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxzcGFuIHN0 eWxlPSJjb2xvcjojMUY0OTdEIj5UaGUgVEVFIHRoZW4gZ2VuZXJhdGVzIGEgbWVzc2FnZSB3aXRo IHRoZSBsaXN0IG9mIFRBcyB0aGF0IGFyZW7igJl0IGFscmVhZHkgaW5zdGFsbGVkLjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MGluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj5bTVBdIFNlZSBhdXRob3JpemF0aW9uIGNvbW1l bnQgYWJvdmUgZm9yIGhvdyBhIFRFRSBhdXRob3JpemVzIGEgcmVxdWVzdCBmcm9tIGEgUmljaCBB cHAgLyBpbnN0YWxsZXIuIERlbGVnYXRlZCBmbG93IHdvdWxkIG1lYW4gdGhhdCBpdCBhbHdheXMg YWNjZXB0IGEgcmVxdWVzdCwgYW5kIGdlbmVyYXRlcyBhIHJlcXVlc3QuIFdvdWxkIHRoaXMgY2F1 c2Ugc29tZQ0KIHNwYW0gYW5kIGF0dGFjayBpc3N1ZSB0byB0aGUgVEVFPyBPbiB0aGUgb3RoZXIg aGFuZCwgVEFNIGlzIGdpdmVuIHRvIGhhbmRsZSBpdHMgY2xpZW50cyBiZWluZyBSaWNoIEFwcCBv ciBhbiBpbnN0YWxsZXIgaW4gYSBSRUUgZXRjLCB3aGljaCBpcyBvdXQgb2YgdGhlIHNjb3BlIGlu IG91ciBkZXNpZ24uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+4oCmPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJn aW4tbGVmdDoxLjc1aW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm80 Ij4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48c3Bh biBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj4zKTxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90 O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8 L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+U2VjdGlvbiA2LjUuMSBwb2ludCA5LkEgaW1w bGllcyB0aGF0IHRvIGluc3RhbGwgYSBUQSwgb25lIG11c3QgaGF2ZSBhbiBleHRyYTxicj4NCnJv dW5kIHRyaXAgZmlyc3QgdG8gY3JlYXRlIGFuIFNEIGlmIG9uZSBpc27igJl0IGFscmVhZHkgdGhl cmUuJm5ic3A7IEkgd291bGQgZXhwZWN0IG9uZTxicj4NCmNvbW1vbiBjYXNlIHRvIGJlIHdoZXJl IHRoZXJlIGlzIG9uZSBUQSBwZXIgU0QsIHNvIHRoYXQgYWxsIFRBcyBhcmUgaXNvbGF0ZWQ8YnI+ DQpmcm9tIGVhY2ggb3RoZXIuJm5ic3A7IEFzIHN1Y2gsIHJlcXVpcmluZyB0aGUgZXh0cmEgZGVs YXkgaXMgaW5lZmZpY2llbnQgaW4gdGltZSw8YnI+DQpiYW5kd2lkdGgsIGFuZCBwcm9jZXNzaW5n LiZuYnNwOyZuYnNwOyBBbGwgdGhlIGZpZWxkcyBpbiBDcmVhdGVTRCBhcmUgYWxyZWFkeSBwcmVz ZW50PGJyPg0KaW4gYW4gSW5zdGFsbFRBIG1lc3NhZ2UgKGV4Y2VwdCB0aGUg4oCcZGlk4oCdIGZp ZWxkIG1lbnRpb25lZCBhYm92ZSBpbiBpc3N1ZSAjNSksPGJyPg0Kc28gaXQgY291bGQgYmUgZG9u ZSBhdXRvbWF0aWNhbGx5IGJ5IHRoZSBmaXJzdCBJbnN0YWxsVEEgbWVzc2FnZSBpdHNlbGYuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDcwQzAiPltBQV0gd2hlbiB0aGUgU0QgaXMgY3JlYXRl ZCwgYW4gYXN5bW1ldHJpYyBrZXlwYWlyIGlzIGdlbmVyYXRlZCAoc3BhaWspLCBhbmQgdGhlIHB1 YmxpYyBwYXJ0IG9mIHRoaXMgaXMgcmV0dXJuZWQuIFdoZW4gYSBUQSBpcyBpbnN0YWxsZWQsIGl0 IGlzIGVuY3J5cHRlZCB3aXRoIHRoaXMga2V5LiBUaGlzIGVuYWJsZXMgc29tZQ0KIHVzZSBjYXNl cyB3aGVyZSBhIFRBTSBjb3VsZCBpbnRlcmZhY2UgdG8gYSBTUCBhbmQgZW5hYmxlIGFuIFNQIHRv IHByb3ZpZGUgdGhlIFRBIGVuY3J5cHRlZCBzdWNoIHRoYXQgdGhlIFRBIGJpbmFyeSBpcyBub3Qg a25vd24gYnkgdGhlIFRBTS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDcwQzAi PlRoZSBzcGFpayBpcyBhbHNvIHVzZWQgdG8gZW5jcnlwdCB0aGUgcGVyc29uYWxpemF0aW9uIGRh dGEgKHRoYXQgaXMgYWxzbyBzZW50IGluIEluc3RhbGxUQSksIGFuZCB0aGVyZSBpcyBhbHNvIGEg dXNlIGNhc2UgZm9yIGEgVEFNIGludGVyZmFjaW5nIHRvIGFuIFNQIGluIG9yZGVyIHRoYXQgdGhl IFNQIGVuY3J5cHRzDQogcGVyc28gZGF0YSBmb3IgdGhhdCBURUUgc3VjaCB0aGF0IGl0IHRyYXZl bHMgdmlhIHRoZSBUQU0gdG8gdGhlIFRFRSwgYnV0IHdpdGhvdXQgdGhlIFRBTSBoYXZpbmcgYWNj ZXNzIHRvIHRoYXQgZGF0YTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+ U2luY2UgSW5zdGFsbFRBIHJlcXVpcmVzIGtub3dsZWRnZSBvZiB0aGUgcHVibGljIGtleSByZXR1 cm5lZCBmcm9tIENyZWF0ZVNELCBpdCBpcyB0cnVlIHRoYXQgdGhlIGV4dHJhIHJvdW5kIHRyaXAg aXMgcmVxdWlyZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDA3MEMwIj5TbyB0 aGUgcXVlc3Rpb24gaXMgd2hldGhlciB0aGVyZSBpcyBhIGNhc2UgZm9yIGluc3RhbGxpbmcgVEEg KGFuZCB0aGVpciBhY2NvbXBhbnlpbmcgcGVyc28gZGF0YSkgd2l0aG91dCB0aGUgYWJpbGl0eSB0 byBwcm92aWRlIGNvbmZpZGVudGlhbGl0eSBiZXR3ZWVuIGFuIFNQIGFuZCB0aGUgVEVFIGJ5IG1h a2luZyB0aGF0DQogbGF5ZXIgb2YgZW5jcnlwdGlvbiBvcHRpb25hbCwgYW5kIGJ5IGFsbG93aW5n IHRoZSBUQSAoYW5kIHBlcnNvIGRhdGE/KSB0byBiZSBidW5kbGVkIGludG8gQ3JlYXRlU0Q8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPk15IG1haW4gcG9pbnQgaXMgdGhhdCBp dCBzaG91bGQgYmUgcG9zc2libGUgdG8gY29tYmluZSBDcmVhdGVTRCBpbnRvIHRoZSBmaXJzdCBJ bnN0YWxsVEEgYW5kIGJlIG1vcmUgZWZmaWNpZW50Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5BbHNvIHJlbWVt YmVyIHRoYXQgdGhlIFRBIGJpbmFyeSBuZWVkIG5vdCBjb21lIGZyb20gdGhlIFRBTS48L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPltNUF0gVGhpcyBjb3VsZCBiZSBhbiBvcHRpb24sIEkg dGhpbmssIHdoZW4gYSBUQSBiaW5hcnkgZW5jcnlwdGlvbiBpc27igJl0IG5lZWRlZC4gSG93ZXZl ciwgd2UgZGlkIGVsYWJvcmF0ZSB0aGlzIGluIHRoZSB2ZXJ5IGJlZ2lubmluZyBvZiBwcm90b2Nv bCBkZXNpZ24gd2hldGhlciB3ZSBnaXZlIHN1Y2ggYW4gb3B0aW9uLiBXZSAoT1RyUCBBbGxpYW5j ZSBhdCB0aGUgdGltZSkgYWdyZWVkIHRoYXQgdGhlIHByb3RlY3Rpb24NCiBvZiBUQSBiaW5hcnkg aXRzZWxmIGlzIHZlcnkgdmFsdWFibGUuIFlvdSBkb27igJl0IHdhbnQgc29tZW9uZSB0byByZXZl cnNlIGVuZ2luZWVyIHlvdXIgVEEgY29kZSB0aGF0IG1ha2VzIGV4cGxvaXQgZmluZGluZyBlYXNp ZXIuIEluIHRoZSBjdXJyZW50IGRlc2lnbiwgYSBUQSBiaW5hcnkgY29kZSBpcyBuZXZlciBnaXZl biBjbGVhciB0byBhbnkgUmljaCBBcHAgb3IgTUlUTS4gSXQgaXMgb25seSBrbm93biBieSB0aGUg ZGV2ZWxvcGVyIGFuZCB0aGVuDQogdGhlIHJ1bm5pbmcgZGV2aWNlIFRFRSBpdHNlbGYuIFRoaXMg d2FzIGEgdmVyeSBpbXBvcnRhbnQgZGVzaWduIGdvYWwgaW4gdGhpcyBwcm90b2NvbC48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjc1aW47dGV4 dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm80Ij4NCjwhW2lmICFzdXBwb3J0 TGlzdHNdPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6 SWdub3JlIj40KTxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bh bj48IVtlbmRpZl0+VGhlIHNjb3BlIG9mIHVuaXF1ZW5lc3Mgb2YgdGhlIOKAnHJpZOKAnSBhbmQg 4oCcdGlk4oCdIGZpZWxkcyBpcyB1bmRlcnNwZWNpZmllZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPlRoZXkganVz dCBzYXkg4oCcdW5pcXVl4oCdLiZuYnNwOyBJIHRoaW5rIOKAnHJpZOKAnSBpcyBqdXN0IHN1cHBv c2VkIHRvIGJlIHVuaXF1ZSB3aXRoaW48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0 UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPmEgZ2l2ZW4ge3Nlc3Npb24s4oCd dGlk4oCdfSBidXQgSSBjYW7igJl0IHRlbGwgZm9yIHN1cmUuJm5ic3A7IEFuZCBJIHRoaW5rIOKA nHRpZOKAnSBpcyBqdXN0IHN1cHBvc2VkPGJyPg0KdG8gYmUgdW5pcXVlIHdpdGhpbiBhIGdpdmVu