From jmdesp@free.fr Mon Oct 1 04:46:55 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79AE521F860B for ; Mon, 1 Oct 2012 04:46:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3iSUNrSlBVVk for ; Mon, 1 Oct 2012 04:46:54 -0700 (PDT) Received: from smtp4-g21.free.fr (smtp4-g21.free.fr [IPv6:2a01:e0c:1:1599::13]) by ietfa.amsl.com (Postfix) with ESMTP id 7CCF321F85F0 for ; Mon, 1 Oct 2012 04:46:52 -0700 (PDT) Received: from [172.30.24.38] (host.104.92.68.195.rev.coltfrance.com [195.68.92.104]) (Authenticated sender: jmdesp) by smtp4-g21.free.fr (Postfix) with ESMTPA id 33C2B4C8157; Mon, 1 Oct 2012 13:46:38 +0200 (CEST) Message-ID: <50698299.6020503@free.fr> Date: Mon, 01 Oct 2012 13:46:33 +0200 From: Jean-Marc Desperrier User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20120923 Firefox/16.0 SeaMonkey/2.13 MIME-Version: 1.0 To: Nikos Mavrogiannopoulos References: <5067D8B2.3080405@gnutls.org> In-Reply-To: <5067D8B2.3080405@gnutls.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Cc: "tls@ietf.org" Subject: Re: [TLS] comments on draft-ietf-tls-multiple-cert-status-extension-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Oct 2012 11:46:55 -0000 Nikos Mavrogiannopoulos a écrit : >> A zero-length >> "responder_id_list" sequence has the special meaning that the >> responders are implicitly known to the server > This is from RFC6066, but I think this text is only applicable to > original intent of the ocsp extension, as an extension for constrained > embedded clients. This is not valid generally, as most (if not all) > browsers always send a zero-length responder_id_list irrespective of any > prior arrangement with the server (there is none). The empty > responder_id_list indicates that the client would accept the preferred > by the server OCSP responder. The *true* meaning of the current practice for browsers of sending a zero-length responder_id_list irrespective of any prior arrangement is that only the certificate of the CA that issued the certificate, or a OCSP certificate with a id-ad-ocspSigning extension will be accepted. It would be best to find a way to remove the ambiguity of the zero-length responder_id_list value between "there's a prior arrangement, use the one defined by that" and "there's no prior arrangement, use a certificate that doesn't require one" (this unfortunately applies just as well to RFC 6066). If it can't be done, there should be a warning to implementors that in this situation, the responder should only use an OCSP signing certificate that requires a prior arrangement only in a closed environment/community, in other words if it knows by some out-of-band process that this client will accept it. And I think it would be best to have an errata for RFC 6066 that stipulates this. From turners@ieca.com Mon Oct 1 09:34:47 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 19C0F1F0D0A for ; Mon, 1 Oct 2012 09:34:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.101 X-Spam-Level: X-Spam-Status: No, score=-102.101 tagged_above=-999 required=5 tests=[AWL=0.164, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PBZsYr34EKDI for ; Mon, 1 Oct 2012 09:34:46 -0700 (PDT) Received: from gateway13.websitewelcome.com (gateway13.websitewelcome.com [69.93.179.5]) by ietfa.amsl.com (Postfix) with ESMTP id 8A1D61F0CD1 for ; Mon, 1 Oct 2012 09:34:46 -0700 (PDT) Received: by gateway13.websitewelcome.com (Postfix, from userid 5007) id 8430829D211D3; Mon, 1 Oct 2012 11:34:48 -0500 (CDT) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway13.websitewelcome.com (Postfix) with ESMTP id 759D729D2119D for ; Mon, 1 Oct 2012 11:34:48 -0500 (CDT) Received: from [108.18.174.220] (port=53179 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.77) (envelope-from ) id 1TIixB-0001ZX-FB; Mon, 01 Oct 2012 11:34:45 -0500 Message-ID: <5069C624.7030705@ieca.com> Date: Mon, 01 Oct 2012 12:34:44 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: Nikos Mavrogiannopoulos References: <5067D8B2.3080405@gnutls.org> In-Reply-To: <5067D8B2.3080405@gnutls.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [108.18.174.220]:53179 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 9 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: "tls@ietf.org" Subject: Re: [TLS] comments on draft-ietf-tls-multiple-cert-status-extension-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Oct 2012 16:34:47 -0000 Curious whether you think SCVP should stay or go? spt On 9/30/12 1:29 AM, Nikos Mavrogiannopoulos wrote: > * Section 2.2: > The document says: > "In the OCSPStatusRequest and SCVPStatusRequest structures, the > "ResponderIDs" provide a list of OCSP and SCVP responders > (respectively) that the client trusts. A zero-length > "responder_id_list" sequence has the special meaning that the > responders are implicitly known to the server, e.g., by prior > arrangement, or are identfied by the certificates used by the server." > > This is from RFC6066, but I think this text is only applicable to > original intent of the ocsp extension, as an extension for constrained > embedded clients. This is not valid generally, as most (if not all) > browsers always send a zero-length responder_id_list irrespective of any > prior arrangement with the server (there is none). The empty > responder_id_list indicates that the client would accept the preferred > by the server OCSP responder. > > * same section: > '"Extensions" is a DER encoding of OCSP request extensions.' > > I cannot understand the intent of the extensions. Is this field really > required, or the draft could be simplified by removing it? My guess is > that this is a relic of the original intention of the extension which > assumed that the server would poll the ocsp server at the moment the > client connected at his request. Are there any actual clients that use > this field on the current RFC6066 extension? > > * same section: > struct { > OCSPResponse ocsp_response_list<1..2^24-1> > } OCSPResponseList > > there is a missing ';' > > * same section: > "Clients requesting a certificate response and receiving either one or > more OCSP responses or a SCVP response in a "CertificateStatus" > message MUST check the response(s) and abort the handshake, if the > response is a revoked status or is otherwise not satisfactory with a > bad_certificate_status_response(113) alert. This alert is always > fatal." > > This text doesn't seem to belong in this section. There should be in a > verification section or so. However my question is whether this text is > applicable to this document at all. Is this document the proper place to > define what to do when OCSP verification fails? If there is some TLS > verification profile later that would like to set some verification > rules, it risks violating the OCSP extension draft. > > I'd suggest, if you want to keep this text, to keep it pure > informational without MUSTs or SHOULDs. > > regards, > Nikos > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From n.mavrogiannopoulos@gmail.com Mon Oct 1 11:24:54 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36E211F0D17 for ; Mon, 1 Oct 2012 11:24:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R+iymOhFRelZ for ; Mon, 1 Oct 2012 11:24:53 -0700 (PDT) Received: from mail-ey0-f172.google.com (mail-ey0-f172.google.com [209.85.215.172]) by ietfa.amsl.com (Postfix) with ESMTP id 724281F0D50 for ; Mon, 1 Oct 2012 11:24:53 -0700 (PDT) Received: by eaak13 with SMTP id k13so2040264eaa.31 for ; Mon, 01 Oct 2012 11:24:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:x-enigmail-version:openpgp:content-type :content-transfer-encoding; bh=RH2GSfvZB9WCUGYewiL0pt+YVcSgPCYfQU7yZAw+vbc=; b=D8syYGUocrLwR9+d06vDjDgnK6cUL8C1PHhFQw6HcxUR5NnnRKJCZR8M4h3itjX/nQ Vy7QOwPiIzwt9k/L0kV95qdjLuEZ3L6kfjHYI3d4rq3WgdVAvU7sf3DZxx8ii7LWplnl ZgN7bLwzLrX/UOZIHb2Lf9WYWbnt7WeNj+Ol+elge5qQ4KqandR9nUIqhB6GoH5t/IwT GtHwdWyrExXO7v2reex3qragHhoVo9jTAYAzkYqkFhAS3YRU7ksTp1WSw0igIeu7R705 6dFTLzshNlz+j7c9/uKpex7NXxHS6JerHQWKhpA78bqb4t3sbNkGaE2yTNR5/LdUVxxW yOZQ== Received: by 10.14.220.134 with SMTP id o6mr19337725eep.35.1349115892682; Mon, 01 Oct 2012 11:24:52 -0700 (PDT) Received: from [10.100.2.17] (94-224-100-5.access.telenet.be. [94.224.100.5]) by mx.google.com with ESMTPS id h42sm50036591eem.5.2012.10.01.11.24.51 (version=SSLv3 cipher=OTHER); Mon, 01 Oct 2012 11:24:51 -0700 (PDT) Sender: Nikos Mavrogiannopoulos Message-ID: <5069DFF2.20204@gnutls.org> Date: Mon, 01 Oct 2012 20:24:50 +0200 From: Nikos Mavrogiannopoulos User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.6esrpre) Gecko/20120805 Icedove/10.0.6 MIME-Version: 1.0 To: Sean Turner References: <5067D8B2.3080405@gnutls.org> <5069C624.7030705@ieca.com> In-Reply-To: <5069C624.7030705@ieca.com> X-Enigmail-Version: 1.4.1 OpenPGP: id=96865171 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "tls@ietf.org" Subject: Re: [TLS] comments on draft-ietf-tls-multiple-cert-status-extension-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Oct 2012 18:24:54 -0000 On 10/01/2012 06:34 PM, Sean Turner wrote: > Curious whether you think SCVP should stay or go? If you are asking me, I hardly know the protocol nor plan to implement it in the near future, so I cannot judge its merits. I'd keep it if there are people that plan to or already implemented this option, but I would definitely remove it if there are none (it can be added in the future anyway). regards, Nikos From turners@ieca.com Mon Oct 1 11:29:28 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D81B51F0D4B for ; Mon, 1 Oct 2012 11:29:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.107 X-Spam-Level: X-Spam-Status: No, score=-102.107 tagged_above=-999 required=5 tests=[AWL=0.158, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9IPPkQrEeW1R for ; Mon, 1 Oct 2012 11:29:28 -0700 (PDT) Received: from gateway09.websitewelcome.com (gateway09.websitewelcome.com [67.18.39.12]) by ietfa.amsl.com (Postfix) with ESMTP id 5C2F21F0D17 for ; Mon, 1 Oct 2012 11:29:28 -0700 (PDT) Received: by gateway09.websitewelcome.com (Postfix, from userid 507) id 257AC2D805DC6; Mon, 1 Oct 2012 13:29:26 -0500 (CDT) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway09.websitewelcome.com (Postfix) with ESMTP id 14D922D805DA2 for ; Mon, 1 Oct 2012 13:29:26 -0500 (CDT) Received: from [108.18.174.220] (port=53690 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.77) (envelope-from ) id 1TIkkB-00030m-9t; Mon, 01 Oct 2012 13:29:27 -0500 Message-ID: <5069E106.701@ieca.com> Date: Mon, 01 Oct 2012 14:29:26 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: Nikos Mavrogiannopoulos References: <5067D8B2.3080405@gnutls.org> <5069C624.7030705@ieca.com> <5069DFF2.20204@gnutls.org> In-Reply-To: <5069DFF2.20204@gnutls.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [108.18.174.220]:53690 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 7 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: "tls@ietf.org" Subject: Re: [TLS] comments on draft-ietf-tls-multiple-cert-status-extension-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Oct 2012 18:29:29 -0000 On 10/1/12 2:24 PM, Nikos Mavrogiannopoulos wrote: > On 10/01/2012 06:34 PM, Sean Turner wrote: > >> Curious whether you think SCVP should stay or go? > > > If you are asking me, I hardly know the protocol nor plan to implement > it in the near future, so I cannot judge its merits. I'd keep it if > there are people that plan to or already implemented this option, but I > would definitely remove it if there are none (it can be added in the > future anyway). At this point, I think I'm the only one who asked for it and I don't implement it and don't plan to. I agree that if nobody else jumps up and down (and soon) that it ought to be removed. spt From yngve@opera.com Tue Oct 2 01:51:30 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D6FC21F8B19 for ; Tue, 2 Oct 2012 01:51:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZrulDDp99kNq for ; Tue, 2 Oct 2012 01:51:29 -0700 (PDT) Received: from smtp.opera.com (smtp.opera.com [213.236.208.81]) by ietfa.amsl.com (Postfix) with ESMTP id 310E921F8B1A for ; Tue, 2 Oct 2012 01:51:27 -0700 (PDT) Received: from damia.oslo.osa (oslo.jvpn.opera.com [213.236.208.46]) (authenticated bits=0) by smtp.opera.com (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id q928pMrK001001 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 2 Oct 2012 08:51:23 GMT Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes To: "tls@ietf.org" , "Nikos Mavrogiannopoulos" References: <5067D8B2.3080405@gnutls.org> <5067DA8C.80809@gnutls.org> Date: Tue, 02 Oct 2012 10:51:21 +0200 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: "Yngve Nysaeter Pettersen" Organization: Opera Software ASA Message-ID: In-Reply-To: <5067DA8C.80809@gnutls.org> User-Agent: Opera Mail/11.64 (Win32) Subject: Re: [TLS] comments on draft-ietf-tls-multiple-cert-status-extension-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2012 08:51:30 -0000 On Sun, 30 Sep 2012 07:37:16 +0200, Nikos Mavrogiannopoulos wrote: > btw. There are no suggested values for XX, YY, and AA. There cannot be > interoperable implementation without some hint on these values. That is intentional. I have noticed that there are several cases of enums and ciphersuite values that have been made unallocatable because a draft and/or implementation have used them without going through channels first. I would rather avoid causing even more such waste. It may well be that now that the document is a Work Group item that we can ask for values to be assigned, but I am not sure who should request them. In any case, as the SCVP case is not yet approved by consensus, I would not think it proper to assign a final value to its enum at this time. What limited development and testing I have done have been done using the max values in each range as placeholders, rather than grabbing the smallest available value in the range. -- Sincerely, Yngve N. Pettersen ******************************************************************** Senior Developer Email: yngve@opera.com Opera Software ASA http://www.opera.com/ Phone: +47 96 90 41 51 Fax: +47 23 69 24 01 ******************************************************************** From yngve@opera.com Tue Oct 2 01:51:30 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E34421F8B1D for ; Tue, 2 Oct 2012 01:51:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y7SkrUqfJgZE for ; Tue, 2 Oct 2012 01:51:29 -0700 (PDT) Received: from smtp.opera.com (smtp.opera.com [213.236.208.81]) by ietfa.amsl.com (Postfix) with ESMTP id 3122A21F8B1C for ; Tue, 2 Oct 2012 01:51:27 -0700 (PDT) Received: from damia.oslo.osa (oslo.jvpn.opera.com [213.236.208.46]) (authenticated bits=0) by smtp.opera.com (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id q928pMrL001001 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 2 Oct 2012 08:51:23 GMT Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes To: "tls@ietf.org" , "Nikos Mavrogiannopoulos" References: <5067D8B2.3080405@gnutls.org> Date: Tue, 02 Oct 2012 10:51:23 +0200 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: "Yngve Nysaeter Pettersen" Organization: Opera Software ASA Message-ID: In-Reply-To: <5067D8B2.3080405@gnutls.org> User-Agent: Opera Mail/11.64 (Win32) Subject: Re: [TLS] comments on draft-ietf-tls-multiple-cert-status-extension-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2012 08:51:30 -0000 Hi, Thanks for reviewing On Sun, 30 Sep 2012 07:29:22 +0200, Nikos Mavrogiannopoulos wrote: > * Section 2.2: > The document says: > "In the OCSPStatusRequest and SCVPStatusRequest structures, the > "ResponderIDs" provide a list of OCSP and SCVP responders > (respectively) that the client trusts. A zero-length > "responder_id_list" sequence has the special meaning that the > responders are implicitly known to the server, e.g., by prior > arrangement, or are identfied by the certificates used by the server." > > This is from RFC6066, but I think this text is only applicable to > original intent of the ocsp extension, as an extension for constrained > embedded clients. This is not valid generally, as most (if not all) > browsers always send a zero-length responder_id_list irrespective of any > prior arrangement with the server (there is none). The empty > responder_id_list indicates that the client would accept the preferred > by the server OCSP responder. Yes, it is from RFC 6066. Having these options here, even if most (WebPKI) clients does not use them, allow specialized clients to use these parameters when they connect to servers that support them. Just to be on the safe side: As far as I can tell, SCVP also have the same parameters in the protocol. > * same section: > '"Extensions" is a DER encoding of OCSP request extensions.' > > I cannot understand the intent of the extensions. Is this field really > required, or the draft could be simplified by removing it? My guess is > that this is a relic of the original intention of the extension which > assumed that the server would poll the ocsp server at the moment the > client connected at his request. Are there any actual clients that use > this field on the current RFC6066 extension? At present no, but one can envision customized clients that send a nonce extension and require it to be used in the response. (I seem to remember somebody at an IETF meeting mentioning that some high security networks use nonces in OCSP requests) > * same section: > struct { > OCSPResponse ocsp_response_list<1..2^24-1> > } OCSPResponseList > > there is a missing ';' Thanks, will check that. > * same section: > "Clients requesting a certificate response and receiving either one or > more OCSP responses or a SCVP response in a "CertificateStatus" > message MUST check the response(s) and abort the handshake, if the > response is a revoked status or is otherwise not satisfactory with a > bad_certificate_status_response(113) alert. This alert is always > fatal." > > This text doesn't seem to belong in this section. There should be in a > verification section or so. However my question is whether this text is > applicable to this document at all. Is this document the proper place to > define what to do when OCSP verification fails? If there is some TLS > verification profile later that would like to set some verification > rules, it risks violating the OCSP extension draft. > > I'd suggest, if you want to keep this text, to keep it pure > informational without MUSTs or SHOULDs. Please note that this language is also from RFC 6066 (section 8). In my opinion, if there is no recommendation about what is good and bad responses and what to do in the bad case, then one risk interoperability problems and security issues due to the inconsistencies and different expectations. -- Sincerely, Yngve N. Pettersen ******************************************************************** Senior Developer Email: yngve@opera.com Opera Software ASA http://www.opera.com/ Phone: +47 96 90 41 51 Fax: +47 23 69 24 01 ******************************************************************** From n.mavrogiannopoulos@gmail.com Tue Oct 2 02:26:34 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E371621F8B08 for ; Tue, 2 Oct 2012 02:26:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.977 X-Spam-Level: X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u6FmSiIZ0Z2G for ; Tue, 2 Oct 2012 02:26:34 -0700 (PDT) Received: from mail-vc0-f172.google.com (mail-vc0-f172.google.com [209.85.220.172]) by ietfa.amsl.com (Postfix) with ESMTP id 1A36421F8B07 for ; Tue, 2 Oct 2012 02:26:33 -0700 (PDT) Received: by vcbfl11 with SMTP id fl11so7399743vcb.31 for ; Tue, 02 Oct 2012 02:26:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=xNKf5CorLxw9z0Tisu/Ex/I2hw0EKws95WfREzS6Iu0=; b=KFjbxVnUtEsyE8hzRPL292ZoKFX6dLOhbkgpkSLTc+D7HQAD0WxzS7wM9UaB6xZBbV FWOdA8rs9wtCckEM0yBcJXMThl4TqSoZU+aghBWfsEjuicyEoRhjKG7x7CDTUUvR4nrA 7FUisomWgpR6Xv2Rya/s3aNxVeGgOG7kgAhS+2fQ9aR5s8lcJMept8hsbpQAwVuVSrrv 4KeZjQ5dFp1jRYKMUfOE9waBloQS0YEhdTOFzfhn5ER+QuvDMLCQ5YYBui7CW9HKAYwC w2FpRp3JbL8JrU0F2pEZkyJzkc6+NM7GFUHpv8X5acF/VLE2QtT7Z2/HKBvkCaqJIOz5 W0Iw== MIME-Version: 1.0 Received: by 10.220.205.200 with SMTP id fr8mr9693371vcb.34.1349169993392; Tue, 02 Oct 2012 02:26:33 -0700 (PDT) Sender: n.mavrogiannopoulos@gmail.com Received: by 10.58.128.133 with HTTP; Tue, 2 Oct 2012 02:26:33 -0700 (PDT) In-Reply-To: References: <5067D8B2.3080405@gnutls.org> Date: Tue, 2 Oct 2012 11:26:33 +0200 X-Google-Sender-Auth: JcHbZ6kEOr_-ce_9uQzw4B0KQpk Message-ID: From: Nikos Mavrogiannopoulos To: Yngve Nysaeter Pettersen Content-Type: text/plain; charset=UTF-8 Cc: "tls@ietf.org" Subject: Re: [TLS] comments on draft-ietf-tls-multiple-cert-status-extension-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2012 09:26:35 -0000 On Tue, Oct 2, 2012 at 10:51 AM, Yngve Nysaeter Pettersen wrote: Hello, >> This is from RFC6066, but I think this text is only applicable to >> original intent of the ocsp extension, as an extension for constrained >> embedded clients. This is not valid generally, as most (if not all) >> browsers always send a zero-length responder_id_list irrespective of any >> prior arrangement with the server (there is none). The empty >> responder_id_list indicates that the client would accept the preferred >> by the server OCSP responder. > Yes, it is from RFC 6066. > Having these options here, even if most (WebPKI) clients does not use them, > allow specialized clients to use these parameters when they connect to > servers that support them. Yes, but the question is, are the such specialized clients that warrant the added complexity in the protocol? Is there any existing or planned use of this extension where the client will _not_ use the OCSP server of the CA's certificate? The whole idea of the client suggesting the OCSP is a bit absurd in the context of TLS since the client cannot anyway ask a certificate from a particular CA. (I understand it is not you that you created the RFC6066 status request extension, my point is that you don't need to replicate the issues >> I cannot understand the intent of the extensions. Is this field really >> required, or the draft could be simplified by removing it? My guess is >> that this is a relic of the original intention of the extension which >> assumed that the server would poll the ocsp server at the moment the >> client connected at his request. Are there any actual clients that use >> this field on the current RFC6066 extension? > At present no, but one can envision customized clients that send a nonce > extension and require it to be used in the response. (I seem to remember > somebody at an IETF meeting mentioning that some high security networks use > nonces in OCSP requests) I'd suggest not to plan so far ahead. A TLS extension should solve a problem that exists. You never know whether your solution for an unknown future problem is correct. I'd suggest to allow the draft to be extended with other (extended) status requests, but not solve problems that do not yet exist. I don't think that expecting the server to contact the OCSP server on the fly on every client request is practical on the scale of the Internet, not now at least. So we can avoid this bloat until somebody really needs it. >> I'd suggest, if you want to keep this text, to keep it pure >> informational without MUSTs or SHOULDs. > Please note that this language is also from RFC 6066 (section 8). I wouldn't consider RFC6066 a model RFC. My comments apply to this RFC as well (but it is already published). > In my opinion, if there is no recommendation about what is good and bad > responses and what to do in the bad case, then one risk interoperability > problems and security issues due to the inconsistencies and different > expectations. People have different expectations from different clients. There can be clients that verify certificates and clients that do not. So there can be clients that verify OCSP responses and clients that do not. Why say that a client that does not verify an OCSP response not compliant to the draft-ietf-tls-multiple-cert-status-extension-01? Note that RFC5246 also doesn't mention how to verify certificates, nor forces you to. regards, Nikos From anders.rundgren@telia.com Mon Oct 8 05:05:51 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DB7421F8717 for ; Mon, 8 Oct 2012 05:05:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.11 X-Spam-Level: X-Spam-Status: No, score=-2.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WVgizjQ6Vyyn for ; Mon, 8 Oct 2012 05:05:50 -0700 (PDT) Received: from smtp-out11.han.skanova.net (smtp-out11.han.skanova.net [195.67.226.200]) by ietfa.amsl.com (Postfix) with ESMTP id EFBD721F8753 for ; Mon, 8 Oct 2012 05:05:49 -0700 (PDT) Received: from [192.168.3.161] (37.247.8.250) by smtp-out11.han.skanova.net (8.5.133) (authenticated as u36408181) id 503A68CC0105917E for tls@ietf.org; Mon, 8 Oct 2012 14:05:48 +0200 Message-ID: <5072C194.5070800@telia.com> Date: Mon, 08 Oct 2012 14:05:40 +0200 From: Anders Rundgren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: "'tls@ietf.org'" X-Enigmail-Version: 1.4.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 12:05:51 -0000 TLS CCA (Client Certificate Authentication) has essentially not been updated in 15 years or so. Well, the underpinnings have when going from SSL 1.0 to TLS 1.2 but these enhancements were mainly about security, not about usability. >From a usability point-of-view TLS CCA suffers from many problems when used in browsers including: - Incompatible with the web session concept which forces you to introduce an IDP even for a single site - No logout - Poor credential filtering options Is the TLS WG aware of these shortcomings? Is the TLS WG aware of the fact that most consumer PKIs have invented their own application-level PKI-authentication method to circumvent this issues? Is this what we should expect be the future as well? thanx, Anders From tom@ritter.vg Mon Oct 8 06:58:59 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA46C21F852D for ; Mon, 8 Oct 2012 06:58:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.362 X-Spam-Level: X-Spam-Status: No, score=-2.362 tagged_above=-999 required=5 tests=[AWL=0.615, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JIC-uXpXEUcb for ; Mon, 8 Oct 2012 06:58:59 -0700 (PDT) Received: from mail-qa0-f51.google.com (mail-qa0-f51.google.com [209.85.216.51]) by ietfa.amsl.com (Postfix) with ESMTP id 13E1321F851B for ; Mon, 8 Oct 2012 06:58:58 -0700 (PDT) Received: by mail-qa0-f51.google.com with SMTP id j40so1958852qab.10 for ; Mon, 08 Oct 2012 06:58:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ritter.vg; s=vg; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=eu4wK68HMXl2rKxZTFZ8vOGRYVKGbei9czsoHftheXA=; b=ebu01aeHpAasOVvUkQKdSYayi+MNxZsm5SZC1gSESoelVSGj3MLkWfj+1FTU5FIBuV 6Lzf3PCTlsklXtzSOkvRFfwIU0O8g4oRlUR9feArasEgIzEpRiBEq0/tdW/4od4+A+C6 kTFk11BuS7d12rjjR/SP182/sAhcy1DN+xA4A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:x-gm-message-state; bh=eu4wK68HMXl2rKxZTFZ8vOGRYVKGbei9czsoHftheXA=; b=QZE/1tEKqOr29deKTH5L2I0PvlbIGR+6yzyceQMXuKOVzPqJE4/FSiJ4QTxr+7Ddzb Xn6D0H2p4kco2CYLe6ni6oeF9bM94KRAphIW2CtxDpFZBtj3O4WIphOQvpxEfXKMixYR zPMofu85Paush5OPv/4TjWG4k1Mn4Lt6FodVfu2VoVyJ9kV6NJPaxOOeorKvIjwsKmxh AH+owSKxu60hRayznPCpY0uyQV31qHqq65xgHckZD510knItbEVNCpmwAxBaVyVBqfiY Vj3V3K/U13Jz7XJZyjqsNGZU7NkSzDzqaGK+SxpYVx+vrUttp0GeQnUJVJkTvh1WkZ3+ nFAw== Received: by 10.58.117.103 with SMTP id kd7mr10077481veb.4.1349704738447; Mon, 08 Oct 2012 06:58:58 -0700 (PDT) MIME-Version: 1.0 Received: by 10.58.239.200 with HTTP; Mon, 8 Oct 2012 06:58:38 -0700 (PDT) In-Reply-To: <5072C194.5070800@telia.com> References: <5072C194.5070800@telia.com> From: Tom Ritter Date: Mon, 8 Oct 2012 09:58:38 -0400 Message-ID: To: Anders Rundgren Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQlE5R7mo/MS1Gnp0OgtDfALjQzAwV6ULaKxIwXZLE84j7abH7XDviSExfY8vC1QCnBQytbs Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 13:58:59 -0000 On 8 October 2012 08:05, Anders Rundgren wrote: > Is this what we should expect be the future as well? As long as websites want to have a state (logged in/not logged in) that is independent of an underlying transport - I think so. Keeping this in mind I think should be foremost. Origin Bound Certificates (and Channel Bound Cookies) are a way around that - the Client Certificate does not imply logged in or not-logged-in. That state is independent of the client cert. So in that case, Client Certs work, and would probably work well. Likewise, Client Certificates used in POP/IMAP auth work well, because there is no meaningful 'Logged Out' state in a POP/IMAP conversation. If I'm connected, I need to be authenticated to receive my mail. -tom From anders.rundgren@telia.com Mon Oct 8 07:17:18 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86E2621F854C for ; Mon, 8 Oct 2012 07:17:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.854 X-Spam-Level: X-Spam-Status: No, score=-2.854 tagged_above=-999 required=5 tests=[AWL=0.745, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QfeHFaLEJvS1 for ; Mon, 8 Oct 2012 07:17:17 -0700 (PDT) Received: from smtp-out21.han.skanova.net (smtp-out21.han.skanova.net [195.67.226.208]) by ietfa.amsl.com (Postfix) with ESMTP id 87F3421F84FE for ; Mon, 8 Oct 2012 07:17:16 -0700 (PDT) Received: from [192.168.3.161] (37.247.8.250) by smtp-out21.han.skanova.net (8.5.133) (authenticated as u36408181) id 503A691C0103308E; Mon, 8 Oct 2012 16:17:14 +0200 Message-ID: <5072E061.6080609@telia.com> Date: Mon, 08 Oct 2012 16:17:05 +0200 From: Anders Rundgren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: Tom Ritter References: <5072C194.5070800@telia.com> In-Reply-To: X-Enigmail-Version: 1.4.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 14:17:18 -0000 On 2012-10-08 15:58, Tom Ritter wrote: > On 8 October 2012 08:05, Anders Rundgren wrote: >> Is this what we should expect be the future as well? > > As long as websites want to have a state (logged in/not logged in) > that is independent of an underlying transport - I think so. Unfortunately that is not the case. > Keeping this in mind I think should be foremost. > Origin Bound Certificates (and Channel Bound Cookies) are a way around > that - the Client Certificate does not imply logged in or > not-logged-in. That state is independent of the client cert. So in > that case, Client Certs work, and would probably work well. Yes, but that is special case that is by no means universal. > Likewise, Client Certificates used in POP/IMAP auth work well, because > there is no meaningful 'Logged Out' state in a POP/IMAP conversation. > If I'm connected, I need to be authenticated to receive my mail. Yes, I was merely thinking about web servers and browsers. Anders > > -tom > From henry.story@bblfish.net Mon Oct 8 07:12:03 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B853521F87C5 for ; Mon, 8 Oct 2012 07:12:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mQp9X6Ccoi4X for ; Mon, 8 Oct 2012 07:12:02 -0700 (PDT) Received: from mail-wi0-f178.google.com (mail-wi0-f178.google.com [209.85.212.178]) by ietfa.amsl.com (Postfix) with ESMTP id 01C8D21F84A5 for ; Mon, 8 Oct 2012 07:12:01 -0700 (PDT) Received: by mail-wi0-f178.google.com with SMTP id hr7so2886407wib.13 for ; Mon, 08 Oct 2012 07:12:01 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=RVRO0RswPlZVoxzYOolUjbLYyym9ZkdZu6WHNQh/Ick=; b=KZthRp2vp53IPbxaQPUrVu+5k/BDx/Vlc5a5iBDx4R0Uyqc/giA11kZf2NlwY8n7cJ a4JgdEfyD46uGIE8BtGxdi00ZTGDfAsxzFlGhFCa1LcY9vVfpqJfSYKxQ+jAA6DMEyeQ khkE/2qKBmTv+UELQ3p4h5WmhNPSP7XoaRhuoRXMeic5S5LMXmR2//p5WJDP07+r7BoM iIEDGgTX9SxjnMxVkTsp9aUALMlMLv9M2VeTXQAyPYGDORhkuhc0UBg+1L6Fa5iWz+6Q 8A7M1G/Tw2cc2L1VssJzzrmT6Q1BDLxjz1uld9ofaMQDncqQlOzU7LULFdccwOmsl2+y 4ucQ== Received: by 10.180.87.34 with SMTP id u2mr22289795wiz.4.1349705520808; Mon, 08 Oct 2012 07:12:00 -0700 (PDT) Received: from bblfish.home (AAubervilliers-651-1-329-35.w83-114.abo.wanadoo.fr. [83.114.96.35]) by mx.google.com with ESMTPS id gg4sm22311143wib.6.2012.10.08.07.11.49 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 08 Oct 2012 07:11:58 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_7BCE6FA4-1AFD-433F-A1C0-32E7C85EBCF0"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Henry Story In-Reply-To: <5072C194.5070800@telia.com> Date: Mon, 8 Oct 2012 16:11:47 +0200 Message-Id: <488C2C22-C7D2-4A04-A024-D4C8BF9244FA@bblfish.net> References: <5072C194.5070800@telia.com> To: Anders Rundgren X-Mailer: Apple Mail (2.1499) X-Gm-Message-State: ALoCoQkVfdEU7dA+TlpAtoirPb9SWC0Qn9s5EKlOs6fVU1Rtx8254WERmOioC1E8RdbhKE9NQfw7 X-Mailman-Approved-At: Mon, 08 Oct 2012 07:29:58 -0700 Cc: "'tls@ietf.org'" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 14:12:03 -0000 --Apple-Mail=_7BCE6FA4-1AFD-433F-A1C0-32E7C85EBCF0 Content-Type: multipart/mixed; boundary="Apple-Mail=_032A34C1-5479-4F44-8969-96775BE981DA" --Apple-Mail=_032A34C1-5479-4F44-8969-96775BE981DA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 8 Oct 2012, at 14:05, Anders Rundgren = wrote: > TLS CCA (Client Certificate Authentication) has essentially not been = updated in 15 years or so. > Well, the underpinnings have when going from SSL 1.0 to TLS 1.2 but = these enhancements were mainly about security, not about usability. >=20 > =46rom a usability point-of-view TLS CCA suffers from many problems = when used in browsers including: >=20 > - Incompatible with the web session concept which forces you to = introduce an IDP even for a single site Not sure about this problem. > - No logout This is a UI issue. Nothing to do with TLS protocol. Here is a larger = discussion with Ben Laurie on the subject recently --Apple-Mail=_032A34C1-5479-4F44-8969-96775BE981DA Content-Disposition: inline; filename="UI in browser.pdf" Content-Type: application/pdf; x-unix-mode=0644; name="UI in browser.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAHFWttu20gSfedXNOZJBqIW+8ZuCp5MNpPF5rbIZGNgHhaD QJJpSbEkOiQVj392vmVPk+wiZUkeO/EmEBJTpe7qU6cufeNn9p59ZiphNuWpShPBjFRcOmaM5anA Q5Gx39mGjX4tBZuVTNSfcub7JMpyZ6RmazRP0SsiyaqVdHpXO6Os2IJdsJjHxjmpjMKjcrFKpcST dVoJZSOMoh1PnVUsiTVXsUj9UOiVpMZ1MgwWZEMZpym3iWIr6kuyqB0VQ2gTpy7WHoFLpNVGMIxm MEjqElifah7LWNWWce3i1HQyb1sji6AaxIk0xXDUuS9srNRxbZIfTRmZagEr6/FS7kQcQ3eiuLDG RGtYxV0qlSIZVJMMqpXjMQjBeKFzX+jHSwyXUmgVGSOhSzlYkSSgT1kgb0VQ2orQPbbo4fxAbVfW F0JnZGOeKB8WUvJYezdYwa0wcSdadaKhSOEvbyaEbU+StV6wCRRpgf4CmhLro8haLmSik06G/kE2 FAgEbhLrlbado77Q2+4EXGtMAufHHNGUQKuT3CjrVCdbdbKhUMJxlQAV9Q0yDFTrTLhLkhT9vS06 9tY7ZIdOpehk6N/KAEri2QgDBS507gu91lRyCVDQoBCwPvPWLFVAgpQgGVCRbCiE9aR6+6lzX1hr tTxxKSJYyxQItPFaHbdWpElEMihoZWwoYigTifZaQ+e+0GsVMcIzFoIhOzioSBCnAh4WDnEaZFBA smGC4XVaY6XOfWGj1QGi1JFy8IDzYQowHLlnWRB5na1oaCxC3yGIvbDpyvpC6IyEUHA7Ql6hfhmt pFcqDI9jEEwyKAgyH0AYXPqMos4kbGNViJQrZC5TGpmSCB9VQqKKIGc7GRQE2VAgu5xIRa216Yyw 6IS1/VJzq5OEKZFAFQLbazXcSXBBMq+1lQlR10YDVKCt6RtkGKjWqWIujE2ZTNHJKO9/RDiXOpad DP1bWSSs5NrqGmjo25N5nXH9QXn8jAJmNFiySS0adl97s0E0W7PnZ77WxbFgZzMmUGbxGeIv5gr4 5mzNRmdngseYS84u2ODdBg/vZhWTsZBP2KRiwo1jPD3PNuztZFssM3Y6zTarZ/M8n68yPsvXT9l1 kVfZ+CQ6+8T+eYZpDAPeMZn4cvvt+JVG6TmKP59mRW0DE2askifsZbYpbtiHKsf/pwv/hZf+y7Pp dHWxLBd8k1UHDIEph+en+xnAZuvomAO0RpTroxb0PGDGRj/YA8cmum8HbgAcCXgsdHrU67ERX0v9 vXEejXAUUkx+0TGcOwRrhMiDQvzb4WGaxUx/FN4OjfoH0uiAM0mO4tyh0Wfad6YxRR2L9VF4OzTG 9sdFIyZkzE/yKNAej3qszHfn0dcirPuP4usRqcYy/oFEYubCYvUo0B6RaqzV9ycSM5M2BxNGxexD dlVla5qdZDyWmF2/bnb69hokMAnp9GD2NFg7MoH0BxRJgcnGqINZs0+miMfqRwYmJhxjD2aQTL3j OzJFOjZA+p1LJTYt2L8ezBzsJ29FJtZNEtX8db6ZlOxlPkfIztkb/u6EhVXe/cLvrjVoDUjavaXE 6Sc/Kr/kOV80Iz/LiuWsLPPN4QXn/aBgNXZ0sSAwzWG7u1dV/lE91OCdUaLdRXc9SmL2DF5U1dV4 NJqu8jnM3l5dLTfzrJjlzQJ7dJlNik058mvyUZyOpBktN8MSwtlimF8Mr4rll8nsZvRLtwJ/JELc fmmY59PJ7PJnPj/PPips7bE2+LiuK9pHkWATrRUWAQ/l7M4ggWcszn9ur+NeTL5k7E3NDDYgyyor x37YqN6BPI791qZ7AXG2yHAOtyzZcnOeZedswlZ5xfILNss3F9tymW/YZJpvK1YtMlZup5+yWfWE TRsBek7wr7rO2WV289jusul+bl8tikmZlazKcXzY+IldY//DqsnqElHWgm1DqGaw2cN9jrotZb1n 7L72dpg7wX5rh+mD3aHt2Tra2WP+1oSr53AD6iabfHOzXlY3jx00zuwn2q2xy2xWZLPHdQSKLE76 9uLm/TavPN/VIi8z5gOkiZkq+7MKVFxNimo5264mxeqGLbLV1cV2xdlztL3IC7bOi+xRQwZIca68 hxQRfL246fxSB/v6Ki+qyaZB0kYL5/xRfebxmHgv0dvieH19zVfLzWXJ82I++uXqZyHVo9OR7Cf8 8eH1o1rvt6s4/t0z/22eN4nqS4qPHVSPJ2w2gZdQTeZFBskCBzW73yirWLnIt6tzNvXNMnaeXUy2 q+pxp4oautyfPF9h1NUyQ53GGuIm37LzvMXqK9ArNsfXHBX0OpuyEhW8j3AHN8x7VReLaS8D2uuS ROPQ1OGEt70uEThExpWC6F2XSH9dUh/z3z0v2ASnutYl7XSEE/HmtMxh5cZkqCY4dm9Oy/7LBi9P GI7eJBtk4WETHnDQdILjIxkNPmANUTfKb//GBqeLIDuk4YThnN2yAfKs1lQe0PSsViDYYBo00cMq SP4qaZiginDSuEH30xP2Bzt73UwD4bKJTh5H/8Lt07z8mxO8W0yCI4Eza78Y2uEUx8vNtN7n9MzT 5JsPMB01D2Dyj6gHqXMo4Mj7w2mmq6gHQqccqyqLy4MDSJ4TN8RW41M2eNtQGw0mgeNteCiW4Ym6 h16n5Br6iTSvTqImlMih86CH4oYe6CdyMSkMDp5R4/X/waM9CpEbSXqAvV8D/Bn8WMe/d2M/smQU 8vJr3NiPJdyl4Yw7xU1kKOD9iPrpNXFBdJPfyuAcymVqPA8u2XdbQR4I3d80xOMMvbX2p/DL6aeG iWhAmg/ACN0vwwM1DgLK4TzgIhB3AXxWj450ohDpItTvqYIywhTG60cQlvTBhfVfci7xWHyZBE0U lD3EbZ0MnPybwFDjL5Q3LZJogNZdwNyvdrcr0t34TEW7yulHxen6HhjYYLZjYW1GNCDQ+xYS3eSc NWkgC6k/P8E6G/PHXVz/dBUyiWoM+ZsUtaqjwWxIzQnc/rgUXNdBN5HR6o4GZAm1UaFxCBFS0+VD F/aEYxsC4yhsEHBP2G2RJEi3YbMHwI4GHeynT25F+ENY9/Cvg5H7iIj+88Df31LbqxUdRk/tV+SD v4LazQdcHB4o2Kc9h7Xpetth0YBs8RbfXvxQc2p11OJocJ9g2vPKu9ZL3YKGqg7VLxocdNXJ9YFc Qm1I0lWdgjSFldB+66DxlAK/D6Slo+3W44rcvSZsYQzeYiRAxBgl+9OT6Cu87o+6bnkdd9DNZrxf Bv+z58XedF3TR2HRzRuo9W0lnLXLXDYg4GTKX0TgntkkICI3IX9oQh4OA90UaVRJ/WFPDS40+f2E CevXyu3oUbceftU2fREsDX0+BwFRTdBppb0MsHpAWz+XD8/GsLPwbx35e3jJDC5Tw56X3OInvnDM emwFHn3tfJjgzRFnsb7u72ii+v4fOxoROAkkhYybhYglIijbibWi6RQNZNAShwfSSz+FAegXF9oG 38rAve0zjTd/2LLmr97SYemo/A4AK3kjHS40Eq25c9a/b2K04dbgJZEgw/saOzKl8TIK3k/r921l i11pq/GifkvP4N0WJ/FKj5V4J0rj5Qq8xJFKC3+Ghyi8rfcbDnJx6bOdrFix9G/4hZY+AujLvkYc Vo9erQV7kUfv2fv/AXqS8scKZW5kc3RyZWFtCmVuZG9iago1IDAgb2JqCjI3MzIKZW5kb2JqCjIg MCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDYgMCBSIC9Db250 ZW50cyA0IDAgUiAvTWVkaWFCb3ggWzAgMCA1OTUuMjggODQxLjg5XQo+PgplbmRvYmoKNiAwIG9i ago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgL0ltYWdlQiAvSW1hZ2VDIC9JbWFnZUkgXSAvQ29s b3JTcGFjZSA8PCAvQ3MxIDcgMCBSCi9DczIgOSAwIFIgPj4gL0V4dEdTdGF0ZSA8PCAvR3MzIDEz IDAgUiAvR3MyIDE0IDAgUiAvR3MxIDE1IDAgUiA+PiAvRm9udCA8PAovVFQxLjAgOCAwIFIgL1RU Mi4wIDEwIDAgUiA+PiAvWE9iamVjdCA8PCAvSW0xIDExIDAgUiA+PiA+PgplbmRvYmoKMTEgMCBv YmoKPDwgL0xlbmd0aCAxMiAwIFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdlIC9XaWR0 aCA1MCAvSGVpZ2h0IDUwIC9JbnRlcnBvbGF0ZQp0cnVlIC9Db2xvclNwYWNlIDcgMCBSIC9CaXRz UGVyQ29tcG9uZW50IDggL0ZpbHRlciAvRENURGVjb2RlID4+CnN0cmVhbQr/2P/gABBKRklGAAEB AAABAAEAAP/hAEBFeGlmAABNTQAqAAAACAABh2kABAAAAAEAAAAaAAAAAAACoAIABAAAAAEAAAAy oAMABAAAAAEAAAAyAAAAAP/bAEMAAgEBAgEBAgIBAgICAgIDBQMDAwMDBgQEAwUHBgcHBwYGBgcI CwkHCAoIBgYJDQkKCwsMDAwHCQ0ODQwOCwwMC//bAEMBAgICAwIDBQMDBQsIBggLCwsLCwsLCwsL CwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLC//AABEIADIAMgMBIgACEQED EQH/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0B AgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpD REVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmq srO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/xAAfAQADAQEB AQEBAQEBAAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAABAncAAQIDEQQFITEGEkFR B2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVW V1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrC w8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/2gAMAwEAAhEDEQA/AP3W+I/xn8Jf B+1tp/in4j0fw/FeOY4Gv7pIBMwGSF3HnA6157qn/BRr4B6HfNa618Y/hvZ3KYLRT6/bRuuRkZVn BGRX5mftHft06z+2j+z1oDfGO20fwr4o8NXVvNeSWkEssE8d5LDal47V2L7oZJ0ZohLlkRmVs/IO x+B+meKvGngTQIPhtHF4B8AWttFLYTlLa51bW42QSGaQRqYIhN5rOzKNxkVnG5XFfHeKvGFPwuwe Hni6S9rOUlN1JunThBJOLTjCpOpOd7qFOEmo3lLlQcLwlxRiakcO70lFcvKuacpXakmnKMYKNrNy au9Fdn6IaL+3r8E/EcCTaD8V/AF3BJnbLFrlu0ZwSPv78dQR17GvV4bmO4iWSB1dHAZWU5DA9CK/ F39p79n3TvhP4G0y9PivxVruoyXQtIv7b1T7dM6kSSuQ7r5mAwHG7aoOAANoH0P+xv8A8FgbjSZ7 Hw7+1QkclhHEsEXiC2iIlj2qADdQoMNuwcvGFwcfIQSw+u4CxFLxL4Xp8TZDGU4KU4VIuLVpQs7w uoucbPV2ve6tozxc4zX/AFbzmWT5q4wk1GUHe91K6tLdRd1prZrqfo7vHrRvHrUME63MKyQkMjjI IOQR6ikubqO0t2luXVI0GWZiAFHqTVtpK57RPvHrRUPmE9BRQB+C/wAP/B2keNvipY2XjKfQtPsl 1ODULi91F0G+O2kdjZqHjKkTiRgxZlwE4yxAr9AY9pjUx42nlcdMe1fm/qoDalcZGf3rY/M11Hw+ +P3jD4XeCp9A8FanDbWE1012kslv59zaMxBZIWkYxrGWUttMbHdI5BGRt+S+kz9FfiLxdxeBzzh7 GxcrU4OhU92FOLilOrGabdtI80FBy3cb7Hynhf4v5ZwdSxGXZnRaSc5KcdZSd9IOOmurtK9ujtub n7Tj/wBvftQ64mv60q6atxaWsdwYDL/ZlusMXmrtTLSbZWuZNowcuVAyMnB8feHNL0r4rfEHQtDs JrTw54OtrSTw74nfxLY6lB45M0sayCO0gjWSBow8jZDMFWMhxl1YcxqN9JquqXd5e7Dc39xLdzsi BBJLLI0kjYAABZ3ZjgdSayrHwvp+l63fajYWsUN7qew3UyjBm2AhS3bIBIzX9ScJ+G2O4XyPh/J8 JjXThgqVOFWMPhqSjFc8ul+eSd1JNWk3ZSWv5PmXGGDzLHZpjMRhVUliJSlCUt4Jt8q62tG3wvdW 2en6zf8ABNn9pi68U/sN3DC31HxL4h+HiT2ctjEU+1XyIDLbxxZwDmJkiUnq0RBOcmtbxn8QtK+M PijSNN8fX48QfCT432f9iWtncCOCXQ9YgjllaBnG2RGkSGX5SWeKe2AG3ccfD3/BK/W7y0/bJ8OW Fp4i1LRbK+E73FrbB3i1do4JGWGZAwUKBvcOwbaVwACwZfqfSbnTG8OXjeH42Ftrn7QEM2geTFj7 U6zwvdyKx4KbodRcsCQVBAznFfnPF+UQybN69Kk9G+ZaNcvM27J/3Xqmn0t3S/UOF81qZrlVCpUW qXK9U78qWr/xLRprrddL/nn8U/8AgsX8X/2efid4j8AWPxA8Q3cHgbVLnw/HObDTGMy2krQByZbd 5DkR5y7s3PLE5JK+R/25bEn9tj4w4P8AzO+td/8Ap/norahhlUpxnKjFtpP4I/5HNWxFSFSUY15p Ju3vH6jf8Elf2R4f2qNH17xt8XND8zwlqOjzabaGZXiae6uYl8yW0lG1h5UbyR+ch4dyqsHjcJ4Y f2WfHF7q3iu38BeF/EviKx8HXc9ndXtppssizNDLJEwj2r+9kzESY49zqCpIG4Z/b3wT4C0T4a+F bLQvh5pGm6HounJ5drY2Fulvb265JwkaAKoySeB1JqxrXh+DXNFvLGZp7eO9heFpLaUwyoGUgsjr yrDOQw5B5qsH4gZjgMXWxdJRbmoxs7uKUNFomru19b9Wa4rgTAYzDUsNUbXI5SbVrty31ael+mp/ PzdK1jNcR3ytBJaSPFOsg2NC6Eq6sD90qQQQehBHavpv9jf/AIJmeMf2i9XstW+IVle+FfBW4PJc 3cXlXeoIGIZbeFhuAO0jzXCqVZXTeK/Qz4O/8E6vg58DbuC68E+DLKW9tpBNDc6lNJqEsMgJIeMz swiILHGwKAOBgACva0hSMYjUKBxwMV7+d+KmLxlH2GAp+zurOT+Lz5V9nyu5NHjZN4Z4bCVfbY2f tLPSK2/7ef2vSyXyOH+HX7Ovgv4U/DqPwr4D8PafYaLHbPaGBULNLG+7zPMkYl3Zy7FmZiWLEkkm vGfjLp3hn9ljxJ4d8Z/Fe9WDwl4MgGheAvC+lWUsjLeyW7KX+U4edoYpoYwwCIhY7tznH0/sHpTZ baOYYmRXAORuGea/KoT5Zc0tb766u++tnq+9j9LnSUo2jpbbsrbaaaLsfjj4r/4IZeOvj54o1Lx1 4n0bwtZal40updeu7efVbyCWCa6czujxiI7GDSEFcnBGMmiv2P8AJX+6KK9RZ9jIq0VBLp7kf1Vz y3kOEk7y5m/8cv8AMdRRRXkHshRRRQAUUUUAFFFFAH//2QplbmRzdHJlYW0KZW5kb2JqCjEyIDAg b2JqCjI2MTIKZW5kb2JqCjEzIDAgb2JqCjw8IC9UeXBlIC9FeHRHU3RhdGUgL2NhIDAuMjUgPj4K ZW5kb2JqCjE0IDAgb2JqCjw8IC9UeXBlIC9FeHRHU3RhdGUgL2NhIDEgPj4KZW5kb2JqCjE1IDAg b2JqCjw8IC9UeXBlIC9FeHRHU3RhdGUgL2NhIDAuNSA+PgplbmRvYmoKMTYgMCBvYmoKPDwgL0xl bmd0aCAxNyAwIFIgL04gMyAvQWx0ZXJuYXRlIC9EZXZpY2VSR0IgL0ZpbHRlciAvRmxhdGVEZWNv ZGUgPj4Kc3RyZWFtCngBnZZ3VFPZFofPvTe90BIiICX0GnoJINI7SBUEUYlJgFAChoQmdkQFRhQR KVZkVMABR4ciY0UUC4OCYtcJ8hBQxsFRREXl3YxrCe+tNfPemv3HWd/Z57fX2Wfvfde6AFD8ggTC dFgBgDShWBTu68FcEhPLxPcCGBABDlgBwOFmZgRH+EQC1Py9PZmZqEjGs/buLoBku9ssv1Amc9b/ f5EiN0MkBgAKRdU2PH4mF+UClFOzxRky/wTK9JUpMoYxMhahCaKsIuPEr2z2p+Yru8mYlybkoRpZ zhm8NJ6Mu1DemiXho4wEoVyYJeBno3wHZb1USZoA5fco09P4nEwAMBSZX8znJqFsiTJFFBnuifIC AAiUxDm8cg6L+TlongB4pmfkigSJSWKmEdeYaeXoyGb68bNT+WIxK5TDTeGIeEzP9LQMjjAXgK9v lkUBJVltmWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7VfEm7M+eQYyeWd9s7KwvvRYA9iRamx2zvpVV ALRtBkDl4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL7OxscwGfay4r6Df7n4Jvyr+GOfeZy+77Vjum Fz+BI0kVM2VF5aanpktEzMwMDpfPZP33EP/jwDlpzcnDLJyfwBfxhehVUeiUCYSJaLuFPIFYkC5k CoR/1eF/GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0AQyMDJG4/egJ961sQMQrIvrxorZGvc48yev7n +h8LXIpu4UxBIlPm9gyPZHIloiwZo9+EbMECEpAHdKAKNIEuMAIsYA0cgDNwA94gAISASBADlgMu SAJpQASyQT7YAApBMdgBdoNqcADUgXrQBE6CNnAGXARXwA1wCwyAR0AKhsFLMAHegWkIgvAQFaJB qpAWpA+ZQtYQG1oIeUNBUDgUA8VDiZAQkkD50CaoGCqDqqFDUD30I3Qaughdg/qgB9AgNAb9AX2E EZgC02EN2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4Fj4Ot8IX4RvwACyFX8KTCEDICAPRRlgIG/FE QpBYJAERIWuRIqQCqUWakA6kG7mNSJFx5AMGh6FhmBgWxhnjh1mM4WJWYdZiSjDVmGOYVkwX5jZm EDOB+YKlYtWxplgnrD92CTYRm40txFZgj2BbsJexA9hh7DscDsfAGeIccH64GFwybjWuBLcP14y7 gOvDDeEm8Xi8Kt4U74IPwXPwYnwhvgp/HH8e348fxr8nkAlaBGuCDyGWICRsJFQQGgjnCP2EEcI0 UYGoT3QihhB5xFxiKbGO2EG8SRwmTpMUSYYkF1IkKZm0gVRJaiJdJj0mvSGTyTpkR3IYWUBeT64k nyBfJQ+SP1CUKCYUT0ocRULZTjlKuUB5QHlDpVINqG7UWKqYup1aT71EfUp9L0eTM5fzl+PJrZOr kWuV65d7JU+U15d3l18unydfIX9K/qb8uAJRwUDBU4GjsFahRuG0wj2FSUWaopViiGKaYolig+I1 xVElvJKBkrcST6lA6bDSJaUhGkLTpXnSuLRNtDraZdowHUc3pPvTk+nF9B/ovfQJZSVlW+Uo5Rzl GuWzylIGwjBg+DNSGaWMk4y7jI/zNOa5z+PP2zavaV7/vCmV+SpuKnyVIpVmlQGVj6pMVW/VFNWd qm2qT9QwaiZqYWrZavvVLquNz6fPd57PnV80/+T8h+qwuol6uPpq9cPqPeqTGpoavhoZGlUalzTG NRmabprJmuWa5zTHtGhaC7UEWuVa57VeMJWZ7sxUZiWzizmhra7tpy3RPqTdqz2tY6izWGejTrPO E12SLls3Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/R79bf8rA0CDaYItBm8GooYqhv2GeYaPhYyOq kavRKqNaozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY1N5UYLrPtM8Ma+ZoJjSrNbvHorDcWVmsRtag OcM8yHyjeZv5Kws9i1iLnRbdFl8s7SxTLessH1kpWQVYbbTqsPrD2sSaa11jfceGauNjs86m3ea1 rakt33a/7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4h70O99h0dii7hH3VEevo4bjO8YzjByd7J7HT SaffnVnOKc4NzqMLDBfwF9QtGHLRceG4HHKRLmQujF94cKHUVduV41rr+sxN143ndsRtxN3YPdn9 uPsrD0sPkUeLx5Snk+cazwteiJevV5FXr7eS92Lvau+nPjo+iT6NPhO+dr6rfS/4Yf0C/Xb63fPX 8Of61/tPBDgErAnoCqQERgRWBz4LMgkSBXUEw8EBwbuCHy/SXyRc1BYCQvxDdoU8CTUMXRX6cxgu LDSsJux5uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZLFndGyUfFRdVHTUV7RZdFS5dYLFmz5EaMWowg pj0WHxsVeyR2cqn30t1Lh+Ps4grj7i4zXJaz7NpyteWpy8+ukF/BWXEqHhsfHd8Q/4kTwqnlTK70 X7l35QTXk7uH+5LnxivnjfFd+GX8kQSXhLKE0USXxF2JY0muSRVJ4wJPQbXgdbJf8oHkqZSQlKMp M6nRqc1phLT4tNNCJWGKsCtdMz0nvS/DNKMwQ7rKadXuVROiQNGRTChzWWa7mI7+TPVIjCSbJYNZ C7Nqst5nR2WfylHMEeb05JrkbssdyfPJ+341ZjV3dWe+dv6G/ME17msOrYXWrlzbuU53XcG64fW+ 649tIG1I2fDLRsuNZRvfbore1FGgUbC+YGiz7+bGQrlCUeG9Lc5bDmzFbBVs7d1ms61q25ciXtH1 YsviiuJPJdyS699ZfVf53cz2hO29pfal+3fgdgh33N3puvNYmWJZXtnQruBdreXM8qLyt7tX7L5W YVtxYA9pj2SPtDKosr1Kr2pH1afqpOqBGo+a5r3qe7ftndrH29e/321/0wGNA8UHPh4UHLx/yPdQ a61BbcVh3OGsw8/rouq6v2d/X39E7Ujxkc9HhUelx8KPddU71Nc3qDeUNsKNksax43HHb/3g9UN7 E6vpUDOjufgEOCE58eLH+B/vngw82XmKfarpJ/2f9rbQWopaodbc1om2pDZpe0x73+mA050dzh0t P5v/fPSM9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJF4c6V3Q+urTk0p2usK7ey4GXr17xuXKp2737 /FWXq2euOV07fZ19ve2G/Y3WHruell/sfmnpte9tvelws/2W462OvgV95/pd+y/e9rp95Y7/nRsD iwb67i6+e/9e3D3pfd790QepD14/zHo4/Wj9Y+zjoicKTyqeqj+t/dX412apvfTsoNdgz7OIZ4+G uEMv/5X5r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF8MuMl9Pjhb8p/rb3ldGrn353+71nYsnE8GvR 65k/St6ovjn61vZt52To5NN3ae+mp4req74/9oH9oftj9MeR6exP+E+Vn40/d3wJ/PJ4Jm1m5t/3 hPP7CmVuZHN0cmVhbQplbmRvYmoKMTcgMCBvYmoKMjYxMgplbmRvYmoKNyAwIG9iagpbIC9JQ0NC YXNlZCAxNiAwIFIgXQplbmRvYmoKMTggMCBvYmoKPDwgL0xlbmd0aCAxOSAwIFIgL04gMSAvQWx0 ZXJuYXRlIC9EZXZpY2VHcmF5IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AYVVTWwb VRAeZ9cOqsKKA7RVK5Un/lpFabQJFBIqoK6dOmki180PkFIVbdfP8dab3WV37TZRT7mQE1QCIa4g hHoDgahaftTm0l6KqFQFVMgFqUitAAkBqjgA4pv12lmHQ9Z69vfmzcyb+WbGS9R90fA8u0sQzTuh X5jMzr48e0x036Au0qiH8Bhm4GVLpQnGjutI/u187n1LKZbc3Mu+Os823aXLMjChdQXLLQfmPFFK J8r0mZ4fEnUfh3zodOgxfhv4wdr0ZA74PLAW2wLSQwXpSN8yRcE3FkTJdyuWnYx1s3P2sekzb9c5 Vn52YfUEtalx/PYi5jNVf3QS+Fng901jZAq4D3jNCw+yHDpd99VrM9mmvGuw4h+aieUnFqvTLwE/ AJ1lKxybBu4Hftc5WTwS61+tuePsZzvkv5tB7hjwY0TKlqoc49oI4P6yzI8AIwalWK2Psn/4UZaD xhTLGV9YrOaKwLhLuX3KOFwC3gr8p+9O8l2PEKlbpF3gu+Bf7fPCEsuHgEuOXeS7kIu6LIMoxz3A n4TV6dFY//vQn2Zb9vNvxTo0Bgwe0sKzox56GnjCr09ybE8ALxn+SAEYftLnpTPDvDG+UTbyzO1T wH/RiymDJLl0Et8mOfQP8g3IokaEPPJxVsHepgI0HCyfrNT9VINMUPK8ZWdRFSch7BysBhlUiqya XgSVsRM0x35wEyP2eyfamxt0c9BxaBE+RHz/3VjPVbepuvok1n51Qn1OHVKHSagvqAfU59U8pMPq /sjGh+0CvK7nwTfehdemp9eonozn3I76Hs97540l/1XL/ObN3zos3Xbcc4iruWtzAvbcJEfIrRbr /xSzIZN8XTv75fZEhGJVvXj8Zs+1s3QkWYuoOuWNtUjfTt9Jr+L7Vnot6SP9Q3oNn1uURb3siNl5 ZMccyojrAngwkHGAiOqoK0e/tyPHFdiF0LHpR5y5kVWACvwNy1rEVLLmiZ7oyJdzZx8dGVecczs8 78SHzKt8vXivSEt9+sf6L/oH+nf6r/qq/h7Qzx3RtPqk1SVR9ylvKZ8pXymXlM+V6ySUK8qKclm5 qnykfIHdp5CuKJfghXVbPdfssXbvgLNmF5pxfzEP3LFBxBxrM28sbUVwCmfrmUvktvGGzn5u36Ud 1HZqj2p57WHtcW1C69X2aQe0bdog1oA2qu3Gyc5239hxNXm2kj1r0WzEZrOSHFUV/PqI0sBnPS6e U4tmELdFpyMGgqgODmbg/9PKc4W5SL2C3rXUXeqAOhbPUVbdh0ka75ipIZ60zEgmn8mSyPRmhjMD mcOMEX1zykRmN06H8T3SzohZMZM6HXnJhB5z2mR7fV74X4l7ib00gG3sZCjP4J1FlHO9Bd+aq4Zi UNefEVm8IqUYc8z+PmHYtoiOAuHLQPoNWe4nfv+yHdEfR6P3amrrdbPuN5oySqW+JvoPImqI6gpl bmRzdHJlYW0KZW5kb2JqCjE5IDAgb2JqCjEwODgKZW5kb2JqCjkgMCBvYmoKWyAvSUNDQmFzZWQg MTggMCBSIF0KZW5kb2JqCjIxIDAgb2JqCjw8IC9MZW5ndGggMjIgMCBSIC9GaWx0ZXIgL0ZsYXRl RGVjb2RlID4+CnN0cmVhbQp4Ab1a247bRhJ911fUW2ys1WHzTgNBYDsBdnaDTYwRYGThl5bYkpgh 2TIvo9Xf76kmKdHT6/Ua4Sxy8aisrj5dXXXq0vOJ3tMnCmJKpfB8mWYU+YHwU4rTVKRxKqnR9IFq +v5dK2nXkrT/tDtek8SZwIqKoijDmtX4uRw/33SWn+1Q0pH25AkvSlM/iAL8GKRekPk+fkrSMJBB ssIOYSqyNAlI+lko/MjnjbAqzqL0JsNmk2wtQw+ApE/lde1Vthp3xRZh5GWpFzKCNPaTMJKE3aJQ BBlODNVpILJE2nOJMPWy6Cbjsw2y1VoGKY4dZtjuunguHE4ZevZIvFsQ4SSA59n9GKrnse4oENKP VxXFHuzpB3zkQQbVVxlUwyISVsJ+0+K5kPeLI+H7MgxW0g99kYYhThHHIvCCBEpHEZSOIiyXifCT lDcal9JcCJ2rxBNxAJeQvpQiy/jCEykSGXkzWXmTrfHFUISxhNJp7VU23kMSCy8MJSvwWFfKShM2 QxjfZFg/ydZS4lpimbDScTGu4Cbk08OJwyiKoEFiY/adilJfREGSwqaTrLzJ1rGfCnhNBFjXxVch trJaY0RCnLEGXEaUsWekicjCzEc0TDIoGGWrdZQlIuKTQDgtngtZa+az3QPW4GciwZcrygIRxAiL qwywrrJ1mLJVY/a36+K50GpNRJxm7MVSZvh2xFpTkSQyi1dXGRSMMlqHHoDIkJVOa2cy1ik9+Kcn gdQDKcSIw5X0QgHTwySjqMRPowg2CiMYDBqvK2eyQWMqIrgjvpCkIghS+L5E7EZZCDcdZXb9JIPn QSVfPnYc195kVqdE1PpQBSCJCDP2fCkj4XlwxKsM6ydZhINHzHAsG9aCS64y6ITBMqAD8+AgCBOE LnT6OJ9MELeTDOsnGZMnQiqwOse1k2z0/E9ggijEjkkMIvBoffsISpWBnwiQIe0qerth0vA8SZsd 4Ybst/GnjNlwYbTaVPT9ZgPiBidv9vSiyHXdFftC569I1TnVpqOtpq5RuwedC7qjnappdzSm1VSq TjfUmdk3yDR000F707xcbf6gnzc2Sdxw/hnYcejA7o6qo7boNO9Iig7Fo65JVaavOzJ76opKMzR8 LEo+xFHVB03VhaqixlG3fUfdUVOu96ovoepo+jJfHnoaONBhXVWb+lIV3UW8pG8z1uprdwwepad3 /PEFfSi6Y1FTWWDXlg1UmkOx4x92pm9ajYvew0ydLssRnelb+p1aU2leeaDfFjcOUq9jnPOx2B3p qFrgqlv9qdf1TtP7wTcZDBlcG27cWpAx/pNyo9sZ0DOOCuezHnLmW4W6R708+ihz0G81nLDWqikv VFQn07bFtkQwGXqozRk4cna6iw0yltT02yuW1OyhFipOvSv7XBOfoqiXR52kDmpFO910Cu5xasxW bYsSnjnYDx7www8w8ceXizuqL2PHUTeIyLPeMo5HkEoLEEUr6J7vfduYc6ubdvpLKpioOktICO7B L9ohshutyvKyuPFQeDrGY4SEf/sTXzPuskIodSxhJj3pZq933WsqTqTyvNFti1Mxo9441tJuXrcI SfPQn9rlYUcuf34OQdDbkQ/Z+iP2RpeFYjatcSywvz3X4KUAn+tTaS46pz/6tiPE6xnUsTz0xOVP xmNOTF0b0wj6K4LqpM0JccbxNbpEpSvTFBr+cNZjaDEL2K8IUxdQ0jclnKlULVxIL0/9fuY7zoJd t6CsFvjx/4KpDR4DzIeirkGyy6eDIPCcKHszZR++aaYpBD/umRNppeoLujfVgnwFvakMiH+gZHzV Miqi7qhLwN/ha0i/CqUCPOAZDBiELsGe+m2JtNWekAMGh4QRGS+iCrndQiEQGVu1qHGiSnV813d8 qJwKznGWiu1Z+FtWYwt1i/tuELtUO+02GXMG0SIaw9KC3V5mWY4lID9Bf0fa4HT8/zhAmjgeDIDM a7ZOOB8NexBDY0RnLsnY7ogqvqbWlg34pOhRNxd4fcPudOhVA3fT7Pp2weKGD73YwQ0YjFvl6tQx WGbtCmysUBSCt/Niv4dHIQoOjQEHC/o1z5HEdW36w3G8B86KXJmAva9Rszx4380xjSn1t+bfoRlY fbkZCNHnPy0UERCNRtRw8AyXuINp2l2PQsbUYvnDpi5H3uM2DLO2OjRwEkb0I1em8KYHFudmWZaM 0BhFvsuSwLFXzbJ7weQyQqv+1O7mgYscKnX3HfICTg2i4rwFTxussO8bvptXtG9MZW1Cr9coypZs tSw4dPxPwW34Ckjxf1T31RbVN3Lv1PPtBoI1CCvkDFKPqigVil5ruNVSbSBji6UbGb/oDmGMtgY1 yNAdoPVDDfb6W8Plv/ZVdnfMHJ9aZj0jaPRY3lOjPMMFxYkbMWsUOOYBxQ4RAYbtirdohPOly3Zr B4yyXDtsfrlf/9oUKGPWb3nn9Tt0FJgqwDsAC6B6znQHzZ5xRfsM5kmk21Ku6V6X+/V9cahRrnKr cwVmW0UE2VgRftDbu59mngP2/JNTF7ZY4mew2OqzqQub5I47mapoAerN6aTLreorzkVn0zwMRbfq BG04U/F0o6WL6W3usROb7jK0OrXZmvxii5plOwcLPXRLGDjZ2TICw0HJiD8acFaDHG9JojR86c/i ewmGea7vfeV26dh1p48v2o8vabjfpTkzSV3OXNO7NzR63DwUZs71P430vkpLKR4DXJP89I/7+5/f /UcAS58+9d3mck1CiB+/9ayoWFZfHF+yN+LhxTnrh6lOsMXkbSo0zPNsl42SdJzyLVvAWEipdPLl rFa5JXAuG9Fd2XEFsmeLAhJMuFc7HkOiDEZLhtGWTV63SQcOcV48xWeeS5EcykObZyHwqLcyPH+x lDOUgwh6zA850aB8BmKFCgWTGhTQgn7H+qEzWB6udLtAa8wenMO5fixYbUeCsmlCfHMFcBRK/znI J8uWx4wXhadBCWgAa+11xTizJvcVdnrYnbXC4N1243wWoMdSdN3DKFMhU6hle1X24yxyW71rT4Q+ CGmJyyt2Ul3CO8YWu1UovthTeAAEtJ8bmWfJw7GXt3Dici48cZpWTVPiFlWqraK7Qlur4xxqiK+x CewMOtPRQ5ZGiVdKlxs/sFVQ6HPZerJDN+R3mBPswH1X3StMhXI6q8tri5gpxPo2e4/aGsywbA+A j8vjDdxpG5twrdEd7/BusKZWYbJtXRkNvX0zsShx9w2XM/sCrIZ5Cx5kjDmU+i+Dw9s6S+fwYnaW 5XFHblGMAbA5w5Dr8akHjAVDX6e0U8XCjg2WHZwDRCxQJNAWbwy4AXgTEOMb22eAnLiJ4waOuc0i yU39HUJ/DmV2BkuB8B3b+ewMUootuFHkmnpPfBfLmzpzs8exyFGSkoLPWii2PPyCIdnVrbMg9Wm8 fWAU1J7QW9aw/N1zvMKB3Xw8E7t8DMA16YvGpAqDBX6UG59qpkxyh+fEWYM3kMTwEDUhnZYtbmb8 PomDmF0VgYTnMUsAzMWWeiFnbqj1v+CveyAGewxPStZv8NeWXsaSA7PSCx102/UYoC6PO3Z5+W/j AwFQYFQI8iv2eOVhhBhxMAVavqhUa8c7t+ks/paHDsiHDZM1n5G/9Gp50Kk7WGjN0IIN71GAMtnS 4rOjzgnxHCTXReB3fn1ul7eu77v8vDlq5GPGwAZCWYmnM10hnlrEk33ysGXFvjgc7eATjacdhJbs P+iJ4B4HZKPr61pnFrcvfoXIcWZb/zJMvDLYSwZdjQjhDnwUW1vYBM413q2bWC3wyxABSMFPXSZD yNuhoy3Jwf3IGKiCi2aiBnv5Y7poJpvxt8Zp2AWOuqj5LNDMZS+uDDnQcXsz5hrpAU9gZ36I5vRg X09fwRUOPabd9O6IkQOc+fNfdnj/b/z+HbIKZW5kc3RyZWFtCmVuZG9iagoyMiAwIG9iagoyOTE2 CmVuZG9iagoyMCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMg MjMgMCBSIC9Db250ZW50cyAyMSAwIFIgL01lZGlhQm94ClswIDAgNTk1LjI4IDg0MS44OV0gPj4K ZW5kb2JqCjIzIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8 IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMS4wIDggMCBSCj4+ID4+CmVuZG9iagoyNSAwIG9i ago8PCAvTGVuZ3RoIDI2IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG1WduO 28gRfddXFPYhtpFRi/eLAWdiO4tkHoJgk1n4Yb0PLaoldYZky2xqZPnrc6pJSvJ0LgjAhQFbKovd 1aerTp0qfqGf6AvFGRWhCKKwKCmNYhEVlBWFKLIipE7RJ2pp9dGGVFkK3R9b8TN5Vgo80VCalnhm MX6vx+/XNevvdqhpT1sKRJAWRRSnMT7GRRCXUYRPeZHEYZwvsENSiLLIYwrLIhZhxPvgoaxMi4sJ W02mZR4FokwSqi8PTqbFuCOWT9KgLIKEdy+yKE/SkLBTmoi4xGmxbh6JIh7OJJIiKNOrjc812BbL PHBOF9jt8vCtcThhErjj8G5xGpUJDhG4/YBbGAS8dhKKskwWDWUBsIxiPu5gw9IX2zJjhNMk5v2m h2+NvF+WiigKk3gRlnEocodYlok4iHMsOpqw6GhaZlEhEj4hbOOjdGvEmos8EFmMcAhLHJgRaijn tdPgxlZfbcs0SkVa4hgwjs9ebOM95JkIkiTEAkUZiLTIeNEcN5wl2dWG5yfbMikTkScFezo9vLg1 8ukRwEmaprwCEMqTEKsWkUjjvACmk62+2gBugs0zeHV5drJhI7dmhjNnJT+flPg1x0WRI8rKCHkw 2fD8aFuUIcPNfhbTo1cTr1hGIoJD/HRYiCxMsWIZizhDMlxt9cW2iIIElxQynpdnb2xuzVxkRcnR WwSFiIE91ixEnoclozHa6sXFFsG5LE0iXnN69sbGa4YBUi4I4WeOa0gKvvgQroQFR+hoA3IXWw6A 4ghOsG189sbGa35BHqRJiOzOkAYBLa9fQSZREMKrPFxUDX145JQJgpAeKwqRrfxr/BvGCUUxIuex odXjIygLbPS4pddVLXVD/V72+EvRVla61v2ZekN7+ayoOda9PtSKjlZ1lg6dedYbZfFjbQX9ydDZ HN8sHv9JPz46Qrx69p8dpf/pKGjspaMbbeWuU+r+Df1/u/1XWCKGJU89WB6oNuZJbeh4uELws4NA thvamiP+Zgzeznp45w5I7eXh931/eLta2ePhYLpe7IzZ1UpUpllV+840arXW7Uq29qQ6cTjf7+t3 qv3d8P1dFGdJESWz+5mEsefnA4JmQ63pySrVOoBorbamU2L2a+MK9BKnfxjSbu8GEWroZLon3FVH lep6vdWV7BWi9oGqTuHjhiS16uRCmx6V7VV3R7je+aHKAw8qgKQruOCyztS1Oel2R5IzC7k4ePN2 dtC4+rwELQAiPW30cHEu62V7JrOl5kxrpEEjuydLn18DOBeBVjknX1lGbnus76iS+MRU0M2OXRr5 XHB1qjLHekNgpBb3e2YP6POb+VFDeX2JWijo0x4x/kAnbM7R9meXlb/nCJzAfGrNiX8h7fy4ZKkX U5Ggv8hnjiOrdy2CSyMHQeRgDwv6aM5L8PdWgzrUcTXEmiIDAJnc7+Bo32nOCg5CNb/HhU9s/y79 HIfAbatqVfXI0ZvsJbmTuhWM9UbM7mEWRR6moBSXkSA0kEqtn4BYq3ClrkZadZAdqIRtyIcDaqRp JSqodkTzakO213U9PNeb+T1OQs9jl8FMK8euprXsyO4RhQ2KO5hQyWpPvVzPTy1ZXnpJ8otsTXtu zNH+SqchW2Tj6kNtdjsXoPNDUhYeJL9UoDGtbp3oO1lxgTdcpsC4VvdqduLIw9zHBDh0Z8SF6c6/ ujuREBuVrJ0LI5f159lxyePMx2W9rrfa7v+4h4i4RedoXTW6Tb35wckTD5xPukd4InbNode4GhQh jhR2xhx72kLsXK8LJUkrqvaqeuIffKXlH1C+x4BDHRD0QbnKND+Wpa99qmPXoRLUZ/DoUJaQbzvF uhrhNSijam8sasb3lIZjSnf3TnygfMzubhH6vHZylbMyKJztUYFs2w2DqHtBf+suR2i07eWTanEq +A7nX/iOUsFs6OrH/G7HPrmx+kZ8tLRRFcr+AC7qKxvp1BkcgZ1xeeWAHyl5wJaV6RpnWKOhQYUZ jjS/36kv99g9r47d0QnxzoFd1cZlHCuuzpz4BFD36Lt6VZ8FPXIIDTcmWSreAfX53c5KjyAmZxAF XX883DmYJyMQ7FSjmjW85fPV0vYX/mJwIXBHgmN2hWAaTju/54VP+aANB6w8yPXY0jKI2rryczDW akTBHcJhEK8uqCDdBpQRJLqZfsSh0qHQ6/nVbRn46la2VxDH/LvGCTcuAzVP0kmABt8jK+B7g1RF JqCT4Z+gwdGovODB2QEvE198frzw31jpOaYxQLhENActcHSh5OIFUf7MQwVpnyZ5gl97WfIbuF/4 9D20jtz1jyqPu3sOl51hMHeqVR1y7+w0NYK907s9C/0OGhWVyvVQg9bbGFwCM804LJkb/TgIfDrn /IOkaS30qGqrM7oSwic3xmD/Wfsh/PlnP2O4oZ5VDRo0z8jKD+AfUGWLg/OvDjjvED8MAHJodvzj IPEJEvij/9jr9sm5zqMe9goJOaYtUsFRJJzyDvvyZJANp72G0h06w/nVVBykPllyJYR3o3bqB609 MJ8jcPyfO4xrCGlvDi5LcSPbS/+/Pu6YajDkmei+2mtc1m9wB6XPPOOYqTIbdTtjOgxTJn1sVriD o7Krjeqlru/15l1UYlA/e4SHsc8vCBDU8r08WFqf6XDsr0GKsD3JDm1suxlLEUY5EIo3+cCVi4PJ qZ69qg/D9yve858h9dtdMAIC29o76L0WxdEgkruTdgMVBepz3nESgL3ZXQ50B7nriWUN9t+AT3m2 dpUHZE39rOZvh+Ow9HlmbIfR646hzDWHZTr7O3CJ6z8fiPMV/ZVFZ+FOdM+6coOhHIhpzG4FguqN uZ8Ve0y74yj2CeYBm7evGFPmGGtm7WfcponfAAt6b8FrVuqNm6+4vd3VfnSD2zEgv5/Czw9H5usj Vskg/Gnefxnsg2y68xCCPE1rFe5wSXrrZmsnOYy6eK41v5eFz0gDi7Mk4P1fIV4cuzod2g5vKOQg +MENTjo4xLmODS0/1MXMA12+6jjwe+kf/CYeQ6Af2FUmfpfanfpyhGKAhoCHDZScmz6oSfPPDmkc +Tx6kSfXhpUzFpR0rcB884PHW91B1A8jJUPq66HG/G1+PxOfK3loBU0L7AYFBhF+6aZv8Jv3xQJe cMdxEflzCYUhHrPx1PtwBjAHgonhJHfPiLQx5gSBJXnoxjwuaRo+zYoaO4q3m17DptHRj1eHHkZJ izElagw3X+wrXyzLQgyGr5OSBvWeTzFFxvyORj4dM2Q3iH1+PRV3vJMxyyF5Vy7x3ZGW10M1eJ0E bY3+3yoM++d8+ehQjX1lBxJ30hgcw3ruIiuBLar0pOs4Pv5qvmHeK1nSQU/jfRymEngLhUiY39HU Z3WeJ9D7b5L+jqYKiTrnu1IHDl6Mv3wTMqrG0+kk5DdMw+2TwNvINRrwFTrofjVp8KVul4BoOabQ EtSCV4NfV7MDk8Y+m3CTc0Rfg64Ho1fUBNaLuLhRivCQH3fFLSrmNI6rJ7XF3De/i6nfgV6Zgjjk hbihtp/+Bai3W8QKZW5kc3RyZWFtCmVuZG9iagoyNiAwIG9iagoyNjM5CmVuZG9iagoyNCAwIG9i ago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMjcgMCBSIC9Db250ZW50 cyAyNSAwIFIgL01lZGlhQm94ClswIDAgNTk1LjI4IDg0MS44OV0gPj4KZW5kb2JqCjI3IDAgb2Jq Cjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4g L0ZvbnQgPDwgL1RUMS4wIDggMCBSCj4+ID4+CmVuZG9iagoyOSAwIG9iago8PCAvTGVuZ3RoIDMw IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9WduO28gRfddXVPbFNjDD4f3i l4W9SRAB6wQbT2AEMGC0qJZEi2TLZHO02q/PqW5eNKLXcRAmWGNHU6PuLp6qOnWq+YV+oS8UxJR6 jut7aUaRHzh+SnGaOmmcetRI+kA1PfzUepS35Jn/2pzXJHHmYEVFUZRhzar/vex/n/Ysn51Q0oF2 5DpulKZ+EAX4GKRukPk+PiVpGHhBssIJYepkaRKQHycePpmDsCrOonSy4bDBdh/4jptEaUzluHa0 rfpTcUQYuVnqhuxBGvtJGHmE06LQCTI8MbaOPSdxE/NcTpi6WTTZ+NmsbXXveU7k+XGI48bF10b7 lKFrHolPCyI/Cz08pTkP2Hmuy3sHLqD2VxXF+JD5AT+ytWHryZY5sRekPh83rp1sfFocOb7vhcHK j33XiRA97Bk7gRsk2LI3YcvehK1DwMV4DSv5uMHGOyauEwcIrR+lmZMg5hUhGIkXuQBqsJWTzYuR PUmYYst+KV2ZsCOSxHHD0OPlSYazQt4ycRjIeLJh+WDzstDxvIy9HNcOtj6qSN4wiiJej6SJXU6V 1HeiIEmB5WArJ1sSZk7gI9iw9WtXVzZ+8sGOZ0sRce/ZnqPtak/kkeOxl8PK1Wgx+8UIcpwFwCV1 fNcN2MfEycLM9yYbVg82/AFFZdIr7deurmy8J38Dj3i1vqIscIIYpXW952iL4wQlEmRUrsa1k83U 5WT3I3iXcHym9YOtnGxRFjme68eIxbh2sAGNZ1gGMWraTTgvx/iMtgnLle+HThaH0RWadGV7hmcQ IeR+FF3jOdrK1YgnvuKgmAPec4jFlY33/IIqjUIP/BOjSF26n35F6vuJGyGnslVe0dtHLmjX9egx Jw9cwt/GzyykIMpgrejh8RGcCrp83NHL910j72jTaSo0nVVXbmkj6dRIrS90UkWtS9m2r2lNn7tW U36Q+VFuSdRbkk+yubxaPX6mPz0atp6c+n0f6d/4GHvu6tbHtqj3pSQtNnDjIJ4kqZOs8amlVlWS cqWOhWxJtK3KC6Hl1nlFxq0VN5H/1q0U0MVhOnPrvaKTbA7i1JI+wB9VlxdqD+oMdFR9qVTX0pn/ UKveRSrMVxvpLAmbh/AGSIGZg39WzeTKHf10aBgtUTZSbC8GPlFPX6BKbSV9fKkPqtsf4LQG5Aeh l3fVD2euXlRHW1W/0GjromQctbhc+bbDo5Sq3gPkXBJ/W9ZaNkjaO0J6wFb8DxxFw7rNxYqroNVF WVLXTqkH95AD9KKW/FeFlDir5oi8pXsA3iraIEcr0RyRpY1cHlJ06VtPrZPiSRSl2KB8ChtrE+aP r4YK+e7C/Ra5eBAtUErujF3e4HE3CgXL4GwadW4Rs2ONn7YywDmtrLftUMKvEfItiprJKEdycjUt CpZx1MtmYLF/iCdHURgqRKVuwX57Y1gWLC7XFER+G7A1mLcswKrWib5c5a8gmaLidN/SudAHJp17 5kL8bFUNEmTMdqqrt4tCZdzM5qwyIHTmkwlF2BScXgY966xEPaKn6POyuHHsMmjQGW4aoQL9g7HA Eepo4duILaf8m98E/V20KMUXLdqaOqlWlHcGMo75mzwHcMtSh/EzmhfkO1GLPVKMmYGQZe/Ub6AR 0beq5Qoxy+aFeND61L5+eDgXx8Kp7MGOavYPP4tN+/BBoqk+rLdIskJfHnpQPvUOL5pVACd0odtv g/juQvsOSsO2SKDD0UG8Psscn9FA0RdMQ5JUdaUuTkPKMZrLexgmMw/hU1+SuumqE6qRXdyiXkt1 4voktaO9Uki7HkjSjajbEwi/zhcVSsy3oRvHMx9bVXa6UHXr0CMTmdppI5RO0EuAtkbX3Be1BKHU +9fopXJ0WCyPYTrnjgOgYb5SgK4x53NjF2gGRQlRZEXbIpUAvYuJdk4Wf2tQ/C10ZCuK7R33Gd01 wEZBASPNmENMfbK2pbMsyx5JyDyDIcJdLwmV8TOck0WlcL9hwmfJCsdzHmlII9a91h3kIGKqD2hW uWilQ+/FhXvWslrIuBh7s2Rj0mXF9pxzAaIVc/aP+UHUe1Znf7iK7moBSR56WYZWsHo2zfzM9F/s EDiWWdAWTcEqHAjVR3RLtu+KhhWcLJlYVNeAZKAfmU9MI10ythgcQlxdzYBD8tfsSitFk2O8MyUw lK5Da00VxC/GMNNq8UUz83Bqmi7PvLO4m7jZuqXkwaM7ukjt0FtUiJXag0cSIn1TFu3BDIRUVCfV aAEiHCFFBi/uaTSnvWuevWNkj1KeTF5yNaC/F6UNPYQSk/bwZMCaRLW4h8mc+Dh42yLXQltNeesD 6MhULnwX+0YCUAW5PgF5t7iT2XwIs7obZAKBjsO/oB9zM+G+BsSeLLMw45gud4Z4GSh7kTnbdLUg mhPNmieXi6E4Dh8KGz4KKkV+ZN+uo2/58EYjLImddTL5yiUFJr/uZEvWjl7os5hswIeo5AZsU+wK 3EzQXwCu1dA8YqAFr19gmCxZgi3vaPqVUUfRP9ZklLqGTuCyNh7ARbWvCwy1wgZ4qBJ0Z0gvNERm qmrh5mLwDN2vkKQ4ynbIr++WBLheWv3eFZg9Cpe5t0T3V0TEpJUZrz7IzfqPTBfcQXCl1FWc+G0H phYjc2ASQ9AQ2OXnLtZ2YTynkM3FCCZOeFDYMExDjmwVOttQlRqj4jjeoG626sSDIxYv3DUsmumc RYy2MwIU1yNdw6IF3mFO3Alc0zCwPNkbluM6ZmY0fCJrc++EHFu8DCJ3fpHTjhefDCcmDQyxlVEI HHfdGDpG8Rrqs8lw1eGss8s76s+V4CACGDUjTU2WstMDumVRFdxZoPuZD/vUWPSOkTVgFM9Z78MB dzXmUpN+OMsfLLFdxVf/SG/QdM+HC38Navsm3D/SP1W3JIzG0WTOeqOEAvGVAjMQKwFMSPxv6mPf zTPfug1j2Rd7yYxm1lAAuDW35wMLy73AxNwpGgf3SvPAVipIVFS0ud3WB76vBRUueNNuXAzmQso0 Aqi6BqhQLblR8eEsRhit/5iOvwVTwjDhf7ds/P4kc7TKnK+B74xAAwubq1TOIs57vmpqCXRSlLiu sHHsR3OejYp2SaiMm9mcP24S2XEWBQdv18IE789uwXkrc8H3zmsmUXZBY0R9veTzmpPjeQHd2xtb Fsw8wPfvNz6+5GlanXCtxhXFWscI3AbaDAamKp6sq4u59bUK8uOrxf1N5/qB/UVxj3cxxvGOXyXZ B+lTGiONlvba2czRYCnzogtP9SRK1OvC/YjhTd35sGXfYfXucvYb5Q0veDrMZcPqEUZIX3O5NHyD JximW8Mew8XY0vCmeId6m4homDvc2ZCwF6jQ4+PLN3tLvS12O0h1NP/+9dz/x9VwLpx6xExDv0IS EmVNZx5XP1WXT33T/MQ5zDVFeFOGWymIPiPROetN8lwNYr/8Cx4Vxu8KZW5kc3RyZWFtCmVuZG9i agozMCAwIG9iagoyNTcwCmVuZG9iagoyOCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMg MCBSIC9SZXNvdXJjZXMgMzEgMCBSIC9Db250ZW50cyAyOSAwIFIgL01lZGlhQm94ClswIDAgNTk1 LjI4IDg0MS44OV0gPj4KZW5kb2JqCjMxIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBd IC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMS4wIDggMCBSCj4+ID4+ CmVuZG9iagozMyAwIG9iago8PCAvTGVuZ3RoIDM0IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+ PgpzdHJlYW0KeAG1WU1z20YSvfNX9C12lQTh+8OXlO1NxbpskjWrUlvrHIbgkMQSwMgAaJr/fl/3 gAQkKLJUwsplWxwQmJ7X3a9fN77SH/SVgphSz3F9L80o8gPHTylOUyeNU48aTX9STTcfW4/yljz5 0+Z8TxJnDu6oKIoy3LPoP5f95+GZ5b0dStrRhlzHjdLUD6IAvwapG2S+j9+SNAy8IFlghzB1sjQJ KAhi10mjhDfCXXEWpcMaNjuvxVHsJJkfUHm59by06PfEBmHkZqkb8v5p7Cdh5BH2ikInyHBePBjP i5JITuWEqZtFwxqfzK4t4iRxgiiKsNnl3tGaPWHoynF4ryDys9DDCWU34Oa5Lj/Zy5wkWFTER4Tt fFpZwnMvS4mXYlcv473Od47WeK84cnzfC4NFELiZE4bslTh2AjdI8MR+CY/sl5IwcwIfx8VSfyeN 1u77Z/GIf/gUZ/9ESehEQRaO/XNZG/mHI8uDc+GMy639EuyQPX/snygOHT9KJBjOvrisDf6BowIn S2KPMTv7drR2/4TYto9AnLWPwPEJA9gbhEE6PuFlbXRCH/i6mcuO6k+4GC0984RBkCLIkQycV5cI tGuAblhzE8f3knB8wmBYsyf8uwj8ioNGoYdMixGSLl0PH5HYAbzp4FbKK/qw5PB1XY+WOXnIG/42 /o9DnBH/LKvFzXIJ9gAxLDf0RtVrqk1HO/VNU2fAH+WJTE3dTlOrm2+6uaLjrsh3VKmT/VZlQDKm oVK3LW2NWb9dLP9LvyyFmwbDXmFnGiyWFd2zs6juSl3pulNdYeqWNjCg2xWt85ZetvniCZAigJT5 AObB5kuAUay1oqKlkzlQ3mjVaVJ0AER0h7+4WndFd3II37XorRpz5MtFOyc+YmLoTvDpdFkW9VbM s/5iQxU8dWixPoIJfnmEVZnBv+LK66IsZACTdGLdh0MHb6mO1ka3Em+tKTngAOxdY1ZwrUMfdK4A qEXYHMo1govUEWG3aUw1J4hiZpZMzARkDeWmujt0HPetqbSpNZXG4lrUdKjXcKmidbHZ6AY+p1pV +oo4jRhwpNLMhkauF08M3dfmOHbpk8WZqfF5rn0qN4IQpRvR9zA3bjdy8FJ3F7x0CS/mpu4aU/LF Maa3nLX1noqOk2kL8MiAZADgCZ52BvCYPqT6Ps/0p7jPZ9Mzf4IibNipuztdtw69hwNvSVUSnEWl tkXN6VTrHCynmgKsqODrtjtRW3QHYSGHftm+swfcNIXGEwbz57Ha87yJ1VtOIcEMdP2rMdsS8YcQ tdRkkGkcjLJQ1Fe06rNqp39qqWtOfCrcuNPlHfGXEdQc57NbHkw5ijOr1N+pU+0ehpluR8ZGD/PU 2jBPOU5/Jg4PLkztAbVHSZ0h/V3xEy6Hmt3oMJvAbQPVrL4V5tCiFILdOdFBTSAvmC20xitSQQH7 Vq8BKugM4PJ6LlRmQwo19Rw8s1YFjnAvnvIuzIWJCgQq4ZmXRb5H8NRYQrXYS6RIPHEI2C/3gXM+ naF8p/O9xAhn7nZ2zNMpD3NcWk4FxjU0SXdokKT4Gar9/7mMRX4YTmLht2bk0fv+JpXnIgJUCaqw ZYKr27ExSLiLPBjQg0p7oqGaj7P91J9w9qeqIs60nTn+TCBwNvRsIucdxwaiGDTBV1jkXNmDq/qn jj/z+nCU13MdF5fAnXKdRY9r8DW2VB0orFHYm7UflAMYo7sfEi8pGU9VO04oyOoJcv9GQldF26m9 ruHnVpc6Z2lzdnSum67YFDnLQ5aoF8YS4gDvAVasz4mdmBpNcx+oOTTky0uchG7jkRZCNsriCSZM dGbvcCDdou4Y0ArKSieqjcMGCtmA9iDb6csbbhzQM6Bo0ccdZB1XpS9vQUmsGFjzzQ1N6EWTPD6T Me+KCiSxpJvWoL6jXkqFLGz8G/Yyf+3LGxiuqK2Q34jBeit3wvLZ7Q2mvDOKqvZKMneQ+BY1m5RG pCoquoakOgmfwy10FGDbroDps5sbTXu1sthLL7lC6YG0Zx5BVWFSZyEvcCIemETMYbtz6LOhgr3A YQONYslI0X9UbepThbL71/xmJ1M5OIYJpqPjNE2nwDD0foN+gNjztu3UVCFyIf4vdZ9bUW4EOYYg T2zpnx3rbMqQ1qtrw8TMXQEjyVaxohJEe6M474AnwG3YASOh/RJieHy2wMSAedkkzd53aO50y0CJ KUPzp3XFUQGUUYKYK1qswPUGsdpYKjmHwxFhMTeQUTilSyADic9qqaiYAeDpK47Fmt2KNoEDUwoQ W8hhPaiRBQ9lX9s6C4jptNUbgSg15Jby0nB/JewpCq6vQuOudMQYIIBa61mHNGxr7E55Ff7Ld4at E++NjVBbBV7i3K71d8RDgcZPNQZCSQr4QsZHj2u652sh2wQ+Xr3Q80dxPNVCvzWsK+XnpcXyKQEh 22Ee/7BdXgKB82SoBf+h4vHoRnKWQ71vjJE0a0ThpdMR5Pr75swGNjNxp60a2EysYSrpO/mx0HpS u84zSmJJmATTPP0nekLVbA9SpRkwoV7L3dwvglPqIuceESR8S5sCzbA0+o0I2r70z4mhWBpNuxge D0r9g0rVzUblrGLviUJBV2GqhIy5qKE1indpeKjYGVPO2iaKpcmUY6RAW92WQ78VGDBIAm95qAP6 tr1Y0bVQQGD0DkOQcy9fYTyC5BnwnHluk3pTOXTSUEHidglTbnFHsNLHQYPDYFyseISwgtm6eSeJ NFg7D2+nwVQEjckvh48Rlx2Lym+FAop/6tXtP7jeMaBmU0AlrU1+YFHBR5Ow1rOrnjSaqp4zGVkd Kb2doY3uAFlRA9ZKRl3QvzJHpk/L5e/0K9ga0nd0fXZEk0ekjkyC2peyNIrC4u/einAh4xdAD1n6 GupPWYnP3e9oy1e/iJEt8cb24YuYa84smSlj4viO9BYDMrOvVLN/8YmfqkuyfZg8cuIVNLp0/uP9 5jluzE3j/fdO1zwwQfkHpwDh9QjhZympHx4xjR45Iroi25xzL3rJsnGmglCsov6mymLN/aodf90d Vpid0R4aEYHPA1bobC4366Ln+LlFauy6U+a7JqZkVlElhhDn3pVDFG20HfKB8mAdvlKg77bUYpfO d/7r82fkt16jwkPJ9lKXb5j1FQviLHb9KS1ec/v6Um8/petkI7w4fpjCcJ1lrF3X3b27uflelRgh omzdbIza3LiOd9O/2NxJ1w+hz4FI3DnTEdMwnviXeNG3xvunYZIzNyfHbjpVX/SJaxpisTqdfXju 645oSOHh82DppUj+IG9iN5uSIfUIrlblpmh3Tq27mzttMIi/QXvUnG5y1czdXsSeN5V+PD3a8Jio kQ6Dc9UqaNTWlcZwei2mQhxwClQGGcKpgUDnyYcgx3NuKbtYwEgHUc+jRFUP9euP/wEkIu1FCmVu ZHN0cmVhbQplbmRvYmoKMzQgMCBvYmoKMjU1MwplbmRvYmoKMzIgMCBvYmoKPDwgL1R5cGUgL1Bh Z2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDM1IDAgUiAvQ29udGVudHMgMzMgMCBSIC9NZWRp YUJveApbMCAwIDU5NS4yOCA4NDEuODldID4+CmVuZG9iagozNSAwIG9iago8PCAvUHJvY1NldCBb IC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEu MCA4IDAgUgo+PiA+PgplbmRvYmoKMzcgMCBvYmoKPDwgL0xlbmd0aCAzOCAwIFIgL0ZpbHRlciAv RmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBvVhNk5tGEL3rV/QtcdVmls8BfHOcVOJjKqryxReERmJi xMgDrKJ/n9czICnLeuONsWurtNAw069ffw6f6A/6RLGkMIlFVsQ5pVEsopxkJEVQyIisovfU0v3b LqSqo9D9dRWvyWQh8oIOlKYF1qzG+2a8v+7Z/EtDQzXtKBBBmudRnMa4jPMgLqIIV1mexGGcraAh yUWRZzHJMBVSpjkrwipZ4PIig7JJFhaJCMNCUnNZOolWo04oSNKgyIOE9ecyypI0JOhKExEXucTG QQo0SeSsEkkeFOlVxpZ52WraGcoua29k3sIkcOawrjiNiiSEhU4beAuDIKVUJiJKs2x1gBJwGcXx RYadLzLQJKJEhqxtWnsjY20Sb0Tw4ipNY1FkeBd7ShEHcQbUowhbjqKb1dNKupHxjlkgZAy3pggN WSQpNsxCkYVpgCiZZM1VFmXYO4uY/3Ep3YiwIwJEBEkSYnkcC7DBsZNlIoxkIq8yLJ9kN+svayfZ 6NM8hEvTFOsRuCFiB3vmkUjjLAeXk6y5yuIwE0lRAOW0dHUVsd25FLmUBVaHkciTIuMdM1EkRRRe ZVg+ya7Lp6WPdgzgduf4TwiFNAkR4NKJfrreIp+SIEfuZSlVB/p5zVETBOFqXSGR/Nv4HyWIfbh0 faD79ToUAfJxvaMf+1rRcdg0uqKP6kwfXtHRml5VvdrSSfc1lVWluo4q0/bWNHfUGerrsifTNmdc KRo6Zcns3PXGmhPfVmVLnVKvVuu/6Ne1qxVXxGzTFxhATxiQytVTBuh2Z+yh7LVp78hY0jsCMCA9 6a5WHZVNY05UUjdsOgXoO9I99YY2eEmpljZnqnVHO6tVu+3uqGwNLLO0OP4sneGH7lEv45ouhRCv 6GXkrbz3H/u8SGY+//Dqf+7tI+sJx0RxNNOyhgvKjXlQdOMexNHQbDlWwLqLnS2zz3E0xQ78stNN g1VOrA/lHhv1S/siSpEiTyRDb47siN+M2TeK3tbWHBRHxJYT40FvgQXgPmoECr/X6koR7VTZD1Z1 YvGQifJiBpOZdXr7Wrd7QuS6jDwxqcyky8iqLts9Yp8DG8hBqULO+jePoPTOs4u8XprZOMhnkEdn Tj72UeAhciIy6qOumEPOXBiwvaNDCZb37hlQtqhJyG9ETX9Czi4OOspmoB2qkbq9apUtexQXDgV+ glBoe92jdCg6lR1AM1qzedBm6MTi+OS8dLxpz6fyzI40HcIS3AETkKAYkj5wuKoDMOI56rWnfO+4 1haIzzcYUZI/M+B8cedZXTrPo/qQoPOgec/qwxumDEX2bAbamvYHhuh6jGMXTx6UFbTm+HURvmg3 caBkMHe5LdvuCCrb6owR9tOgrePwphqDqSfGMx48v5ira5d+xFWIAVPKMJrhWrMLG1U+IKOHzndm F4SHo7F92aIIoRhV1qBVd7q/Rqegd+BTtx+XDEgPM54X0HdUAyI6LXx3pqM5KbsbGoTmfnCRiDKw Kx/M4AYG3cOzF/wA2sPRy8NM516etPYuVUqqFDgENq7qzOPR6ocSAeBHhCNI1ZtGvfaJ9A0KkOdT zit9fzJ0VObItdvS3prh6LrOKOPxxpVIQ+rvsZpuTeW49k1heTrzeXHvatfU3USIpv6gHV3M3kTs iJdLZ2vIDVfold8otx2bWTCv51WJMum6ZIemblrc+PkQSLe6qwZOHjzxbdVPvyhNFaq+Gyt56eKE 4uAzy/Y5PDeidzUda9Ob2xBAWSgJBQt9iAGboR/75vJAk3kHwhiN/MZBwB8h/JyERDqU7dn/+EG6 0hZR2blCBcf7VL8k/6Kznfe+TGakclesLAY1zpiSHd5bvRn4oNOZSpcNtRgtjP14hxjRVY3CeeI5 tOJ5D7V2eULzeAbyT4/kvdqApTUmC1xdJ462VxYgxyLboId3mIcw9WHOhuMvJmFOWhxtHsy7Eufz VlWYMWzZ6M4dwLh+3gz8AhZg2OApBEk2nh39qATT3v2Cd5eHGs07U8nhiBHO13DdciR0aKZjqec2 6byN+sUx4EY5nGFrc+JL/FseZTJvTKg8OGrj8AwYmInGid1Fgc8tN8H7qLBD2zqY6LW0NvZmnFto EMmzea3/XbX2/NLjo/8wsXry+OjytQjlbD68pgK9sVWNoabqR8Ur/vj4tR8UvOJ4XtTqvj++vr/f bJod2oNAwt2/1ODxLP6kwTlGvKKYn5c/Z+9qoQ8o0JsF4TwzvrG5ktXiA+njs/a3NtfpzedDwLPm fu056Dm/48iRhfj53kQ4vXLeav6LiJd8eXzObnx5zKIo+O52O73xfKZ+1u4//gELMTDSCmVuZHN0 cmVhbQplbmRvYmoKMzggMCBvYmoKMTczOQplbmRvYmoKMzYgMCBvYmoKPDwgL1R5cGUgL1BhZ2Ug L1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDM5IDAgUiAvQ29udGVudHMgMzcgMCBSIC9NZWRpYUJv eApbMCAwIDU5NS4yOCA4NDEuODldID4+CmVuZG9iagozOSAwIG9iago8PCAvUHJvY1NldCBbIC9Q REYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEuMCA4 IDAgUgo+PiA+PgplbmRvYmoKMyAwIG9iago8PCAvVHlwZSAvUGFnZXMgL01lZGlhQm94IFswIDAg NTk1LjI4IDg0MS44OV0gL0NvdW50IDYgL0tpZHMgWyAyIDAgUiAyMCAwIFIKMjQgMCBSIDI4IDAg UiAzMiAwIFIgMzYgMCBSIF0gPj4KZW5kb2JqCjQwIDAgb2JqCjw8IC9UeXBlIC9DYXRhbG9nIC9Q YWdlcyAzIDAgUiAvVmVyc2lvbiAvMS40ID4+CmVuZG9iagoxMCAwIG9iago8PCAvVHlwZSAvRm9u dCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9BT1dBTE4rSGVsdmV0aWNhIC9Gb250RGVz Y3JpcHRvcgo0MSAwIFIgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9GaXJzdENoYXIgMzIg L0xhc3RDaGFyIDIyMiAvV2lkdGhzIFsgMjc4CjAgMzU1IDAgMCAwIDAgMCAwIDAgMCAwIDI3OCAz MzMgMjc4IDAgNTU2IDU1NiA1NTYgNTU2IDAgMCAwIDU1NiA1NTYgMCAyNzgKMCA1ODQgMCA1ODQg MCAxMDE1IDAgNjY3IDcyMiA3MjIgMCAwIDAgNzIyIDI3OCA1MDAgNjY3IDU1NiA4MzMgMCA3Nzgg MCAwIDcyMgo2NjcgNjExIDAgMCA5NDQgMCAwIDAgMCAwIDAgMCAwIDAgNTU2IDU1NiA1MDAgNTU2 IDU1NiAwIDU1NiA1NTYgMjIyIDIyMiA1MDAKMjIyIDgzMyA1NTYgNTU2IDU1NiA1NTYgMzMzIDUw MCAyNzggNTU2IDUwMCA3MjIgMCA1MDAgMCAwIDAgMCAwIDAgMCAwIDAgMAowIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwCjAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA1MDAg XSA+PgplbmRvYmoKNDEgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Gb250TmFtZSAv QU9XQUxOK0hlbHZldGljYSAvRmxhZ3MgMzIgL0ZvbnRCQm94IFstOTUxIC00ODEgMTQ0NSAxMTIy XQovSXRhbGljQW5nbGUgMCAvQXNjZW50IDc3MCAvRGVzY2VudCAtMjMwIC9DYXBIZWlnaHQgNzE3 IC9TdGVtViA5OCAvWEhlaWdodAo1MjMgL1N0ZW1IIDg1IC9BdmdXaWR0aCAtNDQxIC9NYXhXaWR0 aCAxNTAwIC9Gb250RmlsZTIgNDIgMCBSID4+CmVuZG9iago0MiAwIG9iago8PCAvTGVuZ3RoIDQz IDAgUiAvTGVuZ3RoMSAxODIxNiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHdfHd8 VVW28N771Ftze8utubktvZBGArmGNKoUgQQJvRcpQigDTFQggAyKSBFwFAsdCSFAAHEYBAF1RnBQ lFHHAg5vxowz89AZITn51j43RMibNz//mN/74zs3a5ezT1l77bVX2/tk3tz5E5EG1SEGDRwxdvYk JB8l3yDEFo2fOXZ2rG5cixDeNL52njdW58IIMTMmzZ48M1YXn0VI6Zo8Y1HH/Waop7wyZeLYCbF2 1Ap57hQ4EavjbpAnTpk5b2GsbmiC/KMZs8Z3tJsTof7IzLELO96PPoG695GxMyfGri+5AHni7FmP zuuo50P+9Oy5Ezuux1WA33sIw9lc9AxSoOlIQATp4FeDkHBT6UIstNJ2OBY+kf7u6Lii75BelOuj +z8l5+9svvXCPye2hlTrxR/ghOLu9TTnI1IEITWG9hbV+s4W+T5IcpvRkORm1BugGCAHIDn5ARuq wzvR0wAvAjBoKn4SLQJYDfAcANtZ2gO14/jJRlaMnsCLkAP3iapYz0Mmu8emVHneb8Z80y89H9u+ OontMHpfYHujBikeUOIX8QtoAvLgV1EAL0aVKIy3Ho7M8IyBpj1oNkAdACOnGO9pdGd53sApKMBi uCeI3Cw+6vljZqrnRmYzwY2eM6FmFrJfu6EWjfOcdv3S8yvXZM8bAPtiTXsjcMVRzx7XDM8GdzPe 2uh5xtWM4Z71sWy+C2496pkZ2eSZkCm399vUTPY1egqgfVhU5cnN93lyXNc96aFmEUM91dXPk5T5 G08i3AiXeeGhgaje43Rt8HSHJrerLNQd4CTei7ehJLytMdDHcwKK0N3DvSP5m5rxzw5XhjMDzXhx NLcyvClSGQpE+nkCkfJQCMrDLgjLhYeFB4QsIVkIC0HBJ8QLJtEg6kStqBaVoigKzXh/Y7GHP4n3 oWIgy77DIi9yzfg1OMmexAfkkweOiaxIRCSamts/B+bFyNSM9zXpaAkKR3m5xDfjA4djpw5EPSwt sXKDjtAyJJAigkWC+qAG/ItmHq2w1Bbbig099QXlpf9bMkZuuZsm/++HDbsaNvUdUtWw11XdkEUL 7a7qu5fb7hb+13zefGiaWJKc3HfwosO1s6dNKpvoLxvjL5sIMKbhydoptoa6cV7voWmzaYO3gQmO GTd+Cs3HTmyY7Z9Y2jDNX+o9VCvf16V5Em2u9ZceQpPKHqo6NCk6sbSxNlpb5h9bWn14XMncmvve tbrzXXNL/sW7SujD5tJ3jZPv6/KuGto8jr6rhr6rhr5rXHSc/C7a+bKpQ0oenQfc6S2b2tfbEB7S 0HvQiKoG79jq0ma8E06WzkfcaaTjTqEwV4ccbDryINT+McA1mktD27/mziOdNLP9b0whDOpxCkQq LkKn0S/QNnQQ8Wg3lMNoFNqCLuJpMLdHoib0IXajNJC9LGpG/dC7uL39MpqEXoHr56EzaCM6hNRw z0xkhtZ1ONC+GOpRKI9Dy9tfQokoH61Ep1ABPHUdamnf034YWgejoWgv2gf3v4P95BBrbH+t/ToS 0SB45nJoudzer/0gMqAUVIIGwtnl6A0cYK61T0E2VAjYbUcvoB3o1+gb/Dhuap/SXtt+qf0LYFUb cqIh8FuKm/AXzEF2Zfv29j+1S0CJMEqCt45BG9DL8PyD8DsNorUMT8fz8Aa8kUTJ46SJXcFZpTag QwRVwK8SzUKrgALH0Vn0d/QD/pbYGB0zjznXntP+30iF+kIvaU8molr41cNvHfTpJOZxBu6FB+Kl +Fm8Ef+OJJGhpIosIAvJ18wAZiSziPkd+yjbyK3ltvAq6bv2k+3n2z9AVuRCD6O5aBn07gy6hG6h 25iBZzlxABfiEjwKfnV4GzmOd+DjZCA+jS+RvfgP+Cv8Lb5DOKImZpJM5pENZB85Q37LTGU2Ms8x f2C+Y3tyhNvB3eADwu+lcdJq6bfthe1ftP8TRKyIfDAyJWgAGo3GQm9no27o59CLA/A7CKN2Fp1D F+XfV9iJWtA/gQoIG7ADZ+H+8BuAH8ST8FT8S3wCfm/IuHxPYCCIguiJlTjJEDKOzCR15ANSx8Qz SUwfZgRzEH4XmA+ZO8wdlmONrJmtYHujtexMdiv8drK72Ub2Pa6A68kN4IZxddxqbi0znrvMfcgv 49fxjfy3/F9BLPYTZglrYXQuAs/+Gnj5x4PFiYB9FnoEjceleBzaBKOxA49Fa4C7JuBVQK/ZKNxe wyxjKkgGcMMb6GfArVvRUrSaGYl2tH/E7EVXgVNmwCPr0C62BLm4zTA6j6MM4KKOXzSSFAmHgoFE f4LPCyLfGe+w26wWs8lo0Os0apVSIQo8xzIEo5Qyf/kYb0NwTAMb9FdWptK6fyycGHvPiTEwlb0N 5fdf0+Cl942FpvuujMKVk7pcGY1dGe28Euu8RagoNcVb5vc2/KbU723GIwZVQfkXpf5qb0OLXO4v l5+Wyxoo+3xwg7fMNqXU24DHeMsaymunrCkbU5qago9HgRzK1BQqOKJIRR/cgHqNXQoCFvWiV5Q1 OPylZQ12P5ShjQmUjZ3QMHBQVVlpvM9XDefg1OAqeEdqytQGwBM9qZ7gn/BkcxSNG0NLY0dWNTBj qxvIGPosfXKD1V/aYF18w/Zj9W6pbO09jQ0kUD524pryhuiYJ4G4tDqG1sauhVrfIV54LFlRXdWA V3QgQXGcBphSdGM6ITBmmrdB4S/xT1kzbQwQFw2uanREHbLwbUADqxrtUbtcSU05bltW6IPeH099 IPUBmhf6bMti+R+fiJ1//zTNbcvOfg5538GdBMCUAv7egGeDd7z8Ej8gm0+Tiflozfh8oBMc1Ri6 ORXw6dVAgGeYQAMX6D22oW7IXTSmlMaQGzOttFFhd8hKqKQarh+zRtcdRgqu1/m9a74DbT3G3/LN /WfGdpzhA7rvEG2kA93JKw147N1yLVWWAej1FJt/Ch3fWnlMoe63ld1zAuqUNBTnBhMo8IFVvgZv NZwAazKlbzNSDKw6hPG66mbcvqIZlbqOg43KjB4FzSmU1aaWwvuhkpoCJ5J8UEpL8ZbDm8spr3jX eNf0nrDGW+6dAszEBuQcGiauqU4HCg6pAjqhh+CN0er4zuLE6uru8Jx0+hy4BS5fUw1PmNbxBMjl U+ltcFFGCihTJjiwalBVQ11pfEO0tBpGAdj39MCqhtPAudXVcFVmJ6aA8dKptg6cswDnzCRoz449 BWyXOnhE9Zo19JlDqvy+htNr1sSvofMtVm/GqOuJaMeJZkQvoSRvxnUD4V7I/L54eQx8fh+gVU1p 2g1Y+i5Hgc3+7ymc24k33JkH2ObKFM7/D1G44KdQuPtPonBhJ6b3UbgIcC6kFO7xf0fhnvdRuPjf UzjaiTcg+QBgG5UpXPIfonCvn0Lh0p9E4bJOTO+jcDngXEYpXPF/R+HK+yjc+99TuE8n3oBkX8C2 j0zhfv8hCvf/KRQe8JMo/GAnpvdReCDg/CCl8KD/OwoPvo/CQ/49hR/qxBuQHArYPiRTeNh/iMLD fwqFq34Shas7Mb2PwiMA52pK4Yc7KRyNb0D3yuG6LmIX/ccF88h7SA6WEmdAJaQAHOeraDDke8le NBTyg+yjKApwtiPPhLwvAL32K3Y/clIQPegLbhjaDP7aCIBXAXZA+0Vwzv1wfjtcv53fizbzBWgg tDXBuTHsV8gn/AKiJI+iwQC1cG0h5PkAlQA9AJbj8xTar0FbHZRXwzOW0/MA9NpagCLAczW0U3ys UK+DsgreYYDcDOCErt2NSakRj1dB3Yt+RUMEcqgAsvsOBrGIgzM8xLZE0PyxQwneEwSmADQAWoA4 AB3Sg88XO4zIBB6lBbwiG5ywyycdKF5+PwJb/H8ebvDyvODPJECTH/zOAAqiEPh9EbDYk8GTTAUv Nh0s+EzwDLLhGhrd+//jyOnoRjfo00jw3vaDl94djLpvyBbyJfMsc5pVssO4NK6RL+Ff4T/hbwm5 QoPwkThB/FIxQ5mvnKTKUrWqJ6lvah7SurVvxVniSuOWxf1Fp9Ot1d3Uj9G/byg3rDXOML5uspj2 m0eY/2oZDG8k4Dci9hLEGxgY2+JYLFFMB4MPQNQ1I3QJgNahzHzSjFgABGXhE3QC7kBoWPIJeAoH eUZmtt6nDwGUsOuaW7/kTt3u1cz2vwNxKbhiMDOHjOp4TyBqIvzzLINQhGEjgl1USL6TlRAmGnCr f8uHbai4qK0oMwMzfvlHRrkXeXa4Fnm4U21NpB8F4NS90iVch64B36VGLcivVU4QlTqr1SF0U05A oj1u/ERb8gDdrf5FbS0DyiaWfo2K+7dcacnMsObm5eZ0C4b8OdlmEy/sLXPGYTLzwzG1l9VDU5ME lXDt7QVNZjoYGA3Fn5G+ZDPQxhtVonQGOzhkZyFCV3LYd0LG97rua5TeHx5r9Jl9Q/H3kpJspjEZ DL4rkvFjUDBqxEmMkgPk8AR6/wQfRY52tq0TtcyMvGyz/+Dly9cg0EPpFW3/mHVyW2BOOdGcqLWe w+WiOSeOc+YIGkM+M8uWr3JXuHS1Z21XWtpaUHFLMWDRa1G0G4rXBHHAEVQEuKBFawvDHDSEcbwI JR0PJavaHMZGAold6QwjPQsJjU1hmsjHYxC6tlr0OoH4vKGgvluewWfI1Xcj/gSiN1kt2Ux0yZjh y6QvJWnZ1OJanLNm58IDL2xIr3yN23LjkPSu9MmvpL98fhIX3jqIy2/f+CcefAsXSh9In/5+xTu0 bxgiEoh8wD0DssR/SMTNODuqZllBzQqbOKSsUNBOnf2grQAVF9/6DZA2pyfOy9b79Wff3Bpcd5r5 fo2xeuftR5jv5WdFgX/d3PMgMXZGB+Sy5exwbrrrEfdi93JcT8QkcYR9un2JfYnziJ1DCTiOdWrt PsFphzg054mLSzAqc4yc1zPfl6D2/VzIt8xK0IbiHvPkJyRW+GPEvdWi+67lusyTxS16Q0G6wVqA ITcUFOghQTUy2Z2sXR3QB1UGbRgpTAIQl9XolGEsmiEB+up0Mn2BtLmGYhzjQX+CwAt+KPuyDGaT wMdhHk4AI/VZ8evTj3UbvGnp8Yoge4wpmY/D33+1qPzI6nH5ExyMtjVyHBtmz+qbM2T60g1r+644 WXtJ+v7l/YsrJvbLzRw+ba9Ml0zgHwe3FSTl2aint3pI6sTI+NT5kfmp/KYg7ismK23JJg3zQ6Yp RwNBBX/UpM/R/VyjyYzPSeSEnEyNbVOoVN8MqwFxyvy0WcQT8T7GhEh2RdY9VGm5FWM8IMqttq91 LTpKH0obmSS56Rn2IFJwQVcgIcgjJoxYRswAcjj9njByBGxhzGIByJUOidsXDzQLQtLJjLoiyo2P PQY0wzUsycm2AO9l0cnrT+CFHDfOzpKncoyM3SgZIXIDFHRjswn5seXG6+pw+bF1+4/sMASMzqBl 4gNzt0xsKgtyjdFHsPn3f61IKZ/zc+nv/wxh64Uni+dsWfhsLcYvMMSb//T0eQtLFr84+8Kbx5cP znZ5DtX9RpKArMC7fYHf0rk6mJdDormcyk7yVd3VBZo+mqFkGDuOHBOUSzRNmnMahiiwRtsdxbEK NdHAcs8srZiv2K/VV+hkCgJb3QBKUSYHaQeMhIGRarCZJ9ADYAuDMTfPl8Oml92oGp7qSjtfenP1 5tabXN3zvaSm0ye3jv8Eb8Wb/nLgCCw/oZL2qzDW20EfW0EvvhOtGIaHK0bEVRsn4ImK6XFTjQsC it66n9lr/XMDj4aWZC7JWmWv99aHVqWtytxi11SIWWJASwJZqhy9PoXLcXPWnBQNyQfndeUxbX5k VrqYHw/lI6b89G4V2fcwwI/j31LQMSnkoc9JSnN6DRZGY0k1hZE6WRvGSoMYRrwLEtZDwticZg0j TRIkgpMLY8YLSefIy6P+GK4BOdQx3GaTJdtwTxmFgjndcrM7BhwYw2wC8ZQI5/LIKyvrnnh83qZJ q17du+Kxlzdul44kPXjzg9/+qTQ4sDp7tHTzsvSHJYuZ6IqRA1euHDFxblth/conn97w+OyXyYvJ A+te/Prj9SuHpKdGcia8eEr64auPfn48k8rjr2Dwm1ifrCezog4uSWCSEC8oFSDWOTyBRaDFJvgW LokJdhjSDtEOakdH9QNIdz3AV5fhYH3X2jbIch4jZ3sLe4AF0qBp0ehwZjJTz4C6MTAMIV4DGGk8 lFmG9Ro4jmd4liCG4zDmOSWDMEs40Ekij+yCuMo3+oj87iLd99Yi4CzUo7hYD7Iqne1vq9cl6+qT IYU/UKw1RmxWYDN2sutbS5nX78wio/DbTdJmaVMTfgd4/EecZkRLqlAVM4VZxbAUK8JQfBiW4sNz FEOMOrDCgCCmWPHIIWKWY8i9WFkBLYpVD+D3Dqzqdbb7sVLgHPjD7IE7s5iTrWXsenxUymvC0/DU JimXjsEX7R8IhdwN4PM+6O1odW5ut8py39DKKYrJoWk9J5cs7HHB/laZyp5sLwj3yGfytXk+Xiww K0Ml5aoKfRUaylT5JlkuaC5or5qumq8+oFUp7cqgcpiSlZRYmZoGsSYlQ8QcsRk/fdjh70Mgb0yN FEJ2xMhU9CnvBaWovo9CyaWmudLys7icYFYwLv8UfgomXjGkcULWivSWT1tgXqe3pBsKPk37FAai uO2KoaC45crZFt2VoraztPv1nO40rpkDMx7V1CAQaIRyeJYhB+JHeh2IMi8oYBBiCZTN87RYLiDg d2teNqMF+RaThMjnFXiqk31ZiXlWnvWzXwzpPXfXsAfqN7dt/vLIJ7fwNjzh3V9J3+4ZP4plcl4a 9rPnMLdp0go2a8OKOG2ef+4R6XXpL9Lyi/tfOY3H78TuBSUjpK1XmZPjpf9eMW4yLvx5axXmLsNi Qfl1qWmv9Lfr0qnRvVQ2zaOjG9eexxm1Q3ZLfbJ72lIjfzl9Eys+OyV9eXvvxanVIwbCMj6DNoMH xYLNpwQvIIwej+aP0IzQTyPTNNP0i8kCn9BbU6knLtETx3qMboRCottKVO6QyGbGT43L9DuSFOZA 2GKPJDXj0Yd9tZNi/N0f5pbu+/6y8mkrBlqnt/2odAw2ByfaA3xQsLHJmHOIySBWqOp9DORJDZY1 Rijo9+nvKTKU2rLmkAWJwEcwObus/JH5JY9Lz+MDxwZkPtVvqTT/TbIALMXog5H+c/LHV6+QPmvb wAz05z31dJZTKmgbMa3X6Be7e9rucMatDy94sjo9lJw7Zs+6R/cD345ov8bNAb51ITc6FC2M5zbj TRzjwR72cVzPrTZyQ0RmpUuvN/PdXYy6u1nhJm63nckkhbpMvcOryLTbPd4dvmkxAvRv6eg+9Bxm Exh+UKAyBqy/7shpDRiD2kB8UGVRZCGNSZeFDfo4neCEGoeYLIwJyyht6iwUZ4BEdPBZoIYhocoW 64qo1o2l9MRjoHpFbPWnAQcivc5AVW5eNigo2TKkjOpn3bib/ozvXOPH0nd/+/aTR3u4zzieOShd bUev3dh/AleEuRvStZPrdkrvSeckSfrVnur1N58/te03eD8uu/Ql6FSCXgU+GQ98ogE/cXLUU6/f ZCBZosodR5DbKoqZRodDE9Da7Y4PfbWr71rOlAVgahW3yR0PYos+YA7yAiewAiMQgeOVOhF6a4FE YVBlYcEEulE2c5NovwK0J9QO0xHgBpkF9CaBwNBfmvjAvD6FjriP/ya9cIEMwem7NlZtk1a2Hdxr Ds2qfnJIBdbjtDtbOOPVM9LlP52SGmW7YAf0IR36oELFUZ+ocIP8ZjFRCiIrBHjOocHKgArZ1WrN i77a2dAH3YBbRTFOphmYl8VFBemy32OkbhS1d316/46LpPXixTb2Ivg+O8jo273IwbZB8vsugj56 Bt7HICvd8XECxDZCacmwvkvdNZKekQnP8V+8CHfe7gWN/vaPmZlwvRGVRBMUvJ2frFrMbybcQhYr FKyBaJ5hFfoAcpiVAcFuMjfjQYd9aymi1CeTGY76GMBpspkCZpYvIdgDgw8FkgioqM9mZuZNkr58 9U8np895IdN9Dh89Mfn1wzemTl24aGavE8zvqO20HWg0QKbRiehingtwIbFSqBIWcKuYLUwzLCf+ UVDtZHaCWuPCYkSxW/ED4WBARU7BXCFUv8CeCQUhYYYJGFhWwXNcwACnOBaW6egqncArRI6Ao8xQ yvPidP5n/E3Qmp3U1wADjeqUIvYBuq9rbEB6oH2RbNVbC8T6/mnJ3FLdufo0WzKr6zt44eJzOrFI BH8UzZ1Tg+fUAFmxT4F9WND7t58h72Jj2/NkntTWJv35DIxSN/JuW0PrBvLFF9RglPvM9oU+cygz akSEIW6WExmHgEkAnEke9oAMAdH2I1KAE2AELFFMjQY9eAPbz5ObrYNgGP9+EJ4HMpW3yuP4TrS6 FPdlCI8VjAXbmauYM2InY1LFq4fjKuYK/j1zRfV7tRLooSkjKwk7iGwmJKIMa/KV+ZoKMpzUEiEw QaMkjAEIplIbGF40gznDUhd3W1Sj9DAqvk2NSZvGY4AzR43IbqLMC341YHjdfqugAP5s16lAjvnY ViAlUBK2cRzSqJvx3iYCI6GCQiMhTD3XP21xG7v0bD0Xy4GmNXPn4Lk1c4yUosDy3XJzsJ+qN7Pe vxm78E78MnacYqWac9II7g3u1J0ge+12L2Z86qUFdyLs1dTcT7u1Pg90hj1l7R9wN0HGxsnxpTXR lHoIeJ3Hb5IL4kUl30s0d49j4rsLCidxOlWGTMbhtmWq7C73R13EaqdQlcVKFnJQb7rDl86ivnQW WFy2LOpLZ1FfOov60lngS8dngS8NiSxHaUKPLq60DlxpZMjRgWJHepPBx7DbTj6z66y0UTpw5sCz b8A2hvg/S3/783Xp839gs5a7cftN6ZJ07Fo7+vwj3AcnXcG62y/hRd/BloIi6bz03i3pEDcK5Cds C+IWAk8oIFb2bNQgaHrjSq4aV3FTuQmmhZxoOQmbGewoHjujJX6fNzjGMMcw38QY3B6T08z43BYT GzQkBtxIoYgX3CoSdMaL3oDZE7AwmXFT4x0RMRgIKe3hyIe+jfcr4VsQU7kCYhimUBtQjnoy+ph7 TP3jGjD4ZHsTU7dNVruML4vqWuqkeTCoW6sZdEs6DsqNfqZi7ctze0ySHOfJ7t0z35s5bthwTmBU hrRbSjWrFiYULJYKzzPO2c88X+CGUMuOzFFty3dn++fWnXsoUm7yGYuGffd0ZnzbGqDJmPYP2O+B H2i0UIqOisSF/MFgrjbHVxEcF1ysXZComC7atNYAqdZO0e5NYJTa7gmJCUqGddpWmtLTk53dTQzb PVmRQZRaUZ+Y4AlnZOhtAWtvMRB2ZHkC+t4okG7PzHrRN61DJYFB8qNiNugLCijco6Cp3ZfWlk2t PtDU/cNpeg8SSZAEUwM8xGuYFIhwpqbJGZcEdovL6ElG8WZbMrbbcCqbjBQhVTIOqHAalIUIJG6D ExotkMhcp9PJGpzyXcx3plYP9Z5lx5n6yqGgTOqcbonZWazZT6mewJvBfpTHwmxi/RDwycPYLXQb f3v2yMa+/V46/+agtdhw54+418m4zIevNWwdUXjptxsHrZWe/7P0l23bGNIfX1s64BlvzxcXZmcF UlNyRh57S/rDd7XFjz47bkaWNyM9oXDy2Vvvr33yLyyEizHEdhHVZhA77BZ1YN6NBMKK1IlCdwgT 4Ng7vF1cC+KQxu5uAT/duutHUZkIvouZiglwjC9K+rclPXfq4O2/c1oIttFnB2DH5Rx4tho2/G0U FXihsEixUFWPV7JcBe5LSplKtr9Yolwt1isvkPPMeeGCSl2lmixMUa0mK5mVwmrVc2QTs1HYqtpD djKvCntVcaBelKLKLlqUwwVeJbJK0jNcFuYCPC+ggFqtUrCYURGG49UcIqJSxQiiFjoD5sfKqMiw t5REcatOhfBKtV2zDroFOueWrX9bQYEDoCOzy10ERQTS0yorIlBCLfVpLSBGmxSwB0UJO8aiceBr EXCrWF5QiAolOClbo0pQgwycRmpV/VKdSJUWlyxS7SXKGixW6Tto0WHw08Cd2XoUHgfinZEfqFCI seeBm0ngCaLutAw6bnGbTTwLXiMUlopngepza2rmgKw2KnA2/GG/AqR0G3iQ/T7C/bD5mrTssnRA 2ndZqgMRPZTdR+F2L/bMnZ4wGgwa3P6JvDsoDvZ9FaFPo/lJGVipAz3lDGVX6qYqpumEAtGgVjDx WUKiwqVTuwqTSVqk8FghKcxKChh0Aic6QwlWZzNeE/VbXR4h5EpTEVeOqkgoKnKahEjS7kRHz/iI s09cKN/eo+freDMw2nG8CXUYMLGpeb3tbKd4L24Bs5lOSSqk0lrSWmjcCmSXPDnDuXnmBITtAZwb 50M2d7wPWbwmH/YloDziQw6X1QeMCAmdd2A00ynXEahKlO2hHliL5XCe+b5YX0+IWYH408vuW56Z +nWhYKjDvcvNM2Lt3AGjqzf5pmTNHJc5BDf1NKufWPyLQp9yN/ePl0/VzrcG1G59UkqwJsmiyPvt ko2nTmxe896IlN4715udvFbjTJ+MZ4gpttSRQ/olDXlrW2XllrbNzgSGWaHmS/zRymlHVm18xYiv U5u7tv0zNsCdgdUaN5odTdsp7HJedTIJYpybcAhZXZygV7pdKpUpJDq8jjRdGo4gPbgh9b5TNXct qOvXOw1DsA31EA+VqWczWHilhTcFsUEJiVmwBrFR4Q4CscDLoBIJDBtKCoOeRm2AAmZ/YmdwB4J8 tQcLXxlz4Yfvry1+KKtgJ5m0fv0vfnY8WHGGO9P25/6DpBbpliQ1FPr7r1568409nx29vHnUIZj/ BMGOOOYSOwDRNaZd0fRddrzFtlvca2P6iPptJoYx8S6HoHGBhSTEx1t1IQOGkKbe4VKGrHYnbBMW DvvmLv3R5C3qD1Et6lzdI8TlDnaDYE9AbVYGkdaog15S/woiCdS/8sn+lcqiCYJ/BYnCxgepf+X7 F/6VHNhElph3JYAcpk59XjZlBwI2QrZAPvzKelA3d9n+Phmrnpn9hP2g+68n37+NDVec7ICGq+Of 2D3zxR2frF7wwTmc/TVs5+sOIgjlt19jWmBcVciFFkSz8rQV2uHaXeyeeC4gmkicS4dEl0swKonL quLSjGm6iN7g8KhCDrvbU++bW3Jv99uuQ9y7hbqYnWPrsDkVSoSxTQV9c0KC7CSIlPFiEDoojy70 yhCLTsjKBVYSrNSbyaHdQjndDNnfP7Nj6Y6di1ftwWuGZPQ48FLx/lmHpdvffoZH37x68Z03L71N 8rq5+xLX7Z4bx1fh1Nt/wsNBhlTCiqcDdhg66aogVkcXbRafc+zyMJyWxHEms9YQZzZF1VGTGHHg vqqjzHn8FnM+/iPxY8WHno/8N603/arz+vMGMlLkfIlxWy2uxAJeECw+l1NQuiyqgLDZuct5DOYA G7DEBZycXakW9LAW4ApxjlBimhCy24OhK76dMeYH61dm/Stt8joA2DrAJjWdfAJ6S46Fy9xSjvwg ZmH7JuZY3gPhHYPOqDPpWF4dSIhPDCIvcgWx26WwCkGkMmuDEDb2O3xwioNEtAFfwUoCEJoKGVnW yPImKTnpMfBG0ByIH1E7ymL2xSLilIEggMzLDjvKlk0riJdj0vRhfq5B1/ot9/TmXzyUYTokPJg5 eNEDgy9If8K2L7FHFe5zYMluDvvZiulDB83o89LL52pyKwrXpw106kDa85jgEik4v/zxw2sw/UgC xqSHVMjchDHxyOuyx6L9c029xd6KKrFasUq9J363a09oZ/LxeBVoQktCRHtWmQCim+UjLrvS4FLG pQlpaZyTSbOkpUY4R4ZaG9L0DIac9vSMexjxVksBpXTb9e9APnfMROBImbwxcZPiDzvcKn1iQBf0 u4NBFHZAoldpfShOq9YEXAlBHIqPwHxUg/HdIbA77CNZZlMOzckG55+6tKHYKkNeriyVE/UwDWl4 rmN2gg2FyZJR2Tk7i2ZLFw98oz2mCfV44r1okMndsvQ16Q4WTuDSV37+Rnlgw5IzD6ZIl9mSnv5e 9a1Z79Ze2/ZqZajomWGfDh74D3BsNDhN2nG6cfTWI6cOjl9OUmX7ZTkQlc5dC6wtpAB3ilbBKobY kHG+MF8UjRpihIVJvYsXzGqlJqJ02LA5gix2qw2+0jjsGxebu9RO6hDLRfLMLcB0QUYWuhDviCkg 8LRitp/ev7wpmj388f8aknrcnVk/+2gTCNlPBvkKXq7+Zdsg8nJtXtXWD9voRzAgWwA/XChrdAHl Rp3CDRaMLp6RY+DAHxGBoVHwvT9icrat6Gyn/QaRcNmllePgy4/BwSbd+ZA79S59dvs1aSDOl5+t pwGMIRDRoCbdMPieBdP1ZroODbniEkQ4tHCBPv0EcCBdf87IxLCYi3tiCELQUYRYaQjnNzVJLy3K bAoWN2hcHrbl0g/dWP9I9uidvPndxxF6Izy8Duj9T3inCrTFhGqCu4vYTmDyWPnh3GRuEb9QqOeO MxeZa7B6Gws+MGQ5eZa8Am58gQHCJhADZ/mZBhgpOQDBxeIPjBJsXIaHCIQSQg8KoowglV2tafSN O44tMYuEDlIRjT90hB/kmDgGa4SGH8CA+zVL4w81EIg43RF9gNWQOWCAQfABLDA/DT7UHcC//Vqa hA99LTVuPsCdat2Hz0uz2sYR5xrpEbl/q6GTPWSaRqLAOR1r0CSCGFiFvmeYflysiA3Q6qYmOWpE aQRjzgfYCtiHsSJaKIiClo+zilatNS4khkA8VtqHqSar1P6A0uHy25WEtQZ8LqtLA+YxH+8MMEZl GMxhfQQ+WsGNjgj9VgeW0nFaACakPRRuxpp7Gfe67lbLrbuL4mANQyCkBdYU7y64xrjY3MHF1rvW FDCzrGpo/KCTqxuj3arn1A1ISSx6aeJHA5JOTu8/7bljjsjsSbua2PQtDyb2KE4sHzZk+0Pr2vLI zekD1+1sW09Ozszq+8v3KLfLvM60gGyzgzUxKpp5jD/PE5Y38SFTLT9P4ExqYrLpwEpCvE2ldAgO B1JHFA4nTrNF7MgeD6bqfVMypi5iEgz61QKuYce0hNWYbPM9XaE9APkNQX69Hy/f12/vlOsDU465 MpZFI33yU+Ob8C7Af9TgF4a/ROfnuKIJGktJzpypbe8BsjAjCmHd1wc2kBpiqXb0dDR7i7hJ95zl VXa3uFO3x9IsXhCvsje0/2VSdxd5l01Quwwqu2C3m0kozhGvCJntDljrU4Al1KHpYk5tp+yVVVoK bCsKqowK0Ep6EsSCFUqcBkpKkzoI8xUS0QKGD6OFRNZbNKHRkESDHAigXies6EFImfjAKpCNnc9X ZPQ78eqmTS/Dxyqt0j8+lVqx4Y/8PBy3c9OoZ1sb911nrknfgOnXJr2Gk1vBwI5Se6dWGsoGoOta 2AEwL5qyR9xlJWHR69RreZdZiOO1LqcqQUtCNkeiEqxYXyQhzu5P/JdWrGzq0DV9uY9OSzziHEE2 iOKhY5wFEmzXBhFjlfskd4vastRyjY0ZdaSzISQq8yd8QEBFERi3ej95a1eg/MTJsgCkUtrB3OjD PzsqHZu3ddHgjMKmRb97v27koZMTti4ZvpM5tK53uEj6L+jjS5tG57h7t31KebFIGgq8WAF99KLF 0ex8W6WtyrYb7+J2O/mwaLAyKpdXMPKMy6GyaAUw6iwRs8kBOxlcdl/CPboU1AKN24FR19HVjp7G e9Qa+DgsSOKhf2oPJMjJgNnhVnVYdTHnxkDX32NhBBo26NCbfr1s2dHFgX+Gyhpfrwgl926evws/ 9XBW2r4jqS8s2Cf9ve0iXjZqV8PYzU/WvPDOFdKzV2L5xtsQ+agcitWwuIRxn7vyijwD/dSjB6PB EBPU5DEVLKsVdUSr0CvUIZFON71SdBgxtVuR3WBsxmUgQJZ1eiRy+LS4f/FZus4WW5PukBp0ikG4 KQ3MUB6m1up95lemczaXLl636hkQCcdztxHmDYYcnNu2hdIc1tSZo2xfut8Mp0Wfylds4TYZnjNt MW9J4sOJgVCur9xXkVgRGpY4PDQpcXJwkXqRZpG21j8vcV5gXnCne3eKkQFzjktl04wQVY+3Om3m VFNaOE41FaJpuQESSNAo2WSj7S2nyyiwrrStyap0QaHVEQGl+9IdHpvFFrL2DAeFUNiRqfWEdD1R KM2ekdnYaYOCqIzZRgU6KNHuFqRTJzYWdYJ1IVl0xsJN/XAqCZohzOTTenxIAZ8jYog0+RCsY/uw ywDn4k02H/bGJfiQL0GrEUNKHw4GFEqIPPngG1RI3Hqnj0abYl5vbJFIXimSp8LdCQ4LRkY53nRv uEm2OoT/GW+K6epvxUDp7glbeoQefWr1A/N+f/zv03uRvVyw53OTppaFByw4UzL148++PS/gY3jg iIzhwx8uSwTrPSGp92NbXl83YkqPrIoB0fIku9GVnlL27FOXPn6R/AB6y9r+LVFwI0AKDj6iSVOe 1sI+o+JogLUUWBleq9Q7QC3Bl1kRZNaa4xgPrGy3WmCFqdU3ucMDbKspOEsDmrqYAZNOlVFbUYuu 7bqsJOl6Pp3v4LHJfnwwB3yc7N1H9+0LmjM1bpOnV2jZiPXruRHSBxvayvKNKkzWKcTHJpNzG4DX Capr/4r5DOQW3Rs5Ktq92XTBRBRG0WQ32k1hfgFzFYwKxGmViNcoOZDRNsFmA7cyTRlRqxwOHKHI vn/X0pJXaOjU7rSRYTUJypT1cQ2OIQozlzpiebJvAPsn9AGc78h44vXSQNNe4u82ecONIan4IAur qYO7jdk94nmivXP5lz2SHnpu8GrykYPaAhDAY/7EpsOOURJNK8HnIPA0GU0hU5jJfD27ituFdhMR vrgjZWwfbiW7mjvPXuDE3uFHwwJEq0ClTKbzFIJaze2zm8AZ8rLN+IljDDPTAKsEsOTwRNTNgzUF b+J4GtbiYLcBg8DEUop0sA6SE5haoMsP44O83T6AxtE+/7ytM3omB886dqEIYEbpBlzvL8SyZAiB RQMkQrcuoIiB58EXu+/hsCZ6kEM/PleOzXV5MifokuEPomHgdsGShRwIw59gN04+J804Lc1n01u3 MFPuXAYKYboHltsBJTX2RpdVsHsVMPy4XOitqmfWiCuUb5OzzFvCRfEt5UWVapIwTZyonKqqFRaJ tcpFqhXCGpWSXksqmAVoIccMD1vC4F2zhbiQfQo/xfL3hh15Oeyo7Ag7boOo41mIOp6FoOM2CDpS moOhGQs6xmKOkHZ27W7IsYZSSM0BbQT4ctIAkU0utl3knhjkk1EjjUEKPMvRCzvjkE9GtTQOqVJD t+VbMbVi63VLz9o4asbSgKRcgBjl2c4zdB/KnDlzwKqNJ9nxNKioArv26m8vv/3+75ukiyev/e6k 9A6QtInp13qcqbhzmenR+iYQFOaOWeot+53Uwnk7+sga8yrbLhtD7fZ8Q6WhyjBZWMAsENaatsDu 6y3mzZbN1t1ot0VXifqaK6wXzWwp9xZH6rmdaCfVoVYuMczZzFYL+DJmtSrOJWqpQWSJB6ajPGE1 2w6qn7KAXXQlxsHAev2v22K07CBkzDyCuG6WPd0GqyFFVPcA6aIGM2yAtsw0WK022LZDmdtWDzwJ pKGZCLm8DWQO3eyEs3lYwySyUJS3t+Xmwc5HoAzD+M4HnxhXsr1uezDiTk/SZaXruJ5aad67sIjC pk+W1kvfvCZNauLFVzS8zyY+m8gOAFZ8nNqDsNebWci9D3ImHvz0sdHc+Bt2JLh4pYvBcaYCl0XD e/RKH/Q13h2xebQafcRqEAxxWo+WaFtNdq/vfd/kjqhQp0j8EORih19H105BLsL2FlA4ODPDQF3M Tj1LpST8crJzArDfVgDxc8Rf3KRPtDrtqsHexqbGjRuJsQkOrqTbSAKOFR762rrWCcz2dbs97757 /s6HsqyEBL5+ngjf6P6rA7YGQT85WPmje8/v7jmnMUAX9NgH+8hju8jv3T+ehXLg/zXkoe6oFJWh cvk74T7yt8D94TvaB+XvlQfDN8gPwZfBw9BwVIWq0QjYl31aRoDObiyXeHgneuDB4Q/0G5BcOXFG 7cR5U8ePhZZYK73kc4BvAFrhpBoAxgOnABQB9AMYCTADYAnAWoDtAPsBXgd4F+ATgG8AWoHx1QBO gBSAIoB+ACMBZgAsAVgLsB1gP8DrAO8CfALwDUArEEkN4ARIASgC6AcwEmAGwBKAtQDbAfYDvA7w LsAnAN8AtIJPqwZwAqS0dxzQL9RZxsjbpZ7QpZ7SpU6jHvfen9alntGlDhvx7rs+q0udfhFw7/Py utTzu9S7d6kXdan37FKPdqmXdKn36lIv7VKv7FIHh+0+fKkVfC/+sNf0vnq/LvX+XeoPdqkP7lIf 0qX+UJf68C51ysn34jOuS318l/qELnV5vt7DH5O7tE/pUp/apT6tS316l/qMLvWZXeo0CnIv/rO6 1Gd3qc/pUp/bpf5ol/q8LvX5Xeq1XeoLutQX3V+/I0uN/wcujYPNCmVuZHN0cmVhbQplbmRvYmoK NDMgMCBvYmoKMTIzNTcKZW5kb2JqCjggMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1Ry dWVUeXBlIC9CYXNlRm9udCAvSUxLVklCK01vbmFjbyAvRm9udERlc2NyaXB0b3IKNDQgMCBSIC9F bmNvZGluZyAvTWFjUm9tYW5FbmNvZGluZyAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAxMjIgL1dp ZHRocyBbIDYwMAo2MDAgNjAwIDAgMCAwIDYwMCA2MDAgNjAwIDYwMCAwIDYwMCA2MDAgNjAwIDYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAKNjAwIDYwMCA2MDAgNjAwIDYwMCAwIDYwMCA2 MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMAo2MDAgNjAwIDYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgMCA2MDAgMCA2MDAgNjAw IDYwMCAwCjYwMCAwIDYwMCAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMAo2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAw IDYwMCA2MDAgXSA+PgplbmRvYmoKNDQgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9G b250TmFtZSAvSUxLVklCK01vbmFjbyAvRmxhZ3MgMzIgL0ZvbnRCQm94IFstNjEwIC00MjEgODA0 IDEyMjNdCi9JdGFsaWNBbmdsZSAwIC9Bc2NlbnQgMTAwMCAvRGVzY2VudCAtMjUwIC9DYXBIZWln aHQgNzgwIC9TdGVtViA5OCAvTGVhZGluZwo4MyAvWEhlaWdodCA1NjEgL1N0ZW1IIDc2IC9NYXhX aWR0aCA2MDYgL0ZvbnRGaWxlMiA0NSAwIFIgPj4KZW5kb2JqCjQ1IDAgb2JqCjw8IC9MZW5ndGgg NDYgMCBSIC9MZW5ndGgxIDI0NTUyIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AZW8 B2BUVb4/fs7td+qdlmlJZiaTAiQhgdACIRlKEooU6bBGauhIj4KIoCIacGGliAKiUqS5hoAYiuIi slJcZe2Au/oIFhTFXUSBzOT3OXcShLx97/9/k3zvveeeW0759u/33Dmz5pYTM1lEeNJ/xOgZ44n+ G76AEGnq2GmjZ8TL2hXs/za2Yk4wXpbWEcJfGz9jwrR42bCSENEzYeq8hvvtEwkpyZpYPnpcvJ7U Yd9uIk7Ey7QN9qkTp815IF62bieE9pg6fWxDve0tnN82bfQDDe8n51EO3jd6Wnn8+uH3sPKM6bPn xMvDVmP/7oxZ5Q3X02FoTyGhODuAzCAm0peIhCMa/goIkb9FHY9aVs8RcuH0o86R1oJfqE3RH3fv f72ziB2c2JO74Gag7iVpuvouiqp+PavAfQqJEbJLOHszEJ0jTb9Vw2rZb0ANaZ0ZCeX0fbjvqy1f nSDkTMlZkzvl/Snvr7kyRcrpnNv5/c4fdL7SWayhk6uz2wXeoL/QayREAvQqra1OCfTv4qez8dAr +nYUnUNmABYBvgQIJIjtSsAVACYO2yoAR3+OuJXWgbsVV8BszAvIUl5AVVoFeK5VoIa+vT/VG3gL UENzqvXdUbbrYqZH6CGyGO9+gx5SKPaHG8qHqjsuDhymB+kBjGKAHqgOtMXNNdXpi7F7vbpjB1Tu RwW757XqQDcU99J9+rX7qlNb4qI91anslqp9GYsDSuQQ3YahUeNdrqEtqrOzA12MNIWMoWl4RKhh n0zCAt0fuBgIBy50rBFoxB/4Mtwr8CauPhAuCtSE2wW24nhL9q7A5gGorw68NEbfvRjfbQrXUJx8 PoyT+wPrw8WBpfHDJeFOgfvi14yN7wbG7+8Rry8Nlwa6hWsU3NyVnakONB9TQ9OqA83iV6fHT6ax XcQYSAl3C4QASXq5U2CwR/WoK++XV46SV/aTV0bklYXyylbyylx5Zaa8soW8Mll2KnZFUyyKSTEo iiIpgsIpRHHW1H8ZyWRo5ZQ0tpMEthX0Yw0IShmWYosZVjjSi1Q7g87iUd09Bwil9UueSqgo8hTZ C235Jd3/w2aUfnJU98zff57fD2nv/vMOY/CnEhlb83458J0c6CWzC3oPRM1KvWYlq1n5nbwyXuNJ qlrbe+Cwqp1Jw6tas4P6pOG9q54fGLxn2AG6nW4r7n6Avsx2w4cd4LfQ7cUD2Hl+S/fhty7Dy7bj MpLNduyyTSTALiMBfhO7DEOsP46k0pfZdXlsh+u8EZKqX5fqjdx23Z4xgeLuewLY4Bp3hIzRrxnj jl+j6M/aMyAb12Rjg2taLyID9GsGtF6kN2s0e92ecBiXdMQGl9AzJKxfEqZn9Ffx8cfo12TEr7E8 0XiN5Yn/dk3+f7zm97H/H4/Ku+7t/NCUNcXl4eJR4eJywKiqZRUTPVWLxgSDe6Y8xCqCVXz6qDFj J7L96PKqh8Ll3aumhLsH93TW72tSvYZVdw5330PWFA8atmdNpLx7dedI5+Lw6O7D97bs33fCHe96 8ta7+vb/D+/qzx7Wl72rpX5fk3dNYNUt2bsmsHdNYO9qGWmpv6t40sCu/1O3Z8+ZO3sOKmfPng3p 05cEQAw5gJZCGQkQUn8G8BXbx/rWfyVB8sSWgyKmETd5E9TBIP5bTw7ir5QswN96chLA/g6SvXQy PVpfw84IheRP5De6F8ccqaivJz3IPlyzCyy4JVlIncRKjtIAzmzgApAZIbKQrKc96Z5Yd2IkHchQ zlw/kxSSE+QE/zfUlpGHyFNkDdlIdlMbjdASupIer78L7zxMZ9Izwsn6HXhPgOSgVc/qbTmKa/rR mRAjAbyxF57wDK3h5wjL68fWP1JfWf8BcaKmH85PRi/wdvztIx+SzzkDd5LfzJ+MvRa7UD+wfnb9 wnpwD/aHPszR27Ea79hM9uujcIL8F/q5jv7Ml/O7hBJhQH12/QS8oR7cJEiy0YdSMpgMIbPIXDIf 9x0k58gF8hu5QQM0g7ak3ehgOh+9+ZQLcF24PnwGX8JX8yeFgJAjlAsPStOiX8Zm11vqqyBf89CC QaScTEcrFpKHMcJsRA/i/QSj4qYt8KxhdDPdQb/jCOfmsrhcrifXlyvnpnHXeSc/iB/MjxaWy9Wx 5rGNsd/q5frS+mfrX9S5n4CRUoiXJJMM0pzkknakCG/rp7d9JBlLxpOp6H0FWUJWk3Xox2H8/QV/ p/D3HvkAvbpC/oV+XUfPFLQm3rt26N9QOpbOpYtoNT1E/0rP0I/pBfod/Y3rza3jdnGHuSu8wk/l 5/DL+V38Sf5z/iv8/cbXYQQCQoYwRLy7Toyti70b+6n+L5i1ZmjbBDKNPEZWkR2YsYPkHXKcnCF/ xzxcQhuukF8oT61UQxs8aEUebUM74K+I9qJD6HA6kU5DaxbQxXQ1XY82VdOTaNPPnMh5uF7ccm41 t5M7y32FNmXwRZiLErRrM38TbSnEXxHmZJrwmFApbBFOinPEHyRNfkz+CrRxkrxBjjYSiL7fRTbL R9HOjZilaozQLvIcMOCQPmNTodkcJ5fRvgCdRRNpCdeOnKNBch/no8voMdqXS+H0eaQP8AoohP1O khr6HlcmbiA3uGm0H8cBv89wyXjSEmDw5pvf1K3nU+vOxR7jH6nrH10vKsC/eWQZ+YJ/WgiQ3eQR jFwLQiKtW+XmtMzOymzRvFlGelpqOCUUDCQnJfp9Xo87weV02G2a1WI2GQ2qIkuiwHOUZBWHS0YF q9JHVQnp4R49slk5PBonRt92YlRVEKdK7rymKsjuG42qO66M4MrxTa6MxK+M3LqSasECUpCdFSwO B6ve6x4O1tARdw/D8VPdw8ODVZf14z76sZCuF8wohEK4I1jsmdg9WEVHBYurSiomVkKWZ2fRAxEM oyE7ixzAMBAje3IV6Tb6IfB90o1dUVzlC3cvrvKGcYw6Pq149Liq/ncPK+7uD4WGZ2dV0W5jw2Oq SLhrlTWz4Xb9yVVytyqpGx4dnFSFDpBlwT1Zb1Uur9HImFGZpnHhcaPvGVbFj8YjiqtsmVXucPcq 9/xaT3ZWDd02aFiV2q2GkkGQzb76RXu8i7pD0DVeWby84eqLuLqKSysZXV5ZUhUZtQyzwIqjWGn0 cpSoJwfvZ41mHYh3JS7G0kZNDlap4a7hiZWTR2HkfZVVZMC8ULXPFzkAtuYrDlYOGhYOVRX5w8NH d0/c4ySVA+bt9UaC3jtrsrMOeBZ2CmHgDmR3ye7C9p1CnoXx/TePxs///S229yw89iX2vQfcGjvK mhbuiaZXBccG0YBhYbS/A9uUdyCVYztgiPEbTtHzSRiRUZVaR3SqSkzTwsHKX6B/jwpf/uHOM6Mb zkhp2i+EVbIpv4U2VXR043FVZmZVixaYecxSOSYLTSvUT7TNzqqo8odnaMEqPyQ+6T8Mdw3vmIPB DoXYxC2rga6DQtWiu4fFy0Eyxl9NIjmZw6u4UazmrcYa12BWs6ix5tbto8LAyX1MvSSuKiX91r9V S3AUT+xYRRP+l+pyvR7WTlbvGqL2H7aH0j8Or4FWWkO6Jx2AzcSPvDe7huQxpJ/UHf1HoU0WTrQI 4ahtVrAE416C0R4erAxW9hxXGSwJTgRaC2n6HhXllcNz0PWBwyZhO2hYqCoy3H/rsHz48I54Tjv2 HNyCyyuH4wmTG56AvX4qJ4qL2mf1ZppK/2F3D6ta1N1fBd0QkwpCegvD+hZoCGhdQzrcaila/NAk T0Ob89HmDi1Q3zH+FCi9i/CI4ZWV7JkDGX6+VVnpr2SkHy+DZpqeiDScqCHsEkYLNXRRf9yLXTjk ZyfCoXAIzRreHa/qlAXduoG4hffIKgAR3qOfAmw45rA/jD2DjYBSlLdjfwH7t7EPxc/p9Wtw/CdA LoBdOx6wBbAEwO5j12N/C97HMZ6vP2M39hWA9YBTADxfLy/EntXdB2DPPAfoAGDn2bOqGvbs3aye vZvVJQLaAObjvWOx7wZg17M2PQVg7ZoFeATwcsMxe/fzAPa+9wDzAOwedn4ogN3H7rkBYGMwCrAC wMbACWDtCgKWAMnjdj+BV0Aib6EcJH/AOQ6GdPwnQJeRYA4xI18lBmh8JnhILNAJNWIjduKAbuYi CdA7CfFAJ/ERP0kkSdBNAnhWiKSQMEklaSQdukozaCstSCbJgq7VEvpfLmmFu1oD8kgb0hb7doD2 gA4kn3QkneCf6AytrAgSoAvpSrqR7qSYlEBL60F6Qk/sTe4ifeDN6Ef6k7txF/t1wN8iMKD76BP0 A+gJ3bkKbiW3j/svfqcgCc+JBeIfJSK9JCfLV5TVyt9URW2tTlWvGr40rjP1Mh02J5rHm5+3JFuG WJ62fGnta63Q0rUnbBbbZPsQe8zxguMDZ5YrwfWY63QCSchNuCvhX+5H3Dc8j3ud3qm+XN9Lvlr/ AP+7/rrEbUn2pJXJqclVASXwr+CI4Luh3NCbKZGUD8IJaCUHjYjw06DP8xjb4ogqS0lUEJN4roZu jtgxLQZBTuKJTxWlJI56lYM0i1LiyeyrXS3oEy3oq11jO1JUoEULomzTKrc5tYXkkC3ET4umc2fX xgbQP0va2puJbFQ4+mn9Ge6a/j4ruTui5ZAgz7R5nrOiIRxfU1//OuxnjuOnG+AdidgFI19Qyt1l fksmBaX0Ltmm5Rz75GpFrUeLsi0pin5dVEA7dGiVS2fOnEn5PLgu0tu2aZfXGnqJxNla/pZT3Gnw 4E4dBw+hB4UhN3fG3IM7dRo0sKBgkN4emxDgD8OuYf1vEzGJtLvEc8Ldsni3XEO/2C+Ru3l6N4/D ak5Vck6fv1yr1f6DbfBq9BivDfN5OpxZFLlOKx7OvyoEuJzoGS4Hz+cJV39GOC0VAv9ygUt/jbS+ S3ElBMM5OSHSqrWSkhLKyWlmV5SU1u3DzRMTQ83TrFxKyNA+jTcmjvX7O5XY70uvoXkRU9Z9xi/a 3Cd5O7Zpp49+n8tXo9eiFbb8HM9lUnS5qKDosj0/x55vz19qaZm5VHzo2FLLsWPHlmqWYwUFaKan 27xIu7btMlqqNkE0p7cT2iSTZlp6Mm1hyUomLdWsZK6t2B6avK15Ms00YZNtyEFFjqoQrUArYPYh 1Y3ExfilWWg4JbWtltaStm1TSOODLdNCrjPNw7DLjjAtRE16OEVyORPcCSpl+7zW7fiZY/8y45PY TWofMHDM7omVB2dW0zFWVTqYWPLjj9G/llcMHHbXKE9fmc6JTXnzzwu6Pv7IxJ7/Okzl2gl7+5RV jVpdWX5yaeyu1pGdzlY5XX9dFjvPf1m6o3uXshl3Z5dNMkQN9F9b3nzkhZYM1yg9DKvAps+tJ2Kk 1ziOUP5eThRyPvokmp+PUdNnL8TtenwSHcx/BauVksOx5UIu7FgbiURaSAbJKFklzWVwacXGYutw brhkIDaHmqZotjRiV+abBwpee4cFDVOiz8Rlas/Px5PLaCrh2raxkzSXJHAup11wC7mx72OPXbgA W8J1Jvbh7t00+0xsOTPDzv74Iz1L3fYNjn/Hnvj009gT/3LqfSAb0R6b3p7ukZaqQTWqVlXzGXxa L2Mv6xBuiDTMOMxqUlQz2qOhXXa0aD7x2qeOjrcpemebHAKxu5wcEdu2S7W3bcOlZmykLrrgwoXY Y7Hvz9DsV16JfXhGmmaPfRdL//HHWHrsO9t657/oA59+Sh/4twPjUwpptwSWupGkR5yGciInUalc MJByA5+kCuWSSfvkKuiilhTpO4yDK2QL20JtQ7Y8m7AklrMhlkPPbOCmxff0TIzRCaXbY335VJqB cc+IuGiIjDT2FI30LkUca5mleO2tezd2R8OjL19lU9e2kGv7O61b8IwevbPLho3pMmj+qK2xvgsc pdP6TCooHvmnhfe9XckkzAUug/+eOwqq9EVMNIlwPpF4hTd2s0fXal+TnD7RVrmOtiHXBRhQGevX s3a9XX+GV6kb/fVGTNIMYlTv5b2mxuawwW2VK/7eCokb323U6K5dR4/KGdWt+8iR3buNis9jCHzg FfABnhRFfBylSWCu4A70Q57n8B5O4H0i5xVqaL896zyZXr1BNiAS8RQV9NGitvylYsvMh7RjrXLd YZr32ev8uT05zN3CnlKKZy/Bs42QgMnUGdnuNXstoDpPKpclZym5NJfrLHdWutMI10vuqwyid3N/ kEcqY+lobrJ8nzLJNDFhFp3FzZMfUlZxG4QNyirDNsvexLcTP1LOGj42fWH/OPEn5aLhqnI1Mbvx 0Wk0jZtsmmCeYDls2Wvb6znsf8du6aaYTaZudrfJ6cbrzSbBp3Uloq+rZNZLjqQBvC/oGPCwSlVv YN+n+pSW9bkMKdLnss3NKLKI7ZcqLTMtel8Z18r1JFK7X0waRb0ynIget5WaI9Rithkdo6C2+EYR j+KLEAunRajdoI2iJM6rwLMY21q8mJaRMhokNriM9C0PF0o4hbM5wZaSwbvstjbceKrShNil2K+x 32LfUXcG5827P/LynxVufvT7zBnFb74gFca6xZbGHo91g0d+Pp1H37i5kO9Z1iX2VOxCl7WcVlfd syecKPwLwLPDoJEJkHFm8kikyEANnJ/6OT/vF+BU4ErEIeI8uoQ+Q5/httFt3DXRJkHkShJPBaGb XRRlUaC8LBjM3YwmE4TgQ3sVdYyZ7anMwZ5/6DUiUMFrOUiDlI+L4rI+19wFtTrVgfaKMIINuEJm lqXZLFRu2659ni3kCrXlOgx6vvLciwfp3LrB64U/d7u31fay1TeW6bgOXxkRIsCjMDkUGdhcbZ64 w8Oni+lSupyulDh6hoY6hocmJ05Ompw8OTA1NFe8X7pfnudfkLggaX7y/MC80DrPs4kvJx/3f6f6 vUow0a6KYoojwRJURT4l0We01NDDexPEcEoNPRQxEmoyDvAtJr40lEOvOxZTb+rw1XEqr9VR4iqo i3XnMgUh2IEe8V2rXCCF5vaazJ40s9sYoSavJUKZcFq8GBNd1lwXSUUQRroAYr1nEiqZQjBZORRD QqRucLt1gycHPyt+YVz+U5PvXxgdMO/U2IerZo36wwyJu7Sr6zOHh04NXVlUOG6aL9xua0F2v233 Tjr/ysx779l9P+b3T6C33hindHImMruXbWhgSMpk2wnhPfOJ8KfCWfNH4R/NN+AMUZLARSxtxI5y G0tvudg1wjmFjHM9SB6U57rmeivJY67HvM+R5+Q1rl1ki2uLt0Z5h7xDT7jOiedcl8RLcrIEqakm Jbi8SSIlqUmqy+k2JVmNJozjPlVNLbXjoNotQjs5HDGlmq0DfBXSgJCvmbGGjnzdtZh4MxoH9Gqt TmNsREFiFdAUPPqosiGFymBjAgu4QmeWtW/LxDRGLhRuGz8IpwB98oJMnZKTIcdIKCX9Txe3P3fi i9ivE1a8/ec/rtr65pvPU/+ns55dWlkae6Oe9Ho18dicQ6tWH1z/6pTRS8r2lP5zxeSDPZvNeX7M 2VgtUzuhd+YC1zaCRgygkvGRwD9N9FnTP0zcR2b6rLDazJnM5jF2nhd4mTN3U6CNPhJxE5MgmAkn y1aDSeDIGNFghdpogT5YoH1UEHUXaNCG0CFSxGSPu0AWtUzhIe0jiIpZM8msmdBJ21KdDGy8jXJv R6dxqw7RQOyrQ7E8Wr2BP1pXuCHWF77P7VFEKjHPGzHP/dBGH6mMtMk3dnLN4GbwlbLo86S5sjwl 2hBtinW+db6n0rreuk3ZZd2WsF8+7rph1YxWxctpDl8NfWOfKJp5sPVDezkqONhMuc1mjudL3QNU X6IgjqFksdXrvzVRQHh9qiowRdCrodhFCzBdl20NM1TmYHRsywsSzIcQTsloy1gYU7ZSQ4f58ujg IFx8k5+OXVu79tLgvw8fvvPeWH2shs/gvtsLEf/t5bU/Lu15qmWnIVuH/OkEm4fxDbLDA9vonUiv Tu52/k7JvS193b2Te6eMI+PoXDKXriFr6DblHekd5QPTBZPdb800ZvozA/n+QQn3BCZZx6ctEU4b z3HnhC+stWlWEvQ6XDpSqtODrwa5YNDgYpiqiV7W/7DB7Eh6SZODcq7My74MEoazJpwLV9OA8Ljw orASLvWAI0QMmjlozjXzZi80YPeeRmkRrThd5sEQlfWJxgUGRqcM8hETz5QucIBGaifhONNv7XZB EeVsVB+mBp2Upvb4eNG8z2fFLn4TuxL7N/y8qRtXb1v1QS2d1nvd0FVPPPXaHu6zKUsrPlz+RewA fNAj6WP07ZaH+8UeiZ2LTh1+YNof93/4zLq/6HiyBbj8EPDEQ7ZGihW+A9/B1VudrC6QFsgLlAXq Au1J6VnpWflZZZ12nD8rnZUvSZdkp6Sqot2hWQzE4jM5NG2MHSccmsgTFVz/UCTNZBQIKlRRAOpr Js7k87kHPEwp/S9i0Aycwesd3jgoV8vAMb8u02Uo9IVoAZOisAMgRBnzZGQuWwqYMcDGKAT7yF7E tWsPrYxRtWSlFi6J0qJeBzu81LFrbt05/vNOa1LDE8eNarVs8z+o1uuT3sPnHlrQa+HfWrV6+qnt +1cvQ795sgS4MwR80AebOo8qkZ0weiHhepIRZGjmiJxx0o6U99zv+t9N/MJ9Mes6uU6vczclu6yK BtWTYUvzpfvTM/L57v6SxJKkkrSS9O4ZJZklOYP8gxIHpQ/KGJw5OKfcX544OTA5XJ5enjGl2bTm 4zLH5UxtNa31lLw5hpn+mYkz02dmzG+2oPmCVgtaL8h7zFDZar31ZfMBcoAe4A74Ptc+a/1Z3sXE i0kXW11sfS3zWk6hnzSzCtkh+HYOV8tiNsPHYIKZNONaJPutXG5q8kvGitLcAQ5f29SXhIrSFgO8 3jY11L+nQTBdrrjqiasr7MAGocQgrrfgAEwUAohmMKsIFigTOZA3bl30hJmSeIdVJAtxmwjMNoOe Sil94urh2TXjWv5h6aBV469e/eUqJz5V+tjEGXPHTBViv/35/mm7zzTni72t3567/tzAl0Z1fXDe fd0e+PPU7b9+s6uedp2ysrD3g4/3KFnQp/bUnkkrKyeUfxBk9M10w/GYI0bfJyJD05PburslD0ie TCbT+WQ+3UA20J3KDsch6TX3+ZRLqWyWbqY6xBRqt/rT0pQ0Y5q/ndLG3zYw3jjXd1x5R33b+I7/ 79xZ9QPrZfVSmsPBu4g3Tuyjgi8wYtcYlVcbxDjNm3VaDmeGO4X7hMvCU8IPhpeFV4e3hNWwbPZl OMAKVshU9qbvO/C7NnM5PwcUbsuHbqiPLSNxmLeNJA5BxexPNsoEjJApduCDkFt2G02xYNAbRBi/ PU7j1P8N1ag5tjN2Pk7jsVWNNM53mLJ07kfLz9PSWH7sxdiCWOecQ33pQii3q4bX3PfU/g/X6jTO xe0AYQF0bDdpFnGZZthlZg247rWqM3je6vU0mARQ1i9r8VbfaRjw/8lI6NbUWODLb5kNv9taIukb cUNmwGbgBUKF+BGMOPou9MGPXxcNyJvhBOStXKwmssQcJLD5bcBL79WLHqZNQwwew96jH8DGoS6V ukqFwqiP+xpBxMArsRWxZbt0fKEBYQnvBnXLpMUBwtMj1dx0uEKOwPoR4QeSOah2WbqaVgDnD7OZ rjFjDLolA2HJzaNC4c2jvHv9+thmplZCjjbajHo/fm/97z0S4/2g6IcIyc76QfV+1P7v/VBpW/yz d3LfRL1cIPrVKwjtzt0FvH8feJ8EvA/Cy7cskp6v5Ku7XHy5UC7OM80zC7axdlWRRK/Pn6gE7ZY0 mMTB6RnM45QYMoqSogpGwsJbQtA40H3dbrdNSw3eR1rU0KMRQ4BQK3pVUJpaQ9vuza6Epa3BFzVz pgczjzHRopdvMYboNeiv+eDGGgZJZw7MX1JE2+E/7h9hyhXzVVl5C02it2MJ/VNiv36F9pSugx5Y OvS1eQdOfvn9uq59SzMKBnUcPLhjJ+bQCg+cfv+gro7MgRPvKpma033fiNefXrm++909s2aNb3m7 owuhXYwH80O1JV2oI9LqjwoViKdNuxQX36HI1S6FBovSPB57Wuo1ocOXgZFZISNpExKM7dslBVYG j4Csa+hfIu5udHqzkMXXrSBtE0ya87khxdu10R8VvcZk0LU+0a8rrpV5oLXolHv1shaFXzCuwjM5 xDgmNE5diZ+c30XMa52OSEx6elpKeov0lmkd0/LE3H4kzdYsmYYdwWTidLkjrmTapV2Cq9BbkEwy Tc36wTWFa/KTUGwlt+lHMqypySTkTE3mErp4krnOvqJk0tyc1Y/mqNh0SuwAj1bDTz/Q/Vlxl1bD aXi0XLpLi2uwEsG3wbAz9C18OJ2ozdmoZ3FMg2D+HHAZ3ha+xXD4Zwc90vuD2K8baV9EZ720dFDl GPiyEueMnbD0L3VHzM09Gf2az7/y6LIPlz5eu3xT79SKiQW5LTo9+O7G9uFTdAqV6FT6TmxG7ODK A9O6zevy4KEnXqbJsV5De6b3frL/y7TT4y/Hqk+eim17gbtAzb2eH9ln0JPA8xB0j1ege8jERNtF 1klEFbkc4wrDCuMK0ybDJuMm0xHDEeMRk6EZ31zIMaSbJpAJdCI3gZ8sPCEtkR9TnlQrDWvIc+Ia 5Tn1WcNa0y5uK/+udFz+hHwuXiSXxF/Ir/S68JsYlBWeJ5JqNBJR5GTFZETBYDSKMrKfJFXcZuT4 IG8UxVS7gACwkZDmdjhyjQrPcRIYSFWksxpQqPIjFQUBPmQFzg9eNAqdhCnCg8Iu4RDc4j8bjZ2M U4wPGncZDxkl48/v058ovM6l5k5rdZ9IxdUyT59o2eUyD7NawN/gmMRftIyZiVCTmY9kKTyfYHTY ZcKsAbLlM7VHLCiAP1RkDlEFBeyO6aoQSHJmHhwq8OCG2of4DPnCUfqP9+hXH0+O/iOXvnMoK0PS rl+hg9dzfTZsYDrPbox3B4y3jfghUa9Epj8qrhbXOreIW5zHDcedx12fGD5xfuL6xnDRedF1U7mp akbFqHKP8m86P0/+PvlmijhASUkypDn9jhSnwyC4E5N6EH8PmtbD6qABxxHHPx0/OQQHXG0cUdx5 0uRgnnlNhj8xlTHSzhnpOceiZczRXvvLVdg5TDDOZFyHEViDhQxrTqeujnxYSXelCWnW9JR0p+ou 5L28u5Ama8FCGjYGC/kE2VEIXdPp8Ii+QhqwJBWSkCm1kBoNOm3oVHKLcDKZG2VmGcynYINaE9/B +60b2pnUppuLLWGJ76Y51HbgnnaTyw88Ov3d869+NGFkzuJDTx154dlBVYcxeANfmjhg1bx2vT6b OuHoRH5w5si5JfdNvZnxzOS+j/Zh3awAr4pIRYjiPBUp+EUEmphkbhaZaZppnuV9TXhNeU/9kf9R VVsq5gsmkzXfwHsvEOLO51S4nxD68TvyJK+v86q4M4FxpQKgCSnqcxlsGOyY8WL4EIJaAq+60oU0 W5qSnsA7MuFAxcYpujOJXbYyj0JD93UfElwpEpzezKWbmhe3KRrZQHsh8ufK/bG/7dxOW9dU/vnF TQ/8df7CY/c//5K9y9t08b9/pouOd6kp2xJ7++Absbc2lTE5C8koLAAeGeCzmx3Jedv6D/GM/JN4 Qb5g+cku8wJdZllm5zIV0wXi6sFwQcuT1rhdxlRggTsh59gvQHntFygaRZh8vTvJvENJt2C+7elm VcukDh4bq2zKJDbReXtnGieydQJzBUvhDEwcfMFs5tbTGbFfFzx6JbZt6Xuv9h625dAzkrYn9twv 38ZefGPX05Sv/eeVxRDpmKNTaL8N7TeScfv7m1eaOYXR+H6DQVU5UWLZpWACBJ6IqoiPcspK9QW1 Sn1LFdTJYhHxmSVjKs954ckI73k6rkzEo0l9rtaWxb0+cbs3HlKiZWmweZndy0Cw1R3k20VXcy2j f9+1S9I2RH9eH/0KbQIS6LSpktJIM0nMUBRZhsaUwbHxWym/IFfJb8mCPJnzGQUVA+k1HI7jSEMo qw97d4PBHX9x3FvAXnqBHxydy/WJ7m14X7vb8DSRvBDpuV/Yr7yvnle/B2ZKkouet9NMJbFHPx8t 8tEcHw34qM9HGhHWU5Sgo2sR8W/0elITiS+ZIW3SHUiLIalFnA0xrlodaxm149cw3ZqLV+O467oN dxOa4K7uE/ufUDevdXtbuC38YVuePBo7sxvY+3oce+d9/Vuw1XpaTnPfoo9e/R1/D9fFxoj0KlPr 0P+FGG/mHzHCpx0Q+AzVUGoQObB8RVRSZVnymTmGr15T54dun2Pmz0anwLHzK+DkYEG0PAQHWIAA gQLbwpNc4YkT0aOSFh3Hbbh+hfs8mhF/H+O9Qf19PSIZgsgRg9EsyUKGJHIGmmEkinRJUYFXlwg5 AhLzmv4Qx62yPg0hCV1MRAuYSaxLBry4LfMKxTFrNx0c28XPie0Cuxc+37DhZkZDP+9DDOAw3msj ZZHk7203bHg2omKUV9QMo4Hj8zWkPaWajKUOGO651cRhhwpeq1V80qgG4b22RqVHE6yWdDFNsMqF VDLzhURnMrrnUve9wZWjR0t0DeS+s6v6PNw7tpnLmHl6U3XKm7MLnvqGH7qhTvnt7Nz4mGzEmJxG 2wxkRyR0SboucZ2FzuJSeamyVtkhHJDPCd8K1xSDQdZ9zDV0X6TEzktgMEqqHVMkpcLroKgqL0Aq cxwSoGWkQAu8Kj5KZA0emlHyDFmUfSaeEQxi7bmQgV7jiFf1CS1jhINYBRS+PrVM/jCBzMCLEc6B NIYc1sRM3fJgIUnYCTPhoWGzTfNUGqa2jSe5Lp9EP+QejEbXYcJl7no0UHeGd9d9B/w6h76F0DeR tNwLZgL7piqigZkQnyyIjH9Ih29nHl/j9WhPUatcxi0QbQrVHTzJGMSNhnnsgOetwfPs1BMZIPIG MYH3Cj4xDZpRC7GD0EGcZ3nSsl74k7jOtNG83rJL2CruNu+yHBL2iYfNhy3H+FPmU5bEx8zLLJzX Qq3I78sWFgp/FJ6wSETTjDX1VyIWXrNYmtuLoQKJRjO89vsidnt3AaNrtkCu2n4QeU6BIzw34iOK aFZ4CxFWyJtkTm5eohg/MxQtgopUQ49FDIuElcILQpUgwHl4LKKRUu0zW9EKsom8CuQWYCN9s7+U eh1THo5LuYpomefq1xVe7WoZlKSrX2sV0JIYnut6Ui1mJarbUkxHqsj0xLWk+IEePWfe31mQ72Eb JoYRYvuwzIf5jLD73OZTdDwdf/ygKGZdOfnvDFGUtDqOj12/wn/xxBPR4dzLTzxxJz+wkKWR5stN zwjPmTYLwhphB79V2GU+aBZNzZlPV2huNxpNggkTCeUQsmJBJBVapaKfMcpsBJqXGlSfxltWAAua l0IFtN5iIayjBceYTO+Dw4JjcQcMTIyiAnYoMxVQ0DLjvsAQukPdeRmMtdAMN+1wcD+XViCKBw9G L/UWJO3mr889J6joyW+bX2R9iPtL4rE0Nyhq+FbzVttOx0739/R7sVauNd6gN8Rf5F+Mvzp+dVse syzTljkfS3jaslHb6Hw64W3LKe2U8+2Ev3Pnhb9bzmvnnX9PsLdX7PkSb8onqjVP9XldebzXM2VN fNLiriTdUNJFeAvqNhuheLipC1KbqSAOEUcWA4R4AoeNptgzqVPAJh7jwlbnHOJt4a00uEE0jjk8 NTs3Ph7PQnptQ3zr6bfffhqQ0xjFaoxqbaC9aX/89UYOcxX+XsNYVIFe7gO9mJBXMynS7KDxvPMH J8+JtJmS0IM39bBYOCj3ij0vqLyFNRNrPAk0levs1q5CNYE1GNdPG9WTRNFpSNfSpDSrkfVBtBdS m2rJJA7ZVXhL01oM/kCZFNB9Z5zAdBM9kSAUpvNP0kd+PDtnQ+y7nwYMPbR/zKux2DyuXfSkpE35 28NrYrFl60fvn/z4BjaHsb7CKd3nlUqHRnYISCwRPPxT/keTHg09FV5rXut53v900tOh58M7yTbz Zss2907PruRdwWOWv/mPJh0N/S38oeWcds553v9h0oeh8+EfyEXLRe2i86eEH9w/eK5abvivJmWI FhOCklLIFBYRphB5iZcNikHVBE3UkOE7jo7lxvGryWq6Wl1tWG3c5duaulf91PCD6QfzT7YvHdfI Tdu/HUn3KsSYkihK6S45H4Q+KRIwBvKJN98OL7BRTckLuqjLl56YF7RSqzetAW/iIVPdOaarf9o1 3b5uEGnQbLthHtLVNHOaO51XkLhEiSHVkZJJfbbETJJswiboQRHJPQj2Ob2Z1K9hk2QJZBKTMZSA nQe8Ph4/bVCCwdR1WzluBtCZYjLXibqYEw7eTq5tPLYKbZLqeMdccRrHXSq5r2qKPecvVRsir3+8 AE47GxDR3XNv7IsGNEyaMyJrff9tK5xv0ae/oQPo6Vj32JJ9sdevi0834mEjXmJeWXxyH/DRCsvg auTBx03bDMfUY4ZjpmOOj9WPDR87atVaQ63jotOsmugB8+uWr62XYIyKGEmTaja7xVaKyes1272a zW6yWK2pdpPJbNKItwdvReKLBonOWcxmqpjgEHfljQQj2rjCTPubqdnn99JUFq/nvL4RMEaR//S7 8IN+UeaJsihaXABC9oHbavAPN0btWUoIc8LHPfAsqh0U3YZ0B8jBbnSB4EUQgVO1ZRKjyW5LkD2F iGLfZoAxumAc+hZpwK0M8ZkRarC96MiTdNOptyaVPDiH/uVKrPwk9Y8sy9105hluVRTZXQO3jx6x f0Ukmsmt2tBm6vzO05gS3xjfYnHM9yOP3mW+yzPCU26db54TmBFcatqqvJt+Kd2oWBVNTpHD6f60 YG9huDjCPN4/PviGVh0+p1lg7bvVMM/i1EnJgcSggTcnJAYCqXaDwRRINBmEBN55IeKYbE/It/H0 QoRMtvP5qapeJXudj8p5iFZ68yww9TJGxHXEPlfjTLE2ztcvIxu4iviG1/lguP1+zCob4htED/0g ulEgaxaWj8U0jEZNqk16DpcKX3yowV6DazjAw9nGYpgbrxwbsLbP5KfHT4hd+Tfltq3f9dLiTfNH 9h09oD52I/bPe14OvTmrqKL47qeQL/biT6/+lPtK1ydGjVzYNqdT7oYf9sViLMOe3opjIj1tj4g4 ZdVrzO5RQMud9kkydCYcRMzTuZ+4ejBLr9IpLq9vqaRMLqPRjVooR2M5wrRYS7F81y6oLdCxYQsz HdtFZkQyvrRcdF5Trqm/WMRMxUg5Kd+mGg3NzWaTz025VBdc8Qm3BCWUbF1K6so2pGODkei0pitp AlBP1gyFVLRz8AFYwCx5Jza/W7yUlDnybjm9ID91fbQlhXrebdngEU91O7j4g+ef/scs6ALiiVV9 Bu65yu+uM37+y4Kpn1Ef2o10P2EPazd9NFK1hKc9SQl/l1yslKg9tWXyEybFqbjURNMI5R5V1CCp NIfmfFB4UJR8steW4Gwmt7ClO/Nt7Zwl8l1KT62nrcRZ4hqujNCG2wa7JkkT5YXkIZ7dME+ebZpp XUQWSyvUFdYV2iLXWn6Nuo1/VXpV3qa+anrVfEQ6LL+mHDG9YT4tnZbfUY6pp02nzR/z5xCJ+1g9 bzpr/oa/JF1UvlFvSDdMEWjDTG0z2ks1zSZLAUTha+je1+0lLpcT/gVW19xeYrVC+PHN7fBtIxdF kcEZXJqVKDanIptUqybxRJFd2kH6GbHSzyMuzRKx9LessGyyvGo5Ynnfolh8bherJahV30dUz5vA vFyMsegkAAxB0Jepb0yLYwDmUgA9jv2A+xWZInPqW1p6bh3hYFb8XPxUXAeCWjczj89zuPPaOxq2 umIn8x/sq5lsEZ2baw46RNPc5w8fedclOsBg6/pt3MjvqWu+9hn+k+tXhMTnn79Zy3C9Deb0Wcyp QnZFhghY0rJK2CqcpWfl7+glGf48wltFq7SIW8SvEFdIK7mV/CZxk7SN2yFZoPWl2mGCUKTfQf+T EdiH5UZ5SRSRAAWCgYgmooKR7hJRaRDpDkqEeRS67A9yXpURDcyMqz6o9z5kfhb4vOCuGBvEODyw 2BmnBENAoEMfExboYAfx/od0WyOP2jgu1voilvMMez+Wx/2N7xpdx02sezPaWqfj+ejbQPRNJWMj 7h7cMG4i9wAnwHMpo91wQsoSklPh1UB8Qvd0RFwqwbpcThakIgX+BLAwQwPp9dGTLWr1ycOcMddk tABNbfBOslbltaXM6qQh13zuq2g7fm80yP20SzgBo7M9wjDIOxuLvL9KJHjJsK1tkqxyvIAEXE0S k2RiB59ZGTERQWyGS73KzIZ4DLOrWeyp4ZW6mYu3NThO6Fg+I7qKmxZbLn+14fqQBpuoW2w5P1l/ T/tIIl6CPF8YfgKfRDm7KDSDo/aUhIhPfVxhxfN10z3eJ4ou6s/XjWh+ct3n3LToKmnab4H10k54 SxnOlNaXY60R85wGIlaeoA8GpN1RBFb0RrO0O91qQ14bBgQhqfUsaMQhL+Er4V5hGrK6g+RC5J7j rovyVZknTwo7fG+qZwOCWaWBSDKfhmxaT7IxwY93aXZ7wA7PKdE8ydZiT9hokB12Q3JH3kgcCfYU