IHNlc3Npb24gKG5vdCBnbG9iYWxseSBhY3Jvc3MgYWxsIHNlc3Npb25zLCBhbGwgVEFNcyw8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPmFsbCBkZXZpY2VzKSwgYnV0IEkgY2Fu4oCZdCB0ZWxsLiZuYnNwOyZuYnNwOyBU aGV54oCZcmUgYWxzbyBmb3JtYXR0ZWQgYXMgc3RyaW5ncywgYnV0IEnigJltIG5vdCBzdXJlPGJy Pg0Kd2h5IHRoZXkgY2Fu4oCZdCBiZSBpbnRlZ2VycyB3aGljaCBJIHRoaW5rIHdvdWxkIGJlIG11 Y2ggbW9yZSBlZmZpY2llbnQuLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDA3MEMwIj5bQUFdIGFsdGhvdWdoIGl0IGlzIG5v dCBtYW5kYXRlZCwgcmFuZG9tIGd1aWRzIGNhbiBiZSBhIHZpYWJsZSBpbXBsZW1lbnRhdGlvbiBj aG9pY2UgZm9yIHRoZXNlIChhcyBpdCB0YWtlcyBhd2F5IHRoZSByZXF1aXJlbWVudCB0byBtYW5h Z2UgaW5jcmVtZW50YWwgY291bnRlcnMpIOKAkyBzbyBJIHdvdWxkIG5vdCB3YW50IHRvIHNlZSB0 aGVzZSBiZWNvbWUNCiBpbnRlZ2Vycy4gQnkgbWFraW5nIHRoZW0gc3RyaW5ncywgYSBUQU0gY2Fu IGNob29zZSB0aGUgbWVjaGFuaXNtIGl0IHdhbnRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+SSB0 YWtlIHlvdXIgcG9pbnQgYWJvdXQg4oCccmlk4oCdIGFuZCDigJx0aWTigJ0gYmVpbmcgdW5kZXJz cGVjaWZpZWQuIFRoZSB0cnV0aCBpcyB0aGF0IHZhbHVlcyBjb250YWluZWQgaW4gdGhlc2UgZmll bGRzIGRvbuKAmXQgbWF0dGVyIHRvIHRoZSBwcm90b2NvbCBtdWNoLiAodGhleSBhcmUgbW9zdGx5 IGZvciB0aGUgY29udmVuaWVuY2Ugb2YgdGhlIFRBTSBpbiBvcmRlcg0KIHRvIG1hdGNoIHVwIHJl cXVlc3QgYW5kIHJlc3BvbnNlIG1lc3NhZ2VzIChyaWQpLCBhbmQgKHRpZCkgdG8gdW5kZXJzdGFu ZCB3aGljaCBtZXNzYWdlcyBiZWxvbmcgaW4gYSDigJhjb252ZXJzYXRpb27igJkpPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4t bGVmdDowaW4iPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPlVubGVzcyB0aGVyZSBpcyBhIHJlYXNv biBhIGd1aWQgaXMgYWN0dWFsbHkgbmVlZGVkIChlLmcuLCBnbG9iYWwgdW5pcXVlbmVzcyksIEkg d291bGQgYXJndWUgYWdhaW5zdCB0aGF0IGFkZGl0aW9uYWwgY29tcGxleGl0eS48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPklmIGFsbCB5b3UgbmVlZCBpcyB1 bmlxdWVuZXNzIHdpdGhpbiBhIHNlc3Npb24sIGEgc2ltcGxlIHNlcXVlbmNlIG51bWJlciB3b3Vs ZCBzdWZmaWNlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgi IHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPltNUF0gT3BlbiBzdWdnZXN0aW9uIGZvciB0aGlzIHRv IGJlIG1vcmUgbm9ybWFsaXplZC4gSXQgaXMgdXNlZCBhcyBhbiBpbnRlcm5hbCBsaW5raW5nIGJ5 IHRoZSBUQU0gaXRzZWxmLCBhcyBBbmR5IGNvbW1lbnRlZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS43NWluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvNCI+DQo8 IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5 bGU9Im1zby1saXN0Oklnbm9yZSI+NSk8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1l cyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFu Pjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPkkgZm91bmQgaXQgY29uZnVzaW5nIHRoYXQgdGhlIG5h bWVzIG9mIHRoZSBtZXNzYWdlcyBkb27igJl0IG1hdGNoIHRoZSBuYW1lIHZhbHVlczxicj4NCmlu IHRoZSBtZXNzYWdlcyB0aGVtc2VsdmVzICjigJxHZXREZXZpY2VTdGF0ZVJlc3BvbnNl4oCdIHZz IDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJn aW4tbGVmdDoxLjBpbiI+4oCcR2V0RGV2aWNlVEVFU3RhdGVUQlNSZXNwb25zZeKAnSwgZXRjLikm bmJzcDsmbmJzcDsgSGF2aW5nIHRoZXNlIG5vdCBtYXRjaCBpcyBidWctcHJvbmUuPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMw MDcwQzAiPltBQV0gSSBhZ3JlZS4gSW5zdGVhZCBvZiBoYXZpbmcgYSBtaXh0dXJlIG9mDQo8Yj5H ZXREZXZpY2VTdGF0ZTwvYj5YWFggYW5kIDxiPkdldERldmljZVRFRVN0YXRlPC9iPlhYWCB0aGV5 IHNob3VsZCBhbGwgc3RhbmRhcmRpemUgb24NCjxiPkdldERldmljZVRFRVN0YXRlPC9iPlhYWC48 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDcwQzAiPk5vZGUgdGhhdCB0aGVyZSBhcmUgaW50ZW50aW9uYWwgZGlm ZmVyZW5jZXMgYXQgdGhlIGVuZCBvZiB0aG9zZSB3b3JkcyAoZS5nLiBHZXREZXZpY2VURUVTdGF0 ZTxiPlRCU1Jlc3BvbnNlPC9iPiB2cyBHZXREZXZpY2VURUVTdGF0ZTxiPlJlc3BvbnNlPC9iPiBp cyBpbnRlbnRpb25hbCBhcyBvbmUgb2YgdGhlc2UgaXMgdGhlIOKAmHRvIGJlIHNpZ25lZOKAmQ0K IGRhdGEgYW5kIHRoZSBvdGhlciBpcyB0aGUgc2lnbmVkIGRhdGEuPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4i PjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PHNw YW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkkgZG9u4oCZdCB1bmRlcnN0YW5kLCBhbmQgdGhlIHRl cm1zIHNlZW0gdG8gYmUgaW50ZXJjaGFuZ2VhYmxlIGluIHRoZSBkb2MsIHNvIGlmIHRoZXJlIGlz IGEgZGlzdGluY3Rpb24sIGl04oCZcyBub3QgZXhwbGFpbmVkIGNsZWFybHkgaW4gdGhlIGRvYy48 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjBpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlz dFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+W01QXSBUaGVyZSBpcyBhIGRpZmZl cmVuY2UgdGhlcmUuIFRoZSBkb2N1bWVudCBzYXlzOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW4iPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPuKAnFRo ZSBmaW5hbCBHZXREZXZpY2VTdGF0ZVJlc3BvbnNlIHJlc3BvbnNlIG1lc3NhZ2UgY29uc2lzdHMg b2YgYW4gYXJyYXkgb2YgVEVFIHJlc3BvbnNlcy7igJ08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbiI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjBpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFn cmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNzVpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxp c3Q6bDAgbGV2ZWwxIGxmbzQiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImNv bG9yOiMxRjQ5N0QiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjYpPHNwYW4gc3R5bGU9 ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5JdOKAmXMgdW5j bGVhciB3aGV0aGVyIGEgcmljaCBhcHAgY2FuIGRlcGVuZCBvbiB0d28gVEHigJlzIGZyb20gZGlm ZmVyZW50IFRBTXMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj5hbmQgd2hldGhlciBhIFRBIGNhbiBkZXBlbmQgb24g YSBUQSBmcm9tIGEgZGlmZmVyZW50IFRBTS4mbmJzcDsgSW4gdGhlIHVzZSBjYXNlPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEu MGluIj53aGVyZSB0aGUgZGV2aWNlIGFkbWluIHJ1bnMgdGhlIFRBTSBhbmQgY29udHJvbHMgYWxs IFRBcyBvbiB0aGVpciBkZXZpY2VzIHRoZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xp c3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+YW5zd2VyIHdvdWxkIGJlIG5v LiZuYnNwOyBCdXQgaW4gb3RoZXIgdXNlIGNhc2VzIEnigJltIG5vdCBzdXJlLiZuYnNwOyZuYnNw OyBJZiBzbywgdGhlbiB0aGUgcXVlc3Rpb248YnI+DQphcmlzZXMgYWJvdXQgaG93IGRlcGVuZGVu Y2llcyBhcmUgZXhwcmVzc2VkIGFuZCB3aGV0aGVyIGEgZGVwZW5kZW5jeSBuZWVkczxicj4NCnRv IGV4cHJlc3Mgd2hpY2ggVEFNIGlzIHVzZWQuJm5ic3A7IFRoaXMgdGhlbiBiZWdzIHRoZSBxdWVz dGlvbnMgb2Ygd2hldGhlciBhIFRBIG1pZ2h0PGJyPg0KYmUgdmlhIG1vcmUgdGhhbiBvbmUgVEFN LCBvciBtaWdodCBjaGFuZ2UgVEFNcyBvdmVyIHRpbWUuJm5ic3A7Jm5ic3A7IFRoZSBhbnN3ZXJz