u2NSQkCzzp1hp3Zfij97BgjbG+q7ME5zehaazpUheRi5Ma0cM3eZFeNTpzx0K5iObjMh7vMmCaqS niT4WxGv6m9BEsXkVrBOPS0aNFp4X3oOmhexB4KUC9LkXkgNdvWiUOrQWqZREZaepot2PaMWEWI7 okFIngO/dYfTeRtLXGjInJ03+Kdxy/+5+rfX207RgodaHE0wjx28++JD/Yf+/ebyP/7r2lHaag9c 8HXfn1x4D/JL/+mLXbu4bQdUeI48VX9F+APyYG3Ih38j0vtJcbf7E/cl8bJ8XbwBD9le9ZjKCWw8 eX+a4kCQ0e8yehwa8XfkkWvjwkAaPfpw+QI2R0DLsb5g5aze5JYNQ9fgPdP10YLL0EiLGnIOWECc jVKCj41Sgoph8QmeVtQtu1oQr+hv1WSUEoF0SdTfS0zk7L1Ikv2/j5Ke2wH5Da9lSkZ6Bqw7L0UY Bt5LFpShpUN+HLf8yzW/vd5mqhY8eLB88I5vFvYfeoYfow9Q7H02QFLfuvaxkI+qX7+8HaPDcHQL cK0UsV0P2RjpO844x7jas4tsNR7ySPuFaqVa2+/Y5zzNn1bO8ecUVVRg/pg8FpfpRaPRElZlz4uE uDpyMGln4Fk+nz07RzoicZLX27L/7bjFGHjcAx2FB5phlT46iVYnrwhpWpqTt7cgVgUbGH0tYP5Z GrGoAUlu+Z9Jg/uZhbrtcN62F0oP7dgeu/k07X3plb+8/dz4fWPeONm5YlOwaD1Vd8Ro/y57h5d/ MvOZ2I82LGzgyCz0NwJ8sGN1xGuRrrXyNZmrFA6qp9TPk35UxUAkEXTldBA+IdHhtNktxQYrSQgb ZLshEcRktQc0my/ozX6YEVCgtC16WcHElkenIYYNjHbwr9XqLEiP+sUxwe1nmOAXvK2IW/W2ID4x sRXxyAmNPW2kl6RkyiXTxF7geY5eNNlxByZAv2tCLcy899LbaGXJHbRy6D8RCv35ejX97A46eaT+ S+Eu4IELdPJ6pF+Ja7DroIlfmrRF2KLsMLHAw2u2kwnnjMjIofmQdy5HgsdqCZjcCaWwJjg/hsgR 5oyeF13FM0zU5AtYX8yRihgqJLe9k83UxjME4oYCGyTGcJg404epuTeJt9sQmFDS7bwVo2QE0SSq CS1IkiY6QDomkE6S7GejlknjdtntOJLOYhTgI3abK6SHLdtD2ugUIhT886/P/Ljiiatr//pzXWz0 8+X7ziJunv34jJlbe01eS92bnqW+jbHa2GfN5rw16gH6sv/Jl7bGaeRlyMcnICfcpDySpGpUM2qm oDFoaqeVaIO115RjiirJ1GRxQkrWRJJdkOmWBgqB9SnQQILD6HByzv5erqVHu6rVocenmZnEIhhx emAlPYmLMUQkjbfNi68t0NO3WHCcuWnppt9+G3dm9yOP/2nG8Cf60EOxYr58fZsvPnrCvye365rq HuvrmGADjkOPjkB+pGCFz/VI+rZmtfLXyb/IwpPCG2q1+7T6efZP6vfJ3we+D8I2BOvL4osVR039 jUieJ8HLJ6aGsRosy5ja3FqczgRJFhA/MZxgTUkNOCZZfbne4uZx/M+5A//jkj9OABAfl3UCuD3q TTuAIbbOyEwKOV2CGgwFQskhXlLSM4XmrUiSK6UFdToy1OYtSAsxqxVi2oktSDM5vYWe00z1fObM FmwBRlysZMP0bkmzegnZXLgXbRm+g0yYHdSETvJsGrK9bmUNtmsP38r/QjdWW7PYhZOnPuj3zdTB 63JyUv4TGdVdin39UGTN7omH2w1sl5e3dAZ98DaaonqcqxC8xk1WR3KPyRhpyRFQ+AQ3JY6Okuy2 GBgFmc0zjCuNnNHn5dwBmgM+6vU0cs9G8QJ5qbMWJFQU6YoHRjIBPMmoIsLKS7Z0xOxaAS8dECsg jBYNY4RxFl2Co5foFBN6EVeCwN8menVXNMsXTGBJWrCuEQWDIJFt6w/2/6+ZIzcGvPaDgYGtxnzV U+ob9S9+enRx2/sPRldyS1+c0PXg8qjug+fI81Bv3tF1KAcpjDhsF43QGNMFXpLEdJkYlItw+P6M /JlvxQD3LfE6y0/EtanaaO3V6C11TV+OotuBUNho4womZCHQj2In6RXaPnplSHrGkCEZ6UP4o+vr CteLV4oKC/FfyPB9d6wlvw9tYDL+wYjLYKHvWL8Vv7XwXrj+eP9FF1Vg1tREDEaDxIc1q/0iErN+ xpdFiNEXoDXUsV/Pyk8+coAObUwq/5p59rHQSGdWTKlkUkvnUL8HMVqwIAYW0zFWBN/QTAfLw2qM YWgsf+L2ruzeMKXskZ6xdG71429uvZ8uHZyRMZhBrNefW3Z57gh/7/q6FrHaL0bJR291DbjAVlhu Aw4ZyP7IIlkaJlWI/BLxGfEZ6WXxZemseEn8TVI+lT5SuHcluk58VuI+lb6RINIqxV3yLuWQ9IZ8 Sv5erpOR8mOQOZfolFZLcNgJshzA2isVR6J4wS7wgspDFouCxIFnKVA3DfgWjMHE8SpvCFCmKpiM Oaf/gXQDd4FNY/EON1RE5njOz3lHRqRDU+GFwE6BtQ1vOpk5C/mAM2c1BjxC1PbeQc77W/RbLr2e RL+CLmLgxOjN6HZuWHS7rovMAy79A32VSbdICEkAQCMSRyOgD/8tdP4A7YevOfyTxWEQKei455O4 ksGIQ/tB++EWPkEzBxdlC2+ATn+NVXMKLROrN9zoAwbZmJO1ADkMFyIz2NoEf4o/nMVnCVkpWeFx 8jhlnHWcNsU3xT8lPCV1jjxHmWOdoy3wLfAvCC9IfQx5I49ZH9NWyauUVdZV2lZ5q7Lbtzt8xHck /J7vC9/3vhu+G+HMVL+BF9JCHSVPR4sF0kFKS0pKTHQYkAb9WsTUwxa004idToc+XkPPVif2SGLn zT1UfzCRRhLp9ESayCp6cGmoeK0HmEJ6nwN0eBw9mfu/AKlGM2cWFFREK4CpOKqIsmV5TLVmViFc z8i8YnlXbAJ0Mk/CsgCWbnUbqYPomfIo20o391nS/e6xobJxXXqM32xKdbW5v3BDR3fe3LZCWT3Z vODhuQXjH+49f3/dPu7mvcWpm2qia7gbq9tUL4s+GJeRGFh874HpDysaeZ3Nq/BOlw2cDrn8JoPZ FEDKzAx1pcqpPjfnauB1Cf8zrwPNNSiKmqwpyOXQZHMralFtcS4H979uYNgdgugQbL1Eu+jsRRzO O7kcQf/hYNQzUm/ruc7kxr7UpYHFCWVXFz89aef1/8bfhkJfrGjIfdwRGbqWe054TllrEI7T49xx 4bh4Qj6hnDCcMJ4wn7Cc0E7YjjuQCJNw3H2ZXtaDJnW0Tvy3/G+jB7GQsCSbwsRozZ6BRUAIh2TP 4CkiIn0n3K4qN6R96qwmHhPBlupKsbUFi4m0YDGRFiwm0oLFRCA1BWyYg1rf6Et+xBTC8kNbI1Ge ZOhLGjDLsKW4CVdiX9LglZ9oMPblT2uqqtasraoCUdXX076x6vr62J713546+e23J099y2wnxBL+ gL4zXflY5O59yGE4w32UBNay2LPb83fP9+IP8tfum7IC6ykxrjUnJjicXiu0ZmjLsk2C5mzULN64 ARW0WwOalmN7wcbZvIHfLSiY1XFmy9Qh/P9PqjPTminTnynTmnX9GT3WmW8DJjSqziJTncmdqrOe gKjTwS0TCujwf7ehYn0la6zZbVYU07f66voWkz81keJn5K3ui7ArhEroW7ArEgUj07L8MCyYgeny G20eazEzLWVYmUabxWHDuFh9AU9crUq+Q6363Y+Jwbldq4pbFXH7kpmWhBmZumlJmJHZZGga7UuB 2ZdYgff/rS79n62K6z/zlXfoPzfAEyLAHxuyfDKh/Jix1NpoNigSZzAQzgzGwEkEQjmAMLzPwdkg Zrz2I3HDsUHzaciXAFYwOQPAv55NECd9i1UQrYK5l2gRtV7ECt/N7wpOI927oU3HmdyNg0O/qiwv 35vjn/juSFB85ZOB2LR6ZcuW6P26/NkOWm+D9janwyJ7uJQckkNzuJzmndROhnbJ7QLjUvB9i9QH rA9os0OzU2aHZ6eucjyXsSvjoL3Gsa/5R+pHhosqVgpiIXsyE5pssaqapGIlE7UmWN0+LLpvltDM XYAl88XB4tAfyKDgoNBUMsk4yTzJMslaHigPzifzjCxFd55lnnueZ25gbrASH8HZTQ4ED4SOmz8x fWJO76WkBCwGwStYbIZAYorsfn5kwlxv2ClDj0mMGAQihJsZ3a+Vwn+4f/+MNJrmy4Qg2R8x5tio bRLxtmj5SlwB05dNMBVHX0kOMwR5Nog0wK+FEYZvkYUZdBRr48sQHT5HYi4RM+Rcitz1XJpsRdFv 9+ZSKV3IJUqqAWvBU1RDkhbIJckBq0X38OibRrbEYrVsiVUyWDHSf5HNx6VnxFer60YO2JM7IUCx dhLLMsIp22fcGPrUgqSk2ZHFH7Rr//FPe1+oealiScf8xQtfKSn55y+fdHqnZ6c/dM8OBnN8eXcX dx9TWd1mR9eBhQWpqTkti3r1mv6nQ3G5NApz2kU8Cv/GgoijkiwVnyNrxJ1ERBIL71ETkKWQ/5pB U9OtSF95JmJIQESHTArCxquhj0esZnvAJH8bYGs2vX0bPRosoeZqGVuKq6/7Z06yW6qhy4n8Fpdg b0UcUkKrRtWwwRhB0r6uk8Qzq+LWqdDl0Yr2c4+OZSsvD9KfY9bIlJ5L12S3d42oQsL1eno0Vrg+ 1mXp9DaD4/1Zgf60xvfHXOTpSJuT8ucOLgAfqS5pTaArSFuji8MXEI9Az/G5TeaA0WDIUR9WN6m8 6k1omPyyuD3BuG4DgYHvFvwua1mYhMlawmRtY5LOHbJWYLKWNpW1iNG1ZWov62hDAKVde5vQ+uCI 8/eN2RyBrM0d81Uvoezm5l8qKyft+o2bEZ0Ha+LAU9wyppeFwC9eQd8ksiXSfBG/kn+Bv8Tf4MVS big3kU4Qt0MH/Fr8jVwTVUVU4ZSG4xzZIPXLI82gKAahuJIAkiywGkCS2AGsED2zh0pgM4hfCpJ4 kEaQ1x+JIIldw3fRqqiAlbWLnom72FmC7WU97ABFKq5K/be8WigijYG2EMvjyUMkKuY/TR+mSw/G 3EJZ3XJ+zs3N8bnCMnahBv1xIMa4EZFb/WsdgkyQCWhV7V6D1+y3p6vNzc0s+eZeZkQXETefapxo mosFyQ+CESwhS+g6aa31HSuWREpfI6R7Xbwu/Wr51ZqCTzZaS7gS/hPDp8azJlmwIfhuNsFlb8Rn HCSHxQz9XVMFjbnPzRaBOKabHsYqqlpLwDxDDkgzUk3UESidjo+icaSWOrFwvQxJM3XR6GVPtCzO Zhmn9ebkdM6BWglVH1q/zhH0GKMeU9FDKtg0RFRO7n9lcqK/+uUTYfeUFa/9+ZMUMXBQKIsOe/55 tqiQbW9u5t5/fmM0l801y0faiLExkuORpxj35ZVmYnOpudxCyZfHI0d7gjCbny2s43ZwO8Sd0k65 RjwkHZBPiJ+J3xh/la8ZfWGxrTiBGy8+zj0mbhM/5b5VVI5KyGyiEhxtRBZUI5F5gyQzrKCsxhBA wpeAxC9kKElI1oSDH8lhyPgiEvQx86ssEGVq0LLZKvQy7Wu2qgyr0HWtWt8uFfvoS8sa8qyt+MUX N4TCQAb9PwyG/yl9PTb+R4Sp/R/GFtD3fortxpflnLEn6f3RWHQrfYP1mARjLXV8t5OPIyufxEfi dpJPscilJxlOniSV/HLhSfFJ+zqyjn9Gekbeye8Wdoo1/AHhgHhCOCGeE86JLhUKpE4EbAB5zm4X THZLAx2wD4tISAEIYF01VlgTHjENpLlRyW6A69ZqR7+RvE6LxH7iSHG6uEIURZ/ThPALMqv6xCmi tiy/YWWdB+7bhmATCz+zRCMLks1ZtIklt8Xj+3CEYZ2d0pDqhsTLRgJhSzV107g9klbq3kOq7bBD sX5P/npscLc+JSOWz/FkC7nIay25+a/Y659Zt3hKqruw8UHsBF+QK0NcamTEsYN7l+NYTIpNZmNM qgYxKYnFpGpYTMoQj0kVs5hUMWJSzDsL5+z/KSa1hHslOpZfFe3LndjFFvLUfcdiUvhMAfvV72U+ nf/wG4BzPDLTxFvf5/lPX+e5/ds8//++zNO64as87fBFng74Gk/8WzwR0vV//QrPADIQ3z1kX1Ec SoYBmUbge0L34MuN7EehzYNP4idh9THpeVfvIT27ZvaZft/osdNZbcOP9kfhHsBUwAIAvmyJBXOE Ig+VHgacBpwH/ACowwCZAImALEAB4C7APYCpgAWA5YANgN2Aw4DTgPOAHwB1GDwTIBGQBSgA3AW4 BzAVsACwHLABsBtwGHAacB7wA6AOeGICJAKyAAWAuwD3AKYCFgCWAzYAdgMOA04DzgN+ANTh28wm QCIgC1AAuAtwD2AqYAFgOWADYDfgMOA04DzgB0AdBtMESARkAQoAdwHuqW/4sUG9dQy6b1IONSmn NCmnNynrKcG3PQ+R0Due37xJObNJGW284/rsJmX9EzK3PZ99peT29oOB31FmX5C6vZ5FlW8v5zUp I5Z+R33bJmX2Barb72dfo7q9DNlxRzm/SbljkzLm447rOzcpw4l4R31Rk3KkSblLk3LXJuVuTcrd m5SLm5RLmpSRV3FHe3o0KfdsUu7VpNy7SRm4eMfz+jQp921S7tekDF5wx/36d75uww/G/W6fn4FN yoOalHVV9rb7hzapH96kPKJJ+Q9Nyjpnu+15I5vUj25SHtOkPLZJeVyTcnmT8vgm5QlNyhOblCc1 KU9uUp7SpDy1SXlak/J9Tcpg3HeM/4wm5ZlNyrOalGc3Kc9pUtZd/beNb0WTemY93z7/DzQpw697 Rz3yTQj5f3odmGMKZW5kc3RyZWFtCmVuZG9iago0NiAwIG9iagoxNzUxNAplbmRvYmoKNDcgMCBv YmoKKFJlOiBwcml2YWN5IGRlZmluaXRpb25zIC0tIHdhczogV2ViSUQgcXVlc3Rpb25zKQplbmRv YmoKNDggMCBvYmoKKE1hYyBPUyBYIDEwLjguMiBRdWFydHogUERGQ29udGV4dCkKZW5kb2JqCjQ5 IDAgb2JqCihIZW5yeSBTdG9yeSkKZW5kb2JqCjUwIDAgb2JqCigpCmVuZG9iago1MSAwIG9iagoo TWFpbCkKZW5kb2JqCjUyIDAgb2JqCihEOjIwMTIxMDAyMjAxNzQ3WjAwJzAwJykKZW5kb2JqCjUz IDAgb2JqCigpCmVuZG9iago1NCAwIG9iagpbICgpIF0KZW5kb2JqCjEgMCBvYmoKPDwgL1RpdGxl IDQ3IDAgUiAvQXV0aG9yIDQ5IDAgUiAvU3ViamVjdCA1MCAwIFIgL1Byb2R1Y2VyIDQ4IDAgUiAv Q3JlYXRvcgo1MSAwIFIgL0NyZWF0aW9uRGF0ZSA1MiAwIFIgL01vZERhdGUgNTIgMCBSIC9LZXl3 b3JkcyA1MyAwIFIgL0FBUEw6S2V5d29yZHMKNTQgMCBSID4+CmVuZG9iagp4cmVmCjAgNTUKMDAw MDAwMDAwMCA2NTUzNSBmIAowMDAwMDU2MzU2IDAwMDAwIG4gCjAwMDAwMDI4NDggMDAwMDAgbiAK MDAwMDAyNDEyOSAwMDAwMCBuIAowMDAwMDAwMDIyIDAwMDAwIG4gCjAwMDAwMDI4MjggMDAwMDAg biAKMDAwMDAwMjk1OCAwMDAwMCBuIAowMDAwMDA4ODc3IDAwMDAwIG4gCjAwMDAwMzc2OTkgMDAw MDAgbiAKMDAwMDAxMDEyNiAwMDAwMCBuIAowMDAwMDI0MzE3IDAwMDAwIG4gCjAwMDAwMDMxODYg MDAwMDAgbiAKMDAwMDAwNTk4MCAwMDAwMCBuIAowMDAwMDA2MDAxIDAwMDAwIG4gCjAwMDAwMDYw NDkgMDAwMDAgbiAKMDAwMDAwNjA5NCAwMDAwMCBuIAowMDAwMDA2MTQxIDAwMDAwIG4gCjAwMDAw MDg4NTYgMDAwMDAgbiAKMDAwMDAwODkxMyAwMDAwMCBuIAowMDAwMDEwMTA1IDAwMDAwIG4gCjAw MDAwMTMxNzUgMDAwMDAgbiAKMDAwMDAxMDE2MiAwMDAwMCBuIAowMDAwMDEzMTU0IDAwMDAwIG4g CjAwMDAwMTMyODggMDAwMDAgbiAKMDAwMDAxNjEyNCAwMDAwMCBuIAowMDAwMDEzMzg4IDAwMDAw IG4gCjAwMDAwMTYxMDMgMDAwMDAgbiAKMDAwMDAxNjIzNyAwMDAwMCBuIAowMDAwMDE5MDA0IDAw MDAwIG4gCjAwMDAwMTYzMzcgMDAwMDAgbiAKMDAwMDAxODk4MyAwMDAwMCBuIAowMDAwMDE5MTE3 IDAwMDAwIG4gCjAwMDAwMjE4NjcgMDAwMDAgbiAKMDAwMDAxOTIxNyAwMDAwMCBuIAowMDAwMDIx ODQ2IDAwMDAwIG4gCjAwMDAwMjE5ODAgMDAwMDAgbiAKMDAwMDAyMzkxNiAwMDAwMCBuIAowMDAw MDIyMDgwIDAwMDAwIG4gCjAwMDAwMjM4OTUgMDAwMDAgbiAKMDAwMDAyNDAyOSAwMDAwMCBuIAow MDAwMDI0MjUzIDAwMDAwIG4gCjAwMDAwMjQ5NzggMDAwMDAgbiAKMDAwMDAyNTIyOSAwMDAwMCBu IAowMDAwMDM3Njc3IDAwMDAwIG4gCjAwMDAwMzgyMTEgMDAwMDAgbiAKMDAwMDAzODQ1NSAwMDAw MCBuIAowMDAwMDU2MDYwIDAwMDAwIG4gCjAwMDAwNTYwODIgMDAwMDAgbiAKMDAwMDA1NjE0OCAw MDAwMCBuIAowMDAwMDU2MjAwIDAwMDAwIG4gCjAwMDAwNTYyMzAgMDAwMDAgbiAKMDAwMDA1NjI0 OSAwMDAwMCBuIAowMDAwMDU2MjcyIDAwMDAwIG4gCjAwMDAwNTYzMTQgMDAwMDAgbiAKMDAwMDA1 NjMzMyAwMDAwMCBuIAp0cmFpbGVyCjw8IC9TaXplIDU1IC9Sb290IDQwIDAgUiAvSW5mbyAxIDAg UiAvSUQgWyA8ZGUwOWEyNTBmOTg0ZWJlZTk4MjZkMmE5YTFkODgyNjk+CjxkZTA5YTI1MGY5ODRl YmVlOTgyNmQyYTlhMWQ4ODI2OT4gXSA+PgpzdGFydHhyZWYKNTY1MzEKJSVFT0YK --Apple-Mail=_032A34C1-5479-4F44-8969-96775BE981DA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > - Poor credential filtering options +1 yes, that would be useful to have improvements here >=20 > Is the TLS WG aware of these shortcomings? > Is the TLS WG aware of the fact that most consumer PKIs have invented = their own application-level PKI-authentication method to circumvent this = issues? > Is this what we should expect be the future as well? >=20 > thanx, > Anders > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls Social Web Architect http://bblfish.net/ --Apple-Mail=_032A34C1-5479-4F44-8969-96775BE981DA-- --Apple-Mail=_7BCE6FA4-1AFD-433F-A1C0-32E7C85EBCF0 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPDTCCByMw ggYLoAMCAQICAwTQYzANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0 YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENB MB4XDTEyMDgyOTAxNDU1NloXDTEzMDgzMDA5MjM0MFowZTEZMBcGA1UEDRMQazQ2eDlvOXJDRE5m VzMwYzEgMB4GA1UEAwwXaGVucnkuc3RvcnlAYmJsZmlzaC5uZXQxJjAkBgkqhkiG9w0BCQEWF2hl bnJ5LnN0b3J5QGJibGZpc2gubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArHXp EmiifOSpudkJn1vAnFdZsuaLuYYLbdWL47o1rKD/kg8/RJUmTIM2ara4e/MOxR16mu2fyAca3H1U oIXNNXDbYQDu2PkfLoNSM5JGAoYbfB0nXBK//ZecidVMZ8eExd02/vFzo5vj9kQNaAPSYirid5xe 1cV9Y1RFjlEozuYAUhU8zi3taf22JM45ii2YrCEgVjDdez8yio0QoJeKEEL3JhL4tqpkbfIOHmdi HYx00S6YcCogDfxXc3zOJ3jcIj/F61eXG1qWX/lq9RAyoBjYHLWE2iHQPwdzum03ubcvOTlohqOR +/cVzvx10l6bJ46KitfbydXMh8HoY7QcmwIDAQABo4IDsjCCA64wCQYDVR0TBAIwADALBgNVHQ8E BAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBQRbT9qwRblII9x nAN2FlEMUD1LQzAfBgNVHSMEGDAWgBRTcu2SnODaywFcfH6WNU7y1LhRgjAiBgNVHREEGzAZgRdo ZW5yeS5zdG9yeUBiYmxmaXNoLm5ldDCCAiEGA1UdIASCAhgwggIUMIICEAYLKwYBBAGBtTcBAgIw ggH/MC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQGCCsG AQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIH3BggrBgEF BQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+VGhpcyBj ZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMSBWYWxpZGF0aW9u IHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBvbmx5IGZv ciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5nIHBhcnR5 IG9ibGlnYXRpb25zLjCBnAYIKwYBBQUHAgIwgY8wJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkwAwIBAhpkTGlhYmlsaXR5IGFuZCB3YXJyYW50aWVzIGFyZSBsaW1pdGVkISBTZWUg c2VjdGlvbiAiTGVnYWwgYW5kIExpbWl0YXRpb25zIiBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5 LjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1MS1jcmwuY3Js MIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5zdGFydHNzbC5jb20v c3ViL2NsYXNzMS9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly9haWEuc3RhcnRzc2wuY29t L2NlcnRzL3N1Yi5jbGFzczEuY2xpZW50LmNhLmNydDAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0 YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALj/A19bRLmI7sMf0lVRrdN23NuRC7/UFSLZ DfcxrR1wOtQgAbrFlFLY+Otn6UWYIiWQpv2v5Ploqw9rMam5W8seC3TUt83StohXCmZ0EDmK87If B6kpd7FwJ0RFGCxn22hPU2kuhp2mbjJzCTrd3jWsXw63MXDUzHuucWGX2mY1Ji+zRECh568N7iWA 5jn9kWT+h7o7ywKbHc4qAnksghLYAnTfoCx1IPkT4/8A5hf38imhf9NcNGibrvt/e49sacf6GjRH Ot/lOCrEX2fh2YvTB5sdEKM5tjKCKNpFSqnRCKhsWZ9N9ZP7mRZfCOBjAMsm3CW2ygwlWXc54lgf p1UwggfiMIIFyqADAgECAgENMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu aW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQy MTAxNTRaFw0xMjEwMjIyMTAxNTRaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20g THRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHCYPMzi3YGrEppC4Tq5a+ijKDjKaIQZZVR63UbxIP 6uq/I0fhCu+cQhoUfE6ERKKnu8zPf1Jwuk0tsvVCk6U9b+0UjM0dLep3ZdE1gblK/1FwYT5Pipsu 2yOMluLqwvsuz9/9f1+1PKHG/FaR/wpbfuIqu54qzHDYeqiUfsYzoVflR80DAC7hmJ+SmZnNTWyU GHJbBpA8Q89lGxahNvuryGaC/o2/ceD2uYDX9U8Eg5DpIpGQdcbQeGarV04WgAUjjXX5r/2dabmt xWMZwhZna//jdiSyrrSMTGKkDiXm6/3/4ebfeZuCYKzN2P8O2F/Xe2AC/Y7zeEsnR7FOp+uXAgMB AAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAdBgNVHQ4EFgQUU3Ltkpzg2ssB XHx+ljVO8tS4UYIwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UXaYcwyjRoQ9BBrvKhgYGkfzB9MQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHmCAQEwCQYDVR0SBAIwADA9BggrBgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2Vy dC5zdGFydGNvbS5vcmcvc2ZzY2EtY3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYB BQUHAgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilo dHRwOi8vY2VydC5zdGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMw JxYgU3RhcnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmls aXR5LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29t IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIBDQRD FkFTdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVtYWlsIENl cnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAqprh4FuMzh0b/B3GLDAgoLeTJv3xArbNESi/ Kf/HMM//gf8FzwUUNOCglH6dfYuLQQ/dTtOyMb4JoiL3T7xiVKEAOmQ+t+b/xLOMa0m18zoRqW4k 6Glyoyvc7LMrdpgYk/lEh5nq8tPd9BoNmwiiheXphIVH/QelTgUkNzTC7IVpmYVsKuNOnxE1jJFZ NNfqZZK/5Oto7C6PfOut11KmBQSLZarAz0b/mjghdBsYfHuhdO8vrOvD0g5g7dA4pkOAU2Ed4pSC owBSItyD/5aFwZ75ji6Yq7GCG3BpiyAP9st8h+inc0L+7kmrAMJaLMAmu6GZs5Xgsbzn0wUJvbD9 h5jnnMM9UaZDcxl2uLB04quGUWM6NiKGabbxQc680PYbeQrQu+e6J4uqNAxzoa5RxkBA5a/3qlbg F9uJBekCqJswx5vQ9khJrs8UTMaIFzbEC5VGQziQH3/6KJ4DUP85OJEnCx/quShWA6w318LDnba3 M6a5V+KoNLhsVi/TSxf90UbBqwdRR/cOwuGkNJh16NvvhIqO26osMg64CbZsDVrEDr7uSMV40ieB JTo49Iyt77ECOhz/pyhowa2EUP6aKav+L/wXzAPB3LNqzujGR0K1pbyFWKvyYmdungJtySWUMw+R 5DqpA2bFIOE56pfWPLHZxOL+8+r79PLFX+y2V6ExggNvMIIDawIBATCBlDCBjDELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRp ZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1l ZGlhdGUgQ2xpZW50IENBAgME0GMwCQYFKw4DAhoFAKCCAa8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDA4MTQxMTQ4WjAjBgkqhkiG9w0BCQQxFgQUlZ10cFeZ 0r1eTsgTOS7MlPGphPEwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgME0GMwgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UE ChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2ln bmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGll bnQgQ0ECAwTQYzANBgkqhkiG9w0BAQEFAASCAQB152b+QkDF2HVzJx49idq92gfFpr6v4LYMjsFC YTEuaBwXOyGz+uJRXq08RSn+twNfpBIEyik2HnyuTJfghLeBJXUoRipqGOKUwkqRqhX7FbJv8YdZ mDWVVCHDjDRTKexGLfD8LknpoCHGZUKhgxh09pUxH8blfvu3SgL/Q8CaCsiQK+X2xeECfM0cbzts u+mZW4c+pv3mkJJIadAkpvXhN8x651yAAfulrp1F0+Spmyhn8Rfw0WsQoof4lRxGIIV9iB0TYqSz gj0CBQXFWpETWtqfS2yDqQJdKUqZnE3YPuhzsngk9xvVkwPYUIfcQCxAif+JqIjp3VkcxQ/9bJ2c AAAAAAAA --Apple-Mail=_7BCE6FA4-1AFD-433F-A1C0-32E7C85EBCF0-- From anders.rundgren@telia.com Mon Oct 8 07:33:20 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68D4B21F87CF for ; Mon, 8 Oct 2012 07:33:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.227 X-Spam-Level: X-Spam-Status: No, score=-3.227 tagged_above=-999 required=5 tests=[AWL=0.372, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cz5s82dCJ2jL for ; Mon, 8 Oct 2012 07:33:19 -0700 (PDT) Received: from smtp-out21.han.skanova.net (smtp-out21.han.skanova.net [195.67.226.208]) by ietfa.amsl.com (Postfix) with ESMTP id 6602E21F87A2 for ; Mon, 8 Oct 2012 07:33:19 -0700 (PDT) Received: from [192.168.3.161] (37.247.8.250) by smtp-out21.han.skanova.net (8.5.133) (authenticated as u36408181) id 503A691C01035056; Mon, 8 Oct 2012 16:33:16 +0200 Message-ID: <5072E424.5060104@telia.com> Date: Mon, 08 Oct 2012 16:33:08 +0200 From: Anders Rundgren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: Henry Story References: <5072C194.5070800@telia.com> <488C2C22-C7D2-4A04-A024-D4C8BF9244FA@bblfish.net> In-Reply-To: <488C2C22-C7D2-4A04-A024-D4C8BF9244FA@bblfish.net> X-Enigmail-Version: 1.4.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "'tls@ietf.org'" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 14:33:20 -0000 On 2012-10-08 16:11, Henry Story wrote: > On 8 Oct 2012, at 14:05, Anders Rundgren wrote: > >> TLS CCA (Client Certificate Authentication) has essentially not been updated in 15 years or so. >> Well, the underpinnings have when going from SSL 1.0 to TLS 1.2 but these enhancements were mainly about security, not about usability. >> >> >From a usability point-of-view TLS CCA suffers from many problems when used in browsers including: >> >> - Incompatible with the web session concept which forces you to introduce an IDP even for a single site > Not sure about this problem. If you have a soft certificate and login to a web-server using HTTPS with client-cert-auth you will using out-of-the-box solutions remain logged in forever regardless of web-session timeout settings. My experience here is limited to Servlets. >> - No logout > This is a UI issue. Nothing to do with TLS protocol. I believe that is a combination of server and *UA* behavior. > Here is a larger discussion with Ben Laurie on the subject recently >> - Poor credential filtering options > +1 yes, that would be useful to have improvements here > >> Is the TLS WG aware of these shortcomings? >> Is the TLS WG aware of the fact that most consumer PKIs have invented their own application-level PKI-authentication method to circumvent this issues? >> Is this what we should expect be the future as well? >> >> thanx, >> Anders >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls > Social Web Architect > http://bblfish.net/ > From ekr@rtfm.com Mon Oct 8 08:46:22 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C95321F86FF for ; Mon, 8 Oct 2012 08:46:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.684 X-Spam-Level: X-Spam-Status: No, score=-102.684 tagged_above=-999 required=5 tests=[AWL=0.293, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PRJ9fWqpvL8E for ; Mon, 8 Oct 2012 08:46:22 -0700 (PDT) Received: from mail-ee0-f44.google.com (mail-ee0-f44.google.com [74.125.83.44]) by ietfa.amsl.com (Postfix) with ESMTP id 9B67821F86F1 for ; Mon, 8 Oct 2012 08:46:21 -0700 (PDT) Received: by mail-ee0-f44.google.com with SMTP id d4so3081416eek.31 for ; Mon, 08 Oct 2012 08:46:20 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-originating-ip:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=duo4M79bQRPNfK2fqtrkguEo93cytQ9+Jmz9/6S/Yzs=; b=ReTvq/JIq9EeBzf/XpPKw756Xx5zua1RKXSiUbKyD8EjAsetEqWcye9F75hSEBMaay uFvyK6lNG1z+QKijbRMJowfNULw3EbnIZnYdvfxx6bHEuAk+Gh5xjP/qv0zm4qjPD367 NQWLSNQTop3AUZWRe+PAj5995ZT4KpDtP2OSJm9DO1qtRZ5vpVcEZ4XRNp0zycjRmGbJ OSQ4A4I6iAYvtWvQsqz9/KhntX7iwVNIrj92nZNunKmqki02DQ5+F9OdQ29r5yMoa11K /SpfwuKEA0apaxBD0XDrRaa35hsKMbFZxGtkV44eQJCL82DA+w81OBU0zLcT79Gwn0p+ ETdg== Received: by 10.14.178.195 with SMTP id f43mr23427076eem.44.1349711179804; Mon, 08 Oct 2012 08:46:19 -0700 (PDT) MIME-Version: 1.0 Received: by 10.14.144.77 with HTTP; Mon, 8 Oct 2012 08:45:39 -0700 (PDT) X-Originating-IP: [74.95.2.173] In-Reply-To: <5072C194.5070800@telia.com> References: <5072C194.5070800@telia.com> From: Eric Rescorla Date: Mon, 8 Oct 2012 08:45:39 -0700 Message-ID: To: Anders Rundgren Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQmRYzjIowcHTXDK5thgDQptQSgfEMmy2Ua/+xU9gFtU3kpCa3dJrhArjmIBHhDZPv2g7C4U Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 15:46:22 -0000 On Mon, Oct 8, 2012 at 5:05 AM, Anders Rundgren wrote: > TLS CCA (Client Certificate Authentication) has essentially not been updated in 15 years or so. > Well, the underpinnings have when going from SSL 1.0 to TLS 1.2 but these enhancements were mainly about security, not about usability. > > From a usability point-of-view TLS CCA suffers from many problems when used in browsers including: > > - Incompatible with the web session concept which forces you to introduce an IDP even for a single site > - No logout > - Poor credential filtering options > > Is the TLS WG aware of these shortcomings? > Is the TLS WG aware of the fact that most consumer PKIs have invented their own application-level PKI-authentication method to circumvent this issues? > Is this what we should expect be the future as well? Without taking a position on whether these are shortcomings or not, I think people in the TLS WG are generally aware of the technical behavior of TLS-based client auth. My general sense of the situation is as follows: - There are certain settings in which certificate-based client auth at the TLS layer has been useful, but those settings generally are not the public Web but rather things like corporate networks, etc. - All the evidence suggests that sites want to control their own authentication and want to do it in HTML and/or JS not in the transports. Passwords are a primitive instance of this, but see also OAuth, Facebook Connect, Persona, etc. - There is a lot of work going on in terms of application-level crypto (see WebCrypto, etc.) that seems like a better fit for this model. - There are a number of advantages to binding the JS/HTML/HTTP auth to the transport (OBC is an example of this) but it's probably more useful for authentication continuity and state management rather than primary authentication. None of this is to say that TLS client auth couldn't be improved, but I'd want to start with a clear use case of what it is for before we started talking about technical changed. -Ekr From henry.story@bblfish.net Mon Oct 8 09:56:36 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4012B21F87DC for ; Mon, 8 Oct 2012 09:56:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bX9m2kvFcg+U for ; Mon, 8 Oct 2012 09:56:35 -0700 (PDT) Received: from mail-wg0-f44.google.com (mail-wg0-f44.google.com [74.125.82.44]) by ietfa.amsl.com (Postfix) with ESMTP id EECE221F87DA for ; Mon, 8 Oct 2012 09:56:32 -0700 (PDT) Received: by mail-wg0-f44.google.com with SMTP id dr13so2584349wgb.13 for ; Mon, 08 Oct 2012 09:56:32 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=atcRrJNuR03OJuPXsFA0Hj/djQW+djZgtybquiAz/y4=; b=ngKKzHgdXcvZEf31/R0gpNh7XPXRumkSZbO3+tA4h75smWG3vfyCNtjUwJyEiyp6LB 2DjM57AnFFJ7rvzdX4mDPDsyDQsdCLcSJskomblV/7Fj6hY07I5v827FLiXTbesIi7Eg fKIgx2s2GSIKNO1i3TwOf7YfjkEXByKQD0hu1ahFdRSOCHAR15m6GSci9pFdUgkITXwy X5h6FNYSs2AgPqjtJka61yqFnkOf3SfDzVpep4CEof75GLgO+rWweHyuw64nuS+4Y6tV S8eVI1Md7sJVAUeCASfqT1A3mrV4W+VjMPPNOei7pIRURlY9pEztHC3Fnp7yfnQHr6wu EISA== Received: by 10.216.134.168 with SMTP id s40mr4109357wei.158.1349715391981; Mon, 08 Oct 2012 09:56:31 -0700 (PDT) Received: from bblfish.home (AAubervilliers-651-1-329-35.w83-114.abo.wanadoo.fr. [83.114.96.35]) by mx.google.com with ESMTPS id cl8sm20522034wib.10.2012.10.08.09.56.23 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 08 Oct 2012 09:56:29 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_57CE3EB9-1FE9-4418-A615-F5DB939BF5A0"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Henry Story In-Reply-To: <5072E424.5060104@telia.com> Date: Mon, 8 Oct 2012 18:56:21 +0200 Message-Id: References: <5072C194.5070800@telia.com> <488C2C22-C7D2-4A04-A024-D4C8BF9244FA@bblfish.net> <5072E424.5060104@telia.com> To: Anders Rundgren X-Mailer: Apple Mail (2.1499) X-Gm-Message-State: ALoCoQlSIHZVGGxdsGMQfE9BTSb2ks8ZWtVlbmAtGuPc0o7NWB8FBSIip2rJVQKHf0Gn7bA8ymG3 Cc: "'tls@ietf.org'" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 16:56:36 -0000 --Apple-Mail=_57CE3EB9-1FE9-4418-A615-F5DB939BF5A0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 On 8 Oct 2012, at 16:33, Anders Rundgren = wrote: > On 2012-10-08 16:11, Henry Story wrote: >> On 8 Oct 2012, at 14:05, Anders Rundgren = wrote: >>=20 >>> TLS CCA (Client Certificate Authentication) has essentially not been = updated in 15 years or so. >>> Well, the underpinnings have when going from SSL 1.0 to TLS 1.2 but = these enhancements were mainly about security, not about usability. >>>=20 >>>> =46rom a usability point-of-view TLS CCA suffers from many problems = when used in browsers including: >>>=20 >>> - Incompatible with the web session concept which forces you to = introduce an IDP even for a single site >> Not sure about this problem. >=20 > If you have a soft certificate and login to a web-server using HTTPS = with client-cert-auth you will > using out-of-the-box solutions remain logged in forever regardless of = web-session timeout settings. > My experience here is limited to Servlets. yes, this is a problem in the client. The client should log the user = out when the user wants to. This is a problem because the client keeps sending the certificate. see the e-mail excange with Ben Laurie I linked to below. >=20 >=20 >>> - No logout >> This is a UI issue. Nothing to do with TLS protocol.=20 > I believe that is a combination of server and *UA* behavior. The most important problem from the client side is that the clients do = now show how the client is authenticated. If they did then the user would also be = able to=20 log out in a key stroke. There is something that can be done at the server layer too, but the = biggest issue is client side. Currently the client sends back the same certificate all = the time, and neither the user nor the server ( except for some javascript in = firefox ) can control the logout elegantly. >=20 >> Here is a larger discussion with Ben Laurie on the subject recently The mail did not get through due to the attachment exceeding 50k. Here = it is in pdf form = http://lists.w3.org/Archives/Public/public-webid/2012Oct/att-0022/privacy-= definition-final.pdf which is easier to read than the the thread http://lists.w3.org/Archives/Public/public-webid/2012Sep/thread.html >=20 >>> - Poor credential filtering options >> +1 yes, that would be useful to have improvements here To be precise I would like to be able to filter client certificates on = some capabilities in the certificate. For http://webid.info/ all we would need would be a way to ask for = certificates with WebID. We can simulate this with DN, but it would be nice to have something better. >>=20 >>> Is the TLS WG aware of these shortcomings? >>> Is the TLS WG aware of the fact that most consumer PKIs have = invented their own application-level PKI-authentication method to = circumvent this issues? >>> Is this what we should expect be the future as well? >>>=20 >>> thanx, >>> Anders >>> _______________________________________________ >>> TLS mailing list >>> TLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/tls >> Social Web Architect >> http://bblfish.net/ >>=20 >=20 >=20 Social Web Architect http://bblfish.net/ --Apple-Mail=_57CE3EB9-1FE9-4418-A615-F5DB939BF5A0 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPDTCCByMw ggYLoAMCAQICAwTQYzANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0 YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENB MB4XDTEyMDgyOTAxNDU1NloXDTEzMDgzMDA5MjM0MFowZTEZMBcGA1UEDRMQazQ2eDlvOXJDRE5m VzMwYzEgMB4GA1UEAwwXaGVucnkuc3RvcnlAYmJsZmlzaC5uZXQxJjAkBgkqhkiG9w0BCQEWF2hl bnJ5LnN0b3J5QGJibGZpc2gubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArHXp EmiifOSpudkJn1vAnFdZsuaLuYYLbdWL47o1rKD/kg8/RJUmTIM2ara4e/MOxR16mu2fyAca3H1U oIXNNXDbYQDu2PkfLoNSM5JGAoYbfB0nXBK//ZecidVMZ8eExd02/vFzo5vj9kQNaAPSYirid5xe 1cV9Y1RFjlEozuYAUhU8zi3taf22JM45ii2YrCEgVjDdez8yio0QoJeKEEL3JhL4tqpkbfIOHmdi HYx00S6YcCogDfxXc3zOJ3jcIj/F61eXG1qWX/lq9RAyoBjYHLWE2iHQPwdzum03ubcvOTlohqOR +/cVzvx10l6bJ46KitfbydXMh8HoY7QcmwIDAQABo4IDsjCCA64wCQYDVR0TBAIwADALBgNVHQ8E BAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBQRbT9qwRblII9x nAN2FlEMUD1LQzAfBgNVHSMEGDAWgBRTcu2SnODaywFcfH6WNU7y1LhRgjAiBgNVHREEGzAZgRdo ZW5yeS5zdG9yeUBiYmxmaXNoLm5ldDCCAiEGA1UdIASCAhgwggIUMIICEAYLKwYBBAGBtTcBAgIw ggH/MC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQGCCsG AQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIH3BggrBgEF BQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+VGhpcyBj ZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMSBWYWxpZGF0aW9u IHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBvbmx5IGZv ciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5nIHBhcnR5 IG9ibGlnYXRpb25zLjCBnAYIKwYBBQUHAgIwgY8wJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkwAwIBAhpkTGlhYmlsaXR5IGFuZCB3YXJyYW50aWVzIGFyZSBsaW1pdGVkISBTZWUg c2VjdGlvbiAiTGVnYWwgYW5kIExpbWl0YXRpb25zIiBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5 LjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1MS1jcmwuY3Js MIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5zdGFydHNzbC5jb20v c3ViL2NsYXNzMS9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly9haWEuc3RhcnRzc2wuY29t L2NlcnRzL3N1Yi5jbGFzczEuY2xpZW50LmNhLmNydDAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0 YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALj/A19bRLmI7sMf0lVRrdN23NuRC7/UFSLZ DfcxrR1wOtQgAbrFlFLY+Otn6UWYIiWQpv2v5Ploqw9rMam5W8seC3TUt83StohXCmZ0EDmK87If B6kpd7FwJ0RFGCxn22hPU2kuhp2mbjJzCTrd3jWsXw63MXDUzHuucWGX2mY1Ji+zRECh568N7iWA 5jn9kWT+h7o7ywKbHc4qAnksghLYAnTfoCx1IPkT4/8A5hf38imhf9NcNGibrvt/e49sacf6GjRH Ot/lOCrEX2fh2YvTB5sdEKM5tjKCKNpFSqnRCKhsWZ9N9ZP7mRZfCOBjAMsm3CW2ygwlWXc54lgf p1UwggfiMIIFyqADAgECAgENMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu aW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQy MTAxNTRaFw0xMjEwMjIyMTAxNTRaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20g THRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHCYPMzi3YGrEppC4Tq5a+ijKDjKaIQZZVR63UbxIP 6uq/I0fhCu+cQhoUfE6ERKKnu8zPf1Jwuk0tsvVCk6U9b+0UjM0dLep3ZdE1gblK/1FwYT5Pipsu 2yOMluLqwvsuz9/9f1+1PKHG/FaR/wpbfuIqu54qzHDYeqiUfsYzoVflR80DAC7hmJ+SmZnNTWyU GHJbBpA8Q89lGxahNvuryGaC/o2/ceD2uYDX9U8Eg5DpIpGQdcbQeGarV04WgAUjjXX5r/2dabmt xWMZwhZna//jdiSyrrSMTGKkDiXm6/3/4ebfeZuCYKzN2P8O2F/Xe2AC/Y7zeEsnR7FOp+uXAgMB AAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAdBgNVHQ4EFgQUU3Ltkpzg2ssB XHx+ljVO8tS4UYIwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UXaYcwyjRoQ9BBrvKhgYGkfzB9MQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHmCAQEwCQYDVR0SBAIwADA9BggrBgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2Vy dC5zdGFydGNvbS5vcmcvc2ZzY2EtY3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYB BQUHAgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilo dHRwOi8vY2VydC5zdGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMw JxYgU3RhcnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmls aXR5LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29t IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIBDQRD FkFTdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVtYWlsIENl cnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAqprh4FuMzh0b/B3GLDAgoLeTJv3xArbNESi/ Kf/HMM//gf8FzwUUNOCglH6dfYuLQQ/dTtOyMb4JoiL3T7xiVKEAOmQ+t+b/xLOMa0m18zoRqW4k 6Glyoyvc7LMrdpgYk/lEh5nq8tPd9BoNmwiiheXphIVH/QelTgUkNzTC7IVpmYVsKuNOnxE1jJFZ NNfqZZK/5Oto7C6PfOut11KmBQSLZarAz0b/mjghdBsYfHuhdO8vrOvD0g5g7dA4pkOAU2Ed4pSC owBSItyD/5aFwZ75ji6Yq7GCG3BpiyAP9st8h+inc0L+7kmrAMJaLMAmu6GZs5Xgsbzn0wUJvbD9 h5jnnMM9UaZDcxl2uLB04quGUWM6NiKGabbxQc680PYbeQrQu+e6J4uqNAxzoa5RxkBA5a/3qlbg F9uJBekCqJswx5vQ9khJrs8UTMaIFzbEC5VGQziQH3/6KJ4DUP85OJEnCx/quShWA6w318LDnba3 M6a5V+KoNLhsVi/TSxf90UbBqwdRR/cOwuGkNJh16NvvhIqO26osMg64CbZsDVrEDr7uSMV40ieB JTo49Iyt77ECOhz/pyhowa2EUP6aKav+L/wXzAPB3LNqzujGR0K1pbyFWKvyYmdungJtySWUMw+R 5DqpA2bFIOE56pfWPLHZxOL+8+r79PLFX+y2V6ExggNvMIIDawIBATCBlDCBjDELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRp ZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1l ZGlhdGUgQ2xpZW50IENBAgME0GMwCQYFKw4DAhoFAKCCAa8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDA4MTY1NjIyWjAjBgkqhkiG9w0BCQQxFgQUjonFRh59 Wu8R4KrrCK+Ne/FHD0MwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgME0GMwgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UE ChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2ln bmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGll bnQgQ0ECAwTQYzANBgkqhkiG9w0BAQEFAASCAQB0QrWGNFYVqHwW+IZ8YpnVCdUEuVXPrUEy3D1T 7ELhy3xZvFBLNAVPGJAxL0RVbolKsmy2shoX9fA5Np1nlyiw/oBpUhttiEHZ6EHjpH3nfQh+h7ln odNhJhjb6UGQZxZiSmLilu2BBCxV5gdxcnkI+3DIa20QT9DoJpcmTor/DoVjl07dh2RPDz57eZyr VLwL5YMQbEFip247kjaQf32He+RQjsgbu4OkaxcpfSxs7goZ4Fd7RR3wNBAtUJ8QeiDAihMl1bVg p+ZAHpAxx/G3dnI/Y1x+hoZ0qOakUfvFN8up9VeYjXHhlZCWSdouS64AVOeaPh5d7so9JRGsyle1 AAAAAAAA --Apple-Mail=_57CE3EB9-1FE9-4418-A615-F5DB939BF5A0-- From henry.story@bblfish.net Mon Oct 8 10:19:31 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 362A121F86EC for ; Mon, 8 Oct 2012 10:19:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.289 X-Spam-Level: X-Spam-Status: No, score=-3.289 tagged_above=-999 required=5 tests=[AWL=0.310, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wc0eWMbP55sr for ; Mon, 8 Oct 2012 10:19:30 -0700 (PDT) Received: from mail-wi0-f178.google.com (mail-wi0-f178.google.com [209.85.212.178]) by ietfa.amsl.com (Postfix) with ESMTP id ED2A721F86B1 for ; Mon, 8 Oct 2012 10:19:29 -0700 (PDT) Received: by mail-wi0-f178.google.com with SMTP id hr7so3096732wib.13 for ; Mon, 08 Oct 2012 10:19:29 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=ZPa5aub//MYtjxxIPYXuImEei09PgEQ4h+YE6LMhpjw=; b=Xh/E+jMhNQNctQ+o5aPNwF48LjsCK/x3nQ3zQek0DEfxULT80PywOtMoZHdtUeqX2n fLpt0ZJWJMIdNoY97lkoo8zTbhzY9S/2Jxx+pTHnyPxtN+ncxPWcPPhIswLBznE4DCr0 YlAqsDZ5oiIARoMf9SRTC6DmkhF8+KKDZmfdXLNJx46hEjQqunZWSlbTsNvsAClLobph E57qzREQ28ueCa9yWHv9mwhd1I9IHWxaJconTOmtKG7/K56NJBsR7SBy3blSI7Ggo9D8 SWyP//0aEDJPgoTXOBDIrmU0/Fj0mGePlSn3ifhjBo03AxSa0HfyEA+k1zTqi0La0KQq F9yw== Received: by 10.180.85.99 with SMTP id g3mr23459760wiz.5.1349716769025; Mon, 08 Oct 2012 10:19:29 -0700 (PDT) Received: from bblfish.home (AAubervilliers-651-1-329-35.w83-114.abo.wanadoo.fr. [83.114.96.35]) by mx.google.com with ESMTPS id a10sm23196495wiz.4.2012.10.08.10.19.15 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 08 Oct 2012 10:19:27 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_14BF1280-21A0-4DAB-A724-9C12DD3F15E5"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Henry Story In-Reply-To: Date: Mon, 8 Oct 2012 19:19:13 +0200 Message-Id: References: <5072C194.5070800@telia.com> To: Eric Rescorla X-Mailer: Apple Mail (2.1499) X-Gm-Message-State: ALoCoQmLO90qhdnk7L6u6K9PgKN4i2nl1FYnH9GMC/bVCx+AT+jH2KMW2Z3hs4lTjDECHH6tEgPR Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 17:19:31 -0000 --Apple-Mail=_14BF1280-21A0-4DAB-A724-9C12DD3F15E5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 8 Oct 2012, at 17:45, Eric Rescorla wrote: > On Mon, Oct 8, 2012 at 5:05 AM, Anders Rundgren > wrote: >> TLS CCA (Client Certificate Authentication) has essentially not been = updated in 15 years or so. >> Well, the underpinnings have when going from SSL 1.0 to TLS 1.2 but = these enhancements were mainly about security, not about usability. >>=20 >> =46rom a usability point-of-view TLS CCA suffers from many problems = when used in browsers including: >>=20 >> - Incompatible with the web session concept which forces you to = introduce an IDP even for a single site >> - No logout >> - Poor credential filtering options >>=20 >> Is the TLS WG aware of these shortcomings? >> Is the TLS WG aware of the fact that most consumer PKIs have invented = their own application-level PKI-authentication method to circumvent this = issues? >> Is this what we should expect be the future as well? >=20 > Without taking a position on whether these are shortcomings or not, I = think > people in the TLS WG are generally aware of the technical behavior of > TLS-based client auth. >=20 > My general sense of the situation is as follows: >=20 > - There are certain settings in which certificate-based client auth at > the TLS layer > has been useful, but those settings generally are not the public Web = but > rather things like corporate networks, etc. > - All the evidence suggests that sites want to control their own = authentication > and want to do it in HTML and/or JS not in the transports. Passwords = are > a primitive instance of this, but see also OAuth, Facebook Connect, = Persona, > etc. > - There is a lot of work going on in terms of application-level crypto > (see WebCrypto, etc.) that seems like a better fit for this model. > - There are a number of advantages to binding the JS/HTML/HTTP auth to = the > transport (OBC is an example of this) but it's probably more useful = for > authentication continuity and state management rather than primary > authentication. >=20 > None of this is to say that TLS client auth couldn't be improved, but > I'd want to > start with a clear use case of what it is for before we started = talking about > technical changed. I'd disagree with you on your emphasis. In my view the JS crypto is = going to be ok as a fallback for authentication, but TLS is mostly where things need to = be. Most=20 things JS crypto can do for authentication would be better done at the = TLS layer=20 because. TLS is more efficient - JS is a Turing complete language that = is not needed=20 for auth. And simpler languages are better and more secure. For robots = doing=20 authentication on the web, it is a lot more efficient to have TLS. Even = for rich web=20 clients one can do everything that is needed declaratively rather than = by using JS. =20 But people in crypto need to understand the importance of linkability to = privacy. Because that is where the real use serious uses cases are. See=20 = http://lists.w3.org/Archives/Public/public-privacy/2012OctDec/0003.html Henry >=20 > -Ekr > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls Social Web Architect http://bblfish.net/ --Apple-Mail=_14BF1280-21A0-4DAB-A724-9C12DD3F15E5 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPDTCCByMw ggYLoAMCAQICAwTQYzANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0 YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENB MB4XDTEyMDgyOTAxNDU1NloXDTEzMDgzMDA5MjM0MFowZTEZMBcGA1UEDRMQazQ2eDlvOXJDRE5m VzMwYzEgMB4GA1UEAwwXaGVucnkuc3RvcnlAYmJsZmlzaC5uZXQxJjAkBgkqhkiG9w0BCQEWF2hl bnJ5LnN0b3J5QGJibGZpc2gubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArHXp EmiifOSpudkJn1vAnFdZsuaLuYYLbdWL47o1rKD/kg8/RJUmTIM2ara4e/MOxR16mu2fyAca3H1U oIXNNXDbYQDu2PkfLoNSM5JGAoYbfB0nXBK//ZecidVMZ8eExd02/vFzo5vj9kQNaAPSYirid5xe 1cV9Y1RFjlEozuYAUhU8zi3taf22JM45ii2YrCEgVjDdez8yio0QoJeKEEL3JhL4tqpkbfIOHmdi HYx00S6YcCogDfxXc3zOJ3jcIj/F61eXG1qWX/lq9RAyoBjYHLWE2iHQPwdzum03ubcvOTlohqOR +/cVzvx10l6bJ46KitfbydXMh8HoY7QcmwIDAQABo4IDsjCCA64wCQYDVR0TBAIwADALBgNVHQ8E BAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBQRbT9qwRblII9x nAN2FlEMUD1LQzAfBgNVHSMEGDAWgBRTcu2SnODaywFcfH6WNU7y1LhRgjAiBgNVHREEGzAZgRdo ZW5yeS5zdG9yeUBiYmxmaXNoLm5ldDCCAiEGA1UdIASCAhgwggIUMIICEAYLKwYBBAGBtTcBAgIw ggH/MC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQGCCsG AQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIH3BggrBgEF BQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+VGhpcyBj ZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMSBWYWxpZGF0aW9u IHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBvbmx5IGZv ciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5nIHBhcnR5 IG9ibGlnYXRpb25zLjCBnAYIKwYBBQUHAgIwgY8wJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkwAwIBAhpkTGlhYmlsaXR5IGFuZCB3YXJyYW50aWVzIGFyZSBsaW1pdGVkISBTZWUg c2VjdGlvbiAiTGVnYWwgYW5kIExpbWl0YXRpb25zIiBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5 LjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1MS1jcmwuY3Js MIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5zdGFydHNzbC5jb20v c3ViL2NsYXNzMS9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly9haWEuc3RhcnRzc2wuY29t L2NlcnRzL3N1Yi5jbGFzczEuY2xpZW50LmNhLmNydDAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0 YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALj/A19bRLmI7sMf0lVRrdN23NuRC7/UFSLZ DfcxrR1wOtQgAbrFlFLY+Otn6UWYIiWQpv2v5Ploqw9rMam5W8seC3TUt83StohXCmZ0EDmK87If B6kpd7FwJ0RFGCxn22hPU2kuhp2mbjJzCTrd3jWsXw63MXDUzHuucWGX2mY1Ji+zRECh568N7iWA 5jn9kWT+h7o7ywKbHc4qAnksghLYAnTfoCx1IPkT4/8A5hf38imhf9NcNGibrvt/e49sacf6GjRH Ot/lOCrEX2fh2YvTB5sdEKM5tjKCKNpFSqnRCKhsWZ9N9ZP7mRZfCOBjAMsm3CW2ygwlWXc54lgf p1UwggfiMIIFyqADAgECAgENMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu aW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQy MTAxNTRaFw0xMjEwMjIyMTAxNTRaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20g THRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHCYPMzi3YGrEppC4Tq5a+ijKDjKaIQZZVR63UbxIP 6uq/I0fhCu+cQhoUfE6ERKKnu8zPf1Jwuk0tsvVCk6U9b+0UjM0dLep3ZdE1gblK/1FwYT5Pipsu 2yOMluLqwvsuz9/9f1+1PKHG/FaR/wpbfuIqu54qzHDYeqiUfsYzoVflR80DAC7hmJ+SmZnNTWyU GHJbBpA8Q89lGxahNvuryGaC/o2/ceD2uYDX9U8Eg5DpIpGQdcbQeGarV04WgAUjjXX5r/2dabmt xWMZwhZna//jdiSyrrSMTGKkDiXm6/3/4ebfeZuCYKzN2P8O2F/Xe2AC/Y7zeEsnR7FOp+uXAgMB AAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAdBgNVHQ4EFgQUU3Ltkpzg2ssB XHx+ljVO8tS4UYIwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UXaYcwyjRoQ9BBrvKhgYGkfzB9MQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHmCAQEwCQYDVR0SBAIwADA9BggrBgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2Vy dC5zdGFydGNvbS5vcmcvc2ZzY2EtY3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYB BQUHAgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilo dHRwOi8vY2VydC5zdGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMw JxYgU3RhcnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmls aXR5LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29t IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIBDQRD FkFTdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVtYWlsIENl cnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAqprh4FuMzh0b/B3GLDAgoLeTJv3xArbNESi/ Kf/HMM//gf8FzwUUNOCglH6dfYuLQQ/dTtOyMb4JoiL3T7xiVKEAOmQ+t+b/xLOMa0m18zoRqW4k 6Glyoyvc7LMrdpgYk/lEh5nq8tPd9BoNmwiiheXphIVH/QelTgUkNzTC7IVpmYVsKuNOnxE1jJFZ NNfqZZK/5Oto7C6PfOut11KmBQSLZarAz0b/mjghdBsYfHuhdO8vrOvD0g5g7dA4pkOAU2Ed4pSC owBSItyD/5aFwZ75ji6Yq7GCG3BpiyAP9st8h+inc0L+7kmrAMJaLMAmu6GZs5Xgsbzn0wUJvbD9 h5jnnMM9UaZDcxl2uLB04quGUWM6NiKGabbxQc680PYbeQrQu+e6J4uqNAxzoa5RxkBA5a/3qlbg F9uJBekCqJswx5vQ9khJrs8UTMaIFzbEC5VGQziQH3/6KJ4DUP85OJEnCx/quShWA6w318LDnba3 M6a5V+KoNLhsVi/TSxf90UbBqwdRR/cOwuGkNJh16NvvhIqO26osMg64CbZsDVrEDr7uSMV40ieB JTo49Iyt77ECOhz/pyhowa2EUP6aKav+L/wXzAPB3LNqzujGR0K1pbyFWKvyYmdungJtySWUMw+R 5DqpA2bFIOE56pfWPLHZxOL+8+r79PLFX+y2V6ExggNvMIIDawIBATCBlDCBjDELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRp ZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1l ZGlhdGUgQ2xpZW50IENBAgME0GMwCQYFKw4DAhoFAKCCAa8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDA4MTcxOTE0WjAjBgkqhkiG9w0BCQQxFgQU10B3KqEB U2bXSrei7FpZzcE2j0MwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgME0GMwgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UE ChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2ln bmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGll bnQgQ0ECAwTQYzANBgkqhkiG9w0BAQEFAASCAQBDINH7W8TrscRSEKACU4EY0wlrwdmYcI9EzuAG OYqXoSk9nChBU0iwmeQF+c+69N3ec5FAwW3QaLKVdEoByOu+cQyAieymqHfs8/SI4Iv9am/vmkrF EFMzhX3rxwCs91+rYkMTAShVkupkZuuYtgajn7jyUj7LbbIFuwrBMmWvINoI4hFhl2RJ1kayId7z 08+cs25Xw1J0F0kJHoQf2f+3Ng8vwPlbZwFmUVcK/j1/SvrWutkgWBK6rglwhdrts92mYqf1xkZJ 6DABYSvrqN2t8VMzHA5Mc730wEWV1gsg0s/Z28rPvEvtQ3ymKv8c8yyjgyMp/msaP0mSdnH/U18T AAAAAAAA --Apple-Mail=_14BF1280-21A0-4DAB-A724-9C12DD3F15E5-- From ekr@rtfm.com Mon Oct 8 10:43:20 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B3F521F8800 for ; Mon, 8 Oct 2012 10:43:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.705 X-Spam-Level: X-Spam-Status: No, score=-102.705 tagged_above=-999 required=5 tests=[AWL=0.272, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I0vMJzBuPuAr for ; Mon, 8 Oct 2012 10:43:20 -0700 (PDT) Received: from mail-ea0-f172.google.com (mail-ea0-f172.google.com [209.85.215.172]) by ietfa.amsl.com (Postfix) with ESMTP id B7D9421F87FC for ; Mon, 8 Oct 2012 10:43:19 -0700 (PDT) Received: by mail-ea0-f172.google.com with SMTP id k13so218984eaa.31 for ; Mon, 08 Oct 2012 10:43:18 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-originating-ip:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=Pw8iyrUxArIlJBp8oToQi1p/Zd0diK3C8F/ZlY7Sn+8=; b=jnTlSaaF8zbF3paiIQfqTKOgC8nR3cnLuRzqSus+Gf3SotSXSK/MhGnzV8KWHADayd BktrwQd8K7SzXxjAOyWb2h2pNjm6zIBHJfIMKuz4SPRhxHdl8mD88f6/tEMhe5PI93pd XBUXW7x+OWkq8iNKtz9zBVibtY3EIlAFn4U/ihmAu9P01/mQFZavBZ9UC1YGSjrtDo/c dkYIPrDe5vt7TX8u86JZMq/6EDt1N8WS1bf7xlxAtDd2Ew4x/xjth37ECzM3DV3v8a0e u2vkJTGfWWnlKXurXuwhIZUj4jxuuO/DlFYruoq2rVu8xbQ8WJ00H/wF3NzqHGcy12k5 wzsg== Received: by 10.14.223.4 with SMTP id u4mr23718511eep.19.1349718198812; Mon, 08 Oct 2012 10:43:18 -0700 (PDT) MIME-Version: 1.0 Received: by 10.14.144.77 with HTTP; Mon, 8 Oct 2012 10:42:38 -0700 (PDT) X-Originating-IP: [74.95.2.173] In-Reply-To: References: <5072C194.5070800@telia.com> From: Eric Rescorla Date: Mon, 8 Oct 2012 10:42:38 -0700 Message-ID: To: Henry Story Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQmQunBdoke60KxgB4H332TbsYiucVGRo8b9AkX9NGi91AUXxNd+xai8KpRDoEdB+7YtkqYO Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 17:43:20 -0000 On Mon, Oct 8, 2012 at 10:19 AM, Henry Story wrote: > > On 8 Oct 2012, at 17:45, Eric Rescorla wrote: > >> On Mon, Oct 8, 2012 at 5:05 AM, Anders Rundgren >> wrote: >>> TLS CCA (Client Certificate Authentication) has essentially not been updated in 15 years or so. >>> Well, the underpinnings have when going from SSL 1.0 to TLS 1.2 but these enhancements were mainly about security, not about usability. >>> >>> From a usability point-of-view TLS CCA suffers from many problems when used in browsers including: >>> >>> - Incompatible with the web session concept which forces you to introduce an IDP even for a single site >>> - No logout >>> - Poor credential filtering options >>> >>> Is the TLS WG aware of these shortcomings? >>> Is the TLS WG aware of the fact that most consumer PKIs have invented their own application-level PKI-authentication method to circumvent this issues? >>> Is this what we should expect be the future as well? >> >> Without taking a position on whether these are shortcomings or not, I think >> people in the TLS WG are generally aware of the technical behavior of >> TLS-based client auth. >> >> My general sense of the situation is as follows: >> >> - There are certain settings in which certificate-based client auth at >> the TLS layer >> has been useful, but those settings generally are not the public Web but >> rather things like corporate networks, etc. >> - All the evidence suggests that sites want to control their own authentication >> and want to do it in HTML and/or JS not in the transports. Passwords are >> a primitive instance of this, but see also OAuth, Facebook Connect, Persona, >> etc. >> - There is a lot of work going on in terms of application-level crypto >> (see WebCrypto, etc.) that seems like a better fit for this model. >> - There are a number of advantages to binding the JS/HTML/HTTP auth to the >> transport (OBC is an example of this) but it's probably more useful for >> authentication continuity and state management rather than primary >> authentication. >> >> None of this is to say that TLS client auth couldn't be improved, but >> I'd want to >> start with a clear use case of what it is for before we started talking about >> technical changed. > > I'd disagree with you on your emphasis. In my view the JS crypto is going to be ok as > a fallback for authentication, but TLS is mostly where things need to be. I don't see any evidence that major sites have any interest in this. Quite the contrary, sites go out of their way to gain control of the authentication process and that means having it controlled by JS and HTML. I'm neither endorsing nor condemning this trend, just saying that that's how things are. Again, I'd encourage you to describe a set of use cases that demand a change to TLS and show that there is real interest in them from site operators and the like. -Ekr From henry.story@bblfish.net Mon Oct 8 11:03:24 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2652121F87A8 for ; Mon, 8 Oct 2012 11:03:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.067 X-Spam-Level: X-Spam-Status: No, score=-3.067 tagged_above=-999 required=5 tests=[AWL=-0.068, BAYES_00=-2.599, J_CHICKENPOX_36=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IXKrJT70d2Qy for ; Mon, 8 Oct 2012 11:03:23 -0700 (PDT) Received: from mail-wi0-f178.google.com (mail-wi0-f178.google.com [209.85.212.178]) by ietfa.amsl.com (Postfix) with ESMTP id CA10221F86F9 for ; Mon, 8 Oct 2012 11:03:22 -0700 (PDT) Received: by mail-wi0-f178.google.com with SMTP id hr7so3139319wib.13 for ; Mon, 08 Oct 2012 11:03:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=a+ub2Uasja0Nxjy3pNVuvEDIgShQmH/AigyZsJcfnDY=; b=XOA3To9h3n4tk22uPEP7C9O+8mgIQI5n1zrIpC7Z6epsQxtyO4kcNkZs2IC2ya7aYF x/Rj4OuFKHVHFnU9WEos+YJXJNaeSb9e7ip+bpS4euSOf57puLKApP/8sam93mBN7xBM x3pcEDEh3kQZnbo3D9u9+nry1oAQD5r2S7m0bXW7ftmcM7UBYUvQcFOAMLvGkUxSVaAr YYsfNWh3ZCc8tBVj8Iv/HltVVlQtifJNITHAcI8qeuzJXe0FoGvEFZF8MlXtKtH8m8bc 6QG9jWju6UNyl6gdBjyXkaP1QGvspd0lzd9rhf5gKzc6MKmHpzO7oCJ3R1yT7FTpCUbr XewQ== Received: by 10.216.207.28 with SMTP id m28mr605131weo.52.1349719401980; Mon, 08 Oct 2012 11:03:21 -0700 (PDT) Received: from bblfish.home (AAubervilliers-651-1-329-35.w83-114.abo.wanadoo.fr. [83.114.96.35]) by mx.google.com with ESMTPS id cn6sm23425421wib.9.2012.10.08.11.03.14 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 08 Oct 2012 11:03:18 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_DF56082F-54AE-4F02-9DA1-053666FB229C"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Henry Story In-Reply-To: Date: Mon, 8 Oct 2012 20:03:13 +0200 Message-Id: <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> References: <5072C194.5070800@telia.com> To: Eric Rescorla X-Mailer: Apple Mail (2.1499) X-Gm-Message-State: ALoCoQljZ9SvqO7aZZMondCijPD2sM1abSfWa+9tpWib2wb4Ozf1ZTn4zKc91+HvA3EtTWxjTaq5 Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 18:03:24 -0000 --Apple-Mail=_DF56082F-54AE-4F02-9DA1-053666FB229C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 On 8 Oct 2012, at 19:42, Eric Rescorla wrote: > On Mon, Oct 8, 2012 at 10:19 AM, Henry Story = wrote: >>=20 >> On 8 Oct 2012, at 17:45, Eric Rescorla wrote: >>=20 >>> On Mon, Oct 8, 2012 at 5:05 AM, Anders Rundgren >>> wrote: >>>> TLS CCA (Client Certificate Authentication) has essentially not = been updated in 15 years or so. >>>> Well, the underpinnings have when going from SSL 1.0 to TLS 1.2 but = these enhancements were mainly about security, not about usability. >>>>=20 >>>> =46rom a usability point-of-view TLS CCA suffers from many problems = when used in browsers including: >>>>=20 >>>> - Incompatible with the web session concept which forces you to = introduce an IDP even for a single site >>>> - No logout >>>> - Poor credential filtering options >>>>=20 >>>> Is the TLS WG aware of these shortcomings? >>>> Is the TLS WG aware of the fact that most consumer PKIs have = invented their own application-level PKI-authentication method to = circumvent this issues? >>>> Is this what we should expect be the future as well? >>>=20 >>> Without taking a position on whether these are shortcomings or not, = I think >>> people in the TLS WG are generally aware of the technical behavior = of >>> TLS-based client auth. >>>=20 >>> My general sense of the situation is as follows: >>>=20 >>> - There are certain settings in which certificate-based client auth = at >>> the TLS layer >>> has been useful, but those settings generally are not the public Web = but >>> rather things like corporate networks, etc. >>> - All the evidence suggests that sites want to control their own = authentication >>> and want to do it in HTML and/or JS not in the transports. Passwords = are >>> a primitive instance of this, but see also OAuth, Facebook Connect, = Persona, >>> etc. >>> - There is a lot of work going on in terms of application-level = crypto >>> (see WebCrypto, etc.) that seems like a better fit for this model. >>> - There are a number of advantages to binding the JS/HTML/HTTP auth = to the >>> transport (OBC is an example of this) but it's probably more useful = for >>> authentication continuity and state management rather than primary >>> authentication. >>>=20 >>> None of this is to say that TLS client auth couldn't be improved, = but >>> I'd want to >>> start with a clear use case of what it is for before we started = talking about >>> technical changed. >>=20 >> I'd disagree with you on your emphasis. In my view the JS crypto is = going to be ok as >> a fallback for authentication, but TLS is mostly where things need to = be. >=20 > I don't see any evidence that major sites have any interest in this. = Quite the > contrary, sites go out of their way to gain control of the = authentication > process and that means having it controlled by JS and HTML. I'm = neither > endorsing nor condemning this trend, just saying that that's how = things > are. I know but I don't base my thinking on trends. I base it on serious = thought on what the real political ethical privacy issues that need to be solved = are. If you go on trends then in 2007 you'd have said that the boom was going = to keep growing, and you would have lost all your money. You need to look = at the underlying issues. And you'll find as philosophers have often said that = the most constant trend is that if everybody is going one way then it's = probably a dead end they are running into. In any case the technical issues that stopped people were.=20 1. Too much power for CA -> solved by DANE 2. no good way to do linkable identity. >=20 > Again, I'd encourage you to describe a set of use cases that demand a = change > to TLS and show that there is real interest in them from site = operators and the > like. I don't think there is anything actually needing change at the TLS = layer. We can get what we need done, though a nicer certificate selection = requests from the=20 server ( not just based on DN) would be nice. =20 The rest can be done by combining existing TLS+Linked Data with UI help = from browsers. Look at WebID http://webid.info/ . There is a 10 min video there = explainging it. Also see my talk on the Philosophy of the Social Web at = http://bblfish.net/tmp/2010/10/26/ . In your previous mail you said that TLS client certs are useful for = corporate=20 networks. That is exactly where you went wrong in selling TLS. And so = the real problem with TLS is not the technology, it's the mind set of those using = it, who fail to notice that they can completely change what is possible by = combing TLS's strenght with the strenght of other technologies. But I doubt that arguing on a mailing list will make any difference. I just send a few mails here form time to time, so that those who wish = to hear can hear. Henry >=20 > -Ekr Social Web Architect http://bblfish.net/ --Apple-Mail=_DF56082F-54AE-4F02-9DA1-053666FB229C Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPDTCCByMw ggYLoAMCAQICAwTQYzANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0 YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENB MB4XDTEyMDgyOTAxNDU1NloXDTEzMDgzMDA5MjM0MFowZTEZMBcGA1UEDRMQazQ2eDlvOXJDRE5m VzMwYzEgMB4GA1UEAwwXaGVucnkuc3RvcnlAYmJsZmlzaC5uZXQxJjAkBgkqhkiG9w0BCQEWF2hl bnJ5LnN0b3J5QGJibGZpc2gubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArHXp EmiifOSpudkJn1vAnFdZsuaLuYYLbdWL47o1rKD/kg8/RJUmTIM2ara4e/MOxR16mu2fyAca3H1U oIXNNXDbYQDu2PkfLoNSM5JGAoYbfB0nXBK//ZecidVMZ8eExd02/vFzo5vj9kQNaAPSYirid5xe 1cV9Y1RFjlEozuYAUhU8zi3taf22JM45ii2YrCEgVjDdez8yio0QoJeKEEL3JhL4tqpkbfIOHmdi HYx00S6YcCogDfxXc3zOJ3jcIj/F61eXG1qWX/lq9RAyoBjYHLWE2iHQPwdzum03ubcvOTlohqOR +/cVzvx10l6bJ46KitfbydXMh8HoY7QcmwIDAQABo4IDsjCCA64wCQYDVR0TBAIwADALBgNVHQ8E BAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBQRbT9qwRblII9x nAN2FlEMUD1LQzAfBgNVHSMEGDAWgBRTcu2SnODaywFcfH6WNU7y1LhRgjAiBgNVHREEGzAZgRdo ZW5yeS5zdG9yeUBiYmxmaXNoLm5ldDCCAiEGA1UdIASCAhgwggIUMIICEAYLKwYBBAGBtTcBAgIw ggH/MC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQGCCsG AQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIH3BggrBgEF BQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+VGhpcyBj ZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMSBWYWxpZGF0aW9u IHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBvbmx5IGZv ciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5nIHBhcnR5 IG9ibGlnYXRpb25zLjCBnAYIKwYBBQUHAgIwgY8wJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkwAwIBAhpkTGlhYmlsaXR5IGFuZCB3YXJyYW50aWVzIGFyZSBsaW1pdGVkISBTZWUg c2VjdGlvbiAiTGVnYWwgYW5kIExpbWl0YXRpb25zIiBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5 LjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1MS1jcmwuY3Js MIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5zdGFydHNzbC5jb20v c3ViL2NsYXNzMS9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly9haWEuc3RhcnRzc2wuY29t L2NlcnRzL3N1Yi5jbGFzczEuY2xpZW50LmNhLmNydDAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0 YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALj/A19bRLmI7sMf0lVRrdN23NuRC7/UFSLZ DfcxrR1wOtQgAbrFlFLY+Otn6UWYIiWQpv2v5Ploqw9rMam5W8seC3TUt83StohXCmZ0EDmK87If B6kpd7FwJ0RFGCxn22hPU2kuhp2mbjJzCTrd3jWsXw63MXDUzHuucWGX2mY1Ji+zRECh568N7iWA 5jn9kWT+h7o7ywKbHc4qAnksghLYAnTfoCx1IPkT4/8A5hf38imhf9NcNGibrvt/e49sacf6GjRH Ot/lOCrEX2fh2YvTB5sdEKM5tjKCKNpFSqnRCKhsWZ9N9ZP7mRZfCOBjAMsm3CW2ygwlWXc54lgf p1UwggfiMIIFyqADAgECAgENMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu aW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQy MTAxNTRaFw0xMjEwMjIyMTAxNTRaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20g THRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHCYPMzi3YGrEppC4Tq5a+ijKDjKaIQZZVR63UbxIP 6uq/I0fhCu+cQhoUfE6ERKKnu8zPf1Jwuk0tsvVCk6U9b+0UjM0dLep3ZdE1gblK/1FwYT5Pipsu 2yOMluLqwvsuz9/9f1+1PKHG/FaR/wpbfuIqu54qzHDYeqiUfsYzoVflR80DAC7hmJ+SmZnNTWyU GHJbBpA8Q89lGxahNvuryGaC/o2/ceD2uYDX9U8Eg5DpIpGQdcbQeGarV04WgAUjjXX5r/2dabmt xWMZwhZna//jdiSyrrSMTGKkDiXm6/3/4ebfeZuCYKzN2P8O2F/Xe2AC/Y7zeEsnR7FOp+uXAgMB AAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAdBgNVHQ4EFgQUU3Ltkpzg2ssB XHx+ljVO8tS4UYIwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UXaYcwyjRoQ9BBrvKhgYGkfzB9MQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHmCAQEwCQYDVR0SBAIwADA9BggrBgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2Vy dC5zdGFydGNvbS5vcmcvc2ZzY2EtY3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYB BQUHAgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilo dHRwOi8vY2VydC5zdGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMw JxYgU3RhcnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmls aXR5LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29t IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIBDQRD FkFTdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVtYWlsIENl cnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAqprh4FuMzh0b/B3GLDAgoLeTJv3xArbNESi/ Kf/HMM//gf8FzwUUNOCglH6dfYuLQQ/dTtOyMb4JoiL3T7xiVKEAOmQ+t+b/xLOMa0m18zoRqW4k 6Glyoyvc7LMrdpgYk/lEh5nq8tPd9BoNmwiiheXphIVH/QelTgUkNzTC7IVpmYVsKuNOnxE1jJFZ NNfqZZK/5Oto7C6PfOut11KmBQSLZarAz0b/mjghdBsYfHuhdO8vrOvD0g5g7dA4pkOAU2Ed4pSC owBSItyD/5aFwZ75ji6Yq7GCG3BpiyAP9st8h+inc0L+7kmrAMJaLMAmu6GZs5Xgsbzn0wUJvbD9 h5jnnMM9UaZDcxl2uLB04quGUWM6NiKGabbxQc680PYbeQrQu+e6J4uqNAxzoa5RxkBA5a/3qlbg F9uJBekCqJswx5vQ9khJrs8UTMaIFzbEC5VGQziQH3/6KJ4DUP85OJEnCx/quShWA6w318LDnba3 M6a5V+KoNLhsVi/TSxf90UbBqwdRR/cOwuGkNJh16NvvhIqO26osMg64CbZsDVrEDr7uSMV40ieB JTo49Iyt77ECOhz/pyhowa2EUP6aKav+L/wXzAPB3LNqzujGR0K1pbyFWKvyYmdungJtySWUMw+R 5DqpA2bFIOE56pfWPLHZxOL+8+r79PLFX+y2V6ExggNvMIIDawIBATCBlDCBjDELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRp ZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1l ZGlhdGUgQ2xpZW50IENBAgME0GMwCQYFKw4DAhoFAKCCAa8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDA4MTgwMzE0WjAjBgkqhkiG9w0BCQQxFgQUDTO8N4MK ZuyLHeaBKSTMun3D3xwwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgME0GMwgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UE ChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2ln bmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGll bnQgQ0ECAwTQYzANBgkqhkiG9w0BAQEFAASCAQADtyQrNamd7RRaUsh1oX30uFDQsd3GoTC3YcGR qmbgRMbnxaMQVJ98Rwjvku1ivONxGdhu+CRDtCpIeuJfIx2Wm+j/aDq7ChFVHuSnByKM0vKU2qFN TwsT2m0kuNq6UCzyoDoHTXZqbdG9a/9JIta8CFpOdwwVgLGFeqrVfQEpHZR4/2+rU8ewFauTiNDL satGexhPnDDBDOi90PZaw6utM8ubW13iF/Z1DsGhsXDtUM/Gwfd0rkwsMC+KQrWQr8/44xTlYIg7 huw5tw2G2yVd26a1M7Vl+LOCeTZrhLaB2tjrw5LPEaIFwx86FHtYsqlcueLkCho2uJMUTQBKyN1n AAAAAAAA --Apple-Mail=_DF56082F-54AE-4F02-9DA1-053666FB229C-- From ekr@rtfm.com Mon Oct 8 11:06:07 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B90F021F87D4 for ; Mon, 8 Oct 2012 11:06:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.723 X-Spam-Level: X-Spam-Status: No, score=-102.723 tagged_above=-999 required=5 tests=[AWL=0.254, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zC994PXPjmGW for ; Mon, 8 Oct 2012 11:06:07 -0700 (PDT) Received: from mail-ee0-f44.google.com (mail-ee0-f44.google.com [74.125.83.44]) by ietfa.amsl.com (Postfix) with ESMTP id EB74B21F87C7 for ; Mon, 8 Oct 2012 11:06:06 -0700 (PDT) Received: by mail-ee0-f44.google.com with SMTP id d4so3187508eek.31 for ; Mon, 08 Oct 2012 11:06:06 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-originating-ip:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=Wi45QjU1559reHtHPjk1HpbSV8YASdqmx0f60L8k2bQ=; b=HZ7auvGxCuezAUvJjXsFbegU4xjJlQtdJNaNWj+9/R9DiBr/XgtDEFVFGmo2QQHz7L ePlt9VjGluuBx57s1EL/cVwwDc/SP8T3vtykCHvIs7DWPekeZ5CFelYeum3Z31kKhlY9 sEZPeh9iyx8xGavpME0lojn0QNwcIomG16ZMFocoYllYZyywNXwf2+6EBaZniNbA4oxZ 86Z8N19uqi+v9mt2UxWOUg915BXQxajoUi98XIjDL+FSlhcLY0JR/ZdGI0hjga/6uxG/ AkQo3NNQxdUqduSJi7Yg4zgjEbDl3ysx3DWgd54nZ8eIaKK1zuS2/h4d36hY2dtPikuT 1TEQ== Received: by 10.14.221.132 with SMTP id r4mr23851716eep.29.1349719566087; Mon, 08 Oct 2012 11:06:06 -0700 (PDT) MIME-Version: 1.0 Received: by 10.14.144.77 with HTTP; Mon, 8 Oct 2012 11:05:25 -0700 (PDT) X-Originating-IP: [74.95.2.173] In-Reply-To: <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> References: <5072C194.5070800@telia.com> <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> From: Eric Rescorla Date: Mon, 8 Oct 2012 11:05:25 -0700 Message-ID: To: Henry Story Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQmHvKtwYtFBDcxBOlrb0PGhmqWfjod5iHv/6BgEFvrZ9dDZJOyi0DTKJ41/bLZz26YfNLha Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 18:06:07 -0000 On Mon, Oct 8, 2012 at 11:03 AM, Henry Story wrote: >> Again, I'd encourage you to describe a set of use cases that demand a change >> to TLS and show that there is real interest in them from site operators and the >> like. > > I don't think there is anything actually needing change at the TLS layer. Oh, good. In that case this is off-topic for this mailing list. -Ekr From henry.story@bblfish.net Mon Oct 8 11:09:27 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94C2721F87DD for ; Mon, 8 Oct 2012 11:09:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.353 X-Spam-Level: X-Spam-Status: No, score=-3.353 tagged_above=-999 required=5 tests=[AWL=0.246, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VHW0GIcXEkWz for ; Mon, 8 Oct 2012 11:09:27 -0700 (PDT) Received: from mail-wi0-f178.google.com (mail-wi0-f178.google.com [209.85.212.178]) by ietfa.amsl.com (Postfix) with ESMTP id 9D31F21F87C3 for ; Mon, 8 Oct 2012 11:09:26 -0700 (PDT) Received: by mail-wi0-f178.google.com with SMTP id hr7so3145028wib.13 for ; Mon, 08 Oct 2012 11:09:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=05YdeugtNH9W5Q+HSeY19oYiWqyaxN8pGc9XRvfatbI=; b=HRyZDu+oZR44TAvrXkzR3L/CvBZRwwC1gAjiybryHAGm4QP8ORrsjCX9Nqo1e7qy43 1+pjcqLEt1uAbzBSCMqI3ZUrmURD6r3ed/hisz653jtOje8WFqcmjNeXl8jORgTOq/H3 qexbKRcmX6n/BciWS7/dP/7KMdYszFANyewjYd+12CujZuo/5Qhs8E7LCwOIsv3XaoNq uJfKAkVv6tk022dZLsv2rZoidXsx39GG2G+qyhcUaMAqSBbWt3vmaA+NRYlLLqxgM4ZY 7nx1vzY1ZcyVYGjV/tFZIrh1Shk+DLntCQdzYr/5jUlhoNUS2qZeXH6NuIsrRZffPflX K6RA== Received: by 10.180.93.33 with SMTP id cr1mr23120772wib.8.1349719765393; Mon, 08 Oct 2012 11:09:25 -0700 (PDT) Received: from bblfish.home (AAubervilliers-651-1-329-35.w83-114.abo.wanadoo.fr. [83.114.96.35]) by mx.google.com with ESMTPS id dt9sm20788713wib.1.2012.10.08.11.09.22 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 08 Oct 2012 11:09:24 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_FE139563-626D-416D-926B-16385D38D140"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Henry Story In-Reply-To: Date: Mon, 8 Oct 2012 20:09:20 +0200 Message-Id: References: <5072C194.5070800@telia.com> <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> To: Eric Rescorla X-Mailer: Apple Mail (2.1499) X-Gm-Message-State: ALoCoQknRuAkYLUh8Khh970oJ34Itu17D99ZQ/CtsNFSmhADQUispX4WzjsKHptJKWb/bpzYU2wN Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 18:09:27 -0000 --Apple-Mail=_FE139563-626D-416D-926B-16385D38D140 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 On 8 Oct 2012, at 20:05, Eric Rescorla wrote: > On Mon, Oct 8, 2012 at 11:03 AM, Henry Story = wrote: >>> Again, I'd encourage you to describe a set of use cases that demand = a change >>> to TLS and show that there is real interest in them from site = operators and the >>> like. >>=20 >> I don't think there is anything actually needing change at the TLS = layer. >=20 > Oh, good. In that case this is off-topic for this mailing list. It was not off topic for the mailing list, since the other person was = arguing there were changes needed and I was pointing out I disagreed. Gee the way some IETF people love to throw things off topic that makes = them question their assumptions is seriously tedious. Anyway, I did point to one change that would be nice: A way for the server to more finely select certificates not based just=20= on DNs. As far as we are concerned we can get around a lot of issues with TLS, = because arguing one to one on these lists is just not a good use of one's time. Henry >=20 > -Ekr Social Web Architect http://bblfish.net/ --Apple-Mail=_FE139563-626D-416D-926B-16385D38D140 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPDTCCByMw ggYLoAMCAQICAwTQYzANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0 YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENB MB4XDTEyMDgyOTAxNDU1NloXDTEzMDgzMDA5MjM0MFowZTEZMBcGA1UEDRMQazQ2eDlvOXJDRE5m VzMwYzEgMB4GA1UEAwwXaGVucnkuc3RvcnlAYmJsZmlzaC5uZXQxJjAkBgkqhkiG9w0BCQEWF2hl bnJ5LnN0b3J5QGJibGZpc2gubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArHXp EmiifOSpudkJn1vAnFdZsuaLuYYLbdWL47o1rKD/kg8/RJUmTIM2ara4e/MOxR16mu2fyAca3H1U oIXNNXDbYQDu2PkfLoNSM5JGAoYbfB0nXBK//ZecidVMZ8eExd02/vFzo5vj9kQNaAPSYirid5xe 1cV9Y1RFjlEozuYAUhU8zi3taf22JM45ii2YrCEgVjDdez8yio0QoJeKEEL3JhL4tqpkbfIOHmdi HYx00S6YcCogDfxXc3zOJ3jcIj/F61eXG1qWX/lq9RAyoBjYHLWE2iHQPwdzum03ubcvOTlohqOR +/cVzvx10l6bJ46KitfbydXMh8HoY7QcmwIDAQABo4IDsjCCA64wCQYDVR0TBAIwADALBgNVHQ8E BAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBQRbT9qwRblII9x nAN2FlEMUD1LQzAfBgNVHSMEGDAWgBRTcu2SnODaywFcfH6WNU7y1LhRgjAiBgNVHREEGzAZgRdo ZW5yeS5zdG9yeUBiYmxmaXNoLm5ldDCCAiEGA1UdIASCAhgwggIUMIICEAYLKwYBBAGBtTcBAgIw ggH/MC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQGCCsG AQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIH3BggrBgEF BQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+VGhpcyBj ZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMSBWYWxpZGF0aW9u IHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBvbmx5IGZv ciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5nIHBhcnR5 IG9ibGlnYXRpb25zLjCBnAYIKwYBBQUHAgIwgY8wJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkwAwIBAhpkTGlhYmlsaXR5IGFuZCB3YXJyYW50aWVzIGFyZSBsaW1pdGVkISBTZWUg c2VjdGlvbiAiTGVnYWwgYW5kIExpbWl0YXRpb25zIiBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5 LjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1MS1jcmwuY3Js MIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5zdGFydHNzbC5jb20v c3ViL2NsYXNzMS9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly9haWEuc3RhcnRzc2wuY29t L2NlcnRzL3N1Yi5jbGFzczEuY2xpZW50LmNhLmNydDAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0 YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALj/A19bRLmI7sMf0lVRrdN23NuRC7/UFSLZ DfcxrR1wOtQgAbrFlFLY+Otn6UWYIiWQpv2v5Ploqw9rMam5W8seC3TUt83StohXCmZ0EDmK87If B6kpd7FwJ0RFGCxn22hPU2kuhp2mbjJzCTrd3jWsXw63MXDUzHuucWGX2mY1Ji+zRECh568N7iWA 5jn9kWT+h7o7ywKbHc4qAnksghLYAnTfoCx1IPkT4/8A5hf38imhf9NcNGibrvt/e49sacf6GjRH Ot/lOCrEX2fh2YvTB5sdEKM5tjKCKNpFSqnRCKhsWZ9N9ZP7mRZfCOBjAMsm3CW2ygwlWXc54lgf p1UwggfiMIIFyqADAgECAgENMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu aW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQy MTAxNTRaFw0xMjEwMjIyMTAxNTRaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20g THRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHCYPMzi3YGrEppC4Tq5a+ijKDjKaIQZZVR63UbxIP 6uq/I0fhCu+cQhoUfE6ERKKnu8zPf1Jwuk0tsvVCk6U9b+0UjM0dLep3ZdE1gblK/1FwYT5Pipsu 2yOMluLqwvsuz9/9f1+1PKHG/FaR/wpbfuIqu54qzHDYeqiUfsYzoVflR80DAC7hmJ+SmZnNTWyU GHJbBpA8Q89lGxahNvuryGaC/o2/ceD2uYDX9U8Eg5DpIpGQdcbQeGarV04WgAUjjXX5r/2dabmt xWMZwhZna//jdiSyrrSMTGKkDiXm6/3/4ebfeZuCYKzN2P8O2F/Xe2AC/Y7zeEsnR7FOp+uXAgMB AAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAdBgNVHQ4EFgQUU3Ltkpzg2ssB XHx+ljVO8tS4UYIwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UXaYcwyjRoQ9BBrvKhgYGkfzB9MQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHmCAQEwCQYDVR0SBAIwADA9BggrBgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2Vy dC5zdGFydGNvbS5vcmcvc2ZzY2EtY3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYB BQUHAgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilo dHRwOi8vY2VydC5zdGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMw JxYgU3RhcnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmls aXR5LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29t IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIBDQRD FkFTdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVtYWlsIENl cnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAqprh4FuMzh0b/B3GLDAgoLeTJv3xArbNESi/ Kf/HMM//gf8FzwUUNOCglH6dfYuLQQ/dTtOyMb4JoiL3T7xiVKEAOmQ+t+b/xLOMa0m18zoRqW4k 6Glyoyvc7LMrdpgYk/lEh5nq8tPd9BoNmwiiheXphIVH/QelTgUkNzTC7IVpmYVsKuNOnxE1jJFZ NNfqZZK/5Oto7C6PfOut11KmBQSLZarAz0b/mjghdBsYfHuhdO8vrOvD0g5g7dA4pkOAU2Ed4pSC owBSItyD/5aFwZ75ji6Yq7GCG3BpiyAP9st8h+inc0L+7kmrAMJaLMAmu6GZs5Xgsbzn0wUJvbD9 h5jnnMM9UaZDcxl2uLB04quGUWM6NiKGabbxQc680PYbeQrQu+e6J4uqNAxzoa5RxkBA5a/3qlbg F9uJBekCqJswx5vQ9khJrs8UTMaIFzbEC5VGQziQH3/6KJ4DUP85OJEnCx/quShWA6w318LDnba3 M6a5V+KoNLhsVi/TSxf90UbBqwdRR/cOwuGkNJh16NvvhIqO26osMg64CbZsDVrEDr7uSMV40ieB JTo49Iyt77ECOhz/pyhowa2EUP6aKav+L/wXzAPB3LNqzujGR0K1pbyFWKvyYmdungJtySWUMw+R 5DqpA2bFIOE56pfWPLHZxOL+8+r79PLFX+y2V6ExggNvMIIDawIBATCBlDCBjDELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRp ZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1l ZGlhdGUgQ2xpZW50IENBAgME0GMwCQYFKw4DAhoFAKCCAa8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDA4MTgwOTIxWjAjBgkqhkiG9w0BCQQxFgQUHtP99RHy Um1La7jP2YZLoItuH54wgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgME0GMwgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UE ChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2ln bmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGll bnQgQ0ECAwTQYzANBgkqhkiG9w0BAQEFAASCAQB42PLFBvfVKcEnZNh7yw4rb1j+VVf95tU++LEx nKXz7dqvPXyiM21UY2K5Pomnwft9vnyCWYLq/7iuyaoniOiTIi9YIRIYhg3qhcbZ+MgYB6fmUP+u 8m/eLYLrKPnZS0Eg03xGTtiHweGbdMPe+UTIv8q2b9IlkNuKG13suOxvD5rAnojweiGAWEQ173Mm b7N9hzM34LBddut04q1IUAGuxnUS7YjCvcyRdT8vxqFR5J1vpuJXeN4Pqvlc7++4RsdJH8DrKEMS nefJpp0AZklcjF+QC1H0NSIfA4gMLMiaTGHoDFiPVNo81Jm1OJHbW+jiPEdkof/MmqkYhWGPxd/3 AAAAAAAA --Apple-Mail=_FE139563-626D-416D-926B-16385D38D140-- From ekr@rtfm.com Mon Oct 8 11:19:19 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E22B21F0381 for ; Mon, 8 Oct 2012 11:19:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.739 X-Spam-Level: X-Spam-Status: No, score=-102.739 tagged_above=-999 required=5 tests=[AWL=0.238, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oiLMNHJuh82U for ; Mon, 8 Oct 2012 11:19:19 -0700 (PDT) Received: from mail-ee0-f44.google.com (mail-ee0-f44.google.com [74.125.83.44]) by ietfa.amsl.com (Postfix) with ESMTP id 2EF5E21F853C for ; Mon, 8 Oct 2012 11:19:19 -0700 (PDT) Received: by mail-ee0-f44.google.com with SMTP id d4so3195997eek.31 for ; Mon, 08 Oct 2012 11:19:18 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-originating-ip:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=NCV8ubdFUz4tMiypeRULdTzVqIfQ1fbyQG1bhwFzDi0=; b=TFrE4MvYuzSuCP3fuY8uQN1WnkyYKx44OQ0E+uaLinSuZQBdEwVZrzuefJq3+SpL9n /5ITm9IbeWtgK9R/G/qEZekpGqKPSmjQLO4MmxrjvoVv+0WhkzLwvRnp/ganG3nCWwd5 FacN4Y7pNTObHSw/MrSKqDcdIBFsnaPJkJ+zi0CHO8ZfdNA/eDIqC+dt9ud22PHzENSv n7gcHkGKoQz/bkQFv7+x5gaJX82CyjqtGO/JNsjZowW1oL87knFao5ZwuH+oEa1qXfwN nWgoYZO9AywG67oU9wma9LW5uVAb+e75Xg1tmLiqqdHpHI1smmaPCXukSb7tchr6eMOh 1fMw== Received: by 10.14.193.136 with SMTP id k8mr13536511een.30.1349720358368; Mon, 08 Oct 2012 11:19:18 -0700 (PDT) MIME-Version: 1.0 Received: by 10.14.144.77 with HTTP; Mon, 8 Oct 2012 11:18:38 -0700 (PDT) X-Originating-IP: [74.95.2.173] In-Reply-To: References: <5072C194.5070800@telia.com> <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> From: Eric Rescorla Date: Mon, 8 Oct 2012 11:18:38 -0700 Message-ID: To: Henry Story Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQkSyh4r+V6icEa1dBGoiQf+fjcTvilS5rJsyU9j8QlmDWfWqztopq6dlcrR3yQPisqVr/H2 Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 18:19:20 -0000 On Mon, Oct 8, 2012 at 11:09 AM, Henry Story wrote: > > On 8 Oct 2012, at 20:05, Eric Rescorla wrote: > >> On Mon, Oct 8, 2012 at 11:03 AM, Henry Story wrote: >>>> Again, I'd encourage you to describe a set of use cases that demand a change >>>> to TLS and show that there is real interest in them from site operators and the >>>> like. >>> >>> I don't think there is anything actually needing change at the TLS layer. >> >> Oh, good. In that case this is off-topic for this mailing list. > > It was not off topic for the mailing list, since the other person was arguing there > were changes needed and I was pointing out I disagreed. Fine, but the rest of your post is irrelevant. > Gee the way some IETF people love to throw things off topic that makes them > question their assumptions is seriously tedious. Perhaps if you made more effort to avoid spamming mailing lists with off-topic content you would find people did not tell you that it was off-topic. > Anyway, I did point to one change that would be nice: > A way for the server to more finely select certificates not based just > on DNs. Fine, now we're back to being to the topic of this list. A better way of expressing the server's preferences about which certificate the client should supply would certainly be in scope. I would encourage you to publish a draft describing the relevant use cases and (perhaps) a proposed mechanism. -Ekr From henry.story@bblfish.net Mon Oct 8 11:24:47 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA0C221F87DC for ; Mon, 8 Oct 2012 11:24:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.394 X-Spam-Level: X-Spam-Status: No, score=-3.394 tagged_above=-999 required=5 tests=[AWL=0.205, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6klC7wRT0AJ1 for ; Mon, 8 Oct 2012 11:24:46 -0700 (PDT) Received: from mail-wi0-f178.google.com (mail-wi0-f178.google.com [209.85.212.178]) by ietfa.amsl.com (Postfix) with ESMTP id 7CA5F21F87C5 for ; Mon, 8 Oct 2012 11:24:45 -0700 (PDT) Received: by mail-wi0-f178.google.com with SMTP id hr7so3159001wib.13 for ; Mon, 08 Oct 2012 11:24:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=ulPZIM0+u4hYV9G8ZtML7nPxwIm6eVo/Bj+PtD6LkWI=; b=OuXkr99taAPLt3ZKO2mmahPq8uP8U+B35kNcpIsVO73qCN5ZCR8WAXcG1ezZOtP+/a yNK8DvqceAdpd+bSTdpRBVbFAqLstERCbhvW8WcXk3UWv+423KJ+8GXp9MlPsFi8insC 4p33yAe5eGpafXVea8p4OxWX4vlbnhvmYyhJ+6no1p+val4B09iQVBnAaPv8dOtcMYYY OAKs4YtqaKgbbeCiPpDU1JsVlKC2Twt/cCWv4YVYrIetEIKDZrg2f+zExdOQhwYWzPn6 BMMw1+y5uA1UaA7l9QEHRq3KqECNrUK1Ig5xvp6VoEVfvN0rRHUPt/tPZ76/eWeoHthH P48w== Received: by 10.216.194.205 with SMTP id m55mr5923552wen.79.1349720684215; Mon, 08 Oct 2012 11:24:44 -0700 (PDT) Received: from bblfish.home (AAubervilliers-651-1-329-35.w83-114.abo.wanadoo.fr. [83.114.96.35]) by mx.google.com with ESMTPS id dm3sm23496805wib.3.2012.10.08.11.24.32 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 08 Oct 2012 11:24:32 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_B2F8BF9D-E36C-4C22-82BA-350B6E24FD50"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Henry Story In-Reply-To: Date: Mon, 8 Oct 2012 20:24:30 +0200 Message-Id: References: <5072C194.5070800@telia.com> <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> To: Eric Rescorla X-Mailer: Apple Mail (2.1499) X-Gm-Message-State: ALoCoQnm8BvEGPZLuat9D5kRPtBJ77bZZJcog9jnJPUdzfINF5I/4lpTnO4oK4CHOBM3v6TOYxt7 Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 18:24:47 -0000 --Apple-Mail=_B2F8BF9D-E36C-4C22-82BA-350B6E24FD50 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 On 8 Oct 2012, at 20:18, Eric Rescorla wrote: >>=20 >> Gee the way some IETF people love to throw things off topic that = makes them >> question their assumptions is seriously tedious. >=20 > Perhaps if you made more effort to avoid spamming mailing lists > with off-topic content you would find people did not tell you that > it was off-topic. >=20 I am not spamming mailing lists. Btw. I hope you know the=20 ethical imperative that you cannot create moral law that is not also applicable to yourself. Let us see how you stand up to your own criteria: On 8 Oct 2012, at 17:45, Eric Rescorla wrote: >=20 > My general sense of the situation is as follows: >=20 > - There are certain settings in which certificate-based client auth at > the TLS layer > has been useful, but those settings generally are not the public Web = but > rather things like corporate networks, etc. Wrong. IT can be used for wider internet.=20 > - All the evidence suggests that sites want to control their own = authentication > and want to do it in HTML and/or JS not in the transports. Passwords = are > a primitive instance of this, but see also OAuth, Facebook Connect, = Persona, > etc. Is this not all off-topic? What has your (mistaken) idea of JS, OAUth = etc to do with TLS. > - There is a lot of work going on in terms of application-level crypto > (see WebCrypto, etc.) that seems like a better fit for this model. Btw. I am fore WebCrypto, but this is off topic no? > - There are a number of advantages to binding the JS/HTML/HTTP auth to = the > transport (OBC is an example of this) but it's probably more useful = for > authentication continuity and state management rather than primary > authentication. And again wrong. See WebID for a counterexample. Social Web Architect http://bblfish.net/ --Apple-Mail=_B2F8BF9D-E36C-4C22-82BA-350B6E24FD50 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPDTCCByMw ggYLoAMCAQICAwTQYzANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0 YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENB MB4XDTEyMDgyOTAxNDU1NloXDTEzMDgzMDA5MjM0MFowZTEZMBcGA1UEDRMQazQ2eDlvOXJDRE5m VzMwYzEgMB4GA1UEAwwXaGVucnkuc3RvcnlAYmJsZmlzaC5uZXQxJjAkBgkqhkiG9w0BCQEWF2hl bnJ5LnN0b3J5QGJibGZpc2gubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArHXp EmiifOSpudkJn1vAnFdZsuaLuYYLbdWL47o1rKD/kg8/RJUmTIM2ara4e/MOxR16mu2fyAca3H1U oIXNNXDbYQDu2PkfLoNSM5JGAoYbfB0nXBK//ZecidVMZ8eExd02/vFzo5vj9kQNaAPSYirid5xe 1cV9Y1RFjlEozuYAUhU8zi3taf22JM45ii2YrCEgVjDdez8yio0QoJeKEEL3JhL4tqpkbfIOHmdi HYx00S6YcCogDfxXc3zOJ3jcIj/F61eXG1qWX/lq9RAyoBjYHLWE2iHQPwdzum03ubcvOTlohqOR +/cVzvx10l6bJ46KitfbydXMh8HoY7QcmwIDAQABo4IDsjCCA64wCQYDVR0TBAIwADALBgNVHQ8E BAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBQRbT9qwRblII9x nAN2FlEMUD1LQzAfBgNVHSMEGDAWgBRTcu2SnODaywFcfH6WNU7y1LhRgjAiBgNVHREEGzAZgRdo ZW5yeS5zdG9yeUBiYmxmaXNoLm5ldDCCAiEGA1UdIASCAhgwggIUMIICEAYLKwYBBAGBtTcBAgIw ggH/MC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQGCCsG AQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIH3BggrBgEF BQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+VGhpcyBj ZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMSBWYWxpZGF0aW9u IHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBvbmx5IGZv ciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5nIHBhcnR5 IG9ibGlnYXRpb25zLjCBnAYIKwYBBQUHAgIwgY8wJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkwAwIBAhpkTGlhYmlsaXR5IGFuZCB3YXJyYW50aWVzIGFyZSBsaW1pdGVkISBTZWUg c2VjdGlvbiAiTGVnYWwgYW5kIExpbWl0YXRpb25zIiBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5 LjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1MS1jcmwuY3Js MIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5zdGFydHNzbC5jb20v c3ViL2NsYXNzMS9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly9haWEuc3RhcnRzc2wuY29t L2NlcnRzL3N1Yi5jbGFzczEuY2xpZW50LmNhLmNydDAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0 YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALj/A19bRLmI7sMf0lVRrdN23NuRC7/UFSLZ DfcxrR1wOtQgAbrFlFLY+Otn6UWYIiWQpv2v5Ploqw9rMam5W8seC3TUt83StohXCmZ0EDmK87If B6kpd7FwJ0RFGCxn22hPU2kuhp2mbjJzCTrd3jWsXw63MXDUzHuucWGX2mY1Ji+zRECh568N7iWA 5jn9kWT+h7o7ywKbHc4qAnksghLYAnTfoCx1IPkT4/8A5hf38imhf9NcNGibrvt/e49sacf6GjRH Ot/lOCrEX2fh2YvTB5sdEKM5tjKCKNpFSqnRCKhsWZ9N9ZP7mRZfCOBjAMsm3CW2ygwlWXc54lgf p1UwggfiMIIFyqADAgECAgENMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu aW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQy MTAxNTRaFw0xMjEwMjIyMTAxNTRaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20g THRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHCYPMzi3YGrEppC4Tq5a+ijKDjKaIQZZVR63UbxIP 6uq/I0fhCu+cQhoUfE6ERKKnu8zPf1Jwuk0tsvVCk6U9b+0UjM0dLep3ZdE1gblK/1FwYT5Pipsu 2yOMluLqwvsuz9/9f1+1PKHG/FaR/wpbfuIqu54qzHDYeqiUfsYzoVflR80DAC7hmJ+SmZnNTWyU GHJbBpA8Q89lGxahNvuryGaC/o2/ceD2uYDX9U8Eg5DpIpGQdcbQeGarV04WgAUjjXX5r/2dabmt xWMZwhZna//jdiSyrrSMTGKkDiXm6/3/4ebfeZuCYKzN2P8O2F/Xe2AC/Y7zeEsnR7FOp+uXAgMB AAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAdBgNVHQ4EFgQUU3Ltkpzg2ssB XHx+ljVO8tS4UYIwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UXaYcwyjRoQ9BBrvKhgYGkfzB9MQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHmCAQEwCQYDVR0SBAIwADA9BggrBgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2Vy dC5zdGFydGNvbS5vcmcvc2ZzY2EtY3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYB BQUHAgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilo dHRwOi8vY2VydC5zdGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMw JxYgU3RhcnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmls aXR5LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29t IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIBDQRD FkFTdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVtYWlsIENl cnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAqprh4FuMzh0b/B3GLDAgoLeTJv3xArbNESi/ Kf/HMM//gf8FzwUUNOCglH6dfYuLQQ/dTtOyMb4JoiL3T7xiVKEAOmQ+t+b/xLOMa0m18zoRqW4k 6Glyoyvc7LMrdpgYk/lEh5nq8tPd9BoNmwiiheXphIVH/QelTgUkNzTC7IVpmYVsKuNOnxE1jJFZ NNfqZZK/5Oto7C6PfOut11KmBQSLZarAz0b/mjghdBsYfHuhdO8vrOvD0g5g7dA4pkOAU2Ed4pSC owBSItyD/5aFwZ75ji6Yq7GCG3BpiyAP9st8h+inc0L+7kmrAMJaLMAmu6GZs5Xgsbzn0wUJvbD9 h5jnnMM9UaZDcxl2uLB04quGUWM6NiKGabbxQc680PYbeQrQu+e6J4uqNAxzoa5RxkBA5a/3qlbg F9uJBekCqJswx5vQ9khJrs8UTMaIFzbEC5VGQziQH3/6KJ4DUP85OJEnCx/quShWA6w318LDnba3 M6a5V+KoNLhsVi/TSxf90UbBqwdRR/cOwuGkNJh16NvvhIqO26osMg64CbZsDVrEDr7uSMV40ieB JTo49Iyt77ECOhz/pyhowa2EUP6aKav+L/wXzAPB3LNqzujGR0K1pbyFWKvyYmdungJtySWUMw+R 5DqpA2bFIOE56pfWPLHZxOL+8+r79PLFX+y2V6ExggNvMIIDawIBATCBlDCBjDELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRp ZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1l ZGlhdGUgQ2xpZW50IENBAgME0GMwCQYFKw4DAhoFAKCCAa8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDA4MTgyNDMxWjAjBgkqhkiG9w0BCQQxFgQUOS2gXT0y F5h6mXg/Ctcm+dIsn5EwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgME0GMwgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UE ChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2ln bmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGll bnQgQ0ECAwTQYzANBgkqhkiG9w0BAQEFAASCAQCbWlZw1BGIfwGMbE05+Y1JC7HKjsYxqa/82rcT gNlz6QmX0B8HIx3qG4nE33wLwmVqzQT6PLN8t2Qc3UMF6XkWzz5IX/nj3mzokE41wCjBnxyS+Wwx P2DAEWDB0lP+yU+KAdzfZ6r9Oe1bQXDYZGVITwIKzAlYaMtAlDZJEKK0V9IMVHFP9Hyo4SYf96Ya Ow/N1+duYrNZqQhPhAAgwqLtd/rfk+Id9/rfKoP1w/0vCvzNfUsCCCEiO1Wisu1R6Ysdhax02UJw QFGHFxUJSdB3i+nbufIiKY98nghEr1Eb7wL5ZH6M5k48xfdmGHtQOTT7SEsYZmKaVgcUPQt0knzv AAAAAAAA --Apple-Mail=_B2F8BF9D-E36C-4C22-82BA-350B6E24FD50-- From ekr@rtfm.com Mon Oct 8 11:31:03 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50BDD21F881A for ; Mon, 8 Oct 2012 11:31:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.753 X-Spam-Level: X-Spam-Status: No, score=-102.753 tagged_above=-999 required=5 tests=[AWL=0.224, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Krb-n9bWF6Hy for ; Mon, 8 Oct 2012 11:31:02 -0700 (PDT) Received: from mail-ee0-f44.google.com (mail-ee0-f44.google.com [74.125.83.44]) by ietfa.amsl.com (Postfix) with ESMTP id 7A9E421F87FE for ; Mon, 8 Oct 2012 11:31:02 -0700 (PDT) Received: by mail-ee0-f44.google.com with SMTP id d4so3203614eek.31 for ; Mon, 08 Oct 2012 11:31:01 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-originating-ip:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=7hAuAGEi6kBHEdoGOhVCTWSgkSltcvCKMPfJmKFjRKM=; b=h6GqvqMVSqjTjUBPRJ8Ehx7Z1NeXsd7YtUtDgXUjuay+cOV/9hG2bDSv6eSg7xr5PK ZabR9yAX/AtmJ4kb4szyfFvylGawPSMT825D/arp8cNrJ8mGFterLLhtaPpmdBIDEdVw A05AaTwPSUWExPbwd1zXVcSz8MAjLmQQh7V9naZOVZuBwi93/W/+5wNOgt2eS6QRvQr9 9LUF0IDAjN8r5bu1isI4BF/FBGNC+UfFRjQVFlzucOGl1K4JXawpc9UyGYzPxe3FdFgj hQmjD2ioPS6Hb7S2ifDZdnd9kbkPJPIAxUTQbSFanDM5rphPnQumNj5SwspQtkgaxpaR Ga1w== Received: by 10.14.200.134 with SMTP id z6mr24045146een.33.1349721061627; Mon, 08 Oct 2012 11:31:01 -0700 (PDT) MIME-Version: 1.0 Received: by 10.14.144.77 with HTTP; Mon, 8 Oct 2012 11:30:21 -0700 (PDT) X-Originating-IP: [74.95.2.173] In-Reply-To: References: <5072C194.5070800@telia.com> <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> From: Eric Rescorla Date: Mon, 8 Oct 2012 11:30:21 -0700 Message-ID: To: Henry Story Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQmeINhcHnny0DeFFhuRfTfwdVBt+ayCL75E3Jq9mXGCEuJEETwqHiBMxuqR6Oe82jXQYPYZ Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 18:31:03 -0000 Henry, There's a difference between explaining that a proposed change to layer A isn't likely to take off because people want to solve the problem at layer B and simple off-topic ranting. I'm sorry you can't see this. -Ekr On Mon, Oct 8, 2012 at 11:24 AM, Henry Story wrote: > > On 8 Oct 2012, at 20:18, Eric Rescorla wrote: > >>> >>> Gee the way some IETF people love to throw things off topic that makes them >>> question their assumptions is seriously tedious. >> >> Perhaps if you made more effort to avoid spamming mailing lists >> with off-topic content you would find people did not tell you that >> it was off-topic. >> > > I am not spamming mailing lists. Btw. I hope you know the > ethical imperative that you cannot create moral law that is not > also applicable to yourself. Let us see how you stand up to your > own criteria: > > On 8 Oct 2012, at 17:45, Eric Rescorla wrote: > >> >> My general sense of the situation is as follows: >> >> - There are certain settings in which certificate-based client auth at >> the TLS layer >> has been useful, but those settings generally are not the public Web but >> rather things like corporate networks, etc. > > Wrong. IT can be used for wider internet. > >> - All the evidence suggests that sites want to control their own authentication >> and want to do it in HTML and/or JS not in the transports. Passwords are >> a primitive instance of this, but see also OAuth, Facebook Connect, Persona, >> etc. > > Is this not all off-topic? What has your (mistaken) idea of JS, OAUth etc > to do with TLS. > >> - There is a lot of work going on in terms of application-level crypto >> (see WebCrypto, etc.) that seems like a better fit for this model. > > Btw. I am fore WebCrypto, but this is off topic no? > >> - There are a number of advantages to binding the JS/HTML/HTTP auth to the >> transport (OBC is an example of this) but it's probably more useful for >> authentication continuity and state management rather than primary >> authentication. > > And again wrong. See WebID for a counterexample. > > > Social Web Architect > http://bblfish.net/ > From anders.rundgren@telia.com Mon Oct 8 12:02:40 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 865C01F0420 for ; Mon, 8 Oct 2012 12:02:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FDmCyHNQeHka for ; Mon, 8 Oct 2012 12:02:38 -0700 (PDT) Received: from smtp-out11.han.skanova.net (smtp-out11.han.skanova.net [195.67.226.200]) by ietfa.amsl.com (Postfix) with ESMTP id 3F6531F041F for ; Mon, 8 Oct 2012 12:02:37 -0700 (PDT) Received: from [192.168.0.200] (213.66.133.125) by smtp-out11.han.skanova.net (8.5.133) (authenticated as u36408181) id 503A68CC0108ECB0; Mon, 8 Oct 2012 21:02:36 +0200 Message-ID: <50732341.8090202@telia.com> Date: Mon, 08 Oct 2012 21:02:25 +0200 From: Anders Rundgren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: Eric Rescorla References: <5072C194.5070800@telia.com> <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> In-Reply-To: X-Enigmail-Version: 1.4.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "tls@ietf.org" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 19:02:40 -0000 On 2012-10-08 20:30, Eric Rescorla wrote: > Henry, > > There's a difference between explaining that a proposed change to > layer A isn't likely to take off because people want to solve the problem > at layer B and simple off-topic ranting. I'm sorry you can't see this. I guess this concludes my view on this topic. It is so infected that we better move on and leave TLS CCA to the only application where it actually works, that is, creating secure tunnels between boxes. Anders > > -Ekr > > > On Mon, Oct 8, 2012 at 11:24 AM, Henry Story wrote: >> >> On 8 Oct 2012, at 20:18, Eric Rescorla wrote: >> >>>> >>>> Gee the way some IETF people love to throw things off topic that makes them >>>> question their assumptions is seriously tedious. >>> >>> Perhaps if you made more effort to avoid spamming mailing lists >>> with off-topic content you would find people did not tell you that >>> it was off-topic. >>> >> >> I am not spamming mailing lists. Btw. I hope you know the >> ethical imperative that you cannot create moral law that is not >> also applicable to yourself. Let us see how you stand up to your >> own criteria: >> >> On 8 Oct 2012, at 17:45, Eric Rescorla wrote: >> >>> >>> My general sense of the situation is as follows: >>> >>> - There are certain settings in which certificate-based client auth at >>> the TLS layer >>> has been useful, but those settings generally are not the public Web but >>> rather things like corporate networks, etc. >> >> Wrong. IT can be used for wider internet. >> >>> - All the evidence suggests that sites want to control their own authentication >>> and want to do it in HTML and/or JS not in the transports. Passwords are >>> a primitive instance of this, but see also OAuth, Facebook Connect, Persona, >>> etc. >> >> Is this not all off-topic? What has your (mistaken) idea of JS, OAUth etc >> to do with TLS. >> >>> - There is a lot of work going on in terms of application-level crypto >>> (see WebCrypto, etc.) that seems like a better fit for this model. >> >> Btw. I am fore WebCrypto, but this is off topic no? >> >>> - There are a number of advantages to binding the JS/HTML/HTTP auth to the >>> transport (OBC is an example of this) but it's probably more useful for >>> authentication continuity and state management rather than primary >>> authentication. >> >> And again wrong. See WebID for a counterexample. >> >> >> Social Web Architect >> http://bblfish.net/ >> > From jsalowey@cisco.com Mon Oct 8 15:19:13 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98D2311E80F4 for ; Mon, 8 Oct 2012 15:19:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.377 X-Spam-Level: X-Spam-Status: No, score=-110.377 tagged_above=-999 required=5 tests=[AWL=0.222, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M3Y5Ei4Hpnhg for ; Mon, 8 Oct 2012 15:19:12 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by ietfa.amsl.com (Postfix) with ESMTP id C7DF211E80E3 for ; Mon, 8 Oct 2012 15:19:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=659; q=dns/txt; s=iport; t=1349734752; x=1350944352; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=uTNZMa0+12bp3fwuo/fB4bbKNJe8gHS2TtSl2NTsyyk=; b=BAtT7m06QI/y/0xO/fSqufVRnVB8EzSVUBtlNr7KrS3IOU9qUua4qX8l zj5MypB/lbZx/h3H6adlh++LM0nhp4rOaDYOw3XXLixC6bI8BvVJA6Qed OxcBg+8iXlIbytSiOUl9+SU9hvxAWv6eIar5GlQNEM01HPZe0ZTJIwcdh s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AlQKAHNQc1CtJV2c/2dsb2JhbABFhUq4VgQDgQqBCIIgAQEBAwEBAQEPAQodNBALAgEIIhQQJwslAgQTCBqHXQYLmjufewSLR4M6gXlgA6QwgWmCYA2CFw X-IronPort-AV: E=Sophos;i="4.80,556,1344211200"; d="scan'208";a="129521409" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-6.cisco.com with ESMTP; 08 Oct 2012 22:19:12 +0000 Received: from xhc-rcd-x15.cisco.com (xhc-rcd-x15.cisco.com [173.37.183.89]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id q98MJC9p030315 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Mon, 8 Oct 2012 22:19:12 GMT Received: from xmb-rcd-x09.cisco.com ([169.254.9.68]) by xhc-rcd-x15.cisco.com ([173.37.183.89]) with mapi id 14.02.0318.001; Mon, 8 Oct 2012 17:19:12 -0500 From: "Joseph Salowey (jsalowey)" To: "tls@ietf.org" Thread-Topic: [TLS] Working Group Last Call for draft-ietf-tls-cached-info-13 Thread-Index: AQHNlIpS3klSGbwVeE6POKXHr7ra2JewcJ0A Date: Mon, 8 Oct 2012 22:19:11 +0000 Message-ID: References: <037043A7-AFA7-4D4F-B1FD-1D3C229CC6A0@cisco.com> In-Reply-To: <037043A7-AFA7-4D4F-B1FD-1D3C229CC6A0@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.33.248.63] x-tm-as-product-ver: SMEX-10.2.0.1135-7.000.1014-19252.004 x-tm-as-result: No--36.520400-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: text/plain; charset="us-ascii" Content-ID: <527590D51E3D5C479D49D9B035D61230@cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-cached-info-13 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 22:19:13 -0000 We have not received many comments on the draft. If you have reviewed the = draft and support its publication please indicate so on the list. Also, i= f you have implemented or are planning to implement cached info that would = be useful information as well. =20 Thanks, Joe On Sep 16, 2012, at 9:10 PM, Joseph Salowey (jsalowey) wrote: > This is an announcement of working group last call for draft-ietf-tls-cac= hed-info-13. Please send you comments to the TLS list by October 8, 2012.= =20 >=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From agl@google.com Mon Oct 8 15:28:43 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EC3821F84CD for ; Mon, 8 Oct 2012 15:28:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.677 X-Spam-Level: X-Spam-Status: No, score=-102.677 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, J_CHICKENPOX_31=0.6, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CdyL9HDw4Ppx for ; Mon, 8 Oct 2012 15:28:43 -0700 (PDT) Received: from mail-ie0-f172.google.com (mail-ie0-f172.google.com [209.85.223.172]) by ietfa.amsl.com (Postfix) with ESMTP id 0B69221F84C9 for ; Mon, 8 Oct 2012 15:28:42 -0700 (PDT) Received: by mail-ie0-f172.google.com with SMTP id 9so12034490iec.31 for ; Mon, 08 Oct 2012 15:28:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding:x-system-of-record; bh=n5MIbcN2Y9vwjDrH1oiO/rorQiF3xV01fyGh3TlRm3s=; b=Dm7hhOmLiSHkpzrlLcHuNbnPuTO6l+iUpIlfT6owOod+3tKeSkqEl/0GP5ikcR6YXU T6UXyRRMSgzRMB5W2Flb1HIjrUEzfUk0aacT4FnyZat7pir7anOg+gC/q4XvJFXBa/sJ GPoE6HIzdAuvw/OKC10jr5vwIAj3WGRtenHkww+JD21h76ewvF5TIvKJDVR2vbWjePLs hiMT+xyv40/Do3LnyTDhQQU6Do5P8icmbCV0jdtml2mifWkkepLE7H8Z9FR+51EFUe7G ERHotNEHN0gry5Ya9LyiO5LpjHDGcksnee7OVmTe/aSIIBB7f//vcPo0f0FmuaqlRAiz jPyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding:x-system-of-record :x-gm-message-state; bh=n5MIbcN2Y9vwjDrH1oiO/rorQiF3xV01fyGh3TlRm3s=; b=oGwYqrSAQsrEjAH2i8+osZPuy220+deZGwqFX0ei7N4uX8AS6y0JITgg8q8cQGlG+e xfG63iT8V9j+RNhv0hN6AHQYfw/x8LkZV9MsGhecIxgl/XsrKTrFiblvwbRN+bjnu0/8 1tO3fNZlN/6pNPBCWiZrfiEW8JxSOZYuwSns5vLEVYkyAJjbs6t19zfzfypuTm3owJFX 3gTx8EZpwawSpsuGTfRXOwzXPtTUZ212/B/HNWldgJTq54QuDjWa1n8aKbDt3lj2t09/ Lr8nIvOMIEf4xoKQRQNjSUpznvQEXCxEuH6Nxvpc/Dewn3Cj+1RYC7iQDT0Tn54z93Cd Y/Ng== MIME-Version: 1.0 Received: by 10.50.91.195 with SMTP id cg3mr7365408igb.57.1349735322452; Mon, 08 Oct 2012 15:28:42 -0700 (PDT) Received: by 10.231.56.89 with HTTP; Mon, 8 Oct 2012 15:28:42 -0700 (PDT) In-Reply-To: References: <037043A7-AFA7-4D4F-B1FD-1D3C229CC6A0@cisco.com> Date: Mon, 8 Oct 2012 18:28:42 -0400 Message-ID: From: Adam Langley To: "Joseph Salowey (jsalowey)" Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-System-Of-Record: true X-Gm-Message-State: ALoCoQn1L0cbJdTWQ8QjqBEh07NWeghwrnckFoNQiEgGyagmc8O27dSkfhRTdaIuV48XwHW93FSlgNT5RVao13QA70JESU1476OrAbnW4A6kSSOK3eeTa3bwQYf895+3P4DJ+dvx9X+XylJ1A6TQWGnP+u9GmFA+/2x8gEGNVip8MGcH5UjH13Got95VjW3CR8mjbFRO9LaQ Cc: "tls@ietf.org" Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-cached-info-13 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 22:28:43 -0000 On Mon, Oct 8, 2012 at 6:19 PM, Joseph Salowey (jsalowey) wrote: > We have not received many comments on the draft. If you have reviewed th= e draft and support its publication please indicate so on the list. Also,= if you have implemented or are planning to implement cached info that woul= d be useful information as well. I'm disappointed that we couldn't use FNV1a as the hash function, but not so disappointed that I think it's a fatal flaw. So I support its publication. I don't have any current plans to implement it, but might do the OpenSSL side for fun at some point. Cheers AGL From jsalowey@cisco.com Mon Oct 8 15:37:21 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A30521F87E5 for ; Mon, 8 Oct 2012 15:37:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.414 X-Spam-Level: X-Spam-Status: No, score=-110.414 tagged_above=-999 required=5 tests=[AWL=0.185, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TWz+BLqZ5FOv for ; Mon, 8 Oct 2012 15:37:20 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by ietfa.amsl.com (Postfix) with ESMTP id 427F821F87E3 for ; Mon, 8 Oct 2012 15:37:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=907; q=dns/txt; s=iport; t=1349735840; x=1350945440; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=uscW1PPIGAMEREHwRLoSl1JtNflKUUUmtf1ULSRsHaM=; b=dIf7tCPAdq+zIXQPoRs2ERS5p2qZymzJJ2fKLQ361CAtR1HkDsOg+DUd h1uOxHGb8E3HdlhHDFslAuprS6n5stZCvOOXS4jRu6d7NbhLiVobClnG+ eFlv1V+ThLLRjNFdiosETaaWundakQpivaXThq3IKbn1g6BqxdhnClX8p 4=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AiEFAH1Uc1CtJXHB/2dsb2JhbABFhUq5Z4EIgiABAQEDAQEBAQ8BClELBQsCAQgYCiQnCyUCBA4FCBqHXQYLmi6ffQSLR4M6gXlgA4gjnA2BaYJgDYIX X-IronPort-AV: E=Sophos;i="4.80,556,1344211200"; d="scan'208";a="126523606" Received: from rcdn-core2-6.cisco.com ([173.37.113.193]) by rcdn-iport-9.cisco.com with ESMTP; 08 Oct 2012 22:37:19 +0000 Received: from xhc-rcd-x15.cisco.com (xhc-rcd-x15.cisco.com [173.37.183.89]) by rcdn-core2-6.cisco.com (8.14.5/8.14.5) with ESMTP id q98MbJVL005218 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 8 Oct 2012 22:37:19 GMT Received: from xmb-rcd-x09.cisco.com ([169.254.9.68]) by xhc-rcd-x15.cisco.com ([173.37.183.89]) with mapi id 14.02.0318.001; Mon, 8 Oct 2012 17:37:19 -0500 From: "Joseph Salowey (jsalowey)" To: Rob Stradling Thread-Topic: [TLS] Working Group Last Call for draft-ietf-tls-cached-info-13 Thread-Index: AQHNlIpS3klSGbwVeE6POKXHr7ra2JeOfPyAgCH4sYA= Date: Mon, 8 Oct 2012 22:37:18 +0000 Message-ID: References: <037043A7-AFA7-4D4F-B1FD-1D3C229CC6A0@cisco.com> <5056D64D.9020007@comodo.com> In-Reply-To: <5056D64D.9020007@comodo.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.33.248.63] x-tm-as-product-ver: SMEX-10.2.0.1135-7.000.1014-19252.004 x-tm-as-result: No--39.139400-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: text/plain; charset="iso-8859-1" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "tls@ietf.org" Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-cached-info-13 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2012 22:37:21 -0000 This sounds like a reasonable request. Does anybody see any issues with ad= ding this support? This may also be something that we can take care of in = draft-ietf-tls-multiple-cert-status-extension.=20 Thanks, Joe On Sep 17, 2012, at 12:50 AM, Rob Stradling wrote: > Would it be possible to add support for cached CertificateStatus messages= (see RFC 6066 Section 8 "Certificate Status Request") ? >=20 > On 17/09/12 05:10, Joseph Salowey (jsalowey) wrote: >> This is an announcement of working group last call for draft-ietf-tls-ca= ched-info-13. Please send you comments to the TLS list by October 8, 2012= . >>=20 >>=20 >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >>=20 >=20 > --=20 > Rob Stradling > Senior Research & Development Scientist > COMODO - Creating Trust Online >=20 From ynir@checkpoint.com Mon Oct 8 22:38:42 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D5BD21F84FE for ; Mon, 8 Oct 2012 22:38:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.524 X-Spam-Level: X-Spam-Status: No, score=-10.524 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zDnH4qlKIMmN for ; Mon, 8 Oct 2012 22:38:41 -0700 (PDT) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 4602721F84F8 for ; Mon, 8 Oct 2012 22:38:41 -0700 (PDT) Received: from il-ex01.ad.checkpoint.com (il-ex01.ad.checkpoint.com [194.29.34.26]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id q995caIF009103; Tue, 9 Oct 2012 07:38:36 +0200 X-CheckPoint: {5073B6F6-E-1B221DC2-2FFFF} Received: from il-ex01.ad.checkpoint.com ([194.29.34.26]) by il-ex01.ad.checkpoint.com ([126.0.0.2]) with mapi; Tue, 9 Oct 2012 07:38:35 +0200 From: Yoav Nir To: Henry Story Date: Tue, 9 Oct 2012 07:38:37 +0200 Thread-Topic: [TLS] Making TLS-Client-Certificate-Authentication Useful Thread-Index: Ac2l4FMH22NDOtetTIu/olm0V3ZE4g== Message-ID: <47C5C925-A6CB-4516-8E5D-DDDAF4216288@checkpoint.com> References: <5072C194.5070800@telia.com> <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "tls@ietf.org list" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Oct 2012 05:38:42 -0000 On Oct 8, 2012, at 8:05 PM, Eric Rescorla wrote: > On Mon, Oct 8, 2012 at 11:03 AM, Henry Story wr= ote: >>> Again, I'd encourage you to describe a set of use cases that demand a c= hange >>> to TLS and show that there is real interest in them from site operators= and the >>> like. >>=20 >> I don't think there is anything actually needing change at the TLS layer= . >=20 > Oh, good. In that case this is off-topic for this mailing list. There may be another mailing list where this may be on-topic: the http-auth= mailing list [1]. That one is concerned with authentication at the HTTP la= yer. There's also a BoF planned for Atlanta. Note that the kind of auth discussed there is not in HTML or JS either, so = plugging WebID is not really appropriate there either. However, well-suppor= ted arguments why HTTP is the wrong layer for authentication *are* appropri= ate for that list. Also, discussion of the UI requirements for authenticati= on are very appropriate both on that list and at the BoF, because modifying= browsers to allow customization of the authentication dialog is possible i= n HTTP (and HTML), but would be very strange in TLS. If you believe you have UI expertise, and would like to discuss it in the A= tlanta BoF, please contact Derek Atkins or me directly.