IGhlcmU8YnI+DQpwcm9iYWJseSBiZWxvbmcgaW4gdGhlIGFyY2ggZG9jLjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0 eWxlPSJjb2xvcjojMDA3MEMwIj5bQUFdIFRBIGludGVyLWRlcGVuZGVuY3kgaXMgY29tcGxldGVs eSBvdXQgb2YgdGhlIHNjb3BlIG9mIHRoZSBPVHJQIHByb3RvY29sLiAoc28gdGhlIHJpY2ggYXBw IHZlbmRvciBuZWVkcyB0byBrbm93IGFsbCB0aGUgVEEgSURzIHRoZXkgbmVlZCBpbnN0YWxsaW5n LCBhbmQgd2hpY2ggVEFNKHMpIHRvIGdldCB0aGVtIGZyb20pLjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzFGNDk3RCI+VEFzIGluaGVyZW50bHkgY2FuIGRlcGVuZCBvbiBvdGhlciBUQeKA mXMuJm5ic3A7IEkgZG9u4oCZdCB0aGluayBpdCBzaG91bGQgYmUgb3V0IG9mIHNjb3BlIGZvciB0 aGUgV0cuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bTVBdIExldCB1cyBkaXNjdXNz IHRoaXMgbW9yZS4gSW4gdGhlb3J5LCB0aGVyZSBjb3VsZCBiZSBhbGwgY2hhaW5pbmcgZGVwZW5k ZW5jaWVzLiBJdCBpc27igJl0IGNvbW1vbiB0b2RheS4gV2hlbiBUQTEgdXNlcyBUQTIsIHdvdWxk IFRBMSBpbnN0YWxsYXRpb24gYnkgVEFNIGFuZCBURUUgd2lsbCBuZWVkIHRvIGNoZWNrIGV4aXN0 aW5nIG9mIFRBMj88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W01QXSBPdmVyYWxsLCB0aGFua3Mg Zm9yIHlvdXIgZ3JlYXQgcXVlc3Rpb25zIGFuZCBzdWdnZXN0aW9ucyBvZiBzb21lIGFsdGVybmF0 aXZlIG1vZGVscy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMx RjQ5N0QiPkRhdmU8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRt bD4NCg== --_000_0627F5240443D2498FAA65332EE46C843B671968CRSMSX102amrcor_-- From nobody Tue Jul 17 07:36:08 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82265130E28 for ; Tue, 17 Jul 2018 07:35:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.011 X-Spam-Level: X-Spam-Status: No, score=-2.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vGN_u0zvN_Jg for ; Tue, 17 Jul 2018 07:35:48 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on070e.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe48::70e]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1423C130DF9 for ; Tue, 17 Jul 2018 07:35:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yMzOV5bqtXHMMbkA8vOXRCtz6fWuBNnrffeGhIjhJQ4=; b=Up4/SXIiivAXDy/9TgOlxEy/6OEUkZl2hYph5adqJ1TlDUvbioc4lwalqbpJ32LtTjuowGbDcrLb+38KqGdHwEmt/7w2JZ3UEbKbbcs13Lb06RFtEpHXWnnGGFE/Cl7ZnvFFr2WuOCAo+GbP0V4cXceLvcG55yPPgUR1LzkXIqk= Received: from DM5PR2101MB0805.namprd21.prod.outlook.com (10.167.105.149) by DM5PR2101MB0888.namprd21.prod.outlook.com (52.132.132.157) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.995.0; Tue, 17 Jul 2018 14:35:46 +0000 Received: from DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::8416:6f:8f6b:3fb7]) by DM5PR2101MB0805.namprd21.prod.outlook.com ([fe80::8416:6f:8f6b:3fb7%3]) with mapi id 15.20.0995.004; Tue, 17 Jul 2018 14:35:46 +0000 From: Dave Thaler To: Mingliang Pei , Andrew Atyeo , "teep@ietf.org" Thread-Topic: [Teep] Implementation feedback on draft-ietf-teep-opentrustprotocol-01 Thread-Index: AQHUHXxtkKoaWsfgnUel1QbgYTRqxKSTdQog Date: Tue, 17 Jul 2018 14:35:46 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2018-07-17T14:35:42.6965935Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:67c:1232:144:9f0:7c8d:3aa8:626f] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2101MB0888; 6:CzGN/iJbYDIsNPaqT7ln1o+X04JmNHMQUhx9QekzEWLEGOlnjsvCo7RPeBBRNOrHhftXSaYEoQSZ68K7Gj0Oe12c1nPjiKXPW1LNph3jcFimLDbkIHLvQ5jNMO7KM4jLmf1P4Tl6yDcDVTey9zIU3s5t37ExBXEhaAmpRcGp53IVKEHxBQ0Ko47jW8+g2d4rFxotnTqbr6VoGTbfruLYK5TnIpNqVkDInW6Lfhxyp5a35LZCXa3HXhT/J1JbJgfTZWHnCCt2OlZEOd1bKXd6MyvfSFONNFClLMWCfVkPG2VOkHbxLoD94hbORq7std41eghkpUHdnlPd4YrClt7oRl3B2ljbyxyxP8BaxKMvRznT7q2KThQfBt07GBvXOhiu40aPy7bh95BkvwNaX6nYrGinYWzWGnpJxf98Qv+O4FVyFEm/O+IH/525YS54C5vU1CsGYSonFAxG7FYFp8n6gA==; 5:2xsPZsNkPVKNVfji6tfGP1s8+O9mEC0By9Hkrpw/Wsczai2752r1z4WtBV5/N/6HhCg1TSMM+d3kIQSf08BVLhGaTxWbB1owi+GRAQLqDrDR0gYWTZwOWYTJbCBF06CCaG8jl0aDhTpTcBP1+KnVtUpKQBN31XUlAR9s4nN+h0Q=; 7:3mBHlMFar8i/5WKMQ4awni35qeMRr4YeO+TiysSc7p/6a9mg7xDP52YpkHYXXfPVTxrsodcjE+pYaFS4TQCVhEgUa4D+eZOXrlNA/Sq5jsP0qAOZugEXQdhlng65wky8G42UwdnaAm+RWf3I+GgS08GCSoDlGINLDJaX3Dd2SNagszPKYutn2hjxBmQ+JzYQRIjj8lQxzX6J1jbPObp/C2/0uHQKkYcdZ9fPep7SwIR1q66LmD+sV/FruKCOqPYd x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 8bd85b2a-8e7e-4ec3-7abf-08d5ebf29570 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(48565401081)(2017052603328)(7193020); SRVR:DM5PR2101MB0888; x-ms-traffictypediagnostic: DM5PR2101MB0888: authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(3231311)(944501410)(52105095)(2018427008)(10201501046)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123564045)(20161123562045)(20161123560045)(6072148)(201708071742011)(7699016); SRVR:DM5PR2101MB0888; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2101MB0888; x-forefront-prvs: 073631BD3D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(366004)(136003)(346002)(376002)(396003)(199004)(189003)(86612001)(102836004)(6506007)(478600001)(68736007)(486006)(86362001)(2900100001)(476003)(22452003)(316002)(97736004)(8936002)(256004)(14444005)(10090500001)(9686003)(6116002)(8676002)(5250100002)(6436002)(2501003)(55016002)(305945005)(7696005)(186003)(2906002)(81156014)(76176011)(6246003)(446003)(14454004)(81166006)(33656002)(106356001)(105586002)(74316002)(25786009)(46003)(7736002)(53936002)(5660300001)(99286004)(11346002)(229853002)(110136005)(10290500003)(8990500004); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB0888; H:DM5PR2101MB0805.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: Zq6itOgYR1ZEMCo9sdHXP1J6oNSoHO9tP95os86FHMze1riNmJejCgHlyN4WmlBslvbfy3m92V+++Wl0TNprtumtuughE0s67N+x2NWkuwSA0R1e2p9KD2ay2glCx5kRlizC37f4cYlV1SwurtCBkbl7YLul01iclcuk+pd6FUPicqDmnCO7oMWBzZdvjcUlH8tOFbSJym6Og7gz9IvTGi+MDLHw9Aaa52sgY9iF4lKkpJTEi24jhRNiLrvJ3HFiy6M7qOvSuY/WOckQ/w5icKnVBI6pSObFrwAEYq3KeUfoD0IMLXhv10s0cou8MW/QFGM9o12ewSdot3J1gQrJFx7MpNvfumqGzAcMVWV25CI= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8bd85b2a-8e7e-4ec3-7abf-08d5ebf29570 X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Jul 2018 14:35:46.3020 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0888 Archived-At: Subject: Re: [Teep] Implementation feedback on draft-ietf-teep-opentrustprotocol-01 X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Jul 2018 14:35:55 -0000 TWluZ2xpYW5nIFBlaSB3cml0ZXM6DQouLi4NCj4gVGhlcmUgaXMgb25lIG1ham9yIGRpZmZlcmVu Y2UgaW4gY29udGFjdGluZyBURUUgZmlyc3QgdnMuIGNvbnRhY3RpbmcgVEFNIGZpcnN0LiANCj4g V2hlbiBhIFJpY2ggQXBwIG9yIGFuIGluc3RhbGxlciBiZWluZyBpdHMgZGVsZWdhdGUgbGV0cyBU RUUgdG8gZ2VuZXJhdGUgYSByZXF1ZXN0LA0KPiBhIFRFRSBuZWVkcyBhdXRob3JpemUgc3VjaCBh IHJlcXVlc3QuIFRoZXJlIGlzIHNvbWUgcm9sZSByZWxhdGlvbnNoaXAgdG8gYWdyZWUNCj4gb24g aGVyZS4gQSBkZXZpY2UgaXMgbWFuYWdlZCBieSBhIFRBTSwgYW5kIFRBTeKAmXMgaW5pdGlhdGVk IGNhbGwgY2FuIGJlIGF1dGhvcml6ZWQNCj4gYnkgYSBURUUuIE5vdywgZG9lcyB0aGUgVEVFIGhh dmUgdG8gYXV0aG9yaXplIGJvdGggYW4gaW5zdGFsbGVyIC8gUmljaCBBcHAgaW50ZW50DQo+IGFu ZCBhbHNvIGEgVEFNIGZvciBhIFRBIGluc3RhbGxhdGlvbj8gT3IgeW91IG1lYW4gYnkg4oCccmVs YXRlZCBieSB0aGUgaW5zdGFsbGVy4oCdDQo+IHRoYXQgdGhlIGZpcnN0IGF1dGhvcml6YXRpb24g aXMgZGVsZWdhdGVkIGZyb20gVEVFIHRvIFRBTSwgYW5kIFRBTSB3aWxsIG1ha2UgYQ0KPiBkZWNp c2lvbiB3aGV0aGVyIGl0IHdpbGwgaG9ub3IgYW4gaW5zdGFsbGVy4oCZcyByZXF1ZXN0IGFib3V0 IGEgUmljaCBBcHDigJlzIGRlc2lyZSB0bw0KPiB1c2UgYSBUQSB0aGF0IGl0IG1hbmFnZXMsIHJp Z2h0Pw0KDQpUaGUgaW5zdGFsbGVyJ3MgcmVxdWVzdCBpcyBqdXN0IGEgcmVxdWVzdCwgcmVnYXJk bGVzcyBvZiB3aGV0aGVyIGl0J3Mgc2VudCB0byB0aGUgVEFNDQpvciB0aGUgVEVFLiAgSXQgY2Fu IG9ubHkgYmUgYXV0aG9yaXplZCBieSBjb21tdW5pY2F0aW9uIGJldHdlZW4gdGhlIFRBTSBhbmQg dGhlDQpURUUsIHJlZ2FyZGxlc3Mgb2Ygd2hpY2ggc2lkZSBpbml0aWF0ZWQgaXQuICAgSXQncyBz aW1wbHkgZmFyIG1vcmUgZWZmaWNpZW50IHRvIGNvbnRhY3QNCnRoZSBURUUgZmlyc3QsIHNpbmNl IHRoYXQgZG9lcyBub3QgcmVxdWlyZSBhIG5ldHdvcmsgbWVzc2FnZS4NCg0KSSBoYXZlIGEgZGlh Z3JhbSB0aGF0IEkgd2lsbCBwcmVzZW50IGluIHRoZSBtZWV0aW5nICh3aGljaCBNaW5nIGhhcyBh bHJlYWR5IHNlZW4pLg0KDQrigKYNCj4gRGVsZWdhdGVkIGZsb3cgd291bGQgbWVhbiB0aGF0IGl0 IGFsd2F5cyBhY2NlcHQgYSByZXF1ZXN0LCBhbmQgZ2VuZXJhdGVzIGENCj4gcmVxdWVzdC4gV291 bGQgdGhpcyBjYXVzZSBzb21lIHNwYW0gYW5kIGF0dGFjayBpc3N1ZSB0byB0aGUgVEVFPyBPbiB0 aGUgb3RoZXINCj4gaGFuZCwgVEFNIGlzIGdpdmVuIHRvIGhhbmRsZSBpdHMgY2xpZW50cyBiZWlu ZyBSaWNoIEFwcCBvciBhbiBpbnN0YWxsZXIgaW4gYSBSRUUNCj4gZXRjLCB3aGljaCBpcyBvdXQg b2YgdGhlIHNjb3BlIGluIG91ciBkZXNpZ24uDQoNClRoZXJlJ3MgYSBwb3RlbnRpYWwgc3BhbSBh dHRhY2sgaXNzdWUgb24gd2hvZXZlciB0aGUgaW5zdGFsbGVyL3JpY2ggYXBwDQpjb250YWN0cyBm aXJzdC4gICBJbiB0aGUgZG9jdW1lbnQncyBtb2RlbCwgaXQncyBhIHNwYW0vYXR0YWNrIGlzc3Vl IGFnYWluc3QgdGhlDQpUQU0uICAgSSBjbGFpbSBpdCdzIHNsaWdodGx5IG1vcmUgZWZmaWNpZW50 IHRvIGRlZmVuZCBhZ2FpbnN0IGl0IHdoZW4gdGFsa2luZyB0bw0KdGhlIFRFRSBmaXJzdCwgc2lu Y2UgaXQgZG9lcyBub3QgaW52b2x2ZSBuZXR3b3JrIG1lc3NhZ2VzIGFuZCBzbyBpcyBhIGxlc3Mg c2V2ZXJlIGlzc3VlDQp0byBkZWFsIHdpdGguICAgRS5nLiwgYSByaWNoIGFwcCBzZW5kaW5nIDEw MDAwIG1lc3NhZ2VzIHRvIGEgVEFNIGNvbnN1bWVzDQptb3JlIHJlc291cmNlcyB0aGFuIGEgcmlj aCBhcHAgc2VuZGluZyAxMDAwMCByZXF1ZXN0cyB0byBpdHMgb3duIFRFRSwNCmFuZCBhIFRBTSBo YXMgdG8gc2NhbGUgdG8gZmFyIG1vcmUgcmljaCBhcHBzIChtYW55IHBlciBkZXZpY2UpIHRoYW4g YSBURUUgZG9lcw0KKGp1c3QgdGhlIG9uZXMgb24gdGhlIGxvY2FsIGRldmljZSkgc28gdGhlIHBy b2JsZW0gaXMgbW9yZSBzZXZlcmUgYXQgYSBUQU0uDQrCoA0KLi4uDQo+IE15IG1haW4gcG9pbnQg aXMgdGhhdCBpdCBzaG91bGQgYmUgcG9zc2libGUgdG8gY29tYmluZSBDcmVhdGVTRCBpbnRvDQo+ IHRoZSBmaXJzdCBJbnN0YWxsVEEgYW5kIGJlIG1vcmUgZWZmaWNpZW50Lg0KPiBBbHNvIHJlbWVt YmVyIHRoYXQgdGhlIFRBIGJpbmFyeSBuZWVkIG5vdCBjb21lIGZyb20gdGhlIFRBTS4NCj4NCj4g W0FBXSB3aGVuIHRoZSBTRCBpcyBjcmVhdGVkLCBhbiBhc3ltbWV0cmljIGtleXBhaXIgaXMgZ2Vu ZXJhdGVkIChzcGFpayksDQo+IGFuZCB0aGUgcHVibGljIHBhcnQgb2YgdGhpcyBpcyByZXR1cm5l ZC4gV2hlbiBhIFRBIGlzIGluc3RhbGxlZCwgaXQgaXMgZW5jcnlwdGVkDQo+IHdpdGggdGhpcyBr ZXkuIFRoaXMgZW5hYmxlcyBzb21lIHVzZSBjYXNlcyB3aGVyZSBhIFRBTSBjb3VsZCBpbnRlcmZh Y2UgdG8NCj4gYSBTUCBhbmQgZW5hYmxlIGFuIFNQIHRvIHByb3ZpZGUgdGhlIFRBIGVuY3J5cHRl ZCBzdWNoIHRoYXQgdGhlIFRBIGJpbmFyeQ0KPiBpcyBub3Qga25vd24gYnkgdGhlIFRBTS4NCj4N Cj4gVGhlIHNwYWlrIGlzIGFsc28gdXNlZCB0byBlbmNyeXB0IHRoZSBwZXJzb25hbGl6YXRpb24g ZGF0YSAodGhhdCBpcyBhbHNvIHNlbnQNCj4gaW4gSW5zdGFsbFRBKSwgYW5kIHRoZXJlIGlzIGFs c28gYSB1c2UgY2FzZSBmb3IgYSBUQU0gaW50ZXJmYWNpbmcgdG8gYW4gU1AgaW4NCj4gb3JkZXIg dGhhdCB0aGUgU1AgZW5jcnlwdHMgcGVyc28gZGF0YSBmb3IgdGhhdCBURUUgc3VjaCB0aGF0IGl0 IHRyYXZlbHMgdmlhDQo+IHRoZSBUQU0gdG8gdGhlIFRFRSwgYnV0IHdpdGhvdXQgdGhlIFRBTSBo YXZpbmcgYWNjZXNzIHRvIHRoYXQgZGF0YQ0KPiBTaW5jZSBJbnN0YWxsVEEgcmVxdWlyZXMga25v d2xlZGdlIG9mIHRoZSBwdWJsaWMga2V5IHJldHVybmVkIGZyb20gQ3JlYXRlU0QsDQo+IGl0IGlz IHRydWUgdGhhdCB0aGUgZXh0cmEgcm91bmQgdHJpcCBpcyByZXF1aXJlZC4NCj4gU28gdGhlIHF1 ZXN0aW9uIGlzIHdoZXRoZXIgdGhlcmUgaXMgYSBjYXNlIGZvciBpbnN0YWxsaW5nIFRBIChhbmQg dGhlaXINCj4gYWNjb21wYW55aW5nIHBlcnNvIGRhdGEpIHdpdGhvdXQgdGhlIGFiaWxpdHkgdG8g cHJvdmlkZSBjb25maWRlbnRpYWxpdHkNCj4gYmV0d2VlbiBhbiBTUCBhbmQgdGhlIFRFRSBieSBt YWtpbmcgdGhhdCBsYXllciBvZiBlbmNyeXB0aW9uIG9wdGlvbmFsLA0KPiBhbmQgYnkgYWxsb3dp bmcgdGhlIFRBIChhbmQgcGVyc28gZGF0YT8pIHRvIGJlIGJ1bmRsZWQgaW50byBDcmVhdGVTRA0K PiANCj4gW01QXSBUaGlzIGNvdWxkIGJlIGFuIG9wdGlvbiwgSSB0aGluaywgd2hlbiBhIFRBIGJp bmFyeSBlbmNyeXB0aW9uIGlzbuKAmXQNCj4gbmVlZGVkLiBIb3dldmVyLCB3ZSBkaWQgZWxhYm9y YXRlIHRoaXMgaW4gdGhlIHZlcnkgYmVnaW5uaW5nIG9mIHByb3RvY29sDQo+IGRlc2lnbiB3aGV0 aGVyIHdlIGdpdmUgc3VjaCBhbiBvcHRpb24uIFdlIChPVHJQIEFsbGlhbmNlIGF0IHRoZSB0aW1l KSBhZ3JlZWQNCj4gdGhhdCB0aGUgcHJvdGVjdGlvbiBvZiBUQSBiaW5hcnkgaXRzZWxmIGlzIHZl cnkgdmFsdWFibGUuIFlvdSBkb27igJl0IHdhbnQNCj4gc29tZW9uZSB0byByZXZlcnNlIGVuZ2lu ZWVyIHlvdXIgVEEgY29kZSB0aGF0IG1ha2VzIGV4cGxvaXQgZmluZGluZyBlYXNpZXIuDQo+IElu IHRoZSBjdXJyZW50IGRlc2lnbiwgYSBUQSBiaW5hcnkgY29kZSBpcyBuZXZlciBnaXZlbiBjbGVh ciB0byBhbnkgUmljaCBBcHANCj4gb3IgTUlUTS4gSXQgaXMgb25seSBrbm93biBieSB0aGUgZGV2 ZWxvcGVyIGFuZCB0aGVuIHRoZSBydW5uaW5nIGRldmljZSBURUUNCj4gaXRzZWxmLiBUaGlzIHdh cyBhIHZlcnkgaW1wb3J0YW50IGRlc2lnbiBnb2FsIGluIHRoaXMgcHJvdG9jb2wuDQoNCkkgdGhp bmsgd2UncmUgY29udm9sdXRpbmcgdHdvIHNlcGFyYXRlIHRoaW5ncyBoZXJlOg0KMSkgVGhlIG5v dGlvbiBvZiBhbiBpc29sYXRpb24gYm91bmRhcnkgYXJvdW5kIG9uZSBvciBtb3JlIFRBcy4gIEFu IFNQDQpjYW4gaGF2ZSBtdWx0aXBsZSBzdWNoIGluc3RhbmNlcyB3aXRoaW4gYSBURUUsIGUuZy4s IG9uZSBwZXIgVEEgaXMgYSBjb21tb24NCmNhc2UuDQoyKSBUaGUgbm90aW9uIG9mIGEgY3J5cHRv Z3JhcGhpYyBjb250ZXh0IChzcGFpaykgYmV0d2VlbiBhbiBTUCBhbmQgYSBURUUsDQp0byBhbGxv dyBmb3IgdXNlIGNhc2VzIHdoZXJlIHRoZSBUQU0gc2hvdWxkIG5vdCBoYXZlIGFjY2VzcyB0byBj ZXJ0YWluDQppbmZvcm1hdGlvbiAoZS5nLiwgZGVjcnlwdGVkIFRBIGJpbmFyeSwgZXRjLikNCg0K SW4gbXkgdmlldywgZm9yIHNjYWxhYmlsaXR5IHRoZXNlIG5lZWQgdG8gYmUga2VwdCBhcyBzZXBh cmF0ZSB0aGluZ3MsIHNpbmNlDQp0aGUgZ3JhbnVsYXJpdHkgaXMgZGlmZmVyZW50LiAgSWYgYW4g U1AgaGFzIDEwMCBUQXMgcGVyIGRldmljZSwgSSB0aGluayBpdCBzaG91bGQNCm5lZWQgb25seSAx IGtleSwgbm90IDEwMCBvZiB0aGVtLg0KDQouLi7CoA0KPiBUQXMgaW5oZXJlbnRseSBjYW4gZGVw ZW5kIG9uIG90aGVyIFRB4oCZcy7CoCBJIGRvbuKAmXQgdGhpbmsgaXQgc2hvdWxkIGJlIG91dCBv ZiBzY29wZSBmb3IgdGhlIFdHLg0KPg0KPiBbTVBdIExldCB1cyBkaXNjdXNzIHRoaXMgbW9yZS4g SW4gdGhlb3J5LCB0aGVyZSBjb3VsZCBiZSBhbGwgY2hhaW5pbmcgZGVwZW5kZW5jaWVzLg0KPiBJ dCBpc27igJl0IGNvbW1vbiB0b2RheS4gV2hlbiBUQTEgdXNlcyBUQTIsIHdvdWxkIFRBMSBpbnN0 YWxsYXRpb24gYnkgVEFNIGFuZA0KPiBURUUgd2lsbCBuZWVkIHRvIGNoZWNrIGV4aXN0aW5nIG9m IFRBMj8NCg0KWWVzLg0KDQpJbiBnZW5lcmFsIGFwcHMgY2FuIGRlcGVuZCBvbiBvdGhlciB0aGlu Z3MgYmVpbmcgaW5zdGFsbGVkDQp0aGF0IHRoZW1zZWx2ZXMgZGVwZW5kIG9uIG90aGVyIHRoaW5n cywgdGhpcyBpcyBub3QgbmV3LiAgQWxsIEknbSBzYXlpbmcgaXMgdGhhdCB0aGUNCnNhbWUgZGVw ZW5kZW5jeSBtb2RlbHMgcGVvcGxlIHVzZSBmb3IgYXBwcyB0b2RheSB3aWxsIGhhcHBlbiBmb3Ig VEFzIHRvby4NCg0KRGF2ZQ0K From nobody Tue Jul 17 11:29:21 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C3EC130EF3 for ; Tue, 17 Jul 2018 11:29:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z0DsAe3RgsCT for ; Tue, 17 Jul 2018 11:29:07 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0079.outbound.protection.outlook.com [104.47.2.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F6D2130E44 for ; Tue, 17 Jul 2018 11:29:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vuF0dt3LlkqjmWDRKETfpgXA1WE+OjqcRs1ouMQ97qs=; b=W8xkgd8oGc85OJX1AV5HAfixomwDusrhFcS4cs9lbpYNM2XN+NpEEFbM1+KlbHYPPuj0ppH0cFFnNxkOMBCJD5PrdLzgY3bqJ7+YnkcVKXcn/sVtMIAr/tyClnm+XhZZVhJ0Y05MMX29ITYgIVbaUanNFYdK8I9rGyUXMaYXa0g= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB1295.eurprd08.prod.outlook.com (10.167.197.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.952.19; Tue, 17 Jul 2018 18:29:04 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db%10]) with mapi id 15.20.0952.021; Tue, 17 Jul 2018 18:29:04 +0000 From: Hannes Tschofenig To: "teep@ietf.org" Thread-Topic: Alternative Terminology for "Agent" Thread-Index: AdQd+35E95p073giS8C5EyfplehAww== Date: Tue, 17 Jul 2018 18:29:04 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [2001:67c:1232:144:606a:2803:d7bf:738e] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB1295; 7:n5rU0gVjLt86e6qtKnG6C3yH+CAPVzv1yPx/S37+l4fWJBrzz3N5iQOKynY2DqK14lapMTwb7Sf6BLrWuiKK8cL1fVfWOJSbn00XyNHuvhdRC0AZWn7QvOfVT6FBHbF6KRVuMDejxSJNfPQxGl1W1hq8Cnsr+oSnC3e4un8zB2Ex6R9UsouvNO8A/irn0FO4NjX6zA+0BAvtZhFOKu2eB2h/2lLMAiKTkdJFQ1coSwQsOo4hQHHwDSh5MQE1nBZe x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 1ed0bf64-a2be-4052-f5a0-08d5ec132cc9 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(48565401081)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB1295; x-ms-traffictypediagnostic: VI1PR0801MB1295: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(223705240517415)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3231311)(944501410)(52105095)(93006095)(93001095)(3002001)(10201501046)(6055026)(149027)(150027)(6041310)(20161123564045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123560045)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB1295; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB1295; x-forefront-prvs: 073631BD3D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(346002)(396003)(366004)(39850400004)(376002)(40434004)(199004)(189003)(53754006)(7696005)(6306002)(2501003)(7736002)(2351001)(86362001)(478600001)(2906002)(186003)(55016002)(6916009)(9686003)(72206003)(54896002)(2900100001)(102836004)(486006)(46003)(105586002)(316002)(5630700001)(97736004)(6436002)(14454004)(5250100002)(6506007)(81166006)(81156014)(8936002)(1730700003)(68736007)(8676002)(74316002)(106356001)(14444005)(790700001)(6116002)(5640700003)(33656002)(5660300001)(99286004)(25786009)(5024004)(476003)(256004)(53936002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB1295; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: yafiP/KzIMXhK1lqUaGLgXMl7WSGb7naL1DdRaIxUJDlOVqqbQrvpJjcFLrlDSSR8863W+a5+LNLIhKhz+LdiKPwmBEIZn2Mul2vckaGRe3MgjJo2XyZy51r7qpGFwbtTyUfVvII7QRI4c6OdAMrWtddbQfntVEc2aF+LMWVbS0CAWMN0rpUKot+vzq3pJW7dopu8qZf/lOd3oVRcHoAsYNJKyMO4LWNh2hZGx//VtKlL1oJxNkvpJW3lRWs7sL1kU+1KXXW0EdaZOV78wLmV8Lj2WgVj69KqYbiyp4ZPxOpzsb0oMwKoIRLqaa7QdwZczYi6vSW/u7yS38+m4N53/7C1JxNgyUiprMtntpT5GU= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_VI1PR0801MB211289D85AE487CB49DFAE31FA5C0VI1PR0801MB2112_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1ed0bf64-a2be-4052-f5a0-08d5ec132cc9 X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Jul 2018 18:29:04.1028 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1295 Archived-At: Subject: [Teep] Alternative Terminology for "Agent" X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Jul 2018 18:29:19 -0000 --_000_VI1PR0801MB211289D85AE487CB49DFAE31FA5C0VI1PR0801MB2112_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi all, during the meeting today Dave Thaler suggested to rename the term Agent in = the architecture document to something like * Connector * Facilitator * Broker * Relay As a reminder, the Agent is currently defined as An application running in the rich OS allowing the message protocol exchange between a TAM and a TEE in a device. A TEE is responsible to processing relayed messages and for returning an appropriate response. What term do you prefer? Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. --_000_VI1PR0801MB211289D85AE487CB49DFAE31FA5C0VI1PR0801MB2112_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi all,

 

during the meeting today Dave Thaler suggested to re= name the term Agent in the architecture document to something like

·       Connector

·       Facilitator

·       Broker

·       Relay

 

As a reminder, the Agent is currently defined as

 

   &= nbsp;  An application running in the rich OS allowing the message=

   &= nbsp;   protocol exchange between a TAM and a TEE in a device.&nb= sp; A TEE is

   &= nbsp;   responsible to processing relayed messages and for return= ing an

   &= nbsp;   appropriate response.

 

What term do you prefer?

 

Ciao

Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you. --_000_VI1PR0801MB211289D85AE487CB49DFAE31FA5C0VI1PR0801MB2112_-- From nobody Tue Jul 17 11:58:15 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06E92131022 for ; Tue, 17 Jul 2018 11:58:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yKkme8geEYJy for ; Tue, 17 Jul 2018 11:58:03 -0700 (PDT) Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-eopbgr70053.outbound.protection.outlook.com [40.107.7.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 621C8131036 for ; Tue, 17 Jul 2018 11:58:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3ABPm4VpEAX5wVgvOTY+AaQOj3xh8/yc+2uhu7XEr3Q=; b=o5Y8iaN2DncIoWpmERyCMfAH4KPIPaOzpS+ljE7qP9Jh7Slc9X3+G334uhofnTIlroijVv5ticu5koCcl6iEGEvqbfnBLBToMduypsrjeyG/oxxyo16bSiWiPn6CU+xy3At3Z25YwkEbMG9iGtJ327Kx5rY3mD5NCL1Ov93ITac= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB2061.eurprd08.prod.outlook.com (10.173.74.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.952.19; Tue, 17 Jul 2018 18:57:59 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::3549:bcde:85fc:e3db%10]) with mapi id 15.20.0952.021; Tue, 17 Jul 2018 18:57:59 +0000 From: Hannes Tschofenig To: "teep@ietf.org" Thread-Topic: TEEP & TPMs Thread-Index: AdQd/5TYRYk4u9lKRwyalKGeA/kh7w== Date: Tue, 17 Jul 2018 18:57:59 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [2001:67c:1232:144:606a:2803:d7bf:738e] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB2061; 7:mF/njfsA9CWs01RA9M215cnAD4mgwUXBuMSk5Tn9fRq/SHcLnJjZZZRYc7uRW/KcDLXaTrtGGcnBeIfUM7SMlNlbhSBTf+UYY/s8E0JD6FcBMelGuFKP+uHyllzC3lQdDkok4bMa559v5H4NnYTusWgneofOElNATJliqD6IdbVFG/RhT47w2rvQiFfhT+hFi5TtM7A2ZEKpQkz+P+FiNnA+e/YTMPwuRVd69+9k7RcUb01j/BD6gFiNUivzXDYi x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: abf78eeb-83de-47c3-761c-08d5ec1736f0 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(48565401081)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB2061; x-ms-traffictypediagnostic: VI1PR0801MB2061: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(223705240517415)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(10201501046)(3231311)(944501410)(52105095)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123560045)(20161123558120)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB2061; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB2061; x-forefront-prvs: 073631BD3D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(366004)(39850400004)(396003)(136003)(53754006)(40434004)(189003)(199004)(14454004)(25786009)(2900100001)(5250100002)(6436002)(53936002)(54896002)(9686003)(2501003)(105586002)(46003)(72206003)(6116002)(106356001)(790700001)(478600001)(97736004)(2906002)(86362001)(186003)(2351001)(99286004)(6306002)(74316002)(102836004)(6916009)(7736002)(8936002)(486006)(14444005)(5024004)(256004)(476003)(55016002)(5640700003)(33656002)(68736007)(5630700001)(81166006)(5660300001)(1730700003)(7696005)(6506007)(81156014)(316002)(8676002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB2061; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: PI5Hw2HiS+wghyJIpyMgrqvFDv3IPKBdr8Rxpn3ccRzo1jah9cjEu5/ipa5895i5URERcEHNcrfSCX5c9zmrNmTnoteWmEi46q1LDRLtPzMmXz7UdH0qGzx/hVdufGfHV9KF22XyrZerfkFyjXFTakccHiAW5uoj+0GturUsSNydgCR/T2OnqWaXeX9RERKRLMP/4SZTWF0p/25GyOimSOp27tolMHVOdiJkl7Ewt2XnHXB8Hzqpk5SmXZyjzI3XRNjOqZNJxmfx/haG9lUKBPuXboNuMsgoCXibf5r+497nypQKM1m7HzlNGYj7THWf3az08ZFF6Xd7K1L/iwhCFstqruk274+uBqmuEUjGpQY= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_VI1PR0801MB21121306A1F6096024CD618FFA5C0VI1PR0801MB2112_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: abf78eeb-83de-47c3-761c-08d5ec1736f0 X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Jul 2018 18:57:59.2033 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB2061 Archived-At: Subject: [Teep] TEEP & TPMs X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Jul 2018 18:58:13 -0000 --_000_VI1PR0801MB21121306A1F6096024CD618FFA5C0VI1PR0801MB2112_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi all, In our discussions the use of TPMs for use with TEEP has been mentioned in = examples. I am not a TPM expert and hence I was wondering whether TPMs, as a TEE tech= nology, is actually a suitable candidate for our TEEP work. In TEEP we are trying to install, update and delete trusted apps running in= the TEE. My understanding is that there are different types of TPM variant= s and many of them do not support update of software. So, the question is: Are there TPMs where TEEP functionality is actually ap= plicable? Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. --_000_VI1PR0801MB21121306A1F6096024CD618FFA5C0VI1PR0801MB2112_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi all,

 

In our discussions the use of TPMs for use with TEEP= has been mentioned in examples.

 

I am not a TPM expert and hence I was wondering whet= her TPMs, as a TEE technology, is actually a suitable candidate for our TEE= P work.

In TEEP we are trying to install, update and delete = trusted apps running in the TEE. My understanding is that there are differe= nt types of TPM variants and many of them do not support update of software= .

 

So, the question is: Are there TPMs where TEEP funct= ionality is actually applicable?

 

Ciao

Hannes

 

IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you. --_000_VI1PR0801MB21121306A1F6096024CD618FFA5C0VI1PR0801MB2112_-- From nobody Tue Jul 17 12:25:30 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78160130E08 for ; Tue, 17 Jul 2018 12:25:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=krose.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yeQrRvHg7eJV for ; Tue, 17 Jul 2018 12:25:25 -0700 (PDT) Received: from mail-oi0-x236.google.com (mail-oi0-x236.google.com [IPv6:2607:f8b0:4003:c06::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3587F12F295 for ; Tue, 17 Jul 2018 12:25:25 -0700 (PDT) Received: by mail-oi0-x236.google.com with SMTP id k12-v6so4180654oiw.8 for ; Tue, 17 Jul 2018 12:25:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=krose.org; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Up6kVLeUu+JDIgtm52P63TRBXqFGRDnN3vvQKhKtKQU=; b=mlSJIiE+bcu67glYSwCPIbSKw0ybXJc5X4nd8MSJU6yf3C23t/zI11tkSFHuIGVSje osKttuI2BuHsAKWbD5uxMZ3sCPTtdaz9T65d8zaSwxPJ7XdZmEwQhIRmjjnKV6ns7VV0 yN8QHnTpiro+HRvcRkh+D/R5dIc2RuV7kzp7k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Up6kVLeUu+JDIgtm52P63TRBXqFGRDnN3vvQKhKtKQU=; b=ON2bO6+OpbG4J1K4dfk6Aiva3bqDT8SYri+hCYdMU5bTRARqgRjloiuVYJeCIDDK1o BtkW5TwqeGtaYF1TN8MBzlMupune3w7Aaj+e9agh7dyy5oVRm72xSHBHkoXUAeWslDbY NDp42FidVTBJtB37YtXg2NpECcIoDFDe/jGcQ4i0kY46QR8GmwRjH99p3b8pX1RNNPSt cArr3HQYJn2O/rQphC0iBY/X5Kz5QFCMMUPruGPwtjIWjo8J2WIPdWVDZS8Ay5oJOSJQ YxNMqYcmhep+HGGDpN3IGV6p+f74p60Bq2SBTXZYhnLvbcBQylZXokQ5nHyE8eDGcJRI csSg== X-Gm-Message-State: AOUpUlFxadoKmlVXF1RgV6O2acSHvB7ahmh1HFVdQwFhrnO1PU7DTFCN ErT1vwnPVkPOuYTnecdwBwnJoQAhnlK5+X8wqMxaYtjZ X-Google-Smtp-Source: AAOMgpebviXtzpjA0S0UPUcb5TVdR7GgGHnRveGlzVW8snMu0DcD7jHTy8P24WAdmIrpDCDuoPcTjVv+AqYT0tXQj+w= X-Received: by 2002:aca:d0d7:: with SMTP id j84-v6mr2906046oiy.189.1531855524338; Tue, 17 Jul 2018 12:25:24 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a9d:204a:0:0:0:0:0 with HTTP; Tue, 17 Jul 2018 12:25:23 -0700 (PDT) X-Originating-IP: [2001:67c:370:128:1ccf:bc30:38f6:4c81] In-Reply-To: References: From: Kyle Rose Date: Tue, 17 Jul 2018 15:25:23 -0400 Message-ID: To: Hannes Tschofenig Cc: "teep@ietf.org" Content-Type: multipart/alternative; boundary="000000000000603cdf057136e84d" Archived-At: Subject: Re: [Teep] TEEP & TPMs X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Jul 2018 19:25:28 -0000 --000000000000603cdf057136e84d Content-Type: text/plain; charset="UTF-8" Unless the TPM is associated with a functionally isolated execution environment (a la Intel's SGX), or unless you are willing to live with vulnerabilities at the hypervisor or OS-level, a TPM alone will not give you what you want. At its most basic level, a TPM pre-provisioned with an appropriate trust chain allows you to do two things relevant to remote interactions: (1) Gather fresh assertions about the state of platform control registers (PCRs) on the target device, which enables a class of functionality including secure boot and (in conjunction with a dynamic trust root, like a trusted OS image or hypervisor) process integrity assertions. (The host is very limited in what operations it can perform on PCRs, such that they cannot be set to any particular chosen value except on reboot, where they are set to zero.) (2) Secrets can be encrypted asymmetrically to a key resident to (i.e., available only to) that TPM. Combining the two means that a central authority can remotely attest to (some aspect of) the execution state of the machine, and then deliver it secrets if that state is acceptable. The problem with this for TEEP's use case is that the OS on a phone (for instance) is much too large of a trusted computing base to be practical: Android, for instance, is far too complex to be trusted in any reasonable sense. This is why Intel developed SGX: an isolated execution environment that cannot be inspected by the host machine, and that doesn't have to run an entire OS potentially full of vulnerabilities. Kyle On Tue, Jul 17, 2018 at 2:57 PM, Hannes Tschofenig < Hannes.Tschofenig@arm.com> wrote: > Hi all, > > > > In our discussions the use of TPMs for use with TEEP has been mentioned in > examples. > > > > I am not a TPM expert and hence I was wondering whether TPMs, as a TEE > technology, is actually a suitable candidate for our TEEP work. > > In TEEP we are trying to install, update and delete trusted apps running > in the TEE. My understanding is that there are different types of TPM > variants and many of them do not support update of software.. > > > > So, the question is: Are there TPMs where TEEP functionality is actually > applicable? > > > > Ciao > > Hannes > > > IMPORTANT NOTICE: The contents of this email and any attachments are > confidential and may also be privileged. If you are not the intended > recipient, please notify the sender immediately and do not disclose the > contents to any other person, use it for any purpose, or store or copy the > information in any medium. Thank you. > > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep > > --000000000000603cdf057136e84d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Unless the TPM is associated with a functionally isol= ated execution environment (a la Intel's SGX), or unless you are willin= g to live with vulnerabilities at the hypervisor or OS-level, a TPM alone w= ill not give you what you want.

At its most basic = level, a TPM pre-provisioned with an appropriate trust chain allows you to = do two things relevant to remote interactions:

(1)= Gather fresh assertions about the state of platform control registers (PCR= s) on the target device, which enables a class of functionality including s= ecure boot and (in conjunction with a dynamic trust root, like a trusted OS= image or hypervisor) process integrity assertions. (The host is very limit= ed in what operations it can perform on PCRs, such that they cannot be set = to any particular chosen value except on reboot, where they are set to zero= .)

(2) Secrets can be encrypted asymmetrically= to a key resident to (i.e., available only to) that TPM.

Combining the two means that a central authority can remotely attes= t to (some aspect of) the execution state of the machine, and then deliver = it secrets if that state is acceptable. The problem with this for TEEP'= s use case is that the OS on a phone (for instance) is much too large of a = trusted computing base to be practical: Android, for instance, is far too c= omplex to be trusted in any reasonable sense. This is why Intel developed S= GX: an isolated execution environment that cannot be inspected by the host = machine, and that doesn't have to run an entire OS potentially full of = vulnerabilities.

Kyle



= On Tue, Jul 17, 2018 at 2:57 PM, Hannes Tschofenig <Hannes.Tschofe= nig@arm.com> wrote:

Hi all,

=C2=A0

In our discussions the use of TPMs for use with TEEP= has been mentioned in examples.

=C2=A0

I am not a TPM expert and hence I was wondering whet= her TPMs, as a TEE technology, is actually a suitable candidate for our TEE= P work.

In TEEP we are trying to install, update and delete = trusted apps running in the TEE. My understanding is that there are differe= nt types of TPM variants and many of them do not support update of software= ..

=C2=A0

So, the question is: Are there TPMs where TEEP funct= ionality is actually applicable?

=C2=A0

Ciao

Hannes

=C2=A0

IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you.

_______________________________________________
TEEP mailing list
TEEP@ietf.org
https://www.ietf.org/mailman/listinfo/teep


--000000000000603cdf057136e84d-- From nobody Fri Jul 20 09:50:51 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DEDA130E52 for ; Fri, 20 Jul 2018 09:50:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.709 X-Spam-Level: X-Spam-Status: No, score=-2.709 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dell.com header.b=M4qvvrN2; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=emc.com header.b=dBkpoltk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dFmLhJbbwS92 for ; Fri, 20 Jul 2018 09:50:46 -0700 (PDT) Received: from esa4.dell-outbound.iphmx.com (esa4.dell-outbound.iphmx.com [68.232.149.214]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B27F5130E50 for ; Fri, 20 Jul 2018 09:50:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dell.com; i=@dell.com; q=dns/txt; s=smtpout; t=1532105446; x=1563641446; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=4E9nfkrbodTDEUh6dHnSIm27K54OTMmx6DAP9Utez0s=; b=M4qvvrN2mW5T4KmIDltdKlGIZVpLRwvK/AIHyxSh2/sn6zXPnvmSDX9e gPIdly/oDr81NT+LbqYbQ5gm2oeBbkgA8sFE0Aq5V1vte9F+UbbQPgygO z60F3XVHmejEbNgTqnN/CT9A1okZKHSeqol23vHywD0keGrcGa3thUeQd M=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2HZAAC27FFbmGKa6ERbHAEBAQQBAQoBA?= =?us-ascii?q?YJXIiqBDX8og36UM5dcgSs7CxgBCguEPgIXgnYhOBQBAgEBAgEBAgEBAhABAQE?= =?us-ascii?q?BAQYNCwYpIwyCNSQBDi8cLwgGAQEBAQEBJwEBAQEBAQEBAQEBAQEBAQEBARcCQ?= =?us-ascii?q?wESAQEZAgEDAQEhChMuAgkBDwIBCBItAwICAiULFAMOAQEEDgWDIAGBG2QBDqo?= =?us-ascii?q?ugS6CeodOAwWHagGBF4FXPyZrJ4JqgxkBAYEtARIBJgcKFQuCSTGCJIdTiieHd?= =?us-ascii?q?AcCAotshQceg3SIG5F6AgQCBAUCFIFYgQNxcFAqAYI+gjOBAwECgkiFFIU+b4s?= =?us-ascii?q?KgjoBAQ?= X-IPAS-Result: =?us-ascii?q?A2HZAAC27FFbmGKa6ERbHAEBAQQBAQoBAYJXIiqBDX8og36?= =?us-ascii?q?UM5dcgSs7CxgBCguEPgIXgnYhOBQBAgEBAgEBAgEBAhABAQEBAQYNCwYpIwyCN?= =?us-ascii?q?SQBDi8cLwgGAQEBAQEBJwEBAQEBAQEBAQEBAQEBAQEBARcCQwESAQEZAgEDAQE?= =?us-ascii?q?hChMuAgkBDwIBCBItAwICAiULFAMOAQEEDgWDIAGBG2QBDqougS6CeodOAwWHa?= =?us-ascii?q?gGBF4FXPyZrJ4JqgxkBAYEtARIBJgcKFQuCSTGCJIdTiieHdAcCAotshQceg3S?= =?us-ascii?q?IG5F6AgQCBAUCFIFYgQNxcFAqAYI+gjOBAwECgkiFFIU+b4sKgjoBAQ?= Received: from esa4.dell-outbound2.iphmx.com ([68.232.154.98]) by esa4.dell-outbound.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Jul 2018 11:50:41 -0500 From: "faibish, sorin" Received: from mailuogwdur.emc.com ([128.221.224.79]) by esa4.dell-outbound2.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Jul 2018 22:50:40 +0600 Received: from maildlpprd51.lss.emc.com (maildlpprd51.lss.emc.com [10.106.48.155]) by mailuogwprd52.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id w6KGocgR028659 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 20 Jul 2018 12:50:40 -0400 X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd52.lss.emc.com w6KGocgR028659 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=emc.com; s=jan2013; t=1532105440; bh=JcSIl0W4Yd//mB6UnpMtXaLbKiE=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:MIME-Version; b=dBkpoltksVSLJ5jUllJC6ZuGQ3pfBDla7reskYuEzLIf91aKEiAAWfbVos1VF07DO jxr6bcnpb22w0hMyEMFbuw4FA2in+VK5jQMMxUnOWlV/j3pFiDlWa6O8GxJm8rYSvw cq3lMH33HCL70XVChxirC7xnlZiEq5sT7LaFOxLA= X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd52.lss.emc.com w6KGocgR028659 Received: from mailusrhubprd54.lss.emc.com (mailusrhubprd54.lss.emc.com [10.106.48.19]) by maildlpprd51.lss.emc.com (RSA Interceptor); Fri, 20 Jul 2018 12:50:18 -0400 Received: from MXHUB311.corp.emc.com (MXHUB311.corp.emc.com [10.146.3.89]) by mailusrhubprd54.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id w6KGoLMn003100 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=FAIL); Fri, 20 Jul 2018 12:50:22 -0400 Received: from MX304CL01.corp.emc.com ([fe80::2d21:ebf8:dc15:2b07]) by MXHUB311.corp.emc.com ([10.146.3.89]) with mapi id 14.03.0399.000; Fri, 20 Jul 2018 12:50:21 -0400 To: Hannes Tschofenig CC: "teep@ietf.org" Thread-Topic: [Teep] Alternative Terminology for "Agent" Thread-Index: AdQd+35E95p073giS8C5EyfplehAwwCb8c4A Date: Fri, 20 Jul 2018 16:50:20 +0000 Message-ID: <63FD3BFC-AEDE-4DF4-96A4-B5F1746AC6E9@emc.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_63FD3BFCAEDE4DF496A4B5F1746AC6E9emccom_" MIME-Version: 1.0 X-Sentrion-Hostname: mailusrhubprd54.lss.emc.com X-RSA-Classifications: public Archived-At: Subject: Re: [Teep] Alternative Terminology for "Agent" X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jul 2018 16:50:49 -0000 --_000_63FD3BFCAEDE4DF496A4B5F1746AC6E9emccom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBiZWxpZXZlIHRoYXQgdGhlIG1vc3QgYXBwcm9wcmlhdGUgdGVybSBpcyBhIEJyb2tlci4gV2Ug bWF5IHdhbnQgdG8gcHV0IGl0IHRvIHZvdGUgb2YgVEVFUCBXRy4gVGhhbmtzDQoNCi4vU29yaW4N Cg0KU2VudCBmcm9tIG15IGlQYWQNCg0KT24gSnVsIDE3LCAyMDE4LCBhdCAyOjMwIFBNLCBIYW5u ZXMgVHNjaG9mZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTxtYWlsdG86SGFubmVzLlRz Y2hvZmVuaWdAYXJtLmNvbT4+IHdyb3RlOg0KDQpIaSBhbGwsDQoNCmR1cmluZyB0aGUgbWVldGlu ZyB0b2RheSBEYXZlIFRoYWxlciBzdWdnZXN0ZWQgdG8gcmVuYW1lIHRoZSB0ZXJtIEFnZW50IGlu IHRoZSBhcmNoaXRlY3R1cmUgZG9jdW1lbnQgdG8gc29tZXRoaW5nIGxpa2UNCg0KwrcgICAgICAg Q29ubmVjdG9yDQoNCsK3ICAgICAgIEZhY2lsaXRhdG9yDQoNCsK3ICAgICAgIEJyb2tlcg0KDQrC tyAgICAgICBSZWxheQ0KDQpBcyBhIHJlbWluZGVyLCB0aGUgQWdlbnQgaXMgY3VycmVudGx5IGRl ZmluZWQgYXMNCg0KICAgICAgQW4gYXBwbGljYXRpb24gcnVubmluZyBpbiB0aGUgcmljaCBPUyBh bGxvd2luZyB0aGUgbWVzc2FnZQ0KICAgICAgIHByb3RvY29sIGV4Y2hhbmdlIGJldHdlZW4gYSBU QU0gYW5kIGEgVEVFIGluIGEgZGV2aWNlLiAgQSBURUUgaXMNCiAgICAgICByZXNwb25zaWJsZSB0 byBwcm9jZXNzaW5nIHJlbGF5ZWQgbWVzc2FnZXMgYW5kIGZvciByZXR1cm5pbmcgYW4NCiAgICAg ICBhcHByb3ByaWF0ZSByZXNwb25zZS4NCg0KV2hhdCB0ZXJtIGRvIHlvdSBwcmVmZXI/DQoNCkNp YW8NCkhhbm5lcw0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwg YW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2 aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90 aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVu dHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUg b3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRFRVAgbWFpbGluZyBs aXN0DQpURUVQQGlldGYub3JnPG1haWx0bzpURUVQQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90ZWVwDQo= --_000_63FD3BFCAEDE4DF496A4B5F1746AC6E9emccom_ Content-Type: text/html; charset="utf-8" Content-ID: <281F0D243AA9AA4D985D472B90D15A87@mail.corp.emc.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IGRpcj0iYXV0byI+DQo8 ZGl2PjxzcGFuPjwvc3Bhbj48L2Rpdj4NCjxkaXY+SSBiZWxpZXZlIHRoYXQgdGhlIG1vc3QgYXBw cm9wcmlhdGUgdGVybSBpcyBhIEJyb2tlci4gV2UgbWF5IHdhbnQgdG8gcHV0IGl0IHRvIHZvdGUg b2YgVEVFUCBXRy4gVGhhbmtzDQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj4uL1NvcmluPGJyPg0K PGJyPg0KPGRpdj5TZW50IGZyb20gbXkgaVBhZDwvZGl2Pg0KPGRpdj48YnI+DQpPbiBKdWwgMTcs IDIwMTgsIGF0IDI6MzAgUE0sIEhhbm5lcyBUc2Nob2ZlbmlnICZsdDs8YSBocmVmPSJtYWlsdG86 SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbSI+SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTwvYT4m Z3Q7IHdyb3RlOjxicj4NCjxicj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+DQo8 ZGl2Pg0KPG1ldGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNCAo ZmlsdGVyZWQgbWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAw IDAgMCAwIDAgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OldpbmdkaW5nczsNCglwYW5v c2UtMTo1IDAgMCAwIDAgMCAwIDAgMCAwO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2Fs aWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0 aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJn aW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6 RU4tVVM7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6 OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRl ZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJ Y29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hh ciI7DQoJbWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCnAuTXNvTGlzdFBhcmFncmFwaCwg bGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXBy aW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGNtOw0KCW1hcmdpbi1yaWdodDowY207DQoJbWFyZ2lu LWJvdHRvbTowY207DQoJbWFyZ2luLWxlZnQ6MzYuMHB0Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFw dDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJp ZiI7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7 bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs InNhbnMtc2VyaWYiOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVk Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJ Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1HQjt9 DQouLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjsNCgltc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1V Uzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2lu OjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1s aXN0LWlkOjY4MTEzMjU2NDsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1w bGF0ZS1pZHM6LTE1ODAxODIyOTggMzM1ODI5NzY4IDEzNDgwNzU1NSAxMzQ4MDc1NTcgMTM0ODA3 NTUzIDEzNDgwNzU1NSAxMzQ4MDc1NTcgMTM0ODA3NTUzIDEzNDgwNzU1NSAxMzQ4MDc1NTc7fQ0K QGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpcRjBCNzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1p bHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpA bGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNv dXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0OlxGMEE3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0 Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0OlxGMEI3Ow0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpA bGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0OlxGMEE3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0OlxGMEI3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0 Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDkN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0OlxGMEE3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpv bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQotLT48 L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0i ZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9 ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8 ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgYWxsLCA8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ZHVyaW5nIHRoZSBtZWV0aW5nIHRvZGF5IERhdmUgVGhh bGVyIHN1Z2dlc3RlZCB0byByZW5hbWUgdGhlIHRlcm0gQWdlbnQgaW4gdGhlIGFyY2hpdGVjdHVy ZSBkb2N1bWVudCB0byBzb21ldGhpbmcgbGlrZQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzEiPjwhLS1baWYgIXN1cHBvcnRMaXN0c10tLT48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6U3ltYm9sIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7CtzxzcGFuIHN0eWxl PSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IS0tW2VuZGlmXS0t PkNvbm5lY3RvcjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJ0ZXh0LWluZGVudDotMTguMHB0O21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48IS0tW2lm ICFzdXBwb3J0TGlzdHNdLS0+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OlN5bWJvbCI+PHNwYW4g c3R5bGU9Im1zby1saXN0Oklnbm9yZSI+wrc8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw Ow0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCEtLVtlbmRpZl0tLT5GYWNpbGl0YXRvciA8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6 LTE4LjBwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+PCEtLVtpZiAhc3VwcG9ydExpc3RzXS0t PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpTeW1ib2wiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJ Z25vcmUiPsK3PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwhLS1bZW5kaWZdLS0+QnJva2VyPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv TGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2 ZWwxIGxmbzEiPjwhLS1baWYgIXN1cHBvcnRMaXN0c10tLT48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6U3ltYm9sIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7CtzxzcGFuIHN0eWxlPSJm b250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IS0tW2VuZGlmXS0tPlJl bGF5PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzIGEgcmVtaW5kZXIsIHRoZSBBZ2VudCBpcyBj dXJyZW50bHkgZGVmaW5lZCBhcyA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29s b3I6YmxhY2s7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tR0IiPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwO0FuIGFwcGxpY2F0aW9uIHJ1bm5pbmcgaW4gdGhlIHJpY2ggT1MgYWxs b3dpbmcgdGhlIG1lc3NhZ2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90Oztjb2xvcjpibGFjazttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1HQiI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHByb3RvY29sIGV4Y2hhbmdlIGJldHdl ZW4gYSBUQU0gYW5kIGEgVEVFIGluIGEgZGV2aWNlLiZuYnNwOyBBIFRFRSBpczxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrO21z by1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg Jm5ic3A7cmVzcG9uc2libGUgdG8gcHJvY2Vzc2luZyByZWxheWVkIG1lc3NhZ2VzIGFuZCBmb3Ig cmV0dXJuaW5nIGFuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDs7Y29sb3I6YmxhY2s7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tR0IiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBhcHByb3ByaWF0ZSByZXNwb25zZS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldoYXQgdGVybSBkbyB5b3UgcHJlZmVyPyA8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Q2lhbzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SGFubmVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBj b250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlh bCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVk IHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBu b3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3Ig YW55IHB1cnBvc2UsDQogb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1l ZGl1bS4gVGhhbmsgeW91LiA8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiPg0KPGRpdj48c3Bhbj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXzwvc3Bhbj48YnI+DQo8c3Bhbj5URUVQIG1haWxpbmcgbGlzdDwvc3Bhbj48YnI+ DQo8c3Bhbj48YSBocmVmPSJtYWlsdG86VEVFUEBpZXRmLm9yZyI+VEVFUEBpZXRmLm9yZzwvYT48 L3NwYW4+PGJyPg0KPHNwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby90ZWVwIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RlZXA8 L2E+PC9zcGFuPjxicj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_63FD3BFCAEDE4DF496A4B5F1746AC6E9emccom_--