=20 Apologies for hijacking this thread for plugging our BoF. I promise to do t= his only this once (at least on this mailing list) Yoav [1] https://www.ietf.org/mailman/listinfo/http-auth= From anders.rundgren@telia.com Tue Oct 9 00:45:21 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C50A21F8674 for ; Tue, 9 Oct 2012 00:45:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.351 X-Spam-Level: X-Spam-Status: No, score=-3.351 tagged_above=-999 required=5 tests=[AWL=0.248, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4ESH7Q71gdrI for ; Tue, 9 Oct 2012 00:45:20 -0700 (PDT) Received: from smtp-out21.han.skanova.net (smtp-out21.han.skanova.net [195.67.226.208]) by ietfa.amsl.com (Postfix) with ESMTP id ECA2221F864A for ; Tue, 9 Oct 2012 00:45:19 -0700 (PDT) Received: from [192.168.3.161] (37.247.8.250) by smtp-out21.han.skanova.net (8.5.133) (authenticated as u36408181) id 503A691C01077359; Tue, 9 Oct 2012 09:45:10 +0200 Message-ID: <5073D5FD.8070205@telia.com> Date: Tue, 09 Oct 2012 09:45:01 +0200 From: Anders Rundgren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: Yoav Nir References: <5072C194.5070800@telia.com> <03BCABFC-1307-4761-98C1-32456B31AE49@bblfish.net> <47C5C925-A6CB-4516-8E5D-DDDAF4216288@checkpoint.com> In-Reply-To: <47C5C925-A6CB-4516-8E5D-DDDAF4216288@checkpoint.com> X-Enigmail-Version: 1.4.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "tls@ietf.org list" Subject: Re: [TLS] Making TLS-Client-Certificate-Authentication Useful X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Oct 2012 07:45:21 -0000 On 2012-10-09 07:38, Yoav Nir wrote: > > On Oct 8, 2012, at 8:05 PM, Eric Rescorla wrote: > >> On Mon, Oct 8, 2012 at 11:03 AM, Henry Story wrote: >>>> Again, I'd encourage you to describe a set of use cases that demand a change >>>> to TLS and show that there is real interest in them from site operators and the >>>> like. >>> >>> I don't think there is anything actually needing change at the TLS layer. >> >> Oh, good. In that case this is off-topic for this mailing list. > > > > There may be another mailing list where this may be on-topic: the http-auth mailing list [1]. That one is concerned with authentication at the HTTP layer. There's also a BoF planned for Atlanta. > > Note that the kind of auth discussed there is not in HTML or JS either, so plugging WebID is not really appropriate there either. However, well-supported arguments why HTTP is the wrong layer for authentication *are* appropriate for that list. Also, discussion of the UI requirements for authentication are very appropriate both on that list and at the BoF, because modifying browsers to allow customization of the authentication dialog is possible in HTTP (and HTML), but would be very strange in TLS. > > If you believe you have UI expertise, and would like to discuss it in the Atlanta BoF, please contact Derek Atkins or me directly. > > > > Apologies for hijacking this thread for plugging our BoF. I promise to do this only this once (at least on this mailing list) Any effort trying to make TLS CCA more useful is most welcome! Anders > > Yoav > > [1] https://www.ietf.org/mailman/listinfo/http-auth > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From rob.stradling@comodo.com Tue Oct 9 01:19:37 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44A6C21F8647 for ; Tue, 9 Oct 2012 01:19:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6z+jYZnPfRfa for ; Tue, 9 Oct 2012 01:19:36 -0700 (PDT) Received: from mmmail1.mcr.colo.comodoca.net (mdfw.comodoca.net [91.209.196.68]) by ietfa.amsl.com (Postfix) with ESMTP id ECF6F21F84B9 for ; Tue, 9 Oct 2012 01:19:35 -0700 (PDT) Received: (qmail 10754 invoked from network); 9 Oct 2012 08:19:33 -0000 Received: from ian1.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.201) by mail.colo.comodoca.net with ESMTPS (DHE-RSA-AES256-SHA encrypted); 9 Oct 2012 08:19:33 -0000 Received: (qmail 9046 invoked by uid 1000); 9 Oct 2012 08:19:32 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (CAMELLIA256-SHA encrypted) ESMTPSA; Tue, 09 Oct 2012 09:19:32 +0100 Message-ID: <5073DE14.6040007@comodo.com> Date: Tue, 09 Oct 2012 09:19:32 +0100 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: "Joseph Salowey (jsalowey)" References: <037043A7-AFA7-4D4F-B1FD-1D3C229CC6A0@cisco.com> <5056D64D.9020007@comodo.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: "tls@ietf.org" Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-cached-info-13 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Oct 2012 08:19:37 -0000 On 08/10/12 23:37, Joseph Salowey (jsalowey) wrote: > This sounds like a reasonable request. Does anybody see any issues with adding this support? This may also be something that we can take care of in draft-ietf-tls-multiple-cert-status-extension. I think it would be better to take care of this in draft-ietf-tls-cached-info, because the CertificateStatus message is already defined (in RFC6066) and it has nothing to do with "multiple" certificate statuses. > Thanks, > > Joe > On Sep 17, 2012, at 12:50 AM, Rob Stradling wrote: > >> Would it be possible to add support for cached CertificateStatus messages (see RFC 6066 Section 8 "Certificate Status Request") ? >> >> On 17/09/12 05:10, Joseph Salowey (jsalowey) wrote: >>> This is an announcement of working group last call for draft-ietf-tls-cached-info-13. Please send you comments to the TLS list by October 8, 2012. >>> >>> >>> _______________________________________________ >>> TLS mailing list >>> TLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/tls >>> >> >> -- >> Rob Stradling >> Senior Research & Development Scientist >> COMODO - Creating Trust Online >> > > -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From yngve@opera.com Tue Oct 9 05:14:26 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D54BD21F8829 for ; Tue, 9 Oct 2012 05:14:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AqJCDIzM6CKj for ; Tue, 9 Oct 2012 05:14:26 -0700 (PDT) Received: from smtp.opera.com (smtp.opera.com [213.236.208.81]) by ietfa.amsl.com (Postfix) with ESMTP id DE31521F8822 for ; Tue, 9 Oct 2012 05:14:25 -0700 (PDT) Received: from acorna.invalid.invalid (pat-tdc.opera.com [213.236.208.22]) (authenticated bits=0) by smtp.opera.com (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id q99CEKAd012627 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 9 Oct 2012 12:14:21 GMT Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes To: "tls@ietf.org" , "Joseph Salowey (jsalowey)" References: <037043A7-AFA7-4D4F-B1FD-1D3C229CC6A0@cisco.com> Date: Tue, 09 Oct 2012 14:14:22 +0200 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: "Yngve N. Pettersen (Developer Opera Software ASA)" Organization: Opera Software AS Message-ID: In-Reply-To: <037043A7-AFA7-4D4F-B1FD-1D3C229CC6A0@cisco.com> User-Agent: Opera Mail/11.64 (Win32) Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-cached-info-13 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Oct 2012 12:14:26 -0000 Sorry about the delay. In my opinion, as mentioned during a WG meeting, I think the range (8 bit) of the CachedInformationType is too short. While the handshake type may be 8-bit, the TLS extension enum is 16 bit. My suggestion would be to increase the size of this field to 16 bit. I won't call this a blocker, but in the event that we pass 255 information types, a new extension would have to be defined. One related note, perhaps for future consideration, if a client registers cache entries for many items, then the size of this extension on the wire could become significant. Should this be handled somehow, for example through a shorthand "I sent you a list of entries earlier, with this ID"? One point against this is that it would require the server to remember what the client have sent, and it might create curious error situations. Another is that the extension can max be 64K anyway, which limits both the number of items that can be stored and the bits-on-the-wire footprint. On Mon, 17 Sep 2012 06:10:08 +0200, Joseph Salowey (jsalowey) wrote: > This is an announcement of working group last call for > draft-ietf-tls-cached-info-13. Please send you comments to the TLS > list by October 8, 2012. > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls -- Sincerely, Yngve N. Pettersen ******************************************************************** Senior Developer Email: yngve@opera.com Opera Software ASA http://www.opera.com/ Phone: +47 96 90 41 51 Fax: +47 23 69 24 01 ******************************************************************** From anders.rundgren@telia.com Fri Oct 12 01:13:39 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F0B321F842E for ; Fri, 12 Oct 2012 01:13:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zTsZmRxBhDFb for ; Fri, 12 Oct 2012 01:13:38 -0700 (PDT) Received: from smtp-out12.han.skanova.net (smtp-out12.han.skanova.net [195.67.226.212]) by ietfa.amsl.com (Postfix) with ESMTP id DFBE021F8425 for ; Fri, 12 Oct 2012 01:13:37 -0700 (PDT) Received: from [192.168.0.200] (213.66.133.125) by smtp-out12.han.skanova.net (8.5.133) (authenticated as u36408181) id 5056292D006D6E1E for tls@ietf.org; Fri, 12 Oct 2012 10:13:36 +0200 Message-ID: <5077D12E.9010608@telia.com> Date: Fri, 12 Oct 2012 10:13:34 +0200 From: Anders Rundgren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: "'tls@ietf.org'" X-Enigmail-Version: 1.4.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [TLS] TLS CCA certificate filtering according to Google X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Oct 2012 08:13:39 -0000 http://code.google.com/p/android/issues/detail?id=38393 "I designed the API with the intent that filtering could be added later if necessary, but I've never been convinced that users really are going to have large numbers of keys. What I said about issuer filtering really is true. It almost always is configured wrong if at all. If you can motivate a use case, I'm all ears" The fact is that certificate filtering in TLS is in a big need for improvement, not only in Android but at the protocol level as well. The alternative (which is probably what will happen) is that TLS CCA remains a great solution for creating "secure tunnels between boxes". -- Anders From henry.story@bblfish.net Fri Oct 12 01:22:16 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AF6521F850B for ; Fri, 12 Oct 2012 01:22:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.423 X-Spam-Level: X-Spam-Status: No, score=-3.423 tagged_above=-999 required=5 tests=[AWL=0.176, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ri0+rHrOpRqN for ; Fri, 12 Oct 2012 01:22:15 -0700 (PDT) Received: from mail-we0-f172.google.com (mail-we0-f172.google.com [74.125.82.172]) by ietfa.amsl.com (Postfix) with ESMTP id CAE1721F842F for ; Fri, 12 Oct 2012 01:22:12 -0700 (PDT) Received: by mail-we0-f172.google.com with SMTP id u46so1712467wey.31 for ; Fri, 12 Oct 2012 01:22:12 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=CzAEzYrYPgTHWBrkYKchu86IdkbeebBLrZGZGaSHWls=; b=iohZCizQ3Hv07MBOapWKOB5aJnh4+L+bNnvH/Cx4qQRcVA5YhcHl9yUBTAlyPILV+z E/A78NYUGwaCSXvJ1hx5YYc6dTZVMywk0nhzVjyyxCYEfxMj6K77sjUY194Mvb13PWXD x+6ZKH7NEkreWI70hivHpM3KYelE/4wvm1usnw45VpxiAyGOMSdw3/q9KPE8vRy942Eq 8Lv6fXVGetCZyfvwi4zc/wn9qk8tmyjov0NzC5iEz9GDKgrUPOr+52Kn6gV8XeR4rbOi CV9zkmdj6oynyNezV31Dr4A41xi36gVPOOBYJHj/Jt9OGihaOeRJABWR5EEXjZyMzOWT G6lA== Received: by 10.216.143.71 with SMTP id k49mr2070694wej.43.1350030131922; Fri, 12 Oct 2012 01:22:11 -0700 (PDT) Received: from bblfish.home (AAubervilliers-651-1-329-35.w83-114.abo.wanadoo.fr. [83.114.96.35]) by mx.google.com with ESMTPS id ay10sm2432771wib.2.2012.10.12.01.22.00 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 12 Oct 2012 01:22:01 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_0277A2B7-E2FD-4ADB-AE1F-7205DFD351DA"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Henry Story In-Reply-To: <5077D12E.9010608@telia.com> Date: Fri, 12 Oct 2012 10:21:59 +0200 Message-Id: <1273FF88-53D0-4A96-B53B-0079298615B2@bblfish.net> References: <5077D12E.9010608@telia.com> To: Anders Rundgren X-Mailer: Apple Mail (2.1499) X-Gm-Message-State: ALoCoQnGBKeM6QoKuuZqbt4SFpdFwGv/6hh1URMlTpXZPZ9it36rjstiXM+YmDqfMVHPVQf8u3O7 Cc: "'tls@ietf.org'" Subject: Re: [TLS] TLS CCA certificate filtering according to Google X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Oct 2012 08:22:16 -0000 --Apple-Mail=_0277A2B7-E2FD-4ADB-AE1F-7205DFD351DA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Btw. The WebID protocol we do have a case for certificate filtering, which I explain in more detail here: http://lists.w3.org/Archives/Public/public-webid/2012Oct/0117.html Perhaps this can be used as a guide for this group to think about = improvements. Otherwise I would like to know what people here make of the feasability = of=20 having a WebID DN hack as suggested there? Henry On 12 Oct 2012, at 10:13, Anders Rundgren = wrote: > http://code.google.com/p/android/issues/detail?id=3D38393 >=20 > "I designed the API with the intent that filtering could be added = later if necessary, > but I've never been convinced that users really are going to have = large numbers of keys. > What I said about issuer filtering really is true. It almost always = is configured wrong if at all. > If you can motivate a use case, I'm all ears" >=20 > The fact is that certificate filtering in TLS is in a big need for = improvement, > not only in Android but at the protocol level as well. >=20 > The alternative (which is probably what will happen) is that TLS CCA = remains > a great solution for creating "secure tunnels between boxes". >=20 > -- Anders > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls Social Web Architect http://bblfish.net/ --Apple-Mail=_0277A2B7-E2FD-4ADB-AE1F-7205DFD351DA Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPDTCCByMw ggYLoAMCAQICAwTQYzANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0 YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENB MB4XDTEyMDgyOTAxNDU1NloXDTEzMDgzMDA5MjM0MFowZTEZMBcGA1UEDRMQazQ2eDlvOXJDRE5m VzMwYzEgMB4GA1UEAwwXaGVucnkuc3RvcnlAYmJsZmlzaC5uZXQxJjAkBgkqhkiG9w0BCQEWF2hl bnJ5LnN0b3J5QGJibGZpc2gubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArHXp EmiifOSpudkJn1vAnFdZsuaLuYYLbdWL47o1rKD/kg8/RJUmTIM2ara4e/MOxR16mu2fyAca3H1U oIXNNXDbYQDu2PkfLoNSM5JGAoYbfB0nXBK//ZecidVMZ8eExd02/vFzo5vj9kQNaAPSYirid5xe 1cV9Y1RFjlEozuYAUhU8zi3taf22JM45ii2YrCEgVjDdez8yio0QoJeKEEL3JhL4tqpkbfIOHmdi HYx00S6YcCogDfxXc3zOJ3jcIj/F61eXG1qWX/lq9RAyoBjYHLWE2iHQPwdzum03ubcvOTlohqOR +/cVzvx10l6bJ46KitfbydXMh8HoY7QcmwIDAQABo4IDsjCCA64wCQYDVR0TBAIwADALBgNVHQ8E BAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBQRbT9qwRblII9x nAN2FlEMUD1LQzAfBgNVHSMEGDAWgBRTcu2SnODaywFcfH6WNU7y1LhRgjAiBgNVHREEGzAZgRdo ZW5yeS5zdG9yeUBiYmxmaXNoLm5ldDCCAiEGA1UdIASCAhgwggIUMIICEAYLKwYBBAGBtTcBAgIw ggH/MC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQGCCsG AQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIH3BggrBgEF BQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+VGhpcyBj ZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMSBWYWxpZGF0aW9u IHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBvbmx5IGZv ciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5nIHBhcnR5 IG9ibGlnYXRpb25zLjCBnAYIKwYBBQUHAgIwgY8wJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkwAwIBAhpkTGlhYmlsaXR5IGFuZCB3YXJyYW50aWVzIGFyZSBsaW1pdGVkISBTZWUg c2VjdGlvbiAiTGVnYWwgYW5kIExpbWl0YXRpb25zIiBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5 LjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1MS1jcmwuY3Js MIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5zdGFydHNzbC5jb20v c3ViL2NsYXNzMS9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly9haWEuc3RhcnRzc2wuY29t L2NlcnRzL3N1Yi5jbGFzczEuY2xpZW50LmNhLmNydDAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0 YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALj/A19bRLmI7sMf0lVRrdN23NuRC7/UFSLZ DfcxrR1wOtQgAbrFlFLY+Otn6UWYIiWQpv2v5Ploqw9rMam5W8seC3TUt83StohXCmZ0EDmK87If B6kpd7FwJ0RFGCxn22hPU2kuhp2mbjJzCTrd3jWsXw63MXDUzHuucWGX2mY1Ji+zRECh568N7iWA 5jn9kWT+h7o7ywKbHc4qAnksghLYAnTfoCx1IPkT4/8A5hf38imhf9NcNGibrvt/e49sacf6GjRH Ot/lOCrEX2fh2YvTB5sdEKM5tjKCKNpFSqnRCKhsWZ9N9ZP7mRZfCOBjAMsm3CW2ygwlWXc54lgf p1UwggfiMIIFyqADAgECAgENMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu aW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQy MTAxNTRaFw0xMjEwMjIyMTAxNTRaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20g THRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHCYPMzi3YGrEppC4Tq5a+ijKDjKaIQZZVR63UbxIP 6uq/I0fhCu+cQhoUfE6ERKKnu8zPf1Jwuk0tsvVCk6U9b+0UjM0dLep3ZdE1gblK/1FwYT5Pipsu 2yOMluLqwvsuz9/9f1+1PKHG/FaR/wpbfuIqu54qzHDYeqiUfsYzoVflR80DAC7hmJ+SmZnNTWyU GHJbBpA8Q89lGxahNvuryGaC/o2/ceD2uYDX9U8Eg5DpIpGQdcbQeGarV04WgAUjjXX5r/2dabmt xWMZwhZna//jdiSyrrSMTGKkDiXm6/3/4ebfeZuCYKzN2P8O2F/Xe2AC/Y7zeEsnR7FOp+uXAgMB AAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAdBgNVHQ4EFgQUU3Ltkpzg2ssB XHx+ljVO8tS4UYIwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UXaYcwyjRoQ9BBrvKhgYGkfzB9MQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHmCAQEwCQYDVR0SBAIwADA9BggrBgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2Vy dC5zdGFydGNvbS5vcmcvc2ZzY2EtY3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYB BQUHAgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilo dHRwOi8vY2VydC5zdGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMw JxYgU3RhcnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmls aXR5LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29t IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIBDQRD FkFTdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVtYWlsIENl cnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAqprh4FuMzh0b/B3GLDAgoLeTJv3xArbNESi/ Kf/HMM//gf8FzwUUNOCglH6dfYuLQQ/dTtOyMb4JoiL3T7xiVKEAOmQ+t+b/xLOMa0m18zoRqW4k 6Glyoyvc7LMrdpgYk/lEh5nq8tPd9BoNmwiiheXphIVH/QelTgUkNzTC7IVpmYVsKuNOnxE1jJFZ NNfqZZK/5Oto7C6PfOut11KmBQSLZarAz0b/mjghdBsYfHuhdO8vrOvD0g5g7dA4pkOAU2Ed4pSC owBSItyD/5aFwZ75ji6Yq7GCG3BpiyAP9st8h+inc0L+7kmrAMJaLMAmu6GZs5Xgsbzn0wUJvbD9 h5jnnMM9UaZDcxl2uLB04quGUWM6NiKGabbxQc680PYbeQrQu+e6J4uqNAxzoa5RxkBA5a/3qlbg F9uJBekCqJswx5vQ9khJrs8UTMaIFzbEC5VGQziQH3/6KJ4DUP85OJEnCx/quShWA6w318LDnba3 M6a5V+KoNLhsVi/TSxf90UbBqwdRR/cOwuGkNJh16NvvhIqO26osMg64CbZsDVrEDr7uSMV40ieB JTo49Iyt77ECOhz/pyhowa2EUP6aKav+L/wXzAPB3LNqzujGR0K1pbyFWKvyYmdungJtySWUMw+R 5DqpA2bFIOE56pfWPLHZxOL+8+r79PLFX+y2V6ExggNvMIIDawIBATCBlDCBjDELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRp ZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1l ZGlhdGUgQ2xpZW50IENBAgME0GMwCQYFKw4DAhoFAKCCAa8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDEyMDgyMTU5WjAjBgkqhkiG9w0BCQQxFgQUUYA2+nti u1QsrI4yutGE/NfqPUAwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgME0GMwgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UE ChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2ln bmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGll bnQgQ0ECAwTQYzANBgkqhkiG9w0BAQEFAASCAQCn3XulHyS+agZbLuq+zOAEBIovLgz7+7y1cxbj XCpFBUiJu4UM7yerM1ZekUx6c5fcOM449AL3FBcBryAZLcgcG2urpdbXFiq8TWH13CZ9r4zZ59dO wEHYJ4OPVGn2JrqitnpftziU9lrNyvMFDssYGjW0RYJRcaKxaRTyJmxpJJ0p37jaMQH1zcr6efNY dPZ9huhpdgvpOu4nLWTuO8nA8ja/g9vS4TqFBbaniFGG6qVxn8XFE6J/4YBaQv4GWFMMn/bmgowH 9K3x+Dh4D/kQbgGM53H0H9yURJ1c8o5I7JBvS9xthxydVNQ6z32Ap/SLqNy9sXQT7cAn2rdBDinm AAAAAAAA --Apple-Mail=_0277A2B7-E2FD-4ADB-AE1F-7205DFD351DA-- From anders.rundgren@telia.com Fri Oct 12 01:35:55 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D184221F851A for ; Fri, 12 Oct 2012 01:35:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O4cg9DQb+sso for ; Fri, 12 Oct 2012 01:35:55 -0700 (PDT) Received: from smtp-out21.han.skanova.net (smtp-out21.han.skanova.net [195.67.226.208]) by ietfa.amsl.com (Postfix) with ESMTP id D314821F850D for ; Fri, 12 Oct 2012 01:35:54 -0700 (PDT) Received: from [192.168.0.200] (213.66.133.125) by smtp-out21.han.skanova.net (8.5.133) (authenticated as u36408181) id 503A691C011DF17C; Fri, 12 Oct 2012 10:35:52 +0200 Message-ID: <5077D666.8090706@telia.com> Date: Fri, 12 Oct 2012 10:35:50 +0200 From: Anders Rundgren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: Henry Story References: <5077D12E.9010608@telia.com> <1273FF88-53D0-4A96-B53B-0079298615B2@bblfish.net> In-Reply-To: <1273FF88-53D0-4A96-B53B-0079298615B2@bblfish.net> X-Enigmail-Version: 1.4.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "'tls@ietf.org'" Subject: Re: [TLS] TLS CCA certificate filtering according to Google X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Oct 2012 08:35:55 -0000 On 2012-10-12 10:21, Henry Story wrote: > Btw. The WebID protocol we do have a case for certificate filtering, > which I explain in more detail here: > > http://lists.w3.org/Archives/Public/public-webid/2012Oct/0117.html > > Perhaps this can be used as a guide for this group to think about improvements. This is what I've been playing with in non-TLS CCA contexts: https://code.google.com/p/openkeystore/source/browse/trunk/library/src/org/webpki/crypto/CertificateFilter.java Anders > Otherwise I would like to know what people here make of the feasability of > having a WebID DN hack as suggested there? > > Henry > > On 12 Oct 2012, at 10:13, Anders Rundgren wrote: > >> http://code.google.com/p/android/issues/detail?id=38393 >> >> "I designed the API with the intent that filtering could be added later if necessary, >> but I've never been convinced that users really are going to have large numbers of keys. >> What I said about issuer filtering really is true. It almost always is configured wrong if at all. >> If you can motivate a use case, I'm all ears" >> >> The fact is that certificate filtering in TLS is in a big need for improvement, >> not only in Android but at the protocol level as well. >> >> The alternative (which is probably what will happen) is that TLS CCA remains >> a great solution for creating "secure tunnels between boxes". >> >> -- Anders >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls > > Social Web Architect > http://bblfish.net/ > From jsalowey@cisco.com Mon Oct 15 09:00:28 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9394B11E80F1 for ; Mon, 15 Oct 2012 09:00:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.488 X-Spam-Level: X-Spam-Status: No, score=-110.488 tagged_above=-999 required=5 tests=[AWL=0.111, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nEYiWhp0QZgc for ; Mon, 15 Oct 2012 09:00:27 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by ietfa.amsl.com (Postfix) with ESMTP id 960D61F0C84 for ; Mon, 15 Oct 2012 09:00:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=128; q=dns/txt; s=iport; t=1350316827; x=1351526427; h=from:to:subject:date:message-id:content-id: content-transfer-encoding:mime-version; bh=YxuZyN8IkRVTxWlrOVknFurr3MsllkNbvsQ0OE8M6qE=; b=mAQHexAynvSWr9t9MCWy98n+JCMz2hHcqFrRidp9H9+yIClKwfiN1N1D mJSc9yY++H3ZTS5xQtXkZjlF6UmRPNDeKcZJ6Cvxi52JfJ9gt7ii0MADq eyzwH0KD9E8zaIfnJOIHXxUgr31ZNeueR8OYripXHi5uXtLCv5yRlpDxY U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av0EACQyfFCtJXHA/2dsb2JhbABFv3eBCIIiAQQSASdRASoUQicEGxqHYpxngSifc5E2YAOkMYFrgm2CFw X-IronPort-AV: E=Sophos;i="4.80,588,1344211200"; d="scan'208";a="131732172" Received: from rcdn-core2-5.cisco.com ([173.37.113.192]) by rcdn-iport-5.cisco.com with ESMTP; 15 Oct 2012 16:00:27 +0000 Received: from xhc-rcd-x15.cisco.com (xhc-rcd-x15.cisco.com [173.37.183.89]) by rcdn-core2-5.cisco.com (8.14.5/8.14.5) with ESMTP id q9FG0RTV010961 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Mon, 15 Oct 2012 16:00:27 GMT Received: from xmb-rcd-x09.cisco.com ([169.254.9.68]) by xhc-rcd-x15.cisco.com ([173.37.183.89]) with mapi id 14.02.0318.001; Mon, 15 Oct 2012 11:00:26 -0500 From: "Joseph Salowey (jsalowey)" To: "tls@ietf.org" Thread-Topic: TLS meeting at IETF 85 Thread-Index: AQHNqu4wr4V7fWgeOEaM3qsUMEU3Ug== Date: Mon, 15 Oct 2012 16:00:26 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.33.249.92] x-tm-as-product-ver: SMEX-10.2.0.1135-7.000.1014-19274.004 x-tm-as-result: No--24.584400-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: text/plain; charset="us-ascii" Content-ID: <82121DBC8ED71C46BFBF043792D58FE6@cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [TLS] TLS meeting at IETF 85 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Oct 2012 16:00:28 -0000 TLS is scheduled to meet Tuesday, November 6, 1700-1830. Please let the ch= ains know if you have topics for the agenda. =20 From xuelei.fan@oracle.com Mon Oct 15 21:12:53 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6788221F86CE for ; Mon, 15 Oct 2012 21:12:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZqycknKaP2U7 for ; Mon, 15 Oct 2012 21:12:52 -0700 (PDT) Received: from rcsinet15.oracle.com (rcsinet15.oracle.com [148.87.113.117]) by ietfa.amsl.com (Postfix) with ESMTP id 8DD7321F86CB for ; Mon, 15 Oct 2012 21:12:52 -0700 (PDT) Received: from ucsinet21.oracle.com (ucsinet21.oracle.com [156.151.31.93]) by rcsinet15.oracle.com (Sentrion-MTA-4.2.2/Sentrion-MTA-4.2.2) with ESMTP id q9G4Cpmd010037 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 16 Oct 2012 04:12:52 GMT Received: from acsmt356.oracle.com (acsmt356.oracle.com [141.146.40.156]) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id q9G4Co0A025498 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 16 Oct 2012 04:12:51 GMT Received: from abhmt113.oracle.com (abhmt113.oracle.com [141.146.116.65]) by acsmt356.oracle.com (8.12.11.20060308/8.12.11) with ESMTP id q9G4CopW006007 for ; Mon, 15 Oct 2012 23:12:50 -0500 Received: from [10.191.0.50] (/10.191.0.50) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 15 Oct 2012 21:12:50 -0700 Message-ID: <507CDEBE.4030208@oracle.com> Date: Tue, 16 Oct 2012 12:12:46 +0800 From: Xuelei Fan User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20121010 Thunderbird/16.0.1 MIME-Version: 1.0 To: tls@ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Source-IP: ucsinet21.oracle.com [156.151.31.93] X-Mailman-Approved-At: Tue, 16 Oct 2012 08:33:21 -0700 Subject: [TLS] Name recognition for 1+ server name types in server name indication X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Oct 2012 04:12:53 -0000 Hi, RFC 6066 defines the extensibility of server name types. If there are more than one server name types, it is not very clear what's the expected behaviors of server side if it can recognize one name, but cannot tell the other one. For example, suppose there are two name types, HostName and FutureName. The server side support both of the name types. In the server name indication extension, HostName is set to "www.example.com", and FutureName is set to "In.The.Past". The server side can accept HostName "www.example.com", and FutureName "In.The.Future". HostName in SNI extension: "www.example.com" FutureName in SNI extension: "In.The.Past" Acceptable HostName in server: "www.example.com" Acceptable FutureName in server: "In.The.Future" That is to say, server is able to recognize the name of HostName; but cannot recognize the name of FutureName. The question is, what's the expected behaviors of server side? Accept the server name indication (include an extension of type "server_name" in the server hello), or denied the server name indication (send a fatal-level unrecognized_name(112) alert)? >From my understand, the proper behaviors maybe denied the server name indication. Otherwise, because the "server_name" in the server hello is empty, it is pretty confusing for client to determine which name is acceptable in server side. The client side may make bad decision if it regards that the FutureName("In.The.Past") is recognized by the server. What do you think? Thanks, Xuelei Fan From robert.cragie@gridmerge.com Wed Oct 17 15:30:39 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF6B621F8715 for ; Wed, 17 Oct 2012 15:30:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nD9s-wx3RAyS for ; Wed, 17 Oct 2012 15:30:39 -0700 (PDT) Received: from mail78.extendcp.co.uk (mail78.extendcp.co.uk [79.170.40.78]) by ietfa.amsl.com (Postfix) with ESMTP id 7F30521F84C4 for ; Wed, 17 Oct 2012 15:30:37 -0700 (PDT) Received: from client-82-26-88-203.pete-bam-1.adsl.virginmedia.com ([82.26.88.203] helo=[192.168.0.2]) by mail78.extendcp.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.77) id 1TOc8J-0005cI-Qf for tls@ietf.org; Wed, 17 Oct 2012 23:30:36 +0100 Message-ID: <507F31D5.1090408@gridmerge.com> Date: Wed, 17 Oct 2012 23:31:49 +0100 From: Robert Cragie Organization: Gridmerge Ltd. User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20121010 Thunderbird/16.0.1 MIME-Version: 1.0 To: tls@ietf.org References: <037043A7-AFA7-4D4F-B1FD-1D3C229CC6A0@cisco.com> In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms040808040204050308050105" X-Authenticated-As: robert.cragie@gridmerge.com Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-cached-info-13 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: robert.cragie@gridmerge.com List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Oct 2012 22:30:39 -0000 This is a cryptographically signed message in MIME format. --------------ms040808040204050308050105 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Apologies for the late response and also if this has been discussed=20 before and indeed if there is also a solution for this I am unaware of. I support the principle behind using cached information but the case=20 presented in draft-ietf-tls-cached-info-13 is limited and not wholly=20 representative of the exchange between "smart objects connected using a=20 low power 802.15.4 radio". For mutual authentication in M2M scenarios,=20 it could do with being more flexible with regarding to caching=20 information on certificate chains which may already be present in the=20 devices. For example, given a three chain certificate, the root CA=20 certificate will be in place (already covered in RFC 5246) but the=20 subordinate CA certificate may well also already be in place in both=20 devices wishing to authenticate. In this case, it is only necessary to=20 send the respective device certificate itself and it would be useful to=20 indicate whether this can be done. The potential savings are greater the = longer the chain, of course. The cached info principle could be used to=20 send fingerprints of the stored certificates (not the whole certificate=20 list) between client and server a priori so each side can determine what = actually needs to be sent in the certificate field itself. It may be possible to write this up in another supplemental draft which=20 uses a different CachedInformationType for this purpose. There may also=20 need to be an additional extension type to convey the information in=20 ClientHello. Robert On 09/10/2012 1:14 PM, Yngve N. Pettersen (Developer Opera Software ASA) = wrote: > > Sorry about the delay. > > In my opinion, as mentioned during a WG meeting, I think the range (8=20 > bit) of the CachedInformationType is too short. While the handshake=20 > type may be 8-bit, the TLS extension enum is 16 bit. My suggestion=20 > would be to increase the size of this field to 16 bit. > > I won't call this a blocker, but in the event that we pass 255=20 > information types, a new extension would have to be defined. > > One related note, perhaps for future consideration, if a client=20 > registers cache entries for many items, then the size of this=20 > extension on the wire could become significant. Should this be handled = > somehow, for example through a shorthand "I sent you a list of entries = > earlier, with this ID"? One point against this is that it would=20 > require the server to remember what the client have sent, and it might = > create curious error situations. Another is that the extension can max = > be 64K anyway, which limits both the number of items that can be=20 > stored and the bits-on-the-wire footprint. > > > > On Mon, 17 Sep 2012 06:10:08 +0200, Joseph Salowey (jsalowey)=20 > wrote: > >> This is an announcement of working group last call for=20 >> draft-ietf-tls-cached-info-13. Please send you comments to the TLS=20 >> list by October 8, 2012. >> >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls > > --------------ms040808040204050308050105 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILUDCC BRowggQCoAMCAQICEG0Z6qcZT2ozIuYiMnqqcd4wDQYJKoZIhvcNAQEFBQAwga4xCzAJBgNV BAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoT FVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMYaHR0cDovL3d3dy51c2VydHJ1c3Qu Y29tMTYwNAYDVQQDEy1VVE4tVVNFUkZpcnN0LUNsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQg RW1haWwwHhcNMTEwNDI4MDAwMDAwWhcNMjAwNTMwMTA0ODM4WjCBkzELMAkGA1UEBhMCR0Ix GzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE ChMRQ09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMTMENPTU9ETyBDbGllbnQgQXV0aGVudGlj YXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAJKEhFtLV5jUXi+LpOFAyKNTWF9mZfEyTvefMn1V0HhMVbdClOD5J3EHxcZppLkyxPFA GpDMJ1Zifxe1cWmu5SAb5MtjXmDKokH2auGj/7jfH0htZUOMKi4rYzh337EXrMLaggLW1DJq 1GdvIBOPXDX65VSAr9hxCh03CgJQU2yVHakQFLSZlVkSMf8JotJM3FLb3uJAAVtIaN3FSrTg 7SQfOq9xXwfjrL8UO7AlcWg99A/WF1hGFYE8aIuLgw9teiFX5jSw2zJ+40rhpVJyZCaRTqWS D//gsWD9Gm9oUZljjRqLpcxCm5t9ImPTqaD8zp6Q30QZ9FxbNboW86eb/8ECAwEAAaOCAUsw ggFHMB8GA1UdIwQYMBaAFImCZ33EnSZwAEu0UEh83j2uBG59MB0GA1UdDgQWBBR6E04AdFvG eGNkJ8Ev4qBbvHnFezAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADARBgNV HSAECjAIMAYGBFUdIAAwWAYDVR0fBFEwTzBNoEugSYZHaHR0cDovL2NybC51c2VydHJ1c3Qu Y29tL1VUTi1VU0VSRmlyc3QtQ2xpZW50QXV0aGVudGljYXRpb25hbmRFbWFpbC5jcmwwdAYI KwYBBQUHAQEEaDBmMD0GCCsGAQUFBzAChjFodHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vVVRO QWRkVHJ1c3RDbGllbnRfQ0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1 c3QuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQCF1r54V1VtM39EUv5C1QaoAQOAivsNsv1Kv/av QUn1G1rF0q0bc24+6SZ85kyYwTAo38v7QjyhJT4KddbQPTmGZtGhm7VNm2+vKGwdr+XqdFqo 2rHA8XV6L566k3nK/uKRHlZ0sviN0+BDchvtj/1gOSBH+4uvOmVIPJg9pSW/ve9g4EnlFsjr P0OD8ODuDcHTzTNfm9C9YGqzO/761Mk6PB/tm/+bSTO+Qik5g+4zaS6CnUVNqGnagBsePdIa XXxHmaWbCG0SmYbWXVcHG6cwvktJRLiQfsrReTjrtDP6oDpdJlieYVUYtCHVmdXgQ0BCML7q peeU0rD+83X5f27nMIIGLjCCBRagAwIBAgIQXDFQ28QtqMuYch5f2nTvZjANBgkqhkiG9w0B AQUFADCBkzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMTMENP TU9ETyBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTAeFw0xMTA5 MDIwMDAwMDBaFw0xNDA5MDEyMzU5NTlaMIIBNzELMAkGA1UEBhMCR0IxEDAOBgNVBBETB1dG NCA0V0ExFzAVBgNVBAgTDldlc3QgWW9ya3NoaXJlMRIwEAYDVQQHEwlXYWtlZmllbGQxFDAS BgNVBAkTC0dyYW5nZSBNb29yMR8wHQYDVQQJExY4OSBHcmVlbmZpZWxkIENyZXNjZW50MRcw FQYDVQQKEw5HcmlkbWVyZ2UgTHRkLjE0MDIGA1UECxMrSXNzdWVkIHRocm91Z2ggR3JpZG1l cmdlIEx0ZC4gRS1QS0kgTWFuYWdlcjEfMB0GA1UECxMWQ29ycG9yYXRlIFNlY3VyZSBFbWFp bDEWMBQGA1UEAxMNUm9iZXJ0IENyYWdpZTEqMCgGCSqGSIb3DQEJARYbcm9iZXJ0LmNyYWdp ZUBncmlkbWVyZ2UuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArcThqvLe WU1Q1ZJmnb+2UQSwOQKWok3A1Mwk582AdvwaAQyBFliPyJ0kXJqtwNBoZvk+3WJr0QA5ZRr+ J0x3sXVpcxadojP2HNzy1gsgDtIGG8ltoU4vmX1A8BTlOIUT+Pg8p/bSruxV0vz0CR8ho2hs R0Zi5vU+rQKNmbgufbkWhlQnMEYjknemscLQfw1YZz90ta67doNDujFy6+X6I06HpjudgMYx 8bdsNS5xVFFwuBA1eqNQra+xLzhCOeX9PPB/zK68qdNhrni3WPYG9EhSt4Dzk+xIz9hj7wrU ZIVXDTPsY8qbUSBVpwmzI5lCHPgzurH1OK7WwgpDSsl5pwIDAQABo4IB1TCCAdEwHwYDVR0j BBgwFoAUehNOAHRbxnhjZCfBL+KgW7x5xXswHQYDVR0OBBYEFBCOXNH+lDm8U9gy3b3bRvrx vKgrMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwME BggrBgEFBQcDAjBGBgNVHSAEPzA9MDsGDCsGAQQBsjEBAgEDBTArMCkGCCsGAQUFBwIBFh1o dHRwczovL3NlY3VyZS5jb21vZG8ubmV0L0NQUzBXBgNVHR8EUDBOMEygSqBIhkZodHRwOi8v Y3JsLmNvbW9kb2NhLmNvbS9DT01PRE9DbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3VyZUVt YWlsQ0EuY3JsMIGIBggrBgEFBQcBAQR8MHowUgYIKwYBBQUHMAKGRmh0dHA6Ly9jcnQuY29t b2RvY2EuY29tL0NPTU9ET0NsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5j cnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAmBgNVHREEHzAdgRty b2JlcnQuY3JhZ2llQGdyaWRtZXJnZS5jb20wDQYJKoZIhvcNAQEFBQADggEBAD6b/O0LkPav kR4Znoqxg0Ad7M3duDm4uzfrlX4ecgq56Ccdwd+3Tayz7Ewej30woVMmTKkA/NKRaCd0wVM9 8seF/oZjXKO7o1SH27igRnGSWjCoWXsdwJGfZbYnvcIIhhsxJoCPNbeSR7C0PAFDKsP3xrJy MHMljIJsoRbZu/fnYNyFWh9OXf7fYJOGmKDKAhSabUGfhY7umvU9d/YTqo02Q6YzC7d4zPNG 1a75AuHSEchf6GdKqycG38I5y9jlDaYfXspoS3PlTNCIeZONbOSMZgftnNEVKq+SWytFqyG/ 8+dwpm/a12KMex5J8iHwaUKj++2O2rAFNjDDqXpeEYoxggQZMIIEFQIBATCBqDCBkzELMAkG A1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9y ZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMTMENPTU9ETyBDbGllbnQg QXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIQXDFQ28QtqMuYch5f2nTvZjAJ BgUrDgMCGgUAoIICRTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xMjEwMTcyMjMxNDlaMCMGCSqGSIb3DQEJBDEWBBSbe+5AxqttYFOr/InPQbQAFgKYaDBs BgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcw DgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEo MIG5BgkrBgEEAYI3EAQxgaswgagwgZMxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVy IE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1p dGVkMTkwNwYDVQQDEzBDT01PRE8gQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUg RW1haWwgQ0ECEFwxUNvELajLmHIeX9p072YwgbsGCyqGSIb3DQEJEAILMYGroIGoMIGTMQsw CQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxm b3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDE5MDcGA1UEAxMwQ09NT0RPIENsaWVu dCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhBcMVDbxC2oy5hyHl/adO9m MA0GCSqGSIb3DQEBAQUABIIBAH8hlVM7c/7g+pLl6HnrsnOQ/CF4w3deE0Valw1acPvC1xpY iAOXksJNhisT6ZkHd2mq0JCEMKz56x9RkXulgxJabyNRky8bBqICM8kNg5pt1dY3o+dMRGHE sNH1cT3c4iqw3WrCo6jV19ku068SgKyMjJfOQ23Ce+xFyDkJ1gxvdd4r3A3mfcCBcWs5sBGI wp4IzzpkG5ufxMcAqjfFBc8r7M+piKGorHBXsWKIStFldHB+loyleWL7+tRu0ZH0TxQ/2Pnp KmHhuhxZxaQ0Swp7obfbpmTSuqC2HTjLjMrDuvdpOFUIT+co6D1cjYwVCX1NG9e6nST/BKHj JvX3ASoAAAAAAAA= --------------ms040808040204050308050105-- From internet-drafts@ietf.org Fri Oct 19 09:11:02 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6837221F8607; Fri, 19 Oct 2012 09:11:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.524 X-Spam-Level: X-Spam-Status: No, score=-102.524 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u-8KzjQkmENR; Fri, 19 Oct 2012 09:11:01 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3732921F8464; Fri, 19 Oct 2012 09:11:01 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.34 Message-ID: <20121019161101.16865.91379.idtracker@ietfa.amsl.com> Date: Fri, 19 Oct 2012 09:11:01 -0700 Cc: tls@ietf.org Subject: [TLS] I-D Action: draft-ietf-tls-multiple-cert-status-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2012 16:11:02 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Transport Layer Security Working Group of= the IETF. Title : The TLS Multiple Certificate Status Request Extension Author(s) : Yngve N. Pettersen Filename : draft-ietf-tls-multiple-cert-status-extension-02.txt Pages : 9 Date : 2012-10-19 Abstract: This document defines the Transport Layer Security (TLS) Certificate Status Version 2 Extension to allow clients to specify and support multiple certificate status methods. Also defined is a new method based on the Online Certificate Status Protocol (OCSP) that servers can use to provide status information not just about the server's own certificate, but also the status of intermediate certificates in the chain. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-multiple-cert-status-extens= ion There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-tls-multiple-cert-status-extension-02 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-tls-multiple-cert-status-exte= nsion-02 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From yngve@opera.com Fri Oct 19 09:17:39 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A38621F8743 for ; Fri, 19 Oct 2012 09:17:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hleHia3rQ48S for ; Fri, 19 Oct 2012 09:17:38 -0700 (PDT) Received: from smtp.opera.com (smtp.opera.com [213.236.208.81]) by ietfa.amsl.com (Postfix) with ESMTP id 4340F21F865F for ; Fri, 19 Oct 2012 09:17:38 -0700 (PDT) Received: from acorna.invalid.invalid (pat-tdc.opera.com [213.236.208.22]) (authenticated bits=0) by smtp.opera.com (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id q9JGHZUw021404 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 19 Oct 2012 16:17:36 GMT Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes To: tls@ietf.org References: <20121019161101.16865.91379.idtracker@ietfa.amsl.com> Date: Fri, 19 Oct 2012 18:17:49 +0200 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: "Yngve N. Pettersen (Developer Opera Software ASA)" Organization: Opera Software AS Message-ID: In-Reply-To: <20121019161101.16865.91379.idtracker@ietfa.amsl.com> User-Agent: Opera Mail/11.64 (Win32) Subject: Re: [TLS] I-D Action: draft-ietf-tls-multiple-cert-status-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2012 16:17:39 -0000 Hello all, For reference, the main change in the version is the removal of the SCVP request type. This part was removed because I did not see any great interest in keeping it. If there is later interest in adding SCVP support, a new specification can be published for doing so. Beside that change there were only a few minor fixes. On Fri, 19 Oct 2012 18:11:01 +0200, wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Transport Layer Security Working Group > of the IETF. > > Title : The TLS Multiple Certificate Status Request Extension > Author(s) : Yngve N. Pettersen > Filename : draft-ietf-tls-multiple-cert-status-extension-02.txt > Pages : 9 > Date : 2012-10-19 > > Abstract: > This document defines the Transport Layer Security (TLS) Certificate > Status Version 2 Extension to allow clients to specify and support > multiple certificate status methods. Also defined is a new method > based on the Online Certificate Status Protocol (OCSP) that servers > can use to provide status information not just about the server's own > certificate, but also the status of intermediate certificates in the > chain. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-tls-multiple-cert-status-extension > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-tls-multiple-cert-status-extension-02 > > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=draft-ietf-tls-multiple-cert-status-extension-02 > > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls -- Sincerely, Yngve N. Pettersen ******************************************************************** Senior Developer Email: yngve@opera.com Opera Software ASA http://www.opera.com/ Phone: +47 96 90 41 51 Fax: +47 23 69 24 01 ******************************************************************** From hallam@gmail.com Fri Oct 19 18:08:32 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4DB321F84BA; Fri, 19 Oct 2012 18:08:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.923 X-Spam-Level: X-Spam-Status: No, score=-3.923 tagged_above=-999 required=5 tests=[AWL=-0.325, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YBN6mimEwSP4; Fri, 19 Oct 2012 18:08:28 -0700 (PDT) Received: from mail-ob0-f172.google.com (mail-ob0-f172.google.com [209.85.214.172]) by ietfa.amsl.com (Postfix) with ESMTP id B823621F8464; Fri, 19 Oct 2012 18:08:28 -0700 (PDT) Received: by mail-ob0-f172.google.com with SMTP id v19so1174962obq.31 for ; Fri, 19 Oct 2012 18:08:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=U9A+VHln0SE9UP4Gk5unxDEe1GhVgZxjdICBZ6m9xRM=; b=uTN5k0KLizoRVuV9+xY8RqcRhakFi+t+z07zf8feDsvPe7EC2FgmKXoeVufMd9b26b NoUL+u3MdqryUkceqRk7/oRwpCPwE50l0vI2Be5mTc+zensnXaBMk5Sjn1xAtbSOplzP 9AkqYkdXdoYxLfKmcAeSlyAbz6u0FMHV3qbMIFyL65YQZHrIlyB40sKQMjHrMNWVn2Tu XdjxVTTIkdpnodzsOm7C0uW/GwtBmwyLSTLWhNZ9YW7PLTc40m1AOLiCP2bcNFE7u44a 3numL4nT75Pa0IO+qJN9A+T74jzxMjef5e05qXEQ70k9XBJ7u/pZbtCcuNJIw43FseQu otHQ== MIME-Version: 1.0 Received: by 10.182.145.35 with SMTP id sr3mr1845874obb.98.1350695308228; Fri, 19 Oct 2012 18:08:28 -0700 (PDT) Received: by 10.76.27.103 with HTTP; Fri, 19 Oct 2012 18:08:28 -0700 (PDT) Date: Fri, 19 Oct 2012 21:08:28 -0400 Message-ID: From: Phillip Hallam-Baker To: pkix@ietf.org, tls@ietf.org Content-Type: multipart/alternative; boundary=f46d044630780bf9b904cc734225 Subject: [TLS] TLS Security Policy Draft Update X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Oct 2012 01:08:32 -0000 --f46d044630780bf9b904cc734225 Content-Type: text/plain; charset=ISO-8859-1 http://www.ietf.org/id/draft-hallambaker-tlssecuritypolicy-02.txt I am not proposing this as a PKIX WG item as the plan is to close the group. It may be of interest to PKIX and TLS members however. This is a slight generalization of the 'MUST STAPLE' certificate and CSR extension. Specifically the specification permits two types of security policy to be specified in an X.509v3 cert. * Minimum TLS Version * 'Must Staple OCSP token' The design is slightly more general so that it can co-exist with TLS extensions that are similar to OCSP token stapling. For example Certificate Transparency info. The big advantage to using this is that it allows a client to check revocation status and to immediately fail if the OCSP token is not provided as it should be. At present most clients will only fail if they see an invalid OCSP token, if the token is not returned, they consider it valid. To do otherwise opens the client to a DoS attack bu DDoS-ing the OCSP servers. Note that the TLS protocol handshake provides protection against most forms of downgrade attack and most importantly cipher suite downgrade (for later versions at least). So it is not necessary to wire them into the cert. In fact the only statements that should be wired into the cert are statements that the server knows that it can ensure compliance with. -- Website: http://hallambaker.com/ --f46d044630780bf9b904cc734225 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

I am not proposing this as a PKIX WG item as the pla= n is to close the group. It may be of interest to PKIX and TLS members howe= ver.

This is a slight generalization of the 'MUST STAPLE'= certificate and CSR extension. Specifically the specification permits two = types of security policy to be specified in an X.509v3 cert.

* Minimum TLS Version
* 'Must Staple OCSP toke= n'

The design is slightly more general so that= it can co-exist with TLS extensions that are similar to OCSP token staplin= g. For example Certificate Transparency info.


The big advantage to using this is that = it allows a client to check revocation status and to immediately fail if th= e OCSP token is not provided as it should be. At present most clients will = only fail if they see an invalid OCSP token, if the token is not returned, = they consider it valid. To do otherwise opens the client to a DoS attack bu= DDoS-ing the OCSP servers.

Note that the TLS protocol handshake provides protectio= n against most forms of downgrade attack and most importantly cipher suite = downgrade (for later versions at least). So it is not necessary to wire the= m into the cert. In fact the only statements that should be wired into the = cert are statements that the server knows that it can ensure compliance wit= h.=A0

 --f46d044630780bf9b904cc734225-- From internet-drafts@ietf.org Mon Oct 22 09:39:56 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B165E21F8443; Mon, 22 Oct 2012 09:39:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.537 X-Spam-Level: X-Spam-Status: No, score=-102.537 tagged_above=-999 required=5 tests=[AWL=0.062, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2voa1uZhXvmB; Mon, 22 Oct 2012 09:39:56 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 309B211E808D; Mon, 22 Oct 2012 09:39:56 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.34 Message-ID: <20121022163956.13811.87813.idtracker@ietfa.amsl.com> Date: Mon, 22 Oct 2012 09:39:56 -0700 Cc: tls@ietf.org Subject: [TLS] I-D Action: draft-ietf-tls-oob-pubkey-05.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Oct 2012 16:39:56 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Transport Layer Security Working Group of= the IETF. Title : Out-of-Band Public Key Validation for Transport Layer Se= curity (TLS) Author(s) : Paul Wouters Hannes Tschofenig John Gilmore Samuel Weiler Tero Kivinen Filename : draft-ietf-tls-oob-pubkey-05.txt Pages : 14 Date : 2012-10-22 Abstract: This document specifies a new certificate type for exchanging raw public keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) for use with out-of-band public key validation. Currently, TLS authentication can only occur via X.509-based Public Key Infrastructure (PKI) or OpenPGP certificates. By specifying a minimum resource for raw public key exchange, implementations can use alternative public key validation methods. One such alternative public key valiation method is offered by the DNS-Based Authentication of Named Entities (DANE) together with DNS Security. Another alternative is to utilize pre-configured keys, as is the case with sensors and other embedded devices. The usage of raw public keys, instead of X.509-based certificates, leads to a smaller code footprint. This document introduces the support for raw public keys in TLS. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-oob-pubkey There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-tls-oob-pubkey-05 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-tls-oob-pubkey-05 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From internet-drafts@ietf.org Mon Oct 22 10:11:10 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2247D11E80E4; Mon, 22 Oct 2012 10:11:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.535 X-Spam-Level: X-Spam-Status: No, score=-102.535 tagged_above=-999 required=5 tests=[AWL=0.064, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l3o-Py3sMa+n; Mon, 22 Oct 2012 10:11:02 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E4DB11E80C5; Mon, 22 Oct 2012 10:11:01 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.34 Message-ID: <20121022171101.13822.64893.idtracker@ietfa.amsl.com> Date: Mon, 22 Oct 2012 10:11:01 -0700 Cc: tls@ietf.org Subject: [TLS] I-D Action: draft-ietf-tls-oob-pubkey-06.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Oct 2012 17:11:11 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Transport Layer Security Working Group of= the IETF. Title : Out-of-Band Public Key Validation for Transport Layer Se= curity (TLS) Author(s) : Paul Wouters Hannes Tschofenig John Gilmore Samuel Weiler Tero Kivinen Filename : draft-ietf-tls-oob-pubkey-06.txt Pages : 14 Date : 2012-10-22 Abstract: This document specifies a new certificate type for exchanging raw public keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) for use with out-of-band public key validation. Currently, TLS authentication can only occur via X.509-based Public Key Infrastructure (PKI) or OpenPGP certificates. By specifying a minimum resource for raw public key exchange, implementations can use alternative public key validation methods. One such alternative public key valiation method is offered by the DNS-Based Authentication of Named Entities (DANE) together with DNS Security. Another alternative is to utilize pre-configured keys, as is the case with sensors and other embedded devices. The usage of raw public keys, instead of X.509-based certificates, leads to a smaller code footprint. This document introduces the support for raw public keys in TLS. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-oob-pubkey There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-tls-oob-pubkey-06 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-tls-oob-pubkey-06 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From jsalowey@cisco.com Tue Oct 23 11:45:44 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 629501F042A for ; Tue, 23 Oct 2012 11:45:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.498 X-Spam-Level: X-Spam-Status: No, score=-110.498 tagged_above=-999 required=5 tests=[AWL=0.101, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4M1tg9gNLptV for ; Tue, 23 Oct 2012 11:45:43 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by ietfa.amsl.com (Postfix) with ESMTP id 23BA61F0C9A for ; Tue, 23 Oct 2012 11:45:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=698; q=dns/txt; s=iport; t=1351017943; x=1352227543; h=from:to:subject:date:message-id:content-id: content-transfer-encoding:mime-version; bh=3G/eP3QmoKR69xMIxwrUJyE/wnyzkK89Janqod1FpT4=; b=lpo2Z37xdz1LjL/HQ+kbgpwpb271sXhKJtl2AODHj9P0wzUQCKyeijFC CbP4Lj1REWRG9tgFaC/j3G5ODMjVCC0BgQ/1YpCAT42YQ/aO6fDoS72fS VOQrlIWTzi+wtUoPnB5C3nh24rmaS9rh5iQouq7SixRO2tD+45/has5jm g=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AqsGAA3lhlCtJXHA/2dsb2JhbABEhU20FASIGIEIgiABBBIBJ1EBKhRCJwQbGodiC5pWgSuPXJAwi2CFfmADlwmNN4Frgm+BXCQY X-IronPort-AV: E=Sophos;i="4.80,637,1344211200"; d="scan'208";a="134563267" Received: from rcdn-core2-5.cisco.com ([173.37.113.192]) by rcdn-iport-2.cisco.com with ESMTP; 23 Oct 2012 18:45:35 +0000 Received: from xhc-rcd-x02.cisco.com (xhc-rcd-x02.cisco.com [173.37.183.76]) by rcdn-core2-5.cisco.com (8.14.5/8.14.5) with ESMTP id q9NIjZc3010936 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Tue, 23 Oct 2012 18:45:35 GMT Received: from xmb-rcd-x09.cisco.com ([169.254.9.68]) by xhc-rcd-x02.cisco.com ([173.37.183.76]) with mapi id 14.02.0318.001; Tue, 23 Oct 2012 13:45:34 -0500 From: "Joseph Salowey (jsalowey)" To: "tls@ietf.org" Thread-Topic: Proposed IETF-85 agenda Thread-Index: AQHNsU6V0j/hDMX9TE2N0DbqmbblIw== Date: Tue, 23 Oct 2012 18:45:33 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.154.12.107] x-tm-as-product-ver: SMEX-10.2.0.1135-7.000.1014-19298.000 x-tm-as-result: No--22.783800-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: text/plain; charset="us-ascii" Content-ID: <6EB4B33BEE40A64AA4E96B6C76948F67@cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [TLS] Proposed IETF-85 agenda X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Oct 2012 18:45:45 -0000 IETF-85 TLS Meeting TUESDAY, November 6, 2012 - 1700-1830 ---------------------------------- 1. Note Well, Agenda, Note Takers, Blue sheets (5 Min) 2. Cached Info (15 Min) - Tschofenig http://tools.ietf.org/html/draft-ietf-tls-cached-info-13 3. Certificate Status Extension (15 Min) - Pettersen/Chairs http://tools.ietf.org/html/draft-ietf-tls-multiple-cert-status-extension-02 4. Out-of-band public key validation (15 Min) - Wouters http://tools.ietf.org/html/draft-ietf-tls-oob-pubkey-06 5. DTLS Multicast Security (15 Min) - Sye Loong http://tools.ietf.org/html/draft-keoh-tls-multicast-security-00 6. TLS Tack (15 Min) - Perrin http://tools.ietf.org/html/draft-perrin-tls-tack-01 From turners@ieca.com Wed Oct 24 09:14:39 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7811D21F8C7A for ; Wed, 24 Oct 2012 09:14:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.246 X-Spam-Level: X-Spam-Status: No, score=-102.246 tagged_above=-999 required=5 tests=[AWL=0.019, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z1VBxDJQ2tkx for ; Wed, 24 Oct 2012 09:14:37 -0700 (PDT) Received: from gateway02.websitewelcome.com (gateway02.websitewelcome.com [69.41.248.20]) by ietfa.amsl.com (Postfix) with ESMTP id 84CA221F8C74 for ; Wed, 24 Oct 2012 09:14:37 -0700 (PDT) Received: by gateway02.websitewelcome.com (Postfix, from userid 5007) id BA33B505B79F9; Wed, 24 Oct 2012 11:14:36 -0500 (CDT) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway02.websitewelcome.com (Postfix) with ESMTP id AFA6F505B79D9 for ; Wed, 24 Oct 2012 11:14:36 -0500 (CDT) Received: from [96.241.97.104] (port=51209 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1TR3bI-0001tR-3d; Wed, 24 Oct 2012 11:14:36 -0500 Message-ID: <508813EB.3020203@ieca.com> Date: Wed, 24 Oct 2012 12:14:35 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:16.0) Gecko/20121010 Thunderbird/16.0.1 MIME-Version: 1.0 To: tls@ietf.org References: In-Reply-To: X-Forwarded-Message-Id: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [96.241.97.104]:51209 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 3 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Subject: [TLS] Fwd: [saag] Considerations for Protocols with Compression over TLS X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Oct 2012 16:14:46 -0000 I case you're not subscribed to saag. spt -------- Original Message -------- Subject: [saag] Considerations for Protocols with Compression over TLS Date: Tue, 23 Oct 2012 23:29:13 +0900 From: KIHARA, Boku To: apps-discuss@ietf.org, saag@ietf.org Hello, I'm writing a draft on cosiderations for protocols with compression over TLS, since I was shocked by the CRIME attack. http://tools.ietf.org/html/draft-kihara-compression-considered-harmful-01 What I want to say are: * the CRIME attack may be applied if compression is applied in any form * disabling TLS Compression and SPDY header compression is not a perfect solution; the threat has not gone! * there should be some mitigations to take when using compression in TLS Because I am neither a cryptographer nor a security expert there must many mistakes in the draft in addition to language faults, but I think it is good that we have some guides for comression in TLS. Is IETF the write place to do such things? Regards, Boku Kihara. _______________________________________________ saag mailing list saag@ietf.org https://www.ietf.org/mailman/listinfo/saag From trevp@trevp.net Thu Oct 25 10:20:11 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEF5521F899E for ; Thu, 25 Oct 2012 10:20:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.977 X-Spam-Level: X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P2YzgQsHGScs for ; Thu, 25 Oct 2012 10:20:11 -0700 (PDT) Received: from mail-vc0-f172.google.com (mail-vc0-f172.google.com [209.85.220.172]) by ietfa.amsl.com (Postfix) with ESMTP id 2ED6921F8958 for ; Thu, 25 Oct 2012 10:20:11 -0700 (PDT) Received: by mail-vc0-f172.google.com with SMTP id fl11so2275700vcb.31 for ; Thu, 25 Oct 2012 10:20:07 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-originating-ip:date:message-id:subject:from:to :content-type:x-gm-message-state; bh=rGjUWfPsjVSPMlVPjl8ld0ErLzTU+zz5gLiGY9/3T1M=; b=kUAaYWUb61C7Fe9Lh2r3HGqhN5t87Rn7NJ2N2WnfyfY+UpdDpEg30vBVxPw71aq/0N Xs0qLDghBYmLxxLk2OvCG1E3GmKVqZ38Fu4LkuuMdSBIZ8u2Y55l2R9hPl5OmVMWL0RT IR61dcNi2LtEegQ4E3ujqYsItQx0mCKMNOBFz0v8912GGzr7axX/dCHtJA9jjudNwATl bKIy+LuMAzqBMGwe3FTacwSgHpmUn1aQ80Onhbwz9tvE6MSi//JBwSnGZ5NMFGrjrC0q eYXG45tLr3lNCwhzsE5VIUWJftKd8WM6Uqpo5sFX01yf05Z9QW8KBvvOza6XcB1fsSki YNPg== MIME-Version: 1.0 Received: by 10.52.34.42 with SMTP id w10mr27743978vdi.10.1351185606958; Thu, 25 Oct 2012 10:20:06 -0700 (PDT) Received: by 10.52.110.170 with HTTP; Thu, 25 Oct 2012 10:20:06 -0700 (PDT) X-Originating-IP: [198.228.209.60] Date: Thu, 25 Oct 2012 10:20:06 -0700 Message-ID: From: Trevor Perrin To: tls@ietf.org Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQn0iPy7ZbR/gvp703Z1ZW+8EcYq+A0XV2UrzYZzqz5ohnC9BwABr7ljTuhGPmV+vULaFa1q Subject: [TLS] TACK talk X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Oct 2012 17:20:12 -0000 Hi, We've got a slot to discuss TACK in Atlanta. Is there anything in particular people want to hear about? (confusing points in draft? any envisioned problems? design changes?) The time is pretty limited, so any suggestions that help focus the talk would be great. Thanks! Trevor http://tools.ietf.org/html/draft-perrin-tls-tack-01 From bkihara.l@gmail.com Fri Oct 26 06:02:01 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 19B8121F85F0 for ; Fri, 26 Oct 2012 06:02:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.213 X-Spam-Level: X-Spam-Status: No, score=-3.213 tagged_above=-999 required=5 tests=[AWL=0.387, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AV0KPKEAzMrZ for ; Fri, 26 Oct 2012 06:02:00 -0700 (PDT) Received: from mail-qa0-f51.google.com (mail-qa0-f51.google.com [209.85.216.51]) by ietfa.amsl.com (Postfix) with ESMTP id 61FD321F85B4 for ; Fri, 26 Oct 2012 06:02:00 -0700 (PDT) Received: by mail-qa0-f51.google.com with SMTP id j40so235141qab.10 for ; Fri, 26 Oct 2012 06:02:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=h5uAUJjYfsvHH1LMI6tH87tz62meZjq2KLMdcsypjyA=; b=ILfzneQFKbpfUcDtlbxEUqmbJoOEyI4P2HICsr7fWWTrMRjqMDFWdxeRKXox+ZSseK 2JDvrHRlE4WPOAJCZ5dLnZO8BASjbDeyCkIzetMfbocQyI6JPltyT4qTiKIaSsa/w2VP XZf/BVYYNppufnGQjFdRfEH+GK2W7R4v4+3ZtTUZxnmDnLYsoANZDDtM/jAC8tkBFsd/ ZtKoY8swdqAvAbP9XvOpeOoHVbJnBdGca8b2Y4MMGTODk4juHMLuKMGRnCPGRsFu6rNh iS8B2AruvMNsCI3+JwxzAzSCRMrWTHDAYKOoRXWVsGFUYPw6e7ZuhJm+jIr+gnBSgpDp EaBQ== MIME-Version: 1.0 Received: by 10.49.104.194 with SMTP id gg2mr13729246qeb.6.1351256519948; Fri, 26 Oct 2012 06:01:59 -0700 (PDT) Received: by 10.49.87.163 with HTTP; Fri, 26 Oct 2012 06:01:58 -0700 (PDT) Date: Fri, 26 Oct 2012 22:01:58 +0900 Message-ID: From: "KIHARA, Boku" To: tls@ietf.org Content-Type: text/plain; charset=ISO-8859-1 Subject: [TLS] Not only TLS compression: where to discuss on CRIME mitigation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Oct 2012 13:02:01 -0000 Hello, I'm writing a draft on CRIME mitigation that might be a guide for protocol design, implementation, and deployment. The CRIME attack, I think, is not the fault of TLS compression, but the fault of the application layer that interlaces sensitive data and attacker-origin data, because the CRIME attack can applied to compression other than TLS compression, like HTTP gzip. My question is which mailing list is appropriate to discuss on CRIME mitigation. I'm thinking that the outcome might be something like security considerations of TLS. Anything else? Regards, Boku Kihara. From jsalowey@cisco.com Fri Oct 26 15:09:33 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDB4B21F84AD for ; Fri, 26 Oct 2012 15:09:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.507 X-Spam-Level: X-Spam-Status: No, score=-110.507 tagged_above=-999 required=5 tests=[AWL=0.092, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UWqn0ycCf2tn for ; Fri, 26 Oct 2012 15:09:32 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by ietfa.amsl.com (Postfix) with ESMTP id 8A4B421F8447 for ; Fri, 26 Oct 2012 15:09:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1019; q=dns/txt; s=iport; t=1351289372; x=1352498972; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=a/n1kZRQBcsLp9sKH+f5G484ApsjLh1q+VpF8Lj1T7E=; b=d26f/glg15BAxIK1qU+rbRKoFPGRxc85nCVTBg3QYZYvnGAYG9KAsTwS XU9njHaNceQhGI7FSftV3eld5/3PVd2lCDY+eTWZFjHfvqIAvQ4gGPkuL qUuqkWYYuZs0twjI9SuDZwVjql06umidWJsEgfbhLk9ncNAk5g/23eW62 4=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av8EAEcJi1CtJV2a/2dsb2JhbABEwlaBCIIeAQEBAwEBAQEPASc0CwULAgEIIhQQJwslAgQOBQgah14GC5wyoAcEi3GGDWEDpEaBa4Jvghk X-IronPort-AV: E=Sophos;i="4.80,657,1344211200"; d="scan'208";a="135900268" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-3.cisco.com with ESMTP; 26 Oct 2012 22:09:32 +0000 Received: from xhc-rcd-x13.cisco.com (xhc-rcd-x13.cisco.com [173.37.183.87]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id q9QM9WdG018009 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Fri, 26 Oct 2012 22:09:32 GMT Received: from xmb-rcd-x09.cisco.com ([169.254.9.68]) by xhc-rcd-x13.cisco.com ([173.37.183.87]) with mapi id 14.02.0318.001; Fri, 26 Oct 2012 17:09:31 -0500 From: "Joseph Salowey (jsalowey)" To: "KIHARA, Boku" Thread-Topic: [TLS] Not only TLS compression: where to discuss on CRIME mitigation Thread-Index: AQHNs3oaKvNQ6hkYpEGlhyXkAnPsb5fMegKA Date: Fri, 26 Oct 2012 22:09:31 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.33.249.93] x-tm-as-product-ver: SMEX-10.2.0.1135-7.000.1014-19310.001 x-tm-as-result: No--40.392600-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: text/plain; charset="us-ascii" Content-ID: <5A43581AD7C15B4781D3AB6195592D1B@cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "" Subject: Re: [TLS] Not only TLS compression: where to discuss on CRIME mitigation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Oct 2012 22:09:34 -0000 It seems that the general applies more broadly than TLS and would be of gen= eral interest to SAAG (and possibly APPS area). Countermeasures specific= to TLS should be discussed on the TLS list.=20 On Oct 26, 2012, at 6:01 AM, KIHARA, Boku wrote: > Hello, >=20 > I'm writing a draft on CRIME mitigation that might be a guide for > protocol design, implementation, and deployment. > The CRIME attack, I think, is not the fault of TLS compression, > but the fault of the application layer that interlaces sensitive data > and attacker-origin data, because the CRIME attack can applied to > compression other than TLS compression, like HTTP gzip. > My question is which mailing list is appropriate to discuss on CRIME > mitigation. I'm thinking that the outcome might be something like > security considerations of TLS. Anything else? >=20 > Regards, > Boku Kihara. > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From bkihara.l@gmail.com Fri Oct 26 20:09:00 2012 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4BE721F86AF for ; Fri, 26 Oct 2012 20:09:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.251 X-Spam-Level: X-Spam-Status: No, score=-3.251 tagged_above=-999 required=5 tests=[AWL=0.348, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VvW149mrkQ7K for ; Fri, 26 Oct 2012 20:09:00 -0700 (PDT) Received: from mail-vc0-f172.google.com (mail-vc0-f172.google.com [209.85.220.172]) by ietfa.amsl.com (Postfix) with ESMTP id 3F38121F86B2 for ; Fri, 26 Oct 2012 20:09:00 -0700 (PDT) Received: by mail-vc0-f172.google.com with SMTP id fl11so3934444vcb.31 for ; Fri, 26 Oct 2012 20:08:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=CRj77u024G+d4xJ4jpCUUnO7h6VvmF4aRrIZow7zXMI=; b=cvI0Wtqq+AqdZF0LqSKs4mu08Y9h1ZLKjNOkBmfcGBd9ZzbteYm6kG+q/7Uzw9vcii WYfCDQpGEBg8a99XRqtsJlJ2cAVoY5pa8tUchuZV42jNwMfXoxHVGClWZR9PAZWIVm3k ajCA131IcE1jCfx+b0GpB9ymhEecUKKr+wVl9bxfBSlWefuD+hgX7+RdZX7/kDzDZA0j lDTUihMbAdsHJCYAd/t6VGnBmT+Ypimzn1L/Lz1gJ6DA2WT2+c5HOLiALuDXldUagOzu IsLb/D0bB3JIljJ2PegyM1znP1sqm5qcUoVasHsCUsdQ4tds6CIP2He9yj7Q3MIVNQ9N it4g== MIME-Version: 1.0 Received: by 10.220.8.73 with SMTP id g9mr21812536vcg.28.1351307339682; Fri, 26 Oct 2012 20:08:59 -0700 (PDT) Received: by 10.58.221.33 with HTTP; Fri, 26 Oct 2012 20:08:59 -0700 (PDT) In-Reply-To: References: Date: Sat, 27 Oct 2012 12:08:59 +0900 Message-ID: From: "KIHARA, Boku" To: "Joseph Salowey (jsalowey)" Content-Type: text/plain; charset=ISO-8859-1 Cc: tls@ietf.org Subject: Re: [TLS] Not only TLS compression: where to discuss on CRIME mitigation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Oct 2012 03:09:01 -0000 > Are you attending the meting in Atlanta? Yes. Boku Kihara. 2012/10/27 Joseph Salowey (jsalowey) : > Are you attending the meting in Atlanta? > > Joe > On Oct 26, 2012, at 6:01 AM, KIHARA, Boku wrote: > >> Hello, >> >> I'm writing a draft on CRIME mitigation that might be a guide for >> protocol design, implementation, and deployment. >> The CRIME attack, I think, is not the fault of TLS compression, >> but the fault of the application layer that interlaces sensitive data >> and attacker-origin data, because the CRIME attack can applied to >> compression other than TLS compression, like HTTP gzip. >> My question is which mailing list is appropriate to discuss on CRIME >> mitigation. I'm thinking that the outcome might be something like >> security considerations of TLS. Anything else? >> >> Regards, >> Boku Kihara